driftwood-cli 0.1.0__tar.gz

driftwood_cli-0.1.0/.gitignore

@@ -0,0 +1,57 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# Virtual environments
+.venv/
+venv/
+env/
+ENV/
+
+# Environment variables / secrets
+.logfire/
+
+# PicoClaw agent (binary + runtime state/secrets stay local)
+agent/bin/
+agent/runtimes/
+
+# Distribution / packaging
+build/
+dist/
+*.egg-info/
+.eggs/
+
+# Test / coverage
+.pytest_cache/
+.coverage
+htmlcov/
+.tox/
+
+# Type checkers / linters
+.mypy_cache/
+.ruff_cache/
+
+# Note: uv.lock IS committed (it pins exact dependency versions).
+
+# IDE / editor
+.vscode/
+.idea/
+*.swp
+
+# OS
+.DS_Store
+agent/runtime/
+
+.projects/cache
+.projects/vault
+.projects/state.test.json
+.projects/state.local.test.json
+.env
+.env.*
+!.env.example
+
+# Local MCP preview inputs, reports, and operator scratch scripts.
+.scratch/
+# Trusted build input, reproduced from html_demo/renderer.lock.json.
+/code_job/html_demo/renderer/

driftwood_cli-0.1.0/PKG-INFO

@@ -0,0 +1,36 @@
+Metadata-Version: 2.5
+Name: driftwood-cli
+Version: 0.1.0
+Summary: Company-scoped Driftwood onboarding and dashboard CLI
+Requires-Python: >=3.12
+Requires-Dist: httpx<1,>=0.28.1
+Requires-Dist: keyring<26,>=25
+Description-Content-Type: text/markdown
+
+# Driftwood CLI
+
+Company-scoped onboarding and dashboard operations from your terminal.
+Requires Python 3.12 or newer and a native credential store (macOS Keychain,
+Windows Credential Locker, or Linux Secret Service).
+
+## Get started
+
+Install it with uv:
+
+```sh
+uv tool install driftwood-cli
+driftwood login
+driftwood onboard resume
+driftwood doctor
+```
+
+Login opens your browser for Google sign-in and workspace authorization.
+Provider connections also require browser consent. Workspace approval and your
+current role govern access; completing setup does not start outreach.
+
+Run `driftwood --help` for commands covering company context, accounts, team,
+assets, schedules, MCP connections and operation receipts. Use `--plan` to
+preview changes, or `--json` for machine-readable output. Global options go
+before the command. Credentials stay in the operating system's secret store.
+
+The CLI talks to https://driftwood.sh. It does not expose or edit Drift scripts.

driftwood_cli-0.1.0/README.md

@@ -0,0 +1,27 @@
+# Driftwood CLI
+
+Company-scoped onboarding and dashboard operations from your terminal.
+Requires Python 3.12 or newer and a native credential store (macOS Keychain,
+Windows Credential Locker, or Linux Secret Service).
+
+## Get started
+
+Install it with uv:
+
+```sh
+uv tool install driftwood-cli
+driftwood login
+driftwood onboard resume
+driftwood doctor
+```
+
+Login opens your browser for Google sign-in and workspace authorization.
+Provider connections also require browser consent. Workspace approval and your
+current role govern access; completing setup does not start outreach.
+
+Run `driftwood --help` for commands covering company context, accounts, team,
+assets, schedules, MCP connections and operation receipts. Use `--plan` to
+preview changes, or `--json` for machine-readable output. Global options go
+before the command. Credentials stay in the operating system's secret store.
+
+The CLI talks to https://driftwood.sh. It does not expose or edit Drift scripts.

driftwood_cli-0.1.0/pyproject.toml

@@ -0,0 +1,17 @@
+[project]
+name = "driftwood-cli"
+version = "0.1.0"
+description = "Company-scoped Driftwood onboarding and dashboard CLI"
+readme = "README.md"
+requires-python = ">=3.12"
+dependencies = ["httpx>=0.28.1,<1", "keyring>=25,<26"]
+
+[project.scripts]
+driftwood = "driftwood_cli.main:main"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/driftwood_cli"]

driftwood_cli-0.1.0/src/driftwood_cli/__init__.py

@@ -0,0 +1 @@
+"""The customer Driftwood CLI."""

driftwood_cli-0.1.0/src/driftwood_cli/__main__.py

@@ -0,0 +1,3 @@
+from driftwood_cli.main import main
+
+raise SystemExit(main())

driftwood_cli-0.1.0/src/driftwood_cli/client.py

@@ -0,0 +1,85 @@
+"""Explicit typed command calls use the existing dashboard HTTP contracts."""
+
+import uuid
+from urllib.parse import urlsplit
+
+import httpx
+
+
+class CLIError(Exception):
+    def __init__(self, message, code=1):
+        super().__init__(message)
+        self.code = code
+
+
+def server_url(value):
+    parts = urlsplit(value)
+    local = parts.hostname in {"localhost", "127.0.0.1", "::1"}
+    if (
+        (parts.scheme != "https" and not (parts.scheme == "http" and local))
+        or not parts.netloc
+        or parts.username
+        or parts.password
+        or parts.query
+        or parts.fragment
+        or parts.path not in ("", "/")
+    ):
+        raise CLIError(
+            "Server must be an HTTPS origin (HTTP allowed only on loopback)", 2
+        )
+    return value.rstrip("/")
+
+
+class Client:
+    def __init__(self, server, store, *, transport=None, request_id=None):
+        self.server = server_url(server)
+        self.store = store
+        self.request_id = request_id
+        self.http = httpx.Client(
+            base_url=self.server,
+            timeout=30,
+            follow_redirects=False,
+            transport=transport,
+        )
+
+    def call(self, method, path, *, anonymous=False, **kwargs):
+        headers = {}
+        if not anonymous:
+            credential = self.store.get()
+            if not credential:
+                raise CLIError("Run driftwood login first", 3)
+            headers["Authorization"] = "Bearer " + credential["token"]
+        operation_id = None
+        if not anonymous and method not in {"GET", "HEAD", "OPTIONS"}:
+            operation_id = self.request_id or str(uuid.uuid4())
+            self.store.set(
+                {"id": operation_id, "method": method, "path": path}, "last_operation"
+            )
+            headers["X-Driftwood-Operation-ID"] = operation_id
+        recovery = f" Inspect operations get {operation_id}." if operation_id else ""
+        try:
+            result = self.http.request(method, path, headers=headers, **kwargs)
+        except httpx.HTTPError:
+            raise CLIError(
+                "Connection failed. Check status before retrying a write; "
+                "the server may already have accepted it." + recovery,
+                5,
+            ) from None
+        if not 200 <= result.status_code < 300:
+            # Do not echo HTML, request bodies, provider URLs or credentials.
+            try:
+                error = result.json().get("error", {})
+                message = error.get("detail", "Request failed")
+                if not isinstance(message, str):
+                    message = "Request validation failed; check your input"
+            except (ValueError, AttributeError):
+                message = "Request failed"
+            code = {401: 3, 403: 4, 409: 6, 410: 3, 422: 2}.get(result.status_code, 1)
+            raise CLIError(f"{result.status_code}: {message}" + recovery, code)
+        value = result.json() if result.content else {"ok": True}
+        if operation_id and isinstance(value, dict):
+            value["operation_id"] = operation_id
+        return value
+
+    def close(self):
+        self.http.close()

driftwood_cli-0.1.0/src/driftwood_cli/main.py

@@ -0,0 +1,562 @@
+"""Customer CLI: guided setup plus individually repeatable named operations."""
+
+import argparse
+import base64
+import hashlib
+import json
+import secrets
+import sys
+import time
+import uuid
+import webbrowser
+from pathlib import Path
+from urllib.parse import urlsplit
+
+from driftwood_cli.client import Client, CLIError, server_url
+from driftwood_cli.store import Store
+
+API = "/api/v1"
+DASH = API + "/dashboard"
+SETUP = API + "/cli/onboarding"
+
+
+def emit(value):
+    print(json.dumps(value, indent=2, ensure_ascii=False))
+
+
+def confirm(args, message):
+    print(message, file=sys.stderr)
+    if args.plan:
+        return False
+    if args.yes:
+        return True
+    if args.json or not sys.stdin.isatty():
+        raise CLIError("This write requires --yes; use --plan to preview", 2)
+    if input("Continue? [y/N] ").strip().lower() != "y":
+        raise CLIError("Cancelled", 2)
+    return True
+
+
+def document(path):
+    try:
+        value = json.loads(Path(path).read_text())
+    except (OSError, ValueError):
+        raise CLIError("Input must be a readable JSON file", 2) from None
+    if not isinstance(value, dict):
+        raise CLIError("Input must be a JSON object", 2)
+    return value
+
+
+def checked_id(value):
+    try:
+        return str(uuid.UUID(value))
+    except ValueError:
+        raise CLIError("Expected a valid ID", 2) from None
+
+
+def open_link(url, no_browser=False):
+    if urlsplit(url).scheme not in {"https", "http"}:
+        raise CLIError("Server returned an invalid browser URL", 1)
+    print("Open in your browser: " + url, file=sys.stderr)
+    if not no_browser:
+        webbrowser.open(url)
+
+
+def login(args, client):
+    if args.plan:
+        return {"planned": True, "operation": "Browser-authorized CLI login"}
+    old = client.store.get()
+    if old:
+        raise CLIError(
+            "This profile is already signed in; logout or choose --profile", 2
+        )
+    pending = client.store.get("login") if args.resume else None
+    if not pending:
+        verifier = secrets.token_urlsafe(32)
+        challenge = (
+            base64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest())
+            .decode()
+            .rstrip("=")
+        )
+        pending = client.call(
+            "POST", API + "/cli/login", anonymous=True, json={"challenge": challenge}
+        )
+        pending["verifier"] = verifier
+        client.store.set(pending, "login")
+    print("Verify terminal code: " + pending["verification_code"], file=sys.stderr)
+    open_link(pending["verification_url"], args.no_browser or args.json)
+    if (args.no_wait or args.json) and not args.resume:
+        return {
+            "state": "pending",
+            "verification_url": pending["verification_url"],
+            "verification_code": pending["verification_code"],
+            "next": "driftwood login --resume",
+        }
+    for _ in range(200):
+        result = client.call(
+            "POST",
+            API + "/cli/login/" + checked_id(pending["id"]) + "/exchange",
+            anonymous=True,
+            json={"verifier": pending["verifier"]},
+        )
+        if result["state"] == "authorized":
+            client.store.set(result)
+            client.store.delete("login")
+            return {k: v for k, v in result.items() if k != "token"}
+        if args.no_wait or args.json:
+            return {"state": "pending", "next": "driftwood login --resume"}
+        time.sleep(3)
+    raise CLIError("Waiting for browser approval; resume with login --resume", 7)
+
+
+def write(args, client, method, path, body=None, **kwargs):
+    identity = client.call("GET", API + "/cli/me")
+    summary = {
+        "workspace": identity["workspace"],
+        "org_id": identity["org_id"],
+        "operation": method + " " + path,
+        "changes": body,
+    }
+    if not confirm(args, json.dumps(summary, ensure_ascii=False)):
+        return {"planned": True, **summary}
+    return client.call(method, path, json=body, **kwargs)
+
+
+def onboard(args, client):
+    state = client.call("GET", SETUP)
+    if args.action == "status":
+        return state
+    if args.file:
+        data = state["profile"]["answers"] | document(args.file)
+    elif args.json or not sys.stdin.isatty():
+        return state
+    else:
+        if state["workspace"]["role"] == "member":
+            return state
+        data = dict(state["profile"]["answers"])
+        prompts = {
+            "website": "Company website",
+            "product": "What do you sell?",
+            "target_accounts": "Which companies are your targets?",
+            "target_people": "Who do you sell to?",
+            "exclusions": "Who should we exclude?",
+            "value_proposition": "Why do customers choose you?",
+            "tone": "Preferred tone",
+            "goals": "What outcomes do you want?",
+            "demo_direction": "Any demo direction? (optional)",
+        }
+        for key, label in prompts.items():
+            if not data.get(key) and (
+                key in state["missing_fields"] or state["profile"]["version"] == 0
+            ):
+                data[key] = input(label + ": ").strip() or (
+                    None if key == "website" else ""
+                )
+        if not data.get("channels") and state["profile"]["version"] == 0:
+            data["channels"] = [
+                s.strip()
+                for s in input("Channels (email,linkedin,twitter; optional): ").split(
+                    ","
+                )
+                if s.strip()
+            ]
+    result = write(
+        args,
+        client,
+        "PUT",
+        SETUP,
+        {"expected_version": state["profile"]["version"], "answers": data},
+    )
+    if args.plan:
+        return result
+    state = client.call("GET", SETUP)
+    if state["approval"] != "approved" or args.json or not sys.stdin.isatty():
+        return state
+    for channel in state["channels"]["missing"]:
+        channel = "twitter" if channel == "x" else channel
+        if input(f"Connect {channel} now? [y/N] ").lower().strip() == "y":
+            link = write(args, client, "POST", "/" + channel + "/connect")
+            url = link.get("url") or link.get("auth_url") or link.get("live_view_url")
+            if url:
+                open_link(url)
+            else:
+                emit(link)
+            input("Finish in the browser, then press Enter to check status. ")
+            if channel == "twitter":
+                emit(write(args, client, "POST", "/twitter/finish"))
+    optional_setup(args, client, state)
+    return client.call("GET", SETUP)
+
+
+def connect_mcp(args, client, name):
+    readiness = client.call("GET", SETUP)
+    if not args.plan and readiness["agent"]["status"] not in {
+        "registered",
+        "connected",
+    }:
+        raise CLIError("Wait for approval and agent provisioning before MCP setup", 7)
+    result = write(args, client, "POST", DASH + "/mcp/tokens", {"label": name})
+    if not args.plan:
+        result["org_id"] = readiness["workspace"]["id"]
+        client.store.set(result, "mcp:" + result["id"])
+    return result
+
+
+def optional_setup(args, client, state):
+    """Finish optional dashboard setup without inventing mandatory accounts."""
+    settings = client.call("GET", DASH + "/settings")
+    print("Current send schedule:", file=sys.stderr)
+    print(json.dumps(settings["send_schedule"]), file=sys.stderr)
+    if input("Change this schedule now? [y/N] ").strip().lower() == "y":
+        current = settings["send_schedule"]
+        schedule = {
+            "days": [
+                int(d.strip())
+                for d in input("Days (0=Mon .. 6=Sun), comma-separated: ").split(",")
+            ],
+            "start": input("Start time (HH:MM): ").strip(),
+            "end": input("End time (HH:MM): ").strip(),
+            "tz": input(f"Timezone [{current['tz']}]: ").strip() or current["tz"],
+            "skip_us_holidays": input("Skip US holidays? [y/N] ").strip().lower()
+            == "y",
+        }
+        emit(write(args, client, "PUT", DASH + "/settings/send-schedule", schedule))
+    assets = client.call("GET", DASH + "/assets")
+    print(f"Company assets: {len(assets['assets'])}", file=sys.stderr)
+    if input("Add a company reference link? [y/N] ").strip().lower() == "y":
+        name = input("Asset name: ").strip()
+        url = input("URL: ").strip()
+        emit(
+            write(
+                args, client, "POST", DASH + "/assets/link", {"name": name, "url": url}
+            )
+        )
+    team = client.call("GET", DASH + "/org")
+    print(f"Team seats: {len(team['members'])}", file=sys.stderr)
+    if input("Invite a teammate? [y/N] ").strip().lower() == "y":
+        email = input("Email: ").strip()
+        role = input("Role (member/admin) [member]: ").strip() or "member"
+        emit(
+            write(
+                args,
+                client,
+                "POST",
+                DASH + "/org/members",
+                {"email": email, "role": role, "note": ""},
+            )
+        )
+    if (
+        input("Open the dashboard for optional face/voice setup? [y/N] ")
+        .strip()
+        .lower()
+        == "y"
+    ):
+        open_link(state["dashboard_url"])
+    readiness = client.call("GET", SETUP)
+    if (
+        readiness["agent"]["status"] in {"registered", "connected"}
+        and input("Create an MCP connection? [y/N] ").strip().lower() == "y"
+    ):
+        name = input("Connection name [CLI connection]: ").strip() or "CLI connection"
+        result = connect_mcp(args, client, name)
+        emit({k: v for k, v in result.items() if k != "token"})
+        print(
+            "Credential saved in your OS credential store. Use mcp reveal "
+            + result["id"]
+            + " to copy it into your MCP client.",
+            file=sys.stderr,
+        )
+
+
+def execute(args, client):
+    group, action = args.command, getattr(args, "action", None)
+    if group == "login":
+        return login(args, client)
+    if group in {"whoami", "doctor"}:
+        return client.call("GET", API + "/cli/me" if group == "whoami" else SETUP)
+    if group == "logout":
+        credential = client.store.get()
+        if not credential:
+            return {"signed_out": True}
+        try:
+            result = write(
+                args,
+                client,
+                "DELETE",
+                API + "/cli/credentials/" + checked_id(credential["credential_id"]),
+            )
+        except CLIError as exc:
+            if exc.code not in {3, 4} or args.plan:
+                raise
+            client.store.delete()
+            return {
+                "signed_out": True,
+                "remote_revocation_confirmed": False,
+                "detail": "Server access has expired or been removed",
+            }
+        if not args.plan:
+            client.store.delete()
+        return result
+    if group == "onboard":
+        return onboard(args, client)
+    if group == "operations":
+        if action == "last":
+            return client.store.get("last_operation") or {"operation": None}
+        path = API + "/cli/operations"
+        if action == "get":
+            path += "/" + checked_id(args.id)
+        return client.call("GET", path)
+    if group == "sessions":
+        if action == "list":
+            return client.call("GET", API + "/cli/credentials")
+        result = write(
+            args, client, "DELETE", API + "/cli/credentials/" + checked_id(args.id)
+        )
+        current = client.store.get()
+        if (
+            not args.plan
+            and current
+            and current["credential_id"] == checked_id(args.id)
+        ):
+            client.store.delete()
+        return result
+    if group == "company":
+        state = client.call("GET", SETUP)
+        if action == "show":
+            return state["profile"]
+        return write(
+            args,
+            client,
+            "PUT",
+            SETUP,
+            {
+                "expected_version": state["profile"]["version"],
+                "answers": state["profile"]["answers"] | document(args.file),
+            },
+        )
+    if group == "agent":
+        return client.call("GET", SETUP)["agent"]
+    if group == "accounts":
+        if action == "list":
+            return client.call("GET", DASH + "/accounts")
+        if action == "disconnect":
+            return write(
+                args, client, "DELETE", DASH + "/accounts/" + checked_id(args.id)
+            )
+        result = write(
+            args,
+            client,
+            "POST",
+            "/" + args.channel + "/" + action,
+            {"provider": args.provider} if args.channel == "email" else None,
+        )
+        if not args.plan:
+            url = (
+                result.get("url")
+                or result.get("auth_url")
+                or result.get("live_view_url")
+            )
+            if url:
+                open_link(url, args.no_browser)
+        return result
+    if group == "team":
+        if action == "list":
+            return client.call("GET", DASH + "/org")
+        if action == "invite":
+            return write(
+                args,
+                client,
+                "POST",
+                DASH + "/org/members",
+                {"email": args.email, "role": args.role, "note": args.note},
+            )
+        return write(
+            args, client, "DELETE", DASH + "/org/members/" + checked_id(args.id)
+        )
+    if group == "assets":
+        if action == "list":
+            return client.call("GET", DASH + "/assets")
+        if action == "remove":
+            return write(
+                args, client, "DELETE", DASH + "/assets/" + checked_id(args.id)
+            )
+        if action == "link":
+            return write(
+                args,
+                client,
+                "POST",
+                DASH + "/assets/link",
+                {"name": args.name, "url": args.url},
+            )
+        identity = client.call("GET", API + "/cli/me")
+        if not confirm(args, f"Upload {args.file} to {identity['workspace']}"):
+            return {
+                "planned": True,
+                "file": args.file,
+                "workspace": identity["workspace"],
+            }
+        path = Path(args.file)
+        with path.open("rb") as source:
+            return client.call(
+                "POST",
+                DASH + "/assets/upload",
+                files={"file": (path.name, source)},
+                data={"name": args.name or path.name},
+            )
+    if group == "settings":
+        if action == "show":
+            return client.call("GET", DASH + "/settings")
+        return write(
+            args, client, "PUT", DASH + "/settings/send-schedule", document(args.file)
+        )
+    if group == "mcp":
+        if action == "reveal":
+            saved = client.store.get("mcp:" + checked_id(args.id))
+            if saved is None:
+                raise CLIError("This connection is not stored in this local profile", 2)
+            identity = client.call("GET", API + "/cli/me")
+            if saved.get("org_id") != identity["org_id"]:
+                raise CLIError(
+                    "This saved connection belongs to a different workspace", 4
+                )
+            if confirm(args, "Reveal this connection's secret in terminal output?"):
+                return saved
+            return {"planned": True, "operation": "Reveal stored MCP credential"}
+        if action == "connections":
+            return client.call("GET", DASH + "/mcp/tokens")
+        if action == "revoke":
+            return write(
+                args, client, "DELETE", DASH + "/mcp/tokens/" + checked_id(args.id)
+            )
+        result = connect_mcp(args, client, args.name)
+        if not args.show_token:
+            result = {k: v for k, v in result.items() if k != "token"}
+        return result
+    raise CLIError("Unknown command", 2)
+
+
+def parser():
+    root = argparse.ArgumentParser(prog="driftwood")
+    root.add_argument("--server", default="https://driftwood.sh")
+    root.add_argument("--profile", default="default")
+    root.add_argument(
+        "--request-id",
+        type=lambda value: str(uuid.UUID(value)),
+        help="Reuse an operation ID for a single write",
+    )
+    root.add_argument(
+        "--json", action="store_true", help="Machine-readable, never prompt"
+    )
+    root.add_argument("--yes", action="store_true", help="Confirm the requested writes")
+    root.add_argument(
+        "--plan", action="store_true", help="Preview writes without executing"
+    )
+    groups = root.add_subparsers(dest="command", required=True)
+    p = groups.add_parser("login")
+    p.add_argument("--resume", action="store_true")
+    p.add_argument("--no-browser", action="store_true")
+    p.add_argument("--no-wait", action="store_true")
+    for name in ("logout", "whoami", "doctor"):
+        groups.add_parser(name)
+    p = groups.add_parser("onboard")
+    p.add_argument("action", nargs="?", choices=["status", "resume"], default="resume")
+    p.add_argument("--file")
+    specs = {
+        "company": ("show", "update"),
+        "sessions": ("list", "revoke"),
+        "operations": ("list", "get", "last"),
+        "agent": ("status",),
+        "accounts": ("list", "connect", "disconnect", "finish", "unlock"),
+        "team": ("list", "invite", "remove"),
+        "assets": ("list", "upload", "link", "remove"),
+        "settings": ("show", "send-schedule"),
+        "mcp": ("connect", "connections", "revoke", "reveal"),
+    }
+    for group, actions in specs.items():
+        sub = groups.add_parser(group).add_subparsers(dest="action", required=True)
+        for action in actions:
+            p = sub.add_parser(action)
+            if action in {"remove", "disconnect", "revoke", "reveal", "get"}:
+                p.add_argument("id")
+            if (group, action) in {
+                ("company", "update"),
+                ("settings", "send-schedule"),
+            }:
+                p.add_argument("--file", required=True)
+            if group == "accounts" and action in {"connect", "finish", "unlock"}:
+                p.add_argument(
+                    "channel",
+                    choices=["email", "linkedin", "twitter"]
+                    if action == "connect"
+                    else ["twitter"],
+                )
+                p.add_argument(
+                    "--provider", choices=["gmail", "outlook"], default="gmail"
+                )
+                p.add_argument("--no-browser", action="store_true")
+            if group == "team" and action == "invite":
+                p.add_argument("email")
+                p.add_argument("--role", choices=["admin", "member"], default="member")
+                p.add_argument("--note", default="")
+            if group == "assets" and action in {"upload", "link"}:
+                p.add_argument("--name", required=action == "link")
+                p.add_argument(
+                    "--file" if action == "upload" else "--url", required=True
+                )
+            if group == "mcp" and action == "connect":
+                p.add_argument("--name", default="CLI connection")
+                p.add_argument("--show-token", action="store_true")
+    return root
+
+
+def main(argv=None):
+    args = parser().parse_args(argv)
+    client = None
+    try:
+        server = server_url(args.server)
+        if args.request_id and args.command in {"onboard", "login"}:
+            raise CLIError(
+                "--request-id is for single writes, not the wizard or login", 2
+            )
+        client = Client(server, Store(server, args.profile), request_id=args.request_id)
+        result = execute(args, client)
+        emit(result)
+        if args.command in {"doctor", "onboard"} and result.get("setup_ready") is False:
+            return 7
+        return 0
+    except CLIError as exc:
+        emit({"error": {"message": str(exc), "exit_code": exc.code}})
+        return exc.code
+    except (OSError, RuntimeError, ImportError):
+        emit(
+            {
+                "error": {
+                    "message": "Local credential store or file unavailable",
+                    "exit_code": 5,
+                }
+            }
+        )
+        return 5
+    except ValueError:
+        emit(
+            {
+                "error": {
+                    "message": "Invalid input; check the requested format",
+                    "exit_code": 2,
+                }
+            }
+        )
+        return 2
+    except (KeyboardInterrupt, EOFError):
+        emit(
+            {
+                "error": {
+                    "message": "Interrupted; resume with driftwood onboard",
+                    "exit_code": 130,
+                }
+            }
+        )
+        return 130
+    finally:
+        if client:
+            client.close()

driftwood_cli-0.1.0/src/driftwood_cli/store.py

@@ -0,0 +1,48 @@
+"""Use the native OS credential store; never fall back to plaintext."""
+
+import json
+import sys
+
+from keyring.errors import KeyringError
+
+
+class Store:
+    def __init__(self, server, profile):
+        if sys.platform == "darwin":
+            from keyring.backends.macOS import Keyring
+        elif sys.platform == "win32":
+            from keyring.backends.Windows import WinVaultKeyring as Keyring
+        elif sys.platform.startswith("linux"):
+            from keyring.backends.SecretService import Keyring
+        else:
+            raise RuntimeError("This OS has no supported credential store")
+        self.backend = Keyring()
+        self.service = "driftwood-cli:" + server
+        self.profile = profile
+
+    def get(self, key="credential"):
+        value = self._call(
+            self.backend.get_password, self.service, self.profile + ":" + key
+        )
+        return json.loads(value) if value else None
+
+    def set(self, value, key="credential"):
+        self._call(
+            self.backend.set_password,
+            self.service,
+            self.profile + ":" + key,
+            json.dumps(value),
+        )
+
+    def delete(self, key="credential"):
+        if self.get(key) is not None:
+            self._call(
+                self.backend.delete_password, self.service, self.profile + ":" + key
+            )
+
+    @staticmethod
+    def _call(function, *args):
+        try:
+            return function(*args)
+        except (KeyringError, OSError) as exc:
+            raise RuntimeError("OS credential store unavailable") from exc