graphban-cli 0.5.0__tar.gz → 0.6.0__tar.gz

{graphban_cli-0.5.0 → graphban_cli-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: graphban-cli
-Version: 0.5.0
+Version: 0.6.0
 Summary: gban — a Graphban client for the human at a terminal
 Project-URL: Homepage, https://github.com/asc-me/graphban
 Project-URL: Repository, https://github.com/asc-me/graphban

{graphban_cli-0.5.0 → graphban_cli-0.6.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "graphban-cli"
-version = "0.5.0"
+version = "0.6.0"
 description = "gban — a Graphban client for the human at a terminal"
 readme = "README.md"
 requires-python = ">=3.12"

{graphban_cli-0.5.0 → graphban_cli-0.6.0}/src/gban/cli.py

@@ -266,15 +266,41 @@ def cmd_logout(args) -> int:
 
 def cmd_whoami(args) -> int:
     url = _server(args)
-    me = authenticated(url).call("GET", "/api/auth/me")
+    client = authenticated(url)
+    me = client.call("GET", "/api/auth/me")
     project = config.resolve(args.project, config.PROJECT_ENV, "project")
-    _out({"server": url, "project": project, **me},
-         f"{PROG}: {me.get('email') or me.get('id')} at {url}"
-         + (f"\n     project {project}" if project else "\n     no default project set"),
-         args.as_json)
+    payload: dict = {"server": url, "project": project, **me}
+    human = (f"{PROG}: {me.get('email') or me.get('id')} at {url}"
+             + (f"\n     project {project}" if project else "\n     no default project set"))
+    mismatch = _cwd_project_mismatch(client, project)
+    if mismatch:
+        payload["cwd_project"] = mismatch
+        human += f"\n     WARNING: cwd resolves to project {mismatch!r}, not {project!r}"
+    _out(payload, human, args.as_json)
     return 0
 
 
+def _cwd_project_mismatch(client, configured: str) -> str:
+    """Return the project id the cwd resolves to if it differs from *configured*, else "".
+
+    A session that stands in repo X but carries a credential for project Y is the exact
+    shadowing GRPH-928 fixes on the fleet side. The directory decides; a stored default
+    does not — so we ask setup.resolve_project with no `asked` and the configured project
+    as `stored`. If the directory resolves to a different project, name it.
+    """
+    if not configured:
+        return ""
+    try:
+        cwd_project, _ = setup_mod.resolve_project(client, Path.cwd(), "", configured)
+    except setup_mod.Unresolved:
+        return ""
+    except Exception:
+        return ""
+    if cwd_project and cwd_project != configured:
+        return cwd_project
+    return ""
+
+
 def cmd_doctor(args) -> int:
     url = config.resolve(args.server, config.URL_ENV, "url")
     project = config.resolve(args.project, config.PROJECT_ENV, "project")

{graphban_cli-0.5.0 → graphban_cli-0.6.0}/src/gban/skills/graphban-delegation/SKILL.md

@@ -124,6 +124,26 @@ spawn(enrolment_code="…", tier="cheap", item="<item>", wave="<name>")
 
 Paste `brief.text` from step 3 into the child's instructions.
 
+### Brief → pstack template (PRD-44 D3)
+
+When the child is a pstack `poteto-agent`, map `brief.text` fields to the pstack template so
+the child is a Graphban worker rather than a freelance Cursor session:
+
+| pstack field | Graphban source |
+|---|---|
+| GOAL | `brief.summary` / item title |
+| SCOPE | `brief.touchpoints` — **whitelist** of predicted write areas (may write these; anything else is out) |
+| ACCEPTANCE | item acceptance / checklist |
+| VERIFY | the operating loop in `AGENTS.md` (both DB engines; real PRD) |
+| STANDING | `AGENTS.md` invariants, pasted or pointed at |
+
+Touchpoints are a **whitelist**, not a blacklist and not default-allow. Well outside them →
+stop and flag. If the PRD or item description forbids a file listed in touchpoints, the **PRD
+wins**: stop and flag. Touchpoints are not a must-write list.
+
+No schema change to `brief` is needed — the mapping is in the prompt, not the server
+(PRD-44 D7).
+
 If the adapter is `gbagent`, `turns` and `window` are **required** — it refuses to guess them,
 and a spawn without them exits before registering. That presents as a delegation that expired
 with nothing claimed, not as an error on the spawn, so check these first when a child never

{graphban_cli-0.5.0 → graphban_cli-0.6.0}/tests/test_session.py

@@ -170,6 +170,90 @@ def test_a_refusal_is_printed_in_the_servers_own_words_with_its_hint(home, monke
     assert "mint a role-narrowed credential" in err
 
 
+# ---- GRPH-928: whoami names the project mismatch ---------------------------------------------
+
+class _WhoamiClient:
+    """A fake authenticated client that answers /api/auth/me and /api/projects."""
+    def __init__(self, projects):
+        self._projects = projects
+
+    def call(self, method, path, body=None):
+        if path == "/api/auth/me":
+            return {"email": "agent@test.com", "id": "GRPH-A1"}
+        if path == "/api/projects":
+            return self._projects
+        return {}
+
+
+def test_whoami_warns_when_cwd_resolves_to_a_different_project(
+        home, tmp_path, monkeypatch, capsys):
+    """Sabotage: skip the comparison and this fails — the mismatch would go silent."""
+    config.save_settings(url="http://gb.invalid", project="agentledger")
+    cwd = tmp_path / "super-arc"
+    cwd.mkdir()
+    monkeypatch.chdir(cwd)
+    monkeypatch.setattr("gban.cli.authenticated",
+                        lambda url: _WhoamiClient([
+                            {"id": "agentledger", "name": "Agent Ledger"},
+                            {"id": "super-arc", "name": "Super Arc"},
+                        ]))
+    assert main(["whoami"]) == 0
+    out = capsys.readouterr().out
+    assert "WARNING" in out
+    assert "super-arc" in out
+    assert "agentledger" in out
+
+
+def test_whoami_is_silent_when_cwd_matches_configured_project(
+        home, tmp_path, monkeypatch, capsys):
+    """The control: cwd and configured project agree — no warning."""
+    config.save_settings(url="http://gb.invalid", project="agentledger")
+    cwd = tmp_path / "agentledger"
+    cwd.mkdir()
+    monkeypatch.chdir(cwd)
+    monkeypatch.setattr("gban.cli.authenticated",
+                        lambda url: _WhoamiClient([
+                            {"id": "agentledger", "name": "Agent Ledger"},
+                        ]))
+    assert main(["whoami"]) == 0
+    out = capsys.readouterr().out
+    assert "WARNING" not in out
+
+
+def test_whoami_is_silent_when_cwd_does_not_match_any_project(
+        home, tmp_path, monkeypatch, capsys):
+    """The directory names nothing known — the check is skipped, not an error."""
+    config.save_settings(url="http://gb.invalid", project="agentledger")
+    cwd = tmp_path / "somewhere-else"
+    cwd.mkdir()
+    monkeypatch.chdir(cwd)
+    monkeypatch.setattr("gban.cli.authenticated",
+                        lambda url: _WhoamiClient([
+                            {"id": "agentledger", "name": "Agent Ledger"},
+                        ]))
+    assert main(["whoami"]) == 0
+    out = capsys.readouterr().out
+    assert "WARNING" not in out
+
+
+def test_whoami_json_includes_cwd_project_on_mismatch(
+        home, tmp_path, monkeypatch, capsys):
+    """The machine path carries the same signal."""
+    config.save_settings(url="http://gb.invalid", project="agentledger")
+    cwd = tmp_path / "super-arc"
+    cwd.mkdir()
+    monkeypatch.chdir(cwd)
+    monkeypatch.setattr("gban.cli.authenticated",
+                        lambda url: _WhoamiClient([
+                            {"id": "agentledger", "name": "Agent Ledger"},
+                            {"id": "super-arc", "name": "Super Arc"},
+                        ]))
+    assert main(["--json", "whoami"]) == 0
+    payload = json.loads(capsys.readouterr().out)
+    assert payload["cwd_project"] == "super-arc"
+    assert payload["project"] == "agentledger"
+
+
 # ---- 10: --json is the machine-readable path -------------------------------------------------
 
 def test_json_output_is_parsed_and_carries_no_human_rendering(home, tty, monkeypatch, capsys):