graphban-cli 0.8.4__tar.gz → 0.8.6__tar.gz

{graphban_cli-0.8.4 → graphban_cli-0.8.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: graphban-cli
-Version: 0.8.4
+Version: 0.8.6
 Summary: gban — a Graphban client for the human at a terminal
 Project-URL: Homepage, https://github.com/asc-me/graphban
 Project-URL: Repository, https://github.com/asc-me/graphban
@@ -87,6 +87,7 @@ Releasing is [docs/releasing.md](https://github.com/asc-me/graphban/blob/main/do
 ```bash
 gban login --server https://cloud.agentldgr.dev
 gban doctor                       # both halves: the ledger, and the local fleet
+                                  # (also reports the result to the server; --no-report opts out)
 gban agents                       # the roster, and why an agent is stuck
 gban agents role SA-A4 planner    # what used to need a browser
 gban seats issue worker worker planner                  # one entry per agent
@@ -171,6 +172,15 @@ Three properties worth knowing, each of which is a bug this command exists to no
   committed. It asks git (`check-ignore`), so an equivalent pattern already in the
   file is left alone.
 
+## Machine reports
+
+`gban setup` and `gban doctor` send the server a report of their PASS/FAIL/UNKNOWN lines, tagged
+with a random machine id kept in `~/.graphban/machine.json` (delete it and you are a new
+machine). A report whose every line is PASS turns the dashboard's "Connect your agent" step ✓ (an UNKNOWN is never a pass); the list is
+under Settings → Machines. Pass `--no-report` to skip it. When the report cannot be delivered,
+the command prints `UNKNOWN report could not report to <server>: <reason>` and still exits on
+its own checks — an undelivered report never counts as proof.
+
 ## Wiring a checkout to Swamp
 
 ```bash
@@ -221,7 +231,7 @@ A real post needs a git commit (there is nothing to send for a repo with no HEAD
 It refuses without one, rather than prompting. `getpass` falls back to a plain **echoing**
 read when it cannot turn echo off — it warns, but the warning arrives after the person has
 decided to type — so a login through a pipe, a heredoc or an editor's command runner would
-put the password in the scrollback. There is no non-interactive login yet (PRD-40 open
+put the password in the scrollback. `gban login --pair` is the alternative with no password prompt: it prints a short code, and a person signed in to the web app approves it in the quick-start dialog (step ③). The session you get is the approver's, and the code is single-use and expires after 10 minutes. There is no unattended login yet (PRD-40 open
 question 2: an API key cannot reach the JWT routes, so CI would need a service session).
 
 ## Why not `gb`

{graphban_cli-0.8.4 → graphban_cli-0.8.6}/README.md

@@ -72,6 +72,7 @@ Releasing is [docs/releasing.md](https://github.com/asc-me/graphban/blob/main/do
 ```bash
 gban login --server https://cloud.agentldgr.dev
 gban doctor                       # both halves: the ledger, and the local fleet
+                                  # (also reports the result to the server; --no-report opts out)
 gban agents                       # the roster, and why an agent is stuck
 gban agents role SA-A4 planner    # what used to need a browser
 gban seats issue worker worker planner                  # one entry per agent
@@ -156,6 +157,15 @@ Three properties worth knowing, each of which is a bug this command exists to no
   committed. It asks git (`check-ignore`), so an equivalent pattern already in the
   file is left alone.
 
+## Machine reports
+
+`gban setup` and `gban doctor` send the server a report of their PASS/FAIL/UNKNOWN lines, tagged
+with a random machine id kept in `~/.graphban/machine.json` (delete it and you are a new
+machine). A report whose every line is PASS turns the dashboard's "Connect your agent" step ✓ (an UNKNOWN is never a pass); the list is
+under Settings → Machines. Pass `--no-report` to skip it. When the report cannot be delivered,
+the command prints `UNKNOWN report could not report to <server>: <reason>` and still exits on
+its own checks — an undelivered report never counts as proof.
+
 ## Wiring a checkout to Swamp
 
 ```bash
@@ -206,7 +216,7 @@ A real post needs a git commit (there is nothing to send for a repo with no HEAD
 It refuses without one, rather than prompting. `getpass` falls back to a plain **echoing**
 read when it cannot turn echo off — it warns, but the warning arrives after the person has
 decided to type — so a login through a pipe, a heredoc or an editor's command runner would
-put the password in the scrollback. There is no non-interactive login yet (PRD-40 open
+put the password in the scrollback. `gban login --pair` is the alternative with no password prompt: it prints a short code, and a person signed in to the web app approves it in the quick-start dialog (step ③). The session you get is the approver's, and the code is single-use and expires after 10 minutes. There is no unattended login yet (PRD-40 open
 question 2: an API key cannot reach the JWT routes, so CI would need a service session).
 
 ## Why not `gb`

{graphban_cli-0.8.4 → graphban_cli-0.8.6}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "graphban-cli"
-version = "0.8.4"
+version = "0.8.6"
 description = "gban — a Graphban client for the human at a terminal"
 readme = "README.md"
 requires-python = ">=3.12"

{graphban_cli-0.8.4 → graphban_cli-0.8.6}/src/gban/cli.py

@@ -13,12 +13,14 @@ import os
 import shutil
 import subprocess
 import sys
+import time
 from pathlib import Path
 
-from gban import config, doctor as doctor_mod, setup as setup_mod, stackmap, swamp as swamp_mod
+from gban import config, doctor as doctor_mod, machine as machine_mod, setup as setup_mod, stackmap, swamp as swamp_mod
 from gban.client import (EXIT_NO_SESSION, EXIT_NO_SUPERVISOR, EXIT_REFUSED, EXIT_UNREACHABLE,
                        Client, NoSession,
-                       Refused, Unreachable, authenticated, login)
+                       Refused, Unreachable, authenticated, login, pair_poll,
+                       pair_start)
 
 PROG = "gban"
 
@@ -44,14 +46,20 @@ def _parser() -> argparse.ArgumentParser:
                      "written to session.json at mode 600; the access token is never stored, "
                      "because it is renewed on every invocation anyway."))
     login_cmd.add_argument("--email", default=None)
+    login_cmd.add_argument(
+        "--pair", action="store_true",
+        help=("sign in without typing a password here: prints a short code that a signed-in "
+              "person approves in the web app's quick-start dialog"))
 
     sub.add_parser("logout", help="end the session, here and on the server")
-    sub.add_parser(
+    doctor_cmd = sub.add_parser(
         "doctor", help="check both halves: the ledger, and the local fleet",
         description=("Everything that can be checked before anything is spawned. The ledger "
                      "half runs here; the local half is `gbfleet doctor`, run as a subprocess. "
                      "Neither half silences the other: what could not be checked prints "
                      "UNKNOWN with its reason, never a pass."))
+    doctor_cmd.add_argument("--no-report", action="store_true",
+                            help="do not send the result to the server (Settings → Machines)")
 
     setup_cmd = sub.add_parser(
         "setup", help="enable delegation on a project",
@@ -75,6 +83,8 @@ def _parser() -> argparse.ArgumentParser:
              "lookup")
     setup_cmd.add_argument("--no-install", action="store_true",
                            help="do not install the supervisor")
+    setup_cmd.add_argument("--no-report", action="store_true",
+                           help="do not send the result to the server (Settings → Machines)")
 
     swamp_cmd = sub.add_parser(
         "swamp", help="wire this checkout to Swamp's Graphban adapter",
@@ -183,6 +193,8 @@ def _server(args) -> str:
 
 def cmd_login(args) -> int:
     url = _server(args)
+    if args.pair:
+        return _login_pair(args, url)
     # A TERMINAL, OR NOTHING. `getpass` falls back to a plain echoing read when it cannot
     # turn echo off, and warns about it — which is the wrong trade for a password: the
     # warning arrives after the person has already decided to type. Without a tty the
@@ -205,7 +217,38 @@ def cmd_login(args) -> int:
         # same rule criterion 4 applies to an expired session applies to a cancelled login.
         print(f"\n{PROG}: cancelled", file=sys.stderr)
         return EXIT_REFUSED
-    pair = login(url, email, password)
+    return _finish_login(args, url, email, login(url, email, password))
+
+
+def _login_pair(args, url: str) -> int:
+    """Device-code sign-in (GRPH-1366): the identity is whoever approves the code in the app."""
+    started = pair_start(url)
+    code = started.get("user_code") or ""
+    print(f"{PROG}: open the quick-start dialog in {url} (step 3) and enter this code:\n\n"
+          f"       {code}\n\n     waiting for approval (expires in "
+          f"{int(started.get('expires_in', 0)) // 60} min)…", file=sys.stderr)
+    deadline = time.monotonic() + float(started.get("expires_in", 600))
+    interval = max(float(started.get("interval", 3)), 0.0)
+    try:
+        while time.monotonic() < deadline:
+            time.sleep(interval)
+            try:
+                got = pair_poll(url, started.get("device_code", ""))
+            except Refused:
+                print(f"{PROG}: the code expired or was already used. Run `{PROG} login --pair` "
+                      f"again.", file=sys.stderr)
+                return EXIT_REFUSED
+            if got.get("status") == "approved":
+                return _finish_login(args, url, got.get("email") or "", got)
+    except KeyboardInterrupt:
+        print(f"\n{PROG}: cancelled", file=sys.stderr)
+        return EXIT_REFUSED
+    print(f"{PROG}: the code expired before anyone approved it. Run `{PROG} login --pair` "
+          f"again.", file=sys.stderr)
+    return EXIT_REFUSED
+
+
+def _finish_login(args, url: str, email: str, pair: dict) -> int:
     refresh = pair.get("refresh_token") or ""
     if not refresh:
         print(f"{PROG}: the server returned no refresh token", file=sys.stderr)
@@ -327,6 +370,8 @@ def cmd_doctor(args) -> int:
     project = config.resolve(args.project, config.PROJECT_ENV, "project")
     api_key = doctor_mod.resolve_supervisor_key(project, url=url)
     lines, code = doctor_mod.run(url, project, api_key)
+    if not getattr(args, "no_report", False):
+        lines += machine_mod.send(url, project, lines)  # UNKNOWN when undelivered: exit unchanged
     _out({"lines": lines, "ok": code == 0}, doctor_mod.render(lines), args.as_json)
     return code
 
@@ -354,6 +399,8 @@ def cmd_setup(args) -> int:
         return EXIT_REFUSED
     lines, code, made = setup_mod.run(client, url, project, Path.cwd(), scope=args.scope,
                                       install=not args.no_install)
+    if not args.no_report:
+        lines += machine_mod.send(url, project, lines)
     human = [doctor_mod.render(lines)]
     if how != "named":
         human.insert(0, f"{PROG}: {project} — {how}")
@@ -388,6 +435,8 @@ def _setup_auto(args, url: str, client) -> int:
         got, code, made = setup_mod.run(client, url, pid, repo, scope=args.scope,
                                         install=not args.no_install)
         lines += [{**l, "name": f"{pid}: {l['name']}"} for l in got]
+        if not args.no_report:
+            lines += [{**l, "name": f"{pid}: {l['name']}"} for l in machine_mod.send(url, pid, got)]
         done[pid], worst = {"repo": str(repo), "ok": code == 0, **made}, max(worst, code)
     human = [doctor_mod.render(lines),
              f"\n     {sum(1 for d in done.values() if d['ok'])} of {len(done)} enabled. "

{graphban_cli-0.8.4 → graphban_cli-0.8.6}/src/gban/client.py

@@ -135,6 +135,15 @@ def login(url: str, email: str, password: str) -> dict:
                             {"email": email, "password": password})
 
 
+def pair_start(url: str) -> dict:
+    """Begin a device-code sign-in: no password, no credential yet (GRPH-1366)."""
+    return Client(url).call("POST", "/api/cli/pair")
+
+
+def pair_poll(url: str, device_code: str) -> dict:
+    return Client(url).call("POST", "/api/cli/pair/token", {"device_code": device_code})
+
+
 def authenticated(url: str, *, act: str = "") -> Client:
     """A client for this invocation: one refresh exchange, access token held in memory.
 

graphban_cli-0.8.6/src/gban/machine.py

@@ -0,0 +1,91 @@
+"""Machine identity and the report `gban setup` / `gban doctor` send (GRPH-1442).
+
+The machine id is random and lives in `machine.json` in gban's home. Wiping that directory makes
+a new machine, which is the intent: the id names an installation, not a person or a label.
+
+A report that cannot be delivered NEVER counts. It comes back as an UNKNOWN line naming the
+server and the reason, and the caller still exits on its own checks.
+"""
+from __future__ import annotations
+
+import platform
+import shutil
+import socket
+import subprocess  # nosec B404 - fixed argv, no shell
+import uuid
+from importlib import metadata
+
+from gban import config
+from gban.client import NoSession, Refused, Unreachable, authenticated
+from gban.doctor import UNKNOWN, _line
+
+MACHINE_FILE = "machine.json"
+
+
+def machine_id() -> str:
+    """The stored id, minted on first use. An unwritable home still yields a (volatile) id."""
+    path = config.home() / MACHINE_FILE
+    existing = config._read(path).get("machine_id")
+    if isinstance(existing, str) and existing:
+        return existing
+    fresh = "gbm_" + uuid.uuid4().hex
+    try:
+        config._write(path, {"machine_id": fresh})
+    except OSError:
+        pass
+    return fresh
+
+
+def _version(dist: str) -> str:
+    try:
+        return metadata.version(dist)
+    except metadata.PackageNotFoundError:
+        return ""
+
+
+def _gbfleet_version() -> str:
+    exe = shutil.which("gbfleet")
+    if not exe:
+        return ""
+    try:
+        done = subprocess.run([exe, "--version"], capture_output=True, text=True,  # nosec B603
+                              timeout=5)
+        return (done.stdout or "").strip().split()[-1] if done.returncode == 0 and done.stdout.strip() else ""
+    except (OSError, subprocess.SubprocessError):
+        return ""
+
+
+def _harnesses() -> list[str]:
+    return [name for name, binary in (("claude", "claude"), ("grok", "grok"), ("codex", "codex"))
+            if shutil.which(binary)]
+
+
+def payload(project: str, lines: list[dict]) -> dict:
+    return {
+        "machine_id": machine_id(), "label": socket.gethostname().split(".")[0],
+        "os": f"{platform.system()} {platform.release()}".strip(),
+        "gban_version": _version("gban"), "gbfleet_version": _gbfleet_version(),
+        "harnesses": _harnesses(), "project": project,
+        "lines": [{"status": l["status"], "name": l["name"], "detail": l.get("detail", "")}
+                  for l in lines],
+    }
+
+
+def send(url: str, project: str, lines: list[dict]) -> list[dict]:
+    """Deliver the report. Returns the line to append when it could not be delivered, else []."""
+    try:
+        authenticated(url, act="report").call("POST", "/api/machines/report",
+                                              payload(project, lines))
+    except NoSession as exc:
+        return [_unreported(url, exc.why)]
+    except Refused as exc:
+        return [_unreported(url, exc.detail)]
+    except Unreachable as exc:
+        return [_unreported(url, str(exc))]
+    except Exception as exc:  # noqa: BLE001 - a report must never take the command down
+        return [_unreported(url, f"{type(exc).__name__}: {exc}")]
+    return []
+
+
+def _unreported(url: str, reason: str) -> dict:
+    return _line("report", UNKNOWN, "report", f"could not report to {url}: {reason}")

{graphban_cli-0.8.4 → graphban_cli-0.8.6}/src/gban/setup.py

@@ -62,8 +62,10 @@ SETUP_AGENTS = ("claude", "grok")
 #: flag that moves (e.g. `--server` is a top-level option, not a `login` one) fails a test
 #: rather than a person's terminal.
 QUICKSTART_COMMANDS = (
-    "uv tool install graphban-cli",
+    "uv tool install graphban-cli && uv tool install graphban-fleet",
     "gban --server {server} login",
+    "gban --server {server} login --pair",
+    "gban setup",
     "gban --project {project} setup",
 )
 
@@ -770,6 +772,40 @@ def match(projects: list[dict], here: Path) -> tuple[dict, list[dict]]:
     return by_project, notes
 
 
+def normalize_remote(raw: str) -> str:
+    """`host/owner/name`, lowercased, no scheme, credentials, port or `.git`. The same rule as
+    backend/app/services/projects.py:normalize_repo_url (a separate distribution cannot import
+    it); tests on both sides pin the same table. "" when it does not look like a remote."""
+    value = (raw or "").strip()
+    m = re.match(r"^(?:[a-z][a-z0-9+.-]*://(?:[^@/]*@)?([^/:]+)(?::\d*)?|(?:[^@/]*@)?([^/:]+):?)/?(.+)$",
+                 value, re.IGNORECASE)
+    if not m or any(ch.isspace() for ch in value):
+        return ""
+    path = m.group(3).strip("/")
+    path = path[:-4] if path.endswith(".git") else path
+    return f"{m.group(1) or m.group(2)}/{path}".lower() if "/" in path else ""
+
+
+def git_remotes(here: Path) -> list[str]:
+    """Normalized URLs of every remote of the checkout at `here`, `origin` first. [] when it is
+    not a checkout or git is absent — which is "no signal", and falls through to the name match."""
+    try:
+        names_out = subprocess.run(["git", "-C", str(here), "remote"], capture_output=True,
+                                   text=True, timeout=10)
+        if names_out.returncode != 0:
+            return []
+        out = []
+        for name in sorted(names_out.stdout.split(), key=lambda n: n != "origin"):
+            got = subprocess.run(["git", "-C", str(here), "remote", "get-url", name],
+                                 capture_output=True, text=True, timeout=10)
+            norm = normalize_remote(got.stdout) if got.returncode == 0 else ""
+            if norm and norm not in out:
+                out.append(norm)
+        return out
+    except (OSError, subprocess.SubprocessError):
+        return []
+
+
 class Unresolved(Exception):
     """The directory does not name a project on this deployment (GRPH-795)."""
 
@@ -792,6 +828,15 @@ def resolve_project(client, here: Path, asked: str = "", stored: str = "") -> tu
         return asked, "named"
     rows = client.call("GET", "/api/projects")
     projects = [p for p in (rows if isinstance(rows, list) else []) if isinstance(p, dict)]
+    # The git remote is the stronger signal: a directory can be renamed, a remote names the repo.
+    remotes = git_remotes(here)
+    by_remote = [p for p in projects if str(p.get("repo_url") or "") in remotes]
+    if len(by_remote) == 1:
+        return str(by_remote[0].get("id") or ""), f"matched the git remote {by_remote[0].get('repo_url')!r}"
+    if len(by_remote) > 1:
+        raise Unresolved(
+            f"this checkout's remote matches several projects "
+            f"({', '.join(sorted(str(p.get('id')) for p in by_remote))}), so none was chosen — name one with --project")
     hits = [p for p in projects if slug(here.name) in names(p)]
     if len(hits) == 1:
         return str(hits[0].get("id") or ""), f"matched the directory name {here.name!r}"

{graphban_cli-0.8.4 → graphban_cli-0.8.6}/src/gban/skills/graphban-work/SKILL.md

@@ -15,6 +15,10 @@ Take one item, leave a receipt, hand it to review. Reading the repo is `graphban
 2. Fleet: `claim_cluster`. Solo: `claim_next`. `claimed: false` names who holds the area and when it frees. That is the answer. Take different work.
 3. `get_item_details` once. The `brief` suggests `lane` and `tier` with a basis. You still choose both if you hand it to a child.
 4. `heartbeat(id, status=<one line>, files=[the paths you are in])` on the lease interval. A heartbeat is not a `fleet_status` poll.
+   Heartbeat before any command that can run longer than the lease: a Postgres suite or `pnpm test` prints nothing, and a silent command drops the claim around 150 seconds.
+   After you change paths, `describe_code` those paths so the next child does not grep for them.
+   A review-ready receipt is a test line: an `update_item` evidence entry of kind `test` with passed and failed counts.
+   Finishing the item is `graphban-prove`.
 5. `update_item` as you go. Evidence appends. Touchpoints union: send the files you actually touched. An empty touchpoint list writes nothing. Status goes to `review`.
 6. Stopping unfinished: `release_item`. A blocker that is still true tomorrow is status `blocked` with `blocker` set. `backlog` is claimable and will be handed out again. A build claim released without `to_status` goes back to `next`.
 
@@ -22,7 +26,9 @@ Test scope follows the project's mode, which your delegation brief states. `agen
 
 A product decision the item and its PRD framing do not already state: file a wait and stop. `create_item` with tag `wait:decision`, `status=blocked`, this item's `prd_id`, and a description that is the question plus what each answer would make you do. `link_items` with `a` this item, `b` the wait, `type` `dependency`, `reason` `wait:decision`. Leave this item `blocked`. Leave the wait blocked. Answering it is `graphban-answer`.
 
-A broken build stays a free-text `blocker` on this item. That is not a wait.
+A broken build is either still this item (move it back to `next` with the failure named), or a
+new ticket this item depends on — `create_item`, `link_items` with `type=dependency`, and
+`blocker` set to that item's id. A free-text `blocker` alone is not a wait and is not claimable.
 
 Signing off is `graphban-review`. The builder does not set `done`.
 

graphban_cli-0.8.6/tests/test_login_pair.py

@@ -0,0 +1,46 @@
+"""`gban login --pair` signs in without a password prompt or a tty (GRPH-1366)."""
+from __future__ import annotations
+
+import pytest
+
+from gban import cli as cli_mod, config
+from gban.cli import main
+from gban.client import Refused
+
+
+@pytest.fixture()
+def home(tmp_path, monkeypatch):
+    monkeypatch.setenv(config.HOME_ENV, str(tmp_path))
+    for var in (config.URL_ENV, config.PROJECT_ENV, config.API_KEY_ENV):
+        monkeypatch.delenv(var, raising=False)
+    monkeypatch.setattr(cli_mod.time, "sleep", lambda *_: None)
+    monkeypatch.setattr(cli_mod.sys.stdin, "isatty", lambda: False)
+    monkeypatch.setattr(cli_mod, "authenticated", lambda url, act="": type(
+        "C", (), {"call": lambda self, *a, **k: []})())
+    return tmp_path
+
+
+START = {"device_code": "dev", "user_code": "ABCD-EFGH", "expires_in": 600, "interval": 0}
+
+
+def test_pair_prints_code_then_stores_the_approvers_session(home, monkeypatch, capsys):
+    answers = iter([{"status": "pending"},
+                    {"status": "approved", "refresh_token": "r", "access_token": "a",
+                     "email": "approver@example.com"}])
+    monkeypatch.setattr(cli_mod, "pair_start", lambda url: START)
+    monkeypatch.setattr(cli_mod, "pair_poll", lambda url, dev: next(answers))
+    assert main(["--server", "http://gb.invalid", "login", "--pair"]) == 0
+    err = capsys.readouterr().err
+    assert "ABCD-EFGH" in err
+    assert config.session()["refresh_token"] == "r"
+    assert config.session()["user"] == "approver@example.com"
+
+
+def test_pair_refused_code_stores_nothing(home, monkeypatch):
+    monkeypatch.setattr(cli_mod, "pair_start", lambda url: START)
+
+    def boom(url, dev):
+        raise Refused(400, "expired")
+    monkeypatch.setattr(cli_mod, "pair_poll", boom)
+    assert main(["--server", "http://gb.invalid", "login", "--pair"]) == 1
+    assert not config.session().get("refresh_token")

graphban_cli-0.8.6/tests/test_machine_report.py

@@ -0,0 +1,81 @@
+"""Machine reports from `gban doctor` / `gban setup` (GRPH-1442)."""
+from __future__ import annotations
+
+import pytest
+
+from gban import config, doctor, machine
+from gban.cli import main
+from gban.client import NoSession, Unreachable
+
+
+@pytest.fixture()
+def home(tmp_path, monkeypatch):
+    monkeypatch.setenv(config.HOME_ENV, str(tmp_path))
+    monkeypatch.setenv("CLAUDE_CONFIG_PATH", str(tmp_path / "claude.json"))
+    monkeypatch.setenv("GROK_CONFIG_PATH", str(tmp_path / "grok" / "config.toml"))
+    monkeypatch.chdir(tmp_path)
+    for var in (config.URL_ENV, config.PROJECT_ENV, config.API_KEY_ENV, doctor.SUPERVISOR_KEY_ENV):
+        monkeypatch.delenv(var, raising=False)
+    config.save_settings(url="http://gb.invalid", project="core")
+    return tmp_path
+
+
+class _Rec:
+    def __init__(self):
+        self.calls = []
+
+    def call(self, method, path, body=None):
+        self.calls.append((method, path, body))
+        return {}
+
+
+def _doctor(monkeypatch, lines, code, extra=()):
+    monkeypatch.setattr("gban.cli.doctor_mod.run", lambda *a, **k: (list(lines), code))
+    monkeypatch.setattr("gban.cli.doctor_mod.resolve_supervisor_key", lambda *a, **k: "")
+    return main(["doctor", *extra])
+
+
+def test_machine_id_is_stable_and_wiping_home_makes_a_new_one(home):
+    first = machine.machine_id()
+    assert first == machine.machine_id()
+    (home / machine.MACHINE_FILE).unlink()
+    assert machine.machine_id() != first
+
+
+def test_doctor_posts_its_lines_with_the_machine_id(home, monkeypatch):
+    rec = _Rec()
+    monkeypatch.setattr("gban.machine.authenticated", lambda url, act="": rec)
+    code = _doctor(monkeypatch, [doctor._line("ledger", "PASS", "server", "ok"),
+                                 doctor._line("local", "FAIL", "gbfleet", "bad")], 1)
+    assert code == 1
+    (method, path, body), = rec.calls
+    assert (method, path) == ("POST", "/api/machines/report")
+    assert body["machine_id"] == machine.machine_id() and body["project"] == "core"
+    assert [l["status"] for l in body["lines"]] == ["PASS", "FAIL"]
+
+
+def test_no_report_sends_nothing(home, monkeypatch):
+    rec = _Rec()
+    monkeypatch.setattr("gban.machine.authenticated", lambda url, act="": rec)
+    assert _doctor(monkeypatch, [doctor._line("ledger", "PASS", "server")], 0, ["--no-report"]) == 0
+    assert rec.calls == []
+
+
+@pytest.mark.parametrize("error", [Unreachable("could not reach http://gb.invalid: down"),
+                                   NoSession("no stored session")])
+def test_an_undeliverable_report_prints_unknown_and_keeps_the_exit_code(home, monkeypatch, capsys, error):
+    """Sabotage: block the server. The command still exits on its own checks."""
+    def boom(url, act=""):
+        raise error
+    monkeypatch.setattr("gban.machine.authenticated", boom)
+    code = _doctor(monkeypatch, [doctor._line("ledger", "PASS", "server")], 0)
+    out = capsys.readouterr().out
+    assert code == 0
+    assert "UNKNOWN" in out and "could not report to http://gb.invalid" in out
+    code = _doctor(monkeypatch, [doctor._line("ledger", "FAIL", "session")], 1)
+    assert code == 1  # the report's own failure never turns a FAIL into success
+
+
+def test_undelivered_line_is_unknown_never_pass(home):
+    line = machine._unreported("http://s", "why")
+    assert line["status"] == "UNKNOWN" and line["detail"] == "could not report to http://s: why"

{graphban_cli-0.8.4 → graphban_cli-0.8.6}/tests/test_setup.py

@@ -1210,6 +1210,69 @@ def test_setup_refuses_to_write_a_key_that_would_not_be_ignored(tmp_path, wired,
     assert any("would not be gitignored" in l["detail"] for l in lines)
 
 
+# ---- resolving by git remote first (GRPH-1365) ---------------------------------------------------
+
+import subprocess as _sp
+
+
+def _checkout(path, remote):
+    path.mkdir()
+    _sp.run(["git", "-C", str(path), "init", "-q"], check=True)
+    _sp.run(["git", "-C", str(path), "remote", "add", "origin", remote], check=True)
+    return path
+
+
+@pytest.mark.parametrize("raw,want", [
+    ("https://github.com/Acme/App.git", "github.com/acme/app"),
+    ("git@github.com:acme/app", "github.com/acme/app"),
+    ("ssh://git@github.com:22/acme/app/", "github.com/acme/app"),
+    ("github.com/acme/app", "github.com/acme/app"),
+    ("git@github.com:1password/cli.git", "github.com/1password/cli"),
+    ("https://github.com/1password/cli", "github.com/1password/cli"),
+    ("ssh://git@github.com/37signals/x", "github.com/37signals/x"),
+    ("git@github.com:37signals/x", "github.com/37signals/x"),
+    ("https://user:tok@gitlab.com/a/b/c.git", "gitlab.com/a/b/c"),
+    ("app", ""), ("", ""),
+])
+def test_normalize_remote_table_matches_the_backend(raw, want):
+    assert setup_mod.normalize_remote(raw) == want
+
+
+def test_a_matching_remote_picks_the_project_even_when_names_differ(tmp_path):
+    here = _checkout(tmp_path / "checkout-7", "git@github.com:Acme/App.git")
+    rows = [{"id": "core", "name": "Core", "repo_url": "github.com/acme/app"},
+            {"id": "checkout-7", "name": "Decoy", "repo_url": "github.com/other/thing"}]
+
+    pid, how = setup_mod.resolve_project(Listing(rows), here)
+
+    assert pid == "core" and "git remote" in how
+
+
+def test_no_matching_remote_falls_back_to_the_name(tmp_path):
+    here = _checkout(tmp_path / "super-arc", "git@github.com:acme/unrelated.git")
+    rows = [{"id": "super-arc", "name": "Super Arc", "repo_url": "github.com/acme/app"}]
+
+    pid, how = setup_mod.resolve_project(Listing(rows), here)
+
+    assert pid == "super-arc" and "directory name" in how
+
+
+def test_a_remote_matching_two_projects_is_refused(tmp_path):
+    here = _checkout(tmp_path / "x", "https://github.com/acme/app")
+    rows = [{"id": "a", "name": "A", "repo_url": "github.com/acme/app"},
+            {"id": "b", "name": "B", "repo_url": "github.com/acme/app"}]
+
+    with pytest.raises(setup_mod.Unresolved):
+        setup_mod.resolve_project(Listing(rows), here)
+
+
+def test_a_project_without_repo_url_never_matches_an_empty_remote(tmp_path):
+    here = tmp_path / "plain"
+    here.mkdir()  # not a checkout: no remotes
+    with pytest.raises(setup_mod.Unresolved):
+        setup_mod.resolve_project(Listing([{"id": "a", "name": "A"}]), here)
+
+
 def test_web_agent_list_is_generated_from_setup_agents():
     """The quick-start picker's gban-route list (GRPH-1362 / G9) is exported, not copied."""
     import importlib.util
@@ -1245,6 +1308,50 @@ def test_quickstart_commands_parse_with_the_cli_parser():
             assert ns.project == "core"
 
 
+def _uv_tool_install_packages(command: str) -> list[list[str]]:
+    """The positional arguments of each `uv tool install` in a `&&`-chained line.
+
+    `uv tool install [OPTIONS] <PACKAGE>` takes exactly one package; a second positional
+    exits with "unexpected argument". Options (`--with x`, `-p 3.12`) are skipped with
+    their value so only real positionals are counted."""
+    import shlex
+
+    takes_value = {"--with", "-w", "--python", "-p", "--from", "--index", "--index-url"}
+    out = []
+    for part in command.split("&&"):
+        argv = shlex.split(part)
+        assert argv[:3] == ["uv", "tool", "install"], part
+        pos, i = [], 3
+        while i < len(argv):
+            a = argv[i]
+            if a.startswith("-"):
+                i += 2 if a in takes_value else 1
+                continue
+            pos.append(a)
+            i += 1
+        out.append(pos)
+    return out
+
+
+def test_quickstart_install_line_installs_both_packages_one_per_uv_call():
+    """Bounced once: `uv tool install graphban-cli graphban-fleet` exits 2 — uv takes one
+    package per install. The line must install both tools, each in its own `uv tool install`."""
+    from gban.setup import QUICKSTART_COMMANDS
+
+    installs = [c for c in QUICKSTART_COMMANDS if c.startswith("uv ")]
+    assert len(installs) == 1, "the dialog shows exactly one install line"
+    packages = _uv_tool_install_packages(installs[0])
+    assert all(len(p) == 1 for p in packages), f"one package per uv tool install: {packages}"
+    assert sorted(p[0] for p in packages) == ["graphban-cli", "graphban-fleet"]
+
+
+def test_the_bounced_install_line_is_rejected_by_the_check():
+    """Sabotage for the test above: the bounced string must fail it, or it proves nothing."""
+    packages = _uv_tool_install_packages("uv tool install graphban-cli graphban-fleet")
+    assert packages == [["graphban-cli", "graphban-fleet"]]
+    assert not all(len(p) == 1 for p in packages)
+
+
 def test_the_old_subcommand_flag_order_is_still_rejected():
     """Sabotage for the test above: the bounced strings must fail to parse, or it proves nothing."""
     import pytest
@@ -1254,3 +1361,22 @@ def test_the_old_subcommand_flag_order_is_still_rejected():
     for argv in (["login", "--server", "https://x"], ["setup", "--project", "core"]):
         with pytest.raises(SystemExit):
             _parser().parse_args(argv)
+
+
+def test_graphban_work_names_the_lease_the_graph_and_prove():
+    """The work skill must warn that a silent long command drops the lease, send
+    changed paths to describe_code, call a receipt a test line, and hand
+    finishing to graphban-prove."""
+    body = " ".join(setup_mod.skill_source("graphban-work").read_text(encoding="utf-8").split())
+    assert "Heartbeat before any command that can run longer than the lease" in body
+    assert "`describe_code` those paths" in body
+    assert "A review-ready receipt is a test line" in body
+    assert "Finishing the item is `graphban-prove`" in body
+
+
+def test_the_image_manifest_lists_the_shipped_skills():
+    """backend/scripts/gban_skills.json is a checked-in copy (the image has no cli/)."""
+    root = Path(__file__).resolve().parents[2]
+    manifest = json.loads((root / "backend/scripts/gban_skills.json").read_text())
+    shipped = {p.name for p in (root / "cli/src/gban/skills").iterdir() if p.is_dir()}
+    assert set(manifest["skills"]) == shipped

{graphban_cli-0.8.4 → graphban_cli-0.8.6}/uv.lock

@@ -124,7 +124,7 @@ wheels = [
 
 [[package]]
 name = "graphban-cli"
-version = "0.8.4"
+version = "0.8.6"
 source = { editable = "." }
 
 [package.optional-dependencies]