graphban-cli 0.8.9__tar.gz → 0.8.10__tar.gz

{graphban_cli-0.8.9 → graphban_cli-0.8.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: graphban-cli
-Version: 0.8.9
+Version: 0.8.10
 Summary: gban — a Graphban client for the human at a terminal
 Project-URL: Homepage, https://github.com/asc-me/graphban
 Project-URL: Repository, https://github.com/asc-me/graphban

{graphban_cli-0.8.9 → graphban_cli-0.8.10}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "graphban-cli"
-version = "0.8.9"
+version = "0.8.10"
 description = "gban — a Graphban client for the human at a terminal"
 readme = "README.md"
 requires-python = ">=3.12"

{graphban_cli-0.8.9 → graphban_cli-0.8.10}/src/gban/cli.py

@@ -551,6 +551,30 @@ def cmd_stack(args) -> int:
     return 0
 
 
+ADAPTER_ENV = "GBAN_ADAPTER"
+
+
+def _until_with_adapter(rest: list[str]) -> list[str] | None:
+    """`gbfleet until` requires --adapter; Triage's drain note shows the command without it.
+
+    Fill it from the flag (already there), $GBAN_ADAPTER, the settings file's `adapter`, or
+    `claude` when that binary is on PATH. Otherwise say which value is missing and how to set
+    it, rather than letting argparse print usage. Only args before a `--` are ours to read.
+    """
+    own = rest[:rest.index("--")] if "--" in rest else rest
+    if any(a == "--adapter" or a.startswith("--adapter=") for a in own):
+        return rest
+    adapter = (os.environ.get(ADAPTER_ENV) or config.settings().get("adapter") or "").strip()
+    if not adapter and shutil.which("claude"):
+        adapter = "claude"
+    if not adapter:
+        print(f"{PROG}: `{PROG} fleet until` needs --adapter (the agent vendor to run, e.g. "
+              f"claude) and none is configured. Pass --adapter <vendor>, set ${ADAPTER_ENV}, "
+              f"or add \"adapter\" to {config.home() / config.SETTINGS_FILE}.", file=sys.stderr)
+        return None
+    return [rest[0], "--adapter", adapter, *rest[1:]]
+
+
 def cmd_fleet(args) -> int:
     """A subprocess, never an import (D5).
 
@@ -576,6 +600,10 @@ def cmd_fleet(args) -> int:
     rest = list(args.rest)
     if rest[:1] == ["--"]:
         rest = rest[1:]
+    if rest[:1] == ["until"]:
+        rest = _until_with_adapter(rest)
+        if rest is None:
+            return EXIT_REFUSED
     argv = [binary, *rest]
     url = config.resolve(args.server, config.URL_ENV, "url")
     if url and "--server" not in argv:

{graphban_cli-0.8.9 → graphban_cli-0.8.10}/src/gban/setup.py

@@ -425,6 +425,12 @@ def verify(url: str, key: str, project: str) -> list[dict]:
                      f"{project} is writable" if project in writable else
                      f"the key cannot write {project} — you can read it but not write it, so "
                      "an agent on this key can claim nothing"))
+    if "key_project_id" in ctx and ctx["key_project_id"] != project:
+        # `gbfleet until` refuses a key with no project to bind its minted-by check to
+        # (GRPH-1658), so a reused cross-project key fails the Triage drain command.
+        out.append(_line("ledger", FAIL, "scope",
+                         "the key is not scoped to this project, and `gban fleet until` "
+                         "refuses an unscoped key"))
     missing = {_tier_id(t) for t in (ctx.get("missing_tiers") or [])}
     out.append(_line("ledger", PASS if "fleet" not in missing else FAIL, "fleet tools",
                      "delegate and mint_enrolment are in the manifest" if "fleet" not in missing
@@ -495,9 +501,10 @@ def run(client: Client, url: str, project: str, repo: Path, *, scope: str = "use
         # A key that cannot do the job is replaced, never patched: `tool_tiers` are fixed at
         # mint and there is no route that changes them.
         lines.append(_line("config", UNKNOWN, "credential",
-                           "the configured credential no longer works (revoked, or it cannot "
-                           "delegate), so a new one is being minted; if the old one still "
-                           "works, remove it in Settings → API keys"))
+                           "the configured credential no longer works (revoked, cannot "
+                           "delegate, or not scoped to this project), so a project-scoped "
+                           "one is being minted; if the old one still works, remove it in "
+                           "Settings → API keys"))
     if not key:
         try:
             minted = mint(client, project)

graphban_cli-0.8.10/tests/test_fleet_until.py

@@ -0,0 +1,54 @@
+"""GRPH-1656 — the command Triage's drain note shows must start a drain as copied."""
+from __future__ import annotations
+
+import shlex
+
+import pytest
+
+from gban import config
+from gban.cli import main
+
+
+@pytest.fixture()
+def seen(tmp_path, monkeypatch):
+    monkeypatch.setenv(config.HOME_ENV, str(tmp_path))
+    monkeypatch.delenv("GBAN_ADAPTER", raising=False)
+    monkeypatch.delenv("GBFLEET_API_KEY", raising=False)
+    monkeypatch.setattr("gban.cli.doctor_mod.find_supervisor", lambda: "/usr/bin/gbfleet")
+    out = {}
+
+    class Done:
+        returncode = 0
+
+    monkeypatch.setattr("gban.cli.subprocess.run",
+                        lambda argv, **kw: (out.update(argv=argv), Done())[1])
+    return out
+
+
+def test_drain_note_command_reaches_until_with_an_adapter(seen, monkeypatch):
+    monkeypatch.setenv("GBAN_ADAPTER", "claude")
+    cmd = "gban fleet until --prd P75W-P1"  # the string waits.drain_note emits
+    assert main(shlex.split(cmd)[1:]) == 0
+    argv = seen["argv"]
+    assert argv[1] == "until" and argv[argv.index("--adapter") + 1] == "claude"
+    assert "--prd" in argv
+
+
+def test_adapter_falls_back_to_claude_on_path(seen, monkeypatch):
+    monkeypatch.setattr("gban.cli.shutil.which", lambda n: "/bin/claude" if n == "claude" else None)
+    assert main(["fleet", "until", "--prd", "X"]) == 0
+    assert "claude" in seen["argv"]
+
+
+def test_explicit_adapter_is_left_alone(seen, monkeypatch):
+    monkeypatch.setenv("GBAN_ADAPTER", "claude")
+    assert main(["fleet", "until", "--adapter", "grok", "--prd", "X"]) == 0
+    assert seen["argv"].count("--adapter") == 1 and "grok" in seen["argv"]
+
+
+def test_unknown_adapter_names_what_to_set(seen, monkeypatch, capsys):
+    monkeypatch.setattr("gban.cli.shutil.which", lambda n: None)
+    assert main(["fleet", "until", "--prd", "X"]) != 0
+    err = capsys.readouterr().err
+    assert "--adapter" in err and "GBAN_ADAPTER" in err
+    assert "argv" not in seen

{graphban_cli-0.8.9 → graphban_cli-0.8.10}/tests/test_setup.py

@@ -59,7 +59,8 @@ class Server:
     """Mints, and answers `get_context` as the deployed one does."""
 
     def __init__(self, *, writable=("core",), missing=(), refuse=None, issued=(),
-                 missing_for=None):
+                 missing_for=None, scope_for=None):
+        self.scope_for = dict(scope_for or {})
         self.writable, self.missing, self.refuse = list(writable), list(missing), refuse
         self.missing_for = dict(missing_for or {})
         self.minted = []
@@ -92,6 +93,7 @@ def _context(server):
             raise Refused(401, "invalid api key", "")
         missing = server.missing_for.get(self.api_key, server.missing)
         ctx = {"project_id": "core", "writable_projects": server.writable,
+               "key_project_id": server.scope_for.get(self.api_key, "core"),
                "missing_tiers": [{"tier": t} for t in missing]}
         return {"result": {"content": [{"text": json.dumps(ctx)}]}}
     return call
@@ -1455,3 +1457,27 @@ def test_the_image_manifest_lists_the_shipped_skills():
     manifest = json.loads((root / "backend/scripts/gban_skills.json").read_text())
     shipped = {p.name for p in (root / "cli/src/gban/skills").iterdir() if p.is_dir()}
     assert set(manifest["skills"]) == shipped
+
+
+def test_unscoped_configured_key_is_replaced_by_a_project_scoped_mint(tmp_path, wired):
+    """GRPH-1658: `until` refuses an unscoped key, so setup must not reuse one."""
+    repo, home = tmp_path / "repo", tmp_path / ".claude.json"
+    repo.mkdir()
+    server = Server(issued={"gb_sk_old"}, scope_for={"gb_sk_old": None})
+    home.write_text(json.dumps({"projects": {str(repo.resolve()): {"mcpServers": {
+        "graphban": {"type": "http", "url": URL, "headers": {"X-API-Key": "gb_sk_old"}}}}}}))
+    lines, code, made = _run(server, repo, home, wired=wired)
+    assert code == 0, lines
+    assert len(server.minted) == 1 and server.minted[0]["project_id"] == "core"
+    assert config.stored_supervisor_key("core") == "gb_sk_new1"
+
+
+def test_project_scoped_configured_key_is_still_reused(tmp_path, wired):
+    repo, home = tmp_path / "repo", tmp_path / ".claude.json"
+    repo.mkdir()
+    server = Server(issued={"gb_sk_old"})
+    home.write_text(json.dumps({"projects": {str(repo.resolve()): {"mcpServers": {
+        "graphban": {"type": "http", "url": URL, "headers": {"X-API-Key": "gb_sk_old"}}}}}}))
+    lines, code, made = _run(server, repo, home, wired=wired)
+    assert code == 0, lines
+    assert server.minted == [] and made.get("reused")

{graphban_cli-0.8.9 → graphban_cli-0.8.10}/uv.lock

@@ -124,7 +124,7 @@ wheels = [
 
 [[package]]
 name = "graphban-cli"
-version = "0.8.9"
+version = "0.8.10"
 source = { editable = "." }
 
 [package.optional-dependencies]