grit-cli 0.1.0a0__py3-none-any.whl

grit/__init__.py

@@ -0,0 +1,4 @@
+"""Grit — session-based Git profile manager."""
+
+__version__ = "0.1.0-alpha"
+__app_name__ = "grit"

grit/__main__.py

@@ -0,0 +1,6 @@
+"""Allow running grit as `python -m grit`."""
+
+from grit.cli.main import cli
+
+if __name__ == "__main__":
+    cli()

grit/cli/cmd_audit.py

@@ -0,0 +1,124 @@
+"""CLI commands: grit audit <subcommand>
+
+Enterprise audit log viewer and exporter.
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+
+import click
+
+
+@click.group("audit")
+def audit() -> None:
+    """View and export the enterprise audit log."""
+
+
+@audit.command("show")
+@click.option("--since", default=None, metavar="ISO_DATETIME",
+              help="Only show entries at or after this ISO timestamp (e.g. 2025-01-01T00:00:00Z).")
+@click.option("--action", default=None, metavar="ACTION",
+              help="Filter by action type: profile_switch, session_create, git_config_write.")
+@click.option("--limit", type=int, default=50, show_default=True,
+              help="Maximum number of entries to display.")
+@click.option("--json", "as_json", is_flag=True, help="Output as JSON array.")
+def show(since: str, action: str, limit: int, as_json: bool) -> None:
+    """Display recent audit log entries."""
+    from grit.config.subscription import require_pro_installed
+    require_pro_installed("audit log")
+    from grit.enterprise.audit import export_entries
+
+    entries = export_entries(since=since)
+
+    if action:
+        entries = [e for e in entries if e.get("action") == action]
+
+    entries = entries[-limit:]  # most recent N
+
+    if as_json:
+        click.echo(json.dumps(entries, indent=2))
+        return
+
+    if not entries:
+        click.echo("No audit log entries found.")
+        return
+
+    for entry in entries:
+        ts = entry.get("timestamp", "?")
+        act = entry.get("action", "?")
+        repo = entry.get("repo_path", "")
+        profile = entry.get("profile_name", entry.get("profile_id", ""))
+        key = entry.get("key", "")
+
+        if act == "profile_switch":
+            click.echo(f"{ts}  profile_switch  {profile!r}  →  {repo}")
+        elif act == "session_create":
+            prof = profile or entry.get("profile_id", "?")
+            click.echo(f"{ts}  session_create  profile={prof}  repo={repo}")
+        elif act == "git_config_write":
+            click.echo(f"{ts}  git_config_write  {key}  →  {repo}")
+        else:
+            extra = {k: v for k, v in entry.items() if k not in ("timestamp", "action")}
+            click.echo(f"{ts}  {act}  {json.dumps(extra)}")
+
+
+@audit.command("export")
+@click.option("--since", default=None, metavar="ISO_DATETIME",
+              help="Only export entries at or after this ISO timestamp.")
+@click.option("--format", "fmt", type=click.Choice(["json", "csv", "jsonl"]), default="jsonl",
+              show_default=True)
+@click.option("--output", "-o", default=None, metavar="FILE",
+              help="Write to FILE instead of stdout.")
+def export(since: str, fmt: str, output: str) -> None:
+    """Export audit log entries to JSON, JSONL, or CSV."""
+    from grit.config.subscription import require_pro_installed
+    require_pro_installed("audit log")
+    import csv
+    import io
+
+    from grit.enterprise.audit import export_entries
+
+    entries = export_entries(since=since)
+
+    if fmt == "jsonl":
+        lines = "\n".join(json.dumps(e, ensure_ascii=False) for e in entries)
+        text = lines + ("\n" if lines else "")
+    elif fmt == "json":
+        text = json.dumps(entries, indent=2, ensure_ascii=False) + "\n"
+    else:  # csv
+        buf = io.StringIO()
+        fieldnames = ["timestamp", "action", "repo_path", "profile_id", "profile_name", "key"]
+        writer = csv.DictWriter(buf, fieldnames=fieldnames, extrasaction="ignore",
+                                lineterminator="\n")
+        writer.writeheader()
+        writer.writerows(entries)
+        text = buf.getvalue()
+
+    if output:
+        try:
+            with open(output, "w", encoding="utf-8") as fh:
+                fh.write(text)
+            click.echo(f"Exported {len(entries)} entries to {output}")
+        except OSError as exc:
+            click.echo(f"Error writing {output}: {exc}", err=True)
+            sys.exit(1)
+    else:
+        click.echo(text, nl=False)
+
+
+@audit.command("clear")
+@click.confirmation_option(prompt="This will permanently delete all audit log entries. Continue?")
+def clear() -> None:
+    """Delete the audit log file (irreversible)."""
+    from grit.config.subscription import require_pro_installed
+    require_pro_installed("audit log")
+    from grit.config.paths import audit_log_file
+
+    path = audit_log_file()
+    if path.exists():
+        path.unlink()
+        click.echo("Audit log cleared.")
+    else:
+        click.echo("No audit log found.")

grit/cli/cmd_auth.py

@@ -0,0 +1,114 @@
+"""CLI commands: grit auth <subcommand>
+
+Manages cloud authentication for Grit Pro / Enterprise features.
+Uses device-flow OAuth2 so users never type passwords into the terminal.
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+
+import click
+
+
+@click.group("auth")
+def auth() -> None:
+    """Authenticate with Grit Cloud for Pro/Enterprise features."""
+
+
+@auth.command("login")
+@click.option("--provider", type=click.Choice(["github", "google"]), default="github",
+              help="OAuth provider to use.")
+def login(provider: str) -> None:
+    """Log in to Grit Cloud via browser-based device flow."""
+    from grit.config.subscription import require_pro_installed
+    require_pro_installed("Grit Cloud login")
+    from grit.cloud.auth import poll_device_flow, save_tokens, start_device_flow
+
+    click.echo(f"Starting device-flow login with {provider}...")
+    try:
+        flow = start_device_flow(provider)
+    except Exception as exc:
+        click.echo(f"Login failed: {exc}", err=True)
+        sys.exit(1)
+
+    click.echo(f"\nOpen this URL in your browser:\n\n  {flow['verification_uri']}\n")
+    click.echo(f"Enter code: {flow['user_code']}\n")
+    click.echo("Waiting for authorization...", nl=False)
+
+    try:
+        tokens = poll_device_flow(provider, flow["device_code"], flow["interval"])
+    except TimeoutError:
+        click.echo("\nLogin timed out. Please try again.")
+        sys.exit(1)
+    except Exception as exc:
+        click.echo(f"\nLogin failed: {exc}", err=True)
+        sys.exit(1)
+
+    save_tokens(tokens)
+    click.echo(" done!")
+
+    # Fetch and store license
+    try:
+        from grit.cloud.client import GritCloudClient
+        client = GritCloudClient()
+        license_data = client.get_license_status()
+        from grit.config.subscription import save_license
+        save_license(license_data["token"], license_data["claims"])
+        tier = license_data["claims"].get("tier", "free")
+        click.echo(f"Logged in. Plan: {tier.upper()}")
+    except Exception as exc:
+        click.echo(f"Could not fetch license: {exc}", err=True)
+
+
+@auth.command("logout")
+def logout() -> None:
+    """Log out and remove stored credentials."""
+    from grit.config.subscription import require_pro_installed
+    require_pro_installed("Grit Cloud login")
+    from grit.cloud.auth import clear_tokens
+    from grit.config.subscription import clear_license
+    clear_tokens()
+    clear_license()
+    click.echo("Logged out. Grit will operate in free tier mode.")
+
+
+@auth.command("status")
+@click.option("--json", "as_json", is_flag=True)
+def status(as_json: bool) -> None:
+    """Show current authentication and subscription status."""
+    from grit.config.subscription import require_pro_installed
+    require_pro_installed("Grit Cloud login")
+    from grit.cloud.auth import load_tokens
+    from grit.config.subscription import load_license
+
+    tokens = load_tokens()
+    lic = load_license()
+
+    if as_json:
+        data = {
+            "authenticated": tokens is not None,
+            "tier": lic.tier,
+            "email": lic.email,
+            "expires_at": lic.expires_at,
+            "is_valid": lic.is_valid,
+            "in_grace_period": lic.is_in_grace_period,
+        }
+        click.echo(json.dumps(data, indent=2))
+        return
+
+    if not tokens:
+        click.echo("Not logged in. Run `grit auth login` to authenticate.")
+    else:
+        click.echo(f"Logged in as: {lic.email or 'unknown'}")
+
+    click.echo(f"Plan:         {lic.tier.upper()}")
+    click.echo(f"Expires:      {lic.expires_at}")
+    if lic.is_in_grace_period:
+        click.echo("  (License expired — within 30-day grace period)")
+    elif not lic.is_valid:
+        click.echo("  (License expired — operating in free tier)")
+    click.echo(f"Profile limit: {'unlimited' if lic.profile_limit == -1 else lic.profile_limit}")
+    click.echo(f"Cloud sync:   {'yes' if lic.allows_cloud_sync() else 'no (Pro)'}")
+    click.echo(f"Team profiles:{'yes' if lic.allows_team_profiles() else 'no (Pro)'}")

grit/cli/cmd_compliance.py

@@ -0,0 +1,109 @@
+"""CLI commands: grit compliance <subcommand>
+
+Enterprise compliance reporting.
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+import click
+
+
+@click.group("compliance")
+def compliance() -> None:
+    """Enterprise compliance checks and reporting."""
+
+
+@compliance.command("report")
+@click.option("--since", default=None, metavar="ISO_DATETIME",
+              help="Include audit events since this ISO timestamp.")
+@click.option("--output", "-o", default=None, metavar="FILE",
+              help="Write JSON report to FILE (default: print to stdout).")
+@click.option("--json", "as_json", is_flag=True, help="Always output raw JSON.")
+def report(since: str, output: str, as_json: bool) -> None:
+    """Generate a compliance report (hooks, GPG, SSO, audit summary)."""
+    from grit.enterprise.compliance import generate_report, write_report
+
+    if output:
+        path = Path(output)
+        data = write_report(path, since=since)
+        click.echo(f"Report written to {output} (compliant={data['compliant']})")
+        if not data["compliant"]:
+            sys.exit(1)
+        return
+
+    data = generate_report(since=since)
+
+    if as_json:
+        click.echo(json.dumps(data, indent=2))
+        return
+
+    click.echo(f"Compliance report — {data['generated_at']}")
+    click.echo(f"Overall: {'PASS' if data['compliant'] else 'FAIL'}")
+    click.echo("")
+
+    hooks = data["sections"].get("hook_inventory", {})
+    click.echo(
+        f"Hook inventory:  {hooks.get('hooks_installed', '?')}/"
+        f"{hooks.get('total_repos', '?')} repos have Grit hook"
+    )
+    if hooks.get("missing_repos"):
+        for r in hooks["missing_repos"]:
+            click.echo(f"  MISSING  {r}")
+
+    gpg = data["sections"].get("gpg_enforcement", {})
+    click.echo(
+        f"GPG signing:     {gpg.get('gpg_enabled', '?')}/"
+        f"{gpg.get('total_profiles', '?')} profiles have GPG key"
+    )
+    if gpg.get("profiles_without_gpg"):
+        for name in gpg["profiles_without_gpg"]:
+            click.echo(f"  NO GPG   {name}")
+
+    sso = data["sections"].get("sso_compliance", {})
+    click.echo(
+        f"SSO:             configured={sso.get('sso_configured', '?')}  "
+        f"enforce={sso.get('enforce_sso', '?')}  "
+        f"active_session={sso.get('active_sso_session', '?')}"
+    )
+
+    audit = data["sections"].get("audit_summary", {})
+    click.echo(f"Audit events:    {audit.get('total_events', 0)} total")
+    for action, count in audit.get("by_action", {}).items():
+        click.echo(f"  {action}: {count}")
+
+    if not data["compliant"]:
+        sys.exit(1)
+
+
+@compliance.command("hooks")
+def hooks() -> None:
+    """Check Grit hook installation across all watched repositories."""
+    from grit.enterprise.compliance import check_hook_inventory
+
+    result = check_hook_inventory()
+    status = "OK" if result["hooks_missing"] == 0 else "FAIL"
+    click.echo(
+        f"[{status}] {result['hooks_installed']}/{result['total_repos']} repos have hook installed"
+    )
+    for repo in result.get("missing_repos", []):
+        click.echo(f"  MISSING: {repo}")
+    if result["hooks_missing"]:
+        sys.exit(1)
+
+
+@compliance.command("gpg")
+def gpg() -> None:
+    """Check GPG signing configuration across all profiles."""
+    from grit.enterprise.compliance import check_gpg_enforcement
+
+    result = check_gpg_enforcement()
+    status = "OK" if result["gpg_missing"] == 0 else "WARN"
+    click.echo(
+        f"[{status}] {result['gpg_enabled']}/{result['total_profiles']} profiles have GPG key"
+    )
+    for name in result.get("profiles_without_gpg", []):
+        click.echo(f"  NO GPG: {name}")

grit/cli/cmd_config.py

@@ -0,0 +1,76 @@
+"""CLI commands: grit config <subcommand>"""
+
+from __future__ import annotations
+
+import json
+import sys
+
+import click
+
+from grit.config.app_config import AppConfig
+
+
+@click.group("config")
+def config() -> None:
+    """Get or set Grit application configuration."""
+
+
+@config.command("get")
+@click.argument("key")
+@click.option("--json", "as_json", is_flag=True)
+def get(key: str, as_json: bool) -> None:
+    """Get a configuration value."""
+    cfg = AppConfig.load()
+    if not hasattr(cfg, key):
+        click.echo(f"Unknown config key: {key!r}", err=True)
+        sys.exit(1)
+    value = getattr(cfg, key)
+    if as_json:
+        click.echo(json.dumps({key: value}))
+    else:
+        click.echo(f"{key} = {value}")
+
+
+@config.command("set")
+@click.argument("key")
+@click.argument("value")
+def set_config(key: str, value: str) -> None:
+    """Set a configuration value."""
+    cfg = AppConfig.load()
+    if not hasattr(cfg, key):
+        click.echo(f"Unknown config key: {key!r}", err=True)
+        sys.exit(1)
+    # Coerce value to the field's type
+    field_type = type(getattr(cfg, key))
+    try:
+        coerced = value.lower() in ("true", "1", "yes") if field_type is bool else field_type(value)
+    except (ValueError, TypeError) as exc:
+        click.echo(f"Invalid value for {key!r}: {exc}", err=True)
+        sys.exit(1)
+    setattr(cfg, key, coerced)
+    cfg.save()
+    click.echo(f"Set {key} = {coerced}")
+
+
+@config.command("reset")
+@click.option("--force", is_flag=True, help="Skip confirmation.")
+def reset(force: bool) -> None:
+    """Reset all configuration to defaults."""
+    if not force:
+        click.confirm("Reset all configuration to defaults?", abort=True)
+    AppConfig().save()
+    click.echo("Configuration reset to defaults.")
+
+
+@config.command("list")
+@click.option("--json", "as_json", is_flag=True)
+def list_config(as_json: bool) -> None:
+    """Show all configuration values."""
+    cfg = AppConfig.load()
+    from dataclasses import asdict
+    data = asdict(cfg)
+    if as_json:
+        click.echo(json.dumps(data, indent=2))
+        return
+    for k, v in data.items():
+        click.echo(f"  {k} = {v}")

grit/cli/cmd_credential.py

@@ -0,0 +1,142 @@
+"""CLI commands: grit credential <subcommand>
+
+Manages per-profile HTTPS credentials in the OS credential store so that
+git push/pull authenticates as the right GitHub account when a Grit session
+is active.
+"""
+
+from __future__ import annotations
+
+import sys
+
+import click
+
+from grit.exceptions import GritError, ProfileNotFoundError
+from grit.models.profile import Profile
+from grit.storage.profile_store import ProfileStore
+
+
+@click.group()
+def credential() -> None:
+    """Manage HTTPS credentials for Git profiles."""
+
+
+def _store() -> ProfileStore:
+    return ProfileStore()
+
+
+def _require_http_username(profile_name: str) -> tuple[Profile, str]:
+    """Load profile and return (profile, http_username), exiting on error."""
+    store = _store()
+    try:
+        p = store.get_by_name(profile_name)
+    except ProfileNotFoundError as exc:
+        click.echo(str(exc), err=True)
+        sys.exit(1)
+
+    if not p.http_username:
+        click.echo(
+            f"Profile {profile_name!r} has no HTTP username set.\n"
+            f"Set one first with:\n\n"
+            f"  grit profile edit {profile_name} --http-username <your-github-username>\n",
+            err=True,
+        )
+        sys.exit(1)
+
+    return p, p.http_username
+
+
+@credential.command("login")
+@click.argument("profile_name", metavar="PROFILE")
+@click.option(
+    "--host", default="github.com", show_default=True, help="Git host to authenticate with."
+)
+def login(profile_name: str, host: str) -> None:
+    """Open a browser to authenticate with GitHub and store the credential.
+
+    Triggers GitHub's device flow: a browser tab opens with the authorization
+    code pre-filled so you just need to click Authorize.
+    """
+    from grit.git.credentials import github_browser_login, store_credential
+
+    p, username = _require_http_username(profile_name)
+
+    click.echo(f"Authenticating profile {profile_name!r} ({username}@{host}) via browser...")
+    try:
+        token = github_browser_login(username_hint=username)
+    except GritError as exc:
+        click.echo(str(exc), err=True)
+        sys.exit(1)
+
+    try:
+        store_credential(host, username, token)
+    except GritError as exc:
+        click.echo(f"Failed to store credential: {exc}", err=True)
+        sys.exit(1)
+
+    click.echo(f"Authorized as {username} — credential stored.")
+    click.echo(f"\nNext time you run `grit session set {profile_name}`, git push will")
+    click.echo(f"authenticate as {username} automatically.")
+
+
+@credential.command("set")
+@click.argument("profile_name", metavar="PROFILE")
+@click.option("--token", required=True, prompt=True, hide_input=True, help="Personal access token.")
+@click.option("--host", default="github.com", show_default=True, help="Git host.")
+def set_credential(profile_name: str, token: str, host: str) -> None:
+    """Store a Personal Access Token for a profile (manual alternative to login).
+
+    Use `grit credential login` for the browser-based flow instead.
+    """
+    from grit.git.credentials import store_credential
+
+    p, username = _require_http_username(profile_name)
+
+    try:
+        store_credential(host, username, token)
+    except GritError as exc:
+        click.echo(f"Failed to store credential: {exc}", err=True)
+        sys.exit(1)
+
+    click.echo(f"Credential stored for {username}@{host}.")
+
+
+@credential.command("clear")
+@click.argument("profile_name", metavar="PROFILE")
+@click.option("--host", default="github.com", show_default=True, help="Git host.")
+def clear(profile_name: str, host: str) -> None:
+    """Remove the stored credential for a profile."""
+    from grit.git.credentials import delete_credential
+
+    p, username = _require_http_username(profile_name)
+
+    delete_credential(host, username)
+    click.echo(f"Credential for {username}@{host} cleared.")
+
+
+@credential.command("show")
+@click.argument("profile_name", metavar="PROFILE")
+@click.option("--host", default="github.com", show_default=True, help="Git host.")
+def show(profile_name: str, host: str) -> None:
+    """Show whether a credential is stored for a profile (never shows the value)."""
+    from grit.git.credentials import has_credential
+
+    store = _store()
+    try:
+        p = store.get_by_name(profile_name)
+    except ProfileNotFoundError as exc:
+        click.echo(str(exc), err=True)
+        sys.exit(1)
+
+    click.echo(f"\n[{p.name}]")
+    click.echo(f"  HTTP user:         {p.http_username or '(not set)'}")
+    click.echo(f"  Host:              {host}")
+
+    if not p.http_username:
+        click.echo("  Credential stored: N/A (no HTTP username configured)")
+        return
+
+    stored = has_credential(host, p.http_username)
+    click.echo(f"  Credential stored: {'Yes' if stored else 'No'}")
+    if not stored:
+        click.echo(f"\n  Run `grit credential login {profile_name}` to authenticate.")

grit/cli/cmd_daemon.py

@@ -0,0 +1,106 @@
+"""CLI commands: grit daemon <subcommand>"""
+
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+
+import click
+
+from grit.daemon import pid as pid_mod
+from grit.exceptions import DaemonNotRunningError
+
+
+@click.group()
+def daemon() -> None:
+    """Control the Grit background daemon."""
+
+
+@daemon.command("start")
+@click.option("--foreground", "-f", is_flag=True, help="Run in foreground (don't daemonise).")
+@click.option("--verbose", "-v", is_flag=True)
+def start(foreground: bool, verbose: bool) -> None:
+    """Start the Grit daemon."""
+    running = pid_mod.get_running_pid()
+    if running:
+        click.echo(f"Daemon already running (PID {running}).")
+        return
+
+    cmd = [sys.executable, "-m", "grit.daemon.server"]
+    if verbose:
+        cmd.append("--verbose")
+
+    if foreground:
+        import os
+        os.execv(sys.executable, cmd)  # replace current process
+    else:
+        proc = subprocess.Popen(
+            cmd,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            start_new_session=True,
+        )
+        click.echo(f"Daemon started (PID {proc.pid}).")
+
+
+@daemon.command("stop")
+def stop() -> None:
+    """Stop the running daemon."""
+    import os
+    import signal as sig_mod
+    running = pid_mod.get_running_pid()
+    if not running:
+        click.echo("Daemon is not running.")
+        return
+    try:
+        os.kill(running, sig_mod.SIGTERM)
+        click.echo(f"Sent SIGTERM to daemon (PID {running}).")
+    except OSError as exc:
+        click.echo(f"Could not stop daemon: {exc}", err=True)
+        sys.exit(1)
+
+
+@daemon.command("status")
+@click.option("--json", "as_json", is_flag=True)
+def status(as_json: bool) -> None:
+    """Show daemon status."""
+    from grit.ipc.client import send_request
+    running = pid_mod.get_running_pid()
+    if not running:
+        if as_json:
+            click.echo(json.dumps({"running": False}))
+        else:
+            click.echo("Daemon is not running.")
+        sys.exit(2)
+    try:
+        resp = send_request("daemon-status")
+        info = resp.get("payload", {})
+    except DaemonNotRunningError:
+        info = {}
+
+    if as_json:
+        click.echo(json.dumps({"running": True, **info}))
+        return
+    click.echo(f"Daemon running (PID {running})")
+    if info:
+        click.echo(f"  Version:         {info.get('version', '?')}")
+        click.echo(f"  Active sessions: {info.get('active_sessions', '?')}")
+        click.echo(f"  Profiles:        {info.get('profile_count', '?')}")
+
+
+@daemon.command("restart")
+@click.pass_context
+def restart(ctx: click.Context) -> None:
+    """Restart the daemon (stop then start)."""
+    import time
+    ctx.invoke(stop)
+    # SIGTERM is asynchronous — wait until the process is actually gone
+    for _ in range(50):  # up to 5 seconds
+        time.sleep(0.1)
+        if not pid_mod.get_running_pid():
+            break
+    else:
+        click.echo("Timed out waiting for daemon to stop.", err=True)
+        sys.exit(1)
+    ctx.invoke(start)