ground-control-cli 0.3.0__tar.gz → 0.5.0__tar.gz

{ground_control_cli-0.3.0 → ground_control_cli-0.5.0}/PKG-INFO

@@ -1,5 +1,5 @@
 Metadata-Version: 2.4
 Name: ground-control-cli
-Version: 0.3.0
+Version: 0.5.0
 Summary: What runs on a developer's machine: the command line and the agent's plugin.
 Requires-Python: >=3.12

{ground_control_cli-0.3.0 → ground_control_cli-0.5.0}/claude.py

@@ -181,10 +181,10 @@ def installed(store: Store) -> str | None:
 
 
 def _registered(store: Store) -> bool:
-    """Whether Claude Code knows the store."""
+    """Whether Claude Code knows the store; not when Claude Code cannot say."""
     try:
         listed = json.loads(_ran("plugin", "marketplace", "list", "--json") or "[]")
-    except ValueError:
+    except (ValueError, ClaudeError):
         return False
     return any(m.get("name") == store.name for m in listed)
 
@@ -301,9 +301,90 @@ def _in(folder: str, *args: str) -> str:
     return ""
 
 
-# The settings files whose `disableAllHooks` turns every hook off, and the managed one, whose
-# `allowManagedHooksOnly` turns the plugin's off.
-MANAGED_SETTINGS = Path("/Library/Application Support/ClaudeCode/managed-settings.json")
+# The plugin's name, as its manifest in claude-code/ gives it.
+PLUGIN = "groundcontrol"
+# Claude Code's managed settings on a Mac: a configuration profile (MDM) of the domain
+# com.anthropic.claudecode, and the system folder's file with its drop-ins. Only the first of
+# them that holds a policy applies; the profile comes first.
+MANAGED_FOLDER = Path("/Library/Application Support/ClaudeCode")
+MANAGED_SETTINGS = MANAGED_FOLDER / "managed-settings.json"
+MANAGED_DROP_INS = MANAGED_FOLDER / "managed-settings.d"
+MANAGED_PROFILE = Path("/Library/Managed Preferences/com.anthropic.claudecode.plist")
+# The keys that are no policy of their own: a source holding only these does not apply.
+CONTROL_KEYS = ("wslInheritsWindowsSettings", "managedSourcesBehavior")
+# What the lock is read from in the managed settings, by the name the facts give it.
+LOCK_KEYS = {
+    "disable_all_hooks": "disableAllHooks",
+    "allow_managed_hooks_only": "allowManagedHooksOnly",
+    "disable_sideload_flags": "disableSideloadFlags",
+}
+
+
+def _profile() -> dict:
+    """The managed configuration profile, as JSON; {} when there is none."""
+    if not MANAGED_PROFILE.is_file():
+        return {}
+    try:
+        done = subprocess.run(
+            ["plutil", "-convert", "json", "-o", "-", str(MANAGED_PROFILE)],
+            capture_output=True,
+            text=True,
+            timeout=10,
+        )
+        found = json.loads(done.stdout) if done.returncode == 0 else {}
+    except (OSError, ValueError, subprocess.TimeoutExpired):
+        return {}
+    return found if isinstance(found, dict) else {}
+
+
+def _policy(found: dict) -> bool:
+    return any(k not in CONTROL_KEYS for k in found)
+
+
+def managed() -> tuple[str, dict]:
+    """The managed settings that apply on this machine, and where they come from.
+
+    Returns:
+        ("profile", its settings), ("file", the file's with its drop-ins over it, in their
+        order), or ("none", {}).
+
+    Company: assumes none.
+    """
+    profile = _profile()
+    if _policy(profile):
+        return "profile", profile
+    found = _read(MANAGED_SETTINGS)
+    try:
+        drop_ins = sorted(MANAGED_DROP_INS.glob("*.json"))
+    except OSError:
+        drop_ins = []
+    for target in drop_ins:
+        found |= _read(target)
+    return ("file", found) if _policy(found) else ("none", {})
+
+
+def lock_facts() -> dict:
+    """What the managed settings hold of the plugin and its hooks, and whether its store is here.
+
+    Facts only, for the service to decide whether the machine is locked: where the managed
+    settings come from, what their `enabledPlugins` say of any plugin named groundcontrol, their
+    keys that turn hooks or sideloading off, and the store Claude Code knows, if any.
+
+    Company: assumes none.
+    """
+    source, found = managed()
+    plugins = found.get("enabledPlugins")
+    plugins = plugins if isinstance(plugins, dict) else {}
+    store = read_store()
+    known = store is not None and _registered(store)
+    return {
+        "source": source,
+        "plugins": {
+            k: v for k, v in plugins.items() if k.split("@")[0] == PLUGIN and isinstance(v, bool)
+        },
+        **{name: found.get(key) for name, key in LOCK_KEYS.items()},
+        "store": {"name": store.name, "plugin": store.plugin} if known and store else None,
+    }
 
 
 def config_dir() -> Path:
@@ -325,7 +406,7 @@ def hooks_off(root) -> list[str]:
 
     `disableAllHooks` is read where Claude Code reads it first: the managed settings, then the
     repo's local settings, its settings, and the person's; the managed settings'
-    `allowManagedHooksOnly` turns the plugin's hooks off too.
+    `allowManagedHooksOnly` turns the plugin's hooks off too, unless they force the plugin on.
 
     Args:
         root: The repo's top folder.
@@ -335,11 +416,16 @@ def hooks_off(root) -> list[str]:
 
     Company: assumes none.
     """
-    managed = _read(MANAGED_SETTINGS)
-    if managed.get("allowManagedHooksOnly") is True:
-        return [str(MANAGED_SETTINGS)]
+    source, policy = managed()
+    where = str(MANAGED_PROFILE if source == "profile" else MANAGED_SETTINGS)
+    forced = policy.get("enabledPlugins") if isinstance(policy.get("enabledPlugins"), dict) else {}
+    if policy.get("allowManagedHooksOnly") is True and not any(
+        v is True and k.split("@")[0] == PLUGIN for k, v in forced.items()
+    ):
+        return [where]
+    if "disableAllHooks" in policy:
+        return [where] if policy["disableAllHooks"] is True else []
     for target in (
-        MANAGED_SETTINGS,
         Path(root) / ".claude" / "settings.local.json",
         Path(root) / ".claude" / "settings.json",
         config_dir() / "settings.json",

{ground_control_cli-0.3.0 → ground_control_cli-0.5.0}/cli.py

@@ -7,9 +7,13 @@ saying in one line what it does at each step; the person only approves in the br
 (client/hooks.py); at a session's start (`hook session-start`, or `session-start`) the client
 updates itself and the plugin, removes the old engineering plugin, finds the repo's company,
 and sends its queue; it is silent unless something needs the person. `groundcontrol repo` says
-which company the repo here is of, or what is missing. `groundcontrol remove` removes it all
-from the machine. `send` and `down` run in the background, started by the hooks: the queue's
-sender, and the environments a session brought up taken down.
+which company the repo here is of, or what is missing. `groundcontrol machines` lists the
+company's connected machines and whether Claude Code's managed settings lock the plugin on in
+each, and `groundcontrol policy` prints the policy for the company's IT to deploy; both for a
+person with manage_machines. `groundcontrol remove` sends what the queue holds, then removes it
+all from the machine, saying how many rows of the method log could not be sent. `send` and
+`down` run in the background, started by the hooks: the queue's sender, and the environments a
+session brought up taken down.
 """
 
 from __future__ import annotations
@@ -142,6 +146,7 @@ def _connect(door: str, address: str, here: system.System) -> Service | None:
         say(f"Stopped: {e}.")
         return None
     machine.remember_company(company_address, door)
+    queue.resume(company_address, connected=True)
     say("Approved. The key is in the keychain, and in no file.")
     return Service(company_address, key, TIMEOUT)
 
@@ -242,6 +247,22 @@ def remove() -> int:
     except system.Unsupported as e:
         say(f"Stopped: {e}.")
         return 1
+    try:
+        queue.flush(_service_for, wait=TIMEOUT)
+    except ServiceError as e:
+        say(f"The queue could not all be sent: {e.detail}.")
+    if queue.waiting():
+        dropped, untold = queue.drop_all(_service_for)
+        if dropped - untold:
+            say(
+                f"{dropped - untold} rows of the method log could not be sent, and are dropped; "
+                "the service was told which."
+            )
+        if untold:
+            say(
+                f"{untold} rows of the method log could not be sent, and are dropped; the service "
+                "could not be told which, so features they belong to cannot pass their gate."
+            )
     for address in machine.load()["companies"]:
         called = machine.service(address, here)
         if called is not None:
@@ -267,6 +288,73 @@ def remove() -> int:
     return 0
 
 
+def _company_here(root: Path) -> Service | None:
+    """The company of the repo here, or the one company this machine is connected to."""
+    here = _system()
+    found = machine.find(root, here, known_only=True)
+    if isinstance(found, machine.Found):
+        return found.service
+    companies = machine.load()["companies"]
+    return machine.service(companies[0], here) if len(companies) == 1 else None
+
+
+def machines(root: Path, unlocked: bool) -> int:
+    """List the company's connected machines, and whether the plugin is locked on in each.
+
+    Company: the repo's here, or the one connected.
+    """
+    try:
+        called = _company_here(root)
+    except system.Unsupported as e:
+        say(f"Stopped: {e}.")
+        return 1
+    if called is None:
+        say("Stopped: run it in a repo of the company, or connect this machine to one company.")
+        return 1
+    try:
+        found = called.machines(unlocked)
+    except ServiceError as e:
+        say(f"Stopped: {called.address}: {e.detail}")
+        return 1
+    if not found:
+        say("Every connected machine is locked." if unlocked else "No machine is connected.")
+        return 0
+    for m in found:
+        state = {True: "locked", False: "not locked", None: "never said"}[m["locked"]]
+        said = (m["lock_checked_at"] or "")[:16].replace("T", " ")
+        when = f", said {said}" if said else ""
+        say(f"{m['name']} ({m['person']}): {state}{when}")
+    return 0
+
+
+def policy(root: Path) -> int:
+    """Print the policy for Claude Code's managed settings, for the company's IT to deploy.
+
+    Company: the repo's here, or the one connected.
+    """
+    try:
+        called = _company_here(root)
+    except system.Unsupported as e:
+        say(f"Stopped: {e}.")
+        return 1
+    if called is None:
+        say("Stopped: run it in a repo of the company, or connect this machine to one company.")
+        return 1
+    try:
+        found = called.policy()
+    except ServiceError as e:
+        say(f"Stopped: {called.address}: {e.detail}")
+        return 1
+    print(json.dumps(found["settings"], indent=2))
+    print(
+        f"Deploy it as {found['file']}, or as a configuration profile of the domain "
+        f"{found['profile_domain']}, on every machine. `claude --bare` still starts Claude Code "
+        "without plugins or hooks; no policy stops it.",
+        file=sys.stderr,
+    )
+    return 0
+
+
 def save_store(target: str) -> int:
     """Save the plugin's store as a zip, for a machine that installs it from an archive.
 
@@ -315,6 +403,14 @@ def _service_for(address: str) -> Service | None:
         return None
 
 
+def _notify(line: str) -> None:
+    """Show the person a line from the background: the system's notification."""
+    try:
+        _system().notify(line)
+    except system.Unsupported:
+        pass
+
+
 def method(argv: list[str], root: Path) -> int:
     """`gctl method <command>`: run one of the method's commands on the repo's company's service.
 
@@ -342,7 +438,7 @@ def method(argv: list[str], root: Path) -> int:
         return 1
     top = hooks._git(str(root), "rev-parse", "--show-toplevel") or str(root)
     try:
-        queue.flush(_service_for, found.service.address)
+        queue.flush(_service_for, found.service.address, TIMEOUT)
         done = found.service.method(found.repo, argv, str(root), claude.hooks_off(top))
     except ServiceError as e:
         print(f"refused: {found.service.address}: {e.detail}", file=sys.stderr)
@@ -373,6 +469,9 @@ def main(argv: list[str] | None = None) -> int:
     commands.add_parser("session-start", help="what the plugin's hook runs as a session starts")
     hooked = commands.add_parser("hook", help="what the plugin's hooks run")
     hooked.add_argument("event", choices=HOOKS)
+    hooked.add_argument(
+        "--wait", type=float, default=0, help="how long to go on asking, as the plugin gives it"
+    )
     method_p = commands.add_parser(
         "method", help="run one of the method's commands", add_help=False
     )
@@ -381,6 +480,11 @@ def main(argv: list[str] | None = None) -> int:
     down_p = commands.add_parser("down", help="take down what sessions brought up under a folder")
     down_p.add_argument("folder")
     commands.add_parser("repo", help="say which company the repo here is of")
+    listed = commands.add_parser(
+        "machines", help="the company's machines, and whether the plugin is locked on in each"
+    )
+    listed.add_argument("--unlocked", action="store_true", help="only those not locked")
+    commands.add_parser("policy", help="the managed-settings policy for the company's IT")
     commands.add_parser("remove", help="remove it all from this machine")
     saved = commands.add_parser("store", help="save the plugin's store as an archive")
     saved.add_argument("file")
@@ -400,12 +504,12 @@ def main(argv: list[str] | None = None) -> int:
                 print(json.dumps({"systemMessage": " ".join(lines)}))
             return 0
         if args.command == "hook":
-            code, out = hooks.run(args.event, _event())
+            code, out = hooks.run(args.event, _event(), args.wait)
             if out:
                 print(out)
             return code
         if args.command == "send":
-            queue.send_until_empty(_service_for)
+            queue.send_until_empty(_service_for, tell=_notify)
             return 0
         if args.command == "down":
             health.down_all(args.folder)
@@ -414,6 +518,10 @@ def main(argv: list[str] | None = None) -> int:
             return repo(Path.cwd())
         if args.command == "remove":
             return remove()
+        if args.command == "machines":
+            return machines(Path.cwd(), args.unlocked)
+        if args.command == "policy":
+            return policy(Path.cwd())
         return save_store(args.file)
     except KeyboardInterrupt:
         say("Stopped.")