healthcloud-cli 3.6.0__tar.gz → 3.7.0__tar.gz

{healthcloud_cli-3.6.0 → healthcloud_cli-3.7.0}/.gitignore

@@ -260,3 +260,5 @@ integration-tests/shared/test-assets/
 .ralph/
 /PROMPT.md
 .blind-peer-review/
+# Terraform CI runner-local diagnostics, inputs and sensitive plan bundles.
+/.kb-ci/

{healthcloud_cli-3.6.0 → healthcloud_cli-3.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: healthcloud-cli
-Version: 3.6.0
+Version: 3.7.0
 Summary: Command-line interface for the HealthCloud MCP gateway, generated from the shared MCP tool manifest.
 Project-URL: Issues, https://github.com/healthcloudservices/healthcloud-services/issues
 Project-URL: Repository, https://github.com/healthcloudservices/healthcloud-services
@@ -897,8 +897,8 @@ Policies have an `active` lifecycle flag, so `activate` and `deactivate`
 commands exist (they PUT the `active` field):
 
 ```bash
-uv run --frozen hc ams policies create --environment dev --tenant-id TENANT_ID --name "Appointment Safety" --department-id DEPARTMENT_ID --created-by-user-id ADMIN_USER_ID [--description TEXT] [--content TEXT] [--guardrail-ids GUARDRAIL_ID ...]
-uv run --frozen hc ams policies update --environment dev --tenant-id TENANT_ID --policy-id POLICY_ID [--name NAME] [--description TEXT] [--content TEXT] [--guardrail-ids GUARDRAIL_ID ... | --clear-guardrail-ids]
+uv run --frozen hc ams policies create --environment dev --tenant-id TENANT_ID --name "Appointment Safety" --department-id DEPARTMENT_ID --created-by-user-id ADMIN_USER_ID [--description TEXT] [--content TEXT | --content-file PATH] [--guardrail-ids GUARDRAIL_ID ...]
+uv run --frozen hc ams policies update --environment dev --tenant-id TENANT_ID --policy-id POLICY_ID [--name NAME] [--description TEXT] [--content TEXT | --content-file PATH] [--guardrail-ids GUARDRAIL_ID ... | --clear-guardrail-ids]
 uv run --frozen hc ams policies activate --environment dev --tenant-id TENANT_ID --policy-id POLICY_ID
 uv run --frozen hc ams policies deactivate --environment dev --tenant-id TENANT_ID --policy-id POLICY_ID
 uv run --frozen hc ams policies delete --environment dev --tenant-id TENANT_ID --policy-id POLICY_ID
@@ -911,6 +911,29 @@ uv run --frozen hc ams policies delete --environment dev --tenant-id TENANT_ID -
   server does not validate that `--guardrail-ids` reference real guardrails
   (blank guardrail IDs are rejected client-side). `--content` is write-only:
   it is sent but never echoed back.
+- The protected policy content can also arrive from an owner-only file, which
+  keeps it out of the command line entirely (argv, the process table under
+  `ps`/`/proc/*/cmdline`, shell history and CI logs all see only the path):
+
+  ```bash
+  uv run --frozen hc ams policies create --environment dev --tenant-id TENANT_ID --name "Appointment Safety" --department-id DEPARTMENT_ID --created-by-user-id ADMIN_USER_ID --content-file PATH
+  uv run --frozen hc ams policies update --environment dev --tenant-id TENANT_ID --policy-id POLICY_ID --content-file PATH
+  ```
+
+  The file is read locally, before the login check and any request, by the same
+  reader the sessions commands use: it must be a readable owner-only regular
+  text file (no symlinks, no directories, not group- or world-readable) and
+  must hold 1-20000 characters. Its content is never printed, and an invalid,
+  empty or oversized file is refused locally with a message that names the
+  discipline, never the text. The output is identical to the inline form:
+  `policies.create` / `policies.update` with `data.policy`.
+- Exactly one content source is accepted per write: passing `--content` with
+  `--content-file` is a usage error (exit 2) that sends nothing. The inline
+  `--content` flag remains supported for convenience and remains exposed in
+  argv, the process table and shell history — use the file channel for
+  anything sensitive. An empty `--content ""` on `update` is still the
+  documented clear; an empty `--content-file` is a `validation` refusal, so a
+  truncated or misdirected file can never clear protected content by accident.
 - `update` sends only the options you pass (an empty `--description ""` or
   `--content ""` clears it; `--clear-guardrail-ids` sends an explicit empty
   list to clear the policy's guardrail bindings); it refuses with exit 1
@@ -947,9 +970,9 @@ is refused locally:
 ```bash
 uv run --frozen hc ams sessions list --environment dev --tenant-id TENANT_ID [--limit N]
 uv run --frozen hc ams sessions get --environment dev --tenant-id TENANT_ID --session-id SESSION_ID
-uv run --frozen hc ams sessions create --environment dev --tenant-id TENANT_ID [--agent-id AGENT_ID] [--mode plan|implement] [--initial-prompt TEXT]
+uv run --frozen hc ams sessions create --environment dev --tenant-id TENANT_ID [--agent-id AGENT_ID] [--mode plan|implement] [--initial-prompt TEXT | --initial-prompt-file PATH]
 uv run --frozen hc ams sessions messages list --environment dev --tenant-id TENANT_ID --session-id SESSION_ID [--limit N]
-uv run --frozen hc ams sessions messages add --environment dev --tenant-id TENANT_ID --session-id SESSION_ID --content TEXT [--mode plan|implement] [--idempotency-key KEY]
+uv run --frozen hc ams sessions messages add --environment dev --tenant-id TENANT_ID --session-id SESSION_ID [--content TEXT | --content-file PATH] [--mode plan|implement] [--idempotency-key KEY]
 ```
 
 - `list` emits `operation: "sessions.list"`, `data.sessions` (bounded projections
@@ -966,6 +989,30 @@ uv run --frozen hc ams sessions messages add --environment dev --tenant-id TENAN
   mode, plan ID, model, timestamps) plus `data.idempotency_key` when a key was
   supplied. Protected free text — `--initial-prompt` and `--content` — is sent to
   the server but never appears in the envelope, a refusal, a diagnostic or a log.
+- The protected free text can also arrive from an owner-only file, which keeps it
+  out of the command line entirely (argv, the process table under
+  `ps`/`/proc/*/cmdline`, shell history and CI logs all see only the path):
+
+  ```bash
+  uv run --frozen hc ams sessions create --environment dev --tenant-id TENANT_ID --initial-prompt-file PATH
+  uv run --frozen hc ams sessions messages add --environment dev --tenant-id TENANT_ID --session-id SESSION_ID --content-file PATH
+  ```
+
+  The file is read locally, before the login check and any request, by the same
+  reader `hc ams sessions plans generate --prompt-file` uses: it must be a
+  readable owner-only regular text file (no symlinks, no directories, not
+  group- or world-readable), and must hold 1-20000 characters — the same bound
+  the inline flag is now held to, so neither channel can carry an empty or
+  over-long value past the local check. Its content is never printed, and an
+  invalid, empty or oversized file is refused locally with a message that
+  names the discipline, never the text. The output is identical to the inline form: `sessions.create`
+  with `data.session`, `sessions.messages.add` with `data.message`.
+- Exactly one source is accepted per field. Passing `--initial-prompt` with
+  `--initial-prompt-file`, or `--content` with `--content-file`, is a usage
+  error (exit 2) that sends nothing; `messages add` with neither is the same
+  usage error. The inline `--initial-prompt` and `--content` flags remain
+  supported for convenience, and remain exposed in argv, the process table and
+  shell history — use the file channel for anything sensitive.
 - `--initial-prompt` becomes the session's first `user` message in the same
   server transaction; `hc ams sessions messages list` shows it afterwards.
 - `--mode implement` is not available from the server yet: `create` reports one

{healthcloud_cli-3.6.0 → healthcloud_cli-3.7.0}/README.md

@@ -879,8 +879,8 @@ Policies have an `active` lifecycle flag, so `activate` and `deactivate`
 commands exist (they PUT the `active` field):
 
 ```bash
-uv run --frozen hc ams policies create --environment dev --tenant-id TENANT_ID --name "Appointment Safety" --department-id DEPARTMENT_ID --created-by-user-id ADMIN_USER_ID [--description TEXT] [--content TEXT] [--guardrail-ids GUARDRAIL_ID ...]
-uv run --frozen hc ams policies update --environment dev --tenant-id TENANT_ID --policy-id POLICY_ID [--name NAME] [--description TEXT] [--content TEXT] [--guardrail-ids GUARDRAIL_ID ... | --clear-guardrail-ids]
+uv run --frozen hc ams policies create --environment dev --tenant-id TENANT_ID --name "Appointment Safety" --department-id DEPARTMENT_ID --created-by-user-id ADMIN_USER_ID [--description TEXT] [--content TEXT | --content-file PATH] [--guardrail-ids GUARDRAIL_ID ...]
+uv run --frozen hc ams policies update --environment dev --tenant-id TENANT_ID --policy-id POLICY_ID [--name NAME] [--description TEXT] [--content TEXT | --content-file PATH] [--guardrail-ids GUARDRAIL_ID ... | --clear-guardrail-ids]
 uv run --frozen hc ams policies activate --environment dev --tenant-id TENANT_ID --policy-id POLICY_ID
 uv run --frozen hc ams policies deactivate --environment dev --tenant-id TENANT_ID --policy-id POLICY_ID
 uv run --frozen hc ams policies delete --environment dev --tenant-id TENANT_ID --policy-id POLICY_ID
@@ -893,6 +893,29 @@ uv run --frozen hc ams policies delete --environment dev --tenant-id TENANT_ID -
   server does not validate that `--guardrail-ids` reference real guardrails
   (blank guardrail IDs are rejected client-side). `--content` is write-only:
   it is sent but never echoed back.
+- The protected policy content can also arrive from an owner-only file, which
+  keeps it out of the command line entirely (argv, the process table under
+  `ps`/`/proc/*/cmdline`, shell history and CI logs all see only the path):
+
+  ```bash
+  uv run --frozen hc ams policies create --environment dev --tenant-id TENANT_ID --name "Appointment Safety" --department-id DEPARTMENT_ID --created-by-user-id ADMIN_USER_ID --content-file PATH
+  uv run --frozen hc ams policies update --environment dev --tenant-id TENANT_ID --policy-id POLICY_ID --content-file PATH
+  ```
+
+  The file is read locally, before the login check and any request, by the same
+  reader the sessions commands use: it must be a readable owner-only regular
+  text file (no symlinks, no directories, not group- or world-readable) and
+  must hold 1-20000 characters. Its content is never printed, and an invalid,
+  empty or oversized file is refused locally with a message that names the
+  discipline, never the text. The output is identical to the inline form:
+  `policies.create` / `policies.update` with `data.policy`.
+- Exactly one content source is accepted per write: passing `--content` with
+  `--content-file` is a usage error (exit 2) that sends nothing. The inline
+  `--content` flag remains supported for convenience and remains exposed in
+  argv, the process table and shell history — use the file channel for
+  anything sensitive. An empty `--content ""` on `update` is still the
+  documented clear; an empty `--content-file` is a `validation` refusal, so a
+  truncated or misdirected file can never clear protected content by accident.
 - `update` sends only the options you pass (an empty `--description ""` or
   `--content ""` clears it; `--clear-guardrail-ids` sends an explicit empty
   list to clear the policy's guardrail bindings); it refuses with exit 1
@@ -929,9 +952,9 @@ is refused locally:
 ```bash
 uv run --frozen hc ams sessions list --environment dev --tenant-id TENANT_ID [--limit N]
 uv run --frozen hc ams sessions get --environment dev --tenant-id TENANT_ID --session-id SESSION_ID
-uv run --frozen hc ams sessions create --environment dev --tenant-id TENANT_ID [--agent-id AGENT_ID] [--mode plan|implement] [--initial-prompt TEXT]
+uv run --frozen hc ams sessions create --environment dev --tenant-id TENANT_ID [--agent-id AGENT_ID] [--mode plan|implement] [--initial-prompt TEXT | --initial-prompt-file PATH]
 uv run --frozen hc ams sessions messages list --environment dev --tenant-id TENANT_ID --session-id SESSION_ID [--limit N]
-uv run --frozen hc ams sessions messages add --environment dev --tenant-id TENANT_ID --session-id SESSION_ID --content TEXT [--mode plan|implement] [--idempotency-key KEY]
+uv run --frozen hc ams sessions messages add --environment dev --tenant-id TENANT_ID --session-id SESSION_ID [--content TEXT | --content-file PATH] [--mode plan|implement] [--idempotency-key KEY]
 ```
 
 - `list` emits `operation: "sessions.list"`, `data.sessions` (bounded projections
@@ -948,6 +971,30 @@ uv run --frozen hc ams sessions messages add --environment dev --tenant-id TENAN
   mode, plan ID, model, timestamps) plus `data.idempotency_key` when a key was
   supplied. Protected free text — `--initial-prompt` and `--content` — is sent to
   the server but never appears in the envelope, a refusal, a diagnostic or a log.
+- The protected free text can also arrive from an owner-only file, which keeps it
+  out of the command line entirely (argv, the process table under
+  `ps`/`/proc/*/cmdline`, shell history and CI logs all see only the path):
+
+  ```bash
+  uv run --frozen hc ams sessions create --environment dev --tenant-id TENANT_ID --initial-prompt-file PATH
+  uv run --frozen hc ams sessions messages add --environment dev --tenant-id TENANT_ID --session-id SESSION_ID --content-file PATH
+  ```
+
+  The file is read locally, before the login check and any request, by the same
+  reader `hc ams sessions plans generate --prompt-file` uses: it must be a
+  readable owner-only regular text file (no symlinks, no directories, not
+  group- or world-readable), and must hold 1-20000 characters — the same bound
+  the inline flag is now held to, so neither channel can carry an empty or
+  over-long value past the local check. Its content is never printed, and an
+  invalid, empty or oversized file is refused locally with a message that
+  names the discipline, never the text. The output is identical to the inline form: `sessions.create`
+  with `data.session`, `sessions.messages.add` with `data.message`.
+- Exactly one source is accepted per field. Passing `--initial-prompt` with
+  `--initial-prompt-file`, or `--content` with `--content-file`, is a usage
+  error (exit 2) that sends nothing; `messages add` with neither is the same
+  usage error. The inline `--initial-prompt` and `--content` flags remain
+  supported for convenience, and remain exposed in argv, the process table and
+  shell history — use the file channel for anything sensitive.
 - `--initial-prompt` becomes the session's first `user` message in the same
   server transaction; `hc ams sessions messages list` shows it afterwards.
 - `--mode implement` is not available from the server yet: `create` reports one

{healthcloud_cli-3.6.0 → healthcloud_cli-3.7.0}/healthcloud_cli/ams/output.py

@@ -6,11 +6,16 @@ import hashlib
 import json
 import os
 import stat
+from collections.abc import Callable
 from contextlib import contextmanager
 from pathlib import Path
 
 import click
 
+# One bound for every protected free-text field the CLI accepts, whichever
+# channel it arrives on (#834): the same value the server enforces.
+PROTECTED_TEXT_MAX_CHARS = 20000
+
 
 def canonical(value: object) -> str:
     return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False, allow_nan=False)
@@ -91,6 +96,57 @@ def read_private_text(path: Path, *, maximum: int) -> str:
         ) from None
 
 
+def protected_text(
+    inline: str | None,
+    path: str | None,
+    *,
+    flag: str,
+    file_flag: str,
+    refuse: Callable[[str, str], BaseException],
+    required: bool = False,
+    allow_empty_inline: bool = False,
+) -> str | None:
+    """Resolve one protected free-text field from exactly one input channel.
+
+    ``--<field>`` keeps working for convenience but lands in argv, the process
+    table and shell history; ``--<field>-file`` reads the same text from one
+    owner-only file instead. Exactly one source is allowed, and both channels
+    are bounded identically, so neither can carry an over-long value past the
+    local check the other applies.
+
+    ``required`` makes "no source at all" a refusal here, in the Click-free
+    layer, so the invariant does not depend on the adapter. Empty text is
+    refused on both channels unless the caller documents an empty inline value
+    as a clear (``hc ams policies update --content ""``); an empty file is
+    always refused, so a truncated or misdirected file can never clear a
+    protected field by accident. ``refuse`` builds the caller's own categorized
+    refusal, and no refusal quotes the text itself.
+    """
+
+    if inline is not None and path is not None:
+        raise refuse("validation", f"Pass {flag} or {file_flag}, not both; nothing was sent.")
+    if inline is None and path is None:
+        if not required:
+            return None
+        raise refuse("validation", f"Pass {flag} or {file_flag}; nothing was sent.")
+    if path is not None:
+        if not isinstance(path, str) or not path.strip():
+            raise refuse("validation", f"Explicit {file_flag} file path required.")
+        text = read_private_text(Path(path), maximum=PROTECTED_TEXT_MAX_CHARS)
+        if not text:
+            raise refuse("validation", f"The file given to {file_flag} is empty; nothing was sent.")
+        return text
+    if len(inline) > PROTECTED_TEXT_MAX_CHARS:
+        raise refuse(
+            "validation",
+            f"{flag} is longer than {PROTECTED_TEXT_MAX_CHARS} characters; nothing was sent. "
+            f"Pass a shorter value, or the same text with {file_flag}.",
+        )
+    if not inline and not allow_empty_inline:
+        raise refuse("validation", f"{flag} is empty; nothing was sent. Pass the text, or {file_flag} holding it.")
+    return inline
+
+
 @contextmanager
 def _private_stream(path: Path, newline: str | None = None):
     """Reserve output before network calls, never overwrite, clean failed work."""

{healthcloud_cli-3.6.0 → healthcloud_cli-3.7.0}/healthcloud_cli/ams/policies/commands.py

@@ -88,7 +88,15 @@ def create_create_command(dependencies: AmsDependencies) -> click.Command:
     @click.option(
         "--content",
         default=None,
-        help="Policy content (write-only; never echoed in command output).",
+        help="Policy content (write-only; never echoed in command output). Exposed in argv, the process "
+        "table and shell history: prefer --content-file.",
+    )
+    @click.option(
+        "--content-file",
+        default=None,
+        type=click.Path(dir_okay=False),
+        help="Owner-only text file holding the policy content, so the text never enters argv or shell "
+        "history (1-20000 characters). Cannot be combined with --content.",
     )
     @click.option(
         "--guardrail-ids",
@@ -106,7 +114,10 @@ def create_create_command(dependencies: AmsDependencies) -> click.Command:
         description: str | None,
         content: str | None,
         guardrail_ids: tuple[str, ...],
+        content_file: str | None,
     ) -> None:
+        if content is not None and content_file is not None:
+            raise click.UsageError("Pass --content or --content-file, not both; nothing was sent.")
         target_data = {"environment": environment, "tenant_id": tenant_id, "name": name}
 
         def execute():
@@ -123,6 +134,7 @@ def create_create_command(dependencies: AmsDependencies) -> click.Command:
                 description=description,
                 content=content,
                 guardrail_ids=list(guardrail_ids) or None,
+                content_file=content_file,
             )
 
         run_domain("policies.create", target_data, execute, read_only=False)
@@ -140,7 +152,16 @@ def create_update_command(dependencies: AmsDependencies) -> click.Command:
     @click.option(
         "--content",
         default=None,
-        help="New policy content; an empty value clears it (write-only; never echoed).",
+        help="New policy content; an empty value clears it (write-only; never echoed). Exposed in argv, "
+        "the process table and shell history: prefer --content-file.",
+    )
+    @click.option(
+        "--content-file",
+        default=None,
+        type=click.Path(dir_okay=False),
+        help="Owner-only text file holding the new policy content, so the text never enters argv or "
+        "shell history (1-20000 characters). An empty file is refused. Cannot be combined with "
+        "--content.",
     )
     @click.option(
         "--guardrail-ids",
@@ -163,7 +184,10 @@ def create_update_command(dependencies: AmsDependencies) -> click.Command:
         content: str | None,
         guardrail_ids: tuple[str, ...],
         clear_guardrail_ids: bool,
+        content_file: str | None,
     ) -> None:
+        if content is not None and content_file is not None:
+            raise click.UsageError("Pass --content or --content-file, not both; nothing was sent.")
         target_data = {
             "environment": environment,
             "tenant_id": tenant_id,
@@ -181,14 +205,14 @@ def create_update_command(dependencies: AmsDependencies) -> click.Command:
             if description is not None:
                 fields["description"] = description or None
             if content is not None:
-                fields["content"] = content or None
+                fields["content"] = content
             if guardrail_ids:
                 fields["guardrail_ids"] = list(guardrail_ids)
             elif clear_guardrail_ids:
                 fields["guardrail_ids"] = []
-            if not fields:
+            if not fields and content_file is None:
                 raise click.UsageError("Nothing to update; pass at least one field option.")
-            return update_policy(dependencies, target, policy_id, fields=fields)
+            return update_policy(dependencies, target, policy_id, fields=fields, content_file=content_file)
 
         run_domain("policies.update", target_data, execute, read_only=False)
 

{healthcloud_cli-3.6.0 → healthcloud_cli-3.7.0}/healthcloud_cli/ams/policies/operations.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 from ..context import AmsDependencies
 from ..domain_errors import DomainReadRefused
+from ..output import protected_text
 from ..results import succeeded
 from ..target import TenantTarget
 from .projections import policy_projection
@@ -161,13 +162,26 @@ def create_policy(
     description: str | None,
     content: str | None,
     guardrail_ids: list[str] | None,
+    content_file: str | None = None,
 ) -> dict:
     """Create one policy; the envelope carries the server's authoritative readback.
 
     Policy content is never included in the result envelope or error messages.
+    It arrives from exactly one of ``content`` (argv, exposed) or
+    ``content_file`` (an owner-only file, read here so the text never enters
+    argv, the process table or shell history); the file is read, and the
+    single-source invariant enforced, before any login or network call, so an
+    ambiguous invocation never reaches the server.
     """
     from healthcloud.errors import HealthCloudHTTPError, HealthCloudNetworkError
 
+    content = protected_text(
+        content,
+        content_file,
+        flag="--content",
+        file_flag="--content-file",
+        refuse=PolicyWriteRefused,
+    )
     with dependencies.authenticated_sdk_factory(target) as sdk:
         resource = _resource(sdk, ("create",), write=True)
         try:
@@ -199,14 +213,36 @@ def create_policy(
     return _write_result("policies.create", target, policy.id, {"policy": policy_projection(policy)})
 
 
-def update_policy(dependencies: AmsDependencies, target: TenantTarget, policy_id: str, *, fields: dict) -> dict:
+def update_policy(
+    dependencies: AmsDependencies,
+    target: TenantTarget,
+    policy_id: str,
+    *,
+    fields: dict,
+    content_file: str | None = None,
+) -> dict:
     """Partially update one policy; only explicitly set fields are sent.
 
     Policy content is write-only: it may be sent but never appears in the readback.
+    It arrives either inline in ``fields['content']`` (argv, exposed) or from a
+    single owner-only ``content_file``, resolved before any login or network
+    call. An empty inline value is the documented clear (``--content ""``),
+    while an empty file is refused so a truncated file cannot clear content.
     """
     from healthcloud.errors import HealthCloudHTTPError, HealthCloudNetworkError
 
     policy_id = _policy_id(policy_id)
+    fields = dict(fields)
+    resolved = protected_text(
+        fields.pop("content", None),
+        content_file,
+        flag="--content",
+        file_flag="--content-file",
+        refuse=PolicyWriteRefused,
+        allow_empty_inline=True,
+    )
+    if resolved is not None:
+        fields["content"] = resolved or None
     with dependencies.authenticated_sdk_factory(target) as sdk:
         resource = _resource(sdk, ("update",), write=True)
         try:

{healthcloud_cli-3.6.0 → healthcloud_cli-3.7.0}/healthcloud_cli/ams/sessions/commands.py

@@ -97,7 +97,15 @@ def create_create_command(dependencies: AmsDependencies) -> click.Command:
     @click.option(
         "--initial-prompt",
         default=None,
-        help="Protected free-text opening prompt; becomes the session's first user message (never echoed).",
+        help="Protected free-text opening prompt; becomes the session's first user message (never echoed). "
+        "Exposed in argv, the process table and shell history: prefer --initial-prompt-file.",
+    )
+    @click.option(
+        "--initial-prompt-file",
+        default=None,
+        type=click.Path(dir_okay=False),
+        help="Owner-only text file holding the protected opening prompt, so the text never enters argv or "
+        "shell history (at most 20000 characters). Cannot be combined with --initial-prompt.",
     )
     @pass_ams
     def command(
@@ -107,7 +115,10 @@ def create_create_command(dependencies: AmsDependencies) -> click.Command:
         agent_id: str | None,
         mode: str,
         initial_prompt: str | None,
+        initial_prompt_file: str | None,
     ) -> None:
+        if initial_prompt is not None and initial_prompt_file is not None:
+            raise click.UsageError("Pass --initial-prompt or --initial-prompt-file, not both; nothing was sent.")
         target_data = {"environment": environment, "tenant_id": tenant_id, "agent_id": agent_id, "mode": mode}
 
         def execute():
@@ -121,6 +132,7 @@ def create_create_command(dependencies: AmsDependencies) -> click.Command:
                 agent_id=agent_id,
                 mode=mode,
                 initial_prompt=initial_prompt,
+                initial_prompt_file=initial_prompt_file,
             )
 
         run_domain("sessions.create", target_data, execute, read_only=False)
@@ -504,8 +516,16 @@ def create_messages_add_command(dependencies: AmsDependencies) -> click.Command:
     @click.option("--session-id", required=True)
     @click.option(
         "--content",
-        required=True,
-        help="Protected free-text message content (never echoed); 1-20000 characters.",
+        default=None,
+        help="Protected free-text message content (never echoed); 1-20000 characters. Exposed in argv, the "
+        "process table and shell history: prefer --content-file.",
+    )
+    @click.option(
+        "--content-file",
+        default=None,
+        type=click.Path(dir_okay=False),
+        help="Owner-only text file holding the protected message content, so the text never enters argv or "
+        "shell history (1-20000 characters). Cannot be combined with --content.",
     )
     @click.option(
         "--mode", type=MODES, default="plan", show_default=True, help="Message mode; must match the session mode."
@@ -521,10 +541,15 @@ def create_messages_add_command(dependencies: AmsDependencies) -> click.Command:
         environment: str | None,
         tenant_id: str | None,
         session_id: str,
-        content: str,
+        content: str | None,
         mode: str,
         idempotency_key: str | None,
+        content_file: str | None,
     ) -> None:
+        if content is not None and content_file is not None:
+            raise click.UsageError("Pass --content or --content-file, not both; nothing was sent.")
+        if content is None and content_file is None:
+            raise click.UsageError("Pass --content or --content-file; nothing was sent.")
         target_data = {
             "environment": environment,
             "tenant_id": tenant_id,
@@ -544,6 +569,7 @@ def create_messages_add_command(dependencies: AmsDependencies) -> click.Command:
                 content=content,
                 mode=mode,
                 idempotency_key=idempotency_key,
+                content_file=content_file,
             )
 
         run_domain("sessions.messages.add", target_data, execute, read_only=False)

{healthcloud_cli-3.6.0 → healthcloud_cli-3.7.0}/healthcloud_cli/ams/sessions/operations.py

@@ -7,7 +7,7 @@ from pathlib import Path
 
 from ..context import AmsDependencies
 from ..domain_errors import DomainOutcomeUnknown, DomainReadRefused
-from ..output import private_output, read_private_text
+from ..output import PROTECTED_TEXT_MAX_CHARS, private_output, protected_text, read_private_text
 from ..results import succeeded, unknown
 from ..target import TenantTarget
 from .projections import (
@@ -179,7 +179,7 @@ def _attachment_extension(filename: str) -> None:
 
 PLAN_OPERATIONS = ("modify", "create")
 PLAN_AGENT_TYPES = ("Application", "Utility")
-PROMPT_MAX_CHARS = 20000
+PROMPT_MAX_CHARS = PROTECTED_TEXT_MAX_CHARS
 # The only fields a configure review endorses. Everything else the plan may try
 # to change (capability/permission expansion, lifecycle, model, files) is
 # refused by field name: permission assignment stays a separately reviewed
@@ -646,14 +646,25 @@ def create_session(
     agent_id: str | None,
     mode: str,
     initial_prompt: str | None,
+    initial_prompt_file: str | None = None,
 ) -> dict:
     """Create one session; the envelope carries the server's authoritative readback.
 
     ``initial_prompt`` is protected free text: it is sent once and never
-    appears in the envelope or in any refusal.
+    appears in the envelope or in any refusal. It arrives from exactly one of
+    ``initial_prompt`` (argv, exposed) or ``initial_prompt_file`` (an owner-only
+    file, read here so the text never enters argv, the process table or shell
+    history); the file is read and bounded before any login or network call.
     """
     from healthcloud.errors import HealthCloudHTTPError, HealthCloudNetworkError
 
+    initial_prompt = protected_text(
+        initial_prompt,
+        initial_prompt_file,
+        flag="--initial-prompt",
+        file_flag="--initial-prompt-file",
+        refuse=SessionWriteRefused,
+    )
     with dependencies.authenticated_sdk_factory(target) as sdk:
         resource = _sessions(sdk, ("create",), write=True)
         try:
@@ -999,20 +1010,34 @@ def add_message(
     target: TenantTarget,
     session_id: str,
     *,
-    content: str,
+    content: str | None,
     mode: str,
     idempotency_key: str | None,
+    content_file: str | None = None,
 ) -> dict:
     """Append one user message; the envelope carries the server's authoritative readback.
 
     ``content`` is protected free text: it is sent once and never appears in
-    the envelope or in any refusal. An idempotency replay answers 201 with the
-    existing message, so the envelope reports that message (with its original
-    id) and never a second write.
+    the envelope or in any refusal. It arrives from exactly one of ``content``
+    (argv, exposed) or ``content_file`` (an owner-only file, read here so the
+    text never enters argv, the process table or shell history); the file is
+    read, and its presence enforced, before any login or network call, so the
+    one-source and non-empty invariants hold below the Click layer too. An
+    idempotency replay answers 201 with the existing message, so the envelope
+    reports that message
+    (with its original id) and never a second write.
     """
     from healthcloud.errors import HealthCloudHTTPError, HealthCloudNetworkError
 
     session_id = _session_id(session_id)
+    content = protected_text(
+        content,
+        content_file,
+        flag="--content",
+        file_flag="--content-file",
+        refuse=SessionWriteRefused,
+        required=True,
+    )
     with dependencies.authenticated_sdk_factory(target) as sdk:
         resource = _messages(sdk, ("add",), write=True)
         try:

{healthcloud_cli-3.6.0 → healthcloud_cli-3.7.0}/healthcloud_cli/contracts/mcp-tools.manifest.json

@@ -30336,7 +30336,7 @@
       "defaultBaseUrl": "patient",
       "name": "patient",
       "path": "/patient",
-      "toolCount": 114,
+      "toolCount": 118,
       "tools": [
         {
           "cliCommand": "add-insurance",
@@ -30641,6 +30641,52 @@
           "requiredRoles": [],
           "timeoutSeconds": 25
         },
+        {
+          "cliCommand": "apply-patient-flags-operation",
+          "description": "Apply the exact patient-confirmed boolean flag patch under a stable canonical UUID key. Returns the original stored receipt on replay, not current flags. Requires the patient's Bearer JWT; tenant and patient are resolved server-side. On timeout or unknown outcome, look up the same key before proceeding; never create a fresh key to retry an uncertain write.",
+          "descriptionSource": "mcp-authored",
+          "destructive": false,
+          "fixedArguments": null,
+          "httpMethod": "POST",
+          "httpPath": "/patients/flags/operations",
+          "inputSchema": {
+            "additionalProperties": false,
+            "properties": {
+              "flags": {
+                "additionalProperties": {
+                  "type": "boolean"
+                },
+                "minProperties": 1,
+                "propertyNames": {
+                  "maxLength": 256,
+                  "minLength": 1
+                },
+                "type": "object"
+              },
+              "idempotency_key": {
+                "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "idempotency_key",
+              "flags"
+            ],
+            "type": "object"
+          },
+          "name": "apply_patient_flags_operation",
+          "operationId": "patient.applyPatientFlagsOperation",
+          "parameters": {
+            "body": [
+              "flags",
+              "idempotency_key"
+            ],
+            "path": [],
+            "query": []
+          },
+          "requiredRoles": [],
+          "timeoutSeconds": 25
+        },
         {
           "cliCommand": "ask-assistant",
           "description": "Ask the grounded RAG field-worker assistant a question. Answers are drawn only from the internal knowledge base (PPE, screening, sample collection, field ops).",
@@ -32200,6 +32246,39 @@
           "requiredRoles": [],
           "timeoutSeconds": 25
         },
+        {
+          "cliCommand": "get-patient-flags-operation",
+          "description": "Read the authenticated patient's original flag-operation receipt by canonical UUID key. Never writes or infers an outcome from current flags. A missing receipt does not prove failure: an in-flight write may still commit. Requires the patient's Bearer JWT.",
+          "descriptionSource": "mcp-authored",
+          "destructive": false,
+          "fixedArguments": null,
+          "httpMethod": "GET",
+          "httpPath": "/patients/flags/operations/{idempotency_key}",
+          "inputSchema": {
+            "additionalProperties": false,
+            "properties": {
+              "idempotency_key": {
+                "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "idempotency_key"
+            ],
+            "type": "object"
+          },
+          "name": "get_patient_flags_operation",
+          "operationId": "patient.getPatientFlagsOperation",
+          "parameters": {
+            "body": [],
+            "path": [
+              "idempotency_key"
+            ],
+            "query": []
+          },
+          "requiredRoles": [],
+          "timeoutSeconds": 25
+        },
         {
           "cliCommand": "get-patient-insurance",
           "description": "List FHIR Coverage resources for the authenticated patient.",
@@ -33504,6 +33583,89 @@
           "requiredRoles": [],
           "timeoutSeconds": 25
         },
+        {
+          "cliCommand": "replace-insurance",
+          "description": "Replace existing primary self insurance only after the patient's explicit confirmation of changed card details. Never call for an OCR rescan before first save, an eligibility retry, or Continue without insurance. Keep request_id and the body identical for retries. A pending result requires reconciliation, not add_insurance.",
+          "descriptionSource": "mcp-authored",
+          "destructive": false,
+          "fixedArguments": null,
+          "httpMethod": "PUT",
+          "httpPath": "/patients/insurance/{coverage_id}",
+          "inputSchema": {
+            "additionalProperties": false,
+            "properties": {
+              "coverage_id": {
+                "pattern": "^[A-Za-z0-9.-]{1,64}$",
+                "type": "string"
+              },
+              "image": {
+                "description": "Reviewed replacement card image, base64 PNG/JPEG. The previous card is not reused.",
+                "maxLength": 2000000,
+                "minLength": 1,
+                "title": "Image",
+                "type": "string"
+              },
+              "member_id": {
+                "maxLength": 50,
+                "minLength": 1,
+                "title": "Member Id",
+                "type": "string"
+              },
+              "payer_id": {
+                "maxLength": 100,
+                "minLength": 1,
+                "title": "Payer Id",
+                "type": "string"
+              },
+              "payer_name": {
+                "maxLength": 200,
+                "minLength": 1,
+                "title": "Payer Name",
+                "type": "string"
+              },
+              "request_id": {
+                "description": "Client-generated UUID retained for every retry of this confirmed change.",
+                "format": "uuid",
+                "title": "Request Id",
+                "type": "string"
+              },
+              "state": {
+                "description": "Reviewed US coverage state used for vendor package matching.",
+                "pattern": "^[A-Z]{2}$",
+                "title": "State",
+                "type": "string"
+              }
+            },
+            "required": [
+              "coverage_id",
+              "request_id",
+              "payer_id",
+              "payer_name",
+              "member_id",
+              "state",
+              "image"
+            ],
+            "type": "object"
+          },
+          "name": "replace_insurance",
+          "operationId": "patient.replaceInsurance",
+          "parameters": {
+            "body": [
+              "image",
+              "member_id",
+              "payer_id",
+              "payer_name",
+              "request_id",
+              "state"
+            ],
+            "path": [
+              "coverage_id"
+            ],
+            "query": []
+          },
+          "requiredRoles": [],
+          "timeoutSeconds": 120
+        },
         {
           "cliCommand": "resend-verification-code",
           "description": "Issue a fresh email-verification OTP for a patient whose email is not yet verified.",
@@ -33578,6 +33740,48 @@
           "requiredRoles": [],
           "timeoutSeconds": 25
         },
+        {
+          "cliCommand": "retire-insurance",
+          "description": "Retire the exact saved primary self insurance only after explicit patient confirmation of removal. History is retained; no replacement is created and the insurer contract is not cancelled. Never call because eligibility is inactive, unknown or unavailable, or for Continue without insurance. Reuse request_id for retries; pending is not completed removal.",
+          "descriptionSource": "mcp-authored",
+          "destructive": false,
+          "fixedArguments": null,
+          "httpMethod": "POST",
+          "httpPath": "/patients/insurance/{coverage_id}/retire",
+          "inputSchema": {
+            "additionalProperties": false,
+            "properties": {
+              "coverage_id": {
+                "pattern": "^[A-Za-z0-9.-]{1,64}$",
+                "type": "string"
+              },
+              "request_id": {
+                "description": "Client-generated UUID retained for retries of this confirmed removal.",
+                "format": "uuid",
+                "title": "Request Id",
+                "type": "string"
+              }
+            },
+            "required": [
+              "coverage_id",
+              "request_id"
+            ],
+            "type": "object"
+          },
+          "name": "retire_insurance",
+          "operationId": "patient.retireInsurance",
+          "parameters": {
+            "body": [
+              "request_id"
+            ],
+            "path": [
+              "coverage_id"
+            ],
+            "query": []
+          },
+          "requiredRoles": [],
+          "timeoutSeconds": 120
+        },
         {
           "cliCommand": "search-assistant-knowledge",
           "description": "Search the assistant knowledge base lexically.",
@@ -41252,7 +41456,7 @@
   "protocolVersion": "2024-11-05",
   "schemaVersion": 1,
   "source": {
-    "catalogSha256": "8ee176981250729af9845b7e6dd65fb847f19c9cbbb9ed21429d53e098bbdeab"
+    "catalogSha256": "035606bcc89f84b5a6efbc1ef52a2bcfd0359c1e14eac8e2b60e1f36e2d0c035"
   },
-  "toolCount": 1076
+  "toolCount": 1080
 }

{healthcloud_cli-3.6.0 → healthcloud_cli-3.7.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "healthcloud-cli"
-version = "3.6.0"
+version = "3.7.0"
 description = "Command-line interface for the HealthCloud MCP gateway, generated from the shared MCP tool manifest."
 readme = "README.md"
 requires-python = ">=3.14"