healthcloud-cli 3.7.1__tar.gz → 3.7.2__tar.gz

{healthcloud_cli-3.7.1 → healthcloud_cli-3.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: healthcloud-cli
-Version: 3.7.1
+Version: 3.7.2
 Summary: Command-line interface for the HealthCloud MCP gateway, generated from the shared MCP tool manifest.
 Project-URL: Issues, https://github.com/healthcloudservices/healthcloud-services/issues
 Project-URL: Repository, https://github.com/healthcloudservices/healthcloud-services
@@ -316,6 +316,27 @@ otherwise it prompts (with hidden password input). It stores only the email,
 tenant/environment binding, access/refresh tokens and expiry in the strict
 owner-only `~/.healthcloud/cli/ams-session.json`; it never stores the password.
 
+By default (`pretty`) these three commands print readable lines — never a raw
+JSON blob and never a token:
+
+```text
+$ hc login --environment dev --tenant-id TENANT_ID
+saved session: dev / TENANT_ID
+email: admin@example.test
+expires_at: 2026-11-02T01:42:29Z
+$ hc logout
+saved session removed: true
+server session revoked: false
+```
+
+`hc login --status` prints the same three lines for the saved session, and a
+second `hc logout` reports `saved session removed: false`. `--output json` (and
+`--output raw`, which these commands treat as JSON) prints exactly the objects
+they have always printed: `{"schema_version": 1, "ok": true, "session":
+{"schema_version": 1, "environment", "tenant_id", "email", "expires_at"}}`
+for `login`/`--status`, and `{"schema_version": 1, "ok": true, "removed":
+true|false, "server_session_revoked": false}` for `logout`.
+
 For CI and agents, log in non-interactively: pass `--email` and pipe the password
 to `--password-stdin` (read as exactly one stdin line, never echoed, never a
 flag value — there is no `--password` option):
@@ -545,6 +566,16 @@ explicitly that
 fields — a disabled agent can still be selected by those paths — and that
 in-flight runs, WSS sessions and schedules are untouched by this route.
 
+Default `pretty` output prints those facts as labelled lines — `transition`,
+`requested`, `evidence` (`saved`, `side_effects`, `runtime`), `eligibility`,
+`mutation_replayed: false` — and closes with a `verification:` block, so a
+deactivate reads `transition: deactivate`, then
+`evidence: / saved: / status: confirmed`, then `verification: / saved_state:
+confirmed`, `side_effects: unverified`, `runtime: unverified`; it is never one
+raw JSON line. `--output json` prints the full envelope above, byte-identical to
+before. An unknown outcome still prints its one-line `error:` plus the
+reconciliation on stderr.
+
 Pre-checks refuse with exit 1 and **no write**: a missing `--confirm` (exit 2
 usage error, before login), an agent outside the explicit tenant, an already
 in-effect state, an unsupported `archived`/`draft` target (named as having no
@@ -615,6 +646,12 @@ server audit log records an `UPDATE` with the payload. Runtime enforcement of
 the new references is unobservable: no serving readback route exists, so this
 command never claims it.
 
+Default `pretty` output prints the same facts as labelled lines: `agent_id`,
+`changed` (each field with `before`/`after`/`added`/`removed`),
+`config_version: {before, after}`, `evidence` (`saved`, `side_effects`,
+`runtime`), `mutation_replayed: false`, and a closing `verification:` block.
+`--output json` prints the full envelope described here, unchanged.
+
 `tool_ids` and `data_source_ids` address **unscoped global catalogs** by design;
 the server checks tenant scope only for the department, team, skill, policy and
 guardrail references. This command does not imply otherwise, and it does not
@@ -689,6 +726,13 @@ of restore and has no `--force`, no `--dry-run`, no interactive prompt and no
 `--expected-config-version` — the route has no `If-Match` or version check, so a
 version flag would advertise protection the server does not offer.
 
+Default `pretty` output prints the result as labelled lines next to the stderr
+disclosure: `agent_id`, `deleted: true`, `target`, `disclosure`, `evidence`
+(`deleted`/`side_effects`/`runtime`), `mutation_replayed: false`, and a closing
+`verification:` block. `--output json` prints the full envelope, unchanged. The
+reviewed target and disclosure above are still printed to stderr in `pretty`
+mode only; `--output json`/`raw` keep stderr machine-parsable.
+
 Refusals claim nothing and send nothing extra: a missing `--confirm` is an exit
 2 usage error before login or any request; an agent outside the explicit tenant,
 the tenant identity mismatch and a delete target that no longer exists are
@@ -997,6 +1041,14 @@ uv run --frozen hc ams sessions messages add --environment dev --tenant-id TENAN
   "continuation": null}`). `get` emits `operation: "sessions.get"` and
   `data.session`. The projections never include the session's protected
   `initial_prompt`, tenant or user identity, or arbitrary response fields.
+- Default `pretty` output prints `list` as a table with honest headers —
+  `ID`, `AGENT ID`, `OPERATION`, `STATUS`, `EXPIRES AT` for sessions and `ID`,
+  `ROLE`, `MODE`, `PLAN ID`, `CREATED AT` for messages — followed by an entry
+  count (`1 entry` / `N entries`), and `(no entries)` for an empty list. These
+  projections carry no `name`, so no `NAME` column is invented and the `id` is
+  always shown. `get`, `create` and `messages add` print `key: value` lines.
+  `--output json` prints the full envelope exactly as before; pretty output is
+  additive and never changes the envelope.
 - `create` and `messages add` require a saved `hc login` session (env-var
   credentials are not accepted for writes). Each write is sent exactly once and
   the envelope carries the server's authoritative readback:
@@ -1169,6 +1221,12 @@ uv run --frozen hc ams sessions plans reconcile --environment dev --tenant-id TE
   (create: reference counts by kind) and finding counts. No prompt,
   instructions, greeting, summary, message content or plan value is printed to
   stdout, stderr, a diagnostic or an error string.
+- Default `pretty` output renders `generate`, `get`, `apply`, `rollback` and
+  `reconcile` as labelled lines — `plan:` with the bounded metadata, then
+  `evidence:` (`saved`/`side_effects`/`runtime`) and `mutation_replayed: false`
+  where the command reports them, and a closing `verification:` block for the
+  writes. A write is never printed as a raw JSON blob in the default mode.
+  `--output json` prints the full envelope, unchanged.
 - The prompt is protected free text and never comes from argv: `--prompt-file`
   reads one owner-only regular text file (no symlinks, at most 20000
   characters) and sends it once. `--prompt-file` is optional — the server falls
@@ -1423,8 +1481,12 @@ and `hc ams organization hierarchy`) render in two modes (`--output` on the root
 `hc` command; `pretty` is the default):
 
 - **`pretty`** (default): a compact human view. Lists print an `ID`/`NAME`
-  table with an entry count; a single record prints `key: value` lines; the
-  organization hierarchy prints an indented tree. Each failed AMS command
+  table with an entry count; a collection whose rows have no `name` (sessions,
+  messages, attachments) prints a table of that command's own columns plus the
+  count, and `(no entries)` when empty. A single record prints `key: value`
+  lines, the organization hierarchy prints an indented tree, and write or
+  reconciliation evidence prints labelled `key: value` lines (the write's
+  `verification:` block included) instead of JSON. Each failed AMS command
   prints one stderr line, `error: <message> (<category>)` (flag/argument
   usage errors from Click print Click's standard usage message instead).
 - **`json`**: the stable result envelope (below) on stdout. When stdout is not

{healthcloud_cli-3.7.1 → healthcloud_cli-3.7.2}/README.md

@@ -298,6 +298,27 @@ otherwise it prompts (with hidden password input). It stores only the email,
 tenant/environment binding, access/refresh tokens and expiry in the strict
 owner-only `~/.healthcloud/cli/ams-session.json`; it never stores the password.
 
+By default (`pretty`) these three commands print readable lines — never a raw
+JSON blob and never a token:
+
+```text
+$ hc login --environment dev --tenant-id TENANT_ID
+saved session: dev / TENANT_ID
+email: admin@example.test
+expires_at: 2026-11-02T01:42:29Z
+$ hc logout
+saved session removed: true
+server session revoked: false
+```
+
+`hc login --status` prints the same three lines for the saved session, and a
+second `hc logout` reports `saved session removed: false`. `--output json` (and
+`--output raw`, which these commands treat as JSON) prints exactly the objects
+they have always printed: `{"schema_version": 1, "ok": true, "session":
+{"schema_version": 1, "environment", "tenant_id", "email", "expires_at"}}`
+for `login`/`--status`, and `{"schema_version": 1, "ok": true, "removed":
+true|false, "server_session_revoked": false}` for `logout`.
+
 For CI and agents, log in non-interactively: pass `--email` and pipe the password
 to `--password-stdin` (read as exactly one stdin line, never echoed, never a
 flag value — there is no `--password` option):
@@ -527,6 +548,16 @@ explicitly that
 fields — a disabled agent can still be selected by those paths — and that
 in-flight runs, WSS sessions and schedules are untouched by this route.
 
+Default `pretty` output prints those facts as labelled lines — `transition`,
+`requested`, `evidence` (`saved`, `side_effects`, `runtime`), `eligibility`,
+`mutation_replayed: false` — and closes with a `verification:` block, so a
+deactivate reads `transition: deactivate`, then
+`evidence: / saved: / status: confirmed`, then `verification: / saved_state:
+confirmed`, `side_effects: unverified`, `runtime: unverified`; it is never one
+raw JSON line. `--output json` prints the full envelope above, byte-identical to
+before. An unknown outcome still prints its one-line `error:` plus the
+reconciliation on stderr.
+
 Pre-checks refuse with exit 1 and **no write**: a missing `--confirm` (exit 2
 usage error, before login), an agent outside the explicit tenant, an already
 in-effect state, an unsupported `archived`/`draft` target (named as having no
@@ -597,6 +628,12 @@ server audit log records an `UPDATE` with the payload. Runtime enforcement of
 the new references is unobservable: no serving readback route exists, so this
 command never claims it.
 
+Default `pretty` output prints the same facts as labelled lines: `agent_id`,
+`changed` (each field with `before`/`after`/`added`/`removed`),
+`config_version: {before, after}`, `evidence` (`saved`, `side_effects`,
+`runtime`), `mutation_replayed: false`, and a closing `verification:` block.
+`--output json` prints the full envelope described here, unchanged.
+
 `tool_ids` and `data_source_ids` address **unscoped global catalogs** by design;
 the server checks tenant scope only for the department, team, skill, policy and
 guardrail references. This command does not imply otherwise, and it does not
@@ -671,6 +708,13 @@ of restore and has no `--force`, no `--dry-run`, no interactive prompt and no
 `--expected-config-version` — the route has no `If-Match` or version check, so a
 version flag would advertise protection the server does not offer.
 
+Default `pretty` output prints the result as labelled lines next to the stderr
+disclosure: `agent_id`, `deleted: true`, `target`, `disclosure`, `evidence`
+(`deleted`/`side_effects`/`runtime`), `mutation_replayed: false`, and a closing
+`verification:` block. `--output json` prints the full envelope, unchanged. The
+reviewed target and disclosure above are still printed to stderr in `pretty`
+mode only; `--output json`/`raw` keep stderr machine-parsable.
+
 Refusals claim nothing and send nothing extra: a missing `--confirm` is an exit
 2 usage error before login or any request; an agent outside the explicit tenant,
 the tenant identity mismatch and a delete target that no longer exists are
@@ -979,6 +1023,14 @@ uv run --frozen hc ams sessions messages add --environment dev --tenant-id TENAN
   "continuation": null}`). `get` emits `operation: "sessions.get"` and
   `data.session`. The projections never include the session's protected
   `initial_prompt`, tenant or user identity, or arbitrary response fields.
+- Default `pretty` output prints `list` as a table with honest headers —
+  `ID`, `AGENT ID`, `OPERATION`, `STATUS`, `EXPIRES AT` for sessions and `ID`,
+  `ROLE`, `MODE`, `PLAN ID`, `CREATED AT` for messages — followed by an entry
+  count (`1 entry` / `N entries`), and `(no entries)` for an empty list. These
+  projections carry no `name`, so no `NAME` column is invented and the `id` is
+  always shown. `get`, `create` and `messages add` print `key: value` lines.
+  `--output json` prints the full envelope exactly as before; pretty output is
+  additive and never changes the envelope.
 - `create` and `messages add` require a saved `hc login` session (env-var
   credentials are not accepted for writes). Each write is sent exactly once and
   the envelope carries the server's authoritative readback:
@@ -1151,6 +1203,12 @@ uv run --frozen hc ams sessions plans reconcile --environment dev --tenant-id TE
   (create: reference counts by kind) and finding counts. No prompt,
   instructions, greeting, summary, message content or plan value is printed to
   stdout, stderr, a diagnostic or an error string.
+- Default `pretty` output renders `generate`, `get`, `apply`, `rollback` and
+  `reconcile` as labelled lines — `plan:` with the bounded metadata, then
+  `evidence:` (`saved`/`side_effects`/`runtime`) and `mutation_replayed: false`
+  where the command reports them, and a closing `verification:` block for the
+  writes. A write is never printed as a raw JSON blob in the default mode.
+  `--output json` prints the full envelope, unchanged.
 - The prompt is protected free text and never comes from argv: `--prompt-file`
   reads one owner-only regular text file (no symlinks, at most 20000
   characters) and sends it once. `--prompt-file` is optional — the server falls
@@ -1405,8 +1463,12 @@ and `hc ams organization hierarchy`) render in two modes (`--output` on the root
 `hc` command; `pretty` is the default):
 
 - **`pretty`** (default): a compact human view. Lists print an `ID`/`NAME`
-  table with an entry count; a single record prints `key: value` lines; the
-  organization hierarchy prints an indented tree. Each failed AMS command
+  table with an entry count; a collection whose rows have no `name` (sessions,
+  messages, attachments) prints a table of that command's own columns plus the
+  count, and `(no entries)` when empty. A single record prints `key: value`
+  lines, the organization hierarchy prints an indented tree, and write or
+  reconciliation evidence prints labelled `key: value` lines (the write's
+  `verification:` block included) instead of JSON. Each failed AMS command
   prints one stderr line, `error: <message> (<category>)` (flag/argument
   usage errors from Click print Click's standard usage message instead).
 - **`json`**: the stable result envelope (below) on stdout. When stdout is not

{healthcloud_cli-3.7.1 → healthcloud_cli-3.7.2}/healthcloud_cli/ams/errors.py

@@ -10,7 +10,7 @@ from typing import Any
 import click
 from pydantic import ValidationError
 
-from ..context import CliConfig
+from ..output import output_mode
 from .domain_errors import DomainReadRefused
 from .pretty import error_line, success_text, unknown_details
 from .results import failed
@@ -135,19 +135,6 @@ def emit_compact_json(value: dict, *, err: bool = False) -> None:
     click.echo(json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=True), err=err)
 
 
-def _output_mode() -> str:
-    """The root ``--output`` mode for the running command; pretty is the default.
-
-    Raw is refused for AMS before any read runs, but its refusals keep the
-    structured JSON error envelope, so raw renders like json.
-    """
-
-    ctx = click.get_current_context(silent=True)
-    cfg = ctx.find_object(CliConfig) if ctx is not None else None
-    mode = getattr(cfg, "output", None)
-    return "json" if mode in ("json", "raw") else "pretty"
-
-
 def _render_success(envelope: dict, mode: str) -> None:
     if mode != "json":
         click.echo(success_text(envelope))
@@ -190,7 +177,7 @@ def run_domain(operation: str, target: dict, callback: Callable[[], Any], *, rea
     ``verification`` block in the error envelope.
     """
 
-    mode = _output_mode()
+    mode = output_mode()
 
     def _fail(error: BaseException) -> None:
         """Classify ``error``, render the error envelope, and exit bounded."""

{healthcloud_cli-3.7.1 → healthcloud_cli-3.7.2}/healthcloud_cli/ams/pretty.py

@@ -107,13 +107,109 @@ def _is_list(data: dict) -> bool:
     )
 
 
+# A collection whose rows carry an ``id`` but no ``name`` (sessions, messages,
+# attachments) still renders as a table; these are the honest columns per
+# collection. A collection without a spec here falls back to ``id`` plus the
+# scalar keys every row shares, so no column is invented.
+_LIST_FIELDS = {
+    "sessions": ("id", "agent_id", "operation", "status", "expires_at"),
+    "messages": ("id", "role", "mode", "plan_id", "created_at"),
+    "attachments": ("id", "filename", "content_type", "size_bytes", "index_status"),
+}
+
+
 def _is_item(data: dict) -> bool:
     values = list(data.values())
     return len(data) == 1 and isinstance(values[0], dict)
 
 
+def _id_list(data: dict) -> tuple[str, list[dict]] | None:
+    """The ``(collection, rows)`` of a list whose rows have an ``id`` only.
+
+    Catalog lists already match ``_is_list`` (they add a ``name``); this covers
+    the projections that do not name their row (sessions, messages, ...) without
+    loosening ``_is_list`` and changing existing catalog output.
+    """
+
+    collections = [(key, value) for key, value in data.items() if key != "page"]
+    if len(collections) != 1:
+        return None
+    key, rows = collections[0]
+    if not isinstance(rows, list):
+        return None
+    if not all(isinstance(row, dict) and isinstance(row.get("id"), str) for row in rows):
+        return None
+    return key, rows
+
+
+def _columns(collection: str, rows: list[dict]) -> tuple[str, ...]:
+    fields = _LIST_FIELDS.get(collection)
+    if fields is not None:
+        return fields
+    shared = set(rows[0])
+    for row in rows[1:]:
+        shared &= set(row)
+    return ("id", *sorted(shared - {"id"}))
+
+
+def _columns_table_lines(rows: list[dict], fields: tuple[str, ...]) -> list[str]:
+    headers = [field.replace("_", " ").upper() for field in fields]
+    cells = [[_scalar(row.get(field)) for field in fields] for row in rows]
+    widths = [max(len(headers[index]), *(len(cell[index]) for cell in cells)) for index in range(len(fields))]
+
+    def _line(values: list[str]) -> str:
+        # The trailing column is never padded: no trailing whitespace.
+        if len(values) == 1:
+            return values[0]
+        padded = [value.ljust(width) for value, width in zip(values[:-1], widths[:-1], strict=True)]
+        return "  ".join(padded) + "  " + values[-1]
+
+    lines = [_line(headers)]
+    lines.extend(_line(cell) for cell in cells)
+    count = len(rows)
+    lines.append("")
+    lines.append(f"{count} entry" if count == 1 else f"{count} entries")
+    return lines
+
+
+# Domains whose multi-key ``data`` is write or reconciliation evidence. A
+# non-AMS envelope (``admins.*``, ``tenants.*``) keeps the compact-JSON fallback:
+# their pretty output is a separate story, not this one's to change.
+_EVIDENCE_DOMAINS = frozenset(
+    {
+        "agents",
+        "data-sources",
+        "departments",
+        "guardrails",
+        "organization",
+        "policies",
+        "sessions",
+        "skills",
+        "teams",
+        "tools",
+    }
+)
+
+
+def _is_evidence(envelope: dict, data: dict) -> bool:
+    operation = envelope.get("operation")
+    if not isinstance(operation, str) or operation.split(".", 1)[0] not in _EVIDENCE_DOMAINS:
+        return False
+    return len([key for key in data if key != "page"]) > 1
+
+
+def _evidence_lines(envelope: dict, data: dict) -> list[str]:
+    lines = _detail_lines(data)
+    verification = envelope.get("verification")
+    if isinstance(verification, dict) and verification:
+        lines.append("")
+        lines.append("verification:")
+        lines.extend(_detail_lines(verification, 1))
+    return lines
+
+
 def success_text(envelope: dict) -> str:
-    """Render a succeeded read envelope as compact human text."""
+    """Render a succeeded envelope as compact human text."""
     data = envelope.get("data")
     if not isinstance(data, dict) or not data:
         return json.dumps(data, sort_keys=True, separators=(",", ":"), ensure_ascii=True)
@@ -123,11 +219,42 @@ def success_text(envelope: dict) -> str:
     if _is_list(data):
         rows = [value for key, value in data.items() if key != "page"][0]
         return "\n".join(_table_lines(rows)) if rows else "(no entries)"
+    identified = _id_list(data)
+    if identified is not None:
+        collection, rows = identified
+        if not rows:
+            return "(no entries)"
+        return "\n".join(_columns_table_lines(rows, _columns(collection, rows)))
     if _is_item(data):
         return "\n".join(_item_lines(list(data.values())[0]))
+    if _is_evidence(envelope, data):
+        return "\n".join(_evidence_lines(envelope, data))
     return json.dumps(data, sort_keys=True, separators=(",", ":"), ensure_ascii=True)
 
 
+_SESSION_FIELDS = ("email", "expires_at")
+
+
+def saved_session_text(payload: dict) -> str:
+    """Pretty text for ``hc login`` and ``hc login --status``; never a token."""
+    session = payload.get("session")
+    if not isinstance(session, dict):
+        return "(no saved session)"
+    lines = [f"saved session: {_value(session.get('environment'))} / {_value(session.get('tenant_id'))}"]
+    lines.extend(f"{field}: {_value(session[field])}" for field in _SESSION_FIELDS if field in session)
+    return "\n".join(lines)
+
+
+def logout_text(payload: dict) -> str:
+    """Pretty text for ``hc logout``: what was removed, and what was not undone."""
+    removed = payload.get("removed") is True
+    lines = [f"saved session removed: {'true' if removed else 'false'}"]
+    if isinstance(payload.get("server_session_revoked"), bool):
+        revoked = payload["server_session_revoked"]
+        lines.append(f"server session revoked: {'true' if revoked else 'false'}")
+    return "\n".join(lines)
+
+
 def error_line(category: str, message: str) -> str:
     """One-line stderr rendering of a failed read envelope."""
     return f"error: {_text(message)} ({_text(category)})"

{healthcloud_cli-3.7.1 → healthcloud_cli-3.7.2}/healthcloud_cli/cli.py

@@ -23,9 +23,10 @@ import click
 from . import manifest as manifest_module
 from .admins import create_admins_group
 from .ams.group import create_ams_group
+from .ams.pretty import logout_text, saved_session_text
 from .ams.session import delete_session, load_session, new_session, save_session
 from .context import CliConfig, resolve_config
-from .output import dispatch, dump_rpc_result, read_stdin
+from .output import dispatch, dump_rpc_result, output_mode, read_stdin
 from .params import ParamSpec, build_param_specs, make_click_option, merge_arguments, validate_final
 from .tenants import create_tenants_group
 from .util import (
@@ -332,7 +333,7 @@ def login_cmd(
         session = load_session()
         if session is None:
             raise click.ClickException("No saved AMS session; run hc login.")
-        click.echo(json.dumps({"schema_version": 1, "ok": True, "session": session.public_value()}, sort_keys=True))
+        _emit_session({"schema_version": 1, "ok": True, "session": session.public_value()})
         return
     if environment is None or tenant_id is None or not tenant_id.strip():
         raise click.UsageError("Login requires --environment and a nonblank --tenant-id.")
@@ -377,19 +378,26 @@ def login_cmd(
         raise
     except Exception:
         raise click.ClickException("Tenant-admin login failed; no session was saved.") from None
-    click.echo(json.dumps({"schema_version": 1, "ok": True, "session": session.public_value()}, sort_keys=True))
+    _emit_session({"schema_version": 1, "ok": True, "session": session.public_value()})
+
+
+def _emit_session(payload: dict) -> None:
+    """Render the saved-session object: readable text by default, today's JSON for json."""
+    if output_mode() == "pretty":
+        click.echo(saved_session_text(payload))
+        return
+    click.echo(json.dumps(payload, sort_keys=True))
 
 
 @click.command("logout")
 def logout_cmd() -> None:
     """Remove the validated local tenant-admin session (local only; tokens stay valid until expiry)."""
     removed = delete_session()
-    click.echo(
-        json.dumps(
-            {"schema_version": 1, "ok": True, "removed": removed, "server_session_revoked": False},
-            sort_keys=True,
-        )
-    )
+    payload = {"schema_version": 1, "ok": True, "removed": removed, "server_session_revoked": False}
+    if output_mode() == "pretty":
+        click.echo(logout_text(payload))
+        return
+    click.echo(json.dumps(payload, sort_keys=True))
 
 
 hc.add_command(login_cmd)