hookstride-cli 0.3.0__tar.gz → 0.3.1__tar.gz

{hookstride_cli-0.3.0 → hookstride_cli-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: hookstride-cli
-Version: 0.3.0
+Version: 0.3.1
 Summary: Manage Hookstride projects and destinations, inspect webhook activity and billing.
 License: Proprietary
 Requires-Python: >=3.11
@@ -15,10 +15,11 @@ Description-Content-Type: text/markdown
 
 Hookstride CLI lets you manage projects and webhook destinations, inspect delivery activity, and view billing records. It includes an interactive console with the same selected-project commands.
 
-Version 0.3.0 adds project creation and updates, plus destination creation, updates, and pausing/resuming. Billing and credential changes, delivery replay, and destructive operations remain unavailable.
+Version 0.3.1 adds signed test-event sending with an existing project's delivery API key, and optional delivery-status polling. Project and destination management remain available; billing and credential changes, delivery replay, and destructive operations remain unavailable.
 
 ## Installation
 
+
 Requires Python 3.11 or later.
 
 ```bash
@@ -76,6 +77,7 @@ hookstride destinations update DESTINATION_UUID --resume
 hookstride keys list
 hookstride events list --status failed
 hookstride events show EVENT_UUID
+hookstride events send DESTINATION_UUID --type webhook.test --wait
 hookstride stats
 
 hookstride incoming sources
@@ -102,7 +104,7 @@ hookstride --project PROJECT_UUID events list
 hookstride console
 ```
 
-Use `help` to view commands, Tab for completion, and `exit` or Ctrl+D to leave. The console also supports `show projects`, `show events`, `show destinations`, `use PROJECT_UUID`, `back`, and `set env dev|production`. The same `projects create/update` and `destinations create/update` commands work inside the console. Commands with customer-provided names and URLs are not saved to console history.
+Use `help` to view commands, Tab for completion, and `exit` or Ctrl+D to leave. The console also supports `show projects`, `show events`, `show destinations`, `use PROJECT_UUID`, `back`, and `set env dev|production`. The same `projects create/update`, `destinations create/update`, and `events send` commands work inside the console. Commands with customer-provided names and URLs are not saved to console history.
 
 ### JSON output
 
@@ -116,6 +118,33 @@ hookstride --env production --json billing history
 
 Errors go to standard error; unsuccessful requests return a nonzero exit code. When creating a destination, the server returns a signing secret **once**. Save it securely immediately. Both terminal output and `--json` deliberately include that one-time secret, so avoid piping creation output into logs or public CI artifacts.
 
+### Send a test event
+
+Use an existing active destination from `hookstride destinations list`.
+The command securely prompts for a project delivery API key (`whrk_`). It cannot use a
+Control API token (`whrctl_`); these credentials have different permissions.
+
+```bash
+hookstride --env production projects use PROJECT_UUID
+hookstride --env production events send DESTINATION_UUID --wait
+hookstride --env production events show EVENT_UUID
+```
+
+The event type defaults to `webhook.test`, with a harmless JSON payload:
+`{"message":"Hookstride CLI delivery test","source":"cli"}`.
+To send a different JSON object without placing its contents in shell history:
+
+```bash
+hookstride --env production events send DESTINATION_UUID --type demo.delivery --payload-file ./demo-payload.json --wait
+```
+
+To avoid the hidden prompt, set `HOOKSTRIDE_PRODUCTION_API_KEY` or
+`HOOKSTRIDE_DEV_API_KEY` for the matching environment only.
+Never add keys to CLI arguments, commit them to Git, or paste them into a public CI log.
+The CLI does not save delivery keys or their prompts in its configuration or history.
+The `--wait` flag polls for a terminal status and exits nonzero if delivery fails.
+A non-delivered event can be examined using `events show` with the usual Control token.
+
 ## Environments and local settings
 
 The CLI connects to the production API by default: `https://api.hookstride.com`.

{hookstride_cli-0.3.0 → hookstride_cli-0.3.1}/README.md

@@ -2,10 +2,11 @@
 
 Hookstride CLI lets you manage projects and webhook destinations, inspect delivery activity, and view billing records. It includes an interactive console with the same selected-project commands.
 
-Version 0.3.0 adds project creation and updates, plus destination creation, updates, and pausing/resuming. Billing and credential changes, delivery replay, and destructive operations remain unavailable.
+Version 0.3.1 adds signed test-event sending with an existing project's delivery API key, and optional delivery-status polling. Project and destination management remain available; billing and credential changes, delivery replay, and destructive operations remain unavailable.
 
 ## Installation
 
+
 Requires Python 3.11 or later.
 
 ```bash
@@ -63,6 +64,7 @@ hookstride destinations update DESTINATION_UUID --resume
 hookstride keys list
 hookstride events list --status failed
 hookstride events show EVENT_UUID
+hookstride events send DESTINATION_UUID --type webhook.test --wait
 hookstride stats
 
 hookstride incoming sources
@@ -89,7 +91,7 @@ hookstride --project PROJECT_UUID events list
 hookstride console
 ```
 
-Use `help` to view commands, Tab for completion, and `exit` or Ctrl+D to leave. The console also supports `show projects`, `show events`, `show destinations`, `use PROJECT_UUID`, `back`, and `set env dev|production`. The same `projects create/update` and `destinations create/update` commands work inside the console. Commands with customer-provided names and URLs are not saved to console history.
+Use `help` to view commands, Tab for completion, and `exit` or Ctrl+D to leave. The console also supports `show projects`, `show events`, `show destinations`, `use PROJECT_UUID`, `back`, and `set env dev|production`. The same `projects create/update`, `destinations create/update`, and `events send` commands work inside the console. Commands with customer-provided names and URLs are not saved to console history.
 
 ### JSON output
 
@@ -103,6 +105,33 @@ hookstride --env production --json billing history
 
 Errors go to standard error; unsuccessful requests return a nonzero exit code. When creating a destination, the server returns a signing secret **once**. Save it securely immediately. Both terminal output and `--json` deliberately include that one-time secret, so avoid piping creation output into logs or public CI artifacts.
 
+### Send a test event
+
+Use an existing active destination from `hookstride destinations list`.
+The command securely prompts for a project delivery API key (`whrk_`). It cannot use a
+Control API token (`whrctl_`); these credentials have different permissions.
+
+```bash
+hookstride --env production projects use PROJECT_UUID
+hookstride --env production events send DESTINATION_UUID --wait
+hookstride --env production events show EVENT_UUID
+```
+
+The event type defaults to `webhook.test`, with a harmless JSON payload:
+`{"message":"Hookstride CLI delivery test","source":"cli"}`.
+To send a different JSON object without placing its contents in shell history:
+
+```bash
+hookstride --env production events send DESTINATION_UUID --type demo.delivery --payload-file ./demo-payload.json --wait
+```
+
+To avoid the hidden prompt, set `HOOKSTRIDE_PRODUCTION_API_KEY` or
+`HOOKSTRIDE_DEV_API_KEY` for the matching environment only.
+Never add keys to CLI arguments, commit them to Git, or paste them into a public CI log.
+The CLI does not save delivery keys or their prompts in its configuration or history.
+The `--wait` flag polls for a terminal status and exits nonzero if delivery fails.
+A non-delivered event can be examined using `events show` with the usual Control token.
+
 ## Environments and local settings
 
 The CLI connects to the production API by default: `https://api.hookstride.com`.

{hookstride_cli-0.3.0 → hookstride_cli-0.3.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hookstride-cli"
-version = "0.3.0"
+version = "0.3.1"
 description = "Manage Hookstride projects and destinations, inspect webhook activity and billing."
 readme = "README.md"
 requires-python = ">=3.11"

{hookstride_cli-0.3.0 → hookstride_cli-0.3.1}/src/hookstride_cli/__init__.py

@@ -1,3 +1,3 @@
 """Hookstride developer CLI."""
 
-__version__ = "0.3.0"
+__version__ = "0.3.1"

{hookstride_cli-0.3.0 → hookstride_cli-0.3.1}/src/hookstride_cli/console.py

@@ -30,7 +30,7 @@ ALLOWED_COMMANDS: dict[str, set[str]] = {
     "projects": {"list", "use", "create", "update"},
     "destinations": {"list", "create", "update"},
     "keys": {"list"},
-    "events": {"list", "show"},
+    "events": {"list", "show", "send"},
     "billing": {"status", "history"},
     "incoming": {"sources", "routes", "bindings", "registration-keys"},
     "config": {"show"},
@@ -69,7 +69,7 @@ SAFE_HISTORY_COMMANDS = frozenset(
 COMMAND_COMPLETIONS = sorted(
     {
         *SAFE_HISTORY_COMMANDS,
-        "use ", "projects use ", "events show ", "events list --status ",
+        "use ", "projects use ", "events show ", "events send ", "events list --status ",
         "events list --origin ", "events list --page ", "set project ",
         "projects create --name ", "projects update ",
         "destinations create --name ", "destinations update ",
@@ -210,6 +210,7 @@ class HookstrideConsole:
             "[bold]show events[/bold]           View recent events\n"
             "[bold]events list --status failed[/bold]   Filter delivery history\n"
             "[bold]events show UUID[/bold]      Inspect a delivery and attempts\n"
+            "[bold]events send DEST_UUID --wait[/bold]    Send one signed delivery test\n"
             "[bold]show billing[/bold]          View plan and credits\n"
             "[bold]show payments[/bold]         View payment history\n"
             "[bold]show sources[/bold]          Inspect incoming sources\n"
@@ -307,6 +308,8 @@ class HookstrideConsole:
             raise cli.CLIError("No project selected. Run 'show projects' then 'use UUID'.")
         if _requires_token(group, action) and not self._current_token():
             raise cli.CLIError("No management token for this environment. Run 'auth login'.")
+        if args[:2] == ["events", "show"] and len(args) == 2:
+            raise cli.CLIError("Usage: events show EVENT_UUID.")
         options = ["--env", self.environment, "--api-url", self.session.origin]
         if self.project:
             options += ["--project", self.project]
@@ -320,11 +323,19 @@ class HookstrideConsole:
                     standalone_mode=False,
                 )
         except click.exceptions.Exit as exc:
-            # 'status' already displayed a red Offline panel. Do not add an
-            # unrelated error when returning to the interactive prompt.
+            # The nested CLI must never terminate the interactive console.
+            if exc.exit_code == 0:
+                return
+            # 'status' already displayed a red Offline panel.
             if group == "status" and not json_output and exc.exit_code == 1:
                 return
             raise cli.CLIError("Invalid command arguments. Type 'help'.") from None
+        except SystemExit as exc:
+            # Some Typer/Click error paths raise SystemExit instead of Exit.
+            # Do not let them unwind run() and clear in-memory authentication.
+            if exc.code in (0, None):
+                return
+            raise cli.CLIError("Invalid command arguments. Type 'help'.") from None
         except (click.ClickException, click.Abort):
             # Click errors can quote user-provided arguments; don't echo them.
             raise cli.CLIError("Invalid command arguments. Type 'help'.") from None
@@ -447,7 +458,8 @@ def _requires_project(group: str, action: str | None) -> bool:
 
 
 def _requires_token(group: str, action: str | None) -> bool:
-    return group != "status" and not (group == "config" and action == "show")
+    return (group != "status" and not (group == "config" and action == "show")
+            and not (group == "events" and action == "send"))
 
 
 def run_console(session: cli.Session) -> None:

{hookstride_cli-0.3.0 → hookstride_cli-0.3.1}/src/hookstride_cli/main.py

@@ -6,12 +6,15 @@ Commands use Control API tokens. This module never persists a token.
 from __future__ import annotations
 
 import contextlib
+import getpass
 import json
 import os
 import sys
 import tempfile
+import time
 import unicodedata
 import uuid
+import warnings
 from pathlib import Path
 from typing import Any
 from urllib.parse import urlsplit
@@ -40,7 +43,7 @@ app = typer.Typer(
 auth_app = typer.Typer(help="Check Control API authentication.")
 projects_app = typer.Typer(help="List, create, update and select workspace projects.")
 destinations_app = typer.Typer(help="List, create and update webhook destinations.")
-events_app = typer.Typer(help="Inspect delivery history and attempts.")
+events_app = typer.Typer(help="Send test events and inspect delivery history.")
 billing_app = typer.Typer(help="Inspect project-isolated billing.")
 incoming_app = typer.Typer(help="Inspect incoming webhook sources.")
 keys_app = typer.Typer(help="Inspect masked project API keys.")
@@ -196,12 +199,13 @@ def _request(
     params: dict[str, Any] | None = None,
     method: str = "GET",
     json_body: dict[str, Any] | None = None,
+    auth_token: str | None = None,
 ) -> Any:
     if method not in {"GET", "POST", "PATCH"}:
         raise CLIError("Unsupported API request method.")
     headers = {"Accept": "application/json"}
     if authenticate:
-        headers["Authorization"] = "Bearer " + _token()
+        headers["Authorization"] = "Bearer " + (auth_token if auth_token is not None else _token())
     try:
         with httpx.Client(
             base_url=session.origin,
@@ -219,6 +223,8 @@ def _request(
             "Unable to reach the Hookstride API. Check the URL and connection."
         ) from None
     if response.status_code == 401:
+        if auth_token is not None:
+            raise CLIError("Delivery API key rejected. Check that the project's delivery key is valid.")
         raise CLIError(
             "Authentication rejected. Check that your control token is valid."
         )
@@ -816,6 +822,105 @@ def events_show(ctx: typer.Context, event_id: str = typer.Argument(...)) -> None
     )
 
 
+def _delivery_key(session: Session) -> str:
+    """Read a project-scoped delivery key without saving or echoing it."""
+    env_name = f"HOOKSTRIDE_{session.environment.upper()}_API_KEY"
+    token = os.environ.get(env_name, "").strip()
+    if not token:
+        try:
+            # Never fall back to visibly echoed input on a noninteractive terminal.
+            with warnings.catch_warnings():
+                warnings.simplefilter("error", getpass.GetPassWarning)
+                token = getpass.getpass("Project delivery API key (hidden): ").strip()
+        except (getpass.GetPassWarning, KeyboardInterrupt, EOFError):
+            raise CLIError(
+                f"Cannot read a hidden delivery key. Set {env_name} in your shell instead."
+            ) from None
+    if (
+        not token.startswith("whrk_")
+        or not 16 <= len(token) <= 512
+        or any(ch.isspace() for ch in token)
+    ):
+        raise CLIError("Expected a valid project delivery API key (whrk_...).")
+    return token
+
+
+@events_app.command("send")
+def events_send(
+    ctx: typer.Context,
+    destination_id: str = typer.Argument(..., help="Existing destination UUID."),
+    event_type: str = typer.Option("webhook.test", "--type", help="Event type."),
+    payload_file: Path | None = typer.Option(
+        None, "--payload-file", help="Optional JSON object file, never passed on the command line."
+    ),
+    wait: bool = typer.Option(False, "--wait", help="Wait for delivered or failed status."),
+    timeout: int = typer.Option(120, "--timeout", min=5, max=600, help="Maximum wait in seconds."),
+) -> None:
+    """Send one real event through Hookstride using a project delivery API key."""
+    _project(ctx)  # Explicit project selection prevents accidental context-free writes.
+    destination_id = _uuid(destination_id)
+    event_type = event_type.strip()
+    if not event_type or len(event_type) > 160 or any(ord(ch) < 33 or ord(ch) > 126 for ch in event_type):
+        raise CLIError("Event type must contain 1–160 visible ASCII characters without spaces.")
+    payload: dict[str, Any] = {"message": "Hookstride CLI delivery test", "source": "cli"}
+    if payload_file is not None:
+        try:
+            if payload_file.stat().st_size > 65536:
+                raise CLIError("Payload file exceeds the 64 KB CLI limit.")
+            value = json.loads(payload_file.read_text(encoding="utf-8"))
+        except (OSError, UnicodeError, ValueError):
+            raise CLIError("Cannot read payload file as JSON.") from None
+        if not isinstance(value, dict):
+            raise CLIError("Payload file must contain a JSON object.")
+        payload = value
+    session = _session(ctx)
+    token = _delivery_key(session)
+    data = _request(
+        session,
+        "/api/v1/events/",
+        method="POST",
+        json_body={"endpoint": destination_id, "event_type": event_type, "payload": payload},
+        auth_token=token,
+    )
+    if not isinstance(data, dict) or not isinstance(data.get("id"), str):
+        raise CLIError("Unexpected event creation response.")
+    event_id = _uuid(data["id"])
+    if not session.json_output:
+        session.console.print(f"[green]✓[/green] Event accepted: {_escaped(event_id)}")
+    if wait:
+        deadline = time.monotonic() + timeout
+        previous = None
+        while True:
+            data = _request(session, f"/api/v1/events/{event_id}/", auth_token=token)
+            if not isinstance(data, dict):
+                raise CLIError("Unexpected event status response.")
+            status = data.get("status")
+            if not session.json_output and status != previous:
+                session.console.print("  Status:", _colored_status(status))
+                previous = status
+            if status in {"delivered", "failed"}:
+                break
+            if time.monotonic() >= deadline:
+                if session.json_output:
+                    _print(ctx, {"id": event_id, "status": status, "timed_out": True})
+                raise CLIError(f"Delivery is still {status or 'pending'} for event {event_id}; inspect it with 'events show'.")
+            time.sleep(min(2, max(0, deadline - time.monotonic())))
+    if session.json_output:
+        _print(ctx, {"id": event_id, "status": data.get("status"), "attempt_count": data.get("attempt_count")})
+    elif data.get("status") == "delivered":
+        session.console.print(f"[green]✓[/green] Delivered: {_escaped(event_id)}")
+    elif data.get("status") == "failed":
+        safe_error = _safe_terminal_text(data.get("last_error") or "Unknown delivery failure.")
+        session.console.print("  Error:", Text(safe_error))
+        for attempt in data.get("attempts", []):
+            session.console.print(
+                f"  Attempt {attempt.get('attempt_number', '?')}: "
+                f"HTTP {_escaped(attempt.get('status_code') or 'no response')}"
+            )
+    if data.get("status") == "failed":
+        raise CLIError(f"Event {event_id} failed. Inspect 'events show {event_id}'.")
+
+
 @billing_app.command("status")
 def billing_status(ctx: typer.Context) -> None:
     """Show the selected project's plan and Flex credit balance."""

{hookstride_cli-0.3.0 → hookstride_cli-0.3.1}/tests/test_console.py

@@ -439,3 +439,63 @@ def test_console_status_offline_returns_to_prompt_without_duplicate_error(
     assert "Invalid command arguments" not in shell.test_output.getvalue()
     assert "Unable to connect" not in shell.test_output.getvalue()
     assert shell.execute_line("help")
+
+
+def test_events_show_missing_id_keeps_console_authenticated(shell, monkeypatch):
+    shell.project = PROJECT
+    shell.session.project = PROJECT
+    shell.tokens["dev"] = DEV_TOKEN
+    monkeypatch.setattr(
+        cli, "_request", lambda *_args, **_kwargs: (_ for _ in ()).throw(
+            AssertionError("Missing event ID must not call the API")
+        ),
+    )
+    assert shell.execute_line("events show") is True
+    assert shell._current_token() == DEV_TOKEN
+    assert shell.project == PROJECT
+    assert "Usage: events show EVENT_UUID." in shell.test_output.getvalue()
+    assert "Console closed" not in shell.test_output.getvalue()
+
+
+def test_nested_command_systemexit_does_not_destroy_console_session(shell, monkeypatch):
+    shell.project = PROJECT
+    shell.session.project = PROJECT
+    shell.tokens["dev"] = DEV_TOKEN
+
+    def usage_exit(*_args, **_kwargs):
+        raise SystemExit(2)
+
+    monkeypatch.setattr(shell.click_command, "main", usage_exit)
+    assert shell.execute_line("events list") is True
+    assert shell._current_token() == DEV_TOKEN
+    assert shell.project == PROJECT
+    assert "Invalid command arguments" in shell.test_output.getvalue()
+    assert "Console closed" not in shell.test_output.getvalue()
+
+
+def test_interactive_console_continues_after_missing_event_id(shell, monkeypatch):
+    shell.project = PROJECT
+    shell.session.project = PROJECT
+    shell.tokens["dev"] = DEV_TOKEN
+    commands = iter(["events show", "auth status", "exit"])
+    seen = []
+
+    class FakePromptSession:
+        def __init__(self, **_kwargs):
+            pass
+
+        def prompt(self, _prompt):
+            return next(commands)
+
+    def request(_session, path, **_kwargs):
+        seen.append((path, shell._current_token()))
+        return {"user": {"email": "developer@example.test"}}
+
+    monkeypatch.setattr(shell_module, "PromptSession", FakePromptSession)
+    monkeypatch.setattr(cli, "_request", request)
+    shell.run()
+    output = shell.test_output.getvalue()
+    assert "Usage: events show EVENT_UUID." in output
+    assert seen == [("/control/v1/me/", DEV_TOKEN)]
+    assert output.count("Console closed") == 1
+    assert shell.tokens == {}

hookstride_cli-0.3.1/tests/test_event_send.py

@@ -0,0 +1,174 @@
+"""Offline tests for sending real delivery events from the CLI."""
+from __future__ import annotations
+
+import json
+import uuid
+
+import httpx
+from typer.testing import CliRunner
+
+from hookstride_cli import main as cli
+
+runner = CliRunner()
+PROJECT = str(uuid.UUID("11111111-1111-4111-8111-111111111111"))
+DESTINATION = str(uuid.UUID("22222222-2222-4222-8222-222222222222"))
+EVENT = str(uuid.UUID("33333333-3333-4333-8333-333333333333"))
+KEY = "whrk_test_project_api_key_not_real"
+
+
+def setup(monkeypatch, tmp_path):
+    monkeypatch.setenv("HOOKSTRIDE_PRODUCTION_API_KEY", KEY)
+    monkeypatch.setenv("HOOKSTRIDE_CONFIG_FILE", str(tmp_path / "config.json"))
+    monkeypatch.delenv("HOOKSTRIDE_CONTROL_TOKEN", raising=False)
+
+
+def test_send_uses_delivery_key_not_control_token(monkeypatch, tmp_path):
+    setup(monkeypatch, tmp_path)
+    requests = []
+
+    def fake_request(session, path, **kwargs):
+        requests.append((session.environment, path, kwargs))
+        return {"id": EVENT, "status": "pending"}
+
+    monkeypatch.setattr(cli, "_request", fake_request)
+    result = runner.invoke(cli.app, ["--project", PROJECT, "events", "send", DESTINATION])
+    assert result.exit_code == 0, result.output
+    assert requests == [("production", "/api/v1/events/", {
+        "method": "POST",
+        "json_body": {
+            "endpoint": DESTINATION,
+            "event_type": "webhook.test",
+            "payload": {"message": "Hookstride CLI delivery test", "source": "cli"},
+        },
+        "auth_token": KEY,
+    })]
+    assert EVENT in result.output
+    assert KEY not in result.output
+    assert not (tmp_path / "config.json").exists()
+
+
+def test_wait_polls_until_delivered_and_json_output(monkeypatch, tmp_path):
+    setup(monkeypatch, tmp_path)
+    calls = []
+
+    def fake_request(_session, path, **kwargs):
+        calls.append(path)
+        if path == "/api/v1/events/":
+            return {"id": EVENT, "status": "pending"}
+        if len(calls) == 2:
+            return {"id": EVENT, "status": "delivering"}
+        return {"id": EVENT, "status": "delivered", "attempt_count": 1}
+
+    monkeypatch.setattr(cli, "_request", fake_request)
+    monkeypatch.setattr(cli.time, "sleep", lambda _seconds: None)
+    result = runner.invoke(cli.app, ["--project", PROJECT, "--json", "events", "send",
+                                    DESTINATION, "--wait"])
+    assert result.exit_code == 0, result.output
+    assert json.loads(result.stdout) == {"id": EVENT, "status": "delivered", "attempt_count": 1}
+    assert calls == ["/api/v1/events/", f"/api/v1/events/{EVENT}/", f"/api/v1/events/{EVENT}/"]
+
+
+def test_failed_delivery_returns_failure_and_http_status(monkeypatch, tmp_path):
+    setup(monkeypatch, tmp_path)
+
+    def fake_request(_session, path, **_kw):
+        return ({"id": EVENT, "status": "pending"} if path.endswith("/events/")
+                else {"id": EVENT, "status": "failed", "last_error": "Destination returned HTTP 401.",
+                      "attempts": [{"attempt_number": 1, "status_code": 401}]})
+
+    monkeypatch.setattr(cli, "_request", fake_request)
+    result = runner.invoke(cli.app, ["--project", PROJECT, "events", "send",
+                                    DESTINATION, "--wait"])
+    assert result.exit_code != 0
+    assert "HTTP 401" in result.output
+    assert "failed" in result.output.lower()
+
+
+def test_invalid_payload_and_destination_refuse_network(monkeypatch, tmp_path):
+    setup(monkeypatch, tmp_path)
+    called = []
+    monkeypatch.setattr(cli, "_request", lambda *a, **kw: called.append((a, kw)))
+    filename = tmp_path / "payload.json"
+    for value in ("not json", "[1, 2]"):
+        filename.write_text(value)
+        result = runner.invoke(cli.app, ["--project", PROJECT, "events", "send",
+                                        DESTINATION, "--payload-file", str(filename)])
+        assert result.exit_code != 0
+    result = runner.invoke(cli.app, ["--project", PROJECT, "events", "send",
+                                    "bad-id", "--wait"])
+    assert result.exit_code != 0
+    assert called == []
+
+
+def test_payload_file_and_custom_type(monkeypatch, tmp_path):
+    setup(monkeypatch, tmp_path)
+    payload = tmp_path / "data.json"
+    payload.write_text('{"source":"product-hunt","message":"test"}')
+    seen = []
+
+    def fake_request(_session, _path, **kw):
+        seen.append(kw)
+        return {"id": EVENT, "status": "pending"}
+
+    monkeypatch.setattr(cli, "_request", fake_request)
+    result = runner.invoke(cli.app, ["--project", PROJECT, "events", "send",
+                                    DESTINATION, "--type", "demo.delivery",
+                                    "--payload-file", str(payload)])
+    assert result.exit_code == 0, result.output
+    assert seen[0]["json_body"]["payload"] == {"source": "product-hunt", "message": "test"}
+    assert seen[0]["json_body"]["event_type"] == "demo.delivery"
+
+
+def test_delivery_key_is_sent_only_as_bearer_header(monkeypatch):
+    original = httpx.Client
+    requests = []
+
+    def handler(request):
+        requests.append(request)
+        return httpx.Response(201, json={"id": EVENT, "status": "pending"})
+
+    monkeypatch.setattr(cli.httpx, "Client",
+                        lambda **kwargs: original(transport=httpx.MockTransport(handler), **kwargs))
+    session = cli.Session("production", None, PROJECT, True, True)
+    response = cli._request(session, "/api/v1/events/", method="POST",
+                            json_body={"endpoint": DESTINATION, "event_type": "webhook.test",
+                                       "payload": {}}, auth_token=KEY)
+    assert response["id"] == EVENT
+    request = requests[0]
+    assert request.method == "POST"
+    assert request.headers["Authorization"] == f"Bearer {KEY}"
+    assert KEY not in str(request.url)
+    assert KEY not in request.content.decode("utf8")
+
+
+def test_dev_api_key_is_not_sent_to_production(monkeypatch, tmp_path):
+    setup(monkeypatch, tmp_path)
+    monkeypatch.delenv("HOOKSTRIDE_PRODUCTION_API_KEY")
+    monkeypatch.setenv("HOOKSTRIDE_DEV_API_KEY", "whrk_dev_key_should_not_leak")
+    monkeypatch.setattr(cli.getpass, "getpass", lambda _prompt: (_ for _ in ()).throw(EOFError()))
+    called = []
+    monkeypatch.setattr(cli, "_request", lambda *a, **kw: called.append(a))
+    result = runner.invoke(cli.app, ["--env", "production", "--project", PROJECT,
+                                    "events", "send", DESTINATION])
+    assert result.exit_code != 0
+    assert not called
+    assert "whrk_dev_key_should_not_leak" not in result.output
+
+
+def test_401_delivery_auth_error_does_not_reveal_key(monkeypatch):
+    original = httpx.Client
+
+    def handler(_request):
+        return httpx.Response(401, json={"detail": KEY})
+
+    monkeypatch.setattr(cli.httpx, "Client",
+                        lambda **kwargs: original(transport=httpx.MockTransport(handler), **kwargs))
+    session = cli.Session("production", None, PROJECT, False, True)
+    try:
+        cli._request(session, "/api/v1/events/", method="POST",
+                     json_body={"endpoint": DESTINATION}, auth_token=KEY)
+    except cli.CLIError as exc:
+        assert "Delivery API key rejected" in str(exc)
+        assert KEY not in str(exc)
+    else:
+        raise AssertionError("Expected authentication failure")

{hookstride_cli-0.3.0 → hookstride_cli-0.3.1}/uv.lock

@@ -62,7 +62,7 @@ wheels = [
 
 [[package]]
 name = "hookstride-cli"
-version = "0.3.0"
+version = "0.3.1"
 source = { editable = "." }
 dependencies = [
     { name = "click" },