iac-code 0.3.0__tar.gz → 0.3.1__tar.gz

{iac_code-0.3.0 → iac_code-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: iac_code
-Version: 0.3.0
+Version: 0.3.1
 Summary: Your AI-powered Infrastructure as Code assistant
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.10
@@ -74,6 +74,20 @@ Reading from stdin is also supported:
 echo "Create an OSS Bucket" | iac-code --prompt -
 ```
 
+## Contributing
+
+Install [uv](https://docs.astral.sh/uv/getting-started/installation/), then:
+
+```bash
+make install   # install dependencies and pre-commit hooks
+make dev       # run in debug mode
+make test      # run tests
+make lint      # run linters
+make format    # format code
+```
+
+See the [Contributing Guide](https://aliyun.github.io/iac-code/getting-started/contributing) for details.
+
 ## Contact Us
 
 | [DingTalk](https://qr.dingtalk.com/action/joingroup?code=v1,k1,ubm/77U7qRh/STFZUNBP26X4PNg2z6+uhiPcLGtDNfU=&_dt_no_comment=1&origin=11) | [Discord](https://discord.gg/qECFuFBwF) |

{iac_code-0.3.0 → iac_code-0.3.1}/README.md

@@ -55,6 +55,20 @@ Reading from stdin is also supported:
 echo "Create an OSS Bucket" | iac-code --prompt -
 ```
 
+## Contributing
+
+Install [uv](https://docs.astral.sh/uv/getting-started/installation/), then:
+
+```bash
+make install   # install dependencies and pre-commit hooks
+make dev       # run in debug mode
+make test      # run tests
+make lint      # run linters
+make format    # format code
+```
+
+See the [Contributing Guide](https://aliyun.github.io/iac-code/getting-started/contributing) for details.
+
 ## Contact Us
 
 | [DingTalk](https://qr.dingtalk.com/action/joingroup?code=v1,k1,ubm/77U7qRh/STFZUNBP26X4PNg2z6+uhiPcLGtDNfU=&_dt_no_comment=1&origin=11) | [Discord](https://discord.gg/qECFuFBwF) |

{iac_code-0.3.0 → iac_code-0.3.1}/pyproject.toml

@@ -21,6 +21,7 @@ dependencies = [
     "pyperclip>=1.8.0",
     "openai>=1.50",
     "httpx>=0.27.0",
+    "packaging>=24.0",
     "tiktoken>=0.7.0",
     "jsonschema>=4.20",
     "alibabacloud-ros20190910>=3.0.0",
@@ -32,8 +33,8 @@ dependencies = [
     "pillow==12.2.0",
     "cryptography>=42.0",
     "keyring>=25.0",
-    "tree-sitter>=0.23",
-    "tree-sitter-bash>=0.23",
+    "tree-sitter>=0.25,<0.26",
+    "tree-sitter-bash>=0.25,<0.26",
 ]
 
 [project.optional-dependencies]

iac_code-0.3.1/src/iac_code/__init__.py

@@ -0,0 +1,2 @@
+__version__ = "0.3.1"
+__release_date__ = "2026-06-02"

{iac_code-0.3.0 → iac_code-0.3.1}/src/iac_code/a2a/client.py

@@ -7,6 +7,7 @@ from time import monotonic
 from typing import Any, AsyncIterator
 
 import httpx
+from a2a.types import Role
 
 from iac_code.a2a.signing import AgentCardSignature, agent_card_signature_jwks_url, verify_agent_card_dict
 from iac_code.a2a.transport import A2AAuthConfig, A2ATransportBinding, UnsupportedA2ATransportError, headers_for_auth
@@ -31,19 +32,52 @@ class A2AClientResponse:
         if not isinstance(result, dict):
             return ""
         text = result.get("text")
-        if isinstance(text, str):
+        if isinstance(text, str) and text:
             return text
         status = result.get("status")
-        if not isinstance(status, dict):
-            return ""
-        message = status.get("message")
-        if not isinstance(message, dict):
-            return ""
-        parts = message.get("parts")
-        if not isinstance(parts, list) or not parts or not isinstance(parts[0], dict):
-            return ""
-        value = parts[0].get("text")
-        return value if isinstance(value, str) else ""
+        if isinstance(status, dict):
+            extracted = _extract_parts_text(status.get("message"))
+            if extracted:
+                return extracted
+        task = result.get("task")
+        if isinstance(task, dict):
+            task_status = task.get("status")
+            if isinstance(task_status, dict):
+                extracted = _extract_parts_text(task_status.get("message"))
+                if extracted:
+                    return extracted
+            history = task.get("history")
+            if isinstance(history, list):
+                for entry in reversed(history):
+                    extracted = _extract_agent_entry_text(entry)
+                    if extracted:
+                        return extracted
+        return ""
+
+
+_AGENT_ROLE_NAME = Role.Name(Role.ROLE_AGENT)
+
+
+def _extract_agent_entry_text(entry: Any) -> str:
+    if not isinstance(entry, dict) or entry.get("role") != _AGENT_ROLE_NAME:
+        return ""
+    return _extract_parts_text(entry)
+
+
+def _extract_parts_text(message: Any) -> str:
+    if not isinstance(message, dict):
+        return ""
+    parts = message.get("parts")
+    if not isinstance(parts, list):
+        return ""
+    pieces: list[str] = []
+    for part in parts:
+        if not isinstance(part, dict):
+            continue
+        value = part.get("text")
+        if isinstance(value, str):
+            pieces.append(value)
+    return "".join(pieces)
 
 
 class A2AClient:

{iac_code-0.3.0 → iac_code-0.3.1}/src/iac_code/a2a/transports/base.py

@@ -9,7 +9,7 @@ from urllib.parse import urlparse
 from iac_code.a2a.transport import A2ATransportBinding, UnsupportedA2ATransportError
 from iac_code.i18n import _
 
-RUNNABLE_TRANSPORTS = frozenset({"http", "stdio", "unix", "websocket", "grpc", "grpc-jsonrpc", "redis-streams"})
+SUPPORTED_TRANSPORTS = frozenset({"http", "stdio", "unix", "websocket", "grpc", "grpc-jsonrpc", "redis-streams"})
 
 
 class A2ATransportConfigError(ValueError):
@@ -159,8 +159,16 @@ def select_binding(bindings: Sequence[A2ATransportBinding]) -> A2ATransportBindi
     raise UnsupportedA2ATransportError(f"No runnable A2A transport found. Candidate bindings: {names}")
 
 
+def validate_transport_supported(transport: str) -> None:
+    """Raise ValueError if the transport name is not recognised."""
+    if transport not in SUPPORTED_TRANSPORTS:
+        supported = ", ".join(sorted(SUPPORTED_TRANSPORTS))
+        raise ValueError(f"Unsupported transport '{transport}'. Supported values: {supported}")
+
+
 def validate_transport_for_platform(transport: str) -> None:
-    """Raise RuntimeError if the transport is unavailable on the current platform."""
+    """Raise an error if the transport is unsupported or unavailable on the current platform."""
+    validate_transport_supported(transport)
     if transport == "unix" and sys.platform == "win32":
         raise RuntimeError(
             _(

{iac_code-0.3.0 → iac_code-0.3.1}/src/iac_code/acp/slash_registry.py

@@ -91,7 +91,7 @@ class ACPSlashRegistry:
     async def _handle_clear(self, agent_loop) -> str:
         """Clear the agent_loop conversation history."""
         try:
-            agent_loop.context_manager.reset()
+            agent_loop.reset()
         except Exception as exc:
             logger.warning("ACP /clear failed: %s", exc)
             return _("Clear failed: {error}").format(error=exc)

{iac_code-0.3.0 → iac_code-0.3.1}/src/iac_code/agent/agent_loop.py

@@ -32,6 +32,7 @@ from iac_code.types.stream_events import (
     ToolResultEvent,
     ToolUseEndEvent,
     ToolUseStartEvent,
+    Usage,
 )
 
 
@@ -69,6 +70,7 @@ class AgentLoop:
         cwd: str | None = None,
         permission_context: Any = None,  # ToolPermissionContext
         permission_context_getter: Any = None,  # Callable[[], ToolPermissionContext | None]
+        auto_trigger_skills: list[Any] | None = None,
     ) -> None:
         self._provider_manager = provider_manager
         self.system_prompt = system_prompt
@@ -79,6 +81,8 @@ class AgentLoop:
         self._cwd = cwd or os.getcwd()
         self._permission_context = permission_context
         self._permission_context_getter = permission_context_getter
+        self._auto_trigger_skills = auto_trigger_skills or []
+        self._auto_loaded_skills: set[str] = set()
         self._current_git_branch: str | None = None
 
         model_name = ""
@@ -224,6 +228,7 @@ class AgentLoop:
                 # between turns (user runs git checkout via Bash tool), but
                 # is treated as stable within a single in-flight request.
                 self._refresh_git_branch()
+                await self._apply_auto_triggers(user_input)
                 self.context_manager.add_user_message(user_input)
                 if self._session_storage:
                     from iac_code.agent.message import Message
@@ -535,6 +540,46 @@ class AgentLoop:
                             self.context_manager.add_raw_message(msg)
                     if result.context_modifier is not None:
                         self._apply_context_modifier(result.context_modifier)
+        else:
+            yield MessageEndEvent(stop_reason="max_turns", usage=Usage())
+
+    async def _apply_auto_triggers(self, user_input: str | list[ContentBlock]) -> None:
+        if not self._auto_trigger_skills:
+            return
+        if all(command.name in self._auto_loaded_skills for command in self._auto_trigger_skills):
+            return
+        prompt_text = self._auto_trigger_text(user_input)
+        if not prompt_text:
+            return
+
+        from iac_code.skills.auto_trigger import process_auto_triggered_skills
+
+        results = await process_auto_triggered_skills(
+            prompt_text,
+            self._auto_trigger_skills,
+            loaded_skill_names=self._auto_loaded_skills,
+            context_messages=self.context_manager.get_messages(),
+            session_id=self._session_id,
+        )
+        for result in results:
+            for msg in result.new_messages:
+                injected = self.context_manager.add_raw_message(msg)
+                if self._session_storage:
+                    self._session_storage.append(
+                        self._cwd,
+                        self._session_id,
+                        injected,
+                        git_branch=self._current_git_branch,
+                    )
+            if result.context_modifier is not None:
+                self._apply_context_modifier(result.context_modifier)
+
+    @staticmethod
+    def _auto_trigger_text(user_input: str | list[ContentBlock]) -> str:
+        if isinstance(user_input, str):
+            return user_input
+        parts = [block.text for block in user_input if isinstance(block, TextBlock)]
+        return " ".join(part for part in parts if part).strip()
 
     def _apply_context_modifier(self, modifier: Any) -> None:
         """Apply a context modifier from a ToolResult to the current execution context."""
@@ -642,6 +687,7 @@ class AgentLoop:
 
         self._session_id = session_id
         self._current_git_branch = None
+        self._auto_loaded_skills.clear()
         self.context_manager.reset()
         if resume_messages:
             self.context_manager.load_messages(resume_messages)
@@ -663,6 +709,7 @@ class AgentLoop:
             self._current_git_branch = None
 
     def reset(self) -> None:
+        self._auto_loaded_skills.clear()
         self.context_manager.reset()
 
     def get_context_usage(self) -> dict:

{iac_code-0.3.0 → iac_code-0.3.1}/src/iac_code/cli/headless.py

@@ -24,6 +24,11 @@ from iac_code.types.stream_events import (
     ErrorEvent,
     MessageEndEvent,
     PermissionRequestEvent,
+    StackInstancesProgressEvent,
+    StackProgressEvent,
+    SubAgentToolEvent,
+    ToolResultEvent,
+    ToolUseStartEvent,
 )
 from iac_code.utils.background_housekeeping import start_background_housekeeping
 
@@ -33,6 +38,47 @@ EXIT_MAX_TURNS = 2
 __all__ = ["HeadlessRunner", "logger"]
 
 
+class _ProgressWriter:
+    """Write human-readable headless progress to stderr."""
+
+    def __init__(self, stream: IO[str]) -> None:
+        self._stream = stream
+
+    def handle(self, event: Any) -> None:
+        line: str | None = None
+        if isinstance(event, ToolUseStartEvent):
+            line = _("Tool started: {}").format(event.name)
+        elif isinstance(event, ToolResultEvent):
+            if event.is_error:
+                line = _("Tool failed: {}").format(event.tool_name)
+            else:
+                line = _("Tool finished: {}").format(event.tool_name)
+        elif isinstance(event, SubAgentToolEvent):
+            if event.is_done:
+                if event.is_error:
+                    line = _("Child tool failed: {}").format(event.child_tool_name)
+                else:
+                    line = _("Child tool finished: {}").format(event.child_tool_name)
+            else:
+                line = _("Child tool started: {}").format(event.child_tool_name)
+        elif isinstance(event, StackProgressEvent):
+            line = _("Stack {}: {} ({:.1f}%)").format(
+                event.stack_name,
+                event.status,
+                event.progress_percentage,
+            )
+        elif isinstance(event, StackInstancesProgressEvent):
+            line = _("Stack group {}: {} ({}%)").format(
+                event.stack_group_name,
+                event.status,
+                event.progress_percentage,
+            )
+
+        if line is not None:
+            self._stream.write(line + "\n")
+            self._stream.flush()
+
+
 class HeadlessRunner:
     """Run a single prompt headlessly, auto-approving all permission requests."""
 
@@ -45,6 +91,8 @@ class HeadlessRunner:
         cli_allowed_tools: list[str] | None = None,
         cli_disallowed_tools: list[str] | None = None,
         cli_permission_mode: str | None = None,
+        verbose: bool = False,
+        progress_stream: IO[str] | None = None,
     ) -> None:
         self._model = model
         self._output_format = output_format
@@ -53,6 +101,8 @@ class HeadlessRunner:
         self._cli_allowed_tools = cli_allowed_tools
         self._cli_disallowed_tools = cli_disallowed_tools
         self._cli_permission_mode = cli_permission_mode
+        self._verbose = verbose
+        self._progress_stream = progress_stream or sys.stderr
 
     def _print_provider_not_configured(self, exc: Exception) -> None:
         logger.error("Provider not configured: {}", exc)
@@ -91,6 +141,7 @@ class HeadlessRunner:
 
         agent_loop = self._create_agent_loop()
         writer = create_writer(self._output_format, self._output_stream)
+        progress_writer = _ProgressWriter(self._progress_stream) if self._verbose else None
 
         has_error = False
         hit_max_turns = False
@@ -118,6 +169,9 @@ class HeadlessRunner:
                 if isinstance(event, MessageEndEvent) and event.stop_reason == "max_turns":
                     hit_max_turns = True
 
+                if progress_writer is not None:
+                    progress_writer.handle(event)
+
                 writer.handle(event)
         except ProviderNotConfiguredError as exc:
             self._print_provider_not_configured(exc)

{iac_code-0.3.0 → iac_code-0.3.1}/src/iac_code/cli/main.py

@@ -84,6 +84,7 @@ def main(
     output_format: str = typer.Option("text", "--output-format", help=_("Output format: text, json, stream-json")),
     max_turns: int = typer.Option(100, "--max-turns", help=_("Maximum agent turns in headless mode")),
     debug: bool = typer.Option(False, "--debug", "-d", help=_("Enable debug logging")),
+    verbose: bool = typer.Option(False, "--verbose", help=_("Show headless progress on stderr")),
     version: bool = typer.Option(False, "--version", "-v", "-V", is_eager=True, help=_("Show version and exit")),
     resume: str = typer.Option("", "--resume", "-r", help=_("Resume a session by ID")),
     continue_session: bool = typer.Option(False, "--continue", "-c", help=_("Resume the most recent session")),
@@ -150,6 +151,18 @@ def main(
         typer.echo(_("Error: --resume and --continue cannot be used together."), err=True)
         raise typer.Exit(1)
 
+    fmt = None
+    if prompt:
+        from iac_code.cli.output_formats import OutputFormat
+
+        normalized_output_format = (output_format or "text").strip().lower()
+        try:
+            fmt = OutputFormat(normalized_output_format)
+        except ValueError as exc:
+            valid = ", ".join(item.value for item in OutputFormat)
+            typer.echo(_("Invalid --output-format '{}'. Valid values: {}").format(output_format, valid), err=True)
+            raise typer.Exit(1) from exc
+
     # Priority: CLI parameter > saved config > default
     if not model:
         try:
@@ -159,10 +172,21 @@ def main(
             raise typer.Exit(1)
 
     if prompt:
+        assert fmt is not None
+
         # Read from stdin if prompt is "-"
         if prompt == "-":
             prompt = sys.stdin.read().strip()
 
+        if permission_mode:
+            from iac_code.services.permissions.loader import parse_cli_permission_mode
+
+            try:
+                parse_cli_permission_mode(permission_mode)
+            except ValueError as exc:
+                typer.echo(str(exc), err=True)
+                raise typer.Exit(1) from exc
+
         # Headless mode: generate session_id for logging only
         session_id = str(uuid.uuid4())
         setup_logging(session_id=session_id, debug=debug)
@@ -175,7 +199,7 @@ def main(
             Events.SESSION_STARTED,
             {
                 "headless": True,
-                "output_format": output_format or "text",
+                "output_format": fmt.value,
             },
         )
         add_metric(Metrics.SESSION_COUNT, 1, {})
@@ -215,9 +239,7 @@ def main(
             return await coro
 
         from iac_code.cli.headless import HeadlessRunner
-        from iac_code.cli.output_formats import OutputFormat
 
-        fmt = OutputFormat(output_format)
         cli_allowed = [s.strip() for s in allowed_tools.split(",") if s.strip()] if allowed_tools else None
         cli_disallowed = [s.strip() for s in disallowed_tools.split(",") if s.strip()] if disallowed_tools else None
         try:
@@ -228,6 +250,7 @@ def main(
                 cli_allowed_tools=cli_allowed,
                 cli_disallowed_tools=cli_disallowed,
                 cli_permission_mode=permission_mode or None,
+                verbose=verbose,
             )
             exit_code = asyncio.run(_run_with_handler(runner.run(prompt)))
         except _QwenPawError as exc:
@@ -573,7 +596,11 @@ def a2a(
     ),
 ) -> None:
     """Run iac-code as an A2A 1.0 server."""
-    config = _load_a2a_config(config_path) if config_path else {}
+    try:
+        config = _load_a2a_config(config_path) if config_path else {}
+    except Exception as exc:
+        typer.echo(str(exc), err=True)
+        raise typer.Exit(1) from exc
     host = _a2a_config_value(ctx, config, "host", host)
     port = _a2a_config_value(ctx, config, "port", port)
     transport = _a2a_config_value(ctx, config, "transport", transport)
@@ -789,6 +816,8 @@ def a2a_call(
         route = _a2a_client_route_specs(ctx, config, route)
         route_name = _a2a_config_value(ctx, config, "route_name", route_name)
         cwd = _a2a_config_value(ctx, config, "cwd", cwd)
+        if cwd in ("", "."):
+            cwd = str(Path.cwd())
         context_id = _a2a_config_value(ctx, config, "context_id", context_id)
         timeout = _a2a_config_value(ctx, config, "timeout", timeout)
         stream = _a2a_config_value(ctx, config, "stream", stream)
@@ -809,6 +838,10 @@ def a2a_call(
             require_card_signature=require_card_signature,
         )
         if not url:
+            if not route and not route_name:
+                raise ValueError(
+                    "url is required. Provide --url or url in --config, or configure --route/--route-name."
+                )
             from iac_code.a2a.router import A2ARouter
 
             selected = A2ARouter([_parse_a2a_route_spec(value) for value in route]).resolve(

{iac_code-0.3.0 → iac_code-0.3.1}/src/iac_code/cli/output_formats.py

@@ -81,12 +81,17 @@ class JsonWriter:
             entry["result"] = event.result
             entry["is_error"] = event.is_error
         elif isinstance(event, MessageEndEvent):
-            self._usage = {
+            usage = {
                 "input_tokens": event.usage.input_tokens,
                 "output_tokens": event.usage.output_tokens,
                 "cache_creation_input_tokens": event.usage.cache_creation_input_tokens,
                 "cache_read_input_tokens": event.usage.cache_read_input_tokens,
             }
+            is_empty_synthetic_max_turns = (
+                event.stop_reason == "max_turns" and self._usage is not None and not any(usage.values())
+            )
+            if not is_empty_synthetic_max_turns:
+                self._usage = usage
         elif isinstance(event, ErrorEvent):
             self._error = event.error
 

{iac_code-0.3.0 → iac_code-0.3.1}/src/iac_code/commands/clear.py

@@ -12,7 +12,7 @@ async def clear_command(context=None, **kwargs) -> str:
     if context and hasattr(context, "repl"):
         agent_loop = getattr(context.repl, "_agent_loop", None)
         if agent_loop:
-            agent_loop.context_manager.reset()
+            agent_loop.reset()
         if hasattr(context.repl, "_command_log"):
             context.repl._command_log.clear()
 

{iac_code-0.3.0 → iac_code-0.3.1}/src/iac_code/commands/registry.py

@@ -240,12 +240,16 @@ class CommandRegistry:
         return None
 
     def is_command(self, text: str) -> bool:
-        """Check if text is a command"""
-        return text.startswith("/")
+        """Check if text is a command (``/``) or skill (``$``) invocation."""
+        return text.startswith(("/", "$"))
 
     def parse(self, text: str) -> tuple[str, list[str]]:
-        """Parse command text, return (command name, argument list)"""
-        parts = text.lstrip("/").split()
+        """Parse command text, return (command name, argument list).
+
+        Accepts both the ``/`` trigger (commands + skills) and the ``$``
+        trigger (skills only).
+        """
+        parts = text.lstrip("/$").split()
         name = parts[0] if parts else ""
         args = parts[1:] if len(parts) > 1 else []
         return name, args

{iac_code-0.3.0 → iac_code-0.3.1}/src/iac_code/config.py

@@ -15,6 +15,9 @@ from typing import Any
 
 import yaml
 
+from iac_code.i18n import _
+from iac_code.utils.file_security import ensure_private_dir, ensure_private_file
+
 # Default LLM model used when no model is saved in settings
 DEFAULT_MODEL = "qwen3.7-max"
 
@@ -47,8 +50,9 @@ def _load_yaml(path: Path) -> dict[str, Any]:
 
 def _save_yaml(path: Path, data: dict[str, Any]) -> None:
     """Write *data* to a YAML file, creating parent directories as needed."""
-    path.parent.mkdir(parents=True, exist_ok=True)
+    ensure_private_dir(path.parent)
     path.write_text(yaml.dump(data, default_flow_style=False, allow_unicode=True), encoding="utf-8")
+    ensure_private_file(path)
 
 
 # ---------------------------------------------------------------------------
@@ -56,15 +60,29 @@ def _save_yaml(path: Path, data: dict[str, Any]) -> None:
 # ---------------------------------------------------------------------------
 
 
+def _normalize_provider_lookup_name(value: str) -> str:
+    """Normalize provider display names and keys for user-facing lookup."""
+    return value.lower().replace(" ", "").replace("-", "").replace("_", "")
+
+
 def _build_provider_name_to_key() -> dict[str, str]:
     from iac_code.providers.registry import PROVIDER_REGISTRY
 
     mapping: dict[str, str] = {}
+
+    def _add_alias(alias: str, provider_key: str) -> None:
+        normalized = _normalize_provider_lookup_name(alias)
+        existing = mapping.get(normalized)
+        if existing is not None and existing != provider_key:
+            raise ValueError(
+                f"Ambiguous provider alias {alias!r}: normalized form {normalized!r} "
+                f"maps to both {existing!r} and {provider_key!r}"
+            )
+        mapping[normalized] = provider_key
+
     for desc in PROVIDER_REGISTRY.values():
-        normalized = desc.name.lower().replace(" ", "").replace("-", "").replace("_", "")
-        mapping[normalized] = desc.key
-        key_norm = desc.key.lower().replace("_", "").replace("-", "")
-        mapping[key_norm] = desc.key
+        _add_alias(desc.name, desc.key)
+        _add_alias(desc.key, desc.key)
     return mapping
 
 
@@ -139,11 +157,13 @@ def _get_env_overrides() -> dict[str, str | None]:
     provider_raw = _read("IAC_CODE_PROVIDER")
     provider_key: str | None = None
     if provider_raw is not None:
-        key = _PROVIDER_NAME_TO_KEY.get(provider_raw.lower())
+        key = _PROVIDER_NAME_TO_KEY.get(_normalize_provider_lookup_name(provider_raw))
         if key is None:
             valid = ", ".join(_PROVIDER_CANONICAL_NAMES)
             raise ValueError(
-                f"Invalid IAC_CODE_PROVIDER value: {provider_raw!r}. Valid values (case-insensitive): {valid}"
+                _("Invalid IAC_CODE_PROVIDER value: {!r}. Valid values (case-insensitive): {}").format(
+                    provider_raw, valid
+                )
             )
         provider_key = key
 
@@ -248,8 +268,7 @@ def get_config_dir() -> Path:
     caching).
     """
     config_dir = _resolve_config_dir()
-    config_dir.mkdir(parents=True, exist_ok=True)
-    return config_dir
+    return ensure_private_dir(config_dir)
 
 
 def get_credentials_path() -> Path: