keystone-cli 0.1.26__tar.gz → 0.1.32__tar.gz

{keystone_cli-0.1.26 → keystone_cli-0.1.32}/PKG-INFO

@@ -1,9 +1,9 @@
 Metadata-Version: 2.4
 Name: keystone-cli
-Version: 0.1.26
-Summary: Keystone pro-code agent CLI — author, validate, and run agents locally, then deploy and invoke them on the Keystone platform.
+Version: 0.1.32
+Summary: Keystone pro-code agent CLI — build, test, deploy and operate agents on the Keystone platform.
 Requires-Python: >=3.12
-Requires-Dist: keystone-agent-sdk<0.11,>=0.10
+Requires-Dist: keystone-agent-sdk<0.12,>=0.11.0
 Requires-Dist: keystone-request-context<0.4,>=0.3
 Requires-Dist: typer<1,>=0.12
 Requires-Dist: httpx<1,>=0.27

{keystone_cli-0.1.26 → keystone_cli-0.1.32}/pyproject.toml

@@ -4,13 +4,13 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "keystone-cli"
-version = "0.1.26"
-description = "Keystone pro-code agent CLI — author, validate, and run agents locally, then deploy and invoke them on the Keystone platform."
+version = "0.1.32"
+description = "Keystone pro-code agent CLI — build, test, deploy and operate agents on the Keystone platform."
 requires-python = ">=3.12"
 dependencies = [
     # Pinned to a compatible range: on an index (Artifact Registry) an unpinned name resolves to
     # ANY published version — the wheel's metadata is the only pin that travels with it.
-    "keystone-agent-sdk>=0.10,<0.11",
+    "keystone-agent-sdk>=0.11.0,<0.12",
     # Transitive (the SDK's building-block clients) + used directly by `run` to set a local
     # caller-identity ContextVar and to patch the clients for --offline. uv sources are NOT
     # transitive, so declare it directly (cf. services/llm-gateway).
@@ -45,7 +45,7 @@ where = ["src"]
 keystone_cli = ["templates/*/*.tmpl", "templates/*/pkg/*.tmpl"]
 
 [tool.ruff]
-target-version = "0.1.26"
+target-version = "0.1.32"
 line-length = 120
 
 [tool.ruff.lint]

{keystone_cli-0.1.26 → keystone_cli-0.1.32}/src/keystone_cli/__main__.py

@@ -11,6 +11,7 @@ from keystone_cli.commands.dev import dev
 from keystone_cli.commands.kb import kb_app
 from keystone_cli.commands.login import login
 from keystone_cli.commands.tool_credentials import tool_credentials_app
+from keystone_cli.commands.whoami import whoami
 from keystone_cli.commands.workspace import workspace_app
 
 # FDP-4360 — before Typer builds anything. `--help` is rendered inside `app()`, and the help
@@ -19,7 +20,7 @@ from keystone_cli.commands.workspace import workspace_app
 make_stdio_unicode_safe()
 
 app = typer.Typer(
-    help="Keystone pro-code agent CLI — author, validate, and run agents locally.",
+    help="Keystone CLI — build, test, deploy and operate pro-code agents.",
     no_args_is_help=True,
     add_completion=False,
 )
@@ -47,7 +48,11 @@ def _main(
 
 @app.command(name="version")
 def version() -> None:
-    """Show the CLI version, its target env, and the bundled agent-sdk version."""
+    """Show the CLI version, its target env and the bundled agent-sdk version.
+
+    Example:
+      keystone version
+    """
     typer.echo(version_line())
 
 
@@ -57,6 +62,7 @@ app.add_typer(kb_app, name="kb")
 app.add_typer(tool_credentials_app, name="tool-credentials")
 app.command(name="login")(login)
 app.command(name="dev")(dev)
+app.command(name="whoami")(whoami)
 
 
 if __name__ == "__main__":

{keystone_cli-0.1.26 → keystone_cli-0.1.32}/src/keystone_cli/auth/token_store.py

@@ -9,6 +9,7 @@ from __future__ import annotations
 
 import json
 import os
+import sys
 from dataclasses import asdict, dataclass, fields
 from pathlib import Path
 
@@ -85,6 +86,46 @@ class AuthConfig:
     env: str = ""
 
 
+def endpoint_env(cfg: AuthConfig) -> str | None:
+    """Which env's BAKED endpoints this config carries (issuer or api_base match), or None.
+
+    None for an empty config and for custom endpoints (a deliberate ``--api-base`` / ``--issuer``
+    pointing somewhere no env bakes), so only a config that is recognisably ANOTHER env's is flagged.
+    """
+    for env, (issuer, api_base, _agent) in _ENV_DEFAULTS.items():
+        if (cfg.issuer and cfg.issuer == issuer) or (cfg.api_base and cfg.api_base.rstrip("/") == api_base):
+            return env
+    return None
+
+
+def endpoints_belong_to_other_env(cfg: AuthConfig) -> str | None:
+    """The OTHER env whose endpoints this config carries (vs. this package's ``BUILD_ENV``), else None.
+
+    FDP-3072: the ``env`` stamp alone is not proof. A config stamped ``env=prod`` can still hold the
+    dev issuer/api_base (seen 2026-09-30 after installing the prod package over a dev login): the
+    stamp matched, so ``login`` kept the cache and every command silently went to dev.
+    """
+    env = endpoint_env(cfg)
+    return env if env is not None and env != BUILD_ENV else None
+
+
+_warned_mismatch = False
+
+
+def _warn_if_other_env(cfg: AuthConfig) -> None:
+    """One stderr line per process — a warning, never a block (custom endpoints are never flagged)."""
+    global _warned_mismatch
+    other = endpoints_belong_to_other_env(cfg)
+    if other is None or _warned_mismatch:
+        return
+    _warned_mismatch = True
+    print(
+        f"⚠ {config_path()} points at the {other} endpoints, but this is the {BUILD_ENV} CLI — "
+        f"commands would go to {other}. Run `keystone login` to reset it to {BUILD_ENV}.",
+        file=sys.stderr,
+    )
+
+
 def config_path() -> Path:
     """Config file path. ``KEYSTONE_CONFIG`` overrides (tests); default ``~/.keystone/config.json``."""
     override = os.environ.get("KEYSTONE_CONFIG")
@@ -100,7 +141,9 @@ def load() -> AuthConfig:
     # turned a valid session into "not logged in".
     data = json.loads(path.read_text(encoding="utf-8"))
     known = {f.name for f in fields(AuthConfig)}
-    return AuthConfig(**{k: v for k, v in data.items() if k in known})
+    cfg = AuthConfig(**{k: v for k, v in data.items() if k in known})
+    _warn_if_other_env(cfg)
+    return cfg
 
 
 def _ensure_private_dir(directory: Path) -> None: