keywright-server 0.0.1__tar.gz → 0.0.2__tar.gz

{keywright_server-0.0.1 → keywright_server-0.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: keywright-server
-Version: 0.0.1
+Version: 0.0.2
 Summary: Keywright server: just-in-time credential broker for AI agents. One MCP front door, per-request human approval, no keys in agent context.
 Project-URL: Repository, https://github.com/johnrcarty/keywright
 Project-URL: Issues, https://github.com/johnrcarty/keywright/issues
@@ -18,7 +18,7 @@ Requires-Dist: httpx2<3,>=2.13
 Requires-Dist: httpx>=0.27
 Requires-Dist: itsdangerous>=2.2
 Requires-Dist: jinja2>=3.1
-Requires-Dist: keywright<0.1,>=0.0.1
+Requires-Dist: keywright<0.1,>=0.0.2
 Requires-Dist: mcp<3,>=2.2
 Requires-Dist: pydantic>=2.7
 Requires-Dist: python-multipart>=0.0.9
@@ -40,34 +40,34 @@ Give AI agents temporary access to infrastructure without handing them your cred
 Keywright is a self-hosted broker for SSH hosts and MCP tools, with human approval,
 scoped access, revocation and an audit trail.
 
-**v0.0.1 is in preparation.** Prebuilt preview images are published to GitHub Container
-Registry for Linux x86-64 and ARM64. The repository and image remain private during
-release preparation; the stable release, public availability and licensing review are pending.
+**[v0.0.1 is available](https://github.com/johnrcarty/keywright/releases/tag/v0.0.1).**
+This first experimental release includes public prebuilt images for Linux x86-64 and
+ARM64, Python packages, and verified source and license materials. Keywright is Apache-2.0.
+
+**0.0.2 is in preparation:** expanded integrations, GitHub repository and issue imports,
+native task boards, and knowledge graph improvements. See the [release candidate notes](docs/releases/0.0.2.md).
+The installation instructions below use the latest published release until 0.0.2 is published.
 
 ## Install the prebuilt broker
 
 You need Docker Engine with the Compose plugin. No Git checkout, Python installation
 or local image build is needed.
 
-1. Download the **keywright-install** artifact from a successful
-   [test build and publish workflow](https://github.com/johnrcarty/keywright/actions/workflows/ci.yml).
-   Extract it into a dedicated installation directory. Its `compose.yaml` pins the exact
-   multi-platform image digest; `SHA256SUMS` covers the installation files.
-2. For the private preview, sign in with a GitHub personal access token (classic) that has
-   `read:packages` and access to this package. Enter the token at Docker's password prompt:
-   ```bash
-   docker login ghcr.io -u YOUR_GITHUB_USERNAME
-   ```
-3. In the installation directory:
+1. Download `keywright-install.tar.gz` and `SHA256SUMS` from the
+   [v0.0.1 release](https://github.com/johnrcarty/keywright/releases/tag/v0.0.1)
+   into a dedicated installation directory. The bundle pins the exact multi-platform image digest.
+2. Verify the archive, extract it, verify its files, and start the broker:
    ```bash
+   sha256sum --ignore-missing -c SHA256SUMS
+   tar -xzf keywright-install.tar.gz
    sha256sum -c SHA256SUMS
    docker compose up -d --wait
    ```
 
 The source copy at `deploy/compose.yaml` also works on its own; it follows
-`ghcr.io/johnrcarty/keywright:0.0.1-preview` unless `KEYWRIGHT_IMAGE` selects another tag
-or digest. The install artifact is the reproducible choice for testing a particular build.
-When the image becomes public, registry login will no longer be required.
+`ghcr.io/johnrcarty/keywright:0.0.2-preview` unless `KEYWRIGHT_IMAGE` selects another tag
+or digest. Use the release bundle for the pinned stable installation.
+Public image downloads do not require a registry login.
 
 Open <http://localhost:8700/ui> and set the administrator password. The default port is
 bound to loopback. For a remote VM, use an SSH tunnel first:
@@ -83,13 +83,27 @@ agent machines and use disposable targets for initial tests.
 1. Add an SSH host or upstream MCP server under **Resources**.
 2. Create an agent and copy its token once.
 3. Point an MCP client at `/mcp` with `Authorization: Bearer <agent-token>`, or install
-   the CLI from source using the instructions below.
+   the published CLI using the instructions below.
 4. Request one operation, approve it in the UI, and inspect its audit record.
 5. Revoke the access and verify the operation needs approval again.
 
 Phone notifications through Home Assistant or a webhook are optional. The base stack
 needs no cloud account, model provider, identity provider or external database.
 
+## Install the client
+
+With Python 3.12 or newer and pipx:
+
+```bash
+pipx install keywright==0.0.1
+kw login http://localhost:8700 --paste
+kw setup check
+```
+
+Paste the agent token at the prompt. Run setup as the user who runs the agent.
+Optional integration commands are `kw setup claude-code` and `kw setup codex`.
+See the [client guide](client/README.md) for installing a separate Python runtime.
+
 ## Develop from source
 
 For a local Docker build, clone the repository and explicitly add the development overlay:
@@ -126,17 +140,31 @@ Never point test configuration at a production database.
 
 ## Optional integrations
 
+- [DoorDash (Beta)](docs/DOORDASH.md): guided `dd-cli` setup through a managed SSH host,
+  including headless authentication. Waitlist-only. Full functionality requires an approved account.
+  [Join the waitlist here](https://forms.gle/gvCQZvu9C1EKA6aM6) (0.0.2 candidate).
+- [Robinhood](docs/ROBINHOOD.md): accounts, market data, and trading through browser
+  sign-in (0.0.2 candidate).
+- [Coinbase](docs/COINBASE.md): guided Coinbase CLI setup through a managed SSH host
+  (0.0.2 candidate).
+- [CoinStats](docs/FEATURES.md#oauth-for-upstream-mcp-servers-including-notion-and-coinstats):
+  crypto data and portfolios through browser sign-in (0.0.2 candidate).
+- [Homelab connectors](docs/CONNECTORS.md): Proxmox VE, Pi-hole v6, Home Assistant,
+  Jellyfin, Sonarr, Radarr and authentik setup and read-only tools (0.0.2 candidate).
+- [GitHub and Work](docs/WORK_BOARDS.md): repository discovery, inbound issue sync, environment
+  locations, project boards, All tasks and Needs you views (0.0.2 candidate).
 - [Feature and configuration reference](docs/FEATURES.md): permissions, notifications,
   LLM gateways, OIDC, inventory, shared knowledge and result inspection.
 - [Deployment guide](deploy/README.md): base stack, optional LLM/knowledge services and
   a disposable VM acceptance checklist.
 - [Mail router](router/README.md): optional agent that routes mail through brokered tools.
-- [Release checklist](docs/RELEASE_PLAN.md): remaining work before v0.0.1.
+- [Release checklist](docs/RELEASE_PLAN.md): release evidence and publication record.
 - [Security reporting](SECURITY.md), [support scope](SUPPORT.md), and [contributing](CONTRIBUTING.md).
 - [Third-party source and notice materials](third_party/README.md).
 
-Knowledge chunking changes are experimental pending retrieval evaluation. Optional
-features are not all covered by the minimal-stack installation check.
+Knowledge retrieval remains experimental; the synthetic evaluation does not establish
+quality for every corpus or reliable no-answer detection. Optional features are not all
+covered by the minimal-stack installation check.
 
 Keywright is a credential trust boundary. Protect its host and backups. Command scope
 matching is not a shell sandbox, and output inspection cannot prove arbitrary text is

{keywright_server-0.0.1 → keywright_server-0.0.2}/README.md

@@ -4,34 +4,34 @@ Give AI agents temporary access to infrastructure without handing them your cred
 Keywright is a self-hosted broker for SSH hosts and MCP tools, with human approval,
 scoped access, revocation and an audit trail.
 
-**v0.0.1 is in preparation.** Prebuilt preview images are published to GitHub Container
-Registry for Linux x86-64 and ARM64. The repository and image remain private during
-release preparation; the stable release, public availability and licensing review are pending.
+**[v0.0.1 is available](https://github.com/johnrcarty/keywright/releases/tag/v0.0.1).**
+This first experimental release includes public prebuilt images for Linux x86-64 and
+ARM64, Python packages, and verified source and license materials. Keywright is Apache-2.0.
+
+**0.0.2 is in preparation:** expanded integrations, GitHub repository and issue imports,
+native task boards, and knowledge graph improvements. See the [release candidate notes](docs/releases/0.0.2.md).
+The installation instructions below use the latest published release until 0.0.2 is published.
 
 ## Install the prebuilt broker
 
 You need Docker Engine with the Compose plugin. No Git checkout, Python installation
 or local image build is needed.
 
-1. Download the **keywright-install** artifact from a successful
-   [test build and publish workflow](https://github.com/johnrcarty/keywright/actions/workflows/ci.yml).
-   Extract it into a dedicated installation directory. Its `compose.yaml` pins the exact
-   multi-platform image digest; `SHA256SUMS` covers the installation files.
-2. For the private preview, sign in with a GitHub personal access token (classic) that has
-   `read:packages` and access to this package. Enter the token at Docker's password prompt:
-   ```bash
-   docker login ghcr.io -u YOUR_GITHUB_USERNAME
-   ```
-3. In the installation directory:
+1. Download `keywright-install.tar.gz` and `SHA256SUMS` from the
+   [v0.0.1 release](https://github.com/johnrcarty/keywright/releases/tag/v0.0.1)
+   into a dedicated installation directory. The bundle pins the exact multi-platform image digest.
+2. Verify the archive, extract it, verify its files, and start the broker:
    ```bash
+   sha256sum --ignore-missing -c SHA256SUMS
+   tar -xzf keywright-install.tar.gz
    sha256sum -c SHA256SUMS
    docker compose up -d --wait
    ```
 
 The source copy at `deploy/compose.yaml` also works on its own; it follows
-`ghcr.io/johnrcarty/keywright:0.0.1-preview` unless `KEYWRIGHT_IMAGE` selects another tag
-or digest. The install artifact is the reproducible choice for testing a particular build.
-When the image becomes public, registry login will no longer be required.
+`ghcr.io/johnrcarty/keywright:0.0.2-preview` unless `KEYWRIGHT_IMAGE` selects another tag
+or digest. Use the release bundle for the pinned stable installation.
+Public image downloads do not require a registry login.
 
 Open <http://localhost:8700/ui> and set the administrator password. The default port is
 bound to loopback. For a remote VM, use an SSH tunnel first:
@@ -47,13 +47,27 @@ agent machines and use disposable targets for initial tests.
 1. Add an SSH host or upstream MCP server under **Resources**.
 2. Create an agent and copy its token once.
 3. Point an MCP client at `/mcp` with `Authorization: Bearer <agent-token>`, or install
-   the CLI from source using the instructions below.
+   the published CLI using the instructions below.
 4. Request one operation, approve it in the UI, and inspect its audit record.
 5. Revoke the access and verify the operation needs approval again.
 
 Phone notifications through Home Assistant or a webhook are optional. The base stack
 needs no cloud account, model provider, identity provider or external database.
 
+## Install the client
+
+With Python 3.12 or newer and pipx:
+
+```bash
+pipx install keywright==0.0.1
+kw login http://localhost:8700 --paste
+kw setup check
+```
+
+Paste the agent token at the prompt. Run setup as the user who runs the agent.
+Optional integration commands are `kw setup claude-code` and `kw setup codex`.
+See the [client guide](client/README.md) for installing a separate Python runtime.
+
 ## Develop from source
 
 For a local Docker build, clone the repository and explicitly add the development overlay:
@@ -90,17 +104,31 @@ Never point test configuration at a production database.
 
 ## Optional integrations
 
+- [DoorDash (Beta)](docs/DOORDASH.md): guided `dd-cli` setup through a managed SSH host,
+  including headless authentication. Waitlist-only. Full functionality requires an approved account.
+  [Join the waitlist here](https://forms.gle/gvCQZvu9C1EKA6aM6) (0.0.2 candidate).
+- [Robinhood](docs/ROBINHOOD.md): accounts, market data, and trading through browser
+  sign-in (0.0.2 candidate).
+- [Coinbase](docs/COINBASE.md): guided Coinbase CLI setup through a managed SSH host
+  (0.0.2 candidate).
+- [CoinStats](docs/FEATURES.md#oauth-for-upstream-mcp-servers-including-notion-and-coinstats):
+  crypto data and portfolios through browser sign-in (0.0.2 candidate).
+- [Homelab connectors](docs/CONNECTORS.md): Proxmox VE, Pi-hole v6, Home Assistant,
+  Jellyfin, Sonarr, Radarr and authentik setup and read-only tools (0.0.2 candidate).
+- [GitHub and Work](docs/WORK_BOARDS.md): repository discovery, inbound issue sync, environment
+  locations, project boards, All tasks and Needs you views (0.0.2 candidate).
 - [Feature and configuration reference](docs/FEATURES.md): permissions, notifications,
   LLM gateways, OIDC, inventory, shared knowledge and result inspection.
 - [Deployment guide](deploy/README.md): base stack, optional LLM/knowledge services and
   a disposable VM acceptance checklist.
 - [Mail router](router/README.md): optional agent that routes mail through brokered tools.
-- [Release checklist](docs/RELEASE_PLAN.md): remaining work before v0.0.1.
+- [Release checklist](docs/RELEASE_PLAN.md): release evidence and publication record.
 - [Security reporting](SECURITY.md), [support scope](SUPPORT.md), and [contributing](CONTRIBUTING.md).
 - [Third-party source and notice materials](third_party/README.md).
 
-Knowledge chunking changes are experimental pending retrieval evaluation. Optional
-features are not all covered by the minimal-stack installation check.
+Knowledge retrieval remains experimental; the synthetic evaluation does not establish
+quality for every corpus or reliable no-answer detection. Optional features are not all
+covered by the minimal-stack installation check.
 
 Keywright is a credential trust boundary. Protect its host and backups. Command scope
 matching is not a shell sandbox, and output inspection cannot prove arbitrary text is

{keywright_server-0.0.1 → keywright_server-0.0.2}/THIRD_PARTY_NOTICES

@@ -6,6 +6,14 @@ container base images, optional services and embedding models retain their own
 licenses. This file is a guide to those components, not a replacement for their
 license texts or a complete inventory of a particular image.
 
+Connector artwork
+-----------------
+Bundled connector artwork is documented separately in
+keywright_server/web/assets/brands/ATTRIBUTION.txt, with full licenses,
+unmodified SVG source and pinned provenance in that directory. Pi-hole artwork
+is MIT-licensed; Jellyfin artwork is CC-BY-SA-4.0. These asset licenses and
+trademark guidelines remain in effect independently of Keywright's license.
+
 Python dependencies
 -------------------
 Keywright distributions declare dependencies rather than vendoring them. pip

{keywright_server-0.0.1 → keywright_server-0.0.2}/keywright_server/__init__.py

@@ -1,3 +1,3 @@
 """Keywright: just-in-time credential broker for AI agents."""
 
-__version__ = "0.0.1"
+__version__ = "0.0.2"

{keywright_server-0.0.1 → keywright_server-0.0.2}/keywright_server/access.py

@@ -109,6 +109,8 @@ def operation_matches(constraints: dict | None, operation: dict | None) -> bool:
 def constraint_label(constraints: dict[str, Any] | None) -> str:
     if not constraints:
         return "Permission patterns · any matching arguments"
+    if constraints.get("shopping") and not constraints.get("command"):
+        return "Shopping session · browsing and cart preparation"
     if "command" in constraints:
         return "Exact command"
     if "arguments" in constraints:

{keywright_server-0.0.1 → keywright_server-0.0.2}/keywright_server/approvals.py

@@ -31,11 +31,11 @@ from .models import AccessRequest, Agent, Grant, Policy, Resource, now
 log = logging.getLogger(__name__)
 
 TTL_PRESETS = {"ttl15": 900, "ttl30": 1800, "ttl": 3600}
-SCOPES = ("once", "session", "ttl15", "path15", "ttl30", "ttl", "always", "deny", "deny_always")
-PHONE_SCOPES = ("once", "session", "ttl15", "path15", "ttl30", "ttl", "deny")
+SCOPES = ("once", "session", "shopping20", "ttl15", "path15", "ttl30", "ttl", "always", "deny", "deny_always")
+PHONE_SCOPES = ("once", "session", "shopping20", "ttl15", "path15", "ttl30", "ttl", "deny")
 SCOPE_LABELS = {"once": "Allow once", "session": "This session", "ttl15": "15 minutes", "path15": "This path, 15 min",
                 "ttl30": "30 minutes", "ttl": "1 hour", "always": "Always allow",
-                "deny": "Deny", "deny_always": "Always deny"}
+                "deny": "Deny", "deny_always": "Always deny", "shopping20": "Shop for 20 minutes"}
 
 
 def decision_label(req: AccessRequest) -> str:
@@ -118,6 +118,11 @@ def offered_scopes(req: AccessRequest, scopes: tuple[str, ...] = PHONE_SCOPES) -
     id cannot be granted 'this session': there is nothing to bind the grant to, and an agent-wide
     grant would outlive the conversation that asked for it. A request flagged destructive can only
     be allowed once: nothing timed, nothing standing. An LLM lease is always timed."""
+    if req.detail.get("shopping_session"):
+        return tuple(s for s in scopes if s in ("shopping20", "deny") and (s != "shopping20" or req.session_id))
+    scopes = tuple(s for s in scopes if s != "shopping20")
+    if req.detail.get("checkout"):
+        return tuple(s for s in scopes if s in ("once", "deny"))
     if blocks(hazard_level(req.detail)):
         scopes = tuple(s for s in scopes if s in HAZARD_SCOPES)
     if llm_only(list(req.patterns)):
@@ -185,6 +190,14 @@ async def create(
         semantic=semantic,
         expires_at=now() + timedelta(seconds=settings.request_timeout_s),
     )
+    if req.detail.get("checkout"):
+        from .shopping_mcp import remaining
+
+        cap = 300
+        link = req.detail["checkout"].get("link")
+        if link:
+            cap = min(cap, remaining(link.get("expires_at")) or 0)
+        req.expires_at = min(req.expires_at, now() + timedelta(seconds=cap))
     db.add(req)
     await db.commit()
     await db.refresh(req)
@@ -261,6 +274,12 @@ async def decide(
         raise LookupError("no such request")
     if req.status != "pending":
         return req
+    shopping_session = bool(req.detail.get("shopping_session"))
+    if shopping_session or req.detail.get("checkout") or scope == "shopping20":
+        if scope not in offered_scopes(req, SCOPES) or via == "jev":
+            raise ValueError("Shopping requires a human decision: 20 minutes for preparation, once for checkout")
+        if req.detail.get("checkout") and extent not in (None, "exact"):
+            raise ValueError("Checkout approval must bind the exact quoted order")
     if path_grant:
         if not path_scoped(req.detail):
             raise ValueError("Path access is only offered for a single file write")
@@ -276,6 +295,11 @@ async def decide(
     # One (patterns, constraints) pair per operation; a pattern request is one pair with none.
     bound = [(pats if pats is not None else list(req.patterns), operation_constraints(op, extent), op)
              for pats, op in operations(req.detail)] or [(list(req.patterns), None, None)]
+    if shopping_session:
+        target = await db.get(Resource, req.detail["resource_id"])
+        if target is None:
+            raise ValueError("Shopping resource no longer exists")
+        bound = [(list(req.patterns), {**operation_constraints(req.detail, "patterns"), "shopping": True}, req.detail)]
     if scope == "session" and not req.session_id:
         raise ValueError("This request has no session id; choose Allow once or 1 hour instead")
     if scope not in LLM_SCOPES and any(p.split("/", 1)[0] == "llm" for p in req.patterns):
@@ -313,7 +337,7 @@ async def decide(
         (AccessRequest.expires_at.is_(None)) | (AccessRequest.expires_at > decided_at),
     ).values(status="denied" if scope in ("deny", "deny_always") else "approved", decided_at=decided_at,
              decision_scope=scope, decided_via=via,
-             decision_options={"extent": extent, "ttl_s": ttl_s if scope == "ttl" else None}
+             decision_options={"extent": extent, "ttl_s": 1200 if scope == "shopping20" else ttl_s if scope == "ttl" else None}
              ).execution_options(synchronize_session=False))
     if changed.rowcount != 1:
         await db.rollback()
@@ -343,9 +367,11 @@ async def decide(
                     agent_id=req.agent_id,
                     pattern=p,
                     constraints=constraints,
-                    scope=scope,
-                    session_id=req.session_id if scope == "session" else None,
+                    scope="session" if scope == "shopping20" else scope,
+                    session_id=req.session_id if scope in ("session", "shopping20") else None,
                     expires_at=(decided_at + timedelta(seconds=ttl_s)) if scope == "ttl"
+                    else (decided_at + timedelta(seconds=1200)) if scope == "shopping20"
+                    else min(req.expires_at, decided_at + timedelta(minutes=5)) if req.detail.get("checkout")
                     else (decided_at + timedelta(seconds=settings.session_grant_ttl_s)) if scope == "session"
                     else None,
                     uses_remaining=1 if scope == "once" else None,

keywright_server-0.0.2/keywright_server/cli_setup.py

@@ -0,0 +1,159 @@
+"""Resumable admin CLI setup. Jobs contain status only; user secrets travel over SSH stdin."""
+from __future__ import annotations
+
+import asyncio
+import json
+import re
+import secrets
+import shlex
+import time
+from pathlib import Path
+from urllib.parse import urlsplit
+
+from sqlalchemy import update
+
+from . import audit, ssh
+from .db import session
+from .models import Resource
+
+CONNECTION_KEYS = ("host", "port", "user", "key_path", "host_key")
+TASKS: set[asyncio.Task] = set()
+LEASE_SECONDS = 300
+MESSAGES = {
+    "installed": "DoorDash CLI installed. Continue to sign in.",
+    "signin": "Open DoorDash sign-in, then paste the return address below within 10 minutes.",
+    "signed_in": "Sign-in saved on the selected host. Verify access to finish.",
+    "ready": "DoorDash is ready to use through Keywright.",
+    "unsupported_host": "Guided installation needs glibc Linux on x86_64. Choose another host or use manual setup.",
+    "download_integrity": "The download failed its integrity check. Nothing from that archive was installed.",
+    "binary_failed": "The CLI could not run on this host. Check its OS compatibility or choose another host.",
+    "not_installed": "Install the CLI on this host before signing in.",
+    "signin_failed": "DoorDash sign-in did not complete. Start a new sign-in and try again.",
+    "signin_url": "The CLI did not return a recognized DoorDash sign-in link. You can use an exported token instead.",
+    "invalid_input": "Enter the complete return address, sign-in code, or exported token in the appropriate field.",
+    "sign_in_required": "Sign in before verifying access.",
+    "verification_failed": "DoorDash access could not be verified. Check beta access and try signing in again; the token may have expired.",
+    "host_setup_failed": "Setup could not finish. The host needs Python 3.9+, outbound HTTPS, and a writable home directory. Check the host before retrying.",
+    "interrupted": "Setup was interrupted. Check the host before retrying; the last operation may have completed.",
+}
+
+
+def state(config):
+    value = dict(config.get("cli_setup") or {})
+    if value.get("status") == "running" and time.time() - value.get("started_at", 0) > LEASE_SECONDS:
+        value.update(status="error", message=MESSAGES["interrupted"])
+    return value
+
+
+def allowed_actions(value):
+    phase = value.get("resume", "new") if value.get("status") == "error" else value.get("status", "new")
+    if phase == "running":
+        return set()
+    if phase == "new":
+        return {"install"}
+    if phase == "installed":
+        return {"signin", "token"}
+    if phase == "signin":
+        return {"signin", "finish", "token"}
+    if phase in ("signed_in", "ready"):
+        return {"signin", "token", "verify"}
+    return set()
+
+
+async def start(rid, action, value=""):
+    async with session() as db:
+        res = await db.get(Resource, rid)
+        if not res or res.kind != "ssh" or res.config.get("integration") != "doordash" or not res.config.get("cli_setup"):
+            raise ValueError("No managed DoorDash setup found.")
+        before = dict(res.config)
+        previous = state(before)
+        if action not in allowed_actions(previous):
+            raise ValueError("This step is not available. Refresh setup to see its current status.")
+        if action in ("finish", "token") and (not value.strip() or len(value) > 16384 or any(c in value for c in "\r\n\x00")):
+            raise ValueError("Enter the return address or token on a single line.")
+        resume = previous.get("resume", "new") if previous.get("status") == "error" else previous.get("status", "new")
+        job = secrets.token_urlsafe(16)
+        current = {**previous, "status": "running", "resume": resume, "action": action, "job": job,
+                   "started_at": time.time(), "message": "Working on the selected host…"}
+        current.pop("signin_url", None)
+        result = await db.execute(update(Resource).where(Resource.id == rid, Resource.config == before)
+                                  .values(config={**before, "cli_setup": current}))
+        if result.rowcount != 1:
+            raise ValueError("Another setup step started. Refresh this page.")
+        await audit.record(db, tool="cli.setup", decision="started", detail={"resource": res.name, "step": action})
+        connection = {key: before[key] for key in CONNECTION_KEYS if key in before}
+    task = asyncio.create_task(_perform(rid, job, action, value, connection), name="cli-setup")
+    TASKS.add(task)
+    task.add_done_callback(TASKS.discard)
+
+
+async def _perform(rid, job, action, value, connection):
+    learned = None
+    try:
+        script = Path(__file__).with_name("cli_setup_remote.py").read_text()
+        command = "python3 -c " + shlex.quote(script) + " " + shlex.quote(action) + " " + shlex.quote(rid)
+        result = await ssh.run(connection, command, timeout=150,
+                               stdin=json.dumps({"value": value}).encode())
+        learned = result.learned_host_key
+        output = json.loads(result.stdout) if not result.truncated else {}
+        expected = {"install": "installed", "signin": "signin", "finish": "signed_in", "token": "signed_in", "verify": "ready"}[action]
+        if result.exit_code == 0 and output.get("status") == expected:
+            outcome = {"status": expected, "message": MESSAGES[expected]}
+            if action == "signin":
+                url = output.get("signin_url", "")
+                parsed = urlsplit(url)
+                if (not isinstance(url, str) or len(url) > 8192 or parsed.scheme != "https" or not parsed.hostname
+                        or not (parsed.hostname == "doordash.com" or parsed.hostname.endswith(".doordash.com"))
+                        or parsed.username or parsed.password or parsed.port not in (None, 443)):
+                    raise ValueError("Unexpected sign-in URL")
+                outcome["signin_url"] = url
+        else:
+            code = output.get("error", "host_setup_failed")
+            outcome = {"status": "error", "message": MESSAGES.get(code, MESSAGES["host_setup_failed"])}
+    except asyncio.CancelledError:
+        await _finish(rid, job, {"status": "error", "message": MESSAGES["interrupted"]}, learned)
+        raise
+    except Exception:  # noqa: BLE001 — never expose SSH/CLI exception text containing sign-in data
+        # SSH and CLI error text can include secrets: keep it out of UI, logs and audits.
+        outcome = {"status": "error", "message": MESSAGES["host_setup_failed"]}
+    await _finish(rid, job, outcome, learned)
+
+
+async def _finish(rid, job, outcome, learned):
+    async with session() as db:
+        res = await db.get(Resource, rid)
+        if not res or res.config.get("cli_setup", {}).get("job") != job:
+            return
+        before = dict(res.config)
+        config = {**before, "cli_setup": {**before["cli_setup"], **outcome}}
+        if learned:
+            config["host_key"] = learned
+        if outcome["status"] == "installed":
+            config["cli_runtime"] = rid
+        if outcome["status"] != "signin":
+            config["cli_setup"].pop("signin_url", None)
+        result = await db.execute(update(Resource).where(Resource.id == rid, Resource.config == before).values(config=config))
+        if result.rowcount:
+            await audit.record(db, tool="cli.setup", decision=outcome["status"],
+                               detail={"resource": res.name, "step": before["cli_setup"]["action"]})
+
+
+async def shutdown():
+    tasks = list(TASKS)
+    for task in tasks:
+        task.cancel()
+    await asyncio.gather(*tasks, return_exceptions=True)
+
+
+def runtime_command(config, command):
+    """Apply the managed install only to this resource, preserving the approved command and stdin."""
+    directory = config.get("cli_runtime")
+    if not directory:
+        return command
+    if config.get("integration") != "doordash" or not re.fullmatch(r"res_[A-Za-z0-9_-]{1,80}", directory):
+        raise ValueError("Invalid managed CLI runtime")
+    script = ('unset DD_CLI_ACCESS_TOKEN; d="$HOME/.local/share/keywright/cli/' + directory + '"; '
+              'PATH="$d/bin:$PATH"; export PATH; '
+              'if [ -f "$d/token" ]; then DD_CLI_ACCESS_TOKEN=$(cat "$d/token") || exit; '
+              'export DD_CLI_ACCESS_TOKEN; fi; exec sh -c "$1"')
+    return "sh -c " + shlex.quote(script) + " keywright " + shlex.quote(command)