mammoth-cli 1.0.0__tar.gz → 1.0.2__tar.gz

mammoth_cli-1.0.2/PKG-INFO

@@ -0,0 +1,174 @@
+Metadata-Version: 2.4
+Name: mammoth-cli
+Version: 1.0.2
+Summary: Command-line interface for the Mammoth Analytics platform
+License: Proprietary
+License-File: LICENSE
+Author: Mammoth Analytics
+Author-email: support@mammoth.io
+Requires-Python: >=3.12,<3.15
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: Other/Proprietary License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Dist: PyYAML (>=6,<7)
+Requires-Dist: keyring (>=25.7,<26)
+Requires-Dist: mammoth-io (>=0.6.0,<0.7)
+Requires-Dist: platformdirs (>=4.10,<5)
+Requires-Dist: pydantic (>=2.13,<3)
+Requires-Dist: rich (>=15,<16)
+Requires-Dist: tomlkit (>=0.15.1,<0.16)
+Requires-Dist: typer (>=0.27,<0.28)
+Project-URL: Homepage, https://mammoth.io
+Project-URL: Repository, https://github.com/EdgeMetric/mammothsdk
+Description-Content-Type: text/markdown
+
+# mammoth-cli
+
+Drive the [Mammoth Analytics](https://mammoth.io) platform from your terminal.
+The `mammoth` command uploads data, runs pipeline transformations, manages
+projects and dashboards, and exports results — for people at a shell and for
+autonomous agents alike.
+
+[![PyPI](https://img.shields.io/pypi/v/mammoth-cli)](https://pypi.org/project/mammoth-cli/)
+[![Python](https://img.shields.io/pypi/pyversions/mammoth-cli)](https://pypi.org/project/mammoth-cli/)
+[![License](https://img.shields.io/pypi/l/mammoth-cli)](https://github.com/EdgeMetric/mammothsdk/blob/main/mammoth-cli/LICENSE)
+
+- **Human-friendly by default.** In a terminal, commands print a readable table.
+- **Agent-native.** When output is piped, you get a stable JSON envelope with a
+  documented schema, exit codes, and error codes — no flags required.
+- **Safe.** Every mutation carries a reviewed confirmation policy, so a
+  destructive command never runs unattended by accident.
+- **Discoverable.** `mammoth capability list` and `mammoth schema get` describe
+  every command, so an agent can learn the surface at runtime.
+
+The CLI is built on the public [`mammoth-io`](https://pypi.org/project/mammoth-io/)
+SDK. It adds no second HTTP client and calls no private SDK members.
+
+## Install
+
+```bash
+uv tool install mammoth-cli      # recommended: isolated, on your PATH
+# or
+pipx install mammoth-cli
+# or
+python -m pip install mammoth-cli
+```
+
+Then confirm the install:
+
+```bash
+mammoth --version
+```
+
+The CLI supports Python 3.12, 3.13, and 3.14. For the one-line installers and
+the verified (signed) install flow, see [docs/installation.md](docs/installation.md).
+
+## Quick start
+
+```bash
+mammoth auth login -w 4          # log in once; the secret goes to your OS keyring
+mammoth doctor                   # confirm credentials resolve and the API answers
+mammoth project list             # a table in a terminal, JSON when piped
+mammoth dataset list --project 180
+```
+
+Full walkthrough: [docs/quickstart.md](docs/quickstart.md).
+
+## Built for agents and CI
+
+Piping or redirecting output yields the machine envelope, and `--no-input` turns
+on automatically off a terminal, so an agent needs no special flags:
+
+```bash
+mammoth project list | jq '.data'
+```
+
+To be explicit, pass `--output json --no-input`. Log in without a prompt with a
+permission-checked file:
+
+```bash
+mammoth auth login --input creds.json --output json --no-input
+```
+
+Feed multi-field requests as one document instead of many flags:
+
+```bash
+mammoth view transform math 1039 --project 180 \
+  --input '{"expression": "price * qty", "new_column": "total"}'
+```
+
+Install the bundled agent skill for Claude Code, Codex, and Cursor:
+
+```bash
+mammoth skill install
+```
+
+See [docs/agents.md](docs/agents.md) and the
+[agent skill](mammoth_cli/bundled_skill/mammoth-cli/SKILL.md).
+
+## What you can do
+
+| Area | Command families |
+|---|---|
+| Data in and out | `file`, `dataset`, `connector`, `addon` |
+| Shape and analyze | `view`, `dataset`, `ai` |
+| Organize | `project`, `folder`, `dashboard`, `report`, `template` |
+| Automate | `automation`, `workflow`, `schedule`, `batch`, `webhook` |
+| Administer | `workspace`, `user`, `billing`, `client-app`, `external-key` |
+| Operate the CLI | `auth`, `context`, `config`, `doctor`, `capability`, `schema`, `skill`, `upgrade` |
+
+The full generated list is in [docs/reference/commands.md](docs/reference/commands.md).
+
+## Documentation
+
+| Guide | What it covers |
+|---|---|
+| [Installation](docs/installation.md) | Install the CLI and the agent skill. |
+| [Quick start](docs/quickstart.md) | Log in and run your first commands. |
+| [Authentication](docs/authentication.md) | Getting an API key, login, profiles, projects. |
+| [Agent and CI usage](docs/agents.md) | Machine output, structured input, patterns. |
+| [Safe mutation](docs/safety.md) | Mutation classes and confirmation policies. |
+| [Output and errors](docs/reference/output-and-errors.md) | Envelopes, exit codes, error codes. |
+| [Global flags](docs/reference/global-flags.md) | The flags every command shares. |
+| [Troubleshooting](docs/troubleshooting.md) | Exit codes, error envelopes, recovery. |
+| [Upgrade](docs/upgrade.md) / [Uninstall](docs/uninstall.md) | Keep the CLI current, or remove it. |
+| [Command reference](docs/reference/commands.md) | Every command, grouped by family. |
+
+Agent-readable indexes: [`docs/llms.txt`](docs/llms.txt) and
+[`docs/llms-full.txt`](docs/llms-full.txt).
+
+## Compatibility
+
+`mammoth-cli` follows [Semantic Versioning](https://semver.org) for the 1.x
+series:
+
+- The machine-output and error-envelope contract is stable. `SCHEMA_VERSION`
+  (see `mammoth_cli/__init__.py`) identifies it and never changes incompatibly
+  within a major version. New fields may be added; existing ones are preserved.
+- The CLI surface is stable. Command names, flags, and exit codes are not
+  removed or repurposed within a major version.
+- Bug fixes ship in patch releases. Additive changes ship in minor releases.
+
+## Development
+
+```bash
+pytest tests/ -q                 # unit + contract tests (live tests deselected)
+ruff check mammoth_cli scripts tests
+mypy mammoth_cli
+make cli-docs-check              # documentation gates
+```
+
+Build scripts under `scripts/` regenerate the manifests and the documentation
+corpus offline. Release and packaging details live in
+[../RELEASING.md](../RELEASING.md).
+
+## License
+
+See [LICENSE](LICENSE). Source: https://github.com/EdgeMetric/mammothsdk
+

mammoth_cli-1.0.2/README.md

@@ -0,0 +1,143 @@
+# mammoth-cli
+
+Drive the [Mammoth Analytics](https://mammoth.io) platform from your terminal.
+The `mammoth` command uploads data, runs pipeline transformations, manages
+projects and dashboards, and exports results — for people at a shell and for
+autonomous agents alike.
+
+[![PyPI](https://img.shields.io/pypi/v/mammoth-cli)](https://pypi.org/project/mammoth-cli/)
+[![Python](https://img.shields.io/pypi/pyversions/mammoth-cli)](https://pypi.org/project/mammoth-cli/)
+[![License](https://img.shields.io/pypi/l/mammoth-cli)](https://github.com/EdgeMetric/mammothsdk/blob/main/mammoth-cli/LICENSE)
+
+- **Human-friendly by default.** In a terminal, commands print a readable table.
+- **Agent-native.** When output is piped, you get a stable JSON envelope with a
+  documented schema, exit codes, and error codes — no flags required.
+- **Safe.** Every mutation carries a reviewed confirmation policy, so a
+  destructive command never runs unattended by accident.
+- **Discoverable.** `mammoth capability list` and `mammoth schema get` describe
+  every command, so an agent can learn the surface at runtime.
+
+The CLI is built on the public [`mammoth-io`](https://pypi.org/project/mammoth-io/)
+SDK. It adds no second HTTP client and calls no private SDK members.
+
+## Install
+
+```bash
+uv tool install mammoth-cli      # recommended: isolated, on your PATH
+# or
+pipx install mammoth-cli
+# or
+python -m pip install mammoth-cli
+```
+
+Then confirm the install:
+
+```bash
+mammoth --version
+```
+
+The CLI supports Python 3.12, 3.13, and 3.14. For the one-line installers and
+the verified (signed) install flow, see [docs/installation.md](docs/installation.md).
+
+## Quick start
+
+```bash
+mammoth auth login -w 4          # log in once; the secret goes to your OS keyring
+mammoth doctor                   # confirm credentials resolve and the API answers
+mammoth project list             # a table in a terminal, JSON when piped
+mammoth dataset list --project 180
+```
+
+Full walkthrough: [docs/quickstart.md](docs/quickstart.md).
+
+## Built for agents and CI
+
+Piping or redirecting output yields the machine envelope, and `--no-input` turns
+on automatically off a terminal, so an agent needs no special flags:
+
+```bash
+mammoth project list | jq '.data'
+```
+
+To be explicit, pass `--output json --no-input`. Log in without a prompt with a
+permission-checked file:
+
+```bash
+mammoth auth login --input creds.json --output json --no-input
+```
+
+Feed multi-field requests as one document instead of many flags:
+
+```bash
+mammoth view transform math 1039 --project 180 \
+  --input '{"expression": "price * qty", "new_column": "total"}'
+```
+
+Install the bundled agent skill for Claude Code, Codex, and Cursor:
+
+```bash
+mammoth skill install
+```
+
+See [docs/agents.md](docs/agents.md) and the
+[agent skill](mammoth_cli/bundled_skill/mammoth-cli/SKILL.md).
+
+## What you can do
+
+| Area | Command families |
+|---|---|
+| Data in and out | `file`, `dataset`, `connector`, `addon` |
+| Shape and analyze | `view`, `dataset`, `ai` |
+| Organize | `project`, `folder`, `dashboard`, `report`, `template` |
+| Automate | `automation`, `workflow`, `schedule`, `batch`, `webhook` |
+| Administer | `workspace`, `user`, `billing`, `client-app`, `external-key` |
+| Operate the CLI | `auth`, `context`, `config`, `doctor`, `capability`, `schema`, `skill`, `upgrade` |
+
+The full generated list is in [docs/reference/commands.md](docs/reference/commands.md).
+
+## Documentation
+
+| Guide | What it covers |
+|---|---|
+| [Installation](docs/installation.md) | Install the CLI and the agent skill. |
+| [Quick start](docs/quickstart.md) | Log in and run your first commands. |
+| [Authentication](docs/authentication.md) | Getting an API key, login, profiles, projects. |
+| [Agent and CI usage](docs/agents.md) | Machine output, structured input, patterns. |
+| [Safe mutation](docs/safety.md) | Mutation classes and confirmation policies. |
+| [Output and errors](docs/reference/output-and-errors.md) | Envelopes, exit codes, error codes. |
+| [Global flags](docs/reference/global-flags.md) | The flags every command shares. |
+| [Troubleshooting](docs/troubleshooting.md) | Exit codes, error envelopes, recovery. |
+| [Upgrade](docs/upgrade.md) / [Uninstall](docs/uninstall.md) | Keep the CLI current, or remove it. |
+| [Command reference](docs/reference/commands.md) | Every command, grouped by family. |
+
+Agent-readable indexes: [`docs/llms.txt`](docs/llms.txt) and
+[`docs/llms-full.txt`](docs/llms-full.txt).
+
+## Compatibility
+
+`mammoth-cli` follows [Semantic Versioning](https://semver.org) for the 1.x
+series:
+
+- The machine-output and error-envelope contract is stable. `SCHEMA_VERSION`
+  (see `mammoth_cli/__init__.py`) identifies it and never changes incompatibly
+  within a major version. New fields may be added; existing ones are preserved.
+- The CLI surface is stable. Command names, flags, and exit codes are not
+  removed or repurposed within a major version.
+- Bug fixes ship in patch releases. Additive changes ship in minor releases.
+
+## Development
+
+```bash
+pytest tests/ -q                 # unit + contract tests (live tests deselected)
+ruff check mammoth_cli scripts tests
+mypy mammoth_cli
+make cli-docs-check              # documentation gates
+```
+
+Build scripts under `scripts/` regenerate the manifests and the documentation
+corpus offline. Release and packaging details live in
+[../RELEASING.md](../RELEASING.md).
+
+## License
+
+See [LICENSE](LICENSE). Source: https://github.com/EdgeMetric/mammothsdk

{mammoth_cli-1.0.0 → mammoth_cli-1.0.2}/mammoth_cli/__init__.py

@@ -6,7 +6,7 @@ not implement a second HTTP client and does not call private SDK members.
 
 from __future__ import annotations
 
-__version__ = "1.0.0"
+__version__ = "1.0.2"
 
 # The versioned machine output envelope contract.
 SCHEMA_VERSION = 1

{mammoth_cli-1.0.0 → mammoth_cli-1.0.2}/mammoth_cli/app.py

@@ -29,7 +29,14 @@ from mammoth_cli.commands import BESPOKE
 from mammoth_cli.commands.registry import HANDLERS
 from mammoth_cli.errors.envelope import EXIT_USAGE, CliError, not_implemented_error
 from mammoth_cli.manifest.loader import command_by_id, load_commands
-from mammoth_cli.output.policy import COLOR_MODES, MACHINE_OUTPUTS, VALID_OUTPUTS
+from mammoth_cli.output.policy import (
+    COLOR_MODES,
+    MACHINE_OUTPUTS,
+    OUTPUT_AUTO,
+    SELECTABLE_OUTPUTS,
+    VALID_OUTPUTS,
+    resolve_output,
+)
 from mammoth_cli.runtime import executor, validate
 from mammoth_cli.runtime.invocation import Invocation
 from mammoth_cli.runtime.strict import validate_extra_args
@@ -52,10 +59,12 @@ def _output_mode_from_argv(argv: Sequence[str] | None) -> str:
     Used when a Click ``UsageError`` is raised *before* the per-command option
     is parsed (an unknown command, an unexpected argument, a bad option value),
     so the top-level error renderer can still honor the machine-output contract.
-    Defaults to the same ``"table"`` default the ``--output`` option declares.
+    Defaults to the same ``auto`` default the ``--output`` option declares, then
+    resolves it against whether stdout is a terminal — so a piped invocation
+    gets the machine envelope even for an error raised before option parsing.
     """
     tokens = list(argv) if argv is not None else sys.argv[1:]
-    mode = "table"
+    mode = OUTPUT_AUTO
     index = 0
     while index < len(tokens):
         token = tokens[index]
@@ -69,7 +78,7 @@ def _output_mode_from_argv(argv: Sequence[str] | None) -> str:
         elif token.startswith("-o") and len(token) > 2:
             mode = token[2:]
         index += 1
-    return mode
+    return resolve_output(mode, is_tty=sys.stdout.isatty())
 
 
 class _EnvelopeGroup(TyperGroup):
@@ -160,11 +169,14 @@ def _shared_option_params() -> list[inspect.Parameter]:
     return [
         opt(
             "output",
-            "table",
+            OUTPUT_AUTO,
             Annotated[
                 str,
                 typer.Option(
-                    "--output", "-o", help="Output format.", metavar="|".join(OUTPUT_MODES)
+                    "--output",
+                    "-o",
+                    help="Output format. 'auto' picks a table on a terminal, JSON when piped.",
+                    metavar="|".join(SELECTABLE_OUTPUTS),
                 ),
             ],
         ),

{mammoth_cli-1.0.0 → mammoth_cli-1.0.2}/mammoth_cli/bundled_skill/mammoth-cli/SKILL.md

@@ -11,7 +11,9 @@ deterministic machine output, promptless operation, and stable error envelopes.
 
 ## Golden rules for agents
 
-1. Always pass `--output json` and `--no-input`. Never rely on a prompt.
+1. Always pass `--output json` and `--no-input`. Machine output is automatic
+   when piped or redirected, and `--no-input` turns on automatically off a
+   terminal, but keeping both flags explicit is fine. Never rely on a prompt.
 2. Discover, do not guess. Use `mammoth capability list` and `mammoth schema get`
    to learn a command before you run it.
 3. Read the exit code, not the text. `0` ok, `2` usage, `4` auth, `5` not found,
@@ -20,19 +22,33 @@ deterministic machine output, promptless operation, and stable error envelopes.
    commands also need `--confirm TARGET`. There is no interactive fallback under
    `--no-input`.
 5. Never put a secret on the command line. Pass credentials through
-   `mammoth auth login` (prompt or environment) and structured secrets through
-   `--input`.
+   `mammoth auth login` (interactive) or `mammoth auth login --input creds.json`
+   (non-interactive), and structured secrets through `--input`.
 
 ## Authenticate
 
+Login is the only way to authenticate. Interactive login prompts for the API
+key and secret (hidden input):
+
+```bash
+mammoth auth login -w 4                          # -w is the workspace id
+```
+
+For agents, log in non-interactively from a `0600` JSON file:
+
 ```bash
-export MAMMOTH_API_KEY=... MAMMOTH_API_SECRET=... MAMMOTH_WORKSPACE_ID=4
-mammoth doctor --output json --no-input        # verify credentials + endpoint
+cat > creds.json <<'JSON'
+{"api_key": "...", "api_secret": "...", "workspace_id": 4, "server_prefix": "app"}
+JSON
+chmod 600 creds.json
+mammoth auth login --input creds.json --output json --no-input
+mammoth doctor --output json --no-input          # verify credentials + endpoint
 ```
 
-Credentials resolve in this order: explicit login, then environment, then the
-saved profile. The endpoint defaults to the `app-eu` server prefix. See
-[references/auth.md](references/auth.md).
+`server_prefix` is optional (default `app`). You can also pipe the document with
+`--input - --input-format json`. Credentials resolve in this order: explicit
+login, then the saved profile. The endpoint defaults to the `app` server prefix.
+See [references/auth.md](references/auth.md).
 
 ## Select a project
 
@@ -85,7 +101,7 @@ mammoth view transform bulk-replace VIEW_ID \
 
 ```bash
 mammoth dataset delete 2340 --project 180 --output json --no-input --yes
-mammoth workspace delete 9 --output json --no-input --yes --confirm 9
+mammoth workspace delete --output json --no-input --yes --confirm 9
 ```
 
 See [references/safety.md](references/safety.md).
@@ -107,3 +123,14 @@ mammoth capability list --output json --no-input     # every operation
 mammoth schema list --output json --no-input         # every command's schema
 mammoth schema get view.transform.filter --output json --no-input
 ```
+
+## Keep the CLI current
+
+```bash
+mammoth upgrade --check --output json --no-input      # read-only: installed vs latest on PyPI
+mammoth upgrade --yes --output json --no-input         # upgrade in place (requires --yes when non-interactive)
+```
+
+`mammoth upgrade` detects how the CLI was installed (uv tool, pipx, or pip) and
+upgrades it; `--check` changes nothing. Pin an exact release with
+`--version X.Y.Z`.

mammoth_cli-1.0.2/mammoth_cli/bundled_skill/mammoth-cli/references/auth.md

@@ -0,0 +1,28 @@
+# Authentication and profiles
+
+Required: API key, API secret, workspace id. Optional: a one-label server
+prefix (default `app`, resolving to `https://app.mammoth.io/api/v2`).
+
+## Precedence
+1. Explicit login handed to the current command (secure prompt or `--input`).
+2. The selected or `--profile` profile's saved credentials.
+
+The only supported configuration is the API key, API secret, workspace id, and
+an optional one-label server prefix (default `app`). There is no base-url
+override.
+
+## Commands
+```bash
+mammoth auth login -w 4 --output json --no-input          # prompts for key + secret
+mammoth auth login --input creds.json --output json --no-input   # non-interactive
+mammoth auth status --output json --no-input
+mammoth auth logout --profile default --output json --no-input --yes
+```
+
+`creds.json` is a `0600` JSON file: `{"api_key": "...", "api_secret": "...",
+"workspace_id": 4, "server_prefix": "app"}` (`server_prefix` optional). You can
+also pipe it with `--input - --input-format json`.
+
+Secrets live in the OS keyring (or a `0600` file fallback). They are never
+printed, logged, or included in any envelope. Never pass a secret as a plain
+argument; use the prompt or `--input`.

{mammoth_cli-1.0.0 → mammoth_cli-1.0.2}/mammoth_cli/commands/__init__.py

@@ -14,6 +14,7 @@ from collections.abc import Callable
 from mammoth_cli.commands import auth as auth_cmd
 from mammoth_cli.commands import config as config_cmd
 from mammoth_cli.commands import context as context_cmd
+from mammoth_cli.commands import upgrade as upgrade_cmd
 
 BESPOKE: dict[str, Callable[..., None]] = {
     "auth.login": auth_cmd.auth_login,
@@ -26,4 +27,5 @@ BESPOKE: dict[str, Callable[..., None]] = {
     "context.project.status": context_cmd.context_project_status,
     "context.project.use": context_cmd.context_project_use,
     "context.project.clear": context_cmd.context_project_clear,
+    "upgrade": upgrade_cmd.upgrade_command,
 }

{mammoth_cli-1.0.0 → mammoth_cli-1.0.2}/mammoth_cli/commands/auth.py

@@ -1,11 +1,11 @@
 """Bespoke `auth` command family: login, status, logout.
 
 Authentication has exactly three required inputs (API key, API secret,
-workspace id) and one optional input (server prefix, default ``app-eu``).
-These commands never accept a secret as an ordinary command-line value: the
-API key and secret come from a hidden TTY prompt, the four documented
-``MAMMOTH_*`` environment variables, or a permission-checked JSON/YAML
-document read through the shared ``--input`` option.
+workspace id) and one optional input (server prefix, default ``app``).
+Authentication always requires a login; there is no environment credential
+path. These commands never accept a secret as an ordinary command-line value:
+the API key and secret come from a hidden TTY prompt or a permission-checked
+JSON/YAML login document read through the shared ``--input`` option.
 """
 
 from __future__ import annotations
@@ -24,10 +24,6 @@ from pydantic import ValidationError
 from mammoth_cli.context import credentials, profiles
 from mammoth_cli.context.endpoint import resolve_base_url
 from mammoth_cli.context.resolver import (
-    ENV_API_KEY,
-    ENV_API_SECRET,
-    ENV_SERVER_PREFIX,
-    ENV_WORKSPACE_ID,
     ResolvedAuth,
     resolve_auth,
 )
@@ -189,48 +185,12 @@ def _validate_login_document(document: dict[str, Any]) -> LoginRequest:
         ) from exc
 
 
-def _read_env_login() -> tuple[str, str, int | None, str | None]:
-    """Read credentials from the four documented ``MAMMOTH_*`` variables.
-
-    Returns:
-        ``(api_key, api_secret, workspace_id, server_prefix)``. Workspace id
-        and server prefix are None when their variable is unset.
-
-    Raises:
-        CliError: ``missing_env_credentials`` when the API key or secret
-            variable is unset.
-    """
-    api_key = os.environ.get(ENV_API_KEY)
-    api_secret = os.environ.get(ENV_API_SECRET)
-    workspace_raw = os.environ.get(ENV_WORKSPACE_ID)
-    server_prefix = os.environ.get(ENV_SERVER_PREFIX)
-    if not api_key or not api_secret:
-        raise CliError(
-            code="missing_env_credentials",
-            message="MAMMOTH_API_KEY and MAMMOTH_API_SECRET must be set for --from-env.",
-            exit_status=EXIT_USAGE,
-        )
-    workspace_id: int | None = None
-    if workspace_raw:
-        try:
-            workspace_id = int(workspace_raw)
-        except ValueError as exc:
-            raise CliError(
-                code=CODE_INVALID_WORKSPACE_ID,
-                message="MAMMOTH_WORKSPACE_ID must be an integer.",
-                exit_status=EXIT_USAGE,
-                hint="Set MAMMOTH_WORKSPACE_ID to a numeric workspace id.",
-            ) from exc
-    return api_key, api_secret, workspace_id, server_prefix
-
-
 def _run_login(
     invocation: Invocation,
     *,
     workspace: int | None,
     server_prefix: str | None,
     storage: str,
-    from_env: bool,
 ) -> tuple[dict[str, Any], dict[str, Any]]:
     """Validate, connection-check, and persist one `auth login` invocation."""
     if storage not in _STORAGE_MODES:
@@ -240,12 +200,6 @@ def _run_login(
             exit_status=EXIT_USAGE,
             hint=f"Use one of: {', '.join(_STORAGE_MODES)}.",
         )
-    if from_env and invocation.input_file is not None:
-        raise CliError(
-            code="invalid_input_mode",
-            message="--from-env and --input are mutually exclusive.",
-            exit_status=EXIT_USAGE,
-        )
 
     policy = resolve_policy(
         output=invocation.output,
@@ -255,11 +209,8 @@ def _run_login(
         color=invocation.color,
     )
 
-    if from_env:
-        api_key, api_secret, env_workspace, env_prefix = _read_env_login()
-        effective_workspace = workspace if workspace is not None else env_workspace
-        effective_prefix = server_prefix if server_prefix is not None else env_prefix
-    elif invocation.input_file is not None:
+    effective_workspace: int | None
+    if invocation.input_file is not None:
         document = _load_login_document(invocation.input_file, invocation.input_format)
         request = _validate_login_document(document)
         api_key, api_secret = request.api_key, request.api_secret
@@ -273,9 +224,9 @@ def _run_login(
     else:
         raise CliError(
             code="login_input_required",
-            message="Non-interactive login requires --from-env or --input.",
+            message="Non-interactive login requires --input.",
             exit_status=EXIT_USAGE,
-            hint="Pass --from-env, or --input FILE|- (with --input-format for stdin).",
+            hint="Pass --input FILE|- (with --input-format for stdin), or run in a terminal.",
         )
 
     if effective_workspace is None or effective_workspace <= 0:
@@ -350,22 +301,19 @@ def auth_login(
         None,
         "--workspace",
         "-w",
-        help="Workspace id. Required unless --from-env or --input supplies it.",
+        help="Workspace id. Required unless --input supplies it.",
     ),
     server_prefix: str | None = typer.Option(
-        None, "--server-prefix", help="Server prefix (one DNS label). Default 'app-eu'."
+        None, "--server-prefix", help="Server prefix (one DNS label). Default 'app'."
     ),
     storage: str = typer.Option(
         "auto", "--storage", help="Credential storage backend.", metavar="auto|keyring|file"
     ),
-    from_env: bool = typer.Option(
-        False,
-        "--from-env",
-        help="Read credentials from MAMMOTH_API_KEY/MAMMOTH_API_SECRET/MAMMOTH_WORKSPACE_ID.",
-    ),
 ) -> None:
     """Log in and store one profile's credentials.
 
+    Prompts for the API key and secret in a terminal. For non-interactive use
+    (agents, CI), pass ``--input FILE`` with a login document instead.
     Performs a lightweight connection check before saving anything; a failed
     check leaves existing profile state unchanged.
     """
@@ -391,7 +339,6 @@ def auth_login(
             workspace=workspace,
             server_prefix=server_prefix,
             storage=storage,
-            from_env=from_env,
         )
 
     executor.run(invocation.command_id, invocation.output, producer)