mammoth-cli 2.0.4__tar.gz → 2.0.5__tar.gz

{mammoth_cli-2.0.4 → mammoth_cli-2.0.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mammoth-cli
-Version: 2.0.4
+Version: 2.0.5
 Summary: Command-line interface for the Mammoth Analytics platform
 Project-URL: homepage, https://mammoth.io
 Project-URL: repository, https://github.com/EdgeMetric/mammothsdk
@@ -64,7 +64,6 @@ then confirm it works:
 
 ```bash
 mammoth --version
-mammoth doctor          # checks config, credentials, endpoint, connectivity
 ```
 
 The installer bootstraps its own `uv` tool environment when needed and installs
@@ -73,25 +72,54 @@ X.Y.Z`; the installer has no normal prompts. See
 [Installation](https://github.com/EdgeMetric/mammothsdk/blob/main/mammoth-cli/docs/installation.md) for that option and the SDK-only pip
 installation path.
 
-## Quick start
+## First run: authenticate, check, then discover
+
+Authentication is the first operational step. In an evaluated or isolated run
+with a controller-provided credential broker/sidecar, use that broker's
+readiness check; do not inspect saved profiles, run login, or run doctor, and
+stop if the broker is absent. In an ordinary shell, check the selected profile;
+this is a local presence check, not a live access test. If the profile or
+stored credentials are absent, log in before running `doctor` or any data command:
 
 ```bash
-mammoth auth login               # prompts for API key, API secret, workspace id
-mammoth doctor                   # confirm credentials resolve and the API answers
-mammoth project list             # a table in a terminal, JSON when piped
-mammoth dataset list --project 180
+mammoth skill list --output json --no-input
+mammoth skill path --output json --no-input
+# Read the installed SKILL.md before operating.
+mammoth auth status --output json --no-input
+# Human terminal only, if profile or stored credentials are absent:
+mammoth auth login
+# Then verify configuration, credentials, endpoint, and connectivity:
+mammoth doctor --output json --no-input
+# Then discover a task-specific route:
+mammoth schema find "TASK OR RESOURCE" --output json --no-input
+mammoth schema get COMMAND_ID --output json --no-input
+# Optional API-binding inventory (not the complete CLI surface):
+mammoth capability list --output json --no-input
 ```
 
-Full walkthrough: [docs/quickstart.md](https://github.com/EdgeMetric/mammothsdk/blob/main/mammoth-cli/docs/quickstart.md).
-
-The login command has no workspace shortcut flag. For CI or an agent, use a
-protected request document instead:
+For an agent or CI, do not request or paste secrets into chat, prompts, shell
+history, or command arguments. On POSIX, put the required JSON credentials in a
+private owner-only (0600) file outside the repository and pass its path to:
 
 ```bash
-chmod 600 creds.json
-mammoth auth login --input creds.json --output json --no-input
+mammoth auth login --input /private/path/credentials.json --storage file \
+  --output json --no-input
 ```
 
+On Windows, use the approved OS keyring or credential broker instead; do not
+use a file fallback unless its ACL hardening is approved, and stop if neither
+is available.
+
+The default server prefix is `app`; pass `--server-prefix release` only when
+the release endpoint is explicitly intended. See
+[Authentication](https://github.com/EdgeMetric/mammothsdk/blob/main/mammoth-cli/docs/authentication.md)
+for the required JSON fields and profile behavior. After `doctor` succeeds,
+resolve the exact workspace, project, dataset, and view from read results
+before operating; verify every mutation. Use `schema find`/`schema get` for
+typed and local CLI routes; `capability list` is only an API-binding inventory
+and may omit them. Full walkthrough:
+[docs/quickstart.md](https://github.com/EdgeMetric/mammothsdk/blob/main/mammoth-cli/docs/quickstart.md).
+
 ## Built for agents and CI
 
 Piping or redirecting output yields the machine envelope, and `--no-input` turns
@@ -101,11 +129,12 @@ on automatically off a terminal, so an agent needs no special flags:
 mammoth project list | jq '.data'
 ```
 
-To be explicit, pass `--output json --no-input`. Log in without a prompt with a
-permission-checked file:
+To be explicit, pass `--output json --no-input`. Log in without a prompt with
+the private, permission-checked file described above:
 
 ```bash
-mammoth auth login --input creds.json --output json --no-input
+mammoth auth login --input /private/path/credentials.json --storage file \
+  --output json --no-input
 ```
 
 Feed multi-field requests as one document instead of many flags:

{mammoth_cli-2.0.4 → mammoth_cli-2.0.5}/README.md

@@ -36,7 +36,6 @@ then confirm it works:
 
 ```bash
 mammoth --version
-mammoth doctor          # checks config, credentials, endpoint, connectivity
 ```
 
 The installer bootstraps its own `uv` tool environment when needed and installs
@@ -45,25 +44,54 @@ X.Y.Z`; the installer has no normal prompts. See
 [Installation](https://github.com/EdgeMetric/mammothsdk/blob/main/mammoth-cli/docs/installation.md) for that option and the SDK-only pip
 installation path.
 
-## Quick start
+## First run: authenticate, check, then discover
+
+Authentication is the first operational step. In an evaluated or isolated run
+with a controller-provided credential broker/sidecar, use that broker's
+readiness check; do not inspect saved profiles, run login, or run doctor, and
+stop if the broker is absent. In an ordinary shell, check the selected profile;
+this is a local presence check, not a live access test. If the profile or
+stored credentials are absent, log in before running `doctor` or any data command:
 
 ```bash
-mammoth auth login               # prompts for API key, API secret, workspace id
-mammoth doctor                   # confirm credentials resolve and the API answers
-mammoth project list             # a table in a terminal, JSON when piped
-mammoth dataset list --project 180
+mammoth skill list --output json --no-input
+mammoth skill path --output json --no-input
+# Read the installed SKILL.md before operating.
+mammoth auth status --output json --no-input
+# Human terminal only, if profile or stored credentials are absent:
+mammoth auth login
+# Then verify configuration, credentials, endpoint, and connectivity:
+mammoth doctor --output json --no-input
+# Then discover a task-specific route:
+mammoth schema find "TASK OR RESOURCE" --output json --no-input
+mammoth schema get COMMAND_ID --output json --no-input
+# Optional API-binding inventory (not the complete CLI surface):
+mammoth capability list --output json --no-input
 ```
 
-Full walkthrough: [docs/quickstart.md](https://github.com/EdgeMetric/mammothsdk/blob/main/mammoth-cli/docs/quickstart.md).
-
-The login command has no workspace shortcut flag. For CI or an agent, use a
-protected request document instead:
+For an agent or CI, do not request or paste secrets into chat, prompts, shell
+history, or command arguments. On POSIX, put the required JSON credentials in a
+private owner-only (0600) file outside the repository and pass its path to:
 
 ```bash
-chmod 600 creds.json
-mammoth auth login --input creds.json --output json --no-input
+mammoth auth login --input /private/path/credentials.json --storage file \
+  --output json --no-input
 ```
 
+On Windows, use the approved OS keyring or credential broker instead; do not
+use a file fallback unless its ACL hardening is approved, and stop if neither
+is available.
+
+The default server prefix is `app`; pass `--server-prefix release` only when
+the release endpoint is explicitly intended. See
+[Authentication](https://github.com/EdgeMetric/mammothsdk/blob/main/mammoth-cli/docs/authentication.md)
+for the required JSON fields and profile behavior. After `doctor` succeeds,
+resolve the exact workspace, project, dataset, and view from read results
+before operating; verify every mutation. Use `schema find`/`schema get` for
+typed and local CLI routes; `capability list` is only an API-binding inventory
+and may omit them. Full walkthrough:
+[docs/quickstart.md](https://github.com/EdgeMetric/mammothsdk/blob/main/mammoth-cli/docs/quickstart.md).
+
 ## Built for agents and CI
 
 Piping or redirecting output yields the machine envelope, and `--no-input` turns
@@ -73,11 +101,12 @@ on automatically off a terminal, so an agent needs no special flags:
 mammoth project list | jq '.data'
 ```
 
-To be explicit, pass `--output json --no-input`. Log in without a prompt with a
-permission-checked file:
+To be explicit, pass `--output json --no-input`. Log in without a prompt with
+the private, permission-checked file described above:
 
 ```bash
-mammoth auth login --input creds.json --output json --no-input
+mammoth auth login --input /private/path/credentials.json --storage file \
+  --output json --no-input
 ```
 
 Feed multi-field requests as one document instead of many flags:

{mammoth_cli-2.0.4 → mammoth_cli-2.0.5}/mammoth_cli/__init__.py

@@ -6,7 +6,7 @@ not implement a second HTTP client and does not call private SDK members.
 
 from __future__ import annotations
 
-__version__ = "2.0.4"
+__version__ = "2.0.5"
 
 # The versioned machine output envelope contract.
 SCHEMA_VERSION = 1

{mammoth_cli-2.0.4 → mammoth_cli-2.0.5}/mammoth_cli/bundled_skill/mammoth-cli/SKILL.md

@@ -5,8 +5,21 @@ description: "Use Mammoth Analytics from a terminal: install or authenticate the
 
 # Mammoth CLI
 
-Use this skill for Mammoth shell work, not for Python SDK integration. Start
-with the installed command contract rather than guessed routes or payloads:
+Use this skill for Mammoth shell work, not for Python SDK integration. Complete
+the authentication preflight below before using the installed command contract;
+never guess routes or payloads:
+
+Before any remote read or write, establish authentication. Ordinary operator
+runs check the selected profile with `mammoth auth status --output json --no-input`;
+if the profile is missing or `has_credentials` is false, stop and complete the
+secure login flow in [authentication](references/auth.md). Then run
+`mammoth doctor --profile PROFILE --output json --no-input` and require a
+successful result before discovering resources or operating on them. A failed
+status, login, or doctor check is a precondition failure—not a reason to try
+the business command anyway. In evaluated or isolated runs, skip all saved
+profile checks and login commands: use only the controller-provided credential
+broker/sidecar check, never mount or read a saved profile, and stop if that
+broker is absent.
 
 ```bash
 mammoth schema find "TASK OR RESOURCE" --output json --no-input

mammoth_cli-2.0.5/mammoth_cli/bundled_skill/mammoth-cli/references/auth.md

@@ -0,0 +1,84 @@
+# Authentication and profiles
+
+Required: API key, API secret, workspace id. Optional: a one-label server
+prefix (default `app`, resolving to `https://app.mammoth.io/api/v2`).
+
+## Precedence
+1. Explicit login handed to the current command (secure prompt or `--input`).
+2. The selected or `--profile` profile's saved credentials.
+
+The only supported configuration is the API key, API secret, workspace id, and
+an optional one-label server prefix (default `app`). There is no base-url
+override.
+
+## Cold-start sequence
+
+For an ordinary operator, before any remote command, inspect authentication and
+then verify the connection. These checks are mandatory even when a profile may
+already exist:
+
+```bash
+mammoth auth status --profile PROFILE --output json --no-input
+```
+
+If status reports a missing profile or `has_credentials=false`, run the secure
+login flow, then check status again:
+
+```bash
+mammoth auth login --profile PROFILE --server-prefix app
+mammoth auth status --profile PROFILE --output json --no-input
+```
+
+`auth status` is a local profile/credential-presence check; it does not prove
+that credentials are valid remotely. After the profile is present, verify the
+live connection:
+
+```bash
+mammoth doctor --profile PROFILE --output json --no-input
+```
+
+Do not continue to schema discovery or business operations after an
+authentication or doctor failure. The `app` server prefix is the default;
+release or other environment credentials do not imply authorization for `app`.
+
+For an evaluated or isolated agent, do not run these profile commands: use the
+controller-provided credential broker/sidecar check instead. Never mount or
+read a saved profile. If no broker is provided, stop before authenticated
+actions.
+
+## Commands
+```bash
+mammoth auth login --profile PROFILE --server-prefix app  # hidden prompts
+mammoth auth login --profile PROFILE --input creds.json --storage file --output json --no-input
+mammoth auth status --profile PROFILE --output json --no-input
+mammoth auth logout --profile default --output json --no-input --yes
+```
+
+`PROFILE` means the actual nonsecret profile name selected by the operator or
+reported by `auth status` (for example, `default` or `work`). Substitute that
+name; never type the literal placeholder or invent a profile to evade an
+authorization failure. When using the selected profile, `--profile PROFILE`
+may be omitted.
+
+For an ordinary human-operated terminal, prefer the first command: it asks
+for the key and secret without putting either in shell history, argv, chat, or
+logs. For headless POSIX work, create the JSON file outside the repository, set
+its permissions to `0600`, and pass only its path. With a protected POSIX file,
+specify `--storage file` explicitly; `--storage auto` can require an available
+OS keyring and is not a reliable headless fallback. On Windows, do not use the
+file backend as a secret store; use the OS keyring, a controller broker, or
+stop and obtain a supported secure store. Remove any input file after the
+profile is stored.
+
+`creds.json` is a `0600` JSON file: `{"api_key": "...", "api_secret": "...",
+"workspace_id": 4, "server_prefix": "app"}` (`server_prefix` optional). You can
+also pipe it with `--input - --input-format json`.
+
+Secrets live in the OS keyring (or an explicitly selected `0600` file
+fallback). They are never printed, logged, or included in any envelope. Never
+pass a secret as a plain argument; use the hidden prompt or `--input`.
+
+For evaluated or isolated agents, authentication remains controller-owned: use
+the provided credential broker/sidecar instead of `auth login` and never mount
+or read a saved profile. If no broker is provided, stop before authenticated
+actions and report the precondition failure.

{mammoth_cli-2.0.4 → mammoth_cli-2.0.5}/mammoth_cli/bundled_skill/mammoth-cli/references/command-index.md

@@ -1,6 +1,6 @@
 # Published CLI command catalog
 
-This generated catalog covers every command in the published CLI manifest, currently 547. It is a command-contract index, not an assertion that every backend/OpenAPI operation has a CLI binding. For an exact local CLI contract, run `mammoth schema get COMMAND_ID --output json --no-input`; `mammoth capability list` is an API-binding inventory and can omit typed/local CLI routes. For focused workflows, read the [recipes index](recipes/index.md).
+This generated catalog covers every command in the published CLI manifest, currently 547. It is a command-contract index, not an assertion that every backend/OpenAPI operation has a CLI binding. For an exact local CLI contract, run `mammoth schema get COMMAND_ID --output json --no-input`; `mammoth capability list` is an API-binding inventory and can omit typed/local CLI routes. For focused workflows, read the [recipes index](recipes/index.md). Sensitive structured input must come from a private file or pipe; never put secrets in literal argv.
 
 Load only the applicable domain file:
 

{mammoth_cli-2.0.4 → mammoth_cli-2.0.5}/mammoth_cli/bundled_skill/mammoth-cli/references/commands/file.md

@@ -44,7 +44,9 @@ Expected success: `FileListResult` in the standard JSON envelope; mutation `read
 
 Run: `mammoth file set-password`. Exact input fields: `mammoth schema get file.set-password --output json --no-input`.
 
-Example: `mammoth file set-password 123 --input '{"password": "replace-with-secret"}' --output json --no-input`. Illustrative only: append `--yes --confirm <EXACT_TARGET>` after observing the target.
+Example: `mammoth file set-password 123 --input /private/path/request.json --output json --no-input`. Illustrative only: append `--yes --confirm <EXACT_TARGET>` after observing the target.
+
+Sensitive structured input must come from a private file or pipe; never put secrets in literal argv.
 
 Expected success: `FileSetPasswordResult` in the standard JSON envelope; mutation `high_impact`, confirmation `confirm_target`, wait policy `always_wait`. On nonzero exit, inspect the JSON error envelope and its `recovery_commands`; do not guess request fields. See [representative envelopes](../machine-output.md) for concrete success/error shapes.
 

{mammoth_cli-2.0.4 → mammoth_cli-2.0.5}/mammoth_cli/bundled_skill/mammoth-cli/references/commands/user.md

@@ -20,7 +20,9 @@ Expected success: `UserAvatarUploadResult` in the standard JSON envelope; mutati
 
 Run: `mammoth user change-password`. Exact input fields: `mammoth schema get user.change-password --output json --no-input`.
 
-Example: `mammoth user change-password --input '{"current_password": "replace-with-secret", "new_password": "replace-with-secret"}' --output json --no-input`. Illustrative only: append `--yes --confirm <EXACT_TARGET>` after observing the target.
+Example: `mammoth user change-password --input /private/path/request.json --output json --no-input`. Illustrative only: append `--yes --confirm <EXACT_TARGET>` after observing the target.
+
+Sensitive structured input must come from a private file or pipe; never put secrets in literal argv.
 
 Expected success: `UserChangePasswordResult` in the standard JSON envelope; mutation `high_impact`, confirmation `confirm_target`, wait policy `not_async`. On nonzero exit, inspect the JSON error envelope and its `recovery_commands`; do not guess request fields. See [representative envelopes](../machine-output.md) for concrete success/error shapes.
 

{mammoth_cli-2.0.4 → mammoth_cli-2.0.5}/mammoth_cli/bundled_skill/mammoth-cli/references/commands/view.md

@@ -288,7 +288,9 @@ Expected success: `ViewDraftSubmitResult` in the standard JSON envelope; mutatio
 
 Run: `mammoth view export azure-blob`. Exact input fields: `mammoth schema get view.export.azure-blob --output json --no-input`.
 
-Example: `mammoth view export azure-blob 123 123 --input '{"storage_account_name": "storage-account", "tenant_id": "tenant-id", "client_id": "client-id", "client_secret": "replace-with-secret", "container_name": "exports"}' --output json --no-input`. Illustrative only: append `--yes` after observing an owned target.
+Example: `mammoth view export azure-blob 123 123 --input /private/path/request.json --output json --no-input`. Illustrative only: append `--yes` after observing an owned target.
+
+Sensitive structured input must come from a private file or pipe; never put secrets in literal argv.
 
 Expected success: `ViewExportAzureBlobResult` in the standard JSON envelope; mutation `external_effect`, confirmation `yes_always`, wait policy `returns_job`. On nonzero exit, inspect the JSON error envelope and its `recovery_commands`; do not guess request fields. See [representative envelopes](../machine-output.md) for concrete success/error shapes.
 
@@ -336,7 +338,9 @@ Expected success: `ViewExportDeleteResult` in the standard JSON envelope; mutati
 
 Run: `mammoth view export elasticsearch`. Exact input fields: `mammoth schema get view.export.elasticsearch --output json --no-input`.
 
-Example: `mammoth view export elasticsearch 123 123 --input '{"host": "elastic.example", "username": "agent", "password": "replace-with-secret", "index": "exports"}' --output json --no-input`. Illustrative only: append `--yes` after observing an owned target.
+Example: `mammoth view export elasticsearch 123 123 --input /private/path/request.json --output json --no-input`. Illustrative only: append `--yes` after observing an owned target.
+
+Sensitive structured input must come from a private file or pipe; never put secrets in literal argv.
 
 Expected success: `ViewExportElasticsearchResult` in the standard JSON envelope; mutation `external_effect`, confirmation `yes_always`, wait policy `returns_job`. On nonzero exit, inspect the JSON error envelope and its `recovery_commands`; do not guess request fields. See [representative envelopes](../machine-output.md) for concrete success/error shapes.
 
@@ -352,7 +356,9 @@ Expected success: `ViewExportEmailResult` in the standard JSON envelope; mutatio
 
 Run: `mammoth view export ftp`. Exact input fields: `mammoth schema get view.export.ftp --output json --no-input`.
 
-Example: `mammoth view export ftp 123 123 --input '{"domain": "ftp.example", "directory": "/exports", "file": "report.csv", "username": "agent", "password": "replace-with-secret"}' --output json --no-input`. Illustrative only: append `--yes` after observing an owned target.
+Example: `mammoth view export ftp 123 123 --input /private/path/request.json --output json --no-input`. Illustrative only: append `--yes` after observing an owned target.
+
+Sensitive structured input must come from a private file or pipe; never put secrets in literal argv.
 
 Expected success: `ViewExportFtpResult` in the standard JSON envelope; mutation `external_effect`, confirmation `yes_always`, wait policy `returns_job`. On nonzero exit, inspect the JSON error envelope and its `recovery_commands`; do not guess request fields. See [representative envelopes](../machine-output.md) for concrete success/error shapes.
 
@@ -384,7 +390,9 @@ Expected success: `ViewExportManagedS3Result` in the standard JSON envelope; mut
 
 Run: `mammoth view export mssql`. Exact input fields: `mammoth schema get view.export.mssql --output json --no-input`.
 
-Example: `mammoth view export mssql 123 123 --input '{"host": "db.example", "port": 1433, "database": "analytics", "table": "exports", "username": "agent", "password": "replace-with-secret"}' --output json --no-input`. Illustrative only: append `--yes` after observing an owned target.
+Example: `mammoth view export mssql 123 123 --input /private/path/request.json --output json --no-input`. Illustrative only: append `--yes` after observing an owned target.
+
+Sensitive structured input must come from a private file or pipe; never put secrets in literal argv.
 
 Expected success: `ViewExportMssqlResult` in the standard JSON envelope; mutation `external_effect`, confirmation `yes_always`, wait policy `returns_job`. On nonzero exit, inspect the JSON error envelope and its `recovery_commands`; do not guess request fields. See [representative envelopes](../machine-output.md) for concrete success/error shapes.
 
@@ -392,7 +400,9 @@ Expected success: `ViewExportMssqlResult` in the standard JSON envelope; mutatio
 
 Run: `mammoth view export mysql`. Exact input fields: `mammoth schema get view.export.mysql --output json --no-input`.
 
-Example: `mammoth view export mysql 123 123 --input '{"host": "db.example", "port": 3306, "database": "analytics", "table": "exports", "username": "agent", "password": "replace-with-secret"}' --output json --no-input`. Illustrative only: append `--yes` after observing an owned target.
+Example: `mammoth view export mysql 123 123 --input /private/path/request.json --output json --no-input`. Illustrative only: append `--yes` after observing an owned target.
+
+Sensitive structured input must come from a private file or pipe; never put secrets in literal argv.
 
 Expected success: `ViewExportMysqlResult` in the standard JSON envelope; mutation `external_effect`, confirmation `yes_always`, wait policy `returns_job`. On nonzero exit, inspect the JSON error envelope and its `recovery_commands`; do not guess request fields. See [representative envelopes](../machine-output.md) for concrete success/error shapes.
 
@@ -400,7 +410,9 @@ Expected success: `ViewExportMysqlResult` in the standard JSON envelope; mutatio
 
 Run: `mammoth view export onedrive`. Exact input fields: `mammoth schema get view.export.onedrive --output json --no-input`.
 
-Example: `mammoth view export onedrive 123 123 --input '{"tenant_id": "tenant-id", "client_id": "client-id", "client_secret": "replace-with-secret", "user_id": "user-id"}' --output json --no-input`. Illustrative only: append `--yes` after observing an owned target.
+Example: `mammoth view export onedrive 123 123 --input /private/path/request.json --output json --no-input`. Illustrative only: append `--yes` after observing an owned target.
+
+Sensitive structured input must come from a private file or pipe; never put secrets in literal argv.
 
 Expected success: `ViewExportOnedriveResult` in the standard JSON envelope; mutation `external_effect`, confirmation `yes_always`, wait policy `returns_job`. On nonzero exit, inspect the JSON error envelope and its `recovery_commands`; do not guess request fields. See [representative envelopes](../machine-output.md) for concrete success/error shapes.
 
@@ -408,7 +420,9 @@ Expected success: `ViewExportOnedriveResult` in the standard JSON envelope; muta
 
 Run: `mammoth view export postgres`. Exact input fields: `mammoth schema get view.export.postgres --output json --no-input`.
 
-Example: `mammoth view export postgres 123 123 --input '{"host": "db.example", "port": 5432, "database": "analytics", "table": "exports", "username": "agent", "password": "replace-with-secret"}' --output json --no-input`. Illustrative only: append `--yes` after observing an owned target.
+Example: `mammoth view export postgres 123 123 --input /private/path/request.json --output json --no-input`. Illustrative only: append `--yes` after observing an owned target.
+
+Sensitive structured input must come from a private file or pipe; never put secrets in literal argv.
 
 Expected success: `ViewExportPostgresResult` in the standard JSON envelope; mutation `external_effect`, confirmation `yes_always`, wait policy `returns_job`. On nonzero exit, inspect the JSON error envelope and its `recovery_commands`; do not guess request fields. See [representative envelopes](../machine-output.md) for concrete success/error shapes.
 
@@ -416,7 +430,9 @@ Expected success: `ViewExportPostgresResult` in the standard JSON envelope; muta
 
 Run: `mammoth view export powerbi`. Exact input fields: `mammoth schema get view.export.powerbi --output json --no-input`.
 
-Example: `mammoth view export powerbi 123 123 --input '{"username": "agent", "password": "replace-with-secret", "client_id": "client-id", "dataset": "dataset", "table": "exports"}' --output json --no-input`. Illustrative only: append `--yes` after observing an owned target.
+Example: `mammoth view export powerbi 123 123 --input /private/path/request.json --output json --no-input`. Illustrative only: append `--yes` after observing an owned target.
+
+Sensitive structured input must come from a private file or pipe; never put secrets in literal argv.
 
 Expected success: `ViewExportPowerbiResult` in the standard JSON envelope; mutation `external_effect`, confirmation `yes_always`, wait policy `returns_job`. On nonzero exit, inspect the JSON error envelope and its `recovery_commands`; do not guess request fields. See [representative envelopes](../machine-output.md) for concrete success/error shapes.
 
@@ -440,7 +456,9 @@ Expected success: `ViewExportPublishDbUpdateResult` in the standard JSON envelop
 
 Run: `mammoth view export redshift`. Exact input fields: `mammoth schema get view.export.redshift --output json --no-input`.
 
-Example: `mammoth view export redshift 123 123 --input '{"host": "db.example", "port": 5439, "database": "analytics", "table": "exports", "username": "agent", "password": "replace-with-secret"}' --output json --no-input`. Illustrative only: append `--yes` after observing an owned target.
+Example: `mammoth view export redshift 123 123 --input /private/path/request.json --output json --no-input`. Illustrative only: append `--yes` after observing an owned target.
+
+Sensitive structured input must come from a private file or pipe; never put secrets in literal argv.
 
 Expected success: `ViewExportRedshiftResult` in the standard JSON envelope; mutation `external_effect`, confirmation `yes_always`, wait policy `returns_job`. On nonzero exit, inspect the JSON error envelope and its `recovery_commands`; do not guess request fields. See [representative envelopes](../machine-output.md) for concrete success/error shapes.
 
@@ -464,7 +482,9 @@ Expected success: `ViewExportSftpResult` in the standard JSON envelope; mutation
 
 Run: `mammoth view export sharepoint`. Exact input fields: `mammoth schema get view.export.sharepoint --output json --no-input`.
 
-Example: `mammoth view export sharepoint 123 123 --input '{"tenant_id": "tenant-id", "client_id": "client-id", "client_secret": "replace-with-secret", "site_url": "https://sharepoint.example/site"}' --output json --no-input`. Illustrative only: append `--yes` after observing an owned target.
+Example: `mammoth view export sharepoint 123 123 --input /private/path/request.json --output json --no-input`. Illustrative only: append `--yes` after observing an owned target.
+
+Sensitive structured input must come from a private file or pipe; never put secrets in literal argv.
 
 Expected success: `ViewExportSharepointResult` in the standard JSON envelope; mutation `external_effect`, confirmation `yes_always`, wait policy `returns_job`. On nonzero exit, inspect the JSON error envelope and its `recovery_commands`; do not guess request fields. See [representative envelopes](../machine-output.md) for concrete success/error shapes.
 
@@ -472,7 +492,9 @@ Expected success: `ViewExportSharepointResult` in the standard JSON envelope; mu
 
 Run: `mammoth view export tableau`. Exact input fields: `mammoth schema get view.export.tableau --output json --no-input`.
 
-Example: `mammoth view export tableau 123 123 --input '{"server_url": "https://tableau.example", "token_name": "token", "token_secret": "replace-with-secret"}' --output json --no-input`. Illustrative only: append `--yes` after observing an owned target.
+Example: `mammoth view export tableau 123 123 --input /private/path/request.json --output json --no-input`. Illustrative only: append `--yes` after observing an owned target.
+
+Sensitive structured input must come from a private file or pipe; never put secrets in literal argv.
 
 Expected success: `ViewExportTableauResult` in the standard JSON envelope; mutation `external_effect`, confirmation `yes_always`, wait policy `returns_job`. On nonzero exit, inspect the JSON error envelope and its `recovery_commands`; do not guess request fields. See [representative envelopes](../machine-output.md) for concrete success/error shapes.
 

{mammoth_cli-2.0.4 → mammoth_cli-2.0.5}/mammoth_cli/bundled_skill/mammoth-cli/references/commands/workspace.md

@@ -4,7 +4,9 @@
 
 Run: `mammoth workspace accept-invite`. Exact input fields: `mammoth schema get workspace.accept-invite --output json --no-input`.
 
-Example: `mammoth workspace accept-invite --input '{"token": "replace-with-secret"}' --output json --no-input`. Runnable only after resolving schema-required IDs and input from observed reads.
+Example: `mammoth workspace accept-invite --input /private/path/request.json --output json --no-input`. Runnable only after resolving schema-required IDs and input from observed reads.
+
+Sensitive structured input must come from a private file or pipe; never put secrets in literal argv.
 
 Expected success: `WorkspaceAcceptInviteResult` in the standard JSON envelope; mutation `benign_mutation`, confirmation `none`, wait policy `not_async`. On nonzero exit, inspect the JSON error envelope and its `recovery_commands`; do not guess request fields. See [representative envelopes](../machine-output.md) for concrete success/error shapes.
 

{mammoth_cli-2.0.4 → mammoth_cli-2.0.5}/mammoth_cli/bundled_skill/mammoth-cli/references/task-start.md

@@ -27,9 +27,31 @@ non-evaluated operator use.
    install is required for the agent host, run `mammoth skill install
    --output json --no-input` and verify ownership with `mammoth skill list
    --output json --no-input`.
-3. Use the protected profile/configuration supplied by the user or environment.
-   Run `mammoth doctor --profile PROFILE --output json --no-input`; do not print,
-   echo, or copy its secret-bearing inputs.
+3. Establish authentication before any remote read or write. In an evaluated
+   or isolated run, do not inspect a saved profile and do not run `auth login`:
+   use the controller-provided credential broker/sidecar check. If it is not
+   provided, stop before authenticated actions. The remaining instructions in
+   this step are for ordinary operator runs only. First inspect the selected
+   profile without attempting business work:
+
+   ```bash
+   mammoth auth status --output json --no-input
+   ```
+
+   If the status says the profile or credentials are missing, follow
+   [authentication](auth.md) to log in using a hidden interactive prompt or a
+   protected input file. Never invent a profile, put credentials in chat, or
+   put secrets in argv. After login (or when an existing profile is present),
+   run the connectivity and configuration check and require success:
+
+   ```bash
+   mammoth doctor --profile PROFILE --output json --no-input
+   ```
+
+   Do not print, echo, or copy secret-bearing inputs. A failed status, login,
+   or doctor check stops the task before discovery and business commands. A
+   broker check is the equivalent precondition in evaluated mode; do not add a
+   profile or `--profile` flag to broker-invoked commands.
 4. Discover instead of guessing. Run `mammoth schema list/find/get --output
    json --no-input` for local CLI routes; `mammoth capability list --output
    json --no-input` is an API-binding inventory and can omit typed/local

{mammoth_cli-2.0.4 → mammoth_cli-2.0.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mammoth-cli"
-version = "2.0.4"
+version = "2.0.5"
 description = "Command-line interface for the Mammoth Analytics platform"
 authors = [{name = "Mammoth Analytics", email = "support@mammoth.io"}]
 readme = "README.md"

{mammoth_cli-2.0.4 → mammoth_cli-2.0.5}/spec/manifests/commands/file.yaml

@@ -216,10 +216,10 @@ commands:
   live_exemption_reason: High-impact or external-effect operation without a disposable fixture.
   contract_fixture: null
   required_fixture_guard: null
-  secret_fields: []
+  secret_fields:
+  - password
   human_example: mammoth file set-password FILE_ID --help
-  agent_example: 'mammoth file set-password 123 --input ''{"password": "replace-with-secret"}'' --output
-    json --no-input'
+  agent_example: mammoth file set-password 123 --input /private/path/request.json --output json --no-input
   unit_tests:
   - UT-FILE-SET-PASSWORD
   contract_tests:

{mammoth_cli-2.0.4 → mammoth_cli-2.0.5}/spec/manifests/commands/user.yaml

@@ -96,10 +96,11 @@ commands:
   live_exemption_reason: High-impact or external-effect operation without a disposable fixture.
   contract_fixture: null
   required_fixture_guard: null
-  secret_fields: []
+  secret_fields:
+  - current_password
+  - new_password
   human_example: mammoth user change-password --help
-  agent_example: 'mammoth user change-password --input ''{"current_password": "replace-with-secret", "new_password":
-    "replace-with-secret"}'' --output json --no-input'
+  agent_example: mammoth user change-password --input /private/path/request.json --output json --no-input
   unit_tests:
   - UT-USER-CHANGE-PASSWORD
   contract_tests: