mammoth-cli 2.0.5__tar.gz → 2.0.7__tar.gz

{mammoth_cli-2.0.5 → mammoth_cli-2.0.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mammoth-cli
-Version: 2.0.5
+Version: 2.0.7
 Summary: Command-line interface for the Mammoth Analytics platform
 Project-URL: homepage, https://mammoth.io
 Project-URL: repository, https://github.com/EdgeMetric/mammothsdk
@@ -74,18 +74,19 @@ installation path.
 
 ## First run: authenticate, check, then discover
 
-Authentication is the first operational step. In an evaluated or isolated run
-with a controller-provided credential broker/sidecar, use that broker's
-readiness check; do not inspect saved profiles, run login, or run doctor, and
-stop if the broker is absent. In an ordinary shell, check the selected profile;
+Authentication is the first operational step. Check the selected profile;
 this is a local presence check, not a live access test. If the profile or
-stored credentials are absent, log in before running `doctor` or any data command:
+stored credentials are absent, log in before running `doctor` or any data
+command. An agent does this by asking the operator to run the login below in
+their own terminal; the CLI never reads credentials from environment variables:
 
 ```bash
 mammoth skill list --output json --no-input
 mammoth skill path --output json --no-input
 # Read the installed SKILL.md before operating.
 mammoth auth status --output json --no-input
+# Compare the reported endpoint with the intended target before doctor.
+# Use app for production; use release only when explicitly intended.
 # Human terminal only, if profile or stored credentials are absent:
 mammoth auth login
 # Then verify configuration, credentials, endpoint, and connectivity:
@@ -106,12 +107,13 @@ mammoth auth login --input /private/path/credentials.json --storage file \
   --output json --no-input
 ```
 
-On Windows, use the approved OS keyring or credential broker instead; do not
-use a file fallback unless its ACL hardening is approved, and stop if neither
-is available.
+On Windows, use the approved OS keyring instead; do not use a file fallback
+unless its ACL hardening is approved, and stop if it is not available.
 
 The default server prefix is `app`; pass `--server-prefix release` only when
-the release endpoint is explicitly intended. See
+the release endpoint is explicitly intended. Compare the endpoint reported by
+`auth status` with the intended target before running `doctor`; if it does not
+match, stop and switch to a separate correctly configured profile. See
 [Authentication](https://github.com/EdgeMetric/mammothsdk/blob/main/mammoth-cli/docs/authentication.md)
 for the required JSON fields and profile behavior. After `doctor` succeeds,
 resolve the exact workspace, project, dataset, and view from read results

{mammoth_cli-2.0.5 → mammoth_cli-2.0.7}/README.md

@@ -46,18 +46,19 @@ installation path.
 
 ## First run: authenticate, check, then discover
 
-Authentication is the first operational step. In an evaluated or isolated run
-with a controller-provided credential broker/sidecar, use that broker's
-readiness check; do not inspect saved profiles, run login, or run doctor, and
-stop if the broker is absent. In an ordinary shell, check the selected profile;
+Authentication is the first operational step. Check the selected profile;
 this is a local presence check, not a live access test. If the profile or
-stored credentials are absent, log in before running `doctor` or any data command:
+stored credentials are absent, log in before running `doctor` or any data
+command. An agent does this by asking the operator to run the login below in
+their own terminal; the CLI never reads credentials from environment variables:
 
 ```bash
 mammoth skill list --output json --no-input
 mammoth skill path --output json --no-input
 # Read the installed SKILL.md before operating.
 mammoth auth status --output json --no-input
+# Compare the reported endpoint with the intended target before doctor.
+# Use app for production; use release only when explicitly intended.
 # Human terminal only, if profile or stored credentials are absent:
 mammoth auth login
 # Then verify configuration, credentials, endpoint, and connectivity:
@@ -78,12 +79,13 @@ mammoth auth login --input /private/path/credentials.json --storage file \
   --output json --no-input
 ```
 
-On Windows, use the approved OS keyring or credential broker instead; do not
-use a file fallback unless its ACL hardening is approved, and stop if neither
-is available.
+On Windows, use the approved OS keyring instead; do not use a file fallback
+unless its ACL hardening is approved, and stop if it is not available.
 
 The default server prefix is `app`; pass `--server-prefix release` only when
-the release endpoint is explicitly intended. See
+the release endpoint is explicitly intended. Compare the endpoint reported by
+`auth status` with the intended target before running `doctor`; if it does not
+match, stop and switch to a separate correctly configured profile. See
 [Authentication](https://github.com/EdgeMetric/mammothsdk/blob/main/mammoth-cli/docs/authentication.md)
 for the required JSON fields and profile behavior. After `doctor` succeeds,
 resolve the exact workspace, project, dataset, and view from read results

{mammoth_cli-2.0.5 → mammoth_cli-2.0.7}/mammoth_cli/__init__.py

@@ -6,7 +6,7 @@ not implement a second HTTP client and does not call private SDK members.
 
 from __future__ import annotations
 
-__version__ = "2.0.5"
+__version__ = "2.0.7"
 
 # The versioned machine output envelope contract.
 SCHEMA_VERSION = 1

{mammoth_cli-2.0.5 → mammoth_cli-2.0.7}/mammoth_cli/bundled_skill/mammoth-cli/SKILL.md

@@ -9,17 +9,22 @@ Use this skill for Mammoth shell work, not for Python SDK integration. Complete
 the authentication preflight below before using the installed command contract;
 never guess routes or payloads:
 
-Before any remote read or write, establish authentication. Ordinary operator
-runs check the selected profile with `mammoth auth status --output json --no-input`;
-if the profile is missing or `has_credentials` is false, stop and complete the
-secure login flow in [authentication](references/auth.md). Then run
-`mammoth doctor --profile PROFILE --output json --no-input` and require a
-successful result before discovering resources or operating on them. A failed
-status, login, or doctor check is a precondition failure—not a reason to try
-the business command anyway. In evaluated or isolated runs, skip all saved
-profile checks and login commands: use only the controller-provided credential
-broker/sidecar check, never mount or read a saved profile, and stop if that
-broker is absent.
+Before any remote read or write, establish authentication. For ordinary
+operator runs, determine the intended environment from the task: production
+defaults to the `app` endpoint; use `release` only when explicitly named.
+Check the selected profile with `mammoth auth status --output json --no-input`
+and compare its reported `endpoint` to that target before running doctor. If
+the profile is missing, credentials are absent, or the endpoint does not match,
+stop and follow [authentication](references/auth.md); never silently reuse or
+rewrite a profile from another environment. Then run `mammoth doctor
+--profile PROFILE --output json --no-input` and require success before
+discovering resources or operating on them. A failed status, login, or doctor
+check is a precondition failure—not a reason to try the business command
+anyway. If no matching profile has credentials, the operator must run
+`mammoth auth login` themselves in their own terminal: tell them the exact
+command, wait, then re-check `auth status`. Never ask for the key or secret
+in chat, never read them from environment variables or files you were not
+given, and never run `auth login` on the operator's behalf.
 
 ```bash
 mammoth schema find "TASK OR RESOURCE" --output json --no-input

{mammoth_cli-2.0.5 → mammoth_cli-2.0.7}/mammoth_cli/bundled_skill/mammoth-cli/references/auth.md

@@ -7,15 +7,43 @@ prefix (default `app`, resolving to `https://app.mammoth.io/api/v2`).
 1. Explicit login handed to the current command (secure prompt or `--input`).
 2. The selected or `--profile` profile's saved credentials.
 
+There is no third source. The CLI and SDK do not read credentials from
+environment variables, and an agent must not search the environment, shell
+history, or unrelated files for them.
+
+## How an agent obtains credentials
+
+An agent never receives the key or secret. When `auth status` reports a
+missing profile or `has_credentials=false`, stop and hand the login to the
+human operator:
+
+1. Tell the operator the exact command to run in **their own** terminal, with
+   the profile name and the intended server prefix:
+
+   ```bash
+   mammoth auth login --profile PROFILE --server-prefix app
+   ```
+
+   The command prompts for the key and secret with hidden input, then the
+   workspace id, so no secret enters chat, argv, or history.
+2. Wait for the operator to confirm, then re-run
+   `mammoth auth status --profile PROFILE --output json --no-input` and
+   `mammoth doctor --profile PROFILE --output json --no-input`.
+3. Do not ask the operator to paste the key or secret into chat. Do not run
+   `auth login` yourself, with or without `--input`, unless the operator has
+   explicitly given you a protected `0600` credential file path to use.
+
 The only supported configuration is the API key, API secret, workspace id, and
 an optional one-label server prefix (default `app`). There is no base-url
 override.
 
 ## Cold-start sequence
 
-For an ordinary operator, before any remote command, inspect authentication and
-then verify the connection. These checks are mandatory even when a profile may
-already exist:
+For an ordinary operator, identify the intended environment before any remote
+command. Production means the `app` endpoint by default; use `release` only
+when the task explicitly requests the release environment. Inspect
+authentication and then verify the connection. These checks are mandatory even
+when a profile may already exist:
 
 ```bash
 mammoth auth status --profile PROFILE --output json --no-input
@@ -30,21 +58,21 @@ mammoth auth status --profile PROFILE --output json --no-input
 ```
 
 `auth status` is a local profile/credential-presence check; it does not prove
-that credentials are valid remotely. After the profile is present, verify the
-live connection:
+that credentials are valid remotely. Compare its reported `endpoint` with the
+intended environment before proceeding. A profile for another endpoint is a
+scope mismatch: stop and select or authenticate the explicitly intended
+profile; do not silently reuse, rewrite, or promote it. After the profile is
+present and its endpoint matches, verify the live connection:
 
 ```bash
 mammoth doctor --profile PROFILE --output json --no-input
 ```
 
 Do not continue to schema discovery or business operations after an
-authentication or doctor failure. The `app` server prefix is the default;
-release or other environment credentials do not imply authorization for `app`.
-
-For an evaluated or isolated agent, do not run these profile commands: use the
-controller-provided credential broker/sidecar check instead. Never mount or
-read a saved profile. If no broker is provided, stop before authenticated
-actions.
+authentication or doctor failure. The `app` server prefix is the production
+default; release or other environment credentials do not imply authorization
+for `app`, and a release profile is not appropriate unless the task explicitly
+targets release.
 
 ## Commands
 ```bash
@@ -66,8 +94,8 @@ logs. For headless POSIX work, create the JSON file outside the repository, set
 its permissions to `0600`, and pass only its path. With a protected POSIX file,
 specify `--storage file` explicitly; `--storage auto` can require an available
 OS keyring and is not a reliable headless fallback. On Windows, do not use the
-file backend as a secret store; use the OS keyring, a controller broker, or
-stop and obtain a supported secure store. Remove any input file after the
+file backend as a secret store; use the OS keyring or stop and obtain a
+supported secure store. Remove any input file after the
 profile is stored.
 
 `creds.json` is a `0600` JSON file: `{"api_key": "...", "api_secret": "...",
@@ -77,8 +105,3 @@ also pipe it with `--input - --input-format json`.
 Secrets live in the OS keyring (or an explicitly selected `0600` file
 fallback). They are never printed, logged, or included in any envelope. Never
 pass a secret as a plain argument; use the hidden prompt or `--input`.
-
-For evaluated or isolated agents, authentication remains controller-owned: use
-the provided credential broker/sidecar instead of `auth login` and never mount
-or read a saved profile. If no broker is provided, stop before authenticated
-actions and report the precondition failure.

{mammoth_cli-2.0.5 → mammoth_cli-2.0.7}/mammoth_cli/bundled_skill/mammoth-cli/references/handoff.md

@@ -4,11 +4,10 @@ Use a nonsecret JSON checkpoint when another agent or session must continue.
 This is a record, not a resume subcommand. The receiving agent chooses
 its own plan only after fresh reads.
 
-For evaluated/isolated agents, authentication remains controller-owned: use
-the provided broker/sidecar and never mount or read a saved profile. If that
-broker is absent, stop before authenticated actions. Ordinary operator
-handoffs may reference the authorized profile name, but must not copy its path
-or contents into the checkpoint.
+A handoff may reference the authorized profile name, but must not copy its
+path or contents into the checkpoint. The receiving agent re-checks
+`auth status` and `doctor`; if credentials are missing on its host, the
+operator logs in from their own terminal as described in [auth](auth.md).
 
 ## Required record
 
@@ -49,9 +48,5 @@ mammoth view get VIEW_ID --project PROJECT_ID --output json --no-input
 mammoth job get JOB_ID --output json --no-input
 ```
 
-The commands above are ordinary operator examples; an evaluated/isolated agent
-must use the controller broker/sidecar instead of `--profile` and must stop if
-that broker is absent.
-
 The required fields and receiving procedure above are self-contained for a
 cold-start agent; no repository checkout or unshipped document is required.

{mammoth_cli-2.0.5 → mammoth_cli-2.0.7}/mammoth_cli/bundled_skill/mammoth-cli/references/recipes/auth-scope.md

@@ -3,7 +3,8 @@
 Use `mammoth auth status`, `mammoth doctor`, `mammoth project list`, and
 `mammoth schema get project.list` with `--output json --no-input`. Require
 successful `data` and observed workspace/project metadata. Never put secrets in
-argv; evaluated agents use the controller broker and never mount profiles.
+argv. If credentials are missing, the operator logs in from their own terminal;
+see [auth](../auth.md).
 
 ```bash
 mammoth context project use PROJECT_ID --profile PROFILE --output json --no-input
@@ -13,8 +14,8 @@ The successful envelope should identify the selected profile/workspace/project
 in `data` or `meta`; retain only nonsecret IDs. A deliberately invalid or
 expired profile should return the structured auth error (exit 4), which is a
 stop-and-recover condition, not permission to retry mutations. Never inline
-tokens or secrets in argv, logs, or evidence. Interactive login may receive
-protected credential JSON through stdin or a 0600 input file; evaluated agents
-must use the controller broker and never expose a profile to their shell.
+tokens or secrets in argv, logs, or evidence. Headless login may receive
+protected credential JSON through stdin or a 0600 input file only when the
+operator explicitly supplies that file.
 
 Exit 4 is auth/authorization; preserve the structured error and stop safely.

{mammoth_cli-2.0.5 → mammoth_cli-2.0.7}/mammoth_cli/bundled_skill/mammoth-cli/references/task-start.md

@@ -5,12 +5,6 @@ task and has no repository or prior chat context. The user supplies the intent,
 authorized scope, and (when needed) a protected profile. Never put credentials
 or secrets in an argument, prompt, transcript, or checkpoint.
 
-For an evaluated or isolated agent, follow the controller-provided credential
-broker/sidecar instead of using a saved profile. Never mount or read the saved
-profile in that shell. If the broker/sidecar is not provided, stop before any
-authenticated action. The profile workflow below remains for ordinary,
-non-evaluated operator use.
-
 1. Check whether `mammoth` is available. If it is absent, install the CLI and
    bundled skill with the supported host installer:
 
@@ -27,31 +21,32 @@ non-evaluated operator use.
    install is required for the agent host, run `mammoth skill install
    --output json --no-input` and verify ownership with `mammoth skill list
    --output json --no-input`.
-3. Establish authentication before any remote read or write. In an evaluated
-   or isolated run, do not inspect a saved profile and do not run `auth login`:
-   use the controller-provided credential broker/sidecar check. If it is not
-   provided, stop before authenticated actions. The remaining instructions in
-   this step are for ordinary operator runs only. First inspect the selected
-   profile without attempting business work:
+3. Establish authentication before any remote read or write. Determine the
+   intended environment from the task first: production defaults to the `app` endpoint;
+   use `release` only when the task explicitly names release. Then inspect the
+   selected profile without attempting business work:
 
    ```bash
    mammoth auth status --output json --no-input
    ```
 
-   If the status says the profile or credentials are missing, follow
-   [authentication](auth.md) to log in using a hidden interactive prompt or a
-   protected input file. Never invent a profile, put credentials in chat, or
-   put secrets in argv. After login (or when an existing profile is present),
-   run the connectivity and configuration check and require success:
+   Compare the status response's `endpoint` with the intended environment. If
+   the profile or credentials are missing, or the endpoint is for another
+   environment, stop and follow [authentication](auth.md): tell the operator
+   the exact `mammoth auth login --profile PROFILE --server-prefix app`
+   command to run in their own terminal, wait for them, then re-check status.
+   The CLI does not read credentials from environment variables; do not look
+   for them there. Never silently reuse or rewrite a mismatched profile,
+   invent a profile, ask for credentials in chat, or put secrets in argv.
+   After the operator has logged in (or when an existing, matching profile is
+   present), run the connectivity and configuration check and require success:
 
    ```bash
    mammoth doctor --profile PROFILE --output json --no-input
    ```
 
    Do not print, echo, or copy secret-bearing inputs. A failed status, login,
-   or doctor check stops the task before discovery and business commands. A
-   broker check is the equivalent precondition in evaluated mode; do not add a
-   profile or `--profile` flag to broker-invoked commands.
+   or doctor check stops the task before discovery and business commands.
 4. Discover instead of guessing. Run `mammoth schema list/find/get --output
    json --no-input` for local CLI routes; `mammoth capability list --output
    json --no-input` is an API-binding inventory and can omit typed/local

mammoth_cli-2.0.7/mammoth_cli/commands/doctor.py

@@ -0,0 +1,210 @@
+"""The ``doctor`` command: a read-only environment and connectivity check.
+
+An agent or operator runs ``mammoth doctor`` to confirm, in one deterministic
+envelope, that the CLI can find credentials, resolve an endpoint, and reach the
+Mammoth API. Every check reports a boolean ``ok`` plus a short detail; no secret
+value is ever included. The command never mutates anything and never prompts.
+"""
+
+from __future__ import annotations
+
+import os
+import platform
+import re
+import shlex
+import sys
+from typing import Any
+from urllib.parse import urlsplit
+
+from mammoth_cli import __version__
+from mammoth_cli.context import credentials, profiles
+from mammoth_cli.context.resolver import resolve_auth
+from mammoth_cli.errors.envelope import CliError
+from mammoth_cli.runtime.invocation import Invocation
+from mammoth_cli.runtime.session import open_service, resolved_project
+
+HandlerResult = tuple[Any, dict[str, Any]]
+
+
+def _check(name: str, ok: bool, detail: str) -> dict[str, Any]:
+    return {"name": name, "ok": ok, "detail": detail}
+
+
+def _safe_connection_diagnostics(error: CliError, *, debug: bool) -> dict[str, Any]:
+    """Return the small, allowlisted diagnostic surface exposed by doctor.
+
+    ``CliError.details`` may contain response bodies or backend-specific
+    values because it is also used by the general error envelope.  Doctor is
+    deliberately stricter: it emits only stable transport metadata and never
+    copies exception text or a response body into its result.
+    """
+    raw = error.details if isinstance(error.details, dict) else {}
+    status = raw.get("status_code")
+    if isinstance(status, bool) or not isinstance(status, int):
+        status = None
+    exception_type = raw.get("exception_type")
+    if not isinstance(exception_type, str) or exception_type not in {
+        "ConnectTimeout",
+        "ReadTimeout",
+        "Timeout",
+        "ConnectionError",
+        "ProxyError",
+        "SSLError",
+    }:
+        exception_type = None
+    retry_after = raw.get("retry_after")
+    if isinstance(retry_after, str):
+        if len(retry_after) > 10 or not retry_after.isascii() or not retry_after.isdigit():
+            retry_after = None
+    elif (
+        not isinstance(retry_after, int)
+        or isinstance(retry_after, bool)
+        or retry_after < 0
+    ):
+        retry_after = None
+    request_id = error.request_id or raw.get("request_id")
+    if not isinstance(request_id, str) or len(request_id) > 128 or not re.fullmatch(
+        r"[A-Za-z0-9._:-]+", request_id
+    ):
+        request_id = None
+
+    if status in {429, 503}:
+        reason = f"http_{status}"
+        detail = f"HTTP {status} response; retry the read"
+    elif exception_type in {"ConnectTimeout", "ReadTimeout", "Timeout"}:
+        reason = "transport_timeout"
+        detail = "transport timeout; retry the read"
+    elif exception_type in {"ConnectionError", "ProxyError", "SSLError"}:
+        reason = "transport_connection_error"
+        detail = "transport connection error; retry the read"
+    else:
+        reason = error.code
+        detail = f"connection check failed: {error.code}"
+
+    result: dict[str, Any] = {"error_code": error.code, "reason": reason, "detail": detail}
+    for name, value in (
+        ("status_code", status),
+        ("exception_type", exception_type),
+        ("retry_after", retry_after),
+        ("request_id", request_id),
+    ):
+        if value is not None:
+            result[name] = value
+
+    if debug:
+        method = raw.get("method")
+        if isinstance(method, str) and method.upper() in {"GET", "HEAD", "OPTIONS"}:
+            result["method"] = method.upper()
+        endpoint = raw.get("endpoint")
+        if isinstance(endpoint, str) and len(endpoint) <= 300:
+            parsed = urlsplit(endpoint)
+            if (
+                not parsed.query
+                and not parsed.fragment
+                and not parsed.username
+                and not parsed.password
+            ):
+                result["endpoint"] = parsed.path or endpoint
+        phase = raw.get("phase")
+        if isinstance(phase, str) and phase in {"request", "response", "decode", "authentication"}:
+            result["phase"] = phase
+    return result
+
+
+def doctor(invocation: Invocation) -> HandlerResult:
+    """Run environment and connectivity diagnostics.
+
+    Args:
+        invocation: The current command's resolved global options.
+
+    Returns:
+        ``(data, meta_extra)`` where ``data`` holds the Python/CLI versions, the
+        active profile, and an ordered list of check results with an overall
+        ``ok`` flag.
+    """
+    profile_name = invocation.profile or profiles.get_selected()
+    checks: list[dict[str, Any]] = []
+
+    config_directory = profiles.config_dir()
+    writable_target = config_directory if config_directory.exists() else config_directory.parent
+    config_ok = os.access(writable_target, os.W_OK | os.X_OK)
+    checks.append(
+        _check(
+            "config_directory",
+            config_ok,
+            (
+                f"{config_directory} is writable"
+                if config_ok
+                else f"cannot write configuration below {writable_target}"
+            ),
+        )
+    )
+
+    record = profiles.get_profile(profile_name)
+    checks.append(
+        _check(
+            "profile",
+            record is not None,
+            f"profile '{profile_name}' found" if record else f"no profile '{profile_name}'",
+        )
+    )
+    checks.append(
+        _check(
+            "credentials",
+            credentials.has_credentials(profile_name),
+            "credentials present" if credentials.has_credentials(profile_name) else "none stored",
+        )
+    )
+
+    endpoint_detail = "unresolved"
+    auth_ok = False
+    try:
+        auth = resolve_auth(invocation)
+        endpoint_detail = auth.base_url
+        auth_ok = True
+    except CliError as error:
+        endpoint_detail = error.code
+    checks.append(_check("endpoint", auth_ok, endpoint_detail))
+
+    connection_ok = False
+    connection_detail = "not attempted"
+    if auth_ok:
+        try:
+            with open_service(invocation) as (service, _auth):
+                service.check_connection()
+            connection_ok = True
+            connection_detail = "authenticated request succeeded"
+        except CliError as error:
+            diagnostics = _safe_connection_diagnostics(error, debug=invocation.debug)
+            connection_detail = diagnostics.pop("detail")
+            connection_check = _check("connection", connection_ok, connection_detail)
+            connection_check.update(diagnostics)
+            checks.append(connection_check)
+        else:
+            checks.append(_check("connection", connection_ok, connection_detail))
+    if not auth_ok:
+        checks.append(_check("connection", connection_ok, connection_detail))
+
+    recommendations: list[str] = []
+    if record is None or not credentials.has_credentials(profile_name):
+        login_profile = f" --profile {shlex.quote(profile_name)}" if profile_name else ""
+        recommendations.append(f"mammoth auth login{login_profile}")
+    elif resolved_project(invocation) is None:
+        recommendations.append("mammoth context project use PROJECT_ID")
+    if not connection_ok and auth_ok and not invocation.debug:
+        debug_profile = f" --profile {shlex.quote(profile_name)}" if profile_name else ""
+        recommendations.append(
+            f"mammoth doctor --debug{debug_profile} --output json --no-input"
+        )
+
+    data = {
+        "cli_version": __version__,
+        "python_version": platform.python_version(),
+        "python_executable": sys.executable,
+        "profile": profile_name,
+        "project_id": resolved_project(invocation),
+        "checks": checks,
+        "recommendations": recommendations,
+        "ok": all(c["ok"] for c in checks),
+    }
+    return data, {"profile": profile_name, "project_id": resolved_project(invocation)}

{mammoth_cli-2.0.5 → mammoth_cli-2.0.7}/mammoth_cli/commands/schema.py

@@ -35,6 +35,10 @@ from mammoth_cli.services.positionals import PositionalSpec, resolve_positionals
 from mammoth_cli.services.type_system import is_opaque_mapping, json_schema, sample_value
 
 _OUTPUT_JSON_NO_INPUT = ("--output", "json", "--no-input")
+# A command whose request carries a secret never gets an inline JSON example:
+# the published example points at a protected owner-only file instead, so no
+# generated or copied command line ever puts a credential in argv.
+_PROTECTED_INPUT_PATH = "/private/path/request.json"
 _OPAQUE_EXPERT_COMMANDS = frozenset({"view.task.add", "view.task.preview", "view.task.update"})
 _TYPED_TRANSFORM_ALTERNATIVES = [
     "view.transform.filter",
@@ -565,7 +569,10 @@ def runnable_example(
         # cannot express supplies the missing accepted field here, so the
         # documented example is actually runnable rather than just well-formed.
         document.update(hints)
-        tokens.extend(["--input", json.dumps(document)])
+        if set(record.get("secret_fields") or ()).intersection(document):
+            tokens.extend(["--input", _PROTECTED_INPUT_PATH])
+        else:
+            tokens.extend(["--input", json.dumps(document)])
     tokens.extend(_OUTPUT_JSON_NO_INPUT)
     if record["command_id"] in {"project.user.update", "data-app.share"}:
         # These published high-impact examples must satisfy the same policy

{mammoth_cli-2.0.5 → mammoth_cli-2.0.7}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mammoth-cli"
-version = "2.0.5"
+version = "2.0.7"
 description = "Command-line interface for the Mammoth Analytics platform"
 authors = [{name = "Mammoth Analytics", email = "support@mammoth.io"}]
 readme = "README.md"

{mammoth_cli-2.0.5 → mammoth_cli-2.0.7}/spec/manifests/sdk-methods.yaml

@@ -4386,7 +4386,7 @@ methods:
   reviewed_by: primary
 - sdk_symbol: mammoth.api.jobs.JobsAPI.get_job
   implementation_origin: mammoth.api.jobs.JobsAPI.get_job
-  signature: 'get_job(self, job_id: ''int'', timeout: ''int'' = 300) -> ''dict[str, Any]'''
+  signature: 'get_job(self, job_id: ''int'', timeout: ''float | None'' = None) -> ''dict[str, Any]'''
   openapi_operation_ids: []
   canonical_command: job.get
   alias_of: null
@@ -4398,7 +4398,7 @@ methods:
   reviewed_by: primary
 - sdk_symbol: mammoth.api.jobs.JobsAPI.get_jobs
   implementation_origin: mammoth.api.jobs.JobsAPI.get_jobs
-  signature: 'get_jobs(self, job_ids: ''list[int] | str'') -> ''dict[str, Any]'''
+  signature: 'get_jobs(self, job_ids: ''list[int] | str'', timeout: ''float | None'' = None) -> ''dict[str, Any]'''
   openapi_operation_ids: []
   canonical_command: job.get-many
   alias_of: null