mammoth-cli 2.0.8__tar.gz → 2.0.10__tar.gz

{mammoth_cli-2.0.8 → mammoth_cli-2.0.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mammoth-cli
-Version: 2.0.8
+Version: 2.0.10
 Summary: Command-line interface for the Mammoth Analytics platform
 Project-URL: homepage, https://mammoth.io
 Project-URL: repository, https://github.com/EdgeMetric/mammothsdk

{mammoth_cli-2.0.8 → mammoth_cli-2.0.10}/mammoth_cli/__init__.py

@@ -6,7 +6,7 @@ not implement a second HTTP client and does not call private SDK members.
 
 from __future__ import annotations
 
-__version__ = "2.0.8"
+__version__ = "2.0.10"
 
 # The versioned machine output envelope contract.
 SCHEMA_VERSION = 1

{mammoth_cli-2.0.8 → mammoth_cli-2.0.10}/mammoth_cli/bundled_skill/mammoth-cli/references/auth.md

@@ -17,15 +17,19 @@ An agent never receives the key or secret. When `auth status` reports a
 missing profile or `has_credentials=false`, stop and hand the login to the
 human operator:
 
-1. Tell the operator the exact command to run in **their own** terminal, with
-   the profile name and the intended server prefix:
+1. Tell the operator the exact command to run in **their own** terminal. For
+   production it is just:
 
    ```bash
-   mammoth auth login --profile PROFILE --server-prefix app
+   mammoth auth login
    ```
 
-   The command prompts for the key and secret with hidden input, then the
-   workspace id, so no secret enters chat, argv, or history.
+   Add `--server-prefix release` only when the task names the release
+   environment, and `--profile NAME` only when the operator wants a profile
+   other than `default`. The command prompts for the key and secret with
+   hidden input, then the workspace id, so no secret enters chat, argv, or
+   history. Credentials are per environment: a release key never
+   authenticates on `app`.
 2. Wait for the operator to confirm, then re-run
    `mammoth auth status --profile PROFILE --output json --no-input` and
    `mammoth doctor --profile PROFILE --output json --no-input`.
@@ -53,8 +57,8 @@ If status reports a missing profile or `has_credentials=false`, run the secure
 login flow, then check status again:
 
 ```bash
-mammoth auth login --profile PROFILE --server-prefix app
-mammoth auth status --profile PROFILE --output json --no-input
+mammoth auth login                       # production; add --profile NAME if not 'default'
+mammoth auth status --output json --no-input
 ```
 
 `auth status` is a local profile/credential-presence check; it does not prove
@@ -76,7 +80,8 @@ targets release.
 
 ## Commands
 ```bash
-mammoth auth login --profile PROFILE --server-prefix app  # hidden prompts
+mammoth auth login                                        # hidden prompts; production
+mammoth auth login --server-prefix release                # release environment
 mammoth auth login --profile PROFILE --input creds.json --storage file --output json --no-input
 mammoth auth status --profile PROFILE --output json --no-input
 mammoth auth logout --profile default --output json --no-input --yes

{mammoth_cli-2.0.8 → mammoth_cli-2.0.10}/mammoth_cli/bundled_skill/mammoth-cli/references/task-start.md

@@ -33,8 +33,8 @@ or secrets in an argument, prompt, transcript, or checkpoint.
    Compare the status response's `endpoint` with the intended environment. If
    the profile or credentials are missing, or the endpoint is for another
    environment, stop and follow [authentication](auth.md): tell the operator
-   the exact `mammoth auth login --profile PROFILE --server-prefix app`
-   command to run in their own terminal, wait for them, then re-check status.
+   to run `mammoth auth login` (production; `--server-prefix release` for
+   release) in their own terminal, wait for them, then re-check status.
    The CLI does not read credentials from environment variables; do not look
    for them there. Never silently reuse or rewrite a mismatched profile,
    invent a profile, ask for credentials in chat, or put secrets in argv.

{mammoth_cli-2.0.8 → mammoth_cli-2.0.10}/mammoth_cli/commands/auth.py

@@ -27,6 +27,7 @@ from mammoth_cli.context.resolver import (
 )
 from mammoth_cli.contracts.auth import LoginRequest
 from mammoth_cli.errors.envelope import (
+    CODE_AUTHENTICATION_FAILED,
     CODE_CONFIRMATION_DECLINED,
     CODE_CONFIRMATION_REQUIRED,
     CODE_INVALID_WORKSPACE_ID,
@@ -135,6 +136,34 @@ def _validate_login_document(document: dict[str, Any]) -> LoginRequest:
         ) from exc
 
 
+def _masked_receipt(value: str) -> str:
+    """Describe a secret without revealing it: its length and last four characters."""
+    if len(value) <= 4:
+        return f"{len(value)} characters"
+    return f"{len(value)} characters, ending in …{value[-4:]}"
+
+
+def _prompt_secret(label: str) -> str:
+    """Prompt for one secret with hidden input, then confirm what was captured.
+
+    A hidden prompt shows nothing while typing, so a paste that silently
+    carried a newline or trailing space, or an empty return, used to surface
+    only later as an opaque 401. Surrounding whitespace is stripped, an empty
+    entry is rejected here, and a masked receipt (length and last four
+    characters, never the value) is printed to stderr as feedback.
+    """
+    value = typer.prompt(label, hide_input=True).strip()
+    if not value:
+        raise CliError(
+            code="login_input_required",
+            message=f"The {label} was empty.",
+            exit_status=EXIT_USAGE,
+            hint=f"Paste the {label} at the hidden prompt; nothing is echoed while you type.",
+        )
+    typer.echo(f"  {label}: {_masked_receipt(value)}", err=True)
+    return str(value)
+
+
 def _prompt_blockers(invocation: Invocation) -> list[str]:
     """Reasons this invocation cannot interactively prompt, in report order.
 
@@ -190,8 +219,8 @@ def _run_login(
         # Two flows, nothing else: a terminal prompts for everything (key,
         # secret, then workspace id), and non-interactive uses --input. The
         # workspace is asked last, after the credentials.
-        api_key = typer.prompt("API key", hide_input=True)
-        api_secret = typer.prompt("API secret", hide_input=True)
+        api_key = _prompt_secret("API key")
+        api_secret = _prompt_secret("API secret")
         effective_workspace = typer.prompt("Workspace id", type=int)
         effective_prefix = server_prefix
     else:
@@ -231,6 +260,32 @@ def _run_login(
     service = service_factory.build_service(resolved_auth, timeout=invocation.timeout)
     try:
         service.check_connection()
+    except CliError as exc:
+        if exc.code == CODE_AUTHENTICATION_FAILED:
+            # Say exactly what was tried, without the secret: the endpoint,
+            # the workspace, and a masked receipt of the key. Credentials are
+            # per environment, and a release key typed at a production login
+            # is the common cause of an otherwise opaque 401.
+            exc.details = {
+                **exc.details,
+                "endpoint_base_url": resolved_base_url,
+                "workspace_id": effective_workspace,
+                # Receipts only (length and last four characters). The output
+                # layer redacts any key that looks like a credential, so these
+                # are named for what they are: descriptions, not values.
+                "credential_receipt": {
+                    "key": _masked_receipt(api_key),
+                    "second_value_length": len(api_secret),
+                },
+            }
+            exc.hint = (
+                f"{resolved_base_url} rejected this key/secret for workspace "
+                f"{effective_workspace}. Credentials are per environment: a key issued on "
+                "one Mammoth server does not authenticate on another. Check the key, the "
+                "secret, the workspace id, and that --server-prefix matches where the key "
+                "was issued."
+            )
+        raise
     finally:
         service.close()
 
@@ -243,7 +298,10 @@ def _run_login(
         server_prefix=effective_prefix,
         project_id=existing.project_id if existing is not None else None,
     )
-    profiles.save_profile(record)
+    # Persist the record and the selection pointer in one write, before the
+    # secret goes to its store: a stored secret with no readable record is the
+    # "credentials present / no profile" state that strands a later doctor run.
+    profiles.save_profile(record, select=True)
     storage_used = credentials.store_credentials(
         profile_name,
         api_key,
@@ -251,7 +309,6 @@ def _run_login(
         storage=cast(credentials.StorageMode, storage),
         interactive=not blockers,
     )
-    profiles.set_selected(profile_name)
 
     data = {
         "profile": profile_name,

{mammoth_cli-2.0.8 → mammoth_cli-2.0.10}/mammoth_cli/context/profiles.py

@@ -237,15 +237,22 @@ def get_profile(name: str) -> ProfileRecord | None:
     return _parse_profile(name, table[name])
 
 
-def save_profile(record: ProfileRecord) -> None:
+def save_profile(record: ProfileRecord, *, select: bool = False) -> None:
     """Create or replace one profile's non-secret record.
 
     Args:
         record: The complete profile record to store. Replaces any existing
             record with the same name.
+        select: Also make this profile the selected one, in the same write.
+            Login uses this so the record and the selection pointer can never
+            be persisted separately: a pointer to a profile whose record is
+            missing is exactly the state ``doctor`` reports as
+            ``no profile``.
 
     Raises:
         CliError: ``invalid_profile_name`` for a malformed name.
+        CliError: ``profile_write_failed`` if the record cannot be read back
+            from the file just written.
     """
     validate_profile_name(record.name)
     document = _load_document()
@@ -260,7 +267,18 @@ def save_profile(record: ProfileRecord) -> None:
     if record.project_id is not None:
         entry["project_id"] = record.project_id
     table[record.name] = entry
+    if select:
+        document["selected"] = record.name
     _write_document(document)
+    stored = get_profile(record.name)
+    if stored is None or stored.workspace_id != record.workspace_id:
+        raise CliError(
+            code="profile_write_failed",
+            message=f"Profile '{record.name}' was not persisted to {profiles_path()}.",
+            exit_status=EXIT_USAGE,
+            hint="Check that no other process rewrites the configuration directory, then retry.",
+            details={"path": str(profiles_path())},
+        )
 
 
 def delete_profile(name: str) -> bool:
@@ -313,6 +331,14 @@ def set_selected(name: str) -> None:
     """
     validate_profile_name(name)
     document = _load_document()
+    table = document.get("profiles")
+    if table is None or name not in table:
+        raise CliError(
+            code="profile_not_found",
+            message=f"Profile '{name}' has no stored record, so it cannot be selected.",
+            exit_status=EXIT_USAGE,
+            hint=f"Run 'mammoth auth login --profile {name}' to create it first.",
+        )
     document["selected"] = name
     _write_document(document)
 

{mammoth_cli-2.0.8 → mammoth_cli-2.0.10}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mammoth-cli"
-version = "2.0.8"
+version = "2.0.10"
 description = "Command-line interface for the Mammoth Analytics platform"
 authors = [{name = "Mammoth Analytics", email = "support@mammoth.io"}]
 readme = "README.md"