mammoth-cli 2.2.79__tar.gz → 2.2.80__tar.gz

{mammoth_cli-2.2.79 → mammoth_cli-2.2.80}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mammoth-cli
-Version: 2.2.79
+Version: 2.2.80
 Summary: Command-line interface for the Mammoth Analytics platform
 Project-URL: homepage, https://mammoth.io
 Project-URL: repository, https://github.com/EdgeMetric/mammothsdk
@@ -213,8 +213,10 @@ Onboard me first:
    `recommendation`, print exactly this and wait until I say done: "In the
    Mammoth web app open Workspace settings → API Tokens → Create token (no
    project, so I can create projects), copy the token (it starts with mm_ and
-   is shown once), then run in your own terminal: mammoth auth login" —
-   never ask for, read, or pass the token yourself, and never run auth login.
+   is shown once), then run in your own terminal: mammoth auth login". Or run
+   `mammoth auth login --device` yourself, show me the link and code it prints and wait
+   for it to finish — never ask for, read, or pass the token yourself, and never run any
+   other auth login method.
 3. Require `mammoth doctor` to pass, then run `mammoth skill show` and
    follow the guide it prints.
 Work inside `mammoth project ensure 'PROJECT NAME'` unless I name a project;

{mammoth_cli-2.2.79 → mammoth_cli-2.2.80}/README.md

@@ -184,8 +184,10 @@ Onboard me first:
    `recommendation`, print exactly this and wait until I say done: "In the
    Mammoth web app open Workspace settings → API Tokens → Create token (no
    project, so I can create projects), copy the token (it starts with mm_ and
-   is shown once), then run in your own terminal: mammoth auth login" —
-   never ask for, read, or pass the token yourself, and never run auth login.
+   is shown once), then run in your own terminal: mammoth auth login". Or run
+   `mammoth auth login --device` yourself, show me the link and code it prints and wait
+   for it to finish — never ask for, read, or pass the token yourself, and never run any
+   other auth login method.
 3. Require `mammoth doctor` to pass, then run `mammoth skill show` and
    follow the guide it prints.
 Work inside `mammoth project ensure 'PROJECT NAME'` unless I name a project;

{mammoth_cli-2.2.79 → mammoth_cli-2.2.80}/mammoth_cli/__init__.py

@@ -6,7 +6,7 @@ not implement a second HTTP client and does not call private SDK members.
 
 from __future__ import annotations
 
-__version__ = "2.2.79"
+__version__ = "2.2.80"
 
 # The versioned machine output envelope contract.
 SCHEMA_VERSION = 1

{mammoth_cli-2.2.79 → mammoth_cli-2.2.80}/mammoth_cli/app.py

@@ -1307,6 +1307,11 @@ _HELP_NOTES = {
     ),
 }
 
+#: Commands whose ``--input`` fields apply to one path only; the label says which.
+_INPUT_FIELDS_LABEL = {
+    "auth.login": "Input fields (--method token only; --device and --method oauth take none)",
+}
+
 
 def _command_help(command_id: str, record: dict[str, Any] | None) -> str | None:
     """Build a command's user-facing ``--help`` summary.
@@ -1335,7 +1340,8 @@ def _command_help(command_id: str, record: dict[str, Any] | None) -> str | None:
         parts.append(f"Example: {example}")
     fields = _help_input_fields(command_id)
     if fields:
-        parts.append(f"Input fields: {fields}")
+        label = _INPUT_FIELDS_LABEL.get(command_id, "Input fields")
+        parts.append(f"{label}: {fields}")
     return "\n\n".join(parts) or None
 
 

{mammoth_cli-2.2.79 → mammoth_cli-2.2.80}/mammoth_cli/bundled_skill/mammoth-cli/SKILL.md

@@ -32,11 +32,9 @@ mammoth project ensure 'PROJECT NAME'   # active project
 Never proceed if `doctor` fails.
 On a 502, 504 or timeout, `mammoth doctor --input '{"wait": 300}'`
 re-probes that long; continue once it passes. Production is the `app` endpoint; use `release` only
-when named, and check `meta.profile`/`auth status` `endpoint` match. If no profile has credentials, tell the operator to run
-`mammoth auth login` in their own terminal (`--profile NAME` unless
-`default`; [auth](references/auth.md) says where the token comes from) and
-wait; never ask for the token in chat, read one from a file/env var, or run
-`auth login` yourself. If an envelope carries `meta.update_available`, run its `command` first.
+when named, and check `meta.profile`/`auth status` `endpoint` match. If no profile has credentials, run `mammoth auth login --device` (`--profile NAME`), show the user its
+link and code and wait for it to exit ([auth](references/auth.md)). Run no other login
+method, and never ask for the token in chat or read one from a file/env var. If an envelope carries `meta.update_available`, run its `command` first.
 
 Piped stdout is compact JSON with prompts off; if not piped, `export
 MAMMOTH_OUTPUT=json MAMMOTH_NO_INPUT=1` once.

{mammoth_cli-2.2.79 → mammoth_cli-2.2.80}/mammoth_cli/bundled_skill/mammoth-cli/references/auth.md

@@ -19,8 +19,10 @@ created without a project.
 reports `credential: oauth` and `expires_at`. A refresh that fails exits 4 with `login_expired`:
 tell the operator to run `mammoth auth login` again. `--no-browser` prints the URL. `--device` is the sign-in for a
 machine with no browser: it prints a short code and a URL for the operator to approve on another
-device, then polls. Browser and device sign-in are for the operator's own terminal; an agent never
-runs them. A key made with `token create` expires after 30 days: `cli_key_expired` means run
+device, then polls. An agent may run `mammoth auth login --device` (and only that): it prints the
+link and code on stderr, the agent shows both to the user, and the command exits once the user has
+approved on their device. Browser sign-in (`--method oauth`) and token login are for the operator's
+own terminal; an agent never runs them. A key made with `token create` expires after 30 days: `cli_key_expired` means run
 `mammoth auth login` again. `auth logout` also revokes the
 connection on the server, and warns (still clearing local state) if it cannot.
 
@@ -66,9 +68,12 @@ human operator:
 2. Wait for the operator to confirm, then re-run
    `mammoth auth status --profile PROFILE` and
    `mammoth doctor --profile PROFILE`.
-3. Do not ask the operator to paste the token into chat. Do not run
-   `auth login` yourself, with or without `--input`, unless the operator has
-   explicitly given you a protected `0600` credential file path to use.
+3. Do not ask the operator to paste the token into chat. The one login an agent
+   may run itself is `mammoth auth login --device`: it prints a link and a short
+   code on stderr; show both to the operator, wait for the command to exit, then
+   re-run `auth status`. Do not run any other `auth login` (browser, `--method token`,
+   `--input`), unless the operator has explicitly given you a protected `0600`
+   credential file path to use.
 
 The only supported configuration is the API token and an optional one-label server prefix (default `app`). There is no base-url
 override.

{mammoth_cli-2.2.79 → mammoth_cli-2.2.80}/mammoth_cli/commands/auth.py

@@ -38,6 +38,7 @@ from mammoth_cli.runtime import executor
 from mammoth_cli.runtime import options as go
 from mammoth_cli.runtime.input_loader import load_input_document
 from mammoth_cli.runtime.invocation import Invocation
+from mammoth_cli.runtime.token_scope import pinned_project
 from mammoth_cli.services import factory as service_factory
 
 _STORAGE_MODES = ("auto", "keyring", "file")
@@ -360,7 +361,11 @@ def _no_choice(label: str = "choice") -> CliError:
         code="login_input_required",
         message=f"No {label} was entered.",
         exit_status=EXIT_USAGE,
-        hint="Pass --method oauth|device|token, or --input FILE for a non-interactive login.",
+        hint=(
+            "Pass --device (a code approved on another device), --method oauth --no-browser "
+            "(a sign-in URL), or --input FILE for a non-interactive login."
+        ),
+        recovery_commands=["mammoth auth login --device"],
     )
 
 
@@ -501,14 +506,17 @@ def _run_login(
     else:
         raise CliError(
             code="login_input_required",
-            message="Non-interactive login requires --input.",
+            message="Non-interactive login needs --device, --method oauth --no-browser or --input.",
             exit_status=EXIT_USAGE,
             hint=(
                 "Interactive prompting is off because "
                 + "; ".join(blockers)
-                + ". Pass --input FILE|- (with --input-format for stdin), "
+                + ". Pass --device to get a link and code the user approves on any other device, "
+                "or --method oauth --no-browser to get a sign-in URL, "
+                "or --input FILE|- (with --input-format for stdin) with an API token, "
                 "or run in an interactive terminal."
             ),
+            recovery_commands=["mammoth auth login --device"],
         )
 
     resolved_base_url = resolve_base_url(effective_prefix)
@@ -671,6 +679,7 @@ def _run_status(invocation: Invocation, *, check: bool) -> tuple[dict[str, Any],
         try:
             service.check_connection()
             data["connected"] = True
+            data["token_project"] = pinned_project(service)
         finally:
             service.close()
         data["checked"] = True
@@ -695,7 +704,8 @@ def auth_status(
 ) -> None:
     """Report local authentication state for one profile.
 
-    Makes no network call unless `--check` is given.
+    Makes no network call unless `--check` is given. With `--check` it also reports
+    `token_project`: the project id the token is limited to, or null when it is not limited.
     """
     invocation = go.make_invocation(
         "auth.status",

{mammoth_cli-2.2.79 → mammoth_cli-2.2.80}/mammoth_cli/commands/doctor.py

@@ -25,6 +25,8 @@ from mammoth_cli.errors.envelope import CliError
 from mammoth_cli.runtime import embedded, runlog, updates
 from mammoth_cli.runtime.invocation import Invocation
 from mammoth_cli.runtime.session import open_service, resolved_project
+from mammoth_cli.runtime.token_scope import pinned_project
+from mammoth_cli.services.protocol import MammothService
 
 HandlerResult = tuple[Any, dict[str, Any]]
 
@@ -137,6 +139,38 @@ def _visible_projects(service: Any) -> list[dict[str, Any]]:
     return [p for p in service.list_all_projects() if isinstance(p, dict)]
 
 
+def _token_scope(service: MammothService) -> CliError | int | None:
+    """The project the token is limited to, or the error that kept doctor from learning it."""
+    try:
+        return pinned_project(service)
+    except CliError as error:
+        return error
+
+
+def _scope_check(scope: CliError | int | None, selected_project: int | None) -> dict[str, Any]:
+    """Report the project the token is limited to; a limited token must work in that project."""
+    if isinstance(scope, CliError):
+        return {
+            **_check(
+                "token_scope", False, f"could not read the token's project scope: {scope.message}"
+            ),
+            "pinned_project_id": None,
+        }
+    if scope is None:
+        return {
+            **_check("token_scope", True, "token is not limited to a project"),
+            "pinned_project_id": None,
+        }
+    if selected_project not in (None, scope):
+        detail = (
+            f"token is limited to project {scope} but project {selected_project} is selected; "
+            f"use --project {scope}"
+        )
+        return {**_check("token_scope", False, detail), "pinned_project_id": scope}
+    detail = f"token is limited to project {scope}; it cannot create or open other projects"
+    return {**_check("token_scope", True, detail), "pinned_project_id": scope}
+
+
 def _nearest_existing(path: Path) -> Path:
     """Return ``path`` or its closest existing ancestor.
 
@@ -283,6 +317,7 @@ def doctor(invocation: Invocation) -> HandlerResult:
     connection_ok = False
     connection_detail = "not attempted"
     projects: list[dict[str, Any]] | None = None
+    scope: CliError | int | None = None
     wait_seconds = _wait_seconds(invocation)
     if auth_ok:
         started = time.monotonic()
@@ -293,6 +328,7 @@ def doctor(invocation: Invocation) -> HandlerResult:
                     with open_service(invocation) as (service, _auth):
                         service.check_connection()
                         projects = _visible_projects(service)
+                        scope = _token_scope(service)
                     break
                 except CliError as error:
                     # A 502/504 or timeout during an outage: with ``wait``,
@@ -324,6 +360,7 @@ def doctor(invocation: Invocation) -> HandlerResult:
     # access is claimed by nobody here: the first write reports it.
     selected_project = resolved_project(invocation)
     if projects is not None:
+        checks.append(_scope_check(scope, selected_project))
         visible_ids = [p.get("id") for p in projects]
         checks.append(
             {

{mammoth_cli-2.2.79 → mammoth_cli-2.2.80}/mammoth_cli/commands/project.py

@@ -37,6 +37,7 @@ from mammoth_cli.runtime.confirm import (
 )
 from mammoth_cli.runtime.invocation import Invocation
 from mammoth_cli.runtime.session import open_service, resolved_project
+from mammoth_cli.runtime.token_scope import require_unpinned_token
 from mammoth_cli.services import job_outcome
 
 HandlerResult = tuple[Any, dict[str, Any]]
@@ -292,6 +293,7 @@ def project_create(invocation: Invocation) -> HandlerResult:
         if field in document:
             kwargs[field] = document[field]
     with open_service(invocation) as (service, auth):
+        require_unpinned_token(service, "create a project")
         data = service.call(_symbol(invocation), **kwargs)
         _require_project_access(service, data)
     return data, _meta(invocation, auth.workspace_id, resolved_project(invocation))
@@ -404,6 +406,7 @@ def project_ensure(invocation: Invocation) -> HandlerResult:
             }
             data["active"] = _make_active_project(invocation, data["project_id"])
             return data, _meta(invocation, auth.workspace_id, chosen.get("id"))
+        require_unpinned_token(service, f"create the project {name!r}")
         created = service.call(_ENSURE_CREATE_SYMBOL, name=name)
     record = created.get("project", created) if isinstance(created, dict) else {}
     project_id = record.get("id") if isinstance(record, dict) else None

mammoth_cli-2.2.80/mammoth_cli/runtime/token_scope.py

@@ -0,0 +1,52 @@
+"""The project, if any, a credential is pinned to.
+
+A token created for one project is refused (HTTP 403 ``authorization_required``)
+in every other project. The server says which project that is in
+``GET /workspaces/current`` (field ``project``); this module reads it so a
+command can refuse before it creates something the token cannot open.
+"""
+
+from __future__ import annotations
+
+from mammoth_cli.errors.envelope import CODE_AUTHORIZATION_REQUIRED, EXIT_AUTH, CliError
+from mammoth_cli.services.protocol import MammothService
+
+_CURRENT_SYMBOL = "mammoth.api.workspace.WorkspaceAPI.current"
+
+
+def pinned_project(service: MammothService) -> int | None:
+    """The project id this credential is limited to, or None when it is not limited."""
+    current = service.call(_CURRENT_SYMBOL)
+    project = current.get("project") if isinstance(current, dict) else current.project
+    return project if isinstance(project, int) and project > 0 else None
+
+
+def require_unpinned_token(service: MammothService, action: str) -> None:
+    """Refuse ``action`` when the server says the token is limited to one project."""
+    refuse_pinned_project(pinned_project(service), action)
+
+
+def refuse_pinned_project(project_id: int | None, action: str) -> None:
+    """Refuse ``action`` for a token limited to ``project_id``; None means not limited.
+
+    Raises:
+        CliError: ``authorization_required`` naming the project the token is
+            limited to, before anything is created.
+    """
+    if project_id is None:
+        return
+    raise CliError(
+        code=CODE_AUTHORIZATION_REQUIRED,
+        message=(
+            f"This token is limited to project {project_id}, so it cannot {action}: "
+            "a project it creates would be closed to it."
+        ),
+        exit_status=EXIT_AUTH,
+        hint=(
+            f"Work in project {project_id} (pass --project {project_id}), or ask the operator "
+            "for a token created without a project."
+        ),
+        details={"pinned_project_id": project_id},
+        authorization_required=True,
+        recovery_commands=[f"mammoth project get {project_id}"],
+    )

{mammoth_cli-2.2.79 → mammoth_cli-2.2.80}/mammoth_cli/services/dashboard_review.py

@@ -37,6 +37,7 @@ _MONEY = re.compile(
     r"price|amount|revenue|sales|cost|spend|fee|income|profit|margin|total|value|gmv|arr|mrr",
     re.IGNORECASE,
 )
+_REVENUE = re.compile(r"revenue|sales|amount|gmv|income|total", re.IGNORECASE)
 _UNIT = re.compile(r"price|rate|unit|per[_ ]", re.IGNORECASE)
 _QUANTITY = re.compile(r"^(qty|quantity|units?|count|volume|pieces|items?)\b", re.IGNORECASE)
 _RATE_TITLE = re.compile(r"\brate\b|%|on[- ]time|share of", re.IGNORECASE)
@@ -237,18 +238,23 @@ def review(
             warnings.append(record)
     summed = sorted({name for name, agg in aggs if name in unit_prices and agg == "sum"})
     if summed:
+        revenue = next((name for name in money if _REVENUE.search(name)), None)
         record = {
             "issue": "unit_price_summed",
             "detail": (
                 f"A chart sums the unit price {summed[0]}; that total means nothing. "
                 + (
-                    f"Chart the sum of revenue = {quantities[0]} * {summed[0]} instead."
-                    if quantities
-                    else "Use avg, or chart revenue instead."
+                    f"The view already has {revenue}: chart the sum of {revenue} instead."
+                    if revenue
+                    else (
+                        f"Chart the sum of revenue = {quantities[0]} * {summed[0]} instead."
+                        if quantities
+                        else "Use avg, or chart revenue instead."
+                    )
                 )
             ),
         }
-        if quantities:
+        if quantities and not revenue:
             record["fix"] = _math_fix(view_ref, dataset_id, quantities[0], summed[0])
         warnings.append(record)
     shown = measures | dims

{mammoth_cli-2.2.79 → mammoth_cli-2.2.80}/mammoth_cli/skills/steering.py

@@ -31,9 +31,10 @@ transform --help`). Before the first Mammoth command in a session run
 `mammoth doctor` (it must pass), then `mammoth skill show` and follow that
 guide. If `mammoth` is missing, install it with `pip install mammoth-cli`
 (or `uv tool install mammoth-cli`, then `uv tool update-shell` so it is on
-PATH). If `mammoth auth status` shows no credentials, tell the operator the
-exact `mammoth auth login` command to run in their own terminal
-and wait; never ask for, read, or pass a key or secret.
+PATH). If `mammoth auth status` shows no credentials, run
+`mammoth auth login --device`, show the user the link and code it prints, and wait
+for it to finish; never run any other login method, and never ask for, read, or
+pass a key or secret.
 Piped output is compact JSON. Take ids only from reads; run `mammoth schema get
 COMMAND_ID` before a command you have not used (`schema get A,B,C` reads
 several in one call); destructive commands need

{mammoth_cli-2.2.79 → mammoth_cli-2.2.80}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mammoth-cli"
-version = "2.2.79"
+version = "2.2.80"
 description = "Command-line interface for the Mammoth Analytics platform"
 authors = [{name = "Mammoth Analytics", email = "support@mammoth.io"}]
 readme = "README.md"