mcpgawk 0.1.59__tar.gz → 0.1.60__tar.gz

{mcpgawk-0.1.59 → mcpgawk-0.1.60}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mcpgawk
-Version: 0.1.59
+Version: 0.1.60
 Summary: One gateway in front of every MCP server your agents can reach — every call checked against a baseline you approved. Local-first: nothing leaves your machine.
 Project-URL: Homepage, https://mcp.gawk.dev
 Project-URL: Documentation, https://mcp.gawk.dev/docs

{mcpgawk-0.1.59 → mcpgawk-0.1.60}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "mcpgawk"
-version = "0.1.59"
+version = "0.1.60"
 description = "One gateway in front of every MCP server your agents can reach — every call checked against a baseline you approved. Local-first: nothing leaves your machine."
 readme = "README.md"
 requires-python = ">=3.10"

{mcpgawk-0.1.59 → mcpgawk-0.1.60}/src/mcpgawk/cli.py

@@ -65,7 +65,13 @@ def _headers(pairs: list[str] | None) -> dict[str, str]:
     return out
 
 
-class _NoMatchingServers(Exception):
+class _StopRun(Exception):
+    """`_run` stopped on a usage problem it has already explained on stderr. Raised, never returned:
+    `_run`'s contract is a 3-tuple its caller unpacks, and an int there crashed the CLI (--only in
+    2026-08, --oauth-client-secret-env until 2026-09-25, found by mypy). The caller exits 2."""
+
+
+class _NoMatchingServers(_StopRun):
     """`--only` named nothing that exists. Carries no message: `_run` has already told the user
     what it looked for and what was there. Exists so that outcome can leave `_run` without
     violating its 3-tuple return contract."""
@@ -210,7 +216,7 @@ async def _run(args) -> tuple[list[ServerSnapshot], dict[str, dict], list[tuple[
                     print(f"mcpgawk scan: --oauth-client-secret-env "
                           f"{args.oauth_client_secret_env} is not set in the environment",
                           file=sys.stderr)
-                    return 2
+                    raise _StopRun
                 _ruri = store_preregistered_client(
                     url, args.oauth_client_id, _secret,
                     getattr(args, "oauth_redirect_uri", None))
@@ -1123,9 +1129,9 @@ def _changes(args) -> int:
           f" across {len({f['key'] for f in found})} server"
           f"{'s' if len({f['key'] for f in found}) != 1 else ''}:")
     for f in found:
-        at = str(f["curr"].get("measured_at") or "?")[:16].replace("T", " ")
+        when = str(f["curr"].get("measured_at") or "?")[:16].replace("T", " ")
         before = str(f["prev"].get("measured_at") or "?")[:16].replace("T", " ")
-        head = f"\n    ⟳ {at}  {f['name']} changed  (previous snapshot {before}):"
+        head = f"\n    ⟳ {when}  {f['name']} changed  (previous snapshot {before}):"
         # Each tools-only block already carries its own "(prompts/resources were not
         # fingerprinted in the earlier snapshot)" line from `render`; the footer is for the
         # no-change path, where there is no block to carry it.
@@ -2099,8 +2105,8 @@ def _dispatch(argv: list[str] | None = None) -> int:
     # the nothing-found message and default-deny consent before launching any discovered stdio server.
     try:
         snaps, entries, skipped = asyncio.run(_run(args))
-    except _NoMatchingServers:
-        return 2        # a typo at --only, already explained on stderr; not a tool failure
+    except _StopRun:
+        return 2        # a usage problem (--only typo, unset secret env), already explained on stderr
     measurements = [measure(sn) for sn in snaps]
     # Cross-server signals need all snapshots together; merge into each involved server's signals.
     # Two DISTINCT techniques, both requiring the whole inventory:

{mcpgawk-0.1.59 → mcpgawk-0.1.60}/src/mcpgawk/guard_hook.py

@@ -506,6 +506,7 @@ def _deny(fmt: str, reason: str, human: str | None = None) -> dict:
     getting this right per agent is a security property, not formatting."""
     text = f"[mcpgawk guard] {reason}"
     mod = _load_sibling("agents")
+    payload: dict
     if mod is None:
         payload = {"hookSpecificOutput": {"hookEventName": "PreToolUse",
                                           "permissionDecision": "deny",

{mcpgawk-0.1.59 → mcpgawk-0.1.60}/src/mcpgawk/oauth_login.py

@@ -114,7 +114,7 @@ def _fit_auth_method_to_server(provider: OAuthClientProvider) -> OAuthClientProv
                     break
         return original(data, headers)
 
-    ctx.prepare_token_auth = prepare
+    ctx.prepare_token_auth = prepare  # type: ignore[method-assign]  # deliberate SDK wrap
     return provider
 
 
@@ -169,9 +169,10 @@ def lock_refreshes(provider: OAuthClientProvider, server_url: str) -> OAuthClien
         finally:
             _release()
 
-    provider._refresh_token = refresh_token
-    provider._handle_refresh_response = handle_refresh_response
-    provider._mcpgawk_refresh_lock = True
+    # Deliberate wraps of the SDK's refresh path (one refresh at a time, per server, across processes).
+    provider._refresh_token = refresh_token  # type: ignore[method-assign]
+    provider._handle_refresh_response = handle_refresh_response  # type: ignore[method-assign]
+    provider._mcpgawk_refresh_lock = True  # type: ignore[attr-defined]  # our marker on the SDK object
     return provider
 
 
@@ -529,7 +530,7 @@ def refresh_only_provider(server_url: str) -> Optional[OAuthClientProvider]:
         return None
     client_metadata = OAuthClientMetadata(
         redirect_uris=[AnyUrl("http://127.0.0.1:1/callback")],   # never used: no browser flow
-        token_endpoint_auth_method=("none" if not doc.get("preregistered")
+        token_endpoint_auth_method=("none" if not doc.get("preregistered")  # type: ignore[arg-type]
                                     else str(((doc.get("client_info") or {})
                                               .get("token_endpoint_auth_method")) or "none")),
         grant_types=["authorization_code", "refresh_token"],
@@ -560,6 +561,8 @@ def refresh_only_provider(server_url: str) -> Optional[OAuthClientProvider]:
               else 1.0)
 
     class _KnowsExpiry(OAuthClientProvider):
+        known_expiry: float | None = None
+
         async def _initialize(self) -> None:
             await super()._initialize()
             self.context.token_expiry_time = expiry
@@ -589,7 +592,7 @@ def build_login_provider(server_url: str, scope: str = "") -> tuple[OAuthClientP
             # RFC 9207 `iss`. Dropping it failed Linear, Sentry and Globalping (2026-09-24): they
             # advertise it, so the SDK refuses a redirect without it. None when absent, NEVER "":
             # the SDK reads any non-None value as present-and-must-match.
-            captured["iss"] = (qs.get("iss") or [None])[0]
+            captured["iss"] = qs["iss"][0] if qs.get("iss") else None
             captured["error"] = " — ".join(v[0] for k in ("error", "error_description")
                                            if (v := qs.get(k))) or None
             body = (b"<html><body style='font:16px system-ui;padding:3rem'>"
@@ -653,11 +656,12 @@ def build_login_provider(server_url: str, scope: str = "") -> tuple[OAuthClientP
             # a CIMD server will refuse it, which the flow reports rather than hides.
             server = HTTPServer(("127.0.0.1", 0), _Handler)
         redirect_uri = f"http://127.0.0.1:{server.server_port}/callback"
+    assert server is not None   # both branches above bind a server or raise
     threading.Thread(target=server.serve_forever, daemon=True).start()
 
     client_metadata = OAuthClientMetadata(
         redirect_uris=[AnyUrl(redirect_uri)],
-        token_endpoint_auth_method=(_pre.token_endpoint_auth_method
+        token_endpoint_auth_method=(_pre.token_endpoint_auth_method  # type: ignore[arg-type]
                                     if _pre is not None else "none"),  # public client + PKCE
         grant_types=["authorization_code", "refresh_token"],
         response_types=["code"],

{mcpgawk-0.1.59 → mcpgawk-0.1.60}/src/mcpgawk/observed.py

@@ -97,7 +97,8 @@ def observe(store: dict[str, Any], key: str, spool_path: str | None = None) -> O
     rec_server = servers.get(key) or {}
     hist = [r for r in (rec_server.get("history") or []) if isinstance(r, dict)]
     latest = hist[-1] if hist else {}
-    tools = latest.get("tools") if isinstance(latest.get("tools"), dict) else {}
+    _tools = latest.get("tools")
+    tools = _tools if isinstance(_tools, dict) else {}
     transport = latest.get("transport") or "stdio"
     measured_at = latest.get("measured_at")
 

{mcpgawk-0.1.59 → mcpgawk-0.1.60}/src/mcpgawk/panel.py

@@ -39,6 +39,14 @@ TABS = ("fleet", "runtime", "evidence", "decisions")
 
 
 
+
+def _dict_at(d: Any, key: str, default: dict[str, Any] | None = None) -> dict[str, Any]:
+    """`d[key]` when it is a dict, else a FRESH default (`{}` unless given). Reads the key once — the
+    inline `d.get(k) if isinstance(d.get(k), dict) else {}` it replaces was correct at runtime but
+    left the type checker unable to see the narrowing (26 mypy errors in this file, 2026-09-25)."""
+    v = d.get(key) if isinstance(d, dict) else None
+    return v if isinstance(v, dict) else ({} if default is None else default)
+
 def _run_kind(r) -> str:
     """runlog.display_kind, imported lazily like every other runlog use in this module (D18)."""
     from . import runlog as _runlog_mod
@@ -249,7 +257,7 @@ def collect() -> dict[str, Any]:
                     # rows of "?" against the founder's real file. `candidate` is kept only as a
                     # fallback so an older report still parses.
                     cand = f.get("candidate") or {}
-                    ev = f.get("evidence") if isinstance(f.get("evidence"), dict) else {}
+                    ev = _dict_at(f, "evidence")
                     where = [str(x) for x in (ev.get("egress") or ev.get("hosts") or [])][:4]
                     _hosts = [str(x) for x in ((f.get("evidence") or {}).get("egress")
                                                or (f.get("evidence") or {}).get("hosts") or [])]
@@ -294,7 +302,7 @@ def collect() -> dict[str, Any]:
         # never runs, so the common case costs one read rather than one read per server.
         _wrapped_names = {str(r.get("server")) for r in spool.read(limit=100000)
                           if r.get("adapter") == "wrap" and r.get("server")}
-        _store_w = data.get("store") if isinstance(data.get("store"), dict) else {"servers": {}}
+        _store_w = _dict_at(data, "store", {"servers": {}})
         for _k in (_store_w.get("servers") or {}) if _wrapped_names else ():
             try:
                 _names_k = {str(_k), history.display_name(_store_w, str(_k))} | {
@@ -330,7 +338,7 @@ def collect() -> dict[str, Any]:
     # 2026-09-07 the dashboard read only the engine's `suppressed` flag and /next read only the
     # store: a mute from /next left the Findings tab unchanged.
     try:
-        _st = data.get("store") if isinstance(data.get("store"), dict) else {"servers": {}}
+        _st = _dict_at(data, "store", {"servers": {}})
         for _rec in data["findings"]:
             _rec["muted"] = finding_id(_rec) in history.muted(
                 _st, history.resolve(_st, str(_rec.get("server") or "")))
@@ -383,7 +391,7 @@ def _agent_rows(d: dict[str, Any]) -> list[tuple[str, str, str, int, str]]:
                 #
                 # The counts are MACHINE-WIDE — the spool records no per-client breakdown — so the
                 # wording says "on this machine" rather than implying it measured this agent.
-                act = d.get("activity") if isinstance(d.get("activity"), dict) else {}
+                act = _dict_at(d, "activity")
                 seen = act.get("calls") or 0
                 checked, deferred = act.get("checked"), act.get("deferred") or 0
                 if checked is None:
@@ -521,7 +529,7 @@ def policy_rows(d: dict[str, Any]) -> list[tuple[str, str, str, str]]:
     asserted: a control that is off says off, and no row is ever a percentage.
     """
     from . import history as _h
-    store = d.get("store") if isinstance(d.get("store"), dict) else {"servers": {}}
+    store = _dict_at(d, "store", {"servers": {}})
     agents = _agent_rows(d)
     covered = sum(1 for _k, _l, st, _n, _det in agents if st == "on")
     pending = len(d.get("pending") or [])
@@ -565,7 +573,7 @@ def policy_rows(d: dict[str, Any]) -> list[tuple[str, str, str, str]]:
                  f"{_local_stamp(d.get('verify_at')) if d.get('verify_at') else 'never'}",
                  "warn" if pending else "ok"))
     # 5
-    act = d.get("activity") if isinstance(d.get("activity"), dict) else {}
+    act = _dict_at(d, "activity")
     calls = act.get("calls") or 0
     audit = bool(gw.get("audit_present"))
     rows.append(("Audit everything",
@@ -1023,11 +1031,9 @@ _TW = {"agent_w": 272, "srv_w": 300, "tool_w": 260, "call_w": 320, "h": 46,
        "pitch": 54, "gap": 44, "pad": 10}
 
 
-def _clip(text: str, n: int) -> str:
-    """SVG text does not wrap. A label that overruns its box would draw straight across the
-    connectors, so it is cut here rather than left to overlap the drawing."""
-    text = str(text)
-    return text if len(text) <= n else text[: n - 1] + "\u2026"
+# `_clip` (defined further down) also bounds the SVG labels here: SVG text does not wrap, so a label
+# that overruns its box would draw across the connectors. A second, character-cut `_clip` used to sit
+# here; the later definition replaced it at import, so it never ran (mypy no-redef, 2026-09-25).
 
 
 def _wrap(text: str, width: int, lines: int) -> list[str]:
@@ -2221,7 +2227,8 @@ def _api_store(store: dict, d: dict | None = None) -> dict:
         if not isinstance(se, dict):
             continue
         approved = se.get("approved") if isinstance(se.get("approved"), dict) else None
-        hist = se.get("history") if isinstance(se.get("history"), list) else []
+        _hist = se.get("history")
+        hist = _hist if isinstance(_hist, list) else []
         last = hist[-1] if hist and isinstance(hist[-1], dict) else None
         def _surface(rec):
             if not rec:
@@ -2534,7 +2541,7 @@ def render(d: dict[str, Any], token: str = "", action: dict | None = None,
 
     sel_active = bool(sel) and any(n == sel for n, _, _, _ in classified)
     drawer = ""
-    srows = []
+    srows: list[str] = []
     #: Baseline-only servers render grouped under ONE band that states their shared fact once,
     #: instead of repeating it in every row's cells (panel UX pass, 24 Aug).
     bo_rows: list[str] = []
@@ -5531,6 +5538,7 @@ def session_log_lines(limit: int = 30) -> list[dict[str, str]]:
         # report" (public suite, 2026-09-09). The alerts do not need this rule; only the per-server
         # line does. So an absent engine costs exactly the classification it can no longer make,
         # and nothing else.
+        never_succeeded: Any = None   # the paid engine's rule, or None on the free build
         try:
             from gawk_platform.monitor.status import never_succeeded
         except Exception:  # noqa: BLE001 — free build: no paid engine, so no tally to read
@@ -6660,7 +6668,7 @@ def run_pin(name: str | None) -> dict[str, Any]:
     rows, changed, failed = [], 0, []
     for path in paths:
         edit = configedit.plan_pin(path, name, spec, pinned)
-        res = configedit.apply_pin(edit) if edit.ok else {"ok": False, "changed": 0,
+        res: dict[str, Any] = configedit.apply_pin(edit) if edit.ok else {"ok": False, "changed": 0,
                                                           "message": edit.reason}
         # the banner's row shape is server/outcome/detail/level — anything else renders blank
         rows.append({"server": str(path).replace(str(Path.home()), "~"),
@@ -7491,7 +7499,7 @@ def signin_asks(entries: dict) -> list[str]:
 
 #: (identity, store) for the LAST store read by `_store_for_buttons`. Not a TTL cache: the key is
 #: the file's own identity, so a write invalidates it immediately and a stale render is impossible.
-_STORE_MEMO: tuple[tuple[str, int, int, int], dict[str, Any]] | None = None
+_STORE_MEMO: tuple[tuple[str, int, int, int, Any], dict[str, Any]] | None = None
 
 
 def _store_for_buttons() -> dict[str, Any]:
@@ -7778,8 +7786,8 @@ def fleet_verify_targets() -> tuple[dict[str, dict[str, Any]], dict[str, dict[st
         except Exception:  # noqa: BLE001 — no readable config = no through-gateway routing
             _gw_backends = set()
 
-    local = {}
-    gatewayed = {}
+    local: dict[str, dict[str, Any]] = {}
+    gatewayed: dict[str, dict[str, Any]] = {}
     for n, e in entries.items():
         if not (isinstance(e, dict) and e.get("command")):
             continue
@@ -8017,7 +8025,7 @@ def run_verify_fleet(only: str | None = None) -> dict[str, Any]:
                 for f in (s.get("findings") or []):
                     if f.get("suppressed"):
                         continue
-                    ev = f.get("evidence") if isinstance(f.get("evidence"), dict) else {}
+                    ev = _dict_at(f, "evidence")
                     hosts = [str(x) for x in (ev.get("egress") or ev.get("hosts") or [])]
                     tool = str(f.get("tool") or (f.get("candidate") or {}).get("toolName") or "?")
                     if first_party(sname, hosts, all_targets.get(sname)):
@@ -8305,7 +8313,7 @@ def next_queue(d: dict[str, Any], skip: set[str] | frozenset[str] = frozenset())
     the person set aside on this page load — URL state, nothing stored. Pure over `collect()`."""
     from . import decide as _decide
     from . import history as _h
-    store = d.get("store") if isinstance(d.get("store"), dict) else {"servers": {}}
+    store = _dict_at(d, "store", {"servers": {}})
     items: list[dict[str, Any]] = []
     try:
         pend = _decide.pending_decisions(store)
@@ -8376,7 +8384,7 @@ def next_queue(d: dict[str, Any], skip: set[str] | frozenset[str] = frozenset())
             items.append({"kind": "unverified", "key": n, "name": n, "reasons": reasons[:3],
                           "status": str(v.get("status") or ""), "at": str(v.get("at") or "")})
     # 6 — approved servers with nothing re-checking them.
-    mon = d.get("monitor") if isinstance(d.get("monitor"), dict) else {}
+    mon = _dict_at(d, "monitor")
     approved_n = sum(1 for _n, _e, k, _t in fleet if k and _h.approved(store, k))
     if approved_n and not mon.get("running"):
         alerts = [a for a in (mon.get("alerts") or []) if isinstance(a, dict) and a.get("state") == "pending"]
@@ -8385,10 +8393,10 @@ def next_queue(d: dict[str, Any], skip: set[str] | frozenset[str] = frozenset())
         items.append({"kind": "unwatched", "key": "monitor", "name": "monitor",
                       "approved": approved_n, "alerts": len(alerts), "last_check": last})
     # 7 — agents whose calls pass with no check: a hook point not installed, or none at all.
-    for client, label, state, n, det in _agent_rows(d):
+    for client, label, state, n_servers, det in _agent_rows(d):
         if state != "on":
             items.append({"kind": "unhooked", "key": client, "name": label, "state": state,
-                          "servers": n, "detail": det})
+                          "servers": n_servers, "detail": det})
     # 8 — servers this machine's AGENTS CALL that no config on it declares. Nothing here can
     #     launch them, so the item is terminal and sinks — but its absence was the loudest gap on
     #     the founder's machine: 1605 unchecked calls to a server that appeared on no screen.
@@ -9004,7 +9012,7 @@ def render_next(d: dict[str, Any], token: str = "", action: dict | None = None,
             _nxt_word = {"blocked_vendor": "cannot be signed into from here",
                          "set_aside": "is set aside by you",
                          "signed_in": "is signed in"}.get(
-                             (nxt.get("signin") or {}).get("state"), _nxt_word)
+                             str((nxt.get("signin") or {}).get("state") or ""), _nxt_word)
         nxt_html = (f'<a class="mono" href="{_skip_url(it)}">Next: {_esc(nxt["name"])} '
                     f'{_nxt_word} ›</a>'
                     if nxt else '<span class="mono">Last one in the queue</span>')

{mcpgawk-0.1.59 → mcpgawk-0.1.60}/src/mcpgawk/probe.py

@@ -143,12 +143,12 @@ async def _snapshot(session: ClientSession, name: str, transport: str) -> Server
         # SDK v2 renamed the model attrs to snake_case; by_alias keeps the STORED shape on the
         # wire form (camelCase) so existing baselines and fingerprints do not all drift at once.
         protocol_version = init.protocol_version
-        server_info = (init.server_info.model_dump(by_alias=True, mode="json")
-                       if init.server_info else {})
+        _si = init.server_info
+        server_info = _si.model_dump(by_alias=True, mode="json") if _si else {}
         caps = getattr(init, "capabilities", None)
         try:
             capabilities = (caps.model_dump(by_alias=True, mode="json", exclude_none=True)
-                            if hasattr(caps, "model_dump") else dict(caps or {}))
+                            if caps is not None and hasattr(caps, "model_dump") else dict(caps or {}))
         except Exception:         # noqa: BLE001 — capabilities are evidence, never load-bearing
             capabilities = {}
     except Exception:             # noqa: BLE001 - "refused initialize" is the modern signature
@@ -340,7 +340,7 @@ def _oauth_failure(exc: BaseException) -> str | None:
     except ImportError:                                   # pragma: no cover - an mcp dep
         return None
     seen: set[int] = set()
-    stack = [exc]
+    stack: list[BaseException | None] = [exc]   # a missing cause is skipped below
     while stack:
         e = stack.pop()
         if e is None or id(e) in seen:

{mcpgawk-0.1.59 → mcpgawk-0.1.60}/src/mcpgawk/report.py

@@ -275,6 +275,7 @@ def _calls_summary() -> tuple[Section, str, str]:
     from .spool import recorder_health, summarise
 
     data: dict[str, Any] = {"summary": summarise()}
+    health: dict[str, Any] | str | None
     try:
         health = recorder_health()
     except Exception as exc:                                     # noqa: BLE001

{mcpgawk-0.1.59 → mcpgawk-0.1.60}/src/mcpgawk/status.py

@@ -267,6 +267,7 @@ def collect() -> dict:
     except Exception:                              # noqa: BLE001
         hook_health, guard_path = {}, None
 
+    agents_error: str | None
     try:
         from .discover import discover_servers
         found = discover_servers()

{mcpgawk-0.1.59 → mcpgawk-0.1.60}/src/mcpgawk/verify.py

@@ -27,6 +27,8 @@ import sys
 from pathlib import Path
 from typing import TYPE_CHECKING
 
+from .node_runtime import find_node, install_hint
+
 if TYPE_CHECKING:
     from typing import TextIO
 
@@ -100,7 +102,6 @@ def _print_observed_followup(stream: "TextIO | None" = None) -> None:
     except Exception:  # noqa: BLE001
         return
 
-from .node_runtime import find_node, install_hint
 
 #: Where the compiled engine lives once installed. A checkout's dev build wins over it — see
 #: `resolve_cli_js`.

mcpgawk-0.1.60/tests/test_a_missing_client_secret_env_is_a_usage_error.py

@@ -0,0 +1,34 @@
+"""`--oauth-client-secret-env` naming an unset variable is a usage error, not a crash (2026-09-25).
+
+Found by mypy (cli.py:213, return-value): `_run` returned the int 2 from inside its 3-tuple
+contract, and `_dispatch` unpacks that tuple unconditionally — so the user got
+`TypeError: cannot unpack non-iterable int object` after the helpful message. The same function
+already documented the rule for `--only` ("RAISE, never `return 2`"); this path never followed it.
+Driven through the real CLI with every store redirected; nothing is contacted (the check runs
+before any sign-in starts).
+"""
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+
+
+def test_an_unset_secret_env_exits_2_with_the_reason_and_no_traceback(tmp_path):
+    env = {k: v for k, v in os.environ.items() if k != "MCPGAWK_TEST_UNSET_SECRET"}
+    env.update({"HOME": str(tmp_path), "GAWK_OAUTH_KEY_BACKEND": "file",
+                "GAWK_OAUTH_STORE": str(tmp_path / "oauth"),
+                "MCPGAWK_HISTORY": str(tmp_path / "history.json"),
+                "MCPGAWK_RUNS": str(tmp_path / "runs.db"),
+                "MCPGAWK_AUTH_NEEDED": str(tmp_path / "auth-needed.json"),
+                "MCPGAWK_SIGNIN_ASIDE": str(tmp_path / "signin-aside.json"),
+                "BROWSER": "true"})
+    run = subprocess.run(
+        [sys.executable, "-B", "-m", "mcpgawk", "scan", "--http", "https://mcp.example.invalid/mcp",
+         "--login", "--oauth-client-id", "cid", "--oauth-client-secret-env",
+         "MCPGAWK_TEST_UNSET_SECRET"],
+        env=env, capture_output=True, text=True, timeout=60)
+    out = run.stdout + run.stderr
+    assert run.returncode == 2, out
+    assert "MCPGAWK_TEST_UNSET_SECRET is not set in the environment" in out, out
+    assert "Traceback" not in out and "cannot unpack" not in out, out

{mcpgawk-0.1.59 → mcpgawk-0.1.60}/tests/test_demo.py

@@ -119,7 +119,7 @@ def test_the_demo_sandbox_can_actually_be_verified(tmp_path):
         p = _sp.run([_sys.executable, str(box.fixture)],
                     input="".join(_json.dumps(m) + "\n" for m in msgs),
                     capture_output=True, text=True, timeout=30)
-        lines = [l for l in p.stdout.splitlines() if l.strip()]
+        lines = [ln for ln in p.stdout.splitlines() if ln.strip()]
         return _json.loads(lines[-1])
 
     clean = call("read_notes")

{mcpgawk-0.1.59 → mcpgawk-0.1.60}/tests/test_guard.py

@@ -686,7 +686,7 @@ def test_an_older_projection_without_seen_keeps_the_name_only_verdict(tmp_path):
 def _calls(store: Path) -> list[dict]:
     hits = list(store.parent.rglob("calls.jsonl"))
     assert hits, "no calls.jsonl beside the redirected store"
-    return [json.loads(l) for l in hits[0].read_text().splitlines() if l.strip()]
+    return [json.loads(ln) for ln in hits[0].read_text().splitlines() if ln.strip()]
 
 
 def test_a_deny_tells_the_person_in_one_line_and_records_why(tmp_path):

{mcpgawk-0.1.59 → mcpgawk-0.1.60}/tests/test_panel_api_state.py

@@ -191,8 +191,10 @@ def test_a_sub_agents_call_survives_projection_to_the_api():
 def test_observed_hosts_come_from_the_newest_run_that_contains_the_server(tmp_path, monkeypatch):
     """Slice 7: a single-server verify must not blank the rest of the fleet's evidence."""
     runs = tmp_path / "verify-runs"
-    older = runs / "2026-09-01T00-00-00Z"; newer = runs / "2026-09-02T00-00-00Z"
-    older.mkdir(parents=True); newer.mkdir()
+    older = runs / "2026-09-01T00-00-00Z"
+    newer = runs / "2026-09-02T00-00-00Z"
+    older.mkdir(parents=True)
+    newer.mkdir()
     (older / "audit.jsonl").write_text("\n".join([
         json.dumps({"type": "raw-observation", "server": "alpha", "tool": "fetch", "attempt": 1,
                     "egress": [{"host": "api.alpha.io:443", "hostname": "api.alpha.io", "allowed": True},

{mcpgawk-0.1.59 → mcpgawk-0.1.60}/tests/test_status.py

@@ -187,7 +187,7 @@ def test_the_on_row_claims_the_behavioural_tier_without_overclaiming_it():
 # --------------------------------------------------------------------------- slice 4: status --json
 
 def test_to_json_mirrors_the_rendered_facts_and_routes_the_panel_rows(monkeypatch):
-    from mcpgawk import panel, status
+    from mcpgawk import status
     fixture = {
         "errors": {}, "discovery_problems": [], "unscannable": [], "pending": ["mcp:notion"],
         "activity": {"calls": 3, "checked": 1, "deferred": 2, "denied": 0, "sessions": 1,

{mcpgawk-0.1.59 → mcpgawk-0.1.60}/tests/test_verify_observed_followup.py

@@ -27,16 +27,16 @@ def test_incomplete_server_wrap_observed_gets_the_observed_pointer(tmp_path):
     sp = _spool(tmp_path, [{"adapter": "wrap", "server": "kite", "tool": "get_profile", "decision": "allow"}])
     report = {"servers": [{"server": "kite", "status": "INCOMPLETE", "incompleteReasons": ["please sign in"]}]}
     lines = observed_followup(report, _store(), spool_path=sp)
-    assert any("wrap has observed it" in l for l in lines)
-    assert any("OBSERVED via wrap" in l for l in lines)
-    assert any("not reproduction" in l for l in lines)  # honesty carried through
+    assert any("wrap has observed it" in ln for ln in lines)
+    assert any("OBSERVED via wrap" in ln for ln in lines)
+    assert any("not reproduction" in ln for ln in lines)  # honesty carried through
 
 
 def test_incomplete_auth_server_without_wrap_data_gets_the_install_hint(tmp_path):
     sp = _spool(tmp_path, [])
     report = {"servers": [{"server": "kite", "status": "INCOMPLETE", "incompleteReasons": ["waiting for sign-in"]}]}
     lines = observed_followup(report, _store(), spool_path=sp)
-    assert any("mcpgawk wrap install kite" in l for l in lines)
+    assert any("mcpgawk wrap install kite" in ln for ln in lines)
 
 
 def test_a_completed_server_is_left_alone(tmp_path):