minitest-cli 0.16.0__tar.gz → 0.16.2__tar.gz

{minitest_cli-0.16.0 → minitest_cli-0.16.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: minitest-cli
-Version: 0.16.0
+Version: 0.16.2
 Summary: Minitest CLI – command-line interface for the Minitest testing platform
 Project-URL: Homepage, https://minitap.ai/
 Project-URL: Source, https://github.com/minitap-ai/minitest-cli

{minitest_cli-0.16.0 → minitest_cli-0.16.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "minitest-cli"
-version = "0.16.0"
+version = "0.16.2"
 description = "Minitest CLI – command-line interface for the Minitest testing platform"
 readme = "README.md"
 license = "MIT"

minitest_cli-0.16.2/renovate.json

@@ -0,0 +1,4 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["github>minitap-ai/renovate-config"]
+}

{minitest_cli-0.16.0 → minitest_cli-0.16.2}/src/minitest_cli/api/apps_manager_client.py

@@ -70,6 +70,14 @@ class AppsManagerClient:
         """Send a POST request."""
         return await self._ensure_client().post(path, **kwargs)
 
+    async def put(self, path: str, **kwargs: Any) -> httpx.Response:
+        """Send a PUT request."""
+        return await self._ensure_client().put(path, **kwargs)
+
+    async def delete(self, path: str, **kwargs: Any) -> httpx.Response:
+        """Send a DELETE request."""
+        return await self._ensure_client().delete(path, **kwargs)
+
     async def upload_form(
         self,
         path: str,

minitest_cli-0.16.2/src/minitest_cli/commands/env.py

@@ -0,0 +1,198 @@
+"""App environment-variable commands: list, get, set, unset, clear.
+
+Values are secrets: ``list`` masks them by default (reveal with ``--show``),
+and ``get`` prints a single value verbatim to stdout on purpose. Mutations
+(``set``/``unset``/``clear``) require ``--yes`` so they never run unconfirmed.
+"""
+
+import asyncio
+from collections.abc import Coroutine
+from typing import Annotated, Any
+
+import httpx
+import typer
+from rich.markup import escape
+
+from minitest_cli.commands.env_helpers import (
+    MASK,
+    confirm_or_exit,
+    delete_env_vars,
+    diff_keys,
+    fetch_env_vars,
+    print_diff,
+    put_env_vars,
+    resolve_app_and_tenant,
+)
+from minitest_cli.core.auth import require_auth
+from minitest_cli.core.config import Settings
+from minitest_cli.utils.output import (
+    print_error,
+    print_json,
+    print_success,
+    print_table,
+)
+
+EXIT_NETWORK_ERROR = 3
+EXIT_NOT_FOUND = 4
+
+app = typer.Typer(name="env", help="Manage an app's environment variables.")
+
+
+@app.callback()
+def _callback() -> None:
+    """Manage an app's environment variables."""
+
+
+def _get_settings() -> Settings:
+    return typer.Context.settings  # type: ignore[attr-defined]
+
+
+def _is_json_mode() -> bool:
+    return typer.Context.json_mode  # type: ignore[attr-defined]
+
+
+def _get_app_flag() -> str | None:
+    return typer.Context.app_flag  # type: ignore[attr-defined]
+
+
+def _run[T](coro: Coroutine[Any, Any, T]) -> T:
+    try:
+        return asyncio.run(coro)
+    except httpx.HTTPError as exc:
+        print_error(f"Network error: {exc}")
+        raise typer.Exit(code=EXIT_NETWORK_ERROR) from exc
+
+
+def _context() -> tuple[Settings, str, str, bool]:
+    settings = _get_settings()
+    require_auth(settings)
+    app_id, tenant_id = _run(resolve_app_and_tenant(settings, _get_app_flag()))
+    return settings, app_id, tenant_id, _is_json_mode()
+
+
+@app.command(name="list")
+def list_env(
+    show: Annotated[
+        bool, typer.Option("--show", help="Reveal values instead of masking them.")
+    ] = False,
+) -> None:
+    """List the app's environment variables (values masked unless --show)."""
+    settings, app_id, tenant_id, json_mode = _context()
+    env_vars = _run(fetch_env_vars(settings, tenant_id, app_id))
+
+    rendered = env_vars if show else {k: MASK for k in env_vars}
+    if json_mode:
+        print_json(rendered)
+        return
+    if not env_vars:
+        print_success("No environment variables configured for this app.")
+        return
+    rows = [[escape(k), escape(rendered[k])] for k in sorted(rendered)]
+    print_table(["Key", "Value"], rows, title="Environment variables")
+
+
+@app.command(name="get")
+def get_env(key: Annotated[str, typer.Argument(help="Environment variable name.")]) -> None:
+    """Print a single environment variable's value verbatim to stdout."""
+    settings, app_id, tenant_id, json_mode = _context()
+    env_vars = _run(fetch_env_vars(settings, tenant_id, app_id))
+
+    if key not in env_vars:
+        print_error(f"Environment variable not found: '{key}'.")
+        raise typer.Exit(code=EXIT_NOT_FOUND)
+
+    if json_mode:
+        print_json({key: env_vars[key]})
+        return
+    print(env_vars[key])  # noqa: T201
+
+
+@app.command(name="set")
+def set_env(
+    key: Annotated[str, typer.Argument(help="Environment variable name.")],
+    value: Annotated[str, typer.Argument(help="Value to set.")],
+    yes: Annotated[bool, typer.Option("--yes", "-y", help="Confirm the change.")] = False,
+    dry_run: Annotated[
+        bool, typer.Option("--dry-run", help="Show the change without applying it.")
+    ] = False,
+) -> None:
+    """Set an environment variable (creates or updates), preserving the others."""
+    settings, app_id, tenant_id, json_mode = _context()
+    current = _run(fetch_env_vars(settings, tenant_id, app_id))
+    updated = {**current, key: value}
+
+    _apply(settings, tenant_id, app_id, current, updated, yes, dry_run, json_mode, f"Set '{key}'")
+
+
+@app.command(name="unset")
+def unset_env(
+    key: Annotated[str, typer.Argument(help="Environment variable name.")],
+    yes: Annotated[bool, typer.Option("--yes", "-y", help="Confirm the change.")] = False,
+    dry_run: Annotated[
+        bool, typer.Option("--dry-run", help="Show the change without applying it.")
+    ] = False,
+) -> None:
+    """Remove a single environment variable, preserving the others."""
+    settings, app_id, tenant_id, json_mode = _context()
+    current = _run(fetch_env_vars(settings, tenant_id, app_id))
+    if key not in current:
+        print_error(f"Environment variable not found: '{key}'.")
+        raise typer.Exit(code=EXIT_NOT_FOUND)
+    updated = {k: v for k, v in current.items() if k != key}
+
+    _apply(settings, tenant_id, app_id, current, updated, yes, dry_run, json_mode, f"Unset '{key}'")
+
+
+@app.command(name="clear")
+def clear_env(
+    yes: Annotated[bool, typer.Option("--yes", "-y", help="Confirm the deletion.")] = False,
+    dry_run: Annotated[
+        bool, typer.Option("--dry-run", help="Show the change without applying it.")
+    ] = False,
+) -> None:
+    """Delete ALL environment variables for the app."""
+    settings, app_id, tenant_id, json_mode = _context()
+    current = _run(fetch_env_vars(settings, tenant_id, app_id))
+    if not current:
+        print_error("No environment variables to delete.")
+        raise typer.Exit(code=EXIT_NOT_FOUND)
+
+    _, _, removed = diff_keys(current, {})
+    if dry_run:
+        print_diff([], [], removed)
+        if json_mode:
+            print_json({"added": [], "changed": [], "removed": removed, "dryRun": True})
+        return
+
+    confirm_or_exit(yes, f"Deleting all {len(current)} environment variables")
+    _run(delete_env_vars(settings, tenant_id, app_id))
+    if json_mode:
+        print_json({"added": [], "changed": [], "removed": removed})
+        return
+    print_success(f"Deleted all {len(removed)} environment variables.")
+
+
+def _apply(
+    settings: Settings,
+    tenant_id: str,
+    app_id: str,
+    current: dict[str, str],
+    updated: dict[str, str],
+    yes: bool,
+    dry_run: bool,
+    json_mode: bool,
+    action: str,
+) -> None:
+    added, changed, removed = diff_keys(current, updated)
+    if dry_run:
+        print_diff(added, changed, removed)
+        if json_mode:
+            print_json({"added": added, "changed": changed, "removed": removed, "dryRun": True})
+        return
+
+    confirm_or_exit(yes, action)
+    _run(put_env_vars(settings, tenant_id, app_id, updated))
+    if json_mode:
+        print_json({"added": added, "changed": changed, "removed": removed})
+        return
+    print_success(f"{action} — {len(updated)} environment variables now set.")

minitest_cli-0.16.2/src/minitest_cli/commands/env_helpers.py

@@ -0,0 +1,140 @@
+"""Helpers for env-var commands: app/tenant resolution, HTTP, confirmation."""
+
+import sys
+
+import httpx
+import typer
+
+from minitest_cli.api.apps_manager_client import AppsManagerClient
+from minitest_cli.api.client import ApiClient
+from minitest_cli.core.config import Settings
+from minitest_cli.models.app import AppListResponse
+from minitest_cli.models.app_env_vars import AppEnvVarsResponse
+from minitest_cli.utils.output import print_error
+
+EXIT_GENERAL_ERROR = 1
+EXIT_NETWORK_ERROR = 3
+EXIT_NOT_FOUND = 4
+
+MASK = "********"
+
+
+def env_vars_path(tenant_id: str, app_id: str) -> str:
+    return f"/api/v1/tenants/{tenant_id}/apps/{app_id}/env-vars"
+
+
+async def resolve_app_and_tenant(settings: Settings, app_flag: str | None) -> tuple[str, str]:
+    """Resolve ``--app`` (id or name) to a concrete ``(app_id, tenant_id)`` pair.
+
+    The env-vars endpoint verifies the app belongs to the tenant, so both ids
+    must come from the same app record.
+    """
+    target = app_flag or settings.app_id
+    if not target:
+        print_error("No app specified. Use --app <id-or-name> or set MINITEST_APP_ID.")
+        raise typer.Exit(code=EXIT_GENERAL_ERROR)
+
+    async with ApiClient(settings) as client:
+        resp = await client.get("/api/v1/apps")
+    if resp.status_code >= 400:
+        print_error(f"API error ({resp.status_code}): failed to list apps.")
+        raise typer.Exit(code=EXIT_NETWORK_ERROR)
+
+    apps = AppListResponse.model_validate(resp.json()).apps
+    lowered = target.lower()
+    matches = [a for a in apps if a.id == target or a.name.lower() == lowered]
+    if not matches:
+        print_error(f"App not found: '{target}'. Use a valid app id or name.")
+        raise typer.Exit(code=EXIT_NOT_FOUND)
+    if len(matches) > 1:
+        print_error(f"Ambiguous app name '{target}' matches {len(matches)} apps. Use the app id.")
+        raise typer.Exit(code=EXIT_GENERAL_ERROR)
+
+    app = matches[0]
+    return app.id, app.tenant_id
+
+
+async def fetch_env_vars(settings: Settings, tenant_id: str, app_id: str) -> dict[str, str]:
+    """Return the app's env vars, or an empty dict when none are configured (404)."""
+    async with AppsManagerClient(settings) as client:
+        resp = await client.get(env_vars_path(tenant_id, app_id))
+    if resp.status_code == 404:
+        return {}
+    _raise_for_status(resp, resource="Environment variables")
+    return AppEnvVarsResponse.model_validate(resp.json()).env_vars
+
+
+async def put_env_vars(
+    settings: Settings, tenant_id: str, app_id: str, env_vars: dict[str, str]
+) -> AppEnvVarsResponse:
+    """Replace the app's full env-var set."""
+    async with AppsManagerClient(settings) as client:
+        resp = await client.put(env_vars_path(tenant_id, app_id), json={"envVars": env_vars})
+    _raise_for_status(resp, resource="Environment variables")
+    return AppEnvVarsResponse.model_validate(resp.json())
+
+
+async def delete_env_vars(settings: Settings, tenant_id: str, app_id: str) -> None:
+    """Delete all env vars for the app."""
+    async with AppsManagerClient(settings) as client:
+        resp = await client.delete(env_vars_path(tenant_id, app_id))
+    if resp.status_code == 404:
+        print_error("No environment variables to delete.")
+        raise typer.Exit(code=EXIT_NOT_FOUND)
+    _raise_for_status(resp, resource="Environment variables")
+
+
+def _raise_for_status(resp: httpx.Response, *, resource: str) -> None:
+    if resp.status_code < 400:
+        return
+    detail = _extract_detail(resp)
+    if resp.status_code == 404:
+        print_error(detail or f"{resource} not found.")
+        raise typer.Exit(code=EXIT_NOT_FOUND)
+    if resp.status_code >= 500:
+        print_error(detail or f"API error: {resp.status_code}")
+        raise typer.Exit(code=EXIT_NETWORK_ERROR)
+    print_error(detail or f"API error: {resp.status_code}")
+    raise typer.Exit(code=EXIT_GENERAL_ERROR)
+
+
+def _extract_detail(resp: httpx.Response) -> str | None:
+    try:
+        body = resp.json()
+    except Exception:  # noqa: BLE001
+        return None
+    if isinstance(body, dict):
+        return body.get("detail") or body.get("message")
+    return None
+
+
+def confirm_or_exit(yes: bool, action: str) -> None:
+    """Gate a mutating action behind explicit confirmation.
+
+    Passing ``--yes`` proceeds. Without it we refuse rather than prompt, so the
+    command stays safe to run non-interactively (agents/CI) — exit 1 naming the
+    flag that unblocks it.
+    """
+    if yes:
+        return
+    print_error(f"{action} requires confirmation. Re-run with --yes to proceed.")
+    raise typer.Exit(code=EXIT_GENERAL_ERROR)
+
+
+def diff_keys(
+    current: dict[str, str], updated: dict[str, str]
+) -> tuple[list[str], list[str], list[str]]:
+    """Return (added, changed, removed) keys between two env-var maps."""
+    added = sorted(k for k in updated if k not in current)
+    removed = sorted(k for k in current if k not in updated)
+    changed = sorted(k for k in updated if k in current and updated[k] != current[k])
+    return added, changed, removed
+
+
+def print_diff(added: list[str], changed: list[str], removed: list[str]) -> None:
+    for key in added:
+        print(f"+ {key}", file=sys.stderr)  # noqa: T201
+    for key in changed:
+        print(f"~ {key}", file=sys.stderr)  # noqa: T201
+    for key in removed:
+        print(f"- {key}", file=sys.stderr)  # noqa: T201

{minitest_cli-0.16.0 → minitest_cli-0.16.2}/src/minitest_cli/core/auth.py

@@ -20,7 +20,11 @@ from minitest_cli.core.credentials import (
     save_credentials,
 )
 from minitest_cli.core.oauth import oauth_pkce_login, refresh_token
-from minitest_cli.core.token_exchange import EXIT_CODE_AUTH_ERROR, auth_error
+from minitest_cli.core.token_exchange import (
+    EXIT_CODE_AUTH_ERROR,
+    SessionRevokedError,
+    auth_error,
+)
 
 __all__ = [
     "AuthStatus",
@@ -38,6 +42,7 @@ __all__ = [
     "require_auth",
     "refresh_token",
     "save_credentials",
+    "SessionRevokedError",
 ]
 
 AuthMethod = Literal["api_key", "env_token", "oauth", "none"]
@@ -71,14 +76,20 @@ class AuthStatus(TypedDict):
 def load_or_refresh_credentials(settings: Settings) -> Credentials | None:
     """Load stored credentials, auto-refreshing if near expiry.
 
-    Returns refreshed credentials, original credentials, or None.
+    Returns refreshed credentials, original credentials, or None. When the auth
+    server rejects the stored token outright, the dead credentials are cleared
+    and SessionRevokedError propagates so callers can prompt a fresh login.
     """
     creds = load_credentials(settings)
     if creds is None:
         return None
-    if creds.is_expired:
+    if not creds.is_expired:
+        return creds
+    try:
         return refresh_token(settings, creds)
-    return creds
+    except SessionRevokedError:
+        clear_credentials(settings)
+        raise
 
 
 def load_token(settings: Settings) -> str:
@@ -91,7 +102,13 @@ def load_token(settings: Settings) -> str:
     if settings.api_key:
         return settings.api_key.get_secret_value()
 
-    creds = load_or_refresh_credentials(settings)
+    try:
+        creds = load_or_refresh_credentials(settings)
+    except SessionRevokedError:
+        auth_error(
+            "Your saved session is no longer valid (the auth server rejected it). "
+            "Run `minitest auth login` to sign in again."
+        )
     if creds is not None:
         return creds.access_token
 
@@ -120,8 +137,11 @@ def get_auth_method(settings: Settings) -> AuthMethod:
         return "env_token"
     if settings.api_key:
         return "api_key"
-    if load_or_refresh_credentials(settings) is not None:
-        return "oauth"
+    try:
+        if load_or_refresh_credentials(settings) is not None:
+            return "oauth"
+    except SessionRevokedError:
+        return "none"
     return "none"
 
 

{minitest_cli-0.16.0 → minitest_cli-0.16.2}/src/minitest_cli/core/credentials.py

@@ -23,6 +23,7 @@ class Credentials(BaseModel):
     expires_at: float
     user_id: str
     email: str
+    client_id: str | None = None
 
     @property
     def is_expired(self) -> bool:

{minitest_cli-0.16.0 → minitest_cli-0.16.2}/src/minitest_cli/core/oauth.py

@@ -19,6 +19,7 @@ import httpx
 from minitest_cli.core.config import Settings
 from minitest_cli.core.credentials import Credentials
 from minitest_cli.core.token_exchange import (
+    SessionRevokedError,
     auth_error,
     parse_and_save_token_response,
     register_oauth_client,
@@ -28,47 +29,54 @@ _ASSETS = importlib.resources.files("minitest_cli.assets")
 
 
 def refresh_token(settings: Settings, creds: Credentials) -> Credentials | None:
-    """Refresh an expired access token using the refresh token.
+    """Refresh an expired access token, saving new credentials to disk.
 
-    Returns updated credentials (also saved to disk), or None on failure.
+    OAuth sessions must refresh against the same client that created them, so a
+    persisted client_id is required. Returns None on a transient failure. Raises
+    SessionRevokedError when the token can never succeed (missing client_id, or a
+    4xx rejection) so callers can clear it and re-login.
     """
     if not settings.supabase_url or not settings.supabase_publishable_key:
         return None
+    if not creds.client_id:
+        raise SessionRevokedError
 
     supabase_url = settings.supabase_url.rstrip("/")
     try:
         response = httpx.post(
-            f"{supabase_url}/auth/v1/token?grant_type=refresh_token",
-            json={"refresh_token": creds.refresh_token},
+            f"{supabase_url}/auth/v1/oauth/token",
+            data={
+                "grant_type": "refresh_token",
+                "refresh_token": creds.refresh_token,
+                "client_id": creds.client_id,
+            },
             headers={
-                "Content-Type": "application/json",
+                "Content-Type": "application/x-www-form-urlencoded",
                 "apikey": settings.supabase_publishable_key,
             },
             timeout=15.0,
         )
-        response.raise_for_status()
+    except httpx.HTTPError:
+        return None
+
+    if 400 <= response.status_code < 500:
+        raise SessionRevokedError
+    if response.status_code >= 500:
+        return None
+
+    try:
         data = response.json()
-    except (httpx.HTTPError, ValueError):
+    except ValueError:
         return None
 
     if not isinstance(data, dict):
         return None
 
-    return parse_and_save_token_response(settings, data)
+    return parse_and_save_token_response(settings, data, creds.client_id)
 
 
 def oauth_pkce_login(settings: Settings) -> Credentials:
-    """Run the full OAuth PKCE login flow via Supabase's OAuth2 server.
-
-    Steps:
-      1. Start local callback server
-      2. Dynamically register an OAuth2 client with Supabase
-      3. Generate PKCE code verifier + challenge
-      4. Open browser to Supabase authorize endpoint (shows hosted sign-in page)
-      5. Wait for callback with authorization code
-      6. Exchange code + verifier for tokens at Supabase token endpoint
-      7. Save and return credentials
-    """
+    """Run the full OAuth PKCE login flow via Supabase's OAuth2 server."""
     supabase_url = settings.supabase_url.rstrip("/")
 
     # PKCE challenge: base64url(sha256(verifier)) without padding
@@ -181,7 +189,7 @@ def oauth_pkce_login(settings: Settings) -> Credentials:
     if not isinstance(response_data, dict):
         auth_error("Token exchange returned unexpected response format.")
 
-    creds = parse_and_save_token_response(settings, response_data)
+    creds = parse_and_save_token_response(settings, response_data, client_id)
     if creds is None:
         auth_error("Failed to parse token response.")
 

{minitest_cli-0.16.0 → minitest_cli-0.16.2}/src/minitest_cli/core/token_exchange.py

@@ -16,6 +16,14 @@ from minitest_cli.core.credentials import Credentials, save_credentials
 EXIT_CODE_AUTH_ERROR = 2
 
 
+class SessionRevokedError(Exception):
+    """The auth server rejected the stored refresh token outright (4xx).
+
+    Distinct from a transient network/server error: the token can never
+    succeed (e.g. issued by a project decommissioned after a migration).
+    """
+
+
 def require_supabase_url(settings: Settings) -> str:
     """Return the supabase URL or exit with code 2."""
     if settings.supabase_url:
@@ -35,8 +43,14 @@ def get_apikey_header(settings: Settings) -> str:
     )
 
 
-def parse_and_save_token_response(settings: Settings, data: dict[str, Any]) -> Credentials | None:
-    """Parse a Supabase token response and persist credentials."""
+def parse_and_save_token_response(
+    settings: Settings, data: dict[str, Any], client_id: str | None = None
+) -> Credentials | None:
+    """Parse a Supabase token response and persist credentials.
+
+    client_id is the OAuth client that owns the session; it must be persisted
+    so refresh_token can re-authenticate against the same client.
+    """
     try:
         user = data.get("user", {})
         if not isinstance(user, dict):
@@ -57,6 +71,7 @@ def parse_and_save_token_response(settings: Settings, data: dict[str, Any]) -> C
             expires_at=time.time() + int(expires_in),
             user_id=user_id,
             email=email,
+            client_id=client_id,
         )
         save_credentials(settings, creds)
         return creds

{minitest_cli-0.16.0 → minitest_cli-0.16.2}/src/minitest_cli/main.py

@@ -11,6 +11,7 @@ from minitest_cli.commands import (
     auth,
     batch,
     build,
+    env,
     flow_types,
     init,
     run,
@@ -42,6 +43,7 @@ app.add_typer(test_file.app)
 app.add_typer(flow_types.app)
 app.add_typer(app_knowledge.app)
 app.add_typer(build.app)
+app.add_typer(env.app)
 app.add_typer(run.app)
 app.add_typer(batch.app)
 app.add_typer(skill.app)

minitest_cli-0.16.2/src/minitest_cli/models/app_env_vars.py

@@ -0,0 +1,19 @@
+"""Pydantic models for the app env-vars API (apps-manager)."""
+
+from datetime import datetime
+
+from minitest_cli.models.base import CamelModel
+
+
+class AppEnvVarsResponse(CamelModel):
+    """Response from the apps-manager env-vars endpoints.
+
+    ``env_vars`` values are decrypted plaintext, so treat the whole payload
+    as secret material.
+    """
+
+    id: str
+    app_id: str
+    tenant_id: str
+    env_vars: dict[str, str]
+    updated_at: datetime | None = None