praetorian-cli 2.4.7__tar.gz → 2.4.9__tar.gz

{praetorian_cli-2.4.7/praetorian_cli.egg-info → praetorian_cli-2.4.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: praetorian-cli
-Version: 2.4.7
+Version: 2.4.9
 Summary: For interacting with the Guard API
 Home-page: https://github.com/praetorian-inc/praetorian-cli
 Author: Praetorian
@@ -14,6 +14,7 @@ License-File: LICENSE
 Requires-Dist: click>=8.1.7
 Requires-Dist: boto3>=1.34.0
 Requires-Dist: requests>=2.31.0
+Requires-Dist: truststore>=0.10.0
 Requires-Dist: pytest>=8.0.2
 Requires-Dist: mcp>=1.12.2
 Requires-Dist: anyio>=3.0.0
@@ -44,6 +45,7 @@ Dynamic: license-file
     - [Signing up](#signing-up)
     - [Authentication](#authentication)
 - [Using the CLI](#using-the-cli)
+    - [Update checks](#update-checks)
 - [Operators](#operators)
     - [Interactive Console](#interactive-console)
     - [Install local security tools (optional)](#install-local-security-tools-optional)
@@ -52,6 +54,7 @@ Dynamic: license-file
 - [Developers](#developers)
     - [SDK](#sdk)
     - [Developing external scripts](#developing-external-scripts)
+    - [Running the test suite](#running-the-test-suite)
     - [Contributing](#contributing)
     - [Support](#support)
     - [License](#license)
@@ -146,6 +149,10 @@ export PRAETORIAN_CLI_API_KEY_ID=your-api-key-id-here
 export PRAETORIAN_CLI_API_KEY_SECRET=your-api-key-here
 ```
 
+The backend API URL and the Cognito emulator endpoint (`aws_endpoint_url`)
+must be HTTPS; the CLI refuses to send credentials over plaintext HTTP. For local development against a loopback endpoint (`localhost`,
+`127.0.0.1`, `::1`), set `PRAETORIAN_CLI_ALLOW_HTTP_LOOPBACK=1`.
+
 For more advanced configuration options or managing access in SSO organizations see
 [the documentation on configuration](https://github.com/praetorian-inc/praetorian-cli/blob/main/docs/configure.md).
 
@@ -174,6 +181,72 @@ To get detailed information about a specific asset, run:
 guard --account guard+example@praetorian.com get asset <ASSET_KEY>
 ```
 
+## Update checks
+
+After a command finishes, the CLI may check PyPI for a newer release of
+`praetorian-cli` and print a three-line upgrade advisory to stderr. The check is
+deliberately quiet and infrequent:
+
+- **At most once every 24 hours.** Every attempt is recorded at
+  `${XDG_CACHE_HOME:-~/.cache}/praetorian-cli/update-check.json` *before* the
+  request is made, so a refresh that fails — offline, DNS, timeout, a malformed
+  response — is rate-limited exactly like one that succeeds, and keeps
+  advertising the last version it did learn. Between refreshes the check reads
+  that file and makes no network request at all — as long as the record is a
+  plain file that belongs to you and is no larger than 64 KiB. Anything else at
+  that path is ignored as though it were absent, so the next invocation refreshes
+  and replaces it rather than trusting what it found. Commands that start at the
+  same instant are excluded by a marker file created beside that record, so eight
+  concurrent invocations perform one refresh rather than eight — including when
+  the request fails instantly, since the attempt is recorded before it is made.
+  A process killed mid-refresh leaves the marker behind, which defers the next
+  refresh that is actually due rather than permitting an extra one — by up to a
+  minute, or up to two if the clock steps backwards in between, since a marker
+  counts as held while its age is within a minute in *either* direction. A
+  relative `XDG_CACHE_HOME` is
+  ignored in favour of `~/.cache`, as the base-directory spec requires —
+  honouring it would put a separate cache in every working directory and so
+  defeat the limit outright. If the cache directory cannot be written at all (a
+  read-only home, one owned by another user, or one reached through a symlink),
+  the check does not run: a probe whose rate we cannot limit is one we do not
+  send.
+- **Only when a human is watching.** It is skipped unless **both** stdout and
+  stderr are a terminal, and skipped when `CI` or `GITHUB_ACTIONS` is set or
+  `TERM=dumb`. Piping either stream — `guard list assets | jq` — turns it off.
+  A script you launch by hand from your own terminal inherits your terminal, so
+  treat the opt-out below, not this gate, as the way to guarantee silence.
+- **Never in place of your command's work.** A command that raises skips the
+  check, and a group that is only delegating to a subcommand leaves the check to
+  the subcommand that does the work. A command that reports an error but still
+  exits `0` is the one case where an advisory can follow a visible error.
+- **Not on the path you run day to day.** The daily refresh passes a 2-second
+  timeout to `requests`, which bounds how long the server may go without
+  sending data — not total wall-clock, so DNS, TLS, redirects and a slow trickle
+  are outside it. Ordinary failures are swallowed and cannot change your exit
+  code; `Ctrl-C` and process-control exceptions raised during the check still
+  propagate, by design, so that interrupting the CLI always works.
+
+### Disabling it
+
+```zsh
+export PRAETORIAN_CLI_DISABLE_UPDATE_CHECK=1
+```
+
+`1`, `true`, `yes` or `on` (any case). Nothing is read or written — no request,
+no cache file.
+
+### Privacy
+
+A refresh is an unauthenticated `GET` to `https://pypi.org/pypi/praetorian-cli/json`.
+It sends no account, profile, command, or argument — only what any HTTPS request
+inherently reveals to the server: your IP address and the fact that some
+`praetorian-cli` install asked for the package index at that moment. Because
+every attempt is recorded before it is made and concurrent attempts are
+excluded, that happens at most once per day per user account on the machine —
+several users each get their own cache — so your per-command usage cadence is
+not exposed. If contacting
+pypi.org at all is unacceptable in your environment, set the variable above.
+
 # Operators
 
 ## Interactive Console
@@ -370,6 +443,49 @@ For developing scripts, you can refer to
 this [readme file](https://github.com/praetorian-inc/praetorian-cli/blob/main/docs/script-development.md).
 
 
+## Running the test suite
+
+`guard test` runs the integration suites that ship with the package. **Some of
+those suites create, modify and delete real entities in whatever account the
+selected profile points at**, so the command is gated.
+
+Suites are selected with `-s`/`--suite`:
+
+| Suite | What it runs | Touches a live account? |
+| --- | --- | --- |
+| `safe` *(default)* | Local, offline unit tests | No |
+| `coherence` | End-to-end entity lifecycle tests | **Yes — creates and deletes assets, risks, settings, configurations** |
+| `cli` | CLI-level integration tests | **Yes — mutating** |
+| `tui` | Terminal UI tests | No |
+
+A bare `guard test` runs the `safe` suite only. It executes with a temporary
+`HOME` and with credential environment variables stripped, so it cannot reach
+your real credentials.
+
+The mutating suites additionally require:
+
+1. **An explicit profile and account.** Both must be given and non-empty —
+   `guard --profile <profile> --account <account> test --suite coherence`.
+   There is no fallback: an unset or blank value is an error, so the suite can
+   never quietly run against a default profile.
+2. **Interactive confirmation.** The command prints the suite, profile, account,
+   and whether the suite is live and mutating, then asks you to confirm.
+   Declining — or a non-interactive invocation, which cannot confirm — exits
+   non-zero without running any test.
+
+```zsh
+# Safe by default — no account is touched.
+guard test
+
+# Mutating suite: target must be explicit, and you must confirm.
+guard --profile "United States" --account guard+scratch@praetorian.com \
+    test --suite coherence
+```
+
+Never point a mutating suite at a production account. Use a dedicated scratch
+account whose contents you are willing to lose.
+
+
 ## Contributing
 
 We welcome contributions from the community, from scripts, to the core CLI and SDK. To contribute, fork this

{praetorian_cli-2.4.7 → praetorian_cli-2.4.9}/README.md

@@ -20,6 +20,7 @@
     - [Signing up](#signing-up)
     - [Authentication](#authentication)
 - [Using the CLI](#using-the-cli)
+    - [Update checks](#update-checks)
 - [Operators](#operators)
     - [Interactive Console](#interactive-console)
     - [Install local security tools (optional)](#install-local-security-tools-optional)
@@ -28,6 +29,7 @@
 - [Developers](#developers)
     - [SDK](#sdk)
     - [Developing external scripts](#developing-external-scripts)
+    - [Running the test suite](#running-the-test-suite)
     - [Contributing](#contributing)
     - [Support](#support)
     - [License](#license)
@@ -122,6 +124,10 @@ export PRAETORIAN_CLI_API_KEY_ID=your-api-key-id-here
 export PRAETORIAN_CLI_API_KEY_SECRET=your-api-key-here
 ```
 
+The backend API URL and the Cognito emulator endpoint (`aws_endpoint_url`)
+must be HTTPS; the CLI refuses to send credentials over plaintext HTTP. For local development against a loopback endpoint (`localhost`,
+`127.0.0.1`, `::1`), set `PRAETORIAN_CLI_ALLOW_HTTP_LOOPBACK=1`.
+
 For more advanced configuration options or managing access in SSO organizations see
 [the documentation on configuration](https://github.com/praetorian-inc/praetorian-cli/blob/main/docs/configure.md).
 
@@ -150,6 +156,72 @@ To get detailed information about a specific asset, run:
 guard --account guard+example@praetorian.com get asset <ASSET_KEY>
 ```
 
+## Update checks
+
+After a command finishes, the CLI may check PyPI for a newer release of
+`praetorian-cli` and print a three-line upgrade advisory to stderr. The check is
+deliberately quiet and infrequent:
+
+- **At most once every 24 hours.** Every attempt is recorded at
+  `${XDG_CACHE_HOME:-~/.cache}/praetorian-cli/update-check.json` *before* the
+  request is made, so a refresh that fails — offline, DNS, timeout, a malformed
+  response — is rate-limited exactly like one that succeeds, and keeps
+  advertising the last version it did learn. Between refreshes the check reads
+  that file and makes no network request at all — as long as the record is a
+  plain file that belongs to you and is no larger than 64 KiB. Anything else at
+  that path is ignored as though it were absent, so the next invocation refreshes
+  and replaces it rather than trusting what it found. Commands that start at the
+  same instant are excluded by a marker file created beside that record, so eight
+  concurrent invocations perform one refresh rather than eight — including when
+  the request fails instantly, since the attempt is recorded before it is made.
+  A process killed mid-refresh leaves the marker behind, which defers the next
+  refresh that is actually due rather than permitting an extra one — by up to a
+  minute, or up to two if the clock steps backwards in between, since a marker
+  counts as held while its age is within a minute in *either* direction. A
+  relative `XDG_CACHE_HOME` is
+  ignored in favour of `~/.cache`, as the base-directory spec requires —
+  honouring it would put a separate cache in every working directory and so
+  defeat the limit outright. If the cache directory cannot be written at all (a
+  read-only home, one owned by another user, or one reached through a symlink),
+  the check does not run: a probe whose rate we cannot limit is one we do not
+  send.
+- **Only when a human is watching.** It is skipped unless **both** stdout and
+  stderr are a terminal, and skipped when `CI` or `GITHUB_ACTIONS` is set or
+  `TERM=dumb`. Piping either stream — `guard list assets | jq` — turns it off.
+  A script you launch by hand from your own terminal inherits your terminal, so
+  treat the opt-out below, not this gate, as the way to guarantee silence.
+- **Never in place of your command's work.** A command that raises skips the
+  check, and a group that is only delegating to a subcommand leaves the check to
+  the subcommand that does the work. A command that reports an error but still
+  exits `0` is the one case where an advisory can follow a visible error.
+- **Not on the path you run day to day.** The daily refresh passes a 2-second
+  timeout to `requests`, which bounds how long the server may go without
+  sending data — not total wall-clock, so DNS, TLS, redirects and a slow trickle
+  are outside it. Ordinary failures are swallowed and cannot change your exit
+  code; `Ctrl-C` and process-control exceptions raised during the check still
+  propagate, by design, so that interrupting the CLI always works.
+
+### Disabling it
+
+```zsh
+export PRAETORIAN_CLI_DISABLE_UPDATE_CHECK=1
+```
+
+`1`, `true`, `yes` or `on` (any case). Nothing is read or written — no request,
+no cache file.
+
+### Privacy
+
+A refresh is an unauthenticated `GET` to `https://pypi.org/pypi/praetorian-cli/json`.
+It sends no account, profile, command, or argument — only what any HTTPS request
+inherently reveals to the server: your IP address and the fact that some
+`praetorian-cli` install asked for the package index at that moment. Because
+every attempt is recorded before it is made and concurrent attempts are
+excluded, that happens at most once per day per user account on the machine —
+several users each get their own cache — so your per-command usage cadence is
+not exposed. If contacting
+pypi.org at all is unacceptable in your environment, set the variable above.
+
 # Operators
 
 ## Interactive Console
@@ -346,6 +418,49 @@ For developing scripts, you can refer to
 this [readme file](https://github.com/praetorian-inc/praetorian-cli/blob/main/docs/script-development.md).
 
 
+## Running the test suite
+
+`guard test` runs the integration suites that ship with the package. **Some of
+those suites create, modify and delete real entities in whatever account the
+selected profile points at**, so the command is gated.
+
+Suites are selected with `-s`/`--suite`:
+
+| Suite | What it runs | Touches a live account? |
+| --- | --- | --- |
+| `safe` *(default)* | Local, offline unit tests | No |
+| `coherence` | End-to-end entity lifecycle tests | **Yes — creates and deletes assets, risks, settings, configurations** |
+| `cli` | CLI-level integration tests | **Yes — mutating** |
+| `tui` | Terminal UI tests | No |
+
+A bare `guard test` runs the `safe` suite only. It executes with a temporary
+`HOME` and with credential environment variables stripped, so it cannot reach
+your real credentials.
+
+The mutating suites additionally require:
+
+1. **An explicit profile and account.** Both must be given and non-empty —
+   `guard --profile <profile> --account <account> test --suite coherence`.
+   There is no fallback: an unset or blank value is an error, so the suite can
+   never quietly run against a default profile.
+2. **Interactive confirmation.** The command prints the suite, profile, account,
+   and whether the suite is live and mutating, then asks you to confirm.
+   Declining — or a non-interactive invocation, which cannot confirm — exits
+   non-zero without running any test.
+
+```zsh
+# Safe by default — no account is touched.
+guard test
+
+# Mutating suite: target must be explicit, and you must confirm.
+guard --profile "United States" --account guard+scratch@praetorian.com \
+    test --suite coherence
+```
+
+Never point a mutating suite at a production account. Use a dedicated scratch
+account whose contents you are willing to lose.
+
+
 ## Contributing
 
 We welcome contributions from the community, from scripts, to the core CLI and SDK. To contribute, fork this

{praetorian_cli-2.4.7 → praetorian_cli-2.4.9}/praetorian_cli/handlers/access.py

@@ -1,9 +1,11 @@
 import os
+import shlex
 
 import click
 
 from praetorian_cli.handlers.chariot import chariot
 from praetorian_cli.handlers.cli_decorators import cli_handler
+from praetorian_cli.handlers.utils import error
 
 
 def extract_prefix(email):
@@ -207,3 +209,126 @@ def aws(sdk, account, prefix):
     click.echo(f'Wrote {len(all_profiles)} AWS profile(s) to ~/.aws/config:')
     for profile_name, _ in all_profiles:
         click.echo(f'  {profile_name}')
+
+
+@access.command()
+@cli_handler
+@click.option('--org', default=None,
+              help='GitHub organization to retrieve a token for. Required when the '
+                   'account has more than one GitHub integration.')
+@click.option('--format', 'output_format', default='token',
+              type=click.Choice(['token', 'env']), show_default=True,
+              help='Output shape. token: bare token on stdout. '
+                   'env: export GITHUB_TOKEN / GH_TOKEN lines for `eval`.')
+def github(sdk, org, output_format):
+    """Retrieve a temporary GitHub App installation token.
+
+    Looks up github integrations for the active account, asks the broker to
+    mint a 1-hour App installation token, and prints it. Guard only brokers
+    temporary App installation tokens; static PATs are refused server-side.
+
+    The account is inherited from the top-level guard --account flag.
+
+    \b
+    Example usages:
+        - guard access github
+        - guard --account chariot+client@praetorian.com access github --org acme-inc
+        - eval "$(guard access github --format env)" && gh auth status
+    """
+    account = sdk.keychain.account
+
+    integrations, _ = sdk.integrations.list(name_filter='github')
+    if not integrations:
+        error(f'No GitHub integrations found for account {account}')
+
+    integration = _select_github_integration(integrations, org)
+    target = integration.get('value') or integration.get('key', '')
+
+    token = _fetch_github_app_token(sdk, integration.get('key', ''), target)
+    if not token:
+        error(f'No GitHub App installation token was retrieved for {target}.')
+
+    _print_github_token(token, output_format)
+
+
+def _select_github_integration(integrations, org):
+    """Pick the one integration to mint a token for.
+
+    A single integration is used as-is. With several, --org disambiguates by
+    matching the integration value (a repo/org URL) or its trailing path
+    segment; ambiguity without --org is an error rather than a guess.
+    """
+    if org:
+        matches = [i for i in integrations if _matches_org(i, org)]
+        if not matches:
+            error(f'No GitHub integration matching --org {org!r}. Available:\n'
+                  + _integration_list(integrations))
+        if len(matches) > 1:
+            error(f'--org {org!r} matches more than one GitHub integration:\n'
+                  + _integration_list(matches))
+        return matches[0]
+
+    if len(integrations) > 1:
+        error('This account has more than one GitHub integration. '
+              'Select one with --org:\n' + _integration_list(integrations))
+
+    return integrations[0]
+
+
+def _matches_org(integration, org):
+    value = (integration.get('value') or '').rstrip('/')
+    org = org.strip().rstrip('/').lower()
+    return value.lower() == org or value.rsplit('/', 1)[-1].lower() == org
+
+
+def _integration_list(integrations):
+    return '\n'.join(f'  {i.get("value") or i.get("key", "")}' for i in integrations)
+
+
+def _fetch_github_app_token(sdk, integration_key, target):
+    """Resolve a github credential via the broker.
+
+    Github integrations don't use the standard "Asset + Credential record"
+    pattern that from-parent walks: the OAuth installation flow stores the
+    binding (installation_id, value) directly on the Account record, and the
+    broker reads it from SSM keyed by the integration's own key
+    (backend/pkg/services/account/integration_utils.go writes
+    aws.Secrets.Set(account.Key, account.Secret); the github handler reads
+    aws.Secrets.Get(request.CredentialID)). So for github, CredentialID *is*
+    the integration key, and the right resolution is by-target.
+
+    Returns the token string on success, None after printing a stderr message
+    on failure.
+    """
+    try:
+        result = sdk.credentials.get(
+            integration_key, 'env-integration', 'github', ['token'],
+            resolution='by-target',
+        )
+    except Exception as e:
+        msg = str(e)
+        if '[403]' in msg or 'unauthorized' in msg.lower():
+            click.echo(
+                f'{target}: Guard denied the request. End-user retrieval of '
+                'GitHub App installation tokens may not be enabled on this '
+                'deployment yet.',
+                err=True,
+            )
+        else:
+            click.echo(f'{target}: {msg.splitlines()[0]}', err=True)
+        return None
+
+    token = (result or {}).get('credentialValue', {}).get('github')
+    if not isinstance(token, str) or not token:
+        click.echo(f'{target}: broker returned no token', err=True)
+        return None
+    return token
+
+
+def _print_github_token(token, output_format):
+    if output_format == 'env':
+        quoted = shlex.quote(token)
+        click.echo(f'export GITHUB_TOKEN={quoted}')
+        click.echo(f'export GH_TOKEN={quoted}')
+    else:
+        click.echo(token)

{praetorian_cli-2.4.7 → praetorian_cli-2.4.9}/praetorian_cli/handlers/add.py

@@ -61,16 +61,16 @@ def asset(sdk, identifier, group, asset_type, status, surface, resource_type):
 @add.command()
 @cli_handler
 @click.argument('path')
-@click.option('-n', '--name', help='The file name in Guard. Default: the full path of the uploaded file')
-def file(sdk, path, name):
+@click.option('-n', '--name', help='Destination path in Guard storage. Without this flag, the file is placed automatically')
+@click.option('--public', 'is_public', is_flag=True, default=False, help='Share file with the customer (Praetorian users only)')
+def file(sdk, path, name, is_public):
     """ Upload a file
 
     This commands takes the path to a local file and uploads it to the
     Guard file system. The Guard file system is where the platform
     stores proofs of exploit, risk definitions, and other supporting data.
 
-    User files reside in the "home/" folder. Those files appear in the app
-    at https://guard.praetorian.com/app/files
+    User files appear in the app at https://guard.praetorian.com/app/files
 
     \b
     Arguments:
@@ -79,10 +79,32 @@ def file(sdk, path, name):
     \b
     Example usages:
         - guard add file ./file.txt
-        - guard add file ./file.txt --name "home/file.txt"
+        - guard add file ./file.txt --public
+        - guard add file ./file.txt --name "custom/path/file.txt"
     """
     try:
-        sdk.files.add(path, name)
+        expanded = os.path.expanduser(path)
+        filename = os.path.basename(expanded)
+        praetorian = False
+
+        if name:
+            # if name is provided, use it as the destination path regardless of whether
+            # the path follows the Guard file system filepath conventions. If it does not
+            # follow the conventions, it will still be uploaded but it will not be
+            # displayed in the Guard app UI.
+            dest_path = name
+        elif sdk.is_praetorian_user():
+            if is_public:
+                dest_path = f'home/shared-with/{filename}'
+            else:
+                dest_path = f'home/internal/{filename}'
+                praetorian = True
+        else:
+            dest_path = f'home/shared-by/{filename}'
+
+        sdk.files.add(expanded, dest_path, praetorian=praetorian)
+        size = os.path.getsize(expanded)
+        click.echo(f'Uploaded {expanded} -> {dest_path} ({size} bytes)')
     except Exception as e:
         error(f'Unable to upload file {path}. Error: {e}')
 

{praetorian_cli-2.4.7 → praetorian_cli-2.4.9}/praetorian_cli/handlers/agent.py

@@ -7,6 +7,11 @@ from praetorian_cli.handlers.chariot import chariot
 from praetorian_cli.handlers.cli_decorators import cli_handler
 from praetorian_cli.handlers.utils import error
 
+# Default MCP tool allow profile: read-only query/list/get tools. Sensitive
+# tools (see praetorian_cli.sdk.mcp_server.SENSITIVE_TOOL_PATTERNS) are never
+# matched by these wildcards — they require an exact-name -a entry.
+DEFAULT_MCP_TOOLS = ['search_by_query', '*_list', '*_get']
+
 
 @chariot.group()
 def agent():
@@ -38,19 +43,28 @@ def mcp():
 
 @mcp.command()
 @cli_handler
-@click.option('--allowed', '-a', type=str, multiple=True, default=['search_by_query', '*_list', '*_get'])
+@click.option('--allowed', '-a', type=str, multiple=True, default=DEFAULT_MCP_TOOLS)
 def start(sdk, allowed):
     """ Starts the Guard MCP server
 
+    The default profile exposes read-only query/list/get tools. Tools that
+    return or manage secrets (accounts_*, credentials_*, integrations_*,
+    keys_*, webhook_*) are never matched by wildcard patterns — the default
+    profile included — and are only exposed by passing the exact tool name
+    with -a (e.g. -a credentials_get). Opting in accounts_assume_role is
+    higher-consequence than a read tool: it switches the session's tenant for
+    all subsequent tool calls.
+
     \b
     Example usages:
         - guard agent mcp start
         - guard agent mcp start -a search_by_term -a risk_add
         - guard agent mcp start -a search_* -a risk_add
+        - guard agent mcp start -a credentials_get # exact name required for sensitive tools
 
     \b
     Claude code configuration/usage:
-        - claude mcp add chariot -- guard agent mcp start # read-only
+        - claude mcp add chariot -- guard agent mcp start # default read-only, non-sensitive tools
         - claude mcp add chariot -- guard agent mcp start -a search_by_query -a risk_add -a asset_add # select write tools
         - claude "show me my chariot assets from the example.com domain"
         - claude "show me my chariot assets with port 22 open"
@@ -61,11 +75,15 @@ def start(sdk, allowed):
     sdk.agents.start_mcp_server(allowed)
 
 @mcp.command()
-@click.option('--allowed', '-a', type=str, multiple=True, default=['search_by_query', '*_list', '*_get'])
+@click.option('--allowed', '-a', type=str, multiple=True, default=DEFAULT_MCP_TOOLS)
 @cli_handler
 def tools(sdk, allowed):
     """ Lists available mcp tools
 
+    Sensitive tools (accounts_*, credentials_*, integrations_*, keys_*,
+    webhook_*) never match wildcard patterns and appear only when named
+    exactly with -a.
+
     \b
     Example usages:
         - guard agent mcp tools

{praetorian_cli-2.4.7 → praetorian_cli-2.4.9}/praetorian_cli/handlers/chariot.py

@@ -4,7 +4,14 @@ import click
 @click.group()
 @click.pass_context
 def chariot(click_context):
-    # import done here to avoid circular import errors in praetorian_cli/handlers/cli_decorators.py
+    from praetorian_cli.handlers.test import TestTarget
+
+    if isinstance(click_context.obj, TestTarget):
+        return
+
+    # Deferred import: keeps the cost of importing the whole SDK off the
+    # module-import path, so `guard --help` and unrelated commands do not pay
+    # for it. ENG-6585 owns making this lazy loading systematic.
     from praetorian_cli.sdk.chariot import Chariot
 
     """ Command group for interacting with the Guard product """