py-wlcli 0.8.2__tar.gz → 0.9.0__tar.gz

{py_wlcli-0.8.2 → py_wlcli-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: py_wlcli
-Version: 0.8.2
+Version: 0.9.0
 Summary: wl_cli - Python项目
 Project-URL: Homepage, https://gitlab.gewinnrobo.com/Humuyuan/wl-cli
 Project-URL: Issues, https://gitlab.gewinnrobo.com/Humuyuan/wl-cli/-/issues

py_wlcli-0.9.0/VERSION

@@ -0,0 +1 @@
+0.9.0

{py_wlcli-0.8.2 → py_wlcli-0.9.0}/pyproject.toml

@@ -50,6 +50,11 @@ default = true
 requires = [ "hatchling>=1.27",]
 build-backend = "hatchling.build"
 
+[dependency-groups]
+dev = [
+    "jsonschema>=4.26.0",
+]
+
 [tool.hatch.version]
 source = "regex"
 path = "VERSION"

{py_wlcli-0.8.2 → py_wlcli-0.9.0}/src/wl_cli/capabilities.py

@@ -33,6 +33,7 @@ SCHEMA_VERSION = 1
 #: data ships in (the release bump happens outside this change).
 CAPABILITY_SINCE: dict[str, str] = {
     "cc.check": "0.8.0",
+    "cc.check.schema": "0.9.0",
     "cc.hooks": "0.8.0",
     "cc.init": "0.8.0",
     "cc.mcp": "0.8.0",
@@ -41,6 +42,9 @@ CAPABILITY_SINCE: dict[str, str] = {
     "cc.settings": "0.8.0",
     "cc.stamps": "0.8.0",
     "cc.statusline": "0.8.0",
+    "cc.token.set": "0.9.0",
+    "cc.token.status": "0.9.0",
+    "cc.token.verify": "0.9.0",
     "cc.upgrade": "0.8.0",
     "env.check": "0.8.0",
     "env.check.require": "0.8.2",

{py_wlcli-0.8.2 → py_wlcli-0.9.0}/src/wl_cli/cc/checks.py

@@ -66,6 +66,14 @@ if TYPE_CHECKING:
 #: Stable tool name in the envelope's ``tool`` key.
 TOOL = "cc check"
 
+#: The ``cc.check`` payload schema version (#240). The packaged
+#: ``cc/schemas/cc_check.schema.json`` is the single owner of the shape; this
+#: constant mirrors its top-level ``const``, and the tests pin the two
+#: together. It is deliberately separate from
+#: :data:`wl_cli.capabilities.SCHEMA_VERSION`, which only serves the
+#: deprecated ``wl self capabilities`` payload.
+CC_CHECK_SCHEMA_VERSION = 1
+
 #: Required plugins -- the consumer-side copy of wlcc
 #: ``references/stamps.md``'s ``wl-required-plugins`` key block (#226 there).
 #: Entries are the full ``name@marketplace`` form, so a name cannot match a
@@ -1261,5 +1269,12 @@ def build_report() -> tuple[str, str | None, dict[str, Any]]:
 def emit_check() -> int:
     """Write the ``cc check`` envelope to stdout and return its exit code."""
     status, reason, fields = build_report()
-    dump(status, status in OK_STATUSES, tool=TOOL, reason=reason, **fields)
+    dump(
+        status,
+        status in OK_STATUSES,
+        tool=TOOL,
+        reason=reason,
+        schema_version=CC_CHECK_SCHEMA_VERSION,
+        **fields,
+    )
     return exit_code(status)

{py_wlcli-0.8.2 → py_wlcli-0.9.0}/src/wl_cli/cc/cli.py

@@ -19,13 +19,15 @@ can never disagree with ``repair``.
 
 from __future__ import annotations
 
+from importlib import resources
 from typing import TYPE_CHECKING, Any
 
 import click
 
 from ..envelope import OK_STATUSES, dump, exit_code
 from . import mutate
-from .checks import TOOL, build_report
+from . import token as token_ops
+from .checks import CC_CHECK_SCHEMA_VERSION, TOOL, build_report
 
 if TYPE_CHECKING:
     from collections.abc import Callable
@@ -35,6 +37,24 @@ _HOST_SECTIONS = ("plugins", "mcp", "settings", "stamps", "hooks", "statusline")
 
 _JSON_HELP = "Emit one five-state JSON envelope on stdout."
 
+_SCHEMA_HELP = (
+    "Print the packaged cc.check JSON Schema and exit without running any probe."
+)
+
+
+def schema_bytes() -> bytes:
+    """Return the packaged ``cc_check.schema.json`` bytes, unchanged.
+
+    The schema file is the single owner of the ``wl cc check --json`` payload
+    shape (#240, ruling #234). Reading it through :mod:`importlib.resources`
+    means an installed wheel serves the same bytes as the source tree.
+    """
+    return (
+        resources.files("wl_cli.cc")
+        .joinpath("schemas", "cc_check.schema.json")
+        .read_bytes()
+    )
+
 
 def _section_line(name: str, section: dict[str, Any]) -> str:
     """Render one ``name: status -- reason`` line."""
@@ -146,7 +166,13 @@ def cc_group() -> None:
     is_flag=True,
     help=_JSON_HELP,
 )
-def check(as_json: bool) -> None:
+@click.option(
+    "--schema",
+    "show_schema",
+    is_flag=True,
+    help=_SCHEMA_HELP,
+)
+def check(as_json: bool, show_schema: bool) -> None:
     """Report the Claude Code host state without writing anything.
 
     The report nests the same-process ``wl env check`` payload under ``env``
@@ -156,10 +182,26 @@ def check(as_json: bool) -> None:
     hides the others. In ``--json`` mode stdout is exactly one envelope line
     and diagnostics go to stderr; the probe is read-only, and the dispatcher
     skips the startup ``.wl`` self-sync (#220).
+
+    ``--schema`` prints the packaged JSON Schema byte-for-byte and exits 0
+    without probing anything; it cannot be combined with ``--json``.
     """
+    if show_schema:
+        if as_json:
+            raise click.UsageError("--schema and --json are mutually exclusive")
+        click.echo(schema_bytes(), nl=False)
+        raise SystemExit(0)
+
     status, reason, sections = build_report()
     if as_json:
-        dump(status, status in OK_STATUSES, tool=TOOL, reason=reason, **sections)
+        dump(
+            status,
+            status in OK_STATUSES,
+            tool=TOOL,
+            reason=reason,
+            schema_version=CC_CHECK_SCHEMA_VERSION,
+            **sections,
+        )
         raise SystemExit(exit_code(status))
 
     for line in _summary_lines(status, reason, sections):
@@ -368,3 +410,55 @@ def stamps_check(as_json: bool) -> None:
     are reported and kept here and there.
     """
     _run_single("cc stamps check", lambda: mutate.probe_section("stamps"), as_json)
+
+
+@cc_group.group(name="token")
+def token_group() -> None:
+    """GitLab credential status, set and verify (never echoes the token).
+
+    The three subcommands are ADR-0012's command surface: ``status`` is a
+    local-only probe, ``set`` is stdin-only and ``verify`` is the one explicit
+    network call. Reasons are the closed ADR-0012 §6 prefixes.
+    """
+
+
+@token_group.command(name="status")
+@click.option("--json", "as_json", is_flag=True, help=_JSON_HELP)
+def token_status(as_json: bool) -> None:
+    """Report the credential source and whether the local file decrypts.
+
+    Returns ``source`` / ``path`` / ``exists`` / ``mode`` / ``decryptable``
+    only -- never the token, the hostname, the username or the plaintext
+    length. ``dangling`` (with ``no_token:``, ``token_undecryptable:`` or
+    ``token_insecure_permissions:``) still exits 0: the probe holds and the
+    reason names the one pending action.
+    """
+    _run_single("cc token status", token_ops.status, as_json)
+
+
+@token_group.command(name="set")
+@click.option("--json", "as_json", is_flag=True, help=_JSON_HELP)
+def token_set(as_json: bool) -> None:
+    """Encrypt and atomically write the token read from stdin.
+
+    A TTY prompts without echo; a pipe is read directly. There is deliberately
+    no ``--from-file`` / ``--path`` / ``--force`` / ``--dry-run``: argv and
+    environment variables are a second leak surface for a secret.
+    """
+
+    def action() -> dict[str, Any]:
+        return token_ops.set_token(token_ops.read_token_stdin())
+
+    _run_single("cc token set", action, as_json)
+
+
+@token_group.command(name="verify")
+@click.option("--json", "as_json", is_flag=True, help=_JSON_HELP)
+def token_verify(as_json: bool) -> None:
+    """Check the token against GitLab (``GET /api/v4/user``).
+
+    The only subcommand that uses the network. It reports ``http_code`` and
+    ``host`` only; the response body is never echoed, redirects are never
+    followed and TLS verification cannot be disabled.
+    """
+    _run_single("cc token verify", token_ops.verify, as_json)