pywrit 0.1.4__tar.gz → 0.1.6__tar.gz

{pywrit-0.1.4/pywrit.egg-info → pywrit-0.1.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pywrit
-Version: 0.1.4
+Version: 0.1.6
 Summary: Writ — the gate before the write. Allow/deny gate with a tamper-evident audit log
 Project-URL: Homepage, https://withwrit.com
 Project-URL: Documentation, https://docs.withwrit.com

{pywrit-0.1.4 → pywrit-0.1.6}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "setuptools.build_meta"
 # Distribution name: pywrit (approved by Chad 2026-09-27).
 # The bare name "writ" is taken on PyPI.
 name = "pywrit"
-version = "0.1.4"
+version = "0.1.6"
 description = "Writ — the gate before the write. Allow/deny gate with a tamper-evident audit log"
 readme = "README.md"
 requires-python = ">=3.9"

{pywrit-0.1.4 → pywrit-0.1.6/pywrit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pywrit
-Version: 0.1.4
+Version: 0.1.6
 Summary: Writ — the gate before the write. Allow/deny gate with a tamper-evident audit log
 Project-URL: Homepage, https://withwrit.com
 Project-URL: Documentation, https://docs.withwrit.com

{pywrit-0.1.4 → pywrit-0.1.6}/pywrit.egg-info/SOURCES.txt

@@ -10,4 +10,5 @@ pywrit.egg-info/top_level.txt
 tests/test_scan_tsjs.py
 writ_cli/__init__.py
 writ_cli/cli.py
+writ_cli/config.py
 writ_cli/risk.py

{pywrit-0.1.4 → pywrit-0.1.6}/writ_cli/cli.py

@@ -15,30 +15,17 @@ import urllib.parse
 import urllib.request
 from datetime import datetime, timezone
 
+try:
+    from writ_cli import config
+except ImportError:  # when cli.py is run directly as a script
+    import config
+
 BASE = os.environ.get(
     "WRIT_BASE",
-    "https://api.withwrit.com",
+    config.base_url() or "https://api.withwrit.com",
 )
 
 
-def request(method, path, payload=None, key=None, token=None):
-    headers = {"content-type": "application/json"}
-    if key:
-        headers["authorization"] = "Bearer " + key
-    elif token:
-        headers["authorization"] = token
-    data = None if payload is None else json.dumps(payload).encode()
-    req = urllib.request.Request(BASE + path, data=data, headers=headers, method=method)
-    try:
-        with urllib.request.urlopen(req, timeout=20) as resp:
-            body = resp.read().decode()
-            print(body)
-            return 0
-    except urllib.error.HTTPError as exc:
-        print(exc.read().decode(), file=sys.stderr)
-        return exc.code
-
-
 def stream_cmd(args):
     """Tail the tenant audit log via the SSE stream, reconnecting on each
     long-poll expiry. Prints one line per receipt."""
@@ -11227,6 +11214,34 @@ def request(method, path, payload=None, key=None, token=None):
         return exc.code, exc.read().decode()
 
 
+def _request_and_print(method, path, payload=None, key=None, token=None):
+    """Call request(), print the response, and return a clean exit code.
+
+    Success bodies go to stdout; error bodies go to stderr. This is the
+    helper all simple dispatchers should use so the CLI exits 0 on success.
+    """
+    code, text = request(method, path, payload, key=key, token=token)
+    if code == 0:
+        print(text)
+        return 0
+    print(text, file=sys.stderr)
+    return code
+
+
+def _require_key(key):
+    if not key:
+        print("error: no API key. Run `writ login --email you@example.com` or set WRIT_API_KEY.", file=sys.stderr)
+        return False
+    return True
+
+
+def _require_sponsor_token(token):
+    if not token:
+        print("error: no sponsor token. Run `writ login` or set WRIT_SPONSOR_TOKEN.", file=sys.stderr)
+        return False
+    return True
+
+
 # ---------------------------------------------------------------------------
 # Agent Action Report
 # ---------------------------------------------------------------------------
@@ -11523,17 +11538,28 @@ def main():
     key.add_argument("--tenant-name", default="", help="Optional tenant name (defaults to email domain)")
     key.add_argument("--invite-code", default="", help="Join an existing tenant instead of creating one")
 
+    login = sub.add_parser("login", help="Create or join a tenant and save credentials to ~/.writ/config.json")
+    login.add_argument("--email", required=True)
+    login.add_argument("--tenant-name", default="", help="Optional tenant name (defaults to email domain)")
+    login.add_argument("--invite-code", default="", help="Join an existing tenant instead of creating one")
+
+    cfg = sub.add_parser("config", help="Read or write ~/.writ/config.json")
+    cfg.add_argument("action", choices=("show", "get", "set", "remove"), default="show", nargs="?",
+                   help="Action (default: show)")
+    cfg.add_argument("name", default="", help="Config key")
+    cfg.add_argument("value", default="", help="Config value (for set)")
+
     me = sub.add_parser("me", help="Show tenant, key meta, and policy")
-    me.add_argument("--key", required=True)
+    me.add_argument("--key", default=config.api_key())
 
     MODES = ("allow", "deny", "require_grant", "step_up")
     policy = sub.add_parser("policy", help="Get or set tenant verb policy")
-    policy.add_argument("--key", required=True)
+    policy.add_argument("--key", default=config.api_key())
     policy.add_argument("--set", nargs=2, metavar=("VERB", "MODE"), action="append", default=[])
     policy.add_argument("--env", default="", help="Environment override to get/set: dev, staging, or prod (default: tenant policy)")
 
     check = sub.add_parser("check", help="ALLOW or DENY a write")
-    check.add_argument("--key", required=True)
+    check.add_argument("--key", default=config.api_key())
     check.add_argument("--sponsor", required=True)
     check.add_argument("--agent", required=True)
     check.add_argument("--verb", required=True)
@@ -11551,30 +11577,30 @@ def main():
     revoke.add_argument("--sponsor", required=True)
     revoke.add_argument("--agent", required=True)
     revoke.add_argument("--reason", default="")
-    revoke.add_argument("--sponsor-token", default=os.environ.get("WRIT_SPONSOR_TOKEN", ""))
+    revoke.add_argument("--sponsor-token", default=config.sponsor_token())
 
     reinstate = sub.add_parser("reinstate", help="Undo a revocation (sponsor token)")
     reinstate.add_argument("--sponsor", required=True)
     reinstate.add_argument("--agent", required=True)
-    reinstate.add_argument("--sponsor-token", default=os.environ.get("WRIT_SPONSOR_TOKEN", ""))
+    reinstate.add_argument("--sponsor-token", default=config.sponsor_token())
 
     revoked = sub.add_parser("revoked", help="List revoked principals (sponsor token)")
-    revoked.add_argument("--sponsor-token", default=os.environ.get("WRIT_SPONSOR_TOKEN", ""))
+    revoked.add_argument("--sponsor-token", default=config.sponsor_token())
 
     receipts = sub.add_parser("receipts", help="Latest receipts for your tenant")
-    receipts.add_argument("--key", required=True)
+    receipts.add_argument("--key", default=config.api_key())
 
     stream = sub.add_parser("stream", help="Tail the live audit log (SSE stream)")
-    stream.add_argument("--key", required=True)
+    stream.add_argument("--key", default=config.api_key())
     stream.add_argument("--since", default="", help="receiptId to resume after")
     stream.add_argument("--timeout", type=int, default=600, help="Seconds to stream before exiting (0 = forever)")
 
     verify = sub.add_parser("verify-chain", help="Verify the tenant audit-log hash chain")
-    verify.add_argument("--key", required=True)
+    verify.add_argument("--key", default=config.api_key())
     verify.add_argument("--limit", type=int, default=200, help="Max receipts to verify (1-1000)")
 
     invite = sub.add_parser("invite", help="Create a team invite code for your tenant")
-    invite.add_argument("--key", required=True)
+    invite.add_argument("--key", default=config.api_key())
 
     grant = sub.add_parser("grant", help="Sponsor approval: grant one write (sponsor token)")
     grant.add_argument("--sponsor", required=True)
@@ -11583,10 +11609,10 @@ def main():
     grant.add_argument("--target", required=True)
     grant.add_argument("--purpose", required=True)
     grant.add_argument("--ttl", type=int, default=90, help="Seconds the grant stays valid (1-3600)")
-    grant.add_argument("--sponsor-token", default=os.environ.get("WRIT_SPONSOR_TOKEN", ""))
+    grant.add_argument("--sponsor-token", default=config.sponsor_token())
 
     tv = sub.add_parser("token-verify", help="Validate an ALLOW auth token")
-    tv.add_argument("--key", required=True)
+    tv.add_argument("--key", default=config.api_key())
     tv.add_argument("--token", required=True)
     tv.add_argument("--verb", default=None)
     tv.add_argument("--target", default=None)
@@ -11610,7 +11636,7 @@ def main():
                       help="Fetch the tenant's verb manifest (GET /v1/verbs) and "
                            "map inferred verbs onto custom verbs when the action "
                            "matches exactly one (needs --key)")
-    scan.add_argument("--key", default="",
+    scan.add_argument("--key", default=config.api_key(),
                       help="API key (for --push-policy / --manifest-out)")
     scan.add_argument("--manifest-out", default="",
                       help="Write a signed CI attestation manifest to PATH")
@@ -11623,7 +11649,7 @@ def main():
 
     report = sub.add_parser("report", help="Agent Action Report from receipts")
     rsrc = report.add_mutually_exclusive_group(required=True)
-    rsrc.add_argument("--key", help="API key — fetch receipts from the Writ API")
+    rsrc.add_argument("--key", default=config.api_key(), help="API key — fetch receipts from the Writ API")
     rsrc.add_argument("--file", help="Read receipts from a local JSON file (array or JSON-lines)")
     report.add_argument("--agent", help="Filter to one agent ID")
     report.add_argument("--since", help="Only receipts after this date (YYYY-MM-DD) or unix timestamp")
@@ -11634,7 +11660,7 @@ def main():
                         help="Output format (default: text)")
 
     manifest_key = sub.add_parser("manifest-key", help="Fetch the tenant's CI manifest HMAC key")
-    manifest_key.add_argument("--key", required=True)
+    manifest_key.add_argument("--key", default=config.api_key())
 
     args = parser.parse_args()
     if args.cmd == "key":
@@ -11643,14 +11669,54 @@ def main():
             payload["tenantName"] = args.tenant_name.strip()
         if args.invite_code.strip():
             payload["inviteCode"] = args.invite_code.strip()
-        return request("POST", "/v1/keys", payload)
+        return _request_and_print("POST", "/v1/keys", payload)
+    if args.cmd == "login":
+        payload = {"email": args.email}
+        if args.tenant_name.strip():
+            payload["tenantName"] = args.tenant_name.strip()
+        if args.invite_code.strip():
+            payload["inviteCode"] = args.invite_code.strip()
+        code, text = request("POST", "/v1/keys", payload)
+        if code != 0:
+            print(text, file=sys.stderr)
+            return code
+        data = json.loads(text)
+        config.set_item("apiKey", data.get("apiKey", ""))
+        config.set_item("sponsorToken", data.get("sponsorToken", ""))
+        if data.get("tenantId"):
+            print("Tenant: %s" % data["tenantId"])
+        print("API key and sponsor token saved to ~/.writ/config.json")
+        return 0
+    if args.cmd == "config":
+        if args.action == "show":
+            print(json.dumps(config.read_config(), indent=2))
+        elif args.action == "get":
+            print(config.get(args.name, ""))
+        elif args.action == "set":
+            if not args.name:
+                print("error: config set needs a name.", file=sys.stderr)
+                return 2
+            config.set_item(args.name, args.value)
+            print("set %s" % args.name)
+        elif args.action == "remove":
+            if not args.name:
+                print("error: config remove needs a name.", file=sys.stderr)
+                return 2
+            config.set_item(args.name, None)
+            print("removed %s" % args.name)
+        return 0
+
+    _KEY_COMMANDS = {"me", "policy", "check", "receipts", "stream",
+                     "verify-chain", "invite", "token-verify", "manifest-key"}
+    if args.cmd in _KEY_COMMANDS and not _require_key(args.key):
+        return 2
+
     if args.cmd == "invite":
-        return request("POST", "/v1/tenant/invites", key=args.key)
+        return _request_and_print("POST", "/v1/tenant/invites", key=args.key)
     if args.cmd == "grant":
-        if not args.sponsor_token:
-            print("error: sponsor token required (--sponsor-token or WRIT_SPONSOR_TOKEN)", file=sys.stderr)
+        if not _require_sponsor_token(args.sponsor_token):
             return 2
-        return request(
+        return _request_and_print(
             "POST",
             "/v1/grants",
             {
@@ -11664,7 +11730,7 @@ def main():
             token="Bearer " + args.sponsor_token,
         )
     if args.cmd == "me":
-        return request("GET", "/v1/me", key=args.key)
+        return _request_and_print("GET", "/v1/me", key=args.key)
     if args.cmd == "policy":
         url = "/v1/policy" if not args.env else f"/v1/policies/environments/{args.env}"
         if args.set:
@@ -11672,45 +11738,39 @@ def main():
                 if mode not in MODES:
                     print(f"error: mode must be one of {', '.join(MODES)}", file=sys.stderr)
                     return 2
-            return request("PUT", url, {verb: mode for verb, mode in args.set}, key=args.key)
-        return request("GET", url, key=args.key)
+            return _request_and_print("PUT", url, {verb: mode for verb, mode in args.set}, key=args.key)
+        return _request_and_print("GET", url, key=args.key)
     if args.cmd == "receipts":
-        return request("GET", "/v1/receipts", key=args.key)
+        return _request_and_print("GET", "/v1/receipts", key=args.key)
     if args.cmd == "stream":
         return stream_cmd(args)
     if args.cmd == "verify-chain":
-        return request("GET", f"/v1/receipts/verify?limit={args.limit}", key=args.key)
+        return _request_and_print("GET", f"/v1/receipts/verify?limit={args.limit}", key=args.key)
     if args.cmd == "token-verify":
         payload = {"token": args.token}
         for field in ("verb", "target", "purpose"):
             value = getattr(args, field)
             if value is not None:
                 payload[field] = value
-        return request("POST", "/v1/tokens/verify", payload, key=args.key)
+        return _request_and_print("POST", "/v1/tokens/verify", payload, key=args.key)
     if args.cmd == "scan":
         return scan_cmd(args)
     if args.cmd == "report":
         return report_cmd(args)
     if args.cmd == "manifest-key":
-        code, text = request("GET", "/v1/manifest-key", key=args.key)
-        if code == 0:
-            print(text)
-            return 0
-        print(text, file=sys.stderr)
-        return code
+        return _request_and_print("GET", "/v1/manifest-key", key=args.key)
     if args.cmd in ("revoke", "reinstate", "revoked"):
-        if not args.sponsor_token:
-            print("error: sponsor token required (--sponsor-token or WRIT_SPONSOR_TOKEN)", file=sys.stderr)
+        if not _require_sponsor_token(args.sponsor_token):
             return 2
         token = "Bearer " + args.sponsor_token
         if args.cmd == "revoked":
-            return request("GET", "/v1/revoked", token=token)
+            return _request_and_print("GET", "/v1/revoked", token=token)
         payload = {"sponsorId": args.sponsor, "agentId": args.agent}
         if args.cmd == "revoke":
             if args.reason:
                 payload["reason"] = args.reason
-            return request("POST", "/v1/revoke", payload, token=token)
-        return request("POST", "/v1/reinstate", payload, token=token)
+            return _request_and_print("POST", "/v1/revoke", payload, token=token)
+        return _request_and_print("POST", "/v1/reinstate", payload, token=token)
     body = {
         "sponsorId": args.sponsor,
         "agentId": args.agent,
@@ -11721,8 +11781,8 @@ def main():
     if args.cmd == "check" and args.environment:
         body["environment"] = args.environment
     if args.cmd == "sandbox":
-        return request("POST", "/v1/sandbox", body)
-    return request("POST", "/v1/check", body, key=args.key)
+        return _request_and_print("POST", "/v1/sandbox", body)
+    return _request_and_print("POST", "/v1/check", body, key=args.key)
 
 
 if __name__ == "__main__":

pywrit-0.1.6/writ_cli/config.py

@@ -0,0 +1,65 @@
+"""Local CLI configuration: ~/.writ/config.json.
+
+The CLI looks up credentials in this order:
+  1. Explicit flags (--key, --sponsor-token)
+  2. Environment variables (WRIT_API_KEY, WRIT_SPONSOR_TOKEN, WRIT_BASE)
+  3. ~/.writ/config.json (apiKey, sponsorToken, baseUrl)
+"""
+
+import json
+import os
+
+
+def _config_dir():
+    home = os.path.expanduser("~")
+    d = os.path.join(home, ".writ")
+    os.makedirs(d, exist_ok=True, mode=0o700)
+    return d
+
+
+def _config_path():
+    return os.path.join(_config_dir(), "config.json")
+
+
+def read_config():
+    path = _config_path()
+    if not os.path.exists(path):
+        return {}
+    try:
+        with open(path, "r", encoding="utf-8") as f:
+            return json.load(f)
+    except (ValueError, OSError):
+        return {}
+
+
+def write_config(cfg):
+    path = _config_path()
+    with open(path, "w", encoding="utf-8") as f:
+        json.dump(cfg, f, indent=2)
+        f.write("\n")
+    os.chmod(path, 0o600)
+
+
+def get(key, default=None):
+    return read_config().get(key, default)
+
+
+def set_item(key, value):
+    cfg = read_config()
+    if value is None:
+        cfg.pop(key, None)
+    else:
+        cfg[key] = value
+    write_config(cfg)
+
+
+def api_key():
+    return os.environ.get("WRIT_API_KEY") or get("apiKey", "")
+
+
+def sponsor_token():
+    return os.environ.get("WRIT_SPONSOR_TOKEN") or get("sponsorToken", "")
+
+
+def base_url():
+    return os.environ.get("WRIT_BASE") or get("baseUrl", "")