pywrit 0.1.7__tar.gz → 0.1.9__tar.gz

{pywrit-0.1.7/pywrit.egg-info → pywrit-0.1.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pywrit
-Version: 0.1.7
+Version: 0.1.9
 Summary: Writ — the gate before the write. Allow/deny gate with a tamper-evident audit log
 Project-URL: Homepage, https://withwrit.com
 Project-URL: Documentation, https://docs.withwrit.com

{pywrit-0.1.7 → pywrit-0.1.9}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "setuptools.build_meta"
 # Distribution name: pywrit (approved by Chad 2026-09-27).
 # The bare name "writ" is taken on PyPI.
 name = "pywrit"
-version = "0.1.7"
+version = "0.1.9"
 description = "Writ — the gate before the write. Allow/deny gate with a tamper-evident audit log"
 readme = "README.md"
 requires-python = ">=3.9"
@@ -39,3 +39,6 @@ writ = "writ_cli.cli:main"
 [tool.setuptools.packages.find]
 where = ["."]
 include = ["writ_cli*"]
+
+[tool.setuptools.package-data]
+writ_cli = ["templates/*.json"]

{pywrit-0.1.7 → pywrit-0.1.9/pywrit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pywrit
-Version: 0.1.7
+Version: 0.1.9
 Summary: Writ — the gate before the write. Allow/deny gate with a tamper-evident audit log
 Project-URL: Homepage, https://withwrit.com
 Project-URL: Documentation, https://docs.withwrit.com

{pywrit-0.1.7 → pywrit-0.1.9}/pywrit.egg-info/SOURCES.txt

@@ -11,4 +11,8 @@ tests/test_scan_tsjs.py
 writ_cli/__init__.py
 writ_cli/cli.py
 writ_cli/config.py
-writ_cli/risk.py
+writ_cli/risk.py
+writ_cli/templates/audit-first.json
+writ_cli/templates/dev-smooth.json
+writ_cli/templates/prod-safe.json
+writ_cli/templates/strict-ai-defaults.json

{pywrit-0.1.7 → pywrit-0.1.9}/writ_cli/cli.py

@@ -24,6 +24,7 @@ BASE = os.environ.get(
     "WRIT_BASE",
     config.base_url() or "https://api.withwrit.com",
 )
+_JSON_OUTPUT = False
 
 
 def stream_cmd(args):
@@ -11226,14 +11227,12 @@ def request(method, path, payload=None, key=None, token=None):
 def _request_and_print(method, path, payload=None, key=None, token=None):
     """Call request(), print the response, and return a clean exit code.
 
-    Success bodies go to stdout; error bodies go to stderr. This is the
-    helper all simple dispatchers should use so the CLI exits 0 on success.
+    Success bodies go to stdout; error bodies go to stderr. With --json,
+    everything goes to stdout as raw JSON so agents can parse it cleanly.
     """
     code, text = request(method, path, payload, key=key, token=token)
-    if code == 0:
-        print(text)
-        return 0
-    print(text, file=sys.stderr)
+    out = sys.stdout if _JSON_OUTPUT else (sys.stdout if code == 0 else sys.stderr)
+    print(text, file=out)
     return code
 
 
@@ -11258,6 +11257,28 @@ def _load_json_file(path):
     return json.loads(p.read_text(encoding="utf-8"))
 
 
+def _load_policy_template(name):
+    """Find a policy template JSON file by name or path."""
+    candidates = []
+    if "/" in name or name.endswith(".json"):
+        candidates.append(_pathlib.Path(name))
+    candidates.append(_pathlib.Path.home() / ".writ" / "templates" / (name + ".json"))
+    # when run as an installed package
+    try:
+        import writ_cli as _wc
+        candidates.append(_pathlib.Path(_wc.__file__).parent / "templates" / (name + ".json"))
+    except Exception:
+        pass
+    # when running from the repo
+    candidates.append(_pathlib.Path(__file__).parent / "templates" / (name + ".json"))
+    repo = _pathlib.Path(__file__).parent.parent.parent / "docs" / "templates" / "policies" / (name + ".json")
+    candidates.append(repo)
+    for p in candidates:
+        if p.exists():
+            return json.loads(p.read_text(encoding="utf-8"))
+    raise FileNotFoundError("template not found: %s (looked in %s)" % (name, ", ".join(str(c) for c in candidates)))
+
+
 # ---------------------------------------------------------------------------
 # Agent Action Report
 # ---------------------------------------------------------------------------
@@ -11547,6 +11568,10 @@ def report_cmd(args):
 
 def main():
     parser = argparse.ArgumentParser(description="Ask Writ before an agent writes.")
+    json_parent = argparse.ArgumentParser(add_help=False)
+    json_parent.add_argument("--json", action="store_true",
+                           help="Output raw JSON for machine consumption")
+
     sub = parser.add_subparsers(dest="cmd", required=True)
 
     key = sub.add_parser("key", help="Get a free API key + tenant")
@@ -11565,16 +11590,18 @@ def main():
     cfg.add_argument("name", default="", help="Config key")
     cfg.add_argument("value", default="", help="Config value (for set)")
 
-    me = sub.add_parser("me", help="Show tenant, key meta, and policy")
+    me = sub.add_parser("me", parents=[json_parent], help="Show tenant, key meta, and policy")
     me.add_argument("--key", default=config.api_key())
 
     MODES = ("allow", "deny", "require_grant", "step_up")
-    policy = sub.add_parser("policy", help="Get or set tenant verb policy")
+    policy = sub.add_parser("policy", parents=[json_parent], help="Get or set tenant verb policy")
     policy.add_argument("--key", default=config.api_key())
     policy.add_argument("--set", nargs=2, metavar=("VERB", "MODE"), action="append", default=[])
     policy.add_argument("--env", default="", help="Environment override to get/set: dev, staging, or prod (default: tenant policy)")
+    policy.add_argument("--principal", default="", help="Principal id for a per-principal policy override")
+    policy.add_argument("--template", default="", help="Apply a starter template by name (audit-first, prod-safe, dev-smooth, strict-ai-defaults) or path")
 
-    check = sub.add_parser("check", help="ALLOW or DENY a write")
+    check = sub.add_parser("check", parents=[json_parent], help="ALLOW or DENY a write")
     check.add_argument("--key", default=config.api_key())
     check.add_argument("--sponsor", required=True)
     check.add_argument("--agent", required=True)
@@ -11603,7 +11630,8 @@ def main():
     revoked = sub.add_parser("revoked", help="List revoked principals (sponsor token)")
     revoked.add_argument("--sponsor-token", default=config.sponsor_token())
 
-    receipts = sub.add_parser("receipts", help="Latest receipts for your tenant")
+    receipts = sub.add_parser("receipts", parents=[json_parent], help="Latest receipts for your tenant, or one receipt by id")
+    receipts.add_argument("receipt_id", nargs="?", default="", help="Fetch a single receipt by id; omit to list")
     receipts.add_argument("--key", default=config.api_key())
 
     stream = sub.add_parser("stream", help="Tail the live audit log (SSE stream)")
@@ -11615,7 +11643,7 @@ def main():
     verify.add_argument("--key", default=config.api_key())
     verify.add_argument("--limit", type=int, default=200, help="Max receipts to verify (1-1000)")
 
-    invite = sub.add_parser("invite", help="Create a team invite code for your tenant")
+    invite = sub.add_parser("invite", parents=[json_parent], help="Create a team invite code for your tenant")
     invite.add_argument("--key", default=config.api_key())
 
     grant = sub.add_parser("grant", help="Sponsor approval: grant one write (sponsor token)")
@@ -11665,7 +11693,7 @@ def main():
     scan.add_argument("--repo-id", default="",
                       help="Repository identifier for the manifest (default: directory name)")
 
-    report = sub.add_parser("report", help="Agent Action Report from receipts")
+    report = sub.add_parser("report", parents=[json_parent], help="Agent Action Report from receipts")
     rsrc = report.add_mutually_exclusive_group(required=True)
     rsrc.add_argument("--key", default=config.api_key(), help="API key — fetch receipts from the Writ API")
     rsrc.add_argument("--file", help="Read receipts from a local JSON file (array or JSON-lines)")
@@ -11680,7 +11708,7 @@ def main():
     manifest_key = sub.add_parser("manifest-key", help="Fetch the tenant's CI manifest HMAC key")
     manifest_key.add_argument("--key", default=config.api_key())
 
-    manifests = sub.add_parser("manifests", help="List, fetch, or submit CI attestation manifests")
+    manifests = sub.add_parser("manifests", parents=[json_parent], help="List, fetch, or submit CI attestation manifests")
     manifests_sub = manifests.add_subparsers(dest="manifests_cmd", required=True)
     ms_list = manifests_sub.add_parser("list", help="List repos with their latest manifest summary")
     ms_list.add_argument("--key", default=config.api_key())
@@ -11691,7 +11719,7 @@ def main():
     ms_push.add_argument("file")
     ms_push.add_argument("--key", default=config.api_key())
 
-    github = sub.add_parser("github", help="Manage the Writ GitHub App integration")
+    github = sub.add_parser("github", parents=[json_parent], help="Manage the Writ GitHub App integration")
     github_sub = github.add_subparsers(dest="github_cmd", required=True)
     gh_inst = github_sub.add_parser("installations", help="List connected installations")
     gh_inst.add_argument("--key", default=config.api_key())
@@ -11718,7 +11746,105 @@ def main():
     gh_disc.add_argument("--totp-code", default="", help="TOTP step-up code")
     gh_disc.add_argument("--key", default=config.api_key())
 
+    principals = sub.add_parser("principals", parents=[json_parent], help="Manage the tenant identity directory")
+    pr_sub = principals.add_subparsers(dest="principals_cmd", required=True)
+    pr_list = pr_sub.add_parser("list", help="List principals")
+    pr_list.add_argument("--key", default=config.api_key())
+    pr_create = pr_sub.add_parser("create", help="Create a principal")
+    pr_create.add_argument("name")
+    pr_create.add_argument("--key", default=config.api_key())
+    pr_rename = pr_sub.add_parser("rename", help="Rename a principal")
+    pr_rename.add_argument("principal_id")
+    pr_rename.add_argument("new_name")
+    pr_rename.add_argument("--key", default=config.api_key())
+    pr_disable = pr_sub.add_parser("disable", help="Disable a principal (pauses its keys)")
+    pr_disable.add_argument("principal_id")
+    pr_disable.add_argument("--key", default=config.api_key())
+    pr_enable = pr_sub.add_parser("enable", help="Re-enable a principal")
+    pr_enable.add_argument("principal_id")
+    pr_enable.add_argument("--key", default=config.api_key())
+    pr_del = pr_sub.add_parser("delete", help="Delete a principal")
+    pr_del.add_argument("principal_id")
+    pr_del.add_argument("--force", action="store_true", help="Revoke remaining keys first")
+    pr_del.add_argument("--key", default=config.api_key())
+    pr_rev = pr_sub.add_parser("revoke-keys", help="Revoke all API keys for a principal")
+    pr_rev.add_argument("principal_id")
+    pr_rev.add_argument("--key", default=config.api_key())
+
+    verbs = sub.add_parser("verbs", parents=[json_parent], help="Manage the tenant verb vocabulary")
+    vb_sub = verbs.add_subparsers(dest="verbs_cmd", required=True)
+    vb_list = vb_sub.add_parser("list", help="List custom verbs")
+    vb_list.add_argument("--key", default=config.api_key())
+    vb_add = vb_sub.add_parser("add", help="Add a custom verb")
+    vb_add.add_argument("name")
+    vb_add.add_argument("--description", default="")
+    vb_add.add_argument("--resolved-verb", default="", help="Canonical verb this aliases")
+    vb_add.add_argument("--key", default=config.api_key())
+    vb_rename = vb_sub.add_parser("rename", help="Rename or redescribe a custom verb")
+    vb_rename.add_argument("name")
+    vb_rename.add_argument("--new-name", default="")
+    vb_rename.add_argument("--description", default="")
+    vb_rename.add_argument("--key", default=config.api_key())
+    vb_retire = vb_sub.add_parser("retire", help="Retire a custom verb")
+    vb_retire.add_argument("name")
+    vb_retire.add_argument("--key", default=config.api_key())
+
+    keys = sub.add_parser("keys", parents=[json_parent], help="Manage tenant API keys")
+    keys_sub = keys.add_subparsers(dest="keys_cmd", required=True)
+    keys_list = keys_sub.add_parser("list", help="List key metadata")
+    keys_list.add_argument("--key", default=config.api_key())
+    keys_create = keys_sub.add_parser("create", help="Create a new API key (TOTP-gated)")
+    keys_create.add_argument("--label", default="", help="Optional label")
+    keys_create.add_argument("--principal-id", default="", help="Assign to a principal")
+    keys_create.add_argument("--totp-code", default="", help="TOTP step-up code")
+    keys_create.add_argument("--key", default=config.api_key())
+    keys_revoke = keys_sub.add_parser("revoke", help="Revoke an API key by id")
+    keys_revoke.add_argument("key_id")
+    keys_revoke.add_argument("--key", default=config.api_key())
+
+    badge = sub.add_parser("badge", parents=[json_parent], help="Dynamic README badge tokens")
+    badge_sub = badge.add_subparsers(dest="badge_cmd", required=True)
+    badge_create = badge_sub.add_parser("create", help="Create a public badge token")
+    badge_create.add_argument("--label", default="gated")
+    badge_create.add_argument("--key", default=config.api_key())
+    badge_revoke = badge_sub.add_parser("revoke", help="Revoke a badge token")
+    badge_revoke.add_argument("token")
+    badge_revoke.add_argument("--key", default=config.api_key())
+
+    vault = sub.add_parser("vault", parents=[json_parent], help="Credential vault")
+    vault_sub = vault.add_subparsers(dest="vault_cmd", required=True)
+    vault_list = vault_sub.add_parser("list", help="List enrolled credentials")
+    vault_list.add_argument("--key", default=config.api_key())
+
+    stats = sub.add_parser("stats", parents=[json_parent], help="24-hour receipt decision counters")
+    stats.add_argument("--key", default=config.api_key())
+
+    lease = sub.add_parser("lease", parents=[json_parent], help="Create a single-use gated-execution lease")
+    lease.add_argument("--verb", required=True)
+    lease.add_argument("--target", required=True)
+    lease.add_argument("--purpose", required=True)
+    lease.add_argument("--ttl", type=int, default=60, help="Lease TTL in seconds")
+    lease.add_argument("--key", default=config.api_key())
+
+    execute = sub.add_parser("execute", parents=[json_parent], help="Execute a gated upstream request using a lease")
+    execute.add_argument("lease_id")
+    execute.add_argument("--key", default=config.api_key())
+
+    doctor = sub.add_parser("doctor", help="Validate local config and gate connectivity")
+    doctor.add_argument("--key", default=config.api_key())
+    doctor.add_argument("--sponsor-token", default=config.sponsor_token())
+    doctor.add_argument("--base", default=config.base_url())
+
+    mcp_setup = sub.add_parser("mcp-setup", help="Write MCP client config for Claude Desktop or Cursor")
+    mcp_setup.add_argument("--key", default=config.api_key())
+    mcp_setup.add_argument("--base", default=config.base_url())
+    mcp_setup.add_argument("--server-path", default="", help="Path to mcp-server/server.py; omit to use uvx writ-mcp")
+    mcp_setup.add_argument("--claude", action="store_true", help="Write Claude Desktop config (default)")
+    mcp_setup.add_argument("--cursor", action="store_true", help="Write Cursor config")
+
     args = parser.parse_args()
+    global _JSON_OUTPUT
+    _JSON_OUTPUT = bool(getattr(args, "json", False))
     if args.cmd == "key":
         payload = {"email": args.email}
         if args.tenant_name.strip():
@@ -11764,7 +11890,8 @@ def main():
 
     _KEY_COMMANDS = {"me", "policy", "check", "receipts", "stream",
                      "verify-chain", "invite", "token-verify", "manifest-key",
-                     "manifests", "github"}
+                     "manifests", "github", "principals", "verbs", "keys",
+                     "badge", "vault", "stats", "lease", "execute"}
     if args.cmd in _KEY_COMMANDS and not _require_key(args.key):
         return 2
 
@@ -11789,7 +11916,19 @@ def main():
     if args.cmd == "me":
         return _request_and_print("GET", "/v1/me", key=args.key)
     if args.cmd == "policy":
-        url = "/v1/policy" if not args.env else f"/v1/policies/environments/{args.env}"
+        if args.principal:
+            url = "/v1/policies/principals/" + urllib.parse.quote(args.principal, safe="")
+            if args.env:
+                url += "?environment=" + urllib.parse.quote(args.env, safe="")
+        else:
+            url = "/v1/policy" if not args.env else f"/v1/policies/environments/{args.env}"
+        if args.template:
+            try:
+                template = _load_policy_template(args.template)
+            except (FileNotFoundError, ValueError) as exc:
+                print("error: %s" % exc, file=sys.stderr)
+                return 2
+            return _request_and_print("PUT", url, template, key=args.key)
         if args.set:
             for verb, mode in args.set:
                 if mode not in MODES:
@@ -11798,6 +11937,8 @@ def main():
             return _request_and_print("PUT", url, {verb: mode for verb, mode in args.set}, key=args.key)
         return _request_and_print("GET", url, key=args.key)
     if args.cmd == "receipts":
+        if args.receipt_id:
+            return _request_and_print("GET", "/v1/receipts/" + urllib.parse.quote(args.receipt_id, safe=""), key=args.key)
         return _request_and_print("GET", "/v1/receipts", key=args.key)
     if args.cmd == "stream":
         return stream_cmd(args)
@@ -11849,6 +11990,168 @@ def main():
         if args.github_cmd == "disconnect":
             return _request_and_print("POST", "/v1/github/disconnect",
                 {"installationId": args.installation_id, "totpCode": args.totp_code}, key=args.key)
+    if args.cmd == "principals":
+        if args.principals_cmd == "list":
+            return _request_and_print("GET", "/v1/principals", key=args.key)
+        if args.principals_cmd == "create":
+            return _request_and_print("POST", "/v1/principals", {"name": args.name}, key=args.key)
+        if args.principals_cmd == "rename":
+            return _request_and_print("PATCH", "/v1/principals/" + urllib.parse.quote(args.principal_id, safe=""),
+                {"name": args.new_name}, key=args.key)
+        if args.principals_cmd == "disable":
+            return _request_and_print("PATCH", "/v1/principals/" + urllib.parse.quote(args.principal_id, safe=""),
+                {"disabled": True}, key=args.key)
+        if args.principals_cmd == "enable":
+            return _request_and_print("PATCH", "/v1/principals/" + urllib.parse.quote(args.principal_id, safe=""),
+                {"disabled": False}, key=args.key)
+        if args.principals_cmd == "delete":
+            qs = "?force=1" if args.force else ""
+            return _request_and_print("DELETE", "/v1/principals/" + urllib.parse.quote(args.principal_id, safe="") + qs, key=args.key)
+        if args.principals_cmd == "revoke-keys":
+            return _request_and_print("POST", "/v1/principals/" + urllib.parse.quote(args.principal_id, safe="") + "/revoke",
+                {}, key=args.key)
+    if args.cmd == "verbs":
+        if args.verbs_cmd == "list":
+            return _request_and_print("GET", "/v1/verbs", key=args.key)
+        if args.verbs_cmd == "add":
+            body = {"name": args.name}
+            if args.description:
+                body["description"] = args.description
+            if args.resolved_verb:
+                body["resolvedVerb"] = args.resolved_verb
+            return _request_and_print("POST", "/v1/verbs", body, key=args.key)
+        if args.verbs_cmd == "rename":
+            body = {}
+            if args.new_name:
+                body["name"] = args.new_name
+            if args.description:
+                body["description"] = args.description
+            return _request_and_print("PATCH", "/v1/verbs/" + urllib.parse.quote(args.name, safe=""), body, key=args.key)
+        if args.verbs_cmd == "retire":
+            return _request_and_print("DELETE", "/v1/verbs/" + urllib.parse.quote(args.name, safe=""), key=args.key)
+    if args.cmd == "keys":
+        if args.keys_cmd == "list":
+            return _request_and_print("GET", "/v1/keys", key=args.key)
+        if args.keys_cmd == "create":
+            body = {"totpCode": args.totp_code}
+            if args.label:
+                body["label"] = args.label
+            if args.principal_id:
+                body["principalId"] = args.principal_id
+            return _request_and_print("POST", "/v1/keys", body, key=args.key)
+        if args.keys_cmd == "revoke":
+            return _request_and_print("DELETE", "/v1/keys/" + urllib.parse.quote(args.key_id, safe=""), key=args.key)
+    if args.cmd == "badge":
+        if args.badge_cmd == "create":
+            return _request_and_print("POST", "/v1/badge/tokens", {"label": args.label}, key=args.key)
+        if args.badge_cmd == "revoke":
+            return _request_and_print("POST", "/v1/badge/tokens/revoke", {"token": args.token}, key=args.key)
+    if args.cmd == "vault":
+        if args.vault_cmd == "list":
+            return _request_and_print("GET", "/v1/vault", key=args.key)
+    if args.cmd == "stats":
+        return _request_and_print("GET", "/v1/receipts/stats", key=args.key)
+    if args.cmd == "lease":
+        return _request_and_print("POST", "/v1/leases",
+            {"verb": args.verb, "target": args.target, "purpose": args.purpose, "ttlSeconds": args.ttl}, key=args.key)
+    if args.cmd == "execute":
+        return _request_and_print("POST", "/v1/execute", {"leaseId": args.lease_id}, key=args.key)
+    if args.cmd == "doctor":
+        def _mask(s, n=8):
+            if not s or len(s) <= n * 2:
+                return s
+            return s[:n] + "..." + s[-n:]
+        base = args.base or BASE
+        print("Writ doctor")
+        print("  config path: %s" % config._config_path())
+        cfg = config.read_config()
+        if cfg:
+            print("  config values: %s" % ", ".join(
+                "%s=%s" % (k, _mask(v) if "token" in k or "Key" in k else v)
+                for k, v in sorted(cfg.items())
+            ))
+        else:
+            print("  config: (none)")
+        print("  env WRIT_API_KEY: %s" % ("set" if os.environ.get("WRIT_API_KEY") else "not set"))
+        print("  env WRIT_SPONSOR_TOKEN: %s" % ("set" if os.environ.get("WRIT_SPONSOR_TOKEN") else "not set"))
+        print("  env WRIT_BASE: %s" % os.environ.get("WRIT_BASE", "(default)"))
+        print("  resolved base URL: %s" % base)
+        ok = True
+        code, text = request("GET", "/health")
+        if code == 0:
+            print("  /health: OK (%s)" % text.replace("\n", " "))
+        else:
+            print("  /health: FAIL (exit %s)" % code, file=sys.stderr)
+            ok = False
+        if args.key:
+            code, text = request("GET", "/v1/me", key=args.key)
+            if code == 0:
+                print("  /v1/me: OK")
+            else:
+                print("  /v1/me: FAIL (exit %s) — check your API key" % code, file=sys.stderr)
+                ok = False
+        else:
+            print("  /v1/me: skipped (no API key)")
+        if args.sponsor_token:
+            code, text = request("GET", "/v1/revoked", token="Bearer " + args.sponsor_token)
+            if code == 0:
+                print("  /v1/revoked: OK")
+            else:
+                print("  /v1/revoked: FAIL (exit %s) — check your sponsor token" % code, file=sys.stderr)
+                ok = False
+        else:
+            print("  /v1/revoked: skipped (no sponsor token)")
+        if not ok:
+            print("\nFix: run `writ login --email you@example.com` or set WRIT_API_KEY / WRIT_BASE.", file=sys.stderr)
+            return 1
+        return 0
+    if args.cmd == "mcp-setup":
+        def _mcp_config_block(key, base, server_path):
+            env = {"WRIT_API_KEY": key}
+            if base:
+                env["WRIT_BASE"] = base
+            if server_path:
+                return {
+                    "command": sys.executable,
+                    "args": [server_path],
+                    "env": env,
+                }
+            return {
+                "command": "uvx",
+                "args": ["writ-mcp"],
+                "env": env,
+            }
+        key = args.key or config.api_key()
+        if not key:
+            print("error: no API key. Run `writ login` or pass --key.", file=sys.stderr)
+            return 2
+        do_claude = args.claude or not args.cursor
+        do_cursor = args.cursor
+        base = args.base or config.base_url()
+        written = []
+        if do_claude:
+            config_dir = _pathlib.Path.home() / "Library" / "Application Support" / "Claude"
+            config_path = config_dir / "claude_desktop_config.json"
+            if not config_dir.exists():
+                config_dir = _pathlib.Path.home() / ".config" / "Claude"
+                config_path = config_dir / "claude_desktop_config.json"
+            os.makedirs(config_dir, exist_ok=True)
+            data = json.loads(config_path.read_text(encoding="utf-8")) if config_path.exists() else {}
+            data.setdefault("mcpServers", {})["writ"] = _mcp_config_block(key, base, args.server_path)
+            config_path.write_text(json.dumps(data, indent=2) + "\n", encoding="utf-8")
+            written.append(str(config_path))
+        if do_cursor:
+            cursor_dir = _pathlib.Path.home() / ".cursor"
+            cursor_path = cursor_dir / "mcp.json"
+            os.makedirs(cursor_dir, exist_ok=True)
+            data = json.loads(cursor_path.read_text(encoding="utf-8")) if cursor_path.exists() else {}
+            data.setdefault("mcpServers", {})["writ"] = _mcp_config_block(key, base, args.server_path)
+            cursor_path.write_text(json.dumps(data, indent=2) + "\n", encoding="utf-8")
+            written.append(str(cursor_path))
+        print("Wrote MCP config for Writ to:")
+        for p in written:
+            print("  %s" % p)
+        return 0
     if args.cmd in ("revoke", "reinstate", "revoked"):
         if not _require_sponsor_token(args.sponsor_token):
             return 2

pywrit-0.1.9/writ_cli/templates/audit-first.json

@@ -0,0 +1,7 @@
+{
+  "verify": "require_grant",
+  "refund": "require_grant",
+  "provision": "require_grant",
+  "admit": "require_grant",
+  "prescribe": "require_grant"
+}

pywrit-0.1.9/writ_cli/templates/dev-smooth.json

@@ -0,0 +1,7 @@
+{
+  "verify": "allow",
+  "refund": "require_grant",
+  "provision": "require_grant",
+  "admit": "allow",
+  "prescribe": "require_grant"
+}

pywrit-0.1.9/writ_cli/templates/prod-safe.json

@@ -0,0 +1,7 @@
+{
+  "verify": "require_grant",
+  "refund": "step_up",
+  "provision": "step_up",
+  "admit": "require_grant",
+  "prescribe": "require_grant"
+}

pywrit-0.1.9/writ_cli/templates/strict-ai-defaults.json

@@ -0,0 +1,7 @@
+{
+  "verify": "require_grant",
+  "refund": "deny",
+  "provision": "deny",
+  "admit": "require_grant",
+  "prescribe": "require_grant"
+}