tarnished-cli 0.1.7__tar.gz → 0.2.0__tar.gz

tarnished_cli-0.2.0/.gitignore

@@ -0,0 +1,66 @@
+# Dependencies and build output
+.venv/
+node_modules/
+.yarn/
+.pnp.*
+.uv/
+dist/
+build/
+*.egg-info/
+*.egg
+*.tsbuildinfo
+
+# Local configuration and data
+.env
+.env.*
+!.env.example
+.envrc.local
+.direnv/
+data/
+uploads/
+postgres_data/
+*.db
+*.sqlite
+*.sqlite3
+docker-compose.override.yml
+docker-compose.override.yaml
+backend/requirements.txt
+
+# Caches and test output
+__pycache__/
+*.py[cod]
+.ruff_cache/
+.pytest_cache/
+.mypy_cache/
+.dmypy.json
+.tox/
+.vite/
+.eslintcache
+.cache/
+.npm/
+.coverage
+coverage/
+htmlcov/
+*.cover
+*.lcov
+*.log
+
+# Editor and operating system files
+.vscode/
+.idea/
+.DS_Store
+Thumbs.db
+*.swp
+*.swo
+*~
+*.tmp
+*.bak
+/core
+core.*
+tmp/
+
+# Browser packages
+*.xpi
+extension/tarnished-chrome.zip
+extension/tarnished-firefox.zip
+extension/package-lock.json

tarnished_cli-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Marko Onakic
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

tarnished_cli-0.2.0/PKG-INFO

@@ -0,0 +1,187 @@
+Metadata-Version: 2.5
+Name: tarnished-cli
+Version: 0.2.0
+Summary: Command-line interface for Tarnished
+Project-URL: Homepage, https://markoonakic.github.io/tarnished/
+Project-URL: Repository, https://github.com/markoonakic/tarnished
+Project-URL: Documentation, https://markoonakic.github.io/tarnished/how-to/use-the-cli/
+License-Expression: MIT
+License-File: LICENSE
+Requires-Python: >=3.12
+Requires-Dist: email-validator>=2.0.0
+Requires-Dist: httpx>=0.28.1
+Requires-Dist: keyring>=25.7.0
+Requires-Dist: pydantic>=2.12.0
+Requires-Dist: typer>=0.23.1
+Requires-Dist: tzlocal>=5.3.1
+Description-Content-Type: text/markdown
+
+# Tarnished CLI
+
+Command-line interface for Tarnished, version **0.2.0**. Use a matching Tarnished backend.
+
+**Documentation:** https://markoonakic.github.io/tarnished/
+
+For the user-facing CLI guide, see:
+- https://markoonakic.github.io/tarnished/how-to/use-the-cli/
+
+## Install
+
+Install version 0.2.0 from PyPI once that release is available:
+
+```bash
+uv tool install tarnished-cli==0.2.0
+```
+
+To install this checkout, including before a release is published, run from the repository root:
+
+```bash
+uv tool install ./cli
+```
+
+Homebrew convenience path (the tap can lag the PyPI release):
+
+```bash
+brew tap markoonakic/tap
+brew install tarnished-cli
+```
+
+To install a downloaded wheel:
+
+```bash
+uv tool install ./dist/tarnished_cli-<version>-py3-none-any.whl
+```
+
+## Authentication
+
+Tarnished CLI is API-key-first.
+
+1. Create or rotate the API key in the Tarnished web app.
+2. Prefer the **CLI** preset so the key includes the scopes the CLI expects.
+3. Validate and store the key locally:
+
+```bash
+tarnished auth init --api-key '...'
+```
+
+4. Run the auth doctor to confirm the stored key, live auth check, and required
+   CLI scopes all pass:
+
+```bash
+tarnished auth doctor
+tarnished auth whoami
+```
+
+5. Clear the locally stored key when needed:
+
+```bash
+tarnished auth api-key clear
+```
+
+The web app remains the source of truth for API keys. The CLI does **not**
+create, rotate, revoke, or otherwise manage remote API keys.
+
+The CLI uses the system keyring when available. Otherwise, it stores the key in
+a private file in the CLI config directory. `TARNISHED_API_KEY` overrides stored
+credentials. Clearing a stored key does not unset this environment variable.
+
+## Usage
+
+Global options go before the command:
+
+```bash
+tarnished --base-url https://tarnished.example.com auth status
+tarnished --profile work --json applications list
+tarnished applications --help
+```
+
+Create `config.json` in `~/.config/tarnished` (or
+`$XDG_CONFIG_HOME/tarnished`) to set profiles:
+
+```json
+{
+  "default_profile": "default",
+  "profiles": {
+    "default": { "base_url": "http://127.0.0.1:5577", "output": "json" },
+    "work": { "base_url": "https://tarnished.example.com", "output": "json" }
+  }
+}
+```
+
+`--config-dir` and `TARNISHED_CONFIG_DIR` override this directory. Server URL
+precedence is `--base-url`, then `TARNISHED_BASE_URL`, then the selected profile.
+Use a trusted server: URL overrides send the selected profile's key to that server.
+The CLI follows same-origin redirects but rejects cross-origin or
+credential-bearing URLs. Use the final server URL where possible.
+
+JSON is the default output. Set the profile's output to `text` or use
+`TARNISHED_OUTPUT=text` for text output; `--json` overrides both. API and local
+configuration errors exit with code 1. JSON errors go to stdout; text errors go
+to stderr. Invalid command arguments use Typer's standard error output.
+
+Imports, reports, and transcriptions support `--wait`, `--poll-interval`, and
+`--timeout-seconds`. A local wait timeout does not cancel server work. Report
+waits stop if another job replaces the submitted job. Review the saved state
+before retrying an AI or speech request, which can incur provider charges.
+
+## Development
+
+```bash
+cd cli
+uv sync
+uv run tarnished --help
+uv run pytest -q
+uv run ruff check .
+uv run ruff format --check .
+uv run pyright
+uv build
+```
+
+## Release
+
+The repository release workflow builds CLI distributions, uploads them to the
+GitHub release, and publishes the CLI to PyPI by default. Homebrew tap updates
+run in the separate `homebrew-tap.yml` workflow after Homebrew's 24-hour PyPI
+resource-resolution cooldown window has elapsed.
+
+### One-Time PyPI Trusted Publishing Setup
+
+1. Create the `tarnished-cli` project on PyPI.
+2. In the PyPI project settings, add a Trusted Publisher for this GitHub repository.
+3. Use these values:
+   - Owner: `markoonakic`
+   - Repository: `tarnished`
+   - Workflow name: `release.yml`
+   - Environment name: `pypi`
+
+### One-Time Homebrew Tap Automation Setup
+
+1. Create a write-enabled deploy key for `markoonakic/homebrew-tap`.
+2. Add the private key to this repository as the `HOMEBREW_TAP_DEPLOY_KEY` secret.
+3. The dedicated `homebrew-tap.yml` workflow will:
+   - wait until the target PyPI release is older than Homebrew's 24-hour Python resource cooldown window
+   - update `Formula/tarnished-cli.rb` from PyPI metadata
+   - refresh Python resource blocks with `brew update-python-resources`
+   - build the formula from source and run `brew test tarnished-cli`
+   - push the tap update to `markoonakic/homebrew-tap`
+
+Why separate from the main release workflow?
+
+- Homebrew's Python dependency resolver intentionally excludes PyPI uploads from the last 24 hours when refreshing resource blocks.
+- Keeping tap sync separate avoids false-negative release failures while still following Homebrew's documented Python-formula workflow.
+
+### Release Outputs
+
+`release.yml` publishes:
+
+- `cli/dist/*.whl`
+- `cli/dist/*.tar.gz`
+
+to the GitHub release and publishes the package to PyPI.
+
+`homebrew-tap.yml` then updates the Homebrew tap separately once the published
+sdist is old enough for `brew update-python-resources` to resolve safely.
+
+## License
+
+MIT. The wheel and source distribution include the LICENSE file.

tarnished_cli-0.2.0/README.md

@@ -0,0 +1,169 @@
+# Tarnished CLI
+
+Command-line interface for Tarnished, version **0.2.0**. Use a matching Tarnished backend.
+
+**Documentation:** https://markoonakic.github.io/tarnished/
+
+For the user-facing CLI guide, see:
+- https://markoonakic.github.io/tarnished/how-to/use-the-cli/
+
+## Install
+
+Install version 0.2.0 from PyPI once that release is available:
+
+```bash
+uv tool install tarnished-cli==0.2.0
+```
+
+To install this checkout, including before a release is published, run from the repository root:
+
+```bash
+uv tool install ./cli
+```
+
+Homebrew convenience path (the tap can lag the PyPI release):
+
+```bash
+brew tap markoonakic/tap
+brew install tarnished-cli
+```
+
+To install a downloaded wheel:
+
+```bash
+uv tool install ./dist/tarnished_cli-<version>-py3-none-any.whl
+```
+
+## Authentication
+
+Tarnished CLI is API-key-first.
+
+1. Create or rotate the API key in the Tarnished web app.
+2. Prefer the **CLI** preset so the key includes the scopes the CLI expects.
+3. Validate and store the key locally:
+
+```bash
+tarnished auth init --api-key '...'
+```
+
+4. Run the auth doctor to confirm the stored key, live auth check, and required
+   CLI scopes all pass:
+
+```bash
+tarnished auth doctor
+tarnished auth whoami
+```
+
+5. Clear the locally stored key when needed:
+
+```bash
+tarnished auth api-key clear
+```
+
+The web app remains the source of truth for API keys. The CLI does **not**
+create, rotate, revoke, or otherwise manage remote API keys.
+
+The CLI uses the system keyring when available. Otherwise, it stores the key in
+a private file in the CLI config directory. `TARNISHED_API_KEY` overrides stored
+credentials. Clearing a stored key does not unset this environment variable.
+
+## Usage
+
+Global options go before the command:
+
+```bash
+tarnished --base-url https://tarnished.example.com auth status
+tarnished --profile work --json applications list
+tarnished applications --help
+```
+
+Create `config.json` in `~/.config/tarnished` (or
+`$XDG_CONFIG_HOME/tarnished`) to set profiles:
+
+```json
+{
+  "default_profile": "default",
+  "profiles": {
+    "default": { "base_url": "http://127.0.0.1:5577", "output": "json" },
+    "work": { "base_url": "https://tarnished.example.com", "output": "json" }
+  }
+}
+```
+
+`--config-dir` and `TARNISHED_CONFIG_DIR` override this directory. Server URL
+precedence is `--base-url`, then `TARNISHED_BASE_URL`, then the selected profile.
+Use a trusted server: URL overrides send the selected profile's key to that server.
+The CLI follows same-origin redirects but rejects cross-origin or
+credential-bearing URLs. Use the final server URL where possible.
+
+JSON is the default output. Set the profile's output to `text` or use
+`TARNISHED_OUTPUT=text` for text output; `--json` overrides both. API and local
+configuration errors exit with code 1. JSON errors go to stdout; text errors go
+to stderr. Invalid command arguments use Typer's standard error output.
+
+Imports, reports, and transcriptions support `--wait`, `--poll-interval`, and
+`--timeout-seconds`. A local wait timeout does not cancel server work. Report
+waits stop if another job replaces the submitted job. Review the saved state
+before retrying an AI or speech request, which can incur provider charges.
+
+## Development
+
+```bash
+cd cli
+uv sync
+uv run tarnished --help
+uv run pytest -q
+uv run ruff check .
+uv run ruff format --check .
+uv run pyright
+uv build
+```
+
+## Release
+
+The repository release workflow builds CLI distributions, uploads them to the
+GitHub release, and publishes the CLI to PyPI by default. Homebrew tap updates
+run in the separate `homebrew-tap.yml` workflow after Homebrew's 24-hour PyPI
+resource-resolution cooldown window has elapsed.
+
+### One-Time PyPI Trusted Publishing Setup
+
+1. Create the `tarnished-cli` project on PyPI.
+2. In the PyPI project settings, add a Trusted Publisher for this GitHub repository.
+3. Use these values:
+   - Owner: `markoonakic`
+   - Repository: `tarnished`
+   - Workflow name: `release.yml`
+   - Environment name: `pypi`
+
+### One-Time Homebrew Tap Automation Setup
+
+1. Create a write-enabled deploy key for `markoonakic/homebrew-tap`.
+2. Add the private key to this repository as the `HOMEBREW_TAP_DEPLOY_KEY` secret.
+3. The dedicated `homebrew-tap.yml` workflow will:
+   - wait until the target PyPI release is older than Homebrew's 24-hour Python resource cooldown window
+   - update `Formula/tarnished-cli.rb` from PyPI metadata
+   - refresh Python resource blocks with `brew update-python-resources`
+   - build the formula from source and run `brew test tarnished-cli`
+   - push the tap update to `markoonakic/homebrew-tap`
+
+Why separate from the main release workflow?
+
+- Homebrew's Python dependency resolver intentionally excludes PyPI uploads from the last 24 hours when refreshing resource blocks.
+- Keeping tap sync separate avoids false-negative release failures while still following Homebrew's documented Python-formula workflow.
+
+### Release Outputs
+
+`release.yml` publishes:
+
+- `cli/dist/*.whl`
+- `cli/dist/*.tar.gz`
+
+to the GitHub release and publishes the package to PyPI.
+
+`homebrew-tap.yml` then updates the Homebrew tap separately once the published
+sdist is old enough for `brew update-python-resources` to resolve safely.
+
+## License
+
+MIT. The wheel and source distribution include the LICENSE file.

tarnished_cli-0.2.0/examples/evidence/current-meaning.json

@@ -0,0 +1 @@
+{ "meaning": "rejected", "expected_revision": 0 }

tarnished_cli-0.2.0/examples/evidence/document-text.json

@@ -0,0 +1,4 @@
+{
+  "text": "Synthetic pasted document text for analysis. Replace with the document's real text.",
+  "expected_revision": 0
+}

tarnished_cli-0.2.0/examples/evidence/history-correction.json

@@ -0,0 +1 @@
+{ "to_meaning": "interviewing", "expected_revision": 0 }

tarnished_cli-0.2.0/examples/evidence/insights.json

@@ -0,0 +1 @@
+{ "period": "all", "as_of": "2026-01-07T09:00:00Z" }

tarnished_cli-0.2.0/examples/evidence/report-intent-pipeline.json

@@ -0,0 +1,5 @@
+{
+  "intent_id": "22222222-2222-2222-2222-222222222222",
+  "config_revision": "0",
+  "period": "30d"
+}

tarnished_cli-0.2.0/examples/evidence/report-intent.json

@@ -0,0 +1,5 @@
+{
+  "intent_id": "11111111-1111-1111-1111-111111111111",
+  "generation": 0,
+  "config_revision": "0"
+}

tarnished_cli-0.2.0/examples/evidence/response-clear.json

@@ -0,0 +1 @@
+{ "response_evidence": null, "expected_revision": 0 }

tarnished_cli-0.2.0/examples/evidence/response-record.json

@@ -0,0 +1,7 @@
+{
+  "response_evidence": {
+    "occurred_on": null,
+    "reference": "Synthetic employer response"
+  },
+  "expected_revision": 0
+}

tarnished_cli-0.2.0/examples/evidence/transcript-edit.json

@@ -0,0 +1,9 @@
+{
+  "segments": [
+    {
+      "id": "replace-with-a-real-segment-id",
+      "text": "Corrected sentence text.",
+      "speaker": null
+    }
+  ]
+}

tarnished_cli-0.2.0/examples/evidence/transcript-paste.json

@@ -0,0 +1,4 @@
+{
+  "text": "Interviewer: Thanks for joining.\nCandidate: Glad to be here.",
+  "format": "txt"
+}

{tarnished_cli-0.1.7 → tarnished_cli-0.2.0}/pyproject.toml

@@ -1,8 +1,10 @@
 [project]
 name = "tarnished-cli"
-version = "0.1.7"
-description = "Agent-first CLI for Tarnished"
+version = "0.2.0"
+description = "Command-line interface for Tarnished"
 readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
 requires-python = ">=3.12"
 dependencies = [
     "httpx>=0.28.1",
@@ -10,13 +12,19 @@ dependencies = [
     "pydantic>=2.12.0",
     "email-validator>=2.0.0",
     "typer>=0.23.1",
+    "tzlocal>=5.3.1",
 ]
 
+[project.urls]
+Homepage = "https://markoonakic.github.io/tarnished/"
+Repository = "https://github.com/markoonakic/tarnished"
+Documentation = "https://markoonakic.github.io/tarnished/how-to/use-the-cli/"
+
 [project.scripts]
 tarnished = "tarnished_cli.main:app"
 
 [build-system]
-requires = ["hatchling"]
+requires = ["hatchling>=1.27"]
 build-backend = "hatchling.build"
 
 [tool.hatch.build.targets.wheel]

{tarnished_cli-0.1.7 → tarnished_cli-0.2.0}/src/tarnished_cli/auth_diagnostics.py

@@ -6,7 +6,7 @@ from typing import Any
 from pydantic import ValidationError
 
 from tarnished_cli.auth_storage import StoredAuth
-from tarnished_cli.client import CLIError
+from tarnished_cli.client import CLIError, redact_credentials
 from tarnished_cli.models.auth import AuthDiagnostics, LiveAuthIdentity
 
 API_KEY_PREFIX_LENGTH = 8
@@ -26,6 +26,7 @@ CLI_REQUIRED_SCOPES = (
     "round_types:write",
     "dashboard:read",
     "analytics:read",
+    "analytics:generate",
     "streak:read",
     "streak:write",
     "preferences:read",
@@ -49,7 +50,7 @@ def parse_live_identity(payload: object) -> LiveAuthIdentity:
 
 
 def stored_api_key_prefix(api_key: str | None) -> str | None:
-    if not api_key:
+    if not api_key or len(api_key) <= API_KEY_PREFIX_LENGTH:
         return None
     return api_key[:API_KEY_PREFIX_LENGTH]
 
@@ -63,7 +64,7 @@ def build_auth_diagnostics(
 ) -> AuthDiagnostics:
     return AuthDiagnostics(
         profile=profile,
-        base_url=base_url,
+        base_url=redact_credentials(base_url, stored_auth.api_key),
         has_stored_api_key=bool(stored_auth.api_key),
         stored_api_key_prefix=stored_api_key_prefix(stored_auth.api_key),
         live_identity=_coerce_live_identity(live_identity),

{tarnished_cli-0.1.7 → tarnished_cli-0.2.0}/src/tarnished_cli/auth_storage.py

@@ -9,7 +9,9 @@ import keyring
 from keyring.errors import KeyringError, PasswordDeleteError
 from pydantic import BaseModel
 
+from tarnished_cli.client import CLIError
 from tarnished_cli.config import resolve_config_dir
+from tarnished_cli.files import write_private_file
 
 API_KEY_ENV = "TARNISHED_API_KEY"
 KEYRING_SERVICE = "tarnished-cli"
@@ -41,21 +43,29 @@ def _env_auth() -> StoredAuth | None:
 def _read_auth_file(path: Path) -> StoredAuth:
     if not path.exists():
         return StoredAuth()
-    return StoredAuth.model_validate(json.loads(path.read_text()))
+    return StoredAuth.model_validate(json.loads(path.read_text(encoding="utf-8")))
 
 
 def _write_auth_file(path: Path, auth: StoredAuth) -> None:
-    path.parent.mkdir(parents=True, exist_ok=True)
-    with contextlib.suppress(OSError):
-        path.parent.chmod(0o700)
-    path.write_text(json.dumps(auth.model_dump(mode="json"), sort_keys=True) + "\n")
-    with contextlib.suppress(OSError):
-        path.chmod(0o600)
+    try:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        with contextlib.suppress(OSError):
+            path.parent.chmod(0o700)
+        content = json.dumps(auth.model_dump(mode="json"), sort_keys=True) + "\n"
+        write_private_file(path, content.encode("utf-8"))
+    except OSError:
+        raise CLIError(
+            "Could not save API key. Check config directory permissions and disk space."
+        ) from None
 
 
 def _remove_auth_file(path: Path) -> None:
-    if path.exists():
-        path.unlink()
+    try:
+        path.unlink(missing_ok=True)
+    except OSError:
+        raise CLIError(
+            "Could not remove stored API key. Check config directory permissions."
+        ) from None
 
 
 def load_auth(