taskops-cli 0.3.2__py3-none-any.whl → 0.3.3__py3-none-any.whl

taskops/_version.py

@@ -1,4 +1,4 @@
 from __future__ import annotations
 
 __title__ = "taskops"
-__version__ = "0.3.2"  # single source of truth; pyproject reads it dynamically
+__version__ = "0.3.3"  # single source of truth; pyproject reads it dynamically

taskops/cli/commands.py

@@ -15,7 +15,7 @@ from pathlib import Path
 from . import enrol, watch
 from .. import session, identity
 from .._json import query
-from ..board import DIR, find_root, open_board
+from ..board import DIR, find_root, open_board, read_config
 from ..store import log
 from .._errors import TaskopsError
 from ..gitwork import remote, install, claudefiles
@@ -58,13 +58,15 @@ def join(  # noqa: PLR0913 — one command, one config; each flag is a way IN
     invite: str = "",
     github: bool = False,
 ) -> int:
-    """Connect this repo to a board. Bare like every other verb since the host is
-    recorded and the key is discovered:
-
-        taskops remote add https://host:8787        once per checkout
-        taskops join my-project                     registered key: signs in, done
-        taskops join my-project --invite <id>       first time: enrols the key too
-        taskops join my-project --github            first time, no invite: GitHub vouches
+    """Connect this repo to a board. Bare like every other verb: the address is
+    CARRIED by the clone, the key is discovered, and the recorded remote is the
+    fallback for a checkout that carries nothing:
+
+        taskops join                                a clone: board.json travels, done
+        taskops join --github                       same clone, first time: GitHub vouches
+        taskops join my-project --invite <id>       first time by invite: enrols the key
+        taskops remote add https://host:8787        no carried address? record the host…
+        taskops join my-project                     …and name the board
         taskops join my-project                     no key anywhere + public board: read-only
 
     The name defaults exactly as `board create`'s does (recorded name, else the
@@ -93,8 +95,17 @@ def join(  # noqa: PLR0913 — one command, one config; each flag is a way IN
     root = find_root(here)
     bare = "://" not in target
     if bare:
-        host, name = remote_cli.named(target)
-        target = f"{host}/{name}"
+        # v1's whole ambition, restored (its join.py said it in one line: "a
+        # clone carries `.taskops/board.json`, so the second developer types
+        # two words"). The committed address is read FIRST, so a fresh clone
+        # joins with no URL and no `remote add` — the recorded remote is for
+        # the checkout that has no carried address, or a DIFFERENT board.
+        carried = str(read_config(root).get("url", ""))
+        if carried and target in ("", carried.rsplit("/", 1)[-1]):
+            target = carried
+        else:
+            host, name = remote_cli.named(target)
+            target = f"{host}/{name}"
     base = target.partition("?")[0]
     params = query(target)
     invite = invite or params.get("invite", "")

{taskops_cli-0.3.2.dist-info → taskops_cli-0.3.3.dist-info}/METADATA

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: taskops-cli
-Version: 0.3.2
+Version: 0.3.3
 Summary: A shared work board for teams of coding agents, with a human who decides.
 Project-URL: Repository, https://github.com/bernatch22/taskops
 License-Expression: MIT
@@ -47,8 +47,9 @@ can be misread:
   into it exactly once, to install it and register your key.
 * **A board**: one directory on that host. Created from your laptop with
   `taskops board create`.
-* **A repo**: joined to one board. `taskops remote add` once per checkout, then
-  every command runs bare.
+* **A repo**: joined to one board. A clone carries the board's address
+  (`.taskops/board.json`, committed), so `taskops join` is the whole step;
+  `taskops remote add` covers a checkout that carries none.
 * **Your agents**: they never touch any of this — they talk to the board through
   the eleven MCP tools.
 
@@ -90,10 +91,11 @@ Joining a hosted one is bare, like every other verb — the host is recorded onc
 and the key is discovered the way ssh discovers one:
 
 ```sh
-taskops remote add https://host:8787      # once per checkout
-taskops join my-project                   # your key is registered: that is the credential
-taskops join my-project --invite <id>     # first time: the invite enrols your key too
-taskops join my-project --github          # first time, no invite: GitHub vouches for you
+taskops join                              # a clone: board.json carries the address, done
+taskops join --github                     # same clone, first time: GitHub vouches for you
+taskops join my-project --invite <id>     # first time by invite: it enrols your key too
+taskops remote add https://host:8787      # no carried address? record the host once…
+taskops join my-project                   # …and name the board
 taskops join my-project                   # no key + public board: read-only window
 ```
 
@@ -222,6 +224,59 @@ until an owner records it and cleared again with `--clear`. Only a board that
 has been opted in answers `--github` at all; every other one is invite-only,
 exactly as before.
 
+### The whole flow, and why cloning is not enough
+
+Cloning the repo gives you the board's ADDRESS — `.taskops/board.json` is
+committed and travels with the code — but the host has never seen you: it is a
+different server from GitHub, sharing no session and no cookie with it. So one
+command — `taskops join --github`, no URL: the clone already carries it —
+introduces you, once per checkout, and after that GitHub is not in the picture
+at all.
+
+```
+        GitHub                                the board HOST
+   <owner>/<repo>, private                principals + allowed_signers
+          |                                          |
+ 1. git clone  ->  the code, and .taskops/board.json (the address).
+                   remote.json is 0600 and gitignored: no credential travels.
+          |                                          |
+ 2. taskops join --github   (the carried address)    |
+    |                                                |
+    |-- the CLI finds YOUR token: `gh auth token`, else $GITHUB_TOKEN,
+    |   else a hidden prompt. Never a flag value — the shell writes those
+    |   into ~/.zsh_history before the process starts.
+    |                                                |
+    |-- POST /<board>/join/github ------------------>|
+    |      { github_token, principal, pubkey }       |
+    |                                                |
+    |          the host asks GitHub ONCE, with your token:
+    |          "does this user have <need> on <owner>/<repo>?"
+    |                                                |
+    |          yes -> it writes exactly two rows:    |
+    |                   principals:      <you>, member
+    |                   allowed_signers: <you> ssh-ed25519 AAAA...
+    |          no  -> refused, without saying whether the repo exists
+    |                                                |
+ 3. the GitHub token dies with that request. It is on neither disk.
+
+    from here on GitHub never participates again:
+
+    every session:  your key signs a challenge  ->  the host checks it
+                    (~/.ssh/id_ed25519)             against allowed_signers
+                                                    -> a 12h session
+```
+
+The alternative — re-checking GitHub on every request — would mean the host
+holding somebody else's token, or being handed one on each call. That is the
+whole category of problem this removes: there is no token to steal because
+there is none stored.
+
+**One consequence, stated plainly: access is granted automatically and taken
+back by hand.** Losing push on the repo does not close the board, because the
+credential is no longer GitHub — it is the enrolled key. Remove it with
+`taskops revoke --key SHA256:…`, which is the same verb an invite-enrolled key
+takes.
+
 No URL and no `--key` after `remote add`: the host is recorded in the checkout,
 `board create` records the name, and the key is **discovered** the way ssh
 discovers one — `~/.ssh/id_ed25519`, `id_ecdsa`, `id_rsa`, in that order.

{taskops_cli-0.3.2.dist-info → taskops_cli-0.3.3.dist-info}/RECORD

@@ -4,7 +4,7 @@ taskops/_errors.py,sha256=hBN_ChWVY09f61wNoy2dZPkwhEAQEQF5JRanpENCrNA,1548
 taskops/_ids.py,sha256=97FnOiBVKJ87zAgHj8ia-HZkKqkhx2J6jYeMFjcKq2s,2460
 taskops/_json.py,sha256=8pBzo98KdOKvSV3y3f7H7MF9RNb7zriK3152j8hQCHs,1682
 taskops/_locate.py,sha256=QmmglRfv8rhlqKQWvRdAaiqBdiU05Lxo-varGDSona0,4500
-taskops/_version.py,sha256=iRRyl7Bv-yQ3hYy6KhCfAdbf126hpSkzWrkGC7A1yxI,138
+taskops/_version.py,sha256=c41JEarmRmSUDrwqGrSJhwQs-REk0YwuPsv9lHWoQ5k,138
 taskops/_wire.py,sha256=NrzkgZ5_-vPwETdF2HM_4GgROSdp_L-4rgBbyx-86T0,5392
 taskops/board.py,sha256=GtcEaJmApGdqXpYSDbSyW-UU3zT437LwQgLGbWOq6B8,7867
 taskops/identity.py,sha256=pFNElIrYfbLHL6AFy6yKHvL_bL2gA6pV3rIr7Ugvusc,5351
@@ -14,7 +14,7 @@ taskops/cli/__init__.py,sha256=RyUqzo36ftkMDHiOlBBQpcBXE8iuvYVJLKNw8WZgDCw,150
 taskops/cli/__main__.py,sha256=JZbVGIEQpWgl9VEyTpQL6ORQvj3ODt3ui19x1_0r3Rw,163
 taskops/cli/admin.py,sha256=K04upZZUSms70NpwZ97e-vBSQb9qVeEVzOxprPvIpn8,4021
 taskops/cli/claude.py,sha256=oMeageiJ_wfNloIjhDDHBKWV0RjnYo9Dd9htemlj_m4,9440
-taskops/cli/commands.py,sha256=s8SlIIJRSrNLEBaAOb0fWNxXrm-SbHXORNMIETqi8-0,8574
+taskops/cli/commands.py,sha256=DRBa0HsJVxHGo3dOWZm10T_jnCWEeMMdRdRpeXOejHU,9338
 taskops/cli/enrol.py,sha256=BgyrjT6BebnJILYL4n1JIIE0BD8BHwB29z9nVLw8Pnw,5347
 taskops/cli/grants.py,sha256=LGlDtJLkiMSaxbVvriDzezTQvSAuY2Dcx2J8dqhmghA,2892
 taskops/cli/hooks.py,sha256=C7UREKPZ3DP0PF-fRB2MunfhB9kau7aqgpjhD6sfack,1996
@@ -129,7 +129,7 @@ taskops/verbs/report.py,sha256=WeeeP3C7jO_5DKxIGdvhuCgWVdEREaUIa2CCUv6dUMg,4563
 taskops/verbs/review.py,sha256=L0E0jlW4r7qZU3aDZbW3IUbPUwF4ENMehpW6OUWVlJw,3522
 taskops/verbs/take.py,sha256=HSQVbKCmWxF94pMHxpf9o0SUZZir2IHxwNBahg8Ku2I,4156
 taskops/verbs/update.py,sha256=17HzEmWjr7sFIF11-fMbEI0vzHE9VlYCdokVpaszi7E,8014
-taskops_cli-0.3.2.dist-info/METADATA,sha256=RGfZ05S2xLwAAWFKABV3mB6WXp_ql4lebNpY5sdEiGo,18089
-taskops_cli-0.3.2.dist-info/WHEEL,sha256=lCkmxWfQsSc9CfIClYeavTdQeEX2toPqufh9gI35EQA,87
-taskops_cli-0.3.2.dist-info/entry_points.txt,sha256=vXgZOPfyYUPtaXX8EVEQd7JkXRYU82Nf-gdwV3Gaik0,45
-taskops_cli-0.3.2.dist-info/RECORD,,
+taskops_cli-0.3.3.dist-info/METADATA,sha256=6qgUMO1b5jlIZ3vFIt5CaNGr6x74PPd_7xdYRL5WSI4,21052
+taskops_cli-0.3.3.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
+taskops_cli-0.3.3.dist-info/entry_points.txt,sha256=vXgZOPfyYUPtaXX8EVEQd7JkXRYU82Nf-gdwV3Gaik0,45
+taskops_cli-0.3.3.dist-info/RECORD,,

{taskops_cli-0.3.2.dist-info → taskops_cli-0.3.3.dist-info}/WHEEL

@@ -1,4 +1,4 @@
 Wheel-Version: 1.0
-Generator: hatchling 1.31.0
+Generator: hatchling 1.32.0
 Root-Is-Purelib: true
 Tag: py3-none-any