tavus-cli 0.3.2__tar.gz → 0.3.3__tar.gz

{tavus_cli-0.3.2 → tavus_cli-0.3.3}/.env.example

@@ -8,28 +8,35 @@
 #   TAVUS_PUBLIC_API_BASE_URL=https://test.rqh.tavusapi.com/v2
 #   TAVUS_PORTAL_API_BASE_URL=https://test-api.tavus.io/api
 #   TAVUS_DEV_PORTAL_URL=https://dev.platform.tavus.io
+#   TAVUS_PAL_MAKER_URL=https://dev.maker.tavus.io
 # STG defaults:
 #   TAVUS_PUBLIC_API_BASE_URL=https://stg.rqh.tavusapi.com/v2
 #   TAVUS_PORTAL_API_BASE_URL=https://stg-api.tavus.io/api
 #   TAVUS_DEV_PORTAL_URL=https://stage.platform.tavus.io
+#   TAVUS_PAL_MAKER_URL=https://stage.maker.tavus.io
 # PROD defaults:
 #   TAVUS_PUBLIC_API_BASE_URL=https://tavusapi.com/v2
 #   TAVUS_PORTAL_API_BASE_URL=https://prod-api.tavus.io/api
 #   TAVUS_DEV_PORTAL_URL=https://platform.tavus.io
+#   TAVUS_PAL_MAKER_URL=https://maker.tavus.io
 TAVUS_PUBLIC_API_BASE_URL=
 TAVUS_PORTAL_API_BASE_URL=
 TAVUS_DEV_PORTAL_URL=
+TAVUS_PAL_MAKER_URL=
 
 # Optional per-env overrides. These beat the defaults but not the generic vars above.
 TAVUS_TEST_PUBLIC_API_BASE_URL=
 TAVUS_TEST_PORTAL_API_BASE_URL=
 TAVUS_TEST_DEV_PORTAL_URL=
+TAVUS_TEST_PAL_MAKER_URL=
 TAVUS_STG_PUBLIC_API_BASE_URL=
 TAVUS_STG_PORTAL_API_BASE_URL=
 TAVUS_STG_DEV_PORTAL_URL=
+TAVUS_STG_PAL_MAKER_URL=
 TAVUS_PROD_PUBLIC_API_BASE_URL=
 TAVUS_PROD_PORTAL_API_BASE_URL=
 TAVUS_PROD_DEV_PORTAL_URL=
+TAVUS_PROD_PAL_MAKER_URL=
 
 # Optional auth fallback. If set, it wins over keyring for the selected env.
 TAVUS_API_KEY=

{tavus_cli-0.3.2 → tavus_cli-0.3.3}/.github/workflows/ci.yml

@@ -38,3 +38,22 @@ jobs:
         run: uv run pytest -q
       - name: Build
         run: uv build
+
+  worker:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    defaults:
+      run:
+        working-directory: workers/tavus-mcp
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: workers/tavus-mcp/package-lock.json
+      - run: npm ci
+      - name: Type-check
+        run: npm run build
+      - name: Test hosted MCP and parity
+        run: npm test

{tavus_cli-0.3.2 → tavus_cli-0.3.3}/.github/workflows/pr-reviews.yml

@@ -17,7 +17,7 @@ jobs:
         uses: Tavus-Engineering/pr-changelog-action/review@main
         with:
           slack-bot-token: ${{ secrets.CVI_BOT_SLACK_TOKEN }}
-          slack-channel-id: C0AFT2E9D5Y
+          slack-channel-id: C0AGPSMKQ3Z
           github-token: ${{ secrets.GITHUB_TOKEN }}
           repo: ${{ github.repository }}
           pr-number: ${{ github.event.pull_request.number }}

tavus_cli-0.3.3/AGENTS.md

@@ -0,0 +1,37 @@
+# Repository instructions
+
+## Git worktrees
+
+- Do not create or use Git worktrees in this repository. Use the primary checkout and ordinary branches.
+- If an exceptional task already uses a worktree, remove it immediately after its pull request is merged or closed.
+- Before removing a worktree, verify that it has no uncommitted work and that its pull request or branch state is accounted for. After removal, prune the worktree metadata and delete the merged local branch.
+
+## Plain language for published writing (ISO 24495-1)
+
+Anything an agent writes for people to read follows ISO 24495-1, the plain
+language standard. That covers PR titles and descriptions, PR and review
+comments, commit message bodies, release notes, Slack posts, docs, MCP tool
+descriptions, and CLI help text. The standard's four principles, applied to
+this repo's output:
+
+1. **Relevant** — decide who will read this and what they need from it, and
+   write only that. A reviewer needs the goal, the approach, and the risks,
+   not a file-by-file tour. Cut anything the reader can't act on.
+2. **Findable** — put the most important information first. Use informative
+   headings and short paragraphs so the reader can scan. One idea per
+   paragraph. In a PR body, the first sentence says what the change does and
+   why.
+3. **Understandable** — short sentences, active voice, everyday words. Expand
+   project shorthand (RQH, CVI, PAL, carrier) on first use unless every
+   reader shares it. Use one term per concept; don't alternate between
+   synonyms.
+4. **Usable** — the reader should know what to do after reading: what to
+   review, what to decide, what to verify. When there's an action, state it
+   explicitly.
+
+Write like a person. Skip AI-tell words ("delve", "comprehensive",
+"leverage"), filler openings ("This PR aims to..."), and dense em-dash or
+arrow-chain shorthand where a full sentence is clearer.
+
+MCP tool descriptions and CLI `--help` text ship to end users; hold them to
+the same standard as any other published writing.

{tavus_cli-0.3.2 → tavus_cli-0.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: tavus-cli
-Version: 0.3.2
+Version: 0.3.3
 Summary: Tavus CLI and MCP server for agentic PAL creation and editing.
 Requires-Python: >=3.11
 Requires-Dist: fastmcp>=2.0.0
@@ -11,6 +11,8 @@ Requires-Dist: pydantic>=2.7.0
 Requires-Dist: python-dotenv>=1.0.0
 Requires-Dist: rich>=13.7.0
 Requires-Dist: typer>=0.12.0
+Provides-Extra: daily
+Requires-Dist: daily-python>=0.31.0; extra == 'daily'
 Provides-Extra: dev
 Requires-Dist: pytest-asyncio>=0.23.0; extra == 'dev'
 Requires-Dist: pytest>=8.2.0; extra == 'dev'
@@ -38,9 +40,9 @@ The PAL Maker project is the **human** builder — face-driven, in-product. This
 
 ## Out of scope (for now)
 
-- Face/video preview surfaces (live in the PAL Maker)
 - Marketplace / sharing UX
 - Multi-tenant auth beyond the existing dev-portal token model
+- Deploying customer applications or infrastructure
 
 ## Local Setup
 
@@ -68,6 +70,11 @@ TAVUS_ENV=TEST TAVUS_API_KEY=... uv run tavus pal list
 uv run tavus --env TEST pal list
 ```
 
+PAL creation responses include `pal_url`, a direct link to the matching
+`dev.maker.tavus.io`, `stage.maker.tavus.io`, or `maker.tavus.io` editor.
+Set `TAVUS_PAL_MAKER_URL` (or its environment-specific variant) only when a
+custom PAL Maker deployment should override that default.
+
 The login flow opens the dev-portal at `/dev/cli-authorize` with a loopback callback URL and an
 anti-CSRF state. The dev-portal mints an API key for your signed-in user (tagged `source: cli`) and
 POSTs it back to the loopback receiver. The CLI stores that key in the OS keychain under the
@@ -132,6 +139,14 @@ requires `TAVUS_PORTAL_BEARER_TOKEN`. PAL Knowledge attachment uses
 
 MCP tools return data and file manifests. They do not write files.
 
+Full-pipeline PAL creation defaults to `tavus-gemma-4` with speculative
+inference enabled. Tools are first-class
+`/v2/tools` resources and attach through top-level `tool_ids` or
+`tavus_pal_tools_attach`; inline `layers.llm.tools` and perception tool arrays
+are not accepted by the MCP or CLI. `tavus_voice_list` exposes new stock Voice
+releases directly instead of requiring callers to discover the generic
+`tavus_resource_list` form.
+
 ## Cloudflare Worker
 
 The remote MCP server lives in `workers/tavus-mcp/` and uses Cloudflare's
@@ -159,12 +174,24 @@ Claude Code example:
 claude mcp add -s user --transport http tavus https://mcp.tavus.io/mcp
 ```
 
+Claude.ai and ChatGPT custom connectors use the same URL:
+`https://mcp.tavus.io/mcp`. Their remote HTTPS OAuth callback URLs are accepted
+through dynamic client registration. The Worker accepts only the documented
+Claude and ChatGPT callback shapes; other hosted clients must be explicitly
+registered with `MCP_OAUTH_CLIENTS`. No manually copied OAuth client ID is
+required for Claude or ChatGPT.
+
 The OAuth authorize step redirects to Tavus developer portal
 `/dev/cli-authorize?mode=oauth`. After the user signs in, the portal mints a
-per-user Tavus API key and redirects back to the MCP client's loopback callback.
-The Worker exchanges that code for an MCP bearer token, then forwards the bearer
-to RQH as `x-api-key`. This keeps Tavus API keys user-scoped and out of MCP
-client configuration.
+per-user Tavus API key and returns it to the Worker's trusted
+`/oauth/callback`. The Worker issues an opaque, short-lived authorization code,
+verifies PKCE plus the client, redirect, and MCP resource at `/token`, then
+forwards the resulting bearer to RQH as `x-api-key`. This keeps Tavus API keys
+user-scoped and out of MCP client configuration and browser callback URLs.
+The portal first verifies the Worker's signed request, posts the API key only to
+the callback for the matching environment, and shows the final connector
+destination before the user authorizes it. A SQLite-backed Durable Object makes
+both the authorization request and code one-time to prevent replay.
 
 Developer portal must support the `mode=oauth` authorize flow for remote MCP
 auth to complete. If a local portal is running on port 3000, test the full
@@ -192,6 +219,17 @@ Worker runtime secrets, such as the legacy `TAVUS_API_KEY` or
 `wrangler secret put <NAME> --env <environment>`. They persist across deploys;
 the GitHub workflow does not read or overwrite them.
 
+Remote OAuth also requires a random secret of at least 32 characters in every
+deployed Worker environment:
+
+```bash
+npx wrangler secret put MCP_OAUTH_SIGNING_SECRET --env stg
+npx wrangler secret put MCP_OAUTH_SIGNING_SECRET --env prod
+```
+
+Use different values in staging and production. Do not store either value in
+Git or a Wrangler vars block.
+
 Merges to `main` automatically run the `Deploy Tavus MCP Worker` workflow for
 `prod`. You can also run the workflow manually for `test`, `stg`, or `prod`.
 The public MCP endpoint is always `https://mcp.tavus.io/mcp`. The
@@ -220,6 +258,26 @@ points at the protected-resource metadata URL. A `404 Not Found` at discovery
 usually means the Worker version serving the custom domain does not include the
 OAuth routes yet.
 
+### Keeping local and hosted MCP current
+
+Every remotely usable Tavus feature must be added to the Python MCP/CLI and the
+hosted Worker in the same change. The Worker parity test compares both tool
+manifests and fails CI when a new difference is not explicitly classified.
+Local-file uploads and the legacy Builder flow are the current documented
+exceptions.
+
+For each feature release:
+
+1. Add or update the local SDK/MCP/CLI contract and the hosted Worker tool.
+2. Add schema and transport tests, including the hosted tool name in the parity
+   test automatically by registering it in `tavus.ts`.
+3. Run `uv run ruff check .`, `uv run pytest -q`, `npm run build`, and
+   `npm test`. CI runs both Python and Worker suites on every PR.
+4. Deploy and test `mcp.tavus-preview.io/mcp` first, including a real connector
+   OAuth login and the feature's write/read/cleanup cycle.
+5. Merge to deploy production, then repeat the connector and MCP tool smoke test
+   at `mcp.tavus.io/mcp`.
+
 ## Codex Skill
 
 A publishable Codex skill for this repo lives at `skills/tavus-agentic-pals/`.

{tavus_cli-0.3.2 → tavus_cli-0.3.3}/README.md

@@ -18,9 +18,9 @@ The PAL Maker project is the **human** builder — face-driven, in-product. This
 
 ## Out of scope (for now)
 
-- Face/video preview surfaces (live in the PAL Maker)
 - Marketplace / sharing UX
 - Multi-tenant auth beyond the existing dev-portal token model
+- Deploying customer applications or infrastructure
 
 ## Local Setup
 
@@ -48,6 +48,11 @@ TAVUS_ENV=TEST TAVUS_API_KEY=... uv run tavus pal list
 uv run tavus --env TEST pal list
 ```
 
+PAL creation responses include `pal_url`, a direct link to the matching
+`dev.maker.tavus.io`, `stage.maker.tavus.io`, or `maker.tavus.io` editor.
+Set `TAVUS_PAL_MAKER_URL` (or its environment-specific variant) only when a
+custom PAL Maker deployment should override that default.
+
 The login flow opens the dev-portal at `/dev/cli-authorize` with a loopback callback URL and an
 anti-CSRF state. The dev-portal mints an API key for your signed-in user (tagged `source: cli`) and
 POSTs it back to the loopback receiver. The CLI stores that key in the OS keychain under the
@@ -112,6 +117,14 @@ requires `TAVUS_PORTAL_BEARER_TOKEN`. PAL Knowledge attachment uses
 
 MCP tools return data and file manifests. They do not write files.
 
+Full-pipeline PAL creation defaults to `tavus-gemma-4` with speculative
+inference enabled. Tools are first-class
+`/v2/tools` resources and attach through top-level `tool_ids` or
+`tavus_pal_tools_attach`; inline `layers.llm.tools` and perception tool arrays
+are not accepted by the MCP or CLI. `tavus_voice_list` exposes new stock Voice
+releases directly instead of requiring callers to discover the generic
+`tavus_resource_list` form.
+
 ## Cloudflare Worker
 
 The remote MCP server lives in `workers/tavus-mcp/` and uses Cloudflare's
@@ -139,12 +152,24 @@ Claude Code example:
 claude mcp add -s user --transport http tavus https://mcp.tavus.io/mcp
 ```
 
+Claude.ai and ChatGPT custom connectors use the same URL:
+`https://mcp.tavus.io/mcp`. Their remote HTTPS OAuth callback URLs are accepted
+through dynamic client registration. The Worker accepts only the documented
+Claude and ChatGPT callback shapes; other hosted clients must be explicitly
+registered with `MCP_OAUTH_CLIENTS`. No manually copied OAuth client ID is
+required for Claude or ChatGPT.
+
 The OAuth authorize step redirects to Tavus developer portal
 `/dev/cli-authorize?mode=oauth`. After the user signs in, the portal mints a
-per-user Tavus API key and redirects back to the MCP client's loopback callback.
-The Worker exchanges that code for an MCP bearer token, then forwards the bearer
-to RQH as `x-api-key`. This keeps Tavus API keys user-scoped and out of MCP
-client configuration.
+per-user Tavus API key and returns it to the Worker's trusted
+`/oauth/callback`. The Worker issues an opaque, short-lived authorization code,
+verifies PKCE plus the client, redirect, and MCP resource at `/token`, then
+forwards the resulting bearer to RQH as `x-api-key`. This keeps Tavus API keys
+user-scoped and out of MCP client configuration and browser callback URLs.
+The portal first verifies the Worker's signed request, posts the API key only to
+the callback for the matching environment, and shows the final connector
+destination before the user authorizes it. A SQLite-backed Durable Object makes
+both the authorization request and code one-time to prevent replay.
 
 Developer portal must support the `mode=oauth` authorize flow for remote MCP
 auth to complete. If a local portal is running on port 3000, test the full
@@ -172,6 +197,17 @@ Worker runtime secrets, such as the legacy `TAVUS_API_KEY` or
 `wrangler secret put <NAME> --env <environment>`. They persist across deploys;
 the GitHub workflow does not read or overwrite them.
 
+Remote OAuth also requires a random secret of at least 32 characters in every
+deployed Worker environment:
+
+```bash
+npx wrangler secret put MCP_OAUTH_SIGNING_SECRET --env stg
+npx wrangler secret put MCP_OAUTH_SIGNING_SECRET --env prod
+```
+
+Use different values in staging and production. Do not store either value in
+Git or a Wrangler vars block.
+
 Merges to `main` automatically run the `Deploy Tavus MCP Worker` workflow for
 `prod`. You can also run the workflow manually for `test`, `stg`, or `prod`.
 The public MCP endpoint is always `https://mcp.tavus.io/mcp`. The
@@ -200,6 +236,26 @@ points at the protected-resource metadata URL. A `404 Not Found` at discovery
 usually means the Worker version serving the custom domain does not include the
 OAuth routes yet.
 
+### Keeping local and hosted MCP current
+
+Every remotely usable Tavus feature must be added to the Python MCP/CLI and the
+hosted Worker in the same change. The Worker parity test compares both tool
+manifests and fails CI when a new difference is not explicitly classified.
+Local-file uploads and the legacy Builder flow are the current documented
+exceptions.
+
+For each feature release:
+
+1. Add or update the local SDK/MCP/CLI contract and the hosted Worker tool.
+2. Add schema and transport tests, including the hosted tool name in the parity
+   test automatically by registering it in `tavus.ts`.
+3. Run `uv run ruff check .`, `uv run pytest -q`, `npm run build`, and
+   `npm test`. CI runs both Python and Worker suites on every PR.
+4. Deploy and test `mcp.tavus-preview.io/mcp` first, including a real connector
+   OAuth login and the feature's write/read/cleanup cycle.
+5. Merge to deploy production, then repeat the connector and MCP tool smoke test
+   at `mcp.tavus.io/mcp`.
+
 ## Codex Skill
 
 A publishable Codex skill for this repo lives at `skills/tavus-agentic-pals/`.

{tavus_cli-0.3.2 → tavus_cli-0.3.3}/docs/gemini-enterprise/README.md

@@ -2,7 +2,7 @@
 
 This document is the public reference Google's Gemini Enterprise team uses to
 review and register the Tavus MCP server as a managed connector. It covers the
-server URL, OAuth metadata, scope-to-tool map, and the step-by-step admin
+server URL, OAuth metadata, access model, and the step-by-step admin
 workflow for adding Tavus to a Gemini Enterprise instance.
 
 ## At a glance
@@ -42,35 +42,33 @@ returns:
     "client_secret_post",
     "client_secret_basic"
   ],
-  "scopes_supported": [
-    "tavus",
-    "tavus.personas.read",
-    "tavus.personas.write",
-    "tavus.conversations.read",
-    "tavus.conversations.write",
-    "tavus.resources.read"
-  ]
+  "scopes_supported": ["tavus"]
 }
 ```
 
 The authorize endpoint redirects the user's browser to
 `https://platform.tavus.io/dev/cli-authorize?mode=oauth`. Tavus authenticates
 the user (Google SSO or email/password), mints a user-scoped Tavus API key
-tagged `source: cli`, and redirects back to the registered `redirect_uri`. The
-token endpoint then exchanges that code for a bearer token the MCP client
-sends as `Authorization: Bearer …` on every `/mcp` call.
+tagged `source: cli`, and returns to the trusted Worker callback. The Worker
+redirects an opaque, short-lived code to the registered client. The token
+endpoint verifies PKCE, client, redirect URI, and MCP resource before returning
+a bearer token the MCP client sends as `Authorization: Bearer …` on every
+`/mcp` call.
 
-## Manual OAuth client registration
+## OAuth client registration
 
-Gemini Enterprise cannot use the loopback Dynamic Client Registration path
-that local IDE clients use. Send the following to
-[mcp-connectors@tavus.io](mailto:mcp-connectors@tavus.io) and Tavus will mint a
-pre-registered client for the requested environments:
+The Dynamic Client Registration endpoint accepts the documented Claude and
+ChatGPT HTTPS callback shapes plus local loopback callbacks. Gemini uses an
+explicitly registered client with exact redirect URIs. Use
+`token_endpoint_auth_method=none` when Gemini supports it.
+
+If Gemini requires a confidential static client, send the following to
+[mcp-connectors@tavus.io](mailto:mcp-connectors@tavus.io):
 
 - Display name (shown on the consent screen)
 - Redirect URI(s) — exact match enforced
 - Whether you want a `client_secret` (recommended)
-- Required scopes (see table below)
+- Required scope (`tavus`)
 - Target environment(s) — `test`, `stg`, `prod`
 
 Tavus returns:
@@ -82,42 +80,36 @@ Tavus returns:
 The credentials are scoped per environment; production keys are issued only
 after the connector passes Gemini Enterprise's review in `stg`.
 
-## Scopes
+## Scope
 
-> **Naming note.** Tools and API paths use the new **pal/face** vocabulary
-> (`tavus_pal_*`, `/v2/pals`, `/v2/faces`). The OAuth **scope** strings remain
-> `tavus.personas.*` / `tavus.resources.*` — they are an auth-server contract and
-> are intentionally left unchanged until the auth team confirms pal-named scopes.
+The connector currently exposes one honest umbrella scope because its bearer
+credential is a Tavus API key. It does not advertise granular scopes that the
+API key cannot enforce.
 
 | Scope | Grants |
 | --- | --- |
-| `tavus` | All scopes below (umbrella; default when no scope requested) |
-| `tavus.personas.read` | List, get, and describe pals + attached resources |
-| `tavus.personas.write` | Create, patch, delete pals; create from templates |
-| `tavus.conversations.read` | (Reserved — read-only conversation tools land in a follow-up) |
-| `tavus.conversations.write` | Create + end conversations; run `tavus_quickstart` |
-| `tavus.resources.read` | List faces, voices, guardrails, objectives, documents, llm tools; scaffold embed code |
+| `tavus` | All Tavus MCP tools; default when no scope is requested |
 
-## Tools → scope → API
+## Tools → API
 
 All tools call `https://tavusapi.com/v2/*` with the per-user `x-api-key`
 forwarded from the bearer token.
 
-| Tool | Scope | Tavus API path |
-| --- | --- | --- |
-| `tavus_pal_list` | `tavus.personas.read` | `GET /v2/pals` |
-| `tavus_pal_get` | `tavus.personas.read` | `GET /v2/pals/{id}` |
-| `tavus_describe_pal_options` | `tavus.personas.read` | `GET /v2/pals/{id}` + `GET /v2/{faces,voices,guardrails,objectives,documents,tools}` |
-| `tavus_pal_create` | `tavus.personas.write` | `POST /v2/pals` |
-| `tavus_pal_from_template` | `tavus.personas.write` | `POST /v2/pals` |
-| `tavus_pal_delete` | `tavus.personas.write` | `DELETE /v2/pals/{id}` |
-| `tavus_patch_pal` | `tavus.personas.write` | `PATCH /v2/pals/{id}` |
-| `tavus_conversation_create` | `tavus.conversations.write` | `POST /v2/conversations` |
-| `tavus_conversation_end` | `tavus.conversations.write` | `POST /v2/conversations/{id}/end` |
-| `tavus_quickstart` | `tavus.conversations.write` (+ implicit `tavus.personas.write`) | `POST /v2/pals` + `POST /v2/conversations` |
-| `tavus_face_list` | `tavus.resources.read` | `GET /v2/faces` |
-| `tavus_resource_list` | `tavus.resources.read` | `GET /v2/{guardrails,objectives,documents,voices,tools}` |
-| `tavus_scaffold_embed` | `tavus.resources.read` | none (returns starter HTML/TSX locally) |
+| Tool | Tavus API path |
+| --- | --- |
+| `tavus_pal_list` | `GET /v2/pals` |
+| `tavus_pal_get` | `GET /v2/pals/{id}` |
+| `tavus_describe_pal_options` | `GET /v2/pals/{id}` + `GET /v2/{faces,voices,guardrails,objectives,documents,tools}` |
+| `tavus_pal_create` | `POST /v2/pals` |
+| `tavus_pal_from_template` | `POST /v2/pals` |
+| `tavus_pal_delete` | `DELETE /v2/pals/{id}` |
+| `tavus_patch_pal` | `PATCH /v2/pals/{id}` |
+| `tavus_conversation_create` | `POST /v2/conversations` |
+| `tavus_conversation_end` | `POST /v2/conversations/{id}/end` |
+| `tavus_quickstart` | `POST /v2/pals` + `POST /v2/conversations` |
+| `tavus_face_list` | `GET /v2/faces` |
+| `tavus_resource_list` | `GET /v2/{guardrails,objectives,documents,voices,tools}` |
+| `tavus_scaffold_embed` | none (returns starter HTML/TSX locally) |
 
 ## Tool annotations
 
@@ -142,8 +134,7 @@ pal or conversation ID.
    - **Auth type:** OAuth 2 / 3LO
    - **Client ID / Client secret:** the values Tavus issued in
      [Manual OAuth client registration](#manual-oauth-client-registration).
-   - **Scopes:** start with `tavus.personas.read tavus.conversations.write`
-     and add more as needed.
+   - **Scope:** `tavus`
 3. Run the **Test connection** flow. Gemini Enterprise will:
    1. `GET /.well-known/oauth-protected-resource/mcp`
    2. `GET /.well-known/oauth-authorization-server`
@@ -161,11 +152,16 @@ Public documentation and customer integrations must use only
 credentials privately for connector certification; they are not production
 mirrors or customer-facing fallbacks.
 
-| Env | MCP access | API base | Dev portal | Test account |
-| --- | --- | --- | --- | --- |
-| Test | provided privately | `https://test.rqh.tavusapi.com/v2` | `https://dev.platform.tavus.io` | provided privately |
-| Staging | provided privately | `https://stg.rqh.tavusapi.com/v2` | `https://stage.platform.tavus.io` | provided privately |
-| Production | `https://mcp.tavus.io/mcp` | `https://tavusapi.com/v2` | `https://platform.tavus.io` | provided privately |
+| Env | MCP access | API base | Dev portal | PAL Maker | Test account |
+| --- | --- | --- | --- | --- | --- |
+| Test | provided privately | `https://test.rqh.tavusapi.com/v2` | `https://dev.platform.tavus.io` | `https://dev.maker.tavus.io` | provided privately |
+| Staging | provided privately | `https://stg.rqh.tavusapi.com/v2` | `https://stage.platform.tavus.io` | `https://stage.maker.tavus.io` | provided privately |
+| Production | `https://mcp.tavus.io/mcp` | `https://tavusapi.com/v2` | `https://platform.tavus.io` | `https://maker.tavus.io` | provided privately |
+
+The hosted staging Worker overrides its PAL Maker link to
+`https://maker.tavus.io` because its PALs are edited in the production PAL
+Maker. Local staging configurations keep the `stage.maker.tavus.io` default
+unless `TAVUS_PAL_MAKER_URL` overrides it.
 
 Each env has a dedicated `gemini-enterprise-test@tavus.io` account pre-seeded
 with eval pals, faces, and documents. Credentials and the golden query

{tavus_cli-0.3.2 → tavus_cli-0.3.3}/docs/gemini-enterprise/listing.md

@@ -20,9 +20,8 @@ intake. Edit here; ship the final values to the Gemini Enterprise admin.
 > a conversation," "rename pal X and swap its face," "list all pals
 > tagged as customer-support and end any active conversations on them," or
 > "scaffold the React snippet I need to embed conversation Y in our portal."
-> Every write tool declares a destructive hint, every read tool declares a
-> read-only hint, and OAuth scopes are split per resource group so admins can
-> consent to exactly what they need.
+> Every write tool declares a destructive hint and every read tool declares a
+> read-only hint. The current `tavus` OAuth scope grants the full connector.
 
 ## Connector identity
 
@@ -39,13 +38,13 @@ intake. Edit here; ship the final values to the Gemini Enterprise admin.
 
 | Field | Value |
 | --- | --- |
-| OAuth client type | Confidential (`client_secret_post` + PKCE S256). Public client (`none` + PKCE) is supported for loopback/IDE clients only. |
+| OAuth client type | Public DCR (`none` + PKCE S256) supports approved Claude/ChatGPT HTTPS callbacks and loopback callbacks. Confidential static clients (`client_secret_post` + PKCE) support explicitly registered redirect URIs. |
 | Authorization endpoint | `https://mcp.tavus.io/authorize` |
 | Token endpoint | `https://mcp.tavus.io/token` |
 | Discovery (protected resource) | `https://mcp.tavus.io/.well-known/oauth-protected-resource/mcp` |
 | Discovery (authorization server) | `https://mcp.tavus.io/.well-known/oauth-authorization-server` |
 | Default scope | `tavus` |
-| Granular scopes | `tavus.personas.read`, `tavus.personas.write`, `tavus.conversations.read`, `tavus.conversations.write`, `tavus.resources.read` |
+| Granular scopes | Not advertised; the Tavus API key currently grants the full connector |
 
 ## Test credentials (delivered out-of-band)
 

{tavus_cli-0.3.2 → tavus_cli-0.3.3}/docs/gemini-enterprise/test-queries.md

@@ -20,18 +20,18 @@ Credentials and exact pal/face IDs are delivered out-of-band per
 
 | # | Query intent | Tool exercised | Scope required |
 | --- | --- | --- | --- |
-| 1 | List pals | `tavus_pal_list` | `tavus.personas.read` |
-| 2 | Get a pal | `tavus_pal_get` | `tavus.personas.read` |
-| 3 | Describe pal options | `tavus_describe_pal_options` | `tavus.personas.read` |
-| 4 | Create a pal | `tavus_pal_create` | `tavus.personas.write` |
-| 5 | Create pal from template | `tavus_pal_from_template` | `tavus.personas.write` |
-| 6 | Patch a pal | `tavus_patch_pal` | `tavus.personas.write` |
-| 7 | Delete a pal | `tavus_pal_delete` | `tavus.personas.write` |
-| 8 | List faces | `tavus_face_list` | `tavus.resources.read` |
-| 9 | List voices | `tavus_resource_list` | `tavus.resources.read` |
-| 10 | Scaffold embed code | `tavus_scaffold_embed` | `tavus.resources.read` |
-| 11 | Quickstart end-to-end | `tavus_quickstart` | `tavus.personas.write` + `tavus.conversations.write` |
-| 12 | Create + end a conversation | `tavus_conversation_create`, `tavus_conversation_end` | `tavus.conversations.write` |
+| 1 | List pals | `tavus_pal_list` | `tavus` |
+| 2 | Get a pal | `tavus_pal_get` | `tavus` |
+| 3 | Describe pal options | `tavus_describe_pal_options` | `tavus` |
+| 4 | Create a pal | `tavus_pal_create` | `tavus` |
+| 5 | Create pal from template | `tavus_pal_from_template` | `tavus` |
+| 6 | Patch a pal | `tavus_patch_pal` | `tavus` |
+| 7 | Delete a pal | `tavus_pal_delete` | `tavus` |
+| 8 | List faces | `tavus_face_list` | `tavus` |
+| 9 | List voices | `tavus_resource_list` | `tavus` |
+| 10 | Scaffold embed code | `tavus_scaffold_embed` | `tavus` |
+| 11 | Quickstart end-to-end | `tavus_quickstart` | `tavus` |
+| 12 | Create + end a conversation | `tavus_conversation_create`, `tavus_conversation_end` | `tavus` |
 
 ## Queries
 

{tavus_cli-0.3.2 → tavus_cli-0.3.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tavus-cli"
-version = "0.3.2"
+version = "0.3.3"
 description = "Tavus CLI and MCP server for agentic PAL creation and editing."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -16,6 +16,11 @@ dependencies = [
 ]
 
 [project.optional-dependencies]
+# Direct CVI transport (Daily room join). Optional because daily-python
+# ships native wheels for macOS/Linux only.
+daily = [
+  "daily-python>=0.31.0",
+]
 dev = [
   "pytest>=8.2.0",
   "pytest-asyncio>=0.23.0",