tcw-cli 2.8.1__tar.gz → 2.8.3__tar.gz

{tcw_cli-2.8.1 → tcw_cli-2.8.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tcw-cli
-Version: 2.8.1
+Version: 2.8.3
 Summary: Taxonomy · Capabilities · Work — a storage-abstracted framework for describing and evolving a software project.
 License:                                  Apache License
                                    Version 2.0, January 2004
@@ -218,8 +218,8 @@ Dynamic: license-file
 
 TCW keeps three things about a software project inside the repository, next to
 the code: what the project deals with, what a user can do with it, and what is
-being changed. One command-line tool, `tcw`, and an agent plugin for Claude Code
-and Codex keep all three in step with the code.
+being changed. One command-line tool, `tcw`, and an agent plugin for Claude Code,
+Codex, and Pi keep all three in step with the code.
 
 | Component        | Answers                                                 |
 | ---------------- | ------------------------------------------------------- |
@@ -309,7 +309,28 @@ skill — it runs the same install script Claude runs automatically. Every tcw
 skill also asks the agent to run the plugin's version check once per session,
 which warns when the CLI and the skills come from different releases.
 
-The plugin ships the skills and read-only review agents described in
+In **Pi**:
+
+```bash
+pi install git:github.com/brocef/TCW
+```
+
+Add `-l` to install for the current project instead of your personal settings.
+For a development checkout, use `pi install /absolute/path/to/TCW`.
+Start a new Pi session, then run `/skill:setup` to install or check the `tcw`
+CLI. You can also install it yourself with `pipx install tcw-cli`.
+Invoke skills with `/skill:work`, `/skill:capabilities`, or `/skill:taxonomy`.
+
+Pi loads the same skills through the official `pi` declaration in `package.json`.
+It does not run TCW's Claude session-start hook or shell injections; the skills
+provide explicit commands for setup, version checks, and lifecycle instructions.
+Claude's custom review agents are not installed as Pi agents. When delegation
+is unavailable, run ordinary lifecycle stages in the main session; autonomous
+work still requires the advisors named by that workflow.
+Git installation also installs the repository's Node package dependencies,
+which support the TCW web app; local-path installation uses the checkout directly.
+
+The plugin ships the skills and Claude Code read-only review agents described in
 [Skills and Agents](#skills-and-agents).
 
 ### CLI
@@ -940,7 +961,7 @@ resolve, what has to be true before an item completes. What a command cannot
 decide (what a request really asks for, whether a spec is good enough, whether
 the work is finished) is judgment, and the plugin's skills guide an agent through
 it. Skills name `tcw` commands and never reimplement them. Every entry point is a
-skill, so they work the same way under Claude Code and Codex.
+skill, with the same CLI-backed lifecycle under Claude Code, Codex, and Pi.
 
 The skills for a single axis are listed in that axis's section above. These cut
 across the axes.

{tcw_cli-2.8.1 → tcw_cli-2.8.3}/README.md

@@ -2,8 +2,8 @@
 
 TCW keeps three things about a software project inside the repository, next to
 the code: what the project deals with, what a user can do with it, and what is
-being changed. One command-line tool, `tcw`, and an agent plugin for Claude Code
-and Codex keep all three in step with the code.
+being changed. One command-line tool, `tcw`, and an agent plugin for Claude Code,
+Codex, and Pi keep all three in step with the code.
 
 | Component        | Answers                                                 |
 | ---------------- | ------------------------------------------------------- |
@@ -93,7 +93,28 @@ skill — it runs the same install script Claude runs automatically. Every tcw
 skill also asks the agent to run the plugin's version check once per session,
 which warns when the CLI and the skills come from different releases.
 
-The plugin ships the skills and read-only review agents described in
+In **Pi**:
+
+```bash
+pi install git:github.com/brocef/TCW
+```
+
+Add `-l` to install for the current project instead of your personal settings.
+For a development checkout, use `pi install /absolute/path/to/TCW`.
+Start a new Pi session, then run `/skill:setup` to install or check the `tcw`
+CLI. You can also install it yourself with `pipx install tcw-cli`.
+Invoke skills with `/skill:work`, `/skill:capabilities`, or `/skill:taxonomy`.
+
+Pi loads the same skills through the official `pi` declaration in `package.json`.
+It does not run TCW's Claude session-start hook or shell injections; the skills
+provide explicit commands for setup, version checks, and lifecycle instructions.
+Claude's custom review agents are not installed as Pi agents. When delegation
+is unavailable, run ordinary lifecycle stages in the main session; autonomous
+work still requires the advisors named by that workflow.
+Git installation also installs the repository's Node package dependencies,
+which support the TCW web app; local-path installation uses the checkout directly.
+
+The plugin ships the skills and Claude Code read-only review agents described in
 [Skills and Agents](#skills-and-agents).
 
 ### CLI
@@ -724,7 +745,7 @@ resolve, what has to be true before an item completes. What a command cannot
 decide (what a request really asks for, whether a spec is good enough, whether
 the work is finished) is judgment, and the plugin's skills guide an agent through
 it. Skills name `tcw` commands and never reimplement them. Every entry point is a
-skill, so they work the same way under Claude Code and Codex.
+skill, with the same CLI-backed lifecycle under Claude Code, Codex, and Pi.
 
 The skills for a single axis are listed in that axis's section above. These cut
 across the axes.

{tcw_cli-2.8.1 → tcw_cli-2.8.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "tcw-cli"
-version = "2.8.1"
+version = "2.8.3"
 description = "Taxonomy · Capabilities · Work — a storage-abstracted framework for describing and evolving a software project."
 readme = "README.md"
 requires-python = ">=3.11"

tcw_cli-2.8.3/tcw/__init__.py

@@ -0,0 +1 @@
+__version__ = "2.8.3"

{tcw_cli-2.8.1 → tcw_cli-2.8.3}/tcw/tracker/jira.py

@@ -149,7 +149,11 @@ class JiraClient:
         request = urllib.request.Request(
             f"{self.config.base_url}{path}", data=payload, method=method)
         credentials = base64.b64encode(f"{email}:{token}".encode("utf-8")).decode("ascii")
-        request.add_header("Authorization", f"Basic {credentials}")
+        # Unredirected: urllib copies every `add_header` header onto the request a
+        # redirect produces, whatever host it points at, which would hand the
+        # user's email and API token to that host. A redirected request now goes
+        # without them.
+        request.add_unredirected_header("Authorization", f"Basic {credentials}")
         request.add_header("Accept", "application/json")
         if payload is not None:
             request.add_header("Content-Type", "application/json")

{tcw_cli-2.8.1 → tcw_cli-2.8.3}/tcw_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tcw-cli
-Version: 2.8.1
+Version: 2.8.3
 Summary: Taxonomy · Capabilities · Work — a storage-abstracted framework for describing and evolving a software project.
 License:                                  Apache License
                                    Version 2.0, January 2004
@@ -218,8 +218,8 @@ Dynamic: license-file
 
 TCW keeps three things about a software project inside the repository, next to
 the code: what the project deals with, what a user can do with it, and what is
-being changed. One command-line tool, `tcw`, and an agent plugin for Claude Code
-and Codex keep all three in step with the code.
+being changed. One command-line tool, `tcw`, and an agent plugin for Claude Code,
+Codex, and Pi keep all three in step with the code.
 
 | Component        | Answers                                                 |
 | ---------------- | ------------------------------------------------------- |
@@ -309,7 +309,28 @@ skill — it runs the same install script Claude runs automatically. Every tcw
 skill also asks the agent to run the plugin's version check once per session,
 which warns when the CLI and the skills come from different releases.
 
-The plugin ships the skills and read-only review agents described in
+In **Pi**:
+
+```bash
+pi install git:github.com/brocef/TCW
+```
+
+Add `-l` to install for the current project instead of your personal settings.
+For a development checkout, use `pi install /absolute/path/to/TCW`.
+Start a new Pi session, then run `/skill:setup` to install or check the `tcw`
+CLI. You can also install it yourself with `pipx install tcw-cli`.
+Invoke skills with `/skill:work`, `/skill:capabilities`, or `/skill:taxonomy`.
+
+Pi loads the same skills through the official `pi` declaration in `package.json`.
+It does not run TCW's Claude session-start hook or shell injections; the skills
+provide explicit commands for setup, version checks, and lifecycle instructions.
+Claude's custom review agents are not installed as Pi agents. When delegation
+is unavailable, run ordinary lifecycle stages in the main session; autonomous
+work still requires the advisors named by that workflow.
+Git installation also installs the repository's Node package dependencies,
+which support the TCW web app; local-path installation uses the checkout directly.
+
+The plugin ships the skills and Claude Code read-only review agents described in
 [Skills and Agents](#skills-and-agents).
 
 ### CLI
@@ -940,7 +961,7 @@ resolve, what has to be true before an item completes. What a command cannot
 decide (what a request really asks for, whether a spec is good enough, whether
 the work is finished) is judgment, and the plugin's skills guide an agent through
 it. Skills name `tcw` commands and never reimplement them. Every entry point is a
-skill, so they work the same way under Claude Code and Codex.
+skill, with the same CLI-backed lifecycle under Claude Code, Codex, and Pi.
 
 The skills for a single axis are listed in that axis's section above. These cut
 across the axes.

{tcw_cli-2.8.1 → tcw_cli-2.8.3}/tests/test_tracker_client.py

@@ -300,7 +300,9 @@ def test_the_authorization_header_is_built_from_the_named_variables(monkeypatch)
     captured = {}
 
     def fake_urlopen(request, timeout=None):
-        captured["headers"] = dict(request.headers)
+        # `header_items()` rather than `headers`: the authorization header is
+        # an unredirected one, which `headers` does not include.
+        captured["headers"] = dict(request.header_items())
         captured["timeout"] = timeout
         captured["url"] = request.full_url
 
@@ -501,3 +503,63 @@ def test_a_server_that_drops_the_connection_is_unavailable_not_a_crash():
     finally:
         thread.join(timeout=5)
         listener.close()
+
+
+def test_a_redirect_to_another_host_does_not_carry_the_credentials():
+    """urllib copies every header added with `add_header` onto the request a
+    redirect produces, whatever host it points at. So the authorization header has
+    to be an unredirected one, or a redirect from the tracker (or anything between
+    it and us) to another host receives the user's email and API token. Two real
+    local servers: the first answers 302 to the second, under a different host
+    name and port, and the second records what it was sent."""
+    import http.server
+    import threading
+
+    seen = {}
+
+    def handler(name, answer):
+        class Handler(http.server.BaseHTTPRequestHandler):
+            def do_GET(self):
+                seen[name] = self.headers.get("Authorization")
+                answer(self)
+
+            def log_message(self, *args):
+                pass
+        return Handler
+
+    def ok(request_handler):
+        body = b"{}"
+        request_handler.send_response(200)
+        request_handler.send_header("Content-Type", "application/json")
+        request_handler.send_header("Content-Length", str(len(body)))
+        request_handler.end_headers()
+        request_handler.wfile.write(body)
+
+    other = http.server.HTTPServer(("127.0.0.1", 0), handler("other", ok))
+    other_port = other.server_address[1]
+
+    def redirect(request_handler):
+        request_handler.send_response(302)
+        request_handler.send_header(
+            "Location", f"http://localhost:{other_port}/rest/api/3/myself")
+        request_handler.send_header("Content-Length", "0")
+        request_handler.end_headers()
+
+    tracker = http.server.HTTPServer(("127.0.0.1", 0), handler("tracker", redirect))
+    servers = (tracker, other)
+    threads = [threading.Thread(target=s.serve_forever, daemon=True) for s in servers]
+    for thread in threads:
+        thread.start()
+    try:
+        config = dataclasses.replace(
+            CONFIG, base_url=f"http://127.0.0.1:{tracker.server_address[1]}",
+            timeout_seconds=5)
+        jira.JiraClient(config).myself()
+    finally:
+        for server in servers:
+            server.shutdown()
+            server.server_close()
+
+    assert seen["tracker"] is not None and seen["tracker"].startswith("Basic ")
+    assert "other" in seen, "the redirect was never followed"
+    assert seen["other"] is None

tcw_cli-2.8.1/tcw/__init__.py

@@ -1 +0,0 @@
-__version__ = "2.8.1"