teams-cli 0.1.2__tar.gz → 0.1.3__tar.gz

teams_cli-0.1.3/.github/workflows/ci.yml

@@ -0,0 +1,54 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Test (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c
+        with:
+          toolchain: 1.96.0
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
+      - run: cargo test --locked --all-targets
+
+  quality:
+    name: Formatting and lints
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c
+        with:
+          toolchain: 1.96.0
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
+      - run: cargo fmt -- --check
+      - run: cargo clippy --locked --all-targets -- -D warnings
+
+  security:
+    name: Dependency audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c
+        with:
+          toolchain: 1.96.0
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --version 0.22.2 --locked
+      - name: Audit Cargo.lock
+        run: cargo audit

{teams_cli-0.1.2 → teams_cli-0.1.3}/.github/workflows/release.yml

@@ -3,6 +3,17 @@ name: Release
 on:
   push:
     tags: ["v[0-9]*.[0-9]*.[0-9]*"]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to rehearse (defaults to Cargo.toml)"
+        required: false
+        type: string
+      dry_run:
+        description: "Build and validate without publishing"
+        required: true
+        default: true
+        type: boolean
 
 permissions:
   contents: read
@@ -12,11 +23,23 @@ jobs:
     name: Verify release version
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - name: Match tag to package version
+        env:
+          REQUESTED_VERSION: ${{ inputs.version }}
+          DRY_RUN: ${{ inputs.dry_run }}
         run: |
-          version="$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -1)"
-          test "v${version}" = "$GITHUB_REF_NAME"
+          manifest_version="$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -1)"
+          version="${REQUESTED_VERSION#v}"
+          version="${version:-$manifest_version}"
+          [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+([+-][0-9A-Za-z.-]+)?$ ]]
+          test "$version" = "$manifest_version"
+          if [[ "$GITHUB_EVENT_NAME" == "push" ]]; then
+            test "v${version}" = "$GITHUB_REF_NAME"
+          elif [[ "$DRY_RUN" != "true" ]]; then
+            test "$GITHUB_REF_TYPE" = "tag"
+            test "v${version}" = "$GITHUB_REF_NAME"
+          fi
 
   verify:
     uses: ./.github/workflows/ci.yml
@@ -46,11 +69,13 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c
         with:
+          toolchain: 1.96.0
+          components: rustfmt, clippy
           targets: ${{ matrix.target }}
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
         with:
           key: ${{ matrix.target }}
       - run: cargo build --locked --release --target ${{ matrix.target }}
@@ -63,10 +88,11 @@ jobs:
           tar -C dist/package -czf "dist/teams-cli-${GITHUB_REF_NAME}-${{ matrix.target }}.tar.gz" .
           rm -rf dist/package
       - name: Attest build provenance
-        uses: actions/attest@v4
+        if: ${{ inputs.dry_run != true }}
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6
         with:
           subject-path: dist/*.tar.gz
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: binary-${{ matrix.target }}
           path: dist/*.tar.gz
@@ -93,7 +119,7 @@ jobs:
             manylinux: auto
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
         with:
           maturin-version: v1.14.1
@@ -101,7 +127,12 @@ jobs:
           target: ${{ matrix.target }}
           manylinux: ${{ matrix.manylinux }}
           args: --release --locked --compatibility pypi --out dist
-      - uses: actions/upload-artifact@v7
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d
+        if: ${{ inputs.dry_run == true }}
+      - name: Validate wheel metadata
+        if: ${{ inputs.dry_run == true }}
+        run: uvx --from twine==6.2.0 twine check --strict dist/*.whl
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: wheel-${{ matrix.target }}
           path: dist/*.whl
@@ -112,16 +143,27 @@ jobs:
     needs: [version, verify]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c
+        with:
+          toolchain: 1.96.0
+          components: rustfmt, clippy
       - run: cargo package --locked
+      - name: Validate crates.io package
+        if: ${{ inputs.dry_run == true }}
+        run: cargo publish --locked --dry-run
       - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
         with:
           maturin-version: v1.14.1
           command: sdist
           args: --out dist
       - run: cp target/package/*.crate dist/
-      - uses: actions/upload-artifact@v7
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d
+        if: ${{ inputs.dry_run == true }}
+      - name: Validate source distribution metadata
+        if: ${{ inputs.dry_run == true }}
+        run: uvx --from twine==6.2.0 twine check --strict dist/*.tar.gz
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: source-distributions
           path: dist/*
@@ -136,13 +178,13 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/download-artifact@v8
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
           pattern: binary-*
           path: dist
           merge-multiple: true
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
           name: source-distributions
           path: dist
@@ -155,11 +197,13 @@ jobs:
         working-directory: dist
         run: sha256sum ./*.tar.gz ./*.crate ./*.json > SHA256SUMS
       - name: Attest artifacts and SBOM
-        uses: actions/attest@v4
+        if: ${{ inputs.dry_run != true }}
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6
         with:
           subject-path: dist/*
           sbom-path: dist/teams-cli.cdx.json
       - name: Create GitHub release
+        if: ${{ inputs.dry_run != true }}
         env:
           GH_TOKEN: ${{ github.token }}
         run: gh release create "$GITHUB_REF_NAME" dist/* --verify-tag --generate-notes
@@ -167,13 +211,17 @@ jobs:
   crates-io:
     name: Publish crates.io
     needs: github-release
+    if: ${{ inputs.dry_run != true }}
     runs-on: ubuntu-latest
     environment: crates-io
     permissions:
       id-token: write
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c
+        with:
+          toolchain: 1.96.0
+          components: rustfmt, clippy
       - name: Check whether this version is already published
         id: crate
         shell: bash
@@ -191,7 +239,7 @@ jobs:
       - name: Get temporary crates.io token
         if: steps.crate.outputs.exists != 'true'
         id: crates-auth
-        uses: rust-lang/crates-io-auth-action@v1
+        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18
       - if: steps.crate.outputs.exists != 'true'
         run: cargo publish --locked
         env:
@@ -202,6 +250,7 @@ jobs:
   pypi:
     name: Publish PyPI
     needs: github-release
+    if: ${{ inputs.dry_run != true }}
     runs-on: ubuntu-latest
     environment:
       name: pypi
@@ -209,28 +258,32 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
           pattern: wheel-*
           path: dist
           merge-multiple: true
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
           name: source-distributions
           path: source
       - name: Collect Python distributions
         run: find source -name '*.tar.gz' -exec cp {} dist/ \;
-      - uses: pypa/gh-action-pypi-publish@release/v1
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33
         with:
           packages-dir: dist
 
   post-publish-smoke:
     name: Verify public packages
     needs: [crates-io, pypi]
+    if: ${{ inputs.dry_run != true }}
     runs-on: ubuntu-latest
     steps:
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: actions/setup-python@v7
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c
+        with:
+          toolchain: 1.96.0
+          components: rustfmt, clippy
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: "3.x"
       - name: Install and run the crates.io package

teams_cli-0.1.3/.mise.toml

@@ -0,0 +1,22 @@
+# Reproducible local and CI tooling.
+min_version = "2026.4.19"
+
+[env]
+RUST_BACKTRACE = "1"
+BINSTALL_DISABLE_TELEMETRY = "true"
+
+[tools]
+rust = "1.96.0"
+actionlint = "1.7.12"
+cargo-binstall = "1.22.0"
+"cargo:cargo-nextest" = "0.9.143"
+
+[settings]
+cargo.binstall = true
+
+[tasks.setup]
+description = "Install the exact development toolchain"
+run = """
+mise install rust actionlint cargo-binstall
+mise install cargo:cargo-nextest
+"""

{teams_cli-0.1.2 → teams_cli-0.1.3}/CHANGELOG.md

@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.3](https://github.com/rvben/teams-cli/compare/v0.1.2...v0.1.3) - 2026-08-26
+
+### Added
+
+- **cli**: align safety and configuration contract ([c564f63](https://github.com/rvben/teams-cli/commit/c564f63f7deeb4e8a7c8faa359e32f3ea0da8556))
+
+### Fixed
+
+- **config**: persist profiles atomically ([ababe5e](https://github.com/rvben/teams-cli/commit/ababe5e46f24a52d86007de5737cd7601a1ae0c3))
+- **ci**: install pinned Rust components ([f5ecdcc](https://github.com/rvben/teams-cli/commit/f5ecdccfb4ca697ff23cc828393e519a788cbea8))
+
 ## [0.1.2] - 2026-08-24
 
 ### Added
@@ -35,8 +46,3 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Commands for identity, joined teams, channels, chats, and reading or sending messages through Microsoft Graph.
 - Guided onboarding, diagnostics, completions, bounded collections, and deterministic TUI snapshots.
 - Distribution through crates.io, PyPI binary wheels, and signed GitHub release artifacts.
-
-[Unreleased]: https://github.com/rvben/teams-cli/compare/v0.1.2...HEAD
-[0.1.2]: https://github.com/rvben/teams-cli/compare/v0.1.1...v0.1.2
-[0.1.1]: https://github.com/rvben/teams-cli/compare/v0.1.0...v0.1.1
-[0.1.0]: https://github.com/rvben/teams-cli/releases/tag/v0.1.0

{teams_cli-0.1.2 → teams_cli-0.1.3}/Cargo.lock

@@ -2964,7 +2964,7 @@ dependencies = [
 
 [[package]]
 name = "teams-cli"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
  "assert_cmd",
  "base64 0.23.1",

{teams_cli-0.1.2 → teams_cli-0.1.3}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "teams-cli"
-version = "0.1.2"
+version = "0.1.3"
 edition = "2024"
 rust-version = "1.90"
 description = "A Microsoft Teams CLI and TUI designed equally for humans and agents"
@@ -31,6 +31,7 @@ serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 sha2 = "0.10"
 thiserror = "2"
+tempfile = "3"
 tokio = { version = "1", features = ["macros", "rt-multi-thread", "net", "io-util", "time"] }
 toml = "1.1"
 url = "2"
@@ -39,5 +40,4 @@ url = "2"
 assert_cmd = "2"
 jsonschema = "0.49.8"
 predicates = "3"
-tempfile = "3"
 wiremock = "0.6"

{teams_cli-0.1.2 → teams_cli-0.1.3}/Makefile

@@ -1,4 +1,4 @@
-.PHONY: build test lint fmt check release install clean
+.PHONY: build test lint fmt check release install clean release-patch release-minor release-major
 
 build:
 	cargo build --locked
@@ -23,3 +23,12 @@ install: check release
 
 clean:
 	cargo clean
+
+release-patch:
+	vership bump patch
+
+release-minor:
+	vership bump minor
+
+release-major:
+	vership bump major

{teams_cli-0.1.2 → teams_cli-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: teams-cli
-Version: 0.1.2
+Version: 0.1.3
 Classifier: Programming Language :: Rust
 Classifier: Programming Language :: Python :: Implementation :: CPython
 License-File: LICENSE
@@ -108,11 +108,22 @@ teams auth login --channel-history  # once, with administrator approval
 teams messages list --team TEAM_ID --channel CHANNEL_ID
 teams messages send --chat CHAT_ID --body "On it."
 printf 'Status update' | teams messages send --chat CHAT_ID --body -
+teams config show
 teams doctor
 ```
 
 Collection commands expose `--limit` and `--fields`; Graph-native collections use `--cursor`, while joined teams and channels use `--offset` because those endpoints do not accept `$top`. With a terminal they render concise text; when stdout is piped they emit JSON envelopes with continuation metadata and `truncated`.
 
+Profiles can block every remote write while keeping reads, sign-in, diagnostics, and the TUI available:
+
+```console
+teams init --no-login --read-only
+# or for one invocation/environment
+TEAMS_READ_ONLY=true teams messages send --chat CHAT_ID --body "Blocked"
+```
+
+Like the other tools in the suite, the config file is selected with `--profile`, overridden by `TEAMS_*` environment variables, and inspectable without exposing credentials through `teams config show` and `teams config path`.
+
 ## Boundaries
 
 - Microsoft 365 work or school accounts only. The relevant Teams Graph endpoints do not support personal Microsoft accounts.
@@ -125,3 +136,8 @@ Collection commands expose `--limit` and `--fields`; Graph-native collections us
 
 `teams schema` is offline, unauthenticated, and follows [CLI Spec v0.3](https://clispec.dev/): flat invocable command paths, declared effects and cardinality, bounded collections, stable error kinds and exit codes, stdout/stderr separation, and safe noninteractive behavior.
 
+## Releasing
+
+Vership owns versioning, changelog generation, release commits, and tags. See
+[the release runbook](docs/releases.md) for the verified workflow and recovery policy.
+

{teams_cli-0.1.2 → teams_cli-0.1.3}/README.md

@@ -92,11 +92,22 @@ teams auth login --channel-history  # once, with administrator approval
 teams messages list --team TEAM_ID --channel CHANNEL_ID
 teams messages send --chat CHAT_ID --body "On it."
 printf 'Status update' | teams messages send --chat CHAT_ID --body -
+teams config show
 teams doctor
 ```
 
 Collection commands expose `--limit` and `--fields`; Graph-native collections use `--cursor`, while joined teams and channels use `--offset` because those endpoints do not accept `$top`. With a terminal they render concise text; when stdout is piped they emit JSON envelopes with continuation metadata and `truncated`.
 
+Profiles can block every remote write while keeping reads, sign-in, diagnostics, and the TUI available:
+
+```console
+teams init --no-login --read-only
+# or for one invocation/environment
+TEAMS_READ_ONLY=true teams messages send --chat CHAT_ID --body "Blocked"
+```
+
+Like the other tools in the suite, the config file is selected with `--profile`, overridden by `TEAMS_*` environment variables, and inspectable without exposing credentials through `teams config show` and `teams config path`.
+
 ## Boundaries
 
 - Microsoft 365 work or school accounts only. The relevant Teams Graph endpoints do not support personal Microsoft accounts.
@@ -108,3 +119,8 @@ Collection commands expose `--limit` and `--fields`; Graph-native collections us
 ## CLI Spec
 
 `teams schema` is offline, unauthenticated, and follows [CLI Spec v0.3](https://clispec.dev/): flat invocable command paths, declared effects and cardinality, bounded collections, stable error kinds and exit codes, stdout/stderr separation, and safe noninteractive behavior.
+
+## Releasing
+
+Vership owns versioning, changelog generation, release commits, and tags. See
+[the release runbook](docs/releases.md) for the verified workflow and recovery policy.

teams_cli-0.1.3/docs/releases.md

@@ -0,0 +1,38 @@
+# Releases
+
+Vership is the release control plane for `teams-cli`. GitHub Actions is the
+execution plane for cross-platform builds, publication, provenance, and
+downstream packaging.
+
+## Create a release
+
+Start from a clean, up-to-date `main` branch and run:
+
+```sh
+vership preflight
+vership bump patch # or minor/major
+tarry cmd --timeout 20m -- vership verify
+```
+
+Vership runs `make check`, updates the package version and changelog, creates
+the Conventional Commit release commit and tag, and pushes both. The tag starts
+the release workflow. Use `vership release` only when the on-disk version was
+intentionally set in advance.
+
+Cargo and Python package versions are kept synchronized as one release unit.
+
+## Failure policy
+
+If a release fails before any release, artifact, package, checksum, or
+attestation becomes public, delete and recreate the brief tag and retry the
+same version. Once anything was published, preserve the tag and issue a patch
+release for release-content corrections. Registry and downstream-packaging
+jobs are separate recovery domains; retry only the failed job when possible.
+
+## Dry runs
+
+The Release workflow can be dispatched from `main` with `dry_run` enabled. It
+uses the package version unless an explicit `version` is supplied, builds the
+real artifacts, and exercises registry validation without publishing packages,
+creating a GitHub release, generating attestations, or updating downstream
+packaging.

{teams_cli-0.1.2 → teams_cli-0.1.3}/src/cli.rs

@@ -36,6 +36,11 @@ pub enum Command {
         #[command(subcommand)]
         command: AuthCommand,
     },
+    /// Inspect resolved, secret-free configuration
+    Config {
+        #[command(subcommand)]
+        command: ConfigCommand,
+    },
     /// Show the signed-in Microsoft 365 identity
     Whoami,
     /// List teams joined by the signed-in user
@@ -87,6 +92,17 @@ pub struct InitArgs {
     /// Request admin-consented access to read channel history
     #[arg(long)]
     pub channel_history: bool,
+    /// Block remote write operations for this profile
+    #[arg(long, env = "TEAMS_READ_ONLY")]
+    pub read_only: bool,
+}
+
+#[derive(Debug, Subcommand)]
+pub enum ConfigCommand {
+    /// Print the resolved profile without credentials
+    Show,
+    /// Print the absolute configuration file path
+    Path,
 }
 
 #[derive(Debug, Subcommand)]

{teams_cli-0.1.2 → teams_cli-0.1.3}/src/config.rs

@@ -1,4 +1,5 @@
 use std::collections::BTreeMap;
+use std::io::Write;
 use std::path::PathBuf;
 
 use serde::{Deserialize, Serialize};
@@ -14,6 +15,21 @@ pub struct Profile {
     pub client_id: String,
     #[serde(default = "default_tenant")]
     pub tenant: String,
+    #[serde(default)]
+    pub read_only: bool,
+}
+
+impl Profile {
+    pub fn require_writable(&self) -> Result<(), AppError> {
+        if self.read_only {
+            Err(AppError::ReadOnly(
+                "read-only mode is enabled (unset TEAMS_READ_ONLY or disable read_only in the active profile to allow writes)"
+                    .into(),
+            ))
+        } else {
+            Ok(())
+        }
+    }
 }
 
 fn default_tenant() -> String {
@@ -50,12 +66,18 @@ pub fn save(profile_name: &str, profile: Profile) -> Result<PathBuf, AppError> {
         .ok_or_else(|| AppError::Unexpected("configuration path has no parent".into()))?;
     std::fs::create_dir_all(parent)?;
     let body = toml::to_string_pretty(&config).map_err(|e| AppError::Unexpected(e.to_string()))?;
-    std::fs::write(&path, body)?;
+    let mut temp = tempfile::Builder::new()
+        .prefix(".config-")
+        .suffix(".toml.tmp")
+        .tempfile_in(parent)?;
+    temp.write_all(body.as_bytes())?;
+    temp.flush()?;
     #[cfg(unix)]
     {
         use std::os::unix::fs::PermissionsExt;
-        std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600))?;
+        std::fs::set_permissions(temp.path(), std::fs::Permissions::from_mode(0o600))?;
     }
+    temp.persist(&path).map_err(|error| error.error)?;
     Ok(path)
 }
 
@@ -79,10 +101,33 @@ pub fn load(requested: Option<&str>) -> Result<(String, Profile), AppError> {
         .ok()
         .or_else(|| stored.map(|profile| profile.tenant.clone()))
         .unwrap_or_else(default_tenant);
-    let profile = Profile { client_id, tenant };
+    let read_only = match std::env::var("TEAMS_READ_ONLY") {
+        Ok(value) => parse_bool("TEAMS_READ_ONLY", &value)?,
+        Err(std::env::VarError::NotPresent) => stored.is_some_and(|profile| profile.read_only),
+        Err(error) => {
+            return Err(AppError::InvalidInput(format!(
+                "cannot read TEAMS_READ_ONLY: {error}"
+            )));
+        }
+    };
+    let profile = Profile {
+        client_id,
+        tenant,
+        read_only,
+    };
     Ok((name, profile))
 }
 
+fn parse_bool(name: &str, value: &str) -> Result<bool, AppError> {
+    match value.trim().to_ascii_lowercase().as_str() {
+        "1" | "true" | "yes" | "on" => Ok(true),
+        "0" | "false" | "no" | "off" => Ok(false),
+        _ => Err(AppError::InvalidInput(format!(
+            "{name} must be true or false"
+        ))),
+    }
+}
+
 #[cfg(windows)]
 fn config_base() -> PathBuf {
     dirs::config_dir().unwrap_or_else(|| PathBuf::from(".config"))

{teams_cli-0.1.2 → teams_cli-0.1.3}/src/error.rs

@@ -8,6 +8,8 @@ pub enum AppError {
     #[error("{0}")]
     Auth(String),
     #[error("{0}")]
+    ReadOnly(String),
+    #[error("{0}")]
     Permission(String),
     #[error("{0}")]
     NotFound(String),
@@ -32,7 +34,7 @@ pub struct ErrorContract {
 }
 
 pub const INVALID_INPUT: ErrorContract = ErrorContract {
-    kind: "usage",
+    kind: "invalid_input",
     exit_code: 2,
     retryable: false,
     description: "Arguments or local configuration are invalid",
@@ -45,13 +47,13 @@ pub const AUTH: ErrorContract = ErrorContract {
 };
 pub const PERMISSION: ErrorContract = ErrorContract {
     kind: "permission_denied",
-    exit_code: 4,
+    exit_code: 5,
     retryable: false,
     description: "The tenant or granted scopes do not permit the operation",
 };
 pub const NOT_FOUND: ErrorContract = ErrorContract {
     kind: "not_found",
-    exit_code: 5,
+    exit_code: 4,
     retryable: false,
     description: "The requested Teams resource does not exist",
 };
@@ -63,26 +65,33 @@ pub const RATE_LIMIT: ErrorContract = ErrorContract {
 };
 pub const API: ErrorContract = ErrorContract {
     kind: "api_error",
-    exit_code: 7,
+    exit_code: 5,
     retryable: false,
     description: "Microsoft Graph returned an API error",
 };
 pub const NON_INTERACTIVE: ErrorContract = ErrorContract {
     kind: "tty_required",
-    exit_code: 8,
+    exit_code: 2,
     retryable: false,
     description: "An interactive command was invoked without a terminal",
 };
 pub const UNEXPECTED: ErrorContract = ErrorContract {
-    kind: "internal",
+    kind: "unexpected_error",
     exit_code: 1,
     retryable: false,
     description: "An unexpected local or transport error occurred",
 };
+pub const READ_ONLY: ErrorContract = ErrorContract {
+    kind: "read_only",
+    exit_code: 2,
+    retryable: false,
+    description: "The active profile blocks remote write operations",
+};
 
 pub const ALL: &[ErrorContract] = &[
     INVALID_INPUT,
     AUTH,
+    READ_ONLY,
     PERMISSION,
     NOT_FOUND,
     RATE_LIMIT,
@@ -96,6 +105,7 @@ impl AppError {
         match self {
             Self::InvalidInput(_) => INVALID_INPUT,
             Self::Auth(_) => AUTH,
+            Self::ReadOnly(_) => READ_ONLY,
             Self::Permission(_) => PERMISSION,
             Self::NotFound(_) => NOT_FOUND,
             Self::RateLimit(_) => RATE_LIMIT,

{teams_cli-0.1.2 → teams_cli-0.1.3}/src/main.rs

@@ -6,8 +6,8 @@ use serde_json::Value;
 
 use teams_cli::auth;
 use teams_cli::cli::{
-    AuthCommand, ChannelsCommand, ChatsCommand, Cli, Command, InitArgs, MessagesCommand,
-    OffsetPageArgs, PageArgs, TuiArgs,
+    AuthCommand, ChannelsCommand, ChatsCommand, Cli, Command, ConfigCommand, InitArgs,
+    MessagesCommand, OffsetPageArgs, PageArgs, TuiArgs,
 };
 use teams_cli::config::{self, Profile};
 use teams_cli::error::AppError;
@@ -36,7 +36,7 @@ async fn main() {
         }
     };
     let out = Output {
-        format: if cli.json {
+        format: if cli.json && cli.output == OutputFormat::Auto {
             OutputFormat::Json
         } else {
             cli.output
@@ -60,6 +60,7 @@ async fn dispatch(cli: Cli, out: Output) -> Result<(), AppError> {
                 no_login: false,
                 device_code: false,
                 channel_history: false,
+                read_only: false,
             })
         }
         None if io::stdin().is_terminal() && io::stdout().is_terminal() => Command::Tui(TuiArgs {
@@ -77,6 +78,7 @@ async fn dispatch(cli: Cli, out: Output) -> Result<(), AppError> {
     match command {
         Command::Init(args) => init(profile_arg.unwrap_or("default"), args, out).await,
         Command::Auth { command } => auth_command(profile_arg, command, out).await,
+        Command::Config { command } => config_command(profile_arg, command, out),
         Command::Whoami => {
             let client = client(profile_arg).await?;
             let value = client.me().await?;
@@ -137,7 +139,10 @@ async fn dispatch(cli: Cli, out: Output) -> Result<(), AppError> {
                     "message body cannot be empty".into(),
                 ));
             }
-            let client = client(profile_arg).await?;
+            let (name, profile) = config::load(profile_arg)?;
+            profile.require_writable()?;
+            let token = auth::access_token(&name, &profile).await?;
+            let client = GraphClient::new(token);
             let value = client
                 .send(chat.as_deref(), team.as_deref(), channel.as_deref(), &body)
                 .await?;
@@ -199,6 +204,7 @@ async fn init(profile_name: &str, args: InitArgs, out: Output) -> Result<(), App
         Profile {
             client_id: client_id.clone(),
             tenant: args.tenant.clone(),
+            read_only: args.read_only,
         },
     )?;
     let mut signed_in = false;
@@ -222,6 +228,7 @@ async fn init(profile_name: &str, args: InitArgs, out: Output) -> Result<(), App
         client_id: &'a str,
         tenant: &'a str,
         channel_history_requested: bool,
+        read_only: bool,
     }
     let result = InitResult {
         profile: profile_name,
@@ -230,6 +237,7 @@ async fn init(profile_name: &str, args: InitArgs, out: Output) -> Result<(), App
         client_id: &client_id,
         tenant: &args.tenant,
         channel_history_requested: args.channel_history,
+        read_only: args.read_only,
     };
     out.value(&result, || {
         if signed_in {
@@ -240,6 +248,38 @@ async fn init(profile_name: &str, args: InitArgs, out: Output) -> Result<(), App
     })
 }
 
+fn config_command(
+    profile_arg: Option<&str>,
+    command: ConfigCommand,
+    out: Output,
+) -> Result<(), AppError> {
+    match command {
+        ConfigCommand::Path => out.value(&config::path().display().to_string(), || {
+            config::path().display().to_string()
+        }),
+        ConfigCommand::Show => {
+            let (name, profile) = config::load(profile_arg)?;
+            let value = serde_json::json!({
+                "profile": name,
+                "client_id": profile.client_id,
+                "tenant": profile.tenant,
+                "read_only": profile.read_only,
+                "config_path": config::path(),
+            });
+            out.value(&value, || {
+                format!(
+                    "Profile: {}\nTenant: {}\nClient ID: {}\nRead only: {}\nConfig: {}",
+                    value["profile"].as_str().unwrap_or_default(),
+                    value["tenant"].as_str().unwrap_or_default(),
+                    value["client_id"].as_str().unwrap_or_default(),
+                    yes_no(value["read_only"].as_bool().unwrap_or(false)),
+                    config::path().display(),
+                )
+            })
+        }
+    }
+}
+
 async fn auth_command(
     profile_arg: Option<&str>,
     command: AuthCommand,
@@ -276,12 +316,13 @@ async fn auth_command(
             let signed_in = auth::has_token(name);
             let scopes = auth::granted_scopes(name);
             let channel_history = auth::channel_history_granted(name);
-            let value = serde_json::json!({"profile":name,"configured":configured.is_some(),"signed_in":signed_in,"config_path":config::path(),"granted_scopes":scopes,"channel_history":channel_history});
+            let value = serde_json::json!({"profile":name,"configured":configured.is_some(),"signed_in":signed_in,"config_path":config::path(),"read_only":configured.as_ref().is_some_and(|(_, profile)| profile.read_only),"granted_scopes":scopes,"channel_history":channel_history});
             out.value(&value, || {
                 format!(
-                    "Profile: {name}\nConfigured: {}\nSigned in: {}\nChannel history: {}\nConfig: {}",
+                    "Profile: {name}\nConfigured: {}\nSigned in: {}\nRead only: {}\nChannel history: {}\nConfig: {}",
                     yes_no(configured.is_some()),
                     yes_no(signed_in),
+                    yes_no(value["read_only"].as_bool().unwrap_or(false)),
                     optional_access(channel_history),
                     config::path().display()
                 )
@@ -398,6 +439,17 @@ async fn doctor(profile_arg: Option<&str>, out: Output) -> Result<(), AppError>
         status: if configured.is_some() { "pass" } else { "fail" },
         detail: config::path().display().to_string(),
     });
+    if let Some((_, profile)) = &configured {
+        checks.push(Check {
+            name: "write_safety",
+            status: "pass",
+            detail: if profile.read_only {
+                "read-only mode is enabled".into()
+            } else {
+                "remote writes are enabled".into()
+            },
+        });
+    }
     let signed_in = configured
         .as_ref()
         .is_some_and(|(name, _)| auth::has_token(name));

{teams_cli-0.1.2 → teams_cli-0.1.3}/src/output.rs

@@ -5,7 +5,7 @@ use serde::Serialize;
 
 use crate::error::AppError;
 
-#[derive(Debug, Clone, Copy, ValueEnum)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, ValueEnum)]
 pub enum OutputFormat {
     Auto,
     Text,
@@ -62,7 +62,7 @@ pub fn print_error(error: &AppError, structured: bool) {
                 "retryable": contract.retryable,
             }
         });
-        eprintln!("{}", serde_json::to_string(&envelope).unwrap_or_else(|_| r#"{"error":{"kind":"internal","message":"error serialization failed","retryable":false}}"#.into()));
+        eprintln!("{}", serde_json::to_string(&envelope).unwrap_or_else(|_| r#"{"error":{"kind":"unexpected_error","message":"error serialization failed","retryable":false}}"#.into()));
     }
 }
 

{teams_cli-0.1.2 → teams_cli-0.1.3}/src/schema.rs

@@ -73,6 +73,7 @@ pub fn generate(command_filter: Option<&str>) -> Value {
                     field("client_id", "string"),
                     field("tenant", "string"),
                     field("channel_history_requested", "boolean"),
+                    field("read_only", "boolean"),
                 ],
             );
             value["args"] = json!([
@@ -92,7 +93,8 @@ pub fn generate(command_filter: Option<&str>) -> Value {
                     "--channel-history",
                     "boolean",
                     "Request admin-consented channel-history access"
-                )
+                ),
+                arg("--read-only", "boolean", "Block remote write operations")
             ]);
             value
         },
@@ -137,10 +139,29 @@ pub fn generate(command_filter: Option<&str>) -> Value {
                 field("configured", "boolean"),
                 field("signed_in", "boolean"),
                 field("config_path", "string"),
+                field("read_only", "boolean"),
                 nullable_array_field("granted_scopes", "string"),
                 nullable_field("channel_history", "boolean"),
             ],
         ),
+        single(
+            "config show",
+            "Print the resolved profile without credentials",
+            "read_only",
+            vec![
+                field("profile", "string"),
+                field("client_id", "string"),
+                field("tenant", "string"),
+                field("read_only", "boolean"),
+                field("config_path", "string"),
+            ],
+        ),
+        single(
+            "config path",
+            "Print the absolute configuration file path",
+            "read_only",
+            vec![],
+        ),
         single(
             "whoami",
             "Show the signed-in Microsoft 365 identity",
@@ -275,6 +296,7 @@ pub fn generate(command_filter: Option<&str>) -> Value {
             "api":"Microsoft Graph v1.0",
             "default_client_id": crate::config::DEFAULT_CLIENT_ID,
             "login_modes":["browser_pkce","device_code"],
+            "read_only_env":"TEAMS_READ_ONLY",
             "baseline_scopes": crate::auth::BASE_SCOPES.split_whitespace().collect::<Vec<_>>(),
             "privileged_scopes":[crate::auth::CHANNEL_HISTORY_SCOPE]
         }

{teams_cli-0.1.2 → teams_cli-0.1.3}/tests/cli.rs

@@ -101,7 +101,7 @@ fn no_args_never_prompts_when_piped() {
     Command::cargo_bin("teams")
         .unwrap()
         .assert()
-        .code(8)
+        .code(2)
         .stderr(predicate::str::contains("\"kind\":\"tty_required\""));
 }
 
@@ -119,9 +119,54 @@ fn noninteractive_init_uses_the_maintained_client_id() {
     assert_eq!(result["client_id"], "66ebad71-1604-48fc-a086-0d4caa24988b");
     assert_eq!(result["tenant"], "organizations");
     assert_eq!(result["channel_history_requested"], false);
+    assert_eq!(result["read_only"], false);
     assert!(temp.path().join("teams/config.toml").is_file());
 }
 
+#[test]
+fn init_can_create_a_read_only_profile_and_config_show_resolves_it() {
+    let temp = tempfile::tempdir().unwrap();
+    Command::cargo_bin("teams")
+        .unwrap()
+        .env("XDG_CONFIG_HOME", temp.path())
+        .args(["init", "--no-login", "--read-only"])
+        .assert()
+        .success();
+
+    Command::cargo_bin("teams")
+        .unwrap()
+        .env("XDG_CONFIG_HOME", temp.path())
+        .args(["config", "show"])
+        .assert()
+        .success()
+        .stdout(predicate::str::contains("\"read_only\": true"));
+}
+
+#[test]
+fn suite_exit_codes_and_error_kinds_are_stable() {
+    let schema: Value = serde_json::from_slice(
+        &Command::cargo_bin("teams")
+            .unwrap()
+            .arg("schema")
+            .output()
+            .unwrap()
+            .stdout,
+    )
+    .unwrap();
+    let errors = schema["errors"].as_array().unwrap();
+    let code = |kind: &str| {
+        errors.iter().find(|error| error["kind"] == kind).unwrap()["exit_code"]
+            .as_i64()
+            .unwrap()
+    };
+    assert_eq!(code("invalid_input"), 2);
+    assert_eq!(code("auth"), 3);
+    assert_eq!(code("not_found"), 4);
+    assert_eq!(code("api_error"), 5);
+    assert_eq!(code("rate_limit"), 6);
+    assert_eq!(code("read_only"), 2);
+}
+
 #[test]
 fn headless_browser_login_refuses_before_writing_config() {
     let temp = tempfile::tempdir().unwrap();
@@ -130,7 +175,7 @@ fn headless_browser_login_refuses_before_writing_config() {
         .env("XDG_CONFIG_HOME", temp.path())
         .arg("init")
         .assert()
-        .code(8)
+        .code(2)
         .stderr(predicate::str::contains(
             "browser sign-in requires a terminal",
         ));

teams_cli-0.1.3/vership.toml

@@ -0,0 +1,10 @@
+[project]
+branch = "main"
+
+[changelog]
+unconventional = "exclude"
+
+[checks]
+lint = false
+tests = true
+test_command = "make check"

teams_cli-0.1.2/.github/workflows/ci.yml

@@ -1,47 +0,0 @@
-name: CI
-
-on:
-  push:
-  pull_request:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  test:
-    name: Test (${{ matrix.os }})
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-    runs-on: ${{ matrix.os }}
-    steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
-      - run: cargo test --locked --all-targets
-
-  quality:
-    name: Formatting and lints
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: rustfmt, clippy
-      - uses: Swatinem/rust-cache@v2
-      - run: cargo fmt -- --check
-      - run: cargo clippy --locked --all-targets -- -D warnings
-
-  security:
-    name: Dependency audit
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
-      - name: Install cargo-audit
-        run: cargo install cargo-audit --version 0.22.2 --locked
-      - name: Audit Cargo.lock
-        run: cargo audit