tenuo-claude-code 0.2.0__tar.gz → 0.2.1__tar.gz

{tenuo_claude_code-0.2.0 → tenuo_claude_code-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tenuo-claude-code
-Version: 0.2.0
+Version: 0.2.1
 Summary: Tenuo governance for Claude Code — warrants, hooks, MCP proxy, and Cloud lifecycle
 Project-URL: Homepage, https://tenuo.ai
 Project-URL: Repository, https://github.com/tenuo-ai/claude-governance
@@ -30,8 +30,6 @@ Description-Content-Type: text/markdown
 
 # Tenuo for Claude Code
 
-PyPI package: [`tenuo-claude-code`](https://pypi.org/project/tenuo-claude-code/) · CLI: `tenuo-claude`, `tenuo-admin`
-
 [![PyPI](https://img.shields.io/pypi/v/tenuo-claude-code)](https://pypi.org/project/tenuo-claude-code/)
 [![Python](https://img.shields.io/pypi/pyversions/tenuo-claude-code)](https://pypi.org/project/tenuo-claude-code/)
 [![CI](https://github.com/tenuo-ai/claude-governance/actions/workflows/ci.yml/badge.svg)](https://github.com/tenuo-ai/claude-governance/actions/workflows/ci.yml)
@@ -71,7 +69,7 @@ No Docker, or prefer native? Run `tenuo-claude install-authorizer` once, then `b
 
 ## How it works
 
-![Architecture](docs/images/tenuo_claude_code_architecture.svg)
+![Architecture](https://raw.githubusercontent.com/tenuo-ai/claude-governance/main/docs/images/tenuo_claude_code_architecture.png)
 
 ```
 tenuo.yaml  →  init/up  →  warrant + authorizer + hooks + MCP proxy
@@ -483,7 +481,7 @@ In `mode: audit`, denials show as `WOULD-DENY` in `audit` output (`shadow: true`
 
 These are the non-repudiable receipts for compliance and fleet audit, not the local JSONL file.
 
-![Authorization receipts in Tenuo Cloud](docs/images/cloud-audit-stream.png)
+![Authorization receipts in Tenuo Cloud](https://raw.githubusercontent.com/tenuo-ai/claude-governance/main/docs/images/cloud-audit-stream.png)
 
 More: [docs/DETAILS.md § Receipts](docs/DETAILS.md#receipts).
 

{tenuo_claude_code-0.2.0 → tenuo_claude_code-0.2.1}/README.md

@@ -1,7 +1,5 @@
 # Tenuo for Claude Code
 
-PyPI package: [`tenuo-claude-code`](https://pypi.org/project/tenuo-claude-code/) · CLI: `tenuo-claude`, `tenuo-admin`
-
 [![PyPI](https://img.shields.io/pypi/v/tenuo-claude-code)](https://pypi.org/project/tenuo-claude-code/)
 [![Python](https://img.shields.io/pypi/pyversions/tenuo-claude-code)](https://pypi.org/project/tenuo-claude-code/)
 [![CI](https://github.com/tenuo-ai/claude-governance/actions/workflows/ci.yml/badge.svg)](https://github.com/tenuo-ai/claude-governance/actions/workflows/ci.yml)
@@ -41,7 +39,7 @@ No Docker, or prefer native? Run `tenuo-claude install-authorizer` once, then `b
 
 ## How it works
 
-![Architecture](docs/images/tenuo_claude_code_architecture.svg)
+![Architecture](https://raw.githubusercontent.com/tenuo-ai/claude-governance/main/docs/images/tenuo_claude_code_architecture.png)
 
 ```
 tenuo.yaml  →  init/up  →  warrant + authorizer + hooks + MCP proxy
@@ -453,7 +451,7 @@ In `mode: audit`, denials show as `WOULD-DENY` in `audit` output (`shadow: true`
 
 These are the non-repudiable receipts for compliance and fleet audit, not the local JSONL file.
 
-![Authorization receipts in Tenuo Cloud](docs/images/cloud-audit-stream.png)
+![Authorization receipts in Tenuo Cloud](https://raw.githubusercontent.com/tenuo-ai/claude-governance/main/docs/images/cloud-audit-stream.png)
 
 More: [docs/DETAILS.md § Receipts](docs/DETAILS.md#receipts).
 

tenuo_claude_code-0.2.1/docs/images/README.md

@@ -0,0 +1,22 @@
+# Images for docs
+
+| File | Used in | Shows |
+|------|---------|--------|
+| `tenuo_claude_code_architecture.png` | README (PyPI + GitHub) | Architecture diagram (export from `.svg`) |
+| `tenuo_claude_code_architecture.svg` | Source | Editable diagram |
+| `cloud-audit-stream.png` | README | Cloud receipt list (allow/deny/approved) |
+| `cloud-receipt-approval-detail.png` | PRESENTATION | Drill-down: human approval + request hash |
+
+**PyPI:** the project README uses absolute `raw.githubusercontent.com` URLs and PNG
+(raster) assets. PyPI does not resolve relative paths and does not render SVG in
+project descriptions.
+
+Regenerate the architecture PNG after editing the SVG:
+
+```bash
+rsvg-convert -w 1280 docs/images/tenuo_claude_code_architecture.svg \
+  -o docs/images/tenuo_claude_code_architecture.png
+```
+
+Captured from [cloud.tenuo.ai](https://cloud.tenuo.ai) after a governed WebFetch
+with approval configured. Do not commit credentials or secrets in replacements.

{tenuo_claude_code-0.2.0 → tenuo_claude_code-0.2.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tenuo-claude-code"
-version = "0.2.0"
+version = "0.2.1"
 description = "Tenuo governance for Claude Code — warrants, hooks, MCP proxy, and Cloud lifecycle"
 readme = "README.md"
 requires-python = ">=3.10"

{tenuo_claude_code-0.2.0 → tenuo_claude_code-0.2.1}/src/tenuo_claude_code/__init__.py

@@ -1,3 +1,3 @@
 """Tenuo governance for Claude Code — CLI, hooks, and MCP proxy."""
 
-__version__ = "0.2.0"
+__version__ = "0.2.1"

{tenuo_claude_code-0.2.0 → tenuo_claude_code-0.2.1}/src/tenuo_claude_code/cli.py

@@ -1931,6 +1931,40 @@ def cmd_onboard(args) -> None:
 
     created = scaffold_example_policy(DEMO_DIR, no_scaffold=getattr(args, "no_scaffold", False))
 
+    admin_key = None
+    if cloud:
+        token = getattr(args, "connect_token", None) or os.environ.get("TENUO_CONNECT_TOKEN")
+        if not token and CLOUD_ENV.exists():
+            token = runtime_env().get("TENUO_CONNECT_TOKEN")
+        if not token and not getattr(args, "yes", False):
+            token = _prompt("Paste Quick Connect token (tenuo_ct_…)")
+        if not token:
+            raise SystemExit("Cloud onboarding needs TENUO_CONNECT_TOKEN (Quick Connect → Authorizer Only).")
+        write_cloud_env(token)
+
+        url = _parse_connect_token(token.strip())["url"]
+        write_cloud_profile(url=url)
+        print(f"Wrote {CLOUD_PROFILE.name}")
+
+        if getattr(args, "advanced", False) or getattr(args, "demo", False):
+            approver = getattr(args, "approver", None)
+            approver_id = getattr(args, "approver_id", None)
+            if not approver and not approver_id and not getattr(args, "yes", False):
+                approver = _prompt("Approver display name (must exist in Cloud)")
+            if not approver and not approver_id:
+                raise SystemExit("--advanced requires --approver-id or --approver.")
+            write_advanced_profile(approver=approver, approver_id=approver_id)
+            print(f"Wrote {ADVANCED_PROFILE.name} (advanced — re-run `tenuo-admin setup`)")
+
+        admin_key = getattr(args, "admin_key", None) or os.environ.get("TENUO_ADMIN_KEY")
+        if not admin_key and ADMIN_ENV.exists():
+            admin_key = read_env_file(ADMIN_ENV).get("TENUO_ADMIN_KEY")
+        if not admin_key and not getattr(args, "yes", False):
+            admin_key = _prompt("Paste tenant-admin key for one-time setup (blank = skip)", "")
+        if admin_key:
+            write_admin_env(admin_key)
+            print(f"Wrote {ADMIN_ENV}")
+
     if not created:
         print("\nRunning preflight…")
         try:
@@ -1955,39 +1989,6 @@ def cmd_onboard(args) -> None:
         print("\nOnboard complete (local). Open Claude Code in this directory.")
         return
 
-    # Cloud path
-    token = getattr(args, "connect_token", None) or os.environ.get("TENUO_CONNECT_TOKEN")
-    if not token and CLOUD_ENV.exists():
-        token = runtime_env().get("TENUO_CONNECT_TOKEN")
-    if not token and not getattr(args, "yes", False):
-        token = _prompt("Paste Quick Connect token (tenuo_ct_…)")
-    if not token:
-        raise SystemExit("Cloud onboarding needs TENUO_CONNECT_TOKEN (Quick Connect → Authorizer Only).")
-    write_cloud_env(token)
-
-    url = _parse_connect_token(token.strip())["url"]
-    write_cloud_profile(url=url)
-    print(f"Wrote {CLOUD_PROFILE.name}")
-
-    if getattr(args, "advanced", False) or getattr(args, "demo", False):
-        approver = getattr(args, "approver", None)
-        approver_id = getattr(args, "approver_id", None)
-        if not approver and not approver_id and not getattr(args, "yes", False):
-            approver = _prompt("Approver display name (must exist in Cloud)")
-        if not approver and not approver_id:
-            raise SystemExit("--advanced requires --approver-id or --approver.")
-        write_advanced_profile(approver=approver, approver_id=approver_id)
-        print(f"Wrote {ADVANCED_PROFILE.name} (advanced — re-run `tenuo-admin setup`)")
-
-    admin_key = getattr(args, "admin_key", None) or os.environ.get("TENUO_ADMIN_KEY")
-    if not admin_key and ADMIN_ENV.exists():
-        admin_key = read_env_file(ADMIN_ENV).get("TENUO_ADMIN_KEY")
-    if not admin_key and not getattr(args, "yes", False):
-        admin_key = _prompt("Paste tenant-admin key for one-time setup (blank = skip)", "")
-    if admin_key:
-        write_admin_env(admin_key)
-        print(f"Wrote {ADMIN_ENV}")
-
     cmd_init(argparse.Namespace(cloud=False, local=False))
 
     if admin_key:

tenuo_claude_code-0.2.1/tests/test_check.py

@@ -0,0 +1,74 @@
+"""Preflight / wiring checks (PyPI layout — no repo ``bin/tenuo-claude``)."""
+
+from __future__ import annotations
+
+import argparse
+
+from tenuo_claude_code import cli
+
+
+def test_check_wiring_ok_without_launcher(monkeypatch, tmp_path):
+    """Missing ``./bin/tenuo-claude`` must not fail preflight (PyPI installs use PATH)."""
+    proj = tmp_path / "proj"
+    proj.mkdir()
+    monkeypatch.setattr(cli, "LAUNCHER", proj / "bin" / "tenuo-claude", raising=False)
+    monkeypatch.setattr(cli, "DEMO_DIR", proj, raising=False)
+    ok = cli._check_wiring({"mcp": {}}, True)
+    assert ok is True
+
+
+def test_probe_runtime_creds_accepts_tenant_without_srl(monkeypatch):
+    monkeypatch.setattr(
+        cli,
+        "cloud_api",
+        lambda method, url, key, path: (
+            404,
+            {"error": {"code": "srl_not_found", "message": "no SRL exists for this tenant"}},
+        ),
+    )
+
+    ok, msg = cli.probe_runtime_creds({"url": "https://api.example", "api_key": "rt"})
+
+    assert ok is True
+    assert "no SRL yet" in msg
+
+
+def test_cloud_onboard_writes_profile_before_preflight(monkeypatch, tmp_path):
+    state = tmp_path / ".state"
+    monkeypatch.setattr(cli, "DEMO_DIR", tmp_path, raising=False)
+    monkeypatch.setattr(cli, "STATE", state, raising=False)
+    monkeypatch.setattr(cli, "CONFIG_FILE", tmp_path / "tenuo.yaml", raising=False)
+    monkeypatch.setattr(cli, "CLOUD_ENV", state / "cloud.env", raising=False)
+    monkeypatch.setattr(cli, "CLOUD_STATE", state / "cloud_state.json", raising=False)
+    monkeypatch.setattr(cli, "CLOUD_PROFILE", tmp_path / "tenuo.cloud.yaml", raising=False)
+    monkeypatch.setattr(cli, "ADVANCED_PROFILE", tmp_path / "tenuo.advanced.yaml", raising=False)
+    monkeypatch.setattr(cli, "ADMIN_ENV", tmp_path / "home" / ".tenuo" / "admin.env", raising=False)
+    monkeypatch.setattr(cli, "scaffold_example_policy", lambda *a, **k: False)
+    monkeypatch.setattr(cli, "_parse_connect_token",
+                        lambda token: {"url": "https://api.example", "api_key": "rt"})
+
+    seen = {}
+
+    def fake_check(_args):
+        seen["mode"] = cli.intended_mode({})
+        raise SystemExit(0)
+
+    monkeypatch.setattr(cli, "cmd_check", fake_check)
+    monkeypatch.setattr(cli, "cmd_init", lambda _args: None)
+    monkeypatch.setattr(cli, "cmd_up", lambda _args: None)
+    monkeypatch.setattr(cli, "cmd_verify", lambda _args: None)
+
+    cli.cmd_onboard(argparse.Namespace(
+        cloud=True,
+        local=False,
+        yes=True,
+        no_scaffold=False,
+        connect_token="tenuo_ct_fake",
+        admin_key=None,
+        advanced=False,
+        demo=False,
+        approver=None,
+        approver_id=None,
+    ))
+
+    assert seen["mode"] == "cloud"

tenuo_claude_code-0.2.0/docs/images/README.md

@@ -1,9 +0,0 @@
-# Images for docs
-
-| File | Used in | Shows |
-|------|---------|--------|
-| `cloud-audit-stream.png` | README | Cloud receipt list (allow/deny/approved) |
-| `cloud-receipt-approval-detail.png` | README | Drill-down: human approval + request hash |
-
-Captured from [cloud.tenuo.ai](https://cloud.tenuo.ai) after a governed WebFetch
-with approval configured. Do not commit credentials or secrets in replacements.

tenuo_claude_code-0.2.0/tests/test_check.py

@@ -1,31 +0,0 @@
-"""Preflight / wiring checks (PyPI layout — no repo ``bin/tenuo-claude``)."""
-
-from __future__ import annotations
-
-from tenuo_claude_code import cli
-
-
-def test_check_wiring_ok_without_launcher(monkeypatch, tmp_path):
-    """Missing ``./bin/tenuo-claude`` must not fail preflight (PyPI installs use PATH)."""
-    proj = tmp_path / "proj"
-    proj.mkdir()
-    monkeypatch.setattr(cli, "LAUNCHER", proj / "bin" / "tenuo-claude", raising=False)
-    monkeypatch.setattr(cli, "DEMO_DIR", proj, raising=False)
-    ok = cli._check_wiring({"mcp": {}}, True)
-    assert ok is True
-
-
-def test_probe_runtime_creds_accepts_tenant_without_srl(monkeypatch):
-    monkeypatch.setattr(
-        cli,
-        "cloud_api",
-        lambda method, url, key, path: (
-            404,
-            {"error": {"code": "srl_not_found", "message": "no SRL exists for this tenant"}},
-        ),
-    )
-
-    ok, msg = cli.probe_runtime_creds({"url": "https://api.example", "api_key": "rt"})
-
-    assert ok is True
-    assert "no SRL yet" in msg