tescmd 0.1.2__py3-none-any.whl → 0.2.0__py3-none-any.whl

tescmd/__init__.py

@@ -1,3 +1,3 @@
 """tescmd — A Python CLI for querying and controlling Tesla vehicles via the Fleet API."""
 
-__version__ = "0.1.2"
+__version__ = "0.2.0"

tescmd/api/client.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import asyncio
+import json
 from typing import TYPE_CHECKING, Any
 
 import httpx
@@ -185,5 +186,11 @@ class TeslaFleetClient:
                 status_code=response.status_code,
             )
 
-        result: dict[str, Any] = response.json()
+        try:
+            result: dict[str, Any] = response.json()
+        except json.JSONDecodeError as exc:
+            raise TeslaAPIError(
+                f"Invalid JSON response: {response.text[:200]}",
+                status_code=response.status_code,
+            ) from exc
         return result

tescmd/api/errors.py

@@ -74,3 +74,11 @@ class MissingScopesError(AuthError):
 
 class KeyNotEnrolledError(TeslaAPIError):
     """Vehicle rejected the command — key not enrolled."""
+
+
+class TunnelError(ConfigError):
+    """Tunnel provider not available or setup failed."""
+
+
+class TailscaleError(TunnelError):
+    """Tailscale not installed, not running, or Funnel setup failed."""

tescmd/api/vehicle.py

@@ -132,11 +132,29 @@ class VehicleAPI:
         return result
 
     async def fleet_telemetry_config_create(self, *, config: dict[str, Any]) -> dict[str, Any]:
-        """Create or update fleet telemetry server configuration."""
+        """Create or update fleet telemetry server configuration.
+
+        .. deprecated::
+            Tesla now requires the Vehicle Command HTTP Proxy for this
+            endpoint.  Use :meth:`fleet_telemetry_config_create_jws` instead.
+        """
         data = await self._client.post("/api/1/vehicles/fleet_telemetry_config", json=config)
         result: dict[str, Any] = data.get("response", {})
         return result
 
+    async def fleet_telemetry_config_create_jws(
+        self, *, vins: list[str], token: str
+    ) -> dict[str, Any]:
+        """Create fleet telemetry config via the JWS-signed endpoint.
+
+        *token* is a compact JWS signed with the Tesla.SS256 algorithm
+        (Schnorr/P-256).  See :func:`tescmd.crypto.schnorr.sign_fleet_telemetry_config`.
+        """
+        payload = {"vins": vins, "token": token}
+        data = await self._client.post("/api/1/vehicles/fleet_telemetry_config_jws", json=payload)
+        result: dict[str, Any] = data.get("response", {})
+        return result
+
     async def fleet_telemetry_config_delete(self, vin: str) -> dict[str, Any]:
         """Remove fleet telemetry configuration from a vehicle."""
         data = await self._client.delete(f"/api/1/vehicles/{vin}/fleet_telemetry_config")

tescmd/cache/response_cache.py

@@ -196,10 +196,11 @@ class ResponseCache:
 
     def _write_entry(self, path: Path, data: dict[str, Any], ttl: int) -> None:
         self._cache_dir.mkdir(parents=True, exist_ok=True)
+        now = time.time()
         entry = {
             "data": data,
-            "created_at": time.time(),
-            "expires_at": time.time() + ttl,
+            "created_at": now,
+            "expires_at": now + ttl,
         }
         path.write_text(json.dumps(entry), encoding="utf-8")
 

tescmd/cli/auth.py

@@ -20,7 +20,13 @@ from tescmd.auth.oauth import (
 )
 from tescmd.auth.token_store import TokenStore
 from tescmd.cli._options import global_options
-from tescmd.models.auth import DEFAULT_SCOPES, PARTNER_SCOPES, TokenData, decode_jwt_scopes
+from tescmd.models.auth import (
+    DEFAULT_SCOPES,
+    PARTNER_SCOPES,
+    TokenData,
+    decode_jwt_payload,
+    decode_jwt_scopes,
+)
 from tescmd.models.config import AppSettings
 
 if TYPE_CHECKING:
@@ -182,11 +188,23 @@ async def _cmd_status(app_ctx: AppContext) -> None:
     region: str = meta.get("region", "unknown")
     has_refresh = store.refresh_token is not None
 
-    # Decode the JWT to show the *actual* granted scopes
+    # Decode the JWT to show the *actual* granted scopes and audience
     token_scopes: list[str] | None = None
+    audience: str | None = None
     access_token = store.access_token
     if access_token:
         token_scopes = decode_jwt_scopes(access_token)
+        jwt_payload = decode_jwt_payload(access_token)
+        if jwt_payload is not None:
+            aud_raw = jwt_payload.get("aud")
+            if isinstance(aud_raw, list) and aud_raw:
+                audience = aud_raw[0] if len(aud_raw) == 1 else ", ".join(str(a) for a in aud_raw)
+            elif isinstance(aud_raw, str):
+                audience = aud_raw
+            # Also check for 'ou' (origin URL) — Tesla-specific claim
+            ou = jwt_payload.get("ou")
+            if isinstance(ou, str) and ou:
+                audience = ou
 
     if formatter.format == "json":
         data: dict[str, object] = {
@@ -198,6 +216,8 @@ async def _cmd_status(app_ctx: AppContext) -> None:
         }
         if token_scopes is not None:
             data["token_scopes"] = token_scopes
+        if audience is not None:
+            data["audience"] = audience
         formatter.output(data, command="auth.status")
     else:
         formatter.rich.info("Authenticated: yes")
@@ -211,6 +231,8 @@ async def _cmd_status(app_ctx: AppContext) -> None:
                 formatter.rich.info(
                     f"  [yellow]Warning: requested but not granted: {not_granted}[/yellow]"
                 )
+        if audience is not None:
+            formatter.rich.info(f"Audience: {audience}")
         formatter.rich.info(f"Region: {region}")
         formatter.rich.info(f"Refresh token: {'yes' if has_refresh else 'no'}")
 
@@ -484,6 +506,12 @@ def _interactive_setup(
     info(f"  Allowed Origin URL:  [cyan]{origin_url}[/cyan]")
     info(f"  Allowed Redirect URI: [cyan]{redirect_uri}[/cyan]")
     info("  Allowed Returned URL: (leave empty)")
+    info("")
+    info(
+        "  [dim]For telemetry streaming, add your Tailscale hostname"
+        " as an additional origin:[/dim]"
+    )
+    info("  [dim]  https://<machine>.tailnet.ts.net[/dim]")
     info("  Click Next.")
     info("")
 

tescmd/cli/key.py

@@ -25,6 +25,7 @@ from tescmd.models.config import AppSettings
 
 if TYPE_CHECKING:
     from tescmd.cli.main import AppContext
+    from tescmd.output.formatter import OutputFormatter
 
 
 # ---------------------------------------------------------------------------
@@ -95,22 +96,19 @@ async def _cmd_generate(app_ctx: AppContext, force: bool) -> None:
     default=None,
     help="GitHub repo (e.g. user/user.github.io). Auto-detected if omitted.",
 )
+@click.option(
+    "--method",
+    type=click.Choice(["auto", "github", "tailscale"]),
+    default="auto",
+    help="Deployment method (default: auto-detect).",
+)
 @global_options
-def deploy_cmd(app_ctx: AppContext, repo: str | None) -> None:
-    """Deploy the public key to GitHub Pages."""
-    run_async(_cmd_deploy(app_ctx, repo))
-
+def deploy_cmd(app_ctx: AppContext, repo: str | None, method: str) -> None:
+    """Deploy the public key to GitHub Pages or via Tailscale Funnel."""
+    run_async(_cmd_deploy(app_ctx, repo, method=method))
 
-async def _cmd_deploy(app_ctx: AppContext, repo: str | None) -> None:
-    from tescmd.deploy.github_pages import (
-        create_pages_repo,
-        deploy_public_key,
-        get_gh_username,
-        get_pages_domain,
-        is_gh_authenticated,
-        is_gh_available,
-    )
 
+async def _cmd_deploy(app_ctx: AppContext, repo: str | None, *, method: str = "auto") -> None:
     formatter = app_ctx.formatter
     settings = AppSettings()
     key_dir = Path(settings.config_dir).expanduser() / "keys"
@@ -127,6 +125,142 @@ async def _cmd_deploy(app_ctx: AppContext, repo: str | None) -> None:
             formatter.rich.error("No key pair found. Run [cyan]tescmd key generate[/cyan] first.")
         return
 
+    # Resolve method
+    resolved = _resolve_deploy_method(method, settings)
+
+    if resolved == "tailscale":
+        await _cmd_deploy_tailscale(formatter, key_dir)
+    elif resolved == "github":
+        await _cmd_deploy_github(formatter, settings, key_dir, repo)
+    else:
+        if formatter.format == "json":
+            formatter.output_error(
+                code="no_deploy_method",
+                message=(
+                    "No deployment method available. Install 'gh' CLI for GitHub Pages"
+                    " or Tailscale for Funnel hosting."
+                ),
+                command="key.deploy",
+            )
+        else:
+            formatter.rich.error(
+                "No deployment method available. Install [cyan]gh[/cyan] CLI"
+                " (GitHub Pages) or [cyan]tailscale[/cyan] (Funnel hosting)."
+            )
+
+
+def _resolve_deploy_method(method: str, settings: AppSettings) -> str | None:
+    """Resolve 'auto' to a concrete method, or validate explicit choice."""
+    if method in ("tailscale", "github"):
+        return method
+
+    # Auto-detect: GitHub Pages (always-on) > Tailscale (stable hostname)
+    from tescmd.deploy.github_pages import is_gh_authenticated, is_gh_available
+
+    if is_gh_available() and is_gh_authenticated():
+        return "github"
+
+    from tescmd.deploy.tailscale_serve import is_tailscale_serve_ready
+
+    if run_async(is_tailscale_serve_ready()):
+        return "tailscale"
+
+    # Check saved hosting method as last resort
+    if settings.hosting_method == "tailscale":
+        return "tailscale"
+    if settings.hosting_method == "github":
+        return "github"
+
+    return None
+
+
+async def _cmd_deploy_tailscale(
+    formatter: OutputFormatter,
+    key_dir: Path,
+) -> None:
+    """Deploy public key via Tailscale Funnel."""
+    from tescmd.deploy.tailscale_serve import (
+        deploy_public_key_tailscale,
+        get_key_url,
+        is_tailscale_serve_ready,
+        start_key_serving,
+        wait_for_tailscale_deployment,
+    )
+
+    # Verify Tailscale is ready
+    if not await is_tailscale_serve_ready():
+        if formatter.format == "json":
+            formatter.output_error(
+                code="tailscale_not_ready",
+                message=(
+                    "Tailscale is not available or Funnel is not enabled."
+                    " Ensure Tailscale is running and Funnel is enabled in your tailnet ACL."
+                ),
+                command="key.deploy",
+            )
+        else:
+            formatter.rich.error(
+                "Tailscale is not available or Funnel is not enabled.\n"
+                "  Ensure Tailscale is running and Funnel is enabled in your tailnet ACL."
+            )
+        return
+
+    if formatter.format != "json":
+        formatter.rich.info("Deploying public key via Tailscale Funnel...")
+
+    pem = load_public_key_pem(key_dir)
+    await deploy_public_key_tailscale(pem)
+    hostname = await start_key_serving()
+
+    url = get_key_url(hostname)
+    if formatter.format != "json":
+        formatter.rich.info("[green]Tailscale serve + Funnel started.[/green]")
+        formatter.rich.info(f"  URL: {url}")
+        formatter.rich.info("")
+        formatter.rich.info("Waiting for key to become accessible...")
+
+    deployed = await wait_for_tailscale_deployment(hostname)
+
+    if formatter.format == "json":
+        formatter.output(
+            {
+                "status": "deployed" if deployed else "pending",
+                "method": "tailscale",
+                "hostname": hostname,
+                "url": url,
+                "accessible": deployed,
+            },
+            command="key.deploy",
+        )
+    elif deployed:
+        formatter.rich.info("[green]Key is live and accessible.[/green]")
+        formatter.rich.info("")
+        formatter.rich.info(
+            "[yellow]Note:[/yellow] The key is served by the Tailscale daemon."
+            " If your machine is off or Tailscale stops,"
+            " Tesla cannot reach your public key."
+        )
+    else:
+        formatter.rich.info("[yellow]Key deployed but not yet accessible.[/yellow]")
+        formatter.rich.info("  Run [cyan]tescmd key validate[/cyan] to check again later.")
+
+
+async def _cmd_deploy_github(
+    formatter: OutputFormatter,
+    settings: AppSettings,
+    key_dir: Path,
+    repo: str | None,
+) -> None:
+    """Deploy public key via GitHub Pages."""
+    from tescmd.deploy.github_pages import (
+        create_pages_repo,
+        deploy_public_key,
+        get_gh_username,
+        get_pages_domain,
+        is_gh_authenticated,
+        is_gh_available,
+    )
+
     # Check gh CLI
     if not is_gh_available():
         if formatter.format == "json":
@@ -180,7 +314,7 @@ async def _cmd_deploy(app_ctx: AppContext, repo: str | None) -> None:
         formatter.rich.info("[green]Key deployed.[/green]")
         formatter.rich.info(f"  URL: {get_key_url(domain)}")
         formatter.rich.info("")
-        formatter.rich.info("Waiting for GitHub Pages to publish (this may take a few minutes)...")
+        formatter.rich.info("Waiting for GitHub Pages to publish...")
 
     deployed = wait_for_pages_deployment(domain)
 
@@ -188,6 +322,7 @@ async def _cmd_deploy(app_ctx: AppContext, repo: str | None) -> None:
         formatter.output(
             {
                 "status": "deployed" if deployed else "pending",
+                "method": "github",
                 "repo": repo_name,
                 "domain": domain,
                 "url": get_key_url(domain),

tescmd/cli/main.py

@@ -15,6 +15,7 @@ from tescmd.api.errors import (
     RegistrationRequiredError,
     SessionError,
     TierError,
+    TunnelError,
     VehicleAsleepError,
 )
 from tescmd.output.formatter import OutputFormatter
@@ -287,6 +288,9 @@ def _handle_known_error(
     if isinstance(exc, SessionError):
         _handle_session_error(exc, formatter, cmd_name)
         return True
+    if isinstance(exc, TunnelError):
+        _handle_tunnel_error(exc, formatter, cmd_name)
+        return True
 
     # Keyring failures (e.g. headless Linux with no keyring daemon)
     try:
@@ -599,3 +603,43 @@ def _handle_keyring_error(
     formatter.rich.info(
         "[dim]Tokens will be stored in plaintext with restricted file permissions.[/dim]"
     )
+
+
+def _handle_tunnel_error(
+    exc: TunnelError,
+    formatter: OutputFormatter,
+    cmd_name: str,
+) -> None:
+    """Show a friendly error for tunnel-related failures.
+
+    Only shows install guidance when no provider is found on PATH.
+    TailscaleError means Tailscale IS installed but hit an operational
+    error — install guidance would be confusing.
+    """
+    message = str(exc) or "No tunnel provider available for telemetry streaming."
+
+    if formatter.format == "json":
+        formatter.output_error(
+            code="tunnel_error",
+            message=message,
+            command=cmd_name,
+        )
+        return
+
+    formatter.rich.error(message)
+
+    # Only show install guidance when no provider was found at all.
+    if "No tunnel provider" not in message:
+        return
+
+    formatter.rich.info("")
+    formatter.rich.info("Telemetry streaming requires Tailscale Funnel:")
+    formatter.rich.info("")
+    formatter.rich.info("  1. Install Tailscale: [cyan]https://tailscale.com/download[/cyan]")
+    formatter.rich.info("  2. Authenticate: [cyan]tailscale up[/cyan]")
+    formatter.rich.info(
+        "  3. Enable Funnel in your tailnet ACL:"
+        " [cyan]https://login.tailscale.com/admin/acls[/cyan]"
+    )
+    formatter.rich.info("")
+    formatter.rich.info("Install telemetry deps: [cyan]pip install tescmd[telemetry][/cyan]")