tesla-cli 5.3.0__tar.gz

tesla_cli-5.3.0/.dockerignore

@@ -0,0 +1,9 @@
+.git
+.venv
+__pycache__
+*.pyc
+.pytest_cache
+.ruff_cache
+node_modules
+audit/
+.env*

tesla_cli-5.3.0/.env.example

@@ -0,0 +1,17 @@
+# Tesla CLI — Docker Configuration
+# Copy to .env and fill in your values: cp .env.example .env
+
+# ── Required ──────────────────────────────────────────────────
+TESLA_VIN=              # Your Tesla VIN (17 characters)
+TESLA_RN=               # Order reservation number (e.g. RNXXXXXXXXX)
+
+# ── API Server ────────────────────────────────────────────────
+TESLA_PORT=8080         # Dashboard + API port
+
+# ── Full Stack (docker-compose.full.yml) ──────────────────────
+DB_PASSWORD=teslamate   # PostgreSQL password
+ENCRYPTION_KEY=changeme # TeslaMate encryption key (generate a random string)
+TM_PORT=4000            # TeslaMate web UI port
+GRAFANA_PORT=3000       # Grafana dashboard port
+GRAFANA_PASSWORD=admin  # Grafana admin password
+MQTT_PORT=1883          # Mosquitto MQTT port

tesla_cli-5.3.0/.githooks/pre-push

@@ -0,0 +1,20 @@
+#!/bin/sh
+# Opt in with: git config core.hooksPath .githooks
+set -eu
+root=$(git rev-parse --show-toplevel)
+while read -r local_ref local_oid remote_ref remote_oid extra; do
+    [ -n "$local_ref" ] && [ -n "$remote_ref" ] && [ -z "$extra" ] || {
+        printf '%s\n' 'Invalid pre-push input.' >&2
+        exit 1
+    }
+    for oid in "$local_oid" "$remote_oid"; do
+        case "$oid" in
+            ''|*[!0-9a-fA-F]*) printf '%s\n' 'Invalid pre-push object ID.' >&2; exit 1 ;;
+        esac
+        [ "${#oid}" -eq 40 ] || [ "${#oid}" -eq 64 ] || exit 1
+    done
+    case "$local_oid" in
+        *[!0]*) "$root/scripts/secret-scan.sh" --ref "$local_oid" ;;
+        *) : ;; # Deleting a ref publishes no objects and needs no scanner.
+    esac
+done

tesla_cli-5.3.0/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,31 @@
+---
+name: Bug Report
+about: Report a bug in tesla-cli
+title: "[Bug] "
+labels: bug
+---
+
+## Describe the bug
+A clear description of what the bug is.
+
+## To Reproduce
+Steps to reproduce:
+1. Run `tesla ...`
+2. See error
+
+## Expected behavior
+What you expected to happen.
+
+## Environment
+- OS: [e.g. macOS 15, Ubuntu 24.04]
+- Python: [e.g. 3.12]
+- tesla-cli version: [e.g. 4.8.0]
+- Backend: [owner / fleet / fleet-signed / tessie]
+
+## Logs
+```
+Paste relevant output here
+```
+
+## Additional context
+Any other context (screenshots, config, etc.)

tesla_cli-5.3.0/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,18 @@
+---
+name: Feature Request
+about: Suggest a new feature
+title: "[Feature] "
+labels: enhancement
+---
+
+## Problem
+What problem does this solve?
+
+## Proposed Solution
+Describe the feature you'd like.
+
+## Alternatives Considered
+Any alternatives you've thought about.
+
+## Additional context
+Any other context (screenshots, links, etc.)

tesla_cli-5.3.0/.github/workflows/ci.yml

@@ -0,0 +1,93 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v4
+        with:
+          python-version: "3.12"
+      - run: uv sync --extra dev
+      - run: uv run ruff check src/ tests/
+      - run: uv run ruff format --check src/ tests/
+
+  test:
+    name: Test (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v4
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: uv sync --extra dev --extra serve --extra fleet --extra teslaMate --extra pdf --extra query
+      - run: uv run pytest -m "not integration" -v --cov=tesla_cli --cov-report=xml --cov-report=term --cov-fail-under=55
+        env:
+          NO_COLOR: "1"
+
+  version:
+    name: Version consistency
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: pyproject, __init__ and CHANGELOG agree
+        run: |
+          set -euo pipefail
+          py=$(sed -n 's/^version = "\(.*\)"/\1/p' pyproject.toml | head -1)
+          init=$(sed -n 's/^__version__ = "\(.*\)"/\1/p' src/tesla_cli/__init__.py)
+          echo "pyproject=$py __init__=$init"
+          test "$py" = "$init"
+          grep -Eq "^## \[(Unreleased|$py)\]" CHANGELOG.md
+
+  ui:
+    name: UI (typecheck, unit tests, build)
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ui
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: ui/package-lock.json
+      - run: npm ci
+        env:
+          CYPRESS_INSTALL_BINARY: "0"
+      - run: npx tsc --noEmit
+      - run: npx vitest run
+      - run: npx vite build --outDir "$RUNNER_TEMP/ui-dist" --emptyOutDir
+
+  docker:
+    name: Docker image builds
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build image
+        run: docker build -t tesla-cli:ci .
+      - name: Container serves health + requires API key
+        run: |
+          set -euo pipefail
+          docker run -d --name tesla-ci -p 8080:8080 tesla-cli:ci
+          for i in $(seq 1 30); do
+            curl -fsS http://127.0.0.1:8080/api/health && break
+            sleep 2
+          done
+          curl -fsS http://127.0.0.1:8080/api/health
+          code=$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8080/api/status)
+          test "$code" = "401"
+          docker logs tesla-ci 2>&1 | grep -q "API key generated"
+          test "$(docker exec tesla-ci id -u)" = "1000"
+      - if: always()
+        run: docker logs tesla-ci 2>&1 | tail -50 || true

tesla_cli-5.3.0/.github/workflows/publish.yml

@@ -0,0 +1,78 @@
+name: Publish to PyPI
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  verify:
+    name: Verify release (tag, lint, tests)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Tag matches package version
+        run: |
+          set -euo pipefail
+          tag="${GITHUB_REF_NAME#v}"
+          py=$(sed -n 's/^version = "\(.*\)"/\1/p' pyproject.toml | head -1)
+          init=$(sed -n 's/^__version__ = "\(.*\)"/\1/p' src/tesla_cli/__init__.py)
+          echo "tag=$tag pyproject=$py __init__=$init"
+          test "$tag" = "$py"
+          test "$tag" = "$init"
+          grep -q "^## \[$tag\]" CHANGELOG.md
+      - uses: astral-sh/setup-uv@v4
+        with:
+          python-version: "3.12"
+      - run: uv sync --frozen --extra dev --extra serve --extra fleet --extra teslaMate --extra pdf --extra query
+      - run: uv run ruff check src/ tests/
+      - run: uv run ruff format --check src/ tests/
+      - run: uv run pytest -m "not integration" -q
+        env:
+          NO_COLOR: "1"
+
+  build-and-publish:
+    name: Build and publish to PyPI
+    needs: verify
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/tesla-cli
+    permissions:
+      contents: read
+      id-token: write  # Trusted Publishing (no API token needed)
+
+    steps:
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Install pinned Gitleaks
+        shell: bash
+        run: |
+          set -euo pipefail
+          archive="$RUNNER_TEMP/gitleaks.tar.gz"
+          curl --fail --silent --show-error --location https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz --output "$archive"
+          echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  $archive" | sha256sum --check --status
+          mkdir -p "$RUNNER_TEMP/gitleaks-bin"
+          tar -xzf "$archive" -C "$RUNNER_TEMP/gitleaks-bin" gitleaks
+          echo "$RUNNER_TEMP/gitleaks-bin" >> "$GITHUB_PATH"
+
+      - name: Block publication of sensitive data
+        run: scripts/secret-scan.sh
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+
+      - name: Set up Python
+        run: uv python install 3.12
+
+      - name: Build package
+        run: uv build
+
+      - name: Scan distribution archives before publication
+        run: scripts/secret-scan.sh --artifacts dist
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

tesla_cli-5.3.0/.github/workflows/secret-scan.yml

@@ -0,0 +1,31 @@
+name: Secret Scan
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  secrets:
+    name: Secrets and personal data
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Install pinned Gitleaks
+        shell: bash
+        run: |
+          set -euo pipefail
+          archive="$RUNNER_TEMP/gitleaks.tar.gz"
+          curl --fail --silent --show-error --location https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz --output "$archive"
+          echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  $archive" | sha256sum --check --status
+          mkdir -p "$RUNNER_TEMP/gitleaks-bin"
+          tar -xzf "$archive" -C "$RUNNER_TEMP/gitleaks-bin" gitleaks
+          echo "$RUNNER_TEMP/gitleaks-bin" >> "$GITHUB_PATH"
+      - name: Scan all history and tracked files
+        run: scripts/secret-scan.sh

tesla_cli-5.3.0/.gitignore

@@ -0,0 +1,90 @@
+# Python
+__pycache__/
+*.pyc
+*.pyo
+*.egg-info/
+dist/
+build/
+.venv/
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Secrets & tokens (NEVER commit)
+.tesla-cli/
+mitm-captures/
+*.flow
+
+# VCP key material — must live only in the user's local
+# ~/.tesla-cli/keys/ (private) or their own hosting repo (public).
+# Never in this OSS repo. See docs/fleet-signed-setup.md.
+*.pem
+*.key
+keys/
+.well-known/
+
+# Large data files (generated, not source)
+references/
+nhtsa-complaints.json
+nhtsa-investigations.json
+public-api-data.json
+activity-log.json
+mission-control-data.json
+history/
+*.pdf
+
+# Personal automation scripts
+refresh-mission-control.py
+change-detector.py
+build-activity-log.sh
+mitm-tesla-capture.py
+
+# Generated reports and data exports
+dossier-report.html
+design-studio-co.json
+specs-sources.json
+tesla-ssr-data.json
+IMPLEMENTATION-PLAN.md
+
+# Claude Code local settings
+.claude/settings.local.json
+.claude/
+
+# UI (React frontend)
+ui/node_modules/
+ui/dist/
+ui/.vscode/
+
+# Test artifacts
+.coverage
+
+# OMC
+missions/
+.omx/
+
+# Temp
+fix-live-sources.py
+superchargers-co.json
+.env.local
+.codex/
+AGENTS.md
+audit/
+
+# Local configuration, backups and environment credentials
+.env
+.env.*
+!.env.example
+.envrc
+/tesla-config*.json
+!/tesla-config.example.json
+/tesla-config*.json.*
+/tesla-config*.bak
+/tesla-config*.backup
+coverage.xml

tesla_cli-5.3.0/.gitleaks.toml

@@ -0,0 +1,45 @@
+title = "Tesla secrets and personal identifiers"
+
+[extend]
+useDefault = true
+
+[[rules]]
+id = "tesla-vin"
+description = "Vehicle identifiers must not be published"
+regex = '''\b(?:[1-5][A-HJ-NPR-Z0-9]{2}|7SA|7G2|LRW|XP7)[A-HJ-NPR-Z0-9]{14}\b'''
+
+[[rules.allowlists]]
+description = "Individually audited synthetic fixtures; never add a real identifier"
+regexes = ['''^(?:5YJ3E1EA0JF000000|5YJ3E1EA1PF000001|5YJ3E1EA1PF000002|5YJ3E1EA1PF123456|5YJ3E1EA1PF999999|5YJ3E1EA8PF123456|5YJYGDEE5MF000000|LRWYE7FK4TC123456|LRWYGCEK3TC000000|7SAYGDEF1TF123456|7SAYGDEE4RF000001)$''']
+
+[[rules]]
+id = "tesla-reservation"
+description = "Order reservations must not be published"
+regex = '''\bRN[0-9]{6,12}\b'''
+
+[[rules.allowlists]]
+description = "Individually audited synthetic order fixtures"
+regexes = ['''^(?:RN000000000|RN123456|RN123456789|RN987654321|RN999888|RN999999999)$''']
+
+[[rules]]
+id = "telegram-token-in-url"
+description = "Telegram bot credentials, including Apprise URLs"
+regex = '''\b[0-9]{7,12}:[A-Za-z0-9_-]{30,50}\b'''
+
+[[rules]]
+id = "generic-api-key"
+[[rules.allowlists]]
+description = "Audited generated React vnode SHA1 keys, not authentication keys"
+condition = "AND"
+regexTarget = "match"
+regexes = ['''\bkey\s*:\s*["'][a-f0-9]{30,40}(?:["']|$)''']
+paths = ['''(?:^|/)(?:src/)?tesla_cli/api/ui_dist/assets/[^/]+\.js$''']
+
+[[rules]]
+id = "private-key"
+[[rules.allowlists]]
+description = "Nonfunctional fake key marker used by the idempotency test"
+condition = "AND"
+regexTarget = "match"
+regexes = ['''^-----BEGIN PRIVATE KEY-----(?:\\n|\n)fake(?:\\n|\n)''']
+paths = ['''(?:^|/)tests/test_fleet_signed_backend\.py$''']

tesla_cli-5.3.0/.python-version

@@ -0,0 +1 @@
+3.12