tony-cli 0.3.2__tar.gz → 0.4.0__tar.gz

{tony_cli-0.3.2/src/tony_cli.egg-info → tony_cli-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tony-cli
-Version: 0.3.2
+Version: 0.4.0
 Summary: Explains a git diff to whoever now owns it — annotated changes, blast radius, and steppable runtime walkthroughs.
 Author: Fawwaz Abayomi
 License: MIT License
@@ -95,9 +95,11 @@ tony main...my-branch        # review a branch against main
 tony                         # review the default branch...HEAD
 ```
 
-The page is written to `.tony/` inside the repo (gitignored automatically) and
-opens in your browser. It's one self-contained HTML file — fonts, styles, and
-data inlined — so it works offline and forever.
+Reviews stay on your machine. The page is written to `.tony/` inside the repo
+(gitignored automatically) and opens in your browser — one self-contained HTML
+file, fonts and styles and data inlined, so it works offline and forever.
+Nothing is uploaded; the only thing that leaves your machine is the diff tony
+sends to Anthropic to write the review.
 
 tony needs an Anthropic API key (`ANTHROPIC_API_KEY`, or `~/.tony/.env`). The
 first run tells you exactly where to get one and where to put it. tony reviews
@@ -126,8 +128,7 @@ The range is git's own `BASE...HEAD` syntax. With no range, tony diffs against
 
 | Flag | What it does |
 |---|---|
-| `--local` | Keep the review on this machine. No account needed, nothing uploaded; you get the self-contained page in `.tony/` instead of a link. |
-| `--json` | Print the raw review JSON to stdout and exit. Writes no page, uploads nothing, needs no account. |
+| `--json` | Print the raw review JSON to stdout and exit. Writes no page instead. |
 | `--no-open` | Write the page but don't open a browser. For CI, or over SSH. |
 | `--stale` | Review a revision that isn't checked out, or with a dirty tree. Code is read from disk, so line numbers may not match the diff — tony refuses by default for that reason. |
 | `--replay` | Rebuild the page from the last saved review for this range, without calling the API. Free; use it after a tony upgrade to re-render an old review. |
@@ -135,17 +136,6 @@ The range is git's own `BASE...HEAD` syntax. With no range, tony diffs against
 | `-m`, `--model` | Model to review with. Defaults to `claude-opus-5`. |
 | `--max-tokens` | Response ceiling, default `64000`. Raise it if a review comes back cut off. |
 
-### Sharing
-
-| Command | What it does |
-|---|---|
-| `tony login` | Sign in to tony-cli.com with GitHub's device flow. Once per machine. |
-| `tony logout` | Revoke this machine's token server-side, then delete it locally. |
-| `tony whoami` | Which GitHub account this machine is signed in as. |
-| `tony unpublish <id>` | Take one published review down. The id is the last part of its URL. |
-
-Publishing is the default when you're signed in. `--local` opts out per run.
-
 ### Managing tony
 
 | Command | What it does |
@@ -161,29 +151,6 @@ limit it to the current repo instead of searching your home directory.
 Both `tony update` and the installer resolve from PyPI explicitly, so a machine
 pointed at an internal mirror can't decide what `tony-cli` is.
 
-## Share a review
-
-```sh
-tony login                   # once — GitHub device flow
-tony main...my-branch        # publishing is the default
-tony: https://tony-cli.com/r/8f3ka92m
-```
-
-**Who can read a published review:** anyone signed in who has the link. Review
-ids are random, so the link is what grants access — treat it like a password.
-`tony unpublish <id>` removes a review at any time.
-
-**What the site can read:** everything in the review. The payload is uploaded
-over TLS and encrypted at rest under a key the server holds, so a leak of the
-stored blobs yields nothing — but we can open a review, and so can any lawful
-demand made to us. Do not publish from a repository you could not share with
-us. An earlier design encrypted on your machine and kept the key in the link's
-fragment; that was dropped deliberately when reading moved behind an account
-and a history of past reviews became part of the product, since both need the
-server to be able to open a review.
-
-Local review needs no account and never leaves the machine: `tony --local`.
-
 ## Uninstall
 
 ```sh
@@ -191,16 +158,13 @@ tony uninstall
 ```
 
 Removing the package by itself would leave the parts worth removing: your
-`ANTHROPIC_API_KEY` and site login in `~/.tony`, and a `.tony/` directory of
-past reviews inside every repository you ran tony in — those hold source code.
-`tony uninstall` revokes the site token, lists everything it found and waits
-for you to type `yes`, deletes it, then removes the package with whichever of
-uv, pipx, or pip installed it.
+`ANTHROPIC_API_KEY` in `~/.tony`, and a `.tony/` directory of past reviews
+inside every repository you ran tony in — those hold source code. `tony
+uninstall` lists everything it found, waits for you to type `yes`, deletes it,
+then removes the package with whichever of uv, pipx, or pip installed it.
 
 It searches your home directory for stray review directories; `--no-scan`
-limits it to the current repository, and `--yes` skips the prompt. Reviews you
-published to the site are separate — take those down with `tony unpublish <id>`
-before uninstalling, or they stay up.
+limits it to the current repository, and `--yes` skips the prompt.
 
 ## Development
 

{tony_cli-0.3.2 → tony_cli-0.4.0}/README.md

@@ -41,9 +41,11 @@ tony main...my-branch        # review a branch against main
 tony                         # review the default branch...HEAD
 ```
 
-The page is written to `.tony/` inside the repo (gitignored automatically) and
-opens in your browser. It's one self-contained HTML file — fonts, styles, and
-data inlined — so it works offline and forever.
+Reviews stay on your machine. The page is written to `.tony/` inside the repo
+(gitignored automatically) and opens in your browser — one self-contained HTML
+file, fonts and styles and data inlined, so it works offline and forever.
+Nothing is uploaded; the only thing that leaves your machine is the diff tony
+sends to Anthropic to write the review.
 
 tony needs an Anthropic API key (`ANTHROPIC_API_KEY`, or `~/.tony/.env`). The
 first run tells you exactly where to get one and where to put it. tony reviews
@@ -72,8 +74,7 @@ The range is git's own `BASE...HEAD` syntax. With no range, tony diffs against
 
 | Flag | What it does |
 |---|---|
-| `--local` | Keep the review on this machine. No account needed, nothing uploaded; you get the self-contained page in `.tony/` instead of a link. |
-| `--json` | Print the raw review JSON to stdout and exit. Writes no page, uploads nothing, needs no account. |
+| `--json` | Print the raw review JSON to stdout and exit. Writes no page instead. |
 | `--no-open` | Write the page but don't open a browser. For CI, or over SSH. |
 | `--stale` | Review a revision that isn't checked out, or with a dirty tree. Code is read from disk, so line numbers may not match the diff — tony refuses by default for that reason. |
 | `--replay` | Rebuild the page from the last saved review for this range, without calling the API. Free; use it after a tony upgrade to re-render an old review. |
@@ -81,17 +82,6 @@ The range is git's own `BASE...HEAD` syntax. With no range, tony diffs against
 | `-m`, `--model` | Model to review with. Defaults to `claude-opus-5`. |
 | `--max-tokens` | Response ceiling, default `64000`. Raise it if a review comes back cut off. |
 
-### Sharing
-
-| Command | What it does |
-|---|---|
-| `tony login` | Sign in to tony-cli.com with GitHub's device flow. Once per machine. |
-| `tony logout` | Revoke this machine's token server-side, then delete it locally. |
-| `tony whoami` | Which GitHub account this machine is signed in as. |
-| `tony unpublish <id>` | Take one published review down. The id is the last part of its URL. |
-
-Publishing is the default when you're signed in. `--local` opts out per run.
-
 ### Managing tony
 
 | Command | What it does |
@@ -107,29 +97,6 @@ limit it to the current repo instead of searching your home directory.
 Both `tony update` and the installer resolve from PyPI explicitly, so a machine
 pointed at an internal mirror can't decide what `tony-cli` is.
 
-## Share a review
-
-```sh
-tony login                   # once — GitHub device flow
-tony main...my-branch        # publishing is the default
-tony: https://tony-cli.com/r/8f3ka92m
-```
-
-**Who can read a published review:** anyone signed in who has the link. Review
-ids are random, so the link is what grants access — treat it like a password.
-`tony unpublish <id>` removes a review at any time.
-
-**What the site can read:** everything in the review. The payload is uploaded
-over TLS and encrypted at rest under a key the server holds, so a leak of the
-stored blobs yields nothing — but we can open a review, and so can any lawful
-demand made to us. Do not publish from a repository you could not share with
-us. An earlier design encrypted on your machine and kept the key in the link's
-fragment; that was dropped deliberately when reading moved behind an account
-and a history of past reviews became part of the product, since both need the
-server to be able to open a review.
-
-Local review needs no account and never leaves the machine: `tony --local`.
-
 ## Uninstall
 
 ```sh
@@ -137,16 +104,13 @@ tony uninstall
 ```
 
 Removing the package by itself would leave the parts worth removing: your
-`ANTHROPIC_API_KEY` and site login in `~/.tony`, and a `.tony/` directory of
-past reviews inside every repository you ran tony in — those hold source code.
-`tony uninstall` revokes the site token, lists everything it found and waits
-for you to type `yes`, deletes it, then removes the package with whichever of
-uv, pipx, or pip installed it.
+`ANTHROPIC_API_KEY` in `~/.tony`, and a `.tony/` directory of past reviews
+inside every repository you ran tony in — those hold source code. `tony
+uninstall` lists everything it found, waits for you to type `yes`, deletes it,
+then removes the package with whichever of uv, pipx, or pip installed it.
 
 It searches your home directory for stray review directories; `--no-scan`
-limits it to the current repository, and `--yes` skips the prompt. Reviews you
-published to the site are separate — take those down with `tony unpublish <id>`
-before uninstalling, or they stay up.
+limits it to the current repository, and `--yes` skips the prompt.
 
 ## Development
 

{tony_cli-0.3.2 → tony_cli-0.4.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tony-cli"
-version = "0.3.2"
+version = "0.4.0"
 description = "Explains a git diff to whoever now owns it — annotated changes, blast radius, and steppable runtime walkthroughs."
 readme = "README.md"
 license = { file = "LICENSE" }

{tony_cli-0.3.2 → tony_cli-0.4.0}/src/tony_cli/agent.py

@@ -523,10 +523,6 @@ def main(argv=None):
         epilog=(
             "commands:\n"
             "  tony <path> [BASE...HEAD]      review a diff — the default\n"
-            "  tony login                     sign in to the tony site\n"
-            "  tony logout                    revoke this machine's token\n"
-            "  tony whoami                    who this machine is signed in as\n"
-            "  tony unpublish <id>            take one published review down\n"
             "  tony update                    update to the latest release\n"
             "  tony uninstall                 delete tony, its key, and every saved review\n"
             "  tony --version                 what is installed\n"
@@ -566,10 +562,17 @@ def main(argv=None):
         "--no-open", action="store_false", dest="openPage",
         help="Write the page but do not open it in a browser.",
     )
+    # Reviews stay on this machine unless asked otherwise. Publishing used to be
+    # the default, which put a GitHub account in front of a first run: `tony`
+    # with no account printed an error and never reviewed anything. Sharing is a
+    # separate act, and it is opt-in until it can be relied on end to end.
+    parser.add_argument(
+        "--publish", action="store_true",
+        help=argparse.SUPPRESS,
+    )
     parser.add_argument(
         "--local", action="store_true",
-        help="Keep the review on this machine. Skips publishing, needs no account, "
-             "and opens the self-contained page in .tony/ instead of a link.",
+        help=argparse.SUPPRESS,  # now the default; accepted so it never breaks
     )
     parser.add_argument(
         "--payload", nargs="?", const=True, default=False, metavar="PATH",
@@ -636,17 +639,14 @@ def main(argv=None):
             print(f"tony: {problem}", file=sys.stderr)
             return 2
 
-    # Reviews publish by default, so the login is checked before the review
-    # runs — discovering it afterwards would waste an API call the user paid for.
-    # `--json` prints and exits without ever uploading, so it is as offline as
-    # `--local` and must not be gated on an account it will not use.
-    offline = args.local or args.asJson
-    if not offline and not hosted.savedToken():
+    # Checked before the review runs — discovering it afterwards would waste an
+    # API call the user already paid for.
+    publishing = args.publish and not args.asJson
+    if publishing and not hosted.savedToken():
         print(
-            "tony: you need to sign in before publishing a review.\n\n"
+            "tony: publishing needs an account.\n\n"
             "    tony login          # once, with GitHub\n\n"
-            "  Or keep this one on your machine and skip the account:\n\n"
-            f"    tony {args.path} {args.range or ''} --local".rstrip() + "\n",
+            "  Or drop --publish to keep this review on your machine.\n",
             file=sys.stderr,
         )
         return 2
@@ -745,7 +745,7 @@ def main(argv=None):
     # is the fallback when publishing fails so a paid-for review is never lost.
     target = f"file://{path}"
 
-    if not args.local:
+    if publishing:
         url, problem = hosted.publish(
             payloadJson, repo=os.path.basename(root), rangeLabel=rangeLabel,
         )
@@ -755,8 +755,7 @@ def main(argv=None):
         else:
             print(url)
             target = url
-
-    if args.local:
+    else:
         print(f"tony: {path}")
     if args.openPage:
         webbrowser.open(target)

{tony_cli-0.3.2 → tony_cli-0.4.0}/src/tony_cli/install.py

@@ -7,6 +7,7 @@ the root of the environment tony is actually running from.
 """
 
 import os
+import re
 import subprocess
 import sys
 
@@ -18,7 +19,13 @@ PKG = "tony-cli"
 # an ambient index setting, so on a machine pointed at an internal mirror an
 # update would pull whatever that mirror serves under the name `tony-cli`.
 INDEX = "https://pypi.org/simple"
-RELEASES = "https://pypi.org/pypi/tony-cli/json"
+
+# The project's page on that same index, asked for as JSON (PEP 691). Not
+# pypi.org/pypi/<name>/json — that one is CDN-cached and runs minutes behind a
+# release, so it will call a version "latest" that an installer has already
+# moved past, and report "already on the latest version" to someone who is not.
+PROJECT = f"{INDEX}/{PKG}/"
+SIMPLE_JSON = "application/vnd.pypi.simple.v1+json"
 
 
 def indexEnv():
@@ -101,21 +108,39 @@ def installedOnDisk():
     return name[len("tony_cli-"):-len(".dist-info")] or None
 
 
+def _release(version):
+    """A sortable key for a plain release, or None for anything else.
+
+    Pre-releases and dev builds sort unpredictably as digit tuples — "1.0.0rc1"
+    would read as (1, 0, 0, 1) and outrank 1.0.0 — and `tony update` should not
+    move anyone onto one.
+    """
+    if not re.fullmatch(r"\d+(?:\.\d+)*", version or ""):
+        return None
+    return tuple(int(n) for n in version.split("."))
+
+
 def latestVersion(timeout=10):
-    """The newest version PyPI serves, or None if it cannot be asked.
+    """The newest release the index offers, or None if it cannot be asked.
 
     Worth one request: without it there is nothing to check the upgrade
     against, and every installer exits 0 for "already at latest" — which is
     indistinguishable from "upgraded" unless you knew the target beforehand.
     """
     try:
-        response = httpx.get(RELEASES, timeout=timeout)
+        response = httpx.get(
+            PROJECT, timeout=timeout, headers={"Accept": SIMPLE_JSON},
+            follow_redirects=True,
+        )
         if response.status_code != 200:
             return None
-        return ((response.json() or {}).get("info") or {}).get("version")
+        versions = (response.json() or {}).get("versions") or []
     except Exception:
         return None
 
+    ranked = [(key, v) for v in versions if (key := _release(v))]
+    return max(ranked)[1] if ranked else None
+
 
 def update(argv=()):
     """`tony update`. Returns an exit code, prints its own messages."""

{tony_cli-0.3.2 → tony_cli-0.4.0/src/tony_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tony-cli
-Version: 0.3.2
+Version: 0.4.0
 Summary: Explains a git diff to whoever now owns it — annotated changes, blast radius, and steppable runtime walkthroughs.
 Author: Fawwaz Abayomi
 License: MIT License
@@ -95,9 +95,11 @@ tony main...my-branch        # review a branch against main
 tony                         # review the default branch...HEAD
 ```
 
-The page is written to `.tony/` inside the repo (gitignored automatically) and
-opens in your browser. It's one self-contained HTML file — fonts, styles, and
-data inlined — so it works offline and forever.
+Reviews stay on your machine. The page is written to `.tony/` inside the repo
+(gitignored automatically) and opens in your browser — one self-contained HTML
+file, fonts and styles and data inlined, so it works offline and forever.
+Nothing is uploaded; the only thing that leaves your machine is the diff tony
+sends to Anthropic to write the review.
 
 tony needs an Anthropic API key (`ANTHROPIC_API_KEY`, or `~/.tony/.env`). The
 first run tells you exactly where to get one and where to put it. tony reviews
@@ -126,8 +128,7 @@ The range is git's own `BASE...HEAD` syntax. With no range, tony diffs against
 
 | Flag | What it does |
 |---|---|
-| `--local` | Keep the review on this machine. No account needed, nothing uploaded; you get the self-contained page in `.tony/` instead of a link. |
-| `--json` | Print the raw review JSON to stdout and exit. Writes no page, uploads nothing, needs no account. |
+| `--json` | Print the raw review JSON to stdout and exit. Writes no page instead. |
 | `--no-open` | Write the page but don't open a browser. For CI, or over SSH. |
 | `--stale` | Review a revision that isn't checked out, or with a dirty tree. Code is read from disk, so line numbers may not match the diff — tony refuses by default for that reason. |
 | `--replay` | Rebuild the page from the last saved review for this range, without calling the API. Free; use it after a tony upgrade to re-render an old review. |
@@ -135,17 +136,6 @@ The range is git's own `BASE...HEAD` syntax. With no range, tony diffs against
 | `-m`, `--model` | Model to review with. Defaults to `claude-opus-5`. |
 | `--max-tokens` | Response ceiling, default `64000`. Raise it if a review comes back cut off. |
 
-### Sharing
-
-| Command | What it does |
-|---|---|
-| `tony login` | Sign in to tony-cli.com with GitHub's device flow. Once per machine. |
-| `tony logout` | Revoke this machine's token server-side, then delete it locally. |
-| `tony whoami` | Which GitHub account this machine is signed in as. |
-| `tony unpublish <id>` | Take one published review down. The id is the last part of its URL. |
-
-Publishing is the default when you're signed in. `--local` opts out per run.
-
 ### Managing tony
 
 | Command | What it does |
@@ -161,29 +151,6 @@ limit it to the current repo instead of searching your home directory.
 Both `tony update` and the installer resolve from PyPI explicitly, so a machine
 pointed at an internal mirror can't decide what `tony-cli` is.
 
-## Share a review
-
-```sh
-tony login                   # once — GitHub device flow
-tony main...my-branch        # publishing is the default
-tony: https://tony-cli.com/r/8f3ka92m
-```
-
-**Who can read a published review:** anyone signed in who has the link. Review
-ids are random, so the link is what grants access — treat it like a password.
-`tony unpublish <id>` removes a review at any time.
-
-**What the site can read:** everything in the review. The payload is uploaded
-over TLS and encrypted at rest under a key the server holds, so a leak of the
-stored blobs yields nothing — but we can open a review, and so can any lawful
-demand made to us. Do not publish from a repository you could not share with
-us. An earlier design encrypted on your machine and kept the key in the link's
-fragment; that was dropped deliberately when reading moved behind an account
-and a history of past reviews became part of the product, since both need the
-server to be able to open a review.
-
-Local review needs no account and never leaves the machine: `tony --local`.
-
 ## Uninstall
 
 ```sh
@@ -191,16 +158,13 @@ tony uninstall
 ```
 
 Removing the package by itself would leave the parts worth removing: your
-`ANTHROPIC_API_KEY` and site login in `~/.tony`, and a `.tony/` directory of
-past reviews inside every repository you ran tony in — those hold source code.
-`tony uninstall` revokes the site token, lists everything it found and waits
-for you to type `yes`, deletes it, then removes the package with whichever of
-uv, pipx, or pip installed it.
+`ANTHROPIC_API_KEY` in `~/.tony`, and a `.tony/` directory of past reviews
+inside every repository you ran tony in — those hold source code. `tony
+uninstall` lists everything it found, waits for you to type `yes`, deletes it,
+then removes the package with whichever of uv, pipx, or pip installed it.
 
 It searches your home directory for stray review directories; `--no-scan`
-limits it to the current repository, and `--yes` skips the prompt. Reviews you
-published to the site are separate — take those down with `tony unpublish <id>`
-before uninstalling, or they stay up.
+limits it to the current repository, and `--yes` skips the prompt.
 
 ## Development