transcript-viewer 0.15.0__tar.gz → 0.16.0__tar.gz

transcript_viewer-0.15.0/README.md → transcript_viewer-0.16.0/PKG-INFO

@@ -1,3 +1,18 @@
+Metadata-Version: 2.5
+Name: transcript-viewer
+Version: 0.16.0
+Summary: Browse agent transcripts in a local, dependency-free web viewer.
+License: MIT
+Requires-Python: >=3.12
+Requires-Dist: atif-make>=0.8.0
+Provides-Extra: ai
+Requires-Dist: anthropic>=0.40; extra == 'ai'
+Provides-Extra: parquet
+Requires-Dist: atif-make[parquet]>=0.8.0; extra == 'parquet'
+Provides-Extra: postgres
+Requires-Dist: psycopg[binary]>=3.1; extra == 'postgres'
+Description-Content-Type: text/markdown
+
 # transcript-viewer
 
 Browse agent transcripts in a local web viewer — what Claude Code, Codex and
@@ -10,7 +25,20 @@ all of the reading. What is added here is only the browser interface, so a
 format this cannot open is a parser missing from `atif-make` rather than
 anything to change in the viewer.
 
-## Install
+## Run it
+
+No install, nothing to undo:
+
+```sh
+uvx transcript-viewer                    # opens on 127.0.0.1, and that is it
+uvx transcript-viewer path/to/session.jsonl
+```
+
+`uvx` fetches it, runs it, and leaves nothing behind. It is the honest way to
+try a tool that is going to read your agent logs — have a look first, and keep
+it only if it earns the disk.
+
+To keep it:
 
 ```sh
 uv tool install transcript-viewer                    # pulls atif-make automatically
@@ -20,15 +48,23 @@ uv tool install "transcript-viewer[ai,parquet]"      # + the optional Claude fea
 
 The extras are only needed for what they name: `parquet` for a dataset that
 ships as Parquet rather than JSON, `ai` for the summarise and ask features. The
-viewer works without either.
+viewer works without either. With `uvx`, ask for one with
+`uvx --from "transcript-viewer[parquet]" transcript-viewer`.
 
 ```sh
 transcript-viewer                        # the library, empty on a first run
 transcript-viewer path/to/session.jsonl  # one log
 transcript-viewer bundle.zip             # a bundle someone sent you
 transcript-viewer --port 8080 --no-open
+transcript-viewer sync s3://bucket/runs  # take what is new, and only what is new
 ```
 
+Everything is yours and stays here. It binds `127.0.0.1` and nothing else, the
+library lives in `~/.transcript-viewer`, no account is involved, and nothing
+leaves the machine unless you ask it to — a fetch you typed, or a summary you
+pressed for with your own API key. There is no telemetry to turn off because
+there is none to write.
+
 Nothing appears on a first run. Sessions arrive two ways:
 
 - **⟳ on the Local folder** finds what Claude Code, Codex and Copilot have
@@ -322,17 +358,17 @@ which of the two is in use, and **Remove** clears the stored one.
 
 With no key configured, every AI control is hidden and the endpoint refuses.
 
-Each transcript also has its own **With AI support** switch. Turn it off and
-that session's controls disappear — useful when a transcript holds something that should not
-leave the machine. The server enforces it too, so a switched-off transcript is
-refused even if a request is made directly.
-
 ## Themes
 
-Three, from Diwan: `paper`, `cool` (both light) and `dark`. The control in the
-top bar cycles them, as Diwan's own header does, and the choice is remembered
-per browser. Note that "light and dark" is really three modes here — two of
-Diwan's palettes are light.
+Three from Diwan — `paper`, `cool` (both light) and `dark` — and a pair,
+`redwood` and `redwoodDark`, taken from Redwood Research's own design tokens for
+transcripts that end up in a Redwood deck. Both come from that file as written:
+the dark one is Redwood's own dark palette, not the light one dimmed, which is
+why its green is `#43b184` where the light one's is `#1a7d5c`. The control in
+the top bar cycles them, as Diwan's own header does, and the choice is
+remembered per browser; a remembered name this build no longer has falls back to
+`paper` rather than to an unstyled page. Note that "light and dark" is really
+five modes here, three of them light.
 
 ## What it shows
 
@@ -436,6 +472,56 @@ disagree with it, since the list counted top-level calls while the box counts
 every subagent at every depth. Steps render 250 at a time so
 a 8,000-step session stays responsive.
 
+## Running it for more than one person
+
+Everything above is the whole tool. This section is for the one case it is not:
+a copy of it serving a team rather than sitting on a laptop.
+
+Nothing here is on by default, and a copy told nothing behaves exactly as the
+one you have — loopback, nobody signed in, annotations in SQLite beside the
+index. There is a test that walks every route asserting that, because it is what
+keeps this one program rather than two.
+
+A `deploy.toml` beside the library says the rest, and every setting can come
+from the environment instead, which is what a container has:
+
+```toml
+[server]
+host = "0.0.0.0"
+
+[identity]
+# The header whatever stands in front puts the signed-in person in. Trusted
+# only because it is named here — a header this was not told to expect is one
+# anybody can send.
+header = "x-amzn-oidc-identity"
+admins = ["you@example.com"]
+
+[storage]
+database = "postgresql://…"   # needs transcript-viewer[postgres]
+
+[secrets]
+mode = "server"               # the operator's keys, not each person's
+
+[ai]
+enabled = "off"               # never send a transcript to a model
+
+[sources]
+urls = ["s3://bucket/runs"]   # what `transcript-viewer sync` follows
+```
+
+The sign-in is not implemented here and should not be: a load balancer or a mesh
+in front does it, and hands over one header. That is why the header must be
+named — if the server can be reached around whatever authenticated the request,
+anyone can claim to be anyone.
+
+`postgres` is for this and only this. Annotations live in SQLite otherwise,
+which is in the standard library and needs nothing installed — but two copies of
+the server with two SQLite files means one person's stars exist on one of them
+and not the other, which is a wrong answer rather than a slow one.
+
+Labels are shared and stars are personal: a title, a tag or a note is the team's
+one description of a transcript, and what you starred is yours.
+
 ## Developing alongside atif-make
 
 The two packages are developed together — a viewer feature usually needs the
@@ -473,16 +559,20 @@ it was handed.
 
 ```
 src/transcript_viewer/
-  page.html    the whole front end — 2,232 lines of HTML, CSS and JavaScript
+  page.html    the whole interface: one page, no build step, no dependencies
   viewer.py    the HTTP server: sixteen endpoints over the page and the library
   corpus.py    the index — what is on this machine, and where it came from
   library.py   what you decide about a session: title, tags, stars, summaries
+  db.py        where those decisions are kept — SQLite, or PostgreSQL when shared
+  cache.py     what has been converted lately, kept only while there is room
   fetch.py     bringing transcripts in from Hugging Face, GitHub, S3 or a link
+  ingest.py    what happens to them after: unpack, index, record where they came from
   ai.py        the optional Claude-backed features
-  config.py    settings and tokens
+  config.py    settings and tokens — what a person types in
+  deploy.py    how this copy is set up — what an operator decided, before anyone arrived
+  identity.py  who is asking, when anyone is
   store.py     small JSON files under ~/.transcript-viewer, written so a crash cannot truncate them
   cli.py       the command line
-  page.html    the whole interface: one page, no build step, no dependencies
 ```
 
 The page is a file rather than a string inside `viewer.py`, which is where it
@@ -525,8 +615,8 @@ trajectory pane stuck on "Converting…". Those checks live in
 
 The AI tests never call the API. Most stub the model call and check the part
 that matters when it is wrong — that nothing is sent unasked, that a summary is
-paid for once, that a stored key never reaches a response, and that a transcript
-switched off is refused by the server rather than merely hidden.
+paid for once, that a stored key never reaches a response, and that the endpoint
+refuses outright when no credential is configured.
 
 `tests/test_stream.py` is the exception: it drives the one function that does
 touch the SDK, using a fake client but the SDK's real exception classes, so a

transcript_viewer-0.15.0/PKG-INFO → transcript_viewer-0.16.0/README.md

@@ -1,16 +1,3 @@
-Metadata-Version: 2.5
-Name: transcript-viewer
-Version: 0.15.0
-Summary: Browse agent transcripts in a local, dependency-free web viewer.
-License: MIT
-Requires-Python: >=3.12
-Requires-Dist: atif-make>=0.8.0
-Provides-Extra: ai
-Requires-Dist: anthropic>=0.40; extra == 'ai'
-Provides-Extra: parquet
-Requires-Dist: atif-make[parquet]>=0.8.0; extra == 'parquet'
-Description-Content-Type: text/markdown
-
 # transcript-viewer
 
 Browse agent transcripts in a local web viewer — what Claude Code, Codex and
@@ -23,7 +10,20 @@ all of the reading. What is added here is only the browser interface, so a
 format this cannot open is a parser missing from `atif-make` rather than
 anything to change in the viewer.
 
-## Install
+## Run it
+
+No install, nothing to undo:
+
+```sh
+uvx transcript-viewer                    # opens on 127.0.0.1, and that is it
+uvx transcript-viewer path/to/session.jsonl
+```
+
+`uvx` fetches it, runs it, and leaves nothing behind. It is the honest way to
+try a tool that is going to read your agent logs — have a look first, and keep
+it only if it earns the disk.
+
+To keep it:
 
 ```sh
 uv tool install transcript-viewer                    # pulls atif-make automatically
@@ -33,15 +33,23 @@ uv tool install "transcript-viewer[ai,parquet]"      # + the optional Claude fea
 
 The extras are only needed for what they name: `parquet` for a dataset that
 ships as Parquet rather than JSON, `ai` for the summarise and ask features. The
-viewer works without either.
+viewer works without either. With `uvx`, ask for one with
+`uvx --from "transcript-viewer[parquet]" transcript-viewer`.
 
 ```sh
 transcript-viewer                        # the library, empty on a first run
 transcript-viewer path/to/session.jsonl  # one log
 transcript-viewer bundle.zip             # a bundle someone sent you
 transcript-viewer --port 8080 --no-open
+transcript-viewer sync s3://bucket/runs  # take what is new, and only what is new
 ```
 
+Everything is yours and stays here. It binds `127.0.0.1` and nothing else, the
+library lives in `~/.transcript-viewer`, no account is involved, and nothing
+leaves the machine unless you ask it to — a fetch you typed, or a summary you
+pressed for with your own API key. There is no telemetry to turn off because
+there is none to write.
+
 Nothing appears on a first run. Sessions arrive two ways:
 
 - **⟳ on the Local folder** finds what Claude Code, Codex and Copilot have
@@ -335,17 +343,17 @@ which of the two is in use, and **Remove** clears the stored one.
 
 With no key configured, every AI control is hidden and the endpoint refuses.
 
-Each transcript also has its own **With AI support** switch. Turn it off and
-that session's controls disappear — useful when a transcript holds something that should not
-leave the machine. The server enforces it too, so a switched-off transcript is
-refused even if a request is made directly.
-
 ## Themes
 
-Three, from Diwan: `paper`, `cool` (both light) and `dark`. The control in the
-top bar cycles them, as Diwan's own header does, and the choice is remembered
-per browser. Note that "light and dark" is really three modes here — two of
-Diwan's palettes are light.
+Three from Diwan — `paper`, `cool` (both light) and `dark` — and a pair,
+`redwood` and `redwoodDark`, taken from Redwood Research's own design tokens for
+transcripts that end up in a Redwood deck. Both come from that file as written:
+the dark one is Redwood's own dark palette, not the light one dimmed, which is
+why its green is `#43b184` where the light one's is `#1a7d5c`. The control in
+the top bar cycles them, as Diwan's own header does, and the choice is
+remembered per browser; a remembered name this build no longer has falls back to
+`paper` rather than to an unstyled page. Note that "light and dark" is really
+five modes here, three of them light.
 
 ## What it shows
 
@@ -449,6 +457,56 @@ disagree with it, since the list counted top-level calls while the box counts
 every subagent at every depth. Steps render 250 at a time so
 a 8,000-step session stays responsive.
 
+## Running it for more than one person
+
+Everything above is the whole tool. This section is for the one case it is not:
+a copy of it serving a team rather than sitting on a laptop.
+
+Nothing here is on by default, and a copy told nothing behaves exactly as the
+one you have — loopback, nobody signed in, annotations in SQLite beside the
+index. There is a test that walks every route asserting that, because it is what
+keeps this one program rather than two.
+
+A `deploy.toml` beside the library says the rest, and every setting can come
+from the environment instead, which is what a container has:
+
+```toml
+[server]
+host = "0.0.0.0"
+
+[identity]
+# The header whatever stands in front puts the signed-in person in. Trusted
+# only because it is named here — a header this was not told to expect is one
+# anybody can send.
+header = "x-amzn-oidc-identity"
+admins = ["you@example.com"]
+
+[storage]
+database = "postgresql://…"   # needs transcript-viewer[postgres]
+
+[secrets]
+mode = "server"               # the operator's keys, not each person's
+
+[ai]
+enabled = "off"               # never send a transcript to a model
+
+[sources]
+urls = ["s3://bucket/runs"]   # what `transcript-viewer sync` follows
+```
+
+The sign-in is not implemented here and should not be: a load balancer or a mesh
+in front does it, and hands over one header. That is why the header must be
+named — if the server can be reached around whatever authenticated the request,
+anyone can claim to be anyone.
+
+`postgres` is for this and only this. Annotations live in SQLite otherwise,
+which is in the standard library and needs nothing installed — but two copies of
+the server with two SQLite files means one person's stars exist on one of them
+and not the other, which is a wrong answer rather than a slow one.
+
+Labels are shared and stars are personal: a title, a tag or a note is the team's
+one description of a transcript, and what you starred is yours.
+
 ## Developing alongside atif-make
 
 The two packages are developed together — a viewer feature usually needs the
@@ -486,16 +544,20 @@ it was handed.
 
 ```
 src/transcript_viewer/
-  page.html    the whole front end — 2,232 lines of HTML, CSS and JavaScript
+  page.html    the whole interface: one page, no build step, no dependencies
   viewer.py    the HTTP server: sixteen endpoints over the page and the library
   corpus.py    the index — what is on this machine, and where it came from
   library.py   what you decide about a session: title, tags, stars, summaries
+  db.py        where those decisions are kept — SQLite, or PostgreSQL when shared
+  cache.py     what has been converted lately, kept only while there is room
   fetch.py     bringing transcripts in from Hugging Face, GitHub, S3 or a link
+  ingest.py    what happens to them after: unpack, index, record where they came from
   ai.py        the optional Claude-backed features
-  config.py    settings and tokens
+  config.py    settings and tokens — what a person types in
+  deploy.py    how this copy is set up — what an operator decided, before anyone arrived
+  identity.py  who is asking, when anyone is
   store.py     small JSON files under ~/.transcript-viewer, written so a crash cannot truncate them
   cli.py       the command line
-  page.html    the whole interface: one page, no build step, no dependencies
 ```
 
 The page is a file rather than a string inside `viewer.py`, which is where it
@@ -538,8 +600,8 @@ trajectory pane stuck on "Converting…". Those checks live in
 
 The AI tests never call the API. Most stub the model call and check the part
 that matters when it is wrong — that nothing is sent unasked, that a summary is
-paid for once, that a stored key never reaches a response, and that a transcript
-switched off is refused by the server rather than merely hidden.
+paid for once, that a stored key never reaches a response, and that the endpoint
+refuses outright when no credential is configured.
 
 `tests/test_stream.py` is the exception: it drives the one function that does
 touch the SDK, using a fake client but the SDK's real exception classes, so a

{transcript_viewer-0.15.0 → transcript_viewer-0.16.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "transcript-viewer"
-version = "0.15.0"
+version = "0.16.0"
 description = "Browse agent transcripts in a local, dependency-free web viewer."
 readme = "README.md"
 requires-python = ">=3.12"
@@ -23,6 +23,10 @@ dependencies = ["atif-make>=0.8.0"]
 # reader lives in atif-make, which only needs it to split a shard.
 parquet = ["atif-make[parquet]>=0.8.0"]
 ai = ["anthropic>=0.40"]
+# Only for a deployment serving more than one person. Two copies of the server
+# with two SQLite files means one person's stars exist on one and not the other,
+# which is a wrong answer rather than a slow one.
+postgres = ["psycopg[binary]>=3.1"]
 
 [project.scripts]
 transcript-viewer = "transcript_viewer.cli:main"

{transcript_viewer-0.15.0 → transcript_viewer-0.16.0}/src/transcript_viewer/ai.py

@@ -17,7 +17,7 @@ import re
 from collections.abc import Iterator
 from typing import Any
 
-from . import config
+from . import config, deploy
 
 MODEL = "claude-opus-5"
 
@@ -57,7 +57,14 @@ def status() -> tuple[bool, str]:
 
     A bare boolean was not enough: a saved key with no SDK installed looks
     exactly like no key at all, which reads as "the save didn't work".
+
+    A deployment that has turned this off is answered first and without
+    qualification. Everything below is about whether a call *could* be made;
+    this is about whether it may be, and the two must not be confused — a
+    refusal that reads like a missing dependency invites someone to install it.
     """
+    if deploy.current().ai != "on":
+        return False, "this viewer does not send transcripts to a model"
     try:
         _client()
     except Unavailable as exc:

transcript_viewer-0.16.0/src/transcript_viewer/cache.py

@@ -0,0 +1,115 @@
+"""What has been converted lately, kept only while there is room for it.
+
+Converting is expensive — seconds, and hundreds of megabytes for the largest
+session here — so the answer is worth keeping. It was kept in a dictionary on
+the handler class that nothing ever removed from, which is fine for an afternoon
+on a laptop and is a leak everywhere else: open enough transcripts and the
+process holds every one of them until it is restarted. In a container with a
+memory limit that is not a leak but a crash.
+
+So: least-recently-used, with a budget in bytes rather than in entries. Entries
+are the wrong unit when one of them is a 143 MB rollout and the next is a
+four-step session; a count that holds the small ones comfortably will hold two
+of the large ones and stop.
+
+Nothing here persists. A restart re-converts, which costs seconds once — the
+alternative is a store of converted output that grows on disk instead of in
+memory and needs its own eviction, and that is worth building when a restart is
+frequent enough to notice, not before.
+"""
+
+from __future__ import annotations
+
+import json
+import threading
+from collections import OrderedDict
+from typing import Any
+
+# Enough for the large sessions people actually open, and small enough that a
+# modest container does not have to be sized around it. Measured against the
+# corpus this was built on: the biggest single converted trajectory is ~34 MB,
+# so this holds a working set of several without ever holding all of them.
+DEFAULT_BUDGET = 256 * 1024 * 1024
+
+
+def weigh(value: Any) -> int:
+    """Roughly how much room something takes.
+
+    `len(json.dumps(...))` rather than anything exact: the real cost of a nested
+    dict is not knowable without walking it, this is within a small factor of
+    it, and the number is only ever compared against a budget that is itself a
+    judgement. Bytes are counted for anything already bytes, since that is what
+    an image is and serialising it would be both wrong and enormous.
+    """
+    if isinstance(value, (bytes, bytearray, memoryview)):
+        return len(value)
+    if (
+        isinstance(value, dict)
+        and value
+        and all(isinstance(v, (bytes, bytearray)) for v in value.values())
+    ):
+        return sum(len(v) for v in value.values())
+    try:
+        return len(json.dumps(value, default=str))
+    except (TypeError, ValueError):
+        # Something unserialisable is still taking up room; guess rather than
+        # refuse, because refusing would mean not caching it at all.
+        return 1024
+
+
+class Kept:
+    """A bounded store of what was asked for recently.
+
+    Thread-safe because the server is threaded and two requests for the same
+    unconverted session arrive together often — both will convert, and both will
+    store, and that is cheaper than holding a lock across a conversion.
+    """
+
+    def __init__(self, budget: int = DEFAULT_BUDGET):
+        self.budget = budget
+        self._items: OrderedDict[str, Any] = OrderedDict()
+        self._sizes: dict[str, int] = {}
+        self._lock = threading.Lock()
+        self.held = 0
+
+    def get(self, key: str, default: Any = None) -> Any:
+        with self._lock:
+            if key not in self._items:
+                return default
+            self._items.move_to_end(key)
+            return self._items[key]
+
+    def __contains__(self, key: str) -> bool:
+        with self._lock:
+            return key in self._items
+
+    def __len__(self) -> int:
+        with self._lock:
+            return len(self._items)
+
+    def put(self, key: str, value: Any) -> None:
+        size = weigh(value)
+        with self._lock:
+            if key in self._items:
+                self.held -= self._sizes.pop(key)
+                del self._items[key]
+            # Something larger than the whole budget is not cached rather than
+            # evicting everything to make room for one thing nobody else can
+            # then share.
+            if size > self.budget:
+                return
+            self._items[key] = value
+            self._sizes[key] = size
+            self.held += size
+            while self.held > self.budget and len(self._items) > 1:
+                oldest, _ = self._items.popitem(last=False)
+                self.held -= self._sizes.pop(oldest)
+
+    def __setitem__(self, key: str, value: Any) -> None:
+        self.put(key, value)
+
+    def clear(self) -> None:
+        with self._lock:
+            self._items.clear()
+            self._sizes.clear()
+            self.held = 0

{transcript_viewer-0.15.0 → transcript_viewer-0.16.0}/src/transcript_viewer/cli.py

@@ -6,7 +6,7 @@ import argparse
 import sys
 from pathlib import Path
 
-from . import corpus, store
+from . import config, corpus, db, deploy, fetch, ingest, store, viewer
 from atif_make.container import is_container
 
 from .viewer import serve
@@ -34,6 +34,15 @@ def cmd_view(args: argparse.Namespace) -> int:
             file=sys.stderr,
         )
 
+    # Annotations used to be one JSON document. Import it here, after any rename
+    # has settled, so a library left by either older shape is picked up on the
+    # first run that finds it and never looks like it went missing.
+    if moved := db.adopt_json():
+        print(
+            f"transcript-viewer: moved {moved} records into {db.DB_PATH.name}",
+            file=sys.stderr,
+        )
+
     if args.input:
         path = Path(args.input).expanduser()
         if not path.exists():
@@ -70,6 +79,50 @@ def cmd_view(args: argparse.Namespace) -> int:
     return 0
 
 
+def cmd_sync(args: argparse.Namespace) -> int:
+    """Ask each source what it has now, and take what is not here yet.
+
+    A command rather than a thread inside the server: it can be run by a
+    schedule, by hand, or by neither, and a fetch that wedges takes nothing
+    down with it. The same pipeline the Add dialog uses, so a place followed
+    automatically and a place fetched by hand end in the same state.
+    """
+    urls = args.url or list(deploy.current().sources)
+    if not urls:
+        print(
+            "transcript-viewer: nothing to sync. Name a URL, or list them under "
+            f"[sources] in {deploy.CONFIG_PATH}.",
+            file=sys.stderr,
+        )
+        return 2
+
+    entries = corpus.load()
+    into = fetch.destination(None)
+    trouble = 0
+    for url in urls:
+        try:
+            plan = fetch.plan(url, config.tokens())
+        except fetch.FetchError as exc:
+            print(f"transcript-viewer: {url}: {exc}", file=sys.stderr)
+            trouble = 1
+            continue
+
+        print(f"{url} — {len(plan.files)} files", file=sys.stderr)
+        for frame in ingest.bring(plan, into, entries, viewer._source_of):
+            if frame["t"] == "error":
+                print(f"transcript-viewer: {url}: {frame['error']}", file=sys.stderr)
+                trouble = 1
+            elif frame["t"] == "added":
+                # `seen` counts what the place holds; `added` what was not here
+                # already, which is the only number a schedule cares about.
+                print(
+                    f"{url} — {frame['added']} new of {frame['seen']}",
+                    file=sys.stderr,
+                )
+        entries = corpus.load()
+    return trouble
+
+
 def build_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(
         prog="transcript-viewer",
@@ -84,8 +137,25 @@ def build_parser() -> argparse.ArgumentParser:
     return parser
 
 
+def sync_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="transcript-viewer sync",
+        description="Take what is new from each source.",
+    )
+    parser.add_argument("url", nargs="*",
+                        help="where to look (default: the configured sources)")
+    parser.set_defaults(func=cmd_sync)
+    return parser
+
+
 def main(argv: list[str] | None = None) -> int:
-    args = build_parser().parse_args(list(sys.argv[1:] if argv is None else argv))
+    argv = list(sys.argv[1:] if argv is None else argv)
+    # One subcommand, matched before parsing rather than with subparsers: the
+    # ordinary form takes a path, and argparse cannot be given both an optional
+    # positional and a subcommand without one swallowing the other. A file
+    # actually named `sync` is reachable as `./sync`.
+    parser = sync_parser() if argv[:1] == ["sync"] else build_parser()
+    args = parser.parse_args(argv[1:] if argv[:1] == ["sync"] else argv)
     return args.func(args)
 
 

{transcript_viewer-0.15.0 → transcript_viewer-0.16.0}/src/transcript_viewer/config.py

@@ -20,7 +20,7 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Any
 
-from . import store
+from . import deploy, store
 
 CONFIG_PATH = store.ROOT / "config.json"
 VERSION = 1
@@ -105,11 +105,17 @@ def secret(name: str, path: Path | None = None) -> str | None:
 
     A token typed into settings wins: it is the more explicit, more recent act,
     and `source()` shows which is in use so the precedence is never a surprise.
+
+    Unless the operator supplies them. Then the file is not consulted at all —
+    not merely outranked. A deployment's credentials are its own, and a key
+    left in the file by an earlier local run would otherwise outrank the one
+    the operator configured and quietly spend the wrong account.
     """
     spec = _spec(name)
-    value = load(path).get(spec.field)
-    if isinstance(value, str) and value:
-        return value
+    if deploy.current().secrets != "server":
+        value = load(path).get(spec.field)
+        if isinstance(value, str) and value:
+            return value
     for variable in spec.env:
         from_env = os.environ.get(variable)
         if from_env: