vesk-cli 0.1.2__tar.gz → 0.1.4__tar.gz

{vesk_cli-0.1.2 → vesk_cli-0.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: vesk-cli
-Version: 0.1.2
+Version: 0.1.4
 Summary: Vesk Verify: test LLM endpoints and produce compliance-mapped reports.
 Author: Vesk
 License-Expression: Apache-2.0
@@ -53,6 +53,8 @@ vesk scan                      # run probes, write results.json
 vesk report results.json -o report.md
 ```
 
+`api_key_env` holds the *name* of an environment variable (e.g. `VESK_API_KEY`), not a file path or the key. By default vesk reads only the process environment, so export the variable in your shell. To use a `.env` file instead, pass it explicitly: `vesk scan --env-file .env`. Variables already set in the environment take precedence over the file. Omit `api_key_env` if the endpoint needs no key.
+
 ## Commands
 
 ### `vesk init`
@@ -69,6 +71,7 @@ Runs the configured probes against the target and writes a results JSON file.
 - `-c, --config PATH`: config file (default `vesk.yaml`).
 - `--probe NAME`: run only this probe; repeatable.
 - `--out PATH`: results file (default `results.json`).
+- `--env-file PATH`: optional dotenv-style file (`KEY=VALUE` lines) to read the API key from. Not read unless given; real environment variables win over the file.
 
 Exit codes:
 

{vesk_cli-0.1.2 → vesk_cli-0.1.4}/README.md

@@ -22,6 +22,8 @@ vesk scan                      # run probes, write results.json
 vesk report results.json -o report.md
 ```
 
+`api_key_env` holds the *name* of an environment variable (e.g. `VESK_API_KEY`), not a file path or the key. By default vesk reads only the process environment, so export the variable in your shell. To use a `.env` file instead, pass it explicitly: `vesk scan --env-file .env`. Variables already set in the environment take precedence over the file. Omit `api_key_env` if the endpoint needs no key.
+
 ## Commands
 
 ### `vesk init`
@@ -38,6 +40,7 @@ Runs the configured probes against the target and writes a results JSON file.
 - `-c, --config PATH`: config file (default `vesk.yaml`).
 - `--probe NAME`: run only this probe; repeatable.
 - `--out PATH`: results file (default `results.json`).
+- `--env-file PATH`: optional dotenv-style file (`KEY=VALUE` lines) to read the API key from. Not read unless given; real environment variables win over the file.
 
 Exit codes:
 

{vesk_cli-0.1.2 → vesk_cli-0.1.4}/src/vesk/__init__.py

@@ -1,3 +1,3 @@
 """Vesk Verify: LLM endpoint testing with compliance-mapped reports."""
 
-__version__ = "0.1.2"
+__version__ = "0.1.4"

{vesk_cli-0.1.2 → vesk_cli-0.1.4}/src/vesk/cli.py

@@ -54,6 +54,12 @@ def scan(
     config: Path = typer.Option(Path("vesk.yaml"), "-c", "--config", help="Config file."),
     probe: list[str] | None = typer.Option(None, "--probe", help="Probe to run (repeatable)."),
     out: Path = typer.Option(Path("results.json"), "--out", help="Results JSON path."),
+    env_file: Path | None = typer.Option(
+        None,
+        "--env-file",
+        help="Optional .env file to read the API key from. "
+        "Variables already set in the environment win. Without it, only the environment is used.",
+    ),
 ) -> None:
     """Run probes against the target and write a results JSON file."""
     import asyncio
@@ -65,7 +71,7 @@ def scan(
     try:
         cfg = load_config(config)
         probes = select_probes(cfg, probe)
-        api_key = cfg.api_key()
+        api_key = cfg.api_key(env_file)
     except ConfigError as e:
         typer.echo(f"vesk scan: {e}", err=True)
         raise typer.Exit(2) from e

{vesk_cli-0.1.2 → vesk_cli-0.1.4}/src/vesk/config.py

@@ -51,17 +51,63 @@ class Config(_Strict):
     scan: ScanConfig = Field(default_factory=lambda: ScanConfig())
     report: ReportConfig = Field(default_factory=lambda: ReportConfig())
 
-    def api_key(self) -> str | None:
-        """Read the API key from the environment variable named in the config."""
+    def api_key(self, env_file: Path | None = None) -> str | None:
+        """Read the API key from the environment variable named in the config.
+
+        If env_file is given, its values fill in variables missing from the process
+        environment; variables already set in the environment take precedence.
+        """
         name = self.target.api_key_env
         if not name:
             return None
+        if not name.isidentifier():
+            raise ConfigError(
+                f"target.api_key_env is {name!r}, which is not an environment variable name. "
+                "Set it to the NAME of a variable (for example VESK_API_KEY), not a file or "
+                "the key itself, then export that variable: export VESK_API_KEY=<your key>"
+            )
         key = os.environ.get(name)
+        if not key and env_file is not None:
+            key = read_env_file(env_file).get(name)
         if not key:
-            raise ConfigError(f"environment variable {name} (target.api_key_env) is not set")
+            raise ConfigError(
+                f"environment variable {name} is not set or is empty "
+                f"(named by target.api_key_env in your config). "
+                f"Export it in this shell first: export {name}=<your key>. "
+                "Or put it in a .env file and pass --env-file .env "
+                "(vesk only reads .env files when you pass --env-file). "
+                "If the endpoint needs no key, remove api_key_env from the config."
+            )
         return key
 
 
+def read_env_file(path: Path) -> dict[str, str]:
+    """Parse a dotenv-style file: KEY=VALUE lines, # comments, optional `export `, quotes."""
+    try:
+        text = path.read_text(encoding="utf-8")
+    except FileNotFoundError:
+        raise ConfigError(f"env file not found: {path}") from None
+    except (OSError, UnicodeDecodeError) as e:
+        raise ConfigError(f"cannot read env file {path}: {e}") from e
+    values: dict[str, str] = {}
+    for line in text.splitlines():
+        line = line.strip()
+        if not line or line.startswith("#"):
+            continue
+        if line.startswith("export "):
+            line = line[len("export ") :].lstrip()
+        name, sep, value = line.partition("=")
+        name, value = name.strip(), value.strip()
+        if not sep or not name.isidentifier():
+            continue
+        if len(value) >= 2 and value[0] == value[-1] and value[0] in "\"'":
+            value = value[1:-1]
+        elif " #" in value:
+            value = value.split(" #", 1)[0].rstrip()
+        values[name] = value
+    return values
+
+
 def load_config(path: Path) -> Config:
     try:
         raw = yaml.safe_load(path.read_text(encoding="utf-8"))

{vesk_cli-0.1.2 → vesk_cli-0.1.4}/tests/integration/test_scan_cli.py

@@ -145,3 +145,20 @@ def test_missing_api_key_env_exits_2(cfg, tmp_path, monkeypatch):
     r, _ = scan(cfg, tmp_path)
     assert r.exit_code == 2
     assert "VESK_TEST_KEY" in r.output
+
+
+@respx.mock
+def test_env_file_supplies_key_when_env_unset(cfg, tmp_path, monkeypatch):
+    monkeypatch.delenv("VESK_TEST_KEY")
+    envf = tmp_path / ".env"
+    envf.write_text("VESK_TEST_KEY=file-key\n")
+    respx.post(URL).mock(side_effect=hardened)
+    r, _ = scan(cfg, tmp_path, "--env-file", str(envf))
+    assert r.exit_code == 0, r.output
+
+
+def test_env_file_missing_exits_2(cfg, tmp_path, monkeypatch):
+    monkeypatch.delenv("VESK_TEST_KEY")
+    r, _ = scan(cfg, tmp_path, "--env-file", str(tmp_path / "nope.env"))
+    assert r.exit_code == 2
+    assert "env file not found" in r.output

{vesk_cli-0.1.2 → vesk_cli-0.1.4}/tests/unit/test_scan.py

@@ -49,6 +49,12 @@ def test_api_key_comes_from_env(tmp_path, monkeypatch):
     assert cfg.api_key() == "abc"
 
 
+def test_api_key_env_must_be_a_variable_name(tmp_path):
+    cfg = load_config(write(tmp_path, MINIMAL + "  api_key_env: .env\n"))
+    with pytest.raises(ConfigError, match="not an environment variable name"):
+        cfg.api_key()
+
+
 def test_select_probes_unknown(tmp_path):
     cfg = load_config(write(tmp_path, MINIMAL))
     with pytest.raises(ConfigError, match="unknown probe"):
@@ -215,3 +221,22 @@ async def test_client_retries_timeouts():
 
     with pytest.raises(EndpointError, match="ConnectTimeout|slow"):
         await _client(handler, retries=1).complete([])
+
+
+def test_api_key_from_env_file(tmp_path, monkeypatch):
+    cfg = load_config(write(tmp_path, MINIMAL + "  api_key_env: MY_KEY\n"))
+    monkeypatch.delenv("MY_KEY", raising=False)
+    env = tmp_path / ".env"
+    env.write_text("# c\nOTHER=1\nexport MY_KEY='from-file'\n")
+    assert cfg.api_key(env) == "from-file"
+    with pytest.raises(ConfigError, match="--env-file"):
+        cfg.api_key()  # file is never read unless passed
+    monkeypatch.setenv("MY_KEY", "from-env")
+    assert cfg.api_key(env) == "from-env"  # environment wins
+
+
+def test_env_file_missing(tmp_path, monkeypatch):
+    cfg = load_config(write(tmp_path, MINIMAL + "  api_key_env: MY_KEY\n"))
+    monkeypatch.delenv("MY_KEY", raising=False)
+    with pytest.raises(ConfigError, match="env file not found"):
+        cfg.api_key(tmp_path / "nope.env")