webbee 0.1.2__tar.gz → 0.1.3__tar.gz

webbee-0.1.3/.github/workflows/publish.yml

@@ -0,0 +1,47 @@
+name: publish
+
+# Publish to PyPI on a version tag (e.g. `v0.1.0`), matching the Imperal
+# convention (imperal-mcp). Auth uses the account API token stored as the
+# GitHub Actions secret `PYPI_API_TOKEN` — add it to this repo, or set an
+# `imperalcloud` org-level secret so every package inherits it. The token is
+# NEVER stored in the repo/files; only in the encrypted Actions secret.
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write   # create the GitHub Release for the tag
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Build sdist + wheel
+        run: |
+          python -m pip install --upgrade build
+          python -m build
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          password: ${{ secrets.PYPI_API_TOKEN }}
+      # Mirror the PyPI release as a GitHub Release (so the repo's Releases
+      # sidebar tracks the latest version) with notes from CHANGELOG.md.
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          python - "$VERSION" > notes.md <<'PY'
+          import sys, re, pathlib
+          v = sys.argv[1]
+          text = pathlib.Path("CHANGELOG.md").read_text()
+          m = re.search(rf"^## {re.escape(v)}\b.*?(?=^## |\Z)", text, re.S | re.M)
+          sys.stdout.write(m.group(0).strip() if m else
+                           f"Published to PyPI: https://pypi.org/project/webbee/{v}/")
+          PY
+          gh release create "$GITHUB_REF_NAME" \
+            --title "webbee ${GITHUB_REF_NAME}" --latest --notes-file notes.md

{webbee-0.1.2 → webbee-0.1.3}/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.1.3
+
+- **Sessions & security.** `/sessions` lists everywhere your Imperal account is
+  signed in — terminal (webbee), API, and web — with the current terminal
+  marked. `/sessions revoke <#>` signs out one; `/logout-others` signs out
+  every session except this one. Manage the same sessions from the panel
+  (Settings → Security). Backed by a single gateway-owned session store.
+
 ## 0.1.2
 
 - **Device-code login (RFC 8628).** `/login` and `webbee login` now use the

{webbee-0.1.2 → webbee-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: webbee
-Version: 0.1.2
+Version: 0.1.3
 Summary: Webbee 🐝 — the Imperal Cloud coding agent in your terminal
 Project-URL: Homepage, https://imperal.io
 Project-URL: Documentation, https://docs.imperal.io
@@ -32,10 +32,10 @@ Description-Content-Type: text/markdown
 
 # Webbee 🐝 — the coding agent in your terminal
 
-[![PyPI](https://img.shields.io/pypi/v/webbee.svg)](https://pypi.org/project/webbee/)
-[![Python](https://img.shields.io/pypi/pyversions/webbee.svg)](https://pypi.org/project/webbee/)
-[![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
-[![Docs](https://img.shields.io/badge/docs-imperal.io-00afd7.svg)](https://docs.imperal.io)
+[![PyPI](https://img.shields.io/pypi/v/webbee)](https://pypi.org/project/webbee/)
+[![Python](https://img.shields.io/pypi/pyversions/webbee)](https://pypi.org/project/webbee/)
+[![License: MIT](https://img.shields.io/badge/license-MIT-green)](LICENSE)
+[![Docs](https://img.shields.io/badge/docs-imperal.io-00afd7)](https://docs.imperal.io)
 
 Webbee is the [Imperal Cloud](https://imperal.io) coding agent, in your terminal. It reads, writes, and runs code in your working directory — while the brain runs in the cloud on **ICNLI**, the open protocol behind Webbee. No model keys on your machine. Swap the model underneath and it behaves the same, because the safety was never in the model.
 
@@ -61,7 +61,7 @@ python3 -m venv .venv && . .venv/bin/activate && pip install webbee
 
 ```sh
 webbee            # start the agent in the current directory
-webbee login      # sign in to your Imperal account (opens the browser)
+webbee login      # sign in — shows a code + URL to open in any browser
 ```
 
 Type in plain English. Webbee reads your files, runs commands, and reaches your connected Imperal apps — mail, notes, tasks, and more — to get the job done. `/help` lists the commands: `/login` `/logout` `/mode` `/cost` `/status` `/clear` `/exit`.

{webbee-0.1.2 → webbee-0.1.3}/README.md

@@ -1,9 +1,9 @@
 # Webbee 🐝 — the coding agent in your terminal
 
-[![PyPI](https://img.shields.io/pypi/v/webbee.svg)](https://pypi.org/project/webbee/)
-[![Python](https://img.shields.io/pypi/pyversions/webbee.svg)](https://pypi.org/project/webbee/)
-[![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
-[![Docs](https://img.shields.io/badge/docs-imperal.io-00afd7.svg)](https://docs.imperal.io)
+[![PyPI](https://img.shields.io/pypi/v/webbee)](https://pypi.org/project/webbee/)
+[![Python](https://img.shields.io/pypi/pyversions/webbee)](https://pypi.org/project/webbee/)
+[![License: MIT](https://img.shields.io/badge/license-MIT-green)](LICENSE)
+[![Docs](https://img.shields.io/badge/docs-imperal.io-00afd7)](https://docs.imperal.io)
 
 Webbee is the [Imperal Cloud](https://imperal.io) coding agent, in your terminal. It reads, writes, and runs code in your working directory — while the brain runs in the cloud on **ICNLI**, the open protocol behind Webbee. No model keys on your machine. Swap the model underneath and it behaves the same, because the safety was never in the model.
 
@@ -29,7 +29,7 @@ python3 -m venv .venv && . .venv/bin/activate && pip install webbee
 
 ```sh
 webbee            # start the agent in the current directory
-webbee login      # sign in to your Imperal account (opens the browser)
+webbee login      # sign in — shows a code + URL to open in any browser
 ```
 
 Type in plain English. Webbee reads your files, runs commands, and reaches your connected Imperal apps — mail, notes, tasks, and more — to get the job done. `/help` lists the commands: `/login` `/logout` `/mode` `/cost` `/status` `/clear` `/exit`.

{webbee-0.1.2 → webbee-0.1.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "webbee"
-version = "0.1.2"
+version = "0.1.3"
 description = "Webbee 🐝 — the Imperal Cloud coding agent in your terminal"
 readme = "README.md"
 license = "MIT"

webbee-0.1.3/src/webbee/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.3"

{webbee-0.1.2 → webbee-0.1.3}/src/webbee/commands.py

@@ -10,6 +10,9 @@ _HELP = """Commands:
   /mode [default|plan|autopilot]   consent mode (no arg — show current)
   /cost  (=/usage)   tokens + $ cost this session
   /status            cwd · git · surface · tokens · version
+  /sessions          list active sessions (this + other devices)
+  /sessions revoke <#>   revoke a session by its number
+  /logout-others     sign out every session except this one
   /exit  (=/quit)    quit"""
 
 
@@ -32,6 +35,7 @@ class SlashResult:
     message: str = ""
     action: str = ""
     new_mode: "str | None" = None
+    arg: str = ""
 
 
 def dispatch(line: str, ctx: CommandContext) -> SlashResult:
@@ -64,6 +68,13 @@ def dispatch(line: str, ctx: CommandContext) -> SlashResult:
                f"cwd: {ctx.workspace}   git: {ctx.git_branch}\n"
                f"tokens: {ctx.session_tokens} (~${ctx.session_cost:.4f})   webbee v{ctx.version}")
         return SlashResult(handled=True, action="status", message=msg)
+    if cmd == "/sessions":
+        if args and args[0].lower() == "revoke":
+            return SlashResult(handled=True, action="sessions_revoke",
+                               arg=(args[1] if len(args) > 1 else ""))
+        return SlashResult(handled=True, action="sessions")
+    if cmd == "/logout-others":
+        return SlashResult(handled=True, action="logout_others")
     if cmd == "/mode":
         if not args:
             return SlashResult(handled=True, action="mode", new_mode=None,

{webbee-0.1.2 → webbee-0.1.3}/src/webbee/render.py

@@ -264,6 +264,31 @@ class RichSink:
         self.console.print(Panel(body, title="🐝 Connect this terminal", border_style=_BEE))
         self._nudge()
 
+    def sessions_table(self, sessions) -> None:
+        """Active sessions as a compact table (English-only): #, session, IP,
+        last-seen, and a bee-yellow 'this device' marker for the current one."""
+        from rich.table import Table
+        self.console.print(Text("  Active sessions", style=f"bold {_BEE}"))
+        if not sessions:
+            self.console.print(Text("  (none)", style="dim"))
+            self._nudge()
+            return
+        t = Table(show_header=True, header_style="dim", box=None, padding=(0, 3, 0, 0))
+        t.add_column("#", style="dim", justify="right")
+        t.add_column("session")
+        t.add_column("ip", style="dim")
+        t.add_column("last seen", style="dim")
+        t.add_column("")
+        for i, s in enumerate(sessions, 1):
+            label = str(s.get("label") or s.get("surface") or "?")
+            ip = str(s.get("ip_address") or "-")
+            seen = str(s.get("last_seen_at") or "")[:16].replace("T", " ")
+            here = Text("this device", style=f"bold {_BEE}") if s.get("current") else Text("")
+            t.add_row(str(i), label, ip, seen, here)
+        self.console.print(t)
+        self.console.print(Text("  /sessions revoke <#>  ·  /logout-others", style="dim"))
+        self._nudge()
+
     def progress(self, text: str) -> None:
         if text:
             self.console.print(Text("  " + text, style="dim italic"))

{webbee-0.1.2 → webbee-0.1.3}/src/webbee/repl.py

@@ -19,7 +19,8 @@ def _git_branch(workspace: str) -> str:
 
 
 async def run_repl(cfg, mode: str = "default", *, sink=None, read_line=input,
-                   agent_factory=None, auth=None, account_fetcher=None) -> None:
+                   agent_factory=None, auth=None, account_fetcher=None,
+                   sessions_client=None) -> None:
     """Interactive coding REPL. Production (a real tty, no injected sink) runs
     the persistent prompt_toolkit dock (`tui.run_session`): the bordered input
     box is pinned at the bottom, turn output scrolls above it (patch_stdout →
@@ -32,6 +33,8 @@ async def run_repl(cfg, mode: str = "default", *, sink=None, read_line=input,
         agent_factory = lambda c, tp, ws, m: AgentSession(c, tp, ws, m)  # noqa: E731
     if account_fetcher is None:
         from webbee.account import fetch_account as account_fetcher
+    if sessions_client is None:
+        from webbee import sessions as sessions_client
 
     workspace = os.getcwd()
 
@@ -85,6 +88,31 @@ async def run_repl(cfg, mode: str = "default", *, sink=None, read_line=input,
                 state["logged_in"] = False
                 _sink.note("Signed out, local credentials removed.")
                 return "continue"
+            if res.action == "sessions":
+                rows = await sessions_client.list_sessions(cfg, token_provider)
+                state["sessions"] = rows
+                _sink.sessions_table(rows)
+                return "continue"
+            if res.action == "sessions_revoke":
+                rows = state.get("sessions") or []
+                try:
+                    idx = int(res.arg) - 1
+                except ValueError:
+                    idx = -1
+                if idx < 0 or idx >= len(rows):
+                    _sink.note("Usage: /sessions revoke <#> — run /sessions first to see the list.")
+                    return "continue"
+                s = rows[idx]
+                if s.get("current"):
+                    _sink.note("That's this terminal — use /logout to sign out here.")
+                    return "continue"
+                ok = await sessions_client.revoke_session(cfg, token_provider, s["session_id"])
+                _sink.note(f"Revoked {s.get('label') or s.get('surface')}." if ok else "Failed to revoke session.")
+                return "continue"
+            if res.action == "logout_others":
+                n = await sessions_client.revoke_others(cfg, token_provider)
+                _sink.note(f"Signed out {n} other session(s)." if n >= 0 else "Failed to sign out other sessions.")
+                return "continue"
             if res.action == "clear":
                 _sink.clear()
                 _sink.note(res.message)

webbee-0.1.3/src/webbee/sessions.py

@@ -0,0 +1,48 @@
+"""Sessions client — list/revoke the user's Imperal Cloud sessions from the
+terminal. Talks to the auth gateway with the user's access token (Bearer), so
+the gateway marks THIS terminal as the current session via its `sid` claim.
+Best-effort: network errors never raise — they return empty/False so the REPL
+can note the failure instead of crashing."""
+from __future__ import annotations
+
+
+async def _get(cfg, token_provider, path: str) -> dict:
+    import httpx
+    token = await token_provider()
+    async with httpx.AsyncClient(base_url=cfg.api_url, timeout=10) as c:
+        r = await c.get(path, headers={"Authorization": f"Bearer {token}"})
+        r.raise_for_status()
+        return r.json()
+
+
+async def _post(cfg, token_provider, path: str) -> dict:
+    import httpx
+    token = await token_provider()
+    async with httpx.AsyncClient(base_url=cfg.api_url, timeout=10) as c:
+        r = await c.post(path, headers={"Authorization": f"Bearer {token}"})
+        r.raise_for_status()
+        return r.json() if r.content else {}
+
+
+async def list_sessions(cfg, token_provider) -> list[dict]:
+    try:
+        return (await _get(cfg, token_provider, "/v1/auth/sessions")).get("sessions", [])
+    except Exception:
+        return []
+
+
+async def revoke_session(cfg, token_provider, session_id: str) -> bool:
+    try:
+        await _post(cfg, token_provider, f"/v1/auth/sessions/{session_id}/revoke")
+        return True
+    except Exception:
+        return False
+
+
+async def revoke_others(cfg, token_provider) -> int:
+    """Revoke every session except this terminal's. Returns the count, or -1 on
+    error (the gateway keeps the current session, identified by the JWT sid)."""
+    try:
+        return int((await _post(cfg, token_provider, "/v1/auth/sessions/revoke-others")).get("revoked", 0))
+    except Exception:
+        return -1

{webbee-0.1.2 → webbee-0.1.3}/tests/test_commands.py

@@ -26,13 +26,13 @@ def test_exit_and_quit():
 def test_help_lists_commands():
     r = dispatch("/help", _ctx())
     assert r.handled and r.action == "help"
-    for c in ("/login", "/logout", "/clear", "/mode", "/cost", "/status", "/exit"):
+    for c in ("/login", "/logout", "/clear", "/mode", "/cost", "/status", "/sessions", "/logout-others", "/exit"):
         assert c in r.message
 
 
 def test_help_is_english():
     r = dispatch("/help", _ctx())
-    for c in ("/login", "/logout", "/clear", "/mode", "/cost", "/status", "/exit"):
+    for c in ("/login", "/logout", "/clear", "/mode", "/cost", "/status", "/sessions", "/logout-others", "/exit"):
         assert c in r.message
     assert not NO_CYRILLIC.search(r.message)
 
@@ -98,6 +98,14 @@ def test_clear_login_logout_actions():
     assert dispatch("/logout", _ctx()).action == "logout"
 
 
+def test_sessions_commands():
+    assert dispatch("/sessions", _ctx()).action == "sessions"
+    r = dispatch("/sessions revoke 2", _ctx())
+    assert r.action == "sessions_revoke" and r.arg == "2"
+    assert dispatch("/sessions revoke", _ctx()).action == "sessions_revoke"  # no index -> arg ""
+    assert dispatch("/logout-others", _ctx()).action == "logout_others"
+
+
 def test_unknown_slash_is_handled_with_hint():
     r = dispatch("/frobnicate", _ctx())
     assert r.handled and "/help" in r.message

{webbee-0.1.2 → webbee-0.1.3}/tests/test_render.py

@@ -36,6 +36,26 @@ def test_login_prompt_shows_code_and_url():
     assert not NO_CYRILLIC.search(out)   # English UI only
 
 
+def test_sessions_table_renders():
+    s = _sink()
+    s.sessions_table([
+        {"session_id": "s1", "surface": "cli", "label": "Terminal (webbee)",
+         "ip_address": "1.2.3.4", "last_seen_at": "2026-07-04T00:00:00", "current": True},
+        {"session_id": "s2", "surface": "web", "label": "Web (Chrome)",
+         "ip_address": None, "last_seen_at": "2026-07-03T10:00:00", "current": False},
+    ])
+    out = s.console.export_text()
+    assert "Terminal (webbee)" in out and "Web (Chrome)" in out
+    assert "this device" in out and "1.2.3.4" in out
+    assert not NO_CYRILLIC.search(out)
+
+
+def test_sessions_table_empty():
+    s = _sink()
+    s.sessions_table([])
+    assert "none" in s.console.export_text().lower()
+
+
 def test_ask_consent_relays_raw_input():
     console = Console(record=True, width=80)
     s = RichSink(console=console, live_enabled=False, input_fn=lambda p: "  ага давай  ", clock=lambda: 0.0)

{webbee-0.1.2 → webbee-0.1.3}/tests/test_repl.py

@@ -19,6 +19,7 @@ class FakeSink:
     def abort(self): self.aborted = True
     def welcome(self, *a, **kw): ...
     def user_echo(self, text): self.echoed = getattr(self, "echoed", []) + [text]
+    def sessions_table(self, rows): self.session_tables = getattr(self, "session_tables", []) + [rows]
     # TurnSink no-ops
     def tool_start(self, *a): ...
     def tool_result(self, *a): ...
@@ -50,6 +51,19 @@ class FakeAuth:
     async def logout(self, cfg): self._in = False; self.logged_out = True
 
 
+class FakeSessions:
+    def __init__(self, rows=None):
+        self.rows = rows if rows is not None else [
+            {"session_id": "s1", "surface": "cli", "label": "Terminal (webbee)", "current": True},
+            {"session_id": "s2", "surface": "web", "label": "Web (Chrome)", "current": False},
+        ]
+        self.revoked = []
+        self.others_called = False
+    async def list_sessions(self, cfg, tp): return self.rows
+    async def revoke_session(self, cfg, tp, sid): self.revoked.append(sid); return True
+    async def revoke_others(self, cfg, tp): self.others_called = True; return 2
+
+
 def _lines(*items):
     it = iter(items)
     def read(prompt=""):
@@ -71,7 +85,8 @@ def _run(**kw):
     agent = kw.pop("agent", FakeAgent())
     asyncio.run(run_repl(cfg, "default", sink=sink, agent_factory=lambda c, tp, ws, m: agent,
                          read_line=kw.pop("read_line"), auth=kw.pop("auth", FakeAuth()),
-                         account_fetcher=kw.pop("account_fetcher", _fake_account_fetcher)))
+                         account_fetcher=kw.pop("account_fetcher", _fake_account_fetcher),
+                         sessions_client=kw.pop("sessions_client", FakeSessions())))
     return sink, agent
 
 
@@ -135,6 +150,35 @@ def test_login_uses_device_flow_and_renders_prompt():
     assert any("Signed in as u@imperal.io" in n for n in sink.notes)
 
 
+def test_sessions_list_renders():
+    fs = FakeSessions()
+    sink, agent = _run(read_line=_lines("/sessions", "/exit"), sessions_client=fs)
+    assert getattr(sink, "session_tables", None)          # sessions_table was rendered
+    assert sink.session_tables[0] == fs.rows
+
+
+def test_sessions_revoke_by_index():
+    fs = FakeSessions()
+    sink, agent = _run(read_line=_lines("/sessions", "/sessions revoke 2", "/exit"), sessions_client=fs)
+    assert fs.revoked == ["s2"]                           # #2 = web (not current)
+    assert any("Revoked" in n for n in sink.notes)
+    assert not any(NO_CYRILLIC.search(n) for n in sink.notes)
+
+
+def test_sessions_revoke_current_is_guarded():
+    fs = FakeSessions()
+    sink, agent = _run(read_line=_lines("/sessions", "/sessions revoke 1", "/exit"), sessions_client=fs)
+    assert fs.revoked == []                               # #1 = current terminal -> guarded
+    assert any("this terminal" in n for n in sink.notes)
+
+
+def test_logout_others_calls_client():
+    fs = FakeSessions()
+    sink, agent = _run(read_line=_lines("/logout-others", "/exit"), sessions_client=fs)
+    assert fs.others_called
+    assert any("other session" in n for n in sink.notes)
+
+
 def test_mode_command_switches_agent_mode():
     sink, agent = _run(read_line=_lines("/mode autopilot", "/exit"))
     assert agent.mode == "autopilot"

webbee-0.1.3/tests/test_sessions.py

@@ -0,0 +1,51 @@
+import asyncio
+
+import webbee.sessions as S
+
+
+def test_list_sessions_parses(monkeypatch):
+    async def fake_get(cfg, tp, path):
+        assert path == "/v1/auth/sessions"
+        return {"sessions": [{"session_id": "a", "surface": "cli", "current": True}]}
+    monkeypatch.setattr(S, "_get", fake_get)
+    out = asyncio.run(S.list_sessions(None, None))
+    assert out[0]["session_id"] == "a"
+
+
+def test_list_sessions_network_error_returns_empty(monkeypatch):
+    async def boom(*a):
+        raise RuntimeError("net")
+    monkeypatch.setattr(S, "_get", boom)
+    assert asyncio.run(S.list_sessions(None, None)) == []
+
+
+def test_revoke_session_posts_right_path(monkeypatch):
+    seen = {}
+    async def fake_post(cfg, tp, path):
+        seen["path"] = path
+        return {"status": "revoked"}
+    monkeypatch.setattr(S, "_post", fake_post)
+    assert asyncio.run(S.revoke_session(None, None, "sid1")) is True
+    assert seen["path"] == "/v1/auth/sessions/sid1/revoke"
+
+
+def test_revoke_session_error_returns_false(monkeypatch):
+    async def boom(*a):
+        raise RuntimeError()
+    monkeypatch.setattr(S, "_post", boom)
+    assert asyncio.run(S.revoke_session(None, None, "x")) is False
+
+
+def test_revoke_others_count(monkeypatch):
+    async def fake_post(cfg, tp, path):
+        assert path == "/v1/auth/sessions/revoke-others"
+        return {"revoked": 3}
+    monkeypatch.setattr(S, "_post", fake_post)
+    assert asyncio.run(S.revoke_others(None, None)) == 3
+
+
+def test_revoke_others_error_returns_minus_one(monkeypatch):
+    async def boom(*a):
+        raise RuntimeError()
+    monkeypatch.setattr(S, "_post", boom)
+    assert asyncio.run(S.revoke_others(None, None)) == -1

webbee-0.1.2/.github/workflows/publish.yml

@@ -1,28 +0,0 @@
-name: publish
-
-# Publish to PyPI on a version tag (e.g. `v0.1.0`), matching the Imperal
-# convention (imperal-mcp). Auth uses the account API token stored as the
-# GitHub Actions secret `PYPI_API_TOKEN` — add it to this repo, or set an
-# `imperalcloud` org-level secret so every package inherits it. The token is
-# NEVER stored in the repo/files; only in the encrypted Actions secret.
-
-on:
-  push:
-    tags: ["v*"]
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.12"
-      - name: Build sdist + wheel
-        run: |
-          python -m pip install --upgrade build
-          python -m build
-      - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.PYPI_API_TOKEN }}

webbee-0.1.2/src/webbee/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.1.2"