yoru-cli 0.2.0__tar.gz → 0.3.0__tar.gz

{yoru_cli-0.2.0 → yoru_cli-0.3.0}/.gitignore

@@ -80,3 +80,6 @@ backend/data/.auth_jwt_secret
 
 # install-smoke pre-release wheel (transient)
 install-smoke/_wheel/
+
+# Local MCP wiring (per-agent trovex tokens etc.) — never track; edits must not dirty the merge target
+.mcp.json

{yoru_cli-0.2.0 → yoru_cli-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: yoru-cli
-Version: 0.2.0
+Version: 0.3.0
 Summary: Yoru — audit-grade session receipts for autonomous AI coding agents.
 Project-URL: Homepage, https://yoru.sh
 Project-URL: Documentation, https://yoru.sh/docs
@@ -19,9 +19,11 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: >=3.10
+Requires-Dist: cryptography>=42
 Requires-Dist: httpx>=0.27
 Provides-Extra: dev
 Requires-Dist: pytest>=7; extra == 'dev'
+Requires-Dist: yoru-contract; extra == 'dev'
 Description-Content-Type: text/markdown
 
 # yoru-cli
@@ -70,6 +72,15 @@ The installed script is ~20 lines of Bash that `POST`s one JSON event per Claude
 
 It uses `curl --max-time 2 || true` so a Yoru outage never stalls your terminal — Claude Code doesn't notice the hook is even there.
 
+## Multiple devs, multiple identities
+
+Each paired identity (server + token) gets its own local slot under `~/.config/yoru/identities/`. The shared tailer and every hook event attribute to whichever identity is **active** — there is no per-process attribution.
+
+- **One dev per machine (the normal case):** no ambiguity — one OS user, one identity, all activity is unambiguously yours.
+- **Same OS login, multiple identities paired** (e.g. you re-paired against a second org, or a shared machine): only one identity is active at a time. Concurrent work under that same login attributes to whichever identity is active *regardless of who actually ran it* — this is an explicit, documented limit, not a bug. Switch identities first with `yoru use <label>`.
+
+Run `yoru doctor` any time to see the active identity and get warned if other paired identities exist unused on this machine.
+
 ## Self-host the server
 
 The CLI is MIT. The server (backend + dashboard) is AGPL-3.0 and lives at **[github.com/TsukumoHQ/yoru](https://github.com/TsukumoHQ/yoru)**. `docker-compose up`, then `yoru init --server https://your-host` — done. There is no hosted Yoru; you run it.

{yoru_cli-0.2.0 → yoru_cli-0.3.0}/README.md

@@ -44,6 +44,15 @@ The installed script is ~20 lines of Bash that `POST`s one JSON event per Claude
 
 It uses `curl --max-time 2 || true` so a Yoru outage never stalls your terminal — Claude Code doesn't notice the hook is even there.
 
+## Multiple devs, multiple identities
+
+Each paired identity (server + token) gets its own local slot under `~/.config/yoru/identities/`. The shared tailer and every hook event attribute to whichever identity is **active** — there is no per-process attribution.
+
+- **One dev per machine (the normal case):** no ambiguity — one OS user, one identity, all activity is unambiguously yours.
+- **Same OS login, multiple identities paired** (e.g. you re-paired against a second org, or a shared machine): only one identity is active at a time. Concurrent work under that same login attributes to whichever identity is active *regardless of who actually ran it* — this is an explicit, documented limit, not a bug. Switch identities first with `yoru use <label>`.
+
+Run `yoru doctor` any time to see the active identity and get warned if other paired identities exist unused on this machine.
+
 ## Self-host the server
 
 The CLI is MIT. The server (backend + dashboard) is AGPL-3.0 and lives at **[github.com/TsukumoHQ/yoru](https://github.com/TsukumoHQ/yoru)**. `docker-compose up`, then `yoru init --server https://your-host` — done. There is no hosted Yoru; you run it.

{yoru_cli-0.2.0 → yoru_cli-0.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "yoru-cli"
-version = "0.2.0"
+version = "0.3.0"
 description = "Yoru — audit-grade session receipts for autonomous AI coding agents."
 license = { text = "MIT" }
 license-files = ["LICENSE"]
@@ -18,7 +18,7 @@ classifiers = [
     "Topic :: Software Development :: Libraries :: Python Modules",
 ]
 requires-python = ">=3.10"
-dependencies = ["httpx>=0.27"]
+dependencies = ["httpx>=0.27", "cryptography>=42"]
 
 [project.urls]
 Homepage = "https://yoru.sh"
@@ -30,7 +30,17 @@ Issues = "https://github.com/TsukumoHQ/cli-yoru/issues"
 yoru = "yoru_cli.cli:main"
 
 [project.optional-dependencies]
-dev = ["pytest>=7"]
+# yoru-contract is dev-only for now: nothing in yoru-cli imports it yet (the
+# CLI-side consumption ticket is a separate follow-up), and it isn't
+# published to PyPI or vendored into the wheel — a hard runtime dependency
+# here would break `pip install yoru-cli` with "No matching distribution
+# found for yoru-contract". Once the CLI actually consumes it, the release
+# mirror step needs to vendor its source into the wheel (or publish it
+# separately) before this can become a real dependency.
+dev = ["pytest>=7", "yoru-contract"]
+
+[tool.uv.sources]
+yoru-contract = { path = "../packages/yoru-contract" }
 
 [build-system]
 requires = ["hatchling"]

{yoru_cli-0.2.0 → yoru_cli-0.3.0}/src/yoru_cli/api.py

@@ -10,11 +10,18 @@ class ReceiptClient:
         self.base_url = base_url.rstrip("/")
         self.token = token
 
-    def start_device_code(self, label: str | None = None) -> dict[str, Any]:
+    def start_device_code(
+        self, label: str | None = None, hostname: str | None = None
+    ) -> dict[str, Any]:
         """Begin the device-pairing handshake — no auth needed."""
+        body: dict[str, Any] = {}
+        if label:
+            body["label"] = label
+        if hostname:
+            body["hostname"] = hostname
         r = httpx.post(
             f"{self.base_url}/api/v1/auth/device-code",
-            json={"label": label} if label else {},
+            json=body,
             timeout=5.0,
         )
         r.raise_for_status()
@@ -69,6 +76,29 @@ class ReceiptClient:
         r.raise_for_status()
         return r.json()
 
+    def logout(self) -> bool:
+        """Revoke this client's own token server-side (POST /auth/logout).
+
+        Self-revoke via bearer — no need to know the token's server-side row
+        id, which the CLI never learns (the poll response only ever returns
+        the raw token). Returns True if the token was revoked, False if it
+        was already invalid/revoked (a 401 here just means "nothing to
+        revoke", not a failure worth surfacing). Any other error status or
+        network failure raises, so the caller can warn loudly instead of
+        silently treating a failed revoke as done.
+        """
+        if not self.token:
+            raise RuntimeError("logout requires authentication")
+        r = httpx.post(
+            f"{self.base_url}/api/v1/auth/logout",
+            headers={"Authorization": f"Bearer {self.token}"},
+            timeout=5.0,
+        )
+        if r.status_code == 401:
+            return False
+        r.raise_for_status()
+        return True
+
     def get_share_consent(self) -> dict[str, Any]:
         """Returns {consented: bool, at: str|None} for the authenticated user."""
         if not self.token:

yoru_cli-0.3.0/src/yoru_cli/cli.py

@@ -0,0 +1,260 @@
+from __future__ import annotations
+
+import argparse
+
+from . import __version__
+from . import (
+    config,
+    doctor_cmd,
+    enforce_cmd,
+    git_hook_run,
+    init_cmd,
+    logout_cmd,
+    rotate_cmd,
+    share_cmd,
+    tail_cmd,
+    update_cmd,
+    use_cmd,
+    verify_export_cmd,
+)
+
+
+def _build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="yoru",
+        description="Yoru — audit-grade session receipts for autonomous AI coding agents.",
+    )
+    parser.add_argument(
+        "--version",
+        action="version",
+        version=f"yoru {__version__}",
+    )
+
+    subparsers = parser.add_subparsers(
+        dest="cmd",
+        required=True,
+        metavar="{init,use,logout,rotate,tail,doctor,share,update,verify-export,enforce}",
+    )
+
+    p_init = subparsers.add_parser(
+        "init",
+        help="Install the Claude Code hook and pair a local identity under ~/.config/yoru/.",
+    )
+    p_init.add_argument(
+        "--server",
+        required=True,
+        help="Backend URL of your Yoru server, e.g. https://yoru.acme.com. "
+             "Yoru is self-hosted — there is no default server.",
+    )
+    p_init.add_argument(
+        "--token",
+        default=None,
+        help="Pre-minted hook token (rcpt_...) — for headless/CI/server setups. "
+             "Also read from $YORU_TOKEN. Without this, yoru init launches "
+             "interactive device pairing.",
+    )
+    p_init.add_argument(
+        "--label",
+        default=None,
+        help="Human-readable machine label shown in the dashboard "
+             "(default: <hostname> · <os>).",
+    )
+    p_init.add_argument(
+        "--no-browser",
+        action="store_true",
+        help="Don't try to auto-open the pairing URL in a browser.",
+    )
+    p_init.add_argument("--force", action="store_true", help="Overwrite an existing install.")
+    p_init.add_argument(
+        "--backfill-git",
+        action="store_true",
+        help="OPT-IN: also walk this repo's full pre-existing git history "
+             "and spool it (in addition to the normal from-here-on capture). "
+             "Off by default — see docs/SELF-HOST.md.",
+    )
+
+    p_use = subparsers.add_parser(
+        "use",
+        help="Switch the active paired identity (no arg: list paired identities).",
+    )
+    p_use.add_argument(
+        "label",
+        nargs="?",
+        default=None,
+        help="identity_label (or identity_id) to switch to. Omit to list.",
+    )
+
+    subparsers.add_parser(
+        "logout",
+        help="Revoke the current token server-side and forget it locally.",
+    )
+
+    p_rotate = subparsers.add_parser(
+        "rotate",
+        help="Replace the current token with a new one, revoking the old "
+        "one server-side (same server as the existing pairing).",
+    )
+    p_rotate.add_argument(
+        "--token",
+        default=None,
+        help="Pre-minted replacement token — for headless/CI/server setups. "
+             "Also read from $YORU_TOKEN. Without this, yoru rotate launches "
+             "interactive device pairing.",
+    )
+    p_rotate.add_argument(
+        "--label",
+        default=None,
+        help="Human-readable machine label for the new pairing "
+             "(default: <hostname> · <os>).",
+    )
+    p_rotate.add_argument(
+        "--no-browser",
+        action="store_true",
+        help="Don't try to auto-open the pairing URL in a browser.",
+    )
+
+    p_tail = subparsers.add_parser(
+        "tail",
+        help="Read JSON events from stdin and POST them as a batch (dev/debug).",
+    )
+    p_tail.add_argument(
+        "--server",
+        default=None,
+        help="Backend URL (default: the server saved in config by `yoru init`).",
+    )
+    p_tail.add_argument("--session-id", default=None, help="Session id to stamp on events missing one.")
+
+    subparsers.add_parser(
+        "doctor",
+        help="Diagnose the install: config, backend, token, hook.",
+    )
+
+    p_share = subparsers.add_parser(
+        "share",
+        help="Flip a session public and copy its yoru.sh/s/<id> URL to the clipboard.",
+    )
+    p_share.add_argument(
+        "session_id",
+        help="Session id to share (or revoke). Find it in the dashboard URL or the session header.",
+    )
+    p_share.add_argument(
+        "--revoke",
+        action="store_true",
+        help="Flip the session back to private instead of sharing it.",
+    )
+
+    p_update = subparsers.add_parser(
+        "update",
+        help="Self-update the CLI to the latest release (pip), and refresh the hook.",
+    )
+    p_update.add_argument(
+        "--force",
+        action="store_true",
+        help="Bypass the dev-build and no-downgrade guards (explicit reinstall/downgrade).",
+    )
+    p_update.add_argument(
+        "--check",
+        action="store_true",
+        help="Report whether an update is available and exit — install nothing.",
+    )
+    p_update.add_argument(
+        "--server",
+        nargs="?",
+        const="",
+        default=None,
+        metavar="URL",
+        help="Check the running SERVER's version (notify-only) instead of self-updating "
+        "the CLI. Bare --server uses your configured server; --server URL targets that "
+        "instance. Never pulls or restarts the server.",
+    )
+
+    p_verify = subparsers.add_parser(
+        "verify-export",
+        help="Offline-verify a signed audit-export bundle (Ed25519/DSSE + chain).",
+    )
+    p_verify.add_argument(
+        "bundle",
+        help="Path to the signed bundle JSON (or '-' to read from stdin).",
+    )
+    p_verify.add_argument(
+        "--pubkey-fingerprint",
+        default=None,
+        metavar="SHA256_HEX",
+        help="Pin the deployer's public-key fingerprint (published out-of-band). "
+        "Without it the check is tamper-evident only — the embedded key is "
+        "trusted on faith.",
+    )
+
+    p_enforce = subparsers.add_parser(
+        "enforce",
+        help="Manage the OPT-IN enforcement gate that halts dangerous ops "
+        "(default OFF; the passive audit trail is unaffected).",
+    )
+    _eg = p_enforce.add_mutually_exclusive_group()
+    _eg.add_argument("--enable", action="store_true",
+                     help="Install + enable the PreToolUse enforcement gate.")
+    _eg.add_argument("--disable", action="store_true",
+                     help="Disable the gate (no-arg `enforce` shows status).")
+
+    # Internal: the enforcement hook invokes this with the PreToolUse event on
+    # stdin; it emits a deny decision only on a match, else nothing.
+    subparsers.add_parser(
+        "enforce-check",
+        help="(internal) decision endpoint the enforcement hook calls.",
+    )
+
+    # Internal: the installed post-commit/pre-push git hooks (git_hooks.py)
+    # shell out to this — a real console-script entrypoint, not
+    # `python3 -m yoru_cli...`, so it resolves to the correct interpreter
+    # under pipx/uv-tool-install regardless of what `python3` means on PATH
+    # (B3 slice1 round-2 review finding).
+    p_ghr = subparsers.add_parser(
+        "git-hook-run",
+        help="(internal) invoked by the installed git hooks — captures commit/push events.",
+    )
+    p_ghr.add_argument("hook_kind", choices=["post-commit", "pre-push"])
+    p_ghr.add_argument("hook_args", nargs="*")
+
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = _build_parser()
+    args = parser.parse_args(argv)
+
+    if args.cmd == "tail" and args.server is None:
+        cfg = config.load() or {}
+        args.server = cfg.get("server")
+        if not args.server:
+            parser.error(
+                "no server configured — run `yoru init --server <url>` first, "
+                "or pass --server explicitly."
+            )
+
+    if args.cmd == "init":
+        return init_cmd.run(args)
+    if args.cmd == "use":
+        return use_cmd.run(args)
+    if args.cmd == "logout":
+        return logout_cmd.run(args)
+    if args.cmd == "rotate":
+        return rotate_cmd.run(args)
+    if args.cmd == "tail":
+        return tail_cmd.run(args)
+    if args.cmd == "doctor":
+        return doctor_cmd.run(args)
+    if args.cmd == "share":
+        return share_cmd.run(args)
+    if args.cmd == "update":
+        return update_cmd.run(args)
+    if args.cmd == "verify-export":
+        return verify_export_cmd.run(args)
+    if args.cmd == "enforce":
+        return enforce_cmd.run(args)
+    if args.cmd == "enforce-check":
+        return enforce_cmd.check()
+    if args.cmd == "git-hook-run":
+        return git_hook_run.main([args.hook_kind, *args.hook_args])
+
+    parser.error(f"unknown command: {args.cmd!r}")
+    return 2