zeno-cli 0.3.4__tar.gz → 0.3.5__tar.gz

{zeno_cli-0.3.4 → zeno_cli-0.3.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: zeno-cli
-Version: 0.3.4
+Version: 0.3.5
 Summary: Zeno CLI - measure the supervision cost of AI-assisted work
 Project-URL: Homepage, https://zeno.center
 Project-URL: Repository, https://github.com/Marwan01/zeno

{zeno_cli-0.3.4 → zeno_cli-0.3.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "zeno-cli"
-version = "0.3.4"
+version = "0.3.5"
 description = "Zeno CLI - measure the supervision cost of AI-assisted work"
 readme = "README.md"
 requires-python = ">=3.12"

{zeno_cli-0.3.4 → zeno_cli-0.3.5}/src/zeno_cli/_hooks/cc_bridge.py

@@ -194,6 +194,31 @@ def _api_base_url() -> str:
     return (os.environ.get("ZENO_API_BASE_URL") or DEFAULT_API_BASE_URL).rstrip("/")
 
 
+def _api_token() -> str | None:
+    """Bearer token for the capture push, when one is available.
+
+    Checks the explicit env var first (matches the SDK client's ZENO_API_TOKEN
+    precedence), then the keyring slot `zeno login` writes (service "zeno-sdk",
+    key "clerk_jwt"). The keyring lookup is best-effort: keyring is an optional
+    dependency and may be absent under the system python the hook runs on.
+    Returns None on the tailnet Mini, where identity comes from a header the
+    `tailscale serve` proxy injects rather than a bearer token - so the push
+    stays header-authed there and bearer-authed against a public API.
+    """
+    tok = os.environ.get("ZENO_API_TOKEN")
+    if tok and tok.strip():
+        return tok.strip()
+    try:
+        import keyring  # noqa: PLC0415
+
+        stored = keyring.get_password("zeno-sdk", "clerk_jwt")
+        if stored and stored.strip():
+            return stored.strip()
+    except Exception:
+        return None
+    return None
+
+
 def _sync_timeout_s() -> float:
     try:
         return float(os.environ.get("ZENO_SYNC_TIMEOUT_S") or SYNC_TIMEOUT_S)
@@ -259,14 +284,21 @@ def _post_ingest(body: dict, timeout_s: float) -> bool:
     raises (all exceptions -> False). urllib + an explicit socket timeout only."""
     url = _api_base_url() + SYNC_PATH
     data = json.dumps(body).encode("utf-8")
+    headers = {
+        "Content-Type": "application/json",
+        "Idempotency-Key": _idempotency_key(body),
+    }
+    # Attach the Clerk bearer token when one is available so the push authenticates
+    # against a public API (Cloud Run). Absent it (tailnet Mini), the push relies on
+    # the identity header the `tailscale serve` proxy injects - unchanged behavior.
+    token = _api_token()
+    if token:
+        headers["Authorization"] = "Bearer " + token
     req = urllib.request.Request(
         url,
         data=data,
         method="POST",
-        headers={
-            "Content-Type": "application/json",
-            "Idempotency-Key": _idempotency_key(body),
-        },
+        headers=headers,
     )
     try:
         with urllib.request.urlopen(req, timeout=timeout_s) as resp:  # noqa: S310 (trusted tailnet)