Unifies first-run setup into a single idempotent command that registers
identity, completes claim, and imports API keys from env. Persists
--base-url in client config for remote daemon connections.
Closes#434
Co-authored-by: Cursor <cursoragent@cursor.com>
Phases A–I of TODOS.md:
- Move all five registry classes (IdentityRegistry, PrincipalRegistry,
VaultRegistry, IdentityClaimRegistry, PrincipalVaultBindingRegistry) from
identity/ to server/registries.py. Domain model types stay in identity/.
- Break identity/local.py → cli/ coupling: inline _read/_write_active_identity_handle
helpers so identity/ imports nothing from cli/.
- Remove VaultRegistry + get_server_home imports from auth/service.py; refactor
revoke() to accept explicit vault_ids from the server layer.
- Move proxy_routes() and _build_route_entry() out of AuthService into
server/proxy_catalog.py; proxy route delegates to build_proxy_routes().
- Move AuthService from auth/service.py to server/credential_service.py so
auth/ becomes a true leaf (no vault/, audit/, or server/ imports). Update
all 10+ import sites in server/, cli/ test files, and the top-level __init__.
- Remove global AuthService(identity="server") from app.py. Refactor /ready
to resolve the local identity at request time and use app.state.vault directly.
- Remove vault.home property from Vault; replace all callers with store.home.
- Update AGENTS.md architecture table to reflect new file locations.
All 293 tests pass. ruff and ty clean.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Entire-Checkpoint: 5c8526a4e7d2
- Add ADR-0003: proxy unmatched requests pass through in local mode
- Add docs/agents/ guidance files (domain, issue-tracker, triage-labels)
- Add "Composition over inheritance" principle to AGENTS.md and CONTRIBUTING.md
- Fix AGENTS.md Architecture section: remove "Identity = Profile", update
AuthService constructor (vault_id/principal_id), fix storage key patterns
to vault:<vault_id>:..., add five-registry model description
- Update UBIQUITOUS_LANGUAGE.md: retire Profile term, add Principal, PrincipalId,
VaultId, VaultHandle, IdentityClaimRecord, ClaimStatus, PrincipalVaultBindingRecord,
ActiveIdentity, StorageSubstrate, StorageNamespace, SecretSource, Repository;
update Relationships and Example dialogue to reflect Principal/Vault model
- Add docs/refactor.md: storage composition refactor plan (Phases 1-9); mark
Principal/Vault/Claim architecture as implemented, keep open storage phases
Note: the feature/principal-vault-identity-design branch adds
docs/adr/0003-principal-owned-vault.md — that file must be renamed to
0004-principal-owned-vault.md before that PR merges to avoid collision with
the new ADR-0003 added here.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Entire-Checkpoint: c7b941617a23
Profile is now a pure credential namespace scoped by the Identity handle,
not an independently managed entity. The two were always 1:1 but modelled
as separate concepts; this commit makes that explicit.
Key changes:
- Add `active_identity` to GlobalConfig; `ensure_local_identity` reads it
and errors hard if the configured handle is missing on disk (no silent
re-creation)
- `authsome init` writes `active_identity` to config after registration
- Collapse `registered: bool` + `registration_status: str` on
IdentityMetadata into a single `registered: bool`; add `mark_registered()`
- Remove vestigial `Identity` dataclass, `DEFAULT_IDENTITY`, `current()`
- Remove `name`, `description`, `owner_email` from IdentityMetadata (deferred
to hosted version)
- Remove `ProfileMetadata`, `ProfileNotFoundError`, `create_profile`,
`list_profiles`, `get_profile`, `set_default_profile`, `default_profile`
shim in save_config — profile is a side-effect of identity registration
- Add hard-error test for missing configured identity
- Update UBIQUITOUS_LANGUAGE.md, AGENTS.md architecture section, and
ADR 0002 to reflect current code (fix stale AuthsomeContext, AuthClient,
config.json path, ProfileMetadata references)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Entire-Checkpoint: 614885258a45
pyproject.toml is now the single source of truth for the version.
__init__.py no longer hardcodes a duplicate string that can drift out of
sync on every release.
Also adds an AI agent rule to AGENTS.md: never commit directly to main —
always open a PR.
Closes#222
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Entire-Checkpoint: d9b357881fc6
Add YAGNI, SRP, deep modules, Boy Scout rule, and 5 other design
principles to CONTRIBUTING.md, plus an AI-assisted development section
covering verification, blast radius, and commit hygiene. Mirror the
rules concisely in AGENTS.md with a reference back to CONTRIBUTING.md.
Also fix the wrong title in AGENTS.md and the bare pip install command.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Entire-Checkpoint: 08e2c0d2477f
Add host_url field to atlassian, discord, gitlab, hubspot, microsoft,
notion, and slack provider JSON configs. Fix docs to reflect current
flow names (api_key, device_code), add --show-secret to README example,
and remove --profile flag references that are no longer supported.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* refactor: remove global --json flag support and update documentation to reflect CLI changes
* docs: simplify and condense README content with a focused CLI reference
- Set requires-python to >=3.13, target-version to py313, line-length to 120
- Add LICENSE file (MIT) and license-files field
- Update author name/email to Manoj Bajaj <manojbajaj95@gmail.com>
- Add py.typed marker, ruff config, and coverage config
- Fix test_flows.py: use LocalFileCryptoBackend instead of KeyringCryptoBackend
- Fix test_registry.py: assert "github" instead of non-existent "anthropic" bundled provider
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Manoj Bajaj