A row is named by owner and name — /v1/iam/users/hanzo/z — read with GET,
replaced with PUT, removed with DELETE. The hand-written clients reached for
verb-noun addresses, and the CLI and route table reached for a verb hanging off
the collection; both spellings are gone from the server.
A collection GET answers a wrapper keyed by the plural, and the key is not
always the word in the path — audit-logs answers auditLogs. Every reader now
takes the key from the table and raises when it is absent, because reading a
missing key as [] reports "none" for a healthy org. A row answers the record
itself, absence is 404, and a refusal is an RFC 9457 problem document carrying
the reason. account, memberships, password and login keep the {status, msg,
data} envelope and have their own reader.
The credential goes in Authorization as client_secret_basic, which is where IAM
reads one; the pair used to ride the query string, where it authenticated
nothing and landed in every log on the path. A password rides beside the user
row rather than inside it, so IAM hashes it and nothing writes it in the clear.
An update reads the row before replacing it, since PUT replaces the whole
record.
Role membership is the role's own users list, so adding and removing a member
reads the role, edits the list and writes it back.
The IAM tool drops enforce, system_info and health; the team tool reaches
IAM's workspaces, memberships, invitations and account instead of deferring to
an address it never had. Both name organizations only when the caller does —
IAM scopes the read, and a hardcoded owner is a refusal for everyone outside it.
The CLI route table is checked against IAM's own registered routes, and every
address here was verified against the running server.
Co-authored-by: Hanzo Dev <[email protected]>
Every command in this tree called /api/get-users, /api/set-password,
/api/add-provider and twenty-five more — the Casdoor-era surface. IAM
serves /v1/iam/<entity> and /v1/iam/password; all twenty-eight 404d. The
client id and secret rode in the query string besides, where the server
never looks and every log does.
IAM's entities all have the same five routes, so this is one
implementation of them over a table of fourteen entities rather than
fourteen hand-written command trees: 1391 lines to 300, and every entity
gains the verbs only some of them had. The credential goes in
Authorization — Basic for a confidential client, a bearer when one is
exported — and configure writes ~/.hanzo/auth.json 0600.
test_iam_cli reads IAM's own route registrations out of its Go source and
asserts every route this CLI names is one of them: 70 checked, and it is
what caught certs/get answering GET where the table said POST.
- Refactor tests in test_workflow.py, test_memory.py, and test_signal_handling.py
to use assertions instead of returning booleans (pytest strict mode requires None)
- Fix test_batch_orchestrator.py to mock file finding to avoid filesystem scans
- Add 'integration' pytest marker to both root pyproject.toml and pkg/hanzo/pytest.ini
- Account for system memories in memory manager tests
- Fix Hanzo Node detection to test actual chat endpoint instead of health check
- Check both ports 3690 (default) and 8000 for Hanzo Node
- Add session-based failed tool tracking to avoid repeated attempts
- Cache working tool selection for better performance
- Fix hanzo-mcp integration with proper dependencies
- Add comprehensive test suite for tool detection (14 tests)
- Test and verify OpenAI Codex integration
- Fix syntax errors (indentation) in hanzo-mcp tools
- Replace all bare except statements with except Exception
- Fix import sorting issues across all packages
- Update type annotations to use modern X | Y syntax for Python 3.10+
- Ensure all packages pass ruff linting checks
- Implement unified CLI tools module for all AI providers
- Add support for claude/cc, codex, gemini, grok, openhands/oh, hanzo-dev, cline, aider
- Enable parallel batch execution of CLI tools
- Add comprehensive test suite with 16 passing tests
- Fix typing issues with mypy strict mode
- Add GitHub Actions CI/CD workflow with optional integration tests
- Support authentication flow for all providers
- Follow DRY principle with single source of truth
Major improvements:
- Streaming responses with real-time feedback
- Smart rate limiting with exponential backoff
- Error recovery with circuit breaker pattern
- Comprehensive test suite (all tests passing)
- Fixed CI/CD pipeline issues
- TypeWriter effect for code display
- Adaptive rate limits per API provider
Performance:
- Prevents API overuse with smart throttling
- Automatic fallback on rate limit errors
- Burst protection and cooldown periods
- Per-API customized limits
Version bump to 0.3.21
- Fix import sorting with ruff
- Format code with black for consistent style
- Add proper sys.path handling in tests
- Add comprehensive tests for dev module and orchestrator config
- Ensure all 4 tests pass successfully
- Fix fallback mode to work without hanzo-network
- Tested locally: all tests passing
- Fixed import sorting issues (I001)
- Added timeout to urllib.request.urlopen with S310 suppression
- Fixed bare except statements (E722)
- Removed unused import in hanzo-network
- Removed test_node_command.py that was testing non-existent features
- All lint checks now pass 100%
- Remove all unconditional pytest.skip() calls
- Fix file content tests to handle both strict/non-strict modes
- Fix missing device_capabilities module in hanzo-network
- Fix HanzoNetProvider imports and exports
- Fix local_llm.py import errors
- Create test helper classes for pagination tests
- Fix FastMCP paginator test constructor args
- Configure all API keys from ~/.zsh/after.zsh
- All tests now pass or skip conditionally based on actual requirements
- Added net_check utility for verifying hanzo/net installation
- Improved error handling and dependency detection
- Added comprehensive tests for node command
- Set up CI/CD workflows for both projects
- Better handling of venv and Python paths
zeekayandHanzo Dev