hanzoai/s3 (SeaweedFS fork w/ consensus+ZAP) is the canonical object
store; the minio pip package and its branding are gone. hanzo-s3 is now
a thin native boto3 adapter exposing a stable surface (S3Client + Bucket/
Object/Stat) so the hanzo s3 CLI and s3 MCP tool are unchanged. Removed
the dead MinioAdmin re-export (no consumer) and all MinIO naming.
CLI (7) + MCP S3Tool (14) tests green; ruff clean.
Closes the last gap in the one-way Hanzo control surface. IAM/KMS/PaaS
already had both CLI subcommands and MCP tools; S3 had neither.
- hanzo s3: buckets/mb/rb/ls/stat/rm/presign over hanzo_s3 (MinIO) client,
creds from env (inject from KMS, never plaintext). Registered in the
unified hanzo CLI alongside iam/kms/paas.
- hanzo-tools-s3: S3Tool MCP tool (same action-dispatch pattern as PaaSTool),
exported via the hanzo.tools entry point; s3 added to loader prefix map.
- uv workspace: map hanzo-cli/iam/kms/s3 + tools-s3 to local sources so the
unified CLI resolves on-disk packages (fixes hanzo_iam ImportError from a
stale published 1.29.0 wheel shadowing local 1.30.0).
Tests: 7 CLI + 14 MCP, all green.
Follow-up to 6cb1d11 (hanzo-iam 1.30.0). Consumer packages now read only
the canonical IAM_ prefix — no upstream-brand alias chain, matching the
new IAMConfig.ENV_PREFIX contract enforced by test_env.py.
Touched modules:
- hanzo-cli: hanzo_cli/auth.py, hanzo_cli/bot/commands.py
- hanzo-tools-auth: hanzo_tools/auth/session.py
- hanzo-tools-iam: hanzo_tools/iam/iam_tool.py
- hanzo: src/hanzo/commands/{auth,iam}.py
- hanzoai: auth.py, llm_client.py
- tests: test_auth_pkce.py (import IAM_CLIENT_ID)
Also adds the generated pkg/hanzo-iam/uv.lock — matches the convention
of the other 17 axis pkgs that track their lockfiles.
Add TOML config parser that converts hanzo.toml manifests into PaaS
container API payloads. New `deploy up` command reads hanzo.toml from
CWD and creates or updates containers. Also adds --config flag to
`deploy create` for explicit manifest path. Adds tomli dependency for
Python 3.9/3.10 compat.
Co-authored-by: Hanzo Dev <[email protected]>
The installed @hanzo/bot binary (v2026.2.16) reads OPENCLAW_GATEWAY_TOKEN
for the node run command's token resolution, not BOT_GATEWAY_TOKEN.
Also writes gateway config to bot.json so the config loader picks it up
as a fallback.
Add install, login, logout, run, stop subcommands to `hanzo bot` for
managing local bot agent nodes that connect to gw.hanzo.bot. Browser
OAuth flow authenticates against hanzobot-client-id with dedicated token
storage at ~/.hanzo/bot/token.json. Password grant fallback via
--no-browser flag.
Normalize env var lookup: IAM_ canonical prefix with HANZO_IAM_ accepted
as backwards-compatible fallback via _env() helper in both auth.py and
bot/commands.py.
- Add `hanzo bot` command group (status, logs, deploy, env, events) via PaaS API
- Replace all storage placeholders with real boto3 S3 API calls to s3.hanzo.ai
- Rename `hanzo storage` → `hanzo s3` (storage kept as alias)
- Rewrite `hanzo dev` as lazy-install passthrough to @hanzo/dev binary
- Rewrite `hanzo net`/`hanzo node` as passthrough to hanzod binary
- Remove ~350 lines of inline orchestrator/node code in favor of os.execvp()
- Add `hanzo k8s` command group to hanzo-cli that wraps kubectl with
Hanzo-managed auth and default namespace. Uses KubectlGroup that
dynamically proxies unknown subcommands to kubectl (e.g.
`hanzo k8s get pods` -> `kubectl get pods -n hanzo`).
- Remove REPL mode from hanzo wrapper: bare `hanzo` now shows help
instead of dropping into interactive REPL.
- Remove hanzo-ai, hanzo-chat, hanzo-repl entry points.
- Make hanzo-cli a core dependency of hanzo (was optional [cli] extra).
- Remove unused typer dep, move openai/anthropic/prompt-toolkit to
optional extras ([ai], [interactive]).
Co-authored-by: Hanzo Dev <[email protected]>
Run ruff check --fix and ruff format across the repo to fix ~495
auto-fixable lint errors (mostly I001 import sorting) and reformat
225 files to match the py312 target.
Co-authored-by: Hanzo Dev <[email protected]>
Extract _exchange_iam_token method for cleaner auth caching logic.
Fix deploy_env to send full container payload on PUT (PaaS requires it).
Add e2e test scaffold.
Co-authored-by: Hanzo Dev <[email protected]>
zeekay
