fix(cloud cli): accept tracer slug or id, --json on key create, anon scan (0.3.1)

- _resolve_tracer queries by slug when the ref is not a UUID (the id column is
  uuid-typed, so a slug as an id filter 400s before any fallback).
- keys/ingest-keys create honor --json and emit the created record as JSON.
- scan runs without a session (public endpoint) and sends a first-party Origin
  so the same-origin guard passes for the anonymous flow.
- bump to 0.3.1.

Author: adrida

CHANGELOG.md

@@ -3,6 +3,17 @@
 All notable changes to TRACER are recorded here. This project follows semantic
 versioning.
 
+## 0.3.1 (2026-06)
+
+### Changed
+- `tracer cloud` commands that take a tracer (`get`, `training`, `analytics`,
+  `label-space`, `traces`, ...) now accept either the tracer slug or its id.
+- `tracer cloud scan` works without logging in, matching the public web scan.
+
+### Fixed
+- `tracer cloud keys create` and `tracer cloud ingest-keys create` now honor
+  `--json` and emit the created record (including the one-time secret) as JSON.
+
 ## 0.3.0 (2026-06)
 
 ### Added

src/tracer/__init__.py

@@ -78,7 +78,7 @@ def __getattr__(name: str):
     return obj
 
 
-__version__ = "0.3.0"
+__version__ = "0.3.1"
 
 __all__ = [
     # Core API

src/tracer/cloud/cli.py

@@ -12,6 +12,7 @@
 import getpass
 import json as _json
 import os
+import re
 import sys
 import time
 from typing import Any
@@ -76,10 +77,19 @@ def _resolve_tenant(client: CloudClient, want: str | None) -> dict[str, Any]:
     return tenants[0]
 
 
+_UUID_RE = re.compile(
+    r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", re.I
+)
+
+
 def _resolve_tracer(client: CloudClient, ref: str) -> dict[str, Any]:
-    # Try by id, then by slug.
-    rows = client.db("tracer_summary", select="*", filters={"id": f"eq.{ref}"})
-    if not rows:
+    # A UUID ref is queried by id; anything else is treated as a slug. The id
+    # column is uuid-typed, so sending a non-uuid as an id filter makes
+    # PostgREST 400 ("invalid input syntax for type uuid") before any slug
+    # fallback could run -- so pick the right column up front.
+    key = "id" if _UUID_RE.match(ref or "") else "slug"
+    rows = client.db("tracer_summary", select="*", filters={key: f"eq.{ref}"})
+    if not rows and key == "id":
         rows = client.db("tracer_summary", select="*", filters={"slug": f"eq.{ref}"})
     if not rows:
         raise CloudError(f"tracer not found: {ref}")
@@ -514,6 +524,9 @@ def _cmd_keys(client: CloudClient, args) -> None:
         _table(res.get("keys", []), ["id", "name", "prefix", "last4", "last_used_at", "revoked_at"])
     elif args.action == "create":
         res = client.api("POST", base, json_body={"name": args.name})
+        if args.json:
+            _print_json(res)
+            return
         print(_c("✓ key (shown once):", _GREEN), res.get("full_key"))
     elif args.action == "revoke":
         client.api("DELETE", f"{base}/{args.id}")
@@ -532,6 +545,9 @@ def _cmd_ingest_keys(client: CloudClient, args) -> None:
     elif args.action == "create":
         tenant = _resolve_tenant(client, args.tenant)
         res = client.api("POST", "/api/observe/keys", json_body={"tenant_id": tenant["id"], "name": args.name})
+        if args.json:
+            _print_json(res)
+            return
         print(_c("✓ ingest key (shown once):", _GREEN), res.get("full_key"))
     elif args.action == "revoke":
         client.api("DELETE", f"/api/observe/keys/{args.id}")
@@ -574,7 +590,9 @@ def _cmd_billing(client: CloudClient, args) -> None:
 
 
 def _cmd_scan(client: CloudClient, args) -> None:
-    res = client.api_multipart("/api/scan", {}, args.file)
+    # /api/scan is public (matches the anonymous web /scan flow), so the scan
+    # works logged out; the bearer is attached only if a session exists.
+    res = client.api_multipart("/api/scan", {}, args.file, auth="optional")
     # The agent may need to disambiguate the file format. Re-submit with answers
     # (CLI flags override the server's best-guess defaults) so the scan is
     # non-interactive instead of silently no-opping on an ambiguous file.
@@ -587,7 +605,9 @@ def _cmd_scan(client: CloudClient, args) -> None:
         if args.task:
             answers["task"] = args.task
         print(_c("clarifying format", _DIM), _json.dumps(answers))
-        res = client.api_multipart("/api/scan", {"answers": _json.dumps(answers)}, args.file)
+        res = client.api_multipart(
+            "/api/scan", {"answers": _json.dumps(answers)}, args.file, auth="optional"
+        )
     job_id = res.get("job_id") if isinstance(res, dict) else None
     if not job_id:
         _print_json(res)
@@ -596,7 +616,7 @@ def _cmd_scan(client: CloudClient, args) -> None:
     print(_c("link", _DIM), f"{client.base_url}/scan/{job_id}")
     start = time.time()
     while time.time() - start < 300:
-        st = client.api("GET", f"/api/scan/{job_id}")
+        st = client.api("GET", f"/api/scan/{job_id}", auth="optional")
         if st.get("status") == "ready":
             print(_c("✓", _GREEN), "scan ready")
             if getattr(args, "json", False):
@@ -964,8 +984,9 @@ def run(args) -> None:
         print("usage: tracer cloud <subcommand>  (try `tracer cloud --help`)")
         sys.exit(1)
     client = CloudClient.load()
-    # login/logout don't require an existing session.
-    if cmd not in ("login", "logout") and not client.logged_in:
+    # login/logout don't require an existing session; `scan` is a public
+    # endpoint (mirrors the anonymous web /scan) so it runs logged out too.
+    if cmd not in ("login", "logout", "scan") and not client.logged_in:
         print(_c("not logged in.", _RED), "run `tracer cloud login` first.")
         sys.exit(1)
     handler = _DISPATCH.get(cmd)

src/tracer/cloud/client.py

@@ -39,7 +39,7 @@ class CloudError(RuntimeError):
 
 # A real User-Agent: the default "Python-urllib/x" trips Cloudflare's bot
 # protection on app.tracerml.ai (HTTP 403, CF error 1010).
-USER_AGENT = "tracer-cli/0.3.0 (+https://tracerml.ai)"
+USER_AGENT = "tracer-cli/0.3.1 (+https://tracerml.ai)"
 
 
 def _http(
@@ -191,6 +191,21 @@ def _access_token(self) -> str:
             self._refresh()
         return self.cfg["access_token"]
 
+    def _auth_header(self, auth: str) -> dict[str, str]:
+        """Build the Authorization header for a request.
+
+        auth="required" (default): a session is mandatory (raises if absent).
+        auth="optional": attach the bearer when logged in, otherwise call
+            anonymously -- for public endpoints (e.g. /api/scan) that work
+            without an account, matching the public web flow.
+        auth="none": never attach a bearer.
+        """
+        if auth == "none":
+            return {}
+        if auth == "optional" and not self.logged_in:
+            return {}
+        return {"Authorization": f"Bearer {self._access_token()}"}
+
     def logout(self) -> None:
         for k in ("access_token", "refresh_token", "expires_at", "email", "user_id"):
             self.cfg.pop(k, None)
@@ -204,11 +219,12 @@ def api(
         *,
         json_body: Any | None = None,
         params: dict[str, Any] | None = None,
+        auth: str = "required",
     ) -> Any:
         url = f"{self.base_url}{path}"
         if params:
             url += "?" + urllib.parse.urlencode({k: v for k, v in params.items() if v is not None})
-        headers = {"Authorization": f"Bearer {self._access_token()}"}
+        headers = {**self._auth_header(auth), "Origin": self.base_url}
         data = None
         if json_body is not None:
             headers["Content-Type"] = "application/json"
@@ -220,7 +236,9 @@ def api(
             raise CloudError(f"{method} {path} -> {status}: {err}")
         return payload
 
-    def api_multipart(self, path: str, fields: dict[str, str], file_path: str | None) -> Any:
+    def api_multipart(
+        self, path: str, fields: dict[str, str], file_path: str | None, *, auth: str = "required"
+    ) -> Any:
         """POST multipart/form-data (used by the upload + create routes)."""
         boundary = f"----tracer{uuid.uuid4().hex}"
         buf = io.BytesIO()
@@ -245,7 +263,8 @@ def w(s: str) -> None:
         w(f"--{boundary}--\r\n")
 
         headers = {
-            "Authorization": f"Bearer {self._access_token()}",
+            **self._auth_header(auth),
+            "Origin": self.base_url,
             "Content-Type": f"multipart/form-data; boundary={boundary}",
         }
         status, body, _ = _http(

tests/test_cloud_cli.py

@@ -97,6 +97,31 @@ def test_tenant_delete_calls_rpc_when_confirmed():
     assert c.rpc_calls == [("delete_company_tenant", {"_tenant": "t1"})]
 
 
+# ----- _resolve_tracer picks id vs slug by ref shape ------------------------- #
+class _ResolveClient:
+    def __init__(self):
+        self.filters = []
+
+    def db(self, view, **kw):
+        self.filters.append(kw.get("filters"))
+        return [{"id": "t-1", "slug": "my-tracer"}]
+
+
+def test_resolve_tracer_uses_slug_for_nonuuid():
+    # A slug must NOT be sent as an id filter (the id column is uuid-typed and
+    # PostgREST 400s on a non-uuid before any fallback can run).
+    c = _ResolveClient()
+    cli._resolve_tracer(c, "my-tracer")
+    assert c.filters[0] == {"slug": "eq.my-tracer"}
+
+
+def test_resolve_tracer_uses_id_for_uuid():
+    c = _ResolveClient()
+    uid = "38b9a2cf-7888-4ebd-a136-18add9c1d56a"
+    cli._resolve_tracer(c, uid)
+    assert c.filters[0] == {"id": f"eq.{uid}"}
+
+
 # ----- _table doesn't crash on empty ----------------------------------------- #
 def test_table_empty(capsys):
     cli._table([], ["a", "b"])