bt-cli 0.4.18__tar.gz → 0.4.21__tar.gz

{bt_cli-0.4.18 → bt_cli-0.4.21}/.claude/skills/entitle/SKILL.md

@@ -14,6 +14,40 @@ description: Entitle commands for JIT access, bundles, workflows, and permission
 
 List affected resources first, then ask for explicit confirmation.
 
+## Performance Tips
+
+**ALWAYS use server-side filters** - never download all data and filter locally.
+
+```bash
+# ✓ FAST - Server-side filtering
+bt entitle permissions list --resource <resource_id>
+bt entitle permissions list --user <user_id>
+bt entitle permissions list --integration <integration_id>
+
+# ✗ SLOW - Downloads ALL 23k+ permissions, filters locally
+bt entitle permissions list | jq 'select(...)'
+bt entitle permissions list -o json | grep "something"
+```
+
+**Available filters for permissions list:**
+
+| Flag | Purpose |
+|------|---------|
+| `--resource -r` | Filter by resource ID |
+| `--user -u` | Filter by user ID |
+| `--integration -i` | Filter by integration ID |
+
+**Dataset size warning:** Entitle can have 20,000+ permissions. Unfiltered queries will be very slow.
+
+**Workflow - Check standing access for a resource:**
+```bash
+# 1. Find resource ID
+bt entitle resources list --integration <integration_id> | grep -i "admin"
+
+# 2. Query permissions with resource filter (fast)
+bt entitle permissions list --resource <resource_id> -o json | jq -r '.[] | "\(.actor.name) | \(.actor.email)"'
+```
+
 ## Integrations & Resources
 
 ```bash

{bt_cli-0.4.18 → bt_cli-0.4.21}/.github/workflows/release.yml

@@ -236,6 +236,9 @@ jobs:
       (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) ||
       (github.event_name == 'workflow_dispatch' && inputs.skip_pypi == false)
 
+    permissions:
+      id-token: write  # Required for trusted publishing to PyPI
+
     environment:
       name: pypi
       url: https://pypi.org/project/bt-cli/

{bt_cli-0.4.18/src/bt_cli/data → bt_cli-0.4.21}/CLAUDE.md

@@ -1,6 +1,6 @@
 # BT-CLI
 
-BeyondTrust Platform CLI for Password Safe, Entitle, PRA, and EPM Windows.
+BeyondTrust Platform CLI for Password Safe, Entitle, PRA, and EPM Windows. **Version: 0.4.21**
 
 ## Setup
 
@@ -35,6 +35,9 @@ Use these slash commands for detailed product guidance:
 ## Common Patterns
 
 ```bash
+# Version info
+bt version          # or bt --version or bt -V
+
 # All list commands support JSON output
 bt pws systems list -o json
 bt pra jump-items shell list -o json
@@ -61,6 +64,9 @@ PASSWORD=$(bt pws quick checkout -s server -a admin --raw)
 - PRA K8s tunnels: Require Linux jumpoint
 - PWS assets: Must create via workgroup endpoint
 - ECM integration: PWS system name must match PRA jump item name
+- Entitle permissions: Use server-side filters (`--resource`, `--user`, `--integration`) - dataset can be 20k+ records
+- Entitle users: Use `--all` flag only when needed - default fetches first page only
+- Windows builds: Rich must be pinned to `<14.0.0` (Rich 14 has PyInstaller unicode issues)
 
 ## Functional vs Managed Accounts
 

{bt_cli-0.4.18 → bt_cli-0.4.21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bt-cli
-Version: 0.4.18
+Version: 0.4.21
 Summary: BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM
 Author-email: Dave Grendysz <dgrendysz@beyondtrust.com>
 License: MIT
@@ -23,8 +23,9 @@ Requires-Dist: httpx>=0.27.0
 Requires-Dist: pydantic>=2.0.0
 Requires-Dist: python-dotenv>=1.0.0
 Requires-Dist: pyyaml>=6.0.0
-Requires-Dist: rich<15.0.0,>=13.7.0
+Requires-Dist: rich<14.0.0,>=13.7.0
 Requires-Dist: shellingham>=1.5.0
+Requires-Dist: truststore>=0.8.0; python_version >= '3.10'
 Requires-Dist: typer<1.0.0,>=0.12.0
 Provides-Extra: all
 Requires-Dist: keyring>=24.0.0; extra == 'all'

{bt_cli-0.4.18 → bt_cli-0.4.21}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "bt-cli"
-version = "0.4.18"
+version = "0.4.21"
 description = "BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM"
 readme = "README.md"
 requires-python = ">=3.9"
@@ -39,10 +39,11 @@ dependencies = [
     "typer>=0.12.0,<1.0.0",
     "httpx>=0.27.0",
     "pydantic>=2.0.0",
-    "rich>=13.7.0,<15.0.0",
+    "rich>=13.7.0,<14.0.0",  # Pin to 13.x - Rich 14 has PyInstaller issues
     "python-dotenv>=1.0.0",
     "pyyaml>=6.0.0",
     "shellingham>=1.5.0",
+    "truststore>=0.8.0;python_version>='3.10'",  # Use OS certificate store
 ]
 
 [project.optional-dependencies]

{bt_cli-0.4.18 → bt_cli-0.4.21}/src/bt_cli/__init__.py

@@ -1,3 +1,3 @@
 """BeyondTrust Unified Admin CLI."""
 
-__version__ = "0.4.18"
+__version__ = "0.4.21"

{bt_cli-0.4.18 → bt_cli-0.4.21}/src/bt_cli/cli.py

@@ -3,6 +3,14 @@
 import sys
 from typing import Optional
 
+# Use OS certificate store instead of bundled certifi (for enterprise CAs)
+# This must be done before any SSL connections are made
+try:
+    import truststore
+    truststore.inject_into_ssl()
+except ImportError:
+    pass  # Python < 3.10 or truststore not available
+
 import typer
 
 # Check rich version early to give helpful error
@@ -131,6 +139,13 @@ except Exception:
     pass  # Quick module not ready yet
 
 
+def _version_callback(value: bool) -> None:
+    """Print version and exit."""
+    if value:
+        print(f"bt-cli version {__version__}")
+        raise typer.Exit()
+
+
 @app.callback()
 def main_callback(
     profile: Optional[str] = typer.Option(
@@ -145,6 +160,13 @@ def main_callback(
         help="Show REST API calls (method, URL, headers, body)",
         envvar="BT_SHOW_REST",
     ),
+    version: bool = typer.Option(
+        False,
+        "--version", "-V",
+        help="Show version and exit",
+        callback=_version_callback,
+        is_eager=True,
+    ),
 ) -> None:
     """BeyondTrust Platform CLI.
 

{bt_cli-0.4.18 → bt_cli-0.4.21}/src/bt_cli/data/skills/entitle/SKILL.md

@@ -14,6 +14,40 @@ description: Entitle commands for JIT access, bundles, workflows, and permission
 
 List affected resources first, then ask for explicit confirmation.
 
+## Performance Tips
+
+**ALWAYS use server-side filters** - never download all data and filter locally.
+
+```bash
+# ✓ FAST - Server-side filtering
+bt entitle permissions list --resource <resource_id>
+bt entitle permissions list --user <user_id>
+bt entitle permissions list --integration <integration_id>
+
+# ✗ SLOW - Downloads ALL 23k+ permissions, filters locally
+bt entitle permissions list | jq 'select(...)'
+bt entitle permissions list -o json | grep "something"
+```
+
+**Available filters for permissions list:**
+
+| Flag | Purpose |
+|------|---------|
+| `--resource -r` | Filter by resource ID |
+| `--user -u` | Filter by user ID |
+| `--integration -i` | Filter by integration ID |
+
+**Dataset size warning:** Entitle can have 20,000+ permissions. Unfiltered queries will be very slow.
+
+**Workflow - Check standing access for a resource:**
+```bash
+# 1. Find resource ID
+bt entitle resources list --integration <integration_id> | grep -i "admin"
+
+# 2. Query permissions with resource filter (fast)
+bt entitle permissions list --resource <resource_id> -o json | jq -r '.[] | "\(.actor.name) | \(.actor.email)"'
+```
+
 ## Integrations & Resources
 
 ```bash

{bt_cli-0.4.18 → bt_cli-0.4.21}/src/bt_cli/entitle/client/base.py

@@ -351,10 +351,10 @@ class EntitleClient:
     # =========================================================================
 
     def list_users(
-        self, search: Optional[str] = None, limit: int = 100
+        self, search: Optional[str] = None, limit: int = 100, max_pages: Optional[int] = None
     ) -> list[dict[str, Any]]:
-        """List all users."""
-        return self.paginate("/users", {"search": search}, page_size=limit)
+        """List users with optional pagination limit."""
+        return self.paginate("/users", {"search": search}, page_size=limit, max_pages=max_pages)
 
     def get_user(self, user_id: str) -> dict[str, Any]:
         """Get a user by ID."""

{bt_cli-0.4.18 → bt_cli-0.4.21}/src/bt_cli/entitle/commands/users.py

@@ -14,7 +14,8 @@ app = typer.Typer(no_args_is_help=True, help="Manage users")
 @app.command("list")
 def list_users(
     search: Optional[str] = typer.Option(None, "--search", "-s", help="Search by email or name"),
-    limit: int = typer.Option(100, "--limit", "-l", help="Maximum results to return"),
+    limit: int = typer.Option(50, "--limit", "-l", help="Results per page"),
+    fetch_all: bool = typer.Option(False, "--all", help="Fetch all results (may be slow for large datasets)"),
     output: str = typer.Option("table", "--output", "-o", help="Output format: table, json"),
 ) -> None:
     """List users in Entitle.
@@ -22,11 +23,14 @@ def list_users(
     Examples:
         bt entitle users list
         bt entitle users list -s "john"
-        bt entitle users list -l 50 -o json
+        bt entitle users list -l 100 --all
+        bt entitle users list -o json
     """
     try:
         with get_client() as client:
-            data = client.list_users(search=search, limit=limit)
+            # Only fetch first page by default, use --all for everything
+            max_pages = None if fetch_all else 1
+            data = client.list_users(search=search, limit=limit, max_pages=max_pages)
 
         if output == "json":
             print_json(data)