bt-cli 0.4.70__tar.gz → 0.4.72__tar.gz

{bt_cli-0.4.70 → bt_cli-0.4.72}/.github/workflows/ci.yml

@@ -100,7 +100,9 @@ jobs:
           pip install -e ".[test]"
 
       - name: Run integration tests
-        run: pytest tests/integration -v -m integration
+        # --integration is the opt-in these tests now require; without it they
+        # skip, since credentials alone are no longer the trigger.
+        run: pytest tests/integration -v -m integration --integration
         env:
           BT_PWS_API_URL: ${{ secrets.BT_PWS_API_URL }}
           BT_PWS_CLIENT_ID: ${{ secrets.BT_PWS_CLIENT_ID }}

{bt_cli-0.4.70 → bt_cli-0.4.72}/CLAUDE.md

@@ -1,6 +1,6 @@
 # BT-CLI
 
-BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, EPM Linux, and the BeyondTrust Secrets API. **Version: 0.4.70**
+BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, EPM Linux, and the BeyondTrust Secrets API. **Version: 0.4.72**
 
 ## Setup
 
@@ -42,7 +42,7 @@ Use these slash commands for detailed product guidance:
 | Cross-product | `bt quick` | `pasm-onboard`, `pasm-offboard`, `pasm-search` |
 | Password Safe | `bt pws` | `systems`, `accounts`, `credentials`, `sessions`, `secrets`, `audit`, `quick` |
 | PRA | `bt pra` | `jump-items`, `vault`, `jump-groups`, `quick` |
-| Entitle | `bt entitle` | `integrations`, `resources`, `bundles`, `permissions` |
+| Entitle | `bt entitle` | `integrations`, `resources`, `bundles`, `permissions`, `jit`, `audit` |
 | EPM Windows | `bt epmw` | `computers`, `groups`, `policies`, `requests`, `quick` |
 | EPM Linux | `bt epml` | `rbp` (cmdgrps/hostgrps/usergrps/tmdategrps/roles/policy/tests/tx), `settings`, `users`, `audit`, `siems`, `quick` |
 | Secrets API | `bt secrets` | `folders`, `static`, `dynamic` (incl. `generate`), `leases`, `integrations` |
@@ -82,7 +82,7 @@ PASSWORD=$(bt pws quick checkout -s server -a admin --raw)
 - PRA K8s tunnels: Require Linux jumpoint
 - PWS assets: Must create via workgroup endpoint
 - ECM integration: PWS system name must match PRA jump item name
-- **PRA `-o json` is pure JSON on stdout** — all human status/error banners go to **stderr** (`core/output.py` `err_console`), so `... -o json | jq` is safe. API 4xx `errors` objects are surfaced field-by-field, not collapsed to "Validation Failed".
+- **`-o json` is pure JSON on stdout — in every product.** All human status/progress banners *and interactive prompts* go to **stderr** (`core/output.py` `err_console`; `typer.confirm`/`typer.prompt` are called with `err=True`), so `... -o json | jq` and `json.load(stdin)` are safe even for `quick` workflow commands that narrate their steps. Enforced by static guards in `tests/core/test_json_stdout_purity.py` — when adding a command, use `print_success`/`print_warning`/`print_info` or `err_console.print` for anything that isn't the command's data. Consequence: piping *table* output to a file drops the narration (it's on stderr) — that's intended. PRA API 4xx `errors` objects are surfaced field-by-field, not collapsed to "Validation Failed".
 - **PRA tunnel create gates fields by `tunnel_type`**: tcp→`--ports`, mssql→`--username`/`--database`, k8s→`--url`/`--ca-cert`. **psql/mysql are created BARE** — the public Config API has no write path for their username/database (POST rejects, PATCH no-ops, PUT 405s) though GET shows them; CLI warns + ignores those flags. Set in `/login` UI.
 - **PRA `export jump-items` defaults to a REAL export** (all types: shell/rdp/vnc/web/tunnel, full type-specific columns) that round-trips through `import jump-items`; `--sample` gives the blank template. `bt pra jump-items web create` exists.
 - **PRA vault `associate -t protocol_tunnel` is MSSQL-only** (live-verified): server rejects psql/mysql/tcp/k8s with "Only SQL Server Tunnels are allowed" — use tag/criteria association for those. **TCP `--ports` needs listen;destination *pairs*** (even count; odd → 400 "number of parameters is invalid"). Jumpoint listing is `bt pra jumpoints list` (plural).
@@ -92,6 +92,8 @@ PASSWORD=$(bt pws quick checkout -s server -a admin --raw)
 - **PWS session recording download = headless replay under `/pbsm/replay`** (there is **no** video-export API — `?video/?mp4/?webm` return JSON, not media). Flow: `GET /Sessions/{id}` for `Token`+`RecordKey`+`Protocol` → `POST /pbsm/replay` `{id:Token, record_key, protocol:"RDP"|"SSH", headless:true}` → `PUT /pbsm/replay/{rid}` `{offset:<ms>}` (seek) → `GET /pbsm/replay/{rid}?png=<scale>` (one PNG per offset) → `DELETE /pbsm/replay/{rid}`. **Warm-up:** the first `PUT` 404s (`"no such file or directory"`) until the renderer loads — retry ~0.5s. The seek response is state `{offset, next, eof, duration}`; **`next` = next recorded frame's offset**, enabling event-driven stepping. **`bt pws sessions analyze <id>` (or `--dir`)** preps a replay dump for LLM analysis without calling an LLM: reads `index.json`, selects **keyframes** (RDP frames whose PNG byte-size changed ≥`--threshold`%, dependency-free — no Pillow, UNION the frame that renders each **typed keystroke burst**, anchored via the recording `StartTime` → each keyframe tagged `screen-change`/`after-typing` with the `typed` text, so the model reads targeted spots not every frame), and prints a token/USD **cost estimate** (`--model opus|sonnet|haiku`) for focused (keyframes) vs all-frames; writes `analysis.json`. SSH → recommends the transcript over frames. Consumed by the `/session-analysis` skill (interactive; the model reads only the keyframes). Surfaced as `bt pws sessions replay <id>`. **Default = even coverage + dedup**: ~60 evenly-spaced frames across the whole session (`--frames N`) with consecutive-identical frames skipped (`--dedup`, sha1-based) — because event-driven over-samples RDP (it records many deltas as the screen paints, so `next`-stepping clusters at the login and burns the frame budget before covering the timeline). Modes are mutually exclusive: `--frames` (default) / `--fps` / `--interval` / `--all-frames` (event-driven forensic). Also `--from/--to`, `--scale`, `--max-frames`, `--no-dedup`; `--mp4` stitches via ffmpeg, else prints the command + install hint. Always `DELETE`s the replay in `finally`.
 - Entitle permissions: Use server-side filters (`--resource`, `--user`, `--integration`) - dataset can be 20k+ records
 - Entitle users: Use `--all` flag only when needed - default fetches first page only
+- **Entitle tokens are region-bound**: a token minted in one region 401s `"The token received doesn't exist"` on the others. Servers: `api.entitle.io`, `api.us.entitle.io`, `api.ca.entitle.io` — set `BT_ENTITLE_API_URL`/`entitle.api_url` to the tenant's region (that misleading 401 also = wrong-region config, not just a dead token). **No `GET /users/{id}`** — `users get` resolves via `list_users(search=...)`.
+- **Entitle `jit` / `audit`** (spec-derived, live-verified): `bt entitle jit list` wraps `GET /eligibleJitAccess` — with an org token `--user` is **required** (else 400), and the response is `{roles,bundles,pagination}` not the `result` envelope. `bt entitle audit search` wraps `POST /auditLogs/search` (Experimental) — **date window must be < 24h** (server 400s on ≥24h; CLI enforces client-side, default `--hours 24`), no pagination (returns all rows in range), each row's context is one of `integration`/`idp`/`ticket`/`user`. Full spec at `/projects/reference/entitle-api-reference.openapi.json`.
 - Windows builds: Rich must be pinned to `<14.0.0` (Rich 14 has PyInstaller unicode issues)
 - **EPML URL transform**: spec paths start with `/api/...` but real URL is `https://api.beyondtrust.io/site/<site-id>/epm/linux/<spec-path-minus-/api/>`. Encapsulated in client `_build_url` — never bypass it.
 - **EPML two authorizers**: spec claims `nomine-authorizer` (PAT) globally but the gateway has IAM-only routes (return 403 with AWS-flavored body). PAT cannot reach those. Documented per-op in `src/bt_cli/data/skills/epml/SKILL.md`. Where `/v6/pbul/rbp/...` exists alongside legacy `/pbul/{hostid}/rbp/...`, prefer legacy — v6 is mostly IAM-only.

{bt_cli-0.4.70 → bt_cli-0.4.72}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: bt-cli
-Version: 0.4.70
+Version: 0.4.72
 Summary: BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM
 Author-email: Dave Grendysz <dgrendysz@beyondtrust.com>
 License: MIT

bt_cli-0.4.72/bt-cli-cheatsheet.html

@@ -0,0 +1,229 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<title>BT-CLI Demo Flow — Working Commands (pf922288)</title>
+<style>
+  :root{
+    --bg:#0d1117;
+    --panel:#151b23;
+    --border:#2a323d;
+    --border-strong:#3a4452;
+    --text:#e6edf3;
+    --text-secondary:#9aa7b5;
+    --text-muted:#6b7684;
+    --accent:#3ea6ff;
+    --green:#3fb950;
+    --amber:#d29922;
+    --tag-bg:#1c2733;
+    --mono: "SFMono-Regular", Consolas, "Liberation Mono", Menlo, monospace;
+    --sans: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+  }
+  *{box-sizing:border-box}
+  body{background:var(--bg);color:var(--text);font-family:var(--sans);font-size:17px;margin:0;padding:38px 22px 72px}
+  .wrap{max-width:960px;margin:0 auto}
+  h1{font-size:30px;font-weight:600;margin:0 0 6px}
+  .sub{font-size:16px;color:var(--text-muted);margin:0 0 24px;line-height:1.5}
+  .legend{display:flex;flex-wrap:wrap;gap:18px;font-size:15px;color:var(--text-secondary);margin:0 0 26px;padding:15px 18px;border:1px solid var(--border);border-radius:8px;background:var(--panel)}
+  .legend span{display:inline-flex;align-items:center;gap:7px}
+  .dot{width:10px;height:10px;border-radius:50%}
+  .dot.v{background:var(--green)} .dot.s{background:var(--amber)} .dot.r{background:var(--accent)}
+  .refbox{border:1px solid var(--border-strong);border-radius:8px;padding:16px 18px;margin:0 0 30px;background:#0a0e14;font-family:var(--mono);font-size:15px;line-height:1.85;color:var(--text-secondary)}
+  .refbox b{color:var(--text)}
+  .step{font-size:14px;text-transform:uppercase;letter-spacing:.05em;color:var(--text-muted);margin:32px 0 12px;font-weight:600}
+  .step:first-of-type{margin-top:0}
+  .row{border:1px solid var(--border);border-radius:8px;padding:16px 18px;margin-bottom:12px;background:var(--panel)}
+  .row.state{border-color:#4a3d1a}
+  .hd{display:flex;align-items:center;justify-content:space-between;margin-bottom:12px;gap:10px}
+  .lbl{font-size:17px;font-weight:500;color:var(--text)}
+  .tags{display:flex;gap:7px;flex-shrink:0}
+  .tag{font-size:13px;font-weight:600;letter-spacing:.03em;color:var(--accent);background:var(--tag-bg);border:1px solid var(--border-strong);border-radius:4px;padding:3px 10px;white-space:nowrap}
+  .tag.v{color:var(--green);border-color:#264a30}
+  .tag.s{color:var(--amber);border-color:#4a3d1a}
+  .cmdrow{display:flex;align-items:stretch;gap:9px;margin-bottom:7px}
+  .cmd{flex:1;font-family:var(--mono);font-size:15.5px;line-height:1.6;color:#c9e8ff;background:#0a0e14;border:1px solid var(--border);border-radius:6px;padding:11px 14px;overflow-x:auto;white-space:pre}
+  .cpy{flex-shrink:0;width:44px;font-size:18px;display:flex;align-items:center;justify-content:center;border-radius:6px;border:1px solid var(--border-strong);background:transparent;cursor:pointer;color:var(--text-secondary);transition:background .12s,color .12s}
+  .cpy:hover{background:var(--tag-bg);color:var(--text)}
+  .cpy.copied{color:var(--green);border-color:var(--green)}
+  .note{font-size:15px;color:var(--text-muted);margin-top:8px;line-height:1.6}
+  .note b{color:var(--text-secondary)}
+  .note code{font-family:var(--mono);font-size:14px;color:#c9e8ff}
+  .flag{border:1px dashed var(--border-strong);border-radius:8px;padding:16px 18px;font-size:16px;color:var(--text-secondary);line-height:1.7}
+  .flag b{color:var(--text)}
+</style>
+</head>
+<body>
+<div class="wrap">
+  <h1>BT-CLI demo flow — working commands</h1>
+  <p class="sub">Verified live against tenant pf922288, 01 Jul 2026. Real IDs baked in. Ephemeral IDs (request/session) are captured at runtime, not hardcoded.</p>
+
+  <div class="legend">
+    <span><span class="dot r"></span>tag = docs bucket (BT-CLI / API)</span>
+    <span><span class="dot v"></span><b style="color:var(--green)">VERIFIED</b> — ran live, non-destructive, safe to demo</span>
+    <span><span class="dot s"></span><b style="color:var(--amber)">STATE-CHANGING</b> — correct syntax, changes/creates/deletes; run deliberately</span>
+  </div>
+
+  <div class="refbox">
+    <b>Real values (pf922288)</b><br>
+    system  ad.upm.academy .......... ID <b>19</b> (Active Directory)<br>
+    system  linhost2 ................ ID <b>6</b>  (Linux — used for the create demo)<br>
+    account svc_app ................. ID <b>18119</b> (exists; credential test PASSED)<br>
+    safe    GitHub - BTSolution-Engineering ... <b>9b56a95b-0a8a-4be6-de3c-08dd5118ea68</b><br>
+    folder  IaC-Demo ............... <b>bec2694b-994a-47cd-07c2-08de5e7a5e2d</b><br>
+    group   SecretsSafe_Access ..... ID <b>9</b>  (Dev_Ansible=10, API_Users=11)<br>
+    secret  path ................... <b>GitHub - BTSolution-Engineering/IaC-Demo/AWS</b><br>
+    perm flags ..................... None, Read, Create, Edit, Delete, Share, Manage
+  </div>
+
+  <div class="step">Setup — run once per session</div>
+  <div class="row">
+    <div class="hd"><span class="lbl">Session setup</span><span class="tags"><span class="tag v">VERIFIED</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c0">source .venv/bin/activate</div><button class="cpy" onclick="cp('c0',this)">⧉</button></div>
+    <div class="cmdrow"><div class="cmd" id="c2">bt whoami</div><button class="cpy" onclick="cp('c2',this)">⧉</button></div>
+    <div class="note">Credentials load from <b>~/.bt-cli/config.yaml</b> — no <code>source .env</code> needed. <code>bt whoami</code> should show Password Safe = Connected (user NH-Ansible, ID 120).</div>
+  </div>
+  <div class="row">
+    <div class="hd"><span class="lbl">Show the underlying REST call (demo toggle)</span><span class="tags"><span class="tag">API</span><span class="tag v">VERIFIED</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="cR">bt --show-rest pws accounts get 18119</div><button class="cpy" onclick="cp('cR',this)">⧉</button></div>
+    <div class="note">Prepend <b><code>bt --show-rest</code></b> to <b>any</b> command to print the REST request + response panels (method, URL, headers, body) — auth headers auto-redacted. Great for proving each command hits the public API. Also works as env: <code>export BT_SHOW_REST=1</code>.</div>
+  </div>
+
+  <div class="step">1 · Create account or secret — BT-CLI</div>
+  <div class="row state">
+    <div class="hd"><span class="lbl">Create managed account (local, on a non-directory system)</span><span class="tags"><span class="tag">BT-CLI</span><span class="tag s">STATE</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c3">bt pws accounts create --system 6 --name "svc_demo01" --password 'PASSWORD' --change-frequency xdays --change-days 1 --change-time 02:00</div><button class="cpy" onclick="cp('c3',this)">⧉</button></div>
+    <div class="note"><b>--system takes the integer ID</b> (6 = linhost2, Linux). Sub a real PASSWORD. Note: directory accounts (like svc_app on ad.upm.academy) require a UserPrincipalName and are onboarded via <b>discovery</b>, not this manual create — so the create demo uses a local system.</div>
+  </div>
+  <div class="row state">
+    <div class="hd"><span class="lbl">Create secret (Secrets Safe)</span><span class="tags"><span class="tag">BT-CLI</span><span class="tag s">STATE</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c4">bt pws secrets secrets create --folder bec2694b-994a-47cd-07c2-08de5e7a5e2d --title "db-admin-demo" --username admin --password 'PASSWORD'</div><button class="cpy" onclick="cp('c4',this)">⧉</button></div>
+    <div class="note">--folder is a folder <b>GUID</b> (IaC-Demo). Creates a real secret in that folder.</div>
+  </div>
+
+  <div class="step">2 · Assign policy, ownership, permissions — API</div>
+  <div class="row">
+    <div class="hd"><span class="lbl">List permission flags</span><span class="tags"><span class="tag">API</span><span class="tag v">VERIFIED</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c5">bt pws secrets safes permissions-options</div><button class="cpy" onclick="cp('c5',this)">⧉</button></div>
+  </div>
+  <div class="row">
+    <div class="hd"><span class="lbl">Show current grants on a safe</span><span class="tags"><span class="tag">API</span><span class="tag v">VERIFIED</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c6">bt pws secrets safes permissions 9b56a95b-0a8a-4be6-de3c-08dd5118ea68</div><button class="cpy" onclick="cp('c6',this)">⧉</button></div>
+  </div>
+  <div class="row state">
+    <div class="hd"><span class="lbl">Grant permissions to a group</span><span class="tags"><span class="tag">API</span><span class="tag s">STATE</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c7">bt pws secrets safes grant 9b56a95b-0a8a-4be6-de3c-08dd5118ea68 --group 9 --permissions "Read, Create, Edit, Delete, Share, Manage"</div><button class="cpy" onclick="cp('c7',this)">⧉</button></div>
+    <div class="note"><b>Flags aren't freely combinable</b> — the server validates the whole set. Valid combos (verified live): <code>Read</code> · <code>Read, Edit</code> · <code>Read, Create, Edit, Delete, Share</code> · <code>Read, Create, Edit, Delete, Share, Manage</code> (full owner). <b>Manage only works with the full set</b> — <code>Read,Edit,Manage</code> is rejected as an "Invalid permission combination".</div>
+  </div>
+  <div class="row state">
+    <div class="hd"><span class="lbl">Revoke all permissions for a group</span><span class="tags"><span class="tag">API</span><span class="tag s">STATE</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c8">bt pws secrets safes revoke 9b56a95b-0a8a-4be6-de3c-08dd5118ea68 --group 9</div><button class="cpy" onclick="cp('c8',this)">⧉</button></div>
+  </div>
+
+  <div class="step">3 · Trigger verification and rotation — BT-CLI</div>
+  <div class="row">
+    <div class="hd"><span class="lbl">Verify stored credential (non-destructive)</span><span class="tags"><span class="tag">BT-CLI</span><span class="tag v">VERIFIED</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c9">bt pws quick test -s "ad.upm.academy" -a svc_app</div><button class="cpy" onclick="cp('c9',this)">⧉</button></div>
+    <div class="note">Ran live → <b>Credential test PASSED for svc_app@ad.upm.academy</b>. Quick commands accept the system <b>name</b>.</div>
+  </div>
+  <div class="row state">
+    <div class="hd"><span class="lbl">Rotate now</span><span class="tags"><span class="tag">BT-CLI</span><span class="tag s">STATE</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c10">bt pws quick rotate -s "ad.upm.academy" -a svc_app</div><button class="cpy" onclick="cp('c10',this)">⧉</button></div>
+    <div class="note">Fires the platform rotation/propagation. Changes the live password.</div>
+  </div>
+
+  <div class="step">4 · Submit and approve access request — API</div>
+  <div class="row state">
+    <div class="hd"><span class="lbl">Submit checkout request (capture the request ID)</span><span class="tags"><span class="tag">API</span><span class="tag s">STATE</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c11">bt pws credentials checkout --system "ad.upm.academy" --account "svc_app" --reason "demo" -o json</div><button class="cpy" onclick="cp('c11',this)">⧉</button></div>
+    <div class="note">Returns a <b>RequestID</b> in the JSON. <b>Requires the account to be under an access policy with a schedule your identity can use</b> — otherwise you get <code>"Could not find a schedule to use with this release request."</code> If so, use <b>quick checkout</b> (step 5), which lists only accounts you can actually request.</div>
+  </div>
+  <div class="row">
+    <div class="hd"><span class="lbl">List pending requests</span><span class="tags"><span class="tag">API</span><span class="tag v">VERIFIED</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c12">bt pws credentials list --status pending</div><button class="cpy" onclick="cp('c12',this)">⧉</button></div>
+    <div class="note">Ran live (currently "No requests found"). Also: <code>--all</code>, <code>--status approved</code>.</div>
+  </div>
+  <div class="row state">
+    <div class="hd"><span class="lbl">Approve a pending request</span><span class="tags"><span class="tag">API</span><span class="tag s">STATE</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c13">bt pws credentials approve REQUEST_ID</div><button class="cpy" onclick="cp('c13',this)">⧉</button></div>
+    <div class="note">REQUEST_ID is the integer from the checkout above / from <code>credentials list</code>.</div>
+  </div>
+
+  <div class="step">5 · Retrieve or broker access — API</div>
+  <div class="row state">
+    <div class="hd"><span class="lbl">Quick checkout — the easy path (request + approve + retrieve)</span><span class="tags"><span class="tag">BT-CLI</span><span class="tag s">STATE</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c14b">bt pws quick checkout</div><button class="cpy" onclick="cp('c14b',this)">⧉</button></div>
+    <div class="note"><b>Run with no args to go interactive</b> — it lists only the accounts you're actually allowed to request, you pick one, and it does request → approve → show password in one step. This sidesteps the access-policy/schedule issue above.</div>
+  </div>
+  <div class="row state">
+    <div class="hd"><span class="lbl">Quick checkout — scripted, to a variable</span><span class="tags"><span class="tag">BT-CLI</span><span class="tag s">STATE</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c14">PW=$(bt pws quick checkout -s "SYSTEM" -a "ACCOUNT" --raw)</div><button class="cpy" onclick="cp('c14',this)">⧉</button></div>
+    <div class="note">Same flow, non-interactive. Fill SYSTEM/ACCOUNT with one shown in the interactive list. <code>echo "$PW"</code> to view.</div>
+  </div>
+  <div class="row">
+    <div class="hd"><span class="lbl">Get a Secrets Safe secret value</span><span class="tags"><span class="tag">API</span><span class="tag v">VERIFIED</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c15">bt pws quick get-secret "GitHub - BTSolution-Engineering/IaC-Demo/AWS" --raw</div><button class="cpy" onclick="cp('c15',this)">⧉</button></div>
+    <div class="note">Path is <b>Safe/Folder/SecretName</b>. Resolved live to Secret "AWS". Drop <code>--raw</code> for a table view.</div>
+  </div>
+
+  <div class="step">6 · Revoke access — API</div>
+  <div class="row state">
+    <div class="hd"><span class="lbl">Check in + rotate on release</span><span class="tags"><span class="tag">API</span><span class="tag s">STATE</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c16">bt pws credentials checkin REQUEST_ID --rotate</div><button class="cpy" onclick="cp('c16',this)">⧉</button></div>
+    <div class="note">REQUEST_ID is an integer (from step 4/5).</div>
+  </div>
+  <div class="row">
+    <div class="hd"><span class="lbl">List active sessions (capture the session ID)</span><span class="tags"><span class="tag">API</span><span class="tag v">VERIFIED</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c17">bt pws sessions list --active</div><button class="cpy" onclick="cp('c17',this)">⧉</button></div>
+    <div class="note">Ran live (currently "No sessions found"). The <b>ID</b> column is the SESSION_ID (integer) below.</div>
+  </div>
+  <div class="row state">
+    <div class="hd"><span class="lbl">Suspend session (resumable)</span><span class="tags"><span class="tag">API</span><span class="tag s">STATE</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c18">bt pws sessions suspend SESSION_ID</div><button class="cpy" onclick="cp('c18',this)">⧉</button></div>
+  </div>
+  <div class="row state">
+    <div class="hd"><span class="lbl">Terminate session (permanent)</span><span class="tags"><span class="tag">API</span><span class="tag s">STATE</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c19">bt pws sessions terminate SESSION_ID --force</div><button class="cpy" onclick="cp('c19',this)">⧉</button></div>
+  </div>
+
+  <div class="step">7 · Offboard the account — BT-CLI</div>
+  <div class="row state">
+    <div class="hd"><span class="lbl">Offboard system (removes system + accounts + asset)</span><span class="tags"><span class="tag">BT-CLI</span><span class="tag s">STATE</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c20">bt pws quick offboard -s "ad.upm.academy"</div><button class="cpy" onclick="cp('c20',this)">⧉</button></div>
+    <div class="note"><b>Destructive:</b> deletes ad.upm.academy (ID 19) and all its accounts incl. svc_app. Don't run unless you mean it.</div>
+  </div>
+
+  <div class="step">8 · Export audit evidence — API</div>
+  <div class="row">
+    <div class="hd"><span class="lbl">Full evidence export (JSON)</span><span class="tags"><span class="tag">API</span><span class="tag v">VERIFIED</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c21">bt pws audit export --file ~/evidence.json</div><button class="cpy" onclick="cp('c21',this)">⧉</button></div>
+    <div class="note">Defaults to BOTH requests and sessions when no flag is given. <b>--file must be a writable path</b> — the CLI fetches the evidence then writes the file, so a "Permission denied" here means the directory isn't writable (use <code>~/</code> or <code>/tmp</code>, not a read-only checkout dir).</div>
+  </div>
+  <div class="row">
+    <div class="hd"><span class="lbl">Approved requests (CSV)</span><span class="tags"><span class="tag">API</span><span class="tag v">VERIFIED</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c22">bt pws audit export --requests --status approved --file ~/svc_app-evidence.csv --format csv</div><button class="cpy" onclick="cp('c22',this)">⧉</button></div>
+  </div>
+  <div class="row">
+    <div class="hd"><span class="lbl">Session evidence (CSV)</span><span class="tags"><span class="tag">API</span><span class="tag v">VERIFIED</span></span></div>
+    <div class="cmdrow"><div class="cmd" id="c23">bt pws audit export --sessions --file ~/sessions.csv --format csv</div><button class="cpy" onclick="cp('c23',this)">⧉</button></div>
+  </div>
+
+  <div class="step">9-10 · Integrations + API auth — out of scope</div>
+  <div class="flag">
+    <b>ServiceNow / SailPoint</b> and <b>scoped-token API auth</b> (certs, rate limits, bulk ops) are UI/console config, not bt-cli commands — nothing to copy/paste here.
+  </div>
+</div>
+
+<script>
+function cp(id, btn){
+  const text = document.getElementById(id).innerText;
+  const done = () => { const o = btn.textContent; btn.textContent='✓'; btn.classList.add('copied'); setTimeout(()=>{btn.textContent=o;btn.classList.remove('copied');},1200); };
+  if (navigator.clipboard && navigator.clipboard.writeText) navigator.clipboard.writeText(text).then(done).catch(()=>fallbackCopy(text,done));
+  else fallbackCopy(text,done);
+}
+function fallbackCopy(text, done){
+  const ta=document.createElement('textarea'); ta.value=text; ta.style.position='fixed'; ta.style.opacity='0';
+  document.body.appendChild(ta); ta.select(); try{document.execCommand('copy');}catch(e){} document.body.removeChild(ta); done();
+}
+</script>
+</body>
+</html>

{bt_cli-0.4.70 → bt_cli-0.4.72}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "bt-cli"
-version = "0.4.70"
+version = "0.4.72"
 description = "BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM"
 readme = "README.md"
 requires-python = ">=3.9"
@@ -75,3 +75,7 @@ packages = ["src/bt_cli"]
 [tool.pytest.ini_options]
 asyncio_mode = "auto"
 testpaths = ["tests"]
+# Test the working tree, not whatever bt_cli happens to be installed in
+# site-packages. Without this a non-editable `pip install bt-cli` shadows
+# src/ and the suite silently tests a stale copy at the same version number.
+pythonpath = ["src"]

{bt_cli-0.4.70 → bt_cli-0.4.72}/src/bt_cli/__init__.py

@@ -1,3 +1,3 @@
 """BeyondTrust Unified Admin CLI."""
 
-__version__ = "0.4.70"
+__version__ = "0.4.72"

{bt_cli-0.4.70 → bt_cli-0.4.72}/src/bt_cli/commands/learn.py

@@ -221,7 +221,7 @@ def clear_learnings(
         bt learn clear --force
     """
     if not force:
-        if not typer.confirm("Clear all learnings?"):
+        if not typer.confirm("Clear all learnings?", err=True):
             console.print("[yellow]Cancelled[/yellow]")
             raise typer.Exit(0)
 

{bt_cli-0.4.70 → bt_cli-0.4.72}/src/bt_cli/commands/quick.py

@@ -11,7 +11,7 @@ from rich.console import Console
 from rich.panel import Panel
 from rich.table import Table
 
-from ..core.output import print_api_error, print_error, print_success, print_warning
+from ..core.output import err_console, print_api_error, print_error, print_success, print_warning
 from ..core.prompts import prompt_if_missing, prompt_from_list
 
 
@@ -128,7 +128,7 @@ def pasm_onboard(
         for i, row in enumerate(rows, 1):
             console.print(f"  {i}. {row.get('name', '?')} ({row.get('ip', '?')})")
 
-        if not typer.confirm("\nProceed with bulk onboarding?"):
+        if not typer.confirm("\nProceed with bulk onboarding?", err=True):
             console.print("[yellow]Cancelled.[/yellow]")
             raise typer.Exit(0)
 
@@ -158,19 +158,19 @@ def pasm_onboard(
                 )
                 results.append({"name": row.get('name'), "status": "success"})
             except Exception as e:
-                console.print(f"[red]Failed: {e}[/red]")
+                err_console.print(f"[red]Failed: {e}[/red]")
                 results.append({"name": row.get('name'), "status": "failed", "error": str(e)})
 
         # Summary
         console.print(f"\n[bold]Bulk Onboarding Summary:[/bold]")
         success = sum(1 for r in results if r["status"] == "success")
         failed = sum(1 for r in results if r["status"] == "failed")
-        console.print(f"  [green]Success: {success}[/green]")
+        err_console.print(f"  [green]Success: {success}[/green]")
         if failed:
-            console.print(f"  [red]Failed: {failed}[/red]")
+            err_console.print(f"  [red]Failed: {failed}[/red]")
             for r in results:
                 if r["status"] == "failed":
-                    console.print(f"    - {r['name']}: {r.get('error', 'Unknown error')}")
+                    err_console.print(f"    - {r['name']}: {r.get('error', 'Unknown error')}")
 
         if output == "json":
             console.print_json(json.dumps(results, default=str))
@@ -273,7 +273,7 @@ def _onboard_single_host(
                 pws.authenticate()
 
                 # Create asset
-                console.print(f"[dim]PWS: Creating asset '{name}'...[/dim]")
+                err_console.print(f"[dim]PWS: Creating asset '{name}'...[/dim]")
                 asset = pws.create_asset(
                     workgroup_id=workgroup,
                     ip_address=ip,
@@ -281,10 +281,10 @@ def _onboard_single_host(
                     dns_name=dns,
                 )
                 asset_id = asset.get("AssetID")
-                console.print(f"  [green]Created asset ID: {asset_id}[/green]")
+                err_console.print(f"  [green]Created asset ID: {asset_id}[/green]")
 
                 # Create managed system
-                console.print(f"[dim]PWS: Creating managed system '{name}'...[/dim]")
+                err_console.print(f"[dim]PWS: Creating managed system '{name}'...[/dim]")
                 system = pws.create_managed_system(
                     system_name=name,
                     platform_id=platform,
@@ -295,7 +295,7 @@ def _onboard_single_host(
                     elevation_command=elevation,
                 )
                 system_id = system.get("ManagedSystemID")
-                console.print(f"  [green]Created managed system ID: {system_id}[/green]")
+                err_console.print(f"  [green]Created managed system ID: {system_id}[/green]")
 
                 result["pws"] = {
                     "created": True,
@@ -314,7 +314,7 @@ def _onboard_single_host(
                         account_password = generate_password()
                         generated_password = True
 
-                    console.print(f"[dim]PWS: Creating managed account '{account}'...[/dim]")
+                    err_console.print(f"[dim]PWS: Creating managed account '{account}'...[/dim]")
                     account_obj = pws.create_managed_account(
                         system_id=system_id,
                         account_name=account,
@@ -322,7 +322,7 @@ def _onboard_single_host(
                         auto_management_flag=True if functional_account else False,
                     )
                     account_id = account_obj.get("ManagedAccountID")
-                    console.print(f"  [green]Created managed account ID: {account_id}[/green]")
+                    err_console.print(f"  [green]Created managed account ID: {account_id}[/green]")
 
                     if generated_password:
                         console.print(f"  [yellow]Generated password (save this!):[/yellow] [bold]{account_password}[/bold]")
@@ -339,7 +339,7 @@ def _onboard_single_host(
             pra_user = pra_username or ("ec2-admin" if jump_type == "shell" else None)
 
             if jump_type == "shell":
-                console.print(f"[dim]PRA: Creating shell jump item '{name}'...[/dim]")
+                err_console.print(f"[dim]PRA: Creating shell jump item '{name}'...[/dim]")
                 jump_item = pra.create_shell_jump(
                     name=name,
                     hostname=ip,
@@ -350,9 +350,9 @@ def _onboard_single_host(
                     username=pra_user,
                 )
                 jump_id = jump_item.get("id")
-                console.print(f"  [green]Created shell jump ID: {jump_id}[/green]")
+                err_console.print(f"  [green]Created shell jump ID: {jump_id}[/green]")
             else:
-                console.print(f"[dim]PRA: Creating RDP jump item '{name}'...[/dim]")
+                err_console.print(f"[dim]PRA: Creating RDP jump item '{name}'...[/dim]")
                 jump_item = pra.create_rdp_jump(
                     name=name,
                     hostname=ip,
@@ -361,7 +361,7 @@ def _onboard_single_host(
                     rdp_port=port if port != 22 else 3389,
                 )
                 jump_id = jump_item.get("id")
-                console.print(f"  [green]Created RDP jump ID: {jump_id}[/green]")
+                err_console.print(f"  [green]Created RDP jump ID: {jump_id}[/green]")
 
             result["pra"] = {
                 "created": True,
@@ -489,7 +489,7 @@ def pasm_offboard(
                         else:
                             pws_asset_id = pws_system.get("AssetID")
             except Exception as e:
-                console.print(f"[yellow]PWS search error: {e}[/yellow]")
+                err_console.print(f"[yellow]PWS search error: {e}[/yellow]")
 
         # Search PRA
         if not skip_pra:
@@ -512,7 +512,7 @@ def pasm_offboard(
                             pra_jump_type = "rdp"
                             break
             except Exception as e:
-                console.print(f"[yellow]PRA search error: {e}[/yellow]")
+                err_console.print(f"[yellow]PRA search error: {e}[/yellow]")
 
         # Show what will be deleted
         console.print(f"\n[bold]Will delete '{name}':[/bold]")
@@ -541,7 +541,7 @@ def pasm_offboard(
 
         # Confirm
         if not force:
-            confirm = typer.confirm("\nProceed with deletion?")
+            confirm = typer.confirm("\nProceed with deletion?", err=True)
             if not confirm:
                 console.print("[yellow]Cancelled.[/yellow]")
                 raise typer.Exit(0)
@@ -557,21 +557,21 @@ def pasm_offboard(
                 for acc in pws_accounts:
                     acc_id = acc.get("ManagedAccountID", acc.get("AccountId"))
                     acc_name = acc.get("AccountName")
-                    console.print(f"[dim]PWS: Deleting account {acc_name}...[/dim]")
+                    err_console.print(f"[dim]PWS: Deleting account {acc_name}...[/dim]")
                     pws.delete_managed_account(acc_id)
                     deleted_accounts.append({"id": acc_id, "name": acc_name})
-                    console.print(f"  [green]Deleted account: {acc_name}[/green]")
+                    err_console.print(f"  [green]Deleted account: {acc_name}[/green]")
 
                 # Delete system
-                console.print(f"[dim]PWS: Deleting system {pws_system.get('SystemName')}...[/dim]")
+                err_console.print(f"[dim]PWS: Deleting system {pws_system.get('SystemName')}...[/dim]")
                 pws.delete_managed_system(system_id)
-                console.print(f"  [green]Deleted system: {pws_system.get('SystemName')}[/green]")
+                err_console.print(f"  [green]Deleted system: {pws_system.get('SystemName')}[/green]")
 
                 # Delete asset
                 if pws_asset_id:
-                    console.print(f"[dim]PWS: Deleting asset {pws_asset_id}...[/dim]")
+                    err_console.print(f"[dim]PWS: Deleting asset {pws_asset_id}...[/dim]")
                     pws.delete_asset(pws_asset_id)
-                    console.print(f"  [green]Deleted asset ID: {pws_asset_id}[/green]")
+                    err_console.print(f"  [green]Deleted asset ID: {pws_asset_id}[/green]")
 
                 result["pws"] = {
                     "deleted": True,
@@ -585,12 +585,12 @@ def pasm_offboard(
             pra = get_pra_client()
             jump_id = pra_jump.get("id")
 
-            console.print(f"[dim]PRA: Deleting {pra_jump_type} jump item {pra_jump.get('name')}...[/dim]")
+            err_console.print(f"[dim]PRA: Deleting {pra_jump_type} jump item {pra_jump.get('name')}...[/dim]")
             if pra_jump_type == "shell":
                 pra.delete_shell_jump(jump_id)
             else:
                 pra.delete_rdp_jump(jump_id)
-            console.print(f"  [green]Deleted {pra_jump_type} jump: {pra_jump.get('name')}[/green]")
+            err_console.print(f"  [green]Deleted {pra_jump_type} jump: {pra_jump.get('name')}[/green]")
 
             result["pra"] = {
                 "deleted": True,
@@ -650,7 +650,7 @@ def pasm_search(
         try:
             with get_pws_client() as pws:
                 pws.authenticate()
-                console.print(f"[dim]Searching PWS for '{query}'...[/dim]")
+                err_console.print(f"[dim]Searching PWS for '{query}'...[/dim]")
 
                 systems = pws.list_managed_systems()
                 result["pws"]["systems"] = [
@@ -661,12 +661,12 @@ def pasm_search(
                 accounts = pws.list_managed_accounts(account_name=query)
                 result["pws"]["accounts"] = accounts[:20]
         except Exception as e:
-            console.print(f"[yellow]PWS search error: {e}[/yellow]")
+            err_console.print(f"[yellow]PWS search error: {e}[/yellow]")
 
         # Search PRA
         try:
             pra = get_pra_client()
-            console.print(f"[dim]Searching PRA for '{query}'...[/dim]")
+            err_console.print(f"[dim]Searching PRA for '{query}'...[/dim]")
 
             shell_jumps = pra.list_shell_jumps()
             result["pra"]["shell_jumps"] = [
@@ -682,7 +682,7 @@ def pasm_search(
                 or query_lower in j.get("hostname", "").lower()
             ][:20]
         except Exception as e:
-            console.print(f"[yellow]PRA search error: {e}[/yellow]")
+            err_console.print(f"[yellow]PRA search error: {e}[/yellow]")
 
         if output == "json":
             console.print_json(json.dumps(result, default=str))