claude-mpm 5.4.41__py3-none-any.whl → 5.6.72__py3-none-any.whl

claude_mpm/auth/token_storage.py

@@ -0,0 +1,252 @@
+"""Secure OAuth token storage with Fernet encryption and keyring.
+
+This module provides encrypted persistence for OAuth tokens, using
+the system keyring for encryption key storage and Fernet symmetric
+encryption for the actual token data.
+
+Security Features:
+    - Encryption keys stored in system keyring (not on disk)
+    - Fernet symmetric encryption for token data
+    - File permissions restricted to owner only (600)
+    - Credentials stored in user-specific directory
+"""
+
+import json
+import stat
+from pathlib import Path
+from typing import Optional
+
+import keyring
+from cryptography.fernet import Fernet, InvalidToken
+
+from claude_mpm.auth.models import OAuthToken, StoredToken, TokenMetadata, TokenStatus
+
+# Keyring service identifier for encryption keys
+KEYRING_SERVICE = "claude-mpm-oauth"
+
+# Default credentials directory
+CREDENTIALS_DIR = Path.home() / ".claude-mpm" / "credentials"
+
+
+class TokenStorage:
+    """Secure storage for OAuth tokens using Fernet encryption.
+
+    Tokens are encrypted using Fernet symmetric encryption with keys
+    stored securely in the system keyring. Token files are stored
+    with restricted permissions (600) in the credentials directory.
+
+    Attributes:
+        credentials_dir: Directory where encrypted tokens are stored.
+
+    Example:
+        ```python
+        storage = TokenStorage()
+
+        # Store a token
+        token = OAuthToken(
+            access_token="abc123",
+            expires_at=datetime.now(timezone.utc) + timedelta(hours=1),
+            scopes=["read", "write"]
+        )
+        metadata = TokenMetadata(service_name="github-mcp", provider="github")
+        storage.store("github-mcp", token, metadata)
+
+        # Retrieve the token
+        stored = storage.retrieve("github-mcp")
+        if stored:
+            print(f"Token expires at: {stored.token.expires_at}")
+        ```
+    """
+
+    def __init__(self, credentials_dir: Optional[Path] = None) -> None:
+        """Initialize token storage.
+
+        Args:
+            credentials_dir: Custom directory for storing encrypted tokens.
+                Defaults to ~/.claude-mpm/credentials/
+        """
+        self.credentials_dir = credentials_dir or CREDENTIALS_DIR
+        self._ensure_credentials_dir()
+
+    def _ensure_credentials_dir(self) -> None:
+        """Create credentials directory with secure permissions if needed."""
+        if not self.credentials_dir.exists():
+            self.credentials_dir.mkdir(parents=True, mode=0o700)
+        else:
+            # Ensure directory has correct permissions
+            self.credentials_dir.chmod(0o700)
+
+    def _get_encryption_key(self, service_name: str) -> bytes:
+        """Get or create the Fernet encryption key for a service.
+
+        Keys are stored in the system keyring, not on disk.
+
+        Args:
+            service_name: Name of the service to get/create key for.
+
+        Returns:
+            Fernet encryption key as bytes.
+        """
+        key_name = f"{service_name}-key"
+        existing_key = keyring.get_password(KEYRING_SERVICE, key_name)
+
+        if existing_key:
+            return existing_key.encode()
+
+        # Generate new key and store in keyring
+        new_key = Fernet.generate_key()
+        keyring.set_password(KEYRING_SERVICE, key_name, new_key.decode())
+        return new_key
+
+    def _delete_encryption_key(self, service_name: str) -> None:
+        """Delete the encryption key for a service from keyring.
+
+        Args:
+            service_name: Name of the service to delete key for.
+        """
+        key_name = f"{service_name}-key"
+        try:
+            keyring.delete_password(KEYRING_SERVICE, key_name)
+        except keyring.errors.PasswordDeleteError:
+            pass  # Key doesn't exist, nothing to delete
+
+    def _get_token_path(self, service_name: str) -> Path:
+        """Get the file path for a service's encrypted token.
+
+        Args:
+            service_name: Name of the service.
+
+        Returns:
+            Path to the encrypted token file.
+        """
+        # Sanitize service name for filesystem
+        safe_name = "".join(
+            c if c.isalnum() or c in "-_" else "_" for c in service_name
+        )
+        return self.credentials_dir / f"{safe_name}.enc"
+
+    def store(
+        self,
+        service_name: str,
+        token: OAuthToken,
+        metadata: TokenMetadata,
+    ) -> None:
+        """Store an OAuth token securely.
+
+        The token is encrypted using Fernet symmetric encryption with
+        a key stored in the system keyring. The encrypted data is
+        written to a file with 600 permissions.
+
+        Args:
+            service_name: Unique identifier for the service.
+            token: OAuth token data to store.
+            metadata: Token metadata including provider info.
+        """
+        stored_token = StoredToken(
+            version=1,
+            metadata=metadata,
+            token=token,
+        )
+
+        # Serialize to JSON
+        token_json = stored_token.model_dump_json()
+
+        # Encrypt the token data
+        key = self._get_encryption_key(service_name)
+        fernet = Fernet(key)
+        encrypted_data = fernet.encrypt(token_json.encode())
+
+        # Write encrypted data with secure permissions
+        token_path = self._get_token_path(service_name)
+        token_path.write_bytes(encrypted_data)
+
+        # Set file permissions to owner read/write only (600)
+        token_path.chmod(stat.S_IRUSR | stat.S_IWUSR)
+
+    def retrieve(self, service_name: str) -> Optional[StoredToken]:
+        """Retrieve a stored OAuth token.
+
+        Args:
+            service_name: Unique identifier for the service.
+
+        Returns:
+            StoredToken if found and valid, None otherwise.
+        """
+        token_path = self._get_token_path(service_name)
+
+        if not token_path.exists():
+            return None
+
+        try:
+            # Read encrypted data
+            encrypted_data = token_path.read_bytes()
+
+            # Decrypt
+            key = self._get_encryption_key(service_name)
+            fernet = Fernet(key)
+            decrypted_data = fernet.decrypt(encrypted_data)
+
+            # Deserialize
+            return StoredToken.model_validate_json(decrypted_data)
+
+        except (InvalidToken, json.JSONDecodeError, ValueError):
+            # Token is corrupted or invalid
+            return None
+
+    def delete(self, service_name: str) -> bool:
+        """Delete a stored token and its encryption key.
+
+        Args:
+            service_name: Unique identifier for the service.
+
+        Returns:
+            True if token was deleted, False if it didn't exist.
+        """
+        token_path = self._get_token_path(service_name)
+
+        if not token_path.exists():
+            return False
+
+        # Delete the token file
+        token_path.unlink()
+
+        # Delete the encryption key from keyring
+        self._delete_encryption_key(service_name)
+
+        return True
+
+    def list_services(self) -> list[str]:
+        """List all services with stored tokens.
+
+        Returns:
+            List of service names that have stored tokens.
+        """
+        services = []
+        for path in self.credentials_dir.glob("*.enc"):
+            # Extract service name from filename
+            service_name = path.stem
+            services.append(service_name)
+        return sorted(services)
+
+    def get_status(self, service_name: str) -> TokenStatus:
+        """Get the status of a stored token.
+
+        Args:
+            service_name: Unique identifier for the service.
+
+        Returns:
+            TokenStatus indicating the token's current state.
+        """
+        stored = self.retrieve(service_name)
+
+        if stored is None:
+            token_path = self._get_token_path(service_name)
+            if token_path.exists():
+                # File exists but couldn't be decrypted
+                return TokenStatus.INVALID
+            return TokenStatus.MISSING
+
+        if stored.token.is_expired():
+            return TokenStatus.EXPIRED
+
+        return TokenStatus.VALID

claude_mpm/cli/__init__.py

@@ -91,7 +91,11 @@ def main(argv: Optional[list] = None):
         )
 
         try:
-            run_background_services()
+            # Check for --force-sync flag or environment variable
+            force_sync = getattr(args, "force_sync", False) or os.environ.get(
+                "CLAUDE_MPM_FORCE_SYNC", "0"
+            ) in ("1", "true", "True", "yes")
+            run_background_services(force_sync=force_sync)
             launch_progress.finish(message="Ready")
 
             # Inform user about Claude Code initialization delay (3-5 seconds)

claude_mpm/cli/commands/agents.py

@@ -1379,7 +1379,7 @@ class AgentsCommand(AgentCommand):
                 return CommandResult.error_result("agent_id is required")
 
             import os
-            import subprocess
+            import subprocess  # nosec B404
 
             from ...services.agents.local_template_manager import (
                 LocalAgentTemplateManager,
@@ -1415,7 +1415,7 @@ class AgentsCommand(AgentCommand):
 
             # Use system editor
             editor = getattr(args, "editor", None) or os.environ.get("EDITOR", "nano")
-            subprocess.run([editor, str(template_file)], check=True)
+            subprocess.run([editor, str(template_file)], check=True)  # nosec B603
             return CommandResult.success_result(
                 f"Agent '{agent_id}' edited successfully"
             )
@@ -1519,8 +1519,6 @@ class AgentsCommand(AgentCommand):
             console.print("For a better experience with integrated configuration:")
             console.print("  • Agent management")
             console.print("  • Skills management")
-            console.print("  • Template editing")
-            console.print("  • Behavior configuration")
             console.print("  • Startup settings\n")
 
             console.print("Please use: [bold green]claude-mpm config[/bold green]\n")

claude_mpm/cli/commands/agents_reconcile.py

@@ -0,0 +1,197 @@
+"""
+Agent/Skill Reconciliation CLI Command
+
+Shows the reconciliation view between configured and deployed agents/skills,
+and performs reconciliation (deploy missing, remove unneeded).
+
+Usage:
+    claude-mpm agents reconcile [--dry-run] [--show-only]
+    claude-mpm skills reconcile [--dry-run] [--show-only]
+"""
+
+from pathlib import Path
+
+from rich.console import Console
+from rich.table import Table
+
+from ...core.unified_config import UnifiedConfig
+from ...services.agents.deployment.deployment_reconciler import (
+    DeploymentReconciler,
+    ReconciliationState,
+)
+from ..shared import BaseCommand, CommandResult
+
+
+class AgentsReconcileCommand(BaseCommand):
+    """CLI command for agent reconciliation."""
+
+    def __init__(self):
+        super().__init__("agents-reconcile")
+        self.console = Console()
+
+    def run(self, args) -> CommandResult:
+        """Execute reconciliation."""
+        # Load config
+        config = UnifiedConfig()
+        reconciler = DeploymentReconciler(config)
+
+        # Get project path
+        project_path = Path(getattr(args, "project_path", "."))
+
+        # Show current state
+        if getattr(args, "show_only", False) or getattr(args, "dry_run", False):
+            return self._show_reconciliation_view(reconciler, project_path)
+
+        # Perform reconciliation
+        return self._reconcile_agents(reconciler, project_path)
+
+    def _show_reconciliation_view(
+        self, reconciler: DeploymentReconciler, project_path: Path
+    ) -> CommandResult:
+        """Show reconciliation view without making changes."""
+        view = reconciler.get_reconciliation_view(project_path)
+        agent_state = view["agents"]
+        skill_state = view["skills"]
+
+        # Display agents table
+        self.console.print(
+            "\n[bold blue]═══ Agent Reconciliation View ═══[/bold blue]\n"
+        )
+        agent_table = self._build_reconciliation_table(agent_state, "Agent")
+        self.console.print(agent_table)
+
+        # Display skills table
+        self.console.print(
+            "\n[bold blue]═══ Skill Reconciliation View ═══[/bold blue]\n"
+        )
+        skill_table = self._build_reconciliation_table(skill_state, "Skill")
+        self.console.print(skill_table)
+
+        # Show summary
+        self._show_summary(agent_state, skill_state)
+
+        return CommandResult.success_result("Reconciliation view displayed")
+
+    def _build_reconciliation_table(
+        self, state: ReconciliationState, item_type: str
+    ) -> Table:
+        """Build Rich table for reconciliation state."""
+        table = Table(title=f"{item_type} Deployment Status")
+
+        table.add_column(f"{item_type}", style="cyan", no_wrap=True)
+        table.add_column("Configured", style="green")
+        table.add_column("Deployed", style="yellow")
+        table.add_column("Action", style="magenta")
+
+        # All items to consider
+        all_items = state.configured | state.deployed | state.cached
+
+        for item_id in sorted(all_items):
+            configured = "✓" if item_id in state.configured else "✗"
+            deployed = "✓" if item_id in state.deployed else "✗"
+
+            # Determine action
+            if item_id in state.to_deploy:
+                if item_id in state.cached:
+                    action = "Will deploy"
+                else:
+                    action = "[red]Missing in cache![/red]"
+            elif item_id in state.to_remove:
+                action = "Will remove"
+            elif item_id in state.unchanged:
+                action = "-"
+            elif item_id in state.cached and item_id not in state.configured:
+                action = "[dim]Available (not configured)[/dim]"
+            else:
+                action = "-"
+
+            table.add_row(item_id, configured, deployed, action)
+
+        return table
+
+    def _show_summary(
+        self, agent_state: ReconciliationState, skill_state: ReconciliationState
+    ) -> None:
+        """Show reconciliation summary."""
+        self.console.print("\n[bold]Summary:[/bold]")
+
+        # Agents
+        self.console.print("\nAgents:")
+        self.console.print(f"  Configured: {len(agent_state.configured)}")
+        self.console.print(f"  Deployed: {len(agent_state.deployed)}")
+        self.console.print(f"  To deploy: {len(agent_state.to_deploy)}")
+        self.console.print(f"  To remove: {len(agent_state.to_remove)}")
+        self.console.print(f"  Unchanged: {len(agent_state.unchanged)}")
+
+        # Skills
+        self.console.print("\nSkills:")
+        self.console.print(f"  Configured: {len(skill_state.configured)}")
+        self.console.print(f"  Deployed: {len(skill_state.deployed)}")
+        self.console.print(f"  To deploy: {len(skill_state.to_deploy)}")
+        self.console.print(f"  To remove: {len(skill_state.to_remove)}")
+        self.console.print(f"  Unchanged: {len(skill_state.unchanged)}")
+
+        # Show next steps
+        if agent_state.to_deploy or skill_state.to_deploy:
+            self.console.print(
+                "\n[yellow]Run without --show-only to perform deployment[/yellow]"
+            )
+
+    def _reconcile_agents(
+        self, reconciler: DeploymentReconciler, project_path: Path
+    ) -> CommandResult:
+        """Perform agent and skill reconciliation."""
+        # Show current state first
+        self._show_reconciliation_view(reconciler, project_path)
+
+        self.console.print("\n[bold blue]Performing reconciliation...[/bold blue]\n")
+
+        # Reconcile agents
+        self.console.print("[cyan]Reconciling agents...[/cyan]")
+        agent_result = reconciler.reconcile_agents(project_path)
+
+        if agent_result.deployed:
+            self.console.print(
+                f"  [green]✓ Deployed: {', '.join(agent_result.deployed)}[/green]"
+            )
+        if agent_result.removed:
+            self.console.print(
+                f"  [yellow]✓ Removed: {', '.join(agent_result.removed)}[/yellow]"
+            )
+        if agent_result.errors:
+            for error in agent_result.errors:
+                self.console.print(f"  [red]✗ {error}[/red]")
+
+        # Reconcile skills
+        self.console.print("\n[cyan]Reconciling skills...[/cyan]")
+        skill_result = reconciler.reconcile_skills(project_path)
+
+        if skill_result.deployed:
+            self.console.print(
+                f"  [green]✓ Deployed: {', '.join(skill_result.deployed)}[/green]"
+            )
+        if skill_result.removed:
+            self.console.print(
+                f"  [yellow]✓ Removed: {', '.join(skill_result.removed)}[/yellow]"
+            )
+        if skill_result.errors:
+            for error in skill_result.errors:
+                self.console.print(f"  [red]✗ {error}[/red]")
+
+        # Final summary
+        total_errors = len(agent_result.errors) + len(skill_result.errors)
+        if total_errors == 0:
+            self.console.print("\n[bold green]✓ Reconciliation complete![/bold green]")
+            return CommandResult.success_result("Reconciliation successful")
+        self.console.print(
+            f"\n[bold yellow]⚠ Reconciliation complete with {total_errors} errors[/bold yellow]"
+        )
+        return CommandResult.error_result(f"Reconciliation had {total_errors} errors")
+
+
+class SkillsReconcileCommand(AgentsReconcileCommand):
+    """CLI command for skill reconciliation (alias to agents reconcile)."""
+
+    def __init__(self):
+        BaseCommand.__init__(self, "skills-reconcile")
+        self.console = Console()