cloudsmith-cli 1.17.0__tar.gz → 1.18.0__tar.gz

{cloudsmith_cli-1.17.0/cloudsmith_cli.egg-info → cloudsmith_cli-1.18.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloudsmith-cli
-Version: 1.17.0
+Version: 1.18.0
 Summary: Cloudsmith Command-Line Interface (CLI)
 Home-page: https://github.com/cloudsmith-io/cloudsmith-cli
 Author: Cloudsmith Ltd
@@ -34,12 +34,17 @@ Requires-Dist: json5>=0.9.0
 Requires-Dist: cloudsmith-api<3.0,>=2.0.25
 Requires-Dist: keyring>=25.4.1
 Requires-Dist: mcp==1.9.1
+Requires-Dist: PyJWT>=2.0.0
 Requires-Dist: python-toon==0.1.2
 Requires-Dist: requests>=2.18.4
 Requires-Dist: requests_toolbelt>=1.0.0
 Requires-Dist: rich>=13.0.0
 Requires-Dist: semver>=2.7.9
 Requires-Dist: urllib3>=2.5
+Provides-Extra: aws
+Requires-Dist: boto3[crt]>=1.26.0; extra == "aws"
+Provides-Extra: all
+Requires-Dist: boto3[crt]>=1.26.0; extra == "all"
 Dynamic: author
 Dynamic: author-email
 Dynamic: classifier
@@ -50,6 +55,7 @@ Dynamic: keywords
 Dynamic: license
 Dynamic: license-file
 Dynamic: platform
+Dynamic: provides-extra
 Dynamic: requires-dist
 Dynamic: requires-python
 Dynamic: summary
@@ -197,6 +203,30 @@ Or you can get the latest pre-release version from Cloudsmith:
 pip install --upgrade cloudsmith-cli --extra-index-url=https://dl.cloudsmith.io/public/cloudsmith/cli/python/index/
 ```
 
+### Optional Dependencies
+
+The CLI supports optional extras for additional functionality:
+
+#### AWS OIDC Support
+
+For AWS environments (ECS, EKS, EC2), install with `aws` extra to enable automatic credential discovery:
+
+```
+pip install cloudsmith-cli[aws]
+```
+
+This installs `boto3[crt]` for AWS credential chain support, STS token generation, and AWS SSO compatibility.
+
+#### All Optional Features
+
+To install all optional dependencies:
+
+```
+pip install cloudsmith-cli[all]
+```
+
+**Note:** If you don't install the AWS extra, the AWS OIDC detector will gracefully skip itself with no errors.
+
 ## Configuration
 
 There are two configuration files used by the CLI:

{cloudsmith_cli-1.17.0 → cloudsmith_cli-1.18.0}/README.md

@@ -141,6 +141,30 @@ Or you can get the latest pre-release version from Cloudsmith:
 pip install --upgrade cloudsmith-cli --extra-index-url=https://dl.cloudsmith.io/public/cloudsmith/cli/python/index/
 ```
 
+### Optional Dependencies
+
+The CLI supports optional extras for additional functionality:
+
+#### AWS OIDC Support
+
+For AWS environments (ECS, EKS, EC2), install with `aws` extra to enable automatic credential discovery:
+
+```
+pip install cloudsmith-cli[aws]
+```
+
+This installs `boto3[crt]` for AWS credential chain support, STS token generation, and AWS SSO compatibility.
+
+#### All Optional Features
+
+To install all optional dependencies:
+
+```
+pip install cloudsmith-cli[all]
+```
+
+**Note:** If you don't install the AWS extra, the AWS OIDC detector will gracefully skip itself with no errors.
+
 ## Configuration
 
 There are two configuration files used by the CLI:

{cloudsmith_cli-1.17.0 → cloudsmith_cli-1.18.0}/cloudsmith_cli/cli/commands/mcp.py

@@ -4,6 +4,7 @@ import json
 import os
 import shutil
 import sys
+import tempfile
 from pathlib import Path
 
 import click
@@ -16,6 +17,7 @@ from .main import main
 
 SUPPORTED_MCP_CLIENTS = {
     "claude": "Claude Desktop",
+    "claude-code": "Claude Code",
     "cursor": "Cursor IDE",
     "vscode": "VS Code",
     "gemini-cli": "Gemini CLI",
@@ -196,12 +198,17 @@ def configure(ctx, opts, client, is_global):  # pylint: disable=unused-argument
     This command automatically adds the Cloudsmith MCP server configuration
     to the specified client's configuration file. Supported clients are:
     - Claude Desktop
+    - Claude Code
     - Cursor IDE
     - VS Code (GitHub Copilot)
     - Gemini CLI
 
+    For Claude Code, --global edits ~/.claude.json (user scope) and
+    --local writes ./.mcp.json (project scope, intended to be committed).
+
     Examples:\n
         cloudsmith mcp configure --client claude\n
+        cloudsmith mcp configure --client claude-code\n
         cloudsmith mcp configure --client cursor --local\n
         cloudsmith mcp configure --client gemini-cli\n
         cloudsmith mcp configure  # Auto-detect and configure all
@@ -315,10 +322,16 @@ def _get_server_config(profile=None):
 def detect_available_clients():
     """Detect which MCP clients are available on the system."""
     available = []
+    home = Path.home()
 
     for client in SUPPORTED_MCP_CLIENTS:
         config = get_config_path(client, is_global=True)
-        if config and config.parent.exists():
+        if not config:
+            continue
+        # Parent-dir existence is the usual "app installed" marker, but a
+        # parent of $HOME (Claude Code) tells us nothing; require the file
+        # itself in that case.
+        if config.exists() or (config.parent.exists() and config.parent != home):
             available.append(client)
 
     return available
@@ -344,6 +357,10 @@ def get_config_path(client_name, is_global=True):
             ),
             "linux": home / ".config" / "Claude" / "claude_desktop_config.json",
         },
+        "claude-code": {
+            "global": home / ".claude.json",
+            "local": Path.cwd() / ".mcp.json",
+        },
         "cursor": {
             "global": home / ".cursor" / "mcp.json",
             "local": Path.cwd() / ".cursor" / "mcp.json",
@@ -369,8 +386,8 @@ def get_config_path(client_name, is_global=True):
 
     client_config = config_paths.get(client_name, {})
 
-    # For Cursor and Gemini CLI, use global/local scope instead of platform
-    if client_name in ("cursor", "gemini-cli"):
+    # For scope-keyed (not platform-keyed) clients, look up by global/local.
+    if client_name in ("claude-code", "cursor", "gemini-cli"):
         scope = "global" if is_global else "local"
         return client_config.get(scope)
 
@@ -385,47 +402,119 @@ def get_config_path(client_name, is_global=True):
 
 def configure_client(client_name, server_config, is_global=True, profile=None):
     """Configure a specific MCP client with the Cloudsmith server."""
-    config_path = get_config_path(client_name, is_global)
+    server_name = f"cloudsmith-{profile}" if profile else "cloudsmith"
+
+    if client_name == "claude-code":
+        return _configure_claude_code(server_name, server_config, is_global)
 
+    config_path = get_config_path(client_name, is_global)
     if not config_path:
         return False
 
-    # Ensure parent directory exists
-    config_path.parent.mkdir(parents=True, exist_ok=True)
+    key = "chat.mcp.servers" if client_name == "vscode" else "mcpServers"
 
-    # Read existing config or create new one
-    config = {}
-    if config_path.exists():
-        with open(config_path) as f:
-            content = f.read()
-        try:
-            # Use json5 first as it handles both standard JSON and JSONC
-            # (comments, trailing commas) which VS Code settings.json may contain
-            config = json5.loads(content)
-        except (json.JSONDecodeError, ValueError) as e:
-            raise ValueError(
-                f"Cannot parse config file '{config_path}': {e}. "
-                f"Please fix the JSON syntax or remove the file to create a new one."
-            ) from e
-
-    # Determine server name based on profile
-    server_name = f"cloudsmith-{profile}" if profile else "cloudsmith"
+    def mutate(config):
+        config.setdefault(key, {})[server_name] = server_config
+
+    _safe_update_json(config_path, mutate)
+    return True
 
-    # Add Cloudsmith MCP server based on client format
-    if client_name in {"claude", "cursor", "gemini-cli"}:
-        if "mcpServers" not in config:
-            config["mcpServers"] = {}
-        config["mcpServers"][server_name] = server_config
 
-    elif client_name == "vscode":
-        # VS Code uses a different format in settings.json
-        if "chat.mcp.servers" not in config:
-            config["chat.mcp.servers"] = {}
-        config["chat.mcp.servers"][server_name] = server_config
+def _configure_claude_code(server_name, server_config, is_global):
+    """Register the Cloudsmith MCP server with Claude Code.
+
+    Why direct edit (not `claude mcp add-json`): avoids requiring the Claude
+    Code CLI on PATH. _safe_update_json handles the race with a running
+    Claude Code session writing to ~/.claude.json.
+    """
+    path = get_config_path("claude-code", is_global=is_global)
+    if is_global and not path.exists():
+        raise ValueError(
+            f"{path} not found. Launch Claude Code at least once, "
+            "then re-run this command."
+        )
 
-    # Write updated config
-    with open(config_path, "w") as f:
-        # As we are using json5 to read, we write standard JSON back, which removes existing user JSON comments in the files (currently only present in VS Code settings.json).
-        json.dump(config, f, indent=2)
+    def mutate(config):
+        config.setdefault("mcpServers", {})[server_name] = server_config
 
+    _safe_update_json(path, mutate)
     return True
+
+
+def _atomic_write_json(path: Path, data) -> None:
+    """Write JSON to ``path`` atomically via a tempfile + os.replace.
+
+    Preserves the destination's existing file mode when present.
+
+    Follows symlinks before writing so dotfile-managed configs (a symlinked
+    ~/.claude.json, settings.json, etc.) update through to the real file
+    rather than getting the link replaced.
+    """
+    if path.is_symlink():
+        path = Path(os.path.realpath(path))
+
+    path.parent.mkdir(parents=True, exist_ok=True)
+    existing_mode = path.stat().st_mode & 0o777 if path.exists() else None
+
+    tmp = tempfile.NamedTemporaryFile(
+        mode="w",
+        dir=path.parent,
+        prefix=f".{path.name}.",
+        suffix=".tmp",
+        delete=False,
+    )
+    tmp_path = Path(tmp.name)
+    try:
+        with tmp as f:
+            # json5 is used for reading; we write standard JSON, which drops
+            # any user comments (currently only relevant for VS Code's JSONC).
+            json.dump(data, f, indent=2)
+            f.flush()
+            os.fsync(f.fileno())
+        if existing_mode is not None:
+            os.chmod(tmp_path, existing_mode)
+        os.replace(tmp_path, path)
+    except BaseException:
+        try:
+            tmp_path.unlink()
+        except FileNotFoundError:
+            pass
+        raise
+
+
+def _safe_update_json(path: Path, mutate, *, max_retries: int = 3) -> None:
+    """Read JSON at ``path``, apply ``mutate(dict)``, atomic-write back.
+
+    Retries on mtime change between read and replace -- guards against a
+    concurrent writer (e.g. a running Claude Code session updating
+    ~/.claude.json, or VS Code editing settings.json) clobbering deltas.
+    """
+    for _ in range(max_retries):
+        if path.exists():
+            mtime_before = path.stat().st_mtime_ns
+            with open(path) as f:
+                content = f.read()
+            try:
+                config = json5.loads(content)
+            except (json.JSONDecodeError, ValueError) as e:
+                raise ValueError(
+                    f"Cannot parse config file '{path}': {e}. "
+                    "Please fix the JSON syntax or remove the file to "
+                    "create a new one."
+                ) from e
+        else:
+            mtime_before = None
+            config = {}
+
+        mutate(config)
+
+        if mtime_before is not None and path.stat().st_mtime_ns != mtime_before:
+            continue
+
+        _atomic_write_json(path, config)
+        return
+
+    raise ValueError(
+        f"Could not safely update {path}: another process keeps modifying "
+        "it. Close the consuming app and retry."
+    )

{cloudsmith_cli-1.17.0 → cloudsmith_cli-1.18.0}/cloudsmith_cli/cli/commands/metadata.py

@@ -9,8 +9,6 @@ from ...core.api.metadata import (
     delete_metadata as api_delete_metadata,
     get_metadata as api_get_metadata,
     list_metadata as api_list_metadata,
-    normalise_classification,
-    normalise_source_kind,
     update_metadata as api_update_metadata,
 )
 from ...core.api.packages import get_package_slug_perm as api_get_package_slug_perm
@@ -121,9 +119,8 @@ def metadata_(ctx, opts):  # pylint: disable=unused-argument
     "source_kind",
     default=None,
     help=(
-        "Filter by source kind. Accepts an integer or name "
-        "(for example, 'customer' or 'third_party'). Ignored when "
-        "METADATA_SLUG_PERM is given."
+        "Filter by source kind name (one of: unknown, system, upstream, "
+        "custom, third_party). Ignored when METADATA_SLUG_PERM is given."
     ),
 )
 @click.option(
@@ -131,9 +128,8 @@ def metadata_(ctx, opts):  # pylint: disable=unused-argument
     "classification",
     default=None,
     help=(
-        "Filter by classification. Accepts an integer or name "
-        "(for example, 'provenance' or 'sbom'). Ignored when "
-        "METADATA_SLUG_PERM is given."
+        "Filter by classification name (one of: unknown, intrinsic, security, "
+        "provenance, sbom, generic). Ignored when METADATA_SLUG_PERM is given."
     ),
 )
 @click.pass_context
@@ -187,14 +183,6 @@ def list_metadata(
         _print_metadata_entry(opts, entry)
         return
 
-    # Validate filter values up-front for a friendlier error than what the
-    # API would return (the normalisers raise ValueError on invalid values).
-    try:
-        normalise_source_kind(source_kind)
-        normalise_classification(classification)
-    except ValueError as exc:
-        raise click.UsageError(str(exc)) from exc
-
     _echo_action(
         "Listing metadata for %(package)s ... "
         % {"package": click.style(package, bold=True)},

{cloudsmith_cli-1.17.0 → cloudsmith_cli-1.18.0}/cloudsmith_cli/cli/commands/whoami.py

@@ -1,14 +1,11 @@
 """CLI/Commands - Retrieve authentication status."""
 
-import os
-
 import click
 
 from ...core import keyring
 from ...core.api.exceptions import ApiException
 from ...core.api.user import get_token_metadata, get_user_brief
 from .. import decorators, utils
-from ..config import CredentialsReader
 from ..exceptions import handle_api_exceptions
 from .main import main
 
@@ -26,26 +23,17 @@ def _get_active_method(api_config):
 def _get_api_key_source(opts):
     """Determine where the API key was loaded from.
 
-    Checks in priority order matching actual resolution:
-    CLI --api-key flag > CLOUDSMITH_API_KEY env var > credentials.ini.
+    Uses the credential provider chain result attached by initialise_api.
     """
-    if not opts.api_key:
-        return {"configured": False, "source": None, "source_key": None}
-
-    env_key = os.environ.get("CLOUDSMITH_API_KEY")
-
-    # If env var is set but differs from the resolved key, CLI flag won
-    if env_key and opts.api_key != env_key:
-        source, key = "CLI --api-key flag", "cli_flag"
-    elif env_key:
-        suffix = env_key[-4:]
-        source, key = f"CLOUDSMITH_API_KEY env var (ends with ...{suffix})", "env_var"
-    elif creds := CredentialsReader.find_existing_files():
-        source, key = f"credentials.ini ({creds[0]})", "credentials_file"
-    else:
-        source, key = "CLI --api-key flag", "cli_flag"
+    credential = getattr(opts, "credential", None)
+    if credential and credential.auth_type == "api_key":
+        return {
+            "configured": True,
+            "source": credential.source_detail or credential.source_name,
+            "source_key": credential.source_name,
+        }
 
-    return {"configured": True, "source": source, "source_key": key}
+    return {"configured": False, "source": None, "source_key": None}
 
 
 def _get_sso_status(api_host):
@@ -120,7 +108,12 @@ def _print_verbose_text(data):
                 click.echo(f"  Source: {ak['source']}")
             click.echo("  Note: SSO token is being used instead")
     elif active == "api_key":
-        click.secho("Authentication Method: API Key", fg="cyan", bold=True)
+        if ak.get("source_key") == "oidc":
+            click.secho(
+                "Authentication Method: OIDC Auto-Discovery", fg="cyan", bold=True
+            )
+        else:
+            click.secho("Authentication Method: API Key", fg="cyan", bold=True)
         for label, field in [
             ("Source", "source"),
             ("Token Slug", "slug"),

{cloudsmith_cli-1.17.0 → cloudsmith_cli-1.18.0}/cloudsmith_cli/cli/config.py

@@ -66,6 +66,9 @@ class ConfigSchema:
         api_user_agent = ConfigParam(name="api_user_agent", type=str)
         mcp_allowed_tools = ConfigParam(name="mcp_allowed_tools", type=str)
         mcp_allowed_tool_groups = ConfigParam(name="mcp_allowed_tool_groups", type=str)
+        oidc_audience = ConfigParam(name="oidc_audience", type=str)
+        oidc_org = ConfigParam(name="oidc_org", type=str)
+        oidc_service_slug = ConfigParam(name="oidc_service_slug", type=str)
         metadata_failure_mode = ConfigParam(name="metadata_failure_mode", type=str)
 
     @matches_section("profile:*")
@@ -319,6 +322,33 @@ class Options:  # pylint: disable=too-many-public-methods
         """Set value for API key."""
         self._set_option("api_key", value)
 
+    @property
+    def api_key_from_flag(self):
+        """Get API key set explicitly via --api-key CLI flag."""
+        return self._get_option("api_key_from_flag")
+
+    @api_key_from_flag.setter
+    def api_key_from_flag(self, value):
+        self._set_option("api_key_from_flag", value, allow_clear=True)
+
+    @property
+    def api_key_from_env(self):
+        """Get API key from CLOUDSMITH_API_KEY environment variable."""
+        return self._get_option("api_key_from_env")
+
+    @api_key_from_env.setter
+    def api_key_from_env(self, value):
+        self._set_option("api_key_from_env", value, allow_clear=True)
+
+    @property
+    def api_key_from_file(self):
+        """Get API key loaded from credentials.ini."""
+        return self._get_option("api_key_from_file")
+
+    @api_key_from_file.setter
+    def api_key_from_file(self, value):
+        self._set_option("api_key_from_file", value, allow_clear=True)
+
     @property
     def api_proxy(self):
         """Get value for API proxy."""
@@ -417,6 +447,48 @@ class Options:  # pylint: disable=too-many-public-methods
 
         self._set_option("mcp_allowed_tool_groups", tool_groups)
 
+    @property
+    def oidc_audience(self):
+        """Get value for OIDC audience."""
+        return self._get_option("oidc_audience")
+
+    @oidc_audience.setter
+    def oidc_audience(self, value):
+        """Set value for OIDC audience."""
+        self._set_option("oidc_audience", value)
+
+    @property
+    def oidc_org(self):
+        """Get value for OIDC organisation slug."""
+        return self._get_option("oidc_org")
+
+    @oidc_org.setter
+    def oidc_org(self, value):
+        """Set value for OIDC organisation slug."""
+        self._set_option("oidc_org", value)
+
+    @property
+    def oidc_service_slug(self):
+        """Get value for OIDC service slug."""
+        return self._get_option("oidc_service_slug")
+
+    @oidc_service_slug.setter
+    def oidc_service_slug(self, value):
+        """Set value for OIDC service slug."""
+        self._set_option("oidc_service_slug", value)
+
+    @property
+    def oidc_discovery_disabled(self):
+        """Get value for OIDC discovery disabled flag."""
+        return self._get_option("oidc_discovery_disabled", default=False)
+
+    @oidc_discovery_disabled.setter
+    def oidc_discovery_disabled(self, value):
+        """Set value for OIDC discovery disabled flag."""
+        self._set_option(
+            "oidc_discovery_disabled", bool(value) if value is not None else False
+        )
+
     @property
     def metadata_failure_mode(self):
         """Get value for push-time metadata failure mode."""