cloudsmith-cli 1.24.0__tar.gz → 1.25.0__tar.gz

{cloudsmith_cli-1.24.0/cloudsmith_cli.egg-info → cloudsmith_cli-1.25.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloudsmith-cli
-Version: 1.24.0
+Version: 1.25.0
 Summary: Cloudsmith Command-Line Interface (CLI)
 Author-email: Cloudsmith Ltd <support@cloudsmith.io>
 License-Expression: Apache-2.0
@@ -28,7 +28,7 @@ Requires-Dist: click-configfile>=0.2.3
 Requires-Dist: click-didyoumean>=0.0.3
 Requires-Dist: click-spinner>=0.1.7
 Requires-Dist: json5>=0.9.0
-Requires-Dist: cloudsmith-api<3.0,>=2.0.29
+Requires-Dist: cloudsmith-api<3.0,>=2.0.31
 Requires-Dist: keyring>=25.4.1
 Requires-Dist: keyrings-alt>=5.0.2
 Requires-Dist: keyrings-cryptfile>=1.3.9

{cloudsmith_cli-1.24.0 → cloudsmith_cli-1.25.0}/cloudsmith_cli/cli/commands/credential_helper/__init__.py

@@ -12,6 +12,7 @@ from ..main import main
 from .docker import docker as docker_cmd
 from .generic import generic as generic_cmd
 from .manage import install_cmd, list_cmd, uninstall_cmd
+from .pnpm import pnpm as pnpm_cmd
 
 
 @click.group()
@@ -27,11 +28,18 @@ def credential_helper():
         # Install Docker credential helper
         $ cloudsmith credential-helper install docker
 
+        # Install pnpm credential helper
+        $ cloudsmith credential-helper install pnpm
+
         # Test Docker credential helper directly
         $ echo "docker.cloudsmith.io" | cloudsmith credential-helper docker
+
+        # Test pnpm credential helper directly
+        $ cloudsmith credential-helper pnpm npm.cloudsmith.io
     """
 
 
+credential_helper.add_command(pnpm_cmd, name="pnpm")
 credential_helper.add_command(docker_cmd, name="docker")
 credential_helper.add_command(generic_cmd, name="generic")
 credential_helper.add_command(install_cmd, name="install")

{cloudsmith_cli-1.24.0 → cloudsmith_cli-1.25.0}/cloudsmith_cli/cli/commands/credential_helper/manage.py

@@ -12,6 +12,9 @@ import sys
 
 import click
 
+from cloudsmith_cli.credential_helpers.generic import PartialInstallError
+from cloudsmith_cli.credential_helpers.pnpm.installer import PNPMInstaller
+
 from ....credential_helpers.docker.installer import DockerInstaller
 from ... import utils
 from ...decorators import (
@@ -27,6 +30,7 @@ from ...decorators import (
 
 _INSTALLERS: dict[str, type] = {
     "docker": DockerInstaller,
+    "pnpm": PNPMInstaller,
 }
 
 
@@ -40,7 +44,7 @@ def _get_installer(name: str):
 
     Returns
     -------
-    DockerInstaller
+    BaseInstaller
         An instance of the appropriate installer class.
 
     Raises
@@ -85,7 +89,7 @@ def _get_installer(name: str):
     "--no-discover",
     is_flag=True,
     default=False,
-    help="Disable automatic discovery of custom Docker domains.",
+    help="Disable automatic discovery of custom domains.",
 )
 @click.option(
     "--refresh",
@@ -110,25 +114,30 @@ def install_cmd(
 ) -> None:
     """Install a credential helper launcher and configure the package manager.
 
-    HELPER is the name of the credential helper to install (e.g. ``docker``).
+    HELPER is the name of the credential helper to install (e.g. ``docker``, ``pnpm``).
+
+    Important for pnpm: The tokenHelper directive is only honored in the
+    user-level ~/.npmrc file, not in a project-level .npmrc. This is a pnpm
+    security restriction. The absolute path to the launcher is automatically
+    calculated and configured.
 
     Examples:
 
     \b
-        # Install Docker credential helper
-        $ cloudsmith credential-helper install docker
+        # Install credential helper
+        $ cloudsmith credential-helper install HELPER
 
     \b
         # Install with a custom domain
-        $ cloudsmith credential-helper install docker --domain my.registry.example.com
+        $ cloudsmith credential-helper install HELPER --domain my.registry.example.com
 
     \b
         # Preview without making changes
-        $ cloudsmith credential-helper install docker --dry-run
+        $ cloudsmith credential-helper install HELPER --dry-run
 
     \b
         # Disable automatic custom-domain discovery
-        $ cloudsmith credential-helper install docker --no-discover
+        $ cloudsmith credential-helper install HELPER --no-discover
     """
     installer = _get_installer(helper)
     try:
@@ -146,6 +155,11 @@ def install_cmd(
         raise click.ClickException(
             f"Failed to install {helper!r} credential helper: {exc}"
         )
+    except PartialInstallError as exc:
+        actions = exc.actions
+        ec = exc.exit_code
+    else:
+        ec = 0
 
     use_stderr = utils.should_use_stderr(opts)
     warnings = [a for a in actions if a.startswith("WARNING")]
@@ -157,7 +171,7 @@ def install_cmd(
         "warnings": warnings,
     }
     if utils.maybe_print_as_json(opts, data):
-        return
+        sys.exit(ec)
 
     if dry_run:
         click.echo("Dry run — no changes will be made:", err=use_stderr)
@@ -165,6 +179,7 @@ def install_cmd(
         click.echo(f"  {action}" if dry_run else action, err=use_stderr)
     for warning in warnings:
         click.secho(f"  {warning}" if dry_run else warning, err=True, fg="yellow")
+    sys.exit(ec)
 
 
 # ---------------------------------------------------------------------------

cloudsmith_cli-1.25.0/cloudsmith_cli/cli/commands/credential_helper/pnpm.py

@@ -0,0 +1,51 @@
+# Copyright 2026 Cloudsmith Ltd
+"""
+pnpm credential helper command.
+
+Implements the pnpm credential helper protocol for Cloudsmith registries.
+"""
+
+import sys
+
+import click
+
+from ....credential_helpers.pnpm import execute
+from ...decorators import common_api_auth_options, resolve_credentials
+
+
+@click.command()
+@click.argument("repo", required=False, default="npm.cloudsmith.io")
+@common_api_auth_options
+@resolve_credentials
+def pnpm(opts, repo):
+    """
+    Input (arg, optional):
+        Server URL as plain text (e.g. "npm.cloudsmith.io")
+
+    Output (stdout):
+        Text: <cloudsmith-token>
+
+    \b
+    Exit codes:
+        0: Success
+        1: Error (no credentials available, not a Cloudsmith registry, etc.)
+
+    \b
+    Environment variables:
+        CLOUDSMITH_API_KEY: API key for authentication (optional)
+        CLOUDSMITH_ORG:     Organisation slug (required for custom domain support)
+    """
+
+    exit_code, stdout, stderr = execute(
+        repo,
+        credential=opts.credential,
+        api_host=opts.api_host,
+        org=opts.org,
+    )
+
+    if stdout is not None:
+        click.echo(stdout, nl=False)
+    if stderr is not None:
+        click.echo(stderr, err=True)
+
+    sys.exit(exit_code)

{cloudsmith_cli-1.24.0 → cloudsmith_cli-1.25.0}/cloudsmith_cli/cli/commands/entitlements.py

@@ -115,7 +115,9 @@ def list_entitlements(ctx, opts, owner_repo, page, page_size, show_tokens, page_
 
     click.secho("OK", fg="green", err=use_stderr)
 
-    print_entitlements(opts=opts, data=entitlements_, page_info=page_info)
+    print_entitlements(
+        opts=opts, data=entitlements_, page_info=page_info, page_all=page_all
+    )
 
 
 @entitlements.command(name="list", aliases=["ls"])
@@ -126,7 +128,7 @@ def list_(*args, **kwargs):  # pylint: disable=missing-docstring
     return list_entitlements(*args, **kwargs)
 
 
-def print_entitlements(opts, data, page_info=None, show_list_info=True):
+def print_entitlements(opts, data, page_info=None, show_list_info=True, page_all=False):
     """Print entitlements as a table or output in another format."""
     if utils.maybe_print_as_json(opts, data, page_info):
         return
@@ -163,11 +165,16 @@ def print_entitlements(opts, data, page_info=None, show_list_info=True):
 
     num_results = len(data)
     list_suffix = "entitlement%s" % ("s" if num_results != 1 else "")
-    utils.pretty_print_list_info(num_results=num_results, suffix=list_suffix)
+    utils.pretty_print_list_info(
+        num_results=num_results,
+        page_info=None if page_all else page_info,
+        suffix=f"{list_suffix} retrieved" if page_all else f"{list_suffix} visible",
+        page_all=page_all,
+    )
 
 
 def print_entitlements_with_restrictions(
-    opts, data, page_info=None, show_list_info=True
+    opts, data, page_info=None, show_list_info=True, page_all=False
 ):
     # pylint: disable=too-many-locals
     """Print entitlements (with restrictions) as a table or output in another format."""
@@ -276,7 +283,12 @@ def print_entitlements_with_restrictions(
 
     num_results = len(data)
     list_suffix = "entitlement%s" % ("s" if num_results != 1 else "")
-    utils.pretty_print_list_info(num_results=num_results, suffix=list_suffix)
+    utils.pretty_print_list_info(
+        num_results=num_results,
+        page_info=None if page_all else page_info,
+        suffix=f"{list_suffix} retrieved" if page_all else f"{list_suffix} visible",
+        page_all=page_all,
+    )
 
 
 @entitlements.command(aliases=["new"])

{cloudsmith_cli-1.24.0 → cloudsmith_cli-1.25.0}/cloudsmith_cli/cli/commands/logout.py

@@ -7,7 +7,7 @@ import click
 import cloudsmith_api
 
 from ...core import keyring
-from .. import decorators, utils
+from .. import decorators, utils, validators
 from ..config import CredentialsReader
 from .main import main
 
@@ -117,8 +117,11 @@ def logout(ctx, opts, api_host, keyring_only, config_only, dry_run):
             "--keyring-only and --config-only are mutually exclusive."
         )
 
-    if api_host is None:
-        api_host = opts.api_host or cloudsmith_api.Configuration().host
+    api_host = (
+        validators.normalize_api_host(api_host)
+        or opts.api_host
+        or cloudsmith_api.Configuration().host
+    )
 
     use_stderr = utils.should_use_stderr(opts)
 

{cloudsmith_cli-1.24.0 → cloudsmith_cli-1.25.0}/cloudsmith_cli/cli/commands/mcp.py

@@ -1,17 +1,22 @@
 """Main command/entrypoint."""
 
+from __future__ import annotations
+
 import json
 import os
 import shutil
 import sys
 import tempfile
 from pathlib import Path
+from typing import TYPE_CHECKING
 
 import click
 import json5
 
-from ...core.mcp import server
-from ...core.mcp.data import OpenAPITool
+if TYPE_CHECKING:
+    from ...core.mcp import server
+    from ...core.mcp.data import OpenAPITool
+
 from .. import command, decorators, utils
 from .main import main
 

{cloudsmith_cli-1.24.0 → cloudsmith_cli-1.25.0}/cloudsmith_cli/cli/commands/push.py

@@ -2,6 +2,7 @@
 
 # pylint: disable=too-many-lines
 
+import json
 import math
 import os
 import shlex
@@ -694,7 +695,7 @@ def wait_for_package_sync(
             # When using stderr for logs, avoid an interactive progress bar and just poll for status.
             while True:
                 res = get_package_status(owner, repo, slug)
-                ok, failed, _, _, _, _ = res
+                ok, failed, _, status_str, stage_str, reason = res
                 if ok or failed:
                     break
 
@@ -811,6 +812,34 @@ def wait_for_package_sync(
             attempts=attempts,
         )
     else:
+        if use_stderr:
+            # In JSON output mode the human-readable text above went to
+            # stderr, so stdout still needs a machine-readable envelope.
+            # Mirror the shape produced by ``handle_api_exceptions`` so a
+            # sync failure is parseable the same way as an API failure.
+            error_data = {
+                "detail": reason or "Package failed to synchronise.",
+                "help": {
+                    "context": context_msg,
+                    "hint": None,
+                },
+                "meta": {
+                    "status": status_str,
+                    "stage": stage_str or "Unknown",
+                    "seconds": seconds,
+                },
+            }
+
+            metadata_context = getattr(opts, "push_metadata_info", None)
+            if metadata_context is not None:
+                error_data["metadata_attachment"] = metadata_context
+
+            click.echo(
+                json.dumps(
+                    error_data, indent=4 if opts.output == "pretty_json" else None
+                )
+            )
+
         ctx.exit(1)
 
 

{cloudsmith_cli-1.24.0 → cloudsmith_cli-1.25.0}/cloudsmith_cli/cli/commands/upstream.py

@@ -31,6 +31,7 @@ UPSTREAM_FORMATS = [
     "hex",
     "huggingface",
     "maven",
+    "nix",
     "npm",
     "nuget",
     "python",

{cloudsmith_cli-1.24.0 → cloudsmith_cli-1.25.0}/cloudsmith_cli/cli/config.py

@@ -341,7 +341,7 @@ class Options:  # pylint: disable=too-many-public-methods
     @api_host.setter
     def api_host(self, value):
         """Set value for API host."""
-        self._set_option("api_host", value)
+        self._set_option("api_host", validators.normalize_api_host(value))
 
     @property
     def api_key(self):

{cloudsmith_cli-1.24.0 → cloudsmith_cli-1.25.0}/cloudsmith_cli/cli/decorators.py

@@ -16,7 +16,6 @@ from ..core.credentials.oidc.detectors import (
     disabled_detectors_from_env,
     registered_detectors,
 )
-from ..core.mcp import server
 from ..core.rest import create_requests_session as _create_session
 from . import config, utils
 
@@ -312,7 +311,9 @@ def initialise_session(f):
     """Create a shared HTTP session with proxy/SSL/user-agent settings."""
 
     @click.option(
-        "--api-host", envvar="CLOUDSMITH_API_HOST", help="The API host to connect to."
+        "--api-host",
+        envvar="CLOUDSMITH_API_HOST",
+        help="The API host to connect to",
     )
     @click.option(
         "--api-proxy",
@@ -627,6 +628,8 @@ def initialise_mcp(f):
     @click.pass_context
     @functools.wraps(f)
     def wrapper(ctx, *args, **kwargs):
+        from ..core.mcp import server
+
         opts = kwargs.get("opts")
 
         all_tools = kwargs.pop("all_tools")

{cloudsmith_cli-1.24.0 → cloudsmith_cli-1.25.0}/cloudsmith_cli/cli/saml.py

@@ -26,6 +26,28 @@ def create_configured_session(opts):
     return session
 
 
+def raise_for_api_error(response):
+    """Raise :class:`ApiException` if *response* failed, keeping the API's detail.
+
+    Without the detail the exception renders as bare status text, so a caller
+    reporting it tells the user that something failed but never what.
+    """
+    try:
+        response.raise_for_status()
+    except requests.RequestException as exc:
+        try:
+            body = exc.response.json()
+        except ValueError:
+            body = None
+
+        raise ApiException(
+            response.status_code,
+            detail=body.get("detail") if isinstance(body, dict) else None,
+            headers=exc.response.headers,
+            body=exc.response.content,
+        )
+
+
 def get_idp_url(api_host, owner, session):
     org_saml_url = "{api_host}/orgs/{owner}/saml/?{params}".format(
         api_host=api_host,
@@ -35,14 +57,7 @@ def get_idp_url(api_host, owner, session):
 
     org_saml_response = session.get(org_saml_url, timeout=30)
 
-    try:
-        org_saml_response.raise_for_status()
-    except requests.RequestException as exc:
-        raise ApiException(
-            org_saml_response.status_code,
-            headers=exc.response.headers,
-            body=exc.response.content,
-        )
+    raise_for_api_error(org_saml_response)
 
     return org_saml_response.json().get("redirect_url")
 
@@ -60,14 +75,7 @@ def exchange_2fa_token(api_host, two_factor_token, totp_token, session):
         timeout=30,
     )
 
-    try:
-        exchange_response.raise_for_status()
-    except requests.RequestException as exc:
-        raise ApiException(
-            exchange_response.status_code,
-            headers=exc.response.headers,
-            body=exc.response.content,
-        )
+    raise_for_api_error(exchange_response)
 
     exchange_data = exchange_response.json()
     access_token = exchange_data.get("access_token")
@@ -89,14 +97,7 @@ def refresh_access_token(api_host, access_token, refresh_token, session):
         timeout=30,
     )
 
-    try:
-        response.raise_for_status()
-    except requests.RequestException as exc:
-        raise ApiException(
-            response.status_code,
-            headers=exc.response.headers,
-            body=exc.response.content,
-        )
+    raise_for_api_error(response)
 
     response_data = response.json()
     access_token = response_data.get("access_token")

{cloudsmith_cli-1.24.0 → cloudsmith_cli-1.25.0}/cloudsmith_cli/cli/validators.py

@@ -1,6 +1,7 @@
 """CLI - Validators."""
 
 import base64
+import re
 from datetime import datetime, timezone
 from urllib.parse import urlsplit
 
@@ -13,6 +14,8 @@ CONTEXT_SETTINGS = {"help_option_names": ["-h", "--help"]}
 BAD_API_HEADERS = ("user-agent", "host")
 API_HEADER_TRANSFORMS = {}
 PUBLIC_API_HOST_SUFFIXES = ("cloudsmith.io", "cloudsmith.com")
+DEFAULT_API_HOST_SCHEME = "https"
+API_HOST_SCHEME_RE = re.compile(r"^[a-zA-Z][a-zA-Z0-9+.\-]*://")
 
 
 class IntOrWildcard(click.ParamType):
@@ -86,6 +89,26 @@ def validate_api_headers(param, value):
     return headers
 
 
+def normalize_api_host(value):
+    """Normalise a user-supplied API host into a canonical URL.
+
+    Removes surrounding whitespace and trailing slashes. Adds the https
+    scheme when the value does not give one. Returns None for a blank value,
+    so a blank value does not replace a host that is already set.
+    """
+    if not isinstance(value, str):
+        return value
+
+    host = value.strip()
+    if not host:
+        return None
+
+    if not API_HOST_SCHEME_RE.match(host):
+        host = f"{DEFAULT_API_HOST_SCHEME}://{host.lstrip('/')}"
+
+    return host.rstrip("/")
+
+
 def host_matches_suffixes(url, suffixes):
     """True if url's hostname equals or is a subdomain of one of the suffixes.
 

{cloudsmith_cli-1.24.0 → cloudsmith_cli-1.25.0}/cloudsmith_cli/cli/webserver.py

@@ -13,6 +13,8 @@ from ..core.credentials.models import CredentialResult
 from ..core.keyring import store_sso_tokens
 from .saml import exchange_2fa_token
 
+REJECTED_TWO_FACTOR_STATUSES = frozenset({400, 401, 403, 422})
+
 
 def get_template_path(template_name):
     """Get the absolute path to a template file."""
@@ -118,6 +120,10 @@ class AuthenticationWebServer(HTTPServer):
 
 
 class AuthenticationWebRequestHandler(BaseHTTPRequestHandler):
+    # Set once a response is written, so a later failure doesn't write a
+    # second one onto a request the browser already considers finished.
+    responded = False
+
     def __init__(self, request, client_address, server, **kwargs):
         self.owner = kwargs.get("owner")
         self.debug = kwargs.get("debug", False)
@@ -132,17 +138,64 @@ class AuthenticationWebRequestHandler(BaseHTTPRequestHandler):
         """Get the API host from the server instance."""
         return self.server_instance.api_host if self.server_instance else None
 
+    def _prompt_and_exchange_2fa_token(self, two_factor_token):
+        """Prompt for a 2FA code, and prompt again while the API rejects it."""
+        click.echo(err=True)
+        click.secho(
+            "Your organization requires two-factor authentication.",
+            fg="yellow",
+            bold=True,
+            err=True,
+        )
+        click.echo(
+            "Enter the code from your authenticator app to finish signing in.",
+            err=True,
+        )
+
+        click.echo("Press Ctrl-C to give up.", err=True)
+
+        while True:
+            totp_token = click.prompt(
+                "Please enter your 2FA code", hide_input=True, type=str, err=True
+            )
+
+            try:
+                return exchange_2fa_token(
+                    self.api_host, two_factor_token, totp_token, session=self.session
+                )
+            except ApiException as exc:
+                if exc.status not in REJECTED_TWO_FACTOR_STATUSES:
+                    raise
+
+                click.secho(
+                    f"\nThat 2FA code was rejected ({exc}). Please try again.",
+                    fg="red",
+                    err=True,
+                )
+
     def _return_response(self, status=200, message=None):
+        body = (message or "").encode("utf-8")
+
         self.send_response(status)
         self.send_header("Content-Type", "text/html; charset=utf-8")
+        # Without a length the client can only detect the end of the body when
+        # the connection closes, which is after do_GET returns. The 2FA page is
+        # sent before a blocking prompt, so it must be readable straight away.
+        self.send_header("Content-Length", str(len(body)))
         self.end_headers()
 
-        self.wfile.write(message.encode("utf-8"))
+        self.wfile.write(body)
+        self.wfile.flush()
+        self.responded = True
 
     def _return_success_response(self):
         html_content = render_template("auth_success.html")
         self._return_response(message=html_content)
 
+    def _return_two_factor_response(self):
+        html_content = render_template("auth_two_factor.html")
+        self._return_response(message=html_content)
+
     def _return_error_response(self, error_message=None):
         error_details = ""
         if error_message:
@@ -210,12 +263,13 @@ class AuthenticationWebRequestHandler(BaseHTTPRequestHandler):
                 return
 
             if two_factor_token:
-                totp_token = click.prompt(
-                    "Please enter your 2FA token", hide_input=True, type=str, err=True
-                )
+                # Answer the browser before prompting. The prompt blocks, so a
+                # request left open until then shows the user a blank page with
+                # no sign that the terminal is waiting on them.
+                self._return_two_factor_response()
 
-                access_token, refresh_token = exchange_2fa_token(
-                    self.api_host, two_factor_token, totp_token, session=self.session
+                access_token, refresh_token = self._prompt_and_exchange_2fa_token(
+                    two_factor_token
                 )
 
                 # Store the access token on the server instance (same as above)
@@ -232,10 +286,10 @@ class AuthenticationWebRequestHandler(BaseHTTPRequestHandler):
                     self.server_instance.refresh_api_config_after_auth()
 
                 click.secho("\nAuthentication complete", fg="green", err=True)
-                self._return_success_response()
                 return
         except Exception:
-            self._return_error_response()
+            if not self.responded:
+                self._return_error_response()
             raise
 
         click.secho("\nNo valid authentication parameters received", fg="red", err=True)