cloudsmith-cli 1.30.0__tar.gz → 1.31.0__tar.gz

{cloudsmith_cli-1.30.0/cloudsmith_cli.egg-info → cloudsmith_cli-1.31.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloudsmith-cli
-Version: 1.30.0
+Version: 1.31.0
 Summary: Cloudsmith Command-Line Interface (CLI)
 Author-email: Cloudsmith Ltd <support@cloudsmith.io>
 License-Expression: Apache-2.0
@@ -22,13 +22,13 @@ Classifier: Topic :: Utilities
 Requires-Python: >=3.11.0
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: certifi>=2024.7.4
+Requires-Dist: certifi>=2026.10.23
 Requires-Dist: click!=8.3.0,>=8.2
 Requires-Dist: click-configfile>=0.2.3
 Requires-Dist: click-didyoumean>=0.0.3
 Requires-Dist: click-spinner>=0.1.7
 Requires-Dist: json5>=0.9.0
-Requires-Dist: cloudsmith-api<3.0,>=2.0.38
+Requires-Dist: cloudsmith-api<3.0,>=2.0.43
 Requires-Dist: keyring>=25.4.1
 Requires-Dist: keyrings-alt>=5.0.2
 Requires-Dist: keyrings-cryptfile>=1.3.9
@@ -379,10 +379,11 @@ See the [default config](https://raw.githubusercontent.com/cloudsmith-io/cloudsm
 You can specify the following configuration options:
 
 - `api_host`: The API host to connect to.
-- `proxy`: The proxy to connect through for all HTTP requests, including API, SAML, upload, download, MCP, update, credential helper, OIDC, and error report connections. Use `--proxy` or `CLOUDSMITH_PROXY` to set it for one command. The config key `api_proxy`, flag `--api-proxy`, and environment variable `CLOUDSMITH_API_PROXY` remain supported for compatibility. In config and environment variables, the new name takes precedence over the alias. Without `proxy`, the CLI uses the `HTTPS_PROXY`, `HTTP_PROXY`, and `NO_PROXY` environment variables. When `proxy` is set, it takes precedence over them.
-- `ssl_verify`: Whether or not to verify SSL certificates for HTTPS requests, including API, SAML, uploads, downloads, and MCP (default: `true`). Use `CLOUDSMITH_SSL_VERIFY=1` to enable verification or `CLOUDSMITH_SSL_VERIFY=0` / `--without-ssl-verify` to disable it. Disabling verification is dangerous; prefer disabling only strict checks where possible. The config key `api_ssl_verify`, flag `--without-api-ssl-verify` / `-S`, and environment variable `CLOUDSMITH_WITHOUT_API_SSL_VERIFY` remain supported for compatibility. Command-line settings override environment variables, which override config; within the same source, the new spelling takes precedence.
+- `proxy`: The proxy to connect through for all HTTP requests, including API, SAML, upload, download, MCP, update, credential helper, OIDC, and error report connections. Use `--proxy` or `CLOUDSMITH_PROXY` to set it for one command. The config key `api_proxy`, flag `--api-proxy`, and environment variable `CLOUDSMITH_API_PROXY` still work, but they are deprecated and will be removed in version 2.0.0; the CLI prints a warning when you use them. The new name takes precedence over the old one. Without `proxy`, the CLI uses the `HTTPS_PROXY`, `HTTP_PROXY`, and `NO_PROXY` environment variables. When `proxy` is set, it takes precedence over them.
+- `ssl_verify`: Whether or not to verify SSL certificates for HTTPS requests, including API, SAML, uploads, downloads, and MCP (default: `true`). Use `CLOUDSMITH_SSL_VERIFY=1` to enable verification or `CLOUDSMITH_SSL_VERIFY=0` / `--without-ssl-verify` to disable it. Disabling verification is dangerous; prefer disabling only strict checks where possible. The config key `api_ssl_verify`, flag `--without-api-ssl-verify` / `-S`, and environment variable `CLOUDSMITH_WITHOUT_API_SSL_VERIFY` still work, but they are deprecated and will be removed in version 2.0.0; the CLI prints a warning when you use them. Command-line settings override environment variables, which override config; within the same source, the new spelling takes precedence.
 - `ssl_verify_strict`: Whether or not to apply strict X.509 certificate verification (`VERIFY_X509_STRICT`, enabled by default on Python 3.13+). Set to `false` (or use `--without-ssl-verify-strict` / `CLOUDSMITH_SSL_VERIFY_STRICT=0`) if a TLS-intercepting proxy issues certificates that fail these checks. `CLOUDSMITH_SSL_VERIFY_STRICT=1` keeps strict verification enabled (the default). Certificates are still verified.
 - `api_user_agent`: The user agent to use for requests.
+- `workspace`: The Cloudsmith Workspace slug. Use `-w`/`--workspace` or `CLOUDSMITH_WORKSPACE` to set it for one command. The config keys `org`, `organization`, and `oidc_org`, the flags `--org`, `--organization`, `--oidc-org`, `--owner`, and `-o`, and the environment variable `CLOUDSMITH_ORG` still work, but they are deprecated and will be removed in version 2.0.0; the CLI prints a warning when you use them.
 
 ### Credentials (credentials.ini)
 
@@ -401,7 +402,7 @@ You'll need to provide authentication to Cloudsmith for any CLI actions that res
 
 You can authenticate using your organization's SAML provider, if configured, with the `cloudsmith auth` command:
 ```
-cloudsmith auth --owner example
+cloudsmith auth --workspace example
 Beginning authentication for the example org ...
 Your organization's SAML IDP URL is: https://example.com/some-saml-idp
 
@@ -413,7 +414,7 @@ Authentication complete
 The CLI opens the IDP URL in your browser automatically. If it can't (for example in Cygwin or a headless shell), it tells you to open the URL above manually and carries on waiting for the callback. Use `--no-browser` to skip the automatic launch entirely:
 
 ```
-cloudsmith auth --owner example --no-browser
+cloudsmith auth --workspace example --no-browser
 ```
 
 *Note:* The authentication callback is served on `127.0.0.1`, on the first free port between `12400` and `12404`. The browser you open the URL in must run on the same machine as the CLI.

{cloudsmith_cli-1.30.0 → cloudsmith_cli-1.31.0}/README.md

@@ -323,10 +323,11 @@ See the [default config](https://raw.githubusercontent.com/cloudsmith-io/cloudsm
 You can specify the following configuration options:
 
 - `api_host`: The API host to connect to.
-- `proxy`: The proxy to connect through for all HTTP requests, including API, SAML, upload, download, MCP, update, credential helper, OIDC, and error report connections. Use `--proxy` or `CLOUDSMITH_PROXY` to set it for one command. The config key `api_proxy`, flag `--api-proxy`, and environment variable `CLOUDSMITH_API_PROXY` remain supported for compatibility. In config and environment variables, the new name takes precedence over the alias. Without `proxy`, the CLI uses the `HTTPS_PROXY`, `HTTP_PROXY`, and `NO_PROXY` environment variables. When `proxy` is set, it takes precedence over them.
-- `ssl_verify`: Whether or not to verify SSL certificates for HTTPS requests, including API, SAML, uploads, downloads, and MCP (default: `true`). Use `CLOUDSMITH_SSL_VERIFY=1` to enable verification or `CLOUDSMITH_SSL_VERIFY=0` / `--without-ssl-verify` to disable it. Disabling verification is dangerous; prefer disabling only strict checks where possible. The config key `api_ssl_verify`, flag `--without-api-ssl-verify` / `-S`, and environment variable `CLOUDSMITH_WITHOUT_API_SSL_VERIFY` remain supported for compatibility. Command-line settings override environment variables, which override config; within the same source, the new spelling takes precedence.
+- `proxy`: The proxy to connect through for all HTTP requests, including API, SAML, upload, download, MCP, update, credential helper, OIDC, and error report connections. Use `--proxy` or `CLOUDSMITH_PROXY` to set it for one command. The config key `api_proxy`, flag `--api-proxy`, and environment variable `CLOUDSMITH_API_PROXY` still work, but they are deprecated and will be removed in version 2.0.0; the CLI prints a warning when you use them. The new name takes precedence over the old one. Without `proxy`, the CLI uses the `HTTPS_PROXY`, `HTTP_PROXY`, and `NO_PROXY` environment variables. When `proxy` is set, it takes precedence over them.
+- `ssl_verify`: Whether or not to verify SSL certificates for HTTPS requests, including API, SAML, uploads, downloads, and MCP (default: `true`). Use `CLOUDSMITH_SSL_VERIFY=1` to enable verification or `CLOUDSMITH_SSL_VERIFY=0` / `--without-ssl-verify` to disable it. Disabling verification is dangerous; prefer disabling only strict checks where possible. The config key `api_ssl_verify`, flag `--without-api-ssl-verify` / `-S`, and environment variable `CLOUDSMITH_WITHOUT_API_SSL_VERIFY` still work, but they are deprecated and will be removed in version 2.0.0; the CLI prints a warning when you use them. Command-line settings override environment variables, which override config; within the same source, the new spelling takes precedence.
 - `ssl_verify_strict`: Whether or not to apply strict X.509 certificate verification (`VERIFY_X509_STRICT`, enabled by default on Python 3.13+). Set to `false` (or use `--without-ssl-verify-strict` / `CLOUDSMITH_SSL_VERIFY_STRICT=0`) if a TLS-intercepting proxy issues certificates that fail these checks. `CLOUDSMITH_SSL_VERIFY_STRICT=1` keeps strict verification enabled (the default). Certificates are still verified.
 - `api_user_agent`: The user agent to use for requests.
+- `workspace`: The Cloudsmith Workspace slug. Use `-w`/`--workspace` or `CLOUDSMITH_WORKSPACE` to set it for one command. The config keys `org`, `organization`, and `oidc_org`, the flags `--org`, `--organization`, `--oidc-org`, `--owner`, and `-o`, and the environment variable `CLOUDSMITH_ORG` still work, but they are deprecated and will be removed in version 2.0.0; the CLI prints a warning when you use them.
 
 ### Credentials (credentials.ini)
 
@@ -345,7 +346,7 @@ You'll need to provide authentication to Cloudsmith for any CLI actions that res
 
 You can authenticate using your organization's SAML provider, if configured, with the `cloudsmith auth` command:
 ```
-cloudsmith auth --owner example
+cloudsmith auth --workspace example
 Beginning authentication for the example org ...
 Your organization's SAML IDP URL is: https://example.com/some-saml-idp
 
@@ -357,7 +358,7 @@ Authentication complete
 The CLI opens the IDP URL in your browser automatically. If it can't (for example in Cygwin or a headless shell), it tells you to open the URL above manually and carries on waiting for the callback. Use `--no-browser` to skip the automatic launch entirely:
 
 ```
-cloudsmith auth --owner example --no-browser
+cloudsmith auth --workspace example --no-browser
 ```
 
 *Note:* The authentication callback is served on `127.0.0.1`, on the first free port between `12400` and `12404`. The browser you open the URL in must run on the same machine as the CLI.

{cloudsmith_cli-1.30.0 → cloudsmith_cli-1.31.0}/cloudsmith_cli/cli/command.py

@@ -6,6 +6,11 @@ from collections import OrderedDict
 import click.exceptions
 from click_didyoumean import DYMGroup
 
+try:
+    from click.utils import _PacifyFlushWrapper
+except ImportError:  # click before 8.2
+    from click.utils import PacifyFlushWrapper as _PacifyFlushWrapper
+
 from ..core.certificate_errors import describe_certificate_error
 
 
@@ -202,6 +207,13 @@ class AliasGroup(DYMGroup):
             e.show()
             _echo_certificate_hint(e)
             sys.exit(e.exit_code)
+        except BrokenPipeError:
+            # Click does not catch a failed write in its Ctrl+C handler.
+            if not original_standalone_mode:
+                raise
+            sys.stdout = _PacifyFlushWrapper(sys.stdout)
+            sys.stderr = _PacifyFlushWrapper(sys.stderr)
+            sys.exit(1)
         except Exception as e:  # pylint: disable=broad-exception-caught
             # Anything reaching here is unexpected: click's own errors and
             # handled API errors (which exit via ctx.exit) are dealt with

{cloudsmith_cli-1.30.0 → cloudsmith_cli-1.31.0}/cloudsmith_cli/cli/commands/auth.py

@@ -10,7 +10,7 @@ from ...core.sso import (
     get_access_token_expiry,
     renew_sso_session,
 )
-from .. import decorators, utils, validators
+from .. import decorators, deprecation, utils, validators
 from ..exceptions import handle_api_exceptions
 from ..saml import get_idp_url
 from ..webserver import AuthenticationWebRequestHandler, AuthenticationWebServer
@@ -158,10 +158,28 @@ def _perform_saml_authentication(
                 )
 
         auth_server.handle_request()
+        return auth_server.sso_access_token is not None
     finally:
         auth_server.server_close()
 
 
+def _save_workspace(ctx, opts, workspace, use_stderr):
+    """Save the Workspace to config.ini, or warn when the CLI cannot write it."""
+    try:
+        saved_path = opts.get_config_reader().save_workspace(
+            workspace, profile=ctx.meta.get("profile"), path=ctx.meta.get("config_file")
+        )
+    except (OSError, ValueError) as exc:
+        click.secho(
+            f"Could not save the {workspace} Workspace to config.ini: {exc}",
+            fg="yellow",
+            err=True,
+        )
+        return
+    if saved_path:
+        click.echo(f"Saved the {workspace} Workspace to {saved_path}.", err=use_stderr)
+
+
 @main.command(aliases=["auth"])
 @click.option(
     "-t",
@@ -230,28 +248,13 @@ def authenticate(
     use_stderr = request_api_key_flag or json or utils.should_use_stderr(opts)
 
     if token:
-        click.secho(
-            "DEPRECATION WARNING: The `--token` flag is deprecated and will be removed in a future release. "
-            "Please use `--request-api-key` instead.",
-            fg="yellow",
-            err=True,
-        )
+        deprecation.warn_option("--token", "--request-api-key", ctx=ctx)
 
     if force:
-        click.secho(
-            "DEPRECATION WARNING: The `--force` flag is deprecated and will be removed in a future release. "
-            "Please use `--request-api-key` instead (force is implied).",
-            fg="yellow",
-            err=True,
-        )
+        deprecation.warn_option("--force", "--request-api-key", ctx=ctx)
 
     if json and not utils.should_use_stderr(opts):
-        click.secho(
-            "DEPRECATION WARNING: The `--json` flag is deprecated and will be removed in a future release. "
-            "Please use `--output-format json` instead.",
-            fg="yellow",
-            err=True,
-        )
+        deprecation.warn_option("--json", "--output-format json", ctx=ctx)
 
     if not force and not token and not request_api_key_flag:
         session_result = _renew_existing_sso_session(
@@ -276,7 +279,7 @@ def authenticate(
 
     context_message = "Failed to authenticate via SAML!"
     with handle_api_exceptions(ctx, opts=opts, context_msg=context_message):
-        _perform_saml_authentication(
+        authenticated = _perform_saml_authentication(
             opts,
             workspace,
             enable_token_creation=enable_token_creation,
@@ -285,6 +288,9 @@ def authenticate(
             profile=ctx.meta.get("profile"),
         )
 
+    if authenticated:
+        _save_workspace(ctx, opts, workspace, use_stderr)
+
     if request_api_key_flag:
         # Non-interactive token retrieval
         new_token = request_api_key(ctx, opts, save_config=save_config)

{cloudsmith_cli-1.30.0 → cloudsmith_cli-1.31.0}/cloudsmith_cli/cli/commands/credential_helper/cargo.py

@@ -37,7 +37,7 @@ def cargo(opts, cargo_plugin, provider_args):  # pylint: disable=unused-argument
     Provides credentials for all Cloudsmith Cargo registries: ``*.cloudsmith.io``,
     ``*.cloudsmith.com``, and any custom domains configured for the Workspace
     (requires a Workspace - ``--workspace``, CLOUDSMITH_WORKSPACE, or
-    ``workspace`` in ``config.ini``; legacy aliases are also accepted - and a
+    ``workspace`` in ``config.ini``; deprecated aliases still work - and a
     valid API key/token).
 
     A registry that is not a Cloudsmith one is answered with
@@ -69,13 +69,14 @@ def cargo(opts, cargo_plugin, provider_args):  # pylint: disable=unused-argument
         $ echo '{"v":1,"kind":"get","operation":"read","registry":{"index-url":"sparse+https://cargo.cloudsmith.io/org/repo/"}}' \\
             | cloudsmith credential-helper cargo
 
+    \b
         # Called by Cargo via the launcher
         $ cargo-credential-cloudsmith --cargo-plugin
 
     \b
     Environment variables:
         CLOUDSMITH_API_KEY: API key for authentication (optional)
-        CLOUDSMITH_WORKSPACE: Workspace slug (CLOUDSMITH_ORG is also accepted)
+        CLOUDSMITH_WORKSPACE: Workspace slug (the deprecated CLOUDSMITH_ORG still works)
     """
     # `provider_args` collects the extra arguments Cargo appends from the
     # credential-provider config entry.  This provider takes no configuration

{cloudsmith_cli-1.30.0 → cloudsmith_cli-1.31.0}/cloudsmith_cli/cli/commands/credential_helper/docker.py

@@ -30,7 +30,7 @@ def docker(opts, operation):
     Provides credentials for all Cloudsmith Docker registries: ``*.cloudsmith.io``,
     ``*.cloudsmith.com``, and any custom domains configured for the Workspace
     (requires a Workspace - ``--workspace``, CLOUDSMITH_WORKSPACE, or
-    ``workspace`` in ``config.ini``; legacy aliases are also accepted - and a
+    ``workspace`` in ``config.ini``; deprecated aliases still work - and a
     valid API key/token).
 
     \b
@@ -59,7 +59,7 @@ def docker(opts, operation):
     \b
     Environment variables:
         CLOUDSMITH_API_KEY: API key for authentication (optional)
-        CLOUDSMITH_WORKSPACE: Workspace slug (CLOUDSMITH_ORG is also accepted)
+        CLOUDSMITH_WORKSPACE: Workspace slug (the deprecated CLOUDSMITH_ORG still works)
     """
     exit_code, stdout, stderr = execute(
         operation,

{cloudsmith_cli-1.30.0 → cloudsmith_cli-1.31.0}/cloudsmith_cli/cli/commands/credential_helper/manage.py

@@ -9,13 +9,29 @@ Provides ``credential-helper install``, ``credential-helper uninstall``, and
 from __future__ import annotations
 
 import sys
+from functools import partial
 from urllib.parse import urlsplit
 
 import click
+from click.core import ParameterSource
 
+from cloudsmith_cli.core.cache_utils import ConfigFileParseError
 from cloudsmith_cli.credential_helpers.cargo.installer import CargoInstaller
 from cloudsmith_cli.credential_helpers.generic import PartialInstallError
+from cloudsmith_cli.credential_helpers.gradle.installer import GradleInstaller
+from cloudsmith_cli.credential_helpers.launchers import UnsafeLauncherValue
+from cloudsmith_cli.credential_helpers.maven.extensions import ExtensionsFileError
+from cloudsmith_cli.credential_helpers.maven.installer import (
+    MavenInstaller,
+    MavenrcNotSupported,
+)
+from cloudsmith_cli.credential_helpers.maven_tools import (
+    BuildToolError,
+    ConfigFileConflict,
+    ProjectNotFound,
+)
 from cloudsmith_cli.credential_helpers.pnpm.installer import PNPMInstaller
+from cloudsmith_cli.credential_helpers.sbt.installer import SbtInstaller
 from cloudsmith_cli.credential_helpers.terraform.installer import (
     TerraformHelperExeNotFound,
     TerraformInstaller,
@@ -26,6 +42,7 @@ from cloudsmith_cli.credential_helpers.terraform.terraformrc import (
     TerraformrcConflictError,
 )
 
+from ....core.session import create_requests_session
 from ....credential_helpers.docker.installer import DockerInstaller
 from ... import utils
 from ...decorators import (
@@ -44,6 +61,9 @@ _INSTALLERS: dict[str, type] = {
     "pnpm": PNPMInstaller,
     "cargo": CargoInstaller,
     "terraform": TerraformInstaller,
+    "maven": MavenInstaller,
+    "gradle": GradleInstaller,
+    "sbt": SbtInstaller,
 }
 
 
@@ -76,6 +96,42 @@ def _get_installer(name: str):
     return cls()
 
 
+class HelperOption(click.Option):
+    """A flag that only the helpers in *helpers* accept."""
+
+    def __init__(self, *args, helpers: tuple[str, ...], **kwargs):
+        super().__init__(*args, **kwargs)
+        self.helpers = helpers
+
+
+def _helper_options(ctx: click.Context, helper: str) -> dict[str, bool]:
+    """Return the helper flags that were given, or fail if *helper* does not accept one."""
+    given = {}
+    for param in ctx.command.params:
+        if not isinstance(param, HelperOption) or not ctx.params[param.name]:
+            continue
+        if helper not in param.helpers:
+            raise click.UsageError(
+                f"{param.opts[0]} applies only to {' and '.join(param.helpers)}.", ctx
+            )
+        given[param.name] = True
+    return given
+
+
+def _download_session(opts):
+    """Return a session with the proxy and TLS settings of the command.
+
+    The session goes to the public maven-tools repository, so it does not get
+    the --api-headers that are for the API host.
+    """
+    return create_requests_session(
+        proxy=opts.proxy,
+        ssl_verify=opts.ssl_verify,
+        ssl_verify_strict=opts.ssl_verify_strict,
+        user_agent=opts.api_user_agent,
+    )
+
+
 def _terraform_helper_args(ctx, opts, repo: str | None = None) -> tuple[str, ...]:
     """Build the terraformrc ``args`` list from the resolved config.
 
@@ -134,6 +190,52 @@ def _terraform_proxy_next_steps(opts) -> list[str]:
     ]
 
 
+# Other users can read a launcher, so it never holds a secret.  A proxy URL can
+# hold credentials.
+_NEVER_KEPT = ("api_key", "api_headers", "keyring_key", "proxy")
+
+
+def _main_envvar(option) -> str:
+    """Return the main environment variable of *option*."""
+    names = option.envvar
+    return names if isinstance(names, str) else names[0]
+
+
+def _launcher_settings_from_cli(ctx: click.Context) -> dict[str, str]:
+    """Return the ``CLOUDSMITH_*`` settings that a launcher keeps.
+
+    An option with a ``CLOUDSMITH_*`` environment variable is kept when its
+    value came from a flag or from the environment.  A value from a config
+    file is not kept, because the helper reads that file itself.  An option
+    of this command replaces the same option of a parent command.  A
+    deprecated spelling is kept under the environment variable of the option
+    that replaces it.
+    """
+    contexts = []
+    while ctx is not None:
+        contexts.insert(0, ctx)
+        ctx = ctx.parent
+
+    supplied = (ParameterSource.COMMANDLINE, ParameterSource.ENVIRONMENT)
+    settings = {}
+    for context in contexts:
+        for option in context.command.params:
+            if (
+                option.name in _NEVER_KEPT
+                or option.name not in context.params
+                or not option.envvar
+            ):
+                continue
+            envvar = _main_envvar(option)
+            source = context.get_parameter_source(option.name)
+            if envvar.startswith("CLOUDSMITH_") and source in supplied:
+                value = context.params[option.name]
+                settings[envvar] = (
+                    str(value).lower() if isinstance(value, bool) else value
+                )
+    return settings
+
+
 _REPO_FLAGS = ("-r", "--repo", "--repository")
 
 
@@ -241,6 +343,24 @@ def _terraform_workspace_next_steps(helper_args: tuple[str, ...]) -> list[str]:
     "list (as `-r <repo>`) so `terraform init` needs no CLOUDSMITH_REPO env "
     "var. Terraform does not pass the repository to a credentials helper.",
 )
+@click.option(
+    "--local",
+    cls=HelperOption,
+    helpers=("maven", "sbt"),
+    is_flag=True,
+    default=False,
+    help="Maven and sbt only: set up the project in the current directory "
+    "instead of every build of the user.",
+)
+@click.option(
+    "--mavenrc",
+    cls=HelperOption,
+    helpers=("maven",),
+    is_flag=True,
+    default=False,
+    help="Maven only: load the extension through ~/.mavenrc instead of "
+    "~/.m2/extensions.xml. Use it for Maven 3.9 and earlier.",
+)
 @common_cli_config_options
 @common_cli_output_options
 @common_api_auth_options
@@ -256,6 +376,8 @@ def install_cmd(
     no_discover: bool,
     refresh: bool,
     repo: str | None,
+    local: bool,
+    mavenrc: bool,
 ) -> None:
     """Install a credential helper launcher and configure the package manager.
 
@@ -290,6 +412,9 @@ def install_cmd(
         $ cloudsmith credential-helper install terraform -w acme --repo my-repo
     """
     installer = _get_installer(helper)
+    helper_options = _helper_options(ctx, helper)
+    if local and mavenrc:
+        raise click.UsageError("Use --local or --mavenrc, not both.", ctx)
 
     install_kwargs = {
         "bin_dir": bin_dir,
@@ -300,7 +425,10 @@ def install_cmd(
         "org": opts.org,
         "credential": opts.credential,
         "api_host": opts.api_host,
+        **helper_options,
     }
+    if getattr(installer, "downloads_files", False):
+        install_kwargs["session"] = _download_session(opts)
 
     # Terraform bakes the resolved org/profile into the terraformrc `args` list
     # so `terraform init` needs neither env vars nor a hand-edited config. The
@@ -310,12 +438,23 @@ def install_cmd(
         helper_args = _terraform_helper_args(ctx, opts, repo)
         install_kwargs["helper_args"] = helper_args
 
+    if getattr(installer, "KEEPS_INSTALL_TIME_SETTINGS", False):
+        install_kwargs["launcher_env"] = _launcher_settings_from_cli(ctx)
+    install_kwargs.update(_progress_option(installer))
+
     try:
         actions = installer.install(**install_kwargs)
     except (
+        ConfigFileParseError,
         TerraformrcConflictError,
         TerraformHelperExeNotFound,
         TerraformPluginDirError,
+        ProjectNotFound,
+        ExtensionsFileError,
+        ConfigFileConflict,
+        UnsafeLauncherValue,
+        MavenrcNotSupported,
+        BuildToolError,
     ) as exc:
         raise click.ClickException(str(exc))
     except OSError as exc:
@@ -351,7 +490,7 @@ def install_cmd(
         sys.exit(ec)
 
     if dry_run:
-        click.echo("Dry run — no changes will be made:", err=use_stderr)
+        click.echo("Dry run - no changes will be made:", err=use_stderr)
     for action in normal:
         click.echo(f"  {action}" if dry_run else action, err=use_stderr)
     for warning in warnings:
@@ -380,10 +519,21 @@ def install_cmd(
     default=False,
     help="Show what would be done without making any changes.",
 )
+@click.option(
+    "--local",
+    cls=HelperOption,
+    helpers=("maven", "sbt"),
+    is_flag=True,
+    default=False,
+    help="Maven and sbt only: remove the setup of the project in the current "
+    "directory.",
+)
 @common_cli_config_options
 @common_cli_output_options
 @click.pass_context
-def uninstall_cmd(ctx, opts, helper: str, bin_dir: str | None, dry_run: bool) -> None:
+def uninstall_cmd(
+    ctx, opts, helper: str, bin_dir: str | None, dry_run: bool, local: bool
+) -> None:
     """Uninstall a credential helper launcher and remove its config entries.
 
     HELPER is the name of the credential helper to uninstall (e.g. ``docker``).
@@ -400,7 +550,19 @@ def uninstall_cmd(ctx, opts, helper: str, bin_dir: str | None, dry_run: bool) ->
     """
     installer = _get_installer(helper)
     try:
-        actions = installer.uninstall(bin_dir=bin_dir, dry_run=dry_run)
+        actions = installer.uninstall(
+            bin_dir=bin_dir,
+            dry_run=dry_run,
+            **_helper_options(ctx, helper),
+            **_progress_option(installer),
+        )
+    except (
+        ConfigFileParseError,
+        ProjectNotFound,
+        ConfigFileConflict,
+        BuildToolError,
+    ) as exc:
+        raise click.ClickException(str(exc))
     except OSError as exc:
         raise click.ClickException(
             f"Failed to uninstall {helper!r} credential helper: {exc}"
@@ -419,13 +581,20 @@ def uninstall_cmd(ctx, opts, helper: str, bin_dir: str | None, dry_run: bool) ->
         return
 
     if dry_run:
-        click.echo("Dry run — no changes will be made:", err=use_stderr)
+        click.echo("Dry run - no changes will be made:", err=use_stderr)
     for action in normal:
         click.echo(f"  {action}" if dry_run else action, err=use_stderr)
     for warning in warnings:
         click.secho(f"  {warning}" if dry_run else warning, err=True, fg="yellow")
 
 
+def _progress_option(installer) -> dict:
+    """Return the callback that says why the command waits, for an installer that asks a build tool."""
+    if getattr(installer, "ASKS_BUILD_TOOL", False):
+        return {"progress": partial(click.echo, err=True)}
+    return {}
+
+
 # ---------------------------------------------------------------------------
 # list
 # ---------------------------------------------------------------------------
@@ -441,6 +610,11 @@ def list_cmd(ctx, opts) -> None:
     Shows which helpers are available, whether their launcher binary is
     present on PATH, and which registry hosts they are configured for.
 
+    For gradle and sbt, list checks only the default locations: init.d in
+    $GRADLE_USER_HOME or ~/.gradle, and ~/.sbt/1.0/plugins. Install and
+    uninstall ask Gradle and sbt where they read plugins. If gradle.user.home
+    or sbt.global.base moves that location, list shows "not installed".
+
     Example:
 
     \b

cloudsmith_cli-1.31.0/cloudsmith_cli/cli/commands/credential_helper/pnpm.py

@@ -0,0 +1,77 @@
+# Copyright 2026 Cloudsmith Ltd
+"""
+pnpm credential helper command.
+
+Implements the pnpm credential helper protocol for Cloudsmith registries.
+"""
+
+import sys
+from typing import NoReturn
+
+import click
+
+from ....credential_helpers.pnpm import execute
+from ...config import Options
+from ...decorators import common_api_auth_options, resolve_credentials
+
+
+@click.command()
+@click.argument("repo", required=False, default="npm.cloudsmith.io")
+@common_api_auth_options
+@resolve_credentials
+def pnpm(opts: Options, repo: str) -> NoReturn:
+    """
+    pnpm credential helper for Cloudsmith registries.
+
+    Prints the authorization value for a pnpm registry.  pnpm runs this
+    command through the ``tokenHelper`` setting in the user-level ``~/.npmrc``
+    file.  Use ``cloudsmith credential-helper install pnpm`` to add that
+    setting.
+
+    Provides credentials for all Cloudsmith npm registries: ``*.cloudsmith.io``,
+    ``*.cloudsmith.com``, and any custom domains configured for the Workspace
+    (requires a Workspace - ``--workspace``, CLOUDSMITH_WORKSPACE, or
+    ``workspace`` in ``config.ini``; deprecated aliases still work - and a
+    valid API key/token).
+
+    \b
+    Input (argument, optional):
+        Registry host (default: "npm.cloudsmith.io")
+
+    \b
+    Output (stdout):
+        Text: token <cloudsmith-api-key>, or Bearer <cloudsmith-token>
+
+    \b
+    Exit codes:
+        0: Success
+        1: Error (no credentials available, not a Cloudsmith registry, etc.)
+
+    \b
+    Examples:
+        # Manual testing
+        $ cloudsmith credential-helper pnpm npm.cloudsmith.io
+
+    \b
+        # Called by pnpm via the launcher
+        $ pnpm-credential-cloudsmith
+
+    \b
+    Environment variables:
+        CLOUDSMITH_API_KEY: API key for authentication (optional)
+        CLOUDSMITH_WORKSPACE: Workspace slug (the deprecated CLOUDSMITH_ORG still works)
+    """
+
+    exit_code, stdout, stderr = execute(
+        repo,
+        credential=opts.credential,
+        api_host=opts.api_host,
+        org=opts.org,
+    )
+
+    if stdout is not None:
+        click.echo(stdout, nl=False)
+    if stderr is not None:
+        click.echo(stderr, err=True)
+
+    sys.exit(exit_code)

{cloudsmith_cli-1.30.0 → cloudsmith_cli-1.31.0}/cloudsmith_cli/cli/commands/dependencies.py

@@ -6,6 +6,7 @@ import click
 
 from ...core.api.packages import get_package_dependencies
 from .. import decorators, utils, validators
+from ..config import Options
 from ..exceptions import handle_api_exceptions
 from ..utils import maybe_spinner
 from .main import main
@@ -32,14 +33,17 @@ def list_dependencies_options(f):
     return wrapper
 
 
-def list_dependencies(ctx, opts, owner_repo_package):
+def list_dependencies(
+    ctx: click.Context, opts: Options, owner_repo_package: tuple[str, str, str]
+) -> None:
     """
-    List direct (non-transitive) dependencies for a package.
+    List the direct dependencies of a package.
 
-    NOTE: These are not guaranteed to be complete, and only represent the *direct* /
-    *non-transitive* dependencies of a package. If packages consistently show
-    no dependencies then it is possible that dependency extraction isn't support
-    for the package format yet.
+    The list does not include transitive dependencies. For each dependency, the
+    list shows the type, the name, the version operator and the version.
+
+    The list can be incomplete. Cloudsmith does not extract dependencies for
+    all package formats. For those formats, the list is empty.
 
     - OWNER/REPO/PACKAGE: Specify the OWNER namespace (i.e. user or org), the
     REPO name where the package is stored, and the PACKAGE name (identifier/slug) of the