cloudx-proxy 0.17.0__tar.gz → 0.17.2__tar.gz

{cloudx_proxy-0.17.0 → cloudx_proxy-0.17.2}/.ai/context/development.md

@@ -89,7 +89,7 @@ When working on this codebase, prioritize:
 1. **Type safety**: Add complete type hints to new code.
 2. **Single responsibility**: Keep classes and methods focused.
 3. **Error handling**: Use specific exceptions with context.
-4. **Testing**: Write tests for new functionality (when framework exists).
+4. **Testing**: Write tests for new functionality. Run `uv run pytest` and `uv run ruff check cloudx_proxy tests`; both gate CI. `tests/test_backward_compat.py` holds SSH configs as earlier releases wrote them and must keep passing unchanged - a failure there means existing users would have to edit a file or re-run setup.
 5. **Security**: Validate all inputs and sanitize subprocess calls.
 
 ## Release Process

{cloudx_proxy-0.17.0 → cloudx_proxy-0.17.2}/.ai/context/project-overview.md

@@ -38,8 +38,9 @@ uvx cloudX-proxy setup [OPTIONS]
 - `--aws-env`: AWS environment directory.
 - `--instance`: EC2 instance ID (skips prompt).
 - `--hostname`: Hostname for SSH config.
-- `--yes`: Non-interactive mode.
-- `--dry-run`: Preview changes.
+- `--environment`: cloudX environment (default: from the instance `Name` tag).
+- `--yes`: Non-interactive mode; failures exit non-zero instead of being continued past.
+- `--dry-run`: Preview changes; makes no AWS calls and writes no files.
 
 **What Setup Does:**
 1. **Configures AWS Profile**: Creates/validates profile for IAM user.

cloudx_proxy-0.17.2/.github/workflows/test.yml

@@ -0,0 +1,65 @@
+name: Test
+
+on:
+  push:
+    branches:
+      - main
+      - develop
+  pull_request:
+    branches:
+      - main
+      - develop
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          python-version: "3.12"
+
+      - name: Install project and dev tools
+        run: uv sync --group dev
+
+      - name: Ruff
+        run: uv run ruff check --output-format=github cloudx_proxy tests
+
+  test:
+    name: Test (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version:
+          - "3.10"
+          - "3.11"
+          - "3.12"
+          - "3.13"
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install project and dev tools
+        run: uv sync --group dev
+
+      - name: Run tests
+        run: uv run pytest
+
+      - name: Check the package imports without being built
+        # cloudx_proxy/_version.py is generated by setuptools_scm and is not
+        # committed, so a plain source checkout must still import
+        run: |
+          rm -f cloudx_proxy/_version.py
+          uv run --no-sync python -c "import cloudx_proxy; print(cloudx_proxy.__version__)"

{cloudx_proxy-0.17.0 → cloudx_proxy-0.17.2}/.gitignore

@@ -22,9 +22,6 @@ cloudx_proxy/_version.py
 .installed.cfg
 *.egg
 
-# Version file generated by setuptools_scm
-cloudx_client/_version.py
-
 # Virtual Environment
 .venv/
 env/
@@ -42,3 +39,4 @@ ENV/
 Thumbs.db
 
 
+.claude/

{cloudx_proxy-0.17.0 → cloudx_proxy-0.17.2}/CHANGELOG.md

@@ -1,3 +1,19 @@
+## [0.17.2](https://github.com/easytocloud/cloudX-proxy/compare/v0.17.1...v0.17.2) (2026-09-04)
+
+
+### Bug Fixes
+
+* do not delete a live 1Password agent socket without asking ([5cd724c](https://github.com/easytocloud/cloudX-proxy/commit/5cd724c0cb25f02d440ecf792f54bc1efde557fd))
+* harden the runtime paths around subprocesses ([5f69662](https://github.com/easytocloud/cloudX-proxy/commit/5f69662d6a7da586abc7ec7041c5660a80280297))
+* make --yes and --dry-run report what actually happened ([9a6dcc2](https://github.com/easytocloud/cloudX-proxy/commit/9a6dcc28ecc4f2295aa41f3fedbe396399d52fc2))
+* preserve top-level directives and stop banners accumulating ([ea89703](https://github.com/easytocloud/cloudX-proxy/commit/ea897034fd860a41c1dcf4340d5903244a29e320))
+* repair unquoted IdentityFile paths in existing configs ([e2dc815](https://github.com/easytocloud/cloudX-proxy/commit/e2dc8151d1897236553e5b67ff08d3edf094a1d2))
+* run the AWS CLI without a shell, and resolve CodeQL's import notes ([4962c2c](https://github.com/easytocloud/cloudX-proxy/commit/4962c2c20e5d2c98d13469d09a56430836de268d))
+* stop SSH config rewrites from discarding configuration ([40b1d0f](https://github.com/easytocloud/cloudX-proxy/commit/40b1d0ff9b4c503df6d142b9d2baef6f34579011))
+* validate and quote values written into the SSH config ([bf55191](https://github.com/easytocloud/cloudX-proxy/commit/bf551913be8057f3e1e58599a46b14b6f2d7422b))
+
+## [0.17.1](https://github.com/easytocloud/cloudX-proxy/compare/v0.17.0...v0.17.1) (2026-09-02)
+
 # [0.17.0](https://github.com/easytocloud/cloudX-proxy/compare/v0.16.15...v0.17.0) (2026-09-02)
 
 

{cloudx_proxy-0.17.0 → cloudx_proxy-0.17.2}/CLAUDE.md

@@ -26,6 +26,19 @@ python -m build
 pip install dist/cloudx_proxy-*.whl
 ```
 
+### Testing and Linting
+
+```bash
+# Run the test suite
+uv run pytest
+
+# Lint (config in pyproject.toml under [tool.ruff])
+uv run ruff check cloudx_proxy tests
+```
+
+`tests/test_backward_compat.py` pins the behaviour existing installations
+depend on; see CONTRIBUTING.md before changing those fixtures.
+
 ### Running the Application
 
 The application is designed to be run via `uvx` (from the `uv` package manager):
@@ -50,7 +63,7 @@ When working on this codebase, prioritize:
 1. **Type safety** - Add complete type hints to new code
 2. **Single responsibility** - Keep classes and methods focused
 3. **Error handling** - Use specific exceptions with context
-4. **Testing** - Write tests for new functionality (when framework exists)
+4. **Testing** - Write tests for new functionality; run `uv run pytest` and `uv run ruff check`
 5. **Security** - Validate all inputs and sanitize subprocess calls
 
 ## Release Process

cloudx_proxy-0.17.2/CONTRIBUTING.md

@@ -0,0 +1,57 @@
+# Contributing to cloudX-proxy
+
+## Development Setup
+
+1. Clone the repository
+2. Install the project and development tools:
+   ```bash
+   uv sync --group dev
+   ```
+
+## Tests and Linting
+
+Both run in CI on every pull request and must pass:
+
+```bash
+# Run the test suite
+uv run pytest
+
+# Lint (configuration lives in pyproject.toml under [tool.ruff])
+uv run ruff check cloudx_proxy tests
+
+# Apply the fixes ruff can make safely
+uv run ruff check --fix cloudx_proxy tests
+```
+
+### Backward compatibility
+
+`uvx cloudX-proxy` resolves to the latest release every time it runs, so an
+existing user's SSH config - written by an older version and never edited
+again - is handed straight to new code. `tests/test_backward_compat.py` holds
+configs exactly as earlier versions wrote them and asserts that `cleanup`
+changes nothing in them but the version stamp, that they still parse, and that
+every ProxyCommand shape those versions emitted is still accepted by `connect`.
+
+Treat those fixtures as frozen. If a change makes one of them fail, the change
+requires existing users to edit a file or re-run setup, which needs to be a
+deliberate decision rather than a side effect.
+
+## Publishing to PyPI
+
+The package is automatically published to PyPI via GitHub Actions when a new release is created. Setup:
+
+1. Register project on PyPI
+2. Generate API token in PyPI (Account Settings → API tokens)
+3. Add token as GitHub secret named `PYPI_TOKEN`
+
+## Versioning
+
+The project uses semantic-release for versioning. 
+Version numbers are automatically determined based on commit messages following the conventional commits specification.
+
+The GitHub Actions workflow will:
+
+1. Determine next version based on commits
+2. Update CHANGELOG.md
+3. Create GitHub release
+4. Publish to PyPI

{cloudx_proxy-0.17.0 → cloudx_proxy-0.17.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloudx-proxy
-Version: 0.17.0
+Version: 0.17.2
 Summary: SSH proxy command to connect VSCode with cloudX instance using AWS Systems Manager
 Author-email: easytocloud <info@easytocloud.com>
 License: MIT License
@@ -282,6 +282,14 @@ The setup command will:
    - Offers to wait for setup completion
    - Monitors setup progress
 
+### Prerequisites Check
+
+`setup` first checks that the AWS CLI and the Session Manager plugin are on your
+PATH. Both are invoked from inside the SSH ProxyCommand, where a missing binary
+surfaces only as "Could not establish connection" in VSCode, so setup reports it
+up front. Setup continues either way - writing the configuration is still useful -
+but connections will fail until they are installed.
+
 ### SSH Configuration
 
 The setup command configures SSH to use cloudX-proxy as a ProxyCommand, enabling seamless connections through AWS Systems Manager. For example, running:
@@ -492,8 +500,9 @@ Options:
 - `--aws-env` (optional): AWS environment directory to use. If specified, AWS configuration and credentials will be read from ~/.aws/aws-envs/{env}/.
 - `--instance` (optional): EC2 instance ID to set up connection for. If provided, skips the instance ID prompt.
 - `--hostname` (optional): Hostname to use for SSH configuration. If not provided, a hostname will be generated from the instance ID in non-interactive mode or prompted for in interactive mode.
-- `--yes` (flag): Non-interactive mode, use default values for all prompts. Requires sufficient defaults or explicit parameters for all required values.
-- `--dry-run` (flag): Preview setup changes without actually executing them. Useful for testing configurations before applying them.
+- `--environment` (optional): cloudX environment (e.g. `dev`, `pre-prod`). If not provided, it is taken from the instance's `Name` tag (`cloudX-{env}-{hostname}`), then from the AWS user name. Required with `--yes` when neither is available.
+- `--yes` (flag): Non-interactive mode, use default values for all prompts. Requires sufficient defaults or explicit parameters for all required values. Unlike interactive mode, a failure is never continued past: setup reports the error and exits non-zero rather than carrying on.
+- `--dry-run` (flag): Preview setup changes without actually executing them. Makes no AWS calls and writes no files, so it works without credentials.
 
 Example usage:
 ```bash
@@ -585,6 +594,11 @@ The cleanup command reorganizes and normalizes your SSH configuration file. It:
 - Reorganizes the config with proper structure and banners
 - Normalizes all `cloudX`/`cloudx` prefixes to match the command used
 - Rebuilds ProxyCommand entries to remove redundant flags
+- Preserves entries it does not manage (your own `Host` and `Match` blocks,
+  with the comments above them) in a clearly marked section at the end
+- Writes the previous contents to `<config>.bak` before rewriting
+
+`cleanup` performs a full rewrite of the file, so the backup is your undo.
 
 Options:
 - `--ssh-config` (optional): Path to the SSH config file to use. If not specified, uses ~/.ssh/cloudX/config.

{cloudx_proxy-0.17.0 → cloudx_proxy-0.17.2}/README.md

@@ -230,6 +230,14 @@ The setup command will:
    - Offers to wait for setup completion
    - Monitors setup progress
 
+### Prerequisites Check
+
+`setup` first checks that the AWS CLI and the Session Manager plugin are on your
+PATH. Both are invoked from inside the SSH ProxyCommand, where a missing binary
+surfaces only as "Could not establish connection" in VSCode, so setup reports it
+up front. Setup continues either way - writing the configuration is still useful -
+but connections will fail until they are installed.
+
 ### SSH Configuration
 
 The setup command configures SSH to use cloudX-proxy as a ProxyCommand, enabling seamless connections through AWS Systems Manager. For example, running:
@@ -440,8 +448,9 @@ Options:
 - `--aws-env` (optional): AWS environment directory to use. If specified, AWS configuration and credentials will be read from ~/.aws/aws-envs/{env}/.
 - `--instance` (optional): EC2 instance ID to set up connection for. If provided, skips the instance ID prompt.
 - `--hostname` (optional): Hostname to use for SSH configuration. If not provided, a hostname will be generated from the instance ID in non-interactive mode or prompted for in interactive mode.
-- `--yes` (flag): Non-interactive mode, use default values for all prompts. Requires sufficient defaults or explicit parameters for all required values.
-- `--dry-run` (flag): Preview setup changes without actually executing them. Useful for testing configurations before applying them.
+- `--environment` (optional): cloudX environment (e.g. `dev`, `pre-prod`). If not provided, it is taken from the instance's `Name` tag (`cloudX-{env}-{hostname}`), then from the AWS user name. Required with `--yes` when neither is available.
+- `--yes` (flag): Non-interactive mode, use default values for all prompts. Requires sufficient defaults or explicit parameters for all required values. Unlike interactive mode, a failure is never continued past: setup reports the error and exits non-zero rather than carrying on.
+- `--dry-run` (flag): Preview setup changes without actually executing them. Makes no AWS calls and writes no files, so it works without credentials.
 
 Example usage:
 ```bash
@@ -533,6 +542,11 @@ The cleanup command reorganizes and normalizes your SSH configuration file. It:
 - Reorganizes the config with proper structure and banners
 - Normalizes all `cloudX`/`cloudx` prefixes to match the command used
 - Rebuilds ProxyCommand entries to remove redundant flags
+- Preserves entries it does not manage (your own `Host` and `Match` blocks,
+  with the comments above them) in a clearly marked section at the end
+- Writes the previous contents to `<config>.bak` before rewriting
+
+`cleanup` performs a full rewrite of the file, so the backup is your undo.
 
 Options:
 - `--ssh-config` (optional): Path to the SSH config file to use. If not specified, uses ~/.ssh/cloudX/config.

cloudx_proxy-0.17.2/cloudx_proxy/__init__.py

@@ -0,0 +1,31 @@
+"""cloudx-proxy - SSH proxy connecting VSCode Remote SSH to EC2 via AWS SSM."""
+
+
+def _resolve_version() -> str:
+    """Determine the package version.
+
+    ``_version.py`` is written by setuptools_scm at build time and is not
+    committed, so it is absent in a plain source checkout. Fall back to the
+    installed distribution metadata, and finally to a sentinel, so importing
+    the package never fails merely because it has not been built.
+
+    Returns:
+        str: The package version
+    """
+    try:
+        from ._version import __version__ as scm_version
+        return scm_version
+    except ImportError:
+        pass
+
+    from importlib.metadata import PackageNotFoundError, version
+
+    try:
+        return version("cloudx-proxy")
+    except PackageNotFoundError:
+        return "0.0.0+unknown"
+
+
+__version__ = _resolve_version()
+
+__all__ = ['__version__']

cloudx_proxy-0.17.0/cloudx_proxy/_1password.py → cloudx_proxy-0.17.2/cloudx_proxy/_op.py

@@ -1,8 +1,29 @@
-import os
+"""1Password integration, via 1Password's own CLI (`op`).
+
+Naming rule: every identifier for this integration is `op_*`, after the `op`
+CLI - never `use_1password`, `onepassword_agent_sock` or similar. User-facing
+text still says "1Password"; only identifiers avoid the word.
+
+That is not only style. CodeQL's py/clear-text-logging-sensitive-data query
+decides whether a value is a credential from the name of the identifier that
+produced it, and it matches "password" as a substring - which both "1password"
+and "onepassword" contain. Naming things after the product therefore marked
+vault names, the agent socket path and the `op --version` string as secrets,
+and every status message printing one was reported as clear-text logging of a
+password: high severity, and wrong every time. Renaming to `op_*` describes
+the values accurately and stops the misclassification at its source.
+"""
+
 import json
+import os
 import subprocess
 
-def check_1password_cli() -> tuple:
+# The 1Password CLI can block on an interactive unlock (biometrics, or a
+# device prompt). Output is captured here, so that prompt would be invisible
+# and the call would hang; fail after a bounded wait instead.
+OP_TIMEOUT = 30
+
+def check_op_cli() -> tuple:
     """Check if 1Password CLI is installed and authenticated.
     
     Returns:
@@ -14,7 +35,8 @@ def check_1password_cli() -> tuple:
             ['op', '--version'],
             capture_output=True,
             text=True,
-            check=False
+            check=False,
+            timeout=OP_TIMEOUT
         )
         
         if result.returncode != 0:
@@ -27,7 +49,8 @@ def check_1password_cli() -> tuple:
             ['op', 'account', 'list'],
             capture_output=True,
             text=True,
-            check=False
+            check=False,
+            timeout=OP_TIMEOUT
         )
         
         if result.returncode != 0:
@@ -40,40 +63,6 @@ def check_1password_cli() -> tuple:
     except Exception:
         return False, False, ""
 
-def check_ssh_agent(agent_sock_path: str) -> bool:
-    """Check if 1Password SSH agent is running.
-    
-    Args:
-        agent_sock_path: Path to the SSH agent socket
-        
-    Returns:
-        bool: True if agent is running
-    """
-    try:
-        # Check if the socket file exists
-        if not os.path.exists(agent_sock_path):
-            return False
-            
-        # Check if agent is active
-        env = os.environ.copy()
-        env['SSH_AUTH_SOCK'] = agent_sock_path
-        
-        result = subprocess.run(
-            ['ssh-add', '-l'],
-            env=env,
-            capture_output=True,
-            text=True,
-            check=False
-        )
-        
-        if "Could not open a connection to your authentication agent" in result.stderr:
-            return False
-            
-        return True
-        
-    except Exception:
-        return False
-
 def list_ssh_keys() -> list:
     """List SSH keys stored in 1Password.
     
@@ -86,7 +75,8 @@ def list_ssh_keys() -> list:
             ['op', 'item', 'list', '--categories', 'SSH Key', '--format=json'],
             capture_output=True,
             text=True,
-            check=False
+            check=False,
+            timeout=OP_TIMEOUT
         )
         
         if result.returncode != 0:
@@ -119,7 +109,8 @@ def create_ssh_key(title: str, vault: str) -> tuple:
             ],
             capture_output=True,
             text=True,
-            check=False
+            check=False,
+            timeout=OP_TIMEOUT
         )
         
         if result.returncode != 0:
@@ -130,7 +121,7 @@ def create_ssh_key(title: str, vault: str) -> tuple:
         item_id = ""
         public_key = ""
         
-        for idx, line in enumerate(output_lines):
+        for _idx, line in enumerate(output_lines):
             if line.startswith("ID:"):
                 item_id = line.split(":", 1)[1].strip()
             
@@ -166,7 +157,8 @@ def get_vaults() -> list:
             ['op', 'vault', 'list', '--format=json'],
             capture_output=True,
             text=True,
-            check=False
+            check=False,
+            timeout=OP_TIMEOUT
         )
         
         if result.returncode != 0:

{cloudx_proxy-0.17.0 → cloudx_proxy-0.17.2}/cloudx_proxy/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.17.0'
-__version_tuple__ = version_tuple = (0, 17, 0)
+__version__ = version = '0.17.2'
+__version_tuple__ = version_tuple = (0, 17, 2)
 
 __commit_id__ = commit_id = None