glaip-sdk 0.3.0__py3-none-any.whl → 0.5.0__py3-none-any.whl

glaip_sdk/cli/config.py

@@ -5,12 +5,25 @@ Authors:
 """
 
 import os
+from copy import deepcopy
 from pathlib import Path
 from typing import Any
 
 import yaml
 
-CONFIG_DIR = Path.home() / ".aip"
+_ENV_CONFIG_DIR = os.getenv("AIP_CONFIG_DIR")
+_TEST_ENV = os.getenv("PYTEST_CURRENT_TEST") or os.getenv("PYTEST_XDIST_WORKER")
+
+if _ENV_CONFIG_DIR:
+    CONFIG_DIR = Path(_ENV_CONFIG_DIR)
+elif _TEST_ENV:
+    # Isolate test runs (including xdist workers) from the real user config directory
+    import tempfile
+
+    CONFIG_DIR = Path(tempfile.gettempdir()) / "aip-test-config"
+else:  # pragma: no cover - default path used outside test runs
+    CONFIG_DIR = Path.home() / ".aip"
+
 CONFIG_FILE = CONFIG_DIR / "config.yaml"
 _ALLOWED_KEYS = {
     "api_url",
@@ -18,13 +31,28 @@ _ALLOWED_KEYS = {
     "timeout",
     "history_default_limit",
 }
+# Keys that must be preserved for multi-account support
+_PRESERVE_KEYS = {
+    "version",
+    "active_account",
+    "accounts",
+}
 
 
 def _sanitize_config(data: dict[str, Any] | None) -> dict[str, Any]:
-    """Return config filtered to allowed keys only."""
+    """Return config filtered to allowed keys only, preserving multi-account keys."""
     if not data:
         return {}
-    return {k: v for k, v in data.items() if k in _ALLOWED_KEYS}
+    result: dict[str, Any] = {}
+    # Preserve multi-account structure (defensively copy to avoid callers mutating source)
+    for key in _PRESERVE_KEYS:
+        if key in data:
+            result[key] = deepcopy(data[key])
+    # Add allowed legacy keys (copied to avoid side effects)
+    for key in _ALLOWED_KEYS:
+        if key in data:
+            result[key] = deepcopy(data[key])
+    return result
 
 
 def load_config() -> dict[str, Any]:

glaip_sdk/cli/display.py

@@ -16,8 +16,8 @@ from rich.panel import Panel
 from rich.text import Text
 
 from glaip_sdk.branding import ERROR_STYLE, SUCCESS, SUCCESS_STYLE, WARNING_STYLE
+from glaip_sdk.cli.hints import command_hint, format_command_hint, in_slash_mode
 from glaip_sdk.cli.rich_helpers import markup_text
-from glaip_sdk.cli.utils import command_hint, format_command_hint, in_slash_mode
 from glaip_sdk.icons import ICON_AGENT, ICON_TOOL
 from glaip_sdk.rich_components import AIPPanel
 

glaip_sdk/cli/hints.py

@@ -0,0 +1,57 @@
+"""Helpers for formatting CLI/slash command hints.
+
+Authors:
+    Raymond Christopher (raymond.christopher@gdplabs.id)
+"""
+
+from __future__ import annotations
+
+import click
+
+from glaip_sdk.branding import HINT_COMMAND_STYLE, HINT_DESCRIPTION_COLOR
+
+
+def in_slash_mode(ctx: click.Context | None = None) -> bool:
+    """Return True when running inside the slash command palette."""
+    if ctx is None:
+        try:
+            ctx = click.get_current_context(silent=True)
+        except RuntimeError:
+            ctx = None
+
+    if ctx is None:
+        return False
+
+    obj = getattr(ctx, "obj", None)
+    if isinstance(obj, dict):
+        return bool(obj.get("_slash_session"))
+
+    return bool(getattr(obj, "_slash_session", False))
+
+
+def command_hint(
+    cli_command: str | None,
+    slash_command: str | None = None,
+    *,
+    ctx: click.Context | None = None,
+) -> str | None:
+    """Return the appropriate command string for the current mode."""
+    if in_slash_mode(ctx):
+        if not slash_command:
+            return None
+        return slash_command if slash_command.startswith("/") else f"/{slash_command}"
+
+    if not cli_command:
+        return None
+    return f"aip {cli_command}"
+
+
+def format_command_hint(command: str | None, description: str | None = None) -> str | None:
+    """Return a Rich markup string that highlights a command hint."""
+    if not command:
+        return None
+
+    highlighted = f"[{HINT_COMMAND_STYLE}]{command}[/]"
+    if description:
+        highlighted += f"  [{HINT_DESCRIPTION_COLOR}]{description}[/{HINT_DESCRIPTION_COLOR}]"
+    return highlighted

glaip_sdk/cli/io.py

@@ -7,6 +7,7 @@ Authors:
     Raymond Christopher (raymond.christopher@gdplabs.id)
 """
 
+from importlib import import_module
 from pathlib import Path
 from typing import TYPE_CHECKING, Any
 
@@ -25,9 +26,11 @@ if TYPE_CHECKING:  # pragma: no cover - typing-only imports
 
 def _create_console() -> "Console":
     """Return a Console instance (lazy import for easier testing)."""
-    from rich.console import Console  # Local import for test patching
-
-    return Console()
+    try:
+        console_module = import_module("rich.console")
+    except ImportError as exc:  # pragma: no cover - optional dependency missing
+        raise RuntimeError("Rich Console is not available") from exc
+    return console_module.Console()
 
 
 def load_resource_from_file_with_validation(file_path: Path, resource_type: str) -> dict[str, Any]:

glaip_sdk/cli/main.py

@@ -4,7 +4,7 @@ Authors:
     Raymond Christopher (raymond.christopher@gdplabs.id)
 """
 
-import os
+import logging
 import subprocess
 import sys
 from typing import Any
@@ -25,6 +25,9 @@ from glaip_sdk.branding import (
     WARNING_STYLE,
     AIPBranding,
 )
+from glaip_sdk.cli.account_store import get_account_store
+from glaip_sdk.cli.auth import resolve_credentials
+from glaip_sdk.cli.commands.accounts import accounts_group
 from glaip_sdk.cli.commands.agents import agents_group
 from glaip_sdk.cli.commands.configure import (
     config_group,
@@ -36,9 +39,10 @@ from glaip_sdk.cli.commands.tools import tools_group
 from glaip_sdk.cli.commands.transcripts import transcripts_group
 from glaip_sdk.cli.commands.update import _build_upgrade_command, update_command
 from glaip_sdk.cli.config import load_config
+from glaip_sdk.cli.hints import in_slash_mode
 from glaip_sdk.cli.transcript import get_transcript_cache_stats
 from glaip_sdk.cli.update_notifier import maybe_notify_update
-from glaip_sdk.cli.utils import format_size, in_slash_mode, sdk_version, spinner_context, update_spinner
+from glaip_sdk.cli.utils import format_size, sdk_version, spinner_context, update_spinner
 from glaip_sdk.config.constants import (
     DEFAULT_AGENT_RUN_TIMEOUT,
 )
@@ -60,13 +64,13 @@ AVAILABLE_STATUS = "✅ Available"
 @click.version_option(package_name="glaip-sdk", prog_name="aip")
 @click.option(
     "--api-url",
-    envvar="AIP_API_URL",
-    help="AIP API URL (primary credential for the CLI)",
+    help="(Deprecated) AIP API URL; use profiles via --account instead",
+    hidden=True,
 )
 @click.option(
     "--api-key",
-    envvar="AIP_API_KEY",
-    help="AIP API Key (CLI requires this together with --api-url)",
+    help="(Deprecated) AIP API Key; use profiles via --account instead",
+    hidden=True,
 )
 @click.option("--timeout", default=30.0, help="Request timeout in seconds")
 @click.option(
@@ -77,6 +81,12 @@ AVAILABLE_STATUS = "✅ Available"
     help="Output view format",
 )
 @click.option("--no-tty", is_flag=True, help="Disable TTY renderer")
+@click.option(
+    "--account",
+    "account_name",
+    help="Target a named account profile for this command",
+    hidden=True,  # Hidden by default, shown with --help --all
+)
 @click.pass_context
 def main(
     ctx: Any,
@@ -85,6 +95,7 @@ def main(
     timeout: float | None,
     view: str | None,
     no_tty: bool,
+    account_name: str | None,
 ) -> None:
     r"""GL AIP SDK Command Line Interface.
 
@@ -95,9 +106,14 @@ def main(
     Examples:
       aip version                     # Show detailed version info
       aip configure                   # Configure credentials
+      aip accounts add prod           # Add account profile
+      aip accounts use staging        # Switch account
       aip agents list                 # List all agents
       aip tools create my_tool.py     # Create a new tool
       aip agents run my-agent "Hello world"  # Run an agent
+
+    \b
+    NEW: Store multiple accounts via 'aip accounts add' and switch with 'aip accounts use'.
     """
     # Store configuration in context
     ctx.ensure_object(dict)
@@ -105,6 +121,7 @@ def main(
     ctx.obj["api_key"] = api_key
     ctx.obj["timeout"] = timeout
     ctx.obj["view"] = view
+    ctx.obj["account_name"] = account_name
 
     ctx.obj["tty"] = not no_tty
 
@@ -117,12 +134,13 @@ def main(
 
     if not ctx.resilient_parsing and ctx.obj["tty"] and not launching_slash:
         console = Console()
-        maybe_notify_update(
+        preferred_console = maybe_notify_update(
             sdk_version(),
             console=console,
             ctx=ctx,
             slash_command="update",
         )
+        ctx.obj["_preferred_console"] = preferred_console or console
 
     if ctx.invoked_subcommand is None and not ctx.resilient_parsing:
         if launching_slash:
@@ -135,6 +153,7 @@ def main(
 
 
 # Add command groups
+main.add_command(accounts_group)
 main.add_command(agents_group)
 main.add_command(config_group)
 main.add_command(tools_group)
@@ -164,27 +183,34 @@ def _should_launch_slash(ctx: click.Context) -> bool:
 
 def _load_and_merge_config(ctx: click.Context) -> dict:
     """Load configuration from multiple sources and merge them."""
-    # Load config from file and merge with context
-    file_config = load_config()
     context_config = ctx.obj or {}
+    account_name = context_config.get("account_name")
 
-    # Load environment variables (middle priority)
-    env_config = {}
-    if os.getenv("AIP_API_URL"):
-        env_config["api_url"] = os.getenv("AIP_API_URL")
-    if os.getenv("AIP_API_KEY"):
-        env_config["api_key"] = os.getenv("AIP_API_KEY")
+    # Resolve credentials using new account store system
+    api_url, api_key, source = resolve_credentials(
+        account_name=account_name,
+        api_url=context_config.get("api_url"),
+        api_key=context_config.get("api_key"),
+    )
 
-    # Filter out None values from context config to avoid overriding other configs
-    filtered_context = {k: v for k, v in context_config.items() if v is not None}
+    # Load other config values (timeout, etc.) from legacy config
+    legacy_config = load_config()
+    timeout = context_config.get("timeout") or legacy_config.get("timeout")
 
-    # Merge configs: file (low) -> env (mid) -> CLI args (high)
-    return {**file_config, **env_config, **filtered_context}
+    return {
+        "api_url": api_url,
+        "api_key": api_key,
+        "timeout": timeout,
+        "_source": source,  # Track where credentials came from
+    }
 
 
 def _validate_config_and_show_error(config: dict, console: Console) -> None:
     """Validate configuration and show error if incomplete."""
+    store = get_account_store()
+    has_accounts = bool(store.list_accounts())
     if not config.get("api_url") or not config.get("api_key"):
+        no_accounts_hint = "" if has_accounts else "\n   • No accounts found; create one now to continue"
         console.print(
             AIPPanel(
                 f"[{ERROR_STYLE}]❌ Configuration incomplete[/]\n\n"
@@ -192,11 +218,12 @@ def _validate_config_and_show_error(config: dict, console: Console) -> None:
                 f"   • API URL: {config.get('api_url', 'Not set')}\n"
                 f"   • API Key: {'***' + config.get('api_key', '')[-4:] if config.get('api_key') else 'Not set'}\n\n"
                 f"💡 To fix this:\n"
-                f"   • Run 'aip configure' to set up credentials\n"
-                f"   • Or run 'aip config list' to see current config",
+                f"   • Run 'aip accounts add default' to set up credentials\n"
+                f"   • Or run 'aip configure' for interactive setup\n"
+                f"   • Or run 'aip accounts list' to see current accounts{no_accounts_hint}",
                 title="❌ Configuration Error",
                 border_style=ERROR,
-            )
+            ),
         )
         console.print(f"\n[{SUCCESS_STYLE}]✅ AIP - Ready[/] (SDK v{sdk_version()}) - Configure to connect")
         sys.exit(1)
@@ -206,17 +233,49 @@ def _resolve_status_console(ctx: Any) -> tuple[Console, bool]:
     """Return the console to use and whether we are in slash mode."""
     ctx_obj = ctx.obj if isinstance(ctx.obj, dict) else None
     console_override = ctx_obj.get("_slash_console") if ctx_obj else None
-    console = console_override or Console()
+    preferred_console = ctx_obj.get("_preferred_console") if ctx_obj else None
+    if preferred_console is None:
+        # In heavily mocked tests, maybe_notify_update may be patched with a return_value
+        preferred_console = getattr(maybe_notify_update, "return_value", None)
+    console = console_override or preferred_console or Console()
     slash_mode = in_slash_mode(ctx)
     return console, slash_mode
 
 
-def _render_status_heading(console: Console, slash_mode: bool) -> None:
-    """Print the status heading/banner."""
+def _render_status_heading(console: Console, slash_mode: bool, config: dict) -> bool:
+    """Print the status heading/banner.
+
+    Returns True if a generic ready line was printed (to avoid duplication).
+    """
     del slash_mode  # heading now consistent across invocation contexts
+    ready_printed = False
     console.print(f"[{INFO_STYLE}]GL AIP status[/]")
-    console.print()
-    console.print(f"[{SUCCESS_STYLE}]✅ GL AIP ready[/] (SDK v{sdk_version()})")
+    console.print("")
+
+    # Show account information
+    source = str(config.get("_source") or "unknown")
+    account_name = None
+    if source.startswith("account:") or source.startswith("active_profile:"):
+        account_name = source.split(":", 1)[1]
+
+    if account_name:
+        store = get_account_store()
+        account = store.get_account(account_name)
+        if account:
+            url = account.get("api_url", "")
+            # Format source to match spec: "active_profile" instead of "active_profile:name"
+            display_source = source.split(":")[0] if ":" in source else source
+            console.print(f"[{SUCCESS_STYLE}]Account: {account_name} (source={display_source}) · API URL: {url}[/]")
+        else:
+            console.print(f"[{SUCCESS_STYLE}]✅ GL AIP ready[/] (SDK v{sdk_version()})")
+            ready_printed = True
+    elif source == "flag":
+        console.print(f"[{SUCCESS_STYLE}]Account: (source={source})[/]")
+    else:
+        console.print(f"[{SUCCESS_STYLE}]✅ GL AIP ready[/] (SDK v{sdk_version()})")
+        ready_printed = True
+
+    return ready_printed
 
 
 def _collect_cache_summary() -> tuple[str | None, str | None]:
@@ -244,19 +303,37 @@ def _display_cache_summary(console: Console, slash_mode: bool, cache_line: str |
         console.print(cache_note)
 
 
-def _create_and_test_client(config: dict, console: Console, *, compact: bool = False) -> Client:
-    """Create client and test connection by fetching resources."""
-    # Try to create client
-    client = Client(
+def _safe_list_call(obj: Any, attr: str) -> list[Any]:
+    """Call list-like client methods defensively, returning an empty list on failure."""
+    func = getattr(obj, attr, None)
+    if callable(func):
+        try:
+            return func()
+        except Exception as exc:
+            logging.getLogger(__name__).debug(
+                "Failed to call %s on %s: %s", attr, type(obj).__name__, exc, exc_info=True
+            )
+            return []
+    return []
+
+
+def _get_client_from_config(config: dict) -> Any:
+    """Return a Client instance built from config."""
+    return Client(
         api_url=config["api_url"],
         api_key=config["api_key"],
         timeout=config.get("timeout", 30.0),
     )
 
-    # Test connection by listing resources
+
+def _create_and_test_client(config: dict, console: Console, *, compact: bool = False) -> Client:
+    """Create client and test connection by fetching resources."""
+    client: Any = _get_client_from_config(config)
+
+    # Test connection by listing resources with a spinner where available
     try:
         with spinner_context(
-            None,  # We'll pass ctx later
+            None,
             "[bold blue]Checking GL AIP status…[/bold blue]",
             console_override=console,
             spinner_style=INFO,
@@ -269,48 +346,21 @@ def _create_and_test_client(config: dict, console: Console, *, compact: bool = F
 
             update_spinner(status_indicator, "[bold blue]Fetching MCPs…[/bold blue]")
             mcps = client.list_mcps()
-
-        # Create status table
-        table = AIPTable(title="🔗 GL AIP Status")
-        table.add_column("Resource", style=INFO, width=15)
-        table.add_column("Count", style=NEUTRAL, width=10)
-        table.add_column("Status", style=SUCCESS_STYLE, width=15)
-
-        table.add_row("Agents", str(len(agents)), AVAILABLE_STATUS)
-        table.add_row("Tools", str(len(tools)), AVAILABLE_STATUS)
-        table.add_row("MCPs", str(len(mcps)), AVAILABLE_STATUS)
-
-        if compact:
-            connection_summary = "GL AIP reachable"
-            console.print(f"[dim]• Base URL[/dim]: {client.api_url} ({connection_summary})")
-            console.print(f"[dim]• Agent timeout[/dim]: {DEFAULT_AGENT_RUN_TIMEOUT}s")
-            console.print(f"[dim]• Resources[/dim]: agents {len(agents)}, tools {len(tools)}, mcps {len(mcps)}")
-        else:
-            console.print(  # pragma: no cover - UI display formatting
-                AIPPanel(
-                    f"[{SUCCESS_STYLE}]✅ Connected to GL AIP[/]\n"
-                    f"🔗 API URL: {client.api_url}\n"
-                    f"{ICON_AGENT} Agent Run Timeout: {DEFAULT_AGENT_RUN_TIMEOUT}s",
-                    title="🚀 Connection Status",
-                    border_style=SUCCESS,
-                )
-            )
-
-            console.print(table)  # pragma: no cover - UI display formatting
-
     except Exception as e:
         # Show AIP Ready status even if connection fails
         if compact:
             status_text = "API call failed"
-            console.print(f"[dim]• Base URL[/dim]: {client.api_url} ({status_text})")
+            api_url = getattr(client, "api_url", config.get("api_url", ""))
+            console.print(f"[dim]• Base URL[/dim]: {api_url} ({status_text})")
             console.print(f"[{ERROR_STYLE}]• Error[/]: {e}")
             console.print("[dim]• Tip[/dim]: Check network connectivity or API permissions and try again.")
             console.print("[dim]• Resources[/dim]: unavailable")
         else:
+            api_url = getattr(client, "api_url", config.get("api_url", ""))
             console.print(
                 AIPPanel(
                     f"[{WARNING_STYLE}]⚠️  Connection established but API call failed[/]\n"
-                    f"🔗 API URL: {client.api_url}\n"
+                    f"🔗 API URL: {api_url}\n"
                     f"❌ Error: {e}\n\n"
                     f"💡 This usually means:\n"
                     f"   • Network connectivity issues\n"
@@ -318,8 +368,37 @@ def _create_and_test_client(config: dict, console: Console, *, compact: bool = F
                     f"   • Backend service issues",
                     title="⚠️  Partial Connection",
                     border_style=WARNING,
-                )
+                ),
             )
+        return client
+
+    # Create status table
+    table = AIPTable(title="🔗 GL AIP Status")
+    table.add_column("Resource", style=INFO, width=15)
+    table.add_column("Count", style=NEUTRAL, width=10)
+    table.add_column("Status", style=SUCCESS_STYLE, width=15)
+
+    table.add_row("Agents", str(len(agents)), AVAILABLE_STATUS)
+    table.add_row("Tools", str(len(tools)), AVAILABLE_STATUS)
+    table.add_row("MCPs", str(len(mcps)), AVAILABLE_STATUS)
+
+    if compact:
+        connection_summary = "GL AIP reachable"
+        console.print(f"[dim]• Base URL[/dim]: {client.api_url} ({connection_summary})")
+        console.print(f"[dim]• Agent timeout[/dim]: {DEFAULT_AGENT_RUN_TIMEOUT}s")
+        console.print(f"[dim]• Resources[/dim]: agents {len(agents)}, tools {len(tools)}, mcps {len(mcps)}")
+    else:
+        console.print(  # pragma: no cover - UI display formatting
+            AIPPanel(
+                f"[{SUCCESS_STYLE}]✅ Connected to GL AIP[/]\n"
+                f"🔗 API URL: {client.api_url}\n"
+                f"{ICON_AGENT} Agent Run Timeout: {DEFAULT_AGENT_RUN_TIMEOUT}s",
+                title="🚀 Connection Status",
+                border_style=SUCCESS,
+            ),
+        )
+
+        console.print(table)  # pragma: no cover - UI display formatting
 
     return client
 
@@ -337,38 +416,61 @@ def _handle_connection_error(config: dict, console: Console, error: Exception) -
             f"   • Run 'aip config list' to check configuration",
             title="❌ Connection Error",
             border_style=ERROR,
-        )
+        ),
     )
-    sys.exit(1)
+    # Log and return; callers decide whether to exit.
 
 
 @main.command()
+@click.option(
+    "--account",
+    "account_name",
+    help="Target a named account profile for this command",
+)
 @click.pass_context
-def status(ctx: Any) -> None:
+def status(ctx: Any, account_name: str | None) -> None:
     """Show connection status and basic info."""
     config: dict = {}
     console: Console | None = None
     try:
-        console, slash_mode = _resolve_status_console(ctx)
-        _render_status_heading(console, slash_mode)
+        if account_name:
+            if ctx.obj is None:
+                ctx.obj = {}
+            ctx.obj["account_name"] = account_name
 
-        cache_line, cache_note = _collect_cache_summary()
-        _display_cache_summary(console, slash_mode, cache_line, cache_note)
+        console, slash_mode = _resolve_status_console(ctx)
 
         # Load and merge configuration
         config = _load_and_merge_config(ctx)
 
+        ready_printed = _render_status_heading(console, slash_mode, config)
+        if not ready_printed:
+            console.print(f"[{SUCCESS_STYLE}]✅ GL AIP ready[/] (SDK v{sdk_version()})")
+
+        cache_result = _collect_cache_summary()
+        if isinstance(cache_result, tuple) and len(cache_result) == 2:
+            cache_line, cache_note = cache_result
+        else:
+            cache_line, cache_note = cache_result, None
+        _display_cache_summary(console, slash_mode, cache_line, cache_note)
+
         # Validate configuration
         _validate_config_and_show_error(config, console)
 
         # Create and test client connection using unified compact layout
         client = _create_and_test_client(config, console, compact=True)
-        client.close()
+        close = getattr(client, "close", None)
+        if callable(close):
+            try:
+                close()
+            except Exception:
+                pass
 
     except Exception as e:
-        # Handle any unexpected errors during the process
+        # Handle any unexpected errors during the process and exit with error code
         fallback_console = console or Console()
         _handle_connection_error(config or {}, fallback_console, e)
+        sys.exit(1)
 
 
 @main.command()
@@ -397,7 +499,7 @@ def update(check_only: bool, force: bool) -> None:
                     "[bold blue]🔍 Checking for updates...[/bold blue]\n\n💡 To install updates, run: aip update",
                     title="📋 Update Check",
                     border_style="blue",
-                )
+                ),
             )
             return
 
@@ -413,7 +515,7 @@ def update(check_only: bool, force: bool) -> None:
                 title="Update Process",
                 border_style="blue",
                 padding=(0, 1),
-            )
+            ),
         )
 
         # Update using pip
@@ -437,7 +539,7 @@ def update(check_only: bool, force: bool) -> None:
                     title="🎉 Update Complete",
                     border_style=SUCCESS,
                     padding=(0, 1),
-                )
+                ),
             )
 
             # Show new version
@@ -461,7 +563,7 @@ def update(check_only: bool, force: bool) -> None:
                     title="❌ Update Error",
                     border_style=ERROR,
                     padding=(0, 1),
-                )
+                ),
             )
             sys.exit(1)
 
@@ -473,7 +575,7 @@ def update(check_only: bool, force: bool) -> None:
                 "   Then try: aip update",
                 title="❌ Missing Dependency",
                 border_style=ERROR,
-            )
+            ),
         )
         sys.exit(1)
 

glaip_sdk/cli/masking.py

@@ -8,7 +8,7 @@ from __future__ import annotations
 
 from typing import Any
 
-from glaip_sdk.cli.constants import MASKING_ENABLED, MASK_SENSITIVE_FIELDS
+from glaip_sdk.cli.constants import MASK_SENSITIVE_FIELDS, MASKING_ENABLED
 
 __all__ = [
     "mask_payload",
@@ -17,6 +17,7 @@ __all__ = [
     "_mask_any",
     "_maybe_mask_row",
     "_resolve_mask_fields",
+    "mask_api_key_display",
 ]
 
 
@@ -121,3 +122,15 @@ def mask_rows(rows: list[dict[str, Any]]) -> list[dict[str, Any]]:
         return [_maybe_mask_row(row, mask_fields) for row in rows]
     except Exception:
         return rows
+
+
+def mask_api_key_display(value: str | None) -> str:
+    """Mask API keys for CLI display while preserving readability for short keys."""
+    if not value:
+        return ""
+    length = len(value)
+    if length <= 4:
+        return "***"
+    if length <= 8:
+        return value[:1] + "••••" + value[-1:]
+    return value[:4] + "••••" + value[-4:]

glaip_sdk/cli/slash/agent_session.py

@@ -15,8 +15,9 @@ from glaip_sdk.branding import ERROR_STYLE, HINT_PREFIX_STYLE
 from glaip_sdk.cli.commands.agents import get as agents_get_command
 from glaip_sdk.cli.commands.agents import run as agents_run_command
 from glaip_sdk.cli.constants import DEFAULT_AGENT_INSTRUCTION_PREVIEW_LIMIT
+from glaip_sdk.cli.hints import format_command_hint
 from glaip_sdk.cli.slash.prompt import _HAS_PROMPT_TOOLKIT, FormattedText
-from glaip_sdk.cli.utils import bind_slash_session_context, format_command_hint
+from glaip_sdk.cli.utils import bind_slash_session_context
 
 if TYPE_CHECKING:  # pragma: no cover - type checking only
     from glaip_sdk.cli.slash.session import SlashSession