healthcloud-cli 3.10.2__tar.gz → 3.10.4__tar.gz

{healthcloud_cli-3.10.2 → healthcloud_cli-3.10.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: healthcloud-cli
-Version: 3.10.2
+Version: 3.10.4
 Summary: Command-line interface for the HealthCloud MCP gateway, generated from the shared MCP tool manifest.
 Project-URL: Issues, https://github.com/healthcloudservices/healthcloud-services/issues
 Project-URL: Repository, https://github.com/healthcloudservices/healthcloud-services
@@ -369,7 +369,7 @@ for `login`/`--status`, and `{"schema_version": 1, "ok": true, "removed":
 true|false, "server_session_revoked": false}` for `logout`.
 
 For CI and agents, log in non-interactively: pass `--email` and pipe the password
-to `--password-stdin` (read as exactly one stdin line, never echoed, never a
+to `--password-stdin` (read as exactly one stdin line, never printed by the CLI, never a
 flag value — there is no `--password` option):
 
 ```bash
@@ -389,9 +389,13 @@ prompt (no `GetPassWarning`, no echoed password); a missing email on a
 non-interactive stdin (or a process with no stdin stream at all) is refused the
 same way, naming `--email`/`--password-stdin`; every refusal happens before any
 login request. `--status` cannot be combined with `--email` or `--password-stdin`.
-Even on an interactive terminal, `--password-stdin` suppresses terminal echo
-while the single line is read and restores it afterwards; a stdin stream that is
-closed or errors mid-read is refused cleanly (exit 2, never a traceback).
+On supported POSIX terminals, `--password-stdin` suppresses terminal echo
+while the single line is read and restores it afterwards. When suppression is
+unavailable (including Windows consoles), or stdin's interactivity cannot be
+determined, it warns on stderr before reading that the terminal may display
+the password. Noninteractive pipes do not need suppression and stay quiet.
+A stdin stream that is closed or errors mid-read is refused cleanly
+(exit 2, never a traceback).
 AMS commands may omit both target flags while this session is present, except
 that a `prod` session still needs `--environment prod` on every command. Explicit
 flags and target files must match it exactly. A session within 60 seconds of
@@ -432,8 +436,9 @@ printf '%s\n' "$ADMIN_PASSWORD" | \
 - `--tenant-id` is validated locally (lowercase a-z only, e.g. `acmeclinic`)
   before any network call; anything else is refused without a request.
 - The admin password comes only from a hidden interactive prompt or
-  `--password-stdin` (exactly one stdin line, echo-suppressed). There is no
-  `--password` flag, and the password is never echoed or logged.
+  `--password-stdin` (exactly one stdin line, with terminal echo handling as
+  described above). There is no `--password` flag, and the CLI never prints or
+  logs the password.
 - Output: a `tenants.register` envelope with the tenant ID, status, tier,
   admin ID and `email_otp_sent`, plus a next-step hint pointing at
   `hc tenants verify-email`. A 409 is reported as "A tenant with this ID

{healthcloud_cli-3.10.2 → healthcloud_cli-3.10.4}/README.md

@@ -351,7 +351,7 @@ for `login`/`--status`, and `{"schema_version": 1, "ok": true, "removed":
 true|false, "server_session_revoked": false}` for `logout`.
 
 For CI and agents, log in non-interactively: pass `--email` and pipe the password
-to `--password-stdin` (read as exactly one stdin line, never echoed, never a
+to `--password-stdin` (read as exactly one stdin line, never printed by the CLI, never a
 flag value — there is no `--password` option):
 
 ```bash
@@ -371,9 +371,13 @@ prompt (no `GetPassWarning`, no echoed password); a missing email on a
 non-interactive stdin (or a process with no stdin stream at all) is refused the
 same way, naming `--email`/`--password-stdin`; every refusal happens before any
 login request. `--status` cannot be combined with `--email` or `--password-stdin`.
-Even on an interactive terminal, `--password-stdin` suppresses terminal echo
-while the single line is read and restores it afterwards; a stdin stream that is
-closed or errors mid-read is refused cleanly (exit 2, never a traceback).
+On supported POSIX terminals, `--password-stdin` suppresses terminal echo
+while the single line is read and restores it afterwards. When suppression is
+unavailable (including Windows consoles), or stdin's interactivity cannot be
+determined, it warns on stderr before reading that the terminal may display
+the password. Noninteractive pipes do not need suppression and stay quiet.
+A stdin stream that is closed or errors mid-read is refused cleanly
+(exit 2, never a traceback).
 AMS commands may omit both target flags while this session is present, except
 that a `prod` session still needs `--environment prod` on every command. Explicit
 flags and target files must match it exactly. A session within 60 seconds of
@@ -414,8 +418,9 @@ printf '%s\n' "$ADMIN_PASSWORD" | \
 - `--tenant-id` is validated locally (lowercase a-z only, e.g. `acmeclinic`)
   before any network call; anything else is refused without a request.
 - The admin password comes only from a hidden interactive prompt or
-  `--password-stdin` (exactly one stdin line, echo-suppressed). There is no
-  `--password` flag, and the password is never echoed or logged.
+  `--password-stdin` (exactly one stdin line, with terminal echo handling as
+  described above). There is no `--password` flag, and the CLI never prints or
+  logs the password.
 - Output: a `tenants.register` envelope with the tenant ID, status, tier,
   admin ID and `email_otp_sent`, plus a next-step hint pointing at
   `hc tenants verify-email`. A 409 is reported as "A tenant with this ID

{healthcloud_cli-3.10.2 → healthcloud_cli-3.10.4}/healthcloud_cli/ams/agent_files/commands.py

@@ -116,7 +116,7 @@ def create_download_command(dependencies: AmsDependencies) -> click.Command:
         def execute():
             target = resolve_tenant_target(environment, tenant_id)
             target_data.update(environment=target.environment, tenant_id=target.tenant_id)
-            preflight_agent_files(invocation, target, methods=("download",))
+            preflight_agent_files(invocation, target, methods=("stream_download",))
             # The output path is reserved before sign-in inside the operation, so a
             # bad path never reaches the network (and never overwrites anything).
             return download_agent_file(dependencies, target, agent_id, file_id, output_file)

{healthcloud_cli-3.10.2 → healthcloud_cli-3.10.4}/healthcloud_cli/ams/agent_files/operations.py

@@ -250,24 +250,29 @@ def download_agent_file(
 
     agent_id = _identifier(agent_id, "agent ID")
     file_id = _identifier(file_id, "file ID")
+    digest = hashlib.sha256()
+    size_bytes = 0
     with private_binary_output(output) as write, dependencies.authenticated_sdk_factory(target) as sdk:
-        resource = _resource(sdk, ("download",))
+        resource = _resource(sdk, ("stream_download",))
         try:
-            content = resource.download(agent_id, file_id)
+            with resource.stream_download(agent_id, file_id) as chunks:
+                for chunk in chunks:
+                    write(chunk)
+                    digest.update(chunk)
+                    size_bytes += len(chunk)
         except HealthCloudHTTPError as error:
             refusal = _not_found(error, "file", file_id, agent_id)
             if refusal is not None:
                 raise refusal from error
             raise
-        write(content)
     return succeeded(
         "agent-files.download",
         _target(target, agent_id, file_id),
         {
             "download": {
                 "path": str(output),
-                "size_bytes": len(content),
-                "sha256": hashlib.sha256(content).hexdigest(),
+                "size_bytes": size_bytes,
+                "sha256": digest.hexdigest(),
             }
         },
         read_only=True,

{healthcloud_cli-3.10.2 → healthcloud_cli-3.10.4}/healthcloud_cli/util.py

@@ -39,9 +39,8 @@ class _StdinEchoSuppression:
 
     On POSIX terminals the tty line discipline echoes every character a peer
     writes, which would print the password while ``readline`` waits. Terminal
-    support is probed defensively: on non-tty streams, closed descriptors or
-    platforms without ``termios`` the guard does nothing and the read proceeds
-    as before.
+    support is probed defensively. Non-tty streams need no suppression; if
+    suppression fails on a potentially interactive stream, warn before reading.
     """
 
     def __init__(self, stream: Any) -> None:
@@ -50,21 +49,27 @@ class _StdinEchoSuppression:
         self._fd: int | None = None
         self._original: Any = None
         try:
+            if not stream.isatty():
+                return
+            fd = stream.fileno()
+            if not os.isatty(fd):
+                return
+
             import termios
 
-            fd = stream.fileno()
-            if stream.isatty() and os.isatty(fd):
-                original = termios.tcgetattr(fd)
-                attrs = list(original)
-                attrs[3] = attrs[3] & ~termios.ECHO
-                termios.tcsetattr(fd, termios.TCSANOW, attrs)
-                self._fd = fd
-                self._original = original
+            original = termios.tcgetattr(fd)
+            attrs = list(original)
+            attrs[3] = attrs[3] & ~termios.ECHO
+            termios.tcsetattr(fd, termios.TCSANOW, attrs)
+            self._fd = fd
+            self._original = original
         except Exception:
-            # Best-effort: no tty, no termios, a closed stream or a dead peer
-            # (termios.error is not an OSError) must never break the read.
-            self._fd = None
-            self._original = None
+            # Unknown interactivity or unavailable terminal control must not
+            # silently leave a user typing a visible password.
+            click.echo(
+                "Warning: --password-stdin could not disable terminal echo; the terminal may display your password.",
+                err=True,
+            )
 
     def restore(self) -> None:
         if self._fd is None or self._original is None:
@@ -79,7 +84,7 @@ class _StdinEchoSuppression:
 
 
 def _read_password_from_stdin(stream: Any) -> str:
-    """Read exactly one line from ``stream`` for ``--password-stdin``; never echo it."""
+    """Read one stdin line, suppressing terminal echo when supported or warning."""
 
     if stream is None:
         raise click.UsageError("--password-stdin requires a stdin input stream; none is attached to this process.")

{healthcloud_cli-3.10.2 → healthcloud_cli-3.10.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "healthcloud-cli"
-version = "3.10.2"
+version = "3.10.4"
 description = "Command-line interface for the HealthCloud MCP gateway, generated from the shared MCP tool manifest."
 readme = "README.md"
 requires-python = ">=3.14"