healthcloud-cli 3.2.4__tar.gz → 3.2.5__tar.gz

{healthcloud_cli-3.2.4 → healthcloud_cli-3.2.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: healthcloud-cli
-Version: 3.2.4
+Version: 3.2.5
 Summary: Command-line interface for the HealthCloud MCP gateway, generated from the shared MCP tool manifest.
 Project-URL: Issues, https://github.com/healthcloudservices/healthcloud-services/issues
 Project-URL: Repository, https://github.com/healthcloudservices/healthcloud-services
@@ -56,6 +56,24 @@ uv run --frozen hc mcp tools list --audience patient
 uv run --frozen hc mcp patient get-patient --help
 ```
 
+AMS help and shell-completion discovery are credential-free and offline: they
+do not resolve root profiles, read target files, create SDK clients, or log in.
+You can inspect the group, a leaf command, and completion candidates before
+configuring credentials or a target:
+
+```bash
+uv run --frozen hc ams --help
+uv run --frozen hc ams inspect --help
+_HC_COMPLETE=bash_complete COMP_WORDS="hc ams in" COMP_CWORD=2 uv run --frozen hc
+_HC_COMPLETE=bash_complete COMP_WORDS="hc ams inspect --o" COMP_CWORD=3 uv run --frozen hc
+```
+
+Operational validation starts only when Click invokes an AMS leaf callback.
+`discover` then validates its explicit environment and tenant arguments; the
+other leaves require `--target-file` and apply the existing root, target, and
+authentication checks described below. Deferring preflight does not relax
+those safety requirements.
+
 The bundled tool manifest (`healthcloud_cli/contracts/mcp-tools.manifest.json`)
 is a copy of `packages/cli/contracts/mcp-tools.manifest.json`. Re-sync it
 after pulling manifest changes with:
@@ -441,3 +459,44 @@ then GET plan and GET agent. Restart the stateful simulation before repeating;
 stop it with Ctrl+C afterward. This is a source-backed synthetic failure fixture,
 not the deployed service. The required CI tests exercise both pre-commit and
 post-commit 503 over loopback HTTP without requiring a Postman login or installation.
+
+
+### Installed CLI integration
+
+From the repository root, with Python 3.14, uv 0.12.5 and Node.js available:
+
+```bash
+python -m unittest discover -s tooling/cli-integration -p 'test_*.py' -v
+python tooling/cli-integration/run.py --output /tmp/hc-cli-integration
+```
+
+The runner installs the SDK, tenant-admin SDK and CLI from the frozen CLI lock
+with `uv sync --no-editable` into a fresh temporary environment outside the
+checkout. It verifies installed module ownership, version, help for every AMS
+command, native shell completion, discovery and the
+inspect/plan/show/apply/restore journey. Negative
+journeys exercise denied login, identity/qualification/plan rejection, malformed
+responses, failed readback and uncertain writes without mutation replay.
+
+The `Installed CLI integration` workflow selects its uv-installed Linux job at
+job level for `packages/cli/**`, `packages/pip/**`,
+`packages/pip-tenantadmin/**`, its own tooling/workflow, docs compiler inputs
+(`tooling/docs-compiler/**`, `docs-src/**`, `docs/sdk/**`), MCP contracts
+(`contracts/mcp/**`), and root package/lock, Python/lock and Ruff inputs. Backend-only changes skip the install job;
+the small `CLI integration` result check still runs and verifies applicability.
+Invalid selection or an applicable failed/cancelled/skipped job fails it.
+The job retains only sanitized consumer/JUnit results for seven days.
+
+All scenario records and credentials are synthetic. A test-only Python startup
+adapter preserves the canonical DEV AMS/tenant-admin origins for product
+validation while routing only those exact origins over real HTTP to an owned
+loopback fixture; other origins are refused before network access. Child
+processes use an isolated home and an allowlisted environment. The adapter is
+outside all shipped distributions. This boundary does not verify TLS or deployed
+service conformance. A verified save still exits 1 with `outcome="saved"` and
+`publication="unknown"`; publication and runtime acceptance remain unverified.
+
+Required-check activation is tracked separately in
+[services #724](https://github.com/healthcloudservices/healthcloud-services/issues/724).
+Require `CLI integration` only after the workflow is merged and both relevant
+and unrelated-change Actions results and effective settings are verified.

{healthcloud_cli-3.2.4 → healthcloud_cli-3.2.5}/README.md

@@ -38,6 +38,24 @@ uv run --frozen hc mcp tools list --audience patient
 uv run --frozen hc mcp patient get-patient --help
 ```
 
+AMS help and shell-completion discovery are credential-free and offline: they
+do not resolve root profiles, read target files, create SDK clients, or log in.
+You can inspect the group, a leaf command, and completion candidates before
+configuring credentials or a target:
+
+```bash
+uv run --frozen hc ams --help
+uv run --frozen hc ams inspect --help
+_HC_COMPLETE=bash_complete COMP_WORDS="hc ams in" COMP_CWORD=2 uv run --frozen hc
+_HC_COMPLETE=bash_complete COMP_WORDS="hc ams inspect --o" COMP_CWORD=3 uv run --frozen hc
+```
+
+Operational validation starts only when Click invokes an AMS leaf callback.
+`discover` then validates its explicit environment and tenant arguments; the
+other leaves require `--target-file` and apply the existing root, target, and
+authentication checks described below. Deferring preflight does not relax
+those safety requirements.
+
 The bundled tool manifest (`healthcloud_cli/contracts/mcp-tools.manifest.json`)
 is a copy of `packages/cli/contracts/mcp-tools.manifest.json`. Re-sync it
 after pulling manifest changes with:
@@ -423,3 +441,44 @@ then GET plan and GET agent. Restart the stateful simulation before repeating;
 stop it with Ctrl+C afterward. This is a source-backed synthetic failure fixture,
 not the deployed service. The required CI tests exercise both pre-commit and
 post-commit 503 over loopback HTTP without requiring a Postman login or installation.
+
+
+### Installed CLI integration
+
+From the repository root, with Python 3.14, uv 0.12.5 and Node.js available:
+
+```bash
+python -m unittest discover -s tooling/cli-integration -p 'test_*.py' -v
+python tooling/cli-integration/run.py --output /tmp/hc-cli-integration
+```
+
+The runner installs the SDK, tenant-admin SDK and CLI from the frozen CLI lock
+with `uv sync --no-editable` into a fresh temporary environment outside the
+checkout. It verifies installed module ownership, version, help for every AMS
+command, native shell completion, discovery and the
+inspect/plan/show/apply/restore journey. Negative
+journeys exercise denied login, identity/qualification/plan rejection, malformed
+responses, failed readback and uncertain writes without mutation replay.
+
+The `Installed CLI integration` workflow selects its uv-installed Linux job at
+job level for `packages/cli/**`, `packages/pip/**`,
+`packages/pip-tenantadmin/**`, its own tooling/workflow, docs compiler inputs
+(`tooling/docs-compiler/**`, `docs-src/**`, `docs/sdk/**`), MCP contracts
+(`contracts/mcp/**`), and root package/lock, Python/lock and Ruff inputs. Backend-only changes skip the install job;
+the small `CLI integration` result check still runs and verifies applicability.
+Invalid selection or an applicable failed/cancelled/skipped job fails it.
+The job retains only sanitized consumer/JUnit results for seven days.
+
+All scenario records and credentials are synthetic. A test-only Python startup
+adapter preserves the canonical DEV AMS/tenant-admin origins for product
+validation while routing only those exact origins over real HTTP to an owned
+loopback fixture; other origins are refused before network access. Child
+processes use an isolated home and an allowlisted environment. The adapter is
+outside all shipped distributions. This boundary does not verify TLS or deployed
+service conformance. A verified save still exits 1 with `outcome="saved"` and
+`publication="unknown"`; publication and runtime acceptance remain unverified.
+
+Required-check activation is tracked separately in
+[services #724](https://github.com/healthcloudservices/healthcloud-services/issues/724).
+Require `CLI integration` only after the workflow is merged and both relevant
+and unrelated-change Actions results and effective settings are verified.

healthcloud_cli-3.2.5/healthcloud_cli/ams/commands.py

@@ -0,0 +1,26 @@
+"""Legacy AMS command imports backed by one compatibility assembly."""
+
+from .compatibility import safe_errors
+from .group import create_ams_group
+
+ams = create_ams_group()
+discover = ams.commands["discover"]
+inspect = ams.commands["inspect"]
+plan = ams.commands["plan"]
+show = ams.commands["show"]
+apply = ams.commands["apply"]
+restore = ams.commands["restore"]
+ui = ams.commands["ui"]
+
+__all__ = [
+    "ams",
+    "apply",
+    "create_ams_group",
+    "discover",
+    "inspect",
+    "plan",
+    "restore",
+    "safe_errors",
+    "show",
+    "ui",
+]

healthcloud_cli-3.2.5/healthcloud_cli/ams/compatibility.py

@@ -0,0 +1,264 @@
+"""Compatibility command factories for the existing bounded AMS operations."""
+
+from __future__ import annotations
+
+import functools
+import subprocess
+from pathlib import Path
+from typing import Any
+from urllib.parse import quote, urlsplit
+
+import click
+
+from healthcloud import HCSDK
+from healthcloud.config import resolve_base_url
+from healthcloud.errors import HealthCloudHTTPError, HealthCloudNetworkError
+from healthcloud_tenantadmin.errors import NetworkError, SDKError
+
+from .auth import authenticated_sdk, selected_agent
+from .context import AmsDependencies, pass_ams, preflight_discovery, require_target
+from .output import digest, metadata, private_output, read_json
+from .tuning import (
+    apply_receipt,
+    create_receipt,
+    load_receipt,
+    plan_metadata,
+    reload_bound_plan,
+    restore_receipt,
+    validate_changes,
+)
+from .ui import build_ui_launch, ui_directory
+
+
+def safe_errors(function):
+    @functools.wraps(function)
+    def wrapped(*args, **kwargs):
+        try:
+            return function(*args, **kwargs)
+        except (HealthCloudHTTPError, SDKError) as exc:
+            status = getattr(exc, "status_code", None)
+            label = (
+                "conflict; refresh and review"
+                if status == 409
+                else "request denied or failed; stopped without identity fallback or replay"
+            )
+            raise click.ClickException(f"AMS HTTP {status if type(status) is int else 'error'}: {label}.") from None
+        except HealthCloudNetworkError, NetworkError:
+            raise click.ClickException(
+                "AMS transport failure; outcome may be unknown. No mutation replay; inspect before further action."
+            ) from None
+        except click.ClickException:
+            raise
+        except Exception:
+            raise click.ClickException(
+                "AMS operation refused: invalid local input or SDK response. No automatic replay."
+            ) from None
+
+    return wrapped
+
+
+def _run_process(*args: Any, **kwargs: Any) -> Any:
+    return subprocess.run(*args, **kwargs)
+
+
+def default_dependencies() -> AmsDependencies:
+    return AmsDependencies(
+        public_sdk_factory=HCSDK,
+        authenticated_sdk_factory=authenticated_sdk,
+        process_runner=_run_process,
+    )
+
+
+def create_discover_command(dependencies: AmsDependencies) -> click.Command:
+    @click.command("discover")
+    @click.option("--environment", type=click.Choice(["dev", "uat", "prod"]), required=True)
+    @click.option("--tenant-id", required=True)
+    @pass_ams
+    @safe_errors
+    def discover(invocation, environment, tenant_id):
+        """Public candidate IDs only; never infer or select an agent."""
+        preflight_discovery(invocation)
+        if not tenant_id.strip():
+            raise click.ClickException("Explicit tenant ID required.")
+        with dependencies.public_sdk_factory(environment=environment) as sdk:
+            agents = sdk.ams.get_agents_for_tenant(tenant_id)
+        if not isinstance(agents, dict) or any(
+            not isinstance(v, list) or any(not isinstance(i, str) or not i for i in v) for v in agents.values()
+        ):
+            raise click.ClickException("Unexpected public discovery response; no candidate selected.")
+        origin = urlsplit(resolve_base_url(environment, "ams"))
+        metadata(
+            dict(
+                environment=environment,
+                api_origin=f"{origin.scheme}://{origin.netloc}",
+                tenant_id=tenant_id,
+                candidates={role: agents.get(role, []) for role in ["public", "orchestrator"]},
+                selected_agent=None,
+            )
+        )
+
+    return discover
+
+
+def create_inspect_command(dependencies: AmsDependencies) -> click.Command:
+    @click.command("inspect")
+    @click.option("--out", type=click.Path(path_type=Path, dir_okay=False))
+    @pass_ams
+    @safe_errors
+    def inspect(invocation, out):
+        """Inspect identities, version and field hashes; optional private fields."""
+        target = require_target(invocation)
+
+        def read():
+            with dependencies.authenticated_sdk_factory(target) as sdk:
+                agent = selected_agent(sdk, target)
+            values = dict(instructions=agent.instructions, greetings=agent.greetings)
+            result = target.binding() | dict(
+                config_version=agent.config_version,
+                fields=sorted(values),
+                field_hashes={k: digest(v) for k, v in values.items()},
+                assigned_references={
+                    k: getattr(agent, k)
+                    for k in ["tool_ids", "skill_ids", "guardrail_ids", "policy_ids", "data_source_ids"]
+                },
+                qualification="operator_assertion_only",
+                runtime="unverified",
+            )
+            return result, values
+
+        if out:
+            with private_output(out) as write:
+                result, values = read()
+                write(result | dict(selected_values=values))
+        else:
+            result, _ = read()
+        metadata(result)
+
+    return inspect
+
+
+def create_plan_command(dependencies: AmsDependencies) -> click.Command:
+    @click.command("plan")
+    @click.option("--changes-file", required=True, type=click.Path(path_type=Path, dir_okay=False))
+    @click.option("--out", required=True, type=click.Path(path_type=Path, dir_okay=False))
+    @pass_ams
+    @safe_errors
+    def plan(invocation, changes_file, out):
+        """Create an exact reviewed plan from owner-only selected field values."""
+        target = require_target(invocation)
+        requested = read_json(changes_file, private=True)
+        validate_changes(requested)
+        with private_output(out) as write, dependencies.authenticated_sdk_factory(target) as sdk:
+            receipt = create_receipt(sdk, target, selected_agent(sdk, target), requested)
+            write(receipt)
+        metadata(
+            dict(
+                plan_id=receipt["plan_id"],
+                plan_hash=receipt["plan_hash"],
+                fields=sorted(requested),
+                base_config_version=receipt["base_config_version"],
+                qualification="operator_assertion_only",
+                runtime="unverified",
+            )
+        )
+
+    return plan
+
+
+def create_show_command(dependencies: AmsDependencies) -> click.Command:
+    @click.command("show")
+    @click.option("--receipt", required=True, type=click.Path(path_type=Path, dir_okay=False))
+    @click.option("--out", type=click.Path(path_type=Path, dir_okay=False))
+    @pass_ams
+    @safe_errors
+    def show(invocation, receipt, out):
+        """Reload the immutable server plan; free text only in a private diff."""
+        target = require_target(invocation)
+        record = load_receipt(receipt, target)
+
+        def read():
+            with dependencies.authenticated_sdk_factory(target) as sdk:
+                selected_agent(sdk, target)
+                return reload_bound_plan(sdk, target, record)
+
+        if out:
+            with private_output(out) as write:
+                plan = read()
+                write(
+                    dict(
+                        plan_id=plan.id,
+                        plan_hash=plan.plan_hash,
+                        changes={
+                            k: {side: v[side] for side in ["before", "after"]}
+                            for k, v in plan.plan_json["changes"].items()
+                        },
+                    )
+                )
+        else:
+            plan = read()
+        metadata(plan_metadata(plan))
+
+    return show
+
+
+def create_apply_command(dependencies: AmsDependencies) -> click.Command:
+    @click.command("apply")
+    @click.option("--receipt", required=True, type=click.Path(path_type=Path, dir_okay=False))
+    @click.option("--confirm-plan-hash", required=True)
+    @pass_ams
+    @safe_errors
+    def apply(invocation, receipt, confirm_plan_hash):
+        """Confirm the immutable plan hash; mutation is never automatically replayed."""
+        target = require_target(invocation)
+        record = load_receipt(receipt, target)
+        with dependencies.authenticated_sdk_factory(target) as sdk:
+            apply_receipt(sdk, target, record, confirm_plan_hash)
+
+    return apply
+
+
+def create_restore_command(dependencies: AmsDependencies) -> click.Command:
+    @click.command("restore")
+    @click.option("--receipt", required=True, type=click.Path(path_type=Path, dir_okay=False))
+    @click.option("--out", required=True, type=click.Path(path_type=Path, dir_okay=False))
+    @pass_ams
+    @safe_errors
+    def restore(invocation, receipt, out):
+        """Create a new reviewed inverse plan; intervening same-field edits block it."""
+        target = require_target(invocation)
+        record = load_receipt(receipt, target)
+        with private_output(out) as write, dependencies.authenticated_sdk_factory(target) as sdk:
+            restored = restore_receipt(sdk, target, record)
+            if restored["plan_id"] == record["plan_id"] or restored["plan_hash"] == record["plan_hash"]:
+                raise click.ClickException("Restore must be a new immutable server plan/hash.")
+            write(restored)
+        metadata(
+            dict(
+                plan_id=restored["plan_id"],
+                plan_hash=restored["plan_hash"],
+                fields=sorted(restored["requested"]),
+                base_config_version=restored["base_config_version"],
+                runtime="unverified",
+            )
+        )
+
+    return restore
+
+
+def create_ui_command(dependencies: AmsDependencies) -> click.Command:
+    @click.command("ui")
+    @click.option("--repo", required=True, type=click.Path(path_type=Path, file_okay=False))
+    @pass_ams
+    @safe_errors
+    def ui(invocation, repo):
+        """Run the existing local frontend; browser login is separate."""
+        target = require_target(invocation)
+        argv, env = build_ui_launch(target, repo)
+        metadata(
+            dict(route=f"/app/agents/{quote(target.agent_id, safe='')}", browser_login="separate", runtime="unverified")
+        )
+        result = dependencies.process_runner(argv, cwd=ui_directory(repo), env=env, shell=False, check=False)
+        if result.returncode:
+            raise click.ClickException("Frontend exited unsuccessfully.")
+
+    return ui

healthcloud_cli-3.2.5/healthcloud_cli/ams/context.py

@@ -0,0 +1,74 @@
+"""Typed invocation configuration and deferred AMS operational preflight."""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from contextlib import AbstractContextManager
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+import click
+
+from ..context import CliConfig, resolve_config
+from .target import AmsTarget, load_target
+
+
+@dataclass(frozen=True)
+class AmsDependencies:
+    """Process-local effect adapters used by one assembled AMS command tree."""
+
+    public_sdk_factory: Callable[..., Any]
+    authenticated_sdk_factory: Callable[[AmsTarget], AbstractContextManager[Any]]
+    process_runner: Callable[..., Any]
+
+
+@dataclass(frozen=True)
+class AmsContext:
+    """Configuration recorded for one AMS command invocation."""
+
+    root_config: CliConfig
+    target_file: Path | None
+    dependencies: AmsDependencies
+
+
+pass_ams = click.make_pass_decorator(AmsContext, ensure=False)
+
+
+def _check_root(invocation: AmsContext) -> CliConfig:
+    cfg = invocation.root_config
+    if cfg.access_token is not None or cfg.base_url is not None:
+        raise click.ClickException("AMS refuses root MCP credentials and base URL settings.")
+    try:
+        resolved = resolve_config(
+            cfg.access_token,
+            cfg.base_url,
+            cfg.profile,
+            cfg.output,
+            False,
+            cfg.verbose,
+        )
+    except click.UsageError, OSError, ValueError, TypeError:
+        raise click.ClickException("AMS root profile is unavailable or invalid; use an explicit target.") from None
+    if resolved.access_token is not None or resolved.base_url is not None:
+        raise click.ClickException("AMS refuses root MCP credentials and base URL settings.")
+    if resolved.output == "raw":
+        raise click.ClickException("Raw output is refused for AMS.")
+    return resolved
+
+
+def preflight_discovery(invocation: AmsContext) -> None:
+    """Validate root options for discovery without loading a target."""
+
+    _check_root(invocation)
+    if invocation.target_file is not None:
+        raise click.ClickException("Discover requires explicit environment/tenant flags, without a target file.")
+
+
+def require_target(invocation: AmsContext) -> AmsTarget:
+    """Validate root options and load the explicitly selected AMS target."""
+
+    _check_root(invocation)
+    if invocation.target_file is None:
+        raise click.ClickException("AMS requires an explicit --target-file.")
+    return load_target(invocation.target_file)

healthcloud_cli-3.2.5/healthcloud_cli/ams/group.py

@@ -0,0 +1,30 @@
+"""Fresh AMS Click group assembly."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import click
+
+from ..context import CliConfig
+from .compatibility import default_dependencies, safe_errors
+from .context import AmsContext, AmsDependencies
+from .registry import IMPLEMENTED_CHILDREN, register_children
+
+
+def create_ams_group(dependencies: AmsDependencies | None = None) -> click.Group:
+    dependencies = dependencies or default_dependencies()
+
+    @click.group("ams")
+    @click.option("--target-file", type=click.Path(path_type=Path, dir_okay=False), default=None)
+    @click.pass_context
+    @safe_errors
+    def group(ctx: click.Context, target_file: Path | None) -> None:
+        """Inspect and tune an explicitly selected deployed AMS agent."""
+        cfg = ctx.find_object(CliConfig)
+        if cfg is None:
+            raise click.ClickException("AMS requires root CLI configuration.")
+        ctx.obj = AmsContext(root_config=cfg, target_file=target_file, dependencies=dependencies)
+
+    register_children(group, dependencies, IMPLEMENTED_CHILDREN)
+    return group

healthcloud_cli-3.2.5/healthcloud_cli/ams/registry.py

@@ -0,0 +1,63 @@
+"""Static, atomic child registration for AMS command groups."""
+
+from __future__ import annotations
+
+from collections.abc import Callable, Sequence
+from dataclasses import dataclass
+
+import click
+
+from .compatibility import (
+    create_apply_command,
+    create_discover_command,
+    create_inspect_command,
+    create_plan_command,
+    create_restore_command,
+    create_show_command,
+    create_ui_command,
+)
+from .context import AmsDependencies
+
+CommandFactory = Callable[[AmsDependencies], click.Command]
+
+
+@dataclass(frozen=True)
+class ChildRegistration:
+    name: str
+    factory: CommandFactory
+
+
+IMPLEMENTED_CHILDREN = (
+    ChildRegistration("discover", create_discover_command),
+    ChildRegistration("inspect", create_inspect_command),
+    ChildRegistration("plan", create_plan_command),
+    ChildRegistration("show", create_show_command),
+    ChildRegistration("apply", create_apply_command),
+    ChildRegistration("restore", create_restore_command),
+    ChildRegistration("ui", create_ui_command),
+)
+
+
+def register_children(
+    parent: click.Group,
+    dependencies: AmsDependencies,
+    registrations: Sequence[ChildRegistration],
+) -> None:
+    names = [registration.name for registration in registrations]
+    if any(not isinstance(name, str) or not name for name in names):
+        raise ValueError("AMS child registration names must be non-empty strings")
+    if len(names) != len(set(names)):
+        raise ValueError("AMS child registry contains a duplicate name")
+    collisions = set(names) & set(parent.commands)
+    if collisions:
+        raise ValueError(f"AMS child registry would replace existing commands: {sorted(collisions)}")
+
+    commands = [registration.factory(dependencies) for registration in registrations]
+    for registration, command in zip(registrations, commands, strict=True):
+        if command.name != registration.name:
+            raise ValueError(
+                f"AMS child registration expected {registration.name!r}, factory returned {command.name!r}"
+            )
+
+    for registration, command in zip(registrations, commands, strict=True):
+        parent.add_command(command, registration.name)

{healthcloud_cli-3.2.4 → healthcloud_cli-3.2.5}/healthcloud_cli/cli.py

@@ -16,7 +16,7 @@ from typing import Any
 import click
 
 from . import manifest as manifest_module
-from .ams.commands import ams
+from .ams.group import create_ams_group
 from .context import CliConfig, resolve_config
 from .output import dispatch, dump_rpc_result, read_stdin
 from .params import ParamSpec, build_param_specs, make_click_option, merge_arguments, validate_final
@@ -256,13 +256,14 @@ def hc(
 ) -> None:
     """HealthCloud MCP gateway CLI."""
     if ctx.invoked_subcommand == "ams":
-        # Do not let profile parsing errors echo credential-bearing input.
-        if access_token is not None or base_url is not None:
-            raise click.ClickException("AMS refuses root MCP credentials and base URL settings.")
-        try:
-            ctx.obj = resolve_config(access_token, base_url, profile, output_mode, raw_flag, verbose)
-        except click.UsageError, OSError, ValueError, TypeError:
-            raise click.ClickException("AMS root profile is unavailable or invalid; use an explicit target.") from None
+        ctx.obj = CliConfig(
+            access_token=access_token,
+            base_url=base_url,
+            profile=profile,
+            environment="dev",
+            output="raw" if raw_flag else (output_mode or "pretty"),
+            verbose=verbose,
+        )
     else:
         ctx.obj = resolve_config(access_token, base_url, profile, output_mode, raw_flag, verbose)
 
@@ -291,7 +292,7 @@ def _build_mcp_group() -> click.Group:
 
 hc.add_command(_build_mcp_group())
 
-hc.add_command(ams)
+hc.add_command(create_ams_group())
 
 
 def main() -> None: