indico-cli 0.4.3__tar.gz → 0.5.0__tar.gz

indico_cli-0.5.0/.gitlab-ci.yml

@@ -0,0 +1,23 @@
+stages:
+  - publish
+
+# Publish to PyPI on git tag. The acc-py index (acc-py-repo.cern.ch) is a Nexus
+# group that proxies PyPI, so it serves this package from PyPI automatically
+# once its metadata cache refreshes. Publishing to the acc-py hosted repo is not
+# possible for a package that exists on PyPI (Nexus returns 409 Conflict), so
+# PyPI is the single source of truth.
+publish-pypi:
+  stage: publish
+  image: python:3.12-slim
+  rules:
+    - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+/
+  script:
+    - apt-get update && apt-get install -y git
+    - git fetch --tags
+    - pip install build twine
+    - python -m build
+    - twine upload --skip-existing dist/*
+  variables:
+    TWINE_USERNAME: __token__
+    TWINE_PASSWORD: $PYPI_API_TOKEN
+    GIT_DEPTH: 0

{indico_cli-0.4.3 → indico_cli-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: indico-cli
-Version: 0.4.3
+Version: 0.5.0
 Summary: CLI tool for interacting with Indico event management systems
 Project-URL: Repository, https://gitlab.cern.ch/cern-agent-skills/indico-cli
 License: MIT
@@ -50,6 +50,11 @@ Or use the `configure` command to save credentials:
 indico-cli configure --base-url https://indico.cern.ch --token indp_...
 ```
 
+Saved credentials live in `$XDG_CONFIG_HOME/indico-cli/config.json` (or
+`~/.config/indico-cli/config.json` when `XDG_CONFIG_HOME` is unset), written with
+owner-only permissions (`0600`). Inspect or reset them with `indico-cli config
+show`, `indico-cli config path`, and `indico-cli config clear`.
+
 API tokens can be generated at `<your-indico-url>/user/preferences/api`. Required scopes: `read:legacy_api`, `write:legacy_api` (for create operations), `read:user` (optional).
 
 ## Usage
@@ -117,6 +122,9 @@ indico-cli create-event-with-agenda --title "Workshop" --category-id 4648 \
 | Command | Description |
 |---------|-------------|
 | `configure` | Save Indico base URL and API token, and verify the connection. |
+| `config show` | Show the saved base URL and a masked token, plus the config file path. |
+| `config path` | Print the path to the config file. |
+| `config clear` | Delete the saved configuration (use `--yes` to skip the prompt). |
 | `user-info` | Show the current user's name, email, and admin status. |
 | `search-events` | List events in a category, with optional date range and public-only filter. |
 | `search-by-term` | Full-text search across categories, events, contributions, attachments, and notes. |

{indico_cli-0.4.3 → indico_cli-0.5.0}/README.md

@@ -27,6 +27,11 @@ Or use the `configure` command to save credentials:
 indico-cli configure --base-url https://indico.cern.ch --token indp_...
 ```
 
+Saved credentials live in `$XDG_CONFIG_HOME/indico-cli/config.json` (or
+`~/.config/indico-cli/config.json` when `XDG_CONFIG_HOME` is unset), written with
+owner-only permissions (`0600`). Inspect or reset them with `indico-cli config
+show`, `indico-cli config path`, and `indico-cli config clear`.
+
 API tokens can be generated at `<your-indico-url>/user/preferences/api`. Required scopes: `read:legacy_api`, `write:legacy_api` (for create operations), `read:user` (optional).
 
 ## Usage
@@ -94,6 +99,9 @@ indico-cli create-event-with-agenda --title "Workshop" --category-id 4648 \
 | Command | Description |
 |---------|-------------|
 | `configure` | Save Indico base URL and API token, and verify the connection. |
+| `config show` | Show the saved base URL and a masked token, plus the config file path. |
+| `config path` | Print the path to the config file. |
+| `config clear` | Delete the saved configuration (use `--yes` to skip the prompt). |
 | `user-info` | Show the current user's name, email, and admin status. |
 | `search-events` | List events in a category, with optional date range and public-only filter. |
 | `search-by-term` | Full-text search across categories, events, contributions, attachments, and notes. |

indico_cli-0.5.0/docs/superpowers/plans/2026-06-04-secure-config-storage.md

@@ -0,0 +1,543 @@
+# Secure Config Storage + `config` Commands Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Store the Indico token+URL in a generic config file with owner-only permissions, and add `config show/path/clear` commands to inspect and manage it.
+
+**Architecture:** Extract on-disk config persistence from `cli.py` into a new focused module `indico_cli/config.py` that honors `XDG_CONFIG_HOME` and writes the file as `0600` (dir `0700`). `cli.py` imports from it and gains a `config` Click group. Credential resolution (args -> env -> file) is unchanged.
+
+**Tech Stack:** Python 3.12, Click 8, pytest, Click `CliRunner` for CLI tests.
+
+**Linting:** Before every Python commit, run `uvx ruff check indico_cli tests` and fix anything it reports. The repo is not typed (no `[tool.mypy]`, no type-checking config), so mypy is skipped. Docs-only commits (Task 4) need no lint.
+
+---
+
+## File Structure
+
+- **Create** `indico_cli/config.py` — on-disk credential config: path resolution, load/save (with permission hardening), clear, token masking. Single responsibility.
+- **Create** `tests/test_config.py` — unit tests for `config.py` (tmp `XDG_CONFIG_HOME`).
+- **Create** `tests/test_cli_config.py` — Click `CliRunner` tests for the `config` group.
+- **Modify** `indico_cli/cli.py` — import from `config.py`, delete the inline config code, add the `config` command group.
+- **Modify** `README.md` — document the `config` commands and file permissions.
+- **Modify** `skills/indico-skill/SKILL.md` — mention `config show/path/clear`.
+
+---
+
+## Task 1: Create the `config` module (with tests)
+
+**Files:**
+- Create: `indico_cli/config.py`
+- Test: `tests/test_config.py`
+
+- [ ] **Step 1: Write the failing tests**
+
+Create `tests/test_config.py`:
+
+```python
+"""Unit tests for indico_cli.config on-disk credential storage."""
+
+import os
+import stat
+from pathlib import Path
+
+import pytest
+
+from indico_cli import config
+
+
+@pytest.fixture
+def tmp_xdg(tmp_path, monkeypatch):
+    """Point config storage at a temp XDG_CONFIG_HOME."""
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path))
+    return tmp_path
+
+
+def test_get_config_path_honors_xdg(tmp_xdg):
+    assert config.get_config_path() == tmp_xdg / "indico-cli" / "config.json"
+
+
+def test_get_config_path_defaults_to_home(monkeypatch):
+    monkeypatch.delenv("XDG_CONFIG_HOME", raising=False)
+    assert config.get_config_path() == Path.home() / ".config" / "indico-cli" / "config.json"
+
+
+def test_save_then_load_roundtrips(tmp_xdg):
+    config.save_config("https://indico.cern.ch", "indp_secrettoken")
+    assert config.load_config() == {
+        "base_url": "https://indico.cern.ch",
+        "token": "indp_secrettoken",
+    }
+
+
+@pytest.mark.skipif(os.name == "nt", reason="POSIX permissions only")
+def test_save_sets_owner_only_permissions(tmp_xdg):
+    config.save_config("https://indico.cern.ch", "indp_secrettoken")
+    config_file = config.get_config_path()
+    assert stat.S_IMODE(config_file.stat().st_mode) == 0o600
+    assert stat.S_IMODE(config_file.parent.stat().st_mode) == 0o700
+
+
+def test_load_returns_empty_when_missing(tmp_xdg):
+    assert config.load_config() == {}
+
+
+def test_load_returns_empty_on_corrupt_json(tmp_xdg):
+    config_file = config.get_config_path()
+    config_file.parent.mkdir(parents=True, exist_ok=True)
+    config_file.write_text("{not valid json")
+    assert config.load_config() == {}
+
+
+def test_clear_removes_file_and_returns_true(tmp_xdg):
+    config.save_config("https://indico.cern.ch", "indp_secrettoken")
+    assert config.clear_config() is True
+    assert not config.get_config_path().exists()
+
+
+def test_clear_returns_false_when_nothing(tmp_xdg):
+    assert config.clear_config() is False
+
+
+def test_mask_token_empty():
+    assert config.mask_token("") == "(none)"
+
+
+def test_mask_token_short():
+    assert config.mask_token("indp_123") == "****"
+
+
+def test_mask_token_normal():
+    assert config.mask_token("indp_abcdefgh1234") == "indp_...1234"
+```
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `uv run pytest tests/test_config.py -v`
+Expected: FAIL — `ModuleNotFoundError: No module named 'indico_cli.config'` (or `AttributeError`).
+
+- [ ] **Step 3: Write the module**
+
+Create `indico_cli/config.py`:
+
+```python
+#!/usr/bin/env python3
+"""On-disk credential configuration for indico-cli.
+
+Stores the Indico base URL and API token in a generic config file
+(``$XDG_CONFIG_HOME/indico-cli/config.json`` or
+``~/.config/indico-cli/config.json``). The file holds a token, so it is written
+with owner-only permissions (0600).
+"""
+
+import json
+import os
+from pathlib import Path
+
+APP_DIR_NAME = "indico-cli"
+CONFIG_FILENAME = "config.json"
+
+
+def get_config_path() -> Path:
+    """Return the config file path, honoring XDG_CONFIG_HOME.
+
+    Computed on each call so runtime/test environment changes are respected.
+    Falls back to ~/.config when XDG_CONFIG_HOME is unset (backward compatible).
+    """
+    base = os.environ.get("XDG_CONFIG_HOME")
+    config_home = Path(base) if base else Path.home() / ".config"
+    return config_home / APP_DIR_NAME / CONFIG_FILENAME
+
+
+def load_config() -> dict:
+    """Load saved configuration, returning an empty dict on any failure."""
+    config_file = get_config_path()
+    if config_file.exists():
+        try:
+            return json.loads(config_file.read_text())
+        except (json.JSONDecodeError, OSError):
+            return {}
+    return {}
+
+
+def save_config(base_url: str, token: str) -> None:
+    """Persist configuration with owner-only permissions (dir 0700, file 0600)."""
+    config_file = get_config_path()
+    config_dir = config_file.parent
+    config_dir.mkdir(parents=True, exist_ok=True)
+    config_file.write_text(
+        json.dumps({"base_url": base_url, "token": token}, indent=2)
+    )
+    # Best-effort permission hardening. A filesystem without POSIX permission
+    # bits (e.g. some Windows setups) must not crash the save.
+    try:
+        os.chmod(config_dir, 0o700)
+        os.chmod(config_file, 0o600)
+    except OSError:
+        pass
+
+
+def clear_config() -> bool:
+    """Delete the config file. Return True if a file was removed."""
+    config_file = get_config_path()
+    if config_file.exists():
+        config_file.unlink()
+        return True
+    return False
+
+
+def mask_token(token: str) -> str:
+    """Return a masked representation of a token, safe for display."""
+    if not token:
+        return "(none)"
+    if len(token) <= 8:
+        return "****"
+    return f"{token[:5]}...{token[-4:]}"
+```
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `uv run pytest tests/test_config.py -v`
+Expected: PASS (all tests; the permissions test is skipped only on Windows).
+
+- [ ] **Step 5: Lint, then commit**
+
+Run: `uvx ruff check indico_cli tests` (fix any reported issues, then re-run until clean).
+
+```bash
+git add indico_cli/config.py tests/test_config.py
+git commit -m "feat: add config module with XDG path and 0600 permissions"
+```
+
+---
+
+## Task 2: Wire `cli.py` to the config module
+
+Replace the inline config code in `cli.py` with imports from `indico_cli.config`, keeping `configure` and `get_client` behavior identical. This is a refactor verified by the existing test suite.
+
+**Files:**
+- Modify: `indico_cli/cli.py` (lines ~8, 15-32, 94-95)
+
+- [ ] **Step 1: Remove the now-unused `pathlib` import**
+
+In `indico_cli/cli.py`, delete this line (Task 1's module owns path handling now; `click.Path` is unrelated):
+
+```python
+from pathlib import Path
+```
+
+- [ ] **Step 2: Replace the inline config block with an import**
+
+Delete this entire block (currently lines 15-32):
+
+```python
+CONFIG_DIR = Path.home() / ".config" / "indico-cli"
+CONFIG_FILE = CONFIG_DIR / "config.json"
+
+
+def load_config() -> dict:
+    """Load saved configuration from disk, returning empty dict on failure."""
+    if CONFIG_FILE.exists():
+        try:
+            return json.loads(CONFIG_FILE.read_text())
+        except (json.JSONDecodeError, OSError):
+            return {}
+    return {}
+
+
+def save_config(base_url: str, token: str) -> None:
+    """Persist configuration to ~/.config/indico-cli/config.json."""
+    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+    CONFIG_FILE.write_text(json.dumps({"base_url": base_url, "token": token}, indent=2))
+```
+
+Replace it with this import (place it just below `from indico_cli.indico_api import IndicoAPI, IndicoClient`):
+
+```python
+from indico_cli.config import (
+    clear_config,
+    get_config_path,
+    load_config,
+    mask_token,
+    save_config,
+)
+```
+
+- [ ] **Step 3: Update the `configure` command's saved-path message**
+
+In the `configure` command, replace:
+
+```python
+        save_config(base_url, token)
+        click.echo(f"Configuration saved to {CONFIG_FILE}")
+```
+
+with:
+
+```python
+        save_config(base_url, token)
+        click.echo(f"Configuration saved to {get_config_path()}")
+```
+
+- [ ] **Step 4: Run the full test suite**
+
+Run: `uv run pytest -v`
+Expected: PASS — all existing tests plus `tests/test_config.py`. No import errors.
+
+- [ ] **Step 5: Smoke-test the CLI loads**
+
+Run: `uv run indico-cli --help`
+Expected: the help text lists existing commands and exits 0 (no traceback).
+
+- [ ] **Step 6: Lint, then commit**
+
+Run: `uvx ruff check indico_cli tests` (fix any reported issues, then re-run until clean).
+
+```bash
+git add indico_cli/cli.py
+git commit -m "refactor: use indico_cli.config for credential persistence"
+```
+
+---
+
+## Task 3: Add the `config` command group (with tests)
+
+**Files:**
+- Modify: `indico_cli/cli.py` (add group after the `configure` command, before `user-info`)
+- Test: `tests/test_cli_config.py`
+
+- [ ] **Step 1: Write the failing CLI tests**
+
+Create `tests/test_cli_config.py`:
+
+```python
+"""CLI tests for the `config` command group."""
+
+import json
+
+import pytest
+from click.testing import CliRunner
+
+from indico_cli.cli import cli
+
+
+@pytest.fixture
+def tmp_xdg(tmp_path, monkeypatch):
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path))
+    monkeypatch.delenv("INDICO_BASE_URL", raising=False)
+    monkeypatch.delenv("INDICO_API_TOKEN", raising=False)
+    return tmp_path
+
+
+def _write_config(tmp_path, base_url="https://indico.cern.ch", token="indp_abcdefgh1234"):
+    config_file = tmp_path / "indico-cli" / "config.json"
+    config_file.parent.mkdir(parents=True, exist_ok=True)
+    config_file.write_text(json.dumps({"base_url": base_url, "token": token}))
+    return config_file
+
+
+def test_config_show_masks_token(tmp_xdg):
+    _write_config(tmp_xdg)
+    result = CliRunner().invoke(cli, ["config", "show"])
+    assert result.exit_code == 0
+    assert "indp_...1234" in result.output
+    assert "indp_abcdefgh1234" not in result.output
+    assert "https://indico.cern.ch" in result.output
+
+
+def test_config_show_no_config(tmp_xdg):
+    result = CliRunner().invoke(cli, ["config", "show"])
+    assert result.exit_code == 0
+    assert "No saved configuration" in result.output
+
+
+def test_config_show_notes_env_override(tmp_xdg, monkeypatch):
+    _write_config(tmp_xdg)
+    monkeypatch.setenv("INDICO_API_TOKEN", "indp_envtoken")
+    result = CliRunner().invoke(cli, ["config", "show"])
+    assert result.exit_code == 0
+    assert "INDICO_API_TOKEN" in result.output
+    assert "override" in result.output
+
+
+def test_config_path_prints_path(tmp_xdg):
+    result = CliRunner().invoke(cli, ["config", "path"])
+    assert result.exit_code == 0
+    assert str(tmp_xdg / "indico-cli" / "config.json") in result.output
+
+
+def test_config_clear_with_yes(tmp_xdg):
+    _write_config(tmp_xdg)
+    result = CliRunner().invoke(cli, ["config", "clear", "--yes"])
+    assert result.exit_code == 0
+    assert not (tmp_xdg / "indico-cli" / "config.json").exists()
+
+
+def test_config_clear_nothing(tmp_xdg):
+    result = CliRunner().invoke(cli, ["config", "clear", "--yes"])
+    assert result.exit_code == 0
+    assert "Nothing to clear" in result.output
+
+
+def test_config_clear_aborts_without_confirmation(tmp_xdg):
+    _write_config(tmp_xdg)
+    result = CliRunner().invoke(cli, ["config", "clear"], input="n\n")
+    assert result.exit_code != 0  # click confirm abort -> non-zero exit
+    assert (tmp_xdg / "indico-cli" / "config.json").exists()
+```
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `uv run pytest tests/test_cli_config.py -v`
+Expected: FAIL — `config` is not a command (Click reports "No such command 'config'").
+
+- [ ] **Step 3: Expand the config import, then add the `config` group to `cli.py`**
+
+First, widen the existing import line in `indico_cli/cli.py` (Task 2 left it importing only the three names it used) to also bring in `clear_config` and `mask_token`:
+
+```python
+from indico_cli.config import (
+    clear_config,
+    get_config_path,
+    load_config,
+    mask_token,
+    save_config,
+)
+```
+
+Then insert this block immediately after the `configure` command function (after its final line, before the `user-info` command). It uses `load_config`, `get_config_path`, `clear_config`, `mask_token` and the already-imported `os`/`click`:
+
+```python
+@cli.group("config")
+def config_group():
+    """Inspect and manage saved Indico CLI configuration."""
+
+
+@config_group.command("show")
+def config_show():
+    """Show saved configuration (token masked)."""
+    cfg = load_config()
+    path = get_config_path()
+    if not cfg:
+        click.echo(f"No saved configuration at {path}")
+    else:
+        click.echo(f"Config file:  {path}")
+        click.echo(f"Base URL:     {cfg.get('base_url', '(none)')}")
+        click.echo(f"Token:        {mask_token(cfg.get('token', ''))}")
+    overrides = [
+        name for name in ("INDICO_BASE_URL", "INDICO_API_TOKEN") if os.getenv(name)
+    ]
+    if overrides:
+        click.echo(
+            f"Note: {' and '.join(overrides)} set in environment; "
+            "these override the config file."
+        )
+
+
+@config_group.command("path")
+def config_path():
+    """Print the path to the config file."""
+    path = get_config_path()
+    state = "exists" if path.exists() else "does not exist"
+    click.echo(f"{path} ({state})")
+
+
+@config_group.command("clear")
+@click.option("--yes", "-y", is_flag=True, default=False, help="Skip the confirmation prompt")
+def config_clear(yes):
+    """Delete the saved configuration file."""
+    path = get_config_path()
+    if not path.exists():
+        click.echo("Nothing to clear")
+        return
+    if not yes:
+        click.confirm(f"Delete saved configuration at {path}?", abort=True)
+    clear_config()
+    click.echo(f"Removed {path}")
+```
+
+- [ ] **Step 4: Run the CLI tests to verify they pass**
+
+Run: `uv run pytest tests/test_cli_config.py -v`
+Expected: PASS (all 7 tests).
+
+- [ ] **Step 5: Run the full suite**
+
+Run: `uv run pytest -v`
+Expected: PASS — everything green.
+
+- [ ] **Step 6: Lint, then commit**
+
+Run: `uvx ruff check indico_cli tests` (fix any reported issues, then re-run until clean).
+
+```bash
+git add indico_cli/cli.py tests/test_cli_config.py
+git commit -m "feat: add config show/path/clear commands"
+```
+
+---
+
+## Task 4: Documentation
+
+**Files:**
+- Modify: `README.md`
+- Modify: `skills/indico-skill/SKILL.md`
+
+- [ ] **Step 1: Update the README commands table**
+
+In `README.md`, in the "All Commands" table, add these three rows immediately after the `configure` row:
+
+```markdown
+| `config show` | Show the saved base URL and a masked token, plus the config file path. |
+| `config path` | Print the path to the config file. |
+| `config clear` | Delete the saved configuration (use `--yes` to skip the prompt). |
+```
+
+- [ ] **Step 2: Add a permissions/location note to the README Configuration section**
+
+In `README.md`, append this paragraph to the "Configuration" section (after the `configure` example block, before the "API tokens can be generated..." line):
+
+```markdown
+Saved credentials live in `$XDG_CONFIG_HOME/indico-cli/config.json` (or
+`~/.config/indico-cli/config.json` when `XDG_CONFIG_HOME` is unset), written with
+owner-only permissions (`0600`). Inspect or reset them with `indico-cli config
+show`, `indico-cli config path`, and `indico-cli config clear`.
+```
+
+- [ ] **Step 3: Update SKILL.md Configure section**
+
+In `skills/indico-skill/SKILL.md`, immediately after the line
+`Environment variables \`INDICO_BASE_URL\` and \`INDICO_API_TOKEN\` override the config file.`,
+add:
+
+```markdown
+
+Inspect or reset saved credentials with `uvx indico-cli config show` (token
+masked), `uvx indico-cli config path`, or `uvx indico-cli config clear`. The
+config file is written with `0600` permissions.
+```
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add README.md skills/indico-skill/SKILL.md
+git commit -m "docs: document config show/path/clear and file permissions"
+```
+
+---
+
+## Self-Review
+
+**Spec coverage:**
+- Harden permissions (dir 0700, file 0600) -> Task 1 `save_config` + permission test.
+- `config` group `show`/`path`/`clear` -> Task 3.
+- Extract dedicated module -> Task 1 (`config.py`) + Task 2 (wire-in).
+- Honor `XDG_CONFIG_HOME` -> Task 1 `get_config_path` + test.
+- `mask_token` format -> Task 1 + tests.
+- `config show` env-override note -> Task 3 + `test_config_show_notes_env_override`.
+- No-file / nothing-to-clear exit-0 states -> Task 3 + tests.
+- Docs (README + SKILL.md) -> Task 4.
+- Resolution unchanged (args -> env -> file) -> Task 2 verified by full suite.
+
+**Placeholder scan:** none — every code/test step shows complete content.
+
+**Type/name consistency:** `get_config_path`, `load_config`, `save_config`, `clear_config`, `mask_token` are defined in Task 1 and used with identical names in Tasks 2-3. Click group function `config_group` (command name `config`) does not shadow the imported names. `--yes/-y` flag matches between command and test.

indico_cli-0.5.0/docs/superpowers/specs/2026-06-04-secure-config-storage-design.md

@@ -0,0 +1,137 @@
+# Secure config storage + `config` management commands
+
+**Date:** 2026-06-04
+**Status:** Approved (design)
+
+## Problem
+
+`indico-cli` already persists credentials to a generic config file
+(`~/.config/indico-cli/config.json`) via the `configure` command, and resolves
+credentials in the order CLI args -> env vars -> config file. Two gaps remain:
+
+1. **Security:** the file is written with the default umask (typically `0644`,
+   world-readable). A plaintext API token should not sit world-readable.
+2. **No management surface:** there is no way to inspect what is stored, find the
+   file path, or reset the saved config without manually opening the file.
+
+## Scope
+
+In scope:
+1. Harden permissions of the saved config (dir `0700`, file `0600`).
+2. Add a `config` command group: `show`, `path`, `clear`.
+3. Extract config persistence into a dedicated, unit-testable module.
+4. Honor `XDG_CONFIG_HOME` for the config location (backward compatible).
+
+Out of scope (explicitly deferred):
+- `.env` auto-loading (no `python-dotenv`).
+- Named profiles / multiple Indico instances.
+- Storing additional defaults (category-id, download dir, timezone).
+
+## Design
+
+### 1. New module `indico_cli/config.py`
+
+Today `CONFIG_DIR`, `CONFIG_FILE`, `load_config`, and `save_config` live inside
+`cli.py`. Move them into a focused module whose single purpose is "manage the
+on-disk credential config." This keeps `cli.py` about command wiring, follows the
+"use util modules, do not repeat code" rule, and makes the logic testable in
+isolation. (`utils.py` is the wrong home: it builds Indico API request payloads.)
+
+Public functions:
+
+- `get_config_path() -> Path`
+  Computed on each call:
+  `Path(os.environ.get("XDG_CONFIG_HOME", Path.home() / ".config")) / "indico-cli" / "config.json"`.
+  Reading the environment per call (not at import) keeps it backward compatible
+  (unset -> today's `~/.config/...`) and makes tests trivial via a tmp
+  `XDG_CONFIG_HOME`.
+
+- `load_config() -> dict`
+  Unchanged behavior: returns the parsed dict, or `{}` on missing file, JSON
+  decode error, or `OSError`.
+
+- `save_config(base_url: str, token: str) -> None`
+  Creates the config dir, writes the JSON, then sets dir mode `0700` and file
+  mode `0600`. The permission steps are best-effort: wrapped so a filesystem that
+  does not support POSIX permissions cannot crash the save.
+
+- `clear_config() -> bool`
+  Deletes the config file if present. Returns `True` if a file was removed,
+  `False` if there was nothing to remove.
+
+- `mask_token(token: str) -> str`
+  - empty/`None` -> `(none)`
+  - length <= 8 -> `****`
+  - otherwise -> `<first 5 chars>...<last 4 chars>` (e.g. `indp_...a1b2`).
+  Uses literal `...`, no unicode ellipsis.
+
+`cli.py` imports these. `configure` and `get_client` keep identical behavior and
+gain the hardened permissions for free (both go through `save_config` /
+`load_config`).
+
+### 2. `config` command group
+
+A Click group `config` with three subcommands:
+
+- `indico-cli config show`
+  Loads the stored config and prints `base_url` and the **masked** token, plus
+  the config file path. If no config file exists: print
+  `No saved configuration at <path>` and exit 0 (this is a valid state, not an
+  error). If `INDICO_BASE_URL` or `INDICO_API_TOKEN` is set in the environment,
+  print a one-line note that env vars override the file.
+
+- `indico-cli config path`
+  Prints the absolute config file path and whether it currently exists.
+  Script-friendly.
+
+- `indico-cli config clear`
+  Deletes the config file. Prompts for confirmation (`Are you sure?`) unless
+  `--yes/-y` is passed. If nothing is stored: print `Nothing to clear` and
+  exit 0.
+
+### 3. Security
+
+The token at rest moves from `0644` (world-readable) to `0600`; the containing
+directory to `0700`. `configure` inherits this automatically because it calls
+`save_config`.
+
+### 4. Testing (TDD)
+
+`tests/test_config.py` (unit, against `config.py`, using a tmp `XDG_CONFIG_HOME`):
+- save then load round-trips `base_url` and `token`
+- after `save_config`, file mode is `0600` and dir mode is `0700`
+- `clear_config` removes the file and returns `True`; returns `False` when
+  nothing is present
+- `mask_token`: empty, short (<=8), and normal-length cases
+- `get_config_path` honors `XDG_CONFIG_HOME` when set and falls back to
+  `~/.config` when unset
+
+`tests/test_cli_config.py` (Click `CliRunner`):
+- `config show`: masked token output; no-file message; env-override note when
+  env vars set
+- `config path`: prints the path
+- `config clear`: with `--yes` removes; without `--yes` respects confirmation;
+  nothing-to-clear message
+
+POSIX permission assertions are guarded for non-POSIX platforms (skip if the
+filesystem cannot represent the modes).
+
+### 5. Docs
+
+- `README.md`: add `config show`, `config path`, `config clear` rows to the
+  commands table; add a sentence to the Configuration section noting the `0600`
+  file permission and `XDG_CONFIG_HOME` support.
+- `skills/indico-skill/SKILL.md`: mention `config show` / `config path` /
+  `config clear` in the Configure section.
+
+## Acceptance criteria
+
+- `indico-cli configure ...` writes `config.json` with mode `0600` in a dir with
+  mode `0700`.
+- `indico-cli config show` prints the base URL and a masked token, or a clear
+  no-config message; never prints the full token.
+- `indico-cli config path` prints the resolved path (honoring `XDG_CONFIG_HOME`).
+- `indico-cli config clear` removes the saved config, with confirmation unless
+  `--yes`.
+- Existing credential resolution (args -> env -> file) is unchanged.
+- New unit and CLI tests pass; existing tests still pass.

{indico_cli-0.4.3 → indico_cli-0.5.0}/indico_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.4.3'
-__version_tuple__ = version_tuple = (0, 4, 3)
+__version__ = version = '0.5.0'
+__version_tuple__ = version_tuple = (0, 5, 0)
 
 __commit_id__ = commit_id = None

{indico_cli-0.4.3 → indico_cli-0.5.0}/indico_cli/cli.py

@@ -5,31 +5,18 @@ import asyncio
 import json
 import os
 import sys
-from pathlib import Path
 from typing import Optional
 
 import click
 
 from indico_cli.indico_api import IndicoAPI, IndicoClient
-
-CONFIG_DIR = Path.home() / ".config" / "indico-cli"
-CONFIG_FILE = CONFIG_DIR / "config.json"
-
-
-def load_config() -> dict:
-    """Load saved configuration from disk, returning empty dict on failure."""
-    if CONFIG_FILE.exists():
-        try:
-            return json.loads(CONFIG_FILE.read_text())
-        except (json.JSONDecodeError, OSError):
-            return {}
-    return {}
-
-
-def save_config(base_url: str, token: str) -> None:
-    """Persist configuration to ~/.config/indico-cli/config.json."""
-    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
-    CONFIG_FILE.write_text(json.dumps({"base_url": base_url, "token": token}, indent=2))
+from indico_cli.config import (
+    clear_config,
+    get_config_path,
+    load_config,
+    mask_token,
+    save_config,
+)
 
 
 def get_client(base_url: Optional[str], token: Optional[str]) -> IndicoClient:
@@ -92,13 +79,61 @@ def configure(base_url, token):
         click.echo("Connection successful!")
         click.echo(result)
         save_config(base_url, token)
-        click.echo(f"Configuration saved to {CONFIG_FILE}")
+        click.echo(f"Configuration saved to {get_config_path()}")
     except Exception as error:
         click.echo(f"Connection test failed: {error}", err=True)
         click.echo("Check that your token starts with 'indp_' and has the correct scopes.", err=True)
         sys.exit(1)
 
 
+@cli.group("config")
+def config_group():
+    """Inspect and manage saved Indico CLI configuration."""
+
+
+@config_group.command("show")
+def config_show():
+    """Show saved configuration (token masked)."""
+    cfg = load_config()
+    path = get_config_path()
+    if not cfg:
+        click.echo(f"No saved configuration at {path}")
+    else:
+        click.echo(f"Config file:  {path}")
+        click.echo(f"Base URL:     {cfg.get('base_url', '(none)')}")
+        click.echo(f"Token:        {mask_token(cfg.get('token', ''))}")
+        overrides = [
+            name for name in ("INDICO_BASE_URL", "INDICO_API_TOKEN") if os.getenv(name)
+        ]
+        if overrides:
+            click.echo(
+                f"Note: {' and '.join(overrides)} set in environment; "
+                "these override the config file."
+            )
+
+
+@config_group.command("path")
+def config_path():
+    """Print the path to the config file."""
+    path = get_config_path()
+    state = "exists" if path.exists() else "does not exist"
+    click.echo(f"{path} ({state})")
+
+
+@config_group.command("clear")
+@click.option("--yes", "-y", is_flag=True, default=False, help="Skip the confirmation prompt")
+def config_clear(yes):
+    """Delete the saved configuration file."""
+    path = get_config_path()
+    if not path.exists():
+        click.echo("Nothing to clear")
+        return
+    if not yes:
+        click.confirm(f"Delete saved configuration at {path}?", abort=True)
+    clear_config()
+    click.echo(f"Removed {path}")
+
+
 @cli.command("user-info")
 @click.pass_context
 def user_info(ctx):

indico_cli-0.5.0/indico_cli/config.py

@@ -0,0 +1,72 @@
+#!/usr/bin/env python3
+"""On-disk credential configuration for indico-cli.
+
+Stores the Indico base URL and API token in a generic config file
+(``$XDG_CONFIG_HOME/indico-cli/config.json`` or
+``~/.config/indico-cli/config.json``). The file holds a token, so it is written
+with owner-only permissions (0600).
+"""
+
+import json
+import os
+from pathlib import Path
+
+APP_DIR_NAME = "indico-cli"
+CONFIG_FILENAME = "config.json"
+
+
+def get_config_path() -> Path:
+    """Return the config file path, honoring XDG_CONFIG_HOME.
+
+    Computed on each call so runtime/test environment changes are respected.
+    Falls back to ~/.config when XDG_CONFIG_HOME is unset (backward compatible).
+    """
+    base = os.environ.get("XDG_CONFIG_HOME")
+    config_home = Path(base) if base else Path.home() / ".config"
+    return config_home / APP_DIR_NAME / CONFIG_FILENAME
+
+
+def load_config() -> dict:
+    """Load saved configuration, returning an empty dict on any failure."""
+    config_file = get_config_path()
+    if config_file.exists():
+        try:
+            return json.loads(config_file.read_text())
+        except (json.JSONDecodeError, OSError):
+            return {}
+    return {}
+
+
+def save_config(base_url: str, token: str) -> None:
+    """Persist configuration with owner-only permissions (dir 0700, file 0600)."""
+    config_file = get_config_path()
+    config_dir = config_file.parent
+    config_dir.mkdir(parents=True, exist_ok=True)
+    config_file.write_text(
+        json.dumps({"base_url": base_url, "token": token}, indent=2)
+    )
+    # Best-effort permission hardening. A filesystem without POSIX permission
+    # bits (e.g. some Windows setups) must not crash the save.
+    try:
+        os.chmod(config_dir, 0o700)
+        os.chmod(config_file, 0o600)
+    except OSError:
+        pass
+
+
+def clear_config() -> bool:
+    """Delete the config file. Return True if a file was removed."""
+    config_file = get_config_path()
+    if config_file.exists():
+        config_file.unlink()
+        return True
+    return False
+
+
+def mask_token(token: str) -> str:
+    """Return a masked representation of a token, safe for display."""
+    if not token:
+        return "(none)"
+    if len(token) <= 8:
+        return "****"
+    return f"{token[:5]}...{token[-4:]}"

{indico_cli-0.4.3 → indico_cli-0.5.0}/skills/indico-skill/SKILL.md

@@ -35,6 +35,10 @@ Set up or update Indico CLI credentials.
 
 Environment variables `INDICO_BASE_URL` and `INDICO_API_TOKEN` override the config file.
 
+Inspect or reset saved credentials with `uvx indico-cli config show` (token
+masked), `uvx indico-cli config path`, or `uvx indico-cli config clear`. The
+config file is written with `0600` permissions.
+
 ---
 
 ## Working with Results

indico_cli-0.5.0/tests/test_cli_config.py

@@ -0,0 +1,73 @@
+"""CLI tests for the `config` command group."""
+
+import json
+
+import pytest
+from click.testing import CliRunner
+
+from indico_cli.cli import cli
+
+
+@pytest.fixture
+def tmp_xdg(tmp_path, monkeypatch):
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path))
+    monkeypatch.delenv("INDICO_BASE_URL", raising=False)
+    monkeypatch.delenv("INDICO_API_TOKEN", raising=False)
+    return tmp_path
+
+
+def _write_config(tmp_path, base_url="https://indico.cern.ch", token="indp_abcdefgh1234"):
+    config_file = tmp_path / "indico-cli" / "config.json"
+    config_file.parent.mkdir(parents=True, exist_ok=True)
+    config_file.write_text(json.dumps({"base_url": base_url, "token": token}))
+    return config_file
+
+
+def test_config_show_masks_token(tmp_xdg):
+    _write_config(tmp_xdg)
+    result = CliRunner().invoke(cli, ["config", "show"])
+    assert result.exit_code == 0
+    assert "indp_...1234" in result.output
+    assert "indp_abcdefgh1234" not in result.output
+    assert "https://indico.cern.ch" in result.output
+
+
+def test_config_show_no_config(tmp_xdg):
+    result = CliRunner().invoke(cli, ["config", "show"])
+    assert result.exit_code == 0
+    assert "No saved configuration" in result.output
+
+
+def test_config_show_notes_env_override(tmp_xdg, monkeypatch):
+    _write_config(tmp_xdg)
+    monkeypatch.setenv("INDICO_API_TOKEN", "indp_envtoken")
+    result = CliRunner().invoke(cli, ["config", "show"])
+    assert result.exit_code == 0
+    assert "INDICO_API_TOKEN" in result.output
+    assert "override" in result.output
+
+
+def test_config_path_prints_path(tmp_xdg):
+    result = CliRunner().invoke(cli, ["config", "path"])
+    assert result.exit_code == 0
+    assert str(tmp_xdg / "indico-cli" / "config.json") in result.output
+
+
+def test_config_clear_with_yes(tmp_xdg):
+    _write_config(tmp_xdg)
+    result = CliRunner().invoke(cli, ["config", "clear", "--yes"])
+    assert result.exit_code == 0
+    assert not (tmp_xdg / "indico-cli" / "config.json").exists()
+
+
+def test_config_clear_nothing(tmp_xdg):
+    result = CliRunner().invoke(cli, ["config", "clear", "--yes"])
+    assert result.exit_code == 0
+    assert "Nothing to clear" in result.output
+
+
+def test_config_clear_aborts_without_confirmation(tmp_xdg):
+    _write_config(tmp_xdg)
+    result = CliRunner().invoke(cli, ["config", "clear"], input="n\n")
+    assert result.exit_code != 0  # click confirm abort -> non-zero exit
+    assert (tmp_xdg / "indico-cli" / "config.json").exists()

indico_cli-0.5.0/tests/test_config.py

@@ -0,0 +1,74 @@
+"""Unit tests for indico_cli.config on-disk credential storage."""
+
+import os
+import stat
+from pathlib import Path
+
+import pytest
+
+from indico_cli import config
+
+
+@pytest.fixture
+def tmp_xdg(tmp_path, monkeypatch):
+    """Point config storage at a temp XDG_CONFIG_HOME."""
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path))
+    return tmp_path
+
+
+def test_get_config_path_honors_xdg(tmp_xdg):
+    assert config.get_config_path() == tmp_xdg / "indico-cli" / "config.json"
+
+
+def test_get_config_path_defaults_to_home(monkeypatch):
+    monkeypatch.delenv("XDG_CONFIG_HOME", raising=False)
+    assert config.get_config_path() == Path.home() / ".config" / "indico-cli" / "config.json"
+
+
+def test_save_then_load_roundtrips(tmp_xdg):
+    config.save_config("https://indico.cern.ch", "indp_secrettoken")
+    assert config.load_config() == {
+        "base_url": "https://indico.cern.ch",
+        "token": "indp_secrettoken",
+    }
+
+
+@pytest.mark.skipif(os.name == "nt", reason="POSIX permissions only")
+def test_save_sets_owner_only_permissions(tmp_xdg):
+    config.save_config("https://indico.cern.ch", "indp_secrettoken")
+    config_file = config.get_config_path()
+    assert stat.S_IMODE(config_file.stat().st_mode) == 0o600
+    assert stat.S_IMODE(config_file.parent.stat().st_mode) == 0o700
+
+
+def test_load_returns_empty_when_missing(tmp_xdg):
+    assert config.load_config() == {}
+
+
+def test_load_returns_empty_on_corrupt_json(tmp_xdg):
+    config_file = config.get_config_path()
+    config_file.parent.mkdir(parents=True, exist_ok=True)
+    config_file.write_text("{not valid json")
+    assert config.load_config() == {}
+
+
+def test_clear_removes_file_and_returns_true(tmp_xdg):
+    config.save_config("https://indico.cern.ch", "indp_secrettoken")
+    assert config.clear_config() is True
+    assert not config.get_config_path().exists()
+
+
+def test_clear_returns_false_when_nothing(tmp_xdg):
+    assert config.clear_config() is False
+
+
+def test_mask_token_empty():
+    assert config.mask_token("") == "(none)"
+
+
+def test_mask_token_short():
+    assert config.mask_token("indp_123") == "****"
+
+
+def test_mask_token_normal():
+    assert config.mask_token("indp_abcdefgh1234") == "indp_...1234"

indico_cli-0.4.3/.gitlab-ci.yml

@@ -1,18 +0,0 @@
-stages:
-  - publish
-
-publish-pypi:
-  stage: publish
-  image: python:3.12-slim
-  rules:
-    - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+/
-  script:
-    - apt-get update && apt-get install -y git
-    - git fetch --tags
-    - pip install build twine
-    - python -m build
-    - twine upload dist/*
-  variables:
-    TWINE_USERNAME: __token__
-    TWINE_PASSWORD: $PYPI_API_TOKEN
-    GIT_DEPTH: 0