insightfactory-cli 1.0.3.dev17__tar.gz → 1.0.3.dev20__tar.gz

{insightfactory_cli-1.0.3.dev17 → insightfactory_cli-1.0.3.dev20}/CLAUDE.md

@@ -16,11 +16,14 @@ uv run ty check
 ## Conventions
 
 - Keep one module per CLI command under `src/if_cli/commands/`.
+- The base install has no runtime dependencies. Optional features live in
+  extras and are imported lazily inside their command module.
 - Never send a profile bearer token outside that profile's factory origin.
 - OAuth uses authorization-code flow with PKCE and a loopback-only callback.
 - Store profiles and tokens through the atomic private-file helpers.
-- On-disk profile/token-store paths and JSON shapes stay compatible with the
-  Node CLI (`~/.insightfactory`, `INSIGHTFACTORY_CONFIG_DIR` override).
+- The Node CLI is retired; `[factory <name>]` sections are Python-only. Profile
+  sections and the token store keep the Node layout (`~/.insightfactory`,
+  `INSIGHTFACTORY_CONFIG_DIR` override).
 - Do not commit credentials, access tokens, refresh tokens, or client secrets.
 - Test fixtures use only neutral hostnames (`factory.example`).
 - Do not publish to PyPI from a developer machine. Publishing happens in CI: the

insightfactory_cli-1.0.3.dev17/README.md → insightfactory_cli-1.0.3.dev20/PKG-INFO

@@ -1,3 +1,27 @@
+Metadata-Version: 2.5
+Name: insightfactory-cli
+Version: 1.0.3.dev20
+Summary: Profile-based authentication CLI for the InsightFactory Interfaces API
+Project-URL: Homepage, https://insightfactory.ai
+Author-email: "insightfactory.ai Support" <support@insightfactory.ai>
+License-Expression: LicenseRef-Proprietary
+License-File: LICENSE
+Keywords: cli,insightfactory,oauth,pkce
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: Other/Proprietary License
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Provides-Extra: mcp
+Requires-Dist: anyio; extra == 'mcp'
+Requires-Dist: exceptiongroup; (python_version < '3.11') and extra == 'mcp'
+Requires-Dist: httpx2; extra == 'mcp'
+Requires-Dist: mcp-types; extra == 'mcp'
+Requires-Dist: mcp<3,>=2.1; extra == 'mcp'
+Description-Content-Type: text/markdown
+
 # insightfactory-cli
 
 Profile-based authentication CLI for the InsightFactory Interfaces API. It
@@ -183,6 +207,15 @@ write to stdout, never launch a browser or block on interactive input, and only
 use bounded waits. Changing or removing any of them is a breaking change and
 needs a major version bump.
 
+`get_valid_token` takes a keyword-only `force_refresh` (default `False`). When
+`True`, it refreshes the cached token even if it is still fresh, which a
+caller that just received a 401 from the factory needs: the cached token was
+fresh a moment ago but the factory has since rejected it. With a refresh
+token cached, this re-mints regardless of freshness; without one — a token
+pasted through `if-cli set-token` — it raises `CliError` with the same
+`if-cli login -p <name>` hint rather than serving the token that was just
+rejected.
+
 ## How authentication works
 
 - Profiles live in `~/.insightfactory/config`, one per customer and environment.
@@ -201,6 +234,76 @@ needs a major version bump.
   the client ID from the factory's discovery document at runtime and holds no
   client secret.
 
+## MCP router (`if-cli mcp`)
+
+Runs one MCP server over stdio that fronts several factory environments as a
+single tool catalogue, instead of one MCP connection per environment. Every
+tool gets a required `environment` argument and each call is forwarded to
+that environment's own factory `/mcp` endpoint, authenticated with that
+environment's `if-cli` profile — a profile's bearer token never reaches a
+different environment's host. A tool is only offered on the environments
+whose input schema matches the published one, so a factory on an older
+release cannot be handed argument shapes it does not accept.
+
+It needs the `mcp` extra, which is not part of the base install. Name its environments once
+in a `[factory <name>]` section of `~/.insightfactory/config`, alongside profiles:
+
+```ini
+[factory foundry]
+dev = example-dev
+tst = example-tst
+writable = dev
+```
+
+Every key except `writable` and `catalog` is `<environment code> = <profile name>`; file
+order is the environment order. `writable` is a comma-separated list of codes (default
+none); `catalog` is one code (default the first environment). Then:
+
+```bash
+uv tool install 'insightfactory-cli[mcp]'
+uvx --from 'insightfactory-cli[mcp]' if-cli mcp foundry
+```
+
+Add it to `.mcp.json`:
+
+```json
+{
+  "mcpServers": {
+    "if-factory": {
+      "command": "uvx",
+      "args": ["--from", "insightfactory-cli[mcp]", "if-cli", "mcp", "foundry"]
+    }
+  }
+}
+```
+
+`--env`, `--writable`, `--catalog` and `--allow-tool` still work without a factory section
+(`--env` is required in that case), and each one overrides the section when both are given:
+a repeated `--env CODE=PROFILE` replaces that code's profile, `--writable`/`--catalog`, when
+passed at all, replace the section's value outright, and `--allow-tool` is always additive.
+
+| Flag | Meaning |
+|---|---|
+| `FACTORY` (optional, first positional) | Name of a `[factory <name>]` config section supplying the flags below. |
+| `--env CODE=PROFILE` (repeatable, required without `FACTORY`) | The environment code the model passes, mapped to the `if-cli` profile that reaches it. |
+| `--writable CODE` (repeatable) | Environments where write tools are allowed. Everything else is read-only. |
+| `--read-only` | Forces every environment read-only, overriding both the section's `writable` and any `--writable`. Cannot be combined with `--writable`. |
+| `--catalog CODE` (default: the first environment) | Whose tool list is published; its schemas are the reference every environment is checked against. |
+| `--allow-tool NAME` (repeatable) | Extra tool names treated as read-only, beyond the shipped list. |
+| `--timeout SECONDS` (default `120`) | Per upstream request; higher than the `api` command's default because some tools are slow. |
+
+`mcp`'s `--timeout` does not read `INSIGHTFACTORY_REQUEST_TIMEOUT`: it parses the flag with
+`parse_timeout_seconds` rather than `resolve_request_timeout`, because a long-running stdio
+server is not the one-shot request that environment variable is scoped to.
+
+Only environments passed to `--writable` accept mutating tools; every other
+environment allows only tools it knows to read (an allowlist, not a
+blocklist — a tool the model reaches through `invoke_tool` is never in the
+published catalogue, so a blocklist could never cover everything callable).
+Passing dev-only writes to production means changing an argument value, not
+connecting to a different server, so keep `--writable` scoped to the
+environments meant to be written by hand.
+
 ## Development
 
 ```bash
@@ -218,7 +321,9 @@ uv run if-cli --version
 INSIGHTFACTORY_CONFIG_DIR=$(mktemp -d) uv run if-cli profiles
 ```
 
-Python 3.10 or newer is required. Runtime code is stdlib-only.
+Python 3.10 or newer is required. The base install has no runtime dependencies;
+optional features, such as `if-cli mcp`, ship as extras and are imported lazily
+inside their command module.
 
 ## Release
 

insightfactory_cli-1.0.3.dev17/PKG-INFO → insightfactory_cli-1.0.3.dev20/README.md

@@ -1,21 +1,3 @@
-Metadata-Version: 2.5
-Name: insightfactory-cli
-Version: 1.0.3.dev17
-Summary: Profile-based authentication CLI for the InsightFactory Interfaces API
-Project-URL: Homepage, https://insightfactory.ai
-Author-email: "insightfactory.ai Support" <support@insightfactory.ai>
-License-Expression: LicenseRef-Proprietary
-License-File: LICENSE
-Keywords: cli,insightfactory,oauth,pkce
-Classifier: Development Status :: 5 - Production/Stable
-Classifier: Environment :: Console
-Classifier: Intended Audience :: Developers
-Classifier: License :: Other/Proprietary License
-Classifier: Programming Language :: Python :: 3 :: Only
-Classifier: Typing :: Typed
-Requires-Python: >=3.10
-Description-Content-Type: text/markdown
-
 # insightfactory-cli
 
 Profile-based authentication CLI for the InsightFactory Interfaces API. It
@@ -201,6 +183,15 @@ write to stdout, never launch a browser or block on interactive input, and only
 use bounded waits. Changing or removing any of them is a breaking change and
 needs a major version bump.
 
+`get_valid_token` takes a keyword-only `force_refresh` (default `False`). When
+`True`, it refreshes the cached token even if it is still fresh, which a
+caller that just received a 401 from the factory needs: the cached token was
+fresh a moment ago but the factory has since rejected it. With a refresh
+token cached, this re-mints regardless of freshness; without one — a token
+pasted through `if-cli set-token` — it raises `CliError` with the same
+`if-cli login -p <name>` hint rather than serving the token that was just
+rejected.
+
 ## How authentication works
 
 - Profiles live in `~/.insightfactory/config`, one per customer and environment.
@@ -219,6 +210,76 @@ needs a major version bump.
   the client ID from the factory's discovery document at runtime and holds no
   client secret.
 
+## MCP router (`if-cli mcp`)
+
+Runs one MCP server over stdio that fronts several factory environments as a
+single tool catalogue, instead of one MCP connection per environment. Every
+tool gets a required `environment` argument and each call is forwarded to
+that environment's own factory `/mcp` endpoint, authenticated with that
+environment's `if-cli` profile — a profile's bearer token never reaches a
+different environment's host. A tool is only offered on the environments
+whose input schema matches the published one, so a factory on an older
+release cannot be handed argument shapes it does not accept.
+
+It needs the `mcp` extra, which is not part of the base install. Name its environments once
+in a `[factory <name>]` section of `~/.insightfactory/config`, alongside profiles:
+
+```ini
+[factory foundry]
+dev = example-dev
+tst = example-tst
+writable = dev
+```
+
+Every key except `writable` and `catalog` is `<environment code> = <profile name>`; file
+order is the environment order. `writable` is a comma-separated list of codes (default
+none); `catalog` is one code (default the first environment). Then:
+
+```bash
+uv tool install 'insightfactory-cli[mcp]'
+uvx --from 'insightfactory-cli[mcp]' if-cli mcp foundry
+```
+
+Add it to `.mcp.json`:
+
+```json
+{
+  "mcpServers": {
+    "if-factory": {
+      "command": "uvx",
+      "args": ["--from", "insightfactory-cli[mcp]", "if-cli", "mcp", "foundry"]
+    }
+  }
+}
+```
+
+`--env`, `--writable`, `--catalog` and `--allow-tool` still work without a factory section
+(`--env` is required in that case), and each one overrides the section when both are given:
+a repeated `--env CODE=PROFILE` replaces that code's profile, `--writable`/`--catalog`, when
+passed at all, replace the section's value outright, and `--allow-tool` is always additive.
+
+| Flag | Meaning |
+|---|---|
+| `FACTORY` (optional, first positional) | Name of a `[factory <name>]` config section supplying the flags below. |
+| `--env CODE=PROFILE` (repeatable, required without `FACTORY`) | The environment code the model passes, mapped to the `if-cli` profile that reaches it. |
+| `--writable CODE` (repeatable) | Environments where write tools are allowed. Everything else is read-only. |
+| `--read-only` | Forces every environment read-only, overriding both the section's `writable` and any `--writable`. Cannot be combined with `--writable`. |
+| `--catalog CODE` (default: the first environment) | Whose tool list is published; its schemas are the reference every environment is checked against. |
+| `--allow-tool NAME` (repeatable) | Extra tool names treated as read-only, beyond the shipped list. |
+| `--timeout SECONDS` (default `120`) | Per upstream request; higher than the `api` command's default because some tools are slow. |
+
+`mcp`'s `--timeout` does not read `INSIGHTFACTORY_REQUEST_TIMEOUT`: it parses the flag with
+`parse_timeout_seconds` rather than `resolve_request_timeout`, because a long-running stdio
+server is not the one-shot request that environment variable is scoped to.
+
+Only environments passed to `--writable` accept mutating tools; every other
+environment allows only tools it knows to read (an allowlist, not a
+blocklist — a tool the model reaches through `invoke_tool` is never in the
+published catalogue, so a blocklist could never cover everything callable).
+Passing dev-only writes to production means changing an argument value, not
+connecting to a different server, so keep `--writable` scoped to the
+environments meant to be written by hand.
+
 ## Development
 
 ```bash
@@ -236,7 +297,9 @@ uv run if-cli --version
 INSIGHTFACTORY_CONFIG_DIR=$(mktemp -d) uv run if-cli profiles
 ```
 
-Python 3.10 or newer is required. Runtime code is stdlib-only.
+Python 3.10 or newer is required. The base install has no runtime dependencies;
+optional features, such as `if-cli mcp`, ship as extras and are imported lazily
+inside their command module.
 
 ## Release
 

{insightfactory_cli-1.0.3.dev17 → insightfactory_cli-1.0.3.dev20}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "insightfactory-cli"
-version = "1.0.3.dev17"
+version = "1.0.3.dev20"
 description = "Profile-based authentication CLI for the InsightFactory Interfaces API"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -23,12 +23,15 @@ if-cli = "if_cli.main:main"
 [project.urls]
 Homepage = "https://insightfactory.ai"
 
+[project.optional-dependencies]
+mcp = ["mcp>=2.1,<3", "anyio", "httpx2", "mcp-types", "exceptiongroup; python_version < '3.11'"]
+
 [build-system]
 requires = ["hatchling"]
 build-backend = "hatchling.build"
 
 [dependency-groups]
-dev = ["pytest", "ruff", "ty"]
+dev = ["pytest", "ruff", "ty", "insightfactory-cli[mcp]"]
 
 [tool.hatch.build.targets.wheel]
 packages = ["src/if_cli"]

insightfactory_cli-1.0.3.dev20/src/if_cli/assets/__init__.py

@@ -0,0 +1 @@
+"""Static files shipped with the CLI."""

insightfactory_cli-1.0.3.dev20/src/if_cli/assets/insightfactoryai-logo.svg

@@ -0,0 +1,55 @@
+<svg class="logo" role="img" aria-label="insightfactory.ai" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 286.67 62.53">
+  <defs>
+    <style>
+      .iflogo-1 {
+        fill: #fab314;
+      }
+      .iflogo-2 {
+        fill: #f8e86c;
+      }
+      .iflogo-3 {
+        fill: #fad121;
+      }
+      .iflogo-4 {
+        fill: #1f252e;
+      }
+    </style>
+  </defs>
+  <g id="ARTWORK">
+    <g>
+      <g>
+        <polygon class="iflogo-4" points="32.49 37.52 32.5 37.53 32.49 37.52 32.49 37.52"/>
+        <polygon class="iflogo-4" points="21.66 18.76 0 31.27 21.66 43.78 21.66 18.76"/>
+        <g>
+          <polygon class="iflogo-4" points="43.32 31.27 43.32 43.78 54.15 37.52 43.32 31.27"/>
+          <polygon class="iflogo-4" points="43.32 43.78 43.32 56.28 54.15 62.53 64.98 56.28 43.32 43.78"/>
+        </g>
+        <polygon class="iflogo-2" points="21.66 6.26 32.49 12.51 43.32 6.26 32.48 0 21.66 6.26"/>
+        <polygon class="iflogo-3" points="32.49 12.51 32.49 12.51 21.66 6.26 21.66 18.76 21.66 18.76 21.66 43.78 32.49 50.03 32.49 37.52 32.49 12.51"/>
+        <g>
+          <polygon class="iflogo-1" points="32.49 12.51 32.5 25.02 43.32 18.76 43.32 6.26 32.49 12.51"/>
+          <polygon class="iflogo-1" points="43.32 56.28 43.32 43.78 43.32 31.27 32.49 37.52 32.49 50.03 43.32 56.28"/>
+        </g>
+      </g>
+      <g>
+        <path class="iflogo-4" d="m75.28,23.74c-.81,0-1.47-.27-1.99-.8-.52-.53-.77-1.17-.77-1.91s.26-1.41.77-1.93,1.18-.78,1.99-.78c.76,0,1.41.26,1.94.78.53.52.79,1.17.79,1.93s-.26,1.38-.79,1.91c-.53.53-1.17.8-1.94.8Zm-2.19,2.23h4.31v17.39h-4.31v-17.39Z"/>
+        <path class="iflogo-4" d="m79.46,25.97h3.91l.3,1.77c.54-.63,1.2-1.12,1.97-1.48.78-.36,1.61-.54,2.51-.54,1.33,0,2.46.29,3.39.87.93.58,1.65,1.42,2.16,2.52.51,1.1.76,2.46.76,4.09v10.16h-4.35v-9.57c0-1.34-.26-2.35-.78-3.03s-1.29-1.01-2.33-1.01-1.86.34-2.41,1.03c-.55.68-.83,1.7-.83,3.04v9.53h-4.31v-17.39Z"/>
+        <path class="iflogo-4" d="m100.08,37.69c.13.58.36,1.02.69,1.32.33.3.7.52,1.11.64.42.13.84.19,1.26.19.79,0,1.4-.16,1.85-.47.45-.31.67-.71.67-1.2,0-.42-.16-.75-.47-.99-.31-.24-.71-.43-1.2-.57-.48-.14-.99-.27-1.53-.38-.61-.16-1.25-.34-1.94-.54-.69-.2-1.33-.48-1.94-.85-.61-.37-1.11-.85-1.5-1.44-.39-.59-.59-1.34-.59-2.24,0-1.09.28-2.03.84-2.83.56-.8,1.35-1.43,2.38-1.9s2.21-.7,3.56-.7c1.59,0,2.94.35,4.04,1.04,1.1.7,1.9,1.69,2.39,2.99l-3.78,1.11c-.13-.32-.34-.59-.61-.8s-.59-.36-.96-.45c-.37-.09-.75-.14-1.13-.14-.65,0-1.19.13-1.62.4-.43.27-.64.63-.64,1.1,0,.28.08.5.24.68s.38.32.66.43c.28.12.61.22.98.31.37.09.78.2,1.23.31.7.19,1.4.4,2.11.64.71.24,1.36.55,1.96.92.59.37,1.07.87,1.43,1.5.36.63.56,1.42.61,2.37,0,1.02-.28,1.94-.84,2.77s-1.37,1.48-2.43,1.96c-1.06.49-2.34.73-3.84.73-1.75,0-3.24-.38-4.47-1.15s-2.03-1.96-2.41-3.58l3.88-1.18Z"/>
+        <path class="iflogo-4" d="m114.61,23.74c-.81,0-1.47-.27-1.99-.8-.52-.53-.77-1.17-.77-1.91s.26-1.41.77-1.93,1.18-.78,1.99-.78c.76,0,1.41.26,1.94.78.53.52.79,1.17.79,1.93s-.26,1.38-.79,1.91c-.53.53-1.17.8-1.94.8Zm-2.19,2.23h4.31v17.39h-4.31v-17.39Z"/>
+        <path class="iflogo-4" d="m131.9,25.97h3.91v14.82c0,1.97-.47,3.67-1.42,5.1-.94,1.43-2.31,2.52-4.09,3.29-1.79.76-3.93,1.15-6.42,1.15l-.67-3.76c2.72-.05,4.78-.54,6.18-1.5s2.11-2.32,2.11-4.1v-.07l.57-.21c-.54.81-1.28,1.5-2.22,2.07s-2.07.85-3.37.85c-1.48,0-2.79-.37-3.91-1.11-1.12-.74-2.01-1.78-2.65-3.11-.64-1.33-.96-2.91-.96-4.71s.32-3.39.96-4.73c.64-1.34,1.52-2.38,2.65-3.11,1.12-.73,2.43-1.1,3.91-1.1.76,0,1.48.11,2.14.33.66.22,1.25.51,1.75.87.5.36.93.76,1.26,1.2l.27-2.16Zm-8.32,8.7c0,1.46.37,2.64,1.09,3.53.73.89,1.7,1.34,2.92,1.34.7,0,1.34-.19,1.92-.57.58-.38,1.06-.94,1.43-1.69.37-.74.56-1.61.56-2.61s-.19-1.92-.56-2.64c-.37-.72-.85-1.27-1.45-1.65-.59-.38-1.23-.57-1.9-.57-1.21,0-2.19.45-2.92,1.34-.73.89-1.09,2.07-1.09,3.53Z"/>
+        <path class="iflogo-4" d="m138.5,18.32h4.31v9.36c.52-.58,1.16-1.05,1.94-1.41.78-.36,1.65-.54,2.61-.54,1.28,0,2.39.29,3.34.87.94.58,1.68,1.42,2.21,2.52.53,1.1.79,2.46.79,4.09v10.16h-4.55v-9.57c0-1.34-.26-2.35-.78-3.03s-1.29-1.01-2.33-1.01-1.86.37-2.41,1.1c-.55.73-.83,1.77-.83,3.11v9.39h-4.31v-25.04Z"/>
+        <path class="iflogo-4" d="m157.01,25.97v-4.87h4.35v4.87h3.74v3.93h-3.74v7.06c0,.9.19,1.54.57,1.91.38.37.86.57,1.43.59.57.02,1.15-.01,1.74-.1v3.83c-1.03.23-2.04.3-3.02.21-.98-.09-1.85-.37-2.61-.82-.76-.45-1.36-1.14-1.8-2.07-.44-.93-.66-2.11-.66-3.55v-7.06h-2.39v-3.93h2.39Z"/>
+        <path class="iflogo-4" d="m170.42,23.92c0-1.27.2-2.35.61-3.23s1.05-1.52,1.94-1.93c.89-.41,2.07-.55,3.56-.43v2.33c-1.35-.12-2.28.11-2.8.68s-.78,1.43-.78,2.59v2.05h3.71v2.43h-3.71v14.96h-2.53v-14.96h-2.36v-2.43h2.36v-2.05Z"/>
+        <path class="iflogo-4" d="m188.25,43.36l-.2-3.13c-.47,1.07-1.17,1.9-2.09,2.49-.92.59-2.09.89-3.5.89-1.21,0-2.25-.2-3.1-.59-.85-.39-1.51-.96-1.97-1.69-.46-.73-.69-1.59-.69-2.59,0-1.46.53-2.66,1.58-3.6,1.06-.94,2.58-1.51,4.58-1.72l5.19-.59v-1.39c0-.97-.35-1.76-1.04-2.35s-1.64-.89-2.83-.89-2.14.28-2.92.83c-.78.56-1.31,1.36-1.6,2.4l-2.29-.83c.45-1.53,1.28-2.72,2.48-3.58,1.2-.86,2.67-1.29,4.4-1.29,2,0,3.56.53,4.67,1.58,1.11,1.06,1.67,2.49,1.67,4.3v11.76h-2.33Zm-.2-8.31l-5.22.63c-1.12.14-1.98.46-2.56.96-.58.5-.88,1.15-.88,1.96s.29,1.46.86,1.95c.57.49,1.4.73,2.48.73,1.24,0,2.25-.25,3.03-.77.79-.51,1.37-1.2,1.74-2.07.37-.87.56-1.81.56-2.83v-.56Z"/>
+        <path class="iflogo-4" d="m201.02,43.61c-1.64,0-3.08-.37-4.31-1.11-1.24-.74-2.2-1.78-2.88-3.11-.69-1.33-1.03-2.88-1.03-4.64s.34-3.36,1.03-4.71,1.65-2.41,2.88-3.17c1.24-.75,2.67-1.13,4.31-1.13,1.73,0,3.25.41,4.55,1.23,1.3.82,2.25,1.97,2.83,3.43l-2.33.83c-.34-.93-.95-1.66-1.84-2.21-.89-.54-1.92-.82-3.08-.82s-2.14.27-2.98.8-1.49,1.29-1.96,2.26c-.46.97-.69,2.12-.69,3.44,0,1.95.51,3.51,1.52,4.68s2.36,1.76,4.04,1.76c1.15,0,2.17-.27,3.07-.8.9-.53,1.56-1.25,1.99-2.16l2.29.83c-.61,1.44-1.56,2.56-2.86,3.38-1.3.81-2.82,1.22-4.55,1.22Z"/>
+        <path class="iflogo-4" d="m212.07,25.97v-4.87h2.53v4.87h4.48v2.43h-4.48v9.36c0,1.07.22,1.84.66,2.33.44.49,1,.78,1.68.87.69.09,1.4.09,2.14,0v2.26c-.88.21-1.74.27-2.58.17-.84-.09-1.6-.35-2.26-.78-.66-.43-1.19-1.04-1.58-1.83-.39-.79-.59-1.8-.59-3.03v-9.36h-2.53v-2.43h2.53Z"/>
+        <path class="iflogo-4" d="m228.49,43.61c-1.6,0-3.02-.36-4.28-1.08-1.26-.72-2.25-1.74-2.97-3.08-.72-1.33-1.08-2.92-1.08-4.75s.37-3.46,1.1-4.8c.73-1.34,1.73-2.38,3-3.1,1.27-.72,2.7-1.08,4.3-1.08s3.03.36,4.3,1.08c1.27.72,2.27,1.75,3,3.08.73,1.33,1.1,2.92,1.1,4.75s-.37,3.46-1.11,4.8-1.75,2.38-3.03,3.1-2.72,1.08-4.31,1.08Zm-.03-2.47c.99,0,1.92-.23,2.8-.68.88-.45,1.59-1.16,2.14-2.12.55-.96.83-2.19.83-3.67s-.27-2.74-.81-3.69c-.54-.95-1.24-1.65-2.11-2.1s-1.79-.68-2.78-.68-1.91.23-2.76.68-1.54,1.16-2.07,2.12c-.53.96-.79,2.19-.79,3.67s.26,2.74.78,3.69c.52.95,1.2,1.65,2.04,2.1.84.45,1.76.68,2.75.68Z"/>
+        <path class="iflogo-4" d="m238.93,25.97h2.33l.13,2.54c.45-.63.99-1.16,1.63-1.6.64-.44,1.35-.75,2.12-.92.77-.17,1.6-.18,2.48-.02v2.61c-.94-.18-1.79-.18-2.54,0-.75.19-1.4.53-1.94,1.04-.54.51-.96,1.15-1.25,1.93-.29.78-.44,1.68-.44,2.7v9.11h-2.53v-17.39Z"/>
+        <path class="iflogo-4" d="m262.19,25.97h2.63l-9.64,24.35h-2.43l2.87-7.2-6.81-17.15h2.76l5.39,14.05,5.22-14.05Z"/>
+        <path class="iflogo-4" d="m263.09,43.52c-.46,0-.84-.16-1.15-.5-.31-.33-.46-.73-.46-1.21s.15-.88.46-1.21c.31-.33.69-.5,1.15-.5s.82.17,1.14.5c.32.33.48.73.48,1.21s-.16.88-.48,1.21c-.32.33-.7.5-1.14.5Z"/>
+        <path class="iflogo-4" d="m278.25,43.36l-.2-3.13c-.47,1.07-1.17,1.9-2.09,2.49-.92.59-2.09.89-3.5.89-1.21,0-2.25-.2-3.1-.59-.85-.39-1.51-.96-1.97-1.69-.46-.73-.69-1.59-.69-2.59,0-1.46.53-2.66,1.58-3.6,1.06-.94,2.58-1.51,4.58-1.72l5.19-.59v-1.39c0-.97-.35-1.76-1.04-2.35s-1.64-.89-2.83-.89-2.14.28-2.92.83c-.78.56-1.31,1.36-1.6,2.4l-2.29-.83c.45-1.53,1.28-2.72,2.48-3.58,1.2-.86,2.67-1.29,4.4-1.29,2,0,3.56.53,4.67,1.58,1.11,1.06,1.67,2.49,1.67,4.3v11.76h-2.33Zm-.2-8.31l-5.22.63c-1.12.14-1.98.46-2.56.96-.58.5-.88,1.15-.88,1.96s.29,1.46.86,1.95c.57.49,1.4.73,2.48.73,1.24,0,2.25-.25,3.03-.77.79-.51,1.37-1.2,1.74-2.07.37-.87.56-1.81.56-2.83v-.56Z"/>
+        <path class="iflogo-4" d="m284.92,22.49c-.52,0-.94-.17-1.28-.52-.34-.35-.51-.78-.51-1.29s.17-.97.51-1.32.76-.52,1.28-.52c.47,0,.88.17,1.23.52.35.35.52.79.52,1.32s-.17.94-.52,1.29c-.35.35-.76.52-1.23.52Zm-1.28,3.48h2.49v17.39h-2.49v-17.39Z"/>
+      </g>
+    </g>
+  </g>
+</svg>

insightfactory_cli-1.0.3.dev20/src/if_cli/callback_page.py

@@ -0,0 +1,215 @@
+"""Branded HTML for the loopback OAuth callback tab.
+
+This tab is the frame straight after the Auth0 Universal Login widget, so it
+copies that theme rather than the Interfaces app. Every value here mirrors
+``auth0_branding_theme.insight_factory`` in
+``terraform-Insightfactory-infrastructure/Auth0/modules/auth0/branding.tf``, and
+the comments name the Terraform attribute each one came from. Change them together.
+
+The page is self-contained: the logo is inline SVG and the CSS is inline, so it
+renders from the loopback server with no network access beyond the webfont.
+"""
+
+from __future__ import annotations
+
+from functools import lru_cache
+from importlib.resources import files
+
+
+@lru_cache(maxsize=1)
+def logo_svg() -> str:
+    """The wordmark Auth0 serves from the CDN, shipped with the package.
+
+    Auth0 loads it from cdn.insightfactory.ai. We inline the same file so the
+    callback page does not depend on the CDN being reachable.
+    """
+    return files("if_cli.assets").joinpath("insightfactoryai-logo.svg").read_text(encoding="utf-8")
+
+
+STYLES = """\
+@import url("https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500&display=swap");
+
+:root {
+  --page-background: #20252e;   /* page_background.background_color */
+  --widget-background: #ffffff; /* colors.widget_background */
+  --header: #20252e;            /* colors.header */
+  --body-text: #20252e;         /* colors.body_text */
+  --icons: #65676e;             /* colors.icons */
+  --input-border: #c9cace;      /* colors.input_border */
+  --success: #13a688;           /* colors.success */
+  --error: #d03c38;             /* colors.error */
+  --success-soft: rgba(19, 166, 136, 0.12);
+  --error-soft: rgba(208, 60, 56, 0.12);
+}
+
+* {
+  box-sizing: border-box;
+}
+
+body {
+  margin: 0;
+  min-height: 100vh;
+  display: flex;
+  align-items: center;          /* page_layout: center */
+  justify-content: center;
+  padding: 24px;
+  background: var(--page-background);
+  color: var(--body-text);
+  font-family: "Roboto", -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+  font-size: 16px;              /* fonts.reference_text_size */
+  font-weight: 300;
+  line-height: 1.5;
+  -webkit-font-smoothing: antialiased;
+}
+
+main {
+  width: 100%;
+  max-width: 400px;
+  padding: 40px 32px 32px;
+  border-radius: 8px;                         /* borders.widget_corner_radius */
+  background: var(--widget-background);
+  box-shadow: 0 8px 24px rgba(0, 0, 0, 0.28); /* borders.show_widget_shadow */
+  text-align: center;                         /* widget.header_text_alignment */
+}
+
+.logo {
+  height: 68px;                 /* widget.logo_height */
+  width: auto;
+  max-width: 100%;
+  display: block;
+  margin: 0 auto 24px;          /* widget.logo_position: center */
+}
+
+.pill {
+  display: inline-flex;
+  align-items: center;
+  gap: 7px;
+  margin-bottom: 16px;
+  padding: 4px 12px 4px 10px;
+  border-radius: 999px;
+  background: var(--pill-soft);
+  color: var(--pill);
+  font-size: 14px;
+  font-weight: 500;
+}
+
+.dot {
+  width: 7px;
+  height: 7px;
+  border-radius: 50%;
+  background: currentColor;
+}
+
+h1 {
+  margin: 0 0 10px;
+  color: var(--header);         /* colors.header */
+  font-size: 24px;              /* fonts.title: 150% of 16px */
+  font-weight: 300;             /* fonts.title.bold = false */
+  line-height: 1.25;
+}
+
+p {
+  margin: 0;
+  color: var(--icons);
+  font-size: 14px;              /* fonts.subtitle: 87.5% of 16px */
+  font-weight: 400;
+}
+
+code {
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  font-size: 13px;
+  color: var(--body-text);
+}
+
+pre {
+  margin: 20px 0 0;
+  padding: 12px 14px;
+  border: 1px solid var(--input-border); /* colors.input_border */
+  border-radius: 3px;                    /* borders.input_border_radius */
+  color: var(--body-text);
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  font-size: 13px;
+  text-align: left;
+  white-space: pre-wrap;
+  word-break: break-word;
+}
+"""
+
+_TEMPLATE = """\
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>{title} | insightfactory.ai</title>
+<style>
+{styles}
+</style>
+</head>
+<body>
+<main style="--pill: var({pill_colour}); --pill-soft: var({pill_soft});">
+{logo}
+<span class="pill"><span class="dot"></span>{pill}</span>
+<h1>{heading}</h1>
+<p>{message}</p>
+{detail}
+</main>
+</body>
+</html>
+"""
+
+
+def render(
+    *,
+    title: str,
+    pill: str,
+    heading: str,
+    message: str,
+    detail: str = "",
+    ok: bool = True,
+) -> bytes:
+    """Render one callback page, ready to write to the socket."""
+    return _TEMPLATE.format(
+        title=title,
+        styles=STYLES,
+        logo=logo_svg(),
+        pill=pill,
+        pill_colour="--success" if ok else "--error",
+        pill_soft="--success-soft" if ok else "--error-soft",
+        heading=heading,
+        message=message,
+        detail=detail,
+    ).encode("utf-8")
+
+
+def success_page() -> bytes:
+    return render(
+        title="Login complete",
+        pill="Connected",
+        heading="Authentication successful",
+        message="You can close this tab and return to the terminal.",
+    )
+
+
+def failure_page(error: str, description: str) -> bytes:
+    return render(
+        title="Login failed",
+        pill="Not connected",
+        heading="Authentication failed",
+        message="Close this tab and run <code>if-cli login</code> again.",
+        detail=f"<pre>{error}: {description}</pre>" if error or description else "",
+        ok=False,
+    )
+
+
+def state_mismatch_page() -> bytes:
+    return render(
+        title="Login callback ignored",
+        pill="Not connected",
+        heading="Callback ignored",
+        message=(
+            "The callback state did not match the one this login started with, "
+            "so it was discarded. Close this tab and run <code>if-cli login</code> again."
+        ),
+        ok=False,
+    )

{insightfactory_cli-1.0.3.dev17 → insightfactory_cli-1.0.3.dev20}/src/if_cli/cli.py

@@ -53,6 +53,8 @@ def _parse_args_with_positionals(argv: list[str], *, options: Options) -> tuple[
     """Parse argv allowing options and positionals in any order (Node util.parseArgs parity)."""
     values: dict[str, Any] = {}
     for name, spec in options.items():
+        if spec.get("repeat"):
+            die(f"internal error: option '--{name}' has repeat=True, which allow_positionals parsing does not support")
         if spec["type"] == "boolean":
             values[name] = spec.get("default", False)
         else:
@@ -136,6 +138,10 @@ def parse_args(
         dest = name.replace("-", "_")
         if spec["type"] == "boolean":
             parser.add_argument(*flags, dest=dest, action="store_true", default=spec.get("default", False))
+        elif spec.get("repeat"):
+            # `action="append"` with `default=None` (rather than a spec-level `[]`) so
+            # unset stays None and a shared mutable default can't leak across calls.
+            parser.add_argument(*flags, dest=dest, action="append", default=None)
         else:
             parser.add_argument(*flags, dest=dest, default=spec.get("default"))
     namespace = parser.parse_args(argv)