insightfactory-cli 1.0.3.dev20__tar.gz → 1.0.3.dev21__tar.gz

{insightfactory_cli-1.0.3.dev20 → insightfactory_cli-1.0.3.dev21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: insightfactory-cli
-Version: 1.0.3.dev20
+Version: 1.0.3.dev21
 Summary: Profile-based authentication CLI for the InsightFactory Interfaces API
 Project-URL: Homepage, https://insightfactory.ai
 Author-email: "insightfactory.ai Support" <support@insightfactory.ai>
@@ -304,6 +304,12 @@ Passing dev-only writes to production means changing an argument value, not
 connecting to a different server, so keep `--writable` scoped to the
 environments meant to be written by hand.
 
+A tool the factory will not run until someone finishes a step in a browser, such
+as linking a personal Databricks identity, comes back as a failed call naming the
+page to visit rather than as a prompt. The router never relays the factory's
+request for input to the model, and it names a page only on that environment's
+own origin, logging a `WARN` line on stderr when it drops one that is not.
+
 ## Development
 
 ```bash

{insightfactory_cli-1.0.3.dev20 → insightfactory_cli-1.0.3.dev21}/README.md

@@ -280,6 +280,12 @@ Passing dev-only writes to production means changing an argument value, not
 connecting to a different server, so keep `--writable` scoped to the
 environments meant to be written by hand.
 
+A tool the factory will not run until someone finishes a step in a browser, such
+as linking a personal Databricks identity, comes back as a failed call naming the
+page to visit rather than as a prompt. The router never relays the factory's
+request for input to the model, and it names a page only on that environment's
+own origin, logging a `WARN` line on stderr when it drops one that is not.
+
 ## Development
 
 ```bash

{insightfactory_cli-1.0.3.dev20 → insightfactory_cli-1.0.3.dev21}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "insightfactory-cli"
-version = "1.0.3.dev20"
+version = "1.0.3.dev21"
 description = "Profile-based authentication CLI for the InsightFactory Interfaces API"
 readme = "README.md"
 requires-python = ">=3.10"

{insightfactory_cli-1.0.3.dev20 → insightfactory_cli-1.0.3.dev21}/src/if_cli/commands/mcp.py

@@ -132,7 +132,8 @@ def mcp_command(argv: list[str]) -> None:
     # import bug inside if_cli.router propagates instead of reading as a missing extra.
     if importlib.util.find_spec("mcp") is None:
         die(MISSING_MCP_EXTRA)
-    from if_cli.router.server import build_router, log, run_server
+    from if_cli.router.log import log
+    from if_cli.router.server import build_router, run_server
 
     timeout = parse_timeout_seconds(values["timeout"], "--timeout")
     extra_read_only = frozenset(values["allow-tool"] or [])

insightfactory_cli-1.0.3.dev21/src/if_cli/router/log.py

@@ -0,0 +1,13 @@
+from __future__ import annotations
+
+import sys
+
+
+def log(message: str) -> None:
+    """Write one diagnostic line to stderr.
+
+    The router speaks MCP over stdout, so stderr is the only channel that can
+    carry anything to the operator. This lives in its own module because both
+    `server` and `upstream` write to it and `server` imports `upstream`.
+    """
+    sys.stderr.write(f"[if-cli mcp] {message}\n")

{insightfactory_cli-1.0.3.dev20 → insightfactory_cli-1.0.3.dev21}/src/if_cli/router/server.py

@@ -1,7 +1,6 @@
 from __future__ import annotations
 
 import os
-import sys
 from dataclasses import dataclass
 from importlib.metadata import version
 from typing import Any
@@ -15,6 +14,7 @@ from mcp.server.stdio import stdio_server
 from if_cli.config import Profile
 from if_cli.router import catalog, policy
 from if_cli.router.catalog import ENV_ARG, EnvironmentSpec
+from if_cli.router.log import log
 from if_cli.router.upstream import Upstream
 from if_cli.runtime import CliError
 
@@ -24,10 +24,6 @@ SERVER_VERSION = version("insightfactory-cli")
 DEFAULT_CATALOG_RETRY_WINDOW_S = 5.0
 
 
-def log(message: str) -> None:
-    sys.stderr.write(f"[if-cli mcp] {message}\n")
-
-
 def _catalog_retry_window_seconds() -> float:
     """Read the catalogue-rebuild retry window, in milliseconds, from the environment.
 

insightfactory_cli-1.0.3.dev21/src/if_cli/router/upstream.py

@@ -0,0 +1,272 @@
+from __future__ import annotations
+
+import sys
+from typing import Any
+
+import anyio
+import httpx2
+import mcp_types as types
+from mcp.client import Client
+from mcp.client.streamable_http import streamable_http_client
+
+from if_cli.config import Profile
+from if_cli.http import parse_url, url_origin
+from if_cli.oauth import get_valid_token
+from if_cli.router.log import log
+
+if sys.version_info >= (3, 11):
+    _BaseExceptionGroup = BaseExceptionGroup  # noqa: F821 - builtin from 3.11 on, guarded above
+else:  # pragma: no cover - exercised only on Python < 3.11
+    # anyio pulls in this backport for exactly that case, so it is always
+    # importable here when the builtin is not.
+    from exceptiongroup import BaseExceptionGroup as _BaseExceptionGroup  # ty: ignore[unresolved-import]
+
+
+def _leaf_exception(error: BaseException) -> BaseException:
+    """Unwrap nested single-member `BaseExceptionGroup`s down to their real cause.
+
+    anyio/httpx2 run request handling in task groups, so a failure inside
+    `ProfileBearerAuth` (e.g. the `CliError` login hint from `get_valid_token`)
+    reaches the caller wrapped in one or more `BaseExceptionGroup`s, and a plain
+    `str(error)` on those prints "unhandled errors in a TaskGroup" instead of the
+    real message. A group with several leaves has no single real cause, so those
+    are joined instead of picked from.
+    """
+    if isinstance(error, _BaseExceptionGroup):
+        leaves = [_leaf_exception(sub) for sub in error.exceptions]
+        if len(leaves) == 1:
+            return leaves[0]
+        return RuntimeError("; ".join(str(leaf) for leaf in leaves))
+    return error
+
+
+class ProfileBearerAuth(httpx2.Auth):
+    """Injects a fresh `if-cli` bearer token per request; re-mints once on a 401.
+
+    Never sends a profile's token to any origin but its own factory host —
+    the rule from AGENTS.md, made mechanical.
+    """
+
+    def __init__(self, profile: Profile) -> None:
+        self._profile = profile
+
+    async def async_auth_flow(self, request: httpx2.Request):  # noqa: ANN201 - httpx2.Auth's own generator protocol
+        origin = url_origin(parse_url(str(request.url)))
+        if origin != self._profile["host"]:
+            raise RuntimeError(
+                f"refusing to send the '{self._profile['name']}' profile's bearer token to {origin}; "
+                f"its factory origin is {self._profile['host']}"
+            )
+        token = await anyio.to_thread.run_sync(get_valid_token, self._profile)
+        request.headers["Authorization"] = f"Bearer {token}"
+        response = yield request
+        if response.status_code == 401:
+            token = await anyio.to_thread.run_sync(lambda: get_valid_token(self._profile, force_refresh=True))
+            request.headers["Authorization"] = f"Bearer {token}"
+            yield request
+
+
+def _result_texts(result: Any) -> list[str]:
+    """The text of a result's content blocks, dropping any block that is not text.
+
+    Only the older-revision path needs this, and there the result is the tool's
+    own refusal, which is text.
+    """
+    return [block.text for block in getattr(result, "content", []) if isinstance(block, types.TextContent)]
+
+
+def _connect_url(params: types.ElicitRequestURLParams, origin: str) -> str | None:
+    """The elicited URL, if it is on this environment's own origin.
+
+    What the check buys is narrow and worth stating plainly: the router will not
+    itself render a link to a host that is not this environment's. It cannot stop
+    a factory naming a host in the prose of a message, here or in ordinary tool
+    result text, which passes through verbatim either way. Same rule as the
+    bearer token in `ProfileBearerAuth`, applied in the other direction.
+
+    A rejected URL is reported on stderr. It means the factory named a page on a
+    host that is not its own, which the operator wants to hear about, and which
+    the tool result cannot distinguish from an elicitation in a mode the router
+    does not answer.
+    """
+    try:
+        # `urlparse` defers port validation to `.port`, which `url_origin` reads,
+        # so a malformed port raises here rather than in `parse_url`.
+        if url_origin(parse_url(params.url)) == origin:
+            return params.url
+    except ValueError:
+        pass
+    log(f"WARN dropped a connect URL that is not on {origin}: {params.url!r}")
+    return None
+
+
+class ConnectUrlRecorder:
+    """Declines every elicitation, keeping the first same-origin URL it saw.
+
+    Two jobs. Constructing this and handing it to `Client` is what advertises
+    `elicitation.url`: the SDK derives the capability from the callback being
+    non-default, and the factory only offers its Databricks connect page to a
+    client that advertised the URL mode, so the capability has to be on for the
+    page to be named at all.
+
+    The recording is for older servers only. On 2026-07-28 elicitations arrive
+    inside an `InputRequiredResult`, which `Upstream.call_tool` takes in hand
+    rather than letting the SDK dispatch the embedded requests here, so nothing
+    reaches this callback. A server negotiating an earlier revision sends
+    `elicitation/create` as its own request, which does land here, and without
+    the recording its eventual result would carry the refusal with no page named.
+
+    Declining is the right answer either way. Answering an elicitation means
+    relaying it to the downstream client, and connecting production Databricks
+    under a personal identity should be a deliberate trip to a page rather than a
+    link offered mid tool call.
+    """
+
+    def __init__(self, origin: str) -> None:
+        self._origin = origin
+        self.declined_url_request = False
+        self.url: str | None = None
+
+    async def __call__(self, _context: Any, params: Any) -> types.ElicitResult:
+        if isinstance(params, types.ElicitRequestURLParams):
+            # What makes the call a refusal is the decline, not which host the URL
+            # named. Recording the two separately keeps the origin check out of the
+            # question of whether the tool ran.
+            self.declined_url_request = True
+            if self.url is None:
+                self.url = _connect_url(params, self._origin)
+        return types.ElicitResult(action="decline")
+
+
+def _relayable_requests(result: types.InputRequiredResult, origin: str) -> tuple[list[str], str | None]:
+    """The messages this router will repeat, and the first connect URL it will name.
+
+    A URL-mode request whose URL fails the origin check is dropped whole, its
+    message included: the router rejected the one claim in that request it could
+    check, so it repeats none of it. Requests in any other mode make no such
+    claim and keep their message, which is all there is to pass on.
+
+    `result.request_state` is dropped on purpose. It is the token for retrying the
+    same call once the input is supplied, and the router never retries: the connect
+    flow is a trip to a page in a browser, well outside the lifetime of this stdio
+    process and of the factory's own state TTL.
+    """
+    messages: list[str] = []
+    url: str | None = None
+    for request in (result.input_requests or {}).values():
+        params = getattr(request, "params", None)
+        if isinstance(params, types.ElicitRequestURLParams):
+            found = _connect_url(params, origin)
+            if found is None:
+                continue
+            if url is None:
+                url = found
+        message = getattr(params, "message", None)
+        if isinstance(message, str) and message:
+            messages.append(message)
+    return messages, url
+
+
+class Upstream:
+    """One factory environment's `/mcp` endpoint, reached with its own `if-cli` profile.
+
+    The factory's streamable-HTTP transport is stateless, so every call opens
+    its own client session (connect, initialize, call, close) instead of
+    holding a long-lived connection open for the process lifetime. That keeps
+    this class small and avoids babysitting three persistent connections.
+    """
+
+    def __init__(self, code: str, profile: Profile, *, timeout: float) -> None:
+        self.code = code
+        self.profile = profile
+        self.timeout = timeout
+
+    async def _run(self, action, *, elicitation_callback=None):
+        url = f"{self.profile['host']}/mcp"
+        try:
+            async with httpx2.AsyncClient(auth=ProfileBearerAuth(self.profile), timeout=self.timeout) as http_client:
+                async with Client(
+                    streamable_http_client(url, http_client=http_client),
+                    elicitation_callback=elicitation_callback,
+                ) as client:
+                    return await action(client)
+        except _BaseExceptionGroup as error:
+            raise _leaf_exception(error) from error
+
+    async def list_tools(self) -> list[dict[str, Any]]:
+        async def collect(client: Client) -> list[dict[str, Any]]:
+            collected: list[dict[str, Any]] = []
+            cursor: str | None = None
+            while True:
+                result = await client.list_tools(cursor=cursor)
+                collected.extend(
+                    tool.model_dump(by_alias=True, mode="json", exclude_unset=True) for tool in result.tools
+                )
+                if not result.next_cursor:
+                    return collected
+                cursor = result.next_cursor
+
+        return await self._run(collect)
+
+    async def call_tool(self, name: str, arguments: dict[str, Any]) -> types.CallToolResult:
+        async def call(client: Client):
+            # `allow_input_required` hands back the factory's `InputRequiredResult`
+            # instead of letting the SDK answer the embedded requests and retry.
+            # The router has to drive this itself: the factory re-elicits on every
+            # retry that is still unconnected, so the SDK's automatic loop spins to
+            # `input_required_max_rounds` and raises before any result comes back.
+            return await client.session.call_tool(name, arguments, allow_input_required=True)
+
+        recorder = ConnectUrlRecorder(self.profile["host"])
+        result = await self._run(call, elicitation_callback=recorder)
+        if isinstance(result, types.InputRequiredResult):
+            lines, url = _relayable_requests(result, self.profile["host"])
+            return self._connect_refusal(lines, url)
+        if recorder.declined_url_request:
+            # The older-revision path. The server elicited in band and carried on
+            # once the router declined, so the connect page is in the recorder
+            # rather than in the result, and the result is whatever the tool says
+            # for an identity it never got. Anything it carried beyond text goes:
+            # the router declined, so the call did not run and there is no result
+            # to preserve.
+            return self._connect_refusal(_result_texts(result), recorder.url)
+        return result
+
+    def _connect_refusal(self, lines: list[str], url: str | None) -> types.CallToolResult:
+        """Turn the factory's request for input into a refusal naming the page to visit.
+
+        Some factory tools (`run_sql_query` and the other Databricks-backed ones)
+        run under the caller's *personal* Databricks identity, which each factory
+        stores separately. When that identity is not linked the factory asks for
+        the connect flow to be completed, offering its own connect page as a
+        URL-mode elicitation.
+
+        The router never relays that. It reports the refusal instead, naming the
+        page, which beats hardcoding a frontend route that will move.
+
+        The result is marked as an error because it is one: the connect never
+        happened and the tool never ran, and saying otherwise invites a caller to
+        read a refusal as a result. The code prefix matches the one
+        `Router.call_tool` puts on raised errors; an upstream *result* carrying
+        `is_error` never passes through that path, so without this the line would
+        not say which environment it came from.
+
+        One content block, not one per line, matching `_error_result` in `server`
+        and every other refusal the router produces. A client that renders only
+        the first text block would otherwise show the factory's message and drop
+        the connect line, which is the experience this exists to end.
+
+        With no usable URL the fallback names the environment's own host instead.
+        That address is the router's, built from the profile rather than taken
+        from the factory, so it gives the caller somewhere to start without
+        loosening what the origin check refuses to print.
+        """
+        connect = (
+            f"[{self.code}] Connect at {url}, then retry."
+            if url is not None
+            else (f"[{self.code}] This factory needs input the router cannot relay. Start at {self.profile['host']}.")
+        )
+        return types.CallToolResult(
+            content=[types.TextContent(text="\n".join([*lines, connect]))],
+            is_error=True,
+        )

insightfactory_cli-1.0.3.dev21/tests/test_router_upstream.py

@@ -0,0 +1,370 @@
+from __future__ import annotations
+
+import inspect
+from typing import Any
+
+import pytest
+
+pytest.importorskip("mcp")
+
+import anyio  # noqa: E402
+import httpx2  # noqa: E402
+import mcp_types as types  # noqa: E402
+
+from if_cli.cache import store_tokens  # noqa: E402
+from if_cli.config import Profile  # noqa: E402
+from if_cli.router.upstream import ConnectUrlRecorder, ProfileBearerAuth, Upstream  # noqa: E402
+from tests.servers import Response, ThreadedServer  # noqa: E402
+
+
+def _profile(host: str) -> Profile:
+    return {
+        "name": "a",
+        "host": host,
+        "audience": f"{host}/api",
+        "callback_port": 0,
+        "client_id": None,
+        "organization": None,
+    }
+
+
+def test_auth_refuses_to_send_the_bearer_to_a_foreign_origin():
+    profile = _profile("https://factory.example")
+
+    async def run() -> httpx2.Response:
+        async def handler(_request: httpx2.Request) -> httpx2.Response:
+            return httpx2.Response(200)
+
+        async with httpx2.AsyncClient(
+            auth=ProfileBearerAuth(profile), transport=httpx2.MockTransport(handler)
+        ) as client:
+            return await client.get("https://other.example/mcp")
+
+    with pytest.raises(RuntimeError, match="refusing to send"):
+        anyio.run(run)
+
+
+def test_auth_remints_the_token_once_on_a_401_and_retries():
+    """The 401-retry path, tested directly against the Auth class with a MockTransport.
+
+    A full end-to-end 401-then-refresh round trip through a real upstream MCP
+    session is not exercised here: `if-cli mcp` opens a fresh session per call
+    (see `Upstream._run`), and reliably forcing that session's *second* request
+    to see a 401 without also breaking its handshake requests is far more
+    fragile than isolating the retry behaviour in the auth flow itself.
+    """
+    idp = ThreadedServer(
+        lambda _request: Response(body={"access_token": "refreshed-token", "expires_in": 3600})
+    ).start()
+    try:
+        profile = _profile("https://factory.example")
+        store_tokens(
+            profile["host"],
+            {"access_token": "stale-token", "refresh_token": "refresh-tok", "expires_in": 3600},
+            f"{idp.origin}/token",
+            "test-client",
+            replace=True,
+        )
+        seen_auth: list[str | None] = []
+
+        async def run() -> httpx2.Response:
+            def handler(request: httpx2.Request) -> httpx2.Response:
+                seen_auth.append(request.headers.get("authorization"))
+                return httpx2.Response(401) if len(seen_auth) == 1 else httpx2.Response(200)
+
+            async with httpx2.AsyncClient(
+                auth=ProfileBearerAuth(profile), transport=httpx2.MockTransport(handler)
+            ) as client:
+                return await client.get(f"{profile['host']}/mcp")
+
+        response = anyio.run(run)
+        assert response.status_code == 200
+        assert seen_auth == ["Bearer stale-token", "Bearer refreshed-token"]
+    finally:
+        idp.close()
+
+
+def _url_request(url: str, message: str = "Connect your Databricks account.") -> types.ElicitRequest:
+    return types.ElicitRequest(params=types.ElicitRequestURLParams(message=message, url=url))
+
+
+def _input_required(*requests: types.ElicitRequest) -> types.InputRequiredResult:
+    return types.InputRequiredResult(
+        input_requests={f"r{index}": request for index, request in enumerate(requests)},
+        request_state="opaque",
+    )
+
+
+def _texts(result: types.CallToolResult) -> list[str]:
+    """The refusal's lines, from the single text block it is required to be.
+
+    One block, so a client that renders only the first still sees the connect
+    line. `_error_result` in `server` is the same shape.
+    """
+    assert len(result.content) == 1
+    block = result.content[0]
+    assert isinstance(block, types.TextContent)
+    return block.text.split("\n")
+
+
+class _FakeSession:
+    """Stands in for `client.session`, recording how `call_tool` was invoked."""
+
+    def __init__(self, result):
+        self._result = result
+        self.allow_input_required: bool | None = None
+
+    async def call_tool(self, _name, _arguments, *, allow_input_required=False):
+        self.allow_input_required = allow_input_required
+        return self._result
+
+
+class _FakeClient:
+    def __init__(self, result):
+        self.session = _FakeSession(result)
+
+
+def _upstream_returning(result, *, elicits: Any = None) -> tuple[Upstream, dict]:
+    """An `Upstream` whose `_run` drives the real closure against a fake client.
+
+    `elicits` stands in for a server on an older revision, which sends
+    `elicitation/create` as its own request before answering the call.
+    """
+    upstream = Upstream("prd", _profile("https://factory.example"), timeout=1)
+    seen: dict = {}
+
+    async def fake_run(action, *, elicitation_callback=None):
+        client = _FakeClient(result)
+        seen["elicitation_callback"] = elicitation_callback
+        if elicits is not None and elicitation_callback is not None:
+            seen["elicit_result"] = await elicitation_callback(None, elicits)
+        value = await action(client)
+        seen["allow_input_required"] = client.session.allow_input_required
+        return value
+
+    upstream._run = fake_run  # ty: ignore[invalid-assignment]
+    return upstream, seen
+
+
+def test_call_tool_names_the_connect_page_when_the_factory_asks_for_input():
+    """The refusal this exists for arrives as an `InputRequiredResult`, not a result.
+
+    Observed against foundryaz-dev on 14 September 2026: `run_sql_query` with no
+    linked Databricks identity returns `input_required` carrying a URL-mode
+    elicitation for the factory's connect page, and repeats it on every retry
+    that is still unconnected.
+    """
+    upstream, _ = _upstream_returning(_input_required(_url_request("https://factory.example/my-profile/developer")))
+
+    result = anyio.run(lambda: upstream.call_tool("run_sql_query", {}))
+
+    assert result.is_error
+    assert _texts(result) == [
+        "Connect your Databricks account.",
+        "[prd] Connect at https://factory.example/my-profile/developer, then retry.",
+    ]
+
+
+def test_call_tool_takes_the_input_required_result_in_hand():
+    """Without this the SDK answers the elicitation and retries until it gives up."""
+    upstream, seen = _upstream_returning(_input_required(_url_request("https://factory.example/x")))
+
+    anyio.run(lambda: upstream.call_tool("run_sql_query", {}))
+
+    assert seen["allow_input_required"] is True
+    assert isinstance(seen["elicitation_callback"], ConnectUrlRecorder)
+
+
+def test_call_tool_passes_an_ordinary_result_straight_through():
+    success = types.CallToolResult(content=[types.TextContent(text="1 row")], is_error=False)
+    upstream, _ = _upstream_returning(success)
+
+    result = anyio.run(lambda: upstream.call_tool("run_sql_query", {}))
+
+    assert result is success
+
+
+def test_call_tool_leaves_an_unrelated_failure_alone():
+    failure = types.CallToolResult(content=[types.TextContent(text="query_not_read_only")], is_error=True)
+    upstream, _ = _upstream_returning(failure)
+
+    result = anyio.run(lambda: upstream.call_tool("run_sql_query", {}))
+
+    assert _texts(result) == ["query_not_read_only"]
+
+
+@pytest.mark.parametrize(
+    "url",
+    [
+        "https://phish.example/my-profile/developer",
+        "javascript:alert(1)",
+        # `urlparse` accepts these and only raises when `url_origin` reads `.port`.
+        "https://factory.example:99999/my-profile/developer",
+        "https://factory.example:abc/my-profile/developer",
+    ],
+)
+def test_call_tool_drops_a_request_whose_url_is_not_this_environments(url: str):
+    """A URL the router would print under a trusted environment code, so it is
+    checked the same way `ProfileBearerAuth` checks where a token may go."""
+    upstream, _ = _upstream_returning(_input_required(_url_request(url)))
+
+    result = anyio.run(lambda: upstream.call_tool("run_sql_query", {}))
+
+    assert result.is_error
+    assert _texts(result) == [
+        "[prd] This factory needs input the router cannot relay. Start at https://factory.example."
+    ]
+
+
+def test_call_tool_drops_the_message_of_a_request_it_rejected():
+    """The message is printed a line above the environment code, and can name a
+    host in prose where the URL check would never reach it."""
+    upstream, _ = _upstream_returning(
+        _input_required(
+            _url_request("https://phish.example/first", message="Connect at https://phish.example/first."),
+            _url_request("https://factory.example/my-profile/developer"),
+        )
+    )
+
+    result = anyio.run(lambda: upstream.call_tool("run_sql_query", {}))
+
+    assert _texts(result) == [
+        "Connect your Databricks account.",
+        "[prd] Connect at https://factory.example/my-profile/developer, then retry.",
+    ]
+
+
+def test_call_tool_takes_the_first_same_origin_url():
+    """Only the first request's URL is used, but every accepted request keeps its
+    message, so the second one's text still appears above the connect line."""
+    upstream, _ = _upstream_returning(
+        _input_required(
+            _url_request("https://factory.example/my-profile/developer"),
+            _url_request("https://factory.example/somewhere-else", message="Or here."),
+        )
+    )
+
+    result = anyio.run(lambda: upstream.call_tool("run_sql_query", {}))
+
+    assert _texts(result) == [
+        "Connect your Databricks account.",
+        "Or here.",
+        "[prd] Connect at https://factory.example/my-profile/developer, then retry.",
+    ]
+
+
+def test_call_tool_ignores_a_form_mode_request():
+    """Answering a form means relaying it downstream, which the router does not do."""
+    form = types.ElicitRequest(
+        params=types.ElicitRequestFormParams(
+            message="Pick one.", requested_schema=types.ElicitRequestedSchema(properties={})
+        )
+    )
+    upstream, _ = _upstream_returning(_input_required(form))
+
+    result = anyio.run(lambda: upstream.call_tool("run_sql_query", {}))
+
+    assert result.is_error
+    assert _texts(result) == [
+        "Pick one.",
+        "[prd] This factory needs input the router cannot relay. Start at https://factory.example.",
+    ]
+
+
+def test_declining_is_the_answer_to_any_elicitation_that_does_reach_the_callback():
+    recorder = ConnectUrlRecorder("https://factory.example")
+    params = types.ElicitRequestURLParams(message="Connect.", url="https://factory.example/my-profile/developer")
+
+    result = anyio.run(lambda: recorder(None, params))
+
+    assert result.action == "decline"
+    assert recorder.url == "https://factory.example/my-profile/developer"
+
+
+def test_call_tool_names_the_page_a_down_level_server_elicited_in_band():
+    """Before 2026-07-28 the connect page arrives as its own `elicitation/create`,
+    and the call then answers with an ordinary refusal that names no page."""
+    refusal = types.CallToolResult(
+        content=[types.TextContent(text="Connect your Databricks account to run SQL queries.")], is_error=False
+    )
+    upstream, seen = _upstream_returning(
+        refusal,
+        elicits=types.ElicitRequestURLParams(message="Connect.", url="https://factory.example/my-profile/developer"),
+    )
+
+    result = anyio.run(lambda: upstream.call_tool("run_sql_query", {}))
+
+    assert seen["elicit_result"].action == "decline"
+    assert result.is_error
+    assert _texts(result) == [
+        "Connect your Databricks account to run SQL queries.",
+        "[prd] Connect at https://factory.example/my-profile/developer, then retry.",
+    ]
+
+
+def test_a_down_level_url_from_a_foreign_origin_is_still_a_refusal():
+    """What makes it a refusal is the decline, not the host the URL named. The
+    call did not run either way, so the origin check decides what the caller is
+    pointed at and nothing else."""
+    success = types.CallToolResult(content=[types.TextContent(text="1 row")], is_error=False)
+    upstream, _ = _upstream_returning(
+        success,
+        elicits=types.ElicitRequestURLParams(message="Connect.", url="https://phish.example/connect"),
+    )
+
+    result = anyio.run(lambda: upstream.call_tool("run_sql_query", {}))
+
+    assert result.is_error
+    assert _texts(result) == [
+        "1 row",
+        "[prd] This factory needs input the router cannot relay. Start at https://factory.example.",
+    ]
+
+
+def test_a_down_level_form_elicitation_leaves_the_result_alone():
+    """Only a URL-mode request means the connect flow. A form is a different
+    conversation, and the router declining it does not make the result a refusal."""
+    success = types.CallToolResult(content=[types.TextContent(text="1 row")], is_error=False)
+    upstream, _ = _upstream_returning(
+        success,
+        elicits=types.ElicitRequestFormParams(
+            message="Pick one.", requested_schema=types.ElicitRequestedSchema(properties={})
+        ),
+    )
+
+    result = anyio.run(lambda: upstream.call_tool("run_sql_query", {}))
+
+    assert result is success
+
+
+def test_a_dropped_connect_url_is_reported_on_stderr(capsys):
+    """Silently dropping it reads the same as an elicitation the router will not
+    answer, and the two are very different events."""
+    upstream, _ = _upstream_returning(_input_required(_url_request("https://phish.example/connect")))
+
+    anyio.run(lambda: upstream.call_tool("run_sql_query", {}))
+
+    stderr = capsys.readouterr().err
+    assert "[if-cli mcp] WARN dropped a connect URL that is not on https://factory.example" in stderr
+    assert "https://phish.example/connect" in stderr
+
+
+def test_the_sdk_still_offers_the_surface_call_tool_reaches_for():
+    """`_FakeSession` makes `.session.call_tool(allow_input_required=...)` exist by
+    construction, so only this notices an SDK release that moves it. The extra
+    floor is `mcp>=2.1,<3`, and any 2.x minor could.
+    """
+    from mcp.client import Client
+    from mcp.client.session import ClientSession
+
+    assert "session" in dir(Client)
+    assert "allow_input_required" in inspect.signature(ClientSession.call_tool).parameters
+
+
+def test_the_sdk_client_still_cannot_drive_the_loop_itself():
+    """The reason `call_tool` reaches past `Client` to the session at all. If a
+    release adds the parameter here, prefer it and drop the `.session` call.
+    """
+    from mcp.client import Client
+
+    assert "allow_input_required" not in inspect.signature(Client.call_tool).parameters

insightfactory_cli-1.0.3.dev20/src/if_cli/router/upstream.py

@@ -1,107 +0,0 @@
-from __future__ import annotations
-
-import sys
-from typing import Any
-
-import anyio
-import httpx2
-import mcp_types as types
-from mcp.client import Client
-from mcp.client.streamable_http import streamable_http_client
-
-from if_cli.config import Profile
-from if_cli.http import parse_url, url_origin
-from if_cli.oauth import get_valid_token
-
-if sys.version_info >= (3, 11):
-    _BaseExceptionGroup = BaseExceptionGroup  # noqa: F821 - builtin from 3.11 on, guarded above
-else:  # pragma: no cover - exercised only on Python < 3.11
-    # anyio pulls in this backport for exactly that case, so it is always
-    # importable here when the builtin is not.
-    from exceptiongroup import BaseExceptionGroup as _BaseExceptionGroup  # ty: ignore[unresolved-import]
-
-
-def _leaf_exception(error: BaseException) -> BaseException:
-    """Unwrap nested single-member `BaseExceptionGroup`s down to their real cause.
-
-    anyio/httpx2 run request handling in task groups, so a failure inside
-    `ProfileBearerAuth` (e.g. the `CliError` login hint from `get_valid_token`)
-    reaches the caller wrapped in one or more `BaseExceptionGroup`s, and a plain
-    `str(error)` on those prints "unhandled errors in a TaskGroup" instead of the
-    real message. A group with several leaves has no single real cause, so those
-    are joined instead of picked from.
-    """
-    if isinstance(error, _BaseExceptionGroup):
-        leaves = [_leaf_exception(sub) for sub in error.exceptions]
-        if len(leaves) == 1:
-            return leaves[0]
-        return RuntimeError("; ".join(str(leaf) for leaf in leaves))
-    return error
-
-
-class ProfileBearerAuth(httpx2.Auth):
-    """Injects a fresh `if-cli` bearer token per request; re-mints once on a 401.
-
-    Never sends a profile's token to any origin but its own factory host —
-    the rule from AGENTS.md, made mechanical.
-    """
-
-    def __init__(self, profile: Profile) -> None:
-        self._profile = profile
-
-    async def async_auth_flow(self, request: httpx2.Request):  # noqa: ANN201 - httpx2.Auth's own generator protocol
-        origin = url_origin(parse_url(str(request.url)))
-        if origin != self._profile["host"]:
-            raise RuntimeError(
-                f"refusing to send the '{self._profile['name']}' profile's bearer token to {origin}; "
-                f"its factory origin is {self._profile['host']}"
-            )
-        token = await anyio.to_thread.run_sync(get_valid_token, self._profile)
-        request.headers["Authorization"] = f"Bearer {token}"
-        response = yield request
-        if response.status_code == 401:
-            token = await anyio.to_thread.run_sync(lambda: get_valid_token(self._profile, force_refresh=True))
-            request.headers["Authorization"] = f"Bearer {token}"
-            yield request
-
-
-class Upstream:
-    """One factory environment's `/mcp` endpoint, reached with its own `if-cli` profile.
-
-    The factory's streamable-HTTP transport is stateless, so every call opens
-    its own client session (connect, initialize, call, close) instead of
-    holding a long-lived connection open for the process lifetime. That keeps
-    this class small and avoids babysitting three persistent connections.
-    """
-
-    def __init__(self, code: str, profile: Profile, *, timeout: float) -> None:
-        self.code = code
-        self.profile = profile
-        self.timeout = timeout
-
-    async def _run(self, action):
-        url = f"{self.profile['host']}/mcp"
-        try:
-            async with httpx2.AsyncClient(auth=ProfileBearerAuth(self.profile), timeout=self.timeout) as http_client:
-                async with Client(streamable_http_client(url, http_client=http_client)) as client:
-                    return await action(client)
-        except _BaseExceptionGroup as error:
-            raise _leaf_exception(error) from error
-
-    async def list_tools(self) -> list[dict[str, Any]]:
-        async def collect(client: Client) -> list[dict[str, Any]]:
-            collected: list[dict[str, Any]] = []
-            cursor: str | None = None
-            while True:
-                result = await client.list_tools(cursor=cursor)
-                collected.extend(
-                    tool.model_dump(by_alias=True, mode="json", exclude_unset=True) for tool in result.tools
-                )
-                if not result.next_cursor:
-                    return collected
-                cursor = result.next_cursor
-
-        return await self._run(collect)
-
-    async def call_tool(self, name: str, arguments: dict[str, Any]) -> types.CallToolResult:
-        return await self._run(lambda client: client.call_tool(name, arguments))

insightfactory_cli-1.0.3.dev20/tests/test_router_upstream.py

@@ -1,80 +0,0 @@
-from __future__ import annotations
-
-import pytest
-
-pytest.importorskip("mcp")
-
-import anyio  # noqa: E402
-import httpx2  # noqa: E402
-
-from if_cli.cache import store_tokens  # noqa: E402
-from if_cli.config import Profile  # noqa: E402
-from if_cli.router.upstream import ProfileBearerAuth  # noqa: E402
-from tests.servers import Response, ThreadedServer  # noqa: E402
-
-
-def _profile(host: str) -> Profile:
-    return {
-        "name": "a",
-        "host": host,
-        "audience": f"{host}/api",
-        "callback_port": 0,
-        "client_id": None,
-        "organization": None,
-    }
-
-
-def test_auth_refuses_to_send_the_bearer_to_a_foreign_origin():
-    profile = _profile("https://factory.example")
-
-    async def run() -> httpx2.Response:
-        async def handler(_request: httpx2.Request) -> httpx2.Response:
-            return httpx2.Response(200)
-
-        async with httpx2.AsyncClient(
-            auth=ProfileBearerAuth(profile), transport=httpx2.MockTransport(handler)
-        ) as client:
-            return await client.get("https://other.example/mcp")
-
-    with pytest.raises(RuntimeError, match="refusing to send"):
-        anyio.run(run)
-
-
-def test_auth_remints_the_token_once_on_a_401_and_retries():
-    """The 401-retry path, tested directly against the Auth class with a MockTransport.
-
-    A full end-to-end 401-then-refresh round trip through a real upstream MCP
-    session is not exercised here: `if-cli mcp` opens a fresh session per call
-    (see `Upstream._run`), and reliably forcing that session's *second* request
-    to see a 401 without also breaking its handshake requests is far more
-    fragile than isolating the retry behaviour in the auth flow itself.
-    """
-    idp = ThreadedServer(
-        lambda _request: Response(body={"access_token": "refreshed-token", "expires_in": 3600})
-    ).start()
-    try:
-        profile = _profile("https://factory.example")
-        store_tokens(
-            profile["host"],
-            {"access_token": "stale-token", "refresh_token": "refresh-tok", "expires_in": 3600},
-            f"{idp.origin}/token",
-            "test-client",
-            replace=True,
-        )
-        seen_auth: list[str | None] = []
-
-        async def run() -> httpx2.Response:
-            def handler(request: httpx2.Request) -> httpx2.Response:
-                seen_auth.append(request.headers.get("authorization"))
-                return httpx2.Response(401) if len(seen_auth) == 1 else httpx2.Response(200)
-
-            async with httpx2.AsyncClient(
-                auth=ProfileBearerAuth(profile), transport=httpx2.MockTransport(handler)
-            ) as client:
-                return await client.get(f"{profile['host']}/mcp")
-
-        response = anyio.run(run)
-        assert response.status_code == 200
-        assert seen_auth == ["Bearer stale-token", "Bearer refreshed-token"]
-    finally:
-        idp.close()