insightfactory-cli 1.1.2.dev30__py3-none-any.whl → 1.2.0.dev34__py3-none-any.whl

if_cli/attribution.py

@@ -0,0 +1,51 @@
+"""The `X-IF-UA` client-attribution header.
+
+The Interfaces API attributes work to the client that made the request by reading
+`X-IF-UA`, a list of RFC 9110 product tokens. It takes the first token, splits it at
+`/` into client and version, and ignores the rest. So a tool that drives `if-cli`
+names itself first through `INSIGHTFACTORY_UA` and `if-cli` appends its own token:
+
+    X-IF-UA: if-cli/1.2.0                          # INSIGHTFACTORY_UA unset
+    X-IF-UA: if-fde-harness/5.10.0 if-cli/1.2.0    # INSIGHTFACTORY_UA=if-fde-harness/5.10.0
+
+The environment value is only ever sent after it matches the product-token grammar,
+so a stray newline or shell fragment in it cannot add a header or reach the factory.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+from functools import cache
+from importlib.metadata import version
+
+from if_cli.constants import ENV_UA
+
+HEADER_NAME = "X-IF-UA"
+MAX_CALLER_PRODUCTS_LENGTH = 256
+
+# RFC 9110 section 5.6.2: token = 1*tchar. Section 10.1.5: product = token ["/" product-version].
+_TCHAR = r"[!#$%&'*+\-.^_`|~0-9A-Za-z]"
+_PRODUCT = rf"{_TCHAR}+(?:/{_TCHAR}+)?"
+_PRODUCTS = re.compile(rf"{_PRODUCT}(?: {_PRODUCT})*")
+
+
+@cache
+def _own_product() -> str:
+    return f"if-cli/{version('insightfactory-cli')}"
+
+
+def is_valid_products(value: str) -> bool:
+    """Whether `value` is one or more space-separated product tokens, within the length cap."""
+    return len(value) <= MAX_CALLER_PRODUCTS_LENGTH and _PRODUCTS.fullmatch(value) is not None
+
+
+def build_x_if_ua() -> str:
+    """The `X-IF-UA` value: the caller's products from `INSIGHTFACTORY_UA`, then `if-cli`'s own.
+
+    An unset, empty or invalid `INSIGHTFACTORY_UA` leaves `if-cli`'s token alone.
+    """
+    caller = os.environ.get(ENV_UA)
+    if caller and is_valid_products(caller):
+        return f"{caller} {_own_product()}"
+    return _own_product()

if_cli/commands/mcp.py

@@ -1,11 +1,13 @@
 from __future__ import annotations
 
 import importlib.util
+import platform
 import sys
 
 from if_cli.cli import Options, parse_args
 from if_cli.config import config_file, get_profile, list_factories, load_config, parse_factory_section
 from if_cli.http import parse_timeout_seconds
+from if_cli.router.log import log
 from if_cli.runtime import die
 
 MCP_OPTIONS: Options = {
@@ -75,6 +77,8 @@ def _stray_positional(rest: list[str]) -> str | None:
 
 
 def mcp_command(argv: list[str]) -> None:
+    log(f"starting on Python {platform.python_version()}")
+
     if "-h" in argv or "--help" in argv:
         sys.stdout.write(MCP_USAGE)
         return
@@ -146,7 +150,6 @@ def mcp_command(argv: list[str]) -> None:
     # import bug inside if_cli.router propagates instead of reading as a missing extra.
     if importlib.util.find_spec("mcp") is None:
         die(MISSING_MCP_EXTRA)
-    from if_cli.router.log import log
     from if_cli.router.server import build_router, run_server
 
     timeout = parse_timeout_seconds(values["timeout"], "--timeout")

if_cli/constants.py

@@ -1,5 +1,6 @@
 ENV_PROFILE: str = "INSIGHTFACTORY_CONFIG_PROFILE"
 ENV_REQUEST_TIMEOUT: str = "INSIGHTFACTORY_REQUEST_TIMEOUT"
+ENV_UA: str = "INSIGHTFACTORY_UA"
 DEFAULT_SCOPE: str = "openid profile email offline_access"
 LOOPBACK_HOST: str = "127.0.0.1"
 DEFAULT_CALLBACK_PORT: int = 53682

if_cli/http.py

@@ -10,6 +10,7 @@ from email.message import Message
 from typing import NoReturn
 from urllib.parse import ParseResult, urljoin, urlparse
 
+from if_cli.attribution import HEADER_NAME, build_x_if_ua
 from if_cli.constants import ENV_REQUEST_TIMEOUT
 from if_cli.runtime import die
 
@@ -170,6 +171,7 @@ def fetch_with_timeout(
     body: str | bytes | None = None,
     timeout: float | None = None,
     warn_unsafe_retry: bool = False,
+    attribute: bool = True,
 ) -> HttpResponse:
     """Issue one request, dying on timeout.
 
@@ -177,7 +179,15 @@ def fetch_with_timeout(
     sense for a request the caller issued on the user's behalf against the factory.
     It is wrong advice for an OAuth round trip, where retrying is the correct response
     and there is no factory-side state to confirm.
+
+    `attribute` adds the `X-IF-UA` header (see `if_cli.attribution`) unless the
+    caller already set one. It is on for factory requests and off for the token
+    endpoint, which belongs to the identity provider: that is a third party, and the
+    header is for the factory's own client metrics.
     """
+    request_headers = dict(headers or {})
+    if attribute and not any(name.lower() == HEADER_NAME.lower() for name in request_headers):
+        request_headers[HEADER_NAME] = build_x_if_ua()
     data: bytes | None
     if body is None:
         data = None
@@ -185,7 +195,7 @@ def fetch_with_timeout(
         data = body
     else:
         data = body.encode("utf-8")
-    request = urllib.request.Request(url, data=data, headers=headers or {}, method=method)
+    request = urllib.request.Request(url, data=data, headers=request_headers, method=method)
     effective_timeout = resolve_request_timeout(timeout)
     try:
         # Callers pass endpoints validated by parse_http_url or derived from a

if_cli/oauth.py

@@ -128,6 +128,8 @@ def _token_request(token_endpoint: str, form: dict[str, str]) -> dict[str, objec
         headers={"Content-Type": "application/x-www-form-urlencoded"},
         body=urlencode(form),
         timeout=DEFAULT_REQUEST_TIMEOUT_S,
+        # The token endpoint is the identity provider's, not the factory's.
+        attribute=False,
     )
     if not response.ok:
         body = response.text()

if_cli/router/log.py

@@ -1,13 +1,20 @@
 from __future__ import annotations
 
 import sys
+import time
+
+# Captured at import: this module loads before the router does anything else
+# diagnosable, so it stands in for process start. Two `log()` lines can then
+# be subtracted to time the phase between them.
+_START = time.monotonic()
 
 
 def log(message: str) -> None:
-    """Write one diagnostic line to stderr.
+    """Write one timestamped diagnostic line to stderr.
 
     The router speaks MCP over stdout, so stderr is the only channel that can
     carry anything to the operator. This lives in its own module because both
     `server` and `upstream` write to it and `server` imports `upstream`.
     """
-    sys.stderr.write(f"[if-cli mcp] {message}\n")
+    elapsed_ms = round((time.monotonic() - _START) * 1000)
+    sys.stderr.write(f"[if-cli mcp] +{elapsed_ms}ms {message}\n")

if_cli/router/server.py

@@ -9,7 +9,7 @@ from typing import Any, TypeVar
 import anyio
 import mcp_types as types
 from mcp.server import Server
-from mcp.server.context import ServerRequestContext
+from mcp.server.context import CallNext, HandlerResult, ServerMiddleware, ServerRequestContext
 from mcp.server.stdio import stdio_server
 from mcp.shared.exceptions import MCPError
 
@@ -137,6 +137,7 @@ class Router:
 
     async def build_catalog(self) -> list[types.Tool]:
         """Build the merged catalogue. Safe to call again to pick up a new login."""
+        log(f"catalogue: building from {self.config.catalog_source}")
         catalogues = await self._catalogues()
         source = catalogues.get(self.config.catalog_source)
         if source is None:
@@ -536,6 +537,27 @@ def advertised_extensions(router: Router) -> dict[str, dict[str, Any]]:
     return {SKILLS_EXTENSION: {}} if router.config.skills else {}
 
 
+def _log_first_initialize() -> ServerMiddleware[Any]:
+    """Log once the router has answered a client's `initialize`.
+
+    Read against `prime_catalog`'s startup log lines, this tells an operator
+    apart a slow process (nothing logged yet), a slow factory (catalogue
+    build still running past this point), and a client that called before
+    the handshake (a tool call logged before this line ever appears).
+    """
+    logged = False
+
+    async def middleware(ctx: ServerRequestContext[Any, Any], call_next: CallNext) -> HandlerResult:
+        nonlocal logged
+        result = await call_next(ctx)
+        if not logged and ctx.method == "initialize":
+            logged = True
+            log("answered the first initialize")
+        return result
+
+    return middleware
+
+
 async def _serve(router: Router) -> None:
     server: Server[Any] = Server(
         SERVER_NAME,
@@ -553,6 +575,7 @@ async def _serve(router: Router) -> None:
     # the handshake rebuilds its capabilities from `server.extensions` once the
     # protocol version is known, and ignores the ones computed here.
     server.extensions = advertised_extensions(router)
+    server.middleware.append(_log_first_initialize())
     # Answer `initialize` immediately: the catalogue build runs as a background
     # task so one hung factory reads as a slow tools/list, not a failed
     # handshake (clients cap startup time).

if_cli/router/upstream.py

@@ -9,6 +9,7 @@ import mcp_types as types
 from mcp.client import Client
 from mcp.client.streamable_http import streamable_http_client
 
+from if_cli.attribution import HEADER_NAME, build_x_if_ua
 from if_cli.config import Profile
 from if_cli.http import parse_url, url_origin
 from if_cli.oauth import get_valid_token
@@ -200,7 +201,11 @@ class Upstream:
     async def _run(self, action, *, elicitation_callback=None):
         url = f"{self.profile['host']}/mcp"
         try:
-            async with httpx2.AsyncClient(auth=ProfileBearerAuth(self.profile), timeout=self.timeout) as http_client:
+            async with httpx2.AsyncClient(
+                auth=ProfileBearerAuth(self.profile),
+                timeout=self.timeout,
+                headers={HEADER_NAME: build_x_if_ua()},
+            ) as http_client:
                 async with Client(
                     streamable_http_client(url, http_client=http_client),
                     elicitation_callback=elicitation_callback,

{insightfactory_cli-1.1.2.dev30.dist-info → insightfactory_cli-1.2.0.dev34.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: insightfactory-cli
-Version: 1.1.2.dev30
+Version: 1.2.0.dev34
 Summary: Profile-based authentication CLI for the InsightFactory Interfaces API
 Project-URL: Homepage, https://insightfactory.ai
 Author-email: "insightfactory.ai Support" <support@insightfactory.ai>
@@ -128,6 +128,14 @@ accepted and completed the request after `if-cli` gave up, so re-issuing a
 timeout message tells you to confirm the current state before retrying rather
 than repeat the call.
 
+Every request to the factory carries an `X-IF-UA` header naming the client,
+`if-cli/<version>` by default. A tool that runs `if-cli` can name itself first
+by setting `INSIGHTFACTORY_UA` to one or more RFC 9110 product tokens, such as
+`if-fde-harness/5.10.0`, and the header becomes
+`if-fde-harness/5.10.0 if-cli/<version>`. The CLI ignores a value that is not
+valid product-token syntax or is longer than 256 characters. Token requests to
+the identity provider never carry the header.
+
 Override the config directory with `INSIGHTFACTORY_CONFIG_DIR`, which is useful
 in tests and CI. The default is `~/.insightfactory`.
 
@@ -265,6 +273,14 @@ uv tool install 'insightfactory-cli[mcp]'
 uvx --from 'insightfactory-cli[mcp]' if-cli mcp foundry
 ```
 
+The first `uvx` launch resolves and downloads the package from PyPI before it runs, which
+added roughly four to six seconds on top of the usual startup in local testing, against
+under two seconds once `uv`'s cache was warm. A client with a fixed handshake budget
+(Claude Code allows 30 seconds) usually has room for that, but a slow network can close
+the gap. Two ways to avoid paying it on every launch: `uv tool install 'insightfactory-cli[mcp]'`
+puts a real script on `PATH` with no resolve step, or run the same `uvx --from ...` command
+by hand once before pointing a client at it, which warms `uv`'s cache for the launches after.
+
 Add it to `.mcp.json`:
 
 ```json

{insightfactory_cli-1.1.2.dev30.dist-info → insightfactory_cli-1.2.0.dev34.dist-info}/RECORD

@@ -1,14 +1,15 @@
 if_cli/__init__.py,sha256=YYcz-hEiXXUjdBFGipOrVHynsyH4ZLqQOCDobvCAu8Y,26
 if_cli/__main__.py,sha256=2hLFIiT-gocMb0VJVzVYtGVIoHrxyMChucRgexbXLSQ,68
+if_cli/attribution.py,sha256=hNp1hBueRUh1EKYs61AZF76voehw70F7gZKiI5zOMCw,1869
 if_cli/cache.py,sha256=UfvHs3GQIVg0sVfKYWw4UGlq8d-8BEXuZIDfC1hwwjA,6587
 if_cli/callback_page.py,sha256=lTHd3-vzlT9ndAL7XYonBfy97lBW7apRw3V7SmhNObo,5907
 if_cli/cli.py,sha256=fF7HvsUgpKhkLFdXLMJ1JXHGjp3RwJt2YmPSEW0d8gY,6270
 if_cli/colour.py,sha256=2hbaM4ubTHGja6YZRD886eqnB7T2IaZyW5rvfOjxe4M,682
 if_cli/config.py,sha256=QiphIhVLDN3sp39xMWKwXEyJWxx4IhXT28oEtmPc0ew,10601
-if_cli/constants.py,sha256=RW43KupAdhXfBsX6MxzZdJ-R57brX0q0TgIq8xXgvPs,269
-if_cli/http.py,sha256=W8HL3uZLeOu5MgmsOavM1Y6x4AcrInIQsAr5hx-j8AE,7671
+if_cli/constants.py,sha256=WxZozWfhMCFWU_Wupa__CaJI9UgqJ28W8cchGtp6p4Q,303
+if_cli/http.py,sha256=LNkQtyUR1DAgLcR2CrNzTMHFQO_j_vfHuOBagmQEYNk,8249
 if_cli/main.py,sha256=pn-X2wrHNplc8ceT5_nEv5XlrTN3KgpK8UU4gAmBiWY,3212
-if_cli/oauth.py,sha256=8QZy4A7NqnWSnTULQct-Tj6RT906RstBJOloSTzgflU,16462
+if_cli/oauth.py,sha256=lSJXzOsOzHlkZX56JWoh9G6-sD9MOGgmwpI18tdhA6c,16563
 if_cli/runtime.py,sha256=Pz2iVclqy-uu1UMQWK2P_Hx7O4zAF30UpSFqQvGN0NY,2663
 if_cli/assets/__init__.py,sha256=2vBBor8lUEQofiC6EvS5BvF_ANhfK8bfR9S0OXI8j3g,41
 if_cli/assets/insightfactoryai-logo.svg,sha256=yFxHkoHl6VNm8ppCInTZCVN_bdOog9h-NV8R4Gw1Qew,8192
@@ -17,19 +18,19 @@ if_cli/commands/api.py,sha256=XeVhhD39Oho4xNbMJIGh1I6vi53on5EGGsAtsb_5TAg,9016
 if_cli/commands/config.py,sha256=1KAxjme897NIbXTGBw1rNJlXnFvhbEUf5MAli8A93ns,1724
 if_cli/commands/login.py,sha256=vxsYcRZWsaNEzekyN1zy4ROJO-OCGUpjaVUBhtbK1LY,3255
 if_cli/commands/logout.py,sha256=TW0P4_tXcTtiHHR73xVPHyhlbOWD1jBnkZsMImCiCBw,668
-if_cli/commands/mcp.py,sha256=SVF4egfA9RzjY5GHRlbk0mVi0HtmKfMh8v-SSYHjs98,7270
+if_cli/commands/mcp.py,sha256=iaSsqWkV1lnFjIw9y1pX1ORB1MdKiOVWgK23EDIsDB4,7342
 if_cli/commands/profiles.py,sha256=tgZP5sMqzbFHXlfvglL2plsGdU0M3joo3wvQKX45J1U,3950
 if_cli/commands/set_token.py,sha256=BVyv_QmByvllr04pE2sz8JFEscHbIgOC-7ZPg61PRoc,1886
 if_cli/commands/token.py,sha256=CyiXkyH7vxgH91-n-XJzeHnLI6mZJwO9Js5AHvfHaeM,1120
 if_cli/router/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 if_cli/router/catalog.py,sha256=Er2ZbWTwDUVU-qBGCvyA0bIlFk3UYw_6sVUlYwBhMpI,4992
 if_cli/router/content.py,sha256=POL2n5NIY8yenQHJe8pUbTuTNpPSUSm0Y6Txbvehzhs,14487
-if_cli/router/log.py,sha256=YLWeHUb05HUnS3XHubCwy7oLZAUEGAiHcZysz_YMAAo,412
+if_cli/router/log.py,sha256=wtaqsFcD3hPJRu4jCJaDMSedj-43Y07ym62YgrOm1yM,740
 if_cli/router/policy.py,sha256=CclbjuOA5mwwoQiNDa17iQeN9eXRbfy11bS9JFd8gL4,2840
-if_cli/router/server.py,sha256=JZ-7xbNyDadSY1VVLHpSVTjfx6vxI_uumxFaD22Pl0Y,26449
-if_cli/router/upstream.py,sha256=Ga0OM918Y1CFyQFGs2wO0ocyjcMe1Wk0LvffOZOaE34,18559
-insightfactory_cli-1.1.2.dev30.dist-info/METADATA,sha256=slUXCeTP0H1dPYnOUVV2AZyWBDHlteeG3Grz5dED0Fc,23695
-insightfactory_cli-1.1.2.dev30.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-insightfactory_cli-1.1.2.dev30.dist-info/entry_points.txt,sha256=UlX854D7f-7dBj5F0wGdakVy6vopvP9hA1BN-gv739w,44
-insightfactory_cli-1.1.2.dev30.dist-info/licenses/LICENSE,sha256=8eZ1YAABL398qESVJc_FlK1voYQ0GAh-R_rNBQK6QH8,234
-insightfactory_cli-1.1.2.dev30.dist-info/RECORD,,
+if_cli/router/server.py,sha256=yCjGAm-tnZBOTg5AfvojnLcKcZLEbQQeT9iqqX8XV5A,27397
+if_cli/router/upstream.py,sha256=Ly4fcuQRywS6db2oDYoe8F4c9hryN75FdBqSWzA09g4,18720
+insightfactory_cli-1.2.0.dev34.dist-info/METADATA,sha256=xbyLKunNzQ2g7wv-86s5ruh_-rnUyetLKVWwYINNBp8,24817
+insightfactory_cli-1.2.0.dev34.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+insightfactory_cli-1.2.0.dev34.dist-info/entry_points.txt,sha256=UlX854D7f-7dBj5F0wGdakVy6vopvP9hA1BN-gv739w,44
+insightfactory_cli-1.2.0.dev34.dist-info/licenses/LICENSE,sha256=8eZ1YAABL398qESVJc_FlK1voYQ0GAh-R_rNBQK6QH8,234
+insightfactory_cli-1.2.0.dev34.dist-info/RECORD,,