insightfactory-cli 1.1.2.dev30__tar.gz → 1.2.0__tar.gz

{insightfactory_cli-1.1.2.dev30 → insightfactory_cli-1.2.0}/CHANGELOG.md

@@ -11,6 +11,20 @@ that: every PR into `develop` must add an entry here, and a tag whose version ha
 section fails rather than releasing an empty page. The version only moves when the
 last one has been released, so a cycle's PRs share a section.
 
+## 1.2.0
+
+### Added
+
+- Factory requests carry an `X-IF-UA` header of RFC 9110 product tokens, so the
+  Interfaces API can attribute work to the client that made it. The value is
+  `if-cli/<version>`, with the contents of `INSIGHTFACTORY_UA` in front when that
+  variable holds valid product tokens, for example
+  `if-fde-harness/5.10.0 if-cli/1.2.0`. The CLI drops a value that fails the
+  grammar or exceeds 256 characters and sends its own token alone. `api`, OAuth
+  discovery and the `if-cli mcp` router's calls to each factory send the header.
+  Token requests to the identity provider do not, and a header the caller sets
+  itself replaces the built one.
+
 ## 1.1.2
 
 ### Added
@@ -31,6 +45,12 @@ last one has been released, so a cycle's PRs share a section.
 
 ### Changed
 
+- The router's stderr lines now carry the elapsed time since startup, and it logs when
+  the catalogue build starts and when it answers its first `initialize`, so an operator
+  can tell a slow process apart from a slow factory and a client that called before the
+  handshake finished. `if-cli mcp` also now logs a `starting on Python <version>` line
+  before doing anything else, so a process that dies during argument parsing, config
+  load, or profile lookup still leaves one line on stderr instead of none.
 - `release-guard` asks every PR into `develop` for a `CHANGELOG.md` entry, and asks
   for a version bump only when `develop` is still on the version `main` is on. One
   bump opens a release cycle and the PRs after it add to the section it opened,

{insightfactory_cli-1.1.2.dev30 → insightfactory_cli-1.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: insightfactory-cli
-Version: 1.1.2.dev30
+Version: 1.2.0
 Summary: Profile-based authentication CLI for the InsightFactory Interfaces API
 Project-URL: Homepage, https://insightfactory.ai
 Author-email: "insightfactory.ai Support" <support@insightfactory.ai>
@@ -128,6 +128,14 @@ accepted and completed the request after `if-cli` gave up, so re-issuing a
 timeout message tells you to confirm the current state before retrying rather
 than repeat the call.
 
+Every request to the factory carries an `X-IF-UA` header naming the client,
+`if-cli/<version>` by default. A tool that runs `if-cli` can name itself first
+by setting `INSIGHTFACTORY_UA` to one or more RFC 9110 product tokens, such as
+`if-fde-harness/5.10.0`, and the header becomes
+`if-fde-harness/5.10.0 if-cli/<version>`. The CLI ignores a value that is not
+valid product-token syntax or is longer than 256 characters. Token requests to
+the identity provider never carry the header.
+
 Override the config directory with `INSIGHTFACTORY_CONFIG_DIR`, which is useful
 in tests and CI. The default is `~/.insightfactory`.
 
@@ -265,6 +273,14 @@ uv tool install 'insightfactory-cli[mcp]'
 uvx --from 'insightfactory-cli[mcp]' if-cli mcp foundry
 ```
 
+The first `uvx` launch resolves and downloads the package from PyPI before it runs, which
+added roughly four to six seconds on top of the usual startup in local testing, against
+under two seconds once `uv`'s cache was warm. A client with a fixed handshake budget
+(Claude Code allows 30 seconds) usually has room for that, but a slow network can close
+the gap. Two ways to avoid paying it on every launch: `uv tool install 'insightfactory-cli[mcp]'`
+puts a real script on `PATH` with no resolve step, or run the same `uvx --from ...` command
+by hand once before pointing a client at it, which warms `uv`'s cache for the launches after.
+
 Add it to `.mcp.json`:
 
 ```json

{insightfactory_cli-1.1.2.dev30 → insightfactory_cli-1.2.0}/README.md

@@ -104,6 +104,14 @@ accepted and completed the request after `if-cli` gave up, so re-issuing a
 timeout message tells you to confirm the current state before retrying rather
 than repeat the call.
 
+Every request to the factory carries an `X-IF-UA` header naming the client,
+`if-cli/<version>` by default. A tool that runs `if-cli` can name itself first
+by setting `INSIGHTFACTORY_UA` to one or more RFC 9110 product tokens, such as
+`if-fde-harness/5.10.0`, and the header becomes
+`if-fde-harness/5.10.0 if-cli/<version>`. The CLI ignores a value that is not
+valid product-token syntax or is longer than 256 characters. Token requests to
+the identity provider never carry the header.
+
 Override the config directory with `INSIGHTFACTORY_CONFIG_DIR`, which is useful
 in tests and CI. The default is `~/.insightfactory`.
 
@@ -241,6 +249,14 @@ uv tool install 'insightfactory-cli[mcp]'
 uvx --from 'insightfactory-cli[mcp]' if-cli mcp foundry
 ```
 
+The first `uvx` launch resolves and downloads the package from PyPI before it runs, which
+added roughly four to six seconds on top of the usual startup in local testing, against
+under two seconds once `uv`'s cache was warm. A client with a fixed handshake budget
+(Claude Code allows 30 seconds) usually has room for that, but a slow network can close
+the gap. Two ways to avoid paying it on every launch: `uv tool install 'insightfactory-cli[mcp]'`
+puts a real script on `PATH` with no resolve step, or run the same `uvx --from ...` command
+by hand once before pointing a client at it, which warms `uv`'s cache for the launches after.
+
 Add it to `.mcp.json`:
 
 ```json

{insightfactory_cli-1.1.2.dev30 → insightfactory_cli-1.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "insightfactory-cli"
-version = "1.1.2.dev30"
+version = "1.2.0"
 description = "Profile-based authentication CLI for the InsightFactory Interfaces API"
 readme = "README.md"
 requires-python = ">=3.10"

insightfactory_cli-1.2.0/src/if_cli/attribution.py

@@ -0,0 +1,51 @@
+"""The `X-IF-UA` client-attribution header.
+
+The Interfaces API attributes work to the client that made the request by reading
+`X-IF-UA`, a list of RFC 9110 product tokens. It takes the first token, splits it at
+`/` into client and version, and ignores the rest. So a tool that drives `if-cli`
+names itself first through `INSIGHTFACTORY_UA` and `if-cli` appends its own token:
+
+    X-IF-UA: if-cli/1.2.0                          # INSIGHTFACTORY_UA unset
+    X-IF-UA: if-fde-harness/5.10.0 if-cli/1.2.0    # INSIGHTFACTORY_UA=if-fde-harness/5.10.0
+
+The environment value is only ever sent after it matches the product-token grammar,
+so a stray newline or shell fragment in it cannot add a header or reach the factory.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+from functools import cache
+from importlib.metadata import version
+
+from if_cli.constants import ENV_UA
+
+HEADER_NAME = "X-IF-UA"
+MAX_CALLER_PRODUCTS_LENGTH = 256
+
+# RFC 9110 section 5.6.2: token = 1*tchar. Section 10.1.5: product = token ["/" product-version].
+_TCHAR = r"[!#$%&'*+\-.^_`|~0-9A-Za-z]"
+_PRODUCT = rf"{_TCHAR}+(?:/{_TCHAR}+)?"
+_PRODUCTS = re.compile(rf"{_PRODUCT}(?: {_PRODUCT})*")
+
+
+@cache
+def _own_product() -> str:
+    return f"if-cli/{version('insightfactory-cli')}"
+
+
+def is_valid_products(value: str) -> bool:
+    """Whether `value` is one or more space-separated product tokens, within the length cap."""
+    return len(value) <= MAX_CALLER_PRODUCTS_LENGTH and _PRODUCTS.fullmatch(value) is not None
+
+
+def build_x_if_ua() -> str:
+    """The `X-IF-UA` value: the caller's products from `INSIGHTFACTORY_UA`, then `if-cli`'s own.
+
+    An unset, empty or invalid `INSIGHTFACTORY_UA` leaves `if-cli`'s token alone.
+    """
+    caller = os.environ.get(ENV_UA)
+    if caller and is_valid_products(caller):
+        return f"{caller} {_own_product()}"
+    return _own_product()

{insightfactory_cli-1.1.2.dev30 → insightfactory_cli-1.2.0}/src/if_cli/commands/mcp.py

@@ -1,11 +1,13 @@
 from __future__ import annotations
 
 import importlib.util
+import platform
 import sys
 
 from if_cli.cli import Options, parse_args
 from if_cli.config import config_file, get_profile, list_factories, load_config, parse_factory_section
 from if_cli.http import parse_timeout_seconds
+from if_cli.router.log import log
 from if_cli.runtime import die
 
 MCP_OPTIONS: Options = {
@@ -75,6 +77,8 @@ def _stray_positional(rest: list[str]) -> str | None:
 
 
 def mcp_command(argv: list[str]) -> None:
+    log(f"starting on Python {platform.python_version()}")
+
     if "-h" in argv or "--help" in argv:
         sys.stdout.write(MCP_USAGE)
         return
@@ -146,7 +150,6 @@ def mcp_command(argv: list[str]) -> None:
     # import bug inside if_cli.router propagates instead of reading as a missing extra.
     if importlib.util.find_spec("mcp") is None:
         die(MISSING_MCP_EXTRA)
-    from if_cli.router.log import log
     from if_cli.router.server import build_router, run_server
 
     timeout = parse_timeout_seconds(values["timeout"], "--timeout")

{insightfactory_cli-1.1.2.dev30 → insightfactory_cli-1.2.0}/src/if_cli/constants.py

@@ -1,5 +1,6 @@
 ENV_PROFILE: str = "INSIGHTFACTORY_CONFIG_PROFILE"
 ENV_REQUEST_TIMEOUT: str = "INSIGHTFACTORY_REQUEST_TIMEOUT"
+ENV_UA: str = "INSIGHTFACTORY_UA"
 DEFAULT_SCOPE: str = "openid profile email offline_access"
 LOOPBACK_HOST: str = "127.0.0.1"
 DEFAULT_CALLBACK_PORT: int = 53682

{insightfactory_cli-1.1.2.dev30 → insightfactory_cli-1.2.0}/src/if_cli/http.py

@@ -10,6 +10,7 @@ from email.message import Message
 from typing import NoReturn
 from urllib.parse import ParseResult, urljoin, urlparse
 
+from if_cli.attribution import HEADER_NAME, build_x_if_ua
 from if_cli.constants import ENV_REQUEST_TIMEOUT
 from if_cli.runtime import die
 
@@ -170,6 +171,7 @@ def fetch_with_timeout(
     body: str | bytes | None = None,
     timeout: float | None = None,
     warn_unsafe_retry: bool = False,
+    attribute: bool = True,
 ) -> HttpResponse:
     """Issue one request, dying on timeout.
 
@@ -177,7 +179,15 @@ def fetch_with_timeout(
     sense for a request the caller issued on the user's behalf against the factory.
     It is wrong advice for an OAuth round trip, where retrying is the correct response
     and there is no factory-side state to confirm.
+
+    `attribute` adds the `X-IF-UA` header (see `if_cli.attribution`) unless the
+    caller already set one. It is on for factory requests and off for the token
+    endpoint, which belongs to the identity provider: that is a third party, and the
+    header is for the factory's own client metrics.
     """
+    request_headers = dict(headers or {})
+    if attribute and not any(name.lower() == HEADER_NAME.lower() for name in request_headers):
+        request_headers[HEADER_NAME] = build_x_if_ua()
     data: bytes | None
     if body is None:
         data = None
@@ -185,7 +195,7 @@ def fetch_with_timeout(
         data = body
     else:
         data = body.encode("utf-8")
-    request = urllib.request.Request(url, data=data, headers=headers or {}, method=method)
+    request = urllib.request.Request(url, data=data, headers=request_headers, method=method)
     effective_timeout = resolve_request_timeout(timeout)
     try:
         # Callers pass endpoints validated by parse_http_url or derived from a

{insightfactory_cli-1.1.2.dev30 → insightfactory_cli-1.2.0}/src/if_cli/oauth.py

@@ -128,6 +128,8 @@ def _token_request(token_endpoint: str, form: dict[str, str]) -> dict[str, objec
         headers={"Content-Type": "application/x-www-form-urlencoded"},
         body=urlencode(form),
         timeout=DEFAULT_REQUEST_TIMEOUT_S,
+        # The token endpoint is the identity provider's, not the factory's.
+        attribute=False,
     )
     if not response.ok:
         body = response.text()

insightfactory_cli-1.2.0/src/if_cli/router/log.py

@@ -0,0 +1,20 @@
+from __future__ import annotations
+
+import sys
+import time
+
+# Captured at import: this module loads before the router does anything else
+# diagnosable, so it stands in for process start. Two `log()` lines can then
+# be subtracted to time the phase between them.
+_START = time.monotonic()
+
+
+def log(message: str) -> None:
+    """Write one timestamped diagnostic line to stderr.
+
+    The router speaks MCP over stdout, so stderr is the only channel that can
+    carry anything to the operator. This lives in its own module because both
+    `server` and `upstream` write to it and `server` imports `upstream`.
+    """
+    elapsed_ms = round((time.monotonic() - _START) * 1000)
+    sys.stderr.write(f"[if-cli mcp] +{elapsed_ms}ms {message}\n")

{insightfactory_cli-1.1.2.dev30 → insightfactory_cli-1.2.0}/src/if_cli/router/server.py

@@ -9,7 +9,7 @@ from typing import Any, TypeVar
 import anyio
 import mcp_types as types
 from mcp.server import Server
-from mcp.server.context import ServerRequestContext
+from mcp.server.context import CallNext, HandlerResult, ServerMiddleware, ServerRequestContext
 from mcp.server.stdio import stdio_server
 from mcp.shared.exceptions import MCPError
 
@@ -137,6 +137,7 @@ class Router:
 
     async def build_catalog(self) -> list[types.Tool]:
         """Build the merged catalogue. Safe to call again to pick up a new login."""
+        log(f"catalogue: building from {self.config.catalog_source}")
         catalogues = await self._catalogues()
         source = catalogues.get(self.config.catalog_source)
         if source is None:
@@ -536,6 +537,27 @@ def advertised_extensions(router: Router) -> dict[str, dict[str, Any]]:
     return {SKILLS_EXTENSION: {}} if router.config.skills else {}
 
 
+def _log_first_initialize() -> ServerMiddleware[Any]:
+    """Log once the router has answered a client's `initialize`.
+
+    Read against `prime_catalog`'s startup log lines, this tells an operator
+    apart a slow process (nothing logged yet), a slow factory (catalogue
+    build still running past this point), and a client that called before
+    the handshake (a tool call logged before this line ever appears).
+    """
+    logged = False
+
+    async def middleware(ctx: ServerRequestContext[Any, Any], call_next: CallNext) -> HandlerResult:
+        nonlocal logged
+        result = await call_next(ctx)
+        if not logged and ctx.method == "initialize":
+            logged = True
+            log("answered the first initialize")
+        return result
+
+    return middleware
+
+
 async def _serve(router: Router) -> None:
     server: Server[Any] = Server(
         SERVER_NAME,
@@ -553,6 +575,7 @@ async def _serve(router: Router) -> None:
     # the handshake rebuilds its capabilities from `server.extensions` once the
     # protocol version is known, and ignores the ones computed here.
     server.extensions = advertised_extensions(router)
+    server.middleware.append(_log_first_initialize())
     # Answer `initialize` immediately: the catalogue build runs as a background
     # task so one hung factory reads as a slow tools/list, not a failed
     # handshake (clients cap startup time).

{insightfactory_cli-1.1.2.dev30 → insightfactory_cli-1.2.0}/src/if_cli/router/upstream.py

@@ -9,6 +9,7 @@ import mcp_types as types
 from mcp.client import Client
 from mcp.client.streamable_http import streamable_http_client
 
+from if_cli.attribution import HEADER_NAME, build_x_if_ua
 from if_cli.config import Profile
 from if_cli.http import parse_url, url_origin
 from if_cli.oauth import get_valid_token
@@ -200,7 +201,11 @@ class Upstream:
     async def _run(self, action, *, elicitation_callback=None):
         url = f"{self.profile['host']}/mcp"
         try:
-            async with httpx2.AsyncClient(auth=ProfileBearerAuth(self.profile), timeout=self.timeout) as http_client:
+            async with httpx2.AsyncClient(
+                auth=ProfileBearerAuth(self.profile),
+                timeout=self.timeout,
+                headers={HEADER_NAME: build_x_if_ua()},
+            ) as http_client:
                 async with Client(
                     streamable_http_client(url, http_client=http_client),
                     elicitation_callback=elicitation_callback,

{insightfactory_cli-1.1.2.dev30 → insightfactory_cli-1.2.0}/tests/conftest.py

@@ -7,5 +7,7 @@ import pytest
 def isolate_insightfactory_home(tmp_path, monkeypatch):
     monkeypatch.setenv("INSIGHTFACTORY_CONFIG_DIR", str(tmp_path))
     monkeypatch.delenv("INSIGHTFACTORY_CONFIG_PROFILE", raising=False)
+    # The FDE harness sets this in the shells it runs, tests included.
+    monkeypatch.delenv("INSIGHTFACTORY_UA", raising=False)
     monkeypatch.setenv("NO_COLOR", "1")
     return tmp_path

insightfactory_cli-1.2.0/tests/test_attribution.py

@@ -0,0 +1,160 @@
+from __future__ import annotations
+
+from importlib.metadata import version
+
+import pytest
+
+from if_cli import oauth
+from if_cli.attribution import MAX_CALLER_PRODUCTS_LENGTH, build_x_if_ua
+from if_cli.cache import store_tokens
+from if_cli.config import Profile
+from if_cli.http import fetch_with_timeout
+from tests.servers import Request, Response, ThreadedServer
+
+OWN = f"if-cli/{version('insightfactory-cli')}"
+
+
+def _header(headers: dict[str, str], name: str = "X-IF-UA") -> str | None:
+    matches = [value for key, value in headers.items() if key.lower() == name.lower()]
+    assert len(matches) <= 1, f"{name} sent more than once: {matches}"
+    return matches[0] if matches else None
+
+
+def _recording_server(response: Response | None = None) -> tuple[ThreadedServer, list[dict[str, str]]]:
+    seen: list[dict[str, str]] = []
+
+    def handler(request: Request) -> Response:
+        seen.append(request.headers)
+        return response or Response(body={"ok": True})
+
+    return ThreadedServer(handler).start(), seen
+
+
+def _profile(host: str) -> Profile:
+    return {
+        "name": "a",
+        "host": host,
+        "audience": f"{host}/api",
+        "callback_port": 0,
+        "client_id": None,
+        "organization": None,
+    }
+
+
+def test_unset_sends_only_the_cli_token():
+    assert build_x_if_ua() == OWN
+
+
+@pytest.mark.parametrize(
+    "caller",
+    [
+        "if-fde-harness/5.10.0",
+        "if-fde-harness-mcp",
+        "if-fde-harness/5.10.0 other/1",
+        "a!#$%&'*+-.^_`|~z/9",
+    ],
+)
+def test_a_valid_value_goes_first(monkeypatch, caller: str):
+    monkeypatch.setenv("INSIGHTFACTORY_UA", caller)
+    assert build_x_if_ua() == f"{caller} {OWN}"
+
+
+@pytest.mark.parametrize(
+    "caller",
+    [
+        "",
+        " ",
+        "\t",
+        "if-fde-harness/5.10.0\nX-Injected: 1",
+        "if-fde-harness/5.10.0\r\n",
+        "if-fde-harness/5.10.0\n",
+        "$(whoami)",
+        "if-fde-harness/$(whoami)",
+        " if-fde-harness/5.10.0",
+        "if-fde-harness/5.10.0 ",
+        "if-fde-harness/5.10.0  other/1",
+        "if-fde-harness/",
+        "/5.10.0",
+        "a/b/c",
+        "if-fde-harness/5.10.0 (comment)",
+        "harnessé/1",
+        "x" * (MAX_CALLER_PRODUCTS_LENGTH + 1),
+    ],
+)
+def test_an_invalid_value_is_dropped(monkeypatch, caller: str):
+    monkeypatch.setenv("INSIGHTFACTORY_UA", caller)
+    assert build_x_if_ua() == OWN
+
+
+def test_a_value_at_the_cap_is_kept(monkeypatch):
+    caller = "x" * MAX_CALLER_PRODUCTS_LENGTH
+    monkeypatch.setenv("INSIGHTFACTORY_UA", caller)
+    assert build_x_if_ua() == f"{caller} {OWN}"
+
+
+def test_fetch_with_timeout_sends_the_header(monkeypatch):
+    monkeypatch.setenv("INSIGHTFACTORY_UA", "if-fde-harness/5.10.0")
+    server, seen = _recording_server()
+    try:
+        fetch_with_timeout(f"{server.origin}/api/health")
+    finally:
+        server.close()
+    assert _header(seen[0]) == f"if-fde-harness/5.10.0 {OWN}"
+
+
+def test_fetch_with_timeout_never_puts_an_invalid_value_on_the_wire(monkeypatch):
+    monkeypatch.setenv("INSIGHTFACTORY_UA", "if-fde-harness/5.10.0\r\nX-Injected: 1")
+    server, seen = _recording_server()
+    try:
+        fetch_with_timeout(f"{server.origin}/api/health")
+    finally:
+        server.close()
+    assert _header(seen[0]) == OWN
+    assert _header(seen[0], "X-Injected") is None
+
+
+@pytest.mark.parametrize("name", ["X-IF-UA", "x-if-ua"])
+def test_a_caller_supplied_header_wins(monkeypatch, name: str):
+    monkeypatch.setenv("INSIGHTFACTORY_UA", "if-fde-harness/5.10.0")
+    server, seen = _recording_server()
+    try:
+        fetch_with_timeout(f"{server.origin}/api/health", headers={name: "custom/1"})
+    finally:
+        server.close()
+    assert _header(seen[0]) == "custom/1"
+
+
+def test_oauth_discovery_on_the_factory_carries_the_header(monkeypatch):
+    monkeypatch.setenv("INSIGHTFACTORY_UA", "if-fde-harness/5.10.0")
+    server, seen = _recording_server(
+        Response(
+            body={
+                "authorization_endpoint": "https://factory.example/authorize",
+                "token_endpoint": "https://factory.example/oauth/token",
+            }
+        )
+    )
+    try:
+        oauth._discover(server.origin)
+    finally:
+        server.close()
+    assert _header(seen[0]) == f"if-fde-harness/5.10.0 {OWN}"
+
+
+def test_the_identity_provider_token_request_carries_no_header(monkeypatch):
+    monkeypatch.setenv("INSIGHTFACTORY_UA", "if-fde-harness/5.10.0")
+    idp, seen = _recording_server(Response(body={"access_token": "refreshed-token", "expires_in": 3600}))
+    try:
+        profile = _profile("https://factory.example")
+        store_tokens(
+            profile["host"],
+            {"access_token": "stale-token", "refresh_token": "refresh-tok", "expires_in": 0},
+            f"{idp.origin}/token",
+            "test-client",
+            replace=True,
+        )
+        assert oauth.get_valid_token(profile, force_refresh=True) == "refreshed-token"
+    finally:
+        idp.close()
+    assert len(seen) == 1
+    assert _header(seen[0]) is None

{insightfactory_cli-1.1.2.dev30 → insightfactory_cli-1.2.0}/tests/test_mcp_command.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import json
 import os
+import re
 import subprocess
 import sys
 import time
@@ -802,11 +803,10 @@ def test_mcp_command_logs_the_resolved_factory_mapping_at_startup(tmp_path: Path
 
         anyio.run(scenario)
         stderr_text = stderr_path.read_text(encoding="utf-8")
-        expected = (
-            f"[if-cli mcp] foundry: dev=profile-a {server_a.origin} (writable); "
-            f"tst=profile-b {server_b.origin}; catalog=dev"
+        expected = re.escape(
+            f"foundry: dev=profile-a {server_a.origin} (writable); tst=profile-b {server_b.origin}; catalog=dev"
         )
-        assert expected in stderr_text
+        assert re.search(rf"\[if-cli mcp\] \+\d+ms {expected}", stderr_text)
     finally:
         server_a.close()
         server_b.close()
@@ -827,8 +827,8 @@ def test_mcp_command_logs_environments_label_without_a_factory(tmp_path: Path):
 
         anyio.run(scenario)
         stderr_text = stderr_path.read_text(encoding="utf-8")
-        expected = f"[if-cli mcp] environments: a=profile-a {server.origin} (writable); catalog=a"
-        assert expected in stderr_text
+        expected = re.escape(f"environments: a=profile-a {server.origin} (writable); catalog=a")
+        assert re.search(rf"\[if-cli mcp\] \+\d+ms {expected}", stderr_text)
     finally:
         server.close()
 

insightfactory_cli-1.2.0/tests/test_router_log.py

@@ -0,0 +1,23 @@
+from __future__ import annotations
+
+from if_cli.router import log as log_module
+
+
+def test_log_prefixes_the_elapsed_time_since_process_start(monkeypatch, capsys):
+    monkeypatch.setattr(log_module, "_START", 10.0)
+    monkeypatch.setattr(log_module.time, "monotonic", lambda: 10.25)
+
+    log_module.log("ready over stdio")
+
+    assert capsys.readouterr().err == "[if-cli mcp] +250ms ready over stdio\n"
+
+
+def test_log_keeps_the_grep_prefix_first(monkeypatch, capsys):
+    """`[if-cli mcp]` must stay the first thing on the line, timestamp or not:
+    it is what an operator (or a script) greps a stdio transcript for."""
+    monkeypatch.setattr(log_module, "_START", 0.0)
+    monkeypatch.setattr(log_module.time, "monotonic", lambda: 0.0)
+
+    log_module.log("WARN dropped a connect URL")
+
+    assert capsys.readouterr().err.startswith("[if-cli mcp] +0ms ")

{insightfactory_cli-1.1.2.dev30 → insightfactory_cli-1.2.0}/tests/test_router_upstream.py

@@ -1,6 +1,8 @@
 from __future__ import annotations
 
 import inspect
+import re
+from importlib.metadata import version
 from typing import Any
 
 import pytest
@@ -14,7 +16,7 @@ import mcp_types as types  # noqa: E402
 from if_cli.cache import store_tokens  # noqa: E402
 from if_cli.config import Profile  # noqa: E402
 from if_cli.router.upstream import ConnectUrlRecorder, ProfileBearerAuth, Upstream  # noqa: E402
-from tests.servers import Response, ThreadedServer  # noqa: E402
+from tests.servers import Request, Response, ThreadedServer  # noqa: E402
 
 
 def _profile(host: str) -> Profile:
@@ -84,6 +86,30 @@ def test_auth_remints_the_token_once_on_a_401_and_retries():
         idp.close()
 
 
+def test_the_upstream_client_names_the_router_and_the_cli(monkeypatch):
+    """The router runs with its MCP registration env, so the harness token goes first."""
+    monkeypatch.setenv("INSIGHTFACTORY_UA", "if-fde-harness-mcp")
+    seen: list[dict[str, str]] = []
+
+    def handler(request: Request) -> Response:
+        seen.append(request.headers)
+        # Any error ends the session; only the first request's headers matter.
+        return Response(status=500, body="")
+
+    server = ThreadedServer(handler).start()
+    try:
+        profile = _profile(server.origin)
+        store_tokens(profile["host"], {"access_token": "test-token", "expires_in": 3600}, "", "c", replace=True)
+        with pytest.raises(Exception):
+            anyio.run(Upstream("prd", profile, timeout=5).list_tools)
+    finally:
+        server.close()
+    assert seen, "the router never reached the factory"
+    headers = {name.lower(): value for name, value in seen[0].items()}
+    assert headers["x-if-ua"] == f"if-fde-harness-mcp if-cli/{version('insightfactory-cli')}"
+    assert headers["authorization"] == "Bearer test-token"
+
+
 def _url_request(url: str, message: str = "Connect your Databricks account.") -> types.ElicitRequest:
     return types.ElicitRequest(params=types.ElicitRequestURLParams(message=message, url=url))
 
@@ -373,7 +399,9 @@ def test_a_dropped_connect_url_is_reported_on_stderr(capsys):
     anyio.run(lambda: upstream.call_tool("run_sql_query", {}))
 
     stderr = capsys.readouterr().err
-    assert "[if-cli mcp] WARN dropped a connect URL that is not on https://factory.example" in stderr
+    assert re.search(
+        r"\[if-cli mcp\] \+\d+ms WARN dropped a connect URL that is not on https://factory\.example", stderr
+    )
     assert "https://phish.example/connect" in stderr
 
 

{insightfactory_cli-1.1.2.dev30 → insightfactory_cli-1.2.0}/uv.lock

@@ -305,7 +305,7 @@ wheels = [
 
 [[package]]
 name = "insightfactory-cli"
-version = "1.1.2"
+version = "1.2.0"
 source = { editable = "." }
 
 [package.optional-dependencies]

insightfactory_cli-1.1.2.dev30/src/if_cli/router/log.py

@@ -1,13 +0,0 @@
-from __future__ import annotations
-
-import sys
-
-
-def log(message: str) -> None:
-    """Write one diagnostic line to stderr.
-
-    The router speaks MCP over stdout, so stderr is the only channel that can
-    carry anything to the operator. This lives in its own module because both
-    `server` and `upstream` write to it and `server` imports `upstream`.
-    """
-    sys.stderr.write(f"[if-cli mcp] {message}\n")