keystone-cli 0.1.0__tar.gz → 0.1.9__tar.gz

{keystone_cli-0.1.0 → keystone_cli-0.1.9}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: keystone-cli
-Version: 0.1.0
-Summary: Keystone pro-code agent CLI — validate + run agents locally (FR-06 / FDP-3072, M1). login/deploy = M2.
+Version: 0.1.9
+Summary: Keystone pro-code agent CLI — author, validate, and run agents locally, then deploy and invoke them on the Keystone platform.
 Requires-Python: >=3.12
 Requires-Dist: keystone-agent-sdk<0.4,>=0.3
 Requires-Dist: keystone-request-context<0.4,>=0.3

{keystone_cli-0.1.0 → keystone_cli-0.1.9}/pyproject.toml

@@ -4,8 +4,8 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "keystone-cli"
-version = "0.1.0"
-description = "Keystone pro-code agent CLI — validate + run agents locally (FR-06 / FDP-3072, M1). login/deploy = M2."
+version = "0.1.9"
+description = "Keystone pro-code agent CLI — author, validate, and run agents locally, then deploy and invoke them on the Keystone platform."
 requires-python = ">=3.12"
 dependencies = [
     # Pinned to a compatible range: on an index (Artifact Registry) an unpinned name resolves to

{keystone_cli-0.1.0 → keystone_cli-0.1.9}/src/keystone_cli/__main__.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import typer
 
+from keystone_cli._version import version_line
 from keystone_cli.commands.agent import agent_app
 from keystone_cli.commands.dev import dev
 from keystone_cli.commands.login import login
@@ -14,6 +15,34 @@ app = typer.Typer(
     no_args_is_help=True,
     add_completion=False,
 )
+
+
+def _version_callback(value: bool) -> None:
+    if value:
+        typer.echo(version_line())
+        raise typer.Exit()
+
+
+@app.callback()
+def _main(
+    _version: bool = typer.Option(
+        False,
+        "--version",
+        "-V",
+        callback=_version_callback,
+        is_eager=True,
+        help="Show the CLI version (and target env) and exit.",
+    ),
+) -> None:
+    """Keystone pro-code agent CLI."""
+
+
+@app.command(name="version")
+def version() -> None:
+    """Show the CLI version, its target env, and the bundled agent-sdk version."""
+    typer.echo(version_line())
+
+
 app.add_typer(agent_app, name="agent")
 app.add_typer(workspace_app, name="workspace")
 app.command(name="login")(login)

keystone_cli-0.1.9/src/keystone_cli/_build_env.py

@@ -0,0 +1,2 @@
+from __future__ import annotations
+BUILD_ENV = 'prod'

keystone_cli-0.1.9/src/keystone_cli/_version.py

@@ -0,0 +1,41 @@
+"""CLI version reporting.
+
+The distribution NAME is per-env suffixed by CI (`keystone-cli-dev`, `-qc`,
+`-staging`); prod ships the bare `keystone-cli`, and a source/editable install
+is also the bare name with ``BUILD_ENV`` defaulting to ``dev``. So probe the
+env-specific name first and fall back to the bare name — that resolves the
+version for every install shape without knowing which one we are.
+"""
+
+from __future__ import annotations
+
+from importlib.metadata import PackageNotFoundError
+from importlib.metadata import version as _dist_version
+
+from keystone_cli._build_env import BUILD_ENV
+
+
+def _resolve(base: str) -> str:
+    names = [base] if BUILD_ENV == "prod" else [f"{base}-{BUILD_ENV}", base]
+    for name in names:
+        try:
+            return _dist_version(name)
+        except PackageNotFoundError:
+            continue
+    return "unknown"
+
+
+def cli_version() -> str:
+    """Installed keystone-cli version, or ``unknown`` if not resolvable."""
+    return _resolve("keystone-cli")
+
+
+def sdk_version() -> str:
+    """Installed keystone-agent-sdk version (bundles the deploy archive) — shown
+    so a bundle-behaviour bug can be pinned to a lib version at a glance."""
+    return _resolve("keystone-agent-sdk")
+
+
+def version_line() -> str:
+    """One-line version banner: ``keystone <ver> (env: <env>) · agent-sdk <ver>``."""
+    return f"keystone {cli_version()} (env: {BUILD_ENV}) · agent-sdk {sdk_version()}"

{keystone_cli-0.1.0 → keystone_cli-0.1.9}/src/keystone_cli/auth/token_store.py

@@ -12,14 +12,46 @@ import os
 from dataclasses import asdict, dataclass, fields
 from pathlib import Path
 
-# Baked platform defaults so `keystone login` works with NO flags (like `aws sso login`). NOT secrets —
-# client id is a public identifier, issuer/api are public URLs. Override via --flags / KEYSTONE_* env for
-# other envs (qc/staging) or local testing; after first login these are cached in the config file.
-# dev realm `aip`, Ops-provisioned device-grant client (2026-07-22). Host = keycloak-platform (public),
-# NOT keycloak-platform-admin. Override per env with --issuer / KEYSTONE_ISSUER (qc/staging).
-DEFAULT_ISSUER = "https://keycloak-platform.ops.onemount.dev/realms/aip"
-DEFAULT_CLIENT_ID = "keystone-cli"
-DEFAULT_API_BASE = "https://keystone-api-dev.aws.int.onenexus.dev"
+from keystone_cli._build_env import BUILD_ENV
+
+# Baked platform defaults so `keystone login` works with NO flags (like `aws sso login`), PER ENV.
+# NOT secrets — client id is a public identifier, issuer/api are public URLs. The env is stamped into
+# each package at build time (`_build_env.BUILD_ENV`, from the CI PACKAGE_ENV_SUFFIX): keystone-cli-qc
+# → "qc", plain keystone-cli → "prod", a source/local install → "dev". Override any with
+# --issuer/--api-base / KEYSTONE_* for local testing; after first login they're cached in the config.
+DEFAULT_CLIENT_ID = "keystone-cli"  # public Keycloak client, device grant enabled (Ops-provisioned per realm)
+
+# (issuer, api_base, agent_api_base) per env. dev/qc/staging share the NONPROD Keycloak — the public
+# `.ops` host (NOT the cluster-internal `.int`, unreachable from a laptop) — and note dev's realm is
+# `aip`, NOT `aip-dev`. prod lives on a SEPARATE prod Keycloak (realm `aip`); its hosts are
+# Ops-provisioned and filled when prod onboards (the placeholders below fail loudly until then).
+_NONPROD_KC = "https://keycloak-platform.ops.onemount.dev"
+_ENV_DEFAULTS: dict[str, tuple[str, str, str]] = {
+    "dev": (
+        f"{_NONPROD_KC}/realms/aip",
+        "https://keystone-api-dev.aws.int.onenexus.dev",
+        "https://keystone-agent-api-dev.aws.int.onenexus.dev",
+    ),
+    "qc": (
+        f"{_NONPROD_KC}/realms/aip-qc",
+        "https://keystone-api-qc.aws.int.onenexus.dev",
+        "https://keystone-agent-api-qc.aws.int.onenexus.dev",
+    ),
+    "staging": (
+        f"{_NONPROD_KC}/realms/aip-staging",
+        "https://keystone-api-staging.aws.int.onenexus.dev",
+        "https://keystone-agent-api-staging.aws.int.onenexus.dev",
+    ),
+    # prod Keycloak is a SEPARATE host on `.onemount.com` (note: .com, not the nonprod .dev), realm `aip`.
+    # prod Kong edge is on `.aws.int.onenexus.tech` (note: .tech, not nonprod's .dev) and drops the
+    # per-env suffix (`keystone-api`, not `keystone-api-prod`). Confirmed with Ops 2026-08-28.
+    "prod": (
+        "https://keycloak-platform.ops.onemount.com/realms/aip",
+        "https://keystone-api.aws.int.onenexus.tech",
+        "https://keystone-agent-api.aws.int.onenexus.tech",
+    ),
+}
+DEFAULT_ISSUER, DEFAULT_API_BASE, DEFAULT_AGENT_API_BASE = _ENV_DEFAULTS.get(BUILD_ENV, _ENV_DEFAULTS["dev"])
 
 
 @dataclass
@@ -46,6 +78,11 @@ class AuthConfig:
     # the grant with the secret from the environment). Older config files lack the key and load as
     # ``device``, which is what they are.
     auth_mode: str = "device"
+    # FDP-3072 W6 — the package env (`_build_env.BUILD_ENV`) this config was last written for. `login`
+    # uses it to detect a cross-env config: if a qc package meets a dev-written config, the cached
+    # endpoints/workspace/tokens are stale and are dropped so the package's baked defaults win (no
+    # more silently logging into the wrong realm). Empty on pre-env configs → inferred from the issuer.
+    env: str = ""
 
 
 def config_path() -> Path: