keystone-cli 0.1.26__tar.gz → 0.1.27__tar.gz

{keystone_cli-0.1.26 → keystone_cli-0.1.27}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: keystone-cli
-Version: 0.1.26
+Version: 0.1.27
 Summary: Keystone pro-code agent CLI — author, validate, and run agents locally, then deploy and invoke them on the Keystone platform.
 Requires-Python: >=3.12
 Requires-Dist: keystone-agent-sdk<0.11,>=0.10

{keystone_cli-0.1.26 → keystone_cli-0.1.27}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "keystone-cli"
-version = "0.1.26"
+version = "0.1.27"
 description = "Keystone pro-code agent CLI — author, validate, and run agents locally, then deploy and invoke them on the Keystone platform."
 requires-python = ">=3.12"
 dependencies = [
@@ -45,7 +45,7 @@ where = ["src"]
 keystone_cli = ["templates/*/*.tmpl", "templates/*/pkg/*.tmpl"]
 
 [tool.ruff]
-target-version = "0.1.26"
+target-version = "0.1.27"
 line-length = 120
 
 [tool.ruff.lint]

{keystone_cli-0.1.26 → keystone_cli-0.1.27}/src/keystone_cli/auth/token_store.py

@@ -9,6 +9,7 @@ from __future__ import annotations
 
 import json
 import os
+import sys
 from dataclasses import asdict, dataclass, fields
 from pathlib import Path
 
@@ -85,6 +86,46 @@ class AuthConfig:
     env: str = ""
 
 
+def endpoint_env(cfg: AuthConfig) -> str | None:
+    """Which env's BAKED endpoints this config carries (issuer or api_base match), or None.
+
+    None for an empty config and for custom endpoints (a deliberate ``--api-base`` / ``--issuer``
+    pointing somewhere no env bakes), so only a config that is recognisably ANOTHER env's is flagged.
+    """
+    for env, (issuer, api_base, _agent) in _ENV_DEFAULTS.items():
+        if (cfg.issuer and cfg.issuer == issuer) or (cfg.api_base and cfg.api_base.rstrip("/") == api_base):
+            return env
+    return None
+
+
+def endpoints_belong_to_other_env(cfg: AuthConfig) -> str | None:
+    """The OTHER env whose endpoints this config carries (vs. this package's ``BUILD_ENV``), else None.
+
+    FDP-3072: the ``env`` stamp alone is not proof. A config stamped ``env=prod`` can still hold the
+    dev issuer/api_base (seen 2026-09-30 after installing the prod package over a dev login): the
+    stamp matched, so ``login`` kept the cache and every command silently went to dev.
+    """
+    env = endpoint_env(cfg)
+    return env if env is not None and env != BUILD_ENV else None
+
+
+_warned_mismatch = False
+
+
+def _warn_if_other_env(cfg: AuthConfig) -> None:
+    """One stderr line per process — a warning, never a block (custom endpoints are never flagged)."""
+    global _warned_mismatch
+    other = endpoints_belong_to_other_env(cfg)
+    if other is None or _warned_mismatch:
+        return
+    _warned_mismatch = True
+    print(
+        f"⚠ {config_path()} points at the {other} endpoints, but this is the {BUILD_ENV} CLI — "
+        f"commands would go to {other}. Run `keystone login` to reset it to {BUILD_ENV}.",
+        file=sys.stderr,
+    )
+
+
 def config_path() -> Path:
     """Config file path. ``KEYSTONE_CONFIG`` overrides (tests); default ``~/.keystone/config.json``."""
     override = os.environ.get("KEYSTONE_CONFIG")
@@ -100,7 +141,9 @@ def load() -> AuthConfig:
     # turned a valid session into "not logged in".
     data = json.loads(path.read_text(encoding="utf-8"))
     known = {f.name for f in fields(AuthConfig)}
-    return AuthConfig(**{k: v for k, v in data.items() if k in known})
+    cfg = AuthConfig(**{k: v for k, v in data.items() if k in known})
+    _warn_if_other_env(cfg)
+    return cfg
 
 
 def _ensure_private_dir(directory: Path) -> None:

{keystone_cli-0.1.26 → keystone_cli-0.1.27}/src/keystone_cli/commands/login.py

@@ -61,7 +61,15 @@ def login(
     # cached (no silent wrong-realm). Same env keeps the cache; flags still override.
     cfg = ts.load()
     same_env = (cfg.env == ts.BUILD_ENV) if cfg.env else (not cfg.issuer or cfg.issuer == ts.DEFAULT_ISSUER)
-    if not same_env:
+    # FDP-3072: the stamp can match while the endpoints are another env's (env=prod holding dev URLs).
+    # Treat that as cross-env too, or the stale endpoints survive every login.
+    stale_env = ts.endpoints_belong_to_other_env(cfg)
+    if stale_env is not None:
+        typer.secho(
+            f"  cached config pointed at the {stale_env} endpoints — resetting to the {ts.BUILD_ENV} defaults",
+            fg=typer.colors.YELLOW,
+        )
+    if not same_env or stale_env is not None:
         cfg = ts.AuthConfig()
     cfg.env = ts.BUILD_ENV
     cfg.issuer = issuer or cfg.issuer or ts.DEFAULT_ISSUER

{keystone_cli-0.1.26 → keystone_cli-0.1.27}/src/keystone_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: keystone-cli
-Version: 0.1.26
+Version: 0.1.27
 Summary: Keystone pro-code agent CLI — author, validate, and run agents locally, then deploy and invoke them on the Keystone platform.
 Requires-Python: >=3.12
 Requires-Dist: keystone-agent-sdk<0.11,>=0.10

{keystone_cli-0.1.26 → keystone_cli-0.1.27}/src/keystone_cli.egg-info/SOURCES.txt

@@ -106,6 +106,7 @@ tests/test_assistant_provenance_and_flags.py
 tests/test_auth.py
 tests/test_build_progress.py
 tests/test_ci_token.py
+tests/test_config_env_mismatch.py
 tests/test_deploy.py
 tests/test_dev.py
 tests/test_doctor.py

keystone_cli-0.1.27/tests/test_config_env_mismatch.py

@@ -0,0 +1,102 @@
+"""FDP-3072 — a config whose endpoints belong to ANOTHER env than the installed package.
+
+Seen 2026-09-30: the prod package over a dev login left ``env=prod`` with the dev issuer and
+api_base; ``keystone login`` kept them (the stamp matched) and every command went to dev, silently.
+"""
+
+from __future__ import annotations
+
+import json
+
+import pytest
+from typer.testing import CliRunner
+
+from keystone_cli.__main__ import app
+from keystone_cli.auth import token_store as ts
+
+runner = CliRunner()
+
+DEV_ISSUER, DEV_API, DEV_AGENT = ts._ENV_DEFAULTS["dev"]
+PROD_ISSUER, PROD_API, PROD_AGENT = ts._ENV_DEFAULTS["prod"]
+
+
+@pytest.fixture(autouse=True)
+def _prod_package(tmp_path, monkeypatch):
+    """Pretend the installed package is the prod one, with a private config file."""
+    monkeypatch.setenv("KEYSTONE_CONFIG", str(tmp_path / "config.json"))
+    monkeypatch.setattr(ts, "BUILD_ENV", "prod")
+    monkeypatch.setattr(ts, "DEFAULT_ISSUER", PROD_ISSUER)
+    monkeypatch.setattr(ts, "DEFAULT_API_BASE", PROD_API)
+    monkeypatch.setattr(ts, "DEFAULT_AGENT_API_BASE", PROD_AGENT)
+    monkeypatch.setattr(ts, "_warned_mismatch", False)
+    monkeypatch.setattr("keystone_cli.commands.login.pc.get_me", lambda *_a, **_k: {})
+
+
+def _write(tmp_path, **cfg) -> None:
+    (tmp_path / "config.json").write_text(json.dumps(cfg), encoding="utf-8")
+
+
+def test_endpoint_env_recognises_baked_hosts_only() -> None:
+    assert ts.endpoint_env(ts.AuthConfig(issuer=DEV_ISSUER, api_base=DEV_API)) == "dev"
+    assert ts.endpoint_env(ts.AuthConfig(api_base=PROD_API + "/")) == "prod"
+    assert ts.endpoint_env(ts.AuthConfig(api_base="http://localhost:8080")) is None  # custom → never flagged
+    assert ts.endpoint_env(ts.AuthConfig()) is None
+
+
+def test_load_warns_once_when_endpoints_are_another_envs(tmp_path, capsys) -> None:
+    _write(tmp_path, env="prod", issuer=DEV_ISSUER, api_base=DEV_API, agent_api_base=DEV_AGENT)
+
+    ts.load()
+    ts.load()
+
+    err = capsys.readouterr().err
+    assert err.count("points at the dev endpoints") == 1
+    assert "keystone login" in err
+
+
+@pytest.mark.parametrize(
+    "cfg",
+    [
+        {"env": "prod", "issuer": PROD_ISSUER, "api_base": PROD_API},
+        {"env": "prod", "issuer": "https://kc.local/realms/x", "api_base": "http://localhost:8080"},
+    ],
+)
+def test_load_is_silent_for_matching_or_custom_endpoints(tmp_path, capsys, cfg) -> None:
+    _write(tmp_path, **cfg)
+    ts.load()
+    assert capsys.readouterr().err == ""
+
+
+def test_login_resets_a_prod_stamped_config_holding_dev_endpoints(tmp_path, monkeypatch) -> None:
+    _write(
+        tmp_path,
+        env="prod",
+        issuer=DEV_ISSUER,
+        api_base=DEV_API,
+        agent_api_base=DEV_AGENT,
+        workspace_id="dev-ws",
+        workspace_name="default-workspace",
+    )
+    monkeypatch.setattr(
+        "keystone_cli.commands.login.df.start_device_flow",
+        lambda *_a, **_k: {
+            "device_code": "dc",
+            "user_code": "WXYZ",
+            "verification_uri": "https://kc/device",
+            "interval": 1,
+            "expires_in": 600,
+        },
+    )
+    monkeypatch.setattr(
+        "keystone_cli.commands.login.df.poll_for_token",
+        lambda *_a, **_k: {"access_token": "at", "refresh_token": "rt", "expires_in": 300},
+    )
+
+    result = runner.invoke(app, ["login", "--no-browser", "--no-select-workspace"])
+
+    assert result.exit_code == 0, result.output
+    assert "pointed at the dev endpoints" in result.output
+    saved = json.loads((tmp_path / "config.json").read_text(encoding="utf-8"))
+    assert saved["env"] == "prod"
+    assert (saved["issuer"], saved["api_base"], saved["agent_api_base"]) == (PROD_ISSUER, PROD_API, PROD_AGENT)
+    assert saved["workspace_id"] == ""  # the dev workspace must not survive into prod