keystone-cli 0.2.0__tar.gz → 0.2.1__tar.gz

{keystone_cli-0.2.0 → keystone_cli-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: keystone-cli
-Version: 0.2.0
+Version: 0.2.1
 Summary: Keystone pro-code agent CLI — build, test, deploy and operate agents on the Keystone platform.
 Requires-Python: >=3.12
 Requires-Dist: keystone-agent-sdk<0.14,>=0.13.3

{keystone_cli-0.2.0 → keystone_cli-0.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "keystone-cli"
-version = "0.2.0"
+version = "0.2.1"
 description = "Keystone pro-code agent CLI — build, test, deploy and operate agents on the Keystone platform."
 requires-python = ">=3.12"
 dependencies = [
@@ -45,7 +45,7 @@ where = ["src"]
 keystone_cli = ["templates/*/*.tmpl", "templates/*/pkg/*.tmpl", "skills/*/SKILL.md"]
 
 [tool.ruff]
-target-version = "0.2.0"
+target-version = "0.2.1"
 line-length = 120
 
 [tool.ruff.lint]

{keystone_cli-0.2.0 → keystone_cli-0.2.1}/src/keystone_cli/auth/token_store.py

@@ -44,16 +44,33 @@ _ENV_DEFAULTS: dict[str, tuple[str, str, str]] = {
         "https://keystone-agent-api-staging.aws.int.onenexus.dev",
     ),
     # prod Keycloak is a SEPARATE host on `.onemount.com` (note: .com, not the nonprod .dev), realm `aip`.
-    # prod Kong edge is on `.aws.int.onenexus.tech` (note: .tech, not nonprod's .dev) and drops the
-    # per-env suffix (`keystone-api`, not `keystone-api-prod`). Confirmed with Ops 2026-08-28.
+    # prod Kong edge drops the per-env suffix (`keystone-api`, not `keystone-api-prod`). The CLI uses the
+    # `.ops.onenexus.tech` hosts (FDP-6328 / SP-14079): same Kong routes + plugins as `.aws.int`, but
+    # reachable from customer networks (TCB) through Cloudflare. `.aws.int` stays for in-cluster callers.
     "prod": (
         "https://keycloak-platform.ops.onemount.com/realms/aip",
-        "https://keystone-api.aws.int.onenexus.tech",
-        "https://keystone-agent-api.aws.int.onenexus.tech",
+        "https://keystone-api.ops.onenexus.tech",
+        "https://keystone-agent-api.ops.onenexus.tech",
     ),
 }
 DEFAULT_ISSUER, DEFAULT_API_BASE, DEFAULT_AGENT_API_BASE = _ENV_DEFAULTS.get(BUILD_ENV, _ENV_DEFAULTS["dev"])
 
+# FDP-6328 — hosts an older CLI baked and cached in config.json, mapped to their replacement. `login`
+# keeps a same-env cache and prod's issuer did not change, so without this rewrite an existing prod
+# user would keep calling `.aws.int` (unreachable from a customer network) after upgrading.
+_RETIRED_HOSTS: dict[str, str] = {
+    "https://keystone-api.aws.int.onenexus.tech": "https://keystone-api.ops.onenexus.tech",
+    "https://keystone-agent-api.aws.int.onenexus.tech": "https://keystone-agent-api.ops.onenexus.tech",
+}
+
+
+def _migrate_retired_hosts(cfg: AuthConfig) -> None:
+    """Point a cached endpoint at a retired host to its replacement (in memory; the next save persists it)."""
+    for name in ("api_base", "agent_api_base"):
+        current = getattr(cfg, name).rstrip("/")
+        if current in _RETIRED_HOSTS:
+            setattr(cfg, name, _RETIRED_HOSTS[current])
+
 
 @dataclass
 class AuthConfig:
@@ -142,6 +159,7 @@ def load() -> AuthConfig:
     data = json.loads(path.read_text(encoding="utf-8"))
     known = {f.name for f in fields(AuthConfig)}
     cfg = AuthConfig(**{k: v for k, v in data.items() if k in known})
+    _migrate_retired_hosts(cfg)
     _warn_if_other_env(cfg)
     return cfg
 

{keystone_cli-0.2.0 → keystone_cli-0.2.1}/src/keystone_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: keystone-cli
-Version: 0.2.0
+Version: 0.2.1
 Summary: Keystone pro-code agent CLI — build, test, deploy and operate agents on the Keystone platform.
 Requires-Python: >=3.12
 Requires-Dist: keystone-agent-sdk<0.14,>=0.13.3

{keystone_cli-0.2.0 → keystone_cli-0.2.1}/tests/test_config_env_mismatch.py

@@ -100,3 +100,51 @@ def test_login_resets_a_prod_stamped_config_holding_dev_endpoints(tmp_path, monk
     assert saved["env"] == "prod"
     assert (saved["issuer"], saved["api_base"], saved["agent_api_base"]) == (PROD_ISSUER, PROD_API, PROD_AGENT)
     assert saved["workspace_id"] == ""  # the dev workspace must not survive into prod
+
+
+# FDP-6328 — prod moved from the `.aws.int` hosts to `.ops`. Prod's issuer did not change, so a cached
+# prod config is "same env" and `login` keeps it; the retired hosts must be rewritten on load.
+OLD_PROD_API = "https://keystone-api.aws.int.onenexus.tech"
+OLD_PROD_AGENT = "https://keystone-agent-api.aws.int.onenexus.tech"
+
+
+def test_prod_defaults_use_the_ops_hosts() -> None:
+    assert (PROD_API, PROD_AGENT) == (
+        "https://keystone-api.ops.onenexus.tech",
+        "https://keystone-agent-api.ops.onenexus.tech",
+    )
+
+
+def test_load_rewrites_retired_prod_hosts_and_keeps_the_session(tmp_path, capsys) -> None:
+    _write(
+        tmp_path,
+        env="prod",
+        issuer=PROD_ISSUER,
+        api_base=OLD_PROD_API + "/",
+        agent_api_base=OLD_PROD_AGENT,
+        refresh_token="rt",
+        workspace_id="ws-1",
+    )
+
+    cfg = ts.load()
+
+    assert (cfg.api_base, cfg.agent_api_base) == (PROD_API, PROD_AGENT)
+    assert (cfg.refresh_token, cfg.workspace_id) == ("rt", "ws-1")  # no re-login, workspace kept
+    assert capsys.readouterr().err == ""  # still prod — not flagged as another env
+
+
+def test_load_leaves_custom_and_current_hosts_alone(tmp_path) -> None:
+    _write(tmp_path, env="prod", issuer=PROD_ISSUER, api_base="http://localhost:8080", agent_api_base=PROD_AGENT)
+
+    cfg = ts.load()
+
+    assert (cfg.api_base, cfg.agent_api_base) == ("http://localhost:8080", PROD_AGENT)
+
+
+def test_save_after_load_persists_the_new_hosts(tmp_path) -> None:
+    _write(tmp_path, env="prod", issuer=PROD_ISSUER, api_base=OLD_PROD_API, agent_api_base=OLD_PROD_AGENT)
+
+    ts.save(ts.load())
+
+    saved = json.loads((tmp_path / "config.json").read_text(encoding="utf-8"))
+    assert (saved["api_base"], saved["agent_api_base"]) == (PROD_API, PROD_AGENT)