licos-platform-cli 0.2.10__tar.gz → 0.2.13__tar.gz

{licos_platform_cli-0.2.10 → licos_platform_cli-0.2.13}/.gitignore

@@ -40,6 +40,8 @@ crates/industrial/bin/
 
 /tmp
 tools/android-sdk-cache/*.zip
+tools/codegraph-cache/*.tgz
+tools/codegraph-cache/*.tgz
 
 *.codex-*
 

{licos_platform_cli-0.2.10 → licos_platform_cli-0.2.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: licos-platform-cli
-Version: 0.2.10
+Version: 0.2.13
 Summary: LICOS platform CLI
 Requires-Python: >=3.10
-Requires-Dist: licos-platform-sdk>=0.2.9
+Requires-Dist: licos-platform-sdk>=0.3.0

{licos_platform_cli-0.2.10 → licos_platform_cli-0.2.13}/pyproject.toml

@@ -4,11 +4,11 @@ build-backend = "hatchling.build"
 
 [project]
 name = "licos-platform-cli"
-version = "0.2.10"
+version = "0.2.13"
 description = "LICOS platform CLI"
 requires-python = ">=3.10"
 dependencies = [
-    "licos-platform-sdk>=0.2.9",
+    "licos-platform-sdk>=0.3.0",
 ]
 
 [project.scripts]

{licos_platform_cli-0.2.10 → licos_platform_cli-0.2.13}/src/licos_platform_cli/help_commands.py

@@ -451,10 +451,58 @@ KNOWLEDGE_HELP = {
 }
 
 
+OAUTH_HELP = {
+    "topic": "oauth",
+    "description": "Manage LICOS OAuth2/OIDC login applications from trusted project runtime code.",
+    "runtime": RUNTIME_ENV,
+    "rules": [
+        "Use only when the user explicitly requests LICOS platform OAuth2/OIDC login.",
+        "Before configure-project, confirm auto-apply versus an existing app, login audience, and all callbacks.",
+        "Personal users use ALL. Enterprise users explicitly choose ALL or OWNER_TENANT.",
+        "Generated config uses PKCE and never contains a client secret.",
+        "Do not rotate a secret unless the user explicitly asks for rotation.",
+    ],
+    "sdk": {
+        "python": "from licos_platform_sdk import oauth\napps = oauth.list_apps()\napp = oauth.get_app('app-id')",
+        "node": "import { oauth } from '@kmlckj/licos-platform-sdk';\nconst apps = await oauth.listApps();",
+    },
+    "commands": {
+        "apps": {
+            "description": "List OAuth2 applications manageable by the current project owner.",
+            "parameters": [],
+            "example": "licos-platform oauth apps",
+        },
+        "get": {
+            "description": "Get one manageable OAuth2 application.",
+            "parameters": [{"name": "app_id", "required": True, "description": "OAuth2 application ID."}],
+            "example": "licos-platform oauth get app-id",
+        },
+        "configure-project": {
+            "description": "After explicit confirmation, apply or update one OAuth2 app and write config/licos-oauth.json without a secret.",
+            "parameters": [
+                {"name": "--auto-apply / --app-id", "required": True, "description": "Explicit application selection mode."},
+                {"name": "--name", "required": True, "description": "Application display name."},
+                {"name": "--login-audience", "required": True, "description": "ALL or OWNER_TENANT."},
+                {"name": "--redirect", "required": False, "description": "Optional explicit callback override; otherwise derive stable dev/prod callbacks from project runtime metadata."},
+                {"name": "--public-base-url", "required": False, "description": "Optional public LICOS OAuth2 origin override."},
+            ],
+            "example": "licos-platform oauth configure-project --auto-apply --name 'Project login' --login-audience ALL",
+        },
+        "delete": {"description": "Delete an OAuth2 application.", "parameters": [], "example": "licos-platform oauth delete app-id"},
+        "enable": {"description": "Enable an OAuth2 application.", "parameters": [], "example": "licos-platform oauth enable app-id"},
+        "disable": {"description": "Disable an OAuth2 application.", "parameters": [], "example": "licos-platform oauth disable app-id"},
+        "rotate-secret": {"description": "Explicitly rotate a confidential-client secret.", "parameters": [], "example": "licos-platform oauth rotate-secret app-id"},
+        "grants": {"description": "List application grants.", "parameters": [], "example": "licos-platform oauth grants app-id"},
+        "revoke-grant": {"description": "Revoke one grant.", "parameters": [], "example": "licos-platform oauth revoke-grant grant-id"},
+    },
+}
+
+
 HELP_TOPICS = {
     "storage": STORAGE_HELP,
     "database": DATABASE_HELP,
     "knowledge": KNOWLEDGE_HELP,
+    "oauth": OAUTH_HELP,
 }
 
 
@@ -475,6 +523,8 @@ def _cmd_help(args: argparse.Namespace) -> dict[str, Any]:
             "licos-platform help database studio-ensure",
             "licos-platform help knowledge",
             "licos-platform help knowledge search",
+            "licos-platform help oauth",
+            "licos-platform help oauth configure-project",
         ],
             "topics": sorted(HELP_TOPICS),
         }

{licos_platform_cli-0.2.10 → licos_platform_cli-0.2.13}/src/licos_platform_cli/main.py

@@ -10,6 +10,7 @@ from licos_platform_sdk import PlatformSdkError
 from .database_commands import add_database_parser
 from .help_commands import add_help_parser
 from .knowledge_commands import add_knowledge_parser
+from .oauth_commands import add_oauth_parser
 from .storage_commands import add_storage_parser
 
 
@@ -32,6 +33,7 @@ def _build_parser() -> argparse.ArgumentParser:
     add_storage_parser(subparsers)
     add_database_parser(subparsers)
     add_knowledge_parser(subparsers)
+    add_oauth_parser(subparsers)
     return parser
 
 

licos_platform_cli-0.2.13/src/licos_platform_cli/oauth_commands.py

@@ -0,0 +1,252 @@
+from __future__ import annotations
+
+import argparse
+import json
+import os
+from pathlib import Path
+from typing import Any, Callable
+from urllib.parse import quote, urlsplit, urlunsplit
+
+from licos_platform_sdk import oauth
+
+
+Handler = Callable[[argparse.Namespace], Any]
+DEFAULT_SCOPES = ["openid", "profile", "email"]
+
+
+def _set_handler(parser: argparse.ArgumentParser, handler: Handler) -> None:
+    parser.set_defaults(handler=handler)
+
+
+def _parse_http_url(value: str, *, option: str) -> str:
+    candidate = value.strip()
+    parsed = urlsplit(candidate)
+    if parsed.scheme not in {"http", "https"} or not parsed.netloc:
+        raise argparse.ArgumentTypeError(f"{option} must be an absolute http(s) URL")
+    if parsed.fragment:
+        raise argparse.ArgumentTypeError(f"{option} must not contain a fragment")
+    return candidate
+
+
+def _parse_redirect(value: str) -> dict[str, str]:
+    environment = "prod"
+    redirect_uri = value
+    prefix, separator, remainder = value.partition("=")
+    if separator:
+        environment = prefix.strip().lower()
+        redirect_uri = remainder
+    if environment not in {"dev", "prod"}:
+        raise argparse.ArgumentTypeError("redirect environment must be dev or prod")
+    return {
+        "environment": environment,
+        "redirectUri": _parse_http_url(redirect_uri, option="--redirect"),
+    }
+
+
+def _public_base_url(value: str) -> str:
+    parsed = urlsplit(_parse_http_url(value, option="--public-base-url"))
+    path = parsed.path.rstrip("/")
+    if path.endswith("/api/v1"):
+        path = path[: -len("/api/v1")]
+    return urlunsplit((parsed.scheme, parsed.netloc, path, "", "")).rstrip("/")
+
+
+def _required_env(name: str) -> str:
+    value = (os.environ.get(name) or "").strip()
+    if not value:
+        raise argparse.ArgumentTypeError(
+            f"{name} is required when --redirect is not provided"
+        )
+    return value
+
+
+def _automatic_redirects() -> list[dict[str, str]]:
+    project_id = _required_env("AGENT_PROJECT_ID")
+    encoded_project_id = quote(project_id, safe="")
+    platform_public_base = _public_base_url(_required_env("LICOS_PLATFORM_PUBLIC_BASE_URL"))
+    deploy_public_base = _public_base_url(_required_env("LICOS_DEPLOY_PUBLIC_BASE_URL"))
+    return [
+        {
+            "environment": "dev",
+            "redirectUri": (
+                f"{platform_public_base}/agent/api/v1/projects/"
+                f"{encoded_project_id}/oauth/callback"
+            ),
+        },
+        {
+            "environment": "prod",
+            "redirectUri": (
+                f"{deploy_public_base}/p/{encoded_project_id}/api/auth/licos/callback"
+            ),
+        },
+    ]
+
+
+def _project_root() -> Path:
+    return Path(os.environ.get("LICOS_PROJECT_PATH") or Path.cwd()).resolve()
+
+
+def _config_path(output: str) -> Path:
+    root = _project_root()
+    candidate = Path(output)
+    resolved = (candidate if candidate.is_absolute() else root / candidate).resolve()
+    try:
+        resolved.relative_to(root)
+    except ValueError as exc:
+        raise argparse.ArgumentTypeError("--out must stay inside LICOS_PROJECT_PATH") from exc
+    return resolved
+
+
+def _without_secret(value: Any) -> Any:
+    if isinstance(value, dict):
+        return {
+            key: _without_secret(item)
+            for key, item in value.items()
+            if "secret" not in key.lower().replace("_", "")
+        }
+    if isinstance(value, list):
+        return [_without_secret(item) for item in value]
+    return value
+
+
+def _cmd_apps(args: argparse.Namespace) -> Any:
+    return _without_secret(oauth.list_apps(page=args.page, page_size=args.page_size))
+
+
+def _cmd_get(args: argparse.Namespace) -> Any:
+    return _without_secret(oauth.get_app(args.app_id))
+
+
+def _cmd_delete(args: argparse.Namespace) -> Any:
+    return oauth.delete_app(args.app_id)
+
+
+def _cmd_set_enabled(args: argparse.Namespace) -> Any:
+    return _without_secret(oauth.set_enabled(args.app_id, args.enabled))
+
+
+def _cmd_rotate_secret(args: argparse.Namespace) -> Any:
+    return oauth.rotate_secret(args.app_id)
+
+
+def _cmd_grants(args: argparse.Namespace) -> Any:
+    return oauth.list_grants(args.app_id)
+
+
+def _cmd_revoke_grant(args: argparse.Namespace) -> Any:
+    return oauth.revoke_grant(args.grant_id)
+
+
+def _cmd_configure_project(args: argparse.Namespace) -> dict[str, Any]:
+    public_base_url = (
+        args.public_base_url
+        or os.environ.get("LICOS_PLATFORM_PUBLIC_BASE_URL")
+        or os.environ.get("LICOS_OAUTH_PUBLIC_BASE_URL")
+    )
+    if not public_base_url:
+        raise argparse.ArgumentTypeError(
+            "--public-base-url, LICOS_PLATFORM_PUBLIC_BASE_URL, or LICOS_OAUTH_PUBLIC_BASE_URL is required"
+        )
+    normalized_public_base_url = _public_base_url(public_base_url)
+    redirects = args.redirects or _automatic_redirects()
+    path = _config_path(args.out)
+    app = oauth.ensure_project_app(
+        app_id=args.app_id,
+        name=args.name,
+        description=args.description,
+        login_audience=args.login_audience,
+        redirect_uri_configs=redirects,
+        allowed_scopes=args.scopes or DEFAULT_SCOPES,
+    )
+    app_id = str(app.get("id") or "").strip()
+    if not app_id:
+        raise argparse.ArgumentTypeError("platform OAuth2 app response is missing id")
+    client_id = str(app.get("clientId") or "").strip()
+    if not client_id:
+        raise argparse.ArgumentTypeError("platform OAuth2 app response is missing clientId")
+
+    config = {
+        "provider": "licos-oauth2",
+        "appId": app_id,
+        "appCode": app.get("appCode"),
+        "clientId": client_id,
+        "loginAudience": args.login_audience,
+        "scopes": args.scopes or DEFAULT_SCOPES,
+        "redirectUriConfigs": redirects,
+        "pkce": True,
+        "publicBaseUrl": normalized_public_base_url,
+        "endpoints": {
+            "authorization": "/oauth2/authorize",
+            "token": "/oauth2/token",
+            "userinfo": "/oauth2/userinfo",
+            "revoke": "/oauth2/revoke",
+            "discovery": "/.well-known/openid-configuration",
+            "jwks": "/oauth2/jwks",
+        },
+    }
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(config, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")
+    return {
+        "app": _without_secret(app),
+        "configPath": str(path),
+        "selectionMode": "existing" if args.app_id else "auto-apply",
+    }
+
+
+def add_oauth_parser(subparsers: argparse._SubParsersAction[argparse.ArgumentParser]) -> None:
+    parser = subparsers.add_parser("oauth", help="Manage LICOS platform OAuth2 applications")
+    commands = parser.add_subparsers(dest="oauth_command", required=True)
+
+    apps = commands.add_parser("apps", help="List manageable OAuth2 applications")
+    apps.add_argument("--page", type=int, default=1)
+    apps.add_argument("--page-size", type=int, default=100)
+    _set_handler(apps, _cmd_apps)
+
+    get_app = commands.add_parser("get", help="Get one OAuth2 application")
+    get_app.add_argument("app_id")
+    _set_handler(get_app, _cmd_get)
+
+    configure = commands.add_parser(
+        "configure-project",
+        help="Configure a confirmed OAuth2 application and write public PKCE project settings",
+    )
+    selection = configure.add_mutually_exclusive_group(required=True)
+    selection.add_argument("--auto-apply", action="store_true", help="Create or update the app for this project ID")
+    selection.add_argument("--app-id", default=None, help="Use and update an existing manageable OAuth2 app")
+    configure.add_argument("--name", required=True)
+    configure.add_argument("--description", default=None)
+    configure.add_argument("--login-audience", required=True, choices=["ALL", "OWNER_TENANT"])
+    configure.add_argument(
+        "--redirect",
+        action="append",
+        dest="redirects",
+        type=_parse_redirect,
+        default=None,
+        help="Explicit callback override as dev=URL, prod=URL, or URL (defaults to prod); can repeat",
+    )
+    configure.add_argument("--scope", action="append", dest="scopes", default=None, help="OAuth2 scope; can repeat")
+    configure.add_argument("--public-base-url", default=None, help="Public LICOS OAuth2 origin; /api/v1 is removed")
+    configure.add_argument("--out", default="config/licos-oauth.json", help="Config path under LICOS_PROJECT_PATH")
+    _set_handler(configure, _cmd_configure_project)
+
+    delete = commands.add_parser("delete", help="Delete an OAuth2 application")
+    delete.add_argument("app_id")
+    _set_handler(delete, _cmd_delete)
+
+    for name, enabled in (("enable", True), ("disable", False)):
+        command = commands.add_parser(name, help=f"{name.capitalize()} an OAuth2 application")
+        command.add_argument("app_id")
+        command.set_defaults(enabled=enabled)
+        _set_handler(command, _cmd_set_enabled)
+
+    rotate = commands.add_parser("rotate-secret", help="Explicitly rotate and print a new confidential-client secret")
+    rotate.add_argument("app_id")
+    _set_handler(rotate, _cmd_rotate_secret)
+
+    grants = commands.add_parser("grants", help="List grants for an OAuth2 application")
+    grants.add_argument("app_id")
+    _set_handler(grants, _cmd_grants)
+
+    revoke = commands.add_parser("revoke-grant", help="Revoke one OAuth2 grant")
+    revoke.add_argument("grant_id")
+    _set_handler(revoke, _cmd_revoke_grant)

{licos_platform_cli-0.2.10 → licos_platform_cli-0.2.13}/tests/test_cli.py

@@ -14,7 +14,7 @@ sys.path.insert(0, str(Path(__file__).resolve().parents[2] / "licos-platform-sdk
 sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
 
 from licos_platform_cli import main as cli_main
-from licos_platform_cli import database_commands, knowledge_commands, storage_commands
+from licos_platform_cli import database_commands, knowledge_commands, oauth_commands, storage_commands
 from licos_platform_sdk import ApiError
 
 
@@ -46,7 +46,7 @@ class PlatformCliTests(unittest.TestCase):
         self.assertEqual(code, 0)
         self.assertEqual(stderr, "")
         payload = json.loads(stdout)
-        self.assertEqual(payload["topics"], ["database", "knowledge", "storage"])
+        self.assertEqual(payload["topics"], ["database", "knowledge", "oauth", "storage"])
         self.assertIn("licos-platform help storage", payload["usage"])
 
     def test_structured_help_storage_command_describes_parameters(self) -> None:
@@ -148,6 +148,244 @@ class PlatformCliTests(unittest.TestCase):
         self.assertEqual(stdout, "")
         self.assertIn("platform failed", stderr)
 
+    def test_oauth_configure_project_requires_explicit_app_selection(self) -> None:
+        code, stdout, stderr = run_cli(
+            "oauth",
+            "configure-project",
+            "--name",
+            "Project login",
+            "--login-audience",
+            "ALL",
+            "--redirect",
+            "prod=https://app.example/callback",
+            "--public-base-url",
+            "https://platform.example",
+        )
+
+        self.assertEqual(code, 2)
+        self.assertEqual(stdout, "")
+        self.assertIn("--auto-apply", stderr)
+        self.assertIn("--app-id", stderr)
+
+    def test_oauth_configure_project_requires_explicit_audience(self) -> None:
+        code, stdout, stderr = run_cli(
+            "oauth",
+            "configure-project",
+            "--auto-apply",
+            "--name",
+            "Project login",
+            "--redirect",
+            "prod=https://app.example/callback",
+            "--public-base-url",
+            "https://platform.example",
+        )
+
+        self.assertEqual(code, 2)
+        self.assertEqual(stdout, "")
+        self.assertIn("--login-audience", stderr)
+
+    def test_oauth_list_never_prints_secret_fields(self) -> None:
+        result = {
+            "list": [
+                {
+                    "id": "app-1",
+                    "secret": "secret-1",
+                    "clientSecret": "secret-2",
+                    "client_secret": "secret-3",
+                }
+            ]
+        }
+        with mock.patch.object(oauth_commands.oauth, "list_apps", return_value=result):
+            code, stdout, stderr = run_cli("oauth", "apps")
+
+        self.assertEqual(code, 0)
+        self.assertEqual(stderr, "")
+        self.assertEqual(json.loads(stdout), {"list": [{"id": "app-1"}]})
+
+    def test_oauth_configure_existing_app_writes_pkce_config_without_secret(self) -> None:
+        app = {
+            "id": "app-1",
+            "appCode": "project-project-1",
+            "clientId": "client-1",
+            "secret": "must-not-be-written",
+        }
+        with tempfile.TemporaryDirectory() as tmp:
+            with mock.patch.dict(os.environ, {"LICOS_PROJECT_PATH": tmp}, clear=False):
+                with mock.patch.object(oauth_commands.oauth, "ensure_project_app", return_value=app) as ensure:
+                    code, stdout, stderr = run_cli(
+                        "oauth",
+                        "configure-project",
+                        "--app-id",
+                        "app-1",
+                        "--name",
+                        "Project login",
+                        "--login-audience",
+                        "OWNER_TENANT",
+                        "--redirect",
+                        "dev=http://localhost:3000/auth/callback",
+                        "--redirect",
+                        "prod=https://app.example/auth/callback",
+                        "--public-base-url",
+                        "https://platform.example/api/v1",
+                    )
+
+            self.assertEqual(code, 0)
+            self.assertEqual(stderr, "")
+            payload = json.loads(stdout)
+            config_path = Path(payload["configPath"])
+            config = json.loads(config_path.read_text(encoding="utf-8"))
+            self.assertEqual(config["clientId"], "client-1")
+            self.assertEqual(config["loginAudience"], "OWNER_TENANT")
+            self.assertEqual(config["publicBaseUrl"], "https://platform.example")
+            self.assertTrue(config["pkce"])
+            self.assertNotIn("secret", config)
+            ensure.assert_called_once_with(
+                app_id="app-1",
+                name="Project login",
+                description=None,
+                login_audience="OWNER_TENANT",
+                redirect_uri_configs=[
+                    {"environment": "dev", "redirectUri": "http://localhost:3000/auth/callback"},
+                    {"environment": "prod", "redirectUri": "https://app.example/auth/callback"},
+                ],
+                allowed_scopes=["openid", "profile", "email"],
+            )
+
+    def test_oauth_configure_auto_apply_uses_environment_public_base(self) -> None:
+        app = {
+            "id": "app-2",
+            "appCode": "project-project-1",
+            "clientId": "client-2",
+        }
+        with tempfile.TemporaryDirectory() as tmp:
+            with mock.patch.dict(
+                os.environ,
+                {"LICOS_PROJECT_PATH": tmp, "LICOS_OAUTH_PUBLIC_BASE_URL": "https://platform.example/api/v1"},
+                clear=False,
+            ):
+                with mock.patch.object(oauth_commands.oauth, "ensure_project_app", return_value=app) as ensure:
+                    code, stdout, stderr = run_cli(
+                        "oauth",
+                        "configure-project",
+                        "--auto-apply",
+                        "--name",
+                        "Project login",
+                        "--login-audience",
+                        "ALL",
+                        "--redirect",
+                        "https://app.example/auth/callback",
+                    )
+
+            self.assertEqual(code, 0)
+            self.assertEqual(stderr, "")
+            config = json.loads((Path(tmp) / "config" / "licos-oauth.json").read_text(encoding="utf-8"))
+            self.assertEqual(config["publicBaseUrl"], "https://platform.example")
+            self.assertEqual(config["redirectUriConfigs"][0]["environment"], "prod")
+            self.assertIsNone(ensure.call_args.kwargs["app_id"])
+            self.assertEqual(json.loads(stdout)["selectionMode"], "auto-apply")
+
+    def test_oauth_configure_auto_generates_stable_project_callbacks(self) -> None:
+        app = {
+            "id": "app-3",
+            "appCode": "project-project-1",
+            "clientId": "client-3",
+        }
+        with tempfile.TemporaryDirectory() as tmp:
+            env = {
+                "LICOS_PROJECT_PATH": tmp,
+                "AGENT_PROJECT_ID": "project/1",
+                "LICOS_PLATFORM_PUBLIC_BASE_URL": "https://platform.example",
+                "LICOS_DEPLOY_PUBLIC_BASE_URL": "https://deploy.example",
+            }
+            with mock.patch.dict(os.environ, env, clear=False):
+                with mock.patch.object(oauth_commands.oauth, "ensure_project_app", return_value=app) as ensure:
+                    code, stdout, stderr = run_cli(
+                        "oauth",
+                        "configure-project",
+                        "--auto-apply",
+                        "--name",
+                        "Project login",
+                        "--login-audience",
+                        "ALL",
+                    )
+
+            self.assertEqual(code, 0)
+            self.assertEqual(stderr, "")
+            redirects = ensure.call_args.kwargs["redirect_uri_configs"]
+            self.assertEqual(
+                redirects,
+                [
+                    {
+                        "environment": "dev",
+                        "redirectUri": (
+                            "https://platform.example/agent/api/v1/projects/"
+                            "project%2F1/oauth/callback"
+                        ),
+                    },
+                    {
+                        "environment": "prod",
+                        "redirectUri": (
+                            "https://deploy.example/p/project%2F1/api/auth/licos/callback"
+                        ),
+                    },
+                ],
+            )
+            config = json.loads((Path(tmp) / "config" / "licos-oauth.json").read_text(encoding="utf-8"))
+            self.assertEqual(config["redirectUriConfigs"], redirects)
+            self.assertEqual(config["publicBaseUrl"], "https://platform.example")
+            self.assertEqual(json.loads(stdout)["selectionMode"], "auto-apply")
+
+    def test_oauth_configure_without_redirect_requires_stable_project_metadata(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            env = {
+                "LICOS_PROJECT_PATH": tmp,
+                "LICOS_PLATFORM_PUBLIC_BASE_URL": "https://platform.example",
+                "LICOS_DEPLOY_PUBLIC_BASE_URL": "https://deploy.example",
+                "AGENT_PROJECT_ID": "",
+            }
+            with mock.patch.dict(os.environ, env, clear=False):
+                with mock.patch.object(oauth_commands.oauth, "ensure_project_app") as ensure:
+                    code, stdout, stderr = run_cli(
+                        "oauth",
+                        "configure-project",
+                        "--auto-apply",
+                        "--name",
+                        "Project login",
+                        "--login-audience",
+                        "ALL",
+                    )
+
+            self.assertEqual(code, 2)
+            self.assertEqual(stdout, "")
+            self.assertIn("AGENT_PROJECT_ID", stderr)
+            ensure.assert_not_called()
+
+    def test_oauth_invalid_output_path_does_not_mutate_platform(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            outside = str(Path(tmp).parent / "outside.json")
+            with mock.patch.dict(os.environ, {"LICOS_PROJECT_PATH": tmp}, clear=False):
+                with mock.patch.object(oauth_commands.oauth, "ensure_project_app") as ensure:
+                    code, stdout, stderr = run_cli(
+                        "oauth",
+                        "configure-project",
+                        "--auto-apply",
+                        "--name",
+                        "Project login",
+                        "--login-audience",
+                        "ALL",
+                        "--redirect",
+                        "prod=https://app.example/auth/callback",
+                        "--public-base-url",
+                        "https://platform.example",
+                        "--out",
+                        outside,
+                    )
+
+            self.assertEqual(code, 2)
+            self.assertEqual(stdout, "")
+            self.assertIn("must stay inside", stderr)
+            ensure.assert_not_called()
+
     def test_database_query_forwards_runtime_options(self) -> None:
         with mock.patch.object(database_commands.database, "query", return_value={"rows": []}) as query:
             code, stdout, stderr = run_cli(