lightnow-cli 1.0.0__py3-none-any.whl

lightnow_cli/commands/runner.py

@@ -0,0 +1,399 @@
+"""Local MCP runner commands."""
+
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+from pathlib import Path
+from typing import Any, Optional
+from urllib.parse import quote
+
+import httpx
+import typer
+from rich.console import Console
+from typing_extensions import Annotated
+
+from ..authenticated_http import (
+    authentication_error_from_response,
+    request_with_refresh,
+)
+from ..config import config_manager
+from .auth import (
+    ACCESS_TOKEN_EXPIRED_MESSAGE,
+    AccessTokenExpired,
+    AuthError,
+    require_access_token,
+)
+
+console = Console(stderr=True)
+
+
+def run(
+    server: Annotated[
+        str,
+        typer.Option(
+            "--server",
+            help="MCP server alias from the selected LightNow runtime profile.",
+        ),
+    ],
+    profile: Annotated[
+        str,
+        typer.Option("--profile", help="LightNow runtime profile."),
+    ] = "default",
+    tenant: Annotated[
+        Optional[str],
+        typer.Option("--tenant", help="Tenant id or slug, sent as X-Tenant."),
+    ] = None,
+    api_url: Annotated[
+        Optional[str],
+        typer.Option("--api-url", help="Registry API base URL."),
+    ] = None,
+    transport: Annotated[
+        str,
+        typer.Option("--transport", help="Requested runtime transport."),
+    ] = "stdio",
+) -> None:
+    """Run one MCP server through LightNow and inject secrets into the child process."""
+    if transport != "stdio":
+        console.print("[bold red]Runner failed:[/bold red] only stdio is supported.")
+        raise typer.Exit(2)
+
+    try:
+        token = require_access_token()
+        registry_api_url = api_url or config_manager.load_config().registry_api_url
+        if not registry_api_url:
+            raise ValueError(
+                "Registry API URL required. Configure the CLI or pass --api-url."
+            )
+        selected = resolve_profile_server(
+            api_url=registry_api_url,
+            token=token,
+            tenant=tenant,
+            profile=profile,
+            server=server,
+        )
+        context = fetch_runtime_context(
+            api_url=registry_api_url,
+            token=token,
+            tenant=tenant,
+            profile=profile,
+            server_name=str(selected["server_name"]),
+            version=str(selected["version"]),
+            transport=transport,
+        )
+        assert_runtime_context_ready(context, server=server, profile=profile)
+        command, args, env, cwd = launch_config_from_context(context)
+    except AccessTokenExpired:
+        console.print(f"[red]{ACCESS_TOKEN_EXPIRED_MESSAGE}[/red]")
+        raise typer.Exit(1)
+    except (AuthError, ValueError) as exc:
+        console.print(f"[bold red]Runner failed:[/bold red] {redact(str(exc))}")
+        raise typer.Exit(1) from exc
+
+    process_env = os.environ.copy()
+    process_env.update(env)
+    try:
+        completed = subprocess.run(
+            [command, *args],
+            cwd=str(Path(cwd).expanduser()) if cwd else None,
+            env=process_env,
+            stdin=sys.stdin.buffer,
+            stdout=sys.stdout.buffer,
+            stderr=sys.stderr.buffer,
+            check=False,
+        )
+    except FileNotFoundError as exc:
+        console.print(
+            f"[bold red]Runner failed:[/bold red] command not found: {command}"
+        )
+        raise typer.Exit(127) from exc
+
+    if completed.returncode != 0:
+        console.print(
+            runner_failure_summary(
+                server=server,
+                profile=profile,
+                command=command,
+                args=args,
+                env=env,
+                cwd=cwd,
+                exit_code=completed.returncode,
+            )
+        )
+
+    raise typer.Exit(completed.returncode)
+
+
+def resolve_profile_server(
+    *,
+    api_url: str,
+    token: str,
+    tenant: Optional[str],
+    profile: str,
+    server: str,
+) -> dict[str, Any]:
+    """Find a registry-linked profile server by alias or registry name."""
+    payload = fetch_profile_servers(
+        api_url=api_url,
+        token=token,
+        tenant=tenant,
+        profile=profile,
+    )
+    servers = payload.get("servers") if isinstance(payload, dict) else None
+    if not isinstance(servers, list):
+        raise ValueError("Registry API response did not include profile servers.")
+
+    matches = [
+        item
+        for item in servers
+        if isinstance(item, dict)
+        and (item.get("alias") == server or item.get("server_name") == server)
+    ]
+    if len(matches) != 1:
+        raise ValueError(f"Runtime profile does not contain server '{server}'.")
+
+    selected = matches[0]
+    if selected.get("status") != "linked":
+        missing = missing_inputs_from_context(selected)
+        if missing:
+            raise ValueError(
+                format_missing_inputs_message(
+                    missing,
+                    server=server,
+                    profile=profile,
+                )
+            )
+        status = selected.get("status")
+        raise ValueError(
+            f"Server '{server}' is not ready for the local runner: {status}"
+        )
+    if not isinstance(selected.get("server_name"), str) or not isinstance(
+        selected.get("version"), str
+    ):
+        raise ValueError(
+            f"Server '{server}' must be linked to a registry version before runner sync."
+        )
+    return selected
+
+
+def assert_runtime_context_ready(
+    context: dict[str, Any],
+    *,
+    server: str,
+    profile: str,
+) -> None:
+    """Fail before starting a child process when LightNow knows inputs are missing."""
+    missing = missing_inputs_from_context(context)
+    if missing:
+        raise ValueError(
+            format_missing_inputs_message(missing, server=server, profile=profile)
+        )
+
+
+def missing_inputs_from_context(context: dict[str, Any]) -> list[dict[str, Any]]:
+    """Normalize missing_inputs from Registry API payloads."""
+    raw_missing = context.get("missing_inputs")
+    if not isinstance(raw_missing, list):
+        return []
+    missing: list[dict[str, Any]] = []
+    for item in raw_missing:
+        if isinstance(item, dict):
+            missing.append(item)
+        elif isinstance(item, str) and item:
+            missing.append({"name": item})
+    return missing
+
+
+def format_missing_inputs_message(
+    missing: list[dict[str, Any]],
+    *,
+    server: str,
+    profile: str,
+) -> str:
+    """Render a clear readiness error for missing runtime inputs."""
+    lines = [
+        f"Runtime profile '{profile}' is missing required configuration for '{server}'.",
+        "Missing inputs:",
+    ]
+    for item in missing:
+        lines.append(f"  - {format_missing_input(item)}")
+    lines.extend(
+        [
+            "Open LightNow Integrations, select this server, set the missing values,",
+            "save the profile, and run the command again.",
+        ]
+    )
+    return "\n".join(lines)
+
+
+def format_missing_input(item: dict[str, Any]) -> str:
+    """Render one missing input without exposing values."""
+    name = item.get("name")
+    scope = item.get("scope")
+    is_secret = item.get("is_secret")
+    description = item.get("description")
+
+    label = str(name) if isinstance(name, str) and name else "unnamed input"
+    details: list[str] = []
+    if isinstance(scope, str) and scope:
+        details.append(scope.replace("_", " "))
+    if is_secret is True:
+        details.append("secret")
+    suffix = f" ({', '.join(details)})" if details else ""
+    help_text = (
+        f" - {description}" if isinstance(description, str) and description else ""
+    )
+    return f"{label}{suffix}{help_text}"
+
+
+def runner_failure_summary(
+    *,
+    server: str,
+    profile: str,
+    command: str,
+    args: list[str],
+    env: dict[str, str],
+    cwd: Optional[str],
+    exit_code: int,
+) -> str:
+    """Explain which LightNow-resolved process failed, without printing secrets."""
+    rendered_command = " ".join([command, *args])
+    env_names = ", ".join(sorted(env.keys())) if env else "none"
+    cwd_line = f"\n  working directory: {cwd}" if cwd else ""
+    return (
+        "\n[bold red]Runner failed:[/bold red] MCP server process exited with "
+        f"code {exit_code}.\n"
+        f"  profile: {profile}\n"
+        f"  server: {server}\n"
+        f"  command: {rendered_command}\n"
+        f"  environment values supplied by LightNow: {env_names}"
+        f"{cwd_line}\n"
+        "Check this server's configuration in LightNow Integrations and run again.\n"
+        f"Use 'lightnow info {server}' to inspect the server's expected inputs."
+    )
+
+
+def fetch_profile_servers(
+    *,
+    api_url: str,
+    token: str,
+    tenant: Optional[str],
+    profile: str,
+) -> dict[str, Any]:
+    """Fetch servers configured in a LightNow runtime profile."""
+    url = f"{api_url.rstrip('/')}/integrations/profiles/{profile}/servers"
+    try:
+        response = request_with_refresh(
+            "GET",
+            url,
+            token=token,
+            tenant=tenant,
+            headers={"Accept": "application/json"},
+            timeout=30.0,
+        )
+    except httpx.RequestError as exc:
+        raise ValueError(f"Network error: {exc}") from exc
+
+    return json_response_or_error(response)
+
+
+def fetch_runtime_context(
+    *,
+    api_url: str,
+    token: str,
+    tenant: Optional[str],
+    profile: str,
+    server_name: str,
+    version: str,
+    transport: str,
+) -> dict[str, Any]:
+    """Fetch a secret-bearing runtime context for the local runner."""
+    encoded_server = quote(server_name, safe="")
+    encoded_version = quote(version, safe="")
+    url = f"{api_url.rstrip('/')}/servers/{encoded_server}/versions/{encoded_version}/context"
+    try:
+        response = request_with_refresh(
+            "GET",
+            url,
+            token=token,
+            tenant=tenant,
+            headers={"Accept": "application/json"},
+            params={
+                "profile": profile,
+                "include": "secrets",
+                "transport": transport,
+                "consumer": "local-runner",
+            },
+            timeout=30.0,
+        )
+    except httpx.RequestError as exc:
+        raise ValueError(f"Network error: {exc}") from exc
+
+    return json_response_or_error(response)
+
+
+def launch_config_from_context(
+    context: dict[str, Any],
+) -> tuple[str, list[str], dict[str, str], Optional[str]]:
+    """Extract stdio launch details from a runtime context."""
+    probe_request = context.get("probe_request")
+    if not isinstance(probe_request, dict):
+        raise ValueError("Runtime context did not include a probe request.")
+    if probe_request.get("transport") != "stdio":
+        raise ValueError("Runtime context did not resolve to a stdio server.")
+    stdio = probe_request.get("stdio")
+    if not isinstance(stdio, dict):
+        raise ValueError("Runtime context did not include stdio launch details.")
+
+    command = stdio.get("cmd")
+    if not isinstance(command, str) or command == "":
+        raise ValueError("Runtime context did not include a launch command.")
+
+    args = stdio.get("args", [])
+    if not isinstance(args, list) or not all(isinstance(arg, str) for arg in args):
+        raise ValueError("Runtime context included invalid launch arguments.")
+
+    raw_env = stdio.get("env", {})
+    if raw_env is None:
+        raw_env = {}
+    if not isinstance(raw_env, dict):
+        raise ValueError("Runtime context included invalid environment variables.")
+    env = {str(key): str(value) for key, value in raw_env.items()}
+
+    cwd = stdio.get("cwd") if "cwd" in stdio else stdio.get("working_directory")
+    if cwd is not None and not isinstance(cwd, str):
+        raise ValueError("Runtime context included an invalid working directory.")
+
+    return command, list(args), env, cwd
+
+
+def json_response_or_error(response: httpx.Response) -> dict[str, Any]:
+    """Return JSON response or raise a redacted explicit error."""
+    if response.status_code == 401:
+        raise authentication_error_from_response(response)
+    if response.status_code >= 400:
+        raise ValueError(f"HTTP {response.status_code}: {redact(response.text)}")
+
+    payload = response.json()
+    if not isinstance(payload, dict):
+        raise ValueError("Registry API response was not a JSON object.")
+    return payload
+
+
+def redact(value: str) -> str:
+    """Redact secret-like values from error output."""
+    redacted = value
+    for marker in ("TOKEN", "SECRET", "PASSWORD", "PWD", "KEY"):
+        lines = []
+        for line in redacted.splitlines():
+            if marker in line.upper() and "${" not in line:
+                if "=" in line:
+                    key, _ = line.split("=", 1)
+                    line = key + '= "[REDACTED]"'
+                elif ":" in line:
+                    key, _ = line.split(":", 1)
+                    line = key + ': "[REDACTED]"'
+            lines.append(line)
+        redacted = "\n".join(lines)
+    return redacted

lightnow_cli/commands/validate.py

@@ -0,0 +1,78 @@
+"""Validate command for local artifact validation."""
+
+from pathlib import Path
+from typing import Optional
+
+import typer
+from rich.console import Console
+from typing_extensions import Annotated
+
+from ..validation import validate_artifacts
+
+console = Console()
+
+
+def validate(
+    server: Annotated[
+        Optional[Path], typer.Option("--server", help="Path to server.json file")
+    ] = None,
+    docs: Annotated[
+        Optional[Path], typer.Option("--docs", help="Path to docs.md file")
+    ] = None,
+    spec: Annotated[
+        Optional[Path],
+        typer.Option("--spec", help="Path to OpenAPI specification file"),
+    ] = None,
+) -> None:
+    """Validate MCP server artifacts locally."""
+    if not any([server, docs, spec]):
+        console.print(
+            "[red]Error: At least one file must be specified for validation[/red]"
+        )
+        console.print("Use --help to see available options.")
+        raise typer.Exit(1)
+
+    console.print("[bold blue]Validating MCP server artifacts...[/bold blue]")
+
+    try:
+        results = validate_artifacts(server_file=server, docs_file=docs, spec_file=spec)
+
+        if results["valid"]:
+            console.print("\n[bold green]✓ All artifacts are valid![/bold green]")
+
+            if results["warnings"]:
+                console.print(
+                    f"\n[yellow]Note: {len(results['warnings'])} warning(s) found:[/yellow]"
+                )
+                for warning in results["warnings"]:
+                    console.print(f"  [yellow]•[/yellow] {warning}")
+
+            # Show summary of validated files
+            validated_files = []
+            if server and "server" in results["validated"]:
+                validated_files.append("server.json")
+            if docs and "docs" in results["validated"]:
+                validated_files.append("docs.md")
+            if spec and "spec" in results["validated"]:
+                validated_files.append("OpenAPI specification")
+
+            if validated_files:
+                console.print(f"\nValidated files: {', '.join(validated_files)}")
+
+        else:
+            console.print(
+                f"\n[bold red]Validation failed with {len(results['errors'])} error(s):[/bold red]"
+            )
+            for error in results["errors"]:
+                console.print(f"  [red]•[/red] {error}")
+
+            if results["warnings"]:
+                console.print("\n[yellow]Additional warnings:[/yellow]")
+                for warning in results["warnings"]:
+                    console.print(f"  [yellow]•[/yellow] {warning}")
+
+            raise typer.Exit(1)
+
+    except Exception as e:
+        console.print(f"[bold red]Validation error:[/bold red] {e}")
+        raise typer.Exit(1)

lightnow_cli/config.py

@@ -0,0 +1,152 @@
+"""Configuration and token management."""
+
+import json
+import os
+import tempfile
+from pathlib import Path
+from typing import Any, Dict, Optional
+
+import typer
+from pydantic import BaseModel, Field
+
+DEFAULT_ISSUER = "https://auth.lightnow.ai/realms/lightnow"
+DEFAULT_CLIENT_ID = "lightnow-cli"
+DEFAULT_REGISTRY_API_URL = "https://registry-api.lightnow.ai/v0.1"
+LOCAL_ISSUER = "https://auth.lightnow.local/realms/lightnow-local"
+LOCAL_REGISTRY_API_URL = "https://registry-api.lightnow.local/v0.1"
+
+
+class Config(BaseModel):
+    """CLI configuration model."""
+
+    access_token: Optional[str] = None
+    refresh_token: Optional[str] = None
+    issuer: Optional[str] = Field(default=DEFAULT_ISSUER)
+    client_id: Optional[str] = Field(default=DEFAULT_CLIENT_ID)
+    registry_api_url: Optional[str] = Field(default=DEFAULT_REGISTRY_API_URL)
+    user_info: Optional[Dict[str, Any]] = None
+
+
+class ConfigManager:
+    """Manages CLI configuration and token storage."""
+
+    def __init__(self) -> None:
+        self.config_dir = Path.home() / ".lightnow"
+        self.config_file = self.config_dir / "config.json"
+        self._config: Optional[Config] = None
+
+    def _ensure_config_dir(self) -> None:
+        """Ensure config directory exists."""
+        self.config_dir.mkdir(mode=0o700, exist_ok=True)
+        self.config_dir.chmod(0o700)
+
+    def load_config(self) -> Config:
+        """Load configuration from file."""
+        if self._config is not None:
+            return self._config
+
+        # Start with default config
+        config_data = {}
+
+        # Load from file if exists
+        if self.config_file.exists():
+            try:
+                with open(self.config_file, "r") as f:
+                    config_data = json.load(f)
+            except (json.JSONDecodeError, IOError) as e:
+                typer.echo(f"Warning: Failed to load config file: {e}", err=True)
+
+        self._config = Config(**config_data)
+        return self._config
+
+    def save_config(self, config: Config) -> None:
+        """Save configuration to file."""
+        self._ensure_config_dir()
+
+        config_data = config.model_dump()
+        serialized = json.dumps(config_data, indent=2)
+        fd: Optional[int] = None
+        tmp_path: Optional[Path] = None
+
+        try:
+            fd, raw_tmp_path = tempfile.mkstemp(
+                prefix=f".{self.config_file.name}.",
+                suffix=".tmp",
+                dir=self.config_dir,
+                text=True,
+            )
+            tmp_path = Path(raw_tmp_path)
+            os.fchmod(fd, 0o600)
+            with os.fdopen(fd, "w") as f:
+                fd = None
+                f.write(serialized)
+                f.write("\n")
+                f.flush()
+                os.fsync(f.fileno())
+            os.replace(tmp_path, self.config_file)
+            self.config_file.chmod(0o600)
+            self._fsync_config_dir()
+            self._config = config
+        except IOError as e:
+            typer.echo(f"Error: Failed to save config: {e}", err=True)
+            raise typer.Exit(1)
+        finally:
+            if fd is not None:
+                os.close(fd)
+            if tmp_path is not None and tmp_path.exists():
+                tmp_path.unlink()
+
+    def _fsync_config_dir(self) -> None:
+        """Best-effort fsync for the config directory after atomic replacement."""
+        try:
+            dir_fd = os.open(self.config_dir, os.O_RDONLY)
+        except OSError:
+            return
+        try:
+            os.fsync(dir_fd)
+        finally:
+            os.close(dir_fd)
+
+    def get_token(self) -> Optional[str]:
+        """Get access token from config or environment."""
+        config = self.load_config()
+        return config.access_token
+
+    def set_token(
+        self,
+        token: str,
+        refresh_token: Optional[str] = None,
+        user_info: Optional[Dict[str, Any]] = None,
+    ) -> None:
+        """Set access token, refresh token and optionally user info."""
+        config = self.load_config()
+        config.access_token = token
+        if refresh_token is not None:
+            config.refresh_token = refresh_token
+        config.user_info = user_info
+        self.save_config(config)
+
+    def clear_token(self) -> None:
+        """Clear stored access token."""
+        config = self.load_config()
+        config.access_token = None
+        config.refresh_token = None
+        config.user_info = None
+        self.save_config(config)
+
+    def set_auth_config(
+        self,
+        issuer: str,
+        client_id: str,
+        registry_api_url: Optional[str] = None,
+    ) -> None:
+        """Set authentication configuration."""
+        config = self.load_config()
+        config.issuer = issuer
+        config.client_id = client_id
+        config.registry_api_url = registry_api_url or DEFAULT_REGISTRY_API_URL
+        self.save_config(config)
+
+
+# Global config manager instance
+config_manager = ConfigManager()

lightnow_cli/main.py

@@ -0,0 +1,54 @@
+"""Main CLI application entry point."""
+
+import typer
+from typing_extensions import Annotated
+
+from . import __version__
+from .commands import auth, integrations, publish, query, runner, validate
+from .tls import configure_tls_trust_store
+
+configure_tls_trust_store()
+
+app = typer.Typer(
+    name="lightnow",
+    help="LightNow CLI - publish MCP servers and sync integration profiles.",
+    no_args_is_help=True,
+)
+
+app.command("login")(auth.login)
+app.command("logout")(auth.logout)
+app.command("status")(auth.status)
+app.command("whoami")(auth.whoami)
+app.command("publish")(publish.publish)
+app.command("search")(query.search_servers)
+app.command("favorites")(query.favorite_servers)
+app.command("info")(query.server_info)
+app.command("validate")(validate.validate)
+app.command("sync")(integrations.sync)
+app.command("run")(runner.run)
+
+
+def version_callback(value: bool) -> None:
+    """Print version and exit."""
+    if value:
+        typer.echo(f"LightNow CLI {__version__}")
+        raise typer.Exit()
+
+
+@app.callback()
+def main(
+    version: Annotated[
+        bool, typer.Option("--version", callback=version_callback, help="Show version")
+    ] = False,
+) -> None:
+    """LightNow CLI."""
+    pass
+
+
+def cli() -> None:
+    """Run the LightNow command-line application."""
+    app()
+
+
+if __name__ == "__main__":
+    cli()

lightnow_cli/tls.py

@@ -0,0 +1,8 @@
+"""TLS trust configuration."""
+
+import truststore
+
+
+def configure_tls_trust_store() -> None:
+    """Use the operating system certificate store for HTTPS verification."""
+    truststore.inject_into_ssl()