lightnow-cli 1.0.0__tar.gz → 1.0.2__tar.gz

{lightnow_cli-1.0.0 → lightnow_cli-1.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lightnow-cli
-Version: 1.0.0
+Version: 1.0.2
 Summary: Official LightNow CLI for MCP registry discovery, client config sync, and local MCP runner workflows
 Project-URL: Homepage, https://github.com/lightnow-ai/lightnow-cli
 Project-URL: Repository, https://github.com/lightnow-ai/lightnow-cli
@@ -42,6 +42,8 @@ Description-Content-Type: text/markdown
 
 # LightNow CLI
 
+[![PyPI](https://img.shields.io/pypi/v/lightnow-cli.svg)](https://pypi.org/project/lightnow-cli/)
+
 The **LightNow CLI** connects your local MCP clients with LightNow.
 
 Use it to discover MCP servers, sync client configurations, and run

{lightnow_cli-1.0.0 → lightnow_cli-1.0.2}/README.md

@@ -1,5 +1,7 @@
 # LightNow CLI
 
+[![PyPI](https://img.shields.io/pypi/v/lightnow-cli.svg)](https://pypi.org/project/lightnow-cli/)
+
 The **LightNow CLI** connects your local MCP clients with LightNow.
 
 Use it to discover MCP servers, sync client configurations, and run

{lightnow_cli-1.0.0 → lightnow_cli-1.0.2}/docs/release.md

@@ -31,8 +31,8 @@ Before publishing a release:
    - Environment: `pypi`
 6. Create a signed or otherwise traceable Git tag:
    ```bash
-   git tag v1.0.0
-   git push origin v1.0.0
+   git tag vX.Y.Z
+   git push origin vX.Y.Z
    ```
 7. Verify the GitHub Actions `Release` workflow:
    - tests pass,

{lightnow_cli-1.0.0 → lightnow_cli-1.0.2}/lightnow_cli/__init__.py

@@ -1,3 +1,3 @@
 """LightNow CLI - A command-line tool for managing MCP servers."""
 
-__version__ = "1.0.0"
+__version__ = "1.0.2"

{lightnow_cli-1.0.0 → lightnow_cli-1.0.2}/lightnow_cli/client.py

@@ -151,8 +151,6 @@ class MCPRegistryClient:
             params["favorites"] = favorites
         if sort:
             params["sort"] = sort
-        if tenant:
-            params["tenant"] = tenant
         if cursor:
             params["cursor"] = cursor
 
@@ -163,6 +161,7 @@ class MCPRegistryClient:
                 params=params,
                 headers=self._get_headers(),
                 token=self.token,
+                tenant=tenant,
                 allow_refresh=self._refresh_on_unauthorized,
                 timeout=30.0,
             )
@@ -191,8 +190,6 @@ class MCPRegistryClient:
     ) -> Dict[str, Any]:
         """Get detailed information about a specific server."""
         params: Dict[str, Any] = {}
-        if tenant:
-            params["tenant"] = tenant
 
         encoded_server_id = quote(server_id, safe="")
         if version:
@@ -209,6 +206,7 @@ class MCPRegistryClient:
                 params=params,
                 headers=self._get_headers(),
                 token=self.token,
+                tenant=tenant,
                 allow_refresh=self._refresh_on_unauthorized,
                 timeout=30.0,
             )

{lightnow_cli-1.0.0 → lightnow_cli-1.0.2}/lightnow_cli/commands/auth.py

@@ -25,6 +25,7 @@ from ..config import (
 console = Console()
 app = typer.Typer(help="Authentication commands")
 
+AUTH_HTTP_TIMEOUT = 30.0
 ACCESS_TOKEN_EXPIRED_MESSAGE = (
     "Access token has expired. Please run 'lightnow login' again."
 )
@@ -41,6 +42,14 @@ class AccessTokenExpired(AuthError):
     """The stored access token is expired and cannot be refreshed."""
 
 
+def describe_http_error(error: httpx.HTTPError) -> str:
+    """Return a useful message for httpx errors that may stringify empty."""
+    message = str(error).strip()
+    if message:
+        return message
+    return error.__class__.__name__
+
+
 def open_authorization_url(verification_uri: str) -> bool:
     """Open the device authorization URL in the user's browser."""
     return webbrowser.open(verification_uri, new=2, autoraise=True)
@@ -59,7 +68,7 @@ def pkce_challenge(verifier: str) -> str:
 
 async def discover_oidc_endpoints(issuer: str) -> Dict[str, str]:
     """Discover the OIDC endpoints required by the CLI."""
-    async with httpx.AsyncClient() as client:
+    async with httpx.AsyncClient(timeout=AUTH_HTTP_TIMEOUT) as client:
         try:
             discovery_response = await client.get(
                 f"{issuer}/.well-known/openid-configuration"
@@ -69,7 +78,9 @@ async def discover_oidc_endpoints(issuer: str) -> Dict[str, str]:
             if not isinstance(discovery, dict):
                 raise AuthError("OIDC discovery response is not a JSON object")
         except httpx.HTTPError as e:
-            raise AuthError(f"Failed to discover OIDC endpoints: {e}") from e
+            raise AuthError(
+                f"Failed to discover OIDC endpoints: {describe_http_error(e)}"
+            ) from e
 
     device_authorization_endpoint = discovery.get("device_authorization_endpoint")
     token_endpoint = discovery.get("token_endpoint")
@@ -91,7 +102,7 @@ async def device_code_flow(issuer: str, client_id: str) -> Dict[str, Any]:
     """Perform OIDC Device Code Flow authentication."""
     endpoints = await discover_oidc_endpoints(issuer)
     code_verifier = generate_pkce_verifier()
-    async with httpx.AsyncClient() as client:
+    async with httpx.AsyncClient(timeout=AUTH_HTTP_TIMEOUT) as client:
         # Start device authorization
         try:
             device_response = await client.post(
@@ -107,7 +118,9 @@ async def device_code_flow(issuer: str, client_id: str) -> Dict[str, Any]:
             device_data = device_response.json()
 
         except httpx.HTTPError as e:
-            raise AuthError(f"Failed to start device authorization: {e}")
+            raise AuthError(
+                f"Failed to start device authorization: {describe_http_error(e)}"
+            )
 
         # Show user instructions
         console.print("\n[bold blue]Device Authorization Required[/bold blue]")
@@ -165,7 +178,7 @@ async def device_code_flow(issuer: str, client_id: str) -> Dict[str, Any]:
                         raise AuthError(f"Authorization failed: {error}")
 
             except httpx.HTTPError as e:
-                raise AuthError(f"Failed to poll for token: {e}")
+                raise AuthError(f"Failed to poll for token: {describe_http_error(e)}")
 
         raise AuthError("Authorization timed out")
 
@@ -175,7 +188,7 @@ async def refresh_access_token(
 ) -> Dict[str, Any]:
     """Refresh the access token using the stored refresh token."""
     endpoints = await discover_oidc_endpoints(issuer)
-    async with httpx.AsyncClient() as client:
+    async with httpx.AsyncClient(timeout=AUTH_HTTP_TIMEOUT) as client:
         try:
             token_response = await client.post(
                 endpoints["token_endpoint"],
@@ -186,7 +199,9 @@ async def refresh_access_token(
                 },
             )
         except httpx.HTTPError as e:
-            raise AuthError(f"Failed to refresh access token: {e}") from e
+            raise AuthError(
+                f"Failed to refresh access token: {describe_http_error(e)}"
+            ) from e
 
     if token_response.status_code == 200:
         token_data = token_response.json()
@@ -239,14 +254,16 @@ async def fetch_user_info(issuer: str, token: str) -> Dict[str, Any]:
     if not userinfo_endpoint:
         raise AuthError("OIDC provider does not expose a userinfo endpoint.")
 
-    async with httpx.AsyncClient() as client:
+    async with httpx.AsyncClient(timeout=AUTH_HTTP_TIMEOUT) as client:
         try:
             response = await client.get(
                 userinfo_endpoint,
                 headers={"Authorization": f"Bearer {token}"},
             )
         except httpx.HTTPError as exc:
-            raise AuthError(f"Failed to fetch user information: {exc}") from exc
+            raise AuthError(
+                f"Failed to fetch user information: {describe_http_error(exc)}"
+            ) from exc
 
     if response.status_code == 401:
         raise AccessTokenExpired(ACCESS_TOKEN_EXPIRED_MESSAGE)

{lightnow_cli-1.0.0 → lightnow_cli-1.0.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "lightnow-cli"
-version = "1.0.0"
+version = "1.0.2"
 description = "Official LightNow CLI for MCP registry discovery, client config sync, and local MCP runner workflows"
 authors = [{name = "LightNow Team"}]
 license = {text = "Apache-2.0"}

{lightnow_cli-1.0.0 → lightnow_cli-1.0.2}/tests/test_auth_flow.py

@@ -26,7 +26,8 @@ class FakeResponse:
 class FakeDeviceClient:
     """AsyncClient stub that completes device authorization after one poll."""
 
-    def __init__(self) -> None:
+    def __init__(self, *args: object, **kwargs: object) -> None:
+        assert kwargs.get("timeout") == auth.AUTH_HTTP_TIMEOUT
         self.polls = 0
 
     async def __aenter__(self) -> "FakeDeviceClient":
@@ -103,6 +104,11 @@ async def test_device_code_flow_opens_browser_and_returns_token(monkeypatch) ->
     assert opened == ["https://auth.lightnow.local/device?user_code=TEST"]
 
 
+def test_describe_http_error_names_empty_errors() -> None:
+    """HTTP errors with empty string output still produce useful messages."""
+    assert auth.describe_http_error(auth.httpx.ReadTimeout("")) == "ReadTimeout"
+
+
 def test_get_user_info_decodes_unverified_jwt_claims_for_refresh_hints() -> None:
     """The CLI can inspect local JWT metadata without treating it as identity."""
     token = (
@@ -135,6 +141,9 @@ async def test_fetch_user_info_uses_oidc_userinfo_endpoint(monkeypatch) -> None:
     """Identity is fetched from the issuer instead of trusting local JWT claims."""
 
     class FakeUserInfoClient:
+        def __init__(self, *args: object, **kwargs: object) -> None:
+            assert kwargs.get("timeout") == auth.AUTH_HTTP_TIMEOUT
+
         async def __aenter__(self) -> "FakeUserInfoClient":
             return self
 
@@ -209,7 +218,11 @@ async def test_refresh_access_token_returns_new_tokens(monkeypatch) -> None:
         }
 
     monkeypatch.setattr(auth, "discover_oidc_endpoints", endpoints)
-    monkeypatch.setattr(auth.httpx, "AsyncClient", lambda: fake)
+    monkeypatch.setattr(
+        auth.httpx,
+        "AsyncClient",
+        lambda *args, **kwargs: fake,
+    )
 
     token_data = await auth.refresh_access_token(
         "https://auth.lightnow.local/realms/lightnow",
@@ -234,7 +247,11 @@ async def test_refresh_access_token_invalid_grant_is_expired(monkeypatch) -> Non
         }
 
     monkeypatch.setattr(auth, "discover_oidc_endpoints", endpoints)
-    monkeypatch.setattr(auth.httpx, "AsyncClient", lambda: fake)
+    monkeypatch.setattr(
+        auth.httpx,
+        "AsyncClient",
+        lambda *args, **kwargs: fake,
+    )
 
     with pytest.raises(auth.AccessTokenExpired, match="Access token has expired"):
         await auth.refresh_access_token(

{lightnow_cli-1.0.0 → lightnow_cli-1.0.2}/tests/test_cli.py

@@ -51,7 +51,7 @@ def test_cli_version(runner):
     """Test CLI version command."""
     result = runner.invoke(app, ["--version"])
     assert result.exit_code == 0
-    assert "LightNow CLI 1.0.0" in result.stdout
+    assert "LightNow CLI 1.0.2" in result.stdout
 
 
 def test_cli_help(runner):
@@ -175,6 +175,103 @@ def test_run_command_starts_profile_server(runner):
     assert run_process.call_args.kwargs["env"]["SONARQUBE_TOKEN"] == "secret"
 
 
+def test_run_command_passes_tenant_to_profile_and_context_requests(runner):
+    """The local runner keeps organization context for lookup and secret context."""
+    with (
+        patch(
+            "lightnow_cli.commands.runner.require_access_token",
+            return_value="token",
+        ),
+        patch(
+            "lightnow_cli.commands.runner.resolve_profile_server",
+            return_value={
+                "alias": "sonarqube",
+                "server_name": "io.github.sonarsource/sonarqube-mcp-server",
+                "version": "1.2.3",
+                "status": "linked",
+            },
+        ) as resolve,
+        patch(
+            "lightnow_cli.commands.runner.fetch_runtime_context",
+            return_value={"probe_request": {"transport": "stdio", "stdio": {}}},
+        ) as fetch_context,
+        patch(
+            "lightnow_cli.commands.runner.launch_config_from_context",
+            return_value=("python", ["-m", "server"], {}, None),
+        ),
+        patch(
+            "lightnow_cli.commands.runner.subprocess.run",
+            return_value=MagicMock(returncode=0),
+        ),
+    ):
+        result = runner.invoke(
+            app,
+            [
+                "run",
+                "--server",
+                "sonarqube",
+                "--profile",
+                "default",
+                "--tenant",
+                "acme",
+                "--api-url",
+                "https://registry-api.lightnow.local/v0.1",
+            ],
+        )
+
+    assert result.exit_code == 0
+    assert resolve.call_args.kwargs["tenant"] == "acme"
+    assert fetch_context.call_args.kwargs["tenant"] == "acme"
+
+
+def test_search_command_passes_tenant_context(runner):
+    """Search supports organization context from the public CLI surface."""
+    fake_client = MagicMock()
+    fake_client.list_servers = AsyncMock(return_value={"servers": []})
+
+    with patch("lightnow_cli.commands.query.get_client", return_value=fake_client):
+        result = runner.invoke(
+            app, ["search", "redis", "--tenant", "acme", "--limit", "5"]
+        )
+
+    assert result.exit_code == 0
+    assert fake_client.list_servers.call_args.kwargs["tenant"] == "acme"
+
+
+def test_favorites_command_passes_tenant_context(runner):
+    """Favorites supports organization-scoped favorites from the CLI."""
+    fake_client = MagicMock()
+    fake_client.list_servers = AsyncMock(return_value={"servers": []})
+
+    with patch("lightnow_cli.commands.query.get_client", return_value=fake_client):
+        result = runner.invoke(
+            app, ["favorites", "--scope", "tenant", "--tenant", "acme"]
+        )
+
+    assert result.exit_code == 0
+    assert fake_client.list_servers.call_args.kwargs["favorites"] == "tenant"
+    assert fake_client.list_servers.call_args.kwargs["tenant"] == "acme"
+
+
+def test_info_command_passes_tenant_context(runner):
+    """Server info supports organization context from the public CLI surface."""
+    fake_client = MagicMock()
+    fake_client.get_server_info = AsyncMock(
+        return_value={
+            "name": "io.github.test/server",
+            "version": "1.0.0",
+        }
+    )
+
+    with patch("lightnow_cli.commands.query.get_client", return_value=fake_client):
+        result = runner.invoke(
+            app, ["info", "io.github.test/server", "--tenant", "acme"]
+        )
+
+    assert result.exit_code == 0
+    assert fake_client.get_server_info.call_args.kwargs["tenant"] == "acme"
+
+
 def test_run_command_reports_expired_token(runner):
     """Runner commands use the shared expired-token message."""
     from lightnow_cli.commands.auth import (

{lightnow_cli-1.0.0 → lightnow_cli-1.0.2}/tests/test_client.py

@@ -221,6 +221,21 @@ async def test_client_lists_servers(monkeypatch) -> None:
     assert fake.last_params["cursor"] == "cursor-token"
 
 
+@pytest.mark.asyncio
+async def test_client_lists_servers_with_tenant_header(monkeypatch) -> None:
+    """Tenant context for list queries is sent as X-Tenant, not as a query param."""
+    fake = FakeHttpClient()
+    monkeypatch.setattr("lightnow_cli.client.httpx.AsyncClient", lambda: fake)
+
+    client = MCPRegistryClient(
+        base_url="https://registry-api.lightnow.local/v0.1", token="token"
+    )
+    await client.list_servers(favorites="tenant", tenant="tenant-uuid")
+
+    assert fake.last_headers["X-Tenant"] == "tenant-uuid"
+    assert "tenant" not in fake.last_params
+
+
 @pytest.mark.asyncio
 async def test_client_gets_server_info(monkeypatch) -> None:
     """Server info lookup returns the decoded registry payload."""
@@ -236,6 +251,21 @@ async def test_client_gets_server_info(monkeypatch) -> None:
     assert fake.last_url.endswith("/servers/github/versions/1.0.0")
 
 
+@pytest.mark.asyncio
+async def test_client_gets_server_info_with_tenant_header(monkeypatch) -> None:
+    """Tenant context for server detail lookup is sent as X-Tenant."""
+    fake = FakeHttpClient()
+    monkeypatch.setattr("lightnow_cli.client.httpx.AsyncClient", lambda: fake)
+
+    client = MCPRegistryClient(
+        base_url="https://registry-api.lightnow.local/v0.1", token="token"
+    )
+    await client.get_server_info("github", version="1.0.0", tenant="tenant-uuid")
+
+    assert fake.last_headers["X-Tenant"] == "tenant-uuid"
+    assert "tenant" not in fake.last_params
+
+
 @pytest.mark.asyncio
 async def test_client_encodes_registry_server_names(monkeypatch) -> None:
     """Registry server names with slashes are encoded in path parameters."""

{lightnow_cli-1.0.0 → lightnow_cli-1.0.2}/tests/test_integrations.py

@@ -173,6 +173,39 @@ def test_sync_defaults_to_plaintext_export_mode() -> None:
         assert fetch.call_args.kwargs["secret_mode"] == "plaintext"
 
 
+def test_sync_passes_tenant_to_export_request() -> None:
+    """Client export sync uses the selected organization context."""
+    runner = CliRunner()
+    with tempfile.TemporaryDirectory() as tmp:
+        target = Path(tmp) / "config.toml"
+        with (
+            patch(
+                "lightnow_cli.commands.integrations.require_access_token",
+                return_value="token",
+            ),
+            patch(
+                "lightnow_cli.commands.integrations.fetch_export",
+                return_value='[mcp_servers.github]\ncommand = "docker"\n',
+            ) as fetch,
+        ):
+            result = runner.invoke(
+                app,
+                [
+                    "sync",
+                    "--client",
+                    "codex",
+                    "--tenant",
+                    "acme",
+                    "--config-path",
+                    str(target),
+                ],
+                input="y\n",
+            )
+
+    assert result.exit_code == 0
+    assert fetch.call_args.kwargs["tenant"] == "acme"
+
+
 def test_sync_json_writes_manifest_and_preserves_user_config() -> None:
     """JSON sync stores the LightNow-owned aliases in a sibling manifest."""
     runner = CliRunner()
@@ -509,6 +542,51 @@ def test_sync_runner_dry_run_does_not_fetch_plaintext_export() -> None:
     assert not target.exists()
 
 
+def test_sync_runner_passes_tenant_to_profile_server_lookup() -> None:
+    """Runner sync builds organization-aware client commands from tenant profiles."""
+    runner = CliRunner()
+    with tempfile.TemporaryDirectory() as tmp:
+        target = Path(tmp) / "config.toml"
+        with (
+            patch(
+                "lightnow_cli.commands.integrations.require_access_token",
+                return_value="token",
+            ),
+            patch(
+                "lightnow_cli.commands.integrations.fetch_profile_servers",
+                return_value={
+                    "servers": [
+                        {
+                            "alias": "sonarqube",
+                            "server_name": "io.github.sonarsource/sonarqube-mcp-server",
+                            "version": "1.2.3",
+                            "status": "linked",
+                        }
+                    ]
+                },
+            ) as fetch_profile,
+        ):
+            result = runner.invoke(
+                app,
+                [
+                    "sync",
+                    "--client",
+                    "codex",
+                    "--tenant",
+                    "acme",
+                    "--runner",
+                    "--config-path",
+                    str(target),
+                    "--dry-run",
+                ],
+            )
+
+    assert result.exit_code == 0
+    assert fetch_profile.call_args.kwargs["tenant"] == "acme"
+    assert "--tenant" in result.stdout
+    assert "acme" in result.stdout
+
+
 def test_fetch_runtime_context_requests_local_runner_secret_context() -> None:
     """The runner asks for secret context with consumer=local-runner."""