lightnow-cli 1.0.1__tar.gz → 1.0.3__tar.gz

{lightnow_cli-1.0.1 → lightnow_cli-1.0.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lightnow-cli
-Version: 1.0.1
+Version: 1.0.3
 Summary: Official LightNow CLI for MCP registry discovery, client config sync, and local MCP runner workflows
 Project-URL: Homepage, https://github.com/lightnow-ai/lightnow-cli
 Project-URL: Repository, https://github.com/lightnow-ai/lightnow-cli

{lightnow_cli-1.0.1 → lightnow_cli-1.0.3}/lightnow_cli/__init__.py

@@ -1,3 +1,3 @@
 """LightNow CLI - A command-line tool for managing MCP servers."""
 
-__version__ = "1.0.1"
+__version__ = "1.0.3"

{lightnow_cli-1.0.1 → lightnow_cli-1.0.3}/lightnow_cli/client.py

@@ -151,8 +151,6 @@ class MCPRegistryClient:
             params["favorites"] = favorites
         if sort:
             params["sort"] = sort
-        if tenant:
-            params["tenant"] = tenant
         if cursor:
             params["cursor"] = cursor
 
@@ -163,6 +161,7 @@ class MCPRegistryClient:
                 params=params,
                 headers=self._get_headers(),
                 token=self.token,
+                tenant=tenant,
                 allow_refresh=self._refresh_on_unauthorized,
                 timeout=30.0,
             )
@@ -191,8 +190,6 @@ class MCPRegistryClient:
     ) -> Dict[str, Any]:
         """Get detailed information about a specific server."""
         params: Dict[str, Any] = {}
-        if tenant:
-            params["tenant"] = tenant
 
         encoded_server_id = quote(server_id, safe="")
         if version:
@@ -209,6 +206,7 @@ class MCPRegistryClient:
                 params=params,
                 headers=self._get_headers(),
                 token=self.token,
+                tenant=tenant,
                 allow_refresh=self._refresh_on_unauthorized,
                 timeout=30.0,
             )

{lightnow_cli-1.0.1 → lightnow_cli-1.0.3}/lightnow_cli/commands/auth.py

@@ -17,6 +17,7 @@ from typing_extensions import Annotated
 from ..config import (
     DEFAULT_CLIENT_ID,
     DEFAULT_ISSUER,
+    LOCAL_ADMIN_API_URL,
     LOCAL_ISSUER,
     LOCAL_REGISTRY_API_URL,
     config_manager,
@@ -380,12 +381,14 @@ def login(
         resolved_issuer = issuer or (LOCAL_ISSUER if local else DEFAULT_ISSUER)
         resolved_client_id = client_id or DEFAULT_CLIENT_ID
         resolved_registry_api_url = LOCAL_REGISTRY_API_URL if local else None
+        resolved_admin_api_url = LOCAL_ADMIN_API_URL if local else None
 
         # Store auth config
         config_manager.set_auth_config(
             resolved_issuer,
             resolved_client_id,
             resolved_registry_api_url,
+            resolved_admin_api_url,
         )
 
         # Perform device code flow
@@ -446,6 +449,8 @@ def status() -> None:
     if email:
         console.print(f"Email: [bold]{email}[/bold]")
 
+    console.print(f"Context: [bold]{config_manager.context_display_name()}[/bold]")
+
     exp = user_info.get("exp")
     if exp:
         exp_time = time.strftime("%Y-%m-%d %H:%M:%S UTC", time.gmtime(exp))

lightnow_cli-1.0.3/lightnow_cli/commands/context.py

@@ -0,0 +1,198 @@
+"""Context selection commands."""
+
+from __future__ import annotations
+
+from typing import Any, Optional
+
+import httpx
+import typer
+from rich.console import Console
+from rich.table import Table
+from typing_extensions import Annotated
+
+from ..authenticated_http import (
+    authentication_error_from_response,
+    request_with_refresh,
+)
+from ..config import config_manager
+from .auth import (
+    ACCESS_TOKEN_EXPIRED_MESSAGE,
+    AccessTokenExpired,
+    AuthError,
+    require_access_token,
+)
+
+console = Console()
+
+
+def context(
+    tenant: Annotated[
+        Optional[str],
+        typer.Option(
+            "--tenant",
+            help="Select an organization by exact tenant id or subdomain.",
+        ),
+    ] = None,
+    personal: Annotated[
+        bool,
+        typer.Option("--personal", help="Use the personal account context."),
+    ] = False,
+    show: Annotated[
+        bool,
+        typer.Option("--show", help="Show the currently stored context."),
+    ] = False,
+) -> None:
+    """Select the default LightNow context for context-aware commands."""
+    if personal and tenant:
+        console.print(
+            "[bold red]Context failed:[/bold red] choose --personal or --tenant."
+        )
+        raise typer.Exit(2)
+
+    if show:
+        show_current_context()
+        return
+
+    if personal:
+        config_manager.set_personal_context()
+        console.print("[green]Context set to Personal.[/green]")
+        return
+
+    try:
+        tenants = fetch_tenants()
+    except AccessTokenExpired:
+        console.print(f"[red]{ACCESS_TOKEN_EXPIRED_MESSAGE}[/red]")
+        raise typer.Exit(1)
+    except (AuthError, ValueError) as exc:
+        console.print(f"[bold red]Context failed:[/bold red] {exc}")
+        raise typer.Exit(1) from exc
+
+    if tenant:
+        selected = find_tenant(tenants, tenant)
+        if selected is None:
+            console.print(
+                "[bold red]Context failed:[/bold red] "
+                f"No organization matches '{tenant}'. Use 'lightnow context' "
+                "to choose from available organizations."
+            )
+            raise typer.Exit(1)
+        store_tenant_context(selected)
+        return
+
+    choose_interactively(tenants)
+
+
+def show_current_context() -> None:
+    """Print the currently stored context."""
+    config = config_manager.load_config()
+    table = Table(title="LightNow Context")
+    table.add_column("Scope", style="cyan")
+    table.add_column("Details", style="white")
+    if config.context_type == "tenant":
+        table.add_row(
+            "Organization", config.context_label or config.context_tenant or ""
+        )
+        if config.context_tenant:
+            table.add_row("Tenant ID", config.context_tenant)
+    else:
+        table.add_row("Personal", "Personal LightNow account")
+    console.print(table)
+
+
+def fetch_tenants() -> list[dict[str, Any]]:
+    """Fetch organizations available to the authenticated account."""
+    token = require_access_token()
+    config = config_manager.load_config()
+    admin_api_url = config.admin_api_url
+    if not admin_api_url:
+        raise ValueError("Admin API URL required. Run 'lightnow login' again.")
+
+    try:
+        response = request_with_refresh(
+            "GET",
+            f"{admin_api_url.rstrip('/')}/tenants",
+            token=token,
+            headers={"Accept": "application/json"},
+            timeout=30.0,
+        )
+    except httpx.RequestError as exc:
+        raise ValueError(f"Network error: {exc}") from exc
+
+    if response.status_code == 401:
+        raise authentication_error_from_response(response)
+    if response.status_code >= 400:
+        raise ValueError(f"HTTP {response.status_code}: {response.text}")
+
+    payload = response.json()
+    if not isinstance(payload, list):
+        raise ValueError("Admin API response did not include an organization list.")
+    return [item for item in payload if isinstance(item, dict)]
+
+
+def choose_interactively(tenants: list[dict[str, Any]]) -> None:
+    """Render choices and store the selected context."""
+    choices: list[tuple[str, Optional[dict[str, Any]]]] = [("Personal", None)]
+    choices.extend((tenant_label(item), item) for item in tenants)
+
+    console.print("[bold blue]Select LightNow context[/bold blue]")
+    for index, (label, item) in enumerate(choices, start=1):
+        suffix = ""
+        if item is not None:
+            role = text_value(item.get("role"))
+            plan = text_value(item.get("plan"))
+            details = " · ".join(value for value in [role, plan] if value)
+            suffix = f" ({details})" if details else ""
+        console.print(f"  {index}. {label}{suffix}")
+
+    selected = typer.prompt("Context", default=1)
+    try:
+        selected_index = int(str(selected).strip())
+    except ValueError as exc:
+        raise typer.BadParameter("Context must be a number from the list.") from exc
+
+    if selected_index < 1 or selected_index > len(choices):
+        raise typer.BadParameter("Context selection is out of range.")
+
+    _, item = choices[selected_index - 1]
+    if item is None:
+        config_manager.set_personal_context()
+        console.print("[green]Context set to Personal.[/green]")
+        return
+
+    store_tenant_context(item)
+
+
+def find_tenant(tenants: list[dict[str, Any]], value: str) -> Optional[dict[str, Any]]:
+    """Find a tenant by exact id or subdomain."""
+    for item in tenants:
+        tenant_id = text_value(item.get("id"))
+        subdomain = text_value(item.get("subdomain"))
+        if value in {tenant_id, subdomain}:
+            return item
+    return None
+
+
+def store_tenant_context(item: dict[str, Any]) -> None:
+    """Persist a selected tenant context."""
+    tenant_id = text_value(item.get("id"))
+    if not tenant_id:
+        raise ValueError("Selected organization has no tenant id.")
+    label = tenant_label(item)
+    config_manager.set_tenant_context(tenant_id, label)
+    console.print(f"[green]Context set to organization {label}.[/green]")
+
+
+def tenant_label(item: dict[str, Any]) -> str:
+    """Return a display label for one tenant."""
+    name = text_value(item.get("name"))
+    subdomain = text_value(item.get("subdomain"))
+    if name and subdomain:
+        return f"{name} ({subdomain})"
+    return name or subdomain or text_value(item.get("id")) or "Organization"
+
+
+def text_value(value: Any) -> str:
+    """Return a safe string value."""
+    if isinstance(value, str):
+        return value
+    return ""

{lightnow_cli-1.0.1 → lightnow_cli-1.0.3}/lightnow_cli/commands/integrations.py

@@ -121,6 +121,7 @@ def sync(
         console.print(f"[yellow]{exc}[/yellow]")
         raise typer.Exit(1)
 
+    effective_tenant = config_manager.effective_tenant(tenant)
     registry_api_url = api_url or config_manager.load_config().registry_api_url
     if not registry_api_url:
         raise_bad_argument(
@@ -133,7 +134,7 @@ def sync(
             profile_payload = fetch_profile_servers(
                 api_url=registry_api_url,
                 token=bearer_token,
-                tenant=tenant,
+                tenant=effective_tenant,
                 profile=profile,
             )
             generated = build_runner_export(
@@ -141,13 +142,13 @@ def sync(
                 client=client,
                 export_format=export_format,
                 profile=profile,
-                tenant=tenant,
+                tenant=effective_tenant,
             )
         else:
             generated = fetch_export(
                 api_url=registry_api_url,
                 token=bearer_token,
-                tenant=tenant,
+                tenant=effective_tenant,
                 profile=profile,
                 client=client,
                 export_format=export_format,

{lightnow_cli-1.0.1 → lightnow_cli-1.0.3}/lightnow_cli/commands/publish.py

@@ -9,6 +9,7 @@ from rich.console import Console
 from typing_extensions import Annotated
 
 from ..client import get_client
+from ..config import config_manager
 from ..validation import validate_artifacts
 
 console = Console()
@@ -74,6 +75,7 @@ def publish(
     try:
         # Get client and publish
         client = get_client()
+        effective_tenant = config_manager.effective_tenant(tenant)
         console.print("Publishing to registry...")
 
         result = asyncio.run(
@@ -81,7 +83,7 @@ def publish(
                 server_json=server_data,
                 docs_content=docs_content,
                 spec_content=spec_data,
-                tenant=tenant,
+                tenant=effective_tenant,
             )
         )
 

{lightnow_cli-1.0.1 → lightnow_cli-1.0.3}/lightnow_cli/commands/query.py

@@ -9,6 +9,7 @@ from rich.table import Table
 from typing_extensions import Annotated
 
 from ..client import get_client
+from ..config import config_manager
 
 console = Console()
 
@@ -43,11 +44,12 @@ def search_servers(
 
     try:
         client = get_client()
+        effective_tenant = config_manager.effective_tenant(tenant)
         result = asyncio.run(
             client.list_servers(
                 search=query,
                 sort=sort,
-                tenant=tenant,
+                tenant=effective_tenant,
                 limit=limit,
                 cursor=cursor,
             )
@@ -109,11 +111,12 @@ def favorite_servers(
 
     try:
         client = get_client()
+        effective_tenant = config_manager.effective_tenant(tenant)
         result = asyncio.run(
             client.list_servers(
                 favorites=normalized_scope,
                 sort=sort,
-                tenant=tenant,
+                tenant=effective_tenant,
                 limit=limit,
                 cursor=cursor,
             )
@@ -208,8 +211,13 @@ def server_info(
 
     try:
         client = get_client()
+        effective_tenant = config_manager.effective_tenant(tenant)
         result = asyncio.run(
-            client.get_server_info(server_id=server_id, version=version, tenant=tenant)
+            client.get_server_info(
+                server_id=server_id,
+                version=version,
+                tenant=effective_tenant,
+            )
         )
         payload = server_payload(result)
 

{lightnow_cli-1.0.1 → lightnow_cli-1.0.3}/lightnow_cli/commands/runner.py

@@ -62,6 +62,7 @@ def run(
     try:
         token = require_access_token()
         registry_api_url = api_url or config_manager.load_config().registry_api_url
+        effective_tenant = config_manager.effective_tenant(tenant)
         if not registry_api_url:
             raise ValueError(
                 "Registry API URL required. Configure the CLI or pass --api-url."
@@ -69,14 +70,14 @@ def run(
         selected = resolve_profile_server(
             api_url=registry_api_url,
             token=token,
-            tenant=tenant,
+            tenant=effective_tenant,
             profile=profile,
             server=server,
         )
         context = fetch_runtime_context(
             api_url=registry_api_url,
             token=token,
-            tenant=tenant,
+            tenant=effective_tenant,
             profile=profile,
             server_name=str(selected["server_name"]),
             version=str(selected["version"]),

{lightnow_cli-1.0.1 → lightnow_cli-1.0.3}/lightnow_cli/config.py

@@ -12,8 +12,10 @@ from pydantic import BaseModel, Field
 DEFAULT_ISSUER = "https://auth.lightnow.ai/realms/lightnow"
 DEFAULT_CLIENT_ID = "lightnow-cli"
 DEFAULT_REGISTRY_API_URL = "https://registry-api.lightnow.ai/v0.1"
+DEFAULT_ADMIN_API_URL = "https://admin-api.lightnow.ai/v0/portal"
 LOCAL_ISSUER = "https://auth.lightnow.local/realms/lightnow-local"
 LOCAL_REGISTRY_API_URL = "https://registry-api.lightnow.local/v0.1"
+LOCAL_ADMIN_API_URL = "https://admin-api.lightnow.local/v0/portal"
 
 
 class Config(BaseModel):
@@ -24,7 +26,11 @@ class Config(BaseModel):
     issuer: Optional[str] = Field(default=DEFAULT_ISSUER)
     client_id: Optional[str] = Field(default=DEFAULT_CLIENT_ID)
     registry_api_url: Optional[str] = Field(default=DEFAULT_REGISTRY_API_URL)
+    admin_api_url: Optional[str] = Field(default=DEFAULT_ADMIN_API_URL)
     user_info: Optional[Dict[str, Any]] = None
+    context_type: str = Field(default="personal")
+    context_tenant: Optional[str] = None
+    context_label: Optional[str] = None
 
 
 class ConfigManager:
@@ -127,11 +133,14 @@ class ConfigManager:
         self.save_config(config)
 
     def clear_token(self) -> None:
-        """Clear stored access token."""
+        """Clear stored access token and account-scoped context."""
         config = self.load_config()
         config.access_token = None
         config.refresh_token = None
         config.user_info = None
+        config.context_type = "personal"
+        config.context_tenant = None
+        config.context_label = None
         self.save_config(config)
 
     def set_auth_config(
@@ -139,14 +148,50 @@ class ConfigManager:
         issuer: str,
         client_id: str,
         registry_api_url: Optional[str] = None,
+        admin_api_url: Optional[str] = None,
     ) -> None:
         """Set authentication configuration."""
         config = self.load_config()
         config.issuer = issuer
         config.client_id = client_id
         config.registry_api_url = registry_api_url or DEFAULT_REGISTRY_API_URL
+        config.admin_api_url = admin_api_url or DEFAULT_ADMIN_API_URL
         self.save_config(config)
 
+    def set_personal_context(self) -> None:
+        """Use the personal LightNow context by default."""
+        config = self.load_config()
+        config.context_type = "personal"
+        config.context_tenant = None
+        config.context_label = None
+        self.save_config(config)
+
+    def set_tenant_context(self, tenant_id: str, label: str) -> None:
+        """Use a tenant context by default."""
+        if not tenant_id:
+            raise ValueError("Tenant context requires a tenant id.")
+        config = self.load_config()
+        config.context_type = "tenant"
+        config.context_tenant = tenant_id
+        config.context_label = label
+        self.save_config(config)
+
+    def effective_tenant(self, explicit_tenant: Optional[str] = None) -> Optional[str]:
+        """Return explicit tenant or the stored default tenant context."""
+        if explicit_tenant:
+            return explicit_tenant
+        config = self.load_config()
+        if config.context_type == "tenant":
+            return config.context_tenant
+        return None
+
+    def context_display_name(self) -> str:
+        """Return a human-readable current context label."""
+        config = self.load_config()
+        if config.context_type == "tenant":
+            return config.context_label or config.context_tenant or "Organization"
+        return "Personal"
+
 
 # Global config manager instance
 config_manager = ConfigManager()

{lightnow_cli-1.0.1 → lightnow_cli-1.0.3}/lightnow_cli/main.py

@@ -4,7 +4,7 @@ import typer
 from typing_extensions import Annotated
 
 from . import __version__
-from .commands import auth, integrations, publish, query, runner, validate
+from .commands import auth, context, integrations, publish, query, runner, validate
 from .tls import configure_tls_trust_store
 
 configure_tls_trust_store()
@@ -19,6 +19,7 @@ app.command("login")(auth.login)
 app.command("logout")(auth.logout)
 app.command("status")(auth.status)
 app.command("whoami")(auth.whoami)
+app.command("context")(context.context)
 app.command("publish")(publish.publish)
 app.command("search")(query.search_servers)
 app.command("favorites")(query.favorite_servers)

{lightnow_cli-1.0.1 → lightnow_cli-1.0.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "lightnow-cli"
-version = "1.0.1"
+version = "1.0.3"
 description = "Official LightNow CLI for MCP registry discovery, client config sync, and local MCP runner workflows"
 authors = [{name = "LightNow Team"}]
 license = {text = "Apache-2.0"}

{lightnow_cli-1.0.1 → lightnow_cli-1.0.3}/tests/test_cli.py

@@ -11,6 +11,7 @@ from typer.testing import CliRunner
 from lightnow_cli.config import (
     DEFAULT_CLIENT_ID,
     DEFAULT_ISSUER,
+    LOCAL_ADMIN_API_URL,
     LOCAL_ISSUER,
     LOCAL_REGISTRY_API_URL,
 )
@@ -51,7 +52,7 @@ def test_cli_version(runner):
     """Test CLI version command."""
     result = runner.invoke(app, ["--version"])
     assert result.exit_code == 0
-    assert "LightNow CLI 1.0.1" in result.stdout
+    assert "LightNow CLI 1.0.3" in result.stdout
 
 
 def test_cli_help(runner):
@@ -69,6 +70,7 @@ def test_cli_help(runner):
     assert "status" in result.stdout
     assert "logout" in result.stdout
     assert "whoami" in result.stdout
+    assert "context" in result.stdout
     assert "list" not in result.stdout
     assert "│ auth " not in result.stdout
     assert "│ integrations " not in result.stdout
@@ -91,6 +93,7 @@ def test_login_help_is_customer_friendly(runner):
         "logout",
         "status",
         "whoami",
+        "context",
         "publish",
         "search",
         "favorites",
@@ -175,6 +178,173 @@ def test_run_command_starts_profile_server(runner):
     assert run_process.call_args.kwargs["env"]["SONARQUBE_TOKEN"] == "secret"
 
 
+def test_run_command_passes_tenant_to_profile_and_context_requests(runner):
+    """The local runner keeps organization context for lookup and secret context."""
+    with (
+        patch(
+            "lightnow_cli.commands.runner.require_access_token",
+            return_value="token",
+        ),
+        patch(
+            "lightnow_cli.commands.runner.resolve_profile_server",
+            return_value={
+                "alias": "sonarqube",
+                "server_name": "io.github.sonarsource/sonarqube-mcp-server",
+                "version": "1.2.3",
+                "status": "linked",
+            },
+        ) as resolve,
+        patch(
+            "lightnow_cli.commands.runner.fetch_runtime_context",
+            return_value={"probe_request": {"transport": "stdio", "stdio": {}}},
+        ) as fetch_context,
+        patch(
+            "lightnow_cli.commands.runner.launch_config_from_context",
+            return_value=("python", ["-m", "server"], {}, None),
+        ),
+        patch(
+            "lightnow_cli.commands.runner.subprocess.run",
+            return_value=MagicMock(returncode=0),
+        ),
+    ):
+        result = runner.invoke(
+            app,
+            [
+                "run",
+                "--server",
+                "sonarqube",
+                "--profile",
+                "default",
+                "--tenant",
+                "acme",
+                "--api-url",
+                "https://registry-api.lightnow.local/v0.1",
+            ],
+        )
+
+    assert result.exit_code == 0
+    assert resolve.call_args.kwargs["tenant"] == "acme"
+    assert fetch_context.call_args.kwargs["tenant"] == "acme"
+
+
+def test_run_command_uses_stored_context(runner):
+    """The local runner uses the stored organization context by default."""
+    with (
+        patch(
+            "lightnow_cli.commands.runner.require_access_token",
+            return_value="token",
+        ),
+        patch(
+            "lightnow_cli.commands.runner.config_manager.effective_tenant",
+            return_value="tenant-uuid",
+        ),
+        patch(
+            "lightnow_cli.commands.runner.resolve_profile_server",
+            return_value={
+                "alias": "sonarqube",
+                "server_name": "io.github.sonarsource/sonarqube-mcp-server",
+                "version": "1.2.3",
+                "status": "linked",
+            },
+        ) as resolve,
+        patch(
+            "lightnow_cli.commands.runner.fetch_runtime_context",
+            return_value={"probe_request": {"transport": "stdio", "stdio": {}}},
+        ) as fetch_context,
+        patch(
+            "lightnow_cli.commands.runner.launch_config_from_context",
+            return_value=("python", ["-m", "server"], {}, None),
+        ),
+        patch(
+            "lightnow_cli.commands.runner.subprocess.run",
+            return_value=MagicMock(returncode=0),
+        ),
+    ):
+        result = runner.invoke(
+            app,
+            [
+                "run",
+                "--server",
+                "sonarqube",
+                "--profile",
+                "default",
+                "--api-url",
+                "https://registry-api.lightnow.local/v0.1",
+            ],
+        )
+
+    assert result.exit_code == 0
+    assert resolve.call_args.kwargs["tenant"] == "tenant-uuid"
+    assert fetch_context.call_args.kwargs["tenant"] == "tenant-uuid"
+
+
+def test_search_command_passes_tenant_context(runner):
+    """Search supports organization context from the public CLI surface."""
+    fake_client = MagicMock()
+    fake_client.list_servers = AsyncMock(return_value={"servers": []})
+
+    with patch("lightnow_cli.commands.query.get_client", return_value=fake_client):
+        result = runner.invoke(
+            app, ["search", "redis", "--tenant", "acme", "--limit", "5"]
+        )
+
+    assert result.exit_code == 0
+    assert fake_client.list_servers.call_args.kwargs["tenant"] == "acme"
+
+
+def test_search_command_uses_stored_context(runner):
+    """Search uses the stored context when --tenant is omitted."""
+    fake_client = MagicMock()
+    fake_client.list_servers = AsyncMock(return_value={"servers": []})
+
+    with (
+        patch("lightnow_cli.commands.query.get_client", return_value=fake_client),
+        patch(
+            "lightnow_cli.commands.query.config_manager.effective_tenant",
+            return_value="tenant-uuid",
+        ) as effective_tenant,
+    ):
+        result = runner.invoke(app, ["search", "redis"])
+
+    assert result.exit_code == 0
+    effective_tenant.assert_called_once_with(None)
+    assert fake_client.list_servers.call_args.kwargs["tenant"] == "tenant-uuid"
+
+
+def test_favorites_command_passes_tenant_context(runner):
+    """Favorites supports organization-scoped favorites from the CLI."""
+    fake_client = MagicMock()
+    fake_client.list_servers = AsyncMock(return_value={"servers": []})
+
+    with patch("lightnow_cli.commands.query.get_client", return_value=fake_client):
+        result = runner.invoke(
+            app, ["favorites", "--scope", "tenant", "--tenant", "acme"]
+        )
+
+    assert result.exit_code == 0
+    assert fake_client.list_servers.call_args.kwargs["favorites"] == "tenant"
+    assert fake_client.list_servers.call_args.kwargs["tenant"] == "acme"
+
+
+def test_info_command_passes_tenant_context(runner):
+    """Server info supports organization context from the public CLI surface."""
+    fake_client = MagicMock()
+    fake_client.get_server_info = AsyncMock(
+        return_value={
+            "name": "io.github.test/server",
+            "version": "1.0.0",
+        }
+    )
+
+    with patch("lightnow_cli.commands.query.get_client", return_value=fake_client):
+        result = runner.invoke(
+            app, ["info", "io.github.test/server", "--tenant", "acme"]
+        )
+
+    assert result.exit_code == 0
+    assert fake_client.get_server_info.call_args.kwargs["tenant"] == "acme"
+
+
 def test_run_command_reports_expired_token(runner):
     """Runner commands use the shared expired-token message."""
     from lightnow_cli.commands.auth import (
@@ -304,7 +474,7 @@ def test_login_command_success(
 
     # Verify mocks were called
     mock_set_auth_config.assert_called_once_with(
-        DEFAULT_ISSUER, DEFAULT_CLIENT_ID, None
+        DEFAULT_ISSUER, DEFAULT_CLIENT_ID, None, None
     )
     mock_device_flow.assert_called_once_with(DEFAULT_ISSUER, DEFAULT_CLIENT_ID)
     mock_fetch_user_info.assert_called_once_with(DEFAULT_ISSUER, "mock-access-token")
@@ -333,6 +503,7 @@ def test_login_command_local_profile(
         LOCAL_ISSUER,
         DEFAULT_CLIENT_ID,
         LOCAL_REGISTRY_API_URL,
+        LOCAL_ADMIN_API_URL,
     )
     mock_device_flow.assert_called_once_with(LOCAL_ISSUER, DEFAULT_CLIENT_ID)
     mock_fetch_user_info.assert_called_once_with(LOCAL_ISSUER, "mock-access-token")

{lightnow_cli-1.0.1 → lightnow_cli-1.0.3}/tests/test_client.py

@@ -221,6 +221,21 @@ async def test_client_lists_servers(monkeypatch) -> None:
     assert fake.last_params["cursor"] == "cursor-token"
 
 
+@pytest.mark.asyncio
+async def test_client_lists_servers_with_tenant_header(monkeypatch) -> None:
+    """Tenant context for list queries is sent as X-Tenant, not as a query param."""
+    fake = FakeHttpClient()
+    monkeypatch.setattr("lightnow_cli.client.httpx.AsyncClient", lambda: fake)
+
+    client = MCPRegistryClient(
+        base_url="https://registry-api.lightnow.local/v0.1", token="token"
+    )
+    await client.list_servers(favorites="tenant", tenant="tenant-uuid")
+
+    assert fake.last_headers["X-Tenant"] == "tenant-uuid"
+    assert "tenant" not in fake.last_params
+
+
 @pytest.mark.asyncio
 async def test_client_gets_server_info(monkeypatch) -> None:
     """Server info lookup returns the decoded registry payload."""
@@ -236,6 +251,21 @@ async def test_client_gets_server_info(monkeypatch) -> None:
     assert fake.last_url.endswith("/servers/github/versions/1.0.0")
 
 
+@pytest.mark.asyncio
+async def test_client_gets_server_info_with_tenant_header(monkeypatch) -> None:
+    """Tenant context for server detail lookup is sent as X-Tenant."""
+    fake = FakeHttpClient()
+    monkeypatch.setattr("lightnow_cli.client.httpx.AsyncClient", lambda: fake)
+
+    client = MCPRegistryClient(
+        base_url="https://registry-api.lightnow.local/v0.1", token="token"
+    )
+    await client.get_server_info("github", version="1.0.0", tenant="tenant-uuid")
+
+    assert fake.last_headers["X-Tenant"] == "tenant-uuid"
+    assert "tenant" not in fake.last_params
+
+
 @pytest.mark.asyncio
 async def test_client_encodes_registry_server_names(monkeypatch) -> None:
     """Registry server names with slashes are encoded in path parameters."""

{lightnow_cli-1.0.1 → lightnow_cli-1.0.3}/tests/test_config.py

@@ -7,6 +7,7 @@ from pathlib import Path
 import pytest
 
 from lightnow_cli.config import (
+    DEFAULT_ADMIN_API_URL,
     DEFAULT_CLIENT_ID,
     DEFAULT_ISSUER,
     DEFAULT_REGISTRY_API_URL,
@@ -48,6 +49,9 @@ def test_load_default_config(config_manager):
     assert config.issuer == DEFAULT_ISSUER
     assert config.client_id == DEFAULT_CLIENT_ID
     assert config.registry_api_url == DEFAULT_REGISTRY_API_URL
+    assert config.admin_api_url == DEFAULT_ADMIN_API_URL
+    assert config.context_type == "personal"
+    assert config.context_tenant is None
 
 
 def test_save_and_load_config(config_manager):
@@ -120,20 +124,54 @@ def test_auth_config_methods(config_manager):
     assert config.issuer == "https://auth.example.com"
     assert config.client_id == "my-client"
     assert config.registry_api_url == DEFAULT_REGISTRY_API_URL
+    assert config.admin_api_url == DEFAULT_ADMIN_API_URL
 
 
-def test_auth_config_accepts_registry_api_override(config_manager):
-    """Local auth can persist the matching local Registry API URL."""
+def test_auth_config_accepts_api_overrides(config_manager):
+    """Local auth can persist matching local API URLs."""
     config_manager.set_auth_config(
         "https://auth.example.com",
         "my-client",
         "https://registry-api.example.com/v0.1",
+        "https://admin-api.example.com/v0/portal",
     )
 
     config = config_manager.load_config()
     assert config.issuer == "https://auth.example.com"
     assert config.client_id == "my-client"
     assert config.registry_api_url == "https://registry-api.example.com/v0.1"
+    assert config.admin_api_url == "https://admin-api.example.com/v0/portal"
+
+
+def test_context_methods(config_manager):
+    """Stored context controls default tenant headers."""
+    assert config_manager.effective_tenant() is None
+    assert config_manager.context_display_name() == "Personal"
+
+    config_manager.set_tenant_context("tenant-uuid", "Acme (acme)")
+
+    assert config_manager.effective_tenant() == "tenant-uuid"
+    assert config_manager.effective_tenant("explicit-tenant") == "explicit-tenant"
+    assert config_manager.context_display_name() == "Acme (acme)"
+
+    config_manager.set_personal_context()
+
+    assert config_manager.effective_tenant() is None
+    assert config_manager.context_display_name() == "Personal"
+
+
+def test_logout_clears_context(config_manager):
+    """Logging out removes account-scoped organization context."""
+    config_manager.set_token("token", "refresh", None)
+    config_manager.set_tenant_context("tenant-uuid", "Acme (acme)")
+
+    config_manager.clear_token()
+
+    config = config_manager.load_config()
+    assert config.access_token is None
+    assert config.refresh_token is None
+    assert config.context_type == "personal"
+    assert config.context_tenant is None
 
 
 def test_config_file_permissions(config_manager):

lightnow_cli-1.0.3/tests/test_context.py

@@ -0,0 +1,190 @@
+"""Tests for LightNow context selection."""
+
+from __future__ import annotations
+
+from unittest.mock import MagicMock, patch
+
+from typer.testing import CliRunner
+
+from lightnow_cli.config import Config
+from lightnow_cli.main import app
+
+
+class FakeResponse:
+    """Small response stub for context API tests."""
+
+    def __init__(self, status_code: int, payload: object, text: str = "") -> None:
+        self.status_code = status_code
+        self._payload = payload
+        self.text = text
+
+    def json(self) -> object:
+        return self._payload
+
+
+def test_context_show_displays_personal_context() -> None:
+    """The default context is Personal."""
+    runner = CliRunner()
+
+    with patch(
+        "lightnow_cli.commands.context.config_manager.load_config",
+        return_value=Config(),
+    ):
+        result = runner.invoke(app, ["context", "--show"])
+
+    assert result.exit_code == 0
+    assert "Personal" in result.stdout
+
+
+def test_context_personal_stores_personal_context() -> None:
+    """Users can switch back to personal context explicitly."""
+    runner = CliRunner()
+
+    with patch(
+        "lightnow_cli.commands.context.config_manager.set_personal_context"
+    ) as set_personal:
+        result = runner.invoke(app, ["context", "--personal"])
+
+    assert result.exit_code == 0
+    set_personal.assert_called_once_with()
+    assert "Context set to Personal" in result.stdout
+
+
+def test_context_tenant_resolves_subdomain_and_stores_tenant_id() -> None:
+    """Tenant subdomains are resolved once and stored as tenant IDs."""
+    runner = CliRunner()
+    response = FakeResponse(
+        200,
+        [
+            {
+                "id": "tenant-uuid",
+                "name": "Acme Inc.",
+                "subdomain": "acme",
+                "role": "owner",
+                "plan": "enterprise",
+            }
+        ],
+    )
+
+    with (
+        patch(
+            "lightnow_cli.commands.context.require_access_token", return_value="token"
+        ),
+        patch(
+            "lightnow_cli.commands.context.config_manager.load_config",
+            return_value=Config(
+                admin_api_url="https://admin-api.example.com/v0/portal"
+            ),
+        ),
+        patch(
+            "lightnow_cli.commands.context.request_with_refresh", return_value=response
+        ) as request,
+        patch(
+            "lightnow_cli.commands.context.config_manager.set_tenant_context"
+        ) as set_tenant,
+    ):
+        result = runner.invoke(app, ["context", "--tenant", "acme"])
+
+    assert result.exit_code == 0
+    request.assert_called_once()
+    assert request.call_args.args[:2] == (
+        "GET",
+        "https://admin-api.example.com/v0/portal/tenants",
+    )
+    set_tenant.assert_called_once_with("tenant-uuid", "Acme Inc. (acme)")
+    assert "Context set to organization Acme Inc. (acme)" in result.stdout
+
+
+def test_context_unknown_tenant_fails_without_changing_context() -> None:
+    """Unknown tenants fail explicitly."""
+    runner = CliRunner()
+    response = FakeResponse(
+        200,
+        [{"id": "tenant-uuid", "name": "Acme Inc.", "subdomain": "acme"}],
+    )
+
+    with (
+        patch(
+            "lightnow_cli.commands.context.require_access_token", return_value="token"
+        ),
+        patch(
+            "lightnow_cli.commands.context.config_manager.load_config",
+            return_value=Config(
+                admin_api_url="https://admin-api.example.com/v0/portal"
+            ),
+        ),
+        patch(
+            "lightnow_cli.commands.context.request_with_refresh", return_value=response
+        ),
+        patch(
+            "lightnow_cli.commands.context.config_manager.set_tenant_context"
+        ) as set_tenant,
+    ):
+        result = runner.invoke(app, ["context", "--tenant", "missing"])
+
+    assert result.exit_code == 1
+    set_tenant.assert_not_called()
+    assert "No organization matches 'missing'" in result.stdout
+
+
+def test_context_interactive_choice_stores_selected_tenant() -> None:
+    """Interactive context selection stores the chosen organization."""
+    runner = CliRunner()
+    response = FakeResponse(
+        200,
+        [
+            {"id": "tenant-uuid", "name": "Acme Inc.", "subdomain": "acme"},
+        ],
+    )
+
+    with (
+        patch(
+            "lightnow_cli.commands.context.require_access_token", return_value="token"
+        ),
+        patch(
+            "lightnow_cli.commands.context.config_manager.load_config",
+            return_value=Config(
+                admin_api_url="https://admin-api.example.com/v0/portal"
+            ),
+        ),
+        patch(
+            "lightnow_cli.commands.context.request_with_refresh", return_value=response
+        ),
+        patch(
+            "lightnow_cli.commands.context.config_manager.set_tenant_context"
+        ) as set_tenant,
+    ):
+        result = runner.invoke(app, ["context"], input="2\n")
+
+    assert result.exit_code == 0
+    set_tenant.assert_called_once_with("tenant-uuid", "Acme Inc. (acme)")
+
+
+def test_context_api_401_uses_authentication_error() -> None:
+    """Tenant listing uses the shared auth error path."""
+    runner = CliRunner()
+    response = MagicMock()
+    response.status_code = 401
+
+    with (
+        patch(
+            "lightnow_cli.commands.context.require_access_token", return_value="token"
+        ),
+        patch(
+            "lightnow_cli.commands.context.config_manager.load_config",
+            return_value=Config(
+                admin_api_url="https://admin-api.example.com/v0/portal"
+            ),
+        ),
+        patch(
+            "lightnow_cli.commands.context.request_with_refresh", return_value=response
+        ),
+        patch(
+            "lightnow_cli.commands.context.authentication_error_from_response",
+            side_effect=ValueError("unauthorized"),
+        ),
+    ):
+        result = runner.invoke(app, ["context", "--tenant", "acme"])
+
+    assert result.exit_code == 1
+    assert "Context failed" in result.stdout

{lightnow_cli-1.0.1 → lightnow_cli-1.0.3}/tests/test_integrations.py

@@ -173,6 +173,74 @@ def test_sync_defaults_to_plaintext_export_mode() -> None:
         assert fetch.call_args.kwargs["secret_mode"] == "plaintext"
 
 
+def test_sync_passes_tenant_to_export_request() -> None:
+    """Client export sync uses the selected organization context."""
+    runner = CliRunner()
+    with tempfile.TemporaryDirectory() as tmp:
+        target = Path(tmp) / "config.toml"
+        with (
+            patch(
+                "lightnow_cli.commands.integrations.require_access_token",
+                return_value="token",
+            ),
+            patch(
+                "lightnow_cli.commands.integrations.fetch_export",
+                return_value='[mcp_servers.github]\ncommand = "docker"\n',
+            ) as fetch,
+        ):
+            result = runner.invoke(
+                app,
+                [
+                    "sync",
+                    "--client",
+                    "codex",
+                    "--tenant",
+                    "acme",
+                    "--config-path",
+                    str(target),
+                ],
+                input="y\n",
+            )
+
+    assert result.exit_code == 0
+    assert fetch.call_args.kwargs["tenant"] == "acme"
+
+
+def test_sync_uses_stored_context_when_tenant_is_omitted() -> None:
+    """Client export sync uses the stored organization context by default."""
+    runner = CliRunner()
+    with tempfile.TemporaryDirectory() as tmp:
+        target = Path(tmp) / "config.toml"
+        with (
+            patch(
+                "lightnow_cli.commands.integrations.require_access_token",
+                return_value="token",
+            ),
+            patch(
+                "lightnow_cli.commands.integrations.config_manager.effective_tenant",
+                return_value="tenant-uuid",
+            ),
+            patch(
+                "lightnow_cli.commands.integrations.fetch_export",
+                return_value='[mcp_servers.github]\ncommand = "docker"\n',
+            ) as fetch,
+        ):
+            result = runner.invoke(
+                app,
+                [
+                    "sync",
+                    "--client",
+                    "codex",
+                    "--config-path",
+                    str(target),
+                ],
+                input="y\n",
+            )
+
+    assert result.exit_code == 0
+    assert fetch.call_args.kwargs["tenant"] == "tenant-uuid"
+
+
 def test_sync_json_writes_manifest_and_preserves_user_config() -> None:
     """JSON sync stores the LightNow-owned aliases in a sibling manifest."""
     runner = CliRunner()
@@ -509,6 +577,98 @@ def test_sync_runner_dry_run_does_not_fetch_plaintext_export() -> None:
     assert not target.exists()
 
 
+def test_sync_runner_passes_tenant_to_profile_server_lookup() -> None:
+    """Runner sync builds organization-aware client commands from tenant profiles."""
+    runner = CliRunner()
+    with tempfile.TemporaryDirectory() as tmp:
+        target = Path(tmp) / "config.toml"
+        with (
+            patch(
+                "lightnow_cli.commands.integrations.require_access_token",
+                return_value="token",
+            ),
+            patch(
+                "lightnow_cli.commands.integrations.fetch_profile_servers",
+                return_value={
+                    "servers": [
+                        {
+                            "alias": "sonarqube",
+                            "server_name": "io.github.sonarsource/sonarqube-mcp-server",
+                            "version": "1.2.3",
+                            "status": "linked",
+                        }
+                    ]
+                },
+            ) as fetch_profile,
+        ):
+            result = runner.invoke(
+                app,
+                [
+                    "sync",
+                    "--client",
+                    "codex",
+                    "--tenant",
+                    "acme",
+                    "--runner",
+                    "--config-path",
+                    str(target),
+                    "--dry-run",
+                ],
+            )
+
+    assert result.exit_code == 0
+    assert fetch_profile.call_args.kwargs["tenant"] == "acme"
+    assert "--tenant" in result.stdout
+    assert "acme" in result.stdout
+
+
+def test_sync_runner_uses_stored_context_in_generated_wrappers() -> None:
+    """Runner sync embeds the stored organization context in client wrappers."""
+    runner = CliRunner()
+    with tempfile.TemporaryDirectory() as tmp:
+        target = Path(tmp) / "config.toml"
+        with (
+            patch(
+                "lightnow_cli.commands.integrations.require_access_token",
+                return_value="token",
+            ),
+            patch(
+                "lightnow_cli.commands.integrations.config_manager.effective_tenant",
+                return_value="tenant-uuid",
+            ),
+            patch(
+                "lightnow_cli.commands.integrations.fetch_profile_servers",
+                return_value={
+                    "servers": [
+                        {
+                            "alias": "sonarqube",
+                            "server_name": "io.github.sonarsource/sonarqube-mcp-server",
+                            "version": "1.2.3",
+                            "status": "linked",
+                        }
+                    ]
+                },
+            ) as fetch_profile,
+        ):
+            result = runner.invoke(
+                app,
+                [
+                    "sync",
+                    "--client",
+                    "codex",
+                    "--runner",
+                    "--config-path",
+                    str(target),
+                    "--dry-run",
+                ],
+            )
+
+    assert result.exit_code == 0
+    assert fetch_profile.call_args.kwargs["tenant"] == "tenant-uuid"
+    assert "--tenant" in result.stdout
+    assert "tenant-uuid" in result.stdout
+
+
 def test_fetch_runtime_context_requests_local_runner_secret_context() -> None:
     """The runner asks for secret context with consumer=local-runner."""