lightnow-cli 1.0.4__tar.gz → 1.1.0__tar.gz

lightnow_cli-1.1.0/.github/workflows/release-please.yml

@@ -0,0 +1,24 @@
+name: Release Please
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    name: Open or tag release PR
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Run Release Please
+        uses: googleapis/release-please-action@v4
+        with:
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json

lightnow_cli-1.1.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "1.1.0"
+}

{lightnow_cli-1.0.4 → lightnow_cli-1.1.0}/CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to the LightNow CLI are documented here.
 
 This project follows semantic versioning.
 
+## [1.1.0](https://github.com/lightnow-ai/lightnow-cli/compare/v1.0.5...v1.1.0) (2026-07-07)
+
+
+### Features
+
+* add whoami json output ([9eab480](https://github.com/lightnow-ai/lightnow-cli/commit/9eab480b85765fa50506f4d7126790c2a3ebd094))
+
+
+### Bug Fixes
+
+* **#2:** fix import wizard client configs ([ae0f0b4](https://github.com/lightnow-ai/lightnow-cli/commit/ae0f0b4931dcb1516be65473df3ca73397d6c16e))
+* support wizard client config imports ([35a7347](https://github.com/lightnow-ai/lightnow-cli/commit/35a7347fa438af6e4d9fb754f87a7a5d6a709548))
+* write default local proxy config alias ([47223f6](https://github.com/lightnow-ai/lightnow-cli/commit/47223f62b96ef0790d027ada11abf84459eb63fb))
+
 ## 1.0.0 - Unreleased
 
 Initial stable release candidate.

{lightnow_cli-1.0.4 → lightnow_cli-1.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lightnow-cli
-Version: 1.0.4
+Version: 1.1.0
 Summary: Official LightNow CLI for MCP registry discovery, client config sync, and local MCP runner workflows
 Project-URL: Homepage, https://github.com/lightnow-ai/lightnow-cli
 Project-URL: Repository, https://github.com/lightnow-ai/lightnow-cli
@@ -38,6 +38,8 @@ Requires-Dist: pytest-mock>=3.10.0; extra == 'dev'
 Requires-Dist: pytest>=7.0.0; extra == 'dev'
 Requires-Dist: responses>=0.23.0; extra == 'dev'
 Requires-Dist: twine>=5.0.0; extra == 'dev'
+Requires-Dist: types-jsonschema>=4.25.0; extra == 'dev'
+Requires-Dist: types-pyyaml>=6.0.12; extra == 'dev'
 Description-Content-Type: text/markdown
 
 # LightNow CLI
@@ -170,6 +172,10 @@ Let LightNow choose the configured organization policy for a client:
 lightnow sync --client codex --from-settings
 ```
 
+When LightNow Config blocks unmanaged MCP servers, managed clients keep only the
+`LightNow` entry. When unmanaged servers are allowed, existing user-managed MCP
+entries stay in the client config and `config-status` reports `mixed`.
+
 Check whether a client is configured as expected:
 
 ```bash

{lightnow_cli-1.0.4 → lightnow_cli-1.1.0}/README.md

@@ -128,6 +128,10 @@ Let LightNow choose the configured organization policy for a client:
 lightnow sync --client codex --from-settings
 ```
 
+When LightNow Config blocks unmanaged MCP servers, managed clients keep only the
+`LightNow` entry. When unmanaged servers are allowed, existing user-managed MCP
+entries stay in the client config and `config-status` reports `mixed`.
+
 Check whether a client is configured as expected:
 
 ```bash

{lightnow_cli-1.0.4 → lightnow_cli-1.1.0}/docs/development.md

@@ -55,13 +55,28 @@ lightnow config-status --client antigravity --json
 
 Expected states:
 
-- `managed`: only the LightNow Local Proxy entry is configured.
+- `managed`: the LightNow Local Proxy entry is configured and no unmanaged
+  user MCP servers are present. Client-internal MCP entries may be reported
+  separately as `internal_servers`.
 - `mixed`: LightNow Local Proxy exists, but unmanaged MCP entries are also
-  present.
+  present. This is acceptable when LightNow Config allows unmanaged client
+  servers, but those entries bypass LightNow monitoring and policy.
 - `unmanaged`: MCP entries exist, but none point at the LightNow Local Proxy.
 - `legacy_runner`: older per-server `lightnow run` wrappers are still present.
 - `missing`, `invalid` or `unreadable`: the client config cannot be used as-is.
 
+For settings-driven rollout, `lightnow sync --client <client> --from-settings`
+uses the tenant policy. Managed clients remove unmanaged MCP entries only when
+`allowUnmanagedClientServers` is false. If the policy allows unmanaged entries,
+sync preserves them and the posture remains `mixed`.
+
+When a Local Proxy config exists, `config-status` also reads the non-secret
+runtime posture from that file: selected profile, client identity, client
+transport, telemetry flag, policy mode, and whether unmanaged client MCP
+servers are allowed. If policy mode is `enforce`, unmanaged entries are blocked
+by policy, and the client config still contains unmanaged MCP servers, the
+command reports `policy_blocks_unmanaged_servers`.
+
 The command must not print secrets, headers or payloads. It is the local building
 block for future UI-led enablement and enterprise posture reporting.
 

{lightnow_cli-1.0.4 → lightnow_cli-1.1.0}/docs/release.md

@@ -11,7 +11,31 @@ Use these settings for the public repository:
 
 ## Checklist
 
-Before publishing a release:
+Release Please owns normal version bumps, changelog updates, Git tags, and
+GitHub Releases from Conventional Commits.
+
+Required GitHub setup:
+
+- Repository secret: `RELEASE_PLEASE_TOKEN`
+- Token permissions: contents, pull requests, and issues read/write for this
+  repository
+- Repository Actions setting: allow GitHub Actions to create pull requests
+
+Use a real PAT or GitHub App token for `RELEASE_PLEASE_TOKEN`, not the default
+`GITHUB_TOKEN`. Tags created with the default token do not trigger the existing
+tag-based `Release` workflow, so PyPI publishing would not run.
+
+Normal release flow:
+
+1. Merge Conventional Commit changes to `main`.
+2. Release Please opens or updates a release PR.
+3. Merge the release PR when ready.
+4. Release Please creates the `vX.Y.Z` tag and GitHub Release.
+5. The existing tag-based `Release` workflow builds and publishes PyPI
+   distributions through Trusted Publishing.
+6. Update the Homebrew tap after the release artifact is available.
+
+Manual release checklist for fallback or first-time setup:
 
 1. Update `pyproject.toml` and `lightnow_cli/__init__.py` to the same
    semantic version.

{lightnow_cli-1.0.4 → lightnow_cli-1.1.0}/lightnow_cli/__init__.py

@@ -1,3 +1,3 @@
 """LightNow CLI - A command-line tool for managing MCP servers."""
 
-__version__ = "1.0.4"
+__version__ = "1.1.0"  # x-release-please-version

{lightnow_cli-1.0.4 → lightnow_cli-1.1.0}/lightnow_cli/commands/auth.py

@@ -3,6 +3,7 @@
 import asyncio
 import base64
 import hashlib
+import json
 import secrets
 import time
 import webbrowser
@@ -457,10 +458,19 @@ def status() -> None:
         console.print(f"Token expires: [dim]{exp_time}[/dim]")
 
 
-def whoami() -> None:
+def whoami(
+    json_output: Annotated[
+        bool,
+        typer.Option("--json", help="Print machine-readable identity JSON"),
+    ] = False,
+) -> None:
     """Show current user information."""
     user_info = current_user_info()
 
+    if json_output:
+        typer.echo(json.dumps(user_info, indent=2, sort_keys=True))
+        return
+
     # Display user information
     console.print("[bold blue]Current User Information:[/bold blue]")
 
@@ -488,6 +498,14 @@ def whoami() -> None:
 
 def current_user_info() -> Dict[str, Any]:
     """Return current user info after verifying or refreshing the access token."""
+
+    def fallback_claims_or_exit(token_value: str, exc: AuthError) -> Dict[str, Any]:
+        claims = get_user_info(token_value)
+        if claims is not None and claims.get("sub"):
+            return claims
+        console.print(f"[red]{exc}[/red]")
+        raise typer.Exit(1) from exc
+
     try:
         token = require_access_token()
     except AccessTokenExpired as exc:
@@ -504,16 +522,17 @@ def current_user_info() -> Dict[str, Any]:
         try:
             token = refresh_current_session()
             config = config_manager.load_config()
-            return asyncio.run(fetch_user_info(config.issuer or DEFAULT_ISSUER, token))
+            try:
+                return asyncio.run(
+                    fetch_user_info(config.issuer or DEFAULT_ISSUER, token)
+                )
+            except AuthError as exc:
+                return fallback_claims_or_exit(token, exc)
         except AccessTokenExpired as exc:
             console.print(f"[red]{exc}[/red]")
             raise typer.Exit(1) from exc
-        except AuthError as exc:
-            console.print(f"[red]{exc}[/red]")
-            raise typer.Exit(1) from exc
     except AuthError as exc:
-        console.print(f"[red]{exc}[/red]")
-        raise typer.Exit(1) from exc
+        return fallback_claims_or_exit(token, exc)
 
 
 def logout() -> None:

{lightnow_cli-1.0.4 → lightnow_cli-1.1.0}/lightnow_cli/commands/integrations.py

@@ -82,6 +82,14 @@ CLIENT_DEFAULTS: dict[str, tuple[str, Path]] = {
 }
 
 CLIENTS = sorted(CLIENT_DEFAULTS)
+IMPORT_CLIENTS = {
+    "antigravity",
+    "claude-code",
+    "claude-desktop",
+    "codex",
+    "cursor",
+    "vscode",
+}
 SECRET_MODES = ["placeholder", "plaintext"]
 LOCAL_PROXY_MCP_SERVERS_JSON_CLIENTS = {
     "antigravity",
@@ -99,7 +107,9 @@ LOCAL_LIGHTNOW_CA_RELATIVE_PATH = Path(".local-runtime/certs/lightnow-local-ca.c
 LOCAL_PROXY_EXECUTABLE = "lightnow-proxy"
 LEGACY_LOCAL_PROXY_EXECUTABLE = "mcp-proxy"
 LIGHTNOW_PROXY_ALIASES = {"lightnow", "LightNow"}
-LOCAL_PROXY_RUNNER_VERSION = "0.1.2"
+CLIENT_INTERNAL_MCP_SERVERS = {
+    "codex": {"node_repl"},
+}
 VSCODE_VIRTUAL_TOOLS_THRESHOLD_SETTING = "github.copilot.chat.virtualTools.threshold"
 VSCODE_VIRTUAL_TOOLS_THRESHOLD = 128
 LOCAL_PROXY_STDIO_SUPPORT_MESSAGE = (
@@ -122,6 +132,27 @@ def default_local_proxy_config_path(client: str) -> Path:
     return DEFAULT_LOCAL_PROXY_CONFIG_DIR / f"{safe_client}.yaml"
 
 
+def default_local_proxy_profile_config_path(profile: str = "default") -> Path:
+    """Return the profile-level Local Proxy config path used by proxy defaults."""
+    safe_profile = re.sub(r"[^A-Za-z0-9_.-]+", "-", profile).strip("-") or "default"
+    return DEFAULT_LOCAL_PROXY_CONFIG_DIR / f"{safe_profile}.yaml"
+
+
+def local_proxy_default_config_alias(
+    *,
+    profile: str,
+    explicit_config_path: Optional[Path],
+    proxy_target: Path,
+) -> Optional[Path]:
+    """Return the default health-check alias path that should mirror a sync."""
+    if explicit_config_path is not None or profile != "default":
+        return None
+    alias = default_local_proxy_profile_config_path(profile).expanduser()
+    if alias == proxy_target.expanduser():
+        return None
+    return alias
+
+
 def discover_local_lightnow_ca_file(registry_api_url: str) -> Optional[Path]:
     """Find the local LightNow CA for local development Registry API URLs."""
     parsed = urlparse(registry_api_url)
@@ -323,8 +354,11 @@ def sync(
     proxy_target = (
         local_proxy_config_path or default_local_proxy_config_path(client)
     ).expanduser()
+    proxy_default_alias: Optional[Path] = None
     settings_local_proxy_summary: dict[str, Any] = {}
     removed_direct_servers: list[str] = []
+    remove_unmanaged_client_servers = local_proxy
+    policy_managed_sync = False
 
     try:
         if from_settings:
@@ -345,6 +379,10 @@ def sync(
             )
             if local_proxy_settings.get("enabled") is True and client_is_managed:
                 local_proxy = True
+                policy_managed_sync = True
+                remove_unmanaged_client_servers = (
+                    local_proxy_settings.get("allowUnmanagedClientServers") is False
+                )
                 configured_profile = local_proxy_settings.get("profile")
                 if isinstance(configured_profile, str) and configured_profile:
                     profile = configured_profile
@@ -352,6 +390,11 @@ def sync(
                 profile = str(settings_payload["defaultProfile"])
 
         if local_proxy:
+            proxy_default_alias = local_proxy_default_config_alias(
+                profile=profile,
+                explicit_config_path=local_proxy_config_path,
+                proxy_target=proxy_target,
+            )
             generated = build_local_proxy_export(
                 client=client,
                 export_format=export_format,
@@ -402,12 +445,18 @@ def sync(
             if export_format == "json"
             else {"aliases": [], "input_ids": []}
         )
-        if local_proxy:
+        if local_proxy and remove_unmanaged_client_servers:
             removed_direct_servers = direct_server_aliases(existing, export_format)
-        if local_proxy and client == "codex" and export_format == "toml":
+        if (
+            local_proxy
+            and remove_unmanaged_client_servers
+            and client == "codex"
+            and export_format == "toml"
+        ):
             existing = prepare_codex_local_proxy_config(existing)
         if (
             local_proxy
+            and remove_unmanaged_client_servers
             and client in LOCAL_PROXY_JSON_CLIENTS
             and export_format == "json"
         ):
@@ -442,6 +491,10 @@ def sync(
             err_console.print(
                 f"[cyan]Would write Local Proxy config: {proxy_target}[/cyan]"
             )
+            if proxy_default_alias is not None:
+                err_console.print(
+                    f"[cyan]Would update default Local Proxy config: {proxy_default_alias}[/cyan]"
+                )
             if removed_direct_servers:
                 err_console.print(
                     "[yellow]Would remove direct MCP server entries:[/yellow] "
@@ -468,7 +521,7 @@ def sync(
             console.print("[yellow]Canceled.[/yellow]")
             raise typer.Exit(1)
 
-    if local_proxy and removed_direct_servers and not yes:
+    if local_proxy and removed_direct_servers and not yes and not policy_managed_sync:
         console.print(
             f"[yellow]Local Proxy Mode removes direct MCP server entries from {target}:[/yellow] "
             f"{', '.join(removed_direct_servers)}"
@@ -487,6 +540,11 @@ def sync(
     if local_proxy:
         secure_write_text(proxy_target, proxy_config)
         console.print(f"[green]Wrote Local Proxy config to {proxy_target}[/green]")
+        if proxy_default_alias is not None:
+            secure_write_text(proxy_default_alias, proxy_config)
+            console.print(
+                f"[green]Updated default Local Proxy config at {proxy_default_alias}[/green]"
+            )
         if client == "claude-code":
             warm_local_proxy_tools_cache(proxy_target)
 
@@ -517,6 +575,10 @@ def sync(
                 console.print(
                     "[cyan]LightNow policy is enforce: managed clients should keep only the Local Proxy MCP entry.[/cyan]"
                 )
+            if settings_local_proxy_summary.get("allowUnmanagedClientServers") is False:
+                console.print(
+                    "[cyan]LightNow policy blocks unmanaged MCP servers for this client config.[/cyan]"
+                )
         console.print(
             f"[cyan]Next: restart {client} so it picks up the LightNow MCP entry.[/cyan]"
         )
@@ -598,9 +660,10 @@ def import_config(
     if client not in CLIENT_DEFAULTS:
         raise_bad_argument("Unsupported client", f"Use one of: {', '.join(CLIENTS)}")
     _, default_path = CLIENT_DEFAULTS[client]
-    if client != "codex":
+    if client not in IMPORT_CLIENTS:
         raise_bad_argument(
-            "Unsupported import client", "Config import currently supports Codex."
+            "Unsupported import client",
+            f"Config import supports: {', '.join(sorted(IMPORT_CLIENTS))}.",
         )
 
     target = (config_path or default_path).expanduser()
@@ -858,7 +921,6 @@ def build_local_proxy_config(
         "client_name": client,
         "client_version": None,
         "runner_name": "lightnow-local-proxy",
-        "runner_version": LOCAL_PROXY_RUNNER_VERSION,
         "client_transport": (
             "streamable-http" if local_proxy_transport == "http" else "stdio"
         ),
@@ -1330,9 +1392,11 @@ def analyze_client_config_content(
     local_proxy_aliases: list[str] = []
     local_proxy_commands: list[str] = []
     legacy_runner_servers: list[str] = []
+    internal_servers: list[str] = []
     unmanaged_servers: list[str] = []
     proxy_config_path = str(expected_proxy_config_path.expanduser())
     warnings: list[str] = []
+    client_internal_servers = CLIENT_INTERNAL_MCP_SERVERS.get(client, set())
     for alias, entry in entries.items():
         raw_command = entry.get("command")
         command: str = raw_command if isinstance(raw_command, str) else ""
@@ -1362,6 +1426,9 @@ def analyze_client_config_content(
         if is_lightnow_runner:
             legacy_runner_servers.append(alias)
             continue
+        if alias in client_internal_servers:
+            internal_servers.append(alias)
+            continue
         unmanaged_servers.append(alias)
 
     if local_proxy_aliases and not unmanaged_servers and not legacy_runner_servers:
@@ -1384,6 +1451,7 @@ def analyze_client_config_content(
         "local_proxy_present": bool(local_proxy_aliases),
         "local_proxy_aliases": sorted(local_proxy_aliases),
         "local_proxy_commands": sorted(set(local_proxy_commands)),
+        "internal_servers": sorted(internal_servers),
         "unmanaged_servers": sorted(unmanaged_servers),
         "legacy_runner_servers": sorted(legacy_runner_servers),
         "warnings": sorted(set(warnings)),
@@ -1394,7 +1462,10 @@ def augment_local_proxy_posture(status: dict[str, Any]) -> dict[str, Any]:
     """Add Local Proxy runtime checks (config file, lightnow-proxy binary) to a posture."""
     warnings = [str(item) for item in status.get("warnings", [])]
     expected_path = status.get("expected_proxy_config_path")
-    proxy_config_exists = bool(expected_path) and Path(str(expected_path)).exists()
+    proxy_config_path = Path(str(expected_path)).expanduser() if expected_path else None
+    proxy_config_exists = False
+    if proxy_config_path is not None:
+        proxy_config_exists = proxy_config_path.exists()
     proxy_commands = [
         str(item) for item in status.get("local_proxy_commands", []) if str(item)
     ]
@@ -1409,6 +1480,39 @@ def augment_local_proxy_posture(status: dict[str, Any]) -> dict[str, Any]:
     if status.get("local_proxy_present"):
         if not proxy_config_exists:
             warnings.append("proxy_config_missing")
+        elif proxy_config_path is not None:
+            try:
+                raw_proxy_config = yaml.safe_load(proxy_config_path.read_text()) or {}
+            except yaml.YAMLError as exc:
+                warnings.append(f"proxy_config_invalid:{exc.__class__.__name__}")
+                raw_proxy_config = {}
+            except OSError as exc:
+                warnings.append(f"proxy_config_read_failed:{exc.__class__.__name__}")
+                raw_proxy_config = {}
+            if isinstance(raw_proxy_config, dict):
+                local_proxy = raw_proxy_config.get("local_proxy")
+                if isinstance(local_proxy, dict):
+                    client_name = local_proxy.get("client_name")
+                    status["local_proxy_profile"] = local_proxy.get("profile")
+                    status["local_proxy_client_name"] = client_name
+                    status["local_proxy_client_transport"] = local_proxy.get(
+                        "client_transport"
+                    )
+                    status["local_proxy_telemetry_enabled"] = local_proxy.get(
+                        "telemetry_enabled"
+                    )
+                    status["local_proxy_policy_mode"] = local_proxy.get("policy_mode")
+                    status["local_proxy_allow_unmanaged_client_servers"] = (
+                        local_proxy.get("allow_unmanaged_client_servers")
+                    )
+                    if client_name and str(client_name) != str(status.get("client")):
+                        warnings.append("proxy_config_client_mismatch")
+                    if (
+                        status.get("status") == "mixed"
+                        and local_proxy.get("policy_mode") == "enforce"
+                        and local_proxy.get("allow_unmanaged_client_servers") is False
+                    ):
+                        warnings.append("policy_blocks_unmanaged_servers")
         if not proxy_command_available:
             if proxy_commands and all(
                 "/" in command or "\\" in command for command in proxy_commands
@@ -1506,6 +1610,14 @@ def warning_hint(code: str, client: str) -> Optional[str]:
             "the LightNow entry points at a different Local Proxy config; "
             f"re-run `{sync_command}` to update it."
         ),
+        "proxy_config_client_mismatch": (
+            "the Local Proxy config belongs to a different client; "
+            f"re-run `{sync_command}` for this client."
+        ),
+        "policy_blocks_unmanaged_servers": (
+            "LightNow policy is set to enforce and unmanaged MCP servers are still present; "
+            f"re-run `{sync_command}` or remove the unmanaged entries."
+        ),
     }
     return hints.get(code)
 
@@ -1558,6 +1670,15 @@ def print_config_status(status: dict[str, Any], path: Path) -> None:
         exists = status.get("proxy_config_exists")
         suffix = "" if exists is None else (" (present)" if exists else " (missing)")
         console.print(f"Local Proxy config: {expected_path}{suffix}")
+    proxy_profile = status.get("local_proxy_profile")
+    if proxy_profile:
+        policy_mode = status.get("local_proxy_policy_mode") or "observe"
+        allow_unmanaged = status.get("local_proxy_allow_unmanaged_client_servers")
+        unmanaged_label = "allowed" if allow_unmanaged is not False else "blocked"
+        console.print(
+            "LightNow policy: "
+            f"profile={proxy_profile}, mode={policy_mode}, unmanaged={unmanaged_label}"
+        )
     unmanaged = status.get("unmanaged_servers")
     if isinstance(unmanaged, list) and unmanaged:
         console.print(

{lightnow_cli-1.0.4 → lightnow_cli-1.1.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "lightnow-cli"
-version = "1.0.4"
+version = "1.1.0"
 description = "Official LightNow CLI for MCP registry discovery, client config sync, and local MCP runner workflows"
 authors = [{name = "LightNow Team"}]
 license = {text = "Apache-2.0"}
@@ -45,6 +45,8 @@ dev = [
     "isort>=5.12.0",
     "flake8>=6.0.0",
     "mypy>=1.0.0",
+    "types-jsonschema>=4.25.0",
+    "types-PyYAML>=6.0.12",
     "twine>=5.0.0",
 ]
 

lightnow_cli-1.1.0/release-please-config.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "packages": {
+    ".": {
+      "release-type": "python",
+      "package-name": "lightnow-cli",
+      "changelog-path": "CHANGELOG.md",
+      "include-component-in-tag": false,
+      "include-v-in-tag": true,
+      "extra-files": [
+        {
+          "type": "generic",
+          "path": "lightnow_cli/__init__.py"
+        }
+      ]
+    }
+  }
+}

{lightnow_cli-1.0.4 → lightnow_cli-1.1.0}/tests/test_auth_flow.py

@@ -379,3 +379,26 @@ def test_current_user_info_retries_userinfo_after_refresh(monkeypatch) -> None:
 
     assert auth.current_user_info()["email"] == "test@lightnow.local"
     assert calls == ["old-access-token", "new-access-token"]
+
+
+def test_current_user_info_falls_back_to_token_claims_when_userinfo_rejects(
+    monkeypatch,
+) -> None:
+    """Whoami/status can still display identity when the issuer rejects userinfo."""
+    token = (
+        "eyJhbGciOiJub25lIn0."
+        "eyJzdWIiOiIxMjMiLCJlbWFpbCI6InRlc3RAbGlnaHRub3cubG9jYWwiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ0ZXN0IiwiZXhwIjo5OTk5OTk5OTk5fQ."
+    )
+    config = Config(access_token=token)
+
+    async def fetch(_: str, __: str) -> dict[str, str]:
+        raise auth.AuthError("Failed to fetch user information: HTTP 403")
+
+    monkeypatch.setattr(auth.config_manager, "load_config", lambda: config)
+    monkeypatch.setattr(auth, "require_access_token", lambda: token)
+    monkeypatch.setattr(auth, "fetch_user_info", fetch)
+
+    user_info = auth.current_user_info()
+
+    assert user_info["sub"] == "123"
+    assert user_info["email"] == "test@lightnow.local"

{lightnow_cli-1.0.4 → lightnow_cli-1.1.0}/tests/test_cli.py

@@ -8,6 +8,7 @@ from unittest.mock import AsyncMock, MagicMock, patch
 import pytest
 from typer.testing import CliRunner
 
+from lightnow_cli import __version__
 from lightnow_cli.config import (
     DEFAULT_CLIENT_ID,
     DEFAULT_ISSUER,
@@ -52,7 +53,7 @@ def test_cli_version(runner):
     """Test CLI version command."""
     result = runner.invoke(app, ["--version"])
     assert result.exit_code == 0
-    assert "LightNow CLI 1.0.4" in result.stdout
+    assert f"LightNow CLI {__version__}" in result.stdout
 
 
 def test_cli_help(runner):
@@ -582,6 +583,36 @@ def test_whoami_command_authenticated(mock_fetch_user_info, mock_load_config, ru
     assert "openid" not in result.stdout
 
 
+@patch("lightnow_cli.config.config_manager.load_config")
+@patch("lightnow_cli.commands.auth.fetch_user_info")
+def test_whoami_command_json(mock_fetch_user_info, mock_load_config, runner):
+    """Whoami can emit machine-readable identity details."""
+    mock_config = MagicMock()
+    mock_config.access_token = (
+        "eyJhbGciOiJub25lIn0." "eyJzdWIiOiIxMjMiLCJleHAiOjk5OTk5OTk5OTl9."
+    )
+    mock_config.refresh_token = None
+    mock_config.issuer = DEFAULT_ISSUER
+    mock_fetch_user_info.return_value = {
+        "email": "test@example.com",
+        "name": "Test User",
+        "preferred_username": "test",
+        "sub": "123456",
+    }
+    mock_load_config.return_value = mock_config
+
+    result = runner.invoke(app, ["whoami", "--json"])
+
+    assert result.exit_code == 0
+    assert json.loads(result.stdout) == {
+        "email": "test@example.com",
+        "name": "Test User",
+        "preferred_username": "test",
+        "sub": "123456",
+    }
+    assert "Current User Information" not in result.stdout
+
+
 @patch("lightnow_cli.commands.auth.config_manager.clear_token")
 def test_logout_command(mock_clear_token, runner):
     """Test logout clears the stored token."""

{lightnow_cli-1.0.4 → lightnow_cli-1.1.0}/tests/test_integrations.py

@@ -7,6 +7,7 @@ from pathlib import Path
 from unittest.mock import patch
 
 import httpx
+import pytest
 import yaml
 from typer.testing import CliRunner
 
@@ -18,6 +19,7 @@ from lightnow_cli.commands.auth import (
 from lightnow_cli.commands.integrations import (
     BEGIN,
     END,
+    IMPORT_CLIENTS,
     JSON_MANIFEST_SUFFIX,
     analyze_client_config_content,
     analyze_client_config_file,
@@ -26,6 +28,7 @@ from lightnow_cli.commands.integrations import (
     build_runner_export,
     configure_vscode_virtual_tools,
     default_local_proxy_config_path,
+    default_local_proxy_profile_config_path,
     discover_local_lightnow_ca_file,
     extract_json_managed,
     fetch_export,
@@ -36,6 +39,7 @@ from lightnow_cli.commands.integrations import (
     prepare_json_local_proxy_config,
     print_import_summary,
     redact,
+    render_local_proxy_codex_stdio_toml,
     render_local_proxy_codex_toml,
     render_runner_config,
     secure_write_text,
@@ -498,6 +502,15 @@ def test_default_local_proxy_config_path_is_client_specific() -> None:
     )
 
 
+def test_default_local_proxy_profile_config_path_is_profile_specific() -> None:
+    """The proxy health default is keyed by profile, not by MCP client."""
+    assert default_local_proxy_profile_config_path("default").name == "default.yaml"
+    assert (
+        default_local_proxy_profile_config_path("Engineering Team").name
+        == "Engineering-Team.yaml"
+    )
+
+
 def test_analyzes_managed_codex_local_proxy_config() -> None:
     """Posture scanner recognizes a clean Local Proxy config."""
     status = analyze_client_config_content(
@@ -512,6 +525,34 @@ def test_analyzes_managed_codex_local_proxy_config() -> None:
     assert status["unmanaged_servers"] == []
 
 
+def test_analyzes_codex_local_proxy_with_internal_node_repl_as_managed() -> None:
+    """Codex may add internal MCP plumbing that should not be reported as bypass drift."""
+    content = (
+        render_local_proxy_codex_stdio_toml(Path("/tmp/lightnow/codex.yaml")) + """
+
+[mcp_servers.node_repl]
+command = "/Applications/Codex.app/Contents/Resources/cua_node/bin/node_repl"
+args = []
+startup_timeout_sec = 120
+
+[mcp_servers.node_repl.env]
+CODEX_HOME = "/Users/example/.codex"
+"""
+    )
+
+    status = analyze_client_config_content(
+        client="codex",
+        export_format="toml",
+        content=content,
+        expected_proxy_config_path=Path("/tmp/lightnow/codex.yaml"),
+    )
+
+    assert status["status"] == "managed"
+    assert status["local_proxy_aliases"] == ["lightnow"]
+    assert status["internal_servers"] == ["node_repl"]
+    assert status["unmanaged_servers"] == []
+
+
 def test_analyzes_mixed_json_config_with_unmanaged_servers() -> None:
     """Posture scanner reports bypassable client config entries."""
     content = json.dumps(
@@ -1089,7 +1130,6 @@ def test_sync_local_proxy_replaces_existing_codex_mcp_servers() -> None:
         "client_name": "codex",
         "client_version": None,
         "runner_name": "lightnow-local-proxy",
-        "runner_version": "0.1.2",
         "client_transport": "stdio",
     }
     assert proxy_payload["registry_api"]["use_cli_session"] is True
@@ -1098,6 +1138,50 @@ def test_sync_local_proxy_replaces_existing_codex_mcp_servers() -> None:
     assert proxy_payload["upstreams"] == {}
 
 
+def test_sync_local_proxy_updates_default_profile_config_alias() -> None:
+    """Default-profile sync also updates the config path used by lightnow-proxy --health."""
+    runner = CliRunner()
+    with tempfile.TemporaryDirectory() as tmp:
+        target = Path(tmp) / "config.toml"
+        proxy_config = Path(tmp) / "codex.yaml"
+        default_config = Path(tmp) / "default.yaml"
+        with (
+            patch(
+                "lightnow_cli.commands.integrations.require_access_token",
+                return_value="token",
+            ),
+            patch(
+                "lightnow_cli.commands.integrations.default_local_proxy_config_path",
+                return_value=proxy_config,
+            ),
+            patch(
+                "lightnow_cli.commands.integrations.default_local_proxy_profile_config_path",
+                return_value=default_config,
+            ),
+        ):
+            result = runner.invoke(
+                app,
+                [
+                    "sync",
+                    "--client",
+                    "codex",
+                    "--local-proxy",
+                    "--yes",
+                    "--config-path",
+                    str(target),
+                ],
+            )
+            proxy_exists = proxy_config.exists()
+            default_exists = default_config.exists()
+            configs_match = default_config.read_text() == proxy_config.read_text()
+
+    assert result.exit_code == 0
+    assert proxy_exists
+    assert default_exists
+    assert configs_match
+    assert "Updated default Local Proxy config" in result.stdout
+
+
 def test_sync_local_proxy_replaces_existing_claude_desktop_mcp_servers() -> None:
     """Claude Desktop Local Proxy sync leaves one LightNow MCP server entry."""
     runner = CliRunner()
@@ -1565,6 +1649,118 @@ def test_sync_from_settings_uses_local_proxy_policy() -> None:
     assert "policy is enforce" in result.stdout
 
 
+def test_sync_from_settings_blocks_unmanaged_servers_without_prompt() -> None:
+    """Enterprise block policy removes unmanaged client MCP entries non-interactively."""
+    runner = CliRunner()
+    with tempfile.TemporaryDirectory() as tmp:
+        target = Path(tmp) / "config.toml"
+        proxy_config = Path(tmp) / "codex-proxy.yaml"
+        target.write_text("""
+[mcp_servers.github]
+command = "docker"
+
+[mcp_servers.github.env]
+GITHUB_TOKEN = "secret"
+""".lstrip())
+        with (
+            patch(
+                "lightnow_cli.commands.integrations.require_access_token",
+                return_value="token",
+            ),
+            patch(
+                "lightnow_cli.commands.integrations.fetch_integration_settings",
+                return_value={
+                    "defaultProfile": "default",
+                    "localProxy": {
+                        "enabled": True,
+                        "profile": "engineering",
+                        "managedClients": ["codex"],
+                        "allowUnmanagedClientServers": False,
+                        "telemetryEnabled": True,
+                        "policyMode": "enforce",
+                    },
+                },
+            ),
+        ):
+            result = runner.invoke(
+                app,
+                [
+                    "sync",
+                    "--client",
+                    "codex",
+                    "--from-settings",
+                    "--config-path",
+                    str(target),
+                    "--local-proxy-config-path",
+                    str(proxy_config),
+                ],
+            )
+
+        patched = target.read_text()
+
+    assert result.exit_code == 0
+    assert "[mcp_servers.lightnow]" in patched
+    assert "[mcp_servers.github]" not in patched
+    assert "GITHUB_TOKEN" not in patched
+    assert "LightNow policy blocks unmanaged MCP servers" in result.stdout
+    assert "Removed direct MCP server entries" in result.stdout
+
+
+def test_sync_from_settings_allows_unmanaged_servers_when_policy_allows() -> None:
+    """Enterprise allow policy keeps existing user-managed MCP entries."""
+    runner = CliRunner()
+    with tempfile.TemporaryDirectory() as tmp:
+        target = Path(tmp) / "config.toml"
+        proxy_config = Path(tmp) / "codex-proxy.yaml"
+        target.write_text("""
+[mcp_servers.github]
+command = "docker"
+args = ["run", "github-mcp"]
+""".lstrip())
+        with (
+            patch(
+                "lightnow_cli.commands.integrations.require_access_token",
+                return_value="token",
+            ),
+            patch(
+                "lightnow_cli.commands.integrations.fetch_integration_settings",
+                return_value={
+                    "defaultProfile": "default",
+                    "localProxy": {
+                        "enabled": True,
+                        "profile": "engineering",
+                        "managedClients": ["codex"],
+                        "allowUnmanagedClientServers": True,
+                        "telemetryEnabled": True,
+                        "policyMode": "observe",
+                    },
+                },
+            ),
+        ):
+            result = runner.invoke(
+                app,
+                [
+                    "sync",
+                    "--client",
+                    "codex",
+                    "--from-settings",
+                    "--config-path",
+                    str(target),
+                    "--local-proxy-config-path",
+                    str(proxy_config),
+                ],
+            )
+
+        patched = target.read_text()
+
+    assert result.exit_code == 0
+    assert "[mcp_servers.lightnow]" in patched
+    assert "[mcp_servers.github]" in patched
+    assert "Client config posture: mixed" in result.stdout
+    assert "Unmanaged MCP servers" in result.stdout
+    assert "Removed direct MCP server entries" not in result.stdout
+
+
 def test_sync_from_settings_uses_direct_export_for_unmanaged_client() -> None:
     """Settings-driven sync leaves clients outside managedClients on direct config."""
     runner = CliRunner()
@@ -2420,6 +2616,81 @@ def test_import_config_command_prints_only_redacted_summary() -> None:
     importer.assert_called_once()
 
 
+@pytest.mark.parametrize(
+    "client, filename",
+    [
+        ("antigravity", "mcp_config.json"),
+        ("claude-code", "claude.json"),
+        ("claude-desktop", "claude_desktop_config.json"),
+        ("cursor", "mcp.json"),
+        ("vscode", "mcp.json"),
+    ],
+)
+def test_import_config_command_accepts_wizard_clients(
+    client: str, filename: str
+) -> None:
+    """Wizard clients can import their existing JSON MCP config."""
+    runner = CliRunner()
+    with tempfile.TemporaryDirectory() as tmp:
+        target = Path(tmp) / filename
+        target.write_text('{"mcpServers":{"github":{"command":"docker"}}}')
+        with (
+            patch(
+                "lightnow_cli.commands.integrations.require_access_token",
+                return_value="token",
+            ),
+            patch(
+                "lightnow_cli.commands.integrations.import_profile_config",
+                return_value={
+                    "dry_run": True,
+                    "profile": {"name": "default"},
+                    "summary": {
+                        "total": 1,
+                        "mapped": 1,
+                        "custom": 0,
+                        "importable": 1,
+                        "blocked": 0,
+                    },
+                    "servers": [
+                        {
+                            "alias": "github",
+                            "status": "mapped",
+                            "server_name": "io.github.github/github-mcp-server",
+                        }
+                    ],
+                },
+            ) as importer,
+        ):
+            result = runner.invoke(
+                app,
+                [
+                    "import-config",
+                    "--client",
+                    client,
+                    "--config-path",
+                    str(target),
+                    "--dry-run",
+                ],
+            )
+
+    assert result.exit_code == 0
+    assert "Previewed" in result.stdout
+    importer.assert_called_once()
+    assert importer.call_args.kwargs["source"] == client
+    assert client in IMPORT_CLIENTS
+
+
+def test_import_config_command_rejects_non_wizard_clients() -> None:
+    """Import stays limited to clients that the onboarding wizard supports."""
+    runner = CliRunner()
+    result = runner.invoke(app, ["import-config", "--client", "gemini-cli"])
+
+    assert result.exit_code != 0
+    assert "Unsupported import client" in result.stdout
+    assert "antigravity" in result.stdout
+    assert "gemini-cli" not in result.stdout.split("Config import supports:", 1)[-1]
+
+
 def test_fetch_export_refreshes_and_retries_after_unauthorized() -> None:
     """Export requests share the central refresh-and-retry path."""
 
@@ -2946,6 +3217,72 @@ def test_config_status_reports_missing_absolute_proxy_command() -> None:
     assert payload["warnings"] == ["lightnow_proxy_command_missing"]
 
 
+def test_config_status_reports_local_proxy_policy_from_proxy_config() -> None:
+    """Posture includes the managed policy state without exposing secrets."""
+    runner = CliRunner()
+    with tempfile.TemporaryDirectory() as tmp:
+        proxy_config = Path(tmp) / "proxy.yaml"
+        proxy_config.write_text(
+            yaml.safe_dump(
+                {
+                    "local_proxy": {
+                        "profile": "engineering",
+                        "client_name": "claude-desktop",
+                        "client_transport": "stdio",
+                        "telemetry_enabled": True,
+                        "policy_mode": "enforce",
+                        "allow_unmanaged_client_servers": False,
+                    }
+                }
+            )
+        )
+        target = Path(tmp) / "mcp.json"
+        target.write_text(
+            json.dumps(
+                {
+                    "mcpServers": {
+                        "LightNow": {
+                            "command": "lightnow-proxy",
+                            "args": [
+                                "--config",
+                                str(proxy_config),
+                                "--transport",
+                                "stdio",
+                            ],
+                        },
+                        "github": {"command": "docker"},
+                    }
+                }
+            )
+        )
+        with patch(
+            "lightnow_cli.commands.integrations.shutil.which",
+            return_value="/usr/local/bin/lightnow-proxy",
+        ):
+            result = runner.invoke(
+                app,
+                [
+                    "config-status",
+                    "--client",
+                    "claude-desktop",
+                    "--config-path",
+                    str(target),
+                    "--local-proxy-config-path",
+                    str(proxy_config),
+                    "--json",
+                ],
+            )
+
+    assert result.exit_code == 0
+    payload = json.loads(result.stdout)
+    assert payload["status"] == "mixed"
+    assert payload["local_proxy_profile"] == "engineering"
+    assert payload["local_proxy_policy_mode"] == "enforce"
+    assert payload["local_proxy_allow_unmanaged_client_servers"] is False
+    assert payload["local_proxy_telemetry_enabled"] is True
+    assert "policy_blocks_unmanaged_servers" in payload["warnings"]
+
+
 def test_config_status_prints_next_step_for_unmanaged_config() -> None:
     """Human posture output tells lazy users the exact next command."""
     runner = CliRunner()