lightnow-cli 1.1.0__tar.gz → 1.2.0__tar.gz

lightnow_cli-1.2.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "1.2.0"
+}

{lightnow_cli-1.1.0 → lightnow_cli-1.2.0}/CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to the LightNow CLI are documented here.
 
 This project follows semantic versioning.
 
+## [1.2.0](https://github.com/lightnow-ai/lightnow-cli/compare/v1.1.0...v1.2.0) (2026-07-12)
+
+
+### Features
+
+* **#5:** support runtime Vault bindings ([7750c27](https://github.com/lightnow-ai/lightnow-cli/commit/7750c27b87567012eadb6e96a934a25d5d205b0e))
+* **secrets:** support runtime Vault bindings ([7cacff6](https://github.com/lightnow-ai/lightnow-cli/commit/7cacff66c162c1c320fef5195c6acd0f3a77ca45))
+
+
+### Bug Fixes
+
+* **#4:** fix/empty mcp server sync ([a2865bf](https://github.com/lightnow-ai/lightnow-cli/commit/a2865bf21ba7fba7b7bb7115388ad45f153c3280))
+* **sync:** handle empty MCP server profiles ([065d940](https://github.com/lightnow-ai/lightnow-cli/commit/065d940ea0d7a4016705a8fb124ebdc07d204a7f))
+
 ## [1.1.0](https://github.com/lightnow-ai/lightnow-cli/compare/v1.0.5...v1.1.0) (2026-07-07)
 
 

{lightnow_cli-1.1.0 → lightnow_cli-1.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lightnow-cli
-Version: 1.1.0
+Version: 1.2.0
 Summary: Official LightNow CLI for MCP registry discovery, client config sync, and local MCP runner workflows
 Project-URL: Homepage, https://github.com/lightnow-ai/lightnow-cli
 Project-URL: Repository, https://github.com/lightnow-ai/lightnow-cli
@@ -40,6 +40,8 @@ Requires-Dist: responses>=0.23.0; extra == 'dev'
 Requires-Dist: twine>=5.0.0; extra == 'dev'
 Requires-Dist: types-jsonschema>=4.25.0; extra == 'dev'
 Requires-Dist: types-pyyaml>=6.0.12; extra == 'dev'
+Provides-Extra: keyring
+Requires-Dist: keyring>=25.6.0; extra == 'keyring'
 Description-Content-Type: text/markdown
 
 # LightNow CLI

{lightnow_cli-1.1.0 → lightnow_cli-1.2.0}/lightnow_cli/__init__.py

@@ -1,3 +1,3 @@
 """LightNow CLI - A command-line tool for managing MCP servers."""
 
-__version__ = "1.1.0"  # x-release-please-version
+__version__ = "1.2.0"  # x-release-please-version

{lightnow_cli-1.1.0 → lightnow_cli-1.2.0}/lightnow_cli/commands/integrations.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import json
 import os
 import re
+import shlex
 import shutil
 import subprocess
 import sys
@@ -222,6 +223,70 @@ def direct_server_aliases(content: str, export_format: str) -> list[str]:
     return sorted(alias for alias in entries if alias not in LIGHTNOW_PROXY_ALIASES)
 
 
+def json_server_maps_are_empty(content: str) -> bool:
+    """Return whether a JSON export contains only empty server maps."""
+    payload = json.loads(content)
+    if not isinstance(payload, dict):
+        return False
+    sections = [payload[key] for key in ("mcpServers", "servers") if key in payload]
+    return bool(sections) and all(
+        isinstance(section, dict) and not section for section in sections
+    )
+
+
+def empty_profile_import_command(
+    *,
+    client: str,
+    profile: str,
+    target: Path,
+    tenant: Optional[str],
+    api_url: Optional[str],
+) -> str:
+    """Build a copyable command that previews importing an existing client config."""
+    args = [
+        "lightnow",
+        "import-config",
+        "--client",
+        client,
+        "--profile",
+        profile,
+        "--config-path",
+        str(target),
+        "--dry-run",
+    ]
+    if tenant:
+        args.extend(["--tenant", tenant])
+    if api_url:
+        args.extend(["--api-url", api_url])
+    return shlex.join(args)
+
+
+def print_empty_profile_import_hint(
+    *,
+    client: str,
+    profile: str,
+    target: Path,
+    aliases: list[str],
+    tenant: Optional[str],
+    api_url: Optional[str],
+) -> None:
+    """Explain that existing client servers were preserved and can be imported."""
+    err_console.print(
+        f"[yellow]LightNow profile {profile} has no MCP servers, but {client} already "
+        f"configures: {', '.join(aliases)}. These existing client entries were kept.[/yellow]"
+    )
+    command = empty_profile_import_command(
+        client=client,
+        profile=profile,
+        target=target,
+        tenant=tenant,
+        api_url=api_url,
+    )
+    err_console.print(
+        f"[cyan]To preview importing them into LightNow, run:[/cyan] {command}"
+    )
+
+
 @app.command("sync")
 def sync(
     client: Annotated[str, typer.Option("--client", help="Target MCP client")],
@@ -357,6 +422,7 @@ def sync(
     proxy_default_alias: Optional[Path] = None
     settings_local_proxy_summary: dict[str, Any] = {}
     removed_direct_servers: list[str] = []
+    empty_profile_existing_aliases: list[str] = []
     remove_unmanaged_client_servers = local_proxy
     policy_managed_sync = False
 
@@ -413,6 +479,7 @@ def sync(
                 local_proxy_settings=(
                     settings_local_proxy_summary if from_settings else None
                 ),
+                runtime_secrets=read_local_runtime_secrets(proxy_target),
             )
         elif runner:
             profile_payload = fetch_profile_servers(
@@ -468,6 +535,18 @@ def sync(
             previous_managed["aliases"],
             previous_managed["input_ids"],
         )
+        if (
+            not local_proxy
+            and not runner
+            and export_format == "json"
+            and json_server_maps_are_empty(generated)
+        ):
+            managed_aliases = set(previous_managed["aliases"])
+            empty_profile_existing_aliases = [
+                alias
+                for alias in direct_server_aliases(existing, export_format)
+                if alias not in managed_aliases
+            ]
     except AccessTokenExpired:
         console.print(f"[red]{ACCESS_TOKEN_EXPIRED_MESSAGE}[/red]")
         raise typer.Exit(1)
@@ -483,6 +562,16 @@ def sync(
         console.print(f"[bold red]Integration sync failed:[/bold red] {exc}")
         raise typer.Exit(1) from exc
 
+    if empty_profile_existing_aliases:
+        print_empty_profile_import_hint(
+            client=client,
+            profile=profile,
+            target=target,
+            aliases=empty_profile_existing_aliases,
+            tenant=tenant,
+            api_url=api_url,
+        )
+
     if dry_run:
         typer.echo(redact(patched))
         err_console.print("[cyan]Dry run: nothing was written.[/cyan]")
@@ -886,6 +975,7 @@ def build_local_proxy_config(
     tenant: Optional[str],
     registry_ca_file: Optional[Path] = None,
     local_proxy_settings: Optional[dict[str, Any]] = None,
+    runtime_secrets: Optional[dict[str, Any]] = None,
 ) -> str:
     """Render the local LightNow Proxy config for LightNow-managed profile sync."""
     parsed = urlparse(local_proxy_url)
@@ -952,12 +1042,30 @@ def build_local_proxy_config(
             "jwks_cache_seconds": 300,
         },
         "registry_api": registry_api,
+        "runtime_secrets": runtime_secrets or {"providers": {}},
         "profiles": {profile: {}},
         "upstreams": {},
     }
     return cast(str, yaml.safe_dump(payload, sort_keys=False))
 
 
+def read_local_runtime_secrets(path: Path) -> dict[str, Any]:
+    """Preserve non-secret local provider mappings across managed config syncs."""
+    try:
+        payload = yaml.safe_load(path.expanduser().read_text()) or {}
+    except (FileNotFoundError, OSError, yaml.YAMLError):
+        return {"providers": {}}
+    if not isinstance(payload, dict):
+        return {"providers": {}}
+    runtime_secrets = payload.get("runtime_secrets")
+    if not isinstance(runtime_secrets, dict):
+        return {"providers": {}}
+    providers = runtime_secrets.get("providers")
+    if not isinstance(providers, dict):
+        return {"providers": {}}
+    return {"providers": providers}
+
+
 def build_runner_export(
     *,
     profile_payload: dict[str, Any],

{lightnow_cli-1.1.0 → lightnow_cli-1.2.0}/lightnow_cli/commands/runner.py

@@ -2,12 +2,13 @@
 
 from __future__ import annotations
 
+import ipaddress
 import os
 import subprocess
 import sys
 from pathlib import Path
 from typing import Any, Optional
-from urllib.parse import quote
+from urllib.parse import quote, urlparse
 
 import httpx
 import typer
@@ -83,6 +84,7 @@ def run(
             version=str(selected["version"]),
             transport=transport,
         )
+        resolve_external_secret_bindings(context)
         assert_runtime_context_ready(context, server=server, profile=profile)
         command, args, env, cwd = launch_config_from_context(context)
     except AccessTokenExpired:
@@ -369,6 +371,184 @@ def launch_config_from_context(
     return command, list(args), env, cwd
 
 
+def resolve_external_secret_bindings(context: dict[str, Any]) -> None:
+    """Resolve runtime-only Vault bindings locally without persisting plaintext."""
+    bindings = context.get("external_secret_bindings")
+    if bindings is None:
+        return
+    if not isinstance(bindings, list):
+        raise ValueError("Runtime context included invalid external secret bindings.")
+
+    for binding in bindings:
+        if not isinstance(binding, dict):
+            raise ValueError(
+                "Runtime context included an invalid external secret binding."
+            )
+        provider = binding.get("provider")
+        locator = binding.get("locator")
+        target = binding.get("target")
+        probe = context.get("probe_request")
+        if not all(
+            isinstance(item, dict) for item in (provider, locator, target, probe)
+        ):
+            raise ValueError("Runtime external secret binding is incomplete.")
+        assert isinstance(provider, dict)
+        assert isinstance(locator, dict)
+        assert isinstance(target, dict)
+        assert isinstance(probe, dict)
+
+        provider_id = provider.get("id")
+        if (
+            provider.get("provider_type") != "vault_kv_v2"
+            or provider.get("resolution_mode") != "runtime"
+        ):
+            raise ValueError("Runtime external secret provider is unsupported.")
+        path = locator.get("path")
+        field = locator.get("field")
+        name = target.get("name")
+        if not all(
+            isinstance(item, str) and item for item in (provider_id, path, field, name)
+        ):
+            raise ValueError("Runtime external secret binding is incomplete.")
+
+        target_type = target.get("type")
+        transport = probe.get("transport")
+        if not (
+            (target_type == "env" and transport == "stdio")
+            or (target_type == "header" and transport in {"http", "sse"})
+        ):
+            raise ValueError(
+                "Runtime external secret target does not match the selected transport."
+            )
+
+        raw_config = provider.get("config")
+        config: dict[str, Any] = (
+            {str(key): item for key, item in raw_config.items()}
+            if isinstance(raw_config, dict)
+            else {}
+        )
+        value = resolve_vault_runtime_secret(
+            provider_id=str(provider_id),
+            config=config,
+            path=str(path),
+            field=str(field),
+        )
+        if target_type == "env":
+            stdio = probe.setdefault("stdio", {})
+            if not isinstance(stdio, dict):
+                raise ValueError(
+                    "Runtime context included invalid stdio configuration."
+                )
+            env = stdio.setdefault("env", {})
+            if not isinstance(env, dict):
+                raise ValueError(
+                    "Runtime context included invalid environment variables."
+                )
+            env[str(name)] = value
+        else:
+            remote = probe.setdefault(str(transport), {})
+            if not isinstance(remote, dict):
+                raise ValueError(
+                    "Runtime context included invalid remote configuration."
+                )
+            headers = remote.setdefault("headers", {})
+            if not isinstance(headers, dict):
+                raise ValueError("Runtime context included invalid HTTP headers.")
+            headers[str(name)] = value
+
+
+def resolve_vault_runtime_secret(
+    *, provider_id: str, config: dict[str, Any], path: str, field: str
+) -> str:
+    """Read one Vault KV v2 scalar through Vault Proxy or an opt-in OS keyring token."""
+    auth_mode = os.environ.get("LIGHTNOW_VAULT_AUTH_MODE", "vault-proxy")
+    headers: dict[str, str] = {}
+    namespace = config.get("namespace")
+    if isinstance(namespace, str) and namespace:
+        headers["X-Vault-Namespace"] = namespace
+
+    address: str
+    if auth_mode == "vault-proxy":
+        address = os.environ.get("LIGHTNOW_VAULT_PROXY_URL", "http://127.0.0.1:8200")
+        parsed = urlparse(address)
+        host = parsed.hostname
+        is_loopback = host == "localhost"
+        if host is not None:
+            try:
+                is_loopback = is_loopback or ipaddress.ip_address(host).is_loopback
+            except ValueError:
+                pass
+        if parsed.scheme not in {"http", "https"} or not is_loopback:
+            raise ValueError(
+                "LIGHTNOW_VAULT_PROXY_URL must target an HTTP(S) loopback address."
+            )
+    elif auth_mode == "keyring":
+        configured_address = os.environ.get("LIGHTNOW_VAULT_ADDRESS") or config.get(
+            "address"
+        )
+        if not isinstance(configured_address, str) or not configured_address:
+            raise ValueError(
+                f"Vault address is missing for runtime provider {provider_id}."
+            )
+        address = configured_address
+        parsed = urlparse(address)
+        if parsed.scheme != "https" or parsed.hostname is None:
+            raise ValueError("Runtime Vault address must be an HTTPS origin.")
+        try:
+            import keyring  # type: ignore[import-not-found]
+        except ImportError as exc:
+            raise ValueError(
+                "OS-keyring support is not installed. Install lightnow-cli[keyring] or use Vault Proxy."
+            ) from exc
+        service = os.environ.get(
+            "LIGHTNOW_VAULT_KEYRING_SERVICE", "lightnow-proxy-vault"
+        )
+        token = keyring.get_password(service, provider_id)
+        if not isinstance(token, str) or not token:
+            raise ValueError(
+                f"OS keyring has no Vault token for runtime provider {provider_id}."
+            )
+        headers["X-Vault-Token"] = token
+    else:
+        raise ValueError("LIGHTNOW_VAULT_AUTH_MODE must be vault-proxy or keyring.")
+
+    verify: str | bool = os.environ.get("LIGHTNOW_VAULT_CA_FILE") or True
+    url = f"{address.rstrip('/')}/v1/{path.lstrip('/')}"
+    try:
+        response = httpx.get(
+            url, headers=headers, timeout=10.0, verify=verify, follow_redirects=False
+        )
+    except httpx.RequestError as exc:
+        raise ValueError(
+            f"Runtime Vault provider {provider_id} is not reachable."
+        ) from exc
+    if response.is_redirect:
+        raise ValueError(f"Runtime Vault provider {provider_id} returned a redirect.")
+    if response.status_code >= 400:
+        raise ValueError(
+            f"Runtime Vault provider {provider_id} returned HTTP {response.status_code}."
+        )
+    if len(response.content) > 64 * 1024:
+        raise ValueError(
+            f"Runtime Vault provider {provider_id} returned an oversized response."
+        )
+    try:
+        payload = response.json()
+    except ValueError as exc:
+        raise ValueError(
+            f"Runtime Vault provider {provider_id} returned invalid JSON."
+        ) from exc
+    payload_data = payload.get("data") if isinstance(payload, dict) else None
+    data = payload_data if isinstance(payload_data, dict) else {}
+    secret_data = data.get("data") if isinstance(data.get("data"), dict) else data
+    value = secret_data.get(field) if isinstance(secret_data, dict) else None
+    if not isinstance(value, str | int | float | bool):
+        raise ValueError(
+            f"Runtime Vault provider {provider_id} did not return the configured scalar field."
+        )
+    return str(value)
+
+
 def json_response_or_error(response: httpx.Response) -> dict[str, Any]:
     """Return JSON response or raise a redacted explicit error."""
     if response.status_code == 401:

{lightnow_cli-1.1.0 → lightnow_cli-1.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "lightnow-cli"
-version = "1.1.0"
+version = "1.2.0"
 description = "Official LightNow CLI for MCP registry discovery, client config sync, and local MCP runner workflows"
 authors = [{name = "LightNow Team"}]
 license = {text = "Apache-2.0"}
@@ -34,6 +34,9 @@ dependencies = [
 ]
 
 [project.optional-dependencies]
+keyring = [
+    "keyring>=25.6.0",
+]
 dev = [
     "pytest>=7.0.0",
     "pytest-cov>=4.0.0",

{lightnow_cli-1.1.0 → lightnow_cli-1.2.0}/tests/test_integrations.py

@@ -38,6 +38,7 @@ from lightnow_cli.commands.integrations import (
     prepare_codex_local_proxy_config,
     prepare_json_local_proxy_config,
     print_import_summary,
+    read_local_runtime_secrets,
     redact,
     render_local_proxy_codex_stdio_toml,
     render_local_proxy_codex_toml,
@@ -51,7 +52,9 @@ from lightnow_cli.commands.runner import (
     fetch_runtime_context,
     json_response_or_error,
     launch_config_from_context,
+    resolve_external_secret_bindings,
     resolve_profile_server,
+    resolve_vault_runtime_secret,
     runner_failure_summary,
 )
 from lightnow_cli.main import app
@@ -302,6 +305,67 @@ def test_sync_json_writes_manifest_and_preserves_user_config() -> None:
         assert target.with_suffix(".json.lightnow.bak").exists()
 
 
+def test_empty_antigravity_profile_preserves_servers_and_suggests_import() -> None:
+    """An empty server map preserves client servers and suggests importing them."""
+    runner = CliRunner()
+    with tempfile.TemporaryDirectory() as tmp:
+        target = Path(tmp) / "mcp_config.json"
+        target.write_text(
+            json.dumps(
+                {
+                    "mcpServers": {
+                        "local-redis": {
+                            "command": "docker",
+                            "args": ["run", "--rm", "mcp/redis"],
+                        }
+                    }
+                }
+            )
+        )
+
+        with (
+            patch(
+                "lightnow_cli.commands.integrations.require_access_token",
+                return_value="token",
+            ),
+            patch(
+                "lightnow_cli.commands.integrations.fetch_export",
+                return_value='{"mcpServers": {}}',
+            ),
+        ):
+            result = runner.invoke(
+                app,
+                [
+                    "sync",
+                    "--client",
+                    "antigravity",
+                    "--config-path",
+                    str(target),
+                    "--yes",
+                ],
+            )
+
+        payload = json.loads(target.read_text())
+
+    assert result.exit_code == 0
+    assert payload["mcpServers"]["local-redis"]["command"] == "docker"
+    assert "LightNow profile default has no MCP servers" in result.stderr
+    assert "These existing client entries were kept" in result.stderr
+    compact_stderr = result.stderr.replace("\n", "")
+    assert "lightnow import-config --client antigravity" in compact_stderr
+    assert f"--config-path {target}" in compact_stderr
+    assert "--dry-run" in compact_stderr
+
+
+def test_json_sync_rejects_non_object_server_map() -> None:
+    """JSON exports must provide object-shaped server maps."""
+    with pytest.raises(
+        ValueError,
+        match="LightNow can only sync JSON object field mcpServers",
+    ):
+        patch_config("{}", '{"mcpServers": []}', "json")
+
+
 def test_sync_json_preserves_user_inputs_and_replaces_lightnow_inputs() -> None:
     """VS Code sync patches inputs without deleting user-owned prompts."""
     existing = json.dumps(
@@ -2150,6 +2214,155 @@ def test_launch_config_from_context_extracts_secret_environment() -> None:
     assert cwd == "~/code"
 
 
+def test_runner_resolves_runtime_vault_binding_through_local_vault_proxy(
+    monkeypatch,
+) -> None:
+    """Runtime-only values are fetched locally and never require an API-held token."""
+    monkeypatch.setenv("LIGHTNOW_VAULT_PROXY_URL", "http://127.0.0.1:18200")
+    context = {
+        "probe_request": {"transport": "stdio", "stdio": {"cmd": "docker", "env": {}}},
+        "external_secret_bindings": [
+            {
+                "provider": {
+                    "id": "provider-uuid",
+                    "provider_type": "vault_kv_v2",
+                    "resolution_mode": "runtime",
+                    "config": {
+                        "address": "https://vault.customer.internal",
+                        "namespace": "customer",
+                    },
+                },
+                "locator": {"path": "secret/data/lightnow/test", "field": "token"},
+                "target": {"type": "env", "name": "API_TOKEN"},
+            }
+        ],
+    }
+    response = httpx.Response(
+        200,
+        request=httpx.Request(
+            "GET", "http://127.0.0.1:18200/v1/secret/data/lightnow/test"
+        ),
+        json={"data": {"data": {"token": "runtime-value"}}},
+    )
+
+    with patch(
+        "lightnow_cli.commands.runner.httpx.get", return_value=response
+    ) as vault_get:
+        resolve_external_secret_bindings(context)
+
+    assert context["probe_request"]["stdio"]["env"]["API_TOKEN"] == "runtime-value"
+    assert (
+        vault_get.call_args.args[0]
+        == "http://127.0.0.1:18200/v1/secret/data/lightnow/test"
+    )
+    assert vault_get.call_args.kwargs["headers"] == {"X-Vault-Namespace": "customer"}
+    assert vault_get.call_args.kwargs["follow_redirects"] is False
+
+
+def test_runner_rejects_runtime_binding_target_before_contacting_vault() -> None:
+    context = {
+        "probe_request": {"transport": "stdio", "stdio": {"cmd": "docker"}},
+        "external_secret_bindings": [
+            {
+                "provider": {
+                    "id": "provider-uuid",
+                    "provider_type": "vault_kv_v2",
+                    "resolution_mode": "runtime",
+                    "config": {},
+                },
+                "locator": {"path": "secret/data/lightnow/test", "field": "token"},
+                "target": {"type": "header", "name": "Authorization"},
+            }
+        ],
+    }
+
+    with patch("lightnow_cli.commands.runner.httpx.get") as vault_get:
+        try:
+            resolve_external_secret_bindings(context)
+        except ValueError as exc:
+            assert "does not match" in str(exc)
+        else:
+            raise AssertionError("expected ValueError")
+
+    vault_get.assert_not_called()
+
+
+def test_runtime_vault_resolution_fails_closed_for_unsafe_proxy_and_responses(
+    monkeypatch,
+) -> None:
+    monkeypatch.setenv("LIGHTNOW_VAULT_PROXY_URL", "http://vault.attacker.example:8200")
+    try:
+        resolve_vault_runtime_secret(
+            provider_id="provider-uuid",
+            config={},
+            path="secret/data/test",
+            field="token",
+        )
+    except ValueError as exc:
+        assert "loopback" in str(exc)
+    else:
+        raise AssertionError("expected ValueError")
+
+    monkeypatch.setenv("LIGHTNOW_VAULT_PROXY_URL", "http://127.0.0.1:8200")
+    responses = [
+        (
+            httpx.Response(302, headers={"Location": "http://169.254.169.254"}),
+            "redirect",
+        ),
+        (httpx.Response(503), "HTTP 503"),
+        (httpx.Response(200, content=b"x" * (64 * 1024 + 1)), "oversized"),
+        (httpx.Response(200, content=b"not-json"), "invalid JSON"),
+        (httpx.Response(200, json={"data": {"data": {}}}), "scalar field"),
+    ]
+    for response, expected in responses:
+        response.request = httpx.Request(
+            "GET", "http://127.0.0.1:8200/v1/secret/data/test"
+        )
+        with patch("lightnow_cli.commands.runner.httpx.get", return_value=response):
+            try:
+                resolve_vault_runtime_secret(
+                    provider_id="provider-uuid",
+                    config={},
+                    path="secret/data/test",
+                    field="token",
+                )
+            except ValueError as exc:
+                assert expected in str(exc)
+            else:
+                raise AssertionError("expected ValueError")
+
+
+def test_local_proxy_sync_preserves_runtime_secret_provider_mappings(tmp_path) -> None:
+    config_path = tmp_path / "codex.yaml"
+    config_path.write_text(
+        yaml.safe_dump(
+            {
+                "runtime_secrets": {
+                    "providers": {
+                        "provider-uuid": {
+                            "auth_mode": "vault-proxy",
+                            "vault_proxy_url": "http://127.0.0.1:18200",
+                        }
+                    }
+                }
+            }
+        )
+    )
+
+    preserved = read_local_runtime_secrets(config_path)
+    rendered = yaml.safe_load(
+        build_local_proxy_config(
+            local_proxy_url="http://127.0.0.1:8765/mcp",
+            profile="default",
+            registry_api_url="https://registry-api.lightnow.ai",
+            tenant=None,
+            runtime_secrets=preserved,
+        )
+    )
+
+    assert rendered["runtime_secrets"] == preserved
+
+
 def test_runner_context_readiness_reports_missing_inputs() -> None:
     """The runner blocks before starting a child process when config is incomplete."""
     try:

lightnow_cli-1.1.0/.release-please-manifest.json

@@ -1,3 +0,0 @@
-{
-  ".": "1.1.0"
-}