lightnow-cli 1.5.0__tar.gz → 1.6.0__tar.gz

{lightnow_cli-1.5.0 → lightnow_cli-1.6.0}/.github/workflows/ci.yml

@@ -23,10 +23,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: ${{ matrix.python-version }}
           cache: pip
@@ -59,12 +59,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
-          python-version: "3.13"
+          python-version: "3.12"
           cache: pip
 
       - name: Install build tools
@@ -74,7 +74,7 @@ jobs:
         run: make package
 
       - name: Upload distributions
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: python-distributions
           path: dist/*

{lightnow_cli-1.5.0 → lightnow_cli-1.6.0}/.github/workflows/release-please.yml

@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Run Release Please
-        uses: googleapis/release-please-action@v4
+        uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5
         with:
           token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
           config-file: release-please-config.json

{lightnow_cli-1.5.0 → lightnow_cli-1.6.0}/.github/workflows/release.yml

@@ -15,12 +15,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
-          python-version: "3.13"
+          python-version: "3.12"
           cache: pip
 
       - name: Install package
@@ -36,12 +36,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
-          python-version: "3.13"
+          python-version: "3.12"
           cache: pip
 
       - name: Install build tools
@@ -51,7 +51,7 @@ jobs:
         run: make package
 
       - name: Upload distributions
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: python-distributions
           path: dist/*
@@ -66,13 +66,13 @@ jobs:
 
     steps:
       - name: Download distributions
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: python-distributions
           path: dist
 
       - name: Publish GitHub release notes
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
         with:
           generate_release_notes: true
           files: dist/*
@@ -89,13 +89,13 @@ jobs:
 
     steps:
       - name: Download distributions
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: python-distributions
           path: dist
 
       - name: Publish distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
 
   update-homebrew:
     name: Update Homebrew formula

lightnow_cli-1.6.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "1.6.0"
+}

{lightnow_cli-1.5.0 → lightnow_cli-1.6.0}/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to the LightNow CLI are documented here.
 
 This project follows semantic versioning.
 
+## [1.6.0](https://github.com/lightnow-ai/lightnow-cli/compare/v1.5.0...v1.6.0) (2026-10-09)
+
+
+### Features
+
+* **auth:** support complete connection targets ([#39](https://github.com/lightnow-ai/lightnow-cli/issues/39)) ([699b09e](https://github.com/lightnow-ai/lightnow-cli/commit/699b09e70d1131a82667bb14a828d0234d19a75d))
+
+
+### Bug Fixes
+
+* **renovate:** constrain Python dependency names ([#22](https://github.com/lightnow-ai/lightnow-cli/issues/22)) ([a48bb79](https://github.com/lightnow-ai/lightnow-cli/commit/a48bb7935184d56f169c850d1fc478cde0c1667e))
+
 ## [1.5.0](https://github.com/lightnow-ai/lightnow-cli/compare/v1.4.0...v1.5.0) (2026-07-18)
 
 

{lightnow_cli-1.5.0 → lightnow_cli-1.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: lightnow-cli
-Version: 1.5.0
+Version: 1.6.0
 Summary: Official LightNow CLI for MCP registry discovery, client config sync, and local MCP runner workflows
 Project-URL: Homepage, https://github.com/lightnow-ai/lightnow-cli
 Project-URL: Repository, https://github.com/lightnow-ai/lightnow-cli
@@ -121,6 +121,47 @@ your session with:
 lightnow status
 ```
 
+For an isolated LightNow environment, obtain a credential-free connection target
+from its operator and select it explicitly:
+
+```bash
+lightnow login --target ./connection-target.json
+```
+
+The complete JSON schema is:
+
+```json
+{
+  "schemaVersion": 1,
+  "issuer": "https://auth.example.test/realms/example",
+  "clientId": "lightnow-cli",
+  "registryApiUrl": "https://registry.example.test/v0.1",
+  "adminApiUrl": "https://admin.example.test/v0/portal"
+}
+```
+
+All five fields are required; additional fields and embedded credentials are
+rejected. URLs must use HTTPS without credentials, query strings or fragments.
+The environment operator provisions the public OAuth device-flow client; the CLI
+does not register clients. Authentication remains at the product issuer, which
+may broker an external identity provider through its browser flow.
+The device request includes `openid profile email organization:*`; the operator
+must assign the standard `organization` client scope so existing organization
+memberships are available to the scoped APIs.
+
+`--target` cannot be combined with `--local`, `--issuer` or `--client-id`. Custom
+issuers require a complete target and cannot silently use production API defaults.
+Normal `lightnow login` and `lightnow login --local` remain available.
+
+The selected target and named session are saved only after device authorization
+and userinfo verification succeed. OIDC discovery must identify the selected
+issuer and expose credential-free HTTPS endpoints. Failed login preserves the previous connection.
+A different environment or account returns to personal context; logging into the
+same target and account preserves the selected organization. Organization selection,
+profile requests and generated Local Proxy connections use the selected API URLs.
+For acceptance runs, use a separate container user/home and explicit client and
+proxy configuration paths so existing desktop connections are not modified.
+
 ## Find MCP Servers
 
 Search the LightNow Registry:

{lightnow_cli-1.5.0 → lightnow_cli-1.6.0}/README.md

@@ -73,6 +73,47 @@ your session with:
 lightnow status
 ```
 
+For an isolated LightNow environment, obtain a credential-free connection target
+from its operator and select it explicitly:
+
+```bash
+lightnow login --target ./connection-target.json
+```
+
+The complete JSON schema is:
+
+```json
+{
+  "schemaVersion": 1,
+  "issuer": "https://auth.example.test/realms/example",
+  "clientId": "lightnow-cli",
+  "registryApiUrl": "https://registry.example.test/v0.1",
+  "adminApiUrl": "https://admin.example.test/v0/portal"
+}
+```
+
+All five fields are required; additional fields and embedded credentials are
+rejected. URLs must use HTTPS without credentials, query strings or fragments.
+The environment operator provisions the public OAuth device-flow client; the CLI
+does not register clients. Authentication remains at the product issuer, which
+may broker an external identity provider through its browser flow.
+The device request includes `openid profile email organization:*`; the operator
+must assign the standard `organization` client scope so existing organization
+memberships are available to the scoped APIs.
+
+`--target` cannot be combined with `--local`, `--issuer` or `--client-id`. Custom
+issuers require a complete target and cannot silently use production API defaults.
+Normal `lightnow login` and `lightnow login --local` remain available.
+
+The selected target and named session are saved only after device authorization
+and userinfo verification succeed. OIDC discovery must identify the selected
+issuer and expose credential-free HTTPS endpoints. Failed login preserves the previous connection.
+A different environment or account returns to personal context; logging into the
+same target and account preserves the selected organization. Organization selection,
+profile requests and generated Local Proxy connections use the selected API URLs.
+For acceptance runs, use a separate container user/home and explicit client and
+proxy configuration paths so existing desktop connections are not modified.
+
 ## Find MCP Servers
 
 Search the LightNow Registry:

{lightnow_cli-1.5.0 → lightnow_cli-1.6.0}/lightnow_cli/__init__.py

@@ -1,3 +1,3 @@
 """LightNow CLI - A command-line tool for managing MCP servers."""
 
-__version__ = "1.5.0"  # x-release-please-version
+__version__ = "1.6.0"  # x-release-please-version

{lightnow_cli-1.5.0 → lightnow_cli-1.6.0}/lightnow_cli/commands/auth.py

@@ -7,6 +7,7 @@ import json
 import secrets
 import time
 import webbrowser
+from pathlib import Path
 from typing import Any, Dict, Optional, cast
 
 import httpx
@@ -16,13 +17,16 @@ from rich.console import Console
 from typing_extensions import Annotated
 
 from ..config import (
+    DEFAULT_ADMIN_API_URL,
     DEFAULT_CLIENT_ID,
     DEFAULT_ISSUER,
+    DEFAULT_REGISTRY_API_URL,
     LOCAL_ADMIN_API_URL,
     LOCAL_ISSUER,
     LOCAL_REGISTRY_API_URL,
     config_manager,
 )
+from ..target import ConnectionTarget, load_target, validate_https_url
 
 console = Console()
 app = typer.Typer(help="Authentication commands")
@@ -70,6 +74,10 @@ def pkce_challenge(verifier: str) -> str:
 
 async def discover_oidc_endpoints(issuer: str) -> Dict[str, str]:
     """Discover the OIDC endpoints required by the CLI."""
+    try:
+        issuer = validate_https_url(issuer)
+    except ValueError:
+        raise AuthError("OIDC issuer must be a credential-free HTTPS URL.") from None
     async with httpx.AsyncClient(timeout=AUTH_HTTP_TIMEOUT) as client:
         try:
             discovery_response = await client.get(
@@ -79,6 +87,10 @@ async def discover_oidc_endpoints(issuer: str) -> Dict[str, str]:
             discovery = discovery_response.json()
             if not isinstance(discovery, dict):
                 raise AuthError("OIDC discovery response is not a JSON object")
+            if discovery.get("issuer") != issuer:
+                raise AuthError(
+                    "OIDC discovery issuer does not match the selected issuer."
+                )
         except httpx.HTTPError as e:
             raise AuthError(
                 f"Failed to discover OIDC endpoints: {describe_http_error(e)}"
@@ -91,12 +103,19 @@ async def discover_oidc_endpoints(issuer: str) -> Dict[str, str]:
     if not device_authorization_endpoint or not token_endpoint:
         raise AuthError("OIDC provider does not support device code flow")
 
-    endpoints = {
-        "device_authorization_endpoint": cast(str, device_authorization_endpoint),
-        "token_endpoint": cast(str, token_endpoint),
-    }
-    if isinstance(userinfo_endpoint, str) and userinfo_endpoint:
-        endpoints["userinfo_endpoint"] = userinfo_endpoint
+    try:
+        endpoints = {
+            "device_authorization_endpoint": validate_https_url(
+                device_authorization_endpoint
+            ),
+            "token_endpoint": validate_https_url(token_endpoint),
+        }
+        if userinfo_endpoint is not None:
+            endpoints["userinfo_endpoint"] = validate_https_url(userinfo_endpoint)
+    except ValueError:
+        raise AuthError(
+            "OIDC discovery endpoints must be credential-free HTTPS URLs."
+        ) from None
     return endpoints
 
 
@@ -111,7 +130,7 @@ async def device_code_flow(issuer: str, client_id: str) -> Dict[str, Any]:
                 endpoints["device_authorization_endpoint"],
                 data={
                     "client_id": client_id,
-                    "scope": "openid profile email",
+                    "scope": "openid profile email organization:*",
                     "code_challenge": pkce_challenge(code_verifier),
                     "code_challenge_method": "S256",
                 },
@@ -295,6 +314,7 @@ def persist_refreshed_token(config: Any, token_data: Dict[str, Any]) -> str:
             else config.refresh_token
         ),
         None,
+        expected_binding=config_manager.connection_binding(config),
     )
     return refreshed_token
 
@@ -376,21 +396,43 @@ def login(
             hidden=True,
         ),
     ] = None,
+    target: Annotated[
+        Optional[Path],
+        typer.Option(
+            "--target",
+            help="Credential-free JSON connection target for an isolated environment.",
+        ),
+    ] = None,
 ) -> None:
     """Authenticate with LightNow."""
     try:
-        resolved_issuer = issuer or (LOCAL_ISSUER if local else DEFAULT_ISSUER)
-        resolved_client_id = client_id or DEFAULT_CLIENT_ID
-        resolved_registry_api_url = LOCAL_REGISTRY_API_URL if local else None
-        resolved_admin_api_url = LOCAL_ADMIN_API_URL if local else None
-
-        # Store auth config
-        config_manager.set_auth_config(
-            resolved_issuer,
-            resolved_client_id,
-            resolved_registry_api_url,
-            resolved_admin_api_url,
-        )
+        if target is not None:
+            if local or issuer is not None or client_id is not None:
+                raise AuthError(
+                    "--target cannot be combined with --local, --issuer or --client-id."
+                )
+            try:
+                connection = load_target(target)
+            except ValueError as exc:
+                raise AuthError(str(exc)) from None
+        else:
+            resolved_issuer = LOCAL_ISSUER if local else DEFAULT_ISSUER
+            if issuer is not None and issuer.rstrip("/") != resolved_issuer:
+                raise AuthError("A custom issuer requires --target with both API URLs.")
+            if client_id is not None and (
+                not client_id
+                or any(
+                    character.isspace() or ord(character) < 32
+                    for character in client_id
+                )
+            ):
+                raise AuthError("Client ID must be a nonempty identifier.")
+            connection = ConnectionTarget(
+                resolved_issuer,
+                client_id or DEFAULT_CLIENT_ID,
+                LOCAL_REGISTRY_API_URL if local else DEFAULT_REGISTRY_API_URL,
+                LOCAL_ADMIN_API_URL if local else DEFAULT_ADMIN_API_URL,
+            )
 
         # Perform device code flow
         if local:
@@ -399,23 +441,27 @@ def login(
             )
         else:
             console.print("[bold blue]Starting LightNow authentication...[/bold blue]")
-        token_data = asyncio.run(device_code_flow(resolved_issuer, resolved_client_id))
+        token_data = asyncio.run(
+            device_code_flow(connection.issuer, connection.client_id)
+        )
         token = token_data.get("access_token")
         if not isinstance(token, str) or token == "":
             raise AuthError("OIDC token response did not include an access token.")
         refresh_token = token_data.get("refresh_token")
 
         # Fetch user info from the issuer instead of trusting local JWT claims.
-        user_info = asyncio.run(fetch_user_info(resolved_issuer, token))
+        user_info = asyncio.run(fetch_user_info(connection.issuer, token))
+        subject = user_info.get("sub")
+        if not isinstance(subject, str) or not subject.strip():
+            raise AuthError("OIDC userinfo response did not include a valid subject.")
 
         # Store token and user info
-        config_manager.set_token(
+        config_manager.commit_login(
+            connection,
             token,
             refresh_token if isinstance(refresh_token, str) else None,
             user_info,
-            update_active_session=False,
         )
-        config_manager.persist_current_session(user_info)
 
         console.print("[bold green]✓ Authentication successful![/bold green]")
         if user_info: