lightnow-cli 1.5.0__tar.gz → 1.6.1__tar.gz

{lightnow_cli-1.5.0 → lightnow_cli-1.6.1}/.github/workflows/ci.yml

@@ -23,10 +23,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: ${{ matrix.python-version }}
           cache: pip
@@ -59,12 +59,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
-          python-version: "3.13"
+          python-version: "3.12"
           cache: pip
 
       - name: Install build tools
@@ -73,8 +73,27 @@ jobs:
       - name: Build and check distributions
         run: make package
 
+      - name: Verify distribution provenance contract
+        run: python -m unittest discover -s ci -p 'test_*.py'
+
+      - name: Bind PR distribution provenance
+        if: github.event_name == 'pull_request'
+        env:
+          ARTIFACT_REPOSITORY: ${{ github.repository }}
+          ARTIFACT_PR_NUMBER: ${{ github.event.pull_request.number }}
+          ARTIFACT_HEAD_REVISION: ${{ github.event.pull_request.head.sha }}
+          ARTIFACT_RUN_ID: ${{ github.run_id }}
+          ARTIFACT_RUN_ATTEMPT: ${{ github.run_attempt }}
+        run: |
+          python ci/create_client_artifact.py --component cli \
+            --repository "$ARTIFACT_REPOSITORY" \
+            --pr-number "$ARTIFACT_PR_NUMBER" \
+            --head-revision "$ARTIFACT_HEAD_REVISION" \
+            --run-id "$ARTIFACT_RUN_ID" \
+            --run-attempt "$ARTIFACT_RUN_ATTEMPT"
+
       - name: Upload distributions
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: python-distributions
           path: dist/*

{lightnow_cli-1.5.0 → lightnow_cli-1.6.1}/.github/workflows/release-please.yml

@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Run Release Please
-        uses: googleapis/release-please-action@v4
+        uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5
         with:
           token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
           config-file: release-please-config.json

{lightnow_cli-1.5.0 → lightnow_cli-1.6.1}/.github/workflows/release.yml

@@ -15,12 +15,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
-          python-version: "3.13"
+          python-version: "3.12"
           cache: pip
 
       - name: Install package
@@ -36,12 +36,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
-          python-version: "3.13"
+          python-version: "3.12"
           cache: pip
 
       - name: Install build tools
@@ -51,7 +51,7 @@ jobs:
         run: make package
 
       - name: Upload distributions
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: python-distributions
           path: dist/*
@@ -66,13 +66,13 @@ jobs:
 
     steps:
       - name: Download distributions
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: python-distributions
           path: dist
 
       - name: Publish GitHub release notes
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
         with:
           generate_release_notes: true
           files: dist/*
@@ -89,13 +89,13 @@ jobs:
 
     steps:
       - name: Download distributions
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: python-distributions
           path: dist
 
       - name: Publish distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
 
   update-homebrew:
     name: Update Homebrew formula

lightnow_cli-1.6.1/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "1.6.1"
+}

{lightnow_cli-1.5.0 → lightnow_cli-1.6.1}/CHANGELOG.md

@@ -4,6 +4,27 @@ All notable changes to the LightNow CLI are documented here.
 
 This project follows semantic versioning.
 
+## [1.6.1](https://github.com/lightnow-ai/lightnow-cli/compare/v1.6.0...v1.6.1) (2026-11-09)
+
+
+### Bug Fixes
+
+* **cli:** use active context for default favorites ([5399173](https://github.com/lightnow-ai/lightnow-cli/commit/539917321a8fbafedb05394841b5fadd0b5319e0))
+* **cli:** use active context for default favorites ([1ccba54](https://github.com/lightnow-ai/lightnow-cli/commit/1ccba543e34b236d449bdedeb644029c54f49f03))
+* **cli:** use active context for default favorites ([#45](https://github.com/lightnow-ai/lightnow-cli/issues/45)) ([5399173](https://github.com/lightnow-ai/lightnow-cli/commit/539917321a8fbafedb05394841b5fadd0b5319e0))
+
+## [1.6.0](https://github.com/lightnow-ai/lightnow-cli/compare/v1.5.0...v1.6.0) (2026-10-09)
+
+
+### Features
+
+* **auth:** support complete connection targets ([#39](https://github.com/lightnow-ai/lightnow-cli/issues/39)) ([699b09e](https://github.com/lightnow-ai/lightnow-cli/commit/699b09e70d1131a82667bb14a828d0234d19a75d))
+
+
+### Bug Fixes
+
+* **renovate:** constrain Python dependency names ([#22](https://github.com/lightnow-ai/lightnow-cli/issues/22)) ([a48bb79](https://github.com/lightnow-ai/lightnow-cli/commit/a48bb7935184d56f169c850d1fc478cde0c1667e))
+
 ## [1.5.0](https://github.com/lightnow-ai/lightnow-cli/compare/v1.4.0...v1.5.0) (2026-07-18)
 
 

{lightnow_cli-1.5.0 → lightnow_cli-1.6.1}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: lightnow-cli
-Version: 1.5.0
+Version: 1.6.1
 Summary: Official LightNow CLI for MCP registry discovery, client config sync, and local MCP runner workflows
 Project-URL: Homepage, https://github.com/lightnow-ai/lightnow-cli
 Project-URL: Repository, https://github.com/lightnow-ai/lightnow-cli
@@ -121,6 +121,47 @@ your session with:
 lightnow status
 ```
 
+For an isolated LightNow environment, obtain a credential-free connection target
+from its operator and select it explicitly:
+
+```bash
+lightnow login --target ./connection-target.json
+```
+
+The complete JSON schema is:
+
+```json
+{
+  "schemaVersion": 1,
+  "issuer": "https://auth.example.test/realms/example",
+  "clientId": "lightnow-cli",
+  "registryApiUrl": "https://registry.example.test/v0.1",
+  "adminApiUrl": "https://admin.example.test/v0/portal"
+}
+```
+
+All five fields are required; additional fields and embedded credentials are
+rejected. URLs must use HTTPS without credentials, query strings or fragments.
+The environment operator provisions the public OAuth device-flow client; the CLI
+does not register clients. Authentication remains at the product issuer, which
+may broker an external identity provider through its browser flow.
+The device request includes `openid profile email organization:*`; the operator
+must assign the standard `organization` client scope so existing organization
+memberships are available to the scoped APIs.
+
+`--target` cannot be combined with `--local`, `--issuer` or `--client-id`. Custom
+issuers require a complete target and cannot silently use production API defaults.
+Normal `lightnow login` and `lightnow login --local` remain available.
+
+The selected target and named session are saved only after device authorization
+and userinfo verification succeed. OIDC discovery must identify the selected
+issuer and expose credential-free HTTPS endpoints. Failed login preserves the previous connection.
+A different environment or account returns to personal context; logging into the
+same target and account preserves the selected organization. Organization selection,
+profile requests and generated Local Proxy connections use the selected API URLs.
+For acceptance runs, use a separate container user/home and explicit client and
+proxy configuration paths so existing desktop connections are not modified.
+
 ## Find MCP Servers
 
 Search the LightNow Registry:
@@ -135,7 +176,7 @@ Show details for one server:
 lightnow info io.github.SonarSource/sonarqube-mcp-server
 ```
 
-Show your favorites:
+Show favorites for the active personal or organization context:
 
 ```bash
 lightnow favorites

{lightnow_cli-1.5.0 → lightnow_cli-1.6.1}/README.md

@@ -73,6 +73,47 @@ your session with:
 lightnow status
 ```
 
+For an isolated LightNow environment, obtain a credential-free connection target
+from its operator and select it explicitly:
+
+```bash
+lightnow login --target ./connection-target.json
+```
+
+The complete JSON schema is:
+
+```json
+{
+  "schemaVersion": 1,
+  "issuer": "https://auth.example.test/realms/example",
+  "clientId": "lightnow-cli",
+  "registryApiUrl": "https://registry.example.test/v0.1",
+  "adminApiUrl": "https://admin.example.test/v0/portal"
+}
+```
+
+All five fields are required; additional fields and embedded credentials are
+rejected. URLs must use HTTPS without credentials, query strings or fragments.
+The environment operator provisions the public OAuth device-flow client; the CLI
+does not register clients. Authentication remains at the product issuer, which
+may broker an external identity provider through its browser flow.
+The device request includes `openid profile email organization:*`; the operator
+must assign the standard `organization` client scope so existing organization
+memberships are available to the scoped APIs.
+
+`--target` cannot be combined with `--local`, `--issuer` or `--client-id`. Custom
+issuers require a complete target and cannot silently use production API defaults.
+Normal `lightnow login` and `lightnow login --local` remain available.
+
+The selected target and named session are saved only after device authorization
+and userinfo verification succeed. OIDC discovery must identify the selected
+issuer and expose credential-free HTTPS endpoints. Failed login preserves the previous connection.
+A different environment or account returns to personal context; logging into the
+same target and account preserves the selected organization. Organization selection,
+profile requests and generated Local Proxy connections use the selected API URLs.
+For acceptance runs, use a separate container user/home and explicit client and
+proxy configuration paths so existing desktop connections are not modified.
+
 ## Find MCP Servers
 
 Search the LightNow Registry:
@@ -87,7 +128,7 @@ Show details for one server:
 lightnow info io.github.SonarSource/sonarqube-mcp-server
 ```
 
-Show your favorites:
+Show favorites for the active personal or organization context:
 
 ```bash
 lightnow favorites

lightnow_cli-1.6.1/ci/create_client_artifact.py

@@ -0,0 +1,126 @@
+"""Bind a PR build to its tested checkout and one universal Python wheel."""
+
+import argparse
+import hashlib
+import json
+import re
+import subprocess
+import tomllib
+import zipfile
+from email.parser import Parser
+from pathlib import Path
+
+SCHEMA_VERSION = "platform.lightnow.ai/feature-stack-client-artifact/v1"
+MANIFEST_FILENAME = "feature-stack-client-artifact.json"
+COMPONENTS = {"cli": "lightnow-cli", "proxy": "lightnow-proxy"}
+
+
+def build_manifest(
+    root: Path,
+    component: str,
+    repository: str,
+    pr_number: int,
+    head_revision: str,
+    checkout_revision: str,
+    run_id: int,
+    run_attempt: int,
+) -> dict:
+    """Validate wheel contents and runner identity before creating provenance."""
+    package_name = COMPONENTS.get(component)
+    if package_name is None or repository != f"lightnow-ai/{package_name}":
+        raise ValueError("Component and repository do not match")
+    if any(value <= 0 for value in (pr_number, run_id, run_attempt)):
+        raise ValueError("PR number, run ID and run attempt must be positive")
+    if any(
+        re.fullmatch(r"[0-9a-f]{40}", value) is None
+        for value in (head_revision, checkout_revision)
+    ):
+        raise ValueError("Head and checkout revisions must be full Git SHA-1 values")
+
+    with (root / "pyproject.toml").open("rb") as project_file:
+        project = tomllib.load(project_file)["project"]
+    if project["name"] != package_name:
+        raise ValueError("Repository package metadata does not match component")
+
+    wheels = sorted((root / "dist").glob("*.whl"))
+    if len(wheels) != 1 or wheels[0].is_symlink() or not wheels[0].is_file():
+        raise ValueError("Exactly one regular wheel is required")
+    wheel = wheels[0]
+    wheel_package = package_name.replace("-", "_")
+    expected_filename = f"{wheel_package}-{project['version']}-py3-none-any.whl"
+    if wheel.name != expected_filename:
+        raise ValueError("Expected the repository's universal py3-none-any wheel")
+
+    prefix = f"{wheel_package}-{project['version']}.dist-info/"
+    with zipfile.ZipFile(wheel) as archive:
+        for name in (f"{prefix}METADATA", f"{prefix}WHEEL"):
+            if archive.namelist().count(name) != 1:
+                raise ValueError("Wheel metadata must be unique and match its filename")
+        metadata_files = [
+            name for name in archive.namelist() if name.endswith(".dist-info/METADATA")
+        ]
+        if metadata_files != [f"{prefix}METADATA"]:
+            raise ValueError("Wheel must contain exactly one distribution's metadata")
+        metadata = Parser().parsestr(archive.read(f"{prefix}METADATA").decode("utf-8"))
+        wheel_metadata = Parser().parsestr(
+            archive.read(f"{prefix}WHEEL").decode("utf-8")
+        )
+    if metadata.get_all("Name") != [package_name] or metadata.get_all("Version") != [
+        project["version"]
+    ]:
+        raise ValueError("Wheel METADATA name/version do not match repository metadata")
+    if wheel_metadata.get_all("Tag") != ["py3-none-any"] or wheel_metadata.get_all(
+        "Root-Is-Purelib"
+    ) != ["true"]:
+        raise ValueError("Wheel must declare the universal pure-Python tag")
+
+    return {
+        "schemaVersion": SCHEMA_VERSION,
+        "component": component,
+        "repository": repository,
+        "packageName": metadata["Name"],
+        "packageVersion": metadata["Version"],
+        "filename": wheel.name,
+        "sha256": hashlib.sha256(wheel.read_bytes()).hexdigest(),
+        "source": {
+            "kind": "pull-request",
+            "number": pr_number,
+            "headRevision": head_revision,
+            "checkoutRevision": checkout_revision,
+            "runId": run_id,
+            "runAttempt": run_attempt,
+            "workflowPath": ".github/workflows/ci.yml",
+        },
+    }
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--component", choices=tuple(COMPONENTS), required=True)
+    parser.add_argument("--repository", required=True)
+    parser.add_argument("--pr-number", type=int, required=True)
+    parser.add_argument("--head-revision", required=True)
+    parser.add_argument("--run-id", type=int, required=True)
+    parser.add_argument("--run-attempt", type=int, required=True)
+    args = parser.parse_args()
+    root = Path(__file__).resolve().parents[1]
+    checkout_revision = subprocess.check_output(
+        ["git", "rev-parse", "HEAD"], cwd=root, text=True
+    ).strip()
+    manifest = build_manifest(
+        root,
+        args.component,
+        args.repository,
+        args.pr_number,
+        args.head_revision,
+        checkout_revision,
+        args.run_id,
+        args.run_attempt,
+    )
+    (root / "dist" / MANIFEST_FILENAME).write_text(
+        json.dumps(manifest, indent=2) + "\n", encoding="utf-8"
+    )
+
+
+if __name__ == "__main__":
+    main()

lightnow_cli-1.6.1/ci/test_client_artifact.py

@@ -0,0 +1,124 @@
+"""Offline provenance contract checks; no installation or external services."""
+
+import hashlib
+import tempfile
+import unittest
+import zipfile
+from pathlib import Path
+
+from create_client_artifact import build_manifest
+
+
+class ClientArtifactTests(unittest.TestCase):
+    def setUp(self) -> None:
+        self.directory = tempfile.TemporaryDirectory()
+        self.addCleanup(self.directory.cleanup)
+        self.root = Path(self.directory.name)
+        (self.root / "dist").mkdir()
+        (self.root / "pyproject.toml").write_text(
+            '[project]\nname = "lightnow-cli"\nversion = "1.2.3"\n'
+        )
+        self.wheel = self.root / "dist/lightnow_cli-1.2.3-py3-none-any.whl"
+        self.write_wheel()
+
+    def write_wheel(
+        self,
+        name: str = "lightnow-cli",
+        version: str = "1.2.3",
+        tag: str = "py3-none-any",
+    ) -> None:
+        with zipfile.ZipFile(self.wheel, "w") as archive:
+            archive.writestr(
+                "lightnow_cli-1.2.3.dist-info/METADATA",
+                f"Metadata-Version: 2.3\nName: {name}\nVersion: {version}\n",
+            )
+            archive.writestr(
+                "lightnow_cli-1.2.3.dist-info/WHEEL",
+                f"Wheel-Version: 1.0\nRoot-Is-Purelib: true\nTag: {tag}\n",
+            )
+
+    def manifest(self, **overrides: object) -> dict:
+        arguments = dict(
+            root=self.root,
+            component="cli",
+            repository="lightnow-ai/lightnow-cli",
+            pr_number=42,
+            head_revision="a" * 40,
+            checkout_revision="b" * 40,
+            run_id=123,
+            run_attempt=2,
+        )
+        arguments.update(overrides)
+        return build_manifest(**arguments)
+
+    def test_exact_contract_keeps_head_and_tested_checkout_separate(self) -> None:
+        self.assertEqual(
+            self.manifest(),
+            {
+                "schemaVersion": "platform.lightnow.ai/feature-stack-client-artifact/v1",
+                "component": "cli",
+                "repository": "lightnow-ai/lightnow-cli",
+                "packageName": "lightnow-cli",
+                "packageVersion": "1.2.3",
+                "filename": self.wheel.name,
+                "sha256": hashlib.sha256(self.wheel.read_bytes()).hexdigest(),
+                "source": {
+                    "kind": "pull-request",
+                    "number": 42,
+                    "headRevision": "a" * 40,
+                    "checkoutRevision": "b" * 40,
+                    "runId": 123,
+                    "runAttempt": 2,
+                    "workflowPath": ".github/workflows/ci.yml",
+                },
+            },
+        )
+
+    def test_rejects_unbound_identity(self) -> None:
+        for arguments in (
+            {"repository": "other/lightnow-cli"},
+            {"component": "proxy"},
+            {"head_revision": "a" * 7},
+            {"checkout_revision": "not-a-revision"},
+            {"pr_number": 0},
+            {"run_id": -1},
+            {"run_attempt": 0},
+        ):
+            with self.subTest(arguments=arguments), self.assertRaises(ValueError):
+                self.manifest(**arguments)
+
+    def test_rejects_metadata_or_platform_mismatch(self) -> None:
+        for arguments in (
+            {"name": "another-package"},
+            {"version": "9.0.0"},
+            {"tag": "cp312-cp312-linux_x86_64"},
+        ):
+            with self.subTest(arguments=arguments):
+                self.write_wheel(**arguments)
+                with self.assertRaises(ValueError):
+                    self.manifest()
+
+    def test_rejects_ambiguous_missing_or_symlinked_wheel(self) -> None:
+        extra = self.wheel.with_name("another.whl")
+        extra.write_bytes(self.wheel.read_bytes())
+        with self.assertRaises(ValueError):
+            self.manifest()
+        extra.unlink()
+        self.wheel.unlink()
+        with self.assertRaises(ValueError):
+            self.manifest()
+        self.wheel.symlink_to(self.root / "outside.whl")
+        with self.assertRaises(ValueError):
+            self.manifest()
+
+    def test_rejects_duplicate_distribution_metadata(self) -> None:
+        with zipfile.ZipFile(self.wheel, "a") as archive:
+            archive.writestr(
+                "other-1.0.dist-info/METADATA", "Name: other\nVersion: 1.0\n"
+            )
+        with self.assertRaises(ValueError):
+            self.manifest()
+
+
+if __name__ == "__main__":
+    unittest.main()

{lightnow_cli-1.5.0 → lightnow_cli-1.6.1}/docs/release.md

@@ -101,3 +101,26 @@ tag. If the project does not exist yet, use PyPI's pending publisher flow for
 ```bash
 python -m twine check dist/*
 ```
+
+## PR distribution provenance
+
+PR CI archives `feature-stack-client-artifact.json` alongside the wheel and
+source distribution in `python-distributions`. The manifest uses
+`platform.lightnow.ai/feature-stack-client-artifact/v1` and binds the universal
+wheel SHA-256 and its actual METADATA name/version to the PR number, head
+revision, tested checkout revision, workflow, run ID, and run attempt. The head
+and tested merge checkout are separate fields. Consumers must verify these
+bindings and the wheel checksum against the selected successful CI run before
+installing a candidate; the manifest itself is build metadata, not a signature
+or a runtime test result.
+
+The generator uses only Python's standard library. After a clean package build,
+run its focused offline contract checks with:
+
+```bash
+python -m unittest discover -s ci -p 'test_*.py'
+```
+
+Main CI does not fabricate PR metadata. Tagged release publishing is unchanged:
+release consumers qualify the exact Git tag and published PyPI wheel separately.
+The PR-only JSON never enters the existing PyPI release upload.

{lightnow_cli-1.5.0 → lightnow_cli-1.6.1}/lightnow_cli/__init__.py

@@ -1,3 +1,3 @@
 """LightNow CLI - A command-line tool for managing MCP servers."""
 
-__version__ = "1.5.0"  # x-release-please-version
+__version__ = "1.6.1"  # x-release-please-version