lightnow-cli 1.6.0__tar.gz → 1.6.1__tar.gz

{lightnow_cli-1.6.0 → lightnow_cli-1.6.1}/.github/workflows/ci.yml

@@ -73,8 +73,27 @@ jobs:
       - name: Build and check distributions
         run: make package
 
+      - name: Verify distribution provenance contract
+        run: python -m unittest discover -s ci -p 'test_*.py'
+
+      - name: Bind PR distribution provenance
+        if: github.event_name == 'pull_request'
+        env:
+          ARTIFACT_REPOSITORY: ${{ github.repository }}
+          ARTIFACT_PR_NUMBER: ${{ github.event.pull_request.number }}
+          ARTIFACT_HEAD_REVISION: ${{ github.event.pull_request.head.sha }}
+          ARTIFACT_RUN_ID: ${{ github.run_id }}
+          ARTIFACT_RUN_ATTEMPT: ${{ github.run_attempt }}
+        run: |
+          python ci/create_client_artifact.py --component cli \
+            --repository "$ARTIFACT_REPOSITORY" \
+            --pr-number "$ARTIFACT_PR_NUMBER" \
+            --head-revision "$ARTIFACT_HEAD_REVISION" \
+            --run-id "$ARTIFACT_RUN_ID" \
+            --run-attempt "$ARTIFACT_RUN_ATTEMPT"
+
       - name: Upload distributions
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: python-distributions
           path: dist/*

{lightnow_cli-1.6.0 → lightnow_cli-1.6.1}/.github/workflows/release.yml

@@ -51,7 +51,7 @@ jobs:
         run: make package
 
       - name: Upload distributions
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: python-distributions
           path: dist/*
@@ -66,7 +66,7 @@ jobs:
 
     steps:
       - name: Download distributions
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: python-distributions
           path: dist
@@ -89,7 +89,7 @@ jobs:
 
     steps:
       - name: Download distributions
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: python-distributions
           path: dist

lightnow_cli-1.6.1/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "1.6.1"
+}

{lightnow_cli-1.6.0 → lightnow_cli-1.6.1}/CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to the LightNow CLI are documented here.
 
 This project follows semantic versioning.
 
+## [1.6.1](https://github.com/lightnow-ai/lightnow-cli/compare/v1.6.0...v1.6.1) (2026-11-09)
+
+
+### Bug Fixes
+
+* **cli:** use active context for default favorites ([5399173](https://github.com/lightnow-ai/lightnow-cli/commit/539917321a8fbafedb05394841b5fadd0b5319e0))
+* **cli:** use active context for default favorites ([1ccba54](https://github.com/lightnow-ai/lightnow-cli/commit/1ccba543e34b236d449bdedeb644029c54f49f03))
+* **cli:** use active context for default favorites ([#45](https://github.com/lightnow-ai/lightnow-cli/issues/45)) ([5399173](https://github.com/lightnow-ai/lightnow-cli/commit/539917321a8fbafedb05394841b5fadd0b5319e0))
+
 ## [1.6.0](https://github.com/lightnow-ai/lightnow-cli/compare/v1.5.0...v1.6.0) (2026-10-09)
 
 

{lightnow_cli-1.6.0 → lightnow_cli-1.6.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: lightnow-cli
-Version: 1.6.0
+Version: 1.6.1
 Summary: Official LightNow CLI for MCP registry discovery, client config sync, and local MCP runner workflows
 Project-URL: Homepage, https://github.com/lightnow-ai/lightnow-cli
 Project-URL: Repository, https://github.com/lightnow-ai/lightnow-cli
@@ -176,7 +176,7 @@ Show details for one server:
 lightnow info io.github.SonarSource/sonarqube-mcp-server
 ```
 
-Show your favorites:
+Show favorites for the active personal or organization context:
 
 ```bash
 lightnow favorites

{lightnow_cli-1.6.0 → lightnow_cli-1.6.1}/README.md

@@ -128,7 +128,7 @@ Show details for one server:
 lightnow info io.github.SonarSource/sonarqube-mcp-server
 ```
 
-Show your favorites:
+Show favorites for the active personal or organization context:
 
 ```bash
 lightnow favorites

lightnow_cli-1.6.1/ci/create_client_artifact.py

@@ -0,0 +1,126 @@
+"""Bind a PR build to its tested checkout and one universal Python wheel."""
+
+import argparse
+import hashlib
+import json
+import re
+import subprocess
+import tomllib
+import zipfile
+from email.parser import Parser
+from pathlib import Path
+
+SCHEMA_VERSION = "platform.lightnow.ai/feature-stack-client-artifact/v1"
+MANIFEST_FILENAME = "feature-stack-client-artifact.json"
+COMPONENTS = {"cli": "lightnow-cli", "proxy": "lightnow-proxy"}
+
+
+def build_manifest(
+    root: Path,
+    component: str,
+    repository: str,
+    pr_number: int,
+    head_revision: str,
+    checkout_revision: str,
+    run_id: int,
+    run_attempt: int,
+) -> dict:
+    """Validate wheel contents and runner identity before creating provenance."""
+    package_name = COMPONENTS.get(component)
+    if package_name is None or repository != f"lightnow-ai/{package_name}":
+        raise ValueError("Component and repository do not match")
+    if any(value <= 0 for value in (pr_number, run_id, run_attempt)):
+        raise ValueError("PR number, run ID and run attempt must be positive")
+    if any(
+        re.fullmatch(r"[0-9a-f]{40}", value) is None
+        for value in (head_revision, checkout_revision)
+    ):
+        raise ValueError("Head and checkout revisions must be full Git SHA-1 values")
+
+    with (root / "pyproject.toml").open("rb") as project_file:
+        project = tomllib.load(project_file)["project"]
+    if project["name"] != package_name:
+        raise ValueError("Repository package metadata does not match component")
+
+    wheels = sorted((root / "dist").glob("*.whl"))
+    if len(wheels) != 1 or wheels[0].is_symlink() or not wheels[0].is_file():
+        raise ValueError("Exactly one regular wheel is required")
+    wheel = wheels[0]
+    wheel_package = package_name.replace("-", "_")
+    expected_filename = f"{wheel_package}-{project['version']}-py3-none-any.whl"
+    if wheel.name != expected_filename:
+        raise ValueError("Expected the repository's universal py3-none-any wheel")
+
+    prefix = f"{wheel_package}-{project['version']}.dist-info/"
+    with zipfile.ZipFile(wheel) as archive:
+        for name in (f"{prefix}METADATA", f"{prefix}WHEEL"):
+            if archive.namelist().count(name) != 1:
+                raise ValueError("Wheel metadata must be unique and match its filename")
+        metadata_files = [
+            name for name in archive.namelist() if name.endswith(".dist-info/METADATA")
+        ]
+        if metadata_files != [f"{prefix}METADATA"]:
+            raise ValueError("Wheel must contain exactly one distribution's metadata")
+        metadata = Parser().parsestr(archive.read(f"{prefix}METADATA").decode("utf-8"))
+        wheel_metadata = Parser().parsestr(
+            archive.read(f"{prefix}WHEEL").decode("utf-8")
+        )
+    if metadata.get_all("Name") != [package_name] or metadata.get_all("Version") != [
+        project["version"]
+    ]:
+        raise ValueError("Wheel METADATA name/version do not match repository metadata")
+    if wheel_metadata.get_all("Tag") != ["py3-none-any"] or wheel_metadata.get_all(
+        "Root-Is-Purelib"
+    ) != ["true"]:
+        raise ValueError("Wheel must declare the universal pure-Python tag")
+
+    return {
+        "schemaVersion": SCHEMA_VERSION,
+        "component": component,
+        "repository": repository,
+        "packageName": metadata["Name"],
+        "packageVersion": metadata["Version"],
+        "filename": wheel.name,
+        "sha256": hashlib.sha256(wheel.read_bytes()).hexdigest(),
+        "source": {
+            "kind": "pull-request",
+            "number": pr_number,
+            "headRevision": head_revision,
+            "checkoutRevision": checkout_revision,
+            "runId": run_id,
+            "runAttempt": run_attempt,
+            "workflowPath": ".github/workflows/ci.yml",
+        },
+    }
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--component", choices=tuple(COMPONENTS), required=True)
+    parser.add_argument("--repository", required=True)
+    parser.add_argument("--pr-number", type=int, required=True)
+    parser.add_argument("--head-revision", required=True)
+    parser.add_argument("--run-id", type=int, required=True)
+    parser.add_argument("--run-attempt", type=int, required=True)
+    args = parser.parse_args()
+    root = Path(__file__).resolve().parents[1]
+    checkout_revision = subprocess.check_output(
+        ["git", "rev-parse", "HEAD"], cwd=root, text=True
+    ).strip()
+    manifest = build_manifest(
+        root,
+        args.component,
+        args.repository,
+        args.pr_number,
+        args.head_revision,
+        checkout_revision,
+        args.run_id,
+        args.run_attempt,
+    )
+    (root / "dist" / MANIFEST_FILENAME).write_text(
+        json.dumps(manifest, indent=2) + "\n", encoding="utf-8"
+    )
+
+
+if __name__ == "__main__":
+    main()

lightnow_cli-1.6.1/ci/test_client_artifact.py

@@ -0,0 +1,124 @@
+"""Offline provenance contract checks; no installation or external services."""
+
+import hashlib
+import tempfile
+import unittest
+import zipfile
+from pathlib import Path
+
+from create_client_artifact import build_manifest
+
+
+class ClientArtifactTests(unittest.TestCase):
+    def setUp(self) -> None:
+        self.directory = tempfile.TemporaryDirectory()
+        self.addCleanup(self.directory.cleanup)
+        self.root = Path(self.directory.name)
+        (self.root / "dist").mkdir()
+        (self.root / "pyproject.toml").write_text(
+            '[project]\nname = "lightnow-cli"\nversion = "1.2.3"\n'
+        )
+        self.wheel = self.root / "dist/lightnow_cli-1.2.3-py3-none-any.whl"
+        self.write_wheel()
+
+    def write_wheel(
+        self,
+        name: str = "lightnow-cli",
+        version: str = "1.2.3",
+        tag: str = "py3-none-any",
+    ) -> None:
+        with zipfile.ZipFile(self.wheel, "w") as archive:
+            archive.writestr(
+                "lightnow_cli-1.2.3.dist-info/METADATA",
+                f"Metadata-Version: 2.3\nName: {name}\nVersion: {version}\n",
+            )
+            archive.writestr(
+                "lightnow_cli-1.2.3.dist-info/WHEEL",
+                f"Wheel-Version: 1.0\nRoot-Is-Purelib: true\nTag: {tag}\n",
+            )
+
+    def manifest(self, **overrides: object) -> dict:
+        arguments = dict(
+            root=self.root,
+            component="cli",
+            repository="lightnow-ai/lightnow-cli",
+            pr_number=42,
+            head_revision="a" * 40,
+            checkout_revision="b" * 40,
+            run_id=123,
+            run_attempt=2,
+        )
+        arguments.update(overrides)
+        return build_manifest(**arguments)
+
+    def test_exact_contract_keeps_head_and_tested_checkout_separate(self) -> None:
+        self.assertEqual(
+            self.manifest(),
+            {
+                "schemaVersion": "platform.lightnow.ai/feature-stack-client-artifact/v1",
+                "component": "cli",
+                "repository": "lightnow-ai/lightnow-cli",
+                "packageName": "lightnow-cli",
+                "packageVersion": "1.2.3",
+                "filename": self.wheel.name,
+                "sha256": hashlib.sha256(self.wheel.read_bytes()).hexdigest(),
+                "source": {
+                    "kind": "pull-request",
+                    "number": 42,
+                    "headRevision": "a" * 40,
+                    "checkoutRevision": "b" * 40,
+                    "runId": 123,
+                    "runAttempt": 2,
+                    "workflowPath": ".github/workflows/ci.yml",
+                },
+            },
+        )
+
+    def test_rejects_unbound_identity(self) -> None:
+        for arguments in (
+            {"repository": "other/lightnow-cli"},
+            {"component": "proxy"},
+            {"head_revision": "a" * 7},
+            {"checkout_revision": "not-a-revision"},
+            {"pr_number": 0},
+            {"run_id": -1},
+            {"run_attempt": 0},
+        ):
+            with self.subTest(arguments=arguments), self.assertRaises(ValueError):
+                self.manifest(**arguments)
+
+    def test_rejects_metadata_or_platform_mismatch(self) -> None:
+        for arguments in (
+            {"name": "another-package"},
+            {"version": "9.0.0"},
+            {"tag": "cp312-cp312-linux_x86_64"},
+        ):
+            with self.subTest(arguments=arguments):
+                self.write_wheel(**arguments)
+                with self.assertRaises(ValueError):
+                    self.manifest()
+
+    def test_rejects_ambiguous_missing_or_symlinked_wheel(self) -> None:
+        extra = self.wheel.with_name("another.whl")
+        extra.write_bytes(self.wheel.read_bytes())
+        with self.assertRaises(ValueError):
+            self.manifest()
+        extra.unlink()
+        self.wheel.unlink()
+        with self.assertRaises(ValueError):
+            self.manifest()
+        self.wheel.symlink_to(self.root / "outside.whl")
+        with self.assertRaises(ValueError):
+            self.manifest()
+
+    def test_rejects_duplicate_distribution_metadata(self) -> None:
+        with zipfile.ZipFile(self.wheel, "a") as archive:
+            archive.writestr(
+                "other-1.0.dist-info/METADATA", "Name: other\nVersion: 1.0\n"
+            )
+        with self.assertRaises(ValueError):
+            self.manifest()
+
+
+if __name__ == "__main__":
+    unittest.main()

{lightnow_cli-1.6.0 → lightnow_cli-1.6.1}/docs/release.md

@@ -101,3 +101,26 @@ tag. If the project does not exist yet, use PyPI's pending publisher flow for
 ```bash
 python -m twine check dist/*
 ```
+
+## PR distribution provenance
+
+PR CI archives `feature-stack-client-artifact.json` alongside the wheel and
+source distribution in `python-distributions`. The manifest uses
+`platform.lightnow.ai/feature-stack-client-artifact/v1` and binds the universal
+wheel SHA-256 and its actual METADATA name/version to the PR number, head
+revision, tested checkout revision, workflow, run ID, and run attempt. The head
+and tested merge checkout are separate fields. Consumers must verify these
+bindings and the wheel checksum against the selected successful CI run before
+installing a candidate; the manifest itself is build metadata, not a signature
+or a runtime test result.
+
+The generator uses only Python's standard library. After a clean package build,
+run its focused offline contract checks with:
+
+```bash
+python -m unittest discover -s ci -p 'test_*.py'
+```
+
+Main CI does not fabricate PR metadata. Tagged release publishing is unchanged:
+release consumers qualify the exact Git tag and published PyPI wheel separately.
+The PR-only JSON never enters the existing PyPI release upload.

{lightnow_cli-1.6.0 → lightnow_cli-1.6.1}/lightnow_cli/__init__.py

@@ -1,3 +1,3 @@
 """LightNow CLI - A command-line tool for managing MCP servers."""
 
-__version__ = "1.6.0"  # x-release-please-version
+__version__ = "1.6.1"  # x-release-please-version

{lightnow_cli-1.6.0 → lightnow_cli-1.6.1}/lightnow_cli/commands/query.py

@@ -74,7 +74,7 @@ def favorite_servers(
             "--scope",
             help="Favorite scope: effective, user, tenant, system, or true.",
         ),
-    ] = "user",
+    ] = "effective",
     sort: Annotated[
         Optional[str],
         typer.Option("--sort", help="Sort order supported by the Registry API."),

{lightnow_cli-1.6.0 → lightnow_cli-1.6.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "lightnow-cli"
-version = "1.6.0"
+version = "1.6.1"
 description = "Official LightNow CLI for MCP registry discovery, client config sync, and local MCP runner workflows"
 authors = [{name = "LightNow Team"}]
 license = {text = "Apache-2.0"}

{lightnow_cli-1.6.0 → lightnow_cli-1.6.1}/renovate.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "github>apitree/renovate:python#v1.0.2",
-    "github>apitree/renovate:docker#v1.0.2",
+    "github>apitree/renovate:python",
+    "github>apitree/renovate:docker",
     "helpers:pinGitHubActionDigests",
     "default:automergeDigest",
     ":automergeStableNonMajor",

{lightnow_cli-1.6.0 → lightnow_cli-1.6.1}/tests/test_cli.py

@@ -17,6 +17,7 @@ from lightnow_cli.config import (
     LOCAL_ADMIN_API_URL,
     LOCAL_ISSUER,
     LOCAL_REGISTRY_API_URL,
+    ConfigManager,
 )
 from lightnow_cli.main import app
 from lightnow_cli.target import ConnectionTarget
@@ -335,6 +336,47 @@ def test_favorites_command_passes_tenant_context(runner):
     assert fake_client.list_servers.call_args.kwargs["tenant"] == "acme"
 
 
+@pytest.mark.parametrize("tenant_id", [None, "active-organization"])
+def test_favorites_default_uses_selected_context(runner, tmp_path, tenant_id):
+    """The default list must follow actual persisted personal/organization context."""
+    manager = ConfigManager()
+    manager.config_dir = tmp_path / ".lightnow"
+    manager.config_file = manager.config_dir / "config.json"
+    if tenant_id is None:
+        manager.set_personal_context()
+    else:
+        manager.set_tenant_context(tenant_id, "Selected organization")
+    fake_client = MagicMock()
+    fake_client.list_servers = AsyncMock(return_value={"servers": []})
+    with (
+        patch("lightnow_cli.commands.query.config_manager", manager),
+        patch("lightnow_cli.commands.query.get_client", return_value=fake_client),
+    ):
+        result = runner.invoke(app, ["favorites"])
+    assert result.exit_code == 0
+    assert fake_client.list_servers.call_args.kwargs["favorites"] == "effective"
+    assert fake_client.list_servers.call_args.kwargs["tenant"] == tenant_id
+
+
+@pytest.mark.parametrize("scope", ["user", "tenant", "system", "effective", "true"])
+def test_favorites_explicit_scope_is_not_silently_replaced(runner, tmp_path, scope):
+    """Explicit scope flags do not silently change the active organization."""
+    manager = ConfigManager()
+    manager.config_dir = tmp_path / ".lightnow"
+    manager.config_file = manager.config_dir / "config.json"
+    manager.set_tenant_context("active-organization", "Selected organization")
+    fake_client = MagicMock()
+    fake_client.list_servers = AsyncMock(return_value={"servers": []})
+    with (
+        patch("lightnow_cli.commands.query.config_manager", manager),
+        patch("lightnow_cli.commands.query.get_client", return_value=fake_client),
+    ):
+        result = runner.invoke(app, ["favorites", "--scope", scope])
+    assert result.exit_code == 0
+    assert fake_client.list_servers.call_args.kwargs["favorites"] == scope
+    assert fake_client.list_servers.call_args.kwargs["tenant"] == "active-organization"
+
+
 def test_info_command_passes_tenant_context(runner):
     """Server info supports organization context from the public CLI surface."""
     fake_client = MagicMock()
@@ -847,12 +889,12 @@ def test_favorites_command_empty(mock_list_servers, runner):
 
     assert result.exit_code == 0
     assert "No favorite servers found" in result.stdout
-    assert mock_list_servers.call_args.kwargs["favorites"] == "user"
+    assert mock_list_servers.call_args.kwargs["favorites"] == "effective"
 
 
 @patch("lightnow_cli.client.MCPRegistryClient.list_servers")
 def test_favorites_command_allows_effective_scope(mock_list_servers, runner):
-    """Effective favorites remain available as an explicit combined view."""
+    """Explicit effective scope remains bound to the selected context."""
     mock_list_servers.return_value = {"servers": [], "metadata": {"count": 0}}
 
     result = runner.invoke(app, ["favorites", "--scope", "effective"])

lightnow_cli-1.6.0/.release-please-manifest.json

@@ -1,3 +0,0 @@
-{
-  ".": "1.6.0"
-}