luthien-cli 0.1.0__tar.gz

luthien_cli-0.1.0/.gitignore

@@ -0,0 +1,61 @@
+# Python-generated files
+__pycache__/
+*.py[oc]
+build/
+dist/
+wheels/
+*.egg-info
+.coverage
+.coverage.cavil.*
+coverage.json
+
+# Virtual environments
+.venv
+
+# Logs
+logs/
+
+# Secrets
+.env
+.env.*
+!.env.example
+
+# Development cache files
+.dev_deps_synced
+.last_update
+scratch/
+_scratch/
+
+# Replay callback exports
+dev/replay_logs*.jsonl
+dev/litellm_replay_logs/
+
+# Observability runtime data
+observability/data/
+
+# Test/debug output
+debug_multitool_streaming.json
+debug_multitool_nonstreaming.json
+
+# macOS
+.DS_Store
+.AppleDouble
+.LSOverride
+
+# IDEs
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# Python tools cache
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+.pytype/
+
+# worktree meta
+.worktree-purpose
+.playwright-mcp/
+.worktrees/

luthien_cli-0.1.0/PKG-INFO

@@ -0,0 +1,13 @@
+Metadata-Version: 2.4
+Name: luthien-cli
+Version: 0.1.0
+Summary: CLI tool for managing luthien-proxy gateways
+Requires-Python: >=3.11
+Requires-Dist: click>=8.1.0
+Requires-Dist: httpx>=0.27.0
+Requires-Dist: rich>=13.0.0
+Requires-Dist: tomli-w>=1.0.0
+Provides-Extra: dev
+Requires-Dist: pytest-cov>=4.0; extra == 'dev'
+Requires-Dist: pytest-httpx>=0.35.0; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'

luthien_cli-0.1.0/README.md

@@ -0,0 +1,61 @@
+# Luthien CLI
+
+A standalone CLI tool for managing and interacting with [luthien-proxy](https://github.com/LuthienResearch/luthien-proxy) gateways.
+
+## Install
+
+```bash
+pipx install luthien-cli
+# or for development:
+pip install -e ".[dev]"
+```
+
+## Quick Start
+
+```bash
+# Configure your gateway
+luthien config set gateway.url http://localhost:8000
+luthien config set gateway.api_key sk-your-proxy-key
+luthien config set gateway.admin_key admin-your-key
+
+# Check gateway status
+luthien status
+
+# Launch Claude Code through the proxy
+luthien claude
+luthien claude -- --model opus
+
+# Manage local stack (requires repo_path)
+luthien config set local.repo_path /path/to/luthien-proxy
+luthien up
+luthien logs -f
+luthien down
+```
+
+## Commands
+
+| Command | Description |
+|---------|-------------|
+| `luthien status` | Show gateway health, active policy, and auth mode |
+| `luthien claude [args...]` | Launch Claude Code routed through the gateway |
+| `luthien up [--follow]` | Start the local docker-compose stack |
+| `luthien down` | Stop the local stack |
+| `luthien logs [-f] [-n N]` | View gateway logs |
+| `luthien config show` | Display current configuration |
+| `luthien config set <key> <value>` | Update a config value |
+
+## Configuration
+
+Config is stored at `~/.luthien/config.toml`:
+
+```toml
+[gateway]
+url = "http://localhost:8000"
+api_key = "sk-your-proxy-key"
+admin_key = "admin-your-key"
+
+[local]
+repo_path = "/path/to/luthien-proxy"
+```
+
+Config keys: `gateway.url`, `gateway.api_key`, `gateway.admin_key`, `local.repo_path`

luthien_cli-0.1.0/pyproject.toml

@@ -0,0 +1,31 @@
+[project]
+name = "luthien-cli"
+version = "0.1.0"
+description = "CLI tool for managing luthien-proxy gateways"
+requires-python = ">=3.11"
+dependencies = [
+    "click>=8.1.0",
+    "httpx>=0.27.0",
+    "tomli-w>=1.0.0",
+    "rich>=13.0.0",
+]
+
+[project.scripts]
+luthien = "luthien_cli.main:cli"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/luthien_cli"]
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=8.0",
+    "pytest-cov>=4.0",
+    "pytest-httpx>=0.35.0",
+]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

luthien_cli-0.1.0/src/luthien_cli/commands/claude.py

@@ -0,0 +1,45 @@
+"""luthien claude -- launch Claude Code through the gateway."""
+
+from __future__ import annotations
+
+import os
+import shutil
+
+import click
+from rich.console import Console
+
+from luthien_cli.config import DEFAULT_CONFIG_PATH, load_config
+
+
+@click.command(context_settings={"ignore_unknown_options": True})
+@click.argument("claude_args", nargs=-1, type=click.UNPROCESSED)
+def claude(claude_args: tuple[str, ...]):
+    """Launch Claude Code routed through the configured gateway.
+
+    All arguments after 'claude' are passed through to Claude Code.
+    """
+    console = Console()
+    config = load_config(DEFAULT_CONFIG_PATH)
+
+    if not config.api_key:
+        console.print(
+            "[red]No API key configured. Run: luthien config set gateway.api_key <key>[/red]"
+        )
+        raise SystemExit(1)
+
+    claude_path = shutil.which("claude")
+    if not claude_path:
+        console.print(
+            "[red]Claude Code CLI not found. Install: npm install -g @anthropic-ai/claude-cli[/red]"
+        )
+        raise SystemExit(1)
+
+    gateway_url = config.gateway_url.rstrip("/") + "/"
+
+    env = os.environ.copy()
+    env["ANTHROPIC_BASE_URL"] = gateway_url
+    env["ANTHROPIC_API_KEY"] = config.api_key
+
+    console.print(f"[blue]Routing Claude Code through {config.gateway_url}[/blue]")
+
+    os.execvpe("claude", ["claude", *claude_args], env)

luthien_cli-0.1.0/src/luthien_cli/commands/config_cmd.py

@@ -0,0 +1,65 @@
+"""luthien config -- view and edit CLI configuration."""
+
+from __future__ import annotations
+
+import click
+from rich.console import Console
+from rich.table import Table
+
+from luthien_cli.config import DEFAULT_CONFIG_PATH, load_config, save_config
+
+FIELD_MAP = {
+    "gateway.url": "gateway_url",
+    "gateway.api_key": "api_key",
+    "gateway.admin_key": "admin_key",
+    "local.repo_path": "repo_path",
+}
+
+
+@click.group()
+def config():
+    """View or edit luthien CLI configuration."""
+
+
+@config.command()
+def show():
+    """Display current configuration."""
+    console = Console()
+    cfg = load_config(DEFAULT_CONFIG_PATH)
+
+    table = Table(title=f"Config ({DEFAULT_CONFIG_PATH})")
+    table.add_column("Key", style="bold")
+    table.add_column("Value")
+
+    table.add_row("gateway.url", cfg.gateway_url)
+    table.add_row("gateway.api_key", _mask(cfg.api_key))
+    table.add_row("gateway.admin_key", _mask(cfg.admin_key))
+    table.add_row("local.repo_path", cfg.repo_path or "[dim]not set[/dim]")
+
+    console.print(table)
+
+
+@config.command("set")
+@click.argument("key")
+@click.argument("value")
+def set_value(key: str, value: str):
+    """Set a config value. Keys: gateway.url, gateway.api_key, gateway.admin_key, local.repo_path"""
+    console = Console()
+    cfg = load_config(DEFAULT_CONFIG_PATH)
+
+    if key not in FIELD_MAP:
+        console.print(f"[red]Unknown key: {key}[/red]")
+        console.print(f"Valid keys: {', '.join(FIELD_MAP.keys())}")
+        raise SystemExit(1)
+
+    setattr(cfg, FIELD_MAP[key], value)
+    save_config(cfg, DEFAULT_CONFIG_PATH)
+    console.print(f"[green]Set {key} = {value}[/green]")
+
+
+def _mask(value: str | None) -> str:
+    if not value:
+        return "[dim]not set[/dim]"
+    if len(value) <= 8:
+        return "****"
+    return value[:4] + "..." + value[-4:]

luthien_cli-0.1.0/src/luthien_cli/commands/logs.py

@@ -0,0 +1,33 @@
+"""luthien logs -- view gateway logs."""
+
+from __future__ import annotations
+
+import subprocess
+
+import click
+from rich.console import Console
+
+from luthien_cli.config import DEFAULT_CONFIG_PATH, load_config
+
+
+@click.command()
+@click.option("--tail", "-n", default=None, type=int, help="Number of lines to show")
+@click.option("--follow", "-f", is_flag=True, help="Follow log output")
+def logs(tail: int | None, follow: bool):
+    """View gateway logs (requires local repo_path configured)."""
+    console = Console()
+    config = load_config(DEFAULT_CONFIG_PATH)
+
+    if not config.repo_path:
+        console.print(
+            "[red]No repo_path configured. Set it with: luthien config set local.repo_path <path>[/red]"
+        )
+        raise SystemExit(1)
+
+    cmd = ["docker", "compose", "logs", "gateway"]
+    if tail is not None:
+        cmd.extend(["--tail", str(tail)])
+    if follow:
+        cmd.append("-f")
+
+    subprocess.run(cmd, cwd=config.repo_path)

luthien_cli-0.1.0/src/luthien_cli/commands/status.py

@@ -0,0 +1,53 @@
+"""luthien status -- show gateway state."""
+
+import click
+from rich.console import Console
+from rich.table import Table
+
+from luthien_cli.config import load_config
+from luthien_cli.gateway_client import GatewayClient, GatewayError
+
+
+def make_client() -> GatewayClient:
+    config = load_config()
+    return GatewayClient(
+        base_url=config.gateway_url,
+        api_key=config.api_key,
+        admin_key=config.admin_key,
+    )
+
+
+@click.command()
+def status():
+    """Show gateway health, active policy, and auth mode."""
+    console = Console()
+    client = make_client()
+
+    try:
+        health = client.health()
+    except GatewayError as e:
+        console.print(f"[red]{e}[/red]")
+        raise SystemExit(1)
+
+    table = Table(title="Gateway Status")
+    table.add_column("Property", style="bold")
+    table.add_column("Value")
+
+    table.add_row("URL", client.base_url)
+    table.add_row("Status", f"[green]{health['status']}[/green]")
+    table.add_row("Version", health.get("version", "unknown"))
+
+    try:
+        policy = client.get_current_policy()
+        table.add_row("Policy", policy["policy"])
+        table.add_row("Policy Class", policy["class_ref"])
+    except GatewayError:
+        table.add_row("Policy", "[yellow]unavailable (no admin key?)[/yellow]")
+
+    try:
+        auth = client.get_auth_config()
+        table.add_row("Auth Mode", auth["auth_mode"])
+    except GatewayError:
+        table.add_row("Auth Mode", "[yellow]unavailable[/yellow]")
+
+    console.print(table)

luthien_cli-0.1.0/src/luthien_cli/commands/up.py

@@ -0,0 +1,89 @@
+"""luthien up/down -- manage local docker-compose stack."""
+
+from __future__ import annotations
+
+import subprocess
+import time
+
+import click
+import httpx
+from rich.console import Console
+
+from luthien_cli.config import DEFAULT_CONFIG_PATH, load_config, save_config
+
+
+def wait_for_healthy(url: str, timeout: int = 60) -> bool:
+    """Poll gateway /health until it responds or timeout."""
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        try:
+            r = httpx.get(f"{url}/health", timeout=5.0)
+            if r.status_code == 200:
+                return True
+        except (httpx.ConnectError, httpx.TimeoutException):
+            pass
+        time.sleep(2)
+    return False
+
+
+@click.command()
+@click.option("--follow", "-f", is_flag=True, help="Tail gateway logs after startup")
+def up(follow: bool):
+    """Start the local luthien-proxy stack (db, redis, gateway)."""
+    console = Console()
+    config = load_config(DEFAULT_CONFIG_PATH)
+
+    if not config.repo_path:
+        repo = click.prompt("Path to luthien-proxy repo", type=str)
+        config.repo_path = repo
+        save_config(config, DEFAULT_CONFIG_PATH)
+
+    console.print(f"[blue]Starting stack in {config.repo_path}[/blue]")
+
+    result = subprocess.run(
+        ["docker", "compose", "up", "-d"],
+        cwd=config.repo_path,
+        capture_output=True,
+        text=True,
+    )
+    if result.returncode != 0:
+        console.print(f"[red]docker compose up failed:[/red]\n{result.stderr}")
+        raise SystemExit(1)
+
+    console.print("[yellow]Waiting for gateway to be healthy...[/yellow]")
+    if wait_for_healthy(config.gateway_url):
+        console.print(f"[green]Gateway is healthy at {config.gateway_url}[/green]")
+    else:
+        console.print("[red]Gateway did not become healthy within 60s[/red]")
+        raise SystemExit(1)
+
+    if follow:
+        subprocess.run(
+            ["docker", "compose", "logs", "-f", "gateway"],
+            cwd=config.repo_path,
+        )
+
+
+@click.command()
+def down():
+    """Stop the local luthien-proxy stack."""
+    console = Console()
+    config = load_config(DEFAULT_CONFIG_PATH)
+
+    if not config.repo_path:
+        console.print("[red]No repo_path configured. Nothing to stop.[/red]")
+        raise SystemExit(1)
+
+    console.print(f"[blue]Stopping stack in {config.repo_path}[/blue]")
+
+    result = subprocess.run(
+        ["docker", "compose", "down"],
+        cwd=config.repo_path,
+        capture_output=True,
+        text=True,
+    )
+    if result.returncode != 0:
+        console.print(f"[red]docker compose down failed:[/red]\n{result.stderr}")
+        raise SystemExit(1)
+
+    console.print("[green]Stack stopped.[/green]")

luthien_cli-0.1.0/src/luthien_cli/config.py

@@ -0,0 +1,60 @@
+"""Config management for ~/.luthien/config.toml."""
+
+from __future__ import annotations
+
+import tomllib
+from dataclasses import dataclass
+from pathlib import Path
+
+import tomli_w
+
+DEFAULT_CONFIG_DIR = Path.home() / ".luthien"
+DEFAULT_CONFIG_PATH = DEFAULT_CONFIG_DIR / "config.toml"
+
+
+@dataclass
+class LuthienConfig:
+    gateway_url: str = "http://localhost:8000"
+    api_key: str | None = None
+    admin_key: str | None = None
+    repo_path: str | None = None
+
+
+def load_config(path: Path = DEFAULT_CONFIG_PATH) -> LuthienConfig:
+    """Load config from TOML file. Returns defaults if file doesn't exist."""
+    if not path.exists():
+        return LuthienConfig()
+
+    with open(path, "rb") as f:
+        data = tomllib.load(f)
+
+    gateway = data.get("gateway", {})
+    local = data.get("local", {})
+
+    return LuthienConfig(
+        gateway_url=gateway.get("url", "http://localhost:8000"),
+        api_key=gateway.get("api_key"),
+        admin_key=gateway.get("admin_key"),
+        repo_path=local.get("repo_path"),
+    )
+
+
+def save_config(config: LuthienConfig, path: Path = DEFAULT_CONFIG_PATH) -> None:
+    """Save config to TOML file. Creates parent directories if needed."""
+    path.parent.mkdir(parents=True, exist_ok=True)
+
+    data: dict = {
+        "gateway": {
+            "url": config.gateway_url,
+        },
+        "local": {},
+    }
+    if config.api_key:
+        data["gateway"]["api_key"] = config.api_key
+    if config.admin_key:
+        data["gateway"]["admin_key"] = config.admin_key
+    if config.repo_path:
+        data["local"]["repo_path"] = config.repo_path
+
+    with open(path, "wb") as f:
+        tomli_w.dump(data, f)

luthien_cli-0.1.0/src/luthien_cli/gateway_client.py

@@ -0,0 +1,51 @@
+"""HTTP client for luthien-proxy gateway APIs."""
+
+from __future__ import annotations
+
+from typing import Any
+
+import httpx
+
+
+class GatewayError(Exception):
+    """Error communicating with gateway."""
+
+
+class GatewayClient:
+    """Thin HTTP client for gateway admin/health APIs."""
+
+    def __init__(self, base_url: str, api_key: str | None = None, admin_key: str | None = None):
+        self.base_url = base_url.rstrip("/")
+        self.api_key = api_key
+        self.admin_key = admin_key
+
+    def _admin_headers(self) -> dict[str, str]:
+        headers: dict[str, str] = {}
+        if self.admin_key:
+            headers["x-admin-key"] = self.admin_key
+        return headers
+
+    def _get(self, path: str, admin: bool = False) -> dict[str, Any]:
+        headers = self._admin_headers() if admin else {}
+        try:
+            response = httpx.get(f"{self.base_url}{path}", headers=headers, timeout=10.0)
+        except httpx.ConnectError:
+            raise GatewayError(f"Cannot connect to gateway at {self.base_url}")
+        except httpx.TimeoutException:
+            raise GatewayError(f"Gateway at {self.base_url} timed out")
+
+        if response.status_code == 401:
+            raise GatewayError("Authentication failed — check your admin_key")
+        if response.status_code == 403:
+            raise GatewayError("Forbidden — admin access required")
+        response.raise_for_status()
+        return response.json()
+
+    def health(self) -> dict[str, Any]:
+        return self._get("/health")
+
+    def get_current_policy(self) -> dict[str, Any]:
+        return self._get("/api/admin/policy/current", admin=True)
+
+    def get_auth_config(self) -> dict[str, Any]:
+        return self._get("/api/admin/auth/config", admin=True)

luthien_cli-0.1.0/src/luthien_cli/main.py

@@ -0,0 +1,27 @@
+"""CLI entry point."""
+
+import click
+
+
+@click.group()
+@click.version_option(version="0.1.0")
+def cli():
+    """Luthien -- manage and interact with luthien-proxy gateways."""
+
+
+from luthien_cli.commands.claude import claude
+from luthien_cli.commands.config_cmd import config
+from luthien_cli.commands.logs import logs
+from luthien_cli.commands.status import status
+from luthien_cli.commands.up import down, up
+
+cli.add_command(claude)
+cli.add_command(config)
+cli.add_command(down)
+cli.add_command(logs)
+cli.add_command(status)
+cli.add_command(up)
+
+
+if __name__ == "__main__":
+    cli()

luthien_cli-0.1.0/tests/test_claude.py

@@ -0,0 +1,55 @@
+"""Tests for claude command."""
+
+from unittest.mock import patch
+
+from click.testing import CliRunner
+
+from luthien_cli.main import cli
+
+
+def test_claude_sets_env_and_execs(tmp_path):
+    runner = CliRunner()
+    config_path = tmp_path / "config.toml"
+    config_path.write_text(
+        '[gateway]\nurl = "http://localhost:9000"\napi_key = "sk-proxy"\n'
+    )
+    with (
+        patch("luthien_cli.commands.claude.DEFAULT_CONFIG_PATH", config_path),
+        patch("luthien_cli.commands.claude.shutil.which", return_value="/usr/bin/claude"),
+        patch("os.execvpe") as mock_exec,
+    ):
+        result = runner.invoke(cli, ["claude", "--", "--model", "opus"])
+        mock_exec.assert_called_once()
+        call_args = mock_exec.call_args
+        assert call_args[0][0] == "claude"
+        env = call_args[0][2]
+        assert env["ANTHROPIC_BASE_URL"] == "http://localhost:9000/"
+        assert env["ANTHROPIC_API_KEY"] == "sk-proxy"
+
+
+def test_claude_fails_when_not_installed(tmp_path):
+    runner = CliRunner()
+    config_path = tmp_path / "config.toml"
+    config_path.write_text(
+        '[gateway]\nurl = "http://localhost:8000"\napi_key = "sk-test"\n'
+    )
+    with (
+        patch("luthien_cli.commands.claude.DEFAULT_CONFIG_PATH", config_path),
+        patch("luthien_cli.commands.claude.shutil.which", return_value=None),
+    ):
+        result = runner.invoke(cli, ["claude"])
+        assert result.exit_code != 0
+        assert (
+            "not found" in result.output.lower()
+            or "not installed" in result.output.lower()
+        )
+
+
+def test_claude_fails_without_api_key(tmp_path):
+    runner = CliRunner()
+    config_path = tmp_path / "config.toml"
+    config_path.write_text('[gateway]\nurl = "http://localhost:8000"\n')
+    with patch("luthien_cli.commands.claude.DEFAULT_CONFIG_PATH", config_path):
+        result = runner.invoke(cli, ["claude"])
+        assert result.exit_code != 0
+        assert "api key" in result.output.lower() or "api_key" in result.output.lower()

luthien_cli-0.1.0/tests/test_config.py

@@ -0,0 +1,53 @@
+"""Tests for config module."""
+
+from pathlib import Path
+
+import pytest
+
+from luthien_cli.config import LuthienConfig, load_config, save_config
+
+
+@pytest.fixture
+def config_dir(tmp_path):
+    """Use a temp dir for config instead of ~/.luthien/."""
+    config_path = tmp_path / "config.toml"
+    return tmp_path, config_path
+
+
+def test_load_config_returns_defaults_when_no_file(config_dir):
+    _, config_path = config_dir
+    config = load_config(config_path)
+    assert config.gateway_url == "http://localhost:8000"
+    assert config.api_key is None
+    assert config.admin_key is None
+    assert config.repo_path is None
+
+
+def test_save_and_load_roundtrip(config_dir):
+    _, config_path = config_dir
+    config = LuthienConfig(
+        gateway_url="http://remote:9000",
+        api_key="sk-test",
+        admin_key="admin-test",
+        repo_path="/home/user/luthien-proxy",
+    )
+    save_config(config, config_path)
+    loaded = load_config(config_path)
+    assert loaded.gateway_url == "http://remote:9000"
+    assert loaded.api_key == "sk-test"
+    assert loaded.admin_key == "admin-test"
+    assert loaded.repo_path == "/home/user/luthien-proxy"
+
+
+def test_save_creates_parent_directory(tmp_path):
+    config_path = tmp_path / "subdir" / "config.toml"
+    config = LuthienConfig()
+    save_config(config, config_path)
+    assert config_path.exists()
+
+
+def test_load_config_ignores_unknown_keys(config_dir):
+    _, config_path = config_dir
+    config_path.write_text('[gateway]\nurl = "http://x"\nfoo = "bar"\n')
+    config = load_config(config_path)
+    assert config.gateway_url == "http://x"

luthien_cli-0.1.0/tests/test_config_cmd.py

@@ -0,0 +1,56 @@
+"""Tests for config command."""
+
+from unittest.mock import patch
+
+from click.testing import CliRunner
+
+from luthien_cli.main import cli
+
+
+def test_config_show_displays_config(tmp_path):
+    config_path = tmp_path / "config.toml"
+    config_path.write_text(
+        '[gateway]\nurl = "http://localhost:9000"\napi_key = "sk-test"\n'
+    )
+    runner = CliRunner()
+    with patch("luthien_cli.commands.config_cmd.DEFAULT_CONFIG_PATH", config_path):
+        result = runner.invoke(cli, ["config", "show"])
+        assert result.exit_code == 0
+        assert "localhost:9000" in result.output
+
+
+def test_config_set_updates_value(tmp_path):
+    config_path = tmp_path / "config.toml"
+    config_path.write_text('[gateway]\nurl = "http://localhost:8000"\n')
+    runner = CliRunner()
+    with patch("luthien_cli.commands.config_cmd.DEFAULT_CONFIG_PATH", config_path):
+        result = runner.invoke(
+            cli, ["config", "set", "gateway.url", "http://remote:9000"]
+        )
+        assert result.exit_code == 0
+    with patch("luthien_cli.commands.config_cmd.DEFAULT_CONFIG_PATH", config_path):
+        result = runner.invoke(cli, ["config", "show"])
+        assert "remote:9000" in result.output
+
+
+def test_config_set_rejects_unknown_key(tmp_path):
+    config_path = tmp_path / "config.toml"
+    config_path.write_text('[gateway]\nurl = "http://localhost:8000"\n')
+    runner = CliRunner()
+    with patch("luthien_cli.commands.config_cmd.DEFAULT_CONFIG_PATH", config_path):
+        result = runner.invoke(cli, ["config", "set", "bogus.key", "value"])
+        assert result.exit_code != 0
+        assert "unknown" in result.output.lower()
+
+
+def test_config_show_masks_api_key(tmp_path):
+    config_path = tmp_path / "config.toml"
+    config_path.write_text(
+        '[gateway]\nurl = "http://localhost:8000"\napi_key = "sk-very-long-secret-key"\n'
+    )
+    runner = CliRunner()
+    with patch("luthien_cli.commands.config_cmd.DEFAULT_CONFIG_PATH", config_path):
+        result = runner.invoke(cli, ["config", "show"])
+        assert result.exit_code == 0
+        assert "sk-very-long-secret-key" not in result.output
+        assert "sk-v" in result.output

luthien_cli-0.1.0/tests/test_gateway_client.py

@@ -0,0 +1,55 @@
+"""Tests for gateway client."""
+
+import httpx
+import pytest
+
+from luthien_cli.gateway_client import GatewayClient, GatewayError
+
+
+@pytest.fixture
+def client():
+    return GatewayClient(
+        base_url="http://localhost:8000",
+        api_key="sk-test",
+        admin_key="admin-test",
+    )
+
+
+def test_health_success(client, httpx_mock):
+    httpx_mock.add_response(
+        url="http://localhost:8000/health",
+        json={"status": "healthy", "version": "2.0.0"},
+    )
+    result = client.health()
+    assert result["status"] == "healthy"
+
+
+def test_health_connection_error(client, httpx_mock):
+    httpx_mock.add_exception(httpx.ConnectError("refused"))
+    with pytest.raises(GatewayError, match="Cannot connect"):
+        client.health()
+
+
+def test_get_current_policy(client, httpx_mock):
+    httpx_mock.add_response(
+        url="http://localhost:8000/api/admin/policy/current",
+        json={
+            "policy": "NoOpPolicy",
+            "class_ref": "luthien_proxy.policies.noop_policy:NoOpPolicy",
+            "enabled_at": "2026-03-03T10:00:00",
+            "enabled_by": "api",
+            "config": {},
+        },
+    )
+    result = client.get_current_policy()
+    assert result["policy"] == "NoOpPolicy"
+
+
+def test_get_auth_config(client, httpx_mock):
+    httpx_mock.add_response(
+        url="http://localhost:8000/api/admin/auth/config",
+        json={"auth_mode": "both", "validate_credentials": True,
+              "valid_cache_ttl_seconds": 300, "invalid_cache_ttl_seconds": 60},
+    )
+    result = client.get_auth_config()
+    assert result["auth_mode"] == "both"

luthien_cli-0.1.0/tests/test_integration.py

@@ -0,0 +1,27 @@
+"""Integration test — verify all commands are registered and --help works."""
+
+from click.testing import CliRunner
+
+from luthien_cli.main import cli
+
+
+def test_all_commands_registered():
+    runner = CliRunner()
+    result = runner.invoke(cli, ["--help"])
+    assert result.exit_code == 0
+    for cmd in ["status", "claude", "up", "down", "logs", "config"]:
+        assert cmd in result.output, f"Command '{cmd}' not in help output"
+
+
+def test_each_command_has_help():
+    runner = CliRunner()
+    for cmd in ["status", "claude", "up", "down", "logs", "config"]:
+        result = runner.invoke(cli, [cmd, "--help"])
+        assert result.exit_code == 0, f"{cmd} --help failed"
+
+
+def test_version():
+    runner = CliRunner()
+    result = runner.invoke(cli, ["--version"])
+    assert result.exit_code == 0
+    assert "0.1.0" in result.output

luthien_cli-0.1.0/tests/test_logs.py

@@ -0,0 +1,70 @@
+"""Tests for logs command."""
+
+from unittest.mock import patch, MagicMock
+
+from click.testing import CliRunner
+
+from luthien_cli.main import cli
+
+
+def test_logs_runs_docker_compose_logs(tmp_path):
+    runner = CliRunner()
+    config_path = tmp_path / "config.toml"
+    config_path.write_text(
+        f'[gateway]\nurl = "http://localhost:8000"\n\n[local]\nrepo_path = "{tmp_path}"\n'
+    )
+    with (
+        patch("luthien_cli.commands.logs.DEFAULT_CONFIG_PATH", config_path),
+        patch("luthien_cli.commands.logs.subprocess.run") as mock_run,
+    ):
+        mock_run.return_value = MagicMock(returncode=0)
+        result = runner.invoke(cli, ["logs"])
+        assert result.exit_code == 0
+        args = mock_run.call_args[0][0]
+        assert "docker" in args
+        assert "logs" in args
+
+
+def test_logs_with_tail(tmp_path):
+    runner = CliRunner()
+    config_path = tmp_path / "config.toml"
+    config_path.write_text(
+        f'[gateway]\nurl = "http://localhost:8000"\n\n[local]\nrepo_path = "{tmp_path}"\n'
+    )
+    with (
+        patch("luthien_cli.commands.logs.DEFAULT_CONFIG_PATH", config_path),
+        patch("luthien_cli.commands.logs.subprocess.run") as mock_run,
+    ):
+        mock_run.return_value = MagicMock(returncode=0)
+        result = runner.invoke(cli, ["logs", "--tail", "50"])
+        assert result.exit_code == 0
+        args = mock_run.call_args[0][0]
+        assert "--tail" in args
+        assert "50" in args
+
+
+def test_logs_with_follow(tmp_path):
+    runner = CliRunner()
+    config_path = tmp_path / "config.toml"
+    config_path.write_text(
+        f'[gateway]\nurl = "http://localhost:8000"\n\n[local]\nrepo_path = "{tmp_path}"\n'
+    )
+    with (
+        patch("luthien_cli.commands.logs.DEFAULT_CONFIG_PATH", config_path),
+        patch("luthien_cli.commands.logs.subprocess.run") as mock_run,
+    ):
+        mock_run.return_value = MagicMock(returncode=0)
+        result = runner.invoke(cli, ["logs", "-f"])
+        assert result.exit_code == 0
+        args = mock_run.call_args[0][0]
+        assert "-f" in args
+
+
+def test_logs_fails_without_repo_path(tmp_path):
+    runner = CliRunner()
+    config_path = tmp_path / "config.toml"
+    config_path.write_text('[gateway]\nurl = "http://localhost:8000"\n')
+    with patch("luthien_cli.commands.logs.DEFAULT_CONFIG_PATH", config_path):
+        result = runner.invoke(cli, ["logs"])
+        assert result.exit_code != 0
+        assert "repo_path" in result.output.lower() or "no repo" in result.output.lower()

luthien_cli-0.1.0/tests/test_status.py

@@ -0,0 +1,43 @@
+"""Tests for status command."""
+
+from unittest.mock import patch
+
+from click.testing import CliRunner
+
+from luthien_cli.main import cli
+
+
+def test_status_shows_healthy_gateway():
+    runner = CliRunner()
+    with patch("luthien_cli.commands.status.make_client") as mock_client:
+        client = mock_client.return_value
+        client.base_url = "http://localhost:8000"
+        client.health.return_value = {"status": "healthy", "version": "2.0.0"}
+        client.get_current_policy.return_value = {
+            "policy": "NoOpPolicy",
+            "class_ref": "luthien_proxy.policies.noop_policy:NoOpPolicy",
+            "enabled_at": "2026-03-03T10:00:00",
+            "enabled_by": "api",
+            "config": {},
+        }
+        client.get_auth_config.return_value = {
+            "auth_mode": "both",
+            "validate_credentials": True,
+            "valid_cache_ttl_seconds": 300,
+            "invalid_cache_ttl_seconds": 60,
+        }
+        result = runner.invoke(cli, ["status"])
+        assert result.exit_code == 0
+        assert "healthy" in result.output
+        assert "NoOpPolicy" in result.output
+
+
+def test_status_shows_unreachable_gateway():
+    runner = CliRunner()
+    with patch("luthien_cli.commands.status.make_client") as mock_client:
+        from luthien_cli.gateway_client import GatewayError
+
+        client = mock_client.return_value
+        client.health.side_effect = GatewayError("Cannot connect")
+        result = runner.invoke(cli, ["status"])
+        assert result.exit_code != 0 or "Cannot connect" in result.output

luthien_cli-0.1.0/tests/test_up.py

@@ -0,0 +1,58 @@
+"""Tests for up/down commands."""
+
+from unittest.mock import patch, MagicMock
+
+from click.testing import CliRunner
+
+from luthien_cli.main import cli
+
+
+def test_up_runs_docker_compose(tmp_path):
+    runner = CliRunner()
+    config_path = tmp_path / "config.toml"
+    config_path.write_text(
+        f'[gateway]\nurl = "http://localhost:8000"\n\n[local]\nrepo_path = "{tmp_path}"\n'
+    )
+    with (
+        patch("luthien_cli.commands.up.DEFAULT_CONFIG_PATH", config_path),
+        patch("luthien_cli.commands.up.subprocess.run") as mock_run,
+        patch("luthien_cli.commands.up.wait_for_healthy", return_value=True),
+    ):
+        mock_run.return_value = MagicMock(returncode=0)
+        result = runner.invoke(cli, ["up"])
+        assert result.exit_code == 0
+        mock_run.assert_called()
+
+
+def test_up_prompts_for_repo_path_when_missing(tmp_path):
+    runner = CliRunner()
+    config_path = tmp_path / "config.toml"
+    config_path.write_text('[gateway]\nurl = "http://localhost:8000"\n')
+    with patch("luthien_cli.commands.up.DEFAULT_CONFIG_PATH", config_path):
+        result = runner.invoke(cli, ["up"], input="\n")
+        assert "repo" in result.output.lower()
+
+
+def test_down_runs_docker_compose_down(tmp_path):
+    runner = CliRunner()
+    config_path = tmp_path / "config.toml"
+    config_path.write_text(
+        f'[gateway]\nurl = "http://localhost:8000"\n\n[local]\nrepo_path = "{tmp_path}"\n'
+    )
+    with (
+        patch("luthien_cli.commands.up.DEFAULT_CONFIG_PATH", config_path),
+        patch("luthien_cli.commands.up.subprocess.run") as mock_run,
+    ):
+        mock_run.return_value = MagicMock(returncode=0)
+        result = runner.invoke(cli, ["down"])
+        assert result.exit_code == 0
+
+
+def test_down_fails_without_repo_path(tmp_path):
+    runner = CliRunner()
+    config_path = tmp_path / "config.toml"
+    config_path.write_text('[gateway]\nurl = "http://localhost:8000"\n')
+    with patch("luthien_cli.commands.up.DEFAULT_CONFIG_PATH", config_path):
+        result = runner.invoke(cli, ["down"])
+        assert result.exit_code != 0
+        assert "repo_path" in result.output.lower() or "no repo" in result.output.lower()