mcli-framework 7.8.5__tar.gz → 7.9.0__tar.gz

{mcli_framework-7.8.5 → mcli_framework-7.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcli-framework
-Version: 7.8.5
+Version: 7.9.0
 Summary: Portable workflow framework - transform any script into a versioned, schedulable command. Store in ~/.mcli/commands/, version with lockfile, run as daemon or cron job.
 Author-email: Luis Fernandez de la Vara <luis@lefv.io>
 Maintainer-email: Luis Fernandez de la Vara <luis@lefv.io>
@@ -48,6 +48,7 @@ Requires-Dist: humanize<5.0.0,>=4.9.0
 Requires-Dist: psutil<6.0.0,>=5.9.0
 Requires-Dist: inquirerpy<0.4.0,>=0.3.4
 Requires-Dist: gitpython<4.0.0,>=3.1.40
+Requires-Dist: prompt-toolkit<4.0.0,>=3.0.0
 Requires-Dist: aiohttp>=3.9.0
 Requires-Dist: httpx>=0.28.1
 Requires-Dist: websockets>=12.0

{mcli_framework-7.8.5 → mcli_framework-7.9.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mcli-framework"
-version = "7.8.5"
+version = "7.9.0"
 description = "Portable workflow framework - transform any script into a versioned, schedulable command. Store in ~/.mcli/commands/, version with lockfile, run as daemon or cron job."
 readme = "README.md"
 requires-python = ">=3.9"
@@ -49,6 +49,7 @@ dependencies = [
   "psutil>=5.9.0,<6.0.0",
   "inquirerpy>=0.3.4,<0.4.0",
   "gitpython>=3.1.40,<4.0.0",
+  "prompt-toolkit>=3.0.0,<4.0.0",
   # Basic HTTP/async support
   "aiohttp>=3.9.0",
   "httpx>=0.28.1",

{mcli_framework-7.8.5 → mcli_framework-7.9.0}/src/mcli/app/main.py

@@ -344,6 +344,15 @@ def _add_lazy_commands(app: click.Group):
     except Exception as e:
         logger.debug(f"Could not load self commands: {e}")
 
+    # Library utilities and secrets management
+    try:
+        from mcli.lib.lib import lib
+
+        app.add_command(lib, name="lib")
+        logger.debug("Added lib commands")
+    except Exception as e:
+        logger.debug(f"Could not load lib commands: {e}")
+
     # Add workflow with completion-aware lazy loading
     try:
         from mcli.app.completion_helpers import create_completion_aware_lazy_group

{mcli_framework-7.8.5 → mcli_framework-7.9.0}/src/mcli/lib/lib.py

@@ -3,6 +3,8 @@ import sys
 
 import click
 
+from mcli.lib.secrets.commands import secrets_group
+
 
 def import_public_module(module_name: str):
     prefix = "mcli.public."
@@ -20,10 +22,15 @@ def import_public_module(module_name: str):
     return module
 
 
-@click.group(name="lib")
+@click.group(name="lib", help="Library utilities and secrets management")
 def lib():
+    """Library utilities and management commands."""
     pass
 
 
+# Add secrets as a subcommand
+lib.add_command(secrets_group)
+
+
 if __name__ == "__main__":
     lib()

mcli_framework-7.9.0/src/mcli/lib/secrets/commands.py

@@ -0,0 +1,185 @@
+"""
+CLI commands for secrets management.
+"""
+
+from pathlib import Path
+from typing import Optional
+
+import click
+
+from mcli.lib.ui.styling import error, info, success, warning
+
+from .manager import SecretsManager
+from .repl import run_repl
+from .store import SecretsStore
+
+
+@click.group(name="secrets", help="Secure secrets management with encryption and git sync")
+def secrets_group():
+    """Secrets management commands."""
+    pass
+
+
+@secrets_group.command(name="repl", help="Launch interactive secrets shell")
+def secrets_repl():
+    """Launch the interactive secrets REPL."""
+    run_repl()
+
+
+@secrets_group.command(name="set", help="Set a secret value")
+@click.argument("key")
+@click.argument("value")
+@click.option("-n", "--namespace", default="default", help="Namespace for the secret")
+def secrets_set(key: str, value: str, namespace: str):
+    """Set a secret value."""
+    manager = SecretsManager()
+    try:
+        manager.set(key, value, namespace)
+        success(f"Secret '{key}' set in namespace '{namespace}'")
+    except Exception as e:
+        error(f"Failed to set secret: {e}")
+
+
+@secrets_group.command(name="get", help="Get a secret value")
+@click.argument("key")
+@click.option("-n", "--namespace", default="default", help="Namespace for the secret")
+@click.option("-s", "--show", is_flag=True, help="Show the full value (not masked)")
+def secrets_get(key: str, namespace: str, show: bool):
+    """Get a secret value."""
+    manager = SecretsManager()
+    value = manager.get(key, namespace)
+
+    if value is not None:
+        if show:
+            click.echo(value)
+        else:
+            # Mask the value
+            masked = (
+                value[:3] + "*" * (len(value) - 6) + value[-3:]
+                if len(value) > 6
+                else "*" * len(value)
+            )
+            info(f"{key} = {masked}")
+            info("Use --show to display the full value")
+    else:
+        warning(f"Secret '{key}' not found in namespace '{namespace}'")
+
+
+@secrets_group.command(name="list", help="List all secrets")
+@click.option("-n", "--namespace", help="Filter by namespace")
+def secrets_list(namespace: Optional[str]):
+    """List all secrets."""
+    manager = SecretsManager()
+    secrets = manager.list(namespace)
+
+    if secrets:
+        info("Secrets:")
+        for secret in secrets:
+            click.echo(f"  • {secret}")
+    else:
+        info("No secrets found")
+
+
+@secrets_group.command(name="delete", help="Delete a secret")
+@click.argument("key")
+@click.option("-n", "--namespace", default="default", help="Namespace for the secret")
+@click.confirmation_option(prompt="Are you sure you want to delete this secret?")
+def secrets_delete(key: str, namespace: str):
+    """Delete a secret."""
+    manager = SecretsManager()
+    if manager.delete(key, namespace):
+        success(f"Secret '{key}' deleted from namespace '{namespace}'")
+    else:
+        warning(f"Secret '{key}' not found in namespace '{namespace}'")
+
+
+@secrets_group.command(name="export", help="Export secrets as environment variables")
+@click.option("-n", "--namespace", help="Namespace to export")
+@click.option("-o", "--output", type=click.Path(), help="Output file (defaults to stdout)")
+def secrets_export(namespace: Optional[str], output: Optional[str]):
+    """Export secrets as environment variables."""
+    manager = SecretsManager()
+    env_vars = manager.export_env(namespace)
+
+    if env_vars:
+        if output:
+            with open(output, "w") as f:
+                for key, value in env_vars.items():
+                    f.write(f"export {key}={value}\n")
+            success(f"Exported {len(env_vars)} secrets to {output}")
+        else:
+            for key, value in env_vars.items():
+                click.echo(f"export {key}={value}")
+    else:
+        info("No secrets to export")
+
+
+@secrets_group.command(name="import", help="Import secrets from environment file")
+@click.argument("env_file", type=click.Path(exists=True))
+@click.option("-n", "--namespace", default="default", help="Namespace to import into")
+def secrets_import(env_file: str, namespace: str):
+    """Import secrets from environment file."""
+    manager = SecretsManager()
+    count = manager.import_env(Path(env_file), namespace)
+    success(f"Imported {count} secrets into namespace '{namespace}'")
+
+
+@secrets_group.group(name="store", help="Git-based secrets synchronization")
+def store_group():
+    """Store management commands."""
+    pass
+
+
+@store_group.command(name="init", help="Initialize secrets store")
+@click.option("-r", "--remote", help="Git remote URL")
+def store_init(remote: Optional[str]):
+    """Initialize the secrets store."""
+    store = SecretsStore()
+    store.init(remote)
+
+
+@store_group.command(name="push", help="Push secrets to store")
+@click.option("-m", "--message", help="Commit message")
+def store_push(message: Optional[str]):
+    """Push secrets to store."""
+    manager = SecretsManager()
+    store = SecretsStore()
+    store.push(manager.secrets_dir, message)
+
+
+@store_group.command(name="pull", help="Pull secrets from store")
+def store_pull():
+    """Pull secrets from store."""
+    manager = SecretsManager()
+    store = SecretsStore()
+    store.pull(manager.secrets_dir)
+
+
+@store_group.command(name="sync", help="Sync secrets with store")
+@click.option("-m", "--message", help="Commit message")
+def store_sync(message: Optional[str]):
+    """Sync secrets with store."""
+    manager = SecretsManager()
+    store = SecretsStore()
+    store.sync(manager.secrets_dir, message)
+
+
+@store_group.command(name="status", help="Show store status")
+def store_status():
+    """Show store status."""
+    store = SecretsStore()
+    status = store.status()
+
+    info("Secrets Store Status:")
+    click.echo(f"  Initialized: {status['initialized']}")
+    click.echo(f"  Path: {status['store_path']}")
+
+    if status["initialized"]:
+        click.echo(f"  Branch: {status['branch']}")
+        click.echo(f"  Commit: {status['commit']}")
+        click.echo(f"  Clean: {status['clean']}")
+
+        if status["has_remote"]:
+            click.echo(f"  Remote: {status['remote_url']}")
+        else:
+            click.echo("  Remote: Not configured")

mcli_framework-7.9.0/src/mcli/lib/secrets/manager.py

@@ -0,0 +1,213 @@
+"""
+Secrets manager for handling secure storage and retrieval of secrets.
+"""
+
+import base64
+import json
+import os
+from pathlib import Path
+from typing import Dict, List, Optional
+
+import click
+from cryptography.fernet import Fernet
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
+
+from mcli.lib.logger.logger import get_logger
+
+logger = get_logger(__name__)
+
+
+class SecretsManager:
+    """Manages secrets storage with encryption."""
+
+    def __init__(self, secrets_dir: Optional[Path] = None):
+        """Initialize the secrets manager.
+
+        Args:
+            secrets_dir: Directory to store secrets. Defaults to ~/.mcli/secrets/
+        """
+        self.secrets_dir = secrets_dir or Path.home() / ".mcli" / "secrets"
+        self.secrets_dir.mkdir(parents=True, exist_ok=True)
+        self._cipher_suite = self._get_cipher_suite()
+
+    def _get_cipher_suite(self) -> Fernet:
+        """Get or create encryption key."""
+        key_file = self.secrets_dir / ".key"
+
+        if key_file.exists():
+            with open(key_file, "rb") as f:
+                key = f.read()
+        else:
+            # Generate a new key from a password
+            password = click.prompt("Enter a password for secrets encryption", hide_input=True)
+            password_bytes = password.encode()
+
+            # Use PBKDF2 to derive a key from the password
+            kdf = PBKDF2HMAC(
+                algorithm=hashes.SHA256(),
+                length=32,
+                salt=b"mcli-secrets-salt",  # In production, use a random salt
+                iterations=100000,
+            )
+            key = base64.urlsafe_b64encode(kdf.derive(password_bytes))
+
+            # Save the key (in production, this should be stored more securely)
+            with open(key_file, "wb") as f:
+                f.write(key)
+
+            # Set restrictive permissions
+            os.chmod(key_file, 0o600)
+
+        return Fernet(key)
+
+    def set(self, key: str, value: str, namespace: Optional[str] = None) -> None:
+        """Set a secret value.
+
+        Args:
+            key: Secret key
+            value: Secret value
+            namespace: Optional namespace for grouping secrets
+        """
+        namespace = namespace or "default"
+        namespace_dir = self.secrets_dir / namespace
+        namespace_dir.mkdir(exist_ok=True)
+
+        # Encrypt the value
+        encrypted_value = self._cipher_suite.encrypt(value.encode())
+
+        # Store the encrypted value
+        secret_file = namespace_dir / f"{key}.secret"
+        with open(secret_file, "wb") as f:
+            f.write(encrypted_value)
+
+        # Set restrictive permissions
+        os.chmod(secret_file, 0o600)
+
+        logger.debug(f"Secret '{key}' stored in namespace '{namespace}'")
+
+    def get(self, key: str, namespace: Optional[str] = None) -> Optional[str]:
+        """Get a secret value.
+
+        Args:
+            key: Secret key
+            namespace: Optional namespace
+
+        Returns:
+            Decrypted secret value or None if not found
+        """
+        namespace = namespace or "default"
+        secret_file = self.secrets_dir / namespace / f"{key}.secret"
+
+        if not secret_file.exists():
+            return None
+
+        with open(secret_file, "rb") as f:
+            encrypted_value = f.read()
+
+        try:
+            decrypted_value = self._cipher_suite.decrypt(encrypted_value)
+            return decrypted_value.decode()
+        except Exception as e:
+            logger.error(f"Failed to decrypt secret '{key}': {e}")
+            return None
+
+    def list(self, namespace: Optional[str] = None) -> List[str]:
+        """List all secret keys.
+
+        Args:
+            namespace: Optional namespace filter
+
+        Returns:
+            List of secret keys
+        """
+        if namespace:
+            namespace_dirs = [self.secrets_dir / namespace]
+        else:
+            namespace_dirs = [
+                d for d in self.secrets_dir.iterdir() if d.is_dir() and not d.name.startswith(".")
+            ]
+
+        secrets = []
+        for namespace_dir in namespace_dirs:
+            if namespace_dir.exists():
+                for secret_file in namespace_dir.glob("*.secret"):
+                    key = secret_file.stem
+                    ns = namespace_dir.name
+                    secrets.append(f"{ns}/{key}" if not namespace else key)
+
+        return sorted(secrets)
+
+    def delete(self, key: str, namespace: Optional[str] = None) -> bool:
+        """Delete a secret.
+
+        Args:
+            key: Secret key
+            namespace: Optional namespace
+
+        Returns:
+            True if deleted, False if not found
+        """
+        namespace = namespace or "default"
+        secret_file = self.secrets_dir / namespace / f"{key}.secret"
+
+        if secret_file.exists():
+            secret_file.unlink()
+            logger.debug(f"Secret '{key}' deleted from namespace '{namespace}'")
+            return True
+
+        return False
+
+    def export_env(self, namespace: Optional[str] = None) -> Dict[str, str]:
+        """Export secrets as environment variables.
+
+        Args:
+            namespace: Optional namespace filter
+
+        Returns:
+            Dictionary of key-value pairs
+        """
+        env_vars = {}
+
+        for secret_key in self.list(namespace):
+            if "/" in secret_key:
+                ns, key = secret_key.split("/", 1)
+                value = self.get(key, ns)
+            else:
+                value = self.get(secret_key, namespace)
+
+            if value:
+                # Convert to uppercase for environment variable convention
+                if "/" in secret_key:
+                    env_key = key.upper().replace("-", "_")
+                else:
+                    env_key = secret_key.upper().replace("-", "_")
+                env_vars[env_key] = value
+
+        return env_vars
+
+    def import_env(self, env_file: Path, namespace: Optional[str] = None) -> int:
+        """Import secrets from an environment file.
+
+        Args:
+            env_file: Path to .env file
+            namespace: Optional namespace
+
+        Returns:
+            Number of secrets imported
+        """
+        namespace = namespace or "default"
+        count = 0
+
+        with open(env_file) as f:
+            for line in f:
+                line = line.strip()
+                if line and not line.startswith("#") and "=" in line:
+                    key, value = line.split("=", 1)
+                    key = key.strip()
+                    value = value.strip().strip('"').strip("'")
+
+                    self.set(key.lower().replace("_", "-"), value, namespace)
+                    count += 1
+
+        return count