minitest-cli 0.41.0__tar.gz → 0.43.0__tar.gz

{minitest_cli-0.41.0 → minitest_cli-0.43.0}/.github/workflows/release.yml

@@ -78,53 +78,3 @@ jobs:
         with:
           generate_release_notes: true
           files: dist/*
-
-  update-homebrew:
-    needs: publish-pypi
-    runs-on: ubuntu-latest
-    steps:
-      - name: Fetch PyPI metadata
-        id: pypi
-        run: |
-          VERSION="${GITHUB_REF_NAME#v}"
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-
-          echo "Waiting for minitest-cli $VERSION to be available on PyPI..."
-          for i in $(seq 1 30); do
-            if curl -sSf --connect-timeout 5 --max-time 15 \
-              "https://pypi.org/pypi/minitest-cli/$VERSION/json" -o /tmp/pypi.json.tmp; then
-              mv /tmp/pypi.json.tmp /tmp/pypi.json
-              echo "Package is available on PyPI"
-              break
-            fi
-            echo "Attempt $i/30 - not yet available, waiting 10s..."
-            sleep 10
-          done
-
-          if [ ! -f /tmp/pypi.json ]; then
-            echo "::error::Package not found on PyPI after 5 minutes"
-            exit 1
-          fi
-
-          SDIST_URL=$(jq -r '.urls[] | select(.packagetype == "sdist") | .url' /tmp/pypi.json)
-          SDIST_SHA256=$(jq -r '.urls[] | select(.packagetype == "sdist") | .digests.sha256' /tmp/pypi.json)
-          if [ -z "$SDIST_URL" ] || [ "$SDIST_URL" = "null" ] || [ -z "$SDIST_SHA256" ] || [ "$SDIST_SHA256" = "null" ]; then
-            echo "::error::sdist metadata is missing from PyPI response"
-            exit 1
-          fi
-          echo "sdist_url=$SDIST_URL" >> "$GITHUB_OUTPUT"
-          echo "sdist_sha256=$SDIST_SHA256" >> "$GITHUB_OUTPUT"
-
-      - name: Trigger Homebrew tap update
-        uses: peter-evans/repository-dispatch@v3
-        with:
-          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
-          repository: minitap-ai/homebrew-tap
-          event-type: update-formula
-          client-payload: |
-            {
-              "formula": "minitest-cli",
-              "version": "${{ steps.pypi.outputs.version }}",
-              "sdist_url": "${{ steps.pypi.outputs.sdist_url }}",
-              "sdist_sha256": "${{ steps.pypi.outputs.sdist_sha256 }}"
-            }

{minitest_cli-0.41.0 → minitest_cli-0.43.0}/AGENTS.md

@@ -22,7 +22,8 @@ uv add <package>                                   # Add new dependency (always
 - `api/client.py` - httpx async client with auto auth + X-Minitest-Channel header
 - `utils/`
   - `output.py` - --json helpers: stdout=data, stderr=diagnostics
-  - `update_check.py` - PyPI version check (cached 24h, non-blocking)
+  - `update_check.py` - PyPI version check (cached 1h, non-blocking); hands newer releases to auto-update
+  - `auto_update*.py` - background self-update of the CLI and agent skill: eligibility and plan (`auto_update.py`), lock/state/running-command registry and the saved on/off preference (`auto_update_state.py`, toggled by `minitest upgrade auto`, `commands/upgrade_auto.py`), one-time notices, and the detached worker (`python -m minitest_cli.utils.auto_update_worker`). Tests run with `MINITEST_NO_AUTO_UPDATE=1` (conftest) so they never touch the real install.
 - `main.py` - Typer app entry point, global flags, command group registration
 - `tests/` - Unit tests
 

{minitest_cli-0.41.0 → minitest_cli-0.43.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: minitest-cli
-Version: 0.41.0
+Version: 0.43.0
 Summary: Minitest CLI – command-line interface for the Minitest testing platform
 Project-URL: Homepage, https://minitap.ai/
 Project-URL: Source, https://github.com/minitap-ai/minitest-cli
@@ -62,12 +62,6 @@ Both scripts use `uv` if available, or install it automatically.
 uv tool install minitest-cli
 ```
 
-**Homebrew** (macOS):
-
-```bash
-brew install minitap-ai/tap/minitest-cli
-```
-
 **uvx** (zero-install, all platforms):
 
 ```bash
@@ -83,6 +77,33 @@ uv sync
 uv run minitest --help
 ```
 
+### Staying up to date
+
+A CLI installed with `uv tool install` or the one-liner keeps itself
+current. When a command sees a newer release on PyPI, it updates the CLI in the
+background and your next command runs the new version. The update waits until
+no other `minitest` command is running, and only installs releases that have
+been out for at least an hour. The same background job refreshes the agent
+skill (`npx skills update minitest-cli`) when it has changed. The next command
+prints one line saying what was updated; the details go to
+`~/.minitest/auto_update.log`.
+
+Auto-update never runs in CI (`CI` set), in containers, on Windows, or for
+`uvx` and source checkouts; those keep printing an "Update available" notice.
+
+```bash
+minitest upgrade auto        # show the setting, why it is off, the last update
+minitest upgrade auto off    # turn it off for this user (saved in ~/.minitest/preferences.json)
+minitest upgrade auto on     # turn it back on
+minitest upgrade             # update by hand at any time
+```
+
+`MINITEST_NO_AUTO_UPDATE=1` also turns it off, and wins over the saved setting.
+
+> **Installed with Homebrew?** The `minitap-ai/tap/minitest-cli` formula is
+> retired: it stopped at 0.24.0 and is now disabled. Switch to uv with
+> `brew uninstall minitest-cli && uv tool install minitest-cli`.
+
 ## Quick Start
 
 ```bash
@@ -191,6 +212,7 @@ app defaults.
 | `MINITEST_WEBAPP_URL`         | Minitest webapp base URL (used for review links)            | No (defaults to production)        |
 | `MINITEST_SUPABASE_URL`       | Supabase project URL used for OAuth login                  | No (defaults to production)        |
 | `MINITEST_SUPABASE_PUBLISHABLE_KEY` | Supabase publishable (anon) key used for OAuth login | No (defaults to production)        |
+| `MINITEST_NO_AUTO_UPDATE`     | Set to `1` to stop the CLI and agent skill from updating themselves (or run `minitest upgrade auto off`) | No |
 
 > The recommended way to set these is to copy `.env.example` to `.env` — the CLI loads `.env` automatically. The shipped `.env.example` already targets the **dev** environment (see below).
 
@@ -368,6 +390,53 @@ least one domain. Connectors cannot be created from the CLI: a workspace owner
 or admin creates them in the webapp, under **Workspace settings → Private
 network**.
 
+## Backend API
+
+Mini can read the OpenAPI document of a backend you own and call it during runs,
+authenticated with app vault secrets (it is off by default). `set` reads the
+current settings first and changes only what you pass.
+
+```bash
+minitest --app <app-id> apps backend-api show
+minitest --app <app-id> apps backend-api set --enable \
+  --base-url https://api.staging.example.com \
+  --openapi-url https://api.staging.example.com/openapi.json \
+  --secret API_TOKEN [--remove-secret <name> ...] [--clear-secrets] \
+  [--skill <name-or-id> | --clear-skill]
+minitest --app <app-id> apps backend-api set --disable
+```
+
+Secrets are named references to the app vault (`minitest secret set`); `show`
+warns about names no longer in the vault. URLs must be public `http(s)`
+addresses: private, loopback and cloud-metadata addresses are rejected.
+
+When the OpenAPI document itself needs authentication, say how to download it.
+The credential comes from the app vault, is used for that download only, and is
+sent only to the saved OpenAPI URL's origin (a one-run OpenAPI URL on another
+origin gets none):
+
+```bash
+minitest --app <app-id> apps backend-api set --openapi-auth bearer --openapi-auth-secret API_TOKEN
+minitest --app <app-id> apps backend-api set --openapi-auth header \
+  --openapi-auth-header X-Api-Key --openapi-auth-secret API_TOKEN
+minitest --app <app-id> apps backend-api set --openapi-auth basic \
+  --openapi-auth-username docs-reader --openapi-auth-secret DOCS_PASSWORD
+minitest --app <app-id> apps backend-api set --openapi-auth query \
+  --openapi-auth-param api_key --openapi-auth-secret API_TOKEN
+minitest --app <app-id> apps backend-api set --openapi-auth none
+```
+
+To point one run at another backend, pass `--backend-base-url` and/or
+`--backend-openapi-url` to `run start`, `run all` or `run from-commit`. Only
+that run uses them; the saved settings do not change, and the app's backend API
+must be on.
+
+```bash
+minitest --app <app-id> run all --web \
+  --backend-base-url https://pr-42.api.example.com \
+  --backend-openapi-url https://pr-42.api.example.com/openapi.json
+```
+
 ## Exit Codes
 
 | Code | Meaning                                            |

{minitest_cli-0.41.0 → minitest_cli-0.43.0}/README.md

@@ -28,12 +28,6 @@ Both scripts use `uv` if available, or install it automatically.
 uv tool install minitest-cli
 ```
 
-**Homebrew** (macOS):
-
-```bash
-brew install minitap-ai/tap/minitest-cli
-```
-
 **uvx** (zero-install, all platforms):
 
 ```bash
@@ -49,6 +43,33 @@ uv sync
 uv run minitest --help
 ```
 
+### Staying up to date
+
+A CLI installed with `uv tool install` or the one-liner keeps itself
+current. When a command sees a newer release on PyPI, it updates the CLI in the
+background and your next command runs the new version. The update waits until
+no other `minitest` command is running, and only installs releases that have
+been out for at least an hour. The same background job refreshes the agent
+skill (`npx skills update minitest-cli`) when it has changed. The next command
+prints one line saying what was updated; the details go to
+`~/.minitest/auto_update.log`.
+
+Auto-update never runs in CI (`CI` set), in containers, on Windows, or for
+`uvx` and source checkouts; those keep printing an "Update available" notice.
+
+```bash
+minitest upgrade auto        # show the setting, why it is off, the last update
+minitest upgrade auto off    # turn it off for this user (saved in ~/.minitest/preferences.json)
+minitest upgrade auto on     # turn it back on
+minitest upgrade             # update by hand at any time
+```
+
+`MINITEST_NO_AUTO_UPDATE=1` also turns it off, and wins over the saved setting.
+
+> **Installed with Homebrew?** The `minitap-ai/tap/minitest-cli` formula is
+> retired: it stopped at 0.24.0 and is now disabled. Switch to uv with
+> `brew uninstall minitest-cli && uv tool install minitest-cli`.
+
 ## Quick Start
 
 ```bash
@@ -157,6 +178,7 @@ app defaults.
 | `MINITEST_WEBAPP_URL`         | Minitest webapp base URL (used for review links)            | No (defaults to production)        |
 | `MINITEST_SUPABASE_URL`       | Supabase project URL used for OAuth login                  | No (defaults to production)        |
 | `MINITEST_SUPABASE_PUBLISHABLE_KEY` | Supabase publishable (anon) key used for OAuth login | No (defaults to production)        |
+| `MINITEST_NO_AUTO_UPDATE`     | Set to `1` to stop the CLI and agent skill from updating themselves (or run `minitest upgrade auto off`) | No |
 
 > The recommended way to set these is to copy `.env.example` to `.env` — the CLI loads `.env` automatically. The shipped `.env.example` already targets the **dev** environment (see below).
 
@@ -334,6 +356,53 @@ least one domain. Connectors cannot be created from the CLI: a workspace owner
 or admin creates them in the webapp, under **Workspace settings → Private
 network**.
 
+## Backend API
+
+Mini can read the OpenAPI document of a backend you own and call it during runs,
+authenticated with app vault secrets (it is off by default). `set` reads the
+current settings first and changes only what you pass.
+
+```bash
+minitest --app <app-id> apps backend-api show
+minitest --app <app-id> apps backend-api set --enable \
+  --base-url https://api.staging.example.com \
+  --openapi-url https://api.staging.example.com/openapi.json \
+  --secret API_TOKEN [--remove-secret <name> ...] [--clear-secrets] \
+  [--skill <name-or-id> | --clear-skill]
+minitest --app <app-id> apps backend-api set --disable
+```
+
+Secrets are named references to the app vault (`minitest secret set`); `show`
+warns about names no longer in the vault. URLs must be public `http(s)`
+addresses: private, loopback and cloud-metadata addresses are rejected.
+
+When the OpenAPI document itself needs authentication, say how to download it.
+The credential comes from the app vault, is used for that download only, and is
+sent only to the saved OpenAPI URL's origin (a one-run OpenAPI URL on another
+origin gets none):
+
+```bash
+minitest --app <app-id> apps backend-api set --openapi-auth bearer --openapi-auth-secret API_TOKEN
+minitest --app <app-id> apps backend-api set --openapi-auth header \
+  --openapi-auth-header X-Api-Key --openapi-auth-secret API_TOKEN
+minitest --app <app-id> apps backend-api set --openapi-auth basic \
+  --openapi-auth-username docs-reader --openapi-auth-secret DOCS_PASSWORD
+minitest --app <app-id> apps backend-api set --openapi-auth query \
+  --openapi-auth-param api_key --openapi-auth-secret API_TOKEN
+minitest --app <app-id> apps backend-api set --openapi-auth none
+```
+
+To point one run at another backend, pass `--backend-base-url` and/or
+`--backend-openapi-url` to `run start`, `run all` or `run from-commit`. Only
+that run uses them; the saved settings do not change, and the app's backend API
+must be on.
+
+```bash
+minitest --app <app-id> run all --web \
+  --backend-base-url https://pr-42.api.example.com \
+  --backend-openapi-url https://pr-42.api.example.com/openapi.json
+```
+
 ## Exit Codes
 
 | Code | Meaning                                            |

{minitest_cli-0.41.0 → minitest_cli-0.43.0}/RELEASE.md

@@ -3,8 +3,10 @@
 ## Overview
 
 Releases are automated via GitHub Actions. Pushing a version tag triggers the
-full pipeline: build, publish to PyPI, create a GitHub Release, and update the
-Homebrew formula.
+full pipeline: build, publish to PyPI, and create a GitHub Release. uv is the
+only distribution channel (the Homebrew formula is retired); users
+on a `uv tool install` pick the release up automatically through auto-update
+once it has been on PyPI for an hour.
 
 ## Steps
 
@@ -38,8 +40,6 @@ The tag push triggers `.github/workflows/release.yml`, which:
 2. **Publish to PyPI** — uses trusted publishing (OIDC), no API token needed
 3. **GitHub Release** — creates a release with auto-generated notes and attaches
    the built artifacts
-4. **Homebrew update** — dispatches an event to `minitap-ai/homebrew-tap` with
-   the new version, sdist URL, and SHA256 hash
 
 ### 4. Verify
 
@@ -52,11 +52,6 @@ minitest --version
 
 # uvx
 uvx --from minitest-cli@X.Y.Z minitest --version
-
-# Homebrew (after tap update completes)
-brew update
-brew install minitap-ai/tap/minitest-cli
-minitest --version
 ```
 
 ## Prerequisites
@@ -76,11 +71,6 @@ Configure on PyPI at https://pypi.org/manage/project/minitest-cli/settings/publi
 
 Create a GitHub Actions environment named `pypi` in the repository settings.
 
-### Homebrew tap token
-
-A `HOMEBREW_TAP_TOKEN` secret must be set in this repository with a GitHub
-personal access token that has write access to `minitap-ai/homebrew-tap`.
-
 ## Version scheme
 
 We follow [Semantic Versioning](https://semver.org/):

{minitest_cli-0.41.0 → minitest_cli-0.43.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "minitest-cli"
-version = "0.41.0"
+version = "0.43.0"
 description = "Minitest CLI – command-line interface for the Minitest testing platform"
 readme = "README.md"
 license = "MIT"

{minitest_cli-0.41.0 → minitest_cli-0.43.0}/src/minitest_cli/commands/app_network_helpers.py

@@ -38,12 +38,12 @@ def fail(message: str, code: int = EXIT_GENERAL_ERROR) -> typer.Exit:
     return typer.Exit(code=code)
 
 
-def _raise_for_status(resp: httpx.Response) -> None:
+def _raise_for_status(resp: httpx.Response, forbidden: str) -> None:
     if resp.status_code < 400:
         return
     detail = extract_detail(resp)
     if resp.status_code == 403:
-        raise fail(f"{ADMIN_ONLY_MESSAGE} ({detail})", EXIT_AUTH_ERROR)
+        raise fail(f"{forbidden} ({detail})", EXIT_AUTH_ERROR)
     if resp.status_code == 401:
         raise fail(f"Authentication failed: {detail}", EXIT_AUTH_ERROR)
     if resp.status_code == 404:
@@ -54,12 +54,17 @@ def _raise_for_status(resp: httpx.Response) -> None:
 
 
 def call_api(
-    settings: Settings, method: str, path: str, body: dict[str, Any] | None = None
+    settings: Settings,
+    method: str,
+    path: str,
+    body: dict[str, Any] | None = None,
+    *,
+    forbidden: str = ADMIN_ONLY_MESSAGE,
 ) -> dict[str, Any]:
     async def _run() -> dict[str, Any]:
         async with ApiClient(settings) as client:
             resp = await client.request(method, path, json=body)
-        _raise_for_status(resp)
+        _raise_for_status(resp, forbidden)
         try:
             return resp.json()
         except ValueError as exc:

{minitest_cli-0.41.0 → minitest_cli-0.43.0}/src/minitest_cli/commands/apps.py

@@ -12,6 +12,7 @@ from minitest_cli.api.client import ApiClient
 from minitest_cli.api.errors import format_network_error
 from minitest_cli.commands import (
     apps_dependencies,
+    backend_api,
     apps_get,
     private_network,
     residential_proxy,
@@ -38,6 +39,7 @@ app.command(name="dependencies")(apps_dependencies.dependencies)
 app.command(name="get")(apps_get.get_app)
 app.add_typer(residential_proxy.app)
 app.add_typer(private_network.app)
+app.add_typer(backend_api.app)
 
 
 @app.callback()

minitest_cli-0.43.0/src/minitest_cli/commands/backend_api.py

@@ -0,0 +1,152 @@
+"""'apps backend-api': the backend Mini reads an OpenAPI document of and calls during runs."""
+
+from typing import Annotated, Any
+
+import typer
+
+from minitest_cli.commands.app_network_helpers import call_api, fail, is_json_mode, resolve_target
+from minitest_cli.core.config import Settings
+from minitest_cli.commands.app_skill_helpers import skills_path
+from minitest_cli.commands.backend_api_helpers import (
+    merge_secret_names,
+    openapi_auth_body,
+    render_config,
+)
+from minitest_cli.utils.output import print_success
+
+app = typer.Typer(
+    name="backend-api",
+    help=(
+        "Backend API of the app (--app): during runs Mini searches its OpenAPI document and "
+        "calls it, authenticated with app vault secrets. Off by default."
+    ),
+    no_args_is_help=True,
+)
+
+
+def _path(app_id: str) -> str:
+    return f"/api/v1/apps/{app_id}/backend-config"
+
+
+def _call(
+    settings: Settings, method: str, path: str, body: dict[str, Any] | None = None
+) -> dict[str, Any]:
+    return call_api(settings, method, path, body, forbidden="You cannot access this app.")
+
+
+@app.command(name="show")
+def show() -> None:
+    """Show the app's backend API settings."""
+    settings, app_id = resolve_target()
+    render_config(_call(settings, "GET", _path(app_id)))
+
+
+@app.command(name="set")
+def set_config(
+    enable: Annotated[
+        bool | None,
+        typer.Option(
+            "--enable/--disable",
+            help="Switch it on or off. On needs a base URL and an OpenAPI URL.",
+        ),
+    ] = None,
+    base_url: Annotated[
+        str | None,
+        typer.Option("--base-url", help="Base URL Mini calls, e.g. https://api.staging.example."),
+    ] = None,
+    openapi_url: Annotated[
+        str | None,
+        typer.Option("--openapi-url", help="URL of the OpenAPI (or Swagger) document."),
+    ] = None,
+    secret: Annotated[
+        list[str] | None,
+        typer.Option(
+            "--secret",
+            help="App vault secret Mini authenticates calls with (repeatable), e.g. API_TOKEN.",
+        ),
+    ] = None,
+    remove_secret: Annotated[
+        list[str] | None,
+        typer.Option("--remove-secret", help="Authentication secret to drop (repeatable)."),
+    ] = None,
+    clear_secrets: Annotated[
+        bool,
+        typer.Option("--clear-secrets", help="Drop every current secret before adding --secret."),
+    ] = False,
+    skill: Annotated[
+        str | None,
+        typer.Option("--skill", help="App skill (name or id) explaining how to use the backend."),
+    ] = None,
+    clear_skill: Annotated[
+        bool, typer.Option("--clear-skill", help="Stop pointing Mini at a skill.")
+    ] = False,
+    openapi_auth: Annotated[
+        str | None,
+        typer.Option(
+            "--openapi-auth",
+            help=(
+                "How the OpenAPI document is downloaded when it needs authentication: none, "
+                "bearer, header, basic or query. Used for nothing else, and only sent to the "
+                "saved OpenAPI URL's origin."
+            ),
+        ),
+    ] = None,
+    openapi_auth_secret: Annotated[
+        str | None,
+        typer.Option("--openapi-auth-secret", help="App vault secret holding the credential."),
+    ] = None,
+    openapi_auth_header: Annotated[
+        str | None, typer.Option("--openapi-auth-header", help="Header name, for header.")
+    ] = None,
+    openapi_auth_username: Annotated[
+        str | None, typer.Option("--openapi-auth-username", help="Username, for basic.")
+    ] = None,
+    openapi_auth_param: Annotated[
+        str | None, typer.Option("--openapi-auth-param", help="Query parameter, for query.")
+    ] = None,
+) -> None:
+    """Change the app's backend API settings; options not passed stay as they are."""
+    if skill and clear_skill:
+        raise fail("Pass either --skill or --clear-skill, not both.")
+    changes = [enable is not None, base_url, openapi_url, secret, remove_secret, clear_secrets]
+    auth_names = {
+        "--openapi-auth-header": openapi_auth_header,
+        "--openapi-auth-username": openapi_auth_username,
+        "--openapi-auth-param": openapi_auth_param,
+    }
+    auth_given = any([openapi_auth, openapi_auth_secret, *auth_names.values()])
+    if not any([*changes, skill, clear_skill, auth_given]):
+        raise fail(
+            "Nothing to change: pass --enable/--disable, --base-url, --openapi-url, "
+            "a secret option, a skill option or an --openapi-auth option."
+        )
+    settings, app_id = resolve_target()
+    current = _call(settings, "GET", _path(app_id))
+    body: dict[str, Any] = {
+        "enabled": current["enabled"] if enable is None else enable,
+        "baseUrl": current["baseUrl"] if base_url is None else base_url,
+        "openapiUrl": current["openapiUrl"] if openapi_url is None else openapi_url,
+        "authenticationSecretNames": merge_secret_names(
+            current["authenticationSecretNames"],
+            add=secret,
+            remove=remove_secret,
+            clear=clear_secrets,
+        ),
+        "skillId": current["skill"]["id"] if current["skill"] else None,
+    }
+    if auth_given:
+        body["openapiAuth"] = openapi_auth_body(
+            current["openapiAuth"],
+            auth_type=openapi_auth,
+            secret=openapi_auth_secret,
+            names=auth_names,
+        )
+    if clear_skill:
+        body["skillId"] = None
+    elif skill:
+        body["skillId"] = _call(settings, "GET", f"{skills_path(app_id)}/{skill}")["id"]
+
+    updated = _call(settings, "PUT", _path(app_id), body)
+    if not is_json_mode():
+        print_success("Backend API updated.")
+    render_config(updated)

minitest_cli-0.43.0/src/minitest_cli/commands/backend_api_helpers.py

@@ -0,0 +1,93 @@
+"""Rendering and secret-list editing for 'apps backend-api'."""
+
+from typing import Any
+
+from minitest_cli.commands.app_network_helpers import fail, is_json_mode, on_off
+from minitest_cli.utils.output import print_json, print_warning
+
+
+def merge_secret_names(
+    current: list[str], *, add: list[str] | None, remove: list[str] | None, clear: bool
+) -> list[str]:
+    """Apply ``--clear-secrets``, ``--remove-secret`` then ``--secret``."""
+    removed = {name.strip() for name in remove or []}
+    unknown = sorted(removed - set(current))
+    if unknown:
+        raise fail(f"Not an authentication secret of this app: {', '.join(unknown)}.")
+    base = [] if clear else [name for name in current if name not in removed]
+    return list(dict.fromkeys([*base, *(name.strip() for name in add or [])]))
+
+
+OPENAPI_AUTH_TYPES = ("none", "bearer", "header", "basic", "query")
+_AUTH_NAME_FIELD = {
+    "header": ("headerName", "--openapi-auth-header"),
+    "basic": ("username", "--openapi-auth-username"),
+    "query": ("paramName", "--openapi-auth-param"),
+}
+
+
+def openapi_auth_body(
+    current: dict[str, Any],
+    *,
+    auth_type: str | None,
+    secret: str | None,
+    names: dict[str, str | None],
+) -> dict[str, Any]:
+    """Apply the --openapi-auth options to the saved setting; ``names`` is keyed by option."""
+    kind = auth_type or current["type"]
+    if kind not in OPENAPI_AUTH_TYPES:
+        raise fail(f"--openapi-auth must be one of: {', '.join(OPENAPI_AUTH_TYPES)}.")
+    field = _AUTH_NAME_FIELD.get(kind)
+    stray = [
+        option for option, value in names.items() if value and (not field or option != field[1])
+    ]
+    if kind == "none" and secret:
+        stray.insert(0, "--openapi-auth-secret")
+    if stray:
+        raise fail(f"{', '.join(stray)} does not apply to --openapi-auth {kind}.")
+    if kind == "none":
+        return {"type": "none"}
+    same = current["type"] == kind
+    body = {"type": kind, "secretName": secret or (current.get("secretName") if same else None)}
+    if field:
+        body[field[0]] = names[field[1]] or (current.get(field[0]) if same else None)
+    required = [("--openapi-auth-secret", body["secretName"])] + (
+        [(field[1], body[field[0]])] if field else []
+    )
+    missing = [option for option, value in required if not value]
+    if missing:
+        raise fail(f"--openapi-auth {kind} needs {' and '.join(missing)}.")
+    return body
+
+
+def _describe_openapi_auth(auth: dict[str, Any]) -> str:
+    if auth["type"] == "none":
+        return "none"
+    field = _AUTH_NAME_FIELD.get(auth["type"])
+    detail = f" {field[0]}={auth[field[0]]}" if field else ""
+    return f"{auth['type']}{detail} secret={auth['secretName']}"
+
+
+def render_config(config: dict[str, Any]) -> None:
+    if is_json_mode():
+        print_json(config)
+    else:
+        skill = config["skill"]
+        print(f"Enabled: {on_off(config['enabled'])}")  # noqa: T201
+        print(f"Base URL: {config['baseUrl'] or '-'}")  # noqa: T201
+        print(f"OpenAPI URL: {config['openapiUrl'] or '-'}")  # noqa: T201
+        secrets = ", ".join(config["authenticationSecretNames"]) or "-"
+        print(f"Authentication secrets: {secrets}")  # noqa: T201
+        print(f"Skill: {skill['name'] + ' ' + skill['id'] if skill else '-'}")  # noqa: T201
+        print(f"OpenAPI download: {_describe_openapi_auth(config['openapiAuth'])}")  # noqa: T201
+    missing = config["missingSecretNames"]
+    if missing:
+        print_warning(
+            f"Not in the app vault anymore: {', '.join(missing)}. Create them with "
+            "'minitest secret set' or drop them with --remove-secret."
+        )
+    if config["openapiAuthSecretMissing"]:
+        print_warning(
+            f"The OpenAPI download secret {config['openapiAuth']['secretName']} is not in the "
+            "app vault anymore: runs will not start until it is created again or replaced."
+        )