netconverter-cli 0.4.0__tar.gz → 0.4.1__tar.gz

{netconverter_cli-0.4.0 → netconverter_cli-0.4.1}/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.4.1 — 2026-10-22
+
+- **First-run setup honours the Clerk sign-in (#6).** `NETCONVERTER_API_KEY` in the
+  environment no longer skips the sign-in choice and is never copied into the OS keyring.
+  `whoami` reports `api_key_stored` for the keyring only and adds `api_key_in_environment`.
+- **Sign-in errors show Clerk's full reason.** The OAuth error description was cut at
+  200 characters, hiding the cause sentence (e.g. a missing `device_code` grant, #684).
+- **`whoami` shows one label per organization** (name, else slug) instead of the raw `org_...` id.
+
 ## 0.4.0 — 2026-10-21
 
 - **On PyPI as `netconverter-cli`.** `uv tool install --python 3.12 netconverter-cli`

{netconverter_cli-0.4.0 → netconverter_cli-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: netconverter-cli
-Version: 0.4.0
+Version: 0.4.1
 Summary: NetConverter CLI — any-vendor network configuration migration, validation and optimization, and a local MCP bridge for your AI assistant
 Project-URL: Homepage, https://netconverter.ai
 Project-URL: Repository, https://github.com/valeronlabs/netconverter_terminals

{netconverter_cli-0.4.0 → netconverter_cli-0.4.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "netconverter-cli"
-version = "0.4.0"
+version = "0.4.1"
 description = "NetConverter CLI — any-vendor network configuration migration, validation and optimization, and a local MCP bridge for your AI assistant"
 readme = "README.md"
 license = "MIT"

{netconverter_cli-0.4.0 → netconverter_cli-0.4.1}/src/netconverter_cli/__init__.py

@@ -1,3 +1,3 @@
 """NetConverter CLI: file transfer and conversation are separate paths."""
 
-__version__ = "0.4.0"
+__version__ = "0.4.1"

{netconverter_cli-0.4.0 → netconverter_cli-0.4.1}/src/netconverter_cli/clerk.py

@@ -180,7 +180,8 @@ class OAuthError(ClerkError):
     def __init__(self, error: str, body=None):
         description = ""
         if isinstance(body, dict):
-            description = _safe_text(body.get("error_description"))
+            # Clerk puts the cause in the last sentence; keep the whole description, not a cut-off head.
+            description = _safe_text(body.get("error_description"), 600)
         super().__init__(
             f"Sign-in refused: {error}" + (f" ({description})" if description else "")
         )
@@ -567,9 +568,11 @@ def profile_summary(info: dict) -> dict:
         if isinstance(info.get(key), str) and info[key]:
             out[key] = _safe_text(info[key], 120)
     orgs = []
-    for key in ("org_id", "org_slug", "org_name"):
+    # One label for the active organization: its name, else its slug; the raw id only as a last resort.
+    for key in ("org_name", "org_slug", "org_id"):
         if isinstance(info.get(key), str) and info[key]:
             orgs.append(_safe_text(info[key], 120))
+            break
     for org in info.get("organizations") or info.get("orgs") or []:
         if isinstance(org, dict):
             label = org.get("name") or org.get("slug") or org.get("id")

{netconverter_cli-0.4.0 → netconverter_cli-0.4.1}/src/netconverter_cli/cli.py

@@ -8,7 +8,7 @@ import sys
 from pathlib import Path
 from .api import Client, DEFAULT_BASE, APIError
 from .backend import detect_profile, open_client
-from .credentials import get_secret, keyring_available, save_secret
+from .credentials import get_secret, keyring_available, load_secret, save_secret
 from .controller import Controller
 from .providers import Provider, ProviderError
 from .commands import execute
@@ -139,7 +139,8 @@ def logout(args):
 def whoami(args):
     from .clerk import ClerkError, profile_summary
 
-    out = {"server": args.server, "api_key_stored": bool(get_secret(account(args.server), prompt=False))}
+    out = {"server": args.server, "api_key_stored": bool(load_secret(account(args.server))),
+           "api_key_in_environment": bool(os.environ.get("NETCONVERTER_API_KEY"))}
     session = _clerk_session()
     if session is None:
         out["clerk"] = None

{netconverter_cli-0.4.0 → netconverter_cli-0.4.1}/src/netconverter_cli/setup.py

@@ -4,7 +4,7 @@ import json
 from pathlib import Path
 from .api import Client, DEFAULT_BASE
 from .backend import open_client
-from .credentials import get_secret, save_secret
+from .credentials import get_secret, load_secret, save_secret
 from .providers import Provider, ProviderError
 from .workspace import Workspace, WorkspaceError
 
@@ -85,7 +85,8 @@ class AccountSignIn:
 
 def connect_credential(server, signin, ask, secret):
     """A stored key, the existing sign-in, or the user's choice of signing in or pasting a key."""
-    saved = get_secret(account(server), prompt=False)
+    # Keyring only: a key from the environment must neither skip the sign-in nor be copied into the keyring.
+    saved = load_secret(account(server))
     if not saved and signin.allowed(server):
         session = signin.session()
         if session is not None:

{netconverter_cli-0.4.0 → netconverter_cli-0.4.1}/tests/conftest.py

@@ -20,3 +20,12 @@ def _no_real_sign_in(request, monkeypatch):
     monkeypatch.setattr(update, "cache_dir", lambda: cache)
     if "vault" not in request.fixturenames:
         monkeypatch.setattr(cli, "_clerk_session", lambda: None)
+
+
+@pytest.fixture(autouse=True)
+def _no_real_stored_key(request, monkeypatch):
+    """First-run setup never sees an API key stored in the developer's real keyring."""
+    if "vault" not in request.fixturenames:
+        from netconverter_cli import setup
+
+        monkeypatch.setattr(setup, "load_secret", lambda name: "")

{netconverter_cli-0.4.0 → netconverter_cli-0.4.1}/tests/test_clerk.py

@@ -398,3 +398,18 @@ def test_every_token_request_names_the_mcp_resource():
 
     src = inspect.getsource(clerk)
     assert src.count('"resource": RESOURCE') >= 4
+
+
+def test_oauth_error_keeps_the_cause_sentence_of_a_long_description():
+    """#684: Clerk's cause was cut off at 200 characters."""
+    from netconverter_cli.clerk import OAuthError
+    cause = "This OAuth application does not have the 'urn:ietf:params:oauth:grant-type:device_code' grant."
+    exc = OAuthError("unauthorized_client", {"error_description": "x" * 230 + " " + cause})
+    assert cause in str(exc)
+
+
+def test_profile_summary_shows_the_org_name_not_its_raw_id():
+    from netconverter_cli.clerk import profile_summary
+    info = {"org_id": "org_39VBTisVKmTSYHZamQtGhl8y9rS", "org_slug": "nexthopllc", "org_name": "NextHop LLC"}
+    assert profile_summary(info)["organizations"] == ["NextHop LLC"]
+    assert profile_summary({"org_id": "org_X"})["organizations"] == ["org_X"]

{netconverter_cli-0.4.0 → netconverter_cli-0.4.1}/tests/test_setup.py

@@ -106,7 +106,7 @@ def test_deleted_working_folder_gives_a_clear_message(tmp_path, monkeypatch, cap
     gone.mkdir()
     monkeypatch.chdir(gone)
     gone.rmdir()
-    monkeypatch.setattr(cli, 'get_secret', Mock(return_value=''))
+    monkeypatch.setattr(cli, 'load_secret', Mock(return_value=''))
     monkeypatch.setattr(cli, '_clerk_session', Mock(return_value=None))
     cli.main(['whoami'])  # account commands need no workspace
     assert '"api_key_stored": false' in capsys.readouterr().out

{netconverter_cli-0.4.0 → netconverter_cli-0.4.1}/tests/test_signin_default.py

@@ -121,7 +121,7 @@ def _setup_mocks(monkeypatch):
     client = Mock()
     factory = Mock(return_value=(client, "external"))
     monkeypatch.setattr(setup, "open_client", factory)
-    monkeypatch.setattr(setup, "get_secret", lambda name, prompt=True: "")
+    monkeypatch.setattr(setup, "load_secret", lambda name: "")
     save = Mock(return_value=True)
     monkeypatch.setattr(setup, "save_secret", save)
     return client, factory, save
@@ -172,7 +172,7 @@ def test_setup_never_offers_sign_in_to_an_untrusted_server(tmp_path, monkeypatch
 def test_plain_netconverter_in_a_new_folder_reaches_the_app_signed_in(tmp_path, monkeypatch):
     session = FakeSession()
     monkeypatch.setattr(cli, "_clerk_session", lambda: session)
-    monkeypatch.setattr(setup, "get_secret", lambda name, prompt=True: "")
+    monkeypatch.setattr(setup, "load_secret", lambda name: "")
     monkeypatch.setattr(setup, "save_secret", Mock(return_value=True))
     client = Mock()
     factory = Mock(return_value=(client, "external"))
@@ -186,3 +186,21 @@ def test_plain_netconverter_in_a_new_folder_reaches_the_app_signed_in(tmp_path,
     cli.main(["--workspace", str(tmp_path)])
     factory.assert_called_once_with(session, PROD)
     ran.assert_called_once()
+
+
+def test_env_key_neither_skips_the_sign_in_nor_is_copied_to_the_keyring(monkeypatch):
+    """#6: NETCONVERTER_API_KEY in the environment is not a stored key."""
+    session = FakeSession()
+    monkeypatch.setenv("NETCONVERTER_API_KEY", "nck_FROM_ENV")
+    monkeypatch.setattr(setup, "load_secret", lambda name: "")
+    monkeypatch.setattr(setup, "get_secret", lambda *a, **k: pytest.fail("env key must not be read"))
+    signin = Mock(allowed=Mock(return_value=True), session=Mock(return_value=session))
+    assert setup.connect_credential(PROD, signin, ask=Mock(), secret=Mock()) is session
+
+
+def test_blank_key_prompt_does_not_adopt_the_env_key(monkeypatch):
+    monkeypatch.setenv("NETCONVERTER_API_KEY", "nck_FROM_ENV")
+    monkeypatch.setattr(setup, "load_secret", lambda name: "")
+    signin = Mock(allowed=Mock(return_value=False))
+    with pytest.raises(ValueError):
+        setup.connect_credential(PROD, signin, ask=Mock(), secret=lambda prompt: "")