oed-cli 0.1.3__tar.gz → 0.1.4__tar.gz

{oed_cli-0.1.3/src/oed_cli.egg-info → oed_cli-0.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: oed-cli
-Version: 0.1.3
+Version: 0.1.4
 Summary: oed — openEuler Infra command line. Auto-discovered, AI-friendly.
 Author: oed-cli contributors
 License: Apache-2.0
@@ -97,7 +97,7 @@ pip install -e .
 Verify:
 
 ```bash
-oed --version       # → oed, version 0.1.3
+oed --version       # → oed, version 0.1.4
 ```
 
 ---
@@ -230,6 +230,49 @@ oed schema cve | jq '.paths | keys'
 
 ---
 
+## AtomGit (`ag`) authentication
+
+AtomGit operations authenticate through the `access_token` query parameter
+declared on their spec. Store a personal access token once, and every
+`oed ag ...` call uses it automatically:
+
+```bash
+# Interactive (prompts for the token, never echoes it back)
+oed ag login
+
+# Non-interactive — good for CI / scripts
+oed ag login --token <pat>
+
+# Skip validating the token against AtomGit before storing
+oed ag login --token <pat> --no-verify
+
+# Just report whether a token is configured (no network, no prompt)
+oed ag login --status
+
+# Forget the stored token
+oed ag logout
+```
+
+Token storage:
+
+- Windows: encrypted at rest for the current user via DPAPI (no extra deps).
+- Elsewhere: base64, which is documented obfuscation, **not** encryption.
+- Lives under the cache dir (`tokens/ag.json`); `oed cache clear` never
+  touches credentials.
+
+Auto-injection on real calls:
+
+- If the operation declares `access_token` and you don't pass one, the stored
+  token is filled in automatically — `oed ag listAuthenticatedUserIssues` just
+  works.
+- An explicit `--access-token <pat>` always wins over the stored one.
+- If the operation requires a token and none is available anywhere, you get a
+  clear `ag_token_missing` error with a hint, instead of an opaque gateway 401.
+- `--dry-run` and request echo views mask the token as `<stored>` — the real
+  value only ever goes out on the wire.
+
+---
+
 ## Local development
 
 ### Clone and install (editable)
@@ -248,9 +291,10 @@ invocation. Drop it with `pip uninstall oed-cli` when you're done.
 python -m pytest -q
 ```
 
-41 tests cover v0.1 + v0.2 dispatch, the operation-help cheatsheet,
+58 tests cover v0.1 + v0.2 dispatch, the operation-help cheatsheet,
 per-parameter flag coercion, the `API_`-prefix alias, the
-`resolve_runtime_gateway` no-fallback semantics, and every exit code path.
+`resolve_runtime_gateway` no-fallback semantics, every exit code path, and
+v0.4's `ag` token store (DPAPI/base64) + auto-injection.
 They monkeypatch the discovery layer so no gateway access is needed.
 
 ### Smoke-test against the live gateway
@@ -328,6 +372,7 @@ to eyeball `oed services` output every week.
 | `oed info` hangs or `waf_block` exit 2             | gateway unreachable / WAF      | confirm `curl https://api-gateway.osinfra.cn`; see `context/discoverAPI.md` §6 |
 | Chinese output garbled on Windows                  | console codepage not UTF-8     | `chcp 65001`, or pipe `\| python`, or `PYTHONIOENCODING=utf-8 oed …` |
 | `error="spec_missing"` (exit 4) on a known service | upstream hasn't published the spec yet | wait for the gateway-side OpenAPI yaml; nothing to do on the oed side |
+| `error="ag_token_missing"` on an `ag` call | operation needs a token, none stored | `oed ag login` (or pass `--access-token <pat>`) |
 | A `cve` call exits 2 (`waf_block`)      | spec points to a `.test.osinfra.cn` host | already handled — `oed` reads `base_url` from the discovery feed (no fallback) and ignores the spec's `x-apigateway-backend.httpEndpoints.address` for the host |
 
 ### Offline mode

{oed_cli-0.1.3 → oed_cli-0.1.4}/README.md

@@ -63,7 +63,7 @@ pip install -e .
 Verify:
 
 ```bash
-oed --version       # → oed, version 0.1.3
+oed --version       # → oed, version 0.1.4
 ```
 
 ---
@@ -196,6 +196,49 @@ oed schema cve | jq '.paths | keys'
 
 ---
 
+## AtomGit (`ag`) authentication
+
+AtomGit operations authenticate through the `access_token` query parameter
+declared on their spec. Store a personal access token once, and every
+`oed ag ...` call uses it automatically:
+
+```bash
+# Interactive (prompts for the token, never echoes it back)
+oed ag login
+
+# Non-interactive — good for CI / scripts
+oed ag login --token <pat>
+
+# Skip validating the token against AtomGit before storing
+oed ag login --token <pat> --no-verify
+
+# Just report whether a token is configured (no network, no prompt)
+oed ag login --status
+
+# Forget the stored token
+oed ag logout
+```
+
+Token storage:
+
+- Windows: encrypted at rest for the current user via DPAPI (no extra deps).
+- Elsewhere: base64, which is documented obfuscation, **not** encryption.
+- Lives under the cache dir (`tokens/ag.json`); `oed cache clear` never
+  touches credentials.
+
+Auto-injection on real calls:
+
+- If the operation declares `access_token` and you don't pass one, the stored
+  token is filled in automatically — `oed ag listAuthenticatedUserIssues` just
+  works.
+- An explicit `--access-token <pat>` always wins over the stored one.
+- If the operation requires a token and none is available anywhere, you get a
+  clear `ag_token_missing` error with a hint, instead of an opaque gateway 401.
+- `--dry-run` and request echo views mask the token as `<stored>` — the real
+  value only ever goes out on the wire.
+
+---
+
 ## Local development
 
 ### Clone and install (editable)
@@ -214,9 +257,10 @@ invocation. Drop it with `pip uninstall oed-cli` when you're done.
 python -m pytest -q
 ```
 
-41 tests cover v0.1 + v0.2 dispatch, the operation-help cheatsheet,
+58 tests cover v0.1 + v0.2 dispatch, the operation-help cheatsheet,
 per-parameter flag coercion, the `API_`-prefix alias, the
-`resolve_runtime_gateway` no-fallback semantics, and every exit code path.
+`resolve_runtime_gateway` no-fallback semantics, every exit code path, and
+v0.4's `ag` token store (DPAPI/base64) + auto-injection.
 They monkeypatch the discovery layer so no gateway access is needed.
 
 ### Smoke-test against the live gateway
@@ -294,6 +338,7 @@ to eyeball `oed services` output every week.
 | `oed info` hangs or `waf_block` exit 2             | gateway unreachable / WAF      | confirm `curl https://api-gateway.osinfra.cn`; see `context/discoverAPI.md` §6 |
 | Chinese output garbled on Windows                  | console codepage not UTF-8     | `chcp 65001`, or pipe `\| python`, or `PYTHONIOENCODING=utf-8 oed …` |
 | `error="spec_missing"` (exit 4) on a known service | upstream hasn't published the spec yet | wait for the gateway-side OpenAPI yaml; nothing to do on the oed side |
+| `error="ag_token_missing"` on an `ag` call | operation needs a token, none stored | `oed ag login` (or pass `--access-token <pat>`) |
 | A `cve` call exits 2 (`waf_block`)      | spec points to a `.test.osinfra.cn` host | already handled — `oed` reads `base_url` from the discovery feed (no fallback) and ignores the spec's `x-apigateway-backend.httpEndpoints.address` for the host |
 
 ### Offline mode

{oed_cli-0.1.3 → oed_cli-0.1.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "oed-cli"
-version = "0.1.3"
+version = "0.1.4"
 description = "oed — openEuler Infra command line. Auto-discovered, AI-friendly."
 readme = "README.md"
 requires-python = ">=3.10"

{oed_cli-0.1.3 → oed_cli-0.1.4}/src/oed_cli/__init__.py

@@ -2,5 +2,5 @@
 
 from __future__ import annotations
 
-__version__ = "0.1.3"
+__version__ = "0.1.4"
 __all__ = ["__version__"]

oed_cli-0.1.4/src/oed_cli/auth.py

@@ -0,0 +1,176 @@
+"""Local secret storage for ``oed`` authentication tokens.
+
+On Windows, tokens are encrypted at rest for the current Windows user via
+DPAPI (``CryptProtectData`` / ``CryptUnprotectData`` through ctypes) — a real
+encryption boundary with zero runtime dependencies. Non-Windows platforms fall
+back to base64, which is documented obfuscation and NOT encryption.
+
+The on-disk schema is versioned and keyed by ``service`` so a future general
+``oed login`` can share this store with the ``ag``-specific token here.
+"""
+
+from __future__ import annotations
+
+import base64
+import contextlib
+import ctypes
+import datetime as _dt
+import json
+import platform
+from pathlib import Path
+from typing import Any
+
+from .discovery import _cache_dir
+from .errors import UserError
+
+_SCHEMA_VERSION = 1
+_DPAPI_ENTROPY = b"oed-cli:ag:v1"
+_CRYPTPROTECT_UI_FORBIDDEN = 0x1
+
+
+class _DATA_BLOB(ctypes.Structure):
+    _fields_ = [("cbData", ctypes.c_ulong), ("pbData", ctypes.POINTER(ctypes.c_char))]
+
+
+def _is_windows() -> bool:
+    return platform.system() == "Windows"
+
+
+def token_path(service: str = "ag") -> Path:
+    """Return the on-disk path for ``service``'s encrypted token.
+
+    Lives under the shared cache dir (honors ``OED_CACHE_DIR``) in a ``tokens/``
+    subdirectory so ``oed cache clear`` (which only unlinks ``discovery.json``)
+    can never wipe credentials.
+    """
+
+    return _cache_dir() / "tokens" / f"{service}.json"
+
+
+def _win32_crypt(data: bytes, *, protect: bool) -> bytes:
+    """Protect/unprotect ``data`` with DPAPI scoped to the current Windows user."""
+
+    windll = ctypes.windll
+    func = windll.crypt32.CryptProtectData if protect else windll.crypt32.CryptUnprotectData
+    func.argtypes = [
+        ctypes.POINTER(_DATA_BLOB),  # pDataIn
+        ctypes.c_wchar_p,            # szDataDescr
+        ctypes.POINTER(_DATA_BLOB),  # pOptionalEntropy
+        ctypes.c_void_p,             # pvReserved
+        ctypes.c_void_p,             # pPromptStruct
+        ctypes.c_ulong,              # dwFlags
+        ctypes.POINTER(_DATA_BLOB),  # pDataOut
+    ]
+    func.restype = ctypes.c_int
+
+    # keep the backing buffers referenced for the duration of the call
+    inp = ctypes.create_string_buffer(data, len(data))
+    in_blob = _DATA_BLOB(len(data), ctypes.cast(inp, ctypes.POINTER(ctypes.c_char)))
+    ent = ctypes.create_string_buffer(_DPAPI_ENTROPY, len(_DPAPI_ENTROPY))
+    ent_blob = _DATA_BLOB(len(_DPAPI_ENTROPY), ctypes.cast(ent, ctypes.POINTER(ctypes.c_char)))
+    out_blob = _DATA_BLOB()
+
+    ok = func(
+        ctypes.byref(in_blob),
+        None,
+        ctypes.byref(ent_blob),
+        None,
+        None,
+        _CRYPTPROTECT_UI_FORBIDDEN,
+        ctypes.byref(out_blob),
+    )
+    if not ok:
+        side = "protect" if protect else "unprotect"
+        raise UserError(
+            f"Windows DPAPI could not {side} the token",
+            kind="dpapi_failed",
+            hint="Retry, or file an issue if it persists.",
+        )
+    try:
+        return ctypes.string_at(out_blob.pbData, out_blob.cbData)
+    finally:
+        windll.kernel32.LocalFree(out_blob.pbData)
+
+
+def _encrypt(plain: str) -> tuple[str, str]:
+    """Return ``(base64 blob, schema encryption marker)`` for ``plain``."""
+
+    raw = plain.encode("utf-8")
+    if _is_windows():
+        return base64.b64encode(_win32_crypt(raw, protect=True)).decode("ascii"), "dpapi"
+    return base64.b64encode(raw).decode("ascii"), "base64"
+
+
+def store_token(token: str, *, service: str = "ag") -> Path:
+    """Encrypt ``token`` and write it to disk for ``service``.
+
+    Never stores plaintext; raises :class:`UserError` if the write fails.
+    """
+
+    blob, encryption = _encrypt(token)
+    payload: dict[str, Any] = {
+        "version": _SCHEMA_VERSION,
+        "service": service,
+        "encryption": encryption,
+        "secret": blob,
+        "created_at": _dt.datetime.now(_dt.timezone.utc).isoformat(),
+    }
+    path = token_path(service)
+    try:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(json.dumps(payload, ensure_ascii=False), encoding="utf-8")
+    except OSError as exc:
+        raise UserError(
+            f"could not write token store {path}: {exc}",
+            kind="token_store_write_failed",
+            hint="Check the directory is writable, or set OED_CACHE_DIR.",
+        ) from exc
+    return path
+
+
+def read_token(service: str = "ag") -> str | None:
+    """Return the decrypted token for ``service``, or ``None``.
+
+    Any read failure (missing file, corrupt JSON, undecryptable blob) degrades
+    silently to ``None`` so callers fall through to the missing-token path.
+    """
+
+    try:
+        raw = json.loads(token_path(service).read_text(encoding="utf-8"))
+        if raw.get("version") != _SCHEMA_VERSION or raw.get("service") != service:
+            return None
+        secret = base64.b64decode(raw["secret"])
+        if raw.get("encryption") == "dpapi" and _is_windows():
+            return _win32_crypt(secret, protect=False).decode("utf-8")
+        if raw.get("encryption") == "base64":
+            return secret.decode("utf-8")
+        return None
+    except Exception:
+        return None
+
+
+def token_info(service: str = "ag") -> dict[str, Any] | None:
+    """Return ``{encryption, created_at}`` metadata for the stored token, or ``None``."""
+
+    try:
+        raw = json.loads(token_path(service).read_text(encoding="utf-8"))
+        return {
+            "encryption": raw.get("encryption"),
+            "created_at": raw.get("created_at"),
+        }
+    except Exception:
+        return None
+
+
+def clear_token(service: str = "ag") -> bool:
+    """Delete ``service``'s stored token; return whether one existed."""
+
+    path = token_path(service)
+    if not path.is_file():
+        return False
+    with contextlib.suppress(OSError):
+        path.unlink()
+    return True
+
+
+__all__ = ["clear_token", "read_token", "store_token", "token_info", "token_path"]

{oed_cli-0.1.3 → oed_cli-0.1.4}/src/oed_cli/invoke.py

@@ -24,6 +24,7 @@ from typing import Any
 import httpx
 
 from . import http as http_mod
+from .auth import read_token
 from .dynamic import Operation, coerce_param_types, to_flag
 from .errors import NetworkError, UserError
 from .http import _is_waf_block, _resolve_user_agent
@@ -126,6 +127,33 @@ def _render_response(resp: httpx.Response) -> Any:
         }
 
 
+def _inject_ag_token(op: Operation, query_params: dict[str, Any]) -> None:
+    """Auto-fill the ``access_token`` query param for AtomGit operations.
+
+    ``ag`` authenticates every request through the ``access_token`` query
+    parameter declared on its spec (用户授权码). When the caller didn't
+    pass one explicitly, fall back to the locally stored token from
+    ``oed ag login``. A required token that isn't available anywhere
+    raises a hint instead of failing inside the gateway; optional ones
+    simply go without.
+    """
+
+    declared = next(
+        (p for p in op.query_params if p.get("name") == "access_token"), None
+    )
+    if op.service_name != "ag" or declared is None or "access_token" in query_params:
+        return
+    token = read_token("ag")
+    if token:
+        query_params["access_token"] = token
+    elif declared.get("required"):
+        raise UserError(
+            "this AtomGit operation requires an access_token",
+            kind="ag_token_missing",
+            hint="Store one with `oed ag login`, or pass `--access-token <pat>`.",
+        )
+
+
 def call_operation(
     op: Operation,
     *,
@@ -158,6 +186,7 @@ def call_operation(
         )
 
     query_params = {k: v for k, v in query_params.items() if v is not None}
+    _inject_ag_token(op, query_params)
     url = f"{op.base_url}{filled_path}"
 
     # Discourse (forum) authenticates via Api-Key/Api-Username; inert sentinel
@@ -169,10 +198,15 @@ def call_operation(
     request_headers: dict[str, str] = {"User-Agent": _resolve_user_agent(user_agent)}
     if body is not None:
         request_headers["Content-Type"] = "application/json"
+    # Mask credentials in any echoed request view (dry-run / include_request):
+    # the real token still goes out on the wire, it just never round-trips
+    # back to the terminal.
     request_view: dict[str, Any] = {
         "method": op.backend.method,
         "url": url,
-        "query": query_params,
+        "query": {
+            k: ("<stored>" if k == "access_token" else v) for k, v in query_params.items()
+        },
         "headers": {**request_headers, **api_headers},
         "body": body,
     }

{oed_cli-0.1.3 → oed_cli-0.1.4}/src/oed_cli/main.py

@@ -34,6 +34,7 @@ from collections.abc import Sequence
 
 import click
 
+from .auth import clear_token, read_token, store_token, token_info, token_path
 from .cli import cli as click_cli
 from .dynamic import (
     coerce_flag_value,
@@ -47,7 +48,7 @@ from .dynamic import (
     resolve_runtime_gateway,
     resolve_service_by_name,
 )
-from .errors import OedError
+from .errors import NotFoundError, OedError
 from .invoke import (
     call_operation,
     describe_operation_help,
@@ -200,6 +201,217 @@ def _merge_params(
     return params, body, 0
 
 
+_AG_LOGIN_INSTRUCTIONS = (
+    "AtomGit login\n"
+    "=============\n"
+    "1. Open https://atomgit.com and sign in.\n"
+    "2. Create a personal access token under Settings https://atomgit.com/setting > Access Tokens https://atomgit.com/setting/token-classic/create "
+    "3. Paste the token below. It is stored encrypted for this Windows/Linux user "
+    "and is never echoed back.\n"
+)
+
+
+def _ag_login_help() -> int:
+    click.echo(
+        json.dumps(
+            {
+                "ok": True,
+                "help_for": "ag login",
+                "usage": "oed ag login [--token <pat>] [--no-verify] [--status]",
+                "flags": {
+                    "--token": "provide the AtomGit personal access token non-interactively",
+                    "--no-verify": "skip validating the token against AtomGit before storing",
+                    "--status": "report whether a token is configured, without prompting",
+                },
+                "examples": [
+                    "oed ag login",
+                    "oed ag login --token <pat> --no-verify",
+                    "oed ag login --status",
+                    "oed ag logout",
+                ],
+            },
+            ensure_ascii=False,
+            indent=2,
+        )
+    )
+    return 0
+
+
+def _ag_login(raw_flags: dict[str, str], bool_flags: set[str], help_requested: bool) -> int:
+    """Configure the AtomGit access token used by ``oed ag`` requests."""
+
+    if help_requested:
+        return _ag_login_help()
+
+    if "status" in bool_flags:
+        return _ag_status()
+
+    token = raw_flags.pop("token", None)
+    if token == "":
+        click.echo(
+            json.dumps(
+                {
+                    "ok": False,
+                    "code": 1,
+                    "error": "missing_flag_value",
+                    "message": "--token requires a non-empty value",
+                },
+                ensure_ascii=False,
+            ),
+            err=True,
+        )
+        return 1
+
+    if token is None:
+        click.echo(_AG_LOGIN_INSTRUCTIONS, err=True)
+        try:
+            token = click.prompt("AtomGit personal access token", hide_input=True, err=True)
+        except click.Abort:
+            click.echo(
+                json.dumps(
+                    {"ok": False, "code": 1, "error": "aborted", "message": "login cancelled"},
+                    ensure_ascii=False,
+                ),
+                err=True,
+            )
+            return 1
+
+    token = token.strip()
+    if not token:
+        click.echo(
+            json.dumps(
+                {
+                    "ok": False,
+                    "code": 1,
+                    "error": "missing_token",
+                    "message": "no token provided",
+                },
+                ensure_ascii=False,
+            ),
+            err=True,
+        )
+        return 1
+
+    if "no-verify" not in bool_flags:
+        verify_code = _verify_ag_token(token)
+        if verify_code != 0:
+            return verify_code
+
+    path = store_token(token)
+    click.echo(
+        json.dumps(
+            {
+                "ok": True,
+                "service": "ag",
+                "configured": True,
+                "token_path": str(path),
+                "note": "token stored locally; it is never echoed back",
+            },
+            ensure_ascii=False,
+            indent=2,
+        )
+    )
+    return 0
+
+
+def _verify_ag_token(token: str) -> int:
+    """Best-effort validation: hit an authenticated ``ag`` endpoint with ``token``.
+
+    Returns ``0`` when the token looks valid (or validation is unavailable for
+    the current spec); a nonzero exit code when the token was rejected or the
+    check itself failed.
+    """
+
+    try:
+        service = resolve_service_by_name("ag")
+        spec = fetch_service_spec(service)
+        base_url = resolve_runtime_gateway(service)
+        table = operations_table(spec, service.service_name, base_url=base_url)
+        op = resolve_operation(table, "listAuthenticatedUserIssues")
+    except NotFoundError:
+        return 0
+    except OedError as exc:
+        click.echo(json.dumps(exc.to_dict(), ensure_ascii=False), err=True)
+        return exc.code
+
+    try:
+        result = call_operation(op, params={"access_token": token}, include_request=False)
+    except OedError as exc:
+        click.echo(json.dumps(exc.to_dict(), ensure_ascii=False), err=True)
+        return exc.code
+
+    if not result.get("ok"):
+        click.echo(
+            json.dumps(
+                {
+                    "ok": False,
+                    "code": 1,
+                    "error": "invalid_token",
+                    "message": "AtomGit rejected the token",
+                    "hint": (
+                        "Check the token is active, or create a new one at "
+                        "AtomGit > Settings > Access Tokens, then run `oed ag login` again."
+                    ),
+                },
+                ensure_ascii=False,
+            ),
+            err=True,
+        )
+        return 1
+    return 0
+
+
+def _ag_status() -> int:
+    """Report whether a token is configured, without prompting or network access."""
+
+    configured = read_token("ag") is not None
+    meta = token_info("ag") or {}
+    click.echo(
+        json.dumps(
+            {
+                "ok": True,
+                "service": "ag",
+                "configured": configured,
+                "token_path": str(token_path("ag")),
+                "encryption": meta.get("encryption"),
+                "created_at": meta.get("created_at"),
+                "token": None,
+            },
+            ensure_ascii=False,
+            indent=2,
+        )
+    )
+    return 0
+
+
+def _ag_logout(help_requested: bool) -> int:
+    """Delete the stored ``ag`` token."""
+
+    if help_requested:
+        click.echo(
+            json.dumps(
+                {
+                    "ok": True,
+                    "help_for": "ag logout",
+                    "usage": "oed ag logout",
+                    "examples": ["oed ag logout"],
+                },
+                ensure_ascii=False,
+                indent=2,
+            )
+        )
+        return 0
+    was_set = clear_token("ag")
+    click.echo(
+        json.dumps(
+            {"ok": True, "service": "ag", "configured": False, "was_set": was_set},
+            ensure_ascii=False,
+            indent=2,
+        )
+    )
+    return 0
+
+
 def _dispatch_dynamic(argv: Sequence[str]) -> int:
     """Parse ``oed <service> [<method>] [flags]`` and run the resolved call."""
 
@@ -219,6 +431,26 @@ def _dispatch_dynamic(argv: Sequence[str]) -> int:
     user_agent = raw_flags.pop("user-agent", None)
     method = positional[0] if positional else None
 
+    if service_name == "ag" and method in ("login", "logout"):
+        if len(positional) > 1:
+            click.echo(
+                json.dumps(
+                    {
+                        "ok": False,
+                        "code": 1,
+                        "error": "too_many_positional",
+                        "message": "`oed ag login` takes flags, not extra positionals",
+                        "extra_args": positional[1:],
+                    },
+                    ensure_ascii=False,
+                ),
+                err=True,
+            )
+            return 1
+        if method == "login":
+            return _ag_login(raw_flags, bool_flags, help_requested)
+        return _ag_logout(help_requested)
+
     try:
         service = resolve_service_by_name(service_name)
     except OedError as exc:

{oed_cli-0.1.3 → oed_cli-0.1.4/src/oed_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: oed-cli
-Version: 0.1.3
+Version: 0.1.4
 Summary: oed — openEuler Infra command line. Auto-discovered, AI-friendly.
 Author: oed-cli contributors
 License: Apache-2.0
@@ -97,7 +97,7 @@ pip install -e .
 Verify:
 
 ```bash
-oed --version       # → oed, version 0.1.3
+oed --version       # → oed, version 0.1.4
 ```
 
 ---
@@ -230,6 +230,49 @@ oed schema cve | jq '.paths | keys'
 
 ---
 
+## AtomGit (`ag`) authentication
+
+AtomGit operations authenticate through the `access_token` query parameter
+declared on their spec. Store a personal access token once, and every
+`oed ag ...` call uses it automatically:
+
+```bash
+# Interactive (prompts for the token, never echoes it back)
+oed ag login
+
+# Non-interactive — good for CI / scripts
+oed ag login --token <pat>
+
+# Skip validating the token against AtomGit before storing
+oed ag login --token <pat> --no-verify
+
+# Just report whether a token is configured (no network, no prompt)
+oed ag login --status
+
+# Forget the stored token
+oed ag logout
+```
+
+Token storage:
+
+- Windows: encrypted at rest for the current user via DPAPI (no extra deps).
+- Elsewhere: base64, which is documented obfuscation, **not** encryption.
+- Lives under the cache dir (`tokens/ag.json`); `oed cache clear` never
+  touches credentials.
+
+Auto-injection on real calls:
+
+- If the operation declares `access_token` and you don't pass one, the stored
+  token is filled in automatically — `oed ag listAuthenticatedUserIssues` just
+  works.
+- An explicit `--access-token <pat>` always wins over the stored one.
+- If the operation requires a token and none is available anywhere, you get a
+  clear `ag_token_missing` error with a hint, instead of an opaque gateway 401.
+- `--dry-run` and request echo views mask the token as `<stored>` — the real
+  value only ever goes out on the wire.
+
+---
+
 ## Local development
 
 ### Clone and install (editable)
@@ -248,9 +291,10 @@ invocation. Drop it with `pip uninstall oed-cli` when you're done.
 python -m pytest -q
 ```
 
-41 tests cover v0.1 + v0.2 dispatch, the operation-help cheatsheet,
+58 tests cover v0.1 + v0.2 dispatch, the operation-help cheatsheet,
 per-parameter flag coercion, the `API_`-prefix alias, the
-`resolve_runtime_gateway` no-fallback semantics, and every exit code path.
+`resolve_runtime_gateway` no-fallback semantics, every exit code path, and
+v0.4's `ag` token store (DPAPI/base64) + auto-injection.
 They monkeypatch the discovery layer so no gateway access is needed.
 
 ### Smoke-test against the live gateway
@@ -328,6 +372,7 @@ to eyeball `oed services` output every week.
 | `oed info` hangs or `waf_block` exit 2             | gateway unreachable / WAF      | confirm `curl https://api-gateway.osinfra.cn`; see `context/discoverAPI.md` §6 |
 | Chinese output garbled on Windows                  | console codepage not UTF-8     | `chcp 65001`, or pipe `\| python`, or `PYTHONIOENCODING=utf-8 oed …` |
 | `error="spec_missing"` (exit 4) on a known service | upstream hasn't published the spec yet | wait for the gateway-side OpenAPI yaml; nothing to do on the oed side |
+| `error="ag_token_missing"` on an `ag` call | operation needs a token, none stored | `oed ag login` (or pass `--access-token <pat>`) |
 | A `cve` call exits 2 (`waf_block`)      | spec points to a `.test.osinfra.cn` host | already handled — `oed` reads `base_url` from the discovery feed (no fallback) and ignores the spec's `x-apigateway-backend.httpEndpoints.address` for the host |
 
 ### Offline mode

{oed_cli-0.1.3 → oed_cli-0.1.4}/src/oed_cli.egg-info/SOURCES.txt

@@ -3,6 +3,7 @@ README.md
 pyproject.toml
 src/oed_cli/__init__.py
 src/oed_cli/__main__.py
+src/oed_cli/auth.py
 src/oed_cli/cli.py
 src/oed_cli/discovery.py
 src/oed_cli/dynamic.py
@@ -17,5 +18,7 @@ src/oed_cli.egg-info/dependency_links.txt
 src/oed_cli.egg-info/entry_points.txt
 src/oed_cli.egg-info/requires.txt
 src/oed_cli.egg-info/top_level.txt
+tests/test_auth.py
 tests/test_cli.py
-tests/test_dynamic.py
+tests/test_dynamic.py
+tests/test_invoke.py

oed_cli-0.1.4/tests/test_auth.py

@@ -0,0 +1,107 @@
+"""Tests for oed_cli.auth — encrypted local token storage (DPAPI / base64)."""
+
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+SRC = ROOT / "src"
+if str(SRC) not in sys.path:
+    sys.path.insert(0, str(SRC))
+
+from oed_cli.errors import UserError  # noqa: E402
+
+
+@pytest.fixture()
+def isolated(monkeypatch, tmp_path):
+    """Point the token store at a throwaway dir and return the auth module."""
+
+    monkeypatch.setenv("OED_CACHE_DIR", str(tmp_path))
+    from oed_cli import auth
+
+    return auth
+
+
+def test_dpapi_roundtrip_on_windows(isolated):
+    if not isolated._is_windows():
+        pytest.skip("DPAPI is Windows-only")
+
+    isolated.store_token("tok-abc", service="ag")
+    assert isolated.read_token("ag") == "tok-abc"
+
+
+def test_base64_fallback_roundtrip(isolated, monkeypatch):
+    monkeypatch.setattr(isolated, "_is_windows", lambda: False)
+
+    path = isolated.store_token("tok-secret", service="ag")
+    assert isolated.read_token("ag") == "tok-secret"
+    raw = json.loads(path.read_text(encoding="utf-8"))
+    assert raw["encryption"] == "base64"
+
+
+def test_no_plaintext_secret_on_disk(isolated):
+    isolated.store_token("supersecretvalue", service="ag")
+    text = isolated.token_path("ag").read_text(encoding="utf-8")
+    assert "supersecretvalue" not in text
+
+
+def test_corrupt_file_reads_none(isolated):
+    p = isolated.token_path("ag")
+    p.parent.mkdir(parents=True, exist_ok=True)
+    p.write_text("{not json", encoding="utf-8")
+    assert isolated.read_token("ag") is None
+
+
+def test_missing_file_and_clear(isolated):
+    assert isolated.read_token("ag") is None
+    assert isolated.clear_token("ag") is False
+    isolated.store_token("t", service="ag")
+    assert isolated.clear_token("ag") is True
+    assert isolated.read_token("ag") is None
+
+
+def test_schema_is_versioned_and_scoped(isolated):
+    p = isolated.store_token("t", service="ag")
+    raw = json.loads(p.read_text(encoding="utf-8"))
+    assert raw["version"] == 1
+    assert raw["service"] == "ag"
+    assert raw["encryption"] in {"dpapi", "base64"}
+
+
+def test_storage_respects_cache_dir(isolated, tmp_path):
+    p = isolated.store_token("t", service="ag")
+    assert p == tmp_path / "tokens" / "ag.json"
+    assert p.is_file()
+
+
+def test_store_is_service_keyed(isolated):
+    isolated.store_token("ag-tok", service="ag")
+    isolated.store_token("other-tok", service="other")
+    assert isolated.read_token("ag") == "ag-tok"
+    assert isolated.read_token("other") == "other-tok"
+    assert isolated.read_token("notstored") is None
+
+
+def test_store_io_failure_raises(isolated):
+    block = isolated.token_path("ag")
+    block.parent.mkdir(parents=True, exist_ok=True)
+    block.mkdir()  # directory where the file should go → write fails
+    with pytest.raises(UserError):
+        isolated.store_token("t", service="ag")
+
+
+def test_dpapi_marker_unreadable_off_windows(isolated, monkeypatch):
+    p = isolated.token_path("ag")
+    p.parent.mkdir(parents=True, exist_ok=True)
+    p.write_text(
+        json.dumps(
+            {"version": 1, "service": "ag", "encryption": "dpapi", "secret": "x"}
+        ),
+        encoding="utf-8",
+    )
+    monkeypatch.setattr(isolated, "_is_windows", lambda: False)
+    assert isolated.read_token("ag") is None

oed_cli-0.1.4/tests/test_invoke.py

@@ -0,0 +1,200 @@
+"""Tests for per-service auth injection in :func:`oed_cli.invoke.call_operation`.
+
+AtomGit (``ag``) authenticates through the ``access_token`` query parameter
+declared on its spec. These tests run offline: the stored token is monkeypatched
+and HTTP is stubbed so we only assert on the request that *would* go out.
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+SRC = ROOT / "src"
+if str(SRC) not in sys.path:
+    sys.path.insert(0, str(SRC))
+
+AG_SPEC = {
+    "openapi": "3.0.3",
+    "info": {"title": "openeuler/ag", "version": "1.0.0"},
+    "paths": {
+        "/api/v5/user/issues": {
+            "get": {
+                "summary": "list the authenticated user's issues",
+                "operationId": "listAuthenticatedUserIssues",
+                "parameters": [
+                    {
+                        "name": "access_token",
+                        "in": "query",
+                        "required": True,
+                        "schema": {"type": "string"},
+                    },
+                    {
+                        "name": "filter",
+                        "in": "query",
+                        "required": False,
+                        "schema": {"type": "string"},
+                    },
+                ],
+            }
+        },
+        "/api/v5/repos/{owner}/{repo}/git/trees/{sha}": {
+            "get": {
+                "summary": "list repo tree",
+                "operationId": "getRepoTree",
+                "parameters": [
+                    {"name": "owner", "in": "path", "required": True, "schema": {"type": "string"}},
+                    {"name": "repo", "in": "path", "required": True, "schema": {"type": "string"}},
+                    {"name": "sha", "in": "path", "required": True, "schema": {"type": "string"}},
+                    {
+                        "name": "access_token",
+                        "in": "query",
+                        "required": False,
+                        "schema": {"type": "string"},
+                    },
+                ],
+            }
+        },
+        "/public/health": {
+            "get": {
+                "summary": "unauthenticated health check",
+                "operationId": "getHealth",
+                "parameters": [],
+            }
+        },
+    },
+}
+
+
+@pytest.fixture()
+def captured(monkeypatch):
+    """Stub HTTP + the stored token, capturing the outgoing request."""
+
+    from oed_cli import http as http_mod
+    from oed_cli import invoke as invoke_mod
+
+    box = {}
+
+    def _fake_do_call(
+        method, url, params=None, body=None, timeout=30.0, headers=None, user_agent=None
+    ):
+        class _R:
+            status_code = 200
+            content = b'{"ok":true}'
+            text = content.decode()
+            headers = {"content-type": "application/json"}
+
+            def json(self):
+                return {"ok": True}
+
+        box["method"] = method
+        box["url"] = url
+        box["params"] = params or {}
+        box["body"] = body
+        box["headers"] = headers or {}
+        return _R()
+
+    monkeypatch.setattr(http_mod, "get_request", _fake_do_call)
+    monkeypatch.setattr(http_mod, "_is_waf_block", lambda text: False, raising=False)
+
+    def _set_token(value: str | None):
+        monkeypatch.setattr(invoke_mod, "read_token", lambda service: value)
+
+    box["set_token"] = _set_token
+    box["invoke"] = invoke_mod
+    return box
+
+
+def _op(name: str):
+    from oed_cli.dynamic import operations_table
+
+    return operations_table(AG_SPEC, "ag", base_url="https://apig.osinfra.cn")[name]
+
+
+def test_ag_required_token_injected_from_store(captured):
+    from oed_cli.invoke import call_operation
+
+    captured["set_token"]("tok-abc")
+    op = _op("listAuthenticatedUserIssues")
+    call_operation(op, params={"filter": "all"})
+    assert captured["params"]["access_token"] == "tok-abc"
+
+
+def test_ag_explicit_token_wins_over_store(captured):
+    from oed_cli.invoke import call_operation
+
+    captured["set_token"]("stored-token")
+    op = _op("listAuthenticatedUserIssues")
+    call_operation(op, params={"access_token": "explicit-token"})
+    assert captured["params"]["access_token"] == "explicit-token"
+
+
+def test_ag_required_token_missing_raises_hint(captured):
+    from oed_cli.errors import UserError
+    from oed_cli.invoke import call_operation
+
+    captured["set_token"](None)
+    op = _op("listAuthenticatedUserIssues")
+    with pytest.raises(UserError) as exc:
+        call_operation(op)
+    assert exc.value.kind == "ag_token_missing"
+
+
+def test_ag_optional_token_missing_goes_without(captured):
+    from oed_cli.invoke import call_operation
+
+    captured["set_token"](None)
+    op = _op("getRepoTree")
+    call_operation(op, params={"owner": "o", "repo": "r", "sha": "s"})
+    assert "access_token" not in captured["params"]
+
+
+def test_ag_public_operation_gets_no_token(captured):
+    from oed_cli.invoke import call_operation
+
+    captured["set_token"]("tok-abc")
+    op = _op("getHealth")
+    call_operation(op)
+    assert "access_token" not in captured["params"]
+
+
+def test_non_ag_service_gets_no_token(captured):
+    from oed_cli.dynamic import operations_table
+    from oed_cli.invoke import call_operation
+
+    spec = {
+        "openapi": "3.0.3",
+        "info": {"title": "x", "version": "1.0.0"},
+        "paths": {
+            "/v1/foo": {
+                "get": {
+                    "operationId": "getFoo",
+                    "parameters": [
+                        {
+                            "name": "access_token",
+                            "in": "query",
+                            "required": True,
+                            "schema": {"type": "string"},
+                        }
+                    ],
+                }
+            }
+        },
+    }
+    captured["set_token"]("tok-abc")
+    op = operations_table(spec, "other", base_url="https://apig.osinfra.cn")["getFoo"]
+    call_operation(op)
+    assert "access_token" not in captured["params"]
+
+
+def test_ag_dry_run_masks_stored_token(captured):
+    from oed_cli.invoke import call_operation
+
+    captured["set_token"]("super-secret-token")
+    op = _op("listAuthenticatedUserIssues")
+    dry = call_operation(op, dry_run=True)
+    assert dry["request"]["query"]["access_token"] == "<stored>"
+    assert "super-secret-token" not in str(dry)