oed-cli 0.3.0rc2__tar.gz → 0.3.1__tar.gz

{oed_cli-0.3.0rc2/src/oed_cli.egg-info → oed_cli-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: oed-cli
-Version: 0.3.0rc2
+Version: 0.3.1
 Summary: oed — openEuler Infra command line. Auto-discovered, AI-friendly.
 Author: oed-cli contributors
 License: Apache-2.0
@@ -82,7 +82,7 @@ pip install -e .
 Verify:
 
 ```
-oed --version       # → oed, version 0.3.0rc2
+oed --version       # → oed, version 0.3.1
 ```
 
 ## Quick start: install, then call
@@ -131,6 +131,15 @@ oed cve getSecurityNoticeByCveId --cve-id CVE-2019-10082 \
   | jq '.response.result[0] | {cveId, affectedProduct, affectedComponent}'
 ```
 
+By default `oed` is quiet: only the result JSON reaches stdout, and errors reach stderr — so the pipe above is always clean. Diagnostics and human-progress prompts are level-gated:
+
+- `oed --log-level info <…>` — also show human prompts (e.g. the device-flow "visit URL" line).
+- `oed --log-level debug <…>` — also show HTTP request/response, discovery cache, and token-refresh diagnostics.
+- `-v` = `--log-level debug`, `-q` = `--log-level warning` (the default).
+- `OED_LOG_LEVEL=debug|info|warning` sets it without a flag.
+
+The flag may appear anywhere in the command line and applies to both built-in commands (`oed info`, `oed auth login`) and dynamic dispatch (`oed <service> <method>`).
+
 ```
 {
   "cveId": "CVE-2019-10082",

{oed_cli-0.3.0rc2 → oed_cli-0.3.1}/README.md

@@ -37,7 +37,7 @@ pip install -e .
 Verify:
 
 ```
-oed --version       # → oed, version 0.3.0rc2
+oed --version       # → oed, version 0.3.1
 ```
 
 ## Quick start: install, then call
@@ -86,6 +86,15 @@ oed cve getSecurityNoticeByCveId --cve-id CVE-2019-10082 \
   | jq '.response.result[0] | {cveId, affectedProduct, affectedComponent}'
 ```
 
+By default `oed` is quiet: only the result JSON reaches stdout, and errors reach stderr — so the pipe above is always clean. Diagnostics and human-progress prompts are level-gated:
+
+- `oed --log-level info <…>` — also show human prompts (e.g. the device-flow "visit URL" line).
+- `oed --log-level debug <…>` — also show HTTP request/response, discovery cache, and token-refresh diagnostics.
+- `-v` = `--log-level debug`, `-q` = `--log-level warning` (the default).
+- `OED_LOG_LEVEL=debug|info|warning` sets it without a flag.
+
+The flag may appear anywhere in the command line and applies to both built-in commands (`oed info`, `oed auth login`) and dynamic dispatch (`oed <service> <method>`).
+
 ```
 {
   "cveId": "CVE-2019-10082",

{oed_cli-0.3.0rc2 → oed_cli-0.3.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "oed-cli"
-version = "0.3.0rc2"
+version = "0.3.1"
 description = "oed — openEuler Infra command line. Auto-discovered, AI-friendly."
 readme = "README.md"
 requires-python = ">=3.10"

{oed_cli-0.3.0rc2 → oed_cli-0.3.1}/src/oed_cli/__init__.py

@@ -2,5 +2,5 @@
 
 from __future__ import annotations
 
-__version__ = "0.3.0rc2"
+__version__ = "0.3.1"
 __all__ = ["__version__"]

{oed_cli-0.3.0rc2 → oed_cli-0.3.1}/src/oed_cli/auth.py

@@ -11,6 +11,12 @@ Storage:
     cache contains ``access_token`` + ``refresh_token`` + account metadata,
     which is what enables silent refresh on subsequent calls.
 
+    On Windows, when the OS keyring backend is unavailable (the default install
+    lacks the ``[os-keyring-windows]`` extra), the plaintext fallback is
+    transparently DPAPI-encrypted (bound to the current Windows user) before
+    being written, because NTFS ignores ``0600``. macOS / Linux write plaintext
+    JSON unchanged. See :func:`_dpapi_enabled`.
+
 Public surface:
     - :func:`save_auth` / :func:`load_auth` / :func:`clear_auth` — manual token
       persistence (also synthesizes a minimal MSAL cache for backward compat)
@@ -32,12 +38,13 @@ from __future__ import annotations
 
 import contextlib
 import json
+import logging
 import os
 import subprocess
 import sys
 import time
 import webbrowser
-from base64 import b64decode
+from base64 import b64decode, b64encode
 from collections.abc import Callable
 from importlib.resources import files
 from pathlib import Path
@@ -50,6 +57,8 @@ import tomllib
 
 from .discovery import ag_token_path, auth_token_path
 
+log = logging.getLogger("oed")
+
 # Best-effort token lifetime — the openEuler gateway does not publish a TTL.
 TOKEN_MAX_AGE = 24 * 60 * 60
 
@@ -215,8 +224,9 @@ class _SecureStore:
     def save(self, payload: dict[str, Any]) -> str:
         """Persist ``payload`` via the best available backend.
 
-        Returns the backend label (``"keyring"`` or ``"plaintext"``) so the
-        caller can surface it (``oed auth status``).
+        Returns the backend label (``"keyring"``, ``"plaintext-dpapi"`` on
+        Windows, or ``"plaintext"`` elsewhere) so the caller can surface it
+        (``oed auth status``).
         """
 
         path = self._fallback_path()
@@ -239,8 +249,8 @@ class _SecureStore:
                 self._available = False
         path.parent.mkdir(parents=True, exist_ok=True)
         _atomic_write_json_plaintext(path, payload)
-        self._last_backend = "plaintext"
-        return "plaintext"
+        self._last_backend = "plaintext-dpapi" if _dpapi_enabled() else "plaintext"
+        return self._last_backend
 
     def load(self) -> dict[str, Any] | None:
         """Read ``payload`` from the best available backend.
@@ -269,7 +279,10 @@ class _SecureStore:
                         self._keyring.delete_password(_KEYRING_SERVICE, self._username)  # type: ignore[union-attr]
         # Fallback: plaintext file (migration or no-keyring envs).
         existing = _read_existing(self._fallback_path())
-        self._last_backend = "plaintext" if existing else "unprobed"
+        if existing:
+            self._last_backend = "plaintext-dpapi" if _dpapi_enabled() else "plaintext"
+        else:
+            self._last_backend = "unprobed"
         return existing or None
 
     def clear(self) -> None:
@@ -283,7 +296,12 @@ class _SecureStore:
         self._last_backend = "unprobed"
 
     def backend_label(self) -> str:
-        """Last backend actually used (``"keyring"`` / ``"plaintext"`` / ``"unprobed"``)."""
+        """Last backend actually used.
+
+        One of ``"keyring"`` (OS keystore), ``"plaintext-dpapi"`` (Windows
+        DPAPI-encrypted fallback), ``"plaintext"`` (macOS/Linux fallback), or
+        ``"unprobed"``.
+        """
 
         return self._last_backend
 
@@ -430,6 +448,7 @@ def _try_silent_refresh(stored: dict[str, Any]) -> str | None:
     with contextlib.suppress(Exception):
         rt_entries = list(cache.search("RefreshToken"))
     if not rt_entries:
+        log.debug("silent refresh: no refresh_token in cache, skipping")
         return None
 
     client_id = get_client_id()
@@ -444,8 +463,10 @@ def _try_silent_refresh(stored: dict[str, Any]) -> str | None:
 
     accounts = app.get_accounts()
     if not accounts:
+        log.debug("silent refresh: no account in cache, skipping")
         return None
 
+    log.debug("silent refresh: attempting acquire_token_silent")
     with contextlib.suppress(Exception):
         result = app.acquire_token_silent(
             scopes=[],  # reserved scopes (openid/profile/offline_access) added by MSAL
@@ -454,7 +475,9 @@ def _try_silent_refresh(stored: dict[str, Any]) -> str | None:
         if result and "access_token" in result:
             # Persist the refreshed cache back to disk.
             save_msal_auth(cache)
+            log.debug("silent refresh: succeeded, cache persisted")
             return result["access_token"]
+    log.debug("silent refresh: no token returned")
     return None
 
 
@@ -689,9 +712,11 @@ def device_login(
     """Run RFC 8628 device authorization grant.
 
     Returns dict with ``access_token`` (and optional ``refresh_token``) on
-    success; ``None`` on failure or cancellation. Prints stage JSON to stdout
-    and human prompts to stderr. The caller is responsible for persisting the
-    resulting MSAL token cache via :func:`save_msal_auth`.
+    success; ``None`` on failure or cancellation. Prints human prompts and
+    machine-readable stage JSON to **stderr** — stdout stays reserved for the
+    caller's single success envelope (the ``| jq`` contract). The caller is
+    responsible for persisting the resulting MSAL token cache via
+    :func:`save_msal_auth`.
     """
 
     client_id = get_client_id()
@@ -747,36 +772,39 @@ def device_login(
 
     user_code = flow["user_code"]
     verification_uri = flow.get("verification_uri", "")
-    expires_in = int(flow.get("expires_in", 1800))
-    interval = int(flow.get("interval", 5))
+    # The code-embedded URL is the one-paste path — the bare device page would
+    # make the user retype the code by hand.
+    verify_url = flow.get("verification_uri_complete") or verification_uri
 
+    # stderr human prompts first — clear, actionable, ready-to-open URL front
+    # and center. The machine-readable stage JSON stays on stderr too, so
+    # agents keep stdout reserved for the caller's single JSON envelope.
     click.echo(
-        json.dumps(
-            {
-                "ok": True,
-                "stage": "device_code_issued",
-                "user_code": user_code,
-                "verification_uri": verification_uri,
-                "verification_uri_complete": flow.get("verification_uri_complete"),
-                "expires_in": expires_in,
-                "interval": interval,
-            },
-            ensure_ascii=False,
-        )
+        "1. Please open the following link in your browser and complete the "
+        f"authorization: {verification_uri}",
+        err=True,
     )
+    if user_code:
+        click.echo(
+            f"2. Please enter the following code in the browser: "
+            f"{click.style(user_code, fg='cyan', bold=True)}",
+            err=True,
+        )
 
-    # stderr human prompts
-    click.echo(
+    # Human prompt (stderr, level-gated): the stage JSON above already carries
+    # user_code + verification_uri for agents; this line is the friendlier
+    # interactive nudge. Default level (warning) hides it — ``--log-level info``
+    # shows it, ``--log-level debug`` shows it plus the HTTP diagnostics.
+    log.info(
         flow.get("message")
-        or f"Visit {verification_uri} and enter code: {user_code}",
-        err=True,
+        or f"Visit {verification_uri} and enter code: {user_code}"
     )
     if copy_code and _copy_to_clipboard(user_code):
-        click.echo("(user_code copied to clipboard)", err=True)
+        log.info("(user_code copied to clipboard)")
 
-    # Best-effort auto-open the verification URL.
-    if open_browser and verification_uri:
-        _try_open_browser(verification_uri)
+    # Best-effort auto-open the verification URL (code pre-filled when possible).
+    if open_browser and verify_url:
+        _try_open_browser(verify_url)
 
     # MSAL handles slow_down + anti-fast-poll + 5xx-keep-polling internally.
     # Its default exit_condition uses flow["expires_at"], set in
@@ -845,18 +873,15 @@ def _fetch_user_allowlist(
     The endpoint URL comes from ``defaults.toml [oauth].cli_user_data_url``
     with an ``OED_USER_DATA_URL`` env override (useful for fork builds).
 
-    Each branch emits a one-line diagnostic to stderr (keyed by ``stage``)
-    so an operator running ``oed auth login`` can see what the server
-    returned without grepping the source. Stdout stays reserved for the
-    success-JSON envelope — these prints never break ``| jq``.
+    Each branch emits a human-readable diagnostic to stderr so an operator
+    running ``oed auth login`` can see what happened without grepping the
+    source. Stdout stays reserved for the success-JSON envelope — these
+    prints never break ``| jq``.
     """
     url = os.environ.get("OED_USER_DATA_URL") or _get_user_data_url()
     if not url:
         click.echo(
-            json.dumps(
-                {"ok": True, "stage": "user_data_skipped", "reason": "no_user_data_url"},
-                ensure_ascii=False,
-            ),
+            "No user-data URL configured; skipping per-user service allowlist fetch.",
             err=True,
         )
         return None
@@ -868,6 +893,7 @@ def _fetch_user_allowlist(
     params: dict[str, str] = {}
     if user_code:
         params["user_code"] = user_code
+    log.debug("user-data fetch %s params=%s", url, params)
     try:
         resp = httpx.get(
             url,
@@ -881,46 +907,29 @@ def _fetch_user_allowlist(
         # an operator can tell apart auth (401/403) from missing endpoint
         # (404) from upstream errors (5xx) without re-running the curl.
         click.echo(
-            json.dumps(
-                {
-                    "ok": False,
-                    "stage": "user_data_fetch_failed",
-                    "url": url,
-                    "status": exc.response.status_code,
-                    "reason": exc.response.reason_phrase,
-                    "body_preview": exc.response.text[:512],
-                },
-                ensure_ascii=False,
-            ),
+            f"Failed to fetch user service allowlist: HTTP {exc.response.status_code} "
+            f"{exc.response.reason_phrase} from {url}\n"
+            f"  body: {exc.response.text[:512]}",
             err=True,
         )
         return None
     except httpx.HTTPError:
         # Connect / read / DNS / timeout — no response object.
         click.echo(
-            json.dumps(
-                {"ok": False, "stage": "user_data_fetch_failed", "url": url},
-                ensure_ascii=False,
-            ),
+            f"Failed to fetch user service allowlist (network error): {url}",
             err=True,
         )
         return None
 
     raw_body = resp.text
+    log.debug("user-data %s -> %d", url, resp.status_code)
     try:
         body = resp.json()
     except ValueError:
         click.echo(
-            json.dumps(
-                {
-                    "ok": False,
-                    "stage": "user_data_parse_failed",
-                    "url": url,
-                    "status": resp.status_code,
-                    "body_preview": raw_body[:512],
-                },
-                ensure_ascii=False,
-            ),
+            f"Failed to parse user service allowlist response (HTTP {resp.status_code}) "
+            f"from {url}\n"
+            f"  body: {raw_body[:512]}",
             err=True,
         )
         return None
@@ -940,35 +949,16 @@ def _fetch_user_allowlist(
                 data = inner  # enveloped shape
     if not isinstance(data, str):
         click.echo(
-            json.dumps(
-                {
-                    "ok": False,
-                    "stage": "user_data_unexpected_shape",
-                    "url": url,
-                    "status": resp.status_code,
-                    "body": body,
-                },
-                ensure_ascii=False,
-            ),
+            f"Unexpected response shape from user service allowlist endpoint "
+            f"(HTTP {resp.status_code}) from {url}\n"
+            f"  body: {json.dumps(body, ensure_ascii=False)[:512]}",
             err=True,
         )
         return None
     parsed = [s.strip() for s in data.split(",") if s.strip()]
     click.echo(
-        json.dumps(
-            {
-                "ok": True,
-                "stage": "user_data_fetched",
-                "url": url,
-                "status": resp.status_code,
-                "raw_data_field": data,
-                "parsed_allowlist": parsed,
-                "count": len(parsed),
-                "sent_user_code_param": bool(user_code),
-                "response_envelope": "wrapped" if isinstance(body.get("data"), dict) else "flat",
-            },
-            ensure_ascii=False,
-        ),
+        f"Successfully granted {len(parsed)} services:"
+        f"({', '.join(parsed) if parsed else 'none'})",
         err=True,
     )
     # Empty list is preserved (caller treats [] the same as None — fail-open).
@@ -1012,12 +1002,6 @@ def _finalize_device_result(
         save_msal_auth(cache, allowlist=allowlist)
         summary = _summarize_token_response(result)
         summary["allowlist"] = allowlist
-        click.echo(
-            json.dumps(
-                summary,
-                ensure_ascii=False,
-            )
-        )
         return result
 
     err = result.get("error") or "unknown"
@@ -1080,13 +1064,111 @@ def manual_login() -> dict[str, Any] | None:
 # ---------------------------------------------------------------------------
 
 
+def _dpapi_enabled() -> bool:
+    """Whether the on-disk plaintext fallback should be DPAPI-encrypted.
+
+    True only on Windows. macOS / Linux keep writing plaintext JSON (0600 is
+    a real permission there, and they almost always reach the keyring backend
+    anyway). The :func:`_dpapi_protect` / :func:`_dpapi_unprotect` ctypes calls
+    sit behind this gate, so they are never invoked — and ``ctypes.windll`` is
+    never touched — on non-Windows.
+    """
+
+    return sys.platform == "win32"
+
+
+def _dpapi_protect(data: bytes) -> bytes:
+    """Encrypt ``data`` with Windows DPAPI (``crypt32.CryptProtectData``).
+
+    Bound to the current Windows user (no entropy), so the ciphertext can only
+    be decrypted by this user on this machine. Raises :class:`UserError` on any
+    failure — we deliberately do NOT fall back to plaintext, since avoiding
+    plaintext on Windows is the whole point.
+    """
+
+    import ctypes
+    from ctypes import wintypes
+
+    from .errors import UserError
+
+    class _DATA_BLOB(ctypes.Structure):
+        _fields_ = [
+            ("cbData", wintypes.DWORD),
+            ("pbData", ctypes.POINTER(ctypes.c_char)),
+        ]
+
+    buf = ctypes.create_string_buffer(data, len(data))
+    ptr = ctypes.cast(buf, ctypes.POINTER(ctypes.c_char))
+    blob_in = _DATA_BLOB(len(data), ptr)  # type: ignore[arg-type]
+    blob_out = _DATA_BLOB()
+    try:
+        ok = ctypes.windll.crypt32.CryptProtectData(  # type: ignore[attr-defined]
+            ctypes.byref(blob_in), None, None, None, None, 0, ctypes.byref(blob_out)
+        )
+        if not ok:
+            raise OSError(f"CryptProtectData returned {ok}")
+        size = blob_out.cbData
+        ciphertext = ctypes.string_at(blob_out.pbData, size)
+    except Exception as exc:  # noqa: BLE001 — ctypes/OS error → readable UserError
+        raise UserError(
+            f"DPAPI encryption failed: {exc}",
+            kind="dpapi_protect_failed",
+            hint="Could not encrypt the token cache with Windows DPAPI. "
+            "Run `oed auth login` again, or install `oed-cli[os-keyring-windows]` "
+            "to use the Credential Manager backend instead.",
+        ) from exc
+    finally:
+        with contextlib.suppress(Exception):
+            ctypes.windll.kernel32.LocalFree(blob_out.pbData)  # type: ignore[attr-defined]
+    return ciphertext
+
+
+def _dpapi_unprotect(data: bytes) -> bytes:
+    """Decrypt DPAPI ciphertext (``crypt32.CryptUnprotectData``).
+
+    Raises on failure (wrong user / corrupt). The caller
+    (:func:`_read_existing`) treats any exception as a corrupt file.
+    """
+
+    import ctypes
+    from ctypes import wintypes
+
+    class _DATA_BLOB(ctypes.Structure):
+        _fields_ = [
+            ("cbData", wintypes.DWORD),
+            ("pbData", ctypes.POINTER(ctypes.c_char)),
+        ]
+
+    buf = ctypes.create_string_buffer(data, len(data))
+    ptr = ctypes.cast(buf, ctypes.POINTER(ctypes.c_char))
+    blob_in = _DATA_BLOB(len(data), ptr)  # type: ignore[arg-type]
+    blob_out = _DATA_BLOB()
+    ok = ctypes.windll.crypt32.CryptUnprotectData(  # type: ignore[attr-defined]
+        ctypes.byref(blob_in), None, None, None, None, 0, ctypes.byref(blob_out)
+    )
+    if not ok:
+        raise OSError(f"CryptUnprotectData returned {ok}")
+    try:
+        size = blob_out.cbData
+        return ctypes.string_at(blob_out.pbData, size)
+    finally:
+        ctypes.windll.kernel32.LocalFree(blob_out.pbData)  # type: ignore[attr-defined]
+
+
 def _read_existing(path: Path) -> dict[str, Any]:
-    """Read existing ``auth.json``; return empty dict if missing or corrupt."""
+    """Read existing ``auth.json``; return empty dict if missing or corrupt.
+
+    On Windows an encrypted envelope ``{"dpapi_v1": "<base64 ciphertext>"}``
+    is transparently decrypted. A legacy plaintext file (no ``dpapi_v1`` key)
+    is returned as-is — it migrates to the encrypted form on the next
+    :func:`_atomic_write_json_plaintext` write. Decrypt failure (wrong user /
+    corrupt) is treated like any corrupt file: unlink + return ``{}``.
+    """
 
     if not path.is_file():
         return {}
     try:
-        return json.loads(path.read_text(encoding="utf-8"))
+        parsed = json.loads(path.read_text(encoding="utf-8"))
     except (OSError, json.JSONDecodeError, UnicodeDecodeError):
         # Corrupt file — wrong encoding / truncated / half-written. Drop it
         # rather than crash the login flow. Caller treats {} as
@@ -1095,6 +1177,17 @@ def _read_existing(path: Path) -> dict[str, Any]:
             path.unlink()
         return {}
 
+    if _dpapi_enabled() and isinstance(parsed, dict) and "dpapi_v1" in parsed:
+        try:
+            ciphertext = b64decode(parsed["dpapi_v1"])
+            plaintext = _dpapi_unprotect(ciphertext)
+            return json.loads(plaintext.decode("utf-8"))
+        except Exception:  # noqa: BLE001 — wrong user / corrupt ciphertext
+            with contextlib.suppress(OSError):
+                path.unlink()
+            return {}
+    return parsed
+
 
 def _atomic_write_json_plaintext(path: Path, data: dict[str, Any]) -> None:
     """Write ``data`` as JSON to ``path`` atomically with 0600 perms.
@@ -1103,10 +1196,24 @@ def _atomic_write_json_plaintext(path: Path, data: dict[str, Any]) -> None:
     is unreachable. Production callers go through
     :func:`save_auth` / :func:`save_msal_auth` / :func:`update_auth_from_response_headers`,
     not this helper directly.
+
+    On Windows the plaintext payload is DPAPI-encrypted (bound to the current
+    Windows user) before being written, so a default install without the
+    ``[os-keyring-windows]`` extra still never lands an unencrypted token on
+    disk — NTFS ignores ``0600``, so the app-layer encryption is the real
+    protection. macOS / Linux write plaintext JSON unchanged (0600 is real
+    there). See :func:`_dpapi_enabled`.
     """
 
     tmp = path.with_suffix(path.suffix + ".tmp")
-    tmp.write_text(json.dumps(data, ensure_ascii=False, indent=2), encoding="utf-8")
+    if _dpapi_enabled():
+        blob = json.dumps(data, ensure_ascii=False, indent=2).encode("utf-8")
+        ciphertext = _dpapi_protect(blob)
+        payload = {"dpapi_v1": b64encode(ciphertext).decode("ascii")}
+        body = json.dumps(payload, indent=2)
+    else:
+        body = json.dumps(data, ensure_ascii=False, indent=2)
+    tmp.write_text(body, encoding="utf-8")
     with contextlib.suppress(OSError):
         os.chmod(tmp, 0o600)
     tmp.replace(path)
@@ -1383,7 +1490,6 @@ def auth_logout_cmd() -> None:
         )
     )
 
-
 def run_login(manual: bool) -> None:
     """Public entry for the top-level ``oed login`` shortcut.
 
@@ -1403,7 +1509,6 @@ def _run_login(manual: bool) -> None:
     """
 
     from .errors import UserError
-
     if manual:
         try:
             creds = manual_login()
@@ -1417,9 +1522,6 @@ def _run_login(manual: bool) -> None:
             )
             raise SystemExit(1)
         token = creds.get("token")
-        cookie = creds.get("cookie")
-        refresh_token = None
-        id_token = None
     else:
         # device_login() reads get_scopes() internally; pass nothing and let
         # it fall back to _BASE_SCOPES. Passing scope=[] would override the
@@ -1437,9 +1539,6 @@ def _run_login(manual: bool) -> None:
             )
             raise SystemExit(1)
         token = result.get("access_token")
-        cookie = None
-        refresh_token = result.get("refresh_token")
-        id_token = result.get("id_token")
 
     if not token:
         click.echo(
@@ -1448,25 +1547,7 @@ def _run_login(manual: bool) -> None:
         )
         raise SystemExit(1)
 
-    # Both branches already persisted to auth.json; this is informational.
-    path = auth_token_path()
-
-    click.echo(
-        json.dumps(
-            {
-                "ok": True,
-                "stage": "saved",
-                "path": str(path),
-                "has_cookie": bool(cookie),
-                "has_refresh_token": bool(refresh_token),
-                "has_id_token": bool(id_token),
-                "token_fingerprint": _token_fingerprint(token),
-            },
-            ensure_ascii=False,
-            indent=2,
-        )
-    )
-
+    click.echo(click.style("Login succeeded.", fg="green", bold=True))
 
 @auth_group.command("login")
 @click.option(
@@ -1593,10 +1674,11 @@ def token_backend(service: str = "ag") -> str:
     """The storage backend actually used for ``service``'s last write/read.
 
     Reflects the cached verdict from the most recent :meth:`_SecureStore.save`
-    / :meth:`_SecureStore.load` (``"keyring"`` / ``"plaintext"`` / ``"unprobed"``)
-    without re-probing. Use it right after :func:`store_token` to tell the user
-    *where* their token landed — the OS credential manager (no on-disk file) or
-    the 0600 plaintext fallback (the file at :func:`token_path`).
+    / :meth:`_SecureStore.load` (``"keyring"`` / ``"plaintext-dpapi"`` /
+    ``"plaintext"`` / ``"unprobed"``) without re-probing. Use it right after
+    :func:`store_token` to tell the user *where* their token landed — the OS
+    credential manager (no on-disk file), the DPAPI-encrypted fallback
+    (Windows), or the 0600 plaintext fallback (the file at :func:`token_path`).
     """
 
     return _ag_store(service).backend_label()
@@ -1605,9 +1687,9 @@ def token_backend(service: str = "ag") -> str:
 def token_info(service: str = "ag") -> dict[str, Any] | None:
     """Return ``{encryption, created_at}`` metadata for ``service``'s token.
 
-    ``encryption`` reports the backend actually used (``"keyring"`` or
-    ``"plaintext"``), not a hand-rolled cipher marker. Returns ``None`` when
-    no token is stored.
+    ``encryption`` reports the backend actually used (``"keyring"``,
+    ``"plaintext-dpapi"`` on Windows, or ``"plaintext"`` on macOS/Linux), not
+    a hand-rolled cipher marker. Returns ``None`` when no token is stored.
     """
 
     store = _ag_store(service)

{oed_cli-0.3.0rc2 → oed_cli-0.3.1}/src/oed_cli/cli.py

@@ -137,6 +137,10 @@ def cli(ctx: click.Context, no_color: bool) -> None:
     """oed — openEuler Infra command line. Auto-discovered, AI-friendly."""
     ctx.ensure_object(dict)
     ctx.obj["no_color"] = no_color
+    # Bare `oed` (no subcommand) renders the same help as `oed --help`
+    # (including the auto-discovered services section from OedCli.get_help).
+    if ctx.invoked_subcommand is None:
+        click.echo(ctx.get_help())
 
 
 # Register reserved sub-groups from sibling modules.