secflow-cli 0.2.2__py3-none-any.whl → 0.2.3__py3-none-any.whl

secflow_cli/__init__.py

@@ -1 +0,0 @@
-"""Independent operator CLI; no server imports or executable replacement."""

secflow_cli/access_profile_commands.py

@@ -1,12 +1,8 @@
-"""Default access profile metadata through the existing org-admin API."""
 from collections.abc import Mapping
-from uuid import UUID
-from uuid import uuid4
-import re
 import sys
 
-from secflow_sdk import SecFlowConfigError, SecFlowSdkError
 from secflow_cli.account_commands import required_input
+from secflow_cli.command_support import canonical_id, idempotency_key, is_uuid, run_mutation, typed_confirm
 from secflow_cli.errors import CliError
 
 FLAGS = ("allow_cli_login", "allow_api_session", "allow_namespace_request")
@@ -28,66 +24,37 @@ def add_commands(groups):
 
 def prepare(args):
     profile_id = required_input(args, "profile_id", "profile ID")
-    try:
-        if str(UUID(profile_id)) != profile_id:
-            raise ValueError
-    except ValueError:
-        raise CliError(2, "INVALID_INPUT", "Supply a canonical profile UUID.") from None
+    canonical_id(profile_id, "Supply a canonical profile UUID.")
     profile = dict(profile_id=profile_id, domain="intflow.ai", roles=[], allow_audit_read=False, allow_plaintext_read=False)
     for field in FLAGS:
         value = required_input(args, field, field.replace("_", " "))
         if value not in ("true", "false"):
             raise CliError(2, "INVALID_INPUT", "Profile settings must be true or false.")
         profile[field] = value == "true"
-    key = args.idempotency_key or "cli-access-profile-" + str(uuid4())
-    if not re.fullmatch(r"[A-Za-z0-9_.:-]{16,128}", key):
-        raise CliError(2, "INVALID_INPUT", "Supply a normalized idempotency key of 16-128 characters.")
+    key = idempotency_key(args, "cli-access-profile-", "Supply a normalized idempotency key of 16-128 characters.")
     print("Replace global default access profile: " + profile_id, file=sys.stderr)
     for field in FLAGS:
         print(field + ": " + str(profile[field]).lower(), file=sys.stderr)
     print("Full replacement; concurrent changes are not protected by a server precondition. This does not grant roles or revoke existing credentials.", file=sys.stderr)
-    if not args.yes:
-        if args.non_interactive or args.token_stdin or not sys.stdin.isatty():
-            raise CliError(2, "CONFIRMATION_REQUIRED", "Supply all settings and --yes for unattended execution or when stdin carries a token.")
-        print("Type the profile ID to confirm: ", end="", file=sys.stderr, flush=True)
-        try:
-            answer = input()
-        except EOFError:
-            answer = None
-        if answer != profile_id:
-            raise CliError(2, "CONFIRMATION_CANCELLED", "Profile replacement cancelled; no mutation was sent.")
+    typed_confirm(args, profile_id, prompt="Type the profile ID to confirm: ", cancelled="Profile replacement cancelled; no mutation was sent.",
+                  required="Supply all settings and --yes for unattended execution or when stdin carries a token.")
     return dict(profile=profile, idempotency_key=key)
 
 
-def execute(client, values, *, mapped_error):
-    key = values["idempotency_key"]
-    print("Idempotency key: " + key, file=sys.stderr)
-    data = dict(idempotency_key=key, outcome="unknown", profile=None)
-    try:
-        result = metadata(client.put_default_access_profile(**values))
-        if result != values["profile"]:
-            raise CliError(7, "INVALID_RESPONSE", "The server did not confirm the requested profile.")
-        data.update(outcome="confirmed", profile=result)
-        return data, None
-    except (SecFlowSdkError, CliError) as caught:
-        error = mapped_error(caught)
-        if isinstance(caught, SecFlowConfigError):
-            data["outcome"] = "not_sent"
-        elif error.status in (2, 3, 4, 5, 6):
-            data["outcome"] = "not_confirmed"
-        else:
-            error = CliError(7, "MUTATION_OUTCOME_UNKNOWN", "Mutation completion is unknown. Inspect current state; any retry must use identical inputs and the same idempotency key.")
-        return data, error
+def execute(client, values):
+    data = dict(idempotency_key=values["idempotency_key"], outcome="unknown", profile=None)
+    return run_mutation(data, lambda: send(client, values))
+
+
+def send(client, values):
+    result = metadata(client.put_default_access_profile(**values))
+    if result != values["profile"]:
+        raise CliError(7, "INVALID_RESPONSE", "The server did not confirm the requested profile.")
+    return dict(profile=result)
 
 
 def metadata(value):
-    valid_id = False
-    if isinstance(value, Mapping) and isinstance(value.get("profile_id"), str):
-        try:
-            valid_id = str(UUID(value["profile_id"])) == value["profile_id"]
-        except ValueError:
-            pass
-    if (not valid_id or value.get("domain") != "intflow.ai" or value.get("roles") != []
+    if (not isinstance(value, Mapping) or not is_uuid(value.get("profile_id")) or value.get("domain") != "intflow.ai" or value.get("roles") != []
             or any(type(value.get(field)) is not bool for field in FLAGS)
             or value.get("allow_audit_read") is not False or value.get("allow_plaintext_read") is not False):
         raise CliError(7, "INVALID_RESPONSE", "The server returned an invalid default access profile.")

secflow_cli/account_commands.py

@@ -1,20 +1,16 @@
-"""Additive account mutations using existing Admin API contracts."""
 from __future__ import annotations
 
-import re
-import hashlib
 import sys
 from collections.abc import Mapping
-from uuid import UUID, uuid4
 
-from secflow_sdk import SecFlowConfigError, SecFlowSdkError
-
-from secflow_cli.command_support import preview_delete, require_confirmable
+from secflow_cli.command_support import canonical_id, correlation, idempotency_key, preview_delete, require_confirmable, run_mutation, typed_confirm
 from secflow_cli.errors import CliError
+from secflow_cli.output import account_metadata
 
 
 ACTIONS = ("create", "update", "reactivate", "suspend", "delete")
 DESTRUCTIVE_ACTIONS = frozenset({"suspend", "delete"})
+ACCOUNT_UUID = "Supply an exact canonical account UUID."
 
 
 def add_commands(commands):
@@ -46,18 +42,11 @@ def required_input(args, field, label):
 
 
 def prepare(args):
-    """Validate metadata and the retry key before any mutation is sent."""
-    key = args.idempotency_key or "cli-account-" + str(uuid4())
-    if not re.fullmatch(r"[A-Za-z0-9_.:-]{16,128}", key):
-        raise CliError(2, "INVALID_INPUT", "Idempotency keys must contain 16-128 letters, digits, dots, underscores, colons, or hyphens.")
+    key = idempotency_key(args, "cli-account-", "Idempotency keys must contain 16-128 letters, digits, dots, underscores, colons, or hyphens.")
     values = {"idempotency_key": key}
     if args.action == "create":
         values["email"] = required_input(args, "email", "email")
-        # The server digests the complete request, including correlation IDs.
-        # Keep these stable when a user retries in a later CLI process.
-        operation = hashlib.sha256(key.encode("ascii")).hexdigest()
-        values["request_id"] = "cli-request-" + operation
-        values["trace_id"] = "cli-trace-" + operation
+        values.update(correlation(key))
     else:
         values["account_id"] = required_input(args, "account_id", "account ID")
     if args.action == "update":
@@ -67,21 +56,13 @@ def prepare(args):
     if args.action == "reactivate":
         values["status"] = "active"
     if args.action == "delete":
-        canonical_account(values["account_id"])
+        canonical_id(values["account_id"], ACCOUNT_UUID)
         require_confirmable(args, "Supply the exact account ID and --yes for unattended execution or when stdin carries a token.")
     elif args.action in DESTRUCTIVE_ACTIONS:
         confirm_destructive(args, values["account_id"])
     return values
 
 
-def canonical_account(account_id):
-    try:
-        if str(UUID(account_id)) != account_id:
-            raise ValueError
-    except ValueError:
-        raise CliError(2, "INVALID_INPUT", "Supply an exact canonical account UUID.") from None
-
-
 def preview(args, client, values):
     return preview_delete(args, client, kind="account", target=values["account_id"], operation="accounts.impact",
                           query={"account_id": values["account_id"]},
@@ -89,55 +70,34 @@ def preview(args, client, values):
 
 
 def confirm_destructive(args, account_id):
-    canonical_account(account_id)
+    canonical_id(account_id, ACCOUNT_UUID)
     print("Suspend account: " + account_id, file=sys.stderr)
     print("Operation semantics, not a server impact preview: suspension revokes active Admin sessions and SDK tokens. Reactivation does not restore revoked credentials. Affected counts are unknown.", file=sys.stderr)
-    if args.yes:
-        return
-    if args.non_interactive or not sys.stdin.isatty() or args.token_stdin:
-        raise CliError(2, "CONFIRMATION_REQUIRED", "Supply the exact account ID and --yes for unattended execution or when stdin carries a token.")
-    print("Type the account ID to confirm: ", end="", file=sys.stderr, flush=True)
-    try:
-        answer = input()
-    except EOFError:
-        answer = None
-    if answer != account_id:
-        raise CliError(2, "CONFIRMATION_CANCELLED", "Account operation cancelled; no mutation was sent.")
-
-
-def execute(args, client, values, *, account_metadata, mapped_error):
-    key = values["idempotency_key"]
-    print("Idempotency key: " + key, file=sys.stderr)
-    data = {"idempotency_key": key, "outcome": "unknown", "account": None}
+    typed_confirm(args, account_id, prompt="Type the account ID to confirm: ", cancelled="Account operation cancelled; no mutation was sent.",
+                  required="Supply the exact account ID and --yes for unattended execution or when stdin carries a token.")
+
+
+def execute(args, client, values):
+    data = {"idempotency_key": values["idempotency_key"], "outcome": "unknown", "account": None}
     if args.action == "delete":
         data["deletion"] = None
-    try:
-        method = {"create": client.create_account, "update": client.patch_account,
-                  "reactivate": client.patch_account, "suspend": client.suspend_account,
-                  "delete": client.delete_account}[args.action]
-        response = method(**values)
-        if args.action == "delete":
-            if (not isinstance(response, Mapping) or response.get("kind") != "account"
-                    or response.get("id") != values["account_id"] or response.get("deleted") is not True
-                    or not isinstance(response.get("label"), str)):
-                raise CliError(7, "INVALID_RESPONSE", "The server did not confirm deletion of the selected account.")
-            data.update(outcome="confirmed", deletion={name: response[name] for name in ("kind", "id", "label", "deleted")})
-            return data, None
-        account = account_metadata(response)
-        if not isinstance(account.get("account_id"), str) or not account["account_id"]:
-            raise CliError(7, "INVALID_RESPONSE", "The server did not return confirmed account metadata.")
-        if args.action == "suspend" and (account["account_id"] != values["account_id"] or account.get("status") != "suspended"):
-            raise CliError(7, "INVALID_RESPONSE", "The server did not confirm suspension of the selected account.")
-        data.update(account=account, outcome="confirmed")
-        return data, None
-    except (SecFlowSdkError, CliError) as caught:
-        error = mapped_error(caught)
-        if isinstance(caught, SecFlowConfigError):
-            data["outcome"] = "not_sent"
-        elif error.status in (2, 3, 4, 5, 6):
-            # The final request was rejected; an earlier attempt using this
-            # key may have completed. Never imply rollback of that attempt.
-            data["outcome"] = "not_confirmed"
-        else:
-            error = CliError(7, "MUTATION_OUTCOME_UNKNOWN", "Mutation completion is unknown. Inspect current state; any retry must use identical inputs and the same idempotency key.")
-        return data, error
+    return run_mutation(data, lambda: send(args, client, values))
+
+
+def send(args, client, values):
+    method = {"create": client.create_account, "update": client.patch_account,
+              "reactivate": client.patch_account, "suspend": client.suspend_account,
+              "delete": client.delete_account}[args.action]
+    response = method(**values)
+    if args.action == "delete":
+        if (not isinstance(response, Mapping) or response.get("kind") != "account"
+                or response.get("id") != values["account_id"] or response.get("deleted") is not True
+                or not isinstance(response.get("label"), str)):
+            raise CliError(7, "INVALID_RESPONSE", "The server did not confirm deletion of the selected account.")
+        return {"deletion": {name: response[name] for name in ("kind", "id", "label", "deleted")}}
+    account = account_metadata(response)
+    if not isinstance(account.get("account_id"), str) or not account["account_id"]:
+        raise CliError(7, "INVALID_RESPONSE", "The server did not return confirmed account metadata.")
+    if args.action == "suspend" and (account["account_id"] != values["account_id"] or account.get("status") != "suspended"):
+        raise CliError(7, "INVALID_RESPONSE", "The server did not confirm suspension of the selected account.")
+    return {"account": account}

secflow_cli/browser_login.py

@@ -1,4 +1,3 @@
-"""Human browser login; Auth credentials stay on the SecFlow server."""
 from __future__ import annotations
 
 import base64
@@ -55,6 +54,27 @@ def acquire_session(url, timeout, *, no_browser=False):
         raise rejected() from None
 
 
+def _open_browser(verification_uri):
+    try:
+        opened = webbrowser.open(verification_uri)
+    except Exception:
+        opened = False
+    if not opened:
+        print("Open the URL above manually to continue.", file=sys.stderr)
+
+
+def _issued_session(result):
+    token = result.get("session_token")
+    if not isinstance(token, str) or not re.fullmatch(r"[A-Za-z0-9_-]{32,256}", token):
+        raise rejected()
+    if any(str(UUID(result.get(field))) != result[field] for field in ("session_id", "account_id")):
+        raise rejected()
+    expiry = datetime.fromisoformat(result["expires_at"].replace("Z", "+00:00"))
+    if expiry.tzinfo is None or expiry <= datetime.now(timezone.utc):
+        raise rejected()
+    return {field: result[field] for field in ("session_token", "session_id", "account_id", "expires_at")}
+
+
 def _acquire_session(url, timeout, *, no_browser):
     proof = base64.urlsafe_b64encode(os.urandom(32)).rstrip(b"=").decode("ascii")
     started_at = time.monotonic()
@@ -76,12 +96,7 @@ def _acquire_session(url, timeout, *, no_browser):
     print("Open " + verification_uri, file=sys.stderr)
     print("Confirm code " + created["user_code"] + " and approve the login in your browser.", file=sys.stderr)
     if not no_browser:
-        try:
-            opened = webbrowser.open(verification_uri)
-        except Exception:
-            opened = False
-        if not opened:
-            print("Open the URL above manually to continue.", file=sys.stderr)
+        _open_browser(verification_uri)
     interval = created["interval"]
     while time.monotonic() + interval < deadline:
         time.sleep(interval)
@@ -97,15 +112,7 @@ def _acquire_session(url, timeout, *, no_browser):
             continue
         if status != 200:
             raise rejected()
-        token = result.get("session_token")
-        if not isinstance(token, str) or not re.fullmatch(r"[A-Za-z0-9_-]{32,256}", token):
-            raise rejected()
-        if any(str(UUID(result.get(field))) != result[field] for field in ("session_id", "account_id")):
-            raise rejected()
-        expiry = datetime.fromisoformat(result["expires_at"].replace("Z", "+00:00"))
-        if expiry.tzinfo is None or expiry <= datetime.now(timezone.utc):
-            raise rejected()
-        return {field: result[field] for field in ("session_token", "session_id", "account_id", "expires_at")}
+        return _issued_session(result)
     raise CliError(3, "BROWSER_LOGIN_EXPIRED", "Browser login expired. Start a new login.")
 
 
@@ -119,8 +126,6 @@ def login(url, timeout, store, reference, *, no_browser=False):
             raise rejected()
         store.set(reference, session["session_token"])
     except BaseException:
-        # Do not erase a previously stored credential. Revoke only the session
-        # obtained by this invocation when validation/storage is unsuccessful.
         try:
             client.revoke_current_session()
         except Exception:

secflow_cli/command_support.py

@@ -1,10 +1,12 @@
-"""Shared validation for operator commands; never render request payloads."""
 import hashlib
 import re
 import sys
 from uuid import UUID, uuid4
 
+from secflow_sdk import SecFlowConfigError, SecFlowSdkError
+
 from secflow_cli.errors import CliError
+from secflow_cli.output import mapped_error
 
 
 def mutation_options(command, *, confirm=False):
@@ -14,39 +16,72 @@ def mutation_options(command, *, confirm=False):
         command.add_argument('--yes', action='store_true')
 
 
-def mutation_key(args):
-    key = args.idempotency_key or 'cli-operation-' + str(uuid4())
-    if not re.fullmatch(r'[A-Za-z0-9_.:-]{16,128}', key):
-        raise CliError(2, 'INVALID_INPUT', 'Idempotency keys must contain 16-128 normalized characters.')
+KEY_PATTERN = r'[A-Za-z0-9_.:-]{16,128}'
+UNKNOWN_OUTCOME = 'Mutation completion is unknown. Inspect current state; any retry must use identical inputs and the same idempotency key.'
+
+
+def idempotency_key(args, prefix, message):
+    key = args.idempotency_key or prefix + str(uuid4())
+    if not re.fullmatch(KEY_PATTERN, key):
+        raise CliError(2, 'INVALID_INPUT', message)
     return key
 
 
+def mutation_key(args):
+    return idempotency_key(args, 'cli-operation-', 'Idempotency keys must contain 16-128 normalized characters.')
+
+
 def correlation(key):
     digest = hashlib.sha256(key.encode('ascii')).hexdigest()
     return dict(request_id='cli-request-' + digest, trace_id='cli-trace-' + digest)
 
 
-def canonical_id(value):
+def is_uuid(value):
     try:
-        if str(UUID(value)) == value:
-            return value
-    except (ValueError, TypeError, AttributeError):
-        pass
-    raise CliError(2, 'INVALID_INPUT', 'Supply a canonical resource UUID.')
+        return isinstance(value, str) and str(UUID(value)) == value
+    except ValueError:
+        return False
 
 
-def confirm(args, target):
+def canonical_id(value, message='Supply a canonical resource UUID.'):
+    if not is_uuid(value):
+        raise CliError(2, 'INVALID_INPUT', message)
+    return value
+
+
+def typed_confirm(args, target, *, prompt, cancelled, required=None):
     if args.yes:
         return
-    if args.non_interactive or args.token_stdin or not sys.stdin.isatty():
-        raise CliError(2, 'CONFIRMATION_REQUIRED', 'Inspect the exact target, then supply --yes to confirm this change.')
-    print('Type the exact target to confirm: ' + target, file=sys.stderr)
+    if required is not None:
+        require_confirmable(args, required)
+    print(prompt, end='', file=sys.stderr, flush=True)
     try:
         answer = input()
     except EOFError:
         answer = None
     if answer != target:
-        raise CliError(2, 'CONFIRMATION_CANCELLED', 'Cancelled; no mutation was sent.')
+        raise CliError(2, 'CONFIRMATION_CANCELLED', cancelled)
+
+
+def confirm(args, target):
+    typed_confirm(args, target, prompt='Type the exact target to confirm: ' + target + '\n', cancelled='Cancelled; no mutation was sent.',
+                  required='Inspect the exact target, then supply --yes to confirm this change.')
+
+
+def run_mutation(data, send):
+    print('Idempotency key: ' + data['idempotency_key'], file=sys.stderr)
+    try:
+        data.update(send(), outcome='confirmed')
+        return data, None
+    except (SecFlowSdkError, CliError) as caught:
+        error = mapped_error(caught)
+        if isinstance(caught, SecFlowConfigError):
+            data['outcome'] = 'not_sent'
+        elif error.status in (2, 3, 4, 5, 6):
+            data['outcome'] = 'not_confirmed'
+        else:
+            error = CliError(7, 'MUTATION_OUTCOME_UNKNOWN', UNKNOWN_OUTCOME)
+        return data, error
 
 
 BLOCKING = frozenset({'current_account'})
@@ -58,9 +93,8 @@ def require_confirmable(args, message):
 
 
 def server_impact(client, operation, query):
-    from secflow_sdk import SecFlowSdkError
     try:
-        response = client._request_json('GET', '/v1/admin/operator/' + operation, query=tuple(query.items()))
+        response = client.get_operator_metadata(operation, parameters=query)
     except SecFlowSdkError:
         return None
     impact, blocking = response.get('impact'), response.get('blocking')
@@ -72,7 +106,6 @@ def server_impact(client, operation, query):
 
 
 def preview_delete(args, client, *, kind, target, operation, query, semantics):
-    """Show the server's current-state impact, then require exact confirmation."""
     print('Delete ' + kind + ': ' + target, file=sys.stderr)
     impact = server_impact(client, operation, query)
     if impact is None:
@@ -82,12 +115,5 @@ def preview_delete(args, client, *, kind, target, operation, query, semantics):
         print('Server impact preview of current state (not a reservation): ' + counts, file=sys.stderr)
         if impact['blocking']:
             raise CliError(6, 'PRECONDITION_FAILED', 'The server reports a blocking precondition (' + ', '.join(impact['blocking']) + '); no mutation was sent.')
-    if not args.yes:
-        print('Type the ' + kind + ' to confirm: ', end='', file=sys.stderr, flush=True)
-        try:
-            answer = input()
-        except EOFError:
-            answer = None
-        if answer != target:
-            raise CliError(2, 'CONFIRMATION_CANCELLED', kind.capitalize() + ' deletion cancelled; no mutation was sent.')
+    typed_confirm(args, target, prompt='Type the ' + kind + ' to confirm: ', cancelled=kind.capitalize() + ' deletion cancelled; no mutation was sent.')
     return impact

secflow_cli/completion.py

@@ -1,4 +1,3 @@
-"""Offline shell completion generated from the parser; never fetches server catalogs."""
 import argparse
 import json
 

secflow_cli/config.py

@@ -51,48 +51,88 @@ def credential_ref(name: str, url: str) -> str:
     return "admin:" + hashlib.sha256((profile_name(name) + "\n" + endpoint(url)).encode()).hexdigest()
 
 
+def access_denied(directory: Path) -> CliError:
+    return CliError(
+        2,
+        "CONFIG_ACCESS_DENIED",
+        f"This account has no permission to use the CLI configuration folder {directory}. "
+        "Fix the folder permissions or delete it, or set SECFLOW_CLI_CONFIG_DIR to another folder.",
+    )
+
+
+def require_readable_folder(directory: Path) -> None:
+    try:
+        os.listdir(directory)
+    except FileNotFoundError:
+        return
+    except PermissionError:
+        raise access_denied(directory) from None
+
+
+def config_directory() -> Path:
+    override = os.environ.get("SECFLOW_CLI_CONFIG_DIR")
+    if override:
+        return Path(override).expanduser()
+    if sys.platform == "win32":
+        return Path(os.environ.get("APPDATA", str(Path.home() / "AppData/Roaming"))) / "SecFlow/cli"
+    if sys.platform == "darwin":
+        return Path.home() / "Library/Application Support/SecFlow/cli"
+    return Path(os.environ.get("XDG_CONFIG_HOME", str(Path.home() / ".config"))) / "secflow/cli"
+
+
+def read_profiles_text(path: Path) -> str | None:
+    try:
+        return path.read_text(encoding="utf-8")
+    except FileNotFoundError:
+        require_readable_folder(path.parent)
+        return None
+    except PermissionError:
+        raise access_denied(path.parent) from None
+    except OSError:
+        raise CliError(2, "CONFIG_READ_FAILED", f"Cannot read the CLI profile configuration file {path}.") from None
+
+
+def parsed_profiles(text: str) -> dict:
+    try:
+        raw = json.loads(text)
+        if not isinstance(raw, dict) or set(raw) != {"version", "current", "profiles"} or raw["version"] != 1 or not isinstance(raw["profiles"], dict):
+            raise ValueError
+        for name, profile in raw["profiles"].items():
+            profile_name(name)
+            if not isinstance(profile, dict) or set(profile) != {"base_url", "credential_ref"}:
+                raise ValueError
+            if profile["credential_ref"] != credential_ref(name, endpoint(profile["base_url"])):
+                raise ValueError
+        if raw["current"] is not None and raw["current"] not in raw["profiles"]:
+            raise ValueError
+        return raw
+    except (ValueError, TypeError, KeyError):
+        raise CliError(2, "INVALID_CONFIG", "Cannot read valid CLI profile configuration.") from None
+
+
 class Profiles:
     def __init__(self):
-        override = os.environ.get("SECFLOW_CLI_CONFIG_DIR")
-        if override:
-            directory = Path(override).expanduser()
-        elif sys.platform == "win32":
-            directory = Path(os.environ.get("APPDATA", str(Path.home() / "AppData/Roaming"))) / "SecFlow/cli"
-        elif sys.platform == "darwin":
-            directory = Path.home() / "Library/Application Support/SecFlow/cli"
-        else:
-            directory = Path(os.environ.get("XDG_CONFIG_HOME", str(Path.home() / ".config"))) / "secflow/cli"
-        self.path = directory.resolve() / "profiles.json"
-        if any((ancestor / ".git").exists() for ancestor in self.path.parents):
-            raise CliError(2, "INVALID_CONFIG_LOCATION", "CLI configuration must be outside a repository.")
-        self.data = {"version": 1, "current": None, "profiles": {}}
+        self.path = config_directory().resolve() / "profiles.json"
         try:
-            if self.path.exists():
-                raw = json.loads(self.path.read_text(encoding="utf-8"))
-                if not isinstance(raw, dict) or set(raw) != {"version", "current", "profiles"} or raw["version"] != 1 or not isinstance(raw["profiles"], dict):
-                    raise ValueError
-                for name, profile in raw["profiles"].items():
-                    profile_name(name)
-                    if not isinstance(profile, dict) or set(profile) != {"base_url", "credential_ref"}:
-                        raise ValueError
-                    url = endpoint(profile["base_url"])
-                    if profile["credential_ref"] != credential_ref(name, url):
-                        raise ValueError
-                if raw["current"] is not None and raw["current"] not in raw["profiles"]:
-                    raise ValueError
-                self.data = raw
-        except (OSError, ValueError, TypeError, KeyError):
-            raise CliError(2, "INVALID_CONFIG", "Cannot read valid CLI profile configuration.") from None
+            inside_repository = any((ancestor / ".git").exists() for ancestor in self.path.parents)
+        except PermissionError:
+            raise access_denied(self.path.parent) from None
+        if inside_repository:
+            raise CliError(2, "INVALID_CONFIG_LOCATION", "CLI configuration must be outside a repository.")
+        text = read_profiles_text(self.path)
+        self.data = parsed_profiles(text) if text is not None else {"version": 1, "current": None, "profiles": {}}
 
     def save(self):
-        self.path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
         temporary = None
         try:
+            self.path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
             with tempfile.NamedTemporaryFile(mode="w", encoding="utf-8", dir=self.path.parent, delete=False) as stream:
                 temporary = Path(stream.name)
                 json.dump(self.data, stream, indent=2)
                 stream.write("\n")
             os.replace(temporary, self.path)
+        except PermissionError:
+            raise access_denied(self.path.parent) from None
         except OSError:
             raise CliError(2, "CONFIG_WRITE_FAILED", "Cannot save CLI profile configuration.") from None
         finally:

secflow_cli/credentials.py

@@ -4,7 +4,6 @@ from secflow_cli.errors import CliError
 
 
 class CredentialStore:
-    """Only explicitly supported OS stores; never file-backed fallback plugins."""
 
     service = "secflow-cli"
     supported = frozenset({
@@ -24,9 +23,6 @@ class CredentialStore:
             import keyring
             backend = keyring.get_keyring()
             kind = (type(backend).__module__, type(backend).__name__)
-            # Keychain and Secret Service may display OS unlock dialogs. Until
-            # a prompt-free adapter is available, require explicit credentials
-            # in unattended sessions on these platforms.
             if not self.allow_interaction and kind != ("keyring.backends.Windows", "WinVaultKeyring"):
                 raise RuntimeError
             if kind not in self.supported or backend.priority <= 0: