secflow-cli 0.2.2__tar.gz → 0.2.3__tar.gz

{secflow_cli-0.2.2/src/secflow_cli.egg-info → secflow_cli-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secflow-cli
-Version: 0.2.2
+Version: 0.2.3
 Summary: SecFlow operator CLI
 License-Expression: MIT
 Project-URL: Repository, https://github.com/yeon3724/secflow
@@ -8,7 +8,7 @@ Project-URL: Issues, https://github.com/yeon3724/secflow/issues
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: secflow-sdk==0.1.8
+Requires-Dist: secflow-sdk==0.1.9
 Requires-Dist: keyring<26,>=25
 Dynamic: license-file
 
@@ -30,7 +30,7 @@ npm install --global @intflow/secflow-cli
 secflowctl --version
 ```
 
-The Python distribution requires Python 3.10+. Installation automatically includes the Admin-capable `secflow-sdk==0.1.8` dependency.
+The Python distribution requires Python 3.10+. Installation automatically includes the matching Admin-capable `secflow-sdk` dependency.
 
 The npm distribution includes Python and the CLI dependencies in OS-specific native packages. Initial targets: Windows x64, macOS Intel/Apple Silicon, and Linux x64 with glibc 2.35+ (Ubuntu 22.04+). Alpine/musl and Linux ARM are not npm targets yet; use the Python distribution there. Keep npm optional dependencies enabled. Installation has no postinstall script or runtime download. Native binaries are not platform-signed or notarized.
 
@@ -63,9 +63,9 @@ For automation use `SECFLOW_ADMIN_SESSION_TOKEN` supplied by your secret manager
 
 To uninstall, use `pipx uninstall secflow-cli`, `python -m pip uninstall secflow-cli`, or `npm uninstall --global @intflow/secflow-cli` as appropriate. Uninstalling does not revoke server sessions or erase profiles; log out and remove unwanted profiles first.
 
-## Expanded commands in 0.2.0
+## Commands
 
-CLI 0.2.0 adds the commands below. Metadata catalogs, details, permission checks, and per-secret access changes require the additive operator APIs on the server. An older server can still serve existing commands. `auth status` reports expiry and capabilities on newer servers and falls back to identity-only metadata when the session endpoint is absent. Authorization or dependency failures are not treated as an old server.
+Catalogs, details, permission checks, and per-secret access changes use the server's operator API. `auth status` reports the session's expiry and capabilities.
 
 | Task | Discover commands |
 | --- | --- |

{secflow_cli-0.2.2 → secflow_cli-0.2.3}/USAGE.md

@@ -16,7 +16,7 @@ npm install --global @intflow/secflow-cli
 secflowctl --version
 ```
 
-The Python distribution requires Python 3.10+. Installation automatically includes the Admin-capable `secflow-sdk==0.1.8` dependency.
+The Python distribution requires Python 3.10+. Installation automatically includes the matching Admin-capable `secflow-sdk` dependency.
 
 The npm distribution includes Python and the CLI dependencies in OS-specific native packages. Initial targets: Windows x64, macOS Intel/Apple Silicon, and Linux x64 with glibc 2.35+ (Ubuntu 22.04+). Alpine/musl and Linux ARM are not npm targets yet; use the Python distribution there. Keep npm optional dependencies enabled. Installation has no postinstall script or runtime download. Native binaries are not platform-signed or notarized.
 
@@ -49,9 +49,9 @@ For automation use `SECFLOW_ADMIN_SESSION_TOKEN` supplied by your secret manager
 
 To uninstall, use `pipx uninstall secflow-cli`, `python -m pip uninstall secflow-cli`, or `npm uninstall --global @intflow/secflow-cli` as appropriate. Uninstalling does not revoke server sessions or erase profiles; log out and remove unwanted profiles first.
 
-## Expanded commands in 0.2.0
+## Commands
 
-CLI 0.2.0 adds the commands below. Metadata catalogs, details, permission checks, and per-secret access changes require the additive operator APIs on the server. An older server can still serve existing commands. `auth status` reports expiry and capabilities on newer servers and falls back to identity-only metadata when the session endpoint is absent. Authorization or dependency failures are not treated as an old server.
+Catalogs, details, permission checks, and per-secret access changes use the server's operator API. `auth status` reports the session's expiry and capabilities.
 
 | Task | Discover commands |
 | --- | --- |

{secflow_cli-0.2.2 → secflow_cli-0.2.3}/pyproject.toml

@@ -4,12 +4,12 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "secflow-cli"
-version = "0.2.2"
+version = "0.2.3"
 description = "SecFlow operator CLI"
 readme = "USAGE.md"
 license = "MIT"
 requires-python = ">=3.10"
-dependencies = ["secflow-sdk==0.1.8", "keyring>=25,<26"]
+dependencies = ["secflow-sdk==0.1.9", "keyring>=25,<26"]
 
 [project.scripts]
 secflowctl = "secflow_cli.main:main"

secflow_cli-0.2.3/src/secflow_cli/access_profile_commands.py

@@ -0,0 +1,61 @@
+from collections.abc import Mapping
+import sys
+
+from secflow_cli.account_commands import required_input
+from secflow_cli.command_support import canonical_id, idempotency_key, is_uuid, run_mutation, typed_confirm
+from secflow_cli.errors import CliError
+
+FLAGS = ("allow_cli_login", "allow_api_session", "allow_namespace_request")
+FIELDS = ("profile_id", "domain", "roles", *FLAGS, "allow_audit_read", "allow_plaintext_read")
+
+
+def add_commands(groups):
+    commands = groups.add_parser("access-profile").add_subparsers(dest="action", required=True)
+    command = commands.add_parser("get")
+    command.add_argument("--token-stdin", action="store_true")
+    command = commands.add_parser("set")
+    command.add_argument("--profile-id")
+    for field in FLAGS:
+        command.add_argument("--" + field.replace("_", "-"), choices=("true", "false"))
+    command.add_argument("--token-stdin", action="store_true")
+    command.add_argument("--idempotency-key")
+    command.add_argument("--yes", action="store_true")
+
+
+def prepare(args):
+    profile_id = required_input(args, "profile_id", "profile ID")
+    canonical_id(profile_id, "Supply a canonical profile UUID.")
+    profile = dict(profile_id=profile_id, domain="intflow.ai", roles=[], allow_audit_read=False, allow_plaintext_read=False)
+    for field in FLAGS:
+        value = required_input(args, field, field.replace("_", " "))
+        if value not in ("true", "false"):
+            raise CliError(2, "INVALID_INPUT", "Profile settings must be true or false.")
+        profile[field] = value == "true"
+    key = idempotency_key(args, "cli-access-profile-", "Supply a normalized idempotency key of 16-128 characters.")
+    print("Replace global default access profile: " + profile_id, file=sys.stderr)
+    for field in FLAGS:
+        print(field + ": " + str(profile[field]).lower(), file=sys.stderr)
+    print("Full replacement; concurrent changes are not protected by a server precondition. This does not grant roles or revoke existing credentials.", file=sys.stderr)
+    typed_confirm(args, profile_id, prompt="Type the profile ID to confirm: ", cancelled="Profile replacement cancelled; no mutation was sent.",
+                  required="Supply all settings and --yes for unattended execution or when stdin carries a token.")
+    return dict(profile=profile, idempotency_key=key)
+
+
+def execute(client, values):
+    data = dict(idempotency_key=values["idempotency_key"], outcome="unknown", profile=None)
+    return run_mutation(data, lambda: send(client, values))
+
+
+def send(client, values):
+    result = metadata(client.put_default_access_profile(**values))
+    if result != values["profile"]:
+        raise CliError(7, "INVALID_RESPONSE", "The server did not confirm the requested profile.")
+    return dict(profile=result)
+
+
+def metadata(value):
+    if (not isinstance(value, Mapping) or not is_uuid(value.get("profile_id")) or value.get("domain") != "intflow.ai" or value.get("roles") != []
+            or any(type(value.get(field)) is not bool for field in FLAGS)
+            or value.get("allow_audit_read") is not False or value.get("allow_plaintext_read") is not False):
+        raise CliError(7, "INVALID_RESPONSE", "The server returned an invalid default access profile.")
+    return {field: value[field] for field in FIELDS}

secflow_cli-0.2.3/src/secflow_cli/account_commands.py

@@ -0,0 +1,103 @@
+from __future__ import annotations
+
+import sys
+from collections.abc import Mapping
+
+from secflow_cli.command_support import canonical_id, correlation, idempotency_key, preview_delete, require_confirmable, run_mutation, typed_confirm
+from secflow_cli.errors import CliError
+from secflow_cli.output import account_metadata
+
+
+ACTIONS = ("create", "update", "reactivate", "suspend", "delete")
+DESTRUCTIVE_ACTIONS = frozenset({"suspend", "delete"})
+ACCOUNT_UUID = "Supply an exact canonical account UUID."
+
+
+def add_commands(commands):
+    for action in ACTIONS:
+        command = commands.add_parser(action)
+        command.add_argument("--token-stdin", action="store_true")
+        command.add_argument("--idempotency-key")
+        if action == "create":
+            command.add_argument("--email")
+        else:
+            command.add_argument("--account-id")
+        if action in ("create", "update"):
+            command.add_argument("--display-name")
+        if action in DESTRUCTIVE_ACTIONS:
+            command.add_argument("--yes", action="store_true")
+
+
+def required_input(args, field, label):
+    value = getattr(args, field)
+    if value is None and not args.non_interactive and not args.token_stdin and sys.stdin.isatty():
+        print(label + ": ", end="", file=sys.stderr, flush=True)
+        try:
+            value = input()
+        except EOFError:
+            value = None
+    if not isinstance(value, str) or not value.strip() or value != value.strip():
+        raise CliError(2, "INVALID_INPUT", "Supply a non-empty normalized " + label + ".")
+    return value
+
+
+def prepare(args):
+    key = idempotency_key(args, "cli-account-", "Idempotency keys must contain 16-128 letters, digits, dots, underscores, colons, or hyphens.")
+    values = {"idempotency_key": key}
+    if args.action == "create":
+        values["email"] = required_input(args, "email", "email")
+        values.update(correlation(key))
+    else:
+        values["account_id"] = required_input(args, "account_id", "account ID")
+    if args.action == "update":
+        values["display_name"] = required_input(args, "display_name", "display name")
+    elif args.action == "create" and args.display_name is not None:
+        values["display_name"] = required_input(args, "display_name", "display name")
+    if args.action == "reactivate":
+        values["status"] = "active"
+    if args.action == "delete":
+        canonical_id(values["account_id"], ACCOUNT_UUID)
+        require_confirmable(args, "Supply the exact account ID and --yes for unattended execution or when stdin carries a token.")
+    elif args.action in DESTRUCTIVE_ACTIONS:
+        confirm_destructive(args, values["account_id"])
+    return values
+
+
+def preview(args, client, values):
+    return preview_delete(args, client, kind="account", target=values["account_id"], operation="accounts.impact",
+                          query={"account_id": values["account_id"]},
+                          semantics="deletion removes the account, its sessions, SDK tokens, and direct role bindings.")
+
+
+def confirm_destructive(args, account_id):
+    canonical_id(account_id, ACCOUNT_UUID)
+    print("Suspend account: " + account_id, file=sys.stderr)
+    print("Operation semantics, not a server impact preview: suspension revokes active Admin sessions and SDK tokens. Reactivation does not restore revoked credentials. Affected counts are unknown.", file=sys.stderr)
+    typed_confirm(args, account_id, prompt="Type the account ID to confirm: ", cancelled="Account operation cancelled; no mutation was sent.",
+                  required="Supply the exact account ID and --yes for unattended execution or when stdin carries a token.")
+
+
+def execute(args, client, values):
+    data = {"idempotency_key": values["idempotency_key"], "outcome": "unknown", "account": None}
+    if args.action == "delete":
+        data["deletion"] = None
+    return run_mutation(data, lambda: send(args, client, values))
+
+
+def send(args, client, values):
+    method = {"create": client.create_account, "update": client.patch_account,
+              "reactivate": client.patch_account, "suspend": client.suspend_account,
+              "delete": client.delete_account}[args.action]
+    response = method(**values)
+    if args.action == "delete":
+        if (not isinstance(response, Mapping) or response.get("kind") != "account"
+                or response.get("id") != values["account_id"] or response.get("deleted") is not True
+                or not isinstance(response.get("label"), str)):
+            raise CliError(7, "INVALID_RESPONSE", "The server did not confirm deletion of the selected account.")
+        return {"deletion": {name: response[name] for name in ("kind", "id", "label", "deleted")}}
+    account = account_metadata(response)
+    if not isinstance(account.get("account_id"), str) or not account["account_id"]:
+        raise CliError(7, "INVALID_RESPONSE", "The server did not return confirmed account metadata.")
+    if args.action == "suspend" and (account["account_id"] != values["account_id"] or account.get("status") != "suspended"):
+        raise CliError(7, "INVALID_RESPONSE", "The server did not confirm suspension of the selected account.")
+    return {"account": account}

{secflow_cli-0.2.2 → secflow_cli-0.2.3}/src/secflow_cli/browser_login.py

@@ -1,4 +1,3 @@
-"""Human browser login; Auth credentials stay on the SecFlow server."""
 from __future__ import annotations
 
 import base64
@@ -55,6 +54,27 @@ def acquire_session(url, timeout, *, no_browser=False):
         raise rejected() from None
 
 
+def _open_browser(verification_uri):
+    try:
+        opened = webbrowser.open(verification_uri)
+    except Exception:
+        opened = False
+    if not opened:
+        print("Open the URL above manually to continue.", file=sys.stderr)
+
+
+def _issued_session(result):
+    token = result.get("session_token")
+    if not isinstance(token, str) or not re.fullmatch(r"[A-Za-z0-9_-]{32,256}", token):
+        raise rejected()
+    if any(str(UUID(result.get(field))) != result[field] for field in ("session_id", "account_id")):
+        raise rejected()
+    expiry = datetime.fromisoformat(result["expires_at"].replace("Z", "+00:00"))
+    if expiry.tzinfo is None or expiry <= datetime.now(timezone.utc):
+        raise rejected()
+    return {field: result[field] for field in ("session_token", "session_id", "account_id", "expires_at")}
+
+
 def _acquire_session(url, timeout, *, no_browser):
     proof = base64.urlsafe_b64encode(os.urandom(32)).rstrip(b"=").decode("ascii")
     started_at = time.monotonic()
@@ -76,12 +96,7 @@ def _acquire_session(url, timeout, *, no_browser):
     print("Open " + verification_uri, file=sys.stderr)
     print("Confirm code " + created["user_code"] + " and approve the login in your browser.", file=sys.stderr)
     if not no_browser:
-        try:
-            opened = webbrowser.open(verification_uri)
-        except Exception:
-            opened = False
-        if not opened:
-            print("Open the URL above manually to continue.", file=sys.stderr)
+        _open_browser(verification_uri)
     interval = created["interval"]
     while time.monotonic() + interval < deadline:
         time.sleep(interval)
@@ -97,15 +112,7 @@ def _acquire_session(url, timeout, *, no_browser):
             continue
         if status != 200:
             raise rejected()
-        token = result.get("session_token")
-        if not isinstance(token, str) or not re.fullmatch(r"[A-Za-z0-9_-]{32,256}", token):
-            raise rejected()
-        if any(str(UUID(result.get(field))) != result[field] for field in ("session_id", "account_id")):
-            raise rejected()
-        expiry = datetime.fromisoformat(result["expires_at"].replace("Z", "+00:00"))
-        if expiry.tzinfo is None or expiry <= datetime.now(timezone.utc):
-            raise rejected()
-        return {field: result[field] for field in ("session_token", "session_id", "account_id", "expires_at")}
+        return _issued_session(result)
     raise CliError(3, "BROWSER_LOGIN_EXPIRED", "Browser login expired. Start a new login.")
 
 
@@ -119,8 +126,6 @@ def login(url, timeout, store, reference, *, no_browser=False):
             raise rejected()
         store.set(reference, session["session_token"])
     except BaseException:
-        # Do not erase a previously stored credential. Revoke only the session
-        # obtained by this invocation when validation/storage is unsuccessful.
         try:
             client.revoke_current_session()
         except Exception:

{secflow_cli-0.2.2 → secflow_cli-0.2.3}/src/secflow_cli/command_support.py

@@ -1,10 +1,12 @@
-"""Shared validation for operator commands; never render request payloads."""
 import hashlib
 import re
 import sys
 from uuid import UUID, uuid4
 
+from secflow_sdk import SecFlowConfigError, SecFlowSdkError
+
 from secflow_cli.errors import CliError
+from secflow_cli.output import mapped_error
 
 
 def mutation_options(command, *, confirm=False):
@@ -14,39 +16,72 @@ def mutation_options(command, *, confirm=False):
         command.add_argument('--yes', action='store_true')
 
 
-def mutation_key(args):
-    key = args.idempotency_key or 'cli-operation-' + str(uuid4())
-    if not re.fullmatch(r'[A-Za-z0-9_.:-]{16,128}', key):
-        raise CliError(2, 'INVALID_INPUT', 'Idempotency keys must contain 16-128 normalized characters.')
+KEY_PATTERN = r'[A-Za-z0-9_.:-]{16,128}'
+UNKNOWN_OUTCOME = 'Mutation completion is unknown. Inspect current state; any retry must use identical inputs and the same idempotency key.'
+
+
+def idempotency_key(args, prefix, message):
+    key = args.idempotency_key or prefix + str(uuid4())
+    if not re.fullmatch(KEY_PATTERN, key):
+        raise CliError(2, 'INVALID_INPUT', message)
     return key
 
 
+def mutation_key(args):
+    return idempotency_key(args, 'cli-operation-', 'Idempotency keys must contain 16-128 normalized characters.')
+
+
 def correlation(key):
     digest = hashlib.sha256(key.encode('ascii')).hexdigest()
     return dict(request_id='cli-request-' + digest, trace_id='cli-trace-' + digest)
 
 
-def canonical_id(value):
+def is_uuid(value):
     try:
-        if str(UUID(value)) == value:
-            return value
-    except (ValueError, TypeError, AttributeError):
-        pass
-    raise CliError(2, 'INVALID_INPUT', 'Supply a canonical resource UUID.')
+        return isinstance(value, str) and str(UUID(value)) == value
+    except ValueError:
+        return False
 
 
-def confirm(args, target):
+def canonical_id(value, message='Supply a canonical resource UUID.'):
+    if not is_uuid(value):
+        raise CliError(2, 'INVALID_INPUT', message)
+    return value
+
+
+def typed_confirm(args, target, *, prompt, cancelled, required=None):
     if args.yes:
         return
-    if args.non_interactive or args.token_stdin or not sys.stdin.isatty():
-        raise CliError(2, 'CONFIRMATION_REQUIRED', 'Inspect the exact target, then supply --yes to confirm this change.')
-    print('Type the exact target to confirm: ' + target, file=sys.stderr)
+    if required is not None:
+        require_confirmable(args, required)
+    print(prompt, end='', file=sys.stderr, flush=True)
     try:
         answer = input()
     except EOFError:
         answer = None
     if answer != target:
-        raise CliError(2, 'CONFIRMATION_CANCELLED', 'Cancelled; no mutation was sent.')
+        raise CliError(2, 'CONFIRMATION_CANCELLED', cancelled)
+
+
+def confirm(args, target):
+    typed_confirm(args, target, prompt='Type the exact target to confirm: ' + target + '\n', cancelled='Cancelled; no mutation was sent.',
+                  required='Inspect the exact target, then supply --yes to confirm this change.')
+
+
+def run_mutation(data, send):
+    print('Idempotency key: ' + data['idempotency_key'], file=sys.stderr)
+    try:
+        data.update(send(), outcome='confirmed')
+        return data, None
+    except (SecFlowSdkError, CliError) as caught:
+        error = mapped_error(caught)
+        if isinstance(caught, SecFlowConfigError):
+            data['outcome'] = 'not_sent'
+        elif error.status in (2, 3, 4, 5, 6):
+            data['outcome'] = 'not_confirmed'
+        else:
+            error = CliError(7, 'MUTATION_OUTCOME_UNKNOWN', UNKNOWN_OUTCOME)
+        return data, error
 
 
 BLOCKING = frozenset({'current_account'})
@@ -58,9 +93,8 @@ def require_confirmable(args, message):
 
 
 def server_impact(client, operation, query):
-    from secflow_sdk import SecFlowSdkError
     try:
-        response = client._request_json('GET', '/v1/admin/operator/' + operation, query=tuple(query.items()))
+        response = client.get_operator_metadata(operation, parameters=query)
     except SecFlowSdkError:
         return None
     impact, blocking = response.get('impact'), response.get('blocking')
@@ -72,7 +106,6 @@ def server_impact(client, operation, query):
 
 
 def preview_delete(args, client, *, kind, target, operation, query, semantics):
-    """Show the server's current-state impact, then require exact confirmation."""
     print('Delete ' + kind + ': ' + target, file=sys.stderr)
     impact = server_impact(client, operation, query)
     if impact is None:
@@ -82,12 +115,5 @@ def preview_delete(args, client, *, kind, target, operation, query, semantics):
         print('Server impact preview of current state (not a reservation): ' + counts, file=sys.stderr)
         if impact['blocking']:
             raise CliError(6, 'PRECONDITION_FAILED', 'The server reports a blocking precondition (' + ', '.join(impact['blocking']) + '); no mutation was sent.')
-    if not args.yes:
-        print('Type the ' + kind + ' to confirm: ', end='', file=sys.stderr, flush=True)
-        try:
-            answer = input()
-        except EOFError:
-            answer = None
-        if answer != target:
-            raise CliError(2, 'CONFIRMATION_CANCELLED', kind.capitalize() + ' deletion cancelled; no mutation was sent.')
+    typed_confirm(args, target, prompt='Type the ' + kind + ' to confirm: ', cancelled=kind.capitalize() + ' deletion cancelled; no mutation was sent.')
     return impact

{secflow_cli-0.2.2 → secflow_cli-0.2.3}/src/secflow_cli/completion.py

@@ -1,4 +1,3 @@
-"""Offline shell completion generated from the parser; never fetches server catalogs."""
 import argparse
 import json
 

{secflow_cli-0.2.2 → secflow_cli-0.2.3}/src/secflow_cli/config.py

@@ -51,48 +51,88 @@ def credential_ref(name: str, url: str) -> str:
     return "admin:" + hashlib.sha256((profile_name(name) + "\n" + endpoint(url)).encode()).hexdigest()
 
 
+def access_denied(directory: Path) -> CliError:
+    return CliError(
+        2,
+        "CONFIG_ACCESS_DENIED",
+        f"This account has no permission to use the CLI configuration folder {directory}. "
+        "Fix the folder permissions or delete it, or set SECFLOW_CLI_CONFIG_DIR to another folder.",
+    )
+
+
+def require_readable_folder(directory: Path) -> None:
+    try:
+        os.listdir(directory)
+    except FileNotFoundError:
+        return
+    except PermissionError:
+        raise access_denied(directory) from None
+
+
+def config_directory() -> Path:
+    override = os.environ.get("SECFLOW_CLI_CONFIG_DIR")
+    if override:
+        return Path(override).expanduser()
+    if sys.platform == "win32":
+        return Path(os.environ.get("APPDATA", str(Path.home() / "AppData/Roaming"))) / "SecFlow/cli"
+    if sys.platform == "darwin":
+        return Path.home() / "Library/Application Support/SecFlow/cli"
+    return Path(os.environ.get("XDG_CONFIG_HOME", str(Path.home() / ".config"))) / "secflow/cli"
+
+
+def read_profiles_text(path: Path) -> str | None:
+    try:
+        return path.read_text(encoding="utf-8")
+    except FileNotFoundError:
+        require_readable_folder(path.parent)
+        return None
+    except PermissionError:
+        raise access_denied(path.parent) from None
+    except OSError:
+        raise CliError(2, "CONFIG_READ_FAILED", f"Cannot read the CLI profile configuration file {path}.") from None
+
+
+def parsed_profiles(text: str) -> dict:
+    try:
+        raw = json.loads(text)
+        if not isinstance(raw, dict) or set(raw) != {"version", "current", "profiles"} or raw["version"] != 1 or not isinstance(raw["profiles"], dict):
+            raise ValueError
+        for name, profile in raw["profiles"].items():
+            profile_name(name)
+            if not isinstance(profile, dict) or set(profile) != {"base_url", "credential_ref"}:
+                raise ValueError
+            if profile["credential_ref"] != credential_ref(name, endpoint(profile["base_url"])):
+                raise ValueError
+        if raw["current"] is not None and raw["current"] not in raw["profiles"]:
+            raise ValueError
+        return raw
+    except (ValueError, TypeError, KeyError):
+        raise CliError(2, "INVALID_CONFIG", "Cannot read valid CLI profile configuration.") from None
+
+
 class Profiles:
     def __init__(self):
-        override = os.environ.get("SECFLOW_CLI_CONFIG_DIR")
-        if override:
-            directory = Path(override).expanduser()
-        elif sys.platform == "win32":
-            directory = Path(os.environ.get("APPDATA", str(Path.home() / "AppData/Roaming"))) / "SecFlow/cli"
-        elif sys.platform == "darwin":
-            directory = Path.home() / "Library/Application Support/SecFlow/cli"
-        else:
-            directory = Path(os.environ.get("XDG_CONFIG_HOME", str(Path.home() / ".config"))) / "secflow/cli"
-        self.path = directory.resolve() / "profiles.json"
-        if any((ancestor / ".git").exists() for ancestor in self.path.parents):
-            raise CliError(2, "INVALID_CONFIG_LOCATION", "CLI configuration must be outside a repository.")
-        self.data = {"version": 1, "current": None, "profiles": {}}
+        self.path = config_directory().resolve() / "profiles.json"
         try:
-            if self.path.exists():
-                raw = json.loads(self.path.read_text(encoding="utf-8"))
-                if not isinstance(raw, dict) or set(raw) != {"version", "current", "profiles"} or raw["version"] != 1 or not isinstance(raw["profiles"], dict):
-                    raise ValueError
-                for name, profile in raw["profiles"].items():
-                    profile_name(name)
-                    if not isinstance(profile, dict) or set(profile) != {"base_url", "credential_ref"}:
-                        raise ValueError
-                    url = endpoint(profile["base_url"])
-                    if profile["credential_ref"] != credential_ref(name, url):
-                        raise ValueError
-                if raw["current"] is not None and raw["current"] not in raw["profiles"]:
-                    raise ValueError
-                self.data = raw
-        except (OSError, ValueError, TypeError, KeyError):
-            raise CliError(2, "INVALID_CONFIG", "Cannot read valid CLI profile configuration.") from None
+            inside_repository = any((ancestor / ".git").exists() for ancestor in self.path.parents)
+        except PermissionError:
+            raise access_denied(self.path.parent) from None
+        if inside_repository:
+            raise CliError(2, "INVALID_CONFIG_LOCATION", "CLI configuration must be outside a repository.")
+        text = read_profiles_text(self.path)
+        self.data = parsed_profiles(text) if text is not None else {"version": 1, "current": None, "profiles": {}}
 
     def save(self):
-        self.path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
         temporary = None
         try:
+            self.path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
             with tempfile.NamedTemporaryFile(mode="w", encoding="utf-8", dir=self.path.parent, delete=False) as stream:
                 temporary = Path(stream.name)
                 json.dump(self.data, stream, indent=2)
                 stream.write("\n")
             os.replace(temporary, self.path)
+        except PermissionError:
+            raise access_denied(self.path.parent) from None
         except OSError:
             raise CliError(2, "CONFIG_WRITE_FAILED", "Cannot save CLI profile configuration.") from None
         finally:

{secflow_cli-0.2.2 → secflow_cli-0.2.3}/src/secflow_cli/credentials.py

@@ -4,7 +4,6 @@ from secflow_cli.errors import CliError
 
 
 class CredentialStore:
-    """Only explicitly supported OS stores; never file-backed fallback plugins."""
 
     service = "secflow-cli"
     supported = frozenset({
@@ -24,9 +23,6 @@ class CredentialStore:
             import keyring
             backend = keyring.get_keyring()
             kind = (type(backend).__module__, type(backend).__name__)
-            # Keychain and Secret Service may display OS unlock dialogs. Until
-            # a prompt-free adapter is available, require explicit credentials
-            # in unattended sessions on these platforms.
             if not self.allow_interaction and kind != ("keyring.backends.Windows", "WinVaultKeyring"):
                 raise RuntimeError
             if kind not in self.supported or backend.priority <= 0:

{secflow_cli-0.2.2 → secflow_cli-0.2.3}/src/secflow_cli/doctor_commands.py

@@ -1,10 +1,10 @@
-"""Bounded connection and credential diagnostics; health never proves secret resolution."""
 from datetime import datetime, timedelta, timezone
 import sys
-import time
+from time import sleep
 
 from secflow_sdk import SecFlowHttpError, SecFlowSdkError
 from secflow_cli.errors import CliError
+from secflow_cli.output import envelope, render
 
 
 def add_commands(groups):
@@ -22,12 +22,8 @@ def check(name, status, detail):
 
 def session_checks(client, now):
     try:
-        session = client._request_json('GET', '/v1/admin/operator/session')
+        session = client.get_operator_metadata('session')
     except SecFlowHttpError as error:
-        if error.status_code == 404:
-            client.get_current_account()
-            return [check('session', 'ok', 'Admin session accepted.'),
-                    check('server_features', 'warn', 'The server predates operator metadata; newer commands are unavailable.')]
         if error.status_code in (401, 403):
             return [check('session', 'fail', 'The server rejected the Admin session; sign in again.')]
         raise
@@ -61,8 +57,7 @@ def diagnose(args, name, url, client_factory, health):
     return checks
 
 
-def run(args, name, url, client_factory, command, output):
-    from secflow_cli.main import envelope, health, render
+def run(args, name, url, client_factory, command, output, health):
     if args.watch and (not 5 <= args.interval <= 3600 or not 1 <= args.count <= 1000):
         raise CliError(2, 'INVALID_INPUT', 'Interval must be 5-3600 seconds and count 1-1000.')
     runs = args.count if args.watch else 1
@@ -70,7 +65,6 @@ def run(args, name, url, client_factory, command, output):
     cache = []
 
     def cached_client():
-        # stdin carries the credential once; later runs reuse the same client.
         if not cache:
             try:
                 cache.append(client_factory())
@@ -89,5 +83,5 @@ def run(args, name, url, client_factory, command, output):
         status = error.status if error else 0
         if index + 1 < runs:
             sys.stdout.flush()
-            time.sleep(args.interval)
+            sleep(args.interval)
     return status

{secflow_cli-0.2.2 → secflow_cli-0.2.3}/src/secflow_cli/errors.py

@@ -1,5 +1,4 @@
 class CliError(Exception):
-    """A deliberately safe, locally authored error suitable for rendering."""
 
     def __init__(self, status: int, code: str, message: str):
         super().__init__(message)