secflow-cli 0.2.4__tar.gz → 0.3.0__tar.gz

{secflow_cli-0.2.4/src/secflow_cli.egg-info → secflow_cli-0.3.0}/PKG-INFO

@@ -1,10 +1,11 @@
 Metadata-Version: 2.4
 Name: secflow-cli
-Version: 0.2.4
+Version: 0.3.0
 Summary: SecFlow operator CLI
 License-Expression: MIT
 Project-URL: Repository, https://github.com/yeon3724/secflow
 Project-URL: Issues, https://github.com/yeon3724/secflow/issues
+Keywords: intflow-cli-update-protocol-1
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
@@ -14,11 +15,11 @@ Dynamic: license-file
 
 # SecFlow CLI
 
-Use Intflow browser login or an existing Slack-issued Admin session. Both distributions provide the same `secflowctl` commands.
+Use Intflow browser login or an Admin session token.
 
 ## Install and update
 
-Choose one distribution per machine; both own the same `secflowctl` command and share profiles and the OS credential store.
+Choose npm or Python; both own `secflowctl` and share profiles and OS credentials.
 
 ```sh
 pipx install secflow-cli
@@ -30,19 +31,19 @@ npm install --global @intflow/secflow-cli
 secflowctl --version
 ```
 
-The Python distribution requires Python 3.10+. Installation automatically includes the matching Admin-capable `secflow-sdk` dependency.
+Python 3.10+ is required; installation includes the pinned Admin-capable SDK.
 
-The npm distribution includes Python and the CLI dependencies in OS-specific native packages. Initial targets: Windows x64, macOS Intel/Apple Silicon, and Linux x64 with glibc 2.35+ (Ubuntu 22.04+). Alpine/musl and Linux ARM are not npm targets yet; use the Python distribution there. Keep npm optional dependencies enabled. Installation has no postinstall script or runtime download. Native binaries are not platform-signed or notarized.
+The npm distribution bundles Python and dependencies for Windows x64, macOS Intel/Apple Silicon, and Linux x64 glibc 2.35+. Alpine/musl and Linux ARM use the Python distribution. Keep optional dependencies enabled; installation has no postinstall script. Releases require all four same-version native packages. Binaries are not platform-signed or notarized.
 
-The bundled interpreter includes CA certificates for HTTPS. An explicit `SSL_CERT_FILE` or `SSL_CERT_DIR` takes precedence for organization-managed trust; TLS certificate verification stays enabled.
+The bundle includes HTTPS CAs; `SSL_CERT_FILE`/`SSL_CERT_DIR` overrides trust without disabling TLS verification.
 
 ```sh
-pipx upgrade secflow-cli
-# Or use the same installer as the initial installation:
-python -m pip install --upgrade secflow-cli
-npm install --global @intflow/secflow-cli@latest
+secflowctl update --check
+secflowctl update --status
 ```
 
+Commands check within 3s and stage protocol-1 stable runtimes in a private cache/venv, then run argv once; offline failures keep the last good runtime. TTY/JSON agree; help/version/check/status never install. `update --apply` installs; `--auto on|off` persists policy; `--pin VERSION` freezes an exact runtime; `--unpin` releases only policy. `INTFLOW_CLI_AUTO_UPDATE=0` stops automatic installs, allowing explicit apply/pin. Pins outrank off and fail closed. Internal native binaries update through npm.
+
 ## Connect
 
 ```sh
@@ -55,9 +56,9 @@ secflowctl --help
 
 `secflowctl` without arguments displays a quick start. `secflowctl login` opens Intflow login and creates the `production` profile for `https://secflow.intflow.dev` on first use. Existing profiles retain their selected server. For another server, first use `secflowctl profile add staging --base-url https://secflow.example.test`, then `secflowctl --profile staging login`. Global options precede the command. Every command supports `--help`, including examples. Account and role administration requires server authorization.
 
-`auth login` remains compatible with Slack-issued Admin sessions and prompts without echo for an existing session. Sessions are stored in Windows Credential Manager, macOS Keychain, or Linux Secret Service. Linux persistent login needs an unlocked Secret Service (for example GNOME Keyring) and a D-Bus session. If secure storage is unavailable, login fails without a plaintext file fallback. Installing the CLI does not create an account or grant access.
+`auth login` prompts without echo for an existing Admin session token. Sessions are stored in Windows Credential Manager, macOS Keychain, or Linux Secret Service. Linux persistent login needs an unlocked Secret Service (for example GNOME Keyring) and a D-Bus session. If secure storage is unavailable, login fails without a plaintext file fallback. Installing the CLI does not create an account or grant access.
 
-When browser login is enabled on the server, run `secflowctl auth login --browser`. Sign in to Intflow, compare the code with your terminal, and approve the SecFlow login. Use `--browser --no-browser` to open the displayed URL manually. This requires an interactive terminal, an existing authorized SecFlow account, and OS credential storage. The CLI stores only the resulting SecFlow session. If login expires or the exchange fails, start a new login.
+When browser login is enabled on the server, run `secflowctl auth login --browser`. Sign in to Intflow, compare the code with your terminal, and approve the SecFlow login. Use `--browser --no-browser` to open the displayed URL manually. This requires an interactive terminal, an existing authorized SecFlow account, and OS credential storage. The CLI stores only the resulting SecFlow session. A busy server is retried for a minute. If login expires or the exchange fails, log in again.
 
 For automation use `SECFLOW_ADMIN_SESSION_TOKEN` supplied by your secret manager, or `--token-stdin` with `--non-interactive`. Never put tokens in command arguments, profiles, shell history, or tracked files. SDK tokens cannot authorize these Admin commands. `auth logout` revokes the current server session; `auth forget` only removes the local credential.
 
@@ -128,6 +129,6 @@ For automation, use `--non-interactive` before the command and `--yes` on `put`.
 
 ## Credentials and values
 
-`tokens issue --save-as NAME` stores an SDK token separately from Admin profiles; `runtime ... --sdk-name NAME` uses it. `auth sessions issue --save-as PROFILE` creates a new destination profile. Both require a new destination name or explicit `--token-stdout` to redirected stdout; raw credentials never appear in ordinary JSON/table results. Linux/macOS non-interactive invocations require an explicitly injected credential rather than unlocking the OS store.
+`tokens issue` uses the server-default lifetime; choose `--ttl-seconds` (1-7776000) or `--no-expiry`, never both. `--save-as NAME` stores an SDK token for `runtime ... --sdk-name NAME`. `auth sessions issue --save-as PROFILE` stores a separate Admin profile. Both need a new destination or `--token-stdout` redirected to a pipe/file; ordinary results contain no raw credentials. Linux/macOS non-interactive calls need an injected credential, not an OS store unlock.
 
-Secret create/rotate reads exact UTF-8 or base64 input through hidden input, `--value-stdin`, or `--value-file`. Do not put values in command arguments. Stdin cannot simultaneously carry an Admin token and a secret or policy document. Runtime commands use SDK credentials only; Admin sessions are never substituted. No plaintext resolve command is provided.
+Secret create/rotate accepts exact UTF-8 or base64 via hidden input, `--value-stdin` or `--value-file`, never command arguments. Stdin cannot carry both an Admin token and a value or policy. Runtime uses SDK credentials, never Admin sessions; no plaintext resolve command exists.

{secflow_cli-0.2.4 → secflow_cli-0.3.0}/USAGE.md

@@ -1,10 +1,10 @@
 # SecFlow CLI
 
-Use Intflow browser login or an existing Slack-issued Admin session. Both distributions provide the same `secflowctl` commands.
+Use Intflow browser login or an Admin session token.
 
 ## Install and update
 
-Choose one distribution per machine; both own the same `secflowctl` command and share profiles and the OS credential store.
+Choose npm or Python; both own `secflowctl` and share profiles and OS credentials.
 
 ```sh
 pipx install secflow-cli
@@ -16,19 +16,19 @@ npm install --global @intflow/secflow-cli
 secflowctl --version
 ```
 
-The Python distribution requires Python 3.10+. Installation automatically includes the matching Admin-capable `secflow-sdk` dependency.
+Python 3.10+ is required; installation includes the pinned Admin-capable SDK.
 
-The npm distribution includes Python and the CLI dependencies in OS-specific native packages. Initial targets: Windows x64, macOS Intel/Apple Silicon, and Linux x64 with glibc 2.35+ (Ubuntu 22.04+). Alpine/musl and Linux ARM are not npm targets yet; use the Python distribution there. Keep npm optional dependencies enabled. Installation has no postinstall script or runtime download. Native binaries are not platform-signed or notarized.
+The npm distribution bundles Python and dependencies for Windows x64, macOS Intel/Apple Silicon, and Linux x64 glibc 2.35+. Alpine/musl and Linux ARM use the Python distribution. Keep optional dependencies enabled; installation has no postinstall script. Releases require all four same-version native packages. Binaries are not platform-signed or notarized.
 
-The bundled interpreter includes CA certificates for HTTPS. An explicit `SSL_CERT_FILE` or `SSL_CERT_DIR` takes precedence for organization-managed trust; TLS certificate verification stays enabled.
+The bundle includes HTTPS CAs; `SSL_CERT_FILE`/`SSL_CERT_DIR` overrides trust without disabling TLS verification.
 
 ```sh
-pipx upgrade secflow-cli
-# Or use the same installer as the initial installation:
-python -m pip install --upgrade secflow-cli
-npm install --global @intflow/secflow-cli@latest
+secflowctl update --check
+secflowctl update --status
 ```
 
+Commands check within 3s and stage protocol-1 stable runtimes in a private cache/venv, then run argv once; offline failures keep the last good runtime. TTY/JSON agree; help/version/check/status never install. `update --apply` installs; `--auto on|off` persists policy; `--pin VERSION` freezes an exact runtime; `--unpin` releases only policy. `INTFLOW_CLI_AUTO_UPDATE=0` stops automatic installs, allowing explicit apply/pin. Pins outrank off and fail closed. Internal native binaries update through npm.
+
 ## Connect
 
 ```sh
@@ -41,9 +41,9 @@ secflowctl --help
 
 `secflowctl` without arguments displays a quick start. `secflowctl login` opens Intflow login and creates the `production` profile for `https://secflow.intflow.dev` on first use. Existing profiles retain their selected server. For another server, first use `secflowctl profile add staging --base-url https://secflow.example.test`, then `secflowctl --profile staging login`. Global options precede the command. Every command supports `--help`, including examples. Account and role administration requires server authorization.
 
-`auth login` remains compatible with Slack-issued Admin sessions and prompts without echo for an existing session. Sessions are stored in Windows Credential Manager, macOS Keychain, or Linux Secret Service. Linux persistent login needs an unlocked Secret Service (for example GNOME Keyring) and a D-Bus session. If secure storage is unavailable, login fails without a plaintext file fallback. Installing the CLI does not create an account or grant access.
+`auth login` prompts without echo for an existing Admin session token. Sessions are stored in Windows Credential Manager, macOS Keychain, or Linux Secret Service. Linux persistent login needs an unlocked Secret Service (for example GNOME Keyring) and a D-Bus session. If secure storage is unavailable, login fails without a plaintext file fallback. Installing the CLI does not create an account or grant access.
 
-When browser login is enabled on the server, run `secflowctl auth login --browser`. Sign in to Intflow, compare the code with your terminal, and approve the SecFlow login. Use `--browser --no-browser` to open the displayed URL manually. This requires an interactive terminal, an existing authorized SecFlow account, and OS credential storage. The CLI stores only the resulting SecFlow session. If login expires or the exchange fails, start a new login.
+When browser login is enabled on the server, run `secflowctl auth login --browser`. Sign in to Intflow, compare the code with your terminal, and approve the SecFlow login. Use `--browser --no-browser` to open the displayed URL manually. This requires an interactive terminal, an existing authorized SecFlow account, and OS credential storage. The CLI stores only the resulting SecFlow session. A busy server is retried for a minute. If login expires or the exchange fails, log in again.
 
 For automation use `SECFLOW_ADMIN_SESSION_TOKEN` supplied by your secret manager, or `--token-stdin` with `--non-interactive`. Never put tokens in command arguments, profiles, shell history, or tracked files. SDK tokens cannot authorize these Admin commands. `auth logout` revokes the current server session; `auth forget` only removes the local credential.
 
@@ -114,6 +114,6 @@ For automation, use `--non-interactive` before the command and `--yes` on `put`.
 
 ## Credentials and values
 
-`tokens issue --save-as NAME` stores an SDK token separately from Admin profiles; `runtime ... --sdk-name NAME` uses it. `auth sessions issue --save-as PROFILE` creates a new destination profile. Both require a new destination name or explicit `--token-stdout` to redirected stdout; raw credentials never appear in ordinary JSON/table results. Linux/macOS non-interactive invocations require an explicitly injected credential rather than unlocking the OS store.
+`tokens issue` uses the server-default lifetime; choose `--ttl-seconds` (1-7776000) or `--no-expiry`, never both. `--save-as NAME` stores an SDK token for `runtime ... --sdk-name NAME`. `auth sessions issue --save-as PROFILE` stores a separate Admin profile. Both need a new destination or `--token-stdout` redirected to a pipe/file; ordinary results contain no raw credentials. Linux/macOS non-interactive calls need an injected credential, not an OS store unlock.
 
-Secret create/rotate reads exact UTF-8 or base64 input through hidden input, `--value-stdin`, or `--value-file`. Do not put values in command arguments. Stdin cannot simultaneously carry an Admin token and a secret or policy document. Runtime commands use SDK credentials only; Admin sessions are never substituted. No plaintext resolve command is provided.
+Secret create/rotate accepts exact UTF-8 or base64 via hidden input, `--value-stdin` or `--value-file`, never command arguments. Stdin cannot carry both an Admin token and a value or policy. Runtime uses SDK credentials, never Admin sessions; no plaintext resolve command exists.

{secflow_cli-0.2.4 → secflow_cli-0.3.0}/pyproject.toml

@@ -4,15 +4,16 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "secflow-cli"
-version = "0.2.4"
+version = "0.3.0"
 description = "SecFlow operator CLI"
 readme = "USAGE.md"
 license = "MIT"
 requires-python = ">=3.10"
+keywords = ["intflow-cli-update-protocol-1"]
 dependencies = ["secflow-sdk==0.1.10", "keyring>=25,<26"]
 
 [project.scripts]
-secflowctl = "secflow_cli.main:main"
+secflowctl = "secflow_cli.bootstrap:main"
 
 [project.urls]
 Repository = "https://github.com/yeon3724/secflow"

secflow_cli-0.3.0/src/secflow_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.3.0"

secflow_cli-0.3.0/src/secflow_cli/__main__.py

@@ -0,0 +1,3 @@
+from secflow_cli.bootstrap import main
+
+raise SystemExit(main())

secflow_cli-0.3.0/src/secflow_cli/bootstrap.py

@@ -0,0 +1,37 @@
+from __future__ import annotations
+
+import sys
+from typing import Any
+
+from . import __version__
+from .update_runtime import bootstrap
+from .update_state import Configuration, default_root
+
+
+def execute(arguments: list[str]) -> int:
+    from .main import main
+
+    return main(arguments, configure=True)
+
+
+def output(value: dict[str, Any]) -> None:
+    from .output import update_result
+
+    update_result(value)
+
+
+def main(argv: list[str] | None = None) -> int:
+    config = Configuration(
+        "secflow-cli", "secflow_cli", __version__, default_root("secflow-cli")
+    )
+    return bootstrap(
+        config,
+        list(sys.argv[1:] if argv is None else argv),
+        execute,
+        output,
+        frozen=bool(getattr(sys, "frozen", False)),
+    )
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

{secflow_cli-0.2.4 → secflow_cli-0.3.0}/src/secflow_cli/browser_login.py

@@ -4,6 +4,7 @@ import base64
 from datetime import datetime, timezone
 import hashlib
 import json
+import logging
 import os
 import re
 import sys
@@ -11,12 +12,18 @@ import time
 from urllib.error import HTTPError
 from urllib.request import HTTPRedirectHandler, Request, build_opener
 from uuid import UUID
+
+
+LOGGER = logging.getLogger(__name__)
 import webbrowser
 
 from secflow_sdk import SecFlowAdminClient
 from secflow_cli.errors import CliError
 
 
+BUSY_WAIT_SECONDS = 60
+
+
 def rejected():
     return CliError(3, "BROWSER_LOGIN_FAILED", "Browser login did not complete. Start a new login; uncertain session exchanges are not retried.")
 
@@ -32,9 +39,9 @@ def post(url, body, timeout):
     try:
         response = build_opener(NoRedirect).open(request, timeout=timeout)
     except HTTPError as error:
-        status = error.code
+        status, retry_after = error.code, _retry_after(error.headers.get("Retry-After"))
         error.close()
-        return status, {}
+        return status, {}, retry_after
     with response:
         raw = response.read(16385)
         if len(raw) > 16384:
@@ -42,7 +49,13 @@ def post(url, body, timeout):
         value = json.loads(raw)
         if not isinstance(value, dict):
             raise rejected()
-        return response.status, value
+        return response.status, value, None
+
+
+def _retry_after(value):
+    if not isinstance(value, str) or not re.fullmatch(r"[0-9]{1,4}", value):
+        return None
+    return min(30, max(1, int(value)))
 
 
 def acquire_session(url, timeout, *, no_browser=False):
@@ -57,7 +70,8 @@ def acquire_session(url, timeout, *, no_browser=False):
 def _open_browser(verification_uri):
     try:
         opened = webbrowser.open(verification_uri)
-    except Exception:
+    except Exception as caught:
+        LOGGER.debug("Browser could not be opened", extra={"attributes": {"error.type": type(caught).__name__}})
         opened = False
     if not opened:
         print("Open the URL above manually to continue.", file=sys.stderr)
@@ -75,10 +89,26 @@ def _issued_session(result):
     return {field: result[field] for field in ("session_token", "session_id", "account_id", "expires_at")}
 
 
+def _create(url, proof, timeout):
+    give_up = time.monotonic() + BUSY_WAIT_SECONDS
+    announced = False
+    while True:
+        started_at = time.monotonic()
+        status, created, retry_after = post(url + "/v1/auth/browser-login", {"poll_challenge": hashlib.sha256(proof.encode()).hexdigest()}, timeout)
+        if status != 503 or retry_after is None:
+            return status, created, started_at
+        remaining = give_up - time.monotonic()
+        if remaining <= 0:
+            raise CliError(3, "BROWSER_LOGIN_BUSY", "The server is too busy to start a browser login. Try again in a few minutes.")
+        if not announced:
+            print("The server is busy. Retrying for up to " + str(BUSY_WAIT_SECONDS) + " seconds.", file=sys.stderr)
+            announced = True
+        time.sleep(min(retry_after, remaining))
+
+
 def _acquire_session(url, timeout, *, no_browser):
     proof = base64.urlsafe_b64encode(os.urandom(32)).rstrip(b"=").decode("ascii")
-    started_at = time.monotonic()
-    status, created = post(url + "/v1/auth/browser-login", {"poll_challenge": hashlib.sha256(proof.encode()).hexdigest()}, timeout)
+    status, created, started_at = _create(url, proof, timeout)
     if status == 404:
         raise CliError(3, "BROWSER_LOGIN_UNAVAILABLE", "This server has not enabled browser login. Use a Slack-issued Admin session.")
     if status != 201:
@@ -97,18 +127,26 @@ def _acquire_session(url, timeout, *, no_browser):
     print("Confirm code " + created["user_code"] + " and approve the login in your browser.", file=sys.stderr)
     if not no_browser:
         _open_browser(verification_uri)
-    interval = created["interval"]
-    while time.monotonic() + interval < deadline:
-        time.sleep(interval)
+    return _poll(url, timeout, identifier, proof, deadline, created["interval"])
+
+
+def _poll(url, timeout, identifier, proof, deadline, interval):
+    wait = interval
+    while time.monotonic() + wait < deadline:
+        time.sleep(wait)
+        wait = interval
         remaining = deadline - time.monotonic()
         if remaining <= 0:
             break
-        status, result = post(url + "/v1/auth/browser-login/redeem",
-                              {"transaction_id": identifier, "poll_secret": proof}, min(timeout, remaining))
+        status, result, retry_after = post(url + "/v1/auth/browser-login/redeem",
+                                           {"transaction_id": identifier, "poll_secret": proof}, min(timeout, remaining))
         if status == 202 and result == {"status": "pending"}:
             continue
         if status == 429:
-            interval = min(30, interval + 2)
+            wait = interval = min(30, interval + 2)
+            continue
+        if status == 503 and retry_after is not None:
+            wait = max(interval, retry_after)
             continue
         if status != 200:
             raise rejected()
@@ -128,7 +166,7 @@ def login(url, timeout, store, reference, *, no_browser=False):
     except BaseException:
         try:
             client.revoke_current_session()
-        except Exception:
-            pass
+        except Exception as caught:
+            LOGGER.debug("New session revocation failed", extra={"attributes": {"error.type": type(caught).__name__}})
         raise
     return account, session["expires_at"]