secflow-cli 0.2.5__tar.gz → 0.3.0__tar.gz

{secflow_cli-0.2.5/src/secflow_cli.egg-info → secflow_cli-0.3.0}/PKG-INFO

@@ -1,10 +1,11 @@
 Metadata-Version: 2.4
 Name: secflow-cli
-Version: 0.2.5
+Version: 0.3.0
 Summary: SecFlow operator CLI
 License-Expression: MIT
 Project-URL: Repository, https://github.com/yeon3724/secflow
 Project-URL: Issues, https://github.com/yeon3724/secflow/issues
+Keywords: intflow-cli-update-protocol-1
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
@@ -14,11 +15,11 @@ Dynamic: license-file
 
 # SecFlow CLI
 
-Use Intflow browser login or an existing Admin session token. Both distributions provide the same `secflowctl` commands.
+Use Intflow browser login or an Admin session token.
 
 ## Install and update
 
-Choose one distribution per machine; both own the same `secflowctl` command and share profiles and the OS credential store.
+Choose npm or Python; both own `secflowctl` and share profiles and OS credentials.
 
 ```sh
 pipx install secflow-cli
@@ -30,19 +31,19 @@ npm install --global @intflow/secflow-cli
 secflowctl --version
 ```
 
-The Python distribution requires Python 3.10+. Installation automatically includes the matching Admin-capable `secflow-sdk` dependency.
+Python 3.10+ is required; installation includes the pinned Admin-capable SDK.
 
-The npm distribution includes Python and the CLI dependencies in OS-specific native packages. Targets: Windows x64, macOS Intel/Apple Silicon, and Linux x64 with glibc 2.35+ (Ubuntu 22.04+). Alpine/musl and Linux ARM are not npm targets; use the Python distribution there. Keep npm optional dependencies enabled. Installation has no postinstall script or runtime download. Native binaries are not platform-signed or notarized.
+The npm distribution bundles Python and dependencies for Windows x64, macOS Intel/Apple Silicon, and Linux x64 glibc 2.35+. Alpine/musl and Linux ARM use the Python distribution. Keep optional dependencies enabled; installation has no postinstall script. Releases require all four same-version native packages. Binaries are not platform-signed or notarized.
 
-The bundled interpreter includes CA certificates for HTTPS. An explicit `SSL_CERT_FILE` or `SSL_CERT_DIR` takes precedence for organization-managed trust; TLS certificate verification stays enabled.
+The bundle includes HTTPS CAs; `SSL_CERT_FILE`/`SSL_CERT_DIR` overrides trust without disabling TLS verification.
 
 ```sh
-pipx upgrade secflow-cli
-# Or use the same installer as the initial installation:
-python -m pip install --upgrade secflow-cli
-npm install --global @intflow/secflow-cli@latest
+secflowctl update --check
+secflowctl update --status
 ```
 
+Commands check within 3s and stage protocol-1 stable runtimes in a private cache/venv, then run argv once; offline failures keep the last good runtime. TTY/JSON agree; help/version/check/status never install. `update --apply` installs; `--auto on|off` persists policy; `--pin VERSION` freezes an exact runtime; `--unpin` releases only policy. `INTFLOW_CLI_AUTO_UPDATE=0` stops automatic installs, allowing explicit apply/pin. Pins outrank off and fail closed. Internal native binaries update through npm.
+
 ## Connect
 
 ```sh

{secflow_cli-0.2.5 → secflow_cli-0.3.0}/USAGE.md

@@ -1,10 +1,10 @@
 # SecFlow CLI
 
-Use Intflow browser login or an existing Admin session token. Both distributions provide the same `secflowctl` commands.
+Use Intflow browser login or an Admin session token.
 
 ## Install and update
 
-Choose one distribution per machine; both own the same `secflowctl` command and share profiles and the OS credential store.
+Choose npm or Python; both own `secflowctl` and share profiles and OS credentials.
 
 ```sh
 pipx install secflow-cli
@@ -16,19 +16,19 @@ npm install --global @intflow/secflow-cli
 secflowctl --version
 ```
 
-The Python distribution requires Python 3.10+. Installation automatically includes the matching Admin-capable `secflow-sdk` dependency.
+Python 3.10+ is required; installation includes the pinned Admin-capable SDK.
 
-The npm distribution includes Python and the CLI dependencies in OS-specific native packages. Targets: Windows x64, macOS Intel/Apple Silicon, and Linux x64 with glibc 2.35+ (Ubuntu 22.04+). Alpine/musl and Linux ARM are not npm targets; use the Python distribution there. Keep npm optional dependencies enabled. Installation has no postinstall script or runtime download. Native binaries are not platform-signed or notarized.
+The npm distribution bundles Python and dependencies for Windows x64, macOS Intel/Apple Silicon, and Linux x64 glibc 2.35+. Alpine/musl and Linux ARM use the Python distribution. Keep optional dependencies enabled; installation has no postinstall script. Releases require all four same-version native packages. Binaries are not platform-signed or notarized.
 
-The bundled interpreter includes CA certificates for HTTPS. An explicit `SSL_CERT_FILE` or `SSL_CERT_DIR` takes precedence for organization-managed trust; TLS certificate verification stays enabled.
+The bundle includes HTTPS CAs; `SSL_CERT_FILE`/`SSL_CERT_DIR` overrides trust without disabling TLS verification.
 
 ```sh
-pipx upgrade secflow-cli
-# Or use the same installer as the initial installation:
-python -m pip install --upgrade secflow-cli
-npm install --global @intflow/secflow-cli@latest
+secflowctl update --check
+secflowctl update --status
 ```
 
+Commands check within 3s and stage protocol-1 stable runtimes in a private cache/venv, then run argv once; offline failures keep the last good runtime. TTY/JSON agree; help/version/check/status never install. `update --apply` installs; `--auto on|off` persists policy; `--pin VERSION` freezes an exact runtime; `--unpin` releases only policy. `INTFLOW_CLI_AUTO_UPDATE=0` stops automatic installs, allowing explicit apply/pin. Pins outrank off and fail closed. Internal native binaries update through npm.
+
 ## Connect
 
 ```sh

{secflow_cli-0.2.5 → secflow_cli-0.3.0}/pyproject.toml

@@ -4,15 +4,16 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "secflow-cli"
-version = "0.2.5"
+version = "0.3.0"
 description = "SecFlow operator CLI"
 readme = "USAGE.md"
 license = "MIT"
 requires-python = ">=3.10"
+keywords = ["intflow-cli-update-protocol-1"]
 dependencies = ["secflow-sdk==0.1.10", "keyring>=25,<26"]
 
 [project.scripts]
-secflowctl = "secflow_cli.main:main"
+secflowctl = "secflow_cli.bootstrap:main"
 
 [project.urls]
 Repository = "https://github.com/yeon3724/secflow"

secflow_cli-0.3.0/src/secflow_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.3.0"

secflow_cli-0.3.0/src/secflow_cli/__main__.py

@@ -0,0 +1,3 @@
+from secflow_cli.bootstrap import main
+
+raise SystemExit(main())

secflow_cli-0.3.0/src/secflow_cli/bootstrap.py

@@ -0,0 +1,37 @@
+from __future__ import annotations
+
+import sys
+from typing import Any
+
+from . import __version__
+from .update_runtime import bootstrap
+from .update_state import Configuration, default_root
+
+
+def execute(arguments: list[str]) -> int:
+    from .main import main
+
+    return main(arguments, configure=True)
+
+
+def output(value: dict[str, Any]) -> None:
+    from .output import update_result
+
+    update_result(value)
+
+
+def main(argv: list[str] | None = None) -> int:
+    config = Configuration(
+        "secflow-cli", "secflow_cli", __version__, default_root("secflow-cli")
+    )
+    return bootstrap(
+        config,
+        list(sys.argv[1:] if argv is None else argv),
+        execute,
+        output,
+        frozen=bool(getattr(sys, "frozen", False)),
+    )
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

{secflow_cli-0.2.5 → secflow_cli-0.3.0}/src/secflow_cli/main.py

@@ -53,6 +53,7 @@ class VersionAction(argparse.Action):
 
 def parser():
     result = Parser(prog="secflowctl", description="SecFlow operator CLI (independent of the service CLI).")
+    result.epilog = "CLI updates: update [--check|--apply|--status|--auto on|off|--pin VERSION|--unpin]."
     result.add_argument("--version", action=VersionAction, nargs=0, help="Show the CLI version and exit.")
     result.add_argument("--profile")
     result.add_argument("--base-url")
@@ -496,8 +497,8 @@ def dispatch(arguments, run):
     return run_configured(args, run, quick_login)
 
 
-def main(argv=None):
-    if argv is None:
+def main(argv=None, *, configure=False):
+    if argv is None or configure:
         logkit.configure("secflowctl", kind="cli")
     run = Invocation("table" if sys.stdout.isatty() else "json")
     try:

{secflow_cli-0.2.5 → secflow_cli-0.3.0}/src/secflow_cli/output.py

@@ -14,6 +14,10 @@ TOKEN_FIELDS = ("token_id", "account_id", "scope_type", "scope", "issued_at", "e
 ACCOUNT_ROLES = ("org_admin", "namespace_admin", "secret_writer", "secret_reader")
 
 
+def update_result(value):
+    print(json.dumps(value, ensure_ascii=True, separators=(",", ":")))
+
+
 def safe_fields(value, fields):
     if not isinstance(value, Mapping):
         raise CliError(7, "INVALID_RESPONSE", "The server returned an invalid metadata response.")

secflow_cli-0.3.0/src/secflow_cli/update_install.py

@@ -0,0 +1,322 @@
+from __future__ import annotations
+
+import http.client
+import json
+import os
+import queue
+import re
+import subprocess
+import sys
+import threading
+import time
+import urllib.parse
+import uuid
+from pathlib import Path
+from typing import Any
+
+from .update_security import directory, windows_tree
+from .update_state import (
+    CHILD,
+    MARKER,
+    PROTOCOL,
+    Configuration,
+    UpdateError,
+    checked,
+    digest,
+    executable,
+    private,
+    read,
+    release_path,
+    remove_release,
+    save,
+    version,
+)
+
+
+def compatible(specification: Any) -> bool:
+    if not isinstance(specification, str) or not specification:
+        return False
+    current = sys.version_info[:3]
+    operations = {
+        ">=": lambda wanted: current >= wanted,
+        ">": lambda wanted: current > wanted,
+        "<=": lambda wanted: current <= wanted,
+        "<": lambda wanted: current < wanted,
+        "==": lambda wanted: current == wanted,
+        "!=": lambda wanted: current != wanted,
+    }
+    for term in specification.split(","):
+        match = re.fullmatch(
+            r"\s*(>=|<=|==|!=|>|<)\s*(\d+)\.(\d+)(?:\.(\d+))?\s*", term
+        )
+        if match is None:
+            return False
+        wanted = tuple(int(value or 0) for value in match.groups()[1:])
+        if not operations[match[1]](wanted):
+            return False
+    return True
+
+
+def registry_bytes(url: str) -> bytes:
+    target = urllib.parse.urlsplit(url)
+    if (
+        target.scheme != "https"
+        or target.netloc != "pypi.org"
+        or target.query
+        or target.fragment
+    ):
+        raise UpdateError("INVALID_REGISTRY_RESPONSE")
+    connection = http.client.HTTPSConnection("pypi.org", timeout=3)
+    try:
+        connection.request("GET", target.path, headers={"Accept": "application/json"})
+        response = connection.getresponse()
+        if response.status != 200:
+            raise UpdateError("REGISTRY_UNAVAILABLE")
+        content = response.read(1048577)
+    finally:
+        connection.close()
+    if len(content) > 1048576:
+        raise UpdateError("INVALID_REGISTRY_RESPONSE")
+    return content
+
+
+def registry_document(url: str) -> dict[str, Any]:
+    result: queue.Queue[bytes | Exception] = queue.Queue(maxsize=1)
+
+    def fetch() -> None:
+        try:
+            result.put(registry_bytes(url))
+        except (OSError, ValueError, http.client.HTTPException, UpdateError) as error:
+            result.put(error)
+
+    threading.Thread(target=fetch, daemon=True).start()
+    try:
+        content = result.get(timeout=3)
+    except queue.Empty:
+        raise UpdateError("REGISTRY_TIMEOUT") from None
+    if isinstance(content, Exception):
+        raise UpdateError("REGISTRY_UNAVAILABLE") from None
+    value = json.loads(content)
+    if not isinstance(value, dict) or not isinstance(value.get("info"), dict):
+        raise UpdateError("INVALID_REGISTRY_RESPONSE")
+    return value
+
+
+def metadata(config: Configuration, target: str | None = None) -> dict[str, Any]:
+    if target is not None:
+        version(target)
+    suffix = "/" + target if target else ""
+    url = (
+        "https://pypi.org/pypi/"
+        + urllib.parse.quote(config.package, safe="")
+        + suffix
+        + "/json"
+    )
+    value = registry_document(url)
+    info = value.get("info", {})
+    actual = info.get("version")
+    version(actual)
+    normalized = re.sub(r"[-_.]+", "-", str(info.get("name", ""))).lower()
+    if normalized != config.package or (target is not None and actual != target):
+        raise UpdateError("INVALID_REGISTRY_RESPONSE")
+    keywords = info.get("keywords")
+    if not isinstance(keywords, str) or MARKER not in re.split(r"[\s,]+", keywords):
+        raise UpdateError("UNSUPPORTED_PROTOCOL", actual)
+    if not compatible(info.get("requires_python")):
+        raise UpdateError("INCOMPATIBLE_RUNTIME", actual)
+    wheels = [
+        row
+        for row in value.get("urls", [])
+        if isinstance(row, dict)
+        and row.get("packagetype") == "bdist_wheel"
+        and row.get("yanked") is False
+    ]
+    if not wheels:
+        raise UpdateError("WHEEL_UNAVAILABLE", actual)
+    return {"version": actual, "package": config.package, "protocol": PROTOCOL}
+
+
+def installer_environment() -> dict[str, str]:
+    allowed = {
+        "PATH",
+        "PATHEXT",
+        "SYSTEMROOT",
+        "WINDIR",
+        "COMSPEC",
+        "HOME",
+        "USERPROFILE",
+        "LOCALAPPDATA",
+        "APPDATA",
+        "TEMP",
+        "TMP",
+        "TMPDIR",
+        "LANG",
+        "LC_ALL",
+    }
+    return {
+        **{key: value for key, value in os.environ.items() if key.upper() in allowed},
+        CHILD: "1",
+        "INTFLOW_CLI_AUTO_UPDATE": "0",
+        "PYTHONUTF8": "1",
+        "PYTHONDONTWRITEBYTECODE": "1",
+        "PIP_CONFIG_FILE": os.devnull,
+        "NETRC": os.devnull,
+        "PIP_KEYRING_PROVIDER": "disabled",
+    }
+
+
+def execute(
+    command: list[str], folder: Path, deadline: float, capture: bool = False
+) -> str:
+    remaining = deadline - time.monotonic()
+    if remaining <= 0:
+        raise UpdateError("INSTALL_TIMEOUT")
+    result = subprocess.run(
+        command,
+        cwd=folder,
+        stdin=subprocess.DEVNULL,
+        stdout=subprocess.PIPE if capture else subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+        env=installer_environment(),
+        timeout=remaining,
+        check=False,
+    )
+    if result.returncode != 0:
+        raise UpdateError("VALIDATION_FAILED" if capture else "INSTALL_FAILED")
+    if capture:
+        if len(result.stdout) > 4096:
+            raise UpdateError("INVALID_PROBE")
+        return result.stdout.decode("utf-8").strip()
+    return ""
+
+
+def site_packages(release: Path) -> Path:
+    return release / (
+        "Lib/site-packages"
+        if os.name == "nt"
+        else f"lib/python{sys.version_info.major}.{sys.version_info.minor}/site-packages"
+    )
+
+
+def seal_files(release: Path) -> dict[str, str]:
+    files = [executable(release), release / "pyvenv.cfg"]
+    site = checked(site_packages(release))
+    for path in site.rglob("*"):
+        checked(path)
+        if path.is_file():
+            files.append(path)
+    if len(files) > 8192 or sum(path.stat().st_size for path in files) > 134217728:
+        raise UpdateError("RELEASE_TOO_LARGE")
+    return {path.relative_to(release).as_posix(): digest(path) for path in files}
+
+
+def validate(config: Configuration, pointer: dict[str, Any]) -> Path:
+    directory(config.root)
+    version(pointer.get("version"))
+    release = release_path(config.root, pointer.get("release"))
+    directory(release)
+    windows_tree(release)
+    seal = read(release, "release.json", 1048576)
+    if (
+        seal.get("package") != config.package
+        or seal.get("version") != pointer["version"]
+        or seal.get("protocol") != PROTOCOL
+    ):
+        raise UpdateError("INVALID_RELEASE")
+    if seal.get("files") != seal_files(release):
+        raise UpdateError("RELEASE_TAMPERED")
+    probe(config, release, pointer["version"], time.monotonic() + 10)
+    return executable(release)
+
+
+def probe(config: Configuration, release: Path, target: str, deadline: float) -> None:
+    python = str(executable(release))
+    query = (
+        "import importlib.metadata,json,sys; m=importlib.metadata.metadata(sys.argv[1]);"
+        "print(json.dumps({k:m.get(k) for k in "
+        "['Name','Version','Requires-Python','Keywords']}))"
+    )
+    installed = json.loads(
+        execute(
+            [python, "-I", "-B", "-c", query, config.package], release, deadline, True
+        )
+    )
+    normalized = re.sub(r"[-_.]+", "-", str(installed.get("Name", ""))).lower()
+    if normalized != config.package or installed.get("Version") != target:
+        raise UpdateError("VERSION_MISMATCH")
+    if MARKER not in re.split(
+        r"[\s,]+", str(installed.get("Keywords", ""))
+    ) or not compatible(installed.get("Requires-Python")):
+        raise UpdateError("UNSUPPORTED_PROTOCOL")
+    payload = execute(
+        [python, "-I", "-B", "-m", config.module + ".bootstrap", "--runtime-probe"],
+        release,
+        deadline,
+        True,
+    )
+    if json.loads(payload) != {
+        "protocol": PROTOCOL,
+        "package": config.package,
+        "version": target,
+        "runtime": "python",
+    }:
+        raise UpdateError("INVALID_PROBE")
+    displayed = execute(
+        [python, "-I", "-B", "-m", config.module + ".bootstrap", "--version"],
+        release,
+        deadline,
+        True,
+    )
+    if target not in displayed.split():
+        raise UpdateError("VERSION_MISMATCH")
+
+
+def install(config: Configuration, target: str) -> dict[str, Any]:
+    version(target)
+    private(config.root)
+    release = config.root / ("release-" + str(uuid.uuid4()))
+    private(release)
+    deadline = time.monotonic() + 180
+    complete = False
+    try:
+        execute(
+            [sys.executable, "-I", "-m", "venv", "--copies", str(release)],
+            release,
+            deadline,
+        )
+        execute(
+            [
+                str(executable(release)),
+                "-I",
+                "-m",
+                "pip",
+                "install",
+                "--disable-pip-version-check",
+                "--no-input",
+                "--no-cache-dir",
+                "--no-compile",
+                "--index-url",
+                "https://pypi.org/simple",
+                "--only-binary",
+                ":all:",
+                config.package + "==" + target,
+            ],
+            release,
+            deadline,
+        )
+        probe(config, release, target, deadline)
+        save(
+            release,
+            "release.json",
+            {
+                "package": config.package,
+                "version": target,
+                "protocol": PROTOCOL,
+                "files": seal_files(release),
+            },
+        )
+        complete = True
+        return {"version": target, "release": release.name}
+    finally:
+        if not complete:
+            remove_release(config.root, release)