systemlink-cli 1.17.4__tar.gz → 1.19.0__tar.gz

{systemlink_cli-1.17.4 → systemlink_cli-1.19.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: systemlink-cli
-Version: 1.17.4
+Version: 1.19.0
 Summary: SystemLink Integrator CLI - cross-platform CLI for SystemLink workflows and templates.
 License-File: LICENSE
 Author: Fred Visser

{systemlink_cli-1.17.4 → systemlink_cli-1.19.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "systemlink-cli"
-version = "1.17.4"
+version = "1.19.0"
 description = "SystemLink Integrator CLI - cross-platform CLI for SystemLink workflows and templates."
 authors = ["Fred Visser <fred.visser@emerson.com>"]
 packages = [{ include = "slcli" }]

{systemlink_cli-1.17.4 → systemlink_cli-1.19.0}/slcli/_version.py

@@ -1,4 +1,4 @@
 """Version information for slcli."""
 
 # This file is auto-generated. Do not edit manually.
-__version__ = "1.17.4"
+__version__ = "1.19.0"

{systemlink_cli-1.17.4 → systemlink_cli-1.19.0}/slcli/config_click.py

@@ -4,8 +4,9 @@ import getpass
 import json
 import os
 import re
+import ssl
 import sys
-from typing import Any, Optional
+from typing import Any, NoReturn, Optional
 from urllib.parse import urlparse
 
 import click
@@ -18,8 +19,15 @@ from .platform import (
 )
 from .profiles import ProfileConfig, Profile, check_config_file_permissions
 from .rich_output import render_table
+from .ssl_trust import (
+    get_managed_trust_records,
+    get_ssl_server_origin,
+    inspect_server_certificate,
+    remove_managed_trust,
+    save_managed_certificate,
+)
 from .table_utils import output_formatted_list
-from .utils import ExitCodes
+from .utils import ExitCodes, get_base_url
 
 API_KEY_LENGTH = 42
 API_KEY_PATTERN = re.compile(rf"^[A-Za-z0-9_-]{{{API_KEY_LENGTH}}}$")
@@ -30,7 +38,7 @@ ENV_OVERRIDE_FIELDS = (
 )
 
 
-def _exit_with_validation_error(message: str, exit_code: int = ExitCodes.INVALID_INPUT) -> None:
+def _exit_with_validation_error(message: str, exit_code: int = ExitCodes.INVALID_INPUT) -> NoReturn:
     """Exit the command with a consistent validation message."""
     click.echo(f"✗ {message}", err=True)
     sys.exit(exit_code)
@@ -100,6 +108,91 @@ def _all_service_probes_unauthorized(services: dict[str, str]) -> bool:
     return bool(services) and all(status == "unauthorized" for status in services.values())
 
 
+def _normalize_fingerprint(fingerprint: str) -> str:
+    """Normalize a SHA-256 certificate fingerprint supplied by a user."""
+    normalized = fingerprint.replace(":", "").replace(" ", "").strip().upper()
+    if len(normalized) != 64 or any(
+        character not in "0123456789ABCDEF" for character in normalized
+    ):
+        _exit_with_validation_error("Certificate fingerprint must be a 64-character SHA-256 value.")
+    return normalized
+
+
+def _show_certificate_warning(certificate: dict[str, Any]) -> None:
+    """Display the identity of a certificate before it is trusted."""
+    click.echo("\n⚠️  TLS certificate verification failed.", err=True)
+    click.echo(f"  Server: {certificate.get('origin', 'unknown')}", err=True)
+    click.echo(f"  Subject: {certificate.get('subject', 'unknown')}", err=True)
+    click.echo(f"  Issuer: {certificate.get('issuer', 'unknown')}", err=True)
+    click.echo(f"  SHA-256: {certificate.get('fingerprint', 'unknown')}", err=True)
+    click.echo(f"  Self-signed: {'yes' if certificate.get('self-signed') else 'no'}", err=True)
+    click.echo(
+        f"  Valid: {certificate.get('not-before', 'unknown')} to "
+        f"{certificate.get('not-after', 'unknown')}",
+        err=True,
+    )
+
+
+def _trust_certificate_if_requested(
+    url: str, api_key: str, status: dict[str, Any], trust_fingerprint: Optional[str]
+) -> dict[str, Any]:
+    """Prompt for or apply certificate trust after a verification failure."""
+    certificate_details = status.get("certificate")
+    if not isinstance(certificate_details, dict):
+        _exit_with_validation_error(
+            "TLS certificate verification failed, but the server certificate could not be "
+            "inspected. Profile was not saved.",
+            ExitCodes.NETWORK_ERROR,
+        )
+
+    _show_certificate_warning(certificate_details)
+    expected_fingerprint = _normalize_fingerprint(trust_fingerprint) if trust_fingerprint else None
+    actual_fingerprint = str(certificate_details.get("fingerprint", "")).upper()
+    if expected_fingerprint:
+        if expected_fingerprint != actual_fingerprint:
+            _exit_with_validation_error(
+                "The server certificate fingerprint does not match --trust-fingerprint. "
+                "Profile was not saved.",
+                ExitCodes.INVALID_INPUT,
+            )
+    elif not click.confirm("Trust this certificate for this server?", default=False):
+        _exit_with_validation_error("Certificate was not trusted. Profile was not saved.")
+
+    try:
+        certificate = inspect_server_certificate(url)
+    except (OSError, ValueError, ssl.SSLError) as exc:
+        _exit_with_validation_error(
+            f"Could not inspect the server certificate: {exc}. Profile was not saved.",
+            ExitCodes.NETWORK_ERROR,
+        )
+
+    if certificate.fingerprint != actual_fingerprint:
+        _exit_with_validation_error(
+            "The server certificate changed during approval. Profile was not saved.",
+            ExitCodes.NETWORK_ERROR,
+        )
+
+    try:
+        save_managed_certificate(certificate)
+        retry_status = check_service_status(url, api_key)
+    except (OSError, ValueError) as exc:
+        _exit_with_validation_error(
+            f"Could not save the trusted certificate: {exc}. Profile was not saved.",
+            ExitCodes.GENERAL_ERROR,
+        )
+
+    if not retry_status.get("server_reachable") or retry_status.get("certificate_error"):
+        remove_managed_trust(url)
+        _exit_with_validation_error(
+            "The server could not be verified after trusting its certificate. "
+            "Profile was not saved.",
+            ExitCodes.NETWORK_ERROR,
+        )
+
+    click.echo("  Certificate: ✓ Trusted for this server")
+    return retry_status
+
+
 def _add_profile_impl(
     profile: Optional[str],
     url: Optional[str],
@@ -108,6 +201,7 @@ def _add_profile_impl(
     workspace: Optional[str],
     set_current: bool,
     readonly: bool,
+    trust_fingerprint: Optional[str] = None,
 ) -> None:
     """Shared implementation for add-profile and login commands.
 
@@ -122,6 +216,7 @@ def _add_profile_impl(
         workspace: Default workspace for this profile
         set_current: Whether to set as the current profile
         readonly: Whether to enable readonly mode
+        trust_fingerprint: Optional SHA-256 fingerprint for non-interactive trust approval
     """
     # Get profile name
     if not profile:
@@ -152,6 +247,10 @@ def _add_profile_impl(
     # Detect platform type and check service status
     click.echo("Checking server connectivity and services...")
     status = check_service_status(url, api_key)
+
+    if status.get("certificate_error") and not status.get("server_reachable"):
+        status = _trust_certificate_if_requested(url, api_key, status, trust_fingerprint)
+
     platform = status["platform"]
     services = status.get("services", {})
 
@@ -458,6 +557,98 @@ def register_config_commands(cli: Any) -> None:
         if warning:
             click.echo(f"\n⚠️  {warning}", err=True)
 
+    @config.group(name="trust")
+    def trust() -> None:
+        """Manage explicitly trusted server certificates."""
+        pass
+
+    @trust.command(name="list")
+    @click.option(
+        "--format",
+        "output_format",
+        type=click.Choice(["table", "json"]),
+        default="table",
+        help="Output format",
+    )
+    def list_trusted_certificates(output_format: str) -> None:
+        """List certificates trusted by slcli."""
+        records = get_managed_trust_records()
+        if output_format == "json":
+            click.echo(json.dumps(records, indent=2))
+            return
+        if not records:
+            click.echo("No managed server certificates.")
+            return
+
+        rows = [
+            [
+                str(record.get("origin", "")),
+                str(record.get("fingerprint", "")),
+                "yes" if record.get("self-signed") else "no",
+            ]
+            for record in records
+        ]
+        render_table(
+            headers=["SERVER", "SHA-256", "SELF-SIGNED"],
+            column_widths=[40, 64, 12],
+            rows=rows,
+            show_total=True,
+            total_label="certificate(s)",
+        )
+
+    @trust.command(name="add")
+    @click.option("--url", help="HTTPS server URL (defaults to the active API URL)")
+    @click.option(
+        "--fingerprint",
+        required=True,
+        help="Expected SHA-256 fingerprint of the certificate to trust",
+    )
+    def add_trusted_certificate(url: Optional[str], fingerprint: str) -> None:
+        """Trust a server certificate after verifying its fingerprint."""
+        server_url = url or get_base_url()
+        try:
+            expected_fingerprint = _normalize_fingerprint(fingerprint)
+            certificate = inspect_server_certificate(server_url)
+        except (OSError, ValueError, ssl.SSLError) as exc:
+            _exit_with_validation_error(f"Could not inspect the server certificate: {exc}.")
+
+        _show_certificate_warning(certificate.to_dict())
+        if certificate.fingerprint != expected_fingerprint:
+            _exit_with_validation_error(
+                "The server certificate fingerprint does not match the supplied fingerprint."
+            )
+        try:
+            path = save_managed_certificate(certificate)
+        except OSError as exc:
+            _exit_with_validation_error(f"Could not save the trusted certificate: {exc}.")
+        click.echo(f"✓ Trusted certificate for {certificate.origin}")
+        click.echo(f"  Certificate file: {path}")
+
+    @trust.command(name="remove")
+    @click.option("--url", help="HTTPS server URL (defaults to the active API URL)")
+    @click.option("--force", is_flag=True, help="Skip confirmation prompt")
+    def remove_trusted_certificate(url: Optional[str], force: bool) -> None:
+        """Remove a server certificate from the managed trust store."""
+        server_url = url or get_base_url()
+        try:
+            origin = get_ssl_server_origin(server_url)
+        except ValueError as exc:
+            _exit_with_validation_error(str(exc))
+        if not force and not click.confirm(
+            f"Remove trusted certificate for {origin}?", default=False
+        ):
+            click.echo("Certificate was not removed.")
+            return
+        try:
+            removed = remove_managed_trust(server_url)
+        except (OSError, ValueError) as exc:
+            _exit_with_validation_error(f"Could not remove the trusted certificate: {exc}.")
+        if not removed:
+            _exit_with_validation_error(
+                f"No trusted certificate found for {origin}.", ExitCodes.NOT_FOUND
+            )
+        click.echo(f"✓ Removed trusted certificate for {origin}")
+
     @config.command(name="delete")
     @click.argument("name")
     @click.option("--force", "-f", is_flag=True, help="Skip confirmation prompt")
@@ -558,6 +749,10 @@ def register_config_commands(cli: Any) -> None:
             "publish, and disable commands)"
         ),
     )
+    @click.option(
+        "--trust-fingerprint",
+        help="Trust a certificate after its SHA-256 fingerprint matches exactly",
+    )
     def add_profile(
         profile: Optional[str],
         url: Optional[str],
@@ -566,6 +761,7 @@ def register_config_commands(cli: Any) -> None:
         workspace: Optional[str],
         set_current: bool,
         readonly: bool,
+        trust_fingerprint: Optional[str],
     ) -> None:
         """Add or update a SystemLink profile.
 
@@ -588,4 +784,5 @@ def register_config_commands(cli: Any) -> None:
             workspace=workspace,
             set_current=set_current,
             readonly=readonly,
+            trust_fingerprint=trust_fingerprint,
         )

{systemlink_cli-1.17.4 → systemlink_cli-1.19.0}/slcli/main.py

@@ -8,7 +8,7 @@ import ssl
 import tomllib
 from pathlib import Path
 from types import ModuleType
-from typing import List, Optional, Tuple
+from typing import List, Optional, Tuple, Union
 from urllib.parse import urlparse
 
 import click as base_click
@@ -103,6 +103,16 @@ def _configure_rich_click_command_groups() -> None:
 
 def _get_ca_source_display() -> str:
     """Describe the CA source used for HTTPS verification."""
+    try:
+        from .ssl_trust import get_managed_trust_path
+        from .utils import get_base_url
+
+        managed_path = get_managed_trust_path(get_base_url())
+        if managed_path is not None:
+            return f"managed-pem ({managed_path})"
+    except (OSError, ValueError):
+        pass
+
     if OS_TRUST_INJECTED:
         return f"system (reason={OS_TRUST_REASON})"
 
@@ -113,7 +123,7 @@ def _get_ca_source_display() -> str:
     return f"certifi (reason={OS_TRUST_REASON})"
 
 
-def _build_tls_debug_context(ssl_verify: bool) -> ssl.SSLContext:
+def _build_tls_debug_context(ssl_verify: Union[bool, str]) -> ssl.SSLContext:
     """Build an SSL context aligned with the current CLI trust configuration."""
     if not ssl_verify:
         ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
@@ -121,6 +131,9 @@ def _build_tls_debug_context(ssl_verify: bool) -> ssl.SSLContext:
         ctx.verify_mode = ssl.CERT_NONE
         return ctx
 
+    if isinstance(ssl_verify, str):
+        return ssl.create_default_context(cafile=ssl_verify)
+
     verify_env = os.environ.get("REQUESTS_CA_BUNDLE") or os.environ.get("SSL_CERT_FILE")
     if verify_env:
         return ssl.create_default_context(cafile=verify_env)
@@ -204,7 +217,7 @@ def _get_proxy_debug_rows(api_url: str) -> List[Tuple[str, str]]:
     ]
 
 
-def _probe_tls_connection(api_url: str, ssl_verify: bool) -> List[Tuple[str, str]]:
+def _probe_tls_connection(api_url: str, ssl_verify: Union[bool, str]) -> List[Tuple[str, str]]:
     """Collect TLS handshake and leaf certificate details for the API host."""
     import requests
 
@@ -268,7 +281,7 @@ def _collect_info_debug_rows(api_url: str) -> List[Tuple[str, str]]:
     """Return structured connection diagnostics for info --debug."""
     from .utils import get_ssl_verify
 
-    ssl_verify = get_ssl_verify()
+    ssl_verify = get_ssl_verify(api_url)
     rows = [
         ("SSL Verify", "enabled" if ssl_verify else "disabled"),
         ("CA Source", _get_ca_source_display()),
@@ -414,6 +427,10 @@ def ca_info() -> None:
         "publish, and disable commands)"
     ),
 )
+@click.option(
+    "--trust-fingerprint",
+    help="Trust a certificate after its SHA-256 fingerprint matches exactly",
+)
 def login(
     profile: Optional[str],
     url: Optional[str],
@@ -422,6 +439,7 @@ def login(
     workspace: Optional[str],
     set_current: bool,
     readonly: bool,
+    trust_fingerprint: Optional[str],
 ) -> None:
     """Create or update a SystemLink profile with credentials.
 
@@ -447,6 +465,7 @@ def login(
         workspace=workspace,
         set_current=set_current,
         readonly=readonly,
+        trust_fingerprint=trust_fingerprint,
     )
 
 

{systemlink_cli-1.17.4 → systemlink_cli-1.19.0}/slcli/mcp_server.py

@@ -254,12 +254,27 @@ def query_tag_history(path: str, take: int = 100) -> str:
     from .utils import get_base_url
 
     path = _require(path, "path")
-    encoded_path = urllib.parse.quote(path, safe="")
-    url = f"{get_base_url()}/nitag/v2/tags/{encoded_path}/values/history?take={take}"
-    data = _get_json(url)
+    url = f"{get_base_url()}/nitaghistorian/v2/tags/query-history"
+    data = _post_json(
+        url,
+        {
+            "path": path,
+            "startTime": "0001-01-01T00:00:00Z",
+            "endTime": "9999-12-31T23:59:59Z",
+            "take": take,
+            "sortOrder": "DESCENDING",
+        },
+    )
     if isinstance(data, list):
         return _dump(data)
-    return _dump(data.get("values", data.get("tagsWithAggregates", [])))
+    values = data.get("values", [])
+    value_type = data.get("type")
+    if isinstance(values, list) and isinstance(value_type, str):
+        values = [
+            {**item, "type": value_type} if isinstance(item, dict) and "type" not in item else item
+            for item in values
+        ]
+    return _dump(values)
 
 
 @server.tool()

{systemlink_cli-1.17.4 → systemlink_cli-1.19.0}/slcli/platform.py

@@ -6,6 +6,7 @@ This module provides utilities to detect and manage the target platform
 
 import json
 import os
+import ssl
 import sys
 import time
 from functools import lru_cache
@@ -15,6 +16,7 @@ import click
 import keyring
 import requests
 
+from .ssl_trust import use_standard_ssl_context
 from .utils import ExitCodes, get_ssl_verify
 
 DEFAULT_SERVICE_PROBE_CACHE_TTL_SECONDS = 300
@@ -206,7 +208,7 @@ def _probe_service_status(api_url: str, api_key: str, method: str, url_path: str
         "Content-Type": "application/json",
         "User-Agent": "SystemLink-CLI/1.0 (cross-platform)",
     }
-    ssl_verify = get_ssl_verify()
+    ssl_verify = get_ssl_verify(api_url)
 
     try:
         full_url = f"{api_url}{url_path}"
@@ -469,7 +471,7 @@ def get_file_query_capability(api_url: str, api_key: str) -> Dict[str, Any]:
         "Content-Type": "application/json",
         "User-Agent": "SystemLink-CLI/1.0 (cross-platform)",
     }
-    ssl_verify = get_ssl_verify()
+    ssl_verify = get_ssl_verify(api_url)
 
     try:
         search_resp = requests.post(
@@ -583,7 +585,7 @@ def get_system_query_capability(api_url: str, api_key: str) -> Dict[str, Any]:
         "Content-Type": "application/json",
         "User-Agent": "SystemLink-CLI/1.0 (cross-platform)",
     }
-    ssl_verify = get_ssl_verify()
+    ssl_verify = get_ssl_verify(api_url)
 
     try:
         search_resp = requests.post(
@@ -679,17 +681,25 @@ def check_service_status(api_url: str, api_key: str) -> Dict[str, Any]:
         - platform: detected platform string (PLATFORM_SLE, PLATFORM_SLS,
           PLATFORM_UNREACHABLE, PLATFORM_UNKNOWN)
     """
+    ssl_verify = get_ssl_verify(api_url)
+    with use_standard_ssl_context(ssl_verify):
+        return _check_service_status(api_url, api_key)
+
+
+def _check_service_status(api_url: str, api_key: str) -> Dict[str, Any]:
+    """Probe services while the caller has selected the appropriate SSL context."""
     headers = {
         "x-ni-api-key": api_key,
         "Content-Type": "application/json",
         "User-Agent": "SystemLink-CLI/1.0 (cross-platform)",
     }
-    ssl_verify = get_ssl_verify()
+    ssl_verify = get_ssl_verify(api_url)
 
     services: Dict[str, str] = {}
     any_responded = False
     any_authorized = False
     all_unauthorized = True
+    certificate_error = False
 
     for display_name, method, url_path in SERVICE_CHECKS:
         try:
@@ -725,15 +735,28 @@ def check_service_status(api_url: str, api_key: str) -> Dict[str, Any]:
             else:
                 services[display_name] = "error"
                 all_unauthorized = False
+        except requests.exceptions.SSLError:
+            services[display_name] = "certificate_error"
+            certificate_error = True
         except requests.RequestException:
             services[display_name] = "unreachable"
 
     # Determine overall status
     if not any_responded:
+        certificate_details: Optional[Dict[str, Any]] = None
+        if certificate_error:
+            try:
+                from .ssl_trust import inspect_server_certificate
+
+                certificate_details = inspect_server_certificate(api_url).to_dict()
+            except (OSError, ValueError, ssl.SSLError):
+                certificate_details = None
         return {
             "server_reachable": False,
             "auth_valid": None,
             "services": services,
+            "certificate_error": certificate_error,
+            "certificate": certificate_details,
             "file_query_endpoint": None,
             "elasticsearch_available": None,
             "system_query_endpoint": None,
@@ -759,6 +782,7 @@ def check_service_status(api_url: str, api_key: str) -> Dict[str, Any]:
         "server_reachable": True,
         "auth_valid": auth_valid,
         "services": services,
+        "certificate_error": certificate_error,
         "file_query_endpoint": file_capability["file_query_endpoint"],
         "elasticsearch_available": file_capability["elasticsearch_available"],
         "system_query_endpoint": system_capability["system_query_endpoint"],

{systemlink_cli-1.17.4 → systemlink_cli-1.19.0}/slcli/skills/slcli/references/commands.md

@@ -378,6 +378,7 @@ slcli dataframe delete <TABLE_ID>... [--yes]
 slcli tag list [OPTIONS]                            # List tags (filter by path glob, workspace)
 slcli tag get <TAG_PATH> [-f json]                  # Get tag metadata
 slcli tag get-value <TAG_PATH>                      # Read current tag value
+slcli tag history <TAG_PATH> [-w WORKSPACE] [-t TAKE] [-f json] [--graph]  # Read or graph history
 slcli tag set-value <TAG_PATH> <VALUE>              # Write a tag value
 slcli tag create --path <PATH> --data-type <TYPE>   # Create a new tag
 slcli tag update <TAG_PATH> [OPTIONS]               # Update tag metadata