systemlink-cli 1.23.0__tar.gz → 1.25.0__tar.gz

{systemlink_cli-1.23.0 → systemlink_cli-1.25.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: systemlink-cli
-Version: 1.23.0
+Version: 1.25.0
 Summary: SystemLink Integrator CLI - cross-platform CLI for SystemLink workflows and templates.
 License-File: LICENSE
 Author: Fred Visser
@@ -14,7 +14,7 @@ Provides-Extra: mcp
 Requires-Dist: click (>=7.1.2)
 Requires-Dist: cryptography (>=49.0.0)
 Requires-Dist: keyring (>=25.6.0,<26.0.0)
-Requires-Dist: mcp (>=1.0) ; extra == "mcp"
+Requires-Dist: mcp (>=2,<3) ; extra == "mcp"
 Requires-Dist: packaging (>=21.0)
 Requires-Dist: pygments (>=2.20.0)
 Requires-Dist: pyyaml (>=6.0.3,<7.0.0)

{systemlink_cli-1.23.0 → systemlink_cli-1.25.0}/pyproject.toml

@@ -1,10 +1,11 @@
 [tool.poetry]
 name = "systemlink-cli"
-version = "1.23.0"
+version = "1.25.0"
 description = "SystemLink Integrator CLI - cross-platform CLI for SystemLink workflows and templates."
 authors = ["Fred Visser <fred.visser@emerson.com>"]
 packages = [{ include = "slcli" }]
 include = [
+    { path = "slcli/systemlink-logo.svg", format = ["wheel", "sdist"] },
     { path = "dff-editor/index.html", format = ["wheel", "sdist"] },
     { path = "dff-editor/editor.js", format = ["wheel", "sdist"] },
     { path = "slcli/skills", format = ["wheel", "sdist"] },
@@ -37,7 +38,7 @@ rich = ">=15,<16"
 rich-click = ">=1.8,<2"
 cryptography = ">=49.0.0"
 pygments = ">=2.20.0"
-mcp = { version = ">=1.0", optional = true }
+mcp = { version = ">=2,<3", optional = true }
 
 [tool.poetry.extras]
 mcp = ["mcp"]
@@ -80,7 +81,7 @@ pytest-xdist = "^3.8.0"
 openpyxl = "^3.1.5"
 
 # MCP server (optional feature, also needed for type checking)
-mcp = ">=1.0"
+mcp = ">=2,<3"
 
 [tool.pytest.ini_options]
 addopts = "--cov slcli --strict-markers --doctest-modules --ignore=tests/e2e"

{systemlink_cli-1.23.0 → systemlink_cli-1.25.0}/slcli/_version.py

@@ -1,4 +1,4 @@
 """Version information for slcli."""
 
 # This file is auto-generated. Do not edit manually.
-__version__ = "1.23.0"
+__version__ = "1.25.0"

{systemlink_cli-1.23.0 → systemlink_cli-1.25.0}/slcli/config_click.py

@@ -16,6 +16,7 @@ from .platform import (
     PLATFORM_SLE,
     PLATFORM_SLS,
     check_service_status,
+    check_web_server_auth,
 )
 from .profiles import ProfileConfig, Profile, check_config_file_permissions
 from .rich_output import render_table
@@ -134,7 +135,11 @@ def _show_certificate_warning(certificate: dict[str, Any]) -> None:
 
 
 def _trust_certificate_if_requested(
-    url: str, api_key: str, status: dict[str, Any], trust_fingerprint: Optional[str]
+    url: str,
+    credential: str,
+    status: dict[str, Any],
+    trust_fingerprint: Optional[str],
+    auth_scheme: str = "api-key",
 ) -> dict[str, Any]:
     """Prompt for or apply certificate trust after a verification failure."""
     certificate_details = status.get("certificate")
@@ -174,7 +179,10 @@ def _trust_certificate_if_requested(
 
     try:
         save_managed_certificate(certificate)
-        retry_status = check_service_status(url, api_key)
+        if auth_scheme == "bearer":
+            retry_status = check_web_server_auth(url, credential, auth_scheme=auth_scheme)
+        else:
+            retry_status = check_service_status(url, credential, auth_scheme=auth_scheme)
     except (OSError, ValueError) as exc:
         _exit_with_validation_error(
             f"Could not save the trusted certificate: {exc}. Profile was not saved.",
@@ -202,6 +210,10 @@ def _add_profile_impl(
     set_current: bool,
     readonly: bool,
     trust_fingerprint: Optional[str] = None,
+    auth_mode: str = "api-key",
+    client_id: Optional[str] = None,
+    scopes: tuple[str, ...] = (),
+    callback_port: Optional[int] = None,
 ) -> None:
     """Shared implementation for add-profile and login commands.
 
@@ -217,6 +229,10 @@ def _add_profile_impl(
         set_current: Whether to set as the current profile
         readonly: Whether to enable readonly mode
         trust_fingerprint: Optional SHA-256 fingerprint for non-interactive trust approval
+        auth_mode: Authentication flow to use
+        client_id: Public OAuth client ID for the PKCE login
+        scopes: OAuth scopes for the PKCE login
+        callback_port: Optional loopback callback port; zero selects an ephemeral port
     """
     # Get profile name
     if not profile:
@@ -231,11 +247,20 @@ def _add_profile_impl(
     assert isinstance(url, str)
     url = _normalize_base_url(url, "SystemLink API URL")
 
-    # Get API key - either from flag or prompt
-    if not api_key:
-        api_key = getpass.getpass("Enter your SystemLink API key: ")
-    assert isinstance(api_key, str)
-    api_key = _normalize_api_key(api_key)
+    if auth_mode == "api-key":
+        # Get API key - either from flag or prompt
+        if not api_key:
+            api_key = getpass.getpass("Enter your SystemLink API key: ")
+        assert isinstance(api_key, str)
+        api_key = _normalize_api_key(api_key)
+    elif auth_mode == "pkce":
+        if api_key:
+            _exit_with_validation_error(
+                "--api-key cannot be combined with --auth pkce. "
+                "Use --auth api-key for the API-key login flow."
+            )
+    else:
+        _exit_with_validation_error(f"Unsupported authentication flow: {auth_mode}")
 
     # Normalize and validate web_url (prompt if not provided)
     if not web_url:
@@ -244,12 +269,59 @@ def _add_profile_impl(
     assert isinstance(web_url, str)
     web_url = _normalize_base_url(web_url, "SystemLink Web UI URL")
 
-    # Detect platform type and check service status
+    pkce_result: Any = None
+    pkce_scopes = list(scopes) if scopes else ["openid", "profile", "email", "offline_access"]
+    if auth_mode == "pkce":
+        certificate_status = check_web_server_auth(web_url, "", auth_scheme="bearer")
+        if certificate_status.get("certificate_error") and not certificate_status.get(
+            "server_reachable"
+        ):
+            _trust_certificate_if_requested(
+                web_url,
+                "",
+                certificate_status,
+                trust_fingerprint,
+                auth_scheme="bearer",
+            )
+        if not client_id:
+            client_id = click.prompt("PKCE client ID")
+        assert isinstance(client_id, str)
+        client_id = client_id.strip()
+        if not client_id:
+            _exit_with_validation_error("PKCE client ID cannot be empty.")
+
+        from .pkce import PkceError, perform_pkce_login
+
+        click.echo("Opening the SystemLink Web UI for authentication...")
+        try:
+            if callback_port is None:
+                pkce_result = perform_pkce_login(web_url, client_id, pkce_scopes)
+            else:
+                pkce_result = perform_pkce_login(
+                    web_url, client_id, pkce_scopes, callback_port=callback_port
+                )
+        except PkceError as exc:
+            _exit_with_validation_error(f"PKCE login failed: {exc}")
+        api_key = pkce_result.access_token
+
+    assert isinstance(api_key, str)
+
+    # Validate PKCE against the Web Server identity route; API-key login retains API probes.
     click.echo("Checking server connectivity and services...")
-    status = check_service_status(url, api_key)
+    if auth_mode == "pkce":
+        status = check_web_server_auth(web_url, api_key, auth_scheme="bearer")
+    else:
+        status = check_service_status(url, api_key)
 
     if status.get("certificate_error") and not status.get("server_reachable"):
-        status = _trust_certificate_if_requested(url, api_key, status, trust_fingerprint)
+        validation_url = web_url if auth_mode == "pkce" else url
+        status = _trust_certificate_if_requested(
+            validation_url,
+            api_key,
+            status,
+            trust_fingerprint,
+            auth_scheme="bearer" if auth_mode == "pkce" else "api-key",
+        )
 
     platform = status["platform"]
     services = status.get("services", {})
@@ -262,16 +334,26 @@ def _add_profile_impl(
         )
 
     if status["auth_valid"] is False and _all_service_probes_unauthorized(services):
+        auth_failure_message = (
+            "PKCE bearer token validation failed. The server responded, but the token was not authorized. "
+            if auth_mode == "pkce"
+            else "API key validation failed. The server responded, but the key was not authorized. "
+        )
         _exit_with_validation_error(
-            "API key validation failed. The server responded, but the key was not authorized. "
-            "Profile was not saved.",
+            auth_failure_message + "Profile was not saved.",
             ExitCodes.PERMISSION_DENIED,
         )
 
     if status["auth_valid"] is not True:
-        _exit_with_validation_error(
+        verification_message = (
             "Connected to the server, but profile verification was inconclusive. Check the "
-            "API URL, API key, and service availability. Profile was not saved.",
+            "Web UI URL, bearer token, and service availability. Profile was not saved."
+            if auth_mode == "pkce"
+            else "Connected to the server, but profile verification was inconclusive. Check the "
+            "API URL, API key, and service availability. Profile was not saved."
+        )
+        _exit_with_validation_error(
+            verification_message,
             ExitCodes.GENERAL_ERROR,
         )
 
@@ -283,7 +365,10 @@ def _add_profile_impl(
     else:
         click.echo("  Platform: Unknown (will attempt all features)")
 
-    click.echo("  API key:  ✓ Authorized")
+    if auth_mode == "pkce":
+        click.echo("  PKCE bearer token:  ✓ Authorized")
+    else:
+        click.echo("  API key:  ✓ Authorized")
 
     if status.get("file_query_endpoint") == "query-files":
         click.echo("  File query: query-files")
@@ -315,13 +400,40 @@ def _add_profile_impl(
         platform=platform,
         workspace=workspace,
         readonly=readonly,
+        auth_mode=auth_mode,
+        pkce_client_id=client_id if auth_mode == "pkce" else None,
+        pkce_scopes=pkce_scopes if auth_mode == "pkce" else None,
     )
 
     # Load config and add profile
     cfg = ProfileConfig.load()
+    previous_profile = cfg.get_profile(profile)
+    previous_current_profile = cfg.current_profile
     cfg.add_profile(new_profile, set_current=set_current)
     cfg.save()
 
+    if auth_mode == "pkce" and pkce_result is not None:
+        from .pkce import save_pkce_credentials
+
+        try:
+            save_pkce_credentials(
+                profile,
+                pkce_result.access_token,
+                pkce_result.refresh_token,
+                pkce_result.expires_at,
+            )
+        except Exception as exc:
+            if previous_profile is None:
+                cfg.profiles.pop(profile, None)
+            else:
+                cfg.profiles[profile] = previous_profile
+            cfg.current_profile = previous_current_profile
+            cfg.save()
+            _exit_with_validation_error(
+                f"Could not store PKCE credentials securely: {exc}.",
+                ExitCodes.GENERAL_ERROR,
+            )
+
     click.echo(f"\n✓ Profile '{profile}' saved successfully.")
     click.echo(f"  Server: {url}")
     click.echo(f"  Web URL: {web_url}")
@@ -373,6 +485,7 @@ def register_config_commands(cli: Any) -> None:
                 item = {
                     "name": p.name,
                     "server": p.server,
+                    "auth-mode": p.auth_mode,
                     "current": p.name == cfg.current_profile,
                 }
                 if p.web_url:
@@ -523,13 +636,16 @@ def register_config_commands(cli: Any) -> None:
             if profile.platform:
                 rows.append(["Platform", profile.platform or "Unknown"])
 
-            if show_secrets:
-                api_key_display = profile.api_key
+            if profile.auth_mode == "pkce":
+                rows.append(["Authentication", "PKCE (bearer token in keyring)"])
             else:
-                api_key_display = (
-                    "****" + profile.api_key[-4:] if len(profile.api_key) >= 4 else "****"
-                )
-            rows.append(["API Key", api_key_display])
+                if show_secrets:
+                    api_key_display = profile.api_key
+                else:
+                    api_key_display = (
+                        "****" + profile.api_key[-4:] if len(profile.api_key) >= 4 else "****"
+                    )
+                rows.append(["API Key", api_key_display])
 
             if profile.workspace:
                 rows.append(["Workspace", profile.workspace])
@@ -735,6 +851,29 @@ def register_config_commands(cli: Any) -> None:
     @click.option("--url", help="SystemLink API URL")
     @click.option("--api-key", help="SystemLink API key")
     @click.option("--web-url", help="SystemLink Web UI base URL")
+    @click.option(
+        "--auth",
+        "auth_mode",
+        type=click.Choice(["api-key", "pkce"]),
+        default="api-key",
+        show_default=True,
+        help="Authentication flow to use",
+    )
+    @click.option("--client-id", help="Public OAuth client ID for the PKCE prototype")
+    @click.option(
+        "--callback-port",
+        type=click.IntRange(0, 65535),
+        help="Loopback callback port; use 0 for an ephemeral port",
+    )
+    @click.option(
+        "--scope",
+        "scopes",
+        multiple=True,
+        help=(
+            "OAuth scope to request; may be repeated "
+            "(defaults to openid profile email offline_access)"
+        ),
+    )
     @click.option("--workspace", "-w", help="Default workspace for this profile")
     @click.option(
         "--set-current/--no-set-current",
@@ -758,6 +897,10 @@ def register_config_commands(cli: Any) -> None:
         url: Optional[str],
         api_key: Optional[str],
         web_url: Optional[str],
+        auth_mode: str,
+        client_id: Optional[str],
+        callback_port: Optional[int],
+        scopes: tuple[str, ...],
         workspace: Optional[str],
         set_current: bool,
         readonly: bool,
@@ -781,6 +924,10 @@ def register_config_commands(cli: Any) -> None:
             url=url,
             api_key=api_key,
             web_url=web_url,
+            auth_mode=auth_mode,
+            client_id=client_id,
+            callback_port=callback_port,
+            scopes=scopes,
             workspace=workspace,
             set_current=set_current,
             readonly=readonly,

{systemlink_cli-1.23.0 → systemlink_cli-1.25.0}/slcli/main.py

@@ -415,6 +415,29 @@ def ca_info() -> None:
 @click.option("--url", help="SystemLink API URL")
 @click.option("--api-key", help="SystemLink API key")
 @click.option("--web-url", help="SystemLink Web UI base URL")
+@click.option(
+    "--auth",
+    "auth_mode",
+    type=click.Choice(["api-key", "pkce"]),
+    default="api-key",
+    show_default=True,
+    help="Authentication flow to use",
+)
+@click.option("--client-id", help="Public OAuth client ID for the PKCE prototype")
+@click.option(
+    "--callback-port",
+    type=click.IntRange(0, 65535),
+    help="Loopback callback port; use 0 for an ephemeral port",
+)
+@click.option(
+    "--scope",
+    "scopes",
+    multiple=True,
+    help=(
+        "OAuth scope to request; may be repeated "
+        "(defaults to openid profile email offline_access)"
+    ),
+)
 @click.option("--workspace", "-w", help="Default workspace for this profile")
 @click.option(
     "--set-current/--no-set-current",
@@ -438,6 +461,10 @@ def login(
     url: Optional[str],
     api_key: Optional[str],
     web_url: Optional[str],
+    auth_mode: str,
+    client_id: Optional[str],
+    callback_port: Optional[int],
+    scopes: tuple[str, ...],
     workspace: Optional[str],
     set_current: bool,
     readonly: bool,
@@ -464,6 +491,10 @@ def login(
         url=url,
         api_key=api_key,
         web_url=web_url,
+        auth_mode=auth_mode,
+        client_id=client_id,
+        callback_port=callback_port,
+        scopes=scopes,
         workspace=workspace,
         set_current=set_current,
         readonly=readonly,
@@ -486,6 +517,7 @@ def logout(profile: Optional[str], remove_all: bool, force: bool) -> None:
     from .profiles import ProfileConfig
 
     cfg = ProfileConfig.load()
+    removed_profiles: list[str] = []
 
     if remove_all:
         if not force:
@@ -497,6 +529,7 @@ def logout(profile: Optional[str], remove_all: bool, force: bool) -> None:
                 return
 
         # Clear all profiles
+        removed_profiles = list(cfg.profiles)
         cfg.profiles.clear()
         cfg.current_profile = None
         cfg.save()
@@ -517,6 +550,7 @@ def logout(profile: Optional[str], remove_all: bool, force: bool) -> None:
                 return
 
         cfg.delete_profile(profile)
+        removed_profiles = [profile]
         cfg.save()
         click.echo(f"✓ Profile '{profile}' removed.")
 
@@ -536,12 +570,20 @@ def logout(profile: Optional[str], remove_all: bool, force: bool) -> None:
                 return
 
         cfg.delete_profile(current)
+        removed_profiles = [current]
         cfg.save()
         click.echo(f"✓ Profile '{current}' removed.")
         if cfg.current_profile:
             click.echo(f"  Current profile is now: {cfg.current_profile}")
 
     # Also clean up legacy keyring entries
+    try:
+        from .pkce import delete_pkce_credentials
+
+        for removed_profile in removed_profiles:
+            delete_pkce_credentials(removed_profile)
+    except Exception:
+        pass
     try:
         keyring.delete_password("systemlink-cli", "SYSTEMLINK_API_KEY")
     except Exception:
@@ -606,7 +648,10 @@ def info(format: str, skip_health: bool, debug: bool) -> None:
     elif platform_info.get("server_reachable") is False:
         status = "✗ Server unreachable"
     elif platform_info.get("auth_valid") is False:
-        status = "✗ API key unauthorized"
+        credential_name = (
+            "Bearer token" if active_profile and active_profile.auth_mode == "pkce" else "API key"
+        )
+        status = f"✗ {credential_name} unauthorized"
     else:
         status = "✓ Connected"
 

{systemlink_cli-1.23.0 → systemlink_cli-1.25.0}/slcli/mcp_click.py

@@ -14,6 +14,8 @@ import click
 
 from .utils import ExitCodes
 
+DEFAULT_STREAMABLE_HTTP_PORT = 8765
+
 
 def _slcli_exe() -> str:
     """Return the absolute path to the slcli executable, or 'slcli' as a fallback."""
@@ -26,7 +28,7 @@ def _vscode_server_entry(slcli_exe: str) -> Dict[str, Any]:
     return {
         "type": "stdio",
         "command": slcli_exe,
-        "args": ["mcp", "serve"],
+        "args": ["mcp", "serve", "--transport", "stdio"],
     }
 
 
@@ -34,7 +36,7 @@ def _claude_server_entry(slcli_exe: str) -> Dict[str, Any]:
     """Return the Claude Desktop / Cursor MCP server JSON object for slcli."""
     return {
         "command": slcli_exe,
-        "args": ["mcp", "serve"],
+        "args": ["mcp", "serve", "--transport", "stdio"],
     }
 
 
@@ -150,7 +152,7 @@ def register_mcp_commands(cli: Any) -> None:
         "--transport",
         "-T",
         type=click.Choice(["stdio", "streamable-http"]),
-        default="stdio",
+        default="streamable-http",
         show_default=True,
         help=(
             "Transport layer: 'stdio' for AI client integration, "
@@ -160,7 +162,7 @@ def register_mcp_commands(cli: Any) -> None:
     @click.option(
         "--port",
         "-p",
-        default=8000,
+        default=DEFAULT_STREAMABLE_HTTP_PORT,
         show_default=True,
         help="Port to bind to (streamable HTTP transport only).",
     )
@@ -173,36 +175,35 @@ def register_mcp_commands(cli: Any) -> None:
     def serve(transport: str, port: int, host: str) -> None:
         """Start the MCP server.
 
-        Defaults to stdio transport for direct AI client integration (VS Code
-        Copilot, Claude Desktop, Cursor).  Switch to streamable HTTP transport to serve
-        over HTTP — useful for the MCP Inspector, browser-based tooling, or
-        any client that prefers a persistent HTTP connection.
+        Defaults to streamable HTTP on localhost — useful for the MCP Inspector,
+        browser-based tooling, or any client that prefers a persistent HTTP connection.
+        Use stdio explicitly for AI clients that launch the server as a subprocess.
 
         \b
-        Stdio (default — configure once with 'slcli mcp install'):
+        Streamable HTTP (default on http://127.0.0.1:8765/mcp):
             slcli mcp serve
+            slcli mcp serve --transport streamable-http --host 0.0.0.0 --port 9000
 
         \b
-        Streamable HTTP (HTTP server on http://127.0.0.1:8000/mcp):
-            slcli mcp serve --transport streamable-http
-            slcli mcp serve --transport streamable-http --host 0.0.0.0 --port 9000
+        Stdio (for direct AI client integration):
+            slcli mcp serve --transport stdio
 
         \b
         Test with the MCP Inspector (Streamable HTTP):
-            slcli mcp serve --transport streamable-http
+            slcli mcp serve
             npx @modelcontextprotocol/inspector
-            # connect to http://127.0.0.1:8000/mcp (transport: Streamable HTTP)
+            # connect to http://127.0.0.1:8765/mcp (transport: Streamable HTTP)
         """
         try:
             from .mcp_server import main as run_mcp_server
-            from .mcp_server import server as mcp_server
+            from .mcp_server import run_streamable_http
         except ImportError:
             click.echo(
                 "✗ The 'mcp' package is not installed.\n"
-                "  Install it with: pip install 'mcp>=1.0'\n"
-                "  Or in a Poetry project: poetry add mcp\n"
+                "  Install it with: pip install 'mcp>=2,<3'\n"
+                "  Or in a Poetry project: poetry add 'mcp>=2,<3'\n"
                 "  If slcli was installed with pipx:\n"
-                "  pipx runpip systemlink-cli install 'mcp>=1.0'\n",
+                "  pipx runpip systemlink-cli install 'mcp>=2,<3'\n",
                 err=True,
             )
             sys.exit(ExitCodes.GENERAL_ERROR)
@@ -210,9 +211,6 @@ def register_mcp_commands(cli: Any) -> None:
         if transport == "stdio":
             run_mcp_server()
         else:
-            mcp_server.settings.host = host
-            mcp_server.settings.port = port
-
             click.echo(
                 "✓ slcli MCP server starting in streamable HTTP mode on "
                 f"http://{host}:{port}/mcp"
@@ -224,7 +222,7 @@ def register_mcp_commands(cli: Any) -> None:
             click.echo("  Press Ctrl+C to stop.\n")
 
             try:
-                mcp_server.run(transport="streamable-http")
+                run_streamable_http(host=host, port=port)
             except KeyboardInterrupt:
                 click.echo("\nslcli MCP server stopped")
                 sys.exit(0)