systemlink-cli 1.30.3__tar.gz → 2.2.2__tar.gz

{systemlink_cli-1.30.3 → systemlink_cli-2.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: systemlink-cli
-Version: 1.30.3
+Version: 2.2.2
 Summary: SystemLink Integrator CLI - cross-platform CLI for SystemLink workflows and templates.
 License-File: LICENSE
 Author: Fred Visser
@@ -10,11 +10,17 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
+Provides-Extra: managed-client
 Provides-Extra: mcp
+Requires-Dist: anyio (>=4.14.2,<5) ; extra == "mcp"
 Requires-Dist: click (>=7.1.2)
 Requires-Dist: cryptography (>=49.0.0)
+Requires-Dist: filelock (>=3.20,<4)
+Requires-Dist: httpcore2 (>=2.10.0,<3) ; extra == "mcp"
+Requires-Dist: httpx2 (>=2.12.0,<3) ; extra == "mcp"
 Requires-Dist: keyring (>=25.6.0,<26.0.0)
 Requires-Dist: mcp (>=2,<3) ; extra == "mcp"
+Requires-Dist: msgpack (>=1.1,<2) ; extra == "managed-client"
 Requires-Dist: packaging (>=21.0)
 Requires-Dist: pygments (>=2.20.0)
 Requires-Dist: pyyaml (>=6.0.3,<7.0.0)

{systemlink_cli-1.30.3 → systemlink_cli-2.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "systemlink-cli"
-version = "1.30.3"
+version = "2.2.2"
 description = "SystemLink Integrator CLI - cross-platform CLI for SystemLink workflows and templates."
 authors = ["Fred Visser <fred.visser@emerson.com>"]
 packages = [{ include = "slcli" }]
@@ -26,6 +26,7 @@ lint = "scripts.lint:main"
 python = ">=3.11.1,<3.15"
 # cli
 click = ">=7.1.2"
+filelock = ">=3.20,<4"
 keyring = "^25.6.0"
 requests = "^2.32.4"
 tabulate = "^0.10.0"
@@ -38,10 +39,15 @@ rich = ">=15,<16"
 rich-click = ">=1.8,<2"
 cryptography = ">=49.0.0"
 pygments = ">=2.20.0"
+msgpack = { version = ">=1.1,<2", optional = true }
 mcp = { version = ">=2,<3", optional = true }
+anyio = { version = ">=4.14.2,<5", optional = true }
+httpx2 = { version = ">=2.12.0,<3", optional = true }
+httpcore2 = { version = ">=2.10.0,<3", optional = true }
 
 [tool.poetry.extras]
-mcp = ["mcp"]
+managed-client = ["msgpack"]
+mcp = ["mcp", "anyio", "httpx2", "httpcore2"]
 
 
 [tool.poetry.group.dev.dependencies]
@@ -69,13 +75,14 @@ pytest-cov = ">=3.0"
 pytest-timeout = ">=2.1.0"
 pyinstaller = "^6.14.2"
 jsonschema = ">=4.0"
+msgpack = ">=1.1,<2"
 
 # Typed stubs for third-party libraries used by mypy in CI
 types-requests = "*"
 types-tabulate = "*"
 
 # Changelog and release management
-towncrier = "^25.8.0"
+towncrier = "^26.0.0"
 pytest-xdist = "^3.8.0"
 
 # Excel file generation

{systemlink_cli-1.30.3 → systemlink_cli-2.2.2}/slcli/_version.py

@@ -1,4 +1,4 @@
 """Version information for slcli."""
 
 # This file is auto-generated. Do not edit manually.
-__version__ = "1.30.3"
+__version__ = "2.2.2"

{systemlink_cli-1.30.3 → systemlink_cli-2.2.2}/slcli/config_click.py

@@ -12,13 +12,18 @@ from urllib.parse import urlparse
 import click
 import questionary
 
+from .credentials import (
+    CredentialStoreError,
+    describe_credential_store,
+    get_credential,
+)
 from .platform import (
     PLATFORM_SLE,
     PLATFORM_SLS,
     check_service_status,
     check_web_server_auth,
 )
-from .profiles import ProfileConfig, Profile, check_config_file_permissions
+from .profiles import Profile, ProfileConfig, check_config_file_permissions
 from .rich_output import render_table
 from .ssl_trust import (
     get_managed_trust_records,
@@ -33,9 +38,9 @@ from .utils import ExitCodes, get_base_url, get_base_url_resolution
 API_KEY_LENGTH = 42
 API_KEY_PATTERN = re.compile(rf"^[A-Za-z0-9_-]{{{API_KEY_LENGTH}}}$")
 ENV_OVERRIDE_FIELDS = (
-    ("API URL", ("SLCLI_API_URL", "SYSTEMLINK_API_URL")),
-    ("API Key", ("SLCLI_API_KEY", "SYSTEMLINK_API_KEY")),
-    ("Web URL", ("SLCLI_WEB_URL", "SYSTEMLINK_WEB_URL")),
+    ("API URL", ("SLCLI_API_URL",)),
+    ("API Key", ("SLCLI_API_KEY",)),
+    ("Web URL", ("SLCLI_WEB_URL",)),
 )
 
 
@@ -224,6 +229,7 @@ def _add_profile_impl(
     client_id: Optional[str] = None,
     scopes: tuple[str, ...] = (),
     callback_port: Optional[int] = None,
+    credential_store: str = "os",
 ) -> None:
     """Shared implementation for add-profile and login commands.
 
@@ -243,6 +249,7 @@ def _add_profile_impl(
         client_id: Public OAuth client ID for the PKCE login
         scopes: OAuth scopes for the PKCE login
         callback_port: Optional loopback callback port; zero selects an ephemeral port
+        credential_store: Store for profile API keys and PKCE credentials
     """
     # Get profile name
     if not profile:
@@ -410,10 +417,11 @@ def _add_profile_impl(
         workspace = workspace_input if workspace_input else None
 
     # Create profile
+    cfg = ProfileConfig.load()
     new_profile = Profile(
         name=profile,
         server=url,
-        api_key=api_key,
+        api_key=api_key or "",
         web_url=web_url,
         platform=platform,
         workspace=workspace,
@@ -421,36 +429,25 @@ def _add_profile_impl(
         auth_mode=auth_mode,
         pkce_client_id=client_id if auth_mode == "pkce" else None,
         pkce_scopes=pkce_scopes if auth_mode == "pkce" else None,
+        credential_store=credential_store,
     )
-
-    # Load config and add profile
-    cfg = ProfileConfig.load()
-    previous_profile = cfg.get_profile(profile)
-    previous_current_profile = cfg.current_profile
-    cfg.add_profile(new_profile, set_current=set_current)
-    cfg.save()
-
     if auth_mode == "pkce" and pkce_result is not None:
-        from .pkce import save_pkce_credentials
+        new_profile.pkce_credentials = {
+            "access-token": pkce_result.access_token,
+            "refresh-token": pkce_result.refresh_token,
+            "access-expires-at": pkce_result.expires_at,
+        }
 
-        try:
-            save_pkce_credentials(
-                profile,
-                pkce_result.access_token,
-                pkce_result.refresh_token,
-                pkce_result.expires_at,
-            )
-        except Exception as exc:
-            if previous_profile is None:
-                cfg.profiles.pop(profile, None)
-            else:
-                cfg.profiles[profile] = previous_profile
-            cfg.current_profile = previous_current_profile
-            cfg.save()
-            _exit_with_validation_error(
-                f"Could not store PKCE credentials securely: {exc}.",
-                ExitCodes.GENERAL_ERROR,
-            )
+    from .profile_credentials import ProfileCredentialError, save_profile_credentials
+
+    try:
+        warnings = save_profile_credentials(cfg, new_profile, set_current=set_current)
+    except ProfileCredentialError as exc:
+        for warning in exc.warnings:
+            click.echo(f"⚠️  {warning}", err=True)
+        _exit_with_validation_error(str(exc), ExitCodes.GENERAL_ERROR)
+    for warning in warnings:
+        click.echo(f"⚠️  {warning}", err=True)
 
     click.echo(f"\n✓ Profile '{profile}' saved successfully.")
     click.echo(f"  Server: {url}")
@@ -464,6 +461,14 @@ def _add_profile_impl(
     click.echo(f"\nConfig file: {ProfileConfig.get_config_path()}")
 
 
+def _get_profile_secret(profile: Profile, credential: str) -> Optional[str]:
+    """Read a profile secret only for an explicit secret-display operation."""
+    try:
+        return get_credential(profile.credential_id, credential, profile.credential_store)
+    except CredentialStoreError as exc:
+        raise click.ClickException(str(exc)) from exc
+
+
 def register_config_commands(cli: Any) -> None:
     """Register the 'config' command group and its subcommands."""
 
@@ -582,16 +587,15 @@ def register_config_commands(cli: Any) -> None:
     @click.argument("name")
     def use_profile(name: str) -> None:
         """Switch to a different profile."""
-        cfg = ProfileConfig.load()
-
-        if name not in cfg.profiles:
-            click.echo(f"✗ Profile '{name}' not found.", err=True)
-            if cfg.profiles:
-                click.echo(f"Available profiles: {', '.join(cfg.profiles.keys())}", err=True)
-            sys.exit(ExitCodes.NOT_FOUND)
-
-        cfg.set_current_profile(name)
-        cfg.save()
+        with ProfileConfig().transaction() as cfg:
+            if name not in cfg.profiles:
+                click.echo(f"✗ Profile '{name}' not found.", err=True)
+                if cfg.profiles:
+                    click.echo(f"Available profiles: {', '.join(cfg.profiles.keys())}", err=True)
+                sys.exit(ExitCodes.NOT_FOUND)
+
+            cfg.set_current_profile(name)
+            cfg.save()
 
         profile = cfg.get_profile(name)
         click.echo(f"✓ Switched to profile '{name}'")
@@ -627,8 +631,37 @@ def register_config_commands(cli: Any) -> None:
                 data["profiles"] = {}
                 for name, profile in cfg.profiles.items():
                     profile_dict = profile.to_dict()
-                    if not show_secrets and "api-key" in profile_dict:
-                        # Show only last 4 characters
+                    if profile.auth_mode == "pkce":
+                        if show_secrets:
+                            try:
+                                pkce_credentials = json.loads(
+                                    _get_profile_secret(profile, "pkce") or "{}"
+                                )
+                            except json.JSONDecodeError:
+                                _exit_with_validation_error(
+                                    f"Stored PKCE credentials for profile '{name}' are invalid. "
+                                    f"Run 'slcli login --profile {name}' to authenticate again.",
+                                    ExitCodes.GENERAL_ERROR,
+                                )
+                            if not isinstance(pkce_credentials, dict):
+                                _exit_with_validation_error(
+                                    f"Stored PKCE credentials for profile '{name}' are invalid. "
+                                    f"Run 'slcli login --profile {name}' to authenticate again.",
+                                    ExitCodes.GENERAL_ERROR,
+                                )
+                            profile_dict["pkce-credentials"] = pkce_credentials
+                        else:
+                            profile_dict["pkce-credentials"] = (
+                                f"stored in {describe_credential_store(profile.credential_store)}"
+                            )
+                    elif profile.credential_store == "os" and not profile.api_key:
+                        if show_secrets:
+                            profile_dict["api-key"] = _get_profile_secret(profile, "api-key")
+                        else:
+                            profile_dict["api-key"] = (
+                                f"stored in {describe_credential_store(profile.credential_store)}"
+                            )
+                    elif not show_secrets and "api-key" in profile_dict:
                         key = profile_dict["api-key"]
                         profile_dict["api-key"] = "****" + key[-4:] if len(key) >= 4 else "****"
                     data["profiles"][name] = profile_dict
@@ -655,9 +688,23 @@ def register_config_commands(cli: Any) -> None:
                 rows.append(["Platform", profile.platform or "Unknown"])
 
             if profile.auth_mode == "pkce":
-                rows.append(["Authentication", "PKCE (bearer token in keyring)"])
-            else:
+                rows.append(
+                    [
+                        "Authentication",
+                        f"PKCE (bearer token in {describe_credential_store(profile.credential_store)})",
+                    ]
+                )
                 if show_secrets:
+                    rows.append(["PKCE Credentials", _get_profile_secret(profile, "pkce") or ""])
+            else:
+                if profile.credential_store == "os" and not profile.api_key:
+                    if show_secrets:
+                        api_key_display = _get_profile_secret(profile, "api-key") or ""
+                    else:
+                        api_key_display = (
+                            f"stored in {describe_credential_store(profile.credential_store)}"
+                        )
+                elif show_secrets:
                     api_key_display = profile.api_key
                 else:
                     api_key_display = (
@@ -812,18 +859,56 @@ def register_config_commands(cli: Any) -> None:
             )
         click.echo(f"✓ Removed trusted certificate for {origin}")
 
+    @config.command(name="cleanup")
+    def cleanup_pending_credentials() -> None:
+        """Retry pending credential cleanup without deleting profiles."""
+        from .utils import check_readonly_mode
+        from .credentials import CredentialStoreError
+        from .profile_credentials import retry_pending_profile_deletions
+
+        check_readonly_mode("clean up pending credentials")
+        cfg = ProfileConfig.load()
+        try:
+            completed = retry_pending_profile_deletions(cfg)
+        except (CredentialStoreError, RuntimeError) as exc:
+            _exit_with_validation_error(
+                f"Could not finish pending credential cleanup: {exc}. "
+                "Resolve the credential-store issue and retry 'slcli config cleanup'.",
+                ExitCodes.GENERAL_ERROR,
+            )
+        if not completed:
+            click.echo("No pending credential cleanup.")
+            return
+        click.echo(f"✓ Finished pending credential cleanup for: {', '.join(completed)}")
+
     @config.command(name="delete")
     @click.argument("name")
     @click.option("--force", "-f", is_flag=True, help="Skip confirmation prompt")
     def delete_profile(name: str, force: bool) -> None:
         """Delete a profile."""
         from .utils import check_readonly_mode
+        from .credentials import CredentialStoreError
+        from .profile_credentials import (
+            delete_profile_with_credentials,
+            retry_pending_profile_deletions,
+        )
 
         check_readonly_mode("delete a profile")
 
         cfg = ProfileConfig.load()
 
+        try:
+            completed = retry_pending_profile_deletions(cfg, name)
+        except (CredentialStoreError, RuntimeError) as exc:
+            _exit_with_validation_error(
+                f"Could not finish deleting profile '{name}': {exc}. Retry when the store is available.",
+                ExitCodes.GENERAL_ERROR,
+            )
+
         if name not in cfg.profiles:
+            if completed:
+                click.echo(f"✓ Profile '{name}' deleted.")
+                return
             click.echo(f"✗ Profile '{name}' not found.", err=True)
             sys.exit(ExitCodes.NOT_FOUND)
 
@@ -835,63 +920,64 @@ def register_config_commands(cli: Any) -> None:
                 click.echo("Aborted.")
                 sys.exit(ExitCodes.GENERAL_ERROR)
 
+        profile_to_delete = cfg.profiles[name]
         was_current = cfg.current_profile == name
-        cfg.delete_profile(name)
-        cfg.save()
+        try:
+            delete_profile_with_credentials(cfg, profile_to_delete)
+        except CredentialStoreError as exc:
+            _exit_with_validation_error(
+                f"Could not remove stored credentials: {exc}. Deletion is pending; "
+                f"retry 'slcli config delete {name} --force'.",
+                ExitCodes.GENERAL_ERROR,
+            )
+        except RuntimeError as exc:
+            _exit_with_validation_error(
+                f"Could not save profile removal for '{name}': {exc}. "
+                "Credentials were not removed or deletion is pending; retry the command.",
+                ExitCodes.GENERAL_ERROR,
+            )
 
         click.echo(f"✓ Profile '{name}' deleted.")
         if was_current and cfg.current_profile:
             click.echo(f"  Current profile is now: {cfg.current_profile}")
 
-    @config.command(name="migrate")
-    @click.option(
-        "--profile-name",
-        "-n",
-        default="default",
-        help="Name for the migrated profile",
-    )
-    @click.option(
-        "--delete-keyring",
-        is_flag=True,
-        help="Delete keyring entries after migration",
-    )
-    def migrate(profile_name: str, delete_keyring: bool) -> None:
-        """Migrate credentials from keyring to config file.
+    @config.command(name="secure")
+    @click.option("--profile", "profile_name", help="Profile to secure (defaults to current)")
+    @click.option("--all", "secure_all", is_flag=True, help="Secure every file-backed profile")
+    def secure_profiles(profile_name: Optional[str], secure_all: bool) -> None:
+        """Move plaintext API keys and PKCE credentials into the OS store."""
+        from .utils import check_readonly_mode
 
-        This command reads existing credentials from the system keyring
-        and creates a new profile in the config file.
-        """
-        from .profiles import migrate_from_keyring
+        check_readonly_mode("secure profile credentials")
+        if profile_name and secure_all:
+            _exit_with_validation_error("Choose either --profile or --all, not both.")
 
-        # Check if profile already exists
         cfg = ProfileConfig.load()
-        if profile_name in cfg.profiles:
-            if not questionary.confirm(
-                f"Profile '{profile_name}' already exists. Overwrite?",
-                default=False,
-            ).ask():
-                click.echo("Aborted.")
-                sys.exit(ExitCodes.GENERAL_ERROR)
-
-        # Use centralized migration function
-        profile = migrate_from_keyring(profile_name=profile_name, delete_keyring=delete_keyring)
-
-        if not profile:
-            click.echo("✗ No credentials found in keyring.", err=True)
-            click.echo("Run 'slcli login --profile <name>' to create a new profile.", err=True)
-            sys.exit(ExitCodes.NOT_FOUND)
+        if secure_all:
+            selected = list(cfg.profiles.values())
+        else:
+            selected_name = profile_name or cfg.current_profile
+            if not selected_name:
+                _exit_with_validation_error("No current profile is set.", ExitCodes.NOT_FOUND)
+            profile_to_secure = cfg.get_profile(selected_name)
+            if not profile_to_secure:
+                _exit_with_validation_error(
+                    f"Profile '{selected_name}' not found.", ExitCodes.NOT_FOUND
+                )
+            selected = [profile_to_secure]
 
-        click.echo(f"✓ Migrated credentials to profile '{profile_name}'")
-        click.echo(f"  Server: {profile.server}")
-        if profile.web_url:
-            click.echo(f"  Web URL: {profile.web_url}")
-        if profile.platform:
-            click.echo(f"  Platform: {profile.platform}")
+        from .profile_credentials import ProfileCredentialError, secure_profile_credentials
 
-        if delete_keyring:
-            click.echo("✓ Deleted keyring entries")
-        else:
-            click.echo("\nNote: Keyring entries still exist. Use --delete-keyring to remove them.")
+        try:
+            secured_names, warnings = secure_profile_credentials(cfg, selected)
+        except ProfileCredentialError as exc:
+            _exit_with_validation_error(str(exc))
+        if not secured_names:
+            click.echo("All selected profile credentials are already secured.")
+            return
+        for warning in warnings:
+            click.echo(f"⚠️  {warning}", err=True)
+        click.echo(f"✓ Secured credentials for: {', '.join(secured_names)}")
 
     @config.command(name="add")
     @click.option("--profile", "-p", help="Profile name (default: 'default')")
@@ -921,6 +1007,14 @@ def register_config_commands(cli: Any) -> None:
             "(defaults to openid profile email offline_access)"
         ),
     )
+    @click.option(
+        "--credential-store",
+        type=click.Choice(["os", "file"]),
+        default="os",
+        envvar="SLCLI_CREDENTIAL_STORE",
+        show_default=True,
+        help="Store credentials in the OS store or config file",
+    )
     @click.option("--workspace", "-w", help="Default workspace for this profile")
     @click.option(
         "--set-current/--no-set-current",
@@ -948,6 +1042,7 @@ def register_config_commands(cli: Any) -> None:
         client_id: Optional[str],
         callback_port: Optional[int],
         scopes: tuple[str, ...],
+        credential_store: str,
         workspace: Optional[str],
         set_current: bool,
         readonly: bool,
@@ -956,7 +1051,7 @@ def register_config_commands(cli: Any) -> None:
         """Add or update a SystemLink profile.
 
         Profiles allow you to configure multiple SystemLink environments and switch
-        between them. Credentials are stored in ~/.config/slcli/config.json.
+        between them. Credentials use the OS store by default.
 
         The readonly flag enables readonly mode, which disables all delete and edit
         commands in slcli. This is useful for AI agents or untrusted environments.
@@ -975,6 +1070,7 @@ def register_config_commands(cli: Any) -> None:
             client_id=client_id,
             callback_port=callback_port,
             scopes=scopes,
+            credential_store=credential_store,
             workspace=workspace,
             set_current=set_current,
             readonly=readonly,