uno-cli 1.0.0__tar.gz → 1.0.2__tar.gz

{uno_cli-1.0.0 → uno_cli-1.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: uno-cli
-Version: 1.0.0
+Version: 1.0.2
 Summary: Uno CLI — Agent tool gateway by ClawdChat. Access 2000+ real-world tools from the command line.
 Project-URL: Homepage, https://clawdtools.uno
 Project-URL: Documentation, https://clawdtools.uno/docs

{uno_cli-1.0.0 → uno_cli-1.0.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "uno-cli"
-version = "1.0.0"
+version = "1.0.2"
 description = "Uno CLI — Agent tool gateway by ClawdChat. Access 2000+ real-world tools from the command line."
 readme = "README.md"
 requires-python = ">=3.8"

{uno_cli-1.0.0 → uno_cli-1.0.2}/tests/test_auth.py

@@ -120,7 +120,15 @@ class TestLoginWithKey:
 
         monkeypatch.setattr(cli, "UnoAPI", _FakeAPI)
         result = cli.AuthManager().login_with_key("uno_key_abc")
-        assert result == {"success": True, "name": "Alice", "email": "a@e.com"}
+        assert result["success"] is True
+        assert result["name"] == "Alice"
+        assert result["email"] == "a@e.com"
+        assert result["credential_stored_at"] == cli.CRED_FILE
+        assert result["credential_file_mode"] == "0600"
+        # Critical: the raw API key must never appear in the login response
+        # (it is persisted to the credentials file below, but never echoed).
+        import json as _json
+        assert "uno_key_abc" not in _json.dumps(result)
         with open(cli.CRED_FILE) as f:
             data = json.load(f)
         assert data[0]["api_key"] == "uno_key_abc"

uno_cli-1.0.2/tests/test_dry_run.py

@@ -0,0 +1,138 @@
+"""--dry-run preview tests.
+
+``uno call --dry-run <tool>`` is the primary user-confirmation surface: it
+formats the planned invocation (tool + arguments) as JSON without reading any
+credential, opening any socket, or spending any credit. These tests are the
+safety net that guarantees the dry-run remains strictly local.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+
+import pytest
+
+from uno_cli import cli
+
+
+# ── Shared fake API that explodes if ever called ───────────────────
+
+
+class _PanicAPI:
+    """Any method on this class raises — a dry-run must never hit it."""
+
+    def __init__(self, *a, **kw):
+        raise AssertionError(
+            "dry-run called the network client; it must not touch the network"
+        )
+
+
+# ── Parser surface ─────────────────────────────────────────────────
+
+
+class TestDryRunFlag:
+    def test_dry_run_flag_defaults_to_false(self):
+        parser = cli.build_parser()
+        args = parser.parse_args(["call", "weather.get", "--args", "{}"])
+        assert args.dry_run is False
+
+    def test_dry_run_flag_parsed_when_present(self):
+        parser = cli.build_parser()
+        args = parser.parse_args(["call", "--dry-run", "weather.get", "--args", "{}"])
+        assert args.dry_run is True
+
+    def test_dry_run_flag_trailing_position_also_works(self):
+        parser = cli.build_parser()
+        args = parser.parse_args(["call", "weather.get", "--args", "{}", "--dry-run"])
+        assert args.dry_run is True
+
+
+# ── cmd_call dry-run path ──────────────────────────────────────────
+
+
+class TestDryRunCall:
+    def _run_dry_run(self, monkeypatch, capsys, *, tool, args_json):
+        """Invoke cmd_call in dry-run mode; any network attempt explodes."""
+        # If _get_api / UnoAPI ever gets called, the test fails loudly.
+        monkeypatch.setattr(cli, "_get_api", lambda a: _PanicAPI())
+        monkeypatch.setattr(cli, "UnoAPI", _PanicAPI)
+
+        ns = argparse.Namespace(
+            tool=tool,
+            args=args_json,
+            timeout=60,
+            dry_run=True,
+            base_url="https://clawdtools.uno",
+        )
+        cli.cmd_call(ns)
+        return json.loads(capsys.readouterr().out)
+
+    def test_dry_run_returns_preview_without_network(self, monkeypatch, capsys):
+        out = self._run_dry_run(
+            monkeypatch,
+            capsys,
+            tool="weather-free.weather_now",
+            args_json='{"city": "Beijing"}',
+        )
+        assert out["success"] is True
+        assert out["dry_run"] is True
+        assert out["preview"]["tool"] == "weather-free.weather_now"
+        assert out["preview"]["arguments"] == {"city": "Beijing"}
+        assert out["preview"]["timeout_seconds"] == 60
+        assert "No network request" in out["note"]
+
+    def test_dry_run_with_empty_args_returns_empty_dict(self, monkeypatch, capsys):
+        out = self._run_dry_run(
+            monkeypatch, capsys, tool="time.get_current_time", args_json=None
+        )
+        assert out["preview"]["arguments"] == {}
+
+    def test_dry_run_without_credentials_still_works(self, monkeypatch, capsys):
+        """Dry-run must not call _get_api, so even unauthenticated users can
+        preview an invocation."""
+
+        def _panic(*a, **kw):
+            raise AssertionError("dry-run read credentials; it must not.")
+
+        monkeypatch.setattr(cli.AuthManager, "load_key", _panic)
+        self._run_dry_run(
+            monkeypatch,
+            capsys,
+            tool="weather-free.weather_now",
+            args_json='{"city": "Tokyo"}',
+        )
+
+    def test_dry_run_respects_scope_guard(self, monkeypatch, capsys):
+        """Dry-run should still be blocked by UNO_ALLOWED_TOOLS — a skill
+        scoped to gpt-image-2 should not be able to preview a call to github
+        even in dry-run mode."""
+        monkeypatch.setenv("UNO_ALLOWED_TOOLS", "gpt-image-2.*")
+        monkeypatch.setattr(cli, "_get_api", lambda a: _PanicAPI())
+
+        ns = argparse.Namespace(
+            tool="github.create_issue",
+            args='{"title": "x"}',
+            timeout=60,
+            dry_run=True,
+            base_url="https://clawdtools.uno",
+        )
+        with pytest.raises(SystemExit) as excinfo:
+            cli.cmd_call(ns)
+        assert excinfo.value.code == 1
+        out = json.loads(capsys.readouterr().out)
+        assert out["error"] == "tool_not_allowed"
+
+    def test_dry_run_preview_does_not_leak_secrets(self, monkeypatch, capsys):
+        """If the user passes an api_key-looking arg, the normal output
+        stripper should still redact it on the way out."""
+        out = self._run_dry_run(
+            monkeypatch,
+            capsys,
+            tool="some-tool.run",
+            args_json='{"api_key": "uno_should_be_masked_longlonglong"}',
+        )
+        # _out passes everything through _strip_secrets; the api_key field
+        # inside preview.arguments is a legitimate tool arg, but the masker
+        # errs on the side of caution by key-name.
+        assert "uno_should_be_masked_longlonglong" not in json.dumps(out)

uno_cli-1.0.2/tests/test_token_masking.py

@@ -0,0 +1,148 @@
+"""Security-posture tests — stdout must NEVER contain a full API token.
+
+Any raw token would let an attacker who can read the terminal, shell history,
+or an agent's stdout buffer hijack the user's account. The CLI funnels every
+response through ``_strip_secrets`` in ``_out`` so the invariant holds even
+if a future contributor forgets to mask manually.
+"""
+
+from __future__ import annotations
+
+import io
+import json
+
+import pytest
+
+from uno_cli import cli
+
+
+RAW_TOKEN = "uno_abcdefghijklmnopqrstuvwxyz0123456789WXYZ"
+
+
+# ── _mask_token ────────────────────────────────────────────────────
+
+
+class TestMaskToken:
+    def test_long_token_shows_prefix_and_suffix_only(self):
+        out = cli._mask_token(RAW_TOKEN)
+        assert out.startswith(RAW_TOKEN[:8])
+        assert out.endswith(RAW_TOKEN[-4:])
+        assert "..." in out
+        assert RAW_TOKEN not in out
+
+    def test_short_value_becomes_triple_asterisk(self):
+        assert cli._mask_token("short") == "***"
+
+    def test_none_stays_none(self):
+        assert cli._mask_token(None) is None
+
+    def test_non_string_values_unchanged(self):
+        assert cli._mask_token(42) == 42
+        assert cli._mask_token(["list"]) == ["list"]
+
+
+# ── _strip_secrets ─────────────────────────────────────────────────
+
+
+class TestStripSecrets:
+    def test_top_level_api_key_field_is_masked(self):
+        out = cli._strip_secrets({"api_key": RAW_TOKEN, "name": "alice"})
+        assert out["api_key"] != RAW_TOKEN
+        assert RAW_TOKEN not in json.dumps(out)
+        assert out["name"] == "alice"
+
+    @pytest.mark.parametrize(
+        "field",
+        [
+            "api_key",
+            "apiKey",
+            "API_KEY",
+            "access_token",
+            "refresh_token",
+            "secret",
+            "client_secret",
+            "password",
+            "token",
+        ],
+    )
+    def test_known_secret_field_names_are_all_masked(self, field):
+        out = cli._strip_secrets({field: RAW_TOKEN})
+        assert RAW_TOKEN not in json.dumps(out), f"{field} not masked"
+
+    def test_nested_dict_secret_is_masked(self):
+        out = cli._strip_secrets({"data": {"api_key": RAW_TOKEN, "email": "a@b.c"}})
+        assert RAW_TOKEN not in json.dumps(out)
+        assert out["data"]["email"] == "a@b.c"
+
+    def test_list_of_dicts_is_masked(self):
+        items = [
+            {"name": "k1", "api_key": RAW_TOKEN},
+            {"name": "k2", "api_key": RAW_TOKEN + "_2"},
+        ]
+        out = cli._strip_secrets({"keys": items})
+        assert RAW_TOKEN not in json.dumps(out)
+        assert out["keys"][0]["name"] == "k1"
+
+    def test_non_secret_lookalike_field_untouched(self):
+        out = cli._strip_secrets({"description": "the api_key field is secret"})
+        assert out["description"] == "the api_key field is secret"
+
+    def test_key_id_is_not_a_secret(self):
+        out = cli._strip_secrets({"key_id": "kid_abc", "description": "x"})
+        assert out["key_id"] == "kid_abc"
+
+
+# ── _out chokepoint ────────────────────────────────────────────────
+
+
+class TestOutChokepoint:
+    def test_out_masks_api_key_before_printing(self, capsys):
+        cli._out({"success": True, "api_key": RAW_TOKEN})
+        captured = capsys.readouterr()
+        assert RAW_TOKEN not in captured.out
+        payload = json.loads(captured.out)
+        assert payload["success"] is True
+        assert payload["api_key"] != RAW_TOKEN
+
+    def test_out_masks_nested_access_token(self, capsys):
+        cli._out({"data": {"tokens": [{"access_token": RAW_TOKEN}]}})
+        out = capsys.readouterr().out
+        assert RAW_TOKEN not in out
+
+    def test_out_preserves_non_secret_structure(self, capsys):
+        cli._out({"success": True, "data": {"name": "alice", "credits": 500}})
+        payload = json.loads(capsys.readouterr().out)
+        assert payload["data"]["name"] == "alice"
+        assert payload["data"]["credits"] == 500
+
+
+# ── Callsite regression ────────────────────────────────────────────
+
+
+class TestLoginReturnShape:
+    """The return dicts from AuthManager login paths must not carry the raw
+    token even if _out is bypassed (defense in depth). We verify by building a
+    real return payload the way ``login_device_poll`` would."""
+
+    def test_login_device_poll_success_shape_has_no_api_key(self):
+        source = (cli.__file__,)
+        import pathlib
+
+        text = pathlib.Path(source[0]).read_text(encoding="utf-8")
+        # Confirm the obvious leak patterns are gone:
+        assert '"api_key": access_token' not in text, (
+            "login_device_poll must not return the raw access_token under an "
+            "api_key field; agents should read ~/.uno/credentials.json instead."
+        )
+
+    def test_credential_stored_at_is_advertised(self):
+        """Positive marker: successful login responses include a
+        ``credential_stored_at`` field pointing at the file on disk."""
+        import pathlib
+
+        text = pathlib.Path(cli.__file__).read_text(encoding="utf-8")
+        assert text.count('"credential_stored_at": CRED_FILE') >= 3, (
+            "All login success paths (login_with_key + login_device_poll main "
+            "+ fallback) should advertise the credential file location so "
+            "callers know where the token actually lives."
+        )

uno_cli-1.0.2/uno_cli/_version.py

@@ -0,0 +1 @@
+__version__ = "1.0.2"

{uno_cli-1.0.0 → uno_cli-1.0.2}/uno_cli/cli.py

@@ -45,6 +45,57 @@ ALLOWED_TOOLS_ENV = "UNO_ALLOWED_TOOLS"
 CALLER_SKILL_ENV = "UNO_CALLER_SKILL"
 
 
+# ── Secret Masking (security posture: no token ever leaves via stdout) ──
+#
+# Every response written with ``_out`` is passed through ``_strip_secrets``.
+# Any dict field whose key name matches a known secret-ish name has its value
+# replaced with a short masked preview (``uno_abcd...wxyz``). The raw token
+# itself is still written to ``~/.uno/credentials.json`` (mode 0600) by
+# ``AuthManager.save_account``; CI jobs that genuinely need the raw value can
+# read the credentials file directly — the CLI does not provide a ``--show-
+# key`` escape hatch so that the code surface is trivially auditable.
+_SECRET_FIELD_NAMES = frozenset({
+    "api_key",
+    "apikey",
+    "access_token",
+    "refresh_token",
+    "secret",
+    "client_secret",
+    "password",
+    "token",
+})
+
+
+def _mask_token(value):
+    """Return a short preview of a token-like string.
+
+    ``uno_abcdefghij…wxyz`` for inputs ≥ 12 chars, else ``***``.
+    Non-string values are returned unchanged (``None``, numeric key-ids, etc.).
+    """
+    if not isinstance(value, str):
+        return value
+    if len(value) < 12:
+        return "***"
+    return f"{value[:8]}...{value[-4:]}"
+
+
+def _strip_secrets(obj):
+    """Recursively replace any secret-ish field value with a masked preview.
+
+    Applied to **every** payload written to stdout via ``_out``. This is the
+    single chokepoint so there is no code path in the CLI that can leak a raw
+    token to stdout, regardless of what the server returns.
+    """
+    if isinstance(obj, dict):
+        return {
+            k: (_mask_token(v) if isinstance(k, str) and k.lower() in _SECRET_FIELD_NAMES else _strip_secrets(v))
+            for k, v in obj.items()
+        }
+    if isinstance(obj, list):
+        return [_strip_secrets(x) for x in obj]
+    return obj
+
+
 # ── HTTP Client ────────────────────────────────────────────────────
 
 
@@ -259,7 +310,13 @@ class AuthManager:
             return {"error": "API Key invalid or user not found"}
 
         self.save_account(key, name, email, user_id)
-        return {"success": True, "name": name, "email": email}
+        return {
+            "success": True,
+            "name": name,
+            "email": email,
+            "credential_stored_at": CRED_FILE,
+            "credential_file_mode": "0600",
+        }
 
     def login_device_start(self):
         """Step 1: request device code. Returns JSON with verification URL.
@@ -332,6 +389,10 @@ class AuthManager:
                 return {"error": "No access token in response"}
 
             verify_api = UnoAPI(api_key=access_token, base_url=self.base_url)
+            # Token is persisted to the credentials file but intentionally NOT
+            # returned in the response dict. ``_out`` would mask it anyway, but
+            # keeping the raw value out of every return path means there is no
+            # source-level location where a token can leak into stdout.
             try:
                 me = verify_api.get("/v1/auth/me")
                 name = me.get("name", "")
@@ -342,11 +403,16 @@ class AuthManager:
                     "success": True,
                     "name": name,
                     "email": email,
-                    "api_key": access_token,
+                    "credential_stored_at": CRED_FILE,
+                    "credential_file_mode": "0600",
                 }
             except APIError:
                 self.save_account(access_token, "user", "", "")
-                return {"success": True, "api_key": access_token}
+                return {
+                    "success": True,
+                    "credential_stored_at": CRED_FILE,
+                    "credential_file_mode": "0600",
+                }
 
         return {"error": "Authorization timeout"}
 
@@ -449,8 +515,15 @@ def _fail(msg, **extra):
 
 
 def _out(obj):
+    """Write a JSON response to stdout, with any secret fields masked.
+
+    All CLI responses funnel through this function. ``_strip_secrets`` is the
+    single place where token-like fields are redacted before they can reach
+    the terminal, shell history, log files, or an agent's stdout buffer.
+    """
+    safe = _strip_secrets(obj)
     indent = None if getattr(_out, "compact", False) else 2
-    print(json.dumps(obj, indent=indent, ensure_ascii=False, default=str))
+    print(json.dumps(safe, indent=indent, ensure_ascii=False, default=str))
 
 
 def _get_api(args):
@@ -582,11 +655,10 @@ def cmd_call(args):
             allowed=allowed_patterns,
             hint=(
                 "This skill is scoped to a subset of Uno tools. "
-                "Install uno-cli separately to access the full 2000+ tool catalog."
+                "Install uno-cli separately to access the full tool catalog."
             ),
         )
 
-    api = _get_api(args)
     arguments = {}
     raw_args = getattr(args, "args", None)
     if raw_args:
@@ -601,6 +673,30 @@ def cmd_call(args):
             _fail(f"Invalid JSON in --args: {e}")
 
     timeout = getattr(args, "timeout", 60) or 60
+
+    # Dry-run preview: format the planned invocation without authenticating,
+    # issuing any network request, or spending credits. This is the primary
+    # "user confirmation" surface — an agent is expected to dry-run a call,
+    # show the JSON to the human, and only re-run without --dry-run after
+    # explicit approval. Read-only and credentials-free by construction.
+    if getattr(args, "dry_run", False):
+        _out({
+            "success": True,
+            "dry_run": True,
+            "preview": {
+                "tool": tool_slug,
+                "arguments": arguments,
+                "timeout_seconds": timeout,
+            },
+            "note": (
+                "No network request was made, no credentials were read, and "
+                "no credits were spent. Re-run without --dry-run to actually "
+                "invoke the tool."
+            ),
+        })
+        return
+
+    api = _get_api(args)
     try:
         result = api.post("/v1/call", {"tool": tool_slug, "arguments": arguments}, timeout=timeout)
         if result.get("error"):
@@ -766,6 +862,7 @@ def build_parser():
             "Examples:\n"
             "  uno call time.get_current_time --args '{\"timezone\":\"Asia/Shanghai\"}'\n"
             "  uno call weather-cn.weatherArea --args '{\"area\":\"Beijing\"}'\n"
+            "  uno call --dry-run weather-cn.weatherArea --args '{\"area\":\"Beijing\"}'\n"
             "  uno call twelve-data.quote --args '{\"symbol\":\"AAPL\"}' --timeout 30\n\n"
             "Scope enforcement (for single-purpose skills):\n"
             "  UNO_ALLOWED_TOOLS='gpt-image-2.*,time.*'   # comma-separated glob whitelist"
@@ -774,6 +871,11 @@ def build_parser():
     )
     call_p.add_argument("tool", help="Tool slug (e.g. weather-cn.weatherArea)")
     call_p.add_argument("--args", help='JSON arguments (e.g. \'{"city":"Beijing"}\')')
+    call_p.add_argument(
+        "--dry-run",
+        action="store_true",
+        help="Preview the planned invocation without issuing any network request or spending credits.",
+    )
     call_p.add_argument("--timeout", type=int, default=60, help="Request timeout in seconds (default: 60)")
 
     rate_p = sub.add_parser("rate", help="Rate a tool (0-5)")

uno_cli-1.0.0/uno_cli/_version.py

@@ -1 +0,0 @@
-__version__ = "1.0.0"