Metadata-Version: 2.4
Name: secflow-cli
Version: 0.1.0
Summary: SecFlow operator CLI
License-Expression: MIT
Project-URL: Repository, https://github.com/yeon3724/secflow
Project-URL: Issues, https://github.com/yeon3724/secflow/issues
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: secflow-sdk==0.1.8
Requires-Dist: keyring<26,>=25
Dynamic: license-file

# SecFlow CLI

Use Intflow browser login or an existing Slack-issued Admin session. Both distributions provide the same `secflowctl` commands.

## Install and update

Choose one distribution per machine; both own the same `secflowctl` command and share profiles and the OS credential store.

```sh
pipx install secflow-cli
# Or in a Python environment:
python -m pip install secflow-cli

# Alternative: Node.js 22+; no separate Python installation required
npm install --global @intflow/secflow-cli
secflowctl --version
```

The Python distribution requires Python 3.10+. Installation automatically includes the Admin-capable `secflow-sdk==0.1.8` dependency.

The npm distribution includes Python and the CLI dependencies in OS-specific native packages. Initial targets: Windows x64, macOS Intel/Apple Silicon, and Linux x64 with glibc 2.35+ (Ubuntu 22.04+). Alpine/musl and Linux ARM are not npm targets yet; use the Python distribution there. Keep npm optional dependencies enabled. Installation has no postinstall script or runtime download. Native binaries are not platform-signed or notarized.

The bundled interpreter includes CA certificates for HTTPS. An explicit `SSL_CERT_FILE` or `SSL_CERT_DIR` takes precedence for organization-managed trust; TLS certificate verification stays enabled.

```sh
pipx upgrade secflow-cli
# Or use the same installer as the initial installation:
python -m pip install --upgrade secflow-cli
npm install --global @intflow/secflow-cli@latest
```

## Connect

```sh
secflowctl login
secflowctl auth status
secflowctl namespaces list --help
secflowctl namespaces list --all
secflowctl --help
```

`secflowctl` without arguments displays a quick start. `secflowctl login` opens Intflow login and creates the `production` profile for `https://secflow.intflow.dev` on first use. Existing profiles retain their selected server. For another server, first use `secflowctl profile add staging --base-url https://secflow.example.test`, then `secflowctl --profile staging login`. Global options precede the command. Every command supports `--help`, including examples. Account and role administration still requires server authorization; token commands currently list metadata only.

`auth login` remains compatible with Slack-issued Admin sessions and prompts without echo for an existing session. Sessions are stored in Windows Credential Manager, macOS Keychain, or Linux Secret Service. Linux persistent login needs an unlocked Secret Service (for example GNOME Keyring) and a D-Bus session. If secure storage is unavailable, login fails without a plaintext file fallback. Installing the CLI does not create an account or grant access.

When browser login is enabled on the server, run `secflowctl auth login --browser`. Sign in to Intflow, compare the code with your terminal, and approve the SecFlow login. Use `--browser --no-browser` to open the displayed URL manually. This requires an interactive terminal, an existing authorized SecFlow account, and OS credential storage. The CLI stores only the resulting SecFlow session. If login expires or the exchange fails, start a new login.

For automation use `SECFLOW_ADMIN_SESSION_TOKEN` supplied by your secret manager, or `--token-stdin` with `--non-interactive`. Never put tokens in command arguments, profiles, shell history, or tracked files. SDK tokens cannot authorize these Admin commands. `auth logout` revokes the current server session; `auth forget` only removes the local credential.

To uninstall, use `pipx uninstall secflow-cli`, `python -m pip uninstall secflow-cli`, or `npm uninstall --global @intflow/secflow-cli` as appropriate. Uninstalling does not revoke server sessions or erase profiles; log out and remove unwanted profiles first.
