Metadata-Version: 2.4
Name: limacharlie
Version: 5.5.0
Summary: Python SDK and CLI for the LimaCharlie endpoint detection and response platform
Author-email: Maxime Lamothe-Brassard <maxime@refractionpoint.com>
License-Expression: Apache-2.0
Project-URL: Homepage, https://limacharlie.io
Project-URL: Documentation, https://docs.limacharlie.io
Project-URL: Repository, https://github.com/refractionPOINT/python-limacharlie
Project-URL: Issues, https://github.com/refractionPOINT/python-limacharlie/issues
Project-URL: Changelog, https://github.com/refractionPOINT/python-limacharlie/blob/master/CHANGELOG.md
Project-URL: REST API Docs, https://docs.limacharlie.io/apidocs
Classifier: Development Status :: 5 - Production/Stable
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: System Administrators
Classifier: Topic :: Security
Classifier: Topic :: System :: Monitoring
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Operating System :: OS Independent
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: requests==2.32.3
Requires-Dist: passlib==1.7.4
Requires-Dist: pyyaml==6.0.2
Requires-Dist: tabulate==0.9.0
Requires-Dist: termcolor==2.5.0
Requires-Dist: pygments==2.19.1
Requires-Dist: rich==13.9.4
Requires-Dist: cryptography==46.0.3
Requires-Dist: click==8.1.8
Requires-Dist: jmespath==1.1.0
Requires-Dist: orjson<3.11,>=3.10.0; python_version < "3.10"
Requires-Dist: orjson>=3.10.0; python_version >= "3.10"
Requires-Dist: websockets>=13.0
Requires-Dist: toon_format<1.0,>=0.9.0b1
Provides-Extra: dev
Requires-Dist: pytest==8.3.4; extra == "dev"
Requires-Dist: pytest-rerunfailures==15.0; extra == "dev"
Requires-Dist: pytest-benchmark>=5.0.0; extra == "dev"
Requires-Dist: tomli>=1.0; python_version < "3.11" and extra == "dev"
Dynamic: license-file

# LimaCharlie Python SDK & CLI

![LimaCharlie.io](https://storage.googleapis.com/limacharlie-io/logo_fast_glitch.gif)

Python SDK and command-line interface for the [LimaCharlie](https://limacharlie.io) endpoint detection and response platform.

* **[Documentation](doc/README.md)** — CLI reference, SDK guide, authentication
* [Platform Docs](https://doc.limacharlie.io/) | [REST API](https://api.limacharlie.io) | [Issues](https://github.com/refractionPOINT/python-limacharlie)

## Installation

```bash
pip install limacharlie
```

```bash
docker run refractionpoint/limacharlie:latest --help
```

See [Getting Started](doc/getting-started.md) for Docker credential mounting and first steps.

## Quick Start

```bash
limacharlie auth login --oid YOUR_ORG_ID --api-key YOUR_API_KEY
limacharlie auth whoami
limacharlie org info
limacharlie sensor list
```

See [Authentication](doc/authentication.md) for OAuth, environments, credential resolution, JWT caching, and config directory migration.

## Documentation

| Guide | Topics |
|-------|--------|
| [Getting Started](doc/getting-started.md) | Installation, Docker, first steps |
| [Authentication](doc/authentication.md) | API keys, OAuth, environments, JWT caching, config migration |
| [CLI Overview](doc/cli/README.md) | Command pattern, output formats, filtering, discovery |
| [SDK Overview](doc/sdk/README.md) | Architecture, setup, class reference |

Full reference: [doc/README.md](doc/README.md)

## Shell Completion

The CLI supports tab-completion for all commands, subcommands, and options.

**Bash** - add to `~/.bashrc`:

```bash
eval "$(limacharlie completion bash)"
```

**Zsh** - add to `~/.zshrc`:

```bash
eval "$(limacharlie completion zsh)"
```

**Fish** - run once:

```bash
mkdir -p ~/.config/fish/completions
limacharlie completion fish > ~/.config/fish/completions/limacharlie.fish
```

Restart your shell (or `source` the rc file) for completions to take effect.

### Static completion files

If you prefer not to run `eval` on every shell start, you can write the completion script to a file once. This is slightly faster at shell startup but needs to be re-run after upgrading to pick up new commands and options.

**Bash:**

```bash
mkdir -p ~/.local/share/bash-completion/completions
limacharlie completion bash > ~/.local/share/bash-completion/completions/limacharlie
```

**Zsh:**

```bash
mkdir -p ~/.zfunc
limacharlie completion zsh > ~/.zfunc/_limacharlie
```

Ensure `~/.zfunc` is in your `fpath` by adding this to `~/.zshrc` (before `compinit`):

```bash
fpath=(~/.zfunc $fpath)
autoload -Uz compinit && compinit
```

## Development

### Setup

```bash
git clone https://github.com/refractionPOINT/python-limacharlie.git
cd python-limacharlie
python3 -m venv .venv
source .venv/bin/activate
pip install -e ".[dev]"
```

The editable install (`-e`) means changes to the source code take effect immediately without reinstalling.

### Running the CLI

After the editable install, the `limacharlie` command is available in your venv:

```bash
limacharlie --version
limacharlie --help
limacharlie sensor list --help
```

### Running Tests

Unit tests run without any credentials or network access:

```bash
# All unit tests
pytest tests/unit/ -v

# Single test file
pytest tests/unit/test_client.py -v

# Single test case
pytest tests/unit/test_client.py::TestClientInit::test_creates_with_explicit_creds -v
```

Integration tests require a real LimaCharlie organization:

```bash
pytest tests/integration/ --oid YOUR_ORG_ID --key YOUR_API_KEY -v
```

### Building

```bash
pip install build && python -m build
pip install dist/limacharlie-*-py3-none-any.whl && limacharlie version
```

## Releasing

Releases are published to [PyPI](https://pypi.org/project/limacharlie/) automatically via GitHub Actions when a version tag is pushed. The package version is derived from the git tag using `setuptools-scm` — there is no hardcoded version to bump.

```bash
git tag 5.1.0
git push origin 5.1.0
```

The workflow runs unit tests, builds the package, and publishes to PyPI using [Trusted Publishers](https://docs.pypi.org/trusted-publishers/) (OIDC) — no API tokens or secrets required. See [`.github/workflows/publish-to-pypi.yml`](.github/workflows/publish-to-pypi.yml) for details.
