Skip to content

feat: --hint flag — use kbagent as a Python SDK#153

Merged
padak merged 2 commits intomainfrom
feat/hint-mode
Apr 13, 2026
Merged

feat: --hint flag — use kbagent as a Python SDK#153
padak merged 2 commits intomainfrom
feat/hint-mode

Conversation

@padak
Copy link
Copy Markdown
Owner

@padak padak commented Apr 12, 2026

Summary

  • Adds --hint client|service global flag that generates equivalent Python code instead of executing commands
  • 47 commands covered across all command groups (config, storage, job, branch, workspace, sharing, component, encrypt, lineage, org, tool)
  • Two modes: --hint client (KeboolaClient with explicit URL+token) and --hint service (service layer with CLI config)
  • Commands without hints show clear "no hint available" message
  • Bypasses permission checks and auto-update in hint mode (no API calls made)
  • 26 new tests (renderer, registry, CLI integration, security)

What it looks like

$ kbagent --hint client config list --project myproj
#!/usr/bin/env python3
"""Equivalent of: kbagent config list --project myproj"""

import os
from keboola_agent_cli.client import KeboolaClient

client = KeboolaClient(
    base_url="https://connection.eu-central-1.keboola.com",
    token=os.environ["KBC_STORAGE_TOKEN"],
)
try:
    components = client.list_components()
    print(components)
finally:
    client.close()

New files

  • src/keboola_agent_cli/hints/ — models, registry, renderers, 11 definition files
  • tests/test_hints.py — 26 tests
  • docs/hint-mode.md — user documentation
  • plugins/.../references/programming-with-cli.md — SDK programming guide

Test plan

  • make check passes (1543 tests, 0 failures)
  • --hint client generates valid Python (compile() check)
  • --hint service generates ConfigStore code with explicit config_dir
  • Invalid --hint value shows usage help
  • Commands without hints show "no hint available"
  • No real tokens in generated code
  • Permission-blocked commands still generate hints
  • Auto-update skipped in hint mode

padak added 2 commits April 13, 2026 00:56
Add --hint client|service global flag that generates equivalent Python
code instead of executing commands. Makes kbagent a programmable SDK —
users install one tool and get both CLI and importable Python modules.

Two modes:
- --hint client: generates KeboolaClient code with explicit URL + token
- --hint service: generates service layer code using CLI config

Covers 47 API-backed commands across all command groups (config, storage,
job, branch, workspace, sharing, component, encrypt, lineage, org, tool).
Commands without hints (local-only like project list, branch use) show
a clear "no hint available" message instead of silently executing.

Hint mode bypasses permission checks and auto-update (no API calls made).
Escape quotes, newlines, and triple-quote sequences in parameter values
before embedding them into generated Python string literals. Without this,
a crafted parameter value (e.g. a malicious component ID or bucket name)
could inject arbitrary Python code into the --hint output, which an AI
agent might then execute.

Adds _escape_for_python_string() and _sanitize_for_comment() to renderer.
Includes 4 security regression tests (quote breakout, list injection,
docstring injection, newline injection).
@padak padak merged commit 75cb3e4 into main Apr 13, 2026
1 check passed
@padak padak deleted the feat/hint-mode branch April 13, 2026 08:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant