Address self-review findings

- Use auth client for spec fetch (retries, headers, SSL handling)
- Rename _resolve_credentials to public resolve_credentials
- Replace SystemExit(1) with click.Abort for proper framework cleanup
- Document monkey-patch of typer.main.get_group
- Remove unused requests import from openapi_spec

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: MaorDavidzon

cycode/cli/app.py

@@ -64,7 +64,11 @@
 _api_groups_to_register = get_api_command_groups()
 
 
-# Override the Typer's main to inject API groups into the Click group
+# Monkey-patch typer.main.get_group to inject API Click groups into the Typer CLI.
+# This is necessary because Typer doesn't support adding native Click groups directly.
+# Typer creates a new Click group on each get_group() call, so we intercept that call
+# and add our API groups to the result. The `app_typer is app` guard ensures we only
+# modify our own app, not other Typer apps in the process.
 _original_get_group = typer.main.get_group
 
 

cycode/cli/apps/api/api_command.py

@@ -82,10 +82,10 @@ def _make_api_request(
     """Execute an API request using the CLI's standard auth client."""
     from urllib.parse import quote
 
-    from cycode.cli.apps.api.openapi_spec import _resolve_credentials
+    from cycode.cli.apps.api.openapi_spec import resolve_credentials
     from cycode.cyclient.cycode_token_based_client import CycodeTokenBasedClient
 
-    cid, csecret = _resolve_credentials(client_id, client_secret)
+    cid, csecret = resolve_credentials(client_id, client_secret)
     client = CycodeTokenBasedClient(cid, csecret)
 
     # Substitute path parameters (URL-encoded to prevent path traversal)
@@ -234,7 +234,7 @@ def _callback(**kwargs: Any) -> None:
             )
         except Exception as e:
             click.echo(f'Error: {e}', err=True)
-            raise SystemExit(1) from e
+            raise click.Abort from e
 
         click.echo(json.dumps(result, indent=2))
 

cycode/cli/apps/api/openapi_spec.py

@@ -6,8 +6,6 @@
 from pathlib import Path
 from typing import Optional
 
-import requests
-
 from cycode.cli.consts import CYCODE_CONFIGURATION_DIRECTORY
 from cycode.cli.user_settings.credentials_manager import CredentialsManager
 from cycode.cyclient import config as cyclient_config
@@ -61,7 +59,7 @@ def _load_cached_spec() -> Optional[dict]:
         return None
 
 
-def _resolve_credentials(
+def resolve_credentials(
     client_id: Optional[str] = None, client_secret: Optional[str] = None
 ) -> tuple[str, str]:
     """Resolve credentials from args or the CLI's standard credential chain."""
@@ -81,28 +79,28 @@ def _resolve_credentials(
 
 
 def _fetch_and_cache_spec(client_id: Optional[str] = None, client_secret: Optional[str] = None) -> dict:
-    """Fetch OpenAPI spec from API and cache to disk."""
+    """Fetch OpenAPI spec from API and cache to disk.
+
+    Uses CycodeTokenBasedClient for auth and retries. The spec is served from the app URL,
+    so we create a client with app_url as base instead of the default api_url.
+    """
     from cycode.cyclient.cycode_token_based_client import CycodeTokenBasedClient
 
-    cid, csecret = _resolve_credentials(client_id, client_secret)
-    token = CycodeTokenBasedClient(cid, csecret).get_access_token()
+    cid, csecret = resolve_credentials(client_id, client_secret)
 
-    # Fetch spec from app URL (spec is served from app, not api)
-    app_url = cyclient_config.cycode_app_url
-    spec_url = f'{app_url}{_OPENAPI_SPEC_PATH}'
-    logger.info('Fetching OpenAPI spec from %s', spec_url)
+    # Create a token-based client pointed at app URL (spec is served from app, not api)
+    client = CycodeTokenBasedClient(cid, csecret)
+    client.api_url = cyclient_config.cycode_app_url
+
+    spec_path = _OPENAPI_SPEC_PATH.lstrip('/')
+    logger.info('Fetching OpenAPI spec from %s/%s', cyclient_config.cycode_app_url, spec_path)
 
     try:
-        response = requests.get(
-            spec_url,
-            headers={'Authorization': f'Bearer {token}'},
-            timeout=60,
-        )
-        response.raise_for_status()
+        response = client.get(spec_path)
         spec = response.json()
-    except requests.RequestException as e:
+    except Exception as e:
         raise OpenAPISpecError(
-            f'Failed to fetch OpenAPI spec from {spec_url}. Check your authentication and network connectivity.'
+            f'Failed to fetch OpenAPI spec. Check your authentication and network connectivity. Error: {e}'
         ) from e
 
     # Override server URL with API URL (supports on-premise installations)