Files
wwtools/mxaccesscli
Joseph Doherty 0d25ec445f mxaccesscli: add --username / --domain / --password to write
Wraps LMXProxyServer.AuthenticateUser at the session level
(MxSession.Authenticate) and surfaces three new options on the
write command:

  -u, --username <name>   galaxy / OS user
      --domain   <name>   composed as <domain>\<username>; omit for
                          galaxy-authenticated logins or UPN forms
  -p, --password <pwd>    redacted to "***" in the JSON query echo

The CLI calls AuthenticateUser before AddItem so an auth failure
(userId == 0) bails out cleanly without leaving a half-set-up item.
On success the resolved userId flows into Write(hServer, hItem,
value, userId) and is reflected in:

  - human output: "[OK ] write <tag> = <val> (as <verify-user>, userId=N)"
  - LLM-JSON results[]: { "authenticated": true, "auth_user_id": N }

Verified live against TestChildObject.TestInt with credentials
DESKTOP-6JL3KKO\dohertj / Sonamu89:

  read   -> 99
  write 7 with --username/--domain/--password -> ok, auth_user_id=1
  read   -> 7
  write 99 with same auth -> ok
  read   -> 99 (restored)

Important behavior surfaced and documented in docs/usage.md
"Authentication" section: on a galaxy configured in permissive
(Free Access) mode, AuthenticateUser returns a non-zero userId
regardless of credentials — verified by intentionally passing a
wrong password and an unknown user, both of which still resolved
to userId=1 and the write went through. The CLI's auth path is
wired correctly; the galaxy just isn't strict. To exercise real
authentication, target a galaxy with galaxyAuthenticationMode and
attribute-level security above Free Access.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-03 22:00:06 -04:00
..

mxaccesscli

A .NET Framework 4.8 / x86 CliFx-based CLI for reading, writing, and subscribing to AVEVA System Platform tags via MxAccess (ArchestrA.MxAccess.LMXProxyServerClass). Output as scannable text or as a stable JSON envelope for LLM consumption. Built-in per-tag and per-call timeouts; structured surface of MxStatus categories on every error.

Hard constraints

  • MxAccess is a 32-bit COM proxy. The CLI must stay on net48 / x86 / [STAThread]. Do not retarget to .NET 10 or x64 — LMXProxyServerClass is registered for the WoW64 server only.
  • System Platform must be installed locally so that ArchestrA.MxAccess is registered with COM and the LMX runtime is reachable. Without it Register() fails with a COM error.
  • MxAccess events fire on the registering apartment. Calls must originate from an STA thread, which is why Program.Main is [STAThread]. If you call from a non-STA thread, events queue but never get pumped and your timeouts will always fire.
  • Reads are not synchronous in MxAccess. "Read" is implemented as a brief subscribe → wait for first OnDataChange → tear down. If a tag never delivers a DataChange (offscan, wrong reference, security denied), the read times out — that's the correct semantic, not a CLI bug.
  • Writes need user identity for secured attributes. Default --user-id 0 is "unauthenticated"; secured attributes will reject. Use --user-id <id> after calling AuthenticateUser() from another path (or, for a CLI smoke test, target a non-secured Writeable_USC_* attribute).

Layout

mxaccesscli/
  README.md                this file
  AGENTS.md                agent rules for working in this folder
  MxAccess.Cli.slnx
  lib/
    ArchestrA.MxAccess.dll (copied from System Platform's Framework\Bin)
  src/MxAccess.Cli/
    MxAccess.Cli.csproj
    Program.cs              [STAThread] entry point
    IsExternalInit.cs       net48 polyfill for C# 9 init accessors
    Commands/               read, write, subscribe, info
    Mx/                     MxSession, MxItem, MxUpdate, ValueCoercion
    Output/                 LLM-JSON envelope writer
  docs/
    usage.md                command surface, examples, JSON envelope contract
    api-notes.md            reverse-engineered MxAccess API reference (since AVEVA's
                            online docs are sparse): types, events, threading, status semantics

Resource index — by task

Task Go to
Agent rules for editing this CLI AGENTS.md
Run the CLI / option reference / examples docs/usage.md
MxAccess API surface, threading model, MxStatus semantics docs/api-notes.md
Find a writeable tag in the live galaxy (so smoke tests have a target) ../grdb/README.md
Read tag values via SQL retrieval (an alternative path) ../histdb/README.md

External documentation

AVEVA does not publish a single canonical MxAccess reference online. The closest official sources:

  • https://docs.aveva.com/ — search "MxAccess", "LMXProxyServer", "Object Viewer". Coverage is partial and depends on which product portal you land on.
  • AVEVA Knowledge Base (subscriber-only): TID-based articles on LMX registration, secured writes, and WriteSecured2.
  • The shipped MXAccess32.tlb type library at C:\Program Files (x86)\ArchestrA\Framework\Bin\ is the most authoritative source for method signatures. docs/api-notes.md summarizes what it exposes.

Build & run

dotnet build src/MxAccess.Cli/MxAccess.Cli.csproj -p:Platform=x86 -c Release

# Read two tags with a 3-second timeout, JSON envelope:
dotnet run --project src/MxAccess.Cli/MxAccess.Cli.csproj -- read TestMachine_001.Speed Reactor1.Level -t 3 --llm-json

# Write a value with explicit type:
dotnet run --project src/MxAccess.Cli/MxAccess.Cli.csproj -- write TestMachine_001.Setpoint 42.5 --type double

# Subscribe to a tag for 30 seconds, JSON Lines for streaming:
dotnet run --project src/MxAccess.Cli/MxAccess.Cli.csproj -- subscribe TestMachine_001.Speed -s 30 --llm-json

The built executable is bin\x86\Release\net48\mxa.exe. Drop on PATH and use mxa read ....

Maintenance

This README follows the doctrine in ../DOCS-GUIDE.md. When you add a command, an option, or a new field on the JSON envelope, update docs/usage.md in the same change. Update docs/api-notes.md only if the underlying MxAccess assembly changes (different System Platform version, etc.). The root ../CLAUDE.md carries one row pointing at this README — it should not need to change unless the tool's task surface changes.