agentstack-cli 0.4.2rc9__tar.gz → 0.4.2rc10__tar.gz

{agentstack_cli-0.4.2rc9 → agentstack_cli-0.4.2rc10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: agentstack-cli
-Version: 0.4.2rc9
+Version: 0.4.2rc10
 Summary: Agent Stack CLI
 Author: IBM Corp.
 Requires-Dist: anyio~=4.10.0

{agentstack_cli-0.4.2rc9 → agentstack_cli-0.4.2rc10}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "agentstack-cli"
-version = "0.4.2-rc9"
+version = "0.4.2-rc10"
 description = "Agent Stack CLI"
 readme = "README.md"
 authors = [{ name = "IBM Corp." }]

{agentstack_cli-0.4.2rc9 → agentstack_cli-0.4.2rc10}/src/agentstack_cli/api.py

@@ -44,7 +44,7 @@ async def api_request(
             timeout=60,
             headers=(
                 {"Authorization": f"Bearer {token}"}
-                if use_auth and (token := config.auth_manager.load_auth_token())
+                if use_auth and (token := await config.auth_manager.load_auth_token())
                 else {}
             ),
         )
@@ -83,7 +83,7 @@ async def api_stream(
             timeout=timedelta(hours=1).total_seconds(),
             headers=(
                 {"Authorization": f"Bearer {token}"}
-                if use_auth and (token := config.auth_manager.load_auth_token())
+                if use_auth and (token := await config.auth_manager.load_auth_token())
                 else {}
             ),
         ) as response,
@@ -108,7 +108,7 @@ async def a2a_client(agent_card: AgentCard, use_auth: bool = True) -> AsyncItera
         async with httpx.AsyncClient(
             headers=(
                 {"Authorization": f"Bearer {token}"}
-                if use_auth and (token := config.auth_manager.load_auth_token())
+                if use_auth and (token := await config.auth_manager.load_auth_token())
                 else {}
             ),
             follow_redirects=True,

agentstack_cli-0.4.2rc10/src/agentstack_cli/auth_manager.py

@@ -0,0 +1,241 @@
+# Copyright 2025 © BeeAI a Series of LF Projects, LLC
+# SPDX-License-Identifier: Apache-2.0
+import pathlib
+import time
+import typing
+from collections import defaultdict
+from typing import Any
+
+import httpx
+from pydantic import BaseModel, Field
+
+
+class AuthToken(BaseModel):
+    access_token: str
+    token_type: str = "Bearer"
+    expires_in: int | None = None
+    expires_at: int | None = None
+    refresh_token: str | None = None
+    scope: str | None = None
+
+
+class AuthServer(BaseModel):
+    client_id: str = "df82a687-d647-4247-838b-7080d7d83f6c"  # Backwards compatibility default
+    client_secret: str | None = None
+    token: AuthToken | None = None
+    registration_token: str | None = None
+
+
+class Server(BaseModel):
+    authorization_servers: dict[str, AuthServer] = Field(default_factory=dict)
+
+
+class Auth(BaseModel):
+    version: typing.Literal[1] = 1
+    servers: defaultdict[str, typing.Annotated[Server, Field(default_factory=Server)]] = Field(
+        default_factory=lambda: defaultdict(Server)
+    )
+    active_server: str | None = None
+    active_auth_server: str | None = None
+
+
+@typing.final
+class AuthManager:
+    def __init__(self, config_path: pathlib.Path):
+        self._auth_path = config_path
+        self._auth = self._load()
+
+    def _load(self) -> Auth:
+        if not self._auth_path.exists():
+            return Auth()
+        return Auth.model_validate_json(self._auth_path.read_bytes())
+
+    def _save(self) -> None:
+        self._auth_path.write_text(self._auth.model_dump_json(indent=2))
+
+    def save_auth_token(
+        self,
+        server: str,
+        auth_server: str | None = None,
+        client_id: str | None = None,
+        client_secret: str | None = None,
+        token: dict[str, Any] | None = None,
+        registration_token: str | None = None,
+    ) -> None:
+        if auth_server is not None and client_id is not None and token is not None:
+            if token["access_token"]:
+                usetimestamp = int(time.time()) + int(token["expires_in"])
+                token["expires_at"] = usetimestamp
+            self._auth.servers[server].authorization_servers[auth_server] = AuthServer(
+                client_id=client_id,
+                client_secret=client_secret,
+                token=AuthToken(**token),
+                registration_token=registration_token,
+            )
+        else:
+            self._auth.servers[server]  # touch
+        self._save()
+
+    async def exchange_refresh_token(self, auth_server: str, token: AuthToken) -> dict[str, Any] | None:
+        """
+        This method exchanges a refresh token for a new access token.
+        """
+        async with httpx.AsyncClient(headers={"Accept": "application/json"}) as client:
+            resp = None
+            try:
+                resp = await client.get(f"{auth_server}/.well-known/openid-configuration")
+                resp.raise_for_status()
+                oidc = resp.json()
+            except Exception as e:
+                if resp:
+                    error_details = resp.json()
+                    print(f"error: {error_details['error']} error description: {error_details['error_description']}")
+                raise RuntimeError(f"OIDC discovery failed: {e}") from e
+
+            token_endpoint = oidc["token_endpoint"]
+            try:
+                client_id = (
+                    self._auth.servers[self._auth.active_server or ""].authorization_servers[auth_server].client_id
+                )
+                client_secret = (
+                    self._auth.servers[self._auth.active_server or ""].authorization_servers[auth_server].client_secret
+                )
+                resp = await client.post(
+                    f"{token_endpoint}",
+                    data={
+                        "grant_type": "refresh_token",
+                        "refresh_token": token.refresh_token,
+                        "scope": token.scope,
+                        "client_id": client_id,
+                        "client_secret": client_secret,
+                    },
+                )
+                resp.raise_for_status()
+                new_token = resp.json()
+            except Exception as e:
+                if resp:
+                    error_details = resp.json()
+                    print(f"error: {error_details['error']} error description: {error_details['error_description']}")
+                raise RuntimeError(f"Failed to refresh token: {e}") from e
+            self.save_auth_token(
+                self._auth.active_server or "",
+                self._auth.active_auth_server or "",
+                self._auth.servers[self._auth.active_server or ""].authorization_servers[auth_server].client_id or "",
+                self._auth.servers[self._auth.active_server or ""].authorization_servers[auth_server].client_secret
+                or "",
+                token=new_token,
+            )
+            return new_token
+
+    async def load_auth_token(self) -> str | None:
+        active_res = self._auth.active_server
+        active_auth_server = self._auth.active_auth_server
+        if not active_res or not active_auth_server:
+            return None
+        server = self._auth.servers.get(active_res)
+        if not server:
+            return None
+
+        auth_server = server.authorization_servers.get(active_auth_server)
+        if not auth_server or not auth_server.token:
+            return None
+
+        if (auth_server.token.expires_at or 0) - 60 < time.time():
+            new_token = await self.exchange_refresh_token(active_auth_server, auth_server.token)
+            if new_token:
+                return new_token["access_token"]
+            return None
+
+        return auth_server.token.access_token
+
+    async def deregister_client(self, auth_server, client_id, registration_token) -> None:
+        async with httpx.AsyncClient(headers={"Accept": "application/json"}) as client:
+            resp = None
+            try:
+                resp = await client.get(f"{auth_server}/.well-known/openid-configuration")
+                resp.raise_for_status()
+                oidc = resp.json()
+                registration_endpoint = oidc["registration_endpoint"]
+            except Exception as e:
+                if resp:
+                    error_details = resp.json()
+                    print(f"error: {error_details['error']} error description: {error_details['error_description']}")
+                raise RuntimeError(f"OIDC discovery failed: {e}") from e
+
+            try:
+                if client_id is not None and client_id != "" and registration_token is not None:
+                    headers = {"authorization": f"bearer {registration_token}"}
+                    resp = await client.delete(f"{registration_endpoint}/{client_id}", headers=headers)
+                    resp.raise_for_status()
+
+            except Exception as e:
+                if resp:
+                    error_details = resp.json()
+                    print(f"error: {error_details['error']} error description: {error_details['error_description']}")
+                raise RuntimeError(f"Dynamic client de-registration failed. {e}") from e
+
+    async def clear_auth_token(self, all: bool = False) -> None:
+        if all:
+            for server in self._auth.servers:
+                for auth_server in self._auth.servers[server].authorization_servers:
+                    await self.deregister_client(
+                        auth_server,
+                        self._auth.servers[server].authorization_servers[auth_server].client_id,
+                        self._auth.servers[server].authorization_servers[auth_server].registration_token,
+                    )
+
+            self._auth.servers = defaultdict(Server)
+        else:
+            if self._auth.active_server and self._auth.active_auth_server:
+                if (
+                    self._auth.servers[self._auth.active_server]
+                    .authorization_servers[self._auth.active_auth_server]
+                    .client_id
+                ):
+                    await self.deregister_client(
+                        self._auth.active_auth_server,
+                        self._auth.servers[self._auth.active_server]
+                        .authorization_servers[self._auth.active_auth_server]
+                        .client_id,
+                        self._auth.servers[self._auth.active_server]
+                        .authorization_servers[self._auth.active_auth_server]
+                        .registration_token,
+                    )
+                del self._auth.servers[self._auth.active_server].authorization_servers[self._auth.active_auth_server]
+            if self._auth.active_server and not self._auth.servers[self._auth.active_server].authorization_servers:
+                del self._auth.servers[self._auth.active_server]
+        self._auth.active_server = None
+        self._auth.active_auth_server = None
+        self._save()
+
+    def get_server(self, server: str) -> Server | None:
+        return self._auth.servers.get(server)
+
+    @property
+    def servers(self) -> list[str]:
+        return list(self._auth.servers.keys())
+
+    @property
+    def active_server(self) -> str | None:
+        return self._auth.active_server
+
+    @active_server.setter
+    def active_server(self, server: str | None) -> None:
+        if server is not None and server not in self._auth.servers:
+            raise ValueError(f"Server {server} not found")
+        self._auth.active_server = server
+        self._save()
+
+    @property
+    def active_auth_server(self) -> str | None:
+        return self._auth.active_auth_server
+
+    @active_auth_server.setter
+    def active_auth_server(self, auth_server: str | None) -> None:
+        if auth_server is not None and (
+            self._auth.active_server not in self._auth.servers
+            or auth_server not in self._auth.servers[self._auth.active_server].authorization_servers
+        ):
+            raise ValueError(f"Auth server {auth_server} not found in active server")
+        self._auth.active_auth_server = auth_server
+        self._save()

{agentstack_cli-0.4.2rc9 → agentstack_cli-0.4.2rc10}/src/agentstack_cli/commands/agent.py

@@ -535,7 +535,8 @@ async def _run_agent(
                     error = ""
                     if message and message.parts and isinstance(message.parts[0].root, TextPart):
                         error = message.parts[0].root.text
-                    console.print(f"[red]Task {status}[/red]: {error}")
+                    console.print(f"\n:boom: [red][bold]Task {status.value}[/bold][/red]")
+                    console.print(Markdown(error))
                     return
                 case Task(id=task_id), TaskStatusUpdateEvent(
                     status=TaskStatus(state=TaskState.auth_required, message=message)

{agentstack_cli-0.4.2rc9 → agentstack_cli-0.4.2rc10}/src/agentstack_cli/commands/server.py

@@ -5,6 +5,7 @@ import asyncio
 import logging
 import sys
 import typing
+import uuid
 import webbrowser
 from urllib.parse import urlencode
 
@@ -68,6 +69,10 @@ async def _wait_for_auth_code(port: int = 9001) -> str:
     return code
 
 
+def get_unique_app_name() -> str:
+    return f"Agent Stack CLI {uuid.uuid4()}"
+
+
 @app.command("login | change | select | default | switch")
 async def server_login(server: typing.Annotated[str | None, typer.Argument()] = None):
     """Login to a server or switch between logged in servers."""
@@ -137,6 +142,7 @@ async def server_login(server: typing.Annotated[str | None, typer.Argument()] =
 
         client_id = config.client_id
         client_secret = config.client_secret
+        registration_token = None
 
         if auth_servers:
             if len(auth_servers) == 1:
@@ -161,17 +167,35 @@ async def server_login(server: typing.Annotated[str | None, typer.Argument()] =
             registration_endpoint = oidc["registration_endpoint"]
             if not client_id and registration_endpoint:
                 async with httpx.AsyncClient() as client:
+                    resp = None
                     try:
+                        app_name = get_unique_app_name()
                         resp = await client.post(
                             registration_endpoint,
-                            json={"client_name": "Agent Stack CLI", "redirect_uris": [REDIRECT_URI]},
+                            json={
+                                "client_name": app_name,
+                                "grant_types": ["authorization_code", "refresh_token"],
+                                "enforce_pkce": True,
+                                "all_users_entitled": True,
+                                "redirect_uris": [REDIRECT_URI],
+                            },
                         )
                         resp.raise_for_status()
                         data = resp.json()
                         client_id = data["client_id"]
                         client_secret = data["client_secret"]
-                    except Exception:
-                        console.warning("Dynamic client registration failed. Proceed with manual input.")
+                        registration_token = data["registration_access_token"]
+                    except Exception as e:
+                        if resp:
+                            try:
+                                error_details = resp.json()
+                                console.warning(
+                                    f"error: {error_details['error']} error description: {error_details['error_description']}"
+                                )
+
+                            except Exception:
+                                console.info("no parsable json response.")
+                        console.warning(f" Dynamic client registration failed. Proceed with manual input.  {e!s}")
 
             if not client_id:
                 client_id = await inquirer.text(  #  type: ignore
@@ -208,6 +232,7 @@ async def server_login(server: typing.Annotated[str | None, typer.Argument()] =
 
             code = await _wait_for_auth_code()
             async with httpx.AsyncClient() as client:
+                token_resp = None
                 try:
                     token_resp = await client.post(
                         oidc["token_endpoint"],
@@ -223,6 +248,15 @@ async def server_login(server: typing.Annotated[str | None, typer.Argument()] =
                     token_resp.raise_for_status()
                     token = token_resp.json()
                 except Exception as e:
+                    if resp:
+                        try:
+                            error_details = resp.json()
+                            console.warning(
+                                f"error: {error_details['error']} error description: {error_details['error_description']}"
+                            )
+                        except Exception:
+                            console.info("no parsable json response.")
+
                     raise RuntimeError(f"Token request failed: {e}") from e
 
             if not token:
@@ -234,6 +268,7 @@ async def server_login(server: typing.Annotated[str | None, typer.Argument()] =
             client_id=client_id,
             client_secret=client_secret,
             token=token,
+            registration_token=registration_token,
         )
 
     config.auth_manager.active_server = server
@@ -248,7 +283,7 @@ async def server_logout(
         typer.Option(),
     ] = False,
 ):
-    config.auth_manager.clear_auth_token(all=all)
+    await config.auth_manager.clear_auth_token(all=all)
     console.success("You have been logged out.")
 
 

{agentstack_cli-0.4.2rc9 → agentstack_cli-0.4.2rc10}/src/agentstack_cli/configuration.py

@@ -65,7 +65,7 @@ class Configuration(pydantic_settings.BaseSettings):
             sys.exit(1)
         async with use_platform_client(
             auth=("admin", self.admin_password.get_secret_value()) if self.admin_password else None,
-            auth_token=self.auth_manager.load_auth_token(),
+            auth_token=await self.auth_manager.load_auth_token(),
             base_url=self.auth_manager.active_server + "/",
         ) as client:
             yield client

agentstack_cli-0.4.2rc9/src/agentstack_cli/auth_manager.py

@@ -1,126 +0,0 @@
-# Copyright 2025 © BeeAI a Series of LF Projects, LLC
-# SPDX-License-Identifier: Apache-2.0
-
-import pathlib
-import typing
-from collections import defaultdict
-from typing import Any
-
-from pydantic import BaseModel, Field
-
-
-class AuthToken(BaseModel):
-    access_token: str
-    token_type: str = "Bearer"
-    expires_in: int | None = None
-    refresh_token: str | None = None
-    scope: str | None = None
-
-
-class AuthServer(BaseModel):
-    client_id: str = "df82a687-d647-4247-838b-7080d7d83f6c"  # Backwards compatibility default
-    client_secret: str | None = None
-    token: AuthToken | None = None
-
-
-class Server(BaseModel):
-    authorization_servers: dict[str, AuthServer] = Field(default_factory=dict)
-
-
-class Auth(BaseModel):
-    version: typing.Literal[1] = 1
-    servers: defaultdict[str, typing.Annotated[Server, Field(default_factory=Server)]] = Field(
-        default_factory=lambda: defaultdict(Server)
-    )
-    active_server: str | None = None
-    active_auth_server: str | None = None
-
-
-@typing.final
-class AuthManager:
-    def __init__(self, config_path: pathlib.Path):
-        self._auth_path = config_path
-        self._auth = self._load()
-
-    def _load(self) -> Auth:
-        if not self._auth_path.exists():
-            return Auth()
-        return Auth.model_validate_json(self._auth_path.read_bytes())
-
-    def _save(self) -> None:
-        self._auth_path.write_text(self._auth.model_dump_json(indent=2))
-
-    def save_auth_token(
-        self,
-        server: str,
-        auth_server: str | None = None,
-        client_id: str | None = None,
-        client_secret: str | None = None,
-        token: dict[str, Any] | None = None,
-    ) -> None:
-        if auth_server is not None and client_id is not None and token is not None:
-            self._auth.servers[server].authorization_servers[auth_server] = AuthServer(
-                client_id=client_id, client_secret=client_secret, token=AuthToken(**token)
-            )
-        else:
-            self._auth.servers[server]  # touch
-        self._save()
-
-    def load_auth_token(self) -> str | None:
-        active_res = self._auth.active_server
-        active_auth_server = self._auth.active_auth_server
-        if not active_res or not active_auth_server:
-            return None
-        server = self._auth.servers.get(active_res)
-        if not server:
-            return None
-
-        auth_server = server.authorization_servers.get(active_auth_server)
-        if not auth_server or not auth_server.token:
-            return None
-
-        return auth_server.token.access_token
-
-    def clear_auth_token(self, all: bool = False) -> None:
-        if all:
-            self._auth.servers = defaultdict(Server)
-        else:
-            if self._auth.active_server and self._auth.active_auth_server:
-                del self._auth.servers[self._auth.active_server].authorization_servers[self._auth.active_auth_server]
-            if self._auth.active_server and not self._auth.servers[self._auth.active_server].authorization_servers:
-                del self._auth.servers[self._auth.active_server]
-        self._auth.active_server = None
-        self._auth.active_auth_server = None
-        self._save()
-
-    def get_server(self, server: str) -> Server | None:
-        return self._auth.servers.get(server)
-
-    @property
-    def servers(self) -> list[str]:
-        return list(self._auth.servers.keys())
-
-    @property
-    def active_server(self) -> str | None:
-        return self._auth.active_server
-
-    @active_server.setter
-    def active_server(self, server: str | None) -> None:
-        if server is not None and server not in self._auth.servers:
-            raise ValueError(f"Server {server} not found")
-        self._auth.active_server = server
-        self._save()
-
-    @property
-    def active_auth_server(self) -> str | None:
-        return self._auth.active_auth_server
-
-    @active_auth_server.setter
-    def active_auth_server(self, auth_server: str | None) -> None:
-        if auth_server is not None and (
-            self._auth.active_server not in self._auth.servers
-            or auth_server not in self._auth.servers[self._auth.active_server].authorization_servers
-        ):
-            raise ValueError(f"Auth server {auth_server} not found in active server")
-        self._auth.active_auth_server = auth_server
-        self._save()