PyPI - ama-cli - Versions diffs - 0.1.0__py3-none-any.whl - Mend

ama-cli 0.1.0__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (20) hide show

ama_cli/__init__.py +7 -0
ama_cli/agents/__init__.py +25 -0
ama_cli/agents/adapters/__init__.py +48 -0
ama_cli/agents/adapters/cli_backed.py +271 -0
ama_cli/agents/adapters/cursor.py +86 -0
ama_cli/agents/base.py +206 -0
ama_cli/agents/mcp.py +275 -0
ama_cli/agents/registry.py +179 -0
ama_cli/auth.py +292 -0
ama_cli/cli.py +433 -0
ama_cli/credentials.py +126 -0
ama_cli/discovery.py +114 -0
ama_cli/launch.py +82 -0
ama_cli/onboard.py +421 -0
ama_cli/prompts.py +53 -0
ama_cli/verify.py +259 -0
ama_cli-0.1.0.dist-info/METADATA +90 -0
ama_cli-0.1.0.dist-info/RECORD +20 -0
ama_cli-0.1.0.dist-info/WHEEL +4 -0
ama_cli-0.1.0.dist-info/entry_points.txt +2 -0

ama_cli/auth.py ADDED Viewed

@@ -0,0 +1,292 @@
+"""Browser loopback login for the public CLI.
+OAuth 2.0 authorization code + PKCE over a loopback redirect (RFC 8252), the
+same shape as `gh auth login`:
+    1. bind 127.0.0.1:0 -- the OS picks a free port
+    2. open the browser at {host}/api/v1/cli/auth?redirect_uri=...&state=...
+       &code_challenge=S256(verifier)
+    3. the human signs in (WorkOS) and is redirected back to the listener
+    4. check `state`, then POST {code, verifier} for an ama_ key
+The key is never in a URL: the browser only carries a code, and the code is
+useless without the verifier this process kept. URLs land in history, Referer
+headers and proxy logs.
+"""
+from __future__ import annotations
+import base64
+import hashlib
+import http.server
+import secrets
+import socket
+import threading
+import urllib.parse
+import webbrowser
+from dataclasses import dataclass
+from datetime import UTC, datetime
+from ama_cli.credentials import Credentials
+# Long enough for a real sign-in (including creating an account), short enough
+# that a walked-away terminal does not hang forever.
+LOGIN_TIMEOUT_SECONDS = 180
+_VERIFIER_BYTES = 48  # -> 64 base64url chars, inside RFC 7636's 43..128
+class LoginError(Exception):
+    """Login could not complete."""
+@dataclass(frozen=True)
+class PkcePair:
+    """A PKCE verifier and its S256 challenge."""
+    verifier: str
+    challenge: str
+    @classmethod
+    def generate(cls) -> PkcePair:
+        verifier = secrets.token_urlsafe(_VERIFIER_BYTES)
+        digest = hashlib.sha256(verifier.encode("ascii")).digest()
+        challenge = base64.urlsafe_b64encode(digest).decode("ascii").rstrip("=")
+        return cls(verifier=verifier, challenge=challenge)
+@dataclass
+class _Callback:
+    """What the browser handed back."""
+    code: str | None = None
+    state: str | None = None
+    error: str | None = None
+_SUCCESS_HTML = """<!doctype html>
+<meta charset="utf-8"><title>Ama CLI</title>
+<style>
+ body{font-family:system-ui,-apple-system,sans-serif;display:grid;place-items:center;
+      height:100vh;margin:0;background:#0b0b0f;color:#e8e8ee}
+ .c{text-align:center}.t{font-size:1.5rem;font-weight:600;margin-bottom:.5rem}
+ .s{opacity:.6}
+</style>
+<div class="c"><div class="t">You're signed in</div>
+<div class="s">Return to your terminal — you can close this tab.</div></div>
+"""
+_FAILURE_HTML = """<!doctype html>
+<meta charset="utf-8"><title>Ama CLI</title>
+<style>
+ body{font-family:system-ui,-apple-system,sans-serif;display:grid;place-items:center;
+      height:100vh;margin:0;background:#0b0b0f;color:#e8e8ee}
+ .c{text-align:center}.t{font-size:1.5rem;font-weight:600;margin-bottom:.5rem}
+ .s{opacity:.6}
+</style>
+<div class="c"><div class="t">Sign-in failed</div>
+<div class="s">Return to your terminal for details.</div></div>
+"""
+class LoopbackListener:
+    """A one-shot HTTP server on 127.0.0.1 that catches the OAuth redirect.
+    Binds the loopback interface specifically, never 0.0.0.0 -- the latter would
+    expose the listener, and the authorization code, to the whole local network.
+    """
+    def __init__(self) -> None:
+        self._result = _Callback()
+        self._received = threading.Event()
+        self._server = self._build_server()
+    def _build_server(self) -> http.server.HTTPServer:
+        outer = self
+        class Handler(http.server.BaseHTTPRequestHandler):
+            def do_GET(self) -> None:  # noqa: N802 - stdlib naming
+                parsed = urllib.parse.urlparse(self.path)
+                params = urllib.parse.parse_qs(parsed.query)
+                outer._result = _Callback(
+                    code=_first(params, "code"),
+                    state=_first(params, "state"),
+                    error=_first(params, "error"),
+                )
+                ok = outer._result.code is not None and outer._result.error is None
+                body = (_SUCCESS_HTML if ok else _FAILURE_HTML).encode("utf-8")
+                self.send_response(200)
+                self.send_header("Content-Type", "text/html; charset=utf-8")
+                self.send_header("Content-Length", str(len(body)))
+                self.end_headers()
+                self.wfile.write(body)
+                outer._received.set()
+            def log_message(self, *args) -> None:
+                """Silence the stdlib access log; it would corrupt CLI output."""
+        # Port 0: the OS picks a free one. Nothing is pre-registered, so there is
+        # no fixed port to collide with another CLI or a local dev server.
+        return http.server.HTTPServer(("127.0.0.1", 0), Handler)
+    @property
+    def port(self) -> int:
+        return self._server.server_port
+    @property
+    def redirect_uri(self) -> str:
+        return f"http://127.0.0.1:{self.port}/cb"
+    def __enter__(self) -> LoopbackListener:
+        self._thread = threading.Thread(target=self._server.serve_forever, daemon=True)
+        self._thread.start()
+        return self
+    def __exit__(self, *exc) -> None:
+        self._server.shutdown()
+        self._server.server_close()
+    def wait(self, timeout: float = LOGIN_TIMEOUT_SECONDS) -> _Callback:
+        """Block until the browser calls back, or time out.
+        Raises:
+            LoginError: on timeout, so the caller can fall back rather than hang.
+        """
+        if not self._received.wait(timeout):
+            raise LoginError(
+                f"timed out after {int(timeout)}s waiting for the browser. "
+                "Use --no-browser to sign in by email instead."
+            )
+        return self._result
+def _first(params: dict[str, list[str]], key: str) -> str | None:
+    values = params.get(key)
+    return values[0] if values else None
+def authorize_url(
+    host: str, *, redirect_uri: str, state: str, challenge: str, client_name: str
+) -> str:
+    """The browser URL that starts the flow."""
+    query = urllib.parse.urlencode(
+        {
+            "redirect_uri": redirect_uri,
+            "state": state,
+            "code_challenge": challenge,
+            "code_challenge_method": "S256",
+            "client_name": client_name,
+        }
+    )
+    return f"{host.rstrip('/')}/api/v1/cli/auth?{query}"
+def default_client_name() -> str:
+    """A key name the user will recognise in settings: the machine it lives on."""
+    try:
+        hostname = socket.gethostname().split(".")[0]
+    except OSError:
+        hostname = "unknown"
+    return f"ama-cli@{hostname}"
+def login(
+    host: str,
+    *,
+    open_browser=webbrowser.open,
+    post_token=None,
+    timeout: float = LOGIN_TIMEOUT_SECONDS,
+    on_url=None,
+) -> Credentials:
+    """Run the loopback flow and return credentials.
+    `open_browser` and `post_token` are injected so tests can drive the whole
+    flow without a browser or a network.
+    Raises:
+        LoginError: on timeout, state mismatch, or a rejected exchange.
+    """
+    if post_token is None:
+        post_token = _post_token
+    pkce = PkcePair.generate()
+    state = secrets.token_urlsafe(16)
+    client_name = default_client_name()
+    with LoopbackListener() as listener:
+        url = authorize_url(
+            host,
+            redirect_uri=listener.redirect_uri,
+            state=state,
+            challenge=pkce.challenge,
+            client_name=client_name,
+        )
+        if on_url:
+            on_url(url)
+        open_browser(url)
+        callback = listener.wait(timeout)
+    if callback.error:
+        raise LoginError(f"authorization failed: {callback.error}")
+    if callback.code is None:
+        raise LoginError("no authorization code was returned")
+    # Reject a callback from a different session. Compared with compare_digest
+    # rather than == so the check is not a timing oracle.
+    if callback.state is None or not secrets.compare_digest(callback.state, state):
+        raise LoginError("state mismatch — ignoring a callback this login did not start")
+    payload = post_token(
+        f"{host.rstrip('/')}/api/v1/cli/auth/token",
+        {
+            "code": callback.code,
+            "code_verifier": pkce.verifier,
+            "redirect_uri": f"http://127.0.0.1:{_port_of(listener.redirect_uri)}/cb",
+        },
+    )
+    return Credentials(
+        host=payload.get("host", host),
+        api_key=payload["api_key"],
+        mcp_url=payload["mcp_url"],
+        email=payload.get("email"),
+        tenant_id=payload.get("tenant_id"),
+        created_at=datetime.now(UTC).isoformat(),
+    )
+def _port_of(redirect_uri: str) -> int:
+    return urllib.parse.urlparse(redirect_uri).port or 0
+def _post_token(url: str, body: dict) -> dict:
+    """Exchange the code for a key.
+    urllib rather than httpx: this is the only HTTP the CLI makes, and one
+    stdlib call is cheaper than a dependency on the install path of a one-line
+    onboarding command.
+    """
+    import json
+    import urllib.error
+    import urllib.request
+    data = json.dumps(body).encode()
+    req = urllib.request.Request(
+        url, data=data, headers={"Content-Type": "application/json"}, method="POST"
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=30) as resp:
+            return json.loads(resp.read())
+    except urllib.error.HTTPError as exc:
+        detail = _detail(exc)
+        raise LoginError(f"token exchange failed ({exc.code}): {detail}") from exc
+    except urllib.error.URLError as exc:
+        raise LoginError(f"could not reach {url}: {exc.reason}") from exc
+def _detail(exc) -> str:
+    import json
+    try:
+        return json.loads(exc.read()).get("detail", "unknown error")
+    except Exception:
+        return "unknown error"