benchmax 0.1.2.dev27__py3-none-any.whl → 0.1.2.dev29__py3-none-any.whl

benchmax/cli.py

@@ -0,0 +1,78 @@
+"""``castform`` CLI — browser-based login for the SDK.
+
+Commands: ``login`` (device authorization), ``logout``, ``whoami``. The login
+flow + the reusable ``ensure_session`` live in :mod:`benchmax.platform.login`;
+this module is the thin argparse wrapper. After ``castform login`` the SDK
+resolves its bearer from ``~/.castform`` automatically — no API key or URL.
+"""
+
+from __future__ import annotations
+
+import argparse
+import sys
+
+from benchmax.platform import credentials
+from benchmax.platform.device_auth import DeviceAuthError
+from benchmax.platform.login import _login
+
+
+def _cmd_login(args: argparse.Namespace) -> int:
+    env = "staging" if args.env == "staging" else None
+    try:
+        _login(env)
+    except DeviceAuthError as exc:
+        print(f"Login failed: {exc}", file=sys.stderr)
+        return 1
+    print(f"\n✓ Logged in to {args.env}.")
+    return 0
+
+
+def _cmd_logout(_args: argparse.Namespace) -> int:
+    credentials.clear_castform_session()
+    print("✓ Logged out.")
+    return 0
+
+
+def _cmd_whoami(_args: argparse.Namespace) -> int:
+    session = credentials.read_castform_session()
+    if not session:
+        print("Not logged in. Run `castform login`.", file=sys.stderr)
+        return 1
+    env = session.get("env", "prod")
+    jwt = credentials._session_jwt()  # mints from the session; None if invalid/expired/offline
+    if not jwt:
+        print(
+            f"Session present (env: {env}), but couldn't reach auth-service to "
+            "verify it (offline, or the session expired). If this persists, run "
+            "`castform login` again.",
+            file=sys.stderr,
+        )
+        return 1
+    claims = credentials._jwt_claims(jwt)
+    who = claims.get("email") or claims.get("sub", "<unknown>")
+    print(f"Logged in as {who} (env: {env}).")
+    return 0
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(prog="castform", description="Castform CLI")
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    p_login = sub.add_parser("login", help="Sign in via your browser")
+    p_login.add_argument(
+        "--env",
+        choices=["prod", "staging"],
+        default="prod",
+        help="Environment to sign in to (staging is internal-only)",
+    )
+    p_login.set_defaults(func=_cmd_login)
+
+    sub.add_parser("logout", help="Clear the cached session").set_defaults(func=_cmd_logout)
+    sub.add_parser("whoami", help="Show the current login").set_defaults(func=_cmd_whoami)
+
+    args = parser.parse_args(argv)
+    return args.func(args)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

benchmax/config.py

@@ -16,7 +16,38 @@ DEFAULT_BASE_DOMAIN = "castform.com"
 
 
 def base_domain() -> str:
-    return os.environ.get("CASTFORM_BASE_DOMAIN", DEFAULT_BASE_DOMAIN)
+    """Resolve the platform base domain.
+
+    Precedence: explicit ``CASTFORM_BASE_DOMAIN`` → the cached device-auth
+    session's ``env`` (``staging`` → ``castform.dev``) → ``prod`` default
+    (``castform.com``). The ``env`` claim travels with the credential, so a
+    logged-in SDK routes to the same environment it authenticated against —
+    URL and credential can't desync. A prod session carries no ``env`` marker
+    (``None`` → prod), so only internal staging logins deviate from the default.
+    """
+    override = os.environ.get("CASTFORM_BASE_DOMAIN")
+    if override:
+        return override
+    if _session_env() == "staging":
+        return "castform.dev"
+    return DEFAULT_BASE_DOMAIN
+
+
+def _session_env() -> str | None:
+    """The ``env`` from the cached device-auth session, if any.
+
+    Lazy import: ``config`` is a leaf that ``benchmax.platform`` depends on, so a
+    top-level import would cycle (platform/__init__ → client → config)."""
+    try:
+        from benchmax.platform.credentials import read_castform_session
+
+        session = read_castform_session()
+    except Exception:
+        return None
+    if not session:
+        return None
+    env = session.get("env")
+    return env if isinstance(env, str) else None
 
 
 def platform_url() -> str:
@@ -38,3 +69,13 @@ def web_app_url() -> str:
 def llm_url() -> str:
     """OpenAI-compatible LLM endpoint hosted by the platform."""
     return os.environ.get("CASTFORM_LLM_URL") or f"https://llm.{base_domain()}/v1"
+
+
+def auth_url() -> str:
+    """Auth-service base URL (device-authorization + JWT mint endpoints).
+
+    Used by ``castform login`` and the per-process session→JWT mint. Derives from
+    the same base domain as everything else, so a session minted against ``staging``
+    talks to ``auth.castform.dev`` and a ``prod`` session to ``auth.castform.com``.
+    """
+    return os.environ.get("CASTFORM_AUTH_URL") or f"https://auth.{base_domain()}"

benchmax/envs/example_id.py

@@ -1,24 +1,23 @@
 """Canonical example identity.
 
 ``canonical_example_id(prompt_messages, task)`` returns a SHA-256 hex digest
-that is stable across processes and languages: a TypeScript port lives in
-``platform-service/src/lib/canonical-example-id.ts`` and is exercised by a
-parity test.
-
-Determinism is achieved by:
-- normalizing numeric values so JSON output matches between Python and JS
-  (JS has no int/float distinction; integer-valued floats are coerced to int,
-  -0.0 to 0; NaN/Inf are rejected).
-- rejecting values whose JSON serialization diverges between Python and JS:
-  non-string dict keys, integers outside JS ``Number.MAX_SAFE_INTEGER``,
-  byte strings, lone surrogates, and unknown types.
-- emitting canonical JSON with sorted keys, no whitespace, and no ASCII
-  escaping (modern JSON.stringify also preserves non-ASCII).
-
-The hash is computed over ``{"v": 2, "prompt_messages": ..., "task": ...}``.
-v:2 bump went together with the ``seed_messages`` → ``prompt_messages``
-field rename in 2026-05; v:1 hashes are obsolete.
+stable across processes. Identity is computed only here, in Python — both the
+trainer and rollout-service hash via this module.
+
+Normalization keeps the digest loader-independent:
+- integer-valued floats → int, -0.0 → 0; NaN/Inf rejected.
+- dict keys whose value is ``None`` are dropped, so a key absent in one loader
+  and present-but-null in another (Arrow schema-unification) hashes the same;
+  nulls *inside lists* are kept (length/order are identity).
+- ambiguous values rejected: non-str dict keys, ints beyond
+  ``Number.MAX_SAFE_INTEGER``, byte strings, lone surrogates, unknown types.
+- canonical JSON: sorted keys, no whitespace, no ASCII escaping.
+
+Payload tag ``v:3``. History: v:1→v:2 = the 2026-05 ``seed_messages`` →
+``prompt_messages`` rename; v:2→v:3 = drop null-valued dict keys (loader skew).
+Older hashes are obsolete.
 """
+
 from __future__ import annotations
 
 import hashlib
@@ -78,7 +77,10 @@ def _normalize(v: Any) -> Any:
                 raise ValueError(
                     f"dict keys must be str for canonical hashing; got {type(k).__name__}"
                 )
-            out[k] = _normalize(x)
+            nx = _normalize(x)
+            if nx is None:
+                continue
+            out[k] = nx
         return out
     raise ValueError(
         f"type {type(v).__name__} is not JSON-canonicalizable; "
@@ -90,7 +92,7 @@ def canonical_example_id(
     prompt_messages: Messages,
     task: dict[str, Any] | None,
 ) -> str:
-    payload = {"v": 2, "prompt_messages": prompt_messages, "task": task}
+    payload = {"v": 3, "prompt_messages": prompt_messages, "task": task}
     serialized = json.dumps(
         _normalize(payload),
         sort_keys=True,