deepctl-core 0.2.7__tar.gz → 0.2.9__tar.gz

{deepctl_core-0.2.7 → deepctl_core-0.2.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deepctl-core
-Version: 0.2.7
+Version: 0.2.9
 Summary: Core components for deepctl
 Author-email: Deepgram <devrel@deepgram.com>
 Maintainer-email: Deepgram <devrel@deepgram.com>

{deepctl_core-0.2.7 → deepctl_core-0.2.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "deepctl-core"
-version = "0.2.7" # x-release-please-version
+version = "0.2.9" # x-release-please-version
 description = "Core components for deepctl"
 readme = "README.md"
 license = "MIT"

{deepctl_core-0.2.7 → deepctl_core-0.2.9}/src/deepctl_core/auth.py

@@ -3,6 +3,7 @@
 import os
 import time
 import webbrowser
+from datetime import datetime, timedelta, timezone
 from urllib.parse import urlencode
 
 import httpx
@@ -20,6 +21,8 @@ console = Console()
 AUTH_BASE_URL = os.getenv("DEEPGRAM_CLI_BASE_URL", "https://id.dx.deepgram.com")
 DEVICE_CODE_URL = f"{AUTH_BASE_URL}/device/code"
 TOKEN_POLL_URL = f"{AUTH_BASE_URL}/device/token"
+TOKEN_REFRESH_URL = f"{AUTH_BASE_URL}/token"
+DG_CREDENTIALS_URL = f"{AUTH_BASE_URL}/credentials/token"
 
 # Registered OIDC client ID for the CLI
 CLIENT_ID = "deepgram-cli"
@@ -43,6 +46,7 @@ class TokenResponse(BaseModel):
 
     access_token: str
     project_id: str
+    refresh_token: str | None = None  # Present in new JWT-based device flow
     token_type: str | None = None
     expires_in: int | None = None
     scope: str | None = None
@@ -105,11 +109,12 @@ class AuthManager:
         """
         profile_name = profile_name or self.config.profile or "default"
 
-        # Check keyring for API key
+        # Check keyring for direct API key or JWT (both indicate logged-in state)
         has_api_key = False
         try:
             api_key = keyring.get_password(KEYRING_SERVICE, f"api-key.{profile_name}")
-            has_api_key = bool(api_key)
+            jwt = keyring.get_password(KEYRING_SERVICE, f"jwt.{profile_name}")
+            has_api_key = bool(api_key or jwt)
         except Exception:
             pass
 
@@ -150,32 +155,47 @@ class AuthManager:
         return bool(os.getenv("DEEPGRAM_API_KEY") and os.getenv("DEEPGRAM_PROJECT_ID"))
 
     def get_api_key(self, ignore_env: bool = False) -> str | None:
-        """Get API key following precedence: explicit > profile > env.
+        """Get API key following precedence: explicit > JWT flow > legacy keyring > env.
+
+        When the user logged in via device flow with the new JWT-based server,
+        this method transparently refreshes the JWT if expired and exchanges it
+        for a Deepgram API token (dg_token). All callers receive a usable
+        Deepgram token regardless of which auth path was used.
+
+        Passing --api-key (or DEEPGRAM_API_KEY) bypasses the JWT flow entirely,
+        which is the correct behaviour for CI/CD and direct key usage.
 
         Args:
             ignore_env: If True, don't check environment variables
         """
-        # Explicit credentials have highest priority
+        # Explicit credentials (--api-key flag, CI/CD) bypass the JWT flow.
         if self.explicit_api_key:
             return self.explicit_api_key
 
-        # Check profile credentials next
         profile_name = self.config.profile or "default"
 
-        # Check keyring first
+        # JWT-based flow: present when logged in via device flow with new server.
+        try:
+            jwt = keyring.get_password(KEYRING_SERVICE, f"jwt.{profile_name}")
+            if jwt:
+                return self._get_dg_token_via_jwt(jwt, profile_name)
+        except Exception:
+            pass
+
+        # Legacy path: direct API key in keyring (--api-key login, old device flow).
         try:
             api_key = keyring.get_password(KEYRING_SERVICE, f"api-key.{profile_name}")
             if api_key:
                 return api_key
         except Exception:
-            pass  # Keyring not available or error
+            pass
 
-        # Check config file
+        # Config file fallback (keyring unavailable on this machine).
         current_profile = self.config.get_profile(profile_name)
         if current_profile.api_key:
             return current_profile.api_key
 
-        # Environment variable has lowest priority
+        # Environment variable — lowest priority.
         if not ignore_env:
             api_key = os.getenv("DEEPGRAM_API_KEY")
             if api_key:
@@ -596,29 +616,76 @@ class AuthManager:
         raise AuthenticationError("Authentication timed out")
 
     def _store_token(self, token_response: TokenResponse) -> None:
-        """Store authentication token."""
-        # The access_token from dx-id is the Deepgram API key
-        api_key = token_response.access_token
-        project_id = token_response.project_id
+        """Store authentication token.
 
+        Handles two server response shapes:
+        - New JWT flow: access_token is a short-lived JWT (expires_in=900),
+          refresh_token present. Stores JWT + refresh_token in keyring.
+        - Legacy flow: access_token is a Deepgram API key directly.
+          Stored under api-key.{profile} as before.
+        """
         profile_name = self.config.profile or "default"
-        keyring_available = False
 
-        try:
-            keyring.set_password(KEYRING_SERVICE, f"api-key.{profile_name}", api_key)
-            # Don't store project ID in keyring - it goes in profile config only
-            console.print("[green]✓[/green] API key stored securely in system keyring")
-            keyring_available = True
-        except Exception as e:
-            console.print(f"[yellow]Warning:[/yellow] Could not store in keyring: {e}")
-            console.print("API key will be stored in config file instead")
+        if token_response.refresh_token:
+            # New JWT-based device flow.
+            jwt = token_response.access_token
+            refresh_token = token_response.refresh_token
+            expires_in = token_response.expires_in or 900
+            expires_at = (
+                datetime.now(timezone.utc) + timedelta(seconds=expires_in)
+            ).isoformat()
 
-        # Update config - only store API key if keyring is not available
-        self.config.create_profile(
-            profile_name,
-            api_key=api_key if not keyring_available else None,
-            project_id=project_id,  # Always store project ID in config
-        )
+            try:
+                # Clear any stale direct API key so get_api_key() doesn't
+                # return a cached dg_token from a previous session.
+                keyring.delete_password(KEYRING_SERVICE, f"api-key.{profile_name}")
+            except Exception:
+                pass
+
+            try:
+                keyring.set_password(KEYRING_SERVICE, f"jwt.{profile_name}", jwt)
+                keyring.set_password(
+                    KEYRING_SERVICE, f"refresh-token.{profile_name}", refresh_token
+                )
+                console.print(
+                    "[green]✓[/green] Session stored securely in system keyring"
+                )
+            except Exception as e:
+                console.print(
+                    f"[yellow]Warning:[/yellow] Could not store in keyring: {e}"
+                )
+
+            # Store expiry timestamps and project ID in config (non-sensitive).
+            profile = self.config.get_profile(profile_name)
+            profile.jwt_expires_at = expires_at
+            profile.project_id = token_response.project_id
+            self.config.save()
+
+        else:
+            # Legacy flow: access_token is the Deepgram API key directly.
+            api_key = token_response.access_token
+            project_id = token_response.project_id
+            keyring_available = False
+
+            try:
+                keyring.set_password(
+                    KEYRING_SERVICE, f"api-key.{profile_name}", api_key
+                )
+                console.print(
+                    "[green]✓[/green] API key stored securely in system keyring"
+                )
+                keyring_available = True
+            except Exception as e:
+                console.print(
+                    f"[yellow]Warning:[/yellow] Could not store in keyring: {e}"
+                )
+                console.print("API key will be stored in config file instead")
+
+            self.config.create_profile(
+                profile_name,
+                api_key=api_key if not keyring_available else None,
+                project_id=project_id,
+            )
 
     def logout(self, keep_config: bool = False) -> None:
         """Logout user and clear credentials.
@@ -629,12 +696,17 @@ class AuthManager:
         """
         profile_name = self.config.profile or "default"
 
-        # Clear keyring (API key only)
-        try:
-            keyring.delete_password(KEYRING_SERVICE, f"api-key.{profile_name}")
-            console.print("[dim]Cleared API key from system keyring[/dim]")
-        except Exception:
-            pass  # Ignore errors if not stored
+        # Clear all credential types from keyring.
+        for keyring_key in (
+            f"api-key.{profile_name}",
+            f"jwt.{profile_name}",
+            f"refresh-token.{profile_name}",
+        ):
+            try:
+                keyring.delete_password(KEYRING_SERVICE, keyring_key)
+            except Exception:
+                pass
+        console.print("[dim]Cleared credentials from system keyring[/dim]")
 
         if keep_config:
             # Clear sensitive data from config but keep profile
@@ -687,6 +759,120 @@ class AuthManager:
             current_profile=self.config.profile or self.config._config.default_profile,
         )
 
+    def _get_dg_token_via_jwt(self, jwt: str, profile_name: str) -> str:
+        """Return a valid Deepgram API token, refreshing as needed.
+
+        Checks the cached dg_token first; refreshes the JWT if expired; then
+        exchanges the JWT for a fresh dg_token when the cached one is stale.
+        """
+        profile = self.config.get_profile(profile_name)
+        now = datetime.now(timezone.utc)
+
+        # Return cached dg_token if it is still valid.
+        try:
+            dg_token = keyring.get_password(KEYRING_SERVICE, f"api-key.{profile_name}")
+            if dg_token and profile.dg_token_expires_at:
+                expires = datetime.fromisoformat(profile.dg_token_expires_at)
+                if now < expires:
+                    return dg_token
+        except Exception:
+            pass
+
+        # Refresh the JWT if it has expired.
+        current_jwt = jwt
+        if profile.jwt_expires_at:
+            jwt_expires = datetime.fromisoformat(profile.jwt_expires_at)
+            if now >= jwt_expires:
+                current_jwt = self._refresh_jwt(profile_name)
+
+        return self._exchange_for_dg_token(current_jwt, profile_name)
+
+    def _refresh_jwt(self, profile_name: str) -> str:
+        """Exchange a refresh token for a new JWT."""
+        try:
+            refresh_token = keyring.get_password(
+                KEYRING_SERVICE, f"refresh-token.{profile_name}"
+            )
+        except Exception:
+            refresh_token = None
+
+        if not refresh_token:
+            raise AuthenticationError(
+                "Session expired and no refresh token is available. "
+                "Please run 'dg login' again."
+            )
+
+        try:
+            response = self.client.post(
+                TOKEN_REFRESH_URL,
+                json={"grant_type": "refresh_token", "refresh_token": refresh_token},
+            )
+        except httpx.RequestError as e:
+            raise AuthenticationError(f"Network error during token refresh: {e}")
+
+        if response.status_code not in (200, 201):
+            raise AuthenticationError(
+                f"Token refresh failed (HTTP {response.status_code}). "
+                "Please run 'dg login' again."
+            )
+
+        data = response.json()
+        new_jwt: str = data["access_token"]
+        new_refresh: str = data.get("refresh_token", refresh_token)
+        expires_in: int = data.get("expires_in", 900)
+        expires_at = (
+            datetime.now(timezone.utc) + timedelta(seconds=expires_in)
+        ).isoformat()
+
+        try:
+            keyring.set_password(KEYRING_SERVICE, f"jwt.{profile_name}", new_jwt)
+            if new_refresh != refresh_token:
+                keyring.set_password(
+                    KEYRING_SERVICE, f"refresh-token.{profile_name}", new_refresh
+                )
+        except Exception:
+            pass
+
+        profile = self.config.get_profile(profile_name)
+        profile.jwt_expires_at = expires_at
+        self.config.save()
+
+        return new_jwt
+
+    def _exchange_for_dg_token(self, jwt: str, profile_name: str) -> str:
+        """Exchange a JWT for a Deepgram API token (dg_token)."""
+        try:
+            response = self.client.post(
+                DG_CREDENTIALS_URL,
+                headers={"Authorization": f"Bearer {jwt}"},
+            )
+        except httpx.RequestError as e:
+            raise AuthenticationError(f"Network error during credentials exchange: {e}")
+
+        if response.status_code not in (200, 201):
+            raise AuthenticationError(
+                f"Credentials exchange failed (HTTP {response.status_code}). "
+                "Please run 'dg login' again."
+            )
+
+        data = response.json()
+        dg_token: str = data["dg_token"]
+        expires_in: int = data.get("expires_in", 86400)
+        expires_at = (
+            datetime.now(timezone.utc) + timedelta(seconds=expires_in)
+        ).isoformat()
+
+        try:
+            keyring.set_password(KEYRING_SERVICE, f"api-key.{profile_name}", dg_token)
+        except Exception:
+            pass  # Non-fatal: will re-exchange next time
+
+        profile = self.config.get_profile(profile_name)
+        profile.dg_token_expires_at = expires_at
+        self.config.save()
+
+        return dg_token
+
     def __del__(self) -> None:
         """Cleanup HTTP client."""
         if hasattr(self, "client"):

{deepctl_core-0.2.7 → deepctl_core-0.2.9}/src/deepctl_core/config.py

@@ -15,6 +15,10 @@ class ProfileConfig(BaseModel):
     api_key: str | None = None
     project_id: str | None = None
     base_url: str = "https://api.deepgram.com"
+    # JWT-based auth (device flow with new server): expiry timestamps stored
+    # here (non-sensitive); the tokens themselves live in the keyring.
+    jwt_expires_at: str | None = None
+    dg_token_expires_at: str | None = None
 
 
 class OutputConfig(BaseModel):

{deepctl_core-0.2.7 → deepctl_core-0.2.9}/src/deepctl_core/plugin_env.py

@@ -96,6 +96,45 @@ def get_venv_python() -> str | None:
     return str(python) if python.exists() else None
 
 
+def get_venv_python_version() -> tuple[int, int] | None:
+    """Read the (major, minor) Python version that built the plugin venv.
+
+    Reads ``pyvenv.cfg`` from :data:`PLUGIN_VENV`. Both ``version`` (stdlib
+    ``python -m venv``) and ``version_info`` (uv-created venvs) are accepted.
+
+    Returns ``None`` when the venv doesn't exist, the cfg file is missing,
+    or the version line can't be parsed — callers should treat ``None`` as
+    "unknown" and skip ABI-mismatch checks rather than failing loudly.
+    """
+    if not PLUGIN_VENV.exists():
+        return None
+
+    cfg = PLUGIN_VENV / "pyvenv.cfg"
+    if not cfg.exists():
+        return None
+
+    try:
+        text = cfg.read_text()
+    except OSError:
+        return None
+
+    for line in text.splitlines():
+        key, sep, value = line.partition("=")
+        if not sep:
+            continue
+        if key.strip() not in ("version", "version_info"):
+            continue
+        parts = value.strip().split(".")
+        if len(parts) < 2:
+            continue
+        try:
+            return int(parts[0]), int(parts[1])
+        except ValueError:
+            continue
+
+    return None
+
+
 def get_venv_site_packages() -> Path | None:
     """Return the ``site-packages`` directory inside the plugin venv.
 

{deepctl_core-0.2.7 → deepctl_core-0.2.9}/src/deepctl_core/plugin_manager.py

@@ -12,7 +12,13 @@ from rich.console import Console
 from .base_command import BaseCommand
 from .base_group_command import BaseGroupCommand
 from .models import ErrorResult, PluginInfo
-from .plugin_env import PLUGIN_VENV, get_plugin_state, get_venv_site_packages
+from .output import print_warning
+from .plugin_env import (
+    PLUGIN_VENV,
+    get_plugin_state,
+    get_venv_python_version,
+    get_venv_site_packages,
+)
 from .timing import TimingContext
 
 console = Console()
@@ -139,6 +145,8 @@ class PluginManager:
         if site_packages is None:
             return
 
+        self._warn_if_plugin_venv_python_mismatch()
+
         site_packages_str = str(site_packages)
 
         # Append to sys.path so modules inside the plugin venv can be imported.
@@ -186,6 +194,36 @@ class PluginManager:
         except Exception as e:
             console.print(f"[red]Error loading plugins from plugin venv:[/red] {e}")
 
+    def _warn_if_plugin_venv_python_mismatch(self) -> None:
+        """Surface a one-line warning when the plugin venv's Python differs from ours.
+
+        Triggered when the underlying interpreter is bumped (e.g. ``brew upgrade
+        python@3.13`` rebuilding deepctl against a newer Python) without the user
+        recreating ``~/.deepctl/plugins/venv/``. Pure-Python plugins keep loading
+        via :data:`sys.path` bridging; only C-extension plugins fail to load,
+        and they fail with a confusing low-level ImportError. This warning gives
+        users a clear remediation before they hit that error.
+
+        Silent when the venv version can't be determined (no ``pyvenv.cfg``,
+        unparseable cfg, etc.) — there's no useful guidance to give.
+        """
+        venv_version = get_venv_python_version()
+        if venv_version is None:
+            return
+
+        running = (sys.version_info.major, sys.version_info.minor)
+        if venv_version == running:
+            return
+
+        venv_str = f"{venv_version[0]}.{venv_version[1]}"
+        running_str = f"{running[0]}.{running[1]}"
+        print_warning(
+            f"Plugin environment was built with Python {venv_str} but you're "
+            f"running Python {running_str}. C-extension plugins may fail to "
+            f"load. To rebuild:\n"
+            f"  rm -rf {PLUGIN_VENV} && dg plugin install <your-plugin>"
+        )
+
     def _create_click_command(self, command_instance: Any) -> click.Command:
         """Create a Click command from a BaseCommand instance.
 

{deepctl_core-0.2.7 → deepctl_core-0.2.9}/src/deepctl_core.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deepctl-core
-Version: 0.2.7
+Version: 0.2.9
 Summary: Core components for deepctl
 Author-email: Deepgram <devrel@deepgram.com>
 Maintainer-email: Deepgram <devrel@deepgram.com>