dh-cli 0.13.1__tar.gz → 0.14.0__tar.gz

{dh_cli-0.13.1 → dh_cli-0.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: dh-cli
-Version: 0.13.1
+Version: 0.14.0
 Summary: Dayhoff Labs developer CLI
 Author-email: Dayhoff Labs <dev@dayhofflabs.com>
 License: # PolyForm Noncommercial License 1.0.0
@@ -131,11 +131,13 @@ Requires-Dist: pydantic>=2.0.0
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: questionary>=2.0.1
 Requires-Dist: requests>=2.31.0
-Requires-Dist: toml>=0.10
 Requires-Dist: typer>=0.9.0
 Provides-Extra: h5
 Requires-Dist: h5py>=3.0; extra == 'h5'
 Requires-Dist: numpy>=1.24; extra == 'h5'
+Provides-Extra: mcp
+Requires-Dist: httpx>=0.27; extra == 'mcp'
+Requires-Dist: mcp>=2.2; extra == 'mcp'
 Description-Content-Type: text/markdown
 
 # dh-cli

{dh_cli-0.13.1 → dh_cli-0.14.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "dh-cli"
-version = "0.13.1"
+version = "0.14.0"
 description = "Dayhoff Labs developer CLI"
 requires-python = ">=3.11"
 readme = "README.md"
@@ -20,12 +20,12 @@ dependencies = [
     "pyyaml>=6.0",
     "questionary>=2.0.1",
     "requests>=2.31.0",
-    "toml>=0.10",
     "typer>=0.9.0",
 ]
 
 [project.optional-dependencies]
 h5 = ["h5py>=3.0", "numpy>=1.24"]
+mcp = ["mcp>=2.2", "httpx>=0.27"]
 
 [project.scripts]
 dh = "dh_cli.main:app"

{dh_cli-0.13.1 → dh_cli-0.14.0}/src/dh_cli/github_commands.py

@@ -41,6 +41,12 @@ NC = "\033[0m"
 MAX_PAT_AGE_DAYS = 90
 WARN_PAT_AGE_DAYS = 87
 
+# Account that holds the github-pat/* secrets (dev). Used only to turn a
+# ResourceNotFound into a "you're in the wrong account" diagnosis; the
+# authoritative grant is the per-secret resource policy in
+# blueprints/terraform/environments/dev/github_pat_secrets.tf.
+PAT_ACCOUNT_ID = "074735440724"
+
 # Path to the gh hosts file (resolved at call time via Path.home()).
 _HOSTS_YML_RELATIVE = Path(".config") / "gh" / "hosts.yml"
 
@@ -178,6 +184,46 @@ def _access_denied_diagnosis(session, requested_handle: str) -> None:
     raise typer.Exit(1)
 
 
+def _not_found_diagnosis(session, secret_id: str) -> None:
+    """Explain a ResourceNotFound on the PAT secret. Always exits 1.
+
+    A not-found is far more often a wrong-account session than
+    un-provisioned Terraform: `awslogin <admin-profile>` persists
+    AWS_PROFILE into ~/.bashrc, so every subsequent shell talks to that
+    account, where `github-pat/*` genuinely does not exist. Name the
+    account mismatch before sending anyone to an admin.
+    """
+    try:
+        arn = session.client("sts").get_caller_identity()["Arn"]
+        # arn:aws:sts::<account>:assumed-role/... — account is field 4.
+        # Parsed from the ARN rather than GetCallerIdentity's "Account"
+        # because the ARN is the identity fact this module already
+        # trusts for handle resolution (see _identity.py).
+        account = arn.split(":")[4]
+    except Exception:  # noqa: BLE001 — diagnosis must not mask the original error
+        account = ""
+
+    if account and account != PAT_ACCOUNT_ID:
+        typer.echo(
+            RED
+            + f"Secret `{secret_id}` not found — your session is in account "
+            + f"{account}, but GitHub PATs live in {PAT_ACCOUNT_ID} (dev). "
+            + "Run `awslogin dev-devaccess` and retry."
+            + NC,
+            err=True,
+        )
+    else:
+        typer.echo(
+            RED
+            + f"GitHub PAT secret `{secret_id}` does not exist. "
+            + "Ask an admin to run the Terraform that provisions "
+            + "per-developer github_pat_secrets."
+            + NC,
+            err=True,
+        )
+    raise typer.Exit(1)
+
+
 def _fetch_pat_and_metadata(session, handle: str) -> Tuple[str, dt.datetime]:
     """Fetch the PAT and its CreatedDate from Secrets Manager.
 
@@ -192,15 +238,7 @@ def _fetch_pat_and_metadata(session, handle: str) -> Tuple[str, dt.datetime]:
     try:
         describe = sm.describe_secret(SecretId=secret_id)
     except sm.exceptions.ResourceNotFoundException:
-        typer.echo(
-            RED
-            + f"GitHub PAT secret `{secret_id}` does not exist. "
-            + "Ask an admin to run the Terraform that provisions "
-            + "per-developer github_pat_secrets."
-            + NC,
-            err=True,
-        )
-        raise typer.Exit(1)
+        _not_found_diagnosis(session, secret_id)
     except botocore.exceptions.ClientError as exc:
         code = exc.response.get("Error", {}).get("Code", "")
         if code == "AccessDeniedException":
@@ -623,15 +661,7 @@ def gh_rotate(
     try:
         describe = sm.describe_secret(SecretId=secret_id)
     except sm.exceptions.ResourceNotFoundException:
-        typer.echo(
-            RED
-            + f"GitHub PAT secret `{secret_id}` does not exist. "
-            + "Ask an admin to run the Terraform that provisions "
-            + "per-developer github_pat_secrets."
-            + NC,
-            err=True,
-        )
-        raise typer.Exit(1)
+        _not_found_diagnosis(session, secret_id)
     except botocore.exceptions.ClientError as exc:
         code = exc.response.get("Error", {}).get("Code", "")
         if code == "AccessDeniedException":

{dh_cli-0.13.1 → dh_cli-0.14.0}/src/dh_cli/hz/__init__.py

@@ -95,6 +95,43 @@ def run_script(script: Path, args: list[str] | None = None, cwd: Path | None = N
         raise typer.Exit(result.returncode)
 
 
+@hz_app.command()
+def login(
+    email: str | None = typer.Option(None, "--email", help="Login email (prompted if omitted)."),
+):
+    """Log in to Horizyn (prod) with an emailed code; saves credentials for `dh hz mcp serve`."""
+    from dh_cli.hz.auth import credentials_path
+    from dh_cli.hz.auth import login as _login
+
+    try:
+        creds = _login(email)
+    except RuntimeError as exc:
+        typer.echo(f"Error: {exc}", err=True)
+        raise typer.Exit(1)
+    typer.echo(f"Logged in as {creds.email}. Credentials saved to {credentials_path()}", err=True)
+
+
+mcp_app = typer.Typer(help="Horizyn MCP server for agent clients (Cursor, Codex, Claude Code).")
+
+
+@mcp_app.command()
+def serve():
+    """Run the Horizyn MCP server over stdio. Run `dh hz login` first."""
+    try:
+        import httpx  # noqa: F401
+        import mcp  # noqa: F401
+    except ImportError:
+        typer.echo(
+            "The Horizyn MCP server needs the 'mcp' extra: pip install 'dh-cli[mcp]'",
+            err=True,
+        )
+        raise typer.Exit(1)
+
+    from dh_cli.hz.mcp_server import server
+
+    server.run(transport="stdio")
+
+
 from dh_cli.hz.deploy import deploy_app  # noqa: E402
 from dh_cli.hz.local import local_app  # noqa: E402
 from dh_cli.hz.test import test_app  # noqa: E402
@@ -106,3 +143,4 @@ hz_app.add_typer(deploy_app, name="deploy", help="Deploy API, docking, or fronte
 hz_app.add_typer(local_app, name="local", help="Run local development servers.")
 hz_app.add_typer(test_app, name="test", help="Run integration test suites.")
 hz_app.add_typer(tf_app, name="tf", help="Terraform apply for Horizyn infrastructure.")
+hz_app.add_typer(mcp_app, name="mcp", help="Horizyn MCP server for agent clients.")

dh_cli-0.14.0/src/dh_cli/hz/auth.py

@@ -0,0 +1,162 @@
+"""Horizyn credentials: Cognito passwordless login, storage, and silent refresh.
+
+Prod only. Credentials live in ``~/.horizyn/credentials_prod.json`` (0600) and
+hold the ID token, the refresh token, and the login email. Port of
+``horizyn-api/test/server/deployed/get_jwt_token.py`` without the env switch.
+"""
+
+import base64
+import json
+import os
+import sys
+import time
+from dataclasses import asdict, dataclass
+from pathlib import Path
+
+import boto3
+from botocore.exceptions import BotoCoreError, ClientError
+
+REGION = "us-east-1"
+CLIENT_ID = "4bqudnqan63iur9fi8224m2pee"
+REFRESH_MARGIN_S = 300
+
+
+def credentials_path() -> Path:
+    return Path.home() / ".horizyn" / "credentials_prod.json"
+
+
+class NotLoggedIn(Exception):
+    def __init__(self, detail: str = ""):
+        msg = "Not logged in to Horizyn: run `dh hz login`"
+        super().__init__(f"{msg} ({detail})" if detail else msg)
+
+
+@dataclass
+class Credentials:
+    id_token: str
+    refresh_token: str
+    email: str
+
+    @classmethod
+    def load(cls, path: Path | None = None) -> "Credentials":
+        path = path or credentials_path()
+        try:
+            data = json.loads(path.read_text())
+        except FileNotFoundError:
+            raise NotLoggedIn("no credentials file") from None
+        return cls(
+            id_token=data.get("id_token", ""),
+            refresh_token=data.get("refresh_token", ""),
+            email=data.get("email", ""),
+        )
+
+    def save(self, path: Path | None = None) -> None:
+        path = path or credentials_path()
+        path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+        path.parent.chmod(0o700)
+        fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+        with os.fdopen(fd, "w") as f:
+            json.dump(asdict(self), f, indent=2)
+        path.chmod(0o600)
+
+
+def _jwt_claims(token: str) -> dict:
+    """Decode a JWT payload without verifying it. Returns {} if undecodable."""
+    try:
+        payload = token.split(".")[1]
+        payload += "=" * (-len(payload) % 4)
+        claims = json.loads(base64.urlsafe_b64decode(payload))
+    except (IndexError, ValueError):
+        return {}
+    return claims if isinstance(claims, dict) else {}
+
+
+def _cognito():
+    return boto3.client("cognito-idp", region_name=REGION)
+
+
+def get_id_token(path: Path | None = None) -> str:
+    """Return a valid ID token, refreshing via Cognito when it is about to expire."""
+    creds = Credentials.load(path)
+    exp = _jwt_claims(creds.id_token).get("exp", 0)
+    if exp - REFRESH_MARGIN_S > time.time():
+        return creds.id_token
+    if not creds.refresh_token:
+        raise NotLoggedIn("no refresh token")
+
+    try:
+        response = _cognito().initiate_auth(
+            ClientId=CLIENT_ID,
+            AuthFlow="REFRESH_TOKEN_AUTH",
+            AuthParameters={"REFRESH_TOKEN": creds.refresh_token},
+        )
+    except (ClientError, BotoCoreError) as exc:
+        raise NotLoggedIn(f"refresh failed: {type(exc).__name__}") from None
+
+    result = response.get("AuthenticationResult") or {}
+    id_token = result.get("IdToken")
+    if not id_token:
+        raise NotLoggedIn("refresh returned no token")
+    creds.id_token = id_token
+    if result.get("RefreshToken"):
+        creds.refresh_token = result["RefreshToken"]
+    creds.save(path)
+    return id_token
+
+
+def _prompt(text: str) -> str:
+    print(text, end="", file=sys.stderr, flush=True)
+    return input().strip()
+
+
+def login(email: str | None = None, path: Path | None = None) -> Credentials:
+    """Interactive CUSTOM_AUTH login: email → emailed code → tokens saved to disk.
+
+    Prompts go to stderr. Raises RuntimeError with a user-facing message on failure.
+    """
+    if not email:
+        email = _prompt("Email address: ")
+    if not email:
+        raise RuntimeError("Email address is required")
+
+    cognito = _cognito()
+    print(f"Sending verification code to {email}...", file=sys.stderr)
+    try:
+        response = cognito.initiate_auth(
+            ClientId=CLIENT_ID,
+            AuthFlow="CUSTOM_AUTH",
+            AuthParameters={"USERNAME": email},
+        )
+    except ClientError as exc:
+        raise RuntimeError(f"Could not start login: {_client_error(exc)}") from None
+
+    code = _prompt("Enter the 6-digit verification code: ")
+    if len(code) != 6 or not code.isdigit():
+        raise RuntimeError("Please enter a valid 6-digit code")
+
+    try:
+        response = cognito.respond_to_auth_challenge(
+            ClientId=CLIENT_ID,
+            ChallengeName="CUSTOM_CHALLENGE",
+            Session=response["Session"],
+            ChallengeResponses={"ANSWER": code, "USERNAME": email},
+        )
+    except ClientError as exc:
+        raise RuntimeError(f"Verification failed: {_client_error(exc)}") from None
+
+    result = response.get("AuthenticationResult") or {}
+    if not result.get("IdToken") or not result.get("RefreshToken"):
+        raise RuntimeError("Authentication did not complete; try again")
+
+    creds = Credentials(
+        id_token=result["IdToken"],
+        refresh_token=result["RefreshToken"],
+        email=_jwt_claims(result["IdToken"]).get("email") or email,
+    )
+    creds.save(path)
+    return creds
+
+
+def _client_error(exc: ClientError) -> str:
+    err = exc.response.get("Error", {})
+    return f"{err.get('Code', 'Unknown')} - {err.get('Message', str(exc))}"

dh_cli-0.14.0/src/dh_cli/hz/mcp_server.py

@@ -0,0 +1,200 @@
+"""Horizyn MCP server over stdio (`dh hz mcp serve`). Prod only.
+
+Every request carries the logged-in user's own Cognito ID token, so queries
+land in that user's Horizyn history. Requires the ``mcp`` extra:
+``pip install 'dh-cli[mcp]'``.
+"""
+
+from importlib.metadata import version
+
+import httpx
+from mcp.server.mcpserver import MCPServer
+from mcp.server.mcpserver.exceptions import ToolError
+from mcp.types import ToolAnnotations
+
+from dh_cli.hz import API_URLS
+from dh_cli.hz.auth import NotLoggedIn, get_id_token
+
+CLIENT_HEADER = f"mcp/{version('dh-cli')}"
+_READ_ONLY = ToolAnnotations(read_only_hint=True)
+
+server = MCPServer(
+    "horizyn",
+    instructions=(
+        "Horizyn: Dayhoff Labs' enzyme and reaction similarity search. Tools query "
+        "production as the logged-in user (`dh hz login`). Similarity scores are "
+        "cosine similarities in [0, 1]; higher means more similar."
+    ),
+)
+
+_client = httpx.Client(base_url=API_URLS["prod"], timeout=120)
+
+
+def _request(method: str, path: str, **kwargs) -> dict:
+    try:
+        token = get_id_token()
+    except NotLoggedIn as exc:
+        raise ToolError(str(exc)) from None
+
+    headers = {"Authorization": f"Bearer {token}", "X-Horizyn-Client": CLIENT_HEADER}
+    try:
+        resp = _client.request(method, path, headers=headers, **kwargs)
+    except httpx.HTTPError as exc:
+        raise ToolError(f"Horizyn request failed: {type(exc).__name__}: {exc}") from None
+
+    if resp.status_code == 503:
+        raise ToolError("Horizyn is starting or unavailable, retry shortly")
+    if resp.status_code >= 400:
+        raise ToolError(_error_text(resp))
+    return resp.json()
+
+
+def _error_text(resp: httpx.Response) -> str:
+    try:
+        body = resp.json()
+    except ValueError:
+        body = {}
+    if not isinstance(body, dict):
+        body = {}
+    parts = [p for p in (body.get("error"), body.get("message")) if p]
+    detail = body.get("detail")
+    if isinstance(detail, str):
+        parts.append(detail)
+    elif isinstance(detail, list):
+        # FastAPI validation errors; take loc + msg only, never the echoed `input`.
+        for err in detail:
+            if isinstance(err, dict) and err.get("msg"):
+                loc = ".".join(str(x) for x in err.get("loc", []) if x != "body")
+                parts.append(f"{loc}: {err['msg']}" if loc else err["msg"])
+    text = "; ".join(parts) if parts else resp.reason_phrase
+    return f"Horizyn returned {resp.status_code}: {text}"
+
+
+def _query(path: str, body: dict, filters: dict) -> dict:
+    body.update({k: v for k, v in filters.items() if v is not None})
+    data = _request("POST", path, json=body)
+    data.pop("timings_ms", None)
+    data.pop("tsne", None)
+    return data
+
+
+@server.tool(annotations=_READ_ONLY)
+def horizyn_whoami() -> dict:
+    """Identify the logged-in Horizyn user.
+
+    Returns email, tier (admin, alpha, or beta) and the feature flags that tier
+    grants. Use this first to confirm the server is authenticated.
+    """
+    return _request("GET", "/me")
+
+
+@server.tool(annotations=_READ_ONLY)
+def horizyn_list_screening_sets(screening_set_type: str | None = None) -> dict:
+    """List the screening sets available for similarity queries.
+
+    Each entry gives the set's id, type (protein or reaction), size, model
+    version and whether it is the current default (`is_default`).
+    `screening_set_type` optionally filters to "protein" or "reaction".
+    """
+    params = {"screening_set_type": screening_set_type} if screening_set_type else None
+    return _request("GET", "/screening_sets", params=params)
+
+
+@server.tool(annotations=_READ_ONLY)
+def horizyn_query_reaction(
+    smiles: str,
+    screening_set: str | None = None,
+    top_k: int = 50,
+    page: int = 1,
+    page_size: int = 20,
+    ec_include: list[str] | None = None,
+    ec_exclude: list[str] | None = None,
+    tc_include: list[str] | None = None,
+    tc_exclude: list[str] | None = None,
+    cofactor_include: list[str] | None = None,
+    cofactor_exclude: list[str] | None = None,
+    min_length: int | None = None,
+    max_length: int | None = None,
+) -> dict:
+    """Find proteins (or reactions) similar to a reaction SMILES.
+
+    `smiles` is a reaction SMILES such as "CC=O.O>>CC(O)O". When
+    `screening_set` is omitted Horizyn searches its current default protein set
+    (the response's `screening_set` names it; see horizyn_list_screening_sets).
+    Pass a reaction set such as horizyn_v1_1_rxns to find similar reactions
+    instead. `score` on each result is the cosine similarity between the query
+    and the hit in Horizyn's embedding space (0-1, higher is more similar).
+    `top_k` (max 1000) bounds the similarity search; `page`/`page_size`
+    paginate the result list.
+
+    All filters are optional. `ec_include`/`ec_exclude` and
+    `tc_include`/`tc_exclude` take hierarchical prefixes ("1", "1.1", "1.1.1",
+    "1.1.1.1"; "__NONE__" matches unannotated). `cofactor_include`/
+    `cofactor_exclude` take cofactor names ("NAD", "Zn"; "__ANY__"/"__NONE__").
+    `min_length`/`max_length` bound sequence length. `filter_stats` in the
+    response reports how many hits the filters kept.
+    """
+    body = {"smiles": smiles, "top_k": top_k, "page": page, "page_size": page_size}
+    filters = {
+        "screening_set": screening_set,
+        "ec_include": ec_include,
+        "ec_exclude": ec_exclude,
+        "tc_include": tc_include,
+        "tc_exclude": tc_exclude,
+        "cofactor_include": cofactor_include,
+        "cofactor_exclude": cofactor_exclude,
+        "min_length": min_length,
+        "max_length": max_length,
+    }
+    return _query("/query/reaction", body, filters)
+
+
+@server.tool(annotations=_READ_ONLY)
+def horizyn_query_protein(
+    sequence: str,
+    screening_set: str | None = None,
+    top_k: int = 50,
+    page: int = 1,
+    page_size: int = 20,
+    ec_include: list[str] | None = None,
+    ec_exclude: list[str] | None = None,
+    tc_include: list[str] | None = None,
+    tc_exclude: list[str] | None = None,
+    cofactor_include: list[str] | None = None,
+    cofactor_exclude: list[str] | None = None,
+    min_length: int | None = None,
+    max_length: int | None = None,
+) -> dict:
+    """Find proteins (or reactions) similar to a protein sequence.
+
+    `sequence` is a one-letter amino-acid string. Same screening sets, scoring,
+    pagination and optional filters as horizyn_query_reaction: `score` is the
+    cosine similarity (0-1) in Horizyn's shared reaction/protein embedding
+    space, omitting `screening_set` searches Horizyn's current default protein
+    set, and every filter argument may be omitted.
+    """
+    body = {"sequence": sequence, "top_k": top_k, "page": page, "page_size": page_size}
+    filters = {
+        "screening_set": screening_set,
+        "ec_include": ec_include,
+        "ec_exclude": ec_exclude,
+        "tc_include": tc_include,
+        "tc_exclude": tc_exclude,
+        "cofactor_include": cofactor_include,
+        "cofactor_exclude": cofactor_exclude,
+        "min_length": min_length,
+        "max_length": max_length,
+    }
+    return _query("/query/protein", body, filters)
+
+
+@server.tool(annotations=_READ_ONLY)
+def horizyn_protein_details(protein_id: str, screening_set: str) -> dict:
+    """Get full details for one protein from a screening set.
+
+    `protein_id` is the `id` returned by a query and `screening_set` is the
+    `screening_set` echoed in that query's response (the id is only meaningful
+    within its set). Returns name, organism, EC numbers, cofactors, expression
+    score, full sequence, length, AlphaFold id and any extra metadata.
+    """
+    return _request("GET", f"/protein/{protein_id}/details", params={"screening_set": screening_set})

{dh_cli-0.13.1 → dh_cli-0.14.0}/src/dh_cli/main.py

@@ -7,7 +7,6 @@ import typer
 from dh_cli.cloud_commands import aws_app, gcp_app
 from dh_cli.github_commands import gh_app
 from dh_cli.sweep import sweep
-from dh_cli.utility_commands import build_and_upload_wheel
 from dh_cli.warehouse import get_from_warehouse_typer
 
 
@@ -112,7 +111,7 @@ def _version_option(
 @app.command("wheel")
 def wheel_command(
     target: str = typer.Argument(
-        help="What to publish: 'cli', 'batch', 'embedders', 'chem', or 'legacy' (PyPI).",
+        help="What to publish: 'cli', 'batch', 'embedders', or 'chem'.",
     ),
     bump: str = typer.Option(
         "patch",
@@ -146,7 +145,6 @@ def wheel_command(
       batch      Build and publish dh-batch to CodeArtifact
       embedders  Build and publish dh-embedders to CodeArtifact
       chem       Build and publish dh-chem to CodeArtifact
-      legacy     Build and publish dayhoff-tools to PyPI (default)
     """
     from dh_cli.codeartifact import PACKAGE_DIRS
 
@@ -160,10 +158,8 @@ def wheel_command(
             dry_run=dry_run,
             skip_pypi=no_pypi,
         )
-    elif target == "legacy":
-        build_and_upload_wheel(bump_part=bump)
     else:
-        typer.echo(f"Unknown target '{target}'. Use 'cli', 'batch', 'embedders', 'chem', or 'legacy'.")
+        typer.echo(f"Unknown target '{target}'. Use 'cli', 'batch', 'embedders', or 'chem'.")
         raise typer.Exit(1)
 
 

{dh_cli-0.13.1 → dh_cli-0.14.0}/tests/github/test_login_error_paths.py

@@ -80,6 +80,36 @@ def test_login_secret_not_found_tells_user_to_ask_admin(fake_subprocess, patch_g
     assert "--init" not in combined
 
 
+def test_login_secret_not_found_in_wrong_account_says_wrong_account(fake_subprocess, patch_gh_path, tmp_hosts_yml):
+    """A not-found in a non-dev account is a wrong-profile error.
+
+    Regression: `awslogin admin-secadmin` persists AWS_PROFILE into
+    ~/.bashrc, so every later shell talks to the admin account, where
+    github-pat/* genuinely does not exist. The old message blamed
+    un-provisioned Terraform and sent the user to an admin.
+    """
+    session = make_session(arn="arn:aws:sts::293882909581:assumed-role/AWSReservedSSO_SecurityAdministrator_abc123/dma")
+    err_response = {
+        "Error": {
+            "Code": "ResourceNotFoundException",
+            "Message": "Secrets Manager can't find the specified secret.",
+        }
+    }
+    session._sm.describe_secret.side_effect = session._sm.exceptions.ResourceNotFoundException(
+        err_response, "DescribeSecret"
+    )
+
+    result = _invoke([], session=session, fake_subprocess=fake_subprocess)
+    assert result.exit_code != 0
+    combined = _all(result)
+    # Names both accounts so the user can see the mismatch.
+    assert "293882909581" in combined
+    assert "074735440724" in combined
+    # Points at the fix, not at an admin.
+    assert "awslogin dev-devaccess" in combined
+    assert "ask an admin" not in combined.lower()
+
+
 def test_login_empty_secret_suggests_rotate_init(fake_subprocess, patch_gh_path, tmp_hosts_yml):
     # Secret exists but no AWSCURRENT version — new-hire state.
     session = make_session(version_stages={})

dh_cli-0.14.0/tests/hz/live_smoke.py

@@ -0,0 +1,49 @@
+"""Live protocol smoke for `dh hz mcp serve`. Not collected by pytest.
+
+Spawns the server over stdio via pixi, lists tools, and calls horizyn_whoami
+against prod using the credentials from `dh hz login`.
+
+    cd dayhoff-tools && pixi run -e cpu python packages/dh-cli/tests/hz/live_smoke.py
+"""
+
+import json
+import sys
+from pathlib import Path
+
+import anyio
+from mcp.client.client import Client
+from mcp.client.stdio import StdioServerParameters
+
+MANIFEST = Path(__file__).resolve().parents[4] / "pixi.toml"
+EXPECTED = {
+    "horizyn_whoami",
+    "horizyn_list_screening_sets",
+    "horizyn_query_reaction",
+    "horizyn_query_protein",
+    "horizyn_protein_details",
+}
+
+
+async def main() -> int:
+    params = StdioServerParameters(
+        command="pixi",
+        args=["run", "--manifest-path", str(MANIFEST), "-e", "cpu", "dh", "hz", "mcp", "serve"],
+    )
+    async with Client(params) as client:
+        tools = await client.list_tools()
+        names = {t.name for t in tools.tools}
+        print("tools:", sorted(names))
+        assert names == EXPECTED, (names - EXPECTED, EXPECTED - names)
+
+        result = await client.call_tool("horizyn_whoami", {})
+        text = result.content[0].text
+        print("whoami:", text, "is_error:", result.is_error)
+        if result.is_error:
+            return 1
+        me = json.loads(text)
+        assert me.get("email"), me
+        return 0
+
+
+if __name__ == "__main__":
+    sys.exit(anyio.run(main))