dh-cli 0.13.3__tar.gz → 0.14.0__tar.gz

{dh_cli-0.13.3 → dh_cli-0.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: dh-cli
-Version: 0.13.3
+Version: 0.14.0
 Summary: Dayhoff Labs developer CLI
 Author-email: Dayhoff Labs <dev@dayhofflabs.com>
 License: # PolyForm Noncommercial License 1.0.0
@@ -135,6 +135,9 @@ Requires-Dist: typer>=0.9.0
 Provides-Extra: h5
 Requires-Dist: h5py>=3.0; extra == 'h5'
 Requires-Dist: numpy>=1.24; extra == 'h5'
+Provides-Extra: mcp
+Requires-Dist: httpx>=0.27; extra == 'mcp'
+Requires-Dist: mcp>=2.2; extra == 'mcp'
 Description-Content-Type: text/markdown
 
 # dh-cli

{dh_cli-0.13.3 → dh_cli-0.14.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "dh-cli"
-version = "0.13.3"
+version = "0.14.0"
 description = "Dayhoff Labs developer CLI"
 requires-python = ">=3.11"
 readme = "README.md"
@@ -25,6 +25,7 @@ dependencies = [
 
 [project.optional-dependencies]
 h5 = ["h5py>=3.0", "numpy>=1.24"]
+mcp = ["mcp>=2.2", "httpx>=0.27"]
 
 [project.scripts]
 dh = "dh_cli.main:app"

{dh_cli-0.13.3 → dh_cli-0.14.0}/src/dh_cli/hz/__init__.py

@@ -95,6 +95,43 @@ def run_script(script: Path, args: list[str] | None = None, cwd: Path | None = N
         raise typer.Exit(result.returncode)
 
 
+@hz_app.command()
+def login(
+    email: str | None = typer.Option(None, "--email", help="Login email (prompted if omitted)."),
+):
+    """Log in to Horizyn (prod) with an emailed code; saves credentials for `dh hz mcp serve`."""
+    from dh_cli.hz.auth import credentials_path
+    from dh_cli.hz.auth import login as _login
+
+    try:
+        creds = _login(email)
+    except RuntimeError as exc:
+        typer.echo(f"Error: {exc}", err=True)
+        raise typer.Exit(1)
+    typer.echo(f"Logged in as {creds.email}. Credentials saved to {credentials_path()}", err=True)
+
+
+mcp_app = typer.Typer(help="Horizyn MCP server for agent clients (Cursor, Codex, Claude Code).")
+
+
+@mcp_app.command()
+def serve():
+    """Run the Horizyn MCP server over stdio. Run `dh hz login` first."""
+    try:
+        import httpx  # noqa: F401
+        import mcp  # noqa: F401
+    except ImportError:
+        typer.echo(
+            "The Horizyn MCP server needs the 'mcp' extra: pip install 'dh-cli[mcp]'",
+            err=True,
+        )
+        raise typer.Exit(1)
+
+    from dh_cli.hz.mcp_server import server
+
+    server.run(transport="stdio")
+
+
 from dh_cli.hz.deploy import deploy_app  # noqa: E402
 from dh_cli.hz.local import local_app  # noqa: E402
 from dh_cli.hz.test import test_app  # noqa: E402
@@ -106,3 +143,4 @@ hz_app.add_typer(deploy_app, name="deploy", help="Deploy API, docking, or fronte
 hz_app.add_typer(local_app, name="local", help="Run local development servers.")
 hz_app.add_typer(test_app, name="test", help="Run integration test suites.")
 hz_app.add_typer(tf_app, name="tf", help="Terraform apply for Horizyn infrastructure.")
+hz_app.add_typer(mcp_app, name="mcp", help="Horizyn MCP server for agent clients.")

dh_cli-0.14.0/src/dh_cli/hz/auth.py

@@ -0,0 +1,162 @@
+"""Horizyn credentials: Cognito passwordless login, storage, and silent refresh.
+
+Prod only. Credentials live in ``~/.horizyn/credentials_prod.json`` (0600) and
+hold the ID token, the refresh token, and the login email. Port of
+``horizyn-api/test/server/deployed/get_jwt_token.py`` without the env switch.
+"""
+
+import base64
+import json
+import os
+import sys
+import time
+from dataclasses import asdict, dataclass
+from pathlib import Path
+
+import boto3
+from botocore.exceptions import BotoCoreError, ClientError
+
+REGION = "us-east-1"
+CLIENT_ID = "4bqudnqan63iur9fi8224m2pee"
+REFRESH_MARGIN_S = 300
+
+
+def credentials_path() -> Path:
+    return Path.home() / ".horizyn" / "credentials_prod.json"
+
+
+class NotLoggedIn(Exception):
+    def __init__(self, detail: str = ""):
+        msg = "Not logged in to Horizyn: run `dh hz login`"
+        super().__init__(f"{msg} ({detail})" if detail else msg)
+
+
+@dataclass
+class Credentials:
+    id_token: str
+    refresh_token: str
+    email: str
+
+    @classmethod
+    def load(cls, path: Path | None = None) -> "Credentials":
+        path = path or credentials_path()
+        try:
+            data = json.loads(path.read_text())
+        except FileNotFoundError:
+            raise NotLoggedIn("no credentials file") from None
+        return cls(
+            id_token=data.get("id_token", ""),
+            refresh_token=data.get("refresh_token", ""),
+            email=data.get("email", ""),
+        )
+
+    def save(self, path: Path | None = None) -> None:
+        path = path or credentials_path()
+        path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+        path.parent.chmod(0o700)
+        fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+        with os.fdopen(fd, "w") as f:
+            json.dump(asdict(self), f, indent=2)
+        path.chmod(0o600)
+
+
+def _jwt_claims(token: str) -> dict:
+    """Decode a JWT payload without verifying it. Returns {} if undecodable."""
+    try:
+        payload = token.split(".")[1]
+        payload += "=" * (-len(payload) % 4)
+        claims = json.loads(base64.urlsafe_b64decode(payload))
+    except (IndexError, ValueError):
+        return {}
+    return claims if isinstance(claims, dict) else {}
+
+
+def _cognito():
+    return boto3.client("cognito-idp", region_name=REGION)
+
+
+def get_id_token(path: Path | None = None) -> str:
+    """Return a valid ID token, refreshing via Cognito when it is about to expire."""
+    creds = Credentials.load(path)
+    exp = _jwt_claims(creds.id_token).get("exp", 0)
+    if exp - REFRESH_MARGIN_S > time.time():
+        return creds.id_token
+    if not creds.refresh_token:
+        raise NotLoggedIn("no refresh token")
+
+    try:
+        response = _cognito().initiate_auth(
+            ClientId=CLIENT_ID,
+            AuthFlow="REFRESH_TOKEN_AUTH",
+            AuthParameters={"REFRESH_TOKEN": creds.refresh_token},
+        )
+    except (ClientError, BotoCoreError) as exc:
+        raise NotLoggedIn(f"refresh failed: {type(exc).__name__}") from None
+
+    result = response.get("AuthenticationResult") or {}
+    id_token = result.get("IdToken")
+    if not id_token:
+        raise NotLoggedIn("refresh returned no token")
+    creds.id_token = id_token
+    if result.get("RefreshToken"):
+        creds.refresh_token = result["RefreshToken"]
+    creds.save(path)
+    return id_token
+
+
+def _prompt(text: str) -> str:
+    print(text, end="", file=sys.stderr, flush=True)
+    return input().strip()
+
+
+def login(email: str | None = None, path: Path | None = None) -> Credentials:
+    """Interactive CUSTOM_AUTH login: email → emailed code → tokens saved to disk.
+
+    Prompts go to stderr. Raises RuntimeError with a user-facing message on failure.
+    """
+    if not email:
+        email = _prompt("Email address: ")
+    if not email:
+        raise RuntimeError("Email address is required")
+
+    cognito = _cognito()
+    print(f"Sending verification code to {email}...", file=sys.stderr)
+    try:
+        response = cognito.initiate_auth(
+            ClientId=CLIENT_ID,
+            AuthFlow="CUSTOM_AUTH",
+            AuthParameters={"USERNAME": email},
+        )
+    except ClientError as exc:
+        raise RuntimeError(f"Could not start login: {_client_error(exc)}") from None
+
+    code = _prompt("Enter the 6-digit verification code: ")
+    if len(code) != 6 or not code.isdigit():
+        raise RuntimeError("Please enter a valid 6-digit code")
+
+    try:
+        response = cognito.respond_to_auth_challenge(
+            ClientId=CLIENT_ID,
+            ChallengeName="CUSTOM_CHALLENGE",
+            Session=response["Session"],
+            ChallengeResponses={"ANSWER": code, "USERNAME": email},
+        )
+    except ClientError as exc:
+        raise RuntimeError(f"Verification failed: {_client_error(exc)}") from None
+
+    result = response.get("AuthenticationResult") or {}
+    if not result.get("IdToken") or not result.get("RefreshToken"):
+        raise RuntimeError("Authentication did not complete; try again")
+
+    creds = Credentials(
+        id_token=result["IdToken"],
+        refresh_token=result["RefreshToken"],
+        email=_jwt_claims(result["IdToken"]).get("email") or email,
+    )
+    creds.save(path)
+    return creds
+
+
+def _client_error(exc: ClientError) -> str:
+    err = exc.response.get("Error", {})
+    return f"{err.get('Code', 'Unknown')} - {err.get('Message', str(exc))}"

dh_cli-0.14.0/src/dh_cli/hz/mcp_server.py

@@ -0,0 +1,200 @@
+"""Horizyn MCP server over stdio (`dh hz mcp serve`). Prod only.
+
+Every request carries the logged-in user's own Cognito ID token, so queries
+land in that user's Horizyn history. Requires the ``mcp`` extra:
+``pip install 'dh-cli[mcp]'``.
+"""
+
+from importlib.metadata import version
+
+import httpx
+from mcp.server.mcpserver import MCPServer
+from mcp.server.mcpserver.exceptions import ToolError
+from mcp.types import ToolAnnotations
+
+from dh_cli.hz import API_URLS
+from dh_cli.hz.auth import NotLoggedIn, get_id_token
+
+CLIENT_HEADER = f"mcp/{version('dh-cli')}"
+_READ_ONLY = ToolAnnotations(read_only_hint=True)
+
+server = MCPServer(
+    "horizyn",
+    instructions=(
+        "Horizyn: Dayhoff Labs' enzyme and reaction similarity search. Tools query "
+        "production as the logged-in user (`dh hz login`). Similarity scores are "
+        "cosine similarities in [0, 1]; higher means more similar."
+    ),
+)
+
+_client = httpx.Client(base_url=API_URLS["prod"], timeout=120)
+
+
+def _request(method: str, path: str, **kwargs) -> dict:
+    try:
+        token = get_id_token()
+    except NotLoggedIn as exc:
+        raise ToolError(str(exc)) from None
+
+    headers = {"Authorization": f"Bearer {token}", "X-Horizyn-Client": CLIENT_HEADER}
+    try:
+        resp = _client.request(method, path, headers=headers, **kwargs)
+    except httpx.HTTPError as exc:
+        raise ToolError(f"Horizyn request failed: {type(exc).__name__}: {exc}") from None
+
+    if resp.status_code == 503:
+        raise ToolError("Horizyn is starting or unavailable, retry shortly")
+    if resp.status_code >= 400:
+        raise ToolError(_error_text(resp))
+    return resp.json()
+
+
+def _error_text(resp: httpx.Response) -> str:
+    try:
+        body = resp.json()
+    except ValueError:
+        body = {}
+    if not isinstance(body, dict):
+        body = {}
+    parts = [p for p in (body.get("error"), body.get("message")) if p]
+    detail = body.get("detail")
+    if isinstance(detail, str):
+        parts.append(detail)
+    elif isinstance(detail, list):
+        # FastAPI validation errors; take loc + msg only, never the echoed `input`.
+        for err in detail:
+            if isinstance(err, dict) and err.get("msg"):
+                loc = ".".join(str(x) for x in err.get("loc", []) if x != "body")
+                parts.append(f"{loc}: {err['msg']}" if loc else err["msg"])
+    text = "; ".join(parts) if parts else resp.reason_phrase
+    return f"Horizyn returned {resp.status_code}: {text}"
+
+
+def _query(path: str, body: dict, filters: dict) -> dict:
+    body.update({k: v for k, v in filters.items() if v is not None})
+    data = _request("POST", path, json=body)
+    data.pop("timings_ms", None)
+    data.pop("tsne", None)
+    return data
+
+
+@server.tool(annotations=_READ_ONLY)
+def horizyn_whoami() -> dict:
+    """Identify the logged-in Horizyn user.
+
+    Returns email, tier (admin, alpha, or beta) and the feature flags that tier
+    grants. Use this first to confirm the server is authenticated.
+    """
+    return _request("GET", "/me")
+
+
+@server.tool(annotations=_READ_ONLY)
+def horizyn_list_screening_sets(screening_set_type: str | None = None) -> dict:
+    """List the screening sets available for similarity queries.
+
+    Each entry gives the set's id, type (protein or reaction), size, model
+    version and whether it is the current default (`is_default`).
+    `screening_set_type` optionally filters to "protein" or "reaction".
+    """
+    params = {"screening_set_type": screening_set_type} if screening_set_type else None
+    return _request("GET", "/screening_sets", params=params)
+
+
+@server.tool(annotations=_READ_ONLY)
+def horizyn_query_reaction(
+    smiles: str,
+    screening_set: str | None = None,
+    top_k: int = 50,
+    page: int = 1,
+    page_size: int = 20,
+    ec_include: list[str] | None = None,
+    ec_exclude: list[str] | None = None,
+    tc_include: list[str] | None = None,
+    tc_exclude: list[str] | None = None,
+    cofactor_include: list[str] | None = None,
+    cofactor_exclude: list[str] | None = None,
+    min_length: int | None = None,
+    max_length: int | None = None,
+) -> dict:
+    """Find proteins (or reactions) similar to a reaction SMILES.
+
+    `smiles` is a reaction SMILES such as "CC=O.O>>CC(O)O". When
+    `screening_set` is omitted Horizyn searches its current default protein set
+    (the response's `screening_set` names it; see horizyn_list_screening_sets).
+    Pass a reaction set such as horizyn_v1_1_rxns to find similar reactions
+    instead. `score` on each result is the cosine similarity between the query
+    and the hit in Horizyn's embedding space (0-1, higher is more similar).
+    `top_k` (max 1000) bounds the similarity search; `page`/`page_size`
+    paginate the result list.
+
+    All filters are optional. `ec_include`/`ec_exclude` and
+    `tc_include`/`tc_exclude` take hierarchical prefixes ("1", "1.1", "1.1.1",
+    "1.1.1.1"; "__NONE__" matches unannotated). `cofactor_include`/
+    `cofactor_exclude` take cofactor names ("NAD", "Zn"; "__ANY__"/"__NONE__").
+    `min_length`/`max_length` bound sequence length. `filter_stats` in the
+    response reports how many hits the filters kept.
+    """
+    body = {"smiles": smiles, "top_k": top_k, "page": page, "page_size": page_size}
+    filters = {
+        "screening_set": screening_set,
+        "ec_include": ec_include,
+        "ec_exclude": ec_exclude,
+        "tc_include": tc_include,
+        "tc_exclude": tc_exclude,
+        "cofactor_include": cofactor_include,
+        "cofactor_exclude": cofactor_exclude,
+        "min_length": min_length,
+        "max_length": max_length,
+    }
+    return _query("/query/reaction", body, filters)
+
+
+@server.tool(annotations=_READ_ONLY)
+def horizyn_query_protein(
+    sequence: str,
+    screening_set: str | None = None,
+    top_k: int = 50,
+    page: int = 1,
+    page_size: int = 20,
+    ec_include: list[str] | None = None,
+    ec_exclude: list[str] | None = None,
+    tc_include: list[str] | None = None,
+    tc_exclude: list[str] | None = None,
+    cofactor_include: list[str] | None = None,
+    cofactor_exclude: list[str] | None = None,
+    min_length: int | None = None,
+    max_length: int | None = None,
+) -> dict:
+    """Find proteins (or reactions) similar to a protein sequence.
+
+    `sequence` is a one-letter amino-acid string. Same screening sets, scoring,
+    pagination and optional filters as horizyn_query_reaction: `score` is the
+    cosine similarity (0-1) in Horizyn's shared reaction/protein embedding
+    space, omitting `screening_set` searches Horizyn's current default protein
+    set, and every filter argument may be omitted.
+    """
+    body = {"sequence": sequence, "top_k": top_k, "page": page, "page_size": page_size}
+    filters = {
+        "screening_set": screening_set,
+        "ec_include": ec_include,
+        "ec_exclude": ec_exclude,
+        "tc_include": tc_include,
+        "tc_exclude": tc_exclude,
+        "cofactor_include": cofactor_include,
+        "cofactor_exclude": cofactor_exclude,
+        "min_length": min_length,
+        "max_length": max_length,
+    }
+    return _query("/query/protein", body, filters)
+
+
+@server.tool(annotations=_READ_ONLY)
+def horizyn_protein_details(protein_id: str, screening_set: str) -> dict:
+    """Get full details for one protein from a screening set.
+
+    `protein_id` is the `id` returned by a query and `screening_set` is the
+    `screening_set` echoed in that query's response (the id is only meaningful
+    within its set). Returns name, organism, EC numbers, cofactors, expression
+    score, full sequence, length, AlphaFold id and any extra metadata.
+    """
+    return _request("GET", f"/protein/{protein_id}/details", params={"screening_set": screening_set})

dh_cli-0.14.0/tests/hz/live_smoke.py

@@ -0,0 +1,49 @@
+"""Live protocol smoke for `dh hz mcp serve`. Not collected by pytest.
+
+Spawns the server over stdio via pixi, lists tools, and calls horizyn_whoami
+against prod using the credentials from `dh hz login`.
+
+    cd dayhoff-tools && pixi run -e cpu python packages/dh-cli/tests/hz/live_smoke.py
+"""
+
+import json
+import sys
+from pathlib import Path
+
+import anyio
+from mcp.client.client import Client
+from mcp.client.stdio import StdioServerParameters
+
+MANIFEST = Path(__file__).resolve().parents[4] / "pixi.toml"
+EXPECTED = {
+    "horizyn_whoami",
+    "horizyn_list_screening_sets",
+    "horizyn_query_reaction",
+    "horizyn_query_protein",
+    "horizyn_protein_details",
+}
+
+
+async def main() -> int:
+    params = StdioServerParameters(
+        command="pixi",
+        args=["run", "--manifest-path", str(MANIFEST), "-e", "cpu", "dh", "hz", "mcp", "serve"],
+    )
+    async with Client(params) as client:
+        tools = await client.list_tools()
+        names = {t.name for t in tools.tools}
+        print("tools:", sorted(names))
+        assert names == EXPECTED, (names - EXPECTED, EXPECTED - names)
+
+        result = await client.call_tool("horizyn_whoami", {})
+        text = result.content[0].text
+        print("whoami:", text, "is_error:", result.is_error)
+        if result.is_error:
+            return 1
+        me = json.loads(text)
+        assert me.get("email"), me
+        return 0
+
+
+if __name__ == "__main__":
+    sys.exit(anyio.run(main))

dh_cli-0.14.0/tests/hz/test_auth.py

@@ -0,0 +1,134 @@
+"""Tests for dh hz auth: credential storage and token refresh."""
+
+import base64
+import json
+import stat
+import time
+from unittest.mock import MagicMock, patch
+
+import pytest
+from botocore.exceptions import ClientError
+
+from dh_cli.hz.auth import Credentials, NotLoggedIn, get_id_token
+
+
+def _jwt(exp: float, email: str = "user@dayhofflabs.com") -> str:
+    header = base64.urlsafe_b64encode(b'{"alg":"RS256"}').rstrip(b"=").decode()
+    payload = json.dumps({"exp": int(exp), "email": email}).encode()
+    body = base64.urlsafe_b64encode(payload).rstrip(b"=").decode()
+    return f"{header}.{body}.sig"
+
+
+@pytest.fixture
+def creds_path(tmp_path):
+    return tmp_path / ".horizyn" / "credentials_prod.json"
+
+
+class TestCredentials:
+    def test_save_load_round_trip(self, creds_path):
+        creds = Credentials(id_token="id", refresh_token="refresh", email="a@b.com")
+        creds.save(creds_path)
+
+        assert Credentials.load(creds_path) == creds
+
+    def test_save_sets_restrictive_modes(self, creds_path):
+        Credentials(id_token="id", refresh_token="refresh", email="a@b.com").save(creds_path)
+
+        assert stat.S_IMODE(creds_path.stat().st_mode) == 0o600
+        assert stat.S_IMODE(creds_path.parent.stat().st_mode) == 0o700
+
+    def test_save_overwrite_keeps_mode(self, creds_path):
+        creds = Credentials(id_token="id", refresh_token="refresh", email="a@b.com")
+        creds.save(creds_path)
+        creds.id_token = "id2"
+        creds.save(creds_path)
+
+        assert stat.S_IMODE(creds_path.stat().st_mode) == 0o600
+        assert Credentials.load(creds_path).id_token == "id2"
+
+    def test_load_missing_raises_not_logged_in(self, creds_path):
+        with pytest.raises(NotLoggedIn, match="dh hz login"):
+            Credentials.load(creds_path)
+
+
+class TestGetIdToken:
+    def test_returns_cached_when_fresh(self, creds_path):
+        fresh = _jwt(time.time() + 3600)
+        Credentials(id_token=fresh, refresh_token="r", email="a@b.com").save(creds_path)
+
+        with patch("dh_cli.hz.auth.boto3.client") as client:
+            assert get_id_token(creds_path) == fresh
+            client.assert_not_called()
+
+    def test_refreshes_when_within_margin(self, creds_path):
+        stale = _jwt(time.time() + 60)
+        Credentials(id_token=stale, refresh_token="r", email="a@b.com").save(creds_path)
+        new = _jwt(time.time() + 3600)
+        cognito = MagicMock()
+        cognito.initiate_auth.return_value = {"AuthenticationResult": {"IdToken": new}}
+
+        with patch("dh_cli.hz.auth.boto3.client", return_value=cognito):
+            assert get_id_token(creds_path) == new
+
+        cognito.initiate_auth.assert_called_once_with(
+            ClientId="4bqudnqan63iur9fi8224m2pee",
+            AuthFlow="REFRESH_TOKEN_AUTH",
+            AuthParameters={"REFRESH_TOKEN": "r"},
+        )
+        saved = Credentials.load(creds_path)
+        assert saved.id_token == new
+        assert saved.refresh_token == "r"
+
+    def test_refresh_stores_rotated_refresh_token(self, creds_path):
+        Credentials(id_token=_jwt(0), refresh_token="r", email="a@b.com").save(creds_path)
+        cognito = MagicMock()
+        cognito.initiate_auth.return_value = {
+            "AuthenticationResult": {"IdToken": _jwt(time.time() + 3600), "RefreshToken": "r2"}
+        }
+
+        with patch("dh_cli.hz.auth.boto3.client", return_value=cognito):
+            get_id_token(creds_path)
+
+        assert Credentials.load(creds_path).refresh_token == "r2"
+
+    def test_undecodable_token_is_treated_as_expired(self, creds_path):
+        Credentials(id_token="garbage", refresh_token="r", email="a@b.com").save(creds_path)
+        new = _jwt(time.time() + 3600)
+        cognito = MagicMock()
+        cognito.initiate_auth.return_value = {"AuthenticationResult": {"IdToken": new}}
+
+        with patch("dh_cli.hz.auth.boto3.client", return_value=cognito):
+            assert get_id_token(creds_path) == new
+
+    def test_no_file_raises_not_logged_in(self, creds_path):
+        with pytest.raises(NotLoggedIn, match="dh hz login"):
+            get_id_token(creds_path)
+
+    def test_missing_refresh_token_raises_not_logged_in(self, creds_path):
+        Credentials(id_token=_jwt(0), refresh_token="", email="a@b.com").save(creds_path)
+
+        with patch("dh_cli.hz.auth.boto3.client") as client:
+            with pytest.raises(NotLoggedIn, match="dh hz login"):
+                get_id_token(creds_path)
+            client.assert_not_called()
+
+    def test_cognito_error_raises_not_logged_in(self, creds_path):
+        Credentials(id_token=_jwt(0), refresh_token="r", email="a@b.com").save(creds_path)
+        cognito = MagicMock()
+        cognito.initiate_auth.side_effect = ClientError(
+            {"Error": {"Code": "NotAuthorizedException", "Message": "Refresh Token has expired"}},
+            "InitiateAuth",
+        )
+
+        with patch("dh_cli.hz.auth.boto3.client", return_value=cognito):
+            with pytest.raises(NotLoggedIn, match="dh hz login"):
+                get_id_token(creds_path)
+
+    def test_refresh_response_without_token_raises_not_logged_in(self, creds_path):
+        Credentials(id_token=_jwt(0), refresh_token="r", email="a@b.com").save(creds_path)
+        cognito = MagicMock()
+        cognito.initiate_auth.return_value = {"ChallengeName": "SOMETHING"}
+
+        with patch("dh_cli.hz.auth.boto3.client", return_value=cognito):
+            with pytest.raises(NotLoggedIn, match="dh hz login"):
+                get_id_token(creds_path)