dreadnode 2.0.11__tar.gz → 2.0.13__tar.gz

{dreadnode-2.0.11 → dreadnode-2.0.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dreadnode
-Version: 2.0.11
+Version: 2.0.13
 Summary: Dreadnode SDK
 Project-URL: Homepage, https://dreadnode.io
 Project-URL: Documentation, https://docs.dreadnode.io
@@ -10,6 +10,7 @@ Requires-Python: <3.14,>=3.11
 Requires-Dist: aiofiles<25.0.0,>=24.1.0
 Requires-Dist: art<7.0.0,>=6.5
 Requires-Dist: coolname<3.0.0,>=2.2.0
+Requires-Dist: croniter<7.0.0,>=6.0.0
 Requires-Dist: cyclopts>=4.2.0
 Requires-Dist: datasets>=4.5.0
 Requires-Dist: fastapi>=0.115.0

{dreadnode-2.0.11 → dreadnode-2.0.13}/dreadnode/agents/agent.py

@@ -487,6 +487,7 @@ class Agent(Executor[AgentEvent, Trajectory]):
         than via hook indirection.
         """
         from dreadnode.agents.hooks import (
+            _get_model_context_budget,
             _is_context_length_error,
             find_summarization_boundary,
             summarize_conversation,
@@ -501,19 +502,38 @@ class Agent(Executor[AgentEvent, Trajectory]):
         work = list(messages)
         system_message: Message | None = work.pop(0) if work and work[0].role == "system" else None
 
-        boundary = find_summarization_boundary(work, min_messages_to_keep=10)
+        summarizer = self._generator
+        if summarizer is None:
+            return None
+
+        # Cap summarizer input at ~60% of the model's token budget (~3 chars/token,
+        # conservative to prefer over-truncating on code/JSON-heavy content).
+        # This keeps the recovery call itself from overflowing the same provider
+        # context that triggered recovery.
+        budget_tokens = _get_model_context_budget(summarizer)
+        max_summarize_chars = int(budget_tokens * 0.6 * 3)
+
+        boundary = find_summarization_boundary(
+            work,
+            min_messages_to_keep=10,
+            max_summarize_chars=max_summarize_chars,
+        )
         if boundary == 0:
+            logger.info(
+                "Overflow recovery: no safe summarization window fits summarizer budget "
+                "(budget_tokens={}, max_chars={})",
+                budget_tokens,
+                max_summarize_chars,
+            )
             return None
 
         to_summarize = work[:boundary]
         to_keep = work[boundary:]
 
-        summarizer = self._generator
-        if summarizer is None:
-            return None
-
         logger.info(
-            f"Overflow recovery: summarizing {len(to_summarize)} messages, keeping {len(to_keep)}"
+            "Overflow recovery: summarizing {} messages, keeping {}",
+            len(to_summarize),
+            len(to_keep),
         )
 
         try:
@@ -781,6 +801,12 @@ class Agent(Executor[AgentEvent, Trajectory]):
                             step_chat = await self._generate(messages)
 
                     if step_chat.failed and step_chat.error:
+                        from dreadnode.agents.hooks import _describe_generation_error
+
+                        logger.error(
+                            "Generation step failed: {}",
+                            _describe_generation_error(step_chat.error),
+                        )
                         error_event = GenerationError(
                             agent_id=self.agent_id,
                             agent_name=self.name,

{dreadnode-2.0.11 → dreadnode-2.0.13}/dreadnode/agents/hooks.py

@@ -80,6 +80,9 @@ CONTEXT_LENGTH_ERROR_PATTERNS = [
     "token limit",
     "maximum context length",
     "is too long",
+    "chunk too big",
+    "prompt is too long",
+    "too many tokens",
 ]
 
 
@@ -193,32 +196,94 @@ def _is_context_length_error(error: BaseException) -> bool:
     return any(pattern in error_str for pattern in CONTEXT_LENGTH_ERROR_PATTERNS)
 
 
+def _describe_generation_error(error: BaseException) -> dict[str, t.Any]:
+    """Best-effort structured dump of a generation error for diagnostic logs.
+
+    Returns a dict of litellm-known attributes when present. Never raises:
+    attribute access that fails is silently omitted, so callers can log the
+    result safely even for hostile or malformed exception objects.
+
+    Intended for one-per-failure diagnostic logging at the generation error
+    site. Presence flags are included for fields whose *content* is not
+    itself safe to log (raw bodies may be arbitrary length); they tell a
+    future debugger whether structured data exists to look at without
+    dumping it into every log line.
+    """
+    fields: dict[str, t.Any] = {"type": type(error).__name__}
+
+    with contextlib.suppress(Exception):
+        msg = str(error)
+        if msg:
+            fields["message"] = msg if len(msg) <= 500 else msg[:500] + "...<truncated>"
+
+    for attr in ("status_code", "llm_provider", "model", "request_id"):
+        with contextlib.suppress(Exception):
+            val = getattr(error, attr, None)
+            if val is not None:
+                fields[attr] = val
+
+    with contextlib.suppress(Exception):
+        fields["has_body"] = bool(getattr(error, "body", None))
+
+    with contextlib.suppress(Exception):
+        resp = getattr(error, "response", None)
+        if resp is not None:
+            text = getattr(resp, "text", "") or ""
+            fields["has_response_text"] = bool(text)
+
+    return fields
+
+
 def find_summarization_boundary(
     messages: list[Message],
     min_messages_to_keep: int = 10,
+    max_summarize_chars: int | None = None,
 ) -> int:
     """Find a clean message boundary for summarization.
 
-    Walks messages from the start and finds the latest safe split point that
+    Walks messages from the start and enumerates every safe split point that
     leaves at least ``min_messages_to_keep`` messages in the "keep" portion.
     A safe boundary is after a simple assistant message (no tool calls) —
     this is the natural end of a complete conversational turn.
 
+    When ``max_summarize_chars`` is provided, returns the largest safe split
+    whose cumulative ``len(str(message))`` stays within the cap. This keeps
+    the summarizer call from overflowing the same provider context that
+    triggered recovery. ``str(message)`` is exactly what the summarizer
+    receives (see ``Agent._try_overflow_recovery``) so the cap and the actual
+    serialized input measure the same string — including elision of image
+    URLs (``ContentImageUrl.__str__``) and tool-call arguments
+    (``ToolCall.__str__``).
+
     Returns:
         Index splitting ``messages[:boundary]`` (to summarize) from
         ``messages[boundary:]`` (to keep).  Returns ``0`` when no valid
         boundary exists.
     """
-    best_boundary = 0
+    # Enumerate every safe boundary with its cumulative serialized char count.
+    # (0, 0) is always a valid "no compaction" candidate.
+    candidates: list[tuple[int, int]] = [(0, 0)]
+    running_chars = 0
     for i, message in enumerate(messages):
         if len(messages) - i <= min_messages_to_keep:
             break
+        running_chars += len(str(message))
         is_simple_assistant = message.role == "assistant" and not getattr(
             message, "tool_calls", None
         )
         if is_simple_assistant:
-            best_boundary = i + 1
-    return best_boundary
+            candidates.append((i + 1, running_chars))
+
+    if max_summarize_chars is None:
+        return candidates[-1][0]
+
+    # Cumulative sizes are monotonic in boundary order, so the largest
+    # boundary whose size fits the cap is the best match. Walk candidates
+    # from latest to earliest and return the first that fits.
+    for boundary, size in reversed(candidates):
+        if size <= max_summarize_chars:
+            return boundary
+    return 0
 
 
 def _get_model_context_budget(model_or_generator: "str | Generator | None") -> int:

{dreadnode-2.0.11 → dreadnode-2.0.13}/dreadnode/app/api/client.py

@@ -36,6 +36,7 @@ from dreadnode.app.api.models import (
     UserSecretsList,
     Workspace,
 )
+from dreadnode.core.exceptions import InsufficientCreditsError
 from dreadnode.version import VERSION
 
 
@@ -109,6 +110,11 @@ class ApiClient:
         else:
             return f"{response.status_code}: {detail}"
 
+    @staticmethod
+    def _is_credit_related_429(detail: str) -> bool:
+        lowered = detail.lower()
+        return "credit" in lowered
+
     def _request(
         self,
         method: str,
@@ -141,6 +147,11 @@ class ApiClient:
         response = self._request(method, path, params, json_data, data, headers)
         if response.status_code == 401:
             raise AuthenticationError(self._get_error_message(response))
+        if response.status_code == 429:
+            error_message = self._get_error_message(response)
+            detail = error_message.split(": ", 1)[1] if ": " in error_message else error_message
+            if self._is_credit_related_429(detail):
+                raise InsufficientCreditsError(detail)
         try:
             response.raise_for_status()
         except httpx.HTTPStatusError as e:
@@ -1086,6 +1097,64 @@ class ApiClient:
         )
         return t.cast("dict[str, t.Any]", response.json())
 
+    def create_runtime(
+        self,
+        org: str,
+        workspace: str,
+        project: str | None = None,
+        *,
+        key: str | None = None,
+        name: str | None = None,
+        description: str | None = None,
+        config: dict[str, t.Any] | None = None,
+    ) -> dict[str, t.Any]:
+        """POST /org/{org}/ws/{workspace}/runtimes - Ensure a runtime exists."""
+        payload: dict[str, t.Any] = {}
+        if project is not None:
+            payload["project"] = project
+        if key is not None:
+            payload["key"] = key
+        if name is not None:
+            payload["name"] = name
+        if description is not None:
+            payload["description"] = description
+        if config is not None:
+            payload["config"] = config
+        response = self.request(
+            "POST",
+            f"/org/{org}/ws/{workspace}/runtimes",
+            json_data=payload,
+        )
+        return t.cast("dict[str, t.Any]", response.json())
+
+    def get_runtime_config(
+        self,
+        org: str,
+        workspace: str,
+        runtime_id: str,
+    ) -> dict[str, t.Any]:
+        """GET /org/{org}/ws/{workspace}/runtimes/{runtime_id}/config - Get runtime config."""
+        response = self.request(
+            "GET",
+            f"/org/{org}/ws/{workspace}/runtimes/{runtime_id}/config",
+        )
+        return t.cast("dict[str, t.Any]", response.json())
+
+    def update_runtime_config(
+        self,
+        org: str,
+        workspace: str,
+        runtime_id: str,
+        config: dict[str, t.Any],
+    ) -> dict[str, t.Any]:
+        """PUT /org/{org}/ws/{workspace}/runtimes/{runtime_id}/config - Replace runtime config."""
+        response = self.request(
+            "PUT",
+            f"/org/{org}/ws/{workspace}/runtimes/{runtime_id}/config",
+            json_data={"config": config},
+        )
+        return t.cast("dict[str, t.Any]", response.json())
+
     def pause_runtime(self, org: str, workspace: str, runtime_id: str) -> dict[str, t.Any]:
         """POST /org/{org}/ws/{workspace}/runtimes/{runtime_id}/pause - Pause a runtime."""
         response = self.request(
@@ -1722,6 +1791,23 @@ class ApiClient:
         )
         return t.cast("dict[str, t.Any]", response.json())
 
+    def set_runtime_capability_flags(
+        self,
+        org: str,
+        workspace: str,
+        runtime_id: str,
+        binding_id: str,
+        *,
+        flags: dict[str, bool | None],
+    ) -> dict[str, t.Any]:
+        """PATCH /org/{org}/ws/{workspace}/runtimes/{runtime_id}/capabilities/{binding_id}."""
+        response = self.request(
+            "PATCH",
+            f"/org/{org}/ws/{workspace}/runtimes/{runtime_id}/capabilities/{binding_id}",
+            json_data={"flags": flags},
+        )
+        return t.cast("dict[str, t.Any]", response.json())
+
     def update_runtime_capability(
         self,
         org: str,
@@ -1881,6 +1967,7 @@ class ApiClient:
         title: str | None = None,
         message_count: int = 0,
         project_id: str | None = None,
+        runtime_id: str | None = None,
     ) -> dict[str, t.Any]:
         """POST /org/{org}/ws/{workspace}/sessions - Create or save a session."""
         payload: dict[str, t.Any] = {
@@ -1894,6 +1981,8 @@ class ApiClient:
             payload["title"] = title
         if project_id is not None:
             payload["project_id"] = project_id
+        if runtime_id is not None:
+            payload["runtime_id"] = runtime_id
         response = self.request("POST", f"/org/{org}/ws/{workspace}/sessions", json_data=payload)
         return t.cast("dict[str, t.Any]", response.json())
 
@@ -2500,6 +2589,7 @@ class ApiClient:
         *,
         name: str,
         project_id: str,
+        runtime_id: str | None = None,
         description: str | None = None,
         session_id: str | None = None,
         target_model: str | None = None,
@@ -2517,6 +2607,8 @@ class ApiClient:
             payload["description"] = description
         if session_id is not None:
             payload["session_id"] = session_id
+        if runtime_id is not None:
+            payload["runtime_id"] = runtime_id
         if target_model is not None:
             payload["target_model"] = target_model
         if attacker_model is not None:

{dreadnode-2.0.11 → dreadnode-2.0.13}/dreadnode/app/api/models.py

@@ -792,6 +792,9 @@ class SessionInfo(BaseModel):
     agent: str | None = None
     title: str | None = None
     preview: str | None = None
+    policy_name: str = "interactive"
+    policy_is_autonomous: bool = False
+    policy_display_label: str = ""
 
 
 class SessionMessage(BaseModel):
@@ -814,6 +817,7 @@ class SessionCreateRequest(BaseModel):
         default=None,
         validation_alias="generateParamsExtra",
     )
+    policy: str | dict[str, t.Any] | None = None
 
     model_config = ConfigDict(populate_by_name=True)
 
@@ -823,6 +827,13 @@ class SessionCreateRequest(BaseModel):
         return _normalize_default_agent_fields(data)
 
 
+class SessionEventPublishRequest(BaseModel):
+    """Request body for publishing an event into a session's event bus."""
+
+    kind: str
+    payload: dict[str, t.Any] = Field(default_factory=dict)
+
+
 class SessionRestoreRequest(BaseModel):
     """Request body for restoring a server-side session runtime."""
 
@@ -882,9 +893,9 @@ class CapabilityAgentInfo(BaseModel):
 class ComponentStatusInfo(BaseModel):
     """Component-level load/runtime status."""
 
-    kind: t.Literal["agent", "tool", "hook", "skill", "mcp_server", "capability", "check"]
+    kind: t.Literal["agent", "tool", "hook", "skill", "mcp_server", "capability", "check", "worker"]
     name: str
-    status: t.Literal["ok", "error", "degraded"]
+    status: t.Literal["ok", "error", "degraded", "stopped", "gated_off", "enabled_failed"]
     error: str | None = None
     detail: str | None = None
     # MCP-specific optional fields
@@ -892,6 +903,20 @@ class ComponentStatusInfo(BaseModel):
     capability: str | None = None
     transport: str | None = None
     tool_count: int | None = None
+    # Gate-eligible components (MCP server / worker): flag names that would
+    # satisfy the when: predicate. Present when status is gated_off so the
+    # TUI can tell operators which flag to flip (CAP-FLAG-014).
+    when: list[str] | None = None
+
+
+class FlagInfo(BaseModel):
+    """Resolved flag state exposed by the local runtime."""
+
+    name: str
+    description: str
+    default: bool
+    effective: bool
+    source: t.Literal["default", "binding", "env", "cli"]
 
 
 class CapabilityInfo(BaseModel):
@@ -911,6 +936,7 @@ class CapabilityInfo(BaseModel):
     enabled: bool = True
     binding_id: str | None = None
     update_available: str | None = None
+    flags: list[FlagInfo] = []
     components: list[ComponentStatusInfo] = []
     dependencies: dict[str, t.Any] | None = None
     checks: list[dict[str, t.Any]] | None = None
@@ -945,6 +971,15 @@ class ToolInfo(BaseModel):
     name: str
     description: str = ""
     capability: str = ""
+    parameters_schema: dict[str, t.Any] | None = None
+    """JSON Schema for the tool's parameters, if available.
+
+    Populated for first-class :class:`dreadnode.agents.tools.Tool`
+    instances and MCP tools; ``None`` for synthetic session-scoped
+    entries (``load_skill``, ``spawn_agent``) where no schema applies.
+    The TUI uses this to register per-tool display hints — without it,
+    unknown tools fall back to the generic first-string-arg heuristic.
+    """
 
 
 class ToolsResponse(BaseModel):

{dreadnode-2.0.11 → dreadnode-2.0.13}/dreadnode/app/cli/airt.py

@@ -70,7 +70,14 @@ def _summarize_report(p: dict[str, t.Any]) -> str:
 def create(
     *,
     name: str,
-    project_id: str,
+    project_id: t.Annotated[
+        str | None,
+        cyclopts.Parameter(help="Project ID. Defaults to the active project scope."),
+    ] = None,
+    runtime_id: t.Annotated[
+        str | None,
+        cyclopts.Parameter(help="Runtime ID. Required when the project has multiple runtimes."),
+    ] = None,
     description: t.Annotated[str | None, cyclopts.Parameter(help="Assessment description")] = None,
     session_id: t.Annotated[str | None, cyclopts.Parameter(help="Session ID to associate")] = None,
     target_config: t.Annotated[
@@ -91,11 +98,16 @@ def create(
 ) -> None:
     """Create a new AIRT assessment."""
     api, profile = platform.connect()
+    resolved_project_id = project_id or profile.project_id
+    if resolved_project_id is None:
+        raise ValueError("Project ID required. Pass --project-id or set an active project scope.")
+
     payload = api.create_airt_assessment(
         profile.org_key,
         profile.workspace_key,
         name=name,
-        project_id=project_id,
+        project_id=resolved_project_id,
+        runtime_id=runtime_id,
         description=description,
         session_id=session_id,
         target_config=_parse_json_object_option(target_config, field_name="--target-config"),

{dreadnode-2.0.11 → dreadnode-2.0.13}/dreadnode/app/cli/args.py

@@ -199,6 +199,15 @@ class TuiArgs(PlatformScopeArgs):
             help="Enable specific capability (repeatable, exclusive)",
         ),
     ] = None
+    capability_flags: t.Annotated[
+        list[str] | None,
+        cyclopts.Parameter(
+            name="--capability-flag",
+            group=TUI_GROUP,
+            negative_iterable=(),
+            help="Override capability flag (repeatable, format: capability.flag=true|false)",
+        ),
+    ] = None
     prompt: t.Annotated[
         str | None,
         cyclopts.Parameter(
@@ -222,3 +231,18 @@ class TuiArgs(PlatformScopeArgs):
             help="Headless mode: execute --prompt, print response to stdout, exit",
         ),
     ] = False
+    auto: t.Annotated[
+        bool,
+        cyclopts.Parameter(
+            group=TUI_GROUP,
+            negative=(),
+            help="Launch in autonomous mode: the agent runs without human prompts, bounded by --max-steps",
+        ),
+    ] = False
+    max_steps: t.Annotated[
+        int | None,
+        cyclopts.Parameter(
+            group=TUI_GROUP,
+            help="Step budget for autonomous mode (defaults to 30)",
+        ),
+    ] = None

{dreadnode-2.0.11 → dreadnode-2.0.13}/dreadnode/app/cli/capability.py

@@ -259,6 +259,50 @@ def _summarize_capability(p: dict[str, t.Any]) -> str:
     return f"[cyan]{name}[/cyan]@[dim]{version}[/dim] {_visibility_markup(visibility)}{suffix}"
 
 
+def _download_capability_files(
+    api: t.Any,
+    org: str,
+    name: str,
+    version: str,
+    dest: Path,
+) -> None:
+    """Download capability files to *dest*, trying bundle then file-by-file."""
+    from loguru import logger
+
+    from dreadnode.capabilities.sync import _extract_tar_to_dir
+
+    # Fast path: single tar.gz bundle download
+    bundle_ok = False
+    try:
+        data = api.download_capability_bundle(org, name, version)
+        _extract_tar_to_dir(data, dest)
+        bundle_ok = True
+    except Exception:
+        logger.debug(
+            "Bundle download unavailable for {}/{}@{}, falling back to file-by-file",
+            org,
+            name,
+            version,
+        )
+
+    if bundle_ok:
+        return
+
+    # Slow path: fetch manifest and download each file individually
+    detail = api.get_capability(org, name, version)
+    file_manifest = detail.get("file_manifest", [])
+    if not file_manifest:
+        raise RuntimeError(f"Capability {org}/{name}@{version} has no downloadable files")
+
+    dest.mkdir(parents=True, exist_ok=True)
+    for entry in file_manifest:
+        file_path = entry["path"]
+        content = api.get_capability_file(org, name, version, file_path)
+        file_dest = dest / file_path
+        file_dest.parent.mkdir(parents=True, exist_ok=True)
+        file_dest.write_bytes(content if isinstance(content, bytes) else content.encode())
+
+
 # ---------------------------------------------------------------------------
 # push
 # ---------------------------------------------------------------------------
@@ -429,36 +473,37 @@ def info(
 def pull(
     ref: str,
     *,
-    upgrade: t.Annotated[bool, cyclopts.Parameter(negative=())] = False,
+    output: t.Annotated[Path | None, cyclopts.Parameter(name="--output", alias="-o")] = None,
+    force: t.Annotated[bool, cyclopts.Parameter(negative=())] = False,
     platform: PlatformArgs = PlatformArgs(),
 ) -> None:
-    """Download a capability to read or fork — does not activate it.
+    """Download a capability to a local directory.
 
-    Pulls the capability from the registry and extracts it to the
-    local package cache. Unlike ``install``, this does not activate
-    the capability for use by agents.
+    Fetches the capability from the registry and writes it to disk.
+    Defaults to a folder named after the capability in the current
+    directory. Use ``--output`` to choose a different destination.
+
+    This does **not** install or activate the capability — use
+    ``install`` for that.
 
     Args:
         ref: Capability to pull (e.g. my-cap, my-cap@1.0.0, or acme/my-cap).
-        upgrade: Re-download even if already cached locally.
+        output: Destination directory. Defaults to ./<capability-name>.
+        force: Overwrite the destination if it already exists.
     """
-    dn = configured_dreadnode(platform)
-    _api, profile = platform.connect()
-    parsed = ArtifactRef.parse(ref, profile.org_key)
 
-    version_suffix = f":{parsed.version}" if parsed.version else ""
-    package_ref = f"capability://{parsed.qualified_name}{version_suffix}"
+    api, profile = platform.connect()
+    parsed = ensure_version(api, "capability", ArtifactRef.parse(ref, profile.org_key))
 
-    result = dn.pull_package([package_ref], upgrade=upgrade)
+    dest = (output or Path.cwd() / parsed.name).resolve()
 
-    if not result.success:
-        raise RuntimeError("; ".join(result.errors) or "Pull failed")
+    if dest.exists():
+        if not force:
+            raise FileExistsError(f"{dest} already exists — use --force to overwrite")
+        shutil.rmtree(dest)
 
-    display = parsed.with_version(result.version).format() if result.version else parsed.format()
-    if result.dest:
-        console.print(f"Pulled {display} to {result.dest}")
-    else:
-        console.print(f"Pulled {display}")
+    _download_capability_files(api, parsed.org, parsed.name, parsed.version, dest)
+    print_success(f"Pulled {parsed.format()} to {dest}")
 
 
 # ---------------------------------------------------------------------------

{dreadnode-2.0.11 → dreadnode-2.0.13}/dreadnode/app/cli/main.py

@@ -148,6 +148,12 @@ def create_app(tui_args: TuiArgs) -> "DreadnodeTextualApp":
     except Exception:
         profile = None
 
+    initial_policy: dict[str, t.Any] | None = None
+    if tui_args.auto:
+        initial_policy = {"name": "headless"}
+        if tui_args.max_steps is not None:
+            initial_policy["max_steps"] = tui_args.max_steps
+
     return DreadnodeTextualApp(
         profile=profile,
         platform_url=platform_url,
@@ -158,7 +164,9 @@ def create_app(tui_args: TuiArgs) -> "DreadnodeTextualApp":
         initial_prompt=tui_args.prompt,
         capabilities_dirs=tui_args.capabilities_dirs,
         capabilities=tui_args.capabilities,
+        capability_flags=tui_args.capability_flags,
         system_prompt=tui_args.system_prompt,
+        initial_policy=initial_policy,
     )
 
 
@@ -188,6 +196,7 @@ def _run_print(tui_args: TuiArgs) -> None:
             agent=tui_args.agent,
             capabilities_dirs=tui_args.capabilities_dirs,
             capabilities=tui_args.capabilities,
+            capability_flags=tui_args.capability_flags,
             system_prompt=tui_args.system_prompt,
             server_url=tui_args.runtime_server,
             platform_url=tui_args.server,
@@ -234,7 +243,7 @@ def login(
 ) -> None:
     """Authenticate with the Dreadnode platform."""
     from dreadnode.app.config import DEFAULT_PLATFORM_URL
-    from dreadnode.app.tui.commands import _login_with_api_key
+    from dreadnode.app.tui.auth_flow import _login_with_api_key
 
     server_url = (server or DEFAULT_PLATFORM_URL).rstrip("/")
 
@@ -286,7 +295,7 @@ def _login_with_device_code(
     import httpx
 
     from dreadnode.app.api.client import ApiClient
-    from dreadnode.app.tui.commands import _login_with_api_key
+    from dreadnode.app.tui.auth_flow import _login_with_api_key
 
     api = ApiClient(server_url)
     payload = api.create_device_code()