evo-cli 0.11.4__tar.gz → 0.12.2__tar.gz

{evo_cli-0.11.4 → evo_cli-0.12.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.11.4
+Version: 0.12.2
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli
@@ -114,6 +114,49 @@ Options:
 - `-f, --force` - Apply the fix even if the version is not in the affected range
 - `--unpin` - Undo the fix: re-enable the auto-updater and install the latest build
 
+#### Credentials
+
+`evo` owns the omelet credential store. The source of truth is a folder of one JSON file per service
+(`~/.omelet.d/credentials/`), which compiles into a flat `~/.omelet.json` that older consumers read
+directly.
+
+```bash
+evo cred doctor                       # health + expiry of every credential, exit 1 if any expired
+evo cred get openai_api_key           # print one value by dotted path, nothing else on stdout
+evo cred add openai_api_key           # prompt with no echo, write the folder file, recompile
+evo cred auth --service google-drive  # first-time OAuth consent, stores the refresh token
+evo cred refresh --all                # refresh Google OAuth access tokens
+evo cred compile                      # rebuild ~/.omelet.json from the folder
+evo cred sync push                    # push the folder to a private GitHub repo via gh
+```
+
+Read a value into the environment without it reaching your shell history:
+
+```bash
+eval "$(evo cred get --export OPENAI_API_KEY openai_api_key)"
+```
+
+Configuration is env-driven, with no personal defaults baked in:
+
+- `OMELET_DIR` - store root (default `~/.omelet.d`; the folder is `$OMELET_DIR/credentials`)
+- `OMELET_CONFIG` - compiled flat file (default `~/.omelet.json`)
+- `OMELET_SYNC_REPO` - required for `sync`; a **private** GitHub repo as `owner/repo`
+- `OMELET_SYNC_DIR` - folder name inside the sync repo (default `credentials`)
+- `RCLONE_DRIVE_CLIENT_ID` / `RCLONE_DRIVE_CLIENT_SECRET` - OAuth client for the rclone refresh
+
+`evo cred sync push` refuses to push to a repo whose visibility is not `PRIVATE`. Never echo a value
+into a shared terminal or a log; `doctor` and `list` only ever print a masked preview.
+
+`evo cred auth` performs the initial OAuth consent that `refresh` cannot: it starts a loopback server,
+opens the consent screen, and writes the resulting refresh token into the store. Create the OAuth
+client in the Cloud Console first (APIs & Services -> Credentials -> Create OAuth client ID ->
+**Desktop app**) and pass the downloaded JSON with `--client-secrets`; there is no gcloud equivalent
+for creating an OAuth client.
+
+`evo gdrive` reads its token from the `google_drive` entry through this store rather than parsing
+`~/.omelet.json` itself, so a refresh writes to the folder and recompiles instead of racing whatever
+else has the flat file open.
+
 #### Harness Repositories
 
 Fast-forward every available repository declared in a harness manifest:

{evo_cli-0.11.4 → evo_cli-0.12.2}/README.md

@@ -86,6 +86,49 @@ Options:
 - `-f, --force` - Apply the fix even if the version is not in the affected range
 - `--unpin` - Undo the fix: re-enable the auto-updater and install the latest build
 
+#### Credentials
+
+`evo` owns the omelet credential store. The source of truth is a folder of one JSON file per service
+(`~/.omelet.d/credentials/`), which compiles into a flat `~/.omelet.json` that older consumers read
+directly.
+
+```bash
+evo cred doctor                       # health + expiry of every credential, exit 1 if any expired
+evo cred get openai_api_key           # print one value by dotted path, nothing else on stdout
+evo cred add openai_api_key           # prompt with no echo, write the folder file, recompile
+evo cred auth --service google-drive  # first-time OAuth consent, stores the refresh token
+evo cred refresh --all                # refresh Google OAuth access tokens
+evo cred compile                      # rebuild ~/.omelet.json from the folder
+evo cred sync push                    # push the folder to a private GitHub repo via gh
+```
+
+Read a value into the environment without it reaching your shell history:
+
+```bash
+eval "$(evo cred get --export OPENAI_API_KEY openai_api_key)"
+```
+
+Configuration is env-driven, with no personal defaults baked in:
+
+- `OMELET_DIR` - store root (default `~/.omelet.d`; the folder is `$OMELET_DIR/credentials`)
+- `OMELET_CONFIG` - compiled flat file (default `~/.omelet.json`)
+- `OMELET_SYNC_REPO` - required for `sync`; a **private** GitHub repo as `owner/repo`
+- `OMELET_SYNC_DIR` - folder name inside the sync repo (default `credentials`)
+- `RCLONE_DRIVE_CLIENT_ID` / `RCLONE_DRIVE_CLIENT_SECRET` - OAuth client for the rclone refresh
+
+`evo cred sync push` refuses to push to a repo whose visibility is not `PRIVATE`. Never echo a value
+into a shared terminal or a log; `doctor` and `list` only ever print a masked preview.
+
+`evo cred auth` performs the initial OAuth consent that `refresh` cannot: it starts a loopback server,
+opens the consent screen, and writes the resulting refresh token into the store. Create the OAuth
+client in the Cloud Console first (APIs & Services -> Credentials -> Create OAuth client ID ->
+**Desktop app**) and pass the downloaded JSON with `--client-secrets`; there is no gcloud equivalent
+for creating an OAuth client.
+
+`evo gdrive` reads its token from the `google_drive` entry through this store rather than parsing
+`~/.omelet.json` itself, so a refresh writes to the folder and recompiles instead of racing whatever
+else has the flat file open.
+
 #### Harness Repositories
 
 Fast-forward every available repository declared in a harness manifest:

evo_cli-0.12.2/evo_cli/VERSION

@@ -0,0 +1 @@
+0.12.2

{evo_cli-0.11.4 → evo_cli-0.12.2}/evo_cli/cli.py

@@ -3,6 +3,7 @@ import rich_click as click
 from evo_cli import __version__
 from evo_cli.commands.claude_code import setup_claude
 from evo_cli.commands.cloudflare import cfssh
+from evo_cli.commands.cred import cred_group
 from evo_cli.commands.download import download
 from evo_cli.commands.fix_claude import f_claude
 from evo_cli.commands.gdrive import gdrive
@@ -19,6 +20,7 @@ from evo_cli.commands.plantuml import plantuml
 from evo_cli.commands.site2s import site2s
 from evo_cli.commands.ssh import setupssh
 from evo_cli.commands.sysmon import sysmon
+from evo_cli.commands.update import update
 from evo_cli.commands.wifi import wifi
 
 
@@ -56,6 +58,7 @@ setup_group.add_command(setupssh)
 
 cli.add_command(setup_group)
 cli.add_command(cfssh)
+cli.add_command(cred_group)
 cli.add_command(download)
 cli.add_command(f_claude)
 cli.add_command(gdrive)
@@ -68,6 +71,7 @@ cli.add_command(mcp_group)
 cli.add_command(netcheck)
 cli.add_command(plantuml)
 cli.add_command(sysmon)
+cli.add_command(update)
 cli.add_command(wifi)
 
 

evo_cli-0.12.2/evo_cli/commands/cred.py

@@ -0,0 +1,364 @@
+import getpass
+import json
+import os
+import sys
+import webbrowser
+from pathlib import Path
+
+import rich_click as click
+from rich.table import Table
+
+from evo_cli.console import console, info, success, warning
+from evo_cli.credentials import doctor as doctor_module
+from evo_cli.credentials import google_oauth, migrate, oauth_flow, sync
+from evo_cli.credentials.registry import config_path, credentials_dir
+from evo_cli.credentials.store import (
+    CredentialError,
+    compile_flat,
+    get_value,
+    read_flat,
+    relative_to_store,
+    require_folder,
+    set_value,
+)
+
+HEALTH_STYLE = {
+    "ok": "green",
+    "expiring": "yellow",
+    "EXPIRED": "bold red",
+    "deprecated": "dim",
+}
+
+
+def _guard(func, *args, **kwargs):
+    try:
+        return func(*args, **kwargs)
+    except CredentialError as exc:
+        raise click.ClickException(str(exc)) from exc
+    except ValueError as exc:
+        raise click.ClickException(str(exc)) from exc
+
+
+def _render(rows):
+    table = Table(show_header=True, header_style="accent", box=None, pad_edge=False)
+    for column in ("FILE", "SERVICE", "TYPE", "HEALTH", "SECRET", "EXPIRY"):
+        table.add_column(column, overflow="fold")
+    for row in rows:
+        table.add_row(
+            row["file"],
+            row["service"],
+            row["type"],
+            f"[{HEALTH_STYLE.get(row['health'], 'white')}]{row['health']}[/]",
+            row["secret"],
+            row["expiry"],
+        )
+    console.print(table)
+
+
+@click.group("cred", help="Read, refresh, and sync the omelet credential store.")
+def cred_group():
+    pass
+
+
+@cred_group.command("get", help="Print one credential by dotted key path.")
+@click.argument("key_path")
+@click.option("--export", "export_var", metavar="VAR", help="Print a shell export statement instead of the raw value.")
+def get(key_path, export_var):
+    value = _guard(get_value, key_path)
+
+    if isinstance(value, (dict, list)):
+        sys.stdout.write(json.dumps(value, ensure_ascii=False) + "\n")
+        return
+
+    text = str(value)
+    if export_var:
+        escaped = text.replace("'", "'\\''")
+        sys.stdout.write(f"export {export_var}='{escaped}'\n")
+        return
+
+    sys.stdout.write(text)
+    if sys.stdout.isatty():
+        sys.stdout.write("\n")
+
+
+@cred_group.command("list", help="List every credential in the store with its health.")
+def list_credentials():
+    _guard(require_folder)
+    rows = _guard(doctor_module.scan)
+    _render(rows)
+    console.print(f"\n{len(rows)} entries in {credentials_dir()}")
+
+
+@cred_group.command("doctor", help="Report health and expiry; exit 1 if anything is expired.")
+def doctor():
+    _guard(require_folder)
+    rows = _guard(doctor_module.scan)
+    _render(rows)
+    expired = [row for row in rows if row["health"] == "EXPIRED"]
+    console.print(f"\n{len(rows)} entries in {credentials_dir()}")
+    if expired:
+        warning(f"{len(expired)} EXPIRED - run: evo cred refresh --all")
+        raise click.exceptions.Exit(1)
+    success("all credentials healthy")
+
+
+@cred_group.command("compile", help="Rebuild the flat config from the credentials folder.")
+@click.option("--include-legacy", is_flag=True, help="Also merge entries marked deprecated.")
+def compile_command(include_legacy):
+    count, skipped, target = _guard(compile_flat, include_legacy=include_legacy)
+    message = f"compiled {count} entries -> {target}"
+    if skipped:
+        message += f" (skipped {len(skipped)} deprecated: {', '.join(skipped)})"
+    success(message)
+
+
+@cred_group.command("add", help="Add or update a credential, then recompile the flat config.")
+@click.argument("key_path")
+@click.option("--from-stdin", is_flag=True, help="Read the value from stdin.")
+@click.option("--from-env", metavar="VAR", help="Read the value from an environment variable.")
+@click.option("--value", "inline_value", help="Inline value. Avoid: leaks to shell history.")
+@click.option("--json", "parse_json", is_flag=True, help="Parse the value as JSON (bool/number/object/array).")
+def add(key_path, from_stdin, from_env, inline_value, parse_json):
+    sources = [bool(from_stdin), bool(from_env), inline_value is not None]
+    if sum(sources) > 1:
+        raise click.UsageError("Use only one of --from-stdin, --from-env, --value.")
+
+    if from_stdin:
+        value = sys.stdin.read().rstrip("\n")
+    elif from_env:
+        if from_env not in os.environ:
+            raise click.ClickException(f"env var {from_env} not set")
+        value = os.environ[from_env]
+    elif inline_value is not None:
+        value = inline_value
+    else:
+        value = getpass.getpass(f"value for {key_path} (no echo): ")
+        if not value:
+            raise click.ClickException("empty value, aborting")
+
+    if parse_json:
+        try:
+            value = json.loads(value)
+        except json.JSONDecodeError as exc:
+            raise click.ClickException(f"--json: failed to parse value: {exc}") from exc
+
+    path, existed = _guard(set_value, key_path, value)
+    count, _, target = _guard(compile_flat)
+    verb = "updated" if existed else "added"
+    success(f"{verb} {key_path} in {relative_to_store(path)}, recompiled {target} ({count} entries)")
+
+
+@cred_group.command("refresh", help="Refresh Google OAuth access tokens and recompile.")
+@click.option("--all", "refresh_all", is_flag=True, help="Refresh every refreshable OAuth entry.")
+@click.option(
+    "--service",
+    type=click.Choice(sorted(google_oauth.SERVICE_ALIASES)),
+    help="Refresh a single service.",
+)
+@click.option("--dry-run", is_flag=True, help="Show what would be refreshed without calling Google.")
+def refresh(refresh_all, service, dry_run):
+    if refresh_all == bool(service):
+        raise click.UsageError("Pass exactly one of --all or --service.")
+
+    _guard(require_folder)
+    target = "*" if refresh_all else google_oauth.SERVICE_ALIASES[service]
+    entries = _guard(google_oauth.select_entries, target)
+    if not entries:
+        raise click.ClickException("no matching refreshable oauth entries")
+
+    failures = 0
+    refreshed = 0
+    for path, entry in entries:
+        name = entry.get("id", path.name)
+        creds, err = google_oauth.resolve_creds(entry)
+        if err:
+            warning(f"{name}: skip ({err})")
+            failures += 1
+            continue
+
+        if dry_run:
+            info(
+                f"{name}: would POST {google_oauth.TOKEN_URL} "
+                f"refresh_token={creds['refresh_token'][:10]}... client_id={creds['client_id'][:12]}..."
+            )
+            continue
+
+        try:
+            expiry = google_oauth.refresh_entry(path, entry, creds)
+        except Exception as exc:
+            warning(f"{name}: {google_oauth.describe_error(exc)}")
+            failures += 1
+            continue
+
+        refreshed += 1
+        success(f"{name}: refreshed, valid until {expiry}")
+
+    if refreshed:
+        count, _, target_path = _guard(compile_flat)
+        info(f"recompiled {target_path} ({count} entries)")
+
+    if failures:
+        raise click.exceptions.Exit(1)
+
+
+@cred_group.command("auth", help="Run the first-time Google OAuth consent flow and store the refresh token.")
+@click.option(
+    "--service",
+    required=True,
+    type=click.Choice(sorted(google_oauth.SERVICE_ALIASES)),
+    help="Which service to authorise.",
+)
+@click.option(
+    "--client-secrets",
+    type=click.Path(exists=True, dir_okay=False, path_type=Path),
+    help="OAuth client JSON downloaded from the Cloud Console. Omit to reuse the stored client.",
+)
+@click.option("--scope", "scopes", multiple=True, help="Override the scopes. Repeat for several.")
+@click.option("--no-browser", is_flag=True, help="Print the URL instead of opening a browser.")
+def auth(service, client_secrets, scopes, no_browser):
+    target = google_oauth.SERVICE_ALIASES[service]
+    _guard(require_folder)
+
+    entries = _guard(google_oauth.select_entries, target)
+    if not entries:
+        raise click.ClickException(f"no oauth entry for '{service}' in the store")
+    path, entry = entries[0]
+
+    resolved_scopes = list(scopes) or (entry.get("oauth") or {}).get("scopes")
+    if not resolved_scopes:
+        raise click.ClickException(
+            f"no scopes known for '{service}'. Pass --scope, or add them to the oauth descriptor "
+            f"in evo_cli/credentials/registry.py."
+        )
+
+    if client_secrets:
+        client_id, client_secret = _guard(oauth_flow.client_from_secrets_file, client_secrets)
+    else:
+        client_id, client_secret = oauth_flow.client_from_entry(entry)
+    if not client_id or not client_secret:
+        raise click.ClickException(
+            "no OAuth client available. Create one in the Cloud Console "
+            "(APIs & Services -> Credentials -> OAuth client ID -> Desktop app), download the JSON, "
+            "and pass it with --client-secrets."
+        )
+
+    server, redirect_uri, thread = oauth_flow.capture_code()
+    state = oauth_flow.new_state()
+    url = oauth_flow.build_auth_url(client_id, redirect_uri, resolved_scopes, state)
+
+    info(f"scopes: {', '.join(resolved_scopes)}")
+    info(f"listening on {redirect_uri}")
+    if no_browser:
+        console.print(f"\nOpen this URL to authorise:\n\n{url}\n")
+    else:
+        console.print("\nOpening your browser to authorise. Approve the consent screen.\n")
+        webbrowser.open(url)
+
+    thread.start()
+    thread.join(timeout=300)
+    result = oauth_flow._Handler.result
+    server.server_close()
+
+    if result is None:
+        raise click.ClickException("timed out waiting for the consent redirect")
+    if result.get("error"):
+        raise click.ClickException(f"Google returned an error: {result['error']}")
+    if result.get("state") != state:
+        raise click.ClickException("state mismatch on the redirect; aborting rather than trusting it")
+
+    body = _guard(oauth_flow.exchange_code, client_id, client_secret, result["code"], redirect_uri)
+
+    oauth = entry.get("oauth") or {}
+    container_path = oauth.get("client_from") or oauth.get("container") or []
+    if container_path:
+        cursor = entry.setdefault("flat", {})
+        for part in container_path[:-1]:
+            cursor = cursor.setdefault(part, {})
+        leaf = cursor.setdefault(container_path[-1], {})
+        leaf["client_id"] = client_id
+        leaf["client_secret"] = client_secret
+
+    expiry = _guard(oauth_flow.store_tokens, path, entry, body, resolved_scopes)
+    count, _, target_path = _guard(compile_flat)
+    success(f"{target}: authorised, valid until {expiry}")
+    success(f"compiled {count} entries -> {target_path}")
+
+
+@cred_group.command("migrate", help="Split a flat omelet.json into the per-service credentials folder.")
+@click.option("--source", "source", type=click.Path(), help="Flat file to migrate. Defaults to the compiled config.")
+@click.option("--dry-run", is_flag=True, help="Show the plan, write nothing.")
+@click.option("--merge", is_flag=True, help="Migrate into an existing folder, adding only keys not already present.")
+@click.option("--strict", is_flag=True, help="Abort on keys not mapped in the registry instead of routing to misc/.")
+@click.option("--force", is_flag=True, help="Overwrite an existing non-empty folder.")
+def migrate_command(source, dry_run, merge, strict, force):
+    result = _guard(migrate.plan, source or config_path(), strict=strict, merge=merge)
+
+    console.print(f"source: {result['source_path']} ({result['source_keys']} top-level keys)")
+    console.print(f"target: {credentials_dir()}{'  [MERGE]' if merge else ''}\n")
+
+    for item in result["actions"]:
+        flags = " [unmapped->misc]" if item["misc"] else ""
+        if item["entry"].get("status") == "deprecated":
+            flags += " [DEPRECATED]"
+        if item["entry"].get("expiry"):
+            flags += f" expiry={item['entry']['expiry']}"
+        console.print(f"  {item['action']:6s} {item['rel']:40s} <- {', '.join(item['keys'])}{flags}")
+
+    if result["unmapped"]:
+        warning(f"{len(result['unmapped'])} unmapped key(s) routed to misc/: {', '.join(result['unmapped'])}")
+
+    if dry_run:
+        info(f"dry-run: would write {len(result['actions'])} file(s)")
+        return
+
+    if not result["actions"]:
+        info("nothing to do (folder already up to date)")
+        return
+
+    if migrate.folder_has_files() and not (merge or force):
+        raise click.ClickException(
+            f"refusing: {credentials_dir()} already has files.\n"
+            "Use --merge (add missing keys) or --force (overwrite), or point OMELET_DIR elsewhere."
+        )
+
+    backup = _guard(migrate.apply, result)
+    info(f"backed up source -> {backup}")
+    success(f"wrote {len(result['actions'])} file(s) to {credentials_dir()}")
+
+    count, _, target_path = _guard(compile_flat)
+    success(f"compiled {count} entries -> {target_path}")
+
+
+@cred_group.group("sync", help="Sync the credentials folder with a private GitHub repo.")
+def sync_group():
+    pass
+
+
+@sync_group.command("push", help="Push the local credentials folder to the sync repo.")
+def sync_push():
+    host = _guard(sync.push)
+    if host is None:
+        info("no changes to push")
+        return
+    success(f"pushed {sync.dir_in_repo()}/ to {sync.sync_repo()} (from {host})")
+
+
+@sync_group.command("pull", help="Pull the credentials folder from the sync repo, then recompile.")
+def sync_pull():
+    backup = _guard(sync.pull)
+    if backup:
+        info(f"backed up existing folder -> {backup}")
+    success(f"pulled {sync.sync_repo()}:{sync.dir_in_repo()}/ -> {credentials_dir()}")
+    count, _, target_path = _guard(compile_flat)
+    success(f"compiled {count} entries -> {target_path}")
+
+
+@cred_group.command("path", help="Print the store locations this machine resolves to.")
+def show_path():
+    console.print(f"folder: {credentials_dir()}")
+    console.print(f"flat:   {config_path()}")
+    try:
+        keys = [key for key in read_flat() if not key.startswith("_")]
+    except CredentialError:
+        keys = []
+    console.print(f"keys:   {len(keys)}")

{evo_cli-0.11.4 → evo_cli-0.12.2}/evo_cli/commands/gdrive.py

@@ -1,22 +1,23 @@
 import base64
 import json
 import mimetypes
-import os
 import re
 import sys
-import tempfile
 import urllib.error
 import urllib.parse
 import urllib.request
-from datetime import datetime, timedelta, timezone
+from datetime import datetime, timezone
 from pathlib import Path
 
 import rich_click as click
 from rich.text import Text
 
 from evo_cli.console import error, info, step, success, warning
+from evo_cli.credentials import google_oauth
+from evo_cli.credentials.registry import dig, load_entries
+from evo_cli.credentials.store import compile_flat
 
-CONFIG_PATH = Path(os.environ.get("OMELET_CONFIG", str(Path.home() / ".omelet.json")))
+DRIVE_SERVICE_ID = "google_drive"
 TOKEN_URL = "https://oauth2.googleapis.com/token"
 DOCS_API = "https://docs.googleapis.com/v1/documents/{doc_id}"
 DRIVE_FILE_API = "https://www.googleapis.com/drive/v3/files/{file_id}"
@@ -48,24 +49,14 @@ def extract_doc_id(value):
     return None
 
 
-def read_config():
-    if not CONFIG_PATH.exists():
-        raise click.ClickException(f"config not found: {CONFIG_PATH}")
-    return json.loads(CONFIG_PATH.read_text(encoding="utf-8"))
-
-
-def write_config(data):
-    tmp = tempfile.NamedTemporaryFile("w", delete=False, dir=str(CONFIG_PATH.parent), encoding="utf-8")
-    try:
-        json.dump(data, tmp, indent=2, ensure_ascii=False)
-        tmp.write("\n")
-        tmp.close()
-        os.chmod(tmp.name, 0o600)
-        os.replace(tmp.name, CONFIG_PATH)
-    except Exception:
-        if os.path.exists(tmp.name):
-            os.unlink(tmp.name)
-        raise
+def drive_entry():
+    for path, entry in load_entries():
+        if entry.get("id") == DRIVE_SERVICE_ID and entry.get("oauth"):
+            return path, entry
+    raise click.ClickException(
+        f"no '{DRIVE_SERVICE_ID}' oauth entry in the credential store. "
+        "Authorise it once with: evo cred auth --service google-drive --client-secrets <client.json>"
+    )
 
 
 def token_expired(token_section):
@@ -73,7 +64,7 @@ def token_expired(token_section):
     if not expiry:
         return True
     try:
-        when = datetime.fromisoformat(expiry)
+        when = datetime.fromisoformat(str(expiry).replace("Z", "+00:00"))
     except ValueError:
         return True
     if when.tzinfo is None:
@@ -82,62 +73,31 @@ def token_expired(token_section):
     return (when - now).total_seconds() < 60
 
 
-def refresh_token(data):
-    rclone_section = data.get("rclone", {})
-    token_section = rclone_section.get("token", {})
-    refresh = token_section.get("refresh_token")
-    if not refresh:
-        raise click.ClickException("rclone.token.refresh_token missing in config")
-
-    client_id = os.environ.get("RCLONE_DRIVE_CLIENT_ID") or rclone_section.get("client_id")
-    client_secret = os.environ.get("RCLONE_DRIVE_CLIENT_SECRET") or rclone_section.get("client_secret")
-    if not client_id or not client_secret:
+def refresh_token(path, entry):
+    creds, err = google_oauth.resolve_creds(entry)
+    if err:
         raise click.ClickException(
-            "OAuth client credentials required. Set RCLONE_DRIVE_CLIENT_ID + RCLONE_DRIVE_CLIENT_SECRET "
-            "or add rclone.client_id + rclone.client_secret to the config."
+            f"cannot refresh {DRIVE_SERVICE_ID}: {err}. "
+            "Authorise once with: evo cred auth --service google-drive --client-secrets <client.json>"
         )
-
-    payload = urllib.parse.urlencode(
-        {
-            "client_id": client_id,
-            "client_secret": client_secret,
-            "refresh_token": refresh,
-            "grant_type": "refresh_token",
-        }
-    ).encode("utf-8")
-    req = urllib.request.Request(TOKEN_URL, data=payload, method="POST")
-    req.add_header("Content-Type", "application/x-www-form-urlencoded")
-
     try:
-        with urllib.request.urlopen(req, timeout=30) as resp:
-            body = json.loads(resp.read().decode("utf-8"))
-    except urllib.error.HTTPError as exc:
-        err_body = exc.read().decode("utf-8", "replace")
-        raise click.ClickException(f"token refresh failed: HTTP {exc.code} {err_body}") from exc
-
-    access = body.get("access_token")
-    if not access:
-        raise click.ClickException(f"no access_token in refresh response: {body}")
-
-    expires_in = int(body.get("expires_in", 3600))
-    tz = timezone(timedelta(hours=7))
-    expiry = (datetime.now(tz) + timedelta(seconds=expires_in)).isoformat()
+        expiry = google_oauth.refresh_entry(path, entry, creds)
+    except Exception as exc:
+        raise click.ClickException(f"token refresh failed: {google_oauth.describe_error(exc)}") from exc
 
-    data["rclone"]["token"]["access_token"] = access
-    data["rclone"]["token"]["expiry"] = expiry
-    data["rclone"]["token"]["expires_in"] = expires_in
-    write_config(data)
+    compile_flat()
     info(f"Refreshed Drive access token (valid until [accent]{expiry}[/accent])")
-    return access
+    return creds["container"][entry["oauth"]["access_field"]]
 
 
 def access_token():
-    data = read_config()
-    token_section = data.get("rclone", {}).get("token", {})
-    token = token_section.get("access_token")
-    if not token or token_expired(token_section):
+    path, entry = drive_entry()
+    oauth = entry["oauth"]
+    container = dig(entry.get("flat", {}), oauth["container"]) or {}
+    token = container.get(oauth["access_field"])
+    if not token or token_expired(container):
         info("Access token missing or expired - refreshing.")
-        token = refresh_token(data)
+        token = refresh_token(path, entry)
     return token
 
 

{evo_cli-0.11.4 → evo_cli-0.12.2}/evo_cli/commands/localproxy.py

@@ -32,7 +32,6 @@ from rich.text import Text
 
 from evo_cli.console import console, error, info, step, success, warning
 
-
 # ── Certificate authority / leaf generation ──────────────────────────────────
 
 def _cert_dir(custom=None):