evo-cli 0.12.1__tar.gz → 0.13.0__tar.gz

{evo_cli-0.12.1 → evo_cli-0.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.12.1
+Version: 0.13.0
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli
@@ -124,6 +124,7 @@ directly.
 evo cred doctor                       # health + expiry of every credential, exit 1 if any expired
 evo cred get openai_api_key           # print one value by dotted path, nothing else on stdout
 evo cred add openai_api_key           # prompt with no echo, write the folder file, recompile
+evo cred auth --service google-drive  # first-time OAuth consent, stores the refresh token
 evo cred refresh --all                # refresh Google OAuth access tokens
 evo cred compile                      # rebuild ~/.omelet.json from the folder
 evo cred sync push                    # push the folder to a private GitHub repo via gh
@@ -146,6 +147,16 @@ Configuration is env-driven, with no personal defaults baked in:
 `evo cred sync push` refuses to push to a repo whose visibility is not `PRIVATE`. Never echo a value
 into a shared terminal or a log; `doctor` and `list` only ever print a masked preview.
 
+`evo cred auth` performs the initial OAuth consent that `refresh` cannot: it starts a loopback server,
+opens the consent screen, and writes the resulting refresh token into the store. Create the OAuth
+client in the Cloud Console first (APIs & Services -> Credentials -> Create OAuth client ID ->
+**Desktop app**) and pass the downloaded JSON with `--client-secrets`; there is no gcloud equivalent
+for creating an OAuth client.
+
+`evo gdrive` reads its token from the `google_drive` entry through this store rather than parsing
+`~/.omelet.json` itself, so a refresh writes to the folder and recompiles instead of racing whatever
+else has the flat file open.
+
 #### Harness Repositories
 
 Fast-forward every available repository declared in a harness manifest:
@@ -166,3 +177,49 @@ evo harness pull --dry-run
 The command reads `harness.yaml` and its optional `harness.local.yaml` overlay. Repositories marked
 `present: false` are skipped. Repositories with uncommitted changes are not modified, and every pull
 uses `git pull --ff-only` so the command never creates merge commits.
+
+#### Text to Speech
+
+Synthesise speech through Vbee (Vietnamese) or OpenAI `gpt-4o-mini-tts`, and play it right away:
+
+```bash
+evo tts speak "Xin chào, bản build đã xong"
+evo tts speak -f notes.md -o notes.mp3
+evo tts speak "hello there" -p openai -V nova --instructions "calm and encouraging"
+git log -1 --format=%s | evo tts speak
+```
+
+`speak` is the realtime path. Text longer than the provider's per-request limit (Vbee 300
+characters, OpenAI 4000) is split on sentence boundaries and the audio is joined back into one file,
+so the first words start playing while the rest is still being synthesised.
+
+For bulk work use the batch path, which goes through Vbee's async API and polls
+`/v1/tts/requests/{id}` until each audio link appears:
+
+```bash
+evo tts batch chapters/ -o audio/          # one mp3 per .txt/.md file
+evo tts batch a.txt b.txt -c 8             # 8 items in flight
+evo tts batch --manifest jobs.jsonl        # {"id":.., "text":.., "voice":..} per line
+```
+
+OpenAI has no batch speech endpoint, so with `-p openai` the items are parallelised locally instead.
+
+Voice codes come from `evo tts voices` (`-l en-US`, `--gender male`, `-p openai`, `--json`).
+
+Credentials live in the omelet store, never in flags or source:
+
+```bash
+evo cred add vbee.app_id --from-stdin      # UUID from https://studio.vbee.vn/apps
+evo cred add vbee.token --from-stdin       # JWT from the same app page
+evo cred add openai_api_key --from-stdin
+```
+
+`VBEE_APP_ID`, `VBEE_TOKEN`, and `OPENAI_API_KEY` override the store when set. `--provider auto`
+(the default) picks Vbee when its credentials exist, otherwise OpenAI.
+
+Playback uses whichever of `ffplay`, `mpv`, `cvlc`, `afplay`, or `paplay`/`aplay` is on PATH, and
+falls back to PowerShell's `MediaPlayer` on Windows. Without any of them the audio is still written
+to disk and the command warns.
+
+The same engine backs the `evo-tts` MCP server in
+[agent-skills](https://github.com/maycuatroi1/agent-skills), which gives an agent a `speak` tool.

{evo_cli-0.12.1 → evo_cli-0.13.0}/README.md

@@ -96,6 +96,7 @@ directly.
 evo cred doctor                       # health + expiry of every credential, exit 1 if any expired
 evo cred get openai_api_key           # print one value by dotted path, nothing else on stdout
 evo cred add openai_api_key           # prompt with no echo, write the folder file, recompile
+evo cred auth --service google-drive  # first-time OAuth consent, stores the refresh token
 evo cred refresh --all                # refresh Google OAuth access tokens
 evo cred compile                      # rebuild ~/.omelet.json from the folder
 evo cred sync push                    # push the folder to a private GitHub repo via gh
@@ -118,6 +119,16 @@ Configuration is env-driven, with no personal defaults baked in:
 `evo cred sync push` refuses to push to a repo whose visibility is not `PRIVATE`. Never echo a value
 into a shared terminal or a log; `doctor` and `list` only ever print a masked preview.
 
+`evo cred auth` performs the initial OAuth consent that `refresh` cannot: it starts a loopback server,
+opens the consent screen, and writes the resulting refresh token into the store. Create the OAuth
+client in the Cloud Console first (APIs & Services -> Credentials -> Create OAuth client ID ->
+**Desktop app**) and pass the downloaded JSON with `--client-secrets`; there is no gcloud equivalent
+for creating an OAuth client.
+
+`evo gdrive` reads its token from the `google_drive` entry through this store rather than parsing
+`~/.omelet.json` itself, so a refresh writes to the folder and recompiles instead of racing whatever
+else has the flat file open.
+
 #### Harness Repositories
 
 Fast-forward every available repository declared in a harness manifest:
@@ -138,3 +149,49 @@ evo harness pull --dry-run
 The command reads `harness.yaml` and its optional `harness.local.yaml` overlay. Repositories marked
 `present: false` are skipped. Repositories with uncommitted changes are not modified, and every pull
 uses `git pull --ff-only` so the command never creates merge commits.
+
+#### Text to Speech
+
+Synthesise speech through Vbee (Vietnamese) or OpenAI `gpt-4o-mini-tts`, and play it right away:
+
+```bash
+evo tts speak "Xin chào, bản build đã xong"
+evo tts speak -f notes.md -o notes.mp3
+evo tts speak "hello there" -p openai -V nova --instructions "calm and encouraging"
+git log -1 --format=%s | evo tts speak
+```
+
+`speak` is the realtime path. Text longer than the provider's per-request limit (Vbee 300
+characters, OpenAI 4000) is split on sentence boundaries and the audio is joined back into one file,
+so the first words start playing while the rest is still being synthesised.
+
+For bulk work use the batch path, which goes through Vbee's async API and polls
+`/v1/tts/requests/{id}` until each audio link appears:
+
+```bash
+evo tts batch chapters/ -o audio/          # one mp3 per .txt/.md file
+evo tts batch a.txt b.txt -c 8             # 8 items in flight
+evo tts batch --manifest jobs.jsonl        # {"id":.., "text":.., "voice":..} per line
+```
+
+OpenAI has no batch speech endpoint, so with `-p openai` the items are parallelised locally instead.
+
+Voice codes come from `evo tts voices` (`-l en-US`, `--gender male`, `-p openai`, `--json`).
+
+Credentials live in the omelet store, never in flags or source:
+
+```bash
+evo cred add vbee.app_id --from-stdin      # UUID from https://studio.vbee.vn/apps
+evo cred add vbee.token --from-stdin       # JWT from the same app page
+evo cred add openai_api_key --from-stdin
+```
+
+`VBEE_APP_ID`, `VBEE_TOKEN`, and `OPENAI_API_KEY` override the store when set. `--provider auto`
+(the default) picks Vbee when its credentials exist, otherwise OpenAI.
+
+Playback uses whichever of `ffplay`, `mpv`, `cvlc`, `afplay`, or `paplay`/`aplay` is on PATH, and
+falls back to PowerShell's `MediaPlayer` on Windows. Without any of them the audio is still written
+to disk and the command warns.
+
+The same engine backs the `evo-tts` MCP server in
+[agent-skills](https://github.com/maycuatroi1/agent-skills), which gives an agent a `speak` tool.

evo_cli-0.13.0/evo_cli/VERSION

@@ -0,0 +1 @@
+0.13.0

{evo_cli-0.12.1 → evo_cli-0.13.0}/evo_cli/cli.py

@@ -20,6 +20,7 @@ from evo_cli.commands.plantuml import plantuml
 from evo_cli.commands.site2s import site2s
 from evo_cli.commands.ssh import setupssh
 from evo_cli.commands.sysmon import sysmon
+from evo_cli.commands.tts import tts_group
 from evo_cli.commands.update import update
 from evo_cli.commands.wifi import wifi
 
@@ -71,6 +72,7 @@ cli.add_command(mcp_group)
 cli.add_command(netcheck)
 cli.add_command(plantuml)
 cli.add_command(sysmon)
+cli.add_command(tts_group)
 cli.add_command(update)
 cli.add_command(wifi)
 

{evo_cli-0.12.1 → evo_cli-0.13.0}/evo_cli/commands/cred.py

@@ -2,13 +2,15 @@ import getpass
 import json
 import os
 import sys
+import webbrowser
+from pathlib import Path
 
 import rich_click as click
 from rich.table import Table
 
 from evo_cli.console import console, info, success, warning
 from evo_cli.credentials import doctor as doctor_module
-from evo_cli.credentials import google_oauth, migrate, sync
+from evo_cli.credentials import google_oauth, migrate, oauth_flow, sync
 from evo_cli.credentials.registry import config_path, credentials_dir
 from evo_cli.credentials.store import (
     CredentialError,
@@ -199,6 +201,89 @@ def refresh(refresh_all, service, dry_run):
         raise click.exceptions.Exit(1)
 
 
+@cred_group.command("auth", help="Run the first-time Google OAuth consent flow and store the refresh token.")
+@click.option(
+    "--service",
+    required=True,
+    type=click.Choice(sorted(google_oauth.SERVICE_ALIASES)),
+    help="Which service to authorise.",
+)
+@click.option(
+    "--client-secrets",
+    type=click.Path(exists=True, dir_okay=False, path_type=Path),
+    help="OAuth client JSON downloaded from the Cloud Console. Omit to reuse the stored client.",
+)
+@click.option("--scope", "scopes", multiple=True, help="Override the scopes. Repeat for several.")
+@click.option("--no-browser", is_flag=True, help="Print the URL instead of opening a browser.")
+def auth(service, client_secrets, scopes, no_browser):
+    target = google_oauth.SERVICE_ALIASES[service]
+    _guard(require_folder)
+
+    entries = _guard(google_oauth.select_entries, target)
+    if not entries:
+        raise click.ClickException(f"no oauth entry for '{service}' in the store")
+    path, entry = entries[0]
+
+    resolved_scopes = list(scopes) or (entry.get("oauth") or {}).get("scopes")
+    if not resolved_scopes:
+        raise click.ClickException(
+            f"no scopes known for '{service}'. Pass --scope, or add them to the oauth descriptor "
+            f"in evo_cli/credentials/registry.py."
+        )
+
+    if client_secrets:
+        client_id, client_secret = _guard(oauth_flow.client_from_secrets_file, client_secrets)
+    else:
+        client_id, client_secret = oauth_flow.client_from_entry(entry)
+    if not client_id or not client_secret:
+        raise click.ClickException(
+            "no OAuth client available. Create one in the Cloud Console "
+            "(APIs & Services -> Credentials -> OAuth client ID -> Desktop app), download the JSON, "
+            "and pass it with --client-secrets."
+        )
+
+    server, redirect_uri, thread = oauth_flow.capture_code()
+    state = oauth_flow.new_state()
+    url = oauth_flow.build_auth_url(client_id, redirect_uri, resolved_scopes, state)
+
+    info(f"scopes: {', '.join(resolved_scopes)}")
+    info(f"listening on {redirect_uri}")
+    if no_browser:
+        console.print(f"\nOpen this URL to authorise:\n\n{url}\n")
+    else:
+        console.print("\nOpening your browser to authorise. Approve the consent screen.\n")
+        webbrowser.open(url)
+
+    thread.start()
+    thread.join(timeout=300)
+    result = oauth_flow._Handler.result
+    server.server_close()
+
+    if result is None:
+        raise click.ClickException("timed out waiting for the consent redirect")
+    if result.get("error"):
+        raise click.ClickException(f"Google returned an error: {result['error']}")
+    if result.get("state") != state:
+        raise click.ClickException("state mismatch on the redirect; aborting rather than trusting it")
+
+    body = _guard(oauth_flow.exchange_code, client_id, client_secret, result["code"], redirect_uri)
+
+    oauth = entry.get("oauth") or {}
+    container_path = oauth.get("client_from") or oauth.get("container") or []
+    if container_path:
+        cursor = entry.setdefault("flat", {})
+        for part in container_path[:-1]:
+            cursor = cursor.setdefault(part, {})
+        leaf = cursor.setdefault(container_path[-1], {})
+        leaf["client_id"] = client_id
+        leaf["client_secret"] = client_secret
+
+    expiry = _guard(oauth_flow.store_tokens, path, entry, body, resolved_scopes)
+    count, _, target_path = _guard(compile_flat)
+    success(f"{target}: authorised, valid until {expiry}")
+    success(f"compiled {count} entries -> {target_path}")
+
+
 @cred_group.command("migrate", help="Split a flat omelet.json into the per-service credentials folder.")
 @click.option("--source", "source", type=click.Path(), help="Flat file to migrate. Defaults to the compiled config.")
 @click.option("--dry-run", is_flag=True, help="Show the plan, write nothing.")

{evo_cli-0.12.1 → evo_cli-0.13.0}/evo_cli/commands/gdrive.py

@@ -1,22 +1,23 @@
 import base64
 import json
 import mimetypes
-import os
 import re
 import sys
-import tempfile
 import urllib.error
 import urllib.parse
 import urllib.request
-from datetime import datetime, timedelta, timezone
+from datetime import datetime, timezone
 from pathlib import Path
 
 import rich_click as click
 from rich.text import Text
 
 from evo_cli.console import error, info, step, success, warning
+from evo_cli.credentials import google_oauth
+from evo_cli.credentials.registry import dig, load_entries
+from evo_cli.credentials.store import compile_flat
 
-CONFIG_PATH = Path(os.environ.get("OMELET_CONFIG", str(Path.home() / ".omelet.json")))
+DRIVE_SERVICE_ID = "google_drive"
 TOKEN_URL = "https://oauth2.googleapis.com/token"
 DOCS_API = "https://docs.googleapis.com/v1/documents/{doc_id}"
 DRIVE_FILE_API = "https://www.googleapis.com/drive/v3/files/{file_id}"
@@ -48,24 +49,14 @@ def extract_doc_id(value):
     return None
 
 
-def read_config():
-    if not CONFIG_PATH.exists():
-        raise click.ClickException(f"config not found: {CONFIG_PATH}")
-    return json.loads(CONFIG_PATH.read_text(encoding="utf-8"))
-
-
-def write_config(data):
-    tmp = tempfile.NamedTemporaryFile("w", delete=False, dir=str(CONFIG_PATH.parent), encoding="utf-8")
-    try:
-        json.dump(data, tmp, indent=2, ensure_ascii=False)
-        tmp.write("\n")
-        tmp.close()
-        os.chmod(tmp.name, 0o600)
-        os.replace(tmp.name, CONFIG_PATH)
-    except Exception:
-        if os.path.exists(tmp.name):
-            os.unlink(tmp.name)
-        raise
+def drive_entry():
+    for path, entry in load_entries():
+        if entry.get("id") == DRIVE_SERVICE_ID and entry.get("oauth"):
+            return path, entry
+    raise click.ClickException(
+        f"no '{DRIVE_SERVICE_ID}' oauth entry in the credential store. "
+        "Authorise it once with: evo cred auth --service google-drive --client-secrets <client.json>"
+    )
 
 
 def token_expired(token_section):
@@ -73,7 +64,7 @@ def token_expired(token_section):
     if not expiry:
         return True
     try:
-        when = datetime.fromisoformat(expiry)
+        when = datetime.fromisoformat(str(expiry).replace("Z", "+00:00"))
     except ValueError:
         return True
     if when.tzinfo is None:
@@ -82,62 +73,31 @@ def token_expired(token_section):
     return (when - now).total_seconds() < 60
 
 
-def refresh_token(data):
-    rclone_section = data.get("rclone", {})
-    token_section = rclone_section.get("token", {})
-    refresh = token_section.get("refresh_token")
-    if not refresh:
-        raise click.ClickException("rclone.token.refresh_token missing in config")
-
-    client_id = os.environ.get("RCLONE_DRIVE_CLIENT_ID") or rclone_section.get("client_id")
-    client_secret = os.environ.get("RCLONE_DRIVE_CLIENT_SECRET") or rclone_section.get("client_secret")
-    if not client_id or not client_secret:
+def refresh_token(path, entry):
+    creds, err = google_oauth.resolve_creds(entry)
+    if err:
         raise click.ClickException(
-            "OAuth client credentials required. Set RCLONE_DRIVE_CLIENT_ID + RCLONE_DRIVE_CLIENT_SECRET "
-            "or add rclone.client_id + rclone.client_secret to the config."
+            f"cannot refresh {DRIVE_SERVICE_ID}: {err}. "
+            "Authorise once with: evo cred auth --service google-drive --client-secrets <client.json>"
         )
-
-    payload = urllib.parse.urlencode(
-        {
-            "client_id": client_id,
-            "client_secret": client_secret,
-            "refresh_token": refresh,
-            "grant_type": "refresh_token",
-        }
-    ).encode("utf-8")
-    req = urllib.request.Request(TOKEN_URL, data=payload, method="POST")
-    req.add_header("Content-Type", "application/x-www-form-urlencoded")
-
     try:
-        with urllib.request.urlopen(req, timeout=30) as resp:
-            body = json.loads(resp.read().decode("utf-8"))
-    except urllib.error.HTTPError as exc:
-        err_body = exc.read().decode("utf-8", "replace")
-        raise click.ClickException(f"token refresh failed: HTTP {exc.code} {err_body}") from exc
-
-    access = body.get("access_token")
-    if not access:
-        raise click.ClickException(f"no access_token in refresh response: {body}")
-
-    expires_in = int(body.get("expires_in", 3600))
-    tz = timezone(timedelta(hours=7))
-    expiry = (datetime.now(tz) + timedelta(seconds=expires_in)).isoformat()
+        expiry = google_oauth.refresh_entry(path, entry, creds)
+    except Exception as exc:
+        raise click.ClickException(f"token refresh failed: {google_oauth.describe_error(exc)}") from exc
 
-    data["rclone"]["token"]["access_token"] = access
-    data["rclone"]["token"]["expiry"] = expiry
-    data["rclone"]["token"]["expires_in"] = expires_in
-    write_config(data)
+    compile_flat()
     info(f"Refreshed Drive access token (valid until [accent]{expiry}[/accent])")
-    return access
+    return creds["container"][entry["oauth"]["access_field"]]
 
 
 def access_token():
-    data = read_config()
-    token_section = data.get("rclone", {}).get("token", {})
-    token = token_section.get("access_token")
-    if not token or token_expired(token_section):
+    path, entry = drive_entry()
+    oauth = entry["oauth"]
+    container = dig(entry.get("flat", {}), oauth["container"]) or {}
+    token = container.get(oauth["access_field"])
+    if not token or token_expired(container):
         info("Access token missing or expired - refreshing.")
-        token = refresh_token(data)
+        token = refresh_token(path, entry)
     return token
 
 

{evo_cli-0.12.1 → evo_cli-0.13.0}/evo_cli/commands/localproxy.py

@@ -32,7 +32,6 @@ from rich.text import Text
 
 from evo_cli.console import console, error, info, step, success, warning
 
-
 # ── Certificate authority / leaf generation ──────────────────────────────────
 
 def _cert_dir(custom=None):