godfather-cli 2.1.0__tar.gz → 2.3.0__tar.gz

{godfather_cli-2.1.0/godfather_cli.egg-info → godfather_cli-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: godfather-cli
-Version: 2.1.0
+Version: 2.3.0
 Summary: Free compute for ASU students: connect to AI Society at ASU GPU pods
 Author-email: AI Society ASU <theaisocietyasu@gmail.com>
 License: MIT
@@ -62,10 +62,13 @@ pip install -e .
 
 1. Run `godfather` with no arguments. On first run you won't be logged in
    yet, so it'll walk you into the login flow.
-2. It opens the AI Society platform's sign-in page in your browser (and
-   prints the link). Sign in with Discord and copy the token shown there.
-3. Paste the token back into the terminal. The CLI checks it with the
-   platform and stores it in `~/.godfather/config.json`.
+2. It opens the sign-in page in your browser and prints the link. Sign in
+   with Discord. The browser sends the login back to the CLI, which checks it
+   and stores the token in `~/.godfather/config.json`.
+3. If the browser cannot reach the CLI (no browser on this computer, an
+   older server, or no sign-in within 5 minutes), the CLI asks you to paste
+   the token that the sign-in page shows. `godfather auth --paste` goes
+   straight to that, for a browser on another computer.
 4. From the menu (or `godfather connect`), pick a pod. The CLI creates an SSH
    key on your machine the first time, asks the server for a 12-hour
    certificate for that pod, and opens the connection.
@@ -81,12 +84,14 @@ Windows 10+ ship it.
 ### Interactive menu
 
 Running `godfather` with no arguments opens a menu. Use the arrow keys to
-choose Connect to a pod, List pods, Status, Log out or Exit, and press Enter.
-Ctrl-C quits.
+choose Connect to a pod, List pods, Sessions, Set up VS Code, Status, Log out or Exit, and
+press Enter. Ctrl-C quits.
 
 Connect to a pod shows a list of your pods with their status, access and
 pod ID. A pod that is not running shows with the reason and cannot be
 chosen. If only one pod is running, the CLI asks for a yes instead.
+If none of your pods is running, the CLI shows the next session on your
+pods. A pod starts 10 minutes before its session.
 
 When input is not a terminal (for example in a script), the menu and the pod
 list use numbered prompts.
@@ -97,8 +102,13 @@ list use numbered prompts.
 godfather list                    # List pods you can connect to
 godfather connect                 # Connect to a pod, picking from a list
 godfather connect <pod-id>        # Connect to a specific pod
+godfather connect --admin         # Ask for a root shell (officers, when pod admin is on)
+godfather sessions                # Upcoming sessions on your pods, in local time
+godfather vscode                  # Set up VS Code Remote-SSH for a pod, picking from a list
+godfather vscode <pod-id>         # The same for one pod; run it again to renew the certificate
 godfather status                  # Show server, org, login, token expiry and version
-godfather auth                    # Log in, or refresh an expired session
+godfather auth                    # Log in with Discord in your browser
+godfather auth --paste            # Log in by pasting the token
 godfather logout                  # Clear the stored session
 godfather update                  # Update the CLI to the latest version
 
@@ -106,6 +116,16 @@ godfather update                  # Update the CLI to the latest version
 godfather --api-url https://platform.example.com --org soda list
 ```
 
+### VS Code
+
+`godfather vscode` sets up a pod for the VS Code Remote - SSH extension:
+
+1. It gets a 12-hour certificate for the pod and saves it as `~/.godfather/ssh/<pod-id>-cert.pub`.
+2. It writes a `Host godfather-<pod-id>` block to `~/.godfather/ssh/config` and adds one `Include` line for that file at the top of `~/.ssh/config`.
+3. If the `code` command is on your PATH, it opens VS Code on `/workspace/users/<you>` on the pod. Otherwise run **Remote-SSH: Connect to Host...** in VS Code and pick `godfather-<pod-id>`.
+
+VS Code runs as your pod account (`godfather_<you>`), with the same files and limits as `godfather connect`. After 12 hours VS Code cannot reconnect; run `godfather vscode <pod-id>` again. The pod must run image 2.3.0 or later. `godfather vscode --admin` gives officers a root login on a pod with pod admin on.
+
 ## Files it keeps
 
 Everything lives in `~/.godfather/`:
@@ -113,6 +133,7 @@ Everything lives in `~/.godfather/`:
 - `config.json`: your token (mode 600). Treat it like a password.
 - `ssh/id_ed25519`, `ssh/id_ed25519.pub`: your SSH key, created on first connect. The private key never leaves your machine.
 - `ssh/id_ed25519-cert.pub`: the certificate for the last pod you connected to.
+- `ssh/<pod-id>-cert.pub`, `ssh/config`: the certificate and Host block of each pod set up for VS Code.
 
 Delete the folder to reset everything.
 
@@ -141,23 +162,23 @@ another server or org; the ones you last logged in with are remembered.
 ## Development
 
 The code is in `godfather_cli/`: `cli.py` (commands and menu), `picker.py` (arrow-key menu and pod picker), `auth.py`
-(platform sign-in), `pod_manager.py` (API calls), `ssh_connector.py` (keys,
+(platform sign-in), `login_server.py` (the sign-in callback), `pod_manager.py` (API calls), `ssh_connector.py` (keys,
 certificate, running ssh), `update_checker.py` (PyPI version check), `ui.py`
 (shared console styling). Tests are in `tests/`:
 
 ```bash
-pip install -e . pytest
-pytest -q tests
+uv sync --group dev
+uv run pytest -q tests
 ```
 
+`make check-cli` at the repo root runs ruff, the tests and a build, as CI does.
+
 Releases go to PyPI when a version bump is merged to main; see the
 repo README.
 
 ## Contributing
 
-1. Fork the repository.
-2. Create a feature branch (`git checkout -b feature/your-feature`).
-3. Commit your changes and open a Pull Request.
+See [CONTRIBUTING.md](../CONTRIBUTING.md).
 
 ## License
 

{godfather_cli-2.1.0 → godfather_cli-2.3.0}/README.md

@@ -33,10 +33,13 @@ pip install -e .
 
 1. Run `godfather` with no arguments. On first run you won't be logged in
    yet, so it'll walk you into the login flow.
-2. It opens the AI Society platform's sign-in page in your browser (and
-   prints the link). Sign in with Discord and copy the token shown there.
-3. Paste the token back into the terminal. The CLI checks it with the
-   platform and stores it in `~/.godfather/config.json`.
+2. It opens the sign-in page in your browser and prints the link. Sign in
+   with Discord. The browser sends the login back to the CLI, which checks it
+   and stores the token in `~/.godfather/config.json`.
+3. If the browser cannot reach the CLI (no browser on this computer, an
+   older server, or no sign-in within 5 minutes), the CLI asks you to paste
+   the token that the sign-in page shows. `godfather auth --paste` goes
+   straight to that, for a browser on another computer.
 4. From the menu (or `godfather connect`), pick a pod. The CLI creates an SSH
    key on your machine the first time, asks the server for a 12-hour
    certificate for that pod, and opens the connection.
@@ -52,12 +55,14 @@ Windows 10+ ship it.
 ### Interactive menu
 
 Running `godfather` with no arguments opens a menu. Use the arrow keys to
-choose Connect to a pod, List pods, Status, Log out or Exit, and press Enter.
-Ctrl-C quits.
+choose Connect to a pod, List pods, Sessions, Set up VS Code, Status, Log out or Exit, and
+press Enter. Ctrl-C quits.
 
 Connect to a pod shows a list of your pods with their status, access and
 pod ID. A pod that is not running shows with the reason and cannot be
 chosen. If only one pod is running, the CLI asks for a yes instead.
+If none of your pods is running, the CLI shows the next session on your
+pods. A pod starts 10 minutes before its session.
 
 When input is not a terminal (for example in a script), the menu and the pod
 list use numbered prompts.
@@ -68,8 +73,13 @@ list use numbered prompts.
 godfather list                    # List pods you can connect to
 godfather connect                 # Connect to a pod, picking from a list
 godfather connect <pod-id>        # Connect to a specific pod
+godfather connect --admin         # Ask for a root shell (officers, when pod admin is on)
+godfather sessions                # Upcoming sessions on your pods, in local time
+godfather vscode                  # Set up VS Code Remote-SSH for a pod, picking from a list
+godfather vscode <pod-id>         # The same for one pod; run it again to renew the certificate
 godfather status                  # Show server, org, login, token expiry and version
-godfather auth                    # Log in, or refresh an expired session
+godfather auth                    # Log in with Discord in your browser
+godfather auth --paste            # Log in by pasting the token
 godfather logout                  # Clear the stored session
 godfather update                  # Update the CLI to the latest version
 
@@ -77,6 +87,16 @@ godfather update                  # Update the CLI to the latest version
 godfather --api-url https://platform.example.com --org soda list
 ```
 
+### VS Code
+
+`godfather vscode` sets up a pod for the VS Code Remote - SSH extension:
+
+1. It gets a 12-hour certificate for the pod and saves it as `~/.godfather/ssh/<pod-id>-cert.pub`.
+2. It writes a `Host godfather-<pod-id>` block to `~/.godfather/ssh/config` and adds one `Include` line for that file at the top of `~/.ssh/config`.
+3. If the `code` command is on your PATH, it opens VS Code on `/workspace/users/<you>` on the pod. Otherwise run **Remote-SSH: Connect to Host...** in VS Code and pick `godfather-<pod-id>`.
+
+VS Code runs as your pod account (`godfather_<you>`), with the same files and limits as `godfather connect`. After 12 hours VS Code cannot reconnect; run `godfather vscode <pod-id>` again. The pod must run image 2.3.0 or later. `godfather vscode --admin` gives officers a root login on a pod with pod admin on.
+
 ## Files it keeps
 
 Everything lives in `~/.godfather/`:
@@ -84,6 +104,7 @@ Everything lives in `~/.godfather/`:
 - `config.json`: your token (mode 600). Treat it like a password.
 - `ssh/id_ed25519`, `ssh/id_ed25519.pub`: your SSH key, created on first connect. The private key never leaves your machine.
 - `ssh/id_ed25519-cert.pub`: the certificate for the last pod you connected to.
+- `ssh/<pod-id>-cert.pub`, `ssh/config`: the certificate and Host block of each pod set up for VS Code.
 
 Delete the folder to reset everything.
 
@@ -112,23 +133,23 @@ another server or org; the ones you last logged in with are remembered.
 ## Development
 
 The code is in `godfather_cli/`: `cli.py` (commands and menu), `picker.py` (arrow-key menu and pod picker), `auth.py`
-(platform sign-in), `pod_manager.py` (API calls), `ssh_connector.py` (keys,
+(platform sign-in), `login_server.py` (the sign-in callback), `pod_manager.py` (API calls), `ssh_connector.py` (keys,
 certificate, running ssh), `update_checker.py` (PyPI version check), `ui.py`
 (shared console styling). Tests are in `tests/`:
 
 ```bash
-pip install -e . pytest
-pytest -q tests
+uv sync --group dev
+uv run pytest -q tests
 ```
 
+`make check-cli` at the repo root runs ruff, the tests and a build, as CI does.
+
 Releases go to PyPI when a version bump is merged to main; see the
 repo README.
 
 ## Contributing
 
-1. Fork the repository.
-2. Create a feature branch (`git checkout -b feature/your-feature`).
-3. Commit your changes and open a Pull Request.
+See [CONTRIBUTING.md](../CONTRIBUTING.md).
 
 ## License
 

{godfather_cli-2.1.0 → godfather_cli-2.3.0}/godfather_cli/__init__.py

@@ -2,6 +2,6 @@
 Godfather CLI package
 """
 
-__version__ = "2.1.0"
+__version__ = "2.3.0"
 __author__ = "AI Society ASU"
 __email__ = "admin@ais-asu.com"

{godfather_cli-2.1.0 → godfather_cli-2.3.0}/godfather_cli/auth.py

@@ -1,21 +1,30 @@
 """CLI authentication: token storage, login flow, and token verification."""
 
+import base64
 import datetime
+import hashlib
 import json
 import os
-import requests
+import secrets
 import webbrowser
 from pathlib import Path
 from typing import Dict, Optional
+from urllib.parse import urlencode
+
+import requests
 from rich.panel import Panel
 from rich.prompt import Prompt
 
-from .ui import console, success, error, warning, spinner, BOX, BORDER
+from .login_server import LoopbackReceiver
+from .ui import BORDER, BOX, console, error, spinner, success, warning
 
 TOKEN_PREFIX = 'plat_'
 # The platform issues CLI tokens for 90 days.
 TOKEN_DAYS = 90
 
+# How long the CLI waits for the browser sign-in.
+LOGIN_WAIT_SECONDS = 300
+
 # Token states that check_token returns.
 TOKEN_OK = 'ok'
 TOKEN_MISSING = 'missing'
@@ -24,6 +33,17 @@ TOKEN_UNREACHABLE = 'unreachable'
 TOKEN_REFUSED = 'refused'
 
 
+def make_verifier() -> str:
+    """A PKCE code verifier (RFC 7636): 64 URL-safe characters."""
+    return secrets.token_urlsafe(48)
+
+
+def challenge_for(verifier: str) -> str:
+    """The S256 code challenge of a verifier: base64url SHA-256 without padding."""
+    digest = hashlib.sha256(verifier.encode('ascii')).digest()
+    return base64.urlsafe_b64encode(digest).rstrip(b'=').decode('ascii')
+
+
 class CLIAuthenticator:
     """Handle CLI authentication."""
 
@@ -61,8 +81,84 @@ class CLIAuthenticator:
         """URL of a platform compute route for the configured org."""
         return f"{self.api_base}/api/compute/{self.org}{path}"
 
-    def authenticate(self) -> bool:
-        """Walk the user through signing in with Discord and pasting the token it shows."""
+    def authenticate(self, paste: bool = False) -> bool:
+        """Sign in with Discord. The browser hands the token back; the paste flow is the fallback."""
+        if not paste:
+            if self.supports_loopback():
+                token = self._browser_login()
+                if token:
+                    return self._verify_and_save(token)
+            else:
+                console.print("[dim]This server does not support browser sign-in yet. Paste the token instead.[/dim]")
+        return self._paste_login()
+
+    def supports_loopback(self) -> bool:
+        """True when the server has the cli/token route. It answers 400 to an empty body."""
+        try:
+            response = requests.post(self.compute_url('/cli/token'), json={}, timeout=10)
+        except requests.RequestException:
+            return False
+        return response.status_code == 400
+
+    def _browser_login(self) -> Optional[str]:
+        """The token from the localhost callback with PKCE, or None after printing why not."""
+        state = secrets.token_urlsafe(16)
+        verifier = make_verifier()
+        try:
+            receiver = LoopbackReceiver(state)
+        except OSError:
+            console.print("[dim]Could not listen on 127.0.0.1. Paste the token instead.[/dim]")
+            return None
+        try:
+            query = urlencode(
+                {
+                    'port': receiver.port,
+                    'state': state,
+                    'code_challenge': challenge_for(verifier),
+                    'code_challenge_method': 'S256',
+                }
+            )
+            login_url = f"{self.compute_url('/cli/login')}?{query}"
+            try:
+                opened = webbrowser.open(login_url)
+            except webbrowser.Error:
+                opened = False
+            if not opened:
+                console.print("[dim]No browser opened on this computer. Paste the token instead.[/dim]")
+                return None
+            console.print(f"Sign in with Discord in your browser. If it did not open, go to:\n{login_url}")
+            try:
+                with spinner("Waiting for the browser sign-in..."):
+                    code = receiver.wait(LOGIN_WAIT_SECONDS)
+            except KeyboardInterrupt:
+                console.print("[dim]Cancelled[/dim]")
+                return None
+        finally:
+            receiver.close()
+        if not code:
+            console.print("[dim]The browser sign-in did not finish in time. Paste the token instead.[/dim]")
+            return None
+        return self._redeem(code, verifier)
+
+    def _redeem(self, code: str, verifier: str) -> Optional[str]:
+        """Exchange the one-time code and the PKCE verifier for a token."""
+        try:
+            with spinner("Getting your token..."):
+                response = requests.post(
+                    self.compute_url('/cli/token'),
+                    json={'code': code, 'code_verifier': verifier},
+                    timeout=10,
+                )
+            token = str(response.json().get('token') or '') if response.status_code == 200 else ''
+        except (requests.RequestException, ValueError, AttributeError):
+            token = ''
+        if not token.startswith(TOKEN_PREFIX):
+            console.print("[dim]The server did not return a token. Paste the token instead.[/dim]")
+            return None
+        return token
+
+    def _paste_login(self) -> bool:
+        """Open the sign-in page and take the token the member pastes."""
         login_url = self.compute_url('/cli/login')
         panel = Panel(
             f"[bold]1.[/bold] Open [bold]{login_url}[/bold] and sign in with Discord\n"
@@ -91,13 +187,14 @@ class CLIAuthenticator:
             error("That doesn't look like a valid Godfather token")
             console.print(f"[dim]Tokens start with {TOKEN_PREFIX}. Get a fresh one from {login_url}[/dim]")
             return False
+        return self._verify_and_save(token)
 
+    def _verify_and_save(self, token: str) -> bool:
+        """Check the token with GET /me/pods, then save it with the server and org."""
         try:
             with spinner("Verifying token..."):
                 response = requests.get(
-                    self.compute_url('/me/pods'),
-                    headers={'Authorization': f'Bearer {token}'},
-                    timeout=10
+                    self.compute_url('/me/pods'), headers={'Authorization': f'Bearer {token}'}, timeout=10
                 )
         except requests.ConnectionError:
             error(f"Couldn't reach {self.api_base}")
@@ -153,11 +250,7 @@ class CLIAuthenticator:
             return TOKEN_MISSING
 
         try:
-            response = requests.get(
-                self.compute_url('/me/pods'),
-                headers=self.auth_headers(),
-                timeout=5
-            )
+            response = requests.get(self.compute_url('/me/pods'), headers=self.auth_headers(), timeout=5)
         except requests.RequestException:
             return TOKEN_UNREACHABLE
         if response.status_code == 200: