google-colab-cli 0.5.8__tar.gz → 0.5.9__tar.gz

{google_colab_cli-0.5.8 → google_colab_cli-0.5.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: google-colab-cli
-Version: 0.5.8
+Version: 0.5.9
 Summary: CLI for interacting with Colab.
 License-File: LICENSE
 Requires-Python: >=3.13

{google_colab_cli-0.5.8 → google_colab_cli-0.5.9}/docs/02_execution_and_interactive.md

@@ -26,6 +26,7 @@ Execution involves sending Python code (or shell commands) to the Jupyter kernel
     - If file path is local: Read content, send as code.
     - If file path is remote: Execute `!python <path>`.
 - **Multi-Modal Output**: Handle `display_data` messages (e.g., `image/png`, `text/html`). For the CLI, we'll save images to temporary files and print their paths, or if the terminal supports it (e.g., iTerm2), inline them.
+- **Timeout Configuration**: Exposes a `--timeout` flag (default 10s) to allow long-running silent tasks (like model compilation or data downloading) to execute without being prematurely killed.
 
 ### 3. Console (`colab console`)
 - **Implementation**: Connects directly to the backend terminal endpoint (`/colab/tty`) via WebSockets using `websocket-client`.

{google_colab_cli-0.5.8 → google_colab_cli-0.5.9}/docs/04_automation_and_utility.md

@@ -1,6 +1,7 @@
 ---
 log:
 2026-06-01: Enabled `colab update --install` self-update on macOS in addition to Linux. Refactored platform check logic to keep the implementation DRY and updated both tests and documentation. Also, on these platforms, an additional message is shown recommending `colab update --install` to upgrade in place, positioned above the standard `pip`/`uv` installation command.
+2026-05-29: Added default OAuth2 client config (`oauth_config.json`) as a bundled package resource and restored fallback loading logic in `get_credentials()`. The CLI now falls back to using these default credentials when no explicit local config is found. Added `integration/repro_bundled_oauth` integration test.
 2026-05-27: Refactored `colab README` and `colab AGENT` to bundle `README.md` and `AGENTS.md` via Hatchling's `force-include` and read them using `importlib.resources` instead of `importlib.metadata`. `colab AGENT` now correctly prints `AGENTS.md`.
 2026-05-27: Extended `colab update --install` to detect if the CLI was installed via `uv tool install` (by checking if `sys.executable` contains `/uv/`) and if so, use `uv tool install -U google-colab-cli` to upgrade.
 2026-05-27: Updated auto-update upgrade hint to recommend `pip install --upgrade google-colab-cli` instead of `colab`, aligning with the PyPI package name.
@@ -24,9 +25,9 @@ backend, selected via the global `--auth=<provider>` flag:
 
 1.  **`oauth2`** (default): Standard public InstalledAppFlow via
     `google-auth-oauthlib`. Opens a browser for consent, caches the refresh
-    token at `~/.config/colab-cli/token.json`. Requires a client OAuth
-    config at `~/.colab-cli-oauth-config.json` or a path passed via
-    `-c/--client-oauth-config`.
+    token at `~/.config/colab-cli/token.json`. If no local config is provided
+    via `-c/--client-oauth-config` or found at `~/.colab-cli-oauth-config.json`,
+    it falls back to a bundled `oauth_config.json` containing default OAuth credentials.
 2.  **`adc`**: Application Default Credentials via `google.auth.default()`.
     Honors the standard ADC discovery chain
     (`GOOGLE_APPLICATION_CREDENTIALS`, `gcloud auth application-default

{google_colab_cli-0.5.8 → google_colab_cli-0.5.9}/docs/05_run_command.md

@@ -29,6 +29,7 @@ colab run [OPTIONS] SCRIPT [SCRIPT_ARGS]...
 | `--gpu` | str | None | Same set as `colab new --gpu` (T4, L4, G4, H100, A100). |
 | `--tpu` | str | None | Same set as `colab new --tpu` (v5e1, v6e1). |
 | `--keep` | bool | False | Do **not** stop the session after the script finishes. |
+| `--timeout` | float | 10.0 | Timeout in seconds for code execution to prevent hanging on silent tasks. |
 
 ### Shebang usage
 With `--keep` and `--gpu` baked into the shebang line, an entire one-file workload becomes:

{google_colab_cli-0.5.8 → google_colab_cli-0.5.9}/integration/README.md

@@ -16,6 +16,8 @@ End-to-end tests that run against a **live Colab backend** (unlike the mocked un
 | `repro_keep_alive_scope/` | Slow soak test (~95s): runs the daemon long enough for one ping past the pre-flight, asserts no `keep_alive_error` events. |
 | `repro_variable_persistence/` | Variables persist across `colab exec` calls in the same session. |
 | `repro_piped_console/` | Fast smoke test (~5s including session creation): `echo cmd \| colab console -s s` runs the command and exits within 30s. Regression test for the 2026-05-07 EOF-handler fix. |
+| `repro_bundled_oauth/` | Fast smoke test (~5s): verifies that the fallback OAuth configuration is loaded and starts the OAuth flow with the default client ID when local config is missing. |
+
 
 ## Running
 ```bash

google_colab_cli-0.5.9/integration/repro_bundled_oauth/test.sh

@@ -0,0 +1,93 @@
+#!/bin/bash
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Integration Test: Fallback OAuth Configuration Verification
+#
+# This test verifies that the CLI correctly falls back to using the bundled
+# oauth_config.json containing the default client ID when no local config is present.
+# It simulates a fresh user flow by temporarily hiding existing tokens/configs,
+# starting the OAuth flow, and asserting that the printed authorization URL
+# contains the correct Client ID.
+#
+
+set -e
+
+TOKEN_PATH="$HOME/.config/colab-cli/token.json"
+CONFIG_PATH="$HOME/.colab-cli-oauth-config.json"
+BACKUP_SUFFIX=".backup.$(date +%s)"
+
+TOKEN_BACKUP=""
+CONFIG_BACKUP=""
+
+cleanup() {
+    echo "[*] Cleaning up backups..."
+    if [ -n "$TOKEN_BACKUP" ] && [ -f "$TOKEN_BACKUP" ]; then
+        mv "$TOKEN_BACKUP" "$TOKEN_PATH"
+        echo "[*] Restored token.json"
+    fi
+    if [ -n "$CONFIG_BACKUP" ] && [ -f "$CONFIG_BACKUP" ]; then
+        mv "$CONFIG_BACKUP" "$CONFIG_PATH"
+        echo "[*] Restored .colab-cli-oauth-config.json"
+    fi
+}
+trap cleanup EXIT
+
+# 1. Back up existing configuration files if they exist
+if [ -f "$TOKEN_PATH" ]; then
+    TOKEN_BACKUP="${TOKEN_PATH}${BACKUP_SUFFIX}"
+    mv "$TOKEN_PATH" "$TOKEN_BACKUP"
+    echo "[*] Temporarily backed up token.json to $TOKEN_BACKUP"
+fi
+
+if [ -f "$CONFIG_PATH" ]; then
+    CONFIG_BACKUP="${CONFIG_PATH}${BACKUP_SUFFIX}"
+    mv "$CONFIG_PATH" "$CONFIG_BACKUP"
+    echo "[*] Temporarily backed up .colab-cli-oauth-config.json to $CONFIG_BACKUP"
+fi
+
+# 2. Run colab sessions command to trigger the OAuth flow
+echo "[*] Running 'colab --auth=oauth2 sessions' (expecting to trigger browser flow)..."
+# We expect the command to block waiting for authorization, so we run it with a timeout.
+# We redirect output to a file so we can inspect it.
+OUTPUT_LOG=$(mktemp)
+set +e
+PYTHONUNBUFFERED=1 timeout 5 uv run colab --auth=oauth2 sessions > "$OUTPUT_LOG" 2>&1
+EXIT_CODE=$?
+set -e
+
+echo "[*] Command exited with code: $EXIT_CODE"
+echo "----------------- CLI Output -----------------"
+cat "$OUTPUT_LOG"
+echo "----------------------------------------------"
+
+# 3. Assertions
+EXPECTED_CLIENT_ID="764086051850-6qr4p6gpi6hn506pt8ejuq83di341hur.apps.googleusercontent.com"
+
+# The command should have printed the authorization URL
+if ! grep -q "Please visit this URL to authorize this application" "$OUTPUT_LOG"; then
+    echo "[FAILURE] OAuth prompt message not found in output."
+    rm -f "$OUTPUT_LOG"
+    exit 1
+fi
+
+# The URL should contain the correct client ID
+if ! grep -q "client_id=$EXPECTED_CLIENT_ID" "$OUTPUT_LOG"; then
+    echo "[FAILURE] Authorization URL does not contain the expected client ID: $EXPECTED_CLIENT_ID"
+    rm -f "$OUTPUT_LOG"
+    exit 1
+fi
+
+echo "[SUCCESS] Verified that CLI correctly initiated OAuth flow with the fallback Client ID: $EXPECTED_CLIENT_ID"
+rm -f "$OUTPUT_LOG"

{google_colab_cli-0.5.8 → google_colab_cli-0.5.9}/src/colab_cli/auth.py

@@ -15,11 +15,13 @@
 import enum
 import json
 import logging
+from importlib import resources
 import os
 import warnings
 from typing import Optional
 
 import google.auth
+import typer
 from google.auth.transport import requests
 from google.auth.transport.requests import Request
 from google.oauth2.credentials import Credentials
@@ -43,6 +45,7 @@ PUBLIC_SCOPES = [
     "openid",
     "https://www.googleapis.com/auth/userinfo.profile",
     "https://www.googleapis.com/auth/userinfo.email",
+    "https://www.googleapis.com/auth/cloud-platform",
     "https://www.googleapis.com/auth/colaboratory",
     "https://www.googleapis.com/auth/drive.file",
 ]
@@ -60,9 +63,18 @@ def _get_google_auth_credentials(config_path: str) -> Credentials:
     if os.path.exists(config_path):
         with open(config_path, "r") as f:
             client_config = json.load(f)
+    else:
+        # Last resort: try inlined config
+        try:
+            config_resource = resources.files("colab_cli").joinpath("oauth_config.json")
+            if config_resource.is_file():
+                client_config = json.loads(config_resource.read_text())
+        except Exception as e:
+            logger.debug(f"Failed to load inlined config: {e}")
+
     if not client_config:
         raise FileNotFoundError(
-            f"Client OAuth config not found at {config_path}. "
+            f"Client OAuth config not found at {config_path} and no inlined config available. "
             "Please provide a valid path via -c/--client-oauth-config."
         )
 
@@ -137,6 +149,34 @@ def _get_adc_credentials() -> Credentials:
             category=UserWarning,
         )
         creds, _ = google.auth.default(scopes=list(PUBLIC_SCOPES))
+
+
+    if not creds.valid:
+        from google.auth import compute_engine
+
+        if isinstance(creds, compute_engine.Credentials):
+            creds = None
+        else:
+            logger.warning("Failed to obtain valid ADC credentials.")
+            try:
+                logger.warning("Trying to refresh ADC credentials")
+                creds.refresh(Request())
+            except Exception as e:
+                logger.warning(f"Failed to refresh token: {e}")
+                creds = None
+
+    if not creds:
+        typer.echo(
+            "No valid default credentials found. To authenticate, run:\n\n"
+            "  gcloud auth application-default login \\\n"
+            "      --scopes=openid,"
+            "https://www.googleapis.com/auth/cloud-platform,"
+            "https://www.googleapis.com/auth/userinfo.email,"
+            "https://www.googleapis.com/auth/colaboratory\n",
+            err=True,
+        )
+        exit(1)
+
     # Some credential subclasses ignore the `scopes=` kwarg in `default()`
     # (e.g. user creds), so re-apply via `with_scopes` when supported.
     if getattr(creds, "requires_scopes", False):

{google_colab_cli-0.5.8 → google_colab_cli-0.5.9}/src/colab_cli/cli.py

@@ -75,7 +75,7 @@ def callback(
             ),
             case_sensitive=False,
         ),
-    ] = AuthProvider.ADC,
+    ] = AuthProvider.OAUTH2,
 ):
     """
     Colab CLI global configuration.

{google_colab_cli-0.5.8 → google_colab_cli-0.5.9}/src/colab_cli/commands/execution.py

@@ -108,6 +108,9 @@ def exec_command(
     output_image: Annotated[
         Optional[str], typer.Option("--output-image", help="Path to save plot")
     ] = None,
+    timeout: Annotated[
+        Optional[float], typer.Option("--timeout", help="Timeout in seconds for code execution")
+    ] = 10.0,
 ):
     """Execute code in a session"""
     from colab_cli.common import state
@@ -205,7 +208,9 @@ def exec_command(
             state.store.add(s)
 
             outputs = runtime.execute_code(
-                code, output_hook=lambda o: display_output(o, output_image)
+                code, 
+                output_hook=lambda o: display_output(o, output_image),
+                timeout=timeout
             )
             if "cell" in block:
                 save_output(outputs, block["cell"])

{google_colab_cli-0.5.8 → google_colab_cli-0.5.9}/src/colab_cli/commands/run.py

@@ -233,6 +233,9 @@ def run_command(
             ),
         ),
     ] = False,
+    timeout: Annotated[
+        Optional[float], typer.Option("--timeout", help="Timeout in seconds for code execution")
+    ] = 10.0,
 ):
     """Run a Python script on a fresh Colab VM, then release the VM
 
@@ -386,7 +389,11 @@ def run_command(
         state.store.add(s)
 
         try:
-            outputs = runtime.execute_code(payload, output_hook=_make_run_output_hook())
+            outputs = runtime.execute_code(
+                payload, 
+                output_hook=_make_run_output_hook(),
+                timeout=timeout
+            )
         except Exception:
             # Genuine transport-level failure. Cleanup still happens via the
             # outer finally; surface non-zero exit so callers/CI notice.

google_colab_cli-0.5.9/src/colab_cli/oauth_config.json

@@ -0,0 +1,11 @@
+{
+  "installed": {
+    "client_id": "764086051850-6qr4p6gpi6hn506pt8ejuq83di341hur.apps.googleusercontent.com",
+    "project_id": "colab-cli",
+    "auth_uri": "https://accounts.google.com/o/oauth2/auth",
+    "token_uri": "https://oauth2.googleapis.com/token",
+    "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
+    "client_secret": "d-FL95Q19q7MQmFpd7hHD0Ty",
+    "redirect_uris": ["http://localhost"]
+  }
+}

{google_colab_cli-0.5.8 → google_colab_cli-0.5.9}/tests/test_auth.py

@@ -27,9 +27,11 @@ def mock_deps(mocker):
     m_flow_cls = mocker.patch("colab_cli.auth.InstalledAppFlow")
     m_request = mocker.patch("colab_cli.auth.Request")
     m_session = mocker.patch("colab_cli.auth.requests.AuthorizedSession")
+    m_resources = mocker.patch("colab_cli.auth.resources")
 
-    # By default, pretend oauth config doesn't exist
+    # By default, pretend oauth config doesn't exist anywhere
     m_exists.return_value = False
+    m_resources.files.return_value.joinpath.return_value.is_file.return_value = False
 
     return {
         "exists": m_exists,
@@ -38,11 +40,15 @@ def mock_deps(mocker):
         "flow_cls": m_flow_cls,
         "request": m_request,
         "session": m_session,
+        "resources": m_resources,
     }
 
 
 def test_get_credentials_no_config(mock_deps):
-    with pytest.raises(FileNotFoundError, match="Client OAuth config not found"):
+    with pytest.raises(
+        FileNotFoundError,
+        match="Client OAuth config not found.*and no inlined config available",
+    ):
         get_credentials("missing_config.json", provider=AuthProvider.OAUTH2)
 
 
@@ -105,3 +111,25 @@ def test_get_credentials_no_token(mock_deps):
 
     mock_deps["flow_cls"].from_client_config.assert_called_once()
     mock_flow.run_local_server.assert_called_once()
+
+
+def test_get_credentials_fallback_config(mock_deps):
+    # Setup: config_path doesn't exist, but fallback file does
+    mock_deps["exists"].return_value = False
+    m_file = mock_deps["resources"].files.return_value.joinpath.return_value
+    m_file.is_file.return_value = True
+    m_file.read_text.return_value = '{"installed":{"client_id":"fallback_id"}}'
+
+    # Valid creds in token
+    mock_deps["exists"].side_effect = lambda path: path == TOKEN_CONFIG_PATH
+    mock_creds = MagicMock()
+    mock_creds.valid = True
+    mock_deps["creds_cls"].from_authorized_user_file.return_value = mock_creds
+
+    res = get_credentials("missing_config.json", provider=AuthProvider.OAUTH2)
+
+    mock_deps["resources"].files.assert_called_once_with("colab_cli")
+    m_file.is_file.assert_called_once()
+    m_file.read_text.assert_called_once()
+    mock_deps["creds_cls"].from_authorized_user_file.assert_called_once()
+    assert res == mock_deps["session"].return_value

{google_colab_cli-0.5.8 → google_colab_cli-0.5.9}/tests/test_auth_adc.py

@@ -70,10 +70,8 @@ def test_get_credentials_adc_does_not_invoke_other_providers(mocker):
     mock_flow.from_client_config.assert_not_called()
 
 
-def test_get_credentials_adc_requests_colaboratory_scope(mocker):
-    """The RuntimeService at colab.pa.googleapis.com requires the
-    `colaboratory` scope. ADC must request it via google.auth.default().
-    """
+def test_get_credentials_adc_requests_required_scopes(mocker):
+    """ADC must request required scopes via google.auth.default()."""
     mock_creds = MagicMock()
     # Pretend creds don't need re-scoping (e.g., user creds from gcloud).
     mock_creds.requires_scopes = False
@@ -87,12 +85,13 @@ def test_get_credentials_adc_requests_colaboratory_scope(mocker):
     scopes = mock_default.call_args.kwargs.get("scopes")
     assert scopes is not None, "google.auth.default() must be called with scopes="
     assert "https://www.googleapis.com/auth/colaboratory" in scopes
+    assert "https://www.googleapis.com/auth/cloud-platform" in scopes
     assert "https://www.googleapis.com/auth/userinfo.email" in scopes
 
 
 def test_get_credentials_adc_reapplies_scopes_for_scopable_creds(mocker):
     """For credential subclasses that support `with_scopes` (service accounts,
-    GCE/GKE, etc.), we must call it so the colaboratory scope sticks even if
+    GCE/GKE, etc.), we must call it so the scopes stick even if
     google.auth.default() ignored the kwarg.
     """
     rescoped = MagicMock(name="rescoped_creds")
@@ -106,7 +105,7 @@ def test_get_credentials_adc_reapplies_scopes_for_scopable_creds(mocker):
 
     mock_creds.with_scopes.assert_called_once()
     applied_scopes = mock_creds.with_scopes.call_args.args[0]
-    assert "https://www.googleapis.com/auth/colaboratory" in applied_scopes
+    assert "https://www.googleapis.com/auth/cloud-platform" in applied_scopes
     # The session is built from the *rescoped* creds, not the original.
     mock_session_cls.assert_called_once_with(rescoped)
 

{google_colab_cli-0.5.8 → google_colab_cli-0.5.9}/tests/test_exec.py

@@ -58,7 +58,7 @@ def test_cli_exec_file(mock_store, mock_runtime_class, mock_common_state, tmp_pa
     mock_runtime.execute_code.assert_any_call(
         "import os; os.makedirs('/content', exist_ok=True); os.chdir('/content')"
     )
-    mock_runtime.execute_code.assert_any_call("print('hello')", output_hook=ANY)
+    mock_runtime.execute_code.assert_any_call("print('hello')", output_hook=ANY, timeout=10.0)
 
 
 def test_cli_exec_stdin(mock_store, mock_runtime_class, mock_common_state):
@@ -80,7 +80,7 @@ def test_cli_exec_stdin(mock_store, mock_runtime_class, mock_common_state):
     assert mock_session.last_execution[1] is None
     assert mock_session.last_execution[2] is not None
     mock_store.add.assert_called_with(mock_session)
-    mock_runtime.execute_code.assert_any_call("print(42)", output_hook=ANY)
+    mock_runtime.execute_code.assert_any_call("print(42)", output_hook=ANY, timeout=10.0)
 
 
 def test_cli_exec_not_found(mock_common_state):
@@ -176,3 +176,24 @@ def test_cli_exec_lost_session_prunes(
     assert result.exit_code == 1
     assert "appears to be lost" in result.output
     mock_common_state.prune_session.assert_called_once_with("lost-sess")
+
+
+def test_cli_exec_timeout(mock_store, mock_runtime_class, mock_common_state, tmp_path):
+    mock_session = MagicMock()
+    mock_session.url = "http://url"
+    mock_session.token = "token123"
+    mock_session.name = "s1"
+    mock_session.kernel_id = None
+    mock_session.session_id = None
+    mock_store.get.return_value = mock_session
+
+    mock_common_state.resolve_session.return_value = "s1"
+    mock_runtime = mock_runtime_class.return_value
+    mock_runtime.execute_code.return_value = [{"text": "hello\n"}]
+
+    script = tmp_path / "script.py"
+    script.write_text("print('hello')")
+
+    result = runner.invoke(app, ["exec", "-s", "s1", "-f", str(script), "--timeout", "3600"])
+    assert result.exit_code == 0
+    mock_runtime.execute_code.assert_any_call("print('hello')", output_hook=ANY, timeout=3600.0)

{google_colab_cli-0.5.8 → google_colab_cli-0.5.9}/tests/test_ipynb_exec.py

@@ -98,10 +98,10 @@ class TestIpynbExec(unittest.TestCase):
                 "os.chdir", mock_runtime.execute_code.call_args_list[0].args[0]
             )
             mock_runtime.execute_code.assert_any_call(
-                "print('cell 1')", output_hook=ANY
+                "print('cell 1')", output_hook=ANY, timeout=10.0
             )
             mock_runtime.execute_code.assert_any_call(
-                "print('cell 2')", output_hook=ANY
+                "print('cell 2')", output_hook=ANY, timeout=10.0
             )
 
     @patch("colab_cli.commands.execution.ColabRuntime")

{google_colab_cli-0.5.8 → google_colab_cli-0.5.9}/tests/test_run.py

@@ -504,3 +504,28 @@ def test_run_prelude_suppresses_ipython_exit_warning(
     # Look for the warnings filter targeting IPython's exit-warning text.
     assert "warnings.filterwarnings" in body
     assert "To exit: use" in body
+
+
+def test_run_with_timeout_flag(
+    mock_client,
+    mock_store,
+    mock_runtime_class,
+    mock_spawn_keep_alive,
+    assign_response,
+    script_path,
+):
+    """`colab run --timeout 3600 script.py` must pass timeout down to the runtime."""
+    mock_client.assign.return_value = assign_response
+    mock_runtime = mock_runtime_class.return_value
+    mock_runtime.execute_code.return_value = []
+
+    persisted = {}
+    mock_store.add.side_effect = lambda s: persisted.setdefault("s", s)
+    mock_store.get.side_effect = lambda name: persisted.get("s")
+
+    result = runner.invoke(app, ["run", "--timeout", "3600", str(script_path)])
+    assert result.exit_code == 0, result.output
+
+    code_calls = mock_runtime.execute_code.call_args_list
+    body_call = next(c for c in code_calls if "hello from script" in c.args[0])
+    assert body_call.kwargs.get("timeout") == 3600.0