grains-cli 0.1.1__tar.gz → 0.2.0__tar.gz

{grains_cli-0.1.1 → grains_cli-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: grains-cli
-Version: 0.1.1
+Version: 0.2.0
 Summary: Command-line tools for Grains: build, run, deploy, and pay AI agents.
 Author: Grains
 License-Expression: Apache-2.0

{grains_cli-0.1.1 → grains_cli-0.2.0}/grains_cli/apiclient.py

@@ -27,7 +27,10 @@ def resolve_api(explicit: str | None) -> str:
 
 
 def resolve_token(explicit: str | None) -> str | None:
-    return explicit or os.environ.get("GRAINS_DEPLOY_TOKEN")
+    if explicit or os.environ.get("GRAINS_DEPLOY_TOKEN"):
+        return explicit or os.environ.get("GRAINS_DEPLOY_TOKEN")
+    from .login import stored_token  # lazy: avoid import cycle
+    return stored_token(resolve_api(None))
 
 
 def zip_project(path: Path) -> bytes:

grains_cli-0.2.0/grains_cli/login.py

@@ -0,0 +1,173 @@
+"""`grains login` -- browser sign-in via the Grains OAuth 2.1 server.
+
+Same PKCE + dynamic-client-registration flow Claude Code uses against
+mcp.grains.run, with a loopback redirect: register a public client, open the
+browser to the consent page, catch the code on 127.0.0.1, exchange it for a
+deploy token, and store it in ~/.grains/credentials.json (0600). After this,
+every CLI command works with no token pasting; GRAINS_DEPLOY_TOKEN still
+wins when set (CI, scripts).
+"""
+from __future__ import annotations
+
+import argparse
+import base64
+import hashlib
+import json
+import os
+import secrets
+import stat
+import sys
+import threading
+import webbrowser
+from http.server import BaseHTTPRequestHandler, HTTPServer
+from pathlib import Path
+from urllib.parse import parse_qs, urlencode, urlparse
+
+import httpx
+
+from .apiclient import resolve_api
+
+CRED_PATH = Path.home() / ".grains" / "credentials.json"
+LOGIN_TIMEOUT_S = 300
+
+
+def stored_token(api: str) -> str | None:
+    try:
+        data = json.loads(CRED_PATH.read_text())
+    except (OSError, ValueError):
+        return None
+    return (data.get(api) or {}).get("token")
+
+
+def store_token(api: str, token: str) -> None:
+    CRED_PATH.parent.mkdir(parents=True, exist_ok=True)
+    try:
+        data = json.loads(CRED_PATH.read_text())
+    except (OSError, ValueError):
+        data = {}
+    data[api] = {"token": token}
+    CRED_PATH.write_text(json.dumps(data, indent=2))
+    CRED_PATH.chmod(stat.S_IRUSR | stat.S_IWUSR)
+
+
+def pkce_pair() -> tuple[str, str]:
+    verifier = secrets.token_urlsafe(48)
+    challenge = (
+        base64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest())
+        .rstrip(b"=")
+        .decode()
+    )
+    return verifier, challenge
+
+
+class _Callback(BaseHTTPRequestHandler):
+    result: dict = {}
+    expected_state = ""
+
+    def log_message(self, *a):  # silence
+        pass
+
+    def do_GET(self):
+        q = parse_qs(urlparse(self.path).query)
+        ok = q.get("state", [""])[0] == self.expected_state and "code" in q
+        if ok:
+            _Callback.result = {"code": q["code"][0]}
+        else:
+            _Callback.result = {"error": q.get("error", ["invalid callback"])[0]}
+        body = (
+            b"<body style='font-family:system-ui;text-align:center;padding-top:4rem'>"
+            + (b"<h2>Signed in to Grains.</h2>You can close this tab." if ok
+               else b"<h2>Sign-in failed.</h2>Return to the terminal.")
+            + b"</body>"
+        )
+        self.send_response(200)
+        self.send_header("Content-Type", "text/html")
+        self.end_headers()
+        self.wfile.write(body)
+
+
+def login_flow(api: str, http: httpx.Client | None = None, open_browser=webbrowser.open,
+               timeout_s: float = LOGIN_TIMEOUT_S) -> str:
+    """Run the full browser PKCE flow; returns the deploy token."""
+    client = http or httpx.Client(timeout=30.0)
+    meta = client.get(f"{api}/.well-known/oauth-authorization-server").json()
+
+    server = HTTPServer(("127.0.0.1", 0), _Callback)
+    port = server.server_address[1]
+    redirect_uri = f"http://127.0.0.1:{port}/callback"
+
+    reg = client.post(meta["registration_endpoint"], json={
+        "client_name": "grains CLI",
+        "redirect_uris": [redirect_uri],
+    })
+    reg.raise_for_status()
+    client_id = reg.json()["client_id"]
+
+    verifier, challenge = pkce_pair()
+    state = secrets.token_urlsafe(16)
+    _Callback.expected_state = state
+    _Callback.result = {}
+    auth_url = meta["authorization_endpoint"] + "?" + urlencode({
+        "response_type": "code",
+        "client_id": client_id,
+        "redirect_uri": redirect_uri,
+        "state": state,
+        "code_challenge": challenge,
+        "code_challenge_method": "S256",
+    })
+
+    thread = threading.Thread(target=server.handle_request, daemon=True)
+    thread.start()
+    print("Opening your browser to sign in with GitHub…")
+    print(f"  {auth_url}")
+    open_browser(auth_url)
+    thread.join(timeout=timeout_s)
+    server.server_close()
+    if "code" not in _Callback.result:
+        raise RuntimeError(_Callback.result.get("error") or "sign-in timed out")
+
+    resp = client.post(meta["token_endpoint"], data={
+        "grant_type": "authorization_code",
+        "code": _Callback.result["code"],
+        "code_verifier": verifier,
+        "client_id": client_id,
+        "redirect_uri": redirect_uri,
+    })
+    resp.raise_for_status()
+    return resp.json()["access_token"]
+
+
+def ensure_token(api: str, *, allow_login: bool = True) -> str:
+    token = os.environ.get("GRAINS_DEPLOY_TOKEN") or stored_token(api)
+    if token:
+        return token
+    if not allow_login:
+        raise RuntimeError("not signed in (run `grains login`)")
+    token = login_flow(api)
+    store_token(api, token)
+    print("Signed in. Token stored in ~/.grains/credentials.json")
+    return token
+
+
+def cmd_login(args: argparse.Namespace) -> int:
+    api = resolve_api(getattr(args, "api", None))
+    try:
+        token = login_flow(api)
+    except Exception as e:  # noqa: BLE001
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    store_token(api, token)
+    print("Signed in. Token stored in ~/.grains/credentials.json")
+    return 0
+
+
+def cmd_logout(args: argparse.Namespace) -> int:
+    api = resolve_api(getattr(args, "api", None))
+    try:
+        data = json.loads(CRED_PATH.read_text())
+        data.pop(api, None)
+        CRED_PATH.write_text(json.dumps(data, indent=2))
+    except (OSError, ValueError):
+        pass
+    print("Signed out.")
+    return 0

{grains_cli-0.1.1 → grains_cli-0.2.0}/grains_cli/main.py

@@ -6,7 +6,9 @@ import argparse
 from . import deploy as deploy_cmd
 from . import dev as dev_cmd
 from . import init as init_cmd
+from . import login as login_cmd
 from . import pay as pay_cmd
+from . import ship as ship_cmd
 from . import verify as verify_cmd
 
 
@@ -42,6 +44,19 @@ def build_parser() -> argparse.ArgumentParser:
     p_pay.add_argument("--caller-token", default=None, help="grains_ct_... caller token, if required")
     p_pay.set_defaults(func=pay_cmd.cmd_pay)
 
+    p_ship = sub.add_parser("ship", help="sign in, scaffold if needed, deploy, and wait for live")
+    p_ship.add_argument("path", nargs="?", default=".")
+    p_ship.add_argument("--api", help="control-plane URL (or GRAINS_API_URL)")
+    p_ship.set_defaults(func=ship_cmd.cmd_ship)
+
+    p_login = sub.add_parser("login", help="sign in with GitHub in your browser")
+    p_login.add_argument("--api")
+    p_login.set_defaults(func=login_cmd.cmd_login)
+
+    p_logout = sub.add_parser("logout", help="forget the stored deploy token")
+    p_logout.add_argument("--api")
+    p_logout.set_defaults(func=login_cmd.cmd_logout)
+
     p_deploy = sub.add_parser("deploy", help="deploy the agent in this directory to Grains")
     p_deploy.add_argument("path", nargs="?", default=".")
     p_deploy.add_argument("--token", help="deploy token (or set GRAINS_DEPLOY_TOKEN)")

grains_cli-0.2.0/grains_cli/ship.py

@@ -0,0 +1,79 @@
+"""`grains ship` -- the one command: sign in, scaffold, deploy, live.
+
+Collapses the whole funnel: browser sign-in if needed (PKCE, no token
+pasting), `grains init` if the directory has no agent yet, deploy, poll
+until live, print the endpoint. `uvx grains-cli ship` is the marketing
+one-liner; this module has to keep it honest.
+"""
+from __future__ import annotations
+
+import argparse
+import sys
+import time
+import tomllib
+from argparse import Namespace
+from pathlib import Path
+
+from . import init as init_cmd
+from .apiclient import GrainsAPIError, GrainsClient, resolve_api, zip_project
+from .login import ensure_token
+
+POLL_INTERVAL_S = 3
+BUILD_TIMEOUT_S = 600  # container-tier first builds take minutes
+
+
+def _status(client: GrainsClient, name: str, dep: dict) -> str:
+    if dep.get("status") != "building":
+        return dep.get("status", "unknown")
+    # lazy-reconciled container build: poll the deployment until it settles
+    dep_id = dep.get("id")
+    deadline = time.monotonic() + BUILD_TIMEOUT_S
+    while time.monotonic() < deadline:
+        time.sleep(POLL_INTERVAL_S)
+        cur = client._req("GET", f"/v1/agents/{name}/deployments/{dep_id}")
+        status = cur.get("deployment", cur).get("status")
+        if status not in ("building", "pending"):
+            return status
+        print("  building…", flush=True)
+    return "timeout"
+
+
+def cmd_ship(args: argparse.Namespace) -> int:
+    path = Path(args.path).resolve()
+    api = resolve_api(getattr(args, "api", None))
+
+    try:
+        token = ensure_token(api)
+    except Exception as e:  # noqa: BLE001
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+
+    if not (path / "grains.toml").exists():
+        print(f"no grains.toml in {path.name}/ -- scaffolding")
+        rc = init_cmd.cmd_init(Namespace(path=str(path), force=False, template=None))
+        if rc != 0:
+            return rc
+
+    name = tomllib.loads((path / "grains.toml").read_text())["agent"]["name"]
+    client = GrainsClient(api, token)
+    try:
+        try:
+            client.create_agent(name)
+        except GrainsAPIError as e:
+            if e.status != 409:
+                raise
+        result = client.deploy(name, zip_project(path))
+    except GrainsAPIError as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+
+    dep = result.get("deployment", result)
+    status = _status(client, name, dep)
+    agents_base = api.replace("api.", "agents.")
+    print()
+    print(f"  endpoint   {agents_base.removeprefix('https://')}/{name}")
+    if result.get("agent", {}).get("did") or dep.get("did"):
+        print(f"  identity   {result.get('agent', {}).get('did') or dep.get('did')}")
+    print(f"  status     {status}")
+    print(f"  dashboard  grains.run/dashboard.html")
+    return 0 if status == "live" else 1

{grains_cli-0.1.1 → grains_cli-0.2.0}/grains_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: grains-cli
-Version: 0.1.1
+Version: 0.2.0
 Summary: Command-line tools for Grains: build, run, deploy, and pay AI agents.
 Author: Grains
 License-Expression: Apache-2.0

{grains_cli-0.1.1 → grains_cli-0.2.0}/grains_cli.egg-info/SOURCES.txt

@@ -6,8 +6,10 @@ grains_cli/apiclient.py
 grains_cli/deploy.py
 grains_cli/dev.py
 grains_cli/init.py
+grains_cli/login.py
 grains_cli/main.py
 grains_cli/pay.py
+grains_cli/ship.py
 grains_cli/templates.py
 grains_cli/verify.py
 grains_cli.egg-info/PKG-INFO

{grains_cli-0.1.1 → grains_cli-0.2.0}/grains_cli.egg-info/entry_points.txt

@@ -1,2 +1,3 @@
 [console_scripts]
 grains = grains_cli.main:main
+grains-cli = grains_cli.main:main

{grains_cli-0.1.1 → grains_cli-0.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "grains-cli"
-version = "0.1.1"
+version = "0.2.0"
 description = "Command-line tools for Grains: build, run, deploy, and pay AI agents."
 readme = "README.md"
 license = "Apache-2.0"
@@ -24,6 +24,7 @@ dependencies = ["grains-sdk[crypto]>=0.1.0", "httpx", "eth-account>=0.11"]
 
 [project.scripts]
 grains = "grains_cli.main:main"
+grains-cli = "grains_cli.main:main"
 
 [project.urls]
 Homepage = "https://grains.run"