gravity-cli 0.3.1__tar.gz → 0.4.0__tar.gz

{gravity_cli-0.3.1 → gravity_cli-0.4.0}/.env.example

@@ -3,9 +3,9 @@
 # What each variable does: README.md, "Environment variables".
 
 # --- gravity run / schedule / adapt -------------------------------------
-# Your gateway dev token. Required to run an agent. Issued by the Gravity team;
-# a local gateway prints one at startup, or uses its LOCAL_DEV_TOKEN.
-GRAVITY_DEV_TOKEN=
+# A gateway token. Leave unset: gravity login stores one for you.
+# Set it only for a local gateway (it prints one at startup, or uses its LOCAL_DEV_TOKEN).
+# GRAVITY_DEV_TOKEN=
 
 # The gateway's MCP endpoint. Leave unset: the CLI asks Gravity where the gateway is.
 # Set it only for a local gateway.

{gravity_cli-0.3.1 → gravity_cli-0.4.0}/PKG-INFO

@@ -1,12 +1,12 @@
 Metadata-Version: 2.5
 Name: gravity-cli
-Version: 0.3.1
+Version: 0.4.0
 Summary: gravity cli — init, run, and push python agents to the Gravity marketplace
 License-Expression: Apache-2.0
 License-File: LICENSE
 License-File: NOTICE
 Requires-Python: >=3.12
-Requires-Dist: gravity-schema==0.3.1
+Requires-Dist: gravity-schema==0.4.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: keyring>=25.0.0
 Requires-Dist: python-dotenv>=1.0.0
@@ -69,7 +69,7 @@ pipx install gravity-cli
 gravity init my-agent
 ```
 
-> **Status.** `login`, `push` and the tool catalog work out of the box against Gravity's hosted services. `gravity run` also needs a gateway dev token, issued by the Gravity team until per-builder tokens ship.
+> **Status.** `login`, `push`, `run` and the tool catalog work out of the box against Gravity's hosted services. `gravity login` issues you the gateway token that `run` needs; nothing goes in `.env`.
 
 ## Contents
 
@@ -120,7 +120,7 @@ The same rules apply on your laptop and when the agent runs hosted, because both
 - `graph` is an `async def` factory. Read environment variables inside it, never at import time.
 - A tool that is not in `permissions.tools` is refused, whatever your code does.
 - A tool listed in `approvals.required_for` waits for a yes in the terminal before it runs.
-- The platform runs Python 3.12. Set `runtime.python: "3.12"` in the manifest before you push.
+- The platform runs Python 3.12. `gravity init` writes that, and `gravity validate` fails on anything else.
 
 ## Installation
 
@@ -284,7 +284,7 @@ gravity run --input transcript=@call.txt --input tone=formal
 gravity run --reply "make it shorter"
 ```
 
-- Requires `GRAVITY_DEV_TOKEN` and a reachable gateway.
+- Requires a gateway token: the one `gravity login` stores, or `GRAVITY_DEV_TOKEN`.
 - A call to a tool in `approvals.required_for` pauses, shows what it would do, and waits for `y` or `n`. With no terminal to ask in, it is rejected.
 - Exits with code 0 when the run finishes and 1 when it fails.
 
@@ -422,10 +422,11 @@ gravity logout
 
 ### `gravity whoami`
 
-Show the account you are signed in as.
+Show the account you are signed in as, and whether you hold a gateway token and until when.
 
 ```
 gravity whoami
+gravity whoami --token    # print the gateway token itself, for CI or a teammate's .env
 ```
 
 ### `gravity guide`
@@ -464,11 +465,11 @@ gravity help
 
 ### Where settings live
 
-Put them in `~/.gravity/.env` (on Windows, `%USERPROFILE%\.gravity\.env`). Every `gravity` command loads this file, from any folder, so you set a value once.
+Put them in `~/.gravity/.env` (on Windows, `%USERPROFILE%\.gravity\.env`). Every `gravity` command loads this file, from any folder, so you set a value once. With Gravity's hosted services, `gravity login` is all you need, and the file can stay empty.
 
 ```bash
 # ~/.gravity/.env
-GRAVITY_DEV_TOKEN=<your gateway dev token>
+GRAVITY_DEV_TOKEN=<a gateway token, only if gravity login did not issue you one>
 ```
 
 That is the only setting most builders ever need. The CLI knows where Gravity's control plane is, and asks it where the gateway is.
@@ -487,7 +488,7 @@ Never commit a `.env` file. The `.gitignore` in every template keeps `.env` and
 | You want to | Commands | Required | Usually also set |
 |---|---|---|---|
 | Create, check and package an agent | `init`, `validate`, `build` | nothing | nothing |
-| Run an agent locally | `run`, `schedule`, `adapt` | `GRAVITY_DEV_TOKEN` | nothing |
+| Run an agent locally | `run`, `schedule`, `adapt` | `gravity login` (or `GRAVITY_DEV_TOKEN`) | nothing |
 | Publish and inspect agents | `push`, `tools`, `agents`, `runs`, `logs`, `whoami` | `gravity login` | nothing |
 
 Set `GRAVITY_API_URL` and `GRAVITY_GATEWAY_URL` only to work against services you run yourself; see [Running a local gateway](#running-a-local-gateway).
@@ -496,7 +497,7 @@ Set `GRAVITY_API_URL` and `GRAVITY_GATEWAY_URL` only to work against services yo
 
 | Variable | What it is | Default |
 |---|---|---|
-| `GRAVITY_DEV_TOKEN` | Your gateway dev token. `gravity run` trades it for a run token scoped to the manifest's tools. Required for `run`, `schedule` and `adapt`. | none |
+| `GRAVITY_DEV_TOKEN` | A gateway token. `gravity run` trades it for a run token scoped to the manifest's tools. Overrides the token `gravity login` stored; needed only when login did not issue one, such as against a local gateway. | the token from `gravity login` |
 | `GRAVITY_GATEWAY_URL` | The gateway's MCP endpoint, ending in `/mcp` | the gateway the control plane names in `GET /api/cli/config` |
 | `GRAVITY_LLM_URL` | The OpenAI-compatible model endpoint | the gateway's address + `/v1` |
 | `GRAVITY_API_URL` | The control plane's address | `https://agents.dev.gravity.fast` |
@@ -521,9 +522,9 @@ Two separate credentials, for two separate services:
 | Credential | Used by | How you get it |
 |---|---|---|
 | Control-plane session | `push`, `tools`, `agents`, `runs`, `logs`, `whoami` | `gravity login` |
-| Gateway dev token | `run`, `schedule`, `adapt` | Issued to you, and stored as `GRAVITY_DEV_TOKEN` in `~/.gravity/.env` |
+| Gateway token | `run`, `schedule`, `adapt` | `gravity login` asks Gravity for one and stores it with the session. `gravity whoami` shows its expiry; `gravity whoami --token` prints it. `GRAVITY_DEV_TOKEN`, if set, is used instead. |
 
-`gravity login` stores the session in the operating system's keychain. On machines without one, it falls back to `~/.gravity/session.json`, readable only by you. `gravity logout` removes it.
+`gravity login` stores the session and gateway token in the operating system's keychain. On machines without one, it falls back to `~/.gravity/session.json`, readable only by you. `gravity logout` removes it.
 
 For development, setting `GRAVITY_API_TOKEN` to the control plane's dev token skips login. `gravity whoami` then prints the dev user's id followed by `(dev token)`.
 
@@ -637,7 +638,7 @@ outputs:                          # extra formats the platform renders and deliv
 | `kind` | no | `interactive` | `transform` (input in, result out), `interactive` (calls tools mid-run, may converse) or `monitor` (runs on a schedule or webhook and remembers the last run; needs a trigger). |
 | `runtime.entrypoint` | **yes** | | `path/to/file.py:object`, inside the project. The object is your `graph` factory. |
 | `runtime.framework` | no | `langgraph` | Only `langgraph`. |
-| `runtime.python` | no | `3.13` | `3.10` to `3.13` are accepted, but the platform image runs **3.12**. Set `"3.12"` before you push. |
+| `runtime.python` | no | `3.12` | What the platform image runs. `gravity validate` fails on any other value, because the hosted build would. |
 | `runtime.timeout_seconds` | no | `300` | 10 to 28800. |
 | `dependencies.lockfile` | no | `requirements.lock` | Compiled by `gravity validate`; ships with the agent. |
 | `inputs[]` | no | none | Up to 50. Each has `name` (a lowercase identifier, the key in `state["inputs"]`), `type`, `label`, and optionally `required`, `default`, `options`, `accept`. |
@@ -717,9 +718,10 @@ Real tools act on a connected account. Connect one with `gravity-gateway connect
 | Message | Cause and fix |
 |---|---|
 | `No matching distribution found for gravity-cli` | pip is running on a Python older than 3.12. Use `uv tool install gravity-cli`, or see [Installation](#installation). |
-| `No gateway dev token` | `run`, `schedule` and `adapt` need a gateway dev token. Add `GRAVITY_DEV_TOKEN` to `~/.gravity/.env`. |
+| `No gateway token` | `run`, `schedule` and `adapt` need a gateway token. Run `gravity login`, or add `GRAVITY_DEV_TOKEN` to `~/.gravity/.env`. |
+| `Your gateway token has expired` | The token `gravity login` stored has lapsed. Run `gravity login` again. |
 | `Can't reach the gateway at …` | No gateway at that address. Set `GRAVITY_GATEWAY_URL` to your gateway's `/mcp` address. |
-| `The gateway refused this run` | The gateway rejected the token or a declared tool. Check that `GRAVITY_DEV_TOKEN` is current. |
+| `The gateway refused this run` | The gateway rejected the token or a declared tool. Run `gravity whoami` to check the token, or `gravity login` for a fresh one. |
 | `You are not signed in` | A control-plane command without credentials. Run `gravity login`. |
 | `Can't reach Gravity at …` | The control plane did not answer. Check `GRAVITY_API_URL` in `~/.gravity/.env`. |
 | `Missing required input: …` | Pass each required input with `--input name=value`, or give it a `default` in the manifest. |

{gravity_cli-0.3.1 → gravity_cli-0.4.0}/README.md

@@ -52,7 +52,7 @@ pipx install gravity-cli
 gravity init my-agent
 ```
 
-> **Status.** `login`, `push` and the tool catalog work out of the box against Gravity's hosted services. `gravity run` also needs a gateway dev token, issued by the Gravity team until per-builder tokens ship.
+> **Status.** `login`, `push`, `run` and the tool catalog work out of the box against Gravity's hosted services. `gravity login` issues you the gateway token that `run` needs; nothing goes in `.env`.
 
 ## Contents
 
@@ -103,7 +103,7 @@ The same rules apply on your laptop and when the agent runs hosted, because both
 - `graph` is an `async def` factory. Read environment variables inside it, never at import time.
 - A tool that is not in `permissions.tools` is refused, whatever your code does.
 - A tool listed in `approvals.required_for` waits for a yes in the terminal before it runs.
-- The platform runs Python 3.12. Set `runtime.python: "3.12"` in the manifest before you push.
+- The platform runs Python 3.12. `gravity init` writes that, and `gravity validate` fails on anything else.
 
 ## Installation
 
@@ -267,7 +267,7 @@ gravity run --input transcript=@call.txt --input tone=formal
 gravity run --reply "make it shorter"
 ```
 
-- Requires `GRAVITY_DEV_TOKEN` and a reachable gateway.
+- Requires a gateway token: the one `gravity login` stores, or `GRAVITY_DEV_TOKEN`.
 - A call to a tool in `approvals.required_for` pauses, shows what it would do, and waits for `y` or `n`. With no terminal to ask in, it is rejected.
 - Exits with code 0 when the run finishes and 1 when it fails.
 
@@ -405,10 +405,11 @@ gravity logout
 
 ### `gravity whoami`
 
-Show the account you are signed in as.
+Show the account you are signed in as, and whether you hold a gateway token and until when.
 
 ```
 gravity whoami
+gravity whoami --token    # print the gateway token itself, for CI or a teammate's .env
 ```
 
 ### `gravity guide`
@@ -447,11 +448,11 @@ gravity help
 
 ### Where settings live
 
-Put them in `~/.gravity/.env` (on Windows, `%USERPROFILE%\.gravity\.env`). Every `gravity` command loads this file, from any folder, so you set a value once.
+Put them in `~/.gravity/.env` (on Windows, `%USERPROFILE%\.gravity\.env`). Every `gravity` command loads this file, from any folder, so you set a value once. With Gravity's hosted services, `gravity login` is all you need, and the file can stay empty.
 
 ```bash
 # ~/.gravity/.env
-GRAVITY_DEV_TOKEN=<your gateway dev token>
+GRAVITY_DEV_TOKEN=<a gateway token, only if gravity login did not issue you one>
 ```
 
 That is the only setting most builders ever need. The CLI knows where Gravity's control plane is, and asks it where the gateway is.
@@ -470,7 +471,7 @@ Never commit a `.env` file. The `.gitignore` in every template keeps `.env` and
 | You want to | Commands | Required | Usually also set |
 |---|---|---|---|
 | Create, check and package an agent | `init`, `validate`, `build` | nothing | nothing |
-| Run an agent locally | `run`, `schedule`, `adapt` | `GRAVITY_DEV_TOKEN` | nothing |
+| Run an agent locally | `run`, `schedule`, `adapt` | `gravity login` (or `GRAVITY_DEV_TOKEN`) | nothing |
 | Publish and inspect agents | `push`, `tools`, `agents`, `runs`, `logs`, `whoami` | `gravity login` | nothing |
 
 Set `GRAVITY_API_URL` and `GRAVITY_GATEWAY_URL` only to work against services you run yourself; see [Running a local gateway](#running-a-local-gateway).
@@ -479,7 +480,7 @@ Set `GRAVITY_API_URL` and `GRAVITY_GATEWAY_URL` only to work against services yo
 
 | Variable | What it is | Default |
 |---|---|---|
-| `GRAVITY_DEV_TOKEN` | Your gateway dev token. `gravity run` trades it for a run token scoped to the manifest's tools. Required for `run`, `schedule` and `adapt`. | none |
+| `GRAVITY_DEV_TOKEN` | A gateway token. `gravity run` trades it for a run token scoped to the manifest's tools. Overrides the token `gravity login` stored; needed only when login did not issue one, such as against a local gateway. | the token from `gravity login` |
 | `GRAVITY_GATEWAY_URL` | The gateway's MCP endpoint, ending in `/mcp` | the gateway the control plane names in `GET /api/cli/config` |
 | `GRAVITY_LLM_URL` | The OpenAI-compatible model endpoint | the gateway's address + `/v1` |
 | `GRAVITY_API_URL` | The control plane's address | `https://agents.dev.gravity.fast` |
@@ -504,9 +505,9 @@ Two separate credentials, for two separate services:
 | Credential | Used by | How you get it |
 |---|---|---|
 | Control-plane session | `push`, `tools`, `agents`, `runs`, `logs`, `whoami` | `gravity login` |
-| Gateway dev token | `run`, `schedule`, `adapt` | Issued to you, and stored as `GRAVITY_DEV_TOKEN` in `~/.gravity/.env` |
+| Gateway token | `run`, `schedule`, `adapt` | `gravity login` asks Gravity for one and stores it with the session. `gravity whoami` shows its expiry; `gravity whoami --token` prints it. `GRAVITY_DEV_TOKEN`, if set, is used instead. |
 
-`gravity login` stores the session in the operating system's keychain. On machines without one, it falls back to `~/.gravity/session.json`, readable only by you. `gravity logout` removes it.
+`gravity login` stores the session and gateway token in the operating system's keychain. On machines without one, it falls back to `~/.gravity/session.json`, readable only by you. `gravity logout` removes it.
 
 For development, setting `GRAVITY_API_TOKEN` to the control plane's dev token skips login. `gravity whoami` then prints the dev user's id followed by `(dev token)`.
 
@@ -620,7 +621,7 @@ outputs:                          # extra formats the platform renders and deliv
 | `kind` | no | `interactive` | `transform` (input in, result out), `interactive` (calls tools mid-run, may converse) or `monitor` (runs on a schedule or webhook and remembers the last run; needs a trigger). |
 | `runtime.entrypoint` | **yes** | | `path/to/file.py:object`, inside the project. The object is your `graph` factory. |
 | `runtime.framework` | no | `langgraph` | Only `langgraph`. |
-| `runtime.python` | no | `3.13` | `3.10` to `3.13` are accepted, but the platform image runs **3.12**. Set `"3.12"` before you push. |
+| `runtime.python` | no | `3.12` | What the platform image runs. `gravity validate` fails on any other value, because the hosted build would. |
 | `runtime.timeout_seconds` | no | `300` | 10 to 28800. |
 | `dependencies.lockfile` | no | `requirements.lock` | Compiled by `gravity validate`; ships with the agent. |
 | `inputs[]` | no | none | Up to 50. Each has `name` (a lowercase identifier, the key in `state["inputs"]`), `type`, `label`, and optionally `required`, `default`, `options`, `accept`. |
@@ -700,9 +701,10 @@ Real tools act on a connected account. Connect one with `gravity-gateway connect
 | Message | Cause and fix |
 |---|---|
 | `No matching distribution found for gravity-cli` | pip is running on a Python older than 3.12. Use `uv tool install gravity-cli`, or see [Installation](#installation). |
-| `No gateway dev token` | `run`, `schedule` and `adapt` need a gateway dev token. Add `GRAVITY_DEV_TOKEN` to `~/.gravity/.env`. |
+| `No gateway token` | `run`, `schedule` and `adapt` need a gateway token. Run `gravity login`, or add `GRAVITY_DEV_TOKEN` to `~/.gravity/.env`. |
+| `Your gateway token has expired` | The token `gravity login` stored has lapsed. Run `gravity login` again. |
 | `Can't reach the gateway at …` | No gateway at that address. Set `GRAVITY_GATEWAY_URL` to your gateway's `/mcp` address. |
-| `The gateway refused this run` | The gateway rejected the token or a declared tool. Check that `GRAVITY_DEV_TOKEN` is current. |
+| `The gateway refused this run` | The gateway rejected the token or a declared tool. Run `gravity whoami` to check the token, or `gravity login` for a fresh one. |
 | `You are not signed in` | A control-plane command without credentials. Run `gravity login`. |
 | `Can't reach Gravity at …` | The control plane did not answer. Check `GRAVITY_API_URL` in `~/.gravity/.env`. |
 | `Missing required input: …` | Pass each required input with `--input name=value`, or give it a `default` in the manifest. |

{gravity_cli-0.3.1 → gravity_cli-0.4.0}/packages/gravity-schema/gravity_schema/__init__.py

@@ -8,6 +8,7 @@ from .contract import (
     ENV_LLM_URL,
     ENV_RUN_TOKEN,
     LOCKFILE_PLATFORM,
+    PLATFORM_PYTHON,
     SUPPORTED_CONTRACT_VERSIONS,
     SUPPORTED_PYTHON_VERSIONS,
 )
@@ -49,6 +50,7 @@ __all__ = [  # noqa: RUF022 - grouped by concern, not alphabetical
     "SUPPORTED_CONTRACT_VERSIONS",
     "SUPPORTED_PYTHON_VERSIONS",
     "LOCKFILE_PLATFORM",
+    "PLATFORM_PYTHON",
     "ENV_GATEWAY_URL",
     "ENV_LLM_URL",
     "ENV_RUN_TOKEN",

{gravity_cli-0.3.1 → gravity_cli-0.4.0}/packages/gravity-schema/gravity_schema/contract.py

@@ -53,6 +53,9 @@ SUPPORTED_PYTHON_VERSIONS: Final[frozenset[str]] = frozenset(
 
 # The platform image is ARM64 Linux; locks are resolved for it, not the laptop.
 LOCKFILE_PLATFORM: Final[str] = "aarch64-manylinux2014"
+# The Python the platform image runs (infra/base-image). A manifest naming another
+# version is accepted by the schema but refused by the hosted build, so validate checks it.
+PLATFORM_PYTHON: Final[str] = "3.12"
 
 MIN_TIMEOUT_SECONDS: Final[int] = 10
 # An AgentCore session's 8-hour maximum lifetime.

{gravity_cli-0.3.1 → gravity_cli-0.4.0}/packages/gravity-schema/gravity_schema/manifest.py

@@ -79,7 +79,7 @@ class RuntimeSpec(BaseModel):
     model_config = _STRICT
 
     framework: str = "langgraph"
-    python: str = "3.13"
+    python: str = C.PLATFORM_PYTHON
     entrypoint: Annotated[str, Field(max_length=C.MAX_ENTRYPOINT_LENGTH)]
     timeout_seconds: Annotated[int, Field(ge=C.MIN_TIMEOUT_SECONDS, le=C.MAX_TIMEOUT_SECONDS)] = 300
 

{gravity_cli-0.3.1 → gravity_cli-0.4.0}/packages/gravity-schema/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "gravity-schema"
-version = "0.3.1"
+version = "0.4.0"
 description = "Gravity agent manifest contract — models, validation, and JSON Schema export"
 readme = "README.md"
 license = "Apache-2.0"

{gravity_cli-0.3.1 → gravity_cli-0.4.0}/packages/gravity-schema/schema/manifest.schema.json

@@ -235,7 +235,7 @@
           "type": "string"
         },
         "python": {
-          "default": "3.13",
+          "default": "3.12",
           "title": "Python",
           "type": "string"
         },

{gravity_cli-0.3.1 → gravity_cli-0.4.0}/packages/gravity-schema/tests/test_manifest.py

@@ -623,4 +623,4 @@ def test_state_size_outside_bounds_rejected(manifest_data, bad):
 
 def test_runtime_python_defaults_to_313(manifest_data):
     del manifest_data["runtime"]["python"]
-    assert validate_manifest(manifest_data).runtime.python == "3.13"
+    assert validate_manifest(manifest_data).runtime.python == "3.12"

{gravity_cli-0.3.1 → gravity_cli-0.4.0}/pyproject.toml

@@ -1,13 +1,13 @@
 [project]
 name = "gravity-cli"
-version = "0.3.1"
+version = "0.4.0"
 description = "gravity cli — init, run, and push python agents to the Gravity marketplace"
 readme = "README.md"
 license = "Apache-2.0"
 license-files = ["LICENSE", "NOTICE"]
 requires-python = ">=3.12"
 dependencies = [
-    "gravity-schema==0.3.1",  # released in lockstep: always the same version as this package
+    "gravity-schema==0.4.0",  # released in lockstep: always the same version as this package
     "typer>=0.15.0",
     "httpx>=0.27.0",
     "rich>=13.9.0",

{gravity_cli-0.3.1 → gravity_cli-0.4.0}/src/gravity_cli/api.py

@@ -23,8 +23,11 @@ def _token() -> str:
     return token
 
 
-def _request(method: str, path: str, *, auth: bool = True, timeout: int = 60, headers: dict | None = None, retry: bool = True, **kw) -> Any:
-    """The JSON body. A refused connection or an error status becomes a Problem."""
+def _request(
+    method: str, path: str, *, auth: bool = True, timeout: int = 60, headers: dict | None = None, retry: bool = True,
+    missing_ok: bool = False, **kw,
+) -> Any:
+    """The JSON body. A refused connection or an error status becomes a Problem; with missing_ok, a 404 is None."""
     extra = headers or {}
     sent = {**({"Authorization": f"Bearer {_token()}"} if auth else {}), **extra}
     try:
@@ -39,6 +42,8 @@ def _request(method: str, path: str, *, auth: bool = True, timeout: int = 60, he
         if retry and _refresh():
             return _request(method, path, auth=auth, timeout=timeout, headers=extra, retry=False, **kw)
         raise Problem("Your sign-in has expired", fix="Run gravity login again.")
+    if resp.status_code == 404 and missing_ok:
+        return None
     if resp.status_code >= 400:
         try:
             body = resp.json()
@@ -94,6 +99,11 @@ def get(path: str) -> Any:
     return _request("GET", path)
 
 
+def gateway_token() -> dict | None:
+    """A gateway token for this builder: token, expires_at, budget_usd. None until Gravity issues them."""
+    return _request("POST", "/api/cli/gateway-token", missing_ok=True, json={})
+
+
 def push_agent(manifest_json: dict, zip_bytes: bytes, source_sha256: str) -> dict:
     headers = {
         "Content-Type": "application/octet-stream",

{gravity_cli-0.3.1 → gravity_cli-0.4.0}/src/gravity_cli/commands/adapt.py

@@ -14,6 +14,7 @@ import typer
 
 from .. import Problem, project, ui
 from ..manifest import ManifestValidationError, load_manifest
+from .login import gateway_token
 from .run import BUILDER_TOKENS, _mint_run_token, gateway_urls
 
 ATTEMPTS = 3
@@ -93,7 +94,7 @@ def adapt_command(
     ui.ok("Declared in manifest.yaml")
 
     _, gateway_base = gateway_urls()
-    dev = {"Authorization": f"Bearer {os.environ.get('GRAVITY_DEV_TOKEN', '')}"}
+    dev = {"Authorization": f"Bearer {gateway_token()}"}
     all_tools = sorted({t for tl in manifest.slots[slot].adapters.values() for t in tl} | set(grant))
     try:
         schemas = httpx.get(f"{gateway_base}/tools", params={"names": ",".join(all_tools)}, headers=dev, timeout=15)

gravity_cli-0.4.0/src/gravity_cli/commands/login.py

@@ -0,0 +1,89 @@
+from __future__ import annotations
+
+import os
+import time
+import webbrowser
+from datetime import UTC, datetime
+from typing import Annotated
+
+import typer
+
+from .. import Problem, api, config, ui
+
+
+def login_command():
+    """Log in with a browser device code; the token goes in the OS keychain."""
+    start = api.device_start()
+    device_code = start["deviceCode"]
+    interval = start.get("interval", 3)
+    deadline = time.time() + start.get("expiresIn", 600)
+
+    ui.heading("Sign in to Gravity")
+    ui.table(["", "", ""], [
+        ["1", "Your browser is opening", start["verificationUrl"]],
+        ["2", "Confirm this code", start["userCode"]],
+    ])
+    ui.say()
+    webbrowser.open(start["verificationUrl"])
+
+    with ui.working("Waiting for you to approve") as show:
+        while (left := deadline - time.time()) > 0:
+            show(f"Waiting for you to approve  {int(left) // 60}:{int(left) % 60:02d} left")
+            time.sleep(interval)
+            result = api.device_poll(device_code)
+            if result["status"] == "approved":
+                session = result["session"]
+                config.save_session(config.Session(session["accessToken"], session["refreshToken"]))
+                break
+        else:
+            raise Problem("Sign-in timed out", fix="Run gravity login again.")
+    ui.ok("Signed in")
+    issued = api.gateway_token()
+    if issued:
+        config.save_session(config.Session(session["accessToken"], session["refreshToken"], issued))
+        ui.ok("Gateway token", _token_status(issued))
+
+
+def _token_status(gateway: dict) -> str:
+    until = f"valid until {datetime.fromisoformat(gateway['expires_at']).astimezone():%a %d %b %H:%M}" if gateway.get("expires_at") else "does not expire"
+    budget = f" · budget ${gateway['budget_usd']:.2f}" if gateway.get("budget_usd") is not None else ""
+    return until + budget
+
+
+def gateway_token() -> str:
+    """The token gravity run uses: GRAVITY_DEV_TOKEN if set, else the one gravity login stored."""
+    if token := os.environ.get("GRAVITY_DEV_TOKEN"):
+        return token
+    session = config.load_session()
+    if not (session and session.gateway):
+        raise Problem("No gateway token", fix="Run gravity login, or add GRAVITY_DEV_TOKEN to ~/.gravity/.env")
+    expires = session.gateway.get("expires_at")
+    if expires and datetime.fromisoformat(expires) <= datetime.now(UTC):
+        raise Problem("Your gateway token has expired", fix="Run gravity login again.")
+    return session.gateway["token"]
+
+
+def whoami_command(
+    token: Annotated[bool, typer.Option("--token", help="Print the gateway token itself, for CI or a teammate's .env")] = False,
+):
+    """If you forget who you are."""
+    if token:
+        ui.out.print(gateway_token(), markup=False)  # plain, so it can be piped or copied
+        return
+    me = api.get("/api/cli/me")
+    me = me if isinstance(me, dict) else {}
+    # Only the dev token (GRAVITY_API_TOKEN) is a user without an email.
+    who = me.get("email") or f"{me.get('id', '')} (dev token)"
+    ui.ok(who, me.get("userType", ""))
+    session = config.load_session()
+    if os.environ.get("GRAVITY_DEV_TOKEN"):
+        ui.ok("Gateway token", "from GRAVITY_DEV_TOKEN in your environment")
+    elif session and session.gateway:
+        ui.ok("Gateway token", _token_status(session.gateway))
+    else:
+        ui.warn("No gateway token", "gravity run needs one.", "Run gravity login again, or set GRAVITY_DEV_TOKEN.")
+
+
+def logout_command():
+    config.clear_session()
+    ui.ok("Signed out")

{gravity_cli-0.3.1 → gravity_cli-0.4.0}/src/gravity_cli/commands/run.py

@@ -15,6 +15,7 @@ import typer
 from .. import Problem, api, project, ui
 from ..manifest import load_manifest
 from ..timeline import EVENT_PREFIX, Timeline
+from .login import gateway_token
 
 RUNNER_SCRIPT = Path(__file__).parent.parent / "_runner_script.py"
 # The builder's own tokens: never handed to agent or LLM-written code.
@@ -41,9 +42,7 @@ def _check_version(minimum: str | None) -> None:
 
 def _mint_run_token(gateway_base: str, tools: list[str], approvals: list[str] = ()) -> dict:
     """Dev token -> a run token scoped to the manifest's tools, as a hosted run gets."""
-    dev_token = os.environ.get("GRAVITY_DEV_TOKEN")
-    if not dev_token:
-        raise Problem("No gateway dev token", fix="Add GRAVITY_DEV_TOKEN to ~/.gravity/.env")
+    dev_token = gateway_token()
     try:
         resp = httpx.post(
             f"{gateway_base}/runs",
@@ -89,7 +88,7 @@ def _summary(arguments: dict) -> str:
 
 def _ask_approval(live, timeline: Timeline, ev: dict, gateway_base: str, run_id: str | None) -> None:
     """Find the held call, show what it would do, send the builder's answer."""
-    headers = {"Authorization": f"Bearer {os.environ['GRAVITY_DEV_TOKEN']}"}
+    headers = {"Authorization": f"Bearer {gateway_token()}"}
     name = timeline._name(ev["tool"])
     pending = None
     for _ in range(60):  # the call reaches the gateway a moment after it starts
@@ -156,7 +155,7 @@ def run_command(
         None, "--reply", help='Continue the last conversation of a chat agent, e.g. --reply "make it shorter"'
     ),
 ):
-    """Run your agent locally through the gateway. Needs GRAVITY_DEV_TOKEN in ~/.gravity/.env."""
+    """Run your agent locally through the gateway, with the token gravity login stored or GRAVITY_DEV_TOKEN."""
     project_dir = path.resolve()
     manifest = load_manifest(project_dir / "manifest.yaml")
 

{gravity_cli-0.3.1 → gravity_cli-0.4.0}/src/gravity_cli/commands/validate.py

@@ -8,7 +8,7 @@ import time
 from pathlib import Path
 
 import typer
-from gravity_schema import DEV_TOOL_NAMES, LOCKFILE_PLATFORM
+from gravity_schema import DEV_TOOL_NAMES, LOCKFILE_PLATFORM, PLATFORM_PYTHON
 from gravity_schema.contract import TOOL_NAME_RE as _TOOL_NAME_RE
 
 from .. import ui
@@ -156,6 +156,11 @@ def check(project_dir: Path) -> tuple[Manifest, int, int]:
         ui.ok("Entrypoint", manifest.runtime.entrypoint)
     problems += len(findings)
 
+    if manifest.runtime.python != PLATFORM_PYTHON:  # the hosted build refuses it, so fail here instead
+        ui.bad("Python", f"manifest declares {manifest.runtime.python} but the platform runs {PLATFORM_PYTHON}",
+               f'Set runtime.python to "{PLATFORM_PYTHON}" in {MANIFEST_FILE}.')
+        problems += 1
+
     lock = manifest.dependencies.lockfile
     target = f"{LOCKFILE_PLATFORM} · py{manifest.runtime.python}"
     if not (project_dir / "requirements.txt").is_file():

{gravity_cli-0.3.1 → gravity_cli-0.4.0}/src/gravity_cli/config.py

@@ -57,6 +57,7 @@ def first_run() -> bool:
 class Session:
     access_token: str
     refresh_token: str
+    gateway: dict | None = None  # {"token", "expires_at", "budget_usd"}, once Gravity issues per-builder tokens
 
 
 # Keychain calls fail on headless/CI boxes with no backend; the 0600 file covers those.
@@ -79,7 +80,7 @@ def load_session() -> Session | None:
         return None
     try:
         data = json.loads(payload)
-        return Session(data["access_token"], data["refresh_token"])
+        return Session(data["access_token"], data["refresh_token"], data.get("gateway"))
     except (json.JSONDecodeError, KeyError, TypeError):
         return None
 

{gravity_cli-0.3.1 → gravity_cli-0.4.0}/src/gravity_cli/templates/chat/manifest.yaml

@@ -5,7 +5,7 @@ description: "a conversational langgraph agent - keeps the thread, so you can an
 
 runtime:
   framework: langgraph
-  python: "3.13"
+  python: "3.12"
   entrypoint: src/agent.py:graph
   timeout_seconds: 300
 

{gravity_cli-0.3.1 → gravity_cli-0.4.0}/src/gravity_cli/templates/deepagent/manifest.yaml

@@ -5,7 +5,7 @@ description: "a deepagents-harness agent, scaffolded by gravity init"
 
 runtime:
   framework: langgraph        # deepagents compiles to a langgraph graph
-  python: "3.13"
+  python: "3.12"
   entrypoint: src/agent.py:graph
   timeout_seconds: 300
 

{gravity_cli-0.3.1 → gravity_cli-0.4.0}/src/gravity_cli/templates/minimal/manifest.yaml

@@ -5,7 +5,7 @@ description: "a minimal langgraph agent, scaffolded by gravity init"
 
 runtime:
   framework: langgraph        # v1: langgraph only
-  python: "3.13"
+  python: "3.12"
   entrypoint: src/agent.py:graph   # file:object — the graph the runner invokes
   timeout_seconds: 300
 

{gravity_cli-0.3.1 → gravity_cli-0.4.0}/src/gravity_cli/templates/structured/manifest.yaml

@@ -5,7 +5,7 @@ description: "a structured langgraph agent, scaffolded by gravity init"
 
 runtime:
   framework: langgraph
-  python: "3.13"
+  python: "3.12"
   entrypoint: src/agent.py:graph
   timeout_seconds: 300
 

{gravity_cli-0.3.1 → gravity_cli-0.4.0}/tests/test_build_push.py

@@ -142,3 +142,14 @@ def test_lock_is_compiled_with_paths_relative_to_the_project(project, monkeypatc
     assert Path(cwd) == project
     assert str(project) not in " ".join(cmd), cmd
     assert cmd[-3:] == ["requirements.txt", "-o", "requirements.lock"]
+
+
+def test_validate_fails_on_a_python_the_platform_does_not_run(project, capsys):
+    """The hosted build refuses any Python but the platform's; the push failed minutes
+    after it was accepted. validate says so before the push."""
+    from gravity_cli.commands import validate
+
+    (project / "manifest.yaml").write_text(MANIFEST.replace('python: "3.12"', 'python: "3.13"'))
+    with pytest.raises(typer.Exit):
+        validate.validate_command(project)
+    assert "platform runs 3.12" in capsys.readouterr().out

gravity_cli-0.4.0/tests/test_gateway_token.py

@@ -0,0 +1,72 @@
+"""The per-builder gateway token: login stores it, run uses it, whoami shows its status."""
+
+from __future__ import annotations
+
+from datetime import UTC, datetime, timedelta
+
+import pytest
+import typer
+
+from gravity_cli import config
+from gravity_cli.commands import login
+
+SOON = (datetime.now(UTC) + timedelta(hours=12)).isoformat().replace("+00:00", "Z")
+ISSUED = {"token": "grt_builder", "token_id": "t1", "expires_at": SOON, "budget_usd": 5.0}
+
+
+@pytest.fixture
+def stored(monkeypatch):
+    """The keychain, as a list whose last item is the current session."""
+    sessions: list = []
+    monkeypatch.setattr(config, "save_session", sessions.append)
+    monkeypatch.setattr(config, "load_session", lambda: sessions[-1] if sessions else None)
+    monkeypatch.delenv("GRAVITY_DEV_TOKEN", raising=False)
+    return sessions
+
+
+def _login(monkeypatch, issued):
+    monkeypatch.setattr(login.api, "device_start", lambda: {"deviceCode": "d", "userCode": "U", "verificationUrl": "https://x", "interval": 0})
+    monkeypatch.setattr(login.api, "device_poll", lambda code: {"status": "approved", "session": {"accessToken": "a", "refreshToken": "r"}})
+    monkeypatch.setattr(login.api, "gateway_token", lambda: issued)
+    monkeypatch.setattr(login.webbrowser, "open", lambda url: None)
+    login.login_command()
+
+
+def test_login_stores_the_gateway_token_and_run_uses_it(stored, monkeypatch, capsys):
+    _login(monkeypatch, ISSUED)
+    assert stored[-1].gateway == ISSUED
+    assert "Gateway token" in capsys.readouterr().out
+    assert login.gateway_token() == "grt_builder"
+
+
+def test_login_still_works_before_gravity_issues_tokens(stored, monkeypatch):
+    _login(monkeypatch, None)  # the endpoint answered 404
+    assert stored[-1].gateway is None
+    with pytest.raises(typer.Exit) as e:
+        login.gateway_token()
+    assert "gravity login" in str(e.value) and "GRAVITY_DEV_TOKEN" in str(e.value)
+
+
+def test_the_env_token_wins_and_an_expired_stored_one_is_refused(stored, monkeypatch):
+    stored.append(config.Session("a", "r", {**ISSUED, "expires_at": "2020-01-01T00:00:00Z"}))
+    with pytest.raises(typer.Exit) as e:
+        login.gateway_token()
+    assert "expired" in str(e.value)
+    monkeypatch.setenv("GRAVITY_DEV_TOKEN", "grt_env")
+    assert login.gateway_token() == "grt_env"
+
+
+def test_a_token_without_an_expiry_is_fine(stored, capsys):
+    stored.append(config.Session("a", "r", {"token": "grt_forever", "expires_at": None, "budget_usd": None}))
+    assert login.gateway_token() == "grt_forever"
+    assert "does not expire" in login._token_status(stored[-1].gateway)
+
+
+def test_whoami_shows_token_status_and_prints_it_only_on_request(stored, monkeypatch, capsys):
+    stored.append(config.Session("a", "r", ISSUED))
+    monkeypatch.setattr(login.api, "get", lambda path: {"email": "me@x", "userType": "creator"})
+    login.whoami_command(token=False)
+    out = capsys.readouterr().out
+    assert "valid until" in out and "budget $5.00" in out and "grt_builder" not in out
+    login.whoami_command(token=True)
+    assert capsys.readouterr().out.strip() == "grt_builder"

{gravity_cli-0.3.1 → gravity_cli-0.4.0}/tests/test_templates.py

@@ -38,7 +38,7 @@ def test_manifest_is_valid_and_targets_313(tmp_path, template):
 
     manifest = load_manifest(path)
 
-    assert manifest.runtime.python == "3.13"
+    assert manifest.runtime.python == "3.12"
     assert manifest.runtime.entrypoint == "src/agent.py:graph"
 
 

{gravity_cli-0.3.1 → gravity_cli-0.4.0}/uv.lock

@@ -59,7 +59,7 @@ name = "cffi"
 version = "2.1.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "pycparser", marker = "implementation_name != 'PyPy'" },
+    { name = "pycparser", marker = "implementation_name != 'PyPy' and sys_platform != 'win32'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/9e/ef/008a1939e372c06329a3fce4279c02f328488f3526744906eeec3da7ad5f/cffi-2.1.1.tar.gz", hash = "sha256:dd31f52ea1086513bb9df30f8fcee9b8918323ae067a3d5b78bc826a000712be", size = 530807, upload-time = "2026-08-03T21:21:18.939Z" }
 wheels = [
@@ -123,7 +123,7 @@ name = "cryptography"
 version = "50.0.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
+    { name = "cffi", marker = "platform_python_implementation != 'PyPy' and sys_platform != 'win32'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/de/41/6cbdcf9142d00fe82836fbb51e503e58088575cf7a0fe1dbff6695bf0840/cryptography-50.0.0.tar.gz", hash = "sha256:eeac2acb5a20ed25e0ad6d1df9891a520b78b404266b6d11778f25d5d691a6c9", size = 880201, upload-time = "2026-07-31T14:25:10.11Z" }
 wheels = [
@@ -164,7 +164,7 @@ wheels = [
 
 [[package]]
 name = "gravity-cli"
-version = "0.3.1"
+version = "0.4.0"
 source = { editable = "." }
 dependencies = [
     { name = "gravity-schema" },
@@ -201,7 +201,7 @@ dev = [
 
 [[package]]
 name = "gravity-schema"
-version = "0.3.1"
+version = "0.4.0"
 source = { editable = "packages/gravity-schema" }
 dependencies = [
     { name = "pydantic" },
@@ -619,8 +619,8 @@ name = "secretstorage"
 version = "3.5.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "cryptography" },
-    { name = "jeepney" },
+    { name = "cryptography", marker = "sys_platform != 'win32'" },
+    { name = "jeepney", marker = "sys_platform != 'win32'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/1c/03/e834bcd866f2f8a49a85eaff47340affa3bfa391ee9912a952a1faa68c7b/secretstorage-3.5.0.tar.gz", hash = "sha256:f04b8e4689cbce351744d5537bf6b1329c6fc68f91fa666f60a380edddcd11be", size = 19884, upload-time = "2025-11-23T19:02:53.191Z" }
 wheels = [

gravity_cli-0.3.1/src/gravity_cli/commands/login.py

@@ -1,49 +0,0 @@
-from __future__ import annotations
-
-import time
-import webbrowser
-
-from .. import Problem, api, config, ui
-
-
-def login_command():
-    """Log in with a browser device code; the token goes in the OS keychain."""
-    start = api.device_start()
-    device_code = start["deviceCode"]
-    interval = start.get("interval", 3)
-    deadline = time.time() + start.get("expiresIn", 600)
-
-    ui.heading("Sign in to Gravity")
-    ui.table(["", "", ""], [
-        ["1", "Your browser is opening", start["verificationUrl"]],
-        ["2", "Confirm this code", start["userCode"]],
-    ])
-    ui.say()
-    webbrowser.open(start["verificationUrl"])
-
-    with ui.working("Waiting for you to approve") as show:
-        while (left := deadline - time.time()) > 0:
-            show(f"Waiting for you to approve  {int(left) // 60}:{int(left) % 60:02d} left")
-            time.sleep(interval)
-            result = api.device_poll(device_code)
-            if result["status"] == "approved":
-                session = result["session"]
-                config.save_session(config.Session(session["accessToken"], session["refreshToken"]))
-                break
-        else:
-            raise Problem("Sign-in timed out", fix="Run gravity login again.")
-    ui.ok("Signed in")
-
-
-def whoami_command():
-    """If you forget who you are."""
-    me = api.get("/api/cli/me")
-    me = me if isinstance(me, dict) else {}
-    # Only the dev token (GRAVITY_API_TOKEN) is a user without an email.
-    who = me.get("email") or f"{me.get('id', '')} (dev token)"
-    ui.ok(who, me.get("userType", ""))
-
-
-def logout_command():
-    config.clear_session()
-    ui.ok("Signed out")