gridlinegpu 0.1.2__tar.gz → 0.1.3__tar.gz

{gridlinegpu-0.1.2 → gridlinegpu-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gridlinegpu
-Version: 0.1.2
+Version: 0.1.3
 Summary: Python client for Gridline YAML workload routing
 Author: Gridline GPU
 License: Proprietary
@@ -17,21 +17,21 @@ Requires-Dist: PyYAML<7,>=6.0.2
 
 Submit one YAML workload through Gridline's authenticated API. The Python client stages
 files referenced by YAML, returns a route for review, then launches only that exact
-fresh plan when you supply a cost ceiling and idempotency key.
+fresh plan when you supply a cost ceiling and idempotency key. The package also installs
+the `gridline` command in the same Python environment on macOS and Linux.
 
 ## Install
 
 ```sh
-python -m pip install 'gridlinegpu>=0.1.2,<0.2'
+python -m pip install 'gridlinegpu>=0.1.3,<0.2'
 ```
 
-Create a scoped token using the Gridline CLI after browser sign-in. The token stays in a
-private file; do not paste it into source code or an AI chat.
+Run browser setup once. It creates a 30-day scoped token in a private file, attempts to
+revoke the temporary browser session, and never prints the token. Keep the token file out of
+source control and AI chats.
 
 ```sh
-gridline --profile production auth login --apply
-gridline --profile production auth token create --name python-workloads --scopes read,routing:write --output-file "$HOME/.config/gridline/python-token" --apply
-export GRIDLINE_API_TOKEN_FILE="$HOME/.config/gridline/python-token"
+gridline setup --apply
 ```
 
 Use a YAML file beside its referenced inputs. Task, model, engine, providers, output,
@@ -53,6 +53,32 @@ print(ready["job"]["outputs"], ready["job"]["outcome"])
 print(client.outputs(job_id, "results"))
 ```
 
+The same installed package supports a terminal flow:
+
+```sh
+gridline workload validate --file workload.yaml
+gridline workload plan --file workload.yaml
+gridline workload run --file workload.yaml --apply --max-cost-usd 5 \
+  --idempotency-key my-job-2026-09-27
+gridline workload status JOB_ID
+gridline workload outputs JOB_ID --directory results
+```
+
+The paid `run` command plans a fresh quote, prints it, and asks for explicit confirmation.
+For an approved noninteractive run, add `--yes` and explicit `--profile production`
+alongside `--apply`, a cost ceiling, and an idempotency key. Cancellation similarly
+requires `--apply` and confirmation. A custom
+token path may be passed as global `--token-file` or through `GRIDLINE_API_TOKEN_FILE`.
+Workload commands also honor `GRIDLINE_API_TOKEN` when no token file is selected.
+The existing standalone Bun CLI remains available during transition; check which
+`gridline` executable your shell selects when both are installed. Run
+`python -m gridlinegpu` to choose this package's command explicitly.
+Use `gridline auth token list` to find a token ID and
+`gridline auth token revoke TOKEN_ID --apply` to revoke it. Both require fresh browser
+approval; the Python CLI never stores a privileged refresh token.
+After revoking a token, remove its local file before running setup again; setup never
+overwrites an existing file.
+
 `plan()` stages input bytes but does not allocate a GPU. `launch()` never silently
 changes a plan or retries an ambiguous paid request. If launch outcome is unknown,
 inspect `LaunchOutcomeUnknown.workload_id` with the same idempotency key; do not use a

gridlinegpu-0.1.3/README.md

@@ -0,0 +1,73 @@
+# Gridline Python SDK
+
+Submit one YAML workload through Gridline's authenticated API. The Python client stages
+files referenced by YAML, returns a route for review, then launches only that exact
+fresh plan when you supply a cost ceiling and idempotency key. The package also installs
+the `gridline` command in the same Python environment on macOS and Linux.
+
+## Install
+
+```sh
+python -m pip install 'gridlinegpu>=0.1.3,<0.2'
+```
+
+Run browser setup once. It creates a 30-day scoped token in a private file, attempts to
+revoke the temporary browser session, and never prints the token. Keep the token file out of
+source control and AI chats.
+
+```sh
+gridline setup --apply
+```
+
+Use a YAML file beside its referenced inputs. Task, model, engine, providers, output,
+budget, and deadline belong in YAML rather than Python arguments.
+Current hosted artifact limits are 40 MiB per local input and 8 MiB per output.
+
+```python
+from gridlinegpu import GridlineClient
+
+client = GridlineClient()
+plan = client.plan("workload.yaml")
+print(plan.review)  # Check selected GPU, exclusions, estimate, and maximum.
+
+# Launch only after reviewing the fresh plan and accepting its maximum spend.
+launch = client.launch(plan, max_cost_usd="5.00", idempotency_key="my-job-2026-09-27")
+job_id = launch["jobId"]
+ready = client.wait(job_id, timeout=7200)
+print(ready["job"]["outputs"], ready["job"]["outcome"])
+print(client.outputs(job_id, "results"))
+```
+
+The same installed package supports a terminal flow:
+
+```sh
+gridline workload validate --file workload.yaml
+gridline workload plan --file workload.yaml
+gridline workload run --file workload.yaml --apply --max-cost-usd 5 \
+  --idempotency-key my-job-2026-09-27
+gridline workload status JOB_ID
+gridline workload outputs JOB_ID --directory results
+```
+
+The paid `run` command plans a fresh quote, prints it, and asks for explicit confirmation.
+For an approved noninteractive run, add `--yes` and explicit `--profile production`
+alongside `--apply`, a cost ceiling, and an idempotency key. Cancellation similarly
+requires `--apply` and confirmation. A custom
+token path may be passed as global `--token-file` or through `GRIDLINE_API_TOKEN_FILE`.
+Workload commands also honor `GRIDLINE_API_TOKEN` when no token file is selected.
+The existing standalone Bun CLI remains available during transition; check which
+`gridline` executable your shell selects when both are installed. Run
+`python -m gridlinegpu` to choose this package's command explicitly.
+Use `gridline auth token list` to find a token ID and
+`gridline auth token revoke TOKEN_ID --apply` to revoke it. Both require fresh browser
+approval; the Python CLI never stores a privileged refresh token.
+After revoking a token, remove its local file before running setup again; setup never
+overwrites an existing file.
+
+`plan()` stages input bytes but does not allocate a GPU. `launch()` never silently
+changes a plan or retries an ambiguous paid request. If launch outcome is unknown,
+inspect `LaunchOutcomeUnknown.workload_id` with the same idempotency key; do not use a
+new key. `outputs()` verifies byte count and SHA-256 before creating private files.
+Cancellation requests stop; cleanup and final provider billing can remain pending.
+For finite jobs, `wait()` returns when outputs are complete, even if cleanup and billing
+leave `outcome` pending. Check `status()` later for final settlement.

{gridlinegpu-0.1.2 → gridlinegpu-0.1.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gridlinegpu"
-version = "0.1.2"
+version = "0.1.3"
 description = "Python client for Gridline YAML workload routing"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -17,6 +17,9 @@ classifiers = [
   "Operating System :: OS Independent",
 ]
 
+[project.scripts]
+gridline = "gridlinegpu.cli:main"
+
 [project.urls]
 Documentation = "https://gridlinegpu.com/cli"
 Repository = "https://github.com/GridlineGPU/gridline-gpu"

gridlinegpu-0.1.3/src/gridlinegpu/__main__.py

@@ -0,0 +1,6 @@
+"""Run the packaged customer CLI with ``python -m gridlinegpu``."""
+
+from .cli import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())

gridlinegpu-0.1.3/src/gridlinegpu/cli.py

@@ -0,0 +1,187 @@
+"""Customer workload command installed by the gridlinegpu Python package."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import sys
+from decimal import Decimal, InvalidOperation
+from importlib.metadata import PackageNotFoundError, version
+from pathlib import Path
+from typing import Any, Sequence, TextIO
+
+from .cli_auth import DeviceAuth, default_token_file
+from .client import GridlineClient
+from .errors import GridlineError, LaunchOutcomeUnknown
+
+_KEY = re.compile(r"[A-Za-z0-9][A-Za-z0-9._:-]{0,127}\Z")
+
+
+def _version() -> str:
+    try:
+        return version("gridlinegpu")
+    except PackageNotFoundError:
+        return "development"
+
+
+def _parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="gridline", description="Gridline Python SDK and workload CLI")
+    parser.add_argument("--version", action="version", version=f"gridline Python CLI {_version()}")
+    parser.add_argument("--profile", choices=["production"],
+                        help="Explicit production target, required with --yes")
+    parser.add_argument("--token-file", type=Path,
+                        help="Private scoped token file (default: GRIDLINE_API_TOKEN_FILE or ~/.config/gridline/python-token)")
+    commands = parser.add_subparsers(dest="command", required=True)
+
+    setup = commands.add_parser("setup", help="Approve browser login and create a private workload token")
+    setup.add_argument("--output-file", type=Path, help="New token file; never overwrites")
+    setup.add_argument("--name", default="python-cli", help="Revocable token name")
+    setup.add_argument("--apply", action="store_true", help="Create scoped token after browser approval")
+
+    auth = commands.add_parser("auth", help="List or revoke scoped workload tokens")
+    auth_actions = auth.add_subparsers(dest="auth_action", required=True)
+    tokens = auth_actions.add_parser("token", help="Manage revocable scoped tokens")
+    token_actions = tokens.add_subparsers(dest="token_action", required=True)
+    token_actions.add_parser("list", help="List tokens after browser approval")
+    revoke = token_actions.add_parser("revoke", help="Revoke token after browser approval")
+    revoke.add_argument("token_id")
+    revoke.add_argument("--apply", action="store_true")
+
+    workload = commands.add_parser("workload", help="Validate, plan, launch, and inspect YAML jobs")
+    actions = workload.add_subparsers(dest="action", required=True)
+    for name, help_text in [
+        ("validate", "Validate YAML without allocating a GPU"),
+        ("plan", "Stage inputs and review a route without allocating a GPU"),
+        ("run", "Plan and explicitly launch the same fresh quote"),
+    ]:
+        action = actions.add_parser(name, help=help_text)
+        action.add_argument("--file", type=Path, required=True)
+        if name == "run":
+            action.add_argument("--max-cost-usd", required=True)
+            action.add_argument("--idempotency-key", required=True)
+            action.add_argument("--apply", action="store_true")
+            action.add_argument("--yes", action="store_true",
+                                help="Confirm reviewed plan in a noninteractive terminal")
+    for name, help_text in [
+        ("status", "Read job state"),
+        ("wait", "Wait for job output or terminal outcome"),
+        ("outputs", "Download verified output files"),
+        ("cancel", "Request job cancellation"),
+    ]:
+        action = actions.add_parser(name, help=help_text)
+        action.add_argument("job_id")
+        if name == "outputs":
+            action.add_argument("--directory", type=Path, required=True)
+        if name == "cancel":
+            action.add_argument("--apply", action="store_true")
+            action.add_argument("--yes", action="store_true")
+    actions.add_parser("availability", help="Show account planning and execution gates")
+    return parser
+
+
+def _emit(value: Any, output: TextIO) -> None:
+    print(json.dumps(value, indent=2, sort_keys=True, default=str), file=output)
+
+
+def _confirm(message: str, *, yes: bool, input_stream: TextIO,
+             output: TextIO) -> None:
+    if yes:
+        return
+    if not input_stream.isatty():
+        raise GridlineError("Interactive confirmation required; use --yes only after reviewing the plan",
+                            code="confirmation_required")
+    print(f"{message} Type yes to continue: ", end="", flush=True, file=output)
+    if input_stream.readline().strip().lower() != "yes":
+        raise GridlineError("Operation was not approved", code="not_approved")
+
+
+def _cost(value: str) -> Decimal:
+    try:
+        amount = Decimal(value)
+    except InvalidOperation as error:
+        raise ValueError("--max-cost-usd must be a positive amount") from error
+    if not amount.is_finite() or amount <= 0:
+        raise ValueError("--max-cost-usd must be a positive amount")
+    return amount
+
+
+def main(argv: Sequence[str] | None = None, *, input_stream: TextIO = sys.stdin,
+         output: TextIO = sys.stdout, errors: TextIO = sys.stderr) -> int:
+    args = _parser().parse_args(argv)
+    token_file = args.token_file or default_token_file()
+    try:
+        if args.command == "setup":
+            if not args.apply:
+                raise GridlineError("setup creates a scoped token; pass --apply to continue",
+                                    code="apply_required")
+            result = DeviceAuth().setup(args.output_file or token_file,
+                                        name=args.name, announce=lambda line: print(line, file=output))
+            _emit(result, output)
+            return 0
+        if args.command == "auth":
+            auth = DeviceAuth()
+            announce = lambda line: print(line, file=output)
+            if args.token_action == "list":
+                result = auth.tokens(announce=announce)
+            else:
+                if not args.apply:
+                    raise GridlineError("Token revocation requires --apply", code="apply_required")
+                result = auth.revoke(args.token_id, announce=announce)
+            _emit(result, output)
+            return 0
+
+        client = GridlineClient(token_file=args.token_file) if args.token_file else GridlineClient()
+        action = args.action
+        if action == "availability":
+            result = client.availability()
+        elif action == "validate":
+            result = client.validate(args.file)
+        elif action == "plan":
+            result = client.plan(args.file).review
+        elif action == "run":
+            if not args.apply:
+                raise GridlineError("Paid launch requires --apply", code="apply_required")
+            if args.yes and args.profile != "production":
+                raise GridlineError("Noninteractive launch requires --profile production",
+                                    code="target_confirmation_required")
+            amount = _cost(args.max_cost_usd)
+            if not _KEY.fullmatch(args.idempotency_key):
+                raise ValueError("--idempotency-key must contain 1–128 safe characters")
+            planned = client.plan(args.file)
+            _emit(planned.review, output)
+            if planned.quote is None:
+                raise GridlineError("Router abstained; inspect plan coverage", code="plan_abstained")
+            _confirm(f"Launch with approved ceiling ${amount}?", yes=args.yes,
+                     input_stream=input_stream, output=output)
+            result = client.launch(planned, max_cost_usd=amount,
+                                   idempotency_key=args.idempotency_key)
+        elif action == "status":
+            result = client.status(args.job_id)
+        elif action == "wait":
+            result = client.wait(args.job_id)
+        elif action == "outputs":
+            result = client.outputs(args.job_id, args.directory)
+        elif action == "cancel":
+            if not args.apply:
+                raise GridlineError("Cancellation requires --apply", code="apply_required")
+            if args.yes and args.profile != "production":
+                raise GridlineError("Noninteractive cancellation requires --profile production",
+                                    code="target_confirmation_required")
+            _confirm(f"Cancel job {args.job_id}?", yes=args.yes,
+                     input_stream=input_stream, output=output)
+            result = client.cancel(args.job_id)
+        else:
+            raise ValueError("Unknown workload action")
+        _emit(result, output)
+        return 0
+    except LaunchOutcomeUnknown as error:
+        print(f"{error}. Check workload status before any retry.", file=errors)
+    except (GridlineError, ValueError, OSError) as error:
+        print(f"Gridline: {error}", file=errors)
+    return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

gridlinegpu-0.1.3/src/gridlinegpu/cli_auth.py

@@ -0,0 +1,259 @@
+"""Short-lived browser authorization for the pip-installed customer CLI.
+
+The device session stays in memory only. It creates one scoped automation token
+in a private file, then revokes the more privileged device session.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import stat
+import time
+import webbrowser
+from pathlib import Path
+from typing import Any, Callable
+from urllib.error import HTTPError, URLError
+from urllib.parse import quote, urlparse
+from urllib.request import HTTPRedirectHandler, Request, build_opener
+
+from .errors import GridlineError
+
+_TOKEN = re.compile(r"gla_[A-Za-z0-9_-]{43}\Z")
+_AUTH = "/api/cli-auth"
+_MAX_RESPONSE = 65_536
+
+
+class _NoRedirect(HTTPRedirectHandler):
+    def redirect_request(self, request: Request, fp: Any, code: int,
+                         msg: str, headers: Any, url: str) -> None:
+        return None
+
+
+class DeviceAuth:
+    """Exchange a browser device approval for a private routing token file."""
+
+    def __init__(self, *, base_url: str = "https://gridlinegpu.com", opener: Any = None,
+                 sleep: Callable[[float], None] = time.sleep,
+                 now: Callable[[], float] = time.monotonic,
+                 open_browser: Callable[[str], Any] = webbrowser.open) -> None:
+        parsed = urlparse(base_url)
+        if (parsed.scheme != "https" or not parsed.netloc or
+                parsed.path not in ("", "/") or parsed.username or parsed.password or
+                parsed.query or parsed.fragment):
+            raise ValueError("Authentication URL must be an HTTPS origin")
+        self.base_url = base_url.rstrip("/")
+        self.opener = opener or build_opener(_NoRedirect())
+        self.sleep = sleep
+        self.now = now
+        self.open_browser = open_browser
+
+    def setup(self, output_file: str | Path, *, name: str = "python-cli",
+              announce: Callable[[str], None] = print) -> dict[str, Any]:
+        target = _private_target(output_file)
+        if target.exists() or target.is_symlink():
+            raise GridlineError("Token file already exists; refusing to overwrite it",
+                                code="token_file_exists")
+        if not name or len(name) > 64 or any(ord(char) < 32 for char in name):
+            raise ValueError("Token name must contain 1–64 printable characters")
+
+        access_token = self._authorize(announce)
+        result: dict[str, Any] | None = None
+        revoked_session = False
+        try:
+            created = self._request("POST", f"{_AUTH}/automation-tokens", {
+                "name": name, "scopes": ["read", "routing:write"], "expires_in_days": 30,
+            }, access_token=access_token)
+            token = created.get("token")
+            record = created.get("token_record")
+            if (not isinstance(token, str) or not _TOKEN.fullmatch(token) or
+                    not isinstance(record, dict) or not isinstance(record.get("id"), str) or
+                    not isinstance(record.get("expires_at"), str) or
+                    record.get("scopes") != ["read", "routing:write"]):
+                if isinstance(record, dict) and isinstance(record.get("id"), str):
+                    if not self._revoke_token(record["id"], access_token):
+                        announce("Warning: unrecognized token may remain active; review token list.")
+                raise GridlineError("Invalid automation token response",
+                                    code="remote_contract_invalid")
+            try:
+                _write_private_token(target, token)
+            except Exception:
+                if not self._revoke_token(record["id"], access_token):
+                    announce("Warning: unwritten token may remain active; review token list.")
+                raise
+            result = {
+                "tokenFile": str(target), "tokenId": record["id"],
+                "scopes": ["read", "routing:write"], "expiresAt": record["expires_at"],
+            }
+        finally:
+            revoked_session = self._logout(access_token, announce)
+        if result is None:
+            raise GridlineError("Automation token was not created", code="remote_contract_invalid")
+        result["temporarySessionRevoked"] = revoked_session
+        return result
+
+    def tokens(self, *, announce: Callable[[str], None] = print) -> dict[str, Any]:
+        access_token = self._authorize(announce)
+        try:
+            response = self._request("GET", f"{_AUTH}/automation-tokens",
+                                     access_token=access_token)
+            if not isinstance(response.get("tokens"), list):
+                raise GridlineError("Invalid token list response", code="remote_contract_invalid")
+            return response
+        finally:
+            self._logout(access_token, announce)
+
+    def revoke(self, token_id: str, *, announce: Callable[[str], None] = print) -> dict[str, Any]:
+        if not re.fullmatch(r"[0-9a-fA-F-]{36}", token_id):
+            raise ValueError("Token ID must be a UUID")
+        access_token = self._authorize(announce)
+        try:
+            self._request("DELETE", f"{_AUTH}/automation-tokens/{quote(token_id, safe='')}",
+                          access_token=access_token)
+            return {"revoked": True, "tokenId": token_id}
+        finally:
+            self._logout(access_token, announce)
+
+    def _authorize(self, announce: Callable[[str], None]) -> str:
+        challenge = self._request("POST", f"{_AUTH}/device", {
+            "client_name": "Gridline Python CLI", "scopes": ["read", "auth:write"],
+        })
+        device_code = challenge.get("device_code")
+        verification_url = challenge.get("verification_uri_complete")
+        expires_in = challenge.get("expires_in")
+        interval = challenge.get("interval")
+        if (not isinstance(device_code, str) or not device_code.startswith("gld_") or
+                not isinstance(verification_url, str) or
+                type(expires_in) is not int or expires_in < 1 or
+                type(interval) is not int or interval < 1):
+            raise GridlineError("Invalid device authorization response",
+                                code="remote_contract_invalid")
+        url = urlparse(verification_url)
+        origin = urlparse(self.base_url)
+        if ((url.scheme, url.netloc) != (origin.scheme, origin.netloc) or
+                url.username or url.password):
+            raise GridlineError("Unsafe device approval URL", code="unsafe_verification_url")
+
+        announce(f"Approve Gridline access in your browser: {verification_url}")
+        try:
+            self.open_browser(verification_url)
+        except Exception:
+            pass  # Printed URL still supports headless terminals.
+        deadline = self.now() + min(expires_in, 600)
+        access_token: str | None = None
+        while self.now() < deadline:
+            self.sleep(min(max(interval, 1), 10))
+            try:
+                response = self._request("POST", f"{_AUTH}/token", {
+                    "grant_type": "urn:ietf:params:oauth:grant-type:device_code",
+                    "device_code": device_code,
+                })
+            except GridlineError as error:
+                if error.code == "authorization_pending":
+                    continue
+                if error.code in ("access_denied", "expired_token"):
+                    raise GridlineError("Browser authorization was denied or expired",
+                                        code=error.code) from error
+                raise
+            access_token = response.get("access_token")
+            scopes = response.get("scope", "")
+            if (not isinstance(access_token, str) or not access_token.startswith("glm_") or
+                    response.get("token_type") != "Bearer" or
+                    not isinstance(scopes, str) or "auth:write" not in scopes.split()):
+                if isinstance(access_token, str) and access_token.startswith("glm_"):
+                    self._logout(access_token, announce)
+                raise GridlineError("Invalid device token response",
+                                    code="remote_contract_invalid")
+            break
+        if access_token is None:
+            raise GridlineError("Browser authorization expired", code="authorization_expired")
+        return access_token
+
+    def _logout(self, access_token: str, announce: Callable[[str], None]) -> bool:
+        try:
+            self._request("POST", f"{_AUTH}/logout", access_token=access_token)
+            return True
+        except GridlineError:
+            announce("Warning: temporary browser session could not be revoked; it will expire.")
+            return False
+
+    def _revoke_token(self, token_id: str, access_token: str) -> bool:
+        try:
+            self._request("DELETE", f"{_AUTH}/automation-tokens/{quote(token_id, safe='')}",
+                          access_token=access_token)
+            return True
+        except GridlineError:
+            return False
+
+    def _request(self, method: str, path: str, body: dict[str, Any] | None = None,
+                 *, access_token: str | None = None) -> dict[str, Any]:
+        headers = {"Accept": "application/json", "User-Agent": "GridlinePythonCLI/1"}
+        if access_token:
+            headers["Authorization"] = f"Bearer {access_token}"
+        data = None if body is None else json.dumps(body, separators=(",", ":")).encode()
+        if data is not None:
+            headers["Content-Type"] = "application/json"
+        request = Request(self.base_url + path, data=data, headers=headers, method=method)
+        try:
+            with self.opener.open(request, timeout=30) as response:
+                raw = response.read(_MAX_RESPONSE + 1)
+        except HTTPError as error:
+            try:
+                value = json.loads(error.read(16_384))
+            except (ValueError, UnicodeDecodeError):
+                value = {}
+            code = value.get("error") if isinstance(value, dict) else None
+            raise GridlineError("Gridline authentication request failed",
+                                code=code if isinstance(code, str) else "auth_http_error",
+                                status=error.code) from error
+        except URLError as error:
+            raise GridlineError("Authentication network request failed",
+                                code="network_error") from error
+        if len(raw) > _MAX_RESPONSE:
+            raise GridlineError("Authentication response too large", code="response_too_large")
+        if not raw:
+            return {}
+        try:
+            value = json.loads(raw)
+        except (ValueError, UnicodeDecodeError) as error:
+            raise GridlineError("Invalid authentication response", code="remote_contract_invalid") from error
+        if not isinstance(value, dict):
+            raise GridlineError("Invalid authentication response", code="remote_contract_invalid")
+        return value
+
+
+def default_token_file() -> Path:
+    return Path(os.environ.get("GRIDLINE_API_TOKEN_FILE") or
+                Path.home() / ".config" / "gridline" / "python-token").expanduser()
+
+
+def _private_target(value: str | Path) -> Path:
+    if os.name != "posix":
+        raise GridlineError("Browser setup requires POSIX private-file permissions",
+                            code="unsupported_platform")
+    target = Path(value).expanduser().absolute()
+    parent = target.parent
+    parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+    info = parent.lstat()
+    if (not stat.S_ISDIR(info.st_mode) or info.st_uid != os.getuid() or
+            info.st_mode & 0o077):
+        raise GridlineError("Token directory must be owned by you and mode 0700",
+                            code="token_directory_invalid")
+    return target
+
+
+def _write_private_token(target: Path, token: str) -> None:
+    flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL | getattr(os, "O_NOFOLLOW", 0)
+    descriptor = os.open(target, flags, 0o600)
+    try:
+        os.fchmod(descriptor, 0o600)
+        with os.fdopen(descriptor, "w", encoding="utf-8", closefd=False) as handle:
+            handle.write(token + "\n")
+            handle.flush()
+        os.fsync(descriptor)
+    except Exception:
+        target.unlink(missing_ok=True)
+        raise
+    finally:
+        os.close(descriptor)

{gridlinegpu-0.1.2 → gridlinegpu-0.1.3}/src/gridlinegpu/client.py

@@ -59,8 +59,8 @@ class PlannedWorkload:
 class GridlineClient:
     """Use a scoped Gridline automation token; never put it in YAML or source code.
 
-    Create a token with ``gridline auth token create`` and pass its 0600 file path.
-    The SDK also reads ``GRIDLINE_API_TOKEN_FILE`` or ``GRIDLINE_API_TOKEN``.
+    Create a token with ``gridline setup --apply``. The SDK reads its private
+    default file, ``GRIDLINE_API_TOKEN_FILE``, or ``GRIDLINE_API_TOKEN``.
     """
 
     def __init__(
@@ -77,6 +77,10 @@ class GridlineClient:
         if not token and not token_file:
             token_file = os.getenv("GRIDLINE_API_TOKEN_FILE")
             token = os.getenv("GRIDLINE_API_TOKEN") if not token_file else None
+            if not token and not token_file:
+                installed = Path.home() / ".config" / "gridline" / "python-token"
+                if installed.exists():
+                    token_file = installed
         if not token and not token_file:
             raise ValueError("Set GRIDLINE_API_TOKEN_FILE or pass token_file")
         parsed = urlparse(base_url)

{gridlinegpu-0.1.2 → gridlinegpu-0.1.3}/src/gridlinegpu.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gridlinegpu
-Version: 0.1.2
+Version: 0.1.3
 Summary: Python client for Gridline YAML workload routing
 Author: Gridline GPU
 License: Proprietary
@@ -17,21 +17,21 @@ Requires-Dist: PyYAML<7,>=6.0.2
 
 Submit one YAML workload through Gridline's authenticated API. The Python client stages
 files referenced by YAML, returns a route for review, then launches only that exact
-fresh plan when you supply a cost ceiling and idempotency key.
+fresh plan when you supply a cost ceiling and idempotency key. The package also installs
+the `gridline` command in the same Python environment on macOS and Linux.
 
 ## Install
 
 ```sh
-python -m pip install 'gridlinegpu>=0.1.2,<0.2'
+python -m pip install 'gridlinegpu>=0.1.3,<0.2'
 ```
 
-Create a scoped token using the Gridline CLI after browser sign-in. The token stays in a
-private file; do not paste it into source code or an AI chat.
+Run browser setup once. It creates a 30-day scoped token in a private file, attempts to
+revoke the temporary browser session, and never prints the token. Keep the token file out of
+source control and AI chats.
 
 ```sh
-gridline --profile production auth login --apply
-gridline --profile production auth token create --name python-workloads --scopes read,routing:write --output-file "$HOME/.config/gridline/python-token" --apply
-export GRIDLINE_API_TOKEN_FILE="$HOME/.config/gridline/python-token"
+gridline setup --apply
 ```
 
 Use a YAML file beside its referenced inputs. Task, model, engine, providers, output,
@@ -53,6 +53,32 @@ print(ready["job"]["outputs"], ready["job"]["outcome"])
 print(client.outputs(job_id, "results"))
 ```
 
+The same installed package supports a terminal flow:
+
+```sh
+gridline workload validate --file workload.yaml
+gridline workload plan --file workload.yaml
+gridline workload run --file workload.yaml --apply --max-cost-usd 5 \
+  --idempotency-key my-job-2026-09-27
+gridline workload status JOB_ID
+gridline workload outputs JOB_ID --directory results
+```
+
+The paid `run` command plans a fresh quote, prints it, and asks for explicit confirmation.
+For an approved noninteractive run, add `--yes` and explicit `--profile production`
+alongside `--apply`, a cost ceiling, and an idempotency key. Cancellation similarly
+requires `--apply` and confirmation. A custom
+token path may be passed as global `--token-file` or through `GRIDLINE_API_TOKEN_FILE`.
+Workload commands also honor `GRIDLINE_API_TOKEN` when no token file is selected.
+The existing standalone Bun CLI remains available during transition; check which
+`gridline` executable your shell selects when both are installed. Run
+`python -m gridlinegpu` to choose this package's command explicitly.
+Use `gridline auth token list` to find a token ID and
+`gridline auth token revoke TOKEN_ID --apply` to revoke it. Both require fresh browser
+approval; the Python CLI never stores a privileged refresh token.
+After revoking a token, remove its local file before running setup again; setup never
+overwrites an existing file.
+
 `plan()` stages input bytes but does not allocate a GPU. `launch()` never silently
 changes a plan or retries an ambiguous paid request. If launch outcome is unknown,
 inspect `LaunchOutcomeUnknown.workload_id` with the same idempotency key; do not use a

{gridlinegpu-0.1.2 → gridlinegpu-0.1.3}/src/gridlinegpu.egg-info/SOURCES.txt

@@ -1,11 +1,17 @@
 README.md
 pyproject.toml
 src/gridlinegpu/__init__.py
+src/gridlinegpu/__main__.py
+src/gridlinegpu/cli.py
+src/gridlinegpu/cli_auth.py
 src/gridlinegpu/client.py
 src/gridlinegpu/errors.py
 src/gridlinegpu.egg-info/PKG-INFO
 src/gridlinegpu.egg-info/SOURCES.txt
 src/gridlinegpu.egg-info/dependency_links.txt
+src/gridlinegpu.egg-info/entry_points.txt
 src/gridlinegpu.egg-info/requires.txt
 src/gridlinegpu.egg-info/top_level.txt
+tests/test_cli.py
+tests/test_cli_auth.py
 tests/test_client.py

gridlinegpu-0.1.3/src/gridlinegpu.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+gridline = gridlinegpu.cli:main

gridlinegpu-0.1.3/tests/test_cli.py

@@ -0,0 +1,91 @@
+import io
+import unittest
+from unittest.mock import MagicMock, patch
+
+from gridlinegpu.cli import main
+
+
+class CliTest(unittest.TestCase):
+    def setUp(self):
+        self.output = io.StringIO()
+        self.errors = io.StringIO()
+        self.input = io.StringIO()
+
+    def invoke(self, *arguments):
+        return main(arguments, input_stream=self.input, output=self.output, errors=self.errors)
+
+    @patch("gridlinegpu.cli.GridlineClient")
+    def test_paid_run_requires_apply_and_does_not_plan(self, client_type):
+        code = self.invoke("workload", "run", "--file", "workload.yaml",
+                           "--max-cost-usd", "5", "--idempotency-key", "one")
+        self.assertEqual(code, 1)
+        client_type.return_value.plan.assert_not_called()
+        self.assertIn("--apply", self.errors.getvalue())
+
+    @patch("gridlinegpu.cli.GridlineClient")
+    def test_noninteractive_run_refuses_launch_without_yes(self, client_type):
+        planned = MagicMock()
+        planned.review = {"result": {"status": "planned"}}
+        planned.quote = {"maximumTotalMicros": 5_000_000}
+        client_type.return_value.plan.return_value = planned
+        code = self.invoke("workload", "run", "--file", "workload.yaml", "--apply",
+                           "--max-cost-usd", "5", "--idempotency-key", "one")
+        self.assertEqual(code, 1)
+        client_type.return_value.launch.assert_not_called()
+        self.assertIn("confirmation", self.errors.getvalue())
+
+    @patch("gridlinegpu.cli.GridlineClient")
+    def test_yes_requires_explicit_production_target(self, client_type):
+        code = self.invoke("workload", "run", "--file", "workload.yaml", "--apply",
+                           "--yes", "--max-cost-usd", "5", "--idempotency-key", "one")
+        self.assertEqual(code, 1)
+        client_type.return_value.plan.assert_not_called()
+        self.assertIn("--profile production", self.errors.getvalue())
+
+    @patch("gridlinegpu.cli.GridlineClient")
+    def test_approved_run_passes_fresh_plan_and_cost_to_sdk(self, client_type):
+        planned = MagicMock()
+        planned.review = {"result": {"status": "planned"}}
+        planned.quote = {"maximumTotalMicros": 5_000_000}
+        client_type.return_value.plan.return_value = planned
+        client_type.return_value.launch.return_value = {"jobId": "job_1"}
+        code = self.invoke("--profile", "production", "workload", "run", "--file", "workload.yaml", "--apply",
+                           "--yes", "--max-cost-usd", "5", "--idempotency-key", "one")
+        self.assertEqual(code, 0)
+        client_type.return_value.launch.assert_called_once()
+        self.assertIs(client_type.return_value.launch.call_args.args[0], planned)
+        self.assertEqual(client_type.return_value.launch.call_args.kwargs["idempotency_key"], "one")
+        self.assertIn('"jobId": "job_1"', self.output.getvalue())
+
+    @patch("gridlinegpu.cli.GridlineClient")
+    def test_router_abstention_cannot_launch_even_with_yes(self, client_type):
+        planned = MagicMock()
+        planned.review = {"result": {"status": "abstained"}}
+        planned.quote = None
+        client_type.return_value.plan.return_value = planned
+        code = self.invoke("--profile", "production", "workload", "run", "--file", "workload.yaml", "--apply",
+                           "--yes", "--max-cost-usd", "5", "--idempotency-key", "one")
+        self.assertEqual(code, 1)
+        client_type.return_value.launch.assert_not_called()
+        self.assertIn("abstained", self.errors.getvalue())
+
+    @patch("gridlinegpu.cli.GridlineClient")
+    def test_cancel_requires_apply(self, client_type):
+        code = self.invoke("workload", "cancel", "job_1")
+        self.assertEqual(code, 1)
+        client_type.return_value.cancel.assert_not_called()
+
+    @patch("gridlinegpu.cli.GridlineClient")
+    def test_workload_uses_sdk_token_precedence(self, client_type):
+        self.assertEqual(self.invoke("workload", "availability"), 0)
+        client_type.assert_called_with()
+
+    @patch("gridlinegpu.cli.GridlineClient")
+    def test_explicit_token_file_overrides_sdk_environment(self, client_type):
+        self.assertEqual(self.invoke("--token-file", "/tmp/gridline-token",
+                                     "workload", "availability"), 0)
+        self.assertEqual(str(client_type.call_args.kwargs["token_file"]), "/tmp/gridline-token")
+
+
+if __name__ == "__main__":
+    unittest.main()

gridlinegpu-0.1.3/tests/test_cli_auth.py

@@ -0,0 +1,132 @@
+import io
+import json
+import stat
+import tempfile
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+from urllib.error import HTTPError
+
+from gridlinegpu.cli_auth import DeviceAuth
+from gridlinegpu.errors import GridlineError
+
+
+TOKEN = "gla_" + "a" * 43
+TOKEN_ID = "12345678-1234-1234-1234-123456789abc"
+
+
+class Response(io.BytesIO):
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *_):
+        self.close()
+
+
+class FakeOpener:
+    def __init__(self, *, approval_url="https://gridlinegpu.com/cli/auth?user_code=ABCD"):
+        self.calls = []
+        self.pending = True
+        self.approval_url = approval_url
+        self.created_scopes = ["read", "routing:write"]
+
+    def open(self, request, timeout):
+        path = request.full_url.removeprefix("https://gridlinegpu.com")
+        self.calls.append((request.get_method(), path, request.headers, request.data))
+        if path == "/api/cli-auth/device":
+            result = {"device_code": "gld_private", "verification_uri_complete": self.approval_url,
+                      "expires_in": 600, "interval": 1}
+        elif path == "/api/cli-auth/token":
+            if self.pending:
+                self.pending = False
+                raise HTTPError(request.full_url, 400, "pending", {},
+                                io.BytesIO(b'{"error":"authorization_pending"}'))
+            result = {"access_token": "glm_private", "token_type": "Bearer",
+                      "scope": "read auth:write"}
+        elif path == "/api/cli-auth/automation-tokens" and request.get_method() == "POST":
+            result = {"token": TOKEN, "token_record": {"id": TOKEN_ID,
+                      "expires_at": "2026-10-28T00:00:00Z",
+                      "scopes": self.created_scopes}}
+        elif path == "/api/cli-auth/automation-tokens" and request.get_method() == "GET":
+            result = {"tokens": [{"id": TOKEN_ID, "name": "python-cli"}]}
+        elif path in ("/api/cli-auth/logout", f"/api/cli-auth/automation-tokens/{TOKEN_ID}"):
+            return Response(b"")
+        else:
+            raise AssertionError(f"Unexpected request: {path}")
+        return Response(json.dumps(result).encode())
+
+
+class DeviceAuthTest(unittest.TestCase):
+    def setUp(self):
+        folder = tempfile.TemporaryDirectory()
+        self.addCleanup(folder.cleanup)
+        self.target = Path(folder.name) / "gridline" / "python-token"
+        self.opener = FakeOpener()
+        self.clock = 0
+        self.browser_urls = []
+        self.messages = []
+        self.auth = DeviceAuth(opener=self.opener, now=lambda: self.clock,
+                               sleep=self.advance, open_browser=self.browser_urls.append)
+
+    def advance(self, seconds):
+        self.clock += seconds
+
+    def test_setup_creates_private_token_and_revokes_device_session(self):
+        result = self.auth.setup(self.target, announce=self.messages.append)
+        self.assertEqual(self.target.read_text().strip(), TOKEN)
+        self.assertEqual(stat.S_IMODE(self.target.stat().st_mode), 0o600)
+        self.assertEqual(stat.S_IMODE(self.target.parent.stat().st_mode), 0o700)
+        self.assertEqual(result["tokenId"], TOKEN_ID)
+        self.assertTrue(result["temporarySessionRevoked"])
+        self.assertEqual(len(self.browser_urls), 1)
+        self.assertFalse(any(TOKEN in message or "glm_private" in message for message in self.messages))
+        device_body = json.loads(self.opener.calls[0][3])
+        created_body = json.loads(next(data for method, path, _, data in self.opener.calls
+                                       if method == "POST" and path == "/api/cli-auth/automation-tokens"))
+        self.assertEqual(device_body["scopes"], ["read", "auth:write"])
+        self.assertEqual(created_body["scopes"], ["read", "routing:write"])
+        self.assertEqual(self.opener.calls[-1][:2], ("POST", "/api/cli-auth/logout"))
+
+    def test_existing_token_file_is_never_overwritten_or_networked(self):
+        self.target.parent.mkdir(mode=0o700)
+        self.target.write_text("existing")
+        with self.assertRaisesRegex(GridlineError, "already exists"):
+            self.auth.setup(self.target)
+        self.assertEqual(self.target.read_text(), "existing")
+        self.assertEqual(self.opener.calls, [])
+
+    def test_rejects_cross_origin_browser_approval(self):
+        self.opener.approval_url = "https://other.example/cli/auth?user_code=ABCD"
+        with self.assertRaisesRegex(GridlineError, "Unsafe"):
+            self.auth.setup(self.target)
+        self.assertEqual(self.browser_urls, [])
+        self.assertFalse(self.target.exists())
+
+    def test_failed_private_write_requests_token_revocation(self):
+        with patch("gridlinegpu.cli_auth._write_private_token", side_effect=OSError("disk full")):
+            with self.assertRaises(OSError):
+                self.auth.setup(self.target, announce=self.messages.append)
+        paths = [path for _, path, _, _ in self.opener.calls]
+        self.assertIn(f"/api/cli-auth/automation-tokens/{TOKEN_ID}", paths)
+        self.assertEqual(paths[-1], "/api/cli-auth/logout")
+        self.assertFalse(self.target.exists())
+
+    def test_unexpected_token_scopes_are_revoked_before_write(self):
+        self.opener.created_scopes = ["read", "routing:write", "auth:write"]
+        with self.assertRaisesRegex(GridlineError, "Invalid automation token response"):
+            self.auth.setup(self.target, announce=self.messages.append)
+        paths = [path for _, path, _, _ in self.opener.calls]
+        self.assertIn(f"/api/cli-auth/automation-tokens/{TOKEN_ID}", paths)
+        self.assertFalse(self.target.exists())
+
+    def test_token_can_be_listed_and_revoked_with_fresh_browser_approval(self):
+        self.assertEqual(self.auth.tokens(announce=self.messages.append)["tokens"][0]["id"], TOKEN_ID)
+        result = self.auth.revoke(TOKEN_ID, announce=self.messages.append)
+        self.assertTrue(result["revoked"])
+        self.assertIn(("DELETE", f"/api/cli-auth/automation-tokens/{TOKEN_ID}"),
+                      [(method, path) for method, path, _, _ in self.opener.calls])
+        self.assertEqual(sum(path == "/api/cli-auth/logout" for _, path, _, _ in self.opener.calls), 2)
+
+
+if __name__ == "__main__":
+    unittest.main()

{gridlinegpu-0.1.2 → gridlinegpu-0.1.3}/tests/test_client.py

@@ -1,9 +1,11 @@
 import io
 import json
+import os
 import tempfile
 import unittest
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
+from unittest.mock import patch
 
 from gridlinegpu import GridlineClient, GridlineError
 
@@ -133,6 +135,16 @@ class ClientTest(unittest.TestCase):
         self.assertEqual(next(value for name, value in headers.items() if name.lower() == "user-agent"),
                          "GridlinePythonSDK/1")
 
+    def test_uses_private_token_created_by_pip_installed_cli(self):
+        token_file = Path(self.folder.name) / ".config" / "gridline" / "python-token"
+        token_file.parent.mkdir(parents=True)
+        token_file.write_text(TOKEN + "\n")
+        token_file.chmod(0o600)
+        with patch.dict(os.environ, {"GRIDLINE_API_TOKEN_FILE": "", "GRIDLINE_API_TOKEN": ""}):
+            with patch.object(Path, "home", return_value=Path(self.folder.name)):
+                client = GridlineClient(opener=self.opener)
+                self.assertEqual(client._read_token(), TOKEN)
+
     def test_wait_returns_when_finite_outputs_are_complete_before_billing(self):
         self.opener.job = {"jobId": "job_1", "outcome": "pending", "execution": {"mode": "finite"},
                            "outputs": "complete", "cleanup": "pending", "billing": "pending"}

gridlinegpu-0.1.2/README.md

@@ -1,47 +0,0 @@
-# Gridline Python SDK
-
-Submit one YAML workload through Gridline's authenticated API. The Python client stages
-files referenced by YAML, returns a route for review, then launches only that exact
-fresh plan when you supply a cost ceiling and idempotency key.
-
-## Install
-
-```sh
-python -m pip install 'gridlinegpu>=0.1.2,<0.2'
-```
-
-Create a scoped token using the Gridline CLI after browser sign-in. The token stays in a
-private file; do not paste it into source code or an AI chat.
-
-```sh
-gridline --profile production auth login --apply
-gridline --profile production auth token create --name python-workloads --scopes read,routing:write --output-file "$HOME/.config/gridline/python-token" --apply
-export GRIDLINE_API_TOKEN_FILE="$HOME/.config/gridline/python-token"
-```
-
-Use a YAML file beside its referenced inputs. Task, model, engine, providers, output,
-budget, and deadline belong in YAML rather than Python arguments.
-Current hosted artifact limits are 40 MiB per local input and 8 MiB per output.
-
-```python
-from gridlinegpu import GridlineClient
-
-client = GridlineClient()
-plan = client.plan("workload.yaml")
-print(plan.review)  # Check selected GPU, exclusions, estimate, and maximum.
-
-# Launch only after reviewing the fresh plan and accepting its maximum spend.
-launch = client.launch(plan, max_cost_usd="5.00", idempotency_key="my-job-2026-09-27")
-job_id = launch["jobId"]
-ready = client.wait(job_id, timeout=7200)
-print(ready["job"]["outputs"], ready["job"]["outcome"])
-print(client.outputs(job_id, "results"))
-```
-
-`plan()` stages input bytes but does not allocate a GPU. `launch()` never silently
-changes a plan or retries an ambiguous paid request. If launch outcome is unknown,
-inspect `LaunchOutcomeUnknown.workload_id` with the same idempotency key; do not use a
-new key. `outputs()` verifies byte count and SHA-256 before creating private files.
-Cancellation requests stop; cleanup and final provider billing can remain pending.
-For finite jobs, `wait()` returns when outputs are complete, even if cleanup and billing
-leave `outcome` pending. Check `status()` later for final settlement.