hivekit 0.8.2__tar.gz → 0.9.1__tar.gz

{hivekit-0.8.2 → hivekit-0.9.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hivekit
-Version: 0.8.2
+Version: 0.9.1
 Summary: Toolkits for using hive agents, including CLI and SDK.
 License: 
                                          Apache License

{hivekit-0.8.2 → hivekit-0.9.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "hivekit"
-version = "0.8.2"
+version = "0.9.1"
 description = "Toolkits for using hive agents, including CLI and SDK."
 readme = "README.md"
 requires-python = ">=3.12"

hivekit-0.9.1/src/cli/auth/device_flow.py

@@ -0,0 +1,204 @@
+# Copyright (C) 2026 Hiverge
+#
+# SPDX-License-Identifier: Apache-2.0
+
+"""
+OIDC device authorization login flow (RFC 8628).
+
+Used on headless machines (such as VMs) where no browser is
+available to receive a redirect. The user is shown a URL containing a code
+and the CLI polls the token endpoint until they have authorized.
+"""
+
+import logging
+import time
+from typing import Any, Callable, Dict, Optional, Protocol
+
+import requests
+from rich.console import Console
+
+from cli.utils.url_utils import build_oidc_endpoints
+
+logger = logging.getLogger("hivekit")
+
+_OIDC_CLIENT_ID = "hiverge"
+_SCOPE = "openid offline_access"
+_DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code"
+_REQUEST_TIMEOUT = 30.0
+
+# RFC 8628 section 3.5: on a slow_down response the client must increase the
+# polling interval by five seconds.
+_SLOW_DOWN_INCREMENT = 5
+
+
+class DeviceAuthorizationError(Exception):
+    """
+    Raised when the device authorization flow fails or is denied.
+    """
+
+
+class _PostCallable(Protocol):
+    """
+    Protocol matching the signature of `requests.post` for dependency injection.
+    """
+
+    def __call__(
+        self,
+        url: str,
+        data: Dict[str, str],
+        timeout: float,
+        verify: bool,
+    ) -> requests.Response:
+        """
+        Make an HTTP POST request and return the response.
+        """
+
+
+class OidcDeviceLoginFlow:
+    """
+    Orchestrates the OIDC device authorization login flow.
+    """
+
+    def __init__(
+        self,
+        identity_base_url: str,
+        organization_id: str,
+        post: _PostCallable = requests.post,
+        sleep: Callable[[float], None] = time.sleep,
+        console: Optional[Console] = None,
+        insecure: bool = False,
+    ) -> None:
+        """
+        Initialize the device authorization login flow.
+
+        Args:
+            identity_base_url: The base URL for the identity provider.
+            organization_id: The organization (Keycloak realm) to authenticate against.
+            post: Callable used to make HTTP POST requests (injected for testability).
+            sleep: Callable used to wait between polls (injected for testability).
+            console: Rich console for output (defaults to a new Console).
+            insecure: If True, disable SSL certificate verification on requests.
+        """
+        self._identity_base_url = identity_base_url
+        self._organization_id = organization_id
+        self._post = post
+        self._sleep = sleep
+        self._console = console or Console()
+        self._insecure = insecure
+
+    def login(self) -> Dict[str, Any]:
+        """
+        Run the full device authorization login flow.
+
+        Requests a device code, prompts the user to visit the verification URL
+        and enter the user code, then polls the token endpoint until the user
+        authorizes the device and returns the token dict.
+
+        Raises:
+            DeviceAuthorizationError: If the request is denied, the device code
+                expires, or the identity provider returns an unexpected error.
+        """
+        endpoints = build_oidc_endpoints(
+            identity_base_url=self._identity_base_url,
+            organization_id=self._organization_id,
+        )
+        authorization = self._request_device_code(
+            device_authorization_endpoint=endpoints["device_authorization_endpoint"],
+        )
+        self._display_instructions(authorization=authorization)
+        return self._poll_for_token(
+            token_endpoint=endpoints["token_endpoint"],
+            authorization=authorization,
+        )
+
+    def _request_device_code(self, device_authorization_endpoint: str) -> Dict[str, Any]:
+        """
+        Request a device and user code from the device authorization endpoint.
+        """
+        response = self._post(
+            url=device_authorization_endpoint,
+            data={"client_id": _OIDC_CLIENT_ID, "scope": _SCOPE},
+            timeout=_REQUEST_TIMEOUT,
+            verify=not self._insecure,
+        )
+        if not response.ok:
+            raise DeviceAuthorizationError(
+                f"Device authorization request to {device_authorization_endpoint} failed "
+                f"with status {response.status_code}: {response.text}"
+            )
+        return response.json()
+
+    def _display_instructions(self, authorization: Dict[str, Any]) -> None:
+        """
+        Print the verification URL and user code with instructions for the user.
+
+        When the identity provider supplies ``verification_uri_complete`` the URL
+        embeds the user code, so the user only needs to visit it and the code is
+        not shown separately. Otherwise the user is asked to enter the code on
+        the plain verification page.
+        """
+        verification_uri_complete = authorization.get("verification_uri_complete")
+        if verification_uri_complete is not None:
+            self._console.print(
+                "\n[yellow]To log in, visit the following URL on any device:[/yellow]"
+            )
+            self._console.print(
+                verification_uri_complete,
+                style=f"link {verification_uri_complete}",
+                soft_wrap=True,
+            )
+        else:
+            verification_uri = authorization["verification_uri"]
+            self._console.print(
+                "\n[yellow]To log in, visit the following URL on any device and enter the "
+                "code below:[/yellow]"
+            )
+            self._console.print(verification_uri, style=f"link {verification_uri}", soft_wrap=True)
+            self._console.print(f"[bold]Code:[/bold] {authorization['user_code']}")
+
+    def _poll_for_token(self, token_endpoint: str, authorization: Dict[str, Any]) -> Dict[str, Any]:
+        """
+        Poll the token endpoint until the user authorizes the device.
+        """
+        device_code = authorization["device_code"]
+        interval = authorization.get("interval", 5)
+        while True:
+            self._sleep(interval)
+            response = self._post(
+                url=token_endpoint,
+                data={
+                    "grant_type": _DEVICE_CODE_GRANT_TYPE,
+                    "device_code": device_code,
+                    "client_id": _OIDC_CLIENT_ID,
+                },
+                timeout=_REQUEST_TIMEOUT,
+                verify=not self._insecure,
+            )
+            if response.ok:
+                return response.json()
+            interval = self._handle_poll_error(response=response, interval=interval)
+
+    def _handle_poll_error(self, response: requests.Response, interval: int) -> int:
+        """
+        Interpret an error response while polling and return the next interval.
+
+        Returns the (possibly increased) polling interval when the user has not
+        yet authorized. Raises when the authorization is denied, has expired, or
+        the error is otherwise unrecoverable.
+        """
+        error = response.json().get("error")
+        if error == "authorization_pending":
+            return interval
+        if error == "slow_down":
+            return interval + _SLOW_DOWN_INCREMENT
+        if error == "access_denied":
+            raise DeviceAuthorizationError(
+                "Access was denied. Please contact your Hiverge administrator."
+            )
+        if error == "expired_token":
+            raise DeviceAuthorizationError(
+                "The login code expired before it was used. Please run `hive login` again."
+            )
+        raise DeviceAuthorizationError(
+            f"Device authorization failed with status {response.status_code}: {response.text}"
+        )

{hivekit-0.8.2 → hivekit-0.9.1}/src/cli/auth/session_manager.py

@@ -11,12 +11,13 @@ and re-authenticating when tokens expire.
 
 import logging
 import os
-from typing import Any, Dict
+from typing import Any, Dict, Protocol
 
 from authlib.integrations.requests_client import OAuth2Session
 
 from cli.auth.auth_utils import get_machine_id
 from cli.auth.credential_store import CredentialStore, create_credential_store
+from cli.auth.device_flow import OidcDeviceLoginFlow
 from cli.auth.oidc_flow import OidcLoginFlow
 from cli.utils.config_paths import get_config_dir
 from cli.utils.url_utils import build_oidc_endpoints, derive_identity_base_url
@@ -26,6 +27,17 @@ logger = logging.getLogger("hivekit")
 _OIDC_CLIENT_ID = "hiverge"
 
 
+class LoginFlow(Protocol):
+    """
+    Interface for an interactive OIDC login flow that yields a token.
+    """
+
+    def login(self) -> Dict[str, Any]:
+        """
+        Run the login flow and return the resulting token dict.
+        """
+
+
 class OidcSessionManager:
     """
     Creates and refreshes OAuth2 sessions using OIDC.
@@ -35,7 +47,7 @@ class OidcSessionManager:
         self,
         organization_id: str,
         credential_store: CredentialStore,
-        login_flow: OidcLoginFlow,
+        login_flow: LoginFlow,
         token_endpoint: str,
         insecure: bool = False,
     ) -> None:
@@ -114,6 +126,7 @@ def create_session_manager(
     organization_id: str,
     base_url: str,
     insecure: bool = False,
+    use_device_flow: bool = False,
 ) -> OidcSessionManager:
     """
     Create an OidcSessionManager with all required dependencies.
@@ -125,6 +138,8 @@ def create_session_manager(
         organization_id: The organization (Keycloak realm) to authenticate against.
         base_url: The API base URL, used to derive the identity provider URL.
         insecure: If True, disable SSL certificate verification.
+        use_device_flow: If True, use the device authorization flow (for headless
+            machines) instead of the browser-based flow.
 
     Returns:
         A configured OidcSessionManager.
@@ -134,10 +149,11 @@ def create_session_manager(
         clients_dir=os.path.join(get_config_dir(), "clients"),
         machine_id_func=get_machine_id,
     )
-    login_flow = OidcLoginFlow(
+    login_flow = _create_login_flow(
         identity_base_url=identity_base_url,
         organization_id=organization_id,
         insecure=insecure,
+        use_device_flow=use_device_flow,
     )
     endpoints = build_oidc_endpoints(
         identity_base_url=identity_base_url,
@@ -150,3 +166,25 @@ def create_session_manager(
         token_endpoint=endpoints["token_endpoint"],
         insecure=insecure,
     )
+
+
+def _create_login_flow(
+    identity_base_url: str,
+    organization_id: str,
+    insecure: bool,
+    use_device_flow: bool,
+) -> LoginFlow:
+    """
+    Create the browser-based or device authorization login flow.
+    """
+    if use_device_flow:
+        return OidcDeviceLoginFlow(
+            identity_base_url=identity_base_url,
+            organization_id=organization_id,
+            insecure=insecure,
+        )
+    return OidcLoginFlow(
+        identity_base_url=identity_base_url,
+        organization_id=organization_id,
+        insecure=insecure,
+    )

{hivekit-0.8.2 → hivekit-0.9.1}/src/cli/config.py

@@ -30,12 +30,30 @@ class BaseModel(pydantic.BaseModel):
     model_config = ConfigDict(extra="forbid", coerce_numbers_to_str=True)
 
 
-# Kubernetes caps DNS labels and label values at 63 bytes. The operator derives
-# object names/labels by appending suffixes to the experiment name (the longest
-# is "-coordinator"), so reserve that headroom to keep the derived names valid.
+# Pods created by a Job or Deployment are named "<prefix><5 random chars>".
+# Our pod prefixes are:
+#   coordinator: "<name>-coordinator-"
+#   sandbox:     "<name>-sandbox-<rs-hash>-"
+#
+# The AWS network policy agent identifies a pod by its name minus the last
+# '-' segment. If the coordinator and sandbox pods end up with the same
+# identity, the coordinator will inherit the sandbox's internet-only
+# egress policy (so it cannot reach any in-cluster service, like the database).
+# Reserving room for "-coordinator-", the longer of the two, keeps every pod's
+# role intact.
+#
+# For example, a 51-char <name> leaves only 7 chars for the role:
+#   coordinator: "<name>-coordi" + "6sftc"  -> identity "<name>"
+#   sandbox:     "<name>-sandbo" + "4nxt7"  -> identity "<name>"  (same, broken)
+# while a 45-char <name> keeps both roles:
+#   coordinator: "<name>-coordinator-" + "abcde"  -> identity "<name>-coordinator"
+#   sandbox:     "<name>-sandbox-69df" + "abcde"  -> identity "<name>-sandbox"
 K8S_LABEL_MAX_LENGTH = 63
-RESERVED_NAME_SUFFIX_LENGTH = len("-coordinator")
-MAX_EXPERIMENT_NAME_LENGTH = K8S_LABEL_MAX_LENGTH - RESERVED_NAME_SUFFIX_LENGTH
+K8S_GENERATED_NAME_SUFFIX_LENGTH = 5
+RESERVED_NAME_SUFFIX_LENGTH = len("-coordinator-")
+MAX_EXPERIMENT_NAME_LENGTH = (
+    K8S_LABEL_MAX_LENGTH - K8S_GENERATED_NAME_SUFFIX_LENGTH - RESERVED_NAME_SUFFIX_LENGTH
+)
 # A name ending in '-' gets a random uniqueness suffix appended (see
 # unique_suffix), which eats into the budget the user actually controls (their
 # typed base name).
@@ -77,11 +95,14 @@ KNOWN_MODELS = frozenset(
         "anthropic.claude-opus-4-7",
         "anthropic.claude-opus-4-8",
         "anthropic.claude-opus-5",
+        "anthropic.claude-opus-5-5",
         "anthropic.claude-sonnet-4-6",
         "anthropic.claude-sonnet-5",
         "moonshotai.kimi-k2.5",
         "nvidia.nemotron-super-3-120b",
         "openai.gpt-6-astra",
+        "openai.gpt-6-luna",
+        "openai.gpt-6-sol",
         "openai.gpt-5.6-luna",
         "openai.gpt-5.6-sol",
         "openai.gpt-5.6-terra",
@@ -244,10 +265,6 @@ class SandboxConfig(BaseModel):
 
 
 class PromptConfig(BaseModel):
-    enable_evolution: bool = Field(
-        default=False,
-        description="Whether to enable evolution for the experiment. Default to False.",
-    )
     context: Optional[str] = Field(
         default=None,
         description="Some useful experiment-specific context to provide to the Hive.",
@@ -266,6 +283,20 @@ class PromptConfig(BaseModel):
         ),
     )
 
+    @model_validator(mode="before")
+    @classmethod
+    def drop_enable_evolution(cls, values):
+        """Accept and ignore the removed enable_evolution field without mutating the input."""
+        if not isinstance(values, dict) or "enable_evolution" not in values:
+            return values
+        values = dict(values)
+        values.pop("enable_evolution")
+        logger.warning(
+            "prompt.enable_evolution is deprecated and has no effect. "
+            "Remove it from your config to silence this warning."
+        )
+        return values
+
     @model_validator(mode="before")
     @classmethod
     def migrate_arxiv_ids(cls, values):
@@ -513,6 +544,42 @@ class ProviderConfig(BaseModel):
         "non-interruptible capacity only. Unset (the default): no constraint, "
         "the cheapest available capacity is used.",
     )
+    regions: Optional[list[str]] = Field(
+        default=None,
+        description="The regions the sandbox may be placed in: us, or all for "
+        "every region the platform offers, given as a single value or a list. "
+        "Unset (the default): your default regions.",
+    )
+
+    @field_validator("regions", mode="before")
+    @classmethod
+    def wrap_single_region(cls, v):
+        # `regions: all` or `regions: us` reads better than a one-item list.
+        if isinstance(v, str):
+            return [v]
+        return v
+
+    @field_validator("regions")
+    @classmethod
+    def validate_regions(cls, v):
+        # Only the format is checked here; which regions exist is up to the
+        # backend, so the list can grow without a CLI release.
+        if v is None:
+            return v
+        if not v:
+            raise ValueError("regions must not be empty; omit it to allow any region")
+        regions = []
+        for region in v:
+            region = region.strip().lower()
+            if not re.fullmatch(r"[a-z0-9_-]+", region):
+                raise ValueError(
+                    f"invalid region '{region}', must contain only letters, digits, '-' and '_'"
+                )
+            # The backend treats regions as a set, so drop repeats rather than
+            # have it reject them.
+            if region not in regions:
+                regions.append(region)
+        return regions
 
 
 class AgentModelConfig(BaseModel):

{hivekit-0.8.2 → hivekit-0.9.1}/src/cli/experiment.py

@@ -114,6 +114,8 @@ def build_experiment_crd(config: HiveConfig) -> Dict[str, Any]:
             provider["name"] = config.provider.name
         if config.provider.spot is not None:
             provider["spot"] = config.provider.spot
+        if config.provider.regions:
+            provider["regions"] = config.provider.regions
         if provider:
             experiment["spec"]["provider"] = provider
 
@@ -124,8 +126,6 @@ def build_experiment_crd(config: HiveConfig) -> Dict[str, Any]:
             experiment["spec"]["prompt"]["context"] = config.prompt.context
         if config.prompt.ideas:
             experiment["spec"]["prompt"]["ideas"] = config.prompt.ideas
-        if config.prompt.enable_evolution:
-            experiment["spec"]["prompt"]["enableEvolution"] = config.prompt.enable_evolution
 
     # Add optional agent selection
     if config.agents:

hivekit-0.9.1/src/cli/experiment_download.py

@@ -0,0 +1,131 @@
+# Copyright (C) 2026 Hiverge
+#
+# SPDX-License-Identifier: Apache-2.0
+
+"""Choose export destinations and save complete, validated downloads using bounded memory."""
+
+import gzip
+import os
+import tempfile
+from dataclasses import dataclass
+from email.message import Message
+from pathlib import Path
+
+import requests
+
+from cli.http_client import DOWNLOAD_SYSTEM_ERROR, DownloadError
+
+_CHUNK_SIZE = 1 << 16
+
+
+def resolve_download_output(
+    output: str | None, *, directory_only: bool = False
+) -> tuple[Path, str | None]:
+    """Return the destination directory and optional filename override."""
+    if output is None:
+        return Path.cwd(), None
+    if not output:
+        raise DownloadError("--output must name a file or directory.")
+    path = Path(output)
+    if path.is_dir():
+        return path, None
+    if output.endswith(("/", os.sep)):
+        if path.exists():
+            raise DownloadError(f"Output is not a directory: {path}")
+        path.mkdir(parents=True, exist_ok=True)
+        return path, None
+    if directory_only:
+        raise DownloadError("Full Export requires a directory. Use -o 'DIRECTORY/'.")
+    if output.replace("\\", "/").rsplit("/", 1)[-1] in {".", ".."}:
+        raise DownloadError("--output must name a file or directory.")
+    _check_destination(path)
+    return path.parent, path.name
+
+
+def _check_distinct(main: Path, reports: Path) -> None:
+    resolved_main, resolved_reports = main.resolve(), reports.resolve()
+    same = resolved_main == resolved_reports or (
+        main.exists() and reports.exists() and main.samefile(reports)
+    )
+    if same:
+        raise DownloadError("The main output and evolution reports must have different filenames.")
+
+
+def _check_destination(destination: Path) -> None:
+    if destination.is_dir():
+        raise DownloadError(f"Output is a directory: {destination}")
+    if not destination.parent.is_dir():
+        raise DownloadError(f"Output directory does not exist: {destination.parent}")
+
+
+def _response_filename(response: requests.Response) -> str:
+    disposition = Message()
+    disposition["Content-Disposition"] = response.headers.get("Content-Disposition", "")
+    filename = disposition.get_filename()
+    # AlphaTrion owns sanitization. Reject malformed filenames rather than altering them.
+    if (
+        not filename
+        or filename in {".", ".."}
+        or "/" in filename
+        or "\\" in filename
+        or any(ord(char) < 32 or ord(char) == 127 for char in filename)
+    ):
+        raise DownloadError(DOWNLOAD_SYSTEM_ERROR)
+    return filename
+
+
+@dataclass
+class ExportOutput:
+    directory: Path
+    output: str | None
+
+    @classmethod
+    def prepare(cls, name: str, full_export: bool, output: str | None) -> "ExportOutput":
+        """Validate the output path before authentication or download."""
+        if not name:
+            raise DownloadError("Experiment name must be non-empty.")
+        directory, filename = resolve_download_output(output, directory_only=full_export)
+        return cls(directory, filename)
+
+    def destination(self, response: requests.Response, *, source: Path | None = None) -> Path:
+        """Honor server filenames and check actual destinations before consuming bytes."""
+        filename = _response_filename(response)
+        destination = self.directory / (self.output if source is None and self.output else filename)
+        _check_destination(destination)
+        if source is not None:
+            _check_distinct(source, destination)
+        return destination
+
+
+def save_export(
+    response: requests.Response, destination: Path, *, suppress_empty: bool = False
+) -> bool:
+    """Publish only a complete gzip file; return False for suppressed empty reports.
+
+    The caller owns the response context. Temporary output lives beside the
+    destination so replacement cannot cross filesystem boundaries.
+    """
+    temporary: Path | None = None
+    try:
+        with tempfile.NamedTemporaryFile(
+            mode="wb", dir=destination.parent, prefix=".hive-export-", suffix=".tmp", delete=False
+        ) as output:
+            temporary = Path(output.name)
+            # Preserve AlphaTrion's compressed bytes, even if a proxy adds Content-Encoding.
+            for chunk in response.raw.stream(_CHUNK_SIZE, decode_content=False):
+                output.write(chunk)
+        with temporary.open("rb") as compressed:
+            # gzip accepts a zero-byte input, but a completed export must contain a frame.
+            if compressed.read(2) != b"\x1f\x8b":
+                raise DownloadError(DOWNLOAD_SYSTEM_ERROR)
+        has_content = False
+        with gzip.open(temporary, "rb") as decoded:
+            while decoded.read(_CHUNK_SIZE):
+                has_content = True
+        if suppress_empty and not has_content:
+            return False
+        os.replace(temporary, destination)
+        return True
+    finally:
+        if temporary is not None:
+            temporary.unlink(missing_ok=True)