inferenceport-cli 1.0.0__py3-none-any.whl

ipx/auth.py

@@ -0,0 +1,260 @@
+"""Sign-in flows against Supabase (email/password, OAuth via browser, SSO) plus API-key login and token refresh."""
+
+from __future__ import annotations
+
+import json
+import secrets
+import threading
+import time
+import urllib.parse
+import webbrowser
+from http.server import BaseHTTPRequestHandler, HTTPServer
+from typing import Any, Dict, Optional
+
+from ipx.config import FALLBACK_SUPABASE, Config, Credentials
+from ipx.errors import ApiError, IpxError
+from ipx.http import raw_request
+
+CALLBACK_PAGE = "https://inference.js.org/authcallback.html"
+OAUTH_PROVIDERS = {"github": "GitHub", "google": "Google", "microsoft": "Microsoft", "huggingface": "Hugging Face"}
+# Supabase's provider id for Microsoft is "azure".
+PROVIDER_IDS = {"github": "github", "google": "google", "microsoft": "azure", "huggingface": "custom:huggingface"}
+
+
+# --------------------------------------------------------------------------- supabase config
+
+
+def supabase_config(cfg: Config) -> Dict[str, str]:
+    """Supabase URL + publishable key. Fetched from /v1/config (public) and cached, with a baked-in fallback."""
+    cached = cfg.get("supabase")
+    if isinstance(cached, dict) and cached.get("url") and cached.get("publishableKey"):
+        return cached
+    try:
+        r = raw_request("GET", cfg.base_url + "/v1/config", timeout=15)
+        sb = r.json().get("supabase") or {}  # type: ignore[union-attr]
+        if sb.get("url") and sb.get("publishableKey"):
+            found = {"url": sb["url"].rstrip("/"), "publishableKey": sb["publishableKey"]}
+            cfg.set("supabase", found)
+            return found
+    except IpxError:
+        pass
+    return dict(FALLBACK_SUPABASE)
+
+
+def _auth_call(cfg: Config, method: str, path: str, body: Any = None, token: Optional[str] = None) -> Dict[str, Any]:
+    sb = supabase_config(cfg)
+    headers = {"apikey": sb["publishableKey"], "Authorization": f"Bearer {token or sb['publishableKey']}"}
+    try:
+        r = raw_request(method, sb["url"] + path, json=body, headers=headers, timeout=30)
+    except ApiError as e:
+        raise IpxError(_friendly_auth_error(e), "Check your credentials, or sign in with `ipx auth login --provider github`.")
+    return r.json() or {}  # type: ignore[union-attr]
+
+
+def _friendly_auth_error(e: ApiError) -> str:
+    msg = e.message
+    low = msg.lower()
+    if "invalid login" in low or "invalid_grant" in low or "invalid credentials" in low:
+        return "Incorrect email or password."
+    if "email not confirmed" in low:
+        return "Your email address is not verified yet. Check your inbox for the confirmation link."
+    return msg
+
+
+# --------------------------------------------------------------------------- flows
+
+
+def password_login(cfg: Config, creds: Credentials, email: str, password: str) -> Dict[str, Any]:
+    session = _auth_call(cfg, "POST", "/auth/v1/token?grant_type=password", {"email": email, "password": password})
+    creds.store_session(session, email=email)
+    return session
+
+
+def refresh(cfg: Config, creds: Credentials) -> bool:
+    """Exchange the stored refresh token for a new session. Returns True on success."""
+    rt = creds.refresh_token
+    if not rt or creds.data.get("auth_type") != "jwt":
+        return False
+    try:
+        session = _auth_call(cfg, "POST", "/auth/v1/token?grant_type=refresh_token", {"refresh_token": rt})
+    except IpxError:
+        return False
+    if not session.get("access_token"):
+        return False
+    creds.store_session(session)
+    return True
+
+
+def fetch_user(cfg: Config, access_token: str) -> Dict[str, Any]:
+    return _auth_call(cfg, "GET", "/auth/v1/user", token=access_token)
+
+
+def oauth_url(cfg: Config, provider: str, redirect_to: str) -> str:
+    sb = supabase_config(cfg)
+    params = {"provider": PROVIDER_IDS[provider], "redirect_to": redirect_to}
+    if provider == "microsoft":
+        params["scope"] = "openid profile email"
+    q = urllib.parse.urlencode(params)
+    return f"{sb['url']}/auth/v1/authorize?{q}"
+
+
+def sso_url(cfg: Config, email: str, redirect_to: str) -> str:
+    """Discover the org SSO connection for an email domain and ask Supabase for the IdP login URL."""
+    disc = raw_request("POST", cfg.base_url + "/v1/orgs/sso/discover", json={"email": email}, timeout=15).json()  # type: ignore[union-attr]
+    if not disc or not disc.get("sso"):
+        raise IpxError("No single sign-on is configured for this email domain.",
+                       "Use `ipx auth login` (email/password) or `--provider`.")
+    target: Dict[str, Any] = {"provider_id": disc["provider_id"]} if disc.get("provider_id") else {"domain": disc.get("domain")}
+    if not target.get("provider_id") and not target.get("domain"):
+        raise IpxError("Single sign-on is configured but incomplete. Contact your administrator.")
+    body = dict(target, redirect_to=redirect_to, skip_http_redirect=True)
+    res = _auth_call(cfg, "POST", "/auth/v1/sso", body)
+    if not res.get("url"):
+        raise IpxError("Could not start single sign-on.")
+    return str(res["url"])
+
+
+def api_key_login(cfg: Config, creds: Credentials, key: str) -> Dict[str, Any]:
+    """Validate a Lightning API key (ipa_live_...) against /v1/me and store it."""
+    key = key.strip()
+    try:
+        me = raw_request("GET", cfg.base_url + "/v1/me",
+                         headers={"Authorization": f"Bearer {key}", "X-Client-ID": cfg.client_id}, timeout=20).json()  # type: ignore[union-attr]
+    except ApiError as e:
+        if e.status in (401, 403):
+            raise IpxError("That API key was rejected.", "Create one at https://console.inferenceport.ai or with `ipx p2g keys create`.")
+        raise
+    email = ((me or {}).get("identity") or {}).get("email")
+    creds.store_api_key(key, email=email)
+    return me or {}
+
+
+def parse_callback(text: str) -> Dict[str, Any]:
+    """Parse tokens from a pasted callback URL or a bare `access_token=...&refresh_token=...` string."""
+    text = text.strip()
+    frag = text.split("#", 1)[1] if "#" in text else (text.split("?", 1)[1] if "?" in text and "access_token" in text else text)
+    params = {k: v[0] for k, v in urllib.parse.parse_qs(frag).items()}
+    if params.get("error"):
+        raise IpxError(params.get("error_description") or params["error"])
+    if not params.get("access_token"):
+        raise IpxError("No access token found in what you pasted.", "Paste the full address from the browser's address bar.")
+    session: Dict[str, Any] = {
+        "access_token": params["access_token"],
+        "refresh_token": params.get("refresh_token"),
+    }
+    if params.get("expires_at"):
+        session["expires_at"] = float(params["expires_at"])
+    elif params.get("expires_in"):
+        session["expires_at"] = time.time() + float(params["expires_in"])
+    return session
+
+
+_LANDING = """<!doctype html><meta charset=utf-8><title>ipx</title>
+<style>body{margin:0;display:grid;place-items:center;height:100vh;background:#0b1020;color:#e2e8f0;font:16px system-ui}
+.c{text-align:center;padding:40px 48px;border:1px solid #1e293b;border-radius:16px;background:#0f172a}
+h1{margin:0 0 8px;font-size:22px;background:linear-gradient(90deg,#4f7cff,#a78bfa);-webkit-background-clip:text;color:transparent}
+p{margin:0;color:#94a3b8}</style>
+<div class=c><h1 id=t>Signing you in…</h1><p id=m>One moment.</p></div>
+<script>
+const h=location.hash.slice(1);
+fetch('/token?n=__NONCE__',{method:'POST',body:h}).then(r=>{
+ document.getElementById('t').textContent=r.ok?'You are signed in to ipx':'Sign-in failed';
+ document.getElementById('m').textContent=r.ok?'You can close this tab and return to your terminal.':'Return to your terminal for details.';
+}).catch(()=>{document.getElementById('t').textContent='Sign-in failed';});
+</script>"""
+
+
+def browser_login(cfg: Config, build_url, *, timeout: float = 300.0, open_browser: bool = True,
+                  on_url=None) -> Dict[str, Any]:
+    """Run the OAuth/SSO dance with a loopback listener.
+
+    The hosted callback page (inference.js.org/authcallback.html) forwards the token fragment to the `rd`
+    address we give it; a tiny page served from 127.0.0.1 reads the fragment and posts it back to us.
+    """
+    nonce = secrets.token_urlsafe(16)
+    result: Dict[str, Any] = {}
+    done = threading.Event()
+
+    class Handler(BaseHTTPRequestHandler):
+        def log_message(self, *a: Any) -> None:  # silence
+            pass
+
+        def do_GET(self) -> None:  # noqa: N802
+            if urllib.parse.urlparse(self.path).path == "/callback":
+                body = _LANDING.replace("__NONCE__", nonce).encode()
+                self.send_response(200)
+                self.send_header("Content-Type", "text/html; charset=utf-8")
+                self.send_header("Content-Length", str(len(body)))
+                self.end_headers()
+                self.wfile.write(body)
+            else:
+                self.send_response(404)
+                self.end_headers()
+
+        def do_POST(self) -> None:  # noqa: N802
+            q = urllib.parse.parse_qs(urllib.parse.urlparse(self.path).query)
+            ok = urllib.parse.urlparse(self.path).path == "/token" and q.get("n", [""])[0] == nonce
+            length = int(self.headers.get("Content-Length") or 0)
+            raw = self.rfile.read(length).decode("utf-8", "replace") if length else ""
+            self.send_response(200 if ok else 403)
+            self.end_headers()
+            if ok:
+                try:
+                    result["session"] = parse_callback(raw)
+                except IpxError as e:
+                    result["error"] = e
+                done.set()
+
+    server = HTTPServer(("127.0.0.1", 0), Handler)
+    port = server.server_address[1]
+    rd = f"http://127.0.0.1:{port}/callback"
+    redirect_to = f"{CALLBACK_PAGE}?rd={urllib.parse.quote(rd, safe='')}"
+    url = build_url(redirect_to)
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    try:
+        if on_url:
+            on_url(url)
+        if open_browser:
+            try:
+                webbrowser.open(url)
+            except Exception:  # pragma: no cover
+                pass
+        if not done.wait(timeout):
+            raise IpxError("Timed out waiting for the browser sign-in.",
+                           "Try again, or use `ipx auth login --provider <name> --paste` to paste the redirect URL.")
+    finally:
+        server.shutdown()
+        server.server_close()
+    if "error" in result:
+        raise result["error"]
+    return result["session"]
+
+
+def complete_session(cfg: Config, creds: Credentials, session: Dict[str, Any]) -> Dict[str, Any]:
+    """Look up the user for a freshly obtained session and persist it."""
+    user = fetch_user(cfg, session["access_token"])
+    session = dict(session, user=user)
+    creds.store_session(session, email=user.get("email"))
+    return user
+
+
+def sign_out(cfg: Config, creds: Credentials) -> None:
+    token = creds.access_token if creds.data.get("auth_type") == "jwt" else None
+    if token:
+        try:
+            _auth_call(cfg, "POST", "/auth/v1/logout", {}, token=token)
+        except IpxError:
+            pass  # revoking server-side is best effort; local credentials are always removed
+    creds.clear()
+
+
+def decode_jwt_claims(token: str) -> Dict[str, Any]:
+    import base64
+
+    try:
+        payload = token.split(".")[1]
+        payload += "=" * (-len(payload) % 4)
+        return json.loads(base64.urlsafe_b64decode(payload))
+    except Exception:
+        return {}

ipx/chat.py

@@ -0,0 +1,314 @@
+"""Streaming chat: the interactive REPL and one-shot text generation, backend-agnostic.
+
+A backend is any callable ``stream(messages, model) -> Iterator[event]`` where an event is one of
+  ("text", str)        a content delta
+  ("think", str)       a reasoning delta (shown dimmed)
+  ("meta", dict)       e.g. {"model_name": "..."} from the Lightning router
+  ("usage", dict)      {"credits": float, "tokens": int, ...} at the end of the stream
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+import time
+from datetime import datetime
+from typing import Any, Callable, Dict, Iterator, List, Optional, Tuple
+
+from rich.console import Group
+from rich.live import Live
+from rich.markdown import Markdown
+from rich.panel import Panel
+from rich.text import Text
+
+from ipx import ui
+from ipx.errors import IpxError
+
+Event = Tuple[str, Any]
+Backend = Callable[[List[Dict[str, Any]], Optional[str]], Iterator[Event]]
+
+HELP = [
+    ("/help", "show this help"),
+    ("/exit, /quit", "leave the chat (or press Ctrl+D)"),
+    ("/clear", "forget the conversation so far"),
+    ("/system <text>", "set the system prompt (clears history)"),
+    ("/model [name]", "show or switch the model"),
+    ("/models", "list models you can use"),
+    ("/retry", "regenerate the last answer"),
+    ("/save [file]", "save the transcript as Markdown"),
+    ("/usage", "tokens and credits used in this chat"),
+    ('"""', "start/end a multi-line message (or end a line with \\)"),
+]
+
+
+class Totals:
+    def __init__(self) -> None:
+        self.credits = 0.0
+        self.tokens = 0
+        self.turns = 0
+
+    def add(self, u: Dict[str, Any]) -> None:
+        self.credits += float(u.get("credits") or 0)
+        self.tokens += int(u.get("tokens") or 0)
+
+
+def _stream_turn(backend: Backend, messages: List[Dict[str, Any]], model: Optional[str], totals: Totals,
+                 live_render: bool = True) -> Tuple[str, Dict[str, Any]]:
+    """Run one assistant turn, rendering Markdown live. Returns (text, info)."""
+    text, think = "", ""
+    info: Dict[str, Any] = {}
+    start = time.time()
+    first = None
+
+    def view() -> Group:
+        parts: List[Any] = []
+        if think:
+            tail = think.strip().splitlines()[-3:]
+            parts.append(Text("💭 " + " ".join(tail)[:300], style="dim italic"))
+        if text:
+            parts.append(Markdown(text, code_theme="monokai"))
+        elif not think:
+            parts.append(Text("●●●", style=ui.BRAND))
+        return Group(*parts)
+
+    stream = backend(messages, model)
+    try:
+        with Live(view(), console=ui.console, refresh_per_second=14, transient=False, vertical_overflow="visible") as live:
+            try:
+                for kind, payload in stream:
+                    if kind == "text":
+                        first = first or time.time()
+                        text += payload
+                    elif kind == "think":
+                        think += payload
+                    elif kind == "meta":
+                        info.update(payload)
+                    elif kind == "usage":
+                        info.update(payload)
+                        totals.add(payload)
+                    live.update(view())
+            except KeyboardInterrupt:
+                info["interrupted"] = True
+            live.update(Group(Markdown(text, code_theme="monokai")) if text else Text(""))
+    finally:
+        close = getattr(stream, "close", None)
+        if close:
+            close()
+    info["elapsed"] = time.time() - start
+    return text, info
+
+
+def _footer(info: Dict[str, Any], model: Optional[str], to=None) -> None:
+    out = to or ui.console
+    bits = []
+    used = info.get("model_name") or model
+    if used:
+        bits.append(str(used))
+    if info.get("tokens"):
+        bits.append(f"{info['tokens']} tok")
+    if info.get("credits"):
+        bits.append(f"{ui.fmt_credits(info['credits'])} credits")
+    if info.get("elapsed"):
+        bits.append(f"{info['elapsed']:.1f}s")
+    if info.get("interrupted"):
+        bits.append("stopped")
+    if bits:
+        out.print(Text("  " + " · ".join(bits), style="dim"))
+
+
+def _read_message() -> Optional[str]:
+    """Read a (possibly multi-line) message. Returns None on EOF."""
+    try:
+        line = ui.console.input("[user]you[/user] [muted]›[/muted] ")
+    except EOFError:
+        return None
+    if line.strip() == '"""':
+        lines = []
+        while True:
+            try:
+                nxt = ui.console.input("[muted]… [/muted]")
+            except EOFError:
+                break
+            if nxt.strip() == '"""':
+                break
+            lines.append(nxt)
+        return "\n".join(lines)
+    while line.endswith("\\"):
+        try:
+            line = line[:-1] + "\n" + ui.console.input("[muted]… [/muted]")
+        except EOFError:
+            break
+    return line
+
+
+def run_repl(*, title: str, subtitle: str, backend: Backend, model: Optional[str], system: Optional[str] = None,
+             list_models: Optional[Callable[[], List[str]]] = None, footer_note: Optional[str] = None) -> None:
+    if not ui.is_tty():
+        raise IpxError("Interactive chat needs a terminal.", "For scripts use the one-shot `text` command, e.g. `echo hi | ipx gen text`.")
+    totals = Totals()
+    messages: List[Dict[str, Any]] = []
+    if system:
+        messages.append({"role": "system", "content": system})
+
+    ui.console.print()
+    ui.console.print(Panel(
+        Text.assemble((title, "bold white"), ("  " + subtitle, "muted"), "\n",
+                      ("model ", "muted"), (model or "auto", f"bold {ui.ACCENT}"),
+                      ("   ·   /help for commands   ·   Ctrl+D to exit", "muted")),
+        border_style=ui.DIM, padding=(0, 2)))
+    if footer_note:
+        ui.dim(footer_note)
+    ui.console.print()
+
+    while True:
+        try:
+            msg = _read_message()
+        except KeyboardInterrupt:
+            ui.console.print()
+            break
+        if msg is None:
+            ui.console.print()
+            break
+        msg = msg.strip()
+        if not msg:
+            continue
+        if msg.startswith("/"):
+            cmd, _, arg = msg.partition(" ")
+            cmd, arg = cmd.lower(), arg.strip()
+            if cmd in ("/exit", "/quit", "/q"):
+                break
+            if cmd == "/help":
+                for k, v in HELP:
+                    ui.console.print(f"  [key]{k:<16}[/key] [muted]{v}[/muted]")
+            elif cmd == "/clear":
+                messages = [m for m in messages if m["role"] == "system"]
+                ui.ok("Conversation cleared.")
+            elif cmd == "/system":
+                messages = [{"role": "system", "content": arg}] if arg else []
+                ui.ok("System prompt updated; history cleared." if arg else "System prompt removed.")
+            elif cmd == "/model":
+                if arg:
+                    model = arg
+                    ui.ok(f"Model set to [bold]{model}[/bold]")
+                else:
+                    ui.console.print(f"Model: [bold]{model or 'auto'}[/bold]")
+            elif cmd == "/models":
+                if list_models:
+                    try:
+                        for m in list_models():
+                            ui.console.print(f"  [accent]•[/accent] {m}")
+                    except IpxError as e:
+                        ui.render_error(e)
+                else:
+                    ui.dim("Model listing is not available here.")
+            elif cmd == "/usage":
+                ui.console.print(f"  {totals.turns} turns · {totals.tokens} tokens · {ui.fmt_credits(totals.credits)} credits")
+            elif cmd == "/save":
+                path = arg or f"chat-{datetime.now():%Y%m%d-%H%M%S}.md"
+                with open(path, "w", encoding="utf-8") as fh:
+                    for m in messages:
+                        who = {"user": "You", "assistant": "Assistant", "system": "System"}.get(m["role"], m["role"])
+                        fh.write(f"## {who}\n\n{m['content']}\n\n")
+                ui.ok(f"Saved transcript to [bold]{path}[/bold]")
+            elif cmd == "/retry":
+                while messages and messages[-1]["role"] == "assistant":
+                    messages.pop()
+                if not messages or messages[-1]["role"] != "user":
+                    ui.warn("Nothing to retry yet.")
+                else:
+                    _answer(backend, messages, model, totals)
+            else:
+                ui.warn(f"Unknown command {cmd}. Type /help.")
+            continue
+        messages.append({"role": "user", "content": msg})
+        if not _answer(backend, messages, model, totals):
+            messages.pop()
+
+
+def _answer(backend: Backend, messages: List[Dict[str, Any]], model: Optional[str], totals: Totals) -> bool:
+    ui.console.print(Text("assistant", style="bot"))
+    try:
+        text, info = _stream_turn(backend, messages, model, totals)
+    except IpxError as e:
+        ui.render_error(e)
+        return False
+    if text or info.get("interrupted"):
+        messages.append({"role": "assistant", "content": text})
+        totals.turns += 1
+    _footer(info, model)
+    ui.console.print()
+    return True
+
+
+def one_shot(*, backend: Backend, prompt: str, model: Optional[str], system: Optional[str], as_json: bool,
+             stream_out: bool = True) -> None:
+    """Generate once. Streams plain text to stdout (pipe friendly); footer details go to stderr."""
+    messages: List[Dict[str, Any]] = []
+    if system:
+        messages.append({"role": "system", "content": system})
+    messages.append({"role": "user", "content": prompt})
+    out, info, totals = [], {}, Totals()
+    start = time.time()
+    for kind, payload in backend(messages, model):
+        if kind == "text":
+            out.append(payload)
+            if stream_out and not as_json:
+                sys.stdout.write(payload)
+                sys.stdout.flush()
+        elif kind == "meta":
+            info.update(payload)
+        elif kind == "usage":
+            info.update(payload)
+            totals.add(payload)
+    text = "".join(out)
+    if as_json:
+        ui.emit_json({"text": text, "model": info.get("model_name") or model, "usage": info})
+        return
+    if stream_out:
+        if not text.endswith("\n"):
+            sys.stdout.write("\n")
+    else:
+        sys.stdout.write(text + ("" if text.endswith("\n") else "\n"))
+    if not ui.STATE["quiet"] and sys.stderr.isatty():
+        info["elapsed"] = time.time() - start
+        _footer(info, model, to=ui.err)
+
+
+def parse_openai_sse(stream) -> Iterator[Event]:
+    """Translate an OpenAI-style (plus InferencePort extras) SSE stream into chat events."""
+    for event, data in stream.iter_sse():
+        if event == "payg-usage":
+            try:
+                u = json.loads(data)
+            except ValueError:
+                continue
+            yield "usage", {
+                "credits": u.get("payg_credits_charged"),
+                "tokens": u.get("payg_total_tokens"),
+                "input_tokens": u.get("payg_input_tokens"),
+                "output_tokens": u.get("payg_output_tokens"),
+            }
+            continue
+        if data.strip() == "[DONE]":
+            break
+        try:
+            obj = json.loads(data)
+        except ValueError:
+            continue
+        if not isinstance(obj, dict):
+            continue
+        if obj.get("error"):
+            err = obj["error"]
+            raise IpxError(err if isinstance(err, str) else err.get("message", "The model returned an error."))
+        rm = obj.get("router_metadata")
+        if isinstance(rm, dict):
+            yield "meta", {"model_name": rm.get("model_name")}
+        usage = obj.get("usage")
+        if isinstance(usage, dict) and usage.get("total_tokens"):
+            yield "usage", {"tokens": usage.get("total_tokens"), "credits": usage.get("payg_credits_charged")}
+        for choice in obj.get("choices") or []:
+            delta = choice.get("delta") or choice.get("message") or {}
+            if delta.get("reasoning_content"):
+                yield "think", delta["reasoning_content"]
+            if delta.get("content"):
+                yield "text", delta["content"]