kiteml-cli 0.1.0__tar.gz → 0.3.0__tar.gz

kiteml_cli-0.3.0/.gitignore

@@ -0,0 +1,9 @@
+# The nearest .gitignore to pyproject.toml: hatchling excludes by it and ships it in the sdist,
+# in place of the monorepo's root one.
+__pycache__/
+*.py[cod]
+*.egg-info/
+dist/
+build/
+.venv/
+.pytest_cache/

{kiteml_cli-0.1.0 → kiteml_cli-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: kiteml-cli
-Version: 0.1.0
+Version: 0.3.0
 Summary: Kite CLI and MCP server: train robot policies with reinforcement learning in simulation, augment LeRobot datasets, and build MuJoCo digital twins, from your terminal or an AI agent.
 Project-URL: Homepage, https://kiteml.com
 Project-URL: Documentation, https://kite-ml.mintlify.app/tools/cli-and-mcp
@@ -26,24 +26,18 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: >=3.10
-Requires-Dist: httpx>=0.25
+Requires-Dist: httpx<1,>=0.25
 Requires-Dist: rich>=13.0
-Requires-Dist: typer>=0.9
+Requires-Dist: typer>=0.15.4
 Provides-Extra: all
 Requires-Dist: mcp<2,>=1.0; extra == 'all'
-Requires-Dist: starlette>=0.37; extra == 'all'
-Requires-Dist: uvicorn>=0.30; extra == 'all'
 Provides-Extra: dev
 Requires-Dist: mcp<2,>=1.0; extra == 'dev'
 Requires-Dist: pytest-asyncio; extra == 'dev'
 Requires-Dist: pytest>=7.0; extra == 'dev'
 Requires-Dist: ruff; extra == 'dev'
-Requires-Dist: starlette>=0.37; extra == 'dev'
-Requires-Dist: uvicorn>=0.30; extra == 'dev'
 Provides-Extra: mcp
 Requires-Dist: mcp<2,>=1.0; extra == 'mcp'
-Requires-Dist: starlette>=0.37; extra == 'mcp'
-Requires-Dist: uvicorn>=0.30; extra == 'mcp'
 Description-Content-Type: text/markdown
 
 # Kite CLI and MCP server
@@ -65,6 +59,8 @@ Model Context Protocol (MCP) client.
   Hugging Face.
 - **Digital twins.** Point Kite at one episode of a LeRobot dataset and get an interactable MuJoCo scene of the
   room, with the objects the robot handles built to size.
+- **Sim runs.** Run a Kite SDK spec on Kite's machines, on an NVIDIA L4 for a GPU policy: every episode traced, every
+  evaluator scored. You get a scorecard and the run directory, which `kite verify` checks.
 
 ## Install
 
@@ -112,6 +108,7 @@ lerobot/pusht to look like this photo".
 | `kite_rl_status`, `kite_rl_metrics`, `kite_rl_report`, `kite_rl_list` | Follow training and read each run's evaluation verdict |
 | `kite_augment_create`, `kite_augment_status`, `kite_augment_list`, `kite_augment_cancel` | Augment LeRobot datasets |
 | `kite_twin_validate`, `kite_twin_create`, `kite_twin_status`, `kite_twin_list`, `kite_twin_cancel`, `kite_twin_resume` | Build MuJoCo digital twins |
+| `kite_sim_validate`, `kite_sim_run`, `kite_sim_status`, `kite_sim_list`, `kite_sim_report`, `kite_sim_logs`, `kite_sim_cancel`, `kite_sim_resume` | Run Kite SDK specs on Kite's machines and read their scorecards |
 | `kite_doctor` | Check connectivity and authentication |
 
 ## Use it from the terminal
@@ -140,6 +137,13 @@ Build a digital twin (private beta):
 kite twin create lerobot/svla_so101_pickplace --out ./twins   # -> ./twins/twin_.../scene.xml
 ```
 
+Run a Kite SDK spec on Kite's machines (private beta):
+
+```bash
+kite sim validate specs/smoke.yaml             # free: the plan and what a run reserves
+kite sim run specs/smoke.yaml --out ./runs     # -> ./runs/srun_.../scorecard.json
+```
+
 Every command prints JSON (`{"ok": true, "data": ...}`) so scripts and agents can parse it. Run `kite --help` for
 the full list.
 

{kiteml_cli-0.1.0 → kiteml_cli-0.3.0}/README.md

@@ -17,6 +17,8 @@ Model Context Protocol (MCP) client.
   Hugging Face.
 - **Digital twins.** Point Kite at one episode of a LeRobot dataset and get an interactable MuJoCo scene of the
   room, with the objects the robot handles built to size.
+- **Sim runs.** Run a Kite SDK spec on Kite's machines, on an NVIDIA L4 for a GPU policy: every episode traced, every
+  evaluator scored. You get a scorecard and the run directory, which `kite verify` checks.
 
 ## Install
 
@@ -64,6 +66,7 @@ lerobot/pusht to look like this photo".
 | `kite_rl_status`, `kite_rl_metrics`, `kite_rl_report`, `kite_rl_list` | Follow training and read each run's evaluation verdict |
 | `kite_augment_create`, `kite_augment_status`, `kite_augment_list`, `kite_augment_cancel` | Augment LeRobot datasets |
 | `kite_twin_validate`, `kite_twin_create`, `kite_twin_status`, `kite_twin_list`, `kite_twin_cancel`, `kite_twin_resume` | Build MuJoCo digital twins |
+| `kite_sim_validate`, `kite_sim_run`, `kite_sim_status`, `kite_sim_list`, `kite_sim_report`, `kite_sim_logs`, `kite_sim_cancel`, `kite_sim_resume` | Run Kite SDK specs on Kite's machines and read their scorecards |
 | `kite_doctor` | Check connectivity and authentication |
 
 ## Use it from the terminal
@@ -92,6 +95,13 @@ Build a digital twin (private beta):
 kite twin create lerobot/svla_so101_pickplace --out ./twins   # -> ./twins/twin_.../scene.xml
 ```
 
+Run a Kite SDK spec on Kite's machines (private beta):
+
+```bash
+kite sim validate specs/smoke.yaml             # free: the plan and what a run reserves
+kite sim run specs/smoke.yaml --out ./runs     # -> ./runs/srun_.../scorecard.json
+```
+
 Every command prints JSON (`{"ok": true, "data": ...}`) so scripts and agents can parse it. Run `kite --help` for
 the full list.
 

{kiteml_cli-0.1.0 → kiteml_cli-0.3.0}/pyproject.toml

@@ -1,10 +1,12 @@
 [build-system]
-requires = ["hatchling"]
+requires = ["hatchling>=1.27"]
 build-backend = "hatchling.build"
 
 [project]
+# Published as kiteml-cli: PyPI refuses kite-cli as too similar to the existing `kitecli` project.
+# The import package (kite_cli) and the commands (kite, kite-mcp) keep their names.
 name = "kiteml-cli"
-version = "0.1.0"
+dynamic = ["version"]  # from src/kite_cli/__init__.py, the one place it is bumped
 description = "Kite CLI and MCP server: train robot policies with reinforcement learning in simulation, augment LeRobot datasets, and build MuJoCo digital twins, from your terminal or an AI agent."
 readme = "README.md"
 license = "Apache-2.0"
@@ -34,8 +36,8 @@ classifiers = [
 ]
 
 dependencies = [
-    "typer>=0.9",
-    "httpx>=0.25",
+    "typer>=0.15.4",  # older typers break on click >= 8.2, which pip pairs them with
+    "httpx>=0.25,<1",
     "rich>=13.0",
 ]
 
@@ -48,7 +50,7 @@ Dashboard = "https://app.kiteml.com"
 Blog = "https://kiteml.com/blog"
 
 [project.optional-dependencies]
-mcp = ["mcp>=1.0,<2", "uvicorn>=0.30", "starlette>=0.37"]
+mcp = ["mcp>=1.0,<2"]  # mcp brings the starlette/uvicorn the hosted HTTP transport uses
 all = ["kiteml-cli[mcp]"]
 dev = [
     "kiteml-cli[all]",
@@ -61,6 +63,9 @@ dev = [
 kite = "kite_cli.cli.main:app"
 kite-mcp = "kite_cli.mcp.server:main"
 
+[tool.hatch.version]
+path = "src/kite_cli/__init__.py"
+
 # The published package is the public /v1 client. kite_cli/internal (the dashboard's commands and tools, and the
 # hosted server's HTTP transport) stays in this repo: the hosted image puts the source tree on PYTHONPATH instead.
 [tool.hatch.build.targets.wheel]

{kiteml_cli-0.1.0 → kiteml_cli-0.3.0}/src/kite_cli/__init__.py

@@ -1,3 +1,3 @@
 """Kite CLI and MCP server for the Kite robotics training platform."""
 
-__version__ = "0.1.0"
+__version__ = "0.3.0"

kiteml_cli-0.3.0/src/kite_cli/archive.py

@@ -0,0 +1,108 @@
+"""Fetching a finished resource's `.tar.gz` (a twin, a sim run): to `<out>/<id>.tar.gz`, sha256-verified, and unpacked
+only inside `<out>/<id>/`.
+
+A signed storage URL is fetched with a plain HTTP client, never with the Kite key; the API's own archive route
+(download.requires_auth) goes through KiteClient.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import re
+import tarfile
+from pathlib import Path, PurePosixPath
+from typing import Callable
+
+import httpx
+
+from kite_cli.client import KiteAPIError, KiteClient, user_agent
+
+DATA_FILTER = hasattr(tarfile, "data_filter")  # Python >= 3.10.12 / 3.11.4 / 3.12
+
+
+def storage_client() -> httpx.Client:
+    """A plain client for signed storage URLs: it has no Kite credentials to send."""
+    return httpx.Client(timeout=httpx.Timeout(120.0, connect=30.0), follow_redirects=True)
+
+
+def verified(client: KiteClient, d: dict, out: Path, rid: str, *,
+             storage: Callable[[], httpx.Client] = storage_client) -> Path:
+    """`<out>/<rid>.tar.gz`, fetched from the `download` block `d` and checked against its sha256. An archive already
+    there that still verifies is reused."""
+    if not re.fullmatch(r"[A-Za-z0-9_-]+", rid):
+        raise KiteAPIError(502, f"unexpected id {rid!r}", code="archive_invalid")
+    expected = str(d.get("sha256") or "").lower()
+    if not expected:
+        raise KiteAPIError(502, f"'{rid}' has no download.sha256 to verify against.", code="checksum_missing")
+    out.mkdir(parents=True, exist_ok=True)
+    archive = out / f"{rid}.tar.gz"
+    if not (archive.is_file() and sha256(archive) == expected):
+        part = out / f"{rid}.tar.gz.part"
+        try:
+            fetch(client, d, part, storage=storage)
+            got = sha256(part)
+            if got != expected:
+                raise KiteAPIError(502, f"{archive.name}: sha256 {got} != expected {expected}; the file was discarded, "
+                                        f"retry the download", code="checksum_mismatch",
+                                   details={"expected": expected, "actual": got, "bytes": part.stat().st_size})
+            part.replace(archive)
+        finally:
+            part.unlink(missing_ok=True)
+    return archive
+
+
+def fetch(client: KiteClient, d: dict, dest: Path, *, storage: Callable[[], httpx.Client] = storage_client) -> None:
+    """Stream the archive to `dest`. The Kite key goes to the Kite API only: the archive route through
+    KiteClient, a signed storage URL through a plain client that has no key to send."""
+    url = str(d.get("url") or "")
+    if not url:
+        raise KiteAPIError(502, "the download has no url", code="download_failed")
+    u = httpx.URL(url)
+    if u.is_relative_url or _origin(u) == _origin(httpx.URL(client.base_url)):
+        client.download(url, str(dest))
+        return
+    if d.get("requires_auth"):
+        raise KiteAPIError(502, f"download.url is on {u.host}, not the Kite API; refusing to send it the Kite key",
+                           code="download_failed")
+    headers = {"Accept-Encoding": "identity", "User-Agent": user_agent()}
+    with storage() as http, http.stream("GET", url, headers=headers) as r:
+        if not r.is_success:
+            r.read()
+            raise KiteAPIError(r.status_code, f"GET {u.host} answered HTTP {r.status_code}: {r.text[:200]}",
+                               code="download_failed")
+        with open(dest, "wb") as f:
+            for chunk in r.iter_bytes(1 << 20):
+                f.write(chunk)
+
+
+def _origin(u: httpx.URL) -> tuple:
+    return u.scheme, u.host, u.port or {"https": 443, "http": 80}.get(u.scheme)
+
+
+def sha256(path: Path) -> str:
+    h = hashlib.sha256()
+    with open(path, "rb") as f:
+        for chunk in iter(lambda: f.read(1 << 20), b""):
+            h.update(chunk)
+    return h.hexdigest()
+
+
+def unpack(archive: Path, dest: Path, *, top: str) -> None:
+    """Extract into `dest`. Every member must sit under `<top>/` (the resource's id), with no absolute path or `..`.
+    Python's tarfile "data" filter, where present, also refuses links out of `dest` and device files; without
+    it (Python < 3.10.12), links and special files are refused outright."""
+    with tarfile.open(archive, "r:gz") as tar:
+        members = tar.getmembers()
+        for m in members:
+            parts = PurePosixPath(m.name).parts
+            if (parts and parts[0] != top) or ".." in parts or not (DATA_FILTER or m.isfile() or m.isdir()):
+                raise KiteAPIError(502, f"{archive.name}: refusing to extract {m.name!r}", code="archive_invalid")
+        try:
+            if DATA_FILTER:
+                tar.extractall(dest, members=members, filter="data")
+            else:
+                for m in members:
+                    m.mode = 0o755 if m.isdir() else (m.mode | 0o600) & 0o755
+                tar.extractall(dest, members=members)
+        except tarfile.TarError as e:  # includes the data filter's refusals
+            raise KiteAPIError(502, f"{archive.name}: {e}", code="archive_invalid") from e

kiteml_cli-0.3.0/src/kite_cli/auth.py

@@ -0,0 +1,252 @@
+"""
+Authentication for the Kite CLI.
+
+Supports:
+  - API key: KITE_API_KEY env var (recommended for MCP / programmatic access)
+  - Browser login: `kite auth login` signs in on the dashboard, whose session token lasts an hour, and trades it
+    for an API key that lasts KEY_DAYS: full access (the CLI also calls /api routes), named after this machine so it
+    can be found and revoked in the console. Logging in again replaces this machine's key; logging out revokes it.
+  - Environment variable: KITE_TOKEN for CI/headless
+  - Token file: ~/.kite/credentials.json (written by login, read by client)
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import secrets
+import socket
+import sys
+import threading
+import time
+import webbrowser
+from datetime import datetime, timedelta, timezone
+from http.server import HTTPServer, BaseHTTPRequestHandler
+from pathlib import Path
+from typing import Optional
+from urllib.parse import parse_qs, urlparse
+
+from kite_cli.config import KITE_DIR, get_app_url
+
+CREDENTIALS_PATH = KITE_DIR / "credentials.json"
+KEY_DAYS = 90  # how long the API key a login stores lasts; logging in again before then replaces it
+
+
+def get_token() -> Optional[str]:
+    """Get a valid auth token. Checks env vars first, then credentials file."""
+    # 1. API key (MCP / programmatic access)
+    api_key = os.environ.get("KITE_API_KEY")
+    if api_key:
+        return api_key
+
+    # 2. Token override (CI, headless)
+    env_token = os.environ.get("KITE_TOKEN")
+    if env_token:
+        return env_token
+
+    # 3. Stored credentials: the login's API key, or the session token an older login (or a failed exchange) kept
+    creds = _load_credentials()
+    if creds:
+        return creds.get("api_key") or creds.get("id_token")
+
+    return None
+
+
+def save_credentials(id_token: Optional[str] = None, user_info: Optional[dict] = None, *,
+                     api_key: Optional[str] = None, api_key_id: Optional[str] = None,
+                     expires_at: Optional[str] = None) -> None:
+    """Save credentials to disk, readable by this user only from the moment the file exists."""
+    KITE_DIR.mkdir(parents=True, exist_ok=True)
+    creds: dict = {"user_info": user_info, "saved_at": time.time()}
+    if api_key:
+        creds.update(api_key=api_key, api_key_id=api_key_id, expires_at=expires_at)
+    else:
+        creds["id_token"] = id_token
+    fd = os.open(CREDENTIALS_PATH, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "w") as f:
+        f.write(json.dumps(creds, indent=2) + "\n")
+    try:
+        CREDENTIALS_PATH.chmod(0o600)  # a file an older version wrote keeps its old mode otherwise
+    except OSError:
+        pass
+
+
+def clear_credentials() -> None:
+    """Remove stored credentials."""
+    if CREDENTIALS_PATH.exists():
+        CREDENTIALS_PATH.unlink()
+
+
+def key_name() -> str:
+    """The name a login gives its API key in the console."""
+    return f"Kite CLI on {socket.gethostname() or 'this machine'}"
+
+
+def _api(method: str, path: str, token: str, json_body: Optional[dict] = None) -> Optional[dict]:
+    """One call to the dashboard's /api routes with `token`; None when it fails or cannot be made."""
+    import httpx
+
+    from kite_cli.client import user_agent
+    from kite_cli.config import get_api_url
+
+    try:
+        r = httpx.request(method, f"{get_api_url().rstrip('/')}{path}", json=json_body, timeout=30,
+                          headers={"Authorization": f"Bearer {token}", "User-Agent": user_agent()})
+    except httpx.HTTPError:
+        return None
+    if r.status_code >= 300:
+        return None
+    try:
+        return r.json()
+    except ValueError:
+        return {}
+
+
+def store_login(id_token: str, user_info: Optional[dict] = None) -> dict:
+    """Keep a login: trade the dashboard session's token, which lasts an hour, for an API key that lasts KEY_DAYS, and
+    revoke the key this machine's previous login made. If the API will not make one, keep the session token (and
+    say it lasts about an hour). Returns what was kept, for `kite auth login` to print."""
+    previous = _load_credentials() or {}
+    expires = (datetime.now(timezone.utc) + timedelta(days=KEY_DAYS)).replace(microsecond=0)
+    made = _api("POST", "/api/api-keys", id_token,
+                {"name": key_name(), "expires_at": expires.isoformat().replace("+00:00", "Z")})
+    if not made or not str(made.get("key") or "").startswith("kite_"):
+        save_credentials(id_token=id_token, user_info=user_info)
+        print("warning: could not create an API key for this machine, so this login lasts about an hour; run "
+              "`kite auth login` again, or set KITE_API_KEY", file=sys.stderr)
+        return {"credential": "session", "expires_in_minutes": 60}
+    save_credentials(user_info=user_info, api_key=made["key"], api_key_id=made.get("id"),
+                     expires_at=made.get("expires_at") or expires.isoformat())
+    old = previous.get("api_key_id")
+    if old and old != made.get("id"):
+        _api("DELETE", f"/api/api-keys/{old}", id_token)  # one key per machine; a key of another account 404s
+    return {"credential": "api_key", "key_name": made.get("name") or key_name(),
+            "expires_at": made.get("expires_at") or expires.isoformat()}
+
+
+def logout() -> dict:
+    """Revoke the API key the login stored (with itself), then forget it. A key that could not be revoked from here is
+    named, so it can be revoked in the console."""
+    creds = _load_credentials() or {}
+    out: dict = {"logged_out": True}
+    if creds.get("api_key") and creds.get("api_key_id"):
+        revoked = _api("DELETE", f"/api/api-keys/{creds['api_key_id']}", creds["api_key"]) is not None
+        out["key_revoked"] = revoked
+        if not revoked:
+            out["note"] = (f"revoke '{key_name()}' (prefix {str(creds['api_key'])[:12]}...) at "
+                           f"{get_app_url().rstrip('/')}/platform-api/keys")
+    clear_credentials()
+    return out
+
+
+def _load_credentials() -> Optional[dict]:
+    """Load credentials from disk."""
+    if not CREDENTIALS_PATH.exists():
+        return None
+    try:
+        return json.loads(CREDENTIALS_PATH.read_text())
+    except (json.JSONDecodeError, OSError):
+        return None
+
+
+class _CallbackHandler(BaseHTTPRequestHandler):
+    """HTTP handler that receives the OAuth callback with the token."""
+
+    token: Optional[str] = None
+    user_info: Optional[dict] = None
+    expected_state: Optional[str] = None
+
+    def do_GET(self):
+        parsed = urlparse(self.path)
+        params = parse_qs(parsed.query)
+
+        if parsed.path != "/callback":
+            self.send_response(404)
+            self.end_headers()
+            return
+
+        state = params.get("state", [None])[0]
+        token = params.get("token", [None])[0]
+        email = params.get("email", [None])[0]
+
+        # Only accept the login this process started. Without this, any local
+        # page could hit the ephemeral port and plant a token. compare_digest
+        # keeps the nonce from being probed a byte at a time.
+        expected = _CallbackHandler.expected_state
+        if not expected or not state or not secrets.compare_digest(state, expected):
+            self._reply(403, "Login failed", "This callback did not come from the login you started.")
+            return
+
+        if not token:
+            self._reply(400, "Login failed", "No token received.")
+            return
+
+        _CallbackHandler.token = token
+        _CallbackHandler.user_info = {"email": email} if email else None
+        self._reply(200, "Login successful!", "You can close this tab.")
+
+    def _reply(self, status: int, heading: str, detail: str) -> None:
+        self.send_response(status)
+        self.send_header("Content-Type", "text/html")
+        self.end_headers()
+        self.wfile.write(f"<html><body><h2>{heading}</h2><p>{detail}</p></body></html>".encode())
+
+    def log_message(self, format, *args):
+        pass  # Suppress HTTP server logs
+
+
+def login_browser(timeout: int = 120) -> Optional[dict]:
+    """Open the dashboard to sign in, then keep the login (store_login). Returns what was kept, or None."""
+    import socket
+
+    # Find a free port
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
+        s.bind(("127.0.0.1", 0))
+        port = s.getsockname()[1]
+
+    # Single-use nonce the /cli-auth page echoes back, so we can tell our own
+    # callback apart from any other request that reaches this port.
+    state = secrets.token_urlsafe(24)
+
+    # Reset handler state
+    _CallbackHandler.token = None
+    _CallbackHandler.user_info = None
+    _CallbackHandler.expected_state = state
+
+    server = HTTPServer(("127.0.0.1", port), _CallbackHandler)
+    # Poll in short slices so a stray request can't hold us past the deadline.
+    server.timeout = 1
+
+    # The dashboard's /cli-auth page signs you in, then redirects to our
+    # loopback callback with the token. Derive nothing from the API URL: the
+    # app is a different host (app.kiteml.com vs api.kiteml.com).
+    login_url = f"{get_app_url().rstrip('/')}/cli-auth?redirect_port={port}&state={state}"
+
+    print(f"Opening browser for login...")
+    print(f"If the browser doesn't open, visit: {login_url}")
+    webbrowser.open(login_url)
+
+    # Wait for callback
+    deadline = time.time() + timeout
+    while time.time() < deadline and _CallbackHandler.token is None:
+        server.handle_request()
+
+    server.server_close()
+
+    if _CallbackHandler.token:
+        return store_login(_CallbackHandler.token, _CallbackHandler.user_info)
+
+    return None
+
+
+def login_headless() -> Optional[dict]:
+    """Headless login: prompt user to paste an API key (kept as it is) or a session token (traded for a key)."""
+    print("Visit your Kite dashboard to generate an API token.")
+    print("Then paste it here:")
+    token = input("> ").strip()
+    if not token:
+        return None
+    if token.startswith("kite_"):
+        save_credentials(api_key=token)
+        return {"credential": "api_key"}
+    return store_login(token)

{kiteml_cli-0.1.0 → kiteml_cli-0.3.0}/src/kite_cli/cli/commands/auth_cmd.py

@@ -13,26 +13,22 @@ app = typer.Typer(no_args_is_help=True)
 
 @app.command()
 def login(headless: bool = typer.Option(False, help="Paste token instead of browser flow")):
-    """Log in to Kite via browser OAuth or token paste."""
+    """Log in to Kite in the browser (or by pasting a token): this machine gets its own API key, for 90 days."""
     from kite_cli.auth import login_browser, login_headless
 
-    if headless:
-        ok = login_headless()
-    else:
-        ok = login_browser()
-
-    if ok:
-        print_json({"logged_in": True})
+    kept = login_headless() if headless else login_browser()
+    if kept:
+        print_json({"logged_in": True, **kept})
     else:
         print_error("Login failed. Try --headless to paste a token manually.")
 
 
 @app.command()
 def logout():
-    """Clear stored credentials."""
-    from kite_cli.auth import clear_credentials
-    clear_credentials()
-    print_json({"logged_out": True})
+    """Revoke this machine's API key and clear the stored credentials."""
+    from kite_cli.auth import logout as _logout
+
+    print_json(_logout())
 
 
 @app.command()