lyceum-cli 1.2.2__tar.gz → 1.2.4__tar.gz

{lyceum_cli-1.2.2 → lyceum_cli-1.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lyceum-cli
-Version: 1.2.2
+Version: 1.2.4
 Summary: Command-line interface for Lyceum Cloud
 Author-email: Lyceum <support@lyceum.technology>
 License: MIT

{lyceum_cli-1.2.2 → lyceum_cli-1.2.4}/lyceum/_version.py

@@ -7,4 +7,4 @@ __version__ lives in this module. A future refactor could move these modules
 under lyceum/cli/, claiming one subpackage the way the other two do.
 """
 
-__version__ = "1.2.2"
+__version__ = "1.2.4"

lyceum_cli-1.2.4/lyceum/external/auth/callback_page.py

@@ -0,0 +1,308 @@
+"""Browser page shown by `lyceum auth login` after the dashboard hands back the session.
+
+The same frame as the dashboard's sign-in (`SignInFrame`): a white pane with one centred column on the left, and on
+wide screens the token grid on the right, a board of GPU tiles with tokens gliding along the rows. Everything is
+inline, so the page works offline and loads nothing from a CDN.
+"""
+
+import html
+
+_WORDMARK = (
+    '<svg class="wordmark" viewBox="0 0 544 82" role="img" aria-label="Lyceum" '
+    'xmlns="http://www.w3.org/2000/svg" fill="currentColor"><path d="M407.25 47.5198C407.25 58.0085 399.555 63.9212 388.731 63.9212C377.907 63.9212 370.322 58.0085 370.322 47.5198V1.89453H346V46.6286C346 68.9427 362.401 81.7698 388.281 81.7698C414.16 81.7698 430.897 68.9381 430.897 46.7388V1.89453H407.246V47.5244L407.25 47.5198Z"/><path d="M259.235 79.9873H334.87V63.811H283.442V48.1906H322.153V32.3497H283.442V18.4016H334.87V1.89453H259.235V79.9873Z"/><path d="M248.108 33.8043C244.864 12.7536 226.639 0 202.248 0C174.692 0 156.062 15.5101 156.062 40.9438C156.062 66.3774 174.692 81.8876 202.133 81.8876C226.602 81.8876 244.612 69.0743 248.021 48.0832H223.708C221.324 58.7097 213.031 64.4846 202.584 64.4846C189.642 64.4846 181.051 56.339 181.051 40.9438C181.051 25.5485 189.642 17.5178 202.694 17.5178C213.017 17.5178 221.314 23.2009 223.795 33.8043H248.108Z"/><path d="M24.207 1.89453H0V79.9873H74.9687V63.3607H24.207V1.89453Z"/><path d="M133.818 1.89453L109.455 49.5964H108.844L84.977 1.95426L84.9448 1.89453H59.0977L86.0842 52.4357L86.1163 52.4954H108.022L94.0506 79.7943L93.9679 79.9597H117.183L159.67 2.05992L159.762 1.89453H133.818Z"/><path d="M510.752 1.89453L501.83 27.6636L493.431 50.9977H492.375L484.202 27.6636L475.165 1.89453H442.031V79.9873H463.229L463.119 41.2717L463.008 24.9851L468.471 41.2717L481.973 79.9873H481.983H503.272H503.281L516.779 41.2717L522.246 24.9851L522.132 41.2717L521.911 79.9873H544V1.89453H510.752Z"/></svg>'
+)
+
+# Seconds before a successful sign-in closes its tab.
+CLOSE_AFTER = 10
+
+_STYLE = """
+:root {
+  --paper: #ffffff; --ink: #000114; --ink-2: #3d3e4f; --ink-3: #6b6c7d; --rule: #e7e7e7; --frame: #d3d3dc;
+  --accent: #2f0ac2; --wash: #f7f7fa; --bad: #c23934;
+  color-scheme: light;
+}
+@media (prefers-color-scheme: dark) {
+  :root {
+    --paper: #0b0c1a; --ink: #f2f2f5; --ink-2: #c4c5d4; --ink-3: #8e8fa6; --rule: #24263d; --frame: #34375a;
+    --accent: #6244f2; --wash: #10111f; --bad: #ef6b62;
+    color-scheme: dark;
+  }
+}
+* { box-sizing: border-box; }
+html, body { height: 100%; margin: 0; }
+body {
+  background: var(--paper); color: var(--ink); overflow: hidden;
+  font: 14px/20px Inter, -apple-system, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", sans-serif;
+  -webkit-font-smoothing: antialiased;
+}
+canvas { position: fixed; inset: 0; display: block; width: 100%; height: 100%; }
+.stage {
+  position: fixed; inset: 0; display: flex; align-items: center; justify-content: center; padding: 16px;
+  pointer-events: none;
+}
+.card {
+  position: relative; width: 100%; max-width: 520px; pointer-events: auto; text-align: center;
+  background: var(--paper); border: 1px solid var(--frame); box-shadow: 0 0 0 20px var(--paper);
+  animation: enter 240ms cubic-bezier(0.23, 1, 0.32, 1) both;
+}
+@keyframes enter { from { opacity: 0; transform: scale(0.96); } }
+.body { padding: 48px 40px 44px; }
+.wordmark { display: block; height: 18px; width: auto; margin: 0 auto 32px; }
+h1 { margin: 0; font-size: 44px; line-height: 48px; font-weight: 400; letter-spacing: -0.025em; text-wrap: balance; }
+.sub { margin: 16px 0 0; font-size: 17px; line-height: 24px; color: var(--ink-2); text-wrap: pretty; }
+.sub strong { color: var(--ink); font-weight: 500; }
+.details { margin: 28px 0 0; border: 1px solid var(--rule); text-align: left; font-size: 15px; line-height: 22px; }
+.details div { display: flex; justify-content: space-between; gap: 16px; padding: 10px 14px; }
+.details div + div { border-top: 1px solid var(--rule); }
+.details dt { color: var(--ink-3); flex: none; }
+.details dd { margin: 0; min-width: 0; overflow-wrap: anywhere; text-align: right; color: var(--ink-2); }
+.details strong { color: var(--ink); font-weight: 500; }
+.note { margin: 8px 0 0; font-size: 14px; line-height: 20px; color: var(--ink-3); }
+.count { font-variant-numeric: tabular-nums; }
+.bar { height: 2px; margin: 32px auto 0; max-width: 240px; background: var(--rule); overflow: hidden; }
+.bar i { display: block; height: 100%; background: var(--accent); transform-origin: left; animation: drain __CLOSE__s linear forwards; }
+@keyframes drain { from { transform: scaleX(1); } to { transform: scaleX(0); } }
+pre {
+  margin: 20px 0 0; padding: 12px 14px; text-align: left; white-space: pre-wrap; word-break: break-word;
+  border: 1px solid var(--rule); background: var(--wash); color: var(--bad);
+  font: 12px/18px "JetBrains Mono", ui-monospace, Menlo, monospace;
+}
+code { font: 12px/18px "JetBrains Mono", ui-monospace, Menlo, monospace; color: var(--ink); }
+a { color: inherit; text-decoration: underline; text-decoration-color: var(--frame); text-underline-offset: 3px; }
+a:hover { text-decoration-color: currentColor; }
+@media (max-width: 480px) { .details div { flex-direction: column; gap: 2px; } .details dd { text-align: left; } h1 { font-size: 34px; line-height: 40px; } .body { padding: 36px 20px 32px; } .card { box-shadow: 0 0 0 12px var(--paper); } }
+@media (prefers-reduced-motion: reduce) { .bar i, .card { animation: none; } }
+"""
+
+# The dashboard's token grid (TokenGrid.tsx), in plain JavaScript: square GPU tiles on a bus of hairlines, tokens
+# gliding along the rows and warming each tile they pass. The pointer warms the tiles round it and hurries its row; a
+# click sends a ripple. Still with reduced motion, and no frames while the tab is hidden.
+_GRID = """
+(function () {
+  var canvas = document.querySelector('canvas');
+  if (!canvas) return;
+  var ctx = canvas.getContext('2d');
+  var TILE = 28, GAP = 28, PITCH = TILE + GAP, COOL = 0.9, REACH = 1.8, HURRY = 2.6, RIPPLE = 9;
+  var w = 0, h = 0, sim = null, pointer = null, raf = 0, last = 0, ink = {};
+  var still = window.matchMedia('(prefers-reduced-motion: reduce)');
+  function seeded(s) { return function () { s = (s + 0x6d2b79f5) >>> 0; var x = Math.imul(s ^ (s >>> 15), 1 | s);
+    x = (x + Math.imul(x ^ (x >>> 7), 61 | x)) ^ x; return ((x ^ (x >>> 14)) >>> 0) / 4294967296; }; }
+  function readInk() { var css = getComputedStyle(document.documentElement);
+    ink = { paper: css.getPropertyValue('--paper').trim(), rule: css.getPropertyValue('--rule').trim(),
+            accent: css.getPropertyValue('--accent').trim() }; }
+  function build() {
+    var cols = Math.ceil((w + GAP) / PITCH) + 1;
+    var rows = Math.ceil((h + GAP) / PITCH) + 1;
+    var rand = seeded(20261016), tokens = [], n = Math.max(4, Math.round(rows * 1.6));
+    for (var i = 0; i < n; i++) tokens.push({ lane: Math.floor(rand() * rows), x: rand() * w, v: 22 + rand() * 34 });
+    sim = { cols: cols, rows: rows, ox: Math.round((w - (cols * PITCH - GAP)) / 2),
+            oy: Math.round((h - (rows * PITCH - GAP)) / 2), tokens: tokens, heat: new Float32Array(cols * rows),
+            lanes: new Float32Array(rows), ripples: [] };
+    for (var k = 0; k < 150; k++) step(1 / 30);
+  }
+  function at(x, y) { return { c: (x - sim.ox - TILE / 2) / PITCH, r: (y - sim.oy - TILE / 2) / PITCH }; }
+  function step(dt) {
+    var decay = Math.exp(-dt / COOL), i, r, c;
+    for (i = 0; i < sim.heat.length; i++) sim.heat[i] *= decay;
+    var hov = -1;
+    if (pointer) { var p = at(pointer.x, pointer.y), pr = Math.round(p.r); if (pr >= 0 && pr < sim.rows) hov = pr; }
+    var toward = Math.min(1, dt / 0.18);
+    for (r = 0; r < sim.rows; r++) sim.lanes[r] += ((r === hov ? 1 : 0) - sim.lanes[r]) * toward;
+    sim.tokens = sim.tokens.filter(function (t) {
+      t.x += t.v * dt * (t.lane === hov ? HURRY : 1);
+      if (t.x > w + 40) { if (t.once) return false; t.x = -40 - ((t.v * 7) % 120); }
+      var col = Math.floor((t.x - sim.ox) / PITCH);
+      if (col >= 0 && col < sim.cols && t.x - sim.ox - col * PITCH <= TILE) sim.heat[t.lane * sim.cols + col] = 1;
+      return true;
+    });
+    if (pointer) {
+      var a = at(pointer.x, pointer.y);
+      for (r = Math.max(0, Math.floor(a.r - REACH)); r <= Math.min(sim.rows - 1, Math.ceil(a.r + REACH)); r++)
+        for (c = Math.max(0, Math.floor(a.c - REACH)); c <= Math.min(sim.cols - 1, Math.ceil(a.c + REACH)); c++) {
+          var near = 1 - Math.hypot(c - a.c, r - a.r) / REACH;
+          if (near > 0) sim.heat[r * sim.cols + c] = Math.max(sim.heat[r * sim.cols + c], 0.8 * near * near);
+        }
+    }
+    sim.ripples = sim.ripples.filter(function (rp) {
+      var before = rp.age * RIPPLE; rp.age += dt; var front = rp.age * RIPPLE;
+      for (var r2 = 0; r2 < sim.rows; r2++) for (var c2 = 0; c2 < sim.cols; c2++) {
+        var ring = Math.max(Math.abs(c2 - rp.c), Math.abs(r2 - rp.r));
+        if (ring <= front && ring <= rp.reach && ring > before - 1e-6)
+          sim.heat[r2 * sim.cols + c2] = Math.max(sim.heat[r2 * sim.cols + c2], 1 - ring / (rp.reach + 1));
+      }
+      return front <= rp.reach;
+    });
+  }
+  function paint() {
+    var r, c, x, y;
+    ctx.globalAlpha = 1; ctx.fillStyle = ink.paper; ctx.fillRect(0, 0, w, h);
+    for (r = 0; r < sim.rows; r++) {
+      y = sim.oy + r * PITCH + TILE / 2;
+      [[ink.rule, 1], [ink.accent, sim.lanes[r] * 0.55]].forEach(function (pair) {
+        if (pair[1] < 0.01) return;
+        ctx.globalAlpha = pair[1]; ctx.fillStyle = pair[0]; ctx.fillRect(0, y, sim.ox, 1);
+        for (c = 0; c < sim.cols; c++) { x = sim.ox + c * PITCH + TILE; ctx.fillRect(x, y, c === sim.cols - 1 ? w - x : GAP, 1); }
+      });
+    }
+    var core = 8;
+    for (r = 0; r < sim.rows; r++) for (c = 0; c < sim.cols; c++) {
+      x = sim.ox + c * PITCH; y = sim.oy + r * PITCH;
+      ctx.globalAlpha = 1; ctx.strokeStyle = ink.rule; ctx.lineWidth = 1; ctx.strokeRect(x + 0.5, y + 0.5, TILE - 1, TILE - 1);
+      var heat = sim.heat[r * sim.cols + c];
+      if (heat > 0.03) {
+        ctx.globalAlpha = heat * 0.9; ctx.fillStyle = ink.accent;
+        ctx.fillRect(x + 5, y + 5, core, core); ctx.fillRect(x + TILE - 5 - core, y + 5, core, core);
+        ctx.fillRect(x + 5, y + TILE - 5 - core, core, core); ctx.fillRect(x + TILE - 5 - core, y + TILE - 5 - core, core, core);
+      }
+    }
+    if (pointer) {
+      var a = at(pointer.x, pointer.y), pc = Math.round(a.c), pr = Math.round(a.r);
+      if (pc >= 0 && pc < sim.cols && pr >= 0 && pr < sim.rows && Math.hypot(pc - a.c, pr - a.r) < 0.6) {
+        ctx.globalAlpha = 1; ctx.strokeStyle = ink.accent;
+        ctx.strokeRect(sim.ox + pc * PITCH + 0.5, sim.oy + pr * PITCH + 0.5, TILE - 1, TILE - 1);
+      }
+    }
+    ctx.fillStyle = ink.accent;
+    sim.tokens.forEach(function (t) {
+      var ty = sim.oy + t.lane * PITCH + TILE / 2 - 2;
+      ctx.globalAlpha = 1; ctx.fillRect(t.x, ty, 4, 4);
+      ctx.globalAlpha = 0.4; ctx.fillRect(t.x - 8, ty, 4, 4);
+      ctx.globalAlpha = 0.16; ctx.fillRect(t.x - 16, ty, 4, 4);
+    });
+    ctx.globalAlpha = 1;
+  }
+  function size() {
+    var rect = canvas.getBoundingClientRect(), dpr = Math.min(window.devicePixelRatio || 1, 2);
+    w = Math.round(rect.width); h = Math.round(rect.height);
+    canvas.width = Math.max(1, Math.round(w * dpr)); canvas.height = Math.max(1, Math.round(h * dpr));
+    ctx.setTransform(dpr, 0, 0, dpr, 0, 0);
+    if (w && h) { build(); paint(); }
+  }
+  function running() { return w > 0 && h > 0 && !document.hidden && !still.matches; }
+  function tick(now) {
+    raf = 0; if (!running()) return;
+    if (!last) last = now;
+    var elapsed = now - last;
+    if (elapsed >= 1000 / 30 - 1) { step(Math.min(elapsed, 100) / 1000); last = now; paint(); }
+    raf = requestAnimationFrame(tick);
+  }
+  function start() { if (raf) cancelAnimationFrame(raf); raf = 0; last = 0; if (running()) raf = requestAnimationFrame(tick); }
+  function local(e) { var b = canvas.getBoundingClientRect(); return { x: e.clientX - b.left, y: e.clientY - b.top }; }
+  canvas.addEventListener('pointermove', function (e) { if (!still.matches) pointer = local(e); });
+  canvas.addEventListener('pointerleave', function () { pointer = null; });
+  canvas.addEventListener('pointerdown', function (e) {
+    if (!sim || still.matches) return;
+    var p = local(e), a = at(p.x, p.y);
+    pulse(5, Math.max(0, Math.min(sim.cols - 1, Math.round(a.c))), Math.max(0, Math.min(sim.rows - 1, Math.round(a.r))));
+  });
+  function pulse(reach, c, r) {
+    if (!sim || still.matches || document.hidden) return;
+    sim.ripples.push({ c: c, r: r, age: 0, reach: reach });
+    var from = sim.ox + c * PITCH + TILE;
+    sim.tokens.push({ lane: r, x: from, v: 150, once: true }, { lane: r, x: from - 20, v: 120, once: true });
+  }
+  readInk(); size(); start();
+  setTimeout(function () { if (sim) pulse(7, Math.floor(sim.cols / 2), Math.floor(sim.rows / 2)); }, 250);
+  var rnd = seeded(7);
+  setInterval(function () { if (sim) pulse(3, Math.floor(rnd() * sim.cols), Math.floor(rnd() * sim.rows)); }, 2600);
+  new ResizeObserver(function () { size(); start(); }).observe(canvas);
+  document.addEventListener('visibilitychange', start);
+  still.addEventListener('change', start);
+  window.matchMedia('(prefers-color-scheme: dark)').addEventListener('change', function () { readInk(); if (sim) paint(); });
+})();
+"""
+
+# The session token arrived in the query string: keep it out of the address bar and the history.
+_SCRUB = "if (location.search) history.replaceState(null, '', location.pathname);"
+
+# Count down, then close the tab. Browsers only let a page close a tab a script opened, so if the tab is still here a
+# moment later, say so instead of pretending.
+_COUNTDOWN = """
+(function () {
+  var left = __CLOSE__, count = document.querySelector('.count'), sub = document.querySelector('.closing');
+  var timer = setInterval(function () {
+    left -= 1;
+    if (left > 0) { count.textContent = left + (left === 1 ? ' second' : ' seconds'); return; }
+    clearInterval(timer);
+    window.close();
+    setTimeout(function () {
+      sub.textContent = 'You can close this tab now.';
+      var bar = document.querySelector('.bar'); if (bar) bar.style.visibility = 'hidden';
+    }, 300);
+  }, 1000);
+})();
+"""
+
+
+_STYLE_CLOSING = _STYLE.replace("__CLOSE__", str(CLOSE_AFTER))
+
+
+def _page(title: str, body_html: str, scripts: str) -> str:
+    return f"""<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="referrer" content="no-referrer">
+<title>{html.escape(title)} | Lyceum CLI</title>
+<style>{_STYLE_CLOSING}</style>
+</head>
+<body>
+<canvas aria-hidden="true"></canvas>
+<div class="stage">
+  <main class="card">
+    <div class="body">{_WORDMARK}{body_html}</div>
+  </main>
+</div>
+<script>{_SCRUB}{_GRID}{scripts}</script>
+</body>
+</html>"""
+
+
+def success_page(
+    user: str | None, org: str | None = None, choose_org: bool = False
+) -> str:
+    """`org` is the organization the CLI uses; `choose_org` means it asks in the terminal. Either only for people in
+    more than one organization."""
+    rows = []
+    if user:
+        rows.append(("Signed in as", f"<strong>{html.escape(user)}</strong>"))
+    if org:
+        rows.append(("Organization", f"<strong>{html.escape(org)}</strong>"))
+    elif choose_org:
+        rows.append(("Organization", "Pick one in your terminal"))
+    details = (
+        '<dl class="details">'
+        + "".join(f"<div><dt>{k}</dt><dd>{v}</dd></div>" for k, v in rows)
+        + "</dl>"
+        if rows
+        else ""
+    )
+    return _page(
+        "Signed in",
+        "<h1>You're signed in</h1>"
+        f"{details}"
+        '<p class="sub">Head back to your terminal.</p>'
+        f'<p class="note closing">This tab closes in <span class="count">{CLOSE_AFTER} seconds</span>.</p>'
+        '<div class="bar" aria-hidden="true"><i></i></div>',
+        _COUNTDOWN.replace("__CLOSE__", str(CLOSE_AFTER)),
+    )
+
+
+def error_page(message: str, status: str = "Sign-in failed") -> str:
+    return _page(
+        status,
+        "<h1>Sign-in didn't work</h1>"
+        '<p class="sub">Run <code>lyceum auth login</code> in your terminal to try again.</p>'
+        f"<pre>{html.escape(message)}</pre>",
+        "",
+    )
+
+
+def warning_page(heading: str, message: str) -> str:
+    return _page(
+        heading,
+        f"<h1>{html.escape(heading)}</h1>"
+        f'<p class="sub">{html.escape(message)} Run <code>lyceum auth login</code> to start again.</p>',
+        "",
+    )

{lyceum_cli-1.2.2 → lyceum_cli-1.2.4}/lyceum/external/auth/login.py

@@ -1,6 +1,5 @@
 """Authentication commands: login, logout, status"""
 
-import html
 import socket
 import sys
 import threading
@@ -16,6 +15,7 @@ from rich.console import Console
 
 from ...shared.config import config
 from ...shared.orgs import explain, resolve_org_context
+from .callback_page import error_page, success_page, warning_page
 from .keys import keys_app
 
 console = Console()
@@ -26,48 +26,21 @@ auth_app.add_typer(keys_app, name="keys")
 # Global state for the OAuth callback server
 callback_result: dict[str, Any] = {"token": None, "error": None, "received": False}
 
-# (svg path, tailwind color) per page kind
-_PAGE_ICONS = {
-    "success": ("M5 13l4 4L19 7", "green"),
-    "error": ("M6 18L18 6M6 6l12 12", "red"),
-    "warning": (
-        "M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-2.5L13.732 4c-.77-.833-1.732-.833-2.5 0L3.268 16c-.77.833.192 2.5 1.732 2.5z",  # noqa: E501
-        "yellow",
-    ),
-}
-
-
-def _render_callback_page(kind: str, title: str, heading: str, sub_html: str, auto_close: bool = False) -> str:
-    """Render the browser page shown after the OAuth callback."""
-    icon_path, color = _PAGE_ICONS[kind]
-    script = "<script>setTimeout(() => window.close(), 10000);</script>" if auto_close else ""
-    return f"""<!DOCTYPE html>
-<html lang="en">
-<head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Lyceum CLI - {title}</title>
-    <script src="https://cdn.tailwindcss.com"></script>
-</head>
-<body class="min-h-screen bg-gray-50 flex items-center justify-center py-12 px-4">
-    <div class="max-w-md w-full bg-white rounded-lg shadow-md p-8 text-center">
-        <div class="mx-auto flex items-center justify-center h-16 w-16 rounded-full bg-{color}-100 mb-6">
-            <svg class="h-8 w-8 text-{color}-600" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="{icon_path}"></path>
-            </svg>
-        </div>
-        <h1 class="text-2xl font-bold text-gray-900 mb-2">{heading}</h1>
-        <div class="space-y-3 mb-8 text-gray-600">{sub_html}</div>
-        <div class="w-full py-3 px-4 bg-gray-50 text-gray-700 rounded-md border border-gray-200">
-            You can close this window now
-        </div>
-        <div class="mt-8 pt-6 border-t border-gray-200">
-            <p class="text-xs text-gray-400">Powered by Lyceum Technology</p>
-        </div>
-    </div>
-    {script}
-</body>
-</html>"""
+
+def _org_for_page(token: str) -> dict:
+    """Which organization the sign-in page names, for people in more than one: the pinned one if the new account
+    belongs to it, otherwise a note that the terminal asks. Best effort: the page names none on any error."""
+    try:
+        resp = httpx.get(f"{config.base_url}/api/v2/external/orgs", headers={"Authorization": f"Bearer {token}"}, timeout=4.0)
+        orgs = resp.json() if resp.status_code == 200 else []
+    except (httpx.HTTPError, ValueError):
+        return {}
+    if not isinstance(orgs, list) or len(orgs) < 2:
+        return {}
+    pinned = next((o for o in orgs if o.get("slug") == config.active_org_slug), None)
+    if pinned:
+        return {"org": pinned.get("name") or pinned["slug"]}
+    return {"choose_org": sys.stdin.isatty()}
 
 
 class CallbackHandler(BaseHTTPRequestHandler):
@@ -79,7 +52,7 @@ class CallbackHandler(BaseHTTPRequestHandler):
 
     def _send_page(self, status_code: int, html: str):
         self.send_response(status_code)
-        self.send_header("Content-type", "text/html")
+        self.send_header("Content-type", "text/html; charset=utf-8")
         self.end_headers()
         try:
             self.wfile.write(html.encode())
@@ -95,12 +68,7 @@ class CallbackHandler(BaseHTTPRequestHandler):
             if parsed_url.path != "/callback":
                 self._send_page(
                     404,
-                    _render_callback_page(
-                        "warning",
-                        "Page Not Found",
-                        "Page Not Found",
-                        "<p>The requested page could not be found.</p>",
-                    ),
+                    warning_page("Page not found", "This address only handles the sign-in callback."),
                 )
                 return
 
@@ -114,14 +82,7 @@ class CallbackHandler(BaseHTTPRequestHandler):
 
                 self._send_page(
                     200,
-                    _render_callback_page(
-                        "success",
-                        "Authentication Success",
-                        "Authentication Successful!",
-                        "<p class='text-lg'>Welcome to Lyceum</p>"
-                        "<p>You can now close this browser tab and return to the CLI.</p>",
-                        auto_close=True,
-                    ),
+                    success_page(callback_result.get("user"), **_org_for_page(callback_result["token"])),
                 )
             elif "error" in query_params:
                 error = query_params["error"][0]
@@ -130,13 +91,7 @@ class CallbackHandler(BaseHTTPRequestHandler):
 
                 self._send_page(
                     400,
-                    _render_callback_page(
-                        "error",
-                        "Authentication Error",
-                        "Authentication Failed",
-                        f"<div class='bg-red-50 border border-red-200 text-red-700 px-4 py-3 rounded-md'><p class='text-sm'>{html.escape(error)}</p></div>"  # noqa: E501
-                        "<p>Please try again or contact support if the issue persists.</p>",
-                    ),
+                    error_page(error),
                 )
             else:
                 callback_result["error"] = "Missing token or error parameter"
@@ -144,12 +99,7 @@ class CallbackHandler(BaseHTTPRequestHandler):
 
                 self._send_page(
                     400,
-                    _render_callback_page(
-                        "warning",
-                        "Invalid Parameters",
-                        "Invalid Parameters",
-                        "<p>The authentication callback received invalid parameters.</p>",
-                    ),
+                    warning_page("Sign-in link incomplete", "The dashboard sent back neither a session nor an error."),
                 )
 
         except Exception as e:
@@ -157,12 +107,7 @@ class CallbackHandler(BaseHTTPRequestHandler):
             callback_result["received"] = True
             self._send_page(
                 500,
-                _render_callback_page(
-                    "error",
-                    "Server Error",
-                    "Server Error",
-                    f"<div class='bg-red-50 border border-red-200 text-red-700 px-4 py-3 rounded-md'><p class='text-sm'>{html.escape(str(e))}</p></div>",  # noqa: E501,
-                ),
+                error_page(str(e), status="CLI error"),
             )
 
 

{lyceum_cli-1.2.2 → lyceum_cli-1.2.4}/lyceum/external/compute/inference/chat.py

@@ -1,6 +1,6 @@
 """Inference chat and embeddings commands.
 
-Serverless models (--model) go through the gateway's /serverless endpoints;
+Serverless models (--model) go through /openai/v1 on the API host;
 dedicated deployments (--deployment) go directly to the Iris proxy.
 """
 
@@ -83,9 +83,9 @@ def chat_cmd(
         }
 
         if model:
-            # Serverless: gateway routes by model name and bills per token.
+            # Serverless: routed by model name and billed per token.
             payload["model"] = model
-            url = f"{config.base_url}/api/v2/external/serverless/chat/completions"
+            url = f"{config.base_url}/openai/v1/chat/completions"
             headers = config.auth_headers()
             console.print(f"[dim]Sending to {model}...[/dim]")
         else:
@@ -129,7 +129,7 @@ def embeddings_cmd(
 
     data = api_request(
         "POST",
-        "/api/v2/external/serverless/embeddings",
+        "/openai/v1/embeddings",
         json={"model": model, "input": text},
         timeout=60.0,
     )

{lyceum_cli-1.2.2 → lyceum_cli-1.2.4}/lyceum/external/compute/inference/claude_code.py

@@ -19,7 +19,7 @@ console = Console()
 # or ~/.claude settings on this machine.
 CLAUDE_PROFILE_DIR = Path.home() / ".lyceum" / "claude"
 
-DEFAULT_MODEL = "moonshotai/kimi-k3"
+DEFAULT_MODEL = "moonshotai/kimi-k3.1-pro"
 DEFAULT_FAST_MODEL = "z-ai/glm-5.3-flash"
 
 # Use explicit Lyceum IDs so the backend never has to guess a substitute.

{lyceum_cli-1.2.2 → lyceum_cli-1.2.4}/lyceum/external/compute/inference/infer.py

@@ -74,7 +74,7 @@ def _is_dedicated_inference_hidden() -> bool:
 
 def _fetch_dedicated_models() -> list[dict]:
     """Serverless models a dedicated deployment may run, on their default GPU shape."""
-    return api_request("GET", "/api/v2/external/inference/models", timeout=20.0).get("models", [])
+    return api_request("GET", "/external/inference/models", timeout=20.0).get("models", [])
 
 
 def _format_gpus(gpu_type: str, gpu_count: int) -> str:
@@ -136,7 +136,7 @@ def serverless_models(
         "[dim]Note: 'infer models' now lists serverless models. "
         "For dedicated deployments use 'lyceum infer deployments'.[/dim]"
     )
-    data = api_request("GET", "/api/v2/external/serverless/models", timeout=20.0)
+    data = api_request("GET", "/openai/v1/models", timeout=20.0)
     models = data.get("data", []) if isinstance(data, dict) else data
 
     if as_json:
@@ -181,14 +181,27 @@ def deploy_model(
     target_latency: float = typer.Option(None, "--target-latency", hidden=True),
     stabilisation: int = typer.Option(None, "--stabilisation", hidden=True),
     gpu_count: int = typer.Option(
-        None, "--gpu-count", help="GPUs per replica, defaults per model (also sets --tensor-parallel-size)"
+        None,
+        "--gpu-count",
+        help="GPUs per replica, defaults per model (also sets --tensor-parallel-size)",
+    ),
+    offload: bool = typer.Option(
+        None,
+        "--offload/--no-offload",
+        help=(
+            "Serve requests the deployment cannot from Lyceum's serverless capacity (default off). That may include a "
+            "third-party provider under Lyceum's data terms unless your org is restricted to Lyceum's own"
+        ),
     ),
     yes: bool = typer.Option(False, "--yes", "-y", help="Do not ask before creating"),
     wait: bool = typer.Option(False, "--wait", "-w", help="Wait until deployment has healthy replicas"),
 ):
     """Deploy a serverless model on dedicated GPUs."""
     models = _fetch_dedicated_models()
-    model = next((m for m in models if model_id.lower() in (m["serving_name"].lower(), m["hf_model_id"].lower())), None)
+    model = next(
+        (m for m in models if model_id.lower() in (m["serving_name"].lower(), m["hf_model_id"].lower())),
+        None,
+    )
     if model is None:
         console.print(f"[red]{model_id} cannot be deployed on dedicated GPUs.[/red]")
         console.print("[dim]See the models that can: lyceum infer models --dedicated[/dim]")
@@ -222,7 +235,10 @@ def deploy_model(
             raise typer.Exit(0)
 
     if hf_token is None and not yes and not (os.getenv("HF_TOKEN") or os.getenv("HUGGING_FACE_HUB_TOKEN")):
-        if typer.confirm("No HF token detected. Provide one (required for gated models)?", default=False):
+        if typer.confirm(
+            "No HF token detected. Provide one (required for gated models)?",
+            default=False,
+        ):
             hf_token = typer.prompt("HuggingFace Token", hide_input=True)
 
     payload = {
@@ -233,6 +249,7 @@ def deploy_model(
     overrides = {
         "gpu_count": gpu_count,
         "gpu_type": gpu_type,
+        "offload": offload,
         "stabilisation_window": stabilisation,
         "target_latency_p95_ms": target_latency,
         "target_rps": target_rps,
@@ -241,7 +258,7 @@ def deploy_model(
     if hf_token:
         payload["hf_token"] = hf_token
 
-    data = api_request("POST", "/api/v2/external/inference/create", json=payload)
+    data = api_request("POST", "/external/inference/create", json=payload)
     deployment_id = data.get("deployment_id", "?")
 
     console.print("\n[green]Deployment created![/green]")
@@ -261,6 +278,30 @@ def deploy_model(
         _wait_for_healthy(deployment_id, timeout=model["ready_timeout_s"])
 
 
+def _offload_label(enabled: bool | None) -> str:
+    return "enabled" if enabled else "disabled"
+
+
+@infer_app.command("offload", hidden=_is_dedicated_inference_hidden())
+def set_offload(
+    deployment_id: str = typer.Argument(..., help="Deployment ID"),
+    enabled: bool = typer.Option(..., "--enable/--disable", help="Turn offloading on or off"),
+):
+    """Turn offloading on or off for a deployment.
+
+    Enabled, requests the deployment cannot serve go to Lyceum's serverless capacity,
+    which may include a third-party provider under Lyceum's data terms unless your
+    org is restricted to Lyceum's own.
+    """
+    data = api_request(
+        "POST",
+        "/external/inference/offload",
+        json={"deployment_id": deployment_id, "offload": enabled},
+    )
+    console.print(f"  Deployment ID: [cyan]{data.get('deployment_id')}[/cyan]")
+    console.print(f"  Offload:       [yellow]{_offload_label(data.get('offload'))}[/yellow]")
+
+
 @infer_app.command("stop")
 def stop_model(
     deployment_id: str = typer.Argument(..., help="Deployment ID to stop"),
@@ -268,7 +309,7 @@ def stop_model(
     """Stop a deployed model and all its replicas."""
     console.print(f"[dim]Stopping deployment {deployment_id[:12]}...[/dim]")
 
-    data = api_request("DELETE", "/api/v2/external/inference/stop", json={"deployment_id": deployment_id})
+    data = api_request("DELETE", "/external/inference/stop", json={"deployment_id": deployment_id})
     console.print("[green]Deployment stopped![/green]")
     console.print(f"  Deployment ID: [cyan]{data.get('deployment_id')}[/cyan]")
     console.print(f"  Status:        [yellow]{data.get('status')}[/yellow]")
@@ -283,7 +324,7 @@ def deployment_status(
     """Show detailed status of a deployment."""
     dep = api_request(
         "GET",
-        "/api/v2/external/inference/get",
+        "/external/inference/get",
         params={"deployment_id": deployment_id, "include_terminated": str(include_terminated).lower()},
         timeout=15.0,
     )
@@ -307,6 +348,8 @@ def deployment_status(
         console.print(f"  Target p95:     {dep['target_latency_p95_ms']} ms")
     if dep.get("stabilisation_window") is not None:
         console.print(f"  Stabilisation:  {dep['stabilisation_window']} s")
+    if dep.get("offload") is not None:
+        console.print(f"  Offload:        {_offload_label(dep['offload'])}")
 
     replicas = dep.get("replicas", [])
     if replicas:
@@ -359,7 +402,7 @@ def list_deployments(
     """List your dedicated deployments."""
     data = api_request(
         "GET",
-        "/api/v2/external/inference/list",
+        "/external/inference/list",
         params={"include_terminated": str(include_terminated).lower()},
         timeout=15.0,
     )
@@ -425,7 +468,7 @@ def replica_logs(
     replica_id: str = typer.Argument(..., help="Replica ID"),
 ):
     """Show last container logs for a failed replica."""
-    data = api_request("GET", f"/api/v2/external/inference/replica/{replica_id}/logs", timeout=15.0)
+    data = api_request("GET", f"/external/inference/replica/{replica_id}/logs", timeout=15.0)
     error_logs = data.get("error_logs")
     if not error_logs:
         console.print(f"[yellow]No logs available for replica {replica_id}[/yellow]")
@@ -445,7 +488,7 @@ def _wait_for_healthy(deployment_id: str, timeout: int = 600, poll_interval: int
         while time.time() < deadline:
             try:
                 response = httpx.get(
-                    f"{config.base_url}/api/v2/external/inference/get",
+                    f"{config.base_url}/external/inference/get",
                     headers=headers,
                     params={"deployment_id": deployment_id},
                     timeout=15.0,

{lyceum_cli-1.2.2 → lyceum_cli-1.2.4}/lyceum/external/orgs/management.py

@@ -325,7 +325,7 @@ def add_member(
     slug: str | None = typer.Option(None, "--org", help="Org slug (defaults to active)"),
     role: str = typer.Option("member", "--role", help="owner | admin | member"),
 ):
-    """Add a user by email. If the email isn't a Lyceum user yet, an invite is sent."""
+    """Invite a user by email. They join the org when they accept the invite."""
     slug = _resolve_slug(slug)
     res = _request(
         "POST",

{lyceum_cli-1.2.2 → lyceum_cli-1.2.4}/lyceum/shared/config.py

@@ -147,7 +147,7 @@ class _Config:
 
     def get_iris_url(self) -> str:
         """Get the Iris proxy URL. Resolution: IRIS_PROXY_URL env > iris_url config > prod default."""
-        return os.getenv("IRIS_PROXY_URL") or self.iris_url or "https://iris.lyceum.technology"
+        return os.getenv("IRIS_PROXY_URL") or self.iris_url or "https://api.lyceum.technology"
 
     def get_active_org_slug(self) -> str | None:
         """Resolution: --org flag > LYCEUM_ORG env > config file. Returns None if unset."""

{lyceum_cli-1.2.2 → lyceum_cli-1.2.4}/lyceum_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lyceum-cli
-Version: 1.2.2
+Version: 1.2.4
 Summary: Command-line interface for Lyceum Cloud
 Author-email: Lyceum <support@lyceum.technology>
 License: MIT

{lyceum_cli-1.2.2 → lyceum_cli-1.2.4}/lyceum_cli.egg-info/SOURCES.txt

@@ -5,6 +5,7 @@ lyceum/_version.py
 lyceum/main.py
 lyceum/external/__init__.py
 lyceum/external/auth/__init__.py
+lyceum/external/auth/callback_page.py
 lyceum/external/auth/environment.py
 lyceum/external/auth/keys.py
 lyceum/external/auth/login.py

{lyceum_cli-1.2.2 → lyceum_cli-1.2.4}/pyproject.toml

@@ -40,6 +40,11 @@ Dashboard = "https://dashboard.lyceum.technology"
 [project.scripts]
 lyceum = "lyceum.main:app"
 
+[dependency-groups]
+test = [
+    "pytest==9.0.2",
+]
+
 [tool.setuptools.dynamic]
 version = { attr = "lyceum._version.__version__" }
 

{lyceum_cli-1.2.2 → lyceum_cli-1.2.4}/tests/test_dedicated_deploy.py

@@ -29,11 +29,14 @@ def gateway(monkeypatch):
     creates = []
 
     def api_request(method, path, **kw):
-        if path == "/api/v2/external/inference/models":
+        if path == "/external/inference/models":
             return {"models": [GLM52, FLASH]}
-        if path == "/api/v2/external/inference/create":
+        if path == "/external/inference/create":
             creates.append(kw["json"])
             return {"deployment_id": "d1", "status": "pending"}
+        if path == "/external/inference/offload":
+            creates.append(kw["json"])
+            return kw["json"]
         raise AssertionError(path)
 
     monkeypatch.setattr(infer, "api_request", api_request)
@@ -103,3 +106,24 @@ def test_wait_uses_the_model_ready_timeout(gateway, monkeypatch):
     monkeypatch.setattr(infer, "_wait_for_healthy", lambda d, timeout: waited.append((d, timeout)))
     assert _run("deploy", "deepseek/deepseek-v4-flash-0731", "--wait").exit_code == 0
     assert waited == [("d1", 4800)]
+
+
+def test_deploy_offload_is_sent_only_when_given(gateway):
+    assert _run("deploy", "deepseek/deepseek-v4-flash-0731").exit_code == 0
+    assert "offload" not in gateway[0]
+    assert _run("deploy", "deepseek/deepseek-v4-flash-0731", "--offload").exit_code == 0
+    assert gateway[1]["offload"] is True
+    assert _run("deploy", "deepseek/deepseek-v4-flash-0731", "--no-offload").exit_code == 0
+    assert gateway[2]["offload"] is False
+
+
+def test_offload_command_posts_the_switch(gateway):
+    result = _run("offload", "d1", "--enable")
+    assert result.exit_code == 0
+    assert "enabled" in result.output
+    assert _run("offload", "d1", "--disable").exit_code == 0
+    assert gateway == [
+        {"deployment_id": "d1", "offload": True},
+        {"deployment_id": "d1", "offload": False},
+    ]
+    assert _run("offload", "d1").exit_code == 2