manifold-cli 0.0.39__py3-none-any.whl

manifold_cli/commands/table.py

@@ -0,0 +1,101 @@
+"""Headed tables for the listing commands."""
+
+from collections.abc import Iterable
+from datetime import datetime
+
+from rich.cells import cell_len
+from rich.console import Console
+from rich.measure import Measurement
+from rich.segment import Segment, Segments
+from rich.table import Table
+from rich.text import Text
+
+from manifold_cli.models.catalog import CatalogEntry
+
+# Wider than any terminal, so a table measured against it takes its natural width.
+UNBOUNDED_WIDTH = 1 << 20
+
+# The least of a display name worth showing before the row outgrows the terminal.
+NAME_MIN_WIDTH = 12
+
+
+def relative_time(instant: datetime | None, now: datetime) -> str:
+    """`3d ago`, `in 2h`, or `never`: the instant in its largest whole unit."""
+    if instant is None:
+        return "never"
+    seconds = int((instant - now).total_seconds())
+    magnitude = abs(seconds)
+    phrase = f"{magnitude}s"
+    for unit_seconds, suffix in ((86_400, "d"), (3_600, "h"), (60, "m")):
+        if magnitude >= unit_seconds:
+            phrase = f"{magnitude // unit_seconds}{suffix}"
+            break
+    return f"in {phrase}" if seconds > 0 else f"{phrase} ago"
+
+
+def terminal_width(console: Console) -> int | None:
+    """The console's width in a terminal, else None.
+
+    Rich reports 80 columns for a pipe, and a table cut to fit that would drop
+    text a script wanted whole.
+    """
+    return console.width if console.is_terminal else None
+
+
+def catalog_table(entries: Iterable[CatalogEntry], width: int | None) -> Table:
+    """One row per policy or benchmark: its owner, slug, and display name.
+
+    The owner and slug are what a reference is typed from, so they are shown
+    whole. The name is prose that can run long: given a terminal `width`, it
+    gets what the other two leave and is cut at the edge with an ellipsis
+    rather than wrapped, so a row stays one line and the columns aligned.
+    Given None, every name is shown whole.
+    """
+    entries = list(entries)
+    table = Table(box=None, pad_edge=False)
+    table.add_column("Owner", no_wrap=True)
+    table.add_column("Identifier", no_wrap=True)
+    name_width = None
+    if width is not None:
+        _, right, _, left = table.padding
+        owner_width = max(
+            cell_len("Owner"), *(cell_len(e.owner_org_slug) for e in entries)
+        )
+        slug_width = max(cell_len("Identifier"), *(cell_len(e.slug) for e in entries))
+        name_width = max(
+            width - owner_width - slug_width - 2 * (left + right), NAME_MIN_WIDTH
+        )
+    table.add_column("Name", no_wrap=True, overflow="ellipsis", max_width=name_width)
+    for entry in entries:
+        table.add_row(
+            Text(entry.owner_org_slug),
+            Text(entry.slug, style="bold"),
+            Text(entry.display_name),
+        )
+    return table
+
+
+def print_table(console: Console, table: Table) -> None:
+    """Print a table at its own width, one line per row.
+
+    Rich fits a table to the console by wrapping cells and truncating what
+    still overflows, which turns a row into several lines and drops the tail
+    of a cell. Rendering at the table's own width leaves any overflow to the
+    terminal, and a pipe gets one whole row per line. Rich also pads every
+    cell to its column, so a row whose last cell runs short would end in
+    spaces; those are stripped.
+    """
+    width = Measurement.get(
+        console, console.options.update_width(UNBOUNDED_WIDTH), table
+    ).maximum
+    lines = console.render_lines(table, console.options.update_width(width), pad=False)
+    for line in lines:
+        while line and not line[-1].text.strip():
+            line.pop()
+        if line:
+            last = line[-1]
+            line[-1] = Segment(last.text.rstrip(), last.style, last.control)
+    console.print(
+        Segments(segment for line in lines for segment in (*line, Segment.line())),
+        crop=False,
+    )

manifold_cli/commands/token.py

@@ -0,0 +1,144 @@
+"""Create and manage access tokens."""
+
+import json
+import re
+import unicodedata
+from datetime import UTC, datetime, timedelta
+from typing import Annotated
+from uuid import UUID
+
+import typer
+from rich.console import Console
+from rich.markup import escape
+from rich.table import Table
+
+from manifold_cli.commands.organization import (
+    ORGANIZATION_CALL_ERRORS,
+    exit_for_call_error,
+)
+from manifold_cli.commands.table import print_table, relative_time
+from manifold_cli.dependencies import Dependencies
+from manifold_cli.models.token import AccessTokenNotFoundError, Scope
+
+
+def register(app: typer.Typer, deps: Dependencies) -> None:
+    console = Console()
+    token_app = typer.Typer(
+        name="token",
+        help="Manage access tokens.",
+        no_args_is_help=True,
+        hidden=True,
+    )
+    app.add_typer(token_app)
+
+    @token_app.command()
+    def create(
+        name: Annotated[str, typer.Argument(help="Name for the access token.")],
+        scopes: Annotated[
+            list[Scope],
+            typer.Option(
+                "--scope",
+                help="Operation the token may perform. Repeat for more than one.",
+            ),
+        ],
+        expires_in: Annotated[
+            str | None,
+            typer.Option(
+                "--expires-in",
+                help=(
+                    "Time until expiry, from 1d to 90d. "
+                    "Omit if the token should never expire."
+                ),
+            ),
+        ] = None,
+    ) -> None:
+        """Create an access token and print its plaintext once."""
+        expires_at = _parse_expiry(expires_in)
+        try:
+            created = deps.token_service.create(name, scopes, expires_at=expires_at)
+        except ORGANIZATION_CALL_ERRORS as exc:
+            raise exit_for_call_error(console, exc) from exc
+        console.print(
+            f"[green]✓ Access token created[/green] "
+            f"[bold]{created.access_token.id}[/bold]  "
+            f"{escape(_escape_control_characters(created.access_token.name))}",
+            soft_wrap=True,
+        )
+        console.print(created.token, markup=False, soft_wrap=True)
+        console.print("Store this token now. It will not be shown again.")
+
+    @token_app.command("list")
+    def list_access_tokens() -> None:
+        """List access tokens without their plaintext."""
+        try:
+            access_tokens = deps.token_service.list()
+        except ORGANIZATION_CALL_ERRORS as exc:
+            raise exit_for_call_error(console, exc) from exc
+        now = datetime.now(UTC)
+        active_access_tokens = [
+            access_token
+            for access_token in access_tokens
+            if access_token.revoked_at is None
+            and (access_token.expires_at is None or access_token.expires_at > now)
+        ]
+        if len(active_access_tokens) == 0:
+            console.print(
+                "You have no active access tokens. Create one with: "
+                "manifold token create NAME --scope runners:create",
+                soft_wrap=True,
+            )
+            return
+        table = Table(box=None, pad_edge=False)
+        for heading in ("Id", "Name", "Created", "Expires", "Last used"):
+            table.add_column(heading, no_wrap=True)
+        for access_token in active_access_tokens:
+            table.add_row(
+                f"[bold]{access_token.id}[/bold]",
+                escape(_escape_control_characters(access_token.name)),
+                relative_time(access_token.created_at, now),
+                relative_time(access_token.expires_at, now),
+                relative_time(access_token.last_used_at, now),
+            )
+        print_table(console, table)
+
+    @token_app.command()
+    def revoke(
+        token_id: Annotated[UUID, typer.Argument(help="Access token id.")],
+    ) -> None:
+        """Revoke an access token."""
+        try:
+            access_token = deps.token_service.revoke(token_id)
+        except AccessTokenNotFoundError as exc:
+            console.print(f"[red]{escape(str(exc))}[/red]")
+            raise typer.Exit(1) from exc
+        except ORGANIZATION_CALL_ERRORS as exc:
+            raise exit_for_call_error(console, exc) from exc
+        console.print(
+            f"[green]✓ Access token revoked[/green] "
+            f"[bold]{access_token.id}[/bold]  "
+            f"{escape(_escape_control_characters(access_token.name))}",
+            soft_wrap=True,
+        )
+
+
+def _parse_expiry(value: str | None) -> datetime | None:
+    if value is None:
+        return None
+    match = re.fullmatch(r"([1-9][0-9]?)d", value)
+    if match is not None:
+        days = int(match.group(1))
+        if days <= 90:
+            return datetime.now(UTC) + timedelta(days=days)
+    raise typer.BadParameter(
+        "must be a whole number of days between 1d and 90d",
+        param_hint="'--expires-in'",
+    )
+
+
+def _escape_control_characters(value: str) -> str:
+    return "".join(
+        json.dumps(character)[1:-1]
+        if unicodedata.category(character) == "Cc"
+        else character
+        for character in value
+    )

manifold_cli/dependencies.py

@@ -0,0 +1,116 @@
+from dataclasses import dataclass
+
+from manifold_cli.clients.auth_flow import (
+    InMemoryRunnerTokenAuth,
+    RunnerAuth,
+    StaticTokenAuth,
+    WorkOSAuth,
+)
+from manifold_cli.clients.credentials import CredentialsClient
+from manifold_cli.clients.image import DockerImageClient
+from manifold_cli.clients.manifold import ManifoldApiClient
+from manifold_cli.clients.runner_home import RunnerHomeClient, RunnerHomes
+from manifold_cli.clients.workos import WorkOSDeviceClient
+from manifold_cli.models.errors import (
+    NoRunnerCredentialError,
+    RunnerDeploymentMismatchError,
+)
+from manifold_cli.services.auth import AuthService
+from manifold_cli.services.benchmark import BenchmarkService
+from manifold_cli.services.organization import OrganizationService
+from manifold_cli.services.policy import PolicyService
+from manifold_cli.services.run import RunService
+from manifold_cli.services.runner import RunnerService
+from manifold_cli.services.runner_daemon import (
+    RunnerDaemonManager,
+    RunnerDaemonService,
+)
+from manifold_cli.services.token import TokenService
+from manifold_cli.settings import Settings
+
+
+@dataclass(frozen=True, slots=True)
+class Dependencies:
+    auth_service: AuthService
+    organization_service: OrganizationService
+    policy_service: PolicyService
+    benchmark_service: BenchmarkService
+    run_service: RunService
+    runner_service: RunnerService
+    token_service: TokenService
+    runner_daemon_service: RunnerDaemonManager
+    # Where `runner register` puts the homes of the runners on this box. The
+    # runner's own client is built from one separately; nothing a user runs
+    # authenticates as a runner.
+    runner_homes: RunnerHomes
+    manifold_token: str | None
+    manifold_api_url: str
+    manifold_webapp_url: str
+
+
+def build_dependencies() -> Dependencies:
+    settings = Settings()
+    credentials_client = CredentialsClient(settings.CREDENTIALS_PATH)
+    runner_homes = RunnerHomes(settings.MANIFOLD_RUNNERS_DIR)
+
+    # The client authenticates via a flow that refreshes tokens, and refreshing
+    # needs the CLI config that only the client can fetch. The cycle is broken
+    # lazily: get_cli_config is deferred until login/refresh, by which point
+    # manifold_client below is bound.
+    workos_client = WorkOSDeviceClient(
+        config_provider=lambda: manifold_client.get_cli_config()
+    )
+    auth = WorkOSAuth(credentials=credentials_client, refresher=workos_client)
+    manifold_client = ManifoldApiClient(settings.MANIFOLD_API_URL, auth=auth)
+
+    auth_service = AuthService(
+        manifold_client=manifold_client,
+        workos_client=workos_client,
+        credentials_client=credentials_client,
+        manifold_api_url=settings.MANIFOLD_API_URL,
+    )
+    return Dependencies(
+        auth_service=auth_service,
+        organization_service=OrganizationService(manifold_client=manifold_client),
+        policy_service=PolicyService(manifold_client=manifold_client),
+        benchmark_service=BenchmarkService(
+            manifold_client=manifold_client, image_client=DockerImageClient()
+        ),
+        run_service=RunService(manifold_client=manifold_client),
+        runner_service=RunnerService(manifold_client=manifold_client),
+        token_service=TokenService(manifold_client=manifold_client),
+        runner_daemon_service=RunnerDaemonService.for_current_process(),
+        runner_homes=runner_homes,
+        manifold_token=settings.MANIFOLD_TOKEN,
+        manifold_api_url=settings.MANIFOLD_API_URL,
+        manifold_webapp_url=settings.MANIFOLD_WEBAPP_URL,
+    )
+
+
+def make_runner_client(home: RunnerHomeClient, api_url: str) -> ManifoldApiClient:
+    """A client presenting one home's runner token instead of a user session.
+
+    Built where it is needed rather than in `build_dependencies`, because
+    building one reads the home and a box with none still runs every other
+    command.
+
+    Refuses a credential minted against another deployment, which is what
+    `RunnerCredential.api_url` is stored for. Left to `RunnerAuth`, the token
+    would reach the configured host and come back a bare 401.
+    """
+    stored = home.load()
+    if stored is None:
+        raise NoRunnerCredentialError
+    if stored.credential.api_url.rstrip("/") != api_url.rstrip("/"):
+        raise RunnerDeploymentMismatchError(stored.credential.api_url, api_url)
+    return ManifoldApiClient(api_url, auth=RunnerAuth(home))
+
+
+def make_in_memory_runner_client(token: str, api_url: str) -> ManifoldApiClient:
+    """Build a client that authenticates with an in-memory runner token."""
+    return ManifoldApiClient(api_url, auth=InMemoryRunnerTokenAuth(token))
+
+
+def make_runner_registration_client(token: str, api_url: str) -> ManifoldApiClient:
+    """Build the command-local client that presents an exported access token."""
+    return ManifoldApiClient(api_url, auth=StaticTokenAuth(token))

manifold_cli/models/auth.py

@@ -0,0 +1,49 @@
+from dataclasses import dataclass
+from datetime import datetime
+from enum import Enum, StrEnum
+from uuid import UUID
+
+from pydantic import BaseModel
+
+
+class CliConfig(BaseModel):
+    workos_client_id: str
+    authorization_endpoint: str
+    token_endpoint: str
+
+
+class User(BaseModel):
+    id: UUID
+    email: str
+    last_login_at: datetime | None
+
+
+class DeviceAuthorization(BaseModel):
+    device_code: str
+    user_code: str
+    verification_uri: str
+    verification_uri_complete: str
+    expires_in: int
+    interval: int
+
+
+class TokenResponse(BaseModel):
+    access_token: str
+    refresh_token: str
+
+
+class PollPending(Enum):
+    PENDING = "authorization_pending"
+    SLOW_DOWN = "slow_down"
+
+
+class AuthState(StrEnum):
+    LOGGED_OUT = "logged_out"
+    SESSION_EXPIRED = "session_expired"
+    LOGGED_IN = "logged_in"
+
+
+@dataclass(frozen=True)
+class AuthStatus:
+    state: AuthState
+    user: User | None = None

manifold_cli/models/benchmark.py

@@ -0,0 +1,87 @@
+from datetime import datetime
+from typing import Any
+from uuid import UUID
+
+from pydantic import BaseModel
+
+from manifold_cli.models.catalog import Adapter, Visibility
+
+
+class Benchmark(BaseModel):
+    """One benchmark suite — the unit a run executes against.
+
+    A suite is a benchmark rather than a field on one, so LIBERO's spatial and
+    object suites are two entries here, each with its own slug and versions.
+
+    As on `Policy`, the slug is unique only within the owning organization.
+    """
+
+    id: UUID
+    owner_user_id: UUID
+    owner_org_id: UUID
+    owner_org_slug: str
+    slug: str
+    display_name: str
+    visibility: Visibility
+    created_at: datetime
+    updated_at: datetime
+
+
+class BenchmarkVersion(BaseModel):
+    """A runnable build of a benchmark — the environment a run executes against.
+
+    `episodes` is fixed by the version rather than asked for at submit: every
+    run of it executes that many. `shards` is how many parallel partitions it
+    divides those episodes across, declared the same way but only as a default:
+    `run submit --shards` overrides it for one run. One shard means the build
+    does not partition. Registration clamps a count above `episodes` down to
+    it, so only a version registered before that rule can carry more.
+    `shards_per_gpu`, when set, replaces `shards` with that many shards per GPU
+    of each benchmark runner. A backend that predates `shards_per_gpu` omits
+    the field. The driver requirement also belongs to the version because it
+    describes which runners may execute that build.
+    """
+
+    id: UUID
+    benchmark_id: UUID
+    version: str
+    adapter: Adapter
+    config: dict[str, Any]
+    minimum_gpu_memory_gb: int
+    minimum_driver_major: int | None
+    maximum_driver_major: int | None
+    minimum_gpu_count: int | None = None
+    episodes: int
+    shards: int
+    shards_per_gpu: int | None = None
+    created_at: datetime
+    updated_at: datetime
+
+
+class RubricContent(BaseModel):
+    groups: list[Any]
+    tasks: list[Any]
+    grading: dict[str, Any] = {}
+
+
+class BenchmarkNotFoundError(Exception):
+    """No benchmark visible to the caller matches this reference.
+
+    Carries the server's message, which contains the reference that failed to
+    resolve.
+    """
+
+
+class InvalidImageSpecError(Exception):
+    """The spec file in an image is not a JSON object.
+
+    The message names the image. A missing spec file is not an error.
+    """
+
+
+class InvalidImageRubricError(Exception):
+    """An image carries a rubric that cannot be published.
+
+    Carries a message naming the image. An image carrying no rubric at all is
+    not this: that is the ordinary case and reads as None.
+    """

manifold_cli/models/catalog.py

@@ -0,0 +1,189 @@
+"""Vocabulary shared by the policy and benchmark entities, as on the backend.
+
+Runs use `Visibility` too; the rest is policy and benchmark only.
+"""
+
+import re
+from datetime import datetime
+from enum import StrEnum
+from typing import Protocol
+
+
+class Visibility(StrEnum):
+    """Read scope of a policy or benchmark."""
+
+    OWNER = "owner"
+    ORG = "org"
+    PUBLIC = "public"
+
+
+class Adapter(StrEnum):
+    """How a policy or benchmark version is reached at run time."""
+
+    CONTAINER = "container"
+    SUBPROCESS = "subprocess"
+
+
+class CatalogEntry(Protocol):
+    """A policy or benchmark: a slug under the organization owning it."""
+
+    owner_org_slug: str
+    slug: str
+    display_name: str
+
+
+class CatalogVersion(Protocol):
+    """One registered version of a policy or benchmark."""
+
+    created_at: datetime
+
+
+class InvalidReferenceError(Exception):
+    """A reference is neither `<slug>` nor `<org>/<slug>`.
+
+    Carries a message quoting what was typed.
+    """
+
+
+class InvalidImageError(Exception):
+    """A container image reference does not name the version it would register.
+
+    Carries a message quoting what was typed.
+    """
+
+
+class CatalogRegisterError(Exception):
+    """The server refused to register a policy or benchmark.
+
+    This is typically a permissions error.
+    """
+
+
+# A valid tag, as defined by the OCI distribution spec.
+TAG_PATTERN = re.compile(r"[a-zA-Z0-9_][a-zA-Z0-9._-]{0,127}\Z")
+
+
+def split_ref(ref: str) -> tuple[str | None, str]:
+    """Split a policy or benchmark reference into its owning organization and slug.
+
+    A reference is `<slug>` or `<org>/<slug>`; an unqualified one names no owner
+    (None comes back), and resolving it is the caller's job: the server looks in
+    the submitter's own organization first and then at public entries, and the
+    listing commands follow suit.
+
+    Raises InvalidReferenceError for a malformed reference, as validate_ref does.
+    """
+    validate_ref(ref)
+    owner, separator, slug = ref.partition("/")
+    if not separator:
+        return None, ref
+    return owner, slug
+
+
+def split_versioned_ref(ref: str) -> tuple[str | None, str, str | None]:
+    """Split `[<org>/]<slug>[:<version>]` into the owner, the slug and the version.
+
+    `run submit`, `policy serve` and the delete commands take this form, for
+    example `my-policy:0.0.1`. The owner and the version are None when the reference
+    leaves them out.
+
+    Raises InvalidReferenceError for a malformed reference, for an empty
+    version, for a version that contains `:`, and for a version of `.` or
+    `..`. httpx removes a `.` or `..` path segment, so the URL for such a
+    version would be the URL of the policy or benchmark itself.
+    """
+    name, separator, version = ref.partition(":")
+    if not separator:
+        owner, slug = split_ref(ref)
+        return owner, slug, None
+    if ":" in version:
+        raise InvalidReferenceError(
+            "A version cannot contain ':'. For example: my-policy:0.0.1."
+        )
+    if not version:
+        raise InvalidReferenceError(
+            f"'{ref}' has no version after ':'. For example: my-policy:0.0.1."
+        )
+    if version in (".", ".."):
+        raise InvalidReferenceError(
+            f"'{version}' is not a version. For example: my-policy:0.0.1."
+        )
+    owner, slug = split_ref(name)
+    return owner, slug, version
+
+
+def join_versioned_ref(owner: str | None, slug: str, version: str | None) -> str:
+    """Write a reference in the form that `split_versioned_ref` reads."""
+    ref = slug if owner is None else f"{owner}/{slug}"
+    return ref if version is None else f"{ref}:{version}"
+
+
+def validate_ref(ref: str) -> None:
+    """Raise InvalidReferenceError unless `ref` is `<slug>` or `<org>/<slug>`.
+
+    A slug is one path segment, so a second separator or an empty half is
+    rejected. An unchecked remainder rides into a URL path, or into a submit body
+    that the server splits at the first separator of its own accord. The error
+    that comes back then quotes neither what was typed nor the form the server
+    wanted.
+
+    `run submit` validates without splitting: it sends a reference whole and the
+    server resolves it.
+    """
+    owner, separator, slug = ref.partition("/")
+    if not separator:
+        if not ref:
+            raise InvalidReferenceError("A reference cannot be empty.")
+        return
+    if not owner or not slug or "/" in slug:
+        raise InvalidReferenceError(
+            f"'{ref}' is not a reference; write <identifier> or <org>/<identifier>."
+        )
+
+
+def version_from_image(image: str) -> str:
+    """The version a container image registers as, which is its tag for now.
+
+    Raises InvalidImageError for a reference that names no version: one with no
+    tag, one pinned to a digest, one tagged `latest`, or one whose tag is not a
+    valid OCI tag.
+    """
+    if not image:
+        raise InvalidImageError("An image reference cannot be empty.")
+    if "@" in image:
+        raise InvalidImageError(
+            f"'{image}' is pinned to a digest, which names no version; "
+            "write <image>:<tag>."
+        )
+    repository, separator, tag = image.rpartition(":")
+    if not separator or not tag or "/" in tag:
+        raise InvalidImageError(
+            f"'{image}' has no tag; write <image>:<tag>, and the tag is the "
+            "version it registers as."
+        )
+    if not repository:
+        raise InvalidImageError(f"'{image}' names no image before its tag.")
+    if TAG_PATTERN.match(tag) is None:
+        raise InvalidImageError(
+            f"'{tag}' is not a tag; a tag starts with a letter, digit or '_' "
+            "and continues with those, '.' or '-'."
+        )
+    if tag == "latest":
+        raise InvalidImageError(
+            "'latest' moves between images, so it names no version; tag the "
+            "image with a version string."
+        )
+    return tag
+
+
+def in_owner_order[T: CatalogEntry](entries: list[T]) -> list[T]:
+    """Entries by owner, then by slug, so one owner's entries read together."""
+    return sorted(entries, key=lambda entry: (entry.owner_org_slug, entry.slug))
+
+
+def newest_first[T: CatalogVersion](versions: list[T]) -> list[T]:
+    """Versions newest first.
+
+    Version strings are free text, so versions sort by creation time.
+    """
+    return sorted(versions, key=lambda version: version.created_at, reverse=True)