morphcloud 0.1.112__tar.gz → 0.1.113__tar.gz

{morphcloud-0.1.112 → morphcloud-0.1.113}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: morphcloud
-Version: 0.1.112
+Version: 0.1.113
 Summary: A Python SDK and CLI tool for creating, managing, and interacting with Morph Cloud VMs.
 Author-email: Morph Labs <jobs@morph.so>
 License: Apache-2.0
@@ -720,16 +720,49 @@ morphcloud user api-key create
 # Delete an API key
 morphcloud user api-key delete <api_key_id>
 
-# Get your SSH public key
-morphcloud user ssh-key get
+# List named SSH public keys (fingerprints, expiry, and status)
+morphcloud user ssh-key list
+
+# Add a user-owned public key; never provide the private key
+morphcloud user ssh-key add --name "Work laptop" --public-key-file ~/.ssh/id_ed25519.pub
+
+# Inspect and edit one managed key by its stable ID
+morphcloud user ssh-key get <ssh_key_id>
+morphcloud user ssh-key edit <ssh_key_id> --expires 2030-01-01T00:00:00Z
+
+# Revoke only that key across your current organization memberships
+morphcloud user ssh-key revoke <ssh_key_id>
 
-# Set/update your SSH public key
+# Legacy singular compatibility commands remain available
+morphcloud user ssh-key get
 morphcloud user ssh-key set --public-key "ssh-rsa AAAA..."
 
 # View usage (3-hour lookback by default; supports 30m, 3h, 7d, etc.)
 morphcloud user usage --interval 3h
 ```
 
+The same managed-key lifecycle is typed in the SDK, with async methods using the
+usual `a` prefix (`alist_ssh_keys`, `aadd_ssh_key`, and so on):
+
+```python
+from pathlib import Path
+
+from morphcloud.api import MorphCloudClient
+
+client = MorphCloudClient()
+key = client.user.add_ssh_key(
+    name="Work laptop",
+    public_key=Path("~/.ssh/id_ed25519.pub").expanduser().read_text().strip(),
+)
+key = client.user.get_managed_ssh_key(key.id)
+key = client.user.edit_ssh_key(key.id, name="Work laptop (2026)")
+client.user.revoke_ssh_key(key.id)
+```
+
+Managed account public keys are separate from Morph-generated instance
+credentials and browser terminal access. A managed key is owned by one user and
+authorizes direct SSH through that user's current organization memberships.
+
 ## Advanced Features
 
 ### Profiles

{morphcloud-0.1.112 → morphcloud-0.1.113}/README.md

@@ -689,16 +689,49 @@ morphcloud user api-key create
 # Delete an API key
 morphcloud user api-key delete <api_key_id>
 
-# Get your SSH public key
-morphcloud user ssh-key get
+# List named SSH public keys (fingerprints, expiry, and status)
+morphcloud user ssh-key list
+
+# Add a user-owned public key; never provide the private key
+morphcloud user ssh-key add --name "Work laptop" --public-key-file ~/.ssh/id_ed25519.pub
+
+# Inspect and edit one managed key by its stable ID
+morphcloud user ssh-key get <ssh_key_id>
+morphcloud user ssh-key edit <ssh_key_id> --expires 2030-01-01T00:00:00Z
+
+# Revoke only that key across your current organization memberships
+morphcloud user ssh-key revoke <ssh_key_id>
 
-# Set/update your SSH public key
+# Legacy singular compatibility commands remain available
+morphcloud user ssh-key get
 morphcloud user ssh-key set --public-key "ssh-rsa AAAA..."
 
 # View usage (3-hour lookback by default; supports 30m, 3h, 7d, etc.)
 morphcloud user usage --interval 3h
 ```
 
+The same managed-key lifecycle is typed in the SDK, with async methods using the
+usual `a` prefix (`alist_ssh_keys`, `aadd_ssh_key`, and so on):
+
+```python
+from pathlib import Path
+
+from morphcloud.api import MorphCloudClient
+
+client = MorphCloudClient()
+key = client.user.add_ssh_key(
+    name="Work laptop",
+    public_key=Path("~/.ssh/id_ed25519.pub").expanduser().read_text().strip(),
+)
+key = client.user.get_managed_ssh_key(key.id)
+key = client.user.edit_ssh_key(key.id, name="Work laptop (2026)")
+client.user.revoke_ssh_key(key.id)
+```
+
+Managed account public keys are separate from Morph-generated instance
+credentials and browser terminal access. A managed key is owned by one user and
+authorizes direct SSH through that user's current organization memberships.
+
 ## Advanced Features
 
 ### Profiles

{morphcloud-0.1.112 → morphcloud-0.1.113}/morphcloud/api.py

@@ -13,7 +13,7 @@ from concurrent.futures import ThreadPoolExecutor, as_completed
 from functools import lru_cache
 
 import httpx
-from pydantic import BaseModel, Field, PrivateAttr
+from pydantic import BaseModel, Field, PrivateAttr, model_validator
 
 # Import Rich for fancy printing
 from rich.console import Console
@@ -52,10 +52,29 @@ class ApiError(Exception):
     def __init__(self, message: str, status_code: int, response_body: str):
         self.status_code = status_code
         self.response_body = response_body
+        self.error_code: typing.Optional[str] = None
+        self.detail: typing.Optional[str] = None
+        try:
+            payload = json.loads(response_body)
+            if isinstance(payload, dict):
+                error_code = payload.get("error_code")
+                detail = payload.get("detail")
+                if isinstance(error_code, str):
+                    self.error_code = error_code
+                if isinstance(detail, str):
+                    self.detail = detail
+        except (TypeError, ValueError):
+            pass
         super().__init__(
             f"{message}\nStatus Code: {status_code}\nResponse Body: {response_body}"
         )
 
+    def as_managed_ssh_key_error(self) -> typing.Optional["ManagedSSHKeyError"]:
+        """Return a typed managed-key error when the response uses that contract."""
+        if self.error_code is None or self.detail is None:
+            return None
+        return ManagedSSHKeyError(error_code=self.error_code, detail=self.detail)
+
 
 class ApiClient(httpx.Client):
     def raise_for_status(self, response: httpx.Response) -> None:
@@ -441,28 +460,146 @@ class UserAPI(BaseAPI):
         await self._client._async_http_client.delete(f"/user/secret/{secret_name}")
 
     # ────────────────────────────────
-    # SSH Key
+    # Managed SSH public keys
+    # ────────────────────────────────
+    def list_ssh_keys(self) -> typing.List["ManagedSSHKey"]:
+        """List all managed SSH public keys owned by the authenticated user."""
+        response = self._client._http_client.get("/user/ssh-keys")
+        return ManagedSSHKeyList.model_validate(response.json()).data
+
+    async def alist_ssh_keys(self) -> typing.List["ManagedSSHKey"]:
+        """Asynchronously list all managed SSH public keys owned by the user."""
+        response = await self._client._async_http_client.get("/user/ssh-keys")
+        return ManagedSSHKeyList.model_validate(response.json()).data
+
+    def get_managed_ssh_key(self, ssh_key_id: str) -> "ManagedSSHKey":
+        """Get one managed SSH public key by its stable ID."""
+        response = self._client._http_client.get(f"/user/ssh-keys/{ssh_key_id}")
+        return ManagedSSHKey.model_validate(response.json())
+
+    async def aget_managed_ssh_key(self, ssh_key_id: str) -> "ManagedSSHKey":
+        """Asynchronously get one managed SSH public key by its stable ID."""
+        response = await self._client._async_http_client.get(
+            f"/user/ssh-keys/{ssh_key_id}"
+        )
+        return ManagedSSHKey.model_validate(response.json())
+
+    def add_ssh_key(
+        self,
+        name: str,
+        public_key: str,
+        expires: typing.Optional[int] = None,
+    ) -> "ManagedSSHKey":
+        """Add a named SSH public key, optionally expiring at Unix seconds."""
+        request_body = ManagedSSHKeyCreateRequest(
+            name=name, public_key=public_key, expires=expires
+        )
+        response = self._client._http_client.post(
+            "/user/ssh-keys", json=request_body.model_dump(exclude_none=True)
+        )
+        return ManagedSSHKey.model_validate(response.json())
+
+    async def aadd_ssh_key(
+        self,
+        name: str,
+        public_key: str,
+        expires: typing.Optional[int] = None,
+    ) -> "ManagedSSHKey":
+        """Asynchronously add a named SSH public key."""
+        request_body = ManagedSSHKeyCreateRequest(
+            name=name, public_key=public_key, expires=expires
+        )
+        response = await self._client._async_http_client.post(
+            "/user/ssh-keys", json=request_body.model_dump(exclude_none=True)
+        )
+        return ManagedSSHKey.model_validate(response.json())
+
+    def edit_ssh_key(
+        self,
+        ssh_key_id: str,
+        *,
+        name: typing.Optional[str] = None,
+        expires: typing.Optional[int] = None,
+        clear_expiry: bool = False,
+    ) -> "ManagedSSHKey":
+        """Edit a key's name or expiry without changing its public material.
+
+        Pass ``clear_expiry=True`` to send an explicit JSON null for ``expires``.
+        """
+        request_body = _managed_ssh_key_patch_request(
+            name=name, expires=expires, clear_expiry=clear_expiry
+        )
+        response = self._client._http_client.patch(
+            f"/user/ssh-keys/{ssh_key_id}",
+            json=request_body.model_dump(exclude_unset=True),
+        )
+        return ManagedSSHKey.model_validate(response.json())
+
+    async def aedit_ssh_key(
+        self,
+        ssh_key_id: str,
+        *,
+        name: typing.Optional[str] = None,
+        expires: typing.Optional[int] = None,
+        clear_expiry: bool = False,
+    ) -> "ManagedSSHKey":
+        """Asynchronously edit a key's name or expiry."""
+        request_body = _managed_ssh_key_patch_request(
+            name=name, expires=expires, clear_expiry=clear_expiry
+        )
+        response = await self._client._async_http_client.patch(
+            f"/user/ssh-keys/{ssh_key_id}",
+            json=request_body.model_dump(exclude_unset=True),
+        )
+        return ManagedSSHKey.model_validate(response.json())
+
+    def revoke_ssh_key(self, ssh_key_id: str) -> None:
+        """Permanently revoke one managed SSH public key by stable ID."""
+        self._client._http_client.delete(f"/user/ssh-keys/{ssh_key_id}")
+
+    async def arevoke_ssh_key(self, ssh_key_id: str) -> None:
+        """Asynchronously revoke one managed SSH public key by stable ID."""
+        await self._client._async_http_client.delete(f"/user/ssh-keys/{ssh_key_id}")
+
+    # ────────────────────────────────
+    # Legacy singular SSH key compatibility
     # ────────────────────────────────
     def get_ssh_key(self) -> "UserSSHKey":
+        """Get the legacy singular key through its compatibility endpoint."""
         response = self._client._http_client.get("/user/ssh-key")
         return UserSSHKey.model_validate(response.json())
 
     async def aget_ssh_key(self) -> "UserSSHKey":
+        """Asynchronously get the legacy singular compatibility key."""
         response = await self._client._async_http_client.get("/user/ssh-key")
         return UserSSHKey.model_validate(response.json())
 
     def update_ssh_key(self, public_key: str) -> "UserSSHKey":
+        """Set the legacy singular compatibility key.
+
+        New integrations should use :meth:`add_ssh_key`, then revoke the old key
+        only after verifying the replacement.
+        """
         response = self._client._http_client.put(
             "/user/ssh-key", json={"public_key": public_key}
         )
         return UserSSHKey.model_validate(response.json())
 
     async def aupdate_ssh_key(self, public_key: str) -> "UserSSHKey":
+        """Asynchronously set the legacy singular compatibility key."""
         response = await self._client._async_http_client.put(
             "/user/ssh-key", json={"public_key": public_key}
         )
         return UserSSHKey.model_validate(response.json())
 
+    def set_ssh_key(self, public_key: str) -> "UserSSHKey":
+        """Compatibility alias for :meth:`update_ssh_key`."""
+        return self.update_ssh_key(public_key)
+
+    async def aset_ssh_key(self, public_key: str) -> "UserSSHKey":
+        """Async compatibility alias for :meth:`aupdate_ssh_key`."""
+        return await self.aupdate_ssh_key(public_key)
+
     # ────────────────────────────────
     # Usage
     # ────────────────────────────────
@@ -535,8 +672,83 @@ class CreateSecretRequest(BaseModel):
 
 
 class UserSSHKey(BaseModel):
+    """Legacy singular user SSH-key response."""
+
+    public_key: str
+    created: int
+
+
+class ManagedSSHKeyStatus(StrEnum):
+    ACTIVE = "active"
+    EXPIRED = "expired"
+    REVOKED = "revoked"
+    MIGRATION_WARNING = "migration_warning"
+
+
+class ManagedSSHKey(BaseModel):
+    """A user-owned SSH public key accepted through current org memberships."""
+
+    object: typing.Literal["user_ssh_key"] = "user_ssh_key"
+    id: str
+    name: str
     public_key: str
+    fingerprint: str
+    algorithm: str
     created: int
+    updated: int
+    expires: typing.Optional[int] = None
+    last_used: typing.Optional[int] = None
+    revoked: typing.Optional[int] = None
+    status: ManagedSSHKeyStatus
+    migrated_from_legacy: bool = False
+    migration_warning: bool = False
+
+
+class ManagedSSHKeyList(BaseModel):
+    object: typing.Literal["list"] = "list"
+    data: typing.List[ManagedSSHKey]
+
+
+class ManagedSSHKeyCreateRequest(BaseModel):
+    name: str
+    public_key: str
+    expires: typing.Optional[int] = None
+
+
+class ManagedSSHKeyPatchRequest(BaseModel):
+    name: typing.Optional[str] = None
+    expires: typing.Optional[int] = None
+
+    @model_validator(mode="after")
+    def require_change(self) -> "ManagedSSHKeyPatchRequest":
+        if not self.model_fields_set:
+            raise ValueError("at least one of name or expires must be provided")
+        return self
+
+
+class ManagedSSHKeyError(BaseModel):
+    """Stable machine-readable error returned by managed-key endpoints."""
+
+    detail: str
+    error_code: str
+
+
+def _managed_ssh_key_patch_request(
+    *,
+    name: typing.Optional[str],
+    expires: typing.Optional[int],
+    clear_expiry: bool,
+) -> ManagedSSHKeyPatchRequest:
+    if clear_expiry and expires is not None:
+        raise ValueError("expires and clear_expiry cannot be used together")
+    values: typing.Dict[str, typing.Any] = {}
+    if name is not None:
+        values["name"] = name
+    if clear_expiry:
+        values["expires"] = None
+    elif expires is not None:
+        values["expires"] = expires
+    return ManagedSSHKeyPatchRequest(**values)
 
 
 class UserInstanceUsage(BaseModel):

{morphcloud-0.1.112 → morphcloud-0.1.113}/morphcloud/cli.py

@@ -4,6 +4,7 @@ import datetime
 import importlib.metadata
 import json
 import os
+import pathlib
 import shlex
 import sys
 import termios
@@ -861,20 +862,153 @@ def user_secret_delete(name):
 cli.add_command(user_secret, name="secrets")
 
 
-# ── SSH Key ─────────────────────────────────────────────────
+# ── Managed SSH public keys ─────────────────────────────────
 
 
 @user.group(cls=AliasedGroup, name="ssh-key")
 def user_ssh_key():
-    """Manage user SSH public key."""
+    """Manage user-owned SSH public keys used for direct SSH."""
     pass
 
 
+def _read_ssh_public_key(
+    public_key: typing.Optional[str], public_key_file: typing.Optional[str]
+) -> str:
+    if public_key is not None and public_key_file is not None:
+        raise click.ClickException(
+            "Use either --public-key or --public-key-file, not both."
+        )
+    if public_key_file is not None:
+        path = pathlib.Path(public_key_file)
+        if path.suffix.lower() != ".pub":
+            raise click.ClickException(
+                "--public-key-file must point to a public .pub file, never a private key."
+            )
+        try:
+            public_key = path.read_text(encoding="utf-8")
+        except (OSError, UnicodeError) as exc:
+            raise click.ClickException(
+                f"Could not read public-key file: {exc}"
+            ) from exc
+    if public_key is None:
+        raise click.ClickException(
+            "Provide the public key with --public-key or --public-key-file."
+        )
+    value = public_key.strip()
+    if not value:
+        raise click.ClickException("SSH public key cannot be empty.")
+    if "PRIVATE KEY" in value:
+        raise click.ClickException(
+            "Private keys are not accepted. Provide only the public .pub value."
+        )
+    if "\n" in value or "\r" in value:
+        raise click.ClickException("Provide exactly one SSH public key.")
+    return value
+
+
+def _parse_ssh_expiry(
+    ctx: click.Context,
+    param: typing.Optional[click.Parameter],
+    value: typing.Optional[str],
+) -> typing.Optional[int]:
+    if value is None:
+        return None
+    try:
+        return int(value)
+    except ValueError:
+        pass
+    try:
+        parsed = datetime.datetime.fromisoformat(value.replace("Z", "+00:00"))
+    except ValueError as exc:
+        raise click.BadParameter(
+            "must be Unix seconds or an ISO 8601 datetime", ctx=ctx, param=param
+        ) from exc
+    if parsed.tzinfo is None:
+        parsed = parsed.replace(tzinfo=datetime.timezone.utc)
+    return int(parsed.timestamp())
+
+
+@user_ssh_key.command(name="list", aliases=["ls"])
+@click.option("--json", "json_mode", is_flag=True, default=False)
+def user_ssh_key_list(json_mode):
+    """List managed SSH public keys."""
+    client = get_client()
+    try:
+        keys = client.user.list_ssh_keys()
+        if json_mode:
+            click.echo(
+                json.dumps([key.model_dump(mode="json") for key in keys], indent=2)
+            )
+        else:
+            headers = [
+                "ID",
+                "Name",
+                "Algorithm",
+                "Fingerprint",
+                "Status",
+                "Created",
+                "Last Used",
+                "Expires",
+            ]
+            rows = [
+                [
+                    key.id,
+                    key.name,
+                    key.algorithm,
+                    key.fingerprint,
+                    key.status.value,
+                    unix_timestamp_to_datetime(key.created),
+                    unix_timestamp_to_datetime(key.last_used),
+                    unix_timestamp_to_datetime(key.expires),
+                ]
+                for key in keys
+            ]
+            print_docker_style_table(headers, rows)
+    except Exception as e:
+        handle_api_error(e)
+
+
 @user_ssh_key.command(name="get")
+@click.argument("ssh_key_id", required=False)
 @click.option("--json", "json_mode", is_flag=True, default=False)
-def user_ssh_key_get(json_mode):
+def user_ssh_key_get(ssh_key_id, json_mode):
+    """Get a managed key by ID, or the legacy singular key when ID is omitted."""
     client = get_client()
     try:
+        if ssh_key_id is not None:
+            info = client.user.get_managed_ssh_key(ssh_key_id)
+            if json_mode:
+                click.echo(format_json(info))
+            else:
+                headers = [
+                    "ID",
+                    "Name",
+                    "Algorithm",
+                    "Fingerprint",
+                    "Status",
+                    "Created",
+                    "Updated",
+                    "Last Used",
+                    "Expires",
+                    "Revoked",
+                ]
+                rows = [
+                    [
+                        info.id,
+                        info.name,
+                        info.algorithm,
+                        info.fingerprint,
+                        info.status.value,
+                        unix_timestamp_to_datetime(info.created),
+                        unix_timestamp_to_datetime(info.updated),
+                        unix_timestamp_to_datetime(info.last_used),
+                        unix_timestamp_to_datetime(info.expires),
+                        unix_timestamp_to_datetime(info.revoked),
+                    ]
+                ]
+                print_docker_style_table(headers, rows)
+            return
+
         info = client.user.get_ssh_key()
         if json_mode:
             click.echo(format_json(info))
@@ -886,6 +1020,120 @@ def user_ssh_key_get(json_mode):
         handle_api_error(e)
 
 
+@user_ssh_key.command(name="add", aliases=["create"])
+@click.option("--name", required=True, help="A unique, recognizable device name.")
+@click.option("--public-key", default=None, help="One OpenSSH public-key value.")
+@click.option(
+    "--public-key-file",
+    type=click.Path(exists=True, dir_okay=False, readable=True),
+    default=None,
+    help="Read the public key from a .pub file.",
+)
+@click.option(
+    "--expires",
+    callback=_parse_ssh_expiry,
+    default=None,
+    help="Optional expiry as Unix seconds or ISO 8601 (naive values are UTC).",
+)
+@click.option("--json", "json_mode", is_flag=True, default=False)
+def user_ssh_key_add(name, public_key, public_key_file, expires, json_mode):
+    """Add a managed SSH public key.
+
+    A user-owned key authorizes direct SSH through all current organization
+    memberships. Morph never asks for or stores the corresponding private key.
+    """
+    key_value = _read_ssh_public_key(public_key, public_key_file)
+    client = get_client()
+    try:
+        with Spinner(
+            text="Adding SSH public key...",
+            success_text="SSH public key added",
+            success_emoji="🔐",
+        ):
+            info = client.user.add_ssh_key(
+                name=name, public_key=key_value, expires=expires
+            )
+        if json_mode:
+            click.echo(format_json(info))
+        else:
+            click.secho("SSH public key added.", fg="green")
+            click.echo(f"ID: {info.id}")
+            click.echo(f"Name: {info.name}")
+            click.echo(f"Fingerprint: {info.fingerprint}")
+    except Exception as e:
+        handle_api_error(e)
+
+
+@user_ssh_key.command(name="edit")
+@click.argument("ssh_key_id")
+@click.option("--name", default=None, help="New recognizable device name.")
+@click.option(
+    "--expires",
+    callback=_parse_ssh_expiry,
+    default=None,
+    help="New expiry as Unix seconds or ISO 8601.",
+)
+@click.option(
+    "--clear-expiry",
+    is_flag=True,
+    default=False,
+    help="Remove the key's existing expiry.",
+)
+@click.option("--json", "json_mode", is_flag=True, default=False)
+def user_ssh_key_edit(ssh_key_id, name, expires, clear_expiry, json_mode):
+    """Edit a managed key's name or expiry; public material is immutable."""
+    if name is None and expires is None and not clear_expiry:
+        raise click.ClickException(
+            "Provide at least one of --name, --expires, or --clear-expiry."
+        )
+    if expires is not None and clear_expiry:
+        raise click.ClickException("Use either --expires or --clear-expiry, not both.")
+
+    client = get_client()
+    try:
+        with Spinner(
+            text="Editing SSH public key...",
+            success_text="SSH public key edited",
+            success_emoji="🔐",
+        ):
+            info = client.user.edit_ssh_key(
+                ssh_key_id, name=name, expires=expires, clear_expiry=clear_expiry
+            )
+        if json_mode:
+            click.echo(format_json(info))
+        else:
+            click.secho("SSH public key edited.", fg="green")
+            click.echo(f"ID: {info.id}")
+            click.echo(f"Name: {info.name}")
+            click.echo(f"Expires: {unix_timestamp_to_datetime(info.expires)}")
+    except Exception as e:
+        handle_api_error(e)
+
+
+@user_ssh_key.command(name="revoke", aliases=["rm"])
+@click.argument("ssh_key_id")
+@click.option("--yes", is_flag=True, help="Skip the confirmation prompt.")
+def user_ssh_key_revoke(ssh_key_id, yes):
+    """Revoke one managed key across all current organization memberships."""
+    if not yes:
+        click.confirm(
+            "Revoke this key for direct SSH across all current organization "
+            "memberships? Browser terminal and instance credentials are separate.",
+            abort=True,
+        )
+    client = get_client()
+    try:
+        with Spinner(
+            text="Revoking SSH public key...",
+            success_text="SSH public key revoked",
+            success_emoji="🗑",
+        ):
+            client.user.revoke_ssh_key(ssh_key_id)
+        click.secho("SSH public key revoked.", fg="green")
+    except Exception as e:
+        handle_api_error(e)
+
+
 @user_ssh_key.command(name="set", aliases=["update"])
 @click.option(
     "--public-key",
@@ -894,6 +1142,10 @@ def user_ssh_key_get(json_mode):
 )
 @click.option("--json", "json_mode", is_flag=True, default=False)
 def user_ssh_key_set(public_key, json_mode):
+    """Set the legacy singular compatibility key.
+
+    Prefer ``add`` for safe overlap rotation with managed keys.
+    """
     client = get_client()
     try:
         with Spinner(
@@ -901,7 +1153,7 @@ def user_ssh_key_set(public_key, json_mode):
             success_text="SSH key updated",
             success_emoji="🔐",
         ):
-            info = client.user.update_ssh_key(public_key)
+            info = client.user.set_ssh_key(public_key)
         if json_mode:
             click.echo(format_json(info))
         else: