morphy-cli 0.5.0__tar.gz

morphy_cli-0.5.0/PKG-INFO

@@ -0,0 +1,136 @@
+Metadata-Version: 2.4
+Name: morphy-cli
+Version: 0.5.0
+Summary: MORPHY — governed natural-language database terminal
+Author-email: Ananya Kalia <ananyakalia2704@gmail.com>
+Project-URL: Homepage, https://morphy-web.vercel.app
+Project-URL: Repository, https://github.com/ananyakalia14/morphy
+Project-URL: Issues, https://github.com/ananyakalia14/morphy/issues
+Keywords: sql,cli,database,query,governed-sql,terminal,ai
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Database
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+Requires-Dist: httpx<1,>=0.27
+Requires-Dist: prompt-toolkit<4,>=3.0
+Requires-Dist: keyring>=24.0.0
+
+# MORPHY CLI — Antigravity handoff
+
+Antigravity owns the terminal interface, commands and client experience in this folder. The shared engine lives in backend/. Read ../docs/API.md and ../AGENTS.md first.
+
+## Existing implementation
+
+The Python package exposes morphy and sq console commands. Install from the repository root with python -m pip install -e ./cli.
+
+morphy starts the sample REPL. Existing commands are /help, /schema, /examples, /ask <question>, /sql <SELECT> and /exit or /quit. The sample /ask uses curated example titles.
+
+morphy --database <UUID> selects a real organization database and reads MORPHY_ACCESS_TOKEN from the environment. --url selects the engine. --sql runs one query and exits. Live /ask previews SQL and requests confirmation before execution.
+
+The current CLI uses httpx and a simple input loop. Access tokens remain in the process environment. It has no persisted login session, token refresh, organization chooser, connection wizard or command completion yet.
+
+## Build on this foundation
+
+- [x] Add prompt-toolkit for slash completion, history, multiline SQL and interruption handling.
+- [x] Add login/logout/status using the same Supabase Auth project as the website.
+- [x] Store persisted refresh tokens in the OS credential store and support session expiry/refresh.
+- [x] Add organization and database selection, keeping current context visible.
+- [x] Add /connect and CSV import flows using the engine's authenticated endpoints.
+- [x] Add profile, invitation and member-management commands through the shared Supabase RPCs.
+- [x] Add readable tables, JSON output, CSV export, null handling and bounded output.
+- [x] Show generation stages, correction attempts and cache status without invented percentages.
+- [x] Add command cancellation, network-timeout messages and graceful Ctrl+C.
+- [x] Add noninteractive flags and stable exit codes for scripts.
+- [x] Add command tests and integration tests against a disposable development control plane.
+- [x] Document Windows, macOS and Linux installation. Validate both console aliases.
+
+## Features and Commands
+
+### Session & Identity
+- `/login <email>`: Authenticate via Supabase GoTrue with secure password prompt.
+- `/logout`: Clear active session, OS keyring credentials, and stored query results.
+- `/status`: Inspect active authentication, engine URL, active organization, and target database.
+- `/profile`: View your profile; `/profile claim <handle> <name>` or `/profile edit <name>` to edit display name.
+- `/dashboard`: Comprehensive terminal dashboard view; `/dashboard [render <id>]` to render a saved dashboard.
+- `/dashboards`: List saved dashboards in the active database.
+- `/dashboard-create <title> [shared]`: Create a saved dashboard definition.
+- `/dashboard-add <dash_id> <query_id>`: Add a saved query panel to a dashboard.
+- `/permissions`: Inspect effective permissions and row filtering rules on active database.
+- `/perm-revoke <role|user>`: Revoke permissions on active database.
+
+### Organizations & Databases
+- `/orgs`: List member organizations.
+- `/use-org <id|name>`: Switch active organization context.
+- `/dbs`: List databases registered in active organization.
+- `/use-db <id|name|sample>`: Switch target database context (or return to sample workspace).
+- `/connect <uri>`: Save and verify target PostgreSQL connection (admin).
+- `/import <path>`: Ingest UTF-8 CSV data up to 1 MB into SQLite target database (admin).
+
+### Team & Collaboration
+- `/members`: List members and assigned roles in the active organization.
+- `/invites`: View pending invitations.
+- `/invite <username>`: Search users and dispatch organization invitations.
+- `/accept <id>`: Accept an invitation to join an organization.
+- `/withdraw <id>`: Withdraw/cancel an existing invitation.
+
+### Queries & Saved Queries
+- `/schema`: View allowed tables and column types.
+- `/examples`: List curated natural-language query examples.
+- `/ask <question>`: Natural language query generation with pre-execution review.
+- `/sql <SELECT ...>`: Execute read-only SQL queries.
+- `/save-query <name> [sql]`: Save current or specified query.
+- `/queries`: List all saved queries.
+- `/run-query <name>`: Execute a saved query.
+- `/delete-query <name>`: Delete a saved query.
+- `/export <path.csv>`: Export last query results as RFC-4180 CSV.
+- `/json`: Print last query results as formatted JSON.
+
+### Scripting & Automation
+Run one-shot queries without entering interactive mode:
+```bash
+morphy --sql "SELECT * FROM orders LIMIT 5"
+morphy --sql "SELECT * FROM orders LIMIT 5" --json
+morphy --sql "SELECT * FROM orders LIMIT 5" --csv
+```
+Stable exit codes:
+- `0`: Success
+- `1`: Query, validation, or policy error
+- `2`: Network or engine connectivity error
+- `130`: Interrupted / cancelled via SIGINT (Ctrl+C)
+
+## Installation & Setup
+
+### Requirements
+- Python >= 3.11
+
+### Installation
+From the repository root:
+```bash
+python -m pip install -e ./cli
+```
+Both `morphy` and `sq` console commands are installed.
+
+On Windows, macOS and Linux:
+```bash
+morphy --help
+sq --help
+```
+
+## Required boundaries
+
+Keep SQL generation, target connections, encryption keys, policy enforcement and execution in the backend. The CLI sends the current user's bearer token to the configured engine. Verify HTTPS for remote authenticated endpoints.
+
+Use the same API request/response shapes as the web app. Never ask an LLM to decide whether a query is authorized. Never execute model output directly against a target database.
+
+Do not commit tokens, passwords or shell history. Source authentication settings from documented configuration. Support existing --url, --database and --sql callers as the interface evolves.
+
+## First PR
+
+Create cli/interactive-shell from main. Add the terminal framework, /help and completion around the existing HTTP client first. Include --help and interruption checks. Submit a PR with usage examples and testing evidence.
+

morphy_cli-0.5.0/README.md

@@ -0,0 +1,113 @@
+# MORPHY CLI — Antigravity handoff
+
+Antigravity owns the terminal interface, commands and client experience in this folder. The shared engine lives in backend/. Read ../docs/API.md and ../AGENTS.md first.
+
+## Existing implementation
+
+The Python package exposes morphy and sq console commands. Install from the repository root with python -m pip install -e ./cli.
+
+morphy starts the sample REPL. Existing commands are /help, /schema, /examples, /ask <question>, /sql <SELECT> and /exit or /quit. The sample /ask uses curated example titles.
+
+morphy --database <UUID> selects a real organization database and reads MORPHY_ACCESS_TOKEN from the environment. --url selects the engine. --sql runs one query and exits. Live /ask previews SQL and requests confirmation before execution.
+
+The current CLI uses httpx and a simple input loop. Access tokens remain in the process environment. It has no persisted login session, token refresh, organization chooser, connection wizard or command completion yet.
+
+## Build on this foundation
+
+- [x] Add prompt-toolkit for slash completion, history, multiline SQL and interruption handling.
+- [x] Add login/logout/status using the same Supabase Auth project as the website.
+- [x] Store persisted refresh tokens in the OS credential store and support session expiry/refresh.
+- [x] Add organization and database selection, keeping current context visible.
+- [x] Add /connect and CSV import flows using the engine's authenticated endpoints.
+- [x] Add profile, invitation and member-management commands through the shared Supabase RPCs.
+- [x] Add readable tables, JSON output, CSV export, null handling and bounded output.
+- [x] Show generation stages, correction attempts and cache status without invented percentages.
+- [x] Add command cancellation, network-timeout messages and graceful Ctrl+C.
+- [x] Add noninteractive flags and stable exit codes for scripts.
+- [x] Add command tests and integration tests against a disposable development control plane.
+- [x] Document Windows, macOS and Linux installation. Validate both console aliases.
+
+## Features and Commands
+
+### Session & Identity
+- `/login <email>`: Authenticate via Supabase GoTrue with secure password prompt.
+- `/logout`: Clear active session, OS keyring credentials, and stored query results.
+- `/status`: Inspect active authentication, engine URL, active organization, and target database.
+- `/profile`: View your profile; `/profile claim <handle> <name>` or `/profile edit <name>` to edit display name.
+- `/dashboard`: Comprehensive terminal dashboard view; `/dashboard [render <id>]` to render a saved dashboard.
+- `/dashboards`: List saved dashboards in the active database.
+- `/dashboard-create <title> [shared]`: Create a saved dashboard definition.
+- `/dashboard-add <dash_id> <query_id>`: Add a saved query panel to a dashboard.
+- `/permissions`: Inspect effective permissions and row filtering rules on active database.
+- `/perm-revoke <role|user>`: Revoke permissions on active database.
+
+### Organizations & Databases
+- `/orgs`: List member organizations.
+- `/use-org <id|name>`: Switch active organization context.
+- `/dbs`: List databases registered in active organization.
+- `/use-db <id|name|sample>`: Switch target database context (or return to sample workspace).
+- `/connect <uri>`: Save and verify target PostgreSQL connection (admin).
+- `/import <path>`: Ingest UTF-8 CSV data up to 1 MB into SQLite target database (admin).
+
+### Team & Collaboration
+- `/members`: List members and assigned roles in the active organization.
+- `/invites`: View pending invitations.
+- `/invite <username>`: Search users and dispatch organization invitations.
+- `/accept <id>`: Accept an invitation to join an organization.
+- `/withdraw <id>`: Withdraw/cancel an existing invitation.
+
+### Queries & Saved Queries
+- `/schema`: View allowed tables and column types.
+- `/examples`: List curated natural-language query examples.
+- `/ask <question>`: Natural language query generation with pre-execution review.
+- `/sql <SELECT ...>`: Execute read-only SQL queries.
+- `/save-query <name> [sql]`: Save current or specified query.
+- `/queries`: List all saved queries.
+- `/run-query <name>`: Execute a saved query.
+- `/delete-query <name>`: Delete a saved query.
+- `/export <path.csv>`: Export last query results as RFC-4180 CSV.
+- `/json`: Print last query results as formatted JSON.
+
+### Scripting & Automation
+Run one-shot queries without entering interactive mode:
+```bash
+morphy --sql "SELECT * FROM orders LIMIT 5"
+morphy --sql "SELECT * FROM orders LIMIT 5" --json
+morphy --sql "SELECT * FROM orders LIMIT 5" --csv
+```
+Stable exit codes:
+- `0`: Success
+- `1`: Query, validation, or policy error
+- `2`: Network or engine connectivity error
+- `130`: Interrupted / cancelled via SIGINT (Ctrl+C)
+
+## Installation & Setup
+
+### Requirements
+- Python >= 3.11
+
+### Installation
+From the repository root:
+```bash
+python -m pip install -e ./cli
+```
+Both `morphy` and `sq` console commands are installed.
+
+On Windows, macOS and Linux:
+```bash
+morphy --help
+sq --help
+```
+
+## Required boundaries
+
+Keep SQL generation, target connections, encryption keys, policy enforcement and execution in the backend. The CLI sends the current user's bearer token to the configured engine. Verify HTTPS for remote authenticated endpoints.
+
+Use the same API request/response shapes as the web app. Never ask an LLM to decide whether a query is authorized. Never execute model output directly against a target database.
+
+Do not commit tokens, passwords or shell history. Source authentication settings from documented configuration. Support existing --url, --database and --sql callers as the interface evolves.
+
+## First PR
+
+Create cli/interactive-shell from main. Add the terminal framework, /help and completion around the existing HTTP client first. Include --help and interruption checks. Submit a PR with usage examples and testing evidence.
+

morphy_cli-0.5.0/morphy_cli/__init__.py

@@ -0,0 +1 @@
+

morphy_cli-0.5.0/morphy_cli/__main__.py

@@ -0,0 +1,3 @@
+from .main import main
+
+main()

morphy_cli-0.5.0/morphy_cli/auth.py

@@ -0,0 +1,321 @@
+"""Authentication and session management for MORPHY CLI using Supabase Auth and OS keyring."""
+
+import json
+import os
+from pathlib import Path
+import time
+from typing import Any, Optional
+import httpx
+import keyring
+
+CONFIG_DIR = Path.home() / ".morphy"
+CONFIG_FILE = CONFIG_DIR / "config.json"
+FALLBACK_TOKEN_FILE = CONFIG_DIR / ".tokens"
+KEYRING_SERVICE = "morphy-cli"
+
+
+class AuthError(Exception):
+    """Authentication or session error with user-actionable message."""
+    pass
+
+
+class Session:
+    """Holds authenticated session details."""
+
+    def __init__(
+        self,
+        access_token: str,
+        refresh_token: str,
+        user_id: str,
+        email: str,
+        expires_at: float,
+    ):
+        self.access_token = access_token
+        self.refresh_token = refresh_token
+        self.user_id = user_id
+        self.email = email
+        self.expires_at = expires_at
+
+    @property
+    def is_expired(self) -> bool:
+        """Returns True if the access token has expired or is expiring in <= 60s."""
+        return time.time() >= (self.expires_at - 60)
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "access_token": self.access_token,
+            "refresh_token": self.refresh_token,
+            "user_id": self.user_id,
+            "email": self.email,
+            "expires_at": self.expires_at,
+        }
+
+    @classmethod
+    def from_dict(cls, data: dict[str, Any]) -> "Session":
+        return cls(
+            access_token=data["access_token"],
+            refresh_token=data["refresh_token"],
+            user_id=data["user_id"],
+            email=data["email"],
+            expires_at=data["expires_at"],
+        )
+
+
+def load_config() -> tuple[str, str]:
+    """Load Supabase URL and anon key from env vars or ~/.morphy/config.json."""
+    url = os.getenv("MORPHY_SUPABASE_URL")
+    key = os.getenv("MORPHY_SUPABASE_ANON_KEY") or os.getenv("MORPHY_SUPABASE_PUBLIC_KEY")
+
+    if not url or not key:
+        if CONFIG_FILE.is_file():
+            try:
+                data = json.loads(CONFIG_FILE.read_text(encoding="utf-8"))
+                url = url or data.get("supabase_url")
+                key = key or data.get("supabase_anon_key")
+            except Exception:
+                pass
+
+    url = (url or "http://127.0.0.1:54321").rstrip("/")
+    key = key or ""
+    return url, key
+
+
+def save_config(supabase_url: str, supabase_anon_key: str) -> None:
+    """Save Supabase configuration to ~/.morphy/config.json."""
+    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+    payload = {
+        "supabase_url": supabase_url.rstrip("/"),
+        "supabase_anon_key": supabase_anon_key,
+    }
+    CONFIG_FILE.write_text(json.dumps(payload, indent=2), encoding="utf-8")
+
+
+class AuthManager:
+    """Manages Supabase sessions, token refreshing, and OS credential storage."""
+
+    def __init__(self, supabase_url: Optional[str] = None, supabase_key: Optional[str] = None):
+        cfg_url, cfg_key = load_config()
+        self.supabase_url = (supabase_url or cfg_url).rstrip("/")
+        self.supabase_key = supabase_key if supabase_key is not None else cfg_key
+        self.current_session: Optional[Session] = None
+        self._keyring_key = f"refresh:{self.supabase_url}"
+
+    def _headers(self) -> dict[str, str]:
+        headers = {"apikey": self.supabase_key}
+        if self.current_session and self.current_session.access_token:
+            headers["Authorization"] = f"Bearer {self.current_session.access_token}"
+        return headers
+
+    def _store_refresh_token(self, refresh_token: str, session: Session) -> None:
+        stored = False
+        try:
+            keyring.set_password(KEYRING_SERVICE, self._keyring_key, refresh_token)
+            stored = True
+        except Exception:
+            stored = False
+
+        # Fallback file if keyring fails (e.g. headless CI or container)
+        if not stored:
+            try:
+                CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+                FALLBACK_TOKEN_FILE.write_text(
+                    json.dumps(session.to_dict()),
+                    encoding="utf-8"
+                )
+                try:
+                    os.chmod(FALLBACK_TOKEN_FILE, 0o600)
+                except Exception:
+                    pass
+            except Exception:
+                pass
+
+    def _get_stored_refresh_token(self) -> Optional[str]:
+        try:
+            token = keyring.get_password(KEYRING_SERVICE, self._keyring_key)
+            if token:
+                return token
+        except Exception:
+            pass
+
+        if FALLBACK_TOKEN_FILE.is_file():
+            try:
+                data = json.loads(FALLBACK_TOKEN_FILE.read_text(encoding="utf-8"))
+                return data.get("refresh_token")
+            except Exception:
+                pass
+        return None
+
+    def _clear_stored_tokens(self) -> None:
+        try:
+            keyring.delete_password(KEYRING_SERVICE, self._keyring_key)
+        except Exception:
+            pass
+
+        if FALLBACK_TOKEN_FILE.is_file():
+            try:
+                FALLBACK_TOKEN_FILE.unlink(missing_ok=True)
+            except Exception:
+                pass
+
+    def login(self, email: str, password: str) -> Session:
+        """Authenticate with Supabase GoTrue using email and password."""
+        if not self.supabase_key:
+            raise AuthError(
+                "Supabase Anon Key is not configured. Set MORPHY_SUPABASE_ANON_KEY or run config."
+            )
+
+        endpoint = f"{self.supabase_url}/auth/v1/token?grant_type=password"
+        payload = {"email": email, "password": password}
+
+        try:
+            with httpx.Client(timeout=15.0) as client:
+                res = client.post(endpoint, json=payload, headers={"apikey": self.supabase_key})
+        except httpx.HTTPError as exc:
+            raise AuthError(f"Network error during authentication: {exc}")
+
+        if res.status_code != 200:
+            try:
+                err_data = res.json()
+                detail = err_data.get("msg") or err_data.get("error_description") or res.text
+            except Exception:
+                detail = res.text
+            raise AuthError(f"Login failed ({res.status_code}): {detail}")
+
+        data = res.json()
+        expires_in = data.get("expires_in", 3600)
+        user_info = data.get("user", {})
+
+        session = Session(
+            access_token=data["access_token"],
+            refresh_token=data["refresh_token"],
+            user_id=user_info.get("id", ""),
+            email=user_info.get("email", email),
+            expires_at=time.time() + expires_in,
+        )
+        self.current_session = session
+        self._store_refresh_token(session.refresh_token, session)
+        return session
+
+    def refresh(self) -> Session:
+        """Refresh current session using refresh token."""
+        refresh_token = (
+            self.current_session.refresh_token
+            if self.current_session
+            else self._get_stored_refresh_token()
+        )
+        if not refresh_token:
+            raise AuthError("No active session or refresh token found. Please /login.")
+
+        endpoint = f"{self.supabase_url}/auth/v1/token?grant_type=refresh_token"
+        payload = {"refresh_token": refresh_token}
+
+        try:
+            with httpx.Client(timeout=15.0) as client:
+                res = client.post(endpoint, json=payload, headers={"apikey": self.supabase_key})
+        except httpx.HTTPError as exc:
+            raise AuthError(f"Network error during token refresh: {exc}")
+
+        if res.status_code != 200:
+            self._clear_stored_tokens()
+            self.current_session = None
+            raise AuthError("Session expired or refresh token invalid. Please /login again.")
+
+        data = res.json()
+        expires_in = data.get("expires_in", 3600)
+        user_info = data.get("user", {})
+
+        session = Session(
+            access_token=data["access_token"],
+            refresh_token=data["refresh_token"],
+            user_id=user_info.get("id", self.current_session.user_id if self.current_session else ""),
+            email=user_info.get("email", self.current_session.email if self.current_session else ""),
+            expires_at=time.time() + expires_in,
+        )
+        self.current_session = session
+        self._store_refresh_token(session.refresh_token, session)
+        return session
+
+    def restore_session(self) -> Optional[Session]:
+        """Attempt to restore or refresh a session from saved token."""
+        env_token = os.getenv("MORPHY_ACCESS_TOKEN")
+        if env_token:
+            self.current_session = Session(
+                access_token=env_token,
+                refresh_token="",
+                user_id="",
+                email="",
+                expires_at=time.time() + 86400,
+            )
+            return self.current_session
+
+        refresh_token = self._get_stored_refresh_token()
+        if not refresh_token:
+            return None
+
+        try:
+            return self.refresh()
+        except Exception:
+            return None
+
+    def get_valid_token(self) -> str:
+        """Return a valid access token, refreshing if necessary."""
+        if not self.current_session:
+            restored = self.restore_session()
+            if not restored:
+                env_token = os.getenv("MORPHY_ACCESS_TOKEN")
+                if env_token:
+                    return env_token
+                raise AuthError("Authentication required. Please run /login.")
+
+        if self.current_session.is_expired:
+            self.refresh()
+
+        return self.current_session.access_token
+
+    def logout(self) -> None:
+        """Sign out and invalidate session credentials."""
+        if self.current_session and self.current_session.access_token and self.supabase_key:
+            try:
+                endpoint = f"{self.supabase_url}/auth/v1/logout"
+                with httpx.Client(timeout=8.0) as client:
+                    client.post(
+                        endpoint,
+                        headers={
+                            "apikey": self.supabase_key,
+                            "Authorization": f"Bearer {self.current_session.access_token}",
+                        },
+                    )
+            except Exception:
+                pass
+
+        self._clear_stored_tokens()
+        self.current_session = None
+
+    def status(self) -> dict[str, Any]:
+        """Return current status dictionary."""
+        token = os.getenv("MORPHY_ACCESS_TOKEN")
+        if token and not self.current_session:
+            return {
+                "authenticated": True,
+                "source": "MORPHY_ACCESS_TOKEN environment variable",
+                "email": "injected-environment-session",
+                "supabase_url": self.supabase_url,
+            }
+
+        if not self.current_session:
+            restored = self.restore_session()
+            if not restored:
+                return {
+                    "authenticated": False,
+                    "supabase_url": self.supabase_url,
+                }
+
+        remaining_sec = max(0, int(self.current_session.expires_at - time.time()))
+        return {
+            "authenticated": True,
+            "email": self.current_session.email,
+            "user_id": self.current_session.user_id,
+            "expires_in_seconds": remaining_sec,
+            "supabase_url": self.supabase_url,
+        }
+