nexusquant-cli 0.3.0__tar.gz → 0.5.0__tar.gz

nexusquant_cli-0.3.0/README.md → nexusquant_cli-0.5.0/PKG-INFO

@@ -1,3 +1,17 @@
+Metadata-Version: 2.5
+Name: nexusquant-cli
+Version: 0.5.0
+Summary: NexusQuant CLI for users, strategy providers and admins
+Requires-Python: >=3.10
+Requires-Dist: httpx>=0.27
+Requires-Dist: nexusquant-sdk>=0.2
+Requires-Dist: platformdirs>=4.2
+Requires-Dist: rich>=13.7
+Requires-Dist: typer>=0.12
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == 'dev'
+Description-Content-Type: text/markdown
+
 # nexusquant-cli
 
 Command line tool for NexusQuant investors, strategy providers and admins.
@@ -22,8 +36,15 @@ pip install nexusquant-cli
 ```bash
 nexus-cli auth login          # browser login; one login covers every role
 nexus-cli auth whoami         # account, userType, Wall Pro tier, usable roles
+nexus-cli auth login --device # no local browser (server, SSH): approve a link + code from any browser
 ```
 
+`--device` gives you a **Nexus AI token** instead of a Cognito login:
+- It works for investor commands only; provider and admin commands are refused by the server.
+- It is valid for 90 days and can be revoked at any time.
+- `auth logout` revokes it on the server.
+- The same token kind is what the Nexus AI Discord bot uses.
+
 The role is not picked at login — it is the account's `custom:userType` (or the `admin` Cognito group), and the server checks it on every call. `whoami` reads it from the local token; on a 403 the CLI prints which account type is logged in.
 
 Every read takes `--json` for scripting; the default output is a table.

nexusquant_cli-0.3.0/PKG-INFO → nexusquant_cli-0.5.0/README.md

@@ -1,17 +1,3 @@
-Metadata-Version: 2.5
-Name: nexusquant-cli
-Version: 0.3.0
-Summary: NexusQuant CLI for users, strategy providers and admins
-Requires-Python: >=3.10
-Requires-Dist: httpx>=0.27
-Requires-Dist: nexusquant-sdk>=0.2
-Requires-Dist: platformdirs>=4.2
-Requires-Dist: rich>=13.7
-Requires-Dist: typer>=0.12
-Provides-Extra: dev
-Requires-Dist: pytest>=8; extra == 'dev'
-Description-Content-Type: text/markdown
-
 # nexusquant-cli
 
 Command line tool for NexusQuant investors, strategy providers and admins.
@@ -36,8 +22,15 @@ pip install nexusquant-cli
 ```bash
 nexus-cli auth login          # browser login; one login covers every role
 nexus-cli auth whoami         # account, userType, Wall Pro tier, usable roles
+nexus-cli auth login --device # no local browser (server, SSH): approve a link + code from any browser
 ```
 
+`--device` gives you a **Nexus AI token** instead of a Cognito login:
+- It works for investor commands only; provider and admin commands are refused by the server.
+- It is valid for 90 days and can be revoked at any time.
+- `auth logout` revokes it on the server.
+- The same token kind is what the Nexus AI Discord bot uses.
+
 The role is not picked at login — it is the account's `custom:userType` (or the `admin` Cognito group), and the server checks it on every call. `whoami` reads it from the local token; on a 403 the CLI prints which account type is logged in.
 
 Every read takes `--json` for scripting; the default output is a table.

nexusquant_cli-0.5.0/nexusquant_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.5.0"

{nexusquant_cli-0.3.0 → nexusquant_cli-0.5.0}/nexusquant_cli/api_client.py

@@ -6,7 +6,7 @@ from typing import Any
 import httpx
 
 from nexusquant_cli.auth_pkce import ensure_fresh_id_token
-from nexusquant_cli.config import api_base_url, token_override
+from nexusquant_cli.config import api_base_url, stored_nexus_ai_token, token_override
 
 
 class ApiError(RuntimeError):
@@ -20,7 +20,7 @@ class ApiError(RuntimeError):
 
 
 def _headers(*, force_refresh: bool = False) -> dict[str, str]:
-    token = token_override() or ensure_fresh_id_token(force_refresh=force_refresh)
+    token = token_override() or stored_nexus_ai_token() or ensure_fresh_id_token(force_refresh=force_refresh)
     return {
         "Authorization": f"Bearer {token}",
         "Accept": "application/json",
@@ -58,7 +58,8 @@ def request(
         kwargs["json"] = body
     with httpx.Client(timeout=timeout) as client:
         response = client.request(method, url, headers=_headers(), **kwargs)
-        if _is_stale_tier_403(response) and token_override() is None:
+        # Only a Cognito login can be refreshed; a Nexus AI token's tier is checked live by the server.
+        if _is_stale_tier_403(response) and token_override() is None and stored_nexus_ai_token() is None:
             response = client.request(
                 method, url, headers=_headers(force_refresh=True), **kwargs
             )
@@ -68,6 +69,21 @@ def request(
     return response.json()
 
 
+def public_post(path: str, body: Any, *, timeout: float = 30.0) -> tuple[int, Any]:
+    """POST without any credentials (device login). Returns (status, json) instead of raising."""
+    with httpx.Client(timeout=timeout) as client:
+        response = client.post(f"{api_base_url()}{path}", json=body, headers={"Accept": "application/json"})
+    try:
+        return response.status_code, response.json()
+    except json.JSONDecodeError:
+        return response.status_code, {"error": response.text[:200]}
+
+
+def revoke_current_token() -> Any:
+    """DELETE /nexus-ai/tokens/current/ — revoke the Nexus AI token this CLI is using."""
+    return request("DELETE", "/nexus-ai/tokens/current/")
+
+
 def get_json(
     path: str, *, params: dict[str, Any] | None = None, timeout: float = 60.0
 ) -> Any:
@@ -192,6 +208,23 @@ def list_my_strategies() -> Any:
     return get_json("/user/strategy/list/")
 
 
+def update_strategy_config(strategy_id: str, body: dict[str, Any]) -> Any:
+    """PUT /user/strategy/config/{id}/ — {strategy_params} replaces that slice, {execution} merges.
+
+    After the first save, every save switches listening OFF (the server closes the window).
+    """
+    return put_json(f"/user/strategy/config/{strategy_id}/", body)
+
+
+def set_listening(strategy_id: str, on: bool) -> Any:
+    """POST /user/strategy/subscribe|unsubscribe/{id}/ — arm / disarm auto-trading for one strategy.
+
+    ON means future signals from this strategy place REAL orders in the user's broker account.
+    """
+    action = "subscribe" if on else "unsubscribe"
+    return post_json(f"/user/strategy/{action}/{strategy_id}/", {})
+
+
 def list_signal_logs(
     *,
     strategy_id: str | None = None,
@@ -229,6 +262,36 @@ def get_container_status(container_id: str) -> Any:
     return get_json(f"/container/{container_id}/status/")
 
 
+def get_broker_token_status(container_id: str) -> Any:
+    """GET /container/{cid}/broker_token_status/ — token / session time left and how to renew."""
+    return get_json(f"/container/{container_id}/broker_token_status/")
+
+
+def get_broker_disconnect_notice(container_id: str) -> Any:
+    """GET /container/{cid}/broker-disconnect-notice/ — {notice: "competing_session"|null, broker_id}."""
+    return get_json(f"/container/{container_id}/broker-disconnect-notice/")
+
+
+def ping_broker(container_id: str) -> Any:
+    """POST /container/{cid}/ping/ — the web app's「检查连接」.
+
+    Not a pure read: it asks the broker (e.g. get_funds), updates the stored connection
+    status, and may self-heal (Schwab status, a forced Webull reconnect) unless the user
+    disconnected on purpose. Writes a broker_ping activity row.
+    """
+    return post_json(f"/container/{container_id}/ping/", {})
+
+
+def disconnect_broker(container_id: str) -> Any:
+    """POST /container/{cid}/disconnect/ — stop the broker session; no orders until reconnected."""
+    return post_json(f"/container/{container_id}/disconnect/", {})
+
+
+def reconnect_ibkr(container_id: str) -> Any:
+    """POST /container/{cid}/connect/ step=gateway_reconnect — IBKR re-login; sends a 2FA push to the phone."""
+    return post_json(f"/container/{container_id}/connect/", {"step": "gateway_reconnect", "broker_id": "ibkr"})
+
+
 def list_brokers() -> Any:
     """GET /container/brokers/ — supported broker catalog (public)."""
     return get_json("/container/brokers/")

{nexusquant_cli-0.3.0 → nexusquant_cli-0.5.0}/nexusquant_cli/config.py

@@ -67,6 +67,13 @@ def token_override() -> str | None:
     return _TOKEN_OVERRIDE
 
 
+def stored_nexus_ai_token() -> str | None:
+    """A Nexus AI token saved by `auth login --device` (investor commands only)."""
+    creds = load_credentials() or {}
+    tok = creds.get("nexus_ai_token")
+    return str(tok) if tok and not creds.get("id_token") else None
+
+
 def load_credentials() -> dict[str, Any] | None:
     if _TOKEN_OVERRIDE is not None:
         return {"id_token": _TOKEN_OVERRIDE}

{nexusquant_cli-0.3.0 → nexusquant_cli-0.5.0}/nexusquant_cli/embedded.py

@@ -13,8 +13,12 @@ as the user who is chatting, without any credentials on disk:
     write the user's ID token to stdin  ──▶  read one line, set as the only token
                                              run the command with --json, print JSON, exit
 
-The token never appears in argv, the environment, or a file. Only `investor list|read …`
-is accepted; anything that changes state is refused before a token is read.
+The token never appears in argv, the environment, or a file.
+
+Read commands (`investor list|read …`, plus `ping broker`) always run. Commands that change state run only when the
+caller sets NEXUS_CLI_WRITE_CONFIRMED=1 — the bridge does so only after the user clicked "allow"
+for that exact call — and only from the WRITE_COMMANDS allowlist; they get --yes because the
+confirmation already happened. Everything else is refused before a token is read.
 """
 
 from __future__ import annotations
@@ -23,6 +27,18 @@ import sys
 
 READY = "NEXUS_CLI_READY"
 READ_VERBS = {"list", "read"}
+# Not pure reads, but no confirmation (owner 2026-10-09): the bridge rate-limits them instead.
+UNCONFIRMED_ACTIONS = {"ping": {"broker"}}
+# verb → resources. No broker connect, no container lifecycle: credentials / destructive.
+WRITE_COMMANDS = {
+    "subscribe": {"strategy"},
+    "unsubscribe": {"strategy"},
+    "update": {"config", "listening", "settings", "agent-access"},
+    "delete": {"agent-session"},
+    "disconnect": {"broker"},
+    "reconnect": {"broker"},   # IBKR only (2FA push); the command itself refuses other brokers
+}
+WRITE_CONFIRMED_ENV = "NEXUS_CLI_WRITE_CONFIRMED"
 
 
 def _harden() -> None:
@@ -35,18 +51,38 @@ def _harden() -> None:
         raise SystemExit(f"prctl(PR_SET_DUMPABLE, 0) failed: errno {ctypes.get_errno()}")
 
 
-def validate(argv: list[str]) -> str | None:
-    """None if argv is an allowed read command; otherwise why not."""
+def _options(app, verb: str, resource: str) -> set[str]:
+    """Option names of `investor <verb> <resource>` (empty if it does not exist)."""
+    import typer.main
+
+    try:
+        cmd = typer.main.get_command(app).commands[verb].commands[resource]
+    except (KeyError, AttributeError):
+        return set()
+    return {opt for param in cmd.params for opt in getattr(param, "opts", [])}
+
+
+def is_write(argv: list[str]) -> bool:
+    return len(argv) >= 3 and argv[0] == "investor" and argv[2] in WRITE_COMMANDS.get(argv[1], set())
+
+
+def validate(argv: list[str], *, write_confirmed: bool = False) -> str | None:
+    """None if argv may run; otherwise why not."""
     if len(argv) < 3 or argv[0] != "investor":
-        return "only `investor <list|read> <resource> …` is available"
-    if argv[1] not in READ_VERBS:
-        return f"`{argv[1]}` is not allowed here — read-only commands only (list, read)"
-    return None
+        return "only `investor <verb> <resource> …` is available"
+    if argv[1] in READ_VERBS or argv[2] in UNCONFIRMED_ACTIONS.get(argv[1], set()):
+        return None
+    if is_write(argv):
+        return None if write_confirmed else "this command changes your account and needs your confirmation first"
+    return f"`investor {argv[1]} {argv[2]}` is not available here"
 
 
 def main(argv: list[str] | None = None) -> int:
+    import os
+
     argv = list(sys.argv[1:] if argv is None else argv)
-    why = validate(argv)
+    write = is_write(argv)
+    why = validate(argv, write_confirmed=os.environ.get(WRITE_CONFIRMED_ENV) == "1")
     if why:
         print(why, file=sys.stderr)
         return 2
@@ -66,6 +102,8 @@ def main(argv: list[str] | None = None) -> int:
 
     if "--json" not in argv:
         argv.append("--json")
+    if write and "--yes" not in argv and "--yes" in _options(investor_app, argv[1], argv[2]):
+        argv.append("--yes")   # confirmed in the web UI already; a prompt here would block on stdin
     try:
         investor_app(argv[1:], prog_name="nexus-cli investor", standalone_mode=False)
     except SystemExit as e:  # typer.Exit / click exceptions

{nexusquant_cli-0.3.0 → nexusquant_cli-0.5.0}/nexusquant_cli/identity.py

@@ -21,6 +21,10 @@ def _decode_segment(segment: str) -> dict[str, Any]:
 
 def token_claims() -> dict[str, Any] | None:
     creds = load_credentials()
+    if creds and creds.get("nexus_ai_token") and not creds.get("id_token"):
+        # Device login: not a JWT. Investor-only by construction; tier is checked live by the server.
+        return {"email": creds.get("email"), "sub": creds.get("sub"), "nexus_ai_token": True,
+                "nexus_ai_expires_at": creds.get("expires_at")}
     token = (creds or {}).get("id_token")
     if not token:
         return None
@@ -43,7 +47,9 @@ def user_type(claims: dict[str, Any] | None) -> str:
 
 def roles_for(claims: dict[str, Any] | None) -> list[str]:
     """Role groups this login can use. Mirrors the server: admin passes provider
-    checks too; every login is an investor."""
+    checks too; every login is an investor. A Nexus AI token is investor-only."""
+    if (claims or {}).get("nexus_ai_token"):
+        return ["investor"]
     t = user_type(claims)
     if t == "admin":
         return ["admin", "provider", "investor"]

nexusquant_cli-0.5.0/nexusquant_cli/roles/auth.py

@@ -0,0 +1,157 @@
+"""`nexus-cli auth …` — one login for every role.
+
+The role is not chosen at login: it is ``custom:userType`` on the account, and the
+server checks it per request. ``whoami`` shows which role groups apply.
+"""
+
+from __future__ import annotations
+
+import time
+
+import typer
+from rich.console import Console
+
+from nexusquant_cli.auth_pkce import ensure_fresh_id_token, login_and_save
+from nexusquant_cli.commands._util import fail
+from nexusquant_cli.config import CREDENTIALS_PATH, clear_credentials, load_credentials
+from nexusquant_cli.identity import has_wall_pro, roles_for, token_claims, user_type
+
+console = Console()
+
+auth_app = typer.Typer(
+    help="Login / logout. One login covers every role; the account's userType decides "
+    "which of admin / provider / investor commands the server accepts.",
+    no_args_is_help=True,
+)
+
+
+@auth_app.command(
+    "login",
+    help="Log in. Default: open the browser on this machine (Cognito). --device: show a link and code to "
+    "approve from any browser (for servers / no local browser); gets a Nexus AI token that works for "
+    "investor commands only, valid 90 days.",
+)
+def login(
+    device: bool = typer.Option(False, "--device", help="Device login: approve in any browser."),
+    label: str = typer.Option("", "--label", help="Name shown when you approve, e.g. this machine's name."),
+) -> None:
+    if device:
+        _device_login(label)
+        return
+    try:
+        login_and_save()
+    except Exception as e:  # noqa: BLE001
+        fail(console, e)
+    console.print("[green]Logged in.[/green]")
+    whoami(as_json=False)
+
+
+def _device_login(label: str) -> None:
+    import socket
+
+    from nexusquant_cli import api_client
+    from nexusquant_cli.config import save_credentials
+
+    code, body = api_client.public_post("/nexus-ai/device/start/", {"client": "cli", "label": label or socket.gethostname()})
+    if code != 200:
+        fail(console, RuntimeError(f"HTTP {code}: {body}"))
+    d = body.get("data") or {}
+    console.print(f"Open [bold]{d.get('verification_uri')}[/bold]")
+    console.print(f"and approve code [bold cyan]{d.get('user_code')}[/bold cyan] (expires in {int(d.get('expires_in', 600)) // 60} min).")
+    deadline = time.monotonic() + float(d.get("expires_in") or 600)
+    interval = max(2.0, float(d.get("interval") or 5))
+    with console.status("Waiting for approval…"):
+        while time.monotonic() < deadline:
+            time.sleep(interval)
+            code, body = api_client.public_post("/nexus-ai/device/token/", {"device_code": d.get("device_code")})
+            err = (body or {}).get("error_code")
+            if code == 200:
+                data = body.get("data") or {}
+                save_credentials({
+                    "nexus_ai_token": data["access_token"],
+                    "expires_at": data.get("expires_at"),
+                    "sub": (data.get("user") or {}).get("sub"),
+                    "email": (data.get("user") or {}).get("email"),
+                    "saved_at": time.time(),
+                })
+                console.print("[green]Logged in with a Nexus AI token[/green] (investor commands only).")
+                whoami(as_json=False)
+                return
+            if err != "AUTHORIZATION_PENDING":
+                fail(console, RuntimeError(f"{err or code}: {(body or {}).get('error')}"))
+    fail(console, RuntimeError("Timed out waiting for approval. Run `nexus-cli auth login --device` again."))
+
+
+@auth_app.command("logout", help="Delete locally saved tokens (a Nexus AI token is also revoked on the server).")
+def logout() -> None:
+    creds = load_credentials() or {}
+    if creds.get("nexus_ai_token") and not creds.get("id_token"):
+        from nexusquant_cli import api_client
+
+        try:
+            api_client.revoke_current_token()
+            console.print("[dim]Nexus AI token revoked on the server.[/dim]")
+        except Exception as e:  # noqa: BLE001 — still clear locally
+            console.print(f"[yellow]Could not revoke on the server ({e}); clearing locally anyway.[/yellow]")
+    clear_credentials()
+    console.print("[green]Logged out (local tokens removed).[/green]")
+
+
+@auth_app.command("refresh", help="Force-refresh the ID token (e.g. right after a Wall Pro upgrade).")
+def refresh() -> None:
+    try:
+        ensure_fresh_id_token(force_refresh=True)
+    except Exception as e:  # noqa: BLE001
+        fail(console, e)
+    console.print("[green]Token refreshed.[/green]")
+
+
+@auth_app.command("status", help="Whether tokens are saved on this machine (no network call).")
+def status() -> None:
+    creds = load_credentials()
+    if creds and creds.get("id_token"):
+        console.print(f"[green]Logged in.[/green] Credentials: {CREDENTIALS_PATH}")
+    else:
+        console.print("[yellow]Not logged in. Run: nexus-cli auth login[/yellow]")
+        raise typer.Exit(1)
+
+
+@auth_app.command(
+    "whoami",
+    help="Show the logged-in account, its userType, Wall Pro tier, and usable role groups. "
+    "Read from the local token; the server remains the authority.",
+)
+def whoami(
+    as_json: bool = typer.Option(False, "--json", help="Print raw claims subset as JSON."),
+) -> None:
+    claims = token_claims()
+    if claims is None:
+        console.print("[yellow]Not logged in. Run: nexus-cli auth login[/yellow]")
+        raise typer.Exit(1)
+    exp = claims.get("exp")
+    if claims.get("nexus_ai_token"):
+        info = {"email": claims.get("email"), "login": "nexus_ai_token", "roles": ["investor"],
+                "expires_at": claims.get("nexus_ai_expires_at")}
+        if as_json:
+            console.print_json(data=info)
+            return
+        console.print(f"[bold]{info['email']}[/bold]")
+        console.print("login      Nexus AI token (device login) — investor commands only")
+        console.print(f"expires    {info['expires_at']}")
+        return
+    info = {
+        "email": claims.get("email"),
+        "user_type": user_type(claims),
+        "wall_pro": has_wall_pro(claims),
+        "roles": roles_for(claims),
+        "token_expires_in_s": int(exp - time.time()) if isinstance(exp, (int, float)) else None,
+    }
+    if as_json:
+        console.print_json(data=info)
+        return
+    console.print(f"[bold]{info['email']}[/bold]")
+    console.print(f"userType   {info['user_type']}")
+    console.print(f"Wall Pro   {'[green]yes[/green]' if info['wall_pro'] else '[yellow]no[/yellow]'}")
+    console.print(f"roles      {' / '.join(info['roles'])}")
+    if info["token_expires_in_s"] is not None and info["token_expires_in_s"] < 0:
+        console.print("[dim]ID token expired; it is refreshed automatically on the next call.[/dim]")

{nexusquant_cli-0.3.0 → nexusquant_cli-0.5.0}/nexusquant_cli/roles/investor.py

@@ -213,6 +213,7 @@ def subscribe_strategy(
 def unsubscribe_strategy(
     strategy_id: Annotated[str, typer.Argument(help="Strategy id.")],
     yes: Annotated[bool, typer.Option("--yes", "-y", help="Skip the confirmation prompt.")] = False,
+    as_json: JsonOpt = False,
 ) -> None:
     if not yes:
         mine = (_call(api_client.list_my_strategies) or {}).get("strategies") or []
@@ -227,6 +228,9 @@ def unsubscribe_strategy(
         )
         typer.confirm(f"Remove {strategy_id} from My Strategies?{warn}", abort=True)
     resp = _call(lambda: api_client.market_unsubscribe(strategy_id)) or {}
+    if as_json:
+        console.print_json(data=resp)
+        return
     console.print(f"[green]{resp.get('message') or 'Removed'}[/green] {strategy_id}")
 
 
@@ -402,16 +406,109 @@ def read_settings(as_json: JsonOpt = False) -> None:
     console.print(f"daily report  {'on' if d.get('receive_daily_report') else 'off'}")
 
 
+def _kv_pairs(pairs: list[str] | None, label: str) -> dict[str, Any]:
+    """KEY=VALUE → {KEY: value}; value parsed as JSON when it is a number / bool / null, else kept as text."""
+    import json as _json
+
+    out: dict[str, Any] = {}
+    for raw in pairs or []:
+        key, sep, value = raw.partition("=")
+        if not sep or not key.strip():
+            raise typer.BadParameter(f"{label} must look like KEY=VALUE, got {raw!r}")
+        try:
+            parsed = _json.loads(value)
+            out[key.strip()] = parsed if not isinstance(parsed, (dict, list)) else value
+        except ValueError:
+            out[key.strip()] = value
+    return out
+
+
+@update_app.command(
+    "config",
+    help="Change your personal config for a subscribed strategy. --param sets strategy parameters "
+    "(others keep their current value); --execution sets execution limits such as max_order_cash_usd. "
+    "Saving switches listening OFF if it was on — switch it back on with `update listening`.",
+)
+def update_config(
+    strategy_id: Annotated[str, typer.Argument(help="Strategy id.")],
+    param: Annotated[list[str] | None, typer.Option("--param", help="KEY=VALUE, repeatable.")] = None,
+    execution: Annotated[list[str] | None, typer.Option("--execution", help="KEY=VALUE, repeatable.")] = None,
+    yes: Annotated[bool, typer.Option("--yes", "-y", help="Skip the confirmation prompt.")] = False,
+    as_json: JsonOpt = False,
+) -> None:
+    params, execs = _kv_pairs(param, "--param"), _kv_pairs(execution, "--execution")
+    if not params and not execs:
+        raise typer.BadParameter("Nothing to change. Use --param KEY=VALUE and/or --execution KEY=VALUE.")
+    row = next((x for x in _my_strategies() if str(x.get("id")) == strategy_id), None)
+    if row is None:
+        console.print(f"[red]{strategy_id} is not in My Strategies.[/red]")
+        raise typer.Exit(1)
+    body: dict[str, Any] = {}
+    if params:
+        current = dict(((row.get("personal_config") or {}).get("strategy_params")) or {})
+        body["strategy_params"] = {**current, **params}   # the server replaces this slice: keep the others
+    if execs:
+        body["execution"] = execs                          # the server merges this slice
+    if not yes:
+        warn = " Listening is ON and will be switched OFF by saving." if row.get("signal_listening") else ""
+        typer.confirm(f"Save config for {strategy_id}: {params or ''} {execs or ''}?{warn}", abort=True)
+    d = _call(lambda: api_client.update_strategy_config(strategy_id, body)) or {}
+    out = {"strategy_id": strategy_id, "message": d.get("message"), "personal_config": d.get("personal_config"),
+           "effective_config": d.get("effective_config"),
+           "listening_switched_off": bool(row.get("signal_listening") and row.get("config_acknowledged_at"))}
+    if as_json:
+        console.print_json(data=out)
+        return
+    console.print(f"[green]Saved[/green] {strategy_id}")
+    if out["listening_switched_off"]:
+        console.print("[yellow]Listening was switched OFF by this save.[/yellow]")
+    console.print_json(data=out["effective_config"] or {})
+
+
+@update_app.command(
+    "listening",
+    help="Switch auto-trading for a subscribed strategy ON or OFF. ON means this strategy's future signals "
+    "place REAL orders in your broker account, sized by your effective config.",
+)
+def update_listening(
+    strategy_id: Annotated[str, typer.Argument(help="Strategy id.")],
+    on: Annotated[bool, typer.Option("--on/--off", help="Arm or disarm auto-trading.")],
+    yes: Annotated[bool, typer.Option("--yes", "-y", help="Skip the confirmation prompt.")] = False,
+    as_json: JsonOpt = False,
+) -> None:
+    if not yes:
+        row = next((x for x in _my_strategies() if str(x.get("id")) == strategy_id), None)
+        if row is None:
+            console.print(f"[red]{strategy_id} is not in My Strategies.[/red]")
+            raise typer.Exit(1)
+        what = ("REAL orders will be placed for every new signal from this strategy" if on
+                else "no new orders will be placed for this strategy")
+        typer.confirm(f"Turn listening {'ON' if on else 'OFF'} for {strategy_id}? {what}.", abort=True)
+    d = _call(lambda: api_client.set_listening(strategy_id, on)) or {}
+    out = {"strategy_id": strategy_id, "listening": on, "message": d.get("message"),
+           "warning": d.get("warning"), "failed_containers": d.get("failed_containers")}
+    if as_json:
+        console.print_json(data=out)
+        return
+    console.print(f"[green]Listening {'ON' if on else 'OFF'}[/green] {strategy_id}  [dim]{d.get('message') or ''}[/dim]")
+    if d.get("warning"):
+        console.print(f"[yellow]{d['warning']}[/yellow]")
+
+
 @update_app.command("settings", help="Change notification settings.")
 def update_settings(
     daily_report: Annotated[
         bool | None,
         typer.Option("--daily-report/--no-daily-report", help="Receive the daily trading report email."),
     ] = None,
+    as_json: JsonOpt = False,
 ) -> None:
     if daily_report is None:
         raise typer.BadParameter("Nothing to change. Use --daily-report or --no-daily-report.")
     d = _call(lambda: api_client.update_user_settings({"receive_daily_report": daily_report})) or {}
+    if as_json:
+        console.print_json(data=d)
+        return
     console.print(f"[green]daily report {'on' if d.get('receive_daily_report') else 'off'}[/green]")
 
 
@@ -448,6 +545,114 @@ def read_container(as_json: JsonOpt = False) -> None:
             console.print(f"[dim]{status['opend_status_message']}[/dim]")
 
 
+def _container() -> dict[str, Any]:
+    health = _call(api_client.get_container_health) or {}
+    cont = health.get("container") or {}
+    if not health.get("has_container") or not cont.get("id"):
+        console.print("[yellow]No trading environment yet.[/yellow] Connect a broker in the web app first.")
+        raise typer.Exit(1)
+    return {"health": health, "id": str(cont["id"])}
+
+
+ping_app = typer.Typer(help="Check something live.", no_args_is_help=True)
+disconnect_app = typer.Typer(help="Disconnect something.", no_args_is_help=True)
+reconnect_app = typer.Typer(help="Re-authorize something.", no_args_is_help=True)
+
+
+@read_app.command(
+    "broker",
+    help="Broker connection in one view: login state and selected account, token / session time left, "
+    "and whether another login knocked this one off.",
+)
+def read_broker(as_json: JsonOpt = False) -> None:
+    c = _container()
+    status = (_call(lambda: api_client.get_container_status(c["id"])) or {}).get("container") or {}
+    token = _call(lambda: api_client.get_broker_token_status(c["id"])) or {}
+    notice = _call(lambda: api_client.get_broker_disconnect_notice(c["id"])) or {}
+    acc = status.get("selected_account") or {}
+    out = {
+        "broker_id": status.get("broker_id"),
+        "running": c["health"].get("is_running"),
+        "login_status": status.get("opend_login_status"),
+        "needs_verification": status.get("opend_needs_verification"),
+        "status_message": status.get("opend_status_message"),
+        "account": {k: acc.get(k) for k in ("acc_id", "market", "trd_env", "is_simulation")} if acc else None,
+        "token": token,
+        "disconnect_notice": notice.get("notice"),
+    }
+    if as_json:
+        console.print_json(data=out)
+        return
+    console.print(f"broker {out['broker_id'] or '—'} · running {_yes(out['running'])} · login {out['login_status'] or '—'}")
+    if out["disconnect_notice"]:
+        console.print(f"[red]Knocked off: {out['disconnect_notice']}[/red] (another login used the same account)")
+    if out["status_message"]:
+        console.print(f"[dim]{out['status_message']}[/dim]")
+    console.print_json(data=token)
+
+
+@ping_app.command(
+    "broker",
+    help="Check the broker connection now (the web app's 「检查连接」). Asks the broker live, updates the "
+    "stored status, and may repair a dropped connection unless you disconnected on purpose.",
+)
+def ping_broker(as_json: JsonOpt = False) -> None:
+    c = _container()
+    d = _call(lambda: api_client.ping_broker(c["id"])) or {}
+    if as_json:
+        console.print_json(data=d)
+        return
+    ok = d.get("connected")
+    console.print(("[green]connected[/green]" if ok else "[red]not connected[/red]") + f"  {d.get('message') or ''}")
+
+
+@disconnect_app.command(
+    "broker",
+    help="Disconnect your broker. No orders are placed for any strategy until you connect again in the web app.",
+)
+def disconnect_broker(
+    yes: Annotated[bool, typer.Option("--yes", "-y", help="Skip the confirmation prompt.")] = False,
+    as_json: JsonOpt = False,
+) -> None:
+    c = _container()
+    if not yes:
+        typer.confirm("Disconnect your broker? No orders will be placed until you reconnect in the web app.", abort=True)
+    d = _call(lambda: api_client.disconnect_broker(c["id"])) or {}
+    if as_json:
+        console.print_json(data=d)
+        return
+    console.print(f"[green]Disconnected[/green] {d.get('message') or ''}")
+
+
+@reconnect_app.command(
+    "broker",
+    help="Re-authorize an IBKR connection: sends a 2FA push to your phone — approve it there. Other brokers "
+    "re-authorize in the web app (Schwab needs the redirect URL pasted into the web form, never into a chat).",
+)
+def reconnect_broker(
+    yes: Annotated[bool, typer.Option("--yes", "-y", help="Skip the confirmation prompt.")] = False,
+    as_json: JsonOpt = False,
+) -> None:
+    c = _container()
+    status = (_call(lambda: api_client.get_container_status(c["id"])) or {}).get("container") or {}
+    broker = str(status.get("broker_id") or "").lower()
+    if broker != "ibkr":
+        msg = (f"Re-authorizing {broker or 'this broker'} is done in the web app "
+               "(My Strategies → broker connection). It needs a browser login or a code that must not go through a chat.")
+        if as_json:
+            console.print_json(data={"supported": False, "broker_id": broker, "message": msg})
+        else:
+            console.print(f"[yellow]{msg}[/yellow]")
+        raise typer.Exit(1)
+    if not yes:
+        typer.confirm("Re-login IBKR now? A 2FA push will be sent to your phone.", abort=True)
+    d = _call(lambda: api_client.reconnect_ibkr(c["id"])) or {}
+    if as_json:
+        console.print_json(data=d)
+        return
+    console.print(f"[green]Requested[/green] — approve the IBKR push on your phone. {d.get('message') or ''}")
+
+
 @list_app.command("brokers", help="Brokers the platform supports and how each one logs in.")
 def list_brokers(as_json: JsonOpt = False) -> None:
     rows = (_call(api_client.list_brokers) or {}).get("brokers") or []
@@ -593,10 +798,14 @@ def read_agent_session(
 def delete_agent_session(
     session: Annotated[str, typer.Argument(help="Session id from `list agent-sessions`.")],
     yes: Annotated[bool, typer.Option("--yes", "-y", help="Skip the confirmation prompt.")] = False,
+    as_json: JsonOpt = False,
 ) -> None:
     if not yes:
         typer.confirm(f"Delete conversation {session} from your history?", abort=True)
     d = (_call(lambda: api_client.delete_agent_session(session)) or {}).get("data") or {}
+    if as_json:
+        console.print_json(data=d)
+        return
     console.print(f"[green]Deleted[/green] {session} [dim]({d.get('deleted_at')})[/dim]")
 
 
@@ -635,3 +844,6 @@ investor_app.add_typer(update_app, name="update")
 investor_app.add_typer(subscribe_app, name="subscribe")
 investor_app.add_typer(unsubscribe_app, name="unsubscribe")
 investor_app.add_typer(delete_app, name="delete")
+investor_app.add_typer(ping_app, name="ping")
+investor_app.add_typer(disconnect_app, name="disconnect")
+investor_app.add_typer(reconnect_app, name="reconnect")

{nexusquant_cli-0.3.0 → nexusquant_cli-0.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "nexusquant-cli"
-version = "0.3.0"
+version = "0.5.0"
 description = "NexusQuant CLI for users, strategy providers and admins"
 readme = "README.md"
 requires-python = ">=3.10"

{nexusquant_cli-0.3.0 → nexusquant_cli-0.5.0}/tests/test_nexus_cli.py

@@ -492,3 +492,222 @@ def test_investor_commands_import_without_the_sdk() -> None:
     r = subprocess.run([sys.executable, "-c", code], capture_output=True, text=True)
     assert r.returncode == 0, r.stderr
     assert r.stdout.strip() == "ok"
+
+
+# ── confirmed writes (agent asks the user first) ────────────────────────────
+
+
+def _stdin(token="user-token-abc"):
+    return type("S", (), {"readline": lambda self: token + "\n", "close": lambda self: None})()
+
+
+@pytest.mark.parametrize(
+    "argv, confirmed, allowed",
+    [
+        (["investor", "update", "listening", "s1", "--on"], False, False),
+        (["investor", "update", "listening", "s1", "--on"], True, True),
+        (["investor", "update", "config", "s1", "--param", "a=1"], True, True),
+        (["investor", "unsubscribe", "strategy", "s1"], True, True),
+        (["investor", "update", "nope"], True, False),                 # not in the write allowlist
+        (["investor", "connect", "broker"], True, False),
+        (["admin", "review", "strategy", "s1"], True, False),
+    ],
+)
+def test_embedded_write_gate(argv, confirmed, allowed) -> None:
+    from nexusquant_cli import embedded
+
+    assert (embedded.validate(argv, write_confirmed=confirmed) is None) is allowed
+
+
+def test_embedded_confirmed_write_runs_with_yes_only_where_supported(http: Recorder, monkeypatch, capsys) -> None:
+    from nexusquant_cli import config, embedded
+
+    monkeypatch.setenv(embedded.WRITE_CONFIRMED_ENV, "1")
+    monkeypatch.setattr(embedded.sys, "stdin", _stdin())
+    http.on("POST", "/strategy/unsubscribe/s1/", {"message": "ok"})
+    http.on("POST", "/strategy/market/checkout/", {"results": [{"strategy_id": "s2", "ok": True}]})
+    try:
+        assert embedded.main(["investor", "unsubscribe", "strategy", "s1"]) == 0     # has --yes → no prompt
+        assert embedded.main(["investor", "subscribe", "strategy", "s2"]) == 0       # no --yes option → none appended
+    finally:
+        config.set_token_override(None)
+    assert [c[:2] for c in http.calls] == [("POST", "/strategy/unsubscribe/s1/"), ("POST", "/strategy/market/checkout/")]
+
+
+def test_embedded_unconfirmed_write_never_reads_token(monkeypatch) -> None:
+    from nexusquant_cli import embedded
+
+    monkeypatch.delenv(embedded.WRITE_CONFIRMED_ENV, raising=False)
+    read = []
+    monkeypatch.setattr(embedded.sys, "stdin", type("S", (), {"readline": lambda self: read.append(1) or "t\n",
+                                                              "close": lambda self: None})())
+    assert embedded.main(["investor", "update", "listening", "s1", "--on"]) == 2
+    assert read == []
+
+
+def test_update_config_keeps_other_params(http: Recorder) -> None:
+    http.on("GET", "/user/strategy/list/", {"strategies": [
+        {"id": "s1", "signal_listening": False, "config_acknowledged_at": "2026-10-01T00:00:00Z",
+         "personal_config": {"strategy_params": {"A": 1, "B": 2}}}]})
+    http.on("PUT", "/user/strategy/config/s1/", {"message": "ok", "effective_config": {}})
+    result = runner.invoke(app, ["investor", "update", "config", "s1", "--param", "B=5",
+                                 "--execution", "max_order_cash_usd=1000", "--yes", "--json"])
+    assert result.exit_code == 0, result.output
+    method, path, _, body = http.calls[-1]
+    assert (method, path) == ("PUT", "/user/strategy/config/s1/")
+    assert body == {"strategy_params": {"A": 1, "B": 5}, "execution": {"max_order_cash_usd": 1000}}
+
+
+@pytest.mark.parametrize("flag, path", [("--on", "/user/strategy/subscribe/s1/"), ("--off", "/user/strategy/unsubscribe/s1/")])
+def test_update_listening(http: Recorder, flag, path) -> None:
+    result = runner.invoke(app, ["investor", "update", "listening", "s1", flag, "--yes", "--json"])
+    assert result.exit_code == 0, result.output
+    assert http.calls[-1][:2] == ("POST", path)
+
+
+def test_update_listening_on_asks_first(http: Recorder) -> None:
+    http.on("GET", "/user/strategy/list/", {"strategies": [{"id": "s1"}]})
+    result = runner.invoke(app, ["investor", "update", "listening", "s1", "--on"], input="n\n")
+    assert result.exit_code != 0
+    assert "REAL orders" in result.output
+    assert [c[0] for c in http.calls] == ["GET"]
+
+
+# ── broker: read / ping (no confirmation) / disconnect & IBKR reconnect (confirmed) ──
+
+
+def _with_container(http: Recorder, broker="schwab") -> None:
+    http.on("GET", "/user/container/health/", {"has_container": True, "is_running": True, "container": {"id": "c1"}})
+    http.on("GET", "/container/c1/status/", {"container": {"broker_id": broker, "opend_login_status": "logged_in"}})
+
+
+def test_read_broker_combines_three_reads(http: Recorder) -> None:
+    _with_container(http)
+    http.on("GET", "/container/c1/broker_token_status/", {"status": {"seconds_left": 100}})
+    http.on("GET", "/container/c1/broker-disconnect-notice/", {"notice": "competing_session", "broker_id": "schwab"})
+    result = runner.invoke(app, ["investor", "read", "broker", "--json"])
+    assert result.exit_code == 0, result.output
+    out = json.loads(result.output)
+    assert out["broker_id"] == "schwab" and out["disconnect_notice"] == "competing_session"
+    assert all(c[0] == "GET" for c in http.calls)
+
+
+def test_ping_disconnect_reconnect_routes(http: Recorder) -> None:
+    _with_container(http, broker="ibkr")
+    for argv, path, body in (
+        (["investor", "ping", "broker", "--json"], "/container/c1/ping/", {}),
+        (["investor", "disconnect", "broker", "--yes", "--json"], "/container/c1/disconnect/", {}),
+        (["investor", "reconnect", "broker", "--yes", "--json"], "/container/c1/connect/",
+         {"step": "gateway_reconnect", "broker_id": "ibkr"}),
+    ):
+        result = runner.invoke(app, argv)
+        assert result.exit_code == 0, result.output
+        assert http.calls[-1][0] == "POST" and http.calls[-1][1] == path and http.calls[-1][3] == body
+
+
+def test_reconnect_refuses_non_ibkr_without_calling_connect(http: Recorder) -> None:
+    _with_container(http, broker="schwab")
+    result = runner.invoke(app, ["investor", "reconnect", "broker", "--yes"])
+    assert result.exit_code == 1
+    assert "web app" in result.output
+    assert not [c for c in http.calls if c[0] == "POST"]
+
+
+def test_disconnect_asks_first(http: Recorder) -> None:
+    _with_container(http)
+    result = runner.invoke(app, ["investor", "disconnect", "broker"], input="n\n")
+    assert result.exit_code != 0
+    assert not [c for c in http.calls if c[0] == "POST"]
+
+
+def test_broker_commands_without_container(http: Recorder) -> None:
+    http.on("GET", "/user/container/health/", {"has_container": False})
+    result = runner.invoke(app, ["investor", "ping", "broker"])
+    assert result.exit_code == 1
+    assert [c[1] for c in http.calls] == ["/user/container/health/"]
+
+
+@pytest.mark.parametrize(
+    "argv, confirmed, allowed",
+    [
+        (["investor", "ping", "broker"], False, True),        # no confirmation (bridge rate-limits)
+        (["investor", "disconnect", "broker"], False, False),
+        (["investor", "disconnect", "broker"], True, True),
+        (["investor", "reconnect", "broker"], True, True),
+        (["investor", "connect", "broker"], True, False),     # first-time connect: never
+    ],
+)
+def test_embedded_broker_gate(argv, confirmed, allowed) -> None:
+    from nexusquant_cli import embedded
+
+    assert (embedded.validate(argv, write_confirmed=confirmed) is None) is allowed
+
+
+# ── device login (Nexus AI token) ───────────────────────────────────────────
+
+
+@pytest.fixture
+def creds_dir(tmp_path, monkeypatch):
+    from nexusquant_cli import config
+
+    monkeypatch.setattr(config, "CONFIG_DIR", tmp_path)
+    monkeypatch.setattr(config, "CREDENTIALS_PATH", tmp_path / "credentials.json")
+    return tmp_path / "credentials.json"
+
+
+def _device_routes(http: Recorder, outcomes):
+    http.on("POST", "/nexus-ai/device/start/", {"data": {
+        "device_code": "nxdc_x", "user_code": "BCDF-GHJK", "verification_uri": "https://nexusquant.co/link?code=BCDF-GHJK",
+        "expires_in": 600, "interval": 5}})
+    seq = iter(outcomes)
+    http.on("POST", "/nexus-ai/device/token/", lambda r: next(seq))
+
+
+def test_device_login_saves_token_and_uses_it(http: Recorder, creds_dir, monkeypatch) -> None:
+    from nexusquant_cli.roles import auth as auth_mod
+
+    monkeypatch.setattr(auth_mod.time, "sleep", lambda s: None)
+    _device_routes(http, [
+        httpx.Response(400, json={"error_code": "AUTHORIZATION_PENDING"}),
+        httpx.Response(200, json={"data": {"access_token": "nxat_secret_123", "expires_at": "2027-01-08T00:00:00Z",
+                                           "user": {"sub": "sub-1", "email": "a@x.com"}}}),
+    ])
+    result = runner.invoke(app, ["auth", "login", "--device", "--label", "box"])
+    assert result.exit_code == 0, result.output
+    assert "BCDF-GHJK" in result.output and "https://nexusquant.co/link?code=BCDF-GHJK" in result.output
+    assert "investor commands only" in result.output
+    saved = json.loads(creds_dir.read_text())
+    assert saved["nexus_ai_token"] == "nxat_secret_123" and "id_token" not in saved
+    assert http.calls[0][3] == {"client": "cli", "label": "box"}
+    assert "nxat_secret_123" not in result.output
+
+    # 之后的请求用这个 token（http 夹具把 Cognito 登录换成了 "tok"，这里必须不是它）
+    seen = []
+
+    def stats(request: httpx.Request) -> httpx.Response:
+        seen.append(request.headers["Authorization"])
+        return httpx.Response(200, json={"data": {}})
+
+    http.on("GET", "/strategy-signal/statistics/", stats)
+    assert runner.invoke(app, ["investor", "read", "stats", "--json"]).exit_code == 0
+    assert seen == ["Bearer nxat_secret_123"]
+
+    who = runner.invoke(app, ["auth", "whoami", "--json"])
+    assert json.loads(who.output)["roles"] == ["investor"]
+
+    http.on("DELETE", "/nexus-ai/tokens/current/", {"data": {}})
+    out = runner.invoke(app, ["auth", "logout"])
+    assert out.exit_code == 0, out.output
+    assert http.calls[-1][:2] == ("DELETE", "/nexus-ai/tokens/current/")
+    assert not creds_dir.exists()
+
+
+def test_device_login_denied(http: Recorder, creds_dir, monkeypatch) -> None:
+    from nexusquant_cli.roles import auth as auth_mod
+
+    monkeypatch.setattr(auth_mod.time, "sleep", lambda s: None)
+    _device_routes(http, [httpx.Response(400, json={"error_code": "ACCESS_DENIED", "error": "用户拒绝了授权"})])
+    result = runner.invoke(app, ["auth", "login", "--device"])
+    assert result.exit_code == 1
+    assert "ACCESS_DENIED" in result.output
+    assert not creds_dir.exists()

{nexusquant_cli-0.3.0 → nexusquant_cli-0.5.0}/uv.lock

@@ -133,7 +133,7 @@ wheels = [
 
 [[package]]
 name = "nexusquant-cli"
-version = "0.3.0"
+version = "0.5.0"
 source = { editable = "." }
 dependencies = [
     { name = "httpx" },

nexusquant_cli-0.3.0/nexusquant_cli/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.3.0"

nexusquant_cli-0.3.0/nexusquant_cli/roles/auth.py

@@ -1,91 +0,0 @@
-"""`nexus-cli auth …` — one login for every role.
-
-The role is not chosen at login: it is ``custom:userType`` on the account, and the
-server checks it per request. ``whoami`` shows which role groups apply.
-"""
-
-from __future__ import annotations
-
-import time
-
-import typer
-from rich.console import Console
-
-from nexusquant_cli.auth_pkce import ensure_fresh_id_token, login_and_save
-from nexusquant_cli.commands._util import fail
-from nexusquant_cli.config import CREDENTIALS_PATH, clear_credentials, load_credentials
-from nexusquant_cli.identity import has_wall_pro, roles_for, token_claims, user_type
-
-console = Console()
-
-auth_app = typer.Typer(
-    help="Login / logout. One login covers every role; the account's userType decides "
-    "which of admin / provider / investor commands the server accepts.",
-    no_args_is_help=True,
-)
-
-
-@auth_app.command("login", help="Open the browser for Cognito login and save tokens locally.")
-def login() -> None:
-    try:
-        login_and_save()
-    except Exception as e:  # noqa: BLE001
-        fail(console, e)
-    console.print("[green]Logged in.[/green]")
-    whoami(as_json=False)
-
-
-@auth_app.command("logout", help="Delete locally saved tokens.")
-def logout() -> None:
-    clear_credentials()
-    console.print("[green]Logged out (local tokens removed).[/green]")
-
-
-@auth_app.command("refresh", help="Force-refresh the ID token (e.g. right after a Wall Pro upgrade).")
-def refresh() -> None:
-    try:
-        ensure_fresh_id_token(force_refresh=True)
-    except Exception as e:  # noqa: BLE001
-        fail(console, e)
-    console.print("[green]Token refreshed.[/green]")
-
-
-@auth_app.command("status", help="Whether tokens are saved on this machine (no network call).")
-def status() -> None:
-    creds = load_credentials()
-    if creds and creds.get("id_token"):
-        console.print(f"[green]Logged in.[/green] Credentials: {CREDENTIALS_PATH}")
-    else:
-        console.print("[yellow]Not logged in. Run: nexus-cli auth login[/yellow]")
-        raise typer.Exit(1)
-
-
-@auth_app.command(
-    "whoami",
-    help="Show the logged-in account, its userType, Wall Pro tier, and usable role groups. "
-    "Read from the local token; the server remains the authority.",
-)
-def whoami(
-    as_json: bool = typer.Option(False, "--json", help="Print raw claims subset as JSON."),
-) -> None:
-    claims = token_claims()
-    if claims is None:
-        console.print("[yellow]Not logged in. Run: nexus-cli auth login[/yellow]")
-        raise typer.Exit(1)
-    exp = claims.get("exp")
-    info = {
-        "email": claims.get("email"),
-        "user_type": user_type(claims),
-        "wall_pro": has_wall_pro(claims),
-        "roles": roles_for(claims),
-        "token_expires_in_s": int(exp - time.time()) if isinstance(exp, (int, float)) else None,
-    }
-    if as_json:
-        console.print_json(data=info)
-        return
-    console.print(f"[bold]{info['email']}[/bold]")
-    console.print(f"userType   {info['user_type']}")
-    console.print(f"Wall Pro   {'[green]yes[/green]' if info['wall_pro'] else '[yellow]no[/yellow]'}")
-    console.print(f"roles      {' / '.join(info['roles'])}")
-    if info["token_expires_in_s"] is not None and info["token_expires_in_s"] < 0:
-        console.print("[dim]ID token expired; it is refreshed automatically on the next call.[/dim]")