onehouse-cli 0.2.0__tar.gz → 0.4.0__tar.gz

{onehouse_cli-0.2.0 → onehouse_cli-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: onehouse-cli
-Version: 0.2.0
+Version: 0.4.0
 Summary: A command-line tool for the full Onehouse API
 Author-email: Sagar Lakshmipathy <18vidhyasagar@gmail.com>
 License: Proprietary
@@ -16,7 +16,8 @@ Requires-Python: >=3.9
 Description-Content-Type: text/markdown
 Requires-Dist: click>=8.0
 Requires-Dist: requests>=2.28
-Requires-Dist: onehouse-python-sdk[resources]
+Requires-Dist: onehouse-python-sdk[resources]>=0.3.0
+Requires-Dist: keyring>=24
 Provides-Extra: dev
 Requires-Dist: pytest>=7.0; extra == "dev"
 Requires-Dist: pytest-mock>=3.0; extra == "dev"
@@ -33,6 +34,20 @@ pip install onehouse-cli
 
 The SDK dependency (`onehouse-python-sdk[resources]`) is installed automatically.
 
+## AI agent integration
+
+The package bundles a skill that teaches AI coding agents how to use `oh`. Install it for your agent:
+
+```bash
+oh install agent-skill --claude    # ~/.claude/skills/onehouse-cli
+oh install agent-skill --cursor    # ~/.cursor/skills/onehouse-cli
+oh install agent-skill --codex     # ~/.agents/skills/onehouse-cli
+oh install agent-skill --all       # all of the above
+oh install agent-skill --all --dry-run
+```
+
+Re-run the command after `pip install --upgrade onehouse-cli` to refresh the skill. To read the skill without installing it, run `oh skill`.
+
 ## Setup
 
 **Configure credentials:**
@@ -46,11 +61,12 @@ Fields collected:
 - Profile name
 - Account UID
 - Project UID
-- API Key / API Secret
+- API Key / API Secret (blank if you use `oh login`)
 - Project Region
 - User ID
 - Request ID (link UID)
-- API Endpoint (default: `https://api.onehouse.ai/v1`)
+- API Endpoint (default: `https://api.onehouse.ai`)
+- AI Gateway URL (optional; only `oh ai-gateway` reads it)
 
 **Credentials are stored in:** `~/.onehouse/credentials`
 
@@ -66,6 +82,58 @@ export ONEHOUSE_LINK_UID=...
 export ONEHOUSE_PROFILE=myprofile   # select a profile from the credentials file
 ```
 
+## Sign in instead of an API key (`oh login`)
+
+```bash
+oh login     # opens your browser; commands then run as you
+oh logout    # revokes the session and forgets it
+```
+
+- Your organization must have OAuth sign-in for the API turned on. Ask your Onehouse contact.
+- The profile still needs Account UID, Project UID, Region and Request ID (link UID). It does not need an API key, secret or User ID: `oh-configure` accepts them blank.
+- While you are signed in, commands use your session instead of the profile's API key and secret. `oh logout` switches back.
+- The session renews itself for 30 days. The refresh token is kept in your OS keychain. A machine with no keychain, such as headless Linux, keeps it in `~/.onehouse/sessions/` with mode `0600`. `ONEHOUSE_SESSION_STORE=file` forces the file.
+- A machine with no browser uses a service principal's API key, or `oh login --port <n>` over an SSH forward.
+- `oh login` signs in to the Onehouse API only, not to an AI Gateway; that is `oh ai-gateway login`.
+
+## AI Gateway: Claude Code and Codex with no pasted token
+
+`oh ai-gateway` keeps an AI Gateway token fresh for the whole session. Set the gateway once with `oh-configure` (AI Gateway URL) or pass `--gateway-url`. Everything here needs the VPN or your own network.
+
+As a person:
+
+```bash
+oh ai-gateway login                 # once; prints the one-time MCP setup for both clients
+oh ai-gateway run -- claude         # every session
+oh ai-gateway run -- codex -m <model alias>
+```
+
+As a service principal: use a profile with its API key and secret, skip `login`, and add the MCP entry `oh ai-gateway login` would print. In short:
+
+```bash
+claude mcp add-json --scope user oh-ai-gateway \
+  '{"type":"http","url":"<gateway>/mcp","headersHelper":"oh ai-gateway token --format mcp-headers --gateway-url <gateway>"}'
+oh ai-gateway run -- claude
+```
+
+For Codex 0.148.0 or later, add to `~/.codex/config.toml`:
+
+```toml
+[mcp_servers.oh-ai-gateway]
+url = "<gateway>/mcp"
+http_headers_helper = "oh ai-gateway token --format mcp-headers --gateway-url <gateway>"
+```
+
+- Model calls go through a local proxy that `run` starts on `127.0.0.1` and stops when the client exits. It sets a fresh `X-Onehouse-Authorization` on every request and retries once after a 401. The client gets the proxy's address and a per-run secret in its environment; nothing is copied by hand or written to disk.
+- MCP tools use the `headersHelper` (Claude Code) or `http_headers_helper` (Codex). The client runs it on every connection and again after a 401.
+- Codex runs `http_headers_helper` without your shell's `ONEHOUSE_*` variables. The helper `oh ai-gateway login` prints carries `--profile` and, as an `env` prefix (not on Windows), any `ONEHOUSE_CREDENTIALS_FILE` or `ONEHOUSE_SESSION_STORE` you set. Writing the entry by hand, do the same, and keep a service principal's key and secret in the profile rather than in `ONEHOUSE_API_KEY` and `ONEHOUSE_API_SECRET`.
+- Codex sends only `/v1/responses`, which the gateway passes to the provider as is, so `-m` must name a model alias served by an OpenAI model with the Responses API, such as `gpt-5`. An alias served by Anthropic returns 404, and `gpt-4` fails: it rejects Codex's `web_search_preview` tool and its 8K context is too small.
+- Add the MCP entry at user scope: a project or local-scope `headersHelper` does not run until you accept the folder trust prompt.
+- `oh ai-gateway proxy` runs the proxy on its own for other clients and prints the two variables to set.
+- `oh ai-gateway token` prints a token, and `--format mcp-headers` prints the JSON a headers helper returns.
+- `oh ai-gateway logout` ends the sign-in; the profile's service principal, if any, applies again. Tokens already issued to a person stay valid until they expire, up to 7 days.
+- `run` warns when `ANTHROPIC_API_KEY` is set: it displaces your subscription, and the gateway forwards it upstream as your own key.
+
 ## Global Options
 
 ```

{onehouse_cli-0.2.0 → onehouse_cli-0.4.0}/README.md

@@ -10,6 +10,20 @@ pip install onehouse-cli
 
 The SDK dependency (`onehouse-python-sdk[resources]`) is installed automatically.
 
+## AI agent integration
+
+The package bundles a skill that teaches AI coding agents how to use `oh`. Install it for your agent:
+
+```bash
+oh install agent-skill --claude    # ~/.claude/skills/onehouse-cli
+oh install agent-skill --cursor    # ~/.cursor/skills/onehouse-cli
+oh install agent-skill --codex     # ~/.agents/skills/onehouse-cli
+oh install agent-skill --all       # all of the above
+oh install agent-skill --all --dry-run
+```
+
+Re-run the command after `pip install --upgrade onehouse-cli` to refresh the skill. To read the skill without installing it, run `oh skill`.
+
 ## Setup
 
 **Configure credentials:**
@@ -23,11 +37,12 @@ Fields collected:
 - Profile name
 - Account UID
 - Project UID
-- API Key / API Secret
+- API Key / API Secret (blank if you use `oh login`)
 - Project Region
 - User ID
 - Request ID (link UID)
-- API Endpoint (default: `https://api.onehouse.ai/v1`)
+- API Endpoint (default: `https://api.onehouse.ai`)
+- AI Gateway URL (optional; only `oh ai-gateway` reads it)
 
 **Credentials are stored in:** `~/.onehouse/credentials`
 
@@ -43,6 +58,58 @@ export ONEHOUSE_LINK_UID=...
 export ONEHOUSE_PROFILE=myprofile   # select a profile from the credentials file
 ```
 
+## Sign in instead of an API key (`oh login`)
+
+```bash
+oh login     # opens your browser; commands then run as you
+oh logout    # revokes the session and forgets it
+```
+
+- Your organization must have OAuth sign-in for the API turned on. Ask your Onehouse contact.
+- The profile still needs Account UID, Project UID, Region and Request ID (link UID). It does not need an API key, secret or User ID: `oh-configure` accepts them blank.
+- While you are signed in, commands use your session instead of the profile's API key and secret. `oh logout` switches back.
+- The session renews itself for 30 days. The refresh token is kept in your OS keychain. A machine with no keychain, such as headless Linux, keeps it in `~/.onehouse/sessions/` with mode `0600`. `ONEHOUSE_SESSION_STORE=file` forces the file.
+- A machine with no browser uses a service principal's API key, or `oh login --port <n>` over an SSH forward.
+- `oh login` signs in to the Onehouse API only, not to an AI Gateway; that is `oh ai-gateway login`.
+
+## AI Gateway: Claude Code and Codex with no pasted token
+
+`oh ai-gateway` keeps an AI Gateway token fresh for the whole session. Set the gateway once with `oh-configure` (AI Gateway URL) or pass `--gateway-url`. Everything here needs the VPN or your own network.
+
+As a person:
+
+```bash
+oh ai-gateway login                 # once; prints the one-time MCP setup for both clients
+oh ai-gateway run -- claude         # every session
+oh ai-gateway run -- codex -m <model alias>
+```
+
+As a service principal: use a profile with its API key and secret, skip `login`, and add the MCP entry `oh ai-gateway login` would print. In short:
+
+```bash
+claude mcp add-json --scope user oh-ai-gateway \
+  '{"type":"http","url":"<gateway>/mcp","headersHelper":"oh ai-gateway token --format mcp-headers --gateway-url <gateway>"}'
+oh ai-gateway run -- claude
+```
+
+For Codex 0.148.0 or later, add to `~/.codex/config.toml`:
+
+```toml
+[mcp_servers.oh-ai-gateway]
+url = "<gateway>/mcp"
+http_headers_helper = "oh ai-gateway token --format mcp-headers --gateway-url <gateway>"
+```
+
+- Model calls go through a local proxy that `run` starts on `127.0.0.1` and stops when the client exits. It sets a fresh `X-Onehouse-Authorization` on every request and retries once after a 401. The client gets the proxy's address and a per-run secret in its environment; nothing is copied by hand or written to disk.
+- MCP tools use the `headersHelper` (Claude Code) or `http_headers_helper` (Codex). The client runs it on every connection and again after a 401.
+- Codex runs `http_headers_helper` without your shell's `ONEHOUSE_*` variables. The helper `oh ai-gateway login` prints carries `--profile` and, as an `env` prefix (not on Windows), any `ONEHOUSE_CREDENTIALS_FILE` or `ONEHOUSE_SESSION_STORE` you set. Writing the entry by hand, do the same, and keep a service principal's key and secret in the profile rather than in `ONEHOUSE_API_KEY` and `ONEHOUSE_API_SECRET`.
+- Codex sends only `/v1/responses`, which the gateway passes to the provider as is, so `-m` must name a model alias served by an OpenAI model with the Responses API, such as `gpt-5`. An alias served by Anthropic returns 404, and `gpt-4` fails: it rejects Codex's `web_search_preview` tool and its 8K context is too small.
+- Add the MCP entry at user scope: a project or local-scope `headersHelper` does not run until you accept the folder trust prompt.
+- `oh ai-gateway proxy` runs the proxy on its own for other clients and prints the two variables to set.
+- `oh ai-gateway token` prints a token, and `--format mcp-headers` prints the JSON a headers helper returns.
+- `oh ai-gateway logout` ends the sign-in; the profile's service principal, if any, applies again. Tokens already issued to a person stay valid until they expire, up to 7 days.
+- `run` warns when `ANTHROPIC_API_KEY` is set: it displaces your subscription, and the gateway forwards it upstream as your own key.
+
 ## Global Options
 
 ```

onehouse_cli-0.4.0/onehouse_cli/__init__.py

@@ -0,0 +1,32 @@
+"""
+Onehouse CLI - A command-line tool for executing SQL commands against the Onehouse API.
+"""
+
+try:
+    # For Python 3.8+
+    from importlib.metadata import version
+except ImportError:
+    # For Python 3.7
+    from importlib_metadata import version
+
+try:
+    __version__ = version("onehouse-cli")
+except Exception:
+    # Fallback version if package is not installed
+    __version__ = "0.0.0.dev"
+
+__all__ = ["cli_main", "configure_main"]
+
+
+# Imported lazily (PEP 562) so that pulling in a leaf module does not drag in
+# the whole command tree — and with it the SDK dependency. This keeps
+# `oh-skill` readable on an install where onehouse-python-sdk is missing,
+# which is precisely when someone needs the usage guide.
+def __getattr__(name):
+    if name == "cli_main":
+        from .cli import main
+        return main
+    if name == "configure_main":
+        from .configure import main
+        return main
+    raise AttributeError(f"module {__name__!r} has no attribute {name!r}")

onehouse_cli-0.4.0/onehouse_cli/ai_gateway_proxy.py

@@ -0,0 +1,229 @@
+"""A local forwarding proxy that keeps an AI Gateway token fresh for model calls.
+
+Claude Code reads ``ANTHROPIC_CUSTOM_HEADERS`` once per session, and the gateway's
+``/`` route reads only ``X-Onehouse-Authorization``, so a long session outlives any
+token set in the environment. Pointed at this proxy, a client needs no token at all:
+the proxy sets a fresh one on every request and replays once after a 401.
+
+Any local process can reach a loopback port, so a request must carry the per-run
+secret, and the ``Host`` must be the proxy's own (no DNS rebinding from a browser).
+"""
+
+from __future__ import annotations
+
+import hmac
+import http.client
+import http.server
+import secrets
+import ssl
+import sys
+import threading
+import urllib.parse
+from typing import Optional
+
+from onehouse_python_sdk._oauth import default_ssl_context
+
+#: Carries the per-run secret from the client to the proxy. Stripped before forwarding.
+SECRET_HEADER = "X-Oh-Proxy-Secret"
+GATEWAY_AUTH_HEADER = "X-Onehouse-Authorization"
+
+_HOP_BY_HOP = {
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "proxy-connection",
+    "te",
+    "trailer",
+    "trailers",
+    "transfer-encoding",
+    "upgrade",
+}
+_DROPPED_REQUEST_HEADERS = _HOP_BY_HOP | {
+    "host",
+    "content-length",
+    SECRET_HEADER.lower(),
+    GATEWAY_AUTH_HEADER.lower(),
+}
+_UPSTREAM_TIMEOUT_SECONDS = 600
+_CHUNK = 8192
+
+
+def new_secret() -> str:
+    return secrets.token_urlsafe(32)
+
+
+class _Handler(http.server.BaseHTTPRequestHandler):
+    protocol_version = "HTTP/1.1"
+    # Set per server by AiGatewayProxy.
+    proxy: "AiGatewayProxy"
+
+    def log_message(self, *_args) -> None:
+        """The default access log would print request lines; tokens never pass through it,
+        but nothing here needs logging either."""
+
+    def do_CONNECT(self) -> None:  # noqa: N802
+        self._refuse(405, "CONNECT is not supported")
+
+    def do_GET(self) -> None:  # noqa: N802
+        self._forward()
+
+    do_POST = do_PUT = do_PATCH = do_DELETE = do_HEAD = do_OPTIONS = do_GET  # noqa: N815
+
+    def _refuse(self, status: int, message: str) -> None:
+        body = message.encode("utf-8")
+        self.send_response(status)
+        self.send_header("Content-Type", "text/plain; charset=utf-8")
+        self.send_header("Content-Length", str(len(body)))
+        self.send_header("Connection", "close")
+        self.end_headers()
+        self.wfile.write(body)
+        self.close_connection = True
+
+    def _read_body(self) -> Optional[bytes]:
+        if self.headers.get("Transfer-Encoding", "").lower() == "chunked":
+            chunks = []
+            while True:
+                size = int(self.rfile.readline().split(b";", 1)[0].strip() or b"0", 16)
+                if size == 0:
+                    while self.rfile.readline() not in (b"\r\n", b"\n", b""):
+                        pass
+                    break
+                chunks.append(self.rfile.read(size))
+                self.rfile.readline()
+            return b"".join(chunks)
+        length = int(self.headers.get("Content-Length") or 0)
+        return self.rfile.read(length) if length else None
+
+    def _forward(self) -> None:
+        proxy = self.proxy
+        if self.headers.get("Host", "").lower() not in proxy.allowed_hosts:
+            self._refuse(403, "unexpected Host")
+            return
+        if not hmac.compare_digest(self.headers.get(SECRET_HEADER, ""), proxy.secret):
+            self._refuse(403, f"missing or wrong {SECRET_HEADER}")
+            return
+        # Origin-form only: an absolute-form target would let a caller pick the upstream.
+        if not self.path.startswith("/") or self.path.startswith("//"):
+            self._refuse(400, "absolute-form request targets are not supported")
+            return
+
+        # Buffered so a request refused for an expired token can be replayed once.
+        body = self._read_body()
+        try:
+            upstream = proxy.send(self.command, self.path, self.headers, body, force=False)
+            if upstream.status == 401:
+                upstream.close()
+                upstream = proxy.send(self.command, self.path, self.headers, body, force=True)
+        except Exception as err:  # noqa: BLE001 - surfaced to the client, never the token
+            self._refuse(502, f"could not reach the AI Gateway: {type(err).__name__}: {err}")
+            return
+        self._relay(upstream)
+
+    def _relay(self, upstream: "http.client.HTTPResponse") -> None:
+        self.send_response(upstream.status, upstream.reason)
+        length = upstream.getheader("Content-Length")
+        for name, value in upstream.getheaders():
+            if name.lower() in _HOP_BY_HOP or name.lower() == "content-length":
+                continue
+            self.send_header(name, value)
+        # http.client already undid any upstream chunking, so re-chunk when the length
+        # is unknown: that is what lets SSE stream through without buffering.
+        chunked = length is None and self.command != "HEAD"
+        if chunked:
+            self.send_header("Transfer-Encoding", "chunked")
+        elif length is not None:
+            self.send_header("Content-Length", length)
+        self.end_headers()
+        try:
+            while self.command != "HEAD":
+                data = upstream.read1(_CHUNK)
+                if not data:
+                    break
+                if chunked:
+                    self.wfile.write(f"{len(data):X}\r\n".encode("ascii") + data + b"\r\n")
+                else:
+                    self.wfile.write(data)
+                self.wfile.flush()
+            if chunked:
+                self.wfile.write(b"0\r\n\r\n")
+                self.wfile.flush()
+        finally:
+            upstream.close()
+
+
+class _Server(http.server.ThreadingHTTPServer):
+    def handle_error(self, request, client_address) -> None:
+        # The proxy shares a terminal with the client it runs, so the default traceback
+        # lands in that client's UI. A client dropping a kept-alive connection is routine.
+        if isinstance(sys.exc_info()[1], ConnectionError):
+            return
+        super().handle_error(request, client_address)
+
+
+class AiGatewayProxy:
+    """Forwards to one gateway only, setting ``X-Onehouse-Authorization`` from ``token_source``.
+
+    ``Authorization`` and ``x-api-key`` pass through untouched: a subscription token
+    stays on the gateway's passthrough branch, and a client that sends none stays
+    mediated.
+    """
+
+    def __init__(
+        self,
+        gateway_url: str,
+        token_source,
+        *,
+        port: int = 0,
+        secret: Optional[str] = None,
+        ssl_context: Optional[ssl.SSLContext] = None,
+        connection_factory=None,
+    ) -> None:
+        parts = urllib.parse.urlsplit(gateway_url)
+        if parts.scheme != "https" or not parts.netloc:
+            raise ValueError(f"AI Gateway URL must be https: {gateway_url!r}")
+        self._gateway_host = parts.netloc
+        self._gateway_base_path = parts.path.rstrip("/")
+        self._token_source = token_source
+        self._ssl_context = ssl_context or default_ssl_context()
+        # Tests swap in a plain-HTTP connection to a local upstream.
+        self._connection_factory = connection_factory or (
+            lambda host: http.client.HTTPSConnection(
+                host, timeout=_UPSTREAM_TIMEOUT_SECONDS, context=self._ssl_context
+            )
+        )
+        self.secret = secret or new_secret()
+        handler = type("_BoundHandler", (_Handler,), {"proxy": self})
+        self._server = _Server(("127.0.0.1", port), handler)
+        self._server.daemon_threads = True
+        self.port = self._server.server_address[1]
+        self.allowed_hosts = {f"127.0.0.1:{self.port}", f"localhost:{self.port}"}
+        self._thread: Optional[threading.Thread] = None
+
+    @property
+    def base_url(self) -> str:
+        return f"http://127.0.0.1:{self.port}"
+
+    def send(self, method: str, path: str, headers, body: Optional[bytes], *, force: bool):
+        token = self._token_source.get(force=force)
+        connection = self._connection_factory(self._gateway_host)
+        connection.putrequest(method, self._gateway_base_path + path, skip_accept_encoding=True)
+        for name, value in headers.items():
+            if name.lower() not in _DROPPED_REQUEST_HEADERS:
+                connection.putheader(name, value)
+        connection.putheader(GATEWAY_AUTH_HEADER, f"Bearer {token}")
+        if body is not None:
+            connection.putheader("Content-Length", str(len(body)))
+        connection.endheaders(body)
+        return connection.getresponse()
+
+    def start(self) -> None:
+        self._thread = threading.Thread(target=self._server.serve_forever, daemon=True)
+        self._thread.start()
+
+    def serve_forever(self) -> None:
+        self._server.serve_forever()
+
+    def stop(self) -> None:
+        self._server.shutdown()
+        self._server.server_close()

{onehouse_cli-0.2.0 → onehouse_cli-0.4.0}/onehouse_cli/cli.py

@@ -5,11 +5,12 @@ Global options (--profile, --timeout, --output) are propagated to every
 subcommand via the Click context object (ctx.obj).
 """
 
-import sys
 import click
 
 from . import __version__
 from .commands import (
+    ai_gateway,
+    auth,
     cluster,
     lake,
     database,
@@ -22,10 +23,21 @@ from .commands import (
     job,
     service_principal,
     api_token,
+    install,
+    skill as skill_cmd,
     sql as sql_cmd,
 )
 
 
+_EPILOG = """\
+Agents and new users: run `oh skill` for a complete usage guide covering
+credential setup, the SQL each command emits, and destructive-operation safety.
+
+Note: deletes execute immediately with no confirmation prompt. Use --show-sql
+on any command to preview the statement without running it.
+"""
+
+
 class CliContext:
     def __init__(self, profile: str | None, timeout: int, output: str):
         self.profile = profile
@@ -33,7 +45,10 @@ class CliContext:
         self.output = output
 
 
-@click.group(context_settings={"help_option_names": ["-h", "--help"]})
+@click.group(
+    context_settings={"help_option_names": ["-h", "--help"]},
+    epilog=_EPILOG,
+)
 @click.version_option(__version__, "-v", "--version")
 @click.option(
     "--profile", "-p",
@@ -75,10 +90,17 @@ cli.add_command(job.job)
 cli.add_command(service_principal.service_principal, name="service-principal")
 cli.add_command(api_token.api_token, name="api-token")
 cli.add_command(sql_cmd.sql)
+cli.add_command(skill_cmd.skill)
+cli.add_command(install.install)
+cli.add_command(auth.login)
+cli.add_command(auth.logout)
+cli.add_command(ai_gateway.ai_gateway_group)
 
 
 def main() -> None:
-    sys.exit(cli(standalone_mode=False) or 0)
+    # Standalone mode turns Click errors into a one-line `Error: ...` message
+    # and the conventional exit code (1 = failure, 2 = usage error).
+    cli()
 
 
 if __name__ == "__main__":

{onehouse_cli-0.2.0 → onehouse_cli-0.4.0}/onehouse_cli/client.py

@@ -7,6 +7,7 @@ from pathlib import Path
 import click
 
 try:
+    from onehouse_python_sdk.resources import oauth
     from onehouse_python_sdk.resources.client import OnehouseResources
     from onehouse_python_sdk.resources.exceptions import AuthError, ResourcesError
 except ImportError as exc:
@@ -17,9 +18,16 @@ except ImportError as exc:
     )
     sys.exit(1)
 
+from .profile import api_endpoint
+from .session_store import api_session_store
+
 
 def make_client(profile: str | None, timeout: int) -> OnehouseResources:
-    """Return an OnehouseResources configured from profile + env vars."""
+    """Return an OnehouseResources configured from profile + env vars.
+
+    After `oh login` the client sends the signed-in user's token, and the profile's
+    API key and secret are not used. Without a session it uses them, as before.
+    """
     kwargs: dict = {
         "default_execute_timeout": float(timeout * 60),
     }
@@ -32,6 +40,10 @@ def make_client(profile: str | None, timeout: int) -> OnehouseResources:
         kwargs["profile"] = profile
 
     try:
+        endpoint = api_endpoint(profile)
+        store = api_session_store(oauth.issuer_for(endpoint))
+        if store.get() is not None:
+            kwargs["token_source"] = oauth.FirebaseRefreshTokenSource(endpoint, store)
         return OnehouseResources(**kwargs)
     except AuthError as exc:
         raise click.ClickException(f"Authentication error: {exc}") from exc