pipecatcloud 0.3.1__tar.gz → 0.4.1__tar.gz

{pipecatcloud-0.3.1 → pipecatcloud-0.4.1}/CHANGELOG.md

@@ -5,6 +5,66 @@ All notable changes to **Pipecat Cloud** will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.1] - 2026-03-30
+
+### Added
+
+- **Personal Access Token (PAT) support**: Authenticate with the CLI using a
+  PAT instead of interactive OAuth login. Set `PIPECAT_TOKEN=pcc_pat_...` as an
+  environment variable, or run `pcc auth use-pat <token>` to store it to config.
+  PATs work with all CLI commands and inherit the user's org memberships.
+
+- `pcc auth use-pat` command: Validates a PAT against the API and stores it for
+  persistent use without needing an environment variable.
+
+- `pcc auth whoami` now shows the current auth method (PAT or OAuth).
+
+### Changed
+
+- **OAuth2 authentication**: `pcc auth login` now uses industry-standard
+  OAuth2 Authorization Code + PKCE, replacing the custom device-code flow.
+  Tokens auto-refresh transparently — no more "please run `pcc auth login`"
+  interruptions.
+
+- `pcc auth logout` now revokes tokens server-side. Previously, logout only
+  deleted local credentials and the token remained valid until expiry.
+
+- `pcc auth whoami` now displays the user's email address instead of the
+  internal user ID.
+
+### Fixed
+
+- Credentials file with overly permissive permissions is now automatically
+  repaired to 600 instead of issuing a suppressible warning. If repair fails,
+  the CLI refuses to load the token.
+
+## [0.4.0] - 2026-03-29
+
+### Added
+
+- **`--config-file` flag**: Specify an alternate deploy config file on any
+  command that uses a config file (`deploy`, `agent sessions`, `agent start`,
+  `agent stop`, `docker build-push`). Enables multi-environment workflows
+  without renaming files or setting environment variables.
+
+### Changed
+
+- Renamed `--config` to `--show-cli-config` for clarity — it displays internal
+  CLI state (credentials, active org), not deploy configuration.
+
+### Removed
+
+- Removed `--enable-managed-keys` CLI option from `deploy` command.
+
+- Removed `enable_managed_keys` from `pcc-deploy.toml` configuration.
+
+- Removed "Managed Keys" status display from `agent status` output.
+
+### Fixed
+
+- CLI no longer crashes on a malformed credentials file. It warns and allows
+  `auth login` to run so the user can fix it.
+
 ## [0.3.1] - 2026-03-13
 
 ### Added

{pipecatcloud-0.3.1 → pipecatcloud-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pipecatcloud
-Version: 0.3.1
+Version: 0.4.1
 Summary: Cloud hosting for Pipecat AI applications
 License: BSD 2-Clause License
 Project-URL: Website, https://docs.pipecat.daily.co/

{pipecatcloud-0.3.1 → pipecatcloud-0.4.1}/src/pipecatcloud/_utils/deploy_utils.py

@@ -10,10 +10,13 @@ from datetime import datetime, timezone
 from enum import Enum
 from typing import Callable, List, Optional
 
+
 import toml
+import typer
 from attr import dataclass, field
 from loguru import logger
 
+from pipecatcloud.cli import PIPECAT_DEPLOY_CONFIG_PATH
 from pipecatcloud.constants import KRISP_VIVA_MODELS, KrispVivaAudioFilter
 from pipecatcloud.exception import ConfigFileError
 
@@ -280,7 +283,6 @@ class DeployConfigParams:
     region: Optional[str] = None
     scaling: ScalingParams = ScalingParams()
     enable_krisp: bool = False
-    enable_managed_keys: bool = False
     docker_config: dict = field(factory=dict)
     build_config: BuildConfig = field(factory=BuildConfig)  # Cloud build configuration
     agent_profile: Optional[str] = None
@@ -303,7 +305,6 @@ class DeployConfigParams:
             "region": self.region,
             "scaling": self.scaling.to_dict() if self.scaling else None,
             "enable_krisp": self.enable_krisp,
-            "enable_managed_keys": self.enable_managed_keys,
             "docker_config": self.docker_config,
             "build_config": self.build_config.to_dict() if self.build_config else None,
             "agent_profile": self.agent_profile,
@@ -363,7 +364,6 @@ def load_deploy_config_file() -> Optional[DeployConfigParams]:
             "region",
             "scaling",
             "enable_krisp",
-            "enable_managed_keys",
             "docker",
             "build",
             "agent_profile",
@@ -380,14 +380,34 @@ def load_deploy_config_file() -> Optional[DeployConfigParams]:
         raise ConfigFileError(str(e))
 
 
+CONFIG_FILE_OPTION: Optional[str] = typer.Option(
+    None,
+    "--config-file",
+    help=f"Path to deploy config file (default: {PIPECAT_DEPLOY_CONFIG_PATH})",
+)
+
+
 def with_deploy_config(func: Callable) -> Callable:
     """
     Decorator that loads the deploy config file and injects it into the function.
     If the config file exists, it will be loaded and passed to the function as `deploy_config`.
+
+    If the wrapped function receives a `config_file` kwarg (from a --config-file typer option),
+    it will override the default deploy config path before loading.
     """
 
     @functools.wraps(func)
     def wrapper(*args, **kwargs):
+        config_file = kwargs.pop("config_file", None)
+        if config_file:
+            import pipecatcloud.cli.config as config_module
+
+            if not os.path.exists(config_file):
+                from pipecatcloud._utils.console_utils import console
+
+                console.error(f"Deploy config file not found: {config_file}")
+                raise typer.Exit(1)
+            config_module.deploy_config_path = config_file
         try:
             deploy_config = load_deploy_config_file()
             kwargs["deploy_config"] = deploy_config

{pipecatcloud-0.3.1 → pipecatcloud-0.4.1}/src/pipecatcloud/api.py

@@ -5,6 +5,7 @@
 #
 
 import json
+import time
 from functools import wraps
 from typing import Callable, List, Optional, Union
 
@@ -52,6 +53,62 @@ class _API:
             return {}
         return {"Authorization": f"Bearer {override_token or self.token}"}
 
+    def _is_pat(self) -> bool:
+        """Check if the current token is a Personal Access Token."""
+        return bool(self.token and self.token.startswith("pcc_pat_"))
+
+    def _is_token_expired(self) -> bool:
+        """Check if the current OAuth token is near expiry.
+
+        Returns False for PATs (they don't expire via OAuth) and for
+        non-OAuth tokens (no token_expires_at stored).
+        """
+        if self._is_pat():
+            return False
+
+        from pipecatcloud.cli.config import config as cli_config
+
+        expires_at = cli_config.get("token_expires_at")
+        if expires_at is None:
+            return False
+        # Refresh 60 seconds before actual expiry to avoid race conditions
+        return time.time() > (float(expires_at) - 60)
+
+    async def _refresh_oauth_token(self) -> Optional[str]:
+        """Refresh the OAuth access token using the stored refresh token.
+
+        Updates both the on-disk config and the in-memory token on this API
+        instance. Returns the new access token, or None if refresh failed
+        (in which case the request will proceed with the expired token and
+        the server will return 401, prompting re-login).
+        """
+        from pipecatcloud.cli.config import config as cli_config, update_user_config
+
+        # Inline import: auth.py → cli/api.py → api.py creates a circular
+        # dependency at module load time. Importing here (at call time)
+        # breaks the cycle.
+        from pipecatcloud.cli.commands.auth import refresh_access_token
+
+        refresh_token = cli_config.get("refresh_token")
+        if not refresh_token:
+            return None
+
+        tokens = await refresh_access_token(refresh_token)
+        if not tokens:
+            return None
+
+        new_token = tokens["access_token"]
+        new_refresh = tokens.get("refresh_token", refresh_token)
+        expires_at = time.time() + tokens.get("expires_in", 86400)
+
+        update_user_config(
+            token=new_token,
+            refresh_token=new_refresh,
+            token_expires_at=expires_at,
+        )
+        self.token = new_token
+        return new_token
+
     async def _base_request(
         self,
         method: str,
@@ -61,6 +118,15 @@ class _API:
         not_found_is_empty: bool = False,
         override_token: Optional[str] = None,
     ) -> Optional[dict]:
+        # Auto-refresh expired OAuth tokens before making the request.
+        # Only runs for CLI usage (self.is_cli) and only when an OAuth
+        # refresh_token is stored (token_expires_at is set). Old device-code
+        # tokens are unaffected since _is_token_expired() returns False.
+        if self.is_cli and not override_token and self._is_token_expired():
+            new_token = await self._refresh_oauth_token()
+            if new_token is None:
+                logger.debug("Token refresh failed, proceeding with expired token")
+
         async with aiohttp.ClientSession() as session:
             logger.debug(f"Request: {method} {url} {params} {json}")
 
@@ -336,7 +402,6 @@ class _API:
                 "maxAgents": deploy_config.scaling.max_agents,
             },
             "enableKrisp": deploy_config.enable_krisp,
-            "enableIntegratedKeysProxy": deploy_config.enable_managed_keys,  # API expects this field name
             "agentProfile": deploy_config.agent_profile,
             "krispViva": {
                 "audioFilter": deploy_config.krisp_viva.audio_filter,

{pipecatcloud-0.3.1 → pipecatcloud-0.4.1}/src/pipecatcloud/cli/commands/agent.py

@@ -28,7 +28,11 @@ from pipecatcloud._utils.console_utils import (
     format_duration,
     format_timestamp,
 )
-from pipecatcloud._utils.deploy_utils import DeployConfigParams, with_deploy_config
+from pipecatcloud._utils.deploy_utils import (
+    CONFIG_FILE_OPTION,
+    DeployConfigParams,
+    with_deploy_config,
+)
 from pipecatcloud._utils.regions import get_region_codes, validate_region
 from pipecatcloud.cli import PIPECAT_CLI_NAME
 from pipecatcloud.cli.api import API
@@ -206,24 +210,6 @@ async def status(
             str(data.get("updatedAt", "N/A")),
         )
 
-        # Check for Managed Keys status
-        # API returns integratedKeysProxy but we display as "Managed Keys"
-        integrated_keys = (
-            data.get("deployment", {})
-            .get("manifest", {})
-            .get("spec", {})
-            .get("integratedKeysProxy", {})
-        )
-        if isinstance(integrated_keys, dict):
-            integrated_keys_enabled = integrated_keys.get("enabled", False)
-        else:
-            integrated_keys_enabled = bool(integrated_keys)
-
-        deployment_table.add_row(
-            "[bold]Managed Keys:[/bold]",
-            "[green]Enabled[/green]" if integrated_keys_enabled else "[dim]Disabled[/dim]",
-        )
-
         # Check for Krisp VIVA status (reverse-mapped by API)
         krisp_viva = data.get("krispViva")
         krisp_viva_status = "[dim]Disabled[/dim]"
@@ -346,6 +332,7 @@ async def status(
 @with_deploy_config
 async def sessions(
     deploy_config=typer.Option(None, hidden=True),
+    config_file: Optional[str] = CONFIG_FILE_OPTION,
     agent_name: str = typer.Argument(
         None, help="Name of the agent to list sessions for e.g. 'my-agent'", show_default=False
     ),
@@ -781,6 +768,7 @@ async def deployments(
 @with_deploy_config
 async def start(
     deploy_config=typer.Option(None, hidden=True),
+    config_file: Optional[str] = CONFIG_FILE_OPTION,
     agent_name: str = typer.Argument(None, help="Name of the agent to start e.g. 'my-agent'"),
     force: bool = typer.Option(
         False,
@@ -947,6 +935,7 @@ async def start(
 @with_deploy_config
 async def stop(
     deploy_config=typer.Option(None, hidden=True),
+    config_file: Optional[str] = CONFIG_FILE_OPTION,
     agent_name: str = typer.Argument(None, help="Name of the agent e.g. 'my-agent'"),
     session_id: str = typer.Option(
         ...,