pipecatcloud 0.4.0__tar.gz → 0.4.2__tar.gz

{pipecatcloud-0.4.0 → pipecatcloud-0.4.2}/CHANGELOG.md

@@ -5,6 +5,63 @@ All notable changes to **Pipecat Cloud** will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.2] - 2026-04-02
+
+### Added
+
+- **Container health diagnostics in `agent status` and `deploy`**: When a
+  deployment is failing, the CLI now shows the failure reason (e.g.,
+  CrashLoopBackOff, OOMKilled, ImagePullBackOff), exit code, restart count,
+  and the actual error output (e.g., Python tracebacks). This information
+  appears under the revision line in both `pcc agent status` and during
+  deploy monitoring.
+
+### Changed
+
+- All API requests now include a `User-Agent: PipecatCloudCLI/<version>` header,
+  enabling server-side identification of CLI versions for debugging.
+
+### Fixed
+
+- **Default organization resolution for `PIPECAT_TOKEN` auth**: The CLI now
+  automatically resolves the user's default organization from the API when
+  a token is present but no org is configured locally. Previously,
+  `PIPECAT_TOKEN` required the org to be in the config file or `PIPECAT_ORG`
+  to be set as well.
+
+## [0.4.1] - 2026-03-30
+
+### Added
+
+- **Personal Access Token (PAT) support**: Authenticate with the CLI using a
+  PAT instead of interactive OAuth login. Set `PIPECAT_TOKEN=pcc_pat_...` as an
+  environment variable, or run `pcc auth use-pat <token>` to store it to config.
+  PATs work with all CLI commands and inherit the user's org memberships.
+
+- `pcc auth use-pat` command: Validates a PAT against the API and stores it for
+  persistent use without needing an environment variable.
+
+- `pcc auth whoami` now shows the current auth method (PAT or OAuth).
+
+### Changed
+
+- **OAuth2 authentication**: `pcc auth login` now uses industry-standard
+  OAuth2 Authorization Code + PKCE, replacing the custom device-code flow.
+  Tokens auto-refresh transparently — no more "please run `pcc auth login`"
+  interruptions.
+
+- `pcc auth logout` now revokes tokens server-side. Previously, logout only
+  deleted local credentials and the token remained valid until expiry.
+
+- `pcc auth whoami` now displays the user's email address instead of the
+  internal user ID.
+
+### Fixed
+
+- Credentials file with overly permissive permissions is now automatically
+  repaired to 600 instead of issuing a suppressible warning. If repair fails,
+  the CLI refuses to load the token.
+
 ## [0.4.0] - 2026-03-29
 
 ### Added

{pipecatcloud-0.4.0 → pipecatcloud-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pipecatcloud
-Version: 0.4.0
+Version: 0.4.2
 Summary: Cloud hosting for Pipecat AI applications
 License: BSD 2-Clause License
 Project-URL: Website, https://docs.pipecat.daily.co/

pipecatcloud-0.4.2/src/pipecatcloud/_utils/auth_utils.py

@@ -0,0 +1,67 @@
+#
+# Copyright (c) 2025, Daily
+#
+# SPDX-License-Identifier: BSD 2-Clause License
+#
+
+import functools
+from typing import Optional
+
+import aiohttp
+
+from pipecatcloud.__version__ import version
+from pipecatcloud._utils.console_utils import console
+from pipecatcloud.cli import PIPECAT_CLI_NAME
+from pipecatcloud.cli.config import config
+
+
+async def _resolve_default_org(token: str) -> Optional[str]:
+    """Fetch the user's default organization using the given token."""
+    from pipecatcloud.config import config as base_config
+
+    api_host = base_config.get("api_host")
+    org_path = base_config.get("organization_path")
+    url = f"{api_host}{org_path}"
+
+    async with aiohttp.ClientSession() as session:
+        async with session.get(
+            url,
+            headers={
+                "Authorization": f"Bearer {token}",
+                "User-Agent": f"PipecatCloudCLI/{version}",
+            },
+        ) as resp:
+            if resp.status == 200:
+                data = await resp.json()
+                organizations = data.get("organizations", [])
+                if organizations:
+                    return organizations[0]["name"]
+    return None
+
+
+def requires_login(func):
+    @functools.wraps(func)
+    async def wrapper(*args, **kwargs):
+        token = config.get("token")
+        if token is None:
+            console.error(
+                f"You are not logged in. Please run `{PIPECAT_CLI_NAME} auth login` first.",
+            )
+            return
+
+        # When org is not set locally (e.g. PIPECAT_TOKEN without a config file),
+        # resolve the user's default organization from the API.
+        if config.get("org") is None:
+            org_name = await _resolve_default_org(token)
+            if org_name:
+                config.override_locally("org", org_name)
+            else:
+                console.error(
+                    "Could not determine your organization. "
+                    f"Set PIPECAT_ORG or run `{PIPECAT_CLI_NAME} auth login`.",
+                )
+                return
+
+        return await func(*args, **kwargs)
+
+    return wrapper

{pipecatcloud-0.4.0 → pipecatcloud-0.4.2}/src/pipecatcloud/_utils/deploy_utils.py

@@ -75,7 +75,7 @@ def _format_elapsed(phase_started_at: Optional[str]) -> str:
 
 
 def _format_revision_line(label: str, rev: dict) -> str:
-    """Format a single revision as an indented detail line."""
+    """Format a single revision as an indented detail line, with health details if present."""
     deploy_id = rev.get("deploymentID", "unknown")[:8]
     phase = rev.get("phase", "Unknown")
     ready_replicas = rev.get("readyReplicas")
@@ -88,7 +88,53 @@ def _format_revision_line(label: str, rev: dict) -> str:
     if elapsed:
         parts.append(f"[dim]·[/dim] [dim]{elapsed}[/dim]")
 
-    return " ".join(parts)
+    lines = [" ".join(parts)]
+
+    # Append health details if present and unhealthy
+    health = rev.get("health")
+    if health and not (health.get("ready") and health.get("restartCount", 0) == 0):
+        lines.extend(format_health_lines(health))
+
+    if rev.get("hasInfrastructureIssue"):
+        lines.append("      [yellow]Infrastructure issue detected — contact support[/yellow]")
+
+    return "\n".join(lines)
+
+
+def format_health_lines(health: dict) -> list:
+    """Format health details as indented lines under a revision."""
+    lines = []
+    reason_parts = []
+    reason = health.get("reason", "")
+    term_reason = health.get("lastTerminationReason", "")
+    exit_code = health.get("lastExitCode")
+
+    if reason:
+        detail = reason
+        if term_reason and term_reason != reason:
+            detail += f" ({term_reason}"
+            if exit_code is not None:
+                detail += f", exit {exit_code}"
+            detail += ")"
+        elif exit_code is not None:
+            detail += f" (exit {exit_code})"
+        reason_parts.append(f"[red]{detail}[/red]")
+
+    restarts = health.get("restartCount", 0)
+    replicas_started = health.get("replicasStarted", 0)
+    if restarts > 0:
+        reason_parts.append(f"[dim]·[/dim] {restarts} restarts across {replicas_started} replicas")
+
+    if reason_parts:
+        lines.append("      " + " ".join(reason_parts))
+
+    message = health.get("message", "")
+    if message:
+        last_line = message.strip().split("\n")[-1].strip()
+        if last_line:
+            lines.append(f"      [dim]{last_line}[/dim]")
+
+    return lines
 
 
 def _build_status_message(headline: str, current_rev=None, previous_rev=None) -> str:

{pipecatcloud-0.4.0 → pipecatcloud-0.4.2}/src/pipecatcloud/api.py

@@ -5,12 +5,14 @@
 #
 
 import json
+import time
 from functools import wraps
 from typing import Callable, List, Optional, Union
 
 import aiohttp
 from loguru import logger
 
+from pipecatcloud.__version__ import version
 from pipecatcloud._utils.deploy_utils import DeployConfigParams
 from pipecatcloud.config import config
 from pipecatcloud.exception import AgentStartError
@@ -48,10 +50,70 @@ class _API:
         return f"{config.get('api_host', '')}{config.get(path, '')}"
 
     def _configure_headers(self, override_token: Optional[str] = None) -> dict:
-        if not self.token and not override_token:
-            return {}
-        return {"Authorization": f"Bearer {override_token or self.token}"}
+        headers = {"User-Agent": f"PipecatCloudCLI/{version}"}
+        if self.token or override_token:
+            headers["Authorization"] = f"Bearer {override_token or self.token}"
+        return headers
 
+    def _is_pat(self) -> bool:
+        """Check if the current token is a Personal Access Token."""
+        return bool(self.token and self.token.startswith("pcc_pat_"))
+
+    def _is_token_expired(self) -> bool:
+        """Check if the current OAuth token is near expiry.
+
+        Returns False for PATs (they don't expire via OAuth) and for
+        non-OAuth tokens (no token_expires_at stored).
+        """
+        if self._is_pat():
+            return False
+
+        from pipecatcloud.cli.config import config as cli_config
+
+        expires_at = cli_config.get("token_expires_at")
+        if expires_at is None:
+            return False
+        # Refresh 60 seconds before actual expiry to avoid race conditions
+        return time.time() > (float(expires_at) - 60)
+
+    async def _refresh_oauth_token(self) -> Optional[str]:
+        """Refresh the OAuth access token using the stored refresh token.
+
+        Updates both the on-disk config and the in-memory token on this API
+        instance. Returns the new access token, or None if refresh failed
+        (in which case the request will proceed with the expired token and
+        the server will return 401, prompting re-login).
+        """
+        from pipecatcloud.cli.config import config as cli_config, update_user_config
+
+        # Inline import: auth.py → cli/api.py → api.py creates a circular
+        # dependency at module load time. Importing here (at call time)
+        # breaks the cycle.
+        from pipecatcloud.cli.commands.auth import refresh_access_token
+
+        refresh_token = cli_config.get("refresh_token")
+        if not refresh_token:
+            return None
+
+        tokens = await refresh_access_token(refresh_token)
+        if not tokens:
+            return None
+
+        new_token = tokens["access_token"]
+        new_refresh = tokens.get("refresh_token", refresh_token)
+        expires_at = time.time() + tokens.get("expires_in", 86400)
+
+        update_user_config(
+            token=new_token,
+            refresh_token=new_refresh,
+            token_expires_at=expires_at,
+        )
+        self.token = new_token
+        return new_token
+
+    # TODO: several auth.py and agent.py calls bypass _base_request() with their
+    # own aiohttp.ClientSession(). A longer-term cleanup could route all PCC API
+    # calls through _base_request() so headers (User-Agent, Auth) are set in one place.
     async def _base_request(
         self,
         method: str,
@@ -61,6 +123,15 @@ class _API:
         not_found_is_empty: bool = False,
         override_token: Optional[str] = None,
     ) -> Optional[dict]:
+        # Auto-refresh expired OAuth tokens before making the request.
+        # Only runs for CLI usage (self.is_cli) and only when an OAuth
+        # refresh_token is stored (token_expires_at is set). Old device-code
+        # tokens are unaffected since _is_token_expired() returns False.
+        if self.is_cli and not override_token and self._is_token_expired():
+            new_token = await self._refresh_oauth_token()
+            if new_token is None:
+                logger.debug("Token refresh failed, proceeding with expired token")
+
         async with aiohttp.ClientSession() as session:
             logger.debug(f"Request: {method} {url} {params} {json}")
 

{pipecatcloud-0.4.0 → pipecatcloud-0.4.2}/src/pipecatcloud/cli/commands/agent.py

@@ -20,6 +20,7 @@ from rich.panel import Panel
 from rich.table import Table
 from rich.text import Text
 
+from pipecatcloud.__version__ import version as _cli_version
 from pipecatcloud._utils.async_utils import synchronizer
 from pipecatcloud._utils.auth_utils import requires_login
 from pipecatcloud._utils.console_utils import (
@@ -31,6 +32,7 @@ from pipecatcloud._utils.console_utils import (
 from pipecatcloud._utils.deploy_utils import (
     CONFIG_FILE_OPTION,
     DeployConfigParams,
+    format_health_lines,
     with_deploy_config,
 )
 from pipecatcloud._utils.regions import get_region_codes, validate_region
@@ -285,6 +287,18 @@ async def status(
                 current_parts.append(f"[dim]·[/dim] {rev_replicas} agents")
             health_lines.append(" ".join(current_parts))
 
+            # Show health details when available (skip if healthy with no restarts)
+            rev_health = current_rev.get("health")
+            if rev_health and not (
+                rev_health.get("ready") and rev_health.get("restartCount", 0) == 0
+            ):
+                health_lines.extend(format_health_lines(rev_health))
+
+            if current_rev.get("hasInfrastructureIssue"):
+                health_lines.append(
+                    "    [yellow]Infrastructure issue detected — contact support[/yellow]"
+                )
+
             if previous_rev:
                 prev_phase = previous_rev.get("phase", "Unknown")
                 prev_id = previous_rev.get("deploymentID", "")[:8]
@@ -720,7 +734,10 @@ async def deployments(
             async with aiohttp.ClientSession() as session:
                 response = await session.get(
                     f"{API.construct_api_url('services_deployments_path').format(org=org, service=agent_name)}",
-                    headers={"Authorization": f"Bearer {token}"},
+                    headers={
+                        "Authorization": f"Bearer {token}",
+                        "User-Agent": f"PipecatCloudCLI/{_cli_version}",
+                    },
                 )
             if response.status != 200:
                 error_code = str(response.status)