powerbase-cli 0.1.0__tar.gz → 0.1.2__tar.gz

{powerbase_cli-0.1.0 → powerbase_cli-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: powerbase-cli
-Version: 0.1.0
+Version: 0.1.2
 Summary: CLI for operating Powerbase console workflows
 Author: Powerbase
 Requires-Python: >=3.11
@@ -101,10 +101,12 @@ This will:
 
 1. request a CLI login session from Powerbase
 2. print a browser URL
-3. poll until browser approval or until `--timeout` elapses (default **300** seconds, five minutes)
+3. poll until browser approval or until `--timeout` elapses (default **600** seconds, ten minutes)
 4. save the resulting session to `~/.config/powerbase/auth.json`
 
-Use `--timeout 0` to wait without a time limit. Use a larger value if users need more than five minutes to complete login.
+Use `--timeout 0` to wait without a time limit. Use a larger value if users need more than ten minutes to complete login.
+For agent-guided workflows, prefer `powerbase auth login --no-wait --json` so the CLI returns the `login_url` and exits immediately instead of blocking on polling.
+If the browser link expires or the user is not currently signed in to the console, rerun `powerbase auth login --no-wait --json` to generate a fresh login URL before retrying.
 If an agent or wrapper script is coordinating the workflow, it is still helpful
 to tell the user: after browser approval, return to the current session so the
 remaining steps can continue.
@@ -278,13 +280,15 @@ When Openclaw or another LLM agent uses `powerbase`:
 - run discovery commands before write operations
 - set context for long multi-step tasks
 - use `auth status` before workflows that assume login
-- use `auth token-set` if browser login is not practical in the current environment
+- prefer `auth login --no-wait --json` for browser login so the agent can hand `login_url` back to the user
+- if a protected command says authentication is missing or expired, rerun `auth login --no-wait --json` to generate a fresh login URL
+- do not have the agent open the browser login URL itself; the user must complete that approval step
 - remember that `--json` overrides a saved `config output text` setting for that command
 
 Recommended agent sequence:
 
 1. `powerbase auth status --json`
-2. If unauthenticated, run `powerbase auth login` or `powerbase auth token-set`
+2. If unauthenticated, or if a protected command reports an auth error, run `powerbase auth login --no-wait --json`, return the `login_url` to the user, and wait for them to approve in the browser
 3. `powerbase context show --json`
 4. If no instance is selected, run `powerbase instance list --json`
 5. If no suitable instance exists, prefer `powerbase instance create --name ... --org-id ... --json`

{powerbase_cli-0.1.0 → powerbase_cli-0.1.2}/README.md

@@ -93,10 +93,12 @@ This will:
 
 1. request a CLI login session from Powerbase
 2. print a browser URL
-3. poll until browser approval or until `--timeout` elapses (default **300** seconds, five minutes)
+3. poll until browser approval or until `--timeout` elapses (default **600** seconds, ten minutes)
 4. save the resulting session to `~/.config/powerbase/auth.json`
 
-Use `--timeout 0` to wait without a time limit. Use a larger value if users need more than five minutes to complete login.
+Use `--timeout 0` to wait without a time limit. Use a larger value if users need more than ten minutes to complete login.
+For agent-guided workflows, prefer `powerbase auth login --no-wait --json` so the CLI returns the `login_url` and exits immediately instead of blocking on polling.
+If the browser link expires or the user is not currently signed in to the console, rerun `powerbase auth login --no-wait --json` to generate a fresh login URL before retrying.
 If an agent or wrapper script is coordinating the workflow, it is still helpful
 to tell the user: after browser approval, return to the current session so the
 remaining steps can continue.
@@ -270,13 +272,15 @@ When Openclaw or another LLM agent uses `powerbase`:
 - run discovery commands before write operations
 - set context for long multi-step tasks
 - use `auth status` before workflows that assume login
-- use `auth token-set` if browser login is not practical in the current environment
+- prefer `auth login --no-wait --json` for browser login so the agent can hand `login_url` back to the user
+- if a protected command says authentication is missing or expired, rerun `auth login --no-wait --json` to generate a fresh login URL
+- do not have the agent open the browser login URL itself; the user must complete that approval step
 - remember that `--json` overrides a saved `config output text` setting for that command
 
 Recommended agent sequence:
 
 1. `powerbase auth status --json`
-2. If unauthenticated, run `powerbase auth login` or `powerbase auth token-set`
+2. If unauthenticated, or if a protected command reports an auth error, run `powerbase auth login --no-wait --json`, return the `login_url` to the user, and wait for them to approve in the browser
 3. `powerbase context show --json`
 4. If no instance is selected, run `powerbase instance list --json`
 5. If no suitable instance exists, prefer `powerbase instance create --name ... --org-id ... --json`

{powerbase_cli-0.1.0 → powerbase_cli-0.1.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "powerbase-cli"
-version = "0.1.0"
+version = "0.1.2"
 description = "CLI for operating Powerbase console workflows"
 readme = "README.md"
 requires-python = ">=3.11"

{powerbase_cli-0.1.0 → powerbase_cli-0.1.2}/src/powerbase_cli/commands/auth.py

@@ -10,6 +10,25 @@ def handle_auth_login(args: argparse.Namespace) -> int:
     store, config, _, _, api = build_api(args)
     data = api.start_cli_login()
     login_id = data["login_id"]
+    if getattr(args, "no_wait_login", False):
+        render_output(
+            args,
+            {
+                "status": "pending",
+                "login_id": login_id,
+                "login_url": data["login_url"],
+                "poll_interval": data.get("poll_interval", 2),
+                "next_action": "ask_user_to_open_url",
+                "message": (
+                    "Ask the user to open login_url in a browser and approve the request. "
+                    "If the user is not already signed in to the console or this link expires, "
+                    "rerun `powerbase auth login --no-wait --json` to generate a fresh login URL. "
+                    "After approval, rerun `powerbase auth status --json` or invoke "
+                    "`powerbase auth login` without `--no-wait` to finish in this session."
+                ),
+            },
+        )
+        return 0
     timeout_sec = int(args.login_timeout)
     if timeout_sec < 0:
         raise RuntimeError("--timeout must be >= 0 (0 means wait indefinitely).")
@@ -30,8 +49,9 @@ def handle_auth_login(args: argparse.Namespace) -> int:
                 if remaining <= 0:
                     raise RuntimeError(
                         f"Login timed out after {timeout_sec} seconds without browser approval. "
-                        "Complete login sooner, run `powerbase auth login` again, or pass a larger "
-                        "`--timeout` (use `--timeout 0` to wait indefinitely)."
+                        "Complete login sooner, rerun `powerbase auth login --no-wait --json` to "
+                        "generate a fresh login URL, or pass a larger `--timeout` "
+                        "(use `--timeout 0` to wait indefinitely)."
                     )
             else:
                 remaining = float("inf")
@@ -116,24 +136,37 @@ def register_auth_commands(subparsers: argparse._SubParsersAction[argparse.Argum
         help="Manage login state.",
         description="Log in, inspect, refresh, or clear the saved Powerbase session.",
     )
-    auth_sub = auth.add_subparsers(dest="auth_command")
+    auth_sub = auth.add_subparsers(
+        dest="auth_command",
+        metavar="{login,status,refresh,logout}",
+    )
     p = auth_sub.add_parser(
         "login",
         help="Start browser login.",
         description=(
             "Start browser-based login. This prints a login URL, polls until approval in the browser "
-            "or until --timeout seconds elapse (default 300), then saves the session to "
-            "~/.config/powerbase/auth.json. Use --timeout 0 to wait without a time limit."
+            "or until --timeout seconds elapse (default 600), then saves the session to "
+            "~/.config/powerbase/auth.json. Use --timeout 0 to wait without a time limit. "
+            "Use --no-wait to print the login URL and exit immediately without polling."
+        ),
+    )
+    p.add_argument(
+        "--no-wait",
+        dest="no_wait_login",
+        action="store_true",
+        help=(
+            "Return the login URL and exit immediately without polling for approval. "
+            "Useful for agent-guided flows where the user must open the URL manually."
         ),
     )
     p.add_argument(
         "--timeout",
         dest="login_timeout",
         type=int,
-        default=300,
+        default=600,
         metavar="SECONDS",
         help=(
-            "Stop polling after this many seconds if login is not approved (default: 300). "
+            "Stop polling after this many seconds if login is not approved (default: 600). "
             "Pass 0 to wait indefinitely."
         ),
     )
@@ -157,7 +190,6 @@ def register_auth_commands(subparsers: argparse._SubParsersAction[argparse.Argum
     p.set_defaults(handler=handle_auth_logout)
     p = auth_sub.add_parser(
         "token-set",
-        help="Save tokens into auth.json.",
         description=(
             "Save an access token and optional refresh token into ~/.config/powerbase/auth.json. "
             "If you skip the refresh token, the CLI cannot auto-refresh when the access token expires."

{powerbase_cli-0.1.0 → powerbase_cli-0.1.2}/src/powerbase_cli/session.py

@@ -39,6 +39,12 @@ class SessionManager:
         self.tls_insecure = tls_insecure
         self.ca_cert_file = ca_cert_file
 
+    def _login_guidance(self) -> str:
+        return (
+            "Run `powerbase auth login --no-wait --json` to generate a fresh login URL, "
+            "ask the user to open it in their own browser, and retry after approval."
+        )
+
     def _urlopen(self, req: request.Request):
         if self.tls_insecure:
             context = ssl.create_default_context()
@@ -81,9 +87,12 @@ class SessionManager:
     def refresh(self, auth: AuthState | None = None) -> AuthState:
         auth = auth or self.get_auth_state()
         if not auth:
-            raise SessionError("No authentication session available.")
+            raise SessionError(f"No authentication session available. {self._login_guidance()}")
         if not auth.session.refresh_token:
-            raise SessionError("Current session has no refresh token. Please log in again.")
+            raise SessionError(
+                "Current session has no refresh token or can no longer be refreshed. "
+                f"{self._login_guidance()}"
+            )
         if not self.base_url or not self.anon_key:
             raise SessionError("base_url and anon_key are required to refresh the session.")
 

{powerbase_cli-0.1.0 → powerbase_cli-0.1.2}/src/powerbase_cli/transport.py

@@ -27,6 +27,12 @@ class PowerbaseTransport:
         self.config = config
         self.session_manager = session_manager
 
+    def _login_guidance(self) -> str:
+        return (
+            "Run `powerbase auth login --no-wait --json` to generate a fresh login URL, "
+            "ask the user to open it in their own browser, and retry after approval."
+        )
+
     def _urlopen(self, req: request.Request):
         if self.config.tls_insecure:
             context = ssl.create_default_context()
@@ -76,7 +82,11 @@ class PowerbaseTransport:
             data = json.loads(body_text)
         except json.JSONDecodeError:
             data = {"error": body_text}
-        return ApiError(data.get("error") or body_text or exc.reason, exc.code)
+        message = data.get("error") or body_text or exc.reason
+        if exc.code == 401:
+            base_message = str(message).strip() or "Authentication failed."
+            message = f"{base_message} {self._login_guidance()}"
+        return ApiError(str(message), exc.code)
 
     def invoke(
         self,
@@ -95,6 +105,11 @@ class PowerbaseTransport:
             raise ApiError("Powerbase anon key is not configured.")
 
         auth = self.session_manager.ensure_valid() if requires_auth else None
+        if requires_auth and not auth:
+            raise ApiError(
+                f"No authentication session available. {self._login_guidance()}",
+                401,
+            )
         url = f"{self.config.base_url.rstrip('/')}/functions/v1/{function_path}"
         payload = None if body is None else json.dumps(body).encode("utf-8")
         request_headers = self._build_headers(

{powerbase_cli-0.1.0 → powerbase_cli-0.1.2}/src/powerbase_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: powerbase-cli
-Version: 0.1.0
+Version: 0.1.2
 Summary: CLI for operating Powerbase console workflows
 Author: Powerbase
 Requires-Python: >=3.11
@@ -101,10 +101,12 @@ This will:
 
 1. request a CLI login session from Powerbase
 2. print a browser URL
-3. poll until browser approval or until `--timeout` elapses (default **300** seconds, five minutes)
+3. poll until browser approval or until `--timeout` elapses (default **600** seconds, ten minutes)
 4. save the resulting session to `~/.config/powerbase/auth.json`
 
-Use `--timeout 0` to wait without a time limit. Use a larger value if users need more than five minutes to complete login.
+Use `--timeout 0` to wait without a time limit. Use a larger value if users need more than ten minutes to complete login.
+For agent-guided workflows, prefer `powerbase auth login --no-wait --json` so the CLI returns the `login_url` and exits immediately instead of blocking on polling.
+If the browser link expires or the user is not currently signed in to the console, rerun `powerbase auth login --no-wait --json` to generate a fresh login URL before retrying.
 If an agent or wrapper script is coordinating the workflow, it is still helpful
 to tell the user: after browser approval, return to the current session so the
 remaining steps can continue.
@@ -278,13 +280,15 @@ When Openclaw or another LLM agent uses `powerbase`:
 - run discovery commands before write operations
 - set context for long multi-step tasks
 - use `auth status` before workflows that assume login
-- use `auth token-set` if browser login is not practical in the current environment
+- prefer `auth login --no-wait --json` for browser login so the agent can hand `login_url` back to the user
+- if a protected command says authentication is missing or expired, rerun `auth login --no-wait --json` to generate a fresh login URL
+- do not have the agent open the browser login URL itself; the user must complete that approval step
 - remember that `--json` overrides a saved `config output text` setting for that command
 
 Recommended agent sequence:
 
 1. `powerbase auth status --json`
-2. If unauthenticated, run `powerbase auth login` or `powerbase auth token-set`
+2. If unauthenticated, or if a protected command reports an auth error, run `powerbase auth login --no-wait --json`, return the `login_url` to the user, and wait for them to approve in the browser
 3. `powerbase context show --json`
 4. If no instance is selected, run `powerbase instance list --json`
 5. If no suitable instance exists, prefer `powerbase instance create --name ... --org-id ... --json`

{powerbase_cli-0.1.0 → powerbase_cli-0.1.2}/tests/test_cli_commands.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import json
 import sys
 import tempfile
 import unittest
@@ -36,6 +37,18 @@ class FakeApiPending:
         return {"status": "pending", "poll_interval": 2}
 
 
+class FakeApiNoWait:
+    def start_cli_login(self):
+        return {
+            "login_id": "login-nowait",
+            "login_url": "https://console.example.com/cli-auth/login-nowait",
+            "poll_interval": 2,
+        }
+
+    def poll_cli_login(self, login_id: str):
+        raise AssertionError("poll_cli_login should not be called when --no-wait is set")
+
+
 class FakeApi:
     def start_cli_login(self):
         return {
@@ -101,7 +114,15 @@ class CliCommandTests(unittest.TestCase):
         with tempfile.TemporaryDirectory() as temp_dir:
             store = ConfigStore(Path(temp_dir))
             config = AppConfig(base_url="https://console.example.com", anon_key="anon")
-            args = Namespace(config_dir=temp_dir, base_url=None, anon_key=None, json=True, login_timeout=300, insecure=False)
+            args = Namespace(
+                config_dir=temp_dir,
+                base_url=None,
+                anon_key=None,
+                json=True,
+                login_timeout=300,
+                no_wait_login=False,
+                insecure=False,
+            )
 
             with mock.patch("powerbase_cli.commands.auth.build_api", return_value=(store, config, None, None, FakeApi())):
                 with mock.patch("powerbase_cli.commands.auth.time.sleep", return_value=None):
@@ -114,6 +135,32 @@ class CliCommandTests(unittest.TestCase):
             self.assertEqual(saved.session.access_token, "new-access")
             self.assertEqual(saved.user["id"], "user-1")
 
+    def test_auth_login_no_wait_returns_login_url_without_polling(self) -> None:
+        with tempfile.TemporaryDirectory() as temp_dir:
+            store = ConfigStore(Path(temp_dir))
+            config = AppConfig(base_url="https://console.example.com", anon_key="anon")
+            args = Namespace(
+                config_dir=temp_dir,
+                base_url=None,
+                anon_key=None,
+                json=True,
+                login_timeout=300,
+                no_wait_login=True,
+                insecure=False,
+            )
+
+            with mock.patch("powerbase_cli.commands.auth.build_api", return_value=(store, config, None, None, FakeApiNoWait())):
+                with mock.patch("sys.stdout", new=StringIO()) as stdout:
+                    exit_code = auth_handle_auth_login(args)
+
+            self.assertEqual(exit_code, 0)
+            payload = json.loads(stdout.getvalue())
+            self.assertEqual(payload["status"], "pending")
+            self.assertEqual(payload["login_id"], "login-nowait")
+            self.assertEqual(payload["next_action"], "ask_user_to_open_url")
+            self.assertIn("login_url", payload)
+            self.assertIsNone(store.load_auth())
+
     def test_auth_login_times_out(self) -> None:
         clock = {"t": 0.0}
 
@@ -126,7 +173,15 @@ class CliCommandTests(unittest.TestCase):
         with tempfile.TemporaryDirectory() as temp_dir:
             store = ConfigStore(Path(temp_dir))
             config = AppConfig(base_url="https://console.example.com", anon_key="anon")
-            args = Namespace(config_dir=temp_dir, base_url=None, anon_key=None, json=False, login_timeout=5, insecure=False)
+            args = Namespace(
+                config_dir=temp_dir,
+                base_url=None,
+                anon_key=None,
+                json=False,
+                login_timeout=5,
+                no_wait_login=False,
+                insecure=False,
+            )
 
             with mock.patch("powerbase_cli.commands.auth.build_api", return_value=(store, config, None, None, FakeApiPending())):
                 with mock.patch("powerbase_cli.commands.auth.time.monotonic", fake_monotonic):

{powerbase_cli-0.1.0 → powerbase_cli-0.1.2}/tests/test_cli_help.py

@@ -28,15 +28,16 @@ class CliHelpTests(unittest.TestCase):
         login_parser = auth_parser._subparsers._group_actions[0].choices["login"]
         help_text = login_parser.format_help()
         self.assertIn("--timeout", help_text)
-        self.assertIn("300", help_text)
+        self.assertIn("--no-wait", help_text)
+        self.assertIn("600", help_text)
 
-    def test_auth_token_set_help_mentions_refresh_token(self) -> None:
+    def test_auth_help_does_not_list_token_set_subcommand(self) -> None:
         parser = build_parser()
         auth_parser = parser._subparsers._group_actions[0].choices["auth"]
-        token_parser = auth_parser._subparsers._group_actions[0].choices["token-set"]
-        help_text = token_parser.format_help()
-        self.assertIn("refresh token", help_text.lower())
-        self.assertIn("auto-refresh", help_text)
+        help_text = auth_parser.format_help()
+        self.assertNotIn("token-set", help_text)
+        subcommands = auth_parser._subparsers._group_actions[0].choices
+        self.assertIn("token-set", subcommands)
 
     def test_context_use_instance_help_mentions_source(self) -> None:
         parser = build_parser()

{powerbase_cli-0.1.0 → powerbase_cli-0.1.2}/tests/test_session.py

@@ -11,7 +11,7 @@ from unittest import mock
 sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
 
 from powerbase_cli.config import BUNDLED_CA_CERT_SENTINEL, AuthSession, AuthState, ConfigStore
-from powerbase_cli.session import SessionManager
+from powerbase_cli.session import SessionError, SessionManager
 
 
 class FakeResponse:
@@ -29,6 +29,17 @@ class FakeResponse:
 
 
 class SessionManagerTests(unittest.TestCase):
+    def test_refresh_without_auth_instructs_user_to_log_in_again(self) -> None:
+        with tempfile.TemporaryDirectory() as temp_dir:
+            store = ConfigStore(Path(temp_dir))
+            manager = SessionManager(store, "https://console.example.com", "anon")
+
+            with self.assertRaises(SessionError) as ctx:
+                manager.refresh()
+
+        self.assertIn("No authentication session available", str(ctx.exception))
+        self.assertIn("powerbase auth login --no-wait --json", str(ctx.exception))
+
     def test_refresh_updates_saved_auth_file(self) -> None:
         with tempfile.TemporaryDirectory() as temp_dir:
             store = ConfigStore(Path(temp_dir))

{powerbase_cli-0.1.0 → powerbase_cli-0.1.2}/tests/test_transport.py

@@ -35,6 +35,21 @@ def build_http_error(status: int, payload: dict[str, object]) -> HTTPError:
 
 
 class PowerbaseTransportTests(unittest.TestCase):
+    def test_invoke_requires_login_when_session_missing(self) -> None:
+        with tempfile.TemporaryDirectory() as temp_dir:
+            store = ConfigStore(Path(temp_dir))
+            manager = SessionManager(store, "https://console.example.com", "anon")
+            transport = PowerbaseTransport(AppConfig(base_url="https://console.example.com", anon_key="anon"), manager)
+
+            with mock.patch("powerbase_cli.transport.request.urlopen") as urlopen_mock:
+                with self.assertRaises(ApiError) as ctx:
+                    transport.invoke("instances", method="GET")
+
+        self.assertEqual(ctx.exception.status, 401)
+        self.assertIn("No authentication session available", str(ctx.exception))
+        self.assertIn("powerbase auth login --no-wait --json", str(ctx.exception))
+        self.assertEqual(urlopen_mock.call_count, 0)
+
     def test_invoke_uses_unverified_tls_context_when_insecure(self) -> None:
         with tempfile.TemporaryDirectory() as temp_dir:
             store = ConfigStore(Path(temp_dir))
@@ -167,6 +182,7 @@ class PowerbaseTransportTests(unittest.TestCase):
                         transport.invoke("instances", method="GET")
 
             self.assertEqual(ctx.exception.status, 401)
+            self.assertIn("powerbase auth login --no-wait --json", str(ctx.exception))
             self.assertEqual(refresh_mock.call_count, 0)
             self.assertEqual(urlopen_mock.call_count, 1)