sima-cli 2.1.20__tar.gz → 2.1.21__tar.gz

{sima_cli-2.1.20/sima_cli.egg-info → sima_cli-2.1.21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sima-cli
-Version: 2.1.20
+Version: 2.1.21
 Summary: CLI tool for SiMa Developer Portal to download models, firmware, and apps.
 Home-page: https://community.sima.ai/
 Author: SiMa.ai

{sima_cli-2.1.20 → sima_cli-2.1.21}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "sima-cli"
-version = "2.1.20"
+version = "2.1.21"
 description = "CLI tool for SiMa Developer Portal to download models, firmware, and apps."
 readme = "README.md"
 requires-python = ">=3.8"

{sima_cli-2.1.20 → sima_cli-2.1.21}/sima_cli/__version__.py

@@ -1,2 +1,2 @@
 # sima_cli/__version__.py
-__version__ = "2.1.20"
+__version__ = "2.1.21"

{sima_cli-2.1.20 → sima_cli-2.1.21}/sima_cli/cli.py

@@ -187,7 +187,7 @@ class InspectionAwareGroup(click.Group):
 
 # Entry point for the CLI tool using Click's command group decorator
 @click.group(cls=InspectionAwareGroup, context_settings=dict(help_option_names=["-h", "--help", "-?"], max_content_width=120))
-@click.option('-i', '--internal', is_flag=True, help="Use internal Artifactory resources, Authorized Sima employees only")
+@click.option('-i', '--internal', is_flag=True, help="Use internal SiMa services, authorized SiMa employees only")
 @click.option('-y', '--yes', is_flag=True, help="Assume yes for confirmation prompts.")
 @click.version_option(version=f"{__version__}", message="SiMa CLI version: %(version)s")
 @click.pass_context
@@ -196,7 +196,7 @@ def main(ctx, internal, yes):
     sima-cli – SiMa Developer Portal CLI Tool
 
     Global Options:
-      --internal  Use internal Artifactory resources (can also be set via env variable SIMA_CLI_INTERNAL=1)
+      --internal  Use internal SiMa services (can also be set via env variable SIMA_CLI_INTERNAL=1)
     """
     internal = internal or os.getenv("SIMA_CLI_INTERNAL", "0") in ("1", "true", "yes")
     if internal:
@@ -204,7 +204,10 @@ def main(ctx, internal, yes):
             Text("Pre-release software may be unstable. Use at your own risk.", style="yellow"),
             title="Pre-release software", border_style="yellow", width=72,
         ))
-    if ctx.meta.get('update_inspect'):
+    # CloudEx selects Developer Portal or internal NeatOps authentication itself;
+    # its internal Vulcan flow does not require Artifactory setup.
+    if ctx.meta.get('update_inspect') or ctx.invoked_subcommand == 'cloudex':
+        _configure_stdio_errors()
         ctx.ensure_object(dict)
         ctx.obj.update(internal=internal, yes=yes)
         return

{sima_cli-2.1.20 → sima_cli-2.1.21}/sima_cli/cloudex/client.py

@@ -71,8 +71,7 @@ def decode_key(value):
         raise CloudExError("--key contains an invalid value")
     if len(profile["allocation_secret"]) < 32:
         raise CloudExError("--key contains an invalid allocation secret")
-    if profile["environment"] not in {"vulcan-staging", "vulcan-production"}:
-        raise CloudExError("CloudEx supports only vulcan-staging or vulcan-production allocation keys")
+    # The environment is a descriptive label; api_url selects the backend.
     return profile
 
 

{sima_cli-2.1.20 → sima_cli-2.1.21}/sima_cli/cloudex/commands.py

@@ -1,10 +1,14 @@
 """Hidden, experimental CloudEx command group."""
 
+import base64
+import json
 import os
+import uuid
 import stat
 import sys
 import time
 from datetime import datetime, timezone
+from functools import wraps
 from pathlib import Path
 
 import click
@@ -25,6 +29,7 @@ from .client import (
     run_benchmark,
 )
 from .installer import DEFAULT_BRANCH, install_forwarder
+from .neatops import NeatOps
 
 
 console = Console()
@@ -206,9 +211,33 @@ def _session_table(rows, show_benchmark=False):
     return table
 
 
+def _internal_cloudex():
+    ctx = click.get_current_context(silent=True)
+    return bool(ctx and isinstance(ctx.obj, dict) and ctx.obj.get("internal"))
+
+
+def _require_vulcan():
+    if not _internal_cloudex():
+        raise click.ClickException(
+            "CloudEx is not available on Arthas yet. Use sima-cli -i cloudex for Vulcan."
+        )
+
+
+def _vulcan_only(function):
+    @wraps(function)
+    def wrapped(*args, **kwargs):
+        _require_vulcan()
+        return function(*args, **kwargs)
+    return wrapped
+
+
 @click.group(name="cloudex", hidden=True)
-def cloudex_group():
-    """Connect to allocated DevKits through CloudEx."""
+@click.option("-i", "--internal", is_flag=True, help="Use internal Vulcan CloudEx and NeatOps authentication.")
+@click.pass_context
+def cloudex_group(ctx, internal):
+    """Manage CloudEx devices; use -i for internal Vulcan access."""
+    ctx.ensure_object(dict)
+    ctx.obj["internal"] = internal or ctx.obj.get("internal", False) or os.getenv("SIMA_CLI_INTERNAL", "0") in ("1", "true", "yes")
 
 
 @cloudex_group.command("connect")
@@ -222,6 +251,8 @@ def cloudex_group():
     is_flag=True,
     help="Read the allocation key from standard input for automation.",
 )
+@click.option("--allocation", help="Connect to your NeatOps allocation ID without copying a key.")
+@click.option("--environment", type=click.Choice(["production", "staging"]), default="production", show_default=True, help="Vulcan environment (requires -i).")
 @click.option("--transport", type=click.Choice(["auto", "p2p", "turn"]), default="auto", hidden=True)
 @click.option("--attempts", type=click.IntRange(1, 5), default=3, hidden=True)
 @click.option(
@@ -229,11 +260,16 @@ def cloudex_group():
     is_flag=True,
     help="Print each sanitized connection stage for troubleshooting.",
 )
-def connect_command(key_file, key_stdin, transport, attempts, verbose):
+@_vulcan_only
+def connect_command(key_file, key_stdin, allocation, environment, transport, attempts, verbose):
     """Connect to an allocated DevKit using a securely supplied key."""
-    if key_file and key_stdin:
-        raise click.UsageError("Use either --key-file or --key-stdin, not both.")
+    if sum(bool(value) for value in (key_file, key_stdin, allocation)) > 1:
+        raise click.UsageError("Use either --key-file or --key-stdin, not both; --allocation must be used alone.")
     try:
+        if allocation:
+            profile = _allocation_profile(_neatops_api(environment), _allocation_id(allocation))
+            _connect_profile(profile, verbose=verbose, attempts=attempts, transport=transport)
+            return
         if key_file:
             key = _read_key_file(key_file)
         elif key_stdin:
@@ -243,16 +279,7 @@ def connect_command(key_file, key_stdin, transport, attempts, verbose):
         else:
             key = click.prompt("CloudEx allocation key", hide_input=True).strip()
         profile = decode_key(key)
-        console.print("[cyan]→[/cyan] Authorizing encrypted tunnel access")
-        _authorize_supported_host()
-        with StageProgress("Preparing CloudEx connection", verbose=verbose) as progress:
-            session = connect(profile, _store(), progress, attempts=attempts, transport=transport)
-            progress.success("Connected to {}".format(session["device"]))
-        path = session.get("ice_path", "unknown")
-        path_text = "direct" if path == "direct" else "relayed" if path == "relay" else path
-        console.print("  [dim]Session[/dim]  {}".format(_short(session["session_id"])))
-        console.print("  [dim]Path[/dim]     {}".format(path_text))
-        console.print("  [dim]SSH[/dim]      [bold]ssh sima@{}[/bold]".format(session["target"]))
+        _connect_profile(profile, verbose=verbose, attempts=attempts, transport=transport)
     except CloudExError as exc:
         raise click.ClickException(str(exc)) from exc
 
@@ -264,6 +291,7 @@ def connect_command(key_file, key_stdin, transport, attempts, verbose):
     show_default=True,
     help="Kerrigan branch whose latest forwarder should be installed.",
 )
+@_vulcan_only
 def update_command(branch):
     """Install or update the native CloudEx forwarder."""
     try:
@@ -326,6 +354,7 @@ def _choose_sessions(sessions):
 @cloudex_group.command("disconnect")
 @click.option("--session", "session_id", help="Session ID or unique prefix to disconnect.")
 @click.option("--all", "disconnect_all", is_flag=True, help="Disconnect every recorded CloudEx session.")
+@_vulcan_only
 def disconnect_command(session_id, disconnect_all):
     """Disconnect one or all CloudEx sessions."""
     if session_id and disconnect_all:
@@ -373,6 +402,7 @@ def disconnect_command(session_id, disconnect_all):
 @click.option("--benchmark", is_flag=True, help="Stress-test RTT and maximum bidirectional throughput for each connection.")
 @click.option("--duration", type=click.IntRange(1, 60), default=10, show_default=True,
               help="Throughput measurement window in seconds.")
+@_vulcan_only
 def list_command(benchmark, duration):
     """List locally recorded CloudEx connections."""
     store = _store()
@@ -420,3 +450,192 @@ def list_command(benchmark, duration):
 
 def register_cloudex_commands(main):
     main.add_command(cloudex_group)
+
+
+def _connect_profile(profile, verbose=False, attempts=3, transport="auto"):
+    console.print("[cyan]→[/cyan] Authorizing encrypted tunnel access")
+    _authorize_supported_host()
+    with StageProgress("Preparing CloudEx connection", verbose=verbose) as progress:
+        session = connect(profile, _store(), progress, attempts=attempts, transport=transport)
+        progress.success("Connected to {}".format(session["device"]))
+    path = session.get("ice_path", "unknown")
+    path_text = "direct" if path == "direct" else "relayed" if path == "relay" else path
+    console.print("  [dim]Session[/dim]  {}".format(_short(session["session_id"])))
+    console.print("  [dim]Path[/dim]     {}".format(path_text))
+    console.print("  [dim]SSH[/dim]      [bold]ssh sima@{}[/bold]".format(session["target"]))
+
+
+DURATIONS = {"1h": 3600, "4h": 14400, "8h": 28800, "1d": 86400, "7d": 604800, "4w": 2419200}
+
+
+def _allocation_id(value):
+    if len(value) != 32 or any(c not in "0123456789abcdef" for c in value):
+        raise CloudExError("Use the full 32-character allocation ID from sima-cli -i cloudex devices")
+    return value
+
+
+def _allocation_profile(api, allocation_id, timeout=180):
+    deadline = time.monotonic() + timeout
+    with StageProgress("Waiting for device preparation") as progress:
+        while True:
+            inventory = api.call("GET", "/devkits")
+            allocation = next((a for a in inventory.get("allocations", []) if a["session_id"] == allocation_id), None)
+            if not allocation or allocation.get("status") in {"released", "releasing", "expired", "failed"}:
+                raise CloudExError("Allocation is unavailable; check sima-cli -i cloudex devices")
+            if allocation.get("status") in {"ready", "active"}:
+                profile = api.call("POST", "/devkits/allocations/" + allocation_id + "/profile", {})
+                # Reuse the same strict profile validation as manually supplied keys.
+                profile = decode_key(base64.b64encode(json.dumps(profile).encode()).decode())
+                progress.success("Device is ready")
+                return profile
+            if time.monotonic() >= deadline:
+                raise CloudExError("Device preparation timed out. Allocation {} is retained; retry with sima-cli -i cloudex connect --allocation {} or release it".format(allocation_id, allocation_id))
+            time.sleep(2)
+
+
+def _neatops_login(api):
+    api.login(lambda url: console.print("Open this URL in a browser on this computer:\n" + url, markup=False, soft_wrap=True))
+    console.print("[green]Signed in to NeatOps ({})[/green]".format(api.environment))
+
+
+def _neatops_api(environment):
+    _require_vulcan()
+    return NeatOps(environment, on_login_required=_neatops_login)
+
+
+@cloudex_group.command("login")
+@click.option("--environment", type=click.Choice(["production", "staging"]), default="production", show_default=True, help="Vulcan environment (requires -i).")
+def login_command(environment):
+    """Sign in to the Developer Portal, or NeatOps with -i."""
+    if not _internal_cloudex():
+        if environment != "production":
+            raise click.UsageError("--environment selects a Vulcan environment and requires -i.")
+        from sima_cli.auth.devportal import login_external
+        if not login_external(loginDocker=False):
+            raise click.ClickException("Developer Portal sign-in was not completed.")
+        console.print("Signed in to the Developer Portal. CloudEx is not available on Arthas yet.")
+        return
+    try:
+        _neatops_login(NeatOps(environment))
+    except CloudExError as exc:
+        raise click.ClickException(str(exc)) from exc
+
+
+@cloudex_group.command("logout")
+@click.option("--environment", type=click.Choice(["production", "staging"]), default="production", show_default=True, help="Vulcan environment (requires -i).")
+def logout_command(environment):
+    """Sign out of the Developer Portal, or NeatOps with -i; keep leases."""
+    if not _internal_cloudex():
+        if environment != "production":
+            raise click.UsageError("--environment selects a Vulcan environment and requires -i.")
+        from sima_cli.auth.auth0 import clear_external_login_state
+        clear_external_login_state()
+        console.print("Signed out of the Developer Portal.")
+        return
+    try:
+        NeatOps(environment).logout()
+        console.print("Signed out of NeatOps. Existing device leases are unchanged.")
+    except CloudExError as exc:
+        raise click.ClickException(str(exc)) from exc
+
+
+@cloudex_group.command("devices")
+@click.option("--environment", type=click.Choice(["production", "staging"]), default="production", show_default=True, help="Vulcan environment (requires -i).")
+@_vulcan_only
+def devices_command(environment):
+    """Show NeatOps device availability and your allocation IDs."""
+    try:
+        inventory = _neatops_api(environment).call("GET", "/devkits")
+        table = Table("Device type", "Firmware version", "ID", "Allocation ID", "State")
+        allocations = {(a["cluster_id"], a["target_id"]): a for a in inventory.get("allocations", [])}
+        visible_devices = set()
+        for d in inventory.get("devices", []):
+            device_key = (d["cluster_id"], d["id"])
+            visible_devices.add(device_key)
+            a = d.get("allocation") or allocations.get(device_key, {})
+            table.add_row(d.get("type") or "Unknown", d.get("firmware") or "Unknown", d["id"],
+                          a.get("session_id") or "—", "Available" if d["available"] else "Not available")
+        # Allocations can survive an appliance disappearing from inventory.
+        for a in inventory.get("allocations", []):
+            if (a["cluster_id"], a["target_id"]) not in visible_devices:
+                table.add_row("Unknown", "Unknown", a["target_id"], a["session_id"], "Not available")
+        console.print(table)
+    except CloudExError as exc:
+        raise click.ClickException(str(exc)) from exc
+
+
+@cloudex_group.command("request")
+@click.option("--device", help="Device ID or exact name; otherwise choose interactively.")
+@click.option("--cluster", help="Appliance ID, to disambiguate devices.")
+@click.option("--duration", type=click.Choice(list(DURATIONS)), default="1h", show_default=True)
+@click.option("--environment", type=click.Choice(["production", "staging"]), default="production", show_default=True, help="Vulcan environment (requires -i).")
+@click.option("--verbose", is_flag=True, help="Print sanitized connection stages.")
+@_vulcan_only
+def request_command(device, cluster, duration, environment, verbose):
+    """Request a NeatOps device, wait for preparation, and connect automatically."""
+    allocation_id = None
+    try:
+        api = _neatops_api(environment)
+        entitlement = api.call("GET", "/users/me/entitlement")["entitlement"]
+        if DURATIONS[duration] > entitlement["max_lease_duration_seconds"]:
+            raise CloudExError("Requested duration exceeds your NeatOps lease limit; choose a shorter duration")
+        inventory = api.call("GET", "/devkits")
+        if len(inventory.get("allocations", [])) >= entitlement["max_active_leases"]:
+            raise CloudExError("Your device lease limit is reached; connect to an existing allocation or release one")
+        candidates = [d for d in inventory.get("devices", []) if d.get("available")
+                      and (not cluster or d["cluster_id"] == cluster)
+                      and (not device or device in {d["id"], d["name"]})]
+        if not candidates:
+            raise CloudExError("No matching devices are available; check sima-cli -i cloudex devices")
+        if device and len(candidates) > 1:
+            raise CloudExError("Device name or ID is ambiguous; specify --cluster")
+        if not device:
+            table = Table("#", "Device type", "Software version", "ID")
+            for index, d in enumerate(candidates, 1):
+                table.add_row(str(index), d.get("type") or "Unknown", d.get("firmware") or "Unknown", d["id"])
+            console.print(table)
+            choice = click.prompt("Choose a device", type=click.IntRange(1, len(candidates)))
+            selected = candidates[choice - 1]
+        else:
+            selected = candidates[0]
+        # Get local administrator authorization before reserving scarce hardware.
+        _authorize_supported_host()
+        allocation_id = uuid.uuid4().hex
+        console.print("Allocation {} · {} · {}".format(allocation_id, selected["name"], duration), markup=False)
+        api.call("POST", "/devkits/allocations", {"request_id": allocation_id,
+                 "cluster_id": selected["cluster_id"], "target_id": selected["id"], "duration_seconds": DURATIONS[duration]})
+        profile = _allocation_profile(api, allocation_id)
+        _connect_profile(profile, verbose=verbose)
+    except CloudExError as exc:
+        if allocation_id:
+            console.print("Inspect: sima-cli -i cloudex devices --environment {}\nResume: sima-cli -i cloudex connect --allocation {} --environment {}\nRelease: sima-cli -i cloudex release {} --environment {}".format(environment, allocation_id, environment, allocation_id, environment), markup=False, soft_wrap=True)
+        raise click.ClickException(str(exc)) from exc
+
+
+@cloudex_group.command("release")
+@click.argument("allocation_id")
+@click.option("--environment", type=click.Choice(["production", "staging"]), default="production", show_default=True, help="Vulcan environment (requires -i).")
+@_vulcan_only
+def release_command(allocation_id, environment):
+    """Release your NeatOps lease and disconnect its local CloudEx sessions."""
+    try:
+        allocation_id = _allocation_id(allocation_id)
+        store = _store()
+        failures = []
+        for session in store.list():
+            if session.get("allocation_id") == allocation_id:
+                try:
+                    with StageProgress("Disconnecting CloudEx") as progress:
+                        disconnect_session(session, store, progress)
+                except CloudExError as exc:
+                    failures.append("Tunnel cleanup failed: {}. Local retry state retained; retry sima-cli -i cloudex disconnect.".format(exc))
+        try:
+            _neatops_api(environment).call("DELETE", "/devkits/allocations/" + allocation_id)
+        except CloudExError as exc:
+            failures.append("Lease release failed: {}".format(exc))
+        else:
+            console.print("Lease released; device availability returns after cleanup is confirmed.")
+        if failures:
+            raise CloudExError("; ".join(failures))
+    except CloudExError as exc:
+        raise click.ClickException(str(exc)) from exc

sima_cli-2.1.21/sima_cli/cloudex/neatops.py

@@ -0,0 +1,254 @@
+"""NeatOps browser authentication and personal device allocation API."""
+
+import base64
+import hashlib
+import json
+import os
+import secrets
+import stat
+import tempfile
+import time
+import webbrowser
+from http.server import BaseHTTPRequestHandler, HTTPServer
+from pathlib import Path
+from urllib.parse import parse_qs, urlencode, urlsplit
+
+import requests
+
+from .client import CloudExError, DEFAULT_ROOT
+
+DASHBOARDS = {
+    "production": "https://ops.neat.sima.ai",
+    "staging": "https://ops.stg.neat.sima.ai",
+}
+REDIRECT_URI = "http://127.0.0.1:47182/callback"
+
+
+def _origin(value):
+    if not isinstance(value, str):
+        raise CloudExError("NeatOps configuration requires an HTTPS origin")
+    parsed = urlsplit(value)
+    if (parsed.scheme != "https" or not parsed.hostname or parsed.username
+            or parsed.password or parsed.query or parsed.fragment or parsed.path not in {"", "/"}):
+        raise CloudExError("NeatOps configuration requires an HTTPS origin")
+    return value.rstrip("/")
+
+
+def _json_request(method, url, **kwargs):
+    try:
+        response = requests.request(method, url, timeout=20, allow_redirects=False, **kwargs)
+    except requests.RequestException:
+        raise CloudExError("NeatOps is unavailable; check your connection and retry") from None
+    try:
+        payload = response.json()
+    except ValueError:
+        payload = {}
+    if not isinstance(payload, dict):
+        payload = {}
+    return response.status_code, payload
+
+
+class LoginServer(HTTPServer):
+    def get_request(self):
+        connection, address = super().get_request()
+        connection.settimeout(2)
+        return connection, address
+
+
+class LoginCallback(BaseHTTPRequestHandler):
+    """Only accept the matching loopback OAuth response; never log its code."""
+
+    def log_message(self, *args):
+        pass
+
+    def do_GET(self):
+        parsed = urlsplit(self.path)
+        params = parse_qs(parsed.query)
+        valid = (self.headers.get("Host") == "127.0.0.1:47182"
+                 and parsed.path == "/callback"
+                 and params.get("state") == [self.server.oauth_state])
+        code = params.get("code", [])
+        error = params.get("error", [])
+        valid = valid and ((len(code) == 1 and not error) or (len(error) == 1 and not code))
+        if valid:
+            self.server.oauth_result = {"code": code[0]} if code else {"error": True}
+        self.send_response(200 if valid else 400)
+        self.send_header("Content-Type", "text/plain; charset=utf-8")
+        self.send_header("Cache-Control", "no-store")
+        self.send_header("Referrer-Policy", "no-referrer")
+        self.end_headers()
+        self.wfile.write(b"Return to sima-cli to finish signing in." if valid else b"Invalid sign-in response.")
+
+
+class LoginRequired(CloudExError):
+    """Saved credentials cannot authorize a request without browser sign-in."""
+
+
+class NeatOps:
+    def __init__(self, environment="production", root=None, on_login_required=None):
+        self.environment = environment
+        self.dashboard = DASHBOARDS[environment]
+        self.path = Path(root or DEFAULT_ROOT) / ("neatops-" + environment + ".json")
+        self.config = None
+        self.on_login_required = on_login_required
+        self._login_attempted = False
+
+    def configuration(self):
+        if self.config is None:
+            status, config = _json_request("GET", self.dashboard + "/cli-config.json")
+            if status != 200:
+                raise CloudExError("NeatOps CLI login is not configured on this dashboard yet")
+            auth = config.get("auth", {})
+            if (not isinstance(auth, dict) or auth.get("enabled") is not True
+                    or not isinstance(auth.get("clientId"), str) or not auth["clientId"]
+                    or auth.get("redirectUri") != REDIRECT_URI
+                    or config.get("apiBase") != self.dashboard + "/api"):
+                raise CloudExError("NeatOps CLI login configuration is unavailable or invalid")
+            try:
+                _origin(auth["domain"])
+            except (KeyError, TypeError, ValueError):
+                raise CloudExError("NeatOps sign-in domain is invalid") from None
+            self.config = config
+        return self.config
+
+    def _save(self, tokens):
+        auth = self.configuration()["auth"]
+        if not isinstance(tokens.get("access_token"), str) or not tokens["access_token"]:
+            raise CloudExError("NeatOps sign-in did not return an access token")
+        lifetime = tokens.get("expires_in")
+        if isinstance(lifetime, bool) or not isinstance(lifetime, (int, float)) or lifetime <= 0:
+            raise CloudExError("NeatOps sign-in returned an invalid token lifetime")
+        session = {"access_token": tokens["access_token"], "refresh_token": tokens.get("refresh_token"),
+                   "expires_at": time.time() + lifetime, "client_id": auth["clientId"], "domain": auth["domain"]}
+        self.path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+        descriptor, temporary = tempfile.mkstemp(prefix=".neatops-", dir=str(self.path.parent))
+        try:
+            with os.fdopen(descriptor, "w") as stream:
+                json.dump(session, stream)
+            os.replace(temporary, self.path)
+        finally:
+            if os.path.exists(temporary):
+                os.unlink(temporary)
+        return session["access_token"]
+
+    def _exchange(self, parameters):
+        auth = self.configuration()["auth"]
+        status, tokens = _json_request("POST", auth["domain"].rstrip("/") + "/oauth2/token",
+                                       data={"client_id": auth["clientId"], **parameters})
+        if status == 400 and parameters.get("grant_type") == "refresh_token" and tokens.get("error") == "invalid_grant":
+            raise LoginRequired("NeatOps sign-in expired; run sima-cli -i cloudex login again")
+        if status != 200:
+            raise CloudExError("NeatOps sign-in expired or was rejected; run sima-cli -i cloudex login again")
+        return tokens
+
+    def login(self, announce, timeout=180):
+        auth = self.configuration()["auth"]
+        verifier = secrets.token_urlsafe(48)
+        challenge = base64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest()).decode().rstrip("=")
+        state = secrets.token_urlsafe(32)
+        parameters = {"response_type": "code", "client_id": auth["clientId"], "redirect_uri": REDIRECT_URI,
+                      "scope": "openid email profile", "state": state, "code_challenge_method": "S256",
+                      "code_challenge": challenge}
+        if auth.get("identityProvider"):
+            parameters["identity_provider"] = auth["identityProvider"]
+        url = auth["domain"].rstrip("/") + "/oauth2/authorize?" + urlencode(parameters)
+        try:
+            server = LoginServer(("127.0.0.1", 47182), LoginCallback)
+        except OSError:
+            raise CloudExError("CloudEx sign-in needs local port 47182; close another login and retry") from None
+        with server:
+            server.oauth_state = state
+            server.oauth_result = None
+            server.timeout = 0.5
+            announce(url)
+            try:
+                webbrowser.open(url)
+            except webbrowser.Error:
+                pass  # The terminal also displays the URL for manual opening.
+            deadline = time.monotonic() + timeout
+            while server.oauth_result is None and time.monotonic() < deadline:
+                server.handle_request()
+            result = server.oauth_result
+        if result is None:
+            raise CloudExError("NeatOps sign-in timed out; run sima-cli -i cloudex login again")
+        if result.get("error"):
+            raise CloudExError("NeatOps sign-in was cancelled or rejected")
+        self._save(self._exchange({"grant_type": "authorization_code", "code": result["code"],
+                                   "code_verifier": verifier, "redirect_uri": REDIRECT_URI}))
+
+    def _read_session(self):
+        try:
+            # Refuse symlinks and shared credential files, as for CloudEx keys.
+            descriptor = os.open(str(self.path), os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0))
+            with os.fdopen(descriptor) as stream:
+                mode = os.fstat(stream.fileno()).st_mode
+                if not stat.S_ISREG(mode):
+                    raise CloudExError("NeatOps credential file must be a regular file")
+                if os.name != "nt" and mode & 0o077:
+                    raise CloudExError("NeatOps credential file must have mode 0600")
+                session = json.load(stream)
+            return session
+        except (FileNotFoundError, ValueError, KeyError, TypeError):
+            raise LoginRequired("Sign in first with sima-cli -i cloudex login --environment " + self.environment) from None
+        except OSError:
+            raise CloudExError("Sign in first with sima-cli -i cloudex login --environment " + self.environment) from None
+
+    def access_token(self):
+        auth = self.configuration()["auth"]
+        session = self._read_session()
+        try:
+            if session["client_id"] != auth["clientId"] or session["domain"] != auth["domain"]:
+                raise ValueError("Sign-in policy changed")
+            if session["expires_at"] > time.time() + 60:
+                return session["access_token"]
+            refresh = session.get("refresh_token")
+        except (ValueError, KeyError, TypeError):
+            raise LoginRequired("Sign-in policy changed; run sima-cli -i cloudex login again") from None
+        if not refresh:
+            raise LoginRequired("NeatOps sign-in expired; run sima-cli -i cloudex login again")
+        tokens = self._exchange({"grant_type": "refresh_token", "refresh_token": refresh})
+        tokens.setdefault("refresh_token", refresh)
+        return self._save(tokens)
+
+    def logout(self):
+        if self.path.exists():
+            # Revoke the CLI's refresh token without signing the browser out.
+            auth = self.configuration()["auth"]
+            session = self._read_session()
+            if session.get("refresh_token"):
+                status, _ = _json_request("POST", auth["domain"].rstrip("/") + "/oauth2/revoke",
+                                          data={"client_id": session["client_id"], "token": session["refresh_token"]})
+                if status != 200:
+                    raise CloudExError("NeatOps token revocation failed; retry logout")
+            self.path.unlink()
+
+    def _authenticate(self):
+        if self.on_login_required is None or self._login_attempted:
+            raise LoginRequired("Sign in again with sima-cli -i cloudex login --environment " + self.environment)
+        self._login_attempted = True
+        self.on_login_required(self)
+        return self.access_token()
+
+    def call(self, method, path, data=None):
+        config = self.configuration()
+        try:
+            token = self.access_token()
+        except LoginRequired:
+            token = self._authenticate()
+
+        def request(access_token):
+            return _json_request(method, config["apiBase"] + path,
+                                 headers={"Authorization": "Bearer " + access_token}, json=data)
+
+        status, payload = request(token)
+        # A 401 from the authorizer has no side effects, so retry the same
+        # request once after sign-in. Permission failures and outages do not
+        # trigger login or replay allocation requests.
+        if status == 401 and self.on_login_required is not None and not self._login_attempted:
+            status, payload = request(self._authenticate())
+        if status in {401, 403}:
+            raise CloudExError("NeatOps access denied; sign in again or check your device permissions")
+        if not 200 <= status < 300:
+            # Do not print backend response bodies, which could contain credentials.
+            raise CloudExError("NeatOps request failed (HTTP {}); check availability and lease limits in My Devices".format(status))
+        return payload