sima-cli 2.1.8__tar.gz → 2.1.9__tar.gz

{sima_cli-2.1.8/sima_cli.egg-info → sima_cli-2.1.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sima-cli
-Version: 2.1.8
+Version: 2.1.9
 Summary: CLI tool for SiMa Developer Portal to download models, firmware, and apps.
 Home-page: https://developer.sima.ai/
 Author: SiMa.ai
@@ -17,7 +17,7 @@ Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: click>=8.0
-Requires-Dist: requests>=2.33.0
+Requires-Dist: requests<3.0,>=2.32.4
 Requires-Dist: tqdm>=4.64
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: paramiko>=3.5.1
@@ -163,7 +163,7 @@ sima-cli vulcan download --env production core main
   - `dev`: `https://artifacts.neat.paconsultings.com`
   - `staging`: `https://artifacts.stg.neat.sima.ai`
   - `production`: `https://artifacts.neat.sima.ai`
-- `dev` and `staging` are available for Vulcan downloads. `production` is not yet available.
+- `dev`, `staging`, and `production` are available for Vulcan downloads.
 - Usage:
   - `sima-cli vulcan --env {dev|stg|staging|prd|prod|production} download [REPO] [BRANCH_OR_TAG]`
   - `sima-cli vulcan download --env {dev|stg|staging|prd|prod|production} [REPO] [BRANCH_OR_TAG]`

{sima_cli-2.1.8 → sima_cli-2.1.9}/README.md

@@ -129,7 +129,7 @@ sima-cli vulcan download --env production core main
   - `dev`: `https://artifacts.neat.paconsultings.com`
   - `staging`: `https://artifacts.stg.neat.sima.ai`
   - `production`: `https://artifacts.neat.sima.ai`
-- `dev` and `staging` are available for Vulcan downloads. `production` is not yet available.
+- `dev`, `staging`, and `production` are available for Vulcan downloads.
 - Usage:
   - `sima-cli vulcan --env {dev|stg|staging|prd|prod|production} download [REPO] [BRANCH_OR_TAG]`
   - `sima-cli vulcan download --env {dev|stg|staging|prd|prod|production} [REPO] [BRANCH_OR_TAG]`

{sima_cli-2.1.8 → sima_cli-2.1.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "sima-cli"
-version = "2.1.8"
+version = "2.1.9"
 description = "CLI tool for SiMa Developer Portal to download models, firmware, and apps."
 readme = "README.md"
 requires-python = ">=3.8"
@@ -23,7 +23,7 @@ classifiers = [
 
 dependencies = [
     "click>=8.0",
-    "requests>=2.33.0",
+    "requests>=2.32.4,<3.0",
     "tqdm>=4.64",
     "pyyaml>=6.0",
     "paramiko>=3.5.1",

{sima_cli-2.1.8 → sima_cli-2.1.9}/requirements.txt

@@ -1,5 +1,5 @@
 click>=8.0
-requests>=2.33.0
+requests>=2.32.4,<3.0
 tqdm>=4.64
 pyyaml>=6.0
 paramiko>=3.5.1

{sima_cli-2.1.8 → sima_cli-2.1.9}/setup.py

@@ -18,7 +18,7 @@ setup(
     },
     install_requires=[
         "click>=8.0,<9.0",
-        "requests>=2.33.0,<3.0",
+        "requests>=2.32.4,<3.0",
         "tqdm>=4.64,<5.0",
         "InquirerPy>=0.3.4,<0.4",
         "tftpy>=0.8.6,<0.9",

{sima_cli-2.1.8 → sima_cli-2.1.9}/sima_cli/__version__.py

@@ -1,2 +1,2 @@
 # sima_cli/__version__.py
-__version__ = "2.1.8"
+__version__ = "2.1.9"

{sima_cli-2.1.8 → sima_cli-2.1.9}/sima_cli/auth/auth0.py

@@ -15,7 +15,7 @@ import base64
 import requests
 import webbrowser
 import click
-from typing import Dict, Optional
+from typing import Dict, Iterable, Optional, Tuple
 
 from sima_cli.utils.config_loader import load_resource_config
 
@@ -24,6 +24,16 @@ from sima_cli.utils.config_loader import load_resource_config
 # ─────────────────────────────────────────────
 HOME_DIR = os.path.expanduser("~/.sima-cli")
 TOKEN_FILE = os.path.join(HOME_DIR, ".tokens.json")
+COOKIE_FILE = os.path.join(HOME_DIR, ".sima-cli-cookies.txt")
+CSRF_FILE = os.path.join(HOME_DIR, ".sima-cli-csrf.json")
+PROD_USERINFO_AUDIENCE = "https://sima-ai.us.auth0.com/userinfo"
+STAGING_USERINFO_AUDIENCE = "https://dev-d3sxf54xfkcifph2.us.auth0.com/userinfo"
+USERINFO_AUDIENCE = PROD_USERINFO_AUDIENCE
+LATEST_EULA_GRANT = "LatestEULA"
+DOC_ACCESS_GRANT = "DocsAccess"
+DOC_ACCESS_GRANT_ALIASES = (DOC_ACCESS_GRANT, "DocAccess")
+PROD_DISCOURSE_URL = "https://developer.sima.ai/login"
+STAGING_DISCOURSE_URL = "https://discourse-dev.sima.ai/login"
 
 # ─────────────────────────────────────────────
 # Configuration loader
@@ -81,6 +91,16 @@ def load_tokens() -> Optional[Dict]:
         return None
 
 
+def clear_external_login_state():
+    """Remove cached external-auth state so the next login starts cleanly."""
+    for path in (TOKEN_FILE, COOKIE_FILE, CSRF_FILE):
+        if os.path.exists(path):
+            try:
+                os.remove(path)
+            except Exception as e:
+                print(f"⚠️ Failed to delete {path}: {e}")
+
+
 def is_token_valid(tokens: dict) -> bool:
     """Check if access token still valid based on expires_in field."""
     if not tokens:
@@ -131,6 +151,123 @@ def is_browser_available():
     except webbrowser.Error:
         return False
 
+
+def _discourse_sign_in_url() -> str:
+    if os.getenv("USE_STAGING_DEV_PORTAL", "false").lower() in ("1", "true", "yes"):
+        return STAGING_DISCOURSE_URL
+    return PROD_DISCOURSE_URL
+
+
+def _expected_userinfo_audience() -> str:
+    if os.getenv("USE_STAGING_DEV_PORTAL", "false").lower() in ("1", "true", "yes"):
+        return STAGING_USERINFO_AUDIENCE
+    return PROD_USERINFO_AUDIENCE
+
+
+def _as_iterable(value) -> Iterable:
+    if value is None:
+        return []
+    if isinstance(value, (list, tuple, set)):
+        return value
+    return [value]
+
+
+def _access_token_claims(tokens: dict) -> dict:
+    return decode_jwt_payload(tokens.get("access_token", ""))
+
+
+def _access_token_has_userinfo_audience(claims: dict) -> bool:
+    return _expected_userinfo_audience() in _as_iterable(claims.get("aud"))
+
+
+def _access_token_has_grant(claims: dict, grant: str) -> bool:
+    grant_names = DOC_ACCESS_GRANT_ALIASES if grant in DOC_ACCESS_GRANT_ALIASES else (grant,)
+    for claim_name, claim_value in claims.items():
+        if claim_name in ("permissions", "grants", "roles") or claim_name.endswith(("/permissions", "/grants", "/roles")):
+            if any(grant_name in _as_iterable(claim_value) for grant_name in grant_names):
+                return True
+
+    scope = claims.get("scope")
+    if isinstance(scope, str) and any(grant_name in scope.split() for grant_name in grant_names):
+        return True
+
+    return False
+
+
+def access_token_has_doc_access(tokens: dict) -> bool:
+    return _access_token_has_grant(_access_token_claims(tokens), DOC_ACCESS_GRANT)
+
+
+def access_token_has_latest_eula(tokens: dict) -> bool:
+    return _access_token_has_grant(_access_token_claims(tokens), LATEST_EULA_GRANT)
+
+
+def _validate_access_token_requirements(tokens: dict) -> Tuple[bool, Dict[str, bool]]:
+    claims = _access_token_claims(tokens)
+    checks = {
+        "doc_access": _access_token_has_grant(claims, DOC_ACCESS_GRANT),
+        "latest_eula": _access_token_has_grant(claims, LATEST_EULA_GRANT),
+        "userinfo_audience": _access_token_has_userinfo_audience(claims),
+    }
+    return checks["doc_access"] and checks["latest_eula"] and checks["userinfo_audience"], checks
+
+
+def _prompt_for_discourse_sign_in(checks: Dict[str, bool]) -> bool:
+    discourse_url = _discourse_sign_in_url()
+    missing = []
+    if not checks.get("latest_eula"):
+        missing.append("LatestEULA grant")
+    if not checks.get("userinfo_audience"):
+        missing.append(f"{_expected_userinfo_audience()} audience")
+
+    click.echo("")
+    click.secho("Developer Portal sign-in is required before sima-cli can continue.", fg="yellow")
+    if missing:
+        click.echo(f"Missing from the access token: {', '.join(missing)}.")
+    click.echo("Please sign in to Discourse / Developer Portal and accept the EULA if prompted.")
+
+    if is_browser_available():
+        click.echo(f"Opening sign-in page: {click.style(discourse_url, fg='cyan', bold=True)}")
+        try:
+            webbrowser.open(discourse_url)
+        except Exception:
+            click.echo("Browser could not be opened automatically. Open this link manually:")
+            click.secho(discourse_url, fg="cyan", bold=True)
+    else:
+        click.echo("Browser not available. Open this link manually:")
+        click.secho(discourse_url, fg="cyan", bold=True)
+
+    return click.confirm("Have you signed in to Discourse / Developer Portal?", default=True)
+
+
+def _ensure_access_token_requirements(tokens: dict, auth_cfg: dict) -> Optional[dict]:
+    while True:
+        valid, checks = _validate_access_token_requirements(tokens)
+        if valid:
+            return tokens
+        if not checks.get("doc_access"):
+            return tokens
+
+        if not _prompt_for_discourse_sign_in(checks):
+            clear_external_login_state()
+            click.echo("Logged out. Run `sima-cli login` again after signing in to Developer Portal.")
+            return None
+
+        refresh_token = tokens.get("refresh_token")
+        if not refresh_token:
+            click.echo("Unable to refresh your access token after Developer Portal sign-in.")
+            clear_external_login_state()
+            click.echo("Logged out. Run `sima-cli login` again.")
+            return None
+
+        refreshed = refresh_access_token(auth_cfg, refresh_token)
+        if not refreshed:
+            clear_external_login_state()
+            click.echo("Logged out. Run `sima-cli login` again.")
+            return None
+
+        tokens = refreshed
+
 def request_device_code(auth_cfg):
     """Step 1: Request device code from Auth0."""
     data = {
@@ -269,16 +406,25 @@ def get_or_refresh_tokens(force=False):
     tokens = load_tokens()
 
     if tokens and is_token_valid(tokens) and not force:
-        return tokens
+        tokens = _ensure_access_token_requirements(tokens, auth_cfg)
+        if tokens:
+            return tokens
+        return None
 
     if tokens and tokens.get("refresh_token"):
         refreshed = refresh_access_token(auth_cfg, tokens["refresh_token"])
         if refreshed:
-            print_welcome_message(refreshed)
-            return refreshed
+            refreshed = _ensure_access_token_requirements(refreshed, auth_cfg)
+            if refreshed:
+                print_welcome_message(refreshed)
+                return refreshed
+            return None
         print("⚠️ Refresh failed, falling back to new login.")
 
     new_tokens = login_auth0(auth_cfg)
+    new_tokens = _ensure_access_token_requirements(new_tokens, auth_cfg)
+    if not new_tokens:
+        return None
     print_welcome_message(new_tokens)
     return new_tokens
 

{sima_cli-2.1.8 → sima_cli-2.1.9}/sima_cli/auth/devportal.py

@@ -7,6 +7,7 @@ import subprocess
 import shutil
 import base64
 import hashlib
+import webbrowser
 
 from typing import Optional
 from http.cookiejar import MozillaCookieJar
@@ -17,9 +18,14 @@ from sima_cli.utils.env import is_sima_board
 from sima_cli.auth.auth0 import (
     decode_jwt_payload,
     extract_email,
+    access_token_has_doc_access,
+    access_token_has_latest_eula,
+    get_auth_config,
     get_or_refresh_tokens,
     get_cached_access_token,
+    is_browser_available,
     load_tokens,
+    refresh_access_token,
 )
 
 HOME_DIR = os.path.expanduser("~/.sima-cli")
@@ -43,6 +49,7 @@ else:
 
 # Derived endpoints
 LOGIN_URL = f"{DEV_PORTAL}/session"
+DEV_PORTAL_LOGIN_URL = f"{DEV_PORTAL}/login"
 DUMMY_CHECK_URL = f"{DOCS_PORTAL}/pkg_downloads/validation"
 ACCESS_REQUEST_FORM_URL = "https://www2.sima.ai/l/1041271/2025-05-05/37bndg"
 USER_INFO_CLAIM = "https://auth.sima.ai/user_info"
@@ -61,14 +68,39 @@ HEADERS = {
     "sec-ch-ua-platform": '"macOS"',
 }
 
+
+def _prompt_manual_developer_portal_login(confirm_completion: bool = False) -> bool:
+    click.secho(
+        f"\nOpen this page to accept EULA to proceed, press Y when you are done:\n{DEV_PORTAL_LOGIN_URL}\n",
+        fg="green",
+    )
+    if confirm_completion:
+        return click.confirm("Have you accepted the EULA?", default=True)
+    return False
+
+
+def _open_developer_portal_login_page(confirm_manual_completion: bool = False) -> bool:
+    if not is_browser_available():
+        return _prompt_manual_developer_portal_login(confirm_manual_completion)
+
+    try:
+        opened = webbrowser.open(DEV_PORTAL_LOGIN_URL)
+    except Exception:
+        opened = False
+
+    if not opened:
+        return _prompt_manual_developer_portal_login(confirm_manual_completion)
+    return True
+
+
 def _handle_eula_flow(session: requests.Session, username: str, domain: str) -> bool:
     try:
         click.echo("\n📄 To continue, you must accept the End-User License Agreement (EULA).")
-        click.echo("👉 Please sign in to Developer Portal on your browser, then open the following URL to accept the EULA:")
-        click.echo("👉 If you were not prompted with the EULA acceptance popup, please open the URL in the incogniton browser.")
-        click.echo(f"\n  {DUMMY_CHECK_URL}\n")
+        click.echo("👉 Please sign in to Developer Portal in your browser and accept the EULA if prompted.")
+        click.echo("👉 If you were not prompted with the EULA acceptance popup, try opening the page in an incognito browser.")
+        _open_developer_portal_login_page()
 
-        if not click.confirm("✅ Have you completed the EULA form in your browser?", default=True):
+        if not click.confirm("✅ Have you signed in to Developer Portal and accepted the EULA?", default=True):
             click.echo("❌ EULA acceptance is required to continue.")
             return False
 
@@ -192,15 +224,20 @@ def _show_access_request_pending_message(already_submitted: bool = False):
         click.secho("✅ Your access request has already been submitted.", fg="green")
     else:
         click.secho("✅ Your access request has been submitted.", fg="green")
+
+
+def _show_limited_access_pending_message():
+    click.secho("✅ You are signed in with limited Developer Portal access.", fg="green")
     console.print(
         Panel(
             "\n".join(
                 [
-                    "SiMa is reviewing your request and will grant access shortly.",
+                    "SiMa is reviewing your account and will grant full access shortly.",
                     "Please look out for an email from marketing@marketing.sima.ai.",
-                    "Once access is granted, run `sima-cli login` again.",
                 ]
             ),
+            title="Notice",
+            title_align="center",
             border_style="yellow",
             style="yellow",
             expand=False,
@@ -208,27 +245,26 @@ def _show_access_request_pending_message(already_submitted: bool = False):
     )
 
 
-def _show_access_request_info_panel():
-    console.print(
-        Panel(
-            "\n".join(
-                [
-                    "Welcome to the SiMa.ai Developer Portal.",
-                    "",
-                    "To download digital assets from the Developer Portal, "
-                    "SiMa's business team needs to grant access after you "
-                    "provide a few additional details, including your project goal.",
-                    "",
-                    "Once approved, you will receive an email from "
-                    "marketing@marketing.sima.ai. Please check your email "
-                    "client's spam filter.",
-                ]
-            ),
-            title="Developer Portal Access Request",
-            border_style="yellow",
-            expand=False,
-        )
-    )
+def _prompt_eula_acceptance_after_access_request() -> bool:
+    click.echo("\n📄 To continue, accept the End-User License Agreement (EULA).")
+    click.echo("👉 Please sign in to Developer Portal in your browser and accept the EULA if prompted.")
+    _open_developer_portal_login_page()
+    if not click.confirm("✅ Have you signed in to Developer Portal and accepted the EULA?", default=True):
+        return False
+
+    tokens = load_tokens() or {}
+    refresh_token = tokens.get("refresh_token")
+    if not refresh_token:
+        click.secho("⚠️  Unable to refresh your access token: missing refresh token.", fg="yellow")
+        return False
+
+    click.echo("Refreshing access token after EULA acceptance...")
+    refreshed = refresh_access_token(get_auth_config(), refresh_token)
+    if not refreshed:
+        click.secho("⚠️  Unable to refresh your access token after EULA acceptance.", fg="yellow")
+        return False
+
+    return True
 
 
 def _submit_access_request() -> bool:
@@ -243,19 +279,10 @@ def _submit_access_request() -> bool:
         )
         return False
 
-    if _has_submitted_access_request(claims):
-        _show_access_request_pending_message(already_submitted=True)
-        _logout_external_credentials()
-        return False
-
-    _show_access_request_info_panel()
-    message = click.prompt(
-        click.style("Please briefly describe your project", fg="yellow"),
-        type=str,
-    ).strip()
-    payload = _build_access_request_payload(claims, message)
+    payload = _build_access_request_payload(claims, "sima-cli sign up request")
 
     try:
+        click.echo("Submitting Developer Portal access request...")
         response = requests.post(ACCESS_REQUEST_FORM_URL, data=payload, timeout=15)
         response.raise_for_status()
     except requests.RequestException as e:
@@ -264,7 +291,8 @@ def _submit_access_request() -> bool:
 
     _mark_access_request_submitted(claims)
     _show_access_request_pending_message()
-    _logout_external_credentials()
+    if not access_token_has_latest_eula(load_tokens() or {}):
+        _prompt_eula_acceptance_after_access_request()
     return False
 
 
@@ -355,7 +383,12 @@ def login_external(force=False, loginDocker=True):
         if _ACCESS_REQUEST_HANDLED:
             return None
         
-    get_or_refresh_tokens(force=force)
+    tokens = get_or_refresh_tokens(force=force)
+    if not tokens:
+        return None
+    if not access_token_has_doc_access(tokens):
+        return _submit_access_request()
+
     session, valid = validate_session()
     if valid:
         if loginDocker:

{sima_cli-2.1.8 → sima_cli-2.1.9}/sima_cli/install/metadata_installer.py

@@ -12,7 +12,7 @@ import shlex
 import platform
 import hashlib
 from urllib.parse import urlparse, quote, urljoin, unquote
-from typing import Dict
+from typing import Dict, List
 from tqdm import tqdm
 from pathlib import Path
 import subprocess
@@ -298,7 +298,7 @@ def _resolve_resource_url(base_url: str, resource: str) -> str:
     )
     return urljoin(base_url, encoded_resource)
 
-def _resolve_resource_url_candidates(base_url: str, resource: str) -> list[str]:
+def _resolve_resource_url_candidates(base_url: str, resource: str) -> List[str]:
     primary_url = _resolve_resource_url(base_url, resource)
 
     parsed_resource = urlparse(resource)
@@ -338,12 +338,12 @@ def _normalize_downloaded_metadata_resource(local_path: str, expected_path: Path
 
 def _download_metadata_file_resource(
     resource: str,
-    resource_urls: list[str],
+    resource_urls: List[str],
     dest_folder: str,
     dest_path: Path,
     internal: bool,
 ) -> str:
-    errors: list[str] = []
+    errors: List[str] = []
     for index, resource_url in enumerate(resource_urls):
         try:
             local_path = download_file_from_url(

{sima_cli-2.1.8 → sima_cli-2.1.9}/sima_cli/sdk/utils.py

@@ -347,19 +347,22 @@ def prompt_multi_select(baseline_present: bool = False) -> List[str]:
 
         return deduped
 
-def run_command(cmd, capture_output=False):
+def run_command(cmd, capture_output=False, fatal=True):
     """Run a shell command and return output if requested."""
     try:
         if capture_output:
             return subprocess.check_output(cmd, text=True).strip()
         else:
             subprocess.run(cmd, check=True)
-            return None
+            return True if not fatal else None
     except subprocess.CalledProcessError as e:
-        print(f"❌ Command failed: {' '.join(cmd)}")
+        prefix = "❌ Command failed" if fatal else "⚠️  Optional command failed"
+        print(f"{prefix}: {' '.join(cmd)}")
         if e.stderr:
             print(f"Error: {e.stderr.strip()}")
-        sys.exit(1)
+        if fatal:
+            sys.exit(1)
+        return False
 
 
 ### Dynamic port allocation
@@ -664,7 +667,7 @@ def _copy_sima_cli_auth_cache_to_container(sdk_container_name: str, login_name:
         return
 
     container_auth_dir = f"/home/{login_name}/.sima-cli"
-    run_command([
+    if not run_command([
         "docker",
         "exec",
         "-u",
@@ -673,14 +676,29 @@ def _copy_sima_cli_auth_cache_to_container(sdk_container_name: str, login_name:
         "mkdir",
         "-p",
         container_auth_dir,
-    ])
+    ], fatal=False):
+        print("⚠️  Could not create sima-cli auth cache directory in Neat SDK container; continuing setup.")
+        return
+    if not run_command([
+        "docker",
+        "exec",
+        "-u",
+        "root",
+        sdk_container_name,
+        "chown",
+        f"{uid}:{gid}",
+        container_auth_dir,
+    ], fatal=False):
+        print("⚠️  Could not update ownership for sima-cli auth cache directory; continuing setup.")
 
     copied = []
     for filename in existing_files:
         host_path = os.path.join(host_sima_cli_dir, filename)
         container_path = f"{container_auth_dir}/{filename}"
-        run_command(["docker", "cp", host_path, f"{sdk_container_name}:{container_path}"])
-        run_command([
+        if not run_command(["docker", "cp", host_path, f"{sdk_container_name}:{container_path}"], fatal=False):
+            print(f"⚠️  Could not copy host sima-cli auth cache file '{filename}' into Neat SDK container; continuing setup.")
+            continue
+        if not run_command([
             "docker",
             "exec",
             "-u",
@@ -689,19 +707,15 @@ def _copy_sima_cli_auth_cache_to_container(sdk_container_name: str, login_name:
             "chown",
             f"{uid}:{gid}",
             container_path,
-        ])
+        ], fatal=False):
+            print(f"⚠️  Could not update ownership for copied sima-cli auth cache file '{filename}'; continuing setup.")
+            continue
         copied.append(filename)
 
-    run_command([
-        "docker",
-        "exec",
-        "-u",
-        "root",
-        sdk_container_name,
-        "chown",
-        f"{uid}:{gid}",
-        container_auth_dir,
-    ])
+    if not copied:
+        print("ℹ️  No sima-cli auth cache files were copied into Neat SDK container; continuing setup.")
+        return
+
     print(f"🔐 Copied sima-cli auth cache file(s) into Neat SDK container: {', '.join(copied)}")
 
 
@@ -918,6 +932,8 @@ def install_neat_playbooks(sdk_container_name: str, login_name: str) -> None:
             login_name,
             "-e",
             "SIMA_CLI_CHECK_FOR_UPDATE=0",
+            "-e",
+            "GITHUB_TOKEN",
             sdk_container_name,
             "bash",
             "-lc",