sonilo-cli 0.9.0__tar.gz → 0.11.0__tar.gz

{sonilo_cli-0.9.0 → sonilo_cli-0.11.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: sonilo-cli
-Version: 0.9.0
+Version: 0.11.0
 Summary: Command-line interface for the Sonilo API: generate music and sound effects from text or video
 Project-URL: Repository, https://github.com/sonilo-ai/sonilo-python
 Author: Sonilo AI
@@ -8,7 +8,7 @@ License-Expression: MIT
 License-File: LICENSE
 Keywords: ai,cli,music,sfx,sonilo,text-to-music,video-to-music
 Requires-Python: >=3.9
-Requires-Dist: sonilo<0.12,>=0.11.0
+Requires-Dist: sonilo<0.13,>=0.12.0
 Provides-Extra: dev
 Requires-Dist: pytest>=8; extra == 'dev'
 Requires-Dist: respx>=0.21; extra == 'dev'
@@ -22,16 +22,67 @@ Command-line interface for the [Sonilo API](https://github.com/sonilo-ai/sonilo-
 
     pip install sonilo-cli
 
-## Auth
+## Signing in
 
-Set your API key once:
+Run this once per machine — there is no key to create, paste, or export:
+
+    sonilo login
+
+It prints a one-time code and opens your browser to platform.sonilo.com. Sign
+in, confirm the code matches what the terminal printed, and approve; the CLI is
+waiting on that page and continues by itself. Every command works from then on.
+
+Approving mints an ordinary Sonilo API key on your account, named
+`cli: <hostname>` and valid for **90 days**, stored in
+`~/.config/sonilo/credentials.json` (`$XDG_CONFIG_HOME/sonilo/` when that is
+set), owner-readable only. It is visible and revocable at
+[the dashboard](https://platform.sonilo.com/dashboard/api-keys) like any other
+key.
+
+    sonilo whoami    # which account, key prefix, expiry, and which source is active
+    sonilo logout    # revoke the key server-side, then forget it locally
+
+`logout` revokes before forgetting, so a machine that loses the file never
+leaves a live key behind. If the revoke cannot reach the API the credential is
+deliberately kept and you are pointed at the dashboard, rather than being left
+holding a key nothing can revoke.
+
+Signing in again while already signed in reports the existing session; use
+`--force` to replace it (that mints a fresh key and revokes the one it
+replaces). When a credential has expired you do not need the flag — `sonilo
+login` treats an expired sign-in as no sign-in. On a machine with no browser,
+add `--no-browser` and approve the printed URL from another device.
+
+The credential file is shared with the JS CLI (`npm install -g sonilo-cli`) and
+read by [sonilo-mcp](https://github.com/sonilo-ai/sonilo-mcp) 0.16.0+, so one
+sign-in covers all three — an MCP host config then needs no `env` block at all.
+
+## Auth with an API key
+
+Signing in is optional. A key from
+[the dashboard](https://platform.sonilo.com/dashboard/api-keys) works exactly as
+it always has, which is what you want for CI, containers, and anything
+non-interactive — there is no browser there to approve with, and a 90-day expiry
+is not something a pipeline should depend on:
 
     export SONILO_API_KEY=sk-...
 
 or pass `--api-key sk-...` on any command.
 
+Credentials resolve most-explicit-first: `--api-key`, then `SONILO_API_KEY`,
+then the stored sign-in. That order is a guarantee, not an accident — an
+exported `SONILO_API_KEY` keeps winning after you upgrade, so adding a `sonilo
+login` on the same machine cannot quietly move your calls to another account.
+
+Set `SONILO_API_URL` (or pass `--api-base` to `login`) to point at another
+environment. Credentials are stored per host, so a staging sign-in and a
+production sign-in coexist without overwriting each other.
+
 ## Commands
 
+    sonilo login                       # sign in with your browser, no key needed
+    sonilo whoami                      # show the active account and credential source
+    sonilo logout                      # revoke the stored key and forget it
     sonilo account                     # plan limits and available services
     sonilo usage --days 7              # usage summary
     sonilo text-to-music --prompt "warm lo-fi piano, rain" --duration 30
@@ -106,6 +157,17 @@ request — and values above 1 are never covered by the free trial.
 - On `video-to-sound` / `video-to-video-sound`, `--stem` is applied per variant too, e.g.
   `take.0.music.m4a`.
 
+### Prompt influence
+
+`--prompt-influence` (0-1, API default 0.5) sets how strongly the generated music follows the
+prompt, on `video-to-music` and `video-to-video-music` only. Lower values let the video lead;
+higher values follow the prompt more literally. It is free of charge, and unlike `--format wav` it
+does not force the async path — it works on the streaming default too. Left unset, the field is
+not sent at all and the API's own 0.5 default applies; `--prompt-influence 0` is a real value
+("let the video lead entirely") and is sent. Out-of-range values earn a `422` from the API.
+
+    sonilo video-to-music --video clip.mp4 --prompt "tense synths" --prompt-influence 0.8
+
 ### Scored video
 
 `video-to-video-music` and `video-to-video-sfx` are the video-out counterparts of `video-to-music`
@@ -128,6 +190,8 @@ file (default `output.mp4`):
 - For music *and* effects in one call, use `video-to-video-sound` below.
 - `video-to-video-music` also takes `--variants` — see [Variants](#variants) above.
   `video-to-video-sfx` does not.
+- `video-to-video-music` also takes `--prompt-influence` — see
+  [Prompt influence](#prompt-influence) above. `video-to-video-sfx` does not.
 
 ### Combined soundtracks
 

{sonilo_cli-0.9.0 → sonilo_cli-0.11.0}/README.md

@@ -6,16 +6,67 @@ Command-line interface for the [Sonilo API](https://github.com/sonilo-ai/sonilo-
 
     pip install sonilo-cli
 
-## Auth
+## Signing in
 
-Set your API key once:
+Run this once per machine — there is no key to create, paste, or export:
+
+    sonilo login
+
+It prints a one-time code and opens your browser to platform.sonilo.com. Sign
+in, confirm the code matches what the terminal printed, and approve; the CLI is
+waiting on that page and continues by itself. Every command works from then on.
+
+Approving mints an ordinary Sonilo API key on your account, named
+`cli: <hostname>` and valid for **90 days**, stored in
+`~/.config/sonilo/credentials.json` (`$XDG_CONFIG_HOME/sonilo/` when that is
+set), owner-readable only. It is visible and revocable at
+[the dashboard](https://platform.sonilo.com/dashboard/api-keys) like any other
+key.
+
+    sonilo whoami    # which account, key prefix, expiry, and which source is active
+    sonilo logout    # revoke the key server-side, then forget it locally
+
+`logout` revokes before forgetting, so a machine that loses the file never
+leaves a live key behind. If the revoke cannot reach the API the credential is
+deliberately kept and you are pointed at the dashboard, rather than being left
+holding a key nothing can revoke.
+
+Signing in again while already signed in reports the existing session; use
+`--force` to replace it (that mints a fresh key and revokes the one it
+replaces). When a credential has expired you do not need the flag — `sonilo
+login` treats an expired sign-in as no sign-in. On a machine with no browser,
+add `--no-browser` and approve the printed URL from another device.
+
+The credential file is shared with the JS CLI (`npm install -g sonilo-cli`) and
+read by [sonilo-mcp](https://github.com/sonilo-ai/sonilo-mcp) 0.16.0+, so one
+sign-in covers all three — an MCP host config then needs no `env` block at all.
+
+## Auth with an API key
+
+Signing in is optional. A key from
+[the dashboard](https://platform.sonilo.com/dashboard/api-keys) works exactly as
+it always has, which is what you want for CI, containers, and anything
+non-interactive — there is no browser there to approve with, and a 90-day expiry
+is not something a pipeline should depend on:
 
     export SONILO_API_KEY=sk-...
 
 or pass `--api-key sk-...` on any command.
 
+Credentials resolve most-explicit-first: `--api-key`, then `SONILO_API_KEY`,
+then the stored sign-in. That order is a guarantee, not an accident — an
+exported `SONILO_API_KEY` keeps winning after you upgrade, so adding a `sonilo
+login` on the same machine cannot quietly move your calls to another account.
+
+Set `SONILO_API_URL` (or pass `--api-base` to `login`) to point at another
+environment. Credentials are stored per host, so a staging sign-in and a
+production sign-in coexist without overwriting each other.
+
 ## Commands
 
+    sonilo login                       # sign in with your browser, no key needed
+    sonilo whoami                      # show the active account and credential source
+    sonilo logout                      # revoke the stored key and forget it
     sonilo account                     # plan limits and available services
     sonilo usage --days 7              # usage summary
     sonilo text-to-music --prompt "warm lo-fi piano, rain" --duration 30
@@ -90,6 +141,17 @@ request — and values above 1 are never covered by the free trial.
 - On `video-to-sound` / `video-to-video-sound`, `--stem` is applied per variant too, e.g.
   `take.0.music.m4a`.
 
+### Prompt influence
+
+`--prompt-influence` (0-1, API default 0.5) sets how strongly the generated music follows the
+prompt, on `video-to-music` and `video-to-video-music` only. Lower values let the video lead;
+higher values follow the prompt more literally. It is free of charge, and unlike `--format wav` it
+does not force the async path — it works on the streaming default too. Left unset, the field is
+not sent at all and the API's own 0.5 default applies; `--prompt-influence 0` is a real value
+("let the video lead entirely") and is sent. Out-of-range values earn a `422` from the API.
+
+    sonilo video-to-music --video clip.mp4 --prompt "tense synths" --prompt-influence 0.8
+
 ### Scored video
 
 `video-to-video-music` and `video-to-video-sfx` are the video-out counterparts of `video-to-music`
@@ -112,6 +174,8 @@ file (default `output.mp4`):
 - For music *and* effects in one call, use `video-to-video-sound` below.
 - `video-to-video-music` also takes `--variants` — see [Variants](#variants) above.
   `video-to-video-sfx` does not.
+- `video-to-video-music` also takes `--prompt-influence` — see
+  [Prompt influence](#prompt-influence) above. `video-to-video-sfx` does not.
 
 ### Combined soundtracks
 

{sonilo_cli-0.9.0 → sonilo_cli-0.11.0}/pyproject.toml

@@ -4,13 +4,13 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sonilo-cli"
-version = "0.9.0"
+version = "0.11.0"
 description = "Command-line interface for the Sonilo API: generate music and sound effects from text or video"
 readme = "README.md"
 license = "MIT"
 requires-python = ">=3.9"
 authors = [{ name = "Sonilo AI" }]
-dependencies = ["sonilo>=0.11.0,<0.12"]
+dependencies = ["sonilo>=0.12.0,<0.13"]
 keywords = ["sonilo", "cli", "music", "sfx", "text-to-music", "video-to-music", "ai"]
 
 [project.urls]

{sonilo_cli-0.9.0 → sonilo_cli-0.11.0}/src/sonilo_cli/__init__.py

@@ -1,3 +1,3 @@
-__version__ = "0.9.0"
+__version__ = "0.11.0"
 
 __all__ = ["__version__"]

{sonilo_cli-0.9.0 → sonilo_cli-0.11.0}/src/sonilo_cli/__main__.py

@@ -12,7 +12,8 @@ from urllib.parse import urlparse
 from sonilo import Sonilo
 from sonilo.errors import APIError, SoniloError
 
-from sonilo_cli import __version__
+from sonilo_cli import __version__, credentials
+from sonilo_cli.login import LoginError, cmd_login, cmd_logout, cmd_whoami
 
 
 class _Parser(argparse.ArgumentParser):
@@ -196,12 +197,34 @@ def _segments(args: argparse.Namespace) -> Optional[List[Dict[str, Any]]]:
     return parse_segments(args.segments, args.segments_shape, args.command)
 
 
-def build_client(api_key: Optional[str]) -> Sonilo:
+def _expired(iso: str) -> bool:
+    """Whether a stored credential's expiry has passed.
+
+    Reuses login's parser so both paths agree on what "expired" means, and on
+    treating an unparseable timestamp as *not* expired — the API is the
+    authority on whether a key works, and refusing to run over a formatting
+    quirk would be worse than letting a dead key earn its own 401.
+    """
+    from sonilo_cli.login import _is_expired
+
+    return _is_expired(iso)
+
+
+def build_client(api_key: Optional[str], path: Optional[Path] = None) -> Sonilo:
+    api_base = os.environ.get("SONILO_API_URL", credentials.DEFAULT_API_BASE).rstrip("/")
+    # Order is a compatibility promise: an exported SONILO_API_KEY keeps winning
+    # over a stored credential, so upgrading never moves someone's account.
     key = api_key or os.environ.get("SONILO_API_KEY")
+    if not key:
+        stored = credentials.read_credential(api_base, path)
+        if stored is not None:
+            if _expired(stored.get("expires_at", "")):
+                _fail('your sonilo login expired — run "sonilo login" again')
+            key = stored["api_key"]
     if not key:
         _fail(
-            "no API key — pass --api-key <key> or set the "
-            "SONILO_API_KEY environment variable"
+            'no API key — run "sonilo login", or pass --api-key <key>, or set '
+            "the SONILO_API_KEY environment variable"
         )
     # Identify as the CLI rather than inheriting the SDK's own name, so CLI
     # traffic stays separable from direct SDK use in server-side analytics.
@@ -309,12 +332,15 @@ def cmd_video_to_music(client: Sonilo, args: argparse.Namespace) -> None:
             preserve_speech=args.preserve_speech or None,
             output_format=fmt if fmt != "m4a" else None,
             variants_num=args.variants,
+            prompt_influence=args.prompt_influence,
         )
         _save_music_variants(result, out)
     else:
+        # prompt_influence rides the streaming path too — it is a generation
+        # parameter, not a finalize-time one, so it never forces async.
         track = client.video_to_music.generate(
             video=args.video, video_url=args.video_url, prompt=args.prompt,
-            segments=segments,
+            segments=segments, prompt_influence=args.prompt_influence,
         )
         path = track.save(out)
         _wrote(path, len(track.audio))
@@ -435,6 +461,7 @@ def cmd_video_to_video_music(client: Sonilo, args: argparse.Namespace) -> None:
         preserve_speech=True if args.preserve_speech else None,
         isolate_vocals=True if args.isolate_vocals else None,
         variants_num=args.variants,
+        prompt_influence=args.prompt_influence,
     )
 
 
@@ -543,6 +570,19 @@ def _add_segments(parser: argparse.ArgumentParser, shape: _SegmentShape) -> None
     parser.set_defaults(segments_shape=shape)
 
 
+def _add_prompt_influence(parser: argparse.ArgumentParser) -> None:
+    # Only the two music-from-video commands take this — the API accepts it
+    # nowhere else. type=float so 0 arrives as 0.0, a real value ("let the
+    # video lead entirely"), distinct from the unset None that keeps the
+    # field off the wire and leaves the API its own 0.5 default.
+    parser.add_argument(
+        "--prompt-influence", dest="prompt_influence", type=float, default=None,
+        help="How strongly the generated music follows the prompt, 0-1 "
+             "(API default 0.5). Lower values let the video lead; higher "
+             "values follow the prompt more literally. Free of charge.",
+    )
+
+
 def _add_variants(parser: argparse.ArgumentParser) -> None:
     parser.add_argument(
         "--variants", type=int, default=None,
@@ -560,6 +600,33 @@ def build_parser() -> argparse.ArgumentParser:
     _add_global(parser)
     sub = parser.add_subparsers(dest="command", metavar="<command>")
 
+    # login/logout/whoami run *before* a client exists — build_client exits when
+    # no key is available, which is the exact situation login is for. The
+    # needs_client=False flag is what main() checks to skip that.
+    p_login = sub.add_parser("login", help="Sign in and store an API key for future commands")
+    _add_global(p_login)
+    p_login.add_argument("--force", action="store_true",
+                         help="Sign in again even if already signed in, replacing the stored key.")
+    p_login.add_argument("--no-browser", action="store_true", dest="no_browser",
+                         help="Print the URL instead of opening a browser.")
+    p_login.add_argument("--api-base", dest="api_base", default=None,
+                         help="Sign in against a non-default API base URL.")
+    p_login.set_defaults(func=lambda client, args: cmd_login(args), needs_client=False)
+
+    p_logout = sub.add_parser("logout", help="Revoke the stored key and forget it locally")
+    _add_global(p_logout)
+    p_logout.add_argument("--local-only", action="store_true", dest="local_only",
+                          help="Forget the credential without revoking the key server-side.")
+    p_logout.add_argument("--api-base", dest="api_base", default=None,
+                          help="Act on the credential for a non-default API base URL.")
+    p_logout.set_defaults(func=lambda client, args: cmd_logout(args), needs_client=False)
+
+    p_whoami = sub.add_parser("whoami", help="Show which account and key are currently active")
+    _add_global(p_whoami)
+    p_whoami.add_argument("--api-base", dest="api_base", default=None,
+                          help="Inspect the credential for a non-default API base URL.")
+    p_whoami.set_defaults(func=lambda client, args: cmd_whoami(args), needs_client=False)
+
     p_account = sub.add_parser("account", help="Show plan limits and available services")
     _add_global(p_account)
     p_account.set_defaults(func=cmd_account)
@@ -601,6 +668,7 @@ def build_parser() -> argparse.ArgumentParser:
     p_v2m.add_argument("--async", dest="use_async", action="store_true",
                        help="Submit and poll instead of streaming.")
     _add_variants(p_v2m)
+    _add_prompt_influence(p_v2m)
     p_v2m.set_defaults(func=cmd_video_to_music)
 
     p_t2s = sub.add_parser("text-to-sfx", help="Generate a sound effect from a text prompt")
@@ -677,6 +745,7 @@ def build_parser() -> argparse.ArgumentParser:
                         help="Legacy alias for --preserve-speech; no separate stem.")
     p_v2vm.add_argument("--output", default=None, help="Where to save the scored video.")
     _add_variants(p_v2vm)
+    _add_prompt_influence(p_v2vm)
     p_v2vm.set_defaults(func=cmd_video_to_video_music)
 
     p_v2vfx = sub.add_parser(
@@ -770,6 +839,14 @@ def main(argv: Optional[List[str]] = None) -> None:
     func = getattr(args, "func", None)
     if func is None:
         parser.error("missing command (try `sonilo --help`)")
+    if getattr(args, "needs_client", True) is False:
+        try:
+            func(None, args)  # type: ignore[arg-type]
+        except LoginError as exc:
+            # Expected outcomes — denied, expired, throttled, offline — read as
+            # `sonilo: <message>`, never as a traceback.
+            _fail(str(exc))
+        return
     client = build_client(getattr(args, "api_key", None))
     try:
         func(client, args)

sonilo_cli-0.11.0/src/sonilo_cli/credentials.py

@@ -0,0 +1,105 @@
+"""The credential file written by `sonilo login`.
+
+Format and location are shared with the JS CLI (`packages/cli/src/credentials.ts`
+in sonilo-js) and read by sonilo-mcp, so the path, the JSON shape and the
+0600/0700 modes are a cross-repo contract — change them in all three or not at
+all.
+"""
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+from typing import Any, Dict, Optional
+
+DEFAULT_API_BASE = "https://api.sonilo.com"
+FORMAT_VERSION = 1
+
+
+class CredentialFormatError(Exception):
+    """The file was written by a newer client than this one understands."""
+
+
+def credentials_path() -> Path:
+    base = os.environ.get("XDG_CONFIG_HOME")
+    root = Path(base) if base else Path(os.environ.get("HOME", str(Path.home()))) / ".config"
+    return root / "sonilo" / "credentials.json"
+
+
+def _empty() -> Dict[str, Any]:
+    return {"version": FORMAT_VERSION, "credentials": {}}
+
+
+def _load(path: Path) -> Dict[str, Any]:
+    try:
+        raw = path.read_text(encoding="utf-8")
+    except OSError:
+        return _empty()
+    try:
+        parsed = json.loads(raw)
+    except ValueError:
+        # Corrupt file reads as "no credential"; `login` will replace it.
+        return _empty()
+    if not isinstance(parsed, dict):
+        return _empty()
+    version = parsed.get("version")
+    if isinstance(version, int) and version > FORMAT_VERSION:
+        raise CredentialFormatError(
+            f"{path} was written by a newer sonilo CLI (format {version}). "
+            "Upgrade the CLI or delete the file."
+        )
+    creds = parsed.get("credentials")
+    return {
+        "version": FORMAT_VERSION,
+        "credentials": creds if isinstance(creds, dict) else {},
+    }
+
+
+def _save(path: Path, data: Dict[str, Any]) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    os.chmod(path.parent, 0o700)
+    tmp = path.with_name(path.name + ".{}.tmp".format(os.getpid()))
+    tmp.write_text(json.dumps(data, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+    os.chmod(tmp, 0o600)
+    try:
+        # Rename last: an interrupted write can never replace a whole
+        # credential with half of one.
+        os.replace(tmp, path)
+    except OSError:
+        # Never leave the temp file behind holding a live key.
+        try:
+            tmp.unlink()
+        except OSError:
+            pass
+        raise
+
+
+def read_credential(api_base: str, path: Optional[Path] = None) -> Optional[Dict[str, Any]]:
+    entry = _load(path or credentials_path())["credentials"].get(api_base)
+    if isinstance(entry, dict) and isinstance(entry.get("api_key"), str) and entry["api_key"]:
+        return entry
+    return None
+
+
+def write_credential(
+    api_base: str, cred: Dict[str, Any], path: Optional[Path] = None
+) -> None:
+    target = path or credentials_path()
+    data = _load(target)
+    data["credentials"][api_base] = cred
+    _save(target, data)
+
+
+def remove_credential(api_base: str, path: Optional[Path] = None) -> None:
+    target = path or credentials_path()
+    data = _load(target)
+    if api_base not in data["credentials"]:
+        return
+    del data["credentials"][api_base]
+    if not data["credentials"]:
+        try:
+            target.unlink()
+        except OSError:
+            pass
+        return
+    _save(target, data)