spawnllm 0.17.0__tar.gz → 0.17.2__tar.gz

{spawnllm-0.17.0 → spawnllm-0.17.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: spawnllm
-Version: 0.17.0
+Version: 0.17.2
 Summary: Delete your subprocess wrappers around claude, codex, and gemini.
 Keywords: 
 Author: Yasyf Mohamedali

{spawnllm-0.17.0 → spawnllm-0.17.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "spawnllm"
-version = "0.17.0"
+version = "0.17.2"
 description = "Delete your subprocess wrappers around claude, codex, and gemini."
 readme = "README.md"
 license = "MIT"

{spawnllm-0.17.0 → spawnllm-0.17.2}/pyproject.toml.orig

@@ -1,7 +1,7 @@
 [project]
 name = "spawnllm"
 # Inert sentinel: the real version is set from the release tag (uv version --frozen).
-version = "0.17.0"
+version = "0.17.2"
 description = "Delete your subprocess wrappers around claude, codex, and gemini."
 readme = "README.md"
 license = "MIT"

{spawnllm-0.17.0 → spawnllm-0.17.2}/spawnllm/_core/__init__.py

@@ -20,9 +20,8 @@ from importlib.resources import files
 from pathlib import Path
 from typing import TYPE_CHECKING, Any
 
-from wasmtime import Engine, Func, Linker, Memory, Module, Store, Trap, WasiConfig, WasmtimeError
-
 if TYPE_CHECKING:
+    from wasmtime import Func, Memory, Store
     from wasmtime._instance import InstanceExports
 
 WASM_NAME = "spawnllm_core.wasm"
@@ -59,6 +58,8 @@ class Runtime:
     stderr_path: Path
 
     def invoke(self, request_json: str) -> str:
+        from wasmtime import Trap, WasmtimeError
+
         request = request_json.encode()
         request_len = len(request)
         request_ptr = self.alloc(self.store, request_len)
@@ -90,6 +91,8 @@ def export[T](exports: InstanceExports, name: str, kind: type[T]) -> T:
 
 
 def build() -> Runtime:
+    from wasmtime import Engine, Func, Linker, Memory, Module, Store, WasiConfig
+
     blob = files(__package__).joinpath(WASM_NAME)
     if not blob.is_file():
         raise FileNotFoundError(MISSING_BLOB)
@@ -145,6 +148,8 @@ def trap_message(runtime: Runtime, error: Exception) -> str:
 
 
 def dispatch_raw(request_json: str) -> str:
+    from wasmtime import Trap, WasmtimeError
+
     with LOCK:
         runtime = load()
         try:

{spawnllm-0.17.0 → spawnllm-0.17.2}/spawnllm/backends/base.py

@@ -500,14 +500,17 @@ class CliBackend(LlmBackend):
         return Response(spec=spec, output=Output(""), error=Error(msg, TimeoutError(msg)))
 
     async def aexecute(self, spec: RunSpec) -> Response:
-        inv = self.invocation(spec)
+        return await self.aexecute_invocation(spec, self.invocation(spec), self.env(spec))
+
+    async def aexecute_invocation(self, spec: RunSpec, inv: Invocation, env: dict[str, str]) -> Response:
+        """Run a materialized `inv` asynchronously under `env` and resolve it, removing its temp files."""
         try:
             try:
                 rr = await acapture_cli(
                     inv.argv,
                     input=inv.stdin,
                     env={key: value for key, value in os.environ.items() if key not in inv.env_unset}
-                    | self.env(spec)
+                    | env
                     | (spec.env or {}),
                     cwd=spec.cwd,
                     timeout=spec.timeout,
@@ -522,14 +525,17 @@ class CliBackend(LlmBackend):
         return self.to_response(raw, returncode=rr.returncode, stderr=rr.stderr, spec=spec)
 
     def execute(self, spec: RunSpec) -> Response:
-        inv = self.invocation(spec)
+        return self.execute_invocation(spec, self.invocation(spec), self.env(spec))
+
+    def execute_invocation(self, spec: RunSpec, inv: Invocation, env: dict[str, str]) -> Response:
+        """Run a materialized `inv` under `env` and resolve it, removing its temp files."""
         try:
             try:
                 rr = capture_cli(
                     inv.argv,
                     input=inv.stdin,
                     env={key: value for key, value in os.environ.items() if key not in inv.env_unset}
-                    | self.env(spec)
+                    | env
                     | (spec.env or {}),
                     cwd=spec.cwd,
                     timeout=spec.timeout,

{spawnllm-0.17.0 → spawnllm-0.17.2}/spawnllm/backends/claude.py

@@ -15,6 +15,8 @@ from spawnllm import _core
 from spawnllm.backends.base import ClaudeIsolation, CliBackend
 
 if TYPE_CHECKING:
+    from spawnllm.response import Response
+    from spawnllm.spec import RunSpec
     from spawnllm.types import ProviderName, TModel
 
 CLAUDE_MODELS: dict[TModel, str] = {"small": "haiku", "medium": "sonnet", "large": "opus"}
@@ -64,6 +66,7 @@ class ClaudeCliBackend(CliBackend):
 
     _isolated_config_dir: str | None = None
     _api_config_dir: str | None = None
+    _rejected_tokens: frozenset[str] = frozenset()
 
     def claude_isolation(self, api_auth: bool) -> ClaudeIsolation:
         """Return the isolation for one run: the process-lifetime config home and the env resolved now.
@@ -71,13 +74,14 @@ class ClaudeCliBackend(CliBackend):
         The core's `claude_isolation_sources` op resolves the account pointer,
         credentials file, and Keychain service from the caller's effective config
         home, naming no credential source when the process already carries
-        `CLAUDE_CODE_OAUTH_TOKEN`; this host reads those sources (falling back to
-        the Keychain when the credentials file is absent) and hands them to
-        `claude_isolation_seed` for the exact files-and-modes to write and the env
-        to set. The files land in a fresh temp dir removed at interpreter exit,
-        created on the first call and cached on the backend; the env is resolved
-        on every call so a renewed Keychain token reaches the next run, and it
-        only ever lives in memory. An `api_auth` run names no source at all, so it
+        `CLAUDE_CODE_OAUTH_TOKEN`; this host reads those sources (the Keychain
+        before the credentials file, the order Claude Code itself reads them) and
+        hands them, with every token a run saw rejected, to `claude_isolation_seed`
+        for the exact files-and-modes to write and the env to set. The files land
+        in a fresh temp dir removed at interpreter exit, created on the first
+        call and cached on the backend; the env is resolved on every call so a
+        renewed Keychain token reaches the next run, and it only ever lives in
+        memory. An `api_auth` run names no source at all, so it
         reads no account, credentials file, or Keychain item and gets an empty home
         of its own.
         """
@@ -96,11 +100,21 @@ class ClaudeCliBackend(CliBackend):
             },
         )
         account_json = read_file_opt(sources["account_path"]) if sources["account_path"] else None
-        credentials_json = read_file_opt(sources["credentials_path"]) if sources["credentials_path"] else None
-        if credentials_json is None and sources["keychain_service"] is not None:
-            credentials_json = keychain_credentials(sources["keychain_service"])
+        credentials_json = [
+            credentials
+            for credentials in (
+                keychain_credentials(sources["keychain_service"]) if sources["keychain_service"] else None,
+                read_file_opt(sources["credentials_path"]) if sources["credentials_path"] else None,
+            )
+            if credentials is not None
+        ]
         seed = _core.dispatch(
-            "claude_isolation_seed", {"account_json": account_json, "credentials_json": credentials_json}
+            "claude_isolation_seed",
+            {
+                "account_json": account_json,
+                "credentials_json": credentials_json,
+                "rejected_tokens": sorted(self._rejected_tokens),
+            },
         )
         cached = self._api_config_dir if api_auth else self._isolated_config_dir
         if cached is None:
@@ -116,3 +130,33 @@ class ClaudeCliBackend(CliBackend):
             else:
                 self._isolated_config_dir = cached
         return ClaudeIsolation(cached, seed["env"])
+
+    def reject_credentials(self, spec: RunSpec, env: dict[str, str], response: Response) -> bool:
+        """Record the OAuth token in a run's `env` as rejected when the core reads `response` as an auth failure.
+
+        Returns:
+            `True` when another credential source remains to retry the run with.
+        """
+        token = env.get("CLAUDE_CODE_OAUTH_TOKEN")
+        if token is None or response.error is None:
+            return False
+        if not _core.dispatch("claude_auth_rejected", {"error_msg": response.error.msg})["rejected"]:
+            return False
+        self._rejected_tokens |= {token}
+        return self.claude_isolation(spec.api_auth).env.get("CLAUDE_CODE_OAUTH_TOKEN") not in self._rejected_tokens
+
+    async def aexecute(self, spec: RunSpec) -> Response:
+        env = self.env(spec)
+        response = await self.aexecute_invocation(spec, self.invocation(spec), env)
+        while self.reject_credentials(spec, env, response):
+            env = self.env(spec)
+            response = await self.aexecute_invocation(spec, self.invocation(spec), env)
+        return response
+
+    def execute(self, spec: RunSpec) -> Response:
+        env = self.env(spec)
+        response = self.execute_invocation(spec, self.invocation(spec), env)
+        while self.reject_credentials(spec, env, response):
+            env = self.env(spec)
+            response = self.execute_invocation(spec, self.invocation(spec), env)
+        return response