urun-cli 0.7.1__tar.gz → 0.7.2__tar.gz

{urun_cli-0.7.1 → urun_cli-0.7.2}/CHANGELOG.md

@@ -1,3 +1,10 @@
+## 0.7.2
+
+- Fix the generated serve shim: the `--warm N` pin assigns `URUN_SERVE_WARM`
+  as a STRING. The 0.7.1 shim assigned an int literal, which raises
+  `TypeError: str expected, not int` at `os.encode` inside any build/import —
+  the exact first-build failure the agents-a1-fp8 shared deploy hit.
+
 ## 0.7.1
 
 - `urun serve --warm N` — an idle replica floor on a serve deploy (the

{urun_cli-0.7.1 → urun_cli-0.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: urun-cli
-Version: 0.7.1
+Version: 0.7.2
 Summary: End-user CLI for deploying apps to urun
 Project-URL: Homepage, https://urun.sh
 Project-URL: Repository, https://github.com/urun-sh/urun-cli

{urun_cli-0.7.1 → urun_cli-0.7.2}/pyproject.toml

@@ -20,7 +20,7 @@ name = "urun-cli"
 # so every merge remains on the already-published version until this value is
 # advanced. Wiring semantic-release into CI remains separate work; this patch
 # bump is the minimal release unblock (post-v0.6.3 fixes + the Rust feature minor).
-version = "0.7.1"
+version = "0.7.2"
 description = "End-user CLI for deploying apps to urun"
 readme = "README.md"
 requires-python = ">=3.11"

{urun_cli-0.7.1 → urun_cli-0.7.2}/src/urun/cli.py

@@ -2965,6 +2965,17 @@ def _run_demo_frontend(
     )
     if launch.token_expires_at:
         print(f"Browser token expires: {launch.token_expires_at}")
+    if launch.principal_actor_id:
+        print(
+            f"Browser token identity: bound to your API key's principal "
+            f"(actor {launch.principal_actor_id}) — this session can re-attach "
+            "across `urun dev --attach` runs for this app"
+        )
+    else:
+        print(
+            "Browser token identity: a fresh per-invocation identity (this API "
+            "key has no resolvable principal)"
+        )
     print(
         f"Token endpoint: {launch.token_url} (re-mints silently; a re-mint gates NEW "
         "session starts only — live sessions keep running)"

{urun_cli-0.7.1 → urun_cli-0.7.2}/src/urun/client_tokens.py

@@ -158,7 +158,8 @@ def build_client_token_request(
     allowed_functions: list[str],
     allowed_origins: list[str] | None,
     max_session_s: int | None,
-    subject: str,
+    subject: str | None = None,
+    bind_principal: bool = False,
     dev: bool = False,
     metadata: dict[str, Any] | None = None,
 ) -> dict[str, Any]:
@@ -175,6 +176,15 @@ def build_client_token_request(
     the browser can never ask to be resolved. Omitted entirely when false,
     like every other optional field here: every non-dev mint
     send a body that does not mention dev mode at all.
+
+    ``bind_principal`` (ENG-297) asks the server to derive the subject
+    itself from the API key's creator (``client-user:<principalActorId>``)
+    instead of accepting one from the caller — mutually exclusive with
+    ``subject`` (the server 400s if both are sent; this mirrors that
+    locally, same convention as every other bound here). Omit both to keep
+    minting an unscoped ad-hoc subject the old way (nothing in this CLI
+    does that anymore, but the parameter combination stays legal for direct
+    callers/tests).
     """
     if not isinstance(expires_in, int) or isinstance(expires_in, bool):
         raise UrunError("client token expires_in must be an integer")
@@ -214,7 +224,14 @@ def build_client_token_request(
         not isinstance(max_session_s, int) or isinstance(max_session_s, bool) or max_session_s < 1
     ):
         raise UrunError("client token max_session_s must be a positive integer")
-    if not subject or len(subject) > CLIENT_TOKEN_MAX_SUBJECT_LENGTH:
+    if not isinstance(bind_principal, bool):
+        raise UrunError("client token bind_principal must be a boolean")
+    if bind_principal and subject is not None:
+        raise UrunError(
+            "client token bind_principal and subject are mutually exclusive — "
+            "bind_principal derives the subject server-side"
+        )
+    if not bind_principal and (not subject or len(subject) > CLIENT_TOKEN_MAX_SUBJECT_LENGTH):
         raise UrunError(
             f"client token subject must be 1..{CLIENT_TOKEN_MAX_SUBJECT_LENGTH} characters"
         )
@@ -227,8 +244,11 @@ def build_client_token_request(
     body: dict[str, Any] = {
         "expires_in": expires_in,
         "allowed_functions": list(allowed_functions),
-        "subject": subject,
     }
+    if subject is not None:
+        body["subject"] = subject
+    if bind_principal:
+        body["bind_principal"] = True
     if allowed_origins is not None:
         body["allowed_origins"] = list(allowed_origins)
     if max_session_s is not None:
@@ -245,6 +265,10 @@ class MintedToken:
     token: str
     expires_at: str
     org_id: str
+    # ENG-297: the claim-verified principal actor id, present only when the
+    # mint asked for bind_principal and it was resolved server-side. Absence
+    # is the normal unbound case, never an error.
+    principal_actor_id: str | None = None
 
 
 class ClientTokenMinter:
@@ -294,14 +318,55 @@ class ClientTokenMinter:
                         "client-token response did not include a positive integer expires_in"
                     )
                 expires_at = payload.get("expires_at")
+                principal_actor_id = payload.get("principal_actor_id")
+                # A bind_principal request answered with a PRESENT but
+                # malformed principal_actor_id (empty string, wrong type) is a
+                # server contract violation, not "unbound" — silently
+                # coercing it to None would make the CLI print "no resolvable
+                # principal" for a session the server actually DID bind,
+                # masking a bug instead of failing loud like every other
+                # contract check above. An ABSENT key is different: it is the
+                # expected shape from a pre-ENG-297 server that doesn't know
+                # the field at all (ignores bind_principal, mints with its own
+                # random subject) — the accepted deploy-lag scenario, not a
+                # bug — so it degrades to the unbound case exactly as before.
+                if (
+                    self._body.get("bind_principal") is True
+                    and "principal_actor_id" in payload
+                    and (not isinstance(principal_actor_id, str) or not principal_actor_id)
+                ):
+                    raise UrunError(
+                        "client-token response requested bind_principal but included a "
+                        "malformed principal_actor_id"
+                    )
                 self._minted = MintedToken(
                     token=token,
                     expires_at=expires_at if isinstance(expires_at, str) else "",
                     org_id=org_id,
+                    principal_actor_id=(
+                        principal_actor_id if isinstance(principal_actor_id, str) else None
+                    ),
                 )
                 self._remint_at = now + max(expires_in - self._skew, 1)
             return self._minted
 
+    def replace_body(self, body: dict[str, Any]) -> None:
+        """Swap the mint body for THIS minter's remaining life — every future
+        (re-)mint uses it, not just the next one.
+
+        The ONLY caller is launch_auth.py's bind_principal fallback: the
+        first mint discovers this API key has no resolvable principal, so
+        every mint for the rest of this process must use the legacy nonce
+        subject instead — never retry bind_principal again for this launch.
+        Forces an immediate re-mint (clears the cached token) so the swap
+        takes effect on the very next :meth:`current`, not after some stale
+        remint-skew window.
+        """
+        with self._lock:
+            self._body = body
+            self._minted = None
+            self._remint_at = 0.0
+
 
 class _TokenRequestHandler(BaseHTTPRequestHandler):
     """Serve scoped tokens and browser diagnostics for a local demo.

{urun_cli-0.7.1 → urun_cli-0.7.2}/src/urun/dev.py

@@ -1442,6 +1442,20 @@ def _maybe_launch_frontend(
         "origins: unrestricted (dev only); "
         f"max session: {f'{launch.max_session_s}s' if launch.max_session_s else 'uncapped (ends with the CLI)'})",
     )
+    mux.line(
+        "frontend | ",
+        (
+            f"browser token identity: bound to this API key's principal "
+            f"(actor {launch.principal_actor_id}) — this session can re-attach "
+            "across `urun dev` runs for this app"
+        )
+        if launch.principal_actor_id
+        else (
+            "browser token identity: a fresh per-invocation identity (this API "
+            "key has no resolvable principal — sessions will not re-attach "
+            "across runs; see the warning above)"
+        ),
+    )
     # Say the quiet part out loud: the scope above names the BASE app while the
     # dev loop deploys to `<app>--dev`, which reads like a mismatch to anyone
     # watching. It is the contract — the page asks for the base name and the

{urun_cli-0.7.1 → urun_cli-0.7.2}/src/urun/launch_auth.py

@@ -18,6 +18,7 @@ from __future__ import annotations
 
 import re
 import secrets
+import sys
 import urllib.parse
 from collections.abc import Callable, Sequence
 from dataclasses import dataclass, field
@@ -46,12 +47,16 @@ EVENTS_URL_ENV = "NEXT_PUBLIC_URUN_EVENTS_URL"
 # identity as a pure hash of (v3, orgId, token subject, app, function,
 # concurrency key) — services/session-api-ts/src/logical-id.ts:86 — and the
 # SDK sends no explicit id when the app names no sessionKey
-# (urun-ts packages/core/src/app.ts:162). The mint subject below is fixed for
-# the whole invocation, so the CLI's session and the page it launches derive
-# the SAME id and the platform's attach-or-create binds them together. There
-# is deliberately NO session-key env var: the launcher has nothing to publish.
-# Limitation, stated not hidden: an app passing its OWN sessionKey derives a
-# different id and lands on the platform's coalesce path, not a clean attach.
+# (urun-ts packages/core/src/app.ts:162). The mint subject is fixed for the
+# whole invocation — and, for a principal-bound mint (the default, ENG-297),
+# fixed ACROSS invocations too — so the CLI's session and the page it
+# launches derive the SAME id and the platform's attach-or-create binds them
+# together; a principal-bound launch additionally reattaches a PRIOR run's
+# still-live session for the same actor and app, not just the one page in
+# this process. There is deliberately NO session-key env var: the launcher
+# has nothing to publish. Limitation, stated not hidden: an app passing its
+# OWN sessionKey derives a different id and lands on the platform's coalesce
+# path, not a clean attach.
 # Next.js's built-in dev port, used when a frontend's dev script names none.
 DEFAULT_FRONTEND_PORT = 3000
 # The loopback host `urun dev` binds its token endpoint and pins the browser
@@ -62,6 +67,14 @@ DEFAULT_LAUNCH_HOST = "127.0.0.1"
 # and fails loud — another launch path must be added HERE deliberately.
 _LAUNCH_COMMANDS = frozenset({"dev"})
 
+# ENG-297: the session API's structured error code for "bind_principal was
+# requested but this API key's creator has no resolvable principal" (a
+# legacy key minted before member API keys existed, or an admin-minted key
+# with no creator) — urun-infra services/session-api-ts's
+# handleClientTokenMint. A NAMED constant, not a literal, so the catch below
+# and its test pin ONE string — never message matching.
+PRINCIPAL_UNRESOLVABLE_CODE = "principal_not_available"
+
 
 def launch_auth_label(command: str) -> str:
     """Inert SDK-side auth-provider label (the session API ignores
@@ -160,7 +173,13 @@ def _display_session_url(url: str) -> str:
     return urllib.parse.urlunsplit((parts.scheme, netloc, parts.path, "", ""))
 
 
-def mint_launch_client_token(minter: Any, session_url: str, *, command: str | None = None) -> Any:
+def mint_launch_client_token(
+    minter: Any,
+    session_url: str,
+    *,
+    command: str | None = None,
+    legacy_body_factory: Callable[[], dict[str, Any]] | None = None,
+) -> Any:
     """Mint the launch's first scoped client token, failing with a clear story.
 
     The mint is the first request the launch sends to the SESSION API, and
@@ -172,6 +191,20 @@ def mint_launch_client_token(minter: Any, session_url: str, *, command: str | No
     (Owner ruling 2026-08-03: remedy first, keep it short, and never name
     internal deployment topology — a customer reading this has a support
     issue, and a urun developer knows which host to point the flag at.)
+
+    When ``legacy_body_factory`` is given (only
+    :func:`prepare_frontend_launch_auth` passes one, when the primary mint
+    requested ``bind_principal``), a mint that fails with the server's
+    structured "no resolvable principal" 400
+    (:data:`PRINCIPAL_UNRESOLVABLE_CODE`) is retried EXACTLY ONCE against a
+    freshly-built legacy body (the old per-invocation nonce subject) — this
+    API key has no resolvable principal (a legacy or admin-minted key), so
+    the launch falls back rather than hard-failing a command that used to
+    work. The minter's body is swapped IN PLACE
+    (:meth:`ClientTokenMinter.replace_body`), so every LATER silent re-mint
+    (the TokenEndpoint's) also uses the legacy subject — bind_principal is
+    never retried again for this process. A failure on the retry itself
+    propagates raw, exactly like any other mint failure.
     """
     try:
         return minter.current()
@@ -186,6 +219,20 @@ def mint_launch_client_token(minter: Any, session_url: str, *, command: str | No
                 f"The URL tried ({_display_session_url(session_url)}) does not "
                 "serve POST /api/client-tokens."
             ) from exc
+        if (
+            legacy_body_factory is not None
+            and exc.status == 400
+            and exc.code == PRINCIPAL_UNRESOLVABLE_CODE
+        ):
+            print(
+                "warning: this API key has no resolvable principal — the browser "
+                "session falls back to a fresh per-invocation identity (it will not "
+                "re-attach to a prior `urun dev` run for this app). Re-create the key "
+                "as a member API key to fix this.",
+                file=sys.stderr,
+            )
+            minter.replace_body(legacy_body_factory())
+            return minter.current()
         raise
 
 
@@ -279,6 +326,10 @@ class FrontendLaunchAuth:
     allowed_functions: list[str]
     allowed_origins: list[str]
     max_session_s: int | None
+    # ENG-297: the claim-verified principal this launch's token is bound to,
+    # or None when this API key had no resolvable principal (the legacy
+    # fallback fired — see mint_launch_client_token).
+    principal_actor_id: str | None
     endpoint: TokenEndpoint
     # The launch's token minter — the SessionHolder authenticates its HTTP
     # calls with the same silently-re-minting token the page refreshes from.
@@ -349,20 +400,48 @@ def prepare_frontend_launch_auth(
     # Dev frontends may be opened through any loopback hostname or port. The
     # session API treats an absent claim as unrestricted; demo remains pinned.
     token_allowed_origins = None if dev else endpoint_allowed_origins
+
+    # The DEFAULT (bind_principal=True) asks the platform to derive the
+    # subject itself from the API key's creator (`client-user:<principalActorId>`)
+    # — stable across BOTH re-mints AND invocations, so the same actor
+    # launching the same app twice reattaches the SAME session (ENG-297)
+    # instead of minting a fresh identity every process run. `_legacy_nonce_body`
+    # below is the ONLY fallback: an API key with no resolvable principal
+    # (legacy or admin-minted) still gets a working launch, just back to the
+    # old per-invocation nonce — stable across re-mints for THIS launch,
+    # unique per invocation, so two such launches never coalesce their
+    # sessions.
     mint_body = build_client_token_request(
         expires_in=DEMO_TOKEN_EXPIRES_IN_S,
         allowed_functions=allowed_functions,
         allowed_origins=token_allowed_origins,
         max_session_s=max_session_s,
-        # Stable across re-mints (same actor keeps gating new starts for THIS
-        # launch), unique per invocation (two launches never coalesce their
-        # sessions).
-        subject=f"{command}:{app_slug}:{secrets.token_hex(4)}",
+        bind_principal=True,
         dev=dev,
         metadata={"source": "urun-cli", "command": command, "app": app_slug},
     )
+
+    def _legacy_nonce_body() -> dict[str, Any]:
+        # Rebuilt lazily — only if bind_principal actually fails — from the
+        # SAME scope/dev/metadata as the bound attempt; only the subject
+        # strategy differs. A fresh secrets.token_hex(4) each call: this is
+        # only ever invoked once per process (the fallback retries exactly
+        # once), so "fresh" here still means "one nonce for the whole
+        # invocation" exactly as before.
+        return build_client_token_request(
+            expires_in=DEMO_TOKEN_EXPIRES_IN_S,
+            allowed_functions=allowed_functions,
+            allowed_origins=token_allowed_origins,
+            max_session_s=max_session_s,
+            subject=f"{command}:{app_slug}:{secrets.token_hex(4)}",
+            dev=dev,
+            metadata={"source": "urun-cli", "command": command, "app": app_slug},
+        )
+
     minter = ClientTokenMinter(create_client_token, mint_body)
-    minted = mint_launch_client_token(minter, session_url, command=command)
+    minted = mint_launch_client_token(
+        minter, session_url, command=command, legacy_body_factory=_legacy_nonce_body
+    )
     endpoint = TokenEndpoint(
         minter,
         endpoint_allowed_origins,
@@ -385,6 +464,7 @@ def prepare_frontend_launch_auth(
         allowed_functions=allowed_functions,
         allowed_origins=token_allowed_origins or [],
         max_session_s=max_session_s,
+        principal_actor_id=minted.principal_actor_id,
         endpoint=endpoint,
         minter=minter,
     )

{urun_cli-0.7.1 → urun_cli-0.7.2}/src/urun/serve.py

@@ -663,7 +663,7 @@ __all__ = ["app"]
 '''
     exo_env = render_exo_pin_env(exo_class, exo_image)
     warm_env = (
-        'os.environ["URUN_SERVE_WARM"] = ' + json.dumps(int(warm)) + "\n"
+        'os.environ["URUN_SERVE_WARM"] = ' + json.dumps(str(int(warm))) + "\n"
         if warm is not None
         else ""
     )