Metadata-Version: 2.4
Name: everyframe-cli
Version: 0.5.0
Summary: Everyframe miner CLI — approved Phala TEE deployment and operations
Author: Everyframe
Project-URL: Homepage, https://subnet.everyframe.studio
Project-URL: Documentation, https://docs.everyframe.studio/mining/
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Operating System :: POSIX
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Topic :: System :: Systems Administration
Requires-Python: >=3.10
Description-Content-Type: text/markdown
Requires-Dist: cryptography<51,>=44
Requires-Dist: certifi>=2024.7.4
Requires-Dist: python-dotenv<2,>=1.0

# Everyframe CLI for Python

Operate an approved Everyframe miner with `everycli`. Native Python: **no Node.js,
GPU, Bittensor SDK, seed phrase, or wallet private key required by this CLI**.

## Install

Requires **Python 3.10+**, Linux/macOS, or WSL using its Linux filesystem.

```sh
pip install everyframe-cli
everycli --version
everycli --help
```

For an OS-managed Python installation, use `pipx install everyframe-cli` or a
virtual environment instead of `sudo pip` or `--break-system-packages`:

```sh
python3 -m venv .venv
. .venv/bin/activate
python -m pip install everyframe-cli
```

Also available as `everyframe-cli` and `python -m everyframe_cli`. If an older
Node installation shadows `everycli` in your PATH, use either alternative or the
virtual environment's `everycli`. Python and Node versions are separate releases;
installing this package does not update/remove a global npm installation.

## Mainnet by default

Mainnet **SN117** is the default. Testnet **SN566** requires `--network testnet`
on **each command**. Profiles are intentionally isolated:

| Network | Default profile |
| --- | --- |
| Mainnet 117 | `~/.config/everycli-mainnet117` |
| Testnet 566 | `~/.config/everycli` (or `EVERYCLI_DIR`) |

`--state-dir` selects a dedicated profile explicitly. Mainnet ignores the legacy
testnet `EVERYCLI_DIR`. Existing Node 0.4.1 signed invitations, JSON state and
operation locks are compatible. Never copy a testnet profile into mainnet, run
concurrent operations on one profile, or remove an interrupted-operation lock
without checking its PID and deployment journal with the operator.

## Enrollment and setup

The operator must verify your hotkey ownership/registration on the chosen subnet,
approve models, and issue a signed invitation. Mainnet availability is controlled
by the operator; installing this package does not activate routing or TEE admission.
Wallet creation/registration are handled separately; this CLI never signs a chain
transaction or purchases stake.

Prepare an owner-only credentials file (`chmod 600 miner.env`):

```dotenv
MINER_TOKEN=operator-issued-miner-token
PHALA_CLOUD_API_KEY=your-phala-cloud-key
FAL_KEY=your-fal-key
DSTACK_DOCKER_USERNAME=your-scoped-ghcr-account
DSTACK_DOCKER_PASSWORD=your-read-only-registry-token
```

No credentials should be passed on the command line or committed to source control.
At least one provider key must be allowed by the signed release. Other supported
keys: `MINIMAX_API_KEY`, `OPENROUTER_API_KEY`, `BFL_API_KEY`,
`REPLICATE_API_TOKEN`, `GEMINI_API_KEY`, `RUNWAYML_API_SECRET`, `LUMA_API_KEY`,
`ELEVENLABS_API_KEY`. Extra keys are never sent to an unapproved release. The GHCR
username can be any account with scoped read access; when omitted it defaults to
the namespace in the operator-signed image. Do not use a broad write-enabled token.

```sh
everycli miner init --invitation invitation.json --secrets-file miner.env
everycli miner doctor
everycli miner providers
# Example compute limit; choose your own after reviewing current hosting costs.
everycli miner deploy --max-hourly-usd 0.06
everycli miner status
# Wait for independent operator approval of this exact TEE workload.
everycli miner activate
# Wait for a fresh post-restart attestation.
everycli miner resume
everycli miner offers
everycli miner offer --model EXACT_APPROVED_CONTRACT_ID --discount-pct 5
everycli miner earnings
everycli miner stop
everycli miner reconcile
```

Deploy/start/resume/activate/update/stop/offer display an explicit confirmation.
Automation must supply `--yes` after reviewing those warnings. Init and diagnostics
do not start cloud infrastructure or submit paid generations.

## Costs and safety

- Phala hosting and provider API usage cost real money on **both networks**.
  `--max-hourly-usd` limits the quoted compute rate, **not total spend**. Storage
  costs extra. There is no automatic shutdown or overall budget cap.
- Discounts lower the miner reward target, **not the provider's invoice**.
  Offers do not guarantee eligibility, traffic, profit or wallet payouts.
- Provider keys remain disabled during bootstrap until the exact workload has
  fresh accepted TEE admission. Updated releases require admission again.
- The CLI verifies coordinator signatures, freshness, nonce, miner identity,
  network/genesis, digest-pinned release, app/OS/compose and KMS key bindings.
- Cloud and coordinator requests use fixed HTTPS origins, verified certificates,
  public DNS destinations, bounded responses, no proxy inheritance, no redirects,
  and **no automatic retries**. Secrets/errors are not dumped into diagnostics.
- A durable intent is written before cloud mutations. If a request times out,
  run `status` and `reconcile`; never deploy a replacement or blindly repeat it.
  Uncertain secret injection requires operator reconciliation. Reconcile only
  observes cloud state and updates the local journal.
- `stop --drain-only` blocks new work but leaves hosting running. `stop` waits for
  active work and requests shutdown without deletion. Storage may still be billed.

`--json` gives machine-readable results. Exit codes: `0` success, `1` rejected or
failed operation, `2` unhealthy diagnostics or unresolved reconciliation.

## Development

```sh
python -m pip install -e . pytest build twine
pytest
python -m build
python -m twine check dist/*
```

Tests cover signatures, Node interoperability, encrypted environments, fixed API
paths, profile isolation, permissions, locks, bids, lifecycle ordering, crash
ambiguity and CLI redaction. Tests never provision a paid VM or submit a generation.

[Mining documentation](https://docs.everyframe.studio/mining/) ·
[Subnet dashboard](https://subnet.everyframe.studio)
