add llm clis to postbuild, jupyter-ai to environment

[minrk]

No description provided.

[github-actions]

👈 Test this PR on Binder

[minrk]

/conda-lock

[tsnow03]

@cboettig @mfisher87 Is there anything additional we should change for integrating AI/jupyter-ai so that we can easily use claude and opencode within the CryoCloud image?

[mfisher87]

This looks like it has all the prereqs! One thing I'm wondering about is credentials. When going through the e.g. Claude login process, I believe a token gets saved in the home directory, which I'm not super comfortable with. I'm not sure how we can improve on that though.

I'm not sure how comfortable @cboettig feels with deploying this at the moment, but jupyter-sidekick is an alternative to JupyterAI that is not multiplayer and provides a more traditional UX.

[cboettig]

happy to sidekick be deployed, issues welcome. (hopeful it will be replaced by the next jupyter-ai iteration though still)

[tsnow03]

I don't think we want to teach one thing and then switch again if we are pretty certain we are going to switch from the get-go. I wasn't aware of sidekick before though. We will want to think more about the Claude credentials, though (and ChatGPT/Gemini/Antigravity, which I think will also need to be added and I haven't touched yet). Linking in @yuvipanda and @agoose77 for more ideas.

[agoose77]

I will have a think about secret storage. The short answer is that we don't presently have a nice way to store user secrets. In the long run, perhaps there's scope for OIDC to use JupyterHub logins as an auth provider for Claude. But, that's not realistic near-term.

I think what we could do is to map the Claude etc. persistent token paths to a temporary directory that is wiped after each pod exits. This would require users to log in each time, but avoids the risk of persisting credentials.

[tsnow03]

@itcarroll I'm getting this error in the test. In this new repo, am I getting the wrong APP_TOKEN_KEY or missing something else? I assume ghcr.io is in your realm.
[auth] cryointhecloud/cryo-python-ai-cache:pull,push token for ghcr.io
ERROR: failed to build: failed to solve: error writing layer blob: denied: installation not allowed to Write organization package

[itcarroll]

We use the GITHUB_TOKEN for writing the docker registry cache into ghcr.io. Since this PR is from a fork, it might not be able to get permission to write to the registry cache. The workflow passed in the recent dependapot PR (#3), because it's not from a fork.

Using the cache is a speed boost, it could be disabled for PRs from a fork without defeating the purpose of the test. This level of GitHub Actions permissions is in "the deep end" as my understanding of it goes. Not aware of a quick fix, other than merging without the check passing.

[tsnow03]

Gotcha. Thanks @itcarroll! I fixed it with a little help from Claude.