blitz-cli 0.16.1__tar.gz → 0.17.0__tar.gz

blitz_cli-0.17.0/.claude/settings.json

@@ -0,0 +1,41 @@
+{
+  "permissions": {
+    "ask": [
+      "Bash(aws secretsmanager:*)",
+      "Bash(blitz secrets:*)",
+      "Bash(python -m blitz_cli.cli secrets:*)",
+      "Bash(python3 -m blitz_cli.cli secrets:*)"
+    ]
+  },
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "cmd=$(jq -r '.tool_input.command // \"\"'); if printf '%s' \"$cmd\" | grep -qiE 'secretsmanager|blitz +secrets|blitz_cli\\.cli +secrets'; then printf '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"ask\",\"permissionDecisionReason\":\"Command accesses AWS Secrets Manager \u2014 confirm before running.\"}}'; fi"
+          }
+        ]
+      },
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "cmd=$(jq -r '.tool_input.command // \"\"')\nprintf '%s' \"$cmd\" | grep -qE '(^|[^[:alnum:]_-])git([^[:alnum:]_-]|$)' || exit 0\nis_commit=$(printf '%s' \"$cmd\" | grep -qE 'git[^|;&]*\\bcommit\\b' && echo 1)\nis_push=$(printf '%s' \"$cmd\" | grep -qE 'git[^|;&]*\\bpush\\b' && echo 1)\n[ -z \"$is_commit$is_push\" ] && exit 0\ndir=$(printf '%s' \"$cmd\" | grep -oE 'cd +[^&|;]+' | tail -1 | sed -E 's/^cd +//; s/ +$//; s/^[\"'\"'\"']//; s/[\"'\"'\"']$//')\n[ -z \"$dir\" ] && dir=\".\"\nbranch=$(git -C \"$dir\" rev-parse --abbrev-ref HEAD 2>/dev/null)\nask=\"\"\n[ -n \"$is_push\" ] && printf '%s' \"$cmd\" | grep -qE '\\bpush\\b[^|;]*(\\b|:)(main|master)\\b' && ask=1\ncase \"$branch\" in main|master) [ -n \"$is_commit$is_push\" ] && ask=1 ;; esac\n[ -n \"$ask\" ] && printf '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"ask\",\"permissionDecisionReason\":\"This commits or pushes to main/master \u2014 confirm.\"}}'\nexit 0"
+          }
+        ]
+      },
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "cmd=$(jq -r '.tool_input.command // \"\"')\nprintf '%s' \"$cmd\" | grep -qi docker || exit 0\nask=\"\"\nprintf '%s' \"$cmd\" | grep -qE 'compose[^|;&]*\\bdown\\b' && printf '%s' \"$cmd\" | grep -qwE '\\-v|--volumes' && ask=1\nprintf '%s' \"$cmd\" | grep -qE '\\bvolume\\b[^|;&]*\\b(rm|prune)\\b' && ask=1\nprintf '%s' \"$cmd\" | grep -qE '\\bsystem\\b[^|;&]*\\bprune\\b' && printf '%s' \"$cmd\" | grep -qwE '\\-a|--all|--volumes|-[a-zA-Z]*a' && ask=1\nprintf '%s' \"$cmd\" | grep -qE 'docker[^|;&]*(\\bpush\\b|--push)' && ask=1\nprintf '%s' \"$cmd\" | grep -qE 'docker([- ]compose)?[[:space:]]+(container[[:space:]]+)?rm([[:space:]]|$)' && printf '%s' \"$cmd\" | grep -qwE '\\-f|--force' && ask=1\nprintf '%s' \"$cmd\" | grep -qE 'docker[[:space:]]+(rmi([[:space:]]|$)|image[[:space:]]+rm([[:space:]]|$))' && ask=1\nprintf '%s' \"$cmd\" | grep -qE 'docker([- ]compose)?[[:space:]]+(container[[:space:]]+)?kill([[:space:]]|$)' && ask=1\n[ -n \"$ask\" ] && printf '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"ask\",\"permissionDecisionReason\":\"Destructive Docker action (volume/data loss, container/image removal, kill, or registry push) \u2014 confirm.\"}}'\nexit 0"
+          }
+        ]
+      }
+    ]
+  }
+}

{blitz_cli-0.16.1 → blitz_cli-0.17.0}/.gitignore

@@ -6,8 +6,9 @@ dist/
 .venv/
 .pytest_cache/
 
-# stray test artifacts from running the CLI in-repo
-/.claude/
+# stray test artifacts from running the CLI in-repo, but keep committed settings
+/.claude/*
+!/.claude/settings.json
 
 # The .blitz/ working area is governed content, not an artifact: memory/ holds
 # the repo's playbook (seeded once, never overwritten even by `init --force`),

{blitz_cli-0.16.1 → blitz_cli-0.17.0}/PKG-INFO

@@ -1,11 +1,15 @@
 Metadata-Version: 2.4
 Name: blitz-cli
-Version: 0.16.1
+Version: 0.17.0
 Summary: Developer CLI for Blitz locker-room: spec-driven playbooks, a codebase/huddle ontology graph with an MCP tool, and the composable watcher/trainer/graph containers.
 License: MIT
 License-File: LICENSE
 Requires-Python: >=3.9
 Requires-Dist: rich>=13
+Provides-Extra: secrets
+Requires-Dist: boto3>=1.34; extra == 'secrets'
+Provides-Extra: toml
+Requires-Dist: tomli>=2.0; (python_version < '3.11') and extra == 'toml'
 Provides-Extra: train
 Requires-Dist: accelerate==1.2.1; extra == 'train'
 Requires-Dist: datasets==3.2.0; extra == 'train'

blitz_cli-0.17.0/blitz_cli/_secrets.py

@@ -0,0 +1,182 @@
+"""AWS Secrets Manager <-> env-file sync.
+
+Each service keeps its config as a single JSON blob (one secret per service,
+e.g. `spareparts-api/env`), whose keys are env var names. ECS reads those keys
+directly via the task definition; this module is for the paths ECS doesn't
+cover -- editing the blob and pulling it down.
+
+boto3 is the optional [secrets] extra: the core CLI is stdlib + rich, so the
+import lives inside `_client()` and surfaces `_MISSING` rather than a traceback.
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Dict, Iterable, Optional
+
+_MISSING = (
+    "`blitz secrets` needs the AWS SDK.\n"
+    "Install it with:  pip install 'blitz-cli[secrets]'"
+)
+
+
+class SecretsError(Exception):
+    """A caller-facing failure: bad credentials, missing secret, malformed blob."""
+
+
+def _client(region: str):
+    try:
+        import boto3
+    except ImportError:
+        raise SecretsError(_MISSING)
+    return boto3.client("secretsmanager", region_name=region)
+
+
+def _fetch(client, secret_id: str) -> Dict[str, str]:
+    """Read `secret_id`'s JSON blob. Raises SecretsError unless absent (caller decides)."""
+    try:
+        response = client.get_secret_value(SecretId=secret_id)
+    except client.exceptions.ResourceNotFoundException:
+        raise
+    except Exception as err:
+        raise SecretsError(f"could not read {secret_id}: {err}")
+
+    body = response.get("SecretString")
+    if not body:
+        raise SecretsError(f"{secret_id} has no SecretString (binary secrets unsupported)")
+
+    try:
+        parsed = json.loads(body)
+    except json.JSONDecodeError:
+        raise SecretsError(f"{secret_id} is not JSON -- expected a flat object of env keys")
+
+    if not isinstance(parsed, dict):
+        raise SecretsError(f"{secret_id} is not a JSON object -- expected a flat object of env keys")
+
+    return {key: "" if value is None else str(value) for key, value in parsed.items()}
+
+
+def pull(secret_id: str, region: str, exclude: Optional[Iterable[str]] = None) -> Dict[str, str]:
+    """Fetch the blob, dropping any `exclude` keys."""
+    client = _client(region)
+    try:
+        values = _fetch(client, secret_id)
+    except client.exceptions.ResourceNotFoundException:
+        raise SecretsError(f"secret not found: {secret_id}")
+
+    skip = set(exclude or ())
+    return {key: value for key, value in values.items() if key not in skip}
+
+
+def push(
+    secret_id: str,
+    values: Dict[str, str],
+    region: str,
+    merge: bool = True,
+    create: bool = False,
+) -> Dict[str, int]:
+    """Write `values` to the blob.
+
+    Merging is the default and matters: a local env file is rarely a superset of
+    the blob. Replacing wholesale drops any key the file lacks, and ECS refuses
+    to start a task whose definition references a missing key -- so the damage
+    would surface at the next deploy, not here.
+    """
+    client = _client(region)
+
+    remote: Dict[str, str] = {}
+    exists = True
+    try:
+        remote = _fetch(client, secret_id)
+    except client.exceptions.ResourceNotFoundException:
+        exists = False
+
+    if not exists:
+        if not create:
+            raise SecretsError(f"secret not found: {secret_id} (pass --create to create it)")
+        payload = dict(values)
+    elif merge:
+        payload = {**remote, **values}
+    else:
+        payload = dict(values)
+
+    body = json.dumps(payload)
+    try:
+        if exists:
+            client.update_secret(SecretId=secret_id, SecretString=body)
+        else:
+            client.create_secret(
+                Name=secret_id,
+                SecretString=body,
+                Description="Created by blitz secrets push",
+            )
+    except Exception as err:
+        raise SecretsError(f"could not write {secret_id}: {err}")
+
+    return {
+        "written": len(payload),
+        "added": len(set(payload) - set(remote)),
+        "removed": len(set(remote) - set(payload)),
+    }
+
+
+def parse_env(path: Path) -> Dict[str, str]:
+    """Parse a KEY=VALUE env file.
+
+    Deliberately stdlib rather than python-dotenv -- this is the whole grammar we
+    need: `export ` prefixes, `#` comments, and optional surrounding quotes. A
+    value is only unquoted when the quotes wrap it entirely, so `pass#word` and
+    `a"b` survive intact.
+    """
+    if not path.exists():
+        raise SecretsError(f"file not found: {path}")
+
+    values: Dict[str, str] = {}
+    for lineno, raw in enumerate(path.read_text().splitlines(), start=1):
+        line = raw.strip()
+        if not line or line.startswith("#"):
+            continue
+        if line.startswith("export "):
+            line = line[len("export "):].lstrip()
+
+        key, sep, value = line.partition("=")
+        if not sep:
+            raise SecretsError(f"{path}:{lineno}: expected KEY=VALUE, got {raw!r}")
+
+        key = key.strip()
+        if not key:
+            raise SecretsError(f"{path}:{lineno}: empty key")
+
+        value = value.strip()
+        if len(value) >= 2 and value[0] == value[-1] and value[0] in ("'", '"'):
+            quote = value[0]
+            value = value[1:-1]
+            if quote == "'":
+                # Undo write_env's shell-style escape: a single-quoted string
+                # can't contain a quote, so one is spliced in as '\''.
+                value = value.replace("'\\''", "'")
+        else:
+            # Only strip comments off bare values; a quoted value may contain '#'.
+            marker = value.find(" #")
+            if marker != -1:
+                value = value[:marker].rstrip()
+
+        values[key] = value
+
+    return values
+
+
+def write_env(values: Dict[str, str], path: Path, prepend: str = "") -> None:
+    """Write KEY='VALUE' lines, sorted.
+
+    Every value is single-quoted: unquoted values break docker compose's env_file
+    parsing the moment one contains a '#' or a space. Embedded single quotes are
+    escaped shell-style, so the output is safe to `source` as well.
+    """
+    lines = []
+    for key in sorted(values):
+        escaped = str(values[key]).replace("'", "'\\''")
+        lines.append(f"{prepend}{key}='{escaped}'")
+
+    path.write_text("\n".join(lines) + "\n" if lines else "")