buildai-cli 0.3.149__tar.gz → 0.3.151__tar.gz

buildai_cli-0.3.151/AGENTS.md

@@ -0,0 +1,24 @@
+# Build AI CLI
+
+The installed CLI calls the API. The workspace CLI can also inspect the database.
+Keep those modes separate: installed clients must work without `core/` or database credentials.
+
+## Database commands
+
+- Database commands use a profile-specific `alloydb-auth-proxy` broker. Its state in
+  `~/.buildai/db-brokers` is shared across worktrees. Use `db broker status`,
+  `ensure`, or `stop` to manage it.
+- Select the database with `buildai db --env production|staging|dev`.
+  App targeting comes from environment variables and the Makefile, not a saved CLI context.
+- Staging needs an IAP, VPN, or SOCKS route. For the CLI tunnel, run
+  `buildai db --env staging tunnel`, then query with `--all-proxy socks5://127.0.0.1:1080`.
+- Before counting frame labels by status or mode, read the
+  [labeling query rule](../../../core/dal/labeling/AGENTS.md).
+  A pushed-down filter can produce incorrect totals.
+
+## Check your change
+
+Run the relevant tests in `tests/cli/` from the repo root. For broker changes,
+include `tests/cli/test_db_broker.py`; for query handling, include
+`tests/cli/test_db_query_analysis.py`. Live queries are needed only when the
+change depends on connection behavior.

{buildai_cli-0.3.149 → buildai_cli-0.3.151}/Dockerfile.rescaling-migration-jobs

@@ -20,6 +20,7 @@ WORKDIR /app
 # uv must see every workspace member declaration to honor the checked-in lockfile.
 COPY pyproject.toml uv.lock ./
 COPY core/pyproject.toml core/pyproject.toml
+COPY packages/egoexo/pyproject.toml packages/egoexo/pyproject.toml
 COPY services/pyproject.toml services/pyproject.toml
 COPY apps/buildai/buildai-api/pyproject.toml apps/buildai/buildai-api/pyproject.toml
 COPY apps/buildai/buildai-cli/pyproject.toml apps/buildai/buildai-cli/pyproject.toml

{buildai_cli-0.3.149 → buildai_cli-0.3.151}/Dockerfile.rescaling-migration-jobs.dockerignore

@@ -3,6 +3,9 @@
 !uv.lock
 !core/
 !core/pyproject.toml
+!packages/
+!packages/egoexo/
+!packages/egoexo/pyproject.toml
 !services/
 !services/pyproject.toml
 !apps/

{buildai_cli-0.3.149 → buildai_cli-0.3.151}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: buildai-cli
-Version: 0.3.149
+Version: 0.3.151
 Summary: Build AI CLI (Typer)
 Requires-Python: >=3.11
 Requires-Dist: google-crc32c>=1.7.1

{buildai_cli-0.3.149 → buildai_cli-0.3.151}/cli/commands/egoexo.py

@@ -10,10 +10,12 @@ import httpx
 import typer
 
 from cli.commands.api_proxy import _build_url
+from cli.commands.egoexo_config import app as config_app
 from cli.config import resolve_api_url, resolve_credential
 from cli.console import error
 
 app = typer.Typer(help="Inspect EgoExo verdict-plane outcomes.", no_args_is_help=True)
+app.add_typer(config_app, name="config")
 
 
 def _request(path: str, *, query_params: list[str] | None = None) -> None:

buildai_cli-0.3.151/cli/commands/egoexo_config.py

@@ -0,0 +1,557 @@
+"""Operator commands for the EgoExo runtime configuration store.
+
+The store is one JSON object in the capture bucket. The processing API reads it
+every thirty seconds and lets each stored field override the matching environment
+value. These commands read the object, show the effective configuration, and
+write new revisions. Every write needs ``--write --reason``. Reads never change
+anything.
+
+The commands need the workspace ``egoexo`` package and the Google Cloud Storage
+client, so run them from the repo with ``uv run buildai egoexo config ...``.
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+import tempfile
+from dataclasses import replace
+from pathlib import Path
+from typing import Any
+
+import typer
+
+from cli.console import error, info
+
+app = typer.Typer(
+    help="Show and change the EgoExo runtime configuration store.", no_args_is_help=True
+)
+
+DEPLOYMENT_RELATIVE = Path("infra/production/services/processing-api")
+LOCAL_JSON_MAX_BYTES = 1024 * 1024
+ASSET_PREFIX = "derived/runtime-assets/"
+
+URI_OPTION = typer.Option(
+    None,
+    "--uri",
+    envvar="EGOEXO_RUNTIME_CONFIG_URI",
+    help="Runtime config object. Default: the production object in gs://buildai-ego-exo.",
+)
+DEPLOYMENT_OPTION = typer.Option(
+    None,
+    "--deployment",
+    help=(
+        "Checked-in deployment directory whose egoexo-recipe.json and "
+        "egoexo-trusted-assets.json are the environment fallback shown for env fields. "
+        "Default: infra/production/services/processing-api when run inside the repo."
+    ),
+)
+WRITE_OPTION = typer.Option(False, "--write", help="Write the revision. Omit for a dry run.")
+REASON_OPTION = typer.Option(
+    None, "--reason", help="Why this revision exists. Required with --write."
+)
+
+
+def _runtime_config():
+    """Import the store module lazily so installed clients without it get a clear message."""
+    try:
+        from egoexo.runtime.pipeline import runtime_config
+    except ImportError as exc:
+        error(
+            "'buildai egoexo config' needs the workspace egoexo package and the GCS client.\n"
+            "  Run it from the repo: uv run buildai egoexo config ..."
+        )
+        raise typer.Exit(1) from exc
+    return runtime_config
+
+
+def _store(uri: str | None):
+    """Build a store on the real GCS adapter. Tests replace this function."""
+    rc = _runtime_config()
+    from egoexo.adapters.gcs.publication import GCSStorage
+
+    return rc.RuntimeConfigStore(uri or rc.DEFAULT_RUNTIME_CONFIG_URI, storage=GCSStorage())
+
+
+def _author() -> str:
+    """Return the active gcloud account. It is recorded as the revision author."""
+    from cli.auth_local import _gcloud_value
+
+    account = _gcloud_value("account")
+    if not account:
+        error(
+            "No active gcloud account. Run `gcloud auth login` first; the account is "
+            "recorded as the revision author."
+        )
+        raise typer.Exit(1)
+    return account
+
+
+def _deployment_dir(explicit: Path | None) -> Path | None:
+    """Return the checked-in deployment directory, or None when it is not available."""
+    if explicit is not None:
+        if not explicit.is_dir():
+            error(f"Deployment directory not found: {explicit}")
+            raise typer.Exit(1)
+        return explicit
+    for root in (Path.cwd(), *Path.cwd().parents):
+        candidate = root / DEPLOYMENT_RELATIVE
+        if (candidate / "egoexo-recipe.json").is_file():
+            return candidate
+    return None
+
+
+def _load_json_file(path: Path) -> Any:
+    """Read a bounded local JSON file."""
+    if not path.is_file():
+        error(f"File not found: {path}")
+        raise typer.Exit(1)
+    data = path.read_bytes()
+    if len(data) > LOCAL_JSON_MAX_BYTES:
+        error(f"{path} exceeds {LOCAL_JSON_MAX_BYTES} bytes")
+        raise typer.Exit(1)
+    try:
+        return json.loads(data)
+    except ValueError as exc:
+        error(f"{path} is not valid JSON: {exc}")
+        raise typer.Exit(1) from exc
+
+
+def _deployment_env(deployment: Path | None):
+    """Build the environment fallback from checked-in files. Flags stay unknown."""
+    rc = _runtime_config()
+    if deployment is None:
+        return rc.EnvironmentConfig(), None
+    recipe = deployment / "egoexo-recipe.json"
+    assets = deployment / "egoexo-trusted-assets.json"
+    return (
+        rc.EnvironmentConfig(
+            recipe_json=recipe.read_text() if recipe.is_file() else None,
+            trusted_assets_json=assets.read_text() if assets.is_file() else "[]",
+        ),
+        deployment,
+    )
+
+
+def _read_base(store):
+    """Read the current document once. Returns (document, generation, problem)."""
+    try:
+        document, generation = store.read()
+        return document, generation, None
+    except (ValueError, TypeError, KeyError) as exc:
+        generation = str(store.storage.metadata(store.uri)["generation"])
+        return None, generation, f"{type(exc).__name__}: {exc}"
+
+
+def _emit(payload: dict[str, Any]) -> None:
+    sys.stdout.write(json.dumps(payload, indent=2, default=str) + "\n")
+
+
+def _recipe_summary(recipe: dict[str, Any]) -> dict[str, Any]:
+    stages = {}
+    for stage, spec in sorted(recipe.get("preset", {}).items()):
+        entry: dict[str, Any] = {"method": spec.get("method")}
+        if "config" in spec:
+            entry["config_uri"] = spec["config"].get("uri")
+        for key in ("frames_per_job", "selection", "selections"):
+            if key in spec:
+                entry[key] = spec[key]
+        stages[stage] = entry
+    return {
+        key: recipe.get(key)
+        for key in ("enabled", "gpu_enabled", "bucket", "max_pages", "max_plans")
+        if key in recipe
+    } | {"stages": stages}
+
+
+def _task_class_summary(classes: list[dict[str, Any]]) -> list[dict[str, Any]]:
+    keys = (
+        "name",
+        "machine_type",
+        "provisioning_model",
+        "max_active_tasks",
+        "max_tasks_per_capture",
+        "runtime_seconds",
+        "image",
+    )
+    return [{key: item.get(key) for key in keys if key in item} for item in classes]
+
+
+def _asset_summary(assets: list[dict[str, Any]]) -> list[dict[str, Any]]:
+    return [{"role": a.get("role"), "uri": a.get("uri"), "sha256": a.get("sha256")} for a in assets]
+
+
+ENV_NOTE = "environment value lives in the processing API deployment; not readable locally"
+
+
+@app.command("show")
+def show(
+    uri: str | None = URI_OPTION,
+    deployment: Path | None = DEPLOYMENT_OPTION,
+    full: bool = typer.Option(False, "--full", help="Print full values instead of summaries."),
+) -> None:
+    """Show the effective configuration, the source of each field, and the store generation."""
+    rc = _runtime_config()
+    store = _store(uri)
+    document, generation, problem = _read_base(store)
+    env, deployment_dir = _deployment_env(_deployment_dir(deployment))
+    loaded = rc.LoadedDocument(document, generation) if document is not None else None
+    effective = rc.merge_effective(env, loaded)
+    fields: dict[str, Any] = {}
+
+    def value_or_none(name: str, raw: str | None, summarize):
+        if raw is None:
+            return None
+        parsed = json.loads(raw)
+        return parsed if full else summarize(parsed)
+
+    for name, raw, summarize, filename in (
+        ("recipe", effective.recipe_json, _recipe_summary, "egoexo-recipe.json"),
+        (
+            "trusted_assets",
+            effective.trusted_assets_json,
+            _asset_summary,
+            "egoexo-trusted-assets.json",
+        ),
+    ):
+        source = effective.source(name)
+        entry: dict[str, Any] = {"source": source}
+        if source == "store" or deployment_dir is not None:
+            entry["value"] = value_or_none(name, raw, summarize)
+        if source == "env":
+            entry["note"] = (
+                f"environment value read from {deployment_dir / filename}"
+                if deployment_dir is not None
+                else ENV_NOTE
+            )
+        fields[name] = entry
+    source = effective.source("task_classes")
+    fields["task_classes"] = {"source": source}
+    if source == "store":
+        fields["task_classes"]["value"] = value_or_none(
+            "task_classes", effective.task_classes_json, _task_class_summary
+        )
+    else:
+        fields["task_classes"]["note"] = ENV_NOTE + " (rendered by terraform task_classes.tf)"
+    fields["flags"] = {
+        name: (
+            {"source": "store", "value": getattr(effective, name)}
+            if effective.source(name) == "store"
+            else {"source": "env", "note": ENV_NOTE}
+        )
+        for name in rc.FLAG_NAMES
+    }
+    _emit(
+        {
+            "uri": store.uri,
+            "generation": None if generation == "0" else generation,
+            "revision": (
+                {
+                    "author": document.author,
+                    "reason": document.reason,
+                    "created_at": document.created_at,
+                    "previous_generation": document.previous_generation,
+                }
+                if document is not None
+                else None
+            ),
+            "problem": problem,
+            "fields": fields,
+        }
+    )
+    if problem:
+        raise typer.Exit(1)
+
+
+def _revise(store, *, write: bool, reason: str | None, change: dict[str, Any], mutate) -> None:
+    """Validate a new revision, print the plan, and write it only with --write --reason."""
+    rc = _runtime_config()
+    document, generation, problem = _read_base(store)
+    base = document if document is not None else rc.RuntimeConfigDocument()
+    revised = mutate(base)
+    try:
+        revised.validate()
+    except (ValueError, TypeError, KeyError) as exc:
+        error(f"Rejected by the production parser: {type(exc).__name__}: {exc}")
+        raise typer.Exit(1) from exc
+    plan = {
+        "uri": store.uri,
+        "expected_generation": None if generation == "0" else generation,
+        "current_problem": problem,
+        "change": change,
+        "overrides_after": {
+            "recipe": revised.recipe is not None,
+            "trusted_assets": revised.trusted_assets is not None,
+            "task_classes": revised.task_classes is not None,
+            "flags": dict(revised.flags),
+        },
+    }
+    if not write:
+        _emit(plan | {"written": False})
+        info('Dry run. Nothing was written. Re-run with --write --reason "<text>".')
+        return
+    if not reason or not reason.strip():
+        error("--reason is required with --write.")
+        raise typer.Exit(1)
+    author = _author()
+    try:
+        new_generation = store.write(
+            revised, author=author, reason=reason, expected_generation=generation
+        )
+    except rc.GenerationMismatch as exc:
+        error("The object changed since it was read. Re-run the command to read it again.")
+        raise typer.Exit(1) from exc
+    _emit(
+        plan
+        | {
+            "written": True,
+            "generation": new_generation,
+            "history_uri": store.history_uri(new_generation),
+            "author": author,
+            "reason": reason,
+        }
+    )
+
+
+@app.command("set-recipe")
+def set_recipe(
+    file: Path = typer.Argument(..., help="Recipe JSON, the same document the API loads."),
+    uri: str | None = URI_OPTION,
+    write: bool = WRITE_OPTION,
+    reason: str | None = REASON_OPTION,
+) -> None:
+    """Store a recipe that overrides EGOEXO_CAPTURE_RECIPE_JSON."""
+    recipe = _load_json_file(file)
+    _revise(
+        _store(uri),
+        write=write,
+        reason=reason,
+        change={"field": "recipe", "file": str(file)},
+        mutate=lambda base: replace(base, recipe=recipe),
+    )
+
+
+@app.command("set-task-classes")
+def set_task_classes(
+    file: Path = typer.Argument(..., help="Task class list JSON, one to three classes."),
+    uri: str | None = URI_OPTION,
+    write: bool = WRITE_OPTION,
+    reason: str | None = REASON_OPTION,
+) -> None:
+    """Store task classes that override BUILDAI_EGOEXO_ASSIGNED_TASK_CLASSES_JSON."""
+    classes = _load_json_file(file)
+    _revise(
+        _store(uri),
+        write=write,
+        reason=reason,
+        change={"field": "task_classes", "file": str(file)},
+        mutate=lambda base: replace(base, task_classes=classes),
+    )
+
+
+@app.command("set-trusted-assets")
+def set_trusted_assets(
+    file: Path = typer.Argument(..., help="Trusted asset list JSON with pinned identities."),
+    uri: str | None = URI_OPTION,
+    write: bool = WRITE_OPTION,
+    reason: str | None = REASON_OPTION,
+) -> None:
+    """Store trusted assets that override BUILDAI_EGOEXO_CAPTURE_TRUSTED_ASSETS_JSON."""
+    assets = _load_json_file(file)
+    _revise(
+        _store(uri),
+        write=write,
+        reason=reason,
+        change={"field": "trusted_assets", "file": str(file)},
+        mutate=lambda base: replace(base, trusted_assets=assets),
+    )
+
+
+@app.command("set-flag")
+def set_flag(
+    name: str = typer.Argument(
+        ...,
+        help="assigned_dispatch_enabled, auto_advance_enabled or native_discovery_enabled.",
+    ),
+    value: str = typer.Argument(..., help="true or false."),
+    uri: str | None = URI_OPTION,
+    write: bool = WRITE_OPTION,
+    reason: str | None = REASON_OPTION,
+) -> None:
+    """Store one lane flag that overrides its environment variable."""
+    rc = _runtime_config()
+    if name not in rc.FLAG_NAMES:
+        error(f"Unknown flag {name!r}. Choose one of: {', '.join(rc.FLAG_NAMES)}")
+        raise typer.Exit(1)
+    if value.lower() not in {"true", "false"}:
+        error("Flag value must be true or false.")
+        raise typer.Exit(1)
+    enabled = value.lower() == "true"
+    _revise(
+        _store(uri),
+        write=write,
+        reason=reason,
+        change={"field": f"flags.{name}", "value": enabled},
+        mutate=lambda base: replace(base, flags=dict(base.flags) | {name: enabled}),
+    )
+
+
+@app.command("clear")
+def clear(
+    field: str = typer.Argument(
+        ..., help="recipe, trusted_assets, task_classes, or a flag name to hand back to env."
+    ),
+    uri: str | None = URI_OPTION,
+    write: bool = WRITE_OPTION,
+    reason: str | None = REASON_OPTION,
+) -> None:
+    """Remove one stored override so the environment value applies again."""
+    rc = _runtime_config()
+    if field in rc.VALUE_FIELDS:
+        mutate = lambda base: replace(base, **{field: None})  # noqa: E731
+    elif field in rc.FLAG_NAMES:
+        mutate = lambda base: replace(  # noqa: E731
+            base, flags={k: v for k, v in base.flags.items() if k != field}
+        )
+    else:
+        error(f"Unknown field {field!r}. Choose one of: {', '.join(rc.FIELD_NAMES)}")
+        raise typer.Exit(1)
+    _revise(
+        _store(uri),
+        write=write,
+        reason=reason,
+        change={"field": field, "value": "environment"},
+        mutate=mutate,
+    )
+
+
+def _asset_group(uri: str) -> str | None:
+    """Return the <group> segment of derived/runtime-assets/<group>/<sha256>/<name>."""
+    marker = uri.find(ASSET_PREFIX)
+    if marker < 0:
+        return None
+    parts = uri[marker + len(ASSET_PREFIX) :].split("/")
+    return parts[0] if len(parts) == 3 and parts[0] else None
+
+
+@app.command("pin-config-asset")
+def pin_config_asset(
+    stage: str = typer.Option(..., "--stage", help="Recipe stage whose config changes."),
+    file: Path = typer.Option(..., "--file", help="Local JSON config to upload."),
+    group: str | None = typer.Option(
+        None, "--group", help="Asset group. Default: the group of the stage's current config."
+    ),
+    name: str | None = typer.Option(
+        None, "--name", help="Object name under the SHA256 folder. Default: the file name."
+    ),
+    uri: str | None = URI_OPTION,
+    deployment: Path | None = DEPLOYMENT_OPTION,
+    write: bool = WRITE_OPTION,
+    reason: str | None = REASON_OPTION,
+) -> None:
+    """Upload a content-addressed stage config and pin it in the recipe and trusted assets.
+
+    The object lands at derived/runtime-assets/<group>/<sha256>/<name>. After the
+    upload the command reads it back and checks generation, size, CRC32C and
+    SHA256. The recipe's stage config, the method config_sha256, and the trusted
+    asset list change together in one new store revision.
+    """
+    _runtime_config()
+    from egoexo.adapters.gcs import publication
+
+    _load_json_file(file)
+    store = _store(uri)
+    document, generation, problem = _read_base(store)
+    env, deployment_dir = _deployment_env(_deployment_dir(deployment))
+    if document is not None and document.recipe is not None:
+        recipe = json.loads(json.dumps(document.recipe))
+        recipe_source = "store"
+    elif env.recipe_json:
+        recipe = json.loads(env.recipe_json)
+        recipe_source = f"env ({deployment_dir / 'egoexo-recipe.json'})"
+    else:
+        error("No recipe in the store and no --deployment recipe to start from.")
+        raise typer.Exit(1)
+    if document is not None and document.trusted_assets is not None:
+        assets = json.loads(json.dumps(document.trusted_assets))
+    else:
+        assets = json.loads(env.trusted_assets_json)
+    spec = recipe.get("preset", {}).get(stage)
+    if not isinstance(spec, dict) or not isinstance(spec.get("method"), dict):
+        error(f"Stage {stage!r} is not in the recipe preset.")
+        raise typer.Exit(1)
+    old = spec.get("config")
+    group = group or (_asset_group(old["uri"]) if isinstance(old, dict) else None)
+    if not group or "/" in group:
+        error("Pass --group; the stage has no current config to take the group from.")
+        raise typer.Exit(1)
+    name = name or file.name
+    if "/" in name or name in {"", ".", ".."}:
+        error("--name must be a plain file name.")
+        raise typer.Exit(1)
+    size, sha, crc = publication.identity(file)
+    target = f"gs://{recipe['bucket']}/{ASSET_PREFIX}{group}/{sha}/{name}"
+    change = {
+        "stage": stage,
+        "recipe_source": recipe_source,
+        "file": str(file),
+        "target_uri": target,
+        "sha256": sha,
+        "size_bytes": size,
+        "crc32c_base64": crc,
+        "replaces_config_uri": old["uri"] if isinstance(old, dict) else None,
+    }
+    if not write:
+        _emit(
+            {
+                "uri": store.uri,
+                "expected_generation": None if generation == "0" else generation,
+                "current_problem": problem,
+                "change": change,
+                "written": False,
+            }
+        )
+        info('Dry run. Nothing was uploaded or written. Re-run with --write --reason "<text>".')
+        return
+    if not reason or not reason.strip():
+        error("--reason is required with --write.")
+        raise typer.Exit(1)
+    with tempfile.TemporaryDirectory() as scratch:
+        published = publication.publish(store.storage, target, file, Path(scratch))
+        check = Path(scratch) / "readback.json"
+        store.storage.download(target, published.generation, check, size)
+        if publication.identity(check) != (size, sha, crc):
+            error("Readback of the uploaded object did not match the local file.")
+            raise typer.Exit(1)
+    ref = {
+        "role": "producer_config",
+        "uri": target,
+        "generation": published.generation,
+        "size_bytes": size,
+        "sha256": sha,
+        "sha256_verification": "declared",
+        "crc32c_base64": crc,
+    }
+    spec["config"] = ref
+    spec["method"] = dict(spec["method"]) | {"config_sha256": sha}
+    replaced = False
+    for index, asset in enumerate(assets):
+        if (
+            isinstance(old, dict)
+            and asset.get("uri") == old["uri"]
+            and asset.get("role") == ref["role"]
+        ):
+            assets[index] = ref
+            replaced = True
+    if not replaced and not any(
+        a.get("uri") == target and a.get("role") == ref["role"] for a in assets
+    ):
+        assets.append(ref)
+    change |= {"uploaded_generation": published.generation, "trusted_asset_replaced": replaced}
+    _revise(
+        store,
+        write=True,
+        reason=reason,
+        change=change,
+        mutate=lambda base: replace(base, recipe=recipe, trusted_assets=assets),
+    )

{buildai_cli-0.3.149 → buildai_cli-0.3.151}/cli/commands/ingest.py

@@ -6,6 +6,7 @@ import json
 import sys
 from pathlib import Path
 from typing import Annotated
+from uuid import UUID
 
 import typer
 
@@ -285,6 +286,35 @@ def fleet_readiness(
                 info(f"next: {action}")
 
 
+@fleet_app.command("retry-upload")
+def fleet_retry_upload(
+    server: str = typer.Option(..., "--server", help="Inventory server number or exact name."),
+    handoff_id: UUID = typer.Option(..., "--handoff-id"),
+    transport: str = typer.Option("tailscale", "--transport", help=TRANSPORT_HELP),
+    write: bool = typer.Option(False, "--write", help="Retry only the reviewed source state."),
+    expected_revision: str | None = typer.Option(None, "--expected-revision"),
+    reason: str | None = typer.Option(None, "--reason"),
+) -> None:
+    """Preview a failed card, or retry its exact marker revision after repair."""
+    if write and (not expected_revision or not (reason or "").strip()):
+        raise typer.BadParameter("--write requires --expected-revision and --reason")
+    engine = _ingest_engine()
+    try:
+        payload = engine.retry_mono_upload(
+            server=server,
+            handoff_id=str(handoff_id),
+            transport=transport,
+            write=write,
+            expected_revision=expected_revision,
+            reason=reason,
+        )
+    except ValueError as exc:
+        payload = {"error": {"code": "invalid_request", "message": str(exc)}}
+    sys.stdout.write(json.dumps(payload, indent=2) + "\n")
+    if "error" in payload:
+        raise typer.Exit(1)
+
+
 @fleet_app.command("preflight")
 def fleet_preflight(
     scope: str = typer.Option(

{buildai_cli-0.3.149 → buildai_cli-0.3.151}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "buildai-cli"
-version = "0.3.149"
+version = "0.3.151"
 description = "Build AI CLI (Typer)"
 requires-python = ">=3.11"
 dependencies = [

buildai_cli-0.3.149/AGENTS.md

@@ -1,50 +0,0 @@
-# BuildAI CLI — Typer CLI with standalone (API-backed) and workspace (DB-direct) modes.
-
-## Read first
-
-- [../../../AGENTS.md](../../../AGENTS.md)
-- Docs site Engineering section (`make docs`)
-- Docs site Operations > Database roles (`make docs`)
-
-## Rules
-
-**Two planes.**
-
-| Mode | Install | Auth | DB access |
-|------|---------|------|-----------|
-| Standalone (`buildai`) | `uv tool install buildai-cli` | API key / JWT | Through API |
-| Workspace (`uv run buildai`) | Repo-local editable install | IAM / password | Direct via `db`, through profile-keyed local broker |
-
-**DB guards.** `db` subcommands require workspace install + gcloud IAM. Inspection/migration uses a profile-keyed `alloydb-auth-proxy` broker with state in `~/.buildai/db-brokers` (shared across worktrees). Use `buildai db broker status|ensure|stop` for local transport.
-
-**Writes.** Require `--write`. Production migrations prompt for confirmation.
-
-**Frame-label totals.** A `buildai db query` that counts
-`labeling.frame_labels` by `status` and `label_mode` must use
-`MATERIALIZED` then filter, or `COUNT(*) FILTER`. Do not push those
-predicates into the scan. See
-[core/dal/labeling/AGENTS.md](../../../core/dal/labeling/AGENTS.md).
-
-**Targeting.** Worktree app/runtime targeting comes from explicit env vars and the repo Makefile, not a saved CLI context layer. `buildai db --env` selects `production`, `staging`, or `dev`.
-
-**Staging.** Private-IP only. Start `buildai db --env staging tunnel`, then pass `--all-proxy socks5://127.0.0.1:1080` for queries.
-
-**Workers.** Call the API through the SDK; do not import `core/` or access the database directly from worker shells.
-
-## Verify
-
-```bash
-buildai auth whoami
-uv run buildai ingest deploy plan --scope active
-buildai db broker status
-buildai db schema tables
-buildai db query "SELECT count(*) FROM core.clips"
-buildai db --env staging tunnel   # in one terminal; query with --all-proxy in another
-```
-
-## Don't
-
-- Run `db --write` without `--write`.
-- Query staging without an IAP/VPN/SOCKS route and `--all-proxy`.
-- Assume a saved CLI context picks the worktree's DB lane — use env vars and Makefile.
-- Deploy ingest fleet changes from an unclear branch or dirty checkout.