caffeinated-whale-cli 3.1.1__tar.gz → 3.1.2__tar.gz

{caffeinated_whale_cli-3.1.1 → caffeinated_whale_cli-3.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: caffeinated-whale-cli
-Version: 3.1.1
+Version: 3.1.2
 Summary: A CLI tool to help manage Frappe Docker instances.
 Author-email: Christopher McKay <mckay.christopher73@outlook.com>
 License: MIT
@@ -1253,7 +1253,7 @@ A bench that was not running is left alone.
 **`apps uninstall`** - removes each app from the target site(s) (`bench --site <site> uninstall-app`). This destroys site data, so it is gated by `-y`/`--yes` or an interactive confirmation (a non-TTY without `--yes` refuses). It uses the same resynchronise-and-verify step as install, so no supervised process - web, scheduler, or worker - can keep running against the code and tables of an app that is gone.
 
 **`apps update`** - the canonical app-update path (what the deprecated `cwcli update` now delegates to). Updating the `frappe` framework app runs `bench update --reset`; other apps use the normal git-pull + migrate flow. After the migrations finish and maintenance mode is lifted, it runs the same **resynchronise** step as `apps install`, so a `git pull` cannot leave the bench's web, scheduler, and workers on the code that was there before it; every migrated site must answer Frappe before the run reports success. `--site` narrows which affected sites are migrated; if none of the named site(s) actually have the app installed, the command refuses and exits non-zero rather than silently migrating nothing (a genuine typo/mismatch guard - a bench with no affected sites at all still exits zero). It accepts the same migration flags as the [deprecated `update` command](#update---update-apps-and-migrate) (`--clear-cache`, `--clear-website-cache`, `--build`, `--skip-maintenance`, `--no-recache`). When updating the `frappe` framework app the flow runs the bench-wide `bench update --reset`, so `--site` and those per-app migration flags do not apply and are reported as ignored.
-`--force` is an opt-in, **destructive** recovery for a conflicting update: if an app's `git pull` hits a **conflict** (local changes that would be overwritten, or a conflicted merge), it hard-resets that app to its remote tracking branch (`git fetch` then `git reset --hard @{u}`), discarding the local changes, so the update completes instead of failing. It fires **only on a conflict** - a clean update is untouched, and a pull that failed for another reason (network, auth) is left as the failure it is rather than having work discarded. Without `--force`, a conflict fails safely and discards nothing. Every force-reset app is reported (`force_reset_apps`) and a warning is printed at the reset. `--force` does not delete untracked files (it never runs `git clean`), matching `apps checkout --reset`.
+`--force` is an opt-in, **destructive** recovery for a conflicting update: if an app's `git pull` hits a **conflict** (local changes that would be overwritten, or a conflicted merge), it hard-resets that app to its remote tracking branch (`git fetch` then `git reset --hard @{u}`), discarding the local changes, so the update completes instead of failing. It fires **only on a conflict** - a clean update is untouched, and a pull that failed for another reason (network, auth) is left as the failure it is rather than having work discarded. Without `--force`, a conflict fails safely and discards nothing. Every force-reset app is reported (`force_reset_apps`) and a warning is printed at the reset. `--force` does not delete untracked files (it never runs `git clean`), matching `apps checkout --reset`. `--force` also clears a git **"dubious ownership"** refusal before pulling: when an app's repository is owned by a different user than the container runs as - common on a shared-mode or migrated instance whose app sources are owned by a pre-migration uid - it re-owns the repository to the container user so the pull proceeds, rather than surfacing a raw git ownership error. A `cwcli start`/`cwcli restart` self-heals the same ownership so a plain `apps update` works too; `--force` fixes it inline without a restart.
 
 **`apps checkout`** - fetches and checks out an arbitrary branch, tag, or commit (`REF`) into an app that is **already present** in the bench (`apps/<app>`), so a specific feature branch can be put under test in the instance the app lives in.
 Unlike `apps install` (bench acquisition when needed, then site installation) and `apps update` (the tracked upstream on every app), this targets one existing checkout: it runs `git fetch <remote> <ref>` then `git checkout -B <ref> FETCH_HEAD` in the app directory (the remote is auto-detected - `upstream` for a bench-installed app, `origin` for a hand-cloned one).

{caffeinated_whale_cli-3.1.1 → caffeinated_whale_cli-3.1.2}/README.md

@@ -1213,7 +1213,7 @@ A bench that was not running is left alone.
 **`apps uninstall`** - removes each app from the target site(s) (`bench --site <site> uninstall-app`). This destroys site data, so it is gated by `-y`/`--yes` or an interactive confirmation (a non-TTY without `--yes` refuses). It uses the same resynchronise-and-verify step as install, so no supervised process - web, scheduler, or worker - can keep running against the code and tables of an app that is gone.
 
 **`apps update`** - the canonical app-update path (what the deprecated `cwcli update` now delegates to). Updating the `frappe` framework app runs `bench update --reset`; other apps use the normal git-pull + migrate flow. After the migrations finish and maintenance mode is lifted, it runs the same **resynchronise** step as `apps install`, so a `git pull` cannot leave the bench's web, scheduler, and workers on the code that was there before it; every migrated site must answer Frappe before the run reports success. `--site` narrows which affected sites are migrated; if none of the named site(s) actually have the app installed, the command refuses and exits non-zero rather than silently migrating nothing (a genuine typo/mismatch guard - a bench with no affected sites at all still exits zero). It accepts the same migration flags as the [deprecated `update` command](#update---update-apps-and-migrate) (`--clear-cache`, `--clear-website-cache`, `--build`, `--skip-maintenance`, `--no-recache`). When updating the `frappe` framework app the flow runs the bench-wide `bench update --reset`, so `--site` and those per-app migration flags do not apply and are reported as ignored.
-`--force` is an opt-in, **destructive** recovery for a conflicting update: if an app's `git pull` hits a **conflict** (local changes that would be overwritten, or a conflicted merge), it hard-resets that app to its remote tracking branch (`git fetch` then `git reset --hard @{u}`), discarding the local changes, so the update completes instead of failing. It fires **only on a conflict** - a clean update is untouched, and a pull that failed for another reason (network, auth) is left as the failure it is rather than having work discarded. Without `--force`, a conflict fails safely and discards nothing. Every force-reset app is reported (`force_reset_apps`) and a warning is printed at the reset. `--force` does not delete untracked files (it never runs `git clean`), matching `apps checkout --reset`.
+`--force` is an opt-in, **destructive** recovery for a conflicting update: if an app's `git pull` hits a **conflict** (local changes that would be overwritten, or a conflicted merge), it hard-resets that app to its remote tracking branch (`git fetch` then `git reset --hard @{u}`), discarding the local changes, so the update completes instead of failing. It fires **only on a conflict** - a clean update is untouched, and a pull that failed for another reason (network, auth) is left as the failure it is rather than having work discarded. Without `--force`, a conflict fails safely and discards nothing. Every force-reset app is reported (`force_reset_apps`) and a warning is printed at the reset. `--force` does not delete untracked files (it never runs `git clean`), matching `apps checkout --reset`. `--force` also clears a git **"dubious ownership"** refusal before pulling: when an app's repository is owned by a different user than the container runs as - common on a shared-mode or migrated instance whose app sources are owned by a pre-migration uid - it re-owns the repository to the container user so the pull proceeds, rather than surfacing a raw git ownership error. A `cwcli start`/`cwcli restart` self-heals the same ownership so a plain `apps update` works too; `--force` fixes it inline without a restart.
 
 **`apps checkout`** - fetches and checks out an arbitrary branch, tag, or commit (`REF`) into an app that is **already present** in the bench (`apps/<app>`), so a specific feature branch can be put under test in the instance the app lives in.
 Unlike `apps install` (bench acquisition when needed, then site installation) and `apps update` (the tracked upstream on every app), this targets one existing checkout: it runs `git fetch <remote> <ref>` then `git checkout -B <ref> FETCH_HEAD` in the app directory (the remote is auto-detected - `upstream` for a bench-installed app, `origin` for a hand-cloned one).

{caffeinated_whale_cli-3.1.1 → caffeinated_whale_cli-3.1.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "caffeinated-whale-cli"
-version = "3.1.1"
+version = "3.1.2"
 authors = [
   { name = "Christopher McKay", email = "mckay.christopher73@outlook.com" },
 ]

caffeinated_whale_cli-3.1.2/src/caffeinated_whale_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = "3.1.2"

{caffeinated_whale_cli-3.1.1 → caffeinated_whale_cli-3.1.2}/src/caffeinated_whale_cli/core/docker.py

@@ -230,6 +230,93 @@ def _bench_paths_needing_reown(
     return needing
 
 
+def _decode(out) -> str:
+    return out.decode("utf-8", "replace") if isinstance(out, (bytes, bytearray)) else str(out)
+
+
+def _external_app_source_dirs(container, bench_path: str) -> list[str]:
+    """Real source dirs of each app under ``<bench>/apps`` that live OUTSIDE the bench.
+
+    A cwcli-native bench holds its apps as real directories under ``<bench>/apps``,
+    so the bench re-own already covers them. A devcontainer/externally-provisioned
+    bench instead symlinks each app to a shared source tree - e.g.
+    ``apps/erpnext -> /workspace/.hdsrc/erpnext`` - which a ``chown -R <bench>`` does
+    NOT follow (it changes the link, not its target), leaving the real app repo owned
+    by the pre-shared uid. That is exactly the repo ``bench update``/``git pull``
+    operates on, so an ownership mismatch there is git's "dubious ownership" refusal.
+
+    Resolves each ``apps/*`` entry through its symlink (``readlink -f``) and returns
+    only the targets that resolve OUTSIDE ``bench_path`` (in-bench targets are already
+    covered by the bench re-own). One exec; ``[]`` when ``apps/`` is absent or the
+    probe fails - the caller stays a no-op on any layout it cannot read.
+    """
+    q = shlex.quote(bench_path)
+    prog = (
+        f"for d in {q}/apps/*/; do "
+        f'[ -e "$d" ] || continue; '
+        f't=$(readlink -f "$d" 2>/dev/null) || continue; '
+        f'[ -n "$t" ] || continue; '
+        f'case "$t/" in {q}/*) continue;; esac; '
+        f'printf "%s\\n" "$t"; '
+        f"done"
+    )
+    try:
+        code, out = container.exec_run(["bash", "-c", prog])
+    except DockerException:
+        return []
+    if code != 0:
+        return []
+    return [line.strip() for line in _decode(out).splitlines() if line.strip()]
+
+
+def reown_app_repo_to_frappe(container, app_path: str) -> tuple[bool, str | None]:
+    """Re-own an app's real source dir to the container ``frappe`` user when a
+    different uid owns it - the root cause of git's "dubious ownership" refusal.
+
+    ``git`` run as ``frappe`` refuses a repository owned by another uid, and neither
+    the pull nor ``git status`` can proceed, so ``apps update --force``'s existing
+    conflict recovery (which needs a readable ``git status``) never even fires. This
+    fixes the mismatch itself rather than silencing the check with a stray
+    ``safe.directory``: it resolves ``app_path`` through any symlink (so the real
+    repo under e.g. ``/workspace/.hdsrc`` is chowned, not the link) and ``chown -R``s
+    it to the ``frappe`` user's CURRENT uid/gid - which after alignment is whoever
+    git will actually run as.
+
+    Best-effort, so ``--force`` degrades to the pull's own error rather than raising:
+    returns ``(reowned, failure)``. ``reowned`` is True only when a chown actually
+    ran; an already-correctly-owned repo is ``(False, None)`` (a plain no-op, not the
+    cause of any failure).
+    """
+    uid = _read_frappe_id(container, "-u")
+    gid = _read_frappe_id(container, "-g")
+    if uid is None or gid is None:
+        return (False, "could not read the container 'frappe' user's uid/gid")
+    q = shlex.quote(app_path)
+    try:
+        code, out = container.exec_run(
+            ["bash", "-c", f'p=$(readlink -f {q}) && printf "%s\\n" "$p" && stat -c "%u:%g" "$p"']
+        )
+    except DockerException as e:
+        return (False, f"could not read the app repo owner: {e}")
+    if code != 0:
+        return (False, None)  # unresolvable; let the pull surface its own error
+    lines = _decode(out).splitlines()
+    if len(lines) < 2:
+        return (False, None)
+    real_path, owner = lines[0].strip(), lines[1].strip()
+    if not real_path or owner == f"{uid}:{gid}":
+        return (False, None)  # already owned by the frappe user: not the cause
+    try:
+        code, out = container.exec_run(
+            ["bash", "-c", f"chown -R {uid}:{gid} {shlex.quote(real_path)}"], user="root"
+        )
+    except DockerException as e:
+        return (False, f"could not re-own the app repo: {e}")
+    if code != 0:
+        return (False, f"could not re-own the app repo: {_decode(out).strip()}")
+    return (True, None)
+
+
 # The only paths first-provision writes under /home/frappe: the home root itself
 # (mkdir/write needs its owner to match), plus pip/npm's caches and pyenv/nvm's
 # write targets. Deliberately excludes the ~34.6k-file baked pyenv/nvm toolchain
@@ -287,8 +374,12 @@ def align_container_user_to_host(
     versus ~3s narrowed.
 
     In SHARED mode (``shared_home.shared_mode()``) each path in ``bench_paths`` (the
-    resolved bench dirs) is re-owned to the target identity when its CURRENT owner
-    differs, not merely when the ids change this call. The remap target is the
+    resolved bench dirs) AND the real source dir of any app symlinked outside a bench
+    (``apps/<app> -> /workspace/.hdsrc/<app>`` on a devcontainer bench; see
+    ``_external_app_source_dirs``) is re-owned to the target identity when its CURRENT
+    owner differs, not merely when the ids change this call. Covering the app repos is
+    what lets a subsequent ``apps update`` git pull run without a "dubious ownership"
+    refusal - a bench re-own alone does not follow those symlinks. The remap target is the
     stable ``cwcli`` service account, NOT ``os.getuid()``, so a migrated instance's
     bind-mounted workspace - built under the pre-shared uid - is not owned by the
     remapped ``frappe`` user and ``bench start`` can no longer write
@@ -342,7 +433,21 @@ def align_container_user_to_host(
     # a normal shared box whose workspace already matches gets no chown -R.
     reown_paths: list[str] = []
     if in_shared_mode and bench_paths:
-        reown_paths = _bench_paths_needing_reown(container, bench_paths, host_uid, host_gid)
+        # Each bench dir PLUS the real source dir of any app symlinked outside it
+        # (a devcontainer bench points `apps/<app>` at a shared tree like
+        # `/workspace/.hdsrc/<app>`, which a `chown -R <bench>` does not follow).
+        # Those app repos are what `bench update`/`git pull` operate on, so leaving
+        # them owned by the pre-shared uid is exactly git's "dubious ownership"
+        # refusal on the next `apps update`. Owner-mismatch gated per path, so the
+        # bench dir being already correct never hides an app repo that is not.
+        candidates: list[str] = []
+        seen: set[str] = set()
+        for path in bench_paths:
+            for candidate in (path, *_external_app_source_dirs(container, path)):
+                if candidate not in seen:
+                    seen.add(candidate)
+                    candidates.append(candidate)
+        reown_paths = _bench_paths_needing_reown(container, candidates, host_uid, host_gid)
 
     if not ids_changed and not chown_home and not reown_paths:
         return (False, None)

{caffeinated_whale_cli-3.1.1 → caffeinated_whale_cli-3.1.2}/src/caffeinated_whale_cli/core/update.py

@@ -787,6 +787,29 @@ def _update_apps(  # noqa: C901 - the state machine's phases are the function
                 warnings.append(Message("app.not_found", not_found))
                 emit(UpdateStepEnd(phase="pull", item=app, status="failed", message=not_found))
                 continue
+            # --force clears a git "dubious ownership" refusal at its root: git run as
+            # the frappe user refuses a repo owned by another uid, so BOTH the pull and
+            # the `git status` the conflict path relies on fail and plain --force can do
+            # nothing. Re-own the app repo (resolving the symlink to the real source,
+            # e.g. .hdsrc) to the frappe user BEFORE the pull. Owner-mismatch gated, so
+            # an already-correct repo is a cheap stat; failure degrades to the pull's
+            # own error (the pull runs regardless).
+            if force:
+                reowned, reown_err = core_docker.reown_app_repo_to_frappe(
+                    frappe_container, app_path
+                )
+                if reowned:
+                    warnings.append(
+                        Message(
+                            "app.force_reown",
+                            f"--force: re-owned '{app}' repository to the container user "
+                            "to clear a git ownership refusal before pulling.",
+                        )
+                    )
+                elif reown_err:
+                    warnings.append(
+                        Message("app.force_reown_failed", f"--force: '{app}': {reown_err}")
+                    )
             status = _run_step(
                 frappe_container,
                 "git pull",

caffeinated_whale_cli-3.1.1/src/caffeinated_whale_cli/__init__.py

@@ -1 +0,0 @@
-__version__ = "3.1.1"