cinna-cli 0.1.4__tar.gz → 0.1.6__tar.gz

{cinna_cli-0.1.4 → cinna_cli-0.1.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cinna-cli
-Version: 0.1.4
+Version: 0.1.6
 Summary: Local development CLI for Cinna Core agents
 Project-URL: Homepage, https://github.com/opencinna/cinna-cli
 Project-URL: Repository, https://github.com/opencinna/cinna-cli
@@ -127,10 +127,13 @@ Read-only views onto the live sync session (started by `cinna dev`).
 
 Stream a command through the platform to the remote agent environment. Output streams back live; Ctrl+C aborts. Exit code matches the remote process.
 
+Arguments pass through transparently — each token is re-quoted before being sent, so spaces and shell metacharacters inside an argument survive intact. Use ordinary single-level quoting, exactly as for a local command. To run a shell snippet (pipes, redirects, `&&`), pass it to a shell explicitly: `cinna exec bash -c '…'`.
+
 ```bash
 cinna exec python scripts/main.py
 cinna exec pip install pandas
-cinna exec 'bash -c "ls -la"'
+cinna exec bash -c 'ls -la'
+cinna exec python -c 'import sys; print(sys.argv)' "a b"
 ```
 
 ### `cinna status`

{cinna_cli-0.1.4 → cinna_cli-0.1.6}/README.md

@@ -90,10 +90,13 @@ Read-only views onto the live sync session (started by `cinna dev`).
 
 Stream a command through the platform to the remote agent environment. Output streams back live; Ctrl+C aborts. Exit code matches the remote process.
 
+Arguments pass through transparently — each token is re-quoted before being sent, so spaces and shell metacharacters inside an argument survive intact. Use ordinary single-level quoting, exactly as for a local command. To run a shell snippet (pipes, redirects, `&&`), pass it to a shell explicitly: `cinna exec bash -c '…'`.
+
 ```bash
 cinna exec python scripts/main.py
 cinna exec pip install pandas
-cinna exec 'bash -c "ls -la"'
+cinna exec bash -c 'ls -la'
+cinna exec python -c 'import sys; print(sys.argv)' "a b"
 ```
 
 ### `cinna status`

{cinna_cli-0.1.4 → cinna_cli-0.1.6}/docs/README.md

@@ -328,6 +328,23 @@ Two surfaces expose conflicts:
 
 Ctrl+C closes the SSE stream; the platform cleans up the remote process. Interactive stdin (REPLs, debuggers) is out of scope for the current `/exec` endpoint.
 
+### Argument quoting
+
+There are **two shell passes** between the keyboard and the remote process, and only one round of quoting belongs to each:
+
+1. **Local shell** (the caller's terminal / agent Bash tool) splits the command line into argv and strips one layer of quotes. `exec` is declared `nargs=-1`, so Click receives these already-split tokens as a tuple.
+2. **Remote shell** — the platform runs the `command` string through `/bin/sh -c`, re-parsing it a second time.
+
+`exec_cmd` (`main.py`) bridges the two with `shlex.join(command)`: it re-quotes each token so the remote `sh -c` reconstructs the *exact* argv the caller typed. This makes `cinna exec` a transparent passthrough — callers write ordinary single-level quoting, exactly as for a local command:
+
+```bash
+cinna exec python -c 'import sys; print(sys.argv)' "a b" '[{"x":"y z"}]'
+```
+
+The historical `" ".join(command)` dropped the word boundaries that the local shell's quoting had implied, so any argument containing a space or a shell metacharacter (`;`, `(`, `{`, …) was re-split or mis-parsed by the remote shell — e.g. `print(sys.argv)` failing with `/bin/sh: Syntax error: word unexpected (expecting ")")`. Regression coverage: `test_exec_command_requotes_args` in `tests/test_main.py`.
+
+To run an actual remote shell snippet (pipes, redirects, `&&`), pass it explicitly to a shell: `cinna exec bash -c 'a | b > c'`.
+
 ---
 
 ## Bootstrap Flow
@@ -425,6 +442,45 @@ uv run ruff format --check src/
 
 ---
 
+## Release Management
+
+The CLI is published to [PyPI](https://pypi.org/project/cinna-cli/) by `.github/workflows/publish.yml`, which runs on any pushed tag matching `v*` (and via manual `workflow_dispatch`). It builds the sdist + wheel with `uv build`, runs `twine check`, then publishes through PyPI **Trusted Publishing** (OIDC — no stored API token) from the GitHub `pypi` environment.
+
+### Cutting a release
+
+Versioning is SemVer (`MAJOR.MINOR.PATCH`); a patch release is the common case. From a clean `main` with the changes you want to ship already merged:
+
+1. **Bump the version** — edit `version` in `pyproject.toml` (e.g. `0.1.4` → `0.1.5`).
+2. **Refresh the lockfile** — run `uv lock` so the `cinna-cli` entry in `uv.lock` matches the new version. These two files are the *only* changes in a release commit.
+3. **Commit** with the exact message `release vX.Y.Z` (this is the established convention — release commits touch nothing but `pyproject.toml` + `uv.lock`).
+4. **Tag** the release commit: `git tag vX.Y.Z` (lightweight tag, on the `release` commit).
+5. **Push both** the branch and the tag: `git push origin main && git push origin vX.Y.Z`. Pushing the tag is what triggers the publish workflow.
+
+```bash
+# version already bumped in pyproject.toml
+uv lock
+git add pyproject.toml uv.lock
+git commit -m "release v0.1.5"
+git tag v0.1.5
+git push origin main && git push origin v0.1.5
+```
+
+### Manual approval gate
+
+> **The release manager must manually approve the PyPI publish.** Pushing the tag only *starts* the workflow — the `publish` job targets the protected `pypi` environment, which requires a reviewer to sign off before it runs. Go to **https://github.com/opencinna/cinna-cli/actions**, open the run for the tag you just pushed, and **approve the deployment**. Until you approve, the build completes but nothing is published to PyPI.
+
+### Required changes checklist
+
+| File | Change | Why |
+|------|--------|-----|
+| `pyproject.toml` | `version = "X.Y.Z"` | The single source of truth for the published package version. |
+| `uv.lock` | regenerated via `uv lock` | Keeps the lockfile's `cinna-cli` entry in sync; CI builds from a consistent tree. |
+| git tag `vX.Y.Z` | created on the release commit | The only trigger for the publish workflow. |
+
+`pyproject.toml` is the **only** place the version lives. `src/cinna/__init__.py` derives `__version__` at runtime from the installed package metadata (`importlib.metadata.version("cinna-cli")`), which is what `cinna --version` reports — so it tracks `pyproject.toml` automatically and never needs a manual bump. (It falls back to `0.0.0+unknown` only when run from a source tree with no installed metadata.)
+
+---
+
 ## Tech Stack
 
 | Component | Choice | Rationale |

{cinna_cli-0.1.4 → cinna_cli-0.1.6}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "cinna-cli"
-version = "0.1.4"
+version = "0.1.6"
 description = "Local development CLI for Cinna Core agents"
 readme = "README.md"
 requires-python = ">=3.10"

cinna_cli-0.1.6/src/cinna/__init__.py

@@ -0,0 +1,8 @@
+"""cinna-cli — Local development CLI for Cinna Core agents."""
+
+from importlib.metadata import PackageNotFoundError, version
+
+try:
+    __version__ = version("cinna-cli")
+except PackageNotFoundError:  # not installed (e.g. running from a source tree without metadata)
+    __version__ = "0.0.0+unknown"

{cinna_cli-0.1.4 → cinna_cli-0.1.6}/src/cinna/main.py

@@ -3,6 +3,7 @@
 import logging
 import os
 import platform
+import shlex
 import shutil
 import sys
 import time
@@ -125,10 +126,16 @@ def exec_cmd(timeout: int, command: tuple[str, ...]):
     Output streams back in real time via the platform. Exit code matches the
     remote process's exit code. Ctrl+C aborts the stream.
 
+    Arguments are passed through transparently: each token you type is
+    re-quoted (``shlex.quote``) before being sent, so spaces and shell
+    metacharacters inside an argument survive the remote shell intact. Use
+    ordinary single-level quoting, exactly as for a local command.
+
     Examples:
       cinna exec python scripts/main.py
       cinna exec pip install pandas
       cinna exec bash -c 'ls -la'
+      cinna exec python -c 'import sys; print(sys.argv)' "a b"
       cinna exec --timeout 3600 python long_backfill.py
 
     If your remote command takes its own ``--timeout`` flag, separate it
@@ -139,7 +146,7 @@ def exec_cmd(timeout: int, command: tuple[str, ...]):
     root = find_workspace_root()
     config = load_config(root)
 
-    exit_code = _run_remote_exec(config, " ".join(command), timeout=timeout)
+    exit_code = _run_remote_exec(config, shlex.join(command), timeout=timeout)
     sys.exit(exit_code)
 
 

{cinna_cli-0.1.4 → cinna_cli-0.1.6}/tests/test_main.py

@@ -13,9 +13,13 @@ def runner():
 
 
 def test_version(runner):
+    from cinna import __version__
+
     result = runner.invoke(cli, ["--version"])
     assert result.exit_code == 0
-    assert "0.1.0" in result.output
+    # __version__ is derived from package metadata, not hard-coded — assert the
+    # CLI reports whatever the installed package version is.
+    assert __version__ in result.output
 
 
 def test_status_no_workspace(runner):
@@ -215,7 +219,35 @@ def test_exec_command(mock_load, mock_find, mock_exec, runner, workspace_root, s
 
     result = runner.invoke(cli, ["exec", "python", "scripts/main.py"])
     assert result.exit_code == 0
-    mock_exec.assert_called_once_with(sample_config, "python scripts/main.py")
+    mock_exec.assert_called_once_with(
+        sample_config, "python scripts/main.py", timeout=1800
+    )
+
+
+@patch("cinna.main._run_remote_exec")
+@patch("cinna.main.find_workspace_root")
+@patch("cinna.main.load_config")
+def test_exec_command_requotes_args(
+    mock_load, mock_find, mock_exec, runner, workspace_root, sample_config
+):
+    """Tokens with spaces / shell metacharacters must be re-quoted so the
+    remote shell reconstructs the exact argv the caller intended, rather than
+    re-splitting them. Regression for `cinna exec` mangling quoted arguments.
+    """
+    mock_find.return_value = workspace_root
+    mock_load.return_value = sample_config
+    mock_exec.return_value = 0
+
+    result = runner.invoke(
+        cli,
+        ["exec", "python", "-c", "import sys; print(sys.argv)", "a b", '[{"x":"y z"}]'],
+    )
+    assert result.exit_code == 0
+    mock_exec.assert_called_once_with(
+        sample_config,
+        """python -c 'import sys; print(sys.argv)' 'a b' '[{"x":"y z"}]'""",
+        timeout=1800,
+    )
 
 
 @patch("cinna.main.PlatformClient")

{cinna_cli-0.1.4 → cinna_cli-0.1.6}/uv.lock

@@ -136,7 +136,7 @@ wheels = [
 
 [[package]]
 name = "cinna-cli"
-version = "0.1.4"
+version = "0.1.6"
 source = { editable = "." }
 dependencies = [
     { name = "click" },

cinna_cli-0.1.4/src/cinna/__init__.py

@@ -1,3 +0,0 @@
-"""cinna-cli — Local development CLI for Cinna Core agents."""
-
-__version__ = "0.1.0"