datex-studio-cli 0.4.19__tar.gz → 0.4.21__tar.gz

{datex_studio_cli-0.4.19 → datex_studio_cli-0.4.21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: datex-studio-cli
-Version: 0.4.19
+Version: 0.4.21
 Summary: CLI for Datex Studio low-code platform, designed for LLM-based AI agents
 Project-URL: Homepage, https://github.com/datex/datex-studio-cli
 Project-URL: Documentation, https://github.com/datex/datex-studio-cli

{datex_studio_cli-0.4.19 → datex_studio_cli-0.4.21}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "datex-studio-cli"
-version = "0.4.19"
+version = "0.4.21"
 description = "CLI for Datex Studio low-code platform, designed for LLM-based AI agents"
 readme = "README.md"
 license = "MIT"

{datex_studio_cli-0.4.19 → datex_studio_cli-0.4.21}/src/dxs/__init__.py

@@ -1,4 +1,4 @@
 """Datex Studio CLI - Command-line interface for Datex Studio platform."""
 
-__version__ = "0.4.19"
+__version__ = "0.4.21"
 __app_name__ = "dxs"

{datex_studio_cli-0.4.19 → datex_studio_cli-0.4.21}/src/dxs/cli.py

@@ -70,6 +70,17 @@ def _stdout_is_pipe() -> bool:
         return False
 
 
+def _stdin_is_tty() -> bool:
+    """Whether stdin is interactive — gates confirmation prompts.
+
+    A helper for the same reason as ``_stdout_is_pipe``: tests patch it.
+    """
+    try:
+        return sys.stdin.isatty()
+    except (AttributeError, ValueError):
+        return False
+
+
 def _ensure_utf8_streams() -> None:
     """Force stdout/stderr to UTF-8 so non-ASCII output never crashes the CLI.
 
@@ -571,7 +582,7 @@ def register_commands() -> None:
 @click.pass_context
 def _after_command(ctx: click.Context, result: Any, **kwargs: Any) -> Any:
     """Run post-command hooks (telemetry success event + PyPI update notice)."""
-    from dxs.utils.update_check import maybe_show_update_notice
+    from dxs.utils.update_check import maybe_show_update_notice, maybe_show_update_result
 
     dxs_ctx: DxsContext | None = ctx.find_object(DxsContext)
 
@@ -585,6 +596,13 @@ def _after_command(ctx: click.Context, result: Any, **kwargs: Any) -> Any:
     except Exception:  # noqa: BLE001
         pass
 
+    # The background-upgrade outcome is the result of an explicit user
+    # action, so it is not gated by --no-update-check.
+    try:
+        maybe_show_update_result()
+    except Exception:  # noqa: BLE001 - never let the update check break the CLI
+        pass
+
     skip = bool(dxs_ctx and dxs_ctx.no_update_check)
     try:
         maybe_show_update_notice(skip=skip)
@@ -606,13 +624,23 @@ def _ctx_extras(dxs_ctx: "DxsContext | None") -> dict[str, Any]:
 
 
 @cli.command("update")
-def update_cmd() -> None:
-    """Check PyPI for a newer release and print the upgrade command.
-
-    This command never performs the upgrade itself — run the printed
-    command in a fresh shell. This avoids the running-binary file-lock
-    issues that any in-process upgrade hits on Windows.
+@click.option("--yes", "-y", is_flag=True, help="Skip the confirmation prompt.")
+@click.option(
+    "--check",
+    "check_only",
+    is_flag=True,
+    help="Only check for a newer release and print the upgrade command.",
+)
+def update_cmd(yes: bool, check_only: bool) -> None:
+    """Upgrade dxs to the latest release on PyPI.
+
+    On macOS/Linux this process is replaced by the installer's upgrade
+    command (uv/pipx/pip), so its output appears right here. On Windows
+    the running dxs.exe locks its own files, so the upgrade runs in a
+    detached background helper after dxs exits — the outcome is reported
+    on the next dxs run, with details in ~/.datex/update.log.
     """
+    import shutil
     import time
 
     from dxs.utils.update_check import (
@@ -620,8 +648,14 @@ def update_cmd() -> None:
         _fetch_latest_version,
         _read_cache,
         _write_cache,
+        count_windows_dxs_processes,
+        detect_upgrade_argv,
         detect_upgrade_command,
+        is_dev_install,
         is_newer,
+        is_windows,
+        perform_upgrade_posix,
+        perform_upgrade_windows,
     )
 
     click.echo(f"Current version: {__version__}", err=True)
@@ -636,11 +670,8 @@ def update_cmd() -> None:
         click.echo("You are on the latest version.", err=True)
         return
 
-    upgrade_cmd = detect_upgrade_command()
     click.echo("", err=True)
     click.echo(f"  A new release of dxs is available: {__version__} → {latest}", err=True)
-    click.echo(f"  To upgrade, run: {upgrade_cmd}", err=True)
-    click.echo(f"  https://pypi.org/project/{PACKAGE_NAME}/{latest}/", err=True)
 
     # Refresh the cache and suppress the auto-banner for the next dedupe
     # window — the user has explicitly seen the news.
@@ -651,6 +682,75 @@ def update_cmd() -> None:
     cache["last_notified_at"] = now
     _write_cache(cache)
 
+    if check_only:
+        click.echo(f"  To upgrade, run: {detect_upgrade_command()}", err=True)
+        click.echo(f"  https://pypi.org/project/{PACKAGE_NAME}/{latest}/", err=True)
+        return
+
+    if is_dev_install():
+        click.echo(
+            "This is a development install (source checkout / editable). "
+            "Upgrade it with: git pull && uv sync",
+            err=True,
+        )
+        sys.exit(1)
+
+    argv = detect_upgrade_argv()
+    resolved = shutil.which(argv[0])
+    if resolved is None:
+        click.echo(
+            f"Cannot find '{argv[0]}' on PATH — install it or upgrade manually with: "
+            f"{detect_upgrade_command()}",
+            err=True,
+        )
+        sys.exit(1)
+    argv = [resolved, *argv[1:]]
+
+    if not yes:
+        if not _stdin_is_tty():
+            click.echo(
+                "Not an interactive session — re-run with --yes to upgrade.",
+                err=True,
+            )
+            sys.exit(1)
+        click.confirm(f"  Upgrade to {latest} now?", abort=True, err=True)
+
+    if is_windows():
+        running = count_windows_dxs_processes()
+        if running is not None and running > 1:
+            click.echo(
+                f"  Warning: {running} dxs processes are running (dxs studio, another "
+                "terminal?). The upgrade may fail until they all exit.",
+                err=True,
+            )
+        try:
+            log_path = perform_upgrade_windows(argv, latest)
+        except OSError as e:
+            click.echo(f"Failed to start the background upgrade: {e}", err=True)
+            sys.exit(1)
+        click.echo("  The upgrade will run in the background once dxs exits.", err=True)
+        click.echo(f"  Log: {log_path}", err=True)
+        click.echo(
+            "  The outcome will be reported the next time you run dxs — give it a minute.",
+            err=True,
+        )
+        return
+
+    click.echo(f"  Running: {' '.join(argv)}", err=True)
+    # execvp never returns on success, so the result_callback (telemetry
+    # success event) won't run — record it here first.
+    try:
+        from dxs.core.telemetry import record_end
+
+        record_end(exit_code=0, ctx_extras={})
+    except Exception:  # noqa: BLE001
+        pass
+    try:
+        perform_upgrade_posix(argv)
+    except OSError as e:
+        click.echo(f"Upgrade failed to start: {e}", err=True)
+        sys.exit(1)
+
 
 # Register commands when module loads
 register_commands()

{datex_studio_cli-0.4.19 → datex_studio_cli-0.4.21}/src/dxs/commands/auth.py

@@ -15,6 +15,7 @@ from dxs.core.auth.datex_tenant import (
     is_datex_identity,
 )
 from dxs.core.auth.decorators import get_access_token
+from dxs.core.auth.msal_client import ConsentOutcome
 from dxs.core.auth.tenants import (
     identity_needs_tenant_authority,
     is_foreign_tenant,
@@ -51,6 +52,117 @@ def _reject_tenant_override(ctx: DxsContext, command: str) -> None:
         raise SystemExit(1)
 
 
+def consent_failure_items(outcomes: list[ConsentOutcome] | None) -> list[dict[str, Any]]:
+    """Map failed consent rounds to payload entries (empty when all succeeded).
+
+    AADSTS650057 means the resource is not listed on the CLI app registration —
+    no amount of retrying or user consent can fix that, so it carries an
+    explicit escalation suggestion (issue #135).
+    """
+    items: list[dict[str, Any]] = []
+    for outcome in outcomes or []:
+        if outcome.ok:
+            continue
+        entry: dict[str, Any] = {
+            "resource": outcome.resource,
+            "error": outcome.error,
+            "error_description": outcome.error_description,
+        }
+        if outcome.aadsts_code == "650057":
+            entry["suggestion"] = (
+                "This resource is not listed on the CLI app registration, so consent "
+                "cannot be requested for it — ask an Entra admin to grant tenant-wide "
+                "consent for the resource to the Datex Studio CLI app."
+            )
+        items.append(entry)
+    return items
+
+
+def _run_targeted_consent(ctx: DxsContext, resource_key: str) -> None:
+    """(Re)consent one Datex-internal resource without a full re-login.
+
+    Backs ``dxs auth login --consent devops|crm`` — the recovery path for a
+    user whose login-time consent round was skipped or silently failed
+    (issue #136). Uses the cached Datex identity; the consent round requests
+    the *named* scope so dynamic user consent applies (issue #135).
+    """
+    from dxs.core.auth.datex_tenant import consent_datex_resource
+    from dxs.utils.config import get_settings
+
+    settings = get_settings()
+    if resource_key == "devops":
+        resource = "Azure DevOps"
+        consent_scopes = settings.azure_devops_scopes
+        acquire_scopes = settings.azure_devops_scopes
+        error_code = "DXS-DEVOPS-AUTH-001"
+    else:
+        if not settings.dynamics_crm_url:
+            ctx.output_error(
+                ValidationError(
+                    message=(
+                        "dynamics_crm_url is not configured; there is no Dynamics CRM "
+                        "resource to consent to."
+                    ),
+                    code="DXS-DYNAMICS-CONFIG-001",
+                    suggestions=[
+                        "Run: dxs config set dynamics_crm_url https://yourorg.crm.dynamics.com",
+                        "Then re-run: dxs auth login --consent crm",
+                    ],
+                )
+            )
+            raise SystemExit(1)
+        resource = "Dynamics CRM"
+        consent_scopes = settings.dynamics_crm_consent_scopes
+        acquire_scopes = settings.dynamics_crm_scopes
+        error_code = "DXS-DYNAMICS-AUTH-001"
+
+    def on_device_code(device_code: dict[str, Any]) -> None:
+        ctx.output(
+            single(
+                item={
+                    "status": "awaiting_authentication",
+                    "action_required": {
+                        "type": "device_code",
+                        "instructions": (
+                            f"Sign in with your Datex account to consent to {resource}"
+                        ),
+                        "url": device_code["verification_uri"],
+                        "code": device_code["user_code"],
+                        "expires_in_seconds": device_code["expires_in"],
+                    },
+                    "message": device_code.get("message", ""),
+                },
+                semantic_key="authentication",
+            ),
+            include_metadata=False,
+        )
+
+    try:
+        outcome = consent_datex_resource(
+            consent_scopes=consent_scopes,
+            acquire_scopes=acquire_scopes,
+            resource=resource,
+            error_code=error_code,
+            on_device_code=on_device_code,
+        )
+    except DxsError as e:
+        ctx.output_error(e)
+        raise SystemExit(1) from None
+
+    ctx.output(
+        single(
+            item={
+                "status": "consented",
+                "message": f"Consent for {resource} granted and verified.",
+                "resource": resource,
+                "account": outcome["identity"],
+                "has_token": True,
+            },
+            semantic_key="authentication",
+        )
+    )
+
+
 def run_standard_device_login(
     ctx: DxsContext,
     on_device_code: Callable[[dict[str, Any]], None],
@@ -64,6 +176,7 @@ def run_standard_device_login(
     organization_id: int | None = None,
     organization_name: str | None = None,
     api_base_url: str | None = None,
+    consent_outcomes: list[ConsentOutcome] | None = None,
 ) -> CachedIdentity:
     """Run the multi-resource device-code login and save the identity.
 
@@ -88,6 +201,11 @@ def run_standard_device_login(
     that target a non-default environment (e.g. ``dxs init --target qa``) must
     pass it so the identity is stamped from the same environment its profile is
     detected against, not the stale lru_cached default.
+
+    ``consent_outcomes``, when given, receives one entry per additional consent
+    round so callers can include failures in their success payload. Failed
+    rounds are always logged as warnings here regardless — an additional
+    resource failing never aborts the login, so this is the only signal.
     """
     from dxs.utils.config import get_settings
 
@@ -117,25 +235,36 @@ def run_standard_device_login(
             tenant is known, so DevOps/CRM consent is requested only for Datex
             staff — a customer must never be prompted for Datex-internal
             resources by name.
+
+            The CRM round requests the *named* scope, not ``.default``:
+            ``.default`` is static consent and fails with AADSTS650057 for any
+            first-time user because Dataverse is not listed on the CLI app
+            registration (issue #135). Token acquisition keeps ``.default``.
             """
             internal = (
                 [
                     settings.azure_devops_scopes,
-                    settings.dynamics_crm_scopes,
-                    settings.dynamics_crm_admin_scopes,
-                    settings.data_export_service_scopes,
+                    settings.dynamics_crm_consent_scopes,
                 ]
                 if claims_are_datex(token_response.get("id_token_claims") or {})
                 else []
             )
             return [scopes for scopes in [*internal, [settings.footprint_scope]] if scopes]
 
+    outcomes: list[ConsentOutcome] = consent_outcomes if consent_outcomes is not None else []
     result = client.authenticate_device_code_multi_resource(
         primary_scopes=settings.azure_scopes,
         additional_scope_sets=additional_scope_sets,
         on_device_code=on_device_code,
         on_additional_consent_needed=consent_cb,
+        consent_outcomes=outcomes,
     )
+    for entry in consent_failure_items(outcomes):
+        detail = entry["error_description"] or entry["error"] or "unknown error"
+        warning = f"WARNING: consent for {entry['resource']} was not obtained: {detail}"
+        if "suggestion" in entry:
+            warning += f" {entry['suggestion']}"
+        ctx.log(warning)
 
     saved_identity = cache.save_identity(
         result,
@@ -173,13 +302,16 @@ def _auth_success_item(
     saved_identity: CachedIdentity,
     *,
     message: str = "Successfully authenticated",
+    consent_outcomes: list[ConsentOutcome] | None = None,
 ) -> dict[str, Any]:
     """Build the standard ``authenticated`` response payload shared by the login paths.
 
     The external-tenant descriptor is derived from the saved identity — never from
     which CLI flags were passed — so the payload cannot disagree with the cache
     (a --tenant-id login with the home tenant is persisted as internal). Adds the
-    ``footprint_daemon_auth`` marker when the identity carries daemon creds.
+    ``footprint_daemon_auth`` marker when the identity carries daemon creds, and
+    ``consent_failures`` when an additional consent round failed — the primary
+    login succeeded, so this is where a missing consent becomes visible.
     """
     item: dict[str, Any] = {
         "status": "authenticated",
@@ -194,6 +326,9 @@ def _auth_success_item(
     item["expires_at"] = saved_identity.expires_at.isoformat()
     if saved_identity.footprint_client_id:
         item["footprint_daemon_auth"] = "configured"
+    failures = consent_failure_items(consent_outcomes)
+    if failures:
+        item["consent_failures"] = failures
     return item
 
 
@@ -279,6 +414,16 @@ def auth() -> None:
     default=None,
     help="Entra domain (e.g. csw-wi.com) — resolves the tenant ID for you",
 )
+@click.option(
+    "--consent",
+    "consent_resource",
+    type=click.Choice(["devops", "crm"]),
+    default=None,
+    help=(
+        "Only (re)run the consent round for one Datex-internal resource, using the "
+        "cached Datex identity — no full re-login"
+    ),
+)
 @pass_context
 def login(
     ctx: DxsContext,
@@ -287,6 +432,7 @@ def login(
     client_secret: str | None,
     tenant_id: str | None,
     domain: str | None,
+    consent_resource: str | None,
 ) -> None:
     """Authenticate with Azure Entra using device code flow.
 
@@ -307,6 +453,9 @@ def login(
     credentials) authentication for the Footprint API, needed for cross-tenant
     access where OBO flow is not available.
 
+    Use --consent devops|crm (Datex staff) to grant a missing consent for one
+    internal resource without re-running the whole login.
+
     \b
     Examples:
         dxs auth login                        # Login to default tenant
@@ -314,6 +463,7 @@ def login(
         dxs auth login --domain csw-wi.com    # Bootstrap: no identity required
         dxs auth login --tenant-id <guid>     # Same, when you know the GUID
         dxs auth login CAG --client-id <id> --client-secret <secret>
+        dxs auth login --consent devops       # Grant the missing DevOps consent only
     """
     _reject_tenant_override(ctx, "login")
 
@@ -331,6 +481,23 @@ def login(
         )
         raise SystemExit(1)
 
+    if consent_resource:
+        if org or tenant_id or domain or client_id or client_secret:
+            ctx.output_error(
+                ValidationError(
+                    message=(
+                        "--consent runs a single consent round for the cached Datex "
+                        "identity; it cannot be combined with an organization, tenant, "
+                        "or daemon credentials"
+                    ),
+                    code="DXS-AUTH-024",
+                    suggestions=["Run 'dxs auth login --consent devops|crm' by itself"],
+                )
+            )
+            raise SystemExit(1)
+        _run_targeted_consent(ctx, consent_resource)
+        return
+
     if org and (tenant_id or domain):
         ctx.output_error(
             ValidationError(
@@ -380,6 +547,7 @@ def login(
                 include_metadata=False,
             )
 
+        external_outcomes: list[ConsentOutcome] = []
         try:
             saved_identity = run_standard_device_login(
                 ctx,
@@ -388,12 +556,15 @@ def login(
                 client_secret=client_secret,
                 tenant_id=tenant_id,
                 domain=domain,
+                consent_outcomes=external_outcomes,
             )
         except AuthenticationError as e:
             ctx.output_error(e)
             raise SystemExit(1) from None
 
-        external_success_item = _auth_success_item(saved_identity)
+        external_success_item = _auth_success_item(
+            saved_identity, consent_outcomes=external_outcomes
+        )
         ctx.output(single(item=external_success_item, semantic_key="authentication"))
         return
 
@@ -438,6 +609,7 @@ def login(
             include_metadata=False,
         )
 
+    login_outcomes: list[ConsentOutcome] = []
     try:
         saved_identity = run_standard_device_login(
             ctx,
@@ -445,12 +617,13 @@ def login(
             client_id=client_id,
             client_secret=client_secret,
             on_additional_consent_needed=on_additional_consent_needed,
+            consent_outcomes=login_outcomes,
         )
     except AuthenticationError as e:
         ctx.output_error(e)
         raise SystemExit(1) from None
 
-    success_item = _auth_success_item(saved_identity)
+    success_item = _auth_success_item(saved_identity, consent_outcomes=login_outcomes)
     ctx.output(single(item=success_item, semantic_key="authentication"))
 
 
@@ -1415,7 +1588,9 @@ def _switch_by_organization(
         # Home-tenant org (Datex, or an org with no tenant of its own): the
         # current identity's tokens already cover it, but the org binding on
         # the cached identity must still be re-pointed at the requested org.
-        _rebind_home_tenant_identity(ctx, cache, org_info)
+        _rebind_home_tenant_identity(
+            ctx, cache, org_info, client_id=client_id, client_secret=client_secret
+        )
         return
 
     # Step 4: Reject a misregistered home-tenant org BEFORE any identity lookup —
@@ -1551,6 +1726,8 @@ def _rebind_home_tenant_identity(
     ctx: DxsContext,
     cache: MultiIdentityTokenCache,
     org_info: Any,
+    client_id: str | None = None,
+    client_secret: str | None = None,
 ) -> None:
     """Re-point the active home-tenant identity at ``org_info`` (issue #112).
 
@@ -1561,6 +1738,10 @@ def _rebind_home_tenant_identity(
     made the silent no-op hard to spot — while writes fail with a misleading
     ``DXS-API-400``. Only the two org fields move; tokens and the active
     identity selection stay untouched (the issue #83 contract).
+
+    Supplied daemon credentials are persisted on the active identity on both
+    outcomes (issue #133) — the same contract the other org-switch branches
+    honor. Without credentials, the already-bound outcome writes nothing.
     """
     active = cache.get_active_identity()
     if active is None or identity_needs_tenant_authority(active):
@@ -1587,27 +1768,29 @@ def _rebind_home_tenant_identity(
         )
         raise SystemExit(1)
 
+    storage_key = cache.resolve_stored_key(active) or active.identity_key
+
     already_bound = active.organization_id == org_info.id and (
         (active.organization_name or "").lower() == org_info.name.lower()
     )
     if already_bound:
-        ctx.output(
-            single(
-                item={
-                    "status": "no_action_required",
-                    "message": (
-                        f"Active identity is already bound to organization '{org_info.name}'"
-                    ),
-                    "active_identity": active.account_username,
-                    "organization": org_info.name,
-                    "organization_id": org_info.id,
-                },
-                semantic_key="authentication",
-            )
-        )
+        identity = active
+        if client_id and client_secret:
+            with_creds = cache.update_identity_daemon_creds(storage_key, client_id, client_secret)
+            if with_creds is not None:
+                identity = with_creds
+        item: dict[str, Any] = {
+            "status": "no_action_required",
+            "message": (f"Active identity is already bound to organization '{org_info.name}'"),
+            "active_identity": active.account_username,
+            "organization": org_info.name,
+            "organization_id": org_info.id,
+        }
+        if identity.footprint_client_id:
+            item["footprint_daemon_auth"] = "configured"
+        ctx.output(single(item=item, semantic_key="authentication"))
         return
 
-    storage_key = cache.resolve_stored_key(active) or active.identity_key
     updated = cache.update_identity_org_info(storage_key, org_info.id, org_info.name)
     if updated is None:
         ctx.output_error(
@@ -1618,23 +1801,26 @@ def _rebind_home_tenant_identity(
         )
         raise SystemExit(1)
 
-    ctx.output(
-        single(
-            item={
-                "status": "organization_rebound",
-                "message": (
-                    f"Re-bound the active identity to organization '{org_info.name}' "
-                    "(home tenant; no login required)"
-                ),
-                "active_identity": active.account_username,
-                "organization": org_info.name,
-                "organization_id": org_info.id,
-                "previous_organization": active.organization_name,
-                "previous_organization_id": active.organization_id,
-            },
-            semantic_key="authentication",
-        )
-    )
+    if client_id and client_secret:
+        with_creds = cache.update_identity_daemon_creds(storage_key, client_id, client_secret)
+        if with_creds is not None:
+            updated = with_creds
+
+    item = {
+        "status": "organization_rebound",
+        "message": (
+            f"Re-bound the active identity to organization '{org_info.name}' "
+            "(home tenant; no login required)"
+        ),
+        "active_identity": active.account_username,
+        "organization": org_info.name,
+        "organization_id": org_info.id,
+        "previous_organization": active.organization_name,
+        "previous_organization_id": active.organization_id,
+    }
+    if updated.footprint_client_id:
+        item["footprint_daemon_auth"] = "configured"
+    ctx.output(single(item=item, semantic_key="authentication"))
 
 
 def _handled_home_tenant_external_org(ctx: DxsContext, org_info: Any) -> bool:
@@ -1726,6 +1912,7 @@ def _authenticate_external_tenant(
             include_metadata=False,
         )
 
+    org_outcomes: list[ConsentOutcome] = []
     try:
         ctx.log(f"Initiating device code authentication for {org_info.name}...")
         saved_identity = run_standard_device_login(
@@ -1739,11 +1926,13 @@ def _authenticate_external_tenant(
             external_entra_id=org_info.external_entra_id,
             organization_id=org_info.id,
             organization_name=org_info.name,
+            consent_outcomes=org_outcomes,
         )
 
         success_item = _auth_success_item(
             saved_identity,
             message=f"Successfully authenticated with {org_info.name}",
+            consent_outcomes=org_outcomes,
         )
         ctx.output(single(item=success_item, semantic_key="authentication"))
 

{datex_studio_cli-0.4.19 → datex_studio_cli-0.4.21}/src/dxs/commands/explore.py

@@ -337,7 +337,7 @@ def _build_config_index(client: ApiClient, branch_id: int, ctx: DxsContext) -> C
                     )
         except ApiError as e:
             # Log JSON parse errors as warnings (e.g., endpoints type)
-            if e.code == "DXS-API-JSON-001":
+            if e.code in ("DXS-API-JSON-001", "DXS-API-ROUTE-404"):
                 ctx.log(f"Warning: {ctype} returned non-JSON response")
             # Other API errors are expected (type may not exist)
         except Exception: