datex-studio-cli 0.4.24__tar.gz → 0.5.0__tar.gz

{datex_studio_cli-0.4.24 → datex_studio_cli-0.5.0}/.github/workflows/build-image.yml

@@ -29,9 +29,9 @@ jobs:
     runs-on: arc-dxs
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
+      - uses: actions/checkout@v7
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -39,7 +39,7 @@ jobs:
       - id: meta
         run: echo "datetag=$(date -u +%Y%m%d).${{ github.run_number }}" >> "$GITHUB_OUTPUT"
       - id: build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: quartermaster/Dockerfile

{datex_studio_cli-0.4.24 → datex_studio_cli-0.5.0}/.github/workflows/ci.yml

@@ -20,12 +20,18 @@ jobs:
     runs-on: arc-dxs
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.0.1
         with:
           enable-cache: true
+          # Distinct per-job key: cli and service run in parallel and would
+          # otherwise race to save the same cache entry (noisy warning).
+          cache-suffix: cli
+          # The releases.astral.sh mirror 404s from the arc-dxs runners and
+          # every download falls back to GitHub Releases anyway — skip it.
+          download-from-astral-mirror: false
       - run: uv python install 3.13
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
       - name: Build the report renderer bundle (snapshot tests shell out to it)
@@ -35,19 +41,19 @@ jobs:
           npm run build:render-cli
       - run: uv sync --all-packages --extra dev
       - run: uv run ruff check .
-      - name: mypy (non-blocking — 21 pre-existing errors, see #171)
-        run: uv run mypy src/dxs
-        continue-on-error: true
+      - run: uv run mypy src/dxs
       - run: uv run pytest -q
 
   service:
     runs-on: arc-dxs
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.0.1
         with:
           enable-cache: true
+          cache-suffix: service
+          download-from-astral-mirror: false
       - run: uv python install 3.13
       - run: uv sync --all-packages --extra dev
       - run: uv run ruff check quartermaster

{datex_studio_cli-0.4.24 → datex_studio_cli-0.5.0}/.github/workflows/promote-prod.yml

@@ -39,7 +39,7 @@ jobs:
             echo "confirmation mismatch: expected the literal string promote-to-prod" >&2
             exit 1
           fi
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - id: resolve

datex_studio_cli-0.5.0/.github/workflows/release.yml

@@ -0,0 +1,108 @@
+# The CLI's PyPI release lane (spec §5), retiring publish.sh and ~/.pypirc.
+# Two ways in, one publish path:
+#   - tag push vX.Y.Z — versions must already be aligned across pyproject,
+#     __init__, and uv.lock (the uv.lock entry is the one nothing else updates)
+#   - manual dispatch with an optional `version` input — the workflow bumps
+#     pyproject/__init__/uv.lock, commits to main, tags vX.Y.Z, then publishes.
+#     A blank input publishes the version already in the files (the retry lane
+#     for a release that failed after its bump commit landed).
+# Both lanes: full CI → version-agreement assert → frontend build with a hard
+# existence check (the gitignored web/static/ ships via hatch `artifacts`,
+# which silently includes nothing when absent) → uv build + publish via PyPI
+# trusted publishing.
+# Prerequisite: a trusted publisher for this repo/workflow configured on PyPI.
+name: Release to PyPI
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "New version (X.Y.Z) — bumps files, commits to main, tags, publishes. Blank — publish the version already in the files."
+        required: false
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-pypi
+
+jobs:
+  ci:
+    uses: ./.github/workflows/ci.yml
+
+  publish:
+    needs: ci
+    runs-on: arc-dxs
+    timeout-minutes: 30
+    permissions:
+      contents: write # the dispatch lane pushes the bump commit + tag
+      id-token: write # PyPI trusted publishing
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.0.1
+        with:
+          enable-cache: true
+          cache-suffix: release
+          download-from-astral-mirror: false
+      - run: uv python install 3.13
+      - name: Bump version, commit, and tag (dispatch with a version input)
+        if: github.event_name == 'workflow_dispatch' && inputs.version != ''
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          set -euo pipefail
+          if [ "${GITHUB_REF}" != "refs/heads/main" ]; then
+            echo "version bumps may only be dispatched from main (got ${GITHUB_REF})" >&2
+            exit 1
+          fi
+          if ! echo "$VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "version must be X.Y.Z (got '$VERSION')" >&2
+            exit 1
+          fi
+          current=$(grep -m1 '^version = ' pyproject.toml | cut -d'"' -f2)
+          if [ "$VERSION" != "$current" ]; then
+            sed -i "s/^version = \".*\"/version = \"$VERSION\"/" pyproject.toml
+            sed -i "s/^__version__ = \".*\"/__version__ = \"$VERSION\"/" src/dxs/__init__.py
+            uv lock
+            git config user.name "github-actions[bot]"
+            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+            git add pyproject.toml src/dxs/__init__.py uv.lock
+            git commit -m "Bump version to $VERSION"
+            git push origin HEAD:main
+          fi
+          # The tag push is the reuse guard: it fails if v$VERSION already exists.
+          git tag "v$VERSION"
+          git push origin "v$VERSION"
+      - name: Assert expected version == pyproject == __init__ == uv.lock
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          pyproject=$(grep -m1 '^version = ' pyproject.toml | cut -d'"' -f2)
+          init=$(grep -m1 '__version__' src/dxs/__init__.py | cut -d'"' -f2)
+          lock=$(awk '/^name = "datex-studio-cli"$/ {found=1} found && /^version = / {print; exit}' uv.lock | cut -d'"' -f2)
+          if [ "${GITHUB_EVENT_NAME}" = "push" ]; then
+            expected="${GITHUB_REF#refs/tags/v}"
+          else
+            expected="${VERSION:-$pyproject}"
+          fi
+          echo "expected=${expected} pyproject=${pyproject} __init__=${init} uv.lock=${lock}"
+          if [ "$expected" != "$pyproject" ] || [ "$pyproject" != "$init" ] || [ "$pyproject" != "$lock" ]; then
+            echo "version sources disagree — run 'uv lock' and align all three before releasing" >&2
+            exit 1
+          fi
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+      - name: Build the web UI (shipped via hatch artifacts)
+        working-directory: src/dxs/web/frontend
+        run: |
+          npm ci
+          npm run build
+      - name: Assert the frontend build actually produced the static export
+        run: test -f src/dxs/web/static/index.html
+      - run: uv build
+      - name: Publish via trusted publishing
+        run: uv publish

{datex_studio_cli-0.4.24 → datex_studio_cli-0.5.0}/.gitignore

@@ -102,3 +102,6 @@ test-preview.svg
 
 # CAC working copies (dxs ng harnesses) — never committed
 /components/
+
+# Live auth matrix config (real accounts)
+tests/live/accounts.local.json

{datex_studio_cli-0.4.24 → datex_studio_cli-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: datex-studio-cli
-Version: 0.4.24
+Version: 0.5.0
 Summary: CLI for Datex Studio low-code platform, designed for LLM-based AI agents
 Project-URL: Homepage, https://github.com/datex/datex-studio-cli
 Project-URL: Documentation, https://github.com/datex/datex-studio-cli
@@ -77,7 +77,7 @@ pip install datex-studio-cli
 ## Quick Start
 
 ```bash
-# Authenticate with Azure Entra
+# Authenticate with Azure Entra (opens your browser; device code when headless)
 dxs auth login
 
 # Check authentication status
@@ -203,11 +203,19 @@ Set `DXS_RESTRICTED_MODE=1` to block potentially dangerous operations:
 
 | Command | Description |
 |---------|-------------|
-| `login` | Authenticate with Azure Entra (device code flow) |
+| `login [selector]` | Sign in — browser + PKCE by default, device code when headless or with `--use-device-code`/`--no-browser` |
 | `logout` | Clear credentials (`--all` for all identities) |
 | `status` | Show current authentication status and token expiration |
 | `list` | List all cached identities |
-| `switch <identity>` | Switch to a different cached identity |
+| `switch <selector>` | Switch identity (username, org, Entra domain, or tenant ID) |
+
+One selector grammar is shared by `login`, `switch`, and `init`: an email
+address derives the tenant from its domain (works on a fresh machine), a
+domain or tenant GUID names the tenant directly, anything else is an
+organization name. `--domain`/`--tenant-id` name the tenant to authenticate
+against and always win; combined with an email selector they express a guest
+signing in to another organization's tenant. A usable cached identity for the
+target skips the browser entirely (`--force` re-authenticates).
 
 **Multi-Identity Workflow:**
 
@@ -215,14 +223,18 @@ Set `DXS_RESTRICTED_MODE=1` to block potentially dangerous operations:
 # Login to primary organization
 dxs auth login
 
-# Login to additional organization (prompts for new auth)
-dxs auth login --org other-org
+# Customer self-service: the tenant is derived from your address
+dxs auth login you@csw-wi.com
+
+# Login to an additional organization (fresh auth against its tenant)
+dxs auth login OtherOrg
 
 # List all identities
 dxs auth list
 
-# Switch between organizations
-dxs auth switch other-org
+# Switch between identities — org name, domain, tenant ID, or username
+dxs auth switch OtherOrg
+dxs auth switch csw-wi.com
 ```
 
 ### CLI Settings (`dxs settings`)

{datex_studio_cli-0.4.24 → datex_studio_cli-0.5.0}/README.md

@@ -24,7 +24,7 @@ pip install datex-studio-cli
 ## Quick Start
 
 ```bash
-# Authenticate with Azure Entra
+# Authenticate with Azure Entra (opens your browser; device code when headless)
 dxs auth login
 
 # Check authentication status
@@ -150,11 +150,19 @@ Set `DXS_RESTRICTED_MODE=1` to block potentially dangerous operations:
 
 | Command | Description |
 |---------|-------------|
-| `login` | Authenticate with Azure Entra (device code flow) |
+| `login [selector]` | Sign in — browser + PKCE by default, device code when headless or with `--use-device-code`/`--no-browser` |
 | `logout` | Clear credentials (`--all` for all identities) |
 | `status` | Show current authentication status and token expiration |
 | `list` | List all cached identities |
-| `switch <identity>` | Switch to a different cached identity |
+| `switch <selector>` | Switch identity (username, org, Entra domain, or tenant ID) |
+
+One selector grammar is shared by `login`, `switch`, and `init`: an email
+address derives the tenant from its domain (works on a fresh machine), a
+domain or tenant GUID names the tenant directly, anything else is an
+organization name. `--domain`/`--tenant-id` name the tenant to authenticate
+against and always win; combined with an email selector they express a guest
+signing in to another organization's tenant. A usable cached identity for the
+target skips the browser entirely (`--force` re-authenticates).
 
 **Multi-Identity Workflow:**
 
@@ -162,14 +170,18 @@ Set `DXS_RESTRICTED_MODE=1` to block potentially dangerous operations:
 # Login to primary organization
 dxs auth login
 
-# Login to additional organization (prompts for new auth)
-dxs auth login --org other-org
+# Customer self-service: the tenant is derived from your address
+dxs auth login you@csw-wi.com
+
+# Login to an additional organization (fresh auth against its tenant)
+dxs auth login OtherOrg
 
 # List all identities
 dxs auth list
 
-# Switch between organizations
-dxs auth switch other-org
+# Switch between identities — org name, domain, tenant ID, or username
+dxs auth switch OtherOrg
+dxs auth switch csw-wi.com
 ```
 
 ### CLI Settings (`dxs settings`)

{datex_studio_cli-0.4.24 → datex_studio_cli-0.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "datex-studio-cli"
-version = "0.4.24"
+version = "0.5.0"
 description = "CLI for Datex Studio low-code platform, designed for LLM-based AI agents"
 readme = "README.md"
 license = "MIT"
@@ -159,6 +159,7 @@ markers = [
     "internal_commands_gated: exercise the devops/crm visibility gate (no DXS_INTERNAL_COMMANDS override)",
     "real_auth_state: exercise real auth state (no injected DXS_ACCESS_TOKEN; the variable is scrubbed)",
     "telemetry_live: run without the suite-wide DXS_TELEMETRY=0 kill-switch",
+    "live_auth: sign in against real Entra tenants (opt-in; needs DXS_LIVE_AUTH=1 + a human)",
 ]
 
 [tool.coverage.run]

{datex_studio_cli-0.4.24 → datex_studio_cli-0.5.0}/src/dxs/__init__.py

@@ -1,4 +1,4 @@
 """Datex Studio CLI - Command-line interface for Datex Studio platform."""
 
-__version__ = "0.4.24"
+__version__ = "0.5.0"
 __app_name__ = "dxs"

{datex_studio_cli-0.4.24 → datex_studio_cli-0.5.0}/src/dxs/cli.py

@@ -500,7 +500,7 @@ def handle_errors(f: F) -> F:
         try:
             return ctx.invoke(f, *args, **kwargs)
         except DxsError as e:
-            _record_error_silently(e)
+            _record_error_silently(e, dxs_ctx)
             dxs_ctx.output_error(e)
             sys.exit(1)
         except (click.ClickException, click.Abort, click.exceptions.Exit):
@@ -509,19 +509,24 @@ def handle_errors(f: F) -> F:
             # not errors and must not be rendered as error envelopes.
             raise
         except Exception as e:
-            _record_error_silently(e)
+            _record_error_silently(e, dxs_ctx)
             dxs_ctx.output_error(e)
             sys.exit(1)
 
     return cast(F, wrapper)
 
 
-def _record_error_silently(exc: BaseException) -> None:
-    """Emit a telemetry error event; never raises."""
+def _record_error_silently(exc: BaseException, dxs_ctx: "DxsContext | None" = None) -> None:
+    """Emit a telemetry error event; never raises.
+
+    ``dxs_ctx`` is available on the handle_errors path and supplies the same
+    ``ctx_*`` slices success events carry; errors escaping to main() arrive
+    after Click tears the context down and go out without them.
+    """
     try:
         from dxs.core.telemetry import record_error
 
-        record_error(exc)
+        record_error(exc, ctx_extras=_ctx_extras(dxs_ctx))
     except Exception:  # noqa: BLE001
         pass
 
@@ -756,7 +761,8 @@ def update_cmd(yes: bool, check_only: bool) -> None:
     try:
         from dxs.core.telemetry import record_end
 
-        record_end(exit_code=0, ctx_extras={})
+        dxs_ctx = click.get_current_context().find_object(DxsContext)
+        record_end(exit_code=0, ctx_extras=_ctx_extras(dxs_ctx))
     except Exception:  # noqa: BLE001
         pass
     try: