datex-studio-cli 0.4.25__tar.gz → 0.5.1__tar.gz

{datex_studio_cli-0.4.25 → datex_studio_cli-0.5.1}/.github/workflows/build-image.yml

@@ -29,9 +29,9 @@ jobs:
     runs-on: arc-dxs
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
+      - uses: actions/checkout@v7
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -39,7 +39,7 @@ jobs:
       - id: meta
         run: echo "datetag=$(date -u +%Y%m%d).${{ github.run_number }}" >> "$GITHUB_OUTPUT"
       - id: build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: quartermaster/Dockerfile

{datex_studio_cli-0.4.25 → datex_studio_cli-0.5.1}/.github/workflows/ci.yml

@@ -20,12 +20,18 @@ jobs:
     runs-on: arc-dxs
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.0.1
         with:
           enable-cache: true
+          # Distinct per-job key: cli and service run in parallel and would
+          # otherwise race to save the same cache entry (noisy warning).
+          cache-suffix: cli
+          # The releases.astral.sh mirror 404s from the arc-dxs runners and
+          # every download falls back to GitHub Releases anyway — skip it.
+          download-from-astral-mirror: false
       - run: uv python install 3.13
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
       - name: Build the report renderer bundle (snapshot tests shell out to it)
@@ -35,19 +41,19 @@ jobs:
           npm run build:render-cli
       - run: uv sync --all-packages --extra dev
       - run: uv run ruff check .
-      - name: mypy (non-blocking — 21 pre-existing errors, see #171)
-        run: uv run mypy src/dxs
-        continue-on-error: true
+      - run: uv run mypy src/dxs
       - run: uv run pytest -q
 
   service:
     runs-on: arc-dxs
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.0.1
         with:
           enable-cache: true
+          cache-suffix: service
+          download-from-astral-mirror: false
       - run: uv python install 3.13
       - run: uv sync --all-packages --extra dev
       - run: uv run ruff check quartermaster

{datex_studio_cli-0.4.25 → datex_studio_cli-0.5.1}/.github/workflows/promote-prod.yml

@@ -39,7 +39,7 @@ jobs:
             echo "confirmation mismatch: expected the literal string promote-to-prod" >&2
             exit 1
           fi
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - id: resolve

{datex_studio_cli-0.4.25 → datex_studio_cli-0.5.1}/.github/workflows/release.yml

@@ -41,10 +41,12 @@ jobs:
       contents: write # the dispatch lane pushes the bump commit + tag
       id-token: write # PyPI trusted publishing
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.0.1
         with:
           enable-cache: true
+          cache-suffix: release
+          download-from-astral-mirror: false
       - run: uv python install 3.13
       - name: Bump version, commit, and tag (dispatch with a version input)
         if: github.event_name == 'workflow_dispatch' && inputs.version != ''
@@ -91,7 +93,7 @@ jobs:
             echo "version sources disagree — run 'uv lock' and align all three before releasing" >&2
             exit 1
           fi
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
       - name: Build the web UI (shipped via hatch artifacts)

{datex_studio_cli-0.4.25 → datex_studio_cli-0.5.1}/.gitignore

@@ -102,3 +102,12 @@ test-preview.svg
 
 # CAC working copies (dxs ng harnesses) — never committed
 /components/
+
+# Live auth matrix config (real accounts)
+tests/live/accounts.local.json
+
+# Project-scope `dxs skills` install artifacts (.claude/skills is above).
+# Canonical copies, the codex symlink tree, and the install record.
+.agents/
+.codex/
+skills-lock.json

{datex_studio_cli-0.4.25 → datex_studio_cli-0.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: datex-studio-cli
-Version: 0.4.25
+Version: 0.5.1
 Summary: CLI for Datex Studio low-code platform, designed for LLM-based AI agents
 Project-URL: Homepage, https://github.com/datex/datex-studio-cli
 Project-URL: Documentation, https://github.com/datex/datex-studio-cli
@@ -77,7 +77,7 @@ pip install datex-studio-cli
 ## Quick Start
 
 ```bash
-# Authenticate with Azure Entra
+# Authenticate with Azure Entra (opens your browser; device code when headless)
 dxs auth login
 
 # Check authentication status
@@ -203,11 +203,19 @@ Set `DXS_RESTRICTED_MODE=1` to block potentially dangerous operations:
 
 | Command | Description |
 |---------|-------------|
-| `login` | Authenticate with Azure Entra (device code flow) |
+| `login [selector]` | Sign in — browser + PKCE by default, device code when headless or with `--use-device-code`/`--no-browser` |
 | `logout` | Clear credentials (`--all` for all identities) |
 | `status` | Show current authentication status and token expiration |
 | `list` | List all cached identities |
-| `switch <identity>` | Switch to a different cached identity |
+| `switch <selector>` | Switch identity (username, org, Entra domain, or tenant ID) |
+
+One selector grammar is shared by `login`, `switch`, and `init`: an email
+address derives the tenant from its domain (works on a fresh machine), a
+domain or tenant GUID names the tenant directly, anything else is an
+organization name. `--domain`/`--tenant-id` name the tenant to authenticate
+against and always win; combined with an email selector they express a guest
+signing in to another organization's tenant. A usable cached identity for the
+target skips the browser entirely (`--force` re-authenticates).
 
 **Multi-Identity Workflow:**
 
@@ -215,14 +223,18 @@ Set `DXS_RESTRICTED_MODE=1` to block potentially dangerous operations:
 # Login to primary organization
 dxs auth login
 
-# Login to additional organization (prompts for new auth)
-dxs auth login --org other-org
+# Customer self-service: the tenant is derived from your address
+dxs auth login you@csw-wi.com
+
+# Login to an additional organization (fresh auth against its tenant)
+dxs auth login OtherOrg
 
 # List all identities
 dxs auth list
 
-# Switch between organizations
-dxs auth switch other-org
+# Switch between identities — org name, domain, tenant ID, or username
+dxs auth switch OtherOrg
+dxs auth switch csw-wi.com
 ```
 
 ### CLI Settings (`dxs settings`)

{datex_studio_cli-0.4.25 → datex_studio_cli-0.5.1}/README.md

@@ -24,7 +24,7 @@ pip install datex-studio-cli
 ## Quick Start
 
 ```bash
-# Authenticate with Azure Entra
+# Authenticate with Azure Entra (opens your browser; device code when headless)
 dxs auth login
 
 # Check authentication status
@@ -150,11 +150,19 @@ Set `DXS_RESTRICTED_MODE=1` to block potentially dangerous operations:
 
 | Command | Description |
 |---------|-------------|
-| `login` | Authenticate with Azure Entra (device code flow) |
+| `login [selector]` | Sign in — browser + PKCE by default, device code when headless or with `--use-device-code`/`--no-browser` |
 | `logout` | Clear credentials (`--all` for all identities) |
 | `status` | Show current authentication status and token expiration |
 | `list` | List all cached identities |
-| `switch <identity>` | Switch to a different cached identity |
+| `switch <selector>` | Switch identity (username, org, Entra domain, or tenant ID) |
+
+One selector grammar is shared by `login`, `switch`, and `init`: an email
+address derives the tenant from its domain (works on a fresh machine), a
+domain or tenant GUID names the tenant directly, anything else is an
+organization name. `--domain`/`--tenant-id` name the tenant to authenticate
+against and always win; combined with an email selector they express a guest
+signing in to another organization's tenant. A usable cached identity for the
+target skips the browser entirely (`--force` re-authenticates).
 
 **Multi-Identity Workflow:**
 
@@ -162,14 +170,18 @@ Set `DXS_RESTRICTED_MODE=1` to block potentially dangerous operations:
 # Login to primary organization
 dxs auth login
 
-# Login to additional organization (prompts for new auth)
-dxs auth login --org other-org
+# Customer self-service: the tenant is derived from your address
+dxs auth login you@csw-wi.com
+
+# Login to an additional organization (fresh auth against its tenant)
+dxs auth login OtherOrg
 
 # List all identities
 dxs auth list
 
-# Switch between organizations
-dxs auth switch other-org
+# Switch between identities — org name, domain, tenant ID, or username
+dxs auth switch OtherOrg
+dxs auth switch csw-wi.com
 ```
 
 ### CLI Settings (`dxs settings`)

{datex_studio_cli-0.4.25 → datex_studio_cli-0.5.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "datex-studio-cli"
-version = "0.4.25"
+version = "0.5.1"
 description = "CLI for Datex Studio low-code platform, designed for LLM-based AI agents"
 readme = "README.md"
 license = "MIT"
@@ -149,6 +149,10 @@ ignore_missing_imports = true
 module = ["fastapi.*", "uvicorn.*"]
 ignore_missing_imports = true
 
+[[tool.mypy.overrides]]
+module = ["pyodbc"]
+ignore_missing_imports = true
+
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 python_files = ["test_*.py"]
@@ -159,6 +163,8 @@ markers = [
     "internal_commands_gated: exercise the devops/crm visibility gate (no DXS_INTERNAL_COMMANDS override)",
     "real_auth_state: exercise real auth state (no injected DXS_ACCESS_TOKEN; the variable is scrubbed)",
     "telemetry_live: run without the suite-wide DXS_TELEMETRY=0 kill-switch",
+    "live_auth: sign in against real Entra tenants (opt-in; needs DXS_LIVE_AUTH=1 + a human)",
+    "mssql: integration tests against a throwaway SQL Server container (opt-in; needs DXS_MSSQL_TEST=1)",
 ]
 
 [tool.coverage.run]

datex_studio_cli-0.5.1/scripts/datadog_errors.py

@@ -0,0 +1,275 @@
+# /// script
+# requires-python = ">=3.10"
+# dependencies = ["httpx", "python-dotenv"]
+# ///
+"""Pull recent CLI error events from Datadog Logs for investigation.
+
+Queries the Datadog Logs Search API for ``service:dxs-cli status:error`` (the
+telemetry forwarder's shape — see docs/telemetry-datadog-mapping.md) and prints
+either a summary grouped by command + error code, or the raw events.
+
+Credentials come from the project ``.env``: DATADOG_API_KEY, DATADOG_APP_KEY,
+DATADOG_SITE (e.g. ``us3.datadoghq.com``).
+
+Usage:
+    uv run scripts/datadog_errors.py                          # last 24h, summary
+    uv run scripts/datadog_errors.py --since 7d               # last 7 days
+    uv run scripts/datadog_errors.py --since 7d --list        # one line per event
+    uv run scripts/datadog_errors.py --code DXS-API-001 --detail   # full stacks
+    uv run scripts/datadog_errors.py --command source --version 0.5.0 -f json
+    uv run scripts/datadog_errors.py -q 'usr.email:*@datexcorp.com'  # extra filter
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import re
+import sys
+import time
+from collections import Counter, defaultdict
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+from typing import Any
+
+SUMMARY_FIELDS = (
+    "ts",
+    "command",
+    "error_code",
+    "error_class",
+    "error_message",
+    "cli_version",
+    "api_target",
+    "env",
+    "usr_email",
+    "org",
+    "os",
+)
+
+
+def parse_since(value: str) -> timedelta:
+    m = re.fullmatch(r"(\d+)([mhd])", value.strip())
+    if not m:
+        raise argparse.ArgumentTypeError("expected like 30m, 6h, 7d")
+    n, unit = int(m.group(1)), m.group(2)
+    return timedelta(**{{"m": "minutes", "h": "hours", "d": "days"}[unit]: n})
+
+
+def build_query(args: argparse.Namespace) -> str:
+    parts = [f"service:{args.service}", "status:error"]
+    if args.env:
+        parts.append(f"env:{args.env}")
+    if args.api_target:
+        parts.append(f"@api_target:{args.api_target}")
+    if args.code:
+        parts.append(f"@error_code:{args.code}")
+    if args.command:
+        parts.append(f'@command:"{args.command}"')
+    if args.version:
+        parts.append(f"@version:{args.version}")
+    if args.query:
+        parts.append(f"({args.query})")
+    return " ".join(parts)
+
+
+def fetch_events(
+    site: str, api_key: str, app_key: str, query: str, since: timedelta, limit: int
+) -> list[dict[str, Any]]:
+    import httpx
+
+    now = datetime.now(timezone.utc)
+    body: dict[str, Any] = {
+        "filter": {
+            "query": query,
+            "from": (now - since).isoformat(),
+            "to": now.isoformat(),
+        },
+        "sort": "-timestamp",
+        "page": {"limit": min(limit, 1000)},
+    }
+    headers = {
+        "DD-API-KEY": api_key,
+        "DD-APPLICATION-KEY": app_key,
+        "Content-Type": "application/json",
+    }
+    events: list[dict[str, Any]] = []
+    retries = 0
+    with httpx.Client(base_url=f"https://api.{site}", headers=headers, timeout=30) as client:
+        while True:
+            resp = client.post("/api/v2/logs/events/search", json=body)
+            if resp.status_code == 429 and retries < 3:
+                wait = int(
+                    resp.headers.get("Retry-After") or resp.headers.get("X-RateLimit-Reset") or 5
+                )
+                print(f"rate limited; retrying in {wait}s", file=sys.stderr)
+                time.sleep(wait)
+                retries += 1
+                continue
+            if resp.status_code != 200:
+                print(f"Datadog API {resp.status_code}: {resp.text[:500]}", file=sys.stderr)
+                sys.exit(1)
+            payload = resp.json()
+            events.extend(payload.get("data", []))
+            cursor = payload.get("meta", {}).get("page", {}).get("after")
+            if not cursor or len(events) >= limit:
+                break
+            body["page"]["cursor"] = cursor
+    return events[:limit]
+
+
+def full_command(group: str | None, argv: Any) -> str | None:
+    """`command` is only the Click group (e.g. `configuration`); recover the
+    subcommand path from argv: the bare-word tokens that follow the group."""
+    if not group or not isinstance(argv, list):
+        return group
+    try:
+        i = argv.index(group)
+    except ValueError:
+        return group
+    words = [group]
+    for tok in argv[i + 1 : i + 3]:
+        if isinstance(tok, str) and re.fullmatch(r"[a-z][a-z-]*", tok):
+            words.append(tok)
+        else:
+            break
+    return " ".join(words)
+
+
+def flatten(event: dict[str, Any]) -> dict[str, Any]:
+    """Reduce a Datadog log event to the attributes worth reading."""
+    attrs = event.get("attributes", {})
+    custom = attrs.get("attributes", {})  # user attributes live one level down
+    tags = dict(t.split(":", 1) for t in attrs.get("tags", []) if ":" in t)
+    usr = custom.get("usr", {}) or {}
+    err = custom.get("error", {}) or {}
+    return {
+        "id": event.get("id"),
+        "ts": attrs.get("timestamp"),
+        "message": attrs.get("message"),
+        "command": full_command(custom.get("command"), custom.get("argv")),
+        "argv": custom.get("argv"),
+        "error_code": custom.get("error_code") or tags.get("error_code"),
+        "error_class": custom.get("error_class") or err.get("kind"),
+        "error_message": custom.get("error_message") or err.get("message"),
+        "error_stack": custom.get("error_stack") or err.get("stack"),
+        "exit_code": custom.get("exit_code"),
+        "duration_ms": custom.get("duration_ms"),
+        "cli_version": custom.get("version") or tags.get("version"),
+        "org": custom.get("datex_org_name") or tags.get("org"),
+        "python_version": custom.get("python_version"),
+        "os": custom.get("os", {}).get("name")
+        if isinstance(custom.get("os"), dict)
+        else custom.get("os"),
+        "os_release": custom.get("os_release"),
+        "api_target": custom.get("api_target") or tags.get("api_target"),
+        "env": tags.get("env"),
+        "usr_id": usr.get("id"),
+        "usr_email": usr.get("email"),
+        "usr_name": usr.get("name"),
+        "session_id": (custom.get("session") or {}).get("id"),
+        "install_id": custom.get("install_id"),
+        "ctx_branch_id": custom.get("ctx_branch_id"),
+        "ctx_org": custom.get("ctx_org"),
+        "ctx_env": custom.get("ctx_env"),
+    }
+
+
+def print_summary(rows: list[dict[str, Any]]) -> None:
+    if not rows:
+        print("No matching error events.")
+        return
+    groups: dict[tuple[str, str, str], list[dict[str, Any]]] = defaultdict(list)
+    for r in rows:
+        groups[(r["command"] or "?", r["error_code"] or "-", r["error_class"] or "?")].append(r)
+    print(f"{len(rows)} error events, {len(groups)} distinct (command, code, class)\n")
+    print(f"{'count':>5}  {'command':<28} {'code':<14} {'class':<24} sample message")
+    for key, grp in sorted(groups.items(), key=lambda kv: -len(kv[1])):
+        cmd, code, cls = key
+        msg = (grp[0]["error_message"] or "")[:80].replace("\n", " ")
+        print(f"{len(grp):>5}  {cmd:<28} {code:<14} {cls:<24} {msg}")
+        users = Counter(r["usr_email"] or r["usr_name"] or "?" for r in grp)
+        versions = Counter(r["cli_version"] or "?" for r in grp)
+        print(
+            f"       last={grp[0]['ts']}  users={dict(users.most_common(3))}"
+            f"  versions={dict(versions.most_common(3))}"
+        )
+
+
+def print_list(rows: list[dict[str, Any]]) -> None:
+    for r in rows:
+        msg = (r["error_message"] or "")[:100].replace("\n", " ")
+        print(
+            f"{r['ts']}  {r['cli_version'] or '?':<8} {r['usr_email'] or r['usr_name'] or '?':<32}"
+            f" {r['command'] or '?':<28} {r['error_code'] or '-':<14} {msg}"
+        )
+
+
+def print_detail(rows: list[dict[str, Any]]) -> None:
+    for r in rows:
+        print("=" * 100)
+        for k in SUMMARY_FIELDS + ("argv", "ctx_branch_id", "ctx_org", "session_id", "id"):
+            if r.get(k) is not None:
+                print(f"{k:<14} {r[k]}")
+        if r.get("error_stack"):
+            print("--- stack ---")
+            print(r["error_stack"])
+    print("=" * 100)
+
+
+def main(argv: list[str] | None = None) -> None:
+    p = argparse.ArgumentParser(
+        description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter
+    )
+    p.add_argument(
+        "--since",
+        type=parse_since,
+        default="24h",
+        help="lookback window, e.g. 30m, 6h, 7d (default 24h)",
+    )
+    p.add_argument("--service", default="dxs-cli", help="Datadog service tag (default dxs-cli)")
+    p.add_argument("--env", help="ddtag env: staging|prod|local (which Quartermaster received it)")
+    p.add_argument("--api-target", help="dev|qa|prod|default (which Datex environment the CLI hit)")
+    p.add_argument("--code", help="filter by DXS-* error code")
+    p.add_argument(
+        "--command", help="filter by Click group, e.g. configuration (subcommand is only in argv)"
+    )
+    p.add_argument("--version", help="filter by cli_version")
+    p.add_argument("-q", "--query", help="extra raw Datadog log query ANDed onto the filter")
+    p.add_argument("-n", "--limit", type=int, default=500, help="max events to fetch (default 500)")
+    mode = p.add_mutually_exclusive_group()
+    mode.add_argument("--list", action="store_true", help="one line per event")
+    mode.add_argument("--detail", action="store_true", help="every field + stack per event")
+    p.add_argument("-f", "--format", choices=["text", "json"], default="text")
+    p.add_argument("--show-query", action="store_true", help="print the Datadog query and exit")
+    args = p.parse_args(argv)
+
+    from dotenv import load_dotenv
+
+    load_dotenv(Path(__file__).resolve().parent.parent / ".env")
+    api_key, app_key = os.environ.get("DATADOG_API_KEY"), os.environ.get("DATADOG_APP_KEY")
+    site = os.environ.get("DATADOG_SITE", "datadoghq.com")
+    if not api_key or not app_key:
+        print("DATADOG_API_KEY and DATADOG_APP_KEY must be set (expected in .env)", file=sys.stderr)
+        sys.exit(1)
+
+    query = build_query(args)
+    if args.show_query:
+        print(query)
+        return
+    print(f"query: {query}   window: last {args.since}", file=sys.stderr)
+
+    rows = [flatten(e) for e in fetch_events(site, api_key, app_key, query, args.since, args.limit)]
+    if args.format == "json":
+        json.dump(rows, sys.stdout, indent=2, default=str)
+        print()
+    elif args.detail:
+        print_detail(rows)
+    elif args.list:
+        print_list(rows)
+    else:
+        print_summary(rows)
+
+
+if __name__ == "__main__":
+    main()