datex-studio-cli 0.4.9__tar.gz → 0.4.10__tar.gz

{datex_studio_cli-0.4.9 → datex_studio_cli-0.4.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: datex-studio-cli
-Version: 0.4.9
+Version: 0.4.10
 Summary: CLI for Datex Studio low-code platform, designed for LLM-based AI agents
 Project-URL: Homepage, https://github.com/datex/datex-studio-cli
 Project-URL: Documentation, https://github.com/datex/datex-studio-cli

{datex_studio_cli-0.4.9 → datex_studio_cli-0.4.10}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "datex-studio-cli"
-version = "0.4.9"
+version = "0.4.10"
 description = "CLI for Datex Studio low-code platform, designed for LLM-based AI agents"
 readme = "README.md"
 license = "MIT"

{datex_studio_cli-0.4.9 → datex_studio_cli-0.4.10}/src/dxs/__init__.py

@@ -1,4 +1,4 @@
 """Datex Studio CLI - Command-line interface for Datex Studio platform."""
 
-__version__ = "0.4.9"
+__version__ = "0.4.10"
 __app_name__ = "dxs"

{datex_studio_cli-0.4.9 → datex_studio_cli-0.4.10}/src/dxs/commands/auth.py

@@ -14,6 +14,44 @@ from dxs.utils.responses import list_response, single
 from dxs.utils.restricted import restrict_in_restricted_mode
 
 
+def _format_age(seconds: int) -> str:
+    """Human-readable age from a number of seconds."""
+    if seconds < 60:
+        return f"{seconds} seconds"
+    if seconds < 3600:
+        return f"{seconds // 60} minutes"
+    if seconds < 86400:
+        return f"{seconds // 3600} hours"
+    return f"{seconds // 86400} days"
+
+
+def _refresh_token_info(identity: Any, now: datetime) -> dict[str, Any]:
+    """Describe the identity's refresh token: presence and age.
+
+    Azure does not return a refresh-token expiry, so we surface the age of the
+    stored token (recorded when it was obtained) to help diagnose refresh issues.
+    """
+    if not identity.refresh_token:
+        return {
+            "present": False,
+            "note": "No refresh token stored; a full login is required.",
+        }
+
+    info: dict[str, Any] = {
+        "present": True,
+        "note": "Azure does not expose refresh-token expiry; age shown for reference.",
+    }
+    acquired_at = identity.refresh_token_acquired_at
+    if acquired_at is not None:
+        age_seconds = int((now - acquired_at).total_seconds())
+        info["acquired_at"] = acquired_at.isoformat()
+        info["age_human"] = _format_age(max(age_seconds, 0))
+    else:
+        info["acquired_at"] = None
+        info["age_human"] = "unknown (log in again to start tracking age)"
+    return info
+
+
 @click.group()
 def auth() -> None:
     """Authentication commands.
@@ -398,8 +436,8 @@ def status(ctx: DxsContext) -> None:
     # If primary token is expired, try to refresh it
     if is_expired:
         ctx.log("Primary access token is expired, attempting to refresh...")
-        refreshed_token = cache.try_refresh()
-        if refreshed_token:
+        outcome = cache.try_refresh_detailed()
+        if outcome.access_token:
             ctx.log("Successfully refreshed access token")
             refreshed_identity = cache.get_active_identity()
             if refreshed_identity:
@@ -415,6 +453,9 @@ def status(ctx: DxsContext) -> None:
                         "message": "Authentication token has expired and refresh failed",
                         "account": active_identity.account_username,
                         "expired_at": active_identity.expires_at.isoformat(),
+                        "refresh_error": outcome.error,
+                        "refresh_error_description": outcome.error_description,
+                        "refresh_token": _refresh_token_info(active_identity, now),
                         "suggestion": "Run 'dxs auth login' to re-authenticate",
                     },
                     semantic_key="authentication",
@@ -430,9 +471,14 @@ def status(ctx: DxsContext) -> None:
         else:
             return f"{seconds // 3600} hours"
 
-    # Check all cached tokens for each resource
+    # Check all cached tokens for each resource.
+    # External-tenant identities must be probed against their own tenant authority;
+    # redeeming their refresh token against the default tenant returns invalid_grant.
     settings = get_settings()
-    client = MSALClient()
+    if active_identity.external_entra_id and active_identity.tenant_id:
+        client = MSALClient.for_tenant(active_identity.tenant_id)
+    else:
+        client = MSALClient()
 
     resources = {
         "datex_api": {
@@ -525,6 +571,7 @@ def status(ctx: DxsContext) -> None:
                 "expires_in_seconds": expires_in_seconds,
                 "expires_in_human": format_expiration(expires_in_seconds),
             },
+            "refresh_token": _refresh_token_info(active_identity, now),
         },
         "tokens": tokens_info if tokens_info else None,
     }

{datex_studio_cli-0.4.9 → datex_studio_cli-0.4.10}/src/dxs/commands/studio.py

@@ -109,19 +109,41 @@ def _launch_server(port: int, no_browser: bool, dev: bool, replace: bool = False
     uvicorn.run(app, host="127.0.0.1", port=port, log_level="warning", lifespan="on")
 
 
-def _require_server() -> dict[str, int]:
-    """Read the studio lockfile and return server info, or raise an error.
+def _resolve_server_port(probe_port: int) -> int:
+    """Return the port of a running studio server, preferring the lockfile.
 
-    Returns:
-        dict with ``port`` and ``pid`` keys.
+    Falls back to probing the well-known port so a server started in another
+    shell or session is still found even when this process can't read or trust
+    the lockfile — e.g. a sandboxed Claude Code agent shell on Windows whose
+    PID-liveness check or ``Path.home()`` resolves differently than the user's
+    interactive session (issue #38).
 
     Raises:
-        click.ClickException: If no running studio server is found.
+        click.ClickException: If no running studio server can be located.
     """
     lock = read_studio_lock()
-    if lock is None:
-        raise click.ClickException("No studio server running. Start with: dxs studio")
-    return lock
+    if lock is not None:
+        return int(lock["port"])
+    if _port_in_use(probe_port):
+        return probe_port
+    raise click.ClickException("No studio server running. Start with: dxs studio")
+
+
+def _unreachable_error(subcommand: str, port: int, file: str | None, exc: Exception) -> str:
+    """Build an actionable error for a server that is found but unreachable.
+
+    Distinguishes "no server" (handled in :func:`_resolve_server_port`) from
+    "found but the request failed" — typically a sandboxed agent shell that
+    can't open a loopback connection to the user's server.
+    """
+    arg = f" {file}" if file else ""
+    return (
+        f"Found a studio server on port {port} but couldn't reach it: {exc}\n"
+        "If Studio is running in your own terminal and this is a sandboxed agent "
+        "shell (common on Windows), the agent process may be blocked from the "
+        "local server. Run the command in your own session instead:\n"
+        f"  ! dxs studio {subcommand}{arg}"
+    )
 
 
 @click.group(invoke_without_command=True)
@@ -166,18 +188,24 @@ def studio(ctx: click.Context, port: int, no_browser: bool, dev: bool, replace:
 
 @studio.command("open")
 @click.argument("file", type=click.Path())
-def studio_open(file: str) -> None:
+@click.option(
+    "--port",
+    "-p",
+    type=int,
+    default=5051,
+    help="Port to probe when no studio lockfile is present (default: 5051)",
+)
+def studio_open(file: str, port: int) -> None:
     """Open a report file in the studio design canvas.
 
     FILE is the path to a report file (.rdlx-json) to open.
     """
-    lock = _require_server()
-    port = lock["port"]
+    server_port = _resolve_server_port(port)
     resolved = str(Path(file).resolve())
 
     try:
         resp = httpx.post(
-            f"http://127.0.0.1:{port}/api/design/open",
+            f"http://127.0.0.1:{server_port}/api/design/open",
             json={"path": resolved},
             timeout=10.0,
         )
@@ -190,31 +218,69 @@ def studio_open(file: str) -> None:
             raise click.ClickException(detail)
         resp.raise_for_status()
     except httpx.HTTPError as exc:
-        raise click.ClickException(f"Failed to open file in studio: {exc}") from exc
+        raise click.ClickException(_unreachable_error("open", server_port, file, exc)) from exc
 
     data = resp.json()
     file_path = data.get("path", resolved)
-    click.echo(f"Opened {file_path} in studio (http://127.0.0.1:{port}/design)")
+    click.echo(f"Opened {file_path} in studio (http://127.0.0.1:{server_port}/design)")
 
 
 @studio.command("close")
-def studio_close() -> None:
+@click.option(
+    "--port",
+    "-p",
+    type=int,
+    default=5051,
+    help="Port to probe when no studio lockfile is present (default: 5051)",
+)
+def studio_close(port: int) -> None:
     """Close the current design session in studio."""
-    lock = _require_server()
-    port = lock["port"]
+    server_port = _resolve_server_port(port)
 
     try:
         resp = httpx.post(
-            f"http://127.0.0.1:{port}/api/design/close",
+            f"http://127.0.0.1:{server_port}/api/design/close",
             timeout=10.0,
         )
         resp.raise_for_status()
     except httpx.HTTPError as exc:
-        raise click.ClickException(f"Failed to close design session: {exc}") from exc
+        raise click.ClickException(_unreachable_error("close", server_port, None, exc)) from exc
 
     click.echo("Design session closed")
 
 
+@studio.command("stop")
+@click.option(
+    "--port",
+    "-p",
+    type=int,
+    default=5051,
+    help="Port to probe when no studio lockfile is present (default: 5051)",
+)
+def studio_stop(port: int) -> None:
+    """Stop the studio server tracked by the lockfile.
+
+    Only terminates a server whose PID this CLI recorded in its own lockfile;
+    a process we don't manage is never killed.
+    """
+    lock = read_studio_lock()
+    if lock is None:
+        if _port_in_use(port):
+            raise click.ClickException(
+                f"A server is running on port {port} but it isn't tracked by a "
+                "studio lockfile, so it won't be stopped automatically. Stop it "
+                "from the terminal that launched it."
+            )
+        raise click.ClickException("No studio server running.")
+
+    pid = int(lock["pid"])
+    server_port = int(lock["port"])
+    _terminate_pid(pid)
+    _await_port_free(server_port)
+    remove_studio_lock()
+    click.echo(f"Stopped studio (pid {pid}) on port {server_port}.")
+
+
 @studio.command("status")
 @click.option(
     "--port",

{datex_studio_cli-0.4.9 → datex_studio_cli-0.4.10}/src/dxs/core/auth/decorators.py

@@ -9,13 +9,21 @@ from collections.abc import Callable
 from datetime import datetime, timezone
 from typing import Any, TypeVar
 
-from dxs.core.auth.token_cache import CachedIdentity, MultiIdentityTokenCache
+from dxs.core.auth.token_cache import CachedIdentity, MultiIdentityTokenCache, RefreshResult
 from dxs.utils.errors import AuthenticationError
 
 F = TypeVar("F", bound=Callable[..., Any])
 
 logger = logging.getLogger(__name__)
 
+
+def _refresh_failed_message(outcome: RefreshResult) -> str:
+    """Build an error message that includes the underlying refresh failure reason."""
+    base = "Authentication token expired and refresh failed"
+    detail = outcome.error_description or outcome.error
+    return f"{base}: {detail}" if detail else base
+
+
 # Module-level cache for refreshed tokens (avoids repeated refresh calls)
 _env_token_cache: dict[str, tuple[str, datetime]] = {}
 
@@ -167,18 +175,22 @@ def require_auth(f: F) -> F:
 
         if token is None:
             # Token expired or missing - try to refresh
-            refreshed_token = cache.try_refresh()
-            if refreshed_token is not None:
+            outcome = cache.try_refresh_detailed()
+            if outcome.access_token is not None:
                 # Refresh succeeded, continue
                 return f(*args, **kwargs)
 
-            # Refresh failed - raise appropriate error
+            # Refresh failed - raise appropriate error, surfacing the real reason
             identity = cache.get_active_identity()
             if identity is not None:
                 raise AuthenticationError(
-                    message="Authentication token expired and refresh failed",
+                    message=_refresh_failed_message(outcome),
                     code="DXS-AUTH-001",
-                    details={"expired_at": identity.expires_at.isoformat()},
+                    details={
+                        "expired_at": identity.expires_at.isoformat(),
+                        "refresh_error": outcome.error,
+                        "refresh_error_description": outcome.error_description,
+                    },
                     suggestions=[
                         "Run 'dxs auth login' to re-authenticate",
                     ],
@@ -238,16 +250,20 @@ def get_access_token() -> str:
         return token
 
     # Token expired or missing - try to refresh
-    refreshed_token = cache.try_refresh()
-    if refreshed_token is not None:
-        return refreshed_token
+    outcome = cache.try_refresh_detailed()
+    if outcome.access_token is not None:
+        return outcome.access_token
 
-    # Refresh failed - raise appropriate error
+    # Refresh failed - raise appropriate error, surfacing the real reason
     identity = cache.get_active_identity()
     if identity is not None:
         raise AuthenticationError(
-            message="Authentication token expired and refresh failed",
+            message=_refresh_failed_message(outcome),
             code="DXS-AUTH-001",
+            details={
+                "refresh_error": outcome.error,
+                "refresh_error_description": outcome.error_description,
+            },
             suggestions=["Run 'dxs auth login' to re-authenticate"],
         )
     else:
@@ -330,6 +346,12 @@ def get_access_token_for_scopes(scopes: list[str]) -> str:
                 expires_in = result.get("expires_in", 3600)
                 _env_token_cache[cache_key] = (token, datetime.now(timezone.utc))
                 file_cache.save_resource_token(cache_key, token, expires_in)
+                # Persist the rotated refresh token so the stored token stays fresh.
+                # Only for default-tenant identities: this client uses the default
+                # authority, so a rotated token is only valid for such identities.
+                new_rt = result.get("refresh_token")
+                if new_rt and not identity.external_entra_id:
+                    file_cache.update_refresh_token(new_rt)
                 return token
         except Exception as e:
             logger.debug("Failed to acquire token for scopes %s: %s", scopes, e)

{datex_studio_cli-0.4.9 → datex_studio_cli-0.4.10}/src/dxs/core/auth/msal_client.py

@@ -384,24 +384,52 @@ class MSALClient:
 
         return None
 
-    def refresh_access_token(self, refresh_token: str) -> dict[str, Any] | None:
-        """Refresh access token using refresh token grant.
+    def refresh_access_token_detailed(
+        self, refresh_token: str, scopes: list[str] | None = None
+    ) -> dict[str, Any]:
+        """Refresh an access token and return the raw MSAL result.
+
+        Unlike :meth:`refresh_access_token`, this never returns ``None`` and never
+        raises: on success the dict contains ``access_token`` (and usually a rotated
+        ``refresh_token``); on failure it contains ``error`` and ``error_description``
+        (e.g. the underlying ``AADSTS`` code). Callers can surface that reason instead
+        of a generic "refresh failed".
 
         Args:
             refresh_token: The refresh token from a previous authentication.
+            scopes: Scopes to request. Defaults to the client's configured scopes.
 
         Returns:
-            Token response dict if successful, None if refresh failed.
+            The MSAL token response dict, or a synthetic error dict.
         """
         try:
             result = self._app.acquire_token_by_refresh_token(
                 refresh_token=refresh_token,
-                scopes=self._scopes,
+                scopes=scopes or self._scopes,
             )
-            if result and "access_token" in result:
-                return cast(dict[str, Any], result)
         except Exception as e:
             logger.debug("Failed to refresh access token: %s", e)
+            return {"error": "exception", "error_description": str(e)}
+
+        if result:
+            return cast(dict[str, Any], result)
+        return {
+            "error": "no_result",
+            "error_description": "No response received from the token endpoint.",
+        }
+
+    def refresh_access_token(self, refresh_token: str) -> dict[str, Any] | None:
+        """Refresh access token using refresh token grant.
+
+        Args:
+            refresh_token: The refresh token from a previous authentication.
+
+        Returns:
+            Token response dict if successful, None if refresh failed.
+        """
+        result = self.refresh_access_token_detailed(refresh_token)
+        if "access_token" in result:
+            return result
         return None
 
     def get_accounts(self) -> list[dict[str, Any]]: