datex-studio-cli 0.5.1__tar.gz → 0.5.3__tar.gz

{datex_studio_cli-0.5.1 → datex_studio_cli-0.5.3}/.github/workflows/ci.yml

@@ -59,3 +59,32 @@ jobs:
       - run: uv run ruff check quartermaster
       - run: uv run --package quartermaster mypy quartermaster/src/quartermaster
       - run: uv run --package quartermaster pytest quartermaster/tests -q
+
+  # The artifact nobody was looking at. 0.5.0 and 0.5.1 both shipped without
+  # dxs.core.quartermaster and dxs.core.skills, and 0.5.1 could not run
+  # `dxs --version` at all -- while this suite was fully green, because tests
+  # import from the source tree and never open the wheel. release.yml calls
+  # this workflow, so a broken artifact now blocks the release too.
+  package:
+    runs-on: arc-dxs
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.0.1
+        with:
+          enable-cache: true
+          cache-suffix: package
+          download-from-astral-mirror: false
+      - run: uv python install 3.13
+      - run: uv build
+      - name: Every package under src/ must be in the wheel
+        run: uv run python scripts/check_wheel_completeness.py
+      - name: The built wheel must actually run
+        run: |
+          # A clean venv, not the workspace: importing from the source tree is
+          # exactly what hid this. Resolve deps from the index like a user does.
+          uv venv /tmp/smoke
+          uv pip install --python /tmp/smoke/bin/python dist/*.whl
+          /tmp/smoke/bin/dxs --version
+          /tmp/smoke/bin/dxs skills --help > /dev/null
+          /tmp/smoke/bin/python -c "import dxs.core.quartermaster, dxs.core.skills"

{datex_studio_cli-0.5.1 → datex_studio_cli-0.5.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: datex-studio-cli
-Version: 0.5.1
+Version: 0.5.3
 Summary: CLI for Datex Studio low-code platform, designed for LLM-based AI agents
 Project-URL: Homepage, https://github.com/datex/datex-studio-cli
 Project-URL: Documentation, https://github.com/datex/datex-studio-cli

{datex_studio_cli-0.5.1 → datex_studio_cli-0.5.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "datex-studio-cli"
-version = "0.5.1"
+version = "0.5.3"
 description = "CLI for Datex Studio low-code platform, designed for LLM-based AI agents"
 readme = "README.md"
 license = "MIT"
@@ -94,7 +94,7 @@ exclude = [
     "documentation/",
     "exploration/",
     "exclude/",
-    "skills/",
+    "/skills/",
     "tests/",
     "publish.sh",
     "*.analysis.md",
@@ -102,7 +102,7 @@ exclude = [
     "uv.lock",
     "src/dxs/web/frontend/",
     "example-reports/",
-    "quartermaster/",
+    "/quartermaster/",
 ]
 
 [tool.uv.workspace]

datex_studio_cli-0.5.3/scripts/check_wheel_completeness.py

@@ -0,0 +1,58 @@
+#!/usr/bin/env python
+"""Assert the built wheel carries every package that exists under src/dxs.
+
+Versions 0.5.0 and 0.5.1 both shipped without ``dxs.core.quartermaster`` and
+``dxs.core.skills``. The sdist exclude list named ``skills/`` and
+``quartermaster/`` to drop the top-level directories of those names; hatchling
+matches an unanchored pattern at any depth, so it dropped the nested packages
+too, and ``uv build`` builds the wheel from the sdist it just made. 0.5.1 could
+not even run ``dxs --version``.
+
+A full green suite said nothing about any of it: tests import from the source
+tree and never open the artifact. This looks at the artifact.
+
+Usage: check_wheel_completeness.py [dist_dir]
+"""
+
+from __future__ import annotations
+
+import sys
+import zipfile
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+SRC = ROOT / "src"
+
+
+def main() -> int:
+    dist = Path(sys.argv[1]) if len(sys.argv) > 1 else ROOT / "dist"
+    wheels = sorted(dist.glob("*.whl"))
+    if not wheels:
+        print(f"no wheel in {dist} — run `uv build` first", file=sys.stderr)
+        return 1
+    wheel = wheels[-1]
+
+    # Every directory holding an __init__.py is a package that must ship.
+    expected = {
+        p.parent.relative_to(SRC).as_posix() for p in SRC.rglob("__init__.py")
+        if "__pycache__" not in p.parts
+    }
+    names = zipfile.ZipFile(wheel).namelist()
+    shipped = {n.rsplit("/", 1)[0] for n in names if n.endswith("/__init__.py")}
+
+    missing = sorted(expected - shipped)
+    if missing:
+        print(f"{wheel.name} is missing {len(missing)} package(s) present in src/:",
+              file=sys.stderr)
+        for m in missing:
+            print(f"  {m}", file=sys.stderr)
+        print("\nUsually an unanchored exclude pattern in pyproject.toml matching a "
+              "nested path — anchor it with a leading slash.", file=sys.stderr)
+        return 1
+
+    print(f"{wheel.name}: all {len(expected)} packages present")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

{datex_studio_cli-0.5.1 → datex_studio_cli-0.5.3}/src/dxs/__init__.py

@@ -1,4 +1,4 @@
 """Datex Studio CLI - Command-line interface for Datex Studio platform."""
 
-__version__ = "0.5.1"
+__version__ = "0.5.3"
 __app_name__ = "dxs"

{datex_studio_cli-0.5.1 → datex_studio_cli-0.5.3}/src/dxs/commands/auth.py

@@ -32,14 +32,38 @@ from dxs.core.auth.token_cache import CachedIdentity, get_identity_override
 from dxs.core.footprint import get_footprint_token
 from dxs.core.onboarding import (
     LoginPresenter,
+    apply_sign_in_tenant_hint,
     human_present,
     map_login_failure,
+    missing_service_principal_tenant,
 )
+from dxs.core.quartermaster.tenants import lookup_sign_in_tenant
 from dxs.utils.errors import AuthenticationError, DxsError, ValidationError
 from dxs.utils.responses import list_response, single
 from dxs.utils.restricted import restrict_in_restricted_mode
 
 
+def _sharpen_missing_service_principal(
+    mapped: AuthenticationError, tenant_id: str | None, raw_error: str
+) -> AuthenticationError:
+    """Ask Quartermaster which tenant the org actually signs in against.
+
+    Only for DXS-AUTH-030, only after the login already failed, and only ever
+    additive: any problem reaching the service leaves the mapped notice as-is.
+    The tenant comes from the caller when it resolved one, and otherwise out of
+    Entra's own error text — a blank-prompt or org-name login never had one.
+    """
+    requested = tenant_id or missing_service_principal_tenant(raw_error)
+    if not requested:
+        return mapped
+    try:
+        return apply_sign_in_tenant_hint(
+            mapped, requested_tenant=requested, sign_in=lookup_sign_in_tenant(requested)
+        )
+    except Exception:  # noqa: BLE001 - never worsen a diagnosed failure
+        return mapped
+
+
 def _reject_tenant_override(ctx: DxsContext, command: str) -> None:
     """Block --tenant on identity-management commands.
 
@@ -333,6 +357,10 @@ def run_standard_login(
         mapped = map_login_failure(
             e, external=tenant_scoped, tenant_id=tenant_id, domain=domain, upn=upn
         )
+        if mapped.code == "DXS-AUTH-030":
+            mapped = _sharpen_missing_service_principal(
+                mapped, tenant_id, f"{e.message} {e.details}"
+            )
         if mapped is e:
             raise
         raise mapped from e

{datex_studio_cli-0.5.1 → datex_studio_cli-0.5.3}/src/dxs/core/onboarding.py

@@ -8,6 +8,7 @@ keeps a hard rule: machine envelopes go to stdout, human chrome to stderr.
 """
 
 import os
+import re
 import shutil
 import sys
 from dataclasses import dataclass, field
@@ -19,6 +20,7 @@ import click
 if TYPE_CHECKING:
     from dxs.context import DxsContext
     from dxs.core.api.client import ApiClient
+    from dxs.core.quartermaster.tenants import SignInTenant
     from dxs.utils.errors import AuthenticationError
 
 
@@ -151,6 +153,51 @@ def detect_profile(client: "ApiClient") -> OnboardingProfile:
     )
 
 
+# AADSTS650052: the tenant holds no service principal for a Datex app, so the
+# sign-in cannot even reach a consent screen. Its prose ("Contact your IT Admin
+# ... or consent to the application") reads as consent-required and is not: no
+# consent granted in the tenant named by the error helps a user whose account
+# lives in a different one, which is the common cause — a work-email domain
+# resolves to the org's own corporate tenant (`homeTenantId`), while Datex
+# provisioned `wavelength<org>.onmicrosoft.com` for them and invited their staff
+# into that. Detected and answered ahead of the consent family for that reason.
+_MISSING_SP_MARKERS = (
+    "aadsts650052",
+    "lacks a service principal",
+)
+
+# The tenant is named in the error text, which is the only source on paths where
+# the caller never resolved one (a blank prompt, an org-name login).
+_MISSING_SP_TENANT = re.compile(
+    r"organization\s+'?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})'?",
+    re.IGNORECASE,
+)
+
+
+def is_missing_service_principal_error(error_text: str) -> bool:
+    """True when the tenant signed in against has no Datex service principal."""
+    text = (error_text or "").lower()
+    return any(marker in text for marker in _MISSING_SP_MARKERS)
+
+
+def missing_service_principal_tenant(error_text: str) -> str | None:
+    """The tenant ID Entra named in an AADSTS650052 failure, if it is there."""
+    match = _MISSING_SP_TENANT.search(error_text or "")
+    return match.group(1) if match else None
+
+
+def render_missing_service_principal_notice(tenant_id: str, domain: str | None) -> str:
+    """Actionable notice for a sign-in scoped to a tenant Datex does not live in."""
+    where = f" ({domain})" if domain else ""
+    tenant = tenant_id or "the tenant you signed in against"
+    return (
+        f"AADSTS650052: tenant {tenant}{where} has no service principal for the Datex apps, "
+        "so no Datex sign-in against it can succeed. A work-email domain resolves to your "
+        "organization's own corporate tenant, which is not where your Datex account lives "
+        "when Datex provisioned a wavelength<org>.onmicrosoft.com tenant for your organization."
+    )
+
+
 # Admin-consent-required failure markers. AADSTS65001 = user/admin has not consented;
 # AADSTS90094 = admin consent required. VERIFY these against a real un-consented tenant
 # during rollout — device-code flow may surface the code in either the primary result
@@ -165,8 +212,15 @@ _CONSENT_ERROR_MARKERS = (
 
 
 def is_consent_required_error(error_text: str) -> bool:
-    """True when an auth failure indicates the app is not consented in the tenant."""
+    """True when an auth failure indicates the app is not consented in the tenant.
+
+    A missing service principal (AADSTS650052) is deliberately excluded: its text
+    carries both "consent" and "IT Admin", so the heuristic below claims it, and
+    every remedy that follows from that answer points at the wrong tenant.
+    """
     text = (error_text or "").lower()
+    if is_missing_service_principal_error(text):
+        return False
     if any(marker in text for marker in _CONSENT_ERROR_MARKERS):
         return True
     # Catch phrasings like "admin approval required" / "has not consented".
@@ -248,7 +302,9 @@ def map_login_failure(
     are external-tenant only: both are meaningless for the home tenant, where
     the app is consented and every user is a member. The Conditional Access
     notice is not, because that policy is configured per tenant and the home
-    tenant can adopt it like any other.
+    tenant can adopt it like any other. Neither is the missing-service-principal
+    notice: it names the tenant Entra refused, which it carries in its own text,
+    so it stays diagnostic on the paths where the caller resolved no tenant at all.
     """
     from dxs.utils.errors import AuthenticationError
 
@@ -266,6 +322,22 @@ def map_login_failure(
                 "If you are on a remote host, sign in locally and copy ~/.datex/credentials.yaml",
             ],
         )
+    if is_missing_service_principal_error(combined):
+        tenant = tenant_id or missing_service_principal_tenant(combined) or ""
+        consent_hint = "dxs auth consent" + (f" --tenant-id {tenant}" if tenant else "")
+        return AuthenticationError(
+            message=render_missing_service_principal_notice(tenant, domain),
+            code="DXS-AUTH-030",
+            suggestions=[
+                "dxs init --domain wavelength<org>.onmicrosoft.com   "
+                "# sign in against the tenant Datex provisioned for you",
+                "Sign in there with the same work email — the tenant only decides which "
+                "directory issues the token, not which credentials you type",
+                "Ask Datex support which Entra tenant your organization signs in against",
+                "If your organization does sign in with its own tenant, a tenant admin "
+                f"must grant consent first: {consent_hint}",
+            ],
+        )
     if not external:
         return error
     if upn and is_guest_account_error(combined):
@@ -286,6 +358,58 @@ def map_login_failure(
     return error
 
 
+def apply_sign_in_tenant_hint(
+    error: "AuthenticationError",
+    *,
+    requested_tenant: str,
+    sign_in: "SignInTenant | None",
+) -> "AuthenticationError":
+    """Replace the generic AADSTS650052 advice with this org's actual tenant.
+
+    :func:`map_login_failure` can only describe the *shape* of the fix, since
+    nothing local knows which directory a given organization signs in against.
+    Given Quartermaster's answer, the advice collapses to one command — or, when
+    the tenant that refused the login is the right one after all, to the consent
+    route instead. ``sign_in`` of None (unknown org, service unreachable, older
+    service) leaves the generic notice exactly as it was.
+    """
+    from dxs.utils.errors import AuthenticationError
+
+    if sign_in is None:
+        return error
+
+    if sign_in.tenant_id.strip().lower() == requested_tenant.strip().lower():
+        return AuthenticationError(
+            message=(
+                f"AADSTS650052: {requested_tenant} is the tenant your organization signs in "
+                "against, so the Datex apps have simply never been consented there — no "
+                "service principal for them exists in it yet."
+            ),
+            code="DXS-AUTH-030",
+            suggestions=[
+                f"A tenant admin runs once: dxs auth consent --tenant-id {requested_tenant}",
+                "A blank Microsoft page carrying admin_consent=True is success, not a failure",
+                "Then retry the login",
+            ],
+        )
+
+    target = sign_in.domain or sign_in.tenant_id
+    flag = f"--domain {sign_in.domain}" if sign_in.domain else f"--tenant-id {sign_in.tenant_id}"
+    return AuthenticationError(
+        message=(
+            f"AADSTS650052: your organization signs in against {target}, not tenant "
+            f"{requested_tenant} — that one is only where your work-email domain resolves, "
+            "and the Datex apps do not exist in it."
+        ),
+        code="DXS-AUTH-030",
+        suggestions=[
+            f"dxs init {flag}",
+            "Sign in there with the same work email — you are a guest in that directory, so "
+            "your own organization's credentials still apply",
+        ],
+    )
+
+
 def browser_allowed(no_browser: bool = False) -> bool:
     """Whether login chrome may open (or be) a browser.
 

datex_studio_cli-0.5.3/src/dxs/core/quartermaster/__init__.py

@@ -0,0 +1,5 @@
+"""Quartermaster companion-service client (spec §10, §16)."""
+
+from dxs.core.quartermaster.client import QuartermasterClient, QuartermasterError
+
+__all__ = ["QuartermasterClient", "QuartermasterError"]

datex_studio_cli-0.5.3/src/dxs/core/quartermaster/client.py

@@ -0,0 +1,190 @@
+"""The shared Quartermaster HTTP helper for interactive families (spec §16).
+
+House rules it enforces so every family inherits them:
+
+- ``User-Agent: dxs-cli/{__version__}`` on every request — the per-version
+  traffic view the sunset rule reads.
+- A bare 404 on a family route means the service predates the CLI: mapped to
+  a plain "doesn't serve {family}/{segment}" error. A 404 *with* the
+  structured ``{"error": {...}}`` body is the family's own answer and is
+  surfaced as-is.
+- Tolerant reader: unknown response fields are ignored; genuine failures
+  surface the service's machine-readable code — fail loud, never guess.
+
+Telemetry does not use this helper (fire-and-forget, frozen sender).
+"""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+import httpx
+
+from dxs import __version__
+from dxs.core.auth.decorators import get_access_token
+from dxs.utils.config import get_settings
+from dxs.utils.errors import AuthenticationError, DxsError
+
+_FAMILY_ROUTE = re.compile(r"^/(?P<family>[a-z][a-z0-9_-]*)/(?P<segment>v\d+)(?:/|$)")
+
+
+class QuartermasterError(DxsError):
+    """A Quartermaster request failed; ``service_code`` carries the structured code, if any."""
+
+    def __init__(
+        self,
+        message: str,
+        code: str = "DXS-QM-003",
+        *,
+        service_code: str | None = None,
+        status_code: int | None = None,
+        suggestions: list[str] | None = None,
+        details: dict[str, Any] | None = None,
+    ) -> None:
+        details = dict(details or {})
+        if service_code is not None:
+            details["service_code"] = service_code
+        if status_code is not None:
+            details["status_code"] = status_code
+        super().__init__(code=code, message=message, details=details, suggestions=suggestions)
+        self.service_code = service_code
+        self.status_code = status_code
+
+
+def _family_and_segment(path: str) -> str:
+    match = _FAMILY_ROUTE.match(path)
+    if match is None:
+        return path
+    return f"{match.group('family')}/{match.group('segment')}"
+
+
+def _structured_error(response: httpx.Response) -> dict[str, Any] | None:
+    try:
+        body = response.json()
+    except ValueError:
+        return None
+    error = body.get("error") if isinstance(body, dict) else None
+    return error if isinstance(error, dict) else None
+
+
+class QuartermasterClient:
+    def __init__(self, base_url: str | None = None, timeout: float = 30.0) -> None:
+        resolved = base_url if base_url is not None else get_settings().quartermaster_base_url
+        if not resolved:
+            raise QuartermasterError(
+                "Quartermaster base URL is not configured",
+                code="DXS-QM-001",
+                suggestions=[
+                    "Set DXS_QUARTERMASTER_BASE_URL, or quartermaster_base_url in "
+                    "~/.datex/config.yaml",
+                ],
+            )
+        self.base_url = resolved.rstrip("/")
+        self._timeout = timeout
+        self._client: httpx.Client | None = None
+
+    # -- lifecycle -------------------------------------------------------
+
+    def _http(self) -> httpx.Client:
+        if self._client is None:
+            self._client = httpx.Client(
+                base_url=self.base_url,
+                timeout=self._timeout,
+                verify=get_settings().verify_ssl,
+                headers={"User-Agent": f"dxs-cli/{__version__}"},
+            )
+        return self._client
+
+    def close(self) -> None:
+        if self._client is not None:
+            self._client.close()
+            self._client = None
+
+    def __enter__(self) -> QuartermasterClient:
+        return self
+
+    def __exit__(self, *_: Any) -> None:
+        self.close()
+
+    # -- requests --------------------------------------------------------
+
+    def _request(
+        self, path: str, params: dict[str, Any] | None, accept: str, *, anonymous: bool = False
+    ) -> httpx.Response:
+        """``anonymous`` omits the bearer entirely — not merely optional.
+
+        The bootstrap route (`/tenants/v1/signin-tenant`) is reached while a
+        login is failing, so there is no token to attach and asking for one
+        would raise where the caller needs an answer or a shrug.
+        """
+        headers = {"Accept": accept}
+        if not anonymous:
+            headers["Authorization"] = f"Bearer {get_access_token()}"
+        try:
+            response = self._http().get(path, params=params, headers=headers)
+        except httpx.HTTPError as exc:
+            raise QuartermasterError(
+                f"Could not reach Quartermaster at {self.base_url}: {exc}",
+                code="DXS-QM-004",
+                suggestions=[
+                    "Check your network connection",
+                    "If you point at a staging or local instance, verify "
+                    "DXS_QUARTERMASTER_BASE_URL",
+                ],
+            ) from exc
+        self._raise_for_status(path, response)
+        return response
+
+    def _raise_for_status(self, path: str, response: httpx.Response) -> None:
+        if response.is_success:
+            return
+        status = response.status_code
+        if status == 401:
+            raise AuthenticationError(
+                message="Quartermaster rejected the access token",
+                code="DXS-AUTH-001",
+                suggestions=["Run 'dxs auth login' to refresh your session"],
+            )
+        error = _structured_error(response)
+        if error is not None:
+            message = str(error.get("message") or f"Quartermaster returned {status}")
+            extra = {k: v for k, v in error.items() if k not in ("code", "message")}
+            raise QuartermasterError(
+                message,
+                service_code=str(error.get("code")) if error.get("code") else None,
+                status_code=status,
+                details=extra or None,
+            )
+        if status == 404:
+            route = _family_and_segment(path)
+            raise QuartermasterError(
+                f"Quartermaster at {self.base_url} doesn't serve {route} — "
+                "the service may be older than your CLI",
+                code="DXS-QM-002",
+                status_code=status,
+                suggestions=[
+                    "Check DXS_QUARTERMASTER_BASE_URL points at a current Quartermaster",
+                ],
+            )
+        raise QuartermasterError(
+            f"Quartermaster returned HTTP {status} for {path}",
+            status_code=status,
+        )
+
+    def get_json(
+        self, path: str, params: dict[str, Any] | None = None, *, anonymous: bool = False
+    ) -> Any:
+        response = self._request(path, params, "application/json", anonymous=anonymous)
+        try:
+            return response.json()
+        except ValueError as exc:
+            raise QuartermasterError(
+                f"Quartermaster returned a non-JSON body for {path}", status_code=200
+            ) from exc
+
+    def get_bytes(
+        self, path: str, params: dict[str, Any] | None = None
+    ) -> tuple[bytes, dict[str, str]]:
+        response = self._request(path, params, "application/gzip, application/json")
+        return response.content, {k.lower(): v for k, v in response.headers.items()}

datex_studio_cli-0.5.3/src/dxs/core/quartermaster/tenants.py

@@ -0,0 +1,57 @@
+"""Which Entra tenant an organization signs in against (`/tenants/v1/`).
+
+The bootstrap half of the AADSTS650052 recovery: a work-email domain resolves,
+through Entra's public discovery document, to the caller's own corporate
+tenant — which for every org Datex provisioned a `wavelength<org>.onmicrosoft.com`
+tenant for is the wrong directory. Quartermaster holds the org records that map
+one to the other and answers anonymously, which is what makes it reachable from
+a login that has just failed.
+
+Every failure is a shrug. This runs on an error path, after a login already
+failed with a diagnosis in hand: a Quartermaster that is down, slow, blocked by
+a corporate proxy, older than this CLI, or simply not configured must leave that
+diagnosis alone rather than replace it with a worse one.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from dxs.core.quartermaster.client import QuartermasterClient
+
+# Short on purpose: a failed login is already waiting on this.
+_TIMEOUT_SECONDS = 5.0
+
+
+@dataclass(frozen=True)
+class SignInTenant:
+    """The directory an org authenticates against; ``domain`` when one is recorded."""
+
+    tenant_id: str
+    domain: str | None
+
+
+def lookup_sign_in_tenant(tenant_id: str) -> SignInTenant | None:
+    """Resolve ``tenant_id`` to the tenant its organization signs in against.
+
+    Returns None for every failure and for an unrecognized tenant — callers use
+    it to sharpen an error, never to decide whether one occurred.
+    """
+    try:
+        with QuartermasterClient(timeout=_TIMEOUT_SECONDS) as client:
+            body = client.get_json(
+                "/tenants/v1/signin-tenant", {"tenant": tenant_id}, anonymous=True
+            )
+    except Exception:  # noqa: BLE001 - best-effort by contract; see module docstring
+        return None
+
+    if not isinstance(body, dict):
+        return None
+    resolved = body.get("sign_in_tenant_id")
+    if not isinstance(resolved, str) or not resolved.strip():
+        return None
+    domain = body.get("sign_in_domain")
+    return SignInTenant(
+        tenant_id=resolved.strip(),
+        domain=domain.strip() if isinstance(domain, str) and domain.strip() else None,
+    )

datex_studio_cli-0.5.3/src/dxs/core/skills/__init__.py

@@ -0,0 +1 @@
+"""Skill management (``dxs skills``, issue #95): layout, lockfile, installer, resolver."""

datex_studio_cli-0.5.3/src/dxs/core/skills/frontmatter.py

@@ -0,0 +1,30 @@
+"""Read a skill's frontmatter from an installed copy (offline ``remove``/``doctor``)."""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+
+def parse_frontmatter(text: str) -> dict[str, Any]:
+    if not text.startswith("---"):
+        return {}
+    end = text.find("\n---", 3)
+    if end == -1:
+        return {}
+    try:
+        doc = yaml.safe_load(text[3:end])
+    except yaml.YAMLError:
+        return {}
+    return doc if isinstance(doc, dict) else {}
+
+
+def installed_depends(skill_dir: Path) -> list[str]:
+    skill_md = skill_dir / "SKILL.md"
+    if not skill_md.is_file():
+        return []
+    meta = parse_frontmatter(skill_md.read_text(encoding="utf-8", errors="replace"))
+    raw = meta.get("depends") or []
+    return [str(d) for d in raw] if isinstance(raw, list) else []