datex-studio-cli 0.5.4__tar.gz → 0.5.6__tar.gz

{datex_studio_cli-0.5.4 → datex_studio_cli-0.5.6}/.github/workflows/promote-prod.yml

@@ -82,6 +82,7 @@ jobs:
           fi
       - name: Commit the prod digest bump
         run: |
+          set -euo pipefail
           digest='${{ steps.resolve.outputs.digest }}'
           sed -i -E "s|^  digest:.*|  digest: \"${digest}\"|" quartermaster/deploy/prod/values.yaml
           if git diff --quiet; then
@@ -94,11 +95,24 @@ jobs:
           git commit \
             -m "chore(deploy): prod → ${digest}" \
             -m "Promoted by @${{ github.actor }} via promote-prod (ref input: ${{ inputs.ref }})"
+          # Same collision release.yml handles: main moves under us while the
+          # job runs. Only one ref goes up here, so there is nothing for
+          # --atomic to make atomic — the asymmetry with release.yml is the
+          # point, not an oversight. What does carry over is checking the
+          # rebase. Unchecked, a conflicted one left HEAD detached at main's
+          # tip — someone else's promotion — where the next iteration's push is
+          # "Everything up-to-date" and the loop exits 0. A green run that
+          # promoted nothing, on the workflow that moves prod.
           for attempt in 1 2 3; do
             if git push origin HEAD:main; then
               exit 0
             fi
-            git pull --rebase origin main
+            echo "push attempt ${attempt} lost a race with another push to main; rebasing" >&2
+            if ! git pull --rebase origin main; then
+              git rebase --abort || true
+              echo "could not rebase the prod bump onto main — nothing was pushed; re-dispatch once main is settled" >&2
+              exit 1
+            fi
           done
-          echo "prod bump push failed after 3 attempts" >&2
+          echo "prod bump push failed after 3 attempts — nothing landed, re-dispatch" >&2
           exit 1

datex_studio_cli-0.5.6/.github/workflows/release.yml

@@ -0,0 +1,178 @@
+# The CLI's PyPI release lane (spec §5), retiring publish.sh and ~/.pypirc.
+# Two ways in, one publish path:
+#   - tag push vX.Y.Z — versions must already be aligned across pyproject,
+#     __init__, and uv.lock (the uv.lock entry is the one nothing else updates)
+#   - manual dispatch with an optional `version` input — the workflow bumps
+#     pyproject/__init__/uv.lock, commits to main, tags vX.Y.Z, then publishes.
+#     A blank input publishes the version already in the files (the retry lane
+#     for a release that failed after its bump commit landed).
+#     The bump's branch+tag push is atomic and rebase-retried: main pushes race
+#     with it for the whole CI wait, and a lost race must leave nothing behind
+#     rather than a bump commit with no tag.
+# Both lanes: full CI → version-agreement assert → frontend build with a hard
+# existence check (the gitignored web/static/ ships via hatch `artifacts`,
+# which silently includes nothing when absent) → uv build + publish via PyPI
+# trusted publishing.
+# Prerequisite: a trusted publisher for this repo/workflow configured on PyPI.
+name: Release to PyPI
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "New version (X.Y.Z) — bumps files, commits to main, tags, publishes. Blank — publish the version already in the files."
+        required: false
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-pypi
+
+jobs:
+  ci:
+    uses: ./.github/workflows/ci.yml
+
+  publish:
+    needs: ci
+    runs-on: arc-dxs
+    timeout-minutes: 30
+    permissions:
+      contents: write # the dispatch lane pushes the bump commit + tag
+      id-token: write # PyPI trusted publishing
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # The bump lane rebases onto main when it loses a push race; a
+          # depth-1 checkout has no history to rebase against.
+          fetch-depth: 0
+      - uses: astral-sh/setup-uv@v10.0.1
+        with:
+          enable-cache: true
+          cache-suffix: release
+          download-from-astral-mirror: false
+      - run: uv python install 3.13
+      - name: Bump version, commit, and tag (dispatch with a version input)
+        if: github.event_name == 'workflow_dispatch' && inputs.version != ''
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          set -euo pipefail
+          if [ "${GITHUB_REF}" != "refs/heads/main" ]; then
+            echo "version bumps may only be dispatched from main (got ${GITHUB_REF})" >&2
+            exit 1
+          fi
+          if ! echo "$VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "version must be X.Y.Z (got '$VERSION')" >&2
+            exit 1
+          fi
+          tag="v$VERSION"
+          # The version-reuse guard, checked before anything is written: a taken
+          # version fails here rather than surfacing later as a push rejection
+          # that reads like a lost race.
+          if git ls-remote --exit-code --tags origin "refs/tags/${tag}" >/dev/null 2>&1; then
+            echo "${tag} already exists on origin — pick a new version, or re-dispatch with a blank version input to publish the version already in the files" >&2
+            exit 1
+          fi
+          # A tag is permanent, and the agreement assert below runs after this
+          # step — too late to stop a bad one. A tag pushed onto files that
+          # disagree burns the version outright: the assert then fails the
+          # release, and the version can never be retried either, because the
+          # preflight above refuses a tag that exists. So agreement is checked
+          # here, before either lane pushes. (The assert step stays: it is the
+          # only check for the tag-push and blank-version lanes, which never
+          # reach this step.)
+          assert_versions_agree() {
+            local pyproject init lock
+            pyproject=$(grep -m1 '^version = ' pyproject.toml | cut -d'"' -f2)
+            init=$(grep -m1 '__version__' src/dxs/__init__.py | cut -d'"' -f2)
+            lock=$(awk '/^name = "datex-studio-cli"$/ {found=1} found && /^version = / {print; exit}' uv.lock | cut -d'"' -f2)
+            if [ "$pyproject" != "$VERSION" ] || [ "$init" != "$VERSION" ] || [ "$lock" != "$VERSION" ]; then
+              echo "version files disagree with ${VERSION} (pyproject=${pyproject} __init__=${init} uv.lock=${lock}) — align all three, run 'uv lock', commit, then re-dispatch; nothing was pushed" >&2
+              exit 1
+            fi
+          }
+          current=$(grep -m1 '^version = ' pyproject.toml | cut -d'"' -f2)
+          if [ "$VERSION" = "$current" ]; then
+            # The bump commit already landed and only the tag is missing (a
+            # half-done state older runs could leave behind). Nothing to push to
+            # main, so no race to lose — but a partial bump, where pyproject
+            # moved and __init__/uv.lock did not, reaches exactly here.
+            assert_versions_agree
+            git tag "${tag}"
+            git push origin "refs/tags/${tag}"
+            exit 0
+          fi
+          sed -i "s/^version = \".*\"/version = \"$VERSION\"/" pyproject.toml
+          sed -i "s/^__version__ = \".*\"/__version__ = \"$VERSION\"/" src/dxs/__init__.py
+          uv lock
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add pyproject.toml src/dxs/__init__.py uv.lock
+          git commit -m "Bump version to $VERSION"
+          assert_versions_agree
+          # Branch and tag go up together. The race window here is the whole CI
+          # wait, and any merge during it triggers a staging-digest bump that
+          # pushes to main — so losing a push is normal and gets a rebase-retry,
+          # exactly as promote-prod.yml does. --atomic is what keeps a lost race
+          # from being worse than a retry: without it a branch push that lands
+          # ahead of a failing tag push leaves main carrying "Bump version to
+          # X.Y.Z" with no tag and nothing published.
+          for attempt in 1 2 3; do
+            # Re-pointed on every attempt, not once before the loop: a rebase
+            # replays the bump onto a new commit, and the tag has to follow it
+            # rather than the commit the rebase left behind.
+            git tag -f "${tag}"
+            if git push --atomic origin HEAD:main "refs/tags/${tag}"; then
+              exit 0
+            fi
+            # The preflight cleared this tag, so a rejection is normally the
+            # lost race a rebase fixes. If the tag itself appeared meanwhile,
+            # rebasing can never help and the advice below would send the
+            # operator to a re-dispatch the preflight then refuses.
+            if git ls-remote --exit-code --tags origin "refs/tags/${tag}" >/dev/null 2>&1; then
+              echo "${tag} appeared on origin while this run was pushing — nothing landed from this run; pick a new version" >&2
+              exit 1
+            fi
+            echo "push attempt ${attempt} lost a race with another push to main; rebasing" >&2
+            if ! git pull --rebase origin main; then
+              git rebase --abort || true
+              echo "could not rebase the bump commit onto main — nothing was pushed; re-dispatch the same version once main is settled" >&2
+              exit 1
+            fi
+          done
+          echo "bump push failed after 3 attempts — --atomic means nothing landed, so re-dispatch the same version" >&2
+          exit 1
+      - name: Assert expected version == pyproject == __init__ == uv.lock
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          pyproject=$(grep -m1 '^version = ' pyproject.toml | cut -d'"' -f2)
+          init=$(grep -m1 '__version__' src/dxs/__init__.py | cut -d'"' -f2)
+          lock=$(awk '/^name = "datex-studio-cli"$/ {found=1} found && /^version = / {print; exit}' uv.lock | cut -d'"' -f2)
+          if [ "${GITHUB_EVENT_NAME}" = "push" ]; then
+            expected="${GITHUB_REF#refs/tags/v}"
+          else
+            expected="${VERSION:-$pyproject}"
+          fi
+          echo "expected=${expected} pyproject=${pyproject} __init__=${init} uv.lock=${lock}"
+          if [ "$expected" != "$pyproject" ] || [ "$pyproject" != "$init" ] || [ "$pyproject" != "$lock" ]; then
+            echo "version sources disagree — run 'uv lock' and align all three before releasing" >&2
+            exit 1
+          fi
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+      - name: Build the web UI (shipped via hatch artifacts)
+        working-directory: src/dxs/web/frontend
+        run: |
+          npm ci
+          npm run build
+      - name: Assert the frontend build actually produced the static export
+        run: test -f src/dxs/web/static/index.html
+      - run: uv build
+      - name: Publish via trusted publishing
+        run: uv publish

{datex_studio_cli-0.5.4 → datex_studio_cli-0.5.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: datex-studio-cli
-Version: 0.5.4
+Version: 0.5.6
 Summary: CLI for Datex Studio low-code platform, designed for LLM-based AI agents
 Project-URL: Homepage, https://github.com/datex/datex-studio-cli
 Project-URL: Documentation, https://github.com/datex/datex-studio-cli

{datex_studio_cli-0.5.4 → datex_studio_cli-0.5.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "datex-studio-cli"
-version = "0.5.4"
+version = "0.5.6"
 description = "CLI for Datex Studio low-code platform, designed for LLM-based AI agents"
 readme = "README.md"
 license = "MIT"
@@ -165,6 +165,7 @@ markers = [
     "telemetry_live: run without the suite-wide DXS_TELEMETRY=0 kill-switch",
     "live_auth: sign in against real Entra tenants (opt-in; needs DXS_LIVE_AUTH=1 + a human)",
     "mssql: integration tests against a throwaway SQL Server container (opt-in; needs DXS_MSSQL_TEST=1)",
+    "schema_capability_probe: exercise the real Indexes capability probe (no assumed-capable override)",
 ]
 
 [tool.coverage.run]

{datex_studio_cli-0.5.4 → datex_studio_cli-0.5.6}/src/dxs/__init__.py

@@ -1,4 +1,4 @@
 """Datex Studio CLI - Command-line interface for Datex Studio platform."""
 
-__version__ = "0.5.4"
+__version__ = "0.5.6"
 __app_name__ = "dxs"

{datex_studio_cli-0.5.4 → datex_studio_cli-0.5.6}/src/dxs/cli.py

@@ -1,14 +1,16 @@
 """Main CLI entry point for Datex Studio CLI."""
 
+import errno
+import os
 import sys
 from collections.abc import Callable
-from typing import Any, TypeVar, cast
+from typing import Any, NoReturn, TypeVar, cast
 
 import click
 
 from dxs import __app_name__, __version__
 from dxs.context import DxsContext, pass_context  # re-exported for backward compat
-from dxs.core.auth.datex_tenant import DATEX_INTERNAL_COMMANDS, internal_commands_available
+from dxs.core.auth.datex_tenant import InternalCommandGateMixin
 from dxs.core.output import OutputFormat, format_error
 from dxs.core.output.redaction import (
     AUTHOR_VERBOSE_FIELDS as _AUTHOR_VERBOSE_FIELDS,  # noqa: F401 — re-exported
@@ -121,12 +123,12 @@ HIDDEN_COMMAND_ALIASES = frozenset({"config"})
 RAW_ARGS_META_KEY = "dxs.raw_args"
 
 
-class DxsGroup(click.Group):
+class DxsGroup(InternalCommandGateMixin, click.Group):
     """Custom Group that shows global options in subcommand help.
 
-    Also gates the Datex-internal command groups (``devops``, ``crm``). The gate
-    is applied at lookup time rather than at registration so it reflects the
-    identity cache as of *this* invocation — registration happens once at import.
+    Gating of the Datex-internal command groups comes from
+    :class:`InternalCommandGateMixin`, shared with the subgroups that hold one
+    (``dxs source branch workitem``).
     """
 
     def invoke(self, ctx: click.Context) -> Any:
@@ -136,28 +138,20 @@ class DxsGroup(click.Group):
         so ``_resolve_command_path`` reads them back from ``ctx.meta``.
         """
         ctx.meta[RAW_ARGS_META_KEY] = [*getattr(ctx, "_protected_args", []), *ctx.args]
-        return super().invoke(ctx)
-
-    def _is_gated(self, cmd_name: str) -> bool:
-        """Whether ``cmd_name`` is Datex-internal and unavailable to this user."""
-        return cmd_name in DATEX_INTERNAL_COMMANDS and not internal_commands_available()
+        try:
+            return super().invoke(ctx)
+        except (BrokenPipeError, OSError) as e:
+            # Handle a closed stdout here, inside Click's own invoke, rather
+            # than around cli(): Click catches EPIPE itself and exits 1, so by
+            # the time main() sees anything it is a SystemExit. Raising
+            # SystemExit from here passes straight through that handler.
+            if not _is_broken_pipe(e):
+                raise
+            _exit_broken_pipe()
 
     def list_commands(self, ctx: click.Context) -> list[str]:
         """List visible subcommands, omitting hidden aliases and gated groups."""
-        return [
-            name
-            for name in super().list_commands(ctx)
-            if name not in HIDDEN_COMMAND_ALIASES and not self._is_gated(name)
-        ]
-
-    def get_command(self, ctx: click.Context, cmd_name: str) -> click.Command | None:
-        """Resolve a subcommand, refusing unavailable Datex-internal groups."""
-        if self._is_gated(cmd_name):
-            ctx.fail(
-                f"'{cmd_name}' is a Datex-internal command group and requires a "
-                "Datex tenant identity. Run 'dxs auth login' with your Datex account."
-            )
-        return super().get_command(ctx, cmd_name)
+        return [name for name in super().list_commands(ctx) if name not in HIDDEN_COMMAND_ALIASES]
 
     def format_options(self, ctx: click.Context, formatter: click.HelpFormatter) -> None:
         """Write options to the formatter, including global options."""
@@ -547,6 +541,15 @@ def handle_errors(f: F) -> F:
             _record_error_silently(e, dxs_ctx)
             dxs_ctx.output_error(e)
             sys.exit(1)
+        except (BrokenPipeError, OSError) as e:
+            # A closed stdout is not a command failure: re-raise so main()
+            # can silence it. Rendering an error envelope here would both
+            # lie to the user and record a bogus command.error.
+            if not _is_broken_pipe(e):
+                _record_error_silently(e, dxs_ctx)
+                dxs_ctx.output_error(e)
+                sys.exit(1)
+            raise
         except (click.ClickException, click.Abort, click.exceptions.Exit):
             # Let Click handle its own exceptions and control-flow signals
             # (Abort from confirm(abort=True), Exit from ctx.exit) — these are
@@ -560,6 +563,67 @@ def handle_errors(f: F) -> F:
     return cast(F, wrapper)
 
 
+#: 128 + SIGPIPE, the conventional shell status for "died because the pipe closed".
+BROKEN_PIPE_EXIT_CODE = 141
+
+
+def _is_broken_pipe(exc: BaseException) -> bool:
+    """True when ``exc`` is stdout's consumer going away rather than a failure.
+
+    POSIX raises ``BrokenPipeError`` (EPIPE). Windows has no SIGPIPE and instead
+    fails the underlying ``flush()`` with ``OSError [Errno 22] Invalid argument``
+    — so EINVAL counts only there, since on POSIX it means a hundred other
+    things and must not be mistaken for a closed pipe.
+    """
+    if isinstance(exc, BrokenPipeError):
+        return True
+    if not isinstance(exc, OSError):
+        return False
+    if exc.errno == errno.EPIPE:
+        return True
+    return exc.errno == errno.EINVAL and sys.platform == "win32"
+
+
+def _silence_stdout() -> None:
+    """Point stdout at devnull so interpreter shutdown cannot re-raise.
+
+    Python flushes the standard streams on exit; against a closed pipe that
+    raises a second time, past any handler we control, and CPython prints
+    "Exception ignored in: <_io.TextIOWrapper name='<stdout>'>". Redirecting the
+    file descriptor is the documented way to avoid it. Best-effort: under pytest
+    or Click's CliRunner stdout is a StringIO with no real fileno.
+    """
+    devnull = None
+    try:
+        devnull = os.open(os.devnull, os.O_WRONLY)
+        os.dup2(devnull, sys.stdout.fileno())
+    except Exception:  # noqa: BLE001 - silencing output must never itself fail
+        pass
+    finally:
+        if devnull is not None:
+            try:
+                os.close(devnull)
+            except OSError:
+                pass
+
+
+def _exit_broken_pipe() -> NoReturn:
+    """Leave quietly after the consumer of stdout went away."""
+    _silence_stdout()
+    _record_broken_pipe_silently()
+    sys.exit(BROKEN_PIPE_EXIT_CODE)
+
+
+def _record_broken_pipe_silently() -> None:
+    """Record a closed pipe as a completed run, never as command.error."""
+    try:
+        from dxs.core.telemetry import record_end
+
+        record_end(exit_code=BROKEN_PIPE_EXIT_CODE)
+    except Exception:  # noqa: BLE001
+        pass
+
+
 def _record_error_silently(exc: BaseException, dxs_ctx: "DxsContext | None" = None) -> None:
     """Emit a telemetry error event; never raises.
 
@@ -850,6 +914,15 @@ def main() -> None:
             # SystemExit from sys.exit() inside handle_errors — telemetry already
             # recorded an error there; just propagate.
             raise
+        except (BrokenPipeError, OSError) as e:
+            if not _is_broken_pipe(e):
+                _record_error_silently(e)
+                raise
+            # The consumer stopped reading (`| head`, an agent that moved on).
+            # Say nothing, record a completed run, and exit on the SIGPIPE
+            # convention so `set -o pipefail` scripts can still tell truncated
+            # output from a clean one.
+            _exit_broken_pipe()
         except BaseException as e:
             # Anything else escaping cli() shouldn't take telemetry with it.
             _record_error_silently(e)