delphi-code 0.2.0__py3-none-any.whl → 0.2.2__py3-none-any.whl

delphi_code/hosts.py

@@ -8,7 +8,7 @@ import subprocess
 import sys
 from typing import Any, NamedTuple
 from urllib.error import HTTPError, URLError
-from urllib.parse import quote, urlencode
+from urllib.parse import quote, urlencode, urlsplit
 from urllib.request import Request, urlopen
 
 if __package__:
@@ -24,6 +24,11 @@ class Owner(NamedTuple):
     name: str
 
 
+class ApiCredentials(NamedTuple):
+    authorization: str
+    source: str
+
+
 class Repository(NamedTuple):
     host: str
     owner: str
@@ -43,6 +48,7 @@ class RepositoryHost:
     default_api_base: str
     credentials_hint: str
     rejected_credentials_hint = ""
+    missing_permission_hint = ""
 
     def __init__(self, api_authorization=None):
         self._given_api_authorization = api_authorization
@@ -57,11 +63,14 @@ class RepositoryHost:
     def permalink_template(self, owner, repository, commit):
         raise NotImplementedError
 
+    def suggested_owner(self):
+        return None
+
     def clone_credentials(self):
         raise NotImplementedError
 
     def has_api_credentials(self):
-        return bool(self._available_api_authorization)
+        return self._available_api_credentials is not None
 
     def owners(self):
         return [Owner(**item) for item in self._list_in_child_process("owners")]
@@ -69,7 +78,7 @@ class RepositoryHost:
     def repositories(self, owner):
         return [Repository(**item) for item in self._list_in_child_process("repositories", owner)]
 
-    def _find_api_authorization(self):
+    def _find_api_credentials(self):
         raise NotImplementedError
 
     def _list_owners(self):
@@ -93,19 +102,21 @@ class RepositoryHost:
         return os.environ.get(f"{self._variable_prefix}_API_BASE", self.default_api_base).rstrip("/")
 
     @cached_property
-    def _available_api_authorization(self):
-        return self._given_api_authorization or self._find_api_authorization()
+    def _available_api_credentials(self):
+        if self._given_api_authorization:
+            return ApiCredentials(self._given_api_authorization, "given credentials")
+        return self._find_api_credentials()
 
     @property
-    def _api_authorization(self):
-        authorization = self._available_api_authorization
-        if not authorization:
+    def _api_credentials(self):
+        credentials = self._available_api_credentials
+        if credentials is None:
             raise Failure(
                 "remote_auth_missing",
                 f"Listing {self.name} repositories needs credentials: {self.credentials_hint}",
                 ExitCode.RUNTIME_ASSETS,
             )
-        return authorization
+        return credentials
 
     def _repository(self, owner, slug, description, private):
         return Repository(self.domain, owner, slug, description or "", bool(private))
@@ -129,7 +140,8 @@ class RepositoryHost:
             return json.load(response), (response.headers.get("Link") if response.headers else None) or ""
 
     def _list_in_child_process(self, listing, *arguments) -> list[dict]:
-        environment = dict(os.environ, DELPHI_CODE_API_AUTHORIZATION=self._api_authorization)
+        credentials = self._api_credentials
+        environment = dict(os.environ, DELPHI_CODE_API_AUTHORIZATION=credentials.authorization)
         try:
             result = subprocess.run(
                 [sys.executable, __file__, self.domain, listing, *arguments],
@@ -152,10 +164,18 @@ class RepositoryHost:
         if result.returncode == 0:
             return payload
         error = payload.get("error", {})
-        if error.get("status") in (401, 403):
+        if error.get("status") == 401:
             raise Failure(
                 "remote_auth_failed",
-                f"{self.name} refused the credentials: {error['message']}. {self.rejected_credentials_hint or self.credentials_hint}",
+                f"{self.name} rejected the {credentials.source}: {error['message']}. "
+                f"{self.rejected_credentials_hint or self.credentials_hint}",
+                ExitCode.OPERATION,
+            )
+        if error.get("status") == 403:
+            raise Failure(
+                "remote_permission_denied",
+                f"{self.name} accepted the {credentials.source} but refused {error.get('path')}: {error['message']}. "
+                f"{self.missing_permission_hint}",
                 ExitCode.OPERATION,
             )
         raise Failure(
@@ -170,39 +190,43 @@ class Bitbucket(RepositoryHost):
     default_api_base = "https://api.bitbucket.org/2.0"
     credentials_hint = "set BITBUCKET_USERNAME and BITBUCKET_APP_PASSWORD, or store git credentials for bitbucket.org"
     rejected_credentials_hint = "With an API token, set BITBUCKET_EMAIL to your Atlassian account email"
+    missing_permission_hint = (
+        "Listing needs an API token with the scopes read:user:bitbucket, read:workspace:bitbucket and "
+        "read:repository:bitbucket, or an app password with Account, Workspace membership and Repositories read access"
+    )
     _repository_fields = "next,values.slug,values.description,values.is_private"
 
     def permalink_template(self, owner, repository, commit):
         return f"{self.web_url(owner, repository)}/src/{commit}/{{path}}#lines-{{start}}:{{end}}"
 
+    def suggested_owner(self):
+        return os.environ.get("BITBUCKET_WORKSPACE")
+
     def clone_credentials(self):
         username, password = os.environ.get("BITBUCKET_USERNAME"), os.environ.get("BITBUCKET_APP_PASSWORD")
         return (username, password) if username and password else None
 
-    def _find_api_authorization(self):
-        username = os.environ.get("BITBUCKET_EMAIL") or os.environ.get("BITBUCKET_USERNAME")
-        password = os.environ.get("BITBUCKET_APP_PASSWORD")
-        credentials = (username, password) if username and password else _git_stored_credentials(self.domain)
-        return "Basic " + base64.b64encode(":".join(credentials).encode()).decode() if credentials else None
+    def _find_api_credentials(self):
+        username_variable = "BITBUCKET_EMAIL" if os.environ.get("BITBUCKET_EMAIL") else "BITBUCKET_USERNAME"
+        username, password = os.environ.get(username_variable), os.environ.get("BITBUCKET_APP_PASSWORD")
+        if username and password:
+            source = f"{username_variable} and BITBUCKET_APP_PASSWORD from the environment"
+        else:
+            stored = _git_stored_credentials(self.domain)
+            if stored is None:
+                return None
+            (username, password), source = stored, f"git credentials stored for {self.domain}"
+        return ApiCredentials("Basic " + base64.b64encode(f"{username}:{password}".encode()).decode(), source)
 
     def _workspaces_url(self):
         return f"{self._api_base}/user/workspaces?pagelen={PAGE_LENGTH}"
 
-    def _legacy_workspaces_url(self):
-        return f"{self._api_base}/user/permissions/workspaces?pagelen={PAGE_LENGTH}"
-
     def _repositories_url(self, workspace):
         query = urlencode({"role": "member", "pagelen": PAGE_LENGTH, "sort": "slug", "fields": self._repository_fields})
         return f"{self._api_base}/repositories/{quote(workspace)}?{query}"
 
     def _list_owners(self):
-        try:
-            memberships = self._fetch_pages(self._workspaces_url())
-        except HTTPError as exc:
-            exc.close()
-            if exc.code not in (404, 410):
-                raise
-            memberships = self._fetch_pages(self._legacy_workspaces_url())
+        memberships = self._fetch_pages(self._workspaces_url())
         names_by_slug = {}
         for membership in memberships:
             workspace = membership.get("workspace", membership)
@@ -228,6 +252,9 @@ class GitHub(RepositoryHost):
     owner_noun = "account"
     default_api_base = "https://api.github.com"
     credentials_hint = "set GITHUB_TOKEN, sign in with gh auth login, or store git credentials for github.com"
+    missing_permission_hint = (
+        "Listing needs a classic token with the repo scope, or a fine-grained token with Metadata read access"
+    )
     _next_link = re.compile(r'<([^>]+)>;\s*rel="next"')
 
     def permalink_template(self, owner, repository, commit):
@@ -237,12 +264,16 @@ class GitHub(RepositoryHost):
         token = _github_environment_token()
         return ("x-access-token", token) if token else None
 
-    def _find_api_authorization(self):
-        token = _github_environment_token() or _gh_token(self.domain)
-        if not token:
-            stored = _git_stored_credentials(self.domain)
-            token = stored[1] if stored else None
-        return f"Bearer {token}" if token else None
+    def _find_api_credentials(self):
+        for source, find_token in (
+            ("GITHUB_TOKEN or GH_TOKEN from the environment", _github_environment_token),
+            ("token from gh auth token", lambda: _gh_token(self.domain)),
+            (f"token stored in git credentials for {self.domain}", lambda: _git_stored_token(self.domain)),
+        ):
+            token = find_token()
+            if token:
+                return ApiCredentials(f"Bearer {token}", source)
+        return None
 
     def owners(self):
         owners = sorted({repository.owner for repository in self._accessible_repositories}, key=str.lower)
@@ -304,6 +335,11 @@ def _gh_token(domain):
     return result.stdout.strip() if result.returncode == 0 and result.stdout.strip() else None
 
 
+def _git_stored_token(domain):
+    stored = _git_stored_credentials(domain)
+    return stored[1] if stored else None
+
+
 def _git_stored_credentials(domain):
     environment = {name: value for name, value in os.environ.items() if name not in {"GIT_ASKPASS", "SSH_ASKPASS"}}
     environment["GIT_TERMINAL_PROMPT"] = "0"
@@ -324,14 +360,44 @@ def _git_stored_credentials(domain):
     return fields["username"], fields["password"]
 
 
+def _error_body(exc):
+    try:
+        return exc.read()
+    except (OSError, ValueError):
+        return b""
+    finally:
+        exc.close()
+
+
+def _service_error_message(body):
+    try:
+        payload = json.loads(body)
+    except ValueError:
+        return None
+    if not isinstance(payload, dict):
+        return None
+    bitbucket_error = payload.get("error")
+    if not isinstance(bitbucket_error, dict):
+        return payload.get("message")
+    message, detail = bitbucket_error.get("message"), bitbucket_error.get("detail")
+    if isinstance(detail, dict):
+        detail = "; ".join(f"{name}: {_listed(value)}" for name, value in detail.items())
+    return f"{message} ({detail})" if message and detail else message or detail
+
+
+def _listed(value):
+    return ", ".join(map(str, value)) if isinstance(value, list) else str(value)
+
+
 def main(arguments):
     domain, listing, *listing_arguments = arguments
     host = HOSTS_BY_DOMAIN[domain](os.environ["DELPHI_CODE_API_AUTHORIZATION"])
     try:
         items = host._list_owners() if listing == "owners" else host._list_repositories(*listing_arguments)
     except HTTPError as exc:
-        exc.close()
-        print(json.dumps({"error": {"status": exc.code, "message": f"HTTP {exc.code} {exc.reason}"}}))
+        reason = _service_error_message(_error_body(exc)) or exc.reason
+        path = urlsplit(exc.url).path if exc.url else None
+        print(json.dumps({"error": {"status": exc.code, "path": path, "message": f"HTTP {exc.code} {reason}"}}))
         return 1
     except (URLError, OSError, ValueError, KeyError, TypeError) as exc:
         print(json.dumps({"error": {"status": None, "message": str(exc)}}))

delphi_code/picker.py

@@ -78,7 +78,12 @@ class RepositoryPicker:
     def _choose_owner(self, host):
         import questionary
 
-        owners = host.owners()
+        try:
+            owners = host.owners()
+        except Failure as failure:
+            if failure.code != "remote_permission_denied":
+                raise
+            return self._type_owner(host)
         if not owners:
             raise Failure("remote_empty", f"Your {host.name} account has no repositories", ExitCode.USAGE)
         if len(owners) == 1:
@@ -91,6 +96,16 @@ class RepositoryPicker:
             **self._terminal,
         ).ask()
 
+    def _type_owner(self, host):
+        import questionary
+
+        answer = questionary.text(
+            f"These credentials cannot list {host.name} {host.owner_noun}s. {host.name} {host.owner_noun} to index:",
+            default=host.suggested_owner() or "",
+            **self._terminal,
+        ).ask()
+        return (answer or "").strip() or None
+
     def _choose_repositories(self, owner, repositories, tracked_keys):
         import questionary
 

delphi_code/sources.py

@@ -110,7 +110,8 @@ class GitRemoteSource:
         return Revision(branch, commit)
 
     def _named_revision(self, ref):
-        commits = dict((name, value) for value, name in self._remote_refs(f"refs/heads/{ref}", f"refs/tags/{ref}"))
+        advertised = self._remote_refs(f"refs/heads/{ref}", f"refs/tags/{ref}", f"refs/tags/{ref}^{{}}")
+        commits = dict((name, value) for value, name in advertised)
         commit = (
             commits.get(f"refs/heads/{ref}") or commits.get(f"refs/tags/{ref}^{{}}") or commits.get(f"refs/tags/{ref}")
         )

{delphi_code-0.2.0.dist-info → delphi_code-0.2.2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: delphi-code
-Version: 0.2.0
+Version: 0.2.2
 Summary: Offline local code search for agents
 Author: Mark Dorofeev
 License-Expression: Apache-2.0
@@ -13,6 +13,8 @@ Classifier: Intended Audience :: Developers
 Classifier: Operating System :: MacOS
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Software Development
 Classifier: Topic :: Text Processing :: Indexing
 Requires-Python: >=3.12
@@ -35,7 +37,7 @@ Offline semantic code search for agents. Delphi Code is a small Python CLI that
 ## Quick start
 
 ```sh
-uv tool install --python 3.12 --managed-python delphi-code
+uv tool install --managed-python delphi-code
 delphi-code setup
 delphi-code index -p /absolute/path/to/project
 delphi-code search 'where are user passwords checked?'
@@ -46,7 +48,7 @@ delphi-code search 'where are user passwords checked?'
 ## Requirements
 
 - macOS 14 or later on arm64 (the tested target). Linux has not yet been verified; Windows is not supported by the current file locking implementation.
-- CPython 3.12 with SQLite loadable extensions. Some python.org macOS builds disable that feature; `--managed-python` makes uv use its own Python build, which supports it. `doctor` reports this explicitly.
+- CPython 3.12 or later (tested on 3.12, 3.13 and 3.14) with SQLite loadable extensions. Some python.org macOS builds disable that feature; `--managed-python` makes uv use its own Python build, which supports it. `doctor` reports this explicitly.
 - CPU inference; no GPU is needed.
 
 ## Installation
@@ -54,21 +56,21 @@ delphi-code search 'where are user passwords checked?'
 From PyPI, as in the quick start:
 
 ```sh
-uv tool install --python 3.12 --managed-python delphi-code
+uv tool install --managed-python delphi-code
 delphi-code setup
 ```
 
 From a checkout, with uv:
 
 ```sh
-uv tool install --python 3.12 --managed-python /absolute/path/to/delphi-code
+uv tool install --managed-python /absolute/path/to/delphi-code
 delphi-code setup
 ```
 
-From a checkout, with the pinned dependency versions and a Python 3.12 build that supports SQLite extensions:
+From a checkout, with the pinned dependency versions and a Python 3.12+ build that supports SQLite extensions:
 
 ```sh
-python3.12 -m venv .venv
+python3 -m venv .venv
 .venv/bin/python -m pip install -r requirements-lock.txt
 .venv/bin/python -m pip install --no-deps --no-build-isolation .
 .venv/bin/delphi-code setup
@@ -168,7 +170,7 @@ delphi-code add github.com/octo/tools
 delphi-code add
 ```
 
-Choose Bitbucket or GitHub (asked only when both have credentials), then a Bitbucket workspace or GitHub account (skipped when there is only one). Then check repositories in a list you can filter by typing. Repositories you already track start checked, so unchecking one stops tracking it and deletes its index. After you confirm, the new repositories are indexed. Filter options and `--ref` apply to the repositories you add. The prompts are drawn on stderr, and stdout still receives one JSON object with the added repositories under `repos` and the untracked ones under `removed`. Cancelling changes nothing and reports `"cancelled": true`. Without a terminal, `add` requires sources.
+Choose Bitbucket or GitHub (asked only when both have credentials), then a Bitbucket workspace or GitHub account (skipped when there is only one). If your Bitbucket credentials may not list workspaces, you type the workspace name instead; `BITBUCKET_WORKSPACE` pre-fills it. Then check repositories in a list you can filter by typing. Repositories you already track start checked, so unchecking one stops tracking it and deletes its index. After you confirm, the new repositories are indexed. Filter options and `--ref` apply to the repositories you add. The prompts are drawn on stderr, and stdout still receives one JSON object with the added repositories under `repos` and the untracked ones under `removed`. Cancelling changes nothing and reports `"cancelled": true`. Without a terminal, `add` requires sources.
 
 **Credentials.** Git never prompts. Credentials from the environment reach git through `GIT_ASKPASS`, never in URLs or arguments, and take precedence over configured git credentials. Listing repositories for the picker uses the services' REST APIs. The API requests run in a separate process, like the model download in `setup`, so the main process keeps its network guard.
 
@@ -177,7 +179,7 @@ Choose Bitbucket or GitHub (asked only when both have credentials), then a Bitbu
 | Cloning | `BITBUCKET_USERNAME` and `BITBUCKET_APP_PASSWORD`, otherwise git's own credentials | `GITHUB_TOKEN` or `GH_TOKEN`, otherwise git's own credentials (`gh auth setup-git` configures them) |
 | Listing for the picker | The same variables (with `BITBUCKET_EMAIL` in place of the username when set), otherwise the credentials git has stored for bitbucket.org | `GITHUB_TOKEN` or `GH_TOKEN`, otherwise `gh auth token`, otherwise the token git has stored for github.com |
 
-Bitbucket has replaced app passwords with API tokens. An API token also works in `BITBUCKET_APP_PASSWORD`. Git over HTTPS takes the username that Bitbucket shows for it, and the REST API takes your Atlassian account email, which you set in `BITBUCKET_EMAIL`.
+Bitbucket has replaced app passwords with API tokens. An API token also works in `BITBUCKET_APP_PASSWORD`. Git over HTTPS takes the username that Bitbucket shows for it, and the REST API takes your Atlassian account email, which you set in `BITBUCKET_EMAIL`. Cloning and listing a workspace's repositories need the `read:repository:bitbucket` scope. Listing your workspaces also needs `read:workspace:bitbucket`; without it, the picker asks for the workspace name. An error names the credentials that were used and the scopes Bitbucket requires.
 
 `DELPHI_CODE_BITBUCKET_GIT_BASE` and `DELPHI_CODE_GITHUB_GIT_BASE` send clones to another base URL, such as a mirror, and `DELPHI_CODE_BITBUCKET_API_BASE` and `DELPHI_CODE_GITHUB_API_BASE` do the same for the APIs. Result links still point to bitbucket.org and github.com.
 

{delphi_code-0.2.0.dist-info → delphi_code-0.2.2.dist-info}/RECORD

@@ -5,7 +5,7 @@ delphi_code/doctor.py,sha256=smuiZANoEGCRKDuiL2ls8wH9Uxl-yVsXf5EcNUHYYlA,1442
 delphi_code/download.py,sha256=Mx50naH8omV38ZZ1U1J0ELopD7ccUNVW8H1gfOg6zLE,1048
 delphi_code/errors.py,sha256=GXInITgDqBbqbBNdYXufy20fuH5es46rM-_iw2J6vCY,794
 delphi_code/files.py,sha256=3CIhEBT1B6MjSaLVo7mxXQfIPKk5DpVXtaW8VeSuW-I,3321
-delphi_code/hosts.py,sha256=p9JByx8pHSuP6hvNXbBuWgkHU1egR9o9Er3-c_Bh2Mg,12513
+delphi_code/hosts.py,sha256=U_XpAnBM0R2rOziaoMaBCHbimp9HTwXn0oZ_4UI19C4,14918
 delphi_code/indexing.py,sha256=VwVoL-r2khtEyVr4xtSiP6hzQiuwMYsh-qV-mX3BWFQ,3799
 delphi_code/keys.py,sha256=s4G-iGu4JEJGku3_GdwNU8cMcIoA3Y8ClxrChXcqflE,2638
 delphi_code/manifest.py,sha256=Gy5CHiW4tTDEO7lcT5S2w5-SSowulpXej2Q0e6PXvJQ,3989
@@ -13,17 +13,17 @@ delphi_code/model.py,sha256=8YVkgFKUvmhPjiEvWOjpckbapeonmYbKes4cSsEDIS4,4684
 delphi_code/model_provenance.json,sha256=9fPASR9vJZXuKIdFWmc6Rc0A_I2OQnyOm6Ihytn9ab8,1370
 delphi_code/offline.py,sha256=I7Axon7IS9vuVa6x8c0bjCeq9yf969GMkqgLv67OSJA,1119
 delphi_code/paths.py,sha256=RoM1FDEpR-3u-mLfeFgLigPhqtzk-tPxzL_cQI8K1Ok,645
-delphi_code/picker.py,sha256=WwYaHFuUFafd5xSolqZEMO82f-WC-YJQssur9bV6bEI,4874
+delphi_code/picker.py,sha256=D25tnsMxnBNDnQYJm6rKhgnd93NY5EtZpVIXlC2i-8k,5406
 delphi_code/projects.py,sha256=M1cSVCxzZ0YedVDAhmVzF5Wv1BP_VaPlMLzFOWbp0Rc,12440
 delphi_code/registry.py,sha256=tT4Ohu7L9ix_2NPJLcgOsebOafxJ45EnBiOtsLrePp0,4678
 delphi_code/selection.py,sha256=PI8QvzX7KHcHFNIHHwzwZbOWUsvB9aJhiiWJr32h-qk,614
 delphi_code/setup.py,sha256=eeQnc1K6MkCiPc5XLF5byAdC8QGubFETrzbSuGQM7_4,4596
-delphi_code/sources.py,sha256=X-DvBTUategTwYkn_BTiTaTLMwr2HpNx2TscAzQq5Wo,7082
+delphi_code/sources.py,sha256=lgF4Ml9G2ovj48glcpIdVJUk26jUroUNkG_j3p4Q_GY,7139
 delphi_code/store.py,sha256=2MVm2qRjWmuzeevqcgvkAPQ_JfoJ2WkSLviGNQVGEv4,9696
-delphi_code-0.2.0.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
-delphi_code-0.2.0.dist-info/licenses/THIRD_PARTY_NOTICES.md,sha256=7UBHSW7RAHFxx3BG1GtsQ7a_bb1Si9TG2JL4HFvz774,2302
-delphi_code-0.2.0.dist-info/METADATA,sha256=HDJxu5bzg385VGNFeWXWAjUvOSfzuyGVk-c19owQfig,18522
-delphi_code-0.2.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-delphi_code-0.2.0.dist-info/entry_points.txt,sha256=2UhlG66g8QmTYZko1fdwaZ5ziVY75sBPZeeSLk0fdJo,53
-delphi_code-0.2.0.dist-info/top_level.txt,sha256=duf6zGKXk5n7vYW2b6IKVKfvZwLbXwp3yTiuTt62l2M,12
-delphi_code-0.2.0.dist-info/RECORD,,
+delphi_code-0.2.2.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+delphi_code-0.2.2.dist-info/licenses/THIRD_PARTY_NOTICES.md,sha256=7UBHSW7RAHFxx3BG1GtsQ7a_bb1Si9TG2JL4HFvz774,2302
+delphi_code-0.2.2.dist-info/METADATA,sha256=GTUE_q6gv72F6125jyquaeYi3d7WSFWbGLiFIIIX5y8,19036
+delphi_code-0.2.2.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+delphi_code-0.2.2.dist-info/entry_points.txt,sha256=2UhlG66g8QmTYZko1fdwaZ5ziVY75sBPZeeSLk0fdJo,53
+delphi_code-0.2.2.dist-info/top_level.txt,sha256=duf6zGKXk5n7vYW2b6IKVKfvZwLbXwp3yTiuTt62l2M,12
+delphi_code-0.2.2.dist-info/RECORD,,