dirigent-block-execute 0.17.2__tar.gz → 0.18.0__tar.gz

{dirigent_block_execute-0.17.2 → dirigent_block_execute-0.18.0}/PKG-INFO

@@ -1,14 +1,14 @@
 Metadata-Version: 2.4
 Name: dirigent-block-execute
-Version: 0.17.2
+Version: 0.18.0
 Summary: The execute block family for dirigent: shell, docker, compose, buildx, and a checkout.
 License-Expression: LicenseRef-Proprietary
 License-File: LICENSE
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.13
-Requires-Dist: dirigent-block-http==0.17.2
-Requires-Dist: dirigent-common==0.17.2
-Requires-Dist: dirigent-plugin==0.17.2
+Requires-Dist: dirigent-block-http==0.18.0
+Requires-Dist: dirigent-common==0.18.0
+Requires-Dist: dirigent-plugin==0.18.0
 Requires-Dist: httpx2>=2.12.0
 Requires-Python: >=3.13
 Description-Content-Type: text/markdown

{dirigent_block_execute-0.17.2 → dirigent_block_execute-0.18.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "dirigent-block-execute"
-version = "0.17.2"
+version = "0.18.0"
 description = "The execute block family for dirigent: shell, docker, compose, buildx, and a checkout."
 readme = "README.md"
 requires-python = ">=3.13"
@@ -11,9 +11,9 @@ classifiers = [
     "Programming Language :: Python :: 3.13",
 ]
 dependencies = [
-    "dirigent-block-http==0.17.2",
-    "dirigent-common==0.17.2",
-    "dirigent-plugin==0.17.2",
+    "dirigent-block-http==0.18.0",
+    "dirigent-common==0.18.0",
+    "dirigent-plugin==0.18.0",
     "httpx2>=2.12.0",
 ]
 

{dirigent_block_execute-0.17.2 → dirigent_block_execute-0.18.0}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "dirigent-block-execute"
-version = "0.17.2"
+version = "0.18.0"
 description = "The execute block family for dirigent: shell, docker, compose, buildx, and a checkout."
 readme = "README.md"
 requires-python = ">=3.13"
@@ -11,9 +11,9 @@ classifiers = [
     "Programming Language :: Python :: 3.13",
 ]
 dependencies = [
-    "dirigent-block-http==0.17.2",
-    "dirigent-common==0.17.2",
-    "dirigent-plugin==0.17.2",
+    "dirigent-block-http==0.18.0",
+    "dirigent-common==0.18.0",
+    "dirigent-plugin==0.18.0",
     "httpx2>=2.12.0",
 ]
 

{dirigent_block_execute-0.17.2 → dirigent_block_execute-0.18.0}/src/dirigent_block_execute/build.py

@@ -176,22 +176,18 @@ class DockerBuildOperator(Operator[DockerBuildConfig, DockerBuildOutput]):
         if config.push and (settings is None or not settings.authenticates):
             raise BlockFailure(NO_REGISTRY_CREDENTIAL, error_class=ErrorClass.REJECTED)
         timeout = config.timeout.total_seconds()
-        artifacts = subprocess.prefix(ctx, "build")
-        stdout_uri = f"{artifacts}-stdout.txt"
-        build_log_uri = f"{artifacts}-build.log"
 
         with sealed(settings, root, isolate_config=config.push) as material:
             environ = daemon_environment(
                 subprocess.environment([*DAEMON_ENV, *config.env_allowlist], config.env, root), material
             )
             write_cli_config(root / ".docker")
-            code, out, err = await subprocess.run(
+            code, out, err, stdout_uri, build_log_uri = await subprocess.run(
                 directory=root,
                 ctx=ctx,
-                stdout_uri=stdout_uri,
-                stderr_uri=build_log_uri,
                 timeout_seconds=timeout,
                 environ=environ,
+                stderr_name="build.log",
                 argv=build_argv(config, context, iidfile),
                 what="docker buildx build",
                 redact=material.secrets,

{dirigent_block_execute-0.17.2 → dirigent_block_execute-0.18.0}/src/dirigent_block_execute/compose.py

@@ -141,10 +141,9 @@ class DockerComposeUpConfig(BlockModel):
     pipeline document itself."""
 
     project_name: str | None = None
-    """The compose project (``-p``). Defaults to a deterministic name derived from the run id,
-
-    so this ``up``, the steps that drive it, and a later ``down`` all address the same project,
-    and two runs never collide."""
+    """The compose project (``-p``). Defaults to a deterministic name derived from the run id, so
+    this ``up``, the steps that drive it, and a later ``down`` all address the same project, and
+    two runs never collide."""
 
     profiles: list[str] = Field(default_factory=list[str])
     """Compose profiles to activate (``--profile``)."""
@@ -213,13 +212,11 @@ class DockerComposeDownConfig(BlockModel):
 
     project_name: str | None = None
     """The compose project (``-p``). Defaults to the same deterministic name ``up`` derives from
-
-    the run id, so a teardown step in the same run addresses the stack the ``up`` created with
-    no wiring from the author."""
+    the run id, so a teardown step in the same run addresses the stack the ``up`` created with no
+    wiring from the author."""
 
     file: str | None = None
     """A compose file, only if the CLI needs ``-f`` to resolve the project; a project tears down
-
     by its label alone otherwise. As a path inside the run's work directory."""
 
     content: str | None = None
@@ -342,7 +339,6 @@ class DockerComposeUpOperator(Operator[DockerComposeUpConfig, DockerComposeUpOut
         assert compose_file is not None
         project = config.project_name or _default_project(ctx)
         timeout = config.timeout.total_seconds()
-        stdout_uri, stderr_uri = _artifact_uris(ctx, "up")
 
         with sealed(_connection(config.connection, ctx), root) as material:
             environ = daemon_environment(
@@ -350,13 +346,13 @@ class DockerComposeUpOperator(Operator[DockerComposeUpConfig, DockerComposeUpOut
             )
             write_cli_config(root / ".docker")
             try:
-                code, out, err = await subprocess.run(
+                code, out, err, stdout_uri, stderr_uri = await subprocess.run(
                     directory=root,
                     ctx=ctx,
-                    stdout_uri=stdout_uri,
-                    stderr_uri=stderr_uri,
                     timeout_seconds=timeout,
                     environ=environ,
+                    stdout_name="up-stdout",
+                    stderr_name="up-stderr",
                     argv=up_argv(config, project, compose_file, root),
                     what="docker compose up",
                 )
@@ -411,20 +407,19 @@ class DockerComposeDownOperator(Operator[DockerComposeDownConfig, DockerComposeD
         compose_file = _compose_file(config.file, config.content, ctx, root)
         project = config.project_name or _default_project(ctx)
         timeout = config.timeout.total_seconds()
-        stdout_uri, stderr_uri = _artifact_uris(ctx, "down")
 
         with sealed(_connection(config.connection, ctx), root) as material:
             environ = daemon_environment(
                 subprocess.environment([*DAEMON_ENV, *config.env_allowlist], config.env, root), material
             )
             write_cli_config(root / ".docker")
-            code, out, err = await subprocess.run(
+            code, out, err, stdout_uri, stderr_uri = await subprocess.run(
                 directory=root,
                 ctx=ctx,
-                stdout_uri=stdout_uri,
-                stderr_uri=stderr_uri,
                 timeout_seconds=timeout,
                 environ=environ,
+                stdout_name="down-stdout",
+                stderr_name="down-stderr",
                 argv=down_argv(config, project, compose_file, root),
                 what="docker compose down",
             )
@@ -656,12 +651,6 @@ def _work_relative(path: Path, root: Path) -> str:
     return str(path.relative_to(root))
 
 
-def _artifact_uris(ctx: StepContext, action: str) -> tuple[str, str]:
-    """Where the CLI's two streams are written for this attempt."""
-    root = f"{subprocess.prefix(ctx, 'compose')}-{action}"
-    return f"{root}-stdout.txt", f"{root}-stderr.txt"
-
-
 def _default_project(ctx: StepContext) -> str:
     """A project name that is the same across a run's up, drive and down, and unique between runs."""
     return f"dirigent-{ctx.run_id.hex}"

{dirigent_block_execute-0.17.2 → dirigent_block_execute-0.18.0}/src/dirigent_block_execute/docker.py

@@ -109,8 +109,8 @@ NOT_FOUND = 404
 CONFLICT = 409
 
 
-#: The schemes a daemon URL may be written in, which are the ones the docker CLI accepts.
-DAEMON_SCHEMES = ("tcp://", "ssh://", "unix://")
+#: The schemes a daemon URL may be written in, which are the ones the worker speaks.
+DAEMON_SCHEMES = ("tcp://", "unix://")
 
 #: What a registry credential that names no registry authenticates to.
 DOCKER_HUB = "docker.io"
@@ -123,7 +123,7 @@ class DockerConnectionConfig(BlockModel):
     """A daemon to reach, a registry to authenticate to, or both."""
 
     host: str = ""
-    """The daemon, as ``tcp://host:2376``, ``ssh://user@host`` or ``unix:///var/run/docker.sock``.
+    """The daemon, as ``tcp://host:2376`` or ``unix:///var/run/docker.sock``.
 
     Left empty, a step using this connection reaches the daemon the worker's own environment
     names, which is what a step naming no connection does."""
@@ -157,7 +157,7 @@ class DockerConnectionConfig(BlockModel):
     def _check_shape(self) -> "DockerConnectionConfig":
         """Refuse a daemon URL of an unknown form, half a TLS triple, and half a credential."""
         if self.host and not self.host.startswith(DAEMON_SCHEMES):
-            raise ValueError(NOT_A_DAEMON_SCHEME.render(schemes=", ".join(DAEMON_SCHEMES), host=repr(self.host)))
+            raise ValueError(NOT_A_DAEMON_SCHEME.render(schemes=" or ".join(DAEMON_SCHEMES), host=repr(self.host)))
         pems = [self.tls_ca, self.tls_cert, self.tls_key]
         if any(pem is not None for pem in pems) and not all(pem is not None for pem in pems):
             raise ValueError(TLS_IS_ALL_THREE.render())
@@ -493,6 +493,7 @@ class DockerRunOutput(BlockModel):
     """What the container did, with its full streams and produced files addressable as artifacts."""
 
     exit_code: int
+    """The status the container exited with."""
 
     stdout: str
     """The head of what the container printed, cut at the instance's inline capture size.
@@ -521,7 +522,11 @@ class DockerRunOutput(BlockModel):
     """Whether ``stderr`` above is short of the stream, which is an independent question."""
 
     container_id: str
+    """The container that ran, by the id the daemon gave it."""
+
     image: str
+    """The image the container ran."""
+
     outputs: dict[str, str] = Field(default_factory=dict[str, str])
     """Where each declared output was written, by the name the config gave it: the storage URI,
     or the path relative to the run's work directory it landed at."""
@@ -582,21 +587,16 @@ class DockerRunOperator(Operator[DockerRunConfig, DockerRunOutput]):
 
     async def fetch(self, handle: RemoteHandle, config: DockerRunConfig, ctx: StepContext) -> DockerRunOutput:
         """Collect the exit code, the streams, and the declared files, then drop the container."""
-        artifacts = subprocess.prefix(ctx, "docker")
-        stdout_uri = f"{artifacts}-stdout.txt"
-        stderr_uri = f"{artifacts}-stderr.txt"
         with _material(config, ctx) as environ:
             async with _daemon(config, environ) as daemon:
                 inspected = await daemon.inspect(handle.ref)
                 if inspected is None:
                     raise BlockFailure(CONTAINER_GONE, error_class=ErrorClass.TRANSIENT, container=handle.ref[:12])
-                async with (
-                    ctx.storage.open_write(stdout_uri) as out_sink,
-                    ctx.storage.open_write(stderr_uri) as err_sink,
-                ):
+                async with ctx.capture("stdout") as out_sink, ctx.capture("stderr") as err_sink:
                     stdout, stderr = await drain_logs(
                         daemon, handle.ref, ctx.inline_capture, sinks=(out_sink, err_sink)
                     )
+                    stdout_uri, stderr_uri = out_sink.uri, err_sink.uri
                 collected = await _collect_outputs(config, handle, ctx)
                 # The run log gets only what the probes have not already streamed: the segment
                 # between the last committed cursor and the exit. The full read above is for
@@ -1153,6 +1153,9 @@ def resolve_endpoint(explicit_socket: str | None, environ: Mapping[str, str] | N
     pipeline's containers off the host. ``DOCKER_TLS_VERIFY`` with ``DOCKER_CERT_PATH`` turns
     that into https with client certificates, the way the docker CLI reads the same variables.
 
+    A ``DOCKER_HOST`` in any other scheme is refused instead of resolving to the local socket:
+    the daemon is reached over HTTP here, and nothing tunnels an ``ssh://`` one.
+
     ``environ`` is what a step with a ``docker`` connection reads instead of the worker's own.
     """
     source = os.environ if environ is None else environ
@@ -1173,6 +1176,13 @@ def resolve_endpoint(explicit_socket: str | None, environ: Mapping[str, str] | N
     if host.startswith("unix://"):
         socket = host.removeprefix("unix://") or DEFAULT_SOCKET_PATH
         return DaemonEndpoint(DAEMON_BASE_URL, socket, True, None, socket)
+    if host:
+        raise BlockFailure(
+            NOT_A_DAEMON_SCHEME,
+            error_class=ErrorClass.REJECTED,
+            schemes=" or ".join(DAEMON_SCHEMES),
+            host=repr(host),
+        )
     return DaemonEndpoint(DAEMON_BASE_URL, DEFAULT_SOCKET_PATH, True, None, DEFAULT_SOCKET_PATH)
 
 

{dirigent_block_execute-0.17.2 → dirigent_block_execute-0.18.0}/src/dirigent_block_execute/git.py

@@ -381,16 +381,13 @@ class _Git:
         artifact rather than a buffer in the worker. Each command writes its own pair, named for
         its subcommand; the pair the last one wrote is what the output carries.
         """
-        artifacts = f"{subprocess.prefix(self.ctx, 'git')}-{argv[0]}"
-        stdout_uri = f"{artifacts}-stdout.txt"
-        stderr_uri = f"{artifacts}-stderr.txt"
-        code, out, err = await subprocess.run(
+        code, out, err, stdout_uri, stderr_uri = await subprocess.run(
             directory=directory,
             ctx=self.ctx,
-            stdout_uri=stdout_uri,
-            stderr_uri=stderr_uri,
             timeout_seconds=self.timeout,
             environ=self.environ,
+            stdout_name=f"{argv[0]}-stdout",
+            stderr_name=f"{argv[0]}-stderr",
             argv=[self.binary, *argv],
             what=f"git {argv[0]}",
             redact=self.secrets,

{dirigent_block_execute-0.17.2 → dirigent_block_execute-0.18.0}/src/dirigent_block_execute/messages.py

@@ -125,7 +125,7 @@ CWD_STAYS_INSIDE = EXECUTE.define(
 
 NOT_A_DAEMON_SCHEME = EXECUTE.define(
     "not_a_daemon_scheme",
-    "a docker host is one of {schemes}, and {host} is none of them",
+    "a docker host is {schemes}, and {host} is not one of them",
 )
 
 TLS_IS_ALL_THREE = EXECUTE.define(

{dirigent_block_execute-0.17.2 → dirigent_block_execute-0.18.0}/src/dirigent_block_execute/shell.py

@@ -77,6 +77,7 @@ class ShellRunOutput(BlockModel):
     """What the command did, with its full streams addressable as artifacts."""
 
     exit_code: int
+    """The status the command exited with."""
 
     stdout: str
     """The head of what the command printed, cut at the instance's inline capture size.
@@ -136,14 +137,9 @@ class ShellRunOperator(Operator[ShellRunConfig, ShellRunOutput]):
         workspace = subprocess.workspace(ctx, "shell")
         directory = workspace / config.cwd if config.cwd else workspace
         directory.mkdir(parents=True, exist_ok=True)
-        artifacts = subprocess.prefix(ctx, "shell")
-        stdout_uri = f"{artifacts}-stdout.txt"
-        stderr_uri = f"{artifacts}-stderr.txt"
-        code, out, err = await subprocess.run(
+        code, out, err, stdout_uri, stderr_uri = await subprocess.run(
             directory=directory,
             ctx=ctx,
-            stdout_uri=stdout_uri,
-            stderr_uri=stderr_uri,
             timeout_seconds=config.timeout.total_seconds(),
             environ=_environment(config, directory),
             argv=config.argv or None,

{dirigent_block_execute-0.17.2 → dirigent_block_execute-0.18.0}/src/dirigent_block_execute/subprocess.py

@@ -14,6 +14,7 @@ import os
 import signal
 from collections.abc import Sequence
 from pathlib import Path
+from typing import NamedTuple
 
 from dirigent_block_execute.capture import Drained, LiveLines, drain
 from dirigent_block_execute.environment import allowed
@@ -24,22 +25,26 @@ from dirigent_plugin import BlockFailure, ErrorClass, StepContext
 BASELINE_ENV = ("PATH", "LANG", "LC_ALL", "TZ")
 
 
+class Ran(NamedTuple):
+    """What one child process left behind: how it exited, both streams, and where they were written."""
+
+    code: int
+    out: Drained
+    err: Drained
+    stdout_uri: str
+    stderr_uri: str
+
+
 def segment(ctx: StepContext, name: str) -> str:
-    """The path this attempt's files sit at, under either of the run's two roots.
+    """The path this attempt's files sit at, inside the run's work directory.
 
-    ``{name}/{step}[/{item}]/attempt-{n}``. Both roots are the run's, so the step key and,
-    inside a fan-out, the item id are what keep two steps of one run and two items of one step
-    out of each other's files and working directories.
+    ``{name}/{step}[/{item}]/attempt-{n}``. The step key, and inside a fan-out the item id,
+    are what keep two steps of one run and two items of one step out of each other's files.
     """
     item = f"/{ctx.run_item_id}" if ctx.run_item_id is not None else ""
     return f"{name}/{ctx.step}{item}/attempt-{ctx.attempt}"
 
 
-def prefix(ctx: StepContext, name: str) -> str:
-    """The storage URI this attempt's artifact names are built on, under the run's scratch prefix."""
-    return f"{ctx.scratch.rstrip('/')}/{segment(ctx, name)}"
-
-
 def workspace(ctx: StepContext, name: str) -> Path:
     """This attempt's working directory inside the run's work directory, made if absent."""
     directory = ctx.work / segment(ctx, name)
@@ -59,22 +64,24 @@ async def run(
     *,
     directory: Path,
     ctx: StepContext,
-    stdout_uri: str,
-    stderr_uri: str,
     timeout_seconds: float,
     environ: dict[str, str],
+    stdout_name: str = "stdout",
+    stderr_name: str = "stderr",
     argv: list[str] | None = None,
     command: str | None = None,
     what: str = "the command",
     redact: Sequence[str] = (),
-) -> tuple[int, Drained, Drained]:
+) -> Ran:
     """Start the process, drain it under the timeout, and leave nothing of it behind.
 
-    Both pipes are read as the process writes them and written straight through to storage,
-    so what is held is two bounded ends of each stream rather than all of it: a process that
-    prints more than the worker has memory for is a file, not a dead worker. Each stream's
-    first lines go into the run log where they are printed, so a long command is visible
-    working; ``redact`` names the strings it was handed that must not reach one of them.
+    Both pipes are read as the process writes them and written straight through to a capture
+    the context opens and names, so what is held is two bounded ends of each stream rather
+    than all of it: a process that prints more than the worker has memory for is a file, not
+    a dead worker. The two names distinguish one command's streams from another's where a
+    step runs more than one. Each stream's first lines go into the run log where they are
+    printed, so a long command is visible working; ``redact`` names the strings it was
+    handed that must not reach one of them.
 
     The process leads a session of its own, so what it starts is killable with it: a command
     is usually ``sh -c``, and killing the shell alone leaves the children doing the work.
@@ -106,7 +113,7 @@ async def run(
     pgid = group_of(process)
     try:
         async with asyncio.timeout(timeout_seconds):
-            async with ctx.storage.open_write(stdout_uri) as out_sink, ctx.storage.open_write(stderr_uri) as err_sink:
+            async with ctx.capture(stdout_name) as out_sink, ctx.capture(stderr_name) as err_sink:
                 out, err = await asyncio.gather(
                     drain(
                         process.stdout,
@@ -126,7 +133,7 @@ async def run(
         raise BlockFailure(TIMED_OUT, error_class=ErrorClass.TRANSIENT, what=what, seconds=timeout_seconds) from error
     finally:
         await end(process, pgid)
-    return process.returncode or 0, out, err
+    return Ran(process.returncode or 0, out, err, out_sink.uri, err_sink.uri)
 
 
 async def output(
@@ -207,12 +214,12 @@ def kill(pgid: int, pid: int) -> None:
 
 __all__ = [
     "BASELINE_ENV",
+    "Ran",
     "end",
     "environment",
     "group_of",
     "kill",
     "output",
-    "prefix",
     "run",
     "segment",
     "workspace",