dirigent-cli 0.15.2__tar.gz → 0.16.1__tar.gz

{dirigent_cli-0.15.2 → dirigent_cli-0.16.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dirigent-cli
-Version: 0.15.2
+Version: 0.16.1
 Summary: The dirigent command line interface (dirigent / dg).
 License-Expression: LicenseRef-Proprietary
 License-File: LICENSE

{dirigent_cli-0.15.2 → dirigent_cli-0.16.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "dirigent-cli"
-version = "0.15.2"
+version = "0.16.1"
 description = "The dirigent command line interface (dirigent / dg)."
 readme = "README.md"
 requires-python = ">=3.13"

{dirigent_cli-0.15.2 → dirigent_cli-0.16.1}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "dirigent-cli"
-version = "0.15.2"
+version = "0.16.1"
 description = "The dirigent command line interface (dirigent / dg)."
 readme = "README.md"
 requires-python = ">=3.13"

{dirigent_cli-0.15.2 → dirigent_cli-0.16.1}/src/dirigent_cli/local.py

@@ -12,7 +12,6 @@ from uuid import UUID
 
 import sqlalchemy as sa
 import yaml
-from cryptography.fernet import Fernet
 from pydantic import BaseModel, ConfigDict, Field, SecretStr
 from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker
 
@@ -31,6 +30,7 @@ from dirigent_core.models import ArtifactRef, Connection, LogEntry, Run, RunItem
 from dirigent_core.pipelines import apply_document
 from dirigent_core.plugins import load_plugin_host
 from dirigent_core.schemas import SchemaRefused, resolve_identity, store_schema
+from dirigent_core.secrets import generate_key
 from dirigent_core.storage import scratch_prefix
 from dirigent_core.worker import Worker
 
@@ -315,7 +315,7 @@ def local_settings(root: Path, *, inherited: Settings | None = None) -> Settings
         database_url=f"sqlite+aiosqlite:///{root / 'dirigent.db'}",
         artifact_root=f"file://{root / 'artifacts'}",
         work_root=str(root / "work"),
-        secret_key=SecretStr(Fernet.generate_key().decode()),
+        secret_key=SecretStr(generate_key()),
         enabled_unsafe_blocks=list(base.enabled_unsafe_blocks),
         storage_connections=dict(base.storage_connections),
         inline_artifact_max=base.inline_artifact_max,

{dirigent_cli-0.15.2 → dirigent_cli-0.16.1}/src/dirigent_cli/main.py

@@ -257,6 +257,18 @@ def format_command(
         emit_rendered(item)
 
 
+@app.command(name="secret-key", rich_help_panel=ADMIN_PANEL)
+def secret_key_command() -> None:
+    """Generate a DIRIGENT_SECRET_KEY, as one plain line rather than a record.
+
+    The key is the whole output, at a terminal and in a pipe alike, so
+    `DIRIGENT_SECRET_KEY=$(dg secret-key)` works in a shell and in a `.env`.
+    """
+    from dirigent_core.secrets import generate_key
+
+    typer.echo(generate_key())
+
+
 @config_app.command("show")
 def config_show() -> None:
     """Show the effective configuration, with secrets redacted."""

{dirigent_cli-0.15.2 → dirigent_cli-0.16.1}/src/dirigent_cli/project.py

@@ -1,7 +1,5 @@
 """Pipeline projects: a uv project of documents, and the scaffolding that creates one."""
 
-import base64
-import os
 import re
 from collections.abc import Sequence
 from pathlib import Path
@@ -11,6 +9,7 @@ import yaml
 from pydantic import BaseModel, ConfigDict, Field
 
 from dirigent_core.configdocs import example_document, project_document
+from dirigent_core.secrets import generate_key
 
 if TYPE_CHECKING:
     from dirigent_core.examples import ExampleEntry
@@ -433,7 +432,7 @@ COMPOSE_S3 = """\
     volumes:
       - s3:/data
     ports:
-      - "${S3_PORT:-9010}:9000"
+      - "127.0.0.1:${S3_PORT:-9010}:9000"
     healthcheck:
       # An unauthenticated request answers 403 rather than 200, and that is a serving
       # endpoint answering: -f would call it a failure, so only the connection is asserted.
@@ -734,7 +733,7 @@ S3_SECRET_KEY=dirigent
 S3_BUCKET=dirigent
 S3_CONNECTION=artifacts
 
-# Where the bundled S3 server is published for a person on the host; the stack itself reaches
+# Where the bundled S3 server is published on the host, on loopback only; the stack itself reaches
 # it as http://s3:9000.
 S3_PORT=9010
 DIRIGENT_S3_IMAGE=rustfs/rustfs:1.0.0-rc.4
@@ -955,7 +954,7 @@ def _merge_ignore(path: Path, content: str, written: list[Path], skipped: list[P
 
 def _an_instance_key() -> str:
     """Generate the key the stack seals connection secrets with."""
-    return base64.urlsafe_b64encode(os.urandom(32)).decode()
+    return generate_key()
 
 
 def _write(path: Path, content: str, *, mode: int | None = None) -> Path: