dirigent-cli 0.16.4__tar.gz → 0.16.6__tar.gz

{dirigent_cli-0.16.4 → dirigent_cli-0.16.6}/PKG-INFO

@@ -1,16 +1,18 @@
 Metadata-Version: 2.4
 Name: dirigent-cli
-Version: 0.16.4
+Version: 0.16.6
 Summary: The dirigent command line interface (dirigent / dg).
 License-Expression: LicenseRef-Proprietary
 License-File: LICENSE
-Requires-Dist: dirigent-blocks==0.16.4
-Requires-Dist: dirigent-client==0.16.4
-Requires-Dist: dirigent-common==0.16.4
-Requires-Dist: dirigent-core==0.16.4
-Requires-Dist: dirigent-examples==0.16.4
-Requires-Dist: dirigent-plugin==0.16.4
-Requires-Dist: dirigent-server==0.16.4
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.13
+Requires-Dist: dirigent-blocks==0.16.6
+Requires-Dist: dirigent-client==0.16.6
+Requires-Dist: dirigent-common==0.16.6
+Requires-Dist: dirigent-core==0.16.6
+Requires-Dist: dirigent-examples==0.16.6
+Requires-Dist: dirigent-plugin==0.16.6
+Requires-Dist: dirigent-server==0.16.6
 Requires-Dist: httpx2>=2.12.0
 Requires-Dist: python-dotenv>=1.1.0
 Requires-Dist: pyyaml>=6.0.3

{dirigent_cli-0.16.4 → dirigent_cli-0.16.6}/pyproject.toml

@@ -1,19 +1,23 @@
 [project]
 name = "dirigent-cli"
-version = "0.16.4"
+version = "0.16.6"
 description = "The dirigent command line interface (dirigent / dg)."
 readme = "README.md"
 requires-python = ">=3.13"
 license = "LicenseRef-Proprietary"
 license-files = ["LICENSE"]
+classifiers = [
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.13",
+]
 dependencies = [
-    "dirigent-blocks==0.16.4",
-    "dirigent-client==0.16.4",
-    "dirigent-common==0.16.4",
-    "dirigent-core==0.16.4",
-    "dirigent-examples==0.16.4",
-    "dirigent-plugin==0.16.4",
-    "dirigent-server==0.16.4",
+    "dirigent-blocks==0.16.6",
+    "dirigent-client==0.16.6",
+    "dirigent-common==0.16.6",
+    "dirigent-core==0.16.6",
+    "dirigent-examples==0.16.6",
+    "dirigent-plugin==0.16.6",
+    "dirigent-server==0.16.6",
     "httpx2>=2.12.0",
     "python-dotenv>=1.1.0",
     "pyyaml>=6.0.3",

{dirigent_cli-0.16.4 → dirigent_cli-0.16.6}/pyproject.toml.orig

@@ -1,19 +1,23 @@
 [project]
 name = "dirigent-cli"
-version = "0.16.4"
+version = "0.16.6"
 description = "The dirigent command line interface (dirigent / dg)."
 readme = "README.md"
 requires-python = ">=3.13"
 license = "LicenseRef-Proprietary"
 license-files = ["LICENSE"]
+classifiers = [
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.13",
+]
 dependencies = [
-    "dirigent-blocks==0.16.4",
-    "dirigent-client==0.16.4",
-    "dirigent-common==0.16.4",
-    "dirigent-core==0.16.4",
-    "dirigent-examples==0.16.4",
-    "dirigent-plugin==0.16.4",
-    "dirigent-server==0.16.4",
+    "dirigent-blocks==0.16.6",
+    "dirigent-client==0.16.6",
+    "dirigent-common==0.16.6",
+    "dirigent-core==0.16.6",
+    "dirigent-examples==0.16.6",
+    "dirigent-plugin==0.16.6",
+    "dirigent-server==0.16.6",
     "httpx2>=2.12.0",
     "python-dotenv>=1.1.0",
     "pyyaml>=6.0.3",

{dirigent_cli-0.16.4 → dirigent_cli-0.16.6}/src/dirigent_cli/commands.py

@@ -62,7 +62,7 @@ from dirigent_cli.project import (
     check_choices,
     find_project,
     scaffold,
-    write_token_env,
+    write_instance_env,
 )
 from dirigent_cli.scaffold import ScaffoldedRecord, ScaffoldError, ScaffoldRecord, scaffold_pack
 from dirigent_cli.sources import (
@@ -170,6 +170,11 @@ def fail(message: str) -> NoReturn:
     raise typer.Exit(code=1)
 
 
+def at_a_terminal() -> bool:
+    """Report whether somebody is there to answer a prompt."""
+    return sys.stdin.isatty()
+
+
 def ask(label: str, *, hide: bool = False) -> str:
     """Read one value from the terminal, refusing under --json where nothing can answer.
 
@@ -532,9 +537,10 @@ def init_command(
     stack's services, packs, and the first admin. The flags answer the same questions for a
     script. `--template local` writes the documents and a `pyproject.toml` pinning the running
     dirigent, then creates the state directory, migrates the schema, creates the first admin
-    and mints it a token, kept in `.env`. `--template compose` writes the documents and a
-    container stack instead, and initialises nothing locally: the instance is the containers.
-    `--template documents` writes the documents alone, against an instance somebody else runs.
+    and mints it a token and a secret key, both kept in `.env`. `--template compose` writes the
+    documents and a container stack instead, and initialises nothing locally: the instance is
+    the containers. `--template documents` writes the documents alone, against an instance
+    somebody else runs.
     """
     import asyncio
 
@@ -611,7 +617,7 @@ def init_command(
     migrated = migrations.head_revision(settings) or "none"
     migrations.upgrade("head", settings)
     token = asyncio.run(first_admin(settings, choices.admin, choices.password))
-    env_file = write_token_env(root, token)
+    env_file = write_instance_env(root, token)
     emit_fact(
         "instance.initialised",
         message="initialised",
@@ -885,11 +891,21 @@ def parse_params(
     schema: dict[str, Any] | None = None,
     files: list[Path] | None = None,
 ) -> dict[str, Any]:
-    """Build a run's parameters from files and flags, coerced against the pipeline's schema."""
+    """Build a run's parameters from files and flags, coerced against the pipeline's schema.
+
+    An empty value for a secret field means unset: ``--set api_token=`` leaves the field out
+    altogether, so nothing stores a credential that every read afterwards reports as set.
+    """
     try:
-        return build_params(schema or {}, pairs=pairs or [], files=files or [])
+        built = build_params(schema or {}, pairs=pairs or [], files=files or [])
     except ParamError as error:
         fail(str(error))
+    properties = cast("dict[str, Any]", (schema or {}).get("properties") or {})
+    return {
+        name: value
+        for name, value in built.items()
+        if value != "" or not _is_secret_field(cast("dict[str, Any]", properties.get(name) or {}))
+    }
 
 
 #: What separates the two ends of a ``--window`` value.
@@ -2224,12 +2240,19 @@ def connection_create(
     """Create a connection, prompting for the secret fields without echoing them.
 
     Prompting happens only on a terminal; in a script every value must arrive via ``--set``.
+    An invocation carrying ``--set`` is prompted only for what it cannot do without: a
+    required field it left out. A bare invocation is the interactive form and is offered
+    every secret the kind declares.
     """
     with client_for(state_of(ctx)) as dg:
         schema = _connection_schema(dg.call(dg.blocks.catalog()), kind_id)
         config = parse_params(set_value, schema=schema)
         required = set(cast("list[str]", schema.get("required") or []))
-        interactive = sys.stdin.isatty() and not json_mode()
+        interactive = at_a_terminal() and not json_mode()
+        # An invocation that carried --set said what it wanted, so only a required secret is
+        # still asked for there: an optional one it left out is left out. With no --set at
+        # all the command is the form, and every secret is offered.
+        offered = not set_value
         for field, body in cast("dict[str, Any]", schema.get("properties") or {}).items():
             if field in config:
                 continue
@@ -2241,6 +2264,8 @@ def connection_create(
             if not interactive:
                 continue
             if _is_secret_field(body):
+                if not offered and field not in required:
+                    continue
                 value = typer.prompt(f"{field}", hide_input=True, default="", show_default=False)
                 if value:
                     config[field] = value

{dirigent_cli-0.16.4 → dirigent_cli-0.16.6}/src/dirigent_cli/main.py

@@ -3,7 +3,7 @@
 import os
 import shutil
 import sys
-from collections.abc import Sequence
+from collections.abc import Callable, Sequence
 from datetime import UTC, datetime, timedelta
 from importlib.metadata import PackageNotFoundError, version
 from pathlib import Path
@@ -1076,8 +1076,15 @@ async def _dev(
     install_signal_handlers(worker)
     server_config = uvicorn.Config(build_app(), host=host, port=port, log_config=None)
     api = uvicorn.Server(server_config)
+
+    def shut_down() -> None:
+        """Ask for the shutdown SIGTERM asks for: the worker drains, and serve returns."""
+        worker.request_stop()
+        api.should_exit = True
+
     worker_task = asyncio.create_task(worker.run())
     ready = asyncio.create_task(_announce_ready(api))
+    orphaned = asyncio.create_task(watch_parent(os.getppid, shut_down))
     seeding = (
         asyncio.create_task(_seed(api, local_url(host, port), bearer, seed, installed)) if seed or installed else None
     )
@@ -1085,6 +1092,7 @@ async def _dev(
         await api.serve()
     finally:
         ready.cancel()
+        orphaned.cancel()
         if seeding is not None:
             seeding.cancel()
         worker.request_stop()
@@ -1107,6 +1115,30 @@ async def _announce_ready(api: "uvicorn.Server") -> None:
     emit(make("process", at=datetime.now(UTC), message="ready", process="dev"))
 
 
+#: How often the instance looks at whether the process that started it is still there.
+PARENT_POLL_SECONDS = 1.0
+
+
+async def watch_parent(
+    parent: Callable[[], int], stop: Callable[[], None], *, every: float = PARENT_POLL_SECONDS
+) -> None:
+    """Shut the instance down once the process that started it is gone.
+
+    ``uv run dg dev`` forwards SIGTERM to the instance, but a wrapper that was killed outright
+    cannot, and the instance it leaves behind goes on claiming runs against the same state.
+    macOS has no PR_SET_PDEATHSIG, so the parent pid is polled: a pid that changed means this
+    process was reparented to init. A dev instance therefore does not outlive the process that
+    started it, backgrounding it past the shell that launched it included.
+    """
+    import asyncio
+
+    started = parent()
+    while parent() == started:
+        await asyncio.sleep(every)
+    emit(make("process", at=datetime.now(UTC), message="parent gone", process="dev", parent=started))
+    stop()
+
+
 async def _seed(
     api: "uvicorn.Server",
     url: str,

{dirigent_cli-0.16.4 → dirigent_cli-0.16.6}/src/dirigent_cli/output.py

@@ -16,6 +16,7 @@ from pydantic import BaseModel
 from rich.console import Console, Group, RenderableType
 from rich.markup import escape
 from rich.table import Table
+from rich.text import Text
 
 from dirigent_client.schemas.common import Problem
 from dirigent_core.protocol import Format, Record, as_json, make
@@ -500,16 +501,26 @@ def elapsed(value: object) -> str:
     return f"{int(hours)}h{int(minutes)}m"
 
 
+def titled(title: str, built: Table) -> RenderableType:
+    """Put a title above a table, on a line of its own.
+
+    Rich folds a table's own title to the width of the table, which the widest row sets, so a
+    title carrying a 36-character run id breaks in half wherever the rows are narrower than
+    it. Above the table the title is folded only by the console.
+    """
+    return Group(Text.from_markup(title, style="table.title"), built)
+
+
 def build_table(title: str, columns: Sequence[str], rows: Iterable[Sequence[str]]) -> RenderableType:
     """Build one rich table, or the quiet line that stands in for an empty one."""
-    built = Table(title=title, show_header=True, header_style="bold", title_justify="left")
+    built = Table(show_header=True, header_style="bold")
     for column in columns:
         built.add_column(column)
     count = 0
     for row in rows:
         built.add_row(*row)
         count += 1
-    return built if count else f"[dim]{title}: nothing to show.[/]"
+    return titled(title, built) if count else f"[dim]{title}: nothing to show.[/]"
 
 
 def table(title: str, columns: Sequence[str], rows: Iterable[Sequence[str]]) -> None:
@@ -518,13 +529,13 @@ def table(title: str, columns: Sequence[str], rows: Iterable[Sequence[str]]) ->
 
 
 def build_fields(title: str, values: Mapping[str, Any]) -> RenderableType:
-    """Build one record as a two-column table."""
-    built = Table(title=title, show_header=False, box=None, title_justify="left", padding=(0, 2, 0, 0))
+    """Build one record as a two-column table under its title."""
+    built = Table(show_header=False, box=None, padding=(0, 2, 0, 0))
     built.add_column(style="bold")
     built.add_column()
     for name, value in values.items():
         built.add_row(name, styled(value))
-    return built
+    return titled(title, built)
 
 
 def fields(title: str, values: Mapping[str, Any]) -> None:

{dirigent_cli-0.16.4 → dirigent_cli-0.16.6}/src/dirigent_cli/project.py

@@ -821,14 +821,18 @@ ROOT_IGNORE_TEMPLATE = """\
 .venv/
 __pycache__/
 
-# This instance's token, or the stack's key and first password. Never shared.
+# This instance's token and key, or the stack's key and first password. Never shared.
 .env
 """
 
-TOKEN_ENV_TEMPLATE = """\
+INSTANCE_ENV_TEMPLATE = """\
 # The token dg init minted for this instance's first admin. The local profile in
 # .dirigent/profiles.yaml reads it from here when the shell does not export it.
 DG_TOKEN=__TOKEN__
+
+# The key this instance seals connection secrets with, read by every command run in this
+# directory. What is stored under it cannot be opened under another one.
+DIRIGENT_SECRET_KEY=__SECRET_KEY__
 """
 
 PYPROJECT_TEMPLATE = """\
@@ -923,9 +927,10 @@ def scaffold(directory: Path, choices: InitChoices, *, version: str = "0.0.0") -
     return Scaffolded(files=written, skipped=skipped)
 
 
-def write_token_env(directory: Path, token: str) -> Path:
-    """Write the ``.env`` holding a new instance's token, readable by its owner alone."""
-    return _write(directory / ".env", TOKEN_ENV_TEMPLATE.replace("__TOKEN__", token), mode=0o600)
+def write_instance_env(directory: Path, token: str) -> Path:
+    """Write the ``.env`` holding a new instance's token and key, readable by its owner alone."""
+    document = INSTANCE_ENV_TEMPLATE.replace("__TOKEN__", token).replace("__SECRET_KEY__", _an_instance_key())
+    return _write(directory / ".env", document, mode=0o600)
 
 
 def _record(path: Path, content: str, written: list[Path], skipped: list[Path]) -> None:
@@ -953,7 +958,7 @@ def _merge_ignore(path: Path, content: str, written: list[Path], skipped: list[P
 
 
 def _an_instance_key() -> str:
-    """Generate the key the stack seals connection secrets with."""
+    """Generate the key an instance seals connection secrets with."""
     return generate_key()
 
 

{dirigent_cli-0.16.4 → dirigent_cli-0.16.6}/src/dirigent_cli/summaries.py

@@ -316,7 +316,9 @@ def _initialised(record: Record) -> RenderableType | None:
         "\n  [bold]uv run dg examples list --starter[/]"
         "\n  [bold]uv run dg pipeline new <starter>[/]"
         "\n  [bold]uv run dg apply[/]"
-        "\n\n[dim]No DIRIGENT_SECRET_KEY is set, so a connection carrying a credential cannot be stored until it is.[/]"
+        "\n\n[dim]DIRIGENT_SECRET_KEY is in .env beside it, and every command run in"
+        "\nthis directory reads it: it is what connection secrets are sealed with, and"
+        "\nunder another key the instance cannot open what it stored.[/]"
     )
     return Group(*parts)