docker-stack 2.3.2__tar.gz → 2.3.3__tar.gz

{docker_stack-2.3.2 → docker_stack-2.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: docker-stack
-Version: 2.3.2
+Version: 2.3.3
 Summary: CLI for deploying and managing Docker stacks.
 Home-page: https://github.com/mesudip/docker-stack
 Author: Sudip Bhattarai

{docker_stack-2.3.2 → docker_stack-2.3.3}/docker_stack/cli.py

@@ -48,7 +48,16 @@ from docker_stack.manager_api import (
     format_deploy_error_body,
 )
 from docker_stack.registry import DockerRegistry
-from .envsubst import LineCheckResult, SubstitutionError, envsubst, envsubst_load_file
+from .envsubst import (
+    ENV_DEFAULT_OPERATORS,
+    ENV_VAR_PATTERN,
+    LineCheckResult,
+    SubstitutionError,
+    envsubst,
+    envsubst_load_file,
+    ref_parts,
+    resolve_env_ref,
+)
 
 DOCKER_SHELL_ENDPOINT_ENV_VARS = (
     "DOCKER_HOST",
@@ -115,8 +124,7 @@ def _require_manager() -> ManagerApiClient:
     client = discover_manager_client(strict=True)
     if client is None or not client.is_manager_backend():
         raise RuntimeError(
-            f"{client.manager_url if client else 'the current Docker endpoint'} is not a "
-            "Docker-Manager; node-local commands need one"
+            f"{client.manager_url if client else 'the current Docker endpoint'} is not a " "Docker-Manager; node-local commands need one"
         )
     return client
 
@@ -130,10 +138,7 @@ def _select_node(value: str) -> str:
     nodes = client.list_nodes().get("nodes", [])
     exact = [node for node in nodes if str(node.get("id") or "") == requested]
     candidates = exact or [
-        node
-        for node in nodes
-        if str(node.get("id") or "").startswith(requested)
-        or str(node.get("hostname") or "") == requested
+        node for node in nodes if str(node.get("id") or "").startswith(requested) or str(node.get("hostname") or "") == requested
     ]
     if not candidates:
         raise RuntimeError(f"node '{requested}' is not visible or does not exist")
@@ -424,14 +429,8 @@ def _managed_docker(arguments: List[str]) -> int:
         or (value.startswith("-c") and value != "-c")
         for value in global_options
     )
-    is_ps = bool(command) and (
-        command[0] == "ps"
-        or (len(command) >= 2 and command[0] == "container" and command[1] in {"ls", "list"})
-    )
-    if explicit_target or not is_ps or any(
-        value in {"-q", "--quiet", "--format"} or value.startswith("--format=")
-        for value in command
-    ):
+    is_ps = bool(command) and (command[0] == "ps" or (len(command) >= 2 and command[0] == "container" and command[1] in {"ls", "list"}))
+    if explicit_target or not is_ps or any(value in {"-q", "--quiet", "--format"} or value.startswith("--format=") for value in command):
         return _exec_docker(values)
     try:
         client = discover_manager_client()
@@ -517,8 +516,7 @@ def _add_listing_namespace_arguments(parser: argparse.ArgumentParser) -> None:
 def _prompt_for_manager_target(context_name: str) -> str:
     if not sys.stdin.isatty():
         raise RuntimeError(
-            f"Unknown shell context '{context_name}'. Run "
-            f"'docker-stack shell --context {context_name} <manager-url>' to create it."
+            f"Unknown shell context '{context_name}'. Run " f"'docker-stack shell --context {context_name} <manager-url>' to create it."
         )
     print(f"Docker context '{context_name}' does not exist yet.")
     print("Enter the Docker-Manager URL to create it (for example https://manager.example.com:2376).")
@@ -571,7 +569,9 @@ class EnvFileResolutionError(Exception):
         return "\n".join(formatted_lines)
 
 
-ENV_VAR_PATTERN = re.compile(r"\$\{([^}:\s]+)(?::-(.*?))?\}|\$([a-zA-Z_][a-zA-Z0-9_]*)")
+# The compose interpolation grammar is defined once in envsubst.py and
+# imported above; see the note there for why a second copy is a deploy bug.
+_ref_name_operator_operand = ref_parts
 
 
 def _strip_matching_quotes(value: str) -> Tuple[str, int]:
@@ -614,8 +614,8 @@ def _parse_env_file(env_file: str) -> Tuple[List[EnvFileEntry], List[str]]:
 def _extract_refs(value: str) -> List[Tuple[str, int]]:
     refs = []
     for match in ENV_VAR_PATTERN.finditer(value):
-        var = match.group(1) if match.group(1) is not None else match.group(3)
-        start = match.start(1) if match.group(1) is not None else match.start(3)
+        var, _operator, _operand = _ref_name_operator_operand(match)
+        start = match.start(1) if match.group(1) is not None else match.start(4)
         refs.append((var, start))
     return refs
 
@@ -703,9 +703,9 @@ def load_env_file(env_file: str, base_env: Optional[Dict[str, str]] = None, max_
     return _resolve_env_entries(entries, env_file, base_env=base_env, max_cycles=max_cycles)
 
 
-
-
-_ENV_REF_PATTERN = re.compile(r"\$\{([^}:\s]+)(?::-(.*?))?\}|\$([a-zA-Z_][a-zA-Z0-9_]*)")
+# One pattern, not a second copy: a reference form recognised here but not by
+# the `.env` collector expands locally while its variable is never shipped.
+_ENV_REF_PATTERN = ENV_VAR_PATTERN
 _ESCAPED_DOLLAR = "$_ESCAPED_DOLLAR_"
 
 
@@ -721,13 +721,13 @@ def _substitute_selected_vars(text: str, names: Set[str], replacements: Dict[str
     guarded = text.replace("$$", _ESCAPED_DOLLAR)
 
     def replace(match: "re.Match[str]") -> str:
-        var = match.group(1) if match.group(1) is not None else match.group(3)
+        var, operator, operand = ref_parts(match)
         if var not in names:
             return match.group(0)
-        value = os.environ.get(var)
-        if value in (None, "") and match.group(2) is not None:
-            value = match.group(2)
-        if value in (None, ""):
+        value = resolve_env_ref(var, operator, operand, os.environ)
+        # Unresolvable: left standing so the manager reports it against the
+        # stack, rather than silently deploying an empty value.
+        if value is None:
             return match.group(0)
         for old, new in replacements.items():
             value = value.replace(old, new)
@@ -907,8 +907,8 @@ class DockerStack:
     @staticmethod
     def _iter_env_refs(value: str):
         for match in ENV_VAR_PATTERN.finditer(value):
-            name = match.group(1) if match.group(1) is not None else match.group(3)
-            default = match.group(2) if match.group(1) is not None else None
+            name, operator, operand = _ref_name_operator_operand(match)
+            default = operand if operator in ENV_DEFAULT_OPERATORS else None
             yield name, default
 
     @staticmethod
@@ -1573,9 +1573,7 @@ class DockerStack:
 
         manager_deploy = self._manager_client_for_feature(FEATURE_STACK_DEPLOY)
         if manager_deploy and tag:
-            raise RuntimeError(
-                "Docker-Manager stack deploy does not expose deployment tags; refusing to silently ignore --tag"
-            )
+            raise RuntimeError("Docker-Manager stack deploy does not expose deployment tags; refusing to silently ignore --tag")
         manager_options = {}
         if with_registry_auth:
             manager_options["with_registry_auth"] = True

{docker_stack-2.3.2 → docker_stack-2.3.3}/docker_stack/envsubst.py

@@ -8,7 +8,9 @@ DESCRIPTION
 
     supported syntax:
       normal       - ${VARIABLE1} or $VARIABLE1
-      with default - ${VARIABLE1:-somevalue}
+      with default - ${VARIABLE1:-somevalue} or ${VARIABLE1-somevalue}
+      required     - ${VARIABLE1:?message} or ${VARIABLE1?message}
+      alternate    - ${VARIABLE1:+somevalue} or ${VARIABLE1+somevalue}
 """
 
 from dataclasses import dataclass
@@ -18,6 +20,62 @@ import sys
 from typing import Dict, List, Literal, Optional
 
 
+# The compose interpolation grammar, defined once.
+#
+# Docker-Manager resolves these same forms server-side, and the CLI leaves
+# references standing for it to resolve, so three places have to agree on what
+# a reference is: this substituter, the stack `.env` collector, and local
+# expansion of secret-sourced variables. A form one of them fails to recognise
+# is collected by nobody and the deploy dies with `missing template variable`
+# naming a variable that was set the whole time.
+#
+# The name is restricted to `[A-Za-z0-9_]` on purpose. A looser class swallows
+# the operator: `${VAR-default}` under `[^}:\s]+` parses as a variable
+# literally named `VAR-default`, which is never set.
+#
+# Groups: 1 name, 2 operator, 3 operand, 4 bare `$NAME`. Colon forms lead the
+# alternation so `:-` is never read as a bare `-`.
+ENV_REF_RE = r"\$\{([A-Za-z0-9_]+)(?:(:-|:\?|:\+|-|\?|\+)(.*?))?\}|\$([a-zA-Z_][a-zA-Z0-9_]*)"
+
+ENV_VAR_PATTERN = re.compile(ENV_REF_RE)
+
+# Operators whose operand stands in for the variable's own value. `:?`/`?` take
+# an error message and `:+`/`+` an alternate used only when the variable IS set,
+# so treating either as a default ships a value the author never wrote.
+ENV_DEFAULT_OPERATORS = frozenset({":-", "-"})
+
+
+def ref_parts(match: "re.Match[str]"):
+    """Splits an ENV_VAR_PATTERN match into (name, operator, operand)."""
+    if match.group(1) is not None:
+        return match.group(1), match.group(2), match.group(3)
+    return match.group(4), None, None
+
+
+def resolve_env_ref(name: str, operator: Optional[str], operand: Optional[str], env) -> Optional[str]:
+    """Resolves one reference, mirroring the manager's `substitute_template`.
+
+    Returns None when the reference cannot be resolved, which the caller
+    reports rather than substituting an empty value.
+    """
+    existing = env.get(name, None)
+    is_set = existing is not None
+    is_nonempty = bool(existing)
+    if operator == ":-":
+        return existing if is_nonempty else operand
+    if operator == "-":
+        return existing if is_set else operand
+    if operator == ":+":
+        return operand if is_nonempty else ""
+    if operator == "+":
+        return operand if is_set else ""
+    if operator == ":?":
+        return existing if is_nonempty else None
+    if operator == "?":
+        return existing if is_set else None
+    return existing if is_nonempty else None
+
+
 @dataclass
 class LineCheckResult:
     line_no: int
@@ -102,8 +160,10 @@ class SubstitutionError(Exception):
 def envsubst(template_str, env=os.environ, replacements: Dict[str, str] = None, on_error: Literal["exit", "throw"] = "exit"):
     """Substitute environment variables in the template string, supporting default values."""
 
-    # Combined regex for ${VAR:-default} and $VAR, and also $$
-    pattern = re.compile(r"\$\_ESCAPED_DOLLAR_|\$\{([^}:\s]+)(?::-(.*?))?\}|\$([a-zA-Z_][a-zA-Z0-9_]*)")
+    # The shared grammar, with the escaped-dollar placeholder in front. That
+    # alternative captures nothing, so the group numbers stay as ENV_REF_RE
+    # defines them.
+    pattern = re.compile(r"\$\_ESCAPED_DOLLAR_|" + ENV_REF_RE)
 
     # Handle escaped dollars
     template_str = template_str.replace("$$", "$_ESCAPED_DOLLAR_")
@@ -120,24 +180,12 @@ def envsubst(template_str, env=os.environ, replacements: Dict[str, str] = None,
         def replacer(match: re.Match[str]):
             if match.group(0) == "$_ESCAPED_DOLLAR_":
                 return "$$"
-            # Group 1, 2 for ${VAR:-default}
-            if match.group(1) is not None:
-                var = match.group(1)
-                has_default = match.group(2) is not None
-                default_value = match.group(2) if has_default else None
-                result = env.get(var, None)
-                if result in (None, "") and has_default:
-                    result = default_value
-                if result in (None, "") and not has_default:
-                    line_errors_raw.append((var, match.start(1)))  # Use match.start(1) for ${VAR}
-                    return match.group(0)  # Keep original if variable not found
-            # Group 3 for $VAR
-            else:
-                var = match.group(3)
-                result = env.get(var, None)
-                if result in (None, ""):
-                    line_errors_raw.append((var, match.start(3)))  # Use match.start(3) for $VAR
-                    return match.group(0)  # Keep original if variable not found
+            var, operator, operand = ref_parts(match)
+            start = match.start(1) if match.group(1) is not None else match.start(4)
+            result = resolve_env_ref(var, operator, operand, env)
+            if result is None:
+                line_errors_raw.append((var, start))
+                return match.group(0)  # Keep original if variable not found
 
             if replacements:
                 for old, new in replacements.items():

{docker_stack-2.3.2 → docker_stack-2.3.3}/docker_stack/login.py

@@ -466,12 +466,7 @@ def resolve_login_config(
             inferred_context_name = manager_target
             if isolated_context_target:
                 resolved_docker_config_dir = isolated_config_dir
-    endpoint_context_name = (
-        context_name
-        or os.getenv("DOCKER_MANAGER_CONTEXT_NAME")
-        or inferred_context_name
-        or current_context_name
-    )
+    endpoint_context_name = context_name or os.getenv("DOCKER_MANAGER_CONTEXT_NAME") or inferred_context_name or current_context_name
     if manager_target:
         resolved_manager_url, skip_tls_verify = _resolve_manager_endpoint(
             raw_manager_value,
@@ -1038,9 +1033,7 @@ def browser_login(
         refresh_token = str(refresh_token) if isinstance(refresh_token, str) and refresh_token.strip() else None
         refresh_expires_in = token_response.get("refresh_expires_in")
         refresh_expires_at = (
-            int(time.time()) + int(refresh_expires_in)
-            if isinstance(refresh_expires_in, int) and refresh_expires_in > 0
-            else None
+            int(time.time()) + int(refresh_expires_in) if isinstance(refresh_expires_in, int) and refresh_expires_in > 0 else None
         )
         return DockerManagerLoginResult(
             access_token=access_token,

{docker_stack-2.3.2 → docker_stack-2.3.3}/docker_stack/manager_api.py

@@ -189,11 +189,7 @@ def _public_deploy_options(options: Optional[Dict[str, Any]], compose: str) -> O
 def _public_image_deploy_options(options: Optional[Dict[str, Any]], images: Dict[str, str]) -> Optional[Dict[str, Any]]:
     prepared = dict(options or {})
     if prepared.get("with_registry_auth"):
-        registries = {
-            _image_registry(image.strip())
-            for image in images.values()
-            if isinstance(image, str) and image.strip()
-        }
+        registries = {_image_registry(image.strip()) for image in images.values() if isinstance(image, str) and image.strip()}
         registry_auth = _docker_config_registry_auths(registries)
         if registry_auth:
             prepared["registry_auth"] = registry_auth
@@ -711,9 +707,7 @@ class ManagerApiClient:
                     raise
                 now = time.monotonic()
                 if on_wait and (last_notice is None or now - last_notice >= DEPLOY_WAIT_NOTICE_SECS):
-                    on_wait(
-                        {**exc.active_deployment, "phase": "waiting", "waited_secs": waited, "wait_budget_secs": budget}
-                    )
+                    on_wait({**exc.active_deployment, "phase": "waiting", "waited_secs": waited, "wait_budget_secs": budget})
                     last_notice = now
                 if wait_for_poll is None:
                     time.sleep(DEPLOY_WAIT_POLL_SECS)
@@ -759,9 +753,7 @@ class ManagerApiClient:
         return True
 
     def list_stacks(self, *, namespace: Optional[str] = DEFAULT_NAMESPACE) -> Dict[str, Any]:
-        query = urllib.parse.urlencode(
-            {"namespace": namespace} if namespace is not None else {"all_namespaces": "true"}
-        )
+        query = urllib.parse.urlencode({"namespace": namespace} if namespace is not None else {"all_namespaces": "true"})
         if self._detect_manager_backend():
             return self._request_json(f"/api/docker-stack/stacks?{query}")
         return self._request_json(f"{self._endpoint_path('/inventory/stacks')}?{query}")
@@ -858,9 +850,7 @@ class ManagerApiClient:
             params["limit"] = str(limit)
         if latest:
             params["latest"] = "1"
-        payload = self._request_json(
-            f"/api/docker-stack/containers?{urllib.parse.urlencode(params)}"
-        )
+        payload = self._request_json(f"/api/docker-stack/containers?{urllib.parse.urlencode(params)}")
         if not isinstance(payload, dict) or not isinstance(payload.get("containers"), list):
             raise RuntimeError("Docker-Manager containers response is invalid")
         return payload
@@ -1080,9 +1070,7 @@ class ManagerApiClient:
         )
 
 
-def discover_manager_client(
-    timeout_secs: int = 5, *, strict: bool = False
-) -> Optional[ManagerApiClient]:
+def discover_manager_client(timeout_secs: int = 5, *, strict: bool = False) -> Optional[ManagerApiClient]:
     """Build a client for the manager behind DOCKER_MANAGER_URL or the Docker context.
 
     ``strict`` raises the concrete reason instead of returning ``None``. Callers that
@@ -1105,9 +1093,7 @@ def discover_manager_client(
             config = resolve_login_config(manager_target=context_target)
         else:
             if strict:
-                raise RuntimeError(
-                    "no Docker-Manager endpoint found: DOCKER_MANAGER_URL is unset and the docker CLI is not installed"
-                )
+                raise RuntimeError("no Docker-Manager endpoint found: DOCKER_MANAGER_URL is unset and the docker CLI is not installed")
             return None
     except RuntimeError:
         if strict:

{docker_stack-2.3.2 → docker_stack-2.3.3}/docker_stack/shell_auth.py

@@ -542,13 +542,11 @@ def _write_shell_wrappers(
     zsh_dir = session_dir / "zsh"
     zsh_dir.mkdir(mode=0o700)
     original_bashrc = Path.home() / ".bashrc"
-    original_zshrc_root = Path(
-        os.getenv(SHELL_ORIGINAL_ZDOTDIR_ENV) or os.getenv("ZDOTDIR", str(Path.home()))
-    )
+    original_zshrc_root = Path(os.getenv(SHELL_ORIGINAL_ZDOTDIR_ENV) or os.getenv("ZDOTDIR", str(Path.home())))
     original_zshrc = original_zshrc_root / ".zshrc"
     original_zsh_history = original_zshrc_root / ".zsh_history"
     bash_rc.write_text(
-        f'''[ -f {json.dumps(str(original_bashrc))} ] && source {json.dumps(str(original_bashrc))}
+        f"""[ -f {json.dumps(str(original_bashrc))} ] && source {json.dumps(str(original_bashrc))}
 __docker_stack_base_ps1="$PS1"
 __docker_stack_prompt_update() {{
   local state expires now color reset node
@@ -570,13 +568,13 @@ __docker_stack_prompt_update() {{
 }}
 case ";${{PROMPT_COMMAND:-}};" in *';__docker_stack_prompt_update;'*) ;; *) PROMPT_COMMAND="__docker_stack_prompt_update${{PROMPT_COMMAND:+;$PROMPT_COMMAND}}";; esac
 docker() {{ docker-stack shell-auth ensure || return $?; docker-stack docker -- "$@"; }}
-''',
+""",
         encoding="utf-8",
     )
     os.chmod(bash_rc, 0o600)
     zsh_rc = zsh_dir / ".zshrc"
     zsh_rc.write_text(
-        f'''typeset -g __docker_stack_session_zdotdir="$ZDOTDIR"
+        f"""typeset -g __docker_stack_session_zdotdir="$ZDOTDIR"
 typeset -g ZDOTDIR={json.dumps(str(original_zshrc_root))}
 typeset -g HISTFILE={json.dumps(str(original_zsh_history))}
 typeset -g SHELL_SESSION_HISTORY=0
@@ -606,7 +604,7 @@ __docker_stack_prompt_update() {{
 }}
 add-zsh-hook precmd __docker_stack_prompt_update
 docker() {{ docker-stack shell-auth ensure || return $?; docker-stack docker -- "$@"; }}
-''',
+""",
         encoding="utf-8",
     )
     os.chmod(zsh_rc, 0o600)
@@ -738,9 +736,7 @@ def run_managed_shell(config: DockerManagerLoginConfig, result: DockerManagerLog
         # need to re-probe it (a verified probe against a private CA only
         # produces aborted TLS connections on the manager).
         env[DOCKER_MANAGER_SKIP_TLS_VERIFY_ENV] = "1" if config.skip_tls_verify else "0"
-        env[SHELL_ORIGINAL_ZDOTDIR_ENV] = str(
-            Path(os.getenv(SHELL_ORIGINAL_ZDOTDIR_ENV) or os.getenv("ZDOTDIR", str(Path.home())))
-        )
+        env[SHELL_ORIGINAL_ZDOTDIR_ENV] = str(Path(os.getenv(SHELL_ORIGINAL_ZDOTDIR_ENV) or os.getenv("ZDOTDIR", str(Path.home()))))
         command = [shell, "--rcfile", str(session_dir / "bashrc"), "-i"] if shell_name == "bash" else [shell, "-i"]
         return subprocess.run(command, check=False, env=env).returncode
     finally:

{docker_stack-2.3.2 → docker_stack-2.3.3}/docker_stack.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: docker-stack
-Version: 2.3.2
+Version: 2.3.3
 Summary: CLI for deploying and managing Docker stacks.
 Home-page: https://github.com/mesudip/docker-stack
 Author: Sudip Bhattarai

{docker_stack-2.3.2 → docker_stack-2.3.3}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="docker-stack",
-    version="2.3.2",
+    version="2.3.3",
     description="CLI for deploying and managing Docker stacks.",
     long_description=open("README.md").read(),  # You can include a README file to describe your package
     long_description_content_type="text/markdown",

{docker_stack-2.3.2 → docker_stack-2.3.3}/tests/test_docker_stack.py

@@ -45,8 +45,7 @@ def test_node_use_updates_only_managed_shell_config(monkeypatch, tmp_path):
                 {"id": "node-worker-123", "hostname": "worker-02", "state": "Ready"},
             ]
         },
-        check_node_agent=lambda selector: checked.append(selector)
-        or {"node_id": selector, "node_name": "worker-02", "agent": "ready"},
+        check_node_agent=lambda selector: checked.append(selector) or {"node_id": selector, "node_name": "worker-02", "agent": "ready"},
     )
     monkeypatch.setattr("docker_stack.cli._require_manager", lambda: client)
 
@@ -84,7 +83,7 @@ def test_managed_docker_ps_renders_node_column(monkeypatch, capsys):
                 }
             ],
             "node_errors": [],
-        }
+        },
     )
     monkeypatch.setattr("docker_stack.cli.discover_manager_client", lambda: client)
 
@@ -128,7 +127,15 @@ def test_managed_docker_ps_matches_docker_columns(monkeypatch, capsys):
     header, row = capsys.readouterr().out.splitlines()
 
     assert header.split() == [
-        "CONTAINER", "ID", "IMAGE", "COMMAND", "CREATED", "STATUS", "PORTS", "NAMES", "NODE",
+        "CONTAINER",
+        "ID",
+        "IMAGE",
+        "COMMAND",
+        "CREATED",
+        "STATUS",
+        "PORTS",
+        "NAMES",
+        "NODE",
     ]
     assert row.startswith("467fce208a05   ")
     assert '"sh -c \'java $JAVA_O\u2026"' in row
@@ -193,8 +200,7 @@ def test_managed_docker_ps_forwards_global_latest_and_limit(monkeypatch):
     calls = []
     client = SimpleNamespace(
         is_manager_backend=lambda: True,
-        list_containers=lambda **kwargs: calls.append(kwargs)
-        or {"containers": [], "node_errors": []},
+        list_containers=lambda **kwargs: calls.append(kwargs) or {"containers": [], "node_errors": []},
     )
     monkeypatch.setattr("docker_stack.cli.discover_manager_client", lambda: client)
 
@@ -686,7 +692,8 @@ def test_rendered_compose_normalizes_main_source_name(monkeypatch, tmp_path):
 
 def test_build_uses_service_dockerfile(tmp_path):
     compose_file = tmp_path / "docker-compose.yml"
-    compose_file.write_text("""
+    compose_file.write_text(
+        """
 services:
   storybook:
     image: example/storybook:test
@@ -695,7 +702,8 @@ services:
       dockerfile: storybook.Dockerfile
       args:
         NPMRC_TOKEN: dummy
-""".strip())
+""".strip()
+    )
 
     docker = Docker()
     docker.stack.build_and_push(str(compose_file))
@@ -1015,9 +1023,7 @@ def test_manager_deploy_prints_generated_secret_values(capsys):
                 "warnings": [],
                 "stdout": "",
                 "stderr": "",
-                "generated_secrets": [
-                    {"logical_name": "app-token", "actual_name": "team-a_app-token", "value": "generated-value"}
-                ],
+                "generated_secrets": [{"logical_name": "app-token", "actual_name": "team-a_app-token", "value": "generated-value"}],
             }
 
     Docker().stack._deploy_via_manager(
@@ -1500,7 +1506,9 @@ def test_shell_explicit_target_persists_context_before_opening(monkeypatch):
     events = []
     monkeypatch.setattr("docker_stack.cli.resolve_shell_login_config", lambda **_kwargs: config)
     monkeypatch.setattr("docker_stack.cli.persist_shell_context", lambda value: events.append(("persist", value.context_name)))
-    monkeypatch.setattr("docker_stack.cli.browser_login", lambda _config: events.append(("login", "saas-a")) or SimpleNamespace(expires_at=None))
+    monkeypatch.setattr(
+        "docker_stack.cli.browser_login", lambda _config: events.append(("login", "saas-a")) or SimpleNamespace(expires_at=None)
+    )
     monkeypatch.setattr("docker_stack.cli.run_managed_shell", lambda _config, _result: 0)
 
     with pytest.raises(SystemExit) as excinfo:
@@ -1919,3 +1927,70 @@ secrets:
     # The secret is inlined here instead, so its value never lands in .env.
     assert data["secrets"]["api_token"]["x-content"] == "t0ken"
     assert "API_TOKEN" not in decode_x_files(rendered.enriched)[".env"]
+
+
+# Compose interpolation forms the manager's `substitute_template` understands.
+# The CLI leaves these standing for the manager to resolve, so every variable
+# one of them names has to reach the manager in the stack `.env`. Forms the CLI
+# fails to recognise are collected by nothing and the deploy dies with
+# `missing template variable` against a variable that was set the whole time.
+MANAGER_INTERPOLATION_FORMS = [
+    "${DEPLOY_VAR}",
+    "${DEPLOY_VAR:-fallback}",
+    "${DEPLOY_VAR-fallback}",
+    "${DEPLOY_VAR:?must be set}",
+    "${DEPLOY_VAR?}",
+    "${DEPLOY_VAR:+present}",
+    "${DEPLOY_VAR+present}",
+    "$DEPLOY_VAR",
+]
+
+
+def _manager_resolvable(rendered, name):
+    """Whether the manager could resolve `name` from what the CLI shipped.
+
+    Either the reference was expanded before sending, or the value travels in
+    the stack `.env` the manager interpolates from.
+    """
+    if name not in rendered.clean:
+        return True
+    return f"{name}=" in decode_x_files(rendered.enriched).get(".env", "")
+
+
+@pytest.mark.parametrize("form", MANAGER_INTERPOLATION_FORMS)
+def test_every_manager_interpolation_form_ships_its_variable(monkeypatch, tmp_path, form):
+    monkeypatch.setenv("DEPLOY_VAR", '{"dev":"k1"}')
+    compose_text = (
+        "services:\n"
+        "  annotator-api:\n"
+        "    image: nginx:alpine\n"
+        "    environment:\n"
+        f'      ANNOTATOR_API_KEYS_JSON: "{form}"\n'
+    )
+
+    rendered = _render_for_manager(monkeypatch, tmp_path, compose_text)
+
+    assert _manager_resolvable(rendered, "DEPLOY_VAR"), (
+        f"{form} reaches the manager unresolved and DEPLOY_VAR is absent from .env"
+    )
+
+
+def test_conditional_operand_is_not_mistaken_for_a_default(monkeypatch, tmp_path):
+    """`:+` supplies a value only when the variable IS set; it is not a default.
+
+    Collecting the operand as one would write `FEATURE_FLAGS=present` into the
+    `.env` for an unset variable, so the manager would expand the alternate
+    value as though it were the variable's own.
+    """
+    monkeypatch.delenv("FEATURE_FLAGS", raising=False)
+    compose_text = (
+        "services:\n"
+        "  annotator-api:\n"
+        "    image: nginx:alpine\n"
+        "    environment:\n"
+        '      FLAGS: "${FEATURE_FLAGS:+present}"\n'
+    )
+
+    rendered = _render_for_manager(monkeypatch, tmp_path, compose_text)
+
+    assert "FEATURE_FLAGS=present" not in decode_x_files(rendered.enriched).get(".env", "")

{docker_stack-2.3.2 → docker_stack-2.3.3}/tests/test_login.py

@@ -502,7 +502,9 @@ def test_resolve_login_config_ignores_malformed_context_host(monkeypatch):
 
 
 def test_resolve_login_config_detects_tls_for_positional_target(monkeypatch):
-    monkeypatch.setattr("docker_stack.login.detect_manager_url", lambda value, verify_ssl=False, **_kwargs: ("https://172.31.0.6:2378", True))
+    monkeypatch.setattr(
+        "docker_stack.login.detect_manager_url", lambda value, verify_ssl=False, **_kwargs: ("https://172.31.0.6:2378", True)
+    )
 
     config = resolve_login_config(manager_target="172.31.0.6:2378", context_name="office")
 
@@ -516,7 +518,9 @@ def test_resolve_login_config_prefers_named_context_for_portless_target(monkeypa
         "docker_stack.login.docker_context_target",
         lambda context_name, docker_config_dir=None: "tcp://172.31.0.6:2378" if context_name == "office" else None,
     )
-    monkeypatch.setattr("docker_stack.login.detect_manager_url", lambda value, verify_ssl=False, **_kwargs: ("https://172.31.0.6:2378", True))
+    monkeypatch.setattr(
+        "docker_stack.login.detect_manager_url", lambda value, verify_ssl=False, **_kwargs: ("https://172.31.0.6:2378", True)
+    )
 
     config = resolve_login_config(manager_target="office")
 
@@ -550,7 +554,9 @@ def test_resolve_login_config_uses_current_context_target(monkeypatch):
         "docker_stack.login.current_docker_context_target",
         lambda: ("office", "tcp://172.31.0.6:2378"),
     )
-    monkeypatch.setattr("docker_stack.login.detect_manager_url", lambda value, verify_ssl=False, **_kwargs: ("https://172.31.0.6:2378", True))
+    monkeypatch.setattr(
+        "docker_stack.login.detect_manager_url", lambda value, verify_ssl=False, **_kwargs: ("https://172.31.0.6:2378", True)
+    )
 
     config = resolve_login_config()
 

{docker_stack-2.3.2 → docker_stack-2.3.3}/tests/test_manager_api.py

@@ -761,9 +761,7 @@ def test_abort_forbidden_is_a_typed_error(monkeypatch):
     client = ManagerApiClient("https://172.31.0.6:2378", skip_tls_verify=True)
 
     def urlopen(request, **_kwargs):
-        raise urllib.error.HTTPError(
-            request.full_url, 403, "Forbidden", {}, io.BytesIO(b'{"message":"stack deploy permission required"}')
-        )
+        raise urllib.error.HTTPError(request.full_url, 403, "Forbidden", {}, io.BytesIO(b'{"message":"stack deploy permission required"}'))
 
     monkeypatch.setattr("docker_stack.manager_api.ensure_shell_access", lambda: None)
     monkeypatch.setattr("docker_stack.manager_api._docker_config_headers", dict)
@@ -807,7 +805,10 @@ def test_force_reports_when_a_different_run_was_aborted(monkeypatch):
     monkeypatch.setattr(
         client,
         "abort_active_deployment",
-        lambda **_kw: {"aborted": {"operation": "image deploy", "actor": "ci", "deployment_id": None, "started_at_ms": 5}, "released": True},
+        lambda **_kw: {
+            "aborted": {"operation": "image deploy", "actor": "ci", "deployment_id": None, "started_at_ms": 5},
+            "released": True,
+        },
     )
 
     client.deploy_stack_stream(
@@ -958,7 +959,9 @@ def test_rollback_stack_threads_wait_for_poll_and_force(monkeypatch):
 
     monkeypatch.setattr(client, "_request_json", fake_request)
 
-    payload = client.rollback_stack(stack="web", namespace="team-a", version="3", on_wait=notices.append, wait_for_poll=lambda a, s: "force")
+    payload = client.rollback_stack(
+        stack="web", namespace="team-a", version="3", on_wait=notices.append, wait_for_poll=lambda a, s: "force"
+    )
 
     assert payload["stdout"] == "rolled back"
     assert ("POST", "/api/stacks/deploy/abort", {"namespace": "team-a", "stack": "web"}, 45) in calls

{docker_stack-2.3.2 → docker_stack-2.3.3}/tests/test_shell_auth.py

@@ -239,11 +239,15 @@ def test_missing_and_wrong_secrets_are_rejected_identically(tmp_path, monkeypatc
         base = {"version": PROTOCOL_VERSION, "operation": "status"}
         missing = raw_request(broker.socket_path, base)
         wrong = raw_request(broker.socket_path, {**base, "secret": "wrong"})
-        assert missing == wrong == {
-            "ok": False,
-            "reason": "unauthorized",
-            "message": "shell authentication rejected",
-        }
+        assert (
+            missing
+            == wrong
+            == {
+                "ok": False,
+                "reason": "unauthorized",
+                "message": "shell authentication rejected",
+            }
+        )
     finally:
         stop_broker(broker, thread, monkeypatch)
 
@@ -290,7 +294,7 @@ def test_prompt_hooks_only_read_local_status_and_docker_wrapper_preflights(tmp_p
     wrapper = (tmp_path / "bashrc").read_text(encoding="utf-8")
     prompt_function = wrapper.split("__docker_stack_prompt_update() {", 1)[1].split("}", 1)[0]
     assert "shell-auth" not in prompt_function
-    assert "docker-stack shell-auth ensure || return $?; docker-stack docker -- \"$@\"" in wrapper
+    assert 'docker-stack shell-auth ensure || return $?; docker-stack docker -- "$@"' in wrapper
     assert "(docker:office@${node})" in wrapper
     assert "(docker:!DOCKER_HOST)" in wrapper
 
@@ -395,7 +399,9 @@ def test_shell_supervisor_isolates_secret_and_removes_all_session_artifacts(tmp_
     monkeypatch.setenv("HOME", str(tmp_path))
     monkeypatch.setenv("SHELL", "/bin/bash")
     monkeypatch.setenv("DOCKER_STACK_SHELL_SECRET", "outer-shell-secret")
-    monkeypatch.setattr("docker_stack.shell_auth.configure_docker_context_in_store", lambda _config, path: captured.setdefault("session", path))
+    monkeypatch.setattr(
+        "docker_stack.shell_auth.configure_docker_context_in_store", lambda _config, path: captured.setdefault("session", path)
+    )
 
     def fake_popen(command, **kwargs):
         captured["broker_command"] = command