dooers-cli 0.7.0__tar.gz → 0.7.2__tar.gz

{dooers_cli-0.7.0 → dooers_cli-0.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dooers-cli
-Version: 0.7.0
+Version: 0.7.2
 Summary: Dooers CLI — push agents to Dooers, manage agent records, authenticate from the terminal
 Project-URL: Repository, https://github.com/Dooers-ai/dooers-cli
 Author-email: Dooers <dev@dooers.ai>
@@ -15,7 +15,7 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Typing :: Typed
 Requires-Python: >=3.10
-Requires-Dist: dooers-protocol>=0.6.0
+Requires-Dist: dooers-protocol>=0.6.1
 Requires-Dist: httpx>=0.28.1
 Requires-Dist: pydantic>=2.13.2
 Requires-Dist: pyyaml>=6.0.2

{dooers_cli-0.7.0 → dooers_cli-0.7.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "dooers-cli"
-version = "0.7.0"
+version = "0.7.2"
 description = "Dooers CLI — push agents to Dooers, manage agent records, authenticate from the terminal"
 readme = "README.md"
 license = "MIT"
@@ -26,7 +26,7 @@ dependencies = [
     "pydantic>=2.13.2",
     "pyyaml>=6.0.2",
     "tqdm>=4.66.4",
-    "dooers-protocol>=0.6.0",
+    "dooers-protocol>=0.6.1",
 ]
 
 [tool.uv.sources]

{dooers_cli-0.7.0 → dooers_cli-0.7.2}/src/dooers/cli/agent_store.py

@@ -11,12 +11,26 @@ class AgentStoreError(RuntimeError):
 
 
 def _data(resp: httpx.Response):
-    body = resp.json()
+    # The body may not be JSON: framework-level errors (e.g. a 403 "Forbidden")
+    # and empty success bodies (204) are common. Never let json() crash the CLI.
+    try:
+        body = resp.json()
+    except (json.JSONDecodeError, ValueError):
+        body = None
+
     if isinstance(body, dict) and body.get("success") is False:
         raise AgentStoreError(body.get("error", {}).get("message", f"HTTP {resp.status_code}"))
     if resp.status_code >= 400:
-        raise AgentStoreError(f"HTTP {resp.status_code}")
-    return body.get("data", body)
+        detail = ""
+        if isinstance(body, dict):
+            err = body.get("error")
+            if isinstance(err, dict):
+                detail = err.get("message", "")
+            detail = detail or body.get("message", "")
+        detail = detail or (resp.text or "").strip()
+        msg = f"HTTP {resp.status_code}"
+        raise AgentStoreError(f"{msg}: {detail}" if detail else msg)
+    return body.get("data", body) if isinstance(body, dict) else body
 
 
 def _record(d: dict) -> AgentRecord:
@@ -27,6 +41,7 @@ def _record(d: dict) -> AgentRecord:
         organization_id=d.get("organizationId"),
         host_url=d.get("hostUrl"),
         status=d.get("status"),
+        runtime_api_key=d.get("runtimeApiKey"),
     )
 
 
@@ -77,3 +92,11 @@ class HTTPCoreAgentStore:
             f"{self.api}/agents/{agent_id}", headers=self._h(), timeout=self._timeout
         )
         _data(r)  # success body is {success, message} with no data key — do NOT call _record()
+
+    def regenerate_runtime_api_key(self, agent_id: str) -> AgentRecord:
+        r = httpx.post(
+            f"{self.api}/agents/{agent_id}/runtime-api-key/regenerate",
+            headers=self._h(),
+            timeout=self._timeout,
+        )
+        return _record(_data(r))

{dooers_cli-0.7.0 → dooers_cli-0.7.2}/src/dooers/cli/agents.py

@@ -15,6 +15,7 @@ from dooers.protocol.teardown import format_teardown_result
 
 from dooers.cli import config
 from dooers.cli.agent_store import AgentStoreError, HTTPCoreAgentStore
+from dooers.cli.env_prod import upsert_agent_seed_secret
 from dooers.cli.org import resolve_org_for_cli
 from dooers.cli.push_client import PushClient, PushClientError
 from dooers.cli.settings import Settings
@@ -65,9 +66,40 @@ def create(
         directory=Path.cwd(),
     )
     typer.echo(f"Created {rec.agent_id}. {config.MANIFEST_FILENAME} written.")
+    if rec.runtime_api_key:
+        env_path = upsert_agent_seed_secret(Path.cwd(), rec.runtime_api_key)
+        typer.echo(f"Wrote AGENT_SEED_SECRET to {env_path.name} (shown once — store it safely).")
+    else:
+        typer.echo(
+            "Warning: core did not return a runtime API key. "
+            "Set Agent access key in Studio and AGENT_SEED_SECRET in env.prod before push.",
+            err=True,
+        )
     typer.echo("Edit dooers.yaml (message_path, whatsapp, profile) then run dooers push.")
 
 
+@app.command("rotate-key")
+def rotate_key(
+    ctx: typer.Context,
+    agent_id: str = typer.Argument(..., help="Agent id to rotate the runtime API key for."),
+) -> None:
+    store, _, _ = _store(ctx)
+    try:
+        rec = store.regenerate_runtime_api_key(agent_id)
+    except AgentStoreError as e:
+        typer.echo(f"rotate-key failed: {e}", err=True)
+        raise typer.Exit(code=1) from e
+    if rec.runtime_api_key:
+        env_path = upsert_agent_seed_secret(Path.cwd(), rec.runtime_api_key)
+        typer.echo(f"Wrote AGENT_SEED_SECRET to {env_path.name} (shown once — store it safely).")
+    else:
+        typer.echo(
+            "Warning: core did not return a runtime API key. Check Studio for the new key.",
+            err=True,
+        )
+    typer.echo("Run dooers push to deploy the updated secret to your agent host.")
+
+
 @app.command(name="list")
 def list_agents(ctx: typer.Context, org: str | None = typer.Option(None, "--org")) -> None:
     store, settings, _ = _store(ctx)

dooers_cli-0.7.2/src/dooers/cli/env_prod.py

@@ -0,0 +1,31 @@
+"""Helpers for maintaining env.prod alongside dooers push."""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+_ENV_PROD = "env.prod"
+_SEED_LINE = re.compile(r"^AGENT_SEED_SECRET=.*$", re.MULTILINE)
+
+
+def upsert_agent_seed_secret(directory: Path, secret: str) -> Path:
+    """Write or replace AGENT_SEED_SECRET in env.prod (creates file if missing)."""
+    path = directory / _ENV_PROD
+    line = f"AGENT_SEED_SECRET={secret.strip()}\n"
+    if path.is_file():
+        text = path.read_text(encoding="utf-8")
+        if _SEED_LINE.search(text):
+            text = _SEED_LINE.sub(line.rstrip("\n"), text)
+        else:
+            if text and not text.endswith("\n"):
+                text += "\n"
+            text += "\n# Runtime API key (core ↔ agent settings.seed)\n" + line
+        path.write_text(text, encoding="utf-8")
+    else:
+        path.write_text(
+            "# Production runtime env (uploaded by dooers push; never commit secrets to git)\n"
+            + line,
+            encoding="utf-8",
+        )
+    return path

{dooers_cli-0.7.0 → dooers_cli-0.7.2}/src/dooers/cli/ignore.py

@@ -13,6 +13,8 @@ from pathlib import Path
 DEFAULT_IGNORE_PATTERNS: list[str] = [
     ".git/",
     ".gitignore",
+    ".env",
+    ".env.*",
     ".venv/",
     "venv/",
     "node_modules/",

{dooers_cli-0.7.0 → dooers_cli-0.7.2}/src/dooers/cli/manifest_sync.py

@@ -15,11 +15,16 @@ def _norm_path(p: str) -> str:
 def build_agent_patch(manifest: AgentManifest, deployed_url: str) -> dict:
     """Map the declarative manifest to a core v2 PATCH /agents/:id body.
 
-    Derives serverConfig.apiMessagesUrl (and whatsapp inbound) from the
-    deployed host + the declared paths. Only includes keys the creator set.
+    Records the deployed URL as ``hostUrl`` and derives
+    serverConfig.apiMessagesUrl (and whatsapp inbound) from the deployed host +
+    the declared paths. Only includes keys the creator set.
+
+    The CLI writes ``hostUrl`` here (with the creator's token) because the async
+    push completion runs in a Pub/Sub webhook that has no core credentials, so
+    dooers-push can no longer write it back itself.
     """
     host = _host_and_seg(deployed_url)
-    patch: dict = {}
+    patch: dict = {"hostUrl": deployed_url}
 
     # Only sync a non-empty description. An empty/absent one means "leave as-is"
     # — never send null, which would wipe a description set elsewhere (e.g. Studio).

{dooers_cli-0.7.0 → dooers_cli-0.7.2}/src/dooers/cli/push.py

@@ -17,7 +17,12 @@ from dooers.protocol.push import (
 
 from dooers.cli import config, ignore
 from dooers.cli.manifest_sync import build_agent_patch
-from dooers.cli.push_client import PushClient, PushClientError, PushTransientError
+from dooers.cli.push_client import (
+    PushClient,
+    PushClientError,
+    PushTransientError,
+    friendly_push_error,
+)
 from dooers.cli.settings import Settings
 from dooers.cli.token_store import TokenStore, is_token_expired
 
@@ -153,7 +158,8 @@ def push(
             agent_id=agent_id, archive_path=archive_path, tag=tag, env=target_env
         )
     except PushClientError as e:
-        typer.echo(f"Push failed: {e}", err=True)
+        code = e.envelope.error_code if e.envelope else None
+        typer.echo(f"Push failed: {friendly_push_error(code, str(e))}", err=True)
         raise typer.Exit(code=1) from e
     finally:
         os.unlink(archive_path)
@@ -170,7 +176,7 @@ def push(
         typer.echo("\nAudit: 0 endpoints detected.")
 
     # Poll until terminal, relabeling the spinner with the current phase.
-    spinner_state: dict[str, Callable[[], None] | str] = {}
+    spinner_state: dict[str, object] = {}
 
     def _start_spinner(label: str) -> None:
         cancel = spinner_state.get("cancel")

{dooers_cli-0.7.0 → dooers_cli-0.7.2}/src/dooers/cli/push_client.py

@@ -3,7 +3,7 @@
 from pathlib import Path
 
 import httpx
-from dooers.protocol.errors import ErrorEnvelope
+from dooers.protocol.errors import ErrorCode, ErrorEnvelope
 from dooers.protocol.push import BuildStatusResponse, PushAcceptedResponse
 from dooers.protocol.teardown import TeardownResponse
 
@@ -11,6 +11,19 @@ from dooers.protocol.teardown import TeardownResponse
 _TRANSIENT_STATUS = frozenset({502, 503, 504})
 
 
+def friendly_push_error(error_code: object, message: str) -> str:
+    """Map a server error code to a CLI-friendly message; fall back to `message`.
+
+    `error_code` may be an `ErrorCode` (a str enum) or a plain string.
+    """
+    if error_code == ErrorCode.org_not_provisioned.value:
+        return (
+            "Your organization isn't set up for agent hosting yet. "
+            "Contact Dooers to enable hosting for your organization."
+        )
+    return message
+
+
 class PushClientError(RuntimeError):
     def __init__(self, message: str, envelope: ErrorEnvelope | None = None) -> None:
         super().__init__(message)

{dooers_cli-0.7.0 → dooers_cli-0.7.2}/src/dooers/cli/validate.py

@@ -93,6 +93,38 @@ def collect_issues(root: Path | None = None) -> list[ValidationIssue]:
                 )
             )
 
+    for env_path in [base / ".env", *base.glob("env.*")]:
+        if not env_path.is_file():
+            continue
+        for raw in env_path.read_text().splitlines():
+            line = raw.strip()
+            if not line or line.startswith("#") or "=" not in line:
+                continue
+            key, _, value = line.partition("=")
+            if key.strip().upper() in {
+                "AGENT_DATABASE_HOST",
+                "DATABASE_HOST",
+                "POSTGRES_HOST",
+            } and value.strip().lower() in {"127.0.0.1", "localhost", "0.0.0.0"}:
+                issues.append(
+                    ValidationIssue(
+                        "warning",
+                        f"{env_path.name} sets {key.strip()} to localhost — "
+                        "hosted deploys need a cloud database configured in Dooers Studio",
+                    )
+                )
+
+    manifest = read_manifest(directory=base) if manifest_path.exists() else None
+    if manifest is not None and manifest.hosting and not (base / "env.prod").is_file():
+        issues.append(
+            ValidationIssue(
+                "warning",
+                "hosting is enabled but env.prod is missing — "
+                "create env.prod with production runtime variables (OPENAI_API_KEY, "
+                "AGENT_DATABASE_*, etc.) for Cloud Run deploys",
+            )
+        )
+
     return issues
 
 

{dooers_cli-0.7.0 → dooers_cli-0.7.2}/tests/test_agent_store.py

@@ -99,3 +99,24 @@ def test_get_populates_status():
     )
     rec = HTTPCoreAgentStore(BASE, "tok").get(A)
     assert rec.status == "active"
+
+
+@respx.mock
+def test_delete_nonjson_403_raises_clean_error_not_jsondecode():
+    # Core returns a framework-level 403 with a plain-text body (not JSON).
+    respx.delete(f"{BASE}/api/v2/agents/{A}").mock(
+        return_value=httpx.Response(403, text="Forbidden")
+    )
+    store = HTTPCoreAgentStore(BASE, "tok")
+    with pytest.raises(AgentStoreError) as ei:
+        store.delete(A)
+    msg = str(ei.value)
+    assert "403" in msg and "Forbidden" in msg  # clean message, no JSONDecodeError
+
+
+@respx.mock
+def test_delete_empty_success_body_does_not_crash():
+    # A 204/empty success body must not blow up json() parsing.
+    respx.delete(f"{BASE}/api/v2/agents/{A}").mock(return_value=httpx.Response(204))
+    store = HTTPCoreAgentStore(BASE, "tok")
+    store.delete(A)  # should simply return without raising

dooers_cli-0.7.2/tests/test_env_prod.py

@@ -0,0 +1,19 @@
+from pathlib import Path
+
+from dooers.cli.env_prod import upsert_agent_seed_secret
+
+
+def test_upsert_creates_env_prod(tmp_path: Path) -> None:
+    path = upsert_agent_seed_secret(tmp_path, "secret-one-time-key-abc")
+    assert path.name == "env.prod"
+    assert path.read_text(encoding="utf-8").strip().endswith("AGENT_SEED_SECRET=secret-one-time-key-abc")
+
+
+def test_upsert_replaces_existing_line(tmp_path: Path) -> None:
+    env = tmp_path / "env.prod"
+    env.write_text("FOO=1\nAGENT_SEED_SECRET=old\nBAR=2\n", encoding="utf-8")
+    upsert_agent_seed_secret(tmp_path, "new-key-xxxxxxxxxxxx")
+    text = env.read_text(encoding="utf-8")
+    assert "AGENT_SEED_SECRET=new-key-xxxxxxxxxxxx" in text
+    assert "AGENT_SEED_SECRET=old" not in text
+    assert "FOO=1" in text

{dooers_cli-0.7.0 → dooers_cli-0.7.2}/tests/test_manifest_sync.py

@@ -166,14 +166,20 @@ def test_description_empty_string_not_in_patch():
 
 
 # ---------------------------------------------------------------------------
-# minimal manifest → empty patch
+# hostUrl — always recorded (the CLI writes it; the async webhook can't)
 # ---------------------------------------------------------------------------
 
 
-def test_minimal_manifest_empty_patch():
+def test_minimal_manifest_records_host_url_only():
     m = _manifest()
     patch = build_agent_patch(m, DEPLOYED)
-    assert patch == {}
+    assert patch == {"hostUrl": DEPLOYED}
+
+
+def test_host_url_always_present_alongside_other_fields():
+    m = _manifest(message_path="/agent", description="A helpful agent")
+    patch = build_agent_patch(m, DEPLOYED)
+    assert patch["hostUrl"] == DEPLOYED
 
 
 # ---------------------------------------------------------------------------

dooers_cli-0.7.2/tests/test_push_failure_display.py

@@ -0,0 +1,44 @@
+"""Push failure display tests."""
+
+from dooers.protocol.errors import ErrorCode
+from dooers.protocol.push import BuildStatus, PushResponse, format_push_failure
+
+from dooers.cli.push_client import friendly_push_error
+
+
+def test_friendly_push_error_org_not_provisioned() -> None:
+    msg = friendly_push_error(ErrorCode.org_not_provisioned, "raw server message")
+    assert "set up for agent hosting" in msg.lower()
+    assert "raw server message" not in msg
+
+
+def test_friendly_push_error_accepts_plain_string_code() -> None:
+    assert "hosting" in friendly_push_error("org_not_provisioned", "x").lower()
+
+
+def test_friendly_push_error_falls_back_to_message() -> None:
+    assert friendly_push_error(ErrorCode.forbidden, "you do not own this agent") == (
+        "you do not own this agent"
+    )
+
+
+def test_format_push_failure_includes_step_and_logs() -> None:
+    response = PushResponse(
+        agent_id="agent-1",
+        build_id="build-123",
+        image="img",
+        status=BuildStatus.failed,
+        error="docker build failed: missing Dockerfile",
+        failed_step="build image",
+        build_log_url="https://console.cloud.google.com/cloud-build/builds/build-123?project=proj",
+    )
+
+    text = format_push_failure(response)
+
+    assert "Deployment failed" in text
+    assert "Failed during: build image" in text
+    assert "docker build failed" in text
+    # Console URL (embeds the project id) must NOT be surfaced; a sanitized
+    # build reference is shown instead. See de1b80c.
+    assert "Build logs:" not in text
+    assert "Reference: build build-123" in text

{dooers_cli-0.7.0 → dooers_cli-0.7.2}/tests/test_validate.py

@@ -80,3 +80,48 @@ organization_id: "org_1"
 
     issues = collect_issues(tmp_path)
     assert any("legacy SDK imports" in i.message for i in issues)
+
+
+def test_validate_warns_on_localhost_database_host(tmp_path: Path) -> None:
+    _write(
+        tmp_path / "dooers.yaml",
+        """
+protocol_version: "2"
+agent_id: "550e8400-e29b-41d4-a716-446655440000"
+name: test
+organization_id: "org_1"
+hosting: true
+""".strip()
+        + "\n",
+    )
+    _write(tmp_path / "Dockerfile", "FROM python:3.12-slim\n")
+    _write(
+        tmp_path / "pyproject.toml",
+        '[project]\ndependencies = ["dooers-agents-server>=0.12.0"]\n',
+    )
+    _write(tmp_path / ".env", "AGENT_DATABASE_HOST=127.0.0.1\n")
+
+    issues = collect_issues(tmp_path)
+    assert any("localhost" in i.message.lower() for i in issues)
+
+
+def test_validate_warns_when_hosting_without_env_prod(tmp_path: Path) -> None:
+    _write(
+        tmp_path / "dooers.yaml",
+        """
+protocol_version: "2"
+agent_id: "550e8400-e29b-41d4-a716-446655440000"
+name: test
+organization_id: "org_1"
+hosting: true
+""".strip()
+        + "\n",
+    )
+    _write(tmp_path / "Dockerfile", "FROM python:3.12-slim\n")
+    _write(
+        tmp_path / "pyproject.toml",
+        '[project]\ndependencies = ["dooers-agents-server>=0.12.0"]\n',
+    )
+
+    issues = collect_issues(tmp_path)
+    assert any("env.prod is missing" in i.message for i in issues)

{dooers_cli-0.7.0 → dooers_cli-0.7.2}/uv.lock

@@ -232,7 +232,7 @@ toml = [
 
 [[package]]
 name = "dooers-cli"
-version = "0.7.0"
+version = "0.7.2"
 source = { editable = "." }
 dependencies = [
     { name = "dooers-protocol" },
@@ -278,7 +278,7 @@ provides-extras = ["dev"]
 
 [[package]]
 name = "dooers-protocol"
-version = "0.6.0"
+version = "0.6.1"
 source = { editable = "../dooers-protocol" }
 dependencies = [
     { name = "pydantic" },

dooers_cli-0.7.0/tests/test_push_failure_display.py

@@ -1,22 +0,0 @@
-"""Push failure display tests."""
-
-from dooers.protocol.push import BuildStatus, PushResponse, format_push_failure
-
-
-def test_format_push_failure_includes_step_and_logs() -> None:
-    response = PushResponse(
-        agent_id="agent-1",
-        build_id="build-123",
-        image="img",
-        status=BuildStatus.failed,
-        error="docker build failed: missing Dockerfile",
-        failed_step="build image",
-        build_log_url="https://console.cloud.google.com/cloud-build/builds/build-123?project=proj",
-    )
-
-    text = format_push_failure(response)
-
-    assert "Deployment failed" in text
-    assert "Failed during: build image" in text
-    assert "docker build failed" in text
-    assert "Build logs:" in text