fp-cloud-cli 0.0.1b1__tar.gz → 0.0.1b2__tar.gz

{fp_cloud_cli-0.0.1b1 → fp_cloud_cli-0.0.1b2}/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog — `fp` CLI
 
+## 0.0.1b2 — 2026-08-25
+
+Open for the next release. `0.0.1b1` published on 2026-08-24 and the `bump` job
+moved the version here automatically. Add entries as changes merge — this section
+becomes the GitHub Release body when it ships.
+
+### Fixes
+
+- **Typed errors keep their exit codes under typer 0.27.2.** That release moved
+  `Abort` out of its vendored `typer._click.exceptions`, and `_click_compat`
+  imported all six of its symbols under a single
+  `try: … except ImportError: from click import …`. One missing name was enough
+  to send the whole block to the fallback, binding `ClickException`,
+  `UsageError`, `BadParameter`, `Command` and `Parameter` to the pip `click`
+  distribution — which is *not* the Click Typer runs, and Typer catches only its
+  own. So every typed error escaped its handler: `fp alerts show ghost` exited
+  **1 with an empty stderr** instead of **6** with `no alert named "ghost"`, and
+  likewise for exits 2, 3, 4 and 5. Nothing warned; the CLI imported and every
+  happy path passed. The Click is now decided **once**, on whether `typer._click`
+  exists at all, and every symbol imported from that decision, so a future move
+  fails at import — a CLI that refuses to start — instead of silently flattening
+  the exit-code contract. `Abort` is resolved from `typer.Abort`, which is by
+  construction the class `typer.prompt` raises and typer's own `_main` catches on
+  every version in range. Suite verified green against typer 0.25.1, 0.27.0,
+  0.27.1 and 0.27.2 (#771)
+
+### Dependencies
+
+- typer 0.27.1 → 0.27.2, click 8.4.2 → 8.5.0, posthog 7.42.0 → 7.44.2 (#771)
+
 ## 0.0.1b1 — 2026-08-24
 
 ### The package is `fp-cloud-cli`; the command is still `fp`

{fp_cloud_cli-0.0.1b1/fp_cloud_cli.egg-info → fp_cloud_cli-0.0.1b2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fp-cloud-cli
-Version: 0.0.1b1
+Version: 0.0.1b2
 Summary: Command line client for FailproofAI Cloud — sessions, events, evaluations and audits from your terminal
 Author-email: Failproof AI <failproofai@exosphere.host>
 License: MIT License

{fp_cloud_cli-0.0.1b1 → fp_cloud_cli-0.0.1b2}/fp_cli/_click_compat.py

@@ -11,9 +11,10 @@ compiles, and every happy path still passes:
   should print ``✗ …`` and exit 5 exits **1 with an empty stderr**, and the
   ``rich_format_error`` hook in ``app.py`` (reached only *after* that catch) never
   runs. Same for the ``UsageError``/``BadParameter`` we raise by hand.
-* ``Abort`` — ``typer.prompt`` raises its own Click's ``Abort`` on closed stdin, so a
-  pip-Click ``except click.Abort`` stops matching and the clean "no TTY, pass a slug"
-  usage error becomes a bare abort.
+* ``Abort`` — ``typer.prompt`` raises the ``Abort`` **typer** exports on closed stdin
+  (0.27.2 moved that class out of the vendored Click entirely), so a pip-Click
+  ``except click.Abort`` stops matching and the clean "no TTY, pass a slug" usage error
+  becomes a bare abort.
 * Options — Typer 0.26+ has no ``Option`` class in its vendored Click *at all*: every
   option in a Typer-built tree is a ``typer.core.TyperOption``, subclassing
   ``Parameter`` directly. ``isinstance(param, click.Option)`` is then quietly always
@@ -27,14 +28,36 @@ again, and that our errors are still the class Typer catches.
 
 from __future__ import annotations
 
+# `Abort` is resolved from `typer` itself rather than from either Click, because it is
+# the one symbol here that is not stably a Click class: typer 0.27.2 moved it out of the
+# vendored `typer._click.exceptions` into a plain `typer.exceptions.Abort(RuntimeError)`.
+# `typer.Abort` tracks that move — it is `click.Abort` before 0.26, the vendored class
+# through 0.27.1, the RuntimeError from 0.27.2 — and it is by construction the class
+# `typer.prompt` raises and typer's own `_main` catches, which is the only property
+# `select.py`'s `except click.Abort` needs.
+from typer import Abort as Abort
+
+# Pick the Click ONCE, on whether typer vendors one at all, then import every symbol
+# from that choice. Deciding per symbol — a single `try` around the whole vendored
+# import block, falling back to pip `click` on any ImportError — is what shipped
+# through 0.27.1 and it failed exactly as silently as this module exists to prevent:
+# 0.27.2 removing `typer._click.exceptions.Abort` made that one missing name rebind ALL
+# SIX symbols to pip Click, so every typed error escaped Typer's handler as exit 1 with
+# an empty stderr. A name that goes missing inside the chosen Click must raise here, at
+# import, where it is a CLI that refuses to start rather than one that silently stops
+# reporting errors.
 try:
-    # typer >= 0.26. pip `click` may well still be installed — it is simply not the
-    # Click in play, so binding to it here would reintroduce the whole class of bug.
-    from typer._click import ClickException, Command, Parameter
-    from typer._click.exceptions import Abort, BadParameter, UsageError
+    import typer._click as _typer_click  # typer >= 0.26 vendors its own Click
 except ImportError:  # typer < 0.26 drives the pip `click` distribution directly
+    _typer_click = None  # type: ignore[assignment]
+
+if _typer_click is not None:
+    # pip `click` may well still be installed — it is simply not the Click in play, so
+    # binding to it here would reintroduce the whole class of bug.
+    from typer._click import ClickException, Command, Parameter
+    from typer._click.exceptions import BadParameter, UsageError
+else:
     from click import (  # type: ignore[assignment]
-        Abort,
         BadParameter,
         ClickException,
         Command,

fp_cloud_cli-0.0.1b2/fp_cli/_version.py

@@ -0,0 +1 @@
+__version__ = "0.0.1b2"

{fp_cloud_cli-0.0.1b1 → fp_cloud_cli-0.0.1b2}/fp_cli/permissions.py

@@ -26,6 +26,7 @@ ALL_PERMISSIONS: List[str] = [
     "users:delete",
     "evaluations:read",
     "evaluations:trigger",
+    "evaluations:run",
     "dashboards:read",
     "dashboards:write",
     "dashboards:delete",

{fp_cloud_cli-0.0.1b1 → fp_cloud_cli-0.0.1b2/fp_cloud_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fp-cloud-cli
-Version: 0.0.1b1
+Version: 0.0.1b2
 Summary: Command line client for FailproofAI Cloud — sessions, events, evaluations and audits from your terminal
 Author-email: Failproof AI <failproofai@exosphere.host>
 License: MIT License

{fp_cloud_cli-0.0.1b1 → fp_cloud_cli-0.0.1b2}/fp_cloud_cli.egg-info/SOURCES.txt

@@ -79,6 +79,7 @@ tests/test_no_customer_identifiers.py
 tests/test_operator.py
 tests/test_orgs.py
 tests/test_output.py
+tests/test_pagination.py
 tests/test_policy_check.py
 tests/test_readme_matches_reality.py
 tests/test_review_fixes.py
@@ -114,6 +115,7 @@ tests/__pycache__/test_no_customer_identifiers.cpython-312-pytest-9.1.1.pyc
 tests/__pycache__/test_operator.cpython-312-pytest-9.1.1.pyc
 tests/__pycache__/test_orgs.cpython-312-pytest-9.1.1.pyc
 tests/__pycache__/test_output.cpython-312-pytest-9.1.1.pyc
+tests/__pycache__/test_pagination.cpython-312-pytest-9.1.1.pyc
 tests/__pycache__/test_policy_check.cpython-312-pytest-9.1.1.pyc
 tests/__pycache__/test_readme_matches_reality.cpython-312-pytest-9.1.1.pyc
 tests/__pycache__/test_review_fixes.cpython-312-pytest-9.1.1.pyc

{fp_cloud_cli-0.0.1b1 → fp_cloud_cli-0.0.1b2}/pyproject.toml

@@ -31,7 +31,14 @@ dependencies = [
     # through that — which is what makes both sides of the split work. Import Click from
     # there and nowhere else; `tests/test_click_compat.py` enforces it, because every way
     # this breaks is silent (typed errors collapse to exit 1 with an empty stderr, and the
-    # telemetry flag catalog empties). Suite verified against 0.25.1 and 0.27.0.
+    # telemetry flag catalog empties). Suite verified against 0.25.1, 0.27.0, 0.27.1 and
+    # 0.27.2.
+    #
+    # The split keeps moving INSIDE the vendored tree, so the shim resolves each symbol
+    # separately: 0.27.2 moved `Abort` out of `typer._click.exceptions` into
+    # `typer.exceptions`, and the one all-or-nothing `try/except ImportError` that used to
+    # wrap the vendored import sent every OTHER symbol to pip Click over that single
+    # missing name — 105 tests red, every typed error at exit 1.
     #
     # The floor is 0.13, not 0.12, because 0.12 cannot BUILD this app: the global
     # `--insecure/--secure` option in `app.py` is an `Optional[bool]` with a
@@ -39,7 +46,7 @@ dependencies = [
     # rejects with `TypeError: Secondary flag is not valid for non-boolean flag`.
     # That fires while the command tree is constructed, before any parsing, so
     # `fp --version`, `fp --help` and every subcommand die identically — an
-    # installed CLI that cannot run one command. `uv.lock` pins 0.27.1, so
+    # installed CLI that cannot run one command. `uv.lock` pins 0.27.2, so
     # neither CI nor the publish smoke test ever installed the broken part of the
     # range. Measured across 0.12.0/0.12.3/0.12.5 (all fail) and 0.13.0 upward
     # (all pass).

{fp_cloud_cli-0.0.1b1 → fp_cloud_cli-0.0.1b2}/tests/test_click_compat.py

@@ -11,6 +11,7 @@ from __future__ import annotations
 import ast
 import pathlib
 
+import pytest
 import typer
 from typer.testing import CliRunner
 
@@ -95,6 +96,59 @@ def test_error_exit_codes_are_distinct_per_class():
     assert issubclass(KeyModeUnsupportedError, _click_compat.ClickException)
 
 
+def test_every_symbol_comes_from_the_click_typer_runs():
+    """No symbol may quietly come from pip Click while Typer is running its own.
+
+    This is the alarm for a *partial* miss. `_click_compat` used to wrap the whole
+    vendored import in one `try: … except ImportError: from click import …`, so a single
+    name disappearing from `typer._click` rebound **all six** symbols to pip Click — and
+    that is not hypothetical: typer 0.27.2 moved `Abort` out of
+    `typer._click.exceptions`, and the fallback fired, and 105 tests went red at once
+    with typed errors collapsing to exit 1. Assert the provenance of each symbol
+    separately, so the next move is one failure naming one symbol.
+    """
+    typer_click = pytest.importorskip(
+        "typer._click", reason="typer < 0.26 has no vendored Click; pip click IS the right one"
+    )
+    wrong = {
+        name: obj.__module__
+        for name in ("ClickException", "UsageError", "BadParameter", "Command", "Parameter")
+        if not (obj := getattr(_click_compat, name)).__module__.startswith(typer_click.__name__)
+    }
+    assert not wrong, f"these came from pip Click, not the Click Typer runs: {wrong}"
+
+
+def test_abort_is_the_one_typer_raises():
+    """`Abort` is the exception NOT to pin to a Click — pin it to Typer.
+
+    It is `click.Abort` before typer 0.26, the vendored class through 0.27.1, and a
+    plain `typer.exceptions.Abort(RuntimeError)` from 0.27.2 on. `typer.Abort` is the
+    class `typer.prompt` raises and typer's own `_main` catches on every one of those,
+    which is the only thing `select.py`'s `except click.Abort` needs to be true.
+    """
+    assert _click_compat.Abort is typer.Abort
+
+
+def test_hand_raised_usage_errors_reach_typers_handler():
+    """The other half of the contract: `UsageError`/`BadParameter` we raise ourselves.
+
+    `test_typed_errors_reach_typers_handler` covers the `ClickException` subclasses in
+    `errors.py`; these two are raised directly through the shim (`raise
+    click.UsageError(...)`) from a dozen call sites, and bound to the wrong Click they
+    escape uncaught the same way — exit 1, empty stderr, instead of a clean exit 2.
+    """
+    for exc_class in (_click_compat.UsageError, _click_compat.BadParameter):
+        app = typer.Typer()
+
+        @app.command()
+        def boom() -> None:
+            raise exc_class("bad input")
+
+        result = CliRunner().invoke(app, [])
+        assert result.exit_code == 2, (exc_class, result.output)
+        assert "bad input" in result.output
+
+
 def test_is_option_recognises_typer_options():
     """Typer's vendored Click has no `Option` class, so `isinstance` cannot answer this.
 

fp_cloud_cli-0.0.1b2/tests/test_pagination.py

@@ -0,0 +1,204 @@
+"""When `--all` stops early, the response must say so.
+
+The defect these pin was measured against a live instance, on the CLI this one
+was moved from:
+
+    fp --json sessions --since 7d --limit 200        -> 200 rows, next_cursor set
+    fp --json sessions --since 7d --all              ->  50 rows   (25x undercount)
+    fp --json sessions --since 7d --all --limit 5000 -> 1,274 rows
+
+`--all` inherits `--limit`'s default of 50 — which is documented and deliberate
+here — but the envelope then hard-coded `next_cursor: null`, so a 4% sample of a
+customer's fleet came back with exit 0, no warning, and a response that read as
+complete. Nothing in the output could tell you otherwise.
+
+The fix (`Walk`, carried through `client.paginate`) is present in this repo and
+was untested when these were written. That combination is the one worth
+guarding: a silent-completeness bug cannot be caught by reading the code, only
+by asserting on what the envelope claims.
+
+So every test here checks the REPORTED completeness, not just the row count.
+
+The fake feed is a real cursor server — it honours `limit` and `cursor` — not a
+list of canned pages. A fixture that ignored `limit` would pass no matter how
+few rows the CLI asked for, which is to say it could not fail on the bug.
+"""
+
+from __future__ import annotations
+
+import json
+
+import httpx
+import pytest
+import respx
+
+from fp_cli import client
+from fp_cli.app import app
+
+from .conftest import BASE_URL as BASE
+
+
+def _feed(key: str, total: int, row):
+    """respx side_effect: a cursor-paginated feed holding ``total`` rows.
+
+    The cursor is the offset of the next row (opaque to the CLI, which only
+    round-trips it). ``limit`` is honoured exactly, so the CLI's own page sizing
+    decides how much of the feed it can actually reach.
+    """
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        params = request.url.params
+        limit = int(params["limit"])
+        offset = int(params.get("cursor") or 0)
+        rows = [row(i) for i in range(offset, min(offset + limit, total))]
+        nxt = offset + len(rows)
+        return httpx.Response(
+            200, json={key: rows, "next_cursor": str(nxt) if nxt < total else None}
+        )
+
+    return handler
+
+
+def _event_row(i: int) -> dict:
+    return {
+        "id": i, "session_id": "s", "agent_id": "a", "event_type": "tool_use",
+        "ts": "2026-08-24T12:00:00Z", "environment": "prod", "summary": f"row {i}",
+    }
+
+
+def _session_row(i: int) -> dict:
+    return {
+        "session_id": f"sess-{i}", "agent_id": "a", "environment": "prod",
+        "last_event_at": "2026-08-24T12:00:00Z", "latest_evaluation": None,
+    }
+
+
+def _eval_row(i: int) -> dict:
+    return {
+        "id": f"eval-{i}", "session_id": "s", "agent_id": "a", "environment": "prod",
+        "status": "done", "scores": {"helpfulness": 0.9}, "created_at": "2026-08-24T12:00:00Z",
+    }
+
+
+# (command, endpoint, server key, envelope key, row builder). Every command that
+# takes `--all`; the bug was reported on `sessions` but lived in the shared
+# walker, so all four had it. `errors` is the one where the two keys differ: it
+# reads the shared errored-events feed (`{"events": …}`) and re-labels it
+# `errors` on the way out.
+FEEDS = [
+    ("events", "/api/events/summary", "events", "events", _event_row),
+    ("sessions", "/api/sessions", "sessions", "sessions", _session_row),
+    ("evals", "/api/evaluations", "evaluations", "evaluations", _eval_row),
+    ("errors", "/api/events/summary", "events", "errors", _event_row),
+]
+IDS = [f[0] for f in FEEDS]
+
+TOTAL = 274  # > the 50 default, and not a multiple of the 200 page size
+
+
+@pytest.mark.parametrize("command,endpoint,server_key,key,row", FEEDS, ids=IDS)
+@respx.mock
+def test_all_stopped_by_the_default_limit_is_reported_not_silent(
+    logged_in, runner, command, endpoint, server_key, key, row
+):
+    """THE REGRESSION. `--all` stopping at 50 is the documented behaviour; saying
+    the feed was exhausted is the bug."""
+    respx.get(f"{BASE}{endpoint}").mock(side_effect=_feed(server_key, TOTAL, row))
+    res = runner.invoke(app, ["--base-url", BASE, "--json", command, "--all"])
+    assert res.exit_code == 0, res.output
+    out = json.loads(res.stdout)
+    assert len(out[key]) == 50, "the documented default bound still applies"
+    assert out["next_cursor"] is not None, (
+        "a walk that stopped on --limit must hand back a resumable cursor; "
+        "null here is the 4%-sample-reported-as-complete bug"
+    )
+
+
+@pytest.mark.parametrize("command,endpoint,server_key,key,row", FEEDS, ids=IDS)
+@respx.mock
+def test_all_that_exhausts_the_feed_reports_complete(
+    logged_in, runner, command, endpoint, server_key, key, row
+):
+    """The other direction, and the reason `truncated` cannot just be "we hit the
+    limit": a walk that took every row must NOT claim there is more."""
+    respx.get(f"{BASE}{endpoint}").mock(side_effect=_feed(server_key, 30, row))
+    res = runner.invoke(app, ["--base-url", BASE, "--json", command, "--all", "--limit", "500"])
+    assert res.exit_code == 0, res.output
+    out = json.loads(res.stdout)
+    assert len(out[key]) == 30
+    assert out["next_cursor"] is None, "an exhausted feed must not look truncated"
+
+
+@respx.mock
+def test_an_explicit_limit_is_honoured_and_reported(logged_in, runner):
+    """`--all --limit N` is how you actually get more than the default, so the
+    bound has to hold exactly and still report the remainder."""
+    respx.get(f"{BASE}/api/sessions").mock(side_effect=_feed("sessions", TOTAL, _session_row))
+    res = runner.invoke(
+        app, ["--base-url", BASE, "--json", "sessions", "--all", "--limit", "220"]
+    )
+    assert res.exit_code == 0, res.output
+    out = json.loads(res.stdout)
+    assert len(out["sessions"]) == 220
+    assert out["next_cursor"] is not None
+
+
+@respx.mock
+def test_all_pages_in_chunks_rather_than_one_giant_request(logged_in, runner):
+    """The walk must actually WALK. Asking for 220 in a single request would work
+    against this fake and fail against a server that caps a page at 200."""
+    route = respx.get(f"{BASE}/api/sessions").mock(
+        side_effect=_feed("sessions", TOTAL, _session_row)
+    )
+    res = runner.invoke(
+        app, ["--base-url", BASE, "--json", "sessions", "--all", "--limit", "220"]
+    )
+    assert res.exit_code == 0, res.output
+    assert route.call_count > 1, "a 220-row walk must span more than one request"
+    for call in route.calls:
+        assert int(call.request.url.params["limit"]) <= 200
+
+
+# --- the walker itself, below the CLI ---------------------------------------
+
+
+def _pages(total: int, page: int):
+    """A `fetch_page` over ``total`` rows, honouring the limit it is given."""
+
+    def fetch(cursor=None, limit=None):
+        offset = int(cursor or 0)
+        size = min(limit or page, page)
+        items = list(range(offset, min(offset + size, total)))
+        nxt = offset + len(items)
+        return client.Page(items=items, next_cursor=str(nxt) if nxt < total else None)
+
+    return fetch
+
+
+def test_walk_records_the_cursor_it_stopped_on():
+    walk = client.Walk()
+    items = list(client.paginate(_pages(500, 200), limit=250, walk=walk))
+    assert len(items) == 250
+    assert walk.truncated is True
+    assert walk.next_cursor is not None, "a bounded walk must be resumable"
+
+
+def test_walk_that_exhausts_the_feed_is_not_flagged_truncated():
+    walk = client.Walk()
+    items = list(client.paginate(_pages(120, 200), limit=500, walk=walk))
+    assert len(items) == 120
+    assert walk.truncated is False
+    assert walk.next_cursor is None
+
+
+def test_truncated_is_not_derivable_from_the_row_count():
+    """The subtle case, and why `Walk` exists at all: a walk whose limit lands
+    EXACTLY on the last row is complete, and one that lands exactly on a page
+    boundary with more behind it is not. Row count cannot tell those apart."""
+    exact = client.Walk()
+    list(client.paginate(_pages(200, 200), limit=200, walk=exact))
+    assert exact.truncated is False, "taking every row is not a truncation"
+
+    boundary = client.Walk()
+    list(client.paginate(_pages(400, 200), limit=200, walk=boundary))
+    assert boundary.truncated is True, "stopping on a boundary with more behind it is"

fp_cloud_cli-0.0.1b1/fp_cli/_version.py

@@ -1 +0,0 @@
-__version__ = "0.0.1b1"