graphban-cli 0.6.0__tar.gz → 0.7.1__tar.gz

{graphban_cli-0.6.0 → graphban_cli-0.7.1}/.gitignore

@@ -10,6 +10,7 @@ backend/.pytest.db
 # `test_no_tracked_control_bytes` on main and therefore on every PR built against it.
 .pytest.db
 .pytest.db-journal
+*.db-journal
 # The concurrency lock GRPH-554 added sits beside the database it guards, and xdist gives
 # each worker its own — so the pattern has to cover `.pytest_gw3.db.lock` as well as the
 # bare one. Untracked litter in `git status` is how a real change gets missed in the noise.
@@ -31,6 +32,11 @@ web/node_modules/
 web/dist/
 web/.vite/
 web/*.tsbuildinfo
+web/test-results/
+web/playwright-report/
+web/blob-report/
+# Playwright MCP browser session output (console logs, snapshots)
+.playwright-mcp/
 
 # Env
 .env

{graphban_cli-0.6.0 → graphban_cli-0.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: graphban-cli
-Version: 0.6.0
+Version: 0.7.1
 Summary: gban — a Graphban client for the human at a terminal
 Project-URL: Homepage, https://github.com/asc-me/graphban
 Project-URL: Repository, https://github.com/asc-me/graphban
@@ -187,6 +187,32 @@ script into a shell. And it never writes the gate key into an MCP config: `gban
 key must not carry `gate`, or the agent doing the work attests its own completion — which
 fails silently, since a gate that always says yes looks exactly like a gate that held.
 
+## `gban stack map`
+
+```bash
+gban stack map --dry-run
+gban stack map --project <id>
+```
+
+Reads this checkout and posts one app-topology record to `POST /api/platform/stack/app`.
+`--dry-run` prints that record and posts nothing; it needs no server and no key.
+Two runs of the same commit print the same JSON. There is no timestamp in it.
+
+What it reads:
+
+- Compose files (`compose.yml`, `docker-compose.yml`, and the `compose.*` / `docker-compose.*` variants): a service with `build` is a deployable, a service with only `image` is infrastructure, and `depends_on` is an edge. `environment` contributes variable **names** and, when a value is a literal URL, the bare host.
+- Dockerfiles (`Dockerfile`, `Dockerfile.*`, `*.Dockerfile`), for the deployable they sit in and for a `FROM` image the table knows.
+- Dependency manifests (`package.json`, `pyproject.toml`, `requirements*.txt`, `go.mod`, `Cargo.toml`, `Gemfile`), matched against the known-SDK table and attributed to the deployable whose directory contains them.
+- `.env.example` only. A real `.env` is not a template and is not opened. Source files are not scanned.
+
+The known-SDK table ships at `cli/src/gban/data/stack_sdks.toml` and is versioned with `gban`. A checkout may add rows in `.graphban/stack-sdks.toml` (same shape); those rows are consulted first.
+
+Compose is parsed by a subset, not by PyYAML: block mappings and lists, single-line `[...]` / `{...}` flow, and `|` / `>` scalars. Anchors and aliases are not expanded (`*name` stays text). A `<<` merge key is ignored. A file the subset cannot read is skipped with a warning on stderr; the rest of the tree is still mapped.
+
+Env values are never stored and never posted. A host taken from a URL is the bare host (`api.stripe.com`), because the posted shape rejects any string containing `://`. An image the table does not know is infrastructure named after the **compose service**, kind `unclassified image` — the image string is not stored. A `depends_on`, `external: true`, or `extends.file` that names something this file does not define becomes an `unresolved` node. It is not dropped and it is not a failure.
+
+A real post needs a git commit (there is nothing to send for a repo with no HEAD) and a project-write API key: `$GBFLEET_API_KEY`, then `$GRAPHBAN_API_KEY`, then the key `gban setup` stored for this project. The login session is a different credential and is not sent. Pass `--project` (or `$GRAPHBAN_PROJECT`) so the record names the project; without one, `--dry-run` still prints and a post is refused.
+
 ## `gban login` wants a real terminal
 
 It refuses without one, rather than prompting. `getpass` falls back to a plain **echoing**

{graphban_cli-0.6.0 → graphban_cli-0.7.1}/README.md

@@ -172,6 +172,32 @@ script into a shell. And it never writes the gate key into an MCP config: `gban
 key must not carry `gate`, or the agent doing the work attests its own completion — which
 fails silently, since a gate that always says yes looks exactly like a gate that held.
 
+## `gban stack map`
+
+```bash
+gban stack map --dry-run
+gban stack map --project <id>
+```
+
+Reads this checkout and posts one app-topology record to `POST /api/platform/stack/app`.
+`--dry-run` prints that record and posts nothing; it needs no server and no key.
+Two runs of the same commit print the same JSON. There is no timestamp in it.
+
+What it reads:
+
+- Compose files (`compose.yml`, `docker-compose.yml`, and the `compose.*` / `docker-compose.*` variants): a service with `build` is a deployable, a service with only `image` is infrastructure, and `depends_on` is an edge. `environment` contributes variable **names** and, when a value is a literal URL, the bare host.
+- Dockerfiles (`Dockerfile`, `Dockerfile.*`, `*.Dockerfile`), for the deployable they sit in and for a `FROM` image the table knows.
+- Dependency manifests (`package.json`, `pyproject.toml`, `requirements*.txt`, `go.mod`, `Cargo.toml`, `Gemfile`), matched against the known-SDK table and attributed to the deployable whose directory contains them.
+- `.env.example` only. A real `.env` is not a template and is not opened. Source files are not scanned.
+
+The known-SDK table ships at `cli/src/gban/data/stack_sdks.toml` and is versioned with `gban`. A checkout may add rows in `.graphban/stack-sdks.toml` (same shape); those rows are consulted first.
+
+Compose is parsed by a subset, not by PyYAML: block mappings and lists, single-line `[...]` / `{...}` flow, and `|` / `>` scalars. Anchors and aliases are not expanded (`*name` stays text). A `<<` merge key is ignored. A file the subset cannot read is skipped with a warning on stderr; the rest of the tree is still mapped.
+
+Env values are never stored and never posted. A host taken from a URL is the bare host (`api.stripe.com`), because the posted shape rejects any string containing `://`. An image the table does not know is infrastructure named after the **compose service**, kind `unclassified image` — the image string is not stored. A `depends_on`, `external: true`, or `extends.file` that names something this file does not define becomes an `unresolved` node. It is not dropped and it is not a failure.
+
+A real post needs a git commit (there is nothing to send for a repo with no HEAD) and a project-write API key: `$GBFLEET_API_KEY`, then `$GRAPHBAN_API_KEY`, then the key `gban setup` stored for this project. The login session is a different credential and is not sent. Pass `--project` (or `$GRAPHBAN_PROJECT`) so the record names the project; without one, `--dry-run` still prints and a post is refused.
+
 ## `gban login` wants a real terminal
 
 It refuses without one, rather than prompting. `getpass` falls back to a plain **echoing**

{graphban_cli-0.6.0 → graphban_cli-0.7.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "graphban-cli"
-version = "0.6.0"
+version = "0.7.1"
 description = "gban — a Graphban client for the human at a terminal"
 readme = "README.md"
 requires-python = ">=3.12"

{graphban_cli-0.6.0 → graphban_cli-0.7.1}/src/gban/cli.py

@@ -15,7 +15,7 @@ import subprocess
 import sys
 from pathlib import Path
 
-from gban import config, doctor as doctor_mod, setup as setup_mod, swamp as swamp_mod
+from gban import config, doctor as doctor_mod, setup as setup_mod, stackmap, swamp as swamp_mod
 from gban.client import (EXIT_NO_SESSION, EXIT_NO_SUPERVISOR, EXIT_REFUSED, EXIT_UNREACHABLE,
                        Client, NoSession,
                        Refused, Unreachable, authenticated, login)
@@ -91,6 +91,24 @@ def _parser() -> argparse.ArgumentParser:
     swamp_setup.add_argument("--no-init", action="store_true",
                              help="refuse rather than run `swamp repo init` here")
 
+    stack_cmd = sub.add_parser(
+        "stack", help="map this checkout and post the app topology",
+        description=("Reads compose files, Dockerfiles, dependency manifests and "
+                     ".env.example, and posts one app-topology record. Env values "
+                     "are not stored. --dry-run prints the record and posts nothing."))
+    stack_do = stack_cmd.add_subparsers(dest="act")
+    stack_map = stack_do.add_parser(
+        "map", help="build the record from this repo",
+        description=("Deterministic. Two runs on the same commit print the same "
+                     "JSON. A real post uses a project-write API key "
+                     f"(${doctor_mod.SUPERVISOR_KEY_ENV} or ${config.API_KEY_ENV}), "
+                     "never the login session, and goes to "
+                     f"POST {stackmap._POST_PATH}."))
+    stack_map.add_argument("--dry-run", action="store_true",
+                           help="print the record and do not post it")
+    stack_map.add_argument("--repo", default=None,
+                           help="repository to map (default: the git checkout of the current directory)")
+
     fleet = sub.add_parser(
         "fleet", help="hand off to gbfleet (the supervisor)",
         description=("Passes everything through to `gbfleet` and returns its exit code "
@@ -407,6 +425,73 @@ def cmd_swamp(args) -> int:
     return code
 
 
+def cmd_stack(args) -> int:
+    """Build the app-topology record and, unless --dry-run, post it (GRPH-P55 §3)."""
+    if args.act != "map":
+        print(f"{PROG}: usage: {PROG} stack map [--dry-run] [--repo DIR]", file=sys.stderr)
+        return EXIT_REFUSED
+    start = Path(args.repo).expanduser() if args.repo else Path.cwd()
+    project = (config.resolve(args.project, config.PROJECT_ENV, "project") or "").strip()
+    try:
+        record, warnings = stackmap.build_record(start, project_id=project)
+    except stackmap.MapError as exc:
+        print(f"{PROG}: {exc}", file=sys.stderr)
+        return EXIT_REFUSED
+    for warning in warnings:
+        print(f"{PROG}: {warning}", file=sys.stderr)
+    text = stackmap.canonical(record)
+    if args.dry_run:
+        sys.stdout.write(text)
+        print(f"{PROG}: dry run, nothing posted", file=sys.stderr)
+        return 0
+    if not project:
+        print(f"{PROG}: `{PROG} stack map` needs a project to post. Pass --project, set "
+              f"${config.PROJECT_ENV}, or add --dry-run to print the record only.",
+              file=sys.stderr)
+        return EXIT_REFUSED
+    url = config.resolve(args.server, config.URL_ENV, "url")
+    if not url:
+        print(f"{PROG}: no server. Pass --server, set ${config.URL_ENV}, or run `gban login "
+              f"--server …` once.", file=sys.stderr)
+        return EXIT_REFUSED
+    # The supervisor injects GBFLEET_API_KEY. resolve_supervisor_key does not read
+    # it, so a seat that only has that variable would post with nothing.
+    key = (os.environ.get(doctor_mod.SUPERVISOR_KEY_ENV) or "").strip()
+    if not key:
+        key = doctor_mod.resolve_supervisor_key(project, start)
+    if not key:
+        print(f"{PROG}: no project-write API key. Set ${doctor_mod.SUPERVISOR_KEY_ENV} or "
+              f"${config.API_KEY_ENV}, or run `{PROG} setup`. The login session is not a "
+              f"key and is not sent.", file=sys.stderr)
+        return EXIT_REFUSED
+    # The record goes to stdout only after the server took it: a refused post must not
+    # leave behind something that reads like a record that was sent (GRPH-1103).
+    try:
+        receipt = stackmap.post_record(url, key, record)
+    except Refused as exc:
+        try:
+            reasons = json.loads(exc.detail)
+        except ValueError:
+            reasons = None
+        if not isinstance(reasons, list):
+            raise
+        print(f"{PROG}: the server refused the app map (HTTP {exc.status}):", file=sys.stderr)
+        for reason in reasons:
+            if isinstance(reason, dict):
+                print(f"     {reason.get('path', '?')}: {reason.get('reason', '')}",
+                      file=sys.stderr)
+            else:
+                print(f"     {reason}", file=sys.stderr)
+        return EXIT_REFUSED
+    sys.stdout.write(text)
+    receipt = receipt if isinstance(receipt, dict) else {}
+    sha = str(receipt.get("mapped_sha") or record.get("mapped_sha") or "")[:7]
+    said = [f"{k} {receipt[k]}" for k in ("mapped_at", "posted_by") if receipt.get(k)]
+    print(f"{PROG}: posted {receipt.get('project_id') or project} app map at {sha} to {url}"
+          + (f" ({', '.join(said)})" if said else ""), file=sys.stderr)
+    return 0
+
+
 def cmd_fleet(args) -> int:
     """A subprocess, never an import (D5).
 
@@ -560,7 +645,7 @@ def cmd_keys(args) -> int:
 
 COMMANDS = {"login": cmd_login, "logout": cmd_logout, "whoami": cmd_whoami,
             "doctor": cmd_doctor, "setup": cmd_setup, "fleet": cmd_fleet, "seats": cmd_seats,
-            "agents": cmd_agents, "keys": cmd_keys, "swamp": cmd_swamp}
+            "agents": cmd_agents, "keys": cmd_keys, "swamp": cmd_swamp, "stack": cmd_stack}
 
 
 def main(argv: list[str] | None = None) -> int:

{graphban_cli-0.6.0 → graphban_cli-0.7.1}/src/gban/client.py

@@ -115,6 +115,10 @@ class Client:
             detail = payload.get("detail") or payload.get("message") or f"HTTP {status}"
             if isinstance(detail, dict):
                 detail, hint = (detail.get("message") or str(detail)), detail.get("hint", "")
+            elif isinstance(detail, list):
+                # A list of reasons (e.g. `{path, reason}` from a refused app map) stays JSON,
+                # so a caller can read it back rather than parse a Python repr.
+                detail, hint = json.dumps(detail), payload.get("hint", "")
             else:
                 hint = payload.get("hint", "")
             raise Refused(status, str(detail), str(hint))

graphban_cli-0.7.1/src/gban/data/stack_sdks.toml

@@ -0,0 +1,177 @@
+# Known-SDK table shipped with gban (GRPH-P55 §3). Versioned with the package.
+# A project adds rows in `.graphban/stack-sdks.toml` using the same shape.
+# New shipped rows arrive by PR. cli/tests/test_stackmap.py exercises every row.
+# `domains` on an external row: a URL host equal to or under one of them is that
+# service, so `api.stripe.com` and the `stripe` package draw one node, not two.
+
+[[image]]
+id = "postgres"
+names = ["postgres", "pgvector/pgvector"]
+kind = "postgres"
+label = "Postgres"
+protocol = "postgres"
+
+[[image]]
+id = "redis"
+names = ["redis", "bitnami/redis"]
+kind = "redis"
+label = "Redis"
+protocol = "redis"
+
+[[image]]
+id = "rabbitmq"
+names = ["rabbitmq", "bitnami/rabbitmq"]
+kind = "rabbitmq"
+label = "RabbitMQ"
+protocol = "amqp"
+
+[[image]]
+id = "mysql"
+names = ["mysql", "mariadb"]
+kind = "mysql"
+label = "MySQL"
+protocol = "mysql"
+
+[[image]]
+id = "mongo"
+names = ["mongo", "mongodb"]
+kind = "mongodb"
+label = "MongoDB"
+protocol = "mongodb"
+
+[[sdk]]
+id = "psycopg"
+packages = ["psycopg", "psycopg2", "psycopg2-binary", "psycopg-binary"]
+node = "postgres"
+group = "infrastructure"
+kind = "postgres"
+label = "Postgres"
+protocol = "postgres"
+
+[[sdk]]
+id = "pg"
+packages = ["pg", "postgres"]
+node = "postgres"
+group = "infrastructure"
+kind = "postgres"
+label = "Postgres"
+protocol = "postgres"
+
+[[sdk]]
+id = "redis"
+packages = ["redis", "ioredis"]
+node = "redis"
+group = "infrastructure"
+kind = "redis"
+label = "Redis"
+protocol = "redis"
+
+[[sdk]]
+id = "stripe"
+packages = ["stripe"]
+node = "stripe"
+group = "external"
+kind = ""
+label = "Stripe"
+protocol = "https"
+domains = ["stripe.com"]
+
+[[sdk]]
+id = "boto3"
+packages = ["boto3", "botocore"]
+node = "aws"
+group = "external"
+kind = ""
+label = "AWS"
+protocol = "https"
+domains = ["amazonaws.com"]
+
+[[sdk]]
+id = "aws-sdk"
+packages = ["aws-sdk"]
+prefix = "@aws-sdk/"
+node = "aws"
+group = "external"
+kind = ""
+label = "AWS"
+protocol = "https"
+domains = ["amazonaws.com"]
+
+[[sdk]]
+id = "openai"
+packages = ["openai"]
+node = "openai"
+group = "external"
+kind = ""
+label = "OpenAI"
+protocol = "https"
+domains = ["openai.com"]
+
+[[sdk]]
+id = "anthropic"
+packages = ["anthropic", "@anthropic-ai/sdk"]
+node = "anthropic"
+group = "external"
+kind = ""
+label = "Anthropic"
+protocol = "https"
+domains = ["anthropic.com"]
+
+[[sdk]]
+id = "sentry"
+packages = ["sentry-sdk", "@sentry/node", "@sentry/browser", "@sentry/react"]
+prefix = "@sentry/"
+node = "sentry"
+group = "external"
+kind = ""
+label = "Sentry"
+protocol = "https"
+domains = ["sentry.io"]
+
+[[sdk]]
+id = "twilio"
+packages = ["twilio"]
+node = "twilio"
+group = "external"
+kind = ""
+label = "Twilio"
+protocol = "https"
+domains = ["twilio.com"]
+
+[[sdk]]
+id = "sendgrid"
+packages = ["sendgrid", "@sendgrid/mail"]
+node = "sendgrid"
+group = "external"
+kind = ""
+label = "SendGrid"
+protocol = "https"
+domains = ["sendgrid.com", "sendgrid.net"]
+
+[[sdk]]
+id = "supabase"
+packages = ["supabase", "@supabase/supabase-js"]
+node = "supabase"
+group = "external"
+kind = ""
+label = "Supabase"
+protocol = "https"
+domains = ["supabase.co", "supabase.com"]
+
+[[env]]
+id = "database-url"
+names = ["DATABASE_URL"]
+node = "postgres"
+group = "infrastructure"
+kind = "postgres"
+label = "Postgres"
+protocol = "postgres"
+
+[[env]]
+id = "redis-url"
+names = ["REDIS_URL"]
+node = "redis"
+group = "infrastructure"
+kind = "redis"
+label = "Redis"
+protocol = "redis"

{graphban_cli-0.6.0 → graphban_cli-0.7.1}/src/gban/skills/graphban-delegation/SKILL.md

@@ -107,6 +107,13 @@ willing to pay for.
 `seat=true` mints a worker seat **bound to the item**, which is what makes the child claim it
 at registration rather than racing for it.
 
+`bound_only=true` (with `seat=true`) is the opt-in that stops the child taking anything else.
+Once its bound item leaves `in_progress`, `claim_review`, `claim_next`, `claim_item`,
+`claim_cluster` and `next_cluster` refuse and name the binding, and the child is told to
+exit. Omit the flag and the child may review other items after it finishes — that is today's
+behaviour, and `gbfleet until` does not set the flag, because a wave relies on finished bound
+workers reviewing each other.
+
 Delegate whole items, never fragments. If it has no title, touchpoints and acceptance, it is
 not ready to hand over — the touchpoints become the area reservations that stop the child
 colliding with other work. File it properly or do it inline.