graphban-cli 0.7.0__tar.gz → 0.7.1__tar.gz

{graphban_cli-0.7.0 → graphban_cli-0.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: graphban-cli
-Version: 0.7.0
+Version: 0.7.1
 Summary: gban — a Graphban client for the human at a terminal
 Project-URL: Homepage, https://github.com/asc-me/graphban
 Project-URL: Repository, https://github.com/asc-me/graphban

{graphban_cli-0.7.0 → graphban_cli-0.7.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "graphban-cli"
-version = "0.7.0"
+version = "0.7.1"
 description = "gban — a Graphban client for the human at a terminal"
 readme = "README.md"
 requires-python = ">=3.12"

{graphban_cli-0.7.0 → graphban_cli-0.7.1}/src/gban/cli.py

@@ -442,6 +442,7 @@ def cmd_stack(args) -> int:
     text = stackmap.canonical(record)
     if args.dry_run:
         sys.stdout.write(text)
+        print(f"{PROG}: dry run, nothing posted", file=sys.stderr)
         return 0
     if not project:
         print(f"{PROG}: `{PROG} stack map` needs a project to post. Pass --project, set "
@@ -463,8 +464,31 @@ def cmd_stack(args) -> int:
               f"${config.API_KEY_ENV}, or run `{PROG} setup`. The login session is not a "
               f"key and is not sent.", file=sys.stderr)
         return EXIT_REFUSED
-    stackmap.post_record(url, key, record)
+    # The record goes to stdout only after the server took it: a refused post must not
+    # leave behind something that reads like a record that was sent (GRPH-1103).
+    try:
+        receipt = stackmap.post_record(url, key, record)
+    except Refused as exc:
+        try:
+            reasons = json.loads(exc.detail)
+        except ValueError:
+            reasons = None
+        if not isinstance(reasons, list):
+            raise
+        print(f"{PROG}: the server refused the app map (HTTP {exc.status}):", file=sys.stderr)
+        for reason in reasons:
+            if isinstance(reason, dict):
+                print(f"     {reason.get('path', '?')}: {reason.get('reason', '')}",
+                      file=sys.stderr)
+            else:
+                print(f"     {reason}", file=sys.stderr)
+        return EXIT_REFUSED
     sys.stdout.write(text)
+    receipt = receipt if isinstance(receipt, dict) else {}
+    sha = str(receipt.get("mapped_sha") or record.get("mapped_sha") or "")[:7]
+    said = [f"{k} {receipt[k]}" for k in ("mapped_at", "posted_by") if receipt.get(k)]
+    print(f"{PROG}: posted {receipt.get('project_id') or project} app map at {sha} to {url}"
+          + (f" ({', '.join(said)})" if said else ""), file=sys.stderr)
     return 0
 
 

{graphban_cli-0.7.0 → graphban_cli-0.7.1}/src/gban/client.py

@@ -115,6 +115,10 @@ class Client:
             detail = payload.get("detail") or payload.get("message") or f"HTTP {status}"
             if isinstance(detail, dict):
                 detail, hint = (detail.get("message") or str(detail)), detail.get("hint", "")
+            elif isinstance(detail, list):
+                # A list of reasons (e.g. `{path, reason}` from a refused app map) stays JSON,
+                # so a caller can read it back rather than parse a Python repr.
+                detail, hint = json.dumps(detail), payload.get("hint", "")
             else:
                 hint = payload.get("hint", "")
             raise Refused(status, str(detail), str(hint))

{graphban_cli-0.7.0 → graphban_cli-0.7.1}/src/gban/stackmap.py

@@ -853,6 +853,13 @@ class _Builder:
         self.by_dir: dict[str, str] = {}
         self.kind_of: dict[str, str] = {}
         self.warnings: list[str] = []
+        # Which compose services name an env variable, and which read a template
+        # through `env_file:`. Every service counts, not only the ones that build a
+        # component: a repo-root template is attributed from these.
+        self.env_users: dict[str, set[str]] = {}
+        self.env_file_users: dict[str, set[str]] = {}
+        # Names each `.env.example` declares, keyed by its directory.
+        self.template_names: dict[str, set[str]] = {}
 
     def _ids(self) -> set[str]:
         return set(self.components) | set(self.infra) | set(self.external) | set(self.unresolved)
@@ -1109,6 +1116,32 @@ def _extends(service: Marked) -> tuple[str, str, int] | None:
     return None
 
 
+def _env_files(service: Marked, compose: Path, repo: Path) -> list[str]:
+    """Repo-relative paths a service's `env_file:` names."""
+    if not isinstance(service.value, dict):
+        return []
+    node = service.value.get("env_file")
+    if not isinstance(node, Marked):
+        return []
+    items = node.value if isinstance(node.value, list) else [node]
+    out: list[str] = []
+    for item in items:
+        if not isinstance(item, Marked):
+            continue
+        raw = item.value
+        if isinstance(raw, dict):
+            # The long form: `- path: ./x.env`.
+            raw = raw.get("path").value if isinstance(raw.get("path"), Marked) else None
+        if not isinstance(raw, str) or not raw.strip():
+            continue
+        try:
+            target = (compose.parent / raw.strip().strip("'\"")).resolve()
+            out.append(target.relative_to(repo.resolve()).as_posix())
+        except ValueError:
+            continue
+    return out
+
+
 def _walk_compose(builder: _Builder, path: Path) -> None:
     text = _read_text(path)
     if text is None:
@@ -1185,7 +1218,13 @@ def _walk_compose(builder: _Builder, path: Path) -> None:
             builder.add_edge(src, target, protocol, "depends_on", prov)
         env_node = service.value.get("environment")
         for ename, raw, line in _as_env(env_node if isinstance(env_node, Marked) else None):
+            for mentioned in [ename] + _INTERP.findall(raw):
+                mentioned = re.split(r"[:?+-]", mentioned, maxsplit=1)[0].strip()
+                if mentioned:
+                    builder.env_users.setdefault(mentioned, set()).add(src)
             builder.apply_env_name(ename, raw, line, file, [src], "compose.env")
+        for template in _env_files(service, path, builder.repo):
+            builder.env_file_users.setdefault(template, set()).add(src)
 
 
 def _walk_dockerfile(builder: _Builder, path: Path) -> None:
@@ -1247,6 +1286,61 @@ def _walk_manifest(builder: _Builder, path: Path) -> None:
                          str(row.get("label") or ""), prov)
 
 
+def _template_entries(text: str) -> list[tuple[str, str, int]]:
+    """`(name, raw_value, line)` for each assignment in an env template."""
+    entries: list[tuple[str, str, int]] = []
+    for lineno, raw in enumerate(text.splitlines(), 1):
+        line = raw.strip()
+        if not line or line.startswith("#"):
+            continue
+        if line.startswith("export "):
+            line = line[len("export "):].strip()
+        if "=" not in line:
+            continue
+        name, _, raw_value = line.partition("=")
+        name = name.strip()
+        if len(raw_value) >= 2 and raw_value[0] == raw_value[-1] and raw_value[0] in ("'", '"'):
+            raw_value = raw_value[1:-1]
+        entries.append((name, raw_value, lineno))
+    return entries
+
+
+def _note_template(builder: _Builder, path: Path) -> None:
+    text = _read_text(path)
+    if text is None:
+        return
+    names = {name for name, _raw, _line in _template_entries(text)}
+    builder.template_names.setdefault(_rel(path.parent, builder.repo), set()).update(names)
+
+
+def _root_consumers(builder: _Builder, file: str,
+                    entries: list[tuple[str, str, int]]) -> dict[str, list[str]] | None:
+    """Per name, the compose services a repo-root template's variable belongs to.
+
+    Any compose service counts, a plain `image:` one too. None only when no
+    service names any of the template's variables or reads it: the caller then
+    falls back to every component and says so. A name compose does not mention goes to
+    the components whose own directory template declares it, else to the
+    component at the repo root, else to nobody. The node is still drawn.
+    """
+    readers = builder.env_file_users.get(file, set())
+    names = [name for name, _raw, _line in entries if _interesting_env(name)]
+    if not readers and not any(name in builder.env_users for name in names):
+        return None
+    root = builder.by_dir.get("")
+    out: dict[str, list[str]] = {}
+    for name in names:
+        users = readers | builder.env_users.get(name, set())
+        if not users:
+            users = {builder.by_dir[folder]
+                     for folder, declared in builder.template_names.items()
+                     if folder and name in declared and folder in builder.by_dir}
+        if not users and root:
+            users = {root}
+        out[name] = sorted(users)
+    return out
+
+
 def _walk_env_template(builder: _Builder, path: Path) -> None:
     text = _read_text(path)
     if text is None:
@@ -1254,8 +1348,15 @@ def _walk_env_template(builder: _Builder, path: Path) -> None:
         return
     file = _rel(path, builder.repo)
     directory = _rel(path.parent, builder.repo)
+    entries = _template_entries(text)
+    consumers: dict[str, list[str]] | None = None
     if directory == "":
+        consumers = _root_consumers(builder, file, entries)
         sources = sorted(builder.components)
+        if consumers is None and len(sources) > 1:
+            builder.warnings.append(
+                f"{file}: no compose service names its variables or reads it; "
+                f"its names are attributed to every component")
     else:
         owner = builder.owner(directory)
         sources = [owner] if owner else []
@@ -1266,19 +1367,9 @@ def _walk_env_template(builder: _Builder, path: Path) -> None:
         # the names belong to, so the edges have somewhere to start.
         sources = [builder.add_component(
             ".", "", ".", _provenance(file, "env.template", 1))]
-    for lineno, raw in enumerate(text.splitlines(), 1):
-        line = raw.strip()
-        if not line or line.startswith("#"):
-            continue
-        if line.startswith("export "):
-            line = line[len("export "):].strip()
-        if "=" not in line:
-            continue
-        name, _, raw_value = line.partition("=")
-        name = name.strip()
-        if len(raw_value) >= 2 and raw_value[0] == raw_value[-1] and raw_value[0] in ("'", '"'):
-            raw_value = raw_value[1:-1]
-        builder.apply_env_name(name, raw_value, lineno, file, sources, "env.template")
+    for name, raw_value, lineno in entries:
+        named = consumers.get(name, sources) if consumers is not None else sources
+        builder.apply_env_name(name, raw_value, lineno, file, named, "env.template")
 
 
 def _sha(repo: Path) -> str:
@@ -1333,9 +1424,11 @@ def build_record(start: Path, *, project_id: str = "") -> tuple[dict, list[str]]
     for path in files:
         if _is_manifest(path):
             _walk_manifest(builder, path)
-    for path in files:
-        if path.name == ".env.example":
-            _walk_env_template(builder, path)
+    templates = [path for path in files if path.name == ".env.example"]
+    for path in templates:
+        _note_template(builder, path)
+    for path in templates:
+        _walk_env_template(builder, path)
     if not (builder.components or builder.infra or builder.external or builder.unresolved):
         raise MapError("nothing to map: no compose service, Dockerfile or known dependency")
     return builder.finish(sha), builder.warnings

{graphban_cli-0.7.0 → graphban_cli-0.7.1}/tests/test_stackmap.py

@@ -537,3 +537,184 @@ def test_ignored_and_untracked_files_are_not_mapped(tmp_path):
         (repo / stray / "Dockerfile").write_text("FROM python:3.12\n", encoding="utf-8")
     record, _ = stackmap.build_record(repo)
     assert [n["dir"] for n in record["components"]] == ["app"]
+
+
+def _root_template_repo(tmp_path, compose: str | None) -> Path:
+    repo = tmp_path / "rooted"
+    repo.mkdir()
+    for name in ("api", "web"):
+        (repo / name).mkdir()
+        (repo / name / "requirements.txt").write_text("stripe==8.0\n", encoding="utf-8")
+    if compose is not None:
+        (repo / "compose.yml").write_text(compose, encoding="utf-8")
+    (repo / ".env.example").write_text("OPENAI_API_KEY=\n", encoding="utf-8")
+    _commit(repo)
+    return repo
+
+
+def test_a_root_template_name_goes_to_the_service_that_declares_it(tmp_path):
+    """GRPH-1104: a root .env.example drew web -> openai when only api reads it."""
+    repo = _root_template_repo(tmp_path,
+        "services:\n"
+        "  api:\n"
+        "    build: ./api\n"
+        "    environment:\n"
+        "      - OPENAI_API_KEY\n"
+        "  web:\n"
+        "    build: ./web\n")
+    record, warnings = stackmap.build_record(repo)
+    to_openai = [(e["from"], e["to"]) for e in record["edges"] if e["to"] == "openai"]
+    assert to_openai == [("api", "openai")]
+    assert not [e for e in record["edges"] if e["from"] == "web" and e["to"] != "stripe"]
+    assert warnings == []
+    assert canonical(record) == canonical(stackmap.build_record(repo)[0])
+
+
+def test_a_root_template_with_no_compose_goes_to_every_component_and_says_so(tmp_path):
+    repo = _root_template_repo(tmp_path, None)
+    record, warnings = stackmap.build_record(repo)
+    assert sorted(n["id"] for n in record["components"]) == ["api", "web"]
+    assert sorted(e["from"] for e in record["edges"] if e["to"] == "openai") == ["api", "web"]
+    assert [w for w in warnings if ".env.example" in w]
+
+
+def test_a_root_template_read_through_env_file_goes_to_its_reader(tmp_path):
+    repo = _root_template_repo(tmp_path,
+        "services:\n"
+        "  api:\n"
+        "    build: ./api\n"
+        "  web:\n"
+        "    build: ./web\n"
+        "    env_file: .env.example\n")
+    record, warnings = stackmap.build_record(repo)
+    assert [e["from"] for e in record["edges"] if e["to"] == "openai"] == ["web"]
+    assert warnings == []
+
+
+@pytest.mark.parametrize("worker_env", [
+    "    environment:\n      - OPENAI_API_KEY\n",
+    "    env_file: .env.example\n",
+])
+def test_a_root_template_named_only_by_an_image_service_is_not_every_component(
+        tmp_path, worker_env):
+    """GRPH-1104 bounce: a service that builds nothing still counts as compose naming it."""
+    repo = tmp_path / "imaged"
+    repo.mkdir()
+    for name in ("api", "web"):
+        (repo / name).mkdir()
+        (repo / name / "requirements.txt").write_text("stripe==8.0\n", encoding="utf-8")
+    (repo / "compose.yml").write_text(
+        "services:\n"
+        "  api:\n"
+        "    build: ./api\n"
+        "  web:\n"
+        "    build: ./web\n"
+        "  worker:\n"
+        "    image: alpine\n" + worker_env, encoding="utf-8")
+    (repo / ".env.example").write_text("OPENAI_API_KEY=\nANTHROPIC_API_KEY=\n",
+                                       encoding="utf-8")
+    _commit(repo)
+    record, warnings = stackmap.build_record(repo)
+    assert not [e for e in record["edges"]
+                if e["from"] in ("api", "web") and e["to"] in ("openai", "anthropic")]
+    assert [e["from"] for e in record["edges"] if e["to"] == "openai"] == ["worker"]
+    assert not [w for w in warnings if ".env.example" in w]
+    assert {"openai", "anthropic"} <= {n["id"] for n in record["external"]}
+
+
+def test_this_repo_root_template_draws_no_web_edge_to_a_model_provider():
+    record, _ = stackmap.build_record(ROOT)
+    providers = {"anthropic", "openai", stackmap.LOCAL_NODE}
+    assert not [e for e in record["edges"] if e["from"] == "web" and e["to"] in providers]
+    assert _edge(record, "web", "api", "depends_on")
+    ids = {n["id"] for n in record["external"] + record["infrastructure"]}
+    assert providers <= ids
+
+
+# ---- what a post says it did (GRPH-1103) ----------------------------------------------------
+# A real HTTP server on loopback, so the confirmation and the refusal go through the same
+# transport and error parsing a person's post does.
+
+
+@pytest.fixture()
+def fake_server():
+    import threading
+    from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+    state = {"requests": [], "status": 200, "reply": {}}
+
+    class Handler(BaseHTTPRequestHandler):
+        def do_POST(self):  # noqa: N802
+            raw = self.rfile.read(int(self.headers.get("Content-Length") or 0))
+            state["requests"].append((self.path, self.headers.get("X-API-Key"), json.loads(raw)))
+            reply = state["reply"](json.loads(raw)) if callable(state["reply"]) else state["reply"]
+            data = json.dumps(reply).encode()
+            self.send_response(state["status"])
+            self.send_header("Content-Type", "application/json")
+            self.send_header("Content-Length", str(len(data)))
+            self.end_headers()
+            self.wfile.write(data)
+
+        def log_message(self, *_args):
+            pass
+
+    server = ThreadingHTTPServer(("127.0.0.1", 0), Handler)
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    state["url"] = f"http://127.0.0.1:{server.server_address[1]}"
+    try:
+        yield state
+    finally:
+        server.shutdown()
+        server.server_close()
+
+
+def _mapped_app(isolated, monkeypatch) -> tuple[Path, str]:
+    repo = isolated / "app"
+    repo.mkdir()
+    _write_app(repo)
+    sha = _commit(repo)
+    monkeypatch.setenv("GBFLEET_API_KEY", "gb_sk_seat")
+    return repo, sha
+
+
+def test_a_real_post_says_it_posted_and_where(isolated, monkeypatch, capsys, fake_server):
+    repo, sha = _mapped_app(isolated, monkeypatch)
+    fake_server["reply"] = lambda body: {**body, "mapped_at": "2026-10-23T10:00:00Z",
+                                         "posted_by": "seat-1"}
+    assert main(["--server", fake_server["url"], "--project", "demo",
+                 "stack", "map", "--repo", str(repo)]) == 0
+    assert len(fake_server["requests"]) == 1
+    captured = capsys.readouterr()
+    assert captured.out == canonical(fake_server["requests"][0][2])
+    assert (f"gban: posted demo app map at {sha[:7]} to {fake_server['url']}"
+            in captured.err)
+    assert "posted_by seat-1" in captured.err
+    assert "dry run" not in captured.err
+
+
+def test_dry_run_says_nothing_was_posted(isolated, monkeypatch, capsys, fake_server):
+    repo, _ = _mapped_app(isolated, monkeypatch)
+    assert main(["--server", fake_server["url"], "--project", "demo",
+                 "stack", "map", "--dry-run", "--repo", str(repo)]) == 0
+    captured = capsys.readouterr()
+    assert fake_server["requests"] == []
+    assert "gban: dry run, nothing posted" in captured.err
+    assert "posted demo" not in captured.err
+    assert json.loads(captured.out)["project_id"] == "demo"
+
+
+def test_a_refused_post_prints_the_reasons_and_not_the_record(isolated, monkeypatch, capsys,
+                                                              fake_server):
+    repo, _ = _mapped_app(isolated, monkeypatch)
+    fake_server["status"] = 422
+    fake_server["reply"] = {"detail": [{"path": "edges[2].to", "reason": "unresolved node"},
+                                       {"path": "mapped_sha", "reason": "unknown is not a commit"}]}
+    assert main(["--server", fake_server["url"], "--project", "demo",
+                 "stack", "map", "--repo", str(repo)]) == EXIT_REFUSED
+    assert len(fake_server["requests"]) == 1
+    captured = capsys.readouterr()
+    assert captured.out == ""
+    assert "edges[2].to: unresolved node" in captured.err
+    assert "mapped_sha: unknown is not a commit" in captured.err
+    assert "posted demo" not in captured.err