healthcloud-cli 3.2.2__tar.gz → 3.2.4__tar.gz

{healthcloud_cli-3.2.2 → healthcloud_cli-3.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: healthcloud-cli
-Version: 3.2.2
+Version: 3.2.4
 Summary: Command-line interface for the HealthCloud MCP gateway, generated from the shared MCP tool manifest.
 Project-URL: Issues, https://github.com/healthcloudservices/healthcloud-services/issues
 Project-URL: Repository, https://github.com/healthcloudservices/healthcloud-services
@@ -358,7 +358,8 @@ uv run --frozen hc ams --target-file TARGET.json ui --repo EXISTING_AMS_WORKTREE
 Changes JSON accepts only nonempty subsets of `instructions` (string) and
 `greetings` (language-key to string map). Input changes/receipts must be regular,
 owner-only files (for example create under `umask 077`). Outputs use exclusive
-0600 creation and refuse overwrite/symlinks; failed operations remove unfinished
+0600 creation on POSIX and an owner-only protected DACL on Windows, and refuse
+overwrite/symlinks; failed operations remove unfinished
 outputs. No whole-agent snapshot is saved. Free text appears only in explicitly
 requested private files for human review before any AI use. Default output in
 pretty/json/verbose modes contains bounded metadata and hashes; AMS refuses raw.
@@ -375,7 +376,7 @@ full-input qualification above. Apply requires the displayed hash, matching
 version and selected before-values, and sends `confirm=True` once. HTTP 401/403
 and 409 never trigger identity fallback or mutation replay.
 
-On transport failure, apply records an unknown outcome and reconciles through GET
+On transport failure or HTTP 5xx, apply records an unknown outcome and reconciles through GET
 plan/agent without retrying the mutation. Confirmed saves require applied status,
 selected-field readback and exactly the next config version. The current public
 response omits publication_status: **saved/readback confirmed is reported separately
@@ -403,3 +404,40 @@ operator-controlled.
 AMS failures exit nonzero with safe categories, never backend exception bodies.
 In particular, apply may exit nonzero after a confirmed save because publication
 is unknown: inspect the emitted outcome before any next action.
+
+On Windows, `chmod` does not establish file privacy. Create the private-input
+directory with an owner-only ACL before saving change JSON or receipts there:
+
+```powershell
+New-Item -ItemType Directory -Path .\ams-private
+$amsUser = whoami
+icacls .\ams-private /inheritance:r /grant:r "${amsUser}:(OI)(CI)F"
+```
+
+Native file handling checks the opened handle's owner and DACL, rejects grants to
+other principals and reparse points, and creates outputs with their restricted
+DACL already in place. Filesystems without usable ACLs fail closed.
+
+The `Python CLI` and `Python CLI (Windows)` CI jobs run the non-live suite on
+Linux and Windows, including native file permissions and apply reconciliation.
+Both feed `SDK package checks`; a job failure or unexpected job skip blocks that aggregate.
+Run locally, sequentially, from `packages/cli/pip` with
+`uv run --frozen --extra dev python -m pytest -q -m 'not live'`.
+These synthetic checks do not establish live CareCo acceptance. That still needs
+an explicitly selected and qualified DEV agent, scoped credentials, and the
+attended before/after/restore procedure above.
+
+For an optional real-HTTP reproduction with Postman CLI 1.75.0, start
+`postman simulation run postman/simulations/ams-tuning-failure.sim.yaml --port 4900 --no-history --output ndjson`
+from the repository root. In another terminal, run the same SDK verification
+helper used by the required loopback HTTP tests:
+
+```bash
+uv run --project packages/cli/pip --frozen --extra dev python -c "import sys; sys.path.insert(0, 'packages/cli/pip/tests'); from test_ams_http import verify_uncertain_apply; print(verify_uncertain_apply('http://127.0.0.1:4900/ams/api/ams'))"
+```
+
+The simulation log must show GET plan, GET agent, one POST apply returning 503,
+then GET plan and GET agent. Restart the stateful simulation before repeating;
+stop it with Ctrl+C afterward. This is a source-backed synthetic failure fixture,
+not the deployed service. The required CI tests exercise both pre-commit and
+post-commit 503 over loopback HTTP without requiring a Postman login or installation.

{healthcloud_cli-3.2.2 → healthcloud_cli-3.2.4}/README.md

@@ -340,7 +340,8 @@ uv run --frozen hc ams --target-file TARGET.json ui --repo EXISTING_AMS_WORKTREE
 Changes JSON accepts only nonempty subsets of `instructions` (string) and
 `greetings` (language-key to string map). Input changes/receipts must be regular,
 owner-only files (for example create under `umask 077`). Outputs use exclusive
-0600 creation and refuse overwrite/symlinks; failed operations remove unfinished
+0600 creation on POSIX and an owner-only protected DACL on Windows, and refuse
+overwrite/symlinks; failed operations remove unfinished
 outputs. No whole-agent snapshot is saved. Free text appears only in explicitly
 requested private files for human review before any AI use. Default output in
 pretty/json/verbose modes contains bounded metadata and hashes; AMS refuses raw.
@@ -357,7 +358,7 @@ full-input qualification above. Apply requires the displayed hash, matching
 version and selected before-values, and sends `confirm=True` once. HTTP 401/403
 and 409 never trigger identity fallback or mutation replay.
 
-On transport failure, apply records an unknown outcome and reconciles through GET
+On transport failure or HTTP 5xx, apply records an unknown outcome and reconciles through GET
 plan/agent without retrying the mutation. Confirmed saves require applied status,
 selected-field readback and exactly the next config version. The current public
 response omits publication_status: **saved/readback confirmed is reported separately
@@ -385,3 +386,40 @@ operator-controlled.
 AMS failures exit nonzero with safe categories, never backend exception bodies.
 In particular, apply may exit nonzero after a confirmed save because publication
 is unknown: inspect the emitted outcome before any next action.
+
+On Windows, `chmod` does not establish file privacy. Create the private-input
+directory with an owner-only ACL before saving change JSON or receipts there:
+
+```powershell
+New-Item -ItemType Directory -Path .\ams-private
+$amsUser = whoami
+icacls .\ams-private /inheritance:r /grant:r "${amsUser}:(OI)(CI)F"
+```
+
+Native file handling checks the opened handle's owner and DACL, rejects grants to
+other principals and reparse points, and creates outputs with their restricted
+DACL already in place. Filesystems without usable ACLs fail closed.
+
+The `Python CLI` and `Python CLI (Windows)` CI jobs run the non-live suite on
+Linux and Windows, including native file permissions and apply reconciliation.
+Both feed `SDK package checks`; a job failure or unexpected job skip blocks that aggregate.
+Run locally, sequentially, from `packages/cli/pip` with
+`uv run --frozen --extra dev python -m pytest -q -m 'not live'`.
+These synthetic checks do not establish live CareCo acceptance. That still needs
+an explicitly selected and qualified DEV agent, scoped credentials, and the
+attended before/after/restore procedure above.
+
+For an optional real-HTTP reproduction with Postman CLI 1.75.0, start
+`postman simulation run postman/simulations/ams-tuning-failure.sim.yaml --port 4900 --no-history --output ndjson`
+from the repository root. In another terminal, run the same SDK verification
+helper used by the required loopback HTTP tests:
+
+```bash
+uv run --project packages/cli/pip --frozen --extra dev python -c "import sys; sys.path.insert(0, 'packages/cli/pip/tests'); from test_ams_http import verify_uncertain_apply; print(verify_uncertain_apply('http://127.0.0.1:4900/ams/api/ams'))"
+```
+
+The simulation log must show GET plan, GET agent, one POST apply returning 503,
+then GET plan and GET agent. Restart the stateful simulation before repeating;
+stop it with Ctrl+C afterward. This is a source-backed synthetic failure fixture,
+not the deployed service. The required CI tests exercise both pre-commit and
+post-commit 503 over loopback HTTP without requiring a Postman login or installation.

{healthcloud_cli-3.2.2 → healthcloud_cli-3.2.4}/healthcloud_cli/ams/output.py

@@ -37,10 +37,17 @@ def _pairs(pairs):
 def read_json(path: Path, *, private: bool = False) -> dict:
     """Reject links, non-regular files and ambiguous JSON without quoting input."""
     try:
-        fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
+        if os.name == "nt":
+            from .windows_files import open_file
+
+            fd = open_file(path, private=private)
+        else:
+            fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
         with os.fdopen(fd, encoding="utf-8") as stream:
             info = os.fstat(stream.fileno())
-            if not stat.S_ISREG(info.st_mode) or (private and (info.st_mode & 0o077 or info.st_uid != os.getuid())):
+            if not stat.S_ISREG(info.st_mode) or (
+                private and os.name != "nt" and (info.st_mode & 0o077 or info.st_uid != os.getuid())
+            ):
                 raise ValueError("Private input must be an owner-only regular file")
             value = json.load(
                 stream, object_pairs_hook=_pairs, parse_constant=lambda _: (_ for _ in ()).throw(ValueError())
@@ -58,12 +65,18 @@ def read_json(path: Path, *, private: bool = False) -> dict:
 def private_output(path: Path):
     """Reserve output before network calls, never overwrite, clean failed work."""
     try:
-        fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)
-    except OSError:
+        if os.name == "nt":
+            from .windows_files import open_file
+
+            fd = open_file(path, create=True)
+        else:
+            fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)
+    except OSError, ValueError:
         raise click.ClickException("Cannot create private output; choose a new file, without symlinks.") from None
     try:
         with os.fdopen(fd, "w", encoding="utf-8") as stream:
-            os.fchmod(stream.fileno(), 0o600)
+            if os.name != "nt":
+                os.fchmod(stream.fileno(), 0o600)
             yield lambda value: stream.write(canonical(value) + "\n")
     except BaseException:
         path.unlink(missing_ok=True)

{healthcloud_cli-3.2.2 → healthcloud_cli-3.2.4}/healthcloud_cli/ams/tuning.py

@@ -9,7 +9,7 @@ from uuid import uuid4
 
 import click
 
-from healthcloud.errors import HealthCloudNetworkError
+from healthcloud.errors import HealthCloudHTTPError, HealthCloudNetworkError
 from healthcloud.models.base import JsonValue
 
 from .auth import selected_agent
@@ -199,7 +199,7 @@ def _outcome(sdk, target, receipt, *, unknown: bool = False):
     metadata(result)
     if unknown:
         raise click.ClickException(
-            "Mutation outcome was unknown after transport failure; GET reconciliation recorded. Review saved state; do not replay."
+            "Mutation outcome was unknown after transport or server failure; GET reconciliation recorded. Review saved state; do not replay."
         )
     if not saved:
         raise click.ClickException("Apply status or selected-field readback failed; inspect before further action.")
@@ -226,8 +226,10 @@ def apply_receipt(sdk, target, receipt, confirm_hash: str):
         result = sdk.ams_admin.apply_tuning_plan(
             plan.id, plan_hash=plan.plan_hash, expected_config_version=plan.base_config_version, confirm=True
         )
-    except HealthCloudNetworkError:
-        # No POST replay: even a timeout can have committed on the server.
+    except (HealthCloudNetworkError, HealthCloudHTTPError) as exc:
+        if isinstance(exc, HealthCloudHTTPError) and not 500 <= exc.status_code < 600:
+            raise
+        # A timeout or server/proxy error can occur after the mutation committed.
         metadata(dict(plan_id=plan.id, outcome="unknown", mutation_replayed=False))
         _outcome(sdk, target, receipt, unknown=True)
     if result is None or result.id != plan.id or result.plan_hash != plan.plan_hash:

healthcloud_cli-3.2.4/healthcloud_cli/ams/windows_files.py

@@ -0,0 +1,162 @@
+"""Windows handle-based JSON access with an owner-only, protected DACL.
+
+Keep this module Windows-only: the public file helpers import it lazily.
+Security is checked on the opened handle, before reading or writing content.
+"""
+
+import ctypes
+import msvcrt
+import os
+from ctypes import wintypes as w
+from pathlib import Path
+
+_kernel = ctypes.WinDLL("kernel32", use_last_error=True)
+_security = ctypes.WinDLL("advapi32", use_last_error=True)
+_P = ctypes.c_void_p
+
+
+def _bind(library, name, result, *arguments):
+    function = getattr(library, name)
+    function.restype = result
+    function.argtypes = arguments
+    return function
+
+
+_close = _bind(_kernel, "CloseHandle", w.BOOL, w.HANDLE)
+_free = _bind(_kernel, "LocalFree", _P, _P)
+_process = _bind(_kernel, "GetCurrentProcess", w.HANDLE)
+_open_token = _bind(_security, "OpenProcessToken", w.BOOL, w.HANDLE, w.DWORD, ctypes.POINTER(w.HANDLE))
+_token_info = _bind(_security, "GetTokenInformation", w.BOOL, w.HANDLE, w.DWORD, _P, w.DWORD, ctypes.POINTER(w.DWORD))
+_sid_text = _bind(_security, "ConvertSidToStringSidW", w.BOOL, _P, ctypes.POINTER(_P))
+_descriptor = _bind(
+    _security,
+    "ConvertStringSecurityDescriptorToSecurityDescriptorW",
+    w.BOOL,
+    w.LPCWSTR,
+    w.DWORD,
+    ctypes.POINTER(_P),
+    _P,
+)
+_get_security = _bind(
+    _security,
+    "GetSecurityInfo",
+    w.DWORD,
+    w.HANDLE,
+    w.DWORD,
+    w.DWORD,
+    ctypes.POINTER(_P),
+    _P,
+    ctypes.POINTER(_P),
+    _P,
+    ctypes.POINTER(_P),
+)
+_get_ace = _bind(_security, "GetAce", w.BOOL, _P, w.DWORD, ctypes.POINTER(_P))
+_create = _bind(_kernel, "CreateFileW", w.HANDLE, w.LPCWSTR, w.DWORD, w.DWORD, _P, w.DWORD, w.DWORD, w.HANDLE)
+_file_type = _bind(_kernel, "GetFileType", w.DWORD, w.HANDLE)
+_file_info = _bind(_kernel, "GetFileInformationByHandleEx", w.BOOL, w.HANDLE, w.DWORD, _P, w.DWORD)
+_set_file_info = _bind(_kernel, "SetFileInformationByHandle", w.BOOL, w.HANDLE, w.DWORD, _P, w.DWORD)
+
+
+class _SecurityAttributes(ctypes.Structure):
+    _fields_ = [("length", w.DWORD), ("descriptor", _P), ("inherit", w.BOOL)]
+
+
+class _Acl(ctypes.Structure):
+    _fields_ = [("revision", w.BYTE), ("reserved", w.BYTE), ("size", w.WORD), ("count", w.WORD), ("pad", w.WORD)]
+
+
+def _check(ok):
+    if not ok:
+        raise ctypes.WinError(ctypes.get_last_error())
+
+
+def _sid_string(sid) -> str:
+    text = _P()
+    _check(_sid_text(sid, ctypes.byref(text)))
+    try:
+        return ctypes.wstring_at(text)
+    finally:
+        _free(text)
+
+
+def _user_sid() -> str:
+    token = w.HANDLE()
+    _check(_open_token(_process(), 0x0008, ctypes.byref(token)))  # TOKEN_QUERY
+    try:
+        size = w.DWORD()
+        _token_info(token, 1, None, 0, ctypes.byref(size))  # TokenUser
+        if not size.value:
+            raise ctypes.WinError(ctypes.get_last_error())
+        buffer = ctypes.create_string_buffer(size.value)
+        _check(_token_info(token, 1, buffer, size, ctypes.byref(size)))
+        return _sid_string(_P.from_buffer(buffer).value)  # TOKEN_USER starts with the user SID pointer.
+    finally:
+        _close(token)
+
+
+def _require_private(handle, user_sid: str) -> None:
+    owner, acl, descriptor = _P(), _P(), _P()
+    status = _get_security(
+        handle, 1, 0x00000005, ctypes.byref(owner), None, ctypes.byref(acl), None, ctypes.byref(descriptor)
+    )
+    if status:
+        raise ctypes.WinError(status)
+    try:
+        if not owner or _sid_string(owner) != user_sid or not acl:
+            raise ValueError("Owner-only Windows DACL required")
+        count = ctypes.cast(acl, ctypes.POINTER(_Acl)).contents.count
+        for index in range(count):
+            ace = _P()
+            _check(_get_ace(acl, index, ctypes.byref(ace)))
+            kind, flags = (w.BYTE * 2).from_address(ace.value)
+            if flags & 0x08 or kind == 1:  # INHERIT_ONLY_ACE or ACCESS_DENIED_ACE grants no file access.
+                continue
+            # Only ordinary ACCESS_ALLOWED_ACE grants to the current user are accepted.
+            if kind != 0 or _sid_string(ace.value + 8) != user_sid:
+                raise ValueError("Private Windows files must not grant access to other principals")
+    finally:
+        _free(descriptor)
+
+
+def open_file(path: Path, *, private: bool = False, create: bool = False) -> int:
+    """Return a CRT fd, transferring ownership only after native checks succeed."""
+    user = _user_sid() if private or create else None
+    descriptor = _P()
+    attributes = None
+    if create:
+        # Protected DACL: no inherited grants and no public interval before ACL setup.
+        _check(_descriptor(f"O:{user}D:P(A;;FA;;;{user})", 1, ctypes.byref(descriptor), None))
+        attributes = _SecurityAttributes(ctypes.sizeof(_SecurityAttributes), descriptor, False)
+    try:
+        handle = _create(
+            str(path.absolute()),
+            (0x40010000 if create else 0x80000000) | 0x00020000,  # GENERIC_WRITE + DELETE / READ + READ_CONTROL
+            0 if create else 1,  # No sharing for outputs; share reads only for inputs.
+            ctypes.byref(attributes) if attributes else None,
+            1 if create else 3,  # CREATE_NEW / OPEN_EXISTING
+            0x00200000 | 0x02000000,  # OPEN_REPARSE_POINT | BACKUP_SEMANTICS
+            None,
+        )
+    finally:
+        if descriptor:
+            _free(descriptor)
+    if handle == w.HANDLE(-1).value:
+        raise ctypes.WinError(ctypes.get_last_error())
+    try:
+        info = (w.DWORD * 2)()  # FILE_ATTRIBUTE_TAG_INFO
+        _check(_file_info(handle, 9, info, ctypes.sizeof(info)))
+        if _file_type(handle) != 1 or info[0] & (0x10 | 0x400):  # Disk files only; no directories or reparse points.
+            raise ValueError("Regular non-reparse Windows file required")
+        if user is not None:
+            _require_private(handle, user)
+        fd = msvcrt.open_osfhandle(handle, (os.O_WRONLY if create else os.O_RDONLY) | os.O_BINARY)
+    except BaseException:
+        try:
+            if create:
+                # Delete this exact handle's new file, without a path replacement race.
+                delete = w.BOOL(True)
+                _check(_set_file_info(handle, 4, ctypes.byref(delete), ctypes.sizeof(delete)))
+        finally:
+            _close(handle)
+        raise
+    return fd

{healthcloud_cli-3.2.2 → healthcloud_cli-3.2.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "healthcloud-cli"
-version = "3.2.2"
+version = "3.2.4"
 description = "Command-line interface for the HealthCloud MCP gateway, generated from the shared MCP tool manifest."
 readme = "README.md"
 requires-python = ">=3.14"