hotdata-framework 0.10.0__tar.gz → 0.11.0__tar.gz

{hotdata_framework-0.10.0 → hotdata_framework-0.11.0}/CHANGELOG.md

@@ -7,61 +7,72 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.11.0] - 2026-08-11
+
+### Changed
+
+- Cap the `hotdata` dependency to the current minor (`>=0.8.0,<0.9`). This
+  package wraps a *generated* client, so an SDK minor can remove a model field
+  or a `Configuration` keyword this wrapper passes, and there is no regeneration
+  step here to surface it — an uncapped floor turns an SDK release into a break
+  in this package, in versions already published. Raise the cap deliberately
+  after running the suite against the new minor.
+
+### Removed
+
+- **Breaking:** session/sandbox support is gone. `HotdataClient` no longer accepts
+  `session_id=`, `HotdataClient.session_id` is removed, `default_session_id()` and
+  the `HOTDATA_SANDBOX` read are gone, and `list_workspaces()`,
+  `resolve_workspace_selection()` and `pick_workspace()` lose their `session_id`
+  parameter — note that loss is **positional**, so a three-argument call raises an
+  arity `TypeError` rather than an unexpected-keyword one.
+  `workspace_health_lines()` no longer emits a `sandbox` line.
+
+  **Why now.** The server stopped enforcing session scoping some time ago, so the
+  value already reached nothing. What makes removal urgent rather than tidy is
+  that the SDK is dropping the `SessionId` security scheme: against that release
+  `Configuration(session_id=...)` raises `TypeError` instead of setting a header,
+  and this package passed it unconditionally — so every `HotdataClient(...)`
+  would fail at construction. This package still pins `hotdata<0.9`, so nothing
+  is broken today; the change is what lets the cap be raised later without a
+  second breaking release.
+
+  **Migrating.** Drop `session_id=` from `HotdataClient(...)`, stop reading
+  `client.session_id`, stop setting `HOTDATA_SANDBOX`, and pass two arguments to
+  the workspace helpers. Adapters that re-export session context in their own
+  signatures — a `session_id=` parameter, a `session_id` metadata key — need to
+  remove it from theirs too, which makes their own release breaking in turn.
+
+- `hotdata_framework.http` and `default_http_retries()`. The module existed only
+  to build the `retries=` policy removed under Fixed below, and had no other
+  callers. It predates `hotdata._retry`, which supersedes it.
+
+### Fixed
+
+- A `POST` is no longer replayed because of a response status. `HotdataClient`
+  passed its own `retries=` into `Configuration`, which replaced the generated
+  SDK's policy wholesale with one listing `POST` in `allowed_methods` alongside
+  a `(502, 503, 504)` forcelist — so an intermediary timing out a long request
+  produced a silent, identical re-`POST` while the server was still working on
+  the first one. For a load that is not idempotent: the duplicate collides with
+  the write lock the original holds and is refused.
+
+  The override is removed and the SDK's own default now applies. It is the
+  policy this wrapper was reaching for — `hotdata._retry` retries a
+  *pre-response* connection reset (the stale pooled socket case, where the
+  server did no work) on any method, while leaving read timeouts and status
+  retries idempotent-only.
 
 ## [0.10.0] - 2026-08-07
 
 ### Added
 
-- `create_index(database, table, columns=..., index_type=...)` builds an index on a
-  managed table, bringing the framework client to parity with `hotdata indexes
-  create` in the CLI. It covers all three index kinds the API accepts: `"bm25"` for
-  full-text search, `"vector"` for nearest-neighbour search, and `"sorted"`.
-  Previously the framework had no index API at all and callers had to drop to the raw
-  `hotdata.IndexesApi`, which left a managed database's data loaded but not
-  searchable: full-text queries error without an index, and vector queries run at
-  full-scan speed. Like the other managed-table operations, `database` accepts a
-  name/id or an already-resolved `ManagedDatabase`. Indexing a table on a plain
-  (non-managed) connection is not covered — the CLI's `--catalog` handles that.
-
-  `index_name` is optional and defaults to `{table}_{columns}_{index_type}`, the same
-  derivation the CLI uses when `--name` is omitted, so both surfaces name the same
-  index identically. `index_type` is required, unlike the API's `"sorted"` default,
-  because the wrong kind only fails at query time.
-
-  The server builds the index as a background job whose submit call reports success
-  even when the build later fails, so `create_index` polls the job to a terminal
-  state and raises `RuntimeError` carrying the job's `error_message`. Pass
-  `wait=False` to return once the job is accepted (`status="pending"` plus a
-  `job_id`) and own the outcome check yourself, as the CLI's `--async` does;
-  `timeout_s` and `poll_interval_s` tune the wait.
-
-  Both vector-index modes are supported. Omitting `embedding_provider_id` indexes an
-  existing vector column, queried with a literal vector — and there `metric` must
-  match the distance function the query uses (`cosine`→`cosine_distance`,
-  `l2`→`l2_distance`, `dot`→`negative_dot_product`), since a mismatch silently
-  reverts to a full table scan rather than erroring. Setting
-  `embedding_provider_id` indexes a *text* column instead: the provider embeds it
-  into `output_column`, queries pass text via `vector_distance(source_col, 'query')`,
-  and the server resolves the distance function itself.
-
-  Argument combinations that the server would silently ignore raise `ValueError`
-  before any request is sent: an unknown `index_type` or `metric`, a vector index
-  with more than one column (the engine indexes only the first), and
-  `metric`/`dimensions`/`embedding_provider_id`/`output_column`/`description` on a
-  non-vector index.
-
-  Verified against `api.hotdata.dev` when this version was released: BM25 and vector
-  indexes both build and report `ready`, and a BM25 index is used by full-text
-  search. A *vector* index on a managed database was **not** picked up by the query
-  planner at that time — a matching `cosine_distance(...) ORDER BY ... LIMIT k` still
-  planned as a full scan. That reproduces with an index created by `hotdata indexes
-  create`, so it is an engine-side issue rather than a client one, but it means a
-  vector index built through this method may not yet accelerate queries.
-
-- `CreateIndexResult`, the frozen dataclass `create_index` returns, is exported from
-  `hotdata_framework` and added to the public contract surface. Its `source_column`
-  names the text column to query for a provider-backed vector index, and is `None`
-  for BM25, sorted, and plain vector indexes.
+- `create_index(database, table, columns=..., index_type=...)` builds a `bm25`,
+  `vector`, or `sorted` index on a managed table, matching `hotdata indexes create`
+  in the CLI. The build is a background job whose submit call reports success even
+  when the build later fails, so this polls the job and raises `RuntimeError` with
+  its error message; `wait=False` returns as soon as the job is accepted. Returns
+  `CreateIndexResult`, also exported.
 
 ## [0.9.0] - 2026-07-23
 

{hotdata_framework-0.10.0 → hotdata_framework-0.11.0}/CONTRACT.md

@@ -21,7 +21,6 @@ The supported import surface is:
 - `workspace_health_lines`
 - `default_api_key`
 - `default_host`
-- `default_session_id`
 - `explicit_workspace_id`
 - `list_workspaces`
 - `normalize_host`
@@ -43,7 +42,7 @@ Adapters should import from `hotdata_framework` and treat this surface as the st
 
 ### `HotdataClient`
 
-- Represents runtime context: API key, host, workspace, optional session.
+- Represents runtime context: API key, host, workspace.
 - `from_env()` resolves runtime context from env vars and selected workspace.
 - `execute_sql(sql)` returns `QueryResult` or raises `RuntimeError`/`TimeoutError`.
 - `get_result(result_id)` returns a ready `QueryResult` and waits for readiness when needed.
@@ -79,7 +78,6 @@ Adapters should import from `hotdata_framework` and treat this surface as the st
 
 - `default_api_key()` reads `HOTDATA_API_KEY`.
 - `default_host()` reads `HOTDATA_API_URL` (default: `https://api.hotdata.dev`) and normalizes it.
-- `default_session_id()` reads `HOTDATA_SANDBOX`.
 - `explicit_workspace_id()` reads `HOTDATA_WORKSPACE` (workspace public id).
 - `pick_workspace()` prefers explicit env workspace, then active workspace, then first workspace.
 - `resolve_workspace_selection()` is the canonical workspace selection algorithm. It returns `WorkspaceSelection` with selected workspace id, selection source, and discovered workspaces when auto-selected.

{hotdata_framework-0.10.0 → hotdata_framework-0.11.0}/PKG-INFO

@@ -1,7 +1,7 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: hotdata-framework
-Version: 0.10.0
-Summary: Python framework for building Hotdata integrations: workspace/session runtime, query execution, and managed databases
+Version: 0.11.0
+Summary: Python framework for building Hotdata integrations: workspace runtime, query execution, and managed databases
 Project-URL: Homepage, https://www.hotdata.dev
 Project-URL: Documentation, https://www.hotdata.dev/docs
 Project-URL: Repository, https://github.com/hotdata-dev/sdk-python-framework
@@ -21,7 +21,7 @@ Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Typing :: Typed
 Requires-Python: >=3.10
-Requires-Dist: hotdata>=0.8.0
+Requires-Dist: hotdata<0.9,>=0.8.0
 Requires-Dist: pandas>=2.0
 Requires-Dist: pyarrow>=14.0
 Description-Content-Type: text/markdown
@@ -30,16 +30,15 @@ Description-Content-Type: text/markdown
 
 **A Python framework for building Hotdata integrations.**
 
-Shared runtime primitives for Hotdata integrations: workspace/session semantics, execution context, query state, run history, and replayable result handles. Framework packages (Marimo, Jupyter, Streamlit, LangGraph) depend on this package.
+Shared runtime primitives for Hotdata integrations: workspace semantics, execution context, query state, run history, and replayable result handles. Framework packages (Marimo, Jupyter, Streamlit, LangGraph) depend on this package.
 
 Runtime boundary and guarantees are defined in `CONTRACT.md`.
 
 ## Features
 
-- **Environment-driven client setup** — create clients from `HOTDATA_API_KEY`, optional `HOTDATA_API_URL`, `HOTDATA_WORKSPACE`, and `HOTDATA_SANDBOX`.
+- **Environment-driven client setup** — create clients from `HOTDATA_API_KEY`, optional `HOTDATA_API_URL`, and `HOTDATA_WORKSPACE`.
 - **Workspace resolution** — choose an explicit workspace from env, otherwise discover workspaces and select the active workspace or first available workspace.
-- **Sandbox/session propagation** — pass sandbox session context through the SDK via `X-Session-Id`.
-- **HTTP resilience** — configure SDK retries for transient connection failures and retry SQL execution on stale pooled sockets.
+- **HTTP resilience** — retry SQL execution on stale pooled sockets. Transport-level retries are the SDK's own default, which this package leaves in place so a non-idempotent request is never replayed on a response status.
 - **SQL execution helper** — run SQL through `POST /v1/query`, poll async query runs when needed, and return a `QueryResult`.
 - **Result utilities** — convert query results to records, pandas DataFrames, or metadata dictionaries for adapter display layers.
 - **History helpers** — list recent results and query run history with normalized dataclasses.

{hotdata_framework-0.10.0 → hotdata_framework-0.11.0}/README.md

@@ -2,16 +2,15 @@
 
 **A Python framework for building Hotdata integrations.**
 
-Shared runtime primitives for Hotdata integrations: workspace/session semantics, execution context, query state, run history, and replayable result handles. Framework packages (Marimo, Jupyter, Streamlit, LangGraph) depend on this package.
+Shared runtime primitives for Hotdata integrations: workspace semantics, execution context, query state, run history, and replayable result handles. Framework packages (Marimo, Jupyter, Streamlit, LangGraph) depend on this package.
 
 Runtime boundary and guarantees are defined in `CONTRACT.md`.
 
 ## Features
 
-- **Environment-driven client setup** — create clients from `HOTDATA_API_KEY`, optional `HOTDATA_API_URL`, `HOTDATA_WORKSPACE`, and `HOTDATA_SANDBOX`.
+- **Environment-driven client setup** — create clients from `HOTDATA_API_KEY`, optional `HOTDATA_API_URL`, and `HOTDATA_WORKSPACE`.
 - **Workspace resolution** — choose an explicit workspace from env, otherwise discover workspaces and select the active workspace or first available workspace.
-- **Sandbox/session propagation** — pass sandbox session context through the SDK via `X-Session-Id`.
-- **HTTP resilience** — configure SDK retries for transient connection failures and retry SQL execution on stale pooled sockets.
+- **HTTP resilience** — retry SQL execution on stale pooled sockets. Transport-level retries are the SDK's own default, which this package leaves in place so a non-idempotent request is never replayed on a response status.
 - **SQL execution helper** — run SQL through `POST /v1/query`, poll async query runs when needed, and return a `QueryResult`.
 - **Result utilities** — convert query results to records, pandas DataFrames, or metadata dictionaries for adapter display layers.
 - **History helpers** — list recent results and query run history with normalized dataclasses.

{hotdata_framework-0.10.0 → hotdata_framework-0.11.0}/hotdata_framework/__init__.py

@@ -20,7 +20,6 @@ from hotdata_framework.env import (
     WorkspaceSelection,
     default_api_key,
     default_host,
-    default_session_id,
     explicit_workspace_id,
     list_workspaces,
     normalize_host,
@@ -61,7 +60,6 @@ __all__ = [
     "classify_sdk_error",
     "default_api_key",
     "default_host",
-    "default_session_id",
     "explicit_workspace_id",
     "from_env",
     "is_parquet_path",

{hotdata_framework-0.10.0 → hotdata_framework-0.11.0}/hotdata_framework/client.py

@@ -49,11 +49,9 @@ from hotdata_framework.databases import (
 from hotdata_framework.env import (
     default_api_key,
     default_host,
-    default_session_id,
     normalize_host,
     pick_workspace,
 )
-from hotdata_framework.http import default_http_retries
 from hotdata_framework.result import QueryResult
 
 # Load modes the managed-table endpoint accepts: replace overwrites, append adds
@@ -150,19 +148,21 @@ class HotdataClient:
         workspace_id: str,
         *,
         host: str | None = None,
-        session_id: str | None = None,
         request_timeout: float | tuple[float, float] | None = None,
     ) -> None:
         self._host = normalize_host(host) if host else default_host()
         self._api_key = api_key
         self._workspace_id = workspace_id
-        self._session_id = session_id
+        # No `retries=`: the generated SDK's own default is the correct policy
+        # and passing one here replaces it wholesale. `hotdata._retry` retries a
+        # pre-response connection reset on any method — the stale pooled socket
+        # case this wrapper was reaching for — while leaving read timeouts and
+        # status retries idempotent-only, so a POST that may have reached the
+        # server is never replayed.
         self._config = Configuration(
             host=self._host,
             api_key=api_key,
             workspace_id=workspace_id,
-            session_id=session_id,
-            retries=default_http_retries(),
         )
         self._api = ApiClient(self._config)
         if request_timeout is not None:
@@ -174,9 +174,8 @@ class HotdataClient:
         if not api_key:
             raise RuntimeError("HOTDATA_API_KEY must be set.")
         host = default_host()
-        session = default_session_id()
-        workspace_id = pick_workspace(api_key, host, session)
-        return cls(api_key, workspace_id, host=host, session_id=session)
+        workspace_id = pick_workspace(api_key, host)
+        return cls(api_key, workspace_id, host=host)
 
     @property
     def workspace_id(self) -> str:
@@ -186,10 +185,6 @@ class HotdataClient:
     def host(self) -> str:
         return self._host
 
-    @property
-    def session_id(self) -> str | None:
-        return self._session_id
-
     @property
     def api(self) -> ApiClient:
         return self._api

{hotdata_framework-0.10.0 → hotdata_framework-0.11.0}/hotdata_framework/env.py

@@ -31,16 +31,11 @@ def default_host() -> str:
     return normalize_host(raw)
 
 
-def default_session_id() -> str | None:
-    return os.environ.get("HOTDATA_SANDBOX")
-
-
-def list_workspaces(api_key: str, host: str, session_id: str | None):
+def list_workspaces(api_key: str, host: str):
     cfg = Configuration(
         host=host,
         api_key=api_key,
         workspace_id=None,
-        session_id=session_id,
     )
     with ApiClient(cfg) as api:
         listing = WorkspacesApi(api).list_workspaces()
@@ -54,9 +49,7 @@ class WorkspaceSelection:
     workspaces: list
 
 
-def resolve_workspace_selection(
-    api_key: str, host: str, session_id: str | None
-) -> WorkspaceSelection:
+def resolve_workspace_selection(api_key: str, host: str) -> WorkspaceSelection:
     explicit = explicit_workspace_id()
     if explicit:
         return WorkspaceSelection(
@@ -64,7 +57,7 @@ def resolve_workspace_selection(
             source="explicit_env",
             workspaces=[],
         )
-    workspaces = list_workspaces(api_key, host, session_id)
+    workspaces = list_workspaces(api_key, host)
     if not workspaces:
         raise RuntimeError("No Hotdata workspaces found for this API key.")
     active = [w for w in workspaces if w.active]
@@ -76,6 +69,6 @@ def resolve_workspace_selection(
     )
 
 
-def pick_workspace(api_key: str, host: str, session_id: str | None) -> str:
-    selection = resolve_workspace_selection(api_key, host, session_id)
+def pick_workspace(api_key: str, host: str) -> str:
+    selection = resolve_workspace_selection(api_key, host)
     return selection.workspace_id

{hotdata_framework-0.10.0 → hotdata_framework-0.11.0}/hotdata_framework/health.py

@@ -18,8 +18,6 @@ def workspace_health_lines(client: HotdataClient) -> tuple[bool, list[str]]:
             f"**workspace** `{client.workspace_id}`",
             f"**connections** {n}",
         ]
-        if client.session_id:
-            lines.append(f"**sandbox** `{client.session_id}`")
         return True, lines
     except ApiException as e:
         return False, [e.reason or str(e)]

{hotdata_framework-0.10.0 → hotdata_framework-0.11.0}/pyproject.toml

@@ -4,8 +4,8 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hotdata-framework"
-version = "0.10.0"
-description = "Python framework for building Hotdata integrations: workspace/session runtime, query execution, and managed databases"
+version = "0.11.0"
+description = "Python framework for building Hotdata integrations: workspace runtime, query execution, and managed databases"
 readme = "README.md"
 requires-python = ">=3.10"
 license = { text = "MIT" }
@@ -26,8 +26,18 @@ classifiers = [
   "Typing :: Typed",
 ]
 dependencies = [
-  # 0.7.0 adds `key` to table decls (create_managed_database(keys=) / add_managed_table(key=))
-  "hotdata>=0.8.0",
+  # Floor: 0.8.0 carries the per-load `key` on load_managed_table — the merge key
+  # for delete/update/upsert loads, matched per load rather than declared at table
+  # creation. 0.7.0 is what first put `key` on the table decls themselves
+  # (create_managed_database(keys=) / add_managed_table(key=)).
+  #
+  # Capped to the current minor. This package is a hand-written wrapper over a
+  # GENERATED client, so an SDK minor can remove a model field or a Configuration
+  # keyword we pass, and there is no regeneration step here to catch it — an
+  # uncapped floor turns someone else's release into a break in ours,
+  # with no commit of our own to point at. Raise the cap deliberately, after
+  # running the suite against the new minor.
+  "hotdata>=0.8.0,<0.9",
   "pandas>=2.0",
   "pyarrow>=14.0",
 ]

{hotdata_framework-0.10.0 → hotdata_framework-0.11.0}/scripts/release.sh

@@ -7,6 +7,39 @@ cd "$ROOT"
 die() { echo "error: $*" >&2; exit 1; }
 need() { command -v "$1" >/dev/null 2>&1 || die "$1 is required"; }
 
+# An interpreter that can `import tomllib`, which is stdlib only from 3.11.
+#
+# `python3` carries no version guarantee, and this package's own requires-python
+# is >=3.10 — so hardcoding it meant the release script could not run on the
+# oldest Python the package claims to support. No workflow runs this script; only
+# a human cutting a release does, which is why it went unnoticed for so long. The
+# symptom was a bare ModuleNotFoundError, which reads as a broken checkout rather
+# than a too-old interpreter.
+#
+# `uv` is the fallback because this repo already builds and tests through it, so
+# a machine that can run the suite can run the release.
+resolve_python() {
+  if command -v python3 >/dev/null 2>&1 && python3 -c "import tomllib" >/dev/null 2>&1; then
+    echo python3
+  elif command -v uv >/dev/null 2>&1; then
+    # `>=3.11` not `3.12`: an exact request downloads a managed interpreter when
+    # the machine's uv-visible one is 3.11 or 3.13, and fails outright under
+    # UV_PYTHON_DOWNLOADS=never. It reads like a redirect but is not one —
+    # $PY_BIN is expanded unquoted for word splitting, and bash does not rescan
+    # expansion results for redirection operators, so uv receives it literally.
+    echo "uv run --no-project --python >=3.11 python"
+  else
+    die "need python3 >= 3.11 (for tomllib) or uv; python3 is $(command -v python3 >/dev/null 2>&1 && python3 -V 2>&1 || echo absent)"
+  fi
+}
+
+# Deferred, not resolved at load: the commands that never touch Python must keep
+# working without a usable interpreter — otherwise the message telling you which
+# interpreter you need is itself gated on having it, and `--help` breaks on
+# exactly the machine this resolution exists for. Empty default satisfies `set -u`
+# if a helper is ever reached by another path.
+PY_BIN=""
+
 usage() {
   cat <<'EOF'
 Usage:
@@ -24,7 +57,7 @@ EOF
 }
 
 get_version() {
-  python3 - <<'PY'
+  $PY_BIN - <<'PY'
 import tomllib
 from pathlib import Path
 print(tomllib.loads(Path("pyproject.toml").read_text())["project"]["version"])
@@ -32,7 +65,7 @@ PY
 }
 
 get_pkg_name() {
-  python3 - <<'PY'
+  $PY_BIN - <<'PY'
 import tomllib
 from pathlib import Path
 print(tomllib.loads(Path("pyproject.toml").read_text())["project"]["name"])
@@ -41,7 +74,7 @@ PY
 
 set_version() {
   local ver="$1"
-  python3 - "$ver" <<'PY'
+  $PY_BIN - "$ver" <<'PY'
 import re, sys
 from pathlib import Path
 ver = sys.argv[1]
@@ -56,7 +89,7 @@ PY
 
 bump_version() {
   local kind="$1" current="$2"
-  python3 - "$kind" "$current" <<'PY'
+  $PY_BIN - "$kind" "$current" <<'PY'
 import re, sys
 kind, current = sys.argv[1], sys.argv[2]
 match = re.match(r"^(\d+)\.(\d+)\.(\d+)(.*)$", current)
@@ -95,14 +128,14 @@ update_changelog() {
   local ver="$1"
   local date
   date="$(date +%Y-%m-%d)"
-  python3 scripts/update_changelog.py "$ver" "$date"
+  $PY_BIN scripts/update_changelog.py "$ver" "$date"
 }
 
 cmd_prepare() {
   local bump="${1:-}"
   [[ -n "$bump" ]] || { usage; die "missing bump kind or explicit version"; }
   need gh
-  need python3
+  PY_BIN="$(resolve_python)"
   ensure_clean
 
   local current new base branch pkg
@@ -151,7 +184,7 @@ After merge, run \`./scripts/release.sh publish\` from a clean \`${base}\` check
 
 cmd_publish() {
   need gh
-  need python3
+  PY_BIN="$(resolve_python)"
   ensure_clean
 
   local base ver tag
@@ -166,7 +199,7 @@ cmd_publish() {
 
   git rev-parse "$tag" >/dev/null 2>&1 && die "tag $tag already exists"
   [[ -f CHANGELOG.md ]] || die "CHANGELOG.md is required"
-  python3 - "$ver" <<'PY'
+  $PY_BIN - "$ver" <<'PY'
 import re, sys
 from pathlib import Path
 ver = sys.argv[1]

{hotdata_framework-0.10.0 → hotdata_framework-0.11.0}/tests/test_client.py

@@ -4,6 +4,7 @@ from types import SimpleNamespace
 from unittest.mock import patch
 
 import pytest
+from hotdata import Configuration
 from hotdata.exceptions import ForbiddenException
 
 from hotdata_framework.client import HotdataClient
@@ -153,7 +154,7 @@ def test_normalize_host(raw: str, expected: str):
 
 def test_pick_workspace_prefers_env(monkeypatch: pytest.MonkeyPatch):
     monkeypatch.setenv("HOTDATA_WORKSPACE", "ws_explicit")
-    assert pick_workspace("k", "https://api.hotdata.dev", None) == "ws_explicit"
+    assert pick_workspace("k", "https://api.hotdata.dev") == "ws_explicit"
 
 
 def test_resolve_workspace_selection_prefers_env_without_listing(
@@ -161,7 +162,7 @@ def test_resolve_workspace_selection_prefers_env_without_listing(
 ):
     monkeypatch.setenv("HOTDATA_WORKSPACE", "ws_explicit")
     with patch("hotdata_framework.env.list_workspaces") as listing:
-        resolved = resolve_workspace_selection("k", "https://api.hotdata.dev", None)
+        resolved = resolve_workspace_selection("k", "https://api.hotdata.dev")
     listing.assert_not_called()
     assert resolved.workspace_id == "ws_explicit"
     assert resolved.source == "explicit_env"
@@ -180,7 +181,7 @@ def test_pick_workspace_chooses_first_active(monkeypatch: pytest.MonkeyPatch):
 
     with patch("hotdata_framework.env.WorkspacesApi") as Api:
         Api.return_value.list_workspaces.return_value = listing
-        assert pick_workspace("k", "https://api.hotdata.dev", None) == "ws_2"
+        assert pick_workspace("k", "https://api.hotdata.dev") == "ws_2"
 
 
 def test_pick_workspace_falls_back_to_first(monkeypatch: pytest.MonkeyPatch):
@@ -194,7 +195,7 @@ def test_pick_workspace_falls_back_to_first(monkeypatch: pytest.MonkeyPatch):
 
     with patch("hotdata_framework.env.WorkspacesApi") as Api:
         Api.return_value.list_workspaces.return_value = listing
-        assert pick_workspace("k", "https://api.hotdata.dev", None) == "ws_1"
+        assert pick_workspace("k", "https://api.hotdata.dev") == "ws_1"
 
 
 def test_resolve_workspace_selection_source_first(monkeypatch: pytest.MonkeyPatch):
@@ -206,7 +207,7 @@ def test_resolve_workspace_selection_source_first(monkeypatch: pytest.MonkeyPatc
     listing = SimpleNamespace(workspaces=items)
     with patch("hotdata_framework.env.WorkspacesApi") as Api:
         Api.return_value.list_workspaces.return_value = listing
-        resolved = resolve_workspace_selection("k", "https://api.hotdata.dev", None)
+        resolved = resolve_workspace_selection("k", "https://api.hotdata.dev")
     assert resolved.workspace_id == "ws_1"
     assert resolved.source == "first"
     assert resolved.workspaces == items
@@ -225,7 +226,7 @@ def test_resolve_workspace_selection_returns_workspaces_and_source(
 
     with patch("hotdata_framework.env.WorkspacesApi") as Api:
         Api.return_value.list_workspaces.return_value = listing
-        resolved = resolve_workspace_selection("k", "https://api.hotdata.dev", None)
+        resolved = resolve_workspace_selection("k", "https://api.hotdata.dev")
     assert resolved.workspace_id == "ws_2"
     assert resolved.source == "active"
     assert resolved.workspaces == items
@@ -447,3 +448,99 @@ def test_list_run_history_returns_normalized_items():
     assert out[0].execution_time_ms == 7
     assert out[0].to_dict()["result_id"] == "res_1"
     assert fake_runs.kwargs == {"limit": 5}
+
+
+# ---------------------------------------------------------------------------
+# Session removal — asserted at the wire, not at the signature
+#
+# A signature-shaped check ("does __init__ accept session_id?") is satisfied by
+# any unrecognised keyword and says nothing about what goes on the request. The
+# feature was proven revivable from the ENVIRONMENT with the whole suite green:
+# read HOTDATA_SANDBOX, pass it to Configuration, and the X-Session-Id header is
+# back on every call with no signature change to notice. So these assert on
+# `Configuration.api_keys`, which is where the generated client actually decides
+# to send the header, and they set HOTDATA_SANDBOX so an environment-sourced
+# revival has something to find.
+
+
+def _sandbox_set(monkeypatch: pytest.MonkeyPatch) -> str:
+    value = "sb_should_reach_nothing"
+    monkeypatch.setenv("HOTDATA_SANDBOX", value)
+    return value
+
+
+def test_client_registers_no_session_header(monkeypatch: pytest.MonkeyPatch):
+    """The removal's observable contract: no X-Session-Id on anything this client
+    sends. `api_keys` is the SDK's own record of which security schemes it will
+    attach, so an empty SessionId slot is the header being absent."""
+    _sandbox_set(monkeypatch)
+    client = HotdataClient("k", "ws", host="https://api.hotdata.dev")
+    assert "SessionId" not in client.api.configuration.api_keys
+    assert client.api.configuration.api_keys == {"WorkspaceId": "ws"}
+
+
+def test_client_rejects_session_id_by_name(monkeypatch: pytest.MonkeyPatch):
+    """`match=` matters: without it the assertion passes for ANY unknown keyword,
+    making it a typo detector rather than a statement about `session_id`."""
+    _sandbox_set(monkeypatch)
+    with pytest.raises(TypeError, match="session_id"):
+        HotdataClient("k", "ws", host="https://api.hotdata.dev", session_id="sb_x")
+    # The property is gone too — the CHANGELOG says so, and an adapter reading it
+    # should get AttributeError rather than a stale value.
+    assert not hasattr(HotdataClient("k", "ws", host="https://api.hotdata.dev"), "session_id")
+
+
+def test_workspace_listing_registers_no_session_header(monkeypatch: pytest.MonkeyPatch):
+    """`list_workspaces` builds its OWN Configuration, so it is a second place the
+    header can come back — and it is the pre-auth call, made before any workspace
+    is known."""
+    _clear_workspace_env(monkeypatch)
+    _sandbox_set(monkeypatch)
+    seen: list[Configuration] = []
+
+    def spy(*args: object, **kwargs: object) -> Configuration:
+        # Assert on the CONFIG, not on the kwargs. `session_id=` is only one way
+        # back: `Configuration(api_keys={"SessionId": ...})` is a documented
+        # escape hatch that re-attaches the header with no such keyword, and a
+        # kwargs-only check waves it through.
+        cfg = Configuration(*args, **kwargs)
+        seen.append(cfg)
+        return cfg
+
+    listing = SimpleNamespace(workspaces=[SimpleNamespace(public_id="ws_1", active=True)])
+    with patch("hotdata_framework.env.Configuration", spy), patch(
+        "hotdata_framework.env.WorkspacesApi"
+    ) as Api:
+        Api.return_value.list_workspaces.return_value = listing
+        assert pick_workspace("k", "https://api.hotdata.dev") == "ws_1"
+    assert seen, "list_workspaces built no Configuration — the spy never fired"
+    for cfg in seen:
+        assert "SessionId" not in cfg.api_keys
+
+
+def test_from_env_builds_a_client_without_a_session(monkeypatch: pytest.MonkeyPatch):
+    """`from_env` is the entry point every adapter uses, and its body had no
+    coverage at all: the module-level `from_env` test patches this classmethod
+    out. Leaving a stale 3-argument `pick_workspace(...)` call here broke it
+    unconditionally while the suite stayed green."""
+    _clear_workspace_env(monkeypatch)
+    _sandbox_set(monkeypatch)
+    monkeypatch.setenv("HOTDATA_API_KEY", "k_env")
+    monkeypatch.setenv("HOTDATA_API_URL", "https://api.hotdata.dev")
+
+    with patch("hotdata_framework.client.pick_workspace") as picked:
+        picked.return_value = "ws_from_env"
+        client = HotdataClient.from_env()
+
+    # Two arguments, positionally — the signature this change trimmed.
+    assert picked.call_args.args == ("k_env", "https://api.hotdata.dev")
+    assert picked.call_args.kwargs == {}
+    assert client.workspace_id == "ws_from_env"
+    assert client.host == "https://api.hotdata.dev"
+    assert "SessionId" not in client.api.configuration.api_keys
+
+
+def test_from_env_requires_an_api_key(monkeypatch: pytest.MonkeyPatch):
+    monkeypatch.delenv("HOTDATA_API_KEY", raising=False)
+    with pytest.raises(RuntimeError, match="HOTDATA_API_KEY"):
+        HotdataClient.from_env()

{hotdata_framework-0.10.0 → hotdata_framework-0.11.0}/tests/test_contract.py

@@ -28,7 +28,6 @@ def test_public_exports_contract():
         "classify_sdk_error",
         "default_api_key",
         "default_host",
-        "default_session_id",
         "explicit_workspace_id",
         "from_env",
         "is_parquet_path",

{hotdata_framework-0.10.0 → hotdata_framework-0.11.0}/tests/test_health.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 from unittest.mock import patch
 
+import pytest
 from hotdata.exceptions import ApiException
 
 from hotdata_framework.client import HotdataClient
@@ -22,8 +23,19 @@ def test_workspace_health_ok():
     assert any("reachable" in p for p in parts)
 
 
-def test_workspace_health_ok_includes_sandbox_when_session_set():
-    client = HotdataClient("k", "ws", host="https://api.hotdata.dev", session_id="sb_test")
+def test_workspace_health_no_longer_reports_a_session(monkeypatch: pytest.MonkeyPatch):
+    """Health output must not mention a session even when the environment offers
+    one.
+
+    HOTDATA_SANDBOX is set deliberately, and that is the whole point. An earlier
+    version of this test built a client with no session at all — so on a revert
+    that restored the property and the `if client.session_id:` line, the guard was
+    simply false, no `sandbox` line was emitted, and the assertion passed with the
+    regression fully present. Setting the variable is what makes the assertion
+    reachable, because a revival of this feature would read it from here.
+    """
+    monkeypatch.setenv("HOTDATA_SANDBOX", "sb_should_reach_nothing")
+    client = HotdataClient("k", "ws", host="https://api.hotdata.dev")
     listing = type("L", (), {"connections": [object()]})()
 
     class FakeConnectionsApi:
@@ -33,7 +45,8 @@ def test_workspace_health_ok_includes_sandbox_when_session_set():
     with patch.object(client, "connections", return_value=FakeConnectionsApi()):
         ok, parts = workspace_health_lines(client)
     assert ok is True
-    assert any("sandbox" in p and "sb_test" in p for p in parts)
+    assert "sb_should_reach_nothing" not in " ".join(parts)
+    assert not any("sandbox" in p for p in parts)
 
 
 def test_workspace_health_api_error():

hotdata_framework-0.11.0/tests/test_retry_policy.py

@@ -0,0 +1,63 @@
+"""A POST must never be replayed because of a response status.
+
+A load is not idempotent: re-sending one that the server is still working on
+collides with the write lock the first attempt holds, and the duplicate is
+refused. The generated SDK already draws this line — ``hotdata._retry`` retries
+a *pre-response* connection reset on any method (the stale pooled socket case,
+where the server did no work) while leaving read timeouts and status retries
+idempotent-only. This wrapper used to pass its own ``retries=`` into
+``Configuration``, which replaced that policy wholesale with one that listed
+POST alongside a 502/503/504 forcelist — so a gateway timing out a long request
+produced a silent duplicate of it.
+
+These tests pin the resulting policy rather than the absence of an argument,
+so re-introducing an override that is unsafe for POST fails here.
+"""
+
+from __future__ import annotations
+
+from hotdata_framework.client import HotdataClient
+
+WS = "work_test0000000000000000000000"
+
+
+def _retry_policy():
+    client = HotdataClient(api_key="hd_test", workspace_id=WS, host="https://example.invalid")
+    return client._config.retries
+
+
+def test_no_status_forcelist() -> None:
+    """A status code means the request reached the server, so retrying one is a
+    decision about idempotency that the transport layer cannot make."""
+    retry = _retry_policy()
+    assert not retry.status_forcelist, retry.status_forcelist
+    assert retry.status == 0
+
+
+def test_post_is_not_read_or_status_retried() -> None:
+    """``allowed_methods`` gates both read and status retries. POST outside it is
+    what stops a request the server may already be processing from being sent
+    twice."""
+    retry = _retry_policy()
+    assert "POST" not in retry.allowed_methods
+    assert "GET" in retry.allowed_methods
+
+
+def test_pre_response_connection_reset_still_retries_any_method() -> None:
+    """The case the wrapper's own override was reaching for, kept: a reset before
+    any response means the request never landed, so a POST retry is safe."""
+    from urllib3.exceptions import ProtocolError
+
+    # `_is_connection_error` is urllib3-private, and urllib3 reaches this package
+    # only as an unpinned transitive dependency — so an upstream rename breaks
+    # this test for reasons unrelated to this repo. Accepted knowingly: it is the
+    # only hook that separates a reset from any other ProtocolError without
+    # standing up a live socket.
+    retry = _retry_policy()
+    cause = ConnectionResetError(54, "Connection reset by peer")
+    reset = ProtocolError("Connection aborted.", cause)
+    assert retry._is_connection_error(reset)
+    # A ProtocolError with no connection-level cause is NOT reclassified: only a
+    # reset proves the request never landed. Read timeouts never reach this branch
+    # at all — urllib3 raises those as ReadTimeoutError, and they stay method-gated.
+    assert not retry._is_connection_error(ProtocolError("Connection aborted.", None))

{hotdata_framework-0.10.0 → hotdata_framework-0.11.0}/uv.lock

@@ -101,7 +101,7 @@ wheels = [
 
 [[package]]
 name = "hotdata-framework"
-version = "0.10.0"
+version = "0.11.0"
 source = { editable = "." }
 dependencies = [
     { name = "hotdata" },
@@ -120,7 +120,7 @@ dev = [
 
 [package.metadata]
 requires-dist = [
-    { name = "hotdata", specifier = ">=0.8.0" },
+    { name = "hotdata", specifier = ">=0.8.0,<0.9" },
     { name = "pandas", specifier = ">=2.0" },
     { name = "pyarrow", specifier = ">=14.0" },
 ]

hotdata_framework-0.10.0/hotdata_framework/http.py

@@ -1,17 +0,0 @@
-"""HTTP client defaults for Hotdata SDK :class:`~hotdata.Configuration`."""
-
-from __future__ import annotations
-
-from urllib3.util.retry import Retry
-
-
-def default_http_retries() -> Retry:
-    """Retry transient connection failures (e.g. stale pooled sockets)."""
-    return Retry(
-        total=3,
-        connect=3,
-        read=3,
-        backoff_factor=0.2,
-        status_forcelist=(502, 503, 504),
-        allowed_methods=frozenset(["GET", "HEAD", "POST", "PUT", "DELETE", "OPTIONS", "PATCH"]),
-    )