keboola-cli 0.93.2__tar.gz → 0.94.0__tar.gz

{keboola_cli-0.93.2 → keboola_cli-0.94.0}/CLAUDE.md

@@ -392,12 +392,14 @@ kbagent auth register-projects [--stack URL|alias] [--all] [--project-id ID ...]
 #   USER-scoped "programmatic session" (kbc_at_* access token + kbc_rt_* refresh token) stored in
 #   auth.json (0600), a sibling of config.json -- config.json's schema and CURRENT_CONFIG_VERSION are
 #   unchanged. --register-projects writes each accessible project into config.json with the sentinel
-#   token `kbc-session://{project_id}`. v1 scope is the Storage + Manage paths: the CLI commands and
-#   `serve` both reach them, because `serve` delegates to the same already-guarded services (see
-#   server/dependencies.py). Everything outside those paths fails fast on a sentinel-token project
-#   (AUTH_NOT_SUPPORTED_ON_STACK) naming the static-token fallback; the authoritative list is
-#   SESSION_UNSUPPORTED_FEATURES in services/_auth_registration.py, shipped to callers as
-#   `session_unsupported_features` in --json -- do not re-derive it by hand. `dev-portal` is NOT on it
+#   token `kbc-session://{project_id}`. A session now works with nearly every command -- the Storage
+#   and Manage client paths plus (added by CLI-13) the Scheduler (flow schedule / schedule-remove),
+#   Data Streams (stream), Data Science (data-app), the semantic-layer group, the AI Service, and
+#   Storage bucket sharing (sharing share / unshare). `serve` reaches them too, because it delegates to
+#   the same already-guarded services (see server/dependencies.py). Only three features still fail fast
+#   on a sentinel-token project (AUTH_NOT_SUPPORTED_ON_STACK) naming the static-token fallback: the
+#   authoritative list is SESSION_UNSUPPORTED_FEATURES in services/_auth_registration.py, shipped to
+#   callers as `session_unsupported_features` in --json -- do not re-derive it by hand. `dev-portal` is NOT on it
 #   (it authenticates with its own identity, never a project token). Over `serve`, a session that
 #   expires at runtime answers HTTP 401 with
 #   error_code SESSION_EXPIRED -- a browser login only completes on the host. Serving session projects
@@ -737,6 +739,67 @@ kbagent branch metadata-list --project NAME [--branch ID|default]
 kbagent branch metadata-get --project NAME --key KEY [--branch ID|default]
 kbagent branch metadata-set --project NAME --key KEY [--text STR | --file PATH | --stdin] [--branch ID|default]
 kbagent branch metadata-delete --project NAME --metadata-id ID [--branch ID|default]
+# branch merge is DEPRECATED (since 0.94.0): it only builds a UI URL and resets the active branch. On a
+#   project with `branches-merge-requests` use the merge-request group below; the command keeps working
+#   (it also serves projects without the feature) and now carries `deprecation` in --json.
+
+# merge-request (since 0.94.0, DMD-1900): the non-SOX Branches 2.0 lifecycle. Hidden alias `mr`. Every
+#   command except list/create takes `[--merge-request-id N | --id N] [--branch B]`: omitted, the target is
+#   the merge request OF the active branch (`branch use`) -- a branch has at most one MR, ever. Both flags at
+#   once -> exit 2. `--project` is single-project (never fans out). Status is the DERIVED state the web UI
+#   shows (in_development|in_review|approved|in_merge|merged|closed|rejected), never the raw one.
+kbagent merge-request list [--project A] [--state STATE]   # derived (in_development|in_review|approved|in_merge|merged|closed|rejected) or raw (development|published|canceled) states; `--help` lists them
+kbagent merge-request detail [--project A] [--merge-request-id N | --branch B] [--activity-log]
+kbagent merge-request create --title T [--project A] [--branch B] [--description D] [--reviewer-id ID ...] [--external-id X]
+kbagent merge-request update [--project A] [--merge-request-id N | --branch B] [--title T] [--description D] [--reviewer-id ID ...] [--external-id X]
+kbagent merge-request request-review [--project A] [--merge-request-id N | --branch B]
+kbagent merge-request approve [--project A] [--merge-request-id N | --branch B]
+kbagent merge-request request-changes [--project A] [--merge-request-id N | --branch B] [--reason TEXT]
+kbagent merge-request auto-merge --strategy immediately|scheduled|none [--at TS] [--project A] [--merge-request-id N | --branch B] [--yes]
+kbagent merge-request merge [--project A] [--merge-request-id N | --branch B] [--yes]
+kbagent merge-request conflicts [--project A] [--merge-request-id N | --branch B]
+kbagent merge-request diff --component-id C --config-id I [--project A] [--merge-request-id N | --branch B] [--format short|full] [--output PATH]
+kbagent merge-request resolve --component-id C --config-id I (--take ours|theirs|delete | --resolved JSON|@file|-) [--project A] [--merge-request-id N | --branch B] [--change-description TEXT]
+# WHAT IS DESTRUCTIVE -- a property of the COMMAND, never of a flag or of the MR's state, so a policy is
+#   evaluated from the command name alone, before any network call. Destructive = anything that moves a
+#   merge request toward or into production: `merge` (deletes the source branch, rewrites production),
+#   `request-review` (on the non-SOX default of 0 approvals it lands the MR directly in `approved`),
+#   `approve` (the last approval is what a merge waits for), `resolve` (removes the blocker a merge waits
+#   on) and `auto-merge` (arms a backend scheduler that runs every `approved` MR whose strategy is
+#   immediately/scheduled through the same MergeProcessor, on its own, retrying every tick -- a DELAYED
+#   PRODUCTION MERGE with `merge` never called; `--strategy none` disarms and rides the same command, same
+#   class). Write = shapes the MR without moving it: `create`, `update` (title/description/reviewers/
+#   external id -- auto-merge is NOT a field here), `request-changes` (moves it AWAY from approved).
+#   So `--deny-destructive` yields an agent that can observe and shape merge requests but never move one.
+#   Under --json every destructive command REQUIRES an explicit target (--merge-request-id or --branch),
+#   checked before anything is resolved: every destructive kbagent command either prompts or is told its
+#   target, and --json has no prompt. In human mode the active-branch fallback stays; `merge` and arming
+#   `auto-merge` prompt (--yes skips), the other destructive commands do not. After request-review/
+#   approve/resolve on an MR that IS armed, human mode warns that the backend will now merge (read off the
+#   write's own result, no extra GET).
+#   On a non-SOX project with the default 0 required approvals: `merge` works straight from `development`;
+#   `request-review` lands directly in `approved` (in_review is unreachable); `approve` answers 422 in every
+#   state. There is NO `close`: `request-changes` by the creator is the UI's cancel and leaves the MR in
+#   `development` (the `closed`/`rejected` derivations depend on reviewer status a 0-approval project never
+#   populates -- same blind spot as the web UI, DMD-1988). Requesting review with no reviewers selected
+#   emails EVERY project member.
+#   Conflicts: `conflicts` lists what changed on both sides (isDeleted = the DEV side's flag); `diff`
+#   classifies per path (both / only you / only production) and, when a side deleted the config wholesale,
+#   recommends the --take; `diff --output FILE` writes `resolution_candidate` (your branch's content, all
+#   five keys: name/description/isDisabled/configuration/rows -- rebase REPLACES, a missing key wipes data,
+#   the service refuses a partial body) to edit and hand back via `resolve --resolved @FILE`. No `--all`.
+#   Errors: a project without the feature answers FEATURE_NOT_ENABLED (exit 5) from every command whose
+#   target was resolved implicitly, reads included -- two wordings, missing feature vs SOX project. A
+#   scoped Storage token 403s (ACCESS_DENIED) on everything but `list`. `MR_MERGE_CONFLICT` /
+#   `MR_NOT_READY_TO_MERGE` (exit 1; the latter retryable) come from the merge 409; a truncated conflict
+#   list in the error carries `details.api_error_params_truncated: true` -- run `conflicts` for the full set.
+#   `merge` blocks for up to 10 minutes (no --wait/--timeout). Every result may carry `warnings[]`
+#   (post-merge cleanup failures, a dropped --change-description on a delete resolution). A merge whose
+#   source branch id could not be read carries `cleanup_skipped: true` + `branch_from_id_raw` (the local
+#   active-branch reset / sync unlink did NOT run -- key on the flag, not on warning text). On a project
+#   where the feature was later switched OFF, `list` rows' `allowed_actions` still recommend writes that
+#   will fail FEATURE_NOT_ENABLED (state-derived, feature-blind); `detail` carries `feature_enabled` and
+#   its hint-next respects it.
 
 kbagent workspace create --project ALIAS [--name NAME] [--backend TYPE] [--ui] [--read-only/--no-read-only]
 kbagent workspace list [--project NAME ...] [--orphaned] [--branch ID] [--qs-compatible]

{keboola_cli-0.93.2 → keboola_cli-0.94.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: keboola-cli
-Version: 0.93.2
+Version: 0.94.0
 Summary: AI-friendly CLI for managing Keboola projects
 Author-email: Keboola <dev@keboola.com>
 License-Expression: Apache-2.0

{keboola_cli-0.93.2 → keboola_cli-0.94.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "keboola-cli"
-version = "0.93.2"
+version = "0.94.0"
 description = "AI-friendly CLI for managing Keboola projects"
 readme = "README.md"
 requires-python = ">=3.12"

{keboola_cli-0.93.2 → keboola_cli-0.94.0}/scripts/check_sentinel_guards.py

@@ -113,7 +113,34 @@ CREDENTIAL_WRITE_ALLOWED = {
 # endpoint-family mixins -- every one of them a class that runs that same
 # `__init__` -- outside the check. `KeboolaClient` stays listed because it is the
 # name a reader looks for here; it is already covered as a descendant.
-PROJECT_CREDENTIAL_CLIENTS = {"_CoreClient", "KeboolaClient"}
+#
+# CLI-13: the five service clients below reach their backend over a bearer and
+# dropped `SESSION_AUTH_FEATURE`, so the `http_base.py` runtime guard no longer
+# stops a direct construction from a `kbc-session://` `project.token`. They are
+# built only by `make_session_aware_client_factory` (sentinel-aware); listing
+# them here makes Check 4 guard every OTHER construction site, restoring the net
+# their dropped guard removed.
+PROJECT_CREDENTIAL_CLIENTS = {
+    "_CoreClient",
+    "KeboolaClient",
+    "SchedulerClient",
+    "StreamClient",
+    "DataScienceClient",
+    "MetastoreClient",
+    "AiServiceClient",
+}
+
+# Check 4 exemptions keyed `<file>::<enclosing function>`, each with a reason --
+# a construction that is provably safe even though its own scope is not
+# sentinel-aware. Mirrors `CREDENTIAL_WRITE_ALLOWED` for Check 1.
+PROJECT_CLIENT_CONSTRUCTION_ALLOWED = {
+    "client/stream.py::_get_stream_client": (
+        "built from the parent client's already-resolved (token, http_auth): a "
+        "session parent carries token='' + a BearerAuth hook, a static parent a "
+        "real token + no hook, so a raw sentinel can never reach it "
+        "(test_http_base_auth.py::test_stream_sub_client_inherits_the_bearer_hook)"
+    ),
+}
 
 # Check 2: clients that reach Storage or Manage over bearer, or authenticate
 # with an identity of their own, and so must NOT be guarded. Anything else must
@@ -123,6 +150,13 @@ BEARER_CAPABLE_CLIENTS = {
     "ManageClient",  # Manage: the supported bearer path
     "AuthClient",  # talks to the auth service itself, token=""
     "DeveloperPortalClient",  # own username/password identity, never a project token
+    # CLI-13: these reach their backend over a bearer via
+    # make_session_aware_client_factory; the backends accept OAuth tokens.
+    "SchedulerClient",
+    "StreamClient",
+    "DataScienceClient",
+    "MetastoreClient",
+    "AiServiceClient",
 }
 
 # Check 3: guards that describe no user-reachable command surface.
@@ -133,15 +167,9 @@ FEATURE_EXEMPT_GUARDS = {
 # Guard wording -> the substring of the user-facing entry that covers it, so
 # both can read naturally without being byte-identical.
 FEATURE_ALIASES = {
-    "The Keboola AI Service": "AI Service",
-    "The Scheduler Service": "Scheduler Service",
-    "The Metastore Service (semantic layer)": "Metastore Service",
     "semantic-layer token --encrypt": "Metastore Service",
-    "The Data Science Service (data apps)": "Data Science Service",
-    "The Data Streams Service": "Data Streams Service",
     "The importable SDK Client": "importable SDK",
     "kbagent kai": "kbagent kai",
-    "kbagent sharing (master-token path)": "kbagent sharing",
 }
 
 
@@ -390,6 +418,7 @@ def _unguarded_project_clients(root: Path = SRC_ROOT) -> list[str]:
     # same finding under a different name.
     credential_clients = _descendants_of(root, set(PROJECT_CREDENTIAL_CLIENTS))
     for path in _py_files(root):
+        rel = _rel(path, root)
         source = path.read_text(encoding="utf-8")
         tree = ast.parse(source)
         parents = _parent_map(tree)
@@ -408,7 +437,9 @@ def _unguarded_project_clients(root: Path = SRC_ROOT) -> list[str]:
             if _scope_is_sentinel_aware(node, parents, source):
                 continue
             scope = _enclosing_function_name(node, parents)
-            offenders.append(f"{_rel(path, root)}:{node.lineno} (in {scope})")
+            if f"{rel}::{scope}" in PROJECT_CLIENT_CONSTRUCTION_ALLOWED:
+                continue
+            offenders.append(f"{rel}:{node.lineno} (in {scope})")
     return offenders
 
 

{keboola_cli-0.93.2 → keboola_cli-0.94.0}/src/keboola_agent_cli/ai_client.py

@@ -12,6 +12,8 @@ import logging
 from typing import Any, Self
 from urllib.parse import quote
 
+import httpx
+
 from .constants import AI_SERVICE_TIMEOUT
 from .http_base import BaseHttpClient
 
@@ -28,19 +30,18 @@ class AiServiceClient(BaseHttpClient):
     Inherits _do_request() and _raise_api_error() from BaseHttpClient.
     """
 
-    SESSION_AUTH_FEATURE = "The Keboola AI Service"
-
-    def __init__(self, stack_url: str, token: str) -> None:
+    def __init__(self, stack_url: str, token: str, *, http_auth: httpx.Auth | None = None) -> None:
         self._stack_url = stack_url.rstrip("/")
         ai_base_url = self._derive_service_url(self._stack_url, "ai")
-        headers = {
-            "X-StorageApi-Token": token,
-        }
+        headers: dict[str, str] = {}
+        if http_auth is None:
+            headers["X-StorageApi-Token"] = token
         super().__init__(
             base_url=ai_base_url,
             token=token,
             headers=headers,
             timeout=AI_SERVICE_TIMEOUT,
+            http_auth=http_auth,
         )
 
     def __enter__(self) -> Self:

{keboola_cli-0.93.2 → keboola_cli-0.94.0}/src/keboola_agent_cli/auth/token_provider.py

@@ -461,15 +461,27 @@ class BearerAuth(httpx.Auth):
     `(stack_url, token) -> KeboolaClient` factory call sites.
     """
 
-    def __init__(self, provider: TokenProvider, project_id: int | None = None) -> None:
+    def __init__(
+        self,
+        provider: TokenProvider,
+        project_id: int | None = None,
+        *,
+        refresh_on_401: bool = True,
+    ) -> None:
         self._provider = provider
         self._project_id = project_id
+        self._refresh_on_401 = refresh_on_401
 
     def auth_flow(self, request: httpx.Request) -> Generator[httpx.Request, httpx.Response, None]:
         token = self._provider.get_access_token()
         self._stamp(request, token)
         response = yield request
-        if response.status_code == 401:
+        # A 401 normally means the access token expired mid-flight, so refresh
+        # once and retry. `refresh_on_401=False` opts a client out: the metastore
+        # answers a VALID non-master token with 401 (its master-token gate), and a
+        # refresh cannot fix that -- retrying only burns a refresh-token rotation
+        # and can mask MISSING_MASTER_TOKEN behind a bogus SESSION_EXPIRED.
+        if response.status_code == 401 and self._refresh_on_401:
             token = self._provider.force_refresh(token)
             self._stamp(request, token)
             yield request

{keboola_cli-0.93.2 → keboola_cli-0.94.0}/src/keboola_agent_cli/changelog.py

@@ -24,6 +24,36 @@ from .constants import CHANGELOG_HEADLINE_MAX_CHARS
 
 # Ordered newest-first.  Each value is a list of brief one-line descriptions.
 CHANGELOG: dict[str, list[str]] = {
+    "0.94.0": [
+        "New (#759): a browser-login session (`auth login`) now works with nearly every command, "
+        "not just the Storage and Manage paths (CLI-13). It reaches the Scheduler (`flow schedule` / "
+        "`flow schedule-remove`), Data Streams (`stream`), Data Science (`data-app`), the full "
+        "`semantic-layer` group, the AI Service (`docs query`, `config new` / `examples`, "
+        "`component detail`, `flow new` / `update` / `validate`), and Storage bucket `sharing`. Only "
+        "three features still need a static Storage token and fail fast with "
+        "`AUTH_NOT_SUPPORTED_ON_STACK`: `kai`, `semantic-layer token --encrypt`, and the importable "
+        "SDK (`keboola_agent_cli.Client`). `auth login` and `auth register-projects` print the list "
+        "and ship it in `--json` as `session_unsupported_features`.",
+        "New (#736): a `merge-request` command group (hidden alias `mr`) drives the Branches 2.0 "
+        "merge lifecycle (DMD-1900). It covers create, request-review, approve, auto-merge, merge, "
+        "and conflict resolution (`diff` / `resolve`), on a project with the `branches-merge-requests` "
+        "feature. Each command targets the merge request of the active branch by default, or "
+        "`--merge-request-id N` / `--branch B` to pick one. Commands that move an MR toward production "
+        "(`merge`, `request-review`, `approve`, `resolve`, `auto-merge`) are destructive for "
+        "`--deny-destructive`. `create` / `update` / `request-changes` are writes. `branch merge` is "
+        "now deprecated -- it only built a UI URL and never merged through the API.",
+        "Fix (#752): `sync pull` and `sync clone` no longer strip a data app's runtime type when the "
+        "Data Science list omits it (CLI-8). The type (`python-js` / `streamlit` / ...) lives only on "
+        "the Data Science API, so a cloned or re-pulled app keeps the type it deploys with.",
+        "Fix (#753): `sync pull` and `sync clone` now keep each config's UI folder "
+        "(`KBC.configuration.folderName`) (CLI-9). Before, both silently dropped it and every config "
+        "landed in the tree root, with nothing warning about it.",
+        "Note (#764, #729, #730, #733, #734, #750, #751): housekeeping with no user-facing change. "
+        "#764 shares one session-aware default Data Science client factory between the sync and "
+        "data-app services. It corrects an import that the #752 and #759 combination broke on `main` "
+        "before any release. The rest are web UI and backend dependency bumps (fastify, fast-uri, "
+        "vitest, browserslist, postcss-selector-parser).",
+    ],
     "0.93.2": [
         "New (#757): each usage event now also carries the kbagent version and an agent-vs-human "
         "marker for the telemetry team (CLI-12). `params.cliContext` holds the User-Agent "

{keboola_cli-0.93.2 → keboola_cli-0.94.0}/src/keboola_agent_cli/cli.py

@@ -28,6 +28,7 @@ from .commands.init import init_command
 from .commands.job import job_app
 from .commands.kai import kai_app
 from .commands.lineage import lineage_app
+from .commands.merge_request import merge_request_app
 from .commands.notification import notification_app
 from .commands.org import org_app
 from .commands.permissions import permissions_app
@@ -73,6 +74,7 @@ from .services.job_service import JobService
 from .services.kai_service import KaiService
 from .services.lineage_service import LineageService
 from .services.member_service import MemberService
+from .services.merge_request_service import MergeRequestService
 from .services.notification_service import NotificationService
 from .services.org_service import OrgService
 from .services.project_service import ProjectService
@@ -150,6 +152,8 @@ app.add_typer(notification_app, name="notification", rich_help_panel=_FLOWS)
 # -- Development --
 _DEV = "Development"
 app.add_typer(branch_app, name="branch", rich_help_panel=_DEV)
+app.add_typer(merge_request_app, name="merge-request", rich_help_panel=_DEV)
+app.add_typer(merge_request_app, name="mr", rich_help_panel=_DEV, hidden=True)
 app.add_typer(workspace_app, name="workspace", rich_help_panel=_DEV)
 app.add_typer(sync_app, name="sync", rich_help_panel=_DEV)
 app.add_typer(encrypt_app, name="encrypt", rich_help_panel=_DEV)
@@ -310,6 +314,7 @@ def main(
     member_service = MemberService(config_store=config_store)
     feature_service = FeatureService(config_store=config_store)
     branch_service = BranchService(config_store=config_store)
+    merge_request_service = MergeRequestService(config_store=config_store)
     sharing_service = SharingService(config_store=config_store)
     search_service = SearchService(config_store=config_store)
     snapshot_service = SnapshotService(config_store=config_store)
@@ -370,6 +375,7 @@ def main(
     ctx.obj["member_service"] = member_service
     ctx.obj["feature_service"] = feature_service
     ctx.obj["branch_service"] = branch_service
+    ctx.obj["merge_request_service"] = merge_request_service
     ctx.obj["sharing_service"] = sharing_service
     ctx.obj["search_service"] = search_service
     ctx.obj["snapshot_service"] = snapshot_service

{keboola_cli-0.93.2 → keboola_cli-0.94.0}/src/keboola_agent_cli/commands/_helpers.py

@@ -8,9 +8,11 @@ Provides common patterns used by all CLI commands:
 """
 
 import getpass
+import json
 import os
 import secrets
 import sys
+from pathlib import Path
 from typing import Any
 
 import typer
@@ -74,6 +76,36 @@ def resolve_manage_token(*, allow_env: bool = False) -> str:
     raise typer.Exit(code=2)
 
 
+def parse_json_arg(raw: str, *, label: str) -> Any:
+    """Parse a ``JSON|@file|-`` argument: inline JSON, ``@path``, or ``-`` for stdin.
+
+    The house input contract for structured flags (``config update
+    --configuration``, ``transformation edit --op``, ``merge-request resolve
+    --resolved``). Hoisted from ``transformation.py``'s private copy so the
+    merge-request group did not add another; ``config.py`` still carries an
+    older dict-only variant (``_parse_json_input``) -- folding it in is a
+    follow-up, not this PR.
+
+    Raises:
+        ValueError: On a missing/unreadable file or malformed JSON -- the message
+            names ``label`` (the flag) so the caller can print it at exit 2 as-is.
+    """
+    try:
+        if raw == "-":
+            return json.loads(sys.stdin.read())
+        if raw.startswith("@"):
+            file_path = Path(raw[1:])
+            if not file_path.is_file():
+                raise ValueError(f"{label}: file not found: {file_path}")
+            return json.loads(file_path.read_text(encoding="utf-8"))
+        return json.loads(raw)
+    except json.JSONDecodeError as exc:
+        raise ValueError(f"{label}: invalid JSON: {exc}") from exc
+    except OSError as exc:
+        # a directory, a permission problem -- a usage error, not a crash
+        raise ValueError(f"{label}: cannot read file: {exc}") from exc
+
+
 def read_password_stdin() -> str:
     """Read a password from stdin.