keystone-cli 0.1.9__tar.gz → 0.1.10__tar.gz

{keystone_cli-0.1.9 → keystone_cli-0.1.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: keystone-cli
-Version: 0.1.9
+Version: 0.1.10
 Summary: Keystone pro-code agent CLI — author, validate, and run agents locally, then deploy and invoke them on the Keystone platform.
 Requires-Python: >=3.12
 Requires-Dist: keystone-agent-sdk<0.4,>=0.3

{keystone_cli-0.1.9 → keystone_cli-0.1.10}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "keystone-cli"
-version = "0.1.9"
+version = "0.1.10"
 description = "Keystone pro-code agent CLI — author, validate, and run agents locally, then deploy and invoke them on the Keystone platform."
 requires-python = ">=3.12"
 dependencies = [
@@ -45,7 +45,7 @@ where = ["src"]
 keystone_cli = ["templates/*/*.tmpl", "templates/*/pkg/*.tmpl"]
 
 [tool.ruff]
-target-version = "py312"
+target-version = "0.1.10"
 line-length = 120
 
 [tool.ruff.lint]

{keystone_cli-0.1.9 → keystone_cli-0.1.10}/src/keystone_cli/commands/agent.py

@@ -1287,6 +1287,12 @@ def _warm_up_until_ready(gw_base: str, headers: dict[str, str], agent: str, *, t
     ``502 GW_UPSTREAM_UNAVAILABLE`` past the deadline means it never came up (most often a boot crash
     — CrashLoopBackOff / CreateContainerError). Exits 1 with the reason on timeout."""
     url = f"{gw_base}/api/agent-service/v1/agents/{agent}/runs"
+    # The gateway requires X-Correlation-ID on every proxied request (agent-gateway identity.py); the
+    # edge injects X-Entity-ID/X-User-ID from the JWT but NOT the correlation id — the caller sets it,
+    # like every other data-plane call (invoke / runs). Reusing the publish headers alone omitted it,
+    # so the probe got 400 GW_MISSING_CORRELATION_ID, which the loop below mistook for "still warming"
+    # and waited out to the deadline → a false "did not become Running".
+    headers = {**headers, "X-Correlation-ID": str(uuid.uuid4())}
     deadline = time.monotonic() + timeout_s
     progress = _BuildProgress(sys.stdout.isatty(), label="Warming up ", noun="warm")
     last = "starting"
@@ -1311,7 +1317,20 @@ def _warm_up_until_ready(gw_base: str, headers: dict[str, str], agent: str, *, t
                 last = "upstream unavailable"
                 progress.tick("upstream unavailable")
                 time.sleep(5)
-            else:  # e.g. route not learned yet right after publish — keep waiting briefly
+            elif resp.status_code == 400:
+                # A rejected request (missing / invalid header) never turns into a 200 by waiting —
+                # fail fast and name it, so it is not mistaken for a boot crash or silently waited out.
+                progress.close()
+                typer.secho(f"✗ warm-up probe rejected: HTTP 400 {resp.text[:200]}", fg=typer.colors.RED)
+                typer.secho(
+                    "  This is a gateway request-validation error, not a pod boot failure — the "
+                    "published version is likely serving. Verify with `keystone agent status` / "
+                    "`keystone agent invoke`; if it persists, the agent-service edge is dropping an "
+                    "identity header.",
+                    fg=typer.colors.RED,
+                )
+                raise typer.Exit(1)
+            else:  # e.g. 404 route not learned yet / 403 authz still propagating — keep waiting briefly
                 last = f"HTTP {resp.status_code}"
                 progress.tick(last)
                 time.sleep(5)

{keystone_cli-0.1.9 → keystone_cli-0.1.10}/src/keystone_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: keystone-cli
-Version: 0.1.9
+Version: 0.1.10
 Summary: Keystone pro-code agent CLI — author, validate, and run agents locally, then deploy and invoke them on the Keystone platform.
 Requires-Python: >=3.12
 Requires-Dist: keystone-agent-sdk<0.4,>=0.3

{keystone_cli-0.1.9 → keystone_cli-0.1.10}/tests/test_deploy.py

@@ -237,6 +237,44 @@ def test_deploy_publish_wait_fails_when_pod_never_ready(monkeypatch, project) ->
     assert "crashes at startup" in result.output  # points the dev at the likely cause
 
 
+def test_deploy_publish_wait_sends_correlation_id_and_fails_fast_on_400(monkeypatch, project) -> None:
+    # The warm-up probe MUST send X-Correlation-ID (the gateway requires it and the edge does not
+    # inject it — Kong only projects entity/user from the JWT). And a 400 must fail FAST with a
+    # request-validation message, not be mistaken for "still warming" and waited out to the deadline.
+    monkeypatch.setattr("keystone_cli.commands.agent.df.get_access_token", lambda *_a, **_k: "tok")
+    monkeypatch.setattr("keystone_cli.commands.agent.time.sleep", lambda *_a: None)
+
+    seen: dict[str, str | None] = {"corr": None}
+
+    def handler(req: httpx.Request) -> httpx.Response:
+        p = req.url.path
+        if p == "/api/agent-hub/v1/bundles":
+            return httpx.Response(202, json={"version_id": "v1id", "version": "v1", "status": "building"})
+        if p == "/api/agent-hub/v1/agents":
+            return httpx.Response(200, json={"data": [{"id": "a1", "name": "rag-qa"}], "meta": {}})
+        if p == "/api/agent-hub/v1/agents/a1/versions/v1id":
+            return httpx.Response(200, json={"data": {"id": "v1id", "version": "v1", "status": "staged"}})
+        if p.endswith("/v1id/publish"):
+            return httpx.Response(200, json={"data": {"version": "v1", "status": "live"}})
+        if p == "/api/agent-service/v1/agents/rag-qa/runs":
+            seen["corr"] = req.headers.get("x-correlation-id")
+            return httpx.Response(
+                400, json={"error": {"code": "GW_MISSING_ENTITY", "message": "missing required header x-entity-id"}}
+            )
+        return httpx.Response(404, text=p)
+
+    _mock_httpx(monkeypatch, handler)
+    result = runner.invoke(
+        app,
+        ["agent", "deploy", str(project), "--api-base", "https://api", "--workspace-id", WS, "--publish", "--wait"],
+    )
+    assert result.exit_code == 1, result.output
+    assert seen["corr"], "warm-up probe must send X-Correlation-ID"
+    assert "warm-up probe rejected" in result.output
+    assert "not a pod boot failure" in result.output
+    assert "did not become Running" not in result.output  # a 400 is not the boot-crash timeout path
+
+
 def test_deploy_wait_without_publish_is_a_noop(monkeypatch, project) -> None:
     monkeypatch.setattr("keystone_cli.commands.agent.df.get_access_token", lambda *_a, **_k: "tok")
     called: dict[str, bool] = {"warmed": False}