lager-cli 0.32.4__tar.gz → 0.32.5__tar.gz

{lager_cli-0.32.4/lager_cli.egg-info → lager_cli-0.32.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: lager-cli
-Version: 0.32.4
+Version: 0.32.5
 Summary: Lager CLI - Box and Docker connectivity
 Home-page: https://github.com/lagerdata/lager
 Author: Lager Data

{lager_cli-0.32.4 → lager_cli-0.32.5}/__init__.py

@@ -7,4 +7,4 @@ Lager CLI
 A Command Line Interface for Lager Data
 """
 
-__version__ = '0.32.4'
+__version__ = '0.32.5'

{lager_cli-0.32.4 → lager_cli-0.32.5}/battery/websocket_client.py

@@ -132,19 +132,36 @@ class BatteryWebSocketClient:
         Returns:
             True if connected successfully, False otherwise
         """
-        try:
-            from ..gateway_auth import auth_headers_for_url
-            self.sio.connect(
-                self.box_url,
-                namespaces=['/battery'],
-                wait_timeout=timeout,
-                headers=auth_headers_for_url(self.box_url)
-            )
-            return True
-        except Exception as e:
-            if self.on_error:
-                self.on_error(f"Could not connect to box at {self.box_url}: {str(e)}")
-            return False
+        from ..gateway_auth import (
+            auth_headers_for_url, plain_error_text, ws_handshake_recovery,
+        )
+        headers = auth_headers_for_url(self.box_url)
+        for attempt in (0, 1):
+            try:
+                self.sio.connect(
+                    self.box_url,
+                    namespaces=['/battery'],
+                    wait_timeout=timeout,
+                    headers=headers
+                )
+                return True
+            except Exception as e:
+                # The handshake exception hides the HTTP response, so probe
+                # the box over HTTP: a gated box's first contact records the
+                # mapping and hands back the token for one retry; a genuine
+                # denial becomes the actionable message.
+                retry_headers, denial = ws_handshake_recovery(self.box_url, headers)
+                if denial is not None:
+                    if self.on_error:
+                        self.on_error(plain_error_text(denial))
+                    return False
+                if attempt == 0 and retry_headers:
+                    headers = retry_headers
+                    continue
+                if self.on_error:
+                    self.on_error(f"Could not connect to box at {self.box_url}: {str(e)}")
+                return False
+        return False
 
     def start_monitoring(self) -> bool:
         """

{lager_cli-0.32.4 → lager_cli-0.32.5}/box_storage.py

@@ -583,43 +583,49 @@ def _gateway_kwargs(ip):
 
 def _resend_with_auth(prepared, headers):
     """Re-send an already-prepared request with extra headers merged in.
-    Returns the new response, or None if the resend itself failed."""
+    Returns the new response, or None if the resend itself failed.
+
+    Sent with ``stream=True`` so callers that stream the original request
+    (pip/python output) keep streaming on the retried response; non-streaming
+    callers read ``.json()``/``.text`` which consumes it identically."""
     import requests
     req = prepared.copy()
     for key, value in headers.items():
         req.headers[key] = value
     try:
-        return requests.Session().send(req, timeout=30, stream=False)
+        return requests.Session().send(req, timeout=30, stream=True)
     except requests.RequestException:
         return None
 
 
-def _check_gateway(resp, ip):
-    """Resolve a gateway response, returning the response the caller should use.
-
-    On a plain (un-gated) box this is a passthrough. On a gated box:
+def _resolve_gateway(resp, ip):
+    """Record-and-retry core shared by :func:`_check_gateway` and
+    :func:`check_gateway_status` — the single implementation of gateway
+    discovery. Returns ``(resp, denied)``:
 
+    - Non-gateway responses (no discovery header) pass through untouched
+      with ``denied=False`` — plain boxes are never affected.
     - First contact — we sent no token (the box→auth-server link is only
       learned from this very 401's discovery header) but we already hold a
       session for that server: record the mapping, attach the token, and
-      retry the request once. The caller gets the authenticated response and
-      never sees the round trip. A plain box never receives the token,
-      because only a gateway sends the discovery header.
-    - Genuine denials (revoked session, no access grant, auth server down)
-      raise the actionable `lager login` / "ask your admin" error as before.
-
-    Callers should adopt the return value: ``resp = _check_gateway(resp, ip)``.
+      retry the request once. On success the retried, authenticated response
+      is returned with ``denied=False``. A plain box never receives the
+      token, because only a gateway sends the discovery header.
+    - Anything else is a genuine denial: the mapping is still recorded (so
+      the next attempt authenticates) and ``denied=True`` tells the caller
+      to handle ``resp`` as a gateway denial.
     """
     from .gateway_auth import (
-        DISCOVERY_HEADER, handle_gateway_denial,
-        record_box_auth_server, auth_headers_for_box,
+        DISCOVERY_HEADER, record_box_auth_server, auth_headers_for_box,
     )
-    if not (resp.status_code in (401, 403, 503) and DISCOVERY_HEADER in resp.headers):
-        return resp
+    # getattr: tolerate response-shaped fakes without a headers attribute.
+    resp_headers = getattr(resp, 'headers', None) or {}
+    if not (resp.status_code in (401, 403, 503) and DISCOVERY_HEADER in resp_headers):
+        return resp, False
 
+    record_box_auth_server(ip, resp_headers[DISCOVERY_HEADER])
     sent_auth = 'Authorization' in getattr(resp.request, 'headers', {})
     if resp.status_code == 401 and not sent_auth:
-        record_box_auth_server(ip, resp.headers[DISCOVERY_HEADER])
         headers = auth_headers_for_box(ip)
         if headers:
             retried = _resend_with_auth(resp.request, headers)
@@ -627,13 +633,47 @@ def _check_gateway(resp, ip):
                 gated = (retried.status_code in (401, 403, 503)
                          and DISCOVERY_HEADER in retried.headers)
                 if not gated:
-                    return retried      # transparently authenticated
-                resp = retried          # still refused — report on the retry
+                    return retried, False   # transparently authenticated
+                resp = retried              # still refused — report on the retry
+
+    return resp, True
+
+
+def _check_gateway(resp, ip):
+    """Resolve a gateway response, returning the response the caller should use.
+
+    On a plain (un-gated) box this is a passthrough. On a gated box the
+    first contact is retried transparently (see :func:`_resolve_gateway`);
+    genuine denials (revoked session, no access grant, auth server down)
+    raise the actionable `lager login` / "ask your admin" error as before.
 
-    handle_gateway_denial(resp, ip)     # raises the actionable error
+    Callers should adopt the return value: ``resp = _check_gateway(resp, ip)``.
+    """
+    from .gateway_auth import handle_gateway_denial
+    resp, denied = _resolve_gateway(resp, ip)
+    if denied:
+        handle_gateway_denial(resp, ip)     # raises the actionable error
     return resp
 
 
+def check_gateway_status(resp, ip):
+    """Non-raising variant of :func:`_check_gateway` for fan-out and
+    fail-open callers (`lager boxes`, health polls) that must not abort on a
+    single box's denial.
+
+    Performs the same record-and-retry as ``_check_gateway``. Returns
+    ``(resp, label)``: ``label`` is None when the caller should simply use
+    ``resp`` (plain box, or the retry authenticated transparently), else a
+    short user-facing verdict — 'sign-in required', 'session rejected',
+    'no access', or 'auth server down'.
+    """
+    from .gateway_auth import denial_label
+    resp, denied = _resolve_gateway(resp, ip)
+    if not denied:
+        return resp, None
+    return resp, denial_label(resp)
+
+
 def _lock_url(ip, suffix=''):
     # Lock state is shared box-wide; both the :5000 and :9000 servers expose
     # it via lager.lock_state. The CLI talks to :9000 (the primary HTTP API).
@@ -807,6 +847,9 @@ def release_box_lock(ip, holder, *, quiet=True):
             )
         return False
 
+    # Non-raising gateway check (this function promises never to raise);
+    # a denial falls through to the failure warning below.
+    resp, _gate_verdict = check_gateway_status(resp, ip)
     if resp.status_code == 200:
         return True
     if not quiet:
@@ -848,6 +891,9 @@ def heartbeat_box_lock(ip, holder, *, quiet=True):
                 fg='yellow', err=True,
             )
         return False
+    # Non-raising gateway check; a denial reads as a failed heartbeat, which
+    # callers already treat as "carry on" (server TTL is authoritative).
+    resp, _gate_verdict = check_gateway_status(resp, ip)
     return resp.status_code == 200
 
 

{lager_cli-0.32.4 → lager_cli-0.32.5}/commands/box/boxes.py

@@ -47,6 +47,7 @@ def _list_boxes_live(port=9000, timeout=5):
 
     results = []
     failed_count = 0
+    auth_failed_count = 0
     needs_update_count = 0
     newer_count = 0
 
@@ -67,8 +68,14 @@ def _list_boxes_live(port=9000, timeout=5):
         busy_info = ''
         try:
             from ...gateway_auth import auth_headers_for_box
+            from ...box_storage import check_gateway_status
             lock_resp = requests.get(f'http://{ip}:{port}/lock', timeout=3,
                                      headers={'Cache-Control': 'no-cache', **auth_headers_for_box(ip)})
+            # Non-raising gateway check: one gated box must not abort the
+            # whole table. On first contact this records the box→auth-server
+            # mapping and retries with the stored token, so the /status call
+            # below authenticates normally (no second round trip).
+            lock_resp, _ = check_gateway_status(lock_resp, ip)
             if lock_resp.status_code == 200:
                 lock_data = lock_resp.json()
                 if lock_data.get('locked'):
@@ -81,12 +88,18 @@ def _list_boxes_live(port=9000, timeout=5):
             # It predates the newer capability fields, so even older box images
             # answer it — unlike a brand-new endpoint would.
             from ...gateway_auth import auth_headers_for_box
+            from ...box_storage import check_gateway_status
             url = f'http://{ip}:{port}/status'
             headers = {'Cache-Control': 'no-cache', 'Pragma': 'no-cache',
                        **auth_headers_for_box(ip)}
             response = requests.get(url, timeout=timeout, headers=headers)
+            response, gate_verdict = check_gateway_status(response, ip)
 
-            if response.status_code == 200:
+            if gate_verdict:
+                results.append((name, ip, user, '-', gate_verdict, locked_by, busy_info))
+                auth_failed_count += 1
+
+            elif response.status_code == 200:
                 try:
                     data = response.json()
                     box_version = data.get('version') or data.get('box_version')
@@ -205,6 +218,18 @@ def _list_boxes_live(port=9000, timeout=5):
     if failed_count > 0:
         box_word = 'box' if failed_count == 1 else 'boxes'
         click.secho(f'{failed_count} {box_word} could not be reached', fg='red')
+    if auth_failed_count > 0:
+        from ...gateway_auth import auth_server_for_box
+        box_word = 'box needs' if auth_failed_count == 1 else 'boxes need'
+        click.secho(f'{auth_failed_count} {box_word} sign-in or an access grant', fg='red')
+        # The denial recorded each box's auth server, so we can say exactly
+        # where to sign in. Usually one server covers the whole fleet.
+        signin_urls = sorted({
+            url for r in results if r[4] in ('sign-in required', 'session rejected')
+            for url in [auth_server_for_box(r[1])] if url
+        })
+        for url in signin_urls:
+            click.secho(f'  Sign in with: lager login {url}', fg='red')
 
     root_locked = [r[0] for r in results if r[5] == 'root']
     if root_locked:

{lager_cli-0.32.4 → lager_cli-0.32.5}/commands/box/config.py

@@ -1627,8 +1627,15 @@ def _box_api_responding(box_ip: str, *, timeout: float = 2.0) -> bool:
     poll cheaply."""
     try:
         from ...gateway_auth import auth_headers_for_box
+        from ...box_storage import check_gateway_status
         r = requests.get(f"http://{box_ip}:{_BOX_API_PORT}/hello", timeout=timeout,
                          headers=auth_headers_for_box(box_ip))
+        # Non-raising gateway check: first contact with a gated box records
+        # the mapping and retries with the stored token so the probe sees the
+        # real /hello. A genuine denial reads as not-responding (False) —
+        # this probe sits inside the apply/restart poll loop, which must not
+        # abort mid-restart; the flow's own requests surface auth errors.
+        r, _gate_verdict = check_gateway_status(r, box_ip)
         return r.status_code == 200
     except Exception:
         return False

{lager_cli-0.32.4 → lager_cli-0.32.5}/commands/box/diagnose.py

@@ -30,6 +30,7 @@ import click
 import requests
 
 from ...box_storage import resolve_and_validate_box_with_name
+from ...errors import LagerError
 
 
 # Net-role choices for --type. Mirrors the role strings produced by
@@ -51,8 +52,10 @@ def _fetch_net_info(
     that — otherwise the returned role wins."""
     try:
         from ...gateway_auth import auth_headers_for_box
+        from ...box_storage import _check_gateway
         r = requests.get(f'http://{box_ip}:9000/nets/list', timeout=5,
                          headers=auth_headers_for_box(box_ip))
+        r = _check_gateway(r, box_ip)
         r.raise_for_status()
         nets = r.json()
         # Older box images wrap the list: {"nets": [...]}. Unwrap so the
@@ -72,6 +75,10 @@ def _fetch_net_info(
             f'Check network/Tailscale connectivity, then `lager hello --box {display_name}`.',
             fg='red'), err=True)
         return None, None
+    except LagerError:
+        # A gateway denial from _check_gateway is already actionable — let it
+        # render as-is rather than collapsing into the generic message below.
+        raise
     except Exception as e:
         click.echo(click.style(f'Could not fetch net list from box: {e}', fg='red'), err=True)
         return None, None

{lager_cli-0.32.4 → lager_cli-0.32.5}/commands/box/lock.py

@@ -35,6 +35,7 @@ def lock(ctx, box, lock_user):
         # lock immune to the new heartbeat-driven auto-reap that ephemeral
         # `lager python` locks participate in.
         from ...gateway_auth import auth_headers_for_box
+        from ...box_storage import _check_gateway
         resp = requests.post(
             f'http://{ip}:9000/lock',
             headers=auth_headers_for_box(ip),
@@ -45,6 +46,7 @@ def lock(ctx, box, lock_user):
             },
             timeout=5,
         )
+        resp = _check_gateway(resp, ip)
     except requests.exceptions.RequestException as e:
         click.secho(f"Error: Could not reach box '{display_name}': {e}", fg='red', err=True)
         ctx.exit(1)
@@ -80,12 +82,17 @@ def unlock(ctx, box, force):
 
     try:
         from ...gateway_auth import auth_headers_for_box
+        from ...box_storage import _check_gateway
         resp = requests.post(
             f'http://{ip}:9000/unlock',
             headers=auth_headers_for_box(ip),
             json={'user': user, 'force': force},
             timeout=5,
         )
+        # Gateway denials raise here with the actionable sign-in error; the
+        # 403 branch below keeps meaning "locked by another user" only (a
+        # plain box's application 403 has no discovery header).
+        resp = _check_gateway(resp, ip)
     except requests.exceptions.RequestException as e:
         click.secho(f"Error: Could not reach box '{display_name}': {e}", fg='red', err=True)
         ctx.exit(1)

{lager_cli-0.32.4 → lager_cli-0.32.5}/commands/communication/uart.py

@@ -100,8 +100,12 @@ def _run_query_instruments(ctx: click.Context, box_ip: str) -> list[dict]:
     """
     try:
         from ...gateway_auth import auth_headers_for_box
+        from ...box_storage import _check_gateway
         resp = requests.get(f'http://{box_ip}:9000/instruments/list', timeout=15,
                             headers=auth_headers_for_box(box_ip))
+        # A gateway denial raises the actionable LagerError (not caught
+        # below): an auth problem must not be reported as "no instruments".
+        resp = _check_gateway(resp, box_ip)
         if resp.status_code == 200:
             data = resp.json()
             if isinstance(data, list):

{lager_cli-0.32.4 → lager_cli-0.32.5}/commands/communication/websocket_client.py

@@ -260,23 +260,37 @@ class UARTWebSocketClient:
             self._setup_terminal()
 
             # Connect to WebSocket
-            try:
-                from ...gateway_auth import auth_headers_for_url
-                self.sio.connect(
-                    self.box_url,
-                    namespaces=['/uart'],
-                    wait_timeout=10,
-                    headers=auth_headers_for_url(self.box_url)
-                )
-            except Exception as e:
-                # Preserve the return-code contract (don't sys.exit / .die here):
-                # the caller relies on the return value and the finally-block
-                # terminal restore below.
-                from ...errors import connection_error
-                from urllib.parse import urlparse
-                host = urlparse(self.box_url).hostname or self.box_url
-                connection_error(e, host=host).show()
-                return 1
+            from ...gateway_auth import auth_headers_for_url, ws_handshake_recovery
+            headers = auth_headers_for_url(self.box_url)
+            for attempt in (0, 1):
+                try:
+                    self.sio.connect(
+                        self.box_url,
+                        namespaces=['/uart'],
+                        wait_timeout=10,
+                        headers=headers
+                    )
+                    break
+                except Exception as e:
+                    # The handshake exception hides the HTTP response, so
+                    # probe the box over HTTP: a gated box's first contact
+                    # records the mapping and hands back the token for one
+                    # retry; a genuine denial shows the actionable error.
+                    # Preserve the return-code contract (don't sys.exit /
+                    # .die here): the caller relies on the return value and
+                    # the finally-block terminal restore below.
+                    retry_headers, denial = ws_handshake_recovery(self.box_url, headers)
+                    if denial is not None:
+                        denial.show()
+                        return 1
+                    if attempt == 0 and retry_headers:
+                        headers = retry_headers
+                        continue
+                    from ...errors import connection_error
+                    from urllib.parse import urlparse
+                    host = urlparse(self.box_url).hostname or self.box_url
+                    connection_error(e, host=host).show()
+                    return 1
 
             # Start UART session
             self.sio.emit('start_uart', {

{lager_cli-0.32.4 → lager_cli-0.32.5}/commands/development/debug/service_client.py

@@ -44,6 +44,17 @@ class DebugServiceClient:
             'User-Agent': 'lager-cli/1.0',
         })
 
+        if not ssh_tunnel:
+            # Direct connection may cross an authenticating gateway: attach
+            # the bearer token when this box is known to be gated, and turn
+            # gateway denials into actionable errors instead of raw 401s.
+            # No-op for plain boxes (the hook only fires on the discovery
+            # header, and no token is sent to an unknown box). Tunneled
+            # connections terminate at 127.0.0.1 and never see the gateway.
+            from ....gateway_auth import auth_headers_for_box, gateway_response_hook
+            self.session.headers.update(auth_headers_for_box(box_host))
+            self.session.hooks['response'] = [gateway_response_hook(box_host)]
+
     def health_check(self) -> Dict[str, Any]:
         """Check if service is healthy."""
         response = self.session.get(f'{self.base_url}/health', timeout=5)

{lager_cli-0.32.4 → lager_cli-0.32.5}/commands/utility/update.py

@@ -74,8 +74,15 @@ def wait_for_box_ready(box_ip, *, timeout_s=60, initial_delay_s=2):
         for port in sorted(pending):
             try:
                 from ...gateway_auth import auth_headers_for_box
+                from ...box_storage import check_gateway_status
                 r = requests.get(f'http://{box_ip}:{port}/health', timeout=3,
                                  headers=auth_headers_for_box(box_ip))
+                # Non-raising gateway check: first contact with a gated box
+                # records the mapping and retries with the stored token so a
+                # healthy gated box reads as ready. A denial reads as
+                # not-ready and falls to the timeout path rather than
+                # aborting the update's readiness poll.
+                r, _gate_verdict = check_gateway_status(r, box_ip)
                 if r.status_code == 200:
                     pending.discard(port)
             except requests.exceptions.RequestException:

{lager_cli-0.32.4 → lager_cli-0.32.5}/context/session.py

@@ -358,8 +358,10 @@ class DirectIPSession:
 
         try:
             from ..gateway_auth import auth_headers_for_box
+            from ..box_storage import _check_gateway
             response = requests.post(url, json=payload, timeout=5,
                                      headers=auth_headers_for_box(self.ip_address))
+            response = _check_gateway(response, self.ip_address)
             return response
         except requests.exceptions.RequestException as e:
             # Return a mock response with error
@@ -479,12 +481,19 @@ class DirectIPSession:
         url = f'http://{self.ip_address}:5001/run/pip'
 
         try:
+            from ..gateway_auth import auth_headers_for_box
+            from ..box_storage import _check_gateway
             response = requests.post(
                 url,
                 json={'args': args},
                 stream=True,
-                timeout=600  # 10 minute timeout for pip operations
+                timeout=600,  # 10 minute timeout for pip operations
+                headers=auth_headers_for_box(self.ip_address),
             )
+            # Gateway discovery/denial handling; on a gated box's first
+            # contact the request is retried with the stored token so the
+            # caller streams the real pip output.
+            response = _check_gateway(response, self.ip_address)
 
             # Check for HTTP errors
             if response.status_code != 200:

{lager_cli-0.32.4 → lager_cli-0.32.5}/core/version_skew.py

@@ -61,8 +61,17 @@ def check_and_warn(box_ip: str, box_name: str | None = None) -> None:
         # it's the same endpoint `lager box hello` uses. 1.5s timeout
         # keeps the latency penalty bounded if the box is briefly slow.
         from ..gateway_auth import auth_headers_for_box
+        from ..box_storage import check_gateway_status
         r = requests.get(f'http://{box_ip}:9000/status', timeout=1.5,
                          headers=auth_headers_for_box(box_ip))
+        # Non-raising gateway check: on first contact with a gated box this
+        # records the mapping and retries with the stored token; a genuine
+        # denial just skips the warning (this module is fail-open — the
+        # command's own request will surface the actionable auth error).
+        r, gate_verdict = check_gateway_status(r, box_ip)
+        if gate_verdict:
+            logger.debug('version-skew check: gateway denied (%s)', gate_verdict)
+            return
         if r.status_code == 404:
             # The :9000 server answered but has no /status route — the box
             # image predates the :9000 API surface this CLI requires. That is

{lager_cli-0.32.4 → lager_cli-0.32.5}/core/ws_diagnose.py

@@ -37,9 +37,26 @@ def make_ws_failure_message(box_ip: str, original_error: str | Exception = '') -
         # /health is a cheap, always-present endpoint on box_http_server
         # (port 9000). 2s timeout matches the worst case of a healthy box
         # under temporary load.
-        from ..gateway_auth import auth_headers_for_box
+        from ..gateway_auth import auth_headers_for_box, auth_server_for_box
+        from ..box_storage import check_gateway_status
         r = requests.get(f'http://{box_ip}:9000/health', timeout=2.0,
                          headers=auth_headers_for_box(box_ip))
+        # Non-raising gateway check (this helper promises never to raise):
+        # first contact with a gated box records the mapping and retries with
+        # the stored token; a genuine denial becomes the actionable message.
+        r, gate_verdict = check_gateway_status(r, box_ip)
+        if gate_verdict:
+            url = auth_server_for_box(box_ip) or 'your auth server'
+            if gate_verdict in ('sign-in required', 'session rejected'):
+                action = f'sign in with `lager login {url}` and retry.'
+            elif gate_verdict == 'no access':
+                action = 'ask an org admin to grant you access to this box.'
+            else:  # auth server down
+                action = 'its auth server is unreachable — try again shortly.'
+            return (
+                f'{base}{detail}.\n'
+                f'Action: the box refused the connection ({gate_verdict}) — {action}'
+            )
         if r.status_code == 200:
             return (
                 f'{base}{detail}.\n'

{lager_cli-0.32.4 → lager_cli-0.32.5}/gateway_auth.py

@@ -359,6 +359,36 @@ def handle_gateway_denial(response, box_ip):
         )
 
 
+def denial_label(response):
+    """Short, render-friendly label for a gateway denial response.
+
+    For fan-out commands (`lager boxes`) that show one row per box and must
+    not abort the whole table on a single gated box. The full actionable
+    message stays in :func:`handle_gateway_denial`; this is the compact
+    verdict a table cell can hold.
+    """
+    if response.status_code == 403:
+        return 'no access'
+    if response.status_code == 503:
+        return 'auth server down'
+    if 'Authorization' in getattr(response.request, 'headers', {}):
+        return 'session rejected'
+    return 'sign-in required'
+
+
+def plain_error_text(err):
+    """A LagerError flattened to one unstyled line.
+
+    For error callbacks that render inside a TUI, where the ANSI codes
+    from ``LagerError.format_message()`` would show up literally.
+    """
+    parts = [err.problem]
+    if err.cause:
+        parts.append(err.cause)
+    parts.extend(err.fixes)
+    return ' '.join(parts)
+
+
 def gateway_response_hook(box_ip):
     """requests response hook that intercepts gateway denials."""
     def hook(response, *_args, **_kwargs):
@@ -374,3 +404,48 @@ def auth_headers_for_url(box_url):
     if not host:
         return {}
     return auth_headers_for_box(host)
+
+
+def ws_handshake_recovery(box_url, sent_headers=None):
+    """After a failed WebSocket/SocketIO handshake, work out whether an
+    authenticating gateway refused it.
+
+    The SocketIO/engineio handshake exception does not expose the HTTP
+    response headers, so the discovery header can't be read from it. Instead,
+    probe ``/health`` on the same host/port carrying the same auth the
+    handshake did; a gateway answers every path identically, so the probe
+    mirrors what the handshake saw. A plain box answers the probe without
+    the discovery header and is left completely untouched.
+
+    Returns ``(headers, error)``:
+      - ``({'Authorization': ...}, None)`` — the box is gated, the mapping is
+        now recorded, and we hold a session the failed handshake didn't
+        carry: retry the handshake once with these headers.
+      - ``({}, LagerError)`` — genuine gateway denial; show the error, don't
+        retry.
+      - ``({}, None)`` — not a gateway problem; the original error stands.
+    """
+    parsed = urlparse(box_url)
+    host = parsed.hostname
+    if not host:
+        return {}, None
+    port = parsed.port or 80
+    probe_headers = dict(sent_headers or {})
+    try:
+        resp = requests.get(f'http://{host}:{port}/health',
+                            headers=probe_headers, timeout=5)
+    except requests.RequestException:
+        return {}, None
+    if not (resp.status_code in (401, 403, 503)
+            and DISCOVERY_HEADER in resp.headers):
+        return {}, None
+    record_box_auth_server(host, resp.headers[DISCOVERY_HEADER])
+    if resp.status_code == 401 and 'Authorization' not in probe_headers:
+        headers = auth_headers_for_box(host)
+        if headers:
+            return headers, None
+    try:
+        handle_gateway_denial(resp, host)
+    except LagerError as err:
+        return {}, err
+    return {}, None

{lager_cli-0.32.4 → lager_cli-0.32.5/lager_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: lager-cli
-Version: 0.32.4
+Version: 0.32.5
 Summary: Lager CLI - Box and Docker connectivity
 Home-page: https://github.com/lagerdata/lager
 Author: Lager Data

{lager_cli-0.32.4 → lager_cli-0.32.5}/lager_cli.egg-info/SOURCES.txt

@@ -373,6 +373,7 @@ terminal/ui/themes.py
 tests/test_box_lager_imports.py
 tests/test_box_storage.py
 tests/test_gateway_auth.py
+tests/test_gateway_callsites.py
 tests/test_io_imports.py
 tests/test_update_gate.py
 vendor/__init__.py

{lager_cli-0.32.4 → lager_cli-0.32.5}/status.py

@@ -19,6 +19,14 @@ import threading
 import sys
 import os
 import select
+
+# BaseExceptionGroup is a builtin only from 3.11. setup.py declares
+# python_requires=">=3.10", and the nursery below catches it -- on 3.10 that
+# except clause raises NameError and masks the real exception. trio pulls in
+# the `exceptiongroup` backport on <3.11, so it is always importable here.
+if sys.version_info < (3, 11):  # pragma: no cover - version-dependent
+    from exceptiongroup import BaseExceptionGroup
+
 from functools import partial
 from bson import decode as bson_loads
 import click