maxc-cli 0.9.3__tar.gz → 0.9.5__tar.gz

{maxc_cli-0.9.3 → maxc_cli-0.9.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maxc-cli
-Version: 0.9.3
+Version: 0.9.5
 Summary: Agent-native MaxCompute CLI for external coding agents
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.9
@@ -195,6 +195,18 @@ aliyun maxc agent skill --json                                # Skill 路径、
 maxc meta describe my_table --json
 ```
 
+### 客户端结果脱敏
+
+从 0.9.5 起，CLI 默认保留服务端返回的值。若要让 CLI 按敏感列名（例如
+`email`、`phone`）额外遮盖结果，可在 `~/.maxc/config.yaml` 中设置：
+
+```yaml
+masking:
+  enabled: true
+```
+
+MaxCompute 服务端脱敏仍按项目策略执行。
+
 ### safety 块
 
 `query` 和 `job` 命令的 `data` 中包含 `safety` 字段，描述安全策略决策：
@@ -304,7 +316,7 @@ To return to local signing, explicitly run the appropriate `auth login` command.
 ## Versioned semantic packages
 
 `maxc semantic` manages remote Catalog packages using the current connection.
-Specify the verified main-account ID with `--namespace`. Available operations:
+The namespace is auto-discovered from verified authenticated account identity when possible; otherwise pass an independently verified main-account ID with `--namespace`. Available operations:
 `list`, `get`, `revisions`, `export`, `create`, `diff`, `apply`, `publish`, `delete`.
 `meta semantic` continues to manage local annotations.
 
@@ -324,6 +336,7 @@ write must be reconciled before retrying. Publication checks are not SQL or
 business validation. History lists the latest 20 summaries, and an immutable
 revision read does not guarantee historical DataBridge analysis.
 
+
 ### Task metrics and worker logs
 
 ```bash
@@ -338,3 +351,13 @@ Task detail preserves the service payload (including `mapReduce.jsonSummary`).
 Select `log_id` from `data.workers`; logs are returned as `data.content` in the JSON
 envelope. The requested size defaults to 1 MiB and must be positive; returned logs
 may be partial. Use `--project` to select the owning project explicitly.
+
+Source-specific dbt semantic conversion is maintained by dbt-maxcompute (`dbt run-operation dbt_maxcompute.export_semantic_package`). maxc supplies generic package management and `meta describe --metadata-only` for live schema inspection.
+
+## 语义包试用版
+
+```bash
+python -m pip install 'maxc-cli==0.9.5b1'
+```
+
+0.9.5b1 支持从可信账号身份解析 namespace，兼容旧版 PyODPS 返回的 Catalog 域名，并提供 `meta describe --metadata-only`。参见[语义包中文指南](docs/semantic-packages.zh-CN.md)。dbt 转换使用适配器自带的 `dbt run-operation dbt_maxcompute.export_semantic_package` 宏。

{maxc_cli-0.9.3 → maxc_cli-0.9.5}/README.md

@@ -173,6 +173,18 @@ aliyun maxc agent skill --json                                # Skill 路径、
 maxc meta describe my_table --json
 ```
 
+### 客户端结果脱敏
+
+从 0.9.5 起，CLI 默认保留服务端返回的值。若要让 CLI 按敏感列名（例如
+`email`、`phone`）额外遮盖结果，可在 `~/.maxc/config.yaml` 中设置：
+
+```yaml
+masking:
+  enabled: true
+```
+
+MaxCompute 服务端脱敏仍按项目策略执行。
+
 ### safety 块
 
 `query` 和 `job` 命令的 `data` 中包含 `safety` 字段，描述安全策略决策：
@@ -282,7 +294,7 @@ To return to local signing, explicitly run the appropriate `auth login` command.
 ## Versioned semantic packages
 
 `maxc semantic` manages remote Catalog packages using the current connection.
-Specify the verified main-account ID with `--namespace`. Available operations:
+The namespace is auto-discovered from verified authenticated account identity when possible; otherwise pass an independently verified main-account ID with `--namespace`. Available operations:
 `list`, `get`, `revisions`, `export`, `create`, `diff`, `apply`, `publish`, `delete`.
 `meta semantic` continues to manage local annotations.
 
@@ -302,6 +314,7 @@ write must be reconciled before retrying. Publication checks are not SQL or
 business validation. History lists the latest 20 summaries, and an immutable
 revision read does not guarantee historical DataBridge analysis.
 
+
 ### Task metrics and worker logs
 
 ```bash
@@ -316,3 +329,13 @@ Task detail preserves the service payload (including `mapReduce.jsonSummary`).
 Select `log_id` from `data.workers`; logs are returned as `data.content` in the JSON
 envelope. The requested size defaults to 1 MiB and must be positive; returned logs
 may be partial. Use `--project` to select the owning project explicitly.
+
+Source-specific dbt semantic conversion is maintained by dbt-maxcompute (`dbt run-operation dbt_maxcompute.export_semantic_package`). maxc supplies generic package management and `meta describe --metadata-only` for live schema inspection.
+
+## 语义包试用版
+
+```bash
+python -m pip install 'maxc-cli==0.9.5b1'
+```
+
+0.9.5b1 支持从可信账号身份解析 namespace，兼容旧版 PyODPS 返回的 Catalog 域名，并提供 `meta describe --metadata-only`。参见[语义包中文指南](docs/semantic-packages.zh-CN.md)。dbt 转换使用适配器自带的 `dbt run-operation dbt_maxcompute.export_semantic_package` 宏。

{maxc_cli-0.9.3 → maxc_cli-0.9.5}/src/maxc_cli/__init__.py

@@ -2,4 +2,4 @@
 
 __all__ = ["__version__"]
 
-__version__ = "0.9.3"
+__version__ = "0.9.5"

{maxc_cli-0.9.3 → maxc_cli-0.9.5}/src/maxc_cli/app.py

@@ -2412,6 +2412,7 @@ class MaxCApp:
         project: 'str | None' = None,
         *,
         schema: 'str | None' = None,
+        metadata_only: bool = False,
     ) -> 'Envelope':
         started = monotonic()
         (
@@ -2422,6 +2423,23 @@ class MaxCApp:
             qualified_name,
         ) = self._resolve_table_scope(table_name, project=project, schema=schema)
 
+        if metadata_only:
+            table = self.backend.describe_table_metadata(
+                target_table, project=target_project, schema=effective_schema,
+            )
+            payload = {
+                "table_name": table.name,
+                "schema_name": effective_schema,
+                "project": target_project,
+                "columns": [{"name": c.name, "type": c.type} for c in table.columns],
+                "partition_columns": [{"name": c.name, "type": c.type} for c in table.partition_columns or []],
+                "has_more_columns": False,
+            }
+            envelope = Envelope(command="meta.describe", status="success", data=payload,
+                                metadata={"source": "live", "metadata_only": True})
+            self.log("meta.describe", envelope.status, envelope.metadata)
+            return envelope
+
         # Try to get from cache first
         cached_table = self.cache.get_cached_table(
             target_project,
@@ -2931,14 +2949,14 @@ class MaxCApp:
             raise ValidationError("--schema must not be empty.")
         return target_project, target_schema
 
-    def semantic_manage(self, operation: str, *, namespace: str, **options) -> 'Envelope':
+    def semantic_manage(self, operation: str, *, namespace: 'str | None' = None, **options) -> 'Envelope':
         """Run a remote SemanticSpec workflow, separate from local annotations."""
         from .semantic_management import SemanticManager
 
         manager = SemanticManager(self.backend, namespace)
         data = manager.execute(operation, **options)
         command = "semantic." + operation
-        metadata = {"namespace": namespace}
+        metadata = {"namespace": manager.namespace}
         envelope = Envelope(command=command, status="success", data=data,
                             metadata=metadata, agent_hints=AgentHints(warnings=manager.warnings))
         self.log(command, envelope.status, metadata)

{maxc_cli-0.9.3 → maxc_cli-0.9.5}/src/maxc_cli/backend/auth.py

@@ -1,6 +1,7 @@
 """Auth-related mixin for OdpsBackend."""
 
 import json
+import re
 from typing import Any
 from urllib.parse import quote
 from xml.etree import ElementTree
@@ -14,10 +15,52 @@ from ..helpers import (
 )
 
 
+def semantic_account_identity(result):
+    """Resolve only server-verified IDs; never infer ownership from a project."""
+    raw = result if isinstance(result, dict) else {}
+
+    def numeric(value):
+        return value if isinstance(value, str) and re.fullmatch(r"[0-9]{1,32}", value) else None
+
+    raw_id = raw.get("ID")
+    display = raw.get("DisplayName")
+    display = display if isinstance(display, str) else ""
+    is_main = bool(re.fullmatch(r"ALIYUN\$[^$:\s]+", display))
+    is_ram = display.startswith("RAM$")
+    composite = (
+        re.fullmatch(r"([0-9]{1,32}):([0-9]{1,32}|role/[A-Za-z0-9_+=,.@-]{1,128})", raw_id)
+        if isinstance(raw_id, str)
+        else None
+    )
+    principal = raw_id if composite else numeric(raw_id)
+    kind = (
+        "MAIN_ACCOUNT"
+        if is_main
+        else ("RAM_ROLE" if is_ram and ":role/" in display else "RAM_USER" if is_ram else "UNKNOWN")
+    )
+    account = numeric(raw.get("AccountId"))
+    source = "whoami.AccountId" if account else None
+    resolved = numeric(raw_id) if is_main else composite.group(1) if is_ram and composite else None
+    if resolved:
+        if account and account != resolved:
+            raise ValidationError(
+                "Conflicting account identity returned by whoami; namespace discovery stopped."
+            )
+        account = resolved
+        source = "whoami.main_account.ID" if is_main else "whoami.RAM.ID.account_prefix"
+    return {
+        "principal_id": principal,
+        "principal_type": kind,
+        "account_id": account,
+        "semantic_namespace": account,
+        "semantic_namespace_source": source,
+    }
+
+
 class AuthMixin:
     """Mixin providing authentication and authorization methods."""
 
-    def whoami_info(self, *, project: 'str | None' = None) -> 'tuple[dict[str, Any], list[str]]':
+    def whoami_info(self, *, project: "str | None" = None) -> "tuple[dict[str, Any], list[str]]":
         """Get current identity info by executing ``whoami`` security query.
 
         Calls ``client.execute_security_query("whoami")`` to verify the
@@ -38,7 +81,7 @@ class AuthMixin:
         owner_display_name = result.get("DisplayName") if isinstance(result, dict) else None
         if owner_display_name:
             self._owner_display_name = owner_display_name
-        return build_odps_identity_payload(
+        payload, warnings = build_odps_identity_payload(
             client=self.client,
             settings=self.settings,
             allowed_operations=self.config.allowed_operations,
@@ -48,16 +91,33 @@ class AuthMixin:
             project=target_project,
             owner_display_name=owner_display_name,
         )
+        identity = semantic_account_identity(result)
+        payload.update(identity)
+        if identity["semantic_namespace"] is None:
+            warnings.append(
+                "Main-account namespace could not be verified; pass an independently verified --namespace for semantic commands."
+            )
+        return payload, warnings
+
+    def semantic_namespace(self):
+        """Return the verified account namespace, or require an explicit override."""
+        payload, _ = self.whoami_info()
+        value = payload.get("semantic_namespace")
+        if not value:
+            raise ValidationError(
+                "Cannot verify the main-account namespace for this identity. Pass --namespace with an independently verified main-account ID; do not use a RAM principal ID or project tenant ID."
+            )
+        return value
 
     def _check_permission(
         self,
         *,
-        object_name: 'str',
-        object_type: 'str',
-        action: 'str',
-        project: 'str',
-        schema: 'str | None' = None,
-    ) -> 'tuple[bool, str]':
+        object_name: "str",
+        object_type: "str",
+        action: "str",
+        project: "str",
+        schema: "str | None" = None,
+    ) -> "tuple[bool, str]":
         """Call the schema-aware MaxCompute checkPermission REST API.
 
         This mirrors the current Java SDK ``SecurityManager#checkPermission``
@@ -128,11 +188,11 @@ class AuthMixin:
     def _resolve_permission_target(
         self,
         *,
-        object_name: 'str',
-        object_type: 'str',
-        project: 'str | None',
-        schema: 'str | None',
-    ) -> 'tuple[str, str, str | None, str]':
+        object_name: "str",
+        object_type: "str",
+        project: "str | None",
+        schema: "str | None",
+    ) -> "tuple[str, str, str | None, str]":
         """Resolve a permission target without relying on server error guesses.
 
         Table-like names accept ``table``, ``schema.table`` and
@@ -233,12 +293,12 @@ class AuthMixin:
     def can_i_info(
         self,
         *,
-        object_name: 'str',
-        object_type: 'str' = "Table",
-        operation: 'str',
-        project: 'str | None' = None,
-        schema: 'str | None' = None,
-    ) -> 'tuple[dict[str, Any], list[str]]':
+        object_name: "str",
+        object_type: "str" = "Table",
+        operation: "str",
+        project: "str | None" = None,
+        schema: "str | None" = None,
+    ) -> "tuple[dict[str, Any], list[str]]":
         """Check if a specific operation is allowed on an object.
 
         Calls the MaxCompute checkPermission REST API directly.
@@ -292,7 +352,7 @@ class AuthMixin:
             [],
         )
 
-    def _get_owner_display_name(self) -> 'str | None':
+    def _get_owner_display_name(self) -> "str | None":
         """Get the current user's display name (e.g., 'ALIYUN$xxx' or 'RAM$xxx')."""
         if self._owner_display_name is not None:
             return self._owner_display_name

{maxc_cli-0.9.3 → maxc_cli-0.9.5}/src/maxc_cli/backend/catalog.py

@@ -24,6 +24,8 @@ import json
 import logging
 from typing import Any
 
+from ..catalog_endpoint import normalize_catalog_endpoint
+
 logger = logging.getLogger(__name__)
 
 # KV store keys — scoped by project to handle multi-tenant setups
@@ -117,14 +119,16 @@ class CatalogMixin:
                 max_age_hours=_CACHE_TTL_HOURS,
             )
             if cached is not None:
-                self._catalog_ep_cached = cached
-                return cached
+                self._catalog_ep_cached = normalize_catalog_endpoint(cached)
+                return self._catalog_ep_cached
 
         # Network call via pyodps auto-routing
         try:
             odps = self.client
             if odps is not None:
                 ep = odps.catalog_endpoint
+                if ep is not None:
+                    ep = normalize_catalog_endpoint(ep)
                 if ep is not None and cache is not None:
                     cache.set_kv(self._cache_key(_CATALOG_EP_KEY), ep)
                 self._catalog_ep_cached = ep

{maxc_cli-0.9.3 → maxc_cli-0.9.5}/src/maxc_cli/backend/odps.py

@@ -13,7 +13,7 @@ from ..helpers import (
     translate_odps_error,
 )
 from ..models import QueryResult
-from ..utils import detect_operation, extract_table_names
+from ..utils import detect_operation, extract_table_names, sql_keyword_tokens, sql_statements
 from .auth import AuthMixin
 from .catalog import CatalogMixin
 from .data import DataMixin
@@ -75,6 +75,26 @@ def _raw_task_result_rows(task_results: 'dict[str, Any]') -> 'list[dict[str, Any
     ]
 
 
+def _is_show_partitions(sql: 'str') -> 'bool':
+    statements = sql_statements(sql)
+    return len(statements) == 1 and sql_keyword_tokens(statements[0])[:2] == ["SHOW", "PARTITIONS"]
+
+
+def _show_partition_rows(task_results: 'Any') -> 'list[dict[str, str]]':
+    """SHOW PARTITIONS emits headerless lines, not a CSV table with a header."""
+    if not isinstance(task_results, dict):
+        raise ValueError("SHOW PARTITIONS returned invalid task results")
+    rows = []
+    for text in task_results.values():
+        if text is None:
+            continue
+        if not isinstance(text, str):
+            raise ValueError("SHOW PARTITIONS returned invalid task result text")
+        # Split only protocol line endings; Unicode separators may be values.
+        rows.extend({"partition": line.removesuffix("\r")} for line in text.split("\n") if line.removesuffix("\r"))
+    return rows
+
+
 class OdpsBackend(
     JobMixin,  # JobMixin extends QueryMixin
     CatalogMixin,
@@ -123,11 +143,12 @@ class OdpsBackend(
     ) -> 'QueryResult':
         """Convert ODPS instance to QueryResult."""
         fallback_warnings: list[str] = []
+        show_partitions = _is_show_partitions(sql)
         statement_operation = _write_operation(sql)
         instance_is_select = getattr(instance, "_is_select", None)
         confirmed_task_results = None
         resultless_statement = statement_operation is not None and instance_is_select is not True
-        if not resultless_statement and instance_is_select is False:
+        if not show_partitions and not resultless_statement and instance_is_select is False:
             try:
                 task_results = instance.get_task_results()
             except Exception:
@@ -140,7 +161,23 @@ class OdpsBackend(
                     resultless_statement = not any(str(value or "").strip() for value in task_results.values())
                     if resultless_statement and sql.strip():
                         statement_operation = detect_operation(sql)
-        if resultless_statement:
+        if show_partitions:
+            try:
+                # The generic CSV reader consumes the first partition as a
+                # header and raises on an empty body. Read this known textual
+                # result directly, retaining lookup failures as real errors.
+                all_rows = _show_partition_rows(instance.get_task_results())
+            except Exception as exc:
+                error = translate_odps_error(exc)
+                error.instance_id = instance.id
+                error.logview = self._safe_logview(instance)
+                raise error from exc
+            schema = [{"name": "partition", "type": "string", "comment": ""}]
+            rows = all_rows[offset : offset + max_rows]
+            total_rows = len(all_rows)
+            degraded_reason = None
+            resultless_statement = False
+        elif resultless_statement:
             # Successful write statements have no tabular result. In
             # particular, PyODPS's DDL fallback reader may try to iterate a
             # missing task_results value and raise after the server job has

{maxc_cli-0.9.3 → maxc_cli-0.9.5}/src/maxc_cli/backend/semantic.py

@@ -11,6 +11,7 @@ from urllib.parse import quote, urlsplit, urlunsplit
 import requests
 from odps import options
 
+from ..catalog_endpoint import normalize_catalog_endpoint
 from ..exceptions import MaxCError, ValidationError
 from ..semantic import MAX_FILE_BYTES, SemanticError, identifier, namespace_id
 
@@ -31,12 +32,18 @@ def _failure(status, code, *, mutation):
         "InvalidArgument": "VALIDATION_ERROR",
     }
     mapped = known.get(code) or {
-        400: "VALIDATION_ERROR", 401: "SEMANTIC_AUTHENTICATION_FAILED",
-        403: "SEMANTIC_PERMISSION_DENIED", 404: "SEMANTIC_NOT_FOUND",
+        400: "VALIDATION_ERROR",
+        401: "SEMANTIC_AUTHENTICATION_FAILED",
+        403: "SEMANTIC_PERMISSION_DENIED",
+        404: "SEMANTIC_NOT_FOUND",
         409: "SEMANTIC_REVISION_CONFLICT",
     }.get(status)
     mapped = mapped or ("SEMANTIC_WRITE_UNCERTAIN" if mutation else "SEMANTIC_CONNECTION_ERROR")
-    return SemanticError(mapped, "Catalog semantic operation failed; inspect the object before retrying.", context={"httpStatus": status})
+    return SemanticError(
+        mapped,
+        "Catalog semantic operation failed; inspect the object before retrying.",
+        context={"httpStatus": status},
+    )
 
 
 class SemanticMixin:
@@ -47,11 +54,10 @@ class SemanticMixin:
         try:
             endpoint = self.client.catalog_rest.endpoint.rstrip("/")
         except Exception as exc:
-            raise SemanticError("SEMANTIC_CONNECTION_ERROR", "Catalog endpoint discovery failed.") from exc
-        parsed = urlsplit(endpoint)
-        if parsed.scheme not in ("https", "http") or not parsed.netloc or parsed.username or parsed.password or parsed.query or parsed.fragment:
-            raise ValidationError("Catalog endpoint must be an HTTP(S) service URL without credentials, query, or fragment.")
-        return endpoint
+            raise SemanticError(
+                "SEMANTIC_CONNECTION_ERROR", "Catalog endpoint discovery failed."
+            ) from exc
+        return normalize_catalog_endpoint(endpoint)
 
     def semantic_request(self, namespace, method, name=None, *, suffix="", params=None, body=None):
         namespace_id(namespace)
@@ -68,7 +74,9 @@ class SemanticMixin:
         try:
             payload = None
             if body is not None:
-                payload = json.dumps(body, ensure_ascii=False, separators=(",", ":"), allow_nan=False).encode("utf-8")
+                payload = json.dumps(
+                    body, ensure_ascii=False, separators=(",", ":"), allow_nan=False
+                ).encode("utf-8")
                 if len(payload) > MAX_FILE_BYTES:
                     raise ValidationError("Semantic request exceeds the 16 MiB limit.")
             # Reuse the account (including OAuth/STS/proxy behavior), region and
@@ -76,7 +84,9 @@ class SemanticMixin:
             headers = {"Content-Type": "application/json", "Accept": "application/json"}
             user_agent = getattr(rest, "_user_agent", "maxc-cli")
             headers.update({"User-Agent": user_agent, "x-odps-user-agent": user_agent})
-            request = requests.Request(method, base + path, params=params or {}, data=payload, headers=headers).prepare()
+            request = requests.Request(
+                method, base + path, params=params or {}, data=payload, headers=headers
+            ).prepare()
             region = rest.region_name if options.enable_v4_sign else None
             # PyODPS sign_request unquotes the URL before parse_qsl unquotes
             # each query value again. Protect percent escapes for signing only,
@@ -94,14 +104,30 @@ class SemanticMixin:
             # requests' default adapters have zero retries. No redirect can
             # forward credentials or silently change a signed target/method.
             with requests.Session() as session:
-                settings = session.merge_environment_settings(request.url, dict(getattr(rest, "_proxy", None) or {}), True, options.verify_ssl, None)
-                with session.send(request, timeout=(options.connect_timeout, options.read_timeout), allow_redirects=False, **settings) as response:
+                settings = session.merge_environment_settings(
+                    request.url,
+                    dict(getattr(rest, "_proxy", None) or {}),
+                    True,
+                    options.verify_ssl,
+                    None,
+                )
+                with session.send(
+                    request,
+                    timeout=(options.connect_timeout, options.read_timeout),
+                    allow_redirects=False,
+                    **settings,
+                ) as response:
                     status = response.status_code
                     raw = bytearray()
                     for chunk in response.iter_content(64 * 1024):
                         raw.extend(chunk)
                         if len(raw) > MAX_FILE_BYTES:
-                            raise SemanticError("SEMANTIC_WRITE_UNCERTAIN" if mutation else "SEMANTIC_INVALID_RESPONSE", "Catalog response exceeds the 16 MiB limit.")
+                            raise SemanticError(
+                                "SEMANTIC_WRITE_UNCERTAIN"
+                                if mutation
+                                else "SEMANTIC_INVALID_RESPONSE",
+                                "Catalog response exceeds the 16 MiB limit.",
+                            )
                     if not 200 <= status < 300:
                         code = ""
                         try:
@@ -112,7 +138,11 @@ class SemanticMixin:
                             pass
                         raise _failure(status, code, mutation=mutation)
                     if method == "DELETE":
-                        return {"deleted": True, "specName": name, "expectedSemanticSpecId": (params or {}).get("expectedSemanticSpecId")}
+                        return {
+                            "deleted": True,
+                            "specName": name,
+                            "expectedSemanticSpecId": (params or {}).get("expectedSemanticSpecId"),
+                        }
                     result = json.loads(raw)
                     if not isinstance(result, dict):
                         raise ValueError("expected object")
@@ -121,4 +151,7 @@ class SemanticMixin:
             raise
         except Exception as exc:
             # Raw exceptions can contain signed headers, SQL, or user content.
-            raise SemanticError("SEMANTIC_WRITE_UNCERTAIN" if mutation else "SEMANTIC_CONNECTION_ERROR", "Catalog semantic request did not produce a verifiable result. Reconcile before retrying a write.") from exc
+            raise SemanticError(
+                "SEMANTIC_WRITE_UNCERTAIN" if mutation else "SEMANTIC_CONNECTION_ERROR",
+                "Catalog semantic request did not produce a verifiable result. Reconcile before retrying a write.",
+            ) from exc

maxc_cli-0.9.5/src/maxc_cli/catalog_endpoint.py

@@ -0,0 +1,42 @@
+"""Normalize SDK-discovered Catalog authorities without changing explicit routing."""
+
+import re
+from urllib.parse import urlsplit
+
+from .exceptions import ValidationError
+
+_BARE_AUTHORITY = re.compile(
+    r"(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+"
+    r"[A-Za-z0-9-]+(?::[0-9]{1,5})?"
+)
+
+
+def normalize_catalog_endpoint(endpoint):
+    if not isinstance(endpoint, str) or not endpoint:
+        raise ValidationError("Catalog endpoint must be a nonempty HTTP(S) service URL.")
+    endpoint = endpoint.rstrip("/")
+    if _BARE_AUTHORITY.fullmatch(endpoint):
+        endpoint = "https://" + endpoint
+    try:
+        parsed = urlsplit(endpoint)
+        valid = (
+            parsed.scheme in ("https", "http")
+            and parsed.hostname
+            and not parsed.username
+            and not parsed.password
+            and not parsed.query
+            and not parsed.fragment
+            and not any(c.isspace() for c in endpoint)
+            and "\\" not in endpoint
+            and "%" not in parsed.hostname
+        )
+        # Accessing port checks malformed/non-numeric/out-of-range values.
+        if parsed.port is not None and not 1 <= parsed.port <= 65535:
+            valid = False
+    except ValueError:
+        valid = False
+    if not valid:
+        raise ValidationError(
+            "Catalog endpoint must be an HTTP(S) service URL without credentials, query, or fragment."
+        )
+    return endpoint

{maxc_cli-0.9.3 → maxc_cli-0.9.5}/src/maxc_cli/cli.py

@@ -453,6 +453,7 @@ def build_parser() -> argparse.ArgumentParser:
     meta_describe.add_argument("--project", help="Target MaxCompute project")
     meta_describe.add_argument("--json", action="store_true", help="Output as JSON envelope")
     meta_describe.add_argument("--full", action="store_true", help="Show full column list (default is summary mode)")
+    meta_describe.add_argument("--metadata-only", action="store_true", help="Read live table schema only, without rows, partition values or cache fallback")
     meta_describe.set_defaults(handler=_handle_meta_describe)
 
     meta_functions = _make_parser(meta_subparsers, "list-functions", "meta.list-functions", help="List registered functions")
@@ -1158,7 +1159,7 @@ def build_parser() -> argparse.ArgumentParser:
         child = _make_parser(semantic_commands, operation, "semantic." + operation, help=summary)
         if operation != "list":
             child.add_argument("name", help="Exact semantic package name")
-        child.add_argument("--namespace", required=True, help="Verified main-account ID (not project tenant ID)")
+        child.add_argument("--namespace", help="Verified main-account ID; auto-discovered from authenticated account identity when omitted")
         child.add_argument("--json", action="store_true", help="Output JSON envelope")
         if operation == "list":
             child.add_argument("--page-size", type=positive_int, default=20)
@@ -2152,6 +2153,7 @@ def _handle_meta_describe(app: MaxCApp, args: argparse.Namespace, stdout: TextIO
     full = args.full or _is_json_mode(args)
     envelope = app.meta_describe(
         args.table_name,
+        metadata_only=getattr(args, "metadata_only", False),
         full=full,
         project=args.project,
         schema=getattr(args, "schema", None),
@@ -2940,7 +2942,7 @@ def _manifest_effects(command: str) -> list[dict[str, Any]]:
                 when=_manifest_condition("yes", equals=True), confirmation="--yes with exact target/version; apply also requires --plan-digest"))
         if operation in {"create", "diff", "apply"}:
             effects.append(_manifest_effect("local", "read", "semantic_json_file"))
-        if operation == "export":
+        if operation in {"export"}:
             effects.append(_manifest_effect("local", "create", "semantic_json_file", when=_manifest_condition("overwrite", equals=False)))
             effects.append(_manifest_effect("local", "replace", "semantic_json_file", when=_manifest_condition("overwrite", equals=True), confirmation="--overwrite"))
         return _with_manifest_audit_effect(command, effects)

{maxc_cli-0.9.3 → maxc_cli-0.9.5}/src/maxc_cli/config.py

@@ -796,7 +796,7 @@ def load_config(cwd: 'Path', explicit_path: 'Path | None' = None) -> 'MaxCConfig
     ]
     cost_threshold_cu = float(merged.get("cost_threshold_cu", 50))
     masking_cfg = merged.get("masking", {}) or {}
-    masking_enabled = bool(masking_cfg.get("enabled", True))
+    masking_enabled = bool(masking_cfg.get("enabled", False))
     sensitive_columns = [str(item) for item in merged.get("sensitive_columns", [])]
     sensitive_columns += [str(item) for item in masking_cfg.get("sensitive_patterns", [])]
 

{maxc_cli-0.9.3 → maxc_cli-0.9.5}/src/maxc_cli/semantic_management.py

@@ -19,7 +19,7 @@ from .semantic import (
 class SemanticManager:
     def __init__(self, backend, namespace):
         self.backend = backend
-        self.namespace = namespace_id(namespace)
+        self.namespace = namespace_id(namespace if namespace is not None else backend.semantic_namespace())
         self.warnings = []
 
     def request(self, method, name=None, **kwargs):

{maxc_cli-0.9.3 → maxc_cli-0.9.5}/src/maxc_cli/skills/references/semantic-packages.md

@@ -6,8 +6,11 @@ Read the live help/manifest before choosing arguments.
 
 ## Discover and read
 
-Use the verified main-account ID as `--namespace`; a project's tenant ID is not
-an interchangeable identifier. The active authentication and Catalog endpoint
+Omit `--namespace` to resolve it from verified authenticated account identity.
+If discovery cannot prove the parent account, pass an independently verified
+main-account ID; neither a standalone RAM principal ID nor a project tenant ID
+is interchangeable with this namespace. `auth whoami` exposes the resolution
+under `data.identity.semantic_namespace` and its source. The active authentication and Catalog endpoint
 select the caller and region. Follow `nextPageToken` with `--page-token` until
 the intended exact name is found. Authorization remains server-enforced.