mostlyright-data 0.19.7__tar.gz → 0.20.0__tar.gz

{mostlyright_data-0.19.7 → mostlyright_data-0.20.0}/PKG-INFO

@@ -1,10 +1,10 @@
 Metadata-Version: 2.4
 Name: mostlyright-data
-Version: 0.19.7
+Version: 0.20.0
 Summary: Mostly Right hosted CLI for reviewed datasets
 Project-URL: Homepage, https://mostlyright.md/
 Project-URL: Documentation, https://mostlyright.md/docs/guides/cli/
-Requires-Python: >=3.13
+Requires-Python: >=3.11
 Provides-Extra: build
 Requires-Dist: hatchling==1.28.0; extra == 'build'
 Requires-Dist: uv-build==0.11.3; extra == 'build'
@@ -22,7 +22,7 @@ they finish.
 
 ## Requirements
 
-Use CPython 3.13 or newer.
+Use CPython 3.11 or newer.
 
 ## Install
 

{mostlyright_data-0.19.7 → mostlyright_data-0.20.0}/README.md

@@ -10,7 +10,7 @@ they finish.
 
 ## Requirements
 
-Use CPython 3.13 or newer.
+Use CPython 3.11 or newer.
 
 ## Install
 

{mostlyright_data-0.19.7 → mostlyright_data-0.20.0}/pyproject.toml

@@ -1,9 +1,9 @@
 [project]
 name = "mostlyright-data"
-version = "0.19.7"
+version = "0.20.0"
 description = "Mostly Right hosted CLI for reviewed datasets"
 readme = "README.md"
-requires-python = ">=3.13"
+requires-python = ">=3.11"
 # The published Harness package is a pure-Python, stdlib-only hosted client.  Dataset execution,
 # native readers, and worker publication live in Mostly Right Studio.
 dependencies = []

{mostlyright_data-0.19.7 → mostlyright_data-0.20.0}/src/mostlyright/data_harness/thin/__init__.py

@@ -1,6 +1,6 @@
 """The pure-Python hosted lane: auth, submit, stream, download, receipts.
 
-Every module in this package is importable on a bare CPython 3.13 with no compiled extension in
+Every module in this package is importable on a bare CPython 3.11 with no compiled extension in
 site-packages. That is the whole contract of the package and it is asserted rather than intended:
 :mod:`tests.test_thin_profile` installs the base distribution into a fresh environment, refuses any
 ``.so``/``.pyd``/``.dylib`` it finds, and imports the command router there.

{mostlyright_data-0.19.7 → mostlyright_data-0.20.0}/src/mostlyright/data_harness/thin/download.py

@@ -88,7 +88,15 @@ class DownloadedArtifact:
 
 
 def _required_headers(session: Mapping[str, Any]) -> dict[str, str]:
-    """The headers the signature covers. Sending fewer, or more, invalidates it."""
+    """The headers Studio signed, replayed exactly as it stated them.
+
+    Omitting one, or altering a value, is what invalidates the signature; this builds the outgoing
+    set from the session and from nothing else, so neither can happen here. It is NOT an exact
+    header set for the request as a whole -- :class:`~mostlyright.data_harness.thin.transport.
+    UrlLibTransport` adds this client's identity to every call it makes, signed transfers
+    included, and those transfers succeed. What a given storage backend tolerates beyond the
+    signature is that backend's business, and nothing in this lane may start depending on it.
+    """
 
     declared = session.get("required_headers")
     if declared is None:

{mostlyright_data-0.19.7 → mostlyright_data-0.20.0}/src/mostlyright/data_harness/thin/runs.py

@@ -46,6 +46,31 @@ from mostlyright.data_harness.thin.transport import (
 #: lane's half of that pin, and ``tests/test_thin_client.py`` holds the two equal.
 PINNED_CONTRACT_VERSION = "3.0.0"
 
+#: The header this client names itself under on every Studio call, and the name it gives.
+#:
+#: ⚠ IT IS A COUNTER SELECTOR AND NOTHING ELSE. Studio cannot tell a call from here apart from a
+#: call its own dashboard makes server-side -- both present a Cloud-minted token of the same
+#: credential class, minted by the same function -- so the caller states which one it is and
+#: Studio reads it to decide what to COUNT. It authorizes nothing, no answer changes because it
+#: was sent, and Studio is free to ignore it. Anyone can send it and anyone can withhold it, which
+#: makes the number it feeds a floor with noise in it rather than a measurement of anything.
+#:
+#: Stated per Studio call rather than in the transport, which is the other place every request
+#: passes through and the tempting one, because ``with_user_agent`` is already applied there. The
+#: reason is not that a signed transfer would break under one more header: the transport adds a
+#: user agent to those too, outside the ``required_headers`` the session names, and they succeed.
+#:
+#: The reason is who each header is for. That transport speaks to two kinds of origin -- our own
+#: services, and whatever host a signed transfer URL names, which ``signed_transfer_url`` checks
+#: for a scheme and for the absence of an embedded credential while asserting nothing about whose
+#: storage it is. An identity is owed to every origin a client calls, which is why the user agent
+#: is applied to all of them. A name that means something only to the service keeping the counter
+#: is owed to that service alone, and on the transport it would ride to a third party's storage on
+#: every download, where nothing can count it and nobody asked for it. ``_call`` builds its URL
+#: from ``session.studio_base_url``, so it is the layer that knows the answer is Studio.
+CLIENT_HEADER = "X-Mostlyright-Client"
+CLIENT_NAME = "mr-data"
+
 #: The routes. Kept as one table because it is the thing a reviewer checks against the contract.
 START_RUN_PATH = "/v3/runs"
 #: The same collection, read rather than added to. Written out rather than aliased to
@@ -211,7 +236,11 @@ class StudioApiClient:
         shape: type = dict,
         response_headers: dict[str, str] | None = None,
     ) -> Any:
-        headers = {"Accept": "application/json", **self._session.authorization()}
+        headers = {
+            "Accept": "application/json",
+            CLIENT_HEADER: CLIENT_NAME,
+            **self._session.authorization(),
+        }
         if extra_headers:
             headers.update(extra_headers)
         raw_body: bytes | None = None
@@ -505,6 +534,8 @@ def _studio_refusal(status: int, parsed: Any, path: str) -> ThinLaneError:
 
 __all__ = [
     "ARTIFACT_DOWNLOAD_SESSION_PATH",
+    "CLIENT_HEADER",
+    "CLIENT_NAME",
     "GET_RECIPE_PROPOSAL_PATH",
     "GET_RUN_PATH",
     "LIST_RUNS_PATH",

{mostlyright_data-0.19.7 → mostlyright_data-0.20.0}/src/mostlyright/data_harness/thin/stream.py

@@ -34,7 +34,11 @@ from mostlyright.data_harness.thin.progress_vocabulary import (
     PROGRESS_EVENT_FACTS,
     PROGRESS_SCHEMA_VERSION,
 )
-from mostlyright.data_harness.thin.runs import RUN_EVENTS_STREAM_PATH
+from mostlyright.data_harness.thin.runs import (
+    CLIENT_HEADER,
+    CLIENT_NAME,
+    RUN_EVENTS_STREAM_PATH,
+)
 from mostlyright.data_harness.thin.session import StudioSession
 from mostlyright.data_harness.thin.transport import ThinLaneError, Transport, UrlLibTransport
 
@@ -389,7 +393,11 @@ class RunEventStream:
                 return True
             return False
 
-        headers = {"Accept": "text/event-stream", **self._session.authorization()}
+        headers = {
+            "Accept": "text/event-stream",
+            CLIENT_HEADER: CLIENT_NAME,
+            **self._session.authorization(),
+        }
         # Resume in Studio's own cursor space when we have one. `from_seq` is only ever the
         # starting position of a watch that has not yet seen a frame.
         if progress.last_event_id:

{mostlyright_data-0.19.7 → mostlyright_data-0.20.0}/src/mostlyright/data_harness/ux/credential_store.py

@@ -789,8 +789,13 @@ def _ensure_private_directory(path: Path) -> None:
             created = True
         except FileExistsError:
             created = False
-        if created and os.name == "posix":
-            os.chmod(path, 0o700, follow_symlinks=False)
+        if os.name == "posix":
+            if created:
+                # The umask may have stripped bits from the mode ``mkdir`` was asked for, and a
+                # directory this call just made is one it owns.
+                os.chmod(path, 0o700)
+            else:
+                _narrow_private_directory(path)
         _validate_private_directory(path)
     except OSError:
         raise CredentialStoreError(
@@ -798,6 +803,42 @@ def _ensure_private_directory(path: Path) -> None:
         ) from None
 
 
+def _narrow_private_directory(path: Path) -> None:
+    """Bring a directory this user already owns down to 0700 before the gate below reads it.
+
+    Another tool can have created the same directory under an ordinary umask, which lands it at
+    0755 and makes every later read and write refuse it.  It is still this effective user's
+    directory, so narrowing it is repair rather than a decision.
+
+    The descriptor is the whole safety argument.  ``O_NOFOLLOW`` and ``O_DIRECTORY`` mean a symlink
+    and a non-directory never open at all, so neither can be chmod'ed and both leave through the
+    ``OSError`` the caller turns into a refusal, and the owner is read off the same descriptor the
+    mode is written through, so a directory belonging to somebody else is left exactly as found for
+    :func:`_validate_private_directory` to refuse.
+    """
+
+    try:
+        descriptor = os.open(
+            path,
+            os.O_RDONLY | getattr(os, "O_DIRECTORY", 0) | getattr(os, "O_NOFOLLOW", 0),
+        )
+    except PermissionError:
+        # A directory without its owner-read bit cannot be opened, so the descriptor argument is
+        # unavailable and the kind and owner are read from the name instead.
+        info = os.lstat(path)
+        if stat.S_ISDIR(info.st_mode) and info.st_uid == os.geteuid():
+            os.chmod(path, 0o700)
+        return
+    try:
+        info = os.fstat(descriptor)
+        if not stat.S_ISDIR(info.st_mode) or info.st_uid != os.geteuid():
+            return
+        if stat.S_IMODE(info.st_mode) != 0o700:
+            os.fchmod(descriptor, 0o700)
+    finally:
+        os.close(descriptor)
+
+
 def _validate_private_directory(path: Path) -> None:
     try:
         info = path.stat(follow_symlinks=False)

{mostlyright_data-0.19.7 → mostlyright_data-0.20.0}/src/mostlyright/data_harness/ux/credentials.py

@@ -199,7 +199,7 @@ def store_credentials(
     except LoginError:
         raise
     except CredentialStoreError as error:
-        raise _login_store_error(error) from None
+        raise login_store_error(error) from None
     except OSError:
         raise LoginError(
             "LOGIN_CREDENTIAL_MIGRATION_FAILED",
@@ -251,7 +251,7 @@ def read_credentials(
     except LoginError:
         raise
     except CredentialStoreError as error:
-        raise _login_store_error(error) from None
+        raise login_store_error(error) from None
     except OSError:
         raise LoginError(
             "LOGIN_CREDENTIALS_UNREADABLE",
@@ -392,16 +392,19 @@ def _native_backend_name(directory: Path) -> str:
     try:
         return native_backend(directory).name
     except CredentialStoreError as error:
-        raise _login_store_error(error) from None
+        raise login_store_error(error) from None
 
 
 def _backend_for(directory: Path, backend_name: str) -> CredentialBackend:
     if backend_name == "secure-file":
-        return SecureFileBackend(directory, explicit=True)
+        try:
+            return SecureFileBackend(directory, explicit=True)
+        except CredentialStoreError as error:
+            raise login_store_error(error) from None
     try:
         backend = native_backend(directory)
     except CredentialStoreError as error:
-        raise _login_store_error(error) from None
+        raise login_store_error(error) from None
     if backend.name != backend_name:
         raise LoginError(
             "LOGIN_CREDENTIAL_STORE_UNAVAILABLE",
@@ -588,7 +591,7 @@ def _install_manifest(path: Path, backend_name: str) -> None:
             stage.unlink()
 
 
-def _login_store_error(error: CredentialStoreError) -> LoginError:
+def login_store_error(error: CredentialStoreError) -> LoginError:
     suffix = error.code.removeprefix("CREDENTIAL_")
     details = {
         "CREDENTIAL_STORE_UNAVAILABLE": (
@@ -606,7 +609,7 @@ def _login_store_error(error: CredentialStoreError) -> LoginError:
     }
     return LoginError(
         f"LOGIN_CREDENTIAL_{suffix}",
-        details.get(error.code, "the protected credential operation failed"),
+        details.get(error.code, error.detail or "the protected credential operation failed"),
     )
 
 
@@ -622,6 +625,7 @@ __all__ = [
     "credentials_path",
     "default_credentials_dir",
     "install_credential_manifest",
+    "login_store_error",
     "read_credentials",
     "refuse_existing_credentials",
     "remove_credential_manifest_under_held_lock",

{mostlyright_data-0.19.7 → mostlyright_data-0.20.0}/src/mostlyright/data_harness/ux/login.py

@@ -63,6 +63,7 @@ from mostlyright.data_harness.ux.credentials import (
     StoredCredentials,
     credential_transaction_store,
     install_credential_manifest,
+    login_store_error,
     refuse_existing_credentials,
 )
 
@@ -529,7 +530,7 @@ def run_login(
         if not manifest_path.exists():
             install_credential_manifest(manifest_path, store.backend.name)
     except CredentialStoreError as error:
-        raise LoginError("LOGIN_CREDENTIAL_RECOVERY_REQUIRED", error.detail) from None
+        raise login_store_error(error) from None
     live_transport = transport or UrlLibDeviceFlowTransport()
 
     authorization = request_device_code(resolved_cloud_url, transport=live_transport)

{mostlyright_data-0.19.7 → mostlyright_data-0.20.0}/src/mostlyright/data_harness/ux/remediation.py

@@ -11,7 +11,7 @@ neither affordable nor honest:
 * **Families.** Every code prefix is assigned to a family -- 224 of them, plus 18 compound
   prefixes, across 38 families. A family is one paragraph: what this class of failure is about,
   where to look, and what to do. Every prefix has one, so no code can fail to say something useful.
-* **Curated codes.** The 102 failures a person actually meets get their own exact sentences, and
+* **Curated codes.** The 103 failures a person actually meets get their own exact sentences, and
   where one command is the whole answer, the command itself.
 
 Those four counts are not a note somebody remembered to update:
@@ -1770,6 +1770,19 @@ CODES: dict[str, Remediation] = {
             "mr-data login --force.",
         ),
     ),
+    # `mr-data` narrows a credential directory it already owns, so what is left for this code to
+    # report is something it may not touch on its own.
+    "LOGIN_CREDENTIAL_STORE_PERMISSIONS": Remediation(
+        lines=(
+            "The place the device credential is kept is not a private folder this account owns, "
+            "so nothing was read from it or written to it.",
+            "That place is ~/.mostlyright. A folder there that you own is narrowed to your "
+            "account automatically, so the usual causes are a link, a file, or a folder of "
+            "another account at that name, or a volume that does not accept the change.",
+            "Look at what sits at that path and who owns it. Put a folder you own there, then "
+            "run mr-data login again.",
+        ),
+    ),
     "LOGIN_CREDENTIALS_UNREADABLE": Remediation(
         lines=(
             "The stored credential at the path named above exists but cannot be read as the file "