odoo-agent-cli 0.4.0__tar.gz → 0.5.0__tar.gz

{odoo_agent_cli-0.4.0 → odoo_agent_cli-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: odoo-agent-cli
-Version: 0.4.0
+Version: 0.5.0
 Summary: Odoo JSON-RPC CLI and Python client built for AI agents and scripts.
 Project-URL: Homepage, https://github.com/Organize-IT/odoo-cli
 Project-URL: Issues, https://github.com/Organize-IT/odoo-cli/issues
@@ -67,7 +67,8 @@ odoo group invoices -w unpaid --by partner_id --sum amount_residual
 anything is sent, and the technical names keep working. Full documentation:
 [Organize-IT.github.io/odoo-cli](https://github.com/Organize-IT/odoo-cli/tree/main/docs).
 
-Prefer named connections? They live in a `0600` TOML file:
+Prefer named connections? They live in a TOML file written owner-only where the platform
+can enforce that — `odoo profile path --check` says whether it can:
 
 ```bash
 odoo profile add acme --url https://acme.odoo.com --db acme --login bot@acme.com \
@@ -84,7 +85,10 @@ First match wins, and the CLI never prompts:
 3. a profile named `default`
 
 Nothing found: exit code 3 with a message listing those three ways. A profile stores the key
-(`--api-key`) or points to an env var (`--api-key-env`). `odoo profile path` shows the file.
+(`--api-key`) or points to an env var (`--api-key-env`). `odoo profile path` shows the file,
+`--check` reports what its permissions are actually worth: mode 600 means owner-only on
+POSIX and nothing at all on Windows, where `chmod` only toggles a read-only attribute. On
+such a platform, prefer `--api-key-env` and keep the key in your secret manager.
 
 ## Output contract
 
@@ -96,6 +100,7 @@ Nothing found: exit code 3 with a message listing those three ways. A profile st
 | bad arguments | | `{"error": ...}` | 2 |
 | connection, auth, no profile | | `{"error": ...}` | 3 |
 | refused by a guard | | `{"error": ...}` | 4 |
+| query repaired to run | rows | `{"error": ...}` | 5 |
 | write executed | result | `{"write": {"model", "method", "ids", "fields"}}` | 0 |
 
 Data is never humanised: many2one fields stay `[id, "name"]`, empty values stay `false`.
@@ -134,6 +139,31 @@ A bare word is looked up as a preset for the model: `-w overdue`, `-w unpaid`, `
 `-w confirmed`, `-w archived`. `odoo alias MODEL --presets` lists the ones that apply. A bare
 word that is not a preset exits 2 listing the ones that are.
 
+## Your own names
+
+The shipped table covers what most tenants call things. A profile file adds the rest, and a
+user entry replaces a built-in of the same name — your tenant knows its vocabulary better than
+this tool does:
+
+```toml
+[aliases.subscriptions]
+model = "sale.subscription"
+domain = [["stage_category", "=", "progress"]]
+help = "Running subscriptions"
+
+[aliases.invoices]                     # replaces the built-in
+model = "account.move"
+domain = [["move_type", "=", "out_invoice"], ["company_id", "=", 3]]
+
+[presets.mine]
+domain = [["user_id", "=", 7]]
+models = ["crm.lead", "sale.order"]
+```
+
+`odoo alias` marks each entry `builtin` or `config`. A malformed table fails the command with
+exit 2 instead of being skipped: a filter you believe is applied and is not is exactly what
+this mechanism exists to avoid. Dynamic dates work too — `@today`, `@month-start`, `@year-start`.
+
 ## Names and typos
 
 Read commands accept an alias in place of a technical model name (`invoices`, `customers`,
@@ -192,8 +222,9 @@ are refused unless `--include-sensitive`.
   many2one shapes) and recipes.
 - The same text ships as an [Agent Skill](https://github.com/Organize-IT/odoo-cli/blob/main/SKILL.md):
   `npx skills add Organize-IT/odoo-cli`.
-- `odoo search ... --lenient-fields` removes fields Odoo rejects and retries, with a warning on
-  stderr. Exploration only.
+- `odoo search ... --lenient-fields` removes fields Odoo rejects and retries. It prints the
+  rows, then exits **5**: they answer a wider question than the one you asked. Exploration
+  stays comfortable; a script that checks its exit codes cannot be fooled by it.
 
 ## Library
 
@@ -254,7 +285,8 @@ published to PyPI on `v*` tags through trusted publishing, with every action pin
 commit digest.
 
 `AGENTS.md` is the specification: layering, the contracts that may not change silently, and
-the definition of done. Read it before changing anything.
+the definition of done. [docs/decisions/](docs/decisions/) records the decisions with a real
+trade-off behind them. Read both before changing anything.
 
 ## License
 

{odoo_agent_cli-0.4.0 → odoo_agent_cli-0.5.0}/README.md

@@ -40,7 +40,8 @@ odoo group invoices -w unpaid --by partner_id --sum amount_residual
 anything is sent, and the technical names keep working. Full documentation:
 [Organize-IT.github.io/odoo-cli](https://github.com/Organize-IT/odoo-cli/tree/main/docs).
 
-Prefer named connections? They live in a `0600` TOML file:
+Prefer named connections? They live in a TOML file written owner-only where the platform
+can enforce that — `odoo profile path --check` says whether it can:
 
 ```bash
 odoo profile add acme --url https://acme.odoo.com --db acme --login bot@acme.com \
@@ -57,7 +58,10 @@ First match wins, and the CLI never prompts:
 3. a profile named `default`
 
 Nothing found: exit code 3 with a message listing those three ways. A profile stores the key
-(`--api-key`) or points to an env var (`--api-key-env`). `odoo profile path` shows the file.
+(`--api-key`) or points to an env var (`--api-key-env`). `odoo profile path` shows the file,
+`--check` reports what its permissions are actually worth: mode 600 means owner-only on
+POSIX and nothing at all on Windows, where `chmod` only toggles a read-only attribute. On
+such a platform, prefer `--api-key-env` and keep the key in your secret manager.
 
 ## Output contract
 
@@ -69,6 +73,7 @@ Nothing found: exit code 3 with a message listing those three ways. A profile st
 | bad arguments | | `{"error": ...}` | 2 |
 | connection, auth, no profile | | `{"error": ...}` | 3 |
 | refused by a guard | | `{"error": ...}` | 4 |
+| query repaired to run | rows | `{"error": ...}` | 5 |
 | write executed | result | `{"write": {"model", "method", "ids", "fields"}}` | 0 |
 
 Data is never humanised: many2one fields stay `[id, "name"]`, empty values stay `false`.
@@ -107,6 +112,31 @@ A bare word is looked up as a preset for the model: `-w overdue`, `-w unpaid`, `
 `-w confirmed`, `-w archived`. `odoo alias MODEL --presets` lists the ones that apply. A bare
 word that is not a preset exits 2 listing the ones that are.
 
+## Your own names
+
+The shipped table covers what most tenants call things. A profile file adds the rest, and a
+user entry replaces a built-in of the same name — your tenant knows its vocabulary better than
+this tool does:
+
+```toml
+[aliases.subscriptions]
+model = "sale.subscription"
+domain = [["stage_category", "=", "progress"]]
+help = "Running subscriptions"
+
+[aliases.invoices]                     # replaces the built-in
+model = "account.move"
+domain = [["move_type", "=", "out_invoice"], ["company_id", "=", 3]]
+
+[presets.mine]
+domain = [["user_id", "=", 7]]
+models = ["crm.lead", "sale.order"]
+```
+
+`odoo alias` marks each entry `builtin` or `config`. A malformed table fails the command with
+exit 2 instead of being skipped: a filter you believe is applied and is not is exactly what
+this mechanism exists to avoid. Dynamic dates work too — `@today`, `@month-start`, `@year-start`.
+
 ## Names and typos
 
 Read commands accept an alias in place of a technical model name (`invoices`, `customers`,
@@ -165,8 +195,9 @@ are refused unless `--include-sensitive`.
   many2one shapes) and recipes.
 - The same text ships as an [Agent Skill](https://github.com/Organize-IT/odoo-cli/blob/main/SKILL.md):
   `npx skills add Organize-IT/odoo-cli`.
-- `odoo search ... --lenient-fields` removes fields Odoo rejects and retries, with a warning on
-  stderr. Exploration only.
+- `odoo search ... --lenient-fields` removes fields Odoo rejects and retries. It prints the
+  rows, then exits **5**: they answer a wider question than the one you asked. Exploration
+  stays comfortable; a script that checks its exit codes cannot be fooled by it.
 
 ## Library
 
@@ -227,7 +258,8 @@ published to PyPI on `v*` tags through trusted publishing, with every action pin
 commit digest.
 
 `AGENTS.md` is the specification: layering, the contracts that may not change silently, and
-the definition of done. Read it before changing anything.
+the definition of done. [docs/decisions/](docs/decisions/) records the decisions with a real
+trade-off behind them. Read both before changing anything.
 
 ## License
 

{odoo_agent_cli-0.4.0 → odoo_agent_cli-0.5.0}/SKILL.md

@@ -18,6 +18,8 @@ Resolution order, first match wins:
 3. A profile named `default`
 
 Nothing resolved: exit code 3 and a message listing these three ways. The CLI never prompts.
+`odoo profile path --check` says whether the stored key is really owner-only on this
+platform; on Windows it is not, so prefer `--api-key-env` there.
 `ODOO_API_KEY` accepts an Odoo API key (preferred) or the user's password.
 Check a connection with `odoo info`. Self-signed on-prem server: `--insecure`
 (or `odoo profile add ... --no-verify-ssl`).
@@ -91,7 +93,8 @@ Refresh it after a module install or an Odoo upgrade with `odoo cache clear`.
 - Errors: one JSON object on stderr, `{"error": {"code": ..., "message": ..., "odoo": {...}}}`.
 - Warnings and write logs: one JSON object per line on stderr.
 - Exit codes: `0` ok, `1` Odoo raised, `2` bad usage, `3` connection or authentication,
-  `4` refused by a guard (writes disabled, missing `--yes`, sensitive model).
+  `4` refused by a guard (writes disabled, missing `--yes`, sensitive model), `5` the query
+  was repaired to make it run, so the rows answer a wider question than the one you asked.
 - Values of fields named like `password`, `api_key`, `secret` are replaced by `[redacted]`
   unless `--no-redact`.
 
@@ -173,8 +176,9 @@ One2many and many2many fields take Odoo commands, written as JSON in `-v` or `--
 6. Dates are strings, `YYYY-MM-DD` or `YYYY-MM-DD HH:MM:SS` in UTC.
 7. Field names drift between Odoo 17, 18 and 19 (for example `account.account.company_id`
    became `company_ids`). If a field is rejected, `odoo fields` is the truth.
-   `--lenient-fields` on `search` removes rejected fields and retries, with a warning on
-   stderr; only use it for exploration, never in a script that relies on the result.
+   `--lenient-fields` on `search` removes rejected fields and retries. It prints the rows and
+   then exits 5, because they answer a wider question than the one you asked. Use it to
+   explore; if you keep it in a script, check the exit code.
 8. Never guess a model name: `odoo alias`, then `odoo models --like invoice`. A dotless
    name close to a known alias is reported as a typo instead of being sent.
 9. Sensitive models (`ir.config_parameter`, `ir.mail_server`, `res.users.apikeys`, `ir.cron`,

{odoo_agent_cli-0.4.0 → odoo_agent_cli-0.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "odoo-agent-cli"
-version = "0.4.0"
+version = "0.5.0"
 description = "Odoo JSON-RPC CLI and Python client built for AI agents and scripts."
 readme = "README.md"
 license = "MIT"
@@ -45,6 +45,7 @@ dev = [
   "ruff>=0.6",
   "mypy>=1.11",
   "pytest-cov>=5",
+  "hypothesis>=6.168.0",
 ]
 docs = [
   "mkdocs>=1.6",

{odoo_agent_cli-0.4.0 → odoo_agent_cli-0.5.0}/src/odoocli/AGENT_GUIDE.md

@@ -13,6 +13,8 @@ Resolution order, first match wins:
 3. A profile named `default`
 
 Nothing resolved: exit code 3 and a message listing these three ways. The CLI never prompts.
+`odoo profile path --check` says whether the stored key is really owner-only on this
+platform; on Windows it is not, so prefer `--api-key-env` there.
 `ODOO_API_KEY` accepts an Odoo API key (preferred) or the user's password.
 Check a connection with `odoo info`. Self-signed on-prem server: `--insecure`
 (or `odoo profile add ... --no-verify-ssl`).
@@ -86,7 +88,8 @@ Refresh it after a module install or an Odoo upgrade with `odoo cache clear`.
 - Errors: one JSON object on stderr, `{"error": {"code": ..., "message": ..., "odoo": {...}}}`.
 - Warnings and write logs: one JSON object per line on stderr.
 - Exit codes: `0` ok, `1` Odoo raised, `2` bad usage, `3` connection or authentication,
-  `4` refused by a guard (writes disabled, missing `--yes`, sensitive model).
+  `4` refused by a guard (writes disabled, missing `--yes`, sensitive model), `5` the query
+  was repaired to make it run, so the rows answer a wider question than the one you asked.
 - Values of fields named like `password`, `api_key`, `secret` are replaced by `[redacted]`
   unless `--no-redact`.
 
@@ -168,8 +171,9 @@ One2many and many2many fields take Odoo commands, written as JSON in `-v` or `--
 6. Dates are strings, `YYYY-MM-DD` or `YYYY-MM-DD HH:MM:SS` in UTC.
 7. Field names drift between Odoo 17, 18 and 19 (for example `account.account.company_id`
    became `company_ids`). If a field is rejected, `odoo fields` is the truth.
-   `--lenient-fields` on `search` removes rejected fields and retries, with a warning on
-   stderr; only use it for exploration, never in a script that relies on the result.
+   `--lenient-fields` on `search` removes rejected fields and retries. It prints the rows and
+   then exits 5, because they answer a wider question than the one you asked. Use it to
+   explore; if you keep it in a script, check the exit code.
 8. Never guess a model name: `odoo alias`, then `odoo models --like invoice`. A dotless
    name close to a known alias is reported as a typo instead of being sent.
 9. Sensitive models (`ir.config_parameter`, `ir.mail_server`, `res.users.apikeys`, `ir.cron`,

{odoo_agent_cli-0.4.0 → odoo_agent_cli-0.5.0}/src/odoocli/__init__.py

@@ -9,6 +9,7 @@ from odoocli.errors import (
     OdooError,
     OdooMissingError,
     OdooRefusedError,
+    OdooRepairedError,
     OdooUsageError,
     OdooValidationError,
 )
@@ -23,6 +24,7 @@ __all__ = [
     "OdooError",
     "OdooMissingError",
     "OdooRefusedError",
+    "OdooRepairedError",
     "OdooUsageError",
     "OdooValidationError",
     "__version__",

{odoo_agent_cli-0.4.0 → odoo_agent_cli-0.5.0}/src/odoocli/_version.py

@@ -1,3 +1,3 @@
 """Single source of the package version (kept import-free to avoid cycles)."""
 
-__version__ = "0.4.0"
+__version__ = "0.5.0"

{odoo_agent_cli-0.4.0 → odoo_agent_cli-0.5.0}/src/odoocli/aliases.py

@@ -10,14 +10,20 @@ Both are pure sugar: they expand to an ordinary domain before anything is sent,
 they never change the shape of the result, and the technical model name always
 keeps working. Aliases apply to read commands only — writing through a name
 that hides a filter would be a good way to create the wrong record.
+
+The tables below ship with the tool. A profile file may add its own under
+``[aliases]`` and ``[presets]``; a user entry with a built-in name replaces it,
+because the tenant knows its own vocabulary better than this file does.
 """
 
 from __future__ import annotations
 
 import difflib
+import tomllib
 from collections.abc import Mapping
 from dataclasses import dataclass, field
 from datetime import date
+from pathlib import Path
 from typing import Any
 
 # Dynamic operands, substituted when a preset is expanded.
@@ -141,7 +147,112 @@ PRESETS: Mapping[str, Preset] = {
 }
 
 
-# ----- lookup -----
+# ----- registry -----
+
+
+@dataclass(frozen=True, slots=True)
+class Registry:
+    """The alias and preset tables in force for one invocation."""
+
+    aliases: Mapping[str, Alias]
+    presets: Mapping[str, Preset]
+
+    def resolve(self, name: str) -> Alias | None:
+        return self.aliases.get(name.strip().lower())
+
+    def resolve_model(self, name: str) -> str:
+        alias = self.resolve(name)
+        return alias.model if alias else name
+
+    def suggest(self, name: str) -> list[str]:
+        return difflib.get_close_matches(
+            name.strip().lower(), sorted(self.aliases), n=3, cutoff=0.6
+        )
+
+    def preset(self, model: str, name: str) -> Preset | None:
+        found = self.presets.get(name.strip().lower())
+        if found is None or (found.models and model not in found.models):
+            return None
+        return found
+
+    def presets_for(self, model: str | None) -> dict[str, Preset]:
+        if model is None:
+            return dict(self.presets)
+        return {n: p for n, p in self.presets.items() if not p.models or model in p.models}
+
+    def expand(self, model: str, token: str, today: date | None = None) -> list[list[Any]] | None:
+        found = self.preset(model, token)
+        return None if found is None else found.clauses(today or date.today())
+
+    def rows(self) -> list[dict[str, Any]]:
+        """Table-friendly listing, marking which entries came from the config file."""
+        return [
+            {
+                "alias": name,
+                "model": alias.model,
+                "filter": ", ".join(f"{f} {o} {v}" for f, o, v in alias.domain),
+                "presets": ", ".join(sorted(self.presets_for(alias.model))),
+                "source": "config" if name not in ALIASES or ALIASES[name] != alias else "builtin",
+                "help": alias.help,
+            }
+            for name, alias in sorted(self.aliases.items())
+        ]
+
+
+BUILTIN = Registry(ALIASES, PRESETS)
+
+
+def _leaves(raw: Any, where: str) -> tuple[tuple[str, str, Any], ...]:
+    if raw is None:
+        return ()
+    if not isinstance(raw, list):
+        raise ValueError(f"{where}: 'domain' must be a list of [field, operator, value]")
+    out: list[tuple[str, str, Any]] = []
+    for leaf in raw:
+        if not isinstance(leaf, list | tuple) or len(leaf) != 3 or not isinstance(leaf[0], str):
+            raise ValueError(
+                f"{where}: every clause must be [field, operator, value], got {leaf!r}"
+            )
+        out.append((str(leaf[0]), str(leaf[1]), leaf[2]))
+    return tuple(out)
+
+
+def from_config(path: Path) -> Registry:
+    """Merge ``[aliases]`` and ``[presets]`` from a profile file over the built-in tables.
+
+    A malformed entry raises rather than being skipped: a filter the caller believes is
+    applied and is not is exactly the failure this whole mechanism exists to avoid.
+    """
+    try:
+        raw = tomllib.loads(path.read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return BUILTIN
+    user_aliases = dict(ALIASES)
+    for name, table in (raw.get("aliases") or {}).items():
+        if not isinstance(table, dict):
+            continue
+        model = table.get("model")
+        if not isinstance(model, str) or "." not in model:
+            raise ValueError(f"alias '{name}': 'model' must be a technical Odoo model name")
+        user_aliases[name.strip().lower()] = Alias(
+            model=model,
+            domain=_leaves(table.get("domain"), f"alias '{name}'"),
+            help=str(table.get("help", "")),
+        )
+    user_presets = dict(PRESETS)
+    for name, table in (raw.get("presets") or {}).items():
+        if not isinstance(table, dict):
+            continue
+        models = table.get("models") or []
+        user_presets[name.strip().lower()] = Preset(
+            domain=_leaves(table.get("domain"), f"preset '{name}'"),
+            help=str(table.get("help", "")),
+            models=tuple(str(m) for m in models) if isinstance(models, list) else (),
+        )
+    return Registry(user_aliases, user_presets)
+
+
+# ----- lookup (the built-in tables) -----
 
 
 def resolve(name: str) -> Alias | None:

{odoo_agent_cli-0.4.0 → odoo_agent_cli-0.5.0}/src/odoocli/cli/alias_cmd.py

@@ -6,8 +6,7 @@ from typing import Any
 
 import typer
 
-from odoocli import aliases
-from odoocli.cli.app import app, emit
+from odoocli.cli.app import app, emit, session
 
 
 @app.command("alias")
@@ -21,8 +20,9 @@ def alias_cmd(
     ),
 ) -> None:
     """Model aliases ('invoices' -> account.move) and presets ('-w overdue'). Offline."""
+    registry = session(ctx).registry()
     if presets:
-        model = aliases.resolve_model(name) if name else None
+        model = registry.resolve_model(name) if name else None
         rows: list[dict[str, Any]] = [
             {
                 "preset": preset_name,
@@ -30,11 +30,11 @@ def alias_cmd(
                 "domain": " and ".join(f"{f} {o} {v}" for f, o, v in preset.domain),
                 "help": preset.help,
             }
-            for preset_name, preset in sorted(aliases.presets_for(model).items())
+            for preset_name, preset in sorted(registry.presets_for(model).items())
         ]
         emit(ctx, rows)
         return
-    listing = aliases.alias_rows()
+    listing = registry.rows()
     if name:
         needle = name.lower()
         listing = [r for r in listing if needle in r["alias"] or needle in r["model"]]

{odoo_agent_cli-0.4.0 → odoo_agent_cli-0.5.0}/src/odoocli/cli/app.py

@@ -89,6 +89,19 @@ def hoist_global_options(args: list[str], value_options: frozenset[str] = frozen
 
 
 class _RootGroup(TyperGroup):
+    def invoke(self, ctx: Any) -> object:
+        """Map every OdooError to its exit code, not only those raised inside ``run()``.
+
+        Offline commands (``alias``, ``cache``) never open a client, so without this they
+        would escape as a traceback and exit 1 whatever the error said.
+        """
+        try:
+            return super().invoke(ctx)
+        except OdooError as e:
+            session_obj = ctx.obj if isinstance(ctx.obj, Session) else None
+            fail(e, bool(session_obj is not None and session_obj.verbose))
+            raise  # unreachable: fail() raises typer.Exit
+
     def parse_args(self, ctx: Any, args: list[str]) -> list[str]:
         return super().parse_args(ctx, hoist_global_options(args, self._value_options(ctx, args)))
 
@@ -154,10 +167,20 @@ class Session:
     env: Mapping[str, str] = field(default_factory=lambda: dict(os.environ))
     config: Path = field(default_factory=lambda: config_path(os.environ))
     _store: SchemaStore | None = field(default=None, repr=False, compare=False)
+    _registry: aliases.Registry | None = field(default=None, repr=False, compare=False)
 
     def profile(self) -> Profile:
         return resolve_profile(self.profile_name, self.env, self.config)
 
+    def registry(self) -> aliases.Registry:
+        """Alias and preset tables, built-ins merged with anything the config file adds."""
+        if self._registry is None:
+            try:
+                self._registry = aliases.from_config(self.config)
+            except ValueError as e:
+                raise OdooUsageError(f"{self.config}: {e}", code="invalid_alias_table") from e
+        return self._registry
+
     def store(self, profile: Profile) -> SchemaStore:
         """Schema cache for this connection, created once per command."""
         if self._store is None:
@@ -322,9 +345,9 @@ def fail(err: OdooError, verbose: bool) -> None:
     raise typer.Exit(err.exit_code)
 
 
-def _unknown_name(name: str) -> OdooUsageError | None:
+def _unknown_name(registry: aliases.Registry, name: str) -> OdooUsageError | None:
     """A name with no dot that is close to an alias is almost certainly a typo."""
-    close = aliases.suggest_alias(name)
+    close = registry.suggest(name)
     if "." in name or not close:
         return None
     return OdooUsageError(
@@ -335,22 +358,22 @@ def _unknown_name(name: str) -> OdooUsageError | None:
     )
 
 
-def read_target(name: str) -> tuple[str, list[list[Any]]]:
+def read_target(registry: aliases.Registry, name: str) -> tuple[str, list[list[Any]]]:
     """Resolve a model name or alias for a read command, with its base clauses."""
-    alias = aliases.resolve(name)
+    alias = registry.resolve(name)
     if alias is not None:
         return alias.model, alias.clauses()
-    problem = _unknown_name(name)
+    problem = _unknown_name(registry, name)
     if problem is not None:
         raise problem
     return name, []
 
 
-def write_target(name: str) -> str:
+def write_target(registry: aliases.Registry, name: str) -> str:
     """Resolve a model name for a write command. Filtered aliases are refused."""
-    alias = aliases.resolve(name)
+    alias = registry.resolve(name)
     if alias is None:
-        problem = _unknown_name(name)
+        problem = _unknown_name(registry, name)
         if problem is not None:
             raise problem
         return name

{odoo_agent_cli-0.4.0 → odoo_agent_cli-0.5.0}/src/odoocli/cli/profile_cmds.py

@@ -2,13 +2,14 @@
 
 from __future__ import annotations
 
+import stat
 from typing import Any
 
 import typer
 
-from odoocli.cli.app import app, emit, fail, session
+from odoocli.cli.app import app, emit, fail, session, warn
 from odoocli.cli.read_cmds import info
-from odoocli.config import load_profiles, remove_profile, save_profile
+from odoocli.config import load_profiles, permissions_enforced, remove_profile, save_profile
 from odoocli.errors import OdooConnectionError
 
 profile_app = typer.Typer(
@@ -111,6 +112,39 @@ def profile_remove(ctx: typer.Context, name: str = typer.Argument(...)) -> None:
 
 
 @profile_app.command("path")
-def profile_path(ctx: typer.Context) -> None:
-    """Print the config file path."""
-    typer.echo(str(session(ctx).config))
+def profile_path(
+    ctx: typer.Context,
+    check: bool = typer.Option(
+        False, "--check", help="Also report whether the file is really owner-only here."
+    ),
+) -> None:
+    """Print the config file path; --check reports what its permissions are worth."""
+    sess = session(ctx)
+    if not check:
+        typer.echo(str(sess.config))
+        return
+    path = sess.config
+    mode = None
+    if path.exists():
+        mode = oct(stat.S_IMODE(path.stat().st_mode))
+    emit(
+        ctx,
+        {
+            "path": str(path),
+            "exists": path.exists(),
+            "mode": mode,
+            "owner_only_permissions": permissions_enforced(),
+        },
+    )
+    if not permissions_enforced():
+        warn(
+            {
+                "warning": "permissions_not_enforced",
+                "path": str(path),
+                "message": (
+                    "This platform cannot restrict the file to its owner: treat the stored "
+                    "API key as readable by anyone with access to this machine, or use "
+                    "--api-key-env instead of --api-key."
+                ),
+            }
+        )

{odoo_agent_cli-0.4.0 → odoo_agent_cli-0.5.0}/src/odoocli/cli/read_cmds.py

@@ -11,6 +11,7 @@ from odoocli.cli.app import (
     check_fields,
     check_model,
     emit,
+    fail,
     read_target,
     run,
     session,
@@ -20,7 +21,7 @@ from odoocli.cli.values import parse_ids, split_fields
 from odoocli.client import AsyncOdooClient
 from odoocli.config import Profile
 from odoocli.domain import build_domain
-from odoocli.errors import OdooMissingError, OdooUsageError
+from odoocli.errors import OdooMissingError, OdooRepairedError, OdooUsageError
 from odoocli.lenient import lenient_search_read
 
 DEFAULT_LIMIT = 80
@@ -100,7 +101,7 @@ def fields(
     sess = session(ctx)
 
     async def go(client: AsyncOdooClient, profile: Profile) -> dict[str, dict[str, Any]]:
-        target, _base = read_target(model)
+        target, _base = read_target(sess.registry(), model)
         check_model(sess, profile, target)
         return await client.fields_get(target, None if all_attributes else FIELD_ATTRIBUTES)
 
@@ -147,7 +148,9 @@ def search(
         False, "--all", help="Fetch every match, paginated. Prefer --format jsonl."
     ),
     lenient: bool = typer.Option(
-        False, "--lenient-fields", help="Drop fields Odoo rejects and retry (warns on stderr)."
+        False,
+        "--lenient-fields",
+        help="Drop fields Odoo rejects and retry. Prints the rows, then exits 5 if it had to.",
     ),
     ids_only: bool = typer.Option(
         False, "--ids-only", help="Return matching ids only (ORM search instead of search_read)."
@@ -155,6 +158,12 @@ def search(
 ) -> None:
     """search_read on a model. Output is the raw Odoo result."""
     sess = session(ctx)
+    repairs: list[dict[str, Any]] = []
+
+    def note_repair(payload: dict[str, Any]) -> None:
+        """A repair is a warning *and* a fact the exit code has to carry."""
+        repairs.append(payload)
+        warn(payload)
 
     async def fetch(
         client: AsyncOdooClient,
@@ -166,14 +175,14 @@ def search(
     ) -> list[dict[str, Any]]:
         if lenient:
             return await lenient_search_read(
-                client, target, dom, flds, lim, off, order, on_warning=warn
+                client, target, dom, flds, lim, off, order, on_warning=note_repair
             )
         return await client.search_read(target, dom, flds, lim, off, order)
 
     async def go(client: AsyncOdooClient, profile: Profile) -> list[Any]:
-        target, base = read_target(model)
+        target, base = read_target(sess.registry(), model)
         check_model(sess, profile, target)
-        dom = build_domain(domain, where, model=target, base=base)
+        dom = build_domain(domain, where, model=target, base=base, registry=sess.registry())
         flds = split_fields(fields_)
         await check_fields(sess, client, profile, target, fields=flds, domain=dom, order=order)
         if ids_only:
@@ -197,6 +206,16 @@ def search(
             off += PAGE_SIZE
 
     emit(ctx, run(ctx, go))
+    if repairs:
+        removed = sorted({str(r.get("field")) for r in repairs})
+        fail(
+            OdooRepairedError(
+                f"--lenient-fields removed {', '.join(removed)} to make the query run: "
+                "the rows above answer a wider question than the one you asked.",
+                data={"removed_fields": removed, "repairs": repairs},
+            ),
+            sess.verbose,
+        )
 
 
 @app.command()
@@ -210,9 +229,9 @@ def count(
     sess = session(ctx)
 
     async def go(client: AsyncOdooClient, profile: Profile) -> int:
-        target, base = read_target(model)
+        target, base = read_target(sess.registry(), model)
         check_model(sess, profile, target)
-        dom = build_domain(domain, where, model=target, base=base)
+        dom = build_domain(domain, where, model=target, base=base, registry=sess.registry())
         await check_fields(sess, client, profile, target, domain=dom)
         return await client.search_count(target, dom)
 
@@ -245,9 +264,9 @@ def group(
     sess = session(ctx)
 
     async def go(client: AsyncOdooClient, profile: Profile) -> list[dict[str, Any]]:
-        target, base = read_target(model)
+        target, base = read_target(sess.registry(), model)
         check_model(sess, profile, target)
-        dom = build_domain(domain, where, model=target, base=base)
+        dom = build_domain(domain, where, model=target, base=base, registry=sess.registry())
         groupby = split_fields(by) or []
         if not groupby:
             raise OdooUsageError("--by needs at least one field")
@@ -288,7 +307,7 @@ def read(
     sess = session(ctx)
 
     async def go(client: AsyncOdooClient, profile: Profile) -> list[dict[str, Any]]:
-        target, _base = read_target(model)
+        target, _base = read_target(sess.registry(), model)
         check_model(sess, profile, target)
         id_list = parse_ids(ids)
         flds = split_fields(fields_)

{odoo_agent_cli-0.4.0 → odoo_agent_cli-0.5.0}/src/odoocli/cli/write_cmds.py

@@ -75,7 +75,7 @@ def create(
     sess = session(ctx)
 
     async def go(client: AsyncOdooClient, profile: Profile) -> Any:
-        target = write_target(model)
+        target = write_target(sess.registry(), model)
         check_model(sess, profile, target)
         vals = _merge_values(values, json_values)
         if not dry_run:
@@ -104,7 +104,7 @@ def write(
     sess = session(ctx)
 
     async def go(client: AsyncOdooClient, profile: Profile) -> Any:
-        target = write_target(model)
+        target = write_target(sess.registry(), model)
         check_model(sess, profile, target)
         id_list = parse_ids(ids)
         vals = _merge_values(values, json_values)
@@ -132,7 +132,7 @@ def unlink(
     sess = session(ctx)
 
     async def go(client: AsyncOdooClient, profile: Profile) -> Any:
-        target = write_target(model)
+        target = write_target(sess.registry(), model)
         check_model(sess, profile, target)
         id_list = parse_ids(ids)
         if dry_run:
@@ -165,7 +165,7 @@ def call(
     sess = session(ctx)
 
     async def go(client: AsyncOdooClient, profile: Profile) -> Any:
-        target = write_target(model)
+        target = write_target(sess.registry(), model)
         check_model(sess, profile, target)
         pos = parse_json_arg(args, "args") or []
         if not isinstance(pos, list):

{odoo_agent_cli-0.4.0 → odoo_agent_cli-0.5.0}/src/odoocli/config.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import contextlib
 import os
 import tomllib
 from collections.abc import Mapping
@@ -69,13 +70,41 @@ def _read(path: Path) -> dict[str, Any]:
         return tomllib.load(fh)
 
 
+FILE_MODE = 0o600
+DIR_MODE = 0o700
+
+
+def permissions_enforced() -> bool:
+    """Whether ``chmod`` actually keeps other users out on this platform.
+
+    On POSIX, mode 600 means what it says. On Windows ``os.chmod`` only toggles the
+    read-only attribute, so the file is as readable as anything else in the user's
+    profile directory. The tool says which of the two it is instead of implying the
+    stronger one everywhere.
+    """
+    return os.name == "posix"
+
+
 def _write(path: Path, data: dict[str, Any]) -> None:
+    """Write the profiles atomically, and never leave the key readable in between.
+
+    The temporary file is *created* with mode 600 rather than created and then
+    chmod-ed: with a permissive umask, the second form leaves a window in which the
+    API key sits in a world-readable file.
+    """
     path.parent.mkdir(parents=True, exist_ok=True)
-    os.chmod(path.parent, 0o700)
+    with contextlib.suppress(OSError):
+        os.chmod(path.parent, DIR_MODE)
     tmp = path.with_suffix(".tmp")
-    with tmp.open("wb") as fh:
-        tomli_w.dump(data, fh)
-    os.chmod(tmp, 0o600)
+    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, FILE_MODE)
+    try:
+        with os.fdopen(fd, "wb") as fh:
+            tomli_w.dump(data, fh)
+    except BaseException:
+        tmp.unlink(missing_ok=True)
+        raise
+    with contextlib.suppress(OSError):
+        os.chmod(tmp, FILE_MODE)
     os.replace(tmp, path)
 
 

{odoo_agent_cli-0.4.0 → odoo_agent_cli-0.5.0}/src/odoocli/domain.py

@@ -16,7 +16,8 @@ _UNARY_OP = "!"
 # Trailing "(#42)" of a humanised many2one ("Name (#42)"), as produced by
 # LLM-facing layers. Recovered back to the int id when fed into a domain.
 _HUMANIZED_M2O_RE = re.compile(r"\(#(\d+)\)\s*$")
-_DROP = object()
+_TRUE = object()
+"""A sub-expression that matches everything, once the field it filtered on is removed."""
 
 
 # ----- normalisation (ported from UpBoard's OdooConnector) -----
@@ -103,30 +104,59 @@ def _parse(tokens: list[Any], pos: int) -> tuple[Any, int]:
     return ("leaf", tok), pos + 1
 
 
+def _mentions(node: Any, bad_field: str) -> bool:
+    kind = node[0]
+    if kind == "leaf":
+        term = node[1]
+        return bool(_is_leaf(term) and term[0] == bad_field)
+    if kind == "not":
+        return _mentions(node[1], bad_field)
+    return _mentions(node[2], bad_field) or _mentions(node[3], bad_field)
+
+
 def _serialize(node: Any, bad_field: str) -> Any:
+    """Replace every leaf on ``bad_field`` with "matches everything", then simplify.
+
+    Repairing a query may only ever widen it. Two places make that non-obvious:
+
+    * Under ``!``, weakening the operand *strengthens* the result, so the whole negation
+      has to go rather than the leaf inside it.
+    * Under ``|``, an operand that matches everything absorbs the disjunction. Keeping
+      only the other operand would drop records the caller explicitly asked for.
+    """
     kind = node[0]
     if kind == "leaf":
         term = node[1]
         if _is_leaf(term) and term[0] == bad_field:
-            return _DROP
+            return _TRUE
         return [term]
     if kind == "not":
-        child = _serialize(node[1], bad_field)
-        return _DROP if child is _DROP else [_UNARY_OP, *child]
+        if _mentions(node[1], bad_field):
+            return _TRUE
+        return [_UNARY_OP, *_serialize(node[1], bad_field)]
     _, operator, left_node, right_node = node
     left = _serialize(left_node, bad_field)
     right = _serialize(right_node, bad_field)
-    if left is _DROP and right is _DROP:
-        return _DROP
-    if left is _DROP:
+    if operator == "|":
+        if left is _TRUE or right is _TRUE:
+            return _TRUE
+        return [operator, *left, *right]
+    if left is _TRUE and right is _TRUE:
+        return _TRUE
+    if left is _TRUE:
         return right
-    if right is _DROP:
+    if right is _TRUE:
         return left
     return [operator, *left, *right]
 
 
 def strip_field_from_domain(domain: Any, bad_field: str) -> Any:
-    """Remove every leaf on ``bad_field``; ``|``/``&`` fold onto the surviving operand."""
+    """Remove every constraint on ``bad_field``, widening the domain and never narrowing it.
+
+    Every record the original domain matched still matches the result. That is the only
+    property that makes an automatic repair defensible: returning extra rows is visible,
+    losing rows the caller asked for is not.
+    """
     if not isinstance(domain, list) or not domain:
         return domain
     try:
@@ -135,7 +165,7 @@ def strip_field_from_domain(domain: Any, bad_field: str) -> Any:
         while pos < len(domain):
             node, pos = _parse(domain, pos)
             serialized = _serialize(node, bad_field)
-            if serialized is not _DROP:
+            if serialized is not _TRUE:
                 cleaned.extend(serialized)
         return cleaned
     except (IndexError, TypeError):
@@ -218,10 +248,12 @@ def parse_where(expr: str) -> list[Any]:
 _BARE_WORD_RE = re.compile(r"^[A-Za-z][\w-]*$")
 
 
-def _parse_condition(model: str | None, token: str, today: date | None) -> list[list[Any]]:
+def _parse_condition(
+    model: str | None, token: str, today: date | None, registry: aliases.Registry
+) -> list[list[Any]]:
     """One ``-w`` token: a preset name if it is one, otherwise a domain leaf."""
     if model is not None:
-        expanded = aliases.expand(model, token, today)
+        expanded = registry.expand(model, token, today)
         if expanded is not None:
             return expanded
     try:
@@ -229,7 +261,7 @@ def _parse_condition(model: str | None, token: str, today: date | None) -> list[
     except OdooUsageError:
         if not _BARE_WORD_RE.match(token.strip()):
             raise
-        known = sorted(aliases.presets_for(model))
+        known = sorted(registry.presets_for(model))
         raise OdooUsageError(
             f"{token!r} is neither a condition nor a preset"
             + (f" for {model}" if model else "")
@@ -245,15 +277,17 @@ def build_domain(
     model: str | None = None,
     base: list[list[Any]] | None = None,
     today: date | None = None,
+    registry: aliases.Registry | None = None,
 ) -> list[Any]:
     """AND the alias clauses, an optional JSON domain and every ``-w`` condition.
 
     ``model`` enables preset names in ``-w``; without it every token must be a
     plain ``field op value`` condition.
     """
+    table = registry or aliases.BUILTIN
     out: list[Any] = list(base or [])
     if domain:
         out += sanitize_domain(normalize_domain(domain))
     for token in where:
-        out += _parse_condition(model, token, today)
+        out += _parse_condition(model, token, today, table)
     return out

{odoo_agent_cli-0.4.0 → odoo_agent_cli-0.5.0}/src/odoocli/errors.py

@@ -79,6 +79,17 @@ class OdooUsageError(OdooError):
     default_code = "usage_error"
 
 
+class OdooRepairedError(OdooError):
+    """The query was repaired to make it run, so the result answers a wider question.
+
+    Raised after the data has been printed: the rows are real, they are simply not the
+    rows that were asked for. A human exploring can ignore it; a script cannot.
+    """
+
+    exit_code = 5
+    default_code = "result_repaired"
+
+
 _BY_EXCEPTION_NAME: dict[str, type[OdooError]] = {
     "odoo.exceptions.AccessDenied": OdooAuthError,
     "odoo.exceptions.AccessError": OdooAccessError,