omdev 0.0.52__tar.gz → 0.0.54__tar.gz

{omdev-0.0.52/omdev.egg-info → omdev-0.0.54}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: omdev
-Version: 0.0.52
+Version: 0.0.54
 Summary: omdev
 Author: wrmsr
 License-Expression: BSD-3-Clause
@@ -14,11 +14,11 @@ Classifier: Programming Language :: Python :: 3.15
 Requires-Python: >=3.14
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: omcore==0.0.52
+Requires-Dist: omcore==0.0.54
 Provides-Extra: ominfra
-Requires-Dist: ominfra==0.0.52; extra == "ominfra"
+Requires-Dist: ominfra==0.0.54; extra == "ominfra"
 Provides-Extra: omllm
-Requires-Dist: omllm==0.0.52; extra == "omllm"
+Requires-Dist: omllm==0.0.54; extra == "omllm"
 Provides-Extra: black
 Requires-Dist: black~=26.5; extra == "black"
 Provides-Extra: c
@@ -26,9 +26,6 @@ Requires-Dist: pycparser~=3.0; extra == "c"
 Requires-Dist: pcpp~=1.30; extra == "c"
 Provides-Extra: doc
 Requires-Dist: docutils~=0.23; extra == "doc"
-Requires-Dist: markdown-it-py~=4.2; extra == "doc"
-Requires-Dist: mdit-py-plugins~=0.6; extra == "doc"
-Requires-Dist: pygments~=2.21; extra == "doc"
 Provides-Extra: mypy
 Requires-Dist: mypy~=2.3; extra == "mypy"
 Provides-Extra: ocr
@@ -44,8 +41,6 @@ Provides-Extra: qr
 Requires-Dist: segno~=1.6; extra == "qr"
 Provides-Extra: ruff
 Requires-Dist: ruff~=0.16; extra == "ruff"
-Provides-Extra: tui
-Requires-Dist: rich~=15.0; extra == "tui"
 Provides-Extra: tui-syntax
 Requires-Dist: tree-sitter~=0.26; extra == "tui-syntax"
 Requires-Dist: tree-sitter-bash~=0.25; extra == "tui-syntax"
@@ -64,21 +59,18 @@ Requires-Dist: tree-sitter-toml~=0.7; extra == "tui-syntax"
 Requires-Dist: tree-sitter-xml~=0.7; extra == "tui-syntax"
 Requires-Dist: tree-sitter-yaml~=0.7; extra == "tui-syntax"
 Provides-Extra: cext
-Requires-Dist: omdev-cext==0.0.52; extra == "cext"
+Requires-Dist: omdev-cext==0.0.54; extra == "cext"
 Provides-Extra: rs
-Requires-Dist: omdev-rs==0.0.52; extra == "rs"
+Requires-Dist: omdev-rs==0.0.54; extra == "rs"
 Provides-Extra: cli
-Requires-Dist: omdev-cli==0.0.52; extra == "cli"
+Requires-Dist: omdev-cli==0.0.54; extra == "cli"
 Provides-Extra: all
-Requires-Dist: ominfra==0.0.52; extra == "all"
-Requires-Dist: omllm==0.0.52; extra == "all"
+Requires-Dist: ominfra==0.0.54; extra == "all"
+Requires-Dist: omllm==0.0.54; extra == "all"
 Requires-Dist: black~=26.5; extra == "all"
 Requires-Dist: pycparser~=3.0; extra == "all"
 Requires-Dist: pcpp~=1.30; extra == "all"
 Requires-Dist: docutils~=0.23; extra == "all"
-Requires-Dist: markdown-it-py~=4.2; extra == "all"
-Requires-Dist: mdit-py-plugins~=0.6; extra == "all"
-Requires-Dist: pygments~=2.21; extra == "all"
 Requires-Dist: mypy~=2.3; extra == "all"
 Requires-Dist: pytesseract~=0.3; extra == "all"
 Requires-Dist: rapidocr-onnxruntime~=1.4; extra == "all"
@@ -87,7 +79,6 @@ Requires-Dist: gprof2dot~=2025.4; extra == "all"
 Requires-Dist: basedpyright~=1.39; extra == "all"
 Requires-Dist: segno~=1.6; extra == "all"
 Requires-Dist: ruff~=0.16; extra == "all"
-Requires-Dist: rich~=15.0; extra == "all"
 Requires-Dist: tree-sitter~=0.26; extra == "all"
 Requires-Dist: tree-sitter-bash~=0.25; extra == "all"
 Requires-Dist: tree-sitter-css~=0.25; extra == "all"
@@ -104,9 +95,9 @@ Requires-Dist: tree-sitter-sql~=0.3; extra == "all"
 Requires-Dist: tree-sitter-toml~=0.7; extra == "all"
 Requires-Dist: tree-sitter-xml~=0.7; extra == "all"
 Requires-Dist: tree-sitter-yaml~=0.7; extra == "all"
-Requires-Dist: omdev-cext==0.0.52; extra == "all"
-Requires-Dist: omdev-rs==0.0.52; extra == "all"
-Requires-Dist: omdev-cli==0.0.52; extra == "all"
+Requires-Dist: omdev-cext==0.0.54; extra == "all"
+Requires-Dist: omdev-rs==0.0.54; extra == "all"
+Requires-Dist: omdev-cli==0.0.54; extra == "all"
 Dynamic: license-file
 
 # Overview

{omdev-0.0.52 → omdev-0.0.54}/omdev/.om-manifests.json

@@ -71,18 +71,6 @@
       }
     }
   },
-  {
-    "module": ".diffs.__main__",
-    "attr": "_CLI_MODULE",
-    "file": "omdev/diffs/__main__.py",
-    "line": 4,
-    "value": {
-      "!.cli.types.CliModule": {
-        "name": "diffs",
-        "module": "omdev.diffs.__main__"
-      }
-    }
-  },
   {
     "module": ".dockerdev.__main__",
     "attr": "_CLI_MODULE",
@@ -586,14 +574,14 @@
     }
   },
   {
-    "module": ".tui.rich.diff.__main__",
+    "module": ".tui.diff.__main__",
     "attr": "_CLI_MODULE",
-    "file": "omdev/tui/rich/diff/__main__.py",
+    "file": "omdev/tui/diff/__main__.py",
     "line": 4,
     "value": {
       "!.cli.types.CliModule": {
         "name": "tui/diff",
-        "module": "omdev.tui.rich.diff.__main__"
+        "module": "omdev.tui.diff.__main__"
       }
     }
   }

{omdev-0.0.52 → omdev-0.0.54}/omdev/__about__.py

@@ -28,16 +28,12 @@ class Project(ProjectBase):
 
         'c': [
             'pycparser ~= 3.0',
+
             'pcpp ~= 1.30',
         ],
 
         'doc': [
             'docutils ~= 0.23',
-
-            'markdown-it-py ~= 4.2',
-            'mdit-py-plugins ~= 0.6',
-
-            'pygments ~= 2.21',
         ],
 
         'mypy': [
@@ -76,10 +72,6 @@ class Project(ProjectBase):
         #     'pgcli ~= 4.6',
         # ],
 
-        'tui': [
-            'rich ~= 15.0',
-        ],
-
         'tui-syntax': [
             'tree-sitter ~= 0.26',
             'tree-sitter-bash ~= 0.25',

omdev-0.0.54/omdev/home/secretinject.py

@@ -0,0 +1,330 @@
+#!/usr/bin/env python3
+# @om-lite
+# @om-script
+# ruff: noqa: UP006 UP045
+"""
+inject_secret.py -- atomically upsert keys into a JSON object file, safely in the presence of concurrent invocations of
+itself.
+
+    printf '{"db_password": "%s", "legacy_token": null}' "$DB_PASSWORD" | inject_secret.py /etc/app/config.json
+
+Stdin is a JSON object, shallowly merged into the file (which must hold a JSON object, or not exist yet): each key is
+upserted wholesale -- values can be anything, but dicts and lists are replaced, never merged -- and a null value removes
+the key.
+
+Key order records modification order: keys not mentioned on stdin are written in the order they were read, followed by
+every key set on stdin -- whether or not its value actually changed -- in the order they appear there. Removed keys are
+simply dropped. If the result is identical to the current contents (same keys, values and order, compared by JSON
+serialization, so 1, 1.0 and true are distinct) the file is not rewritten.
+
+Output is pretty-printed with a two space indent, except that an empty object is written as exactly `{}`.
+
+Guarantees (Linux only; needs nothing newer than flock(2), link(2), rename(2)):
+
+  * Nobody ever observes a partial, empty or invalid file at the path. The path is only ever populated by link(2)
+    (create) or rename(2) (replace) of a fully written and fsync'd temp file in the same directory.
+  * Concurrent invocations never lose each other's updates, whether or not the file exists beforehand.
+
+How the lock and the atomic replace are combined:
+
+  flock(2) locks an *inode*, not a path, and rename(2) swaps the inode behind the path. A writer that holds the lock on
+  the old inode and renames a new file into place therefore leaves waiters holding a lock on a stale inode. The fix:
+  after acquiring the lock, compare fstat(fd) with stat(path); if they differ, release and start over against the
+  current file. Every replacement is performed by the holder of the lock on the inode currently at the path, so writers
+  are fully serialized.
+
+  Creation: rename(2) clobbers unconditionally, so bootstrapping via rename could overwrite a file a concurrent writer
+  just populated. link(2) fails with EEXIST if the target exists, so it is the atomic create-if-absent.
+
+Exit status: 0 ok, 1 error, 2 usage, 3 lock timeout.
+"""
+import argparse
+import collections
+import errno
+import fcntl
+import json
+import os
+import random
+import stat
+import sys
+import tempfile
+import time
+import typing as ta
+
+
+##
+
+
+# seconds; jittered so waiters don't wake in lockstep
+POLL_MIN = 0.005
+POLL_MAX = 0.05
+
+# mode for a file we create; existing files keep theirs
+NEW_FILE_MODE = 0o600
+
+JsonObject = ta.OrderedDict[str, ta.Any]  # ta.TypeAlias
+
+
+def write_all(fd: int, data: bytes) -> None:
+    view = memoryview(data)
+    while view:
+        view = view[os.write(fd, view):]
+
+
+def read_all(fd: int) -> bytes:
+    chunks: ta.List[bytes] = []
+    while True:
+        chunk = os.read(fd, 1 << 16)
+        if not chunk:
+            return b''.join(chunks)
+        chunks.append(chunk)
+
+
+def fsync_dir(dirname: str) -> None:
+    """Persist the directory entry (the link/rename itself) after a crash."""
+
+    fd = os.open(dirname, os.O_RDONLY)
+    try:
+        os.fsync(fd)
+    except OSError:
+        pass  # some filesystems refuse fsync on directories; not fatal
+    finally:
+        os.close(fd)
+
+
+def write_temp(
+        dirname: str,
+        basename: str,
+        data: bytes,
+        mode: int,
+        *,
+        uid_gid: ta.Optional[ta.Tuple[int, int]] = None,
+) -> str:
+    """Write data to a fresh, fsync'd temp file next to the target. Returns its path."""
+
+    fd, tmp = tempfile.mkstemp(prefix='.' + basename + '.', suffix='.tmp', dir=dirname)
+
+    try:
+        if uid_gid is not None:
+            uid, gid = uid_gid
+            try:
+                os.fchown(fd, uid, gid)
+            except PermissionError:
+                pass  # not root; the file keeps our ownership
+
+        os.fchmod(fd, mode)
+        write_all(fd, data)
+        os.fsync(fd)
+
+    except BaseException:
+        os.close(fd)
+        os.unlink(tmp)
+        raise
+
+    os.close(fd)
+    return tmp
+
+
+def parse_object(text: str) -> JsonObject:
+    data = json.loads(text, object_pairs_hook=collections.OrderedDict)
+    if not isinstance(data, collections.OrderedDict):
+        raise ValueError('top-level JSON value is not an object')  # noqa
+    return data
+
+
+def load(raw: bytes) -> JsonObject:
+    text = raw.decode('utf-8')
+    if not text.strip():
+        return collections.OrderedDict()  # tolerate an empty/whitespace-only file (e.g. `touch`ed)
+    return parse_object(text)
+
+
+def dump(data: JsonObject) -> bytes:
+    if not data:
+        return b'{}'
+    return (json.dumps(data, indent=2, ensure_ascii=False) + '\n').encode('utf-8')
+
+
+def values_equal(a: ta.Any, b: ta.Any) -> bool:
+    """Compare by JSON serialization: 1, 1.0 and true are all distinct, and key order within nested objects matters."""
+
+    return json.dumps(a) == json.dumps(b)
+
+
+def merge(
+        existing: JsonObject,
+        update: JsonObject,
+) -> ta.Tuple[JsonObject, bool]:
+    """
+    Shallowly apply `update` to `existing`: a None value removes the key, any other value replaces it wholesale. Returns
+    the merged object -- keys not in `update` first, in their existing order, then every key set by `update` in `update`
+    order, even if its value is unchanged -- and whether the result differs from `existing` at all.
+    """
+
+    merged: JsonObject = collections.OrderedDict(
+        (k, v) for k, v in existing.items() if k not in update
+    )
+    merged.update((k, v) for k, v in update.items() if v is not None)
+    return merged, not values_equal(merged, existing)
+
+
+def try_create(
+        path: str,
+        dirname: str,
+        basename: str,
+        data: JsonObject,
+) -> bool:
+    """Atomically create `path` with `data` iff it does not exist. True on success."""
+
+    tmp = write_temp(
+        dirname,
+        basename,
+        dump(data),
+        NEW_FILE_MODE,
+    )
+
+    try:
+        os.link(tmp, path)
+
+    except FileExistsError:
+        return False  # someone beat us to it; caller will lock and update that file
+
+    except OSError as e:
+        if e.errno in (errno.EPERM, errno.EOPNOTSUPP, errno.EXDEV, errno.EMLINK):
+            raise OSError(
+                e.errno,
+                f'filesystem does not allow hard links, which are needed to create the file atomically: {e.strerror}',
+                path,
+            ) from None
+
+        raise
+
+    finally:
+        os.unlink(tmp)
+
+    fsync_dir(dirname)
+    return True
+
+
+def inject(
+        path: str,
+        update: JsonObject,
+        timeout: float,
+) -> None:
+    path = os.path.realpath(path)  # operate on the real file if `path` is a symlink
+    dirname, basename = os.path.split(path)
+    deadline = time.monotonic() + timeout
+
+    while True:
+        try:
+            fd = os.open(path, os.O_RDONLY)
+
+        except FileNotFoundError:
+            merged, _ = merge(collections.OrderedDict(), update)
+
+            if try_create(
+                    path,
+                    dirname,
+                    basename,
+                    merged,
+            ):
+                return
+
+            continue  # lost the create race; lock whatever exists now
+
+        try:
+            try:
+                fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+            except BlockingIOError:
+                if time.monotonic() >= deadline:
+                    raise TimeoutError(f'timed out waiting for lock on {path}') from None
+                time.sleep(random.uniform(POLL_MIN, POLL_MAX))
+                continue
+
+            # We hold a lock on *an* inode. Make sure it is still the one at `path`: a concurrent writer may have
+            # rename()d a new file over it while we waited.
+            st = os.fstat(fd)
+
+            try:
+                cur = os.stat(path)
+            except FileNotFoundError:
+                continue  # deleted underneath us; go recreate
+
+            if (st.st_dev, st.st_ino) != (cur.st_dev, cur.st_ino):
+                continue  # stale inode; retry against the current file
+            if not stat.S_ISREG(st.st_mode):
+                raise OSError(errno.EINVAL, 'not a regular file', path)
+
+            try:
+                existing = load(read_all(fd))
+            except ValueError as e:
+                raise ValueError(f'{path}: {e}') from None
+
+            merged, changed = merge(existing, update)
+            if not changed:
+                return  # nothing to do; don't churn the file
+
+            tmp = write_temp(
+                dirname,
+                basename,
+                dump(merged),
+                stat.S_IMODE(st.st_mode),
+                uid_gid=(st.st_uid, st.st_gid),
+            )
+
+            try:
+                os.rename(tmp, path)  # atomic replace, done while holding the lock
+            except BaseException:
+                os.unlink(tmp)
+                raise
+
+            fsync_dir(dirname)
+            return
+
+        finally:
+            os.close(fd)  # releases the flock
+
+
+def main(argv: ta.Any = None) -> int:
+    ap = argparse.ArgumentParser(
+        description='Atomically upsert keys into a JSON object file; the update is a JSON object read from stdin.',
+    )
+
+    ap.add_argument(
+        'file',
+        help='JSON file to update (created if missing)',
+    )
+    ap.add_argument(
+        '--timeout',
+        type=float,
+        default=30.0,
+        help='max seconds to wait for the lock (default: 30)',
+    )
+    ap.add_argument(
+        '--description',
+        help='ignored; only serves as a note in process listings and execution logs',
+    )
+
+    args = ap.parse_args(argv)
+
+    try:
+        update = parse_object(sys.stdin.buffer.read().decode('utf-8'))
+    except ValueError as e:  # covers UnicodeDecodeError and json.JSONDecodeError
+        print(f'error: stdin is not a JSON object: {e}', file=sys.stderr)
+        return 1
+
+    try:
+        inject(args.file, update, args.timeout)
+    except TimeoutError as e:
+        print(f'error: {e}', file=sys.stderr)
+        return 3
+
+    except (OSError, ValueError) as e:
+        print(f'error: {e}', file=sys.stderr)
+        return 1
+
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main())

{omdev-0.0.52 → omdev-0.0.54}/omdev/home/secrets.py

@@ -1,7 +1,8 @@
 import os.path
 import typing as ta
 
-from omcore.formats.yaml import all as yaml
+from omcore import lang
+from omcore.configs.formats import DEFAULT_CONFIG_FILE_LOADER
 from omcore.os.environ import EnvVar
 from omcore.secrets import all as sec
 
@@ -11,25 +12,34 @@ from .paths import get_home_paths
 ##
 
 
-SECRETS_FILE_ENV_VAR = EnvVar('OM_SECRETS')
-DEFAULT_SECRETS_FILE_NAME = 'secrets.yml'
+INJECTED_SECRETS_FILE_ENV_VAR = EnvVar('OM_SECRETS')
+DEFAULT_INJECTED_SECRETS_FILE_NAME: ta.Final = 'secrets-injected.json'
 
+USER_SECRETS_FILE_ENV_VAR = EnvVar('OM_SECRETS_INJECTED')
+DEFAULT_USER_SECRETS_FILE_NAME: ta.Final = 'secrets.yml'
 
-def get_secrets_file() -> str:
-    return os.path.expanduser(
-        SECRETS_FILE_ENV_VAR.get(lambda: os.path.join(get_home_paths().config_dir, DEFAULT_SECRETS_FILE_NAME)),
-    )
+
+def _get_secrets_file_paths() -> lang.SequenceNotStr[str]:
+    return [
+        os.path.expanduser(p)
+        for ev, dfn in [
+            (INJECTED_SECRETS_FILE_ENV_VAR, DEFAULT_INJECTED_SECRETS_FILE_NAME),
+            (USER_SECRETS_FILE_ENV_VAR, DEFAULT_USER_SECRETS_FILE_NAME),
+        ]
+        for p_ in ev.get(lambda: os.path.join(get_home_paths().config_dir, dfn)).split(os.pathsep)
+        if (p := p_.strip())
+    ]
 
 
 def load_secrets() -> sec.Secrets:
     dct: dict[str, sec.Secret] = {}
-    try:
-        with open(get_secrets_file()) as f:
-            for k, v in yaml.loads(f.read()).items():
+    for fp in _get_secrets_file_paths():
+        try:
+            for k, v in DEFAULT_CONFIG_FILE_LOADER.load_file(fp).as_map().items():
                 if isinstance(v, str):
                     dct[k] = sec.Secret(key=k, value=v)
-    except FileNotFoundError:
-        pass
+        except FileNotFoundError:
+            pass
     return sec.MappingSecrets(dct)
 
 

{omdev-0.0.52 → omdev-0.0.54}/omdev/js/quickjs/_quickjs/libunicode.c

@@ -1053,6 +1053,11 @@ int unicode_normalize(uint32_t **pdst, const uint32_t *src, int src_len,
     int *buf, buf_len, i, p, starter_pos, cc, last_cc, out_len;
     bool is_compat;
     DynBuf dbuf_s, *dbuf = &dbuf_s;
+    
+    if (src_len == 0) {
+        *pdst = NULL;
+        return 0;
+    }
 
     is_compat = n_type >> 1;
 

{omdev-0.0.52 → omdev-0.0.54}/omdev/js/quickjs/_quickjs/quickjs-libc.c

@@ -197,6 +197,8 @@ typedef struct JSThreadState {
 #endif // USE_WORKER
     JSClassID std_file_class_id;
     JSClassID worker_class_id;
+    JSInterruptHandler *prev_interrupt_handler;
+    void *prev_interrupt_opaque;
 } JSThreadState;
 
 static uint64_t os_pending_signals;
@@ -1085,7 +1087,13 @@ static JSValue js_std_gc(JSContext *ctx, JSValueConst this_val,
 
 static int interrupt_handler(JSRuntime *rt, void *opaque)
 {
-    return (os_pending_signals >> SIGINT) & 1;
+    JSThreadState *ts = opaque;
+
+    if (1 & (os_pending_signals >> SIGINT))
+        return 1;
+    if (ts->prev_interrupt_handler)
+        return ts->prev_interrupt_handler(rt, ts->prev_interrupt_opaque);
+    return 0;
 }
 
 static JSValue js_evalScript(JSContext *ctx, JSValueConst this_val,
@@ -1148,7 +1156,14 @@ static JSValue js_evalScript(JSContext *ctx, JSValueConst this_val,
     }
     if (!ts->recv_pipe && ++ts->eval_script_recurse == 1) {
         /* install the interrupt handler */
-        JS_SetInterruptHandler(JS_GetRuntime(ctx), interrupt_handler, NULL);
+        ts->prev_interrupt_handler =
+            (JSInterruptHandler *)js_std_cmd(/*GetInterruptHandler*/5, rt);
+        ts->prev_interrupt_opaque =
+            (void *)js_std_cmd(/*GetInterruptOpaque*/6, rt);
+        // FIXME(bnoordhuis) Questionable hack to make the REPL interruptible.
+        // Ideally qjs installs a signal handler + interrupt handler but then
+        // scripts can intercept it with os.signal(SIGINT).
+        JS_SetInterruptHandler(JS_GetRuntime(ctx), interrupt_handler, ts);
     }
     flags = compile_module ? JS_EVAL_TYPE_MODULE : JS_EVAL_TYPE_GLOBAL;
     if (backtrace_barrier)
@@ -1166,7 +1181,11 @@ static JSValue js_evalScript(JSContext *ctx, JSValueConst this_val,
     JS_FreeCString(ctx, str);
     if (!ts->recv_pipe && --ts->eval_script_recurse == 0) {
         /* remove the interrupt handler */
-        JS_SetInterruptHandler(JS_GetRuntime(ctx), NULL, NULL);
+        JS_SetInterruptHandler(JS_GetRuntime(ctx),
+                               ts->prev_interrupt_handler,
+                               ts->prev_interrupt_opaque);
+        ts->prev_interrupt_handler = NULL;
+        ts->prev_interrupt_opaque = NULL;
         os_pending_signals &= ~((uint64_t)1 << SIGINT);
         /* convert the uncatchable "interrupted" error into a normal error
            so that it can be caught by the REPL */