plugsync-cli 0.5.0__tar.gz → 0.7.0__tar.gz

{plugsync_cli-0.5.0 → plugsync_cli-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugsync-cli
-Version: 0.5.0
+Version: 0.7.0
 Summary: Command-line client for plugsync HubSpot connectors -- manage connectors and plugins like code, no repo checkout required
 Author-email: Exelab <hello@plugsync.com>
 License: Proprietary

{plugsync_cli-0.5.0 → plugsync_cli-0.7.0}/plugsync_cli/__init__.py

@@ -1,2 +1,2 @@
 """PluSync CLI — git-like connector management."""
-__version__ = "0.5.0"
+__version__ = "0.7.0"

{plugsync_cli-0.5.0 → plugsync_cli-0.7.0}/plugsync_cli/commands/diff.py

@@ -51,15 +51,21 @@ from typing import Any
 
 import click
 from rich.console import Console
+from rich.markup import escape
 from rich.table import Table
 
 from plugsync_cli.context import build_client, fail, load_context
 from plugsync_cli.schema_defaults import SchemaNode, plugin_embedded_fields, schema_root
+from plugsync_cli.serializer import OPTIONAL_COLLECTIONS
 
 console = Console()
 
 # Top-level config keys compared item-by-item (keyed by name) rather than whole.
-COLLECTIONS = {"entities": "entity", "flows": "flow"}
+# `sources` reads like the other two here: a published version from before the
+# sources were versioned simply carries no key, so every local source shows up
+# as added, which is what it is against that version. The local side always
+# declares the key: `read_config_directory` refuses a directory that does not.
+COLLECTIONS = {"entities": "entity", "flows": "flow", "sources": "source"}
 
 # Keys listed in one Detail cell before the rest is summarized. A row exists to
 # tell an operator where to look, and forty paths in a table cell do not.
@@ -198,6 +204,7 @@ def _diff_configs(local: dict, remote: dict, root: SchemaNode) -> list[dict]:
 
     for key, label in COLLECTIONS.items():
         member = root.child(key).item()
+        changes.extend(_declaration_change(key, local, remote))
         local_items, remote_items = _by_name(local.get(key)), _by_name(remote.get(key))
         for name in sorted(set(local_items) | set(remote_items)):
             if name not in remote_items:
@@ -228,6 +235,30 @@ def _diff_configs(local: dict, remote: dict, root: SchemaNode) -> list[dict]:
     return changes
 
 
+def _declaration_change(key: str, local: dict, remote: dict) -> list[dict]:
+    """The row for a collection the local files declare and the version does not.
+
+    Only an optional collection can be in that position, and only one way
+    round: the local directory always declares `sources` (a directory that does
+    not is refused before this runs), while a version published before the
+    sources were part of the config carries no key. Item by item "declared, and
+    empty" reads the same as that historical absence -- no sources either way
+    -- so without this row a directory with `sources: []` would diff clean
+    against a version that says nothing about sources.
+    """
+    if key not in OPTIONAL_COLLECTIONS or remote.get(key) is not None:
+        return []
+    return [
+        _simple(
+            f"{key}_key_added",
+            key,
+            f"declared in your files, absent from the published version, which "
+            f"predates {key} being part of the config: publishing makes the "
+            f"config the authority for the connector's {key}",
+        )
+    ]
+
+
 def _simple(change_type: str, scope: str, detail: str) -> dict:
     return {
         "type": change_type,
@@ -264,7 +295,12 @@ def _table(changes: list[dict]) -> Table:
     # name -- which is the part this column exists to show.
     table.add_column("Detail", overflow="fold")
     for change in changes:
-        table.add_row(_mark(change["type"]), change["scope"], change["detail"])
+        # escape: item names and key paths come from the config, and one in
+        # brackets is valid rich markup that would be read as a style tag and
+        # swallowed, taking the name this column exists to show with it.
+        table.add_row(
+            _mark(change["type"]), escape(change["scope"]), escape(change["detail"])
+        )
     return table
 
 

{plugsync_cli-0.5.0 → plugsync_cli-0.7.0}/plugsync_cli/commands/preview.py

@@ -1,6 +1,7 @@
 """plugsync preview -- what publishing the draft would change."""
 import click
 from rich.console import Console
+from rich.markup import escape
 from rich.table import Table
 
 from plugsync_cli.context import (
@@ -55,11 +56,18 @@ def preview(path: str | None):
         console.print(f"\n[bold]Publishing would apply {len(changes)} change(s)[/bold]\n")
         table = Table(show_header=True, header_style="bold")
         table.add_column("Change", width=24)
-        table.add_column("Detail")
+        # fold, and escape below: a change detail carries the key path the
+        # server names it by, and a name in brackets (`sources[hubspot].config`)
+        # is both valid rich markup, which would swallow the name, and one
+        # unbreakable word, which ellipsizing would cut at the wrong end.
+        table.add_column("Detail", overflow="fold")
         for change in changes:
-            scope = change.get("entity") or change.get("event_flow") or ""
-            detail = change.get("detail", "")
-            table.add_row(_mark(change.get("type", "unknown")), f"[bold]{scope}[/bold] {detail}" if scope else detail)
+            scope = escape(str(change.get("entity") or change.get("event_flow") or ""))
+            detail = escape(str(change.get("detail", "")))
+            table.add_row(
+                _mark(change.get("type", "unknown")),
+                f"[bold]{scope}[/bold] {detail}" if scope else detail,
+            )
         console.print(table)
 
     render_preflight(console, client.preflight(context.connector_id))

{plugsync_cli-0.5.0 → plugsync_cli-0.7.0}/plugsync_cli/commands/pull.py

@@ -4,7 +4,12 @@ from pathlib import Path
 import click
 from rich.console import Console
 
-from plugsync_cli.context import build_client, fail, warn_if_flow_order_is_not_preserved
+from plugsync_cli.context import (
+    build_client,
+    describe_config,
+    fail,
+    warn_if_flow_order_is_not_preserved,
+)
 from plugsync_cli.serializer import write_config_directory, write_local_state
 
 console = Console()
@@ -61,10 +66,5 @@ def pull(connector_name: str, revision: int | None, output: str | None):
 
     warn_if_flow_order_is_not_preserved(config)
 
-    entities = len(config.get("entities") or [])
-    flows = len(config.get("flows") or [])
     console.print(f"[green]Pulled {state['source']} to {output_dir}/[/green]")
-    console.print(
-        f"  {entities} entit{'y' if entities == 1 else 'ies'}, "
-        f"{flows} flow{'' if flows == 1 else 's'}"
-    )
+    console.print(f"  {describe_config(config)}")

{plugsync_cli-0.5.0 → plugsync_cli-0.7.0}/plugsync_cli/commands/push.py

@@ -9,7 +9,13 @@ config to production as a side effect of saving a file (#1241).
 import click
 from rich.console import Console
 
-from plugsync_cli.context import build_client, fail, load_context, write_draft_from_directory
+from plugsync_cli.context import (
+    build_client,
+    describe_config,
+    fail,
+    load_context,
+    write_draft_from_directory,
+)
 from plugsync_cli.findings import render_findings, render_preflight
 
 console = Console()
@@ -87,12 +93,9 @@ def push(
     console.print(f"Pushing [bold]{context.directory.name}[/bold] to the draft...")
     draft = write_draft_from_directory(client, context, force=force)
 
-    config = draft["config"]
-    entities = len(config.get("entities") or [])
-    flows = len(config.get("flows") or [])
     console.print(
         f"[green]Draft updated (draft v{draft['draft_version']}): "
-        f"{entities} entities, {flows} flows[/green]"
+        f"{describe_config(draft['config'])}[/green]"
     )
 
     if not do_publish:
@@ -134,7 +137,37 @@ def _publish(client, connector_id: str, message: str | None, republish: bool = F
         )
         return
     console.print(f"[green]Published v{result.get('version')}[/green]")
+    _reveal_created_secrets(result.get("created_sources") or [])
     warnings = result.get("warnings") or []
     if warnings:
         console.print("\nPublished with warnings:")
         render_findings(console, warnings)
+
+
+def _reveal_created_secrets(created_sources: list[dict]) -> None:
+    """Print the plaintext secrets of the webhook sources this publish created.
+
+    A `webhook` source declared in the config is created by the publish itself
+    (ADR-0026), and the publish response is the ONLY place its secret ever
+    appears: nothing reads it back afterwards. Printing it here is what keeps
+    `plugsync push --publish` a complete way to stand a webhook source up;
+    without it the only way to a usable secret is to rotate the one that was
+    just generated. Sources with no secret to generate (every non-webhook
+    type) are skipped rather than printed as a bare name.
+    """
+    revealed = [s for s in created_sources if s.get("secret")]
+    if not revealed:
+        return
+    plural = "s" if len(revealed) > 1 else ""
+    console.print(
+        f"\n[bold]Webhook secret{plural} for the source{plural} this publish "
+        f"created - shown only once:[/bold]"
+    )
+    for source in revealed:
+        console.print(f"  {source['name']}: [bold]{source['secret']}[/bold]")
+    console.print(
+        "[yellow]Copy each value now and configure it in the external system "
+        "that signs that source's deliveries. A secret is never shown again: "
+        "if one is lost, rotate the secret of that source from the dashboard "
+        "to issue a new one.[/yellow]"
+    )

{plugsync_cli-0.5.0 → plugsync_cli-0.7.0}/plugsync_cli/context.py

@@ -9,17 +9,20 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import NoReturn
 
+import httpx
 from rich.console import Console
 
-from plugsync_cli.client import DraftConflict, PlugSyncClient
+from plugsync_cli.client import DraftConflict, PlugSyncClient, describe_http_error
 from plugsync_cli.serializer import (
     CONFIG_FILE_NAME,
     ConfigDirectoryError,
     Normalization,
     canonical_config,
     flows_sharing_a_trigger,
+    locate_in_directory,
     read_config_directory,
     read_local_state,
+    undeclared_collection_message,
     write_config_directory,
     write_local_state,
 )
@@ -128,10 +131,11 @@ def write_draft_from_directory(
     cosmetic: it is what `validate` and `preview` warn about, and a warning that
     fires every time stops being read exactly when it matters.
     """
+    config = context.config()
     expected_version = None if force else _expected_draft_version(client, context)
     try:
         draft = client.put_draft(
-            context.connector_id, context.config(), expected_version=expected_version
+            context.connector_id, config, expected_version=expected_version
         )
     except DraftConflict as conflict:
         fail(
@@ -139,6 +143,8 @@ def write_draft_from_directory(
             "it. Re-run 'plugsync pull' and reapply your changes, or "
             "'plugsync push --force' to overwrite theirs."
         )
+    except httpx.HTTPStatusError as exc:
+        fail(_rejection_pointing_at_the_files(exc, context))
 
     warn_if_flow_order_is_not_preserved(draft["config"])
     write_config_directory(context.directory, draft["config"])
@@ -155,6 +161,69 @@ def write_draft_from_directory(
     return draft
 
 
+# The API's error code for a draft write that omits `sources` on a connector
+# that declares them. `read_config_directory` refuses such a directory before
+# any request, so reaching it means the check was bypassed or the API moved.
+SOURCES_KEY_REMOVAL_ERROR = "sources_key_removal_not_supported"
+
+
+def _api_error_code(exc: httpx.HTTPStatusError) -> str | None:
+    """The machine-readable `detail.error` of a structured API refusal."""
+    try:
+        detail = exc.response.json().get("detail")
+    except (ValueError, AttributeError):
+        return None
+    return detail.get("error") if isinstance(detail, dict) else None
+
+
+def _rejection_pointing_at_the_files(
+    exc: httpx.HTTPStatusError, context: ConnectorContext
+) -> str:
+    """The API's refusal, with every config path it names resolved to a file.
+
+    A rejected draft is described the way the config document reads
+    (`sources[hubspot].config.triggers[0].pattern`), which is not how the
+    operator is looking at it: they have a directory of files open. Naming the
+    file that holds the key, alongside the backend's own explanation, is what
+    makes the failure actionable without decoding the path by hand.
+
+    A refusal to drop `sources` is about the directory as a whole, not a key in
+    it, so it gets the CLI's own explanation instead of the server's JSON.
+    """
+    if _api_error_code(exc) == SOURCES_KEY_REMOVAL_ERROR:
+        return undeclared_collection_message(context.directory, "sources")
+    message = describe_http_error(exc)
+    located = locate_in_directory(message)
+    if not located:
+        return message
+    lines = "\n".join(
+        f"  {file_name}: {key}" if key else f"  {file_name}" for file_name, key in located
+    )
+    return f"{message}\n\nIn your files:\n{lines}"
+
+
+def describe_config(config: dict) -> str:
+    """What a config holds, counted, for the line a pull or a push ends on.
+
+    `sources` is reported only when the config declares the key. Only a
+    version published before the sources were part of the config lacks it, and
+    that is not the same as having none: printing "0 sources" would say
+    something the version never said.
+    """
+    counted = [
+        _counted(config.get("entities"), "entity", "entities"),
+        _counted(config.get("flows"), "flow", "flows"),
+    ]
+    if config.get("sources") is not None:
+        counted.append(_counted(config["sources"], "source", "sources"))
+    return ", ".join(counted)
+
+
+def _counted(items, singular: str, plural: str) -> str:
+    count = len(items or [])
+    return f"{count} {singular if count == 1 else plural}"
+
+
 def _expected_draft_version(client: PlugSyncClient, context: ConnectorContext) -> int:
     """The draft version a write guards itself with.
 

{plugsync_cli-0.5.0 → plugsync_cli-0.7.0}/plugsync_cli/findings.py

@@ -8,6 +8,7 @@ severity therefore gets a glyph, a colour AND the literal word -- the word being
 the part that still reads correctly in a CI log with colour stripped.
 """
 from rich.console import Console
+from rich.markup import escape
 
 # severity -> (glyph, rich colour). Ordered worst-first: that is the order
 # findings are printed in, so the thing that blocks you is not below the noise.
@@ -34,13 +35,21 @@ def _summary(counts: dict[str, int]) -> str:
 
 
 def _render_one(console: Console, finding: dict) -> None:
+    """One finding, with everything the backend wrote printed verbatim.
+
+    `escape` on every backend-authored string: a finding names the key it is
+    about the way the config document does, and a name in brackets --
+    `sources[hubspot].config.triggers[0].pattern` -- is valid rich markup. Rich
+    read `[hubspot]` as a style tag and swallowed it, so the one word saying
+    WHICH source was wrong disappeared from the screen.
+    """
     severity = finding.get("severity", "info")
     # A severity this CLI does not know still gets printed, under its own name.
     glyph, colour = SEVERITY_STYLES.get(severity, ("?", "magenta"))
-    code = finding.get("code", "unknown")
+    code = escape(str(finding.get("code", "unknown")))
+    message = escape(str(finding.get("message", "")))
     console.print(
-        f"  [{colour}]{glyph} {severity:<7}[/{colour}] "
-        f"[bold]{code}[/bold]: {finding.get('message', '')}"
+        f"  [{colour}]{glyph} {severity:<7}[/{colour}] [bold]{code}[/bold]: {message}"
     )
     scope = finding.get("entity") or finding.get("event_flow")
     for label, value in (
@@ -49,7 +58,7 @@ def _render_one(console: Console, finding: dict) -> None:
         ("fix", finding.get("suggestion")),
     ):
         if value:
-            console.print(f"      [dim]{label}:[/dim] {value}")
+            console.print(f"      [dim]{label}:[/dim] {escape(str(value))}")
 
 
 def _severity_rank(severity: str) -> int: