prefect-client 3.6.25.dev5__tar.gz → 3.6.25.dev7__tar.gz

{prefect_client-3.6.25.dev5 → prefect_client-3.6.25.dev7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: prefect-client
-Version: 3.6.25.dev5
+Version: 3.6.25.dev7
 Summary: Workflow orchestration and management.
 Project-URL: Changelog, https://github.com/PrefectHQ/prefect/releases
 Project-URL: Documentation, https://docs.prefect.io

{prefect_client-3.6.25.dev5 → prefect_client-3.6.25.dev7}/src/prefect/AGENTS.md

@@ -24,6 +24,7 @@ There is no formal public/private boundary beyond the `_` prefix convention. Mod
 - **Flow and task engines advance state differently.** The flow engine makes blocking API calls to the server to propose and advance states. The task engine emits `prefect.task_run.*` events (delivered via WebSockets) but advances state locally through `set_state` calls with polling/backoff — do not assume the two engines work the same way.
 - **Flow state transitions go through the server.** The flow engine proposes states to the server, which accepts or rejects them via orchestration rules. The task engine, by contrast, manages state transitions locally via `set_state` and emits `prefect.task_run.*` events — it does not propose states to the server.
 - **`ProcessPoolTaskRunner` requires picklable data across subprocess boundaries.** `PrefectFuture` objects are not picklable and cannot be passed to worker subprocesses. Any `wait_for` futures must be waited on in the parent process and converted to `State` objects before submission. The subprocess task engine handles `State` objects via `resolve_to_final_result`, which raises `UpstreamTaskError` for non-completed upstreams.
+- **`ProcessPoolTaskRunner` instances may be deserialized without `__init__` running.** When a runner is pickled and restored in a subprocess, `__init__` is not called, so instance attributes set there may be absent. Access any such attribute via `getattr(self, "_attr", default)` rather than `self._attr` directly — both in the property getter and in `duplicate()`. The `subprocess_message_processor_factories` property demonstrates the required pattern.
 
 ## Logging
 

prefect_client-3.6.25.dev7/src/prefect/_build_info.py

@@ -0,0 +1,5 @@
+# Generated by versioningit
+__version__ = "3.6.25.dev7"
+__build_date__ = "2026-04-03 08:23:06.380040+00:00"
+__git_commit__ = "34f66a7cfc986e5b47688ea8ea7a91f8fc58e01f"
+__dirty__ = False

{prefect_client-3.6.25.dev5 → prefect_client-3.6.25.dev7}/src/prefect/_internal/installation.py

@@ -2,6 +2,9 @@ import importlib
 import subprocess
 import sys
 
+from packaging.version import Version
+
+import prefect
 import prefect.utilities.processutils
 
 
@@ -11,7 +14,9 @@ def install_packages(
     """
     Install packages using uv if available, otherwise use pip.
     """
-    base_command = ["pip", "install", *packages]
+    version = Version(prefect.__version__)
+    constraint_args = [f"prefect=={prefect.__version__}"] if not version.local else []
+    base_command = ["pip", "install", *constraint_args, *packages]
     if upgrade:
         base_command.append("--upgrade")
     if stream_output:
@@ -44,7 +49,9 @@ async def ainstall_packages(
     """
     Install packages using uv if available, otherwise use pip.
     """
-    base_command = ["pip", "install", *packages]
+    version = Version(prefect.__version__)
+    constraint_args = [f"prefect=={prefect.__version__}"] if not version.local else []
+    base_command = ["pip", "install", *constraint_args, *packages]
     if upgrade:
         base_command.append("--upgrade")
     try:

{prefect_client-3.6.25.dev5 → prefect_client-3.6.25.dev7}/src/prefect/context.py

@@ -37,6 +37,7 @@ from prefect.client.schemas import FlowRun, TaskRun
 from prefect.client.schemas.objects import RunType
 from prefect.events.worker import EventsWorker
 from prefect.exceptions import MissingContextError
+from prefect.logging.configuration import ensure_logging_setup
 from prefect.results import (
     ResultStore,
     get_default_persist_setting,
@@ -163,6 +164,8 @@ def hydrated_context(
 
     with ExitStack() as stack:
         if serialized_context:
+            ensure_logging_setup()
+
             # Set up settings context
             if settings_context := serialized_context.get("settings_context"):
                 stack.enter_context(SettingsContext(**settings_context))

{prefect_client-3.6.25.dev5 → prefect_client-3.6.25.dev7}/src/prefect/deployments/AGENTS.md

@@ -36,5 +36,5 @@ For module path entrypoints, the storage destination is temporarily prepended to
 - **Flow source outside cwd**: `RunnerDeployment.from_flow()` computes the entrypoint path with `Path.relative_to(cwd)`. When the flow file is outside the working directory (e.g., on a different drive on Windows, or an absolute path not under cwd), `relative_to()` raises `ValueError` — the code falls back to `os.path.relpath()`, which may produce paths containing `..` components. Infrastructure that expects clean relative paths (no `..`) must handle this case.
 - **Windows shell mode**: `run_shell_script` always uses `asyncio.create_subprocess_shell` on Windows (`sys.platform == "win32"`), regardless of the `shell` parameter. This ensures cmd.exe built-ins (`echo`, `dir`, `set`, etc.) work. On non-Windows, `shell=False` (default) uses `create_subprocess_exec` with `shlex.split`.
 - **Step ID namespace**: `id` and `requires` are reserved keywords — do not use them as step output keys.
-- **Step import side effects**: steps are imported dynamically; packages listed in `requires` are installed into the current environment at execution time.
+- **Step import side effects**: steps are imported dynamically; packages listed in `requires` are installed into the current environment at execution time. The current prefect version is automatically pinned as a constraint during installation to prevent the running prefect from being overwritten or downgraded. This pin is skipped for local/dev builds (i.e., when `packaging.version.Version(prefect.__version__).local` is truthy).
 - **String `image` argument suppresses build/push output.** When `deploy()` / `adeploy()` receives `image` as a plain string, it constructs `DockerImage(stream_progress_to=None)`, silencing all build and push progress. `DockerImage` itself defaults to `sys.stdout`, so users who pass a string get no output. To see build/push progress, pass a `DockerImage` object explicitly: `DockerImage("registry/image:tag", stream_progress_to=sys.stdout)`.

{prefect_client-3.6.25.dev5 → prefect_client-3.6.25.dev7}/src/prefect/logging/AGENTS.md

@@ -19,6 +19,7 @@ Public API (exported from `__init__.py`):
 Internal factories (not exported, but used by engines/workers):
 - `flow_run_logger()` / `task_run_logger()` — direct logger factories with run metadata
 - `get_worker_logger()` — adds `backend_id` if available (Cloud only)
+- `ensure_logging_setup()` — idempotent guard: calls `setup_logging()` only if `PROCESS_LOGGING_CONFIG` is not yet set. Use this (not `setup_logging()` directly) in remote execution environments (Dask/Ray workers, `hydrated_context`) where the normal SDK import path may not have triggered logging configuration.
 
 **APILogHandler drops logs without a `flow_run_id`.** Logs emitted outside a run context raise `MissingContextError`, which is caught and converted to a warning or silently dropped depending on `PREFECT_LOGGING_TO_API_WHEN_MISSING_FLOW`.
 

{prefect_client-3.6.25.dev5 → prefect_client-3.6.25.dev7}/src/prefect/logging/configuration.py

@@ -65,6 +65,19 @@ def load_logging_config(path: Path) -> dict[str, Any]:
     return flatdict_to_dict(flat_config)
 
 
+def ensure_logging_setup() -> None:
+    """
+    Ensure Prefect logging is configured in this process, calling
+    `setup_logging` only if it has not already been called.
+
+    Use this in remote execution environments (e.g. Dask/Ray workers) where
+    the normal SDK entry point (`import prefect`) may not have triggered
+    logging configuration.
+    """
+    if not PROCESS_LOGGING_CONFIG:
+        setup_logging()
+
+
 def setup_logging(incremental: bool | None = None) -> dict[str, Any]:
     """
     Sets up logging.

{prefect_client-3.6.25.dev5 → prefect_client-3.6.25.dev7}/src/prefect/runner/AGENTS.md

@@ -77,6 +77,15 @@ Each execution mode has a ProcessStarter implementation. To add a new execution
 
 ProcessWorker (src/prefect/workers/process.py) calls `Runner.execute_flow_run()` and `Runner.execute_bundle()` via the deprecated path, suppressing `PrefectDeprecationWarning` with `warnings.catch_warnings()`. It bypasses FlowRunExecutor, ProcessManager, and ProcessStarter entirely. This is a known migration target.
 
+## GitRepository Input Validation
+
+`GitRepository.__init__` (storage.py) enforces two non-obvious constraints:
+
+- **`commit_sha`** must match `^[0-9a-fA-F]{4,64}$` — any value that fails (including git option strings like `--upload-pack=...`) raises `ValueError`. Branch/tag names must use the `branch` parameter instead.
+- **`directories`** entries starting with `--` trigger a `UserWarning` but are not rejected. The values are passed to `git sparse-checkout set --` (with a `--` separator to prevent flag injection). The warning exists because such paths are unusual; legitimate use is allowed.
+
+These validations exist to prevent git argument injection. Do not bypass them when constructing `GitRepository` programmatically.
+
 ## Reference
 
 Full refactor design and rationale: plans/completed/2026-02-18-runner-refactor.md

{prefect_client-3.6.25.dev5 → prefect_client-3.6.25.dev7}/src/prefect/runner/storage.py

@@ -1,7 +1,9 @@
 from __future__ import annotations
 
+import re
 import shutil
 import subprocess
+import warnings
 from copy import deepcopy
 from pathlib import Path
 from typing import (
@@ -176,6 +178,26 @@ class GitRepository:
                 "Cannot provide both a branch and a commit SHA. Please provide only one."
             )
 
+        if commit_sha and not re.match(r"^[0-9a-fA-F]{4,64}$", commit_sha):
+            raise ValueError(
+                f"Invalid commit SHA: {commit_sha!r}."
+                " Expected a hexadecimal Git commit SHA (4–64 characters)."
+                " If you are trying to specify a branch or tag name,"
+                " use the 'branch' parameter instead."
+            )
+
+        if directories:
+            for d in directories:
+                if d.startswith("--"):
+                    warnings.warn(
+                        f"Directory {d!r} starts with '--' and will be"
+                        " interpreted as a path by git sparse-checkout."
+                        " If this is not intentional, remove it from the"
+                        " directories list.",
+                        UserWarning,
+                        stacklevel=2,
+                    )
+
         self._url = url
         self._branch = branch
         self._commit_sha = commit_sha
@@ -357,7 +379,7 @@ class GitRepository:
             # Sparsely checkout the repository if directories are specified and the repo is not in sparse-checkout mode already
             if self._directories and not await self.is_sparsely_checked_out():
                 await run_process(
-                    ["git", "sparse-checkout", "set", *self._directories],
+                    ["git", "sparse-checkout", "set", "--", *self._directories],
                     cwd=self.destination,
                 )
 
@@ -486,7 +508,7 @@ class GitRepository:
         if self._directories:
             self._logger.debug("Will add %s", self._directories)
             await run_process(
-                ["git", "sparse-checkout", "set", *self._directories],
+                ["git", "sparse-checkout", "set", "--", *self._directories],
                 cwd=self.destination,
             )
 

{prefect_client-3.6.25.dev5 → prefect_client-3.6.25.dev7}/src/prefect/task_runners.py

@@ -755,7 +755,7 @@ class ProcessPoolTaskRunner(TaskRunner[PrefectConcurrentFuture[Any]]):
     def duplicate(self) -> Self:
         duplicate_runner = type(self)(max_workers=self._max_workers)
         duplicate_runner.subprocess_message_processor_factories = (
-            self._subprocess_message_processor_factories
+            self.subprocess_message_processor_factories
         )
         return duplicate_runner
 
@@ -763,7 +763,7 @@ class ProcessPoolTaskRunner(TaskRunner[PrefectConcurrentFuture[Any]]):
     def subprocess_message_processor_factories(
         self,
     ) -> tuple[_SubprocessMessageProcessorFactory, ...]:
-        return self._subprocess_message_processor_factories
+        return getattr(self, "_subprocess_message_processor_factories", ())
 
     @subprocess_message_processor_factories.setter
     def subprocess_message_processor_factories(

prefect_client-3.6.25.dev5/src/prefect/_build_info.py

@@ -1,5 +0,0 @@
-# Generated by versioningit
-__version__ = "3.6.25.dev5"
-__build_date__ = "2026-04-01 08:34:04.063154+00:00"
-__git_commit__ = "69775fbacada216f639d444d25535de62ff8f651"
-__dirty__ = False