prefect-client 3.7.4.dev3__tar.gz → 3.7.4.dev4__tar.gz

{prefect_client-3.7.4.dev3 → prefect_client-3.7.4.dev4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: prefect-client
-Version: 3.7.4.dev3
+Version: 3.7.4.dev4
 Summary: Workflow orchestration and management.
 Project-URL: Changelog, https://github.com/PrefectHQ/prefect/releases
 Project-URL: Documentation, https://docs.prefect.io

prefect_client-3.7.4.dev4/src/prefect/_build_info.py

@@ -0,0 +1,5 @@
+# Generated by versioningit
+__version__ = "3.7.4.dev4"
+__build_date__ = "2026-06-05 09:16:11.920641+00:00"
+__git_commit__ = "0bad21f4ce99db95716f64cc2eab836eb274b52c"
+__dirty__ = False

prefect_client-3.7.4.dev4/src/prefect/_internal/urls.py

@@ -0,0 +1,57 @@
+import re
+from collections.abc import Iterable
+from urllib.parse import urlparse, urlunparse
+
+_URL_AUTH_PATTERN = re.compile(
+    r"(?P<scheme>https?://)[^/\s'\"<>]*@", flags=re.IGNORECASE
+)
+
+
+def strip_auth_from_url(url: str) -> str:
+    """
+    Remove authentication credentials (username/password) from a URL.
+
+    Useful for sanitizing URLs before including them in error messages
+    or logs to avoid leaking secrets.
+    """
+    try:
+        parsed = urlparse(url)
+
+        if not parsed.hostname:
+            return url
+
+        netloc = parsed.hostname
+        if parsed.port:
+            netloc = f"{netloc}:{parsed.port}"
+
+        return urlunparse(
+            (
+                parsed.scheme,
+                netloc,
+                parsed.path,
+                parsed.params,
+                parsed.query,
+                parsed.fragment,
+            )
+        )
+    except ValueError:
+        return strip_auth_from_urls_in_text(url)
+
+
+def strip_auth_from_urls_in_text(
+    text: str, extra_secrets: Iterable[str] | None = None
+) -> str:
+    """
+    Remove authentication credentials from HTTP(S) URLs embedded in text.
+
+    Useful for sanitizing command output before including it in error messages
+    or logs. Any caller-supplied secrets are replaced with a redaction marker.
+    """
+    if not text:
+        return text
+
+    sanitized = _URL_AUTH_PATTERN.sub(r"\g<scheme>", text)
+    for secret in extra_secrets or ():
+        if secret:
+            sanitized = sanitized.replace(secret, "***")
+    return sanitized

{prefect_client-3.7.4.dev3 → prefect_client-3.7.4.dev4}/src/prefect/runner/storage.py

@@ -14,7 +14,7 @@ from typing import (
     Union,
     runtime_checkable,
 )
-from urllib.parse import quote, urlparse, urlsplit, urlunparse
+from urllib.parse import quote, unquote, urlparse, urlsplit, urlunparse
 from uuid import uuid4
 
 import fsspec  # pyright: ignore[reportMissingTypeStubs]
@@ -22,7 +22,7 @@ from anyio import run_process
 from pydantic import SecretStr
 
 from prefect._internal.concurrency.api import create_call, from_async
-from prefect._internal.urls import strip_auth_from_url
+from prefect._internal.urls import strip_auth_from_url, strip_auth_from_urls_in_text
 from prefect.blocks.core import Block, BlockNotSavedError
 from prefect.blocks.system import Secret
 from prefect.filesystems import ReadableDeploymentStorage, WritableDeploymentStorage
@@ -499,6 +499,21 @@ class GitRepository:
                 else exc
             )
             safe_url = strip_auth_from_url(self._url)
+            sanitized_stderr = strip_auth_from_urls_in_text(
+                _decode_stderr(exc),
+                extra_secrets=_url_auth_secrets(self._url, repository_url),
+            )
+            # Surface the raw git error at DEBUG so users can opt in via log
+            # level when the hint patterns don't match. The exception chain is
+            # suppressed above when credentials are present, so DEBUG is the
+            # only way to see the actual git output in that case.
+            if sanitized_stderr:
+                self._logger.debug(
+                    "git clone failed (exit %d) for %r: %s",
+                    exc.returncode,
+                    safe_url,
+                    sanitized_stderr.strip(),
+                )
             error_message = (
                 f"Failed to clone repository {safe_url!r} with exit code"
                 f" {exc.returncode}."
@@ -506,6 +521,14 @@ class GitRepository:
             hint = _get_git_clone_error_hint(exc)
             if hint:
                 error_message += f" {hint}"
+            elif sanitized_stderr:
+                # No pattern matched -- surface the actual git error so the
+                # user doesn't have to enable DEBUG to know what went wrong.
+                snippet = sanitized_stderr.strip().splitlines()
+                # Keep the last few lines; git's final 'fatal:' line is usually
+                # the actionable one.
+                tail = " | ".join(snippet[-3:])
+                error_message += f" git stderr: {tail}"
             raise RuntimeError(error_message) from exc_chain
 
         if self._commit_sha:
@@ -985,15 +1008,34 @@ _GIT_CLONE_ERROR_HINTS: list[tuple[str, str]] = [
 ]
 
 
+def _decode_stderr(exc: subprocess.CalledProcessError) -> str:
+    """Decode a CalledProcessError's stderr to text, tolerating bytes/None."""
+    if not exc.stderr:
+        return ""
+    if isinstance(exc.stderr, bytes):
+        return exc.stderr.decode("utf-8", errors="replace")
+    return str(exc.stderr)
+
+
+def _url_auth_secrets(*urls: str) -> list[str]:
+    """Extract userinfo values from URLs so echoed auth can be redacted."""
+    secrets: list[str] = []
+    seen: set[str] = set()
+    for url in urls:
+        parsed = urlparse(url)
+        for value in (parsed.username, parsed.password):
+            if not value:
+                continue
+            for secret in (value, unquote(value)):
+                if secret and secret not in seen:
+                    secrets.append(secret)
+                    seen.add(secret)
+    return secrets
+
+
 def _get_git_clone_error_hint(exc: subprocess.CalledProcessError) -> str | None:
     """Extract a resolution hint from a git clone CalledProcessError's stderr."""
-    stderr = ""
-    if exc.stderr:
-        stderr = (
-            exc.stderr.decode("utf-8", errors="replace")
-            if isinstance(exc.stderr, bytes)
-            else str(exc.stderr)
-        )
+    stderr = _decode_stderr(exc)
     for pattern, hint in _GIT_CLONE_ERROR_HINTS:
         if pattern.lower() in stderr.lower():
             return hint

{prefect_client-3.7.4.dev3 → prefect_client-3.7.4.dev4}/src/prefect/settings/_types.py

@@ -140,6 +140,9 @@ SettingAccessor: TypeAlias = Literal[
     "server.register_blocks_on_start",
     "server.services.cancellation_cleanup.enabled",
     "server.services.cancellation_cleanup.loop_seconds",
+    "server.services.cleanup_reconciler.batch_size",
+    "server.services.cleanup_reconciler.enabled",
+    "server.services.cleanup_reconciler.loop_seconds",
     "server.services.db_vacuum.batch_size",
     "server.services.db_vacuum.enabled",
     "server.services.db_vacuum.event_retention_overrides",

{prefect_client-3.7.4.dev3 → prefect_client-3.7.4.dev4}/src/prefect/settings/models/server/services.py

@@ -542,6 +542,33 @@ class ServerServicesRepossessorSettings(ServicesBaseSetting):
     )
 
 
+class ServerServicesCleanupReconcilerSettings(ServicesBaseSetting):
+    """
+    Settings for controlling the cleanup reconciler service.
+    """
+
+    model_config: ClassVar[SettingsConfigDict] = build_settings_config(
+        ("server", "services", "cleanup_reconciler")
+    )
+
+    enabled: bool = Field(
+        default=True,
+        description="Whether or not to start the cleanup reconciler service in the server application.",
+    )
+
+    loop_seconds: float = Field(
+        default=5,
+        gt=0,
+        description="The cleanup reconciler service will look for expired cleanup message leases this often. Defaults to `5`.",
+    )
+
+    batch_size: int = Field(
+        default=100,
+        gt=0,
+        description="The maximum number of expired cleanup message leases to process per service loop. Defaults to `100`.",
+    )
+
+
 class ServerServicesTaskRunRecorderSettings(ServicesBaseSetting):
     """
     Settings for controlling the task run recorder service
@@ -677,6 +704,10 @@ class ServerServicesSettings(PrefectBaseSettings):
         default_factory=ServerServicesRepossessorSettings,
         description="Settings for controlling the repossessor service",
     )
+    cleanup_reconciler: ServerServicesCleanupReconcilerSettings = Field(
+        default_factory=ServerServicesCleanupReconcilerSettings,
+        description="Settings for controlling the cleanup reconciler service",
+    )
     task_run_recorder: ServerServicesTaskRunRecorderSettings = Field(
         default_factory=ServerServicesTaskRunRecorderSettings,
         description="Settings for controlling the task run recorder service",

prefect_client-3.7.4.dev3/src/prefect/_build_info.py

@@ -1,5 +0,0 @@
-# Generated by versioningit
-__version__ = "3.7.4.dev3"
-__build_date__ = "2026-06-04 09:26:14.779709+00:00"
-__git_commit__ = "80846482817539c21fe22cf2372b55e953a27e92"
-__dirty__ = False

prefect_client-3.7.4.dev3/src/prefect/_internal/urls.py

@@ -1,29 +0,0 @@
-from urllib.parse import urlparse, urlunparse
-
-
-def strip_auth_from_url(url: str) -> str:
-    """
-    Remove authentication credentials (username/password) from a URL.
-
-    Useful for sanitizing URLs before including them in error messages
-    or logs to avoid leaking secrets.
-    """
-    parsed = urlparse(url)
-
-    if not parsed.hostname:
-        return url
-
-    netloc = parsed.hostname
-    if parsed.port:
-        netloc = f"{netloc}:{parsed.port}"
-
-    return urlunparse(
-        (
-            parsed.scheme,
-            netloc,
-            parsed.path,
-            parsed.params,
-            parsed.query,
-            parsed.fragment,
-        )
-    )