py-wlcli 0.8.0__py3-none-any.whl

wl_cli/commands/lfs/policy.py

@@ -0,0 +1,165 @@
+"""LFS Lock policy validation."""
+
+from __future__ import annotations
+
+import getpass
+import os
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, Literal
+
+if TYPE_CHECKING:
+    from .config import LfsLockConfig
+from .manager import LfsLockManager
+
+PolicyStatus = Literal["OK", "WARN", "BLOCKED"]
+
+
+@dataclass(frozen=True)
+class LockCheckResult:
+    ok: bool
+    status: PolicyStatus
+    locked_files: frozenset[str] = field(default_factory=frozenset)
+    unlocked_files: frozenset[str] = field(default_factory=frozenset)
+    locked_by_others: frozenset[str] = field(default_factory=frozenset)
+    config_source: str = ""
+
+
+class LfsLockPolicyValidator:
+    """Validates that changed LFS files are properly locked before push."""
+
+    LOCK_TIMEOUT = 10  # seconds
+
+    def __init__(
+        self, config: LfsLockConfig, manager: LfsLockManager | None = None
+    ) -> None:
+        self.config = config
+        self._manager = manager
+
+    def validate(self, changed_files: frozenset[str]) -> LockCheckResult:
+        if self.config.mode == "off":
+            return LockCheckResult(
+                ok=True,
+                status="OK",
+                config_source=self.config.config_source,
+            )
+
+        manager = self._manager or LfsLockManager()
+        lfs_files = manager.get_lfs_files(changed_files)
+
+        if not lfs_files:
+            return LockCheckResult(
+                ok=True,
+                status="OK",
+                config_source=self.config.config_source,
+            )
+
+        locks = manager.get_locks(timeout=self.LOCK_TIMEOUT)
+        locked_paths = frozenset(lock["path"] for lock in locks)
+        current_user = getpass.getuser()
+
+        locked_by_current: set[str] = set()
+        locked_by_others: set[str] = set()
+        unlocked: set[str] = set()
+
+        for f in lfs_files:
+            if f in locked_paths:
+                lock_owner = next(
+                    (lock["owner"]["name"] for lock in locks if lock["path"] == f),
+                    "",
+                )
+                if lock_owner == current_user:
+                    locked_by_current.add(f)
+                else:
+                    locked_by_others.add(f)
+            else:
+                unlocked.add(f)
+
+        if locked_by_others and not self.config.locked_by_self:
+            return LockCheckResult(
+                ok=False,
+                status="BLOCKED",
+                locked_files=frozenset(locked_by_current),
+                unlocked_files=frozenset(unlocked),
+                locked_by_others=frozenset(locked_by_others),
+                config_source=self.config.config_source,
+            )
+
+        if unlocked:
+            if self.config.mode == "strict":
+                return LockCheckResult(
+                    ok=False,
+                    status="BLOCKED",
+                    locked_files=frozenset(locked_by_current),
+                    unlocked_files=frozenset(unlocked),
+                    locked_by_others=frozenset(locked_by_others),
+                    config_source=self.config.config_source,
+                )
+            else:
+                return LockCheckResult(
+                    ok=True,
+                    status="WARN",
+                    locked_files=frozenset(locked_by_current),
+                    unlocked_files=frozenset(unlocked),
+                    locked_by_others=frozenset(locked_by_others),
+                    config_source=self.config.config_source,
+                )
+
+        return LockCheckResult(
+            ok=True,
+            status="OK",
+            locked_files=frozenset(locked_by_current),
+            unlocked_files=frozenset(),
+            locked_by_others=frozenset(),
+            config_source=self.config.config_source,
+        )
+
+    def validate_with_fallback(self, changed_files: frozenset[str]) -> LockCheckResult:
+        """Validate LFS locks, auto-locking unlocked files if fallback is enabled.
+
+        In CI environments (CI=true), fallback is skipped to avoid stale locks.
+        """
+        # Run normal validation first
+        result = self.validate(changed_files)
+        if result.ok:
+            return result
+
+        # Only apply fallback if configured and not in CI
+        if not self.config.auto_lock_fallback:
+            return result
+
+        in_ci = os.environ.get("CI", "") == "true"
+        if in_ci:
+            return result
+
+        # Skip fallback when files are locked by others
+        if result.locked_by_others and self.config.auto_lock_skip_locked_by_others:
+            return result
+
+        # Auto-lock unlocked files that nobody else has locked
+        manager = self._manager or LfsLockManager()
+        files_to_lock = [
+            f for f in result.unlocked_files if f not in result.locked_by_others
+        ]
+        if not files_to_lock:
+            return result
+
+        lock_results = manager.lock_files(files_to_lock)
+        failed = [f for f, ok in lock_results.items() if not ok]
+        if failed:
+            return LockCheckResult(
+                ok=False,
+                status="BLOCKED",
+                locked_files=result.locked_files,
+                unlocked_files=frozenset(failed),
+                locked_by_others=result.locked_by_others,
+                config_source=self.config.config_source,
+            )
+
+        return LockCheckResult(
+            ok=True,
+            status="OK",
+            locked_files=result.locked_files | frozenset(files_to_lock),
+            unlocked_files=frozenset(),
+            locked_by_others=frozenset(),
+            config_source=self.config.config_source,
+        )

wl_cli/commands/lfs/watcher.py

@@ -0,0 +1,294 @@
+"""LFS file watcher — auto-lock on file modification, auto-unlock on push detection."""
+
+from __future__ import annotations
+
+import os
+import time
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, cast
+
+import click
+
+from ...utils.root import Root, RootKind
+from ...utils.root_fallback import current_root
+from .config import LfsLockConfig
+from .manager import LfsLockManager
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+try:
+    import watchdog.events
+
+    _WATCHDOG_AVAILABLE = True
+except ImportError:
+    _WATCHDOG_AVAILABLE = False
+
+
+@dataclass
+class WatchSessionStats:
+    """Session summary printed on exit."""
+
+    files_locked: int = 0
+    files_unlocked: int = 0
+    files_skipped: int = 0
+
+
+class LfsWatcher:
+    """Watches the filesystem for LFS file modifications and auto-locks them.
+
+    Also polls git refs to detect successful pushes and auto-unlock.
+    """
+
+    REF_POLL_INTERVAL = 5  # seconds between ref polls
+
+    def __init__(
+        self,
+        project_root: Path | None = None,
+        verbose: bool = False,
+    ) -> None:
+        # Root-anchored (#125): the *project* root the CWD belongs to, not the
+        # CWD itself, so ``wl lfs watch`` from a subdirectory watches the whole
+        # project and reads the root's ``.wl/lfs-lock.yml`` (see ``_wl_dir``)
+        # rather than a subdirectory that has no ``.wl`` of its own.
+        self.project_root = project_root or current_root(RootKind.PROJECT).path
+        self.verbose = verbose
+        self.manager = LfsLockManager(cwd=str(self.project_root))
+        self.config = LfsLockConfig(config_path=self._wl_dir() / "lfs-lock.yml")
+        self._debounce_registry: dict[str, float] = {}
+        self._debounce_seconds = 2.0
+        self._running = True
+        self._ref_hash_cache: dict[str, str] = {}
+        self.stats = WatchSessionStats()
+
+    def _wl_dir(self) -> Path:
+        """The ``.wl`` control directory at this watcher's root.
+
+        Built from :class:`~wl_cli.utils.root.Root` so the control-directory
+        name has a single definition (#114/#121). The anchor is this watcher's
+        ``project_root`` -- exactly the directory the pre-migration code joined
+        the name onto, so behaviour is unchanged.
+
+        #123 re-checked the cache-invalidation question this raises: the watcher
+        *creates* this directory (``_write_pid_file``), and a newly created
+        ``.wl`` can change what a ``PROJECT``/``DEPLOY`` lookup would answer.
+        No invalidation is needed. This constructs a :class:`Root` directly and
+        never calls ``resolve``, so nothing here reads or writes the root memo
+        -- that memo lives in :mod:`wl_cli.utils.root` and is per-process, and
+        this process never asks it. Re-check again if the watcher ever starts
+        resolving instead of joining.
+        """
+        return Root(self.project_root, RootKind.PROJECT).wl_dir()
+
+    def log(self, message: str) -> None:
+        """Print message if verbose, always print to internal buffer."""
+        ts = time.strftime("%H:%M:%S")
+        line = f"  [{ts}] {message}"
+        click.echo(line)
+
+    def _startup_scan(self) -> None:
+        """Scan for already-modified LFS files and lock them."""
+        git_dir = self.project_root / ".git"
+        if not git_dir.is_dir():
+            return
+
+        # Check if .gitattributes exists
+        gitattr = self.project_root / ".gitattributes"
+        if not gitattr.is_file():
+            return
+
+        result = self.manager._run_git(["diff", "--name-only", "HEAD"])
+        if result.returncode != 0 or not result.stdout.strip():
+            return
+
+        changed = [f for f in result.stdout.strip().split("\n") if f]
+        lfs_files = [f for f in changed if self.manager.is_file_lfs_tracked(f)]
+        if not lfs_files:
+            return
+
+        self.log(f"Startup scan: {len(lfs_files)} modified LFS file(s)")
+        results = self.manager.lock_files(lfs_files)
+        for f, (ok, reason) in results.items():
+            if ok:
+                self.log(f"  Locked: {f}")
+                self.stats.files_locked += 1
+            else:
+                self.log(f"  Failed to lock: {f} ({reason})")
+
+    def _should_debounce(self, file_path: str) -> bool:
+        """Return True if this file's event should be debounced."""
+        now = time.time()
+        last = self._debounce_registry.get(file_path, 0)
+        if now - last < self._debounce_seconds:
+            return True
+        self._debounce_registry[file_path] = now
+        return False
+
+    def _is_already_running(self) -> bool:
+        """Check if another watch process is already running via PID file."""
+        pid_file = self._wl_dir() / "lfs-watch.pid"
+        if not pid_file.exists():
+            return False
+        try:
+            pid = int(pid_file.read_text().strip())
+            os.kill(pid, 0)  # signal 0: check if process exists
+            return True
+        except (ValueError, OSError):
+            pid_file.unlink(missing_ok=True)
+            return False
+
+    def _write_pid_file(self) -> None:
+        """Write current PID to lock file."""
+        self._wl_dir().mkdir(exist_ok=True)
+        pid_file = self._wl_dir() / "lfs-watch.pid"
+        pid_file.write_text(str(os.getpid()))
+
+    def _cleanup_pid_file(self) -> None:
+        """Remove PID file on shutdown."""
+        pid_file = self._wl_dir() / "lfs-watch.pid"
+        pid_file.unlink(missing_ok=True)
+
+    def _get_current_ref(self, branch: str) -> str | None:
+        """Get current remote ref hash for a branch. Returns None if no remote."""
+        result = self.manager._run_git(["rev-parse", f"refs/remotes/origin/{branch}"])
+        if result.returncode != 0:
+            return None
+        return cast("str", result.stdout.strip())
+
+    def _poll_ref(self, branch: str) -> None:
+        """Poll remote ref for changes. If detected, auto-unlock pushed files."""
+        if not self.config.auto_unlock_on_push:
+            return
+
+        new_hash = self._get_current_ref(branch)
+        if new_hash is None:
+            return
+
+        old_hash = self._ref_hash_cache.get(branch)
+        if old_hash and old_hash == new_hash:
+            return
+        if old_hash is None:
+            self._ref_hash_cache[branch] = new_hash
+            return
+
+        self._ref_hash_cache[branch] = new_hash
+
+        result = self.manager._run_git(["diff", "--name-only", old_hash, new_hash])
+        if result.returncode != 0 or not result.stdout.strip():
+            return
+
+        pushed = [f for f in result.stdout.strip().split("\n") if f]
+        lfs_files = [f for f in pushed if self.manager.is_file_lfs_tracked(f)]
+        if not lfs_files:
+            return
+
+        self.log(f"Push detected on {branch}: {len(lfs_files)} LFS file(s)")
+        for attempt in range(self.config.auto_unlock_retry_count):
+            results = self.manager.unlock_files(lfs_files)
+            for _f, ok in results.items():
+                if ok:
+                    self.stats.files_unlocked += 1
+            failed = [f for f, ok in results.items() if not ok]
+            if not failed:
+                self.log(f"  Unlocked: {', '.join(lfs_files)}")
+                return
+            if attempt < self.config.auto_unlock_retry_count - 1:
+                time.sleep(self.config.auto_unlock_retry_delay)
+        self.log(
+            f"  Failed to unlock after {self.config.auto_unlock_retry_count} attempts"
+        )
+
+    def _on_modified(self, file_path: str) -> None:
+        """Handle a file modification event."""
+        if self._should_debounce(file_path):
+            return
+        if not self.manager.is_file_lfs_tracked(file_path):
+            return
+        self.log(f"Modified: {file_path}")
+        ok, reason = self.manager.lock(file_path)
+        if ok:
+            self.stats.files_locked += 1
+            self.log("  Auto-locked")
+        else:
+            self.stats.files_skipped += 1
+            self.log(f"  Lock failed: {reason}")
+
+    def run(self) -> int:
+        """Start watching. Blocks until Ctrl-C."""
+        if self._is_already_running():
+            click.echo("Error: LFS watch is already running.", err=True)
+            return 1
+
+        if not (self.project_root / ".git").is_dir():
+            click.echo("Error: Not a git repository.", err=True)
+            return 1
+
+        click.echo("LFS Watch started. Ctrl-C to stop.")
+        self._write_pid_file()
+
+        if not _WATCHDOG_AVAILABLE:
+            click.echo(
+                "Error: watchdog is not installed. Run: pip install py_wlcli[lfs]",
+                err=True,
+            )
+            return 1
+
+        import watchdog.observers
+
+        self._startup_scan()
+
+        # Determine the branch to poll
+        branch = self._get_default_branch()
+        if branch:
+            self.log(f"Push monitoring active on: origin/{branch}")
+            self._ref_hash_cache[branch] = self._get_current_ref(branch) or ""
+
+        observer = watchdog.observers.Observer()
+        event_handler = _WatchdogHandler(self)
+        observer.schedule(event_handler, str(self.project_root), recursive=True)
+        observer.start()
+
+        try:
+            while self._running:
+                if branch:
+                    self._poll_ref(branch)
+                time.sleep(self.REF_POLL_INTERVAL)
+        except KeyboardInterrupt:
+            pass
+        finally:
+            observer.stop()
+            observer.join()
+            self._cleanup_pid_file()
+
+        click.echo(
+            f"LFS Watch stopped. "
+            f"Session: {self.stats.files_locked} lock(s), "
+            f"{self.stats.files_unlocked} unlock(s), "
+            f"{self.stats.files_skipped} skipped."
+        )
+        return 0
+
+    def _get_default_branch(self) -> str | None:
+        """Determine the default remote branch."""
+        result = self.manager._run_git(["symbolic-ref", "refs/remotes/origin/HEAD"])
+        if result.returncode != 0:
+            return None
+        full = result.stdout.strip()
+        return cast("str", full.replace("refs/remotes/origin/", ""))
+
+
+if _WATCHDOG_AVAILABLE:
+
+    class _WatchdogHandler(watchdog.events.FileSystemEventHandler):
+        """Watchdog event handler that dispatches to LfsWatcher."""
+
+        def __init__(self, watcher: LfsWatcher) -> None:
+            super().__init__()
+            self.watcher = watcher
+
+        def on_modified(self, event: watchdog.events.FileSystemEvent) -> None:
+            if not event.is_directory:
+                src = event.src_path
+                if isinstance(src, bytes):
+                    src = src.decode("utf-8", errors="replace")
+                self.watcher._on_modified(src)

wl_cli/commands/lint/__init__.py

@@ -0,0 +1 @@
+"""Lint command package."""