querri 1.0.2__tar.gz → 1.0.7__tar.gz

{querri-1.0.2 → querri-1.0.7}/CLAUDE.md

@@ -91,3 +91,26 @@ Every resource, pagination class, and stream has mirrored sync/async implementat
 - **mypy**: Strict mode, target Python 3.9
 - **ruff**: Rules E, F, I, N, UP, B, SIM (target Python 3.9)
 - **Tests**: pytest + pytest-asyncio (mode: auto) + respx for HTTP mocking
+
+## Releasing
+
+Single source of truth: `querri/_version.py`. `pyproject.toml` reads it via `[tool.hatch.version]` — never edit a version string anywhere else.
+
+To cut a release:
+
+```bash
+./scripts/release.sh X.Y.Z
+```
+
+The script: stashes uncommitted work, bumps `_version.py`, runs ruff + mypy + pytest, commits as "Bump version to X.Y.Z", tags `vX.Y.Z`, pushes main + tag, restores the stash. Pushing the tag triggers `.github/workflows/release.yml`, which re-runs CI and (on green) publishes to PyPI via Trusted Publisher.
+
+Verify after release:
+
+```bash
+gh run watch $(gh run list --workflow=release.yml --limit 1 --json databaseId -q '.[0].databaseId')
+curl -s https://pypi.org/pypi/querri/json | python3 -c "import json,sys;print(json.load(sys.stdin)['info']['version'])"
+```
+
+If `release.yml` fails, fix forward and bump to the next patch — never re-tag a published version. PyPI rejects republishing the same version even if the previous attempt failed mid-flight.
+
+Tests assert the CLI's `--version` output and `user_agent` against `__version__` dynamically (`tests/test_cli.py`, `tests/test_config.py`) — if you ever see a hardcoded version string in a test, that's a bug; replace it with `__version__`.

{querri-1.0.2 → querri-1.0.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: querri
-Version: 1.0.2
+Version: 1.0.7
 Summary: Python SDK and CLI for the Querri data analysis platform
 Project-URL: Homepage, https://querri.com
 Project-URL: Documentation, https://docs.querri.com/sdk/python

querri-1.0.7/TODO.md

@@ -0,0 +1,53 @@
+# CLI QA Findings
+
+Issues found during end-to-end QA of every CLI command (2026-04-14).
+
+---
+
+## Fixed
+
+### ✅ `querri session list` — timestamp displayed as Unix epoch float
+`created_at` was a float (e.g. `1776171557.8591616`). Now formatted as `2026-04-14 15:42 UTC`.
+**Fix:** `querri/cli/embed.py` — pre-process row dicts before passing to `print_table`.
+
+### ✅ `querri project select` — multiple matches broke non-interactive mode
+Was falling through to the interactive picker loop and auto-selecting [1] via `EOFError` catch,
+printing a noisy prompt. Now errors cleanly: "Ambiguous name '…' matches N projects. Use a project UUID."
+**Fix:** `querri/cli/projects.py` — check `obj["interactive"]` before showing the picker.
+
+### ✅ `querri share source list` / `remove` — HTTP 405
+GET and DELETE endpoints for `/sources/{id}/shares` were never wired up on the server,
+even though the `_list_shares` and `_revoke_share` helpers existed.
+**Fix:** `Querri/server-api/api/public_api/routes/sharing.py` — added `list_source_shares` (GET)
+and `revoke_source_share` (DELETE) routes, mirroring the project/dashboard pattern.
+
+### ✅ `querri share source org` — HTTP 404
+CLI was calling `/sources/{id}/shares/org` but the server route is `/sources/{id}/org-share`.
+Also the request body was missing the `enabled` field that the server expects.
+**Fix:** `querri/cli/sharing.py` — corrected path and added `"enabled": True` to the body.
+
+### ✅ 501 errors — cryptic "HTTP 501" message
+`dashboard new`, `dashboard delete`, `source sync` all hit intentional 501s (FGA warrant
+creation/cleanup and Redis job queue not yet implemented server-side). Error message was
+just "Error: HTTP 501 / Request ID: …".
+**Fix:** `querri/cli/_output.py` — 501 now prints:
+"This feature is not yet available via the API. Use the Querri web app instead."
+
+---
+
+## Needs Server Infrastructure Work (out of scope for CLI)
+
+### ⏳ `querri dashboard new` / `dashboard delete` — HTTP 501
+Intentional. Server has FGA warrant creation (`fga.create_warrant()`) and cleanup
+(`fga.delete_warrants_for_resource()`) not yet implemented. Until the FGA service is
+updated, dashboard create/delete must go through the web app.
+
+### ⏳ `querri source sync` — HTTP 501
+Intentional. Server is missing `RedisStreamsClient.enqueue_source_job()`. The infrastructure
+for submitting sync jobs to the Redis queue hasn't been built out yet.
+
+### ⏳ `querri step data` — HTTP 404 (qdf_not_found)
+`step list` correctly reports `has_data: True` but `/steps/{id}/data` returns 404.
+The QDF metadata or parquet file is absent in storage despite the step showing data.
+Likely a garbage collection or race condition in the data pipeline — needs investigation
+in the server's QDF save/load path.

{querri-1.0.2 → querri-1.0.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "querri"
-version = "1.0.2"
+dynamic = ["version"]
 description = "Python SDK and CLI for the Querri data analysis platform"
 readme = "README.md"
 license = "MIT"
@@ -57,6 +57,9 @@ Homepage = "https://querri.com"
 Documentation = "https://docs.querri.com/sdk/python"
 Repository = "https://github.com/querri-ai/querri-python"
 
+[tool.hatch.version]
+path = "querri/_version.py"
+
 [tool.hatch.build.targets.wheel]
 packages = ["querri"]
 

{querri-1.0.2 → querri-1.0.7}/querri/_auth.py

@@ -23,10 +23,8 @@ import httpx
 # Constants
 # ---------------------------------------------------------------------------
 
-WORKOS_CLIENT_ID = "client_01HGV989QK3KDNN4JJNGCD87RH"
-WORKOS_AUTHORIZE_URL = "https://api.workos.com/user_management/authorize"
 OAUTH_TIMEOUT_SECONDS = 120
-OAUTH_CALLBACK_PORT = 11847  # Fixed port for WorkOS redirect URI registration
+OAUTH_CALLBACK_PORT = 11847  # Fixed port; registered as allowed redirect URI
 REFRESH_BUFFER_SECONDS = 300  # 5 minutes
 
 
@@ -177,8 +175,9 @@ class TokenStore:
         }
         content = json.dumps(data, indent=2)
 
-        # Atomic write: create temp file with 0600 permissions, then rename
-        tmp_path_obj = self.STORE_DIR / ".tokens_tmp"
+        # Atomic write: create a unique temp file (pid-stamped to avoid races
+        # when multiple querri processes run concurrently), then rename.
+        tmp_path_obj = self.STORE_DIR / f".tokens_tmp_{os.getpid()}"
         try:
             # Create file with restricted permissions — no race window
             fd = os.open(
@@ -438,7 +437,7 @@ rel="stylesheet">
     color:#c5c8cb;
     display:flex;align-items:center;justify-content:center;
     min-height:100vh;
-    overflow:hidden;
+    overflow:auto;
   }
   /* animated grid background */
   body::before{
@@ -594,8 +593,7 @@ rel="stylesheet">
       <div class="section-label typing">create &amp; upload</div>
       <div class="cmd typing">
         <span class="prompt">$</span>
-        <span class="command"> querri projects create</span>
-        <span class="flag"> --name</span>
+        <span class="command"> querri project new</span>
         <span class="string"> "Q1 Analysis"</span>
       </div>
       <div class="cmd typing">
@@ -608,14 +606,8 @@ rel="stylesheet">
       <div class="section-label typing">chat with your data</div>
       <div class="cmd typing">
         <span class="prompt">$</span>
-        <span class="command"> querri chats create</span>
-        <span class="arg"> &lt;project-id&gt;</span>
-      </div>
-      <div class="cmd typing">
-        <span class="prompt">$</span>
-        <span class="command"> querri chats stream</span>
-        <span class="arg"> &lt;project&gt; &lt;chat&gt;</span>
-        <span class="flag"> --prompt</span>
+        <span class="command"> querri project chat</span>
+        <span class="flag"> -m</span>
         <span class="string"> "summarize revenue by region"</span>
       </div>
 
@@ -660,6 +652,43 @@ class _OAuthCallbackServer(HTTPServer):
             self.handle_request()
 
 
+def _fetch_well_known(host: str) -> dict[str, Any]:
+    """Fetch RFC 8414 OAuth authorization server metadata from the Querri server.
+
+    Args:
+        host: The Querri server host (e.g. ``https://app.querri.com``).
+
+    Returns:
+        Parsed JSON dict with ``authorization_endpoint``, ``token_endpoint``, etc.
+
+    Raises:
+        RuntimeError: If the metadata endpoint cannot be reached or returns an error.
+    """
+    url = host.rstrip("/") + "/.well-known/oauth-authorization-server"
+    try:
+        response = httpx.get(url, timeout=10.0)
+        response.raise_for_status()
+        return response.json()  # type: ignore[no-any-return]
+    except Exception as exc:
+        raise RuntimeError(
+            f"Failed to fetch server metadata from {url}: {exc}"
+        ) from exc
+
+
+def _generate_pkce() -> tuple[str, str]:
+    """Generate a PKCE code_verifier and S256 code_challenge pair.
+
+    Returns:
+        Tuple of ``(code_verifier, code_challenge)``.
+    """
+    import hashlib
+
+    code_verifier = secrets.token_urlsafe(64)
+    digest = hashlib.sha256(code_verifier.encode("ascii")).digest()
+    code_challenge = base64.urlsafe_b64encode(digest).rstrip(b"=").decode("ascii")
+    return code_verifier, code_challenge
+
+
 def start_oauth_flow(
     host: str,
     callback: Any = None,
@@ -668,19 +697,21 @@ def start_oauth_flow(
 ) -> dict[str, Any]:
     """Run the browser-based OAuth login flow.
 
-    1. Starts a local HTTP server on 127.0.0.1:11847 (fixed port)
-    2. Opens the browser to the WorkOS authorize URL
-    3. Waits for the callback with the authorization code
-    4. Exchanges the code for tokens via the Querri server proxy
+    1. Fetches ``/.well-known/oauth-authorization-server`` to discover endpoints
+    2. Starts a local HTTP server on 127.0.0.1:11847 (fixed port)
+    3. Opens the browser to the Querri authorize endpoint (which proxies to WorkOS)
+    4. Waits for the server to redirect back with an ``mcp_``-prefixed code
+    5. Exchanges the code for tokens using PKCE (no client secret needed)
 
     Args:
         host: The Querri server host (e.g. ``https://app.querri.com``).
         callback: Unused — reserved for future progress callbacks.
-        organization_id: Optional WorkOS organization ID to scope the login.
+        organization_id: Optional organization ID to scope the login. Required
+            for users who belong to multiple organizations.
 
     Returns:
         Dict with ``access_token``, ``refresh_token``, ``expires_at``,
-        ``user_id``, ``org_id``, ``user_email``.
+        ``user_id``, ``org_id``, ``user_email``, ``all_organizations``.
 
     Raises:
         RuntimeError: If not in an interactive terminal, or if the flow
@@ -692,28 +723,38 @@ def start_oauth_flow(
             "For CI/scripts, use QUERRI_API_KEY instead."
         )
 
-    # Generate state for CSRF protection
+    # Discover endpoints from the server
+    well_known = _fetch_well_known(host)
+    authorize_endpoint = well_known.get("authorization_endpoint", "")
+    token_endpoint = well_known.get("token_endpoint", "")
+    if not authorize_endpoint or not token_endpoint:
+        raise RuntimeError(
+            f"Server at {host} did not return valid OAuth metadata "
+            "(missing authorization_endpoint or token_endpoint)."
+        )
+
+    # Generate PKCE and CSRF state
+    code_verifier, code_challenge = _generate_pkce()
     state = secrets.token_urlsafe(32)
 
     # Start local callback server
     server = _OAuthCallbackServer(expected_state=state)
     port = server.server_address[1]
-
     redirect_uri = f"http://127.0.0.1:{port}/callback"
 
-    # Build authorize URL
-    client_id = os.environ.get("QUERRI_WORKOS_CLIENT_ID", WORKOS_CLIENT_ID)
+    # Build authorize URL — the server proxies to WorkOS using its own client_id
     params: dict[str, str] = {
-        "client_id": client_id,
+        "client_id": "querri-cli",
         "redirect_uri": redirect_uri,
         "response_type": "code",
         "state": state,
-        "provider": "authkit",
+        "scope": "",
+        "code_challenge": code_challenge,
+        "code_challenge_method": "S256",
     }
     if organization_id:
         params["organization_id"] = organization_id
-    authorize_params = urlencode(params)
-    authorize_url = f"{WORKOS_AUTHORIZE_URL}?{authorize_params}"
+    authorize_url = f"{authorize_endpoint}?{urlencode(params)}"
 
     # Open browser
     print("Opening browser for authentication...", file=sys.stderr)
@@ -740,15 +781,14 @@ def start_oauth_flow(
             f"{OAUTH_TIMEOUT_SECONDS} seconds."
         )
 
-    # Exchange authorization code for tokens
-    token_url = host.rstrip("/") + "/api/v1/auth/cli/token"
+    # Exchange the mcp_ code for tokens using PKCE (no redirect_uri needed)
     try:
         response = httpx.post(
-            token_url,
+            token_endpoint,
             json={
                 "grant_type": "authorization_code",
                 "code": server.auth_code,
-                "redirect_uri": redirect_uri,
+                "code_verifier": code_verifier,
             },
             timeout=30.0,
         )

querri-1.0.7/querri/_version.py

@@ -0,0 +1 @@
+__version__ = "1.0.7"

{querri-1.0.2 → querri-1.0.7}/querri/cli/_app.py

@@ -159,6 +159,14 @@ def _global_options(
     # Determine interactive mode
     is_interactive = interactive if interactive is not None else IS_INTERACTIVE
 
+    # Validate --host has a scheme
+    if host and not host.startswith(("http://", "https://")):
+        print(
+            f"Error: --host must include a scheme (e.g. https://{host}).",
+            file=sys.stderr,
+        )
+        raise typer.Exit(code=2)
+
     # Warn about --api-key in shell history (only in interactive TTY mode)
     if api_key and is_interactive:
         import sys as _sys

{querri-1.0.2 → querri-1.0.7}/querri/cli/_output.py

@@ -253,6 +253,13 @@ def handle_api_error(exc: Exception, *, is_json: bool | None = False) -> int:
         exit_code = EXIT_SERVER_ERROR
         error_type = "server_error"
         message = str(exc)
+    elif isinstance(exc, APIError) and exc.status == 501:
+        exit_code = EXIT_ERROR
+        error_type = "not_implemented"
+        message = (
+            "This feature is not yet available via the API. "
+            "Use the Querri web app instead."
+        )
     else:
         exit_code = EXIT_ERROR
         error_type = "api_error"

{querri-1.0.2 → querri-1.0.7}/querri/cli/auth.py

@@ -124,6 +124,9 @@ def login(
     ``--organization org_01JBETJ7PYNGXVMXV0BD3CFNA8``
     """
     host = host or _get_host(ctx)
+    if not host.startswith(("http://", "https://")):
+        print_error(f"--host must include a scheme (e.g. https://{host}).")
+        raise typer.Exit(code=2)
     profile_name = _get_profile_name(ctx)
     is_json = _is_json(ctx)
 
@@ -159,40 +162,6 @@ def login(
     chosen_org_id = result["org_id"]
     chosen_org_name = result.get("org_name", "")
 
-    # If the user didn't pass --organization and they belong to multiple orgs,
-    # show a terminal picker so they can choose which org to work in.
-    if not organization and len(all_orgs) > 1 and not is_json:
-        chosen_org_id, chosen_org_name = _pick_organization(
-            all_orgs,
-            current_org_id=result["org_id"],
-        )
-        # If they picked a different org, refresh tokens scoped to that org
-        if chosen_org_id != result["org_id"]:
-            try:
-                temp_profile = TokenProfile(
-                    auth_type="jwt",
-                    access_token=result["access_token"],
-                    refresh_token=result["refresh_token"],
-                    expires_at=result["expires_at"],
-                    org_id=chosen_org_id,
-                    org_name=chosen_org_name,
-                    user_email=result["user_email"],
-                    user_id=result["user_id"],
-                    user_name=result.get("user_name", ""),
-                    host=host,
-                )
-                temp_profile = refresh_tokens(
-                    temp_profile,
-                    host,
-                    organization_id=chosen_org_id,
-                )
-                result["access_token"] = temp_profile.access_token
-                result["refresh_token"] = temp_profile.refresh_token
-                result["expires_at"] = temp_profile.expires_at
-            except RuntimeError as exc:
-                print_error(f"Failed to switch organization: {exc}")
-                raise typer.Exit(code=2) from None
-
     # Save profile
     profile = TokenProfile(
         auth_type="jwt",
@@ -226,9 +195,16 @@ def login(
         name = result.get("user_name")
         if name:
             identity = f"{name} ({identity})"
-        if chosen_org_name:
-            identity = f"{identity} — {chosen_org_name}"
         print_success(f"Logged in as {identity}")
+        org_label = chosen_org_name or chosen_org_id or "(unknown)"
+        if chosen_org_id and chosen_org_name:
+            org_label = f"{chosen_org_name} ({chosen_org_id})"
+        print(f"  Organization: {org_label}", file=sys.stderr)
+        if len(all_orgs) > 1:
+            print(
+                "  To switch organizations, run: querri auth switch-org",
+                file=sys.stderr,
+            )
 
 
 # ---------------------------------------------------------------------------

{querri-1.0.2 → querri-1.0.7}/querri/cli/embed.py

@@ -126,8 +126,18 @@ def list_sessions(
     if obj.get("json"):
         print_json(result)
     else:
+        from datetime import datetime, timezone
+
+        rows = []
+        for s in result.data:
+            row = dict(s) if isinstance(s, dict) else s.__dict__.copy()
+            ts = row.get("created_at")
+            if isinstance(ts, (int, float)):
+                dt = datetime.fromtimestamp(ts, tz=timezone.utc)
+                row["created_at"] = dt.strftime("%Y-%m-%d %H:%M UTC")
+            rows.append(row)
         print_table(
-            result.data,
+            rows,
             [
                 ("session_token", "Token"),
                 ("user_id", "User ID"),

{querri-1.0.2 → querri-1.0.7}/querri/cli/projects.py

@@ -213,6 +213,13 @@ def select_project(
             if obj.get("json"):
                 print_json([{"id": p.id, "name": p.name} for p in matches])
                 return
+            is_interactive = obj.get("interactive", sys.stdin.isatty())
+            if not is_interactive:
+                print_error(
+                    f"Ambiguous name '{name_or_id}' matches {len(matches)} projects. "
+                    "Use a project UUID or pass --json to list matches."
+                )
+                raise typer.Exit(code=1)
             print(f"\nMultiple projects match '{name_or_id}':\n", file=sys.stderr)
             for i, p in enumerate(matches, 1):
                 print(f"  [{i}] {p.name} ({p.id})", file=sys.stderr)
@@ -221,7 +228,8 @@ def select_project(
                 try:
                     raw = input("Select [1]: ").strip() or "1"
                 except (EOFError, KeyboardInterrupt):
-                    raw = "1"
+                    print(file=sys.stderr)
+                    raise typer.Exit(code=0) from None
                 try:
                     idx = int(raw)
                     if 1 <= idx <= len(matches):
@@ -707,7 +715,7 @@ def _get_full_project(client: object, project_id: str) -> Project | None:
         http = client._http  # type: ignore[attr-defined]
         # The SDK's request() method handles auth headers and retries
         base_url = str(http._client.base_url)
-        internal_base = base_url.replace("/api/v1", "/api")
+        internal_base = base_url.replace("/api/v1", "/api").rstrip("/")
 
         import httpx as _httpx
 

{querri-1.0.2 → querri-1.0.7}/querri/cli/sharing.py

@@ -390,8 +390,8 @@ def org_source_share(
     client = get_client(ctx)
     try:
         resp = client._http.post(
-            f"/sources/{source_id}/shares/org",
-            json={"permission": permission},
+            f"/sources/{source_id}/org-share",
+            json={"enabled": True, "permission": permission},
         )
         result = resp.json()
     except Exception as exc: