queryview 0.0.4__tar.gz → 0.0.6__tar.gz

{queryview-0.0.4 → queryview-0.0.6}/.github/actions/start-git-daemon/action.yaml

@@ -3,8 +3,8 @@ description: >-
   Start a loopback `git daemon` that serves — and accepts pushes into — bare
   repos under a base path, so e2e tests exercise git sync against a real
   git:// remote with no auth. Creates an empty bare repo and exports
-  GIT_SYNC_REMOTE pointing at it; `--detach` keeps the daemon alive across
-  steps.
+  E2E_GIT_REMOTE pointing at it, which the e2e suite applies to the default
+  workspace; `--detach` keeps the daemon alive across steps.
 
 runs:
   using: composite
@@ -15,7 +15,7 @@ runs:
         GIT_DAEMON_BASE="$RUNNER_TEMP/gitsrv"
         mkdir -p "$GIT_DAEMON_BASE"
         git init --bare -b main "$GIT_DAEMON_BASE/queryview.git"
-        echo "GIT_SYNC_REMOTE=git://127.0.0.1:9418/queryview.git" >> "$GITHUB_ENV"
+        echo "E2E_GIT_REMOTE=git://127.0.0.1:9418/queryview.git" >> "$GITHUB_ENV"
         git daemon --reuseaddr --listen=127.0.0.1 --port=9418 \
           --base-path="$GIT_DAEMON_BASE" --export-all \
           --enable=receive-pack --detach

{queryview-0.0.4 → queryview-0.0.6}/.github/workflows/publish.yaml

@@ -221,7 +221,7 @@ jobs:
       - name: Smoke-test installed package
         working-directory: ${{ runner.temp }}
         run: |
-          DB_PATH="$PWD/queryview.db" "$GITHUB_WORKSPACE/.venv/bin/queryview" > server.log 2>&1 &
+          DATA_DIR="$PWD/qv-data" "$GITHUB_WORKSPACE/.venv/bin/queryview" > server.log 2>&1 &
           pid=$!
           for i in $(seq 1 30); do
             curl -sf http://localhost:8000/api/health > /dev/null && break
@@ -417,6 +417,9 @@ jobs:
 
       # Retag the exact multi-arch manifest the smoke gate tested — no
       # rebuild, no wait-for-PyPI. Tested digests ARE the published digests.
+      # The rc tags are left in place: a GHCR package version is a digest,
+      # and vX.Y.Z / latest share the rc manifest's digest, so deleting the
+      # rc version would delete the release with it.
       - name: Promote rc manifest
         run: |
           REF="ghcr.io/kolodkin/queryview"
@@ -425,19 +428,3 @@ jobs:
             TAGS+=(-t "${REF}:latest")
           fi
           docker buildx imagetools create "${TAGS[@]}" "${REF}:${{ inputs.tag }}-rc"
-
-      # Best-effort: GITHUB_TOKEN may lack package-version delete rights;
-      # leftover -rc tags are harmless and useful for debugging.
-      - name: Clean up rc tags
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          for suffix in rc rc-amd64 rc-arm64; do
-            TAG="${{ inputs.tag }}-${suffix}"
-            VERSION_ID=$(gh api "/user/packages/container/queryview/versions" --paginate \
-              --jq ".[] | select(.metadata.container.tags[]? == \"${TAG}\") | .id" | head -n1)
-            if [ -n "$VERSION_ID" ]; then
-              gh api -X DELETE "/user/packages/container/queryview/versions/${VERSION_ID}" || true
-            fi
-          done

{queryview-0.0.4 → queryview-0.0.6}/.gitignore

@@ -26,6 +26,7 @@ backend/queryview/static/
 backend/*.db
 backend/*.db-*
 backend/*.key
+backend/db.sqlite*
 
 # Editor
 .DS_Store

{queryview-0.0.4 → queryview-0.0.6}/CLAUDE.md

@@ -3,6 +3,18 @@
 1. Avoid `Co-Authored-By: Claude` (and similar Claude/AI attribution) trailers in
    commit messages and PR bodies.
 
+# Data Privacy
+
+1. **Never commit tenant data.** Real customer, tenant, or environment
+   identifiers (database and table names, hostnames, account or user names,
+   query results, screenshots of live data) must not appear in code, tests,
+   fixtures, docs, or commit messages.
+2. **Always anonymize.** When an example needs realistic-looking data, invent
+   generic names (e.g. `sales_reporting`, `example.internal`). Rewrite any
+   pasted samples before using them.
+3. If tenant data slips into history, rewrite the commits to remove it and
+   force-push the branch rather than adding a follow-up commit.
+
 # Operational Guidelines
 
 1. Use `uv run` (e.g. `uv run pytest`, `uv run python ...`), not `python -m` or a

{queryview-0.0.4 → queryview-0.0.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: queryview
-Version: 0.0.4
+Version: 0.0.6
 Summary: QueryView: FastAPI + SQLModel backend and React SPA over the ClickHouse HTTP interface
 Project-URL: Homepage, https://github.com/kolodkin/queryview
 Project-URL: Repository, https://github.com/kolodkin/queryview
@@ -16,7 +16,6 @@ Requires-Dist: duckdb>=1.0
 Requires-Dist: fastapi>=0.110
 Requires-Dist: httpx>=0.27
 Requires-Dist: mcp<2,>=1.9
-Requires-Dist: platformdirs>=4
 Requires-Dist: pyyaml>=6
 Requires-Dist: sqlalchemy[asyncio]>=2.0
 Requires-Dist: sqlmodel>=0.0.16
@@ -51,9 +50,69 @@ To serve on a different host port, remap it (the container keeps listening on
 expects to be reached from localhost only, so prefer binding the published port
 to loopback: `docker run -p 127.0.0.1:8000:8000 ...`.
 
-State (the SQLite DB and its encryption key) lives in `/home/queryview`; mount a
-volume there to persist it across containers:
-`docker run -p 8000:8000 -v queryview-data:/home/queryview ghcr.io/kolodkin/queryview:latest`.
+The command above keeps its state inside the container, so connections and
+workspaces are lost when the container is removed. See
+[Run with Docker](#run-with-docker) for a persistent setup.
+
+## Run with Docker
+
+The image runs as the non-root user `queryview` (UID 1000) and sets
+`DATA_DIR=/var/lib/queryview`, so every piece of state lives directly under that
+one directory:
+
+| Path | Contents |
+|---|---|
+| `/var/lib/queryview/db.sqlite` | SQLite store: connections, workspaces, queries, dashboards |
+| `/var/lib/queryview/encryption.key` | Key that encrypts stored connection passwords |
+| `/var/lib/queryview/gitsync/` | Local clones used by workspace git sync |
+
+Mount a volume at `/var/lib/queryview` and all three persist across container
+restarts, removals and upgrades.
+
+### Persisting it
+
+```bash
+mkdir -p ~/.queryview
+docker run -d --name queryview \
+  -p 127.0.0.1:8000:8000 \
+  -v ~/.queryview:/var/lib/queryview \
+  ghcr.io/kolodkin/queryview:latest
+```
+
+Create the directory first so Docker doesn't create it owned by root. The
+container runs as UID 1000, the first user on most Linux distributions; if
+`id -u` prints something else, add `--user "$(id -u):$(id -g)"` so the
+container writes the files as you.
+
+`~/.queryview` is also where a local `uvx queryview` keeps its state, so the
+container and a local run share one database, key and set of clones with no
+extra setup. Don't run both at once: each would serve the same SQLite file.
+
+To let Docker own the location instead, swap the path for a named volume,
+`-v queryview-data:/var/lib/queryview`. Docker seeds it from the image, so
+ownership is already right and there is nothing to create up front, but the
+state no longer lines up with a local run.
+
+### Git sync
+
+The image ships `git`, so workspace git sync works in the container, and its
+clones live under `/var/lib/queryview/gitsync/`, which the mount above already
+covers. Give the workspace an HTTPS remote carrying a scoped, expiring token —
+[docs/gitsync.md](docs/gitsync.md) has the URL form and what becomes of the
+credential.
+
+SSH also works, but nothing in the container can answer a prompt: the key must
+be passphrase-free and `known_hosts` must already list the host. Mount one
+dedicated deploy key, not your whole `.ssh`, readable by UID 1000:
+
+```bash
+docker run -d --name queryview \
+  -p 127.0.0.1:8000:8000 \
+  -v ~/.queryview:/var/lib/queryview \
+  -v ~/.ssh/queryview_deploy:/home/queryview/.ssh/id_ed25519:ro \
+  -v ~/.ssh/known_hosts:/home/queryview/.ssh/known_hosts:ro \
+  ghcr.io/kolodkin/queryview:latest
+```
 
 ## Layout
 
@@ -201,10 +260,7 @@ The single-page prompt UI is described in [docs/queryview.md](docs/queryview.md)
 connecting (`new <type>` / `connect <name>`), SQLite persistence, and session
 auto-connect are specified in [docs/connect.md](docs/connect.md).
 
-Connections are stored in SQLite. The default location is the platform's
-user-data directory — `$XDG_DATA_HOME/queryview/queryview.db` (i.e.
-`~/.local/share/queryview/`) on Linux, `~/Library/Application Support/queryview/`
-on macOS, `%LOCALAPPDATA%\queryview\` on Windows — overridable with `DB_PATH`.
-Alongside it the backend writes a local password-encryption key
-(`<db>.key`, override with `DB_KEY_PATH`) and the workspace git-sync clones
-(`<db>.gitsync/`, override with `GIT_SYNC_DIR`).
+All state lives in one data directory, `~/.queryview` on every OS, relocated
+with `DATA_DIR`. Inside are the SQLite store `db.sqlite`, the local
+password-encryption key `encryption.key`, and the workspace git-sync clones
+under `gitsync/`.

{queryview-0.0.4 → queryview-0.0.6}/README.md

@@ -26,9 +26,69 @@ To serve on a different host port, remap it (the container keeps listening on
 expects to be reached from localhost only, so prefer binding the published port
 to loopback: `docker run -p 127.0.0.1:8000:8000 ...`.
 
-State (the SQLite DB and its encryption key) lives in `/home/queryview`; mount a
-volume there to persist it across containers:
-`docker run -p 8000:8000 -v queryview-data:/home/queryview ghcr.io/kolodkin/queryview:latest`.
+The command above keeps its state inside the container, so connections and
+workspaces are lost when the container is removed. See
+[Run with Docker](#run-with-docker) for a persistent setup.
+
+## Run with Docker
+
+The image runs as the non-root user `queryview` (UID 1000) and sets
+`DATA_DIR=/var/lib/queryview`, so every piece of state lives directly under that
+one directory:
+
+| Path | Contents |
+|---|---|
+| `/var/lib/queryview/db.sqlite` | SQLite store: connections, workspaces, queries, dashboards |
+| `/var/lib/queryview/encryption.key` | Key that encrypts stored connection passwords |
+| `/var/lib/queryview/gitsync/` | Local clones used by workspace git sync |
+
+Mount a volume at `/var/lib/queryview` and all three persist across container
+restarts, removals and upgrades.
+
+### Persisting it
+
+```bash
+mkdir -p ~/.queryview
+docker run -d --name queryview \
+  -p 127.0.0.1:8000:8000 \
+  -v ~/.queryview:/var/lib/queryview \
+  ghcr.io/kolodkin/queryview:latest
+```
+
+Create the directory first so Docker doesn't create it owned by root. The
+container runs as UID 1000, the first user on most Linux distributions; if
+`id -u` prints something else, add `--user "$(id -u):$(id -g)"` so the
+container writes the files as you.
+
+`~/.queryview` is also where a local `uvx queryview` keeps its state, so the
+container and a local run share one database, key and set of clones with no
+extra setup. Don't run both at once: each would serve the same SQLite file.
+
+To let Docker own the location instead, swap the path for a named volume,
+`-v queryview-data:/var/lib/queryview`. Docker seeds it from the image, so
+ownership is already right and there is nothing to create up front, but the
+state no longer lines up with a local run.
+
+### Git sync
+
+The image ships `git`, so workspace git sync works in the container, and its
+clones live under `/var/lib/queryview/gitsync/`, which the mount above already
+covers. Give the workspace an HTTPS remote carrying a scoped, expiring token —
+[docs/gitsync.md](docs/gitsync.md) has the URL form and what becomes of the
+credential.
+
+SSH also works, but nothing in the container can answer a prompt: the key must
+be passphrase-free and `known_hosts` must already list the host. Mount one
+dedicated deploy key, not your whole `.ssh`, readable by UID 1000:
+
+```bash
+docker run -d --name queryview \
+  -p 127.0.0.1:8000:8000 \
+  -v ~/.queryview:/var/lib/queryview \
+  -v ~/.ssh/queryview_deploy:/home/queryview/.ssh/id_ed25519:ro \
+  -v ~/.ssh/known_hosts:/home/queryview/.ssh/known_hosts:ro \
+  ghcr.io/kolodkin/queryview:latest
+```
 
 ## Layout
 
@@ -176,10 +236,7 @@ The single-page prompt UI is described in [docs/queryview.md](docs/queryview.md)
 connecting (`new <type>` / `connect <name>`), SQLite persistence, and session
 auto-connect are specified in [docs/connect.md](docs/connect.md).
 
-Connections are stored in SQLite. The default location is the platform's
-user-data directory — `$XDG_DATA_HOME/queryview/queryview.db` (i.e.
-`~/.local/share/queryview/`) on Linux, `~/Library/Application Support/queryview/`
-on macOS, `%LOCALAPPDATA%\queryview\` on Windows — overridable with `DB_PATH`.
-Alongside it the backend writes a local password-encryption key
-(`<db>.key`, override with `DB_KEY_PATH`) and the workspace git-sync clones
-(`<db>.gitsync/`, override with `GIT_SYNC_DIR`).
+All state lives in one data directory, `~/.queryview` on every OS, relocated
+with `DATA_DIR`. Inside are the SQLite store `db.sqlite`, the local
+password-encryption key `encryption.key`, and the workspace git-sync clones
+under `gitsync/`.

{queryview-0.0.4 → queryview-0.0.6}/backend/queryview/conftest.py

@@ -1,8 +1,8 @@
 """Shared fixtures for backend (non-e2e) tests.
 
-Redirects the SQLite store and encryption-key file to a per-session tempdir so
-tests don't touch the real `backend/queryview.db`, and resets the lazy
-module-level engine/schema state in `queryview.connect` before tests run."""
+Redirects the data directory to a per-session tempdir so tests don't touch the
+real one, and resets the lazy module-level engine/schema state in
+`queryview.connect` before tests run."""
 
 from __future__ import annotations
 
@@ -14,7 +14,18 @@ import pytest
 
 
 @pytest.fixture
-def git_env(tmp_path, monkeypatch):
+def clone_base(tmp_path, monkeypatch) -> Path:
+    """Redirect every workspace's sync clone into this test's tmpdir, so clones
+    never land in the session data dir and can't leak between tests."""
+    from queryview import gitsync
+
+    base = tmp_path / "clones"
+    monkeypatch.setattr(gitsync, "_clone_base", lambda: base)
+    return base
+
+
+@pytest.fixture
+def git_env(tmp_path, clone_base):
     """A local bare repo as the default workspace's git-sync remote + a fresh
     per-workspace clone base dir. Resets the default workspace to 'no remote'
     on teardown so unconfigured-state tests stay valid."""
@@ -28,7 +39,6 @@ def git_env(tmp_path, monkeypatch):
         check=True,
         capture_output=True,
     )
-    monkeypatch.setenv("GIT_SYNC_DIR", str(tmp_path / "clones"))
     asyncio.run(update_workspace(DEFAULT_WORKSPACE, remote=str(remote)))
     yield remote
     asyncio.run(update_workspace(DEFAULT_WORKSPACE, remote=None))
@@ -69,13 +79,7 @@ def default_ws_id() -> int:
 @pytest.fixture(scope="session", autouse=True)
 def _isolated_db(tmp_path_factory: pytest.TempPathFactory):
     tmp: Path = tmp_path_factory.mktemp("qv_backend_tests")
-    os.environ["DB_PATH"] = str(tmp / "test.db")
-    os.environ["DB_KEY_PATH"] = str(tmp / "test.db.key")
-
-    # The workspaces migration seeds the default workspace from GIT_SYNC_*;
-    # tests control that per-test (monkeypatch), never from ambient env.
-    os.environ.pop("GIT_SYNC_REMOTE", None)
-    os.environ.pop("GIT_SYNC_BRANCH", None)
+    os.environ["DATA_DIR"] = str(tmp)
 
     # Reset the lazy globals so the next DB touch picks up the new paths.
     import queryview.connect as _c

{queryview-0.0.4 → queryview-0.0.6}/backend/queryview/connect.py

@@ -14,7 +14,6 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import TYPE_CHECKING, Any, ClassVar
 
-import platformdirs
 from cryptography.hazmat.primitives.ciphers.aead import AESGCM
 from sqlalchemy.ext.asyncio import create_async_engine
 from sqlmodel import Field, SQLModel, col, select
@@ -40,15 +39,18 @@ class Connection(SQLModel, table=True):
     last_active_at: int  # unix ms; the max is the "latest active"
 
 
+def _data_dir() -> Path:
+    """Every piece of state lives here: DATA_DIR, else `~/.queryview` — the same
+    path on every OS, and the image's mount point, so a local run and a container
+    share state. Deliberately not package-relative: that put the DB in
+    site-packages, which is uv's disposable cache under `uvx`."""
+    env = os.environ.get("DATA_DIR")
+    return Path(env) if env else Path.home() / ".queryview"
+
+
 def _db_path() -> Path:
-    """The SQLite store's path: DB_PATH, else the platform's user-data dir
-    (`$XDG_DATA_HOME/queryview` on Linux, `Application Support` on macOS,
-    `%LOCALAPPDATA%` on Windows). Deliberately not package-relative — that put
-    the DB in site-packages, which is uv's disposable cache under `uvx`."""
-    env = os.environ.get("DB_PATH")
-    if env:
-        return Path(env)
-    return Path(platformdirs.user_data_dir("queryview")) / "queryview.db"
+    """The SQLite store: a fixed name in the data dir — move the dir, not it."""
+    return _data_dir() / "db.sqlite"
 
 
 _engine = None
@@ -67,7 +69,7 @@ def _engine_for_db():
 def _alembic_config() -> Config:
     """Alembic Config built in code (not a cwd alembic.ini) so migrations run from
     any directory and from the packaged wheel. Points at the package's migrations
-    dir and injects a *sync* SQLite URL for the current DB_PATH."""
+    dir and injects a *sync* SQLite URL for the current data dir."""
     from alembic.config import Config
 
     cfg = Config()
@@ -85,9 +87,9 @@ async def _ensure_schema() -> None:
         return
     from alembic import command
 
-    # SQLite won't create a missing parent, and the user-data dir doesn't exist
-    # on a fresh install; the key file and git-sync clones land here too.
-    _db_path().parent.mkdir(parents=True, exist_ok=True)
+    # SQLite won't create a missing parent, and the data dir doesn't exist on a
+    # fresh install; the key file and git-sync clones land here too.
+    _data_dir().mkdir(parents=True, exist_ok=True)
     command.upgrade(_alembic_config(), "head")
     _schema_ready = True
 
@@ -99,8 +101,7 @@ async def _ensure_schema() -> None:
 
 
 def _key_path() -> Path:
-    env = os.environ.get("DB_KEY_PATH")
-    return Path(env) if env else Path(f"{_db_path()}.key")
+    return _data_dir() / "encryption.key"
 
 
 _key: bytes | None = None

{queryview-0.0.4 → queryview-0.0.6}/backend/queryview/gitsync.py

@@ -11,9 +11,11 @@ import os
 import shutil
 from pathlib import Path
 from typing import Any
+from urllib.parse import unquote, urlsplit, urlunsplit
 
 import yaml
 
+from .connect import _data_dir
 from .workspaces import WorkspaceRec
 from .yamlio import YamlIOError, dashboard_from_data, dump_yaml, query_from_data, query_to_data, slug
 
@@ -86,8 +88,7 @@ def dashboard_from_files(files: dict[str, str]) -> dict[str, Any]:
 
 
 # --- Configuration ---------------------------------------------------------
-# Runtime config lives on the workspace row (GIT_SYNC_REMOTE/GIT_SYNC_BRANCH
-# are read once, by the workspaces migration, to seed the default workspace).
+# All config lives on the workspace row; there is no environment fallback.
 
 
 def _require_remote(ws: WorkspaceRec) -> str:
@@ -96,15 +97,15 @@ def _require_remote(ws: WorkspaceRec) -> str:
     return ws.remote
 
 
+def _clone_base() -> Path:
+    """Where every workspace's sync clone lives, inside the data dir."""
+    return _data_dir() / "gitsync"
+
+
 def _workdir(ws: WorkspaceRec) -> Path:
     """This workspace's clone: {base}/{workspace id}. Keyed by id so renaming
-    a workspace never orphans its clone. GIT_SYNC_DIR overrides the base."""
-    env = os.environ.get("GIT_SYNC_DIR")
-    if env:
-        return Path(env) / str(ws.id)
-    from .connect import _db_path
-
-    return Path(f"{_db_path()}.gitsync") / str(ws.id)
+    a workspace never orphans its clone."""
+    return _clone_base() / str(ws.id)
 
 
 def configured(ws: WorkspaceRec) -> bool:
@@ -129,15 +130,73 @@ def _lock(ws: WorkspaceRec) -> asyncio.Lock:
     return lock
 
 
-async def _git(*args: str, cwd: Path | None = None) -> str:
-    proc = await asyncio.create_subprocess_exec(
-        "git",
-        *args,
-        cwd=str(cwd) if cwd else None,
-        stdout=asyncio.subprocess.PIPE,
-        stderr=asyncio.subprocess.PIPE,
-    )
-    out, err = await proc.communicate()
+# Seconds before a git invocation is killed; only network calls come close.
+_GIT_TIMEOUT_S = 120
+
+# Feeds the credential back per invocation from the child's environment, so it
+# reaches neither the repo's config nor our argv. Git calls a helper with "get",
+# "store" or "erase"; answering only "get" avoids writing it anywhere.
+_CREDENTIAL_HELPER = (
+    '!f() { test "$1" = get && printf "username=%s\\npassword=%s\\n" "$QV_GIT_USERNAME" "$QV_GIT_PASSWORD"; }; f'
+)
+
+
+def _split_credential(url: str) -> tuple[str, tuple[str, str] | None]:
+    """Split an http(s) URL's credential from the URL, so the URL can be handed
+    to git (and persisted in the clone's config) without it.
+
+    Only http(s) userinfo is a secret: `git@host:path` and `ssh://git@host` name
+    an SSH login, so those are returned untouched."""
+    parts = urlsplit(url)
+    if parts.scheme not in ("http", "https") or not (parts.username or parts.password):
+        return url, None
+    host = parts.hostname or ""
+    if parts.port:
+        host = f"{host}:{parts.port}"
+    sanitized = urlunsplit((parts.scheme, host, parts.path, parts.query, parts.fragment))
+    return sanitized, (unquote(parts.username or ""), unquote(parts.password or ""))
+
+
+def _credential(ws: WorkspaceRec) -> tuple[str, str] | None:
+    """This workspace's git credential, if its remote embeds one."""
+    return _split_credential(_require_remote(ws))[1]
+
+
+async def _git(*args: str, cwd: Path | None = None, credential: tuple[str, str] | None = None) -> str:
+    """Run one git command, never interactively: stdin is closed and any prompt
+    (terminal, SSH passphrase, unknown host) becomes a failure rather than a
+    blocked request. A credential, when passed, arrives via the environment."""
+    env = dict(os.environ)
+    env["GIT_TERMINAL_PROMPT"] = "0"
+    env["GIT_SSH_COMMAND"] = f"{os.environ.get('GIT_SSH_COMMAND', 'ssh')} -o BatchMode=yes"
+    if credential is not None:
+        env["QV_GIT_USERNAME"], env["QV_GIT_PASSWORD"] = credential
+        # Config through the environment, not `-c` flags, so argv stays exactly
+        # what the caller passed. The empty first value clears any helper
+        # inherited from system/global config, leaving ours the only one asked.
+        env["GIT_CONFIG_COUNT"] = "2"
+        env["GIT_CONFIG_KEY_0"], env["GIT_CONFIG_VALUE_0"] = "credential.helper", ""
+        env["GIT_CONFIG_KEY_1"], env["GIT_CONFIG_VALUE_1"] = "credential.helper", _CREDENTIAL_HELPER
+    try:
+        proc = await asyncio.create_subprocess_exec(
+            "git",
+            *args,
+            cwd=str(cwd) if cwd else None,
+            env=env,
+            stdin=asyncio.subprocess.DEVNULL,
+            stdout=asyncio.subprocess.PIPE,
+            stderr=asyncio.subprocess.PIPE,
+        )
+    except FileNotFoundError as e:
+        # No `git` on PATH: a deployment problem, not a repo problem — say so
+        # instead of surfacing a bare FileNotFoundError as a 500.
+        raise GitSyncError("git is not installed on the server") from e
+    try:
+        out, err = await asyncio.wait_for(proc.communicate(), _GIT_TIMEOUT_S)
+    except TimeoutError as e:
+        proc.kill()
+        await proc.wait()
+        raise GitSyncError(f"git {args[0]} timed out after {_GIT_TIMEOUT_S}s") from e
     if proc.returncode != 0:
         tail = err.decode("utf-8", "replace").strip()[-500:]
         raise GitSyncError(f"git {args[0]} failed: {tail}")
@@ -147,19 +206,22 @@ async def _git(*args: str, cwd: Path | None = None) -> str:
 async def _ensure_repo(ws: WorkspaceRec) -> Path:
     """The workspace's sync clone, cloning (or, for an empty remote, init +
     remote add) on first use. Idempotent."""
-    remote, branch, wd = _require_remote(ws), ws.branch, _workdir(ws)
+    branch, wd = ws.branch, _workdir(ws)
     if (wd / ".git").exists():
         return wd
     wd.parent.mkdir(parents=True, exist_ok=True)
+    # The clone records its remote in .git/config, so only the credential-free
+    # URL goes to git as an argument; the credential travels out of band.
+    remote, cred = _split_credential(_require_remote(ws))
     try:
-        await _git("clone", "--branch", branch, remote, str(wd))
+        await _git("clone", "--branch", branch, remote, str(wd), credential=cred)
     except GitSyncError as clone_err:
         # Clone can fail either because the branch genuinely doesn't exist yet
         # on an empty remote (the only case we should paper over with a local
         # init) or because the remote itself is unreachable/misconfigured. Ask
         # the remote directly to tell the two apart.
         try:
-            heads = await _git("ls-remote", "--heads", remote, branch)
+            heads = await _git("ls-remote", "--heads", remote, branch, credential=cred)
         except GitSyncError as probe_err:
             raise GitSyncError(f"git remote unreachable: {probe_err}") from probe_err
         if heads.strip():
@@ -177,7 +239,7 @@ async def _ensure_repo(ws: WorkspaceRec) -> Path:
 async def _origin_head(wd: Path, ws: WorkspaceRec) -> str | None:
     """Fetch, then the remote branch ref if it exists (None on an empty remote).
     Network/auth failures raise."""
-    await _git("fetch", "origin", cwd=wd)
+    await _git("fetch", "origin", cwd=wd, credential=_credential(ws))
     ref = f"origin/{ws.branch}"
     try:
         await _git("rev-parse", "--verify", ref, cwd=wd)
@@ -257,7 +319,7 @@ async def store(
             return {"committed": False, "sha": None, "message": "no changes"}
         label = f"{conn_type}/{name}" if kind == "query" else name
         await _git("commit", "-m", message or f"store {kind} {label}", cwd=wd)
-        await _git("push", "origin", ws.branch, cwd=wd)
+        await _git("push", "origin", ws.branch, cwd=wd, credential=_credential(ws))
         sha = (await _git("rev-parse", "HEAD", cwd=wd)).strip()
         return {"committed": True, "sha": sha, "message": "stored"}
 

{queryview-0.0.4 → queryview-0.0.6}/backend/queryview/migrations/env.py

@@ -21,7 +21,7 @@ target_metadata = SQLModel.metadata
 
 
 def _url() -> str:
-    """Prefer the URL the app injects; fall back to DB_PATH so the dev CLI
+    """Prefer the URL the app injects; fall back to the data dir so the dev CLI
     (`alembic ...`) targets the same SQLite file the app would."""
     from queryview.connect import _db_path
 

{queryview-0.0.4 → queryview-0.0.6}/backend/queryview/migrations/versions/c7d8e9f0a1b2_workspaces.py

@@ -1,8 +1,8 @@
 """workspaces: per-workspace git sync — workspaces table, entity workspace_id
 
-Seeds a 'default' workspace from GIT_SYNC_REMOTE/GIT_SYNC_BRANCH (read once
-here; runtime config lives in the table from now on) and backfills all
-existing predefined queries and dashboards into it. Name uniqueness becomes
+Creates the 'default' workspace (its remote is configured through the UI/API
+afterwards) and backfills all existing predefined queries and dashboards into
+it. Name uniqueness becomes
 per-workspace.
 
 Revision ID: c7d8e9f0a1b2
@@ -13,7 +13,6 @@ Create Date: 2026-07-10
 
 from __future__ import annotations
 
-import os
 from collections.abc import Sequence
 
 import sqlalchemy as sa
@@ -37,17 +36,12 @@ def upgrade() -> None:
     )
     op.create_index(op.f("ix_workspaces_name"), "workspaces", ["name"], unique=True)
 
-    # Seed 'default' from the legacy env config. The app's key loader is
-    # imported here, mirroring the connection-config-blob migration.
-    from queryview.connect import _encrypt_str
-
-    env_remote = os.environ.get("GIT_SYNC_REMOTE")
-    remote = _encrypt_str(env_remote) if env_remote else None
-    branch = os.environ.get("GIT_SYNC_BRANCH") or "main"
+    # No remote yet: git sync stays disabled until one is set through the
+    # UI/API, which encrypts it on the way in.
     conn = op.get_bind()
     conn.execute(
-        sa.text("INSERT INTO workspaces (name, remote, branch) VALUES (:n, :r, :b)"),
-        {"n": "default", "r": remote, "b": branch},
+        sa.text("INSERT INTO workspaces (name, remote, branch) VALUES (:n, NULL, :b)"),
+        {"n": "default", "b": "main"},
     )
     default_id = conn.execute(sa.text("SELECT id FROM workspaces WHERE name = 'default'")).scalar()