sediment-cli 0.4.0__tar.gz → 0.5.0__tar.gz

{sediment_cli-0.4.0 → sediment_cli-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sediment-cli
-Version: 0.4.0
+Version: 0.5.0
 Summary: The sediment command: login, install, server, facts, exports
 Project-URL: Source, https://github.com/sediment-ai/sediment
 Project-URL: Documentation, https://github.com/sediment-ai/sediment/tree/main/docs
@@ -10,7 +10,7 @@ License-Expression: AGPL-3.0-or-later
 License-File: LICENSE
 Requires-Python: >=3.12
 Requires-Dist: httpx>=0.27
-Requires-Dist: sediment-api==0.4.0
-Requires-Dist: sediment-core==0.4.0
-Requires-Dist: sediment-derive==0.4.0
-Requires-Dist: sediment-export==0.4.0
+Requires-Dist: sediment-api==0.5.0
+Requires-Dist: sediment-core==0.5.0
+Requires-Dist: sediment-derive==0.5.0
+Requires-Dist: sediment-export==0.5.0

{sediment_cli-0.4.0 → sediment_cli-0.5.0}/pyproject.toml

@@ -5,7 +5,7 @@
 # Depends on sediment-api deliberately: the operator verbs are DB-local by
 # design (ADR 0001) and `server`/reports/mirror-gc forward into it.
 name = "sediment-cli"
-version = "0.4.0"
+version = "0.5.0"
 description = "The sediment command: login, install, server, facts, exports"
 requires-python = ">=3.12"
 license = "AGPL-3.0-or-later"
@@ -14,10 +14,10 @@ license-files = ["LICENSE"]
 # so an install never mixes member versions (the release workflow asserts
 # the versions agree before publishing).
 dependencies = [
-    "sediment-core==0.4.0",
-    "sediment-derive==0.4.0",
-    "sediment-export==0.4.0",
-    "sediment-api==0.4.0",
+    "sediment-core==0.5.0",
+    "sediment-derive==0.5.0",
+    "sediment-export==0.5.0",
+    "sediment-api==0.5.0",
     "httpx>=0.27",
 ]
 

{sediment_cli-0.4.0 → sediment_cli-0.5.0}/sediment_cli/attribution.py

@@ -105,9 +105,12 @@ try:
 except ImportError:  # pragma: no cover — run by path, not as a package
     # The checkout shim (scripts/sediment_attribution.py) and the fleet
     # bundle execute this file standalone, where no sibling ui module
-    # exists. Those are hook/MDM piped contexts: plain text is the correct
-    # output there, so a passthrough stand-in keeps the bytes identical.
+    # exists. Keep styling plain and match ui's server-text display filter.
     class ui:  # type: ignore[no-redef]  # ponytail: plain-text stand-in
+        @staticmethod
+        def printable_text(value: object) -> str:
+            return "".join(char for char in str(value) if char.isprintable())
+
         @staticmethod
         def style(text: str, *names: str, stream=None) -> str:
             return text
@@ -2876,13 +2879,23 @@ def _env_pairs(
 
 
 def _write_0600(path: Path, content: str) -> None:
-    """0600 on create AND on rewrite — O_CREAT's mode applies only at
-    creation, and these files carry the bearer token."""
+    """Publish a complete private file without truncating the previous version."""
+    if path.is_symlink():
+        raise ValueError(
+            "refusing to replace a symbolic link with private configuration"
+        )
     path.parent.mkdir(parents=True, exist_ok=True)
-    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
-    os.fchmod(fd, 0o600)
-    with os.fdopen(fd, "w", encoding="utf-8") as fh:
-        fh.write(content)
+    temporary = path.with_name(f".{path.name}.{uuid4().hex}.tmp")
+    fd = os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as fh:
+            os.fchmod(fh.fileno(), 0o600)
+            fh.write(content)
+            fh.flush()
+            os.fsync(fh.fileno())
+        os.replace(temporary, path)
+    finally:
+        temporary.unlink(missing_ok=True)
 
 
 def _write_env_files(pairs: list[tuple[str, str]]) -> None:
@@ -3209,11 +3222,13 @@ def _uninstall_codex_profiles() -> bool:
     complete = True
     for path in profiles:
         try:
-            if path.is_symlink() or not path.is_file():
+            if not path.is_file():
                 raise ValueError
             original = path.read_text(encoding="utf-8")
             if _CODEX_OTEL_BEGIN not in original and _CODEX_OTEL_END not in original:
                 continue
+            if path.is_symlink():
+                raise ValueError
             remaining = _without_codex_telemetry(original)
             if remaining.strip():
                 _write_0600(path, remaining)
@@ -3423,7 +3438,8 @@ def _doctor_server(findings: list[Finding]) -> None:
             )
         )
         return
-    detail = f"reachable, {authority} token valid (org {body.get('org_id')})"
+    org_id = ui.printable_text(body.get("org_id"))
+    detail = f"reachable, {authority} token valid (org {org_id})"
     try:
         from sediment_cli import __version__ as client_version
         from sediment_cli import version_skew_advice

{sediment_cli-0.4.0 → sediment_cli-0.5.0}/sediment_cli/cli.py

@@ -820,7 +820,8 @@ def _store_login(
     cfg["servers"] = servers
     write_config(cfg)
     action = "capture credential enrolled for" if capture else "logged in to"
-    print(f"{ui.glyph('✓', 'phosphor')}{action} {url} (org {me['org_id']})")
+    org_id = ui.printable_text(me["org_id"])
+    print(f"{ui.glyph('✓', 'phosphor')}{action} {url} (org {org_id})")
     return 0
 
 
@@ -908,9 +909,8 @@ def cmd_logout(args: argparse.Namespace) -> int:
     if cfg.get("current") == url:
         cfg["current"] = None
     write_config(cfg)
-    print(
-        f"{ui.glyph('✓', 'phosphor')}logged out of {url} (org {removed.get('org_id')})"
-    )
+    org_id = ui.printable_text(removed.get("org_id"))
+    print(f"{ui.glyph('✓', 'phosphor')}logged out of {url} (org {org_id})")
     return 0
 
 

{sediment_cli-0.4.0 → sediment_cli-0.5.0}/sediment_cli/client.py

@@ -226,7 +226,11 @@ def _error_detail(resp: httpx.Response) -> str:
         }
         if isinstance(reason, str) and reason in messages:
             return messages[reason]
-    return detail if isinstance(detail, str) else f"server error ({resp.status_code})"
+    return (
+        ui.printable_text(detail)
+        if isinstance(detail, str)
+        else f"server error ({resp.status_code})"
+    )
 
 
 def probe_me(base_url: str, token: str) -> dict[str, Any]:

{sediment_cli-0.4.0 → sediment_cli-0.5.0}/sediment_cli/ui.py

@@ -54,6 +54,11 @@ _LOGO = "\n".join(
 )
 
 
+def printable_text(value: object) -> str:
+    """Keep printable text without server-supplied terminal or line controls."""
+    return "".join(char for char in str(value) if char.isprintable())
+
+
 def on(stream: TextIO | None = None) -> bool:
     """Whether *stream* (default stdout) gets styled output."""
     stream = sys.stdout if stream is None else stream

{sediment_cli-0.4.0 → sediment_cli-0.5.0}/tests/test_cli_remote.py

@@ -862,6 +862,96 @@ def test_error_detail_uses_the_servers_detail_string() -> None:
     assert api_client._error_detail(resp) == "org_id is required"
 
 
+@pytest.mark.parametrize("command", ["login", "facts", "demo"])
+@pytest.mark.parametrize(
+    ("detail", "display"),
+    [
+        ("org_id is required", "org_id is required"),
+        ("Équipe 東京 — Δ 🚀", "Équipe 東京 — Δ 🚀"),
+        ("bad\x1b[31m\x1b]0;title\x07\r\nforged\x9b\u2028", "bad[31m]0;titleforged"),
+    ],
+    ids=["ascii", "unicode", "controls"],
+)
+def test_remote_errors_print_only_display_text(
+    tmp_path, monkeypatch, capsys, command, detail, display
+):
+    import httpx
+
+    url = "http://127.0.0.1:8000"
+    monkeypatch.setattr(api_client, "CONFIG_PATH", tmp_path / "config.json")
+    monkeypatch.setattr(api_client, "_version_checked", True)
+    monkeypatch.delenv("SEDIMENT_DATABASE_URL", raising=False)
+    monkeypatch.delenv("SEDIMENT_SESSION_TOKEN", raising=False)
+    monkeypatch.setenv("SEDIMENT_URL", url)
+    api_client.write_config({"current": url, "servers": {url: {"token": "synthetic"}}})
+    monkeypatch.setattr(
+        api_client,
+        "_http",
+        lambda: httpx.Client(
+            transport=httpx.MockTransport(
+                lambda request: httpx.Response(400, json={"detail": detail})
+            )
+        ),
+    )
+    monkeypatch.setattr(sys, "stdin", io.StringIO("synthetic\n"))
+    arguments = [command, url, "--with-token"] if command == "login" else [command]
+
+    assert cli.main(arguments) == 1
+
+    output = capsys.readouterr()
+    # Compare escaped output so a regression can't execute controls in test logs.
+    assert ascii(output.err) == ascii(f"error: {display}\n")
+    assert output.out == (
+        f"posting demo session (synthetic) to {url}\n" if command == "demo" else ""
+    )
+
+
+@pytest.mark.parametrize(
+    ("org_id", "display"),
+    [
+        ("ordinary-team", "ordinary-team"),
+        ("Équipe 東京 — Δ 🚀", "Équipe 東京 — Δ 🚀"),
+        ("team\x1b]0;title\x07\r\nforged", "team]0;titleforged"),
+    ],
+    ids=["ascii", "unicode", "controls"],
+)
+def test_login_and_logout_filter_identity_only_for_display(
+    tmp_path, monkeypatch, capsys, org_id, display
+):
+    import httpx
+
+    url = "https://sediment.example.com"
+    monkeypatch.delenv("SEDIMENT_SESSION_TOKEN", raising=False)
+    monkeypatch.setattr(api_client, "CONFIG_PATH", tmp_path / "config.json")
+    monkeypatch.setattr(sys, "stdin", io.StringIO("synthetic\n"))
+    monkeypatch.setattr(
+        api_client,
+        "_http",
+        lambda: httpx.Client(
+            transport=httpx.MockTransport(
+                lambda request: httpx.Response(
+                    200,
+                    json={
+                        "org_id": org_id,
+                        "authority": "operator",
+                        "client_id": "operator",
+                    },
+                )
+            )
+        ),
+    )
+
+    assert cli.main(["login", url, "--with-token"]) == 0
+    assert api_client.read_config()["servers"][url]["org_id"] == org_id
+    assert cli.main(["logout"]) == 0
+
+    output = capsys.readouterr()
+    assert ascii(output.out) == ascii(
+        f"logged in to {url} (org {display})\nlogged out of {url} (org {display})\n"
+    )
+    assert output.err == ""
+
+
 def test_commit_shows_exact_ci_without_session_observation(remote, capsys, monkeypatch):
     from sediment_api.config import settings
     from sediment_api.main import app

{sediment_cli-0.4.0 → sediment_cli-0.5.0}/tests/test_delivery_transport.py

@@ -1171,8 +1171,13 @@ for line in sys.stdin:
                 process.stdin.write(line)
                 process.stdin.flush()
             results = [process.stdout.readline() for process in publishers]
-            assert results == ["queued buffered\n"] * 8, f"round {round_}"
-            assert delivery.status(queue)["pending"] == 8
+            assert set(results) <= {"queued buffered\n", "declined storage_busy\n"}, (
+                f"round {round_}"
+            )
+            assert "queued buffered\n" in results, f"round {round_}"
+            assert delivery.status(queue)["pending"] == results.count(
+                "queued buffered\n"
+            )
     finally:
         for process in publishers:
             process.kill()

{sediment_cli-0.4.0 → sediment_cli-0.5.0}/tests/testdata/help/sediment.txt

@@ -1,4 +1,4 @@
-sediment v0.4.0 — Turn AI developer workflow traces into RL-ready training data.
+sediment v0.5.0 — Turn AI developer workflow traces into RL-ready training data.
 
 USAGE:
   sediment <command> [options]