stemtrace 0.3.2__tar.gz → 0.3.4__tar.gz

{stemtrace-0.3.2 → stemtrace-0.3.4}/.bumpversion.toml

@@ -1,5 +1,5 @@
 [tool.bumpversion]
-current_version = "0.3.2"
+current_version = "0.3.4"
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)"
 serialize = ["{major}.{minor}.{patch}"]
 commit = true

{stemtrace-0.3.2 → stemtrace-0.3.4}/.github/workflows/ci.yml

@@ -152,7 +152,7 @@ jobs:
         run: uvx twine check dist/*
 
       - name: Upload dist artifacts
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: dist
           path: dist/

{stemtrace-0.3.2 → stemtrace-0.3.4}/.github/workflows/e2e.yml

@@ -24,7 +24,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Select compose file and Celery env
         run: |
@@ -91,7 +91,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Select compose file and Celery env
         run: |
@@ -167,7 +167,7 @@ jobs:
           PLAYWRIGHT_BASE_URL: http://localhost:8000
 
       - name: Upload Playwright report
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: playwright-report-${{ matrix.broker }}
@@ -175,7 +175,7 @@ jobs:
           retention-days: 7
 
       - name: Upload test results
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         if: failure()
         with:
           name: playwright-test-results-${{ matrix.broker }}

{stemtrace-0.3.2 → stemtrace-0.3.4}/.github/workflows/release.yml

@@ -74,7 +74,7 @@ jobs:
         run: twine check dist/*
 
       - name: Upload dist artifacts
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: dist
           path: dist/
@@ -87,7 +87,7 @@ jobs:
       id-token: write
     steps:
       - name: Download dist artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: dist
           path: dist/
@@ -104,8 +104,11 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Log in to GitHub Container Registry
         uses: docker/login-action@v3
@@ -116,7 +119,7 @@ jobs:
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ghcr.io/${{ github.repository }}
           tags: |
@@ -124,10 +127,11 @@ jobs:
             type=raw,value=latest
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           push: true
+          platforms: linux/amd64,linux/arm64
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
@@ -142,7 +146,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Download dist artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: dist
           path: dist/

{stemtrace-0.3.2 → stemtrace-0.3.4}/CHANGELOG.md

@@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.4] - 2026-06-25
+
+### Fixed
+- WebSocket: deny unauthenticated connections during the handshake instead of accepting and then closing them. The accept-then-close path half-opened the connection, so when an unauthenticated client (e.g. a port scanner) aborted mid-handshake, uvicorn's legacy `websockets` implementation ran `close()` on a protocol whose `transfer_data_task` was never set, raising `AttributeError: 'WebSocketProtocol' object has no attribute 'transfer_data_task'`. Closing before `accept()` rejects the handshake (HTTP 403) without opening the protocol object.
+- Form login: build the login form action and redirects as relative paths instead of absolute URLs, and derive the session cookie's `Secure` flag from `X-Forwarded-Proto`. Behind a TLS-terminating proxy that doesn't forward the scheme to the ASGI scope (e.g. uvicorn without `--forwarded-allow-ips`), absolute URLs were downgraded to `http://`, so the browser posted the login form over http, the proxy answered `301 -> https`, the POST body was dropped, and login silently failed (with a mixed-content warning). stemtrace now works behind such a proxy without requiring forwarded-headers configuration.
+
+## [0.3.3] - 2026-03-20
+
+### Added
+- Node alias from arguments: derive graph node display name from task args/kwargs via `node_alias_from_arguments` config option (thanks @ohadmata for the idea — #46, #48)
+- Docker: multi-architecture image builds (amd64 + arm64) (thanks @ohadmata — #51)
+
+### Fixed
+- Graph: order task nodes before synthetic container nodes (GROUP/CHORD) for correct rendering (thanks @codyburrito — #52)
+
 ## [0.3.2] - 2026-02-28
 
 ### Fixed

{stemtrace-0.3.2 → stemtrace-0.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: stemtrace
-Version: 0.3.2
+Version: 0.3.4
 Summary: A lightweight Celery task flow visualizer
 Project-URL: Homepage, https://github.com/iansokolskyi/stemtrace
 Project-URL: Documentation, https://github.com/iansokolskyi/stemtrace#readme
@@ -56,7 +56,7 @@ Description-Content-Type: text/markdown
 
 **Zero-infrastructure Celery task flow visualizer**
 
-[![PyPI version](https://img.shields.io/badge/pypi-v0.3.2-darklime)](https://pypi.org/project/stemtrace)
+[![PyPI version](https://img.shields.io/badge/pypi-v0.3.4-darklime)](https://pypi.org/project/stemtrace)
 [![Python](https://img.shields.io/pypi/pyversions/stemtrace.svg)](https://pypi.org/project/stemtrace/)
 [![CI](https://github.com/iansokolskyi/stemtrace/actions/workflows/ci.yml/badge.svg)](https://github.com/iansokolskyi/stemtrace/actions/workflows/ci.yml)
 [![codecov](https://codecov.io/gh/iansokolskyi/stemtrace/graph/badge.svg)](https://codecov.io/gh/iansokolskyi/stemtrace)
@@ -250,6 +250,10 @@ stemtrace.init_worker(
     scrub_sensitive_data=True,                 # Scrub passwords, API keys, etc.
     additional_sensitive_keys=frozenset({"my_secret"}),  # Add custom keys
     safe_keys=frozenset({"public_key"}),       # Never scrub these keys
+
+    # UI display
+    node_alias_from_arguments="operator_type", # Use kwargs["operator_type"] as node name
+    # node_alias_from_arguments="0",           # Or use args[0] (digit string = positional index)
 )
 
 # Introspection (after init)

{stemtrace-0.3.2 → stemtrace-0.3.4}/README.md

@@ -2,7 +2,7 @@
 
 **Zero-infrastructure Celery task flow visualizer**
 
-[![PyPI version](https://img.shields.io/badge/pypi-v0.3.2-darklime)](https://pypi.org/project/stemtrace)
+[![PyPI version](https://img.shields.io/badge/pypi-v0.3.4-darklime)](https://pypi.org/project/stemtrace)
 [![Python](https://img.shields.io/pypi/pyversions/stemtrace.svg)](https://pypi.org/project/stemtrace/)
 [![CI](https://github.com/iansokolskyi/stemtrace/actions/workflows/ci.yml/badge.svg)](https://github.com/iansokolskyi/stemtrace/actions/workflows/ci.yml)
 [![codecov](https://codecov.io/gh/iansokolskyi/stemtrace/graph/badge.svg)](https://codecov.io/gh/iansokolskyi/stemtrace)
@@ -196,6 +196,10 @@ stemtrace.init_worker(
     scrub_sensitive_data=True,                 # Scrub passwords, API keys, etc.
     additional_sensitive_keys=frozenset({"my_secret"}),  # Add custom keys
     safe_keys=frozenset({"public_key"}),       # Never scrub these keys
+
+    # UI display
+    node_alias_from_arguments="operator_type", # Use kwargs["operator_type"] as node name
+    # node_alias_from_arguments="0",           # Or use args[0] (digit string = positional index)
 )
 
 # Introspection (after init)

{stemtrace-0.3.2 → stemtrace-0.3.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "stemtrace"
-version = "0.3.2"
+version = "0.3.4"
 description = "A lightweight Celery task flow visualizer"
 readme = "README.md"
 license = { text = "MIT" }

{stemtrace-0.3.2 → stemtrace-0.3.4}/src/stemtrace/__init__.py

@@ -43,7 +43,7 @@ if TYPE_CHECKING:
     from celery import Celery
     from fastapi import FastAPI
 
-__version__ = "0.3.2"
+__version__ = "0.3.4"
 __all__ = [
     "ConfigurationError",
     "StemtraceConfig",
@@ -93,6 +93,7 @@ def init_worker(
     additional_sensitive_keys: frozenset[str] | None = None,
     safe_keys: frozenset[str] | None = None,
     max_data_size: int = 10240,
+    node_alias_from_arguments: str | None = None,
 ) -> None:
     """Initialize stemtrace for Celery worker instrumentation.
 
@@ -107,6 +108,9 @@ def init_worker(
         additional_sensitive_keys: Extra keys to treat as sensitive.
         safe_keys: Keys to never scrub (overrides sensitive).
         max_data_size: Maximum size in bytes for serialized data (default: 10KB).
+        node_alias_from_arguments: Derive node display name from task arguments.
+            Pass a digit string to use args[index], a string key for kwargs[key],
+            or None to use the task name (default).
 
     Raises:
         ConfigurationError: If no broker URL can be determined.
@@ -130,6 +134,7 @@ def init_worker(
         additional_sensitive_keys=additional_sensitive_keys or frozenset(),
         safe_keys=safe_keys or frozenset(),
         max_data_size=max_data_size,
+        node_alias_from_arguments=node_alias_from_arguments,
     )
     set_config(config)
 
@@ -153,6 +158,7 @@ def init_app(
     login_password: str | None = None,
     login_secret: str | None = None,
     login_ttl_seconds: int = 86400,
+    node_alias_from_arguments: str | None = None,
 ) -> StemtraceExtension:
     """Initialize stemtrace as a FastAPI extension.
 
@@ -174,6 +180,8 @@ def init_app(
             STEMTRACE_LOGIN_SECRET env var. If still missing, a random secret is
             generated (sessions invalidated on app restart).
         login_ttl_seconds: Session TTL in seconds (default: 24 hours).
+        node_alias_from_arguments: Derive graph node display name from task arguments.
+            Digit string for args[index], string for kwargs[key], or None (default).
 
     Returns:
         The initialized StemtraceExtension instance.
@@ -230,6 +238,7 @@ def init_app(
         max_nodes=max_nodes,
         auth_dependency=auth_dependency,
         form_auth_config=form_auth_config,
+        node_alias_from_arguments=node_alias_from_arguments,
     )
     extension.init_app(fastapi_app, prefix=prefix)
 

{stemtrace-0.3.2 → stemtrace-0.3.4}/src/stemtrace/library/config.py

@@ -16,6 +16,9 @@ class StemtraceConfig(BaseModel):
         scrub_sensitive_data: Whether to scrub sensitive keys.
         additional_sensitive_keys: Extra keys to treat as sensitive.
         safe_keys: Keys to never scrub (overrides sensitive).
+        node_alias_from_arguments: Derive graph node display name from task
+            arguments. Pass a string key to use kwargs[key], a digit string
+            to use args[index], or None to use the task name (default).
     """
 
     model_config = ConfigDict(frozen=True)
@@ -34,6 +37,9 @@ class StemtraceConfig(BaseModel):
     additional_sensitive_keys: frozenset[str] = Field(default_factory=frozenset)
     safe_keys: frozenset[str] = Field(default_factory=frozenset)
 
+    # UI display options
+    node_alias_from_arguments: str | None = None
+
 
 _config: StemtraceConfig | None = None
 

{stemtrace-0.3.2 → stemtrace-0.3.4}/src/stemtrace/server/api/routes.py

@@ -123,9 +123,40 @@ def _node_to_response(node: TaskNode) -> TaskNodeResponse:
     )
 
 
+def _resolve_node_alias(node: TaskNode, key: str | None) -> str:
+    """Resolve display name for a graph node from task arguments.
+
+    When a key is configured, attempts to extract a value from the first
+    event's args (if key is a digit string) or kwargs (if key is a regular
+    string). Falls back to the node's registered task name.
+
+    Args:
+        node: Task node containing events with args/kwargs.
+        key: Digit string for args[index], string for kwargs[key],
+            or None to use the task name.
+
+    Returns:
+        Resolved display name for the node.
+    """
+    if key is None or not node.events:
+        return node.name
+
+    event = node.events[0]
+
+    if key.isdigit():
+        index = int(key)
+        if isinstance(event.args, list) and index < len(event.args):
+            return str(event.args[index])
+    elif isinstance(event.kwargs, dict) and key in event.kwargs:
+        return str(event.kwargs[key])
+
+    return node.name
+
+
 def _node_to_graph_response(
     node: TaskNode,
     all_nodes: dict[str, TaskNode] | None = None,
+    node_alias_key: str | None = None,
 ) -> GraphNodeResponse:
     """Convert TaskNode to graph response model.
 
@@ -134,6 +165,7 @@ def _node_to_graph_response(
     Args:
         node: Task node from graph store.
         all_nodes: All nodes dict for child lookup.
+        node_alias_key: Key to resolve display name from task arguments.
 
     Returns:
         GraphNodeResponse with timing from children.
@@ -159,15 +191,25 @@ def _node_to_graph_response(
     if first_seen and last_updated and first_seen != last_updated:
         duration_ms = int((last_updated - first_seen).total_seconds() * 1000)
 
+    # UI traversal is order-sensitive when callbacks can appear as both direct
+    # children and CHORD-linked nodes. Prefer TASK children first so callback
+    # branches render before synthetic containers.
+    children = node.children
+    if all_nodes is not None:
+        children = sorted(
+            node.children,
+            key=lambda c: getattr(all_nodes.get(c), "node_type", None) != "TASK",
+        )
+
     return GraphNodeResponse(
         task_id=node.task_id,
-        name=node.name,
+        name=_resolve_node_alias(node, node_alias_key),
         state=node.state,
         node_type=node.node_type,
         group_id=node.group_id,
         chord_id=node.chord_id,
         parent_id=node.parent_id,
-        children=node.children,
+        children=children,
         duration_ms=duration_ms,
         first_seen=first_seen,
         last_updated=last_updated,
@@ -289,6 +331,7 @@ def create_api_router(
     ws_manager: WebSocketManager | None = None,
     worker_registry: WorkerRegistry | None = None,
     broker_url: str | None = None,
+    node_alias_from_arguments: str | None = None,
 ) -> APIRouter:
     """Create REST API router with task and graph endpoints.
 
@@ -298,6 +341,8 @@ def create_api_router(
         ws_manager: Optional WebSocket manager.
         worker_registry: Optional worker registry for lifecycle tracking.
         broker_url: Optional Celery broker URL for on-demand inspection.
+        node_alias_from_arguments: Key to derive node display name from task
+            arguments. Digit string for args[index], string for kwargs[key].
 
     Returns:
         Configured API router.
@@ -562,7 +607,12 @@ def create_api_router(
             for child in store.get_children(root.task_id):
                 all_nodes[child.task_id] = child
         return GraphListResponse(
-            graphs=[_node_to_graph_response(r, all_nodes) for r in roots],
+            graphs=[
+                _node_to_graph_response(
+                    r, all_nodes, node_alias_key=node_alias_from_arguments
+                )
+                for r in roots
+            ],
             total=total,
             limit=limit,
             offset=offset,
@@ -586,7 +636,10 @@ def create_api_router(
         return GraphResponse(
             root_id=root_id,
             nodes={
-                tid: _node_to_graph_response(n, all_nodes) for tid, n in graph.items()
+                tid: _node_to_graph_response(
+                    n, all_nodes, node_alias_key=node_alias_from_arguments
+                )
+                for tid, n in graph.items()
             },
         )
 

{stemtrace-0.3.2 → stemtrace-0.3.4}/src/stemtrace/server/api/websocket.py

@@ -33,8 +33,12 @@ def create_websocket_router(
                 secret=form_auth_config.secret,
                 expected_username=form_auth_config.username,
             ):
-                # Close without registering the connection.
-                await websocket.accept()
+                # Deny the handshake without completing it. Accepting first and
+                # then closing half-opens the connection; if the unauthenticated
+                # client aborts during that dance, uvicorn's legacy websockets
+                # impl runs close() on a protocol whose transfer_data_task was
+                # never set and raises AttributeError. Closing before accept lets
+                # Starlette reject the handshake (HTTP 403) without opening it.
                 await websocket.close(code=1008)
                 return
 

{stemtrace-0.3.2 → stemtrace-0.3.4}/src/stemtrace/server/fastapi/extension.py

@@ -67,6 +67,7 @@ class StemtraceExtension:
         max_nodes: int = 10000,
         auth_dependency: Any = None,
         form_auth_config: FormAuthConfig | None = None,
+        node_alias_from_arguments: str | None = None,
     ) -> None:
         """Initialize extension with broker and transport configuration.
 
@@ -81,6 +82,8 @@ class StemtraceExtension:
             max_nodes: Maximum number of nodes to keep in memory.
             auth_dependency: Optional FastAPI dependency applied to all routes for authentication.
             form_auth_config: Optional cookie-session configuration used to protect WebSocket.
+            node_alias_from_arguments: Key to derive graph node display name from task
+                arguments. Digit string for args[index], string for kwargs[key].
         """
         self._broker_url = broker_url
         self._transport_url = transport_url or broker_url
@@ -103,6 +106,8 @@ class StemtraceExtension:
                 worker_registry=self._worker_registry,
             )
 
+        self._node_alias_from_arguments = node_alias_from_arguments
+
         self._store.add_listener(self._ws_manager.queue_event)
 
     @staticmethod
@@ -141,6 +146,7 @@ class StemtraceExtension:
             broker_url=self._broker_url,
             auth_dependency=self._auth_dependency,
             form_auth_config=self._form_auth_config,
+            node_alias_from_arguments=self._node_alias_from_arguments,
         )
 
         if self._serve_ui:

{stemtrace-0.3.2 → stemtrace-0.3.4}/src/stemtrace/server/fastapi/login_routes.py

@@ -40,6 +40,20 @@ def _safe_next(next_path: str | None, *, default: str) -> str:
     return next_path
 
 
+def _request_is_https(request: Request) -> bool:
+    """Best-effort HTTPS detection that survives a TLS-terminating proxy.
+
+    Falls back to the ``X-Forwarded-Proto`` header when the ASGI scheme is
+    ``http`` because proxy headers weren't applied to the scope (e.g. uvicorn
+    without ``--forwarded-allow-ips``). The first value of a comma-separated
+    list is the original client scheme.
+    """
+    if request.url.scheme == "https":
+        return True
+    forwarded = request.headers.get("x-forwarded-proto", "")
+    return forwarded.split(",")[0].strip().lower() == "https"
+
+
 def _login_page_html(*, action_path: str, error: str | None, next_path: str) -> str:
     """Render the login page HTML from a template."""
     escaped_title = html.escape(_DEFAULT_TITLE, quote=True)
@@ -92,7 +106,10 @@ def create_login_router(
         next_path = _safe_next(
             request.query_params.get("next"), default=default_next_path
         )
-        action_path = str(request.url_for("stemtrace_login_submit"))
+        # Relative path (not an absolute URL): the browser submits using the
+        # page's own scheme/host, so a TLS-terminating proxy that doesn't
+        # forward the scheme can't downgrade the form action to http.
+        action_path = request.url_for("stemtrace_login_submit").path
         rendered_html = _login_page_html(
             action_path=action_path, error=error, next_path=next_path
         )
@@ -125,7 +142,7 @@ def create_login_router(
             qs = {"error": "Invalid username or password"}
             if next_param:
                 qs["next"] = next_param
-            login_url = str(request.url_for("stemtrace_login_page"))
+            login_url = request.url_for("stemtrace_login_page").path
             return RedirectResponse(
                 url=login_url + "?" + urllib.parse.urlencode(qs),
                 status_code=303,
@@ -141,7 +158,7 @@ def create_login_router(
             value=config.create_session_cookie_value(),
             httponly=True,
             samesite="lax",
-            secure=request.url.scheme == "https",
+            secure=_request_is_https(request),
             path=config.cookie_path,
         )
         return response
@@ -149,7 +166,7 @@ def create_login_router(
     @router.post("/logout", include_in_schema=False, name="stemtrace_logout")
     async def logout(request: Request) -> RedirectResponse:
         """Clear the session cookie and redirect to login."""
-        login_url = str(request.url_for("stemtrace_login_page"))
+        login_url = request.url_for("stemtrace_login_page").path
         response = RedirectResponse(url=login_url, status_code=303)
         response.delete_cookie(key=config.cookie_name, path=config.cookie_path)
         return response

{stemtrace-0.3.2 → stemtrace-0.3.4}/src/stemtrace/server/fastapi/router.py

@@ -24,6 +24,7 @@ def create_router(
     broker_url: str | None = None,
     auth_dependency: Any = None,
     form_auth_config: FormAuthConfig | None = None,
+    node_alias_from_arguments: str | None = None,
 ) -> APIRouter:
     """Create API router. For embedded consumer, use StemtraceExtension."""
     if store is None:
@@ -40,6 +41,7 @@ def create_router(
         ws_manager,
         worker_registry,
         broker_url=broker_url,
+        node_alias_from_arguments=node_alias_from_arguments,
     )
     ws_router = create_websocket_router(ws_manager, form_auth_config=form_auth_config)