stml-cli 0.1.4__tar.gz → 0.1.5__tar.gz

{stml_cli-0.1.4 → stml_cli-0.1.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: stml-cli
-Version: 0.1.4
+Version: 0.1.5
 Summary: The stml partner CLI — pull, edit, push, and publish stml apps and libraries.
 Author: stml
 Project-URL: Homepage, https://stml.io

{stml_cli-0.1.4 → stml_cli-0.1.5}/stml_cli/__init__.py

@@ -9,7 +9,7 @@ from __future__ import annotations
 
 import os
 
-__version__ = "0.1.4"
+__version__ = "0.1.5"
 
 # TLS trust: framework/python.org builds have no OpenSSL CA path, so a real
 # https backend fails with "unable to get local issuer certificate". certifi's

{stml_cli-0.1.4 → stml_cli-0.1.5}/stml_cli/commands.py

@@ -135,9 +135,23 @@ def cmd_pull(args) -> None:
     dest.mkdir(parents=True, exist_ok=True)
     written = paths.write_tree(dest, files)
 
+    # Assets: the text overlay carries no binaries — the app's assets live in
+    # the app-assets bucket. Fetch them as one tarball and extract under
+    # assets/, so the pulled folder is a COMPLETE library dir (publish ships
+    # assets/ back through the normal split). Non-fatal: an older backend
+    # without the endpoint just means no assets/ on disk.
+    asset_count = 0
+    try:
+        asset_url = f"{args.backend}/api/app-source/assets?" + urllib.parse.urlencode(query)
+        blob = http.get_bytes(asset_url, token)
+        asset_count = paths.extract_assets(dest, blob)
+    except http.HttpError:
+        pass
+
     # Record the source coordinate so a later push can be run from the folder.
     _write_link(dest, args.backend, workspace, app)
-    _log(f"✓ Pulled {len(written)} file(s) from {result.get('app', app)} → {dest}")
+    tail = f" (+ {asset_count} asset(s))" if asset_count else ""
+    _log(f"✓ Pulled {len(written)} file(s) from {result.get('app', app)} → {dest}{tail}")
 
 
 def cmd_push(args) -> None:

{stml_cli-0.1.4 → stml_cli-0.1.5}/stml_cli/http.py

@@ -60,6 +60,27 @@ def get_json(url: str, token: str) -> dict:
     return _open(req)
 
 
+def get_bytes(url: str, token: str) -> bytes:
+    """GET a binary response (e.g. the app-assets tarball). Same error shaping
+    as ``_open`` but returns raw bytes instead of parsed JSON."""
+    req = urllib.request.Request(url, headers={"Authorization": f"Bearer {token}"}, method="GET")
+    try:
+        with urllib.request.urlopen(req) as resp:
+            return resp.read()
+    except urllib.error.HTTPError as e:
+        raw = e.read().decode("utf-8", "replace")
+        detail = raw
+        try:
+            parsed = json.loads(raw)
+            if isinstance(parsed, dict) and "detail" in parsed:
+                detail = str(parsed["detail"])
+        except (ValueError, TypeError):
+            pass
+        raise HttpError(e.code, detail)
+    except urllib.error.URLError as e:  # network / DNS / TLS
+        raise HttpError(0, f"cannot reach {req.full_url}: {e.reason}")
+
+
 def post_json(url: str, body: dict, token: str | None = None) -> dict:
     headers = {"Content-Type": "application/json"}
     if token:

{stml_cli-0.1.4 → stml_cli-0.1.5}/stml_cli/paths.py

@@ -88,6 +88,11 @@ def read_tree(root: Path) -> list[dict]:
             continue
         if not p.is_file():
             continue
+        # Top-level assets/ is binary, bucket-backed media (written by pull's
+        # assets fetch) — never part of the text overlay. Publish ships it from
+        # disk via build_tarball; push must neither send it nor crash decoding it.
+        if rel.parts[:1] == ("assets",):
+            continue
         key = to_posix_key(rel)
         if key.startswith("src/"):
             key = key[len("src/"):]
@@ -123,3 +128,29 @@ def write_tree(root: Path, files: list[dict]) -> list[str]:
         dest.write_text(f.get("content") or "", encoding="utf-8", newline="")
         written.append(key)
     return written
+
+
+def extract_assets(root: Path, tarball: bytes) -> int:
+    """Extract a pulled ``assets/…`` tarball (the /api/app-source/assets
+    response) into the folder. Members are already ``assets/<rel>``; anything
+    else is refused (defensive — never let a tar write outside the tree).
+    Returns the number of files written."""
+    import io
+    import tarfile
+
+    count = 0
+    with tarfile.open(fileobj=io.BytesIO(tarball), mode="r:gz") as tar:
+        for m in tar.getmembers():
+            if not m.isfile():
+                continue
+            rel = PurePosixPath(m.name)
+            if rel.parts[:1] != ("assets",) or ".." in rel.parts or rel.is_absolute():
+                continue
+            f = tar.extractfile(m)
+            if f is None:
+                continue
+            dest = root / key_to_native(str(rel))
+            dest.parent.mkdir(parents=True, exist_ok=True)
+            dest.write_bytes(f.read())
+            count += 1
+    return count

{stml_cli-0.1.4 → stml_cli-0.1.5}/stml_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: stml-cli
-Version: 0.1.4
+Version: 0.1.5
 Summary: The stml partner CLI — pull, edit, push, and publish stml apps and libraries.
 Author: stml
 Project-URL: Homepage, https://stml.io

{stml_cli-0.1.4 → stml_cli-0.1.5}/tests/test_paths.py

@@ -114,6 +114,40 @@ def test_local_junk_is_excluded(tmp_path: Path):
     assert keys == {"flows/x.py"}  # .git, __pycache__, .stml, *.pyc all dropped
 
 
+def test_assets_dir_is_never_pushed(tmp_path: Path):
+    """Top-level assets/ is bucket-backed binary media (written by pull) — push
+    must skip it (a .xlsx would crash read_text) but publish ships it from disk."""
+    paths.write_tree(tmp_path, [{"path": "pkg/x.py", "content": "x=1\n"}])
+    (tmp_path / "assets").mkdir()
+    (tmp_path / "assets" / "sample.xlsx").write_bytes(b"\x00\x01binary")
+    keys = {f["path"] for f in paths.read_tree(tmp_path)}
+    assert keys == {"pkg/x.py"}
+
+
+def test_extract_assets_writes_only_under_assets(tmp_path: Path):
+    import io
+    import tarfile
+
+    buf = io.BytesIO()
+    with tarfile.open(fileobj=buf, mode="w:gz") as tar:
+        for name, data in [
+            ("assets/sample.xlsx", b"\x00\x01"),
+            ("assets/sub/img.png", b"\x89PNG"),
+            ("../evil.txt", b"nope"),          # traversal → refused
+            ("pyproject.toml", b"nope"),       # outside assets/ → refused
+        ]:
+            info = tarfile.TarInfo(name=name)
+            info.size = len(data)
+            tar.addfile(info, io.BytesIO(data))
+    n = paths.extract_assets(tmp_path, buf.getvalue())
+    assert n == 2
+    assert (tmp_path / "assets" / "sample.xlsx").read_bytes() == b"\x00\x01"
+    assert (tmp_path / "assets" / "sub" / "img.png").read_bytes() == b"\x89PNG"
+    assert not (tmp_path / "evil.txt").exists()
+    assert not (tmp_path.parent / "evil.txt").exists()
+    assert not (tmp_path / "pyproject.toml").exists()
+
+
 def test_key_to_native_and_back():
     native = paths.key_to_native("flows/sub/x.py")
     assert native == Path("flows") / "sub" / "x.py"