feat: clean up console output, add manage subcommand

[lpillmann]

Summary

• Remove output noise: Replace all console.log() with console.print() and remove dead Python logging framework — eliminates timestamps and file:line references from every output line
• Rename section header: "Drop/create Snowflake objects" → "Manage Snowflake objects"
• Add DDL summary line: Shows operation counts before the statement list (e.g. 0 CREATE, 23 ALTER (0 SET, 23 UNSET), 0 DROP) with red highlighting for DROP operations
• Condense env loading: ~20 lines of verbose output → single Loaded N environment variables from <path> (also removes plaintext secret printing)
• Single dry-run banner: One prominent ⚠ DRY RUN banner at the top instead of two per-section banners
• New manage subcommand: Primary command for object management; drop_create kept as deprecated alias
• Drive-by fixes: unclosed Rich markup tag, invalid typing.T import, privilege-skip message changed from Warning → Info

Before / After

Before:

[17:59:39] Loading environment variables  started                    utils.py:44
           PERMISSION_BOT_USER=PERMIFROST                            utils.py:62
           ...20 more lines of env vars and override listings...
[17:59:39] Drop/create Snowflake objects started                       cli.py:25
           --------------------                                     utils.py:207
           Executing in dry run mode                                utils.py:208
           --------------------                                     utils.py:209
[17:59:41] Resolving user objects                                    core.py:200
           WARNING  Skipping metadata retrieval for user admin:   inspector.py:108

After:

⚠ DRY RUN — no changes will be applied

Loaded 7 environment variables from /path/to/.env

Manage Snowflake objects started
Info: Skipping metadata retrieval for user admin: Permifrost user doesn't have DESCRIBE privileges on this object
...
DDL statements to be executed:
0 CREATE, 23 ALTER (0 SET, 23 UNSET), 0 DROP

- ALTER USER alice UNSET rsa_public_key
- ALTER USER bob SET rsa_public_key='...'
...

Manage Snowflake objects completed successfully

Guardrails

This is a clean reimplementation from main (replaces #21 which had rebase artifacts):

• params_to_unset_if_absent for users: only ["rsa_public_key", "rsa_public_key_2"] ✓
• All 14 baseline tests preserved + 5 new build_summary_line tests (19 total) ✓
• tundri/constants.py, tundri/parser.py, tundri/objects.py — no changes ✓

Test plan

• uv run pytest tests/ --ignore=tests/integration_tests -v — 19 passed
• uv run ruff check . && uv run ruff format --check . — clean
• tundri manage --dry -p spec.yml works (new subcommand)
• tundri drop_create --dry -p spec.yml still works (backwards compat)
• tundri with no subcommand shows help instead of crashing
• Full dry-run against sandbox — output matches After example above

🤖 Generated with Claude Code

[github-actions]

🚀 Package published to TestPyPI!

You can test the installation with:

pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple/ tundri==1.3.5.dev23

View package: https://test.pypi.org/project/tundri/1.3.5.dev23/

[gemma-claude-assistant]

[Suggestion] parser_run manually duplicates the args that add_manage_args already encapsulates (-p, --dry, --users-to-skip). If the manage/drop_create args change in the future, run will silently drift out of sync.

Consider reusing the helper:

Suggested change

	parser_permifrost.add_argument(
	parser_run = subparsers.add_parser("run", help="Run manage and then permifrost")
	add_manage_args(parser_run)
	parser_run.set_defaults(func=run)

add_manage_args already sets func=manage, so you'd need to override it after the call: parser_run.set_defaults(func=run) (as shown above, set_defaults called twice merges; the second call wins).

[gemma-claude-assistant]

[Suggestion] " UNSET " in s requires a space after UNSET, which holds for all current Snowflake ALTER UNSET DDL (e.g. ALTER USER foo UNSET rsa_public_key). However it would also match the substring if a SET statement's value happens to contain UNSET (e.g. ALTER USER foo SET comment = 'Please UNSET this'), silently misclassifying it.

A slightly more robust check would inspect only the SQL keyword portion:

elif s.startswith("ALTER"):
    keyword = s.split("=")[0].upper()  # strip values/assignments
    if " UNSET " in keyword or keyword.endswith(" UNSET"):
        alter_unset += 1
    else:
        alter_set += 1

Low risk in practice, but worth noting for correctness.

[gemma-claude-assistant]

[Suggestion] Injecting Rich markup via .replace() is fragile: if drop_count happens to equal another count (e.g. create=2, drop=2), and the format string ever changes to put counts adjacent, the replacement could match unintended substrings. Since _format_summary already owns the string structure, consider passing an highlight_drops=True flag to it so the markup is built at construction time rather than patched afterwards.

[gemma-claude-assistant]

Review Summary

Overall this is a clean, well-structured PR. The rename from drop_create → manage, the console.log → console.print migration, and the removal of the dead logging framework are all correct and improve the UX. The new build_summary_line / _count_operations / _format_summary helpers are a nice addition and are well-tested.

Three suggestions (no blockers):

1. parser_run duplicates add_manage_args (cli.py:85) — the run subparser manually re-declares -p, --dry, and --users-to-skip instead of calling the add_manage_args helper, risking silent arg drift.

2. UNSET detection is slightly fragile (core.py:112) — " UNSET " in s could theoretically misclassify a SET statement whose value contains the literal substring UNSET. Low probability in practice given Snowflake DDL patterns.

3. Drop-count markup via .replace() (core.py:164) — injecting Rich markup by string-replacing the formatted summary string works now but is fragile to future format changes; better handled inside _format_summary.

Notable positives:

• Security improvement: old load_env_var logged all env var key=value pairs (including passwords) to stdout — the new version only prints a count.
• Unclosed Rich markup tag ([bold] without [/bold]) in the old Permifrost completion message is now fixed.
• The from typing import T import bug (T is not a typing export) is correctly replaced with T = TypeVar("T").

[gemma-claude-assistant]

Claude review cost: $0.7149 · 13 turns · 408s · eu.anthropic.claude-sonnet-4-6

[msenyonyi]

Don't really have the context to review this, tbh - will set to approve cause it looks fine but I'd need to dedicate a bit more time to understanding Tundri