@genex-ai/cli-demo 1.30.0-dev.645 → 1.31.0

package/templates/blender-service/server.py

@@ -1,611 +0,0 @@
-"""Genex Blender service -- HTTP over a live, stateful Blender.
-
-Run as:  blender --background --python server.py -- --port 8080
-
-Two deliberate choices, each load-bearing:
-
-  * `HTTPServer`, never `ThreadingHTTPServer`. bpy is not thread-safe, and a
-    plain HTTPServer dispatches every request on the thread that called
-    serve_forever() -- Blender's main thread. Requests serialize, which is what
-    one-Blender-per-session wants anyway. Swapping in the threading variant
-    would look like a throughput win and corrupt the scene instead.
-
-  * The process blocks in serve_forever(). `blender --background --python x.py`
-    exits the moment the script returns, so the scene lives exactly as long as
-    this call does.
-"""
-
-import sys
-
-# BEFORE any local import. Blender writes __pycache__ beside whatever it
-# imports, and in the local lane the service lives inside the user's installed
-# node_modules -- or, in a source checkout, inside templates/, where the .pyc
-# files then get vendored into the next publish. MEASURED: that is exactly what
-# happened, and blender-parity.test.ts caught it. The PYTHONDONTWRITEBYTECODE
-# env var does NOT work here (Blender's embedded Python ignores it), so it has
-# to be set in-process, above the imports that would trigger the write.
-sys.dont_write_bytecode = True
-
-import argparse
-import base64
-import hashlib
-import json
-import os
-import tempfile
-import time
-from http.server import BaseHTTPRequestHandler, HTTPServer
-
-sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
-
-import ops  # noqa: E402
-import views  # noqa: E402
-
-SHARED_SECRET = os.environ.get("GENEX_BLENDER_SECRET", "")
-# Deliberate, not incidental: this bounds how large a /exec script or an inlined
-# asset may be. 8 MB is a generous script and a firm ceiling.
-MAX_BODY = 8 * 1024 * 1024
-# 4 MiB of base64 ~= 3 MiB of image. A PNG sheet has been measured at ~1 MB;
-# WebP at ~22 KB. Anything past this is a bug, not a big scene.
-SHEET_INLINE_MAX_B64 = 4 * 1024 * 1024
-
-# /run/genex in a container; a user's own directory in the local lane, where
-# / is not writable and a laptop has no business being told otherwise.
-RUN_DIR = os.environ.get("GENEX_BLENDER_RUN_DIR", "/run/genex")
-DEADLINE_FILE = os.path.join(RUN_DIR, "deadline")
-RESTART_REASON = os.path.join(RUN_DIR, "restart-reason")
-CHECKPOINT = os.environ.get("GENEX_BLENDER_CHECKPOINT", "/workspace/checkpoint.blend")
-
-# Per-route budgets, enforced by supervisor.py (this process cannot interrupt
-# itself -- bpy is not thread-safe). A request may lower its own budget but the
-# ceiling is not negotiable from the wire.
-# /render matches /exec at 120s: a genuinely cold pod can pay 30-44s of
-# EEVEE shader compilation before the first pixel, which fits inside 60s
-# but not comfortably. Measured on a fresh 4090 pod the compile had
-# already been paid by the boot probe, so it was never observed at the
-# route -- which is exactly why the headroom should not depend on that.
-ROUTE_BUDGET_S = {"/exec": 120.0, "/render": 120.0, "/bake": 900.0,
-                  "/import": 300.0, "/export": 300.0, "/reset": 60.0}
-# Boot gets its own budget because the GPU probe can HANG rather than fail: a
-# GPU-less host was measured blocking indefinitely inside EGL/EEVEE init instead
-# of erroring. A pod that never becomes healthy and never exits is worse than
-# one that refuses -- it bills forever and no crash-loop guard ever fires.
-# Generous, because a cold GPU pod pays 30-44s of shader compilation here.
-BOOT_BUDGET_S = 180.0
-BUDGET_CEILING_S = 900.0
-
-# True when the scene we are serving came back from a checkpoint rather than
-# from the caller's own steps. Reported ONCE, on the next response: a silent
-# restore is a scene that quietly forgot the last thing it was told, which reads
-# as the model being stupid.
-RESTORED = None
-# Whether this process is allowed to render on the CPU. The GPU image flips it.
-GPU_WITNESS = None
-
-# The contact-sheet mode used when a request does not name one. TIER-AWARE, and
-# that is the whole point: `lit` (EEVEE) is what the GPU is for, and MEASURED on
-# the CPU tier it costs 47.5s per sheet against 0.4s for Workbench. So the GPU
-# tier defaults to the good picture and the CPU tier defaults to the fast one --
-# one default would be wrong on one of them.
-# THREE states, not two, because the local lane is neither of the others:
-#   "1"      require a GPU, refuse to serve without one   (rented pod: software
-#            rendering there means paying GPU rates for CPU work)
-#   "detect" use the GPU if this machine has one, else fall back  (a user's own
-#            machine: refusing would be absurd, and so would forcing a 47s
-#            default onto someone with no GPU)
-#   else     CPU tier                                      (Cloudflare sandbox)
-GPU_MODE = os.environ.get("GENEX_BLENDER_REQUIRE_GPU", "")
-IS_GPU_TIER = GPU_MODE == "1"
-
-
-def _gpu_present(w):
-    """A real GPU behind the RASTERIZER (EEVEE/Workbench), which is what the
-    contact sheet uses. cyclesDevices is about Cycles and is not the same
-    question — see gpu_witness for why that distinction cost a correction."""
-    if not w:
-        return False
-    if IS_GPU_TIER:
-        # The witness already died if there were no GPU (assert_gpu_or_die runs
-        # before the socket opens). Keying the default on gpu.platform alone sent
-        # a healthy rented 4090 to Workbench `solid` whenever that module declined
-        # to answer in background mode — the CPU picture at GPU rates (review).
-        return True
-    if w.get("device") not in ("SOFTWARE", "NONE", "UNKNOWN", None):
-        return True
-    # UNKNOWN from gpu.platform, but the rest of the witness says a GPU rendered.
-    return bool(w.get("cyclesDevices")) and w.get("eeveeProbe") is True
-
-
-# Overwritten at boot once the witness has run.
-DEFAULT_MODE = "solid"
-
-
-def _set_deadline(route, budget_s):
-    """Publish the clock the supervisor enforces. Best-effort: a service that
-    cannot write here must still serve, it just loses the runaway guard."""
-    try:
-        os.makedirs(RUN_DIR, exist_ok=True)
-        with open(DEADLINE_FILE, "w") as f:
-            json.dump({"route": route, "started": time.time(),
-                       "budget": budget_s, "deadline": time.time() + budget_s}, f)
-    except OSError:
-        pass
-
-
-def _clear_deadline():
-    try:
-        os.unlink(DEADLINE_FILE)
-    except (FileNotFoundError, OSError):
-        pass
-
-
-def _budget_for(route, body):
-    asked = body.get("budgetSeconds") if isinstance(body, dict) else None
-    base = ROUTE_BUDGET_S.get(route, 120.0)
-    try:
-        if asked is not None:
-            base = float(asked)
-    except (TypeError, ValueError):
-        pass
-    return max(1.0, min(base, BUDGET_CEILING_S))
-
-
-def _checkpoint():
-    """Snapshot after every mutating call. Best-effort by design: losing a
-    checkpoint must never fail the call that produced the scene."""
-    try:
-        ops.save_checkpoint(CHECKPOINT)
-    except Exception as e:  # noqa: BLE001
-        sys.stderr.write("[svc] checkpoint failed: %s\n" % e)
-
-
-def _restore_if_recovering():
-    """Called once at boot. Restores only when the supervisor says the last
-    process died -- a normal cold start must begin with an EMPTY scene, not
-    with somebody else's leftovers."""
-    global RESTORED
-    if not os.path.exists(RESTART_REASON):
-        return
-    try:
-        with open(RESTART_REASON) as f:
-            reason = json.load(f)
-    except (ValueError, OSError):
-        reason = {"reason": "unknown"}
-    try:
-        os.unlink(RESTART_REASON)
-    except OSError:
-        pass
-    if not os.path.exists(CHECKPOINT):
-        RESTORED = dict(reason, restored=False, note="no checkpoint existed")
-        return
-    try:
-        ops.load_checkpoint(CHECKPOINT)
-        RESTORED = dict(reason, restored=True,
-                        lostAfter=os.path.getmtime(CHECKPOINT))
-        sys.stderr.write("[svc] scene restored from checkpoint (%s)\n"
-                         % reason.get("reason"))
-    except Exception as e:  # noqa: BLE001
-        RESTORED = dict(reason, restored=False, note=str(e))
-
-
-# Routes that must never consume the recovery notice: /health is the container
-# healthcheck's target and would swallow it on a timer.
-_NO_RESTORE_NOTICE = frozenset({"/health"})
-
-
-def _take_restored():
-    """Report the recovery exactly once."""
-    global RESTORED
-    r, RESTORED = RESTORED, None
-    return r
-
-
-# The digest of the last sheet we actually sent: (scene fingerprint, mode, fmt).
-# Used by the repeat guard below.
-_LAST_SHEET = None
-
-
-def _scene_digest():
-    """A cheap fingerprint of what a render would SHOW.
-
-    Lives in ops.scene_digest(): a walk over what a RENDER depends on —
-    transforms including rotation and scale, render visibility, modifiers,
-    mesh vertex coordinates (numpy, hashed), light energy/colour, material
-    colours. The first cut hashed scene_info() alone, which is blind to every one
-    of those, so a rotated object or a subdivided mesh answered "unchanged" and
-    the MCP told the model not to look (review finding).
-    """
-    return ops.scene_digest()
-
-
-def _negotiate_format(body):
-    """Pick a sheet format from the request BODY, never a header.
-
-    A header would be dropped by the pod router's inward allowlist, and every
-    hosted session would silently get PNG while the local lane got WebP -- the
-    compression work appearing not to have shipped on exactly the lane it was
-    built for.
-    """
-    want = None
-    sheet = body.get("sheet") if isinstance(body, dict) else None
-    if isinstance(sheet, dict):
-        fmts = sheet.get("formats")
-        if isinstance(fmts, str):
-            fmts = [fmts]
-        if isinstance(fmts, list):
-            want = next((f for f in fmts if f in views.SHEET_FORMATS), None)
-    # No negotiation = an older client = PNG under the legacy field. New clients
-    # ask; old ones must keep working byte-for-byte.
-    return want
-
-
-def _sheet_b64(mode=None, fmt="png"):
-    mode = mode or DEFAULT_MODE
-    fd, path = tempfile.mkstemp(suffix="." + fmt, prefix="genex-sheet-")
-    os.close(fd)
-    try:
-        mime = views.contact_sheet(path, mode=mode, fmt=fmt)
-        with open(path, "rb") as f:
-            return base64.b64encode(f.read()).decode("ascii"), mime
-    finally:
-        if os.path.exists(path):
-            os.unlink(path)
-
-
-def _attach_sheet(result, body, mode):
-    """Render a sheet into `result`, or say it is unchanged.
-
-    THE REPEAT GUARD IS THE POINT, not the compression. WebP cut the sheet 79x
-    in BYTES and 0% in MODEL TOKENS -- vision cost is a function of resolution,
-    not encoding -- so the transport win removes a wall-clock brake from a loop
-    whose real cost is tokens. This repo has a measured precedent: $11.86 for one
-    hour of a look-only loop. An unchanged scene sends no image at all.
-    """
-    global _LAST_SHEET
-    fmt = _negotiate_format(body)
-    digest = (_scene_digest(), mode, fmt or "png")
-    if _LAST_SHEET == digest:
-        result["contactSheetUnchanged"] = True
-        result["mode"] = mode
-        return
-    b64, mime = _sheet_b64(mode, fmt or "png")
-    # A latent bug /export already guards against: a sheet big enough to blow a
-    # transport ceiling fails only on the long, successful sessions that made the
-    # most geometry. WebP makes this nearly unreachable (measured max 22 KB) --
-    # which is exactly why it should be a ceiling and not a hope.
-    if len(b64) > SHEET_INLINE_MAX_B64:
-        result["contactSheetTooLarge"] = {
-            "b64Bytes": len(b64), "limit": SHEET_INLINE_MAX_B64,
-            "detail": "ask for {\"sheet\":{\"formats\":[\"webp\"]}} or a smaller mode",
-        }
-        _LAST_SHEET = None
-        result["mode"] = mode
-        return
-    _LAST_SHEET = digest
-    result["mode"] = mode
-    if fmt is None:
-        # Legacy field, PNG forever. Never both — that would double the bytes.
-        result["contactSheetPng"] = b64
-    else:
-        result["contactSheet"] = {"mime": mime, "b64": b64}
-
-
-class Handler(BaseHTTPRequestHandler):
-    protocol_version = "HTTP/1.1"
-    server_version = "genex-blender/0"
-    # MEASURED-CLASS BUG, and it only bites with more than one client.
-    # `socketserver` handles one CONNECTION at a time and BaseHTTPRequestHandler
-    # loops `handle_one_request` until the peer closes. With HTTP/1.1 keep-alive
-    # and no timeout, the FIRST client to connect owns the server for as long as
-    # it holds the socket open -- a second caller does not queue, it HANGS. Node
-    # `fetch` keep-alives by default, so this is the normal path, not an edge.
-    #
-    # `timeout` makes `rfile.readline()` give the connection back to the accept
-    # loop when an idle peer has nothing to say.
-    #
-    # THIS BOUNDS THE DAMAGE, IT DOES NOT REMOVE IT. Measured after the fix: a
-    # second client is served in ~5.0s instead of never, and two clients then
-    # ping-pong that wait. That is the difference between broken and slow, and
-    # it is the right scope here -- the real fix is ONE PROCESS PER SEAT behind
-    # a router, where two callers never share a socketserver at all.
-    #
-    # Threading the server is NOT the fix and must not be attempted: bpy is
-    # main-thread-only, so a ThreadingHTTPServer would have to marshal every
-    # call back to one worker anyway, and calling bpy.ops from a handler thread
-    # crashes elsewhere, later, in unrelated code.
-    #
-    # 5s rather than something shorter because an agent thinks for seconds
-    # between calls; a tighter window would churn connections for a client that
-    # is behaving normally.
-    timeout = 5.0
-
-    def handle_one_request(self):
-        # BaseHTTPRequestHandler does not handle the timeout it enables: on
-        # expiry `readline()` raises and the connection dies with a traceback in
-        # the log. Closing quietly is the whole point of setting it.
-        try:
-            super().handle_one_request()
-        except TimeoutError:
-            self.close_connection = True
-        except OSError:
-            self.close_connection = True
-
-    def log_message(self, fmt, *args):
-        sys.stderr.write("[svc] %s\n" % (fmt % args))
-
-    def _send(self, code, payload, close=False):
-        # The recovery notice rides EVERY response, not just /exec's.
-        # Previously only the /exec branch called _take_restored(), so a
-        # /render or /scene right after a crash returned a picture of a scene
-        # that had silently lost work -- and by the time the next /exec carried
-        # the notice, the agent had already reasoned from the wrong image and
-        # possibly re-applied an edit the restore had kept.
-        # ...but NOT on /health. MEASURED: the container healthcheck polls it
-        # every 30s, so attaching the notice there consumed it before any real
-        # client could see it -- the notice went to a probe that discards it.
-        # Only routes a caller actually asks for may take it.
-        route = (self.path or "").split("?")[0]
-        # ...and only on a SUCCESSFUL response. MEASURED: a mistaken request that
-        # 404'd consumed the notice, so the scene really had been restored and
-        # the caller was never told. A failed call delivered nothing the agent
-        # can act on, so it has no business taking the one-shot notice with it.
-        if (200 <= code < 300
-                and route not in _NO_RESTORE_NOTICE
-                and isinstance(payload, dict) and "sceneRestored" not in payload):
-            restored = _take_restored()
-            if restored:
-                payload = dict(payload, sceneRestored=restored)
-        body = json.dumps(payload).encode("utf-8")
-        self.send_response(code)
-        self.send_header("Content-Type", "application/json")
-        self.send_header("Content-Length", str(len(body)))
-        if close:
-            self.send_header("Connection", "close")
-        self.end_headers()
-        self.wfile.write(body)
-
-    def _authed(self):
-        # Constant-time-ish compare; an unset secret means the spike is open,
-        # matching the admin-only/disposable posture. A DEPLOYED service can
-        # never reach here with an empty secret -- main() exits 5 first.
-        if not SHARED_SECRET:
-            return True
-        got = self.headers.get("x-genex-internal", "")
-        if len(got) != len(SHARED_SECRET):
-            return False
-        return sum(a != b for a, b in zip(got, SHARED_SECRET)) == 0
-
-    def _body(self):
-        n = int(self.headers.get("Content-Length") or 0)
-        if n > MAX_BODY:
-            raise ValueError(f"body too large: {n} > {MAX_BODY}")
-        return json.loads(self.rfile.read(n) or b"{}") if n else {}
-
-    def do_GET(self):
-        if self.path == "/health":
-            # The API REFUSES to route a session to a pod whose device is
-            # SOFTWARE. Without that, the boot assertion is a log line nobody
-            # reads and a CPU render bills at GPU rates.
-            return self._send(200, {"ok": True, "blender": _blender_version(),
-                                    "gpu": GPU_WITNESS, "defaultMode": DEFAULT_MODE})
-        if not self._authed():
-            return self._send(401, {"error": "unauthorized"})
-        if self.path == "/scene":
-            return self._send(200, ops.scene_info())
-        if self.path == "/gpu":
-            return self._send(200, {"gpu": GPU_WITNESS})
-        self._send(404, {"error": "not_found"})
-
-    def do_POST(self):
-        if not self._authed():
-            return self._send(401, {"error": "unauthorized"})
-        try:
-            body = self._body()
-        except Exception as e:
-            return self._send(400, {"error": "bad_request", "detail": str(e)})
-
-        started = time.time()
-        route = self.path.split("?")[0]
-        _set_deadline(route, _budget_for(route, body))
-        stage = route.lstrip("/")
-        script_started = False
-        try:
-            if route == "/exec":
-                stage = "script"
-                script_started = True
-                result = ops.run_script(body.get("script", ""))
-                stage = "scene_info"
-                result["scene"] = ops.scene_info()
-                result["gpu"] = GPU_WITNESS
-                # The sheet rides EVERY exec by default. verify:false is for
-                # bulk sub-steps only -- an agent that has to ask for the
-                # picture is an agent that will forget to.
-                if body.get("verify", True):
-                    stage = "verification"
-                    _attach_sheet(result, body, body.get("mode") or DEFAULT_MODE)
-                result["ms"] = int((time.time() - started) * 1000)
-                _checkpoint()
-                return self._send(200, result)
-
-            if route == "/render":
-                out = {"gpu": GPU_WITNESS}
-                # /render is an EXPLICIT ask, so it bypasses the repeat guard --
-                # a caller that asked again wants the bytes (a different mode, or
-                # simply to look again). Only /exec's automatic sheet is guarded.
-                fmt = _negotiate_format(body)
-                mode = body.get("mode") or DEFAULT_MODE
-                b64, mime = _sheet_b64(mode, fmt or "png")
-                out["mode"] = mode
-                if fmt is None:
-                    out["contactSheetPng"] = b64
-                else:
-                    out["contactSheet"] = {"mime": mime, "b64": b64}
-                out["ms"] = int((time.time() - started) * 1000)
-                return self._send(200, out)
-
-            if route == "/export":
-                path = body.get("path") or os.path.join(tempfile.gettempdir(), "scene.glb")
-                res = ops.export_glb(path)
-                upload = body.get("upload")
-                if isinstance(upload, dict) and upload.get("url"):
-                    # The artifact the game ships: straight to object storage.
-                    ops.upload_file(res["path"], upload["url"], upload.get("headers"))
-                    res["uploaded"] = True
-                elif res["bytes"] > ops.INLINE_GLB_MAX_BYTES:
-                    # Refuse rather than emit a body that a 10 MB transport
-                    # ceiling would truncate on exactly the long, successful
-                    # sessions that generated the most texture.
-                    return self._send(413, {
-                        "error": "payload_too_large",
-                        "bytes": res["bytes"],
-                        "limit": ops.INLINE_GLB_MAX_BYTES,
-                        "detail": "pass upload:{url,headers} with a presigned PUT to export this scene",
-                    })
-                else:
-                    with open(res["path"], "rb") as f:
-                        res["glbBase64"] = base64.b64encode(f.read()).decode("ascii")
-                res["ms"] = int((time.time() - started) * 1000)
-                return self._send(200, res)
-
-            if route == "/import":
-                out = ops.import_glb(body["url"])
-                _checkpoint()
-                return self._send(200, out)
-
-            if route in ("/reset", "/session"):
-                info = ops.reset_scene()
-                _checkpoint()
-                return self._send(200, {"ok": True, "scene": info})
-
-            if route == "/destroy":
-                # The process is about to exit, so the connection cannot be
-                # reused. Saying so lets the client close cleanly instead of
-                # holding a keep-alive socket to a corpse until its own timeout.
-                self.close_connection = True
-                # Record the INTENT before exiting. The supervisor no longer
-                # infers "the operator asked to stop" from exit code 0, because
-                # a script calling sys.exit() produces the same code.
-                try:
-                    os.makedirs(RUN_DIR, exist_ok=True)
-                    with open(os.path.join(RUN_DIR, "destroy-requested"), "w") as f:
-                        f.write(str(time.time()))
-                except OSError:
-                    pass
-                self._send(200, {"ok": True}, close=True)
-                self.server._should_stop = True
-                return
-
-            self._send(404, {"error": "not_found"})
-        except Exception as e:
-            import traceback
-
-            self._send(500, {"error": "exec_failed", "detail": str(e), "trace": traceback.format_exc(limit=6),
-                             "stage": stage, "scriptStarted": script_started})
-        finally:
-            # MUST run: a stale deadline file makes the supervisor kill a
-            # perfectly healthy Blender on its next poll.
-            _clear_deadline()
-
-
-def _blender_version():
-    import bpy
-
-    return ".".join(str(v) for v in bpy.app.version)
-
-
-class Server(HTTPServer):
-    _should_stop = False
-
-    def service_actions(self):
-        if self._should_stop:
-            raise SystemExit(0)
-
-
-def main():
-    argv = sys.argv[sys.argv.index("--") + 1:] if "--" in sys.argv else []
-    ap = argparse.ArgumentParser()
-    ap.add_argument("--port", type=int, default=int(os.environ.get("PORT", "8080")))
-    ap.add_argument("--host", default="0.0.0.0")
-    args = ap.parse_args(argv)
-
-    # Boot into the SAME state /reset gives, not Blender's factory scene. The
-    # factory scene ships a Cube, a Light and a Camera, so a bare /exec would
-    # silently build on top of a stray cube nobody asked for -- and the agent
-    # would see objectCount 3 before it had made anything.
-    ops.reset_scene()
-
-    # ORDER MATTERS, and this is the whole safety argument of the GPU tier:
-    # assert BEFORE the socket opens, so a pod that would answer from the CPU
-    # never accepts a request it bills at GPU rates. GENEX_BLENDER_REQUIRE_GPU
-    # is set by Dockerfile.gpu and unset on the CPU image, which is how one
-    # server.py serves both tiers without a second code path.
-    global GPU_WITNESS, DEFAULT_MODE
-    # Under the supervisor's clock from here: see BOOT_BUDGET_S.
-    _set_deadline("/boot", BOOT_BUDGET_S)
-    # NOT `gpu` — Blender ships a BUILT-IN module of that name, and it shadows
-    # any local gpu.py. Measured: `import gpu` inside the service returned
-    # Blender's module and AttributeError'd on assert_gpu_or_die, so the
-    # assertion silently never ran.
-    if IS_GPU_TIER:
-        import gpu_witness
-
-        GPU_WITNESS = gpu_witness.assert_gpu_or_die()
-    elif GPU_MODE == "detect":
-        import gpu_witness
-
-        GPU_WITNESS = gpu_witness.witness()
-        GPU_WITNESS["tier"] = "local"
-    else:
-        GPU_WITNESS = {"backend": "SOFTWARE", "device": "SOFTWARE",
-                       "renderer": "llvmpipe (CPU tier)", "cyclesDevices": [],
-                       "tier": "cpu"}
-
-    # Resolved AFTER the witness, because on the local lane the answer depends
-    # on what was actually found. `lit` costs 0.8s on a GPU and 47s without one,
-    # so the default has to follow the hardware rather than the tier name.
-    DEFAULT_MODE = "lit" if _gpu_present(GPU_WITNESS) else "solid"
-
-    # After the assertion: a recovering process restores its scene, a cold one
-    # does not. Doing this before the socket means the first request already
-    # sees the recovered scene rather than an empty one.
-    _restore_if_recovering()
-    _clear_deadline()
-
-    srv = Server((args.host, args.port), Handler)
-    sys.stderr.write(
-        f"[svc] genex-blender on {args.host}:{args.port} (blender {_blender_version()})\n"
-    )
-    # Deployed anywhere reachable, a missing secret is FATAL, not a warning:
-    # /exec runs arbitrary Python for anyone who can reach the port. Enforced
-    # here rather than as a compose `${VAR:?}`, because compose interpolates the
-    # whole file before selecting services -- MEASURED, that form aborted
-    # `up -d traefik web api ...` too and would have taken the entire dev deploy
-    # down over a service that is off by default.
-    if os.environ.get("GENEX_BLENDER_REQUIRE_SECRET") == "1" and not SHARED_SECRET:
-        sys.stderr.write(
-            "[svc] FATAL no_shared_secret: GENEX_BLENDER_REQUIRE_SECRET=1 but "
-            "GENEX_BLENDER_SECRET is empty - refusing to serve an "
-            "arbitrary-exec endpoint unauthenticated.\n")
-        sys.stderr.flush()
-        sys.exit(5)
-    if not SHARED_SECRET:
-        # Loud, and on purpose. Unset means /exec runs arbitrary Python for
-        # ANY caller that can reach this port -- correct for a laptop, and a
-        # remote-code-execution endpoint the moment it is behind a hostname.
-        # The deployed compose makes the secret mandatory (`:?`), so this line
-        # firing on a server is a misconfiguration you want to see in the log.
-        sys.stderr.write(
-            "[svc] WARNING: GENEX_BLENDER_SECRET is unset - every route is OPEN "
-            "and /exec runs arbitrary Python. Safe on localhost, never on a "
-            "reachable host.\n"
-        )
-    sys.stderr.flush()
-    try:
-        srv.serve_forever(poll_interval=0.2)
-    except (KeyboardInterrupt, SystemExit):
-        pass
-    finally:
-        srv.server_close()
-
-
-if __name__ == "__main__":
-    main()