lagora-cli 1.1.0

package/dist/scripts/report.js

@@ -0,0 +1,104 @@
+import {
+  LagoraCliConfigStore,
+  baseApiUrl,
+  requestHeaders
+} from "./chunk-AZ3EEBVD.js";
+import "./chunk-TJZVQYBL.js";
+
+// packages/cli/src/report.ts
+import { execFile, spawn } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+var exec = promisify(execFile);
+var valueOptions = /* @__PURE__ */ new Set(["--kernel", "--log", "--title", "--reporter", "--description", "--description-file", "--tags", "--store", "--api-url", "--idempotency-key", "--sdk-root", "--python", "--stages", "--kernel-function"]);
+function parse(argv) {
+  const values = /* @__PURE__ */ new Map();
+  for (let index = 0; index < argv.length; index++) {
+    const option = argv[index];
+    if (option === "--auto-lowering") continue;
+    if (!valueOptions.has(option)) throw new Error(`Unknown argument: ${option}`);
+    const value = argv[++index];
+    if (!value || value.startsWith("--")) throw new Error(`${option} requires a value`);
+    if (option === "--api-url" && values.has(option)) throw new Error("Pass --api-url at most once");
+    values.set(option, value);
+  }
+  for (const option of ["--kernel", "--title"]) {
+    if (!values.get(option)?.trim()) throw new Error(`${option} is required`);
+  }
+  return values;
+}
+async function probe(command, args) {
+  try {
+    return (await exec(command, args, { timeout: 2e3, maxBuffer: 64 * 1024 })).stdout.trim() || void 0;
+  } catch (error) {
+    if (error instanceof Error && "code" in error) return void 0;
+    throw error;
+  }
+}
+async function main() {
+  const argv = process.argv.slice(2);
+  const values = parse(argv);
+  if (values.has("--store") && !values.has("--api-url")) {
+    const child = spawn("bash", [fileURLToPath(new URL("submit-issue.sh", import.meta.url)), ...argv], {
+      stdio: "inherit",
+      env: { ...process.env, LAGORA_NODE: process.execPath, LAGORA_VERIFY_ENTRY: fileURLToPath(new URL("verify-issue.js", import.meta.url)) }
+    });
+    const code = await new Promise((resolve, reject) => {
+      child.once("error", reject);
+      child.once("exit", resolve);
+    });
+    process.exitCode = code ?? 1;
+    return;
+  }
+  const session = await new LagoraCliConfigStore().apiSession(values.get("--api-url"));
+  if (!session.token) throw new Error("Run `lagora login` first");
+  const kernelPath = values.get("--kernel");
+  const kernel = await readFile(kernelPath);
+  const checksum = createHash("sha256").update(kernel).digest("hex");
+  const reporter = values.get("--reporter") ?? (await exec(process.execPath, [fileURLToPath(new URL("cli-auth.js", import.meta.url)), "whoami"])).stdout.trim();
+  const description = values.has("--description-file") ? await readFile(values.get("--description-file"), "utf8") : values.get("--description") || `Reported from lagora with kernel ${path.basename(kernelPath)}.`;
+  const [remoteUrl, branch, commit, dirty, python, legatoVersion] = await Promise.all([
+    probe("git", ["config", "--get", "remote.origin.url"]),
+    probe("git", ["rev-parse", "--abbrev-ref", "HEAD"]),
+    probe("git", ["rev-parse", "HEAD"]),
+    probe("git", ["status", "--porcelain"]),
+    probe("python3", ["--version"]),
+    probe("legato", ["--version"])
+  ]);
+  const form = new FormData();
+  for (const [key, value] of Object.entries({
+    title: values.get("--title"),
+    reporter,
+    description,
+    tags: values.get("--tags") ?? "",
+    idempotencyKey: values.get("--idempotency-key") || randomUUID(),
+    gitMetadata: JSON.stringify({ remoteUrl, branch, commit, dirty: Boolean(dirty), filePath: kernelPath }),
+    environmentMetadata: JSON.stringify({
+      platform: process.platform,
+      arch: process.arch,
+      node: process.version,
+      python: python ?? "not found",
+      kernelChecksum: checksum,
+      legatoVersion: legatoVersion ?? "legato binary not found on PATH",
+      cliVersion: "lagora/npm"
+    })
+  })) form.set(key, value);
+  form.set("kernelFile", new File([kernel], path.basename(kernelPath), { type: "text/x-python" }));
+  const log = values.get("--log");
+  if (log) form.set("errorLogFile", new File([await readFile(log)], path.basename(log), { type: "text/plain" }));
+  const response = await fetch(`${baseApiUrl(session.apiUrl)}/api/report-bundles`, {
+    method: "POST",
+    headers: requestHeaders(session),
+    body: form,
+    signal: AbortSignal.timeout(12e4)
+  });
+  if (!response.ok) throw new Error(`Report upload failed: HTTP ${response.status}`);
+  console.log(await response.text());
+}
+main().catch((error) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+});

package/dist/scripts/resolve-sdk-package-version.py

@@ -0,0 +1,151 @@
+"""Pick the exact SDK versions to install from the package index.
+
+The index proxies public PyPI alongside the SDK team's own builds, so an
+unpinned install silently resolves the wrong distribution: `hart` becomes an
+unrelated public project, `legato` becomes a feature-branch build, and `torch_ha`
+becomes the hardware variant. Everything has to be pinned to one exact version,
+and this is what decides which.
+
+There are two version lines, not one. legato carries its own release number --
+`legato/VERSION` in the SDK repo, `0.1.1` at the time of writing -- while the
+support packages (halogger, hart, torch_ha) are all stamped with the shared
+number in their pyproject files, `0.0.4rc4`. Reading them as one line was the
+defect this grew out of: legato was pinned to whatever nightly the support
+packages happened to share, so a released legato was never installed.
+
+So the shared line is resolved across the packages that actually have one, and
+legato is resolved on its own with `--independent`.
+
+Runs inside the prepare job rather than the web pod: the pod's egress only
+reaches GitHub, while the job runs outside the mesh and can reach the index.
+"""
+
+import argparse
+import re
+import sys
+import urllib.request
+
+# The packages the shared version pins. hapti is not among them: it is never
+# installed here (see SDK_INDEX_INSTALL), and requiring it to have published
+# would let a package no run can use veto the whole resolve.
+DEFAULT_PACKAGES = ("halogger", "hart", "torch_ha")
+# 0.0.5.dev20260806+9714ffc64 -- a nightly and nothing else. Branch builds
+# (0.1.0+soft.5428) and variant builds (...+sha.public, ...+sha.hw) are excluded
+# by requiring the local segment to be a bare hex commit.
+NIGHTLY_VERSION = re.compile(r"^(\d+(?:\.\d+)*)\.dev(\d{8})\+([0-9a-f]+)$")
+# 0.2.0 -- a plain release, which is what legato publishes off main. Anything
+# with a local segment is a branch or variant build: `legato_version.py` appends
+# `+SOFT-<number>` and `+HOTFIX.<string>` for unmerged work, and installing one
+# of those would silently test a branch nobody asked for.
+RELEASE_VERSION = re.compile(r"^(\d+(?:\.\d+)*)$")
+DISTRIBUTION_FILE = re.compile(r">([^<>]+?\.(?:whl|tar\.gz))<")
+
+
+def distribution_version(filename):
+    """The version segment of a wheel or sdist filename."""
+    stem = filename[: -len(".whl")] if filename.endswith(".whl") else filename[: -len(".tar.gz")]
+    parts = stem.split("-")
+    return parts[1] if len(parts) >= 2 else None
+
+
+def nightly_versions(html):
+    found = set()
+    for filename in DISTRIBUTION_FILE.findall(html):
+        version = distribution_version(filename)
+        if version and NIGHTLY_VERSION.match(version):
+            found.add(version)
+    return found
+
+
+def sort_key(version):
+    match = NIGHTLY_VERSION.match(version)
+    if not match:
+        return ((), 0)
+    base, dated, _ = match.groups()
+    return (tuple(int(part) for part in base.split(".")), int(dated))
+
+
+def release_sort_key(version):
+    return tuple(int(part) for part in version.split("."))
+
+
+def own_versions(html):
+    """One package's usable versions, releases first, each newest first.
+
+    A release is preferred over any nightly. The nightlies are what the shared
+    line is built from and they are still accepted as a fallback, but a package
+    that has cut a release has said which build it wants people on.
+    """
+    releases, nightlies = set(), set()
+    for filename in DISTRIBUTION_FILE.findall(html):
+        version = distribution_version(filename)
+        if not version:
+            continue
+        if RELEASE_VERSION.match(version):
+            releases.add(version)
+        elif NIGHTLY_VERSION.match(version):
+            nightlies.add(version)
+    return sorted(releases, key=release_sort_key, reverse=True) + sorted(nightlies, key=sort_key, reverse=True)
+
+
+def fetch(index_url, package, timeout):
+    # PEP 503 normalises the project name: underscores become hyphens.
+    url = "{}/{}/".format(index_url.rstrip("/"), package.replace("_", "-").lower())
+    with urllib.request.urlopen(url, timeout=timeout) as response:
+        return response.read().decode("utf-8", "replace")
+
+
+def shared_versions(index_url, packages, timeout):
+    """Every nightly present for *all* the packages, newest first.
+
+    Requiring all of them keeps a half-published night -- one package uploaded,
+    another still building -- from offering a version that cannot install.
+    """
+    shared = set()
+    for position, package in enumerate(packages):
+        versions = nightly_versions(fetch(index_url, package, timeout))
+        shared = versions if position == 0 else (shared & versions)
+        if not shared:
+            return []
+    return sorted(shared, key=sort_key, reverse=True)
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--index-url", required=True)
+    parser.add_argument("--package", action="append", default=None)
+    parser.add_argument("--timeout", type=float, default=30.0)
+    parser.add_argument("--list", action="store_true", help="print every usable version, newest first")
+    parser.add_argument("--limit", type=int, default=0)
+    parser.add_argument(
+        "--independent",
+        action="store_true",
+        help="resolve the single --package on its own version line, rather than a version shared with the others",
+    )
+    args = parser.parse_args(argv)
+
+    packages = args.package or list(DEFAULT_PACKAGES)
+    if args.independent and len(packages) != 1:
+        print("[agora] --independent resolves one package; pass exactly one --package", file=sys.stderr)
+        return 1
+
+    try:
+        if args.independent:
+            versions = own_versions(fetch(args.index_url, packages[0], args.timeout))
+        else:
+            versions = shared_versions(args.index_url, packages, args.timeout)
+    except Exception as error:  # noqa: BLE001 - the caller falls back to a source build
+        print("[agora] package index lookup failed: {}".format(error), file=sys.stderr)
+        return 1
+    if not versions:
+        target = packages[0] if args.independent else "every SDK package"
+        print("[agora] no usable version is published for {}".format(target), file=sys.stderr)
+        return 1
+    if args.limit > 0:
+        versions = versions[: args.limit]
+    print("\n".join(versions) if args.list else versions[0])
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())