coderouter-cli 2.13.0__py3-none-any.whl → 2.15.0__py3-none-any.whl

coderouter/config/schemas.py

@@ -371,6 +371,120 @@ RESTART_COMMAND_SHELL_META_RE = re.compile(r"(&&|\|\||\||;|>|<|\$\(|`)")
 RESTART_COMMAND_ENV_PREFIX_RE = re.compile(r"^\w+=")
 
 
+class CredentialRefresh(BaseModel):
+    """How to make a vendor CLI rotate the token it wrote to disk.
+
+    Deliberately not an OAuth client. Every vendor has its own endpoint,
+    client id, rotation policy and error shape, and all of them change —
+    delegating to the CLI that owns the file is the version that survives
+    contact with a moving vendor.
+
+    ``command`` is an argv **list**, dispatched with ``shell=False``. Same
+    trust decision as v2.13.0's ``restart_command``: a string that goes
+    through a shell turns a config file into arbitrary code execution.
+    There is no string form here to have to refuse.
+    """
+
+    model_config = ConfigDict(extra="forbid")
+
+    command: list[str] = Field(
+        ...,
+        min_length=1,
+        description=(
+            "argv for the vendor CLI, e.g. ['grok', 'models']. Run with "
+            "shell=False; no shell metacharacters are interpreted."
+        ),
+    )
+    early_ratio: float = Field(
+        default=0.5,
+        ge=0.0,
+        le=1.0,
+        description=(
+            "Refresh when the remaining lifetime drops below this fraction "
+            "of itself. Early refresh avoids a token dying mid-request."
+        ),
+    )
+    min_lead_s: float = Field(
+        default=300.0,
+        ge=0.0,
+        description="Always refresh at least this many seconds before expiry.",
+    )
+    timeout_s: float = Field(
+        default=30.0,
+        gt=0.0,
+        le=600.0,
+        description="Hard timeout for the refresh command.",
+    )
+
+
+class ProviderCredential(BaseModel):
+    """Where this provider's credential comes from (v2.14.0).
+
+    ``source: env`` is the historical behaviour, spelled out. ``source:
+    cli_session`` borrows the token a vendor CLI already wrote to disk, so
+    a subscription-authenticated provider can be an ordinary
+    ``openai_compat`` entry instead of a ``kind: agent_cli`` island — and
+    therefore takes part in fallback chains, auto-routing, the budget
+    tracker and every other routing feature.
+    """
+
+    model_config = ConfigDict(extra="forbid")
+
+    source: Literal["env", "cli_session"] = Field(
+        default="env",
+        description="'env' reads an environment variable; 'cli_session' reads a JSON file.",
+    )
+    env: str | None = Field(
+        default=None, description="source=env: the environment variable name."
+    )
+    path: str | None = Field(
+        default=None,
+        description=(
+            "source=cli_session: the JSON file the vendor CLI writes, e.g. "
+            "~/.kimi-code/credentials/kimi-code.json. Must live under $HOME."
+        ),
+    )
+    field: str = Field(
+        default="access_token",
+        description="Dotted path to the token inside that JSON (e.g. 'tokens.access').",
+    )
+    expiry_field: str = Field(
+        default="expires_at",
+        description=(
+            "Dotted path to the expiry. Epoch seconds or milliseconds; both "
+            "are accepted. Absent means 'no expiry info' — the upstream 401 "
+            "becomes the signal instead."
+        ),
+    )
+    refresh: CredentialRefresh | None = Field(
+        default=None,
+        description="Omit to never refresh (a long-lived token, or one you rotate yourself).",
+    )
+
+    @model_validator(mode="after")
+    def _check_source_requirements(self) -> Self:
+        """Each source needs its own field, and only its own field."""
+        if self.source == "env":
+            if not self.env:
+                raise ValueError("credential.source='env' requires credential.env")
+            if self.path:
+                raise ValueError("credential.path is meaningless for source='env'")
+        if self.source == "cli_session":
+            if not self.path:
+                raise ValueError(
+                    "credential.source='cli_session' requires credential.path"
+                )
+            if self.env:
+                raise ValueError("credential.env is meaningless for source='cli_session'")
+            from coderouter.credentials import session_path_is_sane
+
+            if not session_path_is_sane(self.path):
+                raise ValueError(
+                    f"credential.path must live under your home directory: {self.path}"
+                )
+        return self
+
+
 class ProviderConfig(BaseModel):
     """A single provider entry from providers.yaml.
 
@@ -416,6 +530,19 @@ class ProviderConfig(BaseModel):
         default=None,
         description="Env var name holding the API key. None = no auth (e.g. local).",
     )
+    # v2.14.0: the general form of the above. Mutually exclusive with
+    # api_key_env — a resolver that silently fell back between sources would
+    # make "which credential is this request actually using?" unanswerable,
+    # which is the question an operator asks at exactly the wrong moment.
+    credential: ProviderCredential | None = Field(
+        default=None,
+        description=(
+            "Where the credential comes from. Omit to use api_key_env. "
+            "source='cli_session' reads the token a vendor CLI already wrote "
+            "to disk, so a subscription provider can be a plain "
+            "openai_compat entry that takes part in fallback chains."
+        ),
+    )
 
     # Routing-relevant flags
     paid: bool = Field(
@@ -611,6 +738,23 @@ class ProviderConfig(BaseModel):
         validate_output_filters(self.output_filters)
         return self
 
+    @model_validator(mode="after")
+    def _check_credential_exclusive(self) -> Self:
+        """``api_key_env`` and ``credential`` cannot both be set.
+
+        Failing at load time is the whole point: two credential sources on
+        one provider is a question ("which one won?") that should never
+        reach a request, let alone a log line an operator has to reverse
+        engineer at 2am.
+        """
+        if self.credential is not None and self.api_key_env:
+            raise ValueError(
+                f"provider {self.name!r}: set either api_key_env or credential, "
+                "not both (credential.source='env' with credential.env=... is "
+                "the spelled-out form of api_key_env)"
+            )
+        return self
+
     @model_validator(mode="after")
     def _check_kind_requirements(self) -> ProviderConfig:
         """Enforce per-``kind`` field requirements (external-agents design §5.2.2).
@@ -1088,6 +1232,71 @@ class FallbackChain(BaseModel):
         ),
     )
 
+    # --- v2.15.0 (stream-truncation): upstream SSE cut without a terminator --
+    #
+    # A streaming upstream can end its HTTP body *cleanly* while the LLM
+    # protocol carried inside it is still mid-message: no ``message_stop`` on
+    # the Anthropic wire, no ``data: [DONE]`` and no ``finish_reason`` on the
+    # OpenAI wire. llama.cpp slot preemption, an ``--n-predict`` cut-off, a
+    # front proxy closing an EOF-delimited body, or an OOM'd local server all
+    # produce exactly this shape. Transport-level breakage (timeout,
+    # ``httpx.RemoteProtocolError``) was already caught; this is the layer the
+    # transport cannot see.
+    #
+    # Before v2.15.0 that stream was indistinguishable from a complete one:
+    # the adapters never recorded whether a terminator arrived, and the
+    # translation layer's terminator-synthesis guards (H6 / M9 in
+    # ``coderouter.translation.convert``) then fabricated a ``stop_reason:
+    # end_turn`` / ``finish_reason: "stop"`` so the client would not hang. The
+    # synthesis is correct and stays; what was missing is telling the *engine*
+    # that it happened.
+    #
+    #   * ``off``   — no detection, no log, no metric. Backward-compatible
+    #                 default: byte-for-byte identical to v2.14.0 on every path.
+    #   * ``warn``  — emit a ``stream-truncation-detected`` log line (and the
+    #                 ``stream_truncated_total`` metric); the stream still
+    #                 terminates through the legacy synthesis path, so the
+    #                 client sees exactly what it saw before.
+    #   * ``error`` — the adapter raises ``StreamTruncatedError`` (a retryable
+    #                 ``AdapterError``) at the point the terminator should have
+    #                 arrived. The engine's existing branches take over: no
+    #                 bytes forwarded yet → fall back to the next provider with
+    #                 reason ``stream-truncated``; bytes already forwarded →
+    #                 ``MidStreamError``, which ``partial_stitch_action:
+    #                 surface`` renders as a graceful close carrying a
+    #                 ``coderouter_partial`` event with reason
+    #                 ``stream_truncated``.
+    #
+    # Caveats for ``error``:
+    #   * False positives are possible against an upstream that legitimately
+    #     omits the terminator. A ``message_delta`` carrying a ``stop_reason``
+    #     (Anthropic) and a ``finish_reason`` on any choice (OpenAI) are both
+    #     accepted as terminators to keep that risk low, but running ``warn``
+    #     first to measure the real rate is the recommended rollout.
+    #   * Falling back re-generates the answer on the next provider, so the
+    #     tokens the truncated attempt burned are paid twice.
+    #   * On the Anthropic streaming path the pre-content fallback requires
+    #     ``empty_response_action: fallback`` as well — that is the knob that
+    #     withholds the opening events from the client. Without it the opening
+    #     ``message_start`` has already shipped, so a truncation is by
+    #     definition mid-stream.
+    stream_truncation_action: Literal["off", "warn", "error"] = Field(
+        default="off",
+        description=(
+            "v2.15.0: action when an upstream SSE stream ends without its "
+            "protocol terminator (no ``message_stop`` / no ``[DONE]`` and no "
+            "``finish_reason``). ``off`` (default) does nothing — identical to "
+            "v2.14.0. ``warn`` emits a ``stream-truncation-detected`` log and "
+            "metric while the stream still ends through the legacy terminator "
+            "synthesis. ``error`` raises a retryable ``StreamTruncatedError`` "
+            "so the engine falls back to the next provider (reason "
+            "``stream-truncated``) when nothing has reached the client yet, or "
+            "raises ``MidStreamError`` when it has. Pair with "
+            "``empty_response_action: fallback`` for pre-content fallback on "
+            "the Anthropic streaming path."
+        ),
+    )
+
     # --- ⑧ (empty-response): per-request empty-response fallback ------------
     #
     # Some local backends (observed: gemma4:26b on ``no_tool_temptation``

coderouter/credentials.py

@@ -0,0 +1,332 @@
+"""Credential resolution, including CLI-session borrowing (v2.14.0).
+
+Until now a provider's credential could only be an env var. That is fine
+for API keys and useless for the thing an increasing number of vendors
+actually sell: a subscription, authenticated by an OAuth token that their
+own CLI already fetched and wrote to disk.
+
+CodeRouter's existing answer to those was ``kind: agent_cli`` — spawn the
+vendor's CLI once per request and read its stdout. It works, and it
+throws away almost everything CodeRouter is for. A one-shot ``exec`` has
+no streaming, no tool-call repair, no context-budget guard, and it does
+not sit in a fallback chain the way an HTTP provider does. The vendor's
+subscription ends up as an island.
+
+The alternative, which is what codex-router does for Kimi and Grok, is to
+skip the process entirely: **read the token the CLI already wrote, and
+make the HTTP call ourselves.** The provider then becomes an ordinary
+``openai_compat`` entry, and every routing feature applies to it —
+"use the subscription until it 429s, then fall through to a free cloud
+model, then to local llama.cpp" becomes an ordinary chain.
+
+    - name: kimi-sub
+      kind: openai_compat
+      base_url: https://api.moonshot.cn/v1
+      credential:
+        source: cli_session
+        path: ~/.kimi-code/credentials/kimi-code.json
+        field: access_token
+        expiry_field: expires_at
+        refresh:
+          command: ["kimi", "auth", "status"]
+
+Refresh: delegate, don't reimplement
+------------------------------------
+Refreshing is the part that rots. Every vendor has its own endpoint,
+client id, rotation policy and error shape, and all of them change. So
+this module does not implement OAuth. It runs the vendor's own CLI and
+re-reads the file — codex-router's approach for Grok, and the reason that
+path has survived contact with a moving vendor while its bespoke Kimi
+refresh has not.
+
+The command is an argv **list**, dispatched with ``shell=False``. That is
+the same trust decision v2.13.0 made for ``restart_command``: a string
+that goes through a shell turns a config file into arbitrary code
+execution, and half-executing one (``touch a; b`` under ``shell=False``
+creates a file literally named ``a;`` and reports success) is worse than
+refusing. Here there is no string form to refuse — the schema only
+accepts a list.
+
+Concurrency
+-----------
+Two workers hitting an expired token would otherwise both shell out.
+Refresh is single-flighted in-process by a per-path lock, and serialised
+across processes by an advisory ``flock`` on a sidecar file where the
+platform has one. After acquiring either lock the file is re-read before
+deciding to refresh, because the holder of the lock may already have done
+the work.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import threading
+import time
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+from coderouter.logging import get_logger
+from coderouter.secret_redaction import register_secret
+
+__all__ = [
+    "CredentialError",
+    "resolve_provider_credential",
+]
+
+logger = get_logger(__name__)
+
+# One lock per session file, created on demand. Keyed by the resolved
+# absolute path so two providers pointing at the same file share it.
+_locks: dict[str, threading.Lock] = {}
+_locks_guard = threading.Lock()
+
+
+class CredentialError(RuntimeError):
+    """A credential was configured but could not be produced."""
+
+
+@dataclass(frozen=True)
+class _SessionRead:
+    token: str | None
+    expires_at: float | None
+
+
+def _lock_for(path: str) -> threading.Lock:
+    with _locks_guard:
+        return _locks.setdefault(path, threading.Lock())
+
+
+def _dotted_get(payload: Any, dotted: str) -> Any:
+    """Fetch ``a.b.c`` out of nested mappings.
+
+    Vendors nest differently (``access_token`` at the root for Kimi, under
+    ``tokens`` for others), so the field is a path rather than a key. A
+    missing segment returns ``None`` rather than raising — an absent token
+    is a normal state (the operator has not logged in yet) and the caller
+    turns it into a clear message.
+    """
+    current = payload
+    for segment in dotted.split("."):
+        if not isinstance(current, dict) or segment not in current:
+            return None
+        current = current[segment]
+    return current
+
+
+def _as_epoch_seconds(value: Any) -> float | None:
+    """Normalise an expiry field to epoch seconds.
+
+    Accepts seconds and milliseconds, because both are common and telling
+    them apart is unambiguous: any plausible expiry in seconds is under
+    1e11, and any in milliseconds is over it. A value we cannot read at
+    all yields ``None``, which is treated as "no expiry information" —
+    the token is used and the upstream 401 becomes the signal instead.
+    """
+    if isinstance(value, bool) or value is None:
+        return None
+    if isinstance(value, (int, float)):
+        seconds = float(value)
+        return seconds / 1000.0 if seconds > 1e11 else seconds
+    if isinstance(value, str):
+        try:
+            return _as_epoch_seconds(float(value))
+        except ValueError:
+            return None
+    return None
+
+
+def _read_session(path: Path, *, field: str, expiry_field: str) -> _SessionRead:
+    """Read the token (and its expiry, if present) out of a session file."""
+    try:
+        raw = path.read_text(encoding="utf-8")
+    except OSError as exc:
+        raise CredentialError(f"cannot read session file {path}: {exc}") from exc
+    try:
+        payload = json.loads(raw)
+    except json.JSONDecodeError as exc:
+        raise CredentialError(f"session file {path} is not valid JSON: {exc}") from exc
+
+    token = _dotted_get(payload, field)
+    if token is not None and not isinstance(token, str):
+        raise CredentialError(
+            f"session file {path}: field {field!r} is "
+            f"{type(token).__name__}, expected a string"
+        )
+    expires_at = _as_epoch_seconds(_dotted_get(payload, expiry_field))
+    return _SessionRead(token=token or None, expires_at=expires_at)
+
+
+def _needs_refresh(read: _SessionRead, *, early_ratio: float, min_lead_s: float) -> bool:
+    """Whether to refresh now.
+
+    Refresh early rather than on expiry: a token that dies mid-request
+    costs a retry and a confusing upstream error. ``early_ratio`` is a
+    fraction of the *remaining* lifetime as seen right now, floored by
+    ``min_lead_s`` — so a long-lived token still refreshes several minutes
+    before it lapses rather than at the last second.
+    """
+    if read.token is None:
+        return True
+    if read.expires_at is None:
+        return False
+    remaining = read.expires_at - time.time()
+    return remaining <= max(min_lead_s, remaining * early_ratio)
+
+
+def _run_refresh(command: list[str], *, timeout_s: float, path: Path) -> None:
+    """Run the vendor CLI so it rotates the token, then let the caller re-read.
+
+    ``shell=False`` with an argv list: the config file names a program, it
+    does not get to compose a shell command. Failures are logged and
+    swallowed — a stale-but-present token is still worth trying, and the
+    upstream 401 is a better error for the operator than a refresh
+    traceback that hides it.
+    """
+    try:
+        completed = subprocess.run(
+            command,
+            shell=False,
+            capture_output=True,
+            timeout=timeout_s,
+            check=False,
+        )
+    except (OSError, subprocess.SubprocessError) as exc:
+        logger.warning(
+            "credential-refresh-failed",
+            extra={"path": str(path), "command": command[0], "error": str(exc)},
+        )
+        return
+    if completed.returncode != 0:
+        # stderr is deliberately NOT logged: a failing auth CLI is exactly
+        # the thing most likely to print a token or a device code.
+        logger.warning(
+            "credential-refresh-nonzero",
+            extra={
+                "path": str(path),
+                "command": command[0],
+                "returncode": completed.returncode,
+            },
+        )
+
+
+def _flock(handle: Any, *, exclusive: bool = True) -> Any:
+    """Best-effort advisory lock; a no-op where the platform has none."""
+    try:
+        import fcntl
+    except ImportError:  # pragma: no cover - Windows
+        return None
+    fcntl.flock(handle, fcntl.LOCK_EX if exclusive else fcntl.LOCK_SH)
+    return fcntl
+
+
+def _resolve_cli_session(spec: Any, provider_name: str) -> str | None:
+    """Read (and if needed refresh) a token a vendor CLI wrote to disk."""
+    path = Path(str(spec.path)).expanduser()
+    field = spec.field
+    expiry_field = spec.expiry_field
+
+    read = _read_session(path, field=field, expiry_field=expiry_field)
+    refresh = spec.refresh
+    if refresh is None or not _needs_refresh(
+        read, early_ratio=refresh.early_ratio, min_lead_s=refresh.min_lead_s
+    ):
+        return _register(read.token, provider_name)
+
+    with _lock_for(str(path)):
+        # Re-read under the in-process lock: another worker may have
+        # refreshed while we waited.
+        read = _read_session(path, field=field, expiry_field=expiry_field)
+        if not _needs_refresh(
+            read, early_ratio=refresh.early_ratio, min_lead_s=refresh.min_lead_s
+        ):
+            return _register(read.token, provider_name)
+
+        lock_path = path.with_name(path.name + ".coderouter-lock")
+        try:
+            lock_path.parent.mkdir(parents=True, exist_ok=True)
+            with open(lock_path, "a+") as handle:
+                _flock(handle)
+                # And once more across processes, same reason.
+                read = _read_session(path, field=field, expiry_field=expiry_field)
+                if _needs_refresh(
+                    read,
+                    early_ratio=refresh.early_ratio,
+                    min_lead_s=refresh.min_lead_s,
+                ):
+                    logger.info(
+                        "credential-refresh-started",
+                        extra={"provider": provider_name, "command": refresh.command[0]},
+                    )
+                    _run_refresh(
+                        list(refresh.command), timeout_s=refresh.timeout_s, path=path
+                    )
+                    read = _read_session(path, field=field, expiry_field=expiry_field)
+        except OSError as exc:
+            logger.warning(
+                "credential-lock-failed",
+                extra={"path": str(lock_path), "error": str(exc)},
+            )
+
+    return _register(read.token, provider_name)
+
+
+def _register(token: str | None, provider_name: str) -> str | None:
+    """Arm the log scrubber before the token goes anywhere near a header."""
+    if token:
+        register_secret(token, f"{provider_name}-session")
+    return token
+
+
+def resolve_provider_credential(config: Any) -> str | None:
+    """Return the credential for ``config``, or ``None`` when there is none.
+
+    Order of precedence is deliberately not "try everything":
+    ``credential`` and ``api_key_env`` are mutually exclusive at the
+    schema level, so exactly one path can apply. A resolver that silently
+    fell back between sources would make "which credential is this request
+    actually using?" unanswerable, which is the question an operator asks
+    at exactly the wrong moment.
+    """
+    from coderouter.config.loader import resolve_api_key
+
+    spec = getattr(config, "credential", None)
+    if spec is None:
+        return resolve_api_key(getattr(config, "api_key_env", None))
+
+    name = str(getattr(config, "name", "?"))
+    if spec.source == "env":
+        return resolve_api_key(spec.env)
+    if spec.source == "cli_session":
+        try:
+            return _resolve_cli_session(spec, name)
+        except CredentialError as exc:
+            # A missing or malformed session file is an operator problem
+            # (not logged in yet, vendor changed its layout), not a crash.
+            # Returning None sends the request unauthenticated, the upstream
+            # 401 fires, and the fallback chain moves on.
+            logger.warning(
+                "credential-unavailable",
+                extra={"provider": name, "source": spec.source, "error": str(exc)},
+            )
+            return None
+    raise CredentialError(f"provider {name}: unknown credential source {spec.source!r}")
+
+
+def session_path_is_sane(path: str) -> bool:
+    """Reject a session path that reaches outside the user's home.
+
+    ``providers.yaml`` is operator-owned config, at the same trust level as
+    ``launcher.backends[*].binary`` — but v2.13.0 exists because that
+    assumption broke once already when a file could be picked up from the
+    working directory. A vendor CLI writes under ``$HOME``; nothing
+    legitimate needs ``/etc/shadow``.
+    """
+    try:
+        resolved = Path(path).expanduser().resolve()
+        home = Path.home().resolve()
+    except (OSError, RuntimeError):
+        return False
+    return resolved == home or home in resolved.parents or os.name == "nt"

coderouter/doctor_apply.py

@@ -520,6 +520,34 @@ def _resolve_target_path(
     return None
 
 
+def _undo_partial_apply(
+    backups: dict[str, str], created_paths: list[Path]
+) -> int:
+    """Put back every file this invocation already rewrote.
+
+    Best-effort by design: a rollback that raises would mask the original
+    write failure, which is the thing the operator actually needs to see.
+    Files we created from nothing are removed; files we overwrote are
+    restored from the ``.bak`` copy taken moments earlier in the same loop.
+
+    Returns the number of files successfully reverted, for the error text.
+    """
+    reverted = 0
+    for target_str, backup_str in backups.items():
+        try:
+            shutil.copy2(backup_str, target_str)
+            reverted += 1
+        except OSError:
+            continue
+    for created in created_paths:
+        try:
+            created.unlink(missing_ok=True)
+            reverted += 1
+        except OSError:
+            continue
+    return reverted
+
+
 def apply_doctor_patches(
     *,
     report: Any,  # DoctorReport — typed Any to avoid an import cycle
@@ -637,6 +665,9 @@ def apply_doctor_patches(
     written = False
     written_paths: list[str] = []
     backups: dict[str, str] = {}
+    # Files this invocation created from nothing. They have no backup to
+    # restore from, so undoing them means deleting them again.
+    created_paths: list[Path] = []
     for target_path in target_order:
         doc, before_text = docs_by_path[target_path]
         after_text = _dump_yaml_with_comments(doc)
@@ -656,15 +687,29 @@ def apply_doctor_patches(
                 reformat_only[str(target_path)] = diff_text
         if write and target_changed:
             # Backup first (only when we have a pre-existing file).
-            if target_path.is_file():
-                backup_path = target_path.with_suffix(
-                    target_path.suffix + PROVIDERS_BACKUP_SUFFIX
-                )
-                shutil.copy2(target_path, backup_path)
-                backups[str(target_path)] = str(backup_path)
-            else:
-                target_path.parent.mkdir(parents=True, exist_ok=True)
-            target_path.write_text(after_text, encoding="utf-8")
+            try:
+                if target_path.is_file():
+                    backup_path = target_path.with_suffix(
+                        target_path.suffix + PROVIDERS_BACKUP_SUFFIX
+                    )
+                    shutil.copy2(target_path, backup_path)
+                    backups[str(target_path)] = str(backup_path)
+                else:
+                    target_path.parent.mkdir(parents=True, exist_ok=True)
+                    created_paths.append(target_path)
+                target_path.write_text(after_text, encoding="utf-8")
+            except OSError as exc:
+                # v2.14.0: an apply that spans two files used to leave the
+                # first one rewritten when the second failed — a half-applied
+                # config the operator had no way to name, let alone undo. Roll
+                # the completed writes back before surfacing the error, so a
+                # failed apply is always a no-op rather than a partial one.
+                undone = _undo_partial_apply(backups, created_paths)
+                raise DoctorApplyError(
+                    f"failed to write {target_path}: {exc}. "
+                    f"Rolled back {undone} already-written file(s); "
+                    "no partial apply was left on disk."
+                ) from exc
             written = True
             written_paths.append(str(target_path))