flyteplugins-union 0.4.2__tar.gz → 0.5.0__tar.gz

{flyteplugins_union-0.4.2/src/flyteplugins_union.egg-info → flyteplugins_union-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: flyteplugins-union
-Version: 0.4.2
+Version: 0.5.0
 Summary: Union SDK - Proprietary extensions for Flyte
 Author-email: unionai <info@union.ai>
 Project-URL: Homepage, https://www.union.ai/
@@ -19,8 +19,10 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: aiosqlite>=0.20.0
 Requires-Dist: connectrpc>=0.9.0
-Requires-Dist: flyte<2.5.0,>=2.3.0
+Requires-Dist: flyte<2.6.0,>=2.5.7
 Requires-Dist: flyteidl2>=2.0.0
+Requires-Dist: httpx>=0.27.0
+Requires-Dist: httpx-ws>=0.6.0
 Requires-Dist: kubernetes>=27.2.0
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: rich-click>=1.8.0
@@ -43,6 +45,22 @@ For development:
 uv pip install -e .
 ```
 
+## Flyte compatibility
+
+`flyteplugins-union` builds on `flyte` SDK internals that can change between `flyte`
+**minor** releases, so each release pins `flyte` to a single minor line. **Install a
+`flyteplugins-union` release built for your `flyte` minor:**
+
+| flyteplugins-union | Requires flyte   |
+| ------------------ | ---------------- |
+| 0.5.0+             | `>=2.5.7,<2.6.0` |
+| 0.4.3              | `>=2.5.0,<2.6.0` |
+| 0.4.0 – 0.4.2      | `>=2.3.0,<2.5.0` |
+| 0.3.0              | `>=2.1.0,<2.5.0` |
+
+See [COMPATIBILITY.md](https://github.com/unionai/flyteplugins-union/blob/main/COMPATIBILITY.md)
+for the rationale and how the pin tracks new `flyte` releases.
+
 ## Features
 
 ### API Key Management
@@ -100,7 +118,7 @@ This makes Union commands available seamlessly through the Flyte CLI.
 
 ## Dependencies
 
-- flyte>=2.0.0b26 - The Flyte SDK v2
+- flyte - The Flyte SDK v2 (pinned to a single minor; see [Flyte compatibility](#flyte-compatibility))
 - rich-click>=1.8.0 - For CLI formatting
 
 ## Development

{flyteplugins_union-0.4.2 → flyteplugins_union-0.5.0}/README.md

@@ -13,6 +13,22 @@ For development:
 uv pip install -e .
 ```
 
+## Flyte compatibility
+
+`flyteplugins-union` builds on `flyte` SDK internals that can change between `flyte`
+**minor** releases, so each release pins `flyte` to a single minor line. **Install a
+`flyteplugins-union` release built for your `flyte` minor:**
+
+| flyteplugins-union | Requires flyte   |
+| ------------------ | ---------------- |
+| 0.5.0+             | `>=2.5.7,<2.6.0` |
+| 0.4.3              | `>=2.5.0,<2.6.0` |
+| 0.4.0 – 0.4.2      | `>=2.3.0,<2.5.0` |
+| 0.3.0              | `>=2.1.0,<2.5.0` |
+
+See [COMPATIBILITY.md](https://github.com/unionai/flyteplugins-union/blob/main/COMPATIBILITY.md)
+for the rationale and how the pin tracks new `flyte` releases.
+
 ## Features
 
 ### API Key Management
@@ -70,7 +86,7 @@ This makes Union commands available seamlessly through the Flyte CLI.
 
 ## Dependencies
 
-- flyte>=2.0.0b26 - The Flyte SDK v2
+- flyte - The Flyte SDK v2 (pinned to a single minor; see [Flyte compatibility](#flyte-compatibility))
 - rich-click>=1.8.0 - For CLI formatting
 
 ## Development

{flyteplugins_union-0.4.2 → flyteplugins_union-0.5.0}/licenses/BSL.txt

@@ -17,7 +17,7 @@ Additional Use Grant: You may make use of the Licensed Work, provided that
                       computer programs whose source code are controlled by
                       such third parties.
 
-Change Date:          2030-06-16
+Change Date:          2030-06-29
 
 Change License:       Apache License, Version 2.0
 

{flyteplugins_union-0.4.2 → flyteplugins_union-0.5.0}/pyproject.toml

@@ -12,8 +12,11 @@ requires-python = ">=3.10"
 dependencies = [
     "aiosqlite>=0.20.0",
     "connectrpc>=0.9.0",
-    "flyte>=2.3.0,<2.5.0",
+    "flyte>=2.5.7,<2.6.0",
     "flyteidl2>=2.0.0",
+    # ws_proxy (flyte-ws-proxy ssh ProxyCommand) speaks WebSocket over httpx.
+    "httpx>=0.27.0",
+    "httpx-ws>=0.6.0",
     "kubernetes>=27.2.0",
     "pyyaml>=6.0",
     "rich-click>=1.8.0",
@@ -74,6 +77,10 @@ exclude = ["src/flyteplugins/union/internal"]
 Homepage = "https://www.union.ai/"
 Documentation = "https://docs.union.ai/"
 
+[project.scripts]
+# Stdio<->WebSocket proxy used as the ssh ProxyCommand for SSH-into-task debug.
+flyte-ws-proxy = "flyteplugins.union.ws_proxy:main"
+
 [project.entry-points."flyte.plugins.cli.commands"]
 # CLI plugins for Union commands
 "create.api-key" = "flyteplugins.union.cli.api_key:create_api_key"
@@ -109,6 +116,10 @@ Documentation = "https://docs.union.ai/"
 # than an `explore.volume` entry because the plugin loader won't auto-create a
 # missing `explore` verb group (it warns + skips).
 "explore" = "flyteplugins.union.cli.volume:explore"
+# Top-level `flyte debug <run> [action]` command: relaunch an existing run with
+# ssh-debug (via flyte.rerun) and connect — the single ssh-into-task entry point.
+# A single command (no group needed).
+"debug" = "flyteplugins.union.cli.debug:debug"
 
 [project.entry-points."flyte.plugins.types"]
 # Custom TypeTransformer that auto-commits a still-mounted Volume at
@@ -177,3 +188,9 @@ select = [
 # VolumeExplore lazy-imports flyte.io / msgpack / boto3 / the Volume model so
 # `import flyteplugins.union.remote` stays light for non-volume callers.
 "src/flyteplugins/union/remote/_volume_explore.py" = ["PLC0415"]
+# ssh-debug client lazy-imports the flyte auth machinery / remote objects so
+# `flyte debug --help` and `import flyteplugins.union.remote` stay light.
+"src/flyteplugins/union/cli/debug.py" = ["PLC0415"]
+# _debug defers the ssh-debug import (launch_env) so `import flyteplugins.union` stays light.
+"src/flyteplugins/union/_debug.py" = ["PLC0415"]
+"src/flyteplugins/union/remote/_ssh_debug.py" = ["PLC0415"]

flyteplugins_union-0.5.0/src/flyteplugins/union/__init__.py

@@ -0,0 +1,10 @@
+"""Union SDK - Proprietary extensions for Flyte.
+
+This package provides Union-specific functionality on top of the open-source Flyte SDK.
+"""
+
+from flyteplugins.union._debug import debug, with_debugcontext
+
+# `SSHDebug` lives in `flyteplugins.union.remote` — import it from there
+# (`from flyteplugins.union.remote import SSHDebug`).
+__all__ = ["debug", "with_debugcontext"]

flyteplugins_union-0.5.0/src/flyteplugins/union/_debug.py

@@ -0,0 +1,110 @@
+"""SSH-into-task debug helpers.
+
+Public surface:
+
+- ``debug(...)`` / ``with_debugcontext(...)`` — re-exported from ``flyteplugins.union``.
+- ``SSHDebug`` — resolve the connection; import it from ``flyteplugins.union.remote``.
+
+`debug(...)` is the convenience for the two common cases (it just wraps `with_debugcontext`):
+
+```python
+import flyte
+from flyteplugins.union import debug
+from flyteplugins.union.remote import SSHDebug
+
+flyte.init_from_config()
+
+run = debug(my_task, x=1)          # launch a NEW task in debug mode
+run = debug("some-prior-run")      # relaunch an EXISTING run in debug mode (fetches its code+inputs)
+
+print(SSHDebug.connect(run.name).ssh_config)   # paste into ~/.ssh/config, then `ssh flyte-debug`
+```
+
+The `flyte debug <run>` CLI relaunches **and** connects in one shot.
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any, Dict, Optional
+
+import flyte
+
+if TYPE_CHECKING:
+    from flyte import TaskTemplate
+    from flyte.remote import Run
+
+__all__ = ["debug", "with_debugcontext"]
+
+
+def with_debugcontext(
+    mode: Any = None,
+    *,
+    env_vars: Optional[Dict[str, str]] = None,
+    ssh_host_name: Optional[str] = None,
+    custom_context: Optional[Dict[str, str]] = None,
+    **kwargs,
+):
+    """Like `flyte.with_runcontext`, but preconfigured for ssh-into-task debug.
+
+    Ensures the auto-managed debug keypair exists and merges the ssh-debug env
+    (``_F_E_SSH`` / ``_F_SSH_PK`` / ``_F_E_VS``) into *env_vars*; all other
+    arguments are forwarded unchanged. Returns the same runner as
+    `with_runcontext`, so call ``.run(task, ...)`` / ``.rerun(run, ...)`` on it.
+
+    *ssh_host_name* records the intended ssh Host alias on the run's *custom_context*
+    (under ``ssh-host-name``); it is propagation/record only — the alias used to build
+    the local ssh-config is the one threaded directly to `SSHDebug.connect`.
+    """
+    from flyteplugins.union.remote._ssh_debug import SSH_HOST_NAME_CONTEXT_KEY, launch_env
+
+    cc = dict(custom_context or {})
+    if ssh_host_name:
+        cc[SSH_HOST_NAME_CONTEXT_KEY] = ssh_host_name
+    return flyte.with_runcontext(mode, env_vars=launch_env(env_vars), custom_context=cc or None, **kwargs)
+
+
+def debug(
+    target: "str | TaskTemplate",
+    *args: Any,
+    action_name: str = "a0",
+    name: Optional[str] = None,
+    ssh_host_name: Optional[str] = None,
+    custom_context: Optional[Dict[str, str]] = None,
+    task_template: "Optional[TaskTemplate]" = None,
+    inputs: Optional[Dict[str, Any]] = None,
+    env_vars: Optional[Dict[str, str]] = None,
+    **kwargs: Any,
+) -> "Run":
+    """Launch a task, or relaunch an existing run, with ssh-into-task debug enabled. Returns the `Run`.
+
+    Two forms (mirroring `flyte.run` / `flyte.rerun`), both with the ssh-debug env injected so the new
+    run comes up with sshd:
+
+    - **`debug(task, x=1)`** — run ``task`` in debug mode (= `with_debugcontext().run(task, x=1)`).
+    - **`debug("run-name")`** — relaunch an existing run in debug mode, fetching its code + inputs
+      (= `with_debugcontext().rerun("run-name")`). Pass ``inputs={...}`` to change parameters or
+      ``task_template=`` to substitute code.
+
+    Then connect with `SSHDebug.connect(run.name)` (or use the `flyte debug <run>` CLI, which relaunches
+    **and** connects in one shot).
+
+    :param target: a `TaskTemplate` to launch, or a prior run name (str) to relaunch.
+    :param action_name: (run-name form) action to source the task + inputs from (default ``a0``).
+    :param name: explicit name for the new run; omit to let the platform assign one. A fixed name
+        makes the launch idempotent — relaunching with the same name re-uses the existing run.
+    :param ssh_host_name: record the intended ssh Host alias on the run's custom_context
+        (``ssh-host-name``); record/propagation only (see `with_debugcontext`).
+    :param custom_context: extra custom-context key/values to attach to the run (merged with
+        ``ssh-host-name`` when *ssh_host_name* is given).
+    :param task_template: (run-name form) substitute task to run instead of the prior run's code.
+    :param inputs: (run-name form) native input overrides; omit to reuse the prior run's inputs.
+    :param env_vars: extra env vars to set on the run (merged with the ssh-debug env).
+    :param args, kwargs: (task form) inputs to pass to ``target`` (like `flyte.run(task, *args, **kwargs)`).
+    :return: the new ssh-debug Run.
+    """
+    # TODO: add a `recover=` param (recover from the run being relaunched) once the flyteidl2
+    # RunSpec.recover field + backend support ship.
+    ctx = with_debugcontext(name=name, env_vars=env_vars, ssh_host_name=ssh_host_name, custom_context=custom_context)
+    if isinstance(target, str):
+        return ctx.rerun(target, action_name, task_template=task_template, inputs=inputs)
+    return ctx.run(target, *args, **kwargs)

{flyteplugins_union-0.4.2 → flyteplugins_union-0.5.0}/src/flyteplugins/union/cli/assignment.py

@@ -51,24 +51,26 @@ def create_assignment(
 @click.command("assignment")
 @click.option("--user-subject", type=str, default=None, help="User subject identifier")
 @click.option("--creds-subject", type=str, default=None, help="Client credentials application subject")
+@click.option("--email", type=str, default=None, help="User email for lookup")
 @click.pass_obj
-def get_assignment(cfg: common.CLIConfig, user_subject: str | None, creds_subject: str | None):
+def get_assignment(cfg: common.CLIConfig, user_subject: str | None, creds_subject: str | None, email: str | None):
     """Get or list assignments.
 
-    Without --user-subject or --creds-subject, lists all assignments.
+    Without --user-subject, --creds-subject, or --email, lists all assignments.
 
     Examples:
 
         $ flyte --org my-org get assignment
         $ flyte --org my-org get assignment --user-subject user-123
         $ flyte --org my-org get assignment --creds-subject app-456
+        $ flyte --org my-org get assignment --email jane@example.com
     """
     cfg.init(project="", domain="")
     console = common.get_console()
 
     try:
-        if user_subject or creds_subject:
-            assignment = Assignment.get(user_subject=user_subject, creds_subject=creds_subject)
+        if user_subject or creds_subject or email:
+            assignment = Assignment.get(user_subject=user_subject, creds_subject=creds_subject, email=email)
             console.print(common.format("Assignment", [assignment], "json"))
         else:
             assignments = list(Assignment.listall())
@@ -83,6 +85,7 @@ def get_assignment(cfg: common.CLIConfig, user_subject: str | None, creds_subjec
 @click.command("assignment")
 @click.option("--user-subject", type=str, default=None, help="User subject identifier")
 @click.option("--creds-subject", type=str, default=None, help="Client credentials application subject")
+@click.option("--email", type=str, default=None, help="User email for lookup")
 @click.option("--policy", type=str, required=True, help="Policy name to unassign")
 @click.option("--yes", is_flag=True, help="Skip confirmation prompt")
 @click.pass_obj
@@ -90,30 +93,33 @@ def delete_assignment(
     cfg: common.CLIConfig,
     user_subject: str | None,
     creds_subject: str | None,
+    email: str | None,
     policy: str,
     yes: bool,
 ):
     """Unassign a policy from an identity.
 
-    One of --user-subject or --creds-subject must be provided.
+    Exactly one of --user-subject, --creds-subject, or --email must be provided.
 
     Examples:
 
         $ flyte --org my-org delete assignment --user-subject user-123 --policy admin
         $ flyte --org my-org delete assignment --creds-subject app-456 --policy admin
+        $ flyte --org my-org delete assignment --email jane@example.com --policy admin
     """
     cfg.init(project="", domain="")
     console = common.get_console()
 
-    if not user_subject and not creds_subject:
-        raise click.ClickException("One of --user-subject or --creds-subject must be provided")
+    provided = sum(x is not None for x in (user_subject, creds_subject, email))
+    if provided != 1:
+        raise click.ClickException("Exactly one of --user-subject, --creds-subject, or --email must be provided")
 
-    subject = user_subject or creds_subject
+    subject = user_subject or creds_subject or email
     if not yes:
         click.confirm(f"Are you sure you want to unassign policy '{policy}' from '{subject}'?", abort=True)
 
     try:
-        Assignment.unassign(user_subject=user_subject, creds_subject=creds_subject, policy=policy)
+        Assignment.unassign(user_subject=user_subject, creds_subject=creds_subject, email=email, policy=policy)
         console.print(
             f"[green]✓[/green] Successfully unassigned policy [cyan]{policy}[/cyan] from [cyan]{subject}[/cyan]"
         )

flyteplugins_union-0.5.0/src/flyteplugins/union/cli/debug.py

@@ -0,0 +1,260 @@
+"""``flyte debug <run> [action]`` — relaunch an existing run with ssh-debug, then connect.
+
+The single ssh-into-task entry point: it re-runs the given run with the ssh-debug
+env injected (via `flyteplugins.union.debug`, built on `flyte.rerun`), waits for the
+new run's ``:6060`` route, and prints the ready-to-paste ``~/.ssh/config`` block.
+
+The relaunch uses a **deterministic** name derived from the source run, so re-running
+``flyte debug <run>`` reconnects to the live debug run instead of spawning a duplicate:
+the backend's already-exists check short-circuits the relaunch and we just resolve the
+route + (re)write the ssh-config.
+
+Registered as a top-level ``debug`` command (the plugin loader won't auto-create a
+missing verb group; a single command needs no group).
+"""
+
+from __future__ import annotations
+
+import re
+from typing import Optional
+
+import rich_click as click
+
+# Heavy imports (rich, remote objects, the SDK runner) are deferred into the command
+# body so registering the entry point stays fast.
+
+# Conservative cap for a derived run name (DNS-label-like: lowercase alphanumeric + hyphens).
+_RUN_NAME_MAX = 63
+_DEBUG_SUFFIX = "-dbg"
+
+
+def _sanitize_run_name(source: str, *, reserve: int = 0) -> str:
+    """Coerce *source* into a valid run name (DNS-label-like, length-bounded).
+
+    *reserve* leaves room for a caller-appended suffix. The backend rejects user-given run
+    names starting with 'u', so a leading 'u' (and any hyphen it exposes) is dropped.
+    """
+    stem = re.sub(r"[^a-z0-9-]+", "-", source.lower()).strip("-")
+    if stem.startswith("u"):
+        stem = stem[1:].lstrip("-")
+    return stem[: _RUN_NAME_MAX - reserve] or "dbg"
+
+
+def _debug_run_name(source: str) -> str:
+    """Deterministic debug-run name for a source run.
+
+    Re-running ``flyte debug <run>`` derives the same name, so the second invocation hits the
+    backend's already-exists check and we reconnect to the live debug run instead of spawning a
+    duplicate. The suffix keeps it distinct from the source run.
+    """
+    return _sanitize_run_name(source, reserve=len(_DEBUG_SUFFIX)) + _DEBUG_SUFFIX
+
+
+@click.command("debug")
+@click.argument("run_name", required=True)
+@click.argument("action_name", required=False)
+@click.option("--user", type=str, default="root", show_default=True, help="SSH login user inside the pod.")
+@click.option(
+    "--identity-file",
+    "identity_file",
+    type=str,
+    default=None,
+    help="Private key to authenticate with. Defaults to the auto-managed "
+    "~/.flyte/ssh-debug/id_ed25519 (created for you; no ssh-keygen needed).",
+)
+@click.option(
+    "--name",
+    "name",
+    type=str,
+    default=None,
+    help="Name for this debug session — used as both the ~/.ssh/config Host alias and the remote "
+    "debug run name. Re-running with the same name reconnects to the live session; a new name "
+    "starts a fresh debug run (handy if the previous one died). "
+    "Defaults to a name derived from RUN_NAME.",
+)
+@click.option(
+    "--api-key/--no-api-key",
+    "api_key",
+    default=False,
+    help="Authenticate the tunnel with a dedicated, long-lived API key (created/reused "
+    "as `flyte-ssh-debug`) instead of your interactive session token. Survives re-logins "
+    "and won't expire mid-session.",
+)
+@click.option(
+    "--refresh-token",
+    "refresh_token",
+    is_flag=True,
+    help="Force a fresh Bearer instead of reusing the cached one (use if you hit auth errors).",
+)
+# TODO: add a `--recover` flag (recover from the run: reuse its succeeded actions) once the
+# flyteidl2 RunSpec.recover field + backend support ship.
+@click.option(
+    "--write-config",
+    "write_config",
+    is_flag=True,
+    help="Write the Host block into ~/.ssh/config (replacing any prior block for the same name).",
+)
+@click.option(
+    "--wait/--no-wait",
+    "wait",
+    default=True,
+    show_default=True,
+    help="Wait for the debug run to start and its ssh route to become ready, then print the "
+    "ssh-config. With --no-wait, relaunch and return immediately (don't block on the pod coming "
+    "up); re-run the same command later to attach once it's running.",
+)
+@click.option(
+    "--timeout",
+    type=float,
+    default=300.0,
+    show_default=True,
+    help="Seconds to wait for the debug route to become ready.",
+)
+@click.pass_obj
+def debug(
+    cfg,
+    run_name: str,
+    action_name: Optional[str],
+    user: str,
+    identity_file: str,
+    name: Optional[str],
+    api_key: bool,
+    refresh_token: bool,
+    write_config: bool,
+    wait: bool,
+    timeout: float,
+) -> None:
+    """Relaunch RUN_NAME's task with ssh-debug enabled, then connect.
+
+    Only RUN_NAME is required; ACTION_NAME defaults to the root action ``a0``. The new run
+    re-uses the original inputs and comes up with sshd; this then prints its ssh-config.
+
+    Re-running ``flyte debug RUN_NAME`` reconnects to the same debug run (it isn't relaunched
+    twice) and refreshes the token in place — so it doubles as "just reattach".
+
+    Examples:
+
+        # Relaunch a prior run in debug mode and print its ssh-config
+        $ flyte debug my-run
+
+        # Named session (ssh Host alias + remote run name), written into ~/.ssh/config
+        $ flyte debug my-run --name my-dbg --api-key --write-config
+
+        # A new --name starts a fresh debug run (e.g. the previous one died)
+        $ flyte debug my-run --name my-dbg2
+
+        # Fire-and-forget: relaunch and return without waiting for the pod to come up
+        $ flyte debug my-run --no-wait
+
+        # Then connect (or VS Code -> Remote-SSH -> <name>)
+        $ ssh my-dbg
+    """
+    import flyte.errors
+    from flyte.cli import _common as common
+
+    from flyteplugins.union import debug as debug_run
+    from flyteplugins.union.remote import SSHDebug
+    from flyteplugins.union.remote._ssh_debug import DebugRunTerminalError
+
+    action_name = action_name or "a0"
+    cfg.init()
+
+    console = common.get_console()
+    # --name (when given) is both the remote run name and the ssh Host alias; otherwise derive a
+    # deterministic run name from RUN_NAME (so re-running reconnects) and use the default host alias.
+    debug_name = _sanitize_run_name(name) if name else _debug_run_name(run_name)
+    host_alias = name or "flyte-debug"
+    # Connect to the debug run regardless of whether we launched it now or it was already up.
+    target = debug_name
+
+    with console.status(f"[bold]Relaunching[/] {run_name}/{action_name} with ssh-debug…", spinner="dots"):
+        try:
+            # Record the chosen host alias on the run (ssh-host-name); the alias used to build the
+            # ssh-config below is still threaded directly via host_alias (no read-back).
+            new_run = debug_run(run_name, action_name=action_name, name=debug_name, ssh_host_name=name)
+            target = new_run.name
+            console.print(f"[green]Relaunched[/] as [bold]{new_run.name}[/]  {new_run.url}")
+        except flyte.errors.RuntimeUserError as e:
+            # A prior `flyte debug {run_name}` already launched this debug run — reconnect to it
+            # instead of failing. (Any other user error still surfaces.)
+            if getattr(e, "code", None) != "RunAlreadyExistsError":
+                raise
+            console.print(f"[yellow]Debug run[/] [bold]{debug_name}[/] already exists — reconnecting.")
+
+    if not wait:
+        # --no-wait: don't block on the pod booting + sshd coming up. The same command, re-run
+        # once the run is going, reconnects (it won't relaunch) and prints the ssh-config.
+        reattach = f"flyte debug {run_name}" + (f" --name {name}" if name else "")
+        console.print(
+            f"[dim]--no-wait: not waiting for the ssh route on [bold]{target}[/]. "
+            f"Once it's running, re-run [bold]{reattach}[/] to attach (reconnects, won't relaunch), "
+            f"then [bold]ssh {host_alias}[/].[/dim]"
+        )
+        return
+
+    with console.status(f"[bold]Resolving[/] ssh route for {target}/a0…", spinner="dots"):
+        try:
+            info = SSHDebug.connect(
+                target,
+                "a0",
+                user=user,
+                identity_file=identity_file,
+                host_alias=host_alias,
+                use_api_key=api_key,
+                refresh_token=refresh_token,
+                timeout=timeout,
+            )
+        except (TimeoutError, PermissionError, DebugRunTerminalError) as e:
+            raise click.ClickException(str(e)) from e
+
+    _emit(console, info, run_name=target, action_name="a0", write_config=write_config)
+
+
+def _emit(console, info, *, run_name, action_name, write_config):
+    """Write the Host block (optionally) and print the connect panel."""
+    import os
+    from pathlib import Path
+
+    from rich.panel import Panel
+    from rich.syntax import Syntax
+
+    if write_config:
+        ssh_config_path = Path(os.path.expanduser("~/.ssh/config"))
+        ssh_config_path.parent.mkdir(parents=True, exist_ok=True)
+        existing = ssh_config_path.read_text() if ssh_config_path.exists() else ""
+        # Drop any prior `Host <alias>` block (header + its indented body) so
+        # re-running replaces stale config instead of shadowing it with a dup
+        # (ssh honors the first matching Host).
+        kept, skipping = [], False
+        for line in existing.splitlines():
+            if line.strip().startswith("Host ") and line.split()[1:] == [info.host_alias]:
+                skipping = True
+                continue
+            if skipping:
+                # Block body is blank or indented; ends at the next non-indented, non-blank line.
+                if line and not line[0].isspace():
+                    skipping = False
+                else:
+                    continue
+            kept.append(line)
+        new_text = "\n".join(kept).rstrip() + "\n\n" + info.ssh_config
+        ssh_config_path.write_text(new_text)
+        console.print(f"[green]Wrote[/] Host [bold]{info.host_alias}[/] to {ssh_config_path}")
+
+    console.print(
+        Panel.fit(
+            Syntax(info.ssh_config, "sshconfig", theme="ansi_dark", background_color="default"),
+            title=f"[bold]ssh -> {run_name}/{action_name}[/bold]",
+            subtitle=f"then: ssh {info.host_alias}   (or VS Code Remote-SSH -> {info.host_alias})",
+            border_style="cyan",
+        )
+    )
+    if info.headers_file:
+        console.print(f"[dim]Bearer header written to {info.headers_file} (0600)[/dim]")
+    # Prominent next step: the literal command to run.
+    console.print(f"\n[bold green]➜ Connect now:[/] ssh {info.host_alias}")
+    console.print(
+        "[dim]Token expired / 401 on reconnect? Just re-run the same `flyte debug` command "
+        "(reconnects + refreshes in place — no --write-config needed). "
+        "For multi-day sessions use --api-key.[/dim]"
+    )

{flyteplugins_union-0.4.2 → flyteplugins_union-0.5.0}/src/flyteplugins/union/errors.py

@@ -53,6 +53,19 @@ class VolumeUnmountError(VolumeError):
     _code = "VolumeUnmountFailed"
 
 
+class VolumeUnmountUnsupportedError(VolumeUnmountError):
+    """The runtime cannot unmount the FUSE client at all because ``fusermount``
+    can't reach its mount table (``/etc/mtab`` is missing, read-only, or
+    unwritable). Unlike a transient :class:`VolumeUnmountError` (EBUSY), retrying
+    won't help — the image is missing the ``/etc/mtab`` → ``/proc/self/mounts``
+    symlink most base images carry. The terminal seal treats this as recoverable:
+    it falls back to a keep-alive (live) commit, leaving the mount in place. A
+    kind of :class:`VolumeUnmountError`, so ``except VolumeUnmountError`` catches
+    it too."""
+
+    _code = "VolumeUnmountUnsupported"
+
+
 class VolumeCommitError(VolumeError):
     """A keep-alive checkpoint could not be made durable: the writeback staging
     queue did not finish uploading to object storage (it timed out, or its