gpu-compute-provider 0.4.2__tar.gz

gpu_compute_provider-0.4.2/CHANGELOG.md

@@ -0,0 +1,452 @@
+# Changelog
+
+All notable changes to the `supercomputer` Python SDK and CLI are recorded here.
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/);
+versions follow [Semantic Versioning](https://semver.org/).
+
+## [Unreleased]
+
+### Changed
+- The PyPI distribution is now **gpu-compute-provider**: `pip install gpu-compute-provider`.
+  The import path (`import supercomputer`) and the `super` CLI are unchanged.
+
+### Fixed
+- `super sweep status --cost` now prints the spend rollup in human output
+  (`cost: $X.XX across N session(s) (all attempts)`). It was fetched and
+  then dropped, so only `--json` showed what a sweep had cost (#91).
+- A host that dies while it builds a session no longer parks the client for the
+  30-minute ready wait: the lost connection wakes the wait, and `create`/attach
+  go back to the dispatcher for the requeued session (up to twice).
+- `super job wait <id>` on an ephemeral job exits with the exit code of the
+  job's own command — its first spawn, not a later `super exec --on <id>` —
+  (`69` host lost, `75` still running at `--timeout`, `1` when nothing recorded
+  says it succeeded) instead of `0` for any closed session. `--json` adds
+  `termination`.
+- `super job wait <id>` right after `super job run --detach` (or a `job kill`)
+  waits up to 15s for the host to record the job's process instead of exiting
+  `1` with "no process to wait for". If none ever shows up, `--json` now prints
+  a `job_no_process` error object; before, it printed nothing.
+- `super stop` no longer says "files kept" before teardown has run, and says
+  billing stopped when the stop was accepted. `super stop --wait` reports a
+  failed final save when the server records one for this stop: it compares the
+  session's `state_loss_reason`/`state_loss_at` before and after, and exits `1`
+  naming `close_flush_incomplete` (the final sync did not finish) or
+  `volume_commit_failed` only when that stamp is new. A state loss recorded
+  earlier is mentioned, not failed; `--json` adds `state_loss_reason` and
+  `state_loss_at`. A session that ends failed/dead during the stop also exits
+  `1`; one that had already ended that way does not.
+  `super job kill` follows the same rule.
+- `super sessions` no longer counts a `stopping` session in "Spending now", and
+  never shows a non-billable interval's price as a rate.
+- `super job run --retries`: a retry after a lost box re-attaches to a cold
+  (closed) session and its `/workspace` instead of starting a new, empty one.
+  When the session failed or died the retry still needs a new session, and
+  stderr now says its `/workspace` starts empty. A session closed on request
+  (`super job kill`, `super stop`) is never resumed or re-run by a retry.
+- Downloads are checked against the file's SHA-256 (live-session blob reference,
+  session manifest) and a failed or corrupt GET is fetched once more. The
+  manifest hash is re-read once on a mismatch, since a live session's manifest
+  moves; `super sweep harvest` checks each file against its listing's hash.
+- After a host loss during attach, the session reports the host it is on now,
+  so a reconnect is no longer announced as "same host" for a session that moved.
+- A large upload's pre-signed PUT is retried (three attempts) on a dropped
+  connection or a store 5xx.
+- `super --help`: a `super job run` saves `/workspace`; several sessions may
+  attach one volume at once (last writer wins per file).
+- `super sweep retry` after a canary failure reports that the canary runs first
+  (the dispatcher now re-queues the fan-out behind it).
+- `super upload` (and `session.upload`) now preserves file permission bits:
+  an uploaded `0755` script lands executable instead of `0644`, so `./run.sh`
+  works without `chmod +x` or `bash run.sh` (#45). Both the inline and the
+  large-file blob route send the local mode; hosts that predate the field
+  still write `0644`.
+
+### Added
+- `super skus` shows a `$/HR` column and `super skus --json` fills `cost_per_hr`
+  with the rate each SKU was most recently billed at, stamped by `cost_as_of`.
+  It is an observed spot rate, not a list price; a SKU not billed in the last
+  7 days stays `null` / `-`. (#44)
+
+### Changed
+- `super run --retries N` pauses before each re-run (2s, 4s, … capped at 30s)
+  and skips re-runs that cannot change the outcome: exit `126`/`127` and an
+  OOM kill. Other non-zero exits are re-run as before.
+- Installed agent skill files (`~/.claude|.cursor|.codex/skills/supercomputer/SKILL.md`)
+  are refreshed on every `super` invocation when the packaged copy changes, so
+  upgrading the package also upgrades the skill. Only files `super` wrote are
+  touched; the file now carries a "managed by super" note since edits are overwritten.
+- Reads short SKU names, which the dispatcher serves once `SUPERCOMPUTER_PUBLIC_SKU_NAMES=short` is set for this release: the GPU model for one GPU (`l4`, `h100`,
+  `rtx_pro_6000`), `<N>x_<model>` for several (`8x_h100`, `4x_l40s`), `cpu` for
+  the default CPU-only box and `<N>x_cpu` for larger ones. The API, `super skus`,
+  session listings and progress lines show the short names. The long names
+  (`gpu_1x_l4`, `gpu_8x_h100`, `cpu_2x_epyc`, `cpu_generic`) are still accepted
+  everywhere a SKU is given (`--sku`, `supercomputer.json`, `project.session(sku=)`),
+  and the SDK treats both spellings alike when choosing the default image and the
+  torch wheel index. CLI help, examples and the agent skill use the short names.
+- Session and provisioning output no longer names where a host runs. Progress
+  lines read `⟳ provisioning l4 …` (no provider or region), `super shell`
+  prints only state, age and detail, and the API no longer returns
+  provider, region, instance id, availability zone or host domain fields in
+  provisioning payloads and session records.
+- `super skus` and `Client.list_skus()` no longer list a `clouds` field per SKU.
+- Placement pinning (`--provider`/`--region`, `SUPERCOMPUTER_PROVIDER`/
+  `SUPERCOMPUTER_REGION`, `"provider"`/`"region"` in `supercomputer.json`) is
+  internal-only. The API refuses it from other accounts with 403
+  `placement_pin_forbidden`, and the CLI explains which setting to remove.
+- `Session.upload()` reports large files as `blob_files` and the cutoff as
+  `blob_threshold_bytes`. Upload and download errors on that path read
+  `blob upload failed` / `blob download failed`.
+- The Modal-compat `gpu=` mapping is an explicit table onto the short SKU names:
+  `"H100"` gives `h100`, `"H100:8"` gives `8x_h100`, `A10G`/`A10` give `a10g`
+  (was the unservable `gpu_Nx_a10`), `L40S` and `RTX-PRO-6000` are supported,
+  `H100!` maps to `h100`, and CPU-only functions get `cpu`.
+
+### Deprecated
+- The `s3_files` and `s3_threshold_bytes` keys of `Session.upload()`'s result.
+  They still carry the same values as `blob_files` / `blob_threshold_bytes`;
+  read the `blob_*` keys instead.
+
+## [0.4.2] - 2026-09-24
+
+### Fixed
+- Older installs that saved `api.supercomputer.sh` or `supercomputer-dispatcher.fly.dev`
+  (in `~/.supercomputer/url`, `~/.supercomputer/url` or a `SUPERCOMPUTER_URL` / `SUPERCOMPUTER_URL` export) now
+  resolve to `https://api.supercomputer.sh`. Same backend, new hostname; dev and
+  staging hosts are untouched.
+
+## [0.4.1] - 2026-09-24
+
+### Changed
+- The base exception is `SupercomputerError` (`SupercomputerRuntimeError` for
+  SDK-side failures). `SupercomputerError`, `SupercomputerRuntimeError` and `SupercomputerError` are
+  the same classes under their old names, so existing `except` clauses keep
+  working.
+- New API keys are minted as `super_sk_…`; `super_sk_` / `super_sk_` keys stay
+  valid. Prompts and docs show the new prefix.
+- `pip install supercomputer` now installs an empty shim that depends on
+  `supercomputer`, published alongside this release.
+
+## [0.4.0] - 2026-09-24
+
+### Changed
+- Renamed to **supercomputer**. `pip install supercomputer`; the CLI is `super`
+  and the Python package is `import supercomputer`. `supercomputer` / `supercomputer` remain as
+  CLI and import aliases, `SUPERCOMPUTER_*` / `SUPERCOMPUTER_*` env vars still work,
+  `~/.supercomputer` and `supercomputer.json` are still read. New names: `SUPERCOMPUTER_*`,
+  `~/.supercomputer`, `supercomputer.json`.
+- Job tasks now receive `SUPERCOMPUTER_TASK_ID` / `SUPERCOMPUTER_WORLD_SIZE` /
+  `SUPERCOMPUTER_JOB` instead of the `SUPERCOMPUTER_*` names (no alias: update scripts
+  that self-shard).
+
+## [0.3.1] - 2026-09-22
+
+### Fixed
+- `super credits buy` no longer turns auto-refill on by default. It used to
+  consent on behalf of anyone who had never consented before, so buying less
+  than the auto-refill threshold enrolled the account and then charged the
+  saved card for the full top-up seconds later — `buy 10` against the default
+  $25 threshold cost $110. Consent is now opt-in via `--autorefill`, and
+  `--autorefill` also turns the setting back on for an account that had it
+  off, which consent alone cannot do. `--no-autorefill` is still accepted and
+  is now the default; passing both is an error.
+- Before a purchase that will trigger a top-up, the CLI now says so and names
+  the amount. What triggers one is the balance a purchase *leaves behind*,
+  not its size, and the refill is sized to clear the threshold — so $10
+  against a $200 threshold charges the card a further $195, not the $50 the
+  setting says. Both numbers are worked out and printed before anything is
+  charged, including under `--yes`, and including for an account that was
+  already armed.
+- `super credits` no longer claims auto-refill "turns on with your first
+  purchase". It turns on with a purchase made with `--autorefill`, and the
+  status line now says so and names that command.
+- `super credits buy` no longer sends buyers to a dead address after paying.
+  The return URL was built from a domain baked in at release time, which
+  outlived its DNS record: the charge succeeded and the browser landed on a
+  404. The CLI now names no return address and the dispatcher supplies one
+  from its own allowlist, which redeploys with the web app instead of going
+  stale in a published wheel. Setting `SUPERCOMPUTER_WEB_URL` returns you to
+  `/dashboard`, the page that reads the result, rather than to
+  `/dashboard/billing`, which ignores it.
+
+### Changed
+- `resolve_web_url()` returns `None` when no web URL is configured, and
+  `DEFAULT_WEB_URL` is gone. `Client.start_credit_checkout()` takes
+  `success_url` and `cancel_url` as optional and omits them from the request
+  when unset. Set `SUPERCOMPUTER_WEB_URL` only to override where a buyer is returned
+  to. **Needs a dispatcher carrying the matching server change**; against an
+  older one, set `SUPERCOMPUTER_WEB_URL` or buy from the dashboard.
+
+### Added
+- `supercomputer.billing_types.predicted_topup_micros()` — what auto-refill would
+  charge once a given purchase has posted. Mirrors the dispatcher's own
+  `topUpAmount` and daily-cap clamp so a confirmation can name the second
+  charge before the card is saved.
+
+## [0.3.0] - 2026-09-16
+
+### Fixed
+- `exec` no longer returns empty output for a command whose last write lands
+  at process exit. The host mirrors a process's durable log on a background
+  goroutine, so a read issued the instant the process reports "exited" can
+  beat that write and come back empty; the client was answering with that
+  empty read even though it had already drained the output off the live
+  stream. It now keeps whichever of the two saw more bytes. The symptom was
+  `stdout: ""` alongside `returncode: 0` — most often for a block-buffered
+  program, which flushes everything during interpreter teardown
+  microseconds before it dies. A training run's final `print(metrics)` is
+  exactly that shape.
+
+### Added
+- `super map --no-bake` opts a sweep out of canary auto-bake. By default,
+  packages the canary pip-installs are baked into the sweep's image before
+  the fan-out; the canary pass line now names them and points at
+  `image.pip` in `supercomputer.json` as the permanent home.
+- `super credits`: the prepaid wallet from the terminal. `super credits`
+  shows the posted balance, what is available after unbilled usage,
+  auto-refill state and the saved card; `super credits buy <usd>` opens a
+  hosted checkout and waits for the purchase to post; `super credits
+  autorefill on|off|set` changes the top-up rule (turning it off warns that
+  work stops at $0 and needs a confirmation); `super credits statement`
+  lists ledger rows with a running balance.
+- `InsufficientCreditError` (HTTP 402, `code: insufficient_credit`) — raised
+  when the prepaid balance is exhausted, and mapped to **exit code 4** in
+  the CLI with the top-up command named. It is a sibling of `SupercomputerError`,
+  not of `PaymentOverdueError`: nothing is owed, so the remedy is to add
+  credit, not to settle a bill. Code that catches `PaymentOverdueError`
+  alone will not catch it.
+- `Client.credit_balance()`, `credit_ledger()`, `set_autorefill()` and
+  `start_credit_checkout()`, with typed payloads in `supercomputer.billing_types`.
+- A low-balance warning before `exec`/`run`/`shell`/`create`/`job run`/`map`
+  provision anything, shown once per process and only when nothing will top
+  the account up. Best-effort: a failed billing read never blocks a run.
+
+### Changed
+- An out-of-credit refusal is no longer reported as a missed payment. Both
+  error paths now branch on the dispatcher's `code` before falling back on
+  the bare 402 status, so `payment_overdue`, `insufficient_credit` and an
+  older dispatcher's codeless 402 are told apart.
+- A session closed for want of credit says so ("stopped: out of credits")
+  and exits 4, instead of exiting 75 as if it were briefly unreachable.
+- `super sweep` offers the fast lane only for waits more capacity can fix.
+  Tasks blocked on billing get a top-up hint — boosting past that block
+  buys nothing.
+- Python 3.9 is now supported (`requires-python >= 3.9`), and 3.14 is
+  tested. The README has a support grid; CI runs the suite on 3.9 through
+  3.14. The installer script falls back to `uv` instead of `pipx`/`pip`
+  when the system Python is older than 3.9.
+- The CLI no longer prints urllib3's LibreSSL warning on macOS's bundled
+  Python.
+
+## [0.2.1] - 2026-09-14
+
+### Added
+- `super login`: sign in through the browser (device authorization). Shows a
+  short code, opens the approval page, and saves a key minted for this
+  machine (named `cli:<hostname>`); then installs the supercomputer skill for the
+  coding agents present on the machine (`--agents auto`, the default; also
+  `all`, a list, or `none`). `--no-browser` prints the URL and code instead
+  of opening a browser. A fresh install's first command starts the same
+  login, and `super setup` with no key delegates to it.
+- Spend visibility: `super sessions` shows `$/HR` (the rate billed on the
+  session's open usage interval while a host is held, 0 when cold), `SPENT`
+  (compute charged so far) and `AGE` (time on its current host) per row plus
+  a "Spending now" footer; `--json` rows carry `usd_per_hour`, `spent_usd`
+  and `host_age_seconds` (SDK: `Client.session_cost`). New `super usage [--since DUR|TS] [--until TS]`
+  reports what the account was charged over a window (default 30 days) by
+  resource and session (SDK: `Client.billing_usage`).
+
+### Changed
+- `super job ls` shows each job's COMMAND and EXIT code (from its process
+  index; `--json` rows carry `command` and `exit_code`), so rows are
+  tellable apart and failures visible without opening each job.
+
+### Fixed
+- `super logs <sid> <pid>` with a pid the dispatcher has no record of now
+  exits 1 (`process_not_found`) like `wait` and `kill`, instead of printing
+  an empty stream with exit 0 (and `status: ""` in `--json`) that a poller
+  read as a finished, silent process. A just-spawned pid gets a few seconds
+  to reach the durable index before it is called unknown.
+- `super wait` with a `--timeout` shorter than the unknown-pid grace window
+  exits 1 for an unknown pid, not 75 (retry), so scripted callers stop
+  retrying a typo forever.
+- Cold starts of `run`/`exec`/`job run` no longer dump every host status
+  frame (`⟵ session_status: building (phase_change) setup_timing ...`);
+  the fresh-allocation and reconnect paths now use the same quiet printer
+  as warm attaches.
+- `super sweep harvest` no longer pulls the session's virtual `_logs/`
+  directory (`_logs/processes.json`) for a results glob like `*.json`; name
+  `_logs/` in the glob to fetch logs.
+- `super sessions` sizes the HOST and SKU columns to the data (long host ids
+  overflowed the fixed width on every row).
+- `super volume list` shows each volume's last update time.
+- SKILL.md documents `super sessions --limit N`.
+
+## [0.2.0] - 2026-09-08
+
+### Added
+- Per-session checkpoint/restore opt-out: `--no-checkpoint` on
+  `create`/`exec`/`run`/`shell` (SDK: `checkpoint=False` on
+  `Project.session`/`cold_session`, `Client.create_session`/
+  `create_cold_session`). A preempted opt-out session is rebuilt cold on any
+  available host (`/workspace` kept, running processes lost) instead of being
+  checkpointed and restored pinned to the region its checkpoint lives in.
+  Defaults resolve `--checkpoint`/`--no-checkpoint` → `SUPERCOMPUTER_CHECKPOINT` →
+  `supercomputer.json` `"checkpoint"` → the new `super config set checkpoint on|off`
+  user default (`~/.supercomputer/config.json`) → server default (on).
+  `SessionInfo.checkpoint` and `super sessions --json` expose the policy; the
+  create fails loudly against a dispatcher too old to honour the opt-out.
+- `--no-resume` on `exec`/`run`/`shell`: refuse to wake a cold (stopped)
+  session instead of transparently re-provisioning its hardware. The refusal
+  exits 1 with a typed `session_cold` error naming the session and the SKU a
+  resume would have provisioned. SDK: `Client.attach_session(...,
+  resume=False)` raises the new `supercomputer.SessionColdError`.
+- Pipelines: `super map --after SWEEP[,SWEEP]` (SDK: `client.map(...,
+  after=handle_or_name, after_strict=…)`) holds a sweep in the new
+  `waiting` state until the named sweeps finish, then launches it — the
+  barrier is durable server-side, so a generate → train → eval chain
+  submits up front and the client can disconnect. An upstream failure
+  fails the downstream sweep (`upstream_failed:<name>`; re-arm with
+  `super sweep retry <name> --all`); a partially-succeeded upstream
+  counts as finished unless `--after-strict`.
+- `--volume NAME[:MOUNT][:ro]` (also supercomputer.json `"read_only": true` or
+  the `name:/mount:ro` string form) attaches a volume read-only: the
+  session sees it, but its writes are discarded at close (no commit).
+- `super autoresearch init`: scaffolds a karpathy/autoresearch-style keep/discard
+  research loop (agent setup guide + `program.md` template) that runs experiments
+  on a persistent supercomputer session.
+  The loop uploads `results.tsv` to the session each experiment; the dashboard's
+  session page then shows an Autoresearch tab (metric chart + results table).
+- Skip-the-line boost: `super sweep boost <name>` / pressing `s` in
+  `super sweep status --watch` (offered while blocked on capacity) moves a
+  sweep to the fast claim lane; queued tasks re-lane immediately
+  (`SweepHandle.boost()` in the SDK). Freed machines alternate fast/free.
+- `super sweep status` explains WHY a sweep is waiting: a `why:` line under
+  `blocked on capacity` names the line (`3 session(s) ahead in the gpu_1x_l4
+  queue (1 fast-lane)`) and/or the platform (`a new machine is being
+  provisioned`, `no capacity ... (stockout)`, `cloud quota exhausted`, ...),
+  from the new `blocked.sku/queued_reason/queued_ahead/fast_ahead` status
+  fields; a `state: waiting` (pipeline) sweep names the upstream sweeps it
+  holds for. Older dispatchers omit the fields and status reads as before.
+- Async sweep scheduling: `super map --not-before WHEN` (park until), `--by WHEN`
+  (deadline; opportunistic idle-fill until `deadline - --runtime - pad`, then
+  normal launch) and `--runtime DUR` (per-task estimate, default 1h).
+  `super sweep status` shows the window phase; a missed deadline marks the
+  sweep `deadline_missed` (webhook `job.deadline_missed`) but never cancels it.
+- First-run login prompt: with no API key configured, the CLI offers to open
+  the dashboard login and store the key instead of failing with a bare error.
+- CLI errors carry typed error codes and the request id; the client never
+  provisions hardware for a request the server would reject.
+
+### Changed
+- Resuming a cold session now always prints one stderr line (`session <sid>
+  is cold — resuming (provisions <sku>); pass --no-resume to refuse`), even
+  when stderr is not a TTY or `SUPERCOMPUTER_QUIET` is set — waking billed hardware
+  is a spend event, and non-TTY runs used to do it silently.
+- Failed map task attempts now retry with a growing delay (45s × attempt,
+  capped at 10m) instead of relaunching immediately; preemption requeues
+  remain immediate and still don't consume the retry budget.
+
+### Fixed
+- `super map --volume name:/path` sent the custom mount path under a key
+  the server ignores, silently mounting the volume at its default path.
+  Custom mount paths now apply to sweep task sessions.
+
+## [0.1.3] - 2026-08-27
+
+### Changed
+- `super setup` installs the agent skill for all agents by default (Enter or
+  non-interactive stdin = `all`); `--agents none` opts out.
+
+## [0.1.2] - 2026-08-27
+
+### Changed
+- README wording.
+
+## [0.1.1] - 2026-08-27
+
+### Changed
+- README: sign up on the website and paste your API key; the editable
+  checkout install instructions are gone.
+
+## [0.1.0] - 2026-08-27
+
+### Changed
+- Renamed: the package is `supercomputer`, the import is `supercomputer`, the CLI is
+  `supercomputer`, env vars are `SUPERCOMPUTER_*`, config lives in `~/.supercomputer`, project
+  files are `supercomputer.json`, new keys are `super_sk_…`, and the client sends
+  `X-Supercomputer-Client*` headers. Everything old keeps working: `import supercomputer`,
+  the `super` command, `SUPERCOMPUTER_*`, `~/.supercomputer`, `supercomputer.json`, `super_sk_` keys and
+  `supercomputer.SupercomputerError`. Map tasks now receive `SUPERCOMPUTER_TASK_ID` /
+  `SUPERCOMPUTER_WORLD_SIZE` / `SUPERCOMPUTER_JOB` (the `SUPERCOMPUTER_*` names are gone).
+
+### Added
+- `super sweep harvest <name> <remote-glob> <local-dir>` — download every
+  task's matching outputs in one command. Sessions are resolved from the
+  sweep and local paths are task-keyed (`<local-dir>/task-<index>/<path>`,
+  or `--flat`), replacing the per-sweep script that parsed status JSON for
+  session ids and ran N `super download` calls. `--all-states` includes
+  failed and canceled tasks.
+- `super sweep status --watch [--interval S]` — the human live view,
+  repainted in place until the sweep is terminal. Appends instead of
+  repainting when stdout is not a terminal.
+- `super stop --wait [--timeout SECONDS]` — block until the workspace
+  manifest is durable, instead of polling `super sessions` for `state=cold`.
+  `super map --from <sid>` needs that manifest; the default timeout is 300s
+  and the command exits 1 if the wait expires (the stop itself stands).
+- The `super sweep status --json` document is now a documented, versioned
+  contract (`schema_version: 1`) — see `docs/sweep-status-schema.md`.
+  Additive changes keep the version; a removal or rename bumps it.
+- Every request now carries `X-Supercomputer-Client` / `X-Supercomputer-Client-Version`, and a
+  client below the deployment's supported floor is rejected with HTTP 426 and
+  the new `supercomputer.ClientTooOldError`, which names the upgrade command. This
+  replaces the previous failure mode for a stale client, a signature-mismatch
+  error on every >5 MiB upload that read as a credential problem.
+
+### Changed
+- `super upload` now names the files that take the pre-signed cloud-storage
+  path (>5 MiB) rather than only the total, and names them again in the error
+  when that path fails — so a broken large-file upload is attributable to a
+  file, not to the command. `Session.upload()` returns them as `s3_files`
+  alongside `inline_files` and `s3_threshold_bytes`.
+
+## [0.1.0] — first public release
+
+### Added
+- `super` CLI: sessions, exec/run/shell/ssh/tunnel, background processes
+  (spawn/wait/logs/kill), file transfer (upload/download/ls/mount), volumes,
+  run-to-completion jobs, and `super map` sweeps.
+- Python SDK: `Client`, `Project`, `Session`, `Job`, `SweepHandle`, `Image`.
+- `super setup` installs the agent skill (`SKILL.md`) for Cursor, Claude Code
+  and Codex.
+- `super --version` and `supercomputer.__version__`.
+- Directory uploads skip hidden entries, dependency/cache directories and
+  symlinked files by default; `--include-hidden` / `--follow-symlinks` (CLI)
+  and `include_hidden=` / `follow_symlinks=` (SDK) opt back in.
+- `SUPERCOMPUTER_TELEMETRY=0` disables the best-effort CLI crash report.
+
+### Removed
+Relative to the pre-release internal SDK (nothing here was ever on PyPI):
+- Public names `MigrationInfo`, `MigrationStatus`, `SyncProgress`, the
+  `SupercomputerError` and `JobHandle` aliases (`SupercomputerError` / `SweepHandle` remain),
+  and the `Session.migrate()` / `Client.watch()` / `Client.list_session_files()`
+  / `Client.download_file()` helpers — the operator-initiated migration
+  surface is not part of the public client.
+- `Image.add_local_file()`, `Image.add_local_dir()`, `Image.copy()`,
+  `Image.workdir()` — use `Session.upload()` / `super upload` for local files
+  and the `workdir=` argument on exec.
+- Legacy `~/.supercomputer/token`, `~/.supercomputer/url` and `supercomputer.json` lookups
+  (`~/.supercomputer/*` and `supercomputer.json` are the supported forms). `SUPERCOMPUTER_API_KEY` /
+  `SUPERCOMPUTER_URL` are still accepted as aliases of `SUPERCOMPUTER_API_KEY` / `SUPERCOMPUTER_URL`.
+- Internal modules `supercomputer.upload`, `supercomputer.stream`, `supercomputer.jobs`, `supercomputer.client_ext`
+  and the `s3_uploader` / `websockets_transport` providers, with the
+  `websockets` dependency they pulled in.
+- `DirectClient.run_streaming()` (no callers). `DirectClient.execute()` is
+  kept — internal harnesses use it.
+
+### Security
+- Only `SUPERCOMPUTER_*` keys from a project `.env` are imported into the process
+  environment; other keys stay reachable by name via `--secret KEY`.
+- A plaintext (`ws://`) host address is refused when the API was reached over
+  `https://`; a plaintext API URL to a non-local host warns.
+- `super ssh` quotes its ProxyCommand and validates the session id before using
+  it in filesystem paths.

gpu_compute_provider-0.4.2/CONTRIBUTING.md

@@ -0,0 +1,37 @@
+# Contributing
+
+Thanks for your interest in `supercomputer`.
+
+## Development setup
+
+```bash
+cd packages/supercomputer
+python3 -m venv .venv && source .venv/bin/activate
+pip install -e ".[dev]"
+```
+
+## Before you open a pull request
+
+```bash
+ruff check src tests      # lint (rule set in pyproject.toml)
+mypy                      # type-check src/supercomputer (config in pyproject.toml)
+pytest                    # ~640 hermetic tests, no network or credentials needed
+```
+
+- Keep changes focused; one topic per PR.
+- New behaviour comes with a test — the tests are the spec.
+- Comments explain *why*, not *what*. Please don't reference internal ticket
+  numbers, incidents or environments in code comments.
+- Public functions and classes have docstrings.
+- Line length is 100.
+
+## Reporting bugs
+
+Open a GitHub issue with the `super --version` output, the command or code you
+ran, and what you expected. For anything security-related, see
+[SECURITY.md](SECURITY.md) instead.
+
+## License
+
+By contributing you agree that your contributions are licensed under the
+Apache License 2.0 (see [LICENSE](LICENSE)).