gpu-stack-inspector 0.1.0__py3-none-any.whl

gpu_stack_inspector/orchestrator.py

@@ -0,0 +1,132 @@
+"""Runs the collectors and assembles the snapshot; no diagnosis happens here."""
+
+from __future__ import annotations
+
+import os
+import shutil
+import string
+from collections.abc import Callable, Mapping, Sequence
+from dataclasses import replace
+from pathlib import Path
+
+from gpu_stack_inspector import __version__
+from gpu_stack_inspector.collectors.environment import collect_cuda_environment
+from gpu_stack_inspector.collectors.host import collect_host
+from gpu_stack_inspector.collectors.nvidia import collect_nvidia
+from gpu_stack_inspector.collectors.toolkit import DEFAULT_ROOTS, collect_toolkits
+from gpu_stack_inspector.models import (
+    HostFacts,
+    InterpreterFacts,
+    ProbeFailure,
+    Snapshot,
+    utc_timestamp,
+)
+from gpu_stack_inspector.probes.metadata_probe import probe_interpreter
+from gpu_stack_inspector.probes.runtime_probe import run_runtime_probe
+from gpu_stack_inspector.rules.catalog import builtin_rules
+from gpu_stack_inspector.rules.comparison import compare_interpreters
+from gpu_stack_inspector.rules.engine import RuleContext, evaluate
+from gpu_stack_inspector.runner import CommandRunner
+
+
+def inspect_host(
+    runner: CommandRunner,
+    *,
+    which: Callable[[str], str | None] = shutil.which,
+    environ: Mapping[str, str] = os.environ,
+    toolkit_roots: Sequence[Path] = DEFAULT_ROOTS,
+    host: Callable[[], HostFacts] = collect_host,
+) -> Snapshot:
+    """Collect the facts about this machine (not yet about any interpreter)."""
+    nvidia = collect_nvidia(runner, which=which)
+    toolkit = collect_toolkits(runner, which=which, roots=toolkit_roots, environ=environ)
+    return Snapshot(
+        tool_version=__version__,
+        created_at=utc_timestamp(),
+        host=host(),
+        nvidia=nvidia,
+        toolkit=toolkit,
+        cuda_environment=collect_cuda_environment(environ),
+        probe_failures=(*nvidia.failures, *toolkit.failures),
+    )
+
+
+def inspect(
+    runner: CommandRunner,
+    pythons: Sequence[str],
+    *,
+    cwd: Path | None = None,
+    which: Callable[[str], str | None] = shutil.which,
+    environ: Mapping[str, str] = os.environ,
+    toolkit_roots: Sequence[Path] = DEFAULT_ROOTS,
+    host: Callable[[], HostFacts] = collect_host,
+    runtime: bool = False,
+) -> Snapshot:
+    """Inspect the machine and each named interpreter, labelled A, B, C… in order.
+
+    Interpreter failures are added to the snapshot's list tagged with their label, so a
+    report can say which environment could not be checked. With ``runtime`` (the user's
+    explicit consent), torch is also imported and CUDA used once in every interpreter
+    that started and has torch installed.
+    """
+    snapshot = inspect_host(
+        runner, which=which, environ=environ, toolkit_roots=toolkit_roots, host=host
+    )
+    interpreters = tuple(
+        probe_interpreter(runner, interpreter_label(index), raw, cwd=cwd)
+        for index, raw in enumerate(pythons)
+    )
+    if runtime:
+        interpreters = tuple(
+            replace(i, runtime=run_runtime_probe(runner, i.path))
+            if i.version is not None and i.torch is not None
+            else i
+            for i in interpreters
+        )
+    return replace(
+        snapshot,
+        interpreters=interpreters,
+        probe_failures=(*snapshot.probe_failures, *_tagged_failures(interpreters)),
+    )
+
+
+def interpreter_label(index: int) -> str:
+    """A, B, … Z, then #27, #28 …"""
+    return string.ascii_uppercase[index] if index < 26 else f"#{index + 1}"
+
+
+def _tagged_failures(interpreters: Sequence[InterpreterFacts]) -> list[ProbeFailure]:
+    failures = [
+        replace(failure, probe=f"{failure.probe} {facts.label}")
+        for facts in interpreters
+        for failure in facts.failures
+    ]
+    failures += [
+        replace(facts.runtime.failure, probe=f"{facts.runtime.failure.probe} {facts.label}")
+        for facts in interpreters
+        if facts.runtime is not None and facts.runtime.failure is not None
+    ]
+    return failures
+
+
+def default_interpreters(which: Callable[[str], str | None] = shutil.which) -> list[str]:
+    """The interpreter the user's shell would run: ``python``, else ``python3``, on PATH.
+
+    Not the tool's own interpreter: installed with pipx or ``uv tool`` it lives in an
+    isolated environment that tells the user nothing about their projects.
+    """
+    for name in ("python", "python3"):
+        found = which(name)
+        if found:
+            return [found]
+    return []
+
+
+def diagnose(snapshot: Snapshot, context: RuleContext | None = None) -> Snapshot:
+    """The snapshot with the findings of every built-in rule attached."""
+    return replace(snapshot, findings=evaluate(snapshot, builtin_rules(), context))
+
+
+def with_comparison(snapshot: Snapshot) -> Snapshot:
+    """The snapshot with its interpreters compared field by field."""
+    return replace(snapshot, comparison=compare_interpreters(snapshot.interpreters))

gpu_stack_inspector/privacy.py

@@ -0,0 +1,237 @@
+"""Making collected text safe to print and to share.
+
+Everything that leaves the tool (terminal, JSON, Markdown) is built from redacted data:
+redaction runs on the snapshot *before* any renderer sees it.
+"""
+
+from __future__ import annotations
+
+import getpass
+import re
+import socket
+from collections import Counter
+from collections.abc import Callable
+from dataclasses import dataclass, fields, is_dataclass, replace
+from enum import Enum
+from pathlib import Path
+from typing import TYPE_CHECKING, Any, TypeVar, cast
+
+if TYPE_CHECKING:
+    from gpu_stack_inspector.models import Snapshot
+
+T = TypeVar("T")
+
+_ESCAPE_SEQUENCE = re.compile(
+    r"\x1b\[[0-?]*[ -/]*[@-~]"  # CSI: colours, cursor movement, screen clearing
+    r"|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)?"  # OSC: window titles, hyperlinks
+    r"|\x1b[@-_]"  # other two-byte escapes
+)
+_CONTROL = re.compile(r"[\x00-\x08\x0b-\x1f\x7f-\x9f]")
+
+
+def strip_control(text: str) -> str:
+    """Remove terminal escape sequences and control characters, keeping tabs and newlines.
+
+    Collected output can come from a broken or hostile environment; without this a
+    crafted package name could rewrite the user's terminal when a report is shown.
+    """
+    return _CONTROL.sub("", _ESCAPE_SEQUENCE.sub("", text))
+
+
+@dataclass(frozen=True, slots=True)
+class RedactionContext:
+    """The identifying values of the machine the report is made on."""
+
+    home: str | None = None
+    user: str | None = None
+    hostname: str | None = None
+
+    @classmethod
+    def current(cls) -> RedactionContext:
+        """Read the values for the current user; missing ones stay ``None``."""
+        return cls(
+            home=_safe(lambda: str(Path.home())),
+            user=_safe(getpass.getuser),
+            hostname=_safe(socket.gethostname),
+        )
+
+
+def _safe(read: Callable[[], str]) -> str | None:
+    try:
+        value = read()
+    except (OSError, KeyError, RuntimeError):
+        return None
+    return value or None
+
+
+Replacement = str | Callable[[re.Match[str]], str]
+
+_REDACTED = "<redacted>"
+_REDACTED_TOKEN = "<redacted-token>"  # noqa: S105 - the placeholder, not a token
+
+_URL_CREDENTIALS = re.compile(r"\b([a-zA-Z][a-zA-Z0-9+.-]*://)([^/\s?#]*)@")
+"""``scheme://user:password@`` — greedy up to the last ``@`` of the authority."""
+
+_NAME_AND_SEPARATOR = re.compile(r"""(?<![\w-])([A-Za-z_][A-Za-z0-9_]*)(["']?\s*[=:]\s*)""")
+_VALUE = re.compile(r"""("[^"]*"|'[^']*'|[^\s,;}]+)""")
+"""``NAME=value``, ``name: value``, ``"name": "value"``; the name decides if it is secret."""
+
+_SECRET_SUFFIXES = ("token", "secret", "password", "passwd", "apikey", "credential", "credentials")
+_SECRET_PARTS = frozenset({"key", "auth", "pass", "pat"})
+
+_TOKENS = re.compile(
+    r"(?<![A-Za-z0-9_-])(?:"
+    r"gh[pousr]_[A-Za-z0-9]{36,}"  # GitHub
+    r"|github_pat_[A-Za-z0-9_]{22,}"
+    r"|hf_[A-Za-z0-9]{30,}"  # Hugging Face
+    r"|sk-[A-Za-z0-9_-]{20,}"  # OpenAI, Anthropic
+    r"|(?:AKIA|ASIA)[0-9A-Z]{16}"  # AWS access key id
+    r"|xox[abprs]-[A-Za-z0-9-]{10,}"  # Slack
+    r"|eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}"  # JWT
+    r")(?![A-Za-z0-9_-])"
+)
+_BEARER = re.compile(r"(?i)\b(bearer\s+)[A-Za-z0-9._~+/=-]{8,}")
+
+
+def _is_secret_name(name: str) -> bool:
+    """``HF_TOKEN``, ``accessToken``, ``DB_PASSWORD``, ``OPENAI_API_KEY``: yes.
+    ``tokenizers``, ``CUDA_HOME``, ``author``, ``KEYBOARD``: no."""
+    parts = [part for part in name.lower().split("_") if part]
+    return any(part in _SECRET_PARTS or part.endswith(_SECRET_SUFFIXES) for part in parts)
+
+
+_MIN_NAME_LENGTH = 3
+_GENERIC_NAMES = frozenset(
+    {
+        "root", "user", "admin", "guest", "localhost", "linux", "ubuntu", "debian",
+        "fedora", "arch", "archlinux", "manjaro", "pop-os", "mint", "kali", "raspberrypi",
+    }
+)  # fmt: skip
+"""Names that identify nobody and appear in ordinary text (distribution names as hosts)."""
+
+
+def _word_pattern(name: str) -> re.Pattern[str] | None:
+    if len(name) < _MIN_NAME_LENGTH or name.lower() in _GENERIC_NAMES:
+        return None
+    # Whole words only: not inside "malice" or "alice_env", not an already redacted
+    # "<user>", but a sentence-ending period is fine.
+    return re.compile(rf"(?<![\w.<>-]){re.escape(name)}(?![\w<>-]|\.\w)")
+
+
+# Other accounts' home directories. The name may not start with "<", so already redacted
+# paths are left alone.
+_OTHER_HOMES: tuple[tuple[re.Pattern[str], str], ...] = (
+    (re.compile(r"(/home/)[^/\s:'\"<>]+"), r"\1<user>"),
+    (re.compile(r"(/Users/)[^/\s:'\"<>]+"), r"\1<user>"),
+    (re.compile(r"([A-Za-z]:\\Users\\)[^\\\s:'\"<>]+"), r"\1<user>"),
+)
+
+
+class Redactor:
+    """Removes identifying and secret values from text and from whole snapshots.
+
+    One redactor is used per report; :attr:`summary` then tells how many values of each
+    kind were removed, which the report shows so the user knows redaction happened.
+    """
+
+    def __init__(self, context: RedactionContext) -> None:
+        self._counts: Counter[str] = Counter()
+        self._steps: list[tuple[str, re.Pattern[str], Replacement]] = []
+        home = context.home.rstrip("/\\") if context.home else ""
+        if len(home) > 1:  # a home of "/" would redact every absolute path
+            boundary = r"(?=[/\\]|$|[^\w.-])"
+            self._steps.append(("home_path", re.compile(re.escape(home) + boundary), "~"))
+        for pattern, replacement in _OTHER_HOMES:
+            self._steps.append(("home_path", pattern, replacement))
+        # Host before user: "alice-laptop" is a host name even when the user is "alice".
+        for category, name, placeholder in (
+            ("host_name", context.hostname, "<host>"),
+            ("user_name", context.user, "<user>"),
+        ):
+            word = _word_pattern(name) if name else None
+            if word is not None:
+                self._steps.append((category, word, placeholder))
+
+    def text(self, value: str) -> str:
+        """Return ``value`` without control characters, identifying or secret values."""
+        result = strip_control(value)
+        result = _URL_CREDENTIALS.sub(self._url_credentials, result)
+        result = self._secret_assignments(result)
+        for token_pattern, placeholder in (
+            (_TOKENS, _REDACTED_TOKEN),
+            (_BEARER, r"\1" + _REDACTED_TOKEN),
+        ):
+            result, count = token_pattern.subn(placeholder, result)
+            self._counts["token"] += count
+        for category, pattern, replacement in self._steps:
+            result, count = pattern.subn(replacement, result)
+            self._counts[category] += count
+        return result
+
+    def redact(self, obj: T) -> T:
+        """Return a redacted copy of ``obj``.
+
+        Strings are redacted; dataclasses (frozen ones too), tuples, lists and dicts are
+        copied with their contents redacted; enums, numbers, booleans and ``None`` are
+        returned unchanged. The original object is never modified.
+        """
+        return cast(T, self._redact(obj))
+
+    @property
+    def summary(self) -> dict[str, int]:
+        """How many values of each kind this redactor has removed so far."""
+        return {category: count for category, count in self._counts.items() if count}
+
+    def _redact(self, obj: Any) -> Any:
+        if isinstance(obj, Enum):  # StrEnum members are str; keep them as they are
+            return obj
+        if isinstance(obj, str):
+            return self.text(obj)
+        if is_dataclass(obj) and not isinstance(obj, type):
+            changes = {f.name: self._redact(getattr(obj, f.name)) for f in fields(obj) if f.init}
+            return replace(obj, **changes)
+        if isinstance(obj, tuple):
+            return tuple(self._redact(item) for item in obj)
+        if isinstance(obj, list):
+            return [self._redact(item) for item in obj]
+        if isinstance(obj, dict):
+            return {self._redact(key): self._redact(item) for key, item in obj.items()}
+        return obj
+
+    def _url_credentials(self, match: re.Match[str]) -> str:
+        scheme, credentials = match.group(1), match.group(2)
+        if credentials == _REDACTED:
+            return match.group(0)
+        self._counts["url_credentials"] += 1
+        return f"{scheme}{_REDACTED}@"
+
+    def _secret_assignments(self, text: str) -> str:
+        # Scanned by hand rather than with re.sub: the value of a harmless name must not be
+        # consumed, or "env: DB_PASSWORD=hunter2" would hide the password inside the value
+        # of "env". After a harmless name the scan resumes right after its separator.
+        parts: list[str] = []
+        pos = 0
+        while match := _NAME_AND_SEPARATOR.search(text, pos):
+            parts.append(text[pos : match.end()])
+            pos = match.end()
+            value = _VALUE.match(text, pos)
+            if (
+                value is not None
+                and _is_secret_name(match.group(1))
+                and not value.group(0).startswith("<redacted")
+            ):
+                parts.append(_REDACTED)
+                pos = value.end()
+                self._counts["secret_value"] += 1
+        parts.append(text[pos:])
+        return "".join(parts)
+
+
+def redact_snapshot(snapshot: Snapshot, context: RedactionContext | None = None) -> Snapshot:
+    """The snapshot redacted for output, with a record of what was removed."""
+    from gpu_stack_inspector.models import RedactionCount
+
+    redactor = Redactor(context or RedactionContext.current())
+    redacted = redactor.redact(snapshot)
+    counts = tuple(RedactionCount(kind, n) for kind, n in sorted(redactor.summary.items()))
+    return replace(redacted, redactions=counts)

gpu_stack_inspector/probes/__init__.py

@@ -0,0 +1 @@
+"""Programs that run inside a target interpreter, and the code that runs them."""

gpu_stack_inspector/probes/metadata_probe.py

@@ -0,0 +1,230 @@
+"""Running the metadata probe inside a target interpreter and reading its answer."""
+
+from __future__ import annotations
+
+import functools
+import json
+import re
+import tempfile
+from importlib.resources import files
+from pathlib import Path
+from typing import Any
+
+from gpu_stack_inspector.collectors.python_env import PROBE, interpreter_path
+from gpu_stack_inspector.models import (
+    Distribution,
+    FailureKind,
+    InterpreterFacts,
+    ProbeFailure,
+    TorchFacts,
+)
+from gpu_stack_inspector.runner import CommandResult, CommandRunner, Outcome, probe_failure
+
+PROTOCOL = 1
+BEGIN, END = "GSI-PROBE-BEGIN", "GSI-PROBE-END"
+TIMEOUT = 8.0
+"""Starting an interpreter and reading its metadata takes about a second, even in large
+environments; a hung startup (a broken .pth file, a network mount) must not hang us."""
+
+_EXCEPTION_LINE = re.compile(r"[A-Za-z_][\w.]*(?:Error|Exception|Exit|Interrupt)\b.*")
+_DETAIL_LIMIT = 300
+
+_STRING_FIELDS = ("version", "implementation", "executable", "prefix", "base_prefix", "platform")
+_BOOL_FIELDS = ("conda", "user_site", "pythonpath_set")
+
+
+@functools.cache
+def program_source() -> str:
+    """The probe program, passed to the target as ``python -c``."""
+    resource = files("gpu_stack_inspector.probes").joinpath("metadata_program.py")
+    return resource.read_text(encoding="utf-8")
+
+
+def probe_interpreter(
+    runner: CommandRunner,
+    label: str,
+    raw_path: str,
+    *,
+    cwd: Path | None = None,
+    timeout: float = TIMEOUT,
+) -> InterpreterFacts:
+    """Run the metadata probe in the interpreter named by ``raw_path``.
+
+    The target's environment is passed on unchanged: its variables are part of what is
+    being diagnosed. Only the working directory is replaced, see below.
+    """
+    path, failure = interpreter_path(raw_path, cwd=cwd)
+    if path is None:
+        return InterpreterFacts(label, raw_path, failures=(failure,) if failure else ())
+    argv = [str(path), "-c", program_source()]
+    # With -c, Python puts the working directory first on sys.path. Running in a new
+    # empty directory means a module planted where the user runs the tool (a json.py,
+    # say) is never imported by the probe.
+    with tempfile.TemporaryDirectory(prefix="gsi-probe-") as empty:
+        result = runner.run(argv, timeout=timeout, cwd=Path(empty))
+    if result.outcome is Outcome.NONZERO:
+        return InterpreterFacts(label, str(path), failures=(_crash(path, result),))
+    failure = probe_failure(PROBE, result)
+    if failure is not None:
+        return InterpreterFacts(label, str(path), failures=(failure,))
+    return parse_probe_output(label, str(path), result.stdout, truncated=result.stdout_truncated)
+
+
+def parse_probe_output(
+    label: str, path: str, stdout: str, *, truncated: bool = False
+) -> InterpreterFacts:
+    """Read the JSON document between the markers; anything unexpected becomes unknown."""
+    start = stdout.find(BEGIN)
+    end = stdout.find(END, start + len(BEGIN)) if start != -1 else -1
+    if start == -1 or end == -1:
+        if truncated:
+            return _failed(
+                label, path, "the probe's output exceeded the output limit and was cut off"
+            )
+        return _failed(label, path, "the interpreter printed no probe result")
+    try:
+        document = json.loads(stdout[start + len(BEGIN) : end])
+    except ValueError:
+        return _failed(label, path, "the probe result is not valid JSON")
+    if not isinstance(document, dict):
+        return _failed(label, path, "the probe result is not a JSON object")
+    if document.get("protocol") != PROTOCOL:
+        return _failed(label, path, f"unexpected probe protocol {document.get('protocol')!r}")
+
+    unexpected: list[str] = []
+    values = _python_values(document.get("python"), unexpected)
+    distributions = _distributions(document.get("distributions"), unexpected)
+    torch = _torch(document.get("torch"), unexpected)
+    failures: list[ProbeFailure] = []
+    if unexpected:
+        detail = "unexpected values for: " + ", ".join(dict.fromkeys(unexpected))
+        failures.append(_malformed(detail))
+    errors = document.get("errors")
+    if isinstance(errors, list):
+        failures.extend(
+            ProbeFailure(PROBE, FailureKind.PROBE_ERROR, error)
+            for error in errors
+            if isinstance(error, str)
+        )
+    return InterpreterFacts(
+        label,
+        path,
+        **values,
+        distributions=tuple(distributions),
+        torch=torch,
+        failures=tuple(failures),
+    )
+
+
+def _python_values(section: object, unexpected: list[str]) -> dict[str, Any]:
+    values: dict[str, Any] = dict.fromkeys((*_STRING_FIELDS, *_BOOL_FIELDS))
+    if section is None:
+        return values
+    if not isinstance(section, dict):
+        unexpected.append("python")
+        return values
+    for keys, kind in ((_STRING_FIELDS, str), (_BOOL_FIELDS, bool)):
+        for key in keys:
+            value = section.get(key)
+            if value is None or isinstance(value, kind):
+                values[key] = value
+            else:
+                unexpected.append(key)
+    return values
+
+
+def _distributions(section: object, unexpected: list[str]) -> list[Distribution]:
+    if section is None:
+        return []
+    if not isinstance(section, list):
+        unexpected.append("distributions")
+        return []
+    found = []
+    for entry in section:
+        if (
+            isinstance(entry, dict)
+            and isinstance(entry.get("name"), str)
+            and isinstance(entry.get("version"), str)
+            and isinstance(entry.get("location"), str | None)
+        ):
+            found.append(Distribution(entry["name"], entry["version"], entry.get("location")))
+        else:
+            unexpected.append("distributions")
+    return found
+
+
+def python_error_line(stderr: str) -> str:
+    """The line of a Python crash that names the problem, or "" if there is none.
+
+    The exception at the end of a traceback, else the "Fatal Python error" line, else the
+    first line of stderr.
+    """
+    lines = [line.strip() for line in stderr.splitlines() if line.strip()]
+    reason = next((line for line in reversed(lines) if _EXCEPTION_LINE.fullmatch(line)), None)
+    if reason is None:
+        reason = next((line for line in lines if line.startswith("Fatal Python error")), None)
+    if reason is None:
+        reason = lines[0] if lines else ""
+    return reason
+
+
+def _crash(path: Path, result: CommandResult) -> ProbeFailure:
+    """Explain a crashed interpreter by the line that names the problem.
+
+    A traceback starts with "Traceback (most recent call last):", which says nothing;
+    the exception is on its last line. "Fatal Python error" output (a broken standard
+    library, for instance) names the underlying exception further down.
+    """
+    reason = python_error_line(result.stderr)
+    detail = f"{path} exited with code {result.returncode}"
+    if reason:
+        detail += f": {reason}"
+    if reason.startswith("SyntaxError"):
+        detail += " (the probe needs Python 3.8 or newer)"
+    if len(detail) > _DETAIL_LIMIT:
+        detail = detail[: _DETAIL_LIMIT - 1] + "…"
+    return ProbeFailure(PROBE, FailureKind.NONZERO_EXIT, detail)
+
+
+def _torch(section: object, unexpected: list[str]) -> TorchFacts | None:
+    if section is None:
+        return None
+    if not isinstance(section, dict) or not isinstance(section.get("version"), str):
+        unexpected.append("torch")
+        return None
+
+    def optional(value: object, kind: type, key: str) -> Any:
+        if value is None or isinstance(value, kind):
+            return value
+        unexpected.append(f"torch.{key}")
+        return None
+
+    def strings(value: object, key: str) -> tuple[str, ...] | None:
+        if value is None:
+            return None
+        if isinstance(value, list) and all(isinstance(item, str) for item in value):
+            return tuple(value)
+        unexpected.append(f"torch.{key}")
+        return None
+
+    libraries = optional(section.get("libraries"), dict, "libraries") or {}
+    version_py = optional(section.get("version_py"), dict, "version_py")
+    return TorchFacts(
+        version=section["version"],
+        location=optional(section.get("location"), str, "location"),
+        requires_nvidia=strings(section.get("requires_nvidia"), "requires_nvidia") or (),
+        cuda_library=optional(libraries.get("cuda"), bool, "libraries.cuda"),
+        hip_library=optional(libraries.get("hip"), bool, "libraries.hip"),
+        version_py_found=version_py is not None,
+        built_cuda=optional((version_py or {}).get("cuda"), str, "version_py.cuda"),
+        built_hip=optional((version_py or {}).get("hip"), str, "version_py.hip"),
+        conda_records=strings(section.get("conda_records"), "conda_records"),
+    )
+
+
+def _failed(label: str, path: str, detail: str) -> InterpreterFacts:
+    return InterpreterFacts(label, path, failures=(_malformed(detail),))
+
+
+def _malformed(detail: str) -> ProbeFailure:
+    return ProbeFailure(PROBE, FailureKind.MALFORMED_OUTPUT, detail)