imperal-sdk 6.3.1__tar.gz → 6.3.3__tar.gz

{imperal_sdk-6.3.1 → imperal_sdk-6.3.3}/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to `imperal-sdk` are documented here.
 
+## 6.3.3 — 2026-10-20
+
+### Fixed
+- `apply_batches` sizes each part as it is sent (the blob's text and facts, its chunks' vectors) against
+  `APPLY_BATCH_BYTES` = 4 MB, half the vault's request cap: a first sync of a large repo no longer gets 413.
+
+## 6.3.2 — 2026-10-20
+
+### Security
+- `clean_remote` (new, public): a git remote is cleaned by parsing it — a URL rebuilt from scheme, host,
+  port and path (userinfo split on its last `@`, query and fragment dropped), a `user:secret` dropped from
+  an scp-like remote, `""` for what does not parse. `git_identity` and `sftp_read_meta` use it (6.3.1's
+  regex could leave part of a password behind).
+
 ## 6.3.1 — 2026-10-20
 
 ### Security

{imperal_sdk-6.3.1 → imperal_sdk-6.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: imperal-sdk
-Version: 6.3.1
+Version: 6.3.3
 Summary: SDK for building Imperal Cloud extensions
 Author: Valentin Scerbacov, Imperal, Inc.
 License-Expression: Apache-2.0

{imperal_sdk-6.3.1 → imperal_sdk-6.3.3}/sdk-reference.json

@@ -1,5 +1,5 @@
 {
-  "sdk_version": "6.3.1",
+  "sdk_version": "6.3.3",
   "symbols": {
     "ActionResult": {
       "action_vocab_safe": false,

{imperal_sdk-6.3.1 → imperal_sdk-6.3.3}/sdk_claims.json

@@ -1,5 +1,5 @@
 {
-  "_sdk_version": "6.3.1",
+  "_sdk_version": "6.3.3",
   "constants": {
     "max_call_depth": {
       "counts_root": true,

{imperal_sdk-6.3.1 → imperal_sdk-6.3.3}/src/imperal_sdk/__init__.py

@@ -1,7 +1,7 @@
 """Imperal Cloud SDK — build extensions for the Imperal platform."""
 from typing import TYPE_CHECKING
 
-__version__ = "6.3.1"
+__version__ = "6.3.3"
 
 # 5.2.2 (2026-06-11): the package root resolves its public surface lazily
 # (PEP 562). The eager imports pulled the HTTP transport (Context / client

{imperal_sdk-6.3.1 → imperal_sdk-6.3.3}/src/imperal_sdk/code_index.py

@@ -1351,7 +1351,29 @@ def build_index(root: str, files: list[str]) -> ProjectIndex:
 
 _HEAD_REF = re.compile(r"ref:\s*refs/heads/(\S+)")
 _SHA = re.compile(r"^[0-9a-f]{40}$")
-_USERINFO = re.compile(r"^([a-z][a-z0-9+.-]*://)[^/@]*@", re.I)
+def clean_remote(url) -> str:
+    """A git remote without any credentials: a URL is rebuilt from scheme, host, port and path (the userinfo
+    split on its LAST ``@`` and dropped, query and fragment dropped); an scp-like ``user@host:path`` keeps a
+    plain user and drops a ``user:secret``; a value that does not parse is ``""``. Shared word for word
+    by the vault (``stores/repos.clean_remote``)."""
+    from urllib.parse import urlsplit, urlunsplit
+    u = str(url or "").strip().strip('"').strip("'").strip()
+    if not u or any(c.isspace() for c in u):
+        return ""
+    if "://" in u:
+        try:
+            parts = urlsplit(u)
+            host, port = parts.hostname or "", parts.port
+        except ValueError:
+            return ""
+        if not parts.scheme or (not host and parts.scheme != "file"):
+            return ""
+        netloc = (f"[{host}]" if ":" in host else host) + (f":{port}" if port else "")
+        return urlunsplit((parts.scheme, netloc, parts.path, "", ""))
+    user, at, rest = u.rpartition("@")
+    if at and ":" in user:
+        return rest                 # "user:secret@host:path": the secret never leaves
+    return u
 
 
 def _meta_text(meta: dict, key: str) -> str:
@@ -1390,7 +1412,7 @@ def git_identity(meta: dict) -> dict:
             first = first or url
             if section == '[remote"origin"]':
                 remote = url
-    remote = _USERINFO.sub(r"\1", remote or first)
+    remote = clean_remote(remote or first)
     return {"remote": remote, "branch": branch, "commit": commit}
 
 
@@ -1588,7 +1610,7 @@ def embed_query(text: str) -> bytes:
 # normalised and hashed, only blobs the repo does not hold are extracted (and their chunks embedded),
 # and the apply goes in size-bounded parts -- the last one stitches the links.
 
-APPLY_BATCH_BYTES = 8_000_000
+APPLY_BATCH_BYTES = 4_000_000      # one apply body as sent (JSON) -- half the vault's 8 MiB request cap
 READ_BATCH = 200
 
 
@@ -1596,11 +1618,17 @@ def apply_batches(files: list, blobs: list, chunks: list, limit: int = APPLY_BAT
     """One sync's apply split by size (a big first sync never goes as one HTTP body): each part carries
     its blobs, the files that point at them and their chunks; files of blobs the repo already holds go
     first. ``[{files, blobs, chunks}]`` -- the last part stitches."""
+    import json as _json
     parts: list = [{"files": [], "blobs": [], "chunks": []}]
     where: dict = {}
     size = 0
+    by_blob: dict = {}
+    for c in chunks:
+        by_blob.setdefault(c.get("blob"), []).append(c)
     for b in blobs:
-        n = len(str(b.get("text") or "").encode("utf-8"))
+        # the size as sent: the blob with its text and facts, and its chunks with their vectors
+        n = len(_json.dumps(b, default=str).encode("utf-8")) + sum(
+            len(_json.dumps(c, default=str).encode("utf-8")) for c in by_blob.get(b["hash"], ()))
         if parts[-1]["blobs"] and size + n > limit:
             parts.append({"files": [], "blobs": [], "chunks": []})
             size = 0

{imperal_sdk-6.3.1 → imperal_sdk-6.3.3}/tests/test_code_index_indexer.py

@@ -382,3 +382,30 @@ def test_sftp_reads_never_follow_a_link_and_never_ship_git_credentials():
     assert ci.git_identity(meta["files"])["remote"] == "https://git.x/r.git"
     many = asyncio.run(ci.sftp_read_many(S(), "/r", ["app/x.py", "out/passwd", "tsconfig.json"]))
     assert many["files"] == {"app/x.py": b"x = 1\n"} and set(many["skipped"]) == {"out/passwd", "tsconfig.json"}
+
+
+def test_a_remote_never_carries_credentials_however_it_is_written():
+    from imperal_sdk.code_index import clean_remote
+    assert clean_remote("https://u:p@ss@host.x/r.git") == "https://host.x/r.git"
+    assert clean_remote('"https://bob:tok@git.x:8443/r.git?x=1#f"') == "https://git.x:8443/r.git"
+    assert clean_remote("ssh://git@host/r.git") == "ssh://host/r.git"
+    assert clean_remote("git@github.com:org/r.git") == "git@github.com:org/r.git"
+    assert clean_remote("bob:secret@host:r.git") == "host:r.git"
+    assert clean_remote("https://[::1]:9/r") == "https://[::1]:9/r" and clean_remote("http://h:bad/r") == ""
+    assert clean_remote("") == "" and clean_remote("a b") == ""
+
+
+def test_every_apply_part_fits_the_vault_body_cap_as_sent():
+    """Live 2026-10-20: a first sync of the kernel repo hit the vault's 8 MiB body cap (413) -- the parts
+    were sized by file text alone while each blob also carries its facts and its chunks' vectors."""
+    import json
+    from imperal_sdk import code_index as ci
+    blobs = [{"hash": f"h{i}", "text": "x" * 200_000,
+              "facts": {"defs": [{"name": f"d{j}", "qualname": f"q{j}" * 20} for j in range(4000)]}} for i in range(40)]
+    files = [{"path": f"f{i}.py", "blob": f"h{i}"} for i in range(40)]
+    chunks = [{"blob": f"h{i}", "vector": "A" * 2000, "start_line": k} for i in range(40) for k in range(50)]
+    parts = ci.apply_batches(files, blobs, chunks)
+    assert len(parts) > 1 and sum(len(p["blobs"]) for p in parts) == 40
+    for p in parts:
+        assert len(json.dumps(p).encode("utf-8")) <= ci.APPLY_BATCH_BYTES + 64_000
+    assert ci.APPLY_BATCH_BYTES <= 4_200_000