kernelcontract 0.1.0a3__py3-none-any.whl

kernelcontract/__init__.py

@@ -0,0 +1,3 @@
+"""KernelContract: read-only diagnostics for Jupyter kernels and Python environments."""
+
+__version__ = "0.1.0a3"

kernelcontract/__main__.py

@@ -0,0 +1,4 @@
+from .cli import entrypoint
+
+if __name__ == "__main__":
+    entrypoint()

kernelcontract/cli.py

@@ -0,0 +1,87 @@
+"""Command-line interface for KernelContract."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from typing import Optional, Sequence
+
+from . import __version__
+from .diagnostics import run_diagnostics
+from .models import Report
+
+
+def _parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="kernelcontract",
+        description="Read-only diagnostics for Jupyter kernels and Python environments.",
+        epilog="No packages are installed, removed, or modified by this tool.",
+    )
+    parser.add_argument("--version", action="version", version="%(prog)s {}".format(__version__))
+    subparsers = parser.add_subparsers(dest="command", required=True)
+
+    doctor = subparsers.add_parser("doctor", help="check registered Jupyter kernels and environment drift")
+    doctor.add_argument("--server-python", help="path to the Python interpreter used by the Jupyter server (optional)")
+    doctor.add_argument("--json", action="store_true", dest="json_output", help="print machine-readable JSON")
+    doctor.add_argument("--strict", action="store_true", help="exit non-zero for warnings as well as failures")
+    doctor.add_argument("--probe-python", action="store_true", help="execute each registered Python kernel's argv[0] for package checks; use only with trusted kernelspecs")
+
+    notebook = subparsers.add_parser("notebook", help="check a notebook's declared kernel against registered kernels")
+    notebook.add_argument("path", help="path to a .ipynb file")
+    notebook.add_argument("--server-python", help="path to the Python interpreter used by the Jupyter server (optional)")
+    notebook.add_argument("--json", action="store_true", dest="json_output", help="print machine-readable JSON")
+    notebook.add_argument("--strict", action="store_true", help="exit non-zero for warnings as well as failures")
+    notebook.add_argument("--probe-python", action="store_true", help="execute each registered Python kernel's argv[0] for package checks; use only with trusted kernelspecs")
+    return parser
+
+
+def render_text(report: Report) -> str:
+    lines = ["KernelContract {} - {}".format(__version__, report.command), "=" * 44]
+    for check in report.checks:
+        lines.append("{:<5} {}".format(check.status, check.title))
+        lines.append("      {}".format(check.message))
+        for suggestion in check.suggestions:
+            lines.append("      Next: {}".format(suggestion))
+    counts = report.counts
+    lines.extend([
+        "",
+        "Summary: {pass_count} pass, {info_count} info, {warn_count} warning(s), {fail_count} failure(s).".format(
+            pass_count=counts["pass"], info_count=counts["info"], warn_count=counts["warn"], fail_count=counts["fail"]
+        ),
+        "Overall status: {}".format(report.overall_status),
+        "KernelContract did not modify packages or environments.",
+    ])
+    return "\n".join(lines)
+
+
+def exit_code(report: Report, strict: bool = False) -> int:
+    if any(check.status == "FAIL" for check in report.checks):
+        return 1
+    if strict and any(check.status == "WARN" for check in report.checks):
+        return 1
+    return 0
+
+
+def main(argv: Optional[Sequence[str]] = None) -> int:
+    args = _parser().parse_args(argv)
+    notebook_path = args.path if args.command == "notebook" else None
+    report = run_diagnostics(
+        command=args.command,
+        notebook_path=notebook_path,
+        server_python=args.server_python,
+        probe_python_kernels=args.probe_python,
+    )
+    if args.json_output:
+        print(json.dumps(report.to_dict(), indent=2, sort_keys=True))
+    else:
+        print(render_text(report))
+    return exit_code(report, strict=args.strict)
+
+
+def entrypoint() -> None:
+    raise SystemExit(main())
+
+
+if __name__ == "__main__":
+    entrypoint()

kernelcontract/diagnostics.py

@@ -0,0 +1,432 @@
+"""The core deterministic checks used by both local and CI invocations."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from pathlib import Path
+from typing import Any, Dict, List, Optional
+
+from .discovery import discover_kernelspecs, is_python_kernel, probe_python, resolve_executable
+from .models import Check, Report
+
+
+def _same_path(left: Optional[str], right: Optional[str]) -> bool:
+    if not left or not right:
+        return False
+    try:
+        return os.path.normcase(os.path.realpath(left)) == os.path.normcase(os.path.realpath(right))
+    except (OSError, TypeError):
+        return os.path.normcase(str(left)) == os.path.normcase(str(right))
+
+
+def _package(packages: Dict[str, Any], name: str) -> Dict[str, Any]:
+    value = packages.get(name, {})
+    return value if isinstance(value, dict) else {}
+
+
+def _read_notebook(path: str) -> tuple[Optional[Dict[str, Any]], Optional[str]]:
+    target = Path(path).expanduser()
+    if not target.exists():
+        return None, "Notebook file does not exist: {}".format(target)
+    if not target.is_file():
+        return None, "Notebook path is not a file: {}".format(target)
+    try:
+        with target.open("r", encoding="utf-8") as handle:
+            data = json.load(handle)
+    except (OSError, UnicodeError, json.JSONDecodeError) as exc:
+        return None, "Could not read notebook JSON: {}".format(exc)
+    if not isinstance(data, dict):
+        return None, "Notebook JSON root must be an object."
+    metadata = data.get("metadata", {})
+    if not isinstance(metadata, dict):
+        return None, "Notebook metadata must be an object."
+    return data, None
+
+
+def run_diagnostics(
+    command: str = "doctor",
+    notebook_path: Optional[str] = None,
+    server_python: Optional[str] = None,
+    probe_python_kernels: bool = False,
+) -> Report:
+    """Collect diagnostics. All operations are read-only and use bounded subprocesses."""
+    report = Report(command=command)
+    if probe_python_kernels:
+        report.add(Check(
+            id="security.python-probing",
+            status="INFO",
+            title="Python kernel probing enabled",
+            message="The --probe-python option can execute each registered Python kernel executable. Use it only when you trust the kernelspecs on this machine.",
+            suggestions=[],
+        ))
+    provided_server_python = bool(server_python)
+    if server_python:
+        resolved_server = resolve_executable(server_python)
+        control_python = resolved_server if resolved_server else os.path.abspath(os.path.expanduser(server_python))
+    else:
+        control_python = sys.executable
+
+    if not os.path.isfile(control_python):
+        report.add(Check(
+            id="control-python.path",
+            status="FAIL",
+            title="Control/server Python path",
+            message="The configured Python interpreter does not exist or is not a file: {}".format(control_python),
+            details={"path": control_python},
+            suggestions=["Pass the absolute path to the Python interpreter used by the Jupyter server with --server-python."],
+        ))
+        control_probe = None
+    else:
+        control_probe, control_error = probe_python(control_python)
+        if control_error:
+            report.add(Check(
+                id="control-python.probe",
+                status="FAIL",
+                title="Control/server Python probe",
+                message=control_error,
+                details={"path": control_python},
+                suggestions=["Confirm the interpreter is executable and not blocked by the local environment."],
+            ))
+        else:
+            label = "Server Python (explicitly provided)" if provided_server_python else "Current Python (control environment)"
+            report.add(Check(
+                id="control-python.probe",
+                status="PASS",
+                title=label,
+                message="Python {} is executable.".format(control_probe.get("version", "unknown")),
+                details={"executable": control_probe.get("executable"), "prefix": control_probe.get("prefix"), "version": control_probe.get("version")},
+                suggestions=[],
+            ))
+            if not provided_server_python:
+                report.add(Check(
+                    id="control-python.role",
+                    status="INFO",
+                    title="Server interpreter not inferred",
+                    message="The current Python is used as a control environment; it is not assumed to be the actual Jupyter server Python.",
+                    details={"current_python": control_python},
+                    suggestions=["Re-run with --server-python /absolute/path/to/server/python when Jupyter runs from another environment."],
+                ))
+
+    kernels, discover_error = discover_kernelspecs()
+    if discover_error:
+        report.add(Check(
+            id="kernelspec.discovery",
+            status="FAIL",
+            title="Discover Jupyter kernels",
+            message=discover_error,
+            details={},
+            suggestions=["Install or activate the environment that provides the Jupyter command, then rerun kernelcontract doctor."],
+        ))
+        kernels = {}
+    else:
+        report.add(Check(
+            id="kernelspec.discovery",
+            status="PASS",
+            title="Discover Jupyter kernels",
+            message="Found {} registered kernelspec(s).".format(len(kernels)),
+            details={"count": len(kernels), "names": sorted(kernels.keys())},
+            suggestions=["Register a kernel in the environment you intend to use if none of these is expected."] if not kernels else [],
+        ))
+        if not kernels:
+            report.add(Check(
+                id="kernelspec.empty",
+                status="WARN",
+                title="No registered kernels",
+                message="Jupyter returned no registered kernelspecs.",
+                details={},
+                suggestions=["For a Python environment, install ipykernel in the target environment and register it with `python -m ipykernel install --user --name <name>`."],
+            ))
+
+    kernel_probes: Dict[str, Dict[str, Any]] = {}
+    for name, entry in sorted(kernels.items()):
+        resource_dir = entry.get("resource_dir") if isinstance(entry, dict) else None
+        spec = entry.get("spec", {}) if isinstance(entry, dict) else {}
+        spec = spec if isinstance(spec, dict) else {}
+
+        if resource_dir:
+            res_path = Path(resource_dir)
+            if not res_path.is_dir():
+                report.add(Check(
+                    id="kernel.{}.resource-dir".format(name),
+                    status="FAIL",
+                    title="{}: kernelspec directory".format(name),
+                    message="The kernelspec resource directory does not exist or is not a directory: {}".format(resource_dir),
+                    details={"kernel": name, "resource_dir": resource_dir},
+                    suggestions=["Remove the stale kernelspec registration or restore the missing directory."],
+                ))
+                continue
+            kernel_json_path = res_path / "kernel.json"
+            if not kernel_json_path.is_file():
+                report.add(Check(
+                    id="kernel.{}.kernel-json".format(name),
+                    status="FAIL",
+                    title="{}: kernel.json file".format(name),
+                    message="The kernel.json file is missing in kernelspec directory: {}".format(kernel_json_path),
+                    details={"kernel": name, "resource_dir": resource_dir},
+                    suggestions=["Reinstall or re-register this kernelspec."],
+                ))
+                continue
+            try:
+                with kernel_json_path.open("r", encoding="utf-8") as kf:
+                    disk_spec = json.load(kf)
+                if not isinstance(disk_spec, dict):
+                    report.add(Check(
+                        id="kernel.{}.kernel-json".format(name),
+                        status="FAIL",
+                        title="{}: kernel.json format".format(name),
+                        message="kernel.json root must be a JSON object: {}".format(kernel_json_path),
+                        details={"kernel": name, "resource_dir": resource_dir},
+                        suggestions=["Fix the format of kernel.json or re-register this kernelspec."],
+                    ))
+                    continue
+                if not spec:
+                    spec = disk_spec
+            except (json.JSONDecodeError, UnicodeDecodeError, OSError) as exc:
+                report.add(Check(
+                    id="kernel.{}.kernel-json".format(name),
+                    status="FAIL",
+                    title="{}: kernel.json valid".format(name),
+                    message="kernel.json contains malformed JSON or cannot be read: {}".format(exc),
+                    details={"kernel": name, "resource_dir": resource_dir, "error": str(exc)},
+                    suggestions=["Fix syntax errors in kernel.json or re-register this kernelspec."],
+                ))
+                continue
+
+        argv = spec.get("argv", [])
+        if not isinstance(argv, list) or not argv or not isinstance(argv[0], str) or not argv[0].strip():
+            report.add(Check(
+                id="kernel.{}.argv".format(name),
+                status="FAIL",
+                title="{}: kernelspec executable".format(name),
+                message="The kernelspec has no valid argv[0] interpreter/launcher.",
+                details={"kernel": name, "argv": argv, "resource_dir": resource_dir},
+                suggestions=["Inspect kernel.json and reinstall or re-register this kernelspec if it is stale."],
+            ))
+            continue
+
+        spec_env = spec.get("env", {}) if isinstance(spec.get("env", {}), dict) else {}
+        executable = resolve_executable(argv[0], spec_env)
+        is_python = is_python_kernel(spec, executable)
+        if not executable:
+            report.add(Check(
+                id="kernel.{}.executable".format(name),
+                status="FAIL",
+                title="{}: executable exists".format(name),
+                message="The kernelspec executable could not be resolved: {!r}.".format(argv[0]),
+                details={"kernel": name, "argv0": argv[0], "language": spec.get("language"), "resource_dir": resource_dir},
+                suggestions=["If the environment was moved or deleted, recreate it and re-register the kernel. Otherwise inspect the argv field in this kernel's kernel.json."],
+            ))
+            continue
+
+        report.add(Check(
+            id="kernel.{}.executable".format(name),
+            status="PASS",
+            title="{}: executable exists".format(name),
+            message="Resolved kernelspec executable to {}.".format(executable),
+            details={"kernel": name, "argv0": argv[0], "resolved_executable": executable, "language": spec.get("language"), "display_name": spec.get("display_name")},
+        ))
+
+        if not is_python:
+            report.add(Check(
+                id="kernel.{}.runtime".format(name),
+                status="INFO",
+                title="{}: non-Python runtime".format(name),
+                message="Executable exists; Python package checks do not apply to this kernel language.",
+                details={"kernel": name, "language": spec.get("language", "unknown")},
+            ))
+            continue
+
+        same_as_control = bool(control_probe and _same_path(executable, str(control_probe.get("executable", ""))))
+        if not probe_python_kernels and not same_as_control:
+            report.add(Check(
+                id="kernel.{}.probe-skipped".format(name),
+                status="INFO",
+                title="{}: Python runtime probe skipped".format(name),
+                message="This kernel uses a different executable from the current control interpreter. KernelContract did not execute it because kernelspec executables can run arbitrary code.",
+                details={"kernel": name, "executable": executable, "control_executable": control_probe.get("executable") if control_probe else None},
+                suggestions=["If you trust this kernelspec and want package/runtime checks, rerun with --probe-python."],
+            ))
+            continue
+
+        probe, probe_error = probe_python(executable)
+        if probe_error:
+            report.add(Check(
+                id="kernel.{}.probe".format(name),
+                status="FAIL",
+                title="{}: Python can start".format(name),
+                message=probe_error,
+                details={"kernel": name, "executable": executable},
+                suggestions=["Run the configured interpreter directly and check whether the environment is damaged or inaccessible."],
+            ))
+            continue
+
+        kernel_probes[name] = probe
+        packages = probe.get("packages", {})
+        ipykernel = _package(packages, "ipykernel")
+        if ipykernel.get("installed"):
+            report.add(Check(
+                id="kernel.{}.ipykernel".format(name),
+                status="PASS",
+                title="{}: ipykernel importable".format(name),
+                message="Python {} starts and ipykernel is installed{}.".format(
+                    probe.get("version", "unknown"),
+                    " (version {})".format(ipykernel.get("version")) if ipykernel.get("version") else "",
+                ),
+                details={"kernel": name, "python": probe.get("executable"), "prefix": probe.get("prefix"), "ipykernel": ipykernel},
+            ))
+        else:
+            report.add(Check(
+                id="kernel.{}.ipykernel".format(name),
+                status="FAIL",
+                title="{}: ipykernel importable".format(name),
+                message="The kernel points to a Python interpreter where ipykernel was not found.",
+                details={"kernel": name, "python": probe.get("executable"), "prefix": probe.get("prefix")},
+                suggestions=["Install ipykernel into this exact environment, for example: {} -m pip install ipykernel".format(executable)],
+            ))
+
+        if control_probe and not _same_path(str(control_probe.get("prefix", "")), str(probe.get("prefix", ""))):
+            report.add(Check(
+                id="kernel.{}.environment-drift".format(name),
+                status="WARN" if provided_server_python else "INFO",
+                title="{}: control/kernel environments differ".format(name),
+                message=(
+                    "The configured server Python and this kernel use different prefixes. This may be intentional, but server-side and kernel-side packages must be installed in the correct places."
+                    if provided_server_python else
+                    "This kernel uses a different Python prefix from the current CLI environment. The actual server environment was not inferred, so this does not prove a server/kernel mismatch."
+                ),
+                details={"kernel_prefix": probe.get("prefix"), "control_prefix": control_probe.get("prefix"), "server_python_explicit": provided_server_python},
+                suggestions=["Compare package locations in both environments. Keep separate environments if intentional, and install each dependency in the layer that uses it."],
+            ))
+
+        if control_probe:
+            control_packages = control_probe.get("packages", {})
+            kernel_packages = probe.get("packages", {})
+            if _package(control_packages, "jupyterlab").get("installed") and _package(kernel_packages, "ipywidgets").get("installed"):
+                frontend_widgets = _package(control_packages, "jupyterlab_widgets")
+                if not frontend_widgets.get("installed"):
+                    report.add(Check(
+                        id="kernel.{}.widgets-companion".format(name),
+                        status="WARN",
+                        title="{}: JupyterLab widgets companion".format(name),
+                        message="The Python kernel has ipywidgets, but the control/server environment has no jupyterlab_widgets package. Interactive widgets may not render in JupyterLab.",
+                        details={"kernel": name, "ipywidgets": _package(kernel_packages, "ipywidgets"), "jupyterlab": _package(control_packages, "jupyterlab")},
+                        suggestions=["If this is the environment that runs JupyterLab, install jupyterlab_widgets there; keep ipywidgets installed in each kernel environment that uses widgets."],
+                    ))
+                else:
+                    report.add(Check(
+                        id="kernel.{}.widgets-companion".format(name),
+                        status="PASS",
+                        title="{}: JupyterLab widgets companion present".format(name),
+                        message="Both ipywidgets in the kernel and jupyterlab_widgets in the control environment are present; exact version compatibility is not certified by this check.",
+                        details={"kernel": name, "ipywidgets": _package(kernel_packages, "ipywidgets"), "jupyterlab_widgets": frontend_widgets},
+                    ))
+
+    if notebook_path:
+        notebook_data, notebook_error = _read_notebook(notebook_path)
+        if notebook_error:
+            report.add(Check(
+                id="notebook.read",
+                status="FAIL",
+                title="Read notebook metadata",
+                message=notebook_error,
+                details={"path": notebook_path},
+                suggestions=["Provide a readable .ipynb file containing valid JSON."],
+            ))
+        else:
+            metadata = notebook_data.get("metadata")
+            if not isinstance(metadata, dict):
+                report.add(Check(
+                    id="notebook.metadata",
+                    status="FAIL",
+                    title="Notebook metadata object",
+                    message="Notebook metadata is not an object.",
+                    details={"path": str(Path(notebook_path).expanduser())},
+                    suggestions=["Ensure the notebook contains a valid metadata object."],
+                ))
+            else:
+                raw_kernelspec = metadata.get("kernelspec")
+                if raw_kernelspec is not None and not isinstance(raw_kernelspec, dict):
+                    report.add(Check(
+                        id="notebook.kernelspec-metadata",
+                        status="WARN",
+                        title="Notebook kernel metadata malformed",
+                        message="The notebook metadata.kernelspec field is not an object.",
+                        details={"path": str(Path(notebook_path).expanduser()), "kernelspec": raw_kernelspec},
+                        suggestions=["Open the notebook in Jupyter, select the intended kernel, and save the notebook."],
+                    ))
+                elif not raw_kernelspec:
+                    report.add(Check(
+                        id="notebook.kernelspec-metadata",
+                        status="WARN",
+                        title="Notebook kernel metadata missing",
+                        message="The notebook does not declare metadata.kernelspec; the intended kernel cannot be verified from metadata alone.",
+                        details={"path": str(Path(notebook_path).expanduser()), "language_info": metadata.get("language_info")},
+                        suggestions=["Open the notebook in Jupyter, select the intended kernel, save the notebook, and rerun the check."],
+                    ))
+                else:
+                    declared_name = raw_kernelspec.get("name")
+                    display_name = raw_kernelspec.get("display_name")
+                    if not isinstance(declared_name, str) or not declared_name.strip():
+                        report.add(Check(
+                            id="notebook.kernelspec-metadata",
+                            status="WARN",
+                            title="Notebook kernel metadata invalid name",
+                            message="The notebook does not declare a valid metadata.kernelspec.name string; the intended kernel cannot be verified from metadata alone.",
+                            details={"path": str(Path(notebook_path).expanduser()), "kernelspec": raw_kernelspec},
+                            suggestions=["Open the notebook in Jupyter, select the intended kernel, save the notebook, and rerun the check."],
+                        ))
+                    else:
+                        declared_name = declared_name.strip()
+                        if declared_name not in kernels:
+                            report.add(Check(
+                                id="notebook.kernelspec-registered",
+                                status="FAIL",
+                                title="Notebook kernel is registered",
+                                message="Notebook requests kernel {!r}, but that name is not in the discovered kernelspec list.".format(declared_name),
+                                details={
+                                    "path": str(Path(notebook_path).expanduser()),
+                                    "requested_kernel": declared_name,
+                                    "requested_display_name": display_name,
+                                    "available_kernels": sorted(kernels.keys()),
+                                },
+                                suggestions=["Register the intended kernel or select an installed kernel in Jupyter and save the notebook. Do not assume a fallback kernel is equivalent."],
+                            ))
+                        else:
+                            spec = kernels[declared_name].get("spec", {})
+                            registered_display = spec.get("display_name") if isinstance(spec, dict) else None
+                            report.add(Check(
+                                id="notebook.kernelspec-registered",
+                                status="PASS",
+                                title="Notebook kernel is registered",
+                                message="Notebook kernel {!r} is present in the discovered kernelspec list.".format(declared_name),
+                                details={
+                                    "path": str(Path(notebook_path).expanduser()),
+                                    "requested_kernel": declared_name,
+                                    "notebook_display_name": display_name,
+                                    "registered_display_name": registered_display,
+                                },
+                            ))
+                            if (
+                                isinstance(display_name, str)
+                                and isinstance(registered_display, str)
+                                and display_name != registered_display
+                            ):
+                                report.add(Check(
+                                    id="notebook.display-name-drift",
+                                    status="WARN",
+                                    title="Notebook kernel display name differs",
+                                    message="Notebook metadata says {!r}, while the registered kernelspec displays {!r}. The kernel name is registered, but the display name may have changed.".format(
+                                        display_name, registered_display
+                                    ),
+                                    details={
+                                        "notebook_display_name": display_name,
+                                        "registered_display_name": registered_display,
+                                    },
+                                    suggestions=["Confirm the notebook still uses the intended kernel; update metadata only after verifying the runtime."],
+                                ))
+
+    if not report.checks:
+        report.add(Check(id="report.empty", status="INFO", title="No checks run", message="No diagnostics were collected."))
+    return report

kernelcontract/discovery.py

@@ -0,0 +1,249 @@
+"""Read-only discovery of Jupyter kernelspecs and safe interpreter probes."""
+
+from __future__ import annotations
+
+import json
+import os
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+from string import Template
+from typing import Any, Dict, List, Optional, Tuple
+
+
+PYTHON_LANGUAGE_NAMES = {"python", "python2", "python3"}
+
+
+def _expanded_env(spec_env: Dict[str, Any]) -> Dict[str, str]:
+    env = os.environ.copy()
+    entries = {
+        key: value
+        for key, value in spec_env.items()
+        if isinstance(key, str) and isinstance(value, str)
+    }
+    # Kernelspec env entries are added to the parent environment. Expand only
+    # values declared by the kernelspec; applying Template to every inherited
+    # variable could fail on unrelated values containing a literal '$'.
+    env.update(entries)
+    for key, value in entries.items():
+        try:
+            env[key] = Template(value).safe_substitute(env)
+        except ValueError:
+            # Treat malformed template syntax as a literal environment value.
+            env[key] = value
+    return env
+
+
+def resolve_executable(argv0: str, spec_env: Optional[Dict[str, Any]] = None) -> Optional[str]:
+    """Resolve the first kernelspec argv item without invoking a shell."""
+    if not argv0 or not isinstance(argv0, str):
+        return None
+    cleaned = argv0.strip()
+    if (cleaned.startswith('"') and cleaned.endswith('"')) or (cleaned.startswith("'") and cleaned.endswith("'")):
+        cleaned = cleaned[1:-1].strip()
+    if not cleaned:
+        return None
+
+    env = _expanded_env(spec_env or {})
+    try:
+        expanded = Template(os.path.expanduser(cleaned)).safe_substitute(env)
+    except ValueError:
+        expanded = os.path.expanduser(cleaned)
+    # Expand conventional $VAR and %VAR% forms as well. Template above handles
+    # variables added by the kernelspec; expandvars handles platform syntax.
+    expanded = os.path.expandvars(expanded)
+    has_path_component = os.path.isabs(expanded) or os.sep in expanded or (os.altsep and os.altsep in expanded)
+    if has_path_component:
+        candidate = Path(expanded)
+        try:
+            if candidate.is_file() and (os.name == "nt" or os.access(str(candidate), os.X_OK)):
+                return str(candidate.resolve())
+        except OSError:
+            pass
+        # On Windows, path components may omit .exe; check PATHEXT with normalized slashes
+        if os.name == "nt":
+            norm_expanded = os.path.normpath(expanded)
+            pathext = [ext for ext in os.environ.get("PATHEXT", ".COM;.EXE;.BAT;.CMD").split(";") if ext]
+            for ext in pathext:
+                target = Path(norm_expanded + ext if not norm_expanded.lower().endswith(ext.lower()) else norm_expanded)
+                try:
+                    if target.is_file():
+                        return str(target.resolve())
+                except OSError:
+                    pass
+            which_path = shutil.which(norm_expanded)
+            if which_path:
+                return str(Path(which_path).resolve())
+        else:
+            which_path = shutil.which(expanded)
+            if which_path:
+                return str(Path(which_path).resolve())
+        return None
+    resolved = shutil.which(expanded, path=env.get("PATH"))
+    return str(Path(resolved).resolve()) if resolved else None
+
+
+def discover_kernelspecs(timeout: float = 15.0) -> Tuple[Dict[str, Dict[str, Any]], Optional[str]]:
+    """Return {name: {resource_dir, spec}} using Jupyter's supported JSON CLI."""
+    jupyter = shutil.which("jupyter")
+    if not jupyter:
+        return {}, (
+            "Could not find the 'jupyter' command on PATH. Run KernelContract in the "
+            "environment that provides Jupyter, then try again."
+        )
+    try:
+        proc = subprocess.run(
+            [jupyter, "kernelspec", "list", "--json"],
+            capture_output=True,
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+            timeout=timeout,
+            check=False,
+            shell=False,
+        )
+    except subprocess.TimeoutExpired:
+        return {}, "'jupyter kernelspec list --json' timed out after {} seconds.".format(timeout)
+    except OSError as exc:
+        return {}, "Could not run Jupyter's kernelspec command: {}".format(exc)
+
+    if proc.returncode != 0:
+        detail = (proc.stderr or proc.stdout or "no diagnostic text").strip()
+        return {}, "Jupyter could not list kernelspecs (exit {}). {}".format(proc.returncode, detail[:800])
+    raw_stdout = proc.stdout.strip()
+    try:
+        payload = json.loads(raw_stdout)
+    except json.JSONDecodeError as exc:
+        # Some Jupyter plugins or logging hooks print warnings to stdout; attempt to locate JSON boundaries
+        start = raw_stdout.find("{")
+        end = raw_stdout.rfind("}")
+        if start != -1 and end != -1 and end > start:
+            try:
+                payload = json.loads(raw_stdout[start : end + 1])
+            except json.JSONDecodeError:
+                return {}, "Jupyter returned invalid JSON for kernelspecs: {}".format(exc)
+        else:
+            return {}, "Jupyter returned invalid JSON for kernelspecs: {}".format(exc)
+
+    if not isinstance(payload, dict):
+        return {}, "Jupyter returned an unexpected JSON root structure: expected an object, got {}.".format(
+            type(payload).__name__
+        )
+
+    if "kernelspecs" not in payload:
+        return {}, "Jupyter's kernelspec JSON is missing the required 'kernelspecs' field."
+
+    raw_specs = payload["kernelspecs"]
+    if not isinstance(raw_specs, dict):
+        return {}, "Jupyter's kernelspec JSON did not contain a 'kernelspecs' object (got {}).".format(
+            type(raw_specs).__name__
+        )
+
+    result: Dict[str, Dict[str, Any]] = {}
+    for name, entry in raw_specs.items():
+        if not isinstance(name, str) or not isinstance(entry, dict):
+            continue
+        spec = entry.get("spec")
+        if not isinstance(spec, dict):
+            spec = {}
+        result[name] = {
+            "resource_dir": entry.get("resource_dir"),
+            "spec": spec,
+        }
+    return result, None
+
+
+_PROBE_SENTINEL = "__KERNELCONTRACT_PROBE_JSON__:"
+
+
+def probe_python(interpreter: str, timeout: float = 8.0) -> Tuple[Optional[Dict[str, Any]], Optional[str]]:
+    """Run a short, read-only probe in an interpreter; never install or modify packages."""
+    code = r'''
+import importlib.metadata as md
+import importlib.util
+import json
+import sys
+
+def package(name):
+    try:
+        version = md.version(name)
+        return {"installed": True, "version": version}
+    except Exception:
+        try:
+            installed = importlib.util.find_spec(name.replace("-", "_")) is not None
+        except Exception:
+            installed = False
+        return {"installed": installed, "version": None}
+
+payload = {
+    "executable": sys.executable,
+    "prefix": sys.prefix,
+    "base_prefix": sys.base_prefix,
+    "version": ".".join(map(str, sys.version_info[:3])),
+    "packages": {
+        "ipykernel": package("ipykernel"),
+        "ipywidgets": package("ipywidgets"),
+        "jupyterlab": package("jupyterlab"),
+        "jupyterlab_widgets": package("jupyterlab_widgets"),
+        "notebook": package("notebook"),
+        "widgetsnbextension": package("widgetsnbextension"),
+    },
+}
+print("__KERNELCONTRACT_PROBE_JSON__:" + json.dumps(payload))
+'''
+    try:
+        proc = subprocess.run(
+            [interpreter, "-c", code],
+            capture_output=True,
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+            timeout=timeout,
+            check=False,
+            shell=False,
+        )
+    except subprocess.TimeoutExpired:
+        return None, "Python probe timed out after {} seconds.".format(timeout)
+    except OSError as exc:
+        return None, "Could not start interpreter: {}".format(exc)
+    if proc.returncode != 0:
+        detail = (proc.stderr or proc.stdout or "no diagnostic text").strip()
+        return None, "Interpreter probe failed (exit {}). {}".format(proc.returncode, detail[:800])
+
+    lines = proc.stdout.strip().splitlines()
+    json_text: Optional[str] = None
+    for line in reversed(lines):
+        stripped = line.strip()
+        if stripped.startswith(_PROBE_SENTINEL):
+            json_text = stripped[len(_PROBE_SENTINEL):]
+            break
+    if json_text is None and lines:
+        json_text = lines[-1].strip()
+
+    if not json_text:
+        return None, "Interpreter returned empty probe output."
+
+    try:
+        result = json.loads(json_text)
+    except json.JSONDecodeError as exc:
+        return None, "Interpreter returned unexpected probe output: {}".format(exc)
+    return result, None
+
+
+def is_python_kernel(spec: Dict[str, Any], resolved_executable: Optional[str]) -> bool:
+    language = str(spec.get("language", "")).strip().lower()
+    if language in PYTHON_LANGUAGE_NAMES:
+        return True
+    if language:
+        return False
+    # If language was omitted from kernelspec, inspect argv and executable
+    argv = spec.get("argv", [])
+    if isinstance(argv, list):
+        for arg in argv:
+            if isinstance(arg, str) and ("ipykernel" in arg.lower() or "ipykernel_launcher" in arg.lower()):
+                return True
+    if not resolved_executable:
+        return False
+    name = Path(resolved_executable).name.lower()
+    return name.startswith(("python", "pypy"))

kernelcontract/models.py

@@ -0,0 +1,66 @@
+"""Small, dependency-free data models for diagnostic results."""
+
+from __future__ import annotations
+
+from dataclasses import asdict, dataclass, field
+from typing import Any, Dict, List
+
+
+VALID_STATUSES = {"PASS", "INFO", "WARN", "FAIL"}
+
+
+@dataclass
+class Check:
+    """One diagnostic observation."""
+
+    id: str
+    status: str
+    title: str
+    message: str
+    details: Dict[str, Any] = field(default_factory=dict)
+    suggestions: List[str] = field(default_factory=list)
+
+    def __post_init__(self) -> None:
+        self.status = self.status.upper()
+        if self.status not in VALID_STATUSES:
+            raise ValueError("status must be one of PASS, INFO, WARN, FAIL")
+
+    def to_dict(self) -> Dict[str, Any]:
+        return asdict(self)
+
+
+@dataclass
+class Report:
+    """A complete diagnostic report."""
+
+    command: str
+    checks: List[Check] = field(default_factory=list)
+    schema_version: str = "1.0"
+
+    def add(self, check: Check) -> None:
+        self.checks.append(check)
+
+    @property
+    def counts(self) -> Dict[str, int]:
+        return {
+            status.lower(): sum(1 for check in self.checks if check.status == status)
+            for status in ("PASS", "INFO", "WARN", "FAIL")
+        }
+
+    @property
+    def overall_status(self) -> str:
+        if any(check.status == "FAIL" for check in self.checks):
+            return "FAIL"
+        if any(check.status == "WARN" for check in self.checks):
+            return "WARN"
+        return "PASS"
+
+    def to_dict(self) -> Dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "tool": "kernelcontract",
+            "command": self.command,
+            "status": self.overall_status,
+            "summary": self.counts,
+            "checks": [check.to_dict() for check in self.checks],
+        }

kernelcontract-0.1.0a3.dist-info/METADATA

@@ -0,0 +1,188 @@
+Metadata-Version: 2.4
+Name: kernelcontract
+Version: 0.1.0a3
+Summary: Read-only diagnostics for Jupyter kernels and Python environments
+Author: KernelContract contributors
+License: MIT License
+        
+        Copyright (c) 2026 KernelContract contributors
+        
+        Permission is hereby granted, free of charge, to any person obtaining a copy
+        of this software and associated documentation files (the "Software"), to deal
+        in the Software without restriction, including without limitation the rights
+        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+        copies of the Software, and to permit persons to whom the Software is
+        furnished to do so, subject to the following conditions:
+        
+        The above copyright notice and this permission notice shall be included in all
+        copies or substantial portions of the Software.
+        
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+        SOFTWARE.
+        
+Keywords: jupyter,notebook,kernel,diagnostics,python-environments
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Scientific/Engineering
+Classifier: Topic :: Software Development :: Debuggers
+Classifier: Topic :: Utilities
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: test
+Requires-Dist: pytest>=8.0; extra == "test"
+Dynamic: license-file
+
+# KernelContract
+
+**Local-first, read-only diagnostics for Jupyter kernels, kernelspecs, and notebook environments.**
+
+KernelContract inspects registered Jupyter kernelspecs, checks whether their configured executables resolve, probes Python kernel environments, and compares notebook kernel metadata with the kernels available to the current Jupyter CLI. It reports likely configuration mismatches, missing interpreters, and safe next steps without modifying the machine.
+
+> **Alpha Software — Candidate 0.1.0a3 (Latest tagged pre-release: [v0.1.0a2](https://github.com/Ayushxsingh100/kernelcontract/releases/tag/v0.1.0a2)).** KernelContract is an early-stage diagnostic tool under active development. The latest published GitHub pre-release is `v0.1.0a2`, and the current default branch is preparing candidate `0.1.0a3` for PyPI Trusted Publishing. It has **not** yet been published to PyPI. The project name is provisional and has not been trademark- or registry-cleared.
+
+---
+
+## Quick start
+
+### Prerequisites
+
+* **Python 3.10 or newer.**
+* **Jupyter CLI on PATH:** KernelContract has zero external runtime dependencies (it uses the Python standard library only), but it requires that the `jupyter` command is available on your `PATH` (such as via `jupyter-core`) to discover registered kernels via `jupyter kernelspec list --json`.
+
+### End-user installation (pre-release)
+
+Install the tagged alpha pre-release directly from GitHub using `pip`:
+
+```bash
+python -m pip install "git+https://github.com/Ayushxsingh100/kernelcontract.git@v0.1.0a3"
+```
+
+Or install the latest development snapshot from the default `master` branch:
+
+```bash
+python -m pip install "git+https://github.com/Ayushxsingh100/kernelcontract.git"
+```
+
+> **Note on PyPI:** The command `pip install kernelcontract` is reserved for future distribution once the package is officially published to the Python Package Index.
+
+---
+
+## Core usage
+
+### 1. Diagnose registered Jupyter kernels
+
+Run the `doctor` command to inspect all discovered kernelspecs, verify their executables, and check the active Python environment:
+
+```bash
+kernelcontract doctor
+```
+
+### 2. Validate notebook kernel metadata
+
+Inspect whether a `.ipynb` file's declared kernel exists and matches currently registered kernelspecs:
+
+```bash
+kernelcontract notebook path/to/notebook.ipynb
+```
+
+If the notebook requests an unavailable kernel or if the kernel's stored display name has drifted from disk, KernelContract reports the issue with actionable next steps.
+
+### 3. Machine-readable JSON output
+
+Produce structured, versioned JSON suitable for automated tooling, pre-commit hooks, or CI pipelines:
+
+```bash
+kernelcontract doctor --json
+kernelcontract notebook path/to/notebook.ipynb --json
+```
+
+The JSON schema output includes `schema_version`, `status` (`PASS`, `WARN`, `FAIL`), check details, and specific remediation suggestions.
+
+### 4. Strict CI mode
+
+By default, `FAIL` makes the command exit with status 1, while warnings exit with status 0. To fail CI on warnings as well as failures, pass `--strict`:
+
+```bash
+kernelcontract doctor --strict
+```
+
+### 5. Probing external Python kernels (opt-in)
+
+```bash
+kernelcontract doctor --probe-python
+```
+
+* **Security Note:** By default, KernelContract only executes package inspection on the current control interpreter and kernels that resolve to the exact same executable. Interpreters outside the current environment are **not** executed unless you pass `--probe-python`. Use `--probe-python` only with kernelspecs and environments you trust.
+
+---
+
+## What it checks
+
+* **CLI Discovery:** Whether the Jupyter CLI can enumerate kernelspecs using `jupyter kernelspec list --json`.
+* **JSON Structure Safety:** Whether kernelspec outputs have valid root structures and dictionary objects.
+* **Executable Resolution:** Whether each registered kernelspec has a resolvable `argv[0]` executable (including Windows `PATHEXT` resolution for `.exe`, `.cmd`, `.bat`, quoted paths with spaces, and environment variable expansion).
+* **Environment Integrity:** Whether the control Python (and, when opted in, external Python kernels) can start and whether `ipykernel` is installed in that interpreter.
+* **Environment Drift:** Whether a probed kernel's Python prefix differs from the control interpreter.
+* **Widget Companion Check:** A narrow check for presence of `jupyterlab_widgets` when the control environment contains JupyterLab and a probed kernel contains `ipywidgets`.
+* **Notebook Metadata Check:** Whether a notebook file declares a kernel name that is currently registered and whether the recorded display name matches the kernelspec on disk.
+
+---
+
+## Server vs. kernel environments
+
+KernelContract cannot reliably infer which Python interpreter belongs to an already-running Jupyter server across diverse setups (e.g. systemd services, Docker containers, remote SSH tunnels, JupyterHub). By default, it uses the Python interpreter launching KernelContract as its **control environment**.
+
+If you know the specific Python interpreter running the Jupyter server, pass it explicitly:
+
+```bash
+kernelcontract doctor --server-python /absolute/path/to/server/python
+```
+
+---
+
+## Safety and privacy guarantees
+
+* **Strictly Read-Only:** KernelContract modifies no packages, rewrites no files, and changes no configuration.
+* **No Telemetry:** Zero analytics, telemetry, or network calls are made by KernelContract.
+* **Bounded Subprocesses:** Subprocess probes use strict execution timeouts to avoid hanging indefinitely.
+* **No Shell Execution:** Commands are executed directly with argument lists (`shell=False`).
+
+---
+
+## Development
+
+To contribute or run the test suite locally from source:
+
+```bash
+git clone https://github.com/Ayushxsingh100/kernelcontract.git
+cd kernelcontract
+python -m venv .venv
+# Activate .venv (Windows: .venv\Scripts\activate | Unix: source .venv/bin/activate)
+python -m pip install -e ".[test]"
+python -m unittest discover -s tests -v
+python -m pytest -q
+```
+
+---
+
+## Status
+
+* **Version:** `0.1.0a3` (alpha candidate; latest tagged pre-release: [`v0.1.0a2`](https://github.com/Ayushxsingh100/kernelcontract/releases/tag/v0.1.0a2))
+* **Repository:** [https://github.com/Ayushxsingh100/kernelcontract](https://github.com/Ayushxsingh100/kernelcontract)
+* **Pre-release Notes:** [v0.1.0a2 Release](https://github.com/Ayushxsingh100/kernelcontract/releases/tag/v0.1.0a2)
+* **License:** [MIT](LICENSE)
+* **Stability:** Alpha

kernelcontract-0.1.0a3.dist-info/RECORD

@@ -0,0 +1,12 @@
+kernelcontract/__init__.py,sha256=GCWDqMBzU3yXXNJ2PpFH-NDk6uaeBzIqvXIUi2By5x0,114
+kernelcontract/__main__.py,sha256=fpwbU4p9ugfnYvX5e0tIBc20l6JdbVlLs_94qi3K-WE,73
+kernelcontract/cli.py,sha256=OFMzheFbVDazJhhfLE8YMegWwma7EU4dopEbDtwC0qI,3815
+kernelcontract/diagnostics.py,sha256=d_fsfejCNYQzZDaryTLDAt2hKKv2SqtbYXf4jvBMgFI,24118
+kernelcontract/discovery.py,sha256=tprzEdfp1LAZAW4NFTNdYbkViRkGpAm-154E7WJ8IuA,9467
+kernelcontract/models.py,sha256=5fvxxLxMxXqk8W99BlJ3fr_J0Z3wIrjljGeWr67H-Zo,1821
+kernelcontract-0.1.0a3.dist-info/licenses/LICENSE,sha256=Ld4N2ot7ms3UbMdBMw_6R1SVDxps3hcuHxl7RBbaPk8,1084
+kernelcontract-0.1.0a3.dist-info/METADATA,sha256=zPDC4GcxkDbatj3szZe7WLAMXh8UhK8iT3Ou9woyAO0,8720
+kernelcontract-0.1.0a3.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+kernelcontract-0.1.0a3.dist-info/entry_points.txt,sha256=01ZeuxIGq6Zhr60RIEdFORQWZegp0eX4xYUaegU_qhY,65
+kernelcontract-0.1.0a3.dist-info/top_level.txt,sha256=MyCSo3pNdngRsBz-TgDfxSUnR2vJw7aV6HY2eqZB_rs,15
+kernelcontract-0.1.0a3.dist-info/RECORD,,

kernelcontract-0.1.0a3.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.2.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

kernelcontract-0.1.0a3.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+kernelcontract = kernelcontract.cli:entrypoint

kernelcontract-0.1.0a3.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 KernelContract contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

kernelcontract-0.1.0a3.dist-info/top_level.txt

@@ -0,0 +1 @@
+kernelcontract