lablink-cli 0.2.0__tar.gz → 0.4.0__tar.gz

{lablink_cli-0.2.0 → lablink_cli-0.4.0}/PKG-INFO

@@ -1,13 +1,13 @@
 Metadata-Version: 2.4
 Name: lablink-cli
-Version: 0.2.0
+Version: 0.4.0
 Summary: CLI tool for deploying and managing LabLink infrastructure
 Author-email: Elizabeth Berrigan <eberrigan@salk.edu>, Talmo Pereira <talmo@salk.edu>, Andrew Park <hep003@ucsd.edu>
 Project-URL: Homepage, https://github.com/talmolab/lablink
 Project-URL: Issues, https://github.com/talmolab/lablink/issues
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: lablink-allocator-service[config]>=0.2.0
+Requires-Dist: lablink-allocator-service[config]>=0.4.0
 Requires-Dist: typer>=0.15
 Requires-Dist: textual>=3.0
 Requires-Dist: rich>=13.0

{lablink_cli-0.2.0 → lablink_cli-0.4.0}/pyproject.toml

@@ -5,7 +5,7 @@ authors = [
   {name = "Talmo Pereira", email = "talmo@salk.edu"},
   {name = "Andrew Park", email = "hep003@ucsd.edu"},
 ]
-version = "0.2.0"
+version = "0.4.0"
 description = "CLI tool for deploying and managing LabLink infrastructure"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -13,7 +13,7 @@ dependencies = [
     # >=0.2.0: deploy_compose imports PUBLIC_HOSTNAME_HINT,
     # is_valid_public_hostname and is_weak_admin_password, none of which
     # exist in 0.1.2 — an unpinned resolve breaks `provider: manual`.
-    "lablink-allocator-service[config]>=0.2.0",
+    "lablink-allocator-service[config]>=0.4.0",
     "typer>=0.15",
     "textual>=3.0",
     "rich>=13.0",

{lablink_cli-0.2.0 → lablink_cli-0.4.0}/src/lablink_cli/__init__.py

@@ -1,8 +1,8 @@
 """LabLink CLI - Deploy and manage LabLink infrastructure."""
 
 TEMPLATE_REPO = "talmolab/lablink-template"
-TEMPLATE_VERSION = "v0.3.0"
+TEMPLATE_VERSION = "v0.3.1"
 # SHA-256 of the GitHub release tarball for TEMPLATE_VERSION.
 # Update this when bumping TEMPLATE_VERSION.
 # To compute: curl -sL <tarball_url> | sha256sum
-TEMPLATE_SHA256 = "3d3f8803990f80e6bcda0b3098178d909bc454315fdf2304e70dbee5d43e3bb6"
+TEMPLATE_SHA256 = "97f2f96c7bbdcaeeec8bd681394883409357613bbe40f97115a7a974d61a7660"

{lablink_cli-0.2.0 → lablink_cli-0.4.0}/src/lablink_cli/app.py

@@ -258,19 +258,19 @@ def deploy(
         None,
         "--tailscale-authkey",
         help="Tailscale auth key for the allocator's own tailnet sidecar. "
-        "Required on the first deploy when manual.connectivity is "
+        "Needed on the first deploy when manual.connectivity is "
         "'mesh_overlay' and/or manual.participant_exposure is "
-        "'tailscale_funnel'; optional on redeploys (the previous value is "
-        "carried forward). Manual provider only.",
+        "'tailscale_funnel' (prompted if omitted); optional on redeploys "
+        "(the previous value is carried forward). Manual provider only.",
     ),
     cloudflare_tunnel_token: str = typer.Option(
         None,
         "--cloudflare-tunnel-token",
         help="Cloudflare Tunnel token for publishing the allocator at "
-        "manual.public_hostname. Required on the first deploy when "
-        "manual.participant_exposure is 'cloudflare_tunnel'; optional on "
-        "redeploys (the previous value is carried forward). Supply it again "
-        "to rotate. Manual provider only.",
+        "manual.public_hostname. Needed on the first deploy when "
+        "manual.participant_exposure is 'cloudflare_tunnel' (prompted if "
+        "omitted); optional on redeploys (the previous value is carried "
+        "forward). Supply it again to rotate. Manual provider only.",
     ),
     render_only: bool = typer.Option(
         False,

{lablink_cli-0.2.0 → lablink_cli-0.4.0}/src/lablink_cli/commands/deploy_compose.py

@@ -89,6 +89,27 @@ def _read_env_value(env_path: Path, key: str) -> str | None:
     return None
 
 
+def _prompt_secret(label: str, hint: str) -> str:
+    """Prompt for a credential the deploy needs but was not given a flag for.
+
+    Typer's own `prompt=` on the flag would fire on every deploy that omits
+    it, including AWS ones that never want the value. The two callers below
+    already know the credential is required, so the prompt lives there.
+
+    getpass keeps the value off the terminal (and out of a `vhs` recording),
+    matching how the admin password is collected in `deploy.py`.
+    """
+    import getpass
+
+    console.print(hint)
+    value = getpass.getpass(f"  {label}: ").strip()
+    if not value:
+        console.print(f"[red]A {label.lower()} is required.[/red]")
+        raise SystemExit(1)
+    console.print()
+    return value
+
+
 def _needs_tailscale_sidecar(cfg: Config) -> bool:
     """True if a tailnet join is needed for either of two independent
     reasons: reaching mesh-overlay clients, or publishing the allocator
@@ -303,8 +324,8 @@ def run_deploy_compose(
     (Run:AI, Kubernetes) instead of via `docker compose up`. Rejected
     up front when the config needs the Tailscale sidecar, which such
     platforms do not grant kernel TUN/NET_ADMIN access for.
-    `tailscale_authkey` is required when a tailnet join is needed for
-    either `cfg.manual.connectivity == "mesh_overlay"` or
+    `tailscale_authkey` is prompted for (hidden) when a tailnet join is
+    needed for either `cfg.manual.connectivity == "mesh_overlay"` or
     `cfg.manual.participant_exposure == "tailscale_funnel"`, unless a
     value is already on record in this deployment's existing `.env`
     (carried forward on ordinary redeploys by `render_compose_dir`) or
@@ -313,7 +334,7 @@ def run_deploy_compose(
     `lablink destroy`, which wipes the working directory — including
     `.env` — but keeps that volume specifically so this doesn't force a
     needless re-auth).
-    `cloudflare_tunnel_token` is required when
+    `cloudflare_tunnel_token` is prompted for (hidden) when
     `cfg.manual.participant_exposure == "cloudflare_tunnel"`, unless a
     value is already on record in this deployment's existing `.env`. There
     is no state-volume equivalent here: the tunnel's identity lives in
@@ -350,24 +371,22 @@ def run_deploy_compose(
         # enough: a redeploy that *switches* to needing the sidecar has
         # an existing .env, but that .env has no TS_AUTHKEY line to carry
         # forward. Read the actual prior value (if any) so that case
-        # still requires --tailscale-authkey instead of silently
-        # rendering an empty key.
+        # still prompts instead of silently rendering an empty key.
         previous_authkey = _read_env_value(target / ".env", "TS_AUTHKEY")
         if (
             not tailscale_authkey
             and not previous_authkey
             and not _tailscale_state_volume_exists(target, docker=docker)
         ):
-            console.print(
-                "[red]A Tailscale sidecar is needed (manual.connectivity "
-                "is 'mesh_overlay' and/or manual.participant_exposure is "
-                "'tailscale_funnel') but no --tailscale-authkey was given, "
-                "and no previous value is on record for this "
-                "deployment.[/red]\n"
-                "Generate an authkey from your Tailscale admin console "
-                "and re-run with --tailscale-authkey <key>."
+            tailscale_authkey = _prompt_secret(
+                "Tailscale authkey",
+                "A Tailscale sidecar is needed (manual.connectivity is "
+                "'mesh_overlay' and/or manual.participant_exposure is "
+                "'tailscale_funnel') and no authkey is on record for this "
+                "deployment.\n"
+                "Generate one from your Tailscale admin console "
+                "(Settings > Keys).",
             )
-            raise SystemExit(1)
 
     # Preflight: cloudflare_tunnel needs a hostname and a token. The
     # hostname is also checked by get_config_errors(), but `lablink deploy`
@@ -403,16 +422,14 @@ def run_deploy_compose(
             raise SystemExit(1)
         previous_cf_token = _read_env_value(target / ".env", "CLOUDFLARE_TUNNEL_TOKEN")
         if not cloudflare_tunnel_token and not previous_cf_token:
-            console.print(
-                "[red]manual.participant_exposure is 'cloudflare_tunnel' but "
-                "no --cloudflare-tunnel-token was given, and no previous "
-                "value is on record for this deployment.[/red]\n"
+            cloudflare_tunnel_token = _prompt_secret(
+                "Cloudflare tunnel token",
+                "manual.participant_exposure is 'cloudflare_tunnel' and no "
+                "token is on record for this deployment.\n"
                 "Create a tunnel in Cloudflare's Zero Trust dashboard "
-                "(Networks > Tunnels), copy the token from its Docker "
-                "install command, and re-run with "
-                "--cloudflare-tunnel-token <token>."
+                "(Networks > Tunnels) and copy the token from its Docker "
+                "install command.",
             )
-            raise SystemExit(1)
 
     # Preflight: SSL provider must be one the compose template supports.
     # The allocator image has no TLS terminator, so only ssl=none works

{lablink_cli-0.2.0 → lablink_cli-0.4.0}/src/lablink_cli/commands/doctor.py

@@ -240,9 +240,112 @@ def _check_s3_bucket(cfg) -> dict:
     return result
 
 
+# Mirrors data.aws_ami.default_client in the client terraform. Ubuntu 24.04 is pinned
+# there because 26.04 is published on the same dates, and this filter has to match or
+# doctor would verify a different image than the deployment uses.
+DEFAULT_CLIENT_AMI_FILTER = (
+    "Deep Learning Base OSS Nvidia Driver GPU AMI (Ubuntu 24.04)*"
+)
+
+
+def _check_default_client_ami(region: str, published: str | None) -> dict:
+    """Resolve the image an empty machine.ami_id would get, in *region*."""
+    result = {"check": "Client AMI", "status": "fail"}
+
+    try:
+        from lablink_cli.commands.setup import _get_session
+
+        images = (
+            _get_session(region)
+            .client("ec2")
+            .describe_images(
+                Owners=["amazon"],
+                Filters=[{"Name": "name", "Values": [DEFAULT_CLIENT_AMI_FILTER]}],
+            )["Images"]
+        )
+    except Exception as e:
+        result["status"] = "warn"
+        result["detail"] = (
+            f"machine.ami_id is empty (resolve automatically); could not verify a "
+            f"Deep Learning Base AMI in {region}: {e}"
+        )
+        return result
+
+    if images:
+        newest = max(images, key=lambda i: i["CreationDate"])
+        result["status"] = "pass"
+        result["detail"] = (
+            f"empty → {newest['ImageId']} ({newest['Name']}) in {region}"
+        )
+        return result
+
+    hint = f"set it to {published}" if published else (
+        f"set it to an image that exists in {region}"
+    )
+    result["detail"] = (
+        f"machine.ami_id is empty, but AWS publishes no Deep Learning Base AMI in "
+        f"{region} to fall back to — {hint}"
+    )
+    return result
+
+
+def _check_viewer_streaming(cfg) -> dict:
+    """Warn when the viewer will be served over plain HTTP.
+
+    KasmVNC's H.264 path needs the browser's WebCodecs VideoDecoder, which Chrome
+    exposes only on secure origins. With ssl.provider "none" the viewer is served
+    over http://, the codec probe reports "WebCodecs API not available", and every
+    session falls back to JPEG/WebP stills — re-encoding damaged regions from
+    scratch every frame instead of encoding inter-frame change.
+
+    Nothing else surfaces this. The deploy is green, sessions work, and the
+    server-side encoder is fine; it simply never gets asked for video mode. The
+    symptom reaches an operator as "the desktop feels laggy", which is a long way
+    from "ssl.provider is none".
+    """
+    result = {"check": "Viewer streaming", "status": "pass"}
+
+    if cfg is None:
+        result["status"] = "warn"
+        result["detail"] = "Skipped (no valid config)"
+        return result
+
+    provider = (getattr(getattr(cfg, "ssl", None), "provider", "") or "none").lower()
+
+    if provider == "none":
+        result["status"] = "warn"
+        result["detail"] = (
+            "ssl.provider is 'none', so the viewer is served over HTTP and H.264 "
+            "streaming cannot engage — sessions fall back to JPEG/WebP. Configure an "
+            "SSL provider, or to test as-is port-forward the allocator "
+            "(ssh -L 8443:localhost:5000 ...) and open http://localhost:8443, since "
+            "localhost counts as a secure origin"
+        )
+        return result
+
+    result["detail"] = f"H.264 available — viewer served over HTTPS ({provider})"
+    return result
+
+
 def _check_ami(cfg) -> dict:
-    """Check that an AMI is available for the configured region."""
-    result = {"check": "AMI for region", "status": "fail"}
+    """Check that the configured client AMI exists in the configured region.
+
+    Client VMs are the only ones needing a custom image, since the GPU drivers are
+    baked in, which makes machine.ami_id the one region-scoped value a deployment
+    has to get right. The allocator boots stock Ubuntu resolved per region from an
+    SSM parameter and constrains nothing.
+
+    AMI_MAP is consulted only to suggest a value. Asking EC2 whether the configured
+    image actually exists is the whole point: a region absent from the table is fine
+    if the operator copied an image into it, and a region present in the table is no
+    guarantee that the ID in *their* config is right.
+
+    An empty machine.ami_id is not a missing value — it asks the client terraform to
+    resolve AWS's Deep Learning Base AMI for the deployment's region (see
+    data.aws_ami.default_client). So the empty case resolves the same image the
+    deployment would and reports which one, rather than reporting a gap.
+    """
+    result = {"check": "Client AMI", "status": "fail"}
 
     if cfg is None:
         result["status"] = "warn"
@@ -252,17 +355,39 @@ def _check_ami(cfg) -> dict:
     from lablink_cli.config.schema import AMI_MAP
 
     region = cfg.app.region
-    if region in AMI_MAP:
-        result["status"] = "pass"
-        result["detail"] = (
-            f"{region} → {AMI_MAP[region]}"
-        )
-    else:
-        result["status"] = "fail"
-        result["detail"] = (
-            f"No AMI defined for region '{region}'. "
-            f"Supported: {', '.join(AMI_MAP.keys())}"
-        )
+    ami_id = getattr(getattr(cfg, "machine", None), "ami_id", None)
+    published = AMI_MAP.get(region)
+
+    if not ami_id:
+        return _check_default_client_ami(region, published)
+
+    try:
+        from lablink_cli.commands.setup import _get_session
+
+        session = _get_session(region)
+        session.client("ec2").describe_images(ImageIds=[ami_id])
+    except Exception as e:
+        if "InvalidAMIID" in str(e):
+            if published:
+                hint = f"use {published}"
+            else:
+                hint = (
+                    f"clear machine.ami_id to resolve a Deep Learning Base AMI for "
+                    f"{region} automatically, or copy an image from "
+                    f"{', '.join(AMI_MAP)} into {region}"
+                )
+            result["detail"] = f"{ami_id} does not exist in {region} — {hint}"
+        else:
+            # No credentials, no ec2:DescribeImages, network trouble: unverified is
+            # not the same as wrong, so warn rather than failing a good config.
+            result["status"] = "warn"
+            result["detail"] = f"Could not verify {ami_id} in {region}: {e}"
+        return result
+
+    result["status"] = "pass"
+    result["detail"] = f"{ami_id} exists in {region}"
+    if published and ami_id != published:
+        result["detail"] += " (custom, not the image LabLink publishes there)"
 
     return result
 
@@ -288,9 +413,12 @@ def _check_aws_prereqs() -> None:
     # 5. S3 state bucket
     checks.append(_check_s3_bucket(cfg))
 
-    # 6. AMI for region
+    # 6. Client AMI
     checks.append(_check_ami(cfg))
 
+    # 7. Viewer streaming
+    checks.append(_check_viewer_streaming(cfg))
+
     _render_checks(
         checks,
         pass_message=(

{lablink_cli-0.2.0 → lablink_cli-0.4.0}/src/lablink_cli/config/schema.py

@@ -114,12 +114,22 @@ def validate_config(cfg: Config) -> list[str]:
     return errors
 
 
-# AMI IDs by region (Ubuntu 24.04 with Docker + Nvidia GPU Driver)
+# Regions LabLink publishes a client image in (Ubuntu 24.04 + Docker + NVIDIA driver).
+#
+# This is a suggestion, not a limit. Only client VMs need a custom image, because the
+# GPU drivers are baked in; the allocator boots stock Ubuntu resolved per region from
+# an SSM parameter, so it constrains nothing. Any region works if machine.ami_id names
+# an image that exists there — a copy of one of these, or an AWS Deep Learning Base
+# AMI — and doctor asks EC2 rather than trusting this table.
+#
+# AMI IDs are region-scoped, so every entry here is a distinct ID. A repeated ID means
+# some region points at another region's image, which is a config that passes every
+# local check and then fails to launch: that is exactly what this map used to do, with
+# four regions sharing one us-west-2 ID.
 AMI_MAP: dict[str, str] = {
-    "us-east-1": "ami-0601752c11b394251",
-    "us-east-2": "ami-0601752c11b394251",
-    "us-west-1": "ami-0601752c11b394251",
     "us-west-2": "ami-0601752c11b394251",
+    "us-east-1": "ami-0c3412413810adacc",
+    "us-east-2": "ami-0cd7567480c4840a0",
 }
 
 # Common GPU instance types

{lablink_cli-0.2.0 → lablink_cli-0.4.0}/src/lablink_cli.egg-info/PKG-INFO

@@ -1,13 +1,13 @@
 Metadata-Version: 2.4
 Name: lablink-cli
-Version: 0.2.0
+Version: 0.4.0
 Summary: CLI tool for deploying and managing LabLink infrastructure
 Author-email: Elizabeth Berrigan <eberrigan@salk.edu>, Talmo Pereira <talmo@salk.edu>, Andrew Park <hep003@ucsd.edu>
 Project-URL: Homepage, https://github.com/talmolab/lablink
 Project-URL: Issues, https://github.com/talmolab/lablink/issues
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: lablink-allocator-service[config]>=0.2.0
+Requires-Dist: lablink-allocator-service[config]>=0.4.0
 Requires-Dist: typer>=0.15
 Requires-Dist: textual>=3.0
 Requires-Dist: rich>=13.0

{lablink_cli-0.2.0 → lablink_cli-0.4.0}/src/lablink_cli.egg-info/requires.txt

@@ -1,4 +1,4 @@
-lablink-allocator-service[config]>=0.2.0
+lablink-allocator-service[config]>=0.4.0
 typer>=0.15
 textual>=3.0
 rich>=13.0

{lablink_cli-0.2.0 → lablink_cli-0.4.0}/tests/test_deploy_compose.py

@@ -423,14 +423,41 @@ class TestRenderComposeDirParticipantExposure:
 
 
 class TestDeployComposeMeshOverlayPreflight:
+    @patch("getpass.getpass", return_value="")
     @patch("lablink_cli.commands.deploy_compose._tailscale_state_volume_exists")
-    def test_first_deploy_without_authkey_rejected(self, mock_state_exists, tmp_path):
+    def test_first_deploy_without_authkey_and_empty_prompt_rejected(
+        self, mock_state_exists, mock_getpass, tmp_path
+    ):
+        """Declining the prompt (empty answer) is still a hard stop — the
+        sidecar cannot join a tailnet without a key."""
         from lablink_cli.commands.deploy_compose import run_deploy_compose
 
         mock_state_exists.return_value = False
         cfg = _manual_cfg(connectivity="mesh_overlay", overlay_tailnet="example.ts.net")
         with pytest.raises(SystemExit):
             run_deploy_compose(cfg, yes=True, workdir_root=tmp_path)
+        mock_getpass.assert_called_once()
+
+    @patch("getpass.getpass", return_value="tskey-typed")
+    @patch("lablink_cli.commands.deploy_compose._print_summary")
+    @patch("lablink_cli.commands.deploy_compose._health_poll")
+    @patch("lablink_cli.commands.deploy_compose._compose_up")
+    @patch("lablink_cli.commands.deploy_compose._tailscale_state_volume_exists")
+    def test_first_deploy_without_authkey_prompts_and_uses_the_answer(
+        self, mock_state_exists, mock_up, mock_poll, mock_summary, mock_getpass,
+        tmp_path,
+    ):
+        """getpass, not input(): the key must stay off the terminal (and out
+        of shell history) exactly like the admin password."""
+        from lablink_cli.commands.deploy_compose import run_deploy_compose
+
+        mock_state_exists.return_value = False
+        cfg = _manual_cfg(connectivity="mesh_overlay", overlay_tailnet="example.ts.net")
+        run_deploy_compose(cfg, yes=True, workdir_root=tmp_path)
+
+        mock_getpass.assert_called_once()
+        env_content = (tmp_path / "testlab" / ".env").read_text()
+        assert "TS_AUTHKEY=tskey-typed" in env_content
 
     @patch("lablink_cli.commands.deploy_compose._print_summary")
     @patch("lablink_cli.commands.deploy_compose._health_poll")
@@ -493,15 +520,18 @@ class TestDeployComposeMeshOverlayPreflight:
     @patch("lablink_cli.commands.deploy_compose._print_summary")
     @patch("lablink_cli.commands.deploy_compose._health_poll")
     @patch("lablink_cli.commands.deploy_compose._compose_up")
+    @patch("getpass.getpass", return_value="")
     def test_switch_from_lan_direct_without_authkey_rejected(
-        self, mock_up, mock_poll, mock_summary, mock_state_exists, tmp_path
+        self, mock_getpass, mock_up, mock_poll, mock_summary, mock_state_exists,
+        tmp_path,
     ):
         """Regression guard: an existing lan_direct deployment (its .env
         has no TS_AUTHKEY line) that switches manual.connectivity to
-        mesh_overlay must still be required to pass --tailscale-authkey.
+        mesh_overlay must still be asked for an authkey.
         ".env exists" alone is not a valid proxy for "an authkey is on
         record" — without this guard the preflight silently skipped the
-        check and render_compose_dir wrote TS_AUTHKEY= (empty)."""
+        check and render_compose_dir wrote TS_AUTHKEY= (empty). The empty
+        prompt answer here stands in for the operator having none."""
         from lablink_cli.commands.deploy_compose import run_deploy_compose
 
         mock_state_exists.return_value = False
@@ -540,7 +570,10 @@ class TestDeployComposeMeshOverlayPreflight:
 
 class TestDeployComposeParticipantExposurePreflight:
     @patch("lablink_cli.commands.deploy_compose._tailscale_state_volume_exists")
-    def test_lan_direct_with_funnel_requires_authkey(self, mock_state_exists, tmp_path):
+    @patch("getpass.getpass", return_value="")
+    def test_lan_direct_with_funnel_requires_authkey(
+        self, mock_getpass, mock_state_exists, tmp_path
+    ):
         """A lan_direct deployment that enables tailscale_funnel still
         needs the sidecar to join a tailnet — same requirement as
         mesh_overlay, generalized."""
@@ -2418,7 +2451,10 @@ class TestCloudflareTunnelPreflights:
             **kw,
         )
 
-    def test_first_deploy_without_token_is_rejected(self, tmp_path):
+    @patch("getpass.getpass", return_value="")
+    def test_first_deploy_without_token_and_empty_prompt_is_rejected(
+        self, mock_getpass, tmp_path
+    ):
         from lablink_cli.commands.deploy_compose import run_deploy_compose
 
         with pytest.raises(SystemExit):
@@ -2427,9 +2463,31 @@ class TestCloudflareTunnelPreflights:
                 yes=True,
                 workdir_root=tmp_path,
                 # Supplied so the sidecar's own authkey preflight can't be
-                # what raises — this test is about the tunnel token.
+                # what prompts — this test is about the tunnel token.
                 tailscale_authkey="tskey-abc",
             )
+        mock_getpass.assert_called_once()
+
+    @patch("getpass.getpass", return_value="eyJhIjoiTYPED")
+    @patch("lablink_cli.commands.deploy_compose._verify_public_hostname")
+    @patch("lablink_cli.commands.deploy_compose._print_summary")
+    @patch("lablink_cli.commands.deploy_compose._health_poll")
+    @patch("lablink_cli.commands.deploy_compose._compose_up")
+    def test_first_deploy_without_token_prompts_and_uses_the_answer(
+        self, mock_up, mock_poll, mock_summary, mock_verify, mock_getpass, tmp_path
+    ):
+        from lablink_cli.commands.deploy_compose import run_deploy_compose
+
+        run_deploy_compose(
+            self._cf_cfg(),
+            yes=True,
+            workdir_root=tmp_path,
+            tailscale_authkey="tskey-abc",
+        )
+
+        mock_getpass.assert_called_once()
+        env_content = (tmp_path / "testlab" / ".env").read_text()
+        assert "CLOUDFLARE_TUNNEL_TOKEN=eyJhIjoiTYPED" in env_content
 
     def test_empty_public_hostname_is_rejected(self, tmp_path):
         from lablink_cli.commands.deploy_compose import run_deploy_compose

{lablink_cli-0.2.0 → lablink_cli-0.4.0}/tests/test_doctor.py

@@ -5,8 +5,11 @@ from __future__ import annotations
 import json
 from unittest.mock import MagicMock, patch
 
+import pytest
+
 
 from lablink_cli.commands.doctor import (
+    _check_viewer_streaming,
     _check_ami,
     _check_opentofu,
 )
@@ -121,24 +124,108 @@ class TestCheckOpenTofu:
 # ------------------------------------------------------------------
 # _check_ami
 # ------------------------------------------------------------------
+def _ami_cfg(region, ami_id):
+    cfg = MagicMock()
+    cfg.app.region = region
+    cfg.machine.ami_id = ami_id
+    return cfg
+
+
 class TestCheckAmi:
     def test_no_config(self):
         result = _check_ami(None)
         assert result["status"] == "warn"
 
-    def test_supported_region(self):
-        cfg = MagicMock()
-        cfg.app.region = "us-east-1"
-        result = _check_ami(cfg)
+    @patch("lablink_cli.commands.setup._get_session")
+    def test_empty_ami_id_resolves_the_fallback(self, mock_session):
+        """Empty is the recommended value, not a gap: the client terraform resolves a
+        Deep Learning Base AMI for the region, so doctor resolves the same image and
+        reports which one."""
+        mock_session.return_value.client.return_value.describe_images.return_value = {
+            "Images": [
+                {"ImageId": "ami-old", "Name": "DLAMI 24.04 20260101",
+                 "CreationDate": "2026-01-01T00:00:00.000Z"},
+                {"ImageId": "ami-new", "Name": "DLAMI 24.04 20260828",
+                 "CreationDate": "2026-08-28T00:00:00.000Z"},
+            ]
+        }
+        result = _check_ami(_ami_cfg("eu-west-1", ""))
         assert result["status"] == "pass"
-        assert "ami-" in result["detail"]
+        assert "ami-new" in result["detail"], "must pick the newest, like most_recent"
+        assert "ami-old" not in result["detail"]
+
+    @patch("lablink_cli.commands.setup._get_session")
+    def test_empty_ami_id_fails_where_no_fallback_is_published(self, mock_session):
+        mock_session.return_value.client.return_value.describe_images.return_value = {
+            "Images": []
+        }
+        result = _check_ami(_ami_cfg("us-west-2", ""))
+        assert result["status"] == "fail"
+        # should suggest the published image for the region
+        assert "ami-0601752c11b394251" in result["detail"]
 
-    def test_unsupported_region(self):
-        cfg = MagicMock()
-        cfg.app.region = "ap-south-1"
-        result = _check_ami(cfg)
+    @patch("lablink_cli.commands.setup._get_session")
+    def test_empty_ami_id_warns_when_unverifiable(self, mock_session):
+        mock_session.return_value.client.return_value.describe_images.side_effect = (
+            Exception("AuthFailure")
+        )
+        result = _check_ami(_ami_cfg("eu-west-1", ""))
+        assert result["status"] == "warn"
+
+    @patch("lablink_cli.commands.setup._get_session")
+    def test_wrong_region_ami_suggests_clearing_the_field(self, mock_session):
+        """The fix an operator most wants in an unpublished region is 'clear it'."""
+        mock_session.return_value.client.return_value.describe_images.side_effect = (
+            Exception("An error occurred (InvalidAMIID.NotFound)")
+        )
+        result = _check_ami(_ami_cfg("eu-west-1", "ami-0601752c11b394251"))
         assert result["status"] == "fail"
-        assert "No AMI" in result["detail"]
+        assert "clear machine.ami_id" in result["detail"]
+
+    @patch("lablink_cli.commands.setup._get_session")
+    def test_existing_ami_passes(self, mock_session):
+        result = _check_ami(_ami_cfg("us-west-2", "ami-0601752c11b394251"))
+        assert result["status"] == "pass"
+        mock_session.return_value.client.return_value.describe_images.assert_called_once_with(
+            ImageIds=["ami-0601752c11b394251"]
+        )
+
+    @patch("lablink_cli.commands.setup._get_session")
+    def test_missing_ami_fails(self, mock_session):
+        mock_session.return_value.client.return_value.describe_images.side_effect = (
+            Exception("An error occurred (InvalidAMIID.NotFound)")
+        )
+        result = _check_ami(_ami_cfg("us-west-2", "ami-00000000000000000"))
+        assert result["status"] == "fail"
+        assert "does not exist in us-west-2" in result["detail"]
+
+    @patch("lablink_cli.commands.setup._get_session")
+    def test_unpublished_region_with_its_own_image_passes(self, mock_session):
+        """The old check failed any region absent from AMI_MAP. An operator who
+        copied an image into eu-west-1 has a working config, and saying otherwise
+        sends them to fix something that is not broken."""
+        result = _check_ami(_ami_cfg("eu-west-1", "ami-0abcdef1234567890"))
+        assert result["status"] == "pass"
+        assert "eu-west-1" in result["detail"]
+
+    @patch("lablink_cli.commands.setup._get_session")
+    def test_unverifiable_warns_rather_than_fails(self, mock_session):
+        """No credentials or no ec2:DescribeImages means unknown, not wrong."""
+        mock_session.return_value.client.return_value.describe_images.side_effect = (
+            Exception("AuthFailure")
+        )
+        result = _check_ami(_ami_cfg("us-west-2", "ami-0601752c11b394251"))
+        assert result["status"] == "warn"
+
+    @patch("lablink_cli.commands.setup._get_session")
+    def test_us_east_1_no_longer_gets_a_us_west_2_ami(self, mock_session):
+        """AMI_MAP used to hand us-east-1 the us-west-2 ID and call it a pass."""
+        from lablink_cli.config.schema import AMI_MAP
+
+        assert AMI_MAP["us-east-1"] != AMI_MAP["us-west-2"]
+        result = _check_ami(_ami_cfg("us-east-1", AMI_MAP["us-west-2"]))
+        assert result["status"] == "pass"
+        assert "custom" in result["detail"]
 
 
 # ------------------------------------------------------------------
@@ -354,3 +441,42 @@ class TestRunClientDoctor:
         assert "Registered" in out
         assert "Log shipper" in out
         assert "All checks passed" in out
+
+
+# ------------------------------------------------------------------
+# _check_viewer_streaming
+# ------------------------------------------------------------------
+def _ssl_cfg(provider):
+    cfg = MagicMock()
+    cfg.ssl.provider = provider
+    return cfg
+
+
+class TestCheckViewerStreaming:
+    def test_no_config(self):
+        result = _check_viewer_streaming(None)
+        assert result["status"] == "warn"
+
+    def test_http_deployment_warns_with_a_way_to_test(self):
+        """The whole point: an HTTP deployment silently loses H.264, and the
+        operator sees 'laggy desktop', not 'ssl.provider is none'."""
+        result = _check_viewer_streaming(_ssl_cfg("none"))
+        assert result["status"] == "warn"
+        assert "JPEG/WebP" in result["detail"]
+        assert "localhost" in result["detail"], "must name the port-forward workaround"
+
+    def test_warns_rather_than_fails(self):
+        """HTTP is a supported deployment, just a slower one — failing preflight
+        over a performance cliff would block a legitimate config."""
+        assert _check_viewer_streaming(_ssl_cfg("none"))["status"] != "fail"
+
+    @pytest.mark.parametrize("provider", ["letsencrypt", "cloudflare", "acm"])
+    def test_https_providers_pass(self, provider):
+        result = _check_viewer_streaming(_ssl_cfg(provider))
+        assert result["status"] == "pass"
+        assert provider in result["detail"]
+
+    def test_missing_ssl_section_is_treated_as_http(self):
+        cfg = MagicMock()
+        cfg.ssl.provider = None
+        assert _check_viewer_streaming(cfg)["status"] == "warn"

{lablink_cli-0.2.0 → lablink_cli-0.4.0}/tests/test_schema.py

@@ -235,10 +235,14 @@ class TestReferenceData:
         assert not DEPLOYMENT_NAME_RE.match("-invalid")
         assert not DEPLOYMENT_NAME_RE.match("invalid-")
 
-    def test_ami_map_has_regions(self):
-        assert len(AMI_MAP) > 0
-        for region, ami in AMI_MAP.items():
+    def test_ami_map_gives_each_region_its_own_image(self):
+        """AMI IDs are region-scoped, so a repeated ID means some region is
+        pointing at another region's image — which is how this map used to
+        claim four regions with one us-west-2 AMI."""
+        assert "us-west-2" in AMI_MAP
+        for ami in AMI_MAP.values():
             assert ami.startswith("ami-")
+        assert len(set(AMI_MAP.values())) == len(AMI_MAP)
 
     def test_gpu_instance_types_structure(self):
         assert len(GPU_INSTANCE_TYPES) > 0