letify 1.1.2__tar.gz → 1.2.0__tar.gz

{letify-1.1.2 → letify-1.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: letify
-Version: 1.1.2
+Version: 1.2.0
 Summary: Declarations that become infrastructure.
 Project-URL: Homepage, https://github.com/DarkPyonix/letify
 Project-URL: Documentation, https://github.com/DarkPyonix/letify/tree/main/docs
@@ -311,7 +311,7 @@ Provider
 | 🇰🇷 `Elice` | persistent | Korean GPU cloud, per-second billing |
 | 🏅 `Kaggle` | ephemeral | free weekly GPU hours, `host=letify.remote` only |
 
-**Kaggle.** Log in to kaggle.com in a browser and copy the `Cookie` request header of that tab (developer tools, Network, any kaggle.com request), then run `letify login kaggle kaggle_a`. The cookie is asked for without echo, and `--cookie` takes the value or a file holding it. letify checks its shape and its expiry before any network call, proves it with one request that returns your account, and keeps it in `~/.letify/accounts/kaggle_a/cookie` with mode 0600. The cookie expires 30 days after the browser login that made it, and nothing letify does extends that. `letify providers` and `letify usage kaggle_a` show `cookie expires in N days`, and a run on an expired cookie stops with an error telling you to log in again and repeat `letify login kaggle kaggle_a`. `letify usage kaggle_a` also prints the GPU hours left this week.
+**Kaggle.** Log in to kaggle.com in a browser and copy the `Cookie` request header of that tab (developer tools, Network, any kaggle.com request), then run `letify login kaggle kaggle_a`. The cookie is asked for without echo, and `--cookie` takes the value or a file holding it. letify checks its shape and its expiry before any network call, proves it with one request that returns your account, and keeps it in `~/.letify/accounts/kaggle_a/cookie` with mode 0600. The cookie expires 30 days after the browser login that made it, and nothing letify does extends that. `letify providers` and `letify usage kaggle_a` show `cookie expires in N days`, and a run on an expired cookie stops with an error telling you to log in again and repeat `letify login kaggle kaggle_a`. `letify usage kaggle_a` also prints the GPU hours left this week. Login also asks for your Kaggle username (the notebook owner) and the API token exactly as kaggle.com shows it, including `KGAT_`. The token is stored in `access_token` beside the cookie with mode 0600, and every Kaggle CLI command receives it through `KAGGLE_API_TOKEN`.
 
 No step in the Kaggle editor is needed. letify starts the session itself, on a private notebook it creates in your account, and stops it when your program ends. The session runs one worker inside one kernel cell, and frames travel as base64 lines: about 9 MiB/s up and 1.5 MiB/s down, measured from Seoul. letify builds your declared environment there with `uv sync`, ships files, checks the worker's interpreter, and runs calls until Kaggle ends the session, after 20 minutes idle or 12 hours. It never sends a keep-alive.
 

{letify-1.1.2 → letify-1.2.0}/README.md

@@ -286,7 +286,7 @@ Provider
 | 🇰🇷 `Elice` | persistent | Korean GPU cloud, per-second billing |
 | 🏅 `Kaggle` | ephemeral | free weekly GPU hours, `host=letify.remote` only |
 
-**Kaggle.** Log in to kaggle.com in a browser and copy the `Cookie` request header of that tab (developer tools, Network, any kaggle.com request), then run `letify login kaggle kaggle_a`. The cookie is asked for without echo, and `--cookie` takes the value or a file holding it. letify checks its shape and its expiry before any network call, proves it with one request that returns your account, and keeps it in `~/.letify/accounts/kaggle_a/cookie` with mode 0600. The cookie expires 30 days after the browser login that made it, and nothing letify does extends that. `letify providers` and `letify usage kaggle_a` show `cookie expires in N days`, and a run on an expired cookie stops with an error telling you to log in again and repeat `letify login kaggle kaggle_a`. `letify usage kaggle_a` also prints the GPU hours left this week.
+**Kaggle.** Log in to kaggle.com in a browser and copy the `Cookie` request header of that tab (developer tools, Network, any kaggle.com request), then run `letify login kaggle kaggle_a`. The cookie is asked for without echo, and `--cookie` takes the value or a file holding it. letify checks its shape and its expiry before any network call, proves it with one request that returns your account, and keeps it in `~/.letify/accounts/kaggle_a/cookie` with mode 0600. The cookie expires 30 days after the browser login that made it, and nothing letify does extends that. `letify providers` and `letify usage kaggle_a` show `cookie expires in N days`, and a run on an expired cookie stops with an error telling you to log in again and repeat `letify login kaggle kaggle_a`. `letify usage kaggle_a` also prints the GPU hours left this week. Login also asks for your Kaggle username (the notebook owner) and the API token exactly as kaggle.com shows it, including `KGAT_`. The token is stored in `access_token` beside the cookie with mode 0600, and every Kaggle CLI command receives it through `KAGGLE_API_TOKEN`.
 
 No step in the Kaggle editor is needed. letify starts the session itself, on a private notebook it creates in your account, and stops it when your program ends. The session runs one worker inside one kernel cell, and frames travel as base64 lines: about 9 MiB/s up and 1.5 MiB/s down, measured from Seoul. letify builds your declared environment there with `uv sync`, ships files, checks the worker's interpreter, and runs calls until Kaggle ends the session, after 20 minutes idle or 12 hours. It never sends a keep-alive.
 

{letify-1.1.2 → letify-1.2.0}/docs/guide/07-troubleshooting.md

@@ -264,13 +264,7 @@ kind = "tunnel"
 mtu = 1280
 ```
 
-Then check whether the path is relayed, because a relayed Tailscale path has been measured as low as 2.2 Mbit/s across continents:
-
-```python
-let.providers.home_box.diagnose()
-```
-
-If it is relayed and UDP is blocked on your network, switch to `transport = "frp"` on TLS port 443. See [docs/NETWORK.md](../NETWORK.md).
+letify holds every connection strategy, Tailcat's hole punch included, to a floor: a probe below 5 MiB/s or above 300 ms round trip fails the connection instead of completing it, because a slow link is a failure, not a fallback. See [docs/SPEC.md, Link floor](../SPEC.md#link-floor). If the connection now fails with "below the floor", that is the diagnosis: the path is too slow to use, usually because Tailcat's own direct UDP punch did not succeed and it fell back to a relay. No relay path is offered as an alternative, so fix the underlying reachability instead: open the UDP port the punch needs, or set `address` to a direct SSH path if one exists on the same network. See [docs/NETWORK.md](../NETWORK.md).
 
 ### Gathered calls are not running in parallel
 

{letify-1.1.2 → letify-1.2.0}/docs/guide/ko/07-/353/254/270/354/240/234-/355/225/264/352/262/260.md

@@ -264,13 +264,7 @@ kind = "tunnel"
 mtu = 1280
 ```
 
-그다음 경로가 중계인지 확인하세요. 중계된 Tailscale 경로는 대륙 간에서 2.2Mbit/s까지 측정된 사례가 있습니다.
-
-```python
-let.providers.home_box.diagnose()
-```
-
-중계이고 망에서 UDP가 막혀 있으면 TLS 443을 쓰는 `transport = "frp"`로 바꾸세요. [docs/NETWORK.md](../../NETWORK.md)를 보세요.
+letify는 Tailcat 홀펀칭을 포함한 모든 연결 전략을 바닥값에 묶어 둡니다: 측정값이 5 MiB/s 미만이거나 왕복 300 ms를 넘으면 연결을 완료시키는 대신 실패시킵니다. 느린 링크는 폴백이 아니라 실패이기 때문입니다. [docs/SPEC.md의 Link floor](../../SPEC.md#link-floor)를 보세요. 이제 "below the floor"로 연결이 실패한다면 그것이 진단입니다: 경로가 너무 느려 쓸 수 없고, 보통 Tailcat의 직접 UDP 홀펀칭이 성공하지 못해 중계로 떨어졌기 때문입니다. 대안으로 중계 경로를 제공하지 않으므로, 도달성 자체를 고치세요: 홀펀칭에 필요한 UDP 포트를 열거나, 같은 망에 직접 SSH 경로가 있다면 `address`를 설정하세요. [docs/NETWORK.md](../../NETWORK.md)를 보세요.
 
 ### 모은 호출이 병렬로 돌지 않습니다
 

{letify-1.1.2 → letify-1.2.0}/docs/locales/README_ko.md

@@ -280,7 +280,7 @@ Provider
 | 🇰🇷 `Elice` | persistent | 한국 GPU 클라우드, 초 단위 과금 |
 | 🏅 `Kaggle` | ephemeral | 주간 무료 GPU 시간, `host=letify.remote` 전용 |
 
-**Kaggle.** 브라우저에서 kaggle.com에 로그인한 뒤 그 탭의 `Cookie` 요청 헤더를 복사하고(개발자 도구, Network, 아무 kaggle.com 요청), `letify login kaggle kaggle_a`를 실행합니다. 쿠키는 화면에 표시되지 않게 입력받고, `--cookie`로 값이나 값을 담은 파일을 넘겨도 됩니다. letify는 네트워크 호출 전에 쿠키의 형태와 만료를 검사하고, 계정을 돌려주는 요청 하나로 확인한 뒤 `~/.letify/accounts/kaggle_a/cookie`에 0600 권한으로 보관합니다. 쿠키는 그것을 만든 브라우저 로그인으로부터 30일 뒤에 만료되고, letify가 하는 어떤 일도 이를 연장하지 않습니다. `letify providers`와 `letify usage kaggle_a`는 `cookie expires in N days`를 보여 주고, 만료된 쿠키로 실행하면 다시 로그인해서 `letify login kaggle kaggle_a`를 반복하라는 오류로 멈춥니다. `letify usage kaggle_a`는 이번 주에 남은 GPU 시간도 보여 줍니다.
+**Kaggle.** 브라우저에서 kaggle.com에 로그인한 뒤 그 탭의 `Cookie` 요청 헤더를 복사하고(개발자 도구, Network, 아무 kaggle.com 요청), `letify login kaggle kaggle_a`를 실행합니다. 쿠키는 화면에 표시되지 않게 입력받고, `--cookie`로 값이나 값을 담은 파일을 넘겨도 됩니다. letify는 네트워크 호출 전에 쿠키의 형태와 만료를 검사하고, 계정을 돌려주는 요청 하나로 확인한 뒤 `~/.letify/accounts/kaggle_a/cookie`에 0600 권한으로 보관합니다. 쿠키는 그것을 만든 브라우저 로그인으로부터 30일 뒤에 만료되고, letify가 하는 어떤 일도 이를 연장하지 않습니다. `letify providers`와 `letify usage kaggle_a`는 `cookie expires in N days`를 보여 주고, 만료된 쿠키로 실행하면 다시 로그인해서 `letify login kaggle kaggle_a`를 반복하라는 오류로 멈춥니다. `letify usage kaggle_a`는 이번 주에 남은 GPU 시간도 보여 줍니다. 로그인은 노트북 owner인 Kaggle 사용자 이름과 kaggle.com에 표시된 `KGAT_` 포함 API 토큰도 입력받습니다. 토큰은 쿠키 옆 `access_token`에 0600 권한으로 저장하며, 모든 Kaggle CLI 명령에 `KAGGLE_API_TOKEN` 환경 변수로 전달합니다.
 
 Kaggle 편집기에서 할 일은 없습니다. letify가 계정에 비공개 노트북을 만들어 세션을 직접 시작하고, 프로그램이 끝나면 세션을 끝냅니다. 세션은 커널 셀 하나 안에서 워커 하나를 돌리고, 프레임은 base64 줄로 오갑니다. 서울에서 측정해 올리기 약 9 MiB/s, 내리기 약 1.5 MiB/s입니다. letify는 그 세션에서 선언된 환경을 `uv sync`로 만들고, 파일을 주고받고, 워커의 인터프리터를 검사하고, Kaggle이 세션을 끝낼 때까지 호출을 실행합니다. 세션은 20분 동안 쓰지 않거나 12시간이 지나면 끝납니다. keep-alive는 보내지 않습니다.
 

{letify-1.1.2 → letify-1.2.0}/letify/__init__.py

@@ -62,7 +62,7 @@ remote: Final = Host.remote
 # The enum class stays importable from letify.declare.instance for letify's own use.
 del Host
 
-__version__ = "1.1.2"
+__version__ = "1.2.0"
 
 
 def fetch(tensor):  # type: ignore[no-untyped-def]

{letify-1.1.2 → letify-1.2.0}/letify/cli.py

@@ -9,7 +9,10 @@ from __future__ import annotations
 
 import argparse
 import json
+import os
+import shutil
 import sys
+from pathlib import Path
 
 from . import __version__, render
 from .config import login
@@ -33,6 +36,10 @@ def build_parser() -> argparse.ArgumentParser:
     devices_parser.add_argument("--json", action="store_true", help="print the records unformatted")
     status_parser = sub.add_parser("status", help="show live runtimes and what they are costing")
     status_parser.add_argument("--json", action="store_true", help="print the records unformatted")
+    sessions_parser = sub.add_parser("sessions", help="list provider-owned sessions")
+    sessions_parser.add_argument(
+        "--json", action="store_true", help="print the records unformatted"
+    )
     sub.add_parser("stubs", help="write the provider types an editor completes")
 
     usage = sub.add_parser("usage", help="show what each account has left")
@@ -57,7 +64,9 @@ def build_parser() -> argparse.ArgumentParser:
         type=int,
         help="port forward SSH dials at --address when it differs from --port, for tunnel",
     )
-    log_in.add_argument("--key", help="SSH private key path")
+    log_in.add_argument(
+        "--key", help="SSH private key path; with --username, the Kaggle API token instead"
+    )
     log_in.add_argument(
         "--auth",
         choices=login.AUTH_METHODS,
@@ -89,6 +98,13 @@ def build_parser() -> argparse.ArgumentParser:
         "--billing-endpoint", dest="billing_endpoint", help="Elice billing API base URL"
     )
     log_in.add_argument("--account", help="account email, for Colab")
+    log_in.add_argument(
+        "--username",
+        help=(
+            "Kaggle username, with --key the API token from Settings > API on kaggle.com; "
+            "required, for everything the official CLI covers that the cookie does not"
+        ),
+    )
     log_in.add_argument(
         "--workspace",
         metavar="PATH",
@@ -108,7 +124,7 @@ def build_parser() -> argparse.ArgumentParser:
         metavar="COOKIE",
         help=(
             "the browser cookie of a logged-in kaggle.com tab, or a file holding it, for "
-            "kaggle; this is the whole Kaggle credential"
+            "kaggle; required alongside --username/--key, which the official CLI needs"
         ),
     )
     log_in.add_argument(
@@ -135,6 +151,11 @@ def build_parser() -> argparse.ArgumentParser:
         action="store_true",
         help="ask an already declared machine for its GPUs again and replace its devices table",
     )
+    log_in.add_argument(
+        "--replace",
+        action="store_true",
+        help="run the login again for an alias that already exists, to renew its credentials",
+    )
 
     log_out = sub.add_parser("logout", help="remove an account from this machine")
     log_out.add_argument("alias", help="provider alias to forget")
@@ -143,8 +164,13 @@ def build_parser() -> argparse.ArgumentParser:
     check.add_argument("alias", help="provider alias from the configuration")
 
     cache = sub.add_parser("cache", help="show the data caches, or clear a provider's")
-    cache.add_argument("action", nargs="?", choices=("clear",), help="clear a runtime cache")
-    cache.add_argument("alias", nargs="?", help="provider alias whose runtime cache to clear")
+    cache.add_argument(
+        "action",
+        nargs="?",
+        choices=("clear", "clean"),
+        help="clear a runtime cache or local cache",
+    )
+    cache.add_argument("alias", nargs="?", help="provider alias or local cache target to clear")
     cache.add_argument("--json", action="store_true", help="print the records unformatted")
 
     probe = sub.add_parser("probe", help="measure whether host='local' is worth using")
@@ -311,26 +337,114 @@ def _data_cache_request(let: Launcher, alias: str, clear: bool) -> dict:
             let.pool.release(runtime)
 
 
+def _measure_tree(path: Path) -> tuple[int, int]:
+    """Return (file_count, total_bytes) for all files under path."""
+    if not path.exists():
+        return 0, 0
+    if path.is_file():
+        return 1, path.stat().st_size
+    files = 0
+    total_bytes = 0
+    for root, _, filenames in os.walk(path):
+        for name in filenames:
+            p = Path(root) / name
+            try:
+                stat_res = p.stat(follow_symlinks=False)
+                files += 1
+                total_bytes += stat_res.st_size
+            except OSError:
+                pass
+    return files, total_bytes
+
+
 def _cache(let: Launcher, args: argparse.Namespace) -> int:
     """Spec "The cache command"."""
+    from .paths import (
+        accounts_directory,
+        cache_directory,
+        local_runtime_directory,
+        local_tmp_directory,
+        ssh_control_directory,
+        tools_directory,
+    )
     from .store import pathdata
 
     mib = 1 << 20
-    if args.action == "clear":
-        if not args.alias:
-            _fail("name the provider whose runtime cache to clear: letify cache clear <alias>")
+    local_trees: dict[str, tuple[Path, bool]] = {
+        "cache": (cache_directory(), True),
+        "tools": (tools_directory(), True),
+        "tmp": (local_tmp_directory(), True),
+        "ssh": (ssh_control_directory(), True),
+        "runtime": (local_runtime_directory(), True),
+        "accounts": (accounts_directory(), False),
+    }
+
+    if args.action in ("clear", "clean"):
+        target = args.alias
+        if not target:
+            _fail("name the provider or local tree to clear: letify cache clear <target>")
+            return 1
+        if target in ("accounts", "config", "config.toml"):
+            _fail(f"refused: {target} holds credentials or configuration and cannot be cleaned")
+            return 1
+
+        local_targets = ("cache", "tools", "tmp", "ssh", "runtime", "all")
+        if target in local_targets:
+            to_clean = ["cache", "tools", "tmp", "runtime"] if target == "all" else [target]
+            total_removed = 0
+            total_removed_bytes = 0
+            for item in to_clean:
+                dir_path, cleanable = local_trees[item]
+                if cleanable and dir_path.exists():
+                    cnt, sz = _measure_tree(dir_path)
+                    total_removed += cnt
+                    total_removed_bytes += sz
+                    for entry in list(dir_path.iterdir()):
+                        if entry.is_dir():
+                            shutil.rmtree(entry, ignore_errors=True)
+                        else:
+                            entry.unlink(missing_ok=True)
+            if args.json:
+                return _json(
+                    {
+                        "target": target,
+                        "removed": total_removed,
+                        "removed_bytes": total_removed_bytes,
+                    }
+                )
+            print(
+                f"{target}: removed {total_removed} files "
+                f"{total_removed_bytes / mib:.1f} MiB"
+            )
+            return 0
+
+        # Provider target
+        try:
+            result = _data_cache_request(let, target, True)
+        except LetifyError as exc:
+            _fail(str(exc))
             return 1
-        result = _data_cache_request(let, args.alias, True)
         if args.json:
-            return _json({"alias": args.alias, **result})
+            return _json({"alias": target, **result})
         print(
-            f"{args.alias}: removed {result['removed']} files "
+            f"{target}: removed {result['removed']} files "
             f"{result['removed_bytes'] / mib:.1f} MiB"
         )
         return 0
+
     digests = pathdata.DigestCache()
     pruned = digests.prune()
     digests.save()
+
+    local_stats: dict[str, dict] = {}
+    for name, (path, cleanable) in local_trees.items():
+        count, size_bytes = _measure_tree(path)
+        local_stats[name] = {
+            "files": count,
+            "bytes": size_bytes,
+            "cleanable": cleanable,
+        }
+
     records: list[dict] = []
     for alias in let.config.order:
         try:
@@ -351,10 +465,23 @@ def _cache(let: Launcher, args: argparse.Namespace) -> int:
                 "budget": result["budget"],
             }
         )
-    record = {"digests": {"entries": len(digests), "pruned": pruned}, "providers": records}
+    record = {
+        "digests": {"entries": len(digests), "pruned": pruned},
+        "local": local_stats,
+        "providers": records,
+    }
     if args.json:
         return _json(record)
+
     print(f"digest cache: {len(digests)} entries, {pruned} pruned")
+
+    local_rows = []
+    for name, (_path, cleanable) in local_trees.items():
+        st = local_stats[name]
+        clean_str = "yes" if cleanable else "no (credentials)"
+        local_rows.append([name, str(st["files"]), f"{st['bytes'] / mib:.1f} MiB", clean_str])
+    sys.stdout.write(render.table(["LOCAL", "FILES", "SIZE", "CLEANABLE"], local_rows, _out()))
+
     rows = []
     for row in records:
         if "unavailable" in row:
@@ -447,6 +574,7 @@ def _dispatch(args: argparse.Namespace) -> int:
                 "organization": args.organization,
                 "billing_endpoint": args.billing_endpoint,
                 "account": args.account,
+                "username": args.username,
                 "workspace": args.workspace,
                 "profile": args.profile,
                 "connect": args.connect,
@@ -457,6 +585,7 @@ def _dispatch(args: argparse.Namespace) -> int:
             token=args.token,
             interactive=args.interactive,
             install_key=args.install_key,
+            replace=args.replace,
         )
         try:
             fresh, home, project = login.log_in(answers, project=args.config)
@@ -464,9 +593,14 @@ def _dispatch(args: argparse.Namespace) -> int:
             _fail(str(exc))
             return 1
         if fresh:
-            _say("ok", f"{alias} declared in {home}")
+            what = "renewed" if args.replace else "declared"
+            _say("ok", f"{alias} {what} in {home}")
         else:
-            _say("warn", f"{alias} was already declared in {home}, so nothing was asked for")
+            _say(
+                "warn",
+                f"{alias} was already declared in {home}, so nothing was asked for. "
+                f"Pass --replace to renew its credentials",
+            )
         _say("ok", f"{alias} referenced in {project}, which is safe to commit")
         return 0
 
@@ -535,6 +669,16 @@ def _dispatch(args: argparse.Namespace) -> int:
         sys.stdout.write(render.table(["PROVIDER", "ACCELERATORS"], rows, _out()))
         return 0
 
+    if args.command == "sessions":
+        rows = let.sessions()
+        if args.json:
+            return _json(rows)
+        for row in rows:
+            names = ", ".join(row["sessions"])
+            detail = row.get("unavailable") or row.get("reason") or names or "no active sessions"
+            print(f"{row['alias']}  {detail}")
+        return 0
+
     if args.command == "status":
         status = let.status()
         if args.json:

{letify-1.1.2 → letify-1.2.0}/letify/config/login.py

@@ -63,6 +63,9 @@ class Answers:
     token: str | None = None
     interactive: bool = True
     install_key: bool = True
+    #: Run the kind's whole flow again for an alias that already exists, so a credential
+    #: can be renewed. Spec "Logging in".
+    replace: bool = False
 
     def get(self, name: str) -> Any:
         return self.values.get(name)
@@ -738,6 +741,7 @@ def colab_account(answers: Answers) -> dict[str, Any]:
         [*tools.command(tools.COLAB, uv), "sessions"],
         env=tools.environment(answers.alias),
     )
+    tools.sync_tool_credentials(answers.alias)
     if result.returncode != 0:
         raise LoginError(f"the Colab sign in exited {result.returncode}, so nothing was written")
     # The rendezvous installs this key's public half on each runtime, which is what lets
@@ -748,7 +752,7 @@ def colab_account(answers: Answers) -> dict[str, Any]:
     return options
 
 
-#: The cookie file and the prompt for it. The cookie is the whole Kaggle credential.
+#: The browser cookie file and its prompt.
 KAGGLE_COOKIE = "cookie"
 KAGGLE_COOKIE_PROMPT = "Kaggle cookie (from a logged-in kaggle.com tab): "
 
@@ -772,16 +776,56 @@ def read_kaggle_cookie(answers: Answers, given: str | None) -> str:
     return text
 
 
-def kaggle_account(answers: Answers) -> dict[str, Any]:
-    """Store the browser session cookie and prove it names a live login.
+#: The notebook owner and verbatim API token prompts.
+KAGGLE_OWNER_PROMPT = "Kaggle username (notebook owner): "
+KAGGLE_TOKEN_PROMPT = "Kaggle API token exactly as shown on kaggle.com, including KGAT_: "
+
+
+def read_kaggle_token(
+    answers: Answers, given_username: str | None, given_key: str | None
+) -> tuple[str, str]:
+    """Return the notebook owner and verbatim token, refusing malformed token input.
 
-    The cookie is the whole account: only the web session principal can mint the Jupyter
-    proxy token, so an API key is useless here. The cookie is checked for shape and expiry
-    before any network call, then proven with a read of the account. Nothing is written
-    until the check passes.
+    The owner addresses notebook deletion; only the token authenticates the CLI. Validate
+    the prefix and a nonempty whitespace-free body without imposing an unproven length.
+    """
+    username = (given_username or "").strip()
+    if not username and answers.interactive:
+        username = read_line(KAGGLE_OWNER_PROMPT).strip()
+    from ..providers.kaggle import read_api_token
+
+    key = given_key if given_key is not None else (read_api_token(answers.alias) or "")
+    if not key and answers.interactive:
+        key = read_password(KAGGLE_TOKEN_PROMPT)
+    if not username or not key:
+        raise LoginError(
+            f"{answers.alias} needs the Kaggle API token and notebook owner: pass "
+            f"--username <owner> and --key <KGAT_token> from kaggle.com, or drop --no-input."
+        )
+    if not key.startswith("KGAT_") or len(key) <= len("KGAT_") or any(
+        character.isspace() for character in key
+    ):
+        raise LoginError(
+            f"{answers.alias}: paste the Kaggle API token exactly as shown on kaggle.com, "
+            f"including KGAT_ and its nonempty body, with no whitespace."
+        )
+    return username, key
+
+
+def kaggle_account(answers: Answers) -> dict[str, Any]:
+    """Store the browser session cookie and the API token, and prove the cookie is live.
+
+    Two credentials, and both are required. The cookie starts and ends the interactive
+    session and mints its Jupyter proxy URL; it is checked for shape and expiry before any
+    network call, then proven with a read of the account. The API token runs the official
+    CLI for everything else, deleting the notebook a run created and reading the weekly
+    quota; it is checked for shape only, since proving it would mean calling the CLI
+    from inside login, which this function leaves to the first command that uses it.
+    Nothing is written until every check passes.
     """
     from ..providers import kaggle as kg
 
+    username, key = read_kaggle_token(answers, answers.get("username"), answers.get("key"))
     given = answers.get(KAGGLE_COOKIE) or answers.token
     cookie = read_kaggle_cookie(answers, given if isinstance(given, str) else None)
     try:
@@ -802,6 +846,8 @@ def kaggle_account(answers: Answers) -> dict[str, Any]:
     options: dict[str, Any] = {"kind": answers.kind}
     record_workspace(answers, options)
     store_secret(answers.alias, KAGGLE_COOKIE, cookie)
+    store_secret(answers.alias, "access_token", key)
+    store_secret(answers.alias, "username", username)
     return options
 
 
@@ -947,6 +993,8 @@ def log_in(answers: Answers, *, project: str | Path | None = None) -> tuple[bool
     Returns whether the account was newly written, and the two files touched. An account
     already in the home file is not asked for again, which is the common case in a second
     repository: the account was set up once and this project just needs to name it.
+    ``replace`` runs the flow again for such an account, which is how a credential is
+    renewed. Spec "Logging in".
     """
     check_alias(answers.alias)
     if answers.kind not in FLOWS:
@@ -955,7 +1003,8 @@ def log_in(answers: Answers, *, project: str | Path | None = None) -> tuple[bool
 
     home = home_path()
     existing = home.read_text(encoding="utf-8") if home.is_file() else ""
-    fresh = not writer.has_block(existing, answers.alias)
+    declared = not writer.has_block(existing, answers.alias)
+    fresh = declared or answers.replace
     devices = None
     if fresh:
         options = FLOWS[answers.kind](answers)

{letify-1.1.2 → letify-1.2.0}/letify/declare/function.py

@@ -161,7 +161,9 @@ class Function(Generic[R]):
                 # provider may name the failure first, such as a spot preemption.
                 exc = runtime.provider.diagnose(runtime, failure)
                 last = exc
-                launcher.pool.discard(runtime)
+                launcher.pool.discard(
+                    runtime, reason=f"infrastructure_failure:{type(exc).__name__}: {exc}"
+                )
                 if attempt == self.retries:
                     if isinstance(exc, SpotPreempted):
                         raise exc from failure
@@ -205,7 +207,9 @@ class Function(Generic[R]):
             _report_deferred(client.stats.snapshot() - before)
         except (RuntimeFailure, ProtocolError) as failure:
             named = runtime.provider.diagnose(runtime, failure)
-            launcher.pool.discard(runtime)
+            launcher.pool.discard(
+                runtime, reason=f"infrastructure_failure:{type(named).__name__}: {named}"
+            )
             if named is failure:
                 raise
             raise named from failure

{letify-1.1.2 → letify-1.2.0}/letify/install.py

@@ -205,6 +205,8 @@ def find(tool: str, *, link_cache: bool = True, say: Say = _say) -> str | None:
     if paths is not None and paths[0].is_file():
         recorded = _marker_version(paths[1]) if paths[1].is_file() else None
         if recorded is None or recorded == version_of(tool):
+            if not link_cache and recorded == version_of(tool) and cache_path(tool).is_file():
+                return str(cache_path(tool))
             return str(paths[0])
     cached = cache_path(tool)
     if cached.is_file():
@@ -517,6 +519,12 @@ def install(tool: str, *, say: Say = _say) -> Path:
         if final.exists():
             shutil.rmtree(final)
         os.replace(staging, final)
+        for entry in list(final.parent.iterdir()):
+            if entry.name != final.name and not entry.name.startswith("."):
+                if entry.is_dir():
+                    shutil.rmtree(entry, ignore_errors=True)
+                else:
+                    entry.unlink(missing_ok=True)
     except BaseException:
         shutil.rmtree(staging, ignore_errors=True)
         raise
@@ -604,3 +612,85 @@ __all__ = [
     "link",
     "where",
 ]
+
+
+def remote_tailcat_source() -> str:
+    """Prepare the pinned Linux binary on Colab using this installer's release metadata."""
+    import inspect
+
+    return (
+        inspect.getsource(_remote_tailcat)
+        + f"\nbinary = _remote_tailcat({TAILCAT_VERSION!r}, "
+        + f"{TAILCAT_RELEASE.format(version=TAILCAT_VERSION)!r}, {TAILCAT_SHA256!r})\n"
+        + "import json\nprint('LETIFY-TAILCAT ' + json.dumps(binary))\n"
+    )
+
+
+def _remote_tailcat(version, release, pins):
+    """Install a verified Linux tailcat using only the runtime's standard library."""
+    import hashlib
+    import io
+    import json
+    import os
+    import platform
+    import tarfile
+    import tempfile
+    import urllib.request
+    from pathlib import Path
+
+    arch = {"x86_64": "amd64", "aarch64": "arm64", "arm64": "arm64", "armv7l": "armv7"}.get(
+        platform.machine().lower()
+    )
+    asset = f"tailcat_{version}_linux_{arch}.tar.gz"
+    if platform.system() != "Linux" or asset not in pins:
+        raise RuntimeError(f"tailcat: unsupported runtime platform {platform.machine()}")
+    destination = Path.home() / ".letify" / "tools" / "tailcat" / version
+    binary = destination / "tailcat"
+    marker = destination / "verified.json"
+    if binary.is_file() and marker.is_file():
+        verified = json.loads(marker.read_text())
+        actual = hashlib.sha256(binary.read_bytes()).hexdigest()
+        if verified.get("archive") != pins[asset] or verified.get("binary") != actual:
+            raise RuntimeError("tailcat cached binary SHA-256 mismatch; refused")
+        return str(binary)
+    with urllib.request.urlopen(f"{release}/{asset}", timeout=60) as response:
+        data = response.read()
+    actual = hashlib.sha256(data).hexdigest()
+    if actual != pins[asset]:
+        raise RuntimeError(
+            f"tailcat archive SHA-256 mismatch: expected {pins[asset]}, got {actual}"
+        )
+    with tarfile.open(fileobj=io.BytesIO(data), mode="r:gz") as archive:
+        members = archive.getmembers()
+        if any(
+            Path(m.name).is_absolute()
+            or ".." in Path(m.name).parts
+            or m.isdev()
+            or m.islnk()
+            or m.issym()
+            for m in members
+        ):
+            raise RuntimeError("tailcat archive contains an unsafe member; refused")
+        candidates = [
+            m
+            for m in members
+            if m.isfile() and Path(m.name).name == "tailcat" and len(Path(m.name).parts) <= 2
+        ]
+        if len(candidates) != 1:
+            raise RuntimeError("tailcat archive must hold one regular tailcat binary")
+        payload = archive.extractfile(candidates[0]).read()
+    destination.mkdir(parents=True, exist_ok=True)
+    descriptor, temporary = tempfile.mkstemp(prefix=".tailcat-", dir=destination)
+    try:
+        with os.fdopen(descriptor, "wb") as handle:
+            handle.write(payload)
+        os.chmod(temporary, 0o555)
+        os.replace(temporary, binary)
+    finally:
+        if os.path.exists(temporary):
+            os.unlink(temporary)
+    marker.write_text(
+        json.dumps({"archive": actual, "binary": hashlib.sha256(payload).hexdigest()})
+    )
+    marker.chmod(0o444)
+    return str(binary)