letify 2.10.2__tar.gz → 2.10.3__tar.gz

{letify-2.10.2 → letify-2.10.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: letify
-Version: 2.10.2
+Version: 2.10.3
 Summary: Declarations that become infrastructure.
 Project-URL: Homepage, https://github.com/DarkPyonix/letify
 Project-URL: Documentation, https://github.com/DarkPyonix/letify/tree/main/docs

{letify-2.10.2 → letify-2.10.3}/docs/SPEC.md

@@ -281,6 +281,7 @@ Not opening a link is a decision of this project, not a rule of Kaggle's. Two so
 - **Token input and notebook owner.** `letify login kaggle <alias>` accepts `--key` or hidden input asking for the API token exactly as kaggle.com shows it, including `KGAT_`. It requires that prefix and a nonempty body with no whitespace; it does not strip or reformat the token. Length is not fixed because the measured 32-character body establishes a working token, not a universal length contract. A malformed token is refused with a message naming what to paste, before any cookie verification or file write. The token is not verified online at login. A renewal asks for each credential rather than reusing what is on disk, and a blank answer keeps the stored one. The two credentials expire on different clocks: the cookie is a thirty day web session and the token lasts until it is rotated, so renewing one must not demand the other. `letify login kaggle <alias> --replace` therefore prompts for the token and then the cookie, each saying that blank keeps what is stored, and writes only what was answered. A blank answer with nothing stored is refused, naming what to paste. Silently reusing a stored credential would make a renewal a no-op with no way to replace a credential that stopped working. Login retains `--username` or a username prompt and stores it in `username` beside the credentials with mode 0600. This is only the owner for `kernels delete -y <owner>/<slug>`, not an authentication credential. Explicit input avoids another authenticated lookup and does not mistake a cookie display name for an owner. The owner is not read from an authenticated call. Reading an existing `access_token` file strips leading and trailing whitespace, including a trailing newline, before CLI calls or reuse by login when `--key` is omitted. Explicit `--key` and prompted token input still reject whitespace rather than reformatting it, so adding an owner with `--username` does not require pasting the token again. The owner is a public Kaggle username, not a secret, and its file uses the same owner-only permissions as the account directory. Login refuses a missing or blank owner before cookie verification or any file write. Nothing is written until both credentials, the owner and cookie verification pass. Before any session starts or notebook is created, `open_channel` requires a readable, nonempty `username` file. An incomplete account is refused with `ConfigError` naming the login command, so a run cannot reach teardown without a notebook owner.
 - **The cookie carries an ``exp`` claim, but that claim is not proof the cookie still works.** The `CLIENT-TOKEN` cookie is an `alg:none` JWT whose `exp` claim was thirty days after the login that minted it, in every case observed. But a live account has been seen with over nine days left on that claim while every internal call, including the plain `users.UsersService/GetCurrentUser` read, answered as a refused, anonymous session: Kaggle invalidates a cookie server side, for reasons this project has not pinned down, without the claim changing to say so. So `exp` is useful for exactly one direction: a cookie past its `exp` is certainly dead. It says nothing about a cookie before its `exp`, which may be live or may already be refused.
   - **Two checks, for two costs.** An offline check reads only the claim, costs no network call, and is what `letify providers` shows as the account's `exp claim says N days left (not checked live; see letify usage)`, or `EXPIRED` once `exp` has passed. An online check additionally calls `GetCurrentUser`, the same call the login proved the cookie with, and is made once per session start (`open_channel`) and once per `letify usage` read, each result trusted for sixty seconds so starting several runtimes together costs one round trip rather than one per runtime. A run whose cookie fails either check is refused with `ConfigError`: missing or past `exp` says exactly that; refused online says "the Kaggle cookie has not expired, but Kaggle no longer accepts it", which is the one fact that check establishes, never a guess at why. A run is also refused when fewer than one hour is left on the `exp` claim, since starting a session the claim says the cookie cannot outlive risks it dying mid run with no way to tell that apart from any other lost runtime; this offline guard and the online check both have to pass.
+  - **A refused session can answer HTTP 400 with an empty body.** When the `XSRF-TOKEN` cookie in the stored cookie is no longer the one Kaggle issued for the session, `GetCurrentUser` answers HTTP 400, 401 or 403 instead of an empty account. The online check treats those three statuses as Kaggle refusing the cookie and reports `the Kaggle cookie was refused (HTTP <status>)` with the instruction to log in again. Any other HTTP status, such as 500, and any transport failure is not an answer about the cookie: the check reports `the Kaggle cookie could not be checked: HTTP <status>` or the exception class name, and the run fails as an infrastructure failure rather than as a bad cookie.
   - The online check is not made on every call into a running session, only at the two points above, so it is not the cost of every request a declared function makes.
 - Everything after that registration is what every other provider does: the session builds the declared environment with `uv sync`, enters a workspace root, transfers files and checks the worker's interpreter. Kaggle gets no exemption from any of it.
 

{letify-2.10.2 → letify-2.10.3}/letify/__init__.py

@@ -70,7 +70,7 @@ distributed: Final = Host.distributed
 # The enum class stays importable from letify.declare.instance for letify's own use.
 del Host
 
-__version__ = "2.10.2"
+__version__ = "2.10.3"
 
 
 def fetch(tensor):  # type: ignore[no-untyped-def]

{letify-2.10.2 → letify-2.10.3}/letify/providers/kaggle.py

@@ -89,6 +89,9 @@ RETIRED = {
 KAGGLE_INTERNAL = "https://www.kaggle.com/api/i/"
 KERNELS_SERVICE = "kernels.KernelsService/"
 USERS_SERVICE = "users.UsersService/"
+#: HTTP statuses ``GetCurrentUser`` answers for a session Kaggle no longer accepts. A stale
+#: ``XSRF-TOKEN`` cookie is answered with 400 and an empty body.
+REFUSING_STATUSES = frozenset({400, 401, 403})
 
 #: The host that routes to a session's Jupyter server, and the language id for Python.
 JUPYTER_PROXY_HOST = "https://kkb-production.jupyter-proxy.kaggle.net"
@@ -256,6 +259,13 @@ def verify_cookie(cookie: str) -> str:
     try:
         with urlopen(request) as response:
             body = json.loads(response.read())
+    except urllib.error.HTTPError as exc:
+        if exc.code in REFUSING_STATUSES:
+            raise ValueError(
+                f"the Kaggle cookie was refused (HTTP {exc.code}); log in to kaggle.com and "
+                f"copy a fresh cookie"
+            ) from None
+        raise ValueError(f"the Kaggle cookie could not be checked: HTTP {exc.code}") from None
     except (urllib.error.URLError, OSError, ValueError) as exc:
         raise ValueError(f"the Kaggle cookie could not be checked: {type(exc).__name__}") from None
     name = body.get("displayName") or (body.get("user") or {}).get("displayName")

{letify-2.10.2 → letify-2.10.3}/letify-core/Cargo.lock

@@ -138,11 +138,11 @@ dependencies = [
 
 [[package]]
 name = "letify"
-version = "2.10.2"
+version = "2.10.3"
 
 [[package]]
 name = "letify-quic"
-version = "2.10.2"
+version = "2.10.3"
 dependencies = [
  "quinn",
  "rcgen",

{letify-2.10.2 → letify-2.10.3}/letify-core/Cargo.toml

@@ -8,7 +8,7 @@ resolver = "3"
 members = ["letify", "letify-quic"]
 
 [workspace.package]
-version = "2.10.2"
+version = "2.10.3"
 edition = "2024"
 license = "MIT"
 repository = "https://github.com/DarkPyonix/letify"

{letify-2.10.2 → letify-2.10.3}/letify-ext/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "letify-status",
-  "version": "2.10.2",
+  "version": "2.10.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "letify-status",
-      "version": "2.10.2",
+      "version": "2.10.3",
       "license": "SEE LICENSE IN LICENSE",
       "devDependencies": {
         "@types/node": "^18.19.0",

{letify-2.10.2 → letify-2.10.3}/letify-ext/package.json

@@ -2,7 +2,7 @@
   "name": "letify-status",
   "displayName": "letify Status",
   "description": "letify quota and GPU activity in the status bar, read from the letify CLI.",
-  "version": "2.10.2",
+  "version": "2.10.3",
   "publisher": "darkpyonix",
   "license": "SEE LICENSE IN LICENSE",
   "repository": {

{letify-2.10.2 → letify-2.10.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "letify"
-version = "2.10.2"
+version = "2.10.3"
 description = "Declarations that become infrastructure."
 readme = "README.md"
 requires-python = ">=3.11"

{letify-2.10.2 → letify-2.10.3}/tests/test_kaggle.py

@@ -1759,3 +1759,37 @@ def test_a_worker_source_that_arrives_whole_still_runs() -> None:
     # The worker announces itself and then reads, so closing its input ends it cleanly.
     assert b"arrived" not in done.stderr, done.stderr[-2000:]
     assert done.stdout, "the worker said nothing, so it never started"
+
+
+def _http_error(code: int):
+    import io
+    import urllib.error
+
+    return urllib.error.HTTPError("https://www.kaggle.com/", code, "x", {}, io.BytesIO(b""))
+
+
+@pytest.mark.parametrize("code", [400, 401, 403])
+def test_an_http_error_that_refuses_the_session_reads_as_a_refused_cookie(
+    monkeypatch, code
+) -> None:
+    """Spec "Kaggle account": 400, 401 and 403 from GetCurrentUser mean the cookie is refused."""
+    from letify.providers import kaggle as kaggle_module
+
+    def refuse(request, timeout=None):
+        raise _http_error(code)
+
+    monkeypatch.setattr(kaggle_module, "urlopen", refuse)
+    with pytest.raises(ValueError, match=rf"was refused \(HTTP {code}\)"):
+        kaggle_module.verify_cookie(make_cookie())
+
+
+def test_a_server_error_during_the_cookie_check_names_its_status(monkeypatch) -> None:
+    """Spec "Kaggle account": any other status is a failed check, with the status shown."""
+    from letify.providers import kaggle as kaggle_module
+
+    def fail(request, timeout=None):
+        raise _http_error(503)
+
+    monkeypatch.setattr(kaggle_module, "urlopen", fail)
+    with pytest.raises(ValueError, match="could not be checked: HTTP 503"):
+        kaggle_module.verify_cookie(make_cookie())