nerdit 0.7.0__tar.gz → 0.7.2__tar.gz

{nerdit-0.7.0 → nerdit-0.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: nerdit
-Version: 0.7.0
+Version: 0.7.2
 Summary: The local AI PaaS — deploy and operate apps on your own hardware, with first-class local AI
 Project-URL: Homepage, https://github.com/nerdit-ai/nerdit
 Project-URL: Repository, https://github.com/nerdit-ai/nerdit
@@ -264,17 +264,18 @@ your own PostHog project.
 - hosted URLs
 
 Your machine connects out to the cloud, so you open no inbound port. Hosted
-shares are private to you by default. Public access needs an explicit
-publication and follows the [Terms](https://nerdit.ai/terms).
+shares are private by default: only you and the people you allow in the Nerdit
+App can open them. Public access needs an explicit publication and follows the
+[Terms](https://nerdit.ai/terms).
 
 Questions or feedback: [feedback@nerdit.ai](mailto:feedback@nerdit.ai).
 
 ## License
 
-Apache-2.0, see [LICENSE](https://github.com/nerdit-ai/nerdit/blob/v0.7.0/LICENSE). "Nerdit" and the logo are trademarks and
-are not covered by the code license, see [NOTICE](https://github.com/nerdit-ai/nerdit/blob/v0.7.0/NOTICE).
+Apache-2.0, see [LICENSE](https://github.com/nerdit-ai/nerdit/blob/v0.7.2/LICENSE). "Nerdit" and the logo are trademarks and
+are not covered by the code license, see [NOTICE](https://github.com/nerdit-ai/nerdit/blob/v0.7.2/NOTICE).
 
 ## Contributing
 
-Issues and pull requests are welcome. [CONTRIBUTING.md](https://github.com/nerdit-ai/nerdit/blob/v0.7.0/CONTRIBUTING.md)
+Issues and pull requests are welcome. [CONTRIBUTING.md](https://github.com/nerdit-ai/nerdit/blob/v0.7.2/CONTRIBUTING.md)
 explains how contributions land in releases.

{nerdit-0.7.0 → nerdit-0.7.2}/README.md

@@ -205,17 +205,18 @@ your own PostHog project.
 - hosted URLs
 
 Your machine connects out to the cloud, so you open no inbound port. Hosted
-shares are private to you by default. Public access needs an explicit
-publication and follows the [Terms](https://nerdit.ai/terms).
+shares are private by default: only you and the people you allow in the Nerdit
+App can open them. Public access needs an explicit publication and follows the
+[Terms](https://nerdit.ai/terms).
 
 Questions or feedback: [feedback@nerdit.ai](mailto:feedback@nerdit.ai).
 
 ## License
 
-Apache-2.0, see [LICENSE](https://github.com/nerdit-ai/nerdit/blob/v0.7.0/LICENSE). "Nerdit" and the logo are trademarks and
-are not covered by the code license, see [NOTICE](https://github.com/nerdit-ai/nerdit/blob/v0.7.0/NOTICE).
+Apache-2.0, see [LICENSE](https://github.com/nerdit-ai/nerdit/blob/v0.7.2/LICENSE). "Nerdit" and the logo are trademarks and
+are not covered by the code license, see [NOTICE](https://github.com/nerdit-ai/nerdit/blob/v0.7.2/NOTICE).
 
 ## Contributing
 
-Issues and pull requests are welcome. [CONTRIBUTING.md](https://github.com/nerdit-ai/nerdit/blob/v0.7.0/CONTRIBUTING.md)
+Issues and pull requests are welcome. [CONTRIBUTING.md](https://github.com/nerdit-ai/nerdit/blob/v0.7.2/CONTRIBUTING.md)
 explains how contributions land in releases.

{nerdit-0.7.0 → nerdit-0.7.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "nerdit"
-version = "0.7.0"
+version = "0.7.2"
 description = "The local AI PaaS — deploy and operate apps on your own hardware, with first-class local AI"
 readme = "README.md"
 license = "Apache-2.0"

{nerdit-0.7.0 → nerdit-0.7.2}/src/nerdit/__init__.py

@@ -1,3 +1,3 @@
 """Nerdit — Le moteur de l'IA locale."""
 
-__version__ = "0.7.0"
+__version__ = "0.7.2"

{nerdit-0.7.0 → nerdit-0.7.2}/src/nerdit/cli/commands/share.py

@@ -60,7 +60,9 @@ def share(
         False,
         "--public",
         help=(
-            "Make the URL world-reachable instead of owner-only. Needs an "
+            "Make the URL world-reachable instead of private (the owner of this "
+            "machine's Nerdit account and the people they allow in the Nerdit "
+            "App). Needs an "
             "active linked account AND either --consent or a \\[deploy].edge_auth "
             "block on the app."
         ),

{nerdit-0.7.0 → nerdit-0.7.2}/src/nerdit/cli/commands/uninstall.py

@@ -11,6 +11,7 @@ file may survive until reboot. Escape dynamic Rich text.
 
 from __future__ import annotations
 
+import contextlib
 import os
 import shutil
 import signal
@@ -691,6 +692,19 @@ def _remove_unit(unit: ServiceUnit) -> None:
     """Disable and remove the unit only after the data-dir lock proves the daemon is gone."""
     if unit.disable_argv != unit.stop_argv:  # launchd's bootout is both
         _run_unit_command(unit.disable_argv, note=" — continuing")
+    if unit.kind == "systemd-system":
+        # install.sh --template's drop-ins; an operator's own overrides stay.
+        # Before the base unit: unit discovery needs the base unit file, so a
+        # drop-in that outlived it would be invisible to a retried uninstall.
+        drop_in_dir = unit.unit_path.with_name(unit.unit_path.name + ".d")
+        names = ("10-fork-safe.conf", "20-docker0.conf", "30-deny-inbound.conf")
+        ours = [drop_in_dir / n for n in names]
+        if any(path_present(p) for p in ours):
+            for path in ours:
+                if path_present(path):
+                    _delete_path(path)
+            with contextlib.suppress(OSError):
+                drop_in_dir.rmdir()
     if path_present(unit.unit_path):
         _delete_path(unit.unit_path)
         console.print(f"[dim]Removed the service unit ({_plain(unit.unit_path)}).[/dim]")

{nerdit-0.7.0 → nerdit-0.7.2}/src/nerdit/cli/display.py

@@ -472,6 +472,9 @@ def display_wait_outcome(result: dict) -> None:
     outcome = result.get("outcome")
     name = _plain(result.get("service_name")) or "service"
     if outcome == "converged":
+        if result.get("status") == "stopped":  # a requested stop converged
+            console.print(f"[green]Converged:[/green] {name} is stopped")
+            return
         console.print(f"[green]Converged:[/green] {name} is healthy")
         url = result.get("public_url")
         if url:

{nerdit-0.7.0 → nerdit-0.7.2}/src/nerdit/core/eventlog.py

@@ -98,9 +98,10 @@ EVENT_TYPES: frozenset[str] = frozenset(
         # --- the owner's exposure decisions. `share.ready`: a share was set
         # or changed — `data` carries `{access}` and, for a PRIVATE share
         # only, `url`. A private hosted URL is not a bearer capability (the
-        # cloud edge still demands an owner session), while a PUBLIC one is
-        # world-reachable and this feed is POSTed to third-party webhook hosts,
-        # so the public URL is omitted. `share.removed`: the share was deleted
+        # cloud edge still demands a signed-in identity the owner allows),
+        # while a PUBLIC one is world-reachable and this feed is POSTed to
+        # third-party webhook hosts, so the public URL is omitted.
+        # `share.removed`: the share was deleted
         # (`reason` = `unshared` | `service_deleted`). Never the capability
         # token, never a navigation ticket.
         "share.ready",

{nerdit-0.7.0 → nerdit-0.7.2}/src/nerdit/core/services.py

@@ -25,7 +25,7 @@ import sqlite3
 import time
 from collections.abc import AsyncIterator, Awaitable, Callable, Coroutine, Iterable
 from dataclasses import dataclass, field
-from datetime import UTC, datetime
+from datetime import UTC, datetime, timedelta
 from enum import StrEnum
 from pathlib import Path
 
@@ -331,9 +331,15 @@ class RunPreconditionError(Exception):
 #: flushes a partial batch.
 _LOG_BATCH = 256
 _LOG_FLUSH_S = 0.25
-#: Stored rows of the resume second a re-adopted follow checks for replays.
-# ponytail: a busier resume second re-inserts its lines past this bound.
+#: Stored rows of the resume window a re-adopted follow checks for replays.
+# ponytail: a busier resume window re-inserts its lines past this bound.
 _LOG_RESUME_MAX = 4 * _LOG_BATCH
+#: Seconds a re-adopted follow rewinds behind the newest row's insert time.
+#: Docker's `since` is container emission time; rows carry insert time, which
+#: trails emission by the flush interval plus any reader backlog.
+# ponytail: a reader more than this far behind still loses its unread backlog;
+# persisting Docker's own line timestamps is the exact cursor.
+_LOG_RESUME_LAG_S = 10
 
 
 class RunInterruptedError(ContainerRuntimeError):
@@ -3054,16 +3060,20 @@ class ServiceController:
         """
         now = datetime.now(UTC)
         # Re-adopt the log stream if we are not already collecting it (reboot),
-        # resuming at the newest persisted row's second rather than replaying
-        # the container's whole log history into job_logs. Docker's `since` is
-        # inclusive and row timestamps are second-resolution insert times, so
-        # the rows already stored in that second are handed over as `seen`.
+        # resuming shortly before the newest persisted row rather than replaying
+        # the container's whole log history into job_logs. Row timestamps are
+        # second-resolution INSERT times while Docker's inclusive `since` is
+        # EMISSION time, so the follow rewinds `_LOG_RESUME_LAG_S` (a line
+        # emitted before the last insert but never read is not lost) and the
+        # rows stored since that point are handed over as `seen` to drop the
+        # replay. Any row emitted >= since was inserted >= since, so `seen`
+        # covers the whole replay.
         if job.container_id and job.container_id not in self._log_tasks:
             last = await self._queries.get_logs(job.id, tail=1, streams=[LogStream.stdout])
             since = None
             seen: list[str] = []
             if last:
-                ts = last[-1].timestamp
+                ts = last[-1].timestamp - timedelta(seconds=_LOG_RESUME_LAG_S)
                 since = int(ts.replace(tzinfo=UTC).timestamp())
                 rows = await self._queries.get_logs(
                     job.id,

{nerdit-0.7.0 → nerdit-0.7.2}/src/nerdit/daemon/routes/projects.py

@@ -253,6 +253,9 @@ class ApplyResponse(BaseModel):
     """`POST /projects/{project}/apply`: what was planned, applied, or is still missing."""
 
     project: str
+    project_id: str | None = Field(
+        default=None, description="The project's immutable id; null when a dry run creates it"
+    )
     status: Literal["applied", "planned", "waiting_for_variables"]
     dry_run: bool
     services: list[ApplyServiceResult] = Field(default_factory=list)
@@ -1313,6 +1316,7 @@ async def apply_project(
         if missing:
             return ApplyResponse(
                 project=project,
+                project_id=row.id if row is not None else None,
                 status="waiting_for_variables",
                 dry_run=dry_run,
                 missing=missing,
@@ -1329,6 +1333,7 @@ async def apply_project(
         # awaited planning step just as the real deployment checks at reservation.
         if row is not None:
             await _judge_apply_project(request, row.id)
+            result.project_id = row.id
         return result
     finally:
         # `_finalize_deploy` adds masked `ai` / `db` members to the params it

{nerdit-0.7.0 → nerdit-0.7.2}/src/nerdit/daemon/routes/service_logs_stream.py

@@ -132,7 +132,7 @@ async def _log_frames(
         max id first is what makes skipping safe: anything written after this
         read gets a strictly larger id.
         """
-        pre_max = await queries.max_log_id() if filtered else 0
+        pre_max = await queries.max_log_id(job_id) if filtered else 0
         entries = await queries.get_logs(
             job_id, since_id=cursor, grep=grep, since_ts=since_ts, limit=_POLL_CHUNK
         )

{nerdit-0.7.0 → nerdit-0.7.2}/src/nerdit/daemon/routes/service_wait.py

@@ -45,7 +45,11 @@ _WAIT_TERMINAL_STATUSES = frozenset({JobStatus.failed, JobStatus.stopped, JobSta
 
 
 def _evaluate_wait(
-    job: Job, resolved_version: int | None, version_aware: bool
+    job: Job,
+    resolved_version: int | None,
+    version_aware: bool,
+    *,
+    explicit_version: bool = False,
 ) -> tuple[str | None, dict | None]:
     """Compute the wait outcome for a freshly-read row (or `None` = keep waiting).
 
@@ -63,6 +67,18 @@ def _evaluate_wait(
         ld = None
     status = job.status
 
+    # A requested stop is its own target, for every kind: the row reads
+    # `desired_state=stopped` at once but keeps its live status (and any
+    # `healthy` phase) until the reconciler's next tick tears the container
+    # down, so converge only on `stopped` — never on the container still
+    # running, nor `failed` on the very stop the caller asked for: a `failed`
+    # or `cancelled` row is torn down to `stopped` by the same tick, and a
+    # teardown that never lands ends in an honest `timeout`. A wait for an
+    # explicit version (`deploy --wait`) keeps its target: a concurrent stop
+    # must not read as that version converging.
+    if job.desired_state == "stopped" and not explicit_version:
+        return ("converged" if status == JobStatus.stopped else None), ld
+
     # Model rows never carry a last_deploy phase machine
     # (ModelController._stamp_last_deploy_failed is a no-op for them), so
     # `version_aware` is always False here and the status-only branch below
@@ -309,7 +325,9 @@ async def wait_for_service(
     async with _WAIT_SEMAPHORE:
         started = time.monotonic()
         while True:
-            outcome, ld = _evaluate_wait(job, resolved_version, version_aware)
+            outcome, ld = _evaluate_wait(
+                job, resolved_version, version_aware, explicit_version=requested_version is not None
+            )
             waited = time.monotonic() - started
             if outcome is not None:
                 endpoint = await _endpoint_for(job)

{nerdit-0.7.0 → nerdit-0.7.2}/src/nerdit/daemon/routes/services.py

@@ -20,7 +20,6 @@ from nerdit.core.volumes import VolumeSpecError, service_data_root
 from nerdit.daemon.audit import audit_params
 from nerdit.daemon.auth import (
     QuotaExceeded,
-    current_principal,
     require_owner_or_admin,
     require_role,
     require_service_scope,
@@ -531,11 +530,7 @@ async def logs_for_job(  # noqa: PLR0913 - the bounded log query
     # there. Captured BEFORE the scan — anything written after this read gets a
     # strictly larger id, which is what makes skipping to it safe.
     paged = (grep or since_ts) and not (tail is not None and tail > 0)
-    watermark = (
-        await queries.max_log_id()
-        if paged and current_principal(request).project_id is None
-        else None
-    )
+    watermark = await queries.max_log_id(job.id) if paged else None
     # The forward branch carries the SAME cap as `tail` (the tail branch ignores
     # `limit`): without one, a parameterless GET returns the whole retained
     # history of a chatty service — tens of MB materialized as `LogEntry` objects

{nerdit-0.7.0 → nerdit-0.7.2}/src/nerdit/daemon/routes/share.py

@@ -294,7 +294,8 @@ async def set_share(request: Request, name: str, body: ShareRequest) -> ShareVie
     recorder = get_recorder()
     if recorder is not None:
         # A PRIVATE hosted URL is not a bearer capability — the cloud edge still
-        # demands an owner session — so it is safe to carry. A PUBLIC one is
+        # demands a signed-in identity the owner allows (the owner, or a person
+        # allowed in the Nerdit App) — so it is safe to carry. A PUBLIC one is
         # omitted: this feed is POSTed verbatim to operator-configured webhook
         # hosts, and a world-reachable address does not need to travel there.
         data: dict[str, object] = {"access": share.access}

{nerdit-0.7.0 → nerdit-0.7.2}/src/nerdit/daemon/schemas/exposure.py

@@ -71,8 +71,10 @@ class ShareRequest(StrictRequestModel):
     access: Literal["private", "public"] = Field(
         default="private",
         description=(
-            "'private' (default) opens only for signed-in owners of this node at "
-            "the cloud edge; 'public' is world-reachable"
+            "'private' (default) opens only for the owner of this machine's "
+            "Nerdit account and the people they allow in the Nerdit App, checked "
+            "at the cloud edge; "
+            "'public' is world-reachable"
         ),
     )
     consent: bool = Field(