nerdit 0.7.2__tar.gz → 0.8.0__tar.gz

{nerdit-0.7.2 → nerdit-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: nerdit
-Version: 0.7.2
+Version: 0.8.0
 Summary: The local AI PaaS — deploy and operate apps on your own hardware, with first-class local AI
 Project-URL: Homepage, https://github.com/nerdit-ai/nerdit
 Project-URL: Repository, https://github.com/nerdit-ai/nerdit
@@ -272,10 +272,10 @@ Questions or feedback: [feedback@nerdit.ai](mailto:feedback@nerdit.ai).
 
 ## License
 
-Apache-2.0, see [LICENSE](https://github.com/nerdit-ai/nerdit/blob/v0.7.2/LICENSE). "Nerdit" and the logo are trademarks and
-are not covered by the code license, see [NOTICE](https://github.com/nerdit-ai/nerdit/blob/v0.7.2/NOTICE).
+Apache-2.0, see [LICENSE](https://github.com/nerdit-ai/nerdit/blob/v0.8.0/LICENSE). "Nerdit" and the logo are trademarks and
+are not covered by the code license, see [NOTICE](https://github.com/nerdit-ai/nerdit/blob/v0.8.0/NOTICE).
 
 ## Contributing
 
-Issues and pull requests are welcome. [CONTRIBUTING.md](https://github.com/nerdit-ai/nerdit/blob/v0.7.2/CONTRIBUTING.md)
+Issues and pull requests are welcome. [CONTRIBUTING.md](https://github.com/nerdit-ai/nerdit/blob/v0.8.0/CONTRIBUTING.md)
 explains how contributions land in releases.

{nerdit-0.7.2 → nerdit-0.8.0}/README.md

@@ -213,10 +213,10 @@ Questions or feedback: [feedback@nerdit.ai](mailto:feedback@nerdit.ai).
 
 ## License
 
-Apache-2.0, see [LICENSE](https://github.com/nerdit-ai/nerdit/blob/v0.7.2/LICENSE). "Nerdit" and the logo are trademarks and
-are not covered by the code license, see [NOTICE](https://github.com/nerdit-ai/nerdit/blob/v0.7.2/NOTICE).
+Apache-2.0, see [LICENSE](https://github.com/nerdit-ai/nerdit/blob/v0.8.0/LICENSE). "Nerdit" and the logo are trademarks and
+are not covered by the code license, see [NOTICE](https://github.com/nerdit-ai/nerdit/blob/v0.8.0/NOTICE).
 
 ## Contributing
 
-Issues and pull requests are welcome. [CONTRIBUTING.md](https://github.com/nerdit-ai/nerdit/blob/v0.7.2/CONTRIBUTING.md)
+Issues and pull requests are welcome. [CONTRIBUTING.md](https://github.com/nerdit-ai/nerdit/blob/v0.8.0/CONTRIBUTING.md)
 explains how contributions land in releases.

{nerdit-0.7.2 → nerdit-0.8.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "nerdit"
-version = "0.7.2"
+version = "0.8.0"
 description = "The local AI PaaS — deploy and operate apps on your own hardware, with first-class local AI"
 readme = "README.md"
 license = "Apache-2.0"

{nerdit-0.7.2 → nerdit-0.8.0}/src/nerdit/__init__.py

@@ -1,3 +1,3 @@
 """Nerdit — Le moteur de l'IA locale."""
 
-__version__ = "0.7.2"
+__version__ = "0.8.0"

{nerdit-0.7.2 → nerdit-0.8.0}/src/nerdit/cli/client.py

@@ -879,17 +879,26 @@ class NerditClient:
         *,
         access: str = "private",
         consent: bool = False,
+        preserve_existing: bool = False,
+        hosted_only: bool | None = None,
         idempotency_key: str | None = None,
     ) -> dict:
         """Share a service; requires an idempotency key.
 
         The daemon validates entitlement, consent, link state, service kind and
         label length. Send values unchanged so client validation cannot drift.
+        ``preserve_existing`` and ``hosted_only`` travel only when set, so an
+        older daemon (``extra="forbid"``) still accepts the plain body.
         """
+        body: dict[str, object] = {"access": access, "consent": consent}
+        if preserve_existing:
+            body["preserve_existing"] = True
+        if hosted_only is not None:
+            body["hosted_only"] = hosted_only
         return await self._request_json(
             "PUT",
             f"{self._base_url}/api/services/{self._segment(name)}/share",
-            json={"access": access, "consent": consent},
+            json=body,
             idempotency_key=idempotency_key,
             timeout=15.0,
         )

{nerdit-0.7.2 → nerdit-0.8.0}/src/nerdit/cli/commands/dev.py

@@ -19,6 +19,7 @@ import typer
 from rich.markup import escape
 
 from nerdit.cli.display import (
+    _hosted_only,
     _plain,
     console,
     display_deploy_result,
@@ -136,9 +137,12 @@ def _cutover_warning(name: str, service: dict | None, cutover: bool | None) -> l
         reason = "only apps (kind = service) are cutover-eligible"
     elif (service.get("gpu_count") or 0) > 0:
         reason = "GPU services keep the same-port swap (two containers cannot hold one GPU)"
-    elif service.get("status") in ("running", "degraded") and not (
-        service.get("endpoint") or {}
-    ).get("public_url"):
+    elif (
+        service.get("status") in ("running", "degraded")
+        and not (endpoint := service.get("endpoint") or {}).get("public_url")
+        # A locked app's null public_url is by design, not a missing route.
+        and not _hosted_only(endpoint)
+    ):
         reason = "no proxy route — zero-downtime redeploys need [proxy].enabled"
     else:
         return []

{nerdit-0.7.2 → nerdit-0.8.0}/src/nerdit/cli/commands/routes.py

@@ -25,8 +25,15 @@ def _route_cell(route: object) -> str:
     return _plain(route)
 
 
-def _live_cell(live: object) -> str:
+def _live_cell(live: object, reason: object = None) -> str:
     """Render the live-Caddy annotation; `None` ⇒ `-` (unknown, not "no")."""
+    if reason == "hosted_only":
+        # `None` is still unknown here: the lock is an intent, and the proxy may
+        # keep serving a route the deregistration never reached.
+        if live is None:
+            return "hosted only [yellow](proxy table unreadable)[/yellow]"
+        still_live = isinstance(live, dict) and live.get("registered")
+        return "hosted only" + (" [yellow](route still live)[/yellow]" if still_live else "")
     if live is None:
         return "-"
     if not isinstance(live, dict):
@@ -75,7 +82,7 @@ async def _routes_async(*, limit: int, cursor: str | None) -> int:
             _route_cell(item.get("route")),
             _plain(item.get("public_url")),
             _plain(item.get("host_port")),
-            _live_cell(item.get("live")),
+            _live_cell(item.get("live"), item.get("reason")),
         )
     console.print(table)
 

{nerdit-0.7.2 → nerdit-0.8.0}/src/nerdit/cli/commands/share.py

@@ -30,6 +30,16 @@ _STATE_NOTES = {
     ),
 }
 
+#: (Lot 5) ``local_routes`` token → the line printed for a hosted-only share.
+_LOCAL_ROUTES_NOTES = {
+    "absent": "local routes: absent (hosted only)",
+    "present": "local routes: present: purge pending, retry in a few seconds",
+    "unknown": (
+        "local routes: unknown: proxy unreadable, or the daemon is reachable "
+        "without a token (see nerdit doctor)"
+    ),
+}
+
 
 def _render_share(name: str, result: Any, *, verb: str) -> None:
     """Print one share as `<verb> <name> (<access>): <url>` + any state note."""
@@ -52,6 +62,11 @@ def _render_share(name: str, result: Any, *, verb: str) -> None:
         hint = origin.get("hint")
         if isinstance(hint, str) and hint:
             console.print(f"[yellow]origin — {_plain(hint)}[/yellow]")
+    if result.get("hosted_only") is True:
+        routes = result.get("local_routes")
+        note = _LOCAL_ROUTES_NOTES.get(routes) if isinstance(routes, str) else None
+        line = note or f"local routes: {_plain(routes)}"
+        console.print(line if routes == "absent" else f"[yellow]{line}[/yellow]")
 
 
 def share(
@@ -77,12 +92,31 @@ def share(
         "--show",
         help="Print the current share instead of changing it.",
     ),
+    hosted_only: bool | None = typer.Option(
+        None,
+        "--hosted-only/--local-route",
+        help=(
+            "--hosted-only locks the app to its hosted URL: this machine's proxy "
+            "keeps no local route for it. --local-route unlocks and restores the "
+            "local routes (needs the link; offline, nerdit unshare <app> also "
+            "restores them). Without --public, an existing public share stays public."
+        ),
+    ),
 ) -> None:
     """Share a deployed app at a hosted URL through this node's cloud link."""
-    asyncio.run(_share_async(name, public=public, consent=consent, show=show))
+    if show and hosted_only is not None:
+        raise typer.BadParameter(
+            "--show prints the share; it cannot be combined with --hosted-only/--local-route",
+            param_hint="--show",
+        )
+    asyncio.run(
+        _share_async(name, public=public, consent=consent, show=show, hosted_only=hosted_only)
+    )
 
 
-async def _share_async(name: str, *, public: bool, consent: bool, show: bool) -> None:
+async def _share_async(
+    name: str, *, public: bool, consent: bool, show: bool, hosted_only: bool | None = None
+) -> None:
     from nerdit.cli.client import get_configured_client
 
     client = get_configured_client()
@@ -97,6 +131,9 @@ async def _share_async(name: str, *, public: bool, consent: bool, show: bool) ->
             name,
             access="public" if public else "private",
             consent=consent,
+            # (Lot 5) A lock flag alone must not downgrade a public share.
+            preserve_existing=hosted_only is not None and not public,
+            hosted_only=hosted_only,
             idempotency_key=uuid4().hex,
         )
     except Exception as exc:  # noqa: BLE001 — rendered for the user

{nerdit-0.7.2 → nerdit-0.8.0}/src/nerdit/cli/display.py

@@ -223,6 +223,14 @@ def display_gpu_table(gpus: list[dict]) -> None:
     console.print(table)
 
 
+def _hosted_only(endpoint: dict) -> bool:
+    """(Lot 5) A locked app: no client shows its loopback ``endpoint.url``."""
+    return any(
+        isinstance(entry, dict) and entry.get("hosted_only") is True
+        for entry in endpoint.get("public_urls") or []
+    )
+
+
 def display_service_table(services: list[dict]) -> None:
     """Display a Rich table of services (name, status, restarts, GPUs, URL)."""
     table = Table(title="Services")
@@ -244,11 +252,14 @@ def display_service_table(services: list[dict]) -> None:
 
         endpoint = svc.get("endpoint") or {}
         host_port = endpoint.get("host_port")
-        url = (
-            endpoint.get("public_url")
-            or endpoint.get("url")
-            or (f"127.0.0.1:{host_port}" if host_port else "-")
-        )
+        if _hosted_only(endpoint):
+            url = endpoint.get("public_url") or "-"
+        else:
+            url = (
+                endpoint.get("public_url")
+                or endpoint.get("url")
+                or (f"127.0.0.1:{host_port}" if host_port else "-")
+            )
 
         table.add_row(
             _plain(svc.get("name", "")),
@@ -433,12 +444,13 @@ def display_service_submitted(service: dict) -> None:
     console.print(f"  Status:  {_plain(service.get('status'))}")
     endpoint = service.get("endpoint") or {}
     public_url = endpoint.get("public_url")
+    local = None if _hosted_only(endpoint) else endpoint.get("url")
     if public_url:
         console.print(f"  URL:     {_plain(public_url)}")
-        if endpoint.get("url"):
-            console.print(f"  Local:   {_plain(endpoint['url'])}")
-    elif endpoint.get("url"):
-        console.print(f"  URL:     {_plain(endpoint['url'])}")
+        if local:
+            console.print(f"  Local:   {_plain(local)}")
+    elif local:
+        console.print(f"  URL:     {_plain(local)}")
 
 
 def display_deploy_result(
@@ -452,7 +464,7 @@ def display_deploy_result(
     console.print(f"[green]{heading}:[/green] {name}")
     console.print(f"  Status:  {_plain(service.get('status'))}")
     endpoint = service.get("endpoint") or {}
-    url = endpoint.get("public_url") or endpoint.get("url")
+    url = endpoint.get("public_url") or (None if _hosted_only(endpoint) else endpoint.get("url"))
     if url:
         console.print(f"  URL:     {_plain(url)}")
     for hint in service.get("hints") or []:

{nerdit-0.7.2 → nerdit-0.8.0}/src/nerdit/core/cutover.py

@@ -612,8 +612,18 @@ class CutoverManager:
         # and this call needs nothing but the ids. The domain rows are read
         # here, at commit time, so a domain bound during the verify window is
         # included and one removed during it is not.
+        # Lot 5: a hosted-only app has no local route, so there is no dial to
+        # repoint or verify; it is promoted on its probe alone (f1 still runs:
+        # the hosted resolver dials `active_host_port`). A lock landing after
+        # this read makes `register` refuse, the dial never converges, and the
+        # cutover settles `repoint_failure` with blue serving and no route.
+        locked = await queries.is_hosted_only(name)
         domain_rows = await queries.get_service_domains(name)
-        caddy_ids = (_route_id(name), *(_domain_route_id(name, r.domain) for r in domain_rows))
+        caddy_ids: tuple[str, ...] = (
+            ()
+            if locked
+            else (_route_id(name), *(_domain_route_id(name, r.domain) for r in domain_rows))
+        )
         # The repoint REBUILDS the whole route object,
         # so the row's `edge_auth` must ride along or every cutover commit of a
         # protected service would strip its auth handler — and `_await_dial`
@@ -623,19 +633,20 @@ class CutoverManager:
         # and the cutover settles `repoint_failure` with blue restored — the
         # route is then withheld until the secret resolves. Posture beats
         # availability.
-        await proxy.register(
-            name,
-            green_port,
-            edge_auth=parse_job_config(job).get("edge_auth"),
-            project_id=job.project_id,
-            with_domains=True,
-            # The SAME snapshot `caddy_ids` was derived from, never a second
-            # read: a `DELETE` landing between two reads would leave a removed
-            # id in the awaited set that nothing ever writes, and
-            # `_await_dials` would burn its whole budget and unwind a healthy
-            # green. The removed route is torn down by the next reconcile tick.
-            domains=[r.domain for r in domain_rows],
-        )
+        if not locked:
+            await proxy.register(
+                name,
+                green_port,
+                edge_auth=parse_job_config(job).get("edge_auth"),
+                project_id=job.project_id,
+                with_domains=True,
+                # The SAME snapshot `caddy_ids` was derived from, never a second
+                # read: a `DELETE` landing between two reads would leave a removed
+                # id in the awaited set that nothing ever writes, and
+                # `_await_dials` would burn its whole budget and unwind a healthy
+                # green. The removed route is torn down by the next reconcile tick.
+                domains=[r.domain for r in domain_rows],
+            )
         if not await self._await_dials(caddy_ids, green_port):
             await self._settle_repoint_failure(
                 job, version, green_id=green_id, name=name, caddy_ids=caddy_ids
@@ -739,6 +750,8 @@ class CutoverManager:
         One deadline covers the whole set (`cutover_repoint_timeout_s`), not
         one per id.
         """
+        if not caddy_ids:
+            return True  # lot 5: a hosted-only app has no route to verify
         proxy = self._c._proxy
         assert proxy is not None
         expected = f"127.0.0.1:{port}"

{nerdit-0.7.2 → nerdit-0.8.0}/src/nerdit/core/proxy/manager.py

@@ -22,7 +22,7 @@ import time
 from collections.abc import Callable, Sequence
 from enum import Enum
 from pathlib import Path
-from typing import TYPE_CHECKING, Any
+from typing import TYPE_CHECKING, Any, Literal
 from urllib.parse import urlsplit
 
 from nerdit.config.defaults import DEFAULT_HOST, DEFAULT_PORT
@@ -1089,6 +1089,11 @@ class ProxyManager(CaddySupervisorMixin, CaddyTlsMixin):
             return
         new_dial = f"127.0.0.1:{host_port}"
         try:
+            # Lot 5: a hosted-only app has no local route. Inside the try, so a
+            # failed lock read writes nothing (fail closed).
+            if await self._queries.is_hosted_only(service_name):
+                await self._deregister_unlocked(service_name)
+                return
             try:
                 spec = await self._build_route_off_loop(
                     service_name, host_port, load_edge_auth(edge_auth), project_id
@@ -1240,6 +1245,23 @@ class ProxyManager(CaddySupervisorMixin, CaddyTlsMixin):
         except Exception:
             logger.warning("[proxy] deregister failed for %s", service_name, exc_info=True)
 
+    async def local_route_state(self, service_name: str) -> Literal["absent", "present", "unknown"]:
+        """Observe whether Caddy's live table holds any route of `service_name`.
+
+        Asks the admin API even when the proxy is disabled: a leftover Caddy may
+        still serve. Unreadable is `unknown`, except a disabled proxy with no live
+        pid, which has nothing that could serve (`absent`).
+        """
+        if self.enabled and not self._available:
+            return "unknown"
+        try:
+            live = await self._admin.live_routes()
+        except Exception:
+            live = None
+        if live is None:
+            return "unknown" if self.enabled or self._pid_alive() else "absent"
+        return "present" if any(_split_route_id(r)[0] == service_name for r in live) else "absent"
+
     # -- reconcile (source of truth) -----------------------------------------
 
     async def reconcile(self) -> None:

{nerdit-0.7.2 → nerdit-0.8.0}/src/nerdit/core/services.py

@@ -2170,7 +2170,12 @@ class ServiceController:
 
         policy = job.restart_policy or "always"
         clean_exit = exit_code == 0
-        if policy == "no" or (policy == "on-failure" and clean_exit):
+        # A clean exit is a finished one-shot only for kind=service. A managed
+        # database or model is a long-running server: exit 0 means something
+        # stopped it (a host shutdown SIGTERMs Postgres, which exits 0), so it
+        # restarts whatever its persisted 'on-failure' policy says.
+        one_shot_done = clean_exit and job.kind is JobKind.service
+        if policy == "no" or (policy == "on-failure" and one_shot_done):
             final = JobStatus.completed if clean_exit else JobStatus.failed
             error_class = (
                 None if clean_exit else _classify_service_exit(exit_code, oom_killed, gpu_oom)

{nerdit-0.7.2 → nerdit-0.8.0}/src/nerdit/daemon/routes/_resources.py

@@ -74,8 +74,10 @@ def new_workload_row(
 ) -> Job:
     """Build the shared `building`/`running` Job skeleton for a create route.
 
-    `restart_policy` is the fixed `"on-failure"` literal both routes pass
-    today (models.py:158, databases.py:176) — not exposed as a parameter.
+    `restart_policy` is the fixed `"on-failure"` literal, not exposed as a
+    parameter. For these kinds `ServiceController._handle_crash` restarts on a
+    clean exit too (a host shutdown stops Postgres with exit 0), so a managed
+    server never settles to `completed`.
     `submitted_by_token`/`idempotency_key` are read from `request` (the
     same principal `authorize_create` already validated, and the same
     `Idempotency-Key` header both routes read identically).

{nerdit-0.7.2 → nerdit-0.8.0}/src/nerdit/daemon/routes/domains.py

@@ -43,6 +43,7 @@ from nerdit.daemon.views.hosted import (
     domain_cert_state,
     domain_state,
     load_hosted_context,
+    local_public_url,
 )
 from nerdit.daemon.views.service import _not_found, _resolve_service
 from nerdit.db.models import JobKind, TokenRole
@@ -186,7 +187,7 @@ async def _context(request: Request, service_name: str) -> tuple[HostedContext,
     endpoint = await queries.get_service_endpoint(service_name)
     if endpoint is None:
         return hosted, None
-    return hosted, public_url_for(
+    url = public_url_for(
         endpoint.service_name,
         endpoint.route,
         mode=proxy.mode,
@@ -196,6 +197,7 @@ async def _context(request: Request, service_name: str) -> tuple[HostedContext,
         https_port=proxy.https_port,
         public_port=proxy.public_port,
     )
+    return hosted, local_public_url(hosted, endpoint.service_name, url)
 
 
 @router.get(
@@ -312,7 +314,6 @@ async def add_domain(
             f"'{job.kind.value}' workloads cannot have a direct domain.",
             hint="Only deployed apps (kind 'service') can be served under a domain.",
         )
-
     try:
         validated = validate_domain(domain, reserved=_reserved(request))
         # Accepted: from here the canonical (folded) name is the resource, and
@@ -378,6 +379,16 @@ async def add_domain(
         # re-checks under the DB write lock). Nothing was written, so the honest
         # answer is the 404 the resolve would have given a moment later.
         raise _not_found(name)
+    if outcome == "hosted_only":
+        # Lot 5: a domain is a local route, and a locked app has none. Refused
+        # under the insert's own write lock, after the shape checks above, so
+        # a malformed name still gets its 422 and a lock cannot race in.
+        raise NerditError(
+            409,
+            "share.hosted_only_conflict",
+            f"Service '{service_name}' is hosted only: it has no local route.",
+            hint=f"Unlock it first: `nerdit share {service_name} --local-route`.",
+        )
     if outcome == "taken":
         # The message names the DOMAIN only. An owner-scoped principal must not
         # be able to enumerate another owner's app names by probing names it

{nerdit-0.7.2 → nerdit-0.8.0}/src/nerdit/daemon/routes/proxy.py

@@ -8,7 +8,7 @@ from fastapi import APIRouter, Request, Response
 
 from nerdit.core.proxy import _route_id, public_url_for
 from nerdit.daemon.errors import NerditError
-from nerdit.daemon.views.hosted import load_hosted_context, public_urls_for
+from nerdit.daemon.views.hosted import load_hosted_context, local_public_url, public_urls_for
 from nerdit.db.models import ProxyStatusResponse, RouteItem, RouteListPage
 from nerdit.utils.certs import ca_fingerprint
 
@@ -139,6 +139,7 @@ async def list_routes(
                 https_port=proxy_settings.https_port,
                 public_port=proxy_settings.public_port,
             )
+        public_url = local_public_url(hosted, endpoint.service_name, public_url)
         live: dict[str, object] | None = None
         if live_table == "readable" and manager is not None:
             # (P25, rev. 2 amendment 2) The id seam, NOT `build_route`: since
@@ -169,6 +170,7 @@ async def list_routes(
                 public_url=public_url,
                 public_urls=public_urls_for(hosted, endpoint.service_name, public_url),
                 live=live,
+                reason="hosted_only" if hosted.locked(endpoint.service_name) else None,
             )
         )
     return RouteListPage(items=items, next_cursor=next_cursor, live_table=live_table)