pivot 0.3.2__tar.gz → 0.3.3__tar.gz

{pivot-0.3.2 → pivot-0.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pivot
-Version: 0.3.2
+Version: 0.3.3
 Summary: High-performance Python pipeline tool with automatic code change detection
 Author: Sami Jawhar
 Author-email: Sami Jawhar <sami@metr.org>

{pivot-0.3.2 → pivot-0.3.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pivot"
-version = "0.3.2"
+version = "0.3.3"
 description = "High-performance Python pipeline tool with automatic code change detection"
 requires-python = ">=3.13,<3.14"
 readme = "README.md"

{pivot-0.3.2 → pivot-0.3.3}/src/pivot/cli/checkout.py

@@ -8,9 +8,10 @@ from typing import TYPE_CHECKING, Literal
 
 import click
 
-from pivot import config, project, registry, types
+from pivot import config, exceptions, project, registry, types
 from pivot.cli import completion
 from pivot.cli import decorators as cli_decorators
+from pivot.cli import errors as cli_errors
 from pivot.cli import helpers as cli_helpers
 from pivot.cli import targets as cli_targets
 from pivot.storage import cache, lock, state, track
@@ -229,9 +230,13 @@ async def _checkout_files_async(
             for abs_path_str, output_hash in files.items():
                 _ = tg.create_task(restore_one(abs_path_str, output_hash))
     except* Exception as eg:
-        # Convert unexpected exceptions to friendly error message
-        errors = [str(e) for e in eg.exceptions]
-        raise click.ClickException("\n".join(errors)) from None
+        # Convert unexpected exceptions to a friendly error message, rendering a PivotError's
+        # actionable suggestion the same way the top-level CLI error handler does (cli/errors.py).
+        messages = [
+            cli_errors.format_pivot_error(e) if isinstance(e, exceptions.PivotError) else str(e)
+            for e in eg.exceptions
+        ]
+        raise click.ClickException("\n".join(messages)) from None
 
     # Re-raise immediate failures (all of them, aggregated)
     if immediate_errors:

{pivot-0.3.2 → pivot-0.3.3}/src/pivot/cli/track.py

@@ -160,12 +160,14 @@ def _track_single_path(
         total_size = sum(e["size"] for e in manifest)
         num_files = len(manifest)
 
-        # Save each file to cache
+        # copy_to_cache is idempotent and already checks existence itself; letting it see
+        # every entry (not just ones missing from the cache) is what lets it republish an
+        # object `pivot track --force` finds cached non-executable by an older pivot or a
+        # cold `pivot pull`, when this entry's bytes should be executable.
         for entry in manifest:
             file_path = path / entry["relpath"]
             file_cache_path = cache.get_cache_path(cache_dir, entry["hash"])
-            if not file_cache_path.exists():
-                cache.copy_to_cache(file_path, file_cache_path)
+            cache.copy_to_cache(file_path, file_cache_path, executable=entry["isexec"])
 
         pvt_data: track_mod.PvtData = {
             "path": path.name,
@@ -178,8 +180,7 @@ def _track_single_path(
         file_hash, _ = cache.hash_file(path)
         file_size = path.stat().st_size
         file_cache_path = cache.get_cache_path(cache_dir, file_hash)
-        if not file_cache_path.exists():
-            cache.copy_to_cache(path, file_cache_path)
+        cache.copy_to_cache(path, file_cache_path)
 
         pvt_data = {
             "path": path.name,

{pivot-0.3.2 → pivot-0.3.3}/src/pivot/exceptions.py

@@ -214,6 +214,27 @@ class UncachedIncrementalOutputError(CacheError):
     """Raised when an incremental output exists without a cache entry."""
 
 
+class CacheModeCollisionError(CacheError):
+    """A HARDLINK/SYMLINK checkout shares the cache object's own permissions and found it
+    already recorded with the wrong executable bit, with no COPY fallback available.
+
+    This happens when two files with identical content disagree on their executable bit (the
+    cache key is content-only) or when a cache object was populated by a path that does not
+    know a file's intended executable bit (e.g. `pivot pull`, which downloads by hash alone).
+    """
+
+    @override
+    def get_suggestion(self) -> str:
+        return (
+            "Add CheckoutMode.COPY to checkout_modes (cache: checkout_mode: [..., copy] in "
+            ".pivot/config.yaml) so checkout can fall back to a private, correctly-permissioned "
+            "copy instead of sharing the cache object's own permissions; or, if you have the "
+            "source bytes in hand, re-running what produced them (`pivot repro --force "
+            "<stage>`, `pivot track --force <path>`) republishes the cache object with the "
+            "right bit"
+        )
+
+
 class ParamsError(PivotError):
     """Raised when parameter validation or loading fails."""
 

{pivot-0.3.2 → pivot-0.3.3}/src/pivot/storage/cache.py

@@ -447,9 +447,21 @@ def _get_symlink_cache_hash(path: pathlib.Path, cache_dir: pathlib.Path) -> str
         return None  # Includes ELOOP for circular symlinks
 
 
-def copy_to_cache(src: pathlib.Path, cache_path: pathlib.Path) -> None:
-    """Atomically copy file to cache with read-only permissions."""
-    if cache_path.exists():
+def copy_to_cache(src: pathlib.Path, cache_path: pathlib.Path, *, executable: bool = False) -> None:
+    """Atomically copy file to cache with read-only permissions.
+
+    ``executable`` records the source's executable bit on the cache object itself (0o555
+    instead of 0o444): a HARDLINK or SYMLINK checkout has no mode of its own, so it reads
+    straight through to whatever mode the cache object carries, and only COPY checkout
+    re-chmods afterwards (see ``_stage_checkout``).
+
+    An existing object missing the executable bit is republished (a fresh temp file atomically
+    replacing the old one, never a chmod in place: existing hardlinks keep the old inode and
+    its mode) when ``executable`` is True, so an object an older pivot or a remote pull cached
+    non-executable can still be repaired by a caller who has the right bytes in hand. An
+    object already executable, or a non-executable request, is left alone.
+    """
+    if cache_path.exists() and (not executable or _cache_object_isexec(cache_path)):
         return
 
     cache_path.parent.mkdir(parents=True, exist_ok=True)
@@ -458,7 +470,7 @@ def copy_to_cache(src: pathlib.Path, cache_path: pathlib.Path) -> None:
     try:
         os.close(fd)
         shutil.copy2(src, tmp_path)
-        os.chmod(tmp_path, 0o444)
+        os.chmod(tmp_path, 0o555 if executable else 0o444)
         tmp.replace(cache_path)
     except BaseException:
         tmp.unlink(missing_ok=True)
@@ -473,7 +485,7 @@ def _stage_checkout(
     cache_path: pathlib.Path,
     checkout_mode: CheckoutMode,
     *,
-    executable: bool,
+    executable: bool | None,
 ) -> None:
     """Create the link or copy of cache_path at tmp_path."""
     if checkout_mode == CheckoutMode.SYMLINK:
@@ -490,7 +502,7 @@ def _checkout_from_cache(
     cache_path: pathlib.Path,
     checkout_mode: CheckoutMode,
     *,
-    executable: bool = False,
+    executable: bool | None = None,
     staging_path: pathlib.Path | None = None,
 ) -> None:
     """Create link or copy at path atomically, so readers never see a partial file.
@@ -533,33 +545,105 @@ def _checkout_from_cache(
         tmp_path.unlink(missing_ok=True)
 
 
+def _cache_object_isexec(cache_path: pathlib.Path) -> bool | None:
+    """Whether the cache object at cache_path is stored executable, or None if absent.
+
+    HARDLINK and SYMLINK checkout have no mode of their own: the workspace file shares the
+    cache object's permissions directly, so they can only ever produce whatever executable
+    bit the cache object itself carries.
+    """
+    try:
+        return bool(cache_path.stat().st_mode & stat.S_IXUSR)
+    except FileNotFoundError:
+        return None
+
+
+def _repair_tree_dir_isexec(cache_dir_path: pathlib.Path, manifest: list[DirManifestEntry]) -> None:
+    """Chmod any exec-marked file in a whole-directory SYMLINK cache tree that is missing
+    its executable bit, to 0o555.
+
+    A tree an older pivot built (every file chmod'd 0o444 regardless of isexec) keeps being
+    reused across an upgrade: its tree hash already incorporates isexec, so it never changes
+    and neither _store_directory's ``not cache_dir_path.exists()`` branch nor the
+    symlink_fast_path restore would otherwise ever revisit it. Chmod'ing in place is safe
+    here, unlike the single-file cache: a tree directory is a private ``copytree`` copy with
+    no other hardlinks sharing its files.
+
+    ``manifest`` may come straight from a lock file on the restore path, so each relpath is
+    checked the same way the file-by-file restore branch already does: a manifest claiming
+    ``../../../outside/file`` must not chmod a file outside the tree.
+    """
+    resolved_tree = cache_dir_path.resolve()
+    for entry in manifest:
+        if not entry["isexec"]:
+            continue
+        f = cache_dir_path / entry["relpath"]
+        if not f.resolve().is_relative_to(resolved_tree):
+            raise exceptions.SecurityValidationError(
+                f"Manifest contains path traversal: {entry['relpath']!r}"
+            )
+        if _cache_object_isexec(f) is False:
+            os.chmod(f, 0o555)
+
+
 def _checkout_with_fallback(
     path: pathlib.Path,
     cache_path: pathlib.Path,
     checkout_modes: list[CheckoutMode],
     *,
-    executable: bool = False,
+    executable: bool | None = None,
     staging_path: pathlib.Path | None = None,
     keep_existing_copy: bool = False,
+    display_path: pathlib.Path | None = None,
 ) -> None:
     """Try each link mode in order until one succeeds.
 
     With ``keep_existing_copy``, reaching COPY while ``path`` still exists leaves it in place:
     the caller guarantees it already holds the cached bytes. A failed link attempt clears
     ``path`` first, so COPY then copies from the cache as usual.
+
+    ``executable`` is None for a single-file output: ``FileHash`` has no isexec field, so a
+    single file's mode is never part of any hash and there is no wrong permission to guard
+    against. For a directory entry (``executable`` is a bool), a HARDLINK or SYMLINK whose
+    cache object's recorded executable bit does not match it is skipped rather than attempted:
+    two files with identical content can disagree on the executable bit (the cache key is
+    content-only), and a cache object a remote pull populated by hash alone carries no
+    executable bit at all. Either way the shared object cannot represent two permissions at
+    once, so checkout falls through to the next mode; only COPY makes a private copy and can
+    always re-chmod it correctly.
+
+    ``display_path`` names the file in a raised error when ``path`` is a restore-only staging
+    location (a caller checking out into a scratch directory before an atomic swap); it
+    defaults to ``path`` for every other caller.
     """
     if not checkout_modes:
         raise ValueError("checkout_modes cannot be empty")
+    display = display_path if display_path is not None else path
     for i, mode in enumerate(checkout_modes):
+        is_last = i == len(checkout_modes) - 1
         if keep_existing_copy and mode == CheckoutMode.COPY and path.exists():
             return
+        if executable is not None and mode in (CheckoutMode.HARDLINK, CheckoutMode.SYMLINK):
+            cached_isexec = _cache_object_isexec(cache_path)
+            if cached_isexec is not None and cached_isexec != executable:
+                if is_last:
+                    cached_state = "executable" if cached_isexec else "non-executable"
+                    raise exceptions.CacheModeCollisionError(
+                        f"Cache object {cache_path} is recorded {cached_state}, but {display} "
+                        + f"needs isexec={executable}."
+                    )
+                logger.debug(
+                    f"Cache object {cache_path} is executable={cached_isexec}, "
+                    + f"need {executable}; skipping {mode.value}"
+                )
+                continue
         try:
             _checkout_from_cache(
                 path, cache_path, mode, executable=executable, staging_path=staging_path
             )
             return
         except OSError as e:
-            if e.errno not in FALLBACK_ERRNO or i == len(checkout_modes) - 1:
+            if e.errno not in FALLBACK_ERRNO or is_last:
                 raise
             logger.debug(f"Checkout mode {mode.value} failed ({e}), trying next mode")
 
@@ -716,7 +800,7 @@ def _store_directory(
     for entry in manifest:
         file_path = path / entry["relpath"]
         cache_path = get_cache_path(cache_dir, entry["hash"])
-        copy_to_cache(file_path, cache_path)
+        copy_to_cache(file_path, cache_path, executable=entry["isexec"])
 
     with restore_lock(path, state_dir):
         if checkout_modes and checkout_modes[0] == CheckoutMode.SYMLINK:
@@ -725,12 +809,20 @@ def _store_directory(
             if not cache_dir_path.exists():
                 cache_dir_path.parent.mkdir(parents=True, exist_ok=True)
                 shutil.copytree(path, cache_dir_path)
+                isexec_by_relpath = {entry["relpath"]: entry["isexec"] for entry in manifest}
                 for f in cache_dir_path.rglob("*"):
                     # Skip symlinks to avoid changing permissions on target files outside cache
                     if f.is_file() and not f.is_symlink():
-                        os.chmod(f, 0o444)
+                        relpath = str(f.relative_to(cache_dir_path))
+                        executable = isexec_by_relpath.get(relpath, False)
+                        os.chmod(f, 0o555 if executable else 0o444)
                 os.chmod(cache_dir_path, 0o555)
 
+            # A tree an older pivot built keeps its 0o444-everywhere files forever otherwise:
+            # the tree hash already incorporates isexec, so this branch never revisits an
+            # existing tree directory above.
+            _repair_tree_dir_isexec(cache_dir_path, manifest)
+
             _clear_path(path)
             path.symlink_to(cache_dir_path.resolve())
         else:
@@ -902,6 +994,10 @@ def _restore_directory_from_cache(
     restore_prefix = f"{_RESTORE_TEMP_PREFIX}{target_token}."
 
     if symlink_fast_path:
+        # Same repair as _store_directory: a tree an older pivot built keeps its
+        # 0o444-everywhere files forever otherwise, since the tree hash already
+        # incorporates isexec and this path never rebuilds an existing tree directory.
+        _repair_tree_dir_isexec(cache_dir_path, output_hash["manifest"])
         temp_symlink = path.parent / f"{restore_prefix}symlink_{secrets.token_hex(4)}"
         try:
             temp_symlink.symlink_to(cache_dir_path.resolve())
@@ -931,7 +1027,11 @@ def _restore_directory_from_cache(
                 )
             file_path.parent.mkdir(parents=True, exist_ok=True)
             _checkout_with_fallback(
-                file_path, file_cache_path, checkout_modes, executable=entry["isexec"]
+                file_path,
+                file_cache_path,
+                checkout_modes,
+                executable=entry["isexec"],
+                display_path=path / entry["relpath"],
             )
             if file_count % 100 == 0:
                 try: