roar-cli 0.3.5__tar.gz → 0.3.7__tar.gz

{roar_cli-0.3.5 → roar_cli-0.3.7}/LICENSE

@@ -187,7 +187,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright [yyyy] [name of copyright owner]
+   Copyright [2026] [TReqs Inc]
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
@@ -199,4 +199,4 @@
    distributed under the License is distributed on an "AS IS" BASIS,
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
-   limitations under the License.
+   limitations under the License.

{roar_cli-0.3.5 → roar_cli-0.3.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: roar-cli
-Version: 0.3.5
+Version: 0.3.7
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: Intended Audience :: Science/Research

{roar_cli-0.3.5 → roar_cli-0.3.7}/pyproject.toml

@@ -5,7 +5,7 @@ build-backend = "maturin"
 
 [project]
 name = "roar-cli"
-version = "0.3.5"
+version = "0.3.7"
 description = "Reproducibility and provenance tracker for ML training pipelines"
 authors = [
     { name="TReqs Team", email="info@treqs.ai" }

{roar_cli-0.3.5 → roar_cli-0.3.7}/roar/application/git.py

@@ -3,12 +3,13 @@
 from __future__ import annotations
 
 import subprocess
-from dataclasses import dataclass
+from dataclasses import dataclass, replace
 from pathlib import Path
 
 from ..core.interfaces.logger import ILogger
 from ..core.interfaces.registration import GitContext
 from ..integrations.git import GitVCSProvider, resolve_git_context
+from ..utils.git_url import is_shareable_remote
 
 
 @dataclass(frozen=True)
@@ -68,6 +69,29 @@ def resolve_roar_git_context(
     """
     logger.debug("Resolving git context from %s", path)
     ctx = resolve_git_context(path, git_commit, configured_remote=configured_remote)
+    # A repo with no real remote records its own ``file://`` path as the URL.
+    # That resolves only on this machine, so publishing it both leaks the
+    # user's local filesystem layout to GLaaS and is useless to anyone else.
+    # This resolver is publish-only (register/put/package prep), so drop the
+    # non-shareable URL here — the publish record then honestly shows "no
+    # remote", matching the reproducibility checklist. (Local recording uses
+    # ``resolve_git_context`` directly and keeps the ``file://`` URI, which
+    # in-place reproduce relies on.)
+    if ctx.repo and not is_shareable_remote(ctx.repo):
+        logger.debug("Dropping non-shareable git repo URL from publish context: %s", ctx.repo)
+        ctx = replace(ctx, repo=None)
+    # A remote URL can embed credentials (https://user:token@host,
+    # https://TOKEN@host, ssh://user:pass@host). Redact them here, at the
+    # publish-side source, so every publish flow (register, put, package
+    # export) and the canonical session hash see the same credential-free
+    # URL — downstream send paths filter again as defense in depth.
+    if ctx.repo:
+        redacted_repo = _redact_publish_repo_url(ctx.repo, path)
+        if redacted_repo != ctx.repo:
+            logger.warning(
+                "Redacted credentials from git repo URL before publish: %s", redacted_repo
+            )
+            ctx = replace(ctx, repo=redacted_repo)
     logger.debug(
         "Git context resolved: repo=%s, commit=%s, branch=%s",
         ctx.repo,
@@ -77,6 +101,22 @@ def resolve_roar_git_context(
     return ctx
 
 
+def _redact_publish_repo_url(repo_url: str, start_dir: Path) -> str:
+    """Redact embedded credentials from a publish-bound git repo URL.
+
+    Honors the same ``registration.omit`` config (enabled flag, allowlist,
+    custom patterns) as the registration payload filters.
+    """
+    from ..filters.omit import OmitFilter
+    from ..integrations.config.raw import get_raw_registration_omit_config
+
+    omit_config = get_raw_registration_omit_config(start_dir=str(start_dir))
+    if not omit_config.get("enabled", True):
+        return repo_url
+    filtered, _detections = OmitFilter(omit_config).filter_git_url(repo_url)
+    return filtered
+
+
 def build_roar_git_tag_name(commit: str, *, short: bool = False) -> str:
     """Build the canonical roar git tag name."""
     normalized_commit = commit[:8] if short else commit

{roar_cli-0.3.5 → roar_cli-0.3.7}/roar/application/labels.py

@@ -42,6 +42,27 @@ class LabelWriteResult:
     version: int | None = None
 
 
+@dataclass(frozen=True)
+class ReconcileTargetSync:
+    """Correlates one outbound label-reconcile payload item to the local label
+    row(s) it came from and the deletion keys (if any) requested for it.
+
+    A single ``roar label sync`` call can push several targets (dag, jobs,
+    artifacts) in one reconcile request. This lets the caller match each
+    target's entry in the GLaaS response back to the local rows that should
+    (or, if a requested deletion wasn't confirmed, should NOT) get their
+    ``synced_at`` baseline advanced. See
+    ``roar/application/query/label.py::_mark_labels_synced_confirming_deletions``.
+    """
+
+    entity_type: str
+    session_hash: str | None
+    job_uid: str | None
+    artifact_hash: str | None
+    label_ids: list[int]
+    deleted_keys: list[str]
+
+
 class _LabelSyncDatabaseContext(Protocol):
     @property
     def labels(self) -> Any: ...
@@ -512,6 +533,156 @@ def collect_label_sync_payloads(
     return payloads
 
 
+def _user_label_key_paths(metadata: Any) -> set[str]:
+    if not isinstance(metadata, dict):
+        return set()
+    return {key for key, _value in flatten_label_metadata(strip_reserved_system_labels(metadata))}
+
+
+def deleted_user_label_keys(
+    db_ctx: _LabelSyncDatabaseContext,
+    *,
+    entity_type: str,
+    session_id: int | None = None,
+    job_id: int | None = None,
+    artifact_id: str | None = None,
+) -> list[str]:
+    """User-label key paths removed locally since the last synced version.
+
+    The newest version stamped ``synced_at`` is the remote baseline: keys
+    present there but absent from the current version were deliberately unset
+    locally and should be deleted remotely on the next reconcile.
+    """
+    history = db_ctx.labels.get_history(
+        entity_type,
+        session_id=session_id,
+        job_id=job_id,
+        artifact_id=artifact_id,
+    )
+    synced = [row for row in history if row.get("synced_at") is not None]
+    if not history or not synced:
+        return []
+    baseline = max(synced, key=lambda row: int(row.get("version") or 0))
+    current = max(history, key=lambda row: int(row.get("version") or 0))
+    if int(baseline.get("version") or 0) >= int(current.get("version") or 0):
+        return []
+    baseline_keys = _user_label_key_paths(baseline.get("metadata"))
+    current_keys = _user_label_key_paths(current.get("metadata"))
+    return sorted(baseline_keys - current_keys)
+
+
+def _current_label_row_id(
+    db_ctx: _LabelSyncDatabaseContext,
+    *,
+    entity_type: str,
+    session_id: int | None = None,
+    job_id: int | None = None,
+    artifact_id: str | None = None,
+) -> int | None:
+    """Local row id of the current label version for a target, if any."""
+    current = db_ctx.labels.get_current(
+        entity_type,
+        session_id=session_id,
+        job_id=job_id,
+        artifact_id=artifact_id,
+    )
+    if isinstance(current, dict) and isinstance(current.get("id"), int):
+        return int(current["id"])
+    return None
+
+
+def _attach_deleted_user_keys_for_lineage(
+    db_ctx: _LabelSyncDatabaseContext,
+    payloads: list[dict[str, Any]],
+    *,
+    session_id: int | None,
+    jobs: list[dict[str, Any]],
+    artifacts: list[dict[str, Any]],
+) -> None:
+    """Stamp locally-unset user keys and the source label row id onto reconcile
+    payloads, per target.
+
+    ``_label_row_id`` is transient bookkeeping consumed by ``_split_label_row_ids``
+    below (it is never sent to GLaaS) so the caller can correlate the server's
+    response back to the local row(s) that should have ``synced_at`` advanced.
+    """
+    job_id_by_uid: dict[str, int] = {}
+    for job in jobs:
+        job_id = job.get("id")
+        job_uid = job.get("job_uid")
+        remote_job_uid = job.get("remote_job_uid")
+        resolved = remote_job_uid if isinstance(remote_job_uid, str) and remote_job_uid else job_uid
+        if isinstance(job_id, int) and isinstance(resolved, str) and resolved:
+            job_id_by_uid.setdefault(resolved, job_id)
+
+    artifact_id_by_hash: dict[str, str] = {}
+    for artifact in artifacts:
+        artifact_id = artifact.get("id")
+        artifact_hash = artifact.get("hash")
+        if isinstance(artifact_id, str) and isinstance(artifact_hash, str) and artifact_hash:
+            artifact_id_by_hash.setdefault(artifact_hash, artifact_id)
+
+    for payload in payloads:
+        entity_type = payload.get("entity_type")
+        deleted: list[str] = []
+        label_id: int | None = None
+        if entity_type == "dag" and session_id is not None:
+            deleted = deleted_user_label_keys(db_ctx, entity_type="dag", session_id=session_id)
+            label_id = _current_label_row_id(db_ctx, entity_type="dag", session_id=session_id)
+        elif entity_type == "job":
+            job_id = job_id_by_uid.get(str(payload.get("job_uid") or ""))
+            if job_id is not None:
+                deleted = deleted_user_label_keys(db_ctx, entity_type="job", job_id=job_id)
+                label_id = _current_label_row_id(db_ctx, entity_type="job", job_id=job_id)
+        elif entity_type == "artifact":
+            artifact_id = artifact_id_by_hash.get(str(payload.get("artifact_hash") or ""))
+            if artifact_id is not None:
+                deleted = deleted_user_label_keys(
+                    db_ctx,
+                    entity_type="artifact",
+                    artifact_id=artifact_id,
+                )
+                label_id = _current_label_row_id(
+                    db_ctx, entity_type="artifact", artifact_id=artifact_id
+                )
+        if deleted:
+            payload["deleted_keys"] = deleted
+        if label_id is not None:
+            payload["_label_row_id"] = label_id
+
+
+def _split_label_row_ids(
+    payloads: list[dict[str, Any]],
+) -> tuple[list[dict[str, Any]], list[ReconcileTargetSync]]:
+    """Strip the transient ``_label_row_id`` key from outbound wire payloads.
+
+    Returns the cleaned payloads (safe to JSON-serialize to GLaaS) alongside a
+    parallel, same-order list of ``ReconcileTargetSync`` records so the caller
+    can verify server-confirmed deletions before advancing each target's local
+    ``synced_at`` baseline.
+    """
+    wire_payloads: list[dict[str, Any]] = []
+    targets: list[ReconcileTargetSync] = []
+    for payload in payloads:
+        label_row_id = payload.get("_label_row_id")
+        wire_payloads.append({k: v for k, v in payload.items() if k != "_label_row_id"})
+        deleted_keys = payload.get("deleted_keys")
+        session_hash = payload.get("session_hash")
+        job_uid = payload.get("job_uid")
+        artifact_hash = payload.get("artifact_hash")
+        targets.append(
+            ReconcileTargetSync(
+                entity_type=str(payload.get("entity_type") or ""),
+                session_hash=session_hash if isinstance(session_hash, str) else None,
+                job_uid=job_uid if isinstance(job_uid, str) else None,
+                artifact_hash=artifact_hash if isinstance(artifact_hash, str) else None,
+                label_ids=[int(label_row_id)] if isinstance(label_row_id, int) else [],
+                deleted_keys=list(deleted_keys) if isinstance(deleted_keys, list) else [],
+            )
+        )
+    return wire_payloads, targets
+
+
 def collect_current_label_ids(
     db_ctx: _LabelSyncDatabaseContext,
     *,
@@ -576,8 +747,15 @@ def build_reconcile_payload_for_current_lineage(
     db_ctx: _RemoteLabelMutationDatabaseContext,
     *,
     roar_dir: Path,
-) -> tuple[str, list[dict[str, Any]]]:
-    """Build a user-managed reconcile payload for the active local lineage."""
+) -> tuple[str, list[dict[str, Any]], list[ReconcileTargetSync]]:
+    """Build a user-managed reconcile payload for the active local lineage.
+
+    Returns the published session hash, the reconcile label payloads (including
+    per-target ``deleted_keys`` for locally-unset user labels), and a per-target
+    ``ReconcileTargetSync`` list (same order as the payloads) the caller uses to
+    decide which local label rows may have ``synced_at`` stamped after a push —
+    see ``roar/application/query/label.py::_mark_labels_synced_confirming_deletions``.
+    """
     session = db_ctx.sessions.get_active()
     if not isinstance(session, dict) or not isinstance(session.get("id"), int):
         raise ValueError("No active session.")
@@ -594,14 +772,23 @@ def build_reconcile_payload_for_current_lineage(
         list(getattr(lineage, "jobs", []) or []),
         session,
     )
+    artifacts = list(getattr(lineage, "artifacts", []) or [])
     payloads = collect_label_sync_payloads(
         db_ctx,
         session_id=session_id,
         session_hash=session_hash,
         jobs=jobs,
-        artifacts=list(getattr(lineage, "artifacts", []) or []),
+        artifacts=artifacts,
+    )
+    _attach_deleted_user_keys_for_lineage(
+        db_ctx,
+        payloads,
+        session_id=session_id,
+        jobs=jobs,
+        artifacts=artifacts,
     )
-    return session_hash, _user_managed_reconcile_payloads(payloads)
+    wire_payloads, sync_targets = _split_label_row_ids(_user_managed_reconcile_payloads(payloads))
+    return session_hash, wire_payloads, sync_targets
 
 
 def build_reconcile_payload_for_target(
@@ -610,8 +797,12 @@ def build_reconcile_payload_for_target(
     roar_dir: Path,
     target: LabelTargetRef,
     metadata: dict[str, Any],
-) -> tuple[str, list[dict[str, Any]]]:
-    """Build a single-target user-managed reconcile payload."""
+) -> tuple[str, list[dict[str, Any]], list[ReconcileTargetSync]]:
+    """Build a single-target user-managed reconcile payload.
+
+    See ``build_reconcile_payload_for_current_lineage`` for what the returned
+    ``ReconcileTargetSync`` list is used for.
+    """
     payload = build_remote_label_mutation_payload(
         db_ctx,
         roar_dir=roar_dir,
@@ -619,6 +810,15 @@ def build_reconcile_payload_for_target(
         metadata=metadata,
         require_published_session=True,
     )
+    deleted = deleted_user_label_keys(
+        db_ctx,
+        entity_type=target.entity_type,
+        session_id=target.session_id,
+        job_id=target.job_id,
+        artifact_id=target.artifact_id,
+    )
+    if deleted:
+        payload["deleted_keys"] = deleted
     session_hash = payload.get("session_hash")
     if not isinstance(session_hash, str) or not session_hash:
         session_hash = _canonical_remote_session_hash_for_target(
@@ -627,7 +827,17 @@ def build_reconcile_payload_for_target(
             target=target,
             require_published=True,
         )
-    return session_hash, _user_managed_reconcile_payloads([payload])
+    label_id = _current_label_row_id(
+        db_ctx,
+        entity_type=target.entity_type,
+        session_id=target.session_id,
+        job_id=target.job_id,
+        artifact_id=target.artifact_id,
+    )
+    if label_id is not None:
+        payload["_label_row_id"] = label_id
+    wire_payloads, sync_targets = _split_label_row_ids(_user_managed_reconcile_payloads([payload]))
+    return session_hash, wire_payloads, sync_targets
 
 
 def _canonical_remote_session_hash(
@@ -730,14 +940,18 @@ def _user_managed_reconcile_payloads(payloads: list[dict[str, Any]]) -> list[dic
         if not isinstance(metadata, dict):
             continue
         user_metadata = _prune_empty_containers(strip_reserved_system_labels(metadata))
-        if not user_metadata:
+        deleted_keys = payload.get("deleted_keys")
+        has_deletions = isinstance(deleted_keys, list) and bool(deleted_keys)
+        # A target whose user labels were all unset still needs a reconcile item
+        # so the deletions propagate remotely.
+        if not user_metadata and not has_deletions:
             continue
         filtered.append(
             {
                 key: value
                 for key, value in {
                     **payload,
-                    "metadata": user_metadata,
+                    "metadata": user_metadata if isinstance(user_metadata, dict) else {},
                 }.items()
                 if key != "key_origins"
             }

{roar_cli-0.3.5 → roar_cli-0.3.7}/roar/application/lookup/remote_artifacts.py

@@ -22,12 +22,36 @@ def lookup_remote_artifact(
 ) -> tuple[dict[str, Any] | None, str | None]:
     """Resolve a remote artifact by hash prefix.
 
+    Tries the authenticated lookup first. If that's rejected for lack of
+    credentials (401/403) — the common case for a user with no SSH key
+    registered looking up a public artifact — falls back to the public,
+    optionally-authenticated endpoint so anonymous reads still work.
+
     Returns ``(artifact, error_message)``. A 404 is treated as a clean miss.
     """
     reader = artifact_reader or GlaasClient(base_url=server_url)
 
     try:
         artifact = reader.get_artifact(hash_prefix)
+    except GlaasApiError as exc:
+        if exc.status_code == 404:
+            return None, None
+        if exc.status_code in (401, 403) and hasattr(reader, "get_public_artifact"):
+            return _lookup_public_artifact(reader, hash_prefix)
+        return None, str(exc)
+    except (ValueError, RuntimeError) as exc:
+        return None, str(exc)
+
+    if not isinstance(artifact, dict):
+        return None, None
+    return artifact, None
+
+
+def _lookup_public_artifact(
+    reader: SupportsArtifactLookup, hash_prefix: str
+) -> tuple[dict[str, Any] | None, str | None]:
+    try:
+        artifact = reader.get_public_artifact(hash_prefix)  # type: ignore[attr-defined]
     except GlaasApiError as exc:
         if exc.status_code == 404:
             return None, None

{roar_cli-0.3.5 → roar_cli-0.3.7}/roar/application/publish/git_remote.py

@@ -60,7 +60,8 @@ def _git_check_output(repo_root: Path | str, *args: str, capture_stderr: bool) -
     )
 
 
-def _list_remote_names(repo_root: Path | str) -> list[str]:
+def list_remote_names(repo_root: Path | str) -> list[str]:
+    """Return the names of git remotes configured in this repo (empty if none)."""
     try:
         raw = _git_check_output(repo_root, "remote", capture_stderr=False)
     except subprocess.CalledProcessError:
@@ -68,6 +69,10 @@ def _list_remote_names(repo_root: Path | str) -> list[str]:
     return [line.strip() for line in raw.splitlines() if line.strip()]
 
 
+# Back-compat alias for internal callers.
+_list_remote_names = list_remote_names
+
+
 def resolve_canonical_remote(repo_root: Path | str, configured_remote: str | None) -> str:
     """Return the name of the remote roar should push tags to.
 

{roar_cli-0.3.5 → roar_cli-0.3.7}/roar/application/publish/register_execution.py

@@ -24,7 +24,11 @@ from .job_preparation import (
     order_jobs_for_registration,
 )
 from .remote_job_uids import prepare_jobs_for_remote_publication
-from .secrets import detect_lineage_secrets, filter_lineage_secrets
+from .secrets import (
+    detect_lineage_secrets,
+    filter_git_context_secrets,
+    filter_lineage_secrets,
+)
 from .session import build_staged_lineage_counts
 
 if TYPE_CHECKING:
@@ -265,6 +269,12 @@ class RegisterService:
                 lineage=lineage,
                 omit_filter=omit_filter,
             )
+            # The git repo URL is published at the session level (register /
+            # finalize), so it must be redacted here too, not just detected.
+            git_context, _ = filter_git_context_secrets(
+                git_context=git_context,
+                omit_filter=omit_filter,
+            )
 
         registration_jobs = order_jobs_for_registration(
             normalize_jobs_for_registration(lineage.jobs)
@@ -469,8 +479,18 @@ class RegisterService:
 
         composite_registered = sum(1 for item in composite_registrations if item.get("registered"))
         composite_failed = sum(1 for item in composite_registrations if not item.get("registered"))
-        total_artifacts_registered = batch_result.artifacts_registered + composite_registered
         total_artifacts_failed = batch_result.artifacts_failed + composite_failed
+        # Report DISTINCT artifacts, matching `register --dry-run`'s
+        # len(lineage.artifacts). The coordinator's running tally double-counts
+        # (artifacts are tallied in both the staging and the link phase, and the
+        # server's success count is per content-hash) — when everything
+        # registered, the distinct figure is simply the lineage's artifact count.
+        # The success gate below keys off *_failed, not this display number, so
+        # this is safe. On partial failure, fall back to the coordinator's tally.
+        if total_artifacts_failed == 0:
+            total_artifacts_registered = len(lineage.artifacts)
+        else:
+            total_artifacts_registered = batch_result.artifacts_registered + composite_registered
 
         success = (
             batch_result.jobs_failed == 0 and total_artifacts_failed == 0 and not finalize_failed

{roar_cli-0.3.5 → roar_cli-0.3.7}/roar/application/publish/register_tag_push.py

@@ -33,6 +33,7 @@ from ...core.interfaces.logger import ILogger
 from ..git import build_roar_git_tag_name, create_roar_git_tag
 from .git_remote import (
     GitRemoteError,
+    list_remote_names,
     push_roar_tags,
     resolve_canonical_remote,
     warn_if_ssh_passphrase_prompt_likely,
@@ -145,6 +146,21 @@ def ensure_roar_tags_pushed(
             push_skipped_reason="never_config",
         )
 
+    # No remote at all (and none configured): degrade to a local-only register
+    # instead of blocking. The common "does this work" loop shouldn't be gated on
+    # having a remote — and the dry-run never blocks, so the real run shouldn't
+    # contradict it. Tags exist locally; the reproducibility checklist surfaces
+    # that the commit isn't reachable on a remote. (An *invalid* configured
+    # remote or ambiguous multi-remote setup still errors below — those mean the
+    # user wants a push but roar can't safely pick where.)
+    if not configured_remote and not list_remote_names(repo_root):
+        logger.debug("No git remote configured — registering local-only (tags not pushed).")
+        return RegisterTagSummary(
+            session_tag=session_tag_name,
+            job_tags=job_tags,
+            push_skipped_reason="no_remote",
+        )
+
     try:
         remote = resolve_canonical_remote(repo_root, configured_remote)
     except GitRemoteError as exc: