sima-cli 2.1.18__tar.gz → 2.1.20__tar.gz

{sima_cli-2.1.18/sima_cli.egg-info → sima_cli-2.1.20}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sima-cli
-Version: 2.1.18
+Version: 2.1.20
 Summary: CLI tool for SiMa Developer Portal to download models, firmware, and apps.
 Home-page: https://community.sima.ai/
 Author: SiMa.ai
@@ -27,7 +27,8 @@ Requires-Dist: rich==14.0.0
 Requires-Dist: InquirerPy==0.3.4
 Requires-Dist: tftpy==0.8.6
 Requires-Dist: psutil==7.0.0
-Requires-Dist: huggingface-hub<1.0,>=0.34.0
+Requires-Dist: huggingface-hub<3.0,>=2.2.0; python_version >= "3.10"
+Requires-Dist: huggingface-hub<2.0,>=0.34.0; python_version < "3.10"
 Requires-Dist: tabulate==0.9.0
 Dynamic: author
 Dynamic: license-file
@@ -148,6 +149,20 @@ sima-cli --internal login
 SIMA_CLI_INTERNAL=1 sima-cli install -v 2.1.2 tools/model-compiler/amd64
 ```
 
+Full-system SWU updates prefer RAM-backed `/tmp` when available memory can
+hold both the bundle and its extraction, plus a reserve of at least 512 MiB
+or 10% of total RAM (whichever is larger). Otherwise they stage in `/data`,
+with NVMe as a further fallback if `/data` lacks space. RAM staging is temporary;
+interrupted updates retained there do not survive a reboot.
+
+Public-mirror downloads, `models download`, and `neat artifacts` split files
+of at least 64 MiB into four byte ranges when supported by the server. Models
+and Neat artifacts share a limit of four active download connections across
+files and ranges, including single-connection fallbacks. Ranges must match the
+expected size and an object validator or the expected SHA-256 before the file is published. Models retain signed-URL refresh and
+cancellation handling. Existing public-mirror partial downloads continue
+sequentially; servers without range support use a single connection.
+
 ## Common Workflows
 
 Set up SDK containers:
@@ -157,6 +172,14 @@ sima-cli sdk setup
 sima-cli sdk neat
 ```
 
+When pairing with `sdk setup --devkit`, a new DevKit host key is automatically
+recorded in the SDK user's `~/.ssh/known_hosts`, including during unattended
+setup or after SDK container recreation. Subsequent pairing preserves saved
+keys and rejects a changed key at the same address and SSH port. After a device
+reimage or key rotation, verify the replacement fingerprint before explicitly
+updating that entry. For environments requiring verified trust before the first
+connection, provision verified host keys in the SDK user's `known_hosts`.
+
 Install Model Compiler from package metadata:
 
 ```bash
@@ -238,3 +261,13 @@ For command-specific prerequisites, see the generated [command reference](docs/s
 ## Support
 
 For issues and feature requests, use the sima-cli GitHub repository or contact the SiMa.ai development team.
+
+### Remote browser certificate help
+
+SDK setup stages a verified public mkcert CA certificate alongside the SDK HTTPS
+certificate. SDK images with browser certificate help can offer that file for
+download on the sign-in page, with instructions for the browser computer.
+Only the public certificate is staged; the mkcert private key stays on the host.
+If the issuing CA cannot be verified, including a plain self-signed fallback,
+no CA download is published. Re-running setup refreshes the staged file even
+when the existing HTTPS certificate does not need to be reissued.

{sima_cli-2.1.18 → sima_cli-2.1.20}/README.md

@@ -113,6 +113,20 @@ sima-cli --internal login
 SIMA_CLI_INTERNAL=1 sima-cli install -v 2.1.2 tools/model-compiler/amd64
 ```
 
+Full-system SWU updates prefer RAM-backed `/tmp` when available memory can
+hold both the bundle and its extraction, plus a reserve of at least 512 MiB
+or 10% of total RAM (whichever is larger). Otherwise they stage in `/data`,
+with NVMe as a further fallback if `/data` lacks space. RAM staging is temporary;
+interrupted updates retained there do not survive a reboot.
+
+Public-mirror downloads, `models download`, and `neat artifacts` split files
+of at least 64 MiB into four byte ranges when supported by the server. Models
+and Neat artifacts share a limit of four active download connections across
+files and ranges, including single-connection fallbacks. Ranges must match the
+expected size and an object validator or the expected SHA-256 before the file is published. Models retain signed-URL refresh and
+cancellation handling. Existing public-mirror partial downloads continue
+sequentially; servers without range support use a single connection.
+
 ## Common Workflows
 
 Set up SDK containers:
@@ -122,6 +136,14 @@ sima-cli sdk setup
 sima-cli sdk neat
 ```
 
+When pairing with `sdk setup --devkit`, a new DevKit host key is automatically
+recorded in the SDK user's `~/.ssh/known_hosts`, including during unattended
+setup or after SDK container recreation. Subsequent pairing preserves saved
+keys and rejects a changed key at the same address and SSH port. After a device
+reimage or key rotation, verify the replacement fingerprint before explicitly
+updating that entry. For environments requiring verified trust before the first
+connection, provision verified host keys in the SDK user's `known_hosts`.
+
 Install Model Compiler from package metadata:
 
 ```bash
@@ -203,3 +225,13 @@ For command-specific prerequisites, see the generated [command reference](docs/s
 ## Support
 
 For issues and feature requests, use the sima-cli GitHub repository or contact the SiMa.ai development team.
+
+### Remote browser certificate help
+
+SDK setup stages a verified public mkcert CA certificate alongside the SDK HTTPS
+certificate. SDK images with browser certificate help can offer that file for
+download on the sign-in page, with instructions for the browser computer.
+Only the public certificate is staged; the mkcert private key stays on the host.
+If the issuing CA cannot be verified, including a plain self-signed fallback,
+no CA download is published. Re-running setup refreshes the staged file even
+when the existing HTTPS certificate does not need to be reissued.

{sima_cli-2.1.18 → sima_cli-2.1.20}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "sima-cli"
-version = "2.1.18"
+version = "2.1.20"
 description = "CLI tool for SiMa Developer Portal to download models, firmware, and apps."
 readme = "README.md"
 requires-python = ">=3.8"
@@ -33,7 +33,8 @@ dependencies = [
     "InquirerPy==0.3.4",
     "tftpy==0.8.6",
     "psutil==7.0.0",
-    "huggingface-hub>=0.34.0,<1.0",
+    "huggingface-hub>=2.2.0,<3.0; python_version >= '3.10'",
+    "huggingface-hub>=0.34.0,<2.0; python_version < '3.10'",
     "tabulate==0.9.0"
 ]
 

{sima_cli-2.1.18 → sima_cli-2.1.20}/requirements.txt

@@ -8,5 +8,6 @@ rich==14.0.0
 InquirerPy==0.3.4
 tftpy==0.8.6
 psutil==7.0.0
-huggingface-hub>=0.34.0,<1.0
+huggingface-hub>=2.2.0,<3.0; python_version >= "3.10"
+huggingface-hub>=0.34.0,<2.0; python_version < "3.10"
 tabulate==0.9.0

{sima_cli-2.1.18 → sima_cli-2.1.20}/setup.py

@@ -23,7 +23,8 @@ setup(
         "InquirerPy>=0.3.4,<0.4",
         "tftpy>=0.8.6,<0.9",
         "psutil>=7.0.0,<8.0",
-        "huggingface-hub>=0.34.0,<1.0",
+        "huggingface-hub>=2.2.0,<3.0; python_version >= '3.10'",
+        "huggingface-hub>=0.34.0,<2.0; python_version < '3.10'",
         "rich>=13.7,<14.0"
     ],
     entry_points={

{sima_cli-2.1.18 → sima_cli-2.1.20}/sima_cli/__version__.py

@@ -1,2 +1,2 @@
 # sima_cli/__version__.py
-__version__ = "2.1.18"
+__version__ = "2.1.20"

{sima_cli-2.1.18 → sima_cli-2.1.20}/sima_cli/cli.py

@@ -14,7 +14,7 @@ from sima_cli.update.swu import handle_update
 from sima_cli.model_zoo.model import list_models, download_model, describe_model
 from sima_cli.app_zoo.app import list_apps, download_app, describe_app
 from sima_cli.utils.config_loader import internal_resource_exists
-from sima_cli.mla.meminfo import monitor_simaai_mem_chart
+from sima_cli.mla.meminfo import MemoryTelemetryError, monitor_simaai_mem_chart
 from sima_cli.__version__ import __version__ 
 from sima_cli.utils.config import CONFIG_PATH
 from sima_cli.install.optiview import install_optiview
@@ -42,6 +42,7 @@ from sima_cli.upgrade.selfupdate import register_selfupdate_command
 from sima_cli.playbooks import register_playbook_commands
 from sima_cli.vulcan import register_vulcan_commands
 from sima_cli.models import register_models_commands
+from sima_cli.peripherals import register_peripherals_commands
 from sima_cli.cloudex import register_cloudex_commands
 from sima_cli.vulcan.commands import (
     ENV_METAVAR,
@@ -105,6 +106,13 @@ def _rerun_current_command() -> None:
     os.execvpe(sys.executable, cmd, env)
 
 
+# Command groups whose stdout is a machine-readable document: root diagnostics go to stderr for them.
+QUIET_STDOUT_SUBCOMMANDS = ("models", "peripherals")
+# Command groups that only read the DevKit they run on: no PyPI update check and no Artifactory
+# gate before them, so they work offline and never prompt or exit early.
+LOCAL_ONLY_SUBCOMMANDS = ("peripherals",)
+
+
 def _initialize_main_context(ctx, internal, yes):
     _configure_stdio_errors()
     auto_accept_update = yes or _update_auto_confirm_requested(sys.argv)
@@ -112,7 +120,8 @@ def _initialize_main_context(ctx, internal, yes):
     if auto_accept_update:
         os.environ["SIMA_CLI_AUTO_ACCEPT_UPDATE"] = "1"
     try:
-        if check_for_update('sima-cli') and _should_rerun_after_update(sys.argv):
+        if (ctx.invoked_subcommand not in LOCAL_ONLY_SUBCOMMANDS
+                and check_for_update('sima-cli') and _should_rerun_after_update(sys.argv)):
             _rerun_current_command()
     finally:
         if auto_accept_update:
@@ -128,14 +137,15 @@ def _initialize_main_context(ctx, internal, yes):
     if not internal:
         internal = os.getenv("SIMA_CLI_INTERNAL", "0") in ("1", "true", "yes")
 
-    defer_artifactory_access = ctx.invoked_subcommand == "update" or ctx.meta.get("daily_netboot", False)
+    local_only = ctx.invoked_subcommand in LOCAL_ONLY_SUBCOMMANDS
+    defer_artifactory_access = local_only or ctx.invoked_subcommand == "update" or ctx.meta.get("daily_netboot", False)
     if internal and not internal_resource_exists() and not defer_artifactory_access:
         click.echo("❌ You have specified -i or --internal argument to access internal resources, but you do not have an internal resource map configured.")
         click.echo("Refer to the confluence page to find out how to configure internal resource map.")
         exit(0)
 
     internal_reachable = True
-    if internal:
+    if internal and not local_only:
         internal_reachable = check_artifactory_reachability()
 
     if internal and not internal_reachable and not defer_artifactory_access and not _allows_external_prerelease_fallback(sys.argv):
@@ -170,7 +180,7 @@ class InspectionAwareGroup(click.Group):
             _command_name_from_argv(['sima-cli'] + options) == 'bootimg'
             and any(arg in ('--netboot', '-n', '--autoflash', '-a') for arg in options)
         )
-        if _command_name_from_argv(['sima-cli'] + options) == 'update' and '--inspect' in options:
+        if _command_name_from_argv(['sima-cli'] + options) == 'update' and any(arg in ('--inspect', '--swap', '--reset-overlay') for arg in options):
             ctx.meta['update_inspect'] = True
         return super().parse_args(ctx, args)
 
@@ -198,11 +208,11 @@ def main(ctx, internal, yes):
         ctx.ensure_object(dict)
         ctx.obj.update(internal=internal, yes=yes)
         return
-    # Model Registry JSON must remain parseable on stdout. Route root-level
-    # update and environment diagnostics to stderr for this command group.
+    # Model Registry and peripherals JSON must remain parseable on stdout. Route root-level
+    # update and environment diagnostics to stderr for these command groups.
     output_context = (
         redirect_stdout(sys.stderr)
-        if ctx.invoked_subcommand == "models"
+        if ctx.invoked_subcommand in QUIET_STDOUT_SUBCOMMANDS
         else nullcontext()
     )
     with output_context:
@@ -216,6 +226,7 @@ register_sdk_commands(main)
 register_playbook_commands(main)
 register_vulcan_commands(main)
 register_models_commands(main)
+register_peripherals_commands(main)
 register_cloudex_commands(main)
 
 
@@ -352,14 +363,16 @@ def download(ctx, url, dest):
     "--dryrun",
     is_flag=True,
     default=False,
-    help="For eLxr updates, validate the update path and show the command without installing."
+    help="For eLxr, preview an update, slot swap, or overlay reset without making changes."
 )
 @click.option("--inspect", "inspect_state", is_flag=True, help="Show eLxr 3.0+ A/B slots and overlay customizations without updating (local or --ip).")
+@click.option("--reset-overlay", is_flag=True, help="Discard local overlay software and settings without updating firmware; reboot to use the clean system (eLxr 3.0+).")
+@click.option("--swap", is_flag=True, help="Select the available inactive eLxr 3.0+ slot for next boot; use --reboot to restart now.")
 @click.option("--verbose", is_flag=True, help="Show detailed overlay file categories during eLxr 3.0+ inspection or update.")
 @click.option("--signing-cert", metavar="URL_OR_FILE", help="SWUpdate PEM verification certificate: HTTP(S) URL or local file. Defaults to the certificate for the selected channel when configured (eLxr 3.0+).")
-@click.option("--reboot", is_flag=True, help="Reboot after successful eLxr 3.0+ installation; verify remote boot health.")
+@click.option("--reboot", is_flag=True, help="Reboot after successful eLxr 3.0+ installation, slot selection, or overlay reset.")
 @click.pass_context
-def update(ctx, version_or_url, version_option, ip, yes, passwd, flavor, force, troot_only, dryrun, inspect_state, verbose, reboot, signing_cert):
+def update(ctx, version_or_url, version_option, ip, yes, passwd, flavor, force, troot_only, dryrun, inspect_state, verbose, reboot, signing_cert, swap, reset_overlay):
     """
     Update a SiMa DevKit, remote device, or Linux PCIe host.
 
@@ -370,9 +383,23 @@ def update(ctx, version_or_url, version_option, ip, yes, passwd, flavor, force,
 
     eLxr 3.0+ uses signed full-system SWU bundles. Use --inspect for A/B
     state, --ip for remote updates, and --reboot to reboot after installation.
+
+    Use --reset-overlay to discard local software and settings without updating
+    firmware or switching slots. Save needed files first; the saved inventory
+    contains metadata only. Reboot promptly, or add --reboot. Use --dryrun to preview.
+
+    Use --swap to select the valid inactive slot without downloading an update.
+    The current and target versions are shown before confirmation; --yes skips
+    confirmation. Reboot separately to apply, or add --reboot to restart now.
+    Shared data and overlay customizations persist and can override files in
+    the selected version. Blank, invalid, pending, and unknown states are refused.
+
+    Examples: sima-cli update --swap; sima-cli update --ip 192.168.6.5 --swap --reboot
+
     The verification certificate is downloaded for the selected channel when configured; use
     --signing-cert URL_OR_FILE for an image signed with your own certificate.
-    Developer-portal version lookup for 3.0 is not available yet.
+    For official eLxr 3.0+ releases, specify -v 3.0.0 (or -v 3.0) to
+    download the SWU from docs.sima.ai using your developer-portal login.
 
     Internal mode warns that pre-release software may be unstable and is used
     at your own risk. On eLxr 3.0+, unavailable Artifactory access falls back
@@ -479,6 +506,8 @@ def update(ctx, version_or_url, version_option, ip, yes, passwd, flavor, force,
         dryrun
         or troot_only
         or inspect_state
+        or swap
+        or reset_overlay
         or verbose
         or reboot
         or force
@@ -496,6 +525,10 @@ def update(ctx, version_or_url, version_option, ip, yes, passwd, flavor, force,
         return
 
     is_elxr = is_devkit_running_elxr()
+    if reset_overlay and (inspect_state or swap or version_or_url or force or troot_only or signing_cert is not None or flavor != "auto"):
+        raise click.UsageError("--reset-overlay cannot be combined with --inspect, --swap, or installation options.")
+    if swap and (inspect_state or version_or_url or force or troot_only or signing_cert is not None or flavor != "auto"):
+        raise click.UsageError("--swap cannot be combined with --inspect or installation options.")
     if inspect_state and (version_or_url or dryrun or force or troot_only or reboot or signing_cert is not None or flavor != 'auto'):
         raise click.UsageError("--inspect cannot be combined with installation options.")
     try:
@@ -503,7 +536,7 @@ def update(ctx, version_or_url, version_option, ip, yes, passwd, flavor, force,
                          internal=ctx.obj.get("internal", False),
                          auto_confirm=yes or ctx.obj.get("yes", False), dryrun=dryrun,
                          signing_cert=signing_cert, reboot=reboot, inspect=inspect_state, force=force,
-                         troot_only=troot_only, flavor=flavor, local_elxr=is_elxr, verbose=verbose):
+                         troot_only=troot_only, flavor=flavor, local_elxr=is_elxr, verbose=verbose, swap=swap, reset_overlay=reset_overlay):
             return
     except (click.ClickException, click.Abort):
         raise
@@ -632,8 +665,10 @@ def mla(ctx):
 @click.pass_context
 def show_mla_memory_usage(ctx):
     """Show MLA Memory usage overtime."""
-    monitor_simaai_mem_chart()
-    pass
+    try:
+        monitor_simaai_mem_chart()
+    except MemoryTelemetryError as exc:
+        raise click.ClickException(str(exc)) from exc
 
 
 # ----------------------
@@ -789,6 +824,8 @@ def bootimg_cmd(ctx, version, boardtype, netboot, images, delete_cache, devkit_i
         else:
             write_image(version, boardtype, fwtype, internal, flavor='headless', recovery=recovery)
             click.echo("✅ Boot image successfully written.")
+    except click.ClickException:
+        raise
     except Exception as e:
         click.echo(f"❌ Failed to write boot image: {e}", err=True)
         ctx.exit(1)

{sima_cli-2.1.18 → sima_cli-2.1.20}/sima_cli/cloudex/client.py

@@ -7,6 +7,7 @@ import json
 import os
 import shutil
 import subprocess
+import sys
 import time
 import uuid
 from pathlib import Path
@@ -17,6 +18,8 @@ import requests
 
 DEFAULT_ROOT = Path.home() / ".sima-cli" / "cloudex"
 FORWARDER_NAME = "kerrigan-p2p-forwarder"
+MACOS_TUNNEL_PATH = "/usr/bin:/bin:/usr/sbin:/sbin:/opt/homebrew/bin:/usr/local/bin"
+MACOS_WIREGUARD_INSTALL = "Install WireGuard CLI support with: brew install wireguard-tools"
 CONNECTION_SETUP_TIMEOUT_SECONDS = 60
 DIAGNOSTIC_LOG_LINES = 50
 SAFE_FORWARDER_STAGES = {
@@ -68,8 +71,8 @@ def decode_key(value):
         raise CloudExError("--key contains an invalid value")
     if len(profile["allocation_secret"]) < 32:
         raise CloudExError("--key contains an invalid allocation secret")
-    if profile["environment"] != "vulcan-staging":
-        raise CloudExError("CloudEx currently supports only vulcan-staging allocation keys")
+    if profile["environment"] not in {"vulcan-staging", "vulcan-production"}:
+        raise CloudExError("CloudEx supports only vulcan-staging or vulcan-production allocation keys")
     return profile
 
 
@@ -393,6 +396,9 @@ def _forwarder_failure(log_path):
         "start wireguard-go": "the WireGuard interface could not start",
         "invalid session config": "the native forwarder rejected the session configuration",
     }
+    if sys.platform == "darwin":
+        for needle in ("wireguard is unavailable", "start wireguard-go"):
+            mappings[needle] += ". " + MACOS_WIREGUARD_INSTALL
     for needle, message in mappings.items():
         if needle in detail:
             return message + suffix
@@ -552,22 +558,61 @@ def _reconcile_existing_connection(profile, store, progress):
     return None
 
 
+def _forwarder_sudo_prefix(progress=None):
+    """Install missing macOS tools as the user, then expose them through sudo."""
+    prefix = ["sudo", "-n", "--"]
+    if sys.platform != "darwin":
+        return prefix
+    missing = [name for name in ("wg", "wireguard-go")
+               if shutil.which(name, path=MACOS_TUNNEL_PATH) is None]
+    if missing:
+        brew = shutil.which("brew", path=MACOS_TUNNEL_PATH)
+        if brew is None:
+            raise CloudExError(
+                "CloudEx requires {} on macOS. Install Homebrew, then retry CloudEx; "
+                "missing WireGuard dependencies will be installed automatically.".format(
+                    ", ".join(missing)
+                )
+            )
+        packages = ["wireguard-tools" if name == "wg" else name for name in missing]
+        if progress:
+            progress.update("Installing missing WireGuard dependencies with Homebrew")
+        environment = dict(os.environ, PATH=MACOS_TUNNEL_PATH)
+        try:
+            result = subprocess.run(
+                [brew, "install", *packages],
+                env=environment, stdin=subprocess.DEVNULL,
+                stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=600,
+            )
+        except (OSError, subprocess.TimeoutExpired) as exc:
+            raise CloudExError(
+                "Could not install WireGuard dependencies with Homebrew. " + MACOS_WIREGUARD_INSTALL
+            ) from exc
+        if result.returncode:
+            detail = (result.stderr or result.stdout or "Homebrew failed").strip()
+            raise CloudExError("WireGuard dependency installation failed: " + detail[-1024:])
+        missing = [name for name in ("wg", "wireguard-go")
+                   if shutil.which(name, path=MACOS_TUNNEL_PATH) is None]
+        if missing:
+            raise CloudExError(
+                "Homebrew completed but CloudEx still cannot find: {}. {}".format(
+                    ", ".join(missing), MACOS_WIREGUARD_INSTALL
+                )
+            )
+    return prefix + ["/usr/bin/env", "PATH=" + MACOS_TUNNEL_PATH]
+
+
 def connect(profile, store, progress, attempts=3, transport="auto"):
     """Create a session and return its durable local record."""
-    try:
-        forwarder = find_forwarder()
-    except CloudExError:
-        # Import lazily: the installer reuses this module's privilege and error
-        # handling, while ordinary CloudEx commands should remain quick to load.
-        from .installer import DEFAULT_BRANCH, install_forwarder
+    from .installer import ensure_forwarder
 
-        progress.update("CloudEx forwarder is missing; installing from {}".format(DEFAULT_BRANCH))
-        forwarder = install_forwarder(DEFAULT_BRANCH, progress=progress)["path"]
     authorize_admin()
     api = CloudExAPI.from_profile(profile)
     existing = _reconcile_existing_connection(profile, store, progress)
     if existing:
         return existing
+    sudo_prefix = _forwarder_sudo_prefix(progress=progress)
+    forwarder = ensure_forwarder(progress=progress)
     choices = (["p2p"] * attempts + ["routed"] if transport == "auto"
                else ["routed"] if transport == "turn" else ["p2p"] * attempts)
     last_error = None
@@ -616,8 +661,8 @@ def connect(profile, store, progress, attempts=3, transport="auto"):
             config_path.chmod(0o600)
             with log_path.open("x", encoding="utf-8") as log:
                 process = subprocess.Popen(
-                    [
-                        "sudo", "-n", "--", str(forwarder), "session", "--role", "user",
+                    sudo_prefix + [
+                        str(forwarder), "session", "--role", "user",
                         "--config", str(config_path), "--report", str(report_path),
                     ],
                     stdin=subprocess.DEVNULL,

{sima_cli-2.1.18 → sima_cli-2.1.20}/sima_cli/cloudex/installer.py

@@ -1,6 +1,7 @@
 """Install the native CloudEx forwarder from Kerrigan's Vulcan artifacts."""
 
 import hashlib
+import os
 import platform
 import re
 import subprocess
@@ -99,7 +100,30 @@ def _download_resource(client, base_url, resource, expected_sha256, destination)
     return path
 
 
-def install_forwarder(branch=DEFAULT_BRANCH, progress=None, client=None):
+def ensure_forwarder(progress=None):
+    """Resolve the current published binary before starting a new tunnel."""
+    try:
+        installed = find_forwarder()
+    except CloudExError:
+        installed = None
+    else:
+        if os.environ.get("SIMA_CLOUDEX_FORWARDER"):
+            # Preserve an existing controlled binary, but allow the normal
+            # installer to bootstrap a missing controlled installation.
+            return installed
+    return install_forwarder(
+        DEFAULT_BRANCH, progress=progress, current_path=installed
+    )["path"]
+
+
+def _matches_binary(path, checksum):
+    try:
+        return hashlib.sha256(Path(path).read_bytes()).hexdigest() == checksum.lower()
+    except OSError:
+        return False
+
+
+def install_forwarder(branch=DEFAULT_BRANCH, progress=None, client=None, current_path=None):
     """Install or update the forwarder and return artifact/install details."""
     branch = _validate_branch(branch)
     variant = _platform_variant()
@@ -119,6 +143,12 @@ def install_forwarder(branch=DEFAULT_BRANCH, progress=None, client=None):
     metadata, resources, script_resource = _checked_metadata(
         client, result.metadata_url, variant
     )
+    expected_sha256 = metadata["resources-checksum"][resources[0]]
+    if current_path is not None and _matches_binary(current_path, expected_sha256):
+        if progress:
+            progress.update("CloudEx forwarder is up to date")
+        return {"path": current_path, "branch": branch,
+                "version": metadata["version"], "artifact": result.resolved_spec}
     base_url = result.metadata_url.rsplit("/", 1)[0]
     with tempfile.TemporaryDirectory(prefix="sima-cloudex-forwarder-") as temporary:
         root = Path(temporary)
@@ -156,6 +186,8 @@ def install_forwarder(branch=DEFAULT_BRANCH, progress=None, client=None):
             raise CloudExError("CloudEx forwarder installation failed: {}".format(detail[:1024]))
 
     installed = find_forwarder()
+    if current_path is not None and not _matches_binary(installed, expected_sha256):
+        raise CloudExError("CloudEx forwarder update did not replace the active binary; check PATH")
     return {
         "path": installed,
         "branch": branch,

{sima_cli-2.1.18 → sima_cli-2.1.20}/sima_cli/discover/discover.py

@@ -5,6 +5,7 @@ import subprocess
 import json
 import time
 import re
+import shutil
 import psutil
 from typing import List, Dict
 from rich.console import Console
@@ -51,6 +52,9 @@ def get_sima_devices_from_arp():
             try:
                 output = subprocess.check_output(["ip", "neigh", "show"], text=True)
             except FileNotFoundError:
+                if not shutil.which("arp"):
+                    console.print("[yellow]ARP lookup unavailable: install iproute2 (ip) or net-tools (arp); continuing with multicast discovery.[/yellow]")
+                    return []
                 output = subprocess.check_output(["arp", "-n"], text=True)
             pattern = re.compile(
                 r"(?P<ip>\d+\.\d+\.\d+\.\d+).*?(?P<mac>(?:[0-9a-f]{1,2}:){5}[0-9a-f]{1,2})",

{sima_cli-2.1.18 → sima_cli-2.1.20}/sima_cli/discover/linuxll.py

@@ -11,9 +11,41 @@ import re
 import time
 import shlex
 import subprocess
+import shutil
+import sys
+
+import click
 from sima_cli.utils.env import get_environment_type
 from typing import Optional, Dict
 
+def ensure_discovery_tools():
+    """Provision required Linux discovery tools only after an interactive opt-in."""
+    if shutil.which('ip'):
+        return
+    guidance = (
+        "Device discovery needs 'ip' (package iproute2). "
+        "On Ubuntu/Debian run: sudo apt-get update && sudo apt-get install -y iproute2 ethtool. "
+        "For netboot, pass --devkit-ip <IPv4> to bypass auto-discovery."
+    )
+    if not shutil.which('apt-get') or not sys.stdin.isatty():
+        raise click.ClickException(guidance)
+    packages = ['iproute2']
+    if not shutil.which('ethtool'):
+        packages.append('ethtool')
+    if not click.confirm('Device discovery needs host packages. Install ' + ' '.join(packages) + '?', default=False):
+        raise click.ClickException(guidance)
+    prefix = [] if os.geteuid() == 0 else ['sudo']
+    if prefix and not shutil.which('sudo'):
+        raise click.ClickException(guidance + ' sudo is unavailable; ask an administrator to install them.')
+    try:
+        subprocess.run(prefix + ['apt-get', 'update'], check=True)
+        subprocess.run(prefix + ['apt-get', 'install', '-y', '--no-install-recommends'] + packages, check=True)
+    except (OSError, subprocess.CalledProcessError) as error:
+        raise click.ClickException(f'Device discovery package installation failed: {error}. {guidance}') from error
+    if not shutil.which('ip'):
+        raise click.ClickException(guidance)
+
+
 def _run(cmd: str, check=False, capture=True) -> subprocess.CompletedProcess:
     return subprocess.run(
         shlex.split(cmd),
@@ -24,7 +56,7 @@ def _run(cmd: str, check=False, capture=True) -> subprocess.CompletedProcess:
     )
 
 def _has_nmcli() -> bool:
-    return _run("which nmcli").returncode == 0
+    return shutil.which("nmcli") is not None
 
 
 def _iface_has_ipv4(iface: str) -> bool:
@@ -41,7 +73,7 @@ def _get_mac(iface: str) -> str:
 def _is_usb_ethernet(iface: str) -> bool:
     """Return True if this interface is a USB Ethernet device."""
     dev_path = f"/sys/class/net/{iface}/device"
-    if not os.path.exists(dev_path):
+    if not os.path.exists(dev_path) or not shutil.which("udevadm"):
         return False
 
     cp = _run(f"udevadm info -q property -p {dev_path}", capture=True)
@@ -63,7 +95,7 @@ def _usb_attrs(iface: str) -> Dict[str, str]:
     Returns possibly empty dict.
     """
     dev_path = f"/sys/class/net/{iface}/device"
-    if not os.path.exists(dev_path):
+    if not os.path.exists(dev_path) or not shutil.which("udevadm"):
         return {}
 
     cp = _run(f"udevadm info -q property -p {dev_path}", capture=True)
@@ -100,6 +132,8 @@ def _usb_attrs(iface: str) -> Dict[str, str]:
 
 
 def _driver_info(iface: str) -> Dict[str, str]:
+    if not shutil.which("ethtool"):
+        return {"driver": "", "bus-info": "", "firmware": ""}
     cp = _run(f"ethtool -i {iface}", capture=True)
     info = {}
     for line in cp.stdout.splitlines():
@@ -227,6 +261,7 @@ def suggest_and_switch_to_linklocal():
     envtype, env_subtype = get_environment_type()
 
     if envtype == 'host' and env_subtype == 'linux':
+        ensure_discovery_tools()
         cp = _run("ip -o link", capture=True)
         ifaces = []
         for line in cp.stdout.splitlines():