simulo 0.27.0__tar.gz → 0.28.0__tar.gz

{simulo-0.27.0/src/simulo.egg-info → simulo-0.28.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: simulo
-Version: 0.27.0
+Version: 0.28.0
 Summary: Simulo SDK and CLI — define robotics simulation and training apps in Python and run them on the Simulo cloud.
 Author-email: Simulo Team <team@simulo.ai>
 License: BSD-3-Clause
@@ -15,7 +15,7 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Typing :: Typed
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
-Requires-Dist: simulo-interfaces<0.20,>=0.19.0
+Requires-Dist: simulo-interfaces<0.21,>=0.20.0
 Requires-Dist: mcap<2,>=1.3
 Requires-Dist: defusedxml>=0.7.1
 Requires-Dist: usd-core<27,>=26.5

{simulo-0.27.0 → simulo-0.28.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "simulo"
-version = "0.27.0"
+version = "0.28.0"
 description = "Simulo SDK and CLI — define robotics simulation and training apps in Python and run them on the Simulo cloud."
 readme = "PYPI.md"
 requires-python = ">=3.11"
@@ -26,7 +26,7 @@ classifiers = [
 # mcap: used by `simulo recordings` to read back a downloaded recording and
 # verify it (message count) — MIT-licensed, deps only lz4+zstandard.
 dependencies = [
-    "simulo-interfaces>=0.19.0,<0.20",
+    "simulo-interfaces>=0.20.0,<0.21",
     "mcap>=1.3,<2",
     # Hardened XML parsing for URDF ingestion (USD Asset Catalogs, PR-12 fix
     # loop 2, security NIT): stdlib xml.etree.ElementTree relies on

{simulo-0.27.0 → simulo-0.28.0}/src/simulo/_client/_runner.py

@@ -27,14 +27,26 @@ from typing import Any, NoReturn, Optional
 
 from simulo.interfaces.ids import JobId, JobPublicId
 from simulo.interfaces.platform.enums import JobStatus
-from simulo.interfaces.platform.runs import JOB_SCOPE_MINE, TERMINAL_JOB_STATUSES
+from simulo.interfaces.platform.runs import JOB_SCOPE_MINE
 
 #: Poll cadence for cloud ``.get()``. Module-level so tests can shrink it.
 _POLL_INTERVAL_S = 1.0
 
-_TERMINAL_STATUS_STRINGS = frozenset(str(status) for status in TERMINAL_JOB_STATUSES)
 _COMPLETED_STATUS = str(JobStatus.COMPLETED)
 
+#: The tolerant-client check (`M55-org-runtime-policy`, issue #1537):
+#: EVERY status this client can observe outside these two live values is
+#: terminal, whether or not it is one this client's own ``JobStatus`` happens
+#: to know by name. Membership is checked as "not one of the known LIVE
+#: values", never "is one of the known TERMINAL values" — a closed terminal
+#: set silently treats a FUTURE value it has never heard of as still-live
+#: and polls forever (:class:`JobTimeoutError` only fires when the caller
+#: passed a ``timeout``; with none, :meth:`JobHandle._get_cloud` hangs).
+#: Mirrors the existing precedent for an unrecognized ``kind``
+#: (``simulo.interfaces.platform.submit``): a value outside the known set is
+#: treated as data to render, never as grounds to keep waiting on it.
+_LIVE_STATUS_STRINGS = frozenset({str(JobStatus.QUEUED), str(JobStatus.RUNNING)})
+
 
 class JobFailedError(RuntimeError):
     """A cloud job reached a terminal ``failed``/``cancelled`` status.
@@ -154,7 +166,7 @@ class JobHandle:
         while True:
             record = client.get_job(str(self._job_id), scope=JOB_SCOPE_MINE)
             status = str(record.get("status"))
-            if status in _TERMINAL_STATUS_STRINGS:
+            if status not in _LIVE_STATUS_STRINGS:
                 if status == _COMPLETED_STATUS:
                     return client.get_result(str(self._job_id), scope=JOB_SCOPE_MINE)
                 exit_code = record.get("exit_code")

{simulo-0.27.0 → simulo-0.28.0}/src/simulo/_client/app.py

@@ -514,6 +514,26 @@ def _spawn_cloud(
     # already lives there, keyed by this same `job_name`.
     job_entry = manifest.get("jobs", {}).get(job_name) or {}
     system = (job_entry.get("resources") or {}).get("system")
+    # The job's own manifest-declared `timeout` (`M55-org-runtime-policy`,
+    # issue #1537) — already validated at `@app.job(timeout=...)` decoration
+    # time and recorded on THIS job's own manifest entry, exactly like
+    # `system` just above. Forwarded explicitly to `create_job` because the
+    # control plane never parses the uploaded manifest archive itself (see
+    # `JobSubmitRequest.manifest_timeout_s`'s own docstring).
+    manifest_timeout_s = job_entry.get("timeout")
+    if manifest_timeout_s is not None and (
+        isinstance(manifest_timeout_s, bool) or not isinstance(manifest_timeout_s, int)
+    ):
+        # This manifest was just written by THIS process (see the comment on
+        # `Manifest.from_json` re-parsing above) — a non-integer `timeout`
+        # here would mean `@app.job`'s own decoration-time validation
+        # somehow let one through, not an untrusted value to degrade
+        # silently on. Fail loudly rather than send a malformed wire field.
+        raise RuntimeError(
+            f"Package at {package_path} has a non-integer jobs[{job_name!r}].timeout "
+            f"({manifest_timeout_s!r}) in its manifest — this should be impossible; "
+            "please report this as a bug."
+        )
 
     tar_path = ensure_tar(package_path)
     archive_bytes = tar_path.read_bytes()
@@ -568,6 +588,7 @@ def _spawn_cloud(
         assets=asset_pins,
         app_name=app_name,
         system=system,
+        timeout_s=manifest_timeout_s,
     )
 
     raw_public_id = record.get("public_id")
@@ -590,9 +611,24 @@ def _spawn_cloud(
         # the ref resolved to the intended source job. Seed provenance still
         # carries machine UUIDs only, so keep this confirmation neutral rather
         # than leaking a UUID while that response contract catches up.
+        #
+        # `seed["name"]`/`seed["kind"]` are server-supplied text: a
+        # compromised control plane — or a user pointed at an attacker-run
+        # `SIMULO_API_URL` — could embed ANSI/OSC sequences here, so both
+        # route through the same module `cli.py`'s own sanitizers are built
+        # on (`preflight_render`) rather than a second one.
+        # `sanitize_server_text` alone is NOT enough here (cross-vendor
+        # review): it deliberately preserves TAB/LF for its usual
+        # multi-line preflight-finding callers, but this confirmation is a
+        # single line — an unstripped LF would forge an extra line this
+        # code never printed. `_single_line` collapses it instead.
+        from simulo._client.preflight_render import sanitize_server_text_single_line
+
         seed = record.get("seed") or {}
+        seed_name = sanitize_server_text_single_line(str(seed.get("name")))
+        seed_kind = sanitize_server_text_single_line(str(seed.get("kind")))
         print(
-            f"Continuing from selected job ({seed.get('name')}, {seed.get('kind')} checkpoint)",
+            f"Continuing from selected job ({seed_name}, {seed_kind} checkpoint)",
             file=sys.stderr,
         )
 

{simulo-0.27.0 → simulo-0.28.0}/src/simulo/_client/asset_api.py

@@ -296,6 +296,7 @@ class AssetApiClient:
                 api_base_url=self._base_url,
                 timeout=_ARCHIVE_DOWNLOAD_TIMEOUT_S,
                 unavailable_hint=_UNAVAILABLE_HINT,
+                validate_download_url=True,
             )
         except http.HttpError as exc:
             raise _translate(exc) from exc

{simulo-0.27.0 → simulo-0.28.0}/src/simulo/_client/bundle.py

@@ -20,7 +20,7 @@ from pathlib import Path
 from typing import TYPE_CHECKING, Any, Optional, Sequence
 
 from simulo._client.asset import Asset
-from simulo._client.packaging import canonical_args, package, read_bundle_package_id
+from simulo._client.packaging import assert_credentials_outside_project, canonical_args, package, read_bundle_package_id
 from simulo._client.volume import Volume
 from simulo.interfaces.platform import is_platform_pinned
 from simulo.interfaces.platform.manifest import Manifest
@@ -222,6 +222,7 @@ def ensure_bundle(
     (deterministically restoring the correct content for this exact
     submission), never served as a silently wrong package.
     """
+    assert_credentials_outside_project(project_root)
     extra_asset_uris = tuple(sorted({asset.uri for asset in extra_assets}))
     cache_key = (id(app), job_name, canonical_args(args), extra_asset_uris)
     cached = _BUNDLE_CACHE.get(cache_key)

{simulo-0.27.0 → simulo-0.28.0}/src/simulo/_client/cli.py

@@ -361,6 +361,20 @@ _MAX_LIST_LIMIT = 100
 #: (``--all`` on the output commands) or a machine-readable dump
 #: (``--json``), not a table — so those are what the ceiling footer names.
 _MAX_LIST_VIEW_ROWS = 250
+#: A bounded list view may retry a rate-limited page, but no more than this
+#: many times.  Unlike follow loops, a list is a finite read rather than an
+#: operator-controlled wait, so retrying forever would leave the command hung.
+_LIST_RATE_LIMIT_MAX_RETRIES = 3
+#: Total time a bounded list view may spend waiting to retry one or more 429s.
+#: This covers the control plane's current one-minute jobs-list rate-limit
+#: window plus request overhead. A Retry-After that would exceed the remaining
+#: operation budget remains terminal rather than making a listing wait without
+#: a bound.
+_LIST_RATE_LIMIT_RETRY_BUDGET_S = 90.0
+#: Retry-After is required on the platform's 429 responses.  Keep a small
+#: fallback for an older or faulty server that omits it so the bounded retry
+#: does not immediately repeat the request that was just rate-limited.
+_LIST_RATE_LIMIT_RETRY_FALLBACK_S = 1.0
 
 
 def _limit_int(value: str, ceiling: int) -> int:
@@ -416,15 +430,33 @@ def _fetch_list_view(
     ``limit <= _MAX_LIST_LIMIT`` still issues exactly ONE request of exactly
     that size — byte-identical to the single-request behavior this replaced.
 
-    Terminates in at most ``ceil(limit / page_size)`` requests: every
+    A 429 retries the same page after its Retry-After delay.  Retries and
+    their total wait have explicit bounds; when either is exhausted the
+    original error remains terminal, so callers never render accumulated rows
+    as a complete listing.
+
+    Apart from bounded retries, it terminates in at most
+    ``ceil(limit / page_size)`` successful requests: every successful
     iteration either breaks or appends a full page.
     """
     page_size = min(limit, _MAX_LIST_LIMIT)
     rows: list[dict[str, Any]] = []
     total = 0
     page = 1
+    retries = 0
+    retry_deadline = time.monotonic() + _LIST_RATE_LIMIT_RETRY_BUDGET_S
     while True:
-        page_rows, total = fetch_page(page, page_size)
+        try:
+            page_rows, total = fetch_page(page, page_size)
+        except http.HttpHTTPError as exc:
+            if exc.status != 429 or retries >= _LIST_RATE_LIMIT_MAX_RETRIES:
+                raise
+            retry_delay = max(exc.retry_after or 0, _LIST_RATE_LIMIT_RETRY_FALLBACK_S)
+            if time.monotonic() + retry_delay > retry_deadline:
+                raise
+            retries += 1
+            _sleep_for_rate_limit(exc.retry_after, _LIST_RATE_LIMIT_RETRY_FALLBACK_S, deadline=retry_deadline)
+            continue
         rows.extend(page_rows)
         # Enough for the view, a short page (nothing more exists), or we hold
         # everything the server says there is.
@@ -543,9 +575,32 @@ _COMPLETED_STATUS = str(JobStatus.COMPLETED)
 _RUNNING_STATUS = str(JobStatus.RUNNING)
 _CANCELLED_STATUS = str(JobStatus.CANCELLED)
 #: The terminal statuses that carry a self-diagnosis reason (JobRecord's
-#: ``status_reason``/``status_detail``): a failed or cancelled job. A cleanly
-#: ``completed`` job has none.
-_FAILURE_STATUS_STRINGS = frozenset({str(JobStatus.FAILED), str(JobStatus.CANCELLED)})
+#: ``status_reason``/``status_detail``): a failed, cancelled, or timed-out
+#: job. A cleanly ``completed`` job has none.
+#:
+#: ``timed_out`` (`M55-org-runtime-policy`) is added here even though the
+#: control plane still projects a stored ``timed_out`` job as ``failed`` on
+#: every read route today (see that milestone's PR description) — this set
+#: must already be correct for the moment that projection lifts, not
+#: rewritten again at that later date to add the one value its own author
+#: had every reason to add now, while this exact line is open.
+_FAILURE_STATUS_STRINGS = frozenset({str(JobStatus.FAILED), str(JobStatus.CANCELLED), str(JobStatus.TIMED_OUT)})
+
+#: The tolerant-client check for ``simulo view`` specifically
+#: (`M55-org-runtime-policy`, issue #1537) — used ONLY by
+#: :func:`_mint_view_session` and :func:`_cmd_view`'s own post-wait check,
+#: never by the OTHER ``_TERMINAL_STATUS_STRINGS`` call sites on this
+#: surface (``logs --follow``/``cancel``'s own wait loops), which are
+#: unaffected by this milestone. Checked as "not one of the known LIVE
+#: values" rather than "is one of the known TERMINAL values": a job whose
+#: status is anything OTHER than ``queued``/``running`` — including a
+#: FUTURE value this client has never heard of — has ended, and this
+#: command must refuse to mint a view session against it rather than
+#: proceed as though the job were still live (the exact bug an unrecognized
+#: ``timed_out`` produced before this set existed: ``status in
+#: _TERMINAL_STATUS_STRINGS`` reads false for an unknown value, and the
+#: command fell through to minting a session anyway).
+_LIVE_STATUS_STRINGS = frozenset({str(JobStatus.QUEUED), _RUNNING_STATUS})
 
 
 def _log_archive_unavailable(exc: JobsApiHTTPError) -> bool:
@@ -593,7 +648,7 @@ def _report_log_archive_unavailable(exc: JobsApiHTTPError, job_id: str) -> int:
         # longer available": the logs are almost certainly still there and the
         # single most useful thing to tell the user is to try again.
         print(
-            f"Logs for job {job_id} could not be read right now — this is temporary, "
+            f"Logs for job {_safe_table_cell(job_id)} could not be read right now — this is temporary, "
             "not a lost log. Try again in a moment.",
             file=sys.stderr,
             flush=True,
@@ -620,7 +675,7 @@ def _report_log_archive_unavailable(exc: JobsApiHTTPError, job_id: str) -> int:
             "Simulo could not save this job's log output, so it could not be kept. "
             "The job's status and result are unaffected."
         )
-    print(f"Logs for job {job_id} are no longer available. {detail}", file=sys.stderr, flush=True)
+    print(f"Logs for job {_safe_table_cell(job_id)} are no longer available. {detail}", file=sys.stderr, flush=True)
     return 1
 
 
@@ -800,6 +855,25 @@ def _display_resource_id(record: dict[str, Any], machine_field: str, *, unavaila
     output must not regain a UUID leak merely because one response is stale.
     Explicit JSON/info output bypasses this helper and preserves the raw wire
     record unchanged.
+
+    The ``public_id`` branch is a strictly-validated public ID (``parse_*_
+    public_id``) and needs nothing further. The fallback branch is server
+    text with no such validation: bounded in width here so every caller —
+    table cells, prompts, and narrative prose alike — gets a safe value
+    without individually remembering to wrap it, matching the choke-point
+    reasoning :func:`_safe_table_cell` documents.
+
+    The NUL sentinel below is load-bearing, NOT vestigial (cross-vendor
+    review caught a version of this fix that assumed otherwise and
+    dropped it, breaking ``_resource_display_name``'s empty-name path,
+    which returns THIS function's value verbatim as a filename basis —
+    ``_safe_download_filename`` refuses a NUL-tainted name outright rather
+    than silently reconstructing a different one). Every DISPLAY-only
+    caller (a table cell, a prompt, narrative prose — never a filename)
+    strips it by also routing through :func:`_safe_table_cell` /
+    :func:`_safe_single_line_text`, which remove every Unicode ``C*``
+    category including NUL; this function does not strip it itself only
+    because a filename-path caller needs it to survive this boundary.
     """
     public_id = _record_public_id(record, machine_field)
     if public_id is not None:
@@ -816,6 +890,8 @@ def _display_resource_id(record: dict[str, Any], machine_field: str, *, unavaila
     nul_sentinel = "\x00" if "\x00" in raw_machine_text else ""
     if _is_uuid_text(machine_text) or _MACHINE_UUID_RE.search(machine_text):
         return unavailable + nul_sentinel
+    if len(machine_text) > _MAX_OUTPUTS_LINE_CHARS:
+        machine_text = machine_text[: _MAX_OUTPUTS_LINE_CHARS - 1].rstrip() + "…"
     return machine_text + nul_sentinel
 
 
@@ -871,7 +947,17 @@ def _handle_display_id(handle: JobHandle) -> str:
 
 
 def _resolved_job_ref(record: dict[str, Any], fallback: str) -> str:
-    """The complete friendly ref for subsequent calls, failing closed on UUIDs."""
+    """The complete friendly ref for subsequent calls, failing closed on UUIDs.
+
+    Deliberately returns ``fallback`` UNSANITIZED in the synthetic-ID
+    compatibility case: this value feeds follow-up API requests, and
+    mutating it here would send a different identifier than the one the
+    server actually issued (`test_announce_latest_sanitizes_every_rendered_
+    field` in test_cli_outputs.py pins exactly this). Every CALLER that also
+    prints this value to the terminal is responsible for its own
+    :func:`_safe_table_cell`/:func:`_short_job_id` wrap at the print site —
+    do not sanitize here.
+    """
     public_id = _record_public_id(record, "job_id")
     if public_id is not None:
         return public_id
@@ -1852,8 +1938,19 @@ def _seed_summary(
                         public_id_cache[machine_id] = resolved
             except JobsApiError:
                 pass
-    short = job_id
-    name = str(seed.get("name") or seed.get("kind") or "checkpoint")
+    # `_safe_table_cell`, not a bare assignment: `job_id` can come from
+    # `_display_resource_id`'s non-public-id fallback, which can carry a
+    # NUL sentinel through this DISPLAY path on purpose (cross-vendor
+    # review) — only safe to leave unstripped for
+    # `_resource_display_name`'s filename-basis use, never this summary.
+    short = _safe_table_cell(job_id)
+    # `seed["name"]`/`seed["kind"]` are server-supplied text (#623) — route
+    # through the same choke point every other rendered field in this file
+    # uses (`_safe_table_cell`) so BOTH of this function's callers (the
+    # `simulo jobs` "CONTINUED FROM" column and `simulo result`'s stderr
+    # line) are covered by one fix, per this file's own row-builder-SHAPE
+    # design principle (see `_safe_table_cell`'s docstring).
+    name = _safe_table_cell(seed.get("name") or seed.get("kind") or "checkpoint")
     return f"{short} ({name})"
 
 
@@ -1942,10 +2039,12 @@ def _safe_output_detail_text(text: str) -> str:
       terminal encoding can print — left alone, ``print()`` raises
       ``UnicodeEncodeError: surrogates not allowed`` and crashes an
       otherwise-successful command (NFR: users never see a stack trace).
-      Control-char stripping does NOT cover this (surrogates are outside
-      ``\\x00-\\x9f``), so it is handled separately here: round-tripping
-      through UTF-8 with ``errors="replace"`` turns any unencodable
-      codepoint into a literal ``?`` instead of raising.
+      ``sanitize_server_text`` now strips these too (Unicode category
+      ``Cs``, cross-vendor review), but this UTF-8 round-trip with
+      ``errors="replace"`` stays as the belt-and-braces layer — a
+      category check is not the ONLY way an unencodable codepoint can
+      reach this function, and turning it into a literal ``?`` instead of
+      raising is what actually prevents the crash either way.
     """
     text = sanitize_server_text(text)
     return text.encode("utf-8", "replace").decode("utf-8")
@@ -2235,15 +2334,27 @@ def _cmd_jobs(args: argparse.Namespace) -> int:
     )
     rows = [
         (
-            _job_display_id(job),
-            str(job.get("job_name", "-")),
-            str(job.get("status", "-")),
+            # `_safe_table_cell` (not a bare call): `_job_display_id`'s
+            # non-public-id fallback can carry a NUL sentinel through this
+            # DISPLAY path on purpose (cross-vendor review) — it is only
+            # safe to leave unstripped for `_resource_display_name`'s
+            # filename-basis use, never for a table cell.
+            _safe_table_cell(_job_display_id(job)),
+            # `job_name`/`status` are server-supplied text (#623) — the same
+            # class of defect `_announce_latest` already guards against for
+            # these exact two fields on a sibling code path; this table
+            # never had the matching fix.
+            _safe_table_cell(job.get("job_name", "-")),
+            _safe_table_cell(job.get("status", "-")),
         )
         + ((reason or "-",) if show_reason_column else ())
         + ((outputs_summary or "-",) if show_outputs_column else ())
         + (
-            str(job.get("started_at") or "-"),
-            "-" if job.get("exit_code") is None else str(job.get("exit_code")),
+            # `started_at`/`exit_code` are server-supplied too (#623
+            # cross-vendor review) — the same table row builder already
+            # wraps job_name/status, but left these two raw.
+            _safe_table_cell(job.get("started_at") or "-"),
+            "-" if job.get("exit_code") is None else _safe_table_cell(job.get("exit_code")),
         )
         + ((seed_summary or "-",) if show_seed_column else ())
         for job, seed_summary, reason, outputs_summary in zip(jobs, seed_summaries, reason_codes, outputs_summaries)
@@ -2899,9 +3010,9 @@ def _cmd_recordings(args: argparse.Namespace) -> int:
         # the chosen convention (issue #682).
         targeted = args.all or args.name is not None
         if targeted:
-            print(f"No recordings for job {job_id!r}.", file=sys.stderr)
+            print(f"No recordings for job {_safe_repr(job_id)}.", file=sys.stderr)
             return 1
-        print(f"No recordings for job {job_id!r}.")
+        print(f"No recordings for job {_safe_repr(job_id)}.")
         return 0
 
     if args.all:
@@ -2953,7 +3064,7 @@ def _cmd_recordings(args: argparse.Namespace) -> int:
     else:
         available = _join_bounded(sorted(_safe_table_cell(_recording_name(record)) for record in records))
         print(
-            f"Job {job_id!r} has {total} recordings; pass one of ({available}) or --all.",
+            f"Job {_safe_repr(job_id)} has {total} recordings; pass one of ({available}) or --all.",
             file=sys.stderr,
         )
         _print_list_truncation_footer(len(records), total, mention_all=False, cap=_RECORDINGS_VIEW_CAP, file=sys.stderr)
@@ -2987,10 +3098,17 @@ def _cmd_recordings(args: argparse.Namespace) -> int:
         # (see _safe_download_filename).
         destination_observation, dest = _implicit_server_download_destination(_recording_name(record))
         if destination_observation is None or dest is None:
+            # BOTH interpolations are server text and BOTH are bounded
+            # (`_safe_repr`, #623): `repr()` already neutralizes the control
+            # bytes `_safe_download_filename` lets through, but a name that
+            # is long AND unsafe passes the length check, fails the shape
+            # check, and would otherwise land here at full length — the same
+            # wall-of-text hazard `simulo outputs`'/`simulo models`' own
+            # refusal messages already guard against (this one had not).
             print(
                 f"Refusing to download recording "
-                f"{_child_display_id(record, 'recording_id', label='recording')!r}: server-reported "
-                f"name {_recording_name(record)!r} is not a safe local filename. Pass -o PATH to "
+                f"{_safe_repr(_child_display_id(record, 'recording_id', label='recording'))}: server-reported "
+                f"name {_safe_repr(_recording_name(record))} is not a safe local filename. Pass -o PATH to "
                 "choose the destination yourself.",
                 file=sys.stderr,
             )
@@ -3440,9 +3558,15 @@ def _download_model_and_report(
     label = f" ({_safe_table_cell(kind)})" if kind else ""
     verification_note = "sha256 verified" if expected_sha256 else "sha256 not provided by server"
     # Report the LOCAL filename actually written (dest.name), not the raw
-    # server-supplied record["name"] — dest.name is what _safe_download_filename
-    # already vetted, so this print can never echo an unsanitized value back
-    # to the terminal.
+    # server-supplied record["name"]. `_safe_download_filename` DOES strip
+    # control characters (it calls `_safe_single_line_text`, not only the
+    # traversal/reserved-name shape checks) — an earlier version of this
+    # comment claimed otherwise, which cross-vendor review caught as
+    # reversing the actual security ownership. Both halves of this line
+    # are still wrapped in `_safe_table_cell` below as defense-in-depth
+    # (this print does not itself re-derive whether `resolved.name` came
+    # from that exact vetting path), never as the ONLY thing standing
+    # between server text and the terminal.
     print(
         f"Saved {_safe_table_cell(resolved.name)}{label} -> "
         f"{_safe_table_cell(resolved.resolve())} ({verification_note})"
@@ -3634,7 +3758,7 @@ def _cmd_models(args: argparse.Namespace) -> int:
                 _warn_json_bounded(len(records), total)
             return 0
         if not records:
-            print(f"No models for job {job_id!r} (only training jobs produce models).")
+            print(f"No models for job {_safe_repr(job_id)} (only training jobs produce models).")
             return 0
         _print_model_table(records)
         if paginated:
@@ -3643,12 +3767,12 @@ def _cmd_models(args: argparse.Namespace) -> int:
         # is exactly the user who wants the next step, and they should not have
         # to read documentation to find it. Human output only — `--json`
         # returned above, so machine output is unaffected.
-        print(f"Take a policy off the platform (ONNX + local verification): simulo export {job_id}")
+        print(f"Take a policy off the platform (ONNX + local verification): simulo export {_safe_table_cell(job_id)}")
         return 0
 
     records = client.list_models(job_id, scope=scope)  # NAME/--all path — needs the complete set
     if not records:
-        print(f"No models for job {job_id!r} (only training jobs produce models).", file=sys.stderr)
+        print(f"No models for job {_safe_repr(job_id)} (only training jobs produce models).", file=sys.stderr)
         return 1
 
     if args.all:
@@ -4417,11 +4541,16 @@ def _no_checkpoint_message(
     selected_kind = kind or MODEL_KINDS[0]
     suggestion = _first_job_with_models(jobs_client, submit_client, exclude_job_id=job_id, scope=scope)
     lines = [
-        f"Job {job_id} has no {selected_kind} checkpoint to export — only a training run produces "
+        f"Job {_safe_table_cell(job_id)} has no {selected_kind} checkpoint to export — only a training run produces "
         "checkpoints (a rollout, a cancelled run, or a run that failed before its first save has none).",
     ]
     if suggestion is not None:
-        lines += ["", "Export a run that has one:", f"  simulo export {suggestion}"]
+        # `suggestion` comes from `_resolved_job_ref` (via
+        # `_first_job_with_models`), which deliberately returns its
+        # non-public-id fallback RAW for follow-up API calls (cross-vendor
+        # review) — this use is display-only, so it needs its own wrap
+        # here rather than at the source.
+        lines += ["", "Export a run that has one:", f"  simulo export {_safe_table_cell(suggestion)}"]
     else:
         lines += [
             "",
@@ -4458,11 +4587,11 @@ def _export_create_error_message(
                 model_ref = "the selected checkpoint"
             return (
                 f"No checkpoint {model_ref} under job {_human_job_ref(job_id)} — a --model ID must name one of THIS job's "
-                f"checkpoints. List them with `simulo models {job_id}`."
+                f"checkpoints. List them with `simulo models {_safe_table_cell(job_id)}`."
             )
         return (
-            f"Simulo could not resolve a checkpoint to export for job {job_id}. "
-            f"List its checkpoints with `simulo models {job_id}`."
+            f"Simulo could not resolve a checkpoint to export for job {_safe_table_cell(job_id)}. "
+            f"List its checkpoints with `simulo models {_safe_table_cell(job_id)}`."
         )
     if exc.code == "seed_model_unavailable":
         return _no_checkpoint_message(
@@ -4475,9 +4604,9 @@ def _export_create_error_message(
         )
     if exc.code == "seed_job_not_terminal":
         return (
-            f"Job {job_id} has not finished yet — an export converts a FINISHED run's checkpoint.\n"
+            f"Job {_safe_table_cell(job_id)} has not finished yet — an export converts a FINISHED run's checkpoint.\n"
             "Wait for it, then export:\n"
-            f"  simulo logs {job_id} --follow"
+            f"  simulo logs {_safe_table_cell(job_id)} --follow"
         )
     if exc.code == "export_selector_conflict":
         return "Pass either --model MODEL_ID or --kind best|latest, not both — they answer the same question."
@@ -4609,7 +4738,7 @@ def _export_failure_copy(reason: Optional[str], *, job_id: str, kind: Optional[s
             "through it disagreed with the source PyTorch policy beyond the tolerance. No bundle was "
             "published — a converted-but-inequivalent policy is worse than no policy.",
             "Try the other checkpoint of this run:",
-            f"  simulo export {job_id} --kind {other_kind}",
+            f"  simulo export {_safe_table_cell(job_id)} --kind {other_kind}",
         )
     if reason == PolicyExportFailureReason.LOCAL_VALIDATION_FAILED.value:
         return (
@@ -4617,19 +4746,19 @@ def _export_failure_copy(reason: Optional[str], *, job_id: str, kind: Optional[s
             "verify.py on your machine, not to the platform-side conversion check, so this export cannot "
             "be trusted either way.",
             "Try again:",
-            f"  simulo export {job_id}",
+            f"  simulo export {_safe_table_cell(job_id)}",
         )
     if reason == PolicyExportFailureReason.CONVERSION_FAILED.value:
         return (
             "The converter failed before it produced a loadable model. Nothing about your policy is known "
             "to be unexportable — this is the retryable one of the four export failures.",
             "Try again:",
-            f"  simulo export {job_id}",
+            f"  simulo export {_safe_table_cell(job_id)}",
         )
     return (
         "The export job did not finish. This is an ordinary job failure, not a verdict about your policy.",
         "Try again:",
-        f"  simulo export {job_id}",
+        f"  simulo export {_safe_table_cell(job_id)}",
     )
 
 
@@ -4800,7 +4929,7 @@ def _cmd_export(args: argparse.Namespace) -> int:
         print(
             "\nStopped watching. The export is still running on Simulo.\n"
             "Reattach to it — this returns the export already on its way rather than starting a second one:\n"
-            f"  simulo export {job_id}",
+            f"  simulo export {_safe_table_cell(job_id)}",
             file=sys.stderr,
         )
         return 130
@@ -4825,7 +4954,7 @@ def _cmd_export(args: argparse.Namespace) -> int:
             )
             echo("")
             echo("Try again:")
-            echo(f"  simulo export {job_id}")
+            echo(f"  simulo export {_safe_table_cell(job_id)}")
         else:
             _report_export_failure(echo, record, job_id=job_id, kind=args.kind)
         if json_mode:
@@ -4840,7 +4969,7 @@ def _cmd_export(args: argparse.Namespace) -> int:
         echo("")
         echo("Bundle left on the platform (--no-download). Run the export again without it to download and")
         echo("unpack the bundle:")
-        echo(f"  simulo export {job_id}")
+        echo(f"  simulo export {_safe_table_cell(job_id)}")
         if json_mode:
             print(json.dumps({"export": record, "bundle_dir": None}, indent=2))
         return 0
@@ -5093,7 +5222,7 @@ def _mint_view_session(
             if exc.code != _STREAM_ENDPOINT_NOT_READY:
                 raise
             job = jobs_client.get_job(job_id, scope=scope)
-            if str(job.get("status")) in _TERMINAL_STATUS_STRINGS:
+            if str(job.get("status")) not in _LIVE_STATUS_STRINGS:
                 return None, _job_ended_message(job_id)
             if time.monotonic() >= deadline:
                 display_ref = _human_job_ref(job_id)
@@ -5256,7 +5385,7 @@ def _cmd_view(args: argparse.Namespace) -> int:
         jobs_client = JobsApiClient(base_url, token=token)
         view_client = ViewSessionApiClient(base_url, token=token)
 
-    if str(job.get("status")) in _TERMINAL_STATUS_STRINGS:
+    if str(job.get("status")) not in _LIVE_STATUS_STRINGS:
         print(_job_ended_message(job_id), file=sys.stderr)
         return 1
 
@@ -5282,7 +5411,7 @@ def _cmd_view(args: argparse.Namespace) -> int:
     # The actual bootstrap URL deliberately retains the internal job UUID in
     # its fragment.  It is a browser-only transport detail: ordinary CLI
     # output names the public job and must not echo that UUID-bearing URL.
-    print(f"Opening live view for job {job_id} in your browser...")
+    print(f"Opening live view for job {_safe_table_cell(job_id)} in your browser...")
     webbrowser.open(url)
     return 0
 
@@ -5375,9 +5504,18 @@ def _confirm_latest_job_cancel(job: dict[str, Any], *, assume_yes: bool) -> Opti
     if not _stdin_is_tty():
         print(_CANCEL_NON_INTERACTIVE_REFUSAL, file=sys.stderr)
         return 2
-    job_id = _job_display_id(job)
-    name = job.get("job_name", "-")
-    status = job.get("status", "-")
+    # `_safe_table_cell`, not a bare call: `_job_display_id`'s non-public-id
+    # fallback can carry a NUL sentinel through this DISPLAY path on
+    # purpose (cross-vendor review) — only safe to leave unstripped for
+    # `_resource_display_name`'s filename-basis use, never a prompt.
+    job_id = _safe_table_cell(_job_display_id(job))
+    # `job_name`/`status` are server-supplied text (#623) — the same two
+    # fields `simulo jobs`' table and `_announce_latest` already sanitize.
+    # `_safe_table_cell` (not `_safe_single_line_text`) is deliberate here
+    # too: an unbounded hostile name could otherwise push the y/N question
+    # off-screen, the identical width hazard the table guards against.
+    name = _safe_table_cell(job.get("job_name", "-"))
+    status = _safe_table_cell(job.get("status", "-"))
     answer = input(f"Cancel job {job_id} ({name}, {status})? [y/N] ")
     if answer.strip().lower() not in ("y", "yes"):
         print("Nothing cancelled.", file=sys.stderr)
@@ -8663,7 +8801,10 @@ def _build_parser() -> argparse.ArgumentParser:
     )
     asset_delete.set_defaults(func=_observe_handler(asset_delete, _cmd_asset_delete))
 
-    login = sub.add_parser("login", help="Authenticate the CLI via browser (PKCE loopback or manual fallback).")
+    login = sub.add_parser(
+        "login",
+        help="Authenticate via browser; set SIMULO_CREDENTIALS_FILE to save a separate actor session.",
+    )
     login.set_defaults(func=_observe_handler(login, _cmd_login))
 
     logout = sub.add_parser("logout", help="Clear the local session and revoke the refresh token server-side.")