urun-cli 0.6.2__tar.gz → 0.6.3__tar.gz

{urun_cli-0.6.2 → urun_cli-0.6.3}/CHANGELOG.md

@@ -1,3 +1,12 @@
+## 0.6.3
+
+- Bump the vendored `urun-openai` binary pin to `@urun-sh/openai@0.5.0` — the
+  **`omp` agent launcher** (`urun compat omp -p "..."`, the direct
+  extension lane: no proxy subprocess, omp loads `@urun-sh/openai/pi-extension`
+  via its own `-e` mechanism and selects the app with `--model urun/<slug>`)
+  ships through the installed CLI's vendored bundle. Pin + integrity advanced
+  in the same commit (supply-chain contract, see `scripts/openai_proxy.pin`).
+
 # Changelog
 
 ## 0.5.4

{urun_cli-0.6.2 → urun_cli-0.6.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: urun-cli
-Version: 0.6.2
+Version: 0.6.3
 Summary: End-user CLI for deploying apps to urun
 Project-URL: Homepage, https://urun.sh
 Project-URL: Repository, https://github.com/urun-sh/urun-cli

{urun_cli-0.6.2 → urun_cli-0.6.3}/pyproject.toml

@@ -20,7 +20,7 @@ name = "urun-cli"
 # so every merge remains on the already-published version until this value is
 # advanced. Wiring semantic-release into CI remains separate work; this patch
 # bump is the minimal release unblock for the three post-v0.6.0 fixes.
-version = "0.6.2"
+version = "0.6.3"
 description = "End-user CLI for deploying apps to urun"
 readme = "README.md"
 requires-python = ">=3.11"

{urun_cli-0.6.2 → urun_cli-0.6.3}/src/urun/scratch.py

@@ -341,6 +341,49 @@ def _scratch_venv_path(name: str) -> str:
     return f"{SCRATCH_STORAGE_ROOT}/{name}/venv"
 
 
+def _scratch_storage_mounts(
+    runtime_container: dict[str, Any], name: str
+) -> tuple[list[dict[str, Any]], dict[str, Any] | None]:
+    """The storage mounts the venv overlay needs, for either render shape.
+
+    Returns ``(init_mounts, runtime_extra)``:
+
+    * LEGACY full-root render (``/mnt/storage-backend`` mounted whole): the
+      init container reuses that mount and the runtime container already sees
+      the scratch venv through it — ``runtime_extra`` is ``None``.
+    * SCOPED render (tenant isolation: only subPath mounts such as ``.uv``):
+      the init container gets the ``.uv`` mount (the source venv, read-only,
+      as rendered) plus a READ-WRITE subPath mount of the platform scratch
+      prefix ``.scratch/<name>`` at the scratch venv's parent dir (kubelet
+      creates a missing RW subPath dir); the runtime container needs that
+      same RW mount to reach ``URUN_DEPS_VENV`` — returned as
+      ``runtime_extra``. No full-root mount is ever added to a scoped pod.
+    """
+    mounts = runtime_container.get("volumeMounts", [])
+    full_root = [m for m in mounts if m.get("mountPath") == "/mnt/storage-backend"]
+    if full_root:
+        return copy.deepcopy(full_root), None
+    uv = [m for m in mounts if m.get("subPath") == ".uv"]
+    if not uv:
+        raise UrunError(
+            "--wheel needs the runtime container to mount the deps venv store "
+            "(/mnt/storage-backend whole, or the scoped .uv subPath) — no such mount found"
+        )
+    if uv[0].get("readOnly") is not True:
+        raise UrunError(
+            "--wheel refuses a scoped render whose .uv subPath is writable: the shared "
+            "deps-venv store must be read-only on tenant pods (a writable .uv would let "
+            "the scratch pod modify every app's venv)"
+        )
+    scratch_mount = {
+        "name": uv[0]["name"],
+        "mountPath": f"{SCRATCH_STORAGE_ROOT}/{name}",
+        "subPath": f".scratch/{name}",
+        "readOnly": False,
+    }
+    return [copy.deepcopy(uv[0]), copy.deepcopy(scratch_mount)], scratch_mount
+
+
 def venv_overlay_init_container(
     runtime_container: dict[str, Any], wheel_spec: str, name: str
 ) -> dict[str, Any]:
@@ -375,21 +418,12 @@ def venv_overlay_init_container(
         'touch "$dst/.scratch-ready"\n'
         'echo "[scratch] venv overlay ready: $dst"\n'
     )
-    storage_mounts = [
-        mount
-        for mount in runtime_container.get("volumeMounts", [])
-        if mount.get("mountPath") == "/mnt/storage-backend"
-    ]
-    if not storage_mounts:
-        raise UrunError(
-            "--wheel needs the runtime container to mount /mnt/storage-backend "
-            "(no storage mount found)"
-        )
+    init_mounts, _runtime_extra = _scratch_storage_mounts(runtime_container, name)
     return {
         "name": "scratch-venv-overlay",
         "image": runtime_container["image"],
         "command": ["sh", "-c", script],
-        "volumeMounts": copy.deepcopy(storage_mounts),
+        "volumeMounts": init_mounts,
     }
 
 
@@ -470,6 +504,10 @@ def derive_scratch_sts(
         overlay = venv_overlay_init_container(runtime, wheel_spec, name)
         pod_spec.setdefault("initContainers", []).append(overlay)
         forced_env["URUN_DEPS_VENV"] = _scratch_venv_path(name)
+        _init_mounts, runtime_extra = _scratch_storage_mounts(runtime, name)
+        if runtime_extra is not None:
+            # Scoped render: the runtime container must reach the overlaid venv.
+            runtime.setdefault("volumeMounts", []).append(copy.deepcopy(runtime_extra))
 
     env_list = runtime.setdefault("env", [])
     present = {e.get("name") for e in env_list}