Merge remote-tracking branch 'origin/main' into pr-5748-head

tests/studio/install/test_launch_studio_launcher.py

@@ -0,0 +1,50 @@
+"""Guard install.ps1's launch-studio.vbs against re-introducing the AV-heuristic
+shape: a WScript .vbs spawning a hidden, ExecutionPolicy-Bypass PowerShell."""
+
+import re
+from pathlib import Path
+
+import pytest
+
+REPO_ROOT = Path(__file__).resolve().parents[3]
+INSTALL_PS1 = REPO_ROOT / "install.ps1"
+
+
+def _vbs_block() -> str:
+    text = INSTALL_PS1.read_text(encoding = "utf-8")
+    m = re.search(r'\$vbsContent\s*=\s*@"\r?\n(.*?)\r?\n"@', text, re.S)
+    assert m, "could not locate the $vbsContent here-string in install.ps1"
+    return m.group(1)
+
+
+def test_install_ps1_present():
+    assert INSTALL_PS1.is_file(), f"missing {INSTALL_PS1}"
+
+
+def test_vbs_does_not_pass_windowstyle_hidden():
+    vbs = _vbs_block()
+    assert "-WindowStyle Hidden" not in vbs, (
+        "launch-studio.vbs must not pass -WindowStyle Hidden to PowerShell: the "
+        "window is already hidden by shell.Run(cmd, 0, False); the redundant flag "
+        "only adds the hidden-PowerShell token that AV heuristics flag."
+    )
+
+
+def test_vbs_stays_windowless_via_shell_run():
+    vbs = _vbs_block()
+    assert re.search(r"shell\.Run\s+cmd\s*,\s*0\s*,\s*False", vbs), (
+        "launcher must remain windowless via shell.Run(cmd, 0, False) "
+        "(intWindowStyle 0 = hidden)."
+    )
+
+
+def test_vbs_keeps_bypass_and_file_invocation():
+    # Bypass lets the unsigned local .ps1 run under the default Restricted policy.
+    vbs = _vbs_block()
+    assert "-ExecutionPolicy Bypass" in vbs
+    assert "-File" in vbs
+    assert "powershell" in vbs
+
+
+if __name__ == "__main__":
+    raise SystemExit(pytest.main([__file__, "-v"]))

tests/studio/install/test_selection_logic.py

@@ -2611,6 +2611,59 @@ class TestDirectLinuxNvidiaCpuGate:
         assert [a.install_kind for a in plan.attempts] == ["linux-cpu"]
 
 
+class TestLinuxPublishedAttemptsNvidiaCpuGate:
+    """Live fork-manifest path (_linux_published_attempts): an NVIDIA host whose
+    CUDA selection finds nothing must NOT be handed the manifest's CPU bundle --
+    the attempt list stays empty so the caller source-builds with CUDA instead of
+    silently installing a CPU-only binary on a GPU host. CPU-only hosts still get
+    the CPU bundle. Mirrors the ROCm policy and TestDirectLinuxNvidiaCpuGate (the
+    latter covers direct_linux_release_plan, which is off the live path, this the
+    live path)."""
+
+    def _cpu_only_bundle(self):
+        return make_release(
+            [
+                make_artifact(
+                    "app-b8508-linux-x64-cpu.tar.gz",
+                    install_kind = "linux-cpu",
+                    runtime_line = None,
+                    coverage_class = None,
+                    supported_sms = [],
+                    min_sm = None,
+                    max_sm = None,
+                    bundle_profile = None,
+                    rank = 1000,
+                ),
+            ]
+        )
+
+    def test_nvidia_host_without_cuda_line_gets_no_cpu_attempt(self, monkeypatch):
+        monkeypatch.setattr(
+            INSTALL_LLAMA_PREBUILT,
+            "detect_torch_cuda_runtime_preference",
+            lambda host: CudaRuntimePreference(runtime_line = None, selection_log = []),
+        )
+        monkeypatch.setattr(
+            INSTALL_LLAMA_PREBUILT,
+            "detected_linux_runtime_lines",
+            lambda: (["cuda13"], {"cuda13": ["/usr/local/cuda/lib64"]}),
+        )
+        host = make_host(driver_cuda_version = (13, 1), compute_caps = ["100"])
+        attempts = INSTALL_LLAMA_PREBUILT._linux_published_attempts(host, self._cpu_only_bundle())
+        assert attempts == []
+
+    def test_cpu_host_gets_cpu_attempt(self):
+        host = make_host(
+            nvidia_smi = None,
+            driver_cuda_version = None,
+            compute_caps = [],
+            has_physical_nvidia = False,
+            has_usable_nvidia = False,
+        )
+        attempts = INSTALL_LLAMA_PREBUILT._linux_published_attempts(host, self._cpu_only_bundle())
+        assert [a.install_kind for a in attempts] == ["linux-cpu"]
+
+
 # ===========================================================================
 # N.1d. published_windows_cuda_attempts -- version-dynamic ordering seed
 # ===========================================================================

tests/test_studio_install_workspace_guard.py

@@ -873,15 +873,20 @@ def test_llama_cpp_search_roots_handles_studio_root_oserror():
     llama_cpp = (
         REPO_ROOT / "studio" / "backend" / "core" / "inference" / "llama_cpp.py"
     ).read_text()
-    find_block_start = llama_cpp.index("_find_llama_server_binary")
-    find_block = llama_cpp[find_block_start : find_block_start + 4000]
-    assert (
-        "except (ImportError, OSError, ValueError):" in find_block
+
+    def _method_body(name: str) -> str:
+        # Whole method body (def to next sibling def), so the check survives the
+        # function growing past any fixed-size window.
+        start = llama_cpp.index(f"def {name}")
+        indent = " " * (start - llama_cpp.rfind("\n", 0, start) - 1)
+        nxt = llama_cpp.find(f"\n{indent}def ", start + 1)
+        return llama_cpp[start : nxt if nxt != -1 else len(llama_cpp)]
+
+    assert "except (ImportError, OSError, ValueError):" in _method_body(
+        "_find_llama_server_binary"
     ), "_find_llama_server_binary must catch (ImportError, OSError, ValueError) from studio_root()"
-    kill_def_idx = llama_cpp.index("def _kill_orphaned_servers")
-    kill_block = llama_cpp[kill_def_idx : kill_def_idx + 4000]
-    assert (
-        "except (ImportError, OSError, ValueError):" in kill_block
+    assert "except (ImportError, OSError, ValueError):" in _method_body(
+        "_kill_orphaned_servers"
     ), "sibling _kill_orphaned_servers must keep its (ImportError, OSError, ValueError) handler"