add p1 credential-path probe (read-only) + param_count

probes/p1_credential_path.py

@@ -0,0 +1,97 @@
+# Phase 1 CPU probe -- can a Kaggle session act as its own credential store?
+#
+# Why this matters (D-002): §2 permits the HF token to come "from the environment or a secret store",
+# and forbids it reaching a public artifact -- including job logs and any code mirrored to the Hub.
+# The obvious fallback (paste the token into the kernel source) puts it in a Kaggle-held revision and
+# in anything that later mirrors the kernel, so it is the last option, not the first.
+#
+# Kaggle already injects KAGGLE_API_V1_TOKEN / KAGGLE_DATA_PROXY_TOKEN / KAGGLE_USER_SECRETS_TOKEN into
+# internet-enabled sessions (observed in probe p0_cpu_probe). If the Kaggle API is usable *inside* a
+# job, a **private** Kaggle dataset can hold the HF token and be mounted as a data source, which is a
+# genuine secret store: the token then never appears in kernel source, logs, or the public code repo.
+#
+# This probe is READ-ONLY. It lists and reports; it creates nothing and writes no secret. Zero GPU quota.
+# No credentials in this file.
+
+import json
+import os
+import subprocess
+import sys
+import time
+
+R = {}
+
+
+def run(cmd, timeout=180):
+    try:
+        p = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
+        return {"rc": p.returncode, "out": p.stdout[:1500], "err": p.stderr[:900]}
+    except Exception as e:
+        return {"error": f"{type(e).__name__}: {e}"[:200]}
+
+
+def present_and_nonempty(name):
+    v = os.environ.get(name)
+    return {"present": v is not None, "length": len(v) if v else 0}
+
+
+# Never print a token value -- report only that it exists and how long it is.
+R["injected_tokens"] = {n: present_and_nonempty(n) for n in [
+    "KAGGLE_API_V1_TOKEN", "KAGGLE_DATA_PROXY_TOKEN", "KAGGLE_USER_SECRETS_TOKEN",
+    "KAGGLE_DATA_PROXY_URL", "KAGGLE_GRPC_DATA_PROXY_URL", "KAGGLE_KERNEL_INTEGRATIONS",
+    "HF_TOKEN", "HUGGING_FACE_HUB_TOKEN"]}
+
+R["whoami_env"] = run("env | sed 's/=.*/=<redacted>/' | sort | head -60", 60)
+
+# 1. Is the Kaggle API reachable from inside the container at all?
+R["kaggle_cli_preinstalled"] = run("python -m pip show kaggle 2>/dev/null | head -3", 60)
+t = time.monotonic()
+R["kaggle_cli_install"] = run(
+    "python -m pip install --quiet --disable-pip-version-check --no-input kaggle 2>&1 | tail -5", 300)
+R["kaggle_cli_install"]["seconds"] = round(time.monotonic() - t, 1)
+
+# Does it authenticate off the injected credentials, with no ~/.kaggle/kaggle.json written?
+# Redacted through sed on purpose: any credential-shaped run of characters is scrubbed before it can
+# reach stdout, because stdout here becomes a retained kernel log.
+REDACT = " | sed -E 's/[A-Za-z0-9_-]{16,}/<redacted>/g'"
+R["kaggle_auth_status"] = run(f"kaggle --version {REDACT}", 60)
+R["kaggle_whoami"] = run(f"kaggle config view 2>&1 {REDACT}", 60)
+
+# A read that requires a real authenticated principal. If these return rows, the in-job API works.
+R["kaggle_datasets_list"] = run("kaggle datasets list -v --page-size 5 2>&1", 180)
+R["kaggle_kernels_mine"] = run("kaggle kernels list --mine --page-size 5 2>&1", 180)
+
+# 2. The user-secrets harness, if Kaggle exposes it here, is the cleaner store of the two.
+R["secrets_dir"] = run("ls -la /kaggle/input/ 2>&1 | head -20", 60)
+R["secrets_harness"] = {
+    "exists": os.path.exists("/kaggle/input/.secrets/harness_util.py"),
+    "listing": run("ls -la /kaggle/input/.secrets/ 2>&1 | head", 60)}
+
+# 3. Can a job write to the Hub anonymously at all? (It should not be able to.)
+def hub_write_probe():
+    import urllib.request
+    import urllib.error
+
+    url = "https://huggingface.co/api/models/Cion-lab/ounce100m-code/commit/main"
+    req = urllib.request.Request(url, data=b"{}", method="POST",
+                                 headers={"Content-Type": "application/json"})
+    try:
+        with urllib.request.urlopen(req, timeout=30) as r:
+            return {"unexpectedly_ok": True, "status": r.status}
+    except urllib.error.HTTPError as e:
+        return {"expected_denied": True, "status": e.code, "reason": e.reason}
+    except Exception as e:
+        return {"error": f"{type(e).__name__}: {e}"[:200]}
+
+
+R["anonymous_hub_write"] = hub_write_probe()
+
+# 4. Does the image already carry an HF credential path we could populate without a token in source?
+R["hf_cache_state"] = {
+    "HF_HOME": os.environ.get("HF_HOME"),
+    "token_file_exists": os.path.exists(os.path.expanduser("~/.cache/huggingface/token")),
+    "listing": run("ls -la /root/.cache/huggingface/ 2>&1 | head", 60)}
+
+print("PROBE_JSON_BEGIN")
+print(json.dumps(R, indent=1, default=str))
+print("PROBE_JSON_END")