Upload 3 files

Dockerfile

@@ -10,17 +10,16 @@ RUN apt-get update && \
     apt-get install -y --no-install-recommends git curl ca-certificates build-essential && \
     rm -rf /var/lib/apt/lists/*
 
-# Fix: Use the official Astral image for a complete, clean uv installation
+# Use the official Astral image for a complete, clean uv installation
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
 
 WORKDIR /build
 COPY requirements.txt .
 
-# [span_1](start_span)FIX: Use uv to resolve the entire requirements tree at once.[span_1](end_span)
-# [span_2](start_span)This prevents the "ResolutionImpossible" error by finding the[span_2](end_span)
-# [span_3](start_span)valid intersection between Gradio 5 and Aider-chat.[span_3](end_span)
-RUN uv pip install --no-cache --system -r requirements.txt mcp-server-fetch && \
-    pip wheel --no-cache-dir --wheel-dir /wheels -r requirements.txt mcp-server-fetch
+# FIX: only build wheels here — do NOT also run uv pip install --system.
+# The previous double-install (uv pip install --system AND pip wheel) was
+# redundant and could produce conflicting bytecode in the builder layer.
+RUN pip wheel --no-cache-dir --wheel-dir /wheels -r requirements.txt mcp-server-fetch
 
 
 # Stage 2: Runtime
@@ -28,7 +27,10 @@ FROM python:3.12-slim AS runtime
 
 LABEL org.opencontainers.image.title="Rhodawk AI DevSecOps Engine"
 
-# Added critical uv environment variables to force system Python
+# FIX: UV_PYTHON now points to python3 (always present in python:3.12-slim)
+# rather than /usr/local/bin/python which may lack the executable in some
+# HuggingFace Space runtime snapshots. UV_PYTHON_PREFERENCE=system tells uv
+# to skip its managed-toolchain download and use the container Python directly.
 ENV DEBIAN_FRONTEND=noninteractive \
     PYTHONUNBUFFERED=1 \
     GRADIO_SERVER_NAME=0.0.0.0 \
@@ -37,7 +39,7 @@ ENV DEBIAN_FRONTEND=noninteractive \
     PATH="/home/rhodawk/.local/bin:/usr/local/bin:$PATH" \
     UV_LINK_MODE=copy \
     UV_PYTHON_PREFERENCE=system \
-    UV_PYTHON=/usr/local/bin/python
+    UV_PYTHON=/usr/local/bin/python3
 
 RUN apt-get update && \
     apt-get install -y --no-install-recommends git curl ca-certificates nodejs npm && \
@@ -45,18 +47,20 @@ RUN apt-get update && \
 
 RUN npm install -g --quiet @modelcontextprotocol/server-github
 
-# Fix: Hugging Face UID 1000 handling
+# Hugging Face UID 1000 handling
 RUN id -u 1000 >/dev/null 2>&1 && (userdel -r $(id -un 1000) || true) || true && \
     useradd -m -u 1000 -s /bin/bash rhodawk
 
-RUN mkdir -p /data /app && chown -R rhodawk:rhodawk /data /app
+# FIX: create /data with explicit mode so uv venv can write target_venv
+# even before the application calls os.makedirs() at runtime.
+RUN mkdir -p /data /app && chmod 777 /data && chown -R rhodawk:rhodawk /app
 
 WORKDIR /app
 
 # Copy pre-built wheels from builder
 COPY --from=builder /wheels /wheels
 
-# ADDED FIX: Copy the uv executable from the official image
+# Copy the uv executable from the official image
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
 
 RUN pip install --no-cache-dir /wheels/* && rm -rf /wheels

app.py

@@ -306,16 +306,35 @@ def get_changed_files() -> list[str]:
 
 
 def setup_target_venv() -> str:
+    import sys as _sys
+
+    # FIX: ensure /data (PERSISTENT_DIR) exists before writing into it.
+    os.makedirs(PERSISTENT_DIR, exist_ok=True)
+
     if not os.path.exists(VENV_DIR):
         ui_log("Creating isolated virtualenv via uv...")
-        run_subprocess_safe(["uv", "venv", VENV_DIR], cwd="/tmp")
+        # FIX: pass --python explicitly; without it uv exits 2 on Space restarts
+        # when its managed-Python cache is cold or UV_PYTHON is unresolvable.
+        _, code = run_subprocess_safe(
+            ["uv", "venv", "--python", _sys.executable, VENV_DIR],
+            cwd="/tmp", raise_on_error=False,
+        )
+        if code != 0:
+            # FIX: fallback to stdlib venv so the audit can continue even when
+            # uv's Python resolution fails inside the container.
+            ui_log(f"⚠️  uv venv failed (exit {code}) — falling back to python -m venv...")
+            run_subprocess_safe(
+                [_sys.executable, "-m", "venv", VENV_DIR],
+                cwd="/tmp", raise_on_error=True,
+            )
+
     pytest_bin = os.path.join(VENV_DIR, "bin", "pytest")
     req_path = os.path.join(REPO_DIR, "requirements.txt")
     if os.path.exists(req_path):
         ui_log("Installing target repo deps via uv...")
         run_subprocess_safe(
             ["uv", "pip", "install", "--python", VENV_DIR, "--quiet", "-r", req_path],
-            cwd=REPO_DIR, timeout=600,
+            cwd=REPO_DIR, timeout=600, raise_on_error=False,
         )
     return pytest_bin
 

language_runtime.py

@@ -246,9 +246,36 @@ class PythonRuntime(LanguageRuntime):
         return any(os.path.exists(os.path.join(repo_dir, m)) for m in markers)
 
     def setup_env(self, repo_dir: str, persistent_dir: str = "/data") -> EnvConfig:
+        import sys
         venv_dir = os.path.join(persistent_dir, "target_venv")
+
+        # FIX: guarantee the parent directory exists before uv/venv tries to write into it.
+        # In HuggingFace Spaces /data is a mounted volume that may not be pre-created.
+        os.makedirs(persistent_dir, exist_ok=True)
+
         if not os.path.exists(venv_dir):
-            self._run(["uv", "venv", venv_dir], cwd="/tmp", raise_on_error=True)
+            # FIX: pass --python explicitly so uv never has to auto-resolve a Python
+            # interpreter.  Without this flag, uv exits 2 when UV_PYTHON is absent or
+            # the managed-Python toolchain cache is cold (common in Space restarts).
+            out, code = self._run(
+                ["uv", "venv", "--python", sys.executable, venv_dir],
+                cwd="/tmp",
+            )
+            if code != 0:
+                # FIX: graceful fallback to stdlib venv — always available because we
+                # are already running inside the correct interpreter.
+                ui_msg = (
+                    f"uv venv failed (exit {code}) — falling back to "
+                    f"python -m venv. uv output: {out.strip()[:200]}"
+                )
+                import warnings
+                warnings.warn(ui_msg)
+                self._run(
+                    [sys.executable, "-m", "venv", venv_dir],
+                    cwd="/tmp",
+                    raise_on_error=True,
+                )
+
         req_path = os.path.join(repo_dir, "requirements.txt")
         if os.path.exists(req_path):
             self._run(
@@ -263,6 +290,7 @@ class PythonRuntime(LanguageRuntime):
                     ["uv", "pip", "install", "--python", venv_dir, "--quiet", "-e", ".[dev,test]"],
                     cwd=repo_dir, timeout=600,
                 )
+
         pytest_bin = os.path.join(venv_dir, "bin", "pytest")
         return EnvConfig(
             language="python",