refactor(cli): Fail fast deprecated long-running flwr-* wrappers by msheller · Pull Request #6953 · flwrlabs/flower

msheller · 2026-04-05T21:50:54Z

Issue

Description

Part 6/6 of the SuperExec auth stack. This PR is intentionally scoped so reviewers can focus on one or two concepts at a time.

Related issues/PRs

Stack root base: appio-authn/2-and-3-wire-serverappio-and-clientappio-auth-interceptors
This PR base branch: appio-authn/pr-5-clientappio-superexec-wiring
Head branch: appio-authn/pr-6-deprecated-wrapper-policy
Previous stack PR branch: appio-authn/pr-5-clientappio-superexec-wiring
Companion tests branch: appio-authn/pr-6-deprecated-wrapper-policy-tests

Proposal

Explanation

This PR delivers one reviewable slice of the SuperExec shared-secret auth rollout.

Review focus for this PR:

Explicit fail-fast behavior for deprecated long-running wrappers
Clear migration path messaging to flower-superexec
Scope intentionally limited to wrapper policy

Reviewer notes:

This is one PR in a stacked sequence; review against the configured base branch.
Companion tests are isolated in a separate branch to keep implementation and verification review clean:
- appio-authn/pr-6-deprecated-wrapper-policy-tests

Checklist

Implement proposed change
Write tests (in companion test-only branch)
Update documentation
Address LLM-reviewer comments, if applicable (e.g., GitHub Copilot)
Make CI checks pass
Ping maintainers on Slack (channel #contributions)

Any other comments?

This PR is part of a review-focused stacked rollout. If preferred, I can squash/reorder after initial review passes.

…or.py Co-authored-by: Heng Pan <pan@flower.ai>

… to use a token

…entappio-auth-interceptors

This reverts commit ab0975e.

…entappio-auth-interceptors

Copilot

Pull request overview

This PR enforces fail-fast behavior for deprecated long-running flwr-* wrapper commands, directing users to migrate to flower-superexec.

Changes:

Replaced run_with_deprecation_warning(...) long-running wrapper behavior with immediate flwr_exit(...) for missing --token.
Removed now-unused SuperExec-related imports (ExecPluginType, stubs, plugins, and run_with_deprecation_warning) from the affected entrypoints.
Added migration messaging pointing users to flower-superexec --plugin-type ....

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

File	Description
framework/py/flwr/supernode/cli/flwr_clientapp.py	Fail-fast when invoked without token (deprecated long-running wrapper path).
framework/py/flwr/simulation/app.py	Fail-fast when invoked without token; remove deprecated wrapper plumbing.
framework/py/flwr/server/serverapp/app.py	Fail-fast when invoked without token; remove deprecated wrapper plumbing.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-05T22:00:12Z

+        flwr_exit(
+            ExitCode.SUPEREXEC_INVALID_PLUGIN_CONFIG,
+            "Long-running mode in `flwr-clientapp` is no longer supported. "
+            "Use `flower-superexec --plugin-type clientapp` instead.",
        )


ExitCode.SUPEREXEC_INVALID_PLUGIN_CONFIG appends short-help text about an invalid SuperExec YAML plugin config, which is misleading for this fail-fast path (missing --token/deprecated long-running wrapper usage). Consider using a more appropriate exit code, or introduce a dedicated exit code/help entry for deprecated-wrapper/unsupported long-running mode so the rendered short-help and docs URL match the actual error.

Copilot · 2026-04-05T22:00:13Z

+        flwr_exit(
+            ExitCode.SUPEREXEC_INVALID_PLUGIN_CONFIG,
+            "Long-running mode in `flwr-simulation` is no longer supported. "
+            "Use `flower-superexec --plugin-type serverapp` instead.",
        )


ExitCode.SUPEREXEC_INVALID_PLUGIN_CONFIG will also print the short-help message "The YAML configuration for the SuperExec plugin is invalid.", which doesn’t align with the actual error here (deprecated long-running flwr-simulation invocation without --token). Please switch to a more fitting exit code or add a dedicated exit code/help entry for this deprecated-wrapper policy so users aren’t pointed at the wrong docs.

Suggested change

flwr_exit(

ExitCode.SUPEREXEC_INVALID_PLUGIN_CONFIG,

"Long-running mode in `flwr-simulation` is no longer supported. "

"Use `flower-superexec --plugin-type serverapp` instead.",

)

log(

ERROR,

"Long-running mode in `flwr-simulation` is no longer supported. "

"Use `flower-superexec --plugin-type serverapp` instead.",

)

restore_output()

raise SystemExit(1)

Copilot · 2026-04-05T22:00:13Z

+        flwr_exit(
+            ExitCode.SUPEREXEC_INVALID_PLUGIN_CONFIG,
+            "Long-running mode in `flwr-serverapp` is no longer supported. "
+            "Use `flower-superexec --plugin-type serverapp` instead.",
        )


Same issue as in other wrappers: using ExitCode.SUPEREXEC_INVALID_PLUGIN_CONFIG will append short-help text about invalid SuperExec YAML config, which is confusing for the unsupported long-running flwr-serverapp mode (missing --token). Consider a dedicated exit code/help entry for deprecated wrapper usage or another exit code that better matches this condition.

Copilot · 2026-04-05T22:00:13Z

+        flwr_exit(
+            ExitCode.SUPEREXEC_INVALID_PLUGIN_CONFIG,
+            "Long-running mode in `flwr-clientapp` is no longer supported. "
+            "Use `flower-superexec --plugin-type clientapp` instead.",


The suggested migration command (flower-superexec --plugin-type clientapp) isn’t runnable as-is: flower-superexec also requires --appio-api-address and one of --superexec-auth-secret-file/--superexec-auth-secret-stdin (and typically --insecure, given the earlier TLS check). Please update the message to include the minimum required flags or point users to a specific docs page/example command so the guidance is actionable.

Suggested change

"Use `flower-superexec --plugin-type clientapp` instead.",

"Use `flower-superexec --plugin-type clientapp "

"--appio-api-address <ADDRESS> "

"--superexec-auth-secret-file <PATH> --insecure` instead.",

Copilot · 2026-04-05T22:00:13Z

+        flwr_exit(
+            ExitCode.SUPEREXEC_INVALID_PLUGIN_CONFIG,
+            "Long-running mode in `flwr-simulation` is no longer supported. "
+            "Use `flower-superexec --plugin-type serverapp` instead.",


The migration hint flower-superexec --plugin-type serverapp is incomplete: flower-superexec requires --appio-api-address and a SuperExec auth secret flag (--superexec-auth-secret-file or --superexec-auth-secret-stdin), and will also require --insecure in the current TLS-less implementation. Consider expanding the message to a minimal working command or linking to the relevant docs so users can follow it successfully.

Suggested change

"Use `flower-superexec --plugin-type serverapp` instead.",

"Use `flower-superexec --plugin-type serverapp "

f"--appio-api-address {args.serverappio_api_address} "

"--superexec-auth-secret-file <path> --insecure` instead "

"(or replace `--superexec-auth-secret-file <path>` with "

"`--superexec-auth-secret-stdin`).",

Copilot · 2026-04-05T22:00:13Z

+        flwr_exit(
+            ExitCode.SUPEREXEC_INVALID_PLUGIN_CONFIG,
+            "Long-running mode in `flwr-serverapp` is no longer supported. "
+            "Use `flower-superexec --plugin-type serverapp` instead.",


The guidance Use flower-superexec --plugin-type serverapp instead. omits required flower-superexec args (--appio-api-address and one of --superexec-auth-secret-file/--superexec-auth-secret-stdin, plus --insecure given current TLS limitations). Please adjust the message to include a minimal working invocation or a docs link so the next step is clear and immediately usable.

Suggested change

"Use `flower-superexec --plugin-type serverapp` instead.",

"Use `flower-superexec --plugin-type serverapp "

"--appio-api-address <APPIO_API_ADDRESS> "

"--superexec-auth-secret-file <PATH_TO_SECRET> "

"--insecure` instead.",

msheller and others added 30 commits March 16, 2026 16:30

PR 1 for appio-authn changes using tokens/interceptors

3ecefaf

Reduced scope to ServerAppIo and fixed mypy pylint issues

8c8aa0d

Merge branch 'main' into appio-authn/1-shared-interceptor-foundation

466c1a2

Apply suggestion from @panh99

ade51e4

Apply suggestion from @panh99

cd6a276

Update framework/py/flwr/supercore/interceptors/appio_token_intercept…

c666a09

…or.py Co-authored-by: Heng Pan <pan@flower.ai>

Update framework/py/flwr/supercore/interceptors/appio_token_intercept…

92dbcd0

…or.py Co-authored-by: Heng Pan <pan@flower.ai>

Merge branch 'main' into appio-authn/1-shared-interceptor-foundation

10d58a7

Fixed factory name

d08b1b1

Placed policy code into new auth module

c9d4bc0

Removed use of request token in interceptor

079077c

No longer relies on fixed list of methods for interceptor test

a6c5f37

Merge branch 'main' into appio-authn/1-shared-interceptor-foundation

1021ae8

Update policy.py

19dd511

Update __init__.py

dee3250

Merge branch 'main' into appio-authn/1-shared-interceptor-foundation

ac98c4b

Initial draft

5cf4261

Merge branch 'main' into appio-authn/2-wire-serverappio-auth-interceptor

4630760

Updated initial draft to include PR3 as well (ClientAppIo wiring)

2a50444

Disallow empty token in GrpcGrid init

9092eec

Added tests recommended by Codex

9bbc1c7

Initial draft of simulation wiring (client-side)

d862946

Update to fix token lifecycle logic and force simulationio_connection…

eefd34d

… to use a token

Merge branch 'main' into appio-authn/2-and-3-wire-serverappio-and-cli…

8d6649e

…entappio-auth-interceptors

Merge branch 'main' into appio-authn/2-and-3-wire-serverappio-and-cli…

3a8e941

…entappio-auth-interceptors

Merge branch 'main' into appio-authn/2-and-3-wire-serverappio-and-cli…

9340dcb

…entappio-auth-interceptors

Merge branch 'main' into appio-authn/2-and-3-wire-serverappio-and-cli…

0f95540

…entappio-auth-interceptors

Added new run-type parameter to create_run calls

2d3bf9f

Merge branch 'main' into appio-authn/2-and-3-wire-serverappio-and-cli…

5049be1

…entappio-auth-interceptors

Added temporary test change to assist diagnosing CI failure

ab0975e

msheller added 9 commits March 26, 2026 08:26

Revert "Added temporary test change to assist diagnosing CI failure"

a43fa90

This reverts commit ab0975e.

Merge branch 'main' into appio-authn/2-and-3-wire-serverappio-and-cli…

cce72c9

…entappio-auth-interceptors

Merge branch 'main' into appio-authn/2-and-3-wire-serverappio-and-cli…

8502bf1

…entappio-auth-interceptors

feat(superexec-auth): add shared-secret auth primitives

b4466f4

feat(corestate): add nonce replay reservation foundation

edb6e94

feat(interceptors): add SuperExec auth interceptor foundation

eda1356

feat(serverappio): wire SuperExec auth to ServerAppIo

00ecfbe

feat(clientappio): wire SuperExec auth to ClientAppIo

2552890

refactor(cli): fail fast long-running deprecated wrappers

d489151

msheller marked this pull request as ready for review April 5, 2026 21:56

msheller requested review from danieljanes and tanertopal as code owners April 5, 2026 21:56

msheller requested a review from Copilot April 5, 2026 21:56

Copilot started reviewing on behalf of msheller April 5, 2026 21:57 View session

Copilot AI reviewed Apr 5, 2026

View reviewed changes

msheller marked this pull request as draft April 5, 2026 22:22

github-actions bot added the Maintainer Used to determine what PRs (mainly) come from Flower maintainers. label Apr 5, 2026

msheller force-pushed the appio-authn/pr-5-clientappio-superexec-wiring branch 2 times, most recently from 6b386c0 to e111e40 Compare April 8, 2026 21:16

Base automatically changed from appio-authn/pr-5-clientappio-superexec-wiring to main April 9, 2026 16:46

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

refactor(cli): Fail fast deprecated long-running flwr-* wrappers#6953

refactor(cli): Fail fast deprecated long-running flwr-* wrappers#6953
msheller wants to merge 39 commits intomainfrom
appio-authn/pr-6-deprecated-wrapper-policy

msheller commented Apr 5, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 5, 2026

Uh oh!

Copilot AI Apr 5, 2026

Uh oh!

Copilot AI Apr 5, 2026

Uh oh!

Copilot AI Apr 5, 2026

Uh oh!

Copilot AI Apr 5, 2026

Uh oh!

Copilot AI Apr 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

-            "Use `flower-superexec --plugin-type clientapp` instead.",
+            "Use `flower-superexec --plugin-type clientapp "
+            "--appio-api-address <ADDRESS> "
+            "--superexec-auth-secret-file <PATH> --insecure` instead.",

-            "Use `flower-superexec --plugin-type serverapp` instead.",
+            "Use `flower-superexec --plugin-type serverapp "
+            f"--appio-api-address {args.serverappio_api_address} "
+            "--superexec-auth-secret-file <path> --insecure` instead "
+            "(or replace `--superexec-auth-secret-file <path>` with "
+            "`--superexec-auth-secret-stdin`).",

-            "Use `flower-superexec --plugin-type serverapp` instead.",
+            "Use `flower-superexec --plugin-type serverapp "
+            "--appio-api-address <APPIO_API_ADDRESS> "
+            "--superexec-auth-secret-file <PATH_TO_SECRET> "
+            "--insecure` instead.",

Conversation

msheller commented Apr 5, 2026

Issue

Description

Related issues/PRs

Proposal

Explanation

Checklist

Any other comments?

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants