odysseus-dev/odysseus · error · HTTPException

Invalid pip package name

Error message

Invalid pip package name

What it means

HTTP 400 from the pip-install branch of the serve route in routes/cookbook_routes.py (~line 2028). Here req.repo_id doubles as a pip package spec and must fullmatch [A-Za-z0-9][A-Za-z0-9._\-\[\]<>=!,~]{0,200} — a PEP-508-ish name with optional extras and version specifiers. The regex was tightened (v2 review HIGH-14) to use fullmatch and drop spaces and +, which could smuggle extra shell tokens into the serve command.

Source

Thrown at routes/cookbook_routes.py:2028

            # The previous regex turned that URL into
            #   https://abetlen.github.io/llama-cpp-python[server]/whl/cu124
            # which pip then couldn't resolve → silent fallback to source
            # build of the .tar.gz → CPU-only binary (because CMAKE_ARGS
            # isn't set), defeating the entire purpose of the CUDA index.
            req.cmd = re.sub(r"(?<![A-Za-z0-9_.\-/])llama_cpp(?![A-Za-z0-9_.\-/])", "llama-cpp-python[server]", req.cmd)
            req.cmd = re.sub(r"(?<![A-Za-z0-9_.\-/])llama-cpp-python(?![\[/])", "llama-cpp-python[server]", req.cmd)
            if "llama-cpp-python" in req.cmd and "--extra-index-url" not in req.cmd:
                req.cmd += " --extra-index-url https://abetlen.github.io/llama-cpp-python/whl/cpu"
            # PEP-508-style package spec — letters, digits, `.-_` for the
            # name; `[` `]` for extras; `<>=!~,` for version specifiers.
            # v2 review HIGH-14: tightened from the previous regex which
            # also allowed spaces and `+`, both of which can be abused to
            # introduce extra shell tokens once interpolated into the
            # serve command. We now use `re.fullmatch` and drop space/`+`.
            if not req.repo_id or not re.fullmatch(
                r"[A-Za-z0-9][A-Za-z0-9._\-\[\]<>=!,~]{0,200}", req.repo_id
            ):
                raise HTTPException(400, "Invalid pip package name")
        else:
            _validate_serve_model_id(req.repo_id)
        TMUX_LOG_DIR.mkdir(parents=True, exist_ok=True)
        session_id = f"serve-{uuid.uuid4().hex[:8]}"
        remote = req.remote_host
        is_windows = req.platform == "windows"

        # Ollama: if the user didn't pin a port, resolve the actual port we'll
        # bind to here (before runner construction) by probing the target host.
        # Otherwise the runner script picks one at runtime and `_auto_register`
        # below still registers the stale 11434 default — which on a host with
        # a systemd ollama lands on the wrong (unreachable-from-docker) service.
        # Match "ollama serve" as a phrase (with optional flags after), not
        # any substring containing "ollama" — otherwise commands like
        # `docker exec ollama-test ollama-import …` get wrapped as if they
        # were native `ollama serve`, prepending OLLAMA_HOST=… and then
        # running the ollama-not-found preflight which exits 127.
        if re.search(r"\bollama\s+serve\b", req.cmd) and "OLLAMA_HOST=" not in req.cmd:

View on GitHub (pinned to f9235ebbf1)

Solutions

1. Send a plain package name with optional extras and version specifier: llama-cpp-python[server]>=0.2.83
2. Remove spaces, + local version tags, @, :, and VCS URLs from the spec
3. Note the route auto-appends --extra-index-url for llama-cpp-python CPU wheels — do not add it via the name field
4. Pick the exact version from the wheel index so no +local segment is needed

Example fix

// before
{"repo_id": "torch==2.3.1+cu121"}
// after
{"repo_id": "torch==2.3.1"}

import re
PIP_SPEC = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._\-\[\]<>=!,~]{0,200}$")

def prevalidate_pip_spec(v):
    v = (v or "").strip()
    if not PIP_SPEC.fullmatch(v):
        raise ValueError("pip spec must be name[extras]<spec>; no spaces, +, @, :, /")
    return v

prevalidate_pip_spec("llama-cpp-python[server]>=0.2.83")  # ok

When it happens

Trigger: repo_id="llama-cpp-python[server]>=0.2.90" passes; "llama-cpp-python server" (space), "torch==2.3.1+cu121" (+ local tag), "-e ./pkg" (leading dash), or "pkg@ git+https://..." (@, :, /) all fail.

Common situations: Passing a pip URL/VCS spec (git+https) where only name[extras]+specifier is allowed; copying a whole `pip install` command line into the field; CUDA wheel versions with +local segments that must be dropped or matched exactly.

Related errors

• repo_id is required
• Invalid repo_id — must be <org>/<name>, an Ollama name:tag,
• Invalid local_dir — path segments cannot start with '-'
• Invalid cmd — could not parse
• cmd binary '{base or '(empty)'}' is not allowed. Must start

AI-assisted analysis of odysseus-dev/odysseus@f9235ebbf1 (2026-08-14). Data as JSON: /api/errors/e4b03b9465d93768. Report an issue: GitHub.