PyVaultRCE 2.0.0__tar.gz → 2.2.0__tar.gz

{pyvaultrce-2.0.0 → pyvaultrce-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: PyVaultRCE
-Version: 2.0.0
+Version: 2.2.0
 Summary: Remote Code Execution & Hosting client for PyVault — source never exposed
 Author: PyVault
 Keywords: remote execution code hosting vault rce session
@@ -13,6 +13,7 @@ Classifier: Topic :: Internet :: WWW/HTTP
 Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 Requires-Dist: requests>=2.28.0
+Requires-Dist: cryptography>=41.0.0
 Dynamic: author
 Dynamic: classifier
 Dynamic: description

{pyvaultrce-2.0.0 → pyvaultrce-2.2.0}/PyVaultRCE.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: PyVaultRCE
-Version: 2.0.0
+Version: 2.2.0
 Summary: Remote Code Execution & Hosting client for PyVault — source never exposed
 Author: PyVault
 Keywords: remote execution code hosting vault rce session
@@ -13,6 +13,7 @@ Classifier: Topic :: Internet :: WWW/HTTP
 Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 Requires-Dist: requests>=2.28.0
+Requires-Dist: cryptography>=41.0.0
 Dynamic: author
 Dynamic: classifier
 Dynamic: description

pyvaultrce-2.2.0/PyVaultRCE.egg-info/requires.txt

@@ -0,0 +1,2 @@
+requests>=2.28.0
+cryptography>=41.0.0

{pyvaultrce-2.0.0 → pyvaultrce-2.2.0}/pyvaultrce/__init__.py

@@ -18,5 +18,5 @@ Quick start:
 from .manager import CodeManager
 
 __all__    = ["CodeManager"]
-__version__ = "2.0.0"
+__version__ = "2.2.0"
 __author__  = "PyVault"

{pyvaultrce-2.0.0 → pyvaultrce-2.2.0}/pyvaultrce/manager.py

@@ -15,12 +15,36 @@ except ImportError:
         "The 'requests' library is required. Install it with: pip install requests"
     )
 
-_DEFAULT_BASE = os.environ.get("PYVAULT_URL", "http://localhost:5000")
-_MAX_CHARS    = 10_000
-_SID_LEN      = 21
-_HEX_SET      = frozenset("0123456789abcdef")
+try:
+    from cryptography.fernet import Fernet, InvalidToken as _InvalidToken
+    _CIPHER_KEY = b"aK3vytd8SaduKCt6D8-yL-DA2pDNOGiNLfZhnBPJebo="
+    _cipher     = Fernet(_CIPHER_KEY)
+    _HAS_CRYPTO = True
+except ImportError:
+    _HAS_CRYPTO = False
+
+_DEFAULT_BASE = os.environ.get(
+    "PYVAULT_URL",
+    "https://secure-code-runner--diwasreplit.replit.app"
+)
+_MAX_LINES = 10_000
+_SID_LEN   = 21
+_HEX_SET   = frozenset("0123456789abcdef")
+
+
+# ── Encryption helpers ─────────────────────────────────────────────────────────
+
+def _decrypt(data: str) -> str:
+    """Decrypt a Fernet-encrypted payload. Falls back to plaintext on failure."""
+    if not _HAS_CRYPTO:
+        return data
+    try:
+        return _cipher.decrypt(data.encode("ascii")).decode("utf-8")
+    except (_InvalidToken, Exception):
+        return data
 
-# ── Helpers ───────────────────────────────────────────────────────────────────
+
+# ── HTTP helpers ───────────────────────────────────────────────────────────────
 
 def _base(url: Optional[str]) -> str:
     return (url or _DEFAULT_BASE).rstrip("/")
@@ -58,25 +82,21 @@ def _resolve_paste_url(url: str) -> str:
     Supports pastebin.com, hastebin.com, dpaste.com, paste.ofcode.org,
     GitHub Gist raw URLs, and any URL already pointing to raw text.
     """
-    # pastebin.com/XXXX → pastebin.com/raw/XXXX
     url = re.sub(
         r"(https?://pastebin\.com/)(?!raw/)([A-Za-z0-9]+)(\?.*)?$",
         r"\1raw/\2",
         url,
     )
-    # hastebin.com/XXXX → hastebin.com/raw/XXXX
     url = re.sub(
         r"(https?://hastebin\.com/)(?!raw/)([A-Za-z0-9]+)(\?.*)?$",
         r"\1raw/\2",
         url,
     )
-    # dpaste.com/XXXX → dpaste.com/XXXX.txt
     url = re.sub(
         r"(https?://dpaste\.com/)([A-Z0-9]+)(?!\.txt)(\?.*)?$",
         r"\1\2.txt",
         url,
     )
-    # paste.ofcode.org/XXXX → paste.ofcode.org/raw/XXXX
     url = re.sub(
         r"(https?://paste\.ofcode\.org/)(?!raw/)([A-Za-z0-9]+)(\?.*)?$",
         r"\1raw/\2",
@@ -89,9 +109,9 @@ def _http_post(url: str, payload: dict, timeout: int) -> requests.Response:
     try:
         return requests.post(url, json=payload, timeout=timeout)
     except requests.exceptions.ConnectionError:
+        _hint = _localhost_hint(url)
         raise ConnectionError(
-            f"Unable to connect to PyVault at '{url}'. "
-            "Ensure the server is running and PYVAULT_URL is set correctly."
+            f"Unable to connect to PyVault at '{url}'.{_hint}"
         )
     except requests.exceptions.Timeout:
         raise TimeoutError(f"Request to '{url}' timed out after {timeout}s.")
@@ -103,9 +123,9 @@ def _http_get(url: str, timeout: int, headers: Optional[dict] = None) -> request
     try:
         return requests.get(url, timeout=timeout, headers=headers or {})
     except requests.exceptions.ConnectionError:
+        _hint = _localhost_hint(url)
         raise ConnectionError(
-            f"Unable to connect at '{url}'. "
-            "Ensure the server is running and PYVAULT_URL is set correctly."
+            f"Unable to connect to PyVault at '{url}'.{_hint}"
         )
     except requests.exceptions.Timeout:
         raise TimeoutError(f"Request to '{url}' timed out after {timeout}s.")
@@ -113,27 +133,55 @@ def _http_get(url: str, timeout: int, headers: Optional[dict] = None) -> request
         raise ConnectionError(f"HTTP request failed: {exc}") from exc
 
 
-def _upload_code(code: str, base_url: Optional[str], timeout: int) -> str:
-    """Internal: push code string to /pyv/save and return the session ID."""
+def _localhost_hint(url: str) -> str:
+    if "localhost" in url or "127.0.0.1" in url:
+        return (
+            "\n\n  ✗ PYVAULT_URL is not set — defaulting to localhost will not work "
+            "on a phone or remote machine.\n"
+            "  → Set it before running:\n"
+            "       import os\n"
+            "       os.environ['PYVAULT_URL'] = 'https://secure-code-runner--diwasreplit.replit.app'\n"
+            "    or in your shell:\n"
+            "       export PYVAULT_URL=https://secure-code-runner--diwasreplit.replit.app"
+        )
+    return ""
+
+
+def _upload_code(
+    code: str,
+    base_url: Optional[str],
+    timeout: int,
+    expires_in_hours: Optional[float] = None,
+    max_executions: int = 0,
+) -> tuple:
+    """Internal: push code string to /pyv/save. Returns (session_id, owner_token)."""
     if not code.strip():
         raise ValueError("Code is empty — nothing to upload.")
-    if len(code) > _MAX_CHARS:
+    line_count = len(code.splitlines())
+    if line_count > _MAX_LINES:
         raise ValueError(
-            f"Code is {len(code):,} characters, which exceeds the server limit of {_MAX_CHARS:,}."
+            f"Code is {line_count:,} lines, which exceeds the server limit of {_MAX_LINES:,} lines."
         )
+    payload = {"code": code}
+    if expires_in_hours and expires_in_hours > 0:
+        payload["expires_in_hours"] = expires_in_hours
+    if max_executions and max_executions > 0:
+        payload["max_executions"] = max_executions
+
     url  = _base(base_url) + "/pyv/save"
-    resp = _http_post(url, {"code": code}, timeout)
+    resp = _http_post(url, payload, timeout)
     if resp.status_code != 201:
         try:
             err = resp.json().get("error", resp.text)
         except Exception:
             err = resp.text
         raise RuntimeError(f"Server rejected upload (HTTP {resp.status_code}): {err}")
-    data = resp.json()
-    sid  = data.get("session_id", "")
+    data        = resp.json()
+    sid         = data.get("session_id", "")
+    owner_token = data.get("owner_token", "")
     if not _valid_sid(sid):
         raise RuntimeError(f"Server returned unexpected Session ID: '{sid}'")
-    return sid
+    return sid, owner_token
 
 
 # ── CodeManager ───────────────────────────────────────────────────────────────
@@ -151,7 +199,8 @@ class CodeManager:
         CodeManager.run(sid)
 
     Environment variables:
-        PYVAULT_URL — base URL of the PyVault server (default: http://localhost:5000)
+        PYVAULT_URL — base URL of the PyVault server
+                      (default: https://secure-code-runner--diwasreplit.replit.app)
     """
 
     @staticmethod
@@ -159,14 +208,18 @@ class CodeManager:
         file_path: str,
         base_url: Optional[str] = None,
         timeout: int = 30,
+        expires_in_hours: Optional[float] = None,
+        max_executions: int = 0,
     ) -> str:
         """
         Read a local .py file and upload it to PyVault.
 
         Args:
-            file_path: Path to the local Python file.
-            base_url:  Override the server URL.
-            timeout:   HTTP timeout in seconds.
+            file_path:        Path to the local Python file.
+            base_url:         Override the server URL.
+            timeout:          HTTP timeout in seconds.
+            expires_in_hours: Optional auto-expiry in hours from now.
+            max_executions:   Max times the session can be executed (0 = unlimited).
 
         Returns:
             The 21-character hex Session ID.
@@ -177,10 +230,14 @@ class CodeManager:
         code = _read_file(file_path)
         if not code.strip():
             raise ValueError(f"The file '{file_path}' is empty — nothing to upload.")
-        sid = _upload_code(code, base_url, timeout)
+        sid, owner_token = _upload_code(code, base_url, timeout, expires_in_hours, max_executions)
         print(f"[PyVault] ✓ Uploaded  — Session ID : {sid}", flush=True)
         print(f"[PyVault]   Source    : {os.path.abspath(file_path)}", flush=True)
-        print(f"[PyVault]   Size      : {len(code):,} chars", flush=True)
+        print(f"[PyVault]   Lines     : {len(code.splitlines()):,}", flush=True)
+        if owner_token:
+            print(f"\n[PyVault] ⚠ OWNER TOKEN (save this — shown only once!):", flush=True)
+            print(f"[PyVault]   {owner_token}", flush=True)
+            print(f"[PyVault]   Use this to delete or edit your session later.\n", flush=True)
         return sid
 
     @staticmethod
@@ -211,7 +268,7 @@ class CodeManager:
             resp = requests.get(
                 raw_url,
                 timeout=timeout,
-                headers={"User-Agent": "PyVaultRCE/2.0"},
+                headers={"User-Agent": "PyVaultRCE/2.1"},
             )
             resp.raise_for_status()
         except requests.exceptions.ConnectionError:
@@ -229,10 +286,14 @@ class CodeManager:
         if not code.strip():
             raise ValueError("Downloaded content is empty.")
 
-        sid = _upload_code(code, base_url, timeout)
+        sid, owner_token = _upload_code(code, base_url, timeout)
         print(f"[PyVault] ✓ Uploaded from URL — Session ID : {sid}", flush=True)
         print(f"[PyVault]   Source : {paste_url}", flush=True)
-        print(f"[PyVault]   Size   : {len(code):,} chars", flush=True)
+        print(f"[PyVault]   Lines  : {len(code.splitlines()):,}", flush=True)
+        if owner_token:
+            print(f"\n[PyVault] ⚠ OWNER TOKEN (save this — shown only once!):", flush=True)
+            print(f"[PyVault]   {owner_token}", flush=True)
+            print(f"[PyVault]   Use this to delete or edit your session later.\n", flush=True)
         return sid
 
     @staticmethod
@@ -243,10 +304,11 @@ class CodeManager:
         _ns: Optional[dict] = None,
     ) -> None:
         """
-        Fetch the code for a Session ID from PyVault and execute it locally.
+        Fetch the encrypted code for a Session ID from PyVault, decrypt it,
+        and execute it locally.
 
-        The source code is transmitted over the network and run via exec().
-        It is never written to disk and is not accessible after execution.
+        The source code is transmitted encrypted, decrypted in-memory, never
+        written to disk, and is not accessible after execution.
 
         Args:
             session_id: The 21-character hex Session ID.
@@ -269,9 +331,22 @@ class CodeManager:
                 err = resp.json().get("error", "Session not found.")
             except Exception:
                 err = "Session not found."
-            raise RuntimeError(
-                f"Session '{session_id}' not found on the server. {err}"
-            )
+            raise RuntimeError(f"Session '{session_id}' not found on the server. {err}")
+
+        if resp.status_code == 410:
+            try:
+                d   = resp.json()
+                err = d.get("error", "Session is no longer available.")
+                if d.get("expired"):
+                    raise RuntimeError(f"Session '{session_id}' has expired. {err}")
+                if d.get("maxed"):
+                    raise RuntimeError(f"Session '{session_id}' has reached its execution limit. {err}")
+            except RuntimeError:
+                raise
+            except Exception:
+                pass
+            raise RuntimeError(f"Session '{session_id}' is no longer available (HTTP 410).")
+
         if resp.status_code != 200:
             try:
                 err = resp.json().get("error", resp.text)
@@ -280,11 +355,16 @@ class CodeManager:
             raise RuntimeError(f"Server error (HTTP {resp.status_code}): {err}")
 
         data      = resp.json()
-        code      = data.get("code", "")
+        encrypted = data.get("code", "")
         run_count = data.get("execution_count", "?")
 
-        if not code:
-            raise RuntimeError(f"Server returned empty code for session '{session_id}'.")
+        if not encrypted:
+            raise RuntimeError(f"Server returned empty payload for session '{session_id}'.")
+
+        code = _decrypt(encrypted)
+
+        if not code.strip():
+            raise RuntimeError(f"Decrypted code is empty for session '{session_id}'.")
 
         print(f"[PyVault] ▶ Running session '{session_id}' (execution #{run_count})…", flush=True)
 
@@ -341,7 +421,7 @@ class CodeManager:
             f"[PyVault] ℹ Session   : {data['session_id']}\n"
             f"[PyVault]   Executions: {data['execution_count']}\n"
             f"[PyVault]   Created   : {data['created_at']}\n"
-            f"[PyVault]   Code size : {data['code_size']:,} chars",
+            f"[PyVault]   Code size : {data['code_size']:,} bytes (encrypted)",
             flush=True,
         )
         return data
@@ -374,23 +454,73 @@ class CodeManager:
         print(f"[PyVault] ✕ Server unreachable at '{_base(base_url)}'.", flush=True)
         return False
 
+    @staticmethod
+    def delete(
+        session_id: str,
+        owner_token: str,
+        base_url: Optional[str] = None,
+        timeout: int = 30,
+    ) -> None:
+        """
+        Delete your own session using the owner token received when it was created.
+
+        Args:
+            session_id:  The 21-character hex Session ID.
+            owner_token: The owner token printed when the session was first uploaded.
+            base_url:    Override the server URL.
+            timeout:     HTTP timeout in seconds.
+
+        Raises:
+            ValueError, ConnectionError, RuntimeError
+        """
+        _check_sid(session_id)
+        if not owner_token or not owner_token.strip():
+            raise ValueError("owner_token is required.")
+        url = _base(base_url) + f"/pyv/my/{session_id}"
+        try:
+            resp = requests.delete(
+                url,
+                headers={"X-Owner-Token": owner_token.strip()},
+                timeout=timeout,
+            )
+        except requests.exceptions.ConnectionError:
+            raise ConnectionError(f"Unable to connect to PyVault at '{url}'.")
+        except requests.exceptions.Timeout:
+            raise TimeoutError(f"Request timed out after {timeout}s.")
+        except requests.exceptions.RequestException as exc:
+            raise ConnectionError(f"HTTP request failed: {exc}") from exc
+
+        if resp.status_code == 403:
+            raise RuntimeError("Owner token rejected — check the token and try again.")
+        if resp.status_code == 404:
+            raise RuntimeError(f"Session '{session_id}' not found.")
+        if resp.status_code != 200:
+            try:
+                err = resp.json().get("error", resp.text)
+            except Exception:
+                err = resp.text
+            raise RuntimeError(f"Server error (HTTP {resp.status_code}): {err}")
+        print(f"[PyVault] ✓ Session '{session_id}' deleted.", flush=True)
+
     @staticmethod
     def edit(
         session_id: str,
         file_path: str,
-        admin_token: str,
+        admin_token: str = "",
+        owner_token: str = "",
         base_url: Optional[str] = None,
         timeout: int = 30,
     ) -> None:
         """
-        Replace the code stored for a Session ID (admin-only operation).
+        Replace the code stored for a Session ID.
 
-        Requires the admin access token from the PyVault server.
+        Provide either admin_token (admin access) or owner_token (creator access).
 
         Args:
             session_id:  The 21-character hex Session ID to update.
             file_path:   Path to the .py file with the new code.
             admin_token: Admin access token (from server console on first start).
+            owner_token: Owner token printed when the session was first created.
             base_url:    Override the server URL.
             timeout:     HTTP timeout in seconds.
 
@@ -398,23 +528,25 @@ class CodeManager:
             ValueError, FileNotFoundError, ConnectionError, RuntimeError
         """
         _check_sid(session_id)
-        if not admin_token or not admin_token.strip():
-            raise ValueError("admin_token is required. Check the server console for your token.")
+        if not admin_token.strip() and not owner_token.strip():
+            raise ValueError("Provide admin_token or owner_token.")
 
         code = _read_file(file_path)
         if not code.strip():
             raise ValueError(f"The file '{file_path}' is empty — nothing to upload.")
-        if len(code) > _MAX_CHARS:
-            raise ValueError(f"Code is {len(code):,} chars, exceeds {_MAX_CHARS:,} limit.")
+        line_count = len(code.splitlines())
+        if line_count > _MAX_LINES:
+            raise ValueError(f"Code is {line_count:,} lines, exceeds {_MAX_LINES:,} line limit.")
+
+        if owner_token.strip():
+            url     = _base(base_url) + f"/pyv/my/{session_id}"
+            headers = {"Content-Type": "application/json", "X-Owner-Token": owner_token.strip()}
+        else:
+            url     = _base(base_url) + f"/pyv/edit/{session_id}"
+            headers = {"Content-Type": "application/json", "X-Admin-Token": admin_token.strip()}
 
-        url = _base(base_url) + f"/pyv/edit/{session_id}"
         try:
-            resp = requests.put(
-                url,
-                json={"code": code},
-                headers={"X-Admin-Token": admin_token},
-                timeout=timeout,
-            )
+            resp = requests.put(url, json={"code": code}, headers=headers, timeout=timeout)
         except requests.exceptions.ConnectionError:
             raise ConnectionError(f"Unable to connect to PyVault at '{url}'.")
         except requests.exceptions.Timeout:
@@ -423,7 +555,7 @@ class CodeManager:
             raise ConnectionError(f"HTTP request failed: {exc}") from exc
 
         if resp.status_code == 403:
-            raise RuntimeError("Admin token rejected. Check your token and try again.")
+            raise RuntimeError("Token rejected. Check your admin_token or owner_token.")
         if resp.status_code == 404:
             raise RuntimeError(f"Session '{session_id}' not found.")
         if resp.status_code != 200:
@@ -434,5 +566,5 @@ class CodeManager:
             raise RuntimeError(f"Server rejected edit (HTTP {resp.status_code}): {err}")
 
         print(f"[PyVault] ✓ Session '{session_id}' updated.", flush=True)
-        print(f"[PyVault]   File : {os.path.abspath(file_path)}", flush=True)
-        print(f"[PyVault]   Size : {len(code):,} chars", flush=True)
+        print(f"[PyVault]   File  : {os.path.abspath(file_path)}", flush=True)
+        print(f"[PyVault]   Lines : {line_count:,}", flush=True)

{pyvaultrce-2.0.0 → pyvaultrce-2.2.0}/setup.py

@@ -5,7 +5,7 @@ with open("README.md", "r", encoding="utf-8") as fh:
 
 setup(
     name="PyVaultRCE",
-    version="2.0.0",
+    version="2.2.0",
     author="PyVault",
     description="Remote Code Execution & Hosting client for PyVault — source never exposed",
     long_description=long_description,
@@ -14,6 +14,7 @@ setup(
     python_requires=">=3.8",
     install_requires=[
         "requests>=2.28.0",
+        "cryptography>=41.0.0",
     ],
     classifiers=[
         "Programming Language :: Python :: 3",

pyvaultrce-2.0.0/PyVaultRCE.egg-info/requires.txt

@@ -1 +0,0 @@
-requests>=2.28.0