agentwire-dev 1.77.0__tar.gz → 1.77.2__tar.gz

{agentwire_dev-1.77.0 → agentwire_dev-1.77.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentwire-dev
-Version: 1.77.0
+Version: 1.77.2
 Summary: Multi-session voice web interface for AI coding agents
 Project-URL: Homepage, https://agentwire.dev
 Project-URL: Repository, https://github.com/dotdevdotdev/agentwire-dev
@@ -228,7 +228,7 @@ Requires-Dist: aiohttp-jinja2>=1.6
 Requires-Dist: aiohttp>=3.13.4
 Requires-Dist: av>=12.0.0
 Requires-Dist: certifi>=2026.10.23
-Requires-Dist: damage-control-dev<0.2,>=0.1.0
+Requires-Dist: damage-control-dev<0.2,>=0.1.3
 Requires-Dist: fastapi>=0.104.0
 Requires-Dist: jinja2>=3.1.0
 Requires-Dist: kokoro-onnx>=0.4.9; python_version < '3.14'
@@ -377,7 +377,7 @@ The portal binds to loopback (`127.0.0.1`) by default. To access the portal from
    ```bash
    agentwire portal token
    ```
-4. **Connect**: Open `https://<your-machine-ip>:8765` on your phone and enter the token when prompted.
+4. **Connect**: run `agentwire portal pair` on the host and scan the QR (or open the printed URL) on your phone. The URL follows the bind: with `server.host: 0.0.0.0` it uses your machine's `.local` name or LAN IP, not `localhost`; pick another address with `--url`. Or open `https://<your-machine-ip>:8765` yourself and enter the token.
 
 Origin checks reject cross-site browser requests on every bind. Keep the portal on a trusted LAN — never port-forward it or run it on a public-facing VPS. For internet access, use Cloudflare Tunnel + Zero Trust. See [SECURITY.md](SECURITY.md) for details.
 

{agentwire_dev-1.77.0 → agentwire_dev-1.77.2}/README.md

@@ -106,7 +106,7 @@ The portal binds to loopback (`127.0.0.1`) by default. To access the portal from
    ```bash
    agentwire portal token
    ```
-4. **Connect**: Open `https://<your-machine-ip>:8765` on your phone and enter the token when prompted.
+4. **Connect**: run `agentwire portal pair` on the host and scan the QR (or open the printed URL) on your phone. The URL follows the bind: with `server.host: 0.0.0.0` it uses your machine's `.local` name or LAN IP, not `localhost`; pick another address with `--url`. Or open `https://<your-machine-ip>:8765` yourself and enter the token.
 
 Origin checks reject cross-site browser requests on every bind. Keep the portal on a trusted LAN — never port-forward it or run it on a public-facing VPS. For internet access, use Cloudflare Tunnel + Zero Trust. See [SECURITY.md](SECURITY.md) for details.
 

{agentwire_dev-1.77.0 → agentwire_dev-1.77.2}/RELEASING.md

@@ -6,7 +6,7 @@ Every release does **both** a PyPI publish and a GitHub release. The **GitHub re
 
 ## Release order (two packages)
 
-`agentwire-dev` depends on `damage-control-dev` (its own PyPI project, engine source in `packages/damage-control-dev/`). `pyproject.toml` pins it to a range — currently `damage-control-dev>=0.1.0,<0.2` — and `tests/unit/test_damage_control_pin.py` fails if the workspace version leaves that range. A checkout resolves the engine from the workspace; a PyPI install resolves it from PyPI. Order matters, because an `agentwire-dev` that names a version PyPI doesn't have yet is uninstallable:
+`agentwire-dev` depends on `damage-control-dev` (its own PyPI project, engine source in `packages/damage-control-dev/`). `pyproject.toml` pins it to a range — currently `damage-control-dev>=0.1.3,<0.2` — and `tests/unit/test_damage_control_pin.py` fails if the workspace version leaves that range. A checkout resolves the engine from the workspace; a PyPI install resolves it from PyPI. Order matters, because an `agentwire-dev` that names a version PyPI doesn't have yet is uninstallable:
 
 1. **Engine changed?** Bump `__version__` in `packages/damage-control-dev/src/damage_control/__init__.py`, merge, then build and publish it **first** (commands in step 3). Skip entirely when the engine didn't change — the existing pin keeps resolving.
 2. **Pin still admits the engine?** A patch/minor bump inside the range needs no `agentwire-dev` change. A bump outside it (e.g. `0.2.0`) requires widening the range in `pyproject.toml` (`>=0.2.0,<0.3`) in the agentwire PR — the pin test enforces this.

{agentwire_dev-1.77.0 → agentwire_dev-1.77.2}/agentwire/__init__.py

@@ -1,3 +1,3 @@
 """AgentWire - Multi-session voice web interface for AI coding agents."""
 
-__version__ = "1.77.0"
+__version__ = "1.77.2"

{agentwire_dev-1.77.0 → agentwire_dev-1.77.2}/agentwire/core.py

@@ -1545,17 +1545,22 @@ def format_relative_time(timestamp_ms: int) -> str:
 
 # === Cross-group shared helpers (Phase 0.5 sweep, #495) ===
 
-def _default_portal_url() -> str:
-    """Default portal URL — scheme mirrors the typed config's logic: https
-    only when server.ssl cert/key are configured AND exist on disk."""
-    ssl_cfg = load_config().get("server", {}).get("ssl", {})
+def _portal_scheme(config: dict) -> str:
+    """Portal scheme — mirrors the typed config's logic: https only when
+    server.ssl cert/key are configured AND exist on disk."""
+    ssl_cfg = config.get("server", {}).get("ssl", {})
     cert, key = ssl_cfg.get("cert"), ssl_cfg.get("key")
     enabled = bool(
         cert and key
         and Path(os.path.expanduser(cert)).exists()
         and Path(os.path.expanduser(key)).exists()
     )
-    return f"{'https' if enabled else 'http'}://localhost:8765"
+    return "https" if enabled else "http"
+
+
+def _default_portal_url() -> str:
+    """Default portal URL (loopback) for this machine's own CLI calls."""
+    return f"{_portal_scheme(load_config())}://localhost:8765"
 
 
 def _run_remote(machine_id: str, command: str) -> subprocess.CompletedProcess:

{agentwire_dev-1.77.0 → agentwire_dev-1.77.2}/agentwire/portal_cli.py

@@ -10,6 +10,7 @@ and curl helpers travel with this module.
 from __future__ import annotations
 
 import shlex
+import socket
 import subprocess
 import sys
 from pathlib import Path
@@ -17,13 +18,14 @@ from pathlib import Path
 from .core import (
     _check_portal_health,
     _check_tmux_installed,
-    _default_portal_url,
     _output_json,
+    _portal_scheme,
     _start_portal_local,
     get_portal_session_name,
     load_config,
     tmux_session_exists,
 )
+from .security import is_loopback_host
 
 
 def _start_portal_remote(ssh_target: str, machine_id: str, args) -> int:
@@ -333,20 +335,121 @@ def cmd_portal_token(args) -> int:
     return 0
 
 
+def _lan_ipv4_addrs() -> list[str]:
+    """Non-loopback IPv4 addresses of this host, primary outbound first.
+
+    The UDP-connect trick asks the kernel which interface routes outward;
+    ``connect`` on a datagram socket sends no packets.
+    """
+    addrs: list[str] = []
+    try:
+        with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as s:
+            s.connect(("192.0.2.1", 9))  # TEST-NET-1: never routed, never sent
+            addrs.append(s.getsockname()[0])
+    except OSError:
+        pass
+    try:
+        for ip in socket.gethostbyname_ex(socket.gethostname())[2]:
+            addrs.append(ip)
+    except OSError:
+        pass
+    seen: list[str] = []
+    for ip in addrs:
+        if ip not in seen and not ip.startswith("127.") and ip != "0.0.0.0":
+            seen.append(ip)
+    return seen
+
+
+def _mdns_hostname(lan_addrs: list[str]) -> str | None:
+    """``<host>.local`` when it resolves back to one of this host's addresses."""
+    name = socket.gethostname().split(".")[0] + ".local"
+    try:
+        resolved = {ai[4][0] for ai in socket.getaddrinfo(name, None, socket.AF_INET)}
+    except OSError:
+        return None
+    return name if resolved & set(lan_addrs) else None
+
+
+def derive_pair_url(
+    config: dict,
+    *,
+    lan_addrs: list[str],
+    mdns_host: str | None,
+    override: str | None = None,
+) -> tuple[str, str, list[str]]:
+    """Pick the portal base URL a device should open to pair.
+
+    Returns ``(url, source, alternatives)``. Precedence: ``--url`` override >
+    explicit ``portal.url`` > a specific ``server.host`` > (wildcard bind)
+    ``.local`` mDNS name > primary LAN IPv4. Loopback binds keep localhost.
+    The address lookups are injected so this stays a pure function.
+    """
+    if override:
+        return override.rstrip("/"), "--url", []
+    explicit = config.get("portal", {}).get("url")
+    if explicit:
+        return explicit.rstrip("/"), "portal.url", []
+
+    server = config.get("server", {})
+    host = server.get("host", "127.0.0.1")
+    port = server.get("port", 8765)
+    scheme = _portal_scheme(config)
+
+    if is_loopback_host(host):
+        return f"{scheme}://localhost:{port}", "loopback bind", []
+    if host not in ("0.0.0.0", "::", ""):
+        return f"{scheme}://{host}:{port}", "server.host", []
+    if mdns_host:
+        return f"{scheme}://{mdns_host}:{port}", "mDNS hostname", [
+            f"{scheme}://{ip}:{port}" for ip in lan_addrs
+        ]
+    if not lan_addrs:
+        return f"{scheme}://localhost:{port}", "no LAN address found", []
+    return f"{scheme}://{lan_addrs[0]}:{port}", "primary LAN address", [
+        f"{scheme}://{ip}:{port}" for ip in lan_addrs[1:]
+    ]
+
+
 def cmd_portal_pair(args) -> int:
     """Create a short-lived pairing code (+ QR) for a new device."""
     from .devices import PAIRING_TTL_SECONDS, create_pairing
 
-    pairing = create_pairing(name=getattr(args, "name", None) or "device")
+    config = load_config()
+    lan_addrs = _lan_ipv4_addrs()
+    portal_url, source, alternatives = derive_pair_url(
+        config,
+        lan_addrs=lan_addrs,
+        mdns_host=_mdns_hostname(lan_addrs),
+        override=getattr(args, "url", None),
+    )
 
-    portal_url = _default_portal_url()
+    pairing = create_pairing(name=getattr(args, "name", None) or "device")
     pair_url = f"{portal_url}/pair?code={pairing.code}"
     ttl_min = PAIRING_TTL_SECONDS // 60
 
+    if getattr(args, "json", False):
+        _output_json({
+            "success": True,
+            "code": pairing.code,
+            "name": pairing.name,
+            "expires_in_seconds": PAIRING_TTL_SECONDS,
+            "portal_url": portal_url,
+            "url_source": source,
+            "pair_url": pair_url,
+            "alternatives": alternatives,
+        })
+        return 0
+
     print(f"Pairing code: {pairing.code}")
     print(f"  Name:  {pairing.name}")
     print(f"  Expires in {ttl_min} minutes.")
     print()
+    print(f"Using {portal_url} ({source}).")
+    if alternatives:
+        print("Other addresses (pick one with --url):")
+        for alt in alternatives:
+            print(f"  {alt}")
+    print()
     print("On the device, open:")
     print(f"  {pair_url}")
     print("or visit", f"{portal_url}/pair", "and enter the code.")
@@ -497,6 +600,10 @@ def register_portal_parser(subparsers) -> None:
         "pair", help="Pair a new device (prints a short-lived code + QR)"
     )
     portal_pair.add_argument("--name", help="Friendly device name (e.g. 'phone')")
+    portal_pair.add_argument(
+        "--url", help="Portal base URL the device should open (overrides auto-detection)"
+    )
+    portal_pair.add_argument("--json", action="store_true", help="Output as JSON")
     portal_pair.set_defaults(func=cmd_portal_pair)
 
     # portal devices — list paired devices

{agentwire_dev-1.77.0 → agentwire_dev-1.77.2}/agentwire/safety/rule_baselines.json

@@ -53,7 +53,8 @@
       "c0ded80e7d544f10c9db2b831d10fd0469057d08b1737eaf3b7ce7485ba0ad17",
       "c10d81a50fe5bf2b4d83a37bc9e58f22d2a8ea5265cd0757d6bceb38702481dd",
       "d49e33dfeb72a8257e1853bdb4e11719610b41fb739979f439c4e08b53648705",
-      "d7323ac7f5a4f23d1b6a7455c8666a26abca2cfe248e0b9161f93346abdce82a"
+      "d7323ac7f5a4f23d1b6a7455c8666a26abca2cfe248e0b9161f93346abdce82a",
+      "f399f899aac4bf0008d81c9c9b7f3a6f12927aec5a31f4d1d0b135bec4d71f67"
     ],
     "databases.yaml": [
       "0547cffb489a750505941ba773a4be03dccc8217bb358aee12cf2cff663190d3",