chartremotely 0.3.2__tar.gz → 0.3.4__tar.gz

{chartremotely-0.3.2 → chartremotely-0.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: chartremotely
-Version: 0.3.2
+Version: 0.3.4
 Summary: Remote control of desktop charting applications on macOS
 Author: Lonnie VanZandt
 License: 
@@ -219,7 +219,7 @@ Requires-Dist: pyobjc-framework-Quartz>=10; extra == "macos"
 Requires-Dist: pyobjc-framework-Security>=10; extra == "macos"
 Requires-Dist: mlx-whisper>=0.4.3; (sys_platform == "darwin" and platform_machine == "arm64") and extra == "macos"
 Provides-Extra: setup
-Requires-Dist: tollbooth-dpyc[nostr]==0.90.0; extra == "setup"
+Requires-Dist: tollbooth-dpyc[nostr]==0.103.0; extra == "setup"
 Provides-Extra: dev
 Requires-Dist: pytest>=8; extra == "dev"
 Requires-Dist: ruff>=0.6; extra == "dev"

{chartremotely-0.3.2 → chartremotely-0.3.4}/chartremotely/config.py

@@ -35,7 +35,7 @@ DEFAULTS: dict = {
     "agent_id": None,
     "agent_secret": None,
     # Whose display this is: the npub voice commands are billed to. Its
-    # sign-in (the dpop_token) lives in the login Keychain, never here.
+    # sign-in (this Mac's connection tokens) lives in the login Keychain, never here.
     "owner_npub": None,
     "token": None,
     "port": 8899,

{chartremotely-0.3.2 → chartremotely-0.3.4}/chartremotely/displays.py

@@ -21,7 +21,7 @@ import threading
 import time
 from collections.abc import Callable
 
-from . import config, keystore, mcpclient, requestlog
+from . import config, holder, mcpclient, requestlog
 from .config import DATA_DIR
 
 PATH = DATA_DIR / "displays.json"
@@ -81,11 +81,11 @@ def refresh(cfg: dict | None = None, client_for=None, path=None) -> list[str] |
     npub = cfg.get("owner_npub")
     if not (base and npub and cfg.get("agent_id")):
         return None
+    if not holder.connected(npub):
+        return None  # not signed in: a background refresh never opens a connection
     try:
-        token = keystore.load_token(npub)
-        if not token:
-            return None
-        payload = (client_for or mcpclient.Client)(base, timeout=30.0).call(TOOL, {"npub": npub, "dpop_token": token})
+        bearer = holder.bearer(base, npub)
+        payload = (client_for or mcpclient.Client)(base, timeout=30.0, bearer=bearer).call(TOOL, {"npub": npub})
     except Exception as exc:  # noqa: BLE001 - a missing list must never cost a reply
         requestlog.outcome("serve", TOOL, "", f"display list failed: {type(exc).__name__}")
         return None

chartremotely-0.3.4/chartremotely/holder.py

@@ -0,0 +1,123 @@
+"""This Mac as a *holder*: a connection the operator knows, into whose wallet
+the owner's npub is proven by Nostr DM.
+
+The agent holds no key and keeps no grant. It keeps only this connection's
+OAuth tokens, in the login Keychain (as the owner's voice sign-in), and names
+the npub on each priced call; the operator checks the grant it holds.
+
+Becoming a holder is the OAuth Authorization Code flow, run headless: the
+operator's ``/authorize`` approves at once (a holder holds nothing until a DM
+proves an npub into it), so the agent reads the code from the redirect
+instead of opening a browser. A refresh token is single-use, so each refresh
+stores the pair it returns.
+
+Stdlib only, like the rest of the listener.
+"""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import json
+import secrets
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+
+from . import keystore
+
+REDIRECT_URI = "http://127.0.0.1/holder"
+#: Refresh this long before the access token lapses.
+REFRESH_EARLY_SECONDS = 60
+
+
+class HolderError(RuntimeError):
+    """The operator would not connect this Mac."""
+
+
+def _b64url(raw: bytes) -> str:
+    return base64.urlsafe_b64encode(raw).rstrip(b"=").decode()
+
+
+def _post(url: str, body: bytes, content_type: str) -> dict:
+    request = urllib.request.Request(url, data=body, method="POST", headers={"Content-Type": content_type})
+    try:
+        with urllib.request.urlopen(request, timeout=30) as response:
+            return json.loads(response.read().decode())
+    except urllib.error.HTTPError as exc:
+        raise HolderError(f"the operator refused ({exc.code})") from None
+    except OSError as exc:
+        raise HolderError(f"could not reach the operator: {exc}") from None
+
+
+class _KeepRedirect(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, *args, **kwargs):
+        return None
+
+
+def _token(base: str, form: dict, client_id: str) -> dict:
+    t = _post(f"{base}/token",
+              urllib.parse.urlencode({**form, "client_id": client_id, "resource": f"{base}/mcp"}).encode(),
+              "application/x-www-form-urlencoded")
+    return {"client_id": client_id, "access_token": t["access_token"], "refresh_token": t["refresh_token"],
+            "expires_at": time.time() + float(t.get("expires_in") or 3600)}
+
+
+def _login(base: str) -> dict:
+    client_id = _post(f"{base}/register", json.dumps({
+        "client_name": "ChartRemotely agent",
+        "redirect_uris": [REDIRECT_URI],
+        "grant_types": ["authorization_code", "refresh_token"],
+        "response_types": ["code"],
+        "token_endpoint_auth_method": "none",
+    }).encode(), "application/json")["client_id"]
+    verifier = _b64url(secrets.token_bytes(48))
+    state = _b64url(secrets.token_bytes(16))
+    query = urllib.parse.urlencode({
+        "response_type": "code", "client_id": client_id, "redirect_uri": REDIRECT_URI, "state": state,
+        "code_challenge": _b64url(hashlib.sha256(verifier.encode()).digest()),
+        "code_challenge_method": "S256", "resource": f"{base}/mcp",
+    })
+    try:
+        urllib.request.build_opener(_KeepRedirect).open(f"{base}/authorize?{query}", timeout=30)
+        raise HolderError("the operator did not redirect back")
+    except urllib.error.HTTPError as exc:
+        location = exc.headers.get("Location", "")
+    back = urllib.parse.parse_qs(urllib.parse.urlparse(location).query)
+    if back.get("state") != [state] or not back.get("code"):
+        raise HolderError("the operator's reply did not match this connection")
+    return _token(base, {"grant_type": "authorization_code", "code": back["code"][0],
+                         "redirect_uri": REDIRECT_URI, "code_verifier": verifier}, client_id)
+
+
+def _stored(npub: str) -> dict | None:
+    raw = keystore.load_token(npub)
+    try:
+        t = json.loads(raw) if raw else None
+    except ValueError:
+        return None  # a sign-in saved before this Mac connected as a holder
+    return t if isinstance(t, dict) and t.get("refresh_token") else None
+
+
+def bearer(base: str, npub: str) -> str:
+    """The bearer for the next call: refreshed when it is about to lapse, or a
+    fresh connection when there is none. Raises HolderError or KeystoreError."""
+    t = _stored(npub)
+    if t and t["expires_at"] - REFRESH_EARLY_SECONDS <= time.time():
+        try:
+            t = _token(base, {"grant_type": "refresh_token", "refresh_token": t["refresh_token"]}, t["client_id"])
+        except HolderError:
+            t = None
+    if not t:
+        t = _login(base)
+    keystore.save_token(npub, json.dumps(t))
+    return t["access_token"]
+
+
+def connected(npub: str) -> bool:
+    """True when this Mac has a connection to the operator for ``npub``."""
+    try:
+        return _stored(npub) is not None
+    except keystore.KeystoreError:
+        return False

{chartremotely-0.3.2 → chartremotely-0.3.4}/chartremotely/keystore.py

@@ -1,8 +1,8 @@
 """Keep a patron's secrets in their login Keychain, never in this agent's files.
 
 Two kinds, never mixed: the Nostr key ``setup`` may make for the human, and
-the voice sign-in - the ``dpop_token`` the operator returns once the owner
-has proven their npub by DM - which the listener passes on each priced call.
+the voice sign-in - this Mac's OAuth tokens on the operator, whose connection
+holds the owner's npub once they have proven it by DM.
 
 A key made by ``setup`` belongs to the human. It goes into their login
 Keychain as an internet password for the ChartRemotely site, and it is

{chartremotely-0.3.2 → chartremotely-0.3.4}/chartremotely/mcpclient.py

@@ -15,6 +15,7 @@ from __future__ import annotations
 import itertools
 import json
 import urllib.request
+from collections.abc import Callable
 
 PROTOCOL_VERSION = "2025-06-18"
 
@@ -53,22 +54,28 @@ def tool_payload(result: dict) -> dict:
 class Client:
     """A session with one operator's ``/mcp`` endpoint."""
 
-    def __init__(self, base_url: str, timeout: float = 60.0) -> None:
+    def __init__(self, base_url: str, timeout: float = 60.0, *, bearer: str = "",
+                 signer: Callable[[str, str, bytes], str] | None = None) -> None:
+        """``bearer`` is this Mac's holder token; ``signer`` signs each request
+        with a key (NIP-98) and wins over it. With neither, the call is anonymous."""
         self.url = base_url.rstrip("/") + "/mcp"
         self.timeout = timeout
+        self.bearer = bearer
+        self.signer = signer
         self.session: str | None = None
         self._ids = itertools.count(1)
 
     def _send(self, message: dict) -> dict:
-        # The operator refuses a request with no bearer. The agent proves
-        # itself in its arguments, so at the connection it is anonymous.
+        # Identity rides on the connection: a signed request, this Mac's holder
+        # token, or (for free tools) an anonymous bearer.
+        body = json.dumps(message).encode()
         headers = {"Content-Type": "application/json",
                    "Accept": "application/json, text/event-stream",
-                   "Authorization": "Bearer anonymous"}
+                   "Authorization": (self.signer("POST", self.url, body) if self.signer
+                                     else f"Bearer {self.bearer or 'anonymous'}")}
         if self.session:
             headers["mcp-session-id"] = self.session
-        request = urllib.request.Request(
-            self.url, data=json.dumps(message).encode(), headers=headers, method="POST")
+        request = urllib.request.Request(self.url, data=body, headers=headers, method="POST")
         try:
             with urllib.request.urlopen(request, timeout=self.timeout) as response:
                 self.session = response.headers.get("mcp-session-id") or self.session

{chartremotely-0.3.2 → chartremotely-0.3.4}/chartremotely/patron.py

@@ -2,9 +2,9 @@
 
 The Mac plays by the operator's rules like any other MCP client. A chart
 change heard by voice is a call to the operator's own ``chart_show_chart``
-(and "read" to ``chart_read_chart``), made with the display owner's ``npub``
-and the ``dpop_token`` they earned by answering a Nostr DM - the same
-envelope every patron sends. The operator prices it, relays it to the named
+(and "read" to ``chart_read_chart``), made as the display owner's ``npub`` over
+this Mac's holder connection, into which the owner proved that npub by
+answering a Nostr DM. The operator prices it, relays it to the named
 display (blank "Where?": this Mac, by its agent_id), and that display's relay
 changes the chart and takes its picture. Nothing here drives the chart.
 
@@ -17,7 +17,7 @@ while the call finishes on its own and its outcome is logged.
 When the sign-in has expired the owner hears so, and one renewal runs in the
 background: a fresh ``chart_request_npub_proof`` DM, then
 ``chart_receive_npub_proof`` on a bounded, slowing schedule until they answer,
-and the new token goes back into the Keychain. The nsec is never asked for.
+which proves the npub into this Mac's connection again. The nsec is never asked for.
 
 Stdlib only (the Keychain behind a lazy import), like the relay.
 """
@@ -28,7 +28,7 @@ import threading
 import time
 from collections.abc import Callable
 
-from . import config, keystore, mcpclient, recent, requestlog
+from . import config, holder, keystore, mcpclient, recent, requestlog
 
 ERR = "ERR "
 #: How long a spoken reply waits for an early refusal before handing off.
@@ -39,7 +39,7 @@ READ_SECONDS = 25.0
 CALL_TIMEOUT = 60.0
 AS_IS = {"", "as is", "asis"}
 
-#: What the SDK answers when a paid call's dpop_token is missing, unknown or expired.
+#: What the SDK answers when the connection does not (or no longer) prove the npub.
 PROOF_CODES = frozenset({"proof_missing", "proof_required", "proof_refresh_needed", "proof_invalid"})
 EXPIRED = ERR + "Your ChartRemotely sign-in expired. Answer the DM on your phone to renew."
 REASON = "Your Mac's ChartRemotely voice control needs you to sign in again."
@@ -88,10 +88,15 @@ def refusal(payload: dict) -> str | None:
 
 # -- the call -----------------------------------------------------------------------
 
-def _call(base: str, tool: str, args: dict) -> dict:
-    """One tool call. Never raises: an unreachable operator is an ``error`` payload."""
+def _call(base: str, npub: str, tool: str, args: dict) -> dict:
+    """One tool call over this Mac's connection for ``npub``. Never raises: an
+    unreachable operator is an ``error`` payload."""
     try:
-        return mcpclient.Client(base, timeout=CALL_TIMEOUT).call(tool, args)
+        return mcpclient.Client(base, timeout=CALL_TIMEOUT, bearer=holder.bearer(base, npub)).call(tool, args)
+    except holder.HolderError as exc:
+        return {"success": False, "error": str(exc)}
+    except keystore.KeystoreError:
+        return {"success": False, "error": "The Keychain would not give me your ChartRemotely sign-in."}
     except mcpclient.McpError as exc:
         return {"success": False, "error": str(exc)}
     except Exception as exc:  # noqa: BLE001 - a background call must never kill the listener
@@ -117,21 +122,12 @@ def send(command: str, where: str, cfg: dict | None = None) -> str:
     if isinstance(mapped, str):
         return mapped
     tool, args = mapped
-    try:
-        token = keystore.load_token(npub)
-    except keystore.KeystoreError as exc:
-        requestlog.outcome("serve", tool, wanted, str(exc))
-        return ERR + "The Keychain would not give me your ChartRemotely sign-in."
-    if not token:
-        renew(base, npub)
-        return EXPIRED
-
-    envelope = {**args, "display": wanted or agent_id, "npub": npub, "dpop_token": token}
+    envelope = {**args, "display": wanted or agent_id, "npub": npub}
     box: dict = {}
     done = threading.Event()
 
     def work() -> None:
-        payload = _call(base, tool, envelope)
+        payload = _call(base, npub, tool, envelope)
         box["payload"] = payload
         settle(base, npub, tool, wanted, payload)
         if tool == "chart_show_chart" and refusal(payload) is None \
@@ -154,7 +150,7 @@ def send(command: str, where: str, cfg: dict | None = None) -> str:
 
 
 def settle(base: str, npub: str, tool: str, where: str, payload: dict) -> None:
-    """Log how a call ended (no token, no arguments) and renew an expired sign-in."""
+    """Log how a call ended (no arguments) and renew an expired sign-in."""
     if payload.get("error_code") in PROOF_CODES:
         renew(base, npub)
     requestlog.outcome("serve", tool, where, refusal(payload))
@@ -175,16 +171,16 @@ def renew(base: str, npub: str, sleep: Callable[[float], None] = time.sleep) ->
 
 def _renew(base: str, npub: str, sleep: Callable[[float], None]) -> None:
     try:
-        sent = _call(base, "chart_request_npub_proof", {"patron_npub": npub, "reason": REASON})
-        phrase = sent.get("dpop_token")
+        sent = _call(base, npub, "chart_request_npub_proof", {"patron_npub": npub, "reason": REASON})
+        phrase = sent.get("nonce")
         if not phrase:
             requestlog.outcome("serve", "renew", "", refusal(sent) or "no proof request was sent")
             return
         for delay in RENEW_DELAYS:
             sleep(delay)
-            got = _call(base, "chart_receive_npub_proof", {"patron_npub": npub, "dpop_token": phrase})
+            got = _call(base, npub, "chart_receive_npub_proof", {"patron_npub": npub, "nonce": phrase})
             if got.get("success") is not False and not got.get("error"):
-                keystore.save_token(npub, str(got.get("dpop_token") or phrase))
+                # Proven into this Mac's connection; nothing to keep here.
                 requestlog.outcome("serve", "renew", "", None)
                 return
             if got.get("error_code") not in (NOT_YET, None):

{chartremotely-0.3.2 → chartremotely-0.3.4}/chartremotely/setup.py

@@ -10,9 +10,10 @@ what is already done, so running setup again is always safe:
    A made key is kept for the human - their Keychain, then Safari's saved
    passwords - and used once, in memory, to sign the pairing. It is never
    written to this agent's config. Then **pairing**, without a code to copy: setup adopts this machine's code itself.
-   and **voice sign-in**: the ``dpop_token`` from the owner's DM proof, kept in
-   the login Keychain (their npub goes in the config), so the listener can
-   call the operator's priced tools as that patron.
+   and **voice sign-in**: this Mac's connection to the operator, into which the
+   owner's DM proof puts their npub; its OAuth tokens are kept in the login
+   Keychain (their npub goes in the config), so the listener can call the
+   operator's priced tools as that patron.
 2. **Tailscale**: the Mac's tailnet address, with ``/chart`` forwarded to the agent.
 3. **Services**: the listener and the relay, under launchd.
 4. **Permissions**: Accessibility and Screen Recording, asked for by the
@@ -34,7 +35,7 @@ import tempfile
 from collections.abc import Callable
 from pathlib import Path
 
-from . import config, mcpclient, relay
+from . import config, holder, mcpclient, relay
 from .terminal import Terminal, wants_color
 
 OPERATOR_URL = "https://chartremotely-mcp.fastmcp.app"
@@ -51,15 +52,17 @@ class SetupError(RuntimeError):
 
 # -- identity -----------------------------------------------------------------
 
-def prove_by_dm(client: mcpclient.Client, npub: str, ask: Ask, say: Say) -> str:
-    """Prove an existing npub by the Secure Courier DM. Returns the dpop_token.
+def prove_by_dm(client: mcpclient.Client, npub: str, ask: Ask, say: Say) -> None:
+    """Prove an existing npub by the Secure Courier DM, into this Mac's connection.
 
-    The human answers from their own Nostr client, so no key passes through here.
+    ``client`` carries this Mac's holder token, so the operator keeps the grant
+    for this connection. The human answers from their own Nostr client, so no
+    key passes through here.
     """
     sent = client.call("chart_request_npub_proof", {
         "patron_npub": npub, "verify_at": SITE,
         "reason": "You asked to pair a Mac with ChartRemotely."})
-    phrase = sent.get("dpop_token")
+    phrase = sent.get("nonce")
     if not phrase:
         raise SetupError(sent.get("error") or "the operator did not send a proof request")
     say(f"A Nostr DM is on its way to {npub[:12]}…")
@@ -68,10 +71,9 @@ def prove_by_dm(client: mcpclient.Client, npub: str, ask: Ask, say: Say) -> str:
     say("may set cache_duration (30 days, or unlimited) so voice keeps working that")
     say("long; left alone, the sign-in lasts 2 hours.")
     ask("Press Return once you have replied… ")
-    got = client.call("chart_receive_npub_proof", {"patron_npub": npub, "dpop_token": phrase})
+    got = client.call("chart_receive_npub_proof", {"patron_npub": npub, "nonce": phrase})
     if got.get("error"):
         raise SetupError(got["error"])
-    return got.get("dpop_token") or phrase
 
 
 def new_key() -> tuple[str, str]:
@@ -82,11 +84,11 @@ def new_key() -> tuple[str, str]:
     return key.public_key.bech32(), key.bech32()
 
 
-def sign_once(nsec: str, tool: str) -> str:
-    """One kind-27235 proof for one tool call, signed by the SDK."""
-    from tollbooth.identity_proof import create_proof
+def signer_for(nsec: str) -> Callable[[str, str, bytes], str]:
+    """Signs each request with ``nsec`` (NIP-98), by the SDK."""
+    from tollbooth.identity_proof import sign_request
 
-    return create_proof(nsec, tool)
+    return lambda method, url, body: sign_request(nsec, method=method, url=url, body=body)
 
 
 def keep_for_human(npub: str, nsec: str, ask: Ask, say: Say) -> None:
@@ -106,11 +108,11 @@ def keep_for_human(npub: str, nsec: str, ask: Ask, say: Say) -> None:
         keystore.clear_if_unchanged(nsec)
 
 
-def identity(client: mcpclient.Client, ask: Ask, say: Say) -> tuple[str, str, bool]:
+def identity(base: str, ask: Ask, say: Say) -> tuple[str, mcpclient.Client, bool]:
     """Who owns this display, proven.
 
-    Returns (npub, proof for chart_pair_agent, whether that proof is a DM
-    sign-in the listener can keep using).
+    Returns (npub, a client that acts as that npub for chart_pair_agent, and
+    whether this Mac's connection now holds the npub for voice).
     """
     say("Your Nostr identity owns this display:")
     say("  1  I have an npub (I'll answer a Nostr DM to prove it)")
@@ -121,7 +123,9 @@ def identity(client: mcpclient.Client, ask: Ask, say: Say) -> tuple[str, str, bo
         npub = ask("Your npub: ").strip()
         if not npub.startswith("npub1"):
             raise SetupError("that is not an npub")
-        return npub, prove_by_dm(client, npub, ask, say), True
+        client = mcpclient.Client(base, bearer=holder.bearer(base, npub))
+        prove_by_dm(client, npub, ask, say)
+        return npub, client, True
     if choice == "2":
         from . import keystore
 
@@ -133,7 +137,7 @@ def identity(client: mcpclient.Client, ask: Ask, say: Say) -> tuple[str, str, bo
         picked = saved[int(ask("Which key? ").strip() or "1") - 1]
         nsec = keystore.load(picked)  # macOS asks the human first
         try:
-            return picked, sign_once(nsec, "chart_pair_agent"), False
+            return picked, mcpclient.Client(base, signer=signer_for(nsec)), False
         finally:
             del nsec
     if choice == "3":
@@ -141,7 +145,7 @@ def identity(client: mcpclient.Client, ask: Ask, say: Say) -> tuple[str, str, bo
         try:
             say(f"Your new npub is {npub}")
             keep_for_human(npub, nsec, ask, say)
-            return npub, sign_once(nsec, "chart_pair_agent"), False
+            return npub, mcpclient.Client(base, signer=signer_for(nsec)), False
         finally:
             del nsec
     raise SetupError("choose 1, 2 or 3")
@@ -149,40 +153,38 @@ def identity(client: mcpclient.Client, ask: Ask, say: Say) -> tuple[str, str, bo
 
 # -- the voice sign-in --------------------------------------------------------
 
-def keep_sign_in(npub: str, token: str) -> None:
-    """The owner's npub into the config; their sign-in into the Keychain, only."""
-    from . import keystore
-
-    keystore.save_token(npub, token)
+def keep_sign_in(npub: str) -> None:
+    """The owner's npub into the config. Their sign-in is this Mac's connection,
+    whose tokens the holder keeps in the Keychain."""
     config.update(owner_npub=npub)
 
 
 def has_sign_in(npub: str) -> bool:
-    from . import keystore
+    return holder.connected(npub)
 
-    try:
-        return bool(keystore.load_token(npub))
-    except keystore.KeystoreError:
-        return False
 
-
-def voice_sign_in(client: mcpclient.Client, npub: str, ask: Ask, say: Say) -> None:
+def voice_sign_in(base: str, npub: str, ask: Ask, say: Say) -> None:
     """Voice commands are priced tool calls made as the owner: prove the npub by DM for them."""
     config.update(owner_npub=npub)
     say(f"Voice commands are paid for by {npub[:12]}…, signed in by a Nostr DM.")
     if ask("Sign in for voice now? [Y/n] ").strip().lower().startswith("n"):
         say("Then your first voice command sends the DM.")
         return
-    keep_sign_in(npub, prove_by_dm(client, npub, ask, say))
+    prove_by_dm(mcpclient.Client(base, bearer=holder.bearer(base, npub)), npub, ask, say)
+    keep_sign_in(npub)
     say("Voice is signed in.")
 
 
 # -- pairing ------------------------------------------------------------------
 
-def pair(client: mcpclient.Client, base: str, npub: str, proof: str, label: str) -> dict:
-    """Adopt this machine's pairing code with the patron's proof, then collect."""
+def pair(client: mcpclient.Client, base: str, npub: str, label: str) -> dict:
+    """Adopt this machine's pairing code as the patron, then collect.
+
+    ``client`` proves the npub on its connection: signed with their key, or
+    this Mac's connection that holds it.
+    """
     code, expires_in = relay.open_code(base)
-    answer = client.call("chart_pair_agent", {"code": code, "label": label, "npub": npub, "dpop_token": proof})
+    answer = client.call("chart_pair_agent", {"code": code, "label": label, "npub": npub})
     if not answer.get("ok"):
         raise SetupError(answer.get("error") or "the operator refused the pairing")
     return relay.collect(base, code, expires_in)
@@ -250,7 +252,6 @@ def run(ask: Ask = input, say: Say = print, operator_url: str = OPERATOR_URL) ->
 
     # 1. Identity and pairing, unless this Mac is already paired.
     out.step(1, total, "Identity")
-    client = mcpclient.Client(base)
     if cfg.get("agent_id") and cfg.get("agent_secret"):
         out.ok(f"This Mac is already paired ({cfg['agent_id']}).")
         npub = cfg.get("owner_npub") or out.ask("Your npub (whose display this is): ").strip()
@@ -260,18 +261,18 @@ def run(ask: Ask = input, say: Say = print, operator_url: str = OPERATOR_URL) ->
             config.update(owner_npub=npub)
             out.ok("Voice is already signed in.")
         else:
-            voice_sign_in(client, npub, out.ask, out.say)
+            voice_sign_in(base, npub, out.ask, out.say)
     else:
-        npub, proof, by_dm = identity(client, out.ask, out.say)
+        npub, client, by_dm = identity(base, out.ask, out.say)
         label = out.ask("Name this display (e.g. Desk, Office wall): ").strip() or "display"
-        pair(client, base, npub, proof, label)
+        pair(client, base, npub, label)
         out.ok(f"Paired as “{label}”.")
         if by_dm:
-            keep_sign_in(npub, proof)
+            keep_sign_in(npub)
             out.ok("Voice is signed in with the same DM.")
         else:
-            voice_sign_in(client, npub, out.ask, out.say)
-        del proof
+            voice_sign_in(base, npub, out.ask, out.say)
+        del client
 
     # 2. Tailscale.
     from . import tailnet

{chartremotely-0.3.2 → chartremotely-0.3.4}/chartremotely.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: chartremotely
-Version: 0.3.2
+Version: 0.3.4
 Summary: Remote control of desktop charting applications on macOS
 Author: Lonnie VanZandt
 License: 
@@ -219,7 +219,7 @@ Requires-Dist: pyobjc-framework-Quartz>=10; extra == "macos"
 Requires-Dist: pyobjc-framework-Security>=10; extra == "macos"
 Requires-Dist: mlx-whisper>=0.4.3; (sys_platform == "darwin" and platform_machine == "arm64") and extra == "macos"
 Provides-Extra: setup
-Requires-Dist: tollbooth-dpyc[nostr]==0.90.0; extra == "setup"
+Requires-Dist: tollbooth-dpyc[nostr]==0.103.0; extra == "setup"
 Provides-Extra: dev
 Requires-Dist: pytest>=8; extra == "dev"
 Requires-Dist: ruff>=0.6; extra == "dev"

{chartremotely-0.3.2 → chartremotely-0.3.4}/chartremotely.egg-info/SOURCES.txt

@@ -10,6 +10,7 @@ chartremotely/displays.py
 chartremotely/doctor.py
 chartremotely/guilock.py
 chartremotely/hearing.py
+chartremotely/holder.py
 chartremotely/keystore.py
 chartremotely/layout.py
 chartremotely/mcpclient.py

{chartremotely-0.3.2 → chartremotely-0.3.4}/chartremotely.egg-info/requires.txt

@@ -13,4 +13,4 @@ pyobjc-framework-Security>=10
 mlx-whisper>=0.4.3
 
 [setup]
-tollbooth-dpyc[nostr]==0.90.0
+tollbooth-dpyc[nostr]==0.103.0

{chartremotely-0.3.2 → chartremotely-0.3.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "chartremotely"
-version = "0.3.2"
+version = "0.3.4"
 description = "Remote control of desktop charting applications on macOS"
 readme = "README.md"
 requires-python = ">=3.12"
@@ -25,7 +25,7 @@ macos = [
 ]
 # `chartremotely setup` makes and proves Nostr identities. The key and proof
 # code is the tollbooth-dpyc SDK's own, never rewritten here.
-setup = ["tollbooth-dpyc[nostr]==0.90.0"]
+setup = ["tollbooth-dpyc[nostr]==0.103.0"]
 dev = ["pytest>=8", "ruff>=0.6"]
 
 [project.urls]

{chartremotely-0.3.2 → chartremotely-0.3.4}/tests/test_hearing.py

@@ -13,7 +13,7 @@ from pathlib import Path
 import pytest
 from test_understand import ROWS
 
-from chartremotely import displays, hearing, keystore, shortcut
+from chartremotely import displays, hearing, holder, keystore, shortcut
 
 #: A recording big enough to be one: anything under hearing.MIN_BYTES is a bare header.
 M4A = b"m4a-bytes" * 100
@@ -163,20 +163,21 @@ def test_the_list_is_fetched_as_the_owner_and_cached_without_a_token(monkeypatch
     calls = []
 
     class Client:
-        def __init__(self, base, timeout):
-            self.base = base
+        def __init__(self, base, timeout, bearer=""):
+            self.base, self.bearer = base, bearer
 
         def call(self, tool, args):
-            calls.append((self.base, tool, dict(args)))
+            calls.append((self.base, self.bearer, tool, dict(args)))
             return STATUS
 
-    monkeypatch.setattr(keystore, "load_token", lambda npub: "seven-amber-door")
+    monkeypatch.setattr(holder, "connected", lambda npub: True)
+    monkeypatch.setattr(holder, "bearer", lambda base, npub: "dpyc_ha_conn")
     cfg = {"operator_url": "https://op.example/", "agent_id": "a1", "owner_npub": "npub1x"}
     path = tmp_path / "displays.json"
     assert displays.refresh(cfg, client_for=Client, path=path) == ["Mac mini", "Studio"]
-    assert calls == [("https://op.example", "chart_agent_status",
-                      {"npub": "npub1x", "dpop_token": "seven-amber-door"})]
-    assert "seven-amber-door" not in path.read_text()
+    # The connection proves the npub; no proof rides in the arguments.
+    assert calls == [("https://op.example", "dpyc_ha_conn", "chart_agent_status", {"npub": "npub1x"})]
+    assert "dpyc_ha_conn" not in path.read_text()
     assert displays.load(path) == ["Mac mini", "Studio"]
     assert not displays.stale(path)
     assert displays.stale(path, now=lambda: json.loads(path.read_text())["fetched_at"] + displays.MAX_AGE + 1)

{chartremotely-0.3.2 → chartremotely-0.3.4}/tests/test_patron.py

@@ -14,11 +14,11 @@ import urllib.request
 
 import pytest
 
-from chartremotely import config, keystore, mcpclient, patron
+from chartremotely import config, holder, mcpclient, patron
 from chartremotely.answer import Answer
 
 NPUB = "npub1" + "p" * 58
-TOKEN = "seven-amber-door"
+BEARER = "dpyc_ha_this-macs-connection"
 
 
 class FakeOperator:
@@ -28,19 +28,21 @@ class FakeOperator:
         self.calls = []
         self.answers = {"chart_show_chart": {"ok": True, "display": "Desk", "result": "Showing PLTR"},
                         "chart_read_chart": {"ok": True, "display": "Desk", "result": "PLTR at daily"},
-                        "chart_request_npub_proof": {"success": True, "dpop_token": "fresh-code"},
-                        "chart_receive_npub_proof": [{"success": True, "dpop_token": "fresh-code"}]}
+                        "chart_request_npub_proof": {"success": True, "nonce": "fresh-code"},
+                        "chart_receive_npub_proof": [{"success": True, "nonce": "fresh-code"}]}
         self.gate = threading.Event()
         self.gate.set()
         self.lock = threading.Lock()
+        self.bearers = []
 
-    def client(self, base, timeout=60.0):
+    def client(self, base, timeout=60.0, bearer="", signer=None):
         operator = self
 
         class Client:
             def call(self, tool, args):
                 with operator.lock:
                     operator.calls.append((tool, dict(args)))
+                    operator.bearers.append(bearer)
                 if tool not in ("chart_request_npub_proof", "chart_receive_npub_proof"):
                     operator.gate.wait(10)
                 answer = operator.answers[tool]
@@ -62,11 +64,8 @@ def operator(monkeypatch, tmp_path):
     config.update(operator_url="https://op.test", agent_id="a1", agent_secret="s1", owner_npub=NPUB)
     fake = FakeOperator()
     monkeypatch.setattr(mcpclient, "Client", fake.client)
-    vault = {NPUB: TOKEN}
-    monkeypatch.setattr(keystore, "load_token", lambda npub: vault.get(npub))
-    monkeypatch.setattr(keystore, "save_token", lambda npub, token: vault.__setitem__(npub, token))
+    monkeypatch.setattr(holder, "bearer", lambda base, npub: BEARER)
     monkeypatch.setattr(patron, "RENEW_DELAYS", (0.0,) * 5)
-    fake.vault = vault
     yield fake
     fake.gate.set()
     _wait_for_renewal()
@@ -84,7 +83,9 @@ def test_a_set_calls_chart_show_chart_as_the_owner_with_this_macs_id_when_where_
     said = patron.send("set PLTR | half", "")
     assert said == "Chart PLTR at half scale sent to this Mac. Good luck."
     assert operator.calls == [("chart_show_chart", {
-        "security": "PLTR", "scale": "half", "display": "a1", "npub": NPUB, "dpop_token": TOKEN})]
+        "security": "PLTR", "scale": "half", "display": "a1", "npub": NPUB})]
+    # The connection proves the npub; no proof rides in the arguments.
+    assert operator.bearers == [BEARER]
 
 
 def test_a_named_display_goes_as_said_and_the_hand_off_names_it(operator):
@@ -167,7 +168,7 @@ def test_an_expired_sign_in_is_spoken_and_renewed_once(operator, monkeypatch):
     operator.answers["chart_receive_npub_proof"] = [
         {"success": False, "error_code": "courier_not_found", "error": "No reply found"},
         {"success": False, "error_code": "courier_not_found", "error": "No reply found"},
-        {"success": True, "dpop_token": "fresh-code"}]
+        {"success": True, "nonce": "fresh-code"}]
     assert patron.send("set PLTR | half", "") == patron.EXPIRED
     assert patron.send("set PLTR | half", "") == patron.EXPIRED
     _wait_for_renewal()
@@ -175,25 +176,26 @@ def test_an_expired_sign_in_is_spoken_and_renewed_once(operator, monkeypatch):
     assert operator.tools().count("chart_receive_npub_proof") == 3
     request = next(a for t, a in operator.calls if t == "chart_request_npub_proof")
     assert request["patron_npub"] == NPUB and "nsec" not in json.dumps(request).lower()
-    assert operator.vault[NPUB] == "fresh-code"
+    # The renewal proves the npub into the same connection.
+    assert set(operator.bearers) == {BEARER}
 
 
-def test_no_sign_in_yet_starts_the_dm_without_calling_the_paid_tool(operator):
-    operator.vault.clear()
-    assert patron.send("set PLTR | half", "") == patron.EXPIRED
-    _wait_for_renewal()
-    assert "chart_show_chart" not in operator.tools()
-    assert operator.vault[NPUB] == "fresh-code"
+def test_a_mac_the_operator_will_not_connect_says_why(operator, monkeypatch):
+    def refused(base, npub):
+        raise holder.HolderError("the operator refused (503)")
+
+    monkeypatch.setattr(holder, "bearer", refused)
+    assert patron.send("read", "") == patron.ERR + "the operator refused (503)"
+    assert operator.tools() == []
 
 
 def test_a_renewal_that_is_refused_stops_rather_than_polling_on(operator):
-    operator.vault.clear()
+    operator.answers["chart_show_chart"] = {"success": False, "error_code": "proof_required", "error": "no"}
     operator.answers["chart_receive_npub_proof"] = [{"success": False, "error_code": "courier_expired",
                                                      "error": "that request expired"}]
     patron.send("set PLTR | half", "")
     _wait_for_renewal()
     assert operator.tools().count("chart_receive_npub_proof") == 1
-    assert NPUB not in operator.vault
 
 
 def test_the_sign_in_is_never_logged_or_written_to_the_config(operator, capsys, monkeypatch):
@@ -204,9 +206,9 @@ def test_the_sign_in_is_never_logged_or_written_to_the_config(operator, capsys,
     _wait_for_renewal()
     time.sleep(0.1)
     logged = capsys.readouterr().err
-    assert TOKEN not in logged and "fresh-code" not in logged and "PLTR" not in logged
+    assert BEARER not in logged and "fresh-code" not in logged and "PLTR" not in logged
     stored = config.CONFIG_PATH.read_text()
-    assert TOKEN not in stored and "fresh-code" not in stored
+    assert BEARER not in stored and "fresh-code" not in stored
     assert json.loads(stored)["owner_npub"] == NPUB
 
 

{chartremotely-0.3.2 → chartremotely-0.3.4}/tests/test_setup.py

@@ -13,7 +13,7 @@ import types
 
 import pytest
 
-from chartremotely import config, keystore, mcpclient, relay, services, setup, shortcut
+from chartremotely import config, holder, keystore, mcpclient, relay, services, setup, shortcut
 
 NSEC = "nsec1" + "q" * 58
 NPUB = "npub1" + "p" * 58
@@ -199,11 +199,11 @@ class StubClient:
 
 
 def test_an_existing_npub_is_proven_by_dm_and_no_key_is_asked_for():
-    client = StubClient({"chart_request_npub_proof": {"dpop_token": "seven-amber-door"},
-                         "chart_receive_npub_proof": {"success": True, "dpop_token": "seven-amber-door"}})
+    client = StubClient({"chart_request_npub_proof": {"nonce": "seven-amber-door"},
+                         "chart_receive_npub_proof": {"success": True, "nonce": "seven-amber-door"}})
     asked, said = [], []
-    token = setup.prove_by_dm(client, NPUB, lambda q: asked.append(q) or "", said.append)
-    assert token == "seven-amber-door"
+    # Proven into the connection `client` carries: nothing comes back to keep.
+    assert setup.prove_by_dm(client, NPUB, lambda q: asked.append(q) or "", said.append) is None
     assert [t for t, _ in client.calls] == ["chart_request_npub_proof", "chart_receive_npub_proof"]
     assert any("seven-amber-door" in s for s in said), "the human sees the code to compare"
     assert any("cache_duration" in s and "unlimited" in s for s in said), "a longer sign-in is offered"
@@ -211,7 +211,7 @@ def test_an_existing_npub_is_proven_by_dm_and_no_key_is_asked_for():
 
 
 def test_a_dm_that_was_not_answered_stops_setup():
-    client = StubClient({"chart_request_npub_proof": {"dpop_token": "x"},
+    client = StubClient({"chart_request_npub_proof": {"nonce": "x"},
                          "chart_receive_npub_proof": {"error": "no reply yet"}})
     with pytest.raises(setup.SetupError, match="no reply yet"):
         setup.prove_by_dm(client, NPUB, lambda q: "", lambda s: None)
@@ -224,9 +224,9 @@ def test_setup_adopts_its_own_pairing_code(monkeypatch):
     collected = []
     monkeypatch.setattr(relay, "collect", lambda base, code, exp: collected.append(code) or {"agent_id": "a1"})
     client = StubClient({"chart_pair_agent": {"ok": True, "display": "Desk", "agent_id": "a1"}})
-    setup.pair(client, "https://op.test", NPUB, "PROOF", "Desk")
-    assert client.calls == [("chart_pair_agent", {"code": "ABC234", "label": "Desk", "npub": NPUB,
-                                                  "dpop_token": "PROOF"})]
+    setup.pair(client, "https://op.test", NPUB, "Desk")
+    # The client proves the npub on its connection; no proof rides in the arguments.
+    assert client.calls == [("chart_pair_agent", {"code": "ABC234", "label": "Desk", "npub": NPUB})]
     assert collected == ["ABC234"]
 
 
@@ -234,7 +234,7 @@ def test_a_refused_pairing_says_why(monkeypatch):
     monkeypatch.setattr(relay, "open_code", lambda base: ("ABC234", 900.0))
     client = StubClient({"chart_pair_agent": {"success": False, "error": "prove it"}})
     with pytest.raises(setup.SetupError, match="prove it"):
-        setup.pair(client, "https://op.test", NPUB, "PROOF", "Desk")
+        setup.pair(client, "https://op.test", NPUB, "Desk")
 
 
 # -- the whole run never keeps the key -------------------------------------------
@@ -243,13 +243,15 @@ def test_a_made_key_never_reaches_the_agents_config(monkeypatch, tmp_path):
     monkeypatch.setattr(config, "CONFIG_DIR", tmp_path)
     monkeypatch.setattr(config, "CONFIG_PATH", tmp_path / "config.json")
     monkeypatch.setattr(setup, "new_key", lambda: (NPUB, NSEC))
-    monkeypatch.setattr(setup, "sign_once", lambda nsec, tool: f"proof-for-{tool}")
+    signers = []
+    monkeypatch.setattr(setup, "signer_for", lambda nsec: signers.append(nsec) or "signs-with-the-key")
     kept = []
     monkeypatch.setattr(setup, "keep_for_human", lambda npub, nsec, ask, say: kept.append(npub))
     monkeypatch.setattr(relay, "open_code", lambda base: ("ABC234", 900.0))
     monkeypatch.setattr(relay, "collect", lambda base, code, exp: config.update(
         operator_url=base, agent_id="a1", agent_secret="agent-secret"))
-    monkeypatch.setattr(mcpclient, "Client", lambda base: StubClient(
+    clients = []
+    monkeypatch.setattr(mcpclient, "Client", lambda base, **kw: clients.append(kw) or StubClient(
         {"chart_pair_agent": {"ok": True, "display": "Desk", "agent_id": "a1"}}))
 
     from chartremotely import tailnet
@@ -269,7 +271,8 @@ def test_a_made_key_never_reaches_the_agents_config(monkeypatch, tmp_path):
     assert setup.run(ask=lambda q: next(answers), say=said.append) == 0
 
     stored = (tmp_path / "config.json").read_text()
-    assert NSEC not in stored and "proof-for" not in stored
+    assert NSEC not in stored and "signs-with-the-key" not in stored
+    assert signers == [NSEC] and clients[0] == {"signer": "signs-with-the-key"}, "pairing is signed with the key"
     assert json.loads(stored)["agent_id"] == "a1"
     assert kept == [NPUB], "the made key is handed to the human's Keychain"
     assert built == ["https://mac.example.ts.net/chart"]
@@ -289,7 +292,7 @@ def _stand_in_the_mac(monkeypatch, tmp_path, answers):
     monkeypatch.setattr(relay, "open_code", lambda base: ("ABC234", 900.0))
     monkeypatch.setattr(relay, "collect", lambda base, code, exp: config.update(
         operator_url=base, agent_id="a1", agent_secret="agent-secret"))
-    monkeypatch.setattr(mcpclient, "Client", lambda base: StubClient(answers))
+    monkeypatch.setattr(mcpclient, "Client", lambda base, **kw: StubClient(answers))
     from chartremotely import tailnet
     monkeypatch.setattr(tailnet, "status", lambda: {"Self": {"DNSName": "mac.example.ts.net."}})
     monkeypatch.setattr(tailnet, "serve", lambda port: None)
@@ -301,40 +304,45 @@ def _stand_in_the_mac(monkeypatch, tmp_path, answers):
     monkeypatch.setattr(setup.subprocess, "run", lambda *a, **k: None)
     _no_hearing(monkeypatch)
     vault = {}
-    monkeypatch.setattr(keystore, "save_token", lambda npub, token: vault.__setitem__(npub, token))
+
+    def connect(base, npub):  # this Mac's holder connection, kept in the Keychain
+        vault[npub] = '{"refresh_token": "r"}'
+        return "dpyc_ha_conn"
+
+    monkeypatch.setattr(holder, "bearer", connect)
     monkeypatch.setattr(keystore, "load_token", lambda npub: vault.get(npub))
     return vault
 
 
 def test_a_dm_proven_owner_keeps_the_sign_in_in_the_keychain_not_the_config(monkeypatch, tmp_path):
     vault = _stand_in_the_mac(monkeypatch, tmp_path, {
-        "chart_request_npub_proof": {"dpop_token": "seven-amber-door"},
-        "chart_receive_npub_proof": {"success": True, "dpop_token": "seven-amber-door"},
+        "chart_request_npub_proof": {"nonce": "seven-amber-door"},
+        "chart_receive_npub_proof": {"success": True, "nonce": "seven-amber-door"},
         "chart_pair_agent": {"ok": True, "display": "Desk", "agent_id": "a1"}})
     answers = iter(["", "1", NPUB, "", "Desk"])
     said = []
     assert setup.run(ask=lambda q: next(answers), say=said.append) == 0
-    assert vault == {NPUB: "seven-amber-door"}
+    assert set(vault) == {NPUB}, "the connection that holds the npub is kept in the Keychain"
     stored = (tmp_path / "config.json").read_text()
-    assert "seven-amber-door" not in stored
+    assert "refresh_token" not in stored and "dpyc_ha_conn" not in stored
     assert json.loads(stored)["owner_npub"] == NPUB
 
 
 def test_an_already_paired_mac_is_signed_in_for_voice_by_dm(monkeypatch, tmp_path):
     vault = _stand_in_the_mac(monkeypatch, tmp_path, {
-        "chart_request_npub_proof": {"dpop_token": "seven-amber-door"},
-        "chart_receive_npub_proof": {"success": True, "dpop_token": "seven-amber-door"}})
+        "chart_request_npub_proof": {"nonce": "seven-amber-door"},
+        "chart_receive_npub_proof": {"success": True, "nonce": "seven-amber-door"}})
     config.update(operator_url="https://op.test", agent_id="a1", agent_secret="agent-secret")
     answers = iter(["", NPUB, "y", ""])
     assert setup.run(ask=lambda q: next(answers), say=lambda s: None) == 0
-    assert vault == {NPUB: "seven-amber-door"}
-    assert "seven-amber-door" not in (tmp_path / "config.json").read_text()
+    assert set(vault) == {NPUB}
+    assert "refresh_token" not in (tmp_path / "config.json").read_text()
 
 
 def test_setup_removes_a_retired_ask_shortcut_and_names_any_it_could_not(monkeypatch, tmp_path):
     _stand_in_the_mac(monkeypatch, tmp_path, {
-        "chart_request_npub_proof": {"dpop_token": "seven-amber-door"},
-        "chart_receive_npub_proof": {"success": True, "dpop_token": "seven-amber-door"}})
+        "chart_request_npub_proof": {"nonce": "seven-amber-door"},
+        "chart_receive_npub_proof": {"success": True, "nonce": "seven-amber-door"}})
     config.update(operator_url="https://op.test", agent_id="a1", agent_secret="agent-secret")
     monkeypatch.setattr(shortcut, "remove_retired", lambda: (["ChartRemotely Ask"], ["ChartRemotely Ask 2"]))
     answers = iter(["", NPUB, "y", ""])