cync-cli 0.3.0__py3-none-any.whl

cync/__init__.py

@@ -0,0 +1,3 @@
+"""cync — sync Claude Code conversations across machines."""
+
+__version__ = "0.3.0"

cync/auth.py

@@ -0,0 +1,184 @@
+"""GitHub (Supabase) auth for the cync CLI — browser loopback PKCE flow.
+
+`login()` opens the browser to Supabase's GitHub OAuth, captures the redirect on
+a localhost callback, and exchanges the code (PKCE) for a session. The session
+(access + refresh tokens) is stored in ~/.config/cync/session.json; `refresh()`
+renews the access token when it expires.
+"""
+from __future__ import annotations
+
+import base64
+import hashlib
+import http.server
+import json
+import os
+import secrets
+import tempfile
+import time
+import urllib.parse
+import webbrowser
+from dataclasses import asdict, dataclass
+from pathlib import Path
+
+import httpx
+
+SESSION_PATH = Path.home() / ".config" / "cync" / "session.json"
+CALLBACK_PORT = 8765
+REDIRECT_URI = f"http://127.0.0.1:{CALLBACK_PORT}/callback"
+
+
+@dataclass
+class Session:
+    access_token: str
+    refresh_token: str
+    supabase_url: str
+    anon_key: str
+
+
+def load_session() -> Session | None:
+    if SESSION_PATH.exists():
+        try:
+            return Session(**json.loads(SESSION_PATH.read_text()))
+        except Exception:
+            return None
+    return None
+
+
+def save_session(s: Session) -> None:
+    d = SESSION_PATH.parent
+    d.mkdir(parents=True, exist_ok=True)
+    try:
+        d.chmod(0o700)
+    except OSError:
+        pass
+    data = json.dumps(asdict(s), indent=2)
+    # atomic write, 0600 from creation so the refresh token is never world-readable
+    fd, tmp = tempfile.mkstemp(dir=str(d), prefix=".session.", suffix=".tmp")
+    try:
+        os.fchmod(fd, 0o600)
+        with os.fdopen(fd, "w") as f:
+            f.write(data)
+        os.replace(tmp, SESSION_PATH)
+    except BaseException:
+        try:
+            os.unlink(tmp)
+        except OSError:
+            pass
+        raise
+
+
+def clear_session() -> None:
+    if SESSION_PATH.exists():
+        SESSION_PATH.unlink()
+
+
+def discover(server_url: str) -> tuple[str, str]:
+    """Fetch the public Supabase URL + anon key from the cync server's /config."""
+    r = httpx.get(f"{server_url.rstrip('/')}/config", timeout=15)
+    r.raise_for_status()
+    d = r.json()
+    supabase_url = d["supabase_url"].rstrip("/")
+    if not supabase_url.startswith("https://"):
+        raise RuntimeError(f"refusing non-HTTPS Supabase URL from server: {supabase_url}")
+    return supabase_url, d["supabase_anon_key"]
+
+
+def _pkce() -> tuple[str, str]:
+    verifier = base64.urlsafe_b64encode(secrets.token_bytes(64)).rstrip(b"=").decode()
+    digest = hashlib.sha256(verifier.encode()).digest()
+    challenge = base64.urlsafe_b64encode(digest).rstrip(b"=").decode()
+    return verifier, challenge
+
+
+def login(server_url: str) -> Session:
+    supabase_url, anon = discover(server_url)
+    verifier, challenge = _pkce()
+    # Do NOT pass our own OAuth `state` to Supabase's /authorize: GoTrue manages
+    # the GitHub handshake state itself, and a caller-supplied state triggers
+    # `bad_oauth_state`. The CSRF protection on this loopback is PKCE — only a
+    # code bound to our code_challenge can be redeemed with our verifier.
+    authorize_url = (
+        f"{supabase_url}/auth/v1/authorize?provider=github"
+        f"&redirect_to={urllib.parse.quote(REDIRECT_URI, safe='')}"
+        f"&code_challenge={challenge}&code_challenge_method=s256"
+    )
+
+    result: dict = {}
+
+    class Handler(http.server.BaseHTTPRequestHandler):
+        def do_GET(self):  # noqa: N802
+            parsed = urllib.parse.urlparse(self.path)
+            if parsed.path != "/callback":
+                self.send_response(404)
+                self.end_headers()
+                return
+            if result:  # first callback wins; ignore later/duplicate hits
+                self.send_response(204)
+                self.end_headers()
+                return
+            params = urllib.parse.parse_qs(parsed.query)
+            result["code"] = params.get("code", [None])[0]
+            result["error"] = params.get("error_description", params.get("error", [None]))[0]
+            self.send_response(200)
+            self.send_header("Content-Type", "text/html")
+            self.end_headers()
+            self.wfile.write(
+                b"<html><body style='font-family:sans-serif'>"
+                b"<h2>cync: signed in. You can close this tab.</h2></body></html>"
+            )
+
+        def log_message(self, *args):  # silence default logging
+            pass
+
+    httpd = http.server.HTTPServer(("127.0.0.1", CALLBACK_PORT), Handler)
+    httpd.timeout = 1  # return from handle_request each second so we can check the deadline
+    print(f"Opening browser to sign in with GitHub…\n  if it doesn't open: {authorize_url}")
+    webbrowser.open(authorize_url)
+    deadline = time.monotonic() + 300
+    try:
+        while "code" not in result and "error" not in result:
+            if time.monotonic() > deadline:
+                break
+            httpd.handle_request()
+    finally:
+        httpd.server_close()
+
+    if not result.get("code"):
+        raise RuntimeError(f"login failed: {result.get('error') or 'no authorization code received'}")
+
+    r = httpx.post(
+        f"{supabase_url}/auth/v1/token", params={"grant_type": "pkce"},
+        headers={"apikey": anon, "Content-Type": "application/json"},
+        json={"auth_code": result["code"], "code_verifier": verifier}, timeout=30,
+    )
+    r.raise_for_status()
+    d = r.json()
+    s = Session(
+        access_token=d["access_token"], refresh_token=d["refresh_token"],
+        supabase_url=supabase_url, anon_key=anon,
+    )
+    save_session(s)
+    return s
+
+
+def refresh(s: Session) -> Session:
+    r = httpx.post(
+        f"{s.supabase_url}/auth/v1/token", params={"grant_type": "refresh_token"},
+        headers={"apikey": s.anon_key, "Content-Type": "application/json"},
+        json={"refresh_token": s.refresh_token}, timeout=30,
+    )
+    r.raise_for_status()
+    d = r.json()
+    s.access_token = d["access_token"]
+    s.refresh_token = d["refresh_token"]
+    save_session(s)
+    return s
+
+
+def current_user(s: Session) -> dict:
+    r = httpx.get(
+        f"{s.supabase_url}/auth/v1/user",
+        headers={"apikey": s.anon_key, "Authorization": f"Bearer {s.access_token}"},
+        timeout=15,
+    )
+    return r.json() if r.status_code == 200 else {}

cync/client.py

@@ -0,0 +1,319 @@
+"""cync client CLI — push/pull Claude Code conversations, authed via GitHub (Supabase).
+
+Sign in once with `cync login`; the CLI stores a session and sends your Supabase
+JWT to the server (auto-refreshing on expiry). Link a directory to a project with
+`cync init` / `cync link`, then `cync push` / `cync pull`.
+"""
+from __future__ import annotations
+
+import base64
+import json
+import os
+from pathlib import Path
+
+import httpx
+import typer
+from rich.console import Console
+from rich.table import Table
+
+from . import auth, common
+from .config import ClientConfig, get_link, remove_link, set_link
+
+app = typer.Typer(add_completion=False, help="Sync Claude Code conversations across machines.")
+project_app = typer.Typer(help="Manage your projects.")
+app.add_typer(project_app, name="project")
+console = Console()
+
+
+def _check(r: httpx.Response) -> None:
+    if r.is_success:
+        return
+    try:
+        detail = r.json().get("detail", "")
+    except Exception:
+        detail = r.text
+    console.print(f"[red]error {r.status_code}[/] {detail or r.reason_phrase}")
+    raise typer.Exit(1)
+
+
+def _rewrite_cwd(data: bytes, origin: str, root: str) -> bytes:
+    """Rewrite only each line's top-level ``cwd`` field from origin -> root."""
+    out: list[bytes] = []
+    for line in data.split(b"\n"):
+        if not line.strip():
+            out.append(line)
+            continue
+        try:
+            obj = json.loads(line)
+        except Exception:
+            out.append(line)
+            continue
+        if isinstance(obj, dict) and obj.get("cwd") == origin:
+            obj["cwd"] = root
+            out.append(json.dumps(obj, ensure_ascii=False, separators=(",", ":")).encode("utf-8"))
+        else:
+            out.append(line)
+    return b"\n".join(out)
+
+
+class Api:
+    """Authenticated client: sends the session JWT, refreshes once on 401."""
+
+    def __init__(self) -> None:
+        self.server = ClientConfig.load().server_url
+        self.session = auth.load_session()
+        if not self.session:
+            console.print("[red]not logged in[/] — run [bold]cync login[/]")
+            raise typer.Exit(1)
+
+    def request(self, method: str, path: str, **kw) -> httpx.Response:
+        url = self.server + path
+        headers = kw.pop("headers", {})
+        headers["Authorization"] = f"Bearer {self.session.access_token}"
+        r = httpx.request(method, url, headers=headers, timeout=120.0, **kw)
+        if r.status_code == 401:
+            try:
+                self.session = auth.refresh(self.session)
+            except Exception:
+                console.print("[red]session expired[/] — run [bold]cync login[/]")
+                raise typer.Exit(1)
+            headers["Authorization"] = f"Bearer {self.session.access_token}"
+            r = httpx.request(method, url, headers=headers, timeout=120.0, **kw)
+        return r
+
+    def get(self, p, **k):
+        return self.request("GET", p, **k)
+
+    def post(self, p, **k):
+        return self.request("POST", p, **k)
+
+    def put(self, p, **k):
+        return self.request("PUT", p, **k)
+
+    def delete(self, p, **k):
+        return self.request("DELETE", p, **k)
+
+
+def _repo_root() -> str:
+    return common.git_root() or os.path.abspath(os.getcwd())
+
+
+def _linked() -> tuple[str, str, Path]:
+    """(repo_root, project_id, local_project_folder) — requires a link."""
+    root = _repo_root()
+    pid = get_link(root)
+    if not pid:
+        raise typer.BadParameter(
+            "this directory isn't linked to a project — run `cync init <name>` "
+            "(new) or `cync link <name>` (existing)"
+        )
+    folder = common.claude_projects_dir() / common.encode_project_dir(root)
+    return root, pid, folder
+
+
+def _find_by_slug(api: Api, slug: str) -> dict | None:
+    r = api.get("/projects")
+    _check(r)
+    for p in r.json():
+        if p.get("slug") == slug:
+            return p
+    return None
+
+
+# ---- auth ----
+
+
+@app.command()
+def login() -> None:
+    """Sign in with GitHub (opens a browser)."""
+    server = ClientConfig.load().server_url
+    s = auth.login(server)
+    user = auth.current_user(s)
+    console.print(f"[green]logged in[/] as {user.get('email') or user.get('id')}")
+
+
+@app.command()
+def logout() -> None:
+    """Clear the stored session."""
+    auth.clear_session()
+    console.print("logged out")
+
+
+@app.command()
+def whoami() -> None:
+    """Show the signed-in user."""
+    api = Api()
+    user = auth.current_user(api.session)
+    console.print(user.get("email") or user.get("id") or "(unknown)")
+
+
+# ---- project linking ----
+
+
+@app.command()
+def init(name: str = typer.Argument(..., help="project name to create + link here")) -> None:
+    """Create a project and link this directory to it."""
+    api = Api()
+    root = _repo_root()
+    slug = common.slugify_project(name)
+    r = api.post("/projects", json={"name": name})
+    if r.status_code == 409:
+        proj = _find_by_slug(api, slug)
+        if not proj:
+            _check(r)
+        console.print(f"[yellow]project '{slug}' already exists — linking to it[/]")
+    else:
+        _check(r)
+        proj = r.json()
+        console.print(f"[green]created[/] project '{proj['slug']}'")
+    set_link(root, proj["id"])
+    console.print(f"[green]linked[/] {root} -> {proj['slug']}\nnow run [bold]cync push[/]")
+
+
+@app.command()
+def link(name: str = typer.Argument(..., help="existing project to link this directory to")) -> None:
+    """Link this directory to an existing project (e.g. on a 2nd machine)."""
+    api = Api()
+    root = _repo_root()
+    slug = common.slugify_project(name)
+    proj = _find_by_slug(api, slug)
+    if not proj:
+        console.print(f"[red]no project '{slug}'[/] — create it with `cync init {name}`")
+        raise typer.Exit(1)
+    set_link(root, proj["id"])
+    console.print(f"[green]linked[/] {root} -> {proj['slug']}")
+
+
+@app.command()
+def unlink() -> None:
+    """Remove this directory's project link."""
+    root = _repo_root()
+    console.print("unlinked" if remove_link(root) else "[yellow]this directory wasn't linked[/]")
+
+
+# ---- sync ----
+
+
+@app.command()
+def push(id: str = typer.Argument(None, help="conversation id (default: all here)")) -> None:
+    """Upload this project's conversation(s) to the server."""
+    api = Api()
+    root, pid, folder = _linked()
+    files = common.list_local_conversations(folder)
+    if id:
+        files = [f for f in files if f.stem == id]
+    if not files:
+        console.print("[yellow]no conversations found here[/]")
+        raise typer.Exit(code=0)
+    for f in files:
+        raw = f.read_bytes()
+        body = {
+            "project_id": pid,
+            "origin_path": root,
+            "title": common.extract_title(raw.decode("utf-8", "ignore")),
+            "mtime": f.stat().st_mtime,
+            "content_b64": base64.b64encode(raw).decode(),
+        }
+        r = api.put(f"/conversations/{f.stem}", json=body)
+        _check(r)
+        console.print(f"[green]pushed[/] {f.stem[:8]}  {r.json().get('title', '')[:60]}")
+
+
+@app.command()
+def pull(id: str = typer.Argument(None, help="conversation id (default: all here)")) -> None:
+    """Download this project's conversation(s) into ~/.claude on this machine."""
+    api = Api()
+    root, pid, folder = _linked()
+    folder.mkdir(parents=True, exist_ok=True)
+    r = api.get("/conversations", params={"project_id": pid})
+    _check(r)
+    metas = r.json()
+    if id:
+        metas = [m for m in metas if m["id"] == id]
+    if not metas:
+        console.print("[yellow]nothing on the server for this project[/]")
+        raise typer.Exit(code=0)
+    for m in metas:
+        rr = api.get(f"/conversations/{m['id']}", params={"project_id": pid})
+        _check(rr)
+        d = rr.json()
+        data = base64.b64decode(d["content_b64"])
+        origin = d.get("origin_path") or ""
+        if origin and origin != root and origin not in ("/", os.sep) and len(origin) > 1:
+            data = _rewrite_cwd(data, origin, root)
+        dest = folder / f"{m['id']}.jsonl"
+        existed = dest.exists()
+        dest.write_bytes(data)
+        if m.get("mtime"):
+            os.utime(dest, (m["mtime"], m["mtime"]))
+        verb = "overwrote" if existed else "added"
+        console.print(f"[green]{verb}[/] {m['id'][:8]}  {m.get('title', '')[:60]}")
+    console.print(f"\nresume with [bold]claude --resume[/] inside {root}")
+
+
+@app.command(name="list")
+def list_cmd() -> None:
+    """List this project's conversations stored on the server."""
+    api = Api()
+    _root, pid, _folder = _linked()
+    r = api.get("/conversations", params={"project_id": pid})
+    _check(r)
+    table = Table("id", "title", "size", "updated")
+    for m in r.json():
+        table.add_row(
+            m["id"][:8], m.get("title", "")[:60],
+            str(m.get("size", "")), (m.get("updated_at") or "")[:19],
+        )
+    console.print(table)
+
+
+# ---- project management ----
+
+
+@project_app.command("list")
+def project_list() -> None:
+    """List your projects."""
+    api = Api()
+    r = api.get("/projects")
+    _check(r)
+    projects = r.json()
+    if not projects:
+        console.print("[yellow]no projects — create one with `cync init <name>`[/]")
+        return
+    table = Table("slug", "name", "chats", "created")
+    for p in projects:
+        table.add_row(
+            p.get("slug", ""), p.get("name", ""),
+            str(p.get("count", 0)), (p.get("created_at") or "")[:10],
+        )
+    console.print(table)
+
+
+@project_app.command("rm")
+def project_rm(
+    name: str = typer.Argument(..., help="project to delete"),
+    yes: bool = typer.Option(False, "--yes", "-y", help="skip confirmation"),
+) -> None:
+    """Delete a project AND all its conversations."""
+    api = Api()
+    slug = common.slugify_project(name)
+    proj = _find_by_slug(api, slug)
+    if not proj:
+        console.print(f"[yellow]no project '{slug}'[/]")
+        raise typer.Exit(0)
+    if not yes:
+        typer.confirm(f"delete project '{slug}' and ALL its conversations?", abort=True)
+    r = api.delete(f"/projects/{proj['id']}")
+    _check(r)
+    console.print(f"[green]deleted[/] '{slug}'")
+
+
+def main() -> None:
+    from dotenv import load_dotenv
+
+    load_dotenv()
+    app()
+
+
+if __name__ == "__main__":
+    main()

cync/common.py

@@ -0,0 +1,185 @@
+"""Shared helpers for cync.
+
+The two tricky bits both live here:
+  * encode_project_dir() reproduces how Claude Code names the per-project
+    folder under ~/.claude/projects (the abs path with every non-alphanumeric
+    character replaced by '-').
+  * git_remote() gives a machine-independent project identity, so a
+    conversation pushed from /Users/me/x can be pulled into /home/me/x.
+"""
+from __future__ import annotations
+
+import json
+import os
+import re
+import subprocess
+from datetime import datetime, timezone
+from pathlib import Path
+
+
+def now_iso() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def claude_projects_dir() -> Path:
+    base = os.environ.get("CLAUDE_DATA_DIR")
+    root = Path(base) if base else Path.home() / ".claude"
+    return root / "projects"
+
+
+def encode_project_dir(path: str) -> str:
+    """Reproduce Claude Code's project-folder naming.
+
+    Claude Code takes the absolute working directory and replaces every
+    non-alphanumeric character with '-'. e.g.
+        /Users/me/Desktop/stu          -> -Users-me-Desktop-stu
+        /Users/me/Desktop/dev/site.com -> -Users-me-Desktop-dev-site-com
+    """
+    p = os.path.abspath(path)
+    return re.sub(r"[^A-Za-z0-9]", "-", p)
+
+
+def _git(args: list[str], cwd: str | None = None) -> str | None:
+    try:
+        out = subprocess.run(
+            ["git", "-C", cwd or ".", *args],
+            capture_output=True,
+            text=True,
+            check=True,
+        )
+        return out.stdout.strip()
+    except Exception:
+        return None
+
+
+def git_root(cwd: str | None = None) -> str | None:
+    return _git(["rev-parse", "--show-toplevel"], cwd)
+
+
+def git_remote(cwd: str | None = None) -> str | None:
+    url = _git(["remote", "get-url", "origin"], cwd)
+    return normalize_remote(url) if url else None
+
+
+def normalize_remote(url: str) -> str:
+    """Normalize a git remote to a stable host/owner/repo identity.
+
+    All of these collapse to ``github.com/org/repo`` so the same repo yields the
+    same identity regardless of how it was cloned (ports and trailing slashes
+    are stripped, the host is lowercased)::
+
+        git@github.com:org/repo.git
+        https://github.com/org/repo.git
+        https://github.com:443/org/repo/
+        ssh://git@github.com:2222/org/repo.git
+    """
+    u = url.strip().rstrip("/")
+    if u.endswith(".git"):
+        u = u[:-4]
+    had_scheme = False
+    for prefix in ("https://", "http://", "ssh://", "git://"):
+        if u.startswith(prefix):
+            u = u[len(prefix):]
+            had_scheme = True
+            break
+    # scp-style "git@host:org/repo" (no scheme) uses ':' as the path separator;
+    # a scheme'd URL like ssh://git@host:2222/... uses ':' for the PORT instead.
+    if not had_scheme and u.startswith("git@"):
+        u = u[len("git@"):].replace(":", "/", 1)
+    head, sep, tail = u.partition("/")
+    if "@" in head:  # strip leftover user@host
+        head = head.split("@", 1)[1]
+    head = re.sub(r":\d+$", "", head)  # strip port
+    return head.lower() + (sep + tail if sep else "")
+
+
+def project_key(remote: str) -> str:
+    """An R2-key-safe prefix derived from the normalized git remote.
+
+    Collapses anything outside ``[A-Za-z0-9._-]`` to ``_`` and neutralizes
+    ``..`` / leading dots so the key can never be abused for path traversal.
+    """
+    key = re.sub(r"[^A-Za-z0-9._-]", "_", remote)
+    key = re.sub(r"\.\.+", "_", key)  # never let '..' survive into a path/key
+    return key.lstrip(".-") or "_"
+
+
+_SAFE_SEGMENT = re.compile(r"^[A-Za-z0-9._-]+$")
+
+
+def is_safe_segment(value: str) -> bool:
+    """True if ``value`` is safe to use as a single path/storage-key segment.
+
+    Rejects empty, traversal (``..``), separators, and leading dots — used to
+    validate untrusted ``{pk}`` / ``{cid}`` URL params before they touch the
+    filesystem (LocalStorage) or an object-store key.
+    """
+    return (
+        bool(value)
+        and ".." not in value
+        and "/" not in value
+        and "\\" not in value
+        and not value.startswith(".")
+        and bool(_SAFE_SEGMENT.match(value))
+    )
+
+
+# Reserved storage prefix for project-registry records (not a conversation key).
+PROJECTS_PREFIX = "__projects__"
+
+
+def slugify_project(name: str) -> str:
+    """Turn a display name into a clean, URL/storage-key-safe project id.
+
+    "DroneForge" -> "droneforge", "my cool proj!" -> "my-cool-proj".
+    """
+    s = name.strip().lower()
+    s = re.sub(r"[^a-z0-9._-]+", "-", s)
+    s = re.sub(r"-{2,}", "-", s).strip("-._")
+    return s
+
+
+def extract_title(jsonl_text: str) -> str:
+    """Best-effort human title: a summary line if present, else first user msg."""
+    first_user: str | None = None
+    for line in jsonl_text.splitlines():
+        line = line.strip()
+        if not line:
+            continue
+        try:
+            obj = json.loads(line)
+        except Exception:
+            continue
+        if obj.get("type") == "summary" and obj.get("summary"):
+            return " ".join(str(obj["summary"]).split())[:200]
+        if first_user is None and obj.get("type") == "user":
+            content = (obj.get("message") or {}).get("content")
+            if isinstance(content, list):
+                content = " ".join(
+                    p.get("text", "") for p in content if isinstance(p, dict)
+                )
+            if isinstance(content, str):
+                text = " ".join(content.split())  # collapse newlines/whitespace
+                if text and not text.startswith("<"):
+                    first_user = text[:200]
+    return first_user or "(untitled)"
+
+
+def list_local_conversations(project_folder: Path) -> list[Path]:
+    """Real conversation .jsonl files in a project folder.
+
+    Skips agent-*.jsonl sidecars and empty files.
+    """
+    if not project_folder.is_dir():
+        return []
+    files: list[Path] = []
+    for f in sorted(project_folder.glob("*.jsonl")):
+        if f.name.startswith("agent-"):
+            continue
+        try:
+            if f.stat().st_size == 0:
+                continue
+        except OSError:
+            continue
+        files.append(f)
+    return files