dark-chat 2.1.0__tar.gz

dark_chat-2.1.0/MANIFEST.in

@@ -0,0 +1,4 @@
+include README.md
+recursive-include docs *.md
+recursive-include scripts *.py
+exclude docs/node-version.md

dark_chat-2.1.0/PKG-INFO

@@ -0,0 +1,150 @@
+Metadata-Version: 2.4
+Name: dark-chat
+Version: 2.1.0
+Summary: Minimal two-person encrypted terminal chat and WebSocket relay
+Project-URL: Repository, https://github.com/iZubayr/dark-terminal-chat
+Project-URL: Issues, https://github.com/iZubayr/dark-terminal-chat/issues
+Classifier: Programming Language :: Python :: 3
+Classifier: Environment :: Console
+Classifier: Operating System :: OS Independent
+Classifier: Topic :: Communications :: Chat
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: cryptography<50,>=44
+Requires-Dist: websockets<18,>=15
+Requires-Dist: prompt-toolkit<4,>=3.0.48
+
+# Dark Terminal Chat
+
+A plain, English terminal chat for two people. No banner, logo, animation, or forced color. Python 3.10 or newer is required. The client and WebSocket server install from the same Python package.
+
+Version 2 uses a new session protocol. Use version 2 clients and servers together. Source: [GitHub](https://github.com/iZubayr/dark-terminal-chat).
+
+## Install
+
+Install from [PyPI](https://pypi.org/project/dark-chat/):
+
+~~~sh
+pip install dark-chat
+~~~
+
+Create a chat:
+
+~~~sh
+dark-chat --new
+~~~
+
+Join a chat:
+
+~~~sh
+dark-chat --chat
+~~~
+
+Enter your name when asked. The creator receives a code and shares it with the peer. The peer enters that code when asked. Both commands connect to the hosted server automatically.
+
+For development, install from this folder on Windows:
+
+~~~powershell
+python -m venv .venv
+.\.venv\Scripts\Activate.ps1
+python -m pip install .
+~~~
+
+On Linux or macOS:
+
+~~~sh
+python3 -m venv .venv
+. .venv/bin/activate
+python -m pip install .
+~~~
+
+The package provides two commands: dark-chat and dark-chat-server. You can also use python -m dark_terminal_chat and python -m dark_terminal_chat.server.
+
+## Local use
+
+Open three terminals with the Python environment activated.
+
+~~~sh
+# Server
+dark-chat-server
+
+# Creator
+dark-chat --server ws://127.0.0.1:8080/ws --new --name elliot
+
+# Peer, in another terminal
+dark-chat --server ws://127.0.0.1:8080/ws --chat --name whiterose
+~~~
+
+The creator receives a line starting with "Code:". The peer pastes that code at "Code:". The code is hidden while entering it. If no name is supplied, the program asks "Name:". Running dark-chat without either mode asks "Create or join? [c/j]:".
+
+The interface contains only prompts, messages, and relevant connection/error notices. Example:
+
+~~~text
+Code: <invite code>
+Waiting for peer.
+whiterose joined.
+whiterose> Hello.
+elliot>
+~~~
+
+On Windows, chat.cmd and server.cmd use this folder's .venv when available.
+
+## Session rules
+
+- Each chat has two participant slots. A third participant is refused.
+- Leaving with /exit or Ctrl+C releases the participant's slot immediately while connected.
+- When both participants leave, the room is removed. Joining with its old code fails; create a new chat for a new code.
+- A dropped connection reserves the same participant's slot for 60 seconds. Only that participant's in-memory resume token can reclaim it.
+- The client tries to reconnect for up to 60 seconds. When a server restarts, room state is lost and a new chat is needed.
+- Sending is paused while the peer is offline. The draft remains editable.
+- Messages are not queued or automatically resent. If receipt isn't confirmed, the draft is kept and a short notice is shown. A lost receipt can mean the peer already saw the message; check before manually resending.
+- Messages and drafts are not written to files. Old messages are not replayed after reconnecting.
+
+## Internet use
+
+The deployed server is available at wss://zubayr.alwaysdata.net/dark-chat/ws:
+
+~~~sh
+dark-chat --new
+dark-chat --chat
+~~~
+
+Share the code with the peer. To use your own relay, pass --server wss://YOUR_SERVER/ws. Use wss:// for internet connections. TLS certificates are checked; --ca ca.pem supports a private certificate authority.
+
+DARK_CHAT_SERVER can override the default relay. --server overrides that environment variable. DARK_CHAT_CODE is supported for non-interactive clients; interactive clients ask for the code instead.
+
+For local Wi-Fi, use --host 0.0.0.0 on the server and --server ws://LAN_IP:8080/ws --allow-insecure on clients.
+
+[AlwaysData setup beside MediaHub](docs/alwaysdata.md).
+
+## Commands
+
+| Command | Action |
+| --- | --- |
+| /help | List commands |
+| /who | Show the connected participants whose names are known |
+| /clear | Clear the screen |
+| /exit or Ctrl+C | Leave |
+
+## Privacy
+
+Messages and names are encrypted on the client with AES-256-GCM. Keys are derived from a random 32-byte invite code with HKDF-SHA256. The invite code is never sent to the relay. The relay sees opaque room/session identifiers, IP addresses, message sizes, timing, and delivery-control metadata.
+
+An invite code is shared access, and a name is not verified identity. Keep the code private. The terminal scrollback may retain displayed messages and the creator's code; /clear is not secure erasure. There is no forward secrecy, anonymity guarantee, or independent security audit.
+
+The relay holds only session metadata and temporary network buffers. There is no message history or application-level message queue. The default server limit is 128 connections/rooms, with two participant slots per room and a 40-packet limit per connection per 10 seconds. Run one relay process; separate instances do not share rooms.
+
+## Build and check
+
+~~~sh
+python -m pip install -e . build twine
+python -m unittest discover -s tests -v
+python -m build
+python -m twine check dist/*
+~~~
+
+[Package distribution](docs/distribution.md).
+
+GitHub Actions tests the installed wheel on Linux with Python 3.10/3.12 and on Windows with Python 3.12. After all jobs pass, it advances the deploy branch. AlwaysData checks that branch every five minutes and tests the candidate again before changing the running version. See [automatic updates](docs/alwaysdata.md#automatic-updates).
+
+The earlier Node.js TCP experiment remains as reference source only. It does not support the current session protocol. The Python client/server is the application.

dark_chat-2.1.0/README.md

@@ -0,0 +1,134 @@
+# Dark Terminal Chat
+
+A plain, English terminal chat for two people. No banner, logo, animation, or forced color. Python 3.10 or newer is required. The client and WebSocket server install from the same Python package.
+
+Version 2 uses a new session protocol. Use version 2 clients and servers together. Source: [GitHub](https://github.com/iZubayr/dark-terminal-chat).
+
+## Install
+
+Install from [PyPI](https://pypi.org/project/dark-chat/):
+
+~~~sh
+pip install dark-chat
+~~~
+
+Create a chat:
+
+~~~sh
+dark-chat --new
+~~~
+
+Join a chat:
+
+~~~sh
+dark-chat --chat
+~~~
+
+Enter your name when asked. The creator receives a code and shares it with the peer. The peer enters that code when asked. Both commands connect to the hosted server automatically.
+
+For development, install from this folder on Windows:
+
+~~~powershell
+python -m venv .venv
+.\.venv\Scripts\Activate.ps1
+python -m pip install .
+~~~
+
+On Linux or macOS:
+
+~~~sh
+python3 -m venv .venv
+. .venv/bin/activate
+python -m pip install .
+~~~
+
+The package provides two commands: dark-chat and dark-chat-server. You can also use python -m dark_terminal_chat and python -m dark_terminal_chat.server.
+
+## Local use
+
+Open three terminals with the Python environment activated.
+
+~~~sh
+# Server
+dark-chat-server
+
+# Creator
+dark-chat --server ws://127.0.0.1:8080/ws --new --name elliot
+
+# Peer, in another terminal
+dark-chat --server ws://127.0.0.1:8080/ws --chat --name whiterose
+~~~
+
+The creator receives a line starting with "Code:". The peer pastes that code at "Code:". The code is hidden while entering it. If no name is supplied, the program asks "Name:". Running dark-chat without either mode asks "Create or join? [c/j]:".
+
+The interface contains only prompts, messages, and relevant connection/error notices. Example:
+
+~~~text
+Code: <invite code>
+Waiting for peer.
+whiterose joined.
+whiterose> Hello.
+elliot>
+~~~
+
+On Windows, chat.cmd and server.cmd use this folder's .venv when available.
+
+## Session rules
+
+- Each chat has two participant slots. A third participant is refused.
+- Leaving with /exit or Ctrl+C releases the participant's slot immediately while connected.
+- When both participants leave, the room is removed. Joining with its old code fails; create a new chat for a new code.
+- A dropped connection reserves the same participant's slot for 60 seconds. Only that participant's in-memory resume token can reclaim it.
+- The client tries to reconnect for up to 60 seconds. When a server restarts, room state is lost and a new chat is needed.
+- Sending is paused while the peer is offline. The draft remains editable.
+- Messages are not queued or automatically resent. If receipt isn't confirmed, the draft is kept and a short notice is shown. A lost receipt can mean the peer already saw the message; check before manually resending.
+- Messages and drafts are not written to files. Old messages are not replayed after reconnecting.
+
+## Internet use
+
+The deployed server is available at wss://zubayr.alwaysdata.net/dark-chat/ws:
+
+~~~sh
+dark-chat --new
+dark-chat --chat
+~~~
+
+Share the code with the peer. To use your own relay, pass --server wss://YOUR_SERVER/ws. Use wss:// for internet connections. TLS certificates are checked; --ca ca.pem supports a private certificate authority.
+
+DARK_CHAT_SERVER can override the default relay. --server overrides that environment variable. DARK_CHAT_CODE is supported for non-interactive clients; interactive clients ask for the code instead.
+
+For local Wi-Fi, use --host 0.0.0.0 on the server and --server ws://LAN_IP:8080/ws --allow-insecure on clients.
+
+[AlwaysData setup beside MediaHub](docs/alwaysdata.md).
+
+## Commands
+
+| Command | Action |
+| --- | --- |
+| /help | List commands |
+| /who | Show the connected participants whose names are known |
+| /clear | Clear the screen |
+| /exit or Ctrl+C | Leave |
+
+## Privacy
+
+Messages and names are encrypted on the client with AES-256-GCM. Keys are derived from a random 32-byte invite code with HKDF-SHA256. The invite code is never sent to the relay. The relay sees opaque room/session identifiers, IP addresses, message sizes, timing, and delivery-control metadata.
+
+An invite code is shared access, and a name is not verified identity. Keep the code private. The terminal scrollback may retain displayed messages and the creator's code; /clear is not secure erasure. There is no forward secrecy, anonymity guarantee, or independent security audit.
+
+The relay holds only session metadata and temporary network buffers. There is no message history or application-level message queue. The default server limit is 128 connections/rooms, with two participant slots per room and a 40-packet limit per connection per 10 seconds. Run one relay process; separate instances do not share rooms.
+
+## Build and check
+
+~~~sh
+python -m pip install -e . build twine
+python -m unittest discover -s tests -v
+python -m build
+python -m twine check dist/*
+~~~
+
+[Package distribution](docs/distribution.md).
+
+GitHub Actions tests the installed wheel on Linux with Python 3.10/3.12 and on Windows with Python 3.12. After all jobs pass, it advances the deploy branch. AlwaysData checks that branch every five minutes and tests the candidate again before changing the running version. See [automatic updates](docs/alwaysdata.md#automatic-updates).
+
+The earlier Node.js TCP experiment remains as reference source only. It does not support the current session protocol. The Python client/server is the application.

dark_chat-2.1.0/docs/alwaysdata.md

@@ -0,0 +1,97 @@
+# AlwaysData deployment
+
+Deploy this chat as a separate site, directory, and virtual environment beside MediaHub. The applications share the account's resource allowance. The hosting supervisor limits the relay to 32 connections.
+
+AlwaysData supports [WebSocket sites](https://help.alwaysdata.com/en/blog/2023-03-14-hold-on-to-your-socks-high-speed-data-stream-hosting-with-websockets/). External clients use HTTPS/WSS, while the relay listens on the site's internal IP/port.
+
+## Deployed instance
+
+The zubayr account serves the chat at wss://zubayr.alwaysdata.net/dark-chat/ws. Health: https://zubayr.alwaysdata.net/dark-chat/health. Its clone lives at /home/zubayr/dark-chat. The separate Dark Terminal site is 1084884; scheduled task 34302 checks for updates every five minutes. MediaHub remains the root site.
+
+On 2026-10-08, the hosting environment passed all 22 tests. Two clients installed from the GitHub release exchanged messages through the public WSS endpoint. The same check verified encrypted Unicode messages, refusal of a third participant, session resumption, and rejection of an old invite after both participants left. MediaHub's /health returned HTTP 200 before and after the check.
+
+## Install
+
+In the AlwaysData SSH terminal (replace ACCOUNT with the account name):
+
+~~~sh
+cd /home/ACCOUNT
+git clone --branch deploy https://github.com/iZubayr/dark-terminal-chat.git dark-chat
+cd dark-chat
+python3 scripts/update.py
+.deploy/current/venv/bin/dark-chat-server --version
+~~~
+
+Python 3.10+ is required. GitHub Actions advances the deploy branch only after every test job passes. The updater installs that approved commit and tests it again in its own environment. The deploy branch becomes available after the first successful Tests workflow.
+
+## Add a site
+
+In the AlwaysData panel, choose Web → Sites → Add a site. See [User program configuration](https://help.alwaysdata.com/en/docs/web-hosting/sites/http-servers/user-program/).
+
+| Field | Value |
+| --- | --- |
+| Name | Dark Terminal |
+| Addresses | ACCOUNT.alwaysdata.net/dark-chat |
+| Type | User program |
+| Command | python3 /home/ACCOUNT/dark-chat/scripts/run_server.py |
+| Working directory | /home/ACCOUNT/dark-chat |
+| Environment | IP and PORT: the values assigned to this new site in the panel |
+| Trim path | Enabled |
+| Idle time | 0 |
+
+Replace ACCOUNT with your actual account name. If IP/PORT are not supplied automatically, set them in Environment or pass --host PANEL_IP --port PANEL_PORT in Command. Use the new site's assigned port.
+
+Trim path maps external /dark-chat/ws to internal /ws, and /dark-chat/health to /health. AlwaysData handles external TLS. Start/restart the new chat site.
+
+## Verify
+
+~~~sh
+curl --fail https://ACCOUNT.alwaysdata.net/dark-chat/health
+~~~
+
+Expected response:
+
+~~~json
+{"status":"ok"}
+~~~
+
+Then use two computers:
+
+~~~sh
+dark-chat --server wss://ACCOUNT.alwaysdata.net/dark-chat/ws --new --name elliot
+dark-chat --server wss://ACCOUNT.alwaysdata.net/dark-chat/ws --name whiterose
+~~~
+
+The creator shares the invite code with the peer. Confirm messages arrive in both directions, a third client is refused, and MediaHub still responds normally. Local tests do not prove production behavior.
+
+## Restarts and upgrades
+
+Use version 2 clients with a version 2 server. The session protocol is incompatible with version 1.
+
+Run one relay process. Rooms are in memory, so a server restart ends existing sessions and invalidates join codes. Clients handle ordinary connection drops for 60 seconds; they cannot reconstruct rooms after a server restart.
+
+For a 503 response, check this site's startup log, command, environment, and IP/PORT. If health works but chat doesn't, check the public WSS URL, Trim path, TLS, and site settings affecting WebSocket connections.
+
+## Automatic updates
+
+Add a separate AlwaysData scheduled task:
+
+| Field | Value |
+| --- | --- |
+| Type | Command |
+| Frequency | Every 5 minutes |
+| Command | See the bootstrap command below |
+| Working directory | /home/ACCOUNT/dark-chat |
+| Annotation | Dark Terminal updates |
+
+Scheduled task command (replace ACCOUNT):
+
+~~~sh
+/bin/bash -c 'set -eu; cd /home/ACCOUNT/dark-chat; git fetch origin main deploy; mkdir -p .deploy; git show origin/deploy:scripts/update.py > .deploy/update-current.py; exec python3 .deploy/update-current.py'
+~~~
+
+The bootstrap uses the approved upstream updater, so fixes to deployment itself can take effect. The updater fetches the deploy branch published by GitHub Tests, verifies that its commit belongs to main, and builds a separate release environment. Before building, it removes inactive generated release environments inside this clone to fit the hosting disk quota; the current release is preserved. It runs the tests there before fast-forwarding the clone and atomically changing .deploy/current. Pip runs in isolated mode with --no-user and --no-cache-dir. The supervisor then restarts only the chat child process. No GitHub SSH private key, API token, or unauthenticated GitHub API call is needed on the server.
+
+Failed tests, failed installs, local edits, or diverged commits leave the active release unchanged. A lock prevents overlapping updates. The current release and one candidate are retained; older environments can be rebuilt from Git if needed. A successful upgrade ends any current chats because rooms exist only in memory.
+
+For a manual update, run python3 scripts/update.py from the clone. The scheduled task uses the same path. To roll back, point .deploy/current at a known previous release; the supervisor notices the change. Disable the scheduled task while investigating so it does not immediately reapply main.

dark_chat-2.1.0/docs/distribution.md

@@ -0,0 +1,44 @@
+# Distributing dark-chat
+
+The package name and client command are both dark-chat. Python 3.10+ is required. Version 2.1.0 connects to wss://zubayr.alwaysdata.net/dark-chat/ws by default.
+
+The public client commands are:
+
+~~~sh
+pip install dark-chat
+dark-chat --new
+dark-chat --chat
+~~~
+
+The creator shares the code with the peer. Names and codes are entered at the terminal prompts. The server address is optional; --server and DARK_CHAT_SERVER support other relays.
+
+## Build and verify
+
+~~~sh
+python -m build --outdir dist/2.1.0
+python -m twine check dist/2.1.0/*
+python -m pip install dist/2.1.0/dark_chat-2.1.0-py3-none-any.whl
+python -m pip check
+python -m unittest discover -s tests -v
+dark-chat --version
+~~~
+
+Keep earlier dark-terminal-chat distribution files separate. Publish only the new dark-chat distribution. The import module remains dark_terminal_chat, so a client environment should contain one of these distributions at a time.
+
+## PyPI publishing
+
+Configure a pending GitHub Trusted Publisher under [PyPI account publishing](https://pypi.org/manage/account/publishing/):
+
+| Field | Value |
+| --- | --- |
+| PyPI project name | dark-chat |
+| GitHub owner | iZubayr |
+| Repository | dark-terminal-chat |
+| Workflow filename | ci.yml |
+| Environment | pypi |
+
+Then run the Tests workflow on main with the publish input enabled. It builds and installs the package, runs tests on Linux with Python 3.10/3.12 and Windows with Python 3.12, and checks the installed dark-chat command. Only after all jobs pass does the publish job upload the tested Linux 3.12 artifact to PyPI using short-lived OIDC credentials. No permanent PyPI API token is stored in the repository or on AlwaysData.
+
+After publishing, install dark-chat from the normal PyPI index in a fresh environment. Verify --new and --chat exchange messages through the default public relay. A built wheel or successful GitHub workflow without a successful PyPI publish does not establish that pip install dark-chat works.
+
+[PyPI Trusted Publishing documentation](https://docs.pypi.org/trusted-publishers/creating-a-project-through-oidc/).

dark_chat-2.1.0/pyproject.toml

@@ -0,0 +1,32 @@
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "dark-chat"
+version = "2.1.0"
+description = "Minimal two-person encrypted terminal chat and WebSocket relay"
+readme = "README.md"
+requires-python = ">=3.10"
+dependencies = [
+  "cryptography>=44,<50",
+  "websockets>=15,<18",
+  "prompt-toolkit>=3.0.48,<4",
+]
+classifiers = [
+  "Programming Language :: Python :: 3",
+  "Environment :: Console",
+  "Operating System :: OS Independent",
+  "Topic :: Communications :: Chat",
+]
+
+[project.scripts]
+dark-chat = "dark_terminal_chat.client:main"
+dark-chat-server = "dark_terminal_chat.server:main"
+
+[project.urls]
+Repository = "https://github.com/iZubayr/dark-terminal-chat"
+Issues = "https://github.com/iZubayr/dark-terminal-chat/issues"
+
+[tool.setuptools.packages.find]
+where = ["src"]

dark_chat-2.1.0/scripts/run_server.py

@@ -0,0 +1,58 @@
+"""AlwaysData supervises this process; it supervises the active chat release."""
+import os
+from pathlib import Path
+import signal
+import subprocess
+import threading
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def release_target():
+    release = (ROOT / ".deploy/current").resolve(strict=True)
+    release.relative_to((ROOT / ".deploy/releases").resolve())
+    if not (release / "venv/bin/python").is_file():
+        raise ValueError("Active release has no Python runtime")
+    return release
+
+
+def stop_child(child):
+    if child.poll() is not None:
+        return
+    child.terminate()
+    try:
+        child.wait(timeout=10)
+    except subprocess.TimeoutExpired:
+        child.kill()
+        child.wait()
+
+
+def main():
+    stopped = threading.Event()
+    for sig in (signal.SIGINT, signal.SIGTERM):
+        signal.signal(sig, lambda *_: stopped.set())
+    child = None
+    try:
+        while not stopped.is_set():
+            release = release_target()
+            environment = dict(os.environ, PYTHONUNBUFFERED="1")
+            child = subprocess.Popen(
+                [str(release / "venv/bin/python"), "-m", "dark_terminal_chat.server",
+                 "--max-clients", "32"], cwd=release, env=environment,
+            )
+            print(f"Running release: {release.name}", flush=True)
+            while not stopped.wait(2):
+                status = child.poll()
+                if status is not None:
+                    raise SystemExit(status or 1)
+                if release_target() != release:
+                    break
+            stop_child(child)
+            child = None
+    finally:
+        if child is not None:
+            stop_child(child)
+
+
+if __name__ == "__main__":
+    main()

dark_chat-2.1.0/scripts/update.py

@@ -0,0 +1,141 @@
+"""Fast-forward the server clone only after CI and a staged install pass."""
+import argparse
+import contextlib
+import io
+import os
+from pathlib import Path
+import re
+import shutil
+import subprocess
+import tarfile
+import venv
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def command(*args, cwd=ROOT, capture=False):
+    return subprocess.run(args, cwd=cwd, check=True, text=True,
+                          stdout=subprocess.PIPE if capture else None).stdout
+
+
+def current_release(root=ROOT):
+    current = root / ".deploy/current"
+    if not current.exists():
+        if current.is_symlink():
+            raise ValueError("Active release is missing; cleanup refused")
+        return None
+    target = current.resolve(strict=True)
+    releases = (root / ".deploy/releases").resolve()
+    releases.relative_to(root.resolve())
+    if target.parent != releases or not re.fullmatch(r"[0-9a-f]{40}", target.name):
+        raise ValueError("Invalid active release")
+    return target
+
+
+def activate(release, root=ROOT):
+    current = root / ".deploy/current"
+    pending = root / ".deploy/current.next"
+    with contextlib.suppress(FileNotFoundError):
+        pending.unlink()
+    pending.symlink_to(release, target_is_directory=True)
+    os.replace(pending, current)
+
+
+def prune_releases(root=ROOT):
+    releases = root / ".deploy/releases"
+    if releases.is_symlink():
+        raise ValueError("Release directory must not be a symlink")
+    boundary = releases.resolve()
+    boundary.relative_to(root.resolve())
+    if not releases.exists():
+        return
+    active = current_release(root)
+    for candidate in releases.iterdir():
+        if (candidate.is_symlink() or not candidate.is_dir()
+                or not re.fullmatch(r"[0-9a-f]{40}", candidate.name)):
+            continue
+        resolved = candidate.resolve(strict=True)
+        resolved.relative_to(boundary)
+        if resolved == active:
+            continue
+        # These directories contain generated installs, rebuildable from Git.
+        shutil.rmtree(resolved)
+        print(f"Removed inactive release: {candidate.name}")
+
+
+def stage(revision, root=ROOT):
+    # The free hosting quota cannot retain an unbounded number of environments.
+    prune_releases(root)
+    release = root / ".deploy/releases" / revision
+    release.mkdir(parents=True, exist_ok=True)
+    source = release / "code"
+    source.mkdir(exist_ok=True)
+    archive = subprocess.run(["git", "archive", revision], cwd=root, check=True,
+                             stdout=subprocess.PIPE).stdout
+    with tarfile.open(fileobj=io.BytesIO(archive)) as tree:
+        for member in tree.getmembers():
+            if member.issym() or member.islnk() or not (member.isfile() or member.isdir()):
+                raise ValueError("Unexpected file in release archive")
+            (source / member.name).resolve().relative_to(source.resolve())
+        if hasattr(tarfile, "data_filter"):
+            tree.extractall(source, filter="data")
+        else:
+            # Older Python 3.10 versions use the path/type checks above.
+            tree.extractall(source)
+    environment = release / "venv"
+    venv.EnvBuilder(with_pip=True).create(environment)
+    python = environment / "bin/python"
+    # AlwaysData defaults pip to --user; this release has its own environment.
+    command(str(python), "-m", "pip", "--isolated", "install", "--no-user", "--no-cache-dir", "--timeout", "120", str(source), cwd=source)
+    command(str(python), "-m", "pip", "check", cwd=source)
+    command(str(python), "-m", "unittest", "discover", "-s", "tests", "-v", cwd=source)
+    return release
+
+
+def update(root=ROOT):
+    if os.name != "posix":
+        raise ValueError("Run the updater on the Linux hosting server")
+    import fcntl
+    state = root / ".deploy"
+    state.mkdir(exist_ok=True)
+    with (state / "update.lock").open("w") as lock:
+        try:
+            fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except BlockingIOError:
+            print("Another update is running.")
+            return
+        if command("git", "status", "--porcelain", cwd=root, capture=True).strip():
+            raise ValueError("Local checkout has edits; update refused")
+        origin = command("git", "remote", "get-url", "origin", cwd=root, capture=True).strip()
+        match = re.fullmatch(r"https://github\.com/([\w.-]+/[\w.-]+?)(?:\.git)?", origin)
+        if not match:
+            raise ValueError("Origin must be a public GitHub HTTPS repository")
+        # CI alone advances deploy after every test job succeeds. No API token
+        # or shared hosting API rate limit is involved in this checkout.
+        command("git", "fetch", "origin", "main", "deploy", cwd=root)
+        revision = command("git", "rev-parse", "origin/deploy", cwd=root, capture=True).strip()
+        if not re.fullmatch(r"[0-9a-f]{40}", revision):
+            raise ValueError("Invalid upstream revision")
+        command("git", "merge-base", "--is-ancestor", revision, "origin/main", cwd=root)
+        previous = current_release(root)
+        if previous and previous.name == revision:
+            print(f"Already current: {revision}")
+            return
+        command("git", "merge-base", "--is-ancestor", "HEAD", revision, cwd=root)
+        release = stage(revision, root)
+        command("git", "merge", "--ff-only", revision, cwd=root)
+        activate(release, root)
+        print(f"Activated: {revision}")
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.parse_args()
+    try:
+        update()
+    except (OSError, ValueError, subprocess.CalledProcessError) as error:
+        raise SystemExit(f"Update failed: {error}") from None
+
+
+if __name__ == "__main__":
+    main()

dark_chat-2.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+