dev-bubble 0.2.0__tar.gz → 0.2.1__tar.gz

{dev_bubble-0.2.0 → dev_bubble-0.2.1}/.claude/CLAUDE.md

@@ -164,3 +164,29 @@ VS Code must be restarted after modifying this database.
 
 ### Pre-baked VS Code Server
 The base image pre-installs the VS Code Server binary matching the host's `code --version` commit hash. On each `bubble open`, if the hash has changed (VS Code updated), a background `bubble images build base` is triggered. The current bubble proceeds immediately; the next one gets the pre-baked server.
+
+## PyPI Publishing
+
+The package is published to PyPI as **`dev-bubble`** (the CLI command is still `bubble`). Users install with `pipx install dev-bubble` or `uv tool install dev-bubble`.
+
+### Releasing a New Version
+
+When making changes that warrant a release (new features, bug fixes, improvements), create a new version tag:
+
+1. Bump `version` in `pyproject.toml` (use semver: patch for fixes, minor for features)
+2. Commit the version bump
+3. Tag and push:
+   ```bash
+   git tag v0.X.Y
+   git push origin v0.X.Y
+   ```
+
+The `.github/workflows/publish.yml` workflow runs tests then publishes to PyPI automatically via trusted publishing (no API tokens needed).
+
+### When to Release
+
+**Proactively tag a new minor/patch version** after completing work that changes user-visible behavior. Don't let changes accumulate unreleased — small frequent releases are preferred. If you've just made a meaningful change, bump the version and tag it.
+
+### Trusted Publisher Setup
+
+PyPI is configured to trust GitHub Actions from `kim-em/bubble` with the `publish.yml` workflow and `pypi` environment. No secrets or API tokens are stored in the repository.

dev_bubble-0.2.1/.github/workflows/publish.yml

@@ -0,0 +1,35 @@
+name: Publish to PyPI
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+  id-token: write  # Required for trusted publishing
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: pip install -e ".[dev]"
+      - run: ruff check bubble/ tests/
+      - run: pytest -v -m "not integration"
+
+  publish:
+    needs: test
+    runs-on: ubuntu-latest
+    environment: pypi
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: pip install build
+      - run: python -m build
+      - uses: pypa/gh-action-pypi-publish@release/v1

{dev_bubble-0.2.0 → dev_bubble-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dev-bubble
-Version: 0.2.0
+Version: 0.2.1
 Summary: Containerized development environments powered by Incus
 Author-email: Kim Morrison <kim@tqft.net>
 License-Expression: Apache-2.0
@@ -37,9 +37,11 @@ Containerized development environments for the Lean language, powered by [Incus]
 ## Quick Start
 
 ```bash
-# Install (use pipx or uv to avoid PEP 668 issues with system Python)
-pipx install dev-bubble    # or: uv tool install dev-bubble
-# For development:         uv pip install -e '.[dev]'
+# Install
+uv tool install git+https://github.com/kim-em/bubble.git
+
+# Also available on PyPI: uv tool install dev-bubble
+# For development: uv pip install -e '.[dev]'
 
 # Open a bubble for a GitHub PR — just paste the URL, and you get a containerized VSCode window!
 bubble https://github.com/leanprover-community/mathlib4/pull/35219

{dev_bubble-0.2.0 → dev_bubble-0.2.1}/README.md

@@ -5,9 +5,11 @@ Containerized development environments for the Lean language, powered by [Incus]
 ## Quick Start
 
 ```bash
-# Install (use pipx or uv to avoid PEP 668 issues with system Python)
-pipx install dev-bubble    # or: uv tool install dev-bubble
-# For development:         uv pip install -e '.[dev]'
+# Install
+uv tool install git+https://github.com/kim-em/bubble.git
+
+# Also available on PyPI: uv tool install dev-bubble
+# For development: uv pip install -e '.[dev]'
 
 # Open a bubble for a GitHub PR — just paste the URL, and you get a containerized VSCode window!
 bubble https://github.com/leanprover-community/mathlib4/pull/35219

{dev_bubble-0.2.0 → dev_bubble-0.2.1}/bubble/cli.py

@@ -12,11 +12,11 @@ from pathlib import Path
 import click
 
 from . import __version__
-from .config import DATA_DIR, ensure_dirs, load_config, repo_short_name, save_config
+from .clean import CleanStatus, check_clean, format_reasons
+from .config import ensure_dirs, load_config, repo_short_name, save_config
 from .git_store import bare_repo_path, ensure_repo, fetch_ref, github_url, update_all_repos
 from .hooks import select_hook
 from .images.builder import VSCODE_COMMIT_FILE, get_vscode_commit
-from .clean import CleanStatus, check_clean, format_reasons
 from .lifecycle import load_registry, register_bubble, unregister_bubble
 from .naming import deduplicate_name, generate_name
 from .repo_registry import RepoRegistry
@@ -669,8 +669,8 @@ def _provision_container(runtime, name, image_name, ref_path, mount_name, config
                 connect=connect_addr,
                 listen="unix:/bubble/relay.sock",
                 bind="container",
-                uid="1000",
-                gid="1000",
+                uid="1001",
+                gid="1001",
             )
             from .relay import generate_relay_token
 
@@ -681,14 +681,17 @@ def _provision_container(runtime, name, image_name, ref_path, mount_name, config
                     "bash",
                     "-c",
                     f"echo {shlex.quote(token)} > /bubble/relay-token"
-                    " && chown 1000:1000 /bubble/relay-token"
+                    " && chown user:user /bubble/relay-token"
                     " && chmod 600 /bubble/relay-token",
                 ],
             )
 
 
 def _get_pr_metadata(owner: str, repo: str, pr_number: str) -> tuple[str, str, str] | None:
-    """Query GitHub API for PR head branch info. Returns (head_ref, head_repo, clone_url) or None."""
+    """Query GitHub API for PR head branch info.
+
+    Returns (head_ref, head_repo, clone_url) or None.
+    """
     try:
         result = subprocess.run(
             [
@@ -967,7 +970,7 @@ def _format_bytes(n: int) -> str:
     return f"{n:.1f} PB"
 
 
-def _format_age(dt: "datetime | None") -> str:
+def _format_age(dt: "datetime | None") -> str:  # noqa: F821
     """Format a datetime as a human-readable age string."""
     if dt is None:
         return "-"
@@ -1042,16 +1045,23 @@ def list_bubbles(as_json, verbose, show_clean):
 
     if verbose:
         if show_clean:
-            click.echo(f"{'NAME':<30} {'STATE':<10} {'CREATED':<12} {'LAST USED':<12} {'DISK':<10} {'IPv4':<16} {'STATUS'}")
+            click.echo(
+                f"{'NAME':<30} {'STATE':<10} {'CREATED':<12} {'LAST USED':<12}"
+                f" {'DISK':<10} {'IPv4':<16} {'STATUS'}"
+            )
             click.echo("-" * 110)
         else:
-            click.echo(f"{'NAME':<30} {'STATE':<10} {'CREATED':<12} {'LAST USED':<12} {'DISK':<10} {'IPv4':<16}")
+            click.echo(
+                f"{'NAME':<30} {'STATE':<10} {'CREATED':<12} {'LAST USED':<12}"
+                f" {'DISK':<10} {'IPv4':<16}"
+            )
             click.echo("-" * 90)
         for c in containers:
             disk = _format_bytes(c.disk_usage) if c.disk_usage else "-"
             created = _format_age(c.created_at)
             used = _format_age(c.last_used_at)
-            line = f"{c.name:<30} {c.state:<10} {created:<12} {used:<12} {disk:<10} {c.ipv4 or '-':<16}"
+            ipv4 = c.ipv4 or "-"
+            line = f"{c.name:<30} {c.state:<10} {created:<12} {used:<12} {disk:<10} {ipv4:<16}"
             if show_clean:
                 cs = clean_statuses.get(c.name)
                 line += f" {cs.summary}" if cs else ""
@@ -1140,7 +1150,10 @@ def destroy(name, force):
 @main.command()
 @click.option("-n", "--dry-run", is_flag=True, help="Show what would be destroyed")
 @click.option("-f", "--force", is_flag=True, help="Skip confirmation prompt")
-@click.option("-a", "--all", "check_all", is_flag=True, help="Start stopped/frozen bubbles to check them")
+@click.option(
+    "-a", "--all", "check_all", is_flag=True,
+    help="Start stopped/frozen bubbles to check them",
+)
 @click.option("--age", type=int, default=0, help="Only clean up bubbles unused for N+ days")
 def cleanup(dry_run, force, check_all, age):
     """Destroy all clean bubbles (safe, no unsaved work)."""
@@ -1210,7 +1223,8 @@ def cleanup(dry_run, force, check_all, age):
         return
 
     if dry_run:
-        click.echo(f"\nWould destroy {len(clean_list)} clean bubble{'s' if len(clean_list) != 1 else ''}.")
+        n = len(clean_list)
+        click.echo(f"\nWould destroy {n} clean bubble{'s' if n != 1 else ''}.")
         # Re-stop clean containers that were started for checking
         for name in clean_list:
             if name in started_names:

{dev_bubble-0.2.0 → dev_bubble-0.2.1}/bubble/hooks/lean.py

@@ -7,8 +7,8 @@ from pathlib import Path
 
 import click
 
-from . import Hook
 from ..runtime.base import ContainerRuntime
+from . import Hook
 
 # Matches stable releases (v4.16.0) and release candidates (v4.16.0-rc2)
 _STABLE_OR_RC_RE = re.compile(r"^v\d+\.\d+\.\d+(-rc\d+)?$")

{dev_bubble-0.2.0 → dev_bubble-0.2.1}/bubble/images/scripts/base.sh

@@ -73,14 +73,9 @@ def main():
         s.settimeout(30)
         s.connect(sock_path)
         request = json.dumps({"target": target, "token": token})
-        s.sendall(request.encode() + b"\n")
-        s.shutdown(socket.SHUT_WR)
-        data = b""
-        while True:
-            chunk = s.recv(4096)
-            if not chunk:
-                break
-            data += chunk
+        s.sendall(request.encode())
+        # Read response (single recv — response is always < 4KB)
+        data = s.recv(4096)
         response = json.loads(data)
         print(response.get("message", ""))
         sys.exit(0 if response.get("status") == "ok" else 1)

{dev_bubble-0.2.0 → dev_bubble-0.2.1}/bubble/network.py

@@ -95,7 +95,7 @@ def _build_allowlist_script(domains: list[str]) -> str:
             resolve_domain = domain[2:]
             lines.append(f"IPS=$(getent ahostsv4 {resolve_domain} 2>/dev/null"
                          " | awk '{print $1}' | sort -u)")
-            lines.append(f'if [ -z "$IPS" ]; then')
+            lines.append('if [ -z "$IPS" ]; then')
             lines.append(f'  echo "Warning: wildcard domain {domain} did not resolve.'
                          f' Use explicit subdomains instead." >&2')
             lines.append("else")

{dev_bubble-0.2.0 → dev_bubble-0.2.1}/bubble/relay.py

@@ -28,7 +28,6 @@ import threading
 import time
 from collections import deque
 from concurrent.futures import ThreadPoolExecutor
-from pathlib import Path
 
 from .config import DATA_DIR
 from .git_store import repo_is_known
@@ -196,6 +195,10 @@ def validate_relay_target(target: str) -> tuple[str, str]:
     if target.startswith((".", "/", "~")):
         return "error", "Local paths are not allowed via relay."
 
+    # Reject targets starting with '-' to prevent CLI option injection
+    if target.startswith("-"):
+        return "error", "Invalid target."
+
     if "--path" in target:
         return "error", "The --path flag is not allowed via relay."
 
@@ -350,12 +353,20 @@ def _open_bubble(target: str, runtime_factory):
     import subprocess
 
     subprocess.Popen(
-        ["bubble", "open", "--no-clone", target],
+        ["bubble", "open", "--no-clone", "--no-interactive", target],
         stdout=subprocess.DEVNULL,
         stderr=subprocess.DEVNULL,
     )
 
 
+def _guarded_handle(semaphore, conn, rate_limiter, token_registry, runtime_factory):
+    """Wrapper that releases the handler semaphore after connection handling."""
+    try:
+        _handle_connection(conn, rate_limiter, token_registry, runtime_factory)
+    finally:
+        semaphore.release()
+
+
 def run_daemon(runtime_factory=None):
     """Run the relay daemon.
 
@@ -390,6 +401,9 @@ def run_daemon(runtime_factory=None):
     rate_limiter = RateLimiter()
     token_registry = TokenRegistry()
     executor = ThreadPoolExecutor(max_workers=MAX_CONCURRENT_HANDLERS)
+    # Pre-auth connection cap: reject new connections when all handler slots
+    # are busy. Prevents unauthenticated DoS from blocking legitimate requests.
+    handler_semaphore = threading.Semaphore(MAX_CONCURRENT_HANDLERS)
 
     logger.info("Relay daemon started on %s", listen_addr)
     print(f"Relay daemon listening on {listen_addr}")
@@ -397,7 +411,17 @@ def run_daemon(runtime_factory=None):
     try:
         while True:
             conn, _ = server.accept()
-            executor.submit(_handle_connection, conn, rate_limiter, token_registry, runtime_factory)
+            if not handler_semaphore.acquire(blocking=False):
+                # All handler slots busy — drop the connection immediately
+                try:
+                    conn.close()
+                except Exception:
+                    pass
+                continue
+            executor.submit(
+                _guarded_handle, handler_semaphore, conn,
+                rate_limiter, token_registry, runtime_factory,
+            )
     except KeyboardInterrupt:
         logger.info("Relay daemon stopped")
     finally:

{dev_bubble-0.2.0 → dev_bubble-0.2.1}/bubble/repo_registry.py

@@ -8,7 +8,7 @@ from .config import REPOS_FILE
 
 
 class RepoRegistry:
-    """Maps short repo names (e.g. 'mathlib4') to full owner/repo (e.g. 'leanprover-community/mathlib4').
+    """Maps short repo names to full owner/repo pairs.
 
     Repos are learned on first use and stored in ~/.bubble/repos.json.
     """

{dev_bubble-0.2.0 → dev_bubble-0.2.1}/dev_bubble.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dev-bubble
-Version: 0.2.0
+Version: 0.2.1
 Summary: Containerized development environments powered by Incus
 Author-email: Kim Morrison <kim@tqft.net>
 License-Expression: Apache-2.0
@@ -37,9 +37,11 @@ Containerized development environments for the Lean language, powered by [Incus]
 ## Quick Start
 
 ```bash
-# Install (use pipx or uv to avoid PEP 668 issues with system Python)
-pipx install dev-bubble    # or: uv tool install dev-bubble
-# For development:         uv pip install -e '.[dev]'
+# Install
+uv tool install git+https://github.com/kim-em/bubble.git
+
+# Also available on PyPI: uv tool install dev-bubble
+# For development: uv pip install -e '.[dev]'
 
 # Open a bubble for a GitHub PR — just paste the URL, and you get a containerized VSCode window!
 bubble https://github.com/leanprover-community/mathlib4/pull/35219

{dev_bubble-0.2.0 → dev_bubble-0.2.1}/dev_bubble.egg-info/SOURCES.txt

@@ -4,6 +4,7 @@ README.md
 pyproject.toml
 .claude/CLAUDE.md
 .github/workflows/ci.yml
+.github/workflows/publish.yml
 bubble/__init__.py
 bubble/automation.py
 bubble/clean.py

{dev_bubble-0.2.0 → dev_bubble-0.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "dev-bubble"
-version = "0.2.0"
+version = "0.2.1"
 description = "Containerized development environments powered by Incus"
 readme = "README.md"
 license = "Apache-2.0"

{dev_bubble-0.2.0 → dev_bubble-0.2.1}/tests/test_target.py

@@ -1,15 +1,12 @@
 """Tests for the target parsing module."""
 
-import os
 import subprocess
 
 import pytest
 
 from bubble.repo_registry import RepoRegistry
 from bubble.target import (
-    Target,
     TargetParseError,
-    _git_repo_info,
     _parse_github_remote,
     _parse_local_path,
     parse_target,