devlaunch 0.0.12__tar.gz → 0.0.13__tar.gz

{devlaunch-0.0.12 → devlaunch-0.0.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devlaunch
-Version: 0.0.12
+Version: 0.0.13
 Summary: DevLaunch - A streamlined CLI for devpod workspaces
 Project-URL: Source, https://github.com/blooop/devlaunch
 Project-URL: Home, https://github.com/blooop/devlaunch
@@ -75,6 +75,18 @@ dl <user/repo> <cmd>             # Run workspace command (stop, code, etc.)
 dl <user/repo> -- <command>      # Run shell command in workspace
 ```
 
+### Commands that need a terminal
+
+`dl <ws> -- <command>` gives the command a terminal whenever `dl` itself has one,
+so interactive programs — a coding agent, `htop`, `git rebase -i`, a REPL — start
+and stay up instead of exiting immediately. Redirect the output and the terminal
+goes away again, so `dl <ws> -- ls > files.txt` stays free of escape sequences.
+
+This needs the ssh host alias `devpod up` writes to `~/.ssh/config`. If a
+workspace has none, `dl` says so and falls back to the plain `devpod ssh`
+transport, which has no terminal; `dl <ws> restart` republishes the alias. Set
+`DEVLAUNCH_NO_TTY=1` to force the fallback everywhere.
+
 ## aid: start a coding agent in a workspace
 
 `aid` is `dl` with a coding agent started for you:
@@ -209,13 +221,14 @@ than the filesystem has actually done.
 | `dl <user/repo> restart` | Stop and start (no rebuild) |
 | `dl <user/repo> recreate` | Recreate container |
 | `dl <user/repo> reset` | Clean slate (remove all, recreate) |
-| `dl <user/repo> -- <command>` | Run shell command in workspace |
+| `dl <user/repo> -- <command>` | Run shell command in workspace (with a terminal, when `dl` has one) |
 
 ## Options
 
 | Option | Description |
 |--------|-------------|
 | `--devcontainer <variant\|path>` | Use a non-default `devcontainer.json`. A bare name means `.devcontainer/<name>/devcontainer.json`. Stored with the workspace, so pass it once. |
+| `DEVLAUNCH_NO_TTY=1` | Never give a workspace command a terminal; always use the plain `devpod ssh` transport. |
 
 Projects with demanding devcontainers — several variants, compose sidecars, or a
 host-side `initializeCommand` that has to tell branch workspaces apart — are

{devlaunch-0.0.12 → devlaunch-0.0.13}/README.md

@@ -53,6 +53,18 @@ dl <user/repo> <cmd>             # Run workspace command (stop, code, etc.)
 dl <user/repo> -- <command>      # Run shell command in workspace
 ```
 
+### Commands that need a terminal
+
+`dl <ws> -- <command>` gives the command a terminal whenever `dl` itself has one,
+so interactive programs — a coding agent, `htop`, `git rebase -i`, a REPL — start
+and stay up instead of exiting immediately. Redirect the output and the terminal
+goes away again, so `dl <ws> -- ls > files.txt` stays free of escape sequences.
+
+This needs the ssh host alias `devpod up` writes to `~/.ssh/config`. If a
+workspace has none, `dl` says so and falls back to the plain `devpod ssh`
+transport, which has no terminal; `dl <ws> restart` republishes the alias. Set
+`DEVLAUNCH_NO_TTY=1` to force the fallback everywhere.
+
 ## aid: start a coding agent in a workspace
 
 `aid` is `dl` with a coding agent started for you:
@@ -187,13 +199,14 @@ than the filesystem has actually done.
 | `dl <user/repo> restart` | Stop and start (no rebuild) |
 | `dl <user/repo> recreate` | Recreate container |
 | `dl <user/repo> reset` | Clean slate (remove all, recreate) |
-| `dl <user/repo> -- <command>` | Run shell command in workspace |
+| `dl <user/repo> -- <command>` | Run shell command in workspace (with a terminal, when `dl` has one) |
 
 ## Options
 
 | Option | Description |
 |--------|-------------|
 | `--devcontainer <variant\|path>` | Use a non-default `devcontainer.json`. A bare name means `.devcontainer/<name>/devcontainer.json`. Stored with the workspace, so pass it once. |
+| `DEVLAUNCH_NO_TTY=1` | Never give a workspace command a terminal; always use the plain `devpod ssh` transport. |
 
 Projects with demanding devcontainers — several variants, compose sidecars, or a
 host-side `initializeCommand` that has to tell branch workspaces apart — are

{devlaunch-0.0.12 → devlaunch-0.0.13}/devlaunch/dl.py

@@ -33,7 +33,7 @@ from dataclasses import dataclass
 from urllib.parse import urlparse
 from urllib.request import url2pathname
 
-from . import devpod_ssh, gh_auth
+from . import devpod_ssh, gh_auth, tty_session
 from .completion import install_completions
 from .workspace_id import TARGET_LENGTH, WorkspaceId, slug, source_workspace_id, validate_ref_name
 from .worktree.config import get_worktree_config
@@ -41,15 +41,27 @@ from .worktree.migration import migrate_cache
 from .worktree.workspace_clone import WorkspaceCloneManager
 
 
-class DevpodNotInstalled(Exception):
-    """The devpod binary dl shells out to is not on PATH.
+class MissingBinary(Exception):
+    """A binary dl shells out to is not on PATH.
 
     Deliberately not an OSError (FileNotFoundError is one) and not a
     RuntimeError: dl catches both broadly in a dozen places so that a flaky
     command degrades to an empty list or a "failed to prepare workspace"
     message. A missing binary reported through one of those handlers is
-    reported wrongly, so it travels as a type nothing between run_devpod and
-    main() catches, and main() is the only place that handles it.
+    reported wrongly, so it travels as a type nothing between the spawn helpers
+    and main() catches, and main() is the only place that handles it.
+    """
+
+
+class DevpodNotInstalled(MissingBinary):
+    """The devpod binary is not on PATH."""
+
+
+class SshNotInstalled(MissingBinary):
+    """OpenSSH is not on PATH, so no command can be given a terminal.
+
+    Its own type rather than DevpodNotInstalled: telling someone to install
+    devpod when devpod is present and working would send them the wrong way.
     """
 
 
@@ -62,6 +74,14 @@ DEVPOD_MISSING_MESSAGE = (
     "(pixi/conda installs of devlaunch include it; pip installs do not)."
 )
 
+# Same shape, and names the way out that does not need ssh at all: the devpod
+# transport still runs commands, it just cannot give them a terminal.
+SSH_MISSING_MESSAGE = (
+    "ssh not found on PATH: dl needs OpenSSH to give a workspace command a "
+    "terminal. Install it, or set DEVLAUNCH_NO_TTY=1 to run commands through "
+    "devpod instead (interactive programs will not work)."
+)
+
 # The shell's own "command not found" code, which says more than a bare 1 and
 # cannot be confused with a devpod command that ran and failed.
 DEVPOD_MISSING_EXIT_CODE = 127
@@ -1045,6 +1065,28 @@ def workspace_up(
     return result
 
 
+def run_ssh(args: List[str], env: Optional[Dict[str, str]] = None) -> subprocess.CompletedProcess:
+    """Run OpenSSH, dl's other way into a workspace.
+
+    Separate from run_devpod because it is a different binary with a different
+    failure mode, and because the pty transport has to be swappable in tests
+    without stubbing out every devpod call as well.
+
+    Takes the whole argv, `ssh` included, because tty_session composes a
+    complete command rather than a tail of flags -- unlike run_devpod, whose
+    callers each build up their own subcommand.
+
+    Security note: list form, not shell=True, so nothing in the payload is
+    interpreted by a host shell.
+    """
+    logging.debug("Running: %s", " ".join(args))
+    try:
+        # nosec B603 B607 - list form, not shell=True; no command injection risk
+        return subprocess.run(list(args), check=False, env=env)
+    except FileNotFoundError as e:
+        raise SshNotInstalled(SSH_MISSING_MESSAGE) from e
+
+
 def workspace_ssh(
     workspace: str,
     command: Optional[str] = None,
@@ -1052,6 +1094,17 @@ def workspace_ssh(
 ) -> int:
     """SSH into a workspace, optionally running a command.
 
+    A command runs through whichever of the two transports can give it what it
+    needs. devpod's --command never requests a pty, which is fine for `make
+    test` and fatal for anything interactive -- `claude` reads the pipe as a
+    non-interactive invocation and exits instead of starting a session. So when
+    dl is itself on a terminal, the command goes to OpenSSH through the host
+    alias devpod published, with -t (see tty_session). Otherwise, and when no
+    alias exists, it goes to devpod as before.
+
+    A bare attach is left on devpod: it already gets a pty, being the one case
+    devpod requests one for.
+
     Args:
         workspace: The workspace ID to SSH into
         command: Optional command to run (if None, starts interactive shell)
@@ -1060,19 +1113,34 @@ def workspace_ssh(
             if given a path that doesn't exist in the container, so never guess
             one from the workspace id.
     """
-    args = ["ssh", workspace]
+    # devpod runs --command under a non-login, non-interactive `bash -c`, which
+    # sources neither ~/.profile nor ~/.bashrc -- so PATH entries the image adds
+    # there (notably $HOME/.pixi/bin) are missing and the payload dies with
+    # "command not found". An interactive attach gets a login shell, so wrap
+    # here to give both paths the same PATH. dl launches arbitrary repos, so the
+    # parity has to come from the invocation rather than from any particular
+    # devcontainer.json.
+    #
+    # Built once and shared by both transports: two copies of this expression
+    # would be two chances for the transports to drift, which is the whole
+    # failure this function exists to have fixed.
+    payload = f"bash -lc {shlex.quote(command)}" if command else None
+
+    if payload is not None and tty_session.have_terminal():
+        if tty_session.devpod_host_configured(workspace):
+            return _ssh_with_terminal(workspace, payload, workdir)
+        logging.warning(
+            "No devpod ssh host entry for %s, so this command gets no terminal; "
+            "interactive programs may exit immediately. `dl %s restart` republishes it.",
+            workspace,
+            workspace,
+        )
 
+    args = ["ssh", workspace]
     if workdir:
         args.extend(["--workdir", workdir])
-    if command:
-        # devpod runs --command under a non-login, non-interactive `bash -c`,
-        # which sources neither ~/.profile nor ~/.bashrc -- so PATH entries the
-        # image adds there (notably $HOME/.pixi/bin) are missing and the payload
-        # dies with "command not found". An interactive attach gets a login
-        # shell, so wrap here to give both paths the same PATH. dl launches
-        # arbitrary repos, so the parity has to come from the invocation rather
-        # than from any particular devcontainer.json.
-        args.extend(["--command", f"bash -lc {shlex.quote(command)}"])
+    if payload is not None:
+        args.extend(["--command", payload])
 
     # Attaching to a running workspace skips workspace_up, so the gh login has
     # to be offered here too. Only the variable name lands in args; the token
@@ -1097,6 +1165,20 @@ def workspace_ssh(
             devpod_ssh.assert_never(unhandled)
 
 
+def _ssh_with_terminal(workspace: str, payload: str, workdir: Optional[str]) -> int:
+    """Run an already-wrapped payload under a pty via OpenSSH.
+
+    No devpod_ssh.SshOutcome here, and nothing to recover: OpenSSH exits with
+    the remote program's own status, which is the thing devpod loses by wrapping
+    its *ssh.ExitError three times before type-asserting on it. This transport
+    never had that bug, so it needs none of the machinery that works around it.
+    """
+    env_names, env = gh_auth.openssh_env_names_and_env()
+    args = tty_session.ssh_command_args(workspace, payload, send_env=env_names, workdir=workdir)
+    logging.info("SSH command: %s", " ".join(args))
+    return run_ssh(args, env=env).returncode
+
+
 def attach_workspace(workspace_id: str, shell_command: Optional[str] = None) -> int:
     """Hand the workspace to the user: name its prompt, then ssh in.
 
@@ -1299,7 +1381,7 @@ def main(argv: Optional[List[str]] = None) -> int:
     invalidate_workspace_list_cache()
     try:
         return _run_cli(argv)
-    except DevpodNotInstalled as e:
+    except MissingBinary as e:
         print(e, file=sys.stderr)
         return DEVPOD_MISSING_EXIT_CODE
 

{devlaunch-0.0.12 → devlaunch-0.0.13}/devlaunch/gh_auth.py

@@ -169,3 +169,17 @@ def ssh_args_and_env() -> Tuple[List[str], Optional[Dict[str, str]]]:
     if not token:
         return [], None
     return ["--send-env", TOKEN_VAR], {**os.environ, TOKEN_VAR: token}
+
+
+def openssh_env_names_and_env() -> Tuple[List[str], Optional[Dict[str, str]]]:
+    """The same forwarding, for the OpenSSH transport that carries a terminal.
+
+    Interactive payloads reach the workspace through `ssh` rather than `devpod
+    ssh` (see tty_session), which spells the same idea `-o SendEnv=NAME`. Only
+    the names are returned here; tty_session turns them into flags, and the
+    values travel in the environment for the same reason as above.
+    """
+    token = resolve_token()
+    if not token:
+        return [], None
+    return [TOKEN_VAR], {**os.environ, TOKEN_VAR: token}

devlaunch-0.0.13/devlaunch/tty_session.py

@@ -0,0 +1,144 @@
+"""Carry a terminal into the workspace for commands that need one.
+
+`devpod ssh --command` never asks its ssh session for a pty. It requests one
+only for a bare interactive attach, so anything started through --command runs
+with stdin, stdout and stderr on pipes and TERM=dumb, and there is no devpod
+flag that forces the matter.
+
+One-shot commands don't care. Interactive ones do, and they don't fail in a way
+that looks like a missing terminal: `claude` reads the pipe as "invoked
+non-interactively", switches to --print mode, and exits -- so `aid <repo>`
+returned to the shell instead of leaving a session behind, and `dl <ws> --
+claude 'fix it'` printed one answer and stopped.
+
+devpod already publishes the way out. Every `devpod up` writes an ssh host alias
+`<workspace>.devpod` into ~/.ssh/config whose ProxyCommand tunnels through
+`devpod ssh --stdio`, so OpenSSH can open the same session devpod would and, with
+-t, ask it for a pty. That gives the payload a real terminal, and gives the user
+OpenSSH's terminal handling -- raw mode, window size, SIGWINCH -- which is what a
+TUI needs and what a hand-rolled pty proxy in dl would have to reimplement.
+
+This module only decides and composes; dl.workspace_ssh does the spawning. The
+decision is deliberately the one ssh itself makes: use a terminal when there is
+a terminal to use. A redirected `dl <ws> -- ls > out.txt` keeps the old
+transport and so keeps its output free of escape sequences.
+"""
+
+from __future__ import annotations
+
+import os
+import pathlib
+import shlex
+import sys
+from typing import Any, Iterable, List, Optional
+
+# Where devpod writes its host aliases. A module-level path rather than a call
+# to Path.home() per lookup so tests can point it at a fixture.
+SSH_CONFIG_PATH = pathlib.Path.home() / ".ssh" / "config"
+
+# devpod names each alias after the workspace, and brackets the block with
+# markers it recognises again on the next `up`.
+HOST_SUFFIX = ".devpod"
+MARKER_PREFIX = "# DevPod Start "
+
+# Set this to keep every command on the devpod transport, whatever the terminal
+# says. An escape hatch for a machine where the ssh alias is stale or the
+# tunnel misbehaves, matching DEVLAUNCH_NO_GH_TOKEN in spirit.
+DISABLE_VAR = "DEVLAUNCH_NO_TTY"
+
+_FALSEY = ("", "0", "false", "no")
+
+
+def disabled() -> bool:
+    """Whether the user opted this machine out of the pty transport."""
+    return os.environ.get(DISABLE_VAR, "").strip().lower() not in _FALSEY
+
+
+def host_alias(workspace_id: str) -> str:
+    """The ssh host name devpod publishes for a workspace."""
+    return f"{workspace_id}{HOST_SUFFIX}"
+
+
+def have_terminal(stdin: Any = None, stdout: Any = None) -> bool:
+    """Whether dl was run from a terminal it can hand to the workspace.
+
+    Both directions have to be a terminal: a pty on stdout with stdin redirected
+    would give a TUI a screen it cannot receive keystrokes on, and a pty on
+    stdin with stdout redirected would fill the redirect with escape sequences.
+
+    Anything that isn't a real stream -- pytest's capture object, a closed file
+    -- counts as no terminal, because that is what it behaves like.
+    """
+    if disabled():
+        return False
+    streams = (
+        sys.stdin if stdin is None else stdin,
+        sys.stdout if stdout is None else stdout,
+    )
+    for stream in streams:
+        try:
+            if not stream.isatty():
+                return False
+        except (AttributeError, ValueError, OSError):
+            return False
+    return True
+
+
+def devpod_host_configured(workspace_id: str, config_path: Optional[pathlib.Path] = None) -> bool:
+    """Whether devpod has published an ssh alias for this workspace.
+
+    Matched on devpod's own start marker as a whole line, not as a substring:
+    workspace ids share prefixes by construction (`devlaunch-main-abcdefgh` and
+    `devlaunch-main-ijklmnop`), so a substring test would route a command at a
+    host alias belonging to a different container.
+    """
+    path = SSH_CONFIG_PATH if config_path is None else config_path
+    try:
+        text = pathlib.Path(path).read_text(encoding="utf-8", errors="replace")
+    except OSError:
+        # No config, no permission, no alias -- all mean "fall back", never
+        # "fail the launch".
+        return False
+    marker = f"{MARKER_PREFIX}{host_alias(workspace_id)}"
+    return any(line.strip() == marker for line in text.splitlines())
+
+
+def ssh_command_args(
+    workspace_id: str,
+    command: str,
+    send_env: Iterable[str] = (),
+    workdir: Optional[str] = None,
+) -> List[str]:
+    """Build the OpenSSH invocation that runs `command` under a pty.
+
+    -t is what the whole module exists for: without it ssh runs a command with
+    no terminal, which is the situation being escaped.
+
+    send_env names variables only. OpenSSH reads their values from its own
+    environment, so a forwarded token never appears in argv where `ps` would
+    show it to every other user on the host -- the same discipline gh_auth
+    applies to the devpod transport.
+
+    Raises:
+        ValueError: if the workspace id would reach ssh as an option.
+    """
+    # The alias goes in positionally, and ssh has no reliable `--`, so an id
+    # beginning with a dash would be read as a flag -- and `-o ProxyCommand=...`
+    # is arbitrary command execution on the host. devpod's own ids cannot look
+    # like that (workspace_id validates a leading word character) and neither
+    # can the ~/.ssh/config entry this is gated on, so reaching here means
+    # something upstream is already wrong: refuse rather than hand it to ssh.
+    if workspace_id.startswith("-"):
+        raise ValueError(
+            f"refusing to ssh to a workspace id that looks like an option: {workspace_id!r}"
+        )
+    args = ["ssh", "-t"]
+    for name in send_env:
+        args.extend(["-o", f"SendEnv={name}"])
+    args.append(host_alias(workspace_id))
+    # ssh has no --workdir, so a directory has to travel inside the command.
+    payload = command
+    if workdir:
+        payload = f"cd {shlex.quote(workdir)} && {command}"
+    args.append(payload)
+    return args

{devlaunch-0.0.12 → devlaunch-0.0.13}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "devlaunch"
-version = "0.0.12"
+version = "0.0.13"
 authors = [{ name = "Austin Gregg-Smith", email = "blooop@gmail.com" }]
 description = "DevLaunch - A streamlined CLI for devpod workspaces"
 readme = "README.md"
@@ -22,7 +22,12 @@ platforms = ["linux-64"]
 [tool.pixi.dependencies]
 python = ">=3.10"
 shellcheck = ">=0.10.0,<0.11"
-devpod = ">=0.8.0,<0.9"
+# Match the devpod `dl` is actually installed alongside (pixi global ships
+# 0.26.x). The pin used to be <0.9, which quietly meant the suite exercised a
+# devpod five years of releases behind the one users run -- and it hid this
+# module's bug outright: 0.8 requests a pty for `devpod ssh --command` whenever
+# stdout is a terminal, and 0.26 never does. See devlaunch/tty_session.py.
+devpod = ">=0.26.1,<0.27"
 gh = ">=2.83.0,<3.0"
 
 [tool.pixi.feature.py310.dependencies]