devlaunch 0.0.13__tar.gz → 0.0.14__tar.gz

{devlaunch-0.0.13 → devlaunch-0.0.14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devlaunch
-Version: 0.0.13
+Version: 0.0.14
 Summary: DevLaunch - A streamlined CLI for devpod workspaces
 Project-URL: Source, https://github.com/blooop/devlaunch
 Project-URL: Home, https://github.com/blooop/devlaunch
@@ -246,8 +246,9 @@ whichever answers first, and hands it to the container as `GH_TOKEN`. That reach
 any image and any container user, unlike a bind-mount of `~/.config/gh`, and it
 works whether the host keeps its token in `hosts.yml` or in a keyring. The token
 is passed to devpod through a private file and through devpod's own environment,
-never on a command line, so it does not appear in `ps`. The container still needs
-`gh` installed for the login to be of any use. Check a workspace with:
+never on a command line, so it does not appear in `ps`. `dl` installs `gh` itself
+(see [Tools in every workspace](#tools-in-every-workspace)), so the login has
+something to be spent on whatever the image ships. Check a workspace with:
 
 ```bash
 dl <workspace> -- gh auth status
@@ -278,6 +279,36 @@ that is *already running* skips that step, and the token it was given at startup
 stays in place — including one it was given before you set
 `DEVLAUNCH_NO_GH_TOKEN`. Run `dl <workspace> restart` to replace it.
 
+## Tools in every workspace
+
+`gh` and `claude` are available in every workspace `dl` opens, in every kind of
+session — an interactive `dl <workspace>`, a one-shot `dl <workspace> -- <command>`,
+and `aid`. The repo's `devcontainer.json` does not have to provide them, and most
+do not: `dl` launches arbitrary repos, so a guarantee that depended on the image
+would not be a guarantee.
+
+They are installed with `pixi global` on `devpod up`, and put on the PATH of a
+login shell through whichever of `~/.bash_profile`, `~/.bash_login` or `~/.profile`
+bash actually reads — it sources only the first of those that exists, so an image
+shipping a `~/.bash_profile` never reads `~/.profile`. A workspace that already has both is left alone —
+the check runs first, so the cost after the first launch is one round-trip and no
+network. If `pixi` is missing from the image, `dl` installs that too.
+
+An install that fails costs the workspace its tools, not its launch: `dl` logs a
+warning and hands you the session anyway.
+
+```bash
+DEVLAUNCH_NO_TOOLS=1 dl someone/repo
+```
+
+| Variable | Description |
+|----------|-------------|
+| `DEVLAUNCH_NO_TOOLS=1` | Do not install `gh` or `claude` into workspaces |
+
+Attaching to a workspace that is *already running* skips `devpod up`, and so skips
+this too. A workspace started by something other than `dl` — or created before this
+existed — picks the tools up on its next `dl <workspace> restart`.
+
 ## Global Commands
 
 | Command | Description |

{devlaunch-0.0.13 → devlaunch-0.0.14}/README.md

@@ -224,8 +224,9 @@ whichever answers first, and hands it to the container as `GH_TOKEN`. That reach
 any image and any container user, unlike a bind-mount of `~/.config/gh`, and it
 works whether the host keeps its token in `hosts.yml` or in a keyring. The token
 is passed to devpod through a private file and through devpod's own environment,
-never on a command line, so it does not appear in `ps`. The container still needs
-`gh` installed for the login to be of any use. Check a workspace with:
+never on a command line, so it does not appear in `ps`. `dl` installs `gh` itself
+(see [Tools in every workspace](#tools-in-every-workspace)), so the login has
+something to be spent on whatever the image ships. Check a workspace with:
 
 ```bash
 dl <workspace> -- gh auth status
@@ -256,6 +257,36 @@ that is *already running* skips that step, and the token it was given at startup
 stays in place — including one it was given before you set
 `DEVLAUNCH_NO_GH_TOKEN`. Run `dl <workspace> restart` to replace it.
 
+## Tools in every workspace
+
+`gh` and `claude` are available in every workspace `dl` opens, in every kind of
+session — an interactive `dl <workspace>`, a one-shot `dl <workspace> -- <command>`,
+and `aid`. The repo's `devcontainer.json` does not have to provide them, and most
+do not: `dl` launches arbitrary repos, so a guarantee that depended on the image
+would not be a guarantee.
+
+They are installed with `pixi global` on `devpod up`, and put on the PATH of a
+login shell through whichever of `~/.bash_profile`, `~/.bash_login` or `~/.profile`
+bash actually reads — it sources only the first of those that exists, so an image
+shipping a `~/.bash_profile` never reads `~/.profile`. A workspace that already has both is left alone —
+the check runs first, so the cost after the first launch is one round-trip and no
+network. If `pixi` is missing from the image, `dl` installs that too.
+
+An install that fails costs the workspace its tools, not its launch: `dl` logs a
+warning and hands you the session anyway.
+
+```bash
+DEVLAUNCH_NO_TOOLS=1 dl someone/repo
+```
+
+| Variable | Description |
+|----------|-------------|
+| `DEVLAUNCH_NO_TOOLS=1` | Do not install `gh` or `claude` into workspaces |
+
+Attaching to a workspace that is *already running* skips `devpod up`, and so skips
+this too. A workspace started by something other than `dl` — or created before this
+existed — picks the tools up on its next `dl <workspace> restart`.
+
 ## Global Commands
 
 | Command | Description |

{devlaunch-0.0.13 → devlaunch-0.0.14}/devlaunch/dl.py

@@ -33,7 +33,7 @@ from dataclasses import dataclass
 from urllib.parse import urlparse
 from urllib.request import url2pathname
 
-from . import devpod_ssh, gh_auth, tty_session
+from . import devpod_ssh, gh_auth, tools, tty_session
 from .completion import install_completions
 from .workspace_id import TARGET_LENGTH, WorkspaceId, slug, source_workspace_id, validate_ref_name
 from .worktree.config import get_worktree_config
@@ -1062,6 +1062,12 @@ def workspace_up(
     # `up` creates and starts workspaces, so any snapshot of `devpod list`
     # taken before it is now out of date.
     invalidate_workspace_list_cache()
+    # The tools a session always needs, for whatever repo this is: `up` is the
+    # one path that runs for every workspace dl opens and is already slow
+    # enough to absorb a round-trip. Only after a successful `up` -- there is
+    # no container to install into otherwise.
+    if result.returncode == 0 and identity:
+        tools.ensure_tools(identity, run_devpod)
     return result
 
 

devlaunch-0.0.14/devlaunch/tools.py

@@ -0,0 +1,219 @@
+"""Put the tools a session always needs into every workspace devlaunch opens.
+
+`gh` and `claude` are not optional extras for the way these workspaces get used:
+`dl` already forwards the host's GitHub login into every container, which is
+worth nothing when the container has no `gh` to spend it, and `aid` exists to
+run `claude` in there. Both currently arrive only when the repo's own
+devcontainer.json arranges them -- this repo does, through
+`.devcontainer/claude-code/`, which is why `claude` is present in its workspaces
+and `gh` (a project pixi dependency, reachable only as `pixi run gh`) is not.
+
+A guarantee that depends on the repo is not a guarantee. `dl` launches arbitrary
+repos, so the tools have to come from the invocation, the same argument
+gh_auth makes for the token and workspace_ssh's login shell makes for PATH.
+
+Installing them costs a devpod round-trip on `up`, which already runs for
+seconds, and nothing at all on the attach paths -- the script exits before doing
+any work when both tools are already there, and `up` is the only caller.
+
+Two consequences worth knowing:
+
+- A workspace that is already running when `dl` reaches it skips `up` entirely
+  (the fast-attach path), so it is not topped up. That covers workspaces started
+  by something other than `dl`, and ones created before this existed; both get
+  the tools on their next `dl <ws> restart` or `up`.
+- Provisioning is a convenience, so a failed install costs the workspace its
+  tools and not its launch: an install that fails is logged and the session
+  starts anyway. The exception is a devpod that has gone missing between `up`
+  and here, which dl treats as fatal everywhere else and which this does not
+  make an exception of.
+"""
+
+import logging
+import os
+import shlex
+from dataclasses import dataclass
+from typing import List, Optional, Sequence
+
+# Set this to opt a machine out of installing tools into workspaces.
+DISABLE_VAR = "DEVLAUNCH_NO_TOOLS"
+
+_FALSEY = ("", "0", "false", "no")
+
+# The claude package lives in a personal channel rather than conda-forge.
+BLOOOP_CHANNEL = "https://prefix.dev/blooop"
+
+# Which file a bash login shell will actually read. bash tries ~/.bash_profile,
+# ~/.bash_login and ~/.profile in that order and sources only the first that
+# exists, so appending to ~/.profile in an image that ships a ~/.bash_profile
+# writes to a file nothing reads.
+_PROFILE_RESOLUTION = "\n".join(
+    [
+        'if [ -f "$HOME/.bash_profile" ]; then PROFILE="$HOME/.bash_profile"',
+        'elif [ -f "$HOME/.bash_login" ]; then PROFILE="$HOME/.bash_login"',
+        'else PROFILE="$HOME/.profile"',
+        "fi",
+    ]
+)
+
+
+@dataclass(frozen=True)
+class Tool:
+    """A binary a session must be able to run, and the pixi package providing it.
+
+    `command` is what a shell has to find on PATH, which is not always the
+    package name -- `claude` ships in `claude-shim` -- so both are recorded
+    rather than one being derived from the other.
+    """
+
+    command: str
+    package: str
+    channel: Optional[str] = None
+
+    @property
+    def install_args(self) -> List[str]:
+        """The `pixi global install` arguments that provide this tool."""
+        if self.channel:
+            return ["--channel", self.channel, self.package]
+        return [self.package]
+
+
+REQUIRED_TOOLS: Sequence[Tool] = (
+    Tool(command="gh", package="gh"),
+    Tool(command="claude", package="claude-shim", channel=BLOOOP_CHANNEL),
+)
+
+
+def provisioning_disabled() -> bool:
+    """Whether the user opted this machine out of installing tools."""
+    return os.environ.get(DISABLE_VAR, "").strip().lower() not in _FALSEY
+
+
+def _install_line(tool: Tool) -> str:
+    args = " ".join(shlex.quote(arg) for arg in tool.install_args)
+    return (
+        f"if ! command -v {shlex.quote(tool.command)} >/dev/null 2>&1; then\n"
+        f'  echo "devlaunch: installing {tool.command}"\n'
+        f"  pixi global install {args} || failed=1\n"
+        f"fi"
+    )
+
+
+def provision_script(tools: Sequence[Tool] = REQUIRED_TOOLS) -> str:
+    """The shell script that makes `tools` available in a workspace.
+
+    Idempotent and cheap on the common path: every tool already on PATH is
+    skipped, so a workspace that has been provisioned before does nothing but
+    answer. It runs under a login shell (see ensure_tools), which is what puts
+    an earlier run's ~/.pixi/bin on PATH -- checked from a non-login shell every
+    tool would look missing and be reinstalled on every launch.
+
+    Exits 0 unless an install actually failed, so "nothing to do" and "all
+    installs worked" are the same answer to the caller.
+    """
+    all_present = " && ".join(
+        f"command -v {shlex.quote(tool.command)} >/dev/null 2>&1" for tool in tools
+    )
+    installs = "\n".join(_install_line(tool) for tool in tools)
+    # The trampoline pixi writes into ~/.pixi/bin does not work for packages
+    # that ship a shell script, which is why the env's own bin directory is
+    # added too -- the same workaround .devcontainer/claude-code/install.sh
+    # carries, for the same package.
+    profile_lines = "\n".join(
+        [
+            # bash reads exactly one of these on login, in this order, and
+            # stops at the first that exists -- so an image shipping a
+            # ~/.bash_profile means ~/.profile is never sourced at all. Writing
+            # to the wrong one leaves the tools installed and unreachable, and
+            # (since the check above is `command -v`) reinstalled from scratch
+            # on every single launch.
+            _PROFILE_RESOLUTION,
+            'grep -q "\\.pixi/bin" "$PROFILE" 2>/dev/null || '
+            'echo \'export PATH="$HOME/.pixi/bin:$PATH"\' >> "$PROFILE" || failed=1',
+            'grep -q "pixi/envs/claude-shim" "$PROFILE" 2>/dev/null || '
+            'echo \'[ -d "$HOME/.pixi/envs/claude-shim/bin" ] && '
+            'export PATH="$HOME/.pixi/envs/claude-shim/bin:$PATH"\' >> "$PROFILE" || failed=1',
+        ]
+    )
+    return "\n".join(
+        [
+            "set -u",
+            # Everything this script prints is progress, and progress is not
+            # the answer to anything: `dl <ws> -- cmd > file` on a workspace
+            # that needs provisioning must put the command's output in the
+            # file and nothing else. pixi writes to stdout too, so redirect
+            # once here rather than per line.
+            "exec >&2",
+            "failed=0",
+            # Everything already there: leave without touching pixi, the
+            # profile, or the network. Every launch after the first takes this.
+            f"if {all_present}; then exit 0; fi",
+            _pixi_bootstrap(),
+            installs,
+            profile_lines,
+            'exit "$failed"',
+        ]
+    )
+
+
+def _pixi_bootstrap() -> str:
+    """Install pixi if the image has none, since every tool here comes from it.
+
+    An arbitrary repo's container is not required to carry pixi, and without it
+    the guarantee this module makes would hold only for images that happen to
+    have it. Failure is left to the install steps to report: they will fail for
+    a reason the log can name.
+    """
+    return "\n".join(
+        [
+            "if ! command -v pixi >/dev/null 2>&1; then",
+            '  echo "devlaunch: installing pixi"',
+            "  curl -fsSL https://pixi.sh/install.sh | bash >/dev/null 2>&1 || true",
+            '  export PATH="$HOME/.pixi/bin:$PATH"',
+            "fi",
+        ]
+    )
+
+
+def ensure_tools(workspace: str, runner, tools: Sequence[Tool] = REQUIRED_TOOLS) -> bool:
+    """Make `tools` available in `workspace`. Returns whether they now are.
+
+    `runner` is dl.run_devpod, passed in rather than imported to keep this
+    module off dl's import cycle and testable without a devpod.
+
+    The payload goes through `bash -lc` for the same reason workspace_ssh wraps
+    its own: devpod runs --command under a shell that sources no profile, so
+    PATH would be missing the pixi directory this module itself installs into.
+
+    Output is not captured. A cold install downloads pixi and two packages and
+    takes tens of seconds, which with nothing on the terminal reads as a hung
+    `dl`; the script's own progress lines are the answer to that, and they are
+    worth nothing in a buffer. A workspace that needs no work stays silent
+    because the script prints nothing on that path.
+
+    Not every failure is swallowed: DevpodNotInstalled is deliberately not an
+    OSError (see dl.DevpodNotInstalled) so that it is never mistaken for a
+    failure of the thing being attempted, and it keeps that meaning here.
+    """
+    if provisioning_disabled():
+        logging.debug("%s is set; not installing tools into %s", DISABLE_VAR, workspace)
+        return False
+
+    script = provision_script(tools)
+    command = f"bash -lc {shlex.quote(script)}"
+    try:
+        result = runner(["ssh", workspace, "--command", command])
+    except OSError as e:
+        logging.debug("Could not install tools into %s: %s", workspace, e)
+        return False
+
+    if result.returncode != 0:
+        # Named, not raised: the workspace is up and the user asked for a
+        # session, not for an install.
+        logging.warning(
+            "Could not install %s into %s; the session will start without them.",
+            " and ".join(tool.command for tool in tools),
+            workspace,
+        )
+        return False
+    return True

{devlaunch-0.0.13 → devlaunch-0.0.14}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "devlaunch"
-version = "0.0.13"
+version = "0.0.14"
 authors = [{ name = "Austin Gregg-Smith", email = "blooop@gmail.com" }]
 description = "DevLaunch - A streamlined CLI for devpod workspaces"
 readme = "README.md"