devlaunch 0.0.7__tar.gz → 0.0.8__tar.gz

{devlaunch-0.0.7 → devlaunch-0.0.8}/.gitignore

@@ -179,20 +179,8 @@ test_suite_analysis/metadata.json
 # Claude Code local settings (personal, not shared)
 .claude/settings.local.json
 
-# Ralph autonomous agent state files
-.call_count
-.circuit_breaker_history
-.circuit_breaker_state
-.exit_signals
-.last_reset
-.ralph_session
-.ralph_session_history
-.response_analysis
 .claude_session_id
-progress.json
-status.json
 logs/
-.ralph/
 
 # uv is not this project's package manager (pixi.lock is authoritative)
 uv.lock

{devlaunch-0.0.7 → devlaunch-0.0.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devlaunch
-Version: 0.0.7
+Version: 0.0.8
 Summary: DevLaunch - A streamlined CLI for devpod workspaces
 Project-URL: Source, https://github.com/blooop/devlaunch
 Project-URL: Home, https://github.com/blooop/devlaunch
@@ -33,7 +33,7 @@ A streamlined CLI for [devpod](https://devpod.sh) with intuitive autocomplete an
 [![GitHub pull-requests merged](https://badgen.net/github/merged-prs/blooop/devlaunch)](https://github.com/blooop/devlaunch/pulls?q=is%3Amerged)
 [![GitHub release](https://img.shields.io/github/release/blooop/devlaunch.svg)](https://GitHub.com/blooop/devlaunch/releases/)
 [![PyPI](https://img.shields.io/pypi/v/devlaunch)](https://pypi.org/project/devlaunch/)
-[![Conda](https://img.shields.io/badge/conda-v0.0.7-brightgreen?logo=anaconda)](https://prefix.dev/channels/blooop/packages/devlaunch)
+[![Conda](https://img.shields.io/badge/conda-v0.0.8-brightgreen?logo=anaconda)](https://prefix.dev/channels/blooop/packages/devlaunch)
 [![License](https://img.shields.io/github/license/blooop/devlaunch)](https://opensource.org/license/mit/)
 [![Python](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12%20%7C%203.13-blue)](https://www.python.org/downloads/)
 [![Pixi Badge](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/prefix-dev/pixi/main/assets/badge/v0.json)](https://pixi.sh)
@@ -55,6 +55,8 @@ pip install devlaunch
 ```
 
 Note: When using pip, you must install [devpod](https://devpod.sh/docs/getting-started/install) separately.
+If `devpod` is not on `PATH`, every command that needs it prints a single install hint on stderr and exits `127`
+(the shell's "command not found" code). `dl --help` and `dl --version` keep working without it.
 
 ### Shell Completions
 
@@ -105,6 +107,50 @@ Projects with demanding devcontainers — several variants, compose sidecars, or
 host-side `initializeCommand` that has to tell branch workspaces apart — are
 covered in [docs/devcontainer-projects.md](docs/devcontainer-projects.md).
 
+## GitHub Authentication
+
+Every workspace `dl` opens inherits the host's GitHub login, so `gh` is already
+authenticated inside the container and the devcontainer.json does not have to
+arrange anything for it. devpod forwards the ssh agent and git credentials on its
+own, but nothing else carries `gh`.
+
+devlaunch takes the token from `GH_TOKEN`, `GITHUB_TOKEN`, or `gh auth token`,
+whichever answers first, and hands it to the container as `GH_TOKEN`. That reaches
+any image and any container user, unlike a bind-mount of `~/.config/gh`, and it
+works whether the host keeps its token in `hosts.yml` or in a keyring. The token
+is passed to devpod through a private file and through devpod's own environment,
+never on a command line, so it does not appear in `ps`. The container still needs
+`gh` installed for the login to be of any use. Check a workspace with:
+
+```bash
+dl <workspace> -- gh auth status
+```
+
+### Who gets the token
+
+Everything running in the container does — including a `postCreateCommand` from a
+repo you did not write. `dl someone/repo` builds and runs that project's
+devcontainer with your GitHub token in its environment, and a `gh auth login` token
+usually carries `repo`, `workflow`, `gist` and `read:org` scopes. devpod already
+forwards the ssh agent to every workspace, so this is not a new trust boundary, but
+it is a wider one. Skip it for a repo you have not read:
+
+```bash
+DEVLAUNCH_NO_GH_TOKEN=1 dl someone/repo
+```
+
+| Variable | Description |
+|----------|-------------|
+| `DEVLAUNCH_NO_GH_TOKEN=1` | Do not forward the host's GitHub login into workspaces |
+
+### When the token changes
+
+`dl` refreshes the token on every start, so rotating it on the host is enough for
+any workspace that gets started or restarted afterwards. Attaching to a workspace
+that is *already running* skips that step, and the token it was given at startup
+stays in place — including one it was given before you set
+`DEVLAUNCH_NO_GH_TOKEN`. Run `dl <workspace> restart` to replace it.
+
 ## Global Commands
 
 | Command | Description |
@@ -163,13 +209,6 @@ Use `--warm` to prepare a workspace without attaching a shell:
 dl --warm owner/repo@branch  # Creates container in background
 ```
 
-### Backend Selection
-
-```bash
-dl --backend devpod owner/repo  # Force legacy DevPod backend
-DEVLAUNCH_BACKEND=devpod dl owner/repo  # Use environment variable
-```
-
 ## Shell Completion
 
 After running `dl --install`, you get intelligent tab completion:

{devlaunch-0.0.7 → devlaunch-0.0.8}/README.md

@@ -10,7 +10,7 @@ A streamlined CLI for [devpod](https://devpod.sh) with intuitive autocomplete an
 [![GitHub pull-requests merged](https://badgen.net/github/merged-prs/blooop/devlaunch)](https://github.com/blooop/devlaunch/pulls?q=is%3Amerged)
 [![GitHub release](https://img.shields.io/github/release/blooop/devlaunch.svg)](https://GitHub.com/blooop/devlaunch/releases/)
 [![PyPI](https://img.shields.io/pypi/v/devlaunch)](https://pypi.org/project/devlaunch/)
-[![Conda](https://img.shields.io/badge/conda-v0.0.7-brightgreen?logo=anaconda)](https://prefix.dev/channels/blooop/packages/devlaunch)
+[![Conda](https://img.shields.io/badge/conda-v0.0.8-brightgreen?logo=anaconda)](https://prefix.dev/channels/blooop/packages/devlaunch)
 [![License](https://img.shields.io/github/license/blooop/devlaunch)](https://opensource.org/license/mit/)
 [![Python](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12%20%7C%203.13-blue)](https://www.python.org/downloads/)
 [![Pixi Badge](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/prefix-dev/pixi/main/assets/badge/v0.json)](https://pixi.sh)
@@ -32,6 +32,8 @@ pip install devlaunch
 ```
 
 Note: When using pip, you must install [devpod](https://devpod.sh/docs/getting-started/install) separately.
+If `devpod` is not on `PATH`, every command that needs it prints a single install hint on stderr and exits `127`
+(the shell's "command not found" code). `dl --help` and `dl --version` keep working without it.
 
 ### Shell Completions
 
@@ -82,6 +84,50 @@ Projects with demanding devcontainers — several variants, compose sidecars, or
 host-side `initializeCommand` that has to tell branch workspaces apart — are
 covered in [docs/devcontainer-projects.md](docs/devcontainer-projects.md).
 
+## GitHub Authentication
+
+Every workspace `dl` opens inherits the host's GitHub login, so `gh` is already
+authenticated inside the container and the devcontainer.json does not have to
+arrange anything for it. devpod forwards the ssh agent and git credentials on its
+own, but nothing else carries `gh`.
+
+devlaunch takes the token from `GH_TOKEN`, `GITHUB_TOKEN`, or `gh auth token`,
+whichever answers first, and hands it to the container as `GH_TOKEN`. That reaches
+any image and any container user, unlike a bind-mount of `~/.config/gh`, and it
+works whether the host keeps its token in `hosts.yml` or in a keyring. The token
+is passed to devpod through a private file and through devpod's own environment,
+never on a command line, so it does not appear in `ps`. The container still needs
+`gh` installed for the login to be of any use. Check a workspace with:
+
+```bash
+dl <workspace> -- gh auth status
+```
+
+### Who gets the token
+
+Everything running in the container does — including a `postCreateCommand` from a
+repo you did not write. `dl someone/repo` builds and runs that project's
+devcontainer with your GitHub token in its environment, and a `gh auth login` token
+usually carries `repo`, `workflow`, `gist` and `read:org` scopes. devpod already
+forwards the ssh agent to every workspace, so this is not a new trust boundary, but
+it is a wider one. Skip it for a repo you have not read:
+
+```bash
+DEVLAUNCH_NO_GH_TOKEN=1 dl someone/repo
+```
+
+| Variable | Description |
+|----------|-------------|
+| `DEVLAUNCH_NO_GH_TOKEN=1` | Do not forward the host's GitHub login into workspaces |
+
+### When the token changes
+
+`dl` refreshes the token on every start, so rotating it on the host is enough for
+any workspace that gets started or restarted afterwards. Attaching to a workspace
+that is *already running* skips that step, and the token it was given at startup
+stays in place — including one it was given before you set
+`DEVLAUNCH_NO_GH_TOKEN`. Run `dl <workspace> restart` to replace it.
+
 ## Global Commands
 
 | Command | Description |
@@ -140,13 +186,6 @@ Use `--warm` to prepare a workspace without attaching a shell:
 dl --warm owner/repo@branch  # Creates container in background
 ```
 
-### Backend Selection
-
-```bash
-dl --backend devpod owner/repo  # Force legacy DevPod backend
-DEVLAUNCH_BACKEND=devpod dl owner/repo  # Use environment variable
-```
-
 ## Shell Completion
 
 After running `dl --install`, you get intelligent tab completion:

{devlaunch-0.0.7 → devlaunch-0.0.8}/devlaunch/dl.py

@@ -29,11 +29,38 @@ from importlib.metadata import version as pkg_version, PackageNotFoundError
 from typing import List, Optional, Dict, Any
 from dataclasses import dataclass
 
+from . import gh_auth
 from .completion import install_completions
 from .worktree.config import get_worktree_config
 from .worktree.workspace_clone import WorkspaceCloneManager
 
 
+class DevpodNotInstalled(Exception):
+    """The devpod binary dl shells out to is not on PATH.
+
+    Deliberately not an OSError (FileNotFoundError is one) and not a
+    RuntimeError: dl catches both broadly in a dozen places so that a flaky
+    command degrades to an empty list or a "failed to prepare workspace"
+    message. A missing binary reported through one of those handlers is
+    reported wrongly, so it travels as a type nothing between run_devpod and
+    main() catches, and main() is the only place that handles it.
+    """
+
+
+# One line, so a completion helper that trips over it cannot spew into the
+# user's shell. It names both install routes because devpod ships with the
+# pixi/conda package and does not ship with the pip one (see README).
+DEVPOD_MISSING_MESSAGE = (
+    "devpod not found on PATH: dl cannot manage workspaces without it. "
+    "Install devpod from https://devpod.sh/docs/getting-started/install "
+    "(pixi/conda installs of devlaunch include it; pip installs do not)."
+)
+
+# The shell's own "command not found" code, which says more than a bare 1 and
+# cannot be confused with a devpod command that ran and failed.
+DEVPOD_MISSING_EXIT_CODE = 127
+
+
 def get_version() -> str:
     """Get the package version."""
     try:
@@ -560,28 +587,6 @@ def get_git_remote_url(path: str) -> Optional[str]:
     return None
 
 
-def get_git_branches(path: str) -> List[str]:
-    """Get list of branches from a git repository."""
-    try:
-        result = subprocess.run(
-            ["git", "-C", path, "branch", "-r"],
-            capture_output=True,
-            text=True,
-            check=False,
-        )
-        if result.returncode == 0:
-            branches = []
-            for line in result.stdout.strip().split("\n"):
-                line = line.strip()
-                if line and "origin/" in line and "HEAD" not in line:
-                    branch = line.replace("origin/", "")
-                    branches.append(branch)
-            return branches
-    except (OSError, subprocess.SubprocessError):
-        pass
-    return []
-
-
 def _git_ls_remote(owner_repo: str, *args: str) -> Optional[str]:
     """Run git ls-remote and return stdout, or None on error.
 
@@ -610,15 +615,6 @@ def remote_branch_exists(owner_repo: str, branch: str) -> bool:
     return bool(output)
 
 
-def get_remote_head_sha(owner_repo: str) -> Optional[str]:
-    """Get the SHA of the default branch (HEAD) of a remote repository."""
-    output = _git_ls_remote(owner_repo, "HEAD")
-    if not output:
-        return None
-    # Output format: "<sha>\tHEAD"
-    return output.strip().split()[0]
-
-
 def discover_repos_from_workspaces(workspaces: List[Workspace]) -> Dict[str, List[str]]:
     """Discover owner/repo from workspace git remotes.
 
@@ -692,20 +688,34 @@ def get_known_repos() -> List[str]:
     return result
 
 
-def run_devpod(args: List[str], capture: bool = False) -> subprocess.CompletedProcess:
+def run_devpod(
+    args: List[str], capture: bool = False, env: Optional[Dict[str, str]] = None
+) -> subprocess.CompletedProcess:
     """Run a devpod command.
 
+    env replaces devpod's whole environment when given, so a caller that wants
+    to add one variable must build it from os.environ. It exists so a secret can
+    be handed to devpod without putting it in argv, where ps would expose it.
+
     Security note: Using list form of subprocess.run (not shell=True) prevents
     command injection. Each list element is passed as a separate argument to
     the executable, so special characters are not interpreted by a shell.
+
+    This is dl's only devpod spawn, so it is also the only place that can tell
+    "devpod is not installed" from "devpod ran and failed". The former is
+    raised as DevpodNotInstalled rather than folded into a returncode: callers
+    branch on returncode and would carry on as though devpod had answered.
     """
     cmd = ["devpod"] + args
     logging.debug("Running: %s", " ".join(cmd))
-    if capture:
+    try:
+        if capture:
+            # nosec B603 - using list form, not shell=True; no command injection risk
+            return subprocess.run(cmd, capture_output=True, text=True, check=False, env=env)
         # nosec B603 - using list form, not shell=True; no command injection risk
-        return subprocess.run(cmd, capture_output=True, text=True, check=False)
-    # nosec B603 - using list form, not shell=True; no command injection risk
-    return subprocess.run(cmd, check=False)
+        return subprocess.run(cmd, check=False, env=env)
+    except FileNotFoundError as e:
+        raise DevpodNotInstalled(DEVPOD_MISSING_MESSAGE) from e
 
 
 def list_workspaces() -> List[Workspace]:
@@ -835,7 +845,11 @@ def workspace_up(
         args.extend(["--dotfiles", ctx["DOTFILES_URL"]])
     if ctx.get("DOTFILES_SCRIPT"):
         args.extend(["--dotfiles-script", ctx["DOTFILES_SCRIPT"]])
-    return run_devpod(args)
+    # Give every workspace the host's gh login, whatever its devcontainer.json
+    # does or doesn't set up for itself.
+    with gh_auth.up_args() as token_args:
+        args.extend(token_args)
+        return run_devpod(args)
 
 
 def workspace_ssh(
@@ -860,8 +874,14 @@ def workspace_ssh(
     if command:
         args.extend(["--command", command])
 
+    # Attaching to a running workspace skips workspace_up, so the gh login has
+    # to be offered here too. Only the variable name lands in args; the token
+    # travels in devpod's environment.
+    token_args, env = gh_auth.ssh_args_and_env()
+    args.extend(token_args)
+
     logging.info(f"SSH command: devpod {' '.join(args)}")
-    result = run_devpod(args)
+    result = run_devpod(args, env=env)
     return result.returncode
 
 
@@ -904,12 +924,6 @@ def workspace_delete(workspace: str) -> int:
     return result.returncode
 
 
-def workspace_status(workspace: str) -> int:
-    """Get status of a workspace."""
-    result = run_devpod(["status", workspace])
-    return result.returncode
-
-
 def get_workspace_state(workspace_id: str) -> Optional[str]:
     """Get workspace state from devpod (e.g., 'Running', 'Stopped')."""
     result = run_devpod(["status", workspace_id, "--output", "json"], capture=True)
@@ -938,6 +952,10 @@ Options:
                                      name means .devcontainer/<name>/devcontainer.json.
                                      Stored with the workspace, so pass it once.
 
+Environment:
+    DEVLAUNCH_NO_GH_TOKEN=1          Do not forward the host's gh login into
+                                     workspaces (forwarded as GH_TOKEN by default)
+
 Workspace sources:
     dl myproject                     Existing workspace by name
     dl user/repo                     Create from GitHub repo
@@ -986,7 +1004,21 @@ def _get_clone_manager() -> WorkspaceCloneManager:
 
 
 def main() -> int:
-    """Main entry point for dl CLI."""
+    """Main entry point for dl CLI.
+
+    Thin wrapper so there is exactly one handler for a missing devpod, however
+    deep in the command it was noticed. The message goes to stderr because
+    stdout is parsed by the completion machinery (--repos, --completion-data).
+    """
+    try:
+        return _run_cli()
+    except DevpodNotInstalled as e:
+        print(e, file=sys.stderr)
+        return DEVPOD_MISSING_EXIT_CODE
+
+
+def _run_cli() -> int:
+    """Dispatch a dl command line. See main() for the error handling around it."""
     try:
         args, devcontainer = extract_devcontainer_flag(sys.argv[1:])
     except ValueError as e:

devlaunch-0.0.8/devlaunch/gh_auth.py

@@ -0,0 +1,171 @@
+"""Carry the host's GitHub CLI credentials into every workspace devlaunch opens.
+
+devpod forwards the ssh agent and a git credential helper, but nothing carries
+`gh` authentication, so `gh` starts out logged out in every container — including
+the one devlaunch itself is developed in. A devcontainer.json can bind-mount
+~/.config/gh, but that only helps the projects that opted in, the mount target
+has to name the container user's home directory, and it hands over nothing at
+all when the host keeps its token in a keyring instead of hosts.yml.
+
+A token in the environment needs no cooperation from the image, the
+devcontainer.json, or the container user, so it works for whatever devlaunch is
+asked to launch. `gh` reads GH_TOKEN ahead of its own config, and `gh auth
+token` sources the token whether the host stores it in a file or a keyring.
+
+The token reaches devpod out of band — through a private file for `devpod up`
+and through devpod's own environment for `devpod ssh` — so it never sits in a
+command line that `ps` shows to every other user on the host.
+"""
+
+import contextlib
+import functools
+import logging
+import os
+import re
+import shutil
+import subprocess
+import tempfile
+from typing import Dict, Iterator, List, Optional, Tuple
+
+# The variable set inside the container. gh consults it before its config file.
+TOKEN_VAR = "GH_TOKEN"
+
+# Host variables to reuse before paying for a `gh` subprocess. Honouring
+# GH_TOKEN also means a devlaunch running inside a devlaunch workspace passes
+# its own forwarded token further down.
+HOST_TOKEN_VARS = ("GH_TOKEN", "GITHUB_TOKEN")
+
+# Set this to opt a machine out of forwarding entirely.
+DISABLE_VAR = "DEVLAUNCH_NO_GH_TOKEN"
+
+_FALSEY = ("", "0", "false", "no")
+
+# Every GitHub token form is a flat ASCII string; anything else came from a
+# broken gh install or a wrapper script that printed a message on stdout.
+_TOKEN_PATTERN = re.compile(r"\A[A-Za-z0-9_.\-]+\Z")
+
+# gh may have to unlock a keyring, so don't let it stall a workspace forever.
+_GH_TIMEOUT_SECONDS = 10
+
+
+def forwarding_disabled() -> bool:
+    """Whether the user opted this machine out of gh token forwarding."""
+    return os.environ.get(DISABLE_VAR, "").strip().lower() not in _FALSEY
+
+
+def _is_token(value: str) -> bool:
+    return bool(value) and bool(_TOKEN_PATTERN.match(value))
+
+
+def _token_from_gh_cli() -> Optional[str]:
+    """Ask the gh CLI for the host's token, or None if it has none to give."""
+    if not shutil.which("gh"):
+        return None
+    try:
+        # nosec B603 B607 - list form, not shell=True; no command injection risk
+        result = subprocess.run(
+            ["gh", "auth", "token"],
+            capture_output=True,
+            text=True,
+            check=False,
+            # gh must not eat stdin that belongs to the command `dl` was asked
+            # to run, and must not leave the terminal in a state of its own.
+            stdin=subprocess.DEVNULL,
+            timeout=_GH_TIMEOUT_SECONDS,
+        )
+    except (OSError, subprocess.SubprocessError) as e:
+        logging.debug("Could not read a GitHub token from gh: %s", e)
+        return None
+    if result.returncode != 0:
+        logging.debug("gh auth token exited %s; no GitHub auth to forward", result.returncode)
+        return None
+    # Never log the value itself, only whether it was usable.
+    if not _is_token(result.stdout.strip()):
+        logging.debug("gh auth token printed something that is not a token; ignoring it")
+        return None
+    return result.stdout.strip()
+
+
+@functools.lru_cache(maxsize=1)
+def resolve_token() -> Optional[str]:
+    """The host's GitHub token, or None if there is nothing to forward.
+
+    Cached for the life of the process: a single `dl` run can hand the token to
+    both `devpod up` and `devpod ssh`, and asking gh twice can mean unlocking a
+    keyring twice.
+    """
+    if forwarding_disabled():
+        return None
+    for var in HOST_TOKEN_VARS:
+        token = os.environ.get(var, "").strip()
+        if _is_token(token):
+            return token
+    return _token_from_gh_cli()
+
+
+def _stage_token_file(token: str) -> Optional[str]:
+    """Write the token to a file only this user can read, or None if that failed.
+
+    Forwarding a credential is a convenience, so a temp dir that is full or
+    read-only has to cost the workspace its gh login, not its launch.
+    """
+    try:
+        fd, path = tempfile.mkstemp(prefix="devlaunch-gh-", suffix=".env")
+    except OSError as e:
+        logging.debug("Could not create a file to pass the GitHub token to devpod: %s", e)
+        return None
+    try:
+        with os.fdopen(fd, "w") as handle:
+            handle.write(f"{TOKEN_VAR}={token}\n")
+    except OSError as e:
+        logging.debug("Could not write the GitHub token for devpod: %s", e)
+        with contextlib.suppress(OSError):
+            os.unlink(path)
+        return None
+    return path
+
+
+@contextlib.contextmanager
+def up_args() -> Iterator[List[str]]:
+    """Yield `devpod up` flags that put the host's token in the workspace env.
+
+    The token goes in a private file rather than on the command line because
+    `devpod up` can run for minutes while an image builds, and its argv is
+    readable by every user on the host for that whole time. --workspace-env-file
+    is a devpod flag of its own, so it adds to whatever the user has configured
+    through --workspace-env instead of displacing it.
+
+    devpod re-applies the workspace env on every `up`, so a token that has since
+    changed on the host reaches even a container that is already running. It
+    only reaches one this way, though: see ssh_args_and_env.
+    """
+    token = resolve_token()
+    path = _stage_token_file(token) if token else None
+    if not path:
+        yield []
+        return
+    try:
+        yield ["--workspace-env-file", path]
+    finally:
+        with contextlib.suppress(OSError):
+            os.unlink(path)
+
+
+def ssh_args_and_env() -> Tuple[List[str], Optional[Dict[str, str]]]:
+    """Return `devpod ssh` flags plus the environment devpod must be run with.
+
+    This covers attaching to a workspace that is already running, which skips
+    `devpod up` and its workspace env entirely. --send-env only names the
+    variable — devpod reads the value from its own environment — so the token
+    stays out of argv here too.
+
+    devpod lets a workspace env value win over --send-env, so this tops up
+    workspaces devlaunch never created rather than overriding a token that
+    `devpod up` just delivered. The flip side is that it cannot refresh one
+    either: a running workspace whose token has been revoked since it started
+    needs `dl <ws> restart` to pick up the new one.
+    """
+    token = resolve_token()
+    if not token:
+        return [], None
+    return ["--send-env", TOKEN_VAR], {**os.environ, TOKEN_VAR: token}

{devlaunch-0.0.7 → devlaunch-0.0.8}/devlaunch/worktree/branch_manager.py

@@ -186,52 +186,3 @@ class BranchManager:
         except subprocess.CalledProcessError as e:
             logger.debug(f"Failed to push branch: {e.stderr}")
             raise RuntimeError(f"Failed to push branch to remote: {e.stderr}") from e
-
-    def create_remote_branch_via_ssh(
-        self, owner: str, repo: str, branch: str, ssh_key_path: Optional[str] = None
-    ) -> bool:
-        """Create a remote branch on GitHub via SSH (legacy method from dl.py)."""
-        logger.info(f"Creating remote branch {branch} for {owner}/{repo} via SSH")
-
-        ssh_command = ["ssh"]
-        if ssh_key_path:
-            ssh_command.extend(["-i", ssh_key_path])
-
-        ssh_command.extend(["git@github.com", "create", f"{owner}/{repo}", branch])
-
-        try:
-            result = subprocess.run(
-                ssh_command, capture_output=True, text=True, timeout=10, check=False
-            )
-
-            if result.returncode == 0:
-                logger.info(f"Successfully created remote branch {branch}")
-                return True
-            # Check if branch already exists
-            if "branch already exists" in result.stderr.lower():
-                logger.info(f"Branch {branch} already exists on remote")
-                return True
-            logger.warning(f"Failed to create remote branch: {result.stderr}")
-            return False
-
-        except subprocess.TimeoutExpired:
-            logger.warning("SSH command timed out")
-            return False
-        except Exception as e:
-            logger.warning(f"Error creating remote branch via SSH: {e}")
-            return False
-
-    def checkout_branch(self, repo_path: Path, branch: str) -> None:
-        """Checkout a branch in a repository or worktree."""
-        try:
-            result = subprocess.run(
-                ["git", "checkout", branch],
-                cwd=repo_path,
-                capture_output=True,
-                text=True,
-                check=True,
-            )
-            logger.debug(f"Checkout output: {result.stdout}")
-        except subprocess.CalledProcessError as e:
-            logger.debug(f"Failed to checkout branch: {e.stderr}")
-            raise RuntimeError(f"Failed to checkout branch: {e.stderr}") from e

{devlaunch-0.0.7 → devlaunch-0.0.8}/devlaunch/worktree/config.py

@@ -6,7 +6,6 @@ from pathlib import Path
 from typing import Dict, Optional, Union
 
 import tomli
-import tomli_w
 
 
 def _get_cache_base() -> Path:
@@ -101,15 +100,6 @@ def load_config() -> Dict:
         return tomli.load(f)
 
 
-def save_config(config: Dict) -> None:
-    """Save configuration to file."""
-    config_path = get_config_path()
-    config_path.parent.mkdir(parents=True, exist_ok=True)
-
-    with open(config_path, "wb") as f:
-        tomli_w.dump(config, f)
-
-
 def get_worktree_config() -> WorktreeConfig:
     """Get worktree configuration, loading from file if exists."""
     config_data = load_config()

{devlaunch-0.0.7 → devlaunch-0.0.8}/devlaunch/worktree/models.py

@@ -1,9 +1,31 @@
 """Data models for worktree backend."""
 
-from dataclasses import asdict, dataclass, field
+from dataclasses import asdict, dataclass, field, fields
 from datetime import datetime
 from pathlib import Path
-from typing import Dict, List, Optional
+from typing import Any, Dict, List, Optional
+
+
+def unknown_fields(model: Any, data: Dict) -> List[str]:
+    """Return the keys in ``data`` that ``model`` declares no field for.
+
+    A newer devlaunch writing an extra field is the expected source. Callers use
+    this to report what a rewrite would drop; ``from_dict`` ignores those keys.
+    """
+    known = {f.name for f in fields(model)}
+    return sorted(key for key in data if key not in known)
+
+
+def _drop_unknown(model: Any, data: Dict) -> Dict:
+    """Copy ``data`` keeping only the fields ``model`` declares.
+
+    Ignoring an unrecognized field keeps the entry loadable. Rebuilding it with
+    ``cls(**data)`` instead would raise TypeError, and since one stored field is
+    shaped like every other, a single field added by a newer build would make
+    every entry unreadable at once.
+    """
+    known = {f.name for f in fields(model)}
+    return {key: value for key, value in data.items() if key in known}
 
 
 @dataclass
@@ -27,8 +49,8 @@ class BaseRepository:
 
     @classmethod
     def from_dict(cls, data: Dict) -> "BaseRepository":
-        """Create from dictionary."""
-        data = data.copy()
+        """Create from dictionary, ignoring fields this build does not declare."""
+        data = _drop_unknown(cls, data)
         data["local_path"] = Path(data["local_path"])
         if data.get("last_fetched"):
             data["last_fetched"] = datetime.fromisoformat(data["last_fetched"])
@@ -58,8 +80,8 @@ class WorktreeInfo:
 
     @classmethod
     def from_dict(cls, data: Dict) -> "WorktreeInfo":
-        """Create from dictionary."""
-        data = data.copy()
+        """Create from dictionary, ignoring fields this build does not declare."""
+        data = _drop_unknown(cls, data)
         data["local_path"] = Path(data["local_path"])
         data["created_at"] = datetime.fromisoformat(data["created_at"])
         data["last_used"] = datetime.fromisoformat(data["last_used"])

devlaunch-0.0.8/devlaunch/worktree/storage.py

@@ -0,0 +1,348 @@
+"""Storage utilities for worktree metadata."""
+
+import contextlib
+import json
+import os
+import shutil
+import stat
+import sys
+import tempfile
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Tuple
+
+from .models import BaseRepository, WorktreeInfo, unknown_fields
+
+# Version of the on-disk metadata.json format. A file without a "version" key
+# predates versioning and is treated as version 1.
+SCHEMA_VERSION = 1
+
+# Top-level keys this build writes, and therefore the only ones a rewrite keeps.
+_KNOWN_SECTIONS = frozenset({"version", "repositories", "worktrees"})
+
+# Errors raised when a single stored entry cannot be rebuilt into a model:
+# KeyError for a missing field, TypeError for an unknown/bad-typed field
+# (from_dict does cls(**data)), ValueError for an unparsable timestamp.
+_ENTRY_ERRORS = (KeyError, TypeError, ValueError)
+
+
+def _get_default_metadata_path() -> Path:
+    """Get the default metadata path, honoring XDG_CACHE_HOME."""
+    xdg_cache = os.environ.get("XDG_CACHE_HOME")
+    if xdg_cache:
+        return Path(xdg_cache) / "devlaunch" / "metadata.json"
+    return Path.home() / ".cache" / "devlaunch" / "metadata.json"
+
+
+def _warn(message: str) -> None:
+    """Emit a single warning line on stderr (stdout is parsed by completions)."""
+    print(f"dl: {message}", file=sys.stderr)
+
+
+def _file_mode(path: Path) -> Optional[int]:
+    """Return the permission bits of ``path``, or None if it does not exist."""
+    try:
+        return stat.S_IMODE(path.stat().st_mode)
+    except OSError:
+        return None
+
+
+def _resolve_link(path: Path) -> Path:
+    """Return the real file behind ``path``, following it if it is a symlink.
+
+    Only the final component is resolved. Writing atomically means renaming a
+    temp file over the target, which would replace a symlink with a regular
+    file; anyone who points metadata.json at a synced directory would silently
+    lose the link and every later write. Resolving once up front keeps every
+    file operation (write, quarantine, backup) on the real file.
+    """
+    if path.is_symlink():
+        return Path(os.path.realpath(path))
+    return path
+
+
+class MetadataStorage:
+    """Handles persistent storage of worktree metadata."""
+
+    def __init__(self, metadata_path: Optional[Path] = None):
+        """Initialize metadata storage."""
+        if metadata_path is None:
+            metadata_path = _get_default_metadata_path()
+        self.metadata_path = metadata_path
+        self.metadata_path.parent.mkdir(parents=True, exist_ok=True)
+        # Every file operation targets the real file, not a symlink pointing at it.
+        self._file_path = _resolve_link(self.metadata_path)
+        self._load()
+
+    def _quarantine(self, reason: str) -> None:
+        """Move an unusable metadata file aside so the data stays inspectable.
+
+        A single quarantine slot is used, overwritten on repeat corruption.
+        """
+        corrupt_path = self._file_path.with_name(self._file_path.name + ".corrupt")
+        try:
+            self._file_path.replace(corrupt_path)
+        except OSError as exc:
+            _warn(
+                f"{reason}; could not move it aside to {corrupt_path} ({exc}); "
+                "starting with empty metadata"
+            )
+        else:
+            _warn(f"{reason}; moved it to {corrupt_path} and started with empty metadata")
+
+    def _read_file(self) -> Optional[Dict[str, Any]]:
+        """Read and sanity-check the metadata file, quarantining it if unusable."""
+        if not self._file_path.exists():
+            return None
+        try:
+            with open(self._file_path, "r", encoding="utf-8") as f:
+                data = json.load(f)
+        # ValueError covers both json.JSONDecodeError (a ValueError subclass) and
+        # the UnicodeDecodeError that non-UTF-8 bytes raise from inside json.load.
+        except (OSError, ValueError) as exc:
+            self._quarantine(f"could not read metadata file {self._file_path} ({exc})")
+            return None
+        if not isinstance(data, dict):
+            self._quarantine(
+                f"metadata file {self._file_path} is not a JSON object "
+                f"(found {type(data).__name__})"
+            )
+            return None
+        return data
+
+    def _backup(self) -> None:
+        """Copy the on-disk file aside before a lossy rewrite can overwrite it.
+
+        This runs at load time, while the original bytes are still on disk: the
+        next mutation rewrites the file from what was loaded, so anything _load
+        could not round-trip is gone by then. A single backup slot is used,
+        overwritten on repeat, kept separate from the quarantine slot so the two
+        recovery cases cannot clobber each other.
+        """
+        backup_path = self._file_path.with_name(self._file_path.name + ".bak")
+        reason = (
+            f"rewriting {self._file_path} in this build's format will drop "
+            "information it currently holds"
+        )
+        try:
+            shutil.copy2(self._file_path, backup_path)
+        except OSError as exc:
+            _warn(f"{reason}; could not preserve the original at {backup_path} ({exc})")
+        else:
+            _warn(f"{reason}; preserved the original at {backup_path}")
+
+    def _load_section(
+        self, data: Dict[str, Any], section: str, model: Any
+    ) -> Tuple[Dict[str, Any], bool]:
+        """Rebuild one section, skipping (not discarding) individually broken entries.
+
+        Returns the loaded entries and whether anything stored was left behind --
+        an entry that could not be rebuilt at all, or one carrying a field this
+        build does not declare and so would drop on the next write.
+        """
+        entries = data.get(section, {})
+        if not isinstance(entries, dict):
+            _warn(
+                f'ignoring the "{section}" section of {self._file_path}: '
+                f"expected an object, found {type(entries).__name__}"
+            )
+            return {}, True
+
+        loaded: Dict[str, Any] = {}
+        lossy = False
+        for key, entry in entries.items():
+            if not isinstance(entry, dict):
+                lossy = True
+                _warn(
+                    f"skipping malformed {section} entry {key!r} in {self._file_path}: "
+                    f"expected an object, found {type(entry).__name__}"
+                )
+                continue
+            try:
+                loaded[key] = model.from_dict(entry)
+            except _ENTRY_ERRORS as exc:
+                lossy = True
+                _warn(f"skipping malformed {section} entry {key!r} in {self._file_path}: {exc!r}")
+                continue
+            # The entry loaded, but a field only a newer build knows about is not
+            # carried into the rebuilt model and disappears on the next write.
+            extra = unknown_fields(model, entry)
+            if extra:
+                lossy = True
+                _warn(
+                    f"{section} entry {key!r} in {self._file_path} has field(s) this build "
+                    f"does not understand ({', '.join(extra)}); they are dropped when it "
+                    "is rewritten"
+                )
+        return loaded, lossy
+
+    def _load_version(self, data: Dict[str, Any]) -> Tuple[int, bool]:
+        """Interpret the version header, returning the version and whether it is lossy."""
+        if "version" not in data:
+            # An absent version means a legacy pre-versioning file: same shape as v1.
+            return SCHEMA_VERSION, False
+
+        raw = data["version"]
+        # JSON has a single number type, so tools freely normalize 1 to 1.0; an
+        # integral number is that version. bool is an int subclass in Python, but
+        # a true/false header is nonsense rather than version 1.
+        if isinstance(raw, int) and not isinstance(raw, bool):
+            version = raw
+        elif isinstance(raw, float) and raw.is_integer():
+            version = int(raw)
+        else:
+            # The entries do not depend on the header, so never discard them over
+            # it: warn, read the file as legacy v1, and preserve the original
+            # because the rewritten header will not match what is there now.
+            _warn(
+                f'metadata file {self._file_path} has an invalid "version" header '
+                f"({raw!r}); reading it as schema version {SCHEMA_VERSION}"
+            )
+            return SCHEMA_VERSION, True
+
+        if version > SCHEMA_VERSION:
+            _warn(
+                f"{self._file_path} was written by a newer devlaunch (schema version "
+                f"{version}, this build understands {SCHEMA_VERSION}); its entries are "
+                f"loaded as-is, and the next change rewrites the whole file as schema "
+                f"version {SCHEMA_VERSION}"
+            )
+            return version, True
+
+        # A version below SCHEMA_VERSION is an older shape, upgraded on the next
+        # write; the value is exposed unchanged so a migration can branch on it.
+        return version, False
+
+    def _load(self) -> None:
+        """Load metadata from disk, never raising on damaged input."""
+        self.repositories: Dict[str, BaseRepository] = {}
+        self.worktrees: Dict[str, WorktreeInfo] = {}
+        self.schema_version: int = SCHEMA_VERSION
+
+        data = self._read_file()
+        if data is None:
+            return
+
+        self.schema_version, version_is_lossy = self._load_version(data)
+        self.repositories, repos_skipped = self._load_section(data, "repositories", BaseRepository)
+        self.worktrees, worktrees_skipped = self._load_section(data, "worktrees", WorktreeInfo)
+
+        unknown = sorted(set(data) - _KNOWN_SECTIONS)
+        if unknown:
+            _warn(
+                f"{self._file_path} has top-level key(s) this build does not understand "
+                f"({', '.join(unknown)}); they are dropped when it is rewritten"
+            )
+
+        if version_is_lossy or repos_skipped or worktrees_skipped or unknown:
+            self._backup()
+
+    def save(self) -> None:
+        """Save metadata to disk atomically.
+
+        Writes to a fresh temp file, fsyncs it, then renames it over the real
+        path, so an interrupted write can never leave a truncated metadata.json
+        behind. Write failures are deliberately not swallowed: silently losing
+        workspace metadata is worse than an error.
+        """
+        data = {
+            "version": SCHEMA_VERSION,
+            "repositories": {key: repo.to_dict() for key, repo in self.repositories.items()},
+            "worktrees": {key: worktree.to_dict() for key, worktree in self.worktrees.items()},
+        }
+
+        # mkstemp gives a name no other writer can be holding, in the same
+        # directory so the rename stays atomic, created 0600 so the contents are
+        # never briefly world-readable.
+        fd, temp_name = tempfile.mkstemp(
+            dir=self._file_path.parent, prefix=f"{self._file_path.name}.", suffix=".tmp"
+        )
+        temp_path = Path(temp_name)
+        try:
+            with os.fdopen(fd, "w", encoding="utf-8") as f:
+                json.dump(data, f, indent=2)
+                f.flush()
+                os.fsync(f.fileno())
+            # Renaming a fresh file would otherwise reset the mode to the umask
+            # default, silently widening a metadata.json the user locked down.
+            mode = _file_mode(self._file_path)
+            if mode is not None:
+                os.chmod(temp_path, mode)
+            temp_path.replace(self._file_path)
+        finally:
+            # No-op after a successful rename; cleans up a failed write.
+            with contextlib.suppress(OSError):
+                temp_path.unlink(missing_ok=True)
+
+    def add_repository(self, repo: BaseRepository) -> None:
+        """Add or update a repository."""
+        key = f"{repo.owner}/{repo.repo}"
+        self.repositories[key] = repo
+        self.save()
+
+    def get_repository(self, owner: str, repo: str) -> Optional[BaseRepository]:
+        """Get a repository by owner and name."""
+        key = f"{owner}/{repo}"
+        return self.repositories.get(key)
+
+    def list_repositories(self) -> List[BaseRepository]:
+        """List all repositories."""
+        return list(self.repositories.values())
+
+    def remove_repository(self, owner: str, repo: str) -> None:
+        """Remove a repository."""
+        key = f"{owner}/{repo}"
+        if key in self.repositories:
+            del self.repositories[key]
+            self.save()
+
+    def add_worktree(self, worktree: WorktreeInfo) -> None:
+        """Add or update a worktree."""
+        key = f"{worktree.owner}/{worktree.repo}/{worktree.branch}"
+        self.worktrees[key] = worktree
+
+        # Update repository's worktree list in memory, then write once.
+        repo = self.get_repository(worktree.owner, worktree.repo)
+        if repo and worktree.branch not in repo.worktrees:
+            repo.worktrees.append(worktree.branch)
+            self.repositories[f"{worktree.owner}/{worktree.repo}"] = repo
+
+        self.save()
+
+    def get_worktree(self, owner: str, repo: str, branch: str) -> Optional[WorktreeInfo]:
+        """Get a worktree by repository and branch."""
+        key = f"{owner}/{repo}/{branch}"
+        return self.worktrees.get(key)
+
+    def list_worktrees(
+        self, owner: Optional[str] = None, repo: Optional[str] = None
+    ) -> List[WorktreeInfo]:
+        """List worktrees, optionally filtered by repository."""
+        worktrees = list(self.worktrees.values())
+
+        if owner and repo:
+            worktrees = [w for w in worktrees if w.owner == owner and w.repo == repo]
+        elif owner:
+            worktrees = [w for w in worktrees if w.owner == owner]
+
+        return worktrees
+
+    def get_worktree_by_workspace_id(self, workspace_id: str) -> Optional[WorktreeInfo]:
+        """Look up a worktree by its DevPod workspace ID."""
+        for worktree in self.worktrees.values():
+            if worktree.workspace_id == workspace_id:
+                return worktree
+        return None
+
+    def remove_worktree(self, owner: str, repo: str, branch: str) -> None:
+        """Remove a worktree."""
+        key = f"{owner}/{repo}/{branch}"
+        if key in self.worktrees:
+            del self.worktrees[key]
+
+            # Update repository's worktree list in memory, then write once.
+            repo_obj = self.get_repository(owner, repo)
+            if repo_obj and branch in repo_obj.worktrees:
+                repo_obj.worktrees.remove(branch)
+                self.repositories[f"{owner}/{repo}"] = repo_obj
+
+            self.save()

{devlaunch-0.0.7 → devlaunch-0.0.8}/devlaunch/worktree/workspace_clone.py

@@ -214,8 +214,6 @@ class WorkspaceCloneManager:
         bare_repo_path = self.repo_manager.get_bare_path(owner, repo)
 
         ws_path = self.get_workspace_path(owner, repo, branch)
-        is_new_workspace = False
-
         is_new_workspace = False
         if not self.workspace_exists(owner, repo, branch):
             is_new_workspace = True

{devlaunch-0.0.7 → devlaunch-0.0.8}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "devlaunch"
-version = "0.0.7"
+version = "0.0.8"
 authors = [{ name = "Austin Gregg-Smith", email = "blooop@gmail.com" }]
 description = "DevLaunch - A streamlined CLI for devpod workspaces"
 readme = "README.md"

devlaunch-0.0.7/devlaunch/worktree/storage.py

@@ -1,131 +0,0 @@
-"""Storage utilities for worktree metadata."""
-
-import json
-import os
-from pathlib import Path
-from typing import Dict, List, Optional
-
-from .models import BaseRepository, WorktreeInfo
-
-
-def _get_default_metadata_path() -> Path:
-    """Get the default metadata path, honoring XDG_CACHE_HOME."""
-    xdg_cache = os.environ.get("XDG_CACHE_HOME")
-    if xdg_cache:
-        return Path(xdg_cache) / "devlaunch" / "metadata.json"
-    return Path.home() / ".cache" / "devlaunch" / "metadata.json"
-
-
-class MetadataStorage:
-    """Handles persistent storage of worktree metadata."""
-
-    def __init__(self, metadata_path: Optional[Path] = None):
-        """Initialize metadata storage."""
-        if metadata_path is None:
-            metadata_path = _get_default_metadata_path()
-        self.metadata_path = metadata_path
-        self.metadata_path.parent.mkdir(parents=True, exist_ok=True)
-        self._load()
-
-    def _load(self) -> None:
-        """Load metadata from disk."""
-        if self.metadata_path.exists():
-            with open(self.metadata_path, "r", encoding="utf-8") as f:
-                data = json.load(f)
-        else:
-            data = {"repositories": {}, "worktrees": {}}
-
-        self.repositories: Dict[str, BaseRepository] = {}
-        self.worktrees: Dict[str, WorktreeInfo] = {}
-
-        # Load repositories
-        for key, repo_data in data.get("repositories", {}).items():
-            self.repositories[key] = BaseRepository.from_dict(repo_data)
-
-        # Load worktrees
-        for key, worktree_data in data.get("worktrees", {}).items():
-            self.worktrees[key] = WorktreeInfo.from_dict(worktree_data)
-
-    def save(self) -> None:
-        """Save metadata to disk."""
-        data = {
-            "repositories": {key: repo.to_dict() for key, repo in self.repositories.items()},
-            "worktrees": {key: worktree.to_dict() for key, worktree in self.worktrees.items()},
-        }
-
-        with open(self.metadata_path, "w", encoding="utf-8") as f:
-            json.dump(data, f, indent=2)
-
-    def add_repository(self, repo: BaseRepository) -> None:
-        """Add or update a repository."""
-        key = f"{repo.owner}/{repo.repo}"
-        self.repositories[key] = repo
-        self.save()
-
-    def get_repository(self, owner: str, repo: str) -> Optional[BaseRepository]:
-        """Get a repository by owner and name."""
-        key = f"{owner}/{repo}"
-        return self.repositories.get(key)
-
-    def list_repositories(self) -> List[BaseRepository]:
-        """List all repositories."""
-        return list(self.repositories.values())
-
-    def remove_repository(self, owner: str, repo: str) -> None:
-        """Remove a repository."""
-        key = f"{owner}/{repo}"
-        if key in self.repositories:
-            del self.repositories[key]
-            self.save()
-
-    def add_worktree(self, worktree: WorktreeInfo) -> None:
-        """Add or update a worktree."""
-        key = f"{worktree.owner}/{worktree.repo}/{worktree.branch}"
-        self.worktrees[key] = worktree
-
-        # Update repository's worktree list
-        repo = self.get_repository(worktree.owner, worktree.repo)
-        if repo and worktree.branch not in repo.worktrees:
-            repo.worktrees.append(worktree.branch)
-            self.add_repository(repo)
-
-        self.save()
-
-    def get_worktree(self, owner: str, repo: str, branch: str) -> Optional[WorktreeInfo]:
-        """Get a worktree by repository and branch."""
-        key = f"{owner}/{repo}/{branch}"
-        return self.worktrees.get(key)
-
-    def list_worktrees(
-        self, owner: Optional[str] = None, repo: Optional[str] = None
-    ) -> List[WorktreeInfo]:
-        """List worktrees, optionally filtered by repository."""
-        worktrees = list(self.worktrees.values())
-
-        if owner and repo:
-            worktrees = [w for w in worktrees if w.owner == owner and w.repo == repo]
-        elif owner:
-            worktrees = [w for w in worktrees if w.owner == owner]
-
-        return worktrees
-
-    def get_worktree_by_workspace_id(self, workspace_id: str) -> Optional[WorktreeInfo]:
-        """Look up a worktree by its DevPod workspace ID."""
-        for worktree in self.worktrees.values():
-            if worktree.workspace_id == workspace_id:
-                return worktree
-        return None
-
-    def remove_worktree(self, owner: str, repo: str, branch: str) -> None:
-        """Remove a worktree."""
-        key = f"{owner}/{repo}/{branch}"
-        if key in self.worktrees:
-            del self.worktrees[key]
-
-            # Update repository's worktree list
-            repo_obj = self.get_repository(owner, repo)
-            if repo_obj and branch in repo_obj.worktrees:
-                repo_obj.worktrees.remove(branch)
-                self.add_repository(repo_obj)
-
-            self.save()