elsewindow 0.1.0__tar.gz → 0.2.0__tar.gz

elsewindow-0.2.0/.version

@@ -0,0 +1 @@
+0.2.0

elsewindow-0.2.0/CHANGELOG.md

@@ -0,0 +1,115 @@
+<!-- Copyright (c) 2026 kogeler. SPDX-License-Identifier: MIT. -->
+
+# Changelog
+
+All notable changes to Elsewindow are documented here.
+
+## Unreleased
+
+## [0.2.0] - 2026-09-05
+
+### Added
+
+- Enabled remote application notifications by default, with a private owned
+  foreground D-Bus session per application session and no Xpra D-Bus control.
+- Added a separate system-Python Xpra environment with hash-locked matching
+  PyOpenGL and accelerator additions. `make runtime-venv` prepares both local
+  environments; installed and standalone commands provide `--prepare-xpra`.
+  All local Xpra commands use the prepared interpreter, while ordinary startup
+  validates current inputs and installed bytes without installing anything.
+- Bundled Xpra setup resources in all artifacts and shared clean setup,
+  stale-environment rejection, and repair smoke across wheel, sdist, and
+  standalone routes. Extended the existing live topology to exercise the
+  prepared client and its public zero-copy capability.
+- Support accelerator source builds when a wheel is unavailable, including
+  Linux arm64, using a hash-verified archive and separately locked temporary
+  build tools. Exercise offline native compilation in every artifact smoke.
+- Added synchronized `--log-level` control for Elsewindow and Xpra logs on both
+  hosts, with `warning` by default, host-local journald records in ordinary and
+  persistent sessions, and matching local stdout/stderr output.
+- Added targeted diagnostics with `--log-level=debug-clipboard` and general
+  diagnostics with `--log-level=debug`. Both modes warn that system journals
+  may contain sensitive data.
+- Preserved local Xpra probe diagnostics in the journal, including failures
+  before SSH authentication, and added side/session/source-process metadata.
+- Extended the existing live topology to verify real journals on both hosts,
+  identical local terminal output, and unchanged ordinary/persistent cleanup.
+- Aggregate four clearly labeled local/remote Elsewindow and Xpra sources in
+  the local terminal and journal. Forward new remote records through owned
+  SSH mux channels in both lifecycle modes; keep the remote journal limited
+  to remote sources, without granting journal-reading privileges or reconnecting.
+- Include one shared session ID in every log message and native journal record
+  on both hosts. Keep ordinary invocations distinct and persistent IDs stable
+  across reconnects, namespaced by remote machine and account; isolate concurrent
+  log subscribers without changing application identity or ownership.
+- Added `--persistent` sessions backed by owned transient user systemd
+  services. Repeating the same remote executable invocation path and exact
+  arguments resumes the application after client or SSH loss; exiting the
+  foreground application with any status ends the session. Ordinary
+  heartbeat-supervised sessions remain the default.
+- Added per-invocation linger checks and interactive consent to enable it for
+  the remote account, using the same owned SSH connection for any required
+  sudo prompt. Persistent sessions never reconnect or restart automatically.
+- Extended the existing release-backed live topology with real systemd,
+  linger refusal/consent, detach and client/SSH-loss recovery, cancellation,
+  repeated manual reconnects, and cleanup after successful or failed
+  application exit.
+
+### Changed
+
+- Isolated all checkout Python environments by an application-specific hash of
+  the OS machine ID and local UID, shared by Make and the repository launcher.
+  Installed and standalone Xpra defaults use the same host isolation for shared
+  data directories. Leave legacy environments and other machines' venvs untouched.
+- Persistent resumption requires the original logging policy.
+- Consolidated all public CLI options, defaults, profiles, and restrictions
+  into one linked reference, with parser-backed documentation checks.
+- Synchronized the maintained-fork clipboard YAML blocks and assembled the
+  same reviewed policy for both peers without duplicating option values or
+  applying the fork's clipboard-test-only X11 overrides.
+- Included the persistent-session helper in wheel, source, and standalone
+  distributions, verified its packaged bytes, and exposed its source digest
+  through `--diagnose`.
+
+### Fixed
+
+- Restored ordinary GUI behavior suppressed by the minimal Xpra base: custom
+  cursors, mouse-wheel forwarding, keyboard-state synchronization, modal windows,
+  detected DPI, and client scaling initially at 1:1, without new CLI switches.
+- Routed `SIGHUP` through normal session cancellation and terminated owned
+  local SSH probe processes when their requests are cancelled.
+
+## [0.1.1] - 2026-09-04
+
+### Changed
+
+- Enabled bidirectional Xpra clipboard synchronization by default, with
+  explicit `off`, `to-server`, and `both` policies applied to both peers.
+- Synchronized the mirrored Xpra keyboard diagnostics with the current
+  maintained-fork configuration.
+- Moved all exact direct Python versions to six native
+  `requirements*.in`/`requirements*.txt` pip-compile pairs so Dependabot can
+  update each complete graph instead of treating `pyproject.toml` as a plain
+  requirements manifest.
+- Aligned both local lock resolver stages with Dependabot's pip and pip-tools
+  pair, and made published runtime metadata derive from `requirements.in`
+  without a second version authority.
+- Made an exact existing release suppress the reusable release CI and both
+  publication jobs, while ordinary CI accepts maintenance at an already
+  published version and authenticates installer acceptance API requests.
+- Added trusted-base PR metadata automation that mirrors a populated
+  `Unreleased` section without requiring a version change, preserving manual
+  PR text while release-worthy changes accumulate across merges.
+
+## [0.1.0] - 2026-08-30
+
+### Added
+
+- Established Elsewindow as an independent Linux project with one public
+  distribution, import package, command, and repository identity.
+- Preserved the one-authentication OpenSSH lifecycle, mux-only Xpra channels,
+  heartbeat-supervised remote process group, and selective cleanup behavior.
+- Shipped reviewed Xpra command and network profiles as package data and kept
+  release-backed package installation and container acceptance tooling.
+- Added CPython 3.13 and 3.14 governance, deterministic Python distributions,
+  Linux standalone artifacts, and fail-closed publication policy.

{elsewindow-0.1.0 → elsewindow-0.2.0}/MANIFEST.in

@@ -4,7 +4,12 @@ include LICENSE
 include MANIFEST.in
 include README.md
 include pyproject.toml
+include requirements.in
 recursive-include elsewindow *.py *.yml py.typed
+include elsewindow/requirements-xpra.in
+include elsewindow/requirements-xpra.txt
+include elsewindow/requirements-xpra-build.in
+include elsewindow/requirements-xpra-build.txt
 prune .github
 prune bin
 prune containers

{elsewindow-0.1.0 → elsewindow-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: elsewindow
-Version: 0.1.0
+Version: 0.2.0
 Summary: Run one remote Linux GUI application through Xpra over one owned OpenSSH master
 Author: kogeler
 Maintainer: kogeler
@@ -26,25 +26,6 @@ Requires-Python: <3.15,>=3.13
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: ssh-wrapper==0.1.0
-Provides-Extra: quality
-Requires-Dist: bandit[toml]==1.9.4; extra == "quality"
-Requires-Dist: mypy==2.3.1; extra == "quality"
-Requires-Dist: pip-audit==2.10.1; extra == "quality"
-Requires-Dist: pip-licenses==5.5.5; extra == "quality"
-Requires-Dist: ruff==0.16.5; extra == "quality"
-Provides-Extra: test
-Requires-Dist: pytest==9.1.1; extra == "test"
-Requires-Dist: pytest-asyncio==1.4.0; extra == "test"
-Requires-Dist: pytest-cov==7.1.0; extra == "test"
-Requires-Dist: pytest-xdist==3.8.0; extra == "test"
-Provides-Extra: package
-Requires-Dist: build==1.6.0; extra == "package"
-Requires-Dist: setuptools==84.0.0; extra == "package"
-Requires-Dist: wheel==0.48.0; extra == "package"
-Provides-Extra: standalone
-Requires-Dist: pyinstaller==6.22.2; extra == "standalone"
-Provides-Extra: docs
-Requires-Dist: mkdocs-material==9.7.7; extra == "docs"
 Dynamic: license-file
 
 # Elsewindow
@@ -56,17 +37,19 @@ cleans only the server, application process group, sockets, and runtime state
 created by that invocation.
 
 The application renders through the remote Wayland compositor and remote GPU.
-Only Xpra picture, input, and control traffic crosses SSH.
+Only Xpra picture, input, clipboard, and control traffic crosses SSH.
 
 ## Install And Run
 
 The Python distribution requires Linux, CPython 3.13 or 3.14, OpenSSH,
-`false`, a local graphical session, and compatible Xpra packages on both
-systems. Install with pip or pipx after the first release:
+`false`, a local graphical session, and compatible Xpra packages and an
+accessible system journal on both systems. Install with pip or pipx after the
+first release:
 
 ```bash
-python3.14 -m pip install "elsewindow==0.1.0"
-# or: pipx install "elsewindow==0.1.0"
+python3.14 -m pip install "elsewindow==0.2.0"
+# or: pipx install "elsewindow==0.2.0"
+elsewindow --prepare-xpra
 elsewindow --ssh-alias agents-a -- xterm
 ```
 
@@ -87,6 +70,15 @@ make runtime-venv
 ./bin/elsewindow --help
 ```
 
+This one make target prepares the isolated Elsewindow runtime and a separate
+system-Python venv for local Xpra. The latter keeps GTK and native Xpra modules
+in their system packages while installing a hash-locked matching PyOpenGL and
+accelerator pair. Session startup never invokes pip or changes system packages.
+Both environments are selected automatically beneath `.venvs/<machine-user-key>/`,
+so each machine prepares its own Python and native additions in a shared checkout.
+See [checkout setup](doc/getting-started.md#prepare-a-source-checkout) for migration
+and system-command behavior.
+
 Use a direct authority when an OpenSSH alias is not appropriate:
 
 ```bash
@@ -97,10 +89,12 @@ elsewindow \
   -- /opt/application/bin/application
 ```
 
-The default encoding and network profiles are `rgb` and `gigabit_lan`.
-Production arguments come exclusively from the reviewed YAML mirrors shipped
-inside the Python package. See [the Xpra guide](doc/xpra.md) for profile,
-hardware, application, and lifecycle details.
+See the [CLI reference](doc/cli.md) for every option, default, and allowed
+value, including encoding/network profiles, clipboard policy, logging, and
+persistence. Reviewed profile arguments come from the packaged YAML mirrors.
+The [Xpra guide](doc/xpra.md) covers hardware, application, and lifecycle
+behavior; the [security model](doc/security.md) explains clipboard and logging
+trust boundaries.
 
 ## Installing The Maintained Xpra Build
 
@@ -138,17 +132,22 @@ APT transaction.
 After the first release, GitHub Releases provide `elsewindow-linux-amd64` and
 `elsewindow-linux-arm64`. These native one-file ELF executables bundle
 Elsewindow, CPython, `ssh-wrapper`, version metadata, and the reviewed YAML
-profiles. They do not bundle OpenSSH, Xpra, Podman, GPU drivers, VA-API, or
+profiles, and the local Xpra setup code and dependency lock. They do not bundle
+OpenSSH, Xpra, Podman, GPU drivers, VA-API, or
 distribution packages. Verify the release's `SHA256SUMS.txt`, make the selected
-file executable, and run `./elsewindow-linux-amd64 --diagnose` (or the arm64
-equivalent) before starting a session.
+file executable, run `./elsewindow-linux-amd64 --prepare-xpra`, then
+`./elsewindow-linux-amd64 --diagnose` (or the arm64 equivalents) before starting
+a session. Preparation uses the system Xpra Python, not the bundled interpreter,
+and needs neither a checkout nor GNU Make. See the
+[setup reference](doc/cli.md#prepare-xpra) for prerequisites and storage.
 
 ## Documentation
 
 - [Rendered documentation site](https://kogeler.github.io/elsewindow/)
   (published by the first reviewed direct `main` push)
 - [Getting started](doc/getting-started.md)
-- [Complete Xpra behavior and options](doc/xpra.md)
+- [Complete CLI reference](doc/cli.md)
+- [Xpra behavior and lifecycle](doc/xpra.md)
 - [Security model](doc/security.md)
 - [Architecture](doc/architecture.md)
 - [Development and validation](doc/development.md)
@@ -164,13 +163,20 @@ file, and advertised `llms.txt` route without network access.
 ## Automatic Live Validation
 
 `make live-test` resolves the newest fork release, builds checksum-bound Ubuntu
-target and Debian client images, and runs detach and abrupt-master-loss cases
+target and Debian client images, and runs ordinary and persistent lifecycle cases
 on a private rootless Podman network. The payload excludes `elsewindow/` source
 and clean-installs the already verified wheel. The harness generates a fresh
-Ed25519 key, performs exactly one authentication per case, verifies a visible
+Ed25519 key, performs exactly one authentication per invocation, verifies a visible
 window and picture updates through the production profile assembler, preserves
 an unrelated session, and removes only its labelled containers and network.
 All wheel, test, and key material enters through validated tar streams; the
 test uses no host bind, data volume, or copy channel.
 
+Persistent cases exercise real systemd user services, linger consent, resumption
+after client/SSH loss, stable application identity and cleanup on application
+exit. The same matrix checks all four local/remote log sources in the local
+journal and terminal, and only remote sources in the server journal, at the
+selected log level. Enable this opt-in mode with
+`--persistent`; see the [CLI reference](doc/cli.md#persistent).
+
 Released under the [MIT License](LICENSE).

{elsewindow-0.1.0 → elsewindow-0.2.0}/README.md

@@ -7,17 +7,19 @@ cleans only the server, application process group, sockets, and runtime state
 created by that invocation.
 
 The application renders through the remote Wayland compositor and remote GPU.
-Only Xpra picture, input, and control traffic crosses SSH.
+Only Xpra picture, input, clipboard, and control traffic crosses SSH.
 
 ## Install And Run
 
 The Python distribution requires Linux, CPython 3.13 or 3.14, OpenSSH,
-`false`, a local graphical session, and compatible Xpra packages on both
-systems. Install with pip or pipx after the first release:
+`false`, a local graphical session, and compatible Xpra packages and an
+accessible system journal on both systems. Install with pip or pipx after the
+first release:
 
 ```bash
-python3.14 -m pip install "elsewindow==0.1.0"
-# or: pipx install "elsewindow==0.1.0"
+python3.14 -m pip install "elsewindow==0.2.0"
+# or: pipx install "elsewindow==0.2.0"
+elsewindow --prepare-xpra
 elsewindow --ssh-alias agents-a -- xterm
 ```
 
@@ -38,6 +40,15 @@ make runtime-venv
 ./bin/elsewindow --help
 ```
 
+This one make target prepares the isolated Elsewindow runtime and a separate
+system-Python venv for local Xpra. The latter keeps GTK and native Xpra modules
+in their system packages while installing a hash-locked matching PyOpenGL and
+accelerator pair. Session startup never invokes pip or changes system packages.
+Both environments are selected automatically beneath `.venvs/<machine-user-key>/`,
+so each machine prepares its own Python and native additions in a shared checkout.
+See [checkout setup](doc/getting-started.md#prepare-a-source-checkout) for migration
+and system-command behavior.
+
 Use a direct authority when an OpenSSH alias is not appropriate:
 
 ```bash
@@ -48,10 +59,12 @@ elsewindow \
   -- /opt/application/bin/application
 ```
 
-The default encoding and network profiles are `rgb` and `gigabit_lan`.
-Production arguments come exclusively from the reviewed YAML mirrors shipped
-inside the Python package. See [the Xpra guide](doc/xpra.md) for profile,
-hardware, application, and lifecycle details.
+See the [CLI reference](doc/cli.md) for every option, default, and allowed
+value, including encoding/network profiles, clipboard policy, logging, and
+persistence. Reviewed profile arguments come from the packaged YAML mirrors.
+The [Xpra guide](doc/xpra.md) covers hardware, application, and lifecycle
+behavior; the [security model](doc/security.md) explains clipboard and logging
+trust boundaries.
 
 ## Installing The Maintained Xpra Build
 
@@ -89,17 +102,22 @@ APT transaction.
 After the first release, GitHub Releases provide `elsewindow-linux-amd64` and
 `elsewindow-linux-arm64`. These native one-file ELF executables bundle
 Elsewindow, CPython, `ssh-wrapper`, version metadata, and the reviewed YAML
-profiles. They do not bundle OpenSSH, Xpra, Podman, GPU drivers, VA-API, or
+profiles, and the local Xpra setup code and dependency lock. They do not bundle
+OpenSSH, Xpra, Podman, GPU drivers, VA-API, or
 distribution packages. Verify the release's `SHA256SUMS.txt`, make the selected
-file executable, and run `./elsewindow-linux-amd64 --diagnose` (or the arm64
-equivalent) before starting a session.
+file executable, run `./elsewindow-linux-amd64 --prepare-xpra`, then
+`./elsewindow-linux-amd64 --diagnose` (or the arm64 equivalents) before starting
+a session. Preparation uses the system Xpra Python, not the bundled interpreter,
+and needs neither a checkout nor GNU Make. See the
+[setup reference](doc/cli.md#prepare-xpra) for prerequisites and storage.
 
 ## Documentation
 
 - [Rendered documentation site](https://kogeler.github.io/elsewindow/)
   (published by the first reviewed direct `main` push)
 - [Getting started](doc/getting-started.md)
-- [Complete Xpra behavior and options](doc/xpra.md)
+- [Complete CLI reference](doc/cli.md)
+- [Xpra behavior and lifecycle](doc/xpra.md)
 - [Security model](doc/security.md)
 - [Architecture](doc/architecture.md)
 - [Development and validation](doc/development.md)
@@ -115,13 +133,20 @@ file, and advertised `llms.txt` route without network access.
 ## Automatic Live Validation
 
 `make live-test` resolves the newest fork release, builds checksum-bound Ubuntu
-target and Debian client images, and runs detach and abrupt-master-loss cases
+target and Debian client images, and runs ordinary and persistent lifecycle cases
 on a private rootless Podman network. The payload excludes `elsewindow/` source
 and clean-installs the already verified wheel. The harness generates a fresh
-Ed25519 key, performs exactly one authentication per case, verifies a visible
+Ed25519 key, performs exactly one authentication per invocation, verifies a visible
 window and picture updates through the production profile assembler, preserves
 an unrelated session, and removes only its labelled containers and network.
 All wheel, test, and key material enters through validated tar streams; the
 test uses no host bind, data volume, or copy channel.
 
+Persistent cases exercise real systemd user services, linger consent, resumption
+after client/SSH loss, stable application identity and cleanup on application
+exit. The same matrix checks all four local/remote log sources in the local
+journal and terminal, and only remote sources in the server journal, at the
+selected log level. Enable this opt-in mode with
+`--persistent`; see the [CLI reference](doc/cli.md#persistent).
+
 Released under the [MIT License](LICENSE).