fogies 0.0.0.dev11__tar.gz → 0.0.0.dev12__tar.gz

{fogies-0.0.0.dev11 → fogies-0.0.0.dev12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fogies
-Version: 0.0.0.dev11
+Version: 0.0.0.dev12
 Summary: 
 Author: James Fogarty
 Author-email: jayfo@users.noreply.github.com
@@ -12,6 +12,7 @@ Requires-Dist: filelock (>=3.25.2,<4.0.0)
 Requires-Dist: ollama (>=0.6.2,<0.7.0)
 Requires-Dist: psutil (>=7.2.2,<8.0.0)
 Requires-Dist: pydantic (>=2.12.5,<3.0.0)
+Requires-Dist: pyrage (>=1.4.0,<2.0.0)
 Requires-Dist: requests (>=2.33.0,<2.34.0)
 Requires-Dist: tenacity (>=9.1.4,<10.0.0)
 Requires-Dist: tomlkit (>=0.15.1,<0.16.0)

{fogies-0.0.0.dev11 → fogies-0.0.0.dev12}/pyproject.toml

@@ -1,7 +1,7 @@
 [project]
 name = "fogies"
 # Version follows semantic versioning <https://semver.org/>.
-version = "0.0.0-dev.11"
+version = "0.0.0-dev.12"
 description = ""
 authors = [
     {name = "James Fogarty",email = "jayfo@users.noreply.github.com"}
@@ -18,6 +18,7 @@ include = [
     {path = "src/fogies/includes/templates/aws.toml.template", format = ["sdist", "wheel"]},
     {path = "src/fogies/includes/templates/poetry.toml.template", format = ["sdist", "wheel"]},
     {path = "src/fogies/includes/templates/backend_status.toml.template", format = ["sdist", "wheel"]},
+    {path = "src/fogies/includes/templates/claude_sync.toml.template", format = ["sdist", "wheel"]},
 ]
 
 [tool.poetry.dependencies]
@@ -33,6 +34,7 @@ pydantic = "^2.12.5"
 requests = "~2.33.0"
 tenacity = "^9.1.4"
 tomlkit = "^0.15.1"
+pyrage = "^1.4.0"
 
 [tool.poetry.group.dev.dependencies]
 # ^ allows all minor and patch releases.

fogies-0.0.0.dev12/src/fogies/age_key.py

@@ -0,0 +1,48 @@
+"""Age secret keys, which encrypt what claude-sync uploads.
+
+An age secret key is a string like AGE-SECRET-KEY-1...: see
+<https://github.com/FiloSottile/age>. pyrage, which binds to a Rust
+implementation of age, creates and checks them. It ships no type stubs, so the
+little of it that is used is given types here and nowhere else.
+"""
+
+from typing import Protocol, cast
+
+import pyrage  # pyright: ignore[reportMissingTypeStubs]
+
+
+class _IdentityFactory(Protocol):
+    """The parts of pyrage's x25519 Identity class that are used."""
+
+    def generate(self) -> object: ...
+
+    def from_str(self, value: str) -> object: ...
+
+
+_IDENTITY = cast(
+    _IdentityFactory,
+    pyrage.x25519.Identity,  # pyright: ignore[reportUnknownMemberType, reportAttributeAccessIssue]
+)
+
+_IDENTITY_ERROR = cast(
+    type[Exception],
+    pyrage.IdentityError,  # pyright: ignore[reportAttributeAccessIssue]
+)
+
+
+def generate_age_key() -> str:
+    """Return a new, random age secret key."""
+    return str(_IDENTITY.generate())
+
+
+def validate_age_key(value: str) -> str:
+    """Return value, if it is an age secret key.
+
+    Raises ValueError if it is not, including a key with a mistyped character,
+    since the checksum is checked.
+    """
+    try:
+        _ = _IDENTITY.from_str(value)
+    except _IDENTITY_ERROR as exc:
+        raise ValueError("Not an age secret key") from exc
+    return value

fogies-0.0.0.dev12/src/fogies/includes/templates/claude_sync.toml.template

@@ -0,0 +1,16 @@
+# Config for claude-sync tasks.
+# See https://github.com/tawanorg/claude-sync
+
+# Profile in the AWS config, for an IAM user that can use the bucket.
+aws_profile = "..."
+
+# S3 bucket.
+bucket = "..."
+region = "..."
+
+# What to sync: "sessions" or "full".
+scope = "sessions"
+
+# Encryption key.
+# claude-sync.configure will create, so that all machines have the same key.
+# age_key = "AGE-SECRET-KEY-1..."

{fogies-0.0.0.dev11 → fogies-0.0.0.dev12}/src/fogies/tasks/access_key.py

@@ -98,6 +98,7 @@ def get_task_create(
 ) -> Task[Callable[..., None]]:
     @task(
         name="create",
+        auto_shortflags=False,
         positional=[],
         help={
             "prompt": "Prompt for admin credentials.",
@@ -125,6 +126,7 @@ def get_task_delete(
 ) -> Task[Callable[..., None]]:
     @task(
         name="delete",
+        auto_shortflags=False,
         positional=[],
         help={
             "prompt": "Prompt for admin credentials.",
@@ -159,6 +161,7 @@ def get_task_delete_key(
 ) -> Task[Callable[..., None]]:
     @task(
         name="delete-key",
+        auto_shortflags=False,
         positional=[],
         help={
             "prompt": "Prompt for admin credentials.",
@@ -206,6 +209,7 @@ def get_task_list(
 ) -> Task[Callable[..., None]]:
     @task(
         name="list",
+        auto_shortflags=False,
         help={
             "prompt": "Prompt for admin credentials.",
         },
@@ -235,6 +239,7 @@ def get_task_rotate_key(
 ) -> Task[Callable[..., None]]:
     @task(
         name="rotate-key",
+        auto_shortflags=False,
         positional=[],
         help={
             "prompt": "Prompt for admin credentials.",

fogies-0.0.0.dev12/src/fogies/tasks/claude_sync.py

@@ -0,0 +1,145 @@
+"""Tasks for setting up and running claude-sync."""
+
+import pathlib
+from collections.abc import Callable
+from typing import cast
+
+from invoke.collection import Collection
+from invoke.context import Context
+from invoke.tasks import Task, task
+
+from fogies.tools.claude_sync import claude_sync, configure_claude_sync
+from fogies.tools.command import CommandParams
+
+
+def get_task_configure(
+    *,
+    binary_cache_path: pathlib.Path,
+    claude_sync_config_path: pathlib.Path,
+    aws_config_path: pathlib.Path,
+) -> Task[Callable[..., None]]:
+    @task(
+        name="configure",
+        auto_shortflags=False,
+        help={
+            "force": "Force overwrite based on current configuration.",
+        },
+    )  # pyright: ignore[reportUntypedFunctionDecorator]
+    def task_configure(context: Context, force: bool = False) -> None:
+        """
+        Configure claude-sync on this machine.
+        """
+        setup = configure_claude_sync(
+            claude_sync_config_path=claude_sync_config_path,
+            aws_config_path=aws_config_path,
+            force=force,
+        )
+
+        if setup.generated_age_key:
+            print("Generated encryption key.")
+        if setup.applied_to_claude_sync_files:
+            print("Applied configuration to claude-sync files.")
+        else:
+            print("Already configured.")
+
+        # Reads from the bucket and changes nothing, so this fails now, and
+        # clearly, if the credentials, bucket or key are wrong.
+        print("Checking the connection:")
+        with claude_sync(
+            binary_cache_path=binary_cache_path, raise_if_env_exists=False
+        ) as cs:
+            _ = cs.pull(command_params=CommandParams(context=context), dry_run=True)
+
+    return cast(Task[Callable[..., None]], task_configure)
+
+
+def get_task_pull(
+    *,
+    binary_cache_path: pathlib.Path,
+    default_dry_run: bool = False,
+    default_force: bool = False,
+    default_rebuild_history: bool = True,
+) -> Task[Callable[..., None]]:
+    @task(
+        name="pull",
+        auto_shortflags=False,
+        help={
+            "dry_run": "Show what would be downloaded.",
+            "force": "Force overwrite of local files.",
+            "rebuild_history": "Rebuild history from session files.",
+        },
+    )  # pyright: ignore[reportUntypedFunctionDecorator]
+    def task_pull(
+        context: Context,
+        dry_run: bool = default_dry_run,
+        force: bool = default_force,
+        rebuild_history: bool = default_rebuild_history,
+    ) -> None:
+        """
+        Download remote changes.
+        """
+        with claude_sync(
+            binary_cache_path=binary_cache_path, raise_if_env_exists=False
+        ) as cs:
+            _ = cs.pull(
+                command_params=CommandParams(context=context),
+                dry_run=dry_run,
+                force=force,
+                rebuild_history=rebuild_history,
+            )
+
+    return cast(Task[Callable[..., None]], task_pull)
+
+
+def get_task_push(*, binary_cache_path: pathlib.Path) -> Task[Callable[..., None]]:
+    @task(
+        name="push", auto_shortflags=False
+    )  # pyright: ignore[reportUntypedFunctionDecorator]
+    def task_push(context: Context) -> None:
+        """
+        Upload local changes.
+        """
+        with claude_sync(
+            binary_cache_path=binary_cache_path, raise_if_env_exists=False
+        ) as cs:
+            _ = cs.push(command_params=CommandParams(context=context))
+
+    return cast(Task[Callable[..., None]], task_push)
+
+
+def get_task_status(*, binary_cache_path: pathlib.Path) -> Task[Callable[..., None]]:
+    @task(
+        name="status", auto_shortflags=False
+    )  # pyright: ignore[reportUntypedFunctionDecorator]
+    def task_status(context: Context) -> None:
+        """
+        Show local changes since prior synchronization.
+        """
+        with claude_sync(
+            binary_cache_path=binary_cache_path, raise_if_env_exists=False
+        ) as cs:
+            _ = cs.status(command_params=CommandParams(context=context))
+
+    return cast(Task[Callable[..., None]], task_status)
+
+
+def get_collection(
+    *,
+    collection_name: str,
+    binary_cache_path: pathlib.Path,
+    claude_sync_config_path: pathlib.Path,
+    aws_config_path: pathlib.Path,
+) -> Collection:
+    """Get a collection of tasks for setting up and running claude-sync."""
+    collection = Collection(collection_name)
+    collection.add_task(
+        get_task_configure(
+            binary_cache_path=binary_cache_path,
+            claude_sync_config_path=claude_sync_config_path,
+            aws_config_path=aws_config_path,
+        )
+    )
+    collection.add_task(get_task_pull(binary_cache_path=binary_cache_path))
+    collection.add_task(get_task_push(binary_cache_path=binary_cache_path))
+    collection.add_task(get_task_status(binary_cache_path=binary_cache_path))
+    return collection

{fogies-0.0.0.dev11 → fogies-0.0.0.dev12}/src/fogies/tasks/format.py

@@ -26,7 +26,9 @@ def get_task_format(
     if not (fmt_black or fmt_isort or fmt_terraform):
         raise ValueError("At least one fmt flag must be set.")
 
-    @task(name="format")  # pyright: ignore[reportUntypedFunctionDecorator]
+    @task(
+        name="format", auto_shortflags=False
+    )  # pyright: ignore[reportUntypedFunctionDecorator]
     def task_format(context: Context) -> None:
         """
         Apply code formatting.

{fogies-0.0.0.dev11 → fogies-0.0.0.dev12}/src/fogies/tasks/lint.py

@@ -9,7 +9,9 @@ from invoke.tasks import Task, task
 
 
 def get_task_lint() -> Task[Callable[[Context], None]]:
-    @task(name="lint")  # pyright: ignore[reportUntypedFunctionDecorator]
+    @task(
+        name="lint", auto_shortflags=False
+    )  # pyright: ignore[reportUntypedFunctionDecorator]
     def task_lint(context: Context) -> None:
         """
         Run linting.

{fogies-0.0.0.dev11 → fogies-0.0.0.dev12}/src/fogies/tasks/poetry.py

@@ -14,7 +14,9 @@ from fogies.templates import ensure_from_template, poetry_toml_template_factory
 
 
 def get_task_build() -> Task[Callable[[Context], None]]:
-    @task(name="build")  # pyright: ignore[reportUntypedFunctionDecorator]
+    @task(
+        name="build", auto_shortflags=False
+    )  # pyright: ignore[reportUntypedFunctionDecorator]
     def task_build(context: Context) -> None:
         """
         Build package artifacts.
@@ -33,7 +35,9 @@ def get_task_build() -> Task[Callable[[Context], None]]:
 
 
 def get_task_publish(*, secrets_poetry_path: Path) -> Task[Callable[[Context], None]]:
-    @task(name="publish")  # pyright: ignore[reportUntypedFunctionDecorator]
+    @task(
+        name="publish", auto_shortflags=False
+    )  # pyright: ignore[reportUntypedFunctionDecorator]
     def task_publish(context: Context) -> None:
         """
         Publish package to PyPI.

{fogies-0.0.0.dev11 → fogies-0.0.0.dev12}/src/fogies/tasks/terraform.py

@@ -21,6 +21,24 @@ from fogies.tools.terraform import (
 )
 
 
+def validate_init_params(*, init: bool, init_params: InitParams) -> None:
+    """Raise ValueError for task flags that cannot be given together.
+
+    The init options only apply when init runs, and Terraform does not allow
+    migrating state while also reconfiguring the backend.
+    """
+    if init_params.migrate_state and not init:
+        raise ValueError("--init-migrate-state requires --init")
+    if init_params.reconfigure and not init:
+        raise ValueError("--init-reconfigure requires --init")
+    if init_params.upgrade and not init:
+        raise ValueError("--init-upgrade requires --init")
+    if init_params.migrate_state and init_params.reconfigure:
+        raise ValueError(
+            "--init-migrate-state and --init-reconfigure cannot be combined"
+        )
+
+
 def get_task_apply(
     *,
     binary_cache_path: pathlib.Path,
@@ -31,10 +49,11 @@ def get_task_apply(
     tfbackend_factory: TfbackendFactory | None = None,
     tfvars_factory: TfvarsFactory | None = None,
     default_init: bool = True,
-    default_init_upgrade: bool = False,
+    default_init_migrate_state: bool = False,
     default_init_reconfigure: bool = False,
+    default_init_upgrade: bool = False,
     default_apply_auto_approve: bool = False,
-) -> Task[Callable[[Context, bool, bool, bool, bool], None]]:
+) -> Task[Callable[[Context, bool, bool, bool, bool, bool], None]]:
     if backend_config is not None and tfbackend_factory is None:
         raise ValueError("tfbackend_factory is required when backend_config is set")
     if (backend_config is not None or tfbackend_factory is not None) and (
@@ -50,34 +69,34 @@ def get_task_apply(
 
     @task(
         name="apply",
+        auto_shortflags=False,
         help={
             "init": "Include terraform init. Skip with --no-init.",
-            "init_upgrade": "During init, upgrade providers.",
+            "init_migrate_state": "During init, migrate state to a changed backend.",
             "init_reconfigure": "During init, reconfigure the backend.",
+            "init_upgrade": "During init, upgrade providers.",
             "apply_auto_approve": "Skip interactive confirmation.",
         },
     )  # pyright: ignore[reportUntypedFunctionDecorator]
     def task_apply(
         context: Context,
         init: bool = default_init,
-        init_upgrade: bool = default_init_upgrade,
+        init_migrate_state: bool = default_init_migrate_state,
         init_reconfigure: bool = default_init_reconfigure,
+        init_upgrade: bool = default_init_upgrade,
         apply_auto_approve: bool = default_apply_auto_approve,
     ) -> None:
         """
         Apply a Terraform configuration.
         """
-        if init_upgrade and not init:
-            raise ValueError("--init-upgrade requires --init")
-        if init_reconfigure and not init:
-            raise ValueError("--init-reconfigure requires --init")
+        init_params = InitParams(
+            migrate_state=init_migrate_state,
+            reconfigure=init_reconfigure,
+            upgrade=init_upgrade,
+        )
+        validate_init_params(init=init, init_params=init_params)
 
         command_params = CommandParams(context=context)
-        init_params = (
-            InitParams(upgrade=init_upgrade, reconfigure=init_reconfigure)
-            if init
-            else None
-        )
 
         with ExitStack() as stack:
             aws_environ = (
@@ -113,7 +132,9 @@ def get_task_apply(
                 )
             )
 
-    return cast(Task[Callable[[Context, bool, bool, bool, bool], None]], task_apply)
+    return cast(
+        Task[Callable[[Context, bool, bool, bool, bool, bool], None]], task_apply
+    )
 
 
 def get_task_destroy(
@@ -126,10 +147,11 @@ def get_task_destroy(
     tfbackend_factory: TfbackendFactory | None = None,
     tfvars_factory: TfvarsFactory | None = None,
     default_init: bool = True,
-    default_init_upgrade: bool = False,
+    default_init_migrate_state: bool = False,
     default_init_reconfigure: bool = False,
+    default_init_upgrade: bool = False,
     default_destroy_auto_approve: bool = False,
-) -> Task[Callable[[Context, bool, bool, bool, bool], None]]:
+) -> Task[Callable[[Context, bool, bool, bool, bool, bool], None]]:
     if backend_config is not None and tfbackend_factory is None:
         raise ValueError("tfbackend_factory is required when backend_config is set")
     if (backend_config is not None or tfbackend_factory is not None) and (
@@ -145,34 +167,34 @@ def get_task_destroy(
 
     @task(
         name="destroy",
+        auto_shortflags=False,
         help={
             "init": "Include terraform init. Skip with --no-init.",
-            "init_upgrade": "During init, upgrade providers.",
+            "init_migrate_state": "During init, migrate state to a changed backend.",
             "init_reconfigure": "During init, reconfigure the backend.",
+            "init_upgrade": "During init, upgrade providers.",
             "destroy_auto_approve": "Skip interactive confirmation.",
         },
     )  # pyright: ignore[reportUntypedFunctionDecorator]
     def task_destroy(
         context: Context,
         init: bool = default_init,
-        init_upgrade: bool = default_init_upgrade,
+        init_migrate_state: bool = default_init_migrate_state,
         init_reconfigure: bool = default_init_reconfigure,
+        init_upgrade: bool = default_init_upgrade,
         destroy_auto_approve: bool = default_destroy_auto_approve,
     ) -> None:
         """
         Destroy a Terraform configuration.
         """
-        if init_upgrade and not init:
-            raise ValueError("--init-upgrade requires --init")
-        if init_reconfigure and not init:
-            raise ValueError("--init-reconfigure requires --init")
+        init_params = InitParams(
+            migrate_state=init_migrate_state,
+            reconfigure=init_reconfigure,
+            upgrade=init_upgrade,
+        )
+        validate_init_params(init=init, init_params=init_params)
 
         command_params = CommandParams(context=context)
-        init_params = (
-            InitParams(upgrade=init_upgrade, reconfigure=init_reconfigure)
-            if init
-            else None
-        )
 
         with ExitStack() as stack:
             aws_environ = (
@@ -207,7 +229,9 @@ def get_task_destroy(
                 )
             )
 
-    return cast(Task[Callable[[Context, bool, bool, bool, bool], None]], task_destroy)
+    return cast(
+        Task[Callable[[Context, bool, bool, bool, bool, bool], None]], task_destroy
+    )
 
 
 def get_collection(

{fogies-0.0.0.dev11 → fogies-0.0.0.dev12}/src/fogies/tasks/terraform_backend.py

@@ -9,6 +9,7 @@ from invoke.collection import Collection
 from invoke.context import Context
 from invoke.tasks import Task, task
 
+from fogies.tasks.terraform import validate_init_params
 from fogies.terraform.backend import BackendOutput
 from fogies.tools.aws_environ import AwsEnvironFactory
 from fogies.tools.command import CommandParams
@@ -33,40 +34,34 @@ def get_task_backend_apply(
     output_model: type[TerraformOutputModel],
     output_model_get_backend: Callable[[TerraformOutputModel], BackendOutput],
     default_init: bool = True,
-    default_init_upgrade: bool = False,
     default_init_reconfigure: bool = False,
+    default_init_upgrade: bool = False,
     default_apply_auto_approve: bool = False,
 ) -> Task[Callable[[Context, bool, bool, bool, bool], None]]:
     @task(
         name="apply",
+        auto_shortflags=False,
         help={
             "init": "Include terraform init. Skip with --no-init.",
-            "init_upgrade": "During init, upgrade providers.",
             "init_reconfigure": "During init, reconfigure the backend.",
+            "init_upgrade": "During init, upgrade providers.",
             "apply_auto_approve": "Skip interactive confirmation.",
         },
     )  # pyright: ignore[reportUntypedFunctionDecorator]
     def task_apply(
         context: Context,
         init: bool = default_init,
-        init_upgrade: bool = default_init_upgrade,
         init_reconfigure: bool = default_init_reconfigure,
+        init_upgrade: bool = default_init_upgrade,
         apply_auto_approve: bool = default_apply_auto_approve,
     ) -> None:
         """
         Apply a Terraform backend configuration, and record it as applied.
         """
-        if init_upgrade and not init:
-            raise ValueError("--init-upgrade requires --init")
-        if init_reconfigure and not init:
-            raise ValueError("--init-reconfigure requires --init")
+        init_params = InitParams(reconfigure=init_reconfigure, upgrade=init_upgrade)
+        validate_init_params(init=init, init_params=init_params)
 
         command_params = CommandParams(context=context)
-        init_params = (
-            InitParams(upgrade=init_upgrade, reconfigure=init_reconfigure)
-            if init
-            else None
-        )
 
         with ExitStack() as stack:
             if aws_environ_factory is not None:
@@ -108,24 +103,25 @@ def get_task_backend_destroy(
     output_model: type[TerraformOutputModel],
     output_model_get_backend: Callable[[TerraformOutputModel], BackendOutput],
     default_init: bool = True,
-    default_init_upgrade: bool = False,
     default_init_reconfigure: bool = False,
+    default_init_upgrade: bool = False,
     default_destroy_auto_approve: bool = False,
 ) -> Task[Callable[[Context, bool, bool, bool, bool], None]]:
     @task(
         name="destroy",
+        auto_shortflags=False,
         help={
             "init": "Include terraform init. Skip with --no-init.",
-            "init_upgrade": "During init, upgrade providers.",
             "init_reconfigure": "During init, reconfigure the backend.",
+            "init_upgrade": "During init, upgrade providers.",
             "destroy_auto_approve": "Skip interactive confirmation.",
         },
     )  # pyright: ignore[reportUntypedFunctionDecorator]
     def task_destroy(
         context: Context,
         init: bool = default_init,
-        init_upgrade: bool = default_init_upgrade,
         init_reconfigure: bool = default_init_reconfigure,
+        init_upgrade: bool = default_init_upgrade,
         destroy_auto_approve: bool = default_destroy_auto_approve,
     ) -> None:
         """
@@ -136,17 +132,10 @@ def get_task_backend_destroy(
         objects before destroying it. Refuses (raises) if any declared state
         still has resources, regardless of how this task is invoked.
         """
-        if init_upgrade and not init:
-            raise ValueError("--init-upgrade requires --init")
-        if init_reconfigure and not init:
-            raise ValueError("--init-reconfigure requires --init")
+        init_params = InitParams(reconfigure=init_reconfigure, upgrade=init_upgrade)
+        validate_init_params(init=init, init_params=init_params)
 
         command_params = CommandParams(context=context)
-        init_params = (
-            InitParams(upgrade=init_upgrade, reconfigure=init_reconfigure)
-            if init
-            else None
-        )
 
         with ExitStack() as stack:
             if aws_environ_factory is not None:

{fogies-0.0.0.dev11 → fogies-0.0.0.dev12}/src/fogies/tasks/test.py

@@ -14,7 +14,9 @@ from invoke.tasks import Task, task
 def get_task_test(
     *, tests_path: pathlib.Path | None = None
 ) -> Task[Callable[[Context], None]]:
-    @task(name="test")  # pyright: ignore[reportUntypedFunctionDecorator]
+    @task(
+        name="test", auto_shortflags=False
+    )  # pyright: ignore[reportUntypedFunctionDecorator]
     def task_test(context: Context) -> None:
         """
         Run tests.

{fogies-0.0.0.dev11 → fogies-0.0.0.dev12}/src/fogies/templates.py

@@ -56,5 +56,9 @@ def backend_status_toml_template_factory() -> str:
     return _read_template_from_resources("backend_status.toml.template")
 
 
+def claude_sync_toml_template_factory() -> str:
+    return _read_template_from_resources("claude_sync.toml.template")
+
+
 def poetry_toml_template_factory() -> str:
     return _read_template_from_resources("poetry.toml.template")

{fogies-0.0.0.dev11 → fogies-0.0.0.dev12}/src/fogies/terraform/backend.py

@@ -80,7 +80,7 @@ class BackendOutput(BaseModel):
     region: str
     state_keys: dict[str, str]
 
-    def config(self, *, state_name: str) -> BackendConfig:
+    def backend_config(self, *, state_name: str) -> BackendConfig:
         """Return connection config for one of this backend's declared states.
 
         Raises ValueError if state_name is not declared as part of the backend.
@@ -101,7 +101,7 @@ class BackendOutput(BaseModel):
         )
 
     def __getitem__(self, state_name: str) -> BackendConfig:
-        return self.config(state_name=state_name)
+        return self.backend_config(state_name=state_name)
 
 
 def backend_delete_state_objects(*, output: BackendOutput) -> None:
@@ -137,16 +137,18 @@ def backend_delete_state_objects(*, output: BackendOutput) -> None:
     )
 
 
-def backend_state_resources(*, config: BackendConfig, account_id: str) -> list[object]:
-    """Return config's resources from the backend bucket.
+def backend_state_resources(
+    *, backend_config: BackendConfig, account_id: str
+) -> list[object]:
+    """Return backend_config's resources from the backend bucket.
 
     Returns an empty list if the state's object is absent (never applied) or
     has no resources.
     """
     return _state_resources(
-        bucket_name=config.bucket_name(account_id=account_id),
-        region=config.region,
-        key=config.key,
+        bucket_name=backend_config.bucket_name(account_id=account_id),
+        region=backend_config.region,
+        key=backend_config.key,
     )
 
 

fogies-0.0.0.dev12/src/fogies/tools/claude_sync.py

@@ -0,0 +1,302 @@
+"""Tool wrapping claude-sync, built with a portable Go toolchain.
+
+See <https://github.com/tawanorg/claude-sync>. claude-sync ships no Windows
+release binary, so it's built from source here rather than downloaded
+pre-built, unlike fogies.tools.terraform. Only push/pull/status are wrapped.
+
+claude-sync's own setup wizard (`claude-sync init`) can't run unattended: for
+S3 it prompts for the credentials, region and bucket even when they are given
+as flags, and for the passphrase its encryption key can be derived from. So a
+machine is set up by writing the files claude-sync reads, from one
+gitignored config that is synced between machines like the other secrets. That
+config holds the encryption key itself, not a passphrase; see fogies.age_key.
+The credentials are not in it, but in a profile of the AWS config.
+
+The files claude-sync reads are managed only from that config, not with
+claude-sync's own commands. They are compared exactly, so changing them any
+other way makes them differ from it.
+"""
+
+import dataclasses
+import json
+import pathlib
+import tomllib
+from collections.abc import Generator
+from contextlib import contextmanager
+from typing import Literal
+
+import tomlkit
+from invoke.runners import Result
+from pydantic import BaseModel, field_validator
+
+from fogies.age_key import generate_age_key, validate_age_key
+from fogies.templates import claude_sync_toml_template_factory, ensure_from_template
+from fogies.tools.aws_environ import AwsProfile, load_aws_profile_from_config
+from fogies.tools.command import CommandParams, command_run
+from fogies.tools.go import go
+
+# Most recent first; _KNOWN_VERSIONS[0] is the default.
+_KNOWN_VERSIONS = [
+    "1.17.1",
+]
+
+_DEFAULT_VERSION = _KNOWN_VERSIONS[0]
+
+_MODULE_TEMPLATE = "github.com/tawanorg/claude-sync/cmd/claude-sync@v{version}"
+
+# The claude-sync files, in the home directory.
+_DIRECTORY_NAME = ".claude-sync"
+_YAML_FILE_NAME = "config.yaml"
+_KEY_FILE_NAME = "age-key.txt"
+
+
+def claude_sync_files_directory() -> pathlib.Path:
+    """Where the claude-sync files are: its config.yaml and encryption key."""
+    return pathlib.Path.home() / _DIRECTORY_NAME
+
+
+class ClaudeSyncConfig(BaseModel):
+    """Contents of the claude-sync config."""
+
+    # A profile in the AWS config, with the credentials claude-sync signs in with.
+    aws_profile: str
+    bucket: str
+    region: str
+    scope: Literal["full", "sessions"]
+    # Absent until created by configure.
+    age_key: str | None = None
+
+    @field_validator("age_key")
+    @classmethod
+    def _age_key_is_an_age_key(cls, value: str | None) -> str | None:
+        return None if value is None else validate_age_key(value)
+
+
+def load_claude_sync_config(*, path: pathlib.Path) -> ClaudeSyncConfig:
+    """Return the config in path.
+
+    If it doesn't exist yet, it is created from a template and FileNotFoundError
+    is raised, so that it is filled in before it is used.
+    """
+    ensure_from_template(path=path, template_factory=claude_sync_toml_template_factory)
+    with path.open("rb") as f:
+        return ClaudeSyncConfig.model_validate(tomllib.load(f))
+
+
+def update_claude_sync_config(*, path: pathlib.Path, age_key: str) -> None:
+    """Update the config with age_key, keeping its comments and layout."""
+    with path.open("r", encoding="utf-8") as f:
+        doc = tomlkit.parse(f.read())
+    doc["age_key"] = age_key
+    with path.open("w", encoding="utf-8", newline="\n") as f:
+        _ = f.write(tomlkit.dumps(doc))
+
+
+def render_claude_sync_yaml(config: ClaudeSyncConfig, aws_profile: AwsProfile) -> str:
+    """Return the contents of claude-sync's config.yaml for config and aws_profile.
+
+    As `claude-sync init` writes for S3, except that the scope is always
+    written, not left out when it's the default. Values are written as JSON
+    strings, which are also valid YAML strings, so that none needs escaping.
+    """
+    lines = [
+        "storage:",
+        "    provider: s3",
+        "    bucket: " + json.dumps(config.bucket),
+        "    access_key_id: " + json.dumps(aws_profile.aws_access_key_id),
+        "    secret_access_key: " + json.dumps(aws_profile.aws_secret_access_key),
+        "    region: " + json.dumps(config.region),
+        "encryption_key_path: "
+        + json.dumps("~/{}/{}".format(_DIRECTORY_NAME, _KEY_FILE_NAME)),
+        "scope: " + config.scope,
+    ]
+    return "\n".join(lines) + "\n"
+
+
+@dataclasses.dataclass(frozen=True)
+class ClaudeSyncConfigureResult:
+    """What configure_claude_sync() did."""
+
+    generated_age_key: bool
+    applied_to_claude_sync_files: bool
+
+
+def configure_claude_sync(
+    *, claude_sync_config_path: pathlib.Path, aws_config_path: pathlib.Path, force: bool
+) -> ClaudeSyncConfigureResult:
+    """Apply the config at claude_sync_config_path to the claude-sync files.
+
+    The credentials are those of the config's profile in the AWS config at
+    aws_config_path.
+
+    The config decides what claude-sync's encryption key and config.yaml
+    should be, in claude_sync_files_directory(). If it has no key yet, a new one
+    is generated and saved in it, so that other machines use it too.
+
+    A claude-sync file that is missing is written, and one that already
+    matches is left alone. One that differs is an error, and nothing is
+    written, unless force is set, which replaces it.
+    """
+    # Where the claude-sync files are.
+    directory = claude_sync_files_directory()
+    key_path = directory / _KEY_FILE_NAME
+
+    # The key in the config, or a new one if it has none.
+    config = load_claude_sync_config(path=claude_sync_config_path)
+    aws_profile = load_aws_profile_from_config(
+        config_path=aws_config_path, profile_name=config.aws_profile
+    )
+    generated_age_key = config.age_key is None
+    age_key = generate_age_key() if config.age_key is None else config.age_key
+
+    # What the claude-sync files should contain.
+    expected_content = {
+        key_path: age_key + "\n",
+        directory / _YAML_FILE_NAME: render_claude_sync_yaml(config, aws_profile),
+    }
+    # Which of them are missing or differ.
+    paths_to_write = [
+        path
+        for path, text in expected_content.items()
+        if not path.exists() or path.read_text(encoding="utf-8") != text
+    ]
+    # Which of those exist but differ.
+    paths_that_differ = [path for path in paths_to_write if path.exists()]
+
+    # Refuse to replace what differs, unless forced.
+    if paths_that_differ and not force:
+        raise ValueError("Config does not match existing claude-sync files.")
+
+    # Save a generated key in the config, for other machines.
+    if generated_age_key:
+        update_claude_sync_config(path=claude_sync_config_path, age_key=age_key)
+
+    # Write the claude-sync files.
+    directory.mkdir(parents=True, exist_ok=True)
+    for path in paths_to_write:
+        _ = path.write_text(expected_content[path], encoding="utf-8", newline="\n")
+
+    return ClaudeSyncConfigureResult(
+        generated_age_key=generated_age_key,
+        applied_to_claude_sync_files=bool(paths_to_write),
+    )
+
+
+class _ClaudeSync:
+    """Represents a claude-sync binary."""
+
+    _path: pathlib.Path
+
+    def __init__(self, *, path: pathlib.Path) -> None:
+        self._path = path
+
+    @property
+    def binary_path(self) -> pathlib.Path:
+        """The path to the claude-sync executable."""
+        return self._path
+
+    def push(
+        self,
+        *,
+        command_params: CommandParams,
+        include_mcp: bool = False,
+        quiet: bool = False,
+    ) -> Result:
+        """Run `claude-sync push`, uploading local changes to cloud storage."""
+        push_args = ["push"]
+        if include_mcp:
+            push_args.append("--include-mcp")
+        if quiet:
+            push_args.append("-q")
+        return command_run(
+            command=self.binary_path,
+            command_params=command_params,
+            args=push_args,
+        )
+
+    def pull(
+        self,
+        *,
+        command_params: CommandParams,
+        dry_run: bool = False,
+        force: bool = False,
+        include_mcp: bool = False,
+        quiet: bool = False,
+        rebuild_history: bool = False,
+    ) -> Result:
+        """Run `claude-sync pull`, downloading remote changes."""
+        pull_args = ["pull"]
+        if dry_run:
+            pull_args.append("--dry-run")
+        if force:
+            pull_args.append("--force")
+        if include_mcp:
+            pull_args.append("--include-mcp")
+        if quiet:
+            pull_args.append("-q")
+        if rebuild_history:
+            pull_args.append("--rebuild-history")
+        return command_run(
+            command=self.binary_path,
+            command_params=command_params,
+            args=pull_args,
+        )
+
+    def status(self, *, command_params: CommandParams, quiet: bool = False) -> Result:
+        """Run `claude-sync status`, showing pending local changes."""
+        status_args = ["status"]
+        if quiet:
+            status_args.append("-q")
+        return command_run(
+            command=self.binary_path,
+            command_params=command_params,
+            args=status_args,
+        )
+
+
+@contextmanager
+def claude_sync(
+    *,
+    version: str | None = None,
+    binary_cache_path: pathlib.Path,
+    raise_if_env_exists: bool,
+) -> Generator[_ClaudeSync]:
+    """Build claude-sync with a portable Go toolchain (if not cached) and yield a handle.
+
+    *version* when None uses the bundled default claude-sync version. Built
+    into a version-specific subdirectory of binary_cache_path (matching
+    fogies.tools.go's own SDK caching), so bumping the pinned version
+    triggers a fresh build rather than silently reusing a stale binary.
+
+    raise_if_env_exists has no default; see fogies.tools.environ.environ()
+    for why. Passed through to go().install()'s own GOBIN isolation.
+    """
+    if version is None:
+        version = _DEFAULT_VERSION
+
+    if version not in _KNOWN_VERSIONS:
+        known = ", ".join(_KNOWN_VERSIONS)
+        raise ValueError(
+            "Unknown claude-sync version '{}'; known versions: {}".format(
+                version, known
+            )
+        )
+
+    gobin_path = binary_cache_path / "claude_sync_{}".format(version.replace(".", "_"))
+    exe_path = gobin_path / "claude-sync.exe"
+
+    if not exe_path.exists():
+        with go(binary_cache_path=binary_cache_path) as go_tool:
+            _ = go_tool.install(
+                command_params=CommandParams(in_stream=False),
+                module=_MODULE_TEMPLATE.format(version=version),
+                gobin_path=gobin_path,
+                raise_if_env_exists=raise_if_env_exists,
+            )
+
+    if not exe_path.exists():
+        raise RuntimeError(
+            "claude-sync executable not found in '{}'".format(gobin_path)
+        )
+
+    yield _ClaudeSync(path=exe_path)

{fogies-0.0.0.dev11 → fogies-0.0.0.dev12}/src/fogies/tools/terraform.py

@@ -477,7 +477,8 @@ def terraform(
                 backend_status.states[backend_config.state_name] = BackendStatusEntry(
                     applied=bool(
                         backend_state_resources(
-                            config=backend_config, account_id=aws_environ.account_id
+                            backend_config=backend_config,
+                            account_id=aws_environ.account_id,
                         )
                     )
                 )
@@ -501,7 +502,8 @@ def terraform(
                 backend_status.states[backend_config.state_name] = BackendStatusEntry(
                     applied=bool(
                         backend_state_resources(
-                            config=backend_config, account_id=aws_environ.account_id
+                            backend_config=backend_config,
+                            account_id=aws_environ.account_id,
                         )
                     )
                 )

fogies-0.0.0.dev11/src/fogies/tools/claude_sync.py

@@ -1,130 +0,0 @@
-"""Tool wrapping claude-sync, built with a portable Go toolchain.
-
-See <https://github.com/tawanorg/claude-sync>. claude-sync ships no Windows
-release binary, so it's built from source here rather than downloaded
-pre-built, unlike fogies.tools.terraform. Only push/pull/status are wrapped;
-claude-sync's own storage setup (S3/R2/etc. credentials, bucket, encryption
-passphrase) is configured through `claude-sync init`'s interactive wizard,
-which is out of scope here.
-"""
-
-import pathlib
-from collections.abc import Generator
-from contextlib import contextmanager
-
-from invoke.runners import Result
-
-from fogies.tools.command import CommandParams, command_run
-from fogies.tools.go import go
-
-# Most recent first; _KNOWN_VERSIONS[0] is the default.
-_KNOWN_VERSIONS = [
-    "1.17.1",
-]
-
-_DEFAULT_VERSION = _KNOWN_VERSIONS[0]
-
-_MODULE_TEMPLATE = "github.com/tawanorg/claude-sync/cmd/claude-sync@v{version}"
-
-
-class _ClaudeSync:
-    """Represents a claude-sync binary."""
-
-    _path: pathlib.Path
-
-    def __init__(self, *, path: pathlib.Path) -> None:
-        self._path = path
-
-    @property
-    def binary_path(self) -> pathlib.Path:
-        """The path to the claude-sync executable."""
-        return self._path
-
-    def push(self, *, command_params: CommandParams, quiet: bool = False) -> Result:
-        """Run `claude-sync push`, uploading local changes to cloud storage."""
-        push_args = ["push"]
-        if quiet:
-            push_args.append("-q")
-        return command_run(
-            command=self.binary_path,
-            command_params=command_params,
-            args=push_args,
-        )
-
-    def pull(
-        self,
-        *,
-        command_params: CommandParams,
-        dry_run: bool = False,
-        force: bool = False,
-        quiet: bool = False,
-    ) -> Result:
-        """Run `claude-sync pull`, downloading remote changes."""
-        pull_args = ["pull"]
-        if dry_run:
-            pull_args.append("--dry-run")
-        if force:
-            pull_args.append("--force")
-        if quiet:
-            pull_args.append("-q")
-        return command_run(
-            command=self.binary_path,
-            command_params=command_params,
-            args=pull_args,
-        )
-
-    def status(self, *, command_params: CommandParams) -> Result:
-        """Run `claude-sync status`, showing pending local changes."""
-        return command_run(
-            command=self.binary_path,
-            command_params=command_params,
-            args=["status"],
-        )
-
-
-@contextmanager
-def claude_sync(
-    *,
-    version: str | None = None,
-    binary_cache_path: pathlib.Path,
-    raise_if_env_exists: bool,
-) -> Generator[_ClaudeSync]:
-    """Build claude-sync with a portable Go toolchain (if not cached) and yield a handle.
-
-    *version* when None uses the bundled default claude-sync version. Built
-    into a version-specific subdirectory of binary_cache_path (matching
-    fogies.tools.go's own SDK caching), so bumping the pinned version
-    triggers a fresh build rather than silently reusing a stale binary.
-
-    raise_if_env_exists has no default; see fogies.tools.environ.environ()
-    for why. Passed through to go().install()'s own GOBIN isolation.
-    """
-    if version is None:
-        version = _DEFAULT_VERSION
-
-    if version not in _KNOWN_VERSIONS:
-        known = ", ".join(_KNOWN_VERSIONS)
-        raise ValueError(
-            "Unknown claude-sync version '{}'; known versions: {}".format(
-                version, known
-            )
-        )
-
-    gobin_path = binary_cache_path / "claude_sync_{}".format(version.replace(".", "_"))
-    exe_path = gobin_path / "claude-sync.exe"
-
-    if not exe_path.exists():
-        with go(binary_cache_path=binary_cache_path) as go_tool:
-            _ = go_tool.install(
-                command_params=CommandParams(in_stream=False),
-                module=_MODULE_TEMPLATE.format(version=version),
-                gobin_path=gobin_path,
-                raise_if_env_exists=raise_if_env_exists,
-            )
-
-    if not exe_path.exists():
-        raise RuntimeError(
-            "claude-sync executable not found in '{}'".format(gobin_path)
-        )
-
-    yield _ClaudeSync(path=exe_path)