nxplora 0.16.0__tar.gz

nxplora-0.16.0/.gitignore

@@ -0,0 +1,7 @@
+.env*
+__pycache__/
+.venv/
+dist/
+build/
+*.egg-info/
+.DS_Store

nxplora-0.16.0/PKG-INFO

@@ -0,0 +1,56 @@
+Metadata-Version: 2.5
+Name: nxplora
+Version: 0.16.0
+Summary: NX in your terminal, on your Nexplora account.
+License: Proprietary
+Requires-Python: >=3.9
+Requires-Dist: certifi
+Requires-Dist: textual<2,>=1.0
+Description-Content-Type: text/markdown
+
+# nx-cli
+
+**Private source. Proprietary. Published to PyPI as `nxplora` only when ready.**
+
+The NX terminal client: a thin client of a person's Nexplora account. Each message is a real run on the same engine the
+chat uses, with the account's approvals and billing. It shows what really came back and nothing else.
+
+## Charter
+
+| nx-cli OWNS | nx-cli NEVER contains |
+|---|---|
+| Sign-in / enrollment with nx-cloud | Brain logic: routing, prompts, CodeChat harness, council, cognition router, brain core (these stay in private `Nexploraai/NX`) |
+| Terminal UI, streaming, rendering | Model IDs, provider URLs or provider keys |
+| Actions that must run on the operator's own machine (host, computer, phone) — only under nx-cloud-issued, approval-gated commands | Global Nexplora / NX secrets |
+| Its own update channel | Any upload / publish path to a package index other than the gated release job |
+
+Every published build must pass a check that none of the private NX modules are present in the wheel.
+
+## What it does
+
+- **In a Nexplora Code session's terminal** it is already signed in: the app writes a short-lived session ticket (bound to the
+  person, the Operation and that session, one hour, usable only for sending a message there) to a private file, and renews it
+  while the page holds the terminal. The person's login is never on that computer. The ticket can't approve anything.
+- **On any other computer** `nx` shows a short link and a code. Approve it in the browser and it's done. The sign-in stays in
+  `~/.nx-cli/credentials.json` (0600). `nx logout` ends it. Work runs on the person's Nexplora cloud computer, not this one.
+- **Approvals** are given in the chat. `nx` says what is waiting and where, then follows the run as it goes on.
+- **Colours** are the terminal's own, with no painted background, so it matches a light or dark panel.
+
+```bash
+python -m pip install .
+nx
+```
+
+## Checks
+
+```bash
+python -m pytest                                  # includes a real local HTTP server (tests/stub_server.py)
+python -m build --wheel && python scripts/check_wheel.py dist/*.whl   # the charter's check; a release must pass it
+python scripts/pty_proof.py "$(command -v nx)" /tmp/nx-proof          # real pty, reads the screen, fails on any painted background
+```
+
+## PyPI
+
+The `nxplora` project name is owned and all historical releases are yanked (2026-09-29). Existing installs
+run `nx upgrade` → `pip install -U nxplora`, so the first nx-cli release published under `nxplora` becomes
+the migration path for those users. Never delete the PyPI project (name-takeover risk).

nxplora-0.16.0/README.md

@@ -0,0 +1,46 @@
+# nx-cli
+
+**Private source. Proprietary. Published to PyPI as `nxplora` only when ready.**
+
+The NX terminal client: a thin client of a person's Nexplora account. Each message is a real run on the same engine the
+chat uses, with the account's approvals and billing. It shows what really came back and nothing else.
+
+## Charter
+
+| nx-cli OWNS | nx-cli NEVER contains |
+|---|---|
+| Sign-in / enrollment with nx-cloud | Brain logic: routing, prompts, CodeChat harness, council, cognition router, brain core (these stay in private `Nexploraai/NX`) |
+| Terminal UI, streaming, rendering | Model IDs, provider URLs or provider keys |
+| Actions that must run on the operator's own machine (host, computer, phone) — only under nx-cloud-issued, approval-gated commands | Global Nexplora / NX secrets |
+| Its own update channel | Any upload / publish path to a package index other than the gated release job |
+
+Every published build must pass a check that none of the private NX modules are present in the wheel.
+
+## What it does
+
+- **In a Nexplora Code session's terminal** it is already signed in: the app writes a short-lived session ticket (bound to the
+  person, the Operation and that session, one hour, usable only for sending a message there) to a private file, and renews it
+  while the page holds the terminal. The person's login is never on that computer. The ticket can't approve anything.
+- **On any other computer** `nx` shows a short link and a code. Approve it in the browser and it's done. The sign-in stays in
+  `~/.nx-cli/credentials.json` (0600). `nx logout` ends it. Work runs on the person's Nexplora cloud computer, not this one.
+- **Approvals** are given in the chat. `nx` says what is waiting and where, then follows the run as it goes on.
+- **Colours** are the terminal's own, with no painted background, so it matches a light or dark panel.
+
+```bash
+python -m pip install .
+nx
+```
+
+## Checks
+
+```bash
+python -m pytest                                  # includes a real local HTTP server (tests/stub_server.py)
+python -m build --wheel && python scripts/check_wheel.py dist/*.whl   # the charter's check; a release must pass it
+python scripts/pty_proof.py "$(command -v nx)" /tmp/nx-proof          # real pty, reads the screen, fails on any painted background
+```
+
+## PyPI
+
+The `nxplora` project name is owned and all historical releases are yanked (2026-09-29). Existing installs
+run `nx upgrade` → `pip install -U nxplora`, so the first nx-cli release published under `nxplora` becomes
+the migration path for those users. Never delete the PyPI project (name-takeover risk).

nxplora-0.16.0/pyproject.toml

@@ -0,0 +1,22 @@
+[build-system]
+requires = ["hatchling>=1.25"]
+build-backend = "hatchling.build"
+
+[project]
+name = "nxplora"
+version = "0.16.0"
+description = "NX in your terminal, on your Nexplora account."
+readme = "README.md"
+requires-python = ">=3.9"
+license = { text = "Proprietary" }
+dependencies = ["textual>=1.0,<2", "certifi"]
+
+[project.scripts]
+nx = "nxplora_cli.__main__:main"
+nxplora = "nxplora_cli.__main__:main"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/nxplora_cli"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

nxplora-0.16.0/scripts/check_wheel.py

@@ -0,0 +1,52 @@
+#!/usr/bin/env python3
+"""The charter's check: a published wheel holds this client and nothing of NX. Exits non-zero, naming what it found.
+
+Usage: python scripts/check_wheel.py dist/nxplora-*.whl
+"""
+from __future__ import annotations
+
+import re
+import sys
+import zipfile
+
+ALLOWED_MODULES = {"__init__.py", "__main__.py", "app.py", "auth.py", "events.py", "opening.py", "transport.py"}
+# Never in a client: brain modules, model ids, provider addresses, secret names.
+FORBIDDEN = re.compile(
+    r"nx_brain|nx_agent|nx_channel|chat_ui|autonomy_loop|nx_capability|from nx\b|import nx\b"
+    r"|claude-[a-z0-9]|gpt-[0-9]|gemini-[0-9]|qwen|deepseek|kimi|moonshot"
+    r"|api\.anthropic\.com|api\.openai\.com|generativelanguage\.googleapis|deepinfra|openrouter"
+    r"|SUPABASE_|sk-ant-|sk-proj-|BEGIN (?:RSA |EC )?PRIVATE KEY",
+    re.IGNORECASE,
+)
+
+
+def check(path: str) -> list[str]:
+    problems: list[str] = []
+    with zipfile.ZipFile(path) as wheel:
+        for name in wheel.namelist():
+            top = name.split("/", 1)[0]
+            if top.endswith(".dist-info"):
+                continue
+            if top != "nxplora_cli" or name.split("/", 1)[1] not in ALLOWED_MODULES:
+                problems.append(f"{name}: not part of this client")
+                continue
+            found = FORBIDDEN.search(wheel.read(name).decode("utf-8", "replace"))
+            if found:
+                problems.append(f"{name}: contains {found.group(0)!r}")
+    return problems
+
+
+def main() -> int:
+    if len(sys.argv) != 2:
+        print(__doc__, file=sys.stderr)
+        return 2
+    problems = check(sys.argv[1])
+    for problem in problems:
+        print(problem, file=sys.stderr)
+    if not problems:
+        print(f"{sys.argv[1]}: clean")
+    return 1 if problems else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

nxplora-0.16.0/scripts/pty_proof.py

@@ -0,0 +1,154 @@
+#!/usr/bin/env python3
+"""Run a built `nx` in a real pty against the local stub (tests/stub_server.py), read the screen with a terminal emulator,
+and write it out as text and as a picture in the terminal panel's real palettes. Never touches production.
+
+Usage: python scripts/pty_proof.py NX_BINARY OUT_DIR [--term xterm-16color] [--no-send]
+Exits 1 if the app painted any background, or the ticket reached the screen.
+"""
+from __future__ import annotations
+
+import argparse
+import fcntl
+import json
+import os
+import pty
+import select
+import struct
+import sys
+import tempfile
+import termios
+import time
+from pathlib import Path
+
+import pyte
+from PIL import Image, ImageDraw, ImageFont
+
+sys.path.insert(0, str(Path(__file__).parent.parent / "tests"))
+from stub_server import SESSION, Stub  # noqa: E402
+
+COLS, ROWS = 96, 26
+# The panel's xterm themes, from lib/code/pty-bridge.ts LIVING_INK_XTERM, and a plain dark one.
+INK = {"default_bg": "#efe9dc", "default": "#2b2620", "black": "#d9d3c6", "red": "#a63a2a", "green": "#4f6b34", "brown": "#9a7413", "blue": "#3f5d7a", "magenta": "#7a466a", "cyan": "#3f6b68", "white": "#4a4438",
+       "brightblack": "#6f675a", "brightred": "#c04a34", "brightgreen": "#5f7f40", "brightbrown": "#b68a1a", "brightblue": "#4d6f92", "brightmagenta": "#93567f", "brightcyan": "#4f807c", "brightwhite": "#2b2620"}
+DARK = {"default_bg": "#14161a", "default": "#d7d9dc", "black": "#14161a", "red": "#e06c60", "green": "#8fbf6a", "brown": "#d9b45b", "blue": "#7aa2d6", "magenta": "#c78bd0", "cyan": "#6fc0ba", "white": "#c8cacc",
+        "brightblack": "#8a8f96", "brightred": "#ef8378", "brightgreen": "#a5d180", "brightbrown": "#e8c673", "brightblue": "#92b6e6", "brightmagenta": "#d7a2df", "brightcyan": "#86d3cd", "brightwhite": "#ffffff"}
+
+
+def colour(name: str, palette: dict[str, str]) -> str:
+    if name == "default":
+        return palette["default"]
+    if name in palette:
+        return palette[name]
+    return f"#{name}" if len(name) == 6 else palette["default"]
+
+
+def picture(screen: pyte.Screen, palette: dict[str, str], path: Path) -> None:
+    font = None
+    for candidate in ("/System/Library/Fonts/Menlo.ttc", "/System/Library/Fonts/Monaco.ttf"):
+        if os.path.exists(candidate):
+            font = ImageFont.truetype(candidate, 15)
+            break
+    font = font or ImageFont.load_default()
+    w, h = 9, 19
+    image = Image.new("RGB", (COLS * w, ROWS * h), palette["default_bg"])
+    draw = ImageDraw.Draw(image)
+    for y in range(ROWS):
+        for x in range(COLS):
+            cell = screen.buffer[y][x]
+            fg, bg = colour(cell.fg, palette), palette["default_bg"] if cell.bg == "default" else colour(cell.bg, palette)
+            if cell.reverse:
+                fg, bg = bg, fg
+            if bg != palette["default_bg"]:
+                draw.rectangle([x * w, y * h, (x + 1) * w, (y + 1) * h], fill=bg)
+            if cell.data.strip():
+                draw.text((x * w, y * h), cell.data, font=font, fill=fg)
+    image.save(path)
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("nx")
+    parser.add_argument("out")
+    parser.add_argument("--term", default="xterm-16color")
+    parser.add_argument("--no-send", action="store_true")
+    parser.add_argument("--name", default="nx")
+    args = parser.parse_args()
+    out = Path(args.out)
+    out.mkdir(parents=True, exist_ok=True)
+
+    ticket = "nxst_stubpayload.stubsignature"
+    stub = Stub(ticket)
+    stub.run_scripts = [[
+        {"event": "tool_call", "tick": 0, "tool": "run_command", "args": {}, "summary": "Ran npm test"},
+        {"event": "assistant_text", "text": "All 12 tests pass."},
+        {"event": "approval_required", "id": "a1", "tick": 1, "tool": "git_push", "args": {}, "summary": "Push to main", "danger": "push"},
+        {"event": "done", "status": "awaiting_approval"},
+    ]]
+    home = Path(tempfile.mkdtemp())
+    (home / ".nx-pty").mkdir()
+    (home / ".nx-cli").mkdir(mode=0o700)
+    session = home / ".nx-cli" / "session.json"
+    session.write_text(json.dumps({"v": 1, "origin": stub.origin, "session_id": SESSION, "ticket": ticket, "expires_at_ms": int(time.time() * 1000) + 3_600_000}))
+    os.chmod(session, 0o600)
+
+    screen = pyte.Screen(COLS, ROWS)
+    stream = pyte.ByteStream(screen)
+    raw = bytearray()
+    pid, fd = pty.fork()
+    if pid == 0:
+        env = {"HOME": str(home), "TERM": args.term, "PATH": os.environ["PATH"], "LANG": "C.UTF-8"}
+        os.chdir(home)
+        os.execve(args.nx, [args.nx], env)
+    fcntl.ioctl(fd, termios.TIOCSWINSZ, struct.pack("HHHH", ROWS, COLS, 0, 0))
+
+    def pump(seconds: float) -> None:
+        end = time.time() + seconds
+        while time.time() < end:
+            ready, _, _ = select.select([fd], [], [], 0.1)
+            if ready:
+                try:
+                    data = os.read(fd, 65536)
+                except OSError:
+                    return
+                raw.extend(data)
+                stream.feed(data)
+
+    pump(5)
+    first = out / f"{args.name}-open.txt"
+    first.write_text("\n".join(screen.display))
+    if not args.no_send:
+        for ch in "run the tests":
+            os.write(fd, ch.encode())
+            pump(0.03)
+        os.write(fd, b"\r")
+        pump(3)
+    (out / f"{args.name}-screen.txt").write_text("\n".join(screen.display))
+    picture(screen, INK, out / f"{args.name}-light-panel.png")
+    picture(screen, DARK, out / f"{args.name}-dark-panel.png")
+
+    painted: dict[str, int] = {}
+    fgs: dict[str, int] = {}
+    for y in range(ROWS):
+        for x in range(COLS):
+            cell = screen.buffer[y][x]
+            if cell.bg != "default":
+                painted[cell.bg] = painted.get(cell.bg, 0) + 1
+            fgs[cell.fg] = fgs.get(cell.fg, 0) + 1
+    os.write(fd, b"\x03")
+    pump(1)
+    report = {
+        "term": args.term,
+        "painted_background_cells": painted,
+        "foregrounds": fgs,
+        "ticket_on_screen": ticket.encode() in bytes(raw),
+        "requests": [{"path": r["path"], "body_fields": sorted(r["body"] or {})} for r in stub.requests],
+    }
+    (out / f"{args.name}-report.json").write_text(json.dumps(report, indent=1))
+    print(json.dumps(report))
+    print("\n".join(line.rstrip() for line in screen.display))
+    stub.close()
+    return 1 if painted or report["ticket_on_screen"] else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

nxplora-0.16.0/src/nxplora_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.16.0"

nxplora-0.16.0/src/nxplora_cli/__main__.py

@@ -0,0 +1,44 @@
+from __future__ import annotations
+
+import argparse
+import sys
+
+from . import __version__
+from .auth import DEFAULT_ORIGIN, forget_device_login, load_device_login, safe_origin
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(prog="nx", description="NX in your terminal, on your Nexplora account")
+    parser.add_argument("--version", action="version", version=__version__)
+    parser.add_argument("--connect", metavar="URL", help="the Nexplora address to use (default: nexplora.ai)")
+    parser.add_argument("command", nargs="?", choices=["login", "logout"], help="sign in or out on this computer")
+    args = parser.parse_args()
+    origin = safe_origin(args.connect) if args.connect else None
+    if args.connect and not origin:
+        parser.error("that address isn't https, so nx won't send your sign-in to it")
+    if args.command == "logout":
+        _logout()
+        return
+    from .app import NxploraApp
+
+    app = NxploraApp(origin=origin or DEFAULT_ORIGIN, origin_chosen=bool(origin), force_login=args.command == "login")
+    app.run(mouse=False)
+    if app.exit_note:
+        print(app.exit_note)
+
+
+def _logout() -> None:
+    from .transport import Unreachable, revoke_device_session
+
+    login = load_device_login()
+    if login and login.device_session_id:
+        try:
+            revoke_device_session(login.origin, login.access_token, login.device_session_id)
+        except Unreachable:
+            print("Signed out here, but Nexplora couldn't be reached. You can end this sign-in in your account.", file=sys.stderr)
+    forget_device_login()
+    print("Signed out on this computer.")
+
+
+if __name__ == "__main__":
+    main()