opencode-swap 0.4.0__py3-none-any.whl

opencode_swap/__init__.py

@@ -0,0 +1,3 @@
+"""opencode-swap: multi-account switcher for OpenCode."""
+
+__version__ = "0.4.0"

opencode_swap/__main__.py

@@ -0,0 +1,4 @@
+from opencode_swap.cli import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())

opencode_swap/atomic.py

@@ -0,0 +1,95 @@
+"""Shared atomic-write primitives: 0600 temp file in the target's own
+directory, fsynced, then os.replace, with the containing directory fsynced
+afterward. The only publish point is the rename, so a crash mid-write never
+leaves a truncated or partially-written file behind, and the fsyncs mean the
+guarantee holds across a power loss, not just a process crash.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import tempfile
+from contextlib import suppress
+from pathlib import Path
+from typing import Any
+
+DEFAULT_MODE = 0o600
+
+
+def _fsync_dir(directory: Path) -> None:
+    """Best-effort: make the preceding rename itself durable, not just its
+    contents. Suppressed because the publish has already committed by this
+    point, and some filesystems (notably network ones) reject fsync on a
+    directory fd."""
+    with suppress(OSError):
+        fd = os.open(directory, os.O_RDONLY)
+        try:
+            os.fsync(fd)
+        finally:
+            os.close(fd)
+
+
+def atomic_write_bytes(path: Path, data: bytes, mode: int = DEFAULT_MODE) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    fd, tmp_name = tempfile.mkstemp(dir=path.parent, prefix=f".{path.name}.", suffix=".tmp")
+    tmp_path = Path(tmp_name)
+    try:
+        with os.fdopen(fd, "wb") as f:
+            f.write(data)
+            f.flush()
+            os.fsync(f.fileno())
+        os.chmod(tmp_path, mode)
+        os.replace(tmp_path, path)
+    except BaseException:
+        tmp_path.unlink(missing_ok=True)
+        raise
+    _fsync_dir(path.parent)
+
+
+def atomic_write_bytes_exclusive(path: Path, data: bytes, mode: int = DEFAULT_MODE) -> None:
+    """Atomically create bytes only if `path` does not already exist."""
+    path.parent.mkdir(parents=True, exist_ok=True)
+    fd, tmp_name = tempfile.mkstemp(dir=path.parent, prefix=f".{path.name}.", suffix=".tmp")
+    tmp_path = Path(tmp_name)
+    reserved = False
+    try:
+        with os.fdopen(fd, "wb") as f:
+            f.write(data)
+            f.flush()
+            os.fsync(f.fileno())
+        os.chmod(tmp_path, mode)
+        try:
+            os.link(tmp_path, path)
+        except FileExistsError:
+            raise  # exclusivity is the point; never fall back
+        except OSError:
+            # Destination filesystem has no hardlinks (e.g. a FAT32/exFAT
+            # export target). `open(O_CREAT|O_EXCL)` is the only race-safe
+            # exclusive-create primitive left without them. Once it reserves
+            # `path`, publish tmp_path's already-fsynced content over the
+            # reservation with the same atomic os.replace used everywhere
+            # else in this module -- so a failure partway through can never
+            # leave a truncated file under the real name; at worst it leaves
+            # the empty reservation, which the handler below also cleans up.
+            os.close(os.open(path, os.O_CREAT | os.O_EXCL, mode))
+            reserved = True
+            os.replace(tmp_path, path)
+    except BaseException:
+        tmp_path.unlink(missing_ok=True)
+        if reserved:
+            path.unlink(missing_ok=True)
+        raise
+    with suppress(OSError):
+        tmp_path.unlink()
+    _fsync_dir(path.parent)
+
+
+def atomic_write_json(path: Path, data: Any, mode: int = DEFAULT_MODE, indent: int = 2) -> None:
+    atomic_write_bytes(path, json.dumps(data, indent=indent, allow_nan=False).encode("utf-8"), mode=mode)
+
+
+def atomic_write_json_exclusive(path: Path, data: Any, mode: int = DEFAULT_MODE, indent: int = 2) -> None:
+    """Atomically create JSON only if `path` does not already exist."""
+    encoded = json.dumps(data, indent=indent, allow_nan=False).encode("utf-8")
+    atomic_write_bytes_exclusive(path, encoded, mode=mode)

opencode_swap/backup.py

@@ -0,0 +1,128 @@
+"""Recovery snapshots of OpenCode's auth.json, kept under
+``<data_root>/backups/``. All files 0600.
+
+- ``auth.json.bak`` — the live auth.json content immediately before the most
+  recent switch. Lets a user manually recover if opencode-swap's own
+  transaction rollback (see switcher.py) can't run (e.g. opencode-swap was
+  killed mid-operation).
+- ``auth.json.pristine`` — the very first live auth.json content ever seen,
+  written once and never overwritten. The ultimate fallback: what OpenCode's
+  auth looked like before opencode-swap ever touched it.
+- ``unclaimed-<provider>-<timestamp>-<suffix>.json`` — a live provider record that
+  didn't belong to any managed account at switch time (an external
+  `opencode auth login` opencode-swap wasn't told about). Preserved instead
+  of silently overwritten so nothing is lost.
+- ``discarded-restore-<timestamp>-<suffix>.json`` — a `.restore` recovery
+  snapshot archived by ``restore --discard-pending`` before the pending
+  marker is cleared, so the one remaining copy of a previous switch's
+  pre-restore state is never destroyed outright.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import secrets
+import time
+from pathlib import Path
+from typing import cast
+
+from opencode_swap.atomic import atomic_write_json, atomic_write_json_exclusive
+from opencode_swap.exceptions import BackupError
+from opencode_swap.models import JsonObject
+
+BACKUP_DIRNAME = "backups"
+BAK_FILENAME = "auth.json.bak"
+PRISTINE_FILENAME = "auth.json.pristine"
+RESTORE_SNAPSHOT_FILENAME = "auth.json.restore"
+
+
+def _backups_dir(data_root: Path) -> Path:
+    """Return the backups dir, creating it with 0700 if needed.
+
+    atomic_write_json's own mkdir doesn't set a mode (it's shared with
+    OpenCode's own auth.json directory, which opencode-swap must not
+    presumptuously chmod) — so opencode-swap's own subdirectories are
+    responsible for locking themselves down, same as store.py's secrets/.
+    """
+    d = data_root / BACKUP_DIRNAME
+    d.mkdir(parents=True, exist_ok=True)
+    d.chmod(0o700)
+    return d
+
+
+def write_bak(data_root: Path, auth: JsonObject) -> None:
+    atomic_write_json(_backups_dir(data_root) / BAK_FILENAME, auth)
+
+
+def read_bak(data_root: Path) -> JsonObject | None:
+    return _read_snapshot(_backups_dir(data_root) / BAK_FILENAME)
+
+
+def write_pristine_if_absent(data_root: Path, auth: JsonObject) -> None:
+    path = _backups_dir(data_root) / PRISTINE_FILENAME
+    if path.exists():
+        return
+    atomic_write_json(path, auth)
+
+
+def read_pristine(data_root: Path) -> JsonObject | None:
+    return _read_snapshot(_backups_dir(data_root) / PRISTINE_FILENAME)
+
+
+def _read_snapshot(path: Path) -> JsonObject | None:
+    if not path.exists():
+        return None
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError) as exc:
+        raise BackupError(f"could not read backup at {path}: {exc}") from exc
+    if not isinstance(data, dict):
+        raise BackupError(f"backup at {path} does not contain a JSON object at the top level")
+    return cast(JsonObject, data)
+
+
+def write_restore_snapshot(data_root: Path, auth: JsonObject) -> None:
+    """Keep restore source durable while .bak is chained to current live state."""
+    atomic_write_json(_backups_dir(data_root) / RESTORE_SNAPSHOT_FILENAME, auth)
+
+
+def read_restore_snapshot(data_root: Path) -> JsonObject | None:
+    return _read_snapshot(_backups_dir(data_root) / RESTORE_SNAPSHOT_FILENAME)
+
+
+def remove_restore_snapshot(data_root: Path) -> None:
+    (_backups_dir(data_root) / RESTORE_SNAPSHOT_FILENAME).unlink(missing_ok=True)
+
+
+def write_discarded_restore(data_root: Path, auth: JsonObject) -> Path:
+    """Archive a `.restore` recovery snapshot before its pending marker is
+    dropped (see switcher.py's `restore(discard_pending=True)`), so
+    discarding it never destroys the only remaining copy of a previous
+    switch's pre-restore state."""
+    timestamp = time.strftime("%Y%m%dT%H%M%SZ", time.gmtime())
+    directory = _backups_dir(data_root)
+    for _ in range(100):
+        path = directory / f"discarded-restore-{timestamp}-{secrets.token_hex(8)}.json"
+        try:
+            atomic_write_json_exclusive(path, auth)
+        except FileExistsError:
+            continue
+        return path
+    raise BackupError("could not allocate a unique discarded-restore backup")
+
+
+def write_unclaimed(data_root: Path, provider_id: str, record: JsonObject) -> Path:
+    timestamp = time.strftime("%Y%m%dT%H%M%SZ", time.gmtime())
+    directory = _backups_dir(data_root)
+    # Random suffixes make collisions improbable; exclusive publication makes
+    # even a repeated suffix unable to replace another foreign credential.
+    provider_tag = hashlib.sha256(provider_id.encode("utf-8")).hexdigest()[:12]
+    for _ in range(100):
+        path = directory / f"unclaimed-{provider_tag}-{timestamp}-{secrets.token_hex(8)}.json"
+        try:
+            atomic_write_json_exclusive(path, record)
+        except FileExistsError:
+            continue
+        return path
+    raise BackupError("could not allocate a unique unclaimed credential backup")