painapple-code 1.0.0__py3-none-any.whl

painapple_code/cli/__init__.py

@@ -0,0 +1,204 @@
+"""Top-level CLI dispatch for the ``painapple`` command.
+
+``painapple`` is the sole console script (the old ``painapple-code``
+name was retired; ``python -m painapple_code`` still works everywhere).
+
+Backward compatibility is the design constraint: bare invocations like
+``painapple --port 8880 --cwd …`` are baked into systemd units,
+start.sh, deploy.fish, and docker-entrypoint.sh, so they must keep
+working unchanged. Dispatch peeks at the first argument — a known
+subcommand routes to its handler, anything else falls through to the
+server's flat argument parser exactly as before. The one deliberate
+exception: a *leading* ``-h``/``--help`` shows the curated command
+overview below instead of the server's flag dump (``painapple serve
+--help`` still prints the full flag reference).
+
+Docker is not a command group — it's a run mode. ``--in-docker`` runs
+the same serve invocation in a container; profiles carry a ``mode:
+host|docker`` and every verb (start/stop/logs/…) dispatches on it.
+The old ``painapple docker`` group prints a "moved" pointer.
+
+Subcommands:
+    serve         explicit alias for the default server invocation
+    setup [NAME]  global defaults wizard / profile wizard (creates NAME)
+    list          the fleet view: every deployment + unmanaged processes
+    start/stop/restart [NAME]   background lifecycle (mode-aware)
+    status [NAME] one deployment's detail — bare, it IS the fleet view
+    logs [NAME]   follow output (host: console.log · docker: container)
+    password [NAME]  show the server auth URL + password
+    pull          fetch the prebuilt container image
+    shell/extract/claude-login [NAME]   docker-mode utilities
+    help          curated overview (also -h/--help as the first argument)
+    version       the version string (also -v/--version as a flag)
+"""
+
+import sys
+
+SUBCOMMANDS = ("serve", "setup", "list", "start", "stop", "restart",
+               "status", "logs", "password", "pull", "shell", "extract",
+               "claude-login", "help", "version")
+
+_LIST_ALIASES = ("list", "ls", "instances", "profiles")
+_MANAGE_VERBS = {
+    "status": "status", "ps": "status",
+    "logs": "logs", "log": "logs",
+    "password": "password", "show-password": "password",
+    "url": "password", "token": "password",
+    "pull": "pull",
+    "shell": "shell", "sh": "shell",
+    "extract": "extract", "export": "extract",
+    "claude-login": "claude-login", "login": "claude-login",
+    "profile": "profile",  # scripted get/set (desktop launcher)
+}
+
+
+def _help():
+    """Command overview — the front door. Full serve-flag reference
+    stays on `painapple serve --help` (argparse)."""
+    from painapple_code import __version__
+    from painapple_code.cli.ui import BOLD, DIM, GREEN, RESET, say
+    p = "painapple"
+    say(f"""{BOLD}{p}{RESET} — Claude Code in your browser: self-hosted server + web client  {DIM}v{__version__}{RESET}
+
+{BOLD}Usage:{RESET}
+  {p} {DIM}[flags…]{RESET}               Serve the current directory {DIM}(same as: {p} serve){RESET}
+  {p} {GREEN}--in-docker{RESET}            …the same, inside a container {DIM}(Docker/Podman){RESET}
+  {p} {GREEN}setup{RESET}                  Global defaults {DIM}(network · container runtime){RESET}
+  {p} {GREEN}setup{RESET} {DIM}NAME{RESET}             Create/edit a named deployment {DIM}(host or docker mode){RESET}
+  {p} {GREEN}list{RESET}                   Every instance on this machine
+  {p} {GREEN}start{RESET}|{GREEN}stop{RESET}|{GREEN}restart{RESET} {DIM}[NAME]{RESET}  Run/stop in the background {DIM}(NAME = profile · label · pid · port){RESET}
+
+{BOLD}First run:{RESET}
+  cd ~/code/my-project && {p}     {DIM}# → http://127.0.0.1:8765 — login URL printed{RESET}
+  {p} {GREEN}pull{RESET} && {p} {GREEN}--in-docker{RESET}     {DIM}# same, sandboxed in the prebuilt image{RESET}
+
+{BOLD}Common serve flags:{RESET}  {DIM}(all of them: {p} serve --help){RESET}
+  --port N               Port to bind {DIM}(default 8765){RESET}
+  --host IP              Host interface {DIM}(default 127.0.0.1 · 0.0.0.0 = reachable on your LAN){RESET}
+  --workspace PATH       Root dir holding your projects {DIM}(default: current dir){RESET}
+  --tls auto|on|off      TLS {DIM}(auto = on for non-loopback binds; self-signed cert){RESET}
+  --in-docker            Run it containerized instead
+
+{BOLD}Profiles (multiple deployments):{RESET}
+  {p} {GREEN}setup{RESET} work                 {DIM}# create 'work' — pick host mode or docker mode{RESET}
+  {p} {GREEN}start{RESET} work                 {DIM}# run it in the background — own port/data, isolated{RESET}
+  {p} {GREEN}restart{RESET} work · {GREEN}stop{RESET} work    {DIM}# manage it ({p} --profile work runs it in the foreground){RESET}
+  {p} {GREEN}status{RESET} work · {GREEN}logs{RESET} work · {GREEN}password{RESET} work
+
+{BOLD}Everything running:{RESET}
+  {p} {GREEN}list{RESET} {DIM}(= {p} {GREEN}status{RESET}{DIM}){RESET}    Deployments (host + docker) and unmanaged processes
+  {p} {GREEN}status{RESET} {DIM}NAME{RESET}            One deployment in detail {DIM}(NAME = profile · label · pid · port){RESET}
+
+{BOLD}Container extras:{RESET}
+  {p} {GREEN}pull{RESET} [TAG]             Fetch the prebuilt image
+  {p} {GREEN}shell{RESET}|{GREEN}extract{RESET}|{GREEN}claude-login{RESET} {DIM}[NAME]{RESET}   Inside-the-sandbox utilities
+  {p} {GREEN}password{RESET}|{GREEN}logs{RESET} {GREEN}--in-docker{RESET}   {DIM}…for the ad-hoc sandbox (it has no NAME){RESET}
+
+{BOLD}Docs:{RESET} https://painapple.ai/""")
+    return 0
+
+
+def _docker_moved():
+    from painapple_code.cli.ui import DIM, GREEN, RESET, err, say
+    err("`painapple docker` moved — docker is a run mode now, not a "
+        "command group.")
+    say(f"""
+  painapple {GREEN}--in-docker{RESET}          {DIM}run the current dir in a container (was: docker quick){RESET}
+  painapple {GREEN}setup NAME{RESET}           {DIM}create a docker-mode profile (was: docker setup){RESET}
+  painapple {GREEN}start{RESET}|{GREEN}stop{RESET}|{GREEN}restart NAME{RESET}  {DIM}(was: docker up -d / stop / restart){RESET}
+  painapple {GREEN}pull{RESET} · {GREEN}logs{RESET} · {GREEN}password{RESET} · {GREEN}status{RESET} · {GREEN}shell{RESET} · {GREEN}extract{RESET} · {GREEN}claude-login{RESET} {DIM}[NAME]{RESET}
+  painapple {GREEN}list{RESET}                 {DIM}every deployment (was: docker list){RESET}
+
+{DIM}Existing docker profiles are adopted automatically on the next
+profile-aware command (painapple list).{RESET}""")
+    return 2
+
+
+def main(argv=None):
+    if sys.platform == "win32":  # cp1252 console would crash on → / ╔ in help & banner
+        from painapple_code.utils.proc import force_utf8_stdio
+        force_utf8_stdio()
+    argv = list(sys.argv[1:] if argv is None else argv)
+
+    if argv and argv[0] in ("help", "-h", "--help"):
+        return _help()
+
+    if argv and argv[0] in ("version", "--version", "-v"):
+        # Verb form of the flag — same string, no server import.
+        from painapple_code import __version__
+        print(f"painapple {__version__}")
+        return 0
+
+    if argv and argv[0] == "docker":
+        return _docker_moved()
+
+    if argv and argv[0] == "setup":
+        from painapple_code.cli.setup_cmd import main as setup_main
+        return setup_main(argv[1:])
+
+    if argv and argv[0] in _LIST_ALIASES:
+        from painapple_code.cli.list_cmd import main as list_main
+        return list_main(argv[1:])
+
+    if argv and argv[0] in ("start", "stop", "restart"):
+        from painapple_code.cli.lifecycle_cmd import main as lifecycle_main
+        return lifecycle_main(argv[0], argv[1:])
+
+    if argv and argv[0] in _MANAGE_VERBS:
+        from painapple_code.cli.manage_cmd import main as manage_main
+        return manage_main(_MANAGE_VERBS[argv[0]], argv[1:])
+
+    if argv and argv[0] == "serve":
+        argv = argv[1:]
+
+    # Optional --profile NAME: a named deployment run in the foreground.
+    # Stripped here so the flags-only serve parser never sees it.
+    # serve_config is import-light (no yaml/fastapi).
+    from painapple_code.cli import serve_config
+    try:
+        prof, argv = serve_config.extract_profile(argv)
+    except ValueError as e:
+        from painapple_code.cli.ui import err
+        err(str(e))
+        return 2
+
+    # Fast gate: validate flags BEFORE paying the ~300ms server import —
+    # bad flags exit 2, -v / --help exit 0, all in ~40ms. Import stays
+    # inside this branch so setup/list/help skip it.
+    from painapple_code.cli.serve_args import build_parser
+    ns = build_parser().parse_args(argv)
+
+    if prof:
+        # Named deployment: adopt legacy stores, then dispatch on mode.
+        from painapple_code.cli import profiles
+        try:
+            profiles.ensure_migrated()
+            loaded = profiles.load(prof)
+            if loaded is not None and (loaded.is_docker or ns.in_docker):
+                from painapple_code.cli.deploy.launch import run_profile
+                try:
+                    return run_profile(loaded, argv)
+                except KeyboardInterrupt:
+                    return 130
+            if loaded is None and ns.in_docker:
+                from painapple_code.cli.ui import err
+                err(f"Profile {prof!r} doesn't exist — create it with "
+                    f"`painapple setup {prof}`, or drop --profile for an "
+                    "ad-hoc --in-docker run.")
+                return 2
+            profiles.activate(prof)
+        except ValueError as e:
+            from painapple_code.cli.ui import err
+            err(str(e))
+            return 2
+    elif ns.in_docker:
+        from painapple_code.cli.deploy.launch import run_adhoc
+        try:
+            return run_adhoc(argv)
+        except KeyboardInterrupt:
+            return 130
+
+    # Parse succeeded → boot. server.main() re-parses with the same
+    # builder (~1ms) so its signature and behavior stay unchanged.
+    from painapple_code.server import main as serve_main
+    return serve_main(argv)

painapple_code/cli/deploy/__init__.py

@@ -0,0 +1,15 @@
+"""Container run-mode machinery (Docker/Podman).
+
+Docker is not a separate command group — it's *how* a deployment runs.
+This package holds everything the unified CLI needs to run a workspace
+or a profile inside a container:
+
+* ``runtime``   — docker/podman resolution + invocation helpers
+* ``config``    — DockerSettings: the docker-mode key model + validation
+* ``container`` — run/stop/logs/shell/password/extract/pull bodies
+* ``claude_seed`` — .claude credential/onboarding seeding for sandboxes
+
+Entry points: ``painapple --in-docker`` (cwd sandbox), docker-mode
+profiles (``painapple setup NAME`` → ``painapple start NAME``), and the
+management verbs (``painapple logs/password/shell/extract NAME``).
+"""

painapple_code/cli/deploy/claude_seed.py

@@ -0,0 +1,41 @@
+"""Seeding an isolated CLAUDE_HOME for container sandboxes."""
+
+import json
+from pathlib import Path
+
+# Subset of ~/.claude.json worth carrying into the container: "not a
+# fresh install" flags so the onboarding wizard doesn't re-run. The
+# host file's `projects` map is keyed by host paths (dead in the
+# container) and caches refetch on first run — deliberately skipped.
+# KEEP IN SYNC with CLAUDE_JSON_ALLOW in
+# tauri-app/src-tauri/src/local.rs (the desktop app's setup wizard
+# seeds an isolated CLAUDE_HOME the same way).
+CLAUDE_JSON_ALLOW = {
+    "hasCompletedOnboarding",
+    "lastOnboardingVersion",
+    "installMethod",
+    "migrationVersion",
+    "claudeCodeFirstTokenDate",
+    "opusProMigrationComplete",
+    "sonnet1m45MigrationComplete",
+    "lastReleaseNotesSeen",
+    "opus47LaunchSeenCount",
+}
+
+
+def seed_claude_json(src, dst):
+    """Write a minimal .claude.json (dst) from the allowlisted fields of
+    the host file (src). Returns False on any parse/write problem."""
+    try:
+        from painapple_code.paths import lock_mode
+
+        data = json.loads(Path(src).read_text(encoding="utf-8"))
+        subset = {k: data[k] for k in CLAUDE_JSON_ALLOW if k in data}
+        Path(dst).write_text(json.dumps(subset, indent=2), encoding="utf-8")
+        # lock_mode, not chmod: on Windows chmod only toggles the
+        # read-only attribute and reports success, so the 0600 here was
+        # decorative and this file inherited whatever ACEs its parent had.
+        lock_mode(dst, 0o600)
+        return True
+    except (OSError, ValueError):
+        return False

painapple_code/cli/deploy/config.py

@@ -0,0 +1,260 @@
+"""Docker-mode settings: the key model + validation for containerized
+deployments.
+
+There is no separate docker config file anymore. Docker-mode settings
+live in the unified profile store (``profiles/NAME/profile.yaml`` with
+``mode: docker`` — see cli/profiles.py), and the ad-hoc
+``painapple --in-docker`` run assembles its settings from the global
+serve defaults (serve.yaml ``runtime``/``runtime_flags``/``image``)
+plus the serve flags of that invocation.
+
+``DockerSettings`` keeps the KEY-based ``assign()`` validation so
+scripted writers (``painapple profile set``) and the desktop launcher
+accept/reject the same inputs the wizard does.
+"""
+
+import re
+from pathlib import Path
+
+from painapple_code.cli.serve_config import root_home
+
+UPSTREAM_IMAGE = "wrotek/painapple-code"
+DEFAULT_IMAGE = "painapple-code:latest"
+
+WORKSPACE_MODES = ("project", "parent", "multi")
+TLS_MODES = ("auto", "on", "off")
+ACCENT_NAMES = ("blue", "green", "red", "orange", "purple", "cyan")
+_HEX_RE = re.compile(r"^#([0-9a-fA-F]{3}|[0-9a-fA-F]{6})$")
+_IPV4_RE = re.compile(r"^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$")
+
+# Order = order printed by scripted `get` with no args.
+CONFIG_KEYS = (
+    "RUNTIME", "RUNTIME_FLAGS", "WORKSPACE", "WORKSPACE_MODE",
+    "CLAUDE_HOME", "CLAUDE_JSON", "DATA_VOLUME", "CONFIG_VOLUME",
+    "IMAGE", "CONTAINER", "PORT", "LISTEN_HOST", "TLS_MODE",
+    "INSTANCE_NAME", "ACCENT",
+)
+
+# profile.yaml uses the shared serve-key names where a docker setting
+# is the same concept: LISTEN_HOST ↔ host (the bind), TLS_MODE ↔ tls.
+_YAML_NAME = {"LISTEN_HOST": "host", "TLS_MODE": "tls"}
+
+
+def _expand(value):
+    if value in ("~",) or value.startswith("~/"):
+        return str(Path(value).expanduser())
+    return value
+
+
+class ConfigError(ValueError):
+    """Bad key or value in a settings assignment. Message is user-facing."""
+
+
+class DockerSettings:
+    """One containerized deployment's settings, with per-profile
+    collision-free defaults (container name, data volume, global config
+    dir). CLAUDE_HOME defaults to the shared isolated dir for every
+    profile, so one ``claude login`` serves all sandboxes."""
+
+    def __init__(self, profile=None):
+        home = root_home()
+        shared = home / "shared"
+        suffix = f"-{profile}" if profile else ""
+        cfg_dirname = f"docker-{profile}" if profile else "shared"
+        self.runtime = ""            # empty = auto-detect; may be a binary path
+        self.runtime_flags = ""
+        self.workspace = ""
+        self.workspace_mode = "project"
+        self.workspaces = []         # multi mode only
+        self.claude_home = str(shared / ".claude")
+        self.claude_json = ""        # empty = derive ${claude_home}.json
+        self.data_volume = f"painapple-data{suffix}"
+        self.config_volume = str(
+            Path(f"~/.config/painapple-code/{cfg_dirname}").expanduser())
+        self.image = DEFAULT_IMAGE
+        self.container = f"painapple-code{suffix}"
+        self.port = 8765
+        self.listen_host = "127.0.0.1"
+        self.tls_mode = "auto"
+        self.instance_name = ""
+        self.accent = ""
+
+    # ── Derived values ──────────────────────────────────────────────────
+
+    def effective_claude_json(self):
+        return self.claude_json or f"{self.claude_home}.json"
+
+    def effective_tls(self):
+        """Resolve tls_mode 'auto' against the real reachability
+        (listen_host), since the server always binds 0.0.0.0 in-container."""
+        if self.tls_mode != "auto":
+            return self.tls_mode
+        return "off" if self.listen_host in ("127.0.0.1", "::1", "localhost") else "on"
+
+    def data_is_bind(self):
+        return Path(self.data_volume).is_absolute()
+
+    def config_is_bind(self):
+        return Path(self.config_volume).is_absolute()
+
+    def container_mount(self):
+        """In-container mount path — the path hash keys project identity.
+
+        The server itself always serves ``--workspace /workspace`` (the dir
+        that HOLDS projects); modes only differ in what lands where. Project
+        mode therefore mounts the single repo one level down — /workspace
+        acts as a synthetic parent, so the welcome screen offers the repo as
+        one pickable project instead of listing its own subdirs as projects.
+        """
+        if self.workspace_mode in ("parent", "multi"):
+            return "/workspace"
+        return f"/workspace/{Path(self.workspace).name}"
+
+    # ── get/set by KEY ──────────────────────────────────────────────────
+
+    _FIELD_BY_KEY = {k: k.lower() for k in CONFIG_KEYS}
+
+    def get(self, key):
+        if key not in CONFIG_KEYS:
+            raise ConfigError(f"Unknown key: {key}")
+        value = getattr(self, self._FIELD_BY_KEY[key])
+        return str(value)
+
+    def assign(self, key, value):
+        """Validate and set one field. Raises ConfigError with a
+        user-facing message on bad key/value."""
+        if key == "RUNTIME":
+            if value and value not in ("docker", "podman"):
+                # Custom binary: an explicit path must exist + be a file.
+                expanded = _expand(value)
+                if not (Path(expanded).is_absolute() and Path(expanded).is_file()):
+                    raise ConfigError(
+                        "RUNTIME must be 'docker', 'podman', an absolute path "
+                        f"to a runtime binary, or empty to auto-detect: {value}")
+                value = expanded
+            self.runtime = value
+        elif key == "RUNTIME_FLAGS":
+            self.runtime_flags = value
+        elif key == "WORKSPACE":
+            value = _expand(value)
+            if value and not Path(value).is_dir():
+                raise ConfigError(f"WORKSPACE does not exist: {value}")
+            self.workspace = str(Path(value).resolve()) if value else ""
+        elif key == "WORKSPACE_MODE":
+            if value not in WORKSPACE_MODES:
+                raise ConfigError(
+                    f"WORKSPACE_MODE must be 'project', 'parent', or 'multi': {value}")
+            self.workspace_mode = value
+        elif key == "CLAUDE_HOME":
+            value = _expand(value)
+            if not value:
+                raise ConfigError("CLAUDE_HOME can't be empty")
+            # If CLAUDE_JSON was implicitly tracking the previous
+            # CLAUDE_HOME, reset it so it re-derives against the new one.
+            if self.claude_json == f"{self.claude_home}.json":
+                self.claude_json = ""
+            self.claude_home = value
+        elif key == "CLAUDE_JSON":
+            # Empty is meaningful: "derive from CLAUDE_HOME".
+            self.claude_json = _expand(value)
+        elif key in ("DATA_VOLUME", "CONFIG_VOLUME"):
+            value = _expand(value)
+            if not value:
+                raise ConfigError(f"{key} can't be empty")
+            setattr(self, key.lower(), value)
+        elif key in ("IMAGE", "CONTAINER"):
+            if not value:
+                raise ConfigError(f"{key} can't be empty")
+            setattr(self, key.lower(), value)
+        elif key == "PORT":
+            if not value.isdigit() or not 1 <= int(value) <= 65535:
+                raise ConfigError(f"PORT must be 1–65535: {value}")
+            self.port = int(value)
+        elif key == "LISTEN_HOST":
+            if value == "localhost":
+                value = "127.0.0.1"
+            if not _IPV4_RE.match(value):
+                raise ConfigError(
+                    f"LISTEN_HOST must be an IPv4 address (or 'localhost'): {value}")
+            self.listen_host = value
+        elif key == "TLS_MODE":
+            if value not in TLS_MODES:
+                raise ConfigError(f"TLS_MODE must be 'auto', 'on', or 'off': {value}")
+            self.tls_mode = value
+        elif key == "INSTANCE_NAME":
+            if len(value) > 12:
+                raise ConfigError(f"INSTANCE_NAME too long ({len(value)} chars, max 12)")
+            self.instance_name = value
+        elif key == "ACCENT":
+            if value and value not in ACCENT_NAMES and not _HEX_RE.match(value):
+                raise ConfigError(
+                    "ACCENT must be empty, a named color "
+                    f"({'|'.join(ACCENT_NAMES)}), or hex (#RGB / #RRGGBB)")
+            self.accent = value
+        else:
+            raise ConfigError(f"Unknown key: {key}")
+
+
+def flag_to_key(flag):
+    """--listen-host → LISTEN_HOST. Returns None for unknown/non-flags."""
+    if not flag.startswith("--"):
+        return None
+    key = flag[2:].replace("-", "_").upper()
+    return key if key in CONFIG_KEYS else None
+
+
+# ──── profile.yaml (docker mode) mapping ─────────────────────────────────
+
+def settings_to_data(cfg):
+    """DockerSettings → the docker-mode key subset of profile.yaml
+    (shared names for shared concepts: host = bind, tls = tls mode)."""
+    return {
+        "runtime": cfg.runtime,
+        "runtime_flags": cfg.runtime_flags,
+        "workspace": cfg.workspace,
+        "workspace_mode": cfg.workspace_mode,
+        "workspaces": list(cfg.workspaces),
+        "claude_home": cfg.claude_home,
+        "claude_json": cfg.claude_json,
+        "data_volume": cfg.data_volume,
+        "config_volume": cfg.config_volume,
+        "image": cfg.image,
+        "container": cfg.container,
+        "port": cfg.port,
+        "host": cfg.listen_host,
+        "tls": cfg.tls_mode,
+        "instance_name": cfg.instance_name,
+        "accent": cfg.accent,
+    }
+
+
+def settings_from_data(data, profile=None):
+    """profile.yaml data (or a legacy docker.yaml dict) → DockerSettings.
+    Accepts both the unified names (host/tls) and the legacy ones
+    (listen_host/tls_mode). Stale values (e.g. a WORKSPACE dir that no
+    longer exists) are kept verbatim so status/list still show them and
+    an actual start fails with a clear error."""
+    data = data or {}
+    cfg = DockerSettings(profile=profile)
+    aliases = {"host": "LISTEN_HOST", "listen_host": "LISTEN_HOST",
+               "tls": "TLS_MODE", "tls_mode": "TLS_MODE"}
+    for name, raw in data.items():
+        if name == "workspaces":
+            if isinstance(raw, list):
+                cfg.workspaces = [str(w) for w in raw]
+            continue
+        key = aliases.get(name) or (name.upper() if name.upper() in CONFIG_KEYS
+                                    else None)
+        if key is None or raw in (None, ""):
+            continue
+        try:
+            cfg.assign(key, str(raw))
+        except ConfigError:
+            if key == "PORT":
+                try:
+                    cfg.port = int(raw)
+                except (TypeError, ValueError):
+                    pass
+            else:
+                setattr(cfg, key.lower(), str(raw))
+    return cfg