portacode 1.3.32__py3-none-any.whl → 1.4.15.dev3__py3-none-any.whl

portacode/keypair.py

@@ -98,4 +98,66 @@ def fingerprint_public_key(pem: bytes) -> str:
     """Return a short fingerprint for display purposes (SHA-256)."""
     digest = hashes.Hash(hashes.SHA256())
     digest.update(pem)
-    return digest.finalize().hex()[:16] 
+    return digest.finalize().hex()[:16]
+
+
+class InMemoryKeyPair:
+    """Keypair kept purely in memory until explicitly persisted."""
+
+    def __init__(self, private_pem: bytes, public_pem: bytes, key_dir: Path):
+        self._private_pem = private_pem
+        self._public_pem = public_pem
+        self._key_dir = key_dir
+        self._is_new = True
+
+    @property
+    def private_key_pem(self) -> bytes:
+        return self._private_pem
+
+    @property
+    def public_key_pem(self) -> bytes:
+        return self._public_pem
+
+    def sign_challenge(self, challenge: str) -> bytes:
+        private_key = serialization.load_pem_private_key(self._private_pem, password=None)
+        return private_key.sign(
+            challenge.encode(),
+            padding.PKCS1v15(),
+            hashes.SHA256(),
+        )
+
+    def public_key_der_b64(self) -> str:
+        pubkey = serialization.load_pem_public_key(self._public_pem)
+        der = pubkey.public_bytes(
+            encoding=serialization.Encoding.DER,
+            format=serialization.PublicFormat.SubjectPublicKeyInfo,
+        )
+        return base64.b64encode(der).decode()
+
+    def persist(self) -> KeyPair:
+        """Write the keypair to disk and return a regular KeyPair."""
+        key_dir = self._key_dir
+        key_dir.mkdir(parents=True, exist_ok=True)
+        priv_path = key_dir / PRIVATE_KEY_FILE
+        pub_path = key_dir / PUBLIC_KEY_FILE
+        priv_path.write_bytes(self._private_pem)
+        pub_path.write_bytes(self._public_pem)
+        keypair = KeyPair(priv_path, pub_path)
+        keypair._is_new = True  # type: ignore[attr-defined]
+        keypair._key_dir = key_dir  # type: ignore[attr-defined]
+        return keypair
+
+
+def generate_in_memory_keypair() -> InMemoryKeyPair:
+    """Generate a new keypair but keep it in memory until pairing succeeds."""
+    private_pem, public_pem = _generate_keypair()
+    key_dir = get_key_dir()
+    return InMemoryKeyPair(private_pem, public_pem, key_dir)
+
+
+def keypair_files_exist() -> bool:
+    """Return True if the persisted keypair already exists on disk."""
+    key_dir = get_key_dir()
+    priv_path = key_dir / PRIVATE_KEY_FILE
+    pub_path = key_dir / PUBLIC_KEY_FILE
+    return priv_path.exists() and pub_path.exists()

portacode/link_capture/__init__.py

@@ -0,0 +1,38 @@
+"""Helpers for the link capture wrapper scripts."""
+
+import shutil
+import tempfile
+from pathlib import Path
+from typing import Optional
+
+try:
+    # Use the stdlib helpers when they are available (Python ≥3.9).
+    from importlib.resources import as_file, files
+except ImportError:  # pragma: no cover
+    # Fall back to the backport for older Python 3.x runtimes (>=3.6).
+    from importlib_resources import as_file, files
+
+_LINK_CAPTURE_TEMP_DIR: Optional[Path] = None
+
+
+def prepare_link_capture_bin() -> Optional[Path]:
+    """Extract the packaged link capture wrappers into a temporary dir and return it."""
+    global _LINK_CAPTURE_TEMP_DIR
+    if _LINK_CAPTURE_TEMP_DIR:
+        return _LINK_CAPTURE_TEMP_DIR
+
+    bin_source = files(__package__) / "bin"
+    if not bin_source.is_dir():
+        return None
+
+    temp_dir = Path(tempfile.mkdtemp(prefix="portacode-link-capture-"))
+    for entry in bin_source.iterdir():
+        if not entry.is_file():
+            continue
+        with as_file(entry) as file_path:
+            dest = temp_dir / entry.name
+            shutil.copyfile(file_path, dest)
+            dest.chmod(dest.stat().st_mode | 0o111)
+
+    _LINK_CAPTURE_TEMP_DIR = temp_dir
+    return _LINK_CAPTURE_TEMP_DIR

portacode/link_capture/bin/elinks

@@ -0,0 +1,3 @@
+#!/bin/sh
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+exec "$SCRIPT_DIR/link_capture_exec.sh" elinks "$@"

portacode/link_capture/bin/gio-open

@@ -0,0 +1,3 @@
+#!/bin/sh
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+exec "$SCRIPT_DIR/link_capture_exec.sh" gio-open "$@"

portacode/link_capture/bin/gnome-open

@@ -0,0 +1,3 @@
+#!/bin/sh
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+exec "$SCRIPT_DIR/link_capture_exec.sh" gnome-open "$@"

portacode/link_capture/bin/gvfs-open

@@ -0,0 +1,3 @@
+#!/bin/sh
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+exec "$SCRIPT_DIR/link_capture_exec.sh" gvfs-open "$@"

portacode/link_capture/bin/kde-open

@@ -0,0 +1,3 @@
+#!/bin/sh
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+exec "$SCRIPT_DIR/link_capture_exec.sh" kde-open "$@"

portacode/link_capture/bin/kfmclient

@@ -0,0 +1,3 @@
+#!/bin/sh
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+exec "$SCRIPT_DIR/link_capture_exec.sh" kfmclient "$@"

portacode/link_capture/bin/link_capture_exec.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+COMMAND_NAME="$1"
+shift
+
+if [ -z "$COMMAND_NAME" ]; then
+  echo "link_capture: missing command name" >&2
+  exit 1
+fi
+
+exec "$SCRIPT_DIR/link_capture_wrapper.py" "$COMMAND_NAME" "$@"

portacode/link_capture/bin/link_capture_wrapper.py

@@ -0,0 +1,75 @@
+#!/usr/bin/env python3
+"""Simple link capture wrapper that never executes a native browser."""
+
+import json
+import os
+import sys
+import time
+import uuid
+from pathlib import Path
+from urllib.parse import urlparse
+
+LINK_CHANNEL_ENV = "PORTACODE_LINK_CHANNEL"
+TERMINAL_ID_ENV = "PORTACODE_TERMINAL_ID"
+
+
+def _find_link_argument(args):
+    for arg in args:
+        if not isinstance(arg, str):
+            continue
+        parsed = urlparse(arg)
+        if parsed.scheme and parsed.netloc:
+            return arg
+        if arg.startswith("file://"):
+            return arg
+    return None
+
+
+def _write_capture_event(cmd_name, args, link):
+    channel = os.environ.get(LINK_CHANNEL_ENV)
+    terminal_id = os.environ.get(TERMINAL_ID_ENV)
+    if not channel or not link:
+        return
+    payload = {
+        "terminal_id": terminal_id,
+        "command": cmd_name,
+        "args": args,
+        "url": link,
+        "timestamp": time.time(),
+    }
+    directory = Path(channel)
+    try:
+        directory.mkdir(parents=True, exist_ok=True)
+    except Exception:
+        return
+    temp_file = directory / f".{uuid.uuid4().hex}.tmp"
+    term_label = terminal_id or "unknown"
+    base_name = f"{int(time.time() * 1000)}-{term_label}"
+    final_file = directory / f"{base_name}.json"
+    suffix = 0
+    while final_file.exists():
+        suffix += 1
+        final_file = directory / f"{base_name}-{suffix}.json"
+    try:
+        temp_file.write_text(json.dumps(payload), encoding="utf-8")
+        temp_file.replace(final_file)
+    except Exception:
+        if temp_file.exists():
+            temp_file.unlink(missing_ok=True)
+
+
+def main() -> None:
+    if len(sys.argv) < 2:
+        sys.stderr.write("link_capture: missing target command name\n")
+        sys.exit(1)
+    cmd_name = sys.argv[1]
+    cmd_args = sys.argv[2:]
+    link = _find_link_argument(cmd_args)
+    if link:
+        _write_capture_event(cmd_name, cmd_args, link)
+    # Never run a real browser; capture and exit successfully.
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

portacode/link_capture/bin/links

@@ -0,0 +1,3 @@
+#!/bin/sh
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+exec "$SCRIPT_DIR/link_capture_exec.sh" links "$@"

portacode/link_capture/bin/links2

@@ -0,0 +1,3 @@
+#!/bin/sh
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+exec "$SCRIPT_DIR/link_capture_exec.sh" links2 "$@"

portacode/link_capture/bin/lynx

@@ -0,0 +1,3 @@
+#!/bin/sh
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+exec "$SCRIPT_DIR/link_capture_exec.sh" lynx "$@"

portacode/link_capture/bin/mate-open

@@ -0,0 +1,3 @@
+#!/bin/sh
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+exec "$SCRIPT_DIR/link_capture_exec.sh" mate-open "$@"

portacode/link_capture/bin/netsurf

@@ -0,0 +1,3 @@
+#!/bin/sh
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+exec "$SCRIPT_DIR/link_capture_exec.sh" netsurf "$@"

portacode/link_capture/bin/sensible-browser

@@ -0,0 +1,3 @@
+#!/bin/sh
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+exec "$SCRIPT_DIR/link_capture_exec.sh" sensible-browser "$@"

portacode/link_capture/bin/w3m

@@ -0,0 +1,3 @@
+#!/bin/sh
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+exec "$SCRIPT_DIR/link_capture_exec.sh" w3m "$@"

portacode/link_capture/bin/x-www-browser

@@ -0,0 +1,3 @@
+#!/bin/sh
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+exec "$SCRIPT_DIR/link_capture_exec.sh" x-www-browser "$@"

portacode/link_capture/bin/xdg-open

@@ -0,0 +1,3 @@
+#!/bin/sh
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+exec "$SCRIPT_DIR/link_capture_exec.sh" xdg-open "$@"

portacode/pairing.py

@@ -0,0 +1,103 @@
+from __future__ import annotations
+
+import asyncio
+import json
+import os
+import socket
+from dataclasses import dataclass
+from typing import Optional
+
+import websockets
+
+PAIRING_URL_ENV = "PORTACODE_PAIRING_URL"
+DEFAULT_PAIRING_URL = "wss://portacode.com/ws/pairing/device/"
+
+
+class PairingError(Exception):
+    """Raised when pairing fails or is rejected."""
+
+
+@dataclass
+class PairingResult:
+    status: str
+    payload: dict
+
+
+async def _pair_device(
+    url: str,
+    public_key_b64: str,
+    pairing_code: str,
+    device_name: str,
+    project_paths: list[str] | None = None,
+    timeout: float = 300.0,
+) -> PairingResult:
+    async with websockets.connect(url) as ws:
+        # Initial ready/event
+        try:
+            ready = await asyncio.wait_for(ws.recv(), timeout=10)
+        except asyncio.TimeoutError as exc:
+            raise PairingError("Gateway did not acknowledge pairing request") from exc
+
+        try:
+            data = json.loads(ready)
+            if data.get("event") != "pairing_ready":
+                raise PairingError(f"Unexpected response from pairing gateway: {ready}")
+        except json.JSONDecodeError:
+            raise PairingError(f"Unexpected response from pairing gateway: {ready}") from None
+
+        payload = {
+            "code": pairing_code,
+            "device_name": device_name,
+            "public_key": public_key_b64,
+        }
+        if project_paths:
+            payload["project_paths"] = project_paths
+        await ws.send(json.dumps(payload))
+
+        while True:
+            try:
+                message = await asyncio.wait_for(ws.recv(), timeout=timeout)
+            except asyncio.TimeoutError as exc:
+                raise PairingError("Pairing timed out waiting for approval") from exc
+
+            try:
+                data = json.loads(message)
+            except json.JSONDecodeError:
+                continue
+
+            if data.get("event") != "pairing_status":
+                continue
+
+            status = data.get("status")
+            if status == "pending":
+                continue
+            if status == "approved":
+                return PairingResult(status="approved", payload=data)
+            reason = data.get("reason") or status or "unknown_error"
+            raise PairingError(reason)
+
+
+def pair_device_with_code(
+    keypair,
+    pairing_code: str,
+    device_name: Optional[str] = None,
+    project_paths: list[str] | None = None,
+    *,
+    timeout: float = 300.0,
+) -> PairingResult:
+    """Run the pairing workflow synchronously."""
+    pairing_url = os.getenv(PAIRING_URL_ENV, DEFAULT_PAIRING_URL)
+    normalized_url = pairing_url if pairing_url.startswith("ws") else f"wss://{pairing_url.lstrip('/')}"
+    friendly_name = device_name or socket.gethostname() or "Portacode Device"
+
+    public_key_b64 = keypair.public_key_der_b64()
+    return asyncio.run(
+        _pair_device(
+            normalized_url,
+            public_key_b64=public_key_b64,
+            pairing_code=pairing_code,
+            device_name=friendly_name,
+            project_paths=project_paths,
+            timeout=timeout,
+        )
+    )

portacode/static/js/utils/ntp-clock.js

@@ -1,86 +1,74 @@
 /**
  * NTP Clock - Synchronized time source for distributed tracing
  *
- * Provides NTP-synchronized timestamps for accurate distributed tracing.
- * Uses HTTP-based time API since browsers cannot make UDP NTP requests.
- *
- * IMPORTANT: All entities (client, server, device) MUST sync to time.cloudflare.com
- * If sync fails, timestamps will be null to indicate sync failure.
+ * Provides synchronization by requesting the server clock across the WebSocket
+ * channel defined in `WEBSOCKET_PROTOCOL`. The client measures round-trip time
+ * and applies an offset that compensates for latency before exposing timestamps.
  */
 class NTPClock {
     constructor() {
-        this.ntpServer = 'time.cloudflare.com';  // Hardcoded - no fallback
-        this.offset = null;  // Offset from local clock to NTP time (milliseconds), null if not synced
+        this.ntpServer = 'portacode-gateway';
+        this.offset = null;
         this.lastSync = null;
-        this.syncInterval = 5 * 60 * 1000;  // Re-sync every 5 minutes
-        this._syncInProgress = false;
-        this._syncAttempts = 0;
-        this._maxSyncAttempts = 3;
+        this.lastLatencyMs = null;
+        this.syncInterval = 60 * 1000;
+        this.clockSyncTimeout = 20 * 1000;
+        this.maxSyncFailures = 3;
+
+        this._clockSyncSender = null;
+        this._failureCallback = null;
+        this._clockSyncTimer = null;
+        this._clockSyncTimeoutHandle = null;
+        this._pendingRequest = null;
+        this._autoSyncStarted = false;
+        this._clockSyncFailures = 0;
     }
 
     /**
-     * Parse Cloudflare trace response to extract timestamp
+     * Register the function responsible for piping `clock_sync_request`
+     * packets over the dashboard WebSocket.
      */
-    _parseCloudflareTime(text) {
-        const tsMatch = text.match(/ts=([\d.]+)/);
-        if (tsMatch) {
-            return parseFloat(tsMatch[1]) * 1000;  // Convert to milliseconds
+    setClockSyncSender(sender) {
+        this._clockSyncSender = sender;
+        if (this._autoSyncStarted && !this._pendingRequest) {
+            this._scheduleSync(0);
         }
-        throw new Error('Failed to parse Cloudflare timestamp');
     }
 
     /**
-     * Synchronize with Cloudflare NTP via HTTP
+     * Callback invoked when multiple sync failures occur in a row.
+     * Useful for triggering a transport reconnect.
      */
-    async sync() {
-        if (this._syncInProgress) {
-            console.log('NTP sync already in progress, skipping');
-            return false;
-        }
-
-        this._syncInProgress = true;
-        this._syncAttempts++;
-
-        try {
-            // Capture local time BEFORE the fetch to avoid timing drift
-            const localTimeBeforeFetch = Date.now();
-            const t0 = performance.now();
-            const response = await fetch('https://cloudflare.com/cdn-cgi/trace');
-            const t1 = performance.now();
-
-            const text = await response.text();
-            const serverTime = this._parseCloudflareTime(text);
-
-            const latency = (t1 - t0) / 2;  // Estimate one-way latency
-
-            // Calculate offset: server generated timestamp at local time (localTimeBeforeFetch + latency)
-            // So offset = serverTime - (localTimeBeforeFetch + latency)
-            this.offset = serverTime - (localTimeBeforeFetch + latency);
-            this.lastSync = Date.now();
-
-            console.log(
-                `✅ NTP sync successful: offset=${this.offset.toFixed(2)}ms, ` +
-                `latency=${latency.toFixed(2)}ms, server=${this.ntpServer}`
-            );
-
-            this._syncAttempts = 0;  // Reset on success
-            return true;
-
-        } catch (error) {
-            console.warn(`❌ NTP sync failed (attempt ${this._syncAttempts}/${this._maxSyncAttempts}):`, error);
+    onClockSyncFailure(callback) {
+        this._failureCallback = callback;
+    }
 
-            // If all attempts fail, set offset to null to indicate sync failure
-            if (this._syncAttempts >= this._maxSyncAttempts) {
-                this.offset = null;
-                this.lastSync = null;
-                console.error(`⚠️  NTP sync failed after ${this._maxSyncAttempts} attempts. Timestamps will be null.`);
-                this._syncAttempts = 0;
-            }
+    /**
+     * Start the auto-sync loop (idempotent). Will skip sending until a sender
+     * has been registered.
+     */
+    startAutoSync() {
+        if (this._autoSyncStarted) {
+            return;
+        }
+        this._autoSyncStarted = true;
+        this._scheduleSync(0);
+    }
 
-            return false;
-        } finally {
-            this._syncInProgress = false;
+    /**
+     * Stop the auto-sync loop (used primarily in tests).
+     */
+    stopAutoSync() {
+        this._autoSyncStarted = false;
+        if (this._clockSyncTimer) {
+            clearTimeout(this._clockSyncTimer);
+            this._clockSyncTimer = null;
         }
+        this._clearPendingRequest();
+    }
+
+    sync() {
+        return this._performClockSync();
     }
 
     /**
@@ -106,31 +94,134 @@ class NTPClock {
         return new Date(ts).toISOString();
     }
 
-    /**
-     * Get sync status for debugging
-     */
+    handleServerSync(payload) {
+        if (!payload) {
+            return;
+        }
+        const receiveTime = Date.now();
+        let roundTrip = 0;
+        if (
+            payload.request_id &&
+            this._pendingRequest &&
+            payload.request_id === this._pendingRequest.requestId
+        ) {
+            roundTrip = Math.max(receiveTime - this._pendingRequest.sentAt, 0);
+            this._clockSyncFailures = 0;
+            this._clearPendingRequest();
+        }
+        const serverSend = typeof payload.server_send_time === 'number' ? payload.server_send_time : payload.server_time;
+        const serverReceive = payload.server_receive_time;
+        const serverAvg = (typeof serverReceive === 'number' && typeof serverSend === 'number')
+            ? (serverReceive + serverSend) / 2
+            : typeof serverSend === 'number'
+                ? serverSend
+                : undefined;
+        if (typeof serverAvg === 'number') {
+            this.updateFromServer(serverAvg, roundTrip);
+        }
+        if (payload.server_time_iso) {
+            this.serverTimeIso = payload.server_time_iso;
+        }
+        this._scheduleSync(this.syncInterval);
+    }
+
+    applyServerSync(payload) {
+        this.handleServerSync(payload);
+    }
+
+    updateFromServer(serverTimeMs, roundTripMs = 0) {
+        const receiveTime = Date.now();
+        const halfLatency = (roundTripMs || 0) / 2;
+        const estimatedServerReceived = receiveTime - halfLatency;
+        this.offset = serverTimeMs - estimatedServerReceived;
+        this.lastLatencyMs = roundTripMs;
+        this.lastSync = receiveTime;
+    }
+
     getStatus() {
         return {
             server: this.ntpServer,
             offset: this.offset,
             lastSync: this.lastSync ? new Date(this.lastSync).toISOString() : null,
+            lastLatencyMs: this.lastLatencyMs,
             timeSinceSync: this.lastSync ? Date.now() - this.lastSync : null,
             isSynced: this.offset !== null
         };
     }
 
-    /**
-     * Start automatic periodic synchronization
-     */
-    startAutoSync() {
-        // Initial sync
-        this.sync();
-
-        // Periodic re-sync
-        setInterval(() => {
-            console.log('🔄 Starting periodic NTP sync...');
-            this.sync();
-        }, this.syncInterval);
+    _scheduleSync(delay) {
+        if (!this._autoSyncStarted) {
+            return;
+        }
+        if (this._clockSyncTimer) {
+            clearTimeout(this._clockSyncTimer);
+        }
+        this._clockSyncTimer = setTimeout(() => this._performClockSync(), delay);
+    }
+
+    _performClockSync() {
+        if (!this._autoSyncStarted) {
+            return false;
+        }
+        if (!this._clockSyncSender) {
+            this._scheduleSync(Math.min(this.syncInterval, 3000));
+            return false;
+        }
+        if (this._pendingRequest) {
+            return false;
+        }
+        const requestId = this._generateRequestId();
+        const payload = {
+            event: 'clock_sync_request',
+            request_id: requestId,
+        };
+        this._pendingRequest = {
+            requestId,
+            sentAt: Date.now(),
+        };
+        const sent = this._clockSyncSender(payload);
+        if (!sent) {
+            this._handleClockSyncFailure();
+            return false;
+        }
+        this._clockSyncTimeoutHandle = setTimeout(() => this._handleClockSyncTimeout(), this.clockSyncTimeout);
+        return true;
+    }
+
+    _handleClockSyncTimeout() {
+        this._clockSyncFailures += 1;
+        this._clearPendingRequest();
+        if (
+            this._clockSyncFailures >= this.maxSyncFailures &&
+            typeof this._failureCallback === 'function'
+        ) {
+            this._failureCallback();
+        }
+        this._scheduleSync(this.syncInterval);
+    }
+
+    _handleClockSyncFailure() {
+        this._clockSyncFailures += 1;
+        this._clearPendingRequest();
+        if (
+            this._clockSyncFailures >= this.maxSyncFailures &&
+            typeof this._failureCallback === 'function'
+        ) {
+            this._failureCallback();
+        }
+        this._scheduleSync(this.syncInterval);
+    }
+
+    _clearPendingRequest() {
+        if (this._clockSyncTimeoutHandle) {
+            clearTimeout(this._clockSyncTimeoutHandle);
+            this._clockSyncTimeoutHandle = null;
+        }
+        this._pendingRequest = null;
+    }
+
+    _generateRequestId() {
+        return `clock_sync:${Date.now()}:${Math.floor(Math.random() * 1000000)}`;
     }
 }