portacode 1.4.12.dev9__tar.gz → 1.4.15.dev0__tar.gz

{portacode-1.4.12.dev9 → portacode-1.4.15.dev0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: portacode
-Version: 1.4.12.dev9
+Version: 1.4.15.dev0
 Summary: Portacode CLI client and SDK
 Home-page: https://github.com/portacode/portacode
 Author: Meena Erian

{portacode-1.4.12.dev9 → portacode-1.4.15.dev0}/portacode/_version.py

@@ -28,7 +28,7 @@ version_tuple: VERSION_TUPLE
 commit_id: COMMIT_ID
 __commit_id__: COMMIT_ID
 
-__version__ = version = '1.4.12.dev9'
-__version_tuple__ = version_tuple = (1, 4, 12, 'dev9')
+__version__ = version = '1.4.15.dev0'
+__version_tuple__ = version_tuple = (1, 4, 15, 'dev0')
 
 __commit_id__ = commit_id = None

{portacode-1.4.12.dev9 → portacode-1.4.15.dev0}/portacode/connection/handlers/WEBSOCKET_PROTOCOL.md

@@ -326,9 +326,10 @@ Configures a Proxmox node for Portacode infrastructure usage (API token validati
 
 **Payload Fields:**
 
-*   `token_identifier` (string, required): API token identifier in the form `user@realm!tokenid`.
-*   `token_value` (string, required): Secret value associated with the token.
-*   `verify_ssl` (boolean, optional): When true, the handler verifies SSL certificates; defaults to `false`.
+*   `token_identifier` (string, optional when reconfiguring): API token identifier in the form `user@realm!tokenid`. Required on first configuration or when replacing the stored token.
+*   `token_value` (string, optional when reconfiguring): Secret value associated with the token. Required when `token_identifier` is supplied.
+*   `verify_ssl` (boolean, optional): When true, the handler verifies SSL certificates; defaults to `false`. When omitted, the last configured value is preserved.
+*   `cloudflare_api_token` (string, optional): Cloudflare API token the host can reuse later to provision tunnels.
 
 **Responses:**
 
@@ -361,6 +362,9 @@ Creates a Portacode-managed LXC container, starts it, and bootstraps the Portaco
 *   `username` (string, optional): OS user to provision (defaults to `svcuser`).
 *   `password` (string, optional): Password for the user (used only during provisioning).
 *   `ssh_key` (string, optional): SSH public key to add to the user.
+*   `device_id` (string, optional): ID of the Device record that already exists on the dashboard.
+*   `device_public_key` (string, optional): PEM-encoded Portacode public key. When supplied together with `device_private_key` the handler injects the keypair, records the device metadata, and runs `portacode service install` automatically.
+*   `device_private_key` (string, optional): PEM-encoded private key that pairs with `device_public_key`. Both key fields must be present for the automatic service-install mode.
 
 **Responses:**
 
@@ -418,6 +422,8 @@ Emitted after a successful `create_proxmox_container` action. Contains the new c
 *   `public_key` (string): Portacode public auth key created inside the new container.
 *   `container` (object): Metadata such as `vmid`, `hostname`, `template`, `storage`, `disk_gib`, `ram_mib`, and `cpus`.
 *   `setup_steps` (array[object]): Detailed bootstrap step results (name, stdout/stderr, elapsed time, and status).
+*   `device_id` (string, optional): Mirrors the `device_id` supplied with `create_proxmox_container`, if any.
+*   `service_installed` (boolean): True when the handler already ran `portacode service install` (with a provided keypair); otherwise it remains False and the dashboard can call `start_portacode_service`.
 
 ### `proxmox_container_progress`
 
@@ -450,6 +456,7 @@ Runs `sudo portacode service install` inside the container after the dashboard h
 *   Emits additional [`proxmox_container_progress`](#proxmox_container_progress-event) events to report the authentication and service-install steps.
 *   On success, emits a [`proxmox_service_started`](#proxmox_service_started-event).
 *   On failure, emits a generic [`error`](#error) event.
+*   When `create_proxmox_container` already provided a dashboard-generated keypair, the handler may have installed the service already, so this call is optional unless you need to re-run the install.
 
 ### `proxmox_service_started`
 
@@ -1120,6 +1127,8 @@ Provides system information in response to a `system_info` action. Handled by [`
                     *   `message` (string|null): Informational text about the network setup attempt.
                     *   `bridge` (string): The bridge interface configured (typically `vmbr1`).
                     *   `health` (string|null): `"healthy"` when the connectivity verification succeeded.
+                *   `cloudflare` (object): Optional Cloudflare metadata collected for future tunnels:
+                    *   `configured` (boolean): True when a Cloudflare API token is stored.
                 *   `node_status` (object|null): Status response returned by the Proxmox API when validating the token.
                 *   `managed_containers` (object): Cached summary of the Portacode-managed containers:
                     *   `updated_at` (string): ISO timestamp when this snapshot was last refreshed.

{portacode-1.4.12.dev9 → portacode-1.4.15.dev0}/portacode/connection/handlers/proxmox_infra.py

@@ -7,15 +7,17 @@ import json
 import logging
 import os
 import secrets
+import shlex
 import shutil
 import stat
 import subprocess
 import sys
+import tempfile
 import time
 import threading
 from datetime import datetime
 from pathlib import Path
-from typing import Any, Callable, Dict, Iterable, List, Optional, Tuple
+from typing import Any, Callable, Dict, Iterable, List, Optional, Sequence, Tuple
 
 import platformdirs
 
@@ -261,7 +263,10 @@ def _ensure_bridge(bridge: str = DEFAULT_BRIDGE) -> Dict[str, Any]:
         apt = shutil.which("apt-get")
         if not apt:
             raise RuntimeError("dnsmasq is missing and apt-get unavailable to install it")
-        _call_subprocess([apt, "update"], check=True)
+        update = _call_subprocess([apt, "update"], check=False)
+        if update.returncode not in (0, 100):
+            msg = update.stderr or update.stdout or f"exit status {update.returncode}"
+            raise RuntimeError(f"apt-get update failed: {msg}")
         _call_subprocess([apt, "install", "-y", "dnsmasq"], check=True)
     _write_bridge_config(bridge)
     _ensure_sysctl()
@@ -428,7 +433,12 @@ def _friendly_step_label(step_name: str) -> str:
     return normalized.capitalize()
 
 
-def _build_bootstrap_steps(user: str, password: str, ssh_key: str) -> List[Dict[str, Any]]:
+def _build_bootstrap_steps(
+    user: str,
+    password: str,
+    ssh_key: str,
+    include_portacode_connect: bool = True,
+) -> List[Dict[str, Any]]:
     steps = [
         {
             "name": "apt_update",
@@ -465,11 +475,14 @@ def _build_bootstrap_steps(user: str, password: str, ssh_key: str) -> List[Dict[
             "cmd": f"install -d -m 700 /home/{user}/.ssh && echo '{ssh_key}' >> /home/{user}/.ssh/authorized_keys && chown -R {user}:{user} /home/{user}/.ssh",
             "retries": 0,
         })
-    steps.extend([
-        {"name": "pip_upgrade", "cmd": "python3 -m pip install --upgrade pip", "retries": 0},
-        {"name": "install_portacode", "cmd": "python3 -m pip install --upgrade portacode", "retries": 0},
-        {"name": "portacode_connect", "type": "portacode_connect", "timeout_s": 30},
-    ])
+    steps.extend(
+        [
+            {"name": "pip_upgrade", "cmd": "python3 -m pip install --upgrade pip", "retries": 0},
+            {"name": "install_portacode", "cmd": "python3 -m pip install --upgrade portacode", "retries": 0},
+        ]
+    )
+    if include_portacode_connect:
+        steps.append({"name": "portacode_connect", "type": "portacode_connect", "timeout_s": 30})
     return steps
 
 
@@ -679,6 +692,74 @@ def _run_pct_check(vmid: int, cmd: str) -> Dict[str, Any]:
     return res
 
 
+def _run_pct_exec(vmid: int, command: Sequence[str]) -> subprocess.CompletedProcess[str]:
+    return _call_subprocess(["pct", "exec", str(vmid), "--", *command])
+
+
+def _run_pct_exec_check(vmid: int, command: Sequence[str]) -> subprocess.CompletedProcess[str]:
+    res = _run_pct_exec(vmid, command)
+    if res.returncode != 0:
+        raise RuntimeError(res.stderr or res.stdout or f"pct exec {' '.join(command)} failed")
+    return res
+
+
+def _run_pct_push(vmid: int, src: str, dest: str) -> subprocess.CompletedProcess[str]:
+    return _call_subprocess(["pct", "push", str(vmid), src, dest])
+
+
+def _push_bytes_to_container(
+    vmid: int, user: str, path: str, data: bytes, mode: int = 0o600
+) -> None:
+    logger.debug("Preparing to push %d bytes to container vmid=%s path=%s for user=%s", len(data), vmid, path, user)
+    tmp_path: Optional[str] = None
+    try:
+        parent = Path(path).parent
+        parent_str = parent.as_posix()
+        if parent_str not in {"", ".", "/"}:
+            _run_pct_exec_check(vmid, ["mkdir", "-p", parent_str])
+            _run_pct_exec_check(vmid, ["chown", "-R", f"{user}:{user}", parent_str])
+
+        with tempfile.NamedTemporaryFile(delete=False) as tmp:
+            tmp.write(data)
+            tmp.flush()
+            os.fsync(tmp.fileno())
+            tmp_path = tmp.name
+
+        push_res = _run_pct_push(vmid, tmp_path, path)
+        if push_res.returncode != 0:
+            raise RuntimeError(push_res.stderr or push_res.stdout or f"pct push returned {push_res.returncode}")
+
+        _run_pct_exec_check(vmid, ["chown", f"{user}:{user}", path])
+        _run_pct_exec_check(vmid, ["chmod", format(mode, "o"), path])
+        logger.debug("Successfully pushed %d bytes to vmid=%s path=%s", len(data), vmid, path)
+    except Exception as exc:
+        logger.error("Failed to write to container vmid=%s path=%s for user=%s: %s", vmid, path, user, exc)
+        raise
+    finally:
+        if tmp_path:
+            try:
+                os.remove(tmp_path)
+            except OSError as cleanup_exc:
+                logger.warning("Failed to remove temporary file %s: %s", tmp_path, cleanup_exc)
+
+
+def _resolve_portacode_key_dir(vmid: int, user: str) -> str:
+    data_dir_cmd = f"su - {user} -c 'echo -n ${{XDG_DATA_HOME:-$HOME/.local/share}}'"
+    data_home = _run_pct_check(vmid, data_dir_cmd)["stdout"].strip()
+    portacode_dir = f"{data_home}/portacode"
+    _run_pct_exec_check(vmid, ["mkdir", "-p", portacode_dir])
+    _run_pct_exec_check(vmid, ["chown", "-R", f"{user}:{user}", portacode_dir])
+    return f"{portacode_dir}/keys"
+
+
+def _deploy_device_keypair(vmid: int, user: str, private_key: str, public_key: str) -> None:
+    key_dir = _resolve_portacode_key_dir(vmid, user)
+    priv_path = f"{key_dir}/id_portacode"
+    pub_path = f"{key_dir}/id_portacode.pub"
+    _push_bytes_to_container(vmid, user, priv_path, private_key.encode(), mode=0o600)
+    _push_bytes_to_container(vmid, user, pub_path, public_key.encode(), mode=0o644)
+
+
 def _portacode_connect_and_read_key(vmid: int, user: str, timeout_s: int = 10) -> Dict[str, Any]:
     cmd = ["pct", "exec", str(vmid), "--", "bash", "-lc", f"su - {user} -c 'portacode connect'"]
     proc = subprocess.Popen(cmd, text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
@@ -880,6 +961,7 @@ def _bootstrap_portacode(
     progress_callback: Optional[ProgressCallback] = None,
     start_index: int = 1,
     total_steps: Optional[int] = None,
+    default_public_key: Optional[str] = None,
 ) -> Tuple[str, List[Dict[str, Any]]]:
     actual_steps = steps if steps is not None else _build_bootstrap_steps(user, password, ssh_key)
     results, ok = _run_setup_steps(
@@ -897,21 +979,38 @@ def _bootstrap_portacode(
         history_snippet = ""
         if isinstance(history, list) and history:
             history_snippet = f" history={history[-3:]}"
+        command = details.get("cmd")
+        command_text = ""
+        if command:
+            if isinstance(command, (list, tuple)):
+                command_text = shlex.join(str(entry) for entry in command)
+            else:
+                command_text = str(command)
+        command_suffix = f" command={command_text}" if command_text else ""
         if summary:
             logger.warning(
-                "Portacode bootstrap failure summary=%s%s",
+                "Portacode bootstrap failure summary=%s%s%s",
                 summary,
                 f" history_len={len(history)}" if history else "",
+                f" command={command_text}" if command_text else "",
+            )
+            raise RuntimeError(
+                f"Portacode bootstrap steps failed: {summary}{history_snippet}{command_suffix}"
             )
-            raise RuntimeError(f"Portacode bootstrap steps failed: {summary}{history_snippet}")
         raise RuntimeError("Portacode bootstrap steps failed.")
     key_step = next((entry for entry in results if entry.get("name") == "portacode_connect"), None)
-    public_key = key_step.get("public_key") if key_step else None
+    public_key = key_step.get("public_key") if key_step else default_public_key
     if not public_key:
         raise RuntimeError("Portacode connect did not return a public key.")
     return public_key, results
 
 
+def _build_cloudflare_snapshot(cloudflare_config: Dict[str, Any] | None) -> Dict[str, Any]:
+    if not cloudflare_config:
+        return {"configured": False}
+    return {"configured": bool(cloudflare_config.get("api_token"))}
+
+
 def build_snapshot(config: Dict[str, Any]) -> Dict[str, Any]:
     network = config.get("network", {})
     base_network = {
@@ -919,8 +1018,13 @@ def build_snapshot(config: Dict[str, Any]) -> Dict[str, Any]:
         "message": network.get("message"),
         "bridge": network.get("bridge", DEFAULT_BRIDGE),
     }
+    cloudflare_snapshot = _build_cloudflare_snapshot(config.get("cloudflare"))
     if not config:
-        return {"configured": False, "network": base_network}
+        return {
+            "configured": False,
+            "network": base_network,
+            "cloudflare": cloudflare_snapshot,
+        }
     return {
         "configured": True,
         "host": config.get("host"),
@@ -931,18 +1035,54 @@ def build_snapshot(config: Dict[str, Any]) -> Dict[str, Any]:
         "templates": config.get("templates") or [],
         "last_verified": config.get("last_verified"),
         "network": base_network,
+        "cloudflare": cloudflare_snapshot,
     }
 
 
-def configure_infrastructure(token_identifier: str, token_value: str, verify_ssl: bool = False) -> Dict[str, Any]:
+def _resolve_proxmox_credentials(
+    token_identifier: Optional[str],
+    token_value: Optional[str],
+    existing: Dict[str, Any],
+) -> Tuple[str, str, str]:
+    if token_identifier:
+        if not token_value:
+            raise ValueError("token_value is required when providing a new token_identifier")
+        user, token_name = _parse_token(token_identifier)
+        return user, token_name, token_value
+    if existing and existing.get("user") and existing.get("token_name") and existing.get("token_value"):
+        return existing["user"], existing["token_name"], existing["token_value"]
+    raise ValueError("Proxmox token identifier and value are required when no existing configuration is available")
+
+
+def _build_cloudflare_config(existing: Dict[str, Any], api_token: Optional[str]) -> Dict[str, Any]:
+    cloudflare: Dict[str, Any] = dict(existing.get("cloudflare", {}) or {})
+    if api_token:
+        cloudflare["api_token"] = api_token
+    if cloudflare.get("api_token"):
+        cloudflare["configured"] = True
+    elif "configured" in cloudflare:
+        cloudflare.pop("configured", None)
+    return cloudflare
+
+
+def configure_infrastructure(
+    token_identifier: Optional[str] = None,
+    token_value: Optional[str] = None,
+    verify_ssl: Optional[bool] = None,
+    cloudflare_api_token: Optional[str] = None,
+) -> Dict[str, Any]:
     ProxmoxAPI = _ensure_proxmoxer()
-    user, token_name = _parse_token(token_identifier)
+    existing = _load_config()
+    user, token_name, resolved_token_value = _resolve_proxmox_credentials(
+        token_identifier, token_value, existing
+    )
+    actual_verify_ssl = verify_ssl if verify_ssl is not None else existing.get("verify_ssl", False)
     client = ProxmoxAPI(
         DEFAULT_HOST,
         user=user,
         token_name=token_name,
-        token_value=token_value,
-        verify_ssl=verify_ssl,
+        token_value=resolved_token_value,
+        verify_ssl=actual_verify_ssl,
         timeout=30,
     )
     node = _pick_node(client)
@@ -950,35 +1090,35 @@ def configure_infrastructure(token_identifier: str, token_value: str, verify_ssl
     storages = client.nodes(node).storage.get()
     default_storage = _pick_storage(storages)
     templates = _list_templates(client, node, storages)
-    network: Dict[str, Any] = {}
-    try:
-        network = _ensure_bridge()
-        # Wait for network convergence before validating connectivity
-        time.sleep(2)
-        if _verify_connectivity():
+    network = dict(existing.get("network", {}) or {})
+    if not network.get("applied"):
+        try:
+            network = _ensure_bridge()
+            # Wait for network convergence before validating connectivity
+            time.sleep(2)
+            if not _verify_connectivity():
+                raise RuntimeError("Connectivity check failed; bridge reverted")
             network["health"] = "healthy"
-        else:
-            network = {"applied": False, "bridge": DEFAULT_BRIDGE, "message": "Connectivity check failed; bridge reverted"}
+        except Exception as exc:
+            logger.warning("Bridge setup failed; reverting previous changes: %s", exc)
             _revert_bridge()
-    except PermissionError as exc:
-        network = {"applied": False, "message": str(exc), "bridge": DEFAULT_BRIDGE}
-        logger.warning("Bridge setup skipped: %s", exc)
-    except Exception as exc:  # pragma: no cover - best effort
-        network = {"applied": False, "message": str(exc), "bridge": DEFAULT_BRIDGE}
-        logger.warning("Bridge setup failed: %s", exc)
+            raise
     config = {
         "host": DEFAULT_HOST,
         "node": node,
         "user": user,
         "token_name": token_name,
-        "token_value": token_value,
-        "verify_ssl": verify_ssl,
+        "token_value": resolved_token_value,
+        "verify_ssl": actual_verify_ssl,
         "default_storage": default_storage,
         "templates": templates,
         "last_verified": datetime.utcnow().isoformat() + "Z",
         "network": network,
         "node_status": status,
     }
+    cloudflare = _build_cloudflare_config(existing, cloudflare_api_token)
+    if cloudflare:
+        config["cloudflare"] = cloudflare
     _save_config(config)
     snapshot = build_snapshot(config)
     snapshot["node_status"] = status
@@ -1052,8 +1192,17 @@ class CreateProxmoxContainerHandler(SyncHandler):
     def execute(self, message: Dict[str, Any]) -> Dict[str, Any]:
         logger.info("create_proxmox_container command received")
         request_id = message.get("request_id")
+        device_id = message.get("device_id")
+        device_public_key = (message.get("device_public_key") or "").strip()
+        device_private_key = (message.get("device_private_key") or "").strip()
+        has_device_keypair = bool(device_public_key and device_private_key)
         bootstrap_user, bootstrap_password, bootstrap_ssh_key = _get_provisioning_user_info(message)
-        bootstrap_steps = _build_bootstrap_steps(bootstrap_user, bootstrap_password, bootstrap_ssh_key)
+        bootstrap_steps = _build_bootstrap_steps(
+            bootstrap_user,
+            bootstrap_password,
+            bootstrap_ssh_key,
+            include_portacode_connect=not has_device_keypair,
+        )
         total_steps = 3 + len(bootstrap_steps) + 2
         current_step_index = 1
 
@@ -1214,9 +1363,102 @@ class CreateProxmoxContainerHandler(SyncHandler):
             progress_callback=_bootstrap_progress_callback,
             start_index=current_step_index,
             total_steps=total_steps,
+            default_public_key=device_public_key if has_device_keypair else None,
         )
         current_step_index += len(bootstrap_steps)
 
+        service_installed = False
+        if has_device_keypair:
+            logger.info(
+                "deploying dashboard-provided Portacode keypair (device_id=%s) into container %s",
+                device_id,
+                vmid,
+            )
+            _deploy_device_keypair(
+                vmid,
+                payload["username"],
+                device_private_key,
+                device_public_key,
+            )
+            service_installed = True
+            service_start_index = current_step_index
+
+            auth_step_name = "setup_device_authentication"
+            auth_label = "Setting up device authentication"
+            _emit_progress_event(
+                self,
+                step_index=service_start_index,
+                total_steps=total_steps,
+                step_name=auth_step_name,
+                step_label=auth_label,
+                status="in_progress",
+                message="Notifying the server of the new device…",
+                phase="service",
+                request_id=request_id,
+            )
+            _emit_progress_event(
+                self,
+                step_index=service_start_index,
+                total_steps=total_steps,
+                step_name=auth_step_name,
+                step_label=auth_label,
+                status="completed",
+                message="Authentication metadata recorded.",
+                phase="service",
+                request_id=request_id,
+            )
+
+            install_step = service_start_index + 1
+            install_label = "Launching Portacode service"
+            _emit_progress_event(
+                self,
+                step_index=install_step,
+                total_steps=total_steps,
+                step_name="launch_portacode_service",
+                step_label=install_label,
+                status="in_progress",
+                message="Running sudo portacode service install…",
+                phase="service",
+                request_id=request_id,
+            )
+
+            cmd = f"su - {payload['username']} -c 'sudo -S portacode service install'"
+            res = _run_pct(vmid, cmd, input_text=payload["password"] + "\n")
+
+            if res["returncode"] != 0:
+                _emit_progress_event(
+                    self,
+                    step_index=install_step,
+                    total_steps=total_steps,
+                    step_name="launch_portacode_service",
+                    step_label=install_label,
+                    status="failed",
+                    message=f"{install_label} failed: {res.get('stderr') or res.get('stdout')}",
+                    phase="service",
+                    request_id=request_id,
+                    details={
+                        "stderr": res.get("stderr"),
+                        "stdout": res.get("stdout"),
+                    },
+                )
+                raise RuntimeError(res.get("stderr") or res.get("stdout") or "Service install failed")
+
+            _emit_progress_event(
+                self,
+                step_index=install_step,
+                total_steps=total_steps,
+                step_name="launch_portacode_service",
+                step_label=install_label,
+                status="completed",
+                message="Portacode service install finished.",
+                phase="service",
+                request_id=request_id,
+            )
+
+            logger.info("create_proxmox_container: portacode service install completed inside ct %s", vmid)
+
+            current_step_index += 2
+
         return {
             "event": "proxmox_container_created",
             "success": True,
@@ -1233,6 +1475,8 @@ class CreateProxmoxContainerHandler(SyncHandler):
                 "cpus": payload["cpus"],
             },
             "setup_steps": steps,
+            "device_id": device_id,
+            "service_installed": service_installed,
         }
 
 
@@ -1450,10 +1694,13 @@ class ConfigureProxmoxInfraHandler(SyncHandler):
     def execute(self, message: Dict[str, Any]) -> Dict[str, Any]:
         token_identifier = message.get("token_identifier")
         token_value = message.get("token_value")
-        verify_ssl = bool(message.get("verify_ssl"))
-        if not token_identifier or not token_value:
-            raise ValueError("token_identifier and token_value are required")
-        snapshot = configure_infrastructure(token_identifier, token_value, verify_ssl=verify_ssl)
+        verify_ssl = message.get("verify_ssl")
+        snapshot = configure_infrastructure(
+            token_identifier=token_identifier,
+            token_value=token_value,
+            verify_ssl=verify_ssl,
+            cloudflare_api_token=message.get("cloudflare_api_token"),
+        )
         return {
             "event": "proxmox_infra_configured",
             "success": True,