portacode 1.5.17.dev1__tar.gz → 1.5.17.dev2__tar.gz

{portacode-1.5.17.dev1 → portacode-1.5.17.dev2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: portacode
-Version: 1.5.17.dev1
+Version: 1.5.17.dev2
 Summary: Portacode CLI client and SDK
 Home-page: https://github.com/portacode/portacode
 Author: Meena Erian

{portacode-1.5.17.dev1 → portacode-1.5.17.dev2}/portacode/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.5.17.dev1'
-__version_tuple__ = version_tuple = (1, 5, 17, 'dev1')
+__version__ = version = '1.5.17.dev2'
+__version_tuple__ = version_tuple = (1, 5, 17, 'dev2')
 
 __commit_id__ = commit_id = None

{portacode-1.5.17.dev1 → portacode-1.5.17.dev2}/portacode/codex_prepare.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import json
+import logging
 import os
 import platform
 import re
@@ -17,6 +18,8 @@ from typing import Callable, Dict, Iterable, Mapping, MutableMapping, Optional
 
 from .codex_loopback_proxy import CODEX_LOOPBACK_HOST, CODEX_LOOPBACK_PORT
 
+LOGGER = logging.getLogger(__name__)
+
 # Do not pin `model` here — let the installed Codex CLI default apply, and let
 # the Portacode chat UI override via thread/start when the device supports it.
 CODEX_CONFIG = '''model_provider = "portacode_proxy"
@@ -24,11 +27,17 @@ approval_policy = "never"
 sandbox_mode = "danger-full-access"
 cli_auth_credentials_store = "file"
 
+# Force all model traffic through the local Portacode device proxy.
+# Newer Codex builds prefer WebSockets to api.openai.com; that bypasses our
+# proxy and treats OPENAI_API_KEY=portacode-local as a real OpenAI key (401).
+openai_base_url = "http://127.0.0.1:61789/v1"
+
 [model_providers.portacode_proxy]
 name = "Portacode Device Proxy"
 base_url = "http://127.0.0.1:61789/v1"
 wire_api = "responses"
 env_key = "OPENAI_API_KEY"
+supports_websockets = false
 '''
 
 LOCAL_SENTINEL = "portacode-local"
@@ -145,14 +154,72 @@ def _install_codex() -> None:
         raise CodexPreparationError("Codex CLI installation completed but codex is not on PATH.")
 
 
-def _write_config() -> Path:
-    config_path = Path.home() / ".codex" / "config.toml"
-    config_path.parent.mkdir(parents=True, exist_ok=True)
-    config_path.write_text(CODEX_CONFIG, encoding="utf-8")
-    config_path.chmod(0o600)
+def _extract_project_trust_blocks(existing: str) -> str:
+    """Keep Codex ``[projects."..."] trust_level`` stanzas when rewriting config."""
+    blocks: list[str] = []
+    current: list[str] = []
+    in_projects = False
+    for line in existing.splitlines():
+        stripped = line.strip()
+        if stripped.startswith("[") and stripped.endswith("]"):
+            if in_projects and current:
+                blocks.append("\n".join(current).rstrip())
+            current = []
+            in_projects = stripped.startswith("[projects.")
+            if in_projects:
+                current = [line]
+            continue
+        if in_projects:
+            current.append(line)
+    if in_projects and current:
+        blocks.append("\n".join(current).rstrip())
+    if not blocks:
+        return ""
+    return "\n\n" + "\n\n".join(blocks) + "\n"
+
+
+def write_codex_config(codex_home: Optional[Path] = None) -> Path:
+    """Write the managed Codex config into the shared CODEX_HOME.
+
+    Always refreshes the Portacode proxy provider so runtime-user homes
+    (e.g. ``/home/bishoy/.codex``) cannot keep a stale default that sends
+    traffic to ``api.openai.com`` with the local sentinel key.
+    Preserves existing ``[projects.*]`` trust entries.
+    """
+    home = Path(codex_home) if codex_home is not None else resolve_codex_home()
+    home.mkdir(parents=True, exist_ok=True)
+    config_path = home / "config.toml"
+    existing = ""
+    try:
+        if config_path.is_file():
+            existing = config_path.read_text(encoding="utf-8")
+    except OSError:
+        existing = ""
+    body = CODEX_CONFIG.rstrip() + "\n" + _extract_project_trust_blocks(existing)
+    config_path.write_text(body, encoding="utf-8")
+    try:
+        config_path.chmod(0o600)
+    except OSError:
+        pass
+    try:
+        from portacode.connection.handlers.runtime_user import (
+            chown_path_if_possible,
+            get_default_runtime_user,
+        )
+
+        owner = get_default_runtime_user()
+        chown_path_if_possible(home, owner)
+        chown_path_if_possible(config_path, owner)
+    except Exception:
+        pass
     return config_path
 
 
+def _write_config() -> Path:
+    """Backward-compatible alias used by ``prepare_codex``."""
+    return write_codex_config()
+
+
 def read_codex_env_file(path: Optional[Path] = None) -> Dict[str, str]:
     """Parse KEY=VALUE lines from the managed Codex env file."""
     path = path or CODEX_ENV_PATH
@@ -256,7 +323,6 @@ def _persist_codex_home_env(codex_home: Path) -> None:
 
 def ensure_codex_home() -> Path:
     """Create CODEX_HOME and seed it from /root/.codex sessions when needed."""
-    import pwd
     import shutil
 
     codex_home = resolve_codex_home()
@@ -293,18 +359,23 @@ def ensure_codex_home() -> Path:
                     shutil.copy2(src, dest)
                 except OSError:
                     pass
+        # Only chown newly created paths — full-tree chown on every spawn made
+        # Codex app-server initialize race the 10s handshake timeout.
         try:
-            from portacode.connection.handlers.runtime_user import get_default_runtime_user
-
-            user = get_default_runtime_user()
-            pw_entry = pwd.getpwnam(user)
-            for path in [codex_home, *codex_home.rglob("*")]:
-                try:
-                    os.chown(path, pw_entry.pw_uid, pw_entry.pw_gid)
-                except OSError:
-                    pass
+            from portacode.connection.handlers.runtime_user import (
+                chown_path_if_possible,
+                get_default_runtime_user,
+            )
+
+            owner = get_default_runtime_user()
+            chown_path_if_possible(codex_home, owner)
+            chown_path_if_possible(sessions_dir, owner)
         except Exception:
             pass
+    try:
+        write_codex_config(codex_home)
+    except Exception:
+        LOGGER.debug("Could not refresh managed Codex config.toml", exc_info=True)
     try:
         _persist_codex_home_env(codex_home)
     except Exception:

{portacode-1.5.17.dev1 → portacode-1.5.17.dev2}/portacode/connection/codex_app_server.py

@@ -191,13 +191,15 @@ class CodexAppServer:
         Uses `_request_on_running_proc` so we do not re-enter `start()` while
         `start()` already holds `_lock` (asyncio.Lock is not reentrant).
         """
+        # Backfill / first boot can exceed a few seconds after CODEX_HOME moves
+        # or session indexes are rebuilt.
         response = await self._request_on_running_proc(
             "initialize",
             {
                 "clientInfo": self.client_info,
                 "capabilities": {"streaming": True},
             },
-            timeout=10.0,
+            timeout=60.0,
         )
         LOGGER.info("Codex app-server initialized: %s", response.get("result", {}))
         # Required by current Codex app-server clients so post-init notifications

{portacode-1.5.17.dev1 → portacode-1.5.17.dev2}/portacode/connection/handlers/runtime_user.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import os
 import pwd
 import shlex
+import shutil
 import stat
 from pathlib import Path
 from typing import Iterable, List, Optional, Sequence
@@ -69,22 +70,23 @@ def wrap_argv_for_user(
     """Wrap argv to run as ``user`` when the agent is root.
 
     ``login=True`` (default) matches terminal/git helpers with ``sudo -i``.
-    Long-lived daemons (e.g. Codex app-server) should pass ``login=False`` and
-    an explicit ``preserve_env_names`` list so managed env vars survive.
+    Long-lived daemons (e.g. Codex app-server) must pass ``login=False`` so we
+    use ``runuser``/``setpriv`` instead of ``sudo`` — many hosts enable
+    ``Defaults use_pty``, which breaks JSON-RPC over piped stdio.
     """
     argv_list = list(argv)
     if not should_switch_user(user):
         return argv_list
 
+    if not login:
+        return _wrap_daemon_argv_for_user(argv_list, user, cwd=cwd)
+
     preserved = [
         str(name or "").strip()
         for name in (preserve_env_names or [])
         if str(name or "").strip()
     ]
-    sudo_prefix = ["sudo", "-H"]
-    if login:
-        sudo_prefix.append("-i")
-    sudo_prefix.extend(["-u", user])
+    sudo_prefix = ["sudo", "-H", "-i", "-u", user]
     if preserved:
         sudo_prefix.append(f"--preserve-env={','.join(preserved)}")
     sudo_prefix.append("--")
@@ -100,6 +102,49 @@ def wrap_argv_for_user(
     return [*sudo_prefix, shell_path, "-lc", command]
 
 
+def _wrap_daemon_argv_for_user(
+    argv_list: List[str],
+    user: str,
+    *,
+    cwd: Optional[str] = None,
+) -> List[str]:
+    """Run a long-lived subprocess as ``user`` without allocating a PTY."""
+    if cwd:
+        shell_path = _resolve_shell_for_wrapped_argv(user, argv_list[0] if argv_list else "/bin/sh")
+        exec_command = " ".join(shlex.quote(arg) for arg in argv_list)
+        command = f"cd {shlex.quote(cwd)} && exec {exec_command}"
+        inner = [shell_path, "-lc", command]
+    else:
+        inner = list(argv_list)
+
+    runuser = shutil.which("runuser")
+    if runuser:
+        # --preserve-environment keeps OPENAI_API_KEY / CODEX_HOME from the
+        # parent env= mapping passed to create_subprocess_exec.
+        return [runuser, "-u", user, "--preserve-environment", "--", *inner]
+
+    setpriv = shutil.which("setpriv")
+    if setpriv:
+        try:
+            pw_entry = pwd.getpwnam(user)
+        except KeyError:
+            pw_entry = None
+        if pw_entry is not None:
+            return [
+                setpriv,
+                f"--reuid={pw_entry.pw_uid}",
+                f"--regid={pw_entry.pw_gid}",
+                "--init-groups",
+                "--",
+                *inner,
+            ]
+
+    # Last resort: sudo without login shell. Prefer -n (non-interactive).
+    # Hosts with Defaults use_pty may still break stdio — callers should prefer
+    # runuser on Linux agents.
+    return ["sudo", "-n", "-H", "-u", user, "--", *inner]
+
+
 def ensure_parent_dirs(path: str | Path, owner_user: Optional[str] = None) -> None:
     target = Path(path).parent
     missing: List[Path] = []

{portacode-1.5.17.dev1 → portacode-1.5.17.dev2}/portacode/connection/handlers/test_runtime_user.py

@@ -75,8 +75,9 @@ class RuntimeUserTests(TestCase):
         self.assertEqual(wrapped[5:8], ["--", "/bin/bash", "-lc"])
         self.assertIn("cd /home/meena/.openclaw && exec /bin/bash --login", wrapped[8])
 
+    @patch("portacode.connection.handlers.runtime_user.shutil.which", side_effect=lambda name: "/usr/sbin/runuser" if name == "runuser" else None)
     @patch("portacode.connection.handlers.runtime_user.os.geteuid", return_value=0)
-    def test_wrap_argv_for_user_non_login_preserves_env(self, _mock_euid):
+    def test_wrap_argv_for_user_non_login_uses_runuser(self, _mock_euid, _mock_which):
         wrapped = wrap_argv_for_user(
             ["codex", "app-server"],
             "meena",
@@ -84,10 +85,20 @@ class RuntimeUserTests(TestCase):
             login=False,
         )
         self.assertEqual(
-            wrapped[:6],
-            ["sudo", "-H", "-u", "meena", "--preserve-env=OPENAI_API_KEY,CODEX_HOME", "--"],
+            wrapped,
+            ["/usr/sbin/runuser", "-u", "meena", "--preserve-environment", "--", "codex", "app-server"],
         )
-        self.assertEqual(wrapped[6:], ["codex", "app-server"])
+
+    @patch("portacode.connection.handlers.runtime_user.shutil.which", return_value=None)
+    @patch("portacode.connection.handlers.runtime_user.os.geteuid", return_value=0)
+    def test_wrap_argv_for_user_non_login_falls_back_to_sudo_n(self, _mock_euid, _mock_which):
+        wrapped = wrap_argv_for_user(
+            ["codex", "app-server"],
+            "meena",
+            login=False,
+        )
+        self.assertEqual(wrapped[:5], ["sudo", "-n", "-H", "-u", "meena"])
+        self.assertEqual(wrapped[5:], ["--", "codex", "app-server"])
 
     @patch("portacode.connection.handlers.runtime_user.os.geteuid", return_value=0)
     @patch("portacode.connection.handlers.runtime_user.pwd.getpwnam")

{portacode-1.5.17.dev1 → portacode-1.5.17.dev2}/portacode/tests/test_codex_app_server.py

@@ -163,6 +163,15 @@ async def test_spawn_runs_as_runtime_user(tmp_path, monkeypatch):
         "portacode.connection.handlers.runtime_user.should_switch_user",
         lambda user: True,
     )
+    def _which(name: str):
+        if name == "runuser":
+            return "/usr/sbin/runuser"
+        if name in {"codex", "codex.cmd"}:
+            return "/usr/bin/codex"
+        return None
+
+    monkeypatch.setattr("portacode.connection.handlers.runtime_user.shutil.which", _which)
+    monkeypatch.setattr("portacode.connection.codex_app_server.shutil.which", _which)
     monkeypatch.setattr("portacode.codex_prepare.ensure_codex_home", lambda: tmp_path / ".codex")
 
     seen: list[tuple] = []
@@ -176,8 +185,7 @@ async def test_spawn_runs_as_runtime_user(tmp_path, monkeypatch):
     bridge = CodexAppServer(_process_factory=factory)
     await bridge.start()
     assert seen
-    assert seen[0][:4] == ("sudo", "-H", "-u", "bishoy")
-    assert any(str(a).startswith("--preserve-env=") for a in seen[0])
+    assert seen[0][:5] == ("/usr/sbin/runuser", "-u", "bishoy", "--preserve-environment", "--")
     assert "codex" in seen[0]
     await bridge.stop()
 

{portacode-1.5.17.dev1 → portacode-1.5.17.dev2}/portacode/tests/test_codex_prepare.py

@@ -5,7 +5,12 @@ from types import SimpleNamespace
 
 import pytest
 
-from portacode.codex_prepare import CodexPreparationError, _run, resolve_codex_home
+from portacode.codex_prepare import (
+    CodexPreparationError,
+    _run,
+    resolve_codex_home,
+    write_codex_config,
+)
 
 
 def test_run_allows_proxmox_apt_update_exit_100(monkeypatch):
@@ -52,3 +57,28 @@ def test_resolve_codex_home_keeps_explicit_non_root(monkeypatch):
         lambda message=None: "bishoy",
     )
     assert resolve_codex_home() == Path("/custom/codex")
+
+
+def test_write_codex_config_forces_local_proxy(tmp_path, monkeypatch):
+    monkeypatch.setattr(
+        "portacode.connection.handlers.runtime_user.get_default_runtime_user",
+        lambda message=None: "bishoy",
+    )
+    monkeypatch.setattr(
+        "portacode.connection.handlers.runtime_user.chown_path_if_possible",
+        lambda *args, **kwargs: None,
+    )
+    home = tmp_path / ".codex"
+    home.mkdir()
+    (home / "config.toml").write_text(
+        '[projects."/home/bishoy/souldesign_container"]\ntrust_level = "trusted"\n',
+        encoding="utf-8",
+    )
+    path = write_codex_config(home)
+    text = path.read_text(encoding="utf-8")
+    assert 'model_provider = "portacode_proxy"' in text
+    assert "127.0.0.1:61789" in text
+    assert "supports_websockets = false" in text
+    assert "openai_base_url" in text
+    assert '[projects."/home/bishoy/souldesign_container"]' in text
+    assert 'trust_level = "trusted"' in text

{portacode-1.5.17.dev1 → portacode-1.5.17.dev2}/portacode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: portacode
-Version: 1.5.17.dev1
+Version: 1.5.17.dev2
 Summary: Portacode CLI client and SDK
 Home-page: https://github.com/portacode/portacode
 Author: Meena Erian