portacode 1.5.19.dev0__tar.gz → 1.5.19.dev1__tar.gz

{portacode-1.5.19.dev0 → portacode-1.5.19.dev1}/.gitignore

@@ -10,6 +10,8 @@ client_sessions.json
 project_state_debug.json
 test_results
 logs
+AGENTS.md
+secrets
 
 # Example-generated volumes
 examples/simple_device/data/

{portacode-1.5.19.dev0 → portacode-1.5.19.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: portacode
-Version: 1.5.19.dev0
+Version: 1.5.19.dev1
 Summary: Portacode CLI client and SDK
 Home-page: https://github.com/portacode/portacode
 Author: Meena Erian

{portacode-1.5.19.dev0 → portacode-1.5.19.dev1}/portacode/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.5.19.dev0'
-__version_tuple__ = version_tuple = (1, 5, 19, 'dev0')
+__version__ = version = '1.5.19.dev1'
+__version_tuple__ = version_tuple = (1, 5, 19, 'dev1')
 
 __commit_id__ = commit_id = None

{portacode-1.5.19.dev0 → portacode-1.5.19.dev1}/portacode/cli.py

@@ -66,6 +66,18 @@ def prepare_codex_command() -> None:
     )
 
 
+@cli.command("github-setup")
+def github_setup_command() -> None:
+    """Configure Git to request device-scoped GitHub credentials from Portacode."""
+    from .github_credential import configure_git
+
+    try:
+        configure_git()
+    except (OSError, subprocess.CalledProcessError) as exc:
+        raise click.ClickException(f"Could not configure GitHub access: {exc}") from exc
+    click.echo(click.style("GitHub access is configured for this device.", fg="green"))
+
+
 @cli.command()
 @click.option("--gateway", "gateway", "-g", help="Gateway websocket URL (overrides env/ default)")
 @click.option("--debug", "debug", is_flag=True, help="Enable debug logging")

{portacode-1.5.19.dev0 → portacode-1.5.19.dev1}/portacode/connection/client.py

@@ -213,6 +213,16 @@ class ConnectionManager:
             else:
                 print("Press Ctrl+C to close the connection.")
         # Finished authentication flow.
+        try:
+            from portacode.github_credential import configure_git
+
+            await asyncio.to_thread(configure_git)
+        except Exception as exc:
+            logger.warning(
+                "Could not configure device-scoped GitHub credentials: %s",
+                LogCategory.CONNECTION,
+                exc,
+            )
         await self._register_initial_project_paths()
 
     async def _start_codex_loopback_proxy(self) -> None:

portacode-1.5.19.dev1/portacode/github_credential.py

@@ -0,0 +1,122 @@
+"""Git credential helper backed by device-scoped Portacode GitHub grants."""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import json
+import os
+import secrets
+import subprocess
+import sys
+import time
+from urllib.parse import urlparse
+
+import httpx
+
+from .keypair import get_or_create_keypair, keypair_files_exist
+
+
+DEFAULT_BASE_URL = "https://portacode.com"
+BROKER_PATH = "/dashboard/github/device-credential/"
+
+
+def _read_credential_input() -> dict[str, str]:
+    values: dict[str, str] = {}
+    for line in sys.stdin:
+        line = line.rstrip("\r\n")
+        if not line:
+            break
+        key, separator, value = line.partition("=")
+        if separator:
+            values[key] = value
+    return values
+
+
+def _repository_from_input(values: dict[str, str]) -> str | None:
+    host = values.get("host", "").split(":", 1)[0].lower()
+    if host != "github.com":
+        return None
+    path = values.get("path", "").strip("/")
+    if path.endswith(".git"):
+        path = path[:-4]
+    if path.count("/") != 1:
+        return None
+    return path
+
+
+def _signed_headers(body: bytes, *, path: str) -> dict[str, str]:
+    if not keypair_files_exist():
+        raise RuntimeError("This device is not paired with Portacode")
+    keypair = get_or_create_keypair()
+    timestamp = str(int(time.time()))
+    nonce = secrets.token_urlsafe(24)
+    body_hash = hashlib.sha256(body).hexdigest()
+    canonical = f"POST\n{path}\n{timestamp}\n{nonce}\n{body_hash}".encode("ascii")
+    signature = base64.b64encode(keypair.sign_bytes(canonical)).decode("ascii")
+    return {
+        "X-Portacode-Device-Key": keypair.public_key_der_b64(),
+        "X-Portacode-Timestamp": timestamp,
+        "X-Portacode-Nonce": nonce,
+        "X-Portacode-Signature": signature,
+        "Content-Type": "application/json",
+    }
+
+
+def get_credential(repository: str) -> dict[str, str]:
+    body = json.dumps({"repository": repository}, separators=(",", ":")).encode("utf-8")
+    base_url = (os.environ.get("PORTACODE_GITHUB_BASE_URL") or DEFAULT_BASE_URL).rstrip("/")
+    response = httpx.post(
+        f"{base_url}{BROKER_PATH}",
+        content=body,
+        headers=_signed_headers(body, path=BROKER_PATH),
+        timeout=20.0,
+    )
+    payload = response.json()
+    if response.status_code != 200 or not payload.get("ok"):
+        raise RuntimeError(str(payload.get("error") or "GitHub access denied"))
+    return payload
+
+
+def configure_git() -> None:
+    """Use this helper only for github.com and include owner/repository in requests."""
+    from .connection.handlers.runtime_user import get_default_runtime_user, wrap_argv_for_user
+
+    runtime_user = get_default_runtime_user()
+    subprocess.run(
+        wrap_argv_for_user(
+            ["git", "config", "--global", "credential.https://github.com.helper", "portacode"],
+            runtime_user,
+        ),
+        check=True,
+    )
+    subprocess.run(
+        wrap_argv_for_user(
+            ["git", "config", "--global", "credential.https://github.com.useHttpPath", "true"],
+            runtime_user,
+        ),
+        check=True,
+    )
+
+
+def main() -> int:
+    action = sys.argv[1] if len(sys.argv) > 1 else "get"
+    values = _read_credential_input()
+    if action != "get":
+        return 0
+    repository = _repository_from_input(values)
+    if repository is None:
+        return 0
+    try:
+        credential = get_credential(repository)
+    except Exception as exc:
+        print(f"git-credential-portacode: {exc}", file=sys.stderr)
+        return 1
+    print(f"username={credential['username']}")
+    print(f"password={credential['password']}")
+    print()
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

{portacode-1.5.19.dev0 → portacode-1.5.19.dev1}/portacode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: portacode
-Version: 1.5.19.dev0
+Version: 1.5.19.dev1
 Summary: Portacode CLI client and SDK
 Home-page: https://github.com/portacode/portacode
 Author: Meena Erian

{portacode-1.5.19.dev0 → portacode-1.5.19.dev1}/portacode.egg-info/SOURCES.txt

@@ -4,13 +4,10 @@ LICENSE
 MANIFEST.in
 Makefile
 README.md
-backup.sh
 build_android.sh
 connect.py
 connect.sh
-docker-compose.yaml
 pyproject.toml
-restore.sh
 run_tests.py
 setup.py
 test.sh
@@ -283,6 +280,7 @@ portacode/codex_prepare.py
 portacode/codex_usage_limit.py
 portacode/data.py
 portacode/exit_codes.py
+portacode/github_credential.py
 portacode/keypair.py
 portacode/logging_categories.py
 portacode/pairing.py

portacode-1.5.19.dev1/portacode.egg-info/entry_points.txt

@@ -0,0 +1,3 @@
+[console_scripts]
+git-credential-portacode = portacode.github_credential:main
+portacode = portacode.cli:cli

{portacode-1.5.19.dev0 → portacode-1.5.19.dev1}/setup.py

@@ -47,9 +47,10 @@ setup(
         "dev": ["black", "flake8", "pytest"],
     },
     entry_points={
-        "console_scripts": [
-            "portacode=portacode.cli:cli",
-        ]
+        "console_scripts": [
+            "portacode=portacode.cli:cli",
+            "git-credential-portacode=portacode.github_credential:main",
+        ]
     },
     classifiers=[
         "Programming Language :: Python :: 3",

portacode-1.5.19.dev0/backup.sh

@@ -1,42 +0,0 @@
-# backup.sh
-#!/usr/bin/env bash
-set -euo pipefail
-
-# ensure we’re in project root
-cd "$(dirname "$0")"
-
-# config
-BACKUP_DIR="${1:-$PWD/../backups}"
-VOLUME_NAME="portacode_pgdata"
-SERVICE_NAME="db"
-
-mkdir -p "$BACKUP_DIR"
-
-# check & stop DB for a consistent dump
-if [ "$(docker inspect -f '{{.State.Running}}' portacode-db 2>/dev/null || echo false)" = "true" ]; then
-  echo "🛑 Stopping $SERVICE_NAME..."
-  docker-compose stop "$SERVICE_NAME"
-  RESTART_DB=true
-else
-  RESTART_DB=false
-fi
-
-# create backup
-TS=$(date +%F_%H-%M-%S)
-FILE="pgdata-$TS.tar.gz"
-echo "📦 Backing up volume to $BACKUP_DIR/$FILE..."
-docker run --rm \
-  -v "${VOLUME_NAME}":/data:ro \
-  -v "${BACKUP_DIR}":/backup \
-  alpine \
-  sh -c "cd /data && tar czf /backup/${FILE} ."
-
-echo "✅ Backup complete."
-
-# restart DB if we stopped it
-if [ "$RESTART_DB" = true ]; then
-  echo "🔄 Starting $SERVICE_NAME..."
-  docker-compose start "$SERVICE_NAME"
-fi
-
-echo "🎉 Done."

portacode-1.5.19.dev0/docker-compose.yaml

@@ -1,292 +0,0 @@
-services:
-  db:
-    image: postgres:15
-    container_name: portacode-db
-    restart: unless-stopped
-    env_file:
-      - main.env
-    volumes:
-      - pgdata:/var/lib/postgresql/data
-    ports:
-      - "5432:5432"
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U portacode -d portacode"]
-      interval: 5s
-      timeout: 5s
-      retries: 5
-    logging:
-        driver: json-file
-        options:
-          max-size: "50m"   # rotate when log hits 50 MB
-          max-file: "3"     # keep 3 old files
-
-  django:
-    build:
-      context: ./server/portacode_django
-      dockerfile: Dockerfile
-    container_name: portacode-django
-    restart: unless-stopped
-    command: ["bash", "-c", "rm -rf staticfiles && python manage.py migrate && python manage.py collectstatic --noinput && uvicorn portacode_django.asgi:application --host 0.0.0.0 --port 8001"]
-    env_file:
-      - main.env
-    depends_on:
-      db:
-        condition: service_healthy
-    ports:
-      - "8001:8001"
-    volumes:
-      - ./server/portacode_django:/app
-    logging:
-        driver: json-file
-        options:
-          max-size: "50m"   # rotate when log hits 50 MB
-          max-file: "3"     # keep 3 old files
-
-  unibot-worker:
-    build:
-      context: ./server/portacode_django
-      dockerfile: Dockerfile
-    restart: unless-stopped
-    command: ["python", "manage.py", "run_worker"]
-    env_file:
-      - main.env
-    depends_on:
-      db:
-        condition: service_healthy
-    volumes:
-      - ./server/portacode_django:/app
-    deploy:
-      replicas: 3
-    logging:
-        driver: json-file
-        options:
-          max-size: "50m"   # rotate when log hits 50 MB
-          max-file: "3"     # keep 3 old files
-
-  imap-worker:
-    build:
-      context: ./server/portacode_django
-      dockerfile: Dockerfile
-    container_name: portacode-imap-worker
-    restart: unless-stopped
-    command: ["python", "manage.py", "start_imap_listeners"]
-    env_file:
-      - main.env
-    depends_on:
-      db:
-        condition: service_healthy
-    volumes:
-      - ./server/portacode_django:/app
-    logging:
-        driver: json-file
-        options:
-          max-size: "50m"   # rotate when log hits 50 MB
-          max-file: "3"     # keep 3 old files
-  telegram-auth-worker:
-    build:
-      context: ./server/portacode_django
-      dockerfile: Dockerfile
-    container_name: portacode-telegram-auth-worker
-    restart: unless-stopped
-    command:
-      [
-        "python",
-        "manage.py",
-        "handle_telegram_auth",
-        "--category",
-        "telegram_anonymous",
-      ]
-    env_file:
-      - main.env
-    depends_on:
-      db:
-        condition: service_healthy
-    volumes:
-      - ./server/portacode_django:/app
-    logging:
-        driver: json-file
-        options:
-          max-size: "50m"
-          max-file: "3"
-
-  # Multi-tenant Codex Connect + Responses gateway (ChatGPT subscription auth).
-  # Start with 1 replica; scale later if needed. Not per-user containers.
-  codex-gateway:
-    build:
-      context: ./server/portacode_django
-      dockerfile: Dockerfile.codex-gateway
-    container_name: portacode-codex-gateway
-    restart: unless-stopped
-    command: ["python", "manage.py", "run_codex_gateway", "--host", "0.0.0.0", "--port", "8080"]
-    env_file:
-      - main.env
-    environment:
-      CODEX_GATEWAY_INTERNAL_URL: http://codex-gateway:8080
-      CODEX_GATEWAY_PUBLIC_BASE_URL: "${CODEX_GATEWAY_PUBLIC_BASE_URL:-https://codexapi.portacode.com}"
-    depends_on:
-      db:
-        condition: service_healthy
-    ports:
-      - "8082:8080"
-    volumes:
-      - ./server/portacode_django:/app
-    logging:
-        driver: json-file
-        options:
-          max-size: "50m"
-          max-file: "3"
-
-  automation-worker:
-    build:
-      context: ./server/portacode_django
-      dockerfile: Dockerfile
-    restart: unless-stopped
-    command: ["python", "manage.py", "run_automation_workers", "--workers", "3"]
-    env_file:
-      - main.env
-      - automation-worker.env
-    depends_on:
-      db:
-        condition: service_healthy
-    volumes:
-      - ./server/portacode_django:/app
-    deploy:
-      replicas: 3
-    logging:
-        driver: json-file
-        options:
-          max-size: "50m"
-          max-file: "3"
-  expiry-notifier:
-    build:
-      context: ./server/portacode_django
-      dockerfile: Dockerfile
-    restart: unless-stopped
-    command:
-      [
-        "python",
-        "manage.py",
-        "notify_expiring_devices",
-        "--window-hours",
-        "24",
-        "--run-forever",
-        "--interval-seconds",
-        "1800",
-      ]
-    env_file:
-      - main.env
-    depends_on:
-      db:
-        condition: service_healthy
-    volumes:
-      - ./server/portacode_django:/app
-    logging:
-        driver: json-file
-        options:
-          max-size: "50m"
-          max-file: "3"
-  expired-cleanup-worker:
-    build:
-      context: ./server/portacode_django
-      dockerfile: Dockerfile
-    restart: unless-stopped
-    command:
-      [
-        "python",
-        "manage.py",
-        "cleanup_expired_devices",
-        "--run-forever",
-        "--batch-size",
-        "20",
-        "--poll-interval",
-        "5",
-      ]
-    env_file:
-      - main.env
-    depends_on:
-      db:
-        condition: service_healthy
-    volumes:
-      - ./server/portacode_django:/app
-    deploy:
-      replicas: 3
-    logging:
-        driver: json-file
-        options:
-          max-size: "50m"
-          max-file: "3"
-  alert-evaluator:
-    profiles: ["alerts"]
-    build:
-      context: ./server/portacode_django
-      dockerfile: Dockerfile
-    container_name: portacode-alert-evaluator
-    restart: unless-stopped
-    command: ["python", "manage.py", "evaluate_alert_rules", "--run-forever", "--interval", "30"]
-    env_file:
-      - main.env
-    depends_on:
-      db:
-        condition: service_healthy
-    volumes:
-      - ./server/portacode_django:/app
-    logging:
-        driver: json-file
-        options:
-          max-size: "50m"
-          max-file: "3"
-  alert-notifier:
-    profiles: ["alerts"]
-    build:
-      context: ./server/portacode_django
-      dockerfile: Dockerfile
-    restart: unless-stopped
-    command: ["python", "manage.py", "run_alert_notification_workers", "--poll-interval", "2"]
-    env_file:
-      - main.env
-    depends_on:
-      db:
-        condition: service_healthy
-    volumes:
-      - ./server/portacode_django:/app
-    deploy:
-      replicas: 2
-    logging:
-        driver: json-file
-        options:
-          max-size: "50m"
-          max-file: "3"
-  alert-metrics-rollup:
-    profiles: ["alerts"]
-    build:
-      context: ./server/portacode_django
-      dockerfile: Dockerfile
-    container_name: portacode-alert-metrics-rollup
-    restart: unless-stopped
-    command: ["python", "manage.py", "rollup_device_metrics", "--run-forever", "--interval", "3600"]
-    env_file:
-      - main.env
-    depends_on:
-      db:
-        condition: service_healthy
-    volumes:
-      - ./server/portacode_django:/app
-    logging:
-        driver: json-file
-        options:
-          max-size: "50m"
-          max-file: "3"
-  reacher:
-    image: reacherhq/backend:latest
-    env_file:
-      - reacher.env
-    ports:
-      - "8080:8080"
-    restart: always
-    logging:
-        driver: json-file
-        options:
-          max-size: "50m"   # rotate when log hits 50 MB
-          max-file: "3"     # keep 3 old files
-volumes:
-  pgdata: 

portacode-1.5.19.dev0/portacode.egg-info/entry_points.txt

@@ -1,2 +0,0 @@
-[console_scripts]
-portacode = portacode.cli:cli

portacode-1.5.19.dev0/restore.sh

@@ -1,56 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-cd "$(dirname "$0")"
-
-# ─── CONFIG ────────────────────────────────────────────────────────────────
-BACKUP_DIR="${1:-$PWD/../backups}"
-VOLUME_NAME="portacode_pgdata"
-SERVICE="db"
-
-# ─── PICK A BACKUP ────────────────────────────────────────────────────────
-mapfile -t BACKUPS < <(
-  find "$BACKUP_DIR" -maxdepth 1 -type f -name "pgdata-*.tar.gz" \
-    -printf "%f\n" | sort -r
-)
-[ ${#BACKUPS[@]} -gt 0 ] || { echo "❌ No backups in $BACKUP_DIR"; exit 1; }
-
-echo "Available backups:"
-for i in "${!BACKUPS[@]}"; do
-  printf "  %2d) %s\n" $((i+1)) "${BACKUPS[i]}"
-done
-read -rp "Select backup [1-${#BACKUPS[@]}]: " SEL
-(( SEL>=1 && SEL<=${#BACKUPS[@]} )) || { echo "❌ Invalid choice."; exit 1; }
-FILE="${BACKUPS[$((SEL-1))]}"
-
-# ─── STOP & REMOVE OLD DB ─────────────────────────────────────────────────
-if docker-compose ps --status=running | grep -q "$SERVICE"; then
-  echo "🛑 Stopping & removing existing '$SERVICE' container..."
-  docker-compose stop "$SERVICE"
-  docker-compose rm -f "$SERVICE"
-fi
-
-# ─── DROP THE OLD VOLUME ───────────────────────────────────────────────────
-if docker volume inspect "$VOLUME_NAME" &>/dev/null; then
-  echo "🗑️  Removing old volume $VOLUME_NAME..."
-  docker volume rm "$VOLUME_NAME"
-fi
-
-# ─── HAVE COMPOSE CREATE THE BLANK VOLUME ─────────────────────────────────
-echo "➕ Letting Docker Compose create a fresh volume for '$SERVICE'..."
-# 'create' makes the container (and volume) without starting it
-docker-compose create "$SERVICE"
-
-# ─── RESTORE INTO THAT VOLUME ─────────────────────────────────────────────
-echo "📥 Restoring '$FILE' into volume '$VOLUME_NAME'..."
-docker run --rm \
-  -v "${VOLUME_NAME}":/data \
-  -v "$BACKUP_DIR":/backup \
-  alpine \
-  sh -c "cd /data && tar xzf /backup/${FILE}"
-
-# ─── START THE DB AGAIN ────────────────────────────────────────────────────
-echo "🚀 Starting '$SERVICE'..."
-docker-compose up -d "$SERVICE"
-
-echo "✅ Restore complete."