portacode 1.5.31.dev2__tar.gz → 1.5.32.dev0__tar.gz

{portacode-1.5.31.dev2 → portacode-1.5.32.dev0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: portacode
-Version: 1.5.31.dev2
+Version: 1.5.32.dev0
 Summary: Connect real machines to the Portacode AI development environment
 Home-page: https://github.com/portacode/portacode
 Author: Meena Erian

{portacode-1.5.31.dev2 → portacode-1.5.32.dev0}/portacode/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.5.31.dev2'
-__version_tuple__ = version_tuple = (1, 5, 31, 'dev2')
+__version__ = version = '1.5.32.dev0'
+__version_tuple__ = version_tuple = (1, 5, 32, 'dev0')
 
 __commit_id__ = commit_id = None

{portacode-1.5.31.dev2 → portacode-1.5.32.dev0}/portacode/connection/handlers/cloudflare_forwarding.py

@@ -10,6 +10,7 @@ import re
 import subprocess
 import threading
 import tempfile
+import time
 from pathlib import Path
 from typing import Any, Dict, List, Optional
 from urllib.parse import urlparse
@@ -58,6 +59,16 @@ GLOBAL_SHELL_HOOK_PATHS = (
 MANAGED_BLOCK_BEGIN = "# >>> PORTACODE_EXPOSED_SERVICES >>>"
 MANAGED_BLOCK_END = "# <<< PORTACODE_EXPOSED_SERVICES <<<"
 
+
+def _timed_stage(operation_id: str, stage: str, started: float, **details: Any) -> None:
+    logger.info(
+        "Expose ports timing operation_id=%s stage=%s elapsed_s=%.3f details=%s",
+        operation_id,
+        stage,
+        time.monotonic() - started,
+        details,
+    )
+
 def _is_root() -> bool:
     return hasattr(os, "geteuid") and os.geteuid() == 0
 
@@ -112,13 +123,16 @@ def _normalize_rules(
         validated_hostname = _validate_hostname(hostname or "", domain)
         if parsed is None:
             parsed = _parse_destination(destination or "")
-        normalized.append(
-            {
+        normalized_rule = {
                 "hostname": validated_hostname,
                 "destination": destination or "",
                 "parsed": parsed,
             }
-        )
+        if from_storage:
+            resolved_ip = str(entry.get("resolved_ip") or "").strip()
+            if resolved_ip:
+                normalized_rule["resolved_ip"] = resolved_ip
+        normalized.append(normalized_rule)
     return normalized
 
 
@@ -210,7 +224,17 @@ def _resolve_service_endpoint(
         ip = cache[device_id]
     else:
         vmid = _resolve_device_vmid(device_id, proxmox, node)
-        ip = _find_container_ip(proxmox, node, vmid, leases)
+        try:
+            ip = _find_container_ip(proxmox, node, vmid, leases)
+        except RuntimeError:
+            ip = str(parsed.get("resolved_ip") or "").strip()
+            if not ip:
+                raise
+            logger.info(
+                "Using last resolved IP for offline exposed device device_id=%s ip=%s",
+                device_id,
+                ip,
+            )
         cache[device_id] = ip
     port = parsed["port"]
     scheme = parsed["scheme"]
@@ -224,8 +248,12 @@ def _build_ingress_entries(
     leases = _load_leases() if proxmox else []
     device_ip_cache: Dict[str, str] = {}
     for rule in rules:
-        parsed = rule["parsed"]
+        parsed = dict(rule["parsed"])
+        if rule.get("resolved_ip"):
+            parsed["resolved_ip"] = rule["resolved_ip"]
         service = _resolve_service_endpoint(parsed, proxmox, node, leases, device_ip_cache)
+        if parsed["type"] == "device":
+            rule["resolved_ip"] = urlparse(service).hostname
         entry: Dict[str, Any] = {"hostname": rule["hostname"], "service": service}
         path = parsed.get("path", "")
         if path:
@@ -243,6 +271,35 @@ def _build_ingress_entries(
     return entries
 
 
+def _load_active_config_resolved_ips(tunnel_state: Dict[str, Any]) -> Dict[str, str]:
+    """Recover last working hostname endpoints when upgrading old forwarding state."""
+    cfg = tunnel_state.get("config_path")
+    config_path = Path(str(cfg)) if cfg else Path(default_config_path())
+    try:
+        lines = config_path.read_text(encoding="utf-8").splitlines()
+    except OSError:
+        return {}
+    resolved: Dict[str, str] = {}
+    hostname = ""
+    for raw_line in lines:
+        stripped = raw_line.strip()
+        if stripped.startswith("- hostname:"):
+            hostname = stripped.split(":", 1)[1].strip()
+            continue
+        if hostname and stripped.startswith("service:"):
+            service = stripped.split(":", 1)[1].strip()
+            parsed = urlparse(service)
+            if parsed.hostname:
+                try:
+                    ipaddress.ip_address(parsed.hostname)
+                except ValueError:
+                    pass
+                else:
+                    resolved[hostname] = parsed.hostname
+            hostname = ""
+    return resolved
+
+
 def _format_config_value(value: Any) -> str:
     if isinstance(value, bool):
         return "true" if value else "false"
@@ -301,11 +358,17 @@ def _route_dns(hostnames: List[str], tunnel_name: str) -> None:
         if hostname in seen:
             continue
         seen.add(hostname)
+        started = time.monotonic()
         try:
             _call_subprocess(
                 ["cloudflared", "tunnel", "route", "dns", "--overwrite-dns", tunnel_name, hostname],
                 check=True,
             )
+            logger.info(
+                "Expose ports timing stage=route_dns hostname=%s elapsed_s=%.3f",
+                hostname,
+                time.monotonic() - started,
+            )
         except subprocess.CalledProcessError as exc:
             stderr = (getattr(exc, "stderr", "") or "").strip()
             stdout = (getattr(exc, "stdout", "") or "").strip()
@@ -318,7 +381,14 @@ def _route_dns(hostnames: List[str], tunnel_name: str) -> None:
 
 def _reload_cloudflared_service() -> None:
     # Restart via init-system aware logic; sudo/root handled inside.
-    restart_service()
+    started = time.monotonic()
+    try:
+        restart_service()
+    finally:
+        logger.info(
+            "Expose ports timing stage=reload_cloudflared elapsed_s=%.3f",
+            time.monotonic() - started,
+        )
 
 
 def _load_tunnel_state() -> Dict[str, Any]:
@@ -333,10 +403,28 @@ def _load_tunnel_state() -> Dict[str, Any]:
 
 
 def _sanitize_rules(rules: List[Dict[str, Any]]) -> List[Dict[str, str]]:
-    return [
-        {"hostname": rule["hostname"], "destination": rule["destination"]}
-        for rule in rules
-    ]
+    sanitized = []
+    for rule in rules:
+        item = {"hostname": rule["hostname"], "destination": rule["destination"]}
+        if rule.get("resolved_ip"):
+            item["resolved_ip"] = rule["resolved_ip"]
+        sanitized.append(item)
+    return sanitized
+
+
+def _node_device_id(tunnel_state: Dict[str, Any]) -> str:
+    explicit = str(tunnel_state.get("node_device_id") or "").strip()
+    if explicit.isdigit():
+        return explicit
+    match = re.fullmatch(r"portacode-proxmox-(\d+)", str(tunnel_state.get("tunnel_name") or ""))
+    if not match:
+        raise RuntimeError("Unable to determine node device ID for wildcard forwarding")
+    return match.group(1)
+
+
+def _wildcard_hostname(tunnel_state: Dict[str, Any]) -> str:
+    domain = str(tunnel_state.get("domain") or "").strip().lower().rstrip(".")
+    return f"*.{_node_device_id(tunnel_state)}.{domain}"
 
 
 def _apply_and_persist_forwarding_rules(
@@ -349,20 +437,44 @@ def _apply_and_persist_forwarding_rules(
     if not domain or not tunnel_name:
         raise RuntimeError("Cloudflare domain or tunnel name missing from state.")
 
+    active_resolved_ips = _load_active_config_resolved_ips(tunnel_state)
+    for rule in rules:
+        if not rule.get("resolved_ip") and rule.get("hostname") in active_resolved_ips:
+            rule["resolved_ip"] = active_resolved_ips[rule["hostname"]]
+
+    operation_id = f"apply-{time.monotonic_ns()}"
+    total_started = time.monotonic()
     requires_proxmox = any(rule["parsed"]["type"] == "device" for rule in rules)
     proxmox = node = None
     if requires_proxmox:
         infra_config = _ensure_infra_configured()
         proxmox = _connect_proxmox(infra_config)
         node = _get_node_from_config(infra_config)
+    _timed_stage(operation_id, "connect_proxmox", total_started, required=requires_proxmox)
 
+    started = time.monotonic()
     entries = _build_ingress_entries(rules, proxmox, node)
+    _timed_stage(operation_id, "build_ingress_entries", started, rule_count=len(rules))
+    started = time.monotonic()
     _write_cloudflared_config(tunnel_state, entries)
-    hostnames = [entry["hostname"] for entry in entries if entry.get("hostname")]
+    _timed_stage(operation_id, "write_cloudflared_config", started, entry_count=len(entries))
+    forwarding_state = load_forwarding_state()
+    desired_wildcard = _wildcard_hostname(tunnel_state)
+    provisioned_wildcard = str(forwarding_state.get("wildcard_dns_hostname") or "")
+    hostnames = [] if provisioned_wildcard == desired_wildcard else [desired_wildcard]
     if hostnames:
+        started = time.monotonic()
         _route_dns(hostnames, tunnel_name)
+        _timed_stage(operation_id, "route_dns_all", started, hostname_count=len(hostnames))
+    started = time.monotonic()
     _reload_cloudflared_service()
-    state = persist_forwarding_state(rules)
+    _timed_stage(operation_id, "reload_cloudflared_call", started)
+    started = time.monotonic()
+    state = persist_forwarding_state(
+        rules, metadata={"wildcard_dns_hostname": desired_wildcard}
+    )
+    _timed_stage(operation_id, "persist_forwarding_state", started, rule_count=len(rules))
+    _timed_stage(operation_id, "apply_total", total_started, rule_count=len(rules))
     return {
         "rules": _sanitize_rules(rules),
         "updated_at": state.get("updated_at"),
@@ -380,6 +492,20 @@ def _normalize_subdomain_label(subdomain: Any, device_id: str, index: int) -> st
     return candidate
 
 
+def _new_container_hostname(
+    device_id: str,
+    port: int,
+    protocol: str,
+    index: int,
+    tunnel_state: Dict[str, Any],
+) -> str:
+    node_id = _node_device_id(tunnel_state)
+    domain = str(tunnel_state.get("domain") or "").strip().lower().rstrip(".")
+    protocol_suffix = "-https" if protocol == "https" else ""
+    label = device_id if index == 0 else f"{device_id}-{port}{protocol_suffix}"
+    return f"{label}.{node_id}.{domain}"
+
+
 def _normalize_container_rule_specs(
     container_device_id: Any,
     container_rules: List[Dict[str, Any]],
@@ -414,18 +540,48 @@ def _push_root_file_to_container(vmid: int, path: str, data: bytes, mode: int =
     try:
         parent = str(Path(path).parent)
         if parent not in {"", ".", "/"}:
+            started = time.monotonic()
             _run_pct_exec_check(vmid, ["mkdir", "-p", parent])
+            logger.info(
+                "Expose ports timing stage=pct_mkdir vmid=%s elapsed_s=%.3f",
+                vmid,
+                time.monotonic() - started,
+            )
+            started = time.monotonic()
             _run_pct_exec_check(vmid, ["chown", "root:root", parent])
+            logger.info(
+                "Expose ports timing stage=pct_chown_parent vmid=%s elapsed_s=%.3f",
+                vmid,
+                time.monotonic() - started,
+            )
         with tempfile.NamedTemporaryFile(delete=False) as tmp:
             tmp.write(data)
             tmp.flush()
             os.fsync(tmp.fileno())
             tmp_path = tmp.name
+        started = time.monotonic()
         res = _run_pct_push(vmid, tmp_path, path)
+        logger.info(
+            "Expose ports timing stage=pct_push vmid=%s elapsed_s=%.3f",
+            vmid,
+            time.monotonic() - started,
+        )
         if res.returncode != 0:
             raise RuntimeError(res.stderr or res.stdout or f"pct push returned {res.returncode}")
+        started = time.monotonic()
         _run_pct_exec_check(vmid, ["chown", "root:root", path])
+        logger.info(
+            "Expose ports timing stage=pct_chown_file vmid=%s elapsed_s=%.3f",
+            vmid,
+            time.monotonic() - started,
+        )
+        started = time.monotonic()
         _run_pct_exec_check(vmid, ["chmod", format(mode, "o"), path])
+        logger.info(
+            "Expose ports timing stage=pct_chmod_file vmid=%s elapsed_s=%.3f",
+            vmid,
+            time.monotonic() - started,
+        )
     finally:
         if tmp_path:
             try:
@@ -607,13 +763,29 @@ def _sync_exposed_services_into_container(
     proxmox: Any,
     node: str,
 ) -> None:
+    started = time.monotonic()
     vmid = _resolve_device_vmid(container_device_id, proxmox, node)
+    logger.info(
+        "Expose ports timing stage=resolve_target_vmid device_id=%s vmid=%s elapsed_s=%.3f",
+        container_device_id,
+        vmid,
+        time.monotonic() - started,
+    )
     services_payload = {
         "device_id": container_device_id,
         "exposed_services": exposed_ports,
     }
     json_data = (json.dumps(services_payload, indent=2) + "\n").encode("utf-8")
-    _push_root_file_to_container(vmid, EXPOSED_SERVICES_JSON_PATH, json_data, mode=0o644)
+    started = time.monotonic()
+    try:
+        _push_root_file_to_container(vmid, EXPOSED_SERVICES_JSON_PATH, json_data, mode=0o644)
+    finally:
+        logger.info(
+            "Expose ports timing stage=sync_container_metadata device_id=%s vmid=%s elapsed_s=%.3f",
+            container_device_id,
+            vmid,
+            time.monotonic() - started,
+        )
 
 
 def _rule_targets_container(rule: Dict[str, Any], container_device_id: str, domain: str) -> bool:
@@ -639,12 +811,19 @@ def set_container_forwarding_rules(
     container_device_id: Any,
     container_rules: List[Dict[str, Any]],
 ) -> Dict[str, Any]:
+    operation_started = time.monotonic()
     tunnel_state = _load_tunnel_state()
     domain = str(tunnel_state.get("domain") or "").strip().lower().rstrip(".")
     normalized_specs = _normalize_container_rule_specs(container_device_id, container_rules)
     normalized_device_id = str(container_device_id).strip()
 
     with _FORWARDING_UPDATE_LOCK:
+        lock_acquired = time.monotonic()
+        logger.info(
+            "Expose ports timing stage=lock_wait device_id=%s elapsed_s=%.3f",
+            normalized_device_id,
+            lock_acquired - operation_started,
+        )
         stored = load_forwarding_state().get("rules", [])
         existing_rules = _normalize_rules(stored, domain, from_storage=True)
         preserved_rules = [
@@ -652,18 +831,40 @@ def set_container_forwarding_rules(
             for rule in existing_rules
             if not _rule_targets_container(rule, normalized_device_id, domain)
         ]
+        existing_target_rules = [
+            rule
+            for rule in existing_rules
+            if _rule_targets_container(rule, normalized_device_id, domain)
+        ]
+        reusable_hostnames: Dict[tuple[int, str], str] = {}
+        recorded_target_ip = ""
+        for rule in existing_target_rules:
+            parsed = rule.get("parsed") or {}
+            if parsed.get("type") != "device":
+                continue
+            reusable_hostnames[(int(parsed["port"]), str(parsed["scheme"]))] = rule["hostname"]
+            recorded_target_ip = str(rule.get("resolved_ip") or recorded_target_ip)
         new_rules: List[Dict[str, Any]] = []
         exposed_ports: List[Dict[str, Any]] = []
         for spec in normalized_specs:
-            hostname = f"{spec['subdomain']}.{domain}"
+            hostname = reusable_hostnames.get((spec["port"], spec["protocol"]))
+            if not hostname:
+                hostname = _new_container_hostname(
+                    normalized_device_id,
+                    spec["port"],
+                    spec["protocol"],
+                    len(new_rules),
+                    tunnel_state,
+                )
             destination = f"{spec['protocol']}://[{normalized_device_id}]:{spec['port']}"
-            new_rules.append(
-                {
+            new_rule = {
                     "hostname": hostname,
                     "destination": destination,
                     "parsed": _parse_destination(destination),
                 }
-            )
+            if recorded_target_ip:
+                new_rule["resolved_ip"] = recorded_target_ip
+            new_rules.append(new_rule)
             exposed_ports.append(
                 {
                     "port": spec["port"],
@@ -676,16 +877,28 @@ def set_container_forwarding_rules(
         merged_rules = preserved_rules + new_rules
 
         # Ensure the child container receives updated exposure metadata first.
+        started = time.monotonic()
         infra_config = _ensure_infra_configured()
         proxmox = _connect_proxmox(infra_config)
         node = _get_node_from_config(infra_config)
+        logger.info(
+            "Expose ports timing stage=metadata_connect_proxmox device_id=%s elapsed_s=%.3f",
+            normalized_device_id,
+            time.monotonic() - started,
+        )
         try:
+            started = time.monotonic()
             _sync_exposed_services_into_container(
                 normalized_device_id,
                 exposed_ports,
                 proxmox,
                 node,
             )
+            logger.info(
+                "Expose ports timing stage=metadata_total device_id=%s elapsed_s=%.3f",
+                normalized_device_id,
+                time.monotonic() - started,
+            )
         except Exception:
             if exposed_ports:
                 raise
@@ -697,6 +910,13 @@ def set_container_forwarding_rules(
 
         persisted = _apply_and_persist_forwarding_rules(merged_rules, tunnel_state=tunnel_state)
 
+    logger.info(
+        "Expose ports timing stage=request_total device_id=%s elapsed_s=%.3f rule_count=%s",
+        normalized_device_id,
+        time.monotonic() - operation_started,
+        len(merged_rules),
+    )
+
     return {
         "device_id": normalized_device_id,
         "domain": domain,
@@ -706,6 +926,60 @@ def set_container_forwarding_rules(
     }
 
 
+def reconcile_container_forwarding_ip(
+    container_device_id: Any,
+    *,
+    proxmox: Any | None = None,
+    node: str | None = None,
+    lease_attempts: int = 1,
+    lease_retry_seconds: float = 1.0,
+) -> bool:
+    """Refresh ingress after a started exposed container receives a different IP."""
+    device_id = str(container_device_id or "").strip()
+    if not device_id:
+        return False
+    tunnel_state = _load_tunnel_state()
+    domain = str(tunnel_state.get("domain") or "").strip().lower().rstrip(".")
+    with _FORWARDING_UPDATE_LOCK:
+        stored = load_forwarding_state().get("rules", [])
+        rules = _normalize_rules(stored, domain, from_storage=True)
+        target_rules = [rule for rule in rules if _rule_targets_container(rule, device_id, domain)]
+        if not target_rules:
+            return False
+        if proxmox is None or node is None:
+            infra_config = _ensure_infra_configured()
+            proxmox = _connect_proxmox(infra_config)
+            node = _get_node_from_config(infra_config)
+        vmid = _resolve_device_vmid(device_id, proxmox, node)
+        live_ip = ""
+        last_error: Exception | None = None
+        for attempt in range(max(1, lease_attempts)):
+            try:
+                live_ip = _find_container_ip(proxmox, node, vmid, _load_leases())
+                break
+            except RuntimeError as exc:
+                last_error = exc
+                if attempt + 1 < max(1, lease_attempts):
+                    time.sleep(max(0.0, lease_retry_seconds))
+        if not live_ip:
+            raise RuntimeError(
+                f"Unable to resolve live IP after container start: {last_error}"
+            )
+        recorded_ips = {str(rule.get("resolved_ip") or "") for rule in target_rules}
+        if recorded_ips == {live_ip}:
+            return False
+        logger.info(
+            "Exposed container IP changed device_id=%s recorded_ips=%s live_ip=%s; rebuilding ingress",
+            device_id,
+            sorted(recorded_ips),
+            live_ip,
+        )
+        for rule in target_rules:
+            rule["resolved_ip"] = live_ip
+        _apply_and_persist_forwarding_rules(rules, tunnel_state=tunnel_state)
+        return True
+
+
 class CloudflareForwardingHandler(SyncHandler):
     @property
     def command_name(self) -> str: