remo-cli 2.2.0rc1__tar.gz → 2.2.0rc2__tar.gz

{remo_cli-2.2.0rc1 → remo_cli-2.2.0rc2}/.devcontainer/devcontainer.json

@@ -16,7 +16,7 @@
         "ghcr.io/eitsupi/devcontainer-features/jq-likes:2": {},
         "ghcr.io/devcontainers-extra/features/starship:1": {},
         "ghcr.io/get2knowio/devcontainer-features/ai-clis:2": {
-            "install": "claudeCode,specifyCli"
+            "install": "claudeCode,specifyCli,copilot,codex"
         },
         "ghcr.io/get2knowio/devcontainer-features/modern-cli-tools:2": {},
         "ghcr.io/get2knowio/devcontainer-features/python-tools:2": {
@@ -41,7 +41,7 @@
         "source=${localEnv:HOME}/.claude,target=/home/vscode/.claude,type=bind,consistency=cached",
 	"source=${localEnv:HOME}/.aws,target=/home/vscode/.aws,type=bind,consistency=cached",
         "source=${localEnv:HOME}/.ssh,target=/home/vscode/.ssh,type=bind,consistency=cached",
-        "source=${localWorkspaceFolder}/../site,target=/workspaces/site,type=bind,consistency=cached",
+        "source=${localWorkspaceFolder}/../site,target=/workspaces/site,type=bind,consistency=cached"
     ],
     "postCreateCommand": "python3 --version && node --version"
 }

remo_cli-2.2.0rc2/.specify/feature.json

@@ -0,0 +1,3 @@
+{
+  "feature_directory": "specs/011-web-adopt"
+}

{remo_cli-2.2.0rc1 → remo_cli-2.2.0rc2}/CLAUDE.md

@@ -13,6 +13,7 @@ See `.specify/memory/constitution.md` for project principles and non-negotiable
 - Flat file (`~/.config/remo/known_hosts`, colon-delimited) (003-python-cli-rewrite)
 - Cross-provider snapshot model (`models/snapshot.py`) + shared helpers in `core/snapshot.py` (name generator, validator, table formatter, destroy-time cleanup hook). No new runtime deps. (005-provider-snapshots)
 - FastAPI/Uvicorn + WebSockets (backend, optional `web` extra), TypeScript/Vite/React + ghostty-web (frontend), Bash (`remo-host` host command templated by Ansible) (010-web-session-interface)
+- Stdlib `urllib.request` CLI setup client + token-gated `/api/v1/setup/*` FastAPI surface; service state in flat files under the writable `REMO_HOME` volume (`web-identity/` keypair + service known_hosts, `~/.config/remo/web-service.json` saved credentials) (011-web-adopt)
 
 - Ansible 2.14+ / YAML + `ansible.builtin`, `community.general` (for zypper module) (001-bootstrap-incus-host)
 
@@ -27,7 +28,7 @@ src/remo_cli/              # Python CLI package (src layout, hatchling build)
 │   ├── shell.py           # remo shell
 │   ├── cp.py              # remo cp
 │   ├── init_cmd.py        # remo init
-│   ├── web.py             # remo web {serve,check} — lazy-imports remo_cli.web.* (NFR-008)
+│   ├── web.py             # remo web {serve,check,adopt,push} — serve/check lazy-import remo_cli.web.* (NFR-008); adopt/push use core/web_adopt only
 │   └── providers/         # Provider CLI groups
 │       ├── incus.py       # remo incus {create,destroy,update,list,sync,bootstrap}
 │       ├── hetzner.py     # remo hetzner {create,destroy,update,list,sync}
@@ -45,6 +46,7 @@ src/remo_cli/              # Python CLI package (src layout, hatchling build)
 │   ├── known_hosts.py     # Flat-file host registry
 │   ├── ssh.py             # build_ssh_base_cmd(), SSH options, terminal reset, timezone
 │   ├── remo_host_client.py  # Versioned remo-host protocol client (shared by CLI + web)
+│   ├── web_adopt.py       # Workstation-side adoption/push engine (stdlib HTTP, keyscan trust verify, authorized_keys mgmt, --via tunnel)
 │   ├── ansible_runner.py  # Ansible playbook subprocess
 │   ├── picker.py          # InquirerPy fuzzy picker
 │   ├── rsync.py           # File transfer
@@ -52,7 +54,8 @@ src/remo_cli/              # Python CLI package (src layout, hatchling build)
 │   └── init.py            # remo init logic
 ├── web/                    # remo-web service — FastAPI; optional `web` extra, lazily imported
 │   ├── app.py               # FastAPI factory: routers, Host/Origin+CSP middleware, serves built SPA
-│   ├── config.py             # WebSettings (REMO_WEB_* env vars, see docs/web-session-interface.md)
+│   ├── config.py             # WebSettings (REMO_WEB_* env vars incl. api_token, see docs/web-session-interface.md)
+│   ├── state.py              # ConfigurationState detection (unconfigured/adopted/mount_configured/broken) + service identity generation
 │   ├── discovery.py          # Concurrent per-instance discovery via remo-host + SSH
 │   ├── ssh_master.py         # Per-instance SSH ControlMaster lifecycle
 │   ├── terminal.py           # PTY + `ssh -tt … remo-host sessions attach`, resize/backpressure
@@ -64,6 +67,7 @@ src/remo_cli/              # Python CLI package (src layout, hatchling build)
 │   ├── models.py               # Service-only entities: TerminalAttachment, WsToken, SshMaster
 │   └── api/
 │       ├── hosts.py            # GET /api/v1/hosts, /sessions, POST /discovery/refresh
+│       ├── setup.py            # Token-gated /api/v1/setup/{status,identity,registry,verify} (011-web-adopt)
 │       └── terminals.py        # POST/GET/DELETE /api/v1/terminals, WS /api/v1/terminals/{id}
 └── models/
     ├── host.py             # KnownHost dataclass
@@ -182,10 +186,9 @@ Provider SDKs (boto3, hcloud) are lazy-imported with clear error messages if mis
 - Ansible 2.14+ / YAML: Follow standard conventions plus Constitution principles
 
 ## Recent Changes
+- 011-web-adopt: Added CLI-to-web adoption — unconfigured boot with service-scoped ed25519 identity, token-gated `/api/v1/setup/*` (REMO_WEB_API_TOKEN, fail-closed), `remo web adopt`/`remo web push` (registry mirror + workstation-verified host keys + idempotent `remo-web@<id>` authorized_keys entries), AwaitingAdoption SPA page.
 - 010-web-session-interface: Added remo-web Docker service (FastAPI + React/ghostty-web) brokering browser terminal sessions across all Remo-managed instances via a new remo-host SSH command; web extra + remo web {serve,check} CLI group.
 - 005-provider-snapshots: Added cross-provider snapshot CLI (`remo <P> snapshot {create,list,restore,delete}`) + destroy-time cleanup hook across Incus / Proxmox / AWS / Hetzner.
-- 003-python-cli-rewrite: Added Python 3.11+ + Click (CLI framework), InquirerPy (interactive picker), boto3 (AWS, optional), hcloud (Hetzner, optional)
-- 002-incus-container-support: Added Ansible 2.14+ / YAML + `ansible.builtin`, `community.general` (existing), Incus CLI (local)
 
 
 <!-- MANUAL ADDITIONS START -->

{remo_cli-2.2.0rc1 → remo_cli-2.2.0rc2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: remo-cli
-Version: 2.2.0rc1
+Version: 2.2.0rc2
 Summary: Remote development environment CLI
 License-Expression: MIT
 License-File: LICENSE
@@ -357,11 +357,19 @@ uv run remo web serve --host 127.0.0.1 --port 8080   # local dev
 ```
 
 For a home-lab install, use Docker Compose — see [`docker/compose.example.yml`](docker/compose.example.yml)
-for a ready-to-adapt file (read-only registry + SSH material mounts, tmpfs runtime dir, healthcheck,
-non-root/read-only hardening).
-
-Full architecture, security model, Compose walkthrough, credentials/SSM setup, discovery states,
-terminal limits, troubleshooting, and upgrade notes: **[docs/web-session-interface.md](docs/web-session-interface.md)**.
+for a ready-to-adapt file covering both deployment modes (tmpfs runtime dir, healthcheck,
+non-root/read-only hardening in either case):
+
+- **Bind-mount mode**: mount your existing registry and SSH key read-only — the container runs with
+  your identity, on the same box as your config.
+- **Adopted mode**: mount nothing. The container generates its own SSH identity in a writable state
+  volume, and a single `remo web adopt` from your workstation pushes your registry and authorizes
+  that identity on every instance — your personal private key never leaves the workstation
+  (`remo web push` re-syncs later changes).
+
+Full architecture, security model, Compose walkthrough, adoption workflow, credentials/SSM setup,
+discovery states, terminal limits, troubleshooting, and upgrade notes:
+**[docs/web-session-interface.md](docs/web-session-interface.md)**.
 
 ---
 

{remo_cli-2.2.0rc1 → remo_cli-2.2.0rc2}/README.md

@@ -331,11 +331,19 @@ uv run remo web serve --host 127.0.0.1 --port 8080   # local dev
 ```
 
 For a home-lab install, use Docker Compose — see [`docker/compose.example.yml`](docker/compose.example.yml)
-for a ready-to-adapt file (read-only registry + SSH material mounts, tmpfs runtime dir, healthcheck,
-non-root/read-only hardening).
-
-Full architecture, security model, Compose walkthrough, credentials/SSM setup, discovery states,
-terminal limits, troubleshooting, and upgrade notes: **[docs/web-session-interface.md](docs/web-session-interface.md)**.
+for a ready-to-adapt file covering both deployment modes (tmpfs runtime dir, healthcheck,
+non-root/read-only hardening in either case):
+
+- **Bind-mount mode**: mount your existing registry and SSH key read-only — the container runs with
+  your identity, on the same box as your config.
+- **Adopted mode**: mount nothing. The container generates its own SSH identity in a writable state
+  volume, and a single `remo web adopt` from your workstation pushes your registry and authorizes
+  that identity on every instance — your personal private key never leaves the workstation
+  (`remo web push` re-syncs later changes).
+
+Full architecture, security model, Compose walkthrough, adoption workflow, credentials/SSM setup,
+discovery states, terminal limits, troubleshooting, and upgrade notes:
+**[docs/web-session-interface.md](docs/web-session-interface.md)**.
 
 ---
 

{remo_cli-2.2.0rc1 → remo_cli-2.2.0rc2}/docker/compose.example.yml

@@ -117,3 +117,100 @@ services:
       retries: 3
       start_period: 10s
     restart: unless-stopped
+
+  # ---------------------------------------------------------------------------
+  # Adopted mode (011-web-adopt) — an ALTERNATIVE to `remo-web` above; run one
+  # or the other, not both (they publish the same host port).
+  #
+  # When to use which:
+  #
+  #   - `remo-web` (above, bind-mount mode): you are happy to mount your
+  #     existing registry and SSH material read-only into the container. The
+  #     service boots fully configured with YOUR key; nothing else to do.
+  #     Upgrading to this release changes nothing about that mode (SC-005).
+  #
+  #   - `remo-web-adopted` (below): nothing from your workstation is mounted.
+  #     The service boots UNCONFIGURED with an empty named state volume,
+  #     generates its own service-scoped SSH identity there on first start
+  #     (under web-identity/, comment `remo-web@<deployment-id>`), and waits
+  #     in a stable "awaiting adoption" state (GET /api/v1/ready -> 200
+  #     `{"status": "unconfigured"}`). Complete setup from a workstation with
+  #     a working remo CLI:
+  #
+  #       remo web adopt http://<docker-host>:8080
+  #
+  #     which pushes your registry + instance host keys and authorizes the
+  #     service's OWN public key on each instance — your personal private key
+  #     never leaves the workstation. Later registry changes are re-pushed
+  #     with `remo web push`.
+  #
+  # This service carries `profiles: ["adopted"]` so a plain `docker compose
+  # up` still starts only the bind-mount service above. Start this one with:
+  #
+  #   docker compose --profile adopted up -d
+  remo-web-adopted:
+    profiles: ["adopted"]
+    # Same image (and the same optional `build:` override) as `remo-web`
+    # above — the mode is chosen purely by what is mounted, not by the image.
+    image: ghcr.io/get2knowio/remo-web:latest
+    ports:
+      # Adoption traffic (the token-gated /api/v1/setup/* calls made by
+      # `remo web adopt`) arrives over this same port. Loopback-only means
+      # the workstation running the CLI must be the Docker host itself —
+      # otherwise bind a LAN IP here deliberately, or keep loopback and run
+      # `remo web adopt --via <docker-host>` to tunnel over SSH.
+      - "127.0.0.1:8080:8080"
+    environment:
+      # REQUIRED for adopted mode: while this is unset/empty the setup API
+      # does not exist at all (every /api/v1/setup/* request gets a plain
+      # 404), so adoption is impossible. Generate a strong random value,
+      # e.g.:
+      #
+      #   openssl rand -hex 24
+      #
+      # and pass the same value to the CLI via $REMO_API_TOKEN (or the
+      # interactive prompt) when running `remo web adopt`.
+      - "REMO_WEB_API_TOKEN=replace-me--generate-with--openssl-rand-hex-24"
+      # The REMO_WEB_ALLOWED_HOSTS / REMO_WEB_ALLOWED_ORIGINS notes on the
+      # service above apply here unchanged.
+    volumes:
+      # A writable named state volume at REMO_HOME — the ONLY volume in this
+      # mode (no registry mount, no ~/.ssh mounts; presence of those is what
+      # puts the service in mount-configured mode instead). It holds the
+      # pushed registry, per-instance host keys, and the service identity
+      # keypair. Deleting the volume resets the service to unconfigured with
+      # a NEW identity on next boot; it revokes nothing on the instances —
+      # remove the old `remo-web@<deployment-id>` authorized_keys line there.
+      - "remo-web-state:/home/remo/.config/remo"
+    # Identical hardening to the bind-mount service: adopted mode only moves
+    # WHERE configuration comes from, never loosens the runtime posture.
+    #
+    # The tmpfs mode is pinned because an option-less tmpfs mount is
+    # remounted root-owned 0755 (unwritable to uid 1000) by a container
+    # *restart* — `docker compose restart`, or the restart policy reviving
+    # the process — which would fail the startup runtime-dir check on every
+    # boot after the first. `rw,mode=1777` is exactly what Docker mounts on
+    # first boot anyway; pinning it just makes restarts behave the same.
+    tmpfs:
+      - "/run/remo-ssh:rw,mode=1777"
+    read_only: true
+    user: "1000:1000"
+    security_opt:
+      - "no-new-privileges:true"
+    cap_drop:
+      - "ALL"
+    healthcheck:
+      # /api/v1/ready answers 200 for BOTH `ready` and `unconfigured` — a
+      # container awaiting adoption is healthy and must not crash-loop or
+      # flap the healthcheck while it waits (SC-006).
+      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8080/api/v1/ready"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+    restart: unless-stopped
+
+volumes:
+  # Adopted-mode state (see `remo-web-adopted`). Created on first
+  # `--profile adopted` start; harmless if you only use bind-mount mode.
+  remo-web-state:

{remo_cli-2.2.0rc1 → remo_cli-2.2.0rc2}/docker/entrypoint.sh

@@ -20,6 +20,14 @@
 # Full per-instance diagnostics remain available via `remo web check` (no
 # flag), and readiness is (correctly) config-only via GET /api/v1/ready.
 #
+# 011-web-adopt (SC-006): *unconfigured* is a PASSING state for this gate.
+# A fresh writable state volume with no registry/key material yet makes
+# `remo web check` report "awaiting adoption — run `remo web adopt`" and
+# exit 0, so an adopted-mode container boots cleanly (no crash loop under
+# `restart: unless-stopped`) while it waits for adoption. Only genuinely
+# broken configuration (mounted artifacts present but unusable, missing
+# runtime prerequisites) still aborts here.
+#
 # `exec` replaces this script's process (PID 1) with `remo web serve` so it
 # receives signals (SIGTERM) directly, which graceful shutdown depends on.