remo-cli 3.1.0__tar.gz → 4.0.0__tar.gz

{remo_cli-3.1.0 → remo_cli-4.0.0}/.devcontainer/devcontainer.json

@@ -27,6 +27,16 @@
     "remoteEnv": {
         "GH_PAGER": ""
     },
+    "containerEnv": {
+        // Put Claude Code's config INSIDE the mounted ~/.claude directory.
+        // By default the config lives at ~/.claude.json, OUTSIDE that mount, so
+        // every container starts unauthenticated even though .credentials.json is
+        // shared. Bind-mounting the file directly does not work: a file bind pins
+        // to the inode, so the first atomic rewrite orphans the container's view
+        // and silently discards writes. Relocating into the directory mount avoids
+        // that entirely and shares auth across every devcontainer on the host.
+        "CLAUDE_CONFIG_DIR": "/home/vscode/.claude"
+    },
     "customizations": {
         "vscode": {
             "settings": {

{remo_cli-3.1.0 → remo_cli-4.0.0}/.github/workflows/release-please.yml

@@ -43,6 +43,7 @@ jobs:
           private-key: ${{ secrets.RELEASE_PLEASE_APP_KEY }}
 
       - uses: googleapis/release-please-action@v4
+        id: release
         with:
           # Token precedence:
           #   1. GitHub App installation token (recommended — see above).
@@ -55,3 +56,39 @@ jobs:
           token: ${{ steps.app-token.outputs.token || secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
+
+      # release-please bumps `pyproject.toml` but knows nothing about uv.lock,
+      # which records the project's own version in its `remo-cli` package entry.
+      # Left alone the two drift apart at every release (3.1.0 shipped with a
+      # lockfile still saying 3.0.0), and the drift then reappears as noise in
+      # the next unrelated PR, because any `uv run` regenerates it.
+      #
+      # Amend the sync onto the release PR itself. release-please force-pushes
+      # its branch whenever it refreshes the PR, which would drop this commit —
+      # but this job runs immediately after that refresh on every push to main,
+      # so the commit is simply re-made. `tests/unit/test_lockfile_version.py`
+      # is the backstop that keeps a drifted lockfile from merging at all.
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        if: ${{ steps.release.outputs.pr }}
+
+      - name: Sync uv.lock onto the release PR
+        if: ${{ steps.release.outputs.pr }}
+        env:
+          RELEASE_BRANCH: ${{ fromJSON(steps.release.outputs.pr).headBranchName }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          git clone --branch "$RELEASE_BRANCH" --depth 1 \
+            "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" release-pr
+          cd release-pr
+          # `uv lock` is not an upgrade: it re-resolves only what the manifest
+          # forces, so the sole change here is the bumped project version.
+          uv lock
+          if git diff --quiet -- uv.lock; then
+            echo "uv.lock already matches the bumped version; nothing to do."
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git commit -m "chore: sync uv.lock with the released version" -- uv.lock
+          git push origin "HEAD:${RELEASE_BRANCH}"

remo_cli-4.0.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "4.0.0"
+}

{remo_cli-3.1.0 → remo_cli-4.0.0}/AGENTS.md

@@ -26,13 +26,13 @@ Principles I, IV, and VIII are machine-enforced — see [Quality Gates](#quality
 - Python 3.11+ + Click (CLI framework), InquirerPy (interactive picker), boto3 (unconditional runtime dependency, used by the CLI's own lazy `import boto3` in `providers/aws.py` and by the Ansible `amazon.aws`/`community.aws` collections), hcloud (unconditional runtime dependency, consumed by the Ansible layer, not the CLI's own Python code) (003-python-cli-rewrite)
 - Versioned JSON registry (`~/.config/remo/registry.json`, format v2 — named fields per type, no positional overloading; single accessor `core/registry.py` owns parse/serialize/validate/lock/migrate for CLI, providers, and the web service). Legacy `~/.config/remo/known_hosts` (colon-delimited) is read-only migration input, lazily migrated to v2 on first CLI read and renamed to `known_hosts.v1.bak`. (003-python-cli-rewrite; superseded by 015-registry-v2)
 - Cross-provider snapshot model (`models/snapshot.py`) + shared helpers in `core/snapshot.py` (name generator, validator, table formatter, destroy-time cleanup hook). No new runtime deps. (005-provider-snapshots)
-- FastAPI/Uvicorn + WebSockets (backend, optional `web` extra), TypeScript/Vite/React + ghostty-web (frontend), Bash (`remo-host` host command templated by Ansible) (010-web-session-interface)
+- FastAPI/Uvicorn + WebSockets (backend, optional `web` extra), TypeScript/Vite/React + xterm.js (frontend), Bash (`remo-host` host command templated by Ansible) (010-web-session-interface)
 - Stdlib `urllib.request` CLI setup client + token-gated `/api/v1/setup/*` FastAPI surface; service state in flat files under the writable `REMO_HOME` volume (`web-identity/` keypair + service known_hosts, `~/.config/remo/web-service.json` saved credentials, `cache_version: 2`) (011-web-adopt; payload versioning updated by 015-registry-v2)
 - `core/registry.py`: stdlib `json` (format), `fcntl` (advisory locking via a `registry.lock` sidecar), `os.replace` (atomic writes). No new runtime deps. Setup API mirror payload moved to v2 (`contracts/mirror-payload-v2.md`) with a `payload_versions` capability handshake; an upgraded service still accepts v1 payloads. (015-registry-v2)
 - `core/reconcile.py`: provider-agnostic sync-reconcile engine (`SyncScope`, `DiscoveredHost`, `ProbeResult`, `build_plan` (pure), `render_plan`, the consent gate, `apply_plan` via the existing `mutate_registry()`, and the `run_sync` driver). No new runtime deps — stdlib only, built on `core/registry.py`/`core/output.py` as-is. (016-sync-reconcile)
 - `core/web_adopt.py` is now the single unified push engine (`run_push`; `run_adopt` is a thin deprecated alias) — first push adopts, later pushes re-sync, plus best-effort `remo-web@` revocation on removal, `--force` full re-authorization, and multi-workstation flap detection against the service's mirror-generation marker. `core/web_drift.py`: new stdlib-only offline registry-vs-push-cache diff (`diff_registry_against_cache`, `select_deployment`, `render_drift`) powering `remo web status` and the shared `out_of_date_notice()`/`emit_out_of_date_notice()` post-mutation nudge (importable without the `web` extra). Push cache bumped to `cache_version: 3` (`~/.config/remo/web-service.json`: per-deployment `{mirror_generation, instances}`, each instance retaining a non-secret connection tuple for revocation). Service side: `web/api/setup.py` writes/serves a `web-identity/mirror-meta.json` marker (generation + last-push descriptor) additively on `/setup/{status,registry}`; `web/state.py` mode detection fixed so a personal `~/.ssh/id_*` no longer forces `mount_configured` (non-writable `REMO_HOME` is the authoritative signal) with a new `REMO_WEB_MODE` override in `web/config.py`. No new runtime deps; no registry schema change. (017-web-adopt-simplify)
 - No new runtime deps or registry schema change. `pyproject.toml`'s existing `hcloud`/`boto3`/`httpx2` entries gained consumer-attribution comments; `tests/unit/test_docs_structure.py` is a new stdlib-only pytest module (parses the structure diagram below, no new dependency). (019-hygiene-deps-docs)
-- No new runtime deps; no registry schema change (the `host_user`/`node_user` JSON keys already matched the new flag spellings). `core/provider_registry.py` gains `ArgumentSpec` (positional-argument metadata) and `CommandSpec.target`; `ProviderDescriptor.update_options` is replaced by `upgrade_options`/`resize_dimensions`/`resize_options`/`tag_options`/`host_commands`. `cli/providers/factory.py` gains `_build_upgrade`/`_build_resize`/`_build_tag`/`_build_host_group` (dropping `_build_update` and flat-mounted `bootstrap`). (021-cli-plane-separation)
+- No new runtime deps; no registry schema change (the `host_user`/`node_user` JSON keys already matched the new flag spellings). Superseded for Proxmox by the `--node-user` → `--host-user` rename: both host-scoped providers now spell the node/host login `--host-user`/`host_user` on the CLI, in the provider kwargs and in `registry.json`; `core/registry.py` still reads a legacy `proxmox.node_user` key so pre-rename registries load unchanged and migrate on the next write. `core/provider_registry.py` gains `ArgumentSpec` (positional-argument metadata) and `CommandSpec.target`; `ProviderDescriptor.update_options` is replaced by `upgrade_options`/`resize_dimensions`/`resize_options`/`tag_options`/`host_commands`. `cli/providers/factory.py` gains `_build_upgrade`/`_build_resize`/`_build_tag`/`_build_host_group` (dropping `_build_update` and flat-mounted `bootstrap`). (021-cli-plane-separation)
 
 - Ansible 2.14+ / YAML + `ansible.builtin`, `community.general` (for zypper module) (001-bootstrap-incus-host)
 - Formal provider abstraction: `core/provider_registry.py` (`ProviderDescriptor`/`OptionSpec`/`CommandSpec`/`ConnectionSpec` + registry), `core/provider_protocol.py` (`Provider` Protocol), `core/errors.py` (typed taxonomy: `ProviderError`/`MissingDependencyError`/`PreconditionError`/`OperationFailedError`/`UserAbortedError`), `core/lifecycle.py` (shared `run_destroy` template), `cli/providers/factory.py` (generates all four provider CLI groups from descriptors). No new runtime deps. (018-provider-abstraction)
@@ -76,7 +76,7 @@ src/remo_cli/              # Python CLI package (src layout, hatchling build)
 │   ├── ssh.py             # build_ssh_base_cmd(), SSH options, terminal reset, timezone; SSM ProxyCommand construction lives behind descriptor.connection.proxy_hook (AWS: providers/aws.py:ssh_proxy_hook), not hardcoded here
 │   ├── reconcile.py       # SyncScope/DiscoveredHost/build_plan/run_sync; DiscoveredHost.observed (frozenset[str] | None) + observed-aware merge_entry (closes #87 — a provider-filled default never clobbers a hand-edited registry value); SyncScope validation/scoping driven by descriptor name_format + is_provider_type, no literal type tuples
 │   ├── remo_host_client.py  # Versioned remo-host protocol client (shared by CLI + web)
-│   ├── web_adopt.py       # Unified workstation push engine: run_push (adopt-or-resync), run_adopt alias, keyscan trust verify, authorized_keys authorize + best-effort revoke, --force, flap detection, push cache v3, --via tunnel (stdlib HTTP)
+│   ├── web_adopt.py       # Unified workstation push engine: run_push (adopt-or-resync), run_adopt alias, keyscan trust verify, authorized_keys authorize + best-effort revoke, verification-driven self-heal of `unchanged` instances that verify auth_failed (#122), --force, flap detection, push cache v3, --via tunnel (stdlib HTTP)
 │   ├── web_drift.py       # Offline registry-vs-push-cache diff + shared out-of-date nudge (stdlib + core/models only; no web extra)
 │   ├── ansible_runner.py  # Ansible playbook subprocess; build_configure_extra_vars() (timezone+tools+version, replaces 8 inline copies) and run_resize_playbook() (raises OperationFailedError on nonzero rc)
 │   ├── snapshot.py        # Name generation/validation/table formatting; list_all_snapshots(type_name, lister) aggregates across a provider's registry slice (replaces 4 CLI-layer loops)
@@ -118,8 +118,7 @@ frontend/                  # remo-web browser SPA (Vite + React + TypeScript)
 │   ├── api/client.ts        # REST + WS terminal client (remo-terminal.v1 subprotocol)
 │   ├── components/          # Dashboard, InstanceGroup, TargetCard, GridView, TabView, TerminalCard
 │   ├── state/                # discovery.ts, workspace.ts (layout persisted to localStorage)
-│   └── terminal/              # RendererAdapter, GhosttyRenderer (default), XtermRenderer (fallback)
-└── public/                    # Same-origin-served ghostty-web WASM asset
+│   └── terminal/              # RendererAdapter (seam), XtermRenderer (the one engine), TerminalConnection, keymap
 
 docker/                    # remo-web container packaging (010-web-session-interface, US4)
 ├── Dockerfile               # multi-stage: frontend build -> wheel build -> slim Python runtime

{remo_cli-3.1.0 → remo_cli-4.0.0}/CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## [4.0.0](https://github.com/get2knowio/remo/compare/v3.1.0...v4.0.0) (2026-08-03)
+
+
+### ⚠ BREAKING CHANGES
+
+* **web:** drop the ghostty-web renderer, leaving xterm.js as the engine ([#130](https://github.com/get2knowio/remo/issues/130))
+* **providers:** `remo proxmox`'s `--node-user` flag is now `--host-user`, on every verb that took it (create, upgrade, resize, tag, destroy, sync, info, host bootstrap). Scripts passing `--node-user` will fail with a Click "no such option" error naming the new spelling. Separately, a container whose registry entry has no recorded host user is now reached via ssh_config rather than as root — matching how create reached it.
+
+### Features
+
+* **web:** give the console a light/dark mode and selectable terminal themes ([#129](https://github.com/get2knowio/remo/issues/129)) ([7905c4b](https://github.com/get2knowio/remo/commit/7905c4b4f4d94403cc4a48c7a9858776774bf47c))
+
+
+### Bug Fixes
+
+* **ansible:** stop provisioning failing when GitHub rate-limits the zellij lookup ([#132](https://github.com/get2knowio/remo/issues/132)) ([cda5d0b](https://github.com/get2knowio/remo/commit/cda5d0b748bc90bb685b28510645d4fe29c35061))
+* **ansible:** survive the SSM reconnect after the UID-1000 swap ([#133](https://github.com/get2knowio/remo/issues/133)) ([1a76f92](https://github.com/get2knowio/remo/commit/1a76f92107e3bd6fb7bfce60e51a0d284a0f4dcf))
+* **devcontainer:** point CLAUDE_CONFIG_DIR at the mounted ~/.claude ([#125](https://github.com/get2knowio/remo/issues/125)) ([b9da45d](https://github.com/get2knowio/remo/commit/b9da45ddc4ed6f513a895e54de9e2e0dd16fe436))
+* **providers:** spell the Proxmox node login `--host-user`, and record it honestly ([#124](https://github.com/get2knowio/remo/issues/124)) ([830d4d6](https://github.com/get2knowio/remo/commit/830d4d65ecab5c9e78b019323b3ad8b9d926f474)), closes [#106](https://github.com/get2knowio/remo/issues/106) [#107](https://github.com/get2knowio/remo/issues/107)
+* **release:** keep uv.lock's version in step with the release bump ([#126](https://github.com/get2knowio/remo/issues/126)) ([137fa55](https://github.com/get2knowio/remo/commit/137fa55dead73c2da07037d22480e788332f9bb3))
+* unwedge apt, stop authorized_keys being clobbered, and self-heal `remo web push` ([#123](https://github.com/get2knowio/remo/issues/123)) ([679fab9](https://github.com/get2knowio/remo/commit/679fab9f84b90fa33d3ef6eb2f58e568430c9fd9))
+* **web:** make the console's background poll actually re-run discovery ([#128](https://github.com/get2knowio/remo/issues/128)) ([6d18d37](https://github.com/get2knowio/remo/commit/6d18d374023b2d6f1dccf4535016d00bfde92b12))
+* **web:** recover from an expired access-proxy session without a manual reload ([#131](https://github.com/get2knowio/remo/issues/131)) ([3ce3e8e](https://github.com/get2knowio/remo/commit/3ce3e8ea9c1ab3c568b128356e5884631465df9f))
+
+
+### Code Refactoring
+
+* **web:** drop the ghostty-web renderer, leaving xterm.js as the engine ([#130](https://github.com/get2knowio/remo/issues/130)) ([c3e9170](https://github.com/get2knowio/remo/commit/c3e917044c756e1138817b70380177d636824ab2))
+
 ## [3.1.0](https://github.com/get2knowio/remo/compare/v3.0.0...v3.1.0) (2026-07-29)
 
 

{remo_cli-3.1.0 → remo_cli-4.0.0}/CLAUDE.md

@@ -26,13 +26,13 @@ Principles I, IV, and VIII are machine-enforced — see [Quality Gates](#quality
 - Python 3.11+ + Click (CLI framework), InquirerPy (interactive picker), boto3 (unconditional runtime dependency, used by the CLI's own lazy `import boto3` in `providers/aws.py` and by the Ansible `amazon.aws`/`community.aws` collections), hcloud (unconditional runtime dependency, consumed by the Ansible layer, not the CLI's own Python code) (003-python-cli-rewrite)
 - Versioned JSON registry (`~/.config/remo/registry.json`, format v2 — named fields per type, no positional overloading; single accessor `core/registry.py` owns parse/serialize/validate/lock/migrate for CLI, providers, and the web service). Legacy `~/.config/remo/known_hosts` (colon-delimited) is read-only migration input, lazily migrated to v2 on first CLI read and renamed to `known_hosts.v1.bak`. (003-python-cli-rewrite; superseded by 015-registry-v2)
 - Cross-provider snapshot model (`models/snapshot.py`) + shared helpers in `core/snapshot.py` (name generator, validator, table formatter, destroy-time cleanup hook). No new runtime deps. (005-provider-snapshots)
-- FastAPI/Uvicorn + WebSockets (backend, optional `web` extra), TypeScript/Vite/React + ghostty-web (frontend), Bash (`remo-host` host command templated by Ansible) (010-web-session-interface)
+- FastAPI/Uvicorn + WebSockets (backend, optional `web` extra), TypeScript/Vite/React + xterm.js (frontend), Bash (`remo-host` host command templated by Ansible) (010-web-session-interface)
 - Stdlib `urllib.request` CLI setup client + token-gated `/api/v1/setup/*` FastAPI surface; service state in flat files under the writable `REMO_HOME` volume (`web-identity/` keypair + service known_hosts, `~/.config/remo/web-service.json` saved credentials, `cache_version: 2`) (011-web-adopt; payload versioning updated by 015-registry-v2)
 - `core/registry.py`: stdlib `json` (format), `fcntl` (advisory locking via a `registry.lock` sidecar), `os.replace` (atomic writes). No new runtime deps. Setup API mirror payload moved to v2 (`contracts/mirror-payload-v2.md`) with a `payload_versions` capability handshake; an upgraded service still accepts v1 payloads. (015-registry-v2)
 - `core/reconcile.py`: provider-agnostic sync-reconcile engine (`SyncScope`, `DiscoveredHost`, `ProbeResult`, `build_plan` (pure), `render_plan`, the consent gate, `apply_plan` via the existing `mutate_registry()`, and the `run_sync` driver). No new runtime deps — stdlib only, built on `core/registry.py`/`core/output.py` as-is. (016-sync-reconcile)
 - `core/web_adopt.py` is now the single unified push engine (`run_push`; `run_adopt` is a thin deprecated alias) — first push adopts, later pushes re-sync, plus best-effort `remo-web@` revocation on removal, `--force` full re-authorization, and multi-workstation flap detection against the service's mirror-generation marker. `core/web_drift.py`: new stdlib-only offline registry-vs-push-cache diff (`diff_registry_against_cache`, `select_deployment`, `render_drift`) powering `remo web status` and the shared `out_of_date_notice()`/`emit_out_of_date_notice()` post-mutation nudge (importable without the `web` extra). Push cache bumped to `cache_version: 3` (`~/.config/remo/web-service.json`: per-deployment `{mirror_generation, instances}`, each instance retaining a non-secret connection tuple for revocation). Service side: `web/api/setup.py` writes/serves a `web-identity/mirror-meta.json` marker (generation + last-push descriptor) additively on `/setup/{status,registry}`; `web/state.py` mode detection fixed so a personal `~/.ssh/id_*` no longer forces `mount_configured` (non-writable `REMO_HOME` is the authoritative signal) with a new `REMO_WEB_MODE` override in `web/config.py`. No new runtime deps; no registry schema change. (017-web-adopt-simplify)
 - No new runtime deps or registry schema change. `pyproject.toml`'s existing `hcloud`/`boto3`/`httpx2` entries gained consumer-attribution comments; `tests/unit/test_docs_structure.py` is a new stdlib-only pytest module (parses the structure diagram below, no new dependency). (019-hygiene-deps-docs)
-- No new runtime deps; no registry schema change (the `host_user`/`node_user` JSON keys already matched the new flag spellings). `core/provider_registry.py` gains `ArgumentSpec` (positional-argument metadata) and `CommandSpec.target`; `ProviderDescriptor.update_options` is replaced by `upgrade_options`/`resize_dimensions`/`resize_options`/`tag_options`/`host_commands`. `cli/providers/factory.py` gains `_build_upgrade`/`_build_resize`/`_build_tag`/`_build_host_group` (dropping `_build_update` and flat-mounted `bootstrap`). (021-cli-plane-separation)
+- No new runtime deps; no registry schema change (the `host_user`/`node_user` JSON keys already matched the new flag spellings). Superseded for Proxmox by the `--node-user` → `--host-user` rename: both host-scoped providers now spell the node/host login `--host-user`/`host_user` on the CLI, in the provider kwargs and in `registry.json`; `core/registry.py` still reads a legacy `proxmox.node_user` key so pre-rename registries load unchanged and migrate on the next write. `core/provider_registry.py` gains `ArgumentSpec` (positional-argument metadata) and `CommandSpec.target`; `ProviderDescriptor.update_options` is replaced by `upgrade_options`/`resize_dimensions`/`resize_options`/`tag_options`/`host_commands`. `cli/providers/factory.py` gains `_build_upgrade`/`_build_resize`/`_build_tag`/`_build_host_group` (dropping `_build_update` and flat-mounted `bootstrap`). (021-cli-plane-separation)
 
 - Ansible 2.14+ / YAML + `ansible.builtin`, `community.general` (for zypper module) (001-bootstrap-incus-host)
 - Formal provider abstraction: `core/provider_registry.py` (`ProviderDescriptor`/`OptionSpec`/`CommandSpec`/`ConnectionSpec` + registry), `core/provider_protocol.py` (`Provider` Protocol), `core/errors.py` (typed taxonomy: `ProviderError`/`MissingDependencyError`/`PreconditionError`/`OperationFailedError`/`UserAbortedError`), `core/lifecycle.py` (shared `run_destroy` template), `cli/providers/factory.py` (generates all four provider CLI groups from descriptors). No new runtime deps. (018-provider-abstraction)
@@ -76,7 +76,7 @@ src/remo_cli/              # Python CLI package (src layout, hatchling build)
 │   ├── ssh.py             # build_ssh_base_cmd(), SSH options, terminal reset, timezone; SSM ProxyCommand construction lives behind descriptor.connection.proxy_hook (AWS: providers/aws.py:ssh_proxy_hook), not hardcoded here
 │   ├── reconcile.py       # SyncScope/DiscoveredHost/build_plan/run_sync; DiscoveredHost.observed (frozenset[str] | None) + observed-aware merge_entry (closes #87 — a provider-filled default never clobbers a hand-edited registry value); SyncScope validation/scoping driven by descriptor name_format + is_provider_type, no literal type tuples
 │   ├── remo_host_client.py  # Versioned remo-host protocol client (shared by CLI + web)
-│   ├── web_adopt.py       # Unified workstation push engine: run_push (adopt-or-resync), run_adopt alias, keyscan trust verify, authorized_keys authorize + best-effort revoke, --force, flap detection, push cache v3, --via tunnel (stdlib HTTP)
+│   ├── web_adopt.py       # Unified workstation push engine: run_push (adopt-or-resync), run_adopt alias, keyscan trust verify, authorized_keys authorize + best-effort revoke, verification-driven self-heal of `unchanged` instances that verify auth_failed (#122), --force, flap detection, push cache v3, --via tunnel (stdlib HTTP)
 │   ├── web_drift.py       # Offline registry-vs-push-cache diff + shared out-of-date nudge (stdlib + core/models only; no web extra)
 │   ├── ansible_runner.py  # Ansible playbook subprocess; build_configure_extra_vars() (timezone+tools+version, replaces 8 inline copies) and run_resize_playbook() (raises OperationFailedError on nonzero rc)
 │   ├── snapshot.py        # Name generation/validation/table formatting; list_all_snapshots(type_name, lister) aggregates across a provider's registry slice (replaces 4 CLI-layer loops)
@@ -117,9 +117,9 @@ frontend/                  # remo-web browser SPA (Vite + React + TypeScript)
 ├── src/
 │   ├── api/client.ts        # REST + WS terminal client (remo-terminal.v1 subprotocol)
 │   ├── components/          # Dashboard, InstanceGroup, TargetCard, GridView, TabView, TerminalCard
-│   ├── state/                # discovery.ts, workspace.ts (layout persisted to localStorage)
-│   └── terminal/              # RendererAdapter, GhosttyRenderer (default), XtermRenderer (fallback)
-└── public/                    # Same-origin-served ghostty-web WASM asset
+│   ├── state/                # discovery.ts, workspace.ts (layout persisted to localStorage), settings.ts (display prefs: site light/dark mode, accent, fonts, terminal theme + per-target overrides)
+│   ├── terminal/              # RendererAdapter (seam), XtermRenderer (the one engine), TerminalConnection, keymap
+│   └── theme/                 # tokens.css (light-dark() palette, one pair per token), fonts.ts, terminalThemes.ts (8 terminal color schemes: a token-derived Remo Dark/Light pair the default 'auto' selection tracks, plus 6 curated third-party)
 
 docker/                    # remo-web container packaging (010-web-session-interface, US4)
 ├── Dockerfile               # multi-stage: frontend build -> wheel build -> slim Python runtime

{remo_cli-3.1.0 → remo_cli-4.0.0}/CONTRIBUTING.md

@@ -148,9 +148,12 @@ curl -fsSL https://get2knowio.github.io/remo/install.sh | bash
 >
 > See `.github/workflows/release-please.yml`.
 >
-> **Note:** release-please does not run `uv lock`; if `uv.lock`'s recorded
-> project version matters to you, run `uv lock` and amend it onto the release PR
-> before merging.
+> **`uv.lock` is synced for you.** release-please bumps `pyproject.toml` but
+> knows nothing about `uv.lock`, which records the project's own version too.
+> The workflow now runs `uv lock` against the release branch and commits the
+> result onto the release PR, and `tests/unit/test_lockfile_version.py` fails
+> the build if the two ever disagree — so a drifted lockfile can't merge. If
+> that test does fire, the fix is `uv lock` plus a commit.
 
 ### Version Numbering
 

{remo_cli-3.1.0 → remo_cli-4.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: remo-cli
-Version: 3.1.0
+Version: 4.0.0
 Summary: Remote development environment CLI
 License-Expression: MIT
 License-File: LICENSE
@@ -375,7 +375,7 @@ remo proxmox sync --host <node>     # Reconcile registry with remo-managed conta
 remo proxmox sync --host <node> --all   # Also adopt non-remo containers on the node
 remo proxmox sync --host <node> --yes   # Skip the removal confirmation
 remo proxmox sync --host <node> --dry-run   # Preview the plan, change nothing
-remo proxmox upgrade <n> [--host H] [--node-user U]   # Update dev tools
+remo proxmox upgrade <n> [--host H] [--host-user U]   # Update dev tools
 remo proxmox resize <n> --volume-size 40 --cores 4 --memory 4096
 remo proxmox tag <n>                # Mark as remo-managed
 remo proxmox destroy --name <n> [--yes] [--purge]   # Destroy container

{remo_cli-3.1.0 → remo_cli-4.0.0}/README.md

@@ -349,7 +349,7 @@ remo proxmox sync --host <node>     # Reconcile registry with remo-managed conta
 remo proxmox sync --host <node> --all   # Also adopt non-remo containers on the node
 remo proxmox sync --host <node> --yes   # Skip the removal confirmation
 remo proxmox sync --host <node> --dry-run   # Preview the plan, change nothing
-remo proxmox upgrade <n> [--host H] [--node-user U]   # Update dev tools
+remo proxmox upgrade <n> [--host H] [--host-user U]   # Update dev tools
 remo proxmox resize <n> --volume-size 40 --cores 4 --memory 4096
 remo proxmox tag <n>                # Mark as remo-managed
 remo proxmox destroy --name <n> [--yes] [--purge]   # Destroy container

{remo_cli-3.1.0 → remo_cli-4.0.0}/ansible/aws_configure.yml

@@ -72,6 +72,12 @@
       delay: 10
       until: apt_lock_result.rc | default(1) == 0
 
+    # Unwedge apt before the first apt call: a sources line naming a keyring
+    # that no longer exists makes apt refuse to read ANY source list, which
+    # would fail the cache update below and leave the host unrepairable (#120).
+    - name: Repair apt sources referencing a missing keyring
+      ansible.builtin.include_tasks: tasks/repair_apt_sources.yml
+
     - name: Update apt cache
       ansible.builtin.apt:
         update_cache: true

{remo_cli-3.1.0 → remo_cli-4.0.0}/ansible/aws_site.yml

@@ -53,6 +53,12 @@
       delay: 10
       until: apt_lock_result.rc | default(1) == 0
 
+    # Unwedge apt before the first apt call: a sources line naming a keyring
+    # that no longer exists makes apt refuse to read ANY source list, which
+    # would fail the cache update below and leave the host unrepairable (#120).
+    - name: Repair apt sources referencing a missing keyring
+      ansible.builtin.include_tasks: tasks/repair_apt_sources.yml
+
     - name: Update apt cache
       ansible.builtin.apt:
         update_cache: true

{remo_cli-3.1.0 → remo_cli-4.0.0}/ansible/hetzner_configure.yml

@@ -33,6 +33,12 @@
       delay: 10
       until: apt_lock_result.rc | default(1) == 0
 
+    # Unwedge apt before the first apt call: a sources line naming a keyring
+    # that no longer exists makes apt refuse to read ANY source list, which
+    # would fail the cache update below and leave the host unrepairable (#120).
+    - name: Repair apt sources referencing a missing keyring
+      ansible.builtin.include_tasks: tasks/repair_apt_sources.yml
+
     - name: Update apt cache
       ansible.builtin.apt:
         update_cache: true

{remo_cli-3.1.0 → remo_cli-4.0.0}/ansible/hetzner_site.yml

@@ -35,6 +35,12 @@
       delay: 10
       until: apt_lock_result.rc | default(1) == 0
 
+    # Unwedge apt before the first apt call: a sources line naming a keyring
+    # that no longer exists makes apt refuse to read ANY source list, which
+    # would fail the cache update below and leave the host unrepairable (#120).
+    - name: Repair apt sources referencing a missing keyring
+      ansible.builtin.include_tasks: tasks/repair_apt_sources.yml
+
     - name: Update apt cache
       ansible.builtin.apt:
         update_cache: true

{remo_cli-3.1.0 → remo_cli-4.0.0}/ansible/incus_configure.yml

@@ -43,6 +43,13 @@
   become: true
   gather_facts: true
 
+  # Proxmox/Incus place the operator's key straight into the remo user's
+  # authorized_keys at create time, so user_setup must not re-seed it from
+  # root's — doing so overwrote keys placed by other tooling, notably the
+  # `remo-web@…` line `remo web push` installs (#121).
+  vars:
+    user_setup_bootstrap_cloud_keys: false
+
   pre_tasks:
     - name: Wait for apt to be ready
       ansible.builtin.shell: |
@@ -57,6 +64,12 @@
       delay: 10
       until: apt_lock_result.rc | default(1) == 0
 
+    # Unwedge apt before the first apt call: a sources line naming a keyring
+    # that no longer exists makes apt refuse to read ANY source list, which
+    # would fail the cache update below and leave the host unrepairable (#120).
+    - name: Repair apt sources referencing a missing keyring
+      ansible.builtin.include_tasks: tasks/repair_apt_sources.yml
+
     - name: Update apt cache
       ansible.builtin.apt:
         update_cache: true

{remo_cli-3.1.0 → remo_cli-4.0.0}/ansible/incus_site.yml

@@ -50,6 +50,13 @@
   become: true
   gather_facts: false
 
+  # Proxmox/Incus place the operator's key straight into the remo user's
+  # authorized_keys at create time, so user_setup must not re-seed it from
+  # root's — doing so overwrote keys placed by other tooling, notably the
+  # `remo-web@…` line `remo web push` installs (#121).
+  vars:
+    user_setup_bootstrap_cloud_keys: false
+
   pre_tasks:
     - name: Wait for SSH to stabilize after cloud-init
       ansible.builtin.wait_for_connection:
@@ -72,6 +79,12 @@
       delay: 10
       until: apt_lock_result.rc | default(1) == 0
 
+    # Unwedge apt before the first apt call: a sources line naming a keyring
+    # that no longer exists makes apt refuse to read ANY source list, which
+    # would fail the cache update below and leave the host unrepairable (#120).
+    - name: Repair apt sources referencing a missing keyring
+      ansible.builtin.include_tasks: tasks/repair_apt_sources.yml
+
     - name: Update apt cache
       ansible.builtin.apt:
         update_cache: true

{remo_cli-3.1.0 → remo_cli-4.0.0}/ansible/proxmox_bootstrap.yml

@@ -32,4 +32,4 @@
           - Template: {{ proxmox_template }}
 
           Launch a container:
-            remo proxmox create --name dev1 --host {{ inventory_hostname }} --node-user {{ ansible_user | default('root') }}
+            remo proxmox create --name dev1 --host {{ inventory_hostname }} --host-user {{ ansible_user | default('root') }}

{remo_cli-3.1.0 → remo_cli-4.0.0}/ansible/proxmox_configure.yml

@@ -30,6 +30,13 @@
   become: true
   gather_facts: true
 
+  # Proxmox/Incus place the operator's key straight into the remo user's
+  # authorized_keys at create time, so user_setup must not re-seed it from
+  # root's — doing so overwrote keys placed by other tooling, notably the
+  # `remo-web@…` line `remo web push` installs (#121).
+  vars:
+    user_setup_bootstrap_cloud_keys: false
+
   pre_tasks:
     - name: Wait for apt to be ready
       ansible.builtin.shell: |
@@ -44,6 +51,12 @@
       delay: 10
       until: apt_lock_result.rc | default(1) == 0
 
+    # Unwedge apt before the first apt call: a sources line naming a keyring
+    # that no longer exists makes apt refuse to read ANY source list, which
+    # would fail the cache update below and leave the host unrepairable (#120).
+    - name: Repair apt sources referencing a missing keyring
+      ansible.builtin.include_tasks: tasks/repair_apt_sources.yml
+
     - name: Update apt cache
       ansible.builtin.apt:
         update_cache: true

{remo_cli-3.1.0 → remo_cli-4.0.0}/ansible/proxmox_site.yml

@@ -50,6 +50,13 @@
   become: true
   gather_facts: false
 
+  # Proxmox/Incus place the operator's key straight into the remo user's
+  # authorized_keys at create time, so user_setup must not re-seed it from
+  # root's — doing so overwrote keys placed by other tooling, notably the
+  # `remo-web@…` line `remo web push` installs (#121).
+  vars:
+    user_setup_bootstrap_cloud_keys: false
+
   pre_tasks:
     - name: Wait for SSH to stabilize
       ansible.builtin.wait_for_connection:
@@ -72,6 +79,12 @@
       delay: 10
       until: apt_lock_result.rc | default(1) == 0
 
+    # Unwedge apt before the first apt call: a sources line naming a keyring
+    # that no longer exists makes apt refuse to read ANY source list, which
+    # would fail the cache update below and leave the host unrepairable (#120).
+    - name: Repair apt sources referencing a missing keyring
+      ansible.builtin.include_tasks: tasks/repair_apt_sources.yml
+
     - name: Update apt cache
       ansible.builtin.apt:
         update_cache: true

{remo_cli-3.1.0 → remo_cli-4.0.0}/ansible/roles/nodejs/tasks/main.yml

@@ -49,6 +49,13 @@
 
 # Superseded by nodesource.asc above; removed so a rotated key cannot leave a
 # stale trusted key behind on an already-provisioned machine.
+#
+# Removing the keyring is not enough on its own: the `deb ... signed-by=...
+# nodesource.gpg` line that names it survives in nodesource.list, and apt
+# rejects the whole sources tree over the conflicting Signed-By (#120). That
+# line is dropped by `ansible/tasks/repair_apt_sources.yml`, which every
+# configure/site playbook runs as a pre_task — it has to happen before the
+# first apt call, which is earlier than this role can run.
 - name: Remove superseded de-armored NodeSource keyring
   ansible.builtin.file:
     path: /etc/apt/keyrings/nodesource.gpg

{remo_cli-3.1.0 → remo_cli-4.0.0}/ansible/roles/proxmox_container/defaults/main.yml

@@ -66,6 +66,12 @@ proxmox_container_ssh_key_path: "~/.ssh/id_rsa.pub"
 # connect to the container in the configure play.
 proxmox_container_ssh_private_key: "~/.ssh/id_rsa"
 
+# Scratch path inside the container where the pubkey lands before it is merged
+# into authorized_keys. Staging exists so the install is additive rather than a
+# `pct push` overwrite that would revoke keys remo did not place (#121); the
+# file is removed by the merge step.
+proxmox_container_pubkey_staging_path: "/run/remo-pubkey.pub"
+
 # ============================================================================
 # WAIT TIMEOUTS
 # ============================================================================

{remo_cli-3.1.0 → remo_cli-4.0.0}/ansible/roles/proxmox_container/tasks/main.yml

@@ -224,19 +224,55 @@
   changed_when: false
   failed_when: pct_sshdir_result.rc | default(1) != 0
 
-- name: Push SSH pubkey into container via pct push
+# `pct push` straight onto authorized_keys REPLACES the file, so re-running
+# create against an existing container destroyed every key remo did not put
+# there — the same defect user_setup had on the configure path (#121). Stage
+# the pubkey, then merge it line by line: additive, so a key installed by other
+# tooling (notably `remo web push`'s `remo-web@…` line) survives, and a second
+# run reports no change (Principle VII).
+- name: Stage SSH pubkey inside container via pct push
   ansible.builtin.command:
     cmd: >-
       pct push {{ proxmox_container_vmid }}
       {{ proxmox_container_pubkey_host_path }}
-      /home/{{ proxmox_container_ssh_user }}/.ssh/authorized_keys
-      --user {{ proxmox_container_ssh_user }}
-      --group {{ proxmox_container_ssh_user }}
+      {{ proxmox_container_pubkey_staging_path }}
       --perms 0600
   register: pct_push_result
-  changed_when: pct_push_result.rc | default(1) == 0
+  changed_when: false
   failed_when: pct_push_result.rc | default(1) != 0
 
+- name: Merge staged pubkey into authorized_keys
+  ansible.builtin.command:
+    argv:
+      - pct
+      - exec
+      - "{{ proxmox_container_vmid }}"
+      - --
+      - bash
+      - -c
+      - |
+        set -eu
+        user={{ proxmox_container_ssh_user | quote }}
+        staged={{ proxmox_container_pubkey_staging_path | quote }}
+        ak="/home/$user/.ssh/authorized_keys"
+        install -d -o "$user" -g "$user" -m 0700 "/home/$user/.ssh"
+        [ -f "$ak" ] || : > "$ak"
+        changed=0
+        while IFS= read -r line || [ -n "$line" ]; do
+          case "$line" in ''|'#'*) continue ;; esac
+          if ! grep -qxF "$line" "$ak"; then
+            printf '%s\n' "$line" >> "$ak"
+            changed=1
+          fi
+        done < "$staged"
+        chown "$user:$user" "$ak"
+        chmod 0600 "$ak"
+        rm -f "$staged"
+        echo "remo_authorized_keys_changed=$changed"
+  register: pct_merge_key_result
+  changed_when: "'remo_authorized_keys_changed=1' in (pct_merge_key_result.stdout | default(''))"
+  failed_when: pct_merge_key_result.rc | default(1) != 0
+
 - name: Harden sshd config (UseDNS no, PermitRootLogin no, GSSAPI off)
   ansible.builtin.command:
     cmd: >-

{remo_cli-3.1.0 → remo_cli-4.0.0}/ansible/roles/proxmox_container/tasks/preflight.yml

@@ -44,5 +44,5 @@
         pveam update
         pveam download {{ proxmox_container_template.split(':')[0] }} {{ proxmox_container_template.split('/')[-1] }}
 
-      Or run: remo proxmox host bootstrap {{ inventory_hostname }} --node-user {{ ansible_user | default('root') }}
+      Or run: remo proxmox host bootstrap {{ inventory_hostname }} --host-user {{ ansible_user | default('root') }}
   when: proxmox_container_template not in (template_check.stdout | default(''))

{remo_cli-3.1.0 → remo_cli-4.0.0}/ansible/roles/user_setup/defaults/main.yml

@@ -1,6 +1,15 @@
 ---
 remo_user: "remo"
 
+# Seed the remo user's authorized_keys from the key the cloud provider injected
+# elsewhere on the box (Hetzner -> root, EC2 -> ubuntu). Only Hetzner and AWS
+# need this; Proxmox and Incus write the key straight into the remo user's file
+# at create time, and running the bootstrap there overwrote keys placed by other
+# tooling — notably the `remo-web@…` line `remo web push` installs (#121). Those
+# two providers' configure/site playbooks set this false. Even where it does
+# run, the bootstrap merges and only fires on first contact.
+user_setup_bootstrap_cloud_keys: true
+
 # Version displayed in project-menu banner
 remo_version: ""