runtime-sdk 0.4.49__py3-none-win_amd64.whl

runtime_sdk/secrets.py

@@ -0,0 +1,155 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+from runtime_sdk import output as cli_output
+from runtime_sdk.auth import authenticated_client
+from runtime_sdk.config import RuntimeConfig, RuntimeConfigError
+
+
+def _coerce_secret_set_slug(slug: str | None) -> str | None:
+    value = str(slug or "").strip()
+    return value or None
+
+
+def _parse_secret_pairs(pairs: list[str] | None) -> dict[str, str]:
+    values: dict[str, str] = {}
+    for pair in pairs or []:
+        if "=" not in pair:
+            raise RuntimeConfigError(f"invalid secret pair: {pair}")
+        key, value = pair.split("=", 1)
+        key = key.strip()
+        if not key:
+            raise RuntimeConfigError(f"invalid secret pair: {pair}")
+        values[key] = value
+    return values
+
+
+def _parse_secret_delivery(
+    proxy_specs: list[str] | None, values: dict[str, str]
+) -> dict[str, dict[str, str]]:
+    delivery: dict[str, dict[str, str]] = {}
+    for spec in proxy_specs or []:
+        if "=" not in spec:
+            raise RuntimeConfigError(f"invalid proxy delivery: {spec}")
+        key, host = spec.split("=", 1)
+        key = key.strip()
+        host = host.strip()
+        if not key or not host or key not in values:
+            raise RuntimeConfigError(f"invalid proxy delivery: {spec}")
+        delivery[key] = {
+            "delivery": "proxy",
+            "target_host": host,
+            "header": "Authorization",
+            "scheme": "Bearer",
+        }
+    return delivery
+
+
+def _parse_env_file(path: str) -> dict[str, str]:
+    try:
+        lines = Path(path).read_text(encoding="utf-8").splitlines()
+    except OSError as exc:
+        raise RuntimeConfigError(f"failed to read env file: {exc}") from exc
+    values: dict[str, str] = {}
+    for raw_line in lines:
+        line = raw_line.strip()
+        if not line or line.startswith("#"):
+            continue
+        if line.startswith("export "):
+            line = line[len("export ") :].strip()
+        if "=" not in line:
+            raise RuntimeConfigError(f"invalid env line: {raw_line}")
+        key, value = line.split("=", 1)
+        key = key.strip()
+        if not key:
+            raise RuntimeConfigError(f"invalid env line: {raw_line}")
+        value = value.strip()
+        if value and value[0] == value[-1] and value[0] in {'"', "'"}:
+            value = value[1:-1]
+        values[key] = value
+    return values
+
+
+def handle_secrets_list(config: RuntimeConfig) -> int:
+    if (err := cli_output.require_auth(config)) is not None:
+        return err
+    client = authenticated_client(config)
+    return cli_output.report_success(client.list_secret_sets())
+
+
+def handle_secrets_show(config: RuntimeConfig, slug: str | None) -> int:
+    if (err := cli_output.require_auth(config)) is not None:
+        return err
+    resolved_slug = _coerce_secret_set_slug(slug)
+    if resolved_slug is None:
+        if not cli_output.interactive():
+            return cli_output.report_error("secret set slug is required")
+        resolved_slug = cli_output.prompt_text("Secret set slug")
+        if not resolved_slug:
+            return cli_output.report_error("secret set slug is required")
+    client = authenticated_client(config)
+    return cli_output.report_success(client.get_secret_set(resolved_slug))
+
+
+def handle_secrets_set(
+    config: RuntimeConfig,
+    slug: str | None,
+    pairs: list[str] | None,
+    proxy_specs: list[str] | None,
+) -> int:
+    if (err := cli_output.require_auth(config)) is not None:
+        return err
+    resolved_slug = _coerce_secret_set_slug(slug)
+    if resolved_slug is None:
+        if not cli_output.interactive():
+            return cli_output.report_error("secret set slug is required")
+        resolved_slug = cli_output.prompt_text("Secret set slug")
+        if not resolved_slug:
+            return cli_output.report_error("secret set slug is required")
+    values = _parse_secret_pairs(pairs)
+    if not values:
+        return cli_output.report_error("at least one KEY=VALUE pair is required")
+    delivery = _parse_secret_delivery(proxy_specs, values)
+    client = authenticated_client(config)
+    secret_set = client.put_secret_set(resolved_slug, values, delivery)
+    return cli_output.report_success({"secret_set": secret_set})
+
+
+def handle_secrets_import(
+    config: RuntimeConfig,
+    slug: str | None,
+    env_file: str,
+    proxy_specs: list[str] | None,
+) -> int:
+    if (err := cli_output.require_auth(config)) is not None:
+        return err
+    resolved_slug = _coerce_secret_set_slug(slug)
+    if resolved_slug is None:
+        if not cli_output.interactive():
+            return cli_output.report_error("secret set slug is required")
+        resolved_slug = cli_output.prompt_text("Secret set slug")
+        if not resolved_slug:
+            return cli_output.report_error("secret set slug is required")
+    values = _parse_env_file(env_file)
+    if not values:
+        return cli_output.report_error("env file did not contain any secrets")
+    delivery = _parse_secret_delivery(proxy_specs, values)
+    client = authenticated_client(config)
+    secret_set = client.put_secret_set(resolved_slug, values, delivery)
+    return cli_output.report_success({"secret_set": secret_set})
+
+
+def handle_secrets_delete(config: RuntimeConfig, slug: str | None) -> int:
+    if (err := cli_output.require_auth(config)) is not None:
+        return err
+    resolved_slug = _coerce_secret_set_slug(slug)
+    if resolved_slug is None:
+        if not cli_output.interactive():
+            return cli_output.report_error("secret set slug is required")
+        resolved_slug = cli_output.prompt_text("Secret set slug")
+        if not resolved_slug:
+            return cli_output.report_error("secret set slug is required")
+    client = authenticated_client(config)
+    client.delete_secret_set(resolved_slug)
+    return cli_output.report_success({"slug": resolved_slug, "deleted": True})

runtime_sdk/services.py

@@ -0,0 +1,173 @@
+from __future__ import annotations
+
+import json
+import sys
+
+from runtime_sdk import arguments, computers, output as cli_output
+from runtime_sdk.auth import authenticated_client
+from runtime_sdk.config import RuntimeConfig
+
+
+def handle_startup_show(config: RuntimeConfig, computer_id: str | None) -> int:
+    if (err := cli_output.require_auth(config)) is not None:
+        return err
+
+    if computer_id is None:
+        if not cli_output.interactive():
+            return cli_output.report_error("computer id is required")
+        picked = computers.pick_computer(config, "Pick a computer")
+        if picked is None:
+            return 0
+        computer_id = picked.get("id") or picked.get("slug")
+        if not computer_id:
+            return cli_output.report_error("computer is missing an id")
+
+    client = authenticated_client(config)
+    computer_id = computers.resolve_computer_ref(client, computer_id)
+    result = client.get_startup_config(computer_id)
+    return cli_output.report_success(result)
+
+
+def handle_startup_set(
+    config: RuntimeConfig,
+    computer_id: str | None,
+    command: str | None,
+    cwd: str | None,
+    port: int | None,
+) -> int:
+    if (err := cli_output.require_auth(config)) is not None:
+        return err
+    if not computer_id:
+        return cli_output.report_error("computer id is required")
+    if not command:
+        return cli_output.report_error("startup command is required")
+    if port is None:
+        return cli_output.report_error("port is required")
+    if port <= 0 or port > 65535:
+        return cli_output.report_error("port must be between 1 and 65535")
+
+    client = authenticated_client(config)
+    computer_id = computers.resolve_computer_ref(client, computer_id)
+    result = client.set_startup_config(computer_id, command=command, cwd=cwd, port=port)
+    return cli_output.report_success(result)
+
+
+def handle_startup_clear(config: RuntimeConfig, computer_id: str | None) -> int:
+    if (err := cli_output.require_auth(config)) is not None:
+        return err
+    if not computer_id:
+        return cli_output.report_error("computer id is required")
+
+    client = authenticated_client(config)
+    computer_id = computers.resolve_computer_ref(client, computer_id)
+    result = client.clear_startup_config(computer_id)
+
+    return cli_output.report_success(result or {"configured": False})
+
+
+def handle_service_run(
+    config: RuntimeConfig,
+    computer_id: str | None,
+    port: int | None,
+    cwd: str | None,
+    command_parts: list[str] | None,
+) -> int:
+    if (err := cli_output.require_auth(config)) is not None:
+        return err
+    if not computer_id:
+        return cli_output.report_error("computer id is required")
+    if port is None or port <= 0 or port > 65535:
+        return cli_output.report_error("port must be between 1 and 65535")
+    command = arguments.command_from_remainder(command_parts)
+    if not command:
+        return cli_output.report_error("service run requires -- <command...>")
+
+    client = authenticated_client(config)
+    computer_id = computers.resolve_computer_ref(client, computer_id)
+    result = client.run_service(computer_id, command=command, cwd=cwd, port=port)
+    return cli_output.report_success(result)
+
+
+def handle_service_show(config: RuntimeConfig, computer_id: str | None) -> int:
+    if (err := cli_output.require_auth(config)) is not None:
+        return err
+
+    if computer_id is None:
+        if not cli_output.interactive():
+            return cli_output.report_error("computer id is required")
+        picked = computers.pick_computer(config, "Pick a computer")
+        if picked is None:
+            return 0
+        computer_id = picked.get("id") or picked.get("slug")
+        if not computer_id:
+            return cli_output.report_error("computer is missing an id")
+
+    client = authenticated_client(config)
+    computer_id = computers.resolve_computer_ref(client, computer_id)
+    result = client.get_service_config(computer_id)
+    return cli_output.report_success(result)
+
+
+def handle_service_logs(
+    config: RuntimeConfig, computer_id: str | None, follow: bool
+) -> int:
+    if (err := cli_output.require_auth(config)) is not None:
+        return err
+    if not computer_id:
+        return cli_output.report_error("computer id is required")
+    client = authenticated_client(config)
+    computer_id = computers.resolve_computer_ref(client, computer_id)
+    for line in client.stream_service_logs(computer_id, follow=follow):
+        try:
+            frame = json.loads(line)
+        except ValueError:
+            print(line)
+            continue
+        stdout = frame.get("stdout") or ""
+        stderr = frame.get("stderr") or ""
+        data = frame.get("data") or ""
+        error = frame.get("error") or ""
+        if stdout:
+            print(stdout, end="")
+        if stderr:
+            print(stderr, end="", file=sys.stderr)
+        if data:
+            print(data, end="")
+        if error:
+            print(error, file=sys.stderr)
+    return 0
+
+
+def handle_service_restart(config: RuntimeConfig, computer_id: str | None) -> int:
+    if (err := cli_output.require_auth(config)) is not None:
+        return err
+    if not computer_id:
+        return cli_output.report_error("computer id is required")
+    client = authenticated_client(config)
+    computer_id = computers.resolve_computer_ref(client, computer_id)
+    result = client.restart_service(computer_id)
+    return cli_output.report_success(result)
+
+
+def handle_service_stop(config: RuntimeConfig, computer_id: str | None) -> int:
+    if (err := cli_output.require_auth(config)) is not None:
+        return err
+    if not computer_id:
+        return cli_output.report_error("computer id is required")
+    client = authenticated_client(config)
+    computer_id = computers.resolve_computer_ref(client, computer_id)
+    result = client.stop_service(computer_id)
+    return cli_output.report_success(result)
+
+
+def handle_service_clear(config: RuntimeConfig, computer_id: str | None) -> int:
+    if (err := cli_output.require_auth(config)) is not None:
+        return err
+    if not computer_id:
+        return cli_output.report_error("computer id is required")
+
+    client = authenticated_client(config)
+    computer_id = computers.resolve_computer_ref(client, computer_id)
+    result = client.clear_service_config(computer_id)
+
+    return cli_output.report_success(result or {"configured": False})

runtime_sdk/ssh.py

@@ -0,0 +1,197 @@
+from __future__ import annotations
+
+import base64
+import secrets
+import shlex
+import shutil
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+from typing import Callable
+
+from runtime_sdk import computers, output as cli_output, proxy
+from runtime_sdk.auth import authenticated_client
+from runtime_sdk.client import RuntimeAPIError, RuntimeClient
+from runtime_sdk.config import RuntimeConfig, RuntimeConfigError
+
+
+def handle_ssh(
+    config: RuntimeConfig, computer_id: str | None, ssh_args: list[str] | None = None
+) -> int:
+    if (err := cli_output.require_auth(config)) is not None:
+        return err
+    ssh_bin = shutil.which("ssh")
+    if not ssh_bin:
+        return cli_output.report_error("ssh is not installed")
+    ssh_keygen_bin = shutil.which("ssh-keygen")
+    if not ssh_keygen_bin:
+        return cli_output.report_error("ssh-keygen is not installed")
+
+    if computer_id is None:
+        if not cli_output.interactive():
+            return cli_output.report_error("computer id is required")
+        picked = computers.pick_computer(
+            config,
+            "Pick a computer to ssh",
+            lambda c: computers.computer_internal_status(c) in ("running", "cold"),
+        )
+        if picked is None:
+            return 0
+        computer_id = picked.get("id") or picked.get("slug")
+        if not computer_id:
+            return cli_output.report_error("computer is missing an id")
+
+    client = authenticated_client(config)
+    resolved_id = computers.resolve_computer_ref(client, str(computer_id))
+    args = _ssh_extra_args(ssh_args or [])
+
+    with tempfile.TemporaryDirectory(prefix="runtime-ssh-") as temp_dir:
+        temp = Path(temp_dir)
+        key_path = temp / "id_ed25519"
+        known_hosts = temp / "known_hosts"
+        marker = "runtimevm-ssh-" + secrets.token_hex(8)
+        if (key_status := _generate_ssh_key(ssh_keygen_bin, key_path)) != 0:
+            return cli_output.report_error(
+                f"ssh-keygen failed with exit code {key_status}"
+            )
+        public_key = (
+            key_path.with_suffix(key_path.suffix + ".pub")
+            .read_text(encoding="utf-8")
+            .strip()
+        )
+
+        client.create_terminal_ticket(resolved_id)
+        cleanup_proxy: Callable[[], None] | None = None
+        try:
+            _install_temporary_ssh_key(client, resolved_id, public_key, marker)
+            local_port, cleanup_proxy = proxy.start_temporary_proxy(
+                config, resolved_id, 22
+            )
+            ssh_cmd = [
+                ssh_bin,
+                "-i",
+                str(key_path),
+                "-p",
+                str(local_port),
+                "-o",
+                "IdentitiesOnly=yes",
+                "-o",
+                f"UserKnownHostsFile={known_hosts}",
+                "-o",
+                "StrictHostKeyChecking=accept-new",
+                "-o",
+                "LogLevel=ERROR",
+                "runtime@127.0.0.1",
+            ]
+            ssh_cmd.extend(args)
+            return subprocess.run(ssh_cmd).returncode
+        finally:
+            if cleanup_proxy is not None:
+                cleanup_proxy()
+            _remove_temporary_ssh_key(client, resolved_id, marker)
+
+
+def _ssh_extra_args(args: list[str]) -> list[str]:
+    if args and args[0] == "--":
+        return args[1:]
+    return args
+
+
+def _generate_ssh_key(ssh_keygen_bin: str, key_path: Path) -> int:
+    return subprocess.run(
+        [
+            ssh_keygen_bin,
+            "-q",
+            "-t",
+            "ed25519",
+            "-N",
+            "",
+            "-C",
+            "runtimevm-ephemeral",
+            "-f",
+            str(key_path),
+        ]
+    ).returncode
+
+
+def _install_temporary_ssh_key(
+    client: RuntimeClient, computer_id: str, public_key: str, marker: str
+) -> None:
+    encoded_key = base64.b64encode(public_key.encode()).decode()
+    script = f"""set -euo pipefail
+if ! command -v sshd >/dev/null 2>&1 && [ ! -x /usr/sbin/sshd ]; then
+  echo "openssh-server is not installed in this VM image" >&2
+  exit 127
+fi
+mkdir -p /run/sshd
+if command -v systemctl >/dev/null 2>&1; then
+  systemctl start ssh 2>/dev/null || systemctl start sshd 2>/dev/null || /usr/sbin/sshd
+else
+  /usr/sbin/sshd
+fi
+install -d -m 755 -o runtime -g runtime /home/runtime/.runtime
+cat > /home/runtime/.runtime/ssh-session <<'RUNTIME_SSH_SESSION'
+#!/bin/bash
+set -e
+if [ -f /home/runtime/.runtime/prompt.sh ]; then
+  . /home/runtime/.runtime/prompt.sh
+fi
+if [ -f /home/runtime/.runtime/branch-workspace.sh ]; then
+  . /home/runtime/.runtime/branch-workspace.sh
+fi
+if [ -n "${{SSH_ORIGINAL_COMMAND:-}}" ]; then
+  exec /bin/bash -lc "$SSH_ORIGINAL_COMMAND"
+fi
+exec /bin/bash -l
+RUNTIME_SSH_SESSION
+chown runtime:runtime /home/runtime/.runtime/ssh-session
+chmod 755 /home/runtime/.runtime/ssh-session
+install -d -m 700 -o runtime -g runtime /home/runtime/.ssh
+auth=/home/runtime/.ssh/authorized_keys
+touch "$auth"
+chown runtime:runtime "$auth"
+chmod 600 "$auth"
+tmp="$(mktemp)"
+grep -Fv -- {shlex.quote(marker)} "$auth" > "$tmp" || true
+cat "$tmp" > "$auth"
+rm -f "$tmp"
+key="$(printf %s {shlex.quote(encoded_key)} | base64 -d)"
+printf 'command="/home/runtime/.runtime/ssh-session" %s %s\\n' "$key" {shlex.quote(marker)} >> "$auth"
+chown runtime:runtime "$auth"
+chmod 600 "$auth"
+"""
+    result = client.run_command(
+        computer_id, script, uid=0, gid=0, cwd="/", shell="/bin/bash"
+    )
+    if int(result.get("exit_code") or 0) != 0:
+        stderr = str(result.get("stderr") or "").strip()
+        raise RuntimeConfigError(stderr or "failed to install temporary SSH key")
+
+
+def _remove_temporary_ssh_key(
+    client: RuntimeClient, computer_id: str, marker: str
+) -> None:
+    script = f"""set -euo pipefail
+auth=/home/runtime/.ssh/authorized_keys
+[ -f "$auth" ] || exit 0
+tmp="$(mktemp)"
+grep -Fv -- {shlex.quote(marker)} "$auth" > "$tmp" || true
+cat "$tmp" > "$auth"
+rm -f "$tmp"
+chown runtime:runtime "$auth"
+chmod 600 "$auth"
+"""
+    try:
+        result = client.run_command(
+            computer_id, script, uid=0, gid=0, cwd="/", shell="/bin/bash"
+        )
+    except RuntimeAPIError as exc:
+        print(f"warning: failed to remove temporary SSH key: {exc}", file=sys.stderr)
+        return
+    if int(result.get("exit_code") or 0) != 0:
+        stderr = str(result.get("stderr") or "").strip()
+        print(
+            f"warning: failed to remove temporary SSH key: {stderr or 'cleanup command failed'}",
+            file=sys.stderr,
+        )