witbitz-code 1.11.0__tar.gz → 1.12.0__tar.gz

{witbitz_code-1.11.0/src/witbitz_code.egg-info → witbitz_code-1.12.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: witbitz-code
-Version: 1.11.0
+Version: 1.12.0
 Summary: Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay.
 Author: Witbitz
 License-Expression: MIT

{witbitz_code-1.11.0 → witbitz_code-1.12.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "witbitz-code"
-version = "1.11.0"
+version = "1.12.0"
 description = "Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay."
 readme = "README.md"
 requires-python = ">=3.10"

{witbitz_code-1.11.0 → witbitz_code-1.12.0}/src/witbitz_code/__init__.py

@@ -4,4 +4,4 @@ The Python implementation of tools/witbitz-code.mjs (docs/opencode-relay.md phas
 vectors and cross-implementation tests.
 """
 
-__version__ = "1.11.0"
+__version__ = "1.12.0"

{witbitz_code-1.11.0 → witbitz_code-1.12.0}/src/witbitz_code/codekeys.py

@@ -26,6 +26,7 @@ from cryptography.hazmat.primitives.asymmetric import ec, ed25519
 from cryptography.hazmat.primitives.ciphers.aead import AESGCM
 from cryptography.hazmat.primitives.kdf.hkdf import HKDF
 
+from . import app as app_mod
 from . import pairings as pp
 
 API = "https://api.witbitz.chat/v1/spaces/code-keys"
@@ -194,7 +195,7 @@ def sign_in_left_s(token: str, now: float | None = None) -> float:
 
 
 async def mint(client: httpx.AsyncClient, *, id_token: str, account: str, computer_id: str, name: str,
-               ident: dict | None = None) -> dict:
+               ident: dict | None = None, app: str | None = None) -> dict:
     """Ask the account for this computer's keys → the entry to save. Raises CodeKeyRefusal with a sentence."""
     if not id_token:
         raise CodeKeyRefusal("not_signed_in", REFUSALS["not_signed_in"])
@@ -202,19 +203,28 @@ async def mint(client: httpx.AsyncClient, *, id_token: str, account: str, comput
         raise CodeKeyRefusal("signin_stale", REFUSALS["signin_stale"])
     ident = ident or new_identity()
     try:
+        # `app`: the Spaces app this pairing belongs to — each app keeps its own computers and allowance (the owner,
+        # 2026-10-23: "they should be completely separate"); the server files the keys under that app's tenant.
         r = await client.post(api_base(), json={"idToken": id_token, "computerId": computer_id, "name": name,
-                                                "sealPub": seal_pub(ident), "signPub": sign_pub(ident)}, timeout=30)
+                                                "sealPub": seal_pub(ident), "signPub": sign_pub(ident), "app": app or app_mod.name()}, timeout=30)
     except httpx.HTTPError as e:
         raise CodeKeyRefusal("unreachable", f"could not reach Witbitz to get this computer's keys ({str(e)[:80]})") from e
     if r.status_code != 200:
         raise _refusal(r, account)
     d = (r.json() or {}).get("data") or {}
-    entry = {"account": account, "computerId": computer_id, "name": name, "keyId": d.get("keyId"), "tenantId": d.get("tenantId"),
-             "userId": d.get("userId"), "kid": d.get("kid"), **ident, "caps": d.get("caps") or {}, "at": int(time.time() * 1000)}
+    entry = {"account": account, "computerId": computer_id, "name": name, **ident, "app": app or app_mod.name(), "at": int(time.time() * 1000)}
+    return _take(entry, d)
+
+
+def _take(entry: dict, d: dict) -> dict:
+    """A minted pair (a pairing, or a move to the computer's own app) into `entry`: its ids, caps and keys opened with the
+    computer's own identity. Raises CodeKeyRefusal when they cannot be opened."""
+    entry.update({"keyId": d.get("keyId"), "tenantId": d.get("tenantId"), "userId": d.get("userId"), "kid": d.get("kid"), "caps": d.get("caps") or {}})
+    entry.pop("tinfoil", None)
     sealed = d.get("sealed") or {}
     for provider in PROVIDERS:
         if sealed.get(provider):
-            secret = open_sealed(sealed[provider], ident, aad(entry["tenantId"], entry["userId"], entry["kid"], provider))
+            secret = open_sealed(sealed[provider], entry, aad(entry["tenantId"], entry["userId"], entry["kid"], provider))
             if secret is None:
                 raise CodeKeyRefusal("unsealable", "the keys Witbitz sent could not be opened on this computer — pair again")
             entry[provider] = secret
@@ -223,6 +233,18 @@ async def mint(client: httpx.AsyncClient, *, id_token: str, account: str, comput
     return entry
 
 
+def app_of(entry: dict) -> str:
+    """The Spaces app these keys are for: recorded at the mint since 2026-10-23; before that, the app of the pairing they
+    belong to (its `origin`), else this install's."""
+    if entry.get("app") in (app_mod.REGULAR, app_mod.VAULTED):
+        return entry["app"]
+    try:
+        p = next((x for x in pp.read_pairings()["pairings"] if x.get("computerId") == entry.get("computerId")), None)
+    except Exception:  # noqa: BLE001 — a reading; the install's own app is the answer then
+        p = None
+    return app_mod.of_origin(p.get("origin")) if p and p.get("origin") else app_mod.name()
+
+
 def _server_time(r: httpx.Response) -> float | None:
     try:
         return parsedate_to_datetime(r.headers.get("date") or "").timestamp()
@@ -230,14 +252,25 @@ def _server_time(r: httpx.Response) -> float | None:
         return None
 
 
+def _status_body(entry: dict) -> dict:
+    """The status call, naming the app these keys are for and signing a move there ('move:<app>'): a computer the server has
+    under the other app's tenant moves to its own (every computer paired before 2026-10-23 was under the hosted app's)."""
+    b = signed_body("status", entry)
+    a = app_of(entry)
+    b["app"] = a
+    b["moveSig"] = _b64u(_sign_key(entry).sign(signed_message("move:" + a, entry["keyId"], b["ts"]).encode()))
+    return b
+
+
 async def _signed_post(client: httpx.AsyncClient, path: str, op: str, entry: dict, timeout: float = 10) -> httpx.Response:
     """A signed call; refused while this computer's clock is off the server's, it is signed again to the server's time."""
-    r = await client.post(api_base() + path, json=signed_body(op, entry), timeout=timeout)
+    body = (lambda: _status_body(entry)) if op == "status" else (lambda: signed_body(op, entry))
+    r = await client.post(api_base() + path, json=body(), timeout=timeout)
     if r.status_code == 401:
         server = _server_time(r)
         if server is not None and abs(server - _now()) > SKEW_FIX_S:
             _clock["skew"] = server - time.time()
-            r = await client.post(api_base() + path, json=signed_body(op, entry), timeout=timeout)
+            r = await client.post(api_base() + path, json=body(), timeout=timeout)
     return r
 
 
@@ -259,6 +292,19 @@ async def status(client: httpx.AsyncClient, entry: dict) -> dict:
     if r.status_code != 200:
         return {"live": None, "why": _why(r)}  # unknown — keep going as before, and say why
     d = (r.json() or {}).get("data") or {}
+    moved = d.get("moved")
+    if isinstance(moved, dict) and moved.get("keyId"):
+        # MOVED TO ITS OWN APP: the server retired the old pair, so the new one is taken and SAVED here, whoever asked
+        # (serve's check, the page, `pair --status`) — keys left unsaved would be keys this computer no longer has.
+        try:
+            _take(entry, moved)
+            entry["app"] = app_of(entry)
+            save(entry)
+            d["changed"] = False  # saved already
+            d["movedTo"] = entry["app"]
+        except CodeKeyRefusal as e:
+            return {"live": None, "why": str(e)}
+        return d
     tf = (d.get("sealed") or {}).get("tinfoil")
     if tf:
         secret = open_sealed(tf, entry, aad(entry["tenantId"], entry["userId"], entry["kid"], "tinfoil"))
@@ -354,6 +400,8 @@ class LiveKeys:
                     say(f'witbitz-code: coding for {e.get("account")} is paused by Witbitz')
                 self.refuse[cid] = PAUSED_TEXT
             elif st.get("live") is True:
+                if st.get("movedTo"):
+                    say(f'witbitz-code: "{e.get("name")}" → {e.get("account")} now codes under the {app_mod.label(st["movedTo"])}\'s own allowance')
                 if self.refuse.pop(cid, None):
                     say(f'witbitz-code: coding for {e.get("account")} is back on')
                 if st.get("changed"):

{witbitz_code-1.11.0 → witbitz_code-1.12.0/src/witbitz_code.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: witbitz-code
-Version: 1.11.0
+Version: 1.12.0
 Summary: Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay.
 Author: Witbitz
 License-Expression: MIT

{witbitz_code-1.11.0 → witbitz_code-1.12.0}/tests/test_codekeys.py

@@ -349,3 +349,38 @@ def test_the_python_and_node_connectors_read_each_others_keys_and_payers_files()
     pub.verify(codekeys._unb64u(out["body"]["sig"]), codekeys.signed_message("status", e["keyId"], 1800000000).encode())  # raises if not
     assert codekeys.for_computer("cmp_js")["trustedrouter"] == "sk-js" and SessionPayers().payer("ses_J") == "cmp_js"
     assert codekeys.signed_body("status", codekeys.for_computer("cmp_js"))["sig"], "Python signs with a Node-made key"
+
+
+@requires_node
+def test_a_status_that_names_its_app_moves_the_keys_there_and_saves_them(monkeypatch):
+    """The owner, 2026-10-23: each app its own computers and allowance. The status names this pairing's app and signs the
+    move ('move:<app>'); the server answers with a fresh pair under that app, which is opened and SAVED at once (the old one
+    is retired server-side, so unsaved keys would be lost)."""
+    from cryptography.hazmat.primitives.asymmetric import ed25519 as ed
+    T2, U2, K2 = "t_" + "c" * 32, "u_" + "d" * 24, "k_" + "2" * 24
+    ident = codekeys.new_identity()
+    entry = {**ident, "account": "me@x", "computerId": "cmp_1", "name": "desk", "keyId": f"{U}.{K}", "tenantId": T, "userId": U,
+             "kid": K, "trustedrouter": "sk-tr-old", "app": "regular"}
+    codekeys.save(entry)
+    sealed = run_node("import { sealForEnclave } from '@REPO@/control-plane/src/lib/enclaveKeySeal.mjs';"
+                      "OUT({ trustedrouter: await sealForEnclave('sk-tr-new', { tenantId: INPUT.t, userId: INPUT.u, kind: `code:${INPUT.k}:trustedrouter` }, INPUT.pub) })"
+                      .replace("@REPO@", (__import__("conftest").REPO).as_uri()),
+                      {"t": T2, "u": U2, "k": K2, "pub": codekeys.seal_pub(ident)})
+    seen = []
+
+    def handler(req):
+        b = json.loads(req.content)
+        seen.append(b)
+        pub = ed.Ed25519PublicKey.from_public_bytes(base64.urlsafe_b64decode(codekeys.sign_pub(ident) + "="))
+        pub.verify(base64.urlsafe_b64decode(b["moveSig"] + "=" * (-len(b["moveSig"]) % 4)), codekeys.signed_message("move:regular", b["keyId"], b["ts"]).encode())
+        return httpx.Response(200, json={"data": {"live": True, "moved": {"keyId": f"{U2}.{K2}", "tenantId": T2, "userId": U2, "kid": K2, "sealed": sealed, "caps": {"modelsUsd": 50}}}})
+
+    async def go():
+        async with client_for(handler) as c:
+            return await codekeys.status(c, entry)
+    st = run(go())
+    assert seen[0]["app"] == "regular"
+    assert st["live"] is True and st["movedTo"] == "regular"
+    saved = codekeys.for_computer("cmp_1")
+    assert (saved["keyId"], saved["tenantId"], saved["trustedrouter"]) == (f"{U2}.{K2}", T2, "sk-tr-new")
+    assert entry["trustedrouter"] == "sk-tr-new", "the running serve's entry follows too"