witbitz-code 1.14.0__tar.gz → 1.15.2__tar.gz

{witbitz_code-1.14.0/src/witbitz_code.egg-info → witbitz_code-1.15.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: witbitz-code
-Version: 1.14.0
+Version: 1.15.2
 Summary: Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay.
 Author: Witbitz
 License-Expression: MIT

{witbitz_code-1.14.0 → witbitz_code-1.15.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "witbitz-code"
-version = "1.14.0"
+version = "1.15.2"
 description = "Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay."
 readme = "README.md"
 requires-python = ">=3.10"

{witbitz_code-1.14.0 → witbitz_code-1.15.2}/src/witbitz_code/__init__.py

@@ -4,4 +4,4 @@ The Python implementation of tools/witbitz-code.mjs (docs/opencode-relay.md phas
 vectors and cross-implementation tests.
 """
 
-__version__ = "1.14.0"
+__version__ = "1.15.2"

{witbitz_code-1.14.0 → witbitz_code-1.15.2}/src/witbitz_code/connector.py

@@ -164,9 +164,11 @@ class PairingServer:
                  notes_plugin_path: Path | None = None, payers: SessionPayers | None = None,
                  model_url: str = "", remind_times: dict | None = None,
                  browse_probe: Callable[[], dict | None] | None = None,
-                 browse_private: Callable[[bool], Awaitable[bool]] | None = None) -> None:
+                 browse_private: Callable[[bool], Awaitable[bool]] | None = None, screens_root: Path | None = None) -> None:
         self.pairing = pairing
         self._browse_private = browse_private  # private browsing on/off (browse.py LocalBrowser.set_private)
+        # the agent's browser_screenshot writes <home>/.witbitz/screens/<session> (browse-cdp.mjs), served beside the session's folder
+        self._screens_root = Path(screens_root) if screens_root else Path.home() / ".witbitz" / "screens"
         # THE AGENT'S BROWSER ON THIS COMPUTER (browse.py): its /status rides the hello; a change is announced within 2 s
         self._browse_probe = browse_probe
         self._browse_said = ""  # the last browse report the page was told, as JSON
@@ -413,7 +415,8 @@ class PairingServer:
                 await reply(404, {"error": "no such session on this computer"})
                 return
             stat_only = q.get("stat") == "1"
-            st, b = serve_output(directory=session["directory"], path=q.get("path"), stat=stat_only)
+            st, b = serve_output(directory=session["directory"], path=q.get("path"), stat=stat_only,
+                                 shots=(self._screens_root / sid).as_posix())
             self._log_output({"at": int(time.time() * 1000), "session": sid, "digest": hashlib.sha256(q.get("path", "").encode()).hexdigest(),
                               "stat": stat_only, "st": st})
             await reply(st, b)
@@ -1007,7 +1010,7 @@ async def start_connector(pairings: list[dict], *, flush_ms: float = 120, log: C
                           notes_plugin_path: Path | None = None, payers: SessionPayers | None = None,
                           model_url: str = "", remind_times: dict | None = None,
                           browse_probe: Callable[[], dict | None] | None = None,
-                          browse_private: Callable[[bool], Awaitable[bool]] | None = None) -> Connector:
+                          browse_private: Callable[[bool], Awaitable[bool]] | None = None, screens_root: Path | None = None) -> Connector:
     """Serve the given pairings until stop()/aclose(). Options exist for tests: flush_ms, log, client, connect,
     request_timeout_ms, max_senders, max_response_bytes, auto_dir, auto_poll_ms."""
     client = client or local_client()
@@ -1023,7 +1026,7 @@ async def start_connector(pairings: list[dict], *, flush_ms: float = 120, log: C
                           max_senders=max_senders, max_response_bytes=max_response_bytes, auto_dir=auto_dir, auto_poll_ms=auto_poll_ms,
                           attach_root=attach_root, attach_max_file_bytes=attach_max_file_bytes, asks_reconcile_ms=asks_reconcile_ms,
                           notes_root=notes_root, notes_plugin_path=notes_plugin_path, payers=payers, model_url=model_url, remind_times=remind_times,
-                          browse_probe=browse_probe, browse_private=browse_private)
+                          browse_probe=browse_probe, browse_private=browse_private, screens_root=screens_root)
         await s.start()
         servers.append(s)
     return Connector(servers, client, payers)

{witbitz_code-1.14.0 → witbitz_code-1.15.2}/src/witbitz_code/opencode_plugins/witbitz-browse-cdp.mjs

@@ -101,7 +101,24 @@ async function snapshot (c, limit = 120) {
 // The refs are only meaningful next to the snapshot that made them, so they travel with it rather than living in
 // a cache that a page navigation would quietly invalidate.
 const REFS_FILE = (process.env.TMPDIR || '/tmp') + '/wb-browse-refs.json'
-const { writeFileSync, readFileSync } = await import('node:fs')
+const { writeFileSync, readFileSync, mkdirSync, readdirSync, statSync, rmSync } = await import('node:fs')
+const { join } = await import('node:path')
+const { homedir } = await import('node:os')
+
+// THE SCREENSHOTS' FOLDER: <home>/.witbitz/screens/<session> (spaces/public/codeOutputs.js SHOTS_DIR) — the agent's home, as
+// the connector reads it (on a cloud computer /rw/home, on a laptop the person's own). WB_BROWSE_SCREENS moves the root.
+const SHOTS_ROOT = process.env.WB_BROWSE_SCREENS || join(homedir(), '.witbitz', 'screens')
+const shotsDir = (sid) => join(SHOTS_ROOT, sid)
+const SHOT_DAYS = 30
+/** A session's pictures go 30 days after its last one — attachments' rule (tools/code-attachments.mjs). */
+function pruneShots () {
+  try {
+    for (const n of readdirSync(SHOTS_ROOT)) {
+      const d = join(SHOTS_ROOT, n)
+      try { if (Date.now() - statSync(d).mtimeMs > SHOT_DAYS * 86400000) rmSync(d, { recursive: true, force: true }) } catch { /* */ }
+    }
+  } catch { /* none yet */ }
+}
 
 // ★ A MISSING refs file is the SAME situation as a stale ref: the agent has not taken a snapshot yet. Letting
 // readFileSync throw turned that into "ENOENT: no such file or directory", which tells a model nothing it can act
@@ -226,11 +243,22 @@ try {
     await new Promise((r) => setTimeout(r, 400))
   } else if (op === 'screenshot') {
     const { data } = await c.send('Page.captureScreenshot', { format: 'jpeg', quality: 70 })
-    const path = args.path || ((process.env.TMPDIR || '/tmp') + '/wb-browse-' + Date.now() + '.jpg')
-    writeFileSync(path, Buffer.from(data, 'base64'))
+    // ★ INTO WITBITZ'S OWN FOLDER, ONE PER SESSION (the owner, 2026-10-25: "how can I get a screen snapshot in the chat"):
+    //   <home>/.witbitz/screens/<session>/ — the connector serves that folder for that session as well as the session's own
+    //   (tools/code-outputs.mjs), so the picture shows under the agent's answer, and nothing lands in the project. In a temp
+    //   folder the page could never be shown it: the connector serves nothing outside a session's folders.
+    let path = args.path
+    if (!path) {
+      const sid = /^[A-Za-z0-9_-]{1,128}$/.test(String(args.session || '')) ? args.session : 'no-session'
+      const dir = shotsDir(sid)
+      mkdirSync(dir, { recursive: true, mode: 0o700 })
+      pruneShots()
+      path = join(dir, 'screen-' + new Date().toISOString().replace(/[:.]/g, '-') + '.jpg')
+    }
+    writeFileSync(path, Buffer.from(data, 'base64'), { mode: 0o600 })
     const { lines } = await snapshot(c, 0).catch(() => ({ lines: [] }))
     c.close()
-    out({ ok: true, path, note: 'a picture for a person to look at; act from a snapshot, not from this' })
+    out({ ok: true, path, shot: true, note: 'a picture for a person to look at; act from a snapshot, not from this' })
   } else if (op !== 'snapshot') {
     out({ error: 'unknown op: ' + op })
   }

{witbitz_code-1.14.0 → witbitz_code-1.15.2}/src/witbitz_code/opencode_plugins/witbitz-browse-tree.mjs

@@ -4,14 +4,14 @@
 // tools/browse-tree/pin.json
 var pin_default = {
   _: "THE CLOUD COMPUTER'S BROWSER FOR LINUX that this release installs (tools/browse-tree; make.sh writes it). The files are public at <base><tag>/; both sha256s are checked before anything is unpacked.",
-  tag: "p2x",
+  tag: "p2y",
   base: "https://drwev5vxt2t2e.cloudfront.net/browse-tree/",
-  pcr0: "050541844610fd5ed4b586259906d9219edbabc4445ed7943885ac737ee4918e144af2e49838a8313f5823184bc503cf",
-  commit: "235ef2b815ef74b46e954f48f860197d8d2b612c",
+  pcr0: "5a0c2c755715eae50b73fdc13856a6df963bf772e68db5f0155e729c3d822807684f3df10945430f7f75c2e36419e0a0",
+  commit: "f45e85eb16a84c90b126915ba8ca8914e2204650",
   tree: {
     file: "tree.tar.zst",
-    sha256: "839b7cc06c70946a4912578115e6cd053cb6b2811cc458457e012ece885b36b6",
-    size: 664701891
+    sha256: "d992f07bbfec50467d9a462a4d443f714332d57cf7dc5a928eb9bde4bd023fc2",
+    size: 664651711
   },
   lab: {
     file: "ccvm-lab.bin",

{witbitz_code-1.14.0 → witbitz_code-1.15.2}/src/witbitz_code/opencode_plugins/witbitz-browser.js

@@ -43,6 +43,7 @@ function render (j) {
   if (!j) return 'The browser did not answer.'
   if (j.error) return 'Browser: ' + j.error
   if (j.closed) return 'The browser is closed — its tabs and any sign-ins are gone. browser_open or browser_navigate starts a fresh one.'
+  if (j.shot && j.path) return 'Saved a picture of the page: ' + j.path + ' — the person sees it under your answer.'
   if (j.cleared) return 'Cleared: the browser\'s history, cookies, cache and site data are gone, and a fresh browser is open — browser_navigate to go on.'
   if (j.ok && !j.title && !j.url && !(j.elements && j.elements.length) && !j.path) return 'The browser is open' + (j.headed === false ? ' (headless — see it with browser_screenshot)' : j.headed ? ' (a window on this computer\'s screen)' : '') + '. Navigate to a URL next.' // the open op: nothing on screen yet
   const head = [j.title ? 'Title: ' + j.title : null, j.url ? 'URL: ' + j.url : null].filter(Boolean).join('\n')
@@ -157,7 +158,7 @@ export const WitbitzBrowser = async (ctx = {}) => {
       browser_screenshot: tool({
         description: 'Save a picture of the page for the PERSON to look at, and return its path. Do not use this to decide what to click — use a snapshot.',
         args: {},
-        execute: () => run('screenshot', {}),
+        execute: (args, context) => run('screenshot', { session: (context && context.sessionID) || '' }),
       }),
     },
   }

{witbitz_code-1.14.0 → witbitz_code-1.15.2}/src/witbitz_code/outputs.py

@@ -72,15 +72,17 @@ def _answer(st: int, o: dict) -> tuple[int, str]:
 
 
 def serve_output(*, directory: Any, path: Any, stat: bool = False, max_bytes: int = MAX_SERVE_BYTES,
-                 any_kind: bool = False) -> tuple[int, str]:
+                 any_kind: bool = False, shots: str = "") -> tuple[int, str]:
     """One produced file (or its facts, with `stat`) for the page: (status, JSON body) in the connector's reply shape.
 
     `any_kind`: the Files sheet's Download (files.py) — any regular file, not only a kind the page previews; every other
-    check stays (⇄ tools/code-outputs.mjs)."""
+    check stays (⇄ tools/code-outputs.mjs). `shots`: the session's screenshots folder (<home>/.witbitz/screens/<session>,
+    browse-cdp.mjs) — served beside its folder with every same check."""
     if not isinstance(directory, str) or not directory.startswith("/") or not valid_output_path(path):
         return _answer(400, {"error": "not a file in this session"})
-    d = re.sub(r"/+\Z", "", posix_normalize(directory))
     a = posix_normalize(path)
+    shot_dir = re.sub(r"/+\Z", "", posix_normalize(shots)) if isinstance(shots, str) and shots.startswith("/") else ""
+    d = shot_dir if shot_dir and a.startswith(shot_dir + "/") else re.sub(r"/+\Z", "", posix_normalize(directory))
     if not d or not a.startswith(d + "/"):
         return _answer(403, {"error": "that file is outside the session's folder"})
     if _sensitive_path(a[len(d):]):

{witbitz_code-1.14.0 → witbitz_code-1.15.2}/src/witbitz_code/ui.py

@@ -229,7 +229,7 @@ class Manager:
         for p in ps:
             paired.append({"name": p.get("name") or "", "account": p.get("account") or "", "port": wizard.port_of(p), "keys": await self.keys(p),
                            "computer": p.get("computerId") or "", "app": pp.app_label(p)})
-        pair = {k: v for k, v in self.pair_state.items() if k != "log"}
+        pair = {k: v for k, v in self.pair_state.items() if k != "log" and (k != "code" or self.pair_state.get("state") == "waiting")}
         serving = self.serving()
         if serving["state"] == "stopped" and ps:
             el = await self.elsewhere()
@@ -354,7 +354,8 @@ class Manager:
         ch = devicelink.new_link_challenge()
         self.qr_svg = qr.qr_svg(ch.text)
         n = int(self.pair_state.get("n", 0)) + 1
-        self.pair_state = {"state": "waiting", "n": n, "until": int(time.time() * 1000) + link.LIFE_MS, "message": ""}
+        # The code as text beside the QR: a computer cannot scan its own screen, and Add a device takes it pasted.
+        self.pair_state = {"state": "waiting", "n": n, "until": int(time.time() * 1000) + link.LIFE_MS, "message": "", "code": ch.text}
         self.pair_task = asyncio.ensure_future(self._pair_run(ch, await self._pair_port()))
         return {"ok": True}
 

{witbitz_code-1.14.0 → witbitz_code-1.15.2}/src/witbitz_code/ui_static/app.css

@@ -50,6 +50,7 @@ footer { font-size: 13px; text-align: center; }
 @media (prefers-reduced-motion: reduce) { * { transition: none !important; } }
 .actions:not(:has(button:not([hidden]))) { display: none; }
 button.small { font-size: 13px; padding: 2px 10px; margin-left: 8px; }
+pre.cmd.code { white-space: pre-wrap; overflow-wrap: anywhere; font-size: 12px; user-select: all; }
 pre.cmd { background: var(--off-bg); color: var(--text); padding: 8px 10px; border-radius: 8px; }
 /* the security check (seccheck.py) */
 p.small, div.small { font-size: 12.5px; }

{witbitz_code-1.14.0 → witbitz_code-1.15.2}/src/witbitz_code/ui_static/app.js

@@ -92,11 +92,14 @@ function render(s) {
     const want = '/api/pair/qr.svg?n=' + s.pair.n
     if ($('qr').getAttribute('src') !== want) $('qr').setAttribute('src', want)
     show($('qr').parentElement, true)
+    $('pairCode').textContent = s.pair.code || ''
+    show($('codeBox'), !!s.pair.code)
     const left = Math.max(0, Math.round((s.pair.until - Date.now()) / 60000))
     $('pairMsg').textContent = `Waiting for your phone… (this code works for ${left || 'under a'} minute${left === 1 ? '' : 's'})`
     show($('pairRetry'), false)
   } else if (s.pair.state === 'failed') {
     show($('qr').parentElement, false)
+    show($('codeBox'), false)
     $('pairMsg').textContent = s.pair.message || 'Pairing did not finish.'
     show($('pairRetry'), true)
   }
@@ -306,6 +309,11 @@ document.addEventListener('DOMContentLoaded', () => {
   // same OpenCode); nothing is unpaired. Code here pauses while the code is up and comes back when it is scanned or cancelled.
   $('pairAdd').onclick = () => act('/api/pair', {}, 'Add another account? A new code appears — scan it from the other account: Code in Spaces → Computers → Add a computer. Code on this computer pauses until it is scanned or cancelled.')
   $('pairCancel').onclick = () => act('/api/pair/cancel', {})
+  $('pairCopy').onclick = async () => {
+    const b = $('pairCopy')
+    try { await navigator.clipboard.writeText($('pairCode').textContent); b.textContent = 'Copied ✓' } catch { b.textContent = 'Select the code above and copy it' }
+    setTimeout(() => { b.textContent = 'Copy the code' }, 2000)
+  }
   $('pairRetry').onclick = () => act('/api/pair', {})
   $('login').onchange = (e) => act('/api/login', { on: e.target.checked })
   refresh(true)

{witbitz_code-1.14.0 → witbitz_code-1.15.2}/src/witbitz_code/ui_static/index.html

@@ -45,6 +45,11 @@
       <li>Scan this code with the account that should reach this computer.</li>
     </ol>
     <div class="qr-wrap"><img id="qr" alt="Pairing code — scan it in Spaces" width="260" height="260"></div>
+    <div id="codeBox" hidden>
+      <p class="muted">On this computer? Copy the code and paste it under <b>…or paste the code</b> in Add a device.</p>
+      <pre id="pairCode" class="cmd code"></pre>
+      <div class="actions"><button id="pairCopy" type="button" class="ghost">Copy the code</button></div>
+    </div>
     <p id="pairMsg" class="muted">Waiting for your phone…</p>
     <div class="actions"><button id="pairCancel" type="button" class="ghost">Cancel</button><button id="pairRetry" type="button" hidden>Show a new code</button></div>
   </section>

{witbitz_code-1.14.0 → witbitz_code-1.15.2/src/witbitz_code.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: witbitz-code
-Version: 1.14.0
+Version: 1.15.2
 Summary: Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay.
 Author: Witbitz
 License-Expression: MIT

{witbitz_code-1.14.0 → witbitz_code-1.15.2}/tests/test_outputs.py

@@ -67,11 +67,30 @@ def _requests(d: Path, outside: Path, root: Path) -> list[dict]:
              {"directory": str(d), "path": str(d / "out" / "big.pdf"), "stat": False, "maxBytes": 1024},
              {"directory": str(d), "path": str(d / "out" / "big.pdf"), "stat": True, "maxBytes": 1024},
              {"directory": str(d), "path": None, "stat": False}]
+    # the agent's screenshots: <home>/.witbitz/screens/<session>, served for that session only (2026-10-25)
+    mine, theirs = root / "screens" / "ses_A", root / "screens" / "ses_B"
+    reqs += [{"directory": str(d), "path": str(mine / "screen-1.jpg"), "stat": False, "shots": str(mine)},
+             {"directory": str(d), "path": str(theirs / "screen-2.jpg"), "stat": False, "shots": str(mine)},
+             {"directory": str(d), "path": str(mine / "screen-1.jpg"), "stat": False},
+             {"directory": str(d), "path": str(mine / "out.pdf"), "stat": False, "shots": str(mine)},
+             {"directory": str(d), "path": str(d / "out" / "chart.png"), "stat": False, "shots": str(mine)}]
     return reqs
 
 
+def _screens(root: Path, outside: Path) -> None:
+    mine, theirs = root / "screens" / "ses_A", root / "screens" / "ses_B"
+    mine.mkdir(parents=True)
+    theirs.mkdir(parents=True)
+    for p, b in [(mine / "screen-1.jpg", b"JPEGA"), (theirs / "screen-2.jpg", b"JPEGB")]:
+        p.write_bytes(b)
+        os.utime(p, (1789000000, 1789000000))
+    (mine / "out.pdf").symlink_to(outside / "report.pdf")
+
+
 def _py(r: dict) -> list:
     kw = {"max_bytes": r["maxBytes"]} if "maxBytes" in r else {}
+    if "shots" in r:
+        kw["shots"] = r["shots"]
     st, b = serve_output(directory=r["directory"], path=r["path"], stat=r["stat"], **kw)
     return [st, json.loads(b)]
 
@@ -92,12 +111,13 @@ def test_what_the_python_connector_serves(tmp_path):
 @requires_node
 def test_parity_with_the_js_connector(tmp_path):
     d, outside = _tree(tmp_path)
+    _screens(tmp_path, outside)
     reqs = _requests(d, outside, tmp_path)
     js = run_node("""
       import { serveOutput } from '@TOOLS@/code-outputs.mjs'
       import { outputMime } from '@PUBLIC@/codeOutputs.js'
       OUT({
-        served: INPUT.reqs.map((r) => { const o = serveOutput({ directory: r.directory, path: r.path, stat: r.stat, ...(r.maxBytes ? { maxBytes: r.maxBytes } : {}) }); return [o.st, JSON.parse(o.b)] }),
+        served: INPUT.reqs.map((r) => { const o = serveOutput({ directory: r.directory, path: r.path, stat: r.stat, ...(r.maxBytes ? { maxBytes: r.maxBytes } : {}), ...(r.shots ? { shots: r.shots } : {}) }); return [o.st, JSON.parse(o.b)] }),
         mimes: INPUT.exts.map((e) => outputMime('/a/x.' + e)),
       })
     """, {"reqs": reqs, "exts": EXTS})
@@ -108,3 +128,12 @@ def test_parity_with_the_js_connector(tmp_path):
 
 EXTS = ["pdf", "PNG", "jpg", "jpeg", "gif", "webp", "csv", "tsv", "md", "markdown", "txt", "docx", "doc", "xlsx", "xls", "pptx", "ppt",
         "odt", "ods", "odp", "rtf", "zip", "epub", "heic", "svg", "html", "htm", "mp3", "wav", "m4a", "mp4", "mov", "ts", "json", ""]
+
+
+def test_a_screenshot_is_served_for_its_own_session_only(tmp_path):
+    d, outside = _tree(tmp_path)
+    _screens(tmp_path, outside)
+    mine = tmp_path / "screens" / "ses_A"
+    assert _py({"directory": str(d), "path": str(mine / "screen-1.jpg"), "stat": False, "shots": str(mine)})[0] == 200
+    assert _py({"directory": str(d), "path": str(tmp_path / "screens" / "ses_B" / "screen-2.jpg"), "stat": False, "shots": str(mine)})[0] == 403
+    assert _py({"directory": str(d), "path": str(mine / "out.pdf"), "stat": False, "shots": str(mine)})[0] == 403, "a link out"

{witbitz_code-1.14.0 → witbitz_code-1.15.2}/tests/test_ui.py

@@ -147,6 +147,7 @@ def test_unpair_then_pair_again_with_the_code_on_the_page_then_it_serves():
                 assert (await c.post(f"{base}/api/pair", headers=authed(srv), json={})).json() == {"ok": True}
                 st = (await c.get(f"{base}/api/status", headers=authed(srv))).json()
                 assert st["pair"]["state"] == "waiting" and st["pair"]["n"] == 1
+                assert st["pair"]["code"].startswith("wbzlink1:"), "the code as text too: a computer cannot scan its own screen, Add a device takes it pasted"
                 qr = await c.get(f"{base}/api/pair/qr.svg?n=1", headers={"cookie": f"wbui_{srv.port}=T0KEN"})
                 assert qr.status_code == 200 and qr.content.startswith(b"<svg"), "the code an <img> loads with the cookie alone"
                 assert (await c.get(f"{base}/api/pair/qr.svg")).status_code == 403