witbitz-code 1.2.0__tar.gz → 1.2.1__tar.gz

{witbitz_code-1.2.0/src/witbitz_code.egg-info → witbitz_code-1.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: witbitz-code
-Version: 1.2.0
+Version: 1.2.1
 Summary: Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay.
 Author: Witbitz
 License-Expression: MIT
@@ -18,6 +18,7 @@ Requires-Dist: cryptography>=41
 Requires-Dist: websockets>=13
 Requires-Dist: httpx>=0.25
 Requires-Dist: segno>=1.5
+Requires-Dist: tinfoil<0.15,>=0.14
 Provides-Extra: test
 Requires-Dist: pytest>=8; extra == "test"
 Dynamic: license-file
@@ -38,21 +39,34 @@ the other can serve or unpair it.
 pipx install witbitz-code          # or: pip install witbitz-code
 ```
 
-Python 3.10 or newer. Dependencies: `cryptography`, `websockets`, `httpx`, `segno`.
-
-You also need OpenCode itself: `npm install -g opencode-ai` or `curl -fsSL https://opencode.ai/install | bash`.
+Python 3.10 or newer. Dependencies: `cryptography`, `websockets`, `httpx`, `segno`, and `tinfoil` (Tinfoil's own
+verifier — attestation, Sigstore and TLS pinning — for the confidential models below).
 
 ## Use
 
 ```sh
-witbitz-code pair                 # shows a QR code: scan it in Spaces → Settings → Back up & recovery → Add a device
-witbitz-code serve                # starts OpenCode on 127.0.0.1:4096 (unless it is running) and the connector
+witbitz-code setup
 ```
 
-Then open Code in Spaces. Leave `serve` running (Ctrl-C stops it).
+`setup` walks five steps and skips whatever is already done: it installs OpenCode if it is missing (it asks first), pairs
+this computer (scan the QR code in Spaces → Settings → Back up & recovery → Add a device), asks for your **TrustedRouter**
+key and an optional **Tinfoil** key (each checked with the provider before it is saved; it shows as `*****` while you
+paste), then starts `serve` in the window. Then open Code in Spaces. Leave it running (Ctrl-C stops it); next time,
+`witbitz-code serve` is enough.
+
+Your keys are yours: you pay TrustedRouter and Tinfoil directly, and your Witbitz account never carries them — so a new
+computer asks for them once. The TrustedRouter key goes into OpenCode's own credentials (`$XDG_DATA_HOME/opencode/auth.json`,
+the file `opencode auth login` writes), the Tinfoil key into `~/.opencode-server.env`. Without a TrustedRouter key,
+OpenCode offers only its own free models.
+
+The same thing one step at a time: install OpenCode (`curl -fsSL https://opencode.ai/install | bash`), then
+`witbitz-code pair`, `witbitz-code trustedrouter-key`, `witbitz-code tinfoil-key` (optional) and `witbitz-code serve`.
 
 | command | what it does |
 |---|---|
+| `setup [--port <n>]` | The walk-through above. With `--port`, a pairing made for another port moves to it (no new scan). |
+| `trustedrouter-key` | Ask for a TrustedRouter key, check it, and store it in OpenCode's credentials. Restart `serve` to use it. |
+| `tinfoil-key` | Ask for a Tinfoil key, check it, and store it. Used from the next message. |
 | `pair [--name <name>] [--port <n> \| --opencode-url <url>]` | Show the QR code. The account that scans it gets this computer. `--name` sets the label your devices show (default: the hostname). |
 | `serve [--port <n>] [--no-opencode]` | Start OpenCode on `127.0.0.1:<n>` (default 4096) if nothing is listening there, then connect the pairings whose OpenCode is on that port. One OpenCode per port, one `serve` per OpenCode. |
 | `status` | List this computer's pairings: name, account, OpenCode address and relay. Secrets are never printed. |
@@ -94,6 +108,18 @@ all the accounts are yours. If a second account belongs to **another person**, r
 - **The OpenCode password** lives in `~/.opencode-server.env` (created 0600 on first pair). The connector adds it to local
   calls, and it never leaves the computer.
 
+**Confidential models** (the ones labelled "· confidential" in the model menu) are enforced on this computer, by a proxy
+`serve` starts on `127.0.0.1:<port + 100>` and points OpenCode's TrustedRouter calls at — the same checks as the Node download:
+- the request goes out only after **TrustedRouter's gateway proves** (Google Confidential Space attestation: Intel TDX,
+  secure boot, debug off, the operator's own image) what it runs, and it carries the hard floor
+  `provider.min_privacy = confidential`;
+- the answer's words stream as they arrive, but **tool calls, the finish and usage wait for TrustedRouter's signed
+  receipt** to verify for these exact request and response bytes (an attested key, a TEE-verified upstream under a known
+  policy). A receipt that does not verify ends the step with an error, so no tool from that answer runs;
+- an image or a document a text-only confidential model cannot read is read **as text inside Tinfoil's attested
+  enclave** with your Tinfoil key — or refused, never sent anywhere less;
+- every other model passes through untouched.
+
 **Auto mode** (Manual · Accept edits · Plan · **Auto** in the Code composer's mode chip, per session) lets this computer answer OpenCode's permission
 prompts while you are away:
 - **Refused at once:** what is never safe, like `rm -rf ~`, `mkfs` or `dd` onto a disk. The agent is told why.

{witbitz_code-1.2.0 → witbitz_code-1.2.1}/README.md

@@ -14,21 +14,34 @@ the other can serve or unpair it.
 pipx install witbitz-code          # or: pip install witbitz-code
 ```
 
-Python 3.10 or newer. Dependencies: `cryptography`, `websockets`, `httpx`, `segno`.
-
-You also need OpenCode itself: `npm install -g opencode-ai` or `curl -fsSL https://opencode.ai/install | bash`.
+Python 3.10 or newer. Dependencies: `cryptography`, `websockets`, `httpx`, `segno`, and `tinfoil` (Tinfoil's own
+verifier — attestation, Sigstore and TLS pinning — for the confidential models below).
 
 ## Use
 
 ```sh
-witbitz-code pair                 # shows a QR code: scan it in Spaces → Settings → Back up & recovery → Add a device
-witbitz-code serve                # starts OpenCode on 127.0.0.1:4096 (unless it is running) and the connector
+witbitz-code setup
 ```
 
-Then open Code in Spaces. Leave `serve` running (Ctrl-C stops it).
+`setup` walks five steps and skips whatever is already done: it installs OpenCode if it is missing (it asks first), pairs
+this computer (scan the QR code in Spaces → Settings → Back up & recovery → Add a device), asks for your **TrustedRouter**
+key and an optional **Tinfoil** key (each checked with the provider before it is saved; it shows as `*****` while you
+paste), then starts `serve` in the window. Then open Code in Spaces. Leave it running (Ctrl-C stops it); next time,
+`witbitz-code serve` is enough.
+
+Your keys are yours: you pay TrustedRouter and Tinfoil directly, and your Witbitz account never carries them — so a new
+computer asks for them once. The TrustedRouter key goes into OpenCode's own credentials (`$XDG_DATA_HOME/opencode/auth.json`,
+the file `opencode auth login` writes), the Tinfoil key into `~/.opencode-server.env`. Without a TrustedRouter key,
+OpenCode offers only its own free models.
+
+The same thing one step at a time: install OpenCode (`curl -fsSL https://opencode.ai/install | bash`), then
+`witbitz-code pair`, `witbitz-code trustedrouter-key`, `witbitz-code tinfoil-key` (optional) and `witbitz-code serve`.
 
 | command | what it does |
 |---|---|
+| `setup [--port <n>]` | The walk-through above. With `--port`, a pairing made for another port moves to it (no new scan). |
+| `trustedrouter-key` | Ask for a TrustedRouter key, check it, and store it in OpenCode's credentials. Restart `serve` to use it. |
+| `tinfoil-key` | Ask for a Tinfoil key, check it, and store it. Used from the next message. |
 | `pair [--name <name>] [--port <n> \| --opencode-url <url>]` | Show the QR code. The account that scans it gets this computer. `--name` sets the label your devices show (default: the hostname). |
 | `serve [--port <n>] [--no-opencode]` | Start OpenCode on `127.0.0.1:<n>` (default 4096) if nothing is listening there, then connect the pairings whose OpenCode is on that port. One OpenCode per port, one `serve` per OpenCode. |
 | `status` | List this computer's pairings: name, account, OpenCode address and relay. Secrets are never printed. |
@@ -70,6 +83,18 @@ all the accounts are yours. If a second account belongs to **another person**, r
 - **The OpenCode password** lives in `~/.opencode-server.env` (created 0600 on first pair). The connector adds it to local
   calls, and it never leaves the computer.
 
+**Confidential models** (the ones labelled "· confidential" in the model menu) are enforced on this computer, by a proxy
+`serve` starts on `127.0.0.1:<port + 100>` and points OpenCode's TrustedRouter calls at — the same checks as the Node download:
+- the request goes out only after **TrustedRouter's gateway proves** (Google Confidential Space attestation: Intel TDX,
+  secure boot, debug off, the operator's own image) what it runs, and it carries the hard floor
+  `provider.min_privacy = confidential`;
+- the answer's words stream as they arrive, but **tool calls, the finish and usage wait for TrustedRouter's signed
+  receipt** to verify for these exact request and response bytes (an attested key, a TEE-verified upstream under a known
+  policy). A receipt that does not verify ends the step with an error, so no tool from that answer runs;
+- an image or a document a text-only confidential model cannot read is read **as text inside Tinfoil's attested
+  enclave** with your Tinfoil key — or refused, never sent anywhere less;
+- every other model passes through untouched.
+
 **Auto mode** (Manual · Accept edits · Plan · **Auto** in the Code composer's mode chip, per session) lets this computer answer OpenCode's permission
 prompts while you are away:
 - **Refused at once:** what is never safe, like `rm -rf ~`, `mkfs` or `dd` onto a disk. The agent is told why.

{witbitz_code-1.2.0 → witbitz_code-1.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "witbitz-code"
-version = "1.2.0"
+version = "1.2.1"
 description = "Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -23,6 +23,9 @@ dependencies = [
   "websockets>=13",
   "httpx>=0.25",
   "segno>=1.5",
+  # Tinfoil's own verifier (attestation + Sigstore + TLS pinning) — the confidential proxy reads images and files a
+  # text-only confidential model cannot, in Tinfoil's attested enclave (tinfoil_read.py). Pinned to a series on purpose.
+  "tinfoil>=0.14,<0.15",
 ]
 
 [project.optional-dependencies]
@@ -40,7 +43,7 @@ where = ["src"]
 
 # Our OpenCode plugins, installed by `serve` (plugins.py) — copies of tools/opencode-plugins, kept current by embed.mjs
 [tool.setuptools.package-data]
-witbitz_code = ["opencode_plugins/*"]
+witbitz_code = ["opencode_plugins/*", "confidential_models.json"]
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]

{witbitz_code-1.2.0 → witbitz_code-1.2.1}/src/witbitz_code/__init__.py

@@ -4,4 +4,4 @@ The Python implementation of tools/witbitz-code.mjs (docs/opencode-relay.md phas
 vectors and cross-implementation tests.
 """
 
-__version__ = "1.2.0"
+__version__ = "1.2.1"

{witbitz_code-1.2.0 → witbitz_code-1.2.1}/src/witbitz_code/cli.py

@@ -1,18 +1,20 @@
 """witbitz-code — connect the Spaces Code section to OpenCode on this computer (docs/opencode-relay.md). The same commands
 as the single-file Node download (tools/witbitz-code.mjs):
 
+  witbitz-code setup [--port 4096]      the walk-through: OpenCode, pairing, the TrustedRouter and Tinfoil keys, then serve
   witbitz-code pair [--name desk]       scan the QR with the Spaces app → this computer joins that account
   witbitz-code serve [--port 4096]      start OpenCode (if it is not running) and the connector
   witbitz-code status                   what this computer is paired with
   witbitz-code rotate                   new secrets (no scan) — restart serve afterwards
   witbitz-code unpair [--account a@b]   remove this computer from an account
+  witbitz-code trustedrouter-key        store the TrustedRouter key in OpenCode's credentials (what `opencode auth login` does)
+  witbitz-code tinfoil-key              store the Tinfoil key (confidential reading of images and files)
 """
 
 from __future__ import annotations
 
 import asyncio
 import os
-import shutil
 import signal
 import subprocess
 import sys
@@ -23,18 +25,22 @@ import httpx
 from . import __version__
 from . import pair as pair_cmd
 from . import pairings as pp
-from . import codetools, plugins, policy
+from . import codetools, confidential, keys, models, plugins, policy, wizard
 from ._js import to_number, truthy
 from .connector import pairings_for_port, start_connector
 
 HELP = f"""witbitz-code {__version__} — reach OpenCode on this computer from the Spaces Code section, end-to-end encrypted.
 
+  setup [--port <n>]           start here: installs OpenCode if needed, pairs this computer, asks for your TrustedRouter
+                               and Tinfoil keys (each checked before it is saved), then serves
   pair [--name <name>]         show a QR code; scan it in Spaces (Settings → Back up & recovery → Add a device)
   serve [--port <n>] [--no-opencode]
                                start OpenCode on 127.0.0.1 (unless it is already running) and the connector
   status                       list this computer's pairings
   rotate [--account <email>]   replace the pairing secret(s) without a scan, then restart serve
   unpair [--account <email>]   remove this computer from an account
+  trustedrouter-key            store your TrustedRouter API key in OpenCode's credentials (same as opencode auth login)
+  tinfoil-key                  store your Tinfoil API key (images and files a confidential model cannot read)
 
 Nothing listens on the network: OpenCode stays on 127.0.0.1 and the connector dials out to wss://code-relay.witbitz.chat.
 """
@@ -104,13 +110,17 @@ async def _wait_for_stop(stop: _Stop, child: asyncio.subprocess.Process | None)
     return 0
 
 
-async def _start_opencode(exe: str, port: int, media: dict | None = None, tools: tuple[dict, dict] | None = None) -> asyncio.subprocess.Process:
+async def _start_opencode(exe: str, port: int, media: dict | None = None, tools: tuple[dict, dict] | None = None,
+                          extra: dict | None = None) -> asyncio.subprocess.Process:
     password = pp.read_env_password()
     # Subagents ask like their parent, and a refused call does not end the turn (policy.py) — merged by OpenCode over the
     # user's own config, which is never written.
     tools_env, tools_config = tools or ({}, {})  # codetools.py: the lsp tool, ast-grep on PATH, the hint naming it
     env = {**os.environ, **tools_env, **({"OPENCODE_SERVER_PASSWORD": password} if password else {}),
-           "OPENCODE_CONFIG_CONTENT": policy.config_content(os.environ.get("OPENCODE_CONFIG_CONTENT"), policy.merge_config(media or {}, tools_config))}
+           "OPENCODE_CONFIG_CONTENT": policy.config_content(os.environ.get("OPENCODE_CONFIG_CONTENT"), policy.merge_config(policy.merge_config(media or {}, tools_config), extra))}
+    # The Tinfoil key is witbitz-code's (the confidential proxy reads it). Handed to OpenCode it would be in every shell the
+    # agent runs, and OpenCode would list Tinfoil as a plain provider whose attestation nothing checks (as the Node one).
+    env.pop("TINFOIL_API_KEY", None)
     # The resolved path, not "opencode": on Windows the npm install is opencode.cmd, which a bare name does not find.
     # Its own process group there, so stopping it can take the whole tree (cmd.exe → node) with it.
     extra = {"creationflags": subprocess.CREATE_NEW_PROCESS_GROUP} if sys.platform == "win32" else {}
@@ -136,7 +146,7 @@ async def serve(args: list[str]) -> int:
     port = int(port_n) if truthy(port_n) and port_n == port_n and float(port_n).is_integer() else 4096
     everything = pp.load_pairings(log=lambda _m: None)
     if not everything:
-        _err("witbitz-code: this computer is not paired yet — run: witbitz-code pair")
+        _err("witbitz-code: this computer is not paired yet — run: witbitz-code setup")
         return 1
     # One OpenCode per port, one connector per OpenCode: two `serve`s (one per account) must never both answer a channel.
     pairings = pairings_for_port(everything, port)
@@ -161,22 +171,42 @@ async def serve(args: list[str]) -> int:
         _err(note)
     stop = _Stop()
     child = None
+    proxy = None
+    live: dict = {"connector": None}
     try:
+        # THE CONFIDENTIAL-MODEL PROXY (confidential.py): started BEFORE OpenCode, so OpenCode is pointed at it only when it
+        # runs — and only where TrustedRouter is connected, or the confidential models would be on the menu of a computer
+        # that cannot call them.
+        pport = models.proxy_port_for(port)
+        try:
+            proxy = await confidential.start_confidential_proxy(port=pport, log=_err, on_progress=lambda ev: live["connector"] and live["connector"].progress(ev))
+        except OSError as e:
+            _err(f"witbitz-code: could not start the confidential-model proxy on 127.0.0.1:{pport} ({e}) — confidential models are not offered")
+        route = models.proxy_config(proxy.port) if proxy and keys.has_trustedrouter() else None
         if not await is_listening(port) and "--no-opencode" not in args:
-            exe = shutil.which("opencode")
+            exe = wizard.find_opencode()
             if not exe:
-                _err("witbitz-code: OpenCode is not installed (or not on PATH). Install it, then run serve again:")
+                _err("witbitz-code: OpenCode is not installed (or not on PATH). Run witbitz-code setup, or install it and run serve again:")
                 _err("  npm install -g opencode-ai        or        curl -fsSL https://opencode.ai/install | bash")
                 return 1
             _err(f"witbitz-code: starting OpenCode on 127.0.0.1:{port}")
-            child = await _start_opencode(exe, port, media, (tools_env, tools_config))
+            child = await _start_opencode(exe, port, media, (tools_env, tools_config), route)
             for _ in range(40):
                 if stop.event.is_set() or child.returncode is not None or await is_listening(port):
                     break
                 await asyncio.sleep(0.25)
         if stop.event.is_set():
             return 0
+        if proxy and child is None and "--no-opencode" not in args:
+            _err("witbitz-code: OpenCode was already running, so its TrustedRouter calls do not go through the confidential-model proxy — restart it with witbitz-code serve")
+        elif route and child is not None:
+            _err(f"witbitz-code: confidential models are enforced (min_privacy + verified receipts){' and read images through Tinfoil' if keys.tinfoil_key() else ' — add a Tinfoil key (witbitz-code tinfoil-key) to read images with text-only ones'}")
+        elif proxy and not keys.has_trustedrouter():
+            _err("witbitz-code: TrustedRouter is not connected, so Code offers only OpenCode's own models — run witbitz-code trustedrouter-key")
         connector = await start_connector(pairings)
+        live["connector"] = connector
+        if proxy:
+            connector.set_confidential_sink(proxy.add_confidential)  # the page hands down what the account offers today
         served = ", ".join(f'"{p.get("name")}" → {p.get("account") or "account"}' for p in pairings)
         _err(f"witbitz-code: serving {served} through the sealed relay (Ctrl-C to stop)")
         try:
@@ -186,11 +216,52 @@ async def serve(args: list[str]) -> int:
     finally:
         if child is not None:
             await _stop_opencode(child)
+        if proxy is not None:
+            await proxy.close()
         stop.remove()
 
 
+async def set_key(label: str, check, save, after: str) -> int:
+    """`trustedrouter-key` / `tinfoil-key`: ask (it shows as *****), check with the provider, save. A rejected key is not saved."""
+    key = keys.read_line(f"{label} API key (it shows as *****): ", hidden=True)
+    if not key:
+        _err("witbitz-code: no key entered — nothing changed")
+        return 1
+    if not keys.valid_key_shape(key):
+        _err("witbitz-code: that does not look like an API key (no spaces, 8–512 characters) — nothing changed")
+        return 1
+    v = await check(key)
+    if v.get("ok") is False:
+        _err(f"witbitz-code: {v.get('why')} — nothing changed")
+        return 1
+    where = save(key)
+    unchecked = f" without checking it — {v.get('why')}" if v.get("ok") is None else ""
+    _err(f"witbitz-code: saved in {where} (only you can read it){unchecked}. {after}")
+    return 0
+
+
+async def setup(args: list[str]) -> int:
+    port_n = to_number(_flag(args, "--port", "4096"))
+    port = int(port_n) if truthy(port_n) and port_n == port_n and float(port_n).is_integer() else 4096
+    d = wizard.Deps(
+        say=_err, ask=lambda q: keys.read_line(q), secret=lambda q: keys.read_line(q, hidden=True),
+        port=port, port_explicit="--port" in args,
+        pair=lambda p: pair_cmd.main(["--port", str(p)]),
+        is_listening=is_listening, serve_here=lambda p: serve(["--port", str(p)]),
+    )
+    r = await wizard.run_setup(d)
+    return r.get("served", 0) if not r.get("stopped") else 1
+
+
 async def _main(argv: list[str]) -> int:
     cmd, rest = (argv[0], argv[1:]) if argv else ("", [])
+    if cmd == "setup":
+        return await setup(rest)
+    if cmd == "trustedrouter-key":
+        return await set_key("TrustedRouter", keys.check_trustedrouter_key, keys.save_trustedrouter_key,
+                             "Restart witbitz-code serve so OpenCode picks it up.")
+    if cmd == "tinfoil-key":
+        return await set_key("Tinfoil", keys.check_tinfoil_key, keys.save_tinfoil_key, "It is used from the next message — no restart needed.")
     if cmd == "pair":
         return await pair_cmd.main(rest)
     if cmd == "serve":