witbitz-code 1.3.4__tar.gz → 1.3.5__tar.gz

{witbitz_code-1.3.4/src/witbitz_code.egg-info → witbitz_code-1.3.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: witbitz-code
-Version: 1.3.4
+Version: 1.3.5
 Summary: Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay.
 Author: Witbitz
 License-Expression: MIT
@@ -48,9 +48,11 @@ verifier — attestation, Sigstore and TLS pinning — for the confidential mode
 witbitz-code setup
 ```
 
-`setup` walks four steps and skips whatever is already done: it installs OpenCode if it is missing (it asks first), pairs
+`setup` walks five steps and skips whatever is already done: it installs OpenCode if it is missing (it asks first), pairs
 this computer (scan the QR code in Spaces → Settings → Back up & recovery → Add a device), which gives the computer **its
-own keys from your Spaces account**, then starts `serve` in the window. Then open Code in Spaces. Leave it running (Ctrl-C
+own keys from your Spaces account**, offers to install the tools the agent uses for audio, video, PDFs and scans (ffmpeg,
+Poppler, Tesseract, … — with winget, Homebrew or one `sudo apt-get` line; it shows what it will run and asks once), then
+starts `serve` in the window. Then open Code in Spaces. Leave it running (Ctrl-C
 stops it); next time, `witbitz-code serve` is enough.
 
 **No key to paste.** Pairing asks your Spaces account for this computer's own TrustedRouter and Tinfoil keys, capped by the

{witbitz_code-1.3.4 → witbitz_code-1.3.5}/README.md

@@ -23,9 +23,11 @@ verifier — attestation, Sigstore and TLS pinning — for the confidential mode
 witbitz-code setup
 ```
 
-`setup` walks four steps and skips whatever is already done: it installs OpenCode if it is missing (it asks first), pairs
+`setup` walks five steps and skips whatever is already done: it installs OpenCode if it is missing (it asks first), pairs
 this computer (scan the QR code in Spaces → Settings → Back up & recovery → Add a device), which gives the computer **its
-own keys from your Spaces account**, then starts `serve` in the window. Then open Code in Spaces. Leave it running (Ctrl-C
+own keys from your Spaces account**, offers to install the tools the agent uses for audio, video, PDFs and scans (ffmpeg,
+Poppler, Tesseract, … — with winget, Homebrew or one `sudo apt-get` line; it shows what it will run and asks once), then
+starts `serve` in the window. Then open Code in Spaces. Leave it running (Ctrl-C
 stops it); next time, `witbitz-code serve` is enough.
 
 **No key to paste.** Pairing asks your Spaces account for this computer's own TrustedRouter and Tinfoil keys, capped by the

{witbitz_code-1.3.4 → witbitz_code-1.3.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "witbitz-code"
-version = "1.3.4"
+version = "1.3.5"
 description = "Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -43,7 +43,7 @@ where = ["src"]
 
 # Our OpenCode plugins, installed by `serve` (plugins.py) — copies of tools/opencode-plugins, kept current by embed.mjs
 [tool.setuptools.package-data]
-witbitz_code = ["opencode_plugins/*", "confidential_models.json", "offered_models.json"]
+witbitz_code = ["opencode_plugins/*", "confidential_models.json", "offered_models.json", "tools_catalog.json"]
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]

{witbitz_code-1.3.4 → witbitz_code-1.3.5}/src/witbitz_code/__init__.py

@@ -4,4 +4,4 @@ The Python implementation of tools/witbitz-code.mjs (docs/opencode-relay.md phas
 vectors and cross-implementation tests.
 """
 
-__version__ = "1.3.4"
+__version__ = "1.3.5"

{witbitz_code-1.3.4 → witbitz_code-1.3.5}/src/witbitz_code/cli.py

@@ -298,11 +298,17 @@ async def setup(args: list[str]) -> int:
             return {"state": st["why"]}
         return {"state": "unknown", "why": str(st.get("why") or "no answer")}
 
+    def refresh_path() -> None:  # Windows: a tool winget just installed is on the registry's PATH, not yet on ours
+        reg = toolsetup.registry_path()
+        if reg:
+            os.environ["PATH"] = toolsetup.merged_path(os.environ.get("PATH", ""), reg)
+
     d = wizard.Deps(
         say=_err, ask=lambda q: keys.read_line(q), secret=lambda q: keys.read_line(q, hidden=True),
         port=port, port_explicit="--port" in args,
         pair=lambda p: pair_cmd.main(["--port", str(p)]),
         keys_state=keys_state,
+        run_tools=lambda plan: toolsetup.run_plan(plan, say=_err), refresh_path=refresh_path,
         is_listening=is_listening, serve_here=lambda p: serve(["--port", str(p)]),
     )
     try:

witbitz_code-1.3.5/src/witbitz_code/tools_catalog.json

@@ -0,0 +1,219 @@
+{
+  "tools": [
+    {
+      "id": "git",
+      "label": "Git",
+      "bins": [
+        "git"
+      ],
+      "pkg": {
+        "brew": "git",
+        "apt": "git",
+        "dnf": "git",
+        "pacman": "git",
+        "winget": "Git.Git"
+      },
+      "auto": [],
+      "note": ""
+    },
+    {
+      "id": "ripgrep",
+      "label": "ripgrep",
+      "bins": [
+        "rg"
+      ],
+      "pkg": {
+        "brew": "ripgrep",
+        "apt": "ripgrep",
+        "dnf": "ripgrep",
+        "pacman": "ripgrep",
+        "winget": "BurntSushi.ripgrep.MSVC"
+      },
+      "auto": [],
+      "note": ""
+    },
+    {
+      "id": "jq",
+      "label": "jq",
+      "bins": [
+        "jq"
+      ],
+      "pkg": {
+        "brew": "jq",
+        "apt": "jq",
+        "dnf": "jq",
+        "pacman": "jq",
+        "winget": "jqlang.jq"
+      },
+      "auto": [],
+      "note": ""
+    },
+    {
+      "id": "python",
+      "label": "Python 3",
+      "bins": [
+        "python3",
+        "python"
+      ],
+      "pkg": {
+        "brew": "python",
+        "apt": "python3",
+        "dnf": "python3",
+        "pacman": "python",
+        "winget": "Python.Python.3.12"
+      },
+      "auto": [],
+      "note": ""
+    },
+    {
+      "id": "uv",
+      "label": "uv",
+      "bins": [
+        "uv"
+      ],
+      "pkg": {
+        "brew": "uv",
+        "apt": "",
+        "dnf": "",
+        "pacman": "uv",
+        "winget": "astral-sh.uv"
+      },
+      "auto": [],
+      "note": "where there is no package: the official installer from astral.sh"
+    },
+    {
+      "id": "ffmpeg",
+      "label": "ffmpeg",
+      "bins": [
+        "ffmpeg"
+      ],
+      "pkg": {
+        "brew": "ffmpeg",
+        "apt": "ffmpeg",
+        "dnf": "ffmpeg",
+        "pacman": "ffmpeg",
+        "winget": "Gyan.FFmpeg"
+      },
+      "auto": [],
+      "note": ""
+    },
+    {
+      "id": "whisper",
+      "label": "Whisper",
+      "bins": [
+        "whisper-cli",
+        "whisper-cpp",
+        "whisper"
+      ],
+      "pkg": {
+        "brew": "whisper-cpp",
+        "apt": "",
+        "dnf": "",
+        "pacman": "",
+        "winget": ""
+      },
+      "auto": [
+        "linux",
+        "win32"
+      ],
+      "note": "where there is no package: `uv tool install openai-whisper`; either way it needs a model downloaded before first use — say how big it is before fetching it"
+    },
+    {
+      "id": "poppler",
+      "label": "Poppler",
+      "bins": [
+        "pdftotext"
+      ],
+      "pkg": {
+        "brew": "poppler",
+        "apt": "poppler-utils",
+        "dnf": "poppler-utils",
+        "pacman": "poppler",
+        "winget": ""
+      },
+      "auto": [],
+      "note": ""
+    },
+    {
+      "id": "qpdf",
+      "label": "qpdf",
+      "bins": [
+        "qpdf"
+      ],
+      "pkg": {
+        "brew": "qpdf",
+        "apt": "qpdf",
+        "dnf": "qpdf",
+        "pacman": "qpdf",
+        "winget": "QPDF.QPDF"
+      },
+      "auto": [],
+      "note": ""
+    },
+    {
+      "id": "tesseract",
+      "label": "Tesseract",
+      "bins": [
+        "tesseract"
+      ],
+      "pkg": {
+        "brew": "tesseract",
+        "apt": "tesseract-ocr",
+        "dnf": "tesseract",
+        "pacman": "tesseract",
+        "winget": "UB-Mannheim.TesseractOCR"
+      },
+      "auto": [],
+      "note": ""
+    },
+    {
+      "id": "pandoc",
+      "label": "Pandoc",
+      "bins": [
+        "pandoc"
+      ],
+      "pkg": {
+        "brew": "pandoc",
+        "apt": "pandoc",
+        "dnf": "pandoc",
+        "pacman": "pandoc",
+        "winget": "JohnMacFarlane.Pandoc"
+      },
+      "auto": [],
+      "note": ""
+    },
+    {
+      "id": "imagemagick",
+      "label": "ImageMagick",
+      "bins": [
+        "magick",
+        "convert"
+      ],
+      "pkg": {
+        "brew": "imagemagick",
+        "apt": "imagemagick",
+        "dnf": "ImageMagick",
+        "pacman": "imagemagick",
+        "winget": "ImageMagick.ImageMagick"
+      },
+      "auto": [],
+      "note": ""
+    }
+  ],
+  "adminLines": {
+    "apt": "sudo apt-get update && sudo apt-get install -y {pkgs}",
+    "dnf": "sudo dnf install -y {pkgs}",
+    "pacman": "sudo pacman -S --needed --noconfirm {pkgs}",
+    "zypper": "sudo zypper install -y {pkgs}",
+    "apk": "sudo apk add {pkgs}"
+  },
+  "windowsReleases": {
+    "poppler": {
+      "url": "https://github.com/oschwartz10612/poppler-windows/releases/download/v26.09.0-0/Release-26.09.0-0.zip",
+      "sha256": "7a6f256a0ddf7536182246a5733331bf4677cbcc34f4663774947ad34556c8d0",
+      "mb": 42,
+      "inner": "poppler-26.09.0/Library/bin/",
+      "dir": "poppler\\bin"
+    }
+  }
+}

{witbitz_code-1.3.4 → witbitz_code-1.3.5}/src/witbitz_code/tools_probe.py

@@ -27,6 +27,9 @@ PACKAGE_MANAGERS: dict[str, list[tuple[str, str]]] = {
 }
 _EXTRA_POSIX = ["/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin", "/usr/sbin", "/snap/bin", "/home/linuxbrew/.linuxbrew/bin"]
 _EXTRA_HOME = [".local/bin", ".cargo/bin", "bin"]
+# Windows: under %LOCALAPPDATA%\Witbitz — what the Windows installer (code.ps1) fills and witbitz-code serve gives the agent:
+# its Git (Git Bash, the agent's shell), its own Python, and what setup's Tools step puts there (Poppler). = code-tools-probe.mjs
+_WIN_WITBITZ = ["bin", "git\\cmd", "git\\bin", "agent-python\\Scripts", "poppler\\bin"]
 
 
 def _is_executable(path: str) -> bool:
@@ -42,7 +45,11 @@ def search_dirs(*, env: Mapping[str, str], platform: str, home: str) -> list[str
     win = platform == "win32"
     raw = env.get("PATH") or env.get("Path") or ""
     from_path = [d for d in raw.split(";" if win else ":") if d]
-    extra = [] if win else _EXTRA_POSIX + ([f"{home.rstrip('/')}/{d}" for d in _EXTRA_HOME] if home else [])
+    if win:
+        local = (env.get("LOCALAPPDATA") or "").rstrip("\\/")
+        extra = [f"{local}\\Witbitz\\{d}" for d in _WIN_WITBITZ] if local else []
+    else:
+        extra = _EXTRA_POSIX + ([f"{home.rstrip('/')}/{d}" for d in _EXTRA_HOME] if home else [])
     return list(dict.fromkeys(from_path + extra))
 
 

witbitz_code-1.3.5/src/witbitz_code/toolsetup.py

@@ -0,0 +1,179 @@
+"""witbitz-code setup's Tools step — the Python twin of tools/code-tools-install.mjs and codeTools.js installPlan.
+
+Mechanical, in the setup terminal (the owner, 2026-10-08: "Why all this setup (or most of it can't be mechanical)?"): a
+package manager's own install with the person's terminal attached (sudo can ask for the password, winget's Windows
+permission prompt appears in front of them), a pinned download checked against its publisher's SHA-256, and nothing for
+what fetches itself on first use. No model, no approval cards; the agent on the Code card is the fallback.
+The catalog data is tools_catalog.json, written by tools/code-py-models.mjs; tests/test_toolsetup.py holds the plans equal.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import io
+import json
+import ntpath
+import os
+import shutil
+import subprocess
+import sys
+import zipfile
+from collections.abc import Callable
+from pathlib import Path
+from typing import Any
+
+import httpx
+
+_CATALOG = json.loads(Path(__file__).with_name("tools_catalog.json").read_text(encoding="utf-8"))
+TOOLS: list[dict] = _CATALOG["tools"]
+ADMIN_LINES: dict[str, str] = _CATALOG["adminLines"]
+WINDOWS_RELEASES: dict[str, dict] = _CATALOG["windowsReleases"]
+
+WINGET_FLAGS = ["--exact", "--source", "winget", "--silent", "--accept-package-agreements", "--accept-source-agreements", "--disable-interactivity"]
+
+
+def label(tool_id: str) -> str:
+    return next((t["label"] for t in TOOLS if t["id"] == tool_id), tool_id)
+
+
+def missing_tools(report: dict | None) -> list[dict]:
+    """= codeTools.js missingTools: missing per the report, in catalog order, never one this OS gets by itself (`auto`)."""
+    if not report:
+        return []
+    os_id = (report.get("platform") or {}).get("os") or ""
+    return [t for t in TOOLS if report.get("tools", {}).get(t["id"]) is False and os_id not in t["auto"]]
+
+
+def install_plan(ids: list[str], platform: dict) -> list[dict]:
+    """= codeTools.js installPlan → the steps setup runs, in order (see there)."""
+    os_id, pm = (platform or {}).get("os") or "", (platform or {}).get("pm") or ""
+    steps: list[dict] = []
+    batch: list[str] = []
+    batch_ids: list[str] = []
+    for t in TOOLS:
+        if t["id"] not in ids:
+            continue
+        if os_id in t["auto"]:
+            steps.append({"kind": "auto", "id": t["id"]})
+            continue
+        pkg = t["pkg"].get(pm, "") if pm else ""
+        if pkg and pm == "winget":
+            steps.append({"kind": "cmd", "ids": [t["id"]], "argv": ["winget", "install", "--id", pkg, *WINGET_FLAGS]})
+        elif pkg and (pm == "brew" or pm in ADMIN_LINES):
+            batch.append(pkg)
+            batch_ids.append(t["id"])
+        elif os_id == "win32" and t["id"] in WINDOWS_RELEASES:
+            steps.append({"kind": "release", "id": t["id"], **WINDOWS_RELEASES[t["id"]]})
+        else:
+            steps.append({"kind": "none", "id": t["id"], "note": t["note"]})
+    if batch:
+        steps.insert(0, {"kind": "cmd", "ids": batch_ids, "argv": ["brew", "install", *batch]} if pm == "brew"
+                     else {"kind": "cmd", "ids": batch_ids, "admin": True, "argv": ["sh", "-c", ADMIN_LINES[pm].replace("{pkgs}", " ".join(batch))]})
+    return steps
+
+
+def witbitz_dir(env: dict | None = None) -> str:
+    env = os.environ if env is None else env
+    return ntpath.join(env.get("LOCALAPPDATA", ""), "Witbitz")
+
+
+def run_inherit(argv: list[str]) -> int:
+    """A command with the person's terminal attached → its exit code (-1: it could not start)."""
+    try:
+        return subprocess.run(argv, check=False).returncode  # noqa: S603 — argv from installPlan, never a shell string of ours
+    except (OSError, ValueError):
+        return -1
+
+
+def install_release(step: dict, *, client: httpx.Client | None = None, dest: str | None = None) -> str:
+    """A pinned zip → its `inner` folder's files into <witbitz_dir>/<dir>. Raises ValueError with a sentence."""
+    own = client is None
+    client = client or httpx.Client(timeout=httpx.Timeout(300, connect=20), follow_redirects=True)
+    try:
+        r = client.get(step["url"])
+    except httpx.HTTPError as e:
+        raise ValueError(f"could not download it ({str(e)[:80]})") from e
+    finally:
+        if own:
+            client.close()
+    if r.status_code != 200:
+        raise ValueError(f"the download answered {r.status_code}")
+    got = hashlib.sha256(r.content).hexdigest()
+    if got != step["sha256"]:
+        raise ValueError(f"the download is not the pinned file (sha256 {got[:12]}…) — nothing was installed")
+    to = Path(dest or witbitz_dir(), *step["dir"].split("\\"))
+    inner = step["inner"]
+    with zipfile.ZipFile(io.BytesIO(r.content)) as z:
+        members = [m for m in z.infolist() if m.filename.startswith(inner) and not m.is_dir()]
+        if not members:
+            raise ValueError(f"the download does not hold {inner}")
+        to.mkdir(parents=True, exist_ok=True)
+        for m in members:
+            rel = m.filename[len(inner):]
+            if not rel or ".." in Path(rel).parts:
+                continue
+            out = to / rel
+            out.parent.mkdir(parents=True, exist_ok=True)
+            with z.open(m) as src, open(out, "wb") as dst:
+                shutil.copyfileobj(src, dst)
+    return str(to)
+
+
+def run_plan(steps: list[dict], *, say: Callable[[str], Any] = print, run: Callable[[list[str]], int] = run_inherit,
+             release: Callable[[dict], str] = install_release) -> dict:
+    """Carry out the plan → {done, failed, auto, none} (tool ids). Says each step as it goes. = code-tools-install.mjs runPlan"""
+    out: dict = {"done": [], "failed": [], "auto": [], "none": []}
+    for s in steps:
+        if s["kind"] == "cmd":
+            say(f"   $ {s['argv'][2] if s['argv'][0] == 'sh' else ' '.join(s['argv'])}")
+            code = run(s["argv"])
+            (out["done"] if code == 0 else out["failed"]).extend(s["ids"])
+            if code != 0:
+                say(f"   ✖ {', '.join(label(i) for i in s['ids'])}: that {'could not start' if code == -1 else f'ended with {code}'}")
+        elif s["kind"] == "release":
+            say(f"   Downloading {label(s['id'])} ({s['mb']} MB) from its publisher, checked against its SHA-256 …")
+            try:
+                to = release(s)
+                out["done"].append(s["id"])
+                say(f"   ✓ {label(s['id'])} → {to}")
+            except (ValueError, OSError) as e:
+                out["failed"].append(s["id"])
+                say(f"   ✖ {label(s['id'])}: {e}")
+        elif s["kind"] == "auto":
+            out["auto"].append(s["id"])
+            say(f"   ✓ {label(s['id'])}: fetched by itself the first time it is needed — nothing to install now")
+        else:
+            out["none"].append(s["id"])
+            note = f" ({s['note']})" if s.get("note") else ""
+            say(f"   – {label(s['id'])}: nothing here installs it{note} — \"Install with the agent\" in Code can try")
+    return out
+
+
+def registry_path(reg: Any = None) -> str | None:
+    """Windows: PATH as the registry has it now (machine, then user) — a program winget just installed is on it, while this
+    process still has the PATH it started with. None elsewhere or when it cannot be read."""
+    if sys.platform != "win32" and reg is None:
+        return None
+    if reg is None:
+        import winreg as reg  # noqa: PLC0415 — Windows only
+    parts = []
+    for root, key in ((reg.HKEY_LOCAL_MACHINE, r"SYSTEM\CurrentControlSet\Control\Session Manager\Environment"), (reg.HKEY_CURRENT_USER, "Environment")):
+        try:
+            with reg.OpenKey(root, key) as k:
+                value, _kind = reg.QueryValueEx(k, "Path")
+            parts.append(reg.ExpandEnvironmentStrings(value) if hasattr(reg, "ExpandEnvironmentStrings") else value)
+        except OSError:
+            continue
+    return ";".join(p for p in parts if p) or None
+
+
+def merged_path(current: str, from_registry: str | None) -> str:
+    """This process's PATH with the registry's entries added (new installs), keeping what it had. = mergedPath"""
+    seen: set[str] = set()
+    parts: list[str] = []
+    for d in (from_registry or "").split(";") + (current or "").split(";"):
+        d = d.strip()
+        if d and d.lower() not in seen:
+            seen.add(d.lower())
+            parts.append(d)
+    return ";".join(parts)

{witbitz_code-1.3.4 → witbitz_code-1.3.5}/src/witbitz_code/winagent.py

@@ -81,8 +81,11 @@ def windows_agent(config_dir: Path, env: dict | None = None, platform: str | Non
     if bash:
         add["SHELL"] = bash
     py = find_agent_python(env, exists)
-    if py:
-        add["PATH_PREPEND"] = [py]
+    # Poppler from setup's Tools step (toolsetup.py: winget has no package, so a pinned release into Witbitz\poppler\bin)
+    poppler = ntpath.join(_witbitz_dir(env), "poppler", "bin")
+    prepend = [d for d in (py, poppler if exists(ntpath.join(poppler, "pdftotext.exe")) else None) if d]
+    if prepend:
+        add["PATH_PREPEND"] = prepend
     f = Path(config_dir) / INSTRUCTIONS_NAME
     instr: str | None = None
     try:

{witbitz_code-1.3.4 → witbitz_code-1.3.5}/src/witbitz_code/wizard.py

@@ -21,7 +21,7 @@ from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any
 
-from . import codekeys, ports
+from . import codekeys, ports, tools_probe, toolsetup
 from . import pairings as pp
 from .connector import _url_port
 
@@ -77,6 +77,10 @@ class Deps:
     port_owners: Callable[[int], list] = ports.port_owners  # [{pid, cmd}] — this user's processes on a port (ports.py)
     stop_process: Callable[[int], bool] = lambda pid: __import__("witbitz_code.uninstall", fromlist=["stop_process"]).stop_process(pid)
     wsl: bool = field(default_factory=ports.on_wsl)
+    # setup's Tools step (toolsetup.py): what is here, carrying out the plan, and PATH after installs (Windows: the registry)
+    probe_tools: Callable[[], dict] = lambda: tools_probe.probe_tools()
+    run_tools: Callable[[list], dict] = None  # type: ignore[assignment]
+    refresh_path: Callable[[], None] = lambda: None
     serve_here: Callable[[int], Awaitable[int]] = None  # type: ignore[assignment]
     result: dict = field(default_factory=lambda: {"opencode": False, "paired": False, "keys": False, "running": ""})
 
@@ -88,7 +92,7 @@ def _yes(answer: str) -> bool:
 async def run_setup(d: Deps) -> dict:
     port = d.port
     result = d.result
-    d.say("witbitz-code setup — four steps; anything already done is skipped.\n")
+    d.say("witbitz-code setup — five steps; anything already done is skipped.\n")
 
     # 1 — OpenCode
     d.say("1. OpenCode, the coding agent")
@@ -178,7 +182,12 @@ async def run_setup(d: Deps) -> dict:
     result["keys"] = True
 
     # 4 — running (this package has no background service yet: it runs in this window)
-    d.say("\n4. Keep it running")
+    # 4 — the tools the agent works with (the Code card's list), installed HERE, mechanically (toolsetup.py; the owner,
+    # 2026-10-08: "Why all this setup (or most of it can't be mechanical)?"). Asked once; nothing runs on a no.
+    d.say("\n4. Tools for audio, video, PDFs and scans")
+    result["tools"] = await _tools_step(d)
+
+    d.say("\n5. Keep it running")
     # OpenCode's port AND the model proxy's (port + 100): an earlier witbitz-code still running holds both, and keeps answering
     # the phone with the keys it started with (the owner, 2026-10-08: `pipx uninstall` left it running — "could not start
     # the model proxy … address already in use", then "Invalid API key"). This person's own process: offer to stop it.
@@ -218,3 +227,51 @@ async def run_setup(d: Deps) -> dict:
     result["port"] = port
     result["served"] = await d.serve_here(port)
     return result
+
+
+def _describe(step: dict) -> str:
+    if step["kind"] == "cmd":
+        line = step["argv"][2] if step["argv"][0] == "sh" else " ".join(step["argv"][:4])
+        return f"     {line}" + ("   (asks for your password)" if step.get("admin") else "")
+    if step["kind"] == "release":
+        return f"     {toolsetup.label(step['id'])}: a {step['mb']} MB download from its publisher, checked against its SHA-256"
+    if step["kind"] == "auto":
+        return f"     {toolsetup.label(step['id'])}: comes by itself the first time it is needed"
+    return f"     {toolsetup.label(step['id'])}: nothing here installs it" + (f" ({step['note']})" if step.get("note") else "")
+
+
+async def _tools_step(d: Deps) -> str:
+    """→ 'here' | 'installed' | 'partly' | 'skipped' | 'unavailable'."""
+    try:
+        report = d.probe_tools()
+    except Exception:  # noqa: BLE001 — a probe that fails never stops setup
+        d.say("   (could not check which tools are here — skipped)")
+        return "skipped"
+    missing = toolsetup.missing_tools(report)
+    if not missing:
+        d.say("   ✓ Everything the agent uses for these is here")
+        return "here"
+    plan = toolsetup.install_plan([t["id"] for t in missing], report.get("platform") or {})
+    d.say(f"   Missing here: {', '.join(t['label'] for t in missing)}.")
+    if not any(st["kind"] in ("cmd", "release") for st in plan):
+        d.say("   Nothing on this computer can install them (no package manager found) — \"Install with the agent\" in Code can try.")
+        return "unavailable"
+    d.say("   This would run:")
+    for st in plan:
+        d.say(_describe(st))
+    if not _yes(d.ask("   Install them now? [Y/n] ")):
+        d.say("   Skipped — run witbitz-code setup again to install them, or use the card in Code.")
+        return "skipped"
+    d.run_tools(plan)
+    d.refresh_path()
+    try:
+        after = {t["id"] for t in toolsetup.missing_tools(d.probe_tools())}
+    except Exception:  # noqa: BLE001
+        after = {t["id"] for t in missing}
+    still = [t["label"] for t in missing if t["id"] in after]
+    if not still:
+        d.say("   ✓ Installed")
+        return "installed"
+    d.say(f"   Still missing: {', '.join(still)} — \"Install with the agent\" in Code can try, or run setup again.")
+    return "partly"
+

{witbitz_code-1.3.4 → witbitz_code-1.3.5/src/witbitz_code.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: witbitz-code
-Version: 1.3.4
+Version: 1.3.5
 Summary: Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay.
 Author: Witbitz
 License-Expression: MIT
@@ -48,9 +48,11 @@ verifier — attestation, Sigstore and TLS pinning — for the confidential mode
 witbitz-code setup
 ```
 
-`setup` walks four steps and skips whatever is already done: it installs OpenCode if it is missing (it asks first), pairs
+`setup` walks five steps and skips whatever is already done: it installs OpenCode if it is missing (it asks first), pairs
 this computer (scan the QR code in Spaces → Settings → Back up & recovery → Add a device), which gives the computer **its
-own keys from your Spaces account**, then starts `serve` in the window. Then open Code in Spaces. Leave it running (Ctrl-C
+own keys from your Spaces account**, offers to install the tools the agent uses for audio, video, PDFs and scans (ffmpeg,
+Poppler, Tesseract, … — with winget, Homebrew or one `sudo apt-get` line; it shows what it will run and asks once), then
+starts `serve` in the window. Then open Code in Spaces. Leave it running (Ctrl-C
 stops it); next time, `witbitz-code serve` is enough.
 
 **No key to paste.** Pairing asks your Spaces account for this computer's own TrustedRouter and Tinfoil keys, capped by the

{witbitz_code-1.3.4 → witbitz_code-1.3.5}/src/witbitz_code.egg-info/SOURCES.txt

@@ -37,7 +37,9 @@ src/witbitz_code/receipt.py
 src/witbitz_code/relay.py
 src/witbitz_code/seen.py
 src/witbitz_code/tinfoil_read.py
+src/witbitz_code/tools_catalog.json
 src/witbitz_code/tools_probe.py
+src/witbitz_code/toolsetup.py
 src/witbitz_code/uninstall.py
 src/witbitz_code/winagent.py
 src/witbitz_code/winconsole.py
@@ -72,6 +74,7 @@ tests/test_registry.py
 tests/test_relay_codec.py
 tests/test_setup.py
 tests/test_tools_probe.py
+tests/test_toolsetup.py
 tests/test_uninstall.py
 tests/test_winagent.py
 tests/test_winconsole.py

{witbitz_code-1.3.4 → witbitz_code-1.3.5}/tests/test_setup.py

@@ -120,7 +120,9 @@ class Fake:
             code_keys=lambda p: {"caps": {"modelsUsd": 50, "toolsUsd": 5}} if p.get("computerId") in self._keyed else None,
             serve_here=serve_here,
             # never this machine's real processes: the real lookup finds whatever listens on 4096 HERE (an OpenCode does)
-            **{"is_listening": listening, "port_owners": lambda port: [], "stop_process": lambda pid: False, "wsl": False, **over})
+            # and never this machine's tools: nothing is missing, nothing is installed (the Tools step has its own tests)
+            **{"is_listening": listening, "port_owners": lambda port: [], "stop_process": lambda pid: False, "wsl": False,
+               "probe_tools": lambda: {"tools": {}, "platform": {"os": "", "pm": ""}}, "run_tools": lambda plan: {}, "refresh_path": lambda: None, **over})
 
 
 def test_a_new_computer_is_paired_gets_its_keys_from_the_account_and_is_served_without_a_key_prompt():

witbitz_code-1.3.5/tests/test_toolsetup.py

@@ -0,0 +1,147 @@
+"""setup's Tools step (toolsetup.py) — the plan held to codeTools.js installPlan, the runner, the pinned download, PATH after
+installs, and the wizard step. Nothing here installs anything on this computer: every command and download is a fake."""
+
+from __future__ import annotations
+
+import asyncio
+import hashlib
+import io
+import zipfile
+
+import httpx
+import pytest
+from conftest import requires_node, run_node
+
+from witbitz_code import toolsetup as ts, wizard
+
+CASES = [
+    (["git", "ripgrep", "ffmpeg", "whisper", "poppler", "uv", "tesseract"], {"os": "win32", "pm": "winget"}),
+    (["git", "ffmpeg", "whisper", "poppler", "uv", "pandoc"], {"os": "linux", "pm": "apt"}),
+    (["ffmpeg", "whisper", "poppler", "qpdf"], {"os": "darwin", "pm": "brew"}),
+    (["ffmpeg", "poppler"], {"os": "win32", "pm": "scoop"}),
+    (["jq", "whisper"], {"os": "darwin", "pm": ""}),
+    (["git"], {"os": "linux", "pm": "zypper"}),
+]
+
+
+@requires_node
+def test_the_plans_and_the_catalog_copy_are_the_javascript_ones():
+    js = run_node("import { installPlan, missingTools } from '@REPO@/spaces/public/codeTools.js'; import { toolsCatalog } from '@TOOLS@/code-py-models.mjs';"
+                  "OUT({ plans: INPUT.cases.map(([ids, p]) => installPlan(ids, p)), catalog: toolsCatalog(),"
+                  "  missing: INPUT.reports.map((r) => missingTools(r).map((t) => t.id)) })".replace("@REPO@", (__import__("conftest").REPO).as_uri()),
+                  {"cases": CASES, "reports": REPORTS})
+    assert js["catalog"] == {"tools": ts.TOOLS, "adminLines": ts.ADMIN_LINES, "windowsReleases": ts.WINDOWS_RELEASES}, "tools_catalog.json is stale — run node tools/code-py-models.mjs"
+    assert [ts.install_plan(ids, p) for ids, p in CASES] == js["plans"]
+    assert [[t["id"] for t in ts.missing_tools(r)] for r in REPORTS] == js["missing"]
+
+
+REPORTS = [
+    {"tools": {"whisper": False, "ffmpeg": False, "git": True}, "platform": {"os": "win32", "pm": "winget"}},
+    {"tools": {"whisper": False, "ffmpeg": False}, "platform": {"os": "darwin", "pm": "brew"}},
+    {"tools": {"whisper": False}, "platform": {"os": "linux", "pm": "apt"}},
+]
+
+
+def test_whisper_is_never_missing_where_the_media_tools_fetch_it():
+    assert [t["id"] for t in ts.missing_tools(REPORTS[0])] == ["ffmpeg"]
+    assert [t["id"] for t in ts.missing_tools(REPORTS[1])] == ["ffmpeg", "whisper"], "on a Mac it comes from Homebrew"
+    assert ts.missing_tools(REPORTS[2]) == []
+
+
+def test_the_runner_says_each_step_and_sorts_the_outcomes():
+    said, ran = [], []
+    plan = ts.install_plan(["git", "ffmpeg", "poppler", "uv", "whisper"], {"os": "win32", "pm": "winget"}) + [{"kind": "none", "id": "pandoc", "note": ""}]
+    def run(argv):
+        ran.append(argv)
+        return 0 if "Git.Git" in argv else 1
+    out = ts.run_plan(plan, say=said.append, run=run, release=lambda st: "C:\\W\\poppler\\bin")
+    assert out == {"done": ["git", "poppler"], "failed": ["uv", "ffmpeg"], "auto": ["whisper"], "none": ["pandoc"]}
+    assert all(a[:2] == ["winget", "install"] and "--accept-package-agreements" in a for a in ran)
+    assert any("ffmpeg: that ended with 1" in s for s in said) and any("Poppler (42 MB)" in s for s in said)
+
+
+def _zip(files: dict) -> bytes:
+    b = io.BytesIO()
+    with zipfile.ZipFile(b, "w") as z:
+        for name, data in files.items():
+            z.writestr(name, data)
+    return b.getvalue()
+
+
+def test_the_pinned_download_lands_its_inner_folder_and_a_changed_file_is_refused(tmp_path):
+    body = _zip({"poppler-26.09.0/Library/bin/pdftotext.exe": b"MZ-text", "poppler-26.09.0/Library/bin/poppler.dll": b"MZ-dll",
+                 "poppler-26.09.0/share/x.txt": b"no", "poppler-26.09.0/Library/bin/../../evil.txt": b"no"})
+    step = {"url": "https://example.test/p.zip", "sha256": hashlib.sha256(body).hexdigest(), "mb": 1, "inner": "poppler-26.09.0/Library/bin/", "dir": "poppler\\bin"}
+    with httpx.Client(transport=httpx.MockTransport(lambda req: httpx.Response(200, content=body))) as c:
+        to = ts.install_release(step, client=c, dest=str(tmp_path))
+    got = sorted(p.name for p in (tmp_path / "poppler" / "bin").iterdir())
+    assert got == ["pdftotext.exe", "poppler.dll"] and to.endswith("bin") and not (tmp_path / "evil.txt").exists()
+    bad = {**step, "dir": "other\\bin"}
+    with httpx.Client(transport=httpx.MockTransport(lambda req: httpx.Response(200, content=body + b"x"))) as c:
+        with pytest.raises(ValueError, match="not the pinned file"):
+            ts.install_release(bad, client=c, dest=str(tmp_path))
+    assert not (tmp_path / "other").exists(), "nothing written from a changed file"
+
+
+def test_path_after_installs_comes_from_the_registry_and_keeps_this_process_own_entries():
+    class Reg:
+        HKEY_LOCAL_MACHINE, HKEY_CURRENT_USER = "HKLM", "HKCU"
+        vals = {"HKLM": r"C:\Windows;%SystemRoot%\x", "HKCU": r"C:\Users\u\AppData\Local\Microsoft\WinGet\Links"}
+        class _K:
+            def __init__(self, root): self.root = root
+            def __enter__(self): return self
+            def __exit__(self, *a): return False
+        def OpenKey(self, root, key): return Reg._K(root)  # noqa: N802
+        def QueryValueEx(self, k, name): return Reg.vals[k.root], 2  # noqa: N802
+        def ExpandEnvironmentStrings(self, v): return v.replace("%SystemRoot%", r"C:\Windows")  # noqa: N802
+    reg = ts.registry_path(Reg())
+    assert reg == r"C:\Windows;C:\Windows\x;C:\Users\u\AppData\Local\Microsoft\WinGet\Links"
+    assert ts.merged_path(r"C:\W\bin;c:\windows", reg) == r"C:\Windows;C:\Windows\x;C:\Users\u\AppData\Local\Microsoft\WinGet\Links;C:\W\bin"
+
+
+class Tools:
+    """setup's view of this computer's tools: `missing` until run_tools installs them (or `installs` says which)."""
+
+    def __init__(self, missing: list[str], platform: dict, installs: list[str] | None = None) -> None:
+        self.missing, self.platform, self.installs, self.plans, self.refreshed = set(missing), platform, installs, [], 0
+
+    def probe(self) -> dict:
+        return {"tools": {t["id"]: t["id"] not in self.missing for t in ts.TOOLS}, "platform": self.platform}
+
+    def run(self, plan: list) -> dict:
+        self.plans.append(plan)
+        for st in plan:
+            for i in st.get("ids") or [st.get("id")]:
+                if self.installs is None or i in self.installs:
+                    self.missing.discard(i)
+        return {}
+
+
+def step(tools: Tools, answers: list[str]) -> tuple[str, list[str]]:
+    said = []
+    d = wizard.Deps(say=said.append, ask=lambda q: answers.pop(0) if answers else "", secret=lambda q: "",
+                    probe_tools=tools.probe, run_tools=tools.run, refresh_path=lambda: setattr(tools, "refreshed", tools.refreshed + 1))
+    return asyncio.run(wizard._tools_step(d)), said
+
+
+def test_setup_asks_once_installs_mechanically_and_checks_again():
+    t = Tools(["ffmpeg", "poppler", "tesseract", "whisper"], {"os": "win32", "pm": "winget"})
+    r, said = step(t, [""])
+    assert r == "installed" and t.refreshed == 1
+    assert [s["kind"] for s in t.plans[0]] == ["cmd", "release", "cmd"], "Whisper is not asked for on Windows: it comes by itself"
+    assert any("Missing here: ffmpeg, Poppler, Tesseract." in s for s in said) and any("42 MB download" in s for s in said)
+
+
+def test_a_no_installs_nothing_and_what_could_not_be_installed_is_named():
+    t = Tools(["ffmpeg", "pandoc"], {"os": "linux", "pm": "apt"})
+    r, said = step(t, ["n"])
+    assert r == "skipped" and t.plans == []
+    t2 = Tools(["ffmpeg", "pandoc"], {"os": "linux", "pm": "apt"}, installs=["ffmpeg"])
+    r2, said2 = step(t2, [""])
+    assert r2 == "partly" and any("(asks for your password)" in s for s in said2) and any("Still missing: Pandoc" in s for s in said2)
+
+
+def test_no_package_manager_says_so_without_asking():
+    t = Tools(["jq"], {"os": "darwin", "pm": ""})
+    r, said = step(t, [])
+    assert r == "unavailable" and t.plans == [] and any("no package manager found" in s for s in said)

{witbitz_code-1.3.4 → witbitz_code-1.3.5}/tests/test_winagent.py

@@ -67,3 +67,13 @@ def test_apply_puts_python_ahead_of_ast_grep_and_adds_to_the_instructions():
     # no ast-grep: PATH starts from the base
     env, config = winagent.apply({}, {}, add, None, base_path=r"C:\Windows\system32")
     assert env["PATH"] == r"C:\py\Scripts;C:\Windows\system32" and config == {}
+
+
+def test_setups_poppler_joins_the_agents_path_when_it_is_there(tmp_path):
+    # setup's Tools step puts Poppler in Witbitz\poppler\bin (winget has no package) — the agent's PATH must reach it
+    py = r"C:\Users\t\AppData\Local\Witbitz\agent-python\Scripts\python.exe"
+    pdf = r"C:\Users\t\AppData\Local\Witbitz\poppler\bin\pdftotext.exe"
+    add, _, _ = winagent.windows_agent(tmp_path, env=ENV, platform="win32", exists=exists_of(py, pdf))
+    assert add["PATH_PREPEND"] == [r"C:\Users\t\AppData\Local\Witbitz\agent-python\Scripts", r"C:\Users\t\AppData\Local\Witbitz\poppler\bin"]
+    add2, _, _ = winagent.windows_agent(tmp_path, env=ENV, platform="win32", exists=exists_of(py))
+    assert add2["PATH_PREPEND"] == [r"C:\Users\t\AppData\Local\Witbitz\agent-python\Scripts"]