witbitz-code 1.6.3__tar.gz → 1.6.6__tar.gz

{witbitz_code-1.6.3/src/witbitz_code.egg-info → witbitz_code-1.6.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: witbitz-code
-Version: 1.6.3
+Version: 1.6.6
 Summary: Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay.
 Author: Witbitz
 License-Expression: MIT

{witbitz_code-1.6.3 → witbitz_code-1.6.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "witbitz-code"
-version = "1.6.3"
+version = "1.6.6"
 description = "Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay."
 readme = "README.md"
 requires-python = ">=3.10"

{witbitz_code-1.6.3 → witbitz_code-1.6.6}/src/witbitz_code/__init__.py

@@ -4,4 +4,4 @@ The Python implementation of tools/witbitz-code.mjs (docs/opencode-relay.md phas
 vectors and cross-implementation tests.
 """
 
-__version__ = "1.6.3"
+__version__ = "1.6.6"

{witbitz_code-1.6.3 → witbitz_code-1.6.6}/src/witbitz_code/attachments.py

@@ -15,12 +15,14 @@ import hashlib
 import os
 import re
 import shutil
+import sys
 import time
 from decimal import ROUND_HALF_UP, Decimal
 from pathlib import Path
 from typing import Any
 
 from . import _js
+from . import pairings as pp
 
 NOTE_HEAD = "The user attached files. They are saved on this computer — open them with the read tool."
 ATTACHMENT_ROUTE = "/witbitz/attachment"
@@ -178,8 +180,9 @@ def stage_message_body(body: Any, *, session_id: Any, root: Path, max_file_bytes
     d = Path(root) / session_id
     if Path(root).is_symlink() or d.is_symlink():
         return {"error": {"status": 400, "message": "the attachments folder is a link — refusing to write through it"}}
-    d.mkdir(parents=True, exist_ok=True, mode=0o700)
-    os.chmod(d, 0o700)
+    pp.private_mkdir(d)
+    if sys.platform != "win32":
+        os.chmod(d, 0o700)
     used = _folder_bytes(d)
     total = _root_bytes(root)
     entries: list[dict] = []

{witbitz_code-1.6.3 → witbitz_code-1.6.6}/src/witbitz_code/auto.py

@@ -206,6 +206,30 @@ _KEY_FILE = re.compile(r"\.(pem|key|p12|pfx|jks|keystore)\Z", re.ASCII | re.IGNO
 _SECRETISH = re.compile(r"secret|credential", re.ASCII | re.IGNORECASE)
 
 
+_WIN_ABS = re.compile(r"\A(?:\\\\\?\\)?([A-Za-z]):[\\/]")
+_WIN_UNC = re.compile(r"\A\\\\(?!\?\\)([^\\/]+)[\\/]([^\\/]+)")  # \\server\share — a project on a network share
+
+
+def windows_to_posix(path: Any) -> Any:
+    """A Windows path in the form every rule here reads: C:\\Users\\x, C:/Users/x → /c/Users/x (Git Bash's own spelling).
+    Every rule tests "absolute" as a leading / — so on Windows (the owner, 2026-10-09: "The auto mode is not working
+    (windows)") the project folder was never absolute and Auto would not switch on, and C:/… in a command read as a path
+    INSIDE the project. Anything else is returned as it came."""
+    if not isinstance(path, str):
+        return path
+    m = _WIN_ABS.match(path)
+    if m:
+        return "/" + m.group(1).lower() + "/" + path[m.end():].replace("\\", "/")
+    u = _WIN_UNC.match(path)  # \\server\share\x → /unc/server/share/x: never one of the /c/… drive spellings
+    return "/unc/" + u.group(1).lower() + "/" + u.group(2) + path[u.end():].replace("\\", "/") if u else path
+
+
+def _windows_project(ctx: dict) -> bool:
+    """A project on Windows: there a backslash separates folders too (..\\..\\x climbs out exactly as ../../x does)."""
+    d = str(ctx.get("directory") or "")
+    return bool(_WIN_ABS.match(d) or _WIN_UNC.match(d))
+
+
 def _sensitive_path(abs_path: str) -> bool:
     parts = abs_path.split("/")
     base = parts[-1] or ""
@@ -219,7 +243,7 @@ def _sensitive_path(abs_path: str) -> bool:
 
 
 def _project_dir(directory: Any) -> str:
-    d = _js.js_string(directory) if _js.truthy(directory) else ""
+    d = windows_to_posix(_js.js_string(directory)) if _js.truthy(directory) else ""
     return re.sub(r"/+\Z", "", posix_normalize(d))
 
 
@@ -246,6 +270,7 @@ def _word_stays_in_project(w: str, ctx: dict) -> bool:
         v = v[eq + 1:]
         if not v:
             return True
+    v = windows_to_posix(v if not _windows_project(ctx) or v.startswith("~") or _WIN_ABS.match(v) or _WIN_UNC.match(v) else v.replace("\\", "/"))
     if "$" in v or re.search(r"(^|/)\.\.(/|\Z)", v):
         return False
     if v.startswith("~"):
@@ -333,6 +358,8 @@ def _edit_inside_project(patterns: Any, ctx: dict) -> bool:
     for p in patterns:
         if not isinstance(p, str) or not p or re.search(r"[*?\[\]{}]", p):
             return False  # a glob is not a precise target
+        if _windows_project(ctx):
+            p = windows_to_posix(p if _WIN_ABS.match(p) or _WIN_UNC.match(p) else p.replace("\\", "/"))
         a = posix_normalize(p if p.startswith("/") else d + "/" + p)
         r = next((x for x in roots if a.startswith(x + "/")), "")
         if not (r and not _sensitive_path(a[len(r):])):

{witbitz_code-1.6.3 → witbitz_code-1.6.6}/src/witbitz_code/auto_runner.py

@@ -33,7 +33,7 @@ import httpx
 
 from . import _js
 from .folders import allowed_folders
-from .auto import SCRATCH_DIR, action_for, classify_deterministic, log_record, parse_verdict, reviewer_prompt, scratch_paths
+from .auto import SCRATCH_DIR, windows_to_posix, action_for, classify_deterministic, log_record, parse_verdict, reviewer_prompt, scratch_paths
 from .policy import SUBAGENT_GATED
 
 REVIEW_TITLE = "witbitz-auto-review"  # the page never lists a session with this title
@@ -146,7 +146,7 @@ class AutoRunner:
             doc = _js.parse(self._state_path.read_text(encoding="utf-8"))
             sessions = doc.get("sessions") if isinstance(doc, dict) else None
             for sid, v in (sessions.items() if isinstance(sessions, dict) else []):
-                if sid.startswith("ses") and isinstance(v, dict) and isinstance(v.get("dir"), str) and v["dir"].startswith("/"):
+                if sid.startswith("ses") and isinstance(v, dict) and isinstance(v.get("dir"), str) and windows_to_posix(v["dir"]).startswith("/"):
                     at = _js.to_number(v.get("at", _js.UNDEFINED))
                     self._auto[sid] = {"dir": v["dir"], "at": _js.clean_number(at) if _js.truthy(at) else 0}
         except Exception as e:
@@ -470,7 +470,8 @@ class AutoRunner:
         if not isinstance(session_id, str) or not _SESSION_ID.fullmatch(session_id):
             return False
         if on:
-            if not isinstance(directory, str) or not directory.startswith("/") or _js.utf16_len(directory) > 1024:
+            # Windows: C:\\Users\\… is absolute too (auto.windows_to_posix); the folder is kept as given for OpenCode's API.
+            if not isinstance(directory, str) or not windows_to_posix(directory).startswith("/") or _js.utf16_len(directory) > 1024:
                 return False
             self._auto[session_id] = {"dir": directory, "at": self._now()}  # an existing key keeps its place, as Map.set does
         else:

{witbitz_code-1.6.3 → witbitz_code-1.6.6}/src/witbitz_code/cli.py

@@ -240,7 +240,7 @@ async def serve(args: list[str], *, stop: Any = None, live_out: dict | None = No
                  + (f" — held by {held}: an earlier witbitz-code still running? witbitz-code setup offers to stop it" if held
                     else " — free that port and run serve again"))
             return 1
-        route = models.proxy_config(proxy.port)
+        route = {**models.proxy_config(proxy.port), **models.default_model_config()}
         if await is_listening(port) and "--no-opencode" not in args:
             _err(f"witbitz-code: OpenCode is already running on 127.0.0.1:{port}, started some other way — it cannot use your account's keys.")
             _err("              Close it, then run witbitz-code serve again (it starts OpenCode itself).")

{witbitz_code-1.6.3 → witbitz_code-1.6.6}/src/witbitz_code/keys.py

@@ -119,7 +119,7 @@ def has_trustedrouter(env: dict | None = None) -> bool:
 
 def save_trustedrouter_key(key: str) -> Path:
     p = auth_path()
-    p.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+    pp.private_mkdir(p.parent)
     text = p.read_text(encoding="utf-8") if p.exists() else ""
     pp.write_private(p, with_auth_key(text, "trustedrouter", key))
     return p

{witbitz_code-1.6.3 → witbitz_code-1.6.6}/src/witbitz_code/mkdir.py

@@ -47,7 +47,7 @@ def mkdir_in(*, root: object, rel: object, name: object) -> tuple[int, str]:
         return _error(403, "that lies outside the root")
     target = P.join(real_parent, str(name))
     try:
-        os.mkdir(target, 0o700)
+        os.mkdir(target) if win else os.mkdir(target, 0o700)  # Windows: inherit — 0o700 makes an owner-only access list (pairings.private_mkdir)
     except FileExistsError:
         return _error(409, "already there")
     except OSError as e:

{witbitz_code-1.6.3 → witbitz_code-1.6.6}/src/witbitz_code/models.py

@@ -68,6 +68,16 @@ def variants_for(m: dict) -> dict | None:
     return {e: {"reasoningEffort": e} for e in efforts} if efforts else None
 
 
+# The model OpenCode starts with when the page has chosen none — the catalog's confidential default, as the Node connector's
+# config names it (tools/opencode-config.mjs; agent/modelCatalog.mjs DEFAULTS.confidential — held equal by test). Without it
+# OpenCode picked a model itself (the owner, 2026-10-09: "Make deepseek 4.1 flash the default for code").
+DEFAULT_MODEL = "deepseek/deepseek-v4.1-flash"
+
+
+def default_model_config() -> dict:
+    return {"model": f"trustedrouter/{DEFAULT_MODEL}"}
+
+
 def proxy_config(proxy_port: int, cat: list[dict] | None = None) -> dict:
     """OpenCode config that sends TrustedRouter through the proxy and declares the confidential models — a text-only one
     still receives images (the proxy reads them through Tinfoil). Merged by OpenCode over the user's own config."""

{witbitz_code-1.6.3 → witbitz_code-1.6.6}/src/witbitz_code/pairings.py

@@ -165,10 +165,22 @@ def read_pairings(path: Path | None = None) -> dict:
         return norm_pairings(None)
 
 
+def private_mkdir(path: Path, mode: int = 0o700, *, parents: bool = True) -> None:
+    """A folder only this user reads — 0700 off Windows. On Windows NO mode: Python 3.12.4+ turns 0o700 into an access list of
+    SYSTEM, Administrators and the folder's OWNER, and a folder made from an Administrator window is owned by Administrators —
+    the person's own non-admin windows could then not open it (the owner's second desktop, 2026-10-09: uninstall died
+    "[WinError 5] Access is denied: …\\.witbitz\\code\\pairings.json"). The folder inherits the user profile's access instead,
+    which is already the person's alone."""
+    if sys.platform == "win32":
+        path.mkdir(parents=parents, exist_ok=True)
+    else:
+        path.mkdir(parents=parents, exist_ok=True, mode=mode)
+
+
 def write_private(path: Path, text: str, dir_mode: int = 0o700) -> None:
     """Write a 0600 file atomically: the secret is never readable by others, not even for the moment between write and
     chmod, and a crash never leaves half a file."""
-    path.parent.mkdir(parents=True, exist_ok=True, mode=dir_mode)
+    private_mkdir(path.parent, dir_mode)
     fd, tmp = tempfile.mkstemp(dir=path.parent, prefix=f".{path.name}.")
     try:
         with os.fdopen(fd, "w", encoding="utf-8", newline="") as f:

{witbitz_code-1.6.3 → witbitz_code-1.6.6}/src/witbitz_code/plugins.py

@@ -133,8 +133,11 @@ def notes_rules(s: dict, root_dir: str) -> list[dict]:
         return []
     folder = f"{root_dir}/{notes_key(os.path.abspath(root))}"
     plain = bool(s.get("path")) and s.get("directory") == "/" + str(s.get("path"))
-    rel = os.path.relpath(folder, "/" if plain else os.path.abspath(root))
-    return [
-        {"permission": "external_directory", "pattern": f"{folder}/*", "action": "allow"},
-        {"permission": "edit", "pattern": f"{rel}/notes/*", "action": "allow"},
-    ]
+    read = {"permission": "external_directory", "pattern": f"{folder}/*", "action": "allow"}
+    try:
+        rel = os.path.relpath(folder, "/" if plain else os.path.abspath(root))
+    except ValueError:
+        # Windows, the project on another drive or a network share (\\\\192.168.57.47\\Projects — the owner, 2026-10-09:
+        # "path is on mount 'C:', start on mount …"): no relative path reaches the notes, so their writes ask; reads stay.
+        return [read]
+    return [read, {"permission": "edit", "pattern": f"{rel}/notes/*", "action": "allow"}]

{witbitz_code-1.6.3 → witbitz_code-1.6.6/src/witbitz_code.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: witbitz-code
-Version: 1.6.3
+Version: 1.6.6
 Summary: Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay.
 Author: Witbitz
 License-Expression: MIT

{witbitz_code-1.6.3 → witbitz_code-1.6.6}/tests/test_auto.py

@@ -629,3 +629,74 @@ def test_wiring_the_page_switches_auto_and_the_verdict_comes_back(make, tmp_path
                 await connector.stop()
 
     run(go())
+
+
+# ── WINDOWS (the owner, 2026-10-09: "The auto mode is not working (windows)") ────────────────────────────────────────────
+# Every rule read "absolute" as a leading /: Auto would not switch on for C:\…, and C:/… in a command read as INSIDE the
+# project. A Windows request now gets exactly the decision its Linux twin gets.
+_WIN_TWINS = [
+    ("ls src", "ls src"),
+    ("cat /etc/hosts", "cat C:/Windows/win.ini"),
+    ("cat /home/u/repo/src/a.py", "cat C:/Users/u/repo/src/a.py"),
+    ("cat /home/u/repo/.git/config", "cat /c/Users/u/repo/.git/config"),
+]
+_WIN_EDITS = [("src/a.py", "src\\a.py"), ("../../x", "..\\..\\x"), ("/home/u/repo/src/a.py", "C:\\Users\\u\\repo\\src\\a.py"),
+              ("/home/u/other/a.py", "C:\\Users\\u\\other\\a.py")]
+
+
+def _stage(req, directory, home):
+    r = classify_deterministic({"id": "per_x", "sessionID": "ses_x", "always": [], **req}, directory=directory, home=home)
+    return r["stage"] if r else "review"
+
+
+@pytest.mark.parametrize("lin,win", _WIN_TWINS)
+def test_a_windows_command_is_judged_like_its_linux_twin(lin, win):
+    b = lambda c: {"permission": "bash", "patterns": [c], "metadata": {"command": c}}  # noqa: E731
+    assert _stage(b(win), "C:\\Users\\u\\repo", "C:\\Users\\u") == _stage(b(lin), "/home/u/repo", "/home/u")
+
+
+@pytest.mark.parametrize("lin,win", _WIN_EDITS)
+def test_a_windows_edit_is_judged_like_its_linux_twin(lin, win):
+    e = lambda p: {"permission": "edit", "patterns": [p], "metadata": {}}  # noqa: E731
+    assert _stage(e(win), "C:\\Users\\u\\repo", "C:\\Users\\u") == _stage(e(lin), "/home/u/repo", "/home/u")
+
+
+def test_outside_the_project_on_windows_is_never_allowed_by_itself():
+    assert _stage({"permission": "bash", "patterns": ["cat C:/Windows/win.ini"], "metadata": {"command": "cat C:/Windows/win.ini"}},
+                  "C:\\Users\\u\\repo", "C:\\Users\\u") != "fast-allow"
+    assert _stage({"permission": "edit", "patterns": ["..\\..\\x"], "metadata": {}}, "C:\\Users\\u\\repo", "C:\\Users\\u") != "fast-allow"
+
+
+def test_auto_switches_on_for_a_windows_folder_and_talks_to_opencode_with_it_as_given(tmp_path):
+    win = "C:\\Users\\u\\repo"
+
+    async def body(oc, runner, verdicts, make, client):
+        assert runner.set_auto("ses_main", win, True), "C:\\… is a project folder (it was refused: Auto never ran on Windows)"
+        assert runner.set_auto("ses_main", "relative\\dir", True) is False
+        assert runner.set_auto("ses_main", win, True)
+        oc.ask(permission="bash", patterns=["rm -rf ~"], metadata={"command": "rm -rf ~"})
+        assert await until(lambda: oc.replies(), 4)
+        assert oc.replies()[0]["dir"] == win, "OpenCode is asked with the folder exactly as it named it"
+    with_runner(tmp_path, body)
+
+
+# A project on a network share (the owner's second desktop, 2026-10-09: \\192.168.57.47\Projects) — Auto refused it too.
+_UNC = "\\\\192.168.57.47\\Projects\\geo"
+
+
+@pytest.mark.parametrize("req,stage", [
+    ({"permission": "bash", "patterns": ["ls src"], "metadata": {"command": "ls src"}}, "fast-allow"),
+    ({"permission": "bash", "patterns": ["cat C:/Windows/win.ini"], "metadata": {"command": "cat C:/Windows/win.ini"}}, "review"),
+    ({"permission": "edit", "patterns": ["src\\a.py"], "metadata": {}}, "fast-allow"),
+    ({"permission": "edit", "patterns": ["..\\other\\x"], "metadata": {}}, "review"),
+    ({"permission": "edit", "patterns": [_UNC + "\\src\\a.py"], "metadata": {}}, "fast-allow"),
+    ({"permission": "edit", "patterns": ["\\\\192.168.57.47\\Projects\\other\\a.py"], "metadata": {}}, "review"),
+])
+def test_a_project_on_a_network_share_is_judged_like_any_other(req, stage):
+    assert _stage(req, _UNC, "C:\\Users\\u") == stage
+
+
+def test_auto_switches_on_for_a_network_share(tmp_path):
+    async def body(oc, runner, verdicts, make, client):
+        assert runner.set_auto("ses_main", _UNC, True)
+    with_runner(tmp_path, body)

{witbitz_code-1.6.3 → witbitz_code-1.6.6}/tests/test_confidential.py

@@ -353,3 +353,16 @@ def test_progress_goes_only_to_a_channel_a_page_is_watching():
         await asyncio.sleep(0)
     run(main())
     assert len(sent) == 1 and sent[0]["t"] == "progress" and sent[0]["phase"] == "checking" and isinstance(sent[0]["ts"], int)
+
+
+def test_opencode_starts_on_the_catalog_s_confidential_default():
+    """The Python connector named no model, so OpenCode picked one itself (the owner, 2026-10-09: "Make deepseek 4.1 flash the
+    default for code"). It names the catalog's confidential default — the same one the Node connector's config names."""
+    import re
+    from pathlib import Path
+    from witbitz_code import models
+    src = (Path(__file__).resolve().parents[3] / "agent" / "modelCatalog.mjs").read_text(encoding="utf-8")
+    want = re.search(r"DEFAULTS = \{[^}]*confidential: '([^']+)'", src).group(1)
+    entry = next(m for m in models.catalog() if m["model"] == models.DEFAULT_MODEL)
+    assert want in (entry.get("id"), entry["model"].split("/")[-1]), f"catalog default {want!r} vs {models.DEFAULT_MODEL!r}"
+    assert models.default_model_config() == {"model": "trustedrouter/deepseek/deepseek-v4.1-flash"}

{witbitz_code-1.6.3 → witbitz_code-1.6.6}/tests/test_plugins.py

@@ -182,3 +182,13 @@ def test_the_installed_media_server_answers_mcp(tmp_path):
     replies = {m["id"]: m for m in map(json.loads, out.splitlines())}
     assert replies[1]["result"]["serverInfo"]["name"] == "witbitz-media"
     assert "audio" in [t["name"] for t in replies[2]["result"]["tools"]]
+
+
+def test_notes_rules_on_another_drive_keep_the_reads_and_never_raise(monkeypatch):
+    """Windows, a project on a network share and the notes on C: — relpath raises ("path is on mount 'C:', start on mount
+    '\\\\192.168.57.47\\Projects'", the owner's second desktop, 2026-10-09) and the session's setup died with it."""
+    def cross(*_a, **_k):
+        raise ValueError("path is on mount 'C:', start on mount '\\\\192.168.57.47\\Projects'")
+    monkeypatch.setattr(plugins.os.path, "relpath", cross)
+    rules = plugins.notes_rules({"directory": "/p/geo", "path": ""}, "/n")
+    assert [r["permission"] for r in rules] == ["external_directory"], "reads allowed; writes ask (no relative path reaches)"

{witbitz_code-1.6.3 → witbitz_code-1.6.6}/tests/test_windows_files.py

@@ -26,3 +26,21 @@ def test_the_keys_and_payers_files_are_written_where_python_has_no_fchmod(monkey
 def test_no_module_calls_fchmod():
     hits = [f.name for f in SRC.glob("*.py") if "os.fchmod(" in f.read_text(encoding="utf-8")]
     assert hits == [], f"os.fchmod does not exist on Windows Python before 3.13 — use pairings.write_private: {hits}"
+
+
+def test_on_windows_private_folders_inherit_instead_of_an_owner_only_access_list(monkeypatch, tmp_path):
+    """Python 3.12.4+ makes mkdir(mode=0o700) an access list of SYSTEM, Administrators and the OWNER; made from an
+    Administrator window the owner is Administrators and the person's own windows are locked out (the owner's second
+    desktop, 2026-10-09: "[WinError 5] Access is denied: …\\.witbitz\\code\\pairings.json")."""
+    import pathlib
+    from witbitz_code import pairings
+    seen = []
+    real = pathlib.Path.mkdir
+    monkeypatch.setattr(pathlib.Path, "mkdir", lambda self, *a, **k: seen.append(k.get("mode", a[0] if a else None)) or real(self, parents=True, exist_ok=True))
+    monkeypatch.setattr(pairings.sys, "platform", "win32")
+    pairings.write_private(tmp_path / "w" / "pairings.json", "{}")
+    assert seen and all(m is None for m in seen), "no mode on Windows: the folder inherits the profile's access"
+    seen.clear()
+    monkeypatch.setattr(pairings.sys, "platform", "linux")
+    pairings.write_private(tmp_path / "l" / "pairings.json", "{}")
+    assert seen == [0o700], "0700 everywhere else, as before"