witbitz-code 1.8.0__tar.gz → 1.9.0__tar.gz

{witbitz_code-1.8.0/src/witbitz_code.egg-info → witbitz_code-1.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: witbitz-code
-Version: 1.8.0
+Version: 1.9.0
 Summary: Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay.
 Author: Witbitz
 License-Expression: MIT

{witbitz_code-1.8.0 → witbitz_code-1.9.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "witbitz-code"
-version = "1.8.0"
+version = "1.9.0"
 description = "Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay."
 readme = "README.md"
 requires-python = ">=3.10"

{witbitz_code-1.8.0 → witbitz_code-1.9.0}/src/witbitz_code/__init__.py

@@ -4,4 +4,4 @@ The Python implementation of tools/witbitz-code.mjs (docs/opencode-relay.md phas
 vectors and cross-implementation tests.
 """
 
-__version__ = "1.8.0"
+__version__ = "1.9.0"

{witbitz_code-1.8.0 → witbitz_code-1.9.0}/src/witbitz_code/browse.py

@@ -5,11 +5,16 @@ ON by default; `serve --no-browser` or WB_BROWSE_DISABLE=1 turns it off (and rem
 programs are JavaScript (the cloud computer's own: browse-local, the agent's CLI, the publisher), so they run with this
 computer's `node` — as the media tools do; without node the agent works without a browser. Each pairing gets a viewer key
 derived from its secret (relay.browse_key = codeRelay.js deriveBrowseKey), so the app can Watch and Take over.
+
+On Linux with the CLOUD COMPUTER'S browser installed (browsetree.py — the page's card, or `witbitz-browse-tree.mjs install`)
+it is that one instead: the image's own Chromium, KasmVNC, PulseAudio and publisher under bwrap, sealed to the FIRST
+pairing's key (the lab build seals to one). WB_BROWSE_TREE=0 keeps the laptop browser.
 """
 
 from __future__ import annotations
 
 import asyncio
+import json
 import os
 import re
 import shutil
@@ -20,8 +25,8 @@ from typing import Any, Callable
 
 import httpx
 
-from . import plugins
-from .relay import browse_key
+from . import browsetree, plugins
+from .relay import RELAY_URL, browse_key
 
 BROWSE_DIR = "witbitz-browse"
 PLUGIN_REL = "plugins/witbitz-browser.js"
@@ -80,13 +85,16 @@ def _free_port() -> int:
 
 
 class LocalBrowser:
-    def __init__(self, proc: asyncio.subprocess.Process, ctl: int, env: dict, http: httpx.AsyncClient) -> None:
-        self.proc, self.ctl, self.env, self._http = proc, ctl, env, http
+    def __init__(self, proc: asyncio.subprocess.Process, ctl: int, env: dict, http: httpx.AsyncClient, tree: str = "") -> None:
+        self.proc, self.ctl, self.env, self._http, self.tree = proc, ctl, env, http, tree
         self.last: dict | None = None
         self._task: asyncio.Task | None = None
 
     def probe(self) -> dict | None:
-        """The browser's last /status — synchronous: the connector's hello must never wait on it."""
+        """The browser's last /status — synchronous: the connector's hello must never wait on it. The cloud computer's
+        browser answers as in the enclave; `local`/`cast` tell the app to watch it as this computer's, `tree` which image."""
+        if self.last is not None and self.tree:
+            return {**self.last, "local": True, "cast": True, "tree": self.tree}
         return self.last
 
     async def _poll(self) -> None:
@@ -124,6 +132,10 @@ async def start(pairings: list[dict], *, config_dir: Path | None = None, log: Ca
         log("witbitz-code: no node on this computer — the agent works without a browser (install Node.js 22+ to add one)")
         return None
     paths = await asyncio.to_thread(install, config_dir)
+    if browsetree.use_tree():
+        b = await _start_tree(node, paths, pairings, config_dir, log)
+        if b:
+            return b
     watchable = node_major(node) >= 22  # the publisher needs a global WebSocket
     keys = [browse_key(p["secret"]) for p in pairings if p.get("secret")] if watchable else []
     ctl, gate = _free_port(), _free_port()
@@ -143,3 +155,33 @@ async def start(pairings: list[dict], *, config_dir: Path | None = None, log: Ca
     log("witbitz-code: the agent's browser is ready on this computer"
         + (" — watch it from the Code section" if watchable else " (node is older than 22: the app cannot watch it)") + "; off: serve --no-browser")
     return b
+
+
+async def _start_tree(node: str, paths: dict, pairings: list[dict], config_dir: Path | None, log: Callable[[str], Any]) -> LocalBrowser | None:
+    """The cloud computer's browser when it is installed here; None → the laptop browser."""
+    key = next((browse_key(p["secret"]) for p in pairings if p.get("secret")), "")
+    tree = await asyncio.to_thread(browsetree.script, config_dir)
+    st = await asyncio.to_thread(browsetree.read_status, node, tree)
+    if not key or not st.get("supported") or not st.get("installed"):
+        return None
+    proc = await asyncio.create_subprocess_exec(node, str(tree), "run", "--relay", RELAY_URL, "--parent", str(os.getpid()),
+                                                env={**os.environ, "WB_BROWSE_KEY": key}, stdin=asyncio.subprocess.DEVNULL,
+                                                stdout=asyncio.subprocess.PIPE)
+    try:
+        assert proc.stdout
+        ready = json.loads(await asyncio.wait_for(proc.stdout.readline(), 40))
+    except (ValueError, asyncio.TimeoutError, AssertionError):
+        ready = {}
+    if not ready.get("ready"):
+        log(f"witbitz-code: the cloud computer's browser did not start ({ready.get('error') or 'no answer'}) — using the laptop browser")
+        if proc.returncode is None:
+            proc.kill()
+        return None
+    env = {k: str(v) for k, v in ready.items() if k.startswith("WB_BROWSE_")}
+    env["WB_BROWSE_CDP_CLI"] = str(paths["browse-cdp.mjs"])
+    b = LocalBrowser(proc, int(env["WB_BROWSE_CTL"].rsplit(":", 1)[1]), env, httpx.AsyncClient(), tree=str(ready.get("tag") or ""))
+    await b._poll()
+    b._task = asyncio.ensure_future(b._every())
+    if st.get("current") is False:
+        log(f"witbitz-code: this release pins the cloud browser {st['pinned']['tag']} — update it on the witbitz-code page")
+    return b

witbitz_code-1.9.0/src/witbitz_code/browsetree.py

@@ -0,0 +1,117 @@
+"""THE CLOUD COMPUTER'S BROWSER ON THIS LINUX COMPUTER — the page's card and serve's choice (the owner, 2026-10-19: "why isnt
+it part of the pipx install? and why isnt it installed from the witbitz code webpage?").
+
+The program is `witbitz-browse-tree.mjs` (tools/browse-tree/cli.mjs, bundled with this release's pin by tools/browse-embed.mjs)
+run with this computer's node: `status` says what is pinned and installed, `install --json` downloads the pinned image's tree
+(~650 MB, both sha256s checked before anything is unpacked) with progress lines, `run` starts it under bwrap. Nothing is
+downloaded until the person presses Install; a release that pins a newer image shows it as an update.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import os
+import shutil
+import subprocess
+import sys
+import time
+from pathlib import Path
+from typing import Any, Callable
+
+from . import plugins
+
+SCRIPT_REL = "witbitz-browse/browse-tree.mjs"
+PACKAGED = "witbitz-browse-tree.mjs"
+
+
+def script(config_dir: Path | None = None) -> Path:
+    """The program in OpenCode's config folder, beside the other browser files (an identical file is left alone)."""
+    target = (Path(config_dir) if config_dir else plugins.opencode_config_dir()) / SCRIPT_REL
+    text = plugins.packaged(PACKAGED)
+    try:
+        same = target.read_text(encoding="utf-8") == text
+    except (OSError, UnicodeDecodeError):
+        same = False
+    if not same:
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_text(text, encoding="utf-8", newline="")
+    return target
+
+
+def read_status(node: str, path: Path) -> dict:
+    """`status` → {linux, needs, supported, pinned, installed, current, why}; {error} when it could not be asked."""
+    try:
+        r = subprocess.run([node, str(path), "status"], capture_output=True, text=True, timeout=20, check=False)  # noqa: S603
+        return json.loads(r.stdout.strip().splitlines()[-1])
+    except (OSError, ValueError, IndexError, subprocess.SubprocessError) as e:
+        return {"error": f"could not check ({str(e)[:80]})"}
+
+
+class Tree:
+    """The page's card: {shown, state: idle|installing|done|failed, step, pct, error, ...status}. Outside reaches are injected."""
+
+    def __init__(self, *, node: Callable[[], str | None] = lambda: shutil.which("node"),
+                 script_path: Callable[[], Path] = script, read: Callable[[str, Path], dict] = read_status,
+                 platform: str = sys.platform) -> None:
+        self._node, self._script, self._read, self._platform = node, script_path, read, platform
+        self.state, self.step, self.pct, self.error, self.tag = "idle", "", 0.0, "", ""
+        self.task: asyncio.Task | None = None
+        self._cache: tuple[float, dict] | None = None
+
+    def status(self) -> dict:
+        if not self._platform.startswith("linux"):
+            return {"shown": False}
+        live = {"state": self.state, "step": self.step, "pct": self.pct, "error": self.error, "tag": self.tag}
+        if self._cache and time.monotonic() - self._cache[0] < 15 and self.state != "installing":
+            return {**self._cache[1], **live}
+        node = self._node()
+        if not node:
+            st = {"shown": True, "supported": False, "needs": ["Node.js 22.15+"]}
+        else:
+            try:
+                st = {"shown": True, **self._read(node, self._script())}
+            except OSError as e:
+                st = {"shown": True, "error": f"could not check ({str(e)[:80]})"}
+        self._cache = (time.monotonic(), st)
+        return {**st, **live}
+
+    async def install(self) -> dict:
+        if self.task and not self.task.done():
+            return {"ok": True}
+        node = self._node()
+        if not node or not self._platform.startswith("linux"):
+            return {"ok": False, "why": "the cloud computer's browser needs Linux and Node.js"}
+        self.state, self.step, self.pct, self.error = "installing", "download", 0.0, ""
+        self.task = asyncio.ensure_future(self._install(node))
+        return {"ok": True}
+
+    async def _install(self, node: str) -> None:
+        try:
+            proc = await asyncio.create_subprocess_exec(node, str(self._script()), "install", "--json", stdin=asyncio.subprocess.DEVNULL,
+                                                        stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.DEVNULL)
+            assert proc.stdout
+            async for raw in proc.stdout:
+                try:
+                    m: dict[str, Any] = json.loads(raw)
+                except ValueError:
+                    continue
+                if m.get("error"):
+                    self.error = str(m["error"])[:300]
+                elif m.get("ok"):
+                    self.tag = str(m.get("tag") or "")
+                else:
+                    self.step, self.pct = str(m.get("step") or ""), float(m.get("pct") or 0)
+            await proc.wait()
+            if proc.returncode and not self.error:
+                self.error = f"the install stopped ({proc.returncode})"
+        except (OSError, asyncio.CancelledError) as e:
+            self.error = self.error or f"could not run it ({str(e)[:120]})"
+        finally:
+            self._cache = None
+            self.state = "failed" if self.error else "done"
+
+
+def use_tree(env: dict | None = None, platform: str = sys.platform) -> bool:
+    env = os.environ if env is None else env
+    return platform.startswith("linux") and str(env.get("WB_BROWSE_TREE", "")) != "0"

{witbitz_code-1.8.0 → witbitz_code-1.9.0}/src/witbitz_code/opencode_plugins/witbitz-browse-publisher.mjs

@@ -945,6 +945,7 @@ var tellControl = async (path, body) => {
   }
 };
 var said = null;
+var holderVid = null;
 var tellTheViewerWhoHasTheControls = async (why) => {
   let st = null;
   try {
@@ -954,16 +955,17 @@ var tellTheViewerWhoHasTheControls = async (why) => {
   }
   held = !!st.takeover;
   if (!held && cast && cast.incognito && cast.incognito()) closeIncognito("the controls lapsed");
+  if (!held) holderVid = null;
   if (!held && cast && cast.controller()) {
     for (const v of castViewers.values()) v.driving = false;
     cast.setController(null).then(assign).catch(() => {
     });
   }
-  const now = JSON.stringify({ on: !!st.takeover, web: !!st.web });
+  const now = JSON.stringify({ on: !!st.takeover, web: !!st.web, holder: holderVid });
   if (why === "poll" && now === said) return;
   said = now;
   if (relay && relay.readyState === 1) {
-    relay.send(await sealCtl(key, { wb: "takeover", on: !!st.takeover, web: !!st.web, audio: !!PULSE, ack: true, cast: !!CDP, site: siteNow(), incognito: !!(cast && cast.incognito && cast.incognito()) }));
+    relay.send(await sealCtl(key, { wb: "takeover", on: !!st.takeover, web: !!st.web, ...st.takeover && holderVid ? { holder: holderVid } : {}, audio: !!PULSE, ack: true, cast: !!CDP, site: siteNow(), incognito: !!(cast && cast.incognito && cast.incognito()) }));
   }
   log(
     why === "poll" ? "the state changed \u2014" : "a viewer arrived \u2014",
@@ -1327,12 +1329,13 @@ function connectRelay() {
           if (!c.on) await closeIncognito("the controls were given back");
           await tellControl("/takeover", { on: !!c.on });
           held = !!c.on;
+          holderVid = c.on && typeof c.vid === "string" ? c.vid.slice(0, 64) : null;
           log("take-over", c.on ? "ON \u2014 the agent's CDP session is being closed" : "released");
           if (cast) await cast.setController(c.on ? norm(c.view) || largestView() : null).catch(() => {
           });
           for (const [vid, v] of castViewers) v.driving = !!c.on && vid === c.vid;
           if (cast) assign();
-          if (relay && relay.readyState === 1) relay.send(await sealCtl(key, { wb: "takeover", on: !!c.on, audio: !!PULSE, ack: true, cast: !!cast, site: siteNow(), incognito: !!(cast && cast.incognito && cast.incognito()), close: true }));
+          if (relay && relay.readyState === 1) relay.send(await sealCtl(key, { wb: "takeover", on: !!c.on, ...holderVid ? { holder: holderVid } : {}, audio: !!PULSE, ack: true, cast: !!cast, site: siteNow(), incognito: !!(cast && cast.incognito && cast.incognito()), close: true }));
         } else if (c.wb === "incognito" && cast) {
           if (c.on && !held) {
             log("incognito: refused \u2014 nobody holds the controls");
@@ -1357,12 +1360,13 @@ function connectRelay() {
           if (relay && relay.readyState === 1) relay.send(await sealCtl(key, { wb: "site", mode }));
         } else if (c.wb === "hello" && c.cast && typeof c.vid === "string" && CDP) {
           const known = castViewers.has(c.vid);
-          castViewers.set(c.vid.slice(0, 64), { view: norm(c.view), at: Date.now(), driving: !!(held && c.driving) });
+          const mine = held && c.driving && (!holderVid || c.vid.slice(0, 64) === holderVid);
+          castViewers.set(c.vid.slice(0, 64), { view: norm(c.view), at: Date.now(), driving: !!mine });
           if (castViewers.size > 8) castViewers.delete(castViewers.keys().next().value);
           if (!known) log("cast: a viewer said hello \u2014", JSON.stringify(norm(c.view)));
           if (relay && relay.readyState === 1) relay.send(await sealCtl(key, { wb: "cast", on: true, close: true }));
           await startCast();
-          if (held && cast && c.driving) await cast.setController(norm(c.view)).catch(() => {
+          if (mine && cast) await cast.setController(norm(c.view)).catch(() => {
           });
           assign();
         } else if (c.wb === "in" && cast) {

witbitz_code-1.9.0/src/witbitz_code/opencode_plugins/witbitz-browse-tree.mjs

@@ -0,0 +1,303 @@
+#!/usr/bin/env node
+// GENERATED by tools/browse-embed.mjs from tools/browse-tree/cli.mjs and its pin — do not edit.
+
+// tools/browse-tree/pin.json
+var pin_default = {
+  _: "THE CLOUD COMPUTER'S BROWSER FOR LINUX that this release installs (tools/browse-tree; make.sh writes it). The files are public at <base><tag>/; both sha256s are checked before anything is unpacked.",
+  tag: "p2v",
+  base: "https://drwev5vxt2t2e.cloudfront.net/browse-tree/",
+  pcr0: "87162d8648af94daec37f9d022c43546f6dc5c9018b7225ee5ccaf3cecd1c7924c7681f0ca48fddb84f5d0a2f987f719",
+  commit: "e303d54e2295c148c5177b2216eca21de6b6f3a3",
+  tree: {
+    file: "tree.tar.zst",
+    sha256: "1fceee1d2ddbda8a6ec9f792755a960a877af6342645b8a29fbbf94b28b9536e",
+    size: 664712218
+  },
+  lab: {
+    file: "ccvm-lab.bin",
+    sha256: "2d15b2e7c93b9626eccf8fa0d728c6e4385aadbbeba538ab45f7123937aed38b",
+    size: 11908726
+  }
+};
+
+// tools/browse-tree/run.mjs
+import { spawn, spawnSync } from "node:child_process";
+import { existsSync, readFileSync, readlinkSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+var TREE_HOME = () => process.env.WB_BROWSE_TREE_HOME || join(homedir(), ".witbitz", "browse-tree");
+var CTL_PORT = 9224;
+var GATE_PORT = 9223;
+function findTree({ home = TREE_HOME(), platform = process.platform } = {}) {
+  if (platform !== "linux") return { why: "the cloud computer's browser runs on Linux only" };
+  const cur = join(home, "current");
+  if (!existsSync(cur)) return { why: "no cloud browser tree installed (witbitz-code browser install, or node tools/browse-tree/cli.mjs install)" };
+  let dir;
+  try {
+    dir = join(home, readlinkSync(cur));
+  } catch {
+    dir = cur;
+  }
+  const m = (() => {
+    try {
+      return JSON.parse(readFileSync(join(dir, "manifest.json"), "utf8"));
+    } catch {
+      return null;
+    }
+  })();
+  if (!m || !existsSync(join(dir, "tree", "usr", "bin", "chromium")) || !existsSync(join(dir, "ccvm-lab"))) return { why: `the tree in ${dir} is incomplete \u2014 install it again` };
+  if (spawnSync("bwrap", ["--version"], { stdio: "ignore" }).status !== 0) return { why: "bwrap is not installed (apt install bubblewrap)" };
+  return { dir, tree: join(dir, "tree"), lab: join(dir, "ccvm-lab"), manifest: m };
+}
+function bwrapArgs({ tree, lab, key, relay }) {
+  const env = {
+    PATH: "/usr/local/bin:/usr/bin:/bin",
+    HOME: "/tmp",
+    // the image's own paths (browse_paths.go) — the lab build reads them from here instead of compiling them in
+    WB_LAB_ROOT: "/",
+    WB_LAB_XKASM: "/usr/bin/Xkasmvnc",
+    WB_LAB_CHROMIUM: "/usr/bin/chromium",
+    WB_LAB_NODE: "/usr/local/bin/node",
+    WB_LAB_PUBLISHER: "/opt/witbitz/browse-publisher.mjs",
+    WB_LAB_KASM_WWW: "/usr/share/kasmvnc/www",
+    WB_LAB_PULSE: "/usr/bin/pulseaudio",
+    WB_LAB_PAREC: "/usr/bin/parec",
+    WB_LAB_RRWEB: "/opt/witbitz/rrweb.umd.min.cjs",
+    WB_LAB_LOGS: "/tmp",
+    WB_LAB_SCRATCH: "/tmp/wb",
+    WB_LAB_KEY: key,
+    WB_LAB_RELAY: relay
+  };
+  return [
+    "--ro-bind",
+    tree,
+    "/",
+    "--dev",
+    "/dev",
+    "--proc",
+    "/proc",
+    "--tmpfs",
+    "/tmp",
+    "--tmpfs",
+    "/run",
+    "--ro-bind",
+    "/etc/resolv.conf",
+    "/run/resolvconf/resolv.conf",
+    // the image's /etc/resolv.conf is a link to here
+    "--ro-bind",
+    lab,
+    "/tmp/ccvm-lab",
+    "--unshare-pid",
+    "--die-with-parent",
+    "--clearenv",
+    ...Object.entries(env).flatMap(([k, v]) => ["--setenv", k, String(v)]),
+    "/tmp/ccvm-lab",
+    "browselab"
+  ];
+}
+async function startTreeBrowser({ found, key, relay, log = console.error, fetchImpl = fetch, cdpCli = "", node = process.execPath } = {}) {
+  const child = spawn("bwrap", bwrapArgs({ tree: found.tree, lab: found.lab, key, relay }), { stdio: ["ignore", "ignore", "pipe"], detached: false });
+  let tail = "";
+  child.stderr.on("data", (d) => {
+    tail = (tail + d).slice(-2e3);
+  });
+  child.on("exit", (code) => log(`witbitz-code: the cloud browser stopped (${code})${tail ? " \u2014 " + tail.trim().split("\n").pop() : ""}`));
+  let last = null;
+  const poll = async () => {
+    try {
+      last = await (await fetchImpl(`http://127.0.0.1:${CTL_PORT}/status`, { signal: AbortSignal.timeout(1500) })).json();
+    } catch {
+      last = null;
+    }
+  };
+  for (let i = 0; i < 20 && !last; i++) {
+    await new Promise((r) => setTimeout(r, 250));
+    await poll();
+  }
+  const timer = setInterval(poll, 2e3);
+  timer.unref();
+  const m = found.manifest || {};
+  log(`witbitz-code: the agent's browser is the CLOUD COMPUTER's (${m.tag || "?"}, PCR0 ${String(m.pcr0 || "").slice(0, 16)}\u2026) \u2014 its own Chromium, KasmVNC, PulseAudio and publisher, run here with no enclave, one user and this computer's network; watch it from the Code section`);
+  return {
+    tag: m.tag || "",
+    env: { WB_BROWSE_NODE: node, ...cdpCli ? { WB_BROWSE_CDP_CLI: cdpCli } : {}, WB_BROWSE_CTL: `http://127.0.0.1:${CTL_PORT}`, WB_BROWSE_CDP: `http://127.0.0.1:${GATE_PORT}` },
+    // `local`: the app watches a computer's browser through a key it derives from the pairing (opencodeApp.browseCloudOf), as
+    // for the laptop browser; `cast`: the publisher screencasts, as there; `tree`: which image this is, for whoever debugs it
+    probe: () => last ? { ...last, local: true, cast: true, tree: m.tag || "" } : null,
+    stop: () => {
+      clearInterval(timer);
+      try {
+        child.kill();
+      } catch {
+      }
+    }
+  };
+}
+
+// tools/browse-tree/install.mjs
+import { spawn as spawn2, spawnSync as spawnSync2 } from "node:child_process";
+import { createHash } from "node:crypto";
+import { chmodSync, copyFileSync, createReadStream, createWriteStream, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
+import { join as join2 } from "node:path";
+import { Readable, Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import zlib from "node:zlib";
+var sha256File = (file) => new Promise((resolve, reject) => {
+  const h = createHash("sha256");
+  createReadStream(file).on("data", (d) => h.update(d)).on("end", () => resolve(h.digest("hex"))).on("error", reject);
+});
+async function download(url, dest, onBytes, fetchImpl) {
+  const r = await fetchImpl(url);
+  if (!r.ok || !r.body) throw new Error(`${url} answered ${r.status}`);
+  const h = createHash("sha256");
+  const tap = new Transform({ transform(chunk, _e, cb) {
+    h.update(chunk);
+    onBytes(chunk.length);
+    cb(null, chunk);
+  } });
+  await pipeline(Readable.fromWeb(r.body), tap, createWriteStream(dest));
+  return h.digest("hex");
+}
+async function unpack(file, dir) {
+  const tar = spawn2("tar", ["-x", "--no-same-owner", "-C", dir], { stdio: ["pipe", "ignore", "pipe"] });
+  let err = "";
+  tar.stderr.on("data", (d) => {
+    err = (err + d).slice(-500);
+  });
+  const done = new Promise((resolve, reject) => tar.on("close", (c) => c === 0 ? resolve() : reject(new Error("tar: " + (err.trim() || "exit " + c)))));
+  if (typeof zlib.createZstdDecompress === "function") await pipeline(createReadStream(file), zlib.createZstdDecompress(), tar.stdin);
+  else {
+    const z = spawn2("zstd", ["-dc", file], { stdio: ["ignore", "pipe", "inherit"] });
+    z.on("error", () => tar.kill());
+    await pipeline(z.stdout, tar.stdin);
+  }
+  await done;
+}
+async function installTree({ pin, from = "", home = TREE_HOME(), onProgress = () => {
+}, fetchImpl = fetch } = {}) {
+  if (process.platform !== "linux") throw new Error("the cloud computer's browser runs on Linux only");
+  if (spawnSync2("tar", ["--version"], { stdio: "ignore" }).status !== 0) throw new Error("tar is not installed");
+  if (typeof zlib.createZstdDecompress !== "function" && spawnSync2("zstd", ["--version"], { stdio: "ignore" }).status !== 0) throw new Error("this Node has no zstd and the zstd program is not installed \u2014 update Node to 22.15+, or install zstd");
+  const want = from ? JSON.parse(readFileSync2(join2(from, "manifest.json"), "utf8")) : pin;
+  if (!want || !/^p\d\w*$/.test(String(want.tag || "")) || !want.tree || !want.lab) throw new Error("no browser is pinned in this release");
+  mkdirSync(home, { recursive: true });
+  const stage = join2(home, ".incoming");
+  rmSync(stage, { recursive: true, force: true });
+  mkdirSync(stage, { recursive: true });
+  try {
+    const parts = [["tree", "tree.tar.zst"], ["lab", "ccvm-lab"]].map(([k, f]) => [k, f, want[k] && want[k].file || f]);
+    const total = parts.reduce((n, [k, , src]) => n + Number(want[k] && want[k].size || (from ? statSync(join2(from, src)).size : 0)), 0);
+    let done = 0;
+    for (const [k, f, src] of parts) {
+      let got;
+      if (from) {
+        copyFileSync(join2(from, src), join2(stage, f));
+        got = await sha256File(join2(stage, f));
+        done += statSync(join2(stage, f)).size;
+        onProgress({ step: "download", done, total });
+      } else got = await download(`${want.base}${want.tag}/${src}`, join2(stage, f), (n) => {
+        done += n;
+        onProgress({ step: "download", done, total });
+      }, fetchImpl);
+      onProgress({ step: "check", done, total });
+      if (got !== want[k].sha256) throw new Error(`${f} does not match what this release pins (${got.slice(0, 12)}\u2026 \u2260 ${String(want[k].sha256).slice(0, 12)}\u2026) \u2014 nothing was installed`);
+    }
+    const dir = join2(home, want.tag), next = dir + ".new";
+    rmSync(next, { recursive: true, force: true });
+    mkdirSync(join2(next, "tree"), { recursive: true });
+    onProgress({ step: "unpack", done, total });
+    await unpack(join2(stage, "tree.tar.zst"), join2(next, "tree"));
+    if (!existsSync2(join2(next, "tree", "usr", "bin", "chromium"))) throw new Error("the unpacked tree has no Chromium");
+    copyFileSync(join2(stage, "ccvm-lab"), join2(next, "ccvm-lab"));
+    chmodSync(join2(next, "ccvm-lab"), 493);
+    const { _: _note, base: _base, ...record } = want;
+    writeFileSync(join2(next, "manifest.json"), JSON.stringify(record, null, 1) + "\n");
+    rmSync(dir, { recursive: true, force: true });
+    renameSync(next, dir);
+    const cur = join2(home, "current");
+    try {
+      unlinkSync(cur);
+    } catch {
+    }
+    symlinkSync(want.tag, cur);
+    onProgress({ step: "done", done: total, total });
+    return { tag: want.tag, dir };
+  } finally {
+    rmSync(stage, { recursive: true, force: true });
+  }
+}
+var has = (cmd2) => spawnSync2(cmd2, ["--version"], { stdio: "ignore" }).status === 0;
+function treeStatus(pin) {
+  const linux = process.platform === "linux";
+  const needs = !linux ? ["Linux"] : [
+    ...has("bwrap") ? [] : ["bwrap (apt install bubblewrap)"],
+    ...has("tar") ? [] : ["tar"],
+    ...typeof zlib.createZstdDecompress === "function" || has("zstd") ? [] : ["Node 22.15+ or the zstd program"]
+  ];
+  const found = linux ? findTree() : { why: "Linux only" };
+  const installed = found.manifest ? { tag: found.manifest.tag, pcr0: found.manifest.pcr0 } : null;
+  return {
+    linux,
+    needs,
+    supported: linux && !needs.length,
+    pinned: { tag: pin.tag, pcr0: pin.pcr0, bytes: Number(pin.tree.size || 0) + Number(pin.lab.size || 0) },
+    installed,
+    current: !!(installed && installed.tag === pin.tag),
+    why: found.why || ""
+  };
+}
+
+// tools/browse-tree/cli.mjs
+var arg = (name) => {
+  const a = process.argv, i = a.indexOf(name);
+  return i >= 0 ? a[i + 1] : "";
+};
+var say = (o) => process.stdout.write(JSON.stringify(o) + "\n");
+var cmd = process.argv[2];
+if (cmd === "status") say(treeStatus(pin_default));
+else if (cmd === "install") {
+  const json = process.argv.includes("--json");
+  let last = -1;
+  try {
+    const r = await installTree({ pin: pin_default, from: arg("--from"), onProgress: (p) => {
+      const pct = p.total ? Math.floor(p.done * 1e3 / p.total) / 10 : 0;
+      if (pct === last && p.step === "download") return;
+      last = pct;
+      if (json) say({ ...p, pct });
+      else process.stderr.write(`\r${p.step} ${pct}%   `);
+    } });
+    if (json) say({ ok: true, tag: r.tag });
+    else console.error(`
+\u2713 ${r.tag}'s browser is installed \u2014 witbitz-code serve uses it`);
+  } catch (e) {
+    const m = String(e && e.message || e);
+    if (json) say({ error: m });
+    else console.error("\n\u2717 " + m);
+    process.exit(1);
+  }
+} else if (cmd === "run") {
+  const found = findTree();
+  if (!found.dir) {
+    say({ error: found.why });
+    process.exit(1);
+  }
+  const b = await startTreeBrowser({ found, key: arg("--key") || process.env.WB_BROWSE_KEY || "", relay: arg("--relay"), log: (m) => console.error(m) });
+  say({ ready: true, tag: b.tag, ...b.env });
+  const parent = Number(arg("--parent")) || 0;
+  const bye = () => {
+    b.stop();
+    process.exit(0);
+  };
+  process.on("SIGTERM", bye);
+  process.on("SIGINT", bye);
+  if (parent) setInterval(() => {
+    try {
+      process.kill(parent, 0);
+    } catch {
+      bye();
+    }
+  }, 2e3);
+} else if (cmd) {
+  console.error("usage: status | install [--json] | run --key <k> --relay <url> [--parent <pid>]");
+  process.exit(2);
+}

{witbitz_code-1.8.0 → witbitz_code-1.9.0}/src/witbitz_code/ui.py

@@ -35,7 +35,7 @@ from importlib import resources
 from pathlib import Path
 from typing import Any, Awaitable, Callable
 
-from . import __version__, devicelink, link, net, ports, qr, seccheck, selfupdate, uitools, uninstall, winbg, wizard, wslstart
+from . import __version__, browsetree, devicelink, link, net, ports, qr, seccheck, selfupdate, uitools, uninstall, winbg, wizard, wslstart
 from . import pair as pair_cmd
 from . import pairings as pp
 
@@ -127,11 +127,12 @@ class Manager:
                  login_enable: Callable[[dict], tuple] = wslstart.startup_enable,
                  login_disable: Callable[[dict], bool] = wslstart.startup_disable,
                  port_owners: Callable[[int], list] | None = None, stop_pid: Callable[[int], bool] | None = None,
-                 tools: uitools.Tools | None = None, label: dict | None = None, log: deque | None = None,
+                 tools: uitools.Tools | None = None, tree: browsetree.Tree | None = None, label: dict | None = None, log: deque | None = None,
                  security: seccheck.SecurityCheck | None = None, updates: selfupdate.Updates | None = None) -> None:
         self._serve, self._is_listening, self._pair, self._link = serve, is_listening, pair, link_node
         self._load, self._keys_line = load_pairings, keys_line
         self.tools = tools or uitools.Tools()
+        self.tree = tree or browsetree.Tree()
         self.security = security or seccheck.SecurityCheck()
         self.updates = updates or selfupdate.Updates(fetch_text=_fetch_text)
         self._owners = port_owners or ports.port_owners
@@ -219,7 +220,8 @@ class Manager:
         asyncio.ensure_future(self.updates.check(fresh=fresh))
         return {"version": __version__, "update": self.updates.status(), "computer": self.label, "paired": paired, "serving": serving, "pair": pair,
                 "login": self.login(), "busy": self.busy, "background": self.background,
-                "tools": await asyncio.to_thread(self.tools.status), "security": self.security.peek(), "log": list(self.log)[-14:]}
+                "tools": await asyncio.to_thread(self.tools.status),
+                "tree": await asyncio.to_thread(self.tree.status), "security": self.security.peek(), "log": list(self.log)[-14:]}
 
     async def elsewhere(self, fresh: bool = False) -> dict | None:
         """{port, owners} when THIS person's other process holds OpenCode's port or the model proxy's (port + 100) while this
@@ -549,6 +551,7 @@ class Server:
             "/api/quit": self.m.quit,
             "/api/update": self.m.update,
             "/api/tools/install": self.m.tools.install,
+            "/api/tree/install": self.m.tree.install,
             "/api/security/fix": lambda: self.m.security.fix(str(data.get("id") or "")),
         }
         act = actions.get(path)

{witbitz_code-1.8.0 → witbitz_code-1.9.0}/src/witbitz_code/ui_static/app.css

@@ -59,3 +59,4 @@ p.small, div.small { font-size: 12.5px; }
 .sec-list li.todo .sec-head span { font-weight: 600; }
 .sec-list li.ok { opacity: .7; }
 .sec-head { display: flex; align-items: center; justify-content: space-between; gap: 8px; }
+progress { width: 100%; height: 8px; margin-top: 10px; accent-color: var(--accent); }