witbitz-code 1.9.1__tar.gz → 1.9.3__tar.gz

{witbitz_code-1.9.1/src/witbitz_code.egg-info → witbitz_code-1.9.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: witbitz-code
-Version: 1.9.1
+Version: 1.9.3
 Summary: Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay.
 Author: Witbitz
 License-Expression: MIT
@@ -67,8 +67,8 @@ opened (a one-time key traded for a private cookie; no other website can drive i
 **No key to paste.** Pairing asks your Spaces account for this computer's own TrustedRouter and Tinfoil keys, capped by the
 providers (today up to $50 of models and $5 of tools a month per computer). They are sent sealed to this computer, kept in
 `~/.witbitz/code/account-keys.json` (0600) and never given to OpenCode: the local proxy puts them on each call. Model calls
-still go from this computer straight to TrustedRouter and Tinfoil. Coding is by invitation for now — an account that is not
-invited gets no keys, and the pairing stops with a sentence saying so. A computer paired before 1.3 has no account keys:
+still go from this computer straight to TrustedRouter and Tinfoil. An account that is not invited gets the free allowance —
+one computer, $1 of models and $0.25 of tools a month; when it is used up, Code says so and when it comes back. A computer paired before 1.3 has no account keys:
 pair it once more (`witbitz-code pair`).
 
 **Several accounts on one computer:** each pays for its own prompts. OpenCode names the conversation on every call it

{witbitz_code-1.9.1 → witbitz_code-1.9.3}/README.md

@@ -40,8 +40,8 @@ opened (a one-time key traded for a private cookie; no other website can drive i
 **No key to paste.** Pairing asks your Spaces account for this computer's own TrustedRouter and Tinfoil keys, capped by the
 providers (today up to $50 of models and $5 of tools a month per computer). They are sent sealed to this computer, kept in
 `~/.witbitz/code/account-keys.json` (0600) and never given to OpenCode: the local proxy puts them on each call. Model calls
-still go from this computer straight to TrustedRouter and Tinfoil. Coding is by invitation for now — an account that is not
-invited gets no keys, and the pairing stops with a sentence saying so. A computer paired before 1.3 has no account keys:
+still go from this computer straight to TrustedRouter and Tinfoil. An account that is not invited gets the free allowance —
+one computer, $1 of models and $0.25 of tools a month; when it is used up, Code says so and when it comes back. A computer paired before 1.3 has no account keys:
 pair it once more (`witbitz-code pair`).
 
 **Several accounts on one computer:** each pays for its own prompts. OpenCode names the conversation on every call it

{witbitz_code-1.9.1 → witbitz_code-1.9.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "witbitz-code"
-version = "1.9.1"
+version = "1.9.3"
 description = "Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay."
 readme = "README.md"
 requires-python = ">=3.10"

{witbitz_code-1.9.1 → witbitz_code-1.9.3}/src/witbitz_code/__init__.py

@@ -4,4 +4,4 @@ The Python implementation of tools/witbitz-code.mjs (docs/opencode-relay.md phas
 vectors and cross-implementation tests.
 """
 
-__version__ = "1.9.1"
+__version__ = "1.9.3"

{witbitz_code-1.9.1 → witbitz_code-1.9.3}/src/witbitz_code/confidential.py

@@ -45,6 +45,22 @@ _SUBJECT = re.compile(r'"(filePath|path|command|pattern|url)"\s*:\s*"((?:[^"\\]|
 _DATA_URL = re.compile(r"^data:([^;,]+)?(?:;[^,]*)?;base64,(.*)$", re.S)
 
 
+# THE MONTH'S ALLOWANCE IS USED (the owner, 2026-10-20: the free Code allowance — "treat it like any other end of budget"). At a
+# key's monthly cap TrustedRouter answers 429 "API key monthly spend limit exceeded; resets at 2026-11-01T00:00:00Z" (measured
+# 2026-10-20). Passed on as a 429, OpenCode reads "rate limited" and RETRIES — the turn hangs. So it becomes a 402 with a
+# sentence a person can act on. tools/code-confidential.mjs allowanceUsed says the same words.
+PLAN_URL = "https://getspaces.witbitz.chat/account"
+_MONTHS = ("January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December")
+
+
+def allowance_used(status: int, text: str) -> "Refusal | None":
+    if status != 429 or not re.search(r"monthly spend limit exceeded", text or "", re.I):
+        return None
+    m = re.search(r"resets at (\d{4})-(\d{2})-(\d{2})", text or "")
+    day = f"{int(m.group(3))} {_MONTHS[int(m.group(2)) - 1]}" if m and 1 <= int(m.group(2)) <= 12 else "the 1st of next month"
+    return Refusal(402, f"This computer's Code allowance for the month is used up — it comes back on {day}. Your plan and use: {PLAN_URL}", "allowance_used")
+
+
 class Refusal(Exception):
     def __init__(self, status: int, message: str, kind: str = "confidential_refused") -> None:
         super().__init__(message)
@@ -117,9 +133,14 @@ async def convert_unreadable(body: dict, label: str, to_text: Callable | None) -
     return {**body, "messages": messages}
 
 
+# Only the providers whose enclaves we verify (2026-10-20, ⇄ agent/providers/trustedrouter.mjs CONFIDENTIAL_PROVIDERS):
+# TrustedRouter's min_privacy=confidential alone began answering some models from an ordinary server (receipt `tls-webpki`).
+CONFIDENTIAL_PROVIDERS = ("tinfoil",)
+
+
 def stamp_floor(req: dict) -> dict:
     """The confidential floor, as a confidential room stamps it. Key ORDER matters — the receipt signs these exact bytes."""
-    return {**req, "stream": True, "stream_options": {"include_usage": True}, "provider": {**(req.get("provider") or {}), "min_privacy": "confidential"}}
+    return {**req, "stream": True, "stream_options": {"include_usage": True}, "provider": {**(req.get("provider") or {}), "min_privacy": "confidential", "only": list(CONFIDENTIAL_PROVIDERS)}}
 
 
 # ── the answer ───────────────────────────────────────────────────────────────────────────────────────────────────────
@@ -240,6 +261,28 @@ def without_words(frame: str) -> str:
     return f"data: {dumps({**ev, 'choices': [{**ch, 'delta': rest}, *ev['choices'][1:]]})}\n\n"
 
 
+# The confidential default (⇄ tools/code-confidential.mjs CONFIDENTIAL_DEFAULT): what answers when a pick has no verified-enclave
+# route right now. The note says so once per session — a Code task makes many calls.
+CONFIDENTIAL_DEFAULT = "deepseek/deepseek-v4.1-flash"
+_NOTED: dict = {}
+
+
+def fallback_note(frm: str, by: str, session_id: str = "") -> str:
+    if not frm:
+        return ""
+    k = session_id + "\0" + frm
+    if k in _NOTED:
+        return ""
+    _NOTED[k] = True
+    if len(_NOTED) > 500:
+        _NOTED.pop(next(iter(_NOTED)))
+    return f"\n\n_Answered by {by} — {frm} isn't available confidentially right now._"
+
+
+def note_frame(note: str, model: str) -> str:
+    return "data: " + dumps({"id": "witbitz-note", "object": "chat.completion.chunk", "model": model, "choices": [{"index": 0, "delta": {"content": note}}]}) + "\n\n"
+
+
 def completion_of(events: list, model: str) -> dict:
     """The streamed events as one chat.completion — for a caller that asked without `stream`."""
     content = reasoning = ""
@@ -596,6 +639,15 @@ class ConfidentialProxy:
             async with self.client.stream(req.method, target, headers=_forward_headers(req.headers), content=None if req.method in ("GET", "HEAD") else out) as up:
                 headers = {k: v for k, v in up.headers.items() if k.lower() not in ("content-encoding", "content-length", "transfer-encoding", "connection")}
                 self._key_refused(up.status_code)
+                if up.status_code == 429:  # the month's allowance, said plainly — never a "rate limit" OpenCode would retry
+                    text = (await up.aread()).decode("utf-8", "replace")
+                    used = allowance_used(up.status_code, text)
+                    if used:
+                        await self._fail(res, used, False)
+                        return
+                    await res.head(up.status_code, headers)
+                    await res.end(text)
+                    return
                 await res.head(up.status_code, headers)
                 async for c in up.aiter_bytes():
                     await res.write(c)
@@ -622,7 +674,10 @@ class ConfidentialProxy:
             except Exception:  # noqa: BLE001 — progress must never fail a call
                 pass
 
+        fell = {"from": ""}  # the pick's label when TrustedRouter had no verified-enclave route for it and the default answered
+
         async def once(words_shown: bool = False) -> None:
+            nonlocal body, conf, label
             ends = self._proof_ends.get(body["model"])
             hold = attempt["n"] > 1 or (ends is not None and self._now() / 1000 >= ends - HOLD_BEFORE_LAPSE_SEC)
             n = self._nonce()
@@ -637,6 +692,19 @@ class ConfidentialProxy:
                 if not up.is_success:
                     self._key_refused(up.status_code)
                     text = (await up.aread()).decode("utf-8", "replace")
+                    used = allowance_used(up.status_code, text)
+                    if used:
+                        raise used
+                    # No verified-enclave route for the pick (2026-10-20, ⇄ tools/code-confidential.mjs): refused BEFORE any upstream
+                    # saw the request — the same request goes again as the confidential default, attested and checked, once.
+                    if (up.status_code == 400 and "no route candidates" in text.lower() and not fell["from"] and body.get("model") != CONFIDENTIAL_DEFAULT
+                            and CONFIDENTIAL_DEFAULT in self.models and not res.headers_sent):
+                        fell["from"] = conf["label"]
+                        self.log(f"code-confidential: {body['model']} has no verified-enclave route now → {CONFIDENTIAL_DEFAULT} answers")
+                        body = {**body, "model": CONFIDENTIAL_DEFAULT}
+                        conf = self.models[CONFIDENTIAL_DEFAULT]
+                        label = f"{conf['label']} (confidential)"
+                        return await once(words_shown)
                     if res.headers_sent:
                         raise Refusal(502, f"{label}: TrustedRouter answered {up.status_code} when asked again ({text[:160]})", "upstream_error")
                     await res.head(up.status_code, {"content-type": up.headers.get("content-type", "application/json")})
@@ -677,15 +745,25 @@ class ConfidentialProxy:
             exp = ((v.get("claims") or {}).get("upstream") or {}).get("verification_expires_at")
             if isinstance(exp, (int, float)):
                 self._proof_ends[body["model"]] = exp
+            note = fallback_note(fell["from"], conf["label"], session_id)
             if wants_stream:
+                noted = not note
                 for f in answer.held():
+                    if not noted and re.search(r'"finish_reason":"|^data: \[DONE\]', f, re.M):
+                        await res.write(note_frame(note, body["model"]))  # the note goes in before the answer ends
+                        noted = True
                     out = without_words(f) if words_shown else f
                     if out:
                         await res.write(out)
+                if not noted:
+                    await res.write(note_frame(note, body["model"]))
                 await res.end()
                 return
             await res.head(200, {"content-type": "application/json"})
-            await res.end(dumps(completion_of(answer.events(), body["model"])))
+            done = completion_of(answer.events(), body["model"])
+            if note and done.get("choices") and done["choices"][0].get("message") is not None:
+                done["choices"][0]["message"]["content"] = (done["choices"][0]["message"].get("content") or "") + note
+            await res.end(dumps(done))
 
         try:
             if not conf.get("vision"):

{witbitz_code-1.9.1 → witbitz_code-1.9.3}/src/witbitz_code/confidential_models.json

@@ -11,17 +11,6 @@
     ],
     "maxTokens": 24000
   },
-  {
-    "model": "z-ai/glm-5.3-flash",
-    "label": "GLM 5.3 Flash",
-    "vision": true,
-    "efforts": [
-      "low",
-      "high",
-      "max"
-    ],
-    "maxTokens": 16000
-  },
   {
     "model": "z-ai/glm-5.3",
     "label": "GLM 5.3",

{witbitz_code-1.9.1 → witbitz_code-1.9.3/src/witbitz_code.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: witbitz-code
-Version: 1.9.1
+Version: 1.9.3
 Summary: Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay.
 Author: Witbitz
 License-Expression: MIT
@@ -67,8 +67,8 @@ opened (a one-time key traded for a private cookie; no other website can drive i
 **No key to paste.** Pairing asks your Spaces account for this computer's own TrustedRouter and Tinfoil keys, capped by the
 providers (today up to $50 of models and $5 of tools a month per computer). They are sent sealed to this computer, kept in
 `~/.witbitz/code/account-keys.json` (0600) and never given to OpenCode: the local proxy puts them on each call. Model calls
-still go from this computer straight to TrustedRouter and Tinfoil. Coding is by invitation for now — an account that is not
-invited gets no keys, and the pairing stops with a sentence saying so. A computer paired before 1.3 has no account keys:
+still go from this computer straight to TrustedRouter and Tinfoil. An account that is not invited gets the free allowance —
+one computer, $1 of models and $0.25 of tools a month; when it is used up, Code says so and when it comes back. A computer paired before 1.3 has no account keys:
 pair it once more (`witbitz-code pair`).
 
 **Several accounts on one computer:** each pays for its own prompts. OpenCode names the conversation on every call it

{witbitz_code-1.9.1 → witbitz_code-1.9.3}/tests/test_confidential.py

@@ -61,7 +61,8 @@ def test_any_change_to_what_was_sent_or_received_is_refused():
     assert v(request_body=request + b" ")["error"] == "receipt_req_hash"
     assert v(nonce="someone-elses-nonce")["error"] == "receipt_nonce_mismatch"
     tampered = capture_of(stream)
-    tampered.datas[1] = tampered.datas[1].replace(b'"OK"', b'"NO"')
+    at = next(i for i, d in enumerate(tampered.datas) if b'"OK"' in d)  # wherever the captured answer says OK
+    tampered.datas[at] = tampered.datas[at].replace(b'"OK"', b'"NO"')
     assert v(capture=tampered)["error"] == "receipt_resp_hash"
     dropped = capture_of(stream)
     dropped.datas.pop()
@@ -91,14 +92,14 @@ from conftest import requires_node, run_node  # noqa: E402
 
 from witbitz_code import confidential as cf, models as mdl  # noqa: E402
 
-SAY_OK = {"model": "deepseek/deepseek-v4-flash", "messages": [{"role": "user", "content": "Say OK."}], "max_tokens": 5, "stream": True}
+SAY_OK = {"model": "deepseek/deepseek-v4.1-flash", "messages": [{"role": "user", "content": "Say OK."}], "max_tokens": 200, "stream": True}
 PNG = "data:image/png;base64,bm90IHJlYWxseSBhIHBuZw=="
 
 
 def replay_models():
-    # The captured exchange is deepseek-v4-flash's (retired from the confidential tier since), and its receipt signs those
+    # The captured exchange is deepseek-v4.1-flash's (recaptured 2026-10-20 with the Tinfoil-only floor), and its receipt signs those
     # exact bytes — so the replay hands the proxy that model, as the Node test does.
-    return {**mdl.confidential_models(), "deepseek/deepseek-v4-flash": {"vision": False, "label": "DeepSeek V4 Flash"}}
+    return {**mdl.confidential_models()}
 
 
 class FakeNet:
@@ -217,9 +218,9 @@ def test_a_lapsed_proof_before_anything_reached_opencode_is_asked_again_with_a_f
 
     async def t(post, net, _p):
         r = await post({**SAY_OK, "stream": False})
-        assert r.status_code == 200 and r.json()["choices"][0]["message"]["content"] == "OK."
+        assert r.status_code == 200 and r.json()["choices"][0]["message"]["content"] == "OK"
         assert len(net.calls) == 2 and seen == {"verify": 2, "nonce": 2}
-        assert "REFUSED deepseek/deepseek-v4-flash — receipt_verification_window" in "\n".join(logs) and "↻" in "\n".join(logs)
+        assert "REFUSED deepseek/deepseek-v4.1-flash — receipt_verification_window" in "\n".join(logs) and "↻" in "\n".join(logs)
     with_proxy(t, verify=lapsing, nonce=nonce, log=logs.append)
 
 
@@ -246,7 +247,7 @@ def test_the_gateway_must_prove_its_attestation_before_anything_leaves():
 
 @needs_fixture
 def test_an_image_for_a_text_only_model_is_refused_without_a_tinfoil_key_and_read_with_one():
-    img = {**SAY_OK, "messages": [{"role": "user", "content": [{"type": "text", "text": "what is this?"}, {"type": "image_url", "image_url": {"url": PNG}}]}]}
+    img = {**SAY_OK, "model": "z-ai/glm-5.3", "messages": [{"role": "user", "content": [{"type": "text", "text": "what is this?"}, {"type": "image_url", "image_url": {"url": PNG}}]}]}  # a TEXT-ONLY confidential model (as the Node test)
 
     async def no_key(post, net, _p):
         r = await post(img)
@@ -380,3 +381,64 @@ def test_opencode_starts_on_the_catalog_s_confidential_default():
     entry = next(m for m in models.catalog() if m["model"] == models.DEFAULT_MODEL)
     assert want in (entry.get("id"), entry["model"].split("/")[-1]), f"catalog default {want!r} vs {models.DEFAULT_MODEL!r}"
     assert models.default_model_config() == {"model": "trustedrouter/deepseek/deepseek-v4.1-flash"}
+
+
+# THE MONTH'S ALLOWANCE IS USED (the free Code allowance, 2026-10-20): TrustedRouter's answer at a key's cap, as measured.
+SPEND_LIMIT = {"error": {"message": "API key monthly spend limit exceeded; resets at 2026-11-01T00:00:00Z", "source": "router", "status": 429}}
+
+
+class LimitNet(FakeNet):
+    def handler(self, req: httpx.Request):
+        if "googleapis.com/service_accounts" in str(req.url):
+            return httpx.Response(200, json=self.meta["googleJwks"])
+        self.calls.append({"url": str(req.url)})
+        return httpx.Response(429, json=SPEND_LIMIT)
+
+
+@needs_fixture
+def test_the_months_allowance_used_is_a_402_that_says_so_never_a_429_opencode_would_retry():
+    meta, stream, _ = fixture()
+    models = replay_models()
+    for model in ["openai/gpt-6-sol", next(iter(models))]:  # pass-through, and a confidential model
+        async def t(post, _net, _p, model=model):
+            r = await post({"model": model, "messages": [{"role": "user", "content": "hi"}], "stream": True})
+            assert r.status_code == 402, model
+            e = r.json()["error"]
+            assert e["type"] == "allowance_used", model
+            assert "allowance for the month is used up — it comes back on 1 November" in e["message"], e["message"]
+            assert "getspaces.witbitz.chat/account" in e["message"]
+        with_proxy(t, net=LimitNet(meta, stream.decode("utf-8")), models=models)
+    assert cf.allowance_used(429, '{"error":{"message":"rate limited"}}') is None, "a real rate limit stays a rate limit"
+    assert cf.allowance_used(400, json.dumps(SPEND_LIMIT)) is None
+
+
+class NoRouteThenReplay(FakeNet):
+    """TrustedRouter refuses any model but the default ("No route candidates" — before any upstream sees it); the default
+    answers with the captured stream."""
+
+    def handler(self, req: httpx.Request):
+        if "googleapis.com/service_accounts" not in str(req.url) and json.loads(req.content.decode("utf-8")).get("model") != cf.CONFIDENTIAL_DEFAULT:
+            self.calls.append({"url": str(req.url), "headers": dict(req.headers), "raw": list(req.headers.raw), "body": req.content.decode("utf-8")})
+            return httpx.Response(400, json={"error": {"message": "No route candidates match the requested provider filters"}})
+        return super().handler(req)
+
+
+@needs_fixture
+def test_a_pick_with_no_verified_enclave_route_is_answered_by_the_default_with_one_note_per_session():
+    meta, stream, request = fixture()
+    net = NoRouteThenReplay(meta, stream.decode("utf-8"))
+    logs = []
+    glm = {**SAY_OK, "model": "z-ai/glm-5.3"}
+
+    async def t(post, net_, _p):
+        r = await post(glm, {"x-session-id": "ses_fb"})
+        text = r.text
+        assert [json.loads(c["body"])["model"] for c in net.calls] == ["z-ai/glm-5.3", "deepseek/deepseek-v4.1-flash"], "the pick, then the default — once"
+        assert net.calls[1]["body"].encode() == request, "the same request, only the model changed — the receipt signs it"
+        assert '"content":"OK"' in text
+        assert "Answered by DeepSeek V4.1 Flash — GLM 5.3 isn't available confidentially right now." in text
+        assert text.index("Answered by") < text.index("[DONE]")
+        again = (await post(glm, {"x-session-id": "ses_fb"})).text
+        assert "Answered by" not in again and '"content":"OK"' in again, "said once per session"
+        assert any("has no verified-enclave route now" in line for line in logs)
+    with_proxy(t, net=net, log=logs.append)