witbitz-code 1.9.4__tar.gz → 1.9.5__tar.gz

{witbitz_code-1.9.4/src/witbitz_code.egg-info → witbitz_code-1.9.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: witbitz-code
-Version: 1.9.4
+Version: 1.9.5
 Summary: Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay.
 Author: Witbitz
 License-Expression: MIT

{witbitz_code-1.9.4 → witbitz_code-1.9.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "witbitz-code"
-version = "1.9.4"
+version = "1.9.5"
 description = "Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay."
 readme = "README.md"
 requires-python = ">=3.10"

{witbitz_code-1.9.4 → witbitz_code-1.9.5}/src/witbitz_code/__init__.py

@@ -4,4 +4,4 @@ The Python implementation of tools/witbitz-code.mjs (docs/opencode-relay.md phas
 vectors and cross-implementation tests.
 """
 
-__version__ = "1.9.4"
+__version__ = "1.9.5"

{witbitz_code-1.9.4 → witbitz_code-1.9.5}/src/witbitz_code/cli.py

@@ -384,7 +384,7 @@ async def uninstall(args: list[str]) -> int:
             return {"ok": False, "why": "could not give this computer's coding keys back"}
         if entry:
             codekeys.forget(p["computerId"])
-        r = await acct.unpublish_computer(call=call, idx=p["idx"], computer_id=p["computerId"])
+        r = await acct.unpublish_computer(call=net.call_for(call, p.get("origin")), idx=p["idx"], computer_id=p["computerId"])
         if r.get("ok"):
             pp.write_pairings(pp.remove_pairings(pp.read_pairings(), p.get("account") or "")["doc"])
         return r

{witbitz_code-1.9.4 → witbitz_code-1.9.5}/src/witbitz_code/link.py

@@ -156,6 +156,7 @@ async def _link(life_ms, poll_s, origins, get_json, post_json, challenge, svg_pa
     out(f"  waiting up to {round(wait_s)}s for your device to seal the account to this computer…\n")
     until = time.monotonic() + wait_s
     warned = False
+    found = ""
     while time.monotonic() < until:
         await asyncio.sleep(poll_s)
         r = None
@@ -168,7 +169,7 @@ async def _link(life_ms, poll_s, origins, get_json, post_json, challenge, svg_pa
                 err(f"witbitz-code: note — {origin} has no device-link relay; ignoring it.")
                 warned = True
             if isinstance(rr, dict) and truthy(rr.get("ok")):
-                r = rr
+                r, found = rr, origin
                 break
         if r is None:
             continue  # 404 on all = not sealed yet
@@ -184,6 +185,10 @@ async def _link(life_ms, poll_s, origins, get_json, post_json, challenge, svg_pa
         if not account:
             err("witbitz-code: the reply carried no account key.")
             return None
+        # THE APP IT CAME FROM (the owner, 2026-10-22: a second account paired from the hosted app → "computers read refused
+        # (404: not_found)"): the relay that held the reply is that app's own address, and its rooms answer only their own app
+        # since 2026-10-18 — so this account's calls speak as it (pairings.json `origin`, net.call_for).
+        account["origin"] = found
         via = "link" if account["idx"] else ""
         if not account["idx"]:
             out("witbitz-code: no index pointer in the link — recovering it from your account backup… ", end="")

{witbitz_code-1.9.4 → witbitz_code-1.9.5}/src/witbitz_code/net.py

@@ -4,6 +4,7 @@ retried or cached)."""
 from __future__ import annotations
 
 import os
+import re
 from collections.abc import Awaitable, Callable
 from dataclasses import dataclass
 from typing import Any
@@ -31,10 +32,24 @@ def _json_of(r: httpx.Response) -> Any:
     return _js.parse(r.content.decode("utf-8-sig", "replace"))  # fetch's r.json(): BOM dropped, then JSON.parse
 
 
-def make_api_call(client: httpx.AsyncClient) -> ApiCall:
-    """POST {op:'state', …} to the account API, as the Spaces app would (same Origin)."""
+def app_origin(o: Any) -> str:
+    """A pairing's app address, when it is one: https and nothing but scheme://host. Else '' (the default app)."""
+    return o if isinstance(o, str) and re.fullmatch(r"https://[A-Za-z0-9.-]+(:[0-9]+)?", o) else ""
+
+
+def call_for(call: Any, origin: Any) -> Any:
+    """The same account call, speaking as the app `origin` pairs through (its rooms answer only their own app's addresses —
+    the hosted app's since 2026-10-18). A call without that ability (a test's fake) is returned unchanged."""
+    o = app_origin(origin)
+    f = getattr(call, "for_origin", None)
+    return f(o) if o and callable(f) else call
+
+
+def make_api_call(client: httpx.AsyncClient, origin: str | None = None) -> ApiCall:
+    """POST {op:'state', …} to the account API, as the Spaces app would (same Origin). `origin`: the app this account was
+    paired from (a pairing's `origin`); none → RC_ORIGIN, else the regular app."""
     api = os.environ.get("RC_BASE") or API
-    origin = os.environ.get("RC_ORIGIN") or ORIGIN
+    origin = app_origin(origin) or os.environ.get("RC_ORIGIN") or ORIGIN
 
     async def call(body: dict) -> ApiReply:
         r = await client.post(api, content=_js.stringify(body).encode("utf-8"),
@@ -45,6 +60,7 @@ def make_api_call(client: httpx.AsyncClient) -> ApiCall:
             j = None
         return ApiReply(r.status_code, j)
 
+    call.for_origin = lambda o: make_api_call(client, o)  # type: ignore[attr-defined]
     return call
 
 

{witbitz_code-1.9.4 → witbitz_code-1.9.5}/src/witbitz_code/pair.py

@@ -94,6 +94,7 @@ def ensure_local_password(out: Callable[[str], Any] = _out) -> None:
 
 
 async def _publish_entry(call: net.ApiCall, e: dict, out: Callable, err: Callable) -> bool:
+    call = net.call_for(call, e.get("origin"))  # this account's app (the hosted app's rooms refuse the regular one)
     r = await acct.publish_computer(call=call, idx=e["idx"], computer_id=e["computerId"], name=e["name"], relay=e["relay"],
                                     secret=e["secret"])
     who = e["account"] or "account"
@@ -220,7 +221,7 @@ async def _run(args: Args, call: Any, link_fn: LinkFn | None, out: Callable, err
             if entry:
                 codekeys.forget(p["computerId"])
                 _forget_payer(p["computerId"])
-            r = await acct.unpublish_computer(call=call, idx=p["idx"], computer_id=p["computerId"])
+            r = await acct.unpublish_computer(call=net.call_for(call, p.get("origin")), idx=p["idx"], computer_id=p["computerId"])
             if not r["ok"]:
                 ok = False
                 err(f"witbitz-code: ✖ {p.get('account')}: {r['why']} — kept the local pairing so you can retry")
@@ -242,7 +243,8 @@ async def _run(args: Args, call: Any, link_fn: LinkFn | None, out: Callable, err
         cur, ok = doc, True
         for p in to_rotate:
             u = pp.upsert_pairing(cur, account=p.get("account") or "", idx=p["idx"], name=p.get("name") or "",
-                                  relay=p.get("relay", UNDEFINED), opencode_url=p.get("opencodeUrl", UNDEFINED), rotate=True)
+                                  relay=p.get("relay", UNDEFINED), opencode_url=p.get("opencodeUrl", UNDEFINED),
+                                  origin=p.get("origin", UNDEFINED), rotate=True)
             if await _publish_entry(call, u["entry"], out, err):
                 cur = u["doc"]
                 pp.write_pairings(cur)
@@ -260,7 +262,7 @@ async def _run(args: Args, call: Any, link_fn: LinkFn | None, out: Callable, err
         err("witbitz-code: pairing did not complete — nothing changed.")
         return 1
     u = pp.upsert_pairing(doc, account=account.get("email") or "", idx=account["idx"], name=args.name,
-                          opencode_url=args.opencode_url or UNDEFINED)
+                          opencode_url=args.opencode_url or UNDEFINED, origin=account.get("origin") or UNDEFINED)
     # THIS COMPUTER'S CODING KEYS from the account (codekeys.py; docs/code-account-keys.md) — the only way it gets model
     # keys. Asked with the sign-in the scan carried, before anything is published: an account that cannot give keys (not
     # invited, too many computers, …) leaves nothing behind.

{witbitz_code-1.9.4 → witbitz_code-1.9.5}/src/witbitz_code/pairings.py

@@ -114,8 +114,8 @@ def norm_pairings(doc: Any) -> dict:
 
 
 def upsert_pairing(doc: Any, *, idx: dict, account: str = "", name: str = "", relay: Any = UNDEFINED,
-                   opencode_url: Any = UNDEFINED, rotate: bool = False, mint_id: Callable[[], str] = new_computer_id,
-                   mint_secret: Callable[[], str] = new_relay_secret) -> dict:
+                   opencode_url: Any = UNDEFINED, origin: Any = UNDEFINED, rotate: bool = False,
+                   mint_id: Callable[[], str] = new_computer_id, mint_secret: Callable[[], str] = new_relay_secret) -> dict:
     """Add this computer for an account, or refresh the existing entry (same id + secret unless `rotate`). Pure.
     → {doc, entry, isNew, sharedWith}: sharedWith names the other accounts that reach the same OpenCode."""
     relay = RELAY_URL if relay is UNDEFINED else relay
@@ -138,6 +138,11 @@ def upsert_pairing(doc: Any, *, idx: dict, account: str = "", name: str = "", re
         # An OpenCode asked for (`pair --port 4097`) wins; not asked → the entry keeps the one it had (tools/opencode-pair.mjs).
         "opencodeUrl": pick(None if opencode_url is UNDEFINED else opencode_url, "opencodeUrl", DEFAULT_OPENCODE_URL),
     }
+    # The app this account pairs through (its rooms answer only their own app — net.call_for). Absent = the regular app, so an
+    # entry written before 2026-10-22 (or by an older tool) reads as before, byte for byte.
+    app = pick(None if origin is UNDEFINED else origin, "origin", "")
+    if truthy(app):
+        entry["origin"] = app
     pairings = list(cur["pairings"])
     if i >= 0:
         pairings[i] = entry

{witbitz_code-1.9.4 → witbitz_code-1.9.5/src/witbitz_code.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: witbitz-code
-Version: 1.9.4
+Version: 1.9.5
 Summary: Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay.
 Author: Witbitz
 License-Expression: MIT

{witbitz_code-1.9.4 → witbitz_code-1.9.5}/tests/test_devicelink.py

@@ -220,3 +220,25 @@ def test_qr_ansi_and_svg_output_are_byte_identical_to_rc_qr():
     assert qr.render_ansi(out["rows"], compact=False) == out["large"], "and WITBITZ_QR=large"
     assert qr.render_svg(out["rows"]) == out["svg"]
     assert len(qr.qr_modules(text)) == len(out["rows"]), "and the same version: the smallest that fits at level M"
+
+
+def test_link_node_names_the_app_whose_relay_answered(tmp_path):
+    """Each origin's /api/link is polled; the account remembers which answered — the app that scanned (owner, 2026-10-22)."""
+    master = bytes([9] * 32)
+    ch = devicelink.new_link_challenge()
+    out = run_node("""
+      import { sealToChallenge, linkPayload } from '@PUBLIC@/deviceLink.js'
+      OUT({ reply: await sealToChallenge({ ref: INPUT.ref, pub: INPUT.pub },
+        linkPayload({ vault: { master: INPUT.masterB64 }, email: 'me@x', idx: { room: 'sp-idx-9', mk: 'idxmk9' } })) })
+    """, {"masterB64": _js.btoa(master), "ref": ch.ref, "pub": ch.pub})
+
+    async def get_json(url):
+        return {"ok": True, **out["reply"]} if url.startswith("https://b.test/") else {"ok": False}
+
+    async def nopost(url, body):
+        return {}
+
+    account = asyncio.run(link.link_node(life_ms=5000, poll_s=0.01, origins=["https://a.test", "https://b.test"],
+                                         get_json=get_json, post_json=nopost, challenge=ch, svg_path=tmp_path / "q.svg",
+                                         out=lambda *a, **k: None, err=lambda *a: None))
+    assert account and account["origin"] == "https://b.test"

{witbitz_code-1.9.4 → witbitz_code-1.9.5}/tests/test_pair_flows.py

@@ -301,3 +301,61 @@ def test_a_new_pairing_on_wsl_is_named_for_wsl(monkeypatch):
     assert pp.hostname() == "my-laptop (WSL)"
     monkeypatch.setattr(ports, "on_wsl", lambda: False)
     assert pp.hostname() == "my-laptop"
+
+
+def test_a_pairing_from_the_hosted_app_writes_that_app_s_account_and_remembers_it():
+    """The owner, 2026-10-22: a second account added from the vaulted app failed "computers read refused (404)" — its
+    rooms answer only to the hosted app's origin. The relay that answered the scan names the app; each pairing keeps it."""
+    regular, hosted = MockApi(), MockApi()
+    asked = []
+
+    def for_origin(o):
+        asked.append(o)
+        return hosted.call
+
+    async def call(body):
+        return await regular.call(body)
+    call.for_origin = for_origin
+    keys = FakeKeys()
+
+    async def link_fn():
+        return {"email": "me@x", "idx": IDX, "master": "M" * 43, "anchor": ANCHOR, "origin": "https://spaces.witbitz.chat"}
+
+    cap = Capture()
+    assert run(pair.main(["--name", "desk"], call=call, link_fn=link_fn, keys=keys, **cap.kw())) == 0, cap.text()
+    assert asked and set(asked) == {"https://spaces.witbitz.chat"}
+    assert regular.writes == [] and hosted.writes, "the account was written through the hosted app's origin only"
+    p = pp.read_pairings()["pairings"][0]
+    assert p["origin"] == "https://spaces.witbitz.chat"
+
+    async def link_fn2():
+        return {"email": "work@y", "idx": IDX2, "master": "M" * 43, "anchor": {**ANCHOR, "email": "work@y"},
+                "origin": "https://witbitz-spaces.pages.dev"}
+
+    asked.clear()
+    assert run(pair.main([], call=call, link_fn=link_fn2, keys=keys, **Capture().kw())) == 0
+    assert set(asked) == {"https://witbitz-spaces.pages.dev"}, "a regular-app pairing writes through its own origin"
+    q = next(x for x in pp.read_pairings()["pairings"] if x["account"] == "work@y")
+    assert q["origin"] == "https://witbitz-spaces.pages.dev"
+
+    asked.clear()
+    assert run(pair.main(["--rotate", "--account", "me@x"], call=call, **Capture().kw())) == 0
+    assert set(asked) == {"https://spaces.witbitz.chat"}, "a rotate re-publishes to the app it was paired from"
+    assert next(x for x in pp.read_pairings()["pairings"] if x["account"] == "me@x")["origin"] == "https://spaces.witbitz.chat"
+
+    n = len(hosted.writes)
+    assert run(pair.main(["--unpair", "--account", "me@x"], call=call, keys=keys, **Capture().kw())) == 0
+    assert len(hosted.writes) > n, "the unpair tombstone goes to the hosted app's account too"
+
+
+def test_call_for_ignores_anything_that_is_not_an_https_origin():
+    from witbitz_code import net
+
+    async def call(body):
+        return None
+    call.for_origin = lambda o: ("other", o)
+    assert net.call_for(call, None) is call
+    assert net.call_for(call, "http://spaces.witbitz.chat") is call
+    assert net.call_for(call, "https://evil.test/path") is call
+    assert net.call_for(call, "https://spaces.witbitz.chat") == ("other", "https://spaces.witbitz.chat")
+    assert net.call_for(lambda b: None, "https://spaces.witbitz.chat") is not None