Add PyPI package installer, file-tree context menu, and demos UI

Expose micropip installs from the menu, right-click actions on the file
tree, local folder/file open shortcuts, and browse demos/ alongside code/.

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -8,8 +8,8 @@
 
 # --- User accounts (SQLite) ---
 # AUTH_ENABLED=true          # require sign-in for /api/* (except /api/auth/*)
-# AUTH_REGISTER_OPEN=true    # allow POST /api/auth/register
-# AUTH_INVITE_ONLY=false     # require invite token for registration
+# AUTH_REGISTER_OPEN=false   # allow POST /api/auth/register
+# AUTH_INVITE_ONLY=true      # default: require invite token; set false for open signup
 # AUTH_DATABASE_PATH=./data/editor.db
 # AUTH_SESSION_DAYS=14
 # BOOTSTRAP_ADMIN_USERNAME=admin   # first-run only: create superuser if DB has zero users

.gitignore

@@ -15,7 +15,6 @@ dist/
 downloads/
 eggs/
 .eggs/
-/lib/
 /lib64/
 parts/
 sdist/
@@ -177,3 +176,9 @@ cython_debug/
 # PyPI configuration file
 .pypirc
 
+# Editor runtime state — `workspace/` holds user files (auth-mode per-user
+# folders, no-auth dev's `code/`); the canonical demo source lives under
+# `src/static/bundled-demos/demo/` seeds into `workspace/demos/` (and per-user `users/.../demos/`)
+# on startup. Nothing under `workspace/` should ever be committed.
+/workspace/
+src/static/.reload-token

Dockerfile

@@ -12,7 +12,10 @@ COPY Pipfile Pipfile.lock ./
 RUN pipenv install --system --deploy
 
 COPY src ./src
-COPY workspace ./workspace
+COPY lib ./lib
+RUN mkdir -p src/static/bundled-lib && cp -f lib/*.py src/static/bundled-lib/
+# `workspace/` is runtime/user state (gitignored) and is created on demand
+# at app startup — the image does not need to ship it.
 
 EXPOSE 8080
 

LED_TUTORIAL.md

@@ -5,7 +5,7 @@ This tutorial is for the browser editor's ESP32-style mocks:
 - `machine.Pin`
 - `neopixel.NeoPixel`
 
-Use `workspace/code/led_tutorial.py` while reading this guide.
+Open `demos/led_tutorial.py` in the editor while reading this guide. (Source of truth: `src/static/bundled-demos/demo/led_tutorial.py` — the top-level `demos/` folder is seeded from there on first run.)
 
 ## 1) Basic setup
 

Pipfile

@@ -20,7 +20,7 @@ bcrypt = "*"
 python_version = "3.12"
 
 [scripts]
-dev = "uvicorn app:app --app-dir src --reload --port 8080"
+dev = "uvicorn app:app --app-dir src --reload --host 0.0.0.0 --port 8080"
 test = "bash -lc 'cd src && PYTHONPATH=. pytest ../tests'"
 test-integration = "bash -lc 'cd src && PYTHONPATH=. pytest ../tests -m integration'"
 test-selenium = "bash -lc 'cd src && PYTHONPATH=. pytest ../tests -m selenium -v'"

README.md

@@ -73,13 +73,13 @@ Notes:
 - `data/` is mounted to `/app/data` for the SQLite auth DB.
 - In container mode, `WORKSPACE_ROOT` and `AUTH_DATABASE_PATH` are set by `docker-compose.yml`.
 
-**User accounts** — Set `AUTH_ENABLED=true` in `.env` to require sign-in for workspace APIs. Users live in a SQLite file (`AUTH_DATABASE_PATH`, default `./data/editor.db`). Use `/register` (if `AUTH_REGISTER_OPEN=true`) or `BOOTSTRAP_ADMIN_USERNAME` / `BOOTSTRAP_ADMIN_PASSWORD` for the first superuser. Superusers can **GET/POST/DELETE `/api/users`** to list, create, or remove accounts.
+**User accounts** — Set `AUTH_ENABLED=true` in `.env` to require sign-in for workspace APIs. Users live in a SQLite file (`AUTH_DATABASE_PATH`, default `./data/editor.db`). Use `/register` with an invite link (unless you opt into open signup) or `BOOTSTRAP_ADMIN_USERNAME` / `BOOTSTRAP_ADMIN_PASSWORD` for the first superuser. Superusers can **GET `/api/users`**, **PATCH `/api/users/{id}`** (username, password reset, admin flag — renames workspace folder when the username changes), or **DELETE `/api/users/{id}`** to manage accounts. New accounts are added only through **invite links** (**`POST /api/users/invites`**) plus self-service registration (`/register?invite=…`).
 
 Email invite signup:
 
+- By default **`AUTH_INVITE_ONLY=true`**: registrations need a valid invite token. Set **`AUTH_INVITE_ONLY=false`** to allow open signup whenever **`AUTH_REGISTER_OPEN=true`**.
 - Superusers can create invites via `POST /api/users/invites` with `{ "email": "...", "expires_days": 7 }`.
 - Response includes `invite_url`; if SMTP is configured the invite email is sent automatically.
-- Set `AUTH_INVITE_ONLY=true` to require invite tokens for all registrations.
 - Registration page accepts invite links like `/register?invite=<token>`.
 
 When auth is enabled, file APIs use a per-user workspace under `WORKSPACE_ROOT/users/<username-id>/` for **isolated `code/`**. The `lib/` tree is shared and read-only for all users. When auth is disabled, the shared workspace root is used for everything.
@@ -90,19 +90,27 @@ Admins can open another user's workspace from the home page user management pane
 
 The home page can store the API key in `sessionStorage` when you are not using cookie login, or use `?api_key=` on `/editor`.
 
+**Local mode (no login)** — Click *Use locally* on the home page (or open `/editor?local=1`) to run the editor without any FastAPI auth. The boot-time auth probe is skipped when local mode is active, so this works even on a host that has `AUTH_ENABLED=true`. Files default to the browser's **IndexedDB**; inside the editor the workspace badge has a **Folder…** button that opens `window.showDirectoryPicker()` so you can save straight to any folder on disk (Chromium-only — Firefox/Safari stay on IndexedDB). The picked directory handle is persisted across reloads in IndexedDB; if browser permission lapses a *Reconnect* button reappears in the badge. Nothing is sent to the server for file reads/writes. The MicroPython stubs are loaded from **`/static/bundled-lib/*.py`** (files under `src/static/bundled-lib/` in the repo) so a plain static file server is enough; if those requests fail, the app falls back to `GET /api/public/lib-bundle` when FastAPI is available. For static-only hosting, run `python scripts/serve_static_editor.py` from the repo root — it serves `src/static/` with the same `/static/…` URLs the HTML expects (it strips the `/static` prefix when resolving files), rewrites `/editor` → `index.html`, and sends the same COOP/COEP headers as the full app so **ADC sliders, pin toggles, and serial I/O** keep using `SharedArrayBuffer` on mobile Safari and Chrome where supported. An *Exit* button in the editor's workspace badge clears the local-mode flag (your IndexedDB files stay until you wipe browser storage).
+
 ## Layout
 
 - `src/` — FastAPI app and static UI (`src/static/`)
-- `workspace/` — default tree: `code/` (editable), `lib/` (read-only via API)
+- `lib/` — bundled MicroPython stubs, served read-only as `lib/` in the editor and merged into Pyodide at run time (single source of truth)
+- `workspace/` — default `WORKSPACE_ROOT`: `code/` samples and per-user folders (editable); the editor surfaces the repo `lib/` alongside it without copying anything to disk
 
 ## ESP32 / NeoPixel mock
 
-The browser runtime now includes MicroPython-style mocks in `workspace/lib`:
+The browser runtime ships MicroPython-style stubs in repo `lib/` (they appear as `lib/` in the editor and are read-only via the APIs):
 
-- `machine.Pin`
+- `machine.Pin` — `value/on/off/toggle/high/low/init/__call__/irq` plus a live "Pins" panel: OUT pins show an indicator, IN pins expose a clickable toggle button (its value is what `Pin.value()` returns), `irq()` fires on rising / falling edges as you click
+- `machine.PWM` — `freq()` / `duty()` / `duty_u16()` / `duty_ns()` with a duty-cycle bar in the Pins panel
+- `machine.ADC` — backed by a live slider in the editor UI (one slider per pin, `read_u16()` returns 0..65535)
+- `machine.UART` — opens a Serial Monitor pane; `write()` text appears there, what you type is delivered via `read()` / `readline()`
 - `neopixel.NeoPixel`
+- `utime` — `ticks_ms`, `ticks_diff`, `ticks_add`, `sleep_ms`, `sleep_us`, `sleep`
+- `micropython.const` — no-op helper for ported constant declarations
 
-Use them from scripts in `workspace/code` exactly like ESP32 examples:
+Use them from the top-level `demos/` folder (sibling of `code/` and `lib/`; first run seeds from `src/static/bundled-demos/demo/`) like typical ESP32 / MicroPython examples:
 
 ```python
 from machine import Pin
@@ -124,18 +132,20 @@ Simulator modes:
   - rows zig-zag left/right.
 - The 16x16 popup closes automatically on **Stop** or when script execution finishes.
 
-Tutorial files:
+Tutorial files (canonical source — committed under `src/static/bundled-demos/demo/`; copies appear under top-level `demos/` on first run):
 
 - `LED_TUTORIAL.md` - step-by-step NeoPixel tutorial
-- `workspace/code/led_tutorial.py` - runnable guided LED example
-- `workspace/code/led_patterns.py` - reusable pattern helpers (`rainbow_frame`, `chase_frame`, `twinkle_frame`)
-- `workspace/code/pattern_rainbow_demo.py` - rainbow animation demo
-- `workspace/code/pattern_chase_demo.py` - chase animation demo
-- `workspace/code/pattern_twinkle_demo.py` - twinkle animation demo
-- `workspace/code/panel16_utils.py` - helpers for 16x16 serpentine mapping
-- `workspace/code/panel16_rainbow_wave.py` - 16x16 rainbow wave
-- `workspace/code/panel16_bounce.py` - 16x16 bouncing pixel with trail
-- `workspace/code/panel16_matrix_rain.py` - 16x16 matrix rain effect
+- `led_tutorial.py` - runnable guided LED example
+- `led_patterns.py` - shared pattern helpers (used by automated tests); each `pattern_*_demo.py` duplicates what it needs and uses only Python stdlib + `machine` / `neopixel` / `time`
+- `pattern_rainbow_demo.py` - rainbow animation (self-contained)
+- `pattern_chase_demo.py` - Knight Rider–style bouncing scanner (self-contained)
+- `pattern_twinkle_demo.py` - twinkle animation (self-contained)
+- `panel16_utils.py` - helpers for 16x16 serpentine mapping
+- `panel16_rainbow_wave.py` - 16x16 rainbow wave
+- `panel16_bounce.py` - 16x16 bouncing pixel with trail
+- `panel16_matrix_rain.py` - 16x16 matrix rain effect
+
+> `workspace/` is gitignored runtime state. To edit the **shipped** demo source, edit `src/static/bundled-demos/demo/<file>.py` and re-run "Reset demos" in the editor (or restart the dev server with an empty `workspace/demos/`).
 
 ## Dev auto-reload hook
 

lib/browser_fetch.py

@@ -0,0 +1,38 @@
+"""Browser-friendly async HTTP for the Pyodide worker.
+
+These helpers use ``pyodide.http.pyfetch``, which maps to the browser
+``fetch`` API (no Python TLS stack). Prefer them for ``https://`` in
+Pyodide: ``aiohttp`` in the worker often raises
+``RuntimeError('SSL is not supported.')`` for HTTPS even though the wheel
+exists, because user-level SSL is not wired the same as on CPython.
+
+The browser's normal rules apply: the page is served over HTTPS so
+``http://`` URLs are blocked as mixed content, and the response host must
+send permissive CORS headers (e.g. ``Access-Control-Allow-Origin``) or the
+browser hides the body even if the request succeeded.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+async def fetch_text(url: str) -> str:
+    from pyodide.http import pyfetch
+
+    r = await pyfetch(url)
+    return await r.text()
+
+
+async def fetch_bytes(url: str) -> bytes:
+    from pyodide.http import pyfetch
+
+    r = await pyfetch(url)
+    return await r.bytes()
+
+
+async def fetch_json(url: str, **kwargs: Any) -> Any:
+    from pyodide.http import pyfetch
+
+    r = await pyfetch(url)
+    return await r.json(**kwargs)

lib/machine.py

@@ -0,0 +1,445 @@
+"""Minimal MicroPython-style machine module mock for browser simulation."""
+
+import json
+
+
+_PIN_MODE_OUT = 1
+_PIN_MODE_IN = 2
+_PIN_MODE_PWM = 4
+
+
+def _pin_view_get(name):
+    try:
+        import js
+
+        return getattr(js, name, None)
+    except Exception:
+        return None
+
+
+def _sab_isolated():
+    """True when the worker has a real SharedArrayBuffer for pin/ADC views.
+
+    Set by `pyodide-worker.js` at init time. When false, output updates
+    must travel through `print("[pin-out]…")` markers because the main
+    thread can't read worker-local arrays."""
+    try:
+        import js
+
+        return bool(getattr(js, "__sab_isolated", False))
+    except Exception:
+        return False
+
+
+def _pin_out_publish(pin_id, ui_mode, value):
+    """Pack [ui_mode (high byte) | value (low 24 bits)] for the UI panel."""
+    view = _pin_view_get("__pin_out_view")
+    if view is not None:
+        packed = ((int(ui_mode) & 0xFF) << 24) | (int(value) & 0x00FFFFFF)
+        try:
+            import js
+
+            js.Atomics.store(view, int(pin_id), packed)
+        except Exception:
+            try:
+                view[int(pin_id)] = packed
+            except Exception:
+                pass
+    if not _sab_isolated():
+        # Fallback for non-isolated contexts (e.g. mobile over LAN IP):
+        # the main thread reads `[pin-out]` lines from stdout and updates
+        # the Pins panel from there. Slower than SAB but works everywhere.
+        try:
+            print(
+                "[pin-out]"
+                + json.dumps(
+                    {"pin": int(pin_id), "mode": int(ui_mode), "value": int(value)}
+                )
+            )
+        except Exception:
+            pass
+
+
+def _pin_in_read(pin_id):
+    view = _pin_view_get("__pin_in_view")
+    if view is None:
+        return 0
+    try:
+        import js
+
+        return int(js.Atomics.load(view, int(pin_id))) & 1
+    except Exception:
+        try:
+            return int(view[int(pin_id)]) & 1
+        except Exception:
+            return 0
+
+
+def _pin_register(pin_id, ui_mode, **extra):
+    payload = {"pin": int(pin_id), "mode": int(ui_mode)}
+    payload.update({k: v for k, v in extra.items() if v is not None})
+    try:
+        print("[pin-register]" + json.dumps(payload))
+    except Exception:
+        pass
+
+
+class Pin:
+    """Browser-simulated `machine.Pin`.
+
+    A control row appears in the editor UI when a pin is constructed:
+      * `Pin.OUT` pins show a live indicator that mirrors `value()`.
+      * `Pin.IN` pins show a toggle button you can click — the next call
+        to `value()` returns 0 or 1 accordingly.
+    """
+
+    IN = 0
+    OUT = 1
+    PULL_UP = 2
+    PULL_DOWN = 3
+    OPEN_DRAIN = 7
+
+    IRQ_FALLING = 1
+    IRQ_RISING = 2
+
+    def __init__(self, pin_id, mode=OUT, pull=-1, value=None, **_kwargs):
+        self.id = int(pin_id)
+        self.mode = int(mode)
+        self.pull = int(pull) if pull != -1 else -1
+        self._value = 1 if value else 0
+        self._irq_handler = None
+        self._irq_trigger = 0
+        self._last_input = 0
+        self._publish()
+
+    def _ui_mode(self):
+        if self.mode == self.IN:
+            return _PIN_MODE_IN
+        return _PIN_MODE_OUT
+
+    def _publish(self):
+        ui_mode = self._ui_mode()
+        _pin_register(self.id, ui_mode, pull=self.pull if self.pull != -1 else None)
+        if ui_mode == _PIN_MODE_OUT:
+            _pin_out_publish(self.id, ui_mode, self._value)
+
+    def init(self, mode=-1, pull=-1, value=None):
+        if mode != -1:
+            self.mode = int(mode)
+        if pull != -1:
+            self.pull = int(pull)
+        if value is not None:
+            self._value = 1 if int(value) else 0
+        self._publish()
+
+    def value(self, new_value=None):
+        if new_value is None:
+            if self.mode == self.IN:
+                v = _pin_in_read(self.id)
+                if self._irq_handler is not None:
+                    if v and not self._last_input and (self._irq_trigger & self.IRQ_RISING):
+                        self._fire_irq()
+                    elif not v and self._last_input and (self._irq_trigger & self.IRQ_FALLING):
+                        self._fire_irq()
+                self._last_input = v
+                return v
+            return self._value
+        v = 1 if int(new_value) else 0
+        self._value = v
+        if self._ui_mode() == _PIN_MODE_OUT:
+            _pin_out_publish(self.id, _PIN_MODE_OUT, v)
+        return v
+
+    def on(self):
+        return self.value(1)
+
+    def off(self):
+        return self.value(0)
+
+    def high(self):
+        return self.value(1)
+
+    def low(self):
+        return self.value(0)
+
+    def toggle(self):
+        return self.value(0 if (self._value if self.mode == self.OUT else _pin_in_read(self.id)) else 1)
+
+    def irq(self, handler=None, trigger=IRQ_RISING | IRQ_FALLING, **_kwargs):
+        self._irq_handler = handler
+        self._irq_trigger = int(trigger)
+        return self
+
+    def _fire_irq(self):
+        if self._irq_handler is None:
+            return
+        try:
+            self._irq_handler(self)
+        except Exception as exc:
+            try:
+                print(f"[pin] irq handler raised: {exc!r}")
+            except Exception:
+                pass
+
+    def __call__(self, *args):
+        return self.value(*args) if args else self.value()
+
+
+class PWM:
+    """Browser-simulated `machine.PWM`.
+
+    Visualises the configured duty cycle as a bar in the Pins panel.
+    `freq()` and `duty()`/`duty_u16()`/`duty_ns()` mirror MicroPython's API.
+    """
+
+    def __init__(self, pin, freq=1000, duty=None, duty_u16=None, duty_ns=None):
+        self._pin_id = _adc_pin_id(pin)
+        self._freq = int(freq) if freq else 1000
+        self._duty_u16 = 0
+        if duty_u16 is not None:
+            self._duty_u16 = max(0, min(65535, int(duty_u16)))
+        elif duty is not None:
+            self._duty_u16 = max(0, min(65535, int(duty) * 64))
+        elif duty_ns is not None:
+            self._set_duty_ns(int(duty_ns))
+        _pin_register(self._pin_id, _PIN_MODE_PWM, freq=self._freq)
+        _pin_out_publish(self._pin_id, _PIN_MODE_PWM, self._duty_u16)
+
+    def _set_duty_ns(self, ns):
+        period_ns = 1_000_000_000 // max(1, self._freq)
+        if period_ns <= 0:
+            self._duty_u16 = 0
+            return
+        self._duty_u16 = max(0, min(65535, int(ns) * 65535 // period_ns))
+
+    def freq(self, value=None):
+        if value is None:
+            return self._freq
+        self._freq = max(1, int(value))
+        _pin_register(self._pin_id, _PIN_MODE_PWM, freq=self._freq)
+
+    def duty(self, value=None):
+        if value is None:
+            return self._duty_u16 // 64
+        self._duty_u16 = max(0, min(65535, int(value) * 64))
+        _pin_out_publish(self._pin_id, _PIN_MODE_PWM, self._duty_u16)
+
+    def duty_u16(self, value=None):
+        if value is None:
+            return self._duty_u16
+        self._duty_u16 = max(0, min(65535, int(value)))
+        _pin_out_publish(self._pin_id, _PIN_MODE_PWM, self._duty_u16)
+
+    def duty_ns(self, value=None):
+        period_ns = 1_000_000_000 // max(1, self._freq)
+        if value is None:
+            return (self._duty_u16 * period_ns) // 65535
+        self._set_duty_ns(int(value))
+        _pin_out_publish(self._pin_id, _PIN_MODE_PWM, self._duty_u16)
+
+    def deinit(self):
+        _pin_out_publish(self._pin_id, 0, 0)
+
+
+def _adc_pin_id(pin):
+    if isinstance(pin, int):
+        return pin
+    return int(getattr(pin, "id", 0))
+
+
+def _adc_read_raw(pin_id: int) -> int:
+    """Read the live slider value (0..65535) shared from the editor UI.
+
+    Backed by a SharedArrayBuffer so updates from the browser slider propagate
+    instantly without the script having to yield. Falls back to 0 when the
+    runtime is not cross-origin isolated (e.g. older browsers).
+    """
+    try:
+        import js  # only available inside Pyodide
+
+        view = getattr(js, "__adc_view", None)
+        if view is None:
+            return 0
+        try:
+            return int(js.Atomics.load(view, pin_id)) & 0xFFFF
+        except Exception:
+            return int(view[pin_id]) & 0xFFFF
+    except Exception:
+        return 0
+
+
+class ADC:
+    """Browser-simulated `machine.ADC`.
+
+    Exposes a slider in the editor UI for the given pin. `read_u16()` returns
+    the slider value in the 0..65535 range (matching MicroPython's API);
+    `read()` scales to the configured `width` (defaults to 12-bit, 0..4095).
+    """
+
+    WIDTH_9BIT = 9
+    WIDTH_10BIT = 10
+    WIDTH_11BIT = 11
+    WIDTH_12BIT = 12
+    ATTN_0DB = 0
+    ATTN_2_5DB = 1
+    ATTN_6DB = 2
+    ATTN_11DB = 3
+
+    def __init__(self, pin):
+        self._pin = _adc_pin_id(pin)
+        self._atten = self.ATTN_11DB
+        self._width = self.WIDTH_12BIT
+        try:
+            print("[adc-register]" + json.dumps({"pin": self._pin}))
+        except Exception:
+            pass
+
+    def atten(self, attn):
+        self._atten = int(attn)
+
+    def width(self, width):
+        self._width = int(width)
+
+    def read_u16(self):
+        return _adc_read_raw(self._pin)
+
+    def read(self):
+        bits = self._width if self._width in (9, 10, 11, 12) else 12
+        max_val = (1 << bits) - 1
+        return (_adc_read_raw(self._pin) * max_val) // 65535
+
+    def read_uv(self):
+        """Return microvolts assuming a 0..3.3V range (rough simulation)."""
+        return (_adc_read_raw(self._pin) * 3_300_000) // 65535
+
+
+def _serial_drain_pending(buf):
+    """Pull any bytes the editor's serial-monitor has pushed into the SAB ring."""
+    try:
+        import js
+        import base64  # noqa: F401  (kept for symmetry with write path)
+
+        indices = getattr(js, "__serial_in_indices", None)
+        data = getattr(js, "__serial_in_data", None)
+        if indices is None or data is None:
+            return
+        cap = int(getattr(js, "__serial_in_capacity", 0))
+        if cap <= 0:
+            return
+        r = int(js.Atomics.load(indices, 0))
+        w = int(js.Atomics.load(indices, 1))
+        while r != w:
+            buf.append(int(data[r]) & 0xFF)
+            r = (r + 1) % cap
+        js.Atomics.store(indices, 0, r)
+    except Exception:
+        pass
+
+
+class UART:
+    """Browser-simulated `machine.UART`.
+
+    A serial monitor pane appears in the editor when this is constructed.
+    `write()` text shows up there; characters typed into the input box arrive
+    via `read()` / `readline()` / `any()`.
+    """
+
+    INV_TX = 1
+    INV_RX = 2
+    INV_RTS = 4
+    INV_CTS = 8
+
+    def __init__(self, id=0, baudrate=115200, bits=8, parity=None, stop=1,
+                 tx=None, rx=None, timeout=0, **_kwargs):
+        self.id = int(id) if id is not None else 0
+        self.baudrate = int(baudrate)
+        self.bits = int(bits)
+        self.parity = parity
+        self.stop = int(stop)
+        self.tx = tx
+        self.rx = rx
+        self.timeout = int(timeout) if timeout is not None else 0
+        self._buf = bytearray()
+        try:
+            print("[serial-register]" + json.dumps({
+                "id": self.id,
+                "baudrate": self.baudrate,
+            }))
+        except Exception:
+            pass
+
+    def init(self, *args, **kwargs):
+        if args:
+            try:
+                self.baudrate = int(args[0])
+            except Exception:
+                pass
+        if "baudrate" in kwargs:
+            self.baudrate = int(kwargs["baudrate"])
+
+    def deinit(self):
+        self._buf = bytearray()
+
+    def any(self):
+        _serial_drain_pending(self._buf)
+        return len(self._buf)
+
+    def read(self, nbytes=None):
+        _serial_drain_pending(self._buf)
+        if not self._buf:
+            return None
+        if nbytes is None:
+            out = bytes(self._buf)
+            self._buf = bytearray()
+            return out
+        n = min(int(nbytes), len(self._buf))
+        if n <= 0:
+            return None
+        out = bytes(self._buf[:n])
+        del self._buf[:n]
+        return out
+
+    def readinto(self, buf, nbytes=None):
+        n = int(nbytes) if nbytes is not None else len(buf)
+        data = self.read(n)
+        if not data:
+            return None
+        for i, b in enumerate(data):
+            buf[i] = b
+        return len(data)
+
+    def readline(self):
+        _serial_drain_pending(self._buf)
+        if not self._buf:
+            return None
+        nl = self._buf.find(b"\n")
+        if nl == -1:
+            return None
+        out = bytes(self._buf[: nl + 1])
+        del self._buf[: nl + 1]
+        return out
+
+    def write(self, data):
+        if isinstance(data, str):
+            buf = data.encode("utf-8")
+        elif isinstance(data, (bytes, bytearray, memoryview)):
+            buf = bytes(data)
+        else:
+            buf = bytes([int(data) & 0xFF])
+        try:
+            import base64
+
+            encoded = base64.b64encode(buf).decode("ascii")
+            print(f"[serial-out]{encoded}")
+        except Exception:
+            pass
+        return len(buf)
+
+    def sendbreak(self):
+        pass
+
+    def flush(self):
+        pass
+
+    def txdone(self):
+        return True

lib/neopixel.py

@@ -0,0 +1,67 @@
+"""NeoPixel mock for Pyodide/browser execution.
+
+Supports a useful subset of MicroPython's neopixel.NeoPixel API:
+- NeoPixel(pin, n, bpp=3, timing=1)
+- __setitem__, __getitem__, __len__
+- fill(color)
+- write()  # prints current pixel buffer snapshot
+"""
+
+import json
+
+
+def _normalize_color(value, bpp: int):
+    if not hasattr(value, "__iter__"):
+        raise TypeError("Color must be an iterable, e.g. (r, g, b)")
+    parts = [int(v) for v in value]
+    if len(parts) != bpp:
+        raise ValueError(f"Expected {bpp} color channels, got {len(parts)}")
+    out = []
+    for channel in parts:
+        out.append(max(0, min(255, channel)))
+    return tuple(out)
+
+
+class NeoPixel:
+    def __init__(self, pin, n: int, bpp: int = 3, timing: int = 1):
+        self.pin = pin
+        self.n = int(n)
+        self.bpp = int(bpp)
+        self.timing = int(timing)
+        self._buf = [tuple([0] * self.bpp) for _ in range(self.n)]
+        # Tell the editor UI that this pin is the NeoPixel data line so its
+        # row in the Pins panel goes away (it would just look noisy — every
+        # `pixels.write()` flips it).
+        try:
+            pin_id = getattr(self.pin, "id", self.pin)
+            print(
+                "[pin-claim]"
+                + json.dumps({"pin": int(pin_id), "by": "neopixel"})
+            )
+        except Exception:
+            pass
+
+    def __len__(self):
+        return self.n
+
+    def __getitem__(self, index):
+        return self._buf[int(index)]
+
+    def __setitem__(self, index, color):
+        idx = int(index)
+        self._buf[idx] = _normalize_color(color, self.bpp)
+
+    def fill(self, color):
+        c = _normalize_color(color, self.bpp)
+        for i in range(self.n):
+            self._buf[i] = c
+
+    def write(self):
+        pin_id = getattr(self.pin, "id", self.pin)
+        payload = {
+            "type": "neopixel",
+            "pin": pin_id,
+            "pixels": [list(pixel) for pixel in self._buf],
+            "bpp": self.bpp,
+        }
+        print("[neopixel-json]" + json.dumps(payload))

scripts/serve_static_editor.py

@@ -0,0 +1,74 @@
+#!/usr/bin/env python3
+"""Serve only the contents of `src/static/` (HTML, CSS, JS, bundled stubs).
+
+Use this with **local mode** in the editor (`?local=1`): files live in IndexedDB,
+so no FastAPI file API is required. Maps `/` and `/editor` to `home.html` /
+`index.html` so links from the home page keep working.
+
+Sends ``Cross-Origin-Opener-Policy: same-origin`` and
+``Cross-Origin-Embedder-Policy: credentialless`` on every response so the page
+can become cross-origin isolated (SharedArrayBuffer for live ADC / pins /
+serial), matching the full FastAPI app.
+
+Example:
+
+    python scripts/serve_static_editor.py
+    # open http://127.0.0.1:8765/  then "Use locally" → /editor?local=1
+
+Note: Pyodide and CodeMirror still load from CDNs; you need network access.
+"""
+
+from __future__ import annotations
+
+import argparse
+from functools import partial
+from http.server import SimpleHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__.split("\n\n")[0])
+    parser.add_argument("--host", default="127.0.0.1", help="Bind address (default 127.0.0.1)")
+    parser.add_argument("--port", type=int, default=8765, help="Port (default 8765)")
+    args = parser.parse_args()
+
+    static_root = (Path(__file__).resolve().parent.parent / "src" / "static").resolve()
+    if not static_root.is_dir():
+        raise SystemExit(f"Static directory not found: {static_root}")
+
+    class Handler(SimpleHTTPRequestHandler):
+        def __init__(self, *a, **kw):
+            super().__init__(*a, directory=str(static_root), **kw)
+
+        def end_headers(self):
+            self.send_header("Cross-Origin-Opener-Policy", "same-origin")
+            self.send_header("Cross-Origin-Embedder-Policy", "credentialless")
+            super().end_headers()
+
+        def translate_path(self, path: str) -> str:
+            clean = path.split("?", 1)[0].split("#", 1)[0]
+            if clean.startswith("/static/"):
+                clean = clean[len("/static") :]  # e.g. /styles.css, /bundled-lib/machine.py
+            if clean in ("/", ""):
+                clean = "/home.html"
+            elif clean == "/editor" or clean.startswith("/editor/"):
+                clean = "/index.html"
+            elif clean == "/tutorial" or clean.startswith("/tutorial/"):
+                clean = "/tutorial.html"
+            elif clean == "/login" or clean.startswith("/login/"):
+                clean = "/login.html"
+            elif clean == "/register" or clean.startswith("/register/"):
+                clean = "/register.html"
+            return super().translate_path(clean)
+
+    httpd = ThreadingHTTPServer((args.host, args.port), Handler)
+    print(f"Serving {static_root} at http://{args.host}:{args.port}/")
+    print("Open / then use “Use locally” for IndexedDB workspace.")
+    try:
+        httpd.serve_forever()
+    except KeyboardInterrupt:
+        print("\nStopped.")
+
+
+if __name__ == "__main__":
+    main()

src/editor_app/config.py

@@ -28,3 +28,11 @@ load_env_file(PROJECT_ROOT / ".env")
 
 _default_workspace = PROJECT_ROOT / "workspace"
 WORKSPACE_ROOT = Path(os.environ.get("WORKSPACE_ROOT", str(_default_workspace))).resolve()
+
+# Canonical demo bundle root (`manifest.json` lives here). Sample `.py`
+# sources live under `demo/` (same idea as `bundled-lib/` for shared modules).
+# They ship with the static bundle (`/static/bundled-demos/...`) so a
+# static-only host also exposes them. `workspace/` is intentionally NOT used
+# for canonical data — it is treated as runtime/user state and is gitignored.
+BUNDLED_DEMOS_DIR = STATIC_DIR / "bundled-demos"
+BUNDLED_DEMOS_CODE_DIR = BUNDLED_DEMOS_DIR / "demo"

src/editor_app/db/models.py

@@ -54,4 +54,5 @@ class InviteToken(Base):
     consumed_by_user_id: Mapped[int | None] = mapped_column(
         ForeignKey("users.id", ondelete="SET NULL"), nullable=True, index=True
     )
+    grants_superuser: Mapped[bool] = mapped_column(Boolean, default=False)
     created_at: Mapped[dt.datetime] = mapped_column(DateTime, default=_utc_naive)

src/editor_app/deps.py

@@ -1,7 +1,6 @@
 from __future__ import annotations
 
 import os
-import re
 from pathlib import Path
 
 from fastapi import Cookie, Depends, Header, HTTPException, Query
@@ -11,6 +10,7 @@ from editor_app.db.session import get_db
 from editor_app.db.models import User
 from editor_app import config
 from editor_app.services import accounts
+from editor_app.services import user_workspace
 
 
 def api_key_valid(authorization: str | None) -> bool:
@@ -66,13 +66,8 @@ async def require_superuser(
     return user
 
 
-def _safe_workspace_leaf(user: User) -> str:
-    base = re.sub(r"[^a-zA-Z0-9._-]+", "-", user.username).strip("-").lower() or "user"
-    return f"{base}-{user.id}"
-
-
 def _seed_user_workspace(user_root: Path) -> None:
-    (user_root / "code").mkdir(parents=True, exist_ok=True)
+    user_workspace.ensure_default_code_main(user_root)
 
 
 async def get_workspace_root(
@@ -91,6 +86,6 @@ async def get_workspace_root(
         if lookup is None:
             raise HTTPException(status_code=404, detail="Workspace user not found")
         target_user = lookup
-    user_root = root / "users" / _safe_workspace_leaf(target_user)
+    user_root = user_workspace.user_workspace_root(target_user.id, target_user.username, workspace_root=root)
     _seed_user_workspace(user_root)
     return user_root

src/editor_app/main.py

@@ -1,8 +1,9 @@
 import os
 from contextlib import asynccontextmanager
 
-from fastapi import Depends, FastAPI
+from fastapi import Depends, FastAPI, Request
 from fastapi.staticfiles import StaticFiles
+from sqlalchemy import text
 from sqlalchemy.orm import sessionmaker
 
 from editor_app.config import STATIC_DIR, WORKSPACE_ROOT
@@ -13,14 +14,30 @@ from editor_app.routers.auth_routes import router as auth_router
 from editor_app.routers.files import router as files_router
 from editor_app.routers.frontend import router as frontend_router
 from editor_app.routers.users_admin import router as users_admin_router
-from editor_app.services import accounts
+from editor_app.services import accounts, user_workspace
 
 
 @asynccontextmanager
 async def lifespan(_app: FastAPI):
-    (WORKSPACE_ROOT / "lib").mkdir(parents=True, exist_ok=True)
+    # `workspace/` is gitignored runtime state. On a fresh clone it doesn't
+    # exist, and in no-auth dev mode the file tree would otherwise be empty
+    # — seed every bundled demo under top-level `demos/` (next to `code/`)
+    # so `pipenv run dev` after `git clone` Just Works without needing user
+    # accounts. Existing files are left alone (user edits are preserved).
+    WORKSPACE_ROOT.mkdir(parents=True, exist_ok=True)
+    user_workspace.seed_all_bundled_demos(WORKSPACE_ROOT)
+
     engine = get_engine()
     Base.metadata.create_all(bind=engine)
+    with engine.begin() as conn:
+        cols = conn.execute(text("PRAGMA table_info(invite_tokens)")).fetchall()
+        column_names = {row[1] for row in cols}
+        if column_names and "grants_superuser" not in column_names:
+            conn.execute(
+                text(
+                    "ALTER TABLE invite_tokens ADD COLUMN grants_superuser BOOLEAN NOT NULL DEFAULT 0"
+                )
+            )
     factory = sessionmaker(autocommit=False, autoflush=False, bind=engine)
     db = factory()
     try:
@@ -36,6 +53,18 @@ async def lifespan(_app: FastAPI):
 
 def create_app() -> FastAPI:
     app = FastAPI(lifespan=lifespan)
+
+    @app.middleware("http")
+    async def cross_origin_isolation(request: Request, call_next):
+        """Turn on `crossOriginIsolated` so the editor worker can use SharedArrayBuffer
+        (powers the live ADC slider). `credentialless` keeps no-credential cross-origin
+        imports (esm.sh, jsdelivr) loading without requiring CORP everywhere.
+        """
+        response = await call_next(request)
+        response.headers.setdefault("Cross-Origin-Opener-Policy", "same-origin")
+        response.headers.setdefault("Cross-Origin-Embedder-Policy", "credentialless")
+        return response
+
     app.mount("/static", StaticFiles(directory=str(STATIC_DIR)), name="static")
     app.include_router(frontend_router)
     app.include_router(auth_router)

src/editor_app/routers/frontend.py

@@ -1,11 +1,38 @@
 from fastapi import APIRouter
 from fastapi.responses import FileResponse
 
-from editor_app.config import STATIC_DIR
+from editor_app.config import PROJECT_ROOT, STATIC_DIR
 
 router = APIRouter()
 
 
+@router.get("/api/public/lib-bundle")
+async def serve_lib_bundle():
+    """Public, unauthenticated dump of the read-only `lib/` stubs.
+
+    Local-mode browsers (no login, files in IndexedDB) need access to the
+    MicroPython mocks so completion, diagnostics, and `runpy` can resolve
+    `from machine import …`. Reading these is read-only and contains no
+    user data, so it is safe to expose without auth."""
+    bundle_root = (PROJECT_ROOT / "lib").resolve()
+    files: dict[str, str] = {}
+    if bundle_root.is_dir():
+        for path in sorted(bundle_root.rglob("*.py")):
+            if not path.is_file():
+                continue
+            try:
+                rel = path.relative_to(bundle_root)
+            except ValueError:
+                continue
+            if any(part.startswith(".") for part in rel.parts):
+                continue
+            try:
+                files[str(rel).replace("\\", "/")] = path.read_text(encoding="utf-8")
+            except (UnicodeDecodeError, OSError):
+                continue
+    return {"files": files}
+
+
 @router.get("/")
 async def serve_home():
     return FileResponse(STATIC_DIR / "home.html")
@@ -16,6 +43,11 @@ async def serve_frontend():
     return FileResponse(STATIC_DIR / "index.html")
 
 
+@router.get("/tutorial")
+async def serve_tutorial():
+    return FileResponse(STATIC_DIR / "tutorial.html")
+
+
 @router.get("/login")
 async def serve_login():
     return FileResponse(STATIC_DIR / "login.html")
@@ -24,3 +56,10 @@ async def serve_login():
 @router.get("/register")
 async def serve_register():
     return FileResponse(STATIC_DIR / "register.html")
+
+
+@router.get("/users")
+async def serve_users():
+    """Admin panel for managing accounts and invites. Auth is enforced by
+    the underlying `/api/users*` endpoints, not the static page itself."""
+    return FileResponse(STATIC_DIR / "users.html")

src/editor_app/routers/users_admin.py

@@ -6,7 +6,7 @@ from sqlalchemy.orm import Session
 from editor_app.db.session import get_db
 from editor_app.db.models import User
 from editor_app.deps import require_superuser
-from editor_app.schemas.users import InviteCreateRequest, InviteCreateResponse, UserCreateAdmin, UserPublic
+from editor_app.schemas.users import InviteCreateRequest, InviteCreateResponse, UserPublic, UserUpdateAdmin
 from editor_app.services import accounts
 
 router = APIRouter(prefix="/api/users", tags=["users"])
@@ -20,21 +20,26 @@ async def list_users(
     return [UserPublic.model_validate(u) for u in accounts.list_users(db)]
 
 
-@router.post("", response_model=UserPublic)
-async def create_user_admin(
-    body: UserCreateAdmin,
-    admin: User = Depends(require_superuser),
+@router.patch("/{user_id}", response_model=UserPublic)
+async def patch_user_admin(
+    user_id: int,
+    body: UserUpdateAdmin,
+    _admin: User = Depends(require_superuser),
     db: Session = Depends(get_db),
 ) -> UserPublic:
-    if accounts.get_user_by_username(db, body.username):
-        raise HTTPException(status_code=409, detail="Username already taken")
-    user = accounts.create_user(
-        db,
-        body.username,
-        body.password,
-        is_superuser=body.is_superuser,
-    )
-    return UserPublic.model_validate(user)
+    try:
+        updated = accounts.update_user(
+            db,
+            user_id,
+            username=body.username,
+            password=body.password,
+            is_superuser=body.is_superuser,
+        )
+    except ValueError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+    if updated is None:
+        raise HTTPException(status_code=404, detail="User not found")
+    return UserPublic.model_validate(updated)
 
 
 @router.delete("/{user_id}")

src/editor_app/schemas/users.py

@@ -1,4 +1,4 @@
-from pydantic import BaseModel, Field, field_validator
+from pydantic import BaseModel, Field, field_validator, model_validator
 
 
 class RegisterRequest(BaseModel):
@@ -6,6 +6,14 @@ class RegisterRequest(BaseModel):
     password: str = Field(min_length=8, max_length=128)
     invite_token: str | None = Field(default=None, min_length=8, max_length=256)
 
+    @field_validator("invite_token", mode="before")
+    @classmethod
+    def normalize_invite_token(cls, v: object) -> object:
+        if isinstance(v, str):
+            s = v.strip()
+            return s if s else None
+        return v
+
     @field_validator("username")
     @classmethod
     def username_chars(cls, v: str) -> str:
@@ -28,19 +36,34 @@ class UserPublic(BaseModel):
     model_config = {"from_attributes": True}
 
 
-class UserCreateAdmin(BaseModel):
-    username: str = Field(min_length=3, max_length=64)
-    password: str = Field(min_length=8, max_length=128)
-    is_superuser: bool = False
+class UserUpdateAdmin(BaseModel):
+    username: str | None = Field(default=None, min_length=3, max_length=64)
+    password: str | None = Field(default=None, min_length=8, max_length=128)
+    is_superuser: bool | None = None
+
+    @field_validator("username", "password", mode="before")
+    @classmethod
+    def empty_str_to_none(cls, v: object) -> object:
+        if isinstance(v, str) and not v.strip():
+            return None
+        return v
 
     @field_validator("username")
     @classmethod
-    def username_chars(cls, v: str) -> str:
+    def username_chars(cls, v: str | None) -> str | None:
+        if v is None:
+            return None
         s = v.strip()
         if not s.replace("_", "").isalnum():
             raise ValueError("Username may only contain letters, numbers, and underscores")
         return s
 
+    @model_validator(mode="after")
+    def none_empty_patch(self):
+        if self.username is None and self.password is None and self.is_superuser is None:
+            raise ValueError("Provide username, password, and/or superuser changes")
+        return self
+
 
 class AuthStatusResponse(BaseModel):
     auth_enabled: bool

src/editor_app/services/accounts.py

@@ -12,6 +12,7 @@ from sqlalchemy import func, select
 from sqlalchemy.orm import Session
 
 from editor_app.db.models import AuthSession, InviteToken, User
+from editor_app.services import user_workspace
 
 if TYPE_CHECKING:
     pass
@@ -67,6 +68,10 @@ def create_user(db: Session, username: str, password: str, *, is_superuser: bool
     db.add(user)
     db.commit()
     db.refresh(user)
+    if auth_enabled():
+        user_workspace.ensure_default_code_main(
+            user_workspace.user_workspace_root(user.id, user.username)
+        )
     return user
 
 
@@ -83,7 +88,7 @@ def register_user_with_invite(db: Session, username: str, password: str, invite_
         raise ValueError("Invite is invalid or expired")
     if get_user_by_username(db, username):
         raise ValueError("Username already taken")
-    user = create_user(db, username, password, is_superuser=False)
+    user = create_user(db, username, password, is_superuser=bool(invite.grants_superuser))
     invite.used_at = _utc_naive()
     invite.consumed_by_user_id = user.id
     db.add(invite)
@@ -144,11 +149,59 @@ def delete_user(db: Session, user_id: int) -> bool:
     return True
 
 
+def update_user(
+    db: Session,
+    user_id: int,
+    *,
+    username: str | None = None,
+    password: str | None = None,
+    is_superuser: bool | None = None,
+) -> User | None:
+    user = get_user_by_id(db, user_id)
+    if user is None:
+        return None
+
+    old_username = user.username
+
+    if username is not None:
+        normalized = username.strip()
+        if normalized != old_username:
+            dup = db.scalars(select(User).where(User.username == normalized, User.id != user_id)).first()
+            if dup is not None:
+                raise ValueError("Username already taken")
+            user_workspace.rename_user_workspace_leaf(user_id, old_username, normalized)
+        user.username = normalized
+
+    if password is not None:
+        user.password_hash = hash_password(password)
+
+    if is_superuser is not None:
+        if user.is_superuser and not is_superuser:
+            remaining = db.scalar(
+                select(func.count())
+                .select_from(User)
+                .where(User.is_superuser.is_(True), User.id != user_id)
+            )
+            if not remaining:
+                raise ValueError("Cannot demote the last administrator")
+        user.is_superuser = is_superuser
+
+    db.add(user)
+    db.commit()
+    db.refresh(user)
+    return user
+
+
 def invite_required() -> bool:
-    return os.environ.get("AUTH_INVITE_ONLY", "false").strip().lower() in ("1", "true", "yes", "on")
+    return os.environ.get("AUTH_INVITE_ONLY", "true").strip().lower() in ("1", "true", "yes", "on")
 
 
-def create_invite(db: Session, email: str, invited_by_user_id: int | None = None, expires_days: int = 7) -> InviteToken:
+def create_invite(
+    db: Session,
+    email: str,
+    invited_by_user_id: int | None = None,
+    expires_days: int = 7,
+) -> InviteToken:
     token = secrets.token_urlsafe(36)
     expires = _utc_naive() + dt.timedelta(days=max(1, min(30, int(expires_days))))
     row = InviteToken(

src/editor_app/services/filesystem.py

@@ -7,7 +7,7 @@ from editor_app import config
 from editor_app.models import FileInfo
 
 LIB_DIR_NAME = "lib"
-WRITABLE_ROOTS = {"code"}
+WRITABLE_ROOTS = {"code", "demos"}
 
 
 def _workspace_root(workspace_root: Path | None = None) -> Path:
@@ -15,7 +15,13 @@ def _workspace_root(workspace_root: Path | None = None) -> Path:
 
 
 def _shared_lib_root() -> Path:
-    return (config.WORKSPACE_ROOT.resolve() / LIB_DIR_NAME).resolve()
+    """Shared MicroPython stubs ship in the repo `lib/` directory and are read directly.
+
+    Treating the bundle as the single source of truth means there is no on-disk
+    `workspace/lib/` cache to keep in sync — updates to e.g. `machine.py` flow
+    straight through to Pyodide and the file tree.
+    """
+    return (config.PROJECT_ROOT / LIB_DIR_NAME).resolve()
 
 
 def normalize_relative_path(relative_path: str) -> str:
@@ -27,6 +33,9 @@ def normalize_relative_path(relative_path: str) -> str:
     if len(parts) >= 2 and parts[0] == "code":
         while len(parts) >= 2 and parts[0] == parts[1] == "code":
             parts.pop(1)
+    if len(parts) >= 2 and parts[0] == "demos":
+        while len(parts) >= 2 and parts[0] == parts[1] == "demos":
+            parts.pop(1)
     return "/".join(parts)
 
 
@@ -50,16 +59,8 @@ def resolve_workspace_path(relative_path: str, workspace_root: Path | None = Non
 
 
 def _is_path_in_lib(target_path: Path, workspace_root: Path | None = None) -> bool:
-    workspace = _workspace_root(workspace_root)
-    lib_root = (workspace / LIB_DIR_NAME).resolve()
-    shared_lib_root = _shared_lib_root()
     try:
-        target_path.resolve().relative_to(lib_root)
-        return True
-    except ValueError:
-        pass
-    try:
-        target_path.resolve().relative_to(shared_lib_root)
+        target_path.resolve().relative_to(_shared_lib_root())
         return True
     except ValueError:
         return False
@@ -86,7 +87,7 @@ def _ensure_writable_path(target_path: Path, workspace_root: Path | None = None)
     if not _is_writable_path(target_path, workspace_root):
         raise HTTPException(
             status_code=403,
-            detail="Only code/ is writable (lib is read-only)",
+            detail="Only code/ and demos/ are writable (lib is read-only)",
         )
 
 
@@ -213,25 +214,24 @@ def delete_folder(folder_path: str, workspace_root: Path | None = None) -> None:
 
 
 def collect_python_sources(workspace_root: Path | None = None) -> dict[str, str]:
-    """Return all UTF-8 .py files under the workspace for browser-side Pyodide sync."""
+    """Return UTF-8 `.py` under the scoped workspace plus shared stubs from `WORKSPACE_ROOT/lib/` (bundled Micropython mocks for Jedi/completion and Pyodide)."""
     result: dict[str, str] = {}
     workspace = _workspace_root(workspace_root)
-    if not workspace.exists():
-        return result
-    for path in workspace.rglob("*.py"):
-        try:
-            rel = path.relative_to(workspace)
-        except ValueError:
-            continue
-        if any(part.startswith(".") for part in rel.parts):
-            continue
-        try:
-            key = str(rel).replace("\\", "/")
-            result[key] = path.read_text(encoding="utf-8")
-        except (UnicodeDecodeError, OSError):
-            continue
+    if workspace.exists():
+        for path in workspace.rglob("*.py"):
+            try:
+                rel = path.relative_to(workspace)
+            except ValueError:
+                continue
+            if any(part.startswith(".") for part in rel.parts):
+                continue
+            try:
+                key = str(rel).replace("\\", "/")
+                result[key] = path.read_text(encoding="utf-8")
+            except (UnicodeDecodeError, OSError):
+                continue
     shared_lib = _shared_lib_root()
-    if shared_lib.exists() and shared_lib.is_dir() and shared_lib != (workspace / LIB_DIR_NAME).resolve():
+    if shared_lib.is_dir():
         for path in shared_lib.rglob("*.py"):
             try:
                 rel = path.relative_to(shared_lib)

src/editor_app/services/user_workspace.py

@@ -0,0 +1,124 @@
+from __future__ import annotations
+
+import re
+import shutil
+from pathlib import Path
+
+from editor_app import config
+
+_BUNDLED_DEMO_PY_DIR = config.BUNDLED_DEMOS_CODE_DIR
+# Top-level workspace folder for shipped samples (sibling of ``code/``, like ``lib/``).
+_EDITOR_DEMOS_ROOT = "demos"
+
+DEFAULT_MAIN_PY = 'print("Hello, World!")\n'
+
+# Self-contained demos copied from static ``bundled-demos/demo/`` (stdlib + machine/neopixel/time only).
+# New accounts get a copy under ``<user_root>/demos/`` (same level as ``code/``).
+_CANONICAL_DEMO_FILENAMES = (
+    "pattern_rainbow_demo.py",
+    "pattern_twinkle_demo.py",
+    "pattern_chase_demo.py",
+    "adc_slider_demo.py",
+    "pin_demo.py",
+    "serial_demo.py",
+    "async_fetch_demo.py",
+    "aiohttp_fetch_demo.py",
+)
+
+
+def safe_workspace_leaf(username: str, user_id: int) -> str:
+    base = re.sub(r"[^a-zA-Z0-9._-]+", "-", username.strip()).strip("-").lower() or "user"
+    return f"{base}-{user_id}"
+
+
+def user_workspace_root(user_id: int, username: str, workspace_root: Path | None = None) -> Path:
+    root = (workspace_root or config.WORKSPACE_ROOT).resolve()
+    return root / "users" / safe_workspace_leaf(username, user_id)
+
+
+def _seed_canonical_demos(user_root: Path) -> None:
+    """Copy bundled demos into ``demos/`` if missing.
+
+    Reads from `BUNDLED_DEMOS_CODE_DIR` (``src/static/bundled-demos/demo/``).
+    Skips if the file already exists under ``demos/``, legacy ``code/<name>.py``,
+    or old ``code/demos/<name>.py``.
+    """
+    src_root = _BUNDLED_DEMO_PY_DIR.resolve()
+    demos_dir = user_root / _EDITOR_DEMOS_ROOT
+    code_dir = user_root / "code"
+    demos_dir.mkdir(parents=True, exist_ok=True)
+    for filename in _CANONICAL_DEMO_FILENAMES:
+        dst = demos_dir / filename
+        legacy_flat = code_dir / filename
+        legacy_nested = code_dir / "demos" / filename
+        if dst.exists() or legacy_flat.exists() or legacy_nested.exists():
+            continue
+        src = src_root / filename
+        if src.is_file():
+            dst.write_text(src.read_text(encoding="utf-8"), encoding="utf-8")
+
+
+def ensure_default_code_main(user_root: Path) -> None:
+    """Ensure ``code/main.py`` and canonical demos under top-level ``demos/``.
+
+    Demos are sourced from `BUNDLED_DEMOS_CODE_DIR` (the single committed home
+    for sample scripts). Only files listed in `_CANONICAL_DEMO_FILENAMES`
+    get auto-seeded — the rest are available via the editor's "Reset
+    demos" button or a manual copy."""
+    code_dir = user_root / "code"
+    code_dir.mkdir(parents=True, exist_ok=True)
+    main_py = code_dir / "main.py"
+    if not main_py.exists():
+        main_py.write_text(DEFAULT_MAIN_PY, encoding="utf-8")
+    _seed_canonical_demos(user_root)
+
+
+def seed_all_bundled_demos(user_root: Path) -> None:
+    """Copy *every* ``.py`` file in `BUNDLED_DEMOS_CODE_DIR` into ``<user_root>/demos/``.
+
+    Used at app startup to populate a fresh workspace with the full sample
+    set so a no-auth dev install (`pipenv run dev` after `git clone`) has
+    something to play with. Existing files are not overwritten — user edits
+    are preserved.
+    """
+    code_dir = user_root / "code"
+    code_dir.mkdir(parents=True, exist_ok=True)
+    main_py = code_dir / "main.py"
+    if not main_py.exists():
+        main_py.write_text(DEFAULT_MAIN_PY, encoding="utf-8")
+    demos_dir = user_root / _EDITOR_DEMOS_ROOT
+    demos_dir.mkdir(parents=True, exist_ok=True)
+    src_root = _BUNDLED_DEMO_PY_DIR.resolve()
+    if not src_root.is_dir():
+        return
+    for src in sorted(src_root.iterdir()):
+        if not src.is_file() or not src.name.endswith(".py"):
+            continue
+        dst = demos_dir / src.name
+        legacy_flat = code_dir / src.name
+        legacy_nested = code_dir / "demos" / src.name
+        if dst.exists() or legacy_flat.exists() or legacy_nested.exists():
+            continue
+        try:
+            dst.write_text(src.read_text(encoding="utf-8"), encoding="utf-8")
+        except (UnicodeDecodeError, OSError):
+            continue
+
+
+def rename_user_workspace_leaf(
+    user_id: int, old_username: str, new_username: str, workspace_root: Path | None = None
+) -> None:
+    """Rename per-user workspace directory when login name changes."""
+    root = (workspace_root or config.WORKSPACE_ROOT).resolve()
+    users_dir = root / "users"
+    src = users_dir / safe_workspace_leaf(old_username, user_id)
+    dst = users_dir / safe_workspace_leaf(new_username, user_id)
+    if src.resolve() == dst.resolve():
+        return
+    dst.parent.mkdir(parents=True, exist_ok=True)
+    if dst.exists():
+        raise ValueError("Workspace folder for new username already exists; pick another username.")
+    if src.exists():
+        shutil.move(str(src), str(dst))
+    else:
+        ensure_default_code_main(dst)

src/static/.reload-token

@@ -1 +0,0 @@
-1777623664358

src/static/bundled-demos/demo/adc_slider_demo.py

@@ -0,0 +1,55 @@
+"""ADC slider demo — drag the sliders that appear under the editor.
+
+Two simulated ADCs:
+  * pin 34 — sets the base hue of a rainbow
+  * pin 35 — sets overall brightness
+
+The strip lights up while the script runs; the values update live (no need to
+restart the script when you move the slider).
+"""
+
+import time
+
+from machine import ADC, Pin
+from neopixel import NeoPixel
+
+
+NUM_LEDS = 16
+strip = NeoPixel(Pin(5, Pin.OUT), NUM_LEDS)
+
+hue_pot = ADC(Pin(34))
+bri_pot = ADC(Pin(35))
+
+
+def hsv_to_rgb(h, s, v):
+    h = h - int(h)
+    i = int(h * 6)
+    f = h * 6 - i
+    p = v * (1 - s)
+    q = v * (1 - f * s)
+    t = v * (1 - (1 - f) * s)
+    if i == 0:
+        r, g, b = v, t, p
+    elif i == 1:
+        r, g, b = q, v, p
+    elif i == 2:
+        r, g, b = p, v, t
+    elif i == 3:
+        r, g, b = p, q, v
+    elif i == 4:
+        r, g, b = t, p, v
+    else:
+        r, g, b = v, p, q
+    return int(r * 255), int(g * 255), int(b * 255)
+
+
+print("Move the ADC sliders below the editor while this runs.")
+
+while True:
+    base_hue = hue_pot.read_u16() / 65535
+    brightness = bri_pot.read_u16() / 65535
+    for i in range(NUM_LEDS):
+        h = (base_hue + i / NUM_LEDS) % 1.0
+        strip[i] = hsv_to_rgb(h, 1.0, brightness)
+    strip.write()
+    time.sleep(0.04)

src/static/bundled-demos/demo/aiohttp_fetch_demo.py

@@ -0,0 +1,32 @@
+"""Async HTTPS GET of Pyodide’s lock file (browser-safe).
+
+Older Pyodide + ``aiohttp`` examples used ``ClientSession`` here, but the
+Pyodide ``aiohttp`` wheel often raises ``RuntimeError('SSL is not supported.')``
+for ``https://`` — there is no real Python TLS stack in the worker; traffic must
+go through the browser’s ``fetch``.
+
+This demo uses the shared ``browser_fetch`` helpers (``pyodide.http.pyfetch``
+under the hood), same idea as ``async_fetch_demo.py``.
+
+CORS still applies — jsDelivr allows cross-origin GETs. ``print(..., flush=True)``
+helps batched worker stdout appear before the run finishes.
+"""
+
+import asyncio
+
+from browser_fetch import fetch_json
+
+
+async def main():
+    url = "https://cdn.jsdelivr.net/pyodide/v0.26.4/full/pyodide-lock.json"
+    print("Fetching", url, "via browser_fetch.fetch_json ...", flush=True)
+    data = await fetch_json(url)
+    info = data.get("info") or {}
+    packages = data.get("packages") or {}
+    print("pyodide-lock version:", info.get("version"), flush=True)
+    print("python runtime     :", info.get("python"), flush=True)
+    print("indexed packages   :", len(packages), flush=True)
+    print("aiohttp wheel in lock:", "aiohttp" in packages, flush=True)
+
+
+asyncio.run(main())

src/static/bundled-demos/demo/async_fetch_demo.py

@@ -0,0 +1,27 @@
+"""Async HTTP in the browser (Pyodide).
+
+``aiohttp`` and similar clients use OS sockets, which Wasm does not provide, so
+a ``session.get(...)`` can hang after ``print("Running")`` with no body.
+
+Use ``pyodide.http.pyfetch`` or the shared ``browser_fetch`` helpers. From an
+HTTPS editor page, use ``https://`` URLs (mixed content blocks ``http://``).
+
+Many sites do not send CORS headers, so the browser blocks the response even
+when the URL is valid. This demo uses jsDelivr JSON that allows cross-origin
+GET (same host Pyodide loads from).
+"""
+
+import asyncio
+
+from browser_fetch import fetch_json
+
+
+async def main():
+    print("Running")
+    url = "https://cdn.jsdelivr.net/pyodide/v0.26.4/full/repodata.json"
+    data = await fetch_json(url)
+    info = data.get("info") or {}
+    print("Fetched repodata; pyodide lock says:", info.get("version"), info.get("python"))
+
+
+asyncio.run(main())

src/static/bundled-demos/demo/led_patterns.py

@@ -0,0 +1,143 @@
+"""LED pattern helpers inspired by embedded NeoPixel drivers."""
+
+from __future__ import annotations
+
+import random
+
+
+Color = tuple[int, int, int]
+
+
+def _clamp(channel: int) -> int:
+    return max(0, min(255, int(channel)))
+
+
+def wheel(pos: int) -> Color:
+    """Return a rainbow color for position 0-255."""
+    pos = 255 - (pos & 255)
+    if pos < 85:
+        return (_clamp(255 - pos * 3), 0, _clamp(pos * 3))
+    if pos < 170:
+        pos -= 85
+        return (0, _clamp(pos * 3), _clamp(255 - pos * 3))
+    pos -= 170
+    return (_clamp(pos * 3), _clamp(255 - pos * 3), 0)
+
+
+def rainbow_frame(led_count: int, frame: int, step: int = 4) -> list[Color]:
+    """Generate one rainbow frame across all LEDs."""
+    if led_count <= 0:
+        return []
+    return [wheel((i * 256 // led_count + frame * step) & 255) for i in range(led_count)]
+
+
+def chase_frame(
+    led_count: int,
+    frame: int,
+    color: Color = (255, 120, 0),
+    tail: Color = (16, 0, 0),
+) -> list[Color]:
+    """Generate a two-pixel chase pattern."""
+    if led_count <= 0:
+        return []
+    out: list[Color] = [(0, 0, 0) for _ in range(led_count)]
+    head = frame % led_count
+    trail = (head - 1) % led_count
+    out[trail] = tuple(_clamp(v) for v in tail)  # type: ignore[assignment]
+    out[head] = tuple(_clamp(v) for v in color)  # type: ignore[assignment]
+    return out
+
+
+def _bounce_head_index(led_count: int, frame: int) -> int:
+    """Map frame to a triangular index sweep 0..N-1..0 (Ping-Pong position)."""
+    if led_count <= 1:
+        return 0
+    span = led_count - 1
+    cycle = span * 2
+    if cycle <= 0:
+        return 0
+    t = frame % cycle
+    return t if t <= span else 2 * span - t
+
+
+def _bounce_phase_tail_direction(led_count: int, frame: int) -> int:
+    """Extend tail opposite motion: -1 fades toward lower indices, +1 toward higher."""
+    if led_count <= 1:
+        return -1
+    span = led_count - 1
+    cycle = span * 2
+    if cycle <= 0:
+        return -1
+    t = frame % cycle
+    if t <= span:
+        return -1
+    return 1
+
+
+def knight_rider_scanner_frame(
+    led_count: int,
+    frame: int,
+    head_color: Color = (220, 0, 28),
+    tail_len: int = 8,
+    falloff_gamma: float = 2.6,
+) -> list[Color]:
+    """KITT-style bouncing scanner: saturated head with exponential tail fading to off."""
+    if led_count <= 0:
+        return []
+    out: list[Color] = [(0, 0, 0) for _ in range(led_count)]
+    tl = max(1, tail_len)
+    head = _bounce_head_index(led_count, frame)
+    direc = _bounce_phase_tail_direction(led_count, frame)
+    gamma = max(1.05, falloff_gamma)
+    for rk in reversed(range(tl)):
+        idx = head + direc * rk
+        if idx < 0 or idx >= led_count:
+            continue
+        w = max(0.0, float(tl - rk) / float(tl))
+        strength = w**gamma
+        out[idx] = tuple(_clamp(int(head_color[ch] * strength)) for ch in range(3))
+    return out
+
+
+def scanner_bounce_frame(
+    led_count: int,
+    frame: int,
+    head_color: Color = (0, 220, 255),
+    tail_color: Color = (0, 40, 90),
+    tail_len: int = 5,
+) -> list[Color]:
+    """Ping-pong scanner: head reverses at both ends with a directional fading tail."""
+    if led_count <= 0:
+        return []
+    out: list[Color] = [(0, 0, 0) for _ in range(led_count)]
+    tl = max(1, tail_len)
+    for rk in reversed(range(tl)):
+        past = frame - rk
+        if past < 0:
+            continue
+        idx = _bounce_head_index(led_count, past)
+        strength = max(0.0, float(tl - rk) / float(tl))
+        if rk == 0:
+            out[idx] = tuple(_clamp(int(c)) for c in head_color)
+        else:
+            out[idx] = tuple(_clamp(int(tail_color[i] * strength)) for i in range(3))
+    return out
+
+
+def twinkle_frame(
+    led_count: int,
+    frame: int,
+    base: Color = (0, 0, 8),
+    sparkle: Color = (255, 255, 180),
+    sparkles: int = 3,
+    seed: int = 1337,
+) -> list[Color]:
+    """Generate deterministic twinkle frames for testing/replay."""
+    if led_count <= 0:
+        return []
+    out: list[Color] = [tuple(_clamp(v) for v in base) for _ in range(led_count)]  # type: ignore[list-item]
+    rng = random.Random(seed + frame)
+    for _ in range(min(max(0, sparkles), led_count)):
+        idx = rng.randrange(led_count)
+        out[idx] = tuple(_clamp(v) for v in sparkle)  # type: ignore[assignment]
+    return out

src/static/bundled-demos/demo/pattern_chase_demo.py

@@ -0,0 +1,83 @@
+"""Knight Rider–style bouncing scanner — self-contained (stdlib + simulated hardware only)."""
+
+import time
+
+from machine import Pin
+import neopixel
+
+# --- helpers
+
+
+def _clamp(channel: int) -> int:
+    return max(0, min(255, int(channel)))
+
+
+def _bounce_head_index(led_count: int, frame: int) -> int:
+    if led_count <= 1:
+        return 0
+    span = led_count - 1
+    cycle = span * 2
+    if cycle <= 0:
+        return 0
+    t = frame % cycle
+    return t if t <= span else 2 * span - t
+
+
+def _bounce_phase_tail_direction(led_count: int, frame: int) -> int:
+    if led_count <= 1:
+        return -1
+    span = led_count - 1
+    cycle = span * 2
+    if cycle <= 0:
+        return -1
+    t = frame % cycle
+    if t <= span:
+        return -1
+    return 1
+
+
+def knight_rider_scanner_frame(
+    led_count: int,
+    frame: int,
+    head_color=(220, 0, 28),
+    tail_len: int = 8,
+    falloff_gamma: float = 2.6,
+):
+    if led_count <= 0:
+        return []
+    out = [(0, 0, 0) for _ in range(led_count)]
+    tl = max(1, tail_len)
+    head = _bounce_head_index(led_count, frame)
+    direc = _bounce_phase_tail_direction(led_count, frame)
+    gamma = max(1.05, falloff_gamma)
+    for rk in reversed(range(tl)):
+        idx = head + direc * rk
+        if idx < 0 or idx >= led_count:
+            continue
+        w = max(0.0, float(tl - rk) / float(tl))
+        strength = w**gamma
+        out[idx] = tuple(_clamp(int(head_color[ch] * strength)) for ch in range(3))
+    return out
+
+
+# --- demo
+
+NUM_LEDS = 16
+
+np = neopixel.NeoPixel(Pin(4), NUM_LEDS)
+
+for frame in range(200):
+    frame_colors = knight_rider_scanner_frame(
+        len(np),
+        frame,
+        head_color=(220, 0, 36),
+        tail_len=10,
+        falloff_gamma=2.85,
+    )
+    for i, color in enumerate(frame_colors):
+        np[i] = color
+    np.write()
+    time.sleep(0.05)
+
+np.fill((0, 0, 0))
+np.write()

src/static/bundled-demos/demo/pattern_rainbow_demo.py

@@ -0,0 +1,47 @@
+"""Rainbow NeoPixel sweep — self-contained (stdlib + simulated hardware only)."""
+
+import time
+
+from machine import Pin
+import neopixel
+
+# --- helpers (same logic as bundled led_patterns.py, inlined here)
+
+
+def _clamp(channel: int) -> int:
+    return max(0, min(255, int(channel)))
+
+
+def wheel(pos: int):
+    """Return rainbow RGB at position 0–255."""
+    pos = 255 - (pos & 255)
+    if pos < 85:
+        return (_clamp(255 - pos * 3), 0, _clamp(pos * 3))
+    if pos < 170:
+        pos -= 85
+        return (0, _clamp(pos * 3), _clamp(255 - pos * 3))
+    pos -= 170
+    return (_clamp(pos * 3), _clamp(255 - pos * 3), 0)
+
+
+def rainbow_frame(led_count: int, frame: int, step: int = 4):
+    if led_count <= 0:
+        return []
+    return [wheel((i * 256 // led_count + frame * step) & 255) for i in range(led_count)]
+
+
+# --- demo
+
+NUM_LEDS = 16
+
+np = neopixel.NeoPixel(Pin(4), NUM_LEDS)
+
+for frame in range(120):
+    frame_colors = rainbow_frame(len(np), frame, step=5)
+    for i, color in enumerate(frame_colors):
+        np[i] = color
+    np.write()
+    time.sleep(0.05)
+
+np.fill((0, 0, 0))
+np.write()

src/static/bundled-demos/demo/pattern_twinkle_demo.py

@@ -0,0 +1,54 @@
+"""Twinkle NeoPixel demo — self-contained (stdlib + simulated hardware only)."""
+
+import random
+import time
+
+from machine import Pin
+import neopixel
+
+# --- helpers
+
+
+def _clamp(channel: int) -> int:
+    return max(0, min(255, int(channel)))
+
+
+def twinkle_frame(
+    led_count: int,
+    frame: int,
+    base=(0, 0, 8),
+    sparkle=(255, 255, 180),
+    sparkles: int = 3,
+    seed: int = 1337,
+):
+    if led_count <= 0:
+        return []
+    out = [tuple(_clamp(v) for v in base) for _ in range(led_count)]
+    rng = random.Random(seed + frame)
+    for _ in range(min(max(0, sparkles), led_count)):
+        idx = rng.randrange(led_count)
+        out[idx] = tuple(_clamp(v) for v in sparkle)
+    return out
+
+
+# --- demo
+
+NUM_LEDS = 16
+
+np = neopixel.NeoPixel(Pin(4), NUM_LEDS)
+
+for frame in range(120):
+    frame_colors = twinkle_frame(
+        len(np),
+        frame,
+        base=(0, 0, 6),
+        sparkle=(255, 210, 130),
+        sparkles=3,
+    )
+    for i, color in enumerate(frame_colors):
+        np[i] = color
+    np.write()
+    time.sleep(0.08)
+
+np.fill((0, 0, 0))
+np.write()

src/static/bundled-demos/demo/pin_demo.py

@@ -0,0 +1,56 @@
+"""Pin features demo.
+
+A "Pins" panel appears below the editor while this script runs:
+
+  * Pin 2  (OUT) — blinks automatically every ~200 ms via ``.value(...)``.
+  * Pin 4  (OUT) — stays put until you press the button, then flips
+                   (driven from the IRQ handler with ``.toggle()``).
+  * Pin 0  (IN)  — click the toggle button in the panel to drive a 0 → 1
+                   rising edge; the IRQ fires and flips pin 4.
+  * Pin 13 (PWM) — duty sweeps up and down; the bar shows the live duty.
+"""
+
+import time
+
+from machine import Pin, PWM
+
+
+led_a = Pin(2, Pin.OUT)
+led_b = Pin(4, Pin.OUT)
+button = Pin(0, Pin.IN, Pin.PULL_UP)
+fader = PWM(Pin(13), freq=1000, duty_u16=0)
+
+
+def on_button(pin):
+    # Pin 4 is IRQ-driven on purpose — its only source of change is the
+    # button press, so when you see it flip you know the IRQ fired.
+    led_b.toggle()
+
+
+button.irq(handler=on_button, trigger=Pin.IRQ_RISING)
+
+
+tick = 0
+duty = 0
+direction = 1024
+
+while True:
+    # Pin 2: fast on/off via direct .value(...) writes (no IRQ involvement).
+    led_a.value(tick % 2)
+
+    # Pin 13: triangular duty sweep so the PWM bar visibly fills and drains.
+    duty += direction
+    if duty >= 65535:
+        duty = 65535
+        direction = -1024
+    elif duty <= 0:
+        duty = 0
+        direction = 1024
+    fader.duty_u16(duty)
+
+    # Poll the IN pin so its IRQ actually fires when the panel button changes.
+    # (`.value()` reads the current state and dispatches any pending edge.)
+    button.value()
+
+    tick += 1
+    time.sleep(0.1)

src/static/bundled-demos/demo/serial_demo.py

@@ -0,0 +1,90 @@
+"""Serial in/out demo.
+
+When this script runs, a "Serial monitor" pane appears below the editor.
+
+Try this:
+  * type   hello       and press Enter            -> Python echoes "echo: hello"
+  * type   color red                              -> the strip turns red
+  * try    color 0,128,255                        -> any (r,g,b) tuple works
+  * type   off                                    -> strip blanks
+  * type   bye                                    -> script exits cleanly
+
+Anything Python `write()`s to the UART shows up in green; what you type back
+is shown in white.
+"""
+
+import time
+
+from machine import Pin, UART
+from neopixel import NeoPixel
+
+
+NUM_LEDS = 16
+strip = NeoPixel(Pin(5, Pin.OUT), NUM_LEDS)
+uart = UART(0, baudrate=115200)
+
+PALETTE = {
+    "red": (255, 0, 0),
+    "green": (0, 255, 0),
+    "blue": (0, 0, 255),
+    "white": (200, 200, 200),
+    "purple": (160, 0, 200),
+    "orange": (255, 110, 0),
+}
+
+
+def fill(color):
+    strip.fill(color)
+    strip.write()
+
+
+def parse_color(arg):
+    arg = arg.strip().lower()
+    if arg in PALETTE:
+        return PALETTE[arg]
+    parts = [p for p in arg.replace(",", " ").split() if p]
+    if len(parts) == 3:
+        try:
+            return tuple(max(0, min(255, int(p))) for p in parts)
+        except ValueError:
+            return None
+    return None
+
+
+uart.write("ready. commands: color <name|r,g,b> | off | bye\n")
+fill((0, 0, 0))
+
+running = True
+while running:
+    line = uart.readline()
+    if line is None:
+        time.sleep(0.05)
+        continue
+
+    text = line.decode("utf-8", errors="replace").strip()
+    if not text:
+        continue
+
+    if text == "bye":
+        uart.write("goodbye!\n")
+        running = False
+        break
+
+    if text == "off":
+        fill((0, 0, 0))
+        uart.write("strip off\n")
+        continue
+
+    if text.startswith("color"):
+        rest = text[len("color"):].strip()
+        color = parse_color(rest) if rest else None
+        if color is None:
+            uart.write("usage: color <name> | color r,g,b\n")
+        else:
+            fill(color)
+            uart.write(f"strip = {color}\n")
+        continue
+
+    uart.write(f"echo: {text}\n")
+
+fill((0, 0, 0))

src/static/bundled-demos/manifest.json

@@ -0,0 +1,11 @@
+{
+  "files": [
+    "demo/pattern_rainbow_demo.py",
+    "demo/pattern_twinkle_demo.py",
+    "demo/pattern_chase_demo.py",
+    "demo/adc_slider_demo.py",
+    "demo/pin_demo.py",
+    "demo/serial_demo.py",
+    "demo/aiohttp_fetch_demo.py"
+  ]
+}

src/static/bundled-lib/browser_fetch.py

@@ -0,0 +1,38 @@
+"""Browser-friendly async HTTP for the Pyodide worker.
+
+These helpers use ``pyodide.http.pyfetch``, which maps to the browser
+``fetch`` API (no Python TLS stack). Prefer them for ``https://`` in
+Pyodide: ``aiohttp`` in the worker often raises
+``RuntimeError('SSL is not supported.')`` for HTTPS even though the wheel
+exists, because user-level SSL is not wired the same as on CPython.
+
+The browser's normal rules apply: the page is served over HTTPS so
+``http://`` URLs are blocked as mixed content, and the response host must
+send permissive CORS headers (e.g. ``Access-Control-Allow-Origin``) or the
+browser hides the body even if the request succeeded.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+async def fetch_text(url: str) -> str:
+    from pyodide.http import pyfetch
+
+    r = await pyfetch(url)
+    return await r.text()
+
+
+async def fetch_bytes(url: str) -> bytes:
+    from pyodide.http import pyfetch
+
+    r = await pyfetch(url)
+    return await r.bytes()
+
+
+async def fetch_json(url: str, **kwargs: Any) -> Any:
+    from pyodide.http import pyfetch
+
+    r = await pyfetch(url)
+    return await r.json(**kwargs)

src/static/bundled-lib/machine.py

@@ -0,0 +1,419 @@
+"""Minimal MicroPython-style machine module mock for browser simulation."""
+
+import json
+
+
+_PIN_MODE_OUT = 1
+_PIN_MODE_IN = 2
+_PIN_MODE_PWM = 4
+
+
+def _pin_view_get(name):
+    try:
+        import js
+
+        return getattr(js, name, None)
+    except Exception:
+        return None
+
+
+def _pin_out_publish(pin_id, ui_mode, value):
+    """Pack [ui_mode (high byte) | value (low 24 bits)] for the UI panel."""
+    view = _pin_view_get("__pin_out_view")
+    if view is None:
+        return
+    packed = ((int(ui_mode) & 0xFF) << 24) | (int(value) & 0x00FFFFFF)
+    try:
+        import js
+
+        js.Atomics.store(view, int(pin_id), packed)
+    except Exception:
+        try:
+            view[int(pin_id)] = packed
+        except Exception:
+            pass
+
+
+def _pin_in_read(pin_id):
+    view = _pin_view_get("__pin_in_view")
+    if view is None:
+        return 0
+    try:
+        import js
+
+        return int(js.Atomics.load(view, int(pin_id))) & 1
+    except Exception:
+        try:
+            return int(view[int(pin_id)]) & 1
+        except Exception:
+            return 0
+
+
+def _pin_register(pin_id, ui_mode, **extra):
+    payload = {"pin": int(pin_id), "mode": int(ui_mode)}
+    payload.update({k: v for k, v in extra.items() if v is not None})
+    try:
+        print("[pin-register]" + json.dumps(payload))
+    except Exception:
+        pass
+
+
+class Pin:
+    """Browser-simulated `machine.Pin`.
+
+    A control row appears in the editor UI when a pin is constructed:
+      * `Pin.OUT` pins show a live indicator that mirrors `value()`.
+      * `Pin.IN` pins show a toggle button you can click — the next call
+        to `value()` returns 0 or 1 accordingly.
+    """
+
+    IN = 0
+    OUT = 1
+    PULL_UP = 2
+    PULL_DOWN = 3
+    OPEN_DRAIN = 7
+
+    IRQ_FALLING = 1
+    IRQ_RISING = 2
+
+    def __init__(self, pin_id, mode=OUT, pull=-1, value=None, **_kwargs):
+        self.id = int(pin_id)
+        self.mode = int(mode)
+        self.pull = int(pull) if pull != -1 else -1
+        self._value = 1 if value else 0
+        self._irq_handler = None
+        self._irq_trigger = 0
+        self._last_input = 0
+        self._publish()
+
+    def _ui_mode(self):
+        if self.mode == self.IN:
+            return _PIN_MODE_IN
+        return _PIN_MODE_OUT
+
+    def _publish(self):
+        ui_mode = self._ui_mode()
+        _pin_register(self.id, ui_mode, pull=self.pull if self.pull != -1 else None)
+        if ui_mode == _PIN_MODE_OUT:
+            _pin_out_publish(self.id, ui_mode, self._value)
+
+    def init(self, mode=-1, pull=-1, value=None):
+        if mode != -1:
+            self.mode = int(mode)
+        if pull != -1:
+            self.pull = int(pull)
+        if value is not None:
+            self._value = 1 if int(value) else 0
+        self._publish()
+
+    def value(self, new_value=None):
+        if new_value is None:
+            if self.mode == self.IN:
+                v = _pin_in_read(self.id)
+                if self._irq_handler is not None:
+                    if v and not self._last_input and (self._irq_trigger & self.IRQ_RISING):
+                        self._fire_irq()
+                    elif not v and self._last_input and (self._irq_trigger & self.IRQ_FALLING):
+                        self._fire_irq()
+                self._last_input = v
+                return v
+            return self._value
+        v = 1 if int(new_value) else 0
+        self._value = v
+        if self._ui_mode() == _PIN_MODE_OUT:
+            _pin_out_publish(self.id, _PIN_MODE_OUT, v)
+        return v
+
+    def on(self):
+        return self.value(1)
+
+    def off(self):
+        return self.value(0)
+
+    def high(self):
+        return self.value(1)
+
+    def low(self):
+        return self.value(0)
+
+    def toggle(self):
+        return self.value(0 if (self._value if self.mode == self.OUT else _pin_in_read(self.id)) else 1)
+
+    def irq(self, handler=None, trigger=IRQ_RISING | IRQ_FALLING, **_kwargs):
+        self._irq_handler = handler
+        self._irq_trigger = int(trigger)
+        return self
+
+    def _fire_irq(self):
+        if self._irq_handler is None:
+            return
+        try:
+            self._irq_handler(self)
+        except Exception as exc:
+            try:
+                print(f"[pin] irq handler raised: {exc!r}")
+            except Exception:
+                pass
+
+    def __call__(self, *args):
+        return self.value(*args) if args else self.value()
+
+
+class PWM:
+    """Browser-simulated `machine.PWM`.
+
+    Visualises the configured duty cycle as a bar in the Pins panel.
+    `freq()` and `duty()`/`duty_u16()`/`duty_ns()` mirror MicroPython's API.
+    """
+
+    def __init__(self, pin, freq=1000, duty=None, duty_u16=None, duty_ns=None):
+        self._pin_id = _adc_pin_id(pin)
+        self._freq = int(freq) if freq else 1000
+        self._duty_u16 = 0
+        if duty_u16 is not None:
+            self._duty_u16 = max(0, min(65535, int(duty_u16)))
+        elif duty is not None:
+            self._duty_u16 = max(0, min(65535, int(duty) * 64))
+        elif duty_ns is not None:
+            self._set_duty_ns(int(duty_ns))
+        _pin_register(self._pin_id, _PIN_MODE_PWM, freq=self._freq)
+        _pin_out_publish(self._pin_id, _PIN_MODE_PWM, self._duty_u16)
+
+    def _set_duty_ns(self, ns):
+        period_ns = 1_000_000_000 // max(1, self._freq)
+        if period_ns <= 0:
+            self._duty_u16 = 0
+            return
+        self._duty_u16 = max(0, min(65535, int(ns) * 65535 // period_ns))
+
+    def freq(self, value=None):
+        if value is None:
+            return self._freq
+        self._freq = max(1, int(value))
+        _pin_register(self._pin_id, _PIN_MODE_PWM, freq=self._freq)
+
+    def duty(self, value=None):
+        if value is None:
+            return self._duty_u16 // 64
+        self._duty_u16 = max(0, min(65535, int(value) * 64))
+        _pin_out_publish(self._pin_id, _PIN_MODE_PWM, self._duty_u16)
+
+    def duty_u16(self, value=None):
+        if value is None:
+            return self._duty_u16
+        self._duty_u16 = max(0, min(65535, int(value)))
+        _pin_out_publish(self._pin_id, _PIN_MODE_PWM, self._duty_u16)
+
+    def duty_ns(self, value=None):
+        period_ns = 1_000_000_000 // max(1, self._freq)
+        if value is None:
+            return (self._duty_u16 * period_ns) // 65535
+        self._set_duty_ns(int(value))
+        _pin_out_publish(self._pin_id, _PIN_MODE_PWM, self._duty_u16)
+
+    def deinit(self):
+        _pin_out_publish(self._pin_id, 0, 0)
+
+
+def _adc_pin_id(pin):
+    if isinstance(pin, int):
+        return pin
+    return int(getattr(pin, "id", 0))
+
+
+def _adc_read_raw(pin_id: int) -> int:
+    """Read the live slider value (0..65535) shared from the editor UI.
+
+    Backed by a SharedArrayBuffer so updates from the browser slider propagate
+    instantly without the script having to yield. Falls back to 0 when the
+    runtime is not cross-origin isolated (e.g. older browsers).
+    """
+    try:
+        import js  # only available inside Pyodide
+
+        view = getattr(js, "__adc_view", None)
+        if view is None:
+            return 0
+        try:
+            return int(js.Atomics.load(view, pin_id)) & 0xFFFF
+        except Exception:
+            return int(view[pin_id]) & 0xFFFF
+    except Exception:
+        return 0
+
+
+class ADC:
+    """Browser-simulated `machine.ADC`.
+
+    Exposes a slider in the editor UI for the given pin. `read_u16()` returns
+    the slider value in the 0..65535 range (matching MicroPython's API);
+    `read()` scales to the configured `width` (defaults to 12-bit, 0..4095).
+    """
+
+    WIDTH_9BIT = 9
+    WIDTH_10BIT = 10
+    WIDTH_11BIT = 11
+    WIDTH_12BIT = 12
+    ATTN_0DB = 0
+    ATTN_2_5DB = 1
+    ATTN_6DB = 2
+    ATTN_11DB = 3
+
+    def __init__(self, pin):
+        self._pin = _adc_pin_id(pin)
+        self._atten = self.ATTN_11DB
+        self._width = self.WIDTH_12BIT
+        try:
+            print("[adc-register]" + json.dumps({"pin": self._pin}))
+        except Exception:
+            pass
+
+    def atten(self, attn):
+        self._atten = int(attn)
+
+    def width(self, width):
+        self._width = int(width)
+
+    def read_u16(self):
+        return _adc_read_raw(self._pin)
+
+    def read(self):
+        bits = self._width if self._width in (9, 10, 11, 12) else 12
+        max_val = (1 << bits) - 1
+        return (_adc_read_raw(self._pin) * max_val) // 65535
+
+    def read_uv(self):
+        """Return microvolts assuming a 0..3.3V range (rough simulation)."""
+        return (_adc_read_raw(self._pin) * 3_300_000) // 65535
+
+
+def _serial_drain_pending(buf):
+    """Pull any bytes the editor's serial-monitor has pushed into the SAB ring."""
+    try:
+        import js
+        import base64  # noqa: F401  (kept for symmetry with write path)
+
+        indices = getattr(js, "__serial_in_indices", None)
+        data = getattr(js, "__serial_in_data", None)
+        if indices is None or data is None:
+            return
+        cap = int(getattr(js, "__serial_in_capacity", 0))
+        if cap <= 0:
+            return
+        r = int(js.Atomics.load(indices, 0))
+        w = int(js.Atomics.load(indices, 1))
+        while r != w:
+            buf.append(int(data[r]) & 0xFF)
+            r = (r + 1) % cap
+        js.Atomics.store(indices, 0, r)
+    except Exception:
+        pass
+
+
+class UART:
+    """Browser-simulated `machine.UART`.
+
+    A serial monitor pane appears in the editor when this is constructed.
+    `write()` text shows up there; characters typed into the input box arrive
+    via `read()` / `readline()` / `any()`.
+    """
+
+    INV_TX = 1
+    INV_RX = 2
+    INV_RTS = 4
+    INV_CTS = 8
+
+    def __init__(self, id=0, baudrate=115200, bits=8, parity=None, stop=1,
+                 tx=None, rx=None, timeout=0, **_kwargs):
+        self.id = int(id) if id is not None else 0
+        self.baudrate = int(baudrate)
+        self.bits = int(bits)
+        self.parity = parity
+        self.stop = int(stop)
+        self.tx = tx
+        self.rx = rx
+        self.timeout = int(timeout) if timeout is not None else 0
+        self._buf = bytearray()
+        try:
+            print("[serial-register]" + json.dumps({
+                "id": self.id,
+                "baudrate": self.baudrate,
+            }))
+        except Exception:
+            pass
+
+    def init(self, *args, **kwargs):
+        if args:
+            try:
+                self.baudrate = int(args[0])
+            except Exception:
+                pass
+        if "baudrate" in kwargs:
+            self.baudrate = int(kwargs["baudrate"])
+
+    def deinit(self):
+        self._buf = bytearray()
+
+    def any(self):
+        _serial_drain_pending(self._buf)
+        return len(self._buf)
+
+    def read(self, nbytes=None):
+        _serial_drain_pending(self._buf)
+        if not self._buf:
+            return None
+        if nbytes is None:
+            out = bytes(self._buf)
+            self._buf = bytearray()
+            return out
+        n = min(int(nbytes), len(self._buf))
+        if n <= 0:
+            return None
+        out = bytes(self._buf[:n])
+        del self._buf[:n]
+        return out
+
+    def readinto(self, buf, nbytes=None):
+        n = int(nbytes) if nbytes is not None else len(buf)
+        data = self.read(n)
+        if not data:
+            return None
+        for i, b in enumerate(data):
+            buf[i] = b
+        return len(data)
+
+    def readline(self):
+        _serial_drain_pending(self._buf)
+        if not self._buf:
+            return None
+        nl = self._buf.find(b"\n")
+        if nl == -1:
+            return None
+        out = bytes(self._buf[: nl + 1])
+        del self._buf[: nl + 1]
+        return out
+
+    def write(self, data):
+        if isinstance(data, str):
+            buf = data.encode("utf-8")
+        elif isinstance(data, (bytes, bytearray, memoryview)):
+            buf = bytes(data)
+        else:
+            buf = bytes([int(data) & 0xFF])
+        try:
+            import base64
+
+            encoded = base64.b64encode(buf).decode("ascii")
+            print(f"[serial-out]{encoded}")
+        except Exception:
+            pass
+        return len(buf)
+
+    def sendbreak(self):
+        pass
+
+    def flush(self):
+        pass
+
+    def txdone(self):
+        return True

src/static/home.html

@@ -3,7 +3,7 @@
 <head>
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>Python Editor</title>
+  <title>LED Editor</title>
   <link rel="icon" href="data:,">
   <style>
     * { box-sizing: border-box; }
@@ -15,289 +15,152 @@
       font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
       background: linear-gradient(135deg, #0f172a, #1e293b);
       color: #e2e8f0;
+      padding: 1rem;
     }
     .home-card {
-      width: min(560px, 92vw);
+      width: min(420px, 100%);
       background: rgba(15, 23, 42, 0.78);
       border: 1px solid rgba(148, 163, 184, 0.25);
       border-radius: 14px;
       padding: 2rem;
       box-shadow: 0 20px 45px rgba(0, 0, 0, 0.35);
+      text-align: center;
+    }
+    h1 {
+      margin: 0 0 0.5rem 0;
+      font-size: 1.9rem;
+      color: #f8fafc;
+      letter-spacing: 0.02em;
+    }
+    p.tagline {
+      margin: 0 0 1.75rem 0;
+      color: #94a3b8;
+      font-size: 0.95rem;
+    }
+    .actions {
+      display: grid;
+      gap: 0.65rem;
     }
-    h1 { margin: 0 0 0.75rem 0; font-size: 1.8rem; color: #f8fafc; }
-    p { margin: 0 0 1rem 0; color: #cbd5e1; line-height: 1.5; }
     .btn {
-      display: inline-block;
+      display: block;
+      width: 100%;
       text-decoration: none;
-      border-radius: 8px;
-      padding: 0.65rem 1rem;
+      border-radius: 10px;
+      padding: 0.85rem 1rem;
       font-weight: 600;
       border: 1px solid transparent;
       cursor: pointer;
       font-size: 1rem;
+      text-align: center;
     }
     .btn-primary { background: #3b82f6; color: #ffffff; }
-    .btn-ghost { background: transparent; border-color: #64748b; color: #e2e8f0; }
-    label { display: block; font-size: 0.85rem; color: #94a3b8; margin-bottom: 0.35rem; }
-    input[type="password"] {
-      width: 100%;
-      padding: 0.5rem 0.65rem;
-      border-radius: 8px;
-      border: 1px solid #64748b;
-      background: #0f172a;
+    .btn-primary:hover { background: #2563eb; }
+    .btn-ghost {
+      background: transparent;
+      border-color: #475569;
       color: #e2e8f0;
-      margin-bottom: 0.75rem;
     }
-    .note { font-size: 0.8rem; color: #94a3b8; margin-top: 1rem; }
-    .nav { display: flex; flex-wrap: wrap; gap: 0.5rem; margin-bottom: 1rem; align-items: center; }
-    .nav span { color: #94a3b8; font-size: 0.9rem; }
-    .hidden { display: none !important; }
-    .invite-panel {
-      margin: 1rem 0;
-      padding: 0.9rem;
-      border: 1px solid rgba(148, 163, 184, 0.35);
-      border-radius: 10px;
-      background: rgba(30, 41, 59, 0.45);
-    }
-    .invite-row {
-      display: flex;
-      gap: 0.5rem;
-      flex-wrap: wrap;
-      margin-top: 0.4rem;
-    }
-    .invite-row input[type="email"] {
-      flex: 1 1 260px;
-      width: auto;
-      margin: 0;
-    }
-    .invite-row button {
-      margin: 0;
-    }
-    .invite-result {
-      margin-top: 0.55rem;
-      font-size: 0.85rem;
-      color: #cbd5e1;
-      word-break: break-all;
-    }
-    .users-panel {
-      margin: 1rem 0;
-      padding: 0.9rem;
-      border: 1px solid rgba(148, 163, 184, 0.35);
-      border-radius: 10px;
-      background: rgba(30, 41, 59, 0.45);
-    }
-    .users-list {
-      margin-top: 0.5rem;
-      display: grid;
-      gap: 0.45rem;
-    }
-    .user-row {
-      display: flex;
-      justify-content: space-between;
-      align-items: center;
-      gap: 0.5rem;
-      font-size: 0.9rem;
-    }
-    .user-row a {
+    .btn-ghost:hover { background: rgba(71, 85, 105, 0.25); }
+    .btn-link {
+      background: transparent;
+      border: none;
       color: #93c5fd;
-      text-decoration: none;
-      border: 1px solid rgba(147, 197, 253, 0.35);
-      border-radius: 6px;
-      padding: 0.25rem 0.5rem;
+      font-size: 0.85rem;
+      cursor: pointer;
+      padding: 0.4rem;
+      text-decoration: underline;
     }
+    .signed-in {
+      font-size: 0.85rem;
+      color: #94a3b8;
+      margin-bottom: 0.6rem;
+    }
+    .hidden { display: none !important; }
+    .footnote {
+      margin-top: 1.25rem;
+      font-size: 0.78rem;
+      color: #64748b;
+      line-height: 1.4;
+    }
+    .footnote a { color: #93c5fd; text-decoration: none; }
+    .footnote a:hover { text-decoration: underline; }
   </style>
 </head>
 <body>
   <main class="home-card">
-    <h1>Python Editor</h1>
-    <div id="auth-nav" class="nav">
-      <span id="auth-greeting" class="hidden"></span>
-      <a class="btn btn-ghost hidden" id="link-login" href="/login">Sign in</a>
-      <a class="btn btn-ghost hidden" id="link-register" href="/register">Register</a>
-      <button type="button" class="btn btn-ghost hidden" id="btn-logout">Sign out</button>
+    <h1>LED Editor</h1>
+    <p class="tagline">Run MicroPython in your browser. Drive simulated NeoPixels, pins, ADC, and serial.</p>
+
+    <div id="signed-in-row" class="signed-in hidden"></div>
+
+    <div class="actions">
+      <a class="btn btn-primary hidden" id="btn-signin" href="/login">Sign in</a>
+      <a class="btn btn-primary hidden" id="btn-open-editor" href="/editor">Open editor</a>
+      <a class="btn btn-ghost" id="btn-use-locally" href="/editor?local=1">Use locally (no login)</a>
+      <a class="btn-link hidden" id="btn-manage-users" href="/users">Manage users</a>
+      <button type="button" class="btn-link hidden" id="btn-signout">Sign out</button>
     </div>
-    <p>Edit and store files on the server. Python runs in your browser with <a href="https://pyodide.org/" style="color:#93c5fd">Pyodide</a>.</p>
-    <div id="optional-api-key">
-      <p>If you use <code style="color:#fcd34d">EDITOR_API_KEY</code> (without user login), store it here for API calls from this browser tab:</p>
-      <label for="api-key">API key (optional)</label>
-      <input id="api-key" type="password" autocomplete="off" placeholder="Leave blank if not used" />
-      <p class="note">The key is kept in <code>sessionStorage</code>. You can also use <code>?api_key=…</code> on the editor URL.</p>
-    </div>
-    <section id="invite-panel" class="invite-panel hidden">
-      <strong>Admin invites</strong>
-      <p class="note" style="margin-top:0.4rem">Create an email invite link for signup.</p>
-      <div class="invite-row">
-        <input id="invite-email" type="email" placeholder="new.user@example.com" autocomplete="email" />
-        <button type="button" class="btn btn-primary" id="invite-create-btn">Create invite</button>
-        <button type="button" class="btn btn-ghost" id="invite-link-btn">Create link only</button>
-      </div>
-      <div id="invite-result" class="invite-result"></div>
-    </section>
-    <section id="users-panel" class="users-panel hidden">
-      <strong>User management</strong>
-      <div id="users-list" class="users-list"></div>
-    </section>
-    <a class="btn btn-primary" href="/editor" id="open-editor">Open Editor</a>
+
+    <p class="footnote">
+      Local mode keeps files in this browser's <code>IndexedDB</code>; from the editor you can also pick a folder on disk
+      (<a href="https://developer.mozilla.org/en-US/docs/Web/API/File_System_Access_API" target="_blank" rel="noopener">File System Access API</a>, Chromium-only).
+    </p>
   </main>
   <script>
-    const storageKey = 'python-editor.api_key';
-    const input = document.getElementById('api-key');
-    const openLink = document.getElementById('open-editor');
+    async function init() {
+      const signedInRow = document.getElementById('signed-in-row');
+      const btnSignIn = document.getElementById('btn-signin');
+      const btnOpenEditor = document.getElementById('btn-open-editor');
+      const btnSignOut = document.getElementById('btn-signout');
+      const btnManageUsers = document.getElementById('btn-manage-users');
 
-    async function refreshAuthNav() {
-      const st = await fetch('/api/auth/status');
-      const status = await st.json();
-      const loginEl = document.getElementById('link-login');
-      const regEl = document.getElementById('link-register');
-      const outEl = document.getElementById('btn-logout');
-      const greet = document.getElementById('auth-greeting');
-      const optionalKey = document.getElementById('optional-api-key');
-      const invitePanel = document.getElementById('invite-panel');
-      const usersPanel = document.getElementById('users-panel');
-      if (!status.auth_enabled) {
-        loginEl.classList.add('hidden');
-        regEl.classList.add('hidden');
-        outEl.classList.add('hidden');
-        greet.classList.add('hidden');
-        if (invitePanel) invitePanel.classList.add('hidden');
-        if (usersPanel) usersPanel.classList.add('hidden');
+      let authEnabled = false;
+      try {
+        const st = await fetch('/api/auth/status');
+        if (st.ok) {
+          const status = await st.json();
+          authEnabled = Boolean(status.auth_enabled);
+        }
+      } catch (_e) {
+        // No backend (static-only host) → behave like auth disabled.
+      }
+
+      if (!authEnabled) {
+        // No login wall, so "Sign in" makes no sense — go straight to editor.
+        btnOpenEditor.classList.remove('hidden');
         return;
       }
-      loginEl.classList.remove('hidden');
-      if (status.register_open) {
-        regEl.classList.remove('hidden');
-      }
-      const me = await fetch('/api/auth/me', { credentials: 'include' });
-      if (me.ok) {
-        const j = await me.json();
-        greet.textContent = `Signed in as ${j.user.username}`;
-        greet.classList.remove('hidden');
-        loginEl.classList.add('hidden');
-        regEl.classList.add('hidden');
-        outEl.classList.remove('hidden');
-        if (optionalKey) optionalKey.classList.add('hidden');
-        if (invitePanel) {
-          if (j.user && j.user.is_superuser) {
-            invitePanel.classList.remove('hidden');
-            if (usersPanel) usersPanel.classList.remove('hidden');
-            await refreshUsersList();
-          } else {
-            invitePanel.classList.add('hidden');
-            if (usersPanel) usersPanel.classList.add('hidden');
-          }
-        }
-      } else {
-        outEl.classList.add('hidden');
-        greet.classList.add('hidden');
-        if (invitePanel) invitePanel.classList.add('hidden');
-        if (usersPanel) usersPanel.classList.add('hidden');
-      }
-    }
 
-    async function refreshUsersList() {
-      const usersList = document.getElementById('users-list');
-      if (!usersList) return;
-      usersList.textContent = 'Loading users...';
+      let me = null;
       try {
-        const res = await fetch('/api/users', { credentials: 'include' });
-        const users = await res.json().catch(() => []);
-        if (!res.ok) {
-          usersList.textContent = 'Unable to load users.';
-          return;
-        }
-        usersList.innerHTML = '';
-        for (const user of users) {
-          const row = document.createElement('div');
-          row.className = 'user-row';
-          const name = document.createElement('span');
-          name.textContent = `${user.username}${user.is_superuser ? ' (admin)' : ''}`;
-          const link = document.createElement('a');
-          link.href = `/editor?workspace_user_id=${encodeURIComponent(String(user.id))}`;
-          link.textContent = 'Open workspace';
-          row.appendChild(name);
-          row.appendChild(link);
-          usersList.appendChild(row);
-        }
-      } catch (_err) {
-        usersList.textContent = 'Unable to load users.';
+        const meRes = await fetch('/api/auth/me', { credentials: 'include' });
+        if (meRes.ok) me = (await meRes.json()).user;
+      } catch (_e) {
+        // ignore
       }
+
+      if (!me) {
+        btnSignIn.classList.remove('hidden');
+        return;
+      }
+
+      signedInRow.textContent = `Signed in as ${me.username}${me.is_superuser ? ' (admin)' : ''}`;
+      signedInRow.classList.remove('hidden');
+      btnOpenEditor.classList.remove('hidden');
+      btnSignOut.classList.remove('hidden');
+      if (me.is_superuser) btnManageUsers.classList.remove('hidden');
     }
 
-    document.getElementById('btn-logout').addEventListener('click', async () => {
-      await fetch('/api/auth/logout', { method: 'POST', credentials: 'include' });
+    document.getElementById('btn-signout').addEventListener('click', async () => {
+      try {
+        await fetch('/api/auth/logout', { method: 'POST', credentials: 'include' });
+      } catch (_e) {
+        // ignore
+      }
       window.location.reload();
     });
 
-    try {
-      const params = new URLSearchParams(window.location.search);
-      const fromQuery = params.get('api_key');
-      if (fromQuery) {
-        sessionStorage.setItem(storageKey, fromQuery);
-      }
-      const existing = sessionStorage.getItem(storageKey);
-      if (existing) {
-        input.value = existing;
-      }
-    } catch (_e) {}
-    openLink.addEventListener('click', () => {
-      try {
-        const v = input.value.trim();
-        if (v) {
-          sessionStorage.setItem(storageKey, v);
-        } else {
-          sessionStorage.removeItem(storageKey);
-        }
-      } catch (_e) {}
-    });
-
-    document.getElementById('invite-create-btn').addEventListener('click', async () => {
-      const emailInput = document.getElementById('invite-email');
-      const result = document.getElementById('invite-result');
-      const email = (emailInput.value || '').trim();
-      result.textContent = '';
-      if (!email) {
-        result.textContent = 'Enter an email address first.';
-        return;
-      }
-      try {
-        const res = await fetch('/api/users/invites', {
-          method: 'POST',
-          credentials: 'include',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ email, expires_days: 7 })
-        });
-        const body = await res.json().catch(() => ({}));
-        if (!res.ok) {
-          result.textContent = body.detail || res.statusText || 'Failed to create invite';
-          return;
-        }
-        const delivered = body.delivered ? 'Email sent.' : 'Email not sent (SMTP not configured), copy link manually.';
-        result.innerHTML = `${delivered}<br><a href="${body.invite_url}" style="color:#93c5fd">${body.invite_url}</a>`;
-      } catch (err) {
-        result.textContent = String(err.message || err);
-      }
-    });
-    document.getElementById('invite-link-btn').addEventListener('click', async () => {
-      const result = document.getElementById('invite-result');
-      result.textContent = '';
-      try {
-        const res = await fetch('/api/users/invites', {
-          method: 'POST',
-          credentials: 'include',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ email: null, expires_days: 7 })
-        });
-        const body = await res.json().catch(() => ({}));
-        if (!res.ok) {
-          result.textContent = body.detail || res.statusText || 'Failed to create invite link';
-          return;
-        }
-        result.innerHTML = `Invite link created.<br><a href="${body.invite_url}" style="color:#93c5fd">${body.invite_url}</a>`;
-      } catch (err) {
-        result.textContent = String(err.message || err);
-      }
-    });
-    refreshAuthNav();
+    init();
   </script>
 </body>
 </html>

src/static/index.html

@@ -2,14 +2,16 @@
 <html lang="en">
 <head>
   <meta charset="UTF-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>Python Editor</title>
+  <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
+  <meta name="theme-color" content="#2d3748">
+  <title>LED Editor</title>
   <link rel="icon" href="data:,">
-  <link rel="stylesheet" href="/static/styles.css?v=10">
+  <link rel="stylesheet" href="/static/styles.css?v=41">
 </head>
 <body>
   <div class="container">
-    <div class="sidebar">
+    <div class="sidebar-backdrop" id="sidebar-backdrop" hidden></div>
+    <div class="sidebar" id="sidebar">
       <div class="sidebar-header">
         <h3>Files</h3>
         <div class="sidebar-actions">
@@ -24,28 +26,38 @@
       </div>
     </div>
 
+    <div id="file-tree-context-menu" class="file-tree-context-menu" role="menu" hidden aria-hidden="true"></div>
+
     <div class="main-content">
       <div class="editor-header">
+        <button id="sidebar-toggle" class="sidebar-toggle" type="button" aria-label="Toggle file tree" aria-controls="sidebar" aria-expanded="true" title="Toggle file browser"><span class="sidebar-toggle-icon" aria-hidden="true">‹</span></button>
         <div class="file-info">
           <span id="save-status" class="save-status"></span>
-          <span class="runtime-hint" title="Python runs locally in your browser via Pyodide; completions use Jedi in the same runtime.">Browser · Pyodide</span>
-          <span id="lsp-status" class="runtime-hint" title="Jedi in-browser diagnostics">LSP: n/a</span>
           <span id="workspace-badge" class="runtime-hint hidden"></span>
         </div>
-        <div class="mode-toggle">
-          <a id="home-btn" class="mode-btn active" href="/">Home</a>
-        </div>
         <div class="editor-actions">
-          <button id="run-btn" disabled>Run Python</button>
-          <button id="stop-btn" disabled>Stop</button>
-          <label for="run-main-checkbox" class="run-main-toggle">
-            <input type="checkbox" id="run-main-checkbox" />
-            Run `main.py`
-          </label>
-          <label for="panel-16x16-checkbox" class="run-main-toggle">
-            <input type="checkbox" id="panel-16x16-checkbox" />
-            16x16 panel
-          </label>
+          <button id="run-btn" class="icon-btn" disabled aria-label="Run" title="Run">▶</button>
+          <button id="stop-btn" class="icon-btn" disabled aria-label="Stop" title="Stop">■</button>
+          <details class="header-menu" id="header-menu">
+            <summary class="menu-toggle" aria-label="Editor options" title="Options">⋮</summary>
+            <div class="menu-content" role="menu">
+              <a href="/" class="menu-item" id="home-btn" role="menuitem">🏠 Home</a>
+              <label class="menu-item menu-checkbox">
+                <input type="checkbox" id="run-main-checkbox" />
+                Run main.py
+              </label>
+              <label class="menu-item menu-checkbox">
+                <input type="checkbox" id="panel-16x16-checkbox" />
+                16×16 panel
+              </label>
+              <button type="button" class="menu-item menu-button" id="packages-menu-btn" role="menuitem">📦 Python packages…</button>
+              <button type="button" class="menu-item menu-button" id="menu-open-local-folder-btn" role="menuitem">📂 Open local folder…</button>
+              <button type="button" class="menu-item menu-button" id="menu-open-local-file-btn" role="menuitem">📄 Open local file…</button>
+              <div class="menu-separator" role="separator"></div>
+              <div class="menu-section-label" id="workspace-menu-label">Workspace</div>
+              <div id="workspace-menu-actions" role="group"></div>
+            </div>
+          </details>
         </div>
       </div>
 
@@ -57,20 +69,47 @@
       </div>
 
       <section id="led-sim-panel" class="led-sim-panel hidden" aria-label="NeoPixel Simulator">
-        <div class="led-sim-header">
-          <h3>NeoPixel Simulator</h3>
-          <div class="led-sim-actions">
-            <button id="led-run-btn" type="button">Run</button>
-            <button id="led-stop-btn" type="button">Stop</button>
-            <button id="led-close-btn" type="button" aria-label="Close simulator">Close</button>
-          </div>
-        </div>
-        <div id="led-meta" class="led-meta">Waiting for neopixel.write()...</div>
         <div id="led-grid" class="led-grid"></div>
       </section>
 
-      <div class="console-container">
-        <div class="console-header">Console Output</div>
+      <section id="pin-panel" class="pin-panel hidden" aria-label="Pins">
+        <div class="pin-panel-header">
+          <span class="pin-panel-title">Pins</span>
+          <span class="pin-panel-hint">OUT shows live state · IN is clickable · PWM shows duty</span>
+        </div>
+        <div id="pin-rows" class="pin-rows"></div>
+      </section>
+
+      <section id="adc-panel" class="adc-panel hidden" aria-label="ADC inputs">
+        <div class="adc-panel-header">
+          <span class="adc-panel-title">ADC inputs</span>
+          <span class="adc-panel-hint">drag to set value (0–65535)</span>
+        </div>
+        <div id="adc-sliders" class="adc-sliders"></div>
+      </section>
+
+      <section id="serial-panel" class="serial-panel hidden" aria-label="Serial monitor">
+        <div class="serial-header">
+          <span class="serial-title">Serial monitor</span>
+          <span id="serial-meta" class="serial-meta"></span>
+          <button type="button" id="serial-clear" class="serial-clear" title="Clear">Clear</button>
+        </div>
+        <div id="serial-output" class="serial-output" aria-live="polite"></div>
+        <form id="serial-form" class="serial-form" autocomplete="off">
+          <input id="serial-input" type="text" class="serial-input" placeholder="Type and press Enter to send" />
+          <label class="serial-newline" title="Append \n on send">
+            <input type="checkbox" id="serial-newline-checkbox" checked />
+            <span>\n</span>
+          </label>
+          <button type="submit" class="serial-send">Send</button>
+        </form>
+      </section>
+
+      <div class="console-container" id="console-container">
+        <button type="button" class="console-header" id="console-toggle" aria-expanded="true" aria-controls="console-output">
+          <span class="chevron" aria-hidden="true">▾</span>
+          <span>Console Output</span>
+        </button>
         <pre id="console-output" class="console-output"></pre>
       </div>
     </div>
@@ -87,6 +126,27 @@
     </div>
   </div>
 
-  <script type="module" src="/static/script.js?v=23"></script>
+  <div id="packages-modal" class="modal">
+    <div class="modal-content packages-modal-content">
+      <h3>Python packages (Pyodide)</h3>
+      <p class="packages-modal-hint">Install from PyPI using micropip inside the browser. Pure-Python wheels (or packages built for WebAssembly) usually work; manylinux-only C extensions often do not.</p>
+      <label class="packages-field-label" for="packages-install-input">Package names or PEP 508 specs</label>
+      <input type="text" id="packages-install-input" placeholder="e.g. httpx, phonenumbers" autocomplete="off" />
+      <div id="packages-pypi-info" class="packages-pypi-info" aria-live="polite"></div>
+      <div class="packages-modal-actions-row">
+        <button type="button" id="packages-lookup-btn" class="packages-secondary-btn">Look up on PyPI</button>
+      </div>
+      <div id="packages-modal-status" class="packages-modal-status" aria-live="polite"></div>
+      <pre id="packages-install-log" class="packages-install-log hidden" aria-label="Micropip installer output"></pre>
+      <p class="packages-saved-label">Saved in this browser (restored when the editor loads Pyodide):</p>
+      <ul id="packages-saved-list" class="packages-saved-list"></ul>
+      <div class="modal-actions">
+        <button type="button" id="packages-install-btn">Install</button>
+        <button type="button" id="packages-close-btn">Close</button>
+      </div>
+    </div>
+  </div>
+
+  <script type="module" src="/static/script.js?v=83"></script>
 </body>
 </html>

src/static/login.html

@@ -3,7 +3,7 @@
 <head>
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>Sign in — Python Editor</title>
+  <title>Sign in — LED Editor</title>
   <link rel="icon" href="data:,">
   <style>
     * { box-sizing: border-box; }

src/static/pyodide-worker.js

@@ -6,6 +6,26 @@ const PYODIDE_INDEX_URL = 'https://cdn.jsdelivr.net/pyodide/v0.26.4/full/';
 let pyodide = null;
 let loadingPromise = null;
 
+/**
+ * Install PyPI wheels into this Pyodide interpreter via micropip.
+ * Pure-Python wheels (or Pyodide-built packages) work; manylinux
+ * binary wheels that are not built for Emscripten will fail.
+ */
+async function micropipInstallSpecs(p, specs) {
+  const list = specs
+    .map((s) => String(s || '').trim())
+    .filter(Boolean);
+  if (!list.length) {
+    return;
+  }
+  p.globals.set('__micropip_specs', p.toPy(list));
+  await p.runPythonAsync(`
+import micropip
+specs = list(__micropip_specs)
+await micropip.install(specs)
+`);
+}
+
 async function ensurePyodide() {
   if (pyodide) {
     return pyodide;
@@ -20,9 +40,17 @@ async function ensurePyodide() {
         batched: (txt) => self.postMessage({ type: 'io', stream: 'stderr', text: txt }),
       });
       await p.loadPackage('micropip');
+      /* Optional wheels (numpy, scipy, pandas, scikit-learn, …) are not preloaded —
+         first worker init stays small. Install from user code with
+         `await micropip.install("…", index_urls=[…])` (same host as `loadPyodide`).
+         HTTPS: use `pyodide.http.pyfetch` / `browser_fetch`, not `aiohttp`. */
       await p.runPythonAsync(`
 import micropip
 await micropip.install("jedi")
+try:
+    await micropip.install("nest-asyncio")
+except Exception:
+    pass
 `);
       return p;
     })();
@@ -34,14 +62,150 @@ await micropip.install("jedi")
 self.onmessage = async (event) => {
   const { id, type, payload } = event.data || {};
   try {
+    /* Fast-path: fire-and-forget messages used by the SAB-less fallback
+       for pin input + ADC slider values. We update the worker-local
+       Int32Array so Python's next read sees the new value, with no
+       Pyodide round-trip and no reply expected. */
+    if (type === 'pinIn') {
+      const view = self.__pin_in_view;
+      const pin = payload && Number(payload.pin);
+      if (view && Number.isFinite(pin) && pin >= 0 && pin < view.length) {
+        try {
+          view[pin] = (payload.value | 0) ? 1 : 0;
+        } catch (_e) {
+          // ignore
+        }
+      }
+      return;
+    }
+    if (type === 'adcSet') {
+      const view = self.__adc_view;
+      const pin = payload && Number(payload.pin);
+      if (view && Number.isFinite(pin) && pin >= 0 && pin < view.length) {
+        const value = Math.max(0, Math.min(65535, payload.value | 0));
+        try {
+          view[pin] = value;
+        } catch (_e) {
+          // ignore
+        }
+      }
+      return;
+    }
+
     if (type === 'init') {
-      await ensurePyodide();
-      self.postMessage({ id, type: 'init', ok: true });
+      /* The main thread shares an Int32Array-backed SAB so Python ADC.read*()
+         can pick up live slider values without yielding. */
+      const adcSab = payload && payload.adcSab;
+      if (adcSab && typeof adcSab !== 'string') {
+        try {
+          self.__adc_view = new Int32Array(adcSab);
+        } catch (_e) {
+          self.__adc_view = null;
+        }
+      }
+      /* No SAB? Fall back to a worker-local Int32Array; the main thread
+         then delivers slider drags via `postMessage({type:'adcSet'})`. */
+      if (!self.__adc_view) {
+        try {
+          self.__adc_view = new Int32Array(64);
+        } catch (_e) {
+          self.__adc_view = null;
+        }
+      }
+      /* Pin output state: Int32Array[64] — Python writes packed
+         [ui_mode << 24 | value (low 24 bits)] entries, the editor UI reads
+         them every frame to drive the Pins panel indicators. */
+      const pinOutSab = payload && payload.pinOutSab;
+      if (pinOutSab && typeof pinOutSab !== 'string') {
+        try {
+          self.__pin_out_view = new Int32Array(pinOutSab);
+        } catch (_e) {
+          self.__pin_out_view = null;
+        }
+      }
+      if (!self.__pin_out_view) {
+        try {
+          self.__pin_out_view = new Int32Array(64);
+        } catch (_e) {
+          self.__pin_out_view = null;
+        }
+      }
+      /* Pin input state: Int32Array[64] — UI buttons write 0/1 per pin,
+         Python's `Pin.value()` for IN mode reads the matching slot. */
+      const pinInSab = payload && payload.pinInSab;
+      if (pinInSab && typeof pinInSab !== 'string') {
+        try {
+          self.__pin_in_view = new Int32Array(pinInSab);
+        } catch (_e) {
+          self.__pin_in_view = null;
+        }
+      }
+      if (!self.__pin_in_view) {
+        try {
+          self.__pin_in_view = new Int32Array(64);
+        } catch (_e) {
+          self.__pin_in_view = null;
+        }
+      }
+      /* Tell Python whether SAB was actually wired up so machine.py can
+         emit `[pin-out]` print markers as a fallback for the live UI. */
+      self.__sab_isolated = Boolean(pinOutSab && typeof pinOutSab !== 'string');
+      /* Serial-in ring buffer: first 8 bytes are [readIdx, writeIdx] (Int32),
+         followed by `capacity` bytes of payload data. */
+      const serialSab = payload && payload.serialSab;
+      if (serialSab && typeof serialSab !== 'string') {
+        try {
+          self.__serial_in_indices = new Int32Array(serialSab, 0, 2);
+          const capacity = serialSab.byteLength - 8;
+          self.__serial_in_capacity = capacity;
+          self.__serial_in_data = new Uint8Array(serialSab, 8, capacity);
+        } catch (_e) {
+          self.__serial_in_indices = null;
+          self.__serial_in_data = null;
+          self.__serial_in_capacity = 0;
+        }
+      }
+      const p = await ensurePyodide();
+      const rawExtra =
+        payload && Array.isArray(payload.persistedMicropipPackages)
+          ? payload.persistedMicropipPackages
+          : [];
+      const extra = rawExtra.map((s) => String(s || '').trim()).filter(Boolean);
+      let micropipRestoreError = null;
+      if (extra.length) {
+        try {
+          await micropipInstallSpecs(p, extra);
+        } catch (err) {
+          micropipRestoreError = err && err.message ? String(err.message) : String(err);
+        }
+      }
+      const initReply = { id, type: 'init', ok: true };
+      if (micropipRestoreError) {
+        initReply.micropipRestoreError = micropipRestoreError;
+      }
+      self.postMessage(initReply);
       return;
     }
 
     const p = await ensurePyodide();
 
+    if (type === 'micropipInstall') {
+      const raw =
+        payload && payload.specs != null
+          ? payload.specs
+          : payload && payload.spec != null
+            ? [payload.spec]
+            : [];
+      const specs = (Array.isArray(raw) ? raw : [raw]).map((s) => String(s || '').trim()).filter(Boolean);
+      if (!specs.length) {
+        self.postMessage({ id, type: 'micropipInstall', ok: false, error: 'No package names given' });
+        return;
+      }
+      await micropipInstallSpecs(p, specs);
+      self.postMessage({ id, type: 'micropipInstall', ok: true });
+      return;
+    }
+
     if (type === 'complete') {
       const rel = String(payload.path || 'scratch.py').replace(/^\/+/, '');
       const vpath = `/workspace/${rel}`;
@@ -52,7 +216,7 @@ self.onmessage = async (event) => {
       p.globals.set('__cm_max', Math.min(100, Math.max(1, Number(payload.max_results) || 20)));
       p.globals.set('__cm_extra_json', JSON.stringify(payload.extra_files || {}));
       const raw = p.runPython(`
-import json, os
+import json, os, sys
 import jedi
 
 extra = json.loads(__cm_extra_json)
@@ -66,7 +230,13 @@ for rel_path, body in extra.items():
 os.makedirs(os.path.dirname(__cm_path), exist_ok=True)
 with open(__cm_path, "w", encoding="utf-8") as fh:
     fh.write(__cm_code)
-proj = jedi.Project("/workspace")
+for entry in ("/workspace/code", "/workspace/demos", "/workspace/lib", "/workspace"):
+    if entry not in sys.path:
+        sys.path.append(entry)
+proj = jedi.Project(
+    "/workspace",
+    added_sys_path=["/workspace/code", "/workspace/demos", "/workspace/lib", "/workspace"],
+)
 s = jedi.Script(code=__cm_code, path=__cm_path, project=proj)
 items = s.complete(line=__cm_line, column=__cm_col)
 out = [{"name": i.name, "type": i.type, "complete": i.complete} for i in items[:__cm_max]]
@@ -84,7 +254,7 @@ json.dumps(out)
       p.globals.set('__diag_path', vpath);
       p.globals.set('__diag_extra_json', JSON.stringify(payload.extra_files || {}));
       const raw = p.runPython(`
-import json, os
+import json, os, sys
 import jedi
 
 extra = json.loads(__diag_extra_json)
@@ -98,7 +268,13 @@ for rel_path, body in extra.items():
 os.makedirs(os.path.dirname(__diag_path), exist_ok=True)
 with open(__diag_path, "w", encoding="utf-8") as fh:
     fh.write(__diag_code)
-proj = jedi.Project("/workspace")
+for entry in ("/workspace/code", "/workspace/demos", "/workspace/lib", "/workspace"):
+    if entry not in sys.path:
+        sys.path.append(entry)
+proj = jedi.Project(
+    "/workspace",
+    added_sys_path=["/workspace/code", "/workspace/demos", "/workspace/lib", "/workspace"],
+)
 s = jedi.Script(code=__diag_code, path=__diag_path, project=proj)
 errs = s.get_syntax_errors()
 out = [{"line": e.line, "column": e.column, "message": str(e.get_message())} for e in errs]
@@ -129,15 +305,62 @@ for rel, body in files.items():
     with open(full, "w", encoding="utf-8") as fh:
         fh.write(str(body))
 
-for entry in ("/workspace/code", "/workspace/lib", "/workspace"):
+for entry in ("/workspace/code", "/workspace/demos", "/workspace/lib", "/workspace"):
     if entry not in sys.path:
-        sys.path.insert(0, entry)
+        sys.path.append(entry)
 
 os.chdir("/workspace")
 main = __run_main
 sys.argv = [main] + list(__run_args)
-runpy.run_path(main, run_name="__main__")
+# runpy.run_path is synchronous; user asyncio.run() needs an *active* loop (nest_asyncio).
+# Await an async wrapper so get_running_loop() works during the script.
+import asyncio
+import asyncio.events
+import asyncio.base_events
+def _patch_set_debug(cls):
+    _orig = cls.set_debug
+    def set_debug(self, enabled):
+        try:
+            return _orig(self, enabled)
+        except NotImplementedError:
+            pass
+    cls.set_debug = set_debug
+_patch_set_debug(asyncio.events.AbstractEventLoop)
+_patch_set_debug(asyncio.base_events.BaseEventLoop)
+async def __pyodide_run_user_script():
+    loop = asyncio.get_running_loop()
+    try:
+        import nest_asyncio
+        nest_asyncio.apply(loop)
+    except Exception:
+        try:
+            import nest_asyncio
+            nest_asyncio.apply()
+        except Exception:
+            pass
+
+    def _pyodide_asyncio_run(coro, *, debug=False):
+        task = asyncio.ensure_future(coro, loop=loop)
+        return loop.run_until_complete(task)
+
+    asyncio.run = _pyodide_asyncio_run
+    import runpy
+    runpy.run_path(main, run_name="__main__")
+
+await __pyodide_run_user_script()
 `);
+      try {
+        await p.runPythonAsync(`
+import sys
+for _s in (sys.stdout, sys.stderr):
+    try:
+        _s.flush()
+    except Exception:
+        pass
+`);
+      } catch (_e) {
+        // ignore
+      }
       self.postMessage({ id, type: 'run', ok: true });
       return;
     }

src/static/register.html

@@ -3,7 +3,7 @@
 <head>
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>Register — Python Editor</title>
+  <title>Register — LED Editor</title>
   <link rel="icon" href="data:,">
   <style>
     * { box-sizing: border-box; }
@@ -54,6 +54,7 @@
 <body>
   <main class="card">
     <h1>Create account</h1>
+    <p id="invite-banner" class="hint hidden"></p>
     <p class="hint">Username: letters, numbers, underscore (3–64). Password: at least 8 characters.</p>
     <div id="err" class="err"></div>
     <form id="form">
@@ -67,9 +68,31 @@
     <p><a href="/login">Sign in</a> · <a href="/">Home</a></p>
   </main>
   <script>
-    const inviteToken = new URLSearchParams(window.location.search).get("invite") || "";
+    const inviteTokenRaw = new URLSearchParams(window.location.search).get("invite") || "";
+    const inviteToken = inviteTokenRaw.trim();
     const inviteInput = document.getElementById("invite-token");
     if (inviteInput) inviteInput.value = inviteToken;
+    if (inviteToken) {
+      const banner = document.getElementById("invite-banner");
+      if (banner) {
+        banner.classList.remove("hidden");
+        banner.textContent =
+          "You're using an invite link. Choose a username and password — the link works for one signup only.";
+      }
+    }
+
+    function formatApiDetail(body) {
+      if (!body || body.detail === undefined || body.detail === null) return "";
+      const d = body.detail;
+      if (typeof d === "string") return d;
+      if (Array.isArray(d))
+        return d
+          .map((item) =>
+            typeof item === "object" && item && item.msg ? String(item.msg) : JSON.stringify(item)
+          )
+          .join(" ");
+      return String(d);
+    }
 
     (async function checkStatus() {
       try {
@@ -98,7 +121,7 @@
         const body = {
           username: document.getElementById("username").value.trim(),
           password: document.getElementById("password").value,
-          invite_token: inviteToken || null,
+          invite_token: inviteToken ? inviteToken : null,
         };
         const res = await fetch("/api/auth/register", {
           method: "POST",
@@ -107,7 +130,7 @@
         });
         if (!res.ok) {
           const j = await res.json().catch(() => ({}));
-          err.textContent = typeof j.detail === "string" ? j.detail : JSON.stringify(j.detail) || res.statusText;
+          err.textContent = formatApiDetail(j) || res.statusText;
           return;
         }
         window.location.href = "/login?next=/editor";

src/static/tutorial.html

@@ -0,0 +1,250 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Python Tutorial</title>
+  <link rel="icon" href="data:,">
+  <style>
+    * { box-sizing: border-box; }
+    body {
+      margin: 0;
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+      background: #0f172a;
+      color: #e2e8f0;
+      min-height: 100dvh;
+    }
+    .page {
+      max-width: 1100px;
+      margin: 0 auto;
+      padding: 1rem;
+      display: grid;
+      gap: 0.9rem;
+    }
+    .topbar {
+      display: flex;
+      gap: 0.6rem;
+      flex-wrap: wrap;
+      align-items: center;
+    }
+    .btn {
+      border: 1px solid #334155;
+      background: #1e293b;
+      color: #e2e8f0;
+      border-radius: 8px;
+      text-decoration: none;
+      padding: 0.45rem 0.7rem;
+      cursor: pointer;
+      font-size: 0.92rem;
+    }
+    .btn.primary {
+      background: #2563eb;
+      border-color: #2563eb;
+    }
+    .layout {
+      display: grid;
+      grid-template-columns: 1fr;
+      gap: 0.9rem;
+      min-height: 70dvh;
+    }
+    .card {
+      border: 1px solid #334155;
+      border-radius: 12px;
+      background: #111827;
+      padding: 0.8rem;
+      min-height: 0;
+    }
+    .hint { color: #94a3b8; font-size: 0.9rem; margin: 0.4rem 0 0.7rem; white-space: pre-wrap; }
+    .guided-grid {
+      display: grid;
+      grid-template-columns: 1fr 320px;
+      gap: 0.8rem;
+      margin-bottom: 0.9rem;
+    }
+    .demo-code {
+      margin: 0.55rem 0 0;
+      border: 1px solid #334155;
+      background: #020617;
+      border-radius: 8px;
+      padding: 0.6rem;
+      min-height: 280px;
+      overflow: auto;
+      font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+      font-size: 0.84rem;
+      line-height: 1.45;
+      white-space: pre;
+    }
+    .demo-line {
+      display: block;
+      padding: 0 0.2rem;
+      border-radius: 4px;
+      color: #cbd5e1;
+    }
+    .demo-line.active {
+      background: rgba(59, 130, 246, 0.18);
+      color: #dbeafe;
+      outline: 1px solid rgba(59, 130, 246, 0.35);
+    }
+    .demo-controls {
+      display: grid;
+      gap: 0.65rem;
+      margin-top: 0.65rem;
+      padding: 0.7rem;
+      border: 1px solid #334155;
+      border-radius: 10px;
+      background: #0b1220;
+    }
+    .demo-controls label {
+      display: grid;
+      gap: 0.2rem;
+      color: #e2e8f0;
+      font-size: 0.95rem;
+      font-weight: 600;
+    }
+    .demo-controls .control-head {
+      display: flex;
+      justify-content: space-between;
+      align-items: center;
+      gap: 0.5rem;
+    }
+    .demo-controls .value-badge {
+      min-width: 52px;
+      text-align: center;
+      background: #1d4ed8;
+      color: white;
+      border: 1px solid rgba(255,255,255,0.2);
+      border-radius: 999px;
+      padding: 0.1rem 0.45rem;
+      font-size: 0.8rem;
+    }
+    .demo-controls input[type="range"] {
+      width: 100%;
+      accent-color: #3b82f6;
+      height: 1.1rem;
+    }
+    .demo-controls select {
+      width: 100%;
+      border: 1px solid #475569;
+      border-radius: 8px;
+      background: #020617;
+      color: #e2e8f0;
+      padding: 0.5rem 0.55rem;
+      font-size: 0.92rem;
+    }
+    .guide-explain {
+      border: 1px solid #334155;
+      background: #020617;
+      border-radius: 8px;
+      padding: 0.65rem;
+      color: #cbd5e1;
+      min-height: 120px;
+      white-space: pre-wrap;
+    }
+    .guide-step {
+      color: #93c5fd;
+      font-size: 0.9rem;
+      margin: 0.45rem 0;
+    }
+    .hidden { display: none !important; }
+    .led-demo-panel {
+      border: 1px solid #334155;
+      background: #020617;
+      border-radius: 8px;
+      padding: 0.65rem;
+      width: fit-content;
+      display: inline-block;
+    }
+    .led-meta {
+      color: #9ca3af;
+      font-size: 0.82rem;
+      margin-bottom: 0.45rem;
+      display: none;
+    }
+    .led-grid {
+      display: grid;
+      grid-template-columns: repeat(16, 24px);
+      grid-auto-rows: 24px;
+      gap: 6px;
+      max-height: none;
+      overflow: visible;
+      align-content: start;
+      justify-content: start;
+      width: fit-content;
+    }
+    .led {
+      width: 24px;
+      height: 24px;
+      border-radius: 50%;
+      border: 1px solid rgba(255, 255, 255, 0.2);
+      box-shadow: inset 0 0 6px rgba(0, 0, 0, 0.45);
+    }
+    @media (max-width: 900px) {
+      .guided-grid { grid-template-columns: 1fr; }
+    }
+  </style>
+</head>
+<body>
+  <main class="page">
+    <div class="topbar">
+      <a class="btn" href="/">Home</a>
+    </div>
+    <div class="layout">
+      <section class="card">
+        <h3 style="margin:0">Guided LED Demo</h3>
+        <div style="display:flex; gap:0.5rem; flex-wrap:wrap;">
+          <button id="begin-demo-btn" class="btn primary" type="button">Let's Get Started</button>
+          <button id="toggle-breakdown-btn" class="btn hidden" type="button">Show Breakdown</button>
+        </div>
+        <div class="guided-grid">
+          <div>
+            <div class="led-demo-panel">
+              <div id="led-meta" class="led-meta">Press Begin Demo to render the panel animation.</div>
+              <div id="led-grid" class="led-grid"></div>
+            </div>
+          </div>
+          <div>
+            <div class="demo-controls">
+              <label>Pattern
+                <select id="pattern-select">
+                  <option value="plasma">Plasma Swirl</option>
+                  <option value="rainbow">Rainbow Orbit</option>
+                </select>
+              </label>
+              <label>
+                <span class="control-head">Speed <span id="speed-value" class="value-badge"></span></span>
+                <input id="speed-slider" type="range" min="0.8" max="3.2" step="0.1" value="1.6" />
+              </label>
+              <label>
+                <span class="control-head">Wave Width <span id="width-value" class="value-badge"></span></span>
+                <input id="width-slider" type="range" min="0.2" max="0.8" step="0.02" value="0.45" />
+              </label>
+              <label>
+                <span class="control-head">Brightness <span id="brightness-value" class="value-badge"></span></span>
+                <input id="brightness-slider" type="range" min="80" max="230" step="5" value="170" />
+              </label>
+            </div>
+          </div>
+        </div>
+        <div id="learning-content" class="hidden">
+          <div id="breakdown-panel" class="hidden">
+            <div style="display:flex; gap:0.5rem; flex-wrap:wrap; margin-top:0.2rem;">
+              <button id="prev-part-btn" class="btn" type="button">Prev Part</button>
+              <button id="next-part-btn" class="btn" type="button">Next Part</button>
+            </div>
+            <div class="guided-grid" style="margin-top:0.55rem;">
+              <div>
+                <div id="guide-step" class="guide-step"></div>
+                <div id="demo-code" class="demo-code"></div>
+              </div>
+              <div>
+                <div id="guide-explain" class="guide-explain"></div>
+              </div>
+            </div>
+          </div>
+        </div>
+      </section>
+    </div>
+  </main>
+  <script type="module" src="/static/tutorial.js?v=4"></script>
+</body>
+</html>

src/static/tutorial.js

@@ -0,0 +1,435 @@
+const DEMO_PARTS = [
+  {
+    title: "Setup objects",
+    start: 1,
+    end: 6,
+    explain:
+      "We import timing/math and create a 16x16 NeoPixel object.\nThis gives us 256 LEDs to control every frame.",
+  },
+  {
+    title: "Serpentine mapping",
+    start: 8,
+    end: 10,
+    explain:
+      "The panel wiring zig-zags by row.\nEven rows run right-to-left, odd rows run left-to-right.",
+  },
+  {
+    title: "Frame loop",
+    start: 12,
+    end: 12,
+    explain:
+      "`for t in range(...)` is time.\nEach pass draws one frame of animation.",
+  },
+  {
+    title: "Pixel color math",
+    start: 13,
+    end: 17,
+    explain:
+      "For each (x,y), we compute a sine wave value.\nThat value controls brightness and color to create flowing motion.",
+  },
+  {
+    title: "Render + delay",
+    start: 18,
+    end: 19,
+    explain:
+      "`np.write()` pushes the full frame to LEDs.\nA tiny sleep controls animation speed.",
+  },
+];
+
+class TutorialApp {
+  constructor() {
+    this.pyWorker = null;
+    this.pyWorkerMsgId = 0;
+    this.pyWorkerHandlers = new Map();
+    this.pyodideInited = false;
+    this.outputBuffer = "";
+    this.introMode = true;
+    this.previewTimer = null;
+    this.previewTick = 0;
+    this.breakdownVisible = false;
+    this.demoPartIndex = 0;
+    this.demoVars = {
+      pattern: "plasma",
+      speed: 1.6,
+      width: 0.45,
+      brightness: 170,
+    };
+    this.bind();
+    this.renderDemoControls();
+    this.renderDemoCode();
+    this.renderDemoPart();
+    this.prewarm();
+    this.startIdlePreview();
+  }
+
+  bind() {
+    document.getElementById("toggle-breakdown-btn").addEventListener("click", () => {
+      this.breakdownVisible = !this.breakdownVisible;
+      const panel = document.getElementById("breakdown-panel");
+      const button = document.getElementById("toggle-breakdown-btn");
+      if (panel) panel.classList.toggle("hidden", !this.breakdownVisible);
+      if (button) button.textContent = this.breakdownVisible ? "Hide Breakdown" : "Show Breakdown";
+    });
+    document.getElementById("begin-demo-btn").addEventListener("click", async () => {
+      if (this.introMode) {
+        this.introMode = false;
+        this.stopIdlePreview();
+        const learning = document.getElementById("learning-content");
+        const breakdownToggle = document.getElementById("toggle-breakdown-btn");
+        if (learning) learning.classList.remove("hidden");
+        if (breakdownToggle) breakdownToggle.classList.remove("hidden");
+      }
+      const src = this.buildDemoCode();
+      await this.runSource(src, "code/tutorial_demo.py");
+      this.setStatus("Demo ran. Use Show Breakdown to step through code.", "info");
+    });
+    document.getElementById("prev-part-btn").addEventListener("click", () => {
+      this.demoPartIndex = (this.demoPartIndex - 1 + DEMO_PARTS.length) % DEMO_PARTS.length;
+      this.renderDemoPart();
+    });
+    document.getElementById("next-part-btn").addEventListener("click", () => {
+      this.demoPartIndex = (this.demoPartIndex + 1) % DEMO_PARTS.length;
+      this.renderDemoPart();
+    });
+    document.getElementById("pattern-select").addEventListener("change", (event) => {
+      this.demoVars.pattern = String(event.target.value || "plasma");
+      this.renderDemoCode();
+      this.renderDemoPart();
+    });
+    document.getElementById("speed-slider").addEventListener("input", (event) => {
+      this.demoVars.speed = Number(event.target.value);
+      this.renderDemoControls();
+      this.renderDemoCode();
+      this.renderDemoPart();
+    });
+    document.getElementById("width-slider").addEventListener("input", (event) => {
+      this.demoVars.width = Number(event.target.value);
+      this.renderDemoControls();
+      this.renderDemoCode();
+      this.renderDemoPart();
+    });
+    document.getElementById("brightness-slider").addEventListener("input", (event) => {
+      this.demoVars.brightness = Number(event.target.value);
+      this.renderDemoControls();
+      this.renderDemoCode();
+      this.renderDemoPart();
+    });
+  }
+
+  buildDemoCode() {
+    const pattern = this.demoVars.pattern;
+    const speed = this.demoVars.speed.toFixed(2);
+    const width = this.demoVars.width.toFixed(2);
+    const brightness = Math.round(this.demoVars.brightness);
+    const bodyLines =
+      pattern === "rainbow"
+        ? [
+            "            dx = x - 7.5",
+            "            dy = y - 7.5",
+            "            angle = math.atan2(dy, dx)",
+            "            radius = math.sqrt(dx * dx + dy * dy)",
+            "            hue = angle + (radius * WAVE_WIDTH) + (t * SPEED * 0.15)",
+            "            pulse = (math.sin((radius * 0.65) - (t * 0.10)) + 1.0) * 0.5",
+            "            scale = int((0.45 + pulse * 0.55) * BRIGHTNESS)",
+            "            r = int((math.sin(hue + 0.0) * 0.5 + 0.5) * scale)",
+            "            g = int((math.sin(hue + 2.09) * 0.5 + 0.5) * scale)",
+            "            u = int((math.sin(hue + 4.18) * 0.5 + 0.5) * scale)",
+            "            np[xy_to_index(x, y)] = (max(0,min(255,r)), max(0,min(255,g)), max(0,min(255,u)))",
+          ]
+        : [
+            "            dx = x - 7.5",
+            "            dy = y - 7.5",
+            "            dist = math.sqrt(dx * dx + dy * dy)",
+            "            ring = math.sin(dist * (WAVE_WIDTH * 2.6) - t * (SPEED * 0.9))",
+            `            swirl = math.sin((x * WAVE_WIDTH) + (y * ${Math.max(0.1, width * 0.8).toFixed(2)}) + (t * SPEED * 0.55))`,
+            "            pulse = math.sin(t * SPEED * 0.12)",
+            "            b = int((ring * 0.45 + swirl * 0.35 + pulse * 0.2 + 1.0) * (BRIGHTNESS / 2))",
+            "            b = max(0, min(255, b))",
+            "            r_wave = math.sin((x * 0.38) + (t * 0.12))",
+            "            g_wave = math.sin((y * 0.41) - (t * 0.10))",
+            "            u_wave = math.sin(((x + y) * 0.27) + (t * 0.08))",
+            "            r = max(0, min(255, int(b * 0.45 + (r_wave + 1) * 80)))",
+            "            g = max(0, min(255, int(b * 0.30 + (g_wave + 1) * 95)))",
+            "            u = max(0, min(255, int(b * 0.55 + (u_wave + 1) * 85)))",
+            "            np[xy_to_index(x, y)] = (r, g, u)",
+          ];
+    return [
+      "from machine import Pin",
+      "import neopixel",
+      "import time",
+      "import math",
+      "",
+      "np = neopixel.NeoPixel(Pin(4), 16 * 16)",
+      `PATTERN = "${pattern}"`,
+      `SPEED = ${speed}`,
+      `WAVE_WIDTH = ${width}`,
+      `BRIGHTNESS = ${brightness}`,
+      "",
+      "def xy_to_index(x, y):",
+      "    return y * 16 + (15 - x if y % 2 == 0 else x)",
+      "",
+      "frames = 130",
+      "for t in range(frames):",
+      "    for y in range(16):",
+      "        for x in range(16):",
+      ...bodyLines,
+      "    np.write()",
+      "    time.sleep(0.03)",
+      "",
+      "print('DEMO_DONE')",
+    ].join("\n");
+  }
+
+  escapeHtml(text) {
+    return text
+      .replace(/&/g, "&")
+      .replace(/</g, "&lt;")
+      .replace(/>/g, "&gt;");
+  }
+
+  renderDemoControls() {
+    const patternSelect = document.getElementById("pattern-select");
+    if (patternSelect) patternSelect.value = this.demoVars.pattern;
+    document.getElementById("speed-value").textContent = this.demoVars.speed.toFixed(1);
+    document.getElementById("width-value").textContent = this.demoVars.width.toFixed(2);
+    document.getElementById("brightness-value").textContent = String(Math.round(this.demoVars.brightness));
+  }
+
+  renderDemoCode() {
+    const code = this.buildDemoCode();
+    const lines = code.split("\n");
+    const active = DEMO_PARTS[this.demoPartIndex];
+    const html = lines
+      .map((line, idx) => {
+        const n = idx + 1;
+        const activeClass = n >= active.start && n <= active.end ? " active" : "";
+        return `<span class="demo-line${activeClass}">${String(n).padStart(2, " ")}  ${this.escapeHtml(line)}</span>`;
+      })
+      .join("");
+    document.getElementById("demo-code").innerHTML = html;
+  }
+
+  renderDemoPart() {
+    const part = DEMO_PARTS[this.demoPartIndex];
+    document.getElementById("guide-step").textContent = `Part ${this.demoPartIndex + 1}/${DEMO_PARTS.length}: ${part.title}`;
+    document.getElementById("guide-explain").textContent = part.explain;
+    this.renderDemoCode();
+  }
+
+  buildPreviewFrame(tick) {
+    const pixels = new Array(16 * 16).fill(0).map(() => [0, 0, 0]);
+    const pattern = this.demoVars.pattern;
+    const speed = this.demoVars.speed;
+    const width = this.demoVars.width;
+    const brightness = this.demoVars.brightness;
+    for (let y = 0; y < 16; y += 1) {
+      for (let x = 0; x < 16; x += 1) {
+        const ledIndex = y % 2 === 0 ? y * 16 + (15 - x) : y * 16 + x;
+        if (pattern === "rainbow") {
+          const dx = x - 7.5;
+          const dy = y - 7.5;
+          const angle = Math.atan2(dy, dx);
+          const radius = Math.sqrt(dx * dx + dy * dy);
+          const hue = angle + (radius * width) + (tick * speed * 0.012);
+          const pulse = (Math.sin((radius * 0.65) - (tick * 0.012)) + 1) * 0.5;
+          const scale = (0.45 + pulse * 0.55) * brightness;
+          const r = Math.max(0, Math.min(255, Math.floor((Math.sin(hue + 0.0) * 0.5 + 0.5) * scale)));
+          const g = Math.max(0, Math.min(255, Math.floor((Math.sin(hue + 2.09) * 0.5 + 0.5) * scale)));
+          const u = Math.max(0, Math.min(255, Math.floor((Math.sin(hue + 4.18) * 0.5 + 0.5) * scale)));
+          pixels[ledIndex] = [r, g, u];
+        } else {
+          const dx = x - 7.5;
+          const dy = y - 7.5;
+          const dist = Math.sqrt(dx * dx + dy * dy);
+          const ring = Math.sin(dist * (width * 2.6) - tick * speed * 0.072);
+          const swirl = Math.sin((x * width) + (y * Math.max(0.1, width * 0.8)) + (tick * speed * 0.044));
+          const pulse = Math.sin(tick * speed * 0.01);
+          const b = Math.max(0, Math.min(255, Math.floor((ring * 0.45 + swirl * 0.35 + pulse * 0.2 + 1) * (brightness / 2))));
+          const rWave = Math.sin((x * 0.38) + (tick * 0.12));
+          const gWave = Math.sin((y * 0.41) - (tick * 0.10));
+          const uWave = Math.sin(((x + y) * 0.27) + (tick * 0.08));
+          const r = Math.max(0, Math.min(255, Math.floor(b * 0.45 + (rWave + 1) * 80)));
+          const g = Math.max(0, Math.min(255, Math.floor(b * 0.30 + (gWave + 1) * 95)));
+          const u = Math.max(0, Math.min(255, Math.floor(b * 0.55 + (uWave + 1) * 85)));
+          pixels[ledIndex] = [r, g, u];
+        }
+      }
+    }
+    return { type: "neopixel", pin: 4, bpp: 3, pixels };
+  }
+
+  startIdlePreview() {
+    this.stopIdlePreview();
+    this.previewTick = 0;
+    this.previewTimer = setInterval(() => {
+      this.previewTick += 1;
+      this.renderLedSimulation(this.buildPreviewFrame(this.previewTick));
+    }, 50);
+  }
+
+  stopIdlePreview() {
+    if (this.previewTimer) {
+      clearInterval(this.previewTimer);
+      this.previewTimer = null;
+    }
+  }
+
+  setStatus(msg, kind = "error") {
+    const status = document.getElementById("status");
+    if (!status) return;
+    status.textContent = msg;
+    if (kind === "success") {
+      status.style.color = "#86efac";
+    } else if (kind === "info") {
+      status.style.color = "#93c5fd";
+    } else {
+      status.style.color = "#fca5a5";
+    }
+  }
+
+  ensurePyWorker() {
+    if (!this.pyWorker) {
+      this.pyWorker = new Worker("/static/pyodide-worker.js?v=24");
+      this.pyWorker.onmessage = (event) => this.onWorkerMessage(event);
+    }
+    return this.pyWorker;
+  }
+
+  onWorkerMessage(event) {
+    const data = event.data;
+    if (!data || typeof data !== "object") return;
+    if (data.type === "io") {
+      const text = data.text || "";
+      this.outputBuffer += text;
+      this.processSimulationLines(text.split(/\r?\n/));
+      return;
+    }
+    const pending = this.pyWorkerHandlers.get(data.id);
+    if (!pending) return;
+    this.pyWorkerHandlers.delete(data.id);
+    if (data.ok) pending.resolve(data);
+    else pending.reject(new Error(data.error || "Worker error"));
+  }
+
+  callWorker(type, payload) {
+    return new Promise((resolve, reject) => {
+      const id = ++this.pyWorkerMsgId;
+      this.pyWorkerHandlers.set(id, { resolve, reject });
+      this.ensurePyWorker().postMessage({ id, type, payload });
+    });
+  }
+
+  async ensurePyodideReady() {
+    if (this.pyodideInited) return;
+    await this.callWorker("init", {});
+    this.pyodideInited = true;
+  }
+
+  async prewarm() {
+    try {
+      await this.ensurePyodideReady();
+    } catch (_err) {
+      // ignore warm-up errors
+    }
+  }
+
+  renderLedSimulation(frame) {
+    if (!frame) return;
+    const meta = document.getElementById("led-meta");
+    const grid = document.getElementById("led-grid");
+    if (!meta || !grid) return;
+    const pixels = Array.isArray(frame.pixels) ? frame.pixels : [];
+    meta.textContent = `pin=${frame.pin ?? "?"} | leds=${pixels.length} | bpp=${frame.bpp ?? 3} | mode=16x16`;
+    grid.innerHTML = "";
+    const panelSize = 16 * 16;
+    for (let panelIndex = 0; panelIndex < panelSize; panelIndex += 1) {
+      const row = Math.floor(panelIndex / 16);
+      const col = panelIndex % 16;
+      const ledIndex = row % 2 === 0 ? row * 16 + (15 - col) : row * 16 + col;
+      const px = pixels[ledIndex] || [0, 0, 0];
+      const r = Number(px?.[0] ?? 0);
+      const g = Number(px?.[1] ?? 0);
+      const b = Number(px?.[2] ?? 0);
+      const div = document.createElement("div");
+      div.className = "led";
+      div.title = `panel(${row},${col}) -> #${ledIndex} (${r}, ${g}, ${b})`;
+      div.style.backgroundColor = `rgb(${r}, ${g}, ${b})`;
+      div.style.boxShadow = `0 0 10px rgba(${r}, ${g}, ${b}, 0.55), inset 0 0 8px rgba(0,0,0,0.45)`;
+      grid.appendChild(div);
+    }
+  }
+
+  processSimulationLines(lines) {
+    for (const line of lines || []) {
+      if (typeof line !== "string") continue;
+      const marker = "[neopixel-json]";
+      const idx = line.indexOf(marker);
+      if (idx === -1) continue;
+      const jsonPart = line.slice(idx + marker.length).trim();
+      if (!jsonPart) continue;
+      try {
+        const payload = JSON.parse(jsonPart);
+        if (payload && payload.type === "neopixel") {
+          this.renderLedSimulation(payload);
+        }
+      } catch (_err) {
+        // Ignore malformed simulation payloads.
+      }
+    }
+  }
+
+  async runSource(source, mainPath = "code/tutorial_challenge.py") {
+    this.outputBuffer = "";
+    const outputEl = document.getElementById("output");
+    if (outputEl) outputEl.textContent = "Running...\n";
+    try {
+      const bundleResp = await fetch("/api/workspace/py-sources", { credentials: "include" });
+      if (!bundleResp.ok) {
+        throw new Error("Failed to load workspace sources for tutorial runtime.");
+      }
+      const bundle = await bundleResp.json();
+      const files = { ...(bundle.files || {}) };
+      files[mainPath] = source;
+      await this.ensurePyodideReady();
+      await this.callWorker("run", {
+        files,
+        mainPath,
+        args: [],
+      });
+      const visible = this.outputBuffer
+        .split(/\r?\n/)
+        .filter((line) => line && !line.includes("[neopixel-json]"))
+        .join("\n");
+      if (outputEl) outputEl.textContent = visible || "[no output]";
+      return { ok: true, output: this.outputBuffer };
+    } catch (error) {
+      const out = `${this.outputBuffer}\n${error.message}`.trim();
+      if (outputEl) outputEl.textContent = out;
+      return { ok: false, output: out };
+    }
+  }
+}
+
+async function bootTutorial() {
+  try {
+    const st = await fetch("/api/auth/status");
+    if (st.ok) {
+      const status = await st.json();
+      if (status.auth_enabled) {
+        const me = await fetch("/api/auth/me", { credentials: "include" });
+        if (!me.ok) {
+          const next = encodeURIComponent(`${window.location.pathname}${window.location.search}`);
+          window.location.replace(`/login?next=${next}`);
+          return;
+        }
+      }
+    }
+  } catch (_err) {
+    // Continue even if auth check fails.
+  }
+  new TutorialApp();
+}
+
+document.addEventListener("DOMContentLoaded", () => {
+  bootTutorial();
+});

src/static/users.html

@@ -0,0 +1,484 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Manage users — LED Editor</title>
+  <link rel="icon" href="data:,">
+  <style>
+    * { box-sizing: border-box; }
+    body {
+      margin: 0;
+      min-height: 100vh;
+      display: grid;
+      place-items: center;
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+      background: linear-gradient(135deg, #0f172a, #1e293b);
+      color: #e2e8f0;
+    }
+    .home-card {
+      width: min(640px, 92vw);
+      background: rgba(15, 23, 42, 0.78);
+      border: 1px solid rgba(148, 163, 184, 0.25);
+      border-radius: 14px;
+      padding: 2rem;
+      box-shadow: 0 20px 45px rgba(0, 0, 0, 0.35);
+    }
+    h1 { margin: 0 0 0.5rem 0; font-size: 1.6rem; color: #f8fafc; }
+    p { margin: 0 0 1rem 0; color: #cbd5e1; line-height: 1.5; }
+    .btn {
+      display: inline-block;
+      text-decoration: none;
+      border-radius: 8px;
+      padding: 0.55rem 0.9rem;
+      font-weight: 600;
+      border: 1px solid transparent;
+      cursor: pointer;
+      font-size: 0.95rem;
+    }
+    .btn-primary { background: #3b82f6; color: #ffffff; }
+    .btn-ghost { background: transparent; border-color: #64748b; color: #e2e8f0; }
+    .btn-danger { background: transparent; border-color: #f87171; color: #fecaca; }
+    .btn-danger:hover:not(:disabled) { background: rgba(248, 113, 113, 0.15); }
+    .btn:disabled { opacity: 0.45; cursor: not-allowed; }
+    label { display: block; font-size: 0.85rem; color: #94a3b8; margin-bottom: 0.35rem; }
+    .note { font-size: 0.85rem; color: #94a3b8; }
+    .nav { display: flex; flex-wrap: wrap; gap: 0.5rem; margin-bottom: 1rem; align-items: center; }
+    .hidden { display: none !important; }
+    .invite-panel,
+    .users-panel {
+      margin: 1rem 0;
+      padding: 0.9rem;
+      border: 1px solid rgba(148, 163, 184, 0.35);
+      border-radius: 10px;
+      background: rgba(30, 41, 59, 0.45);
+    }
+    .invite-row {
+      display: flex;
+      gap: 0.5rem;
+      flex-wrap: wrap;
+      margin-top: 0.4rem;
+    }
+    .invite-row input[type="email"] {
+      flex: 1 1 260px;
+      padding: 0.5rem 0.65rem;
+      border-radius: 8px;
+      border: 1px solid #64748b;
+      background: #0f172a;
+      color: #e2e8f0;
+    }
+    .invite-result {
+      margin-top: 0.55rem;
+      font-size: 0.85rem;
+      color: #cbd5e1;
+      word-break: break-all;
+    }
+    .users-list { margin-top: 0.5rem; display: grid; gap: 0.45rem; }
+    .user-row {
+      display: flex;
+      justify-content: space-between;
+      align-items: center;
+      gap: 0.5rem;
+      font-size: 0.9rem;
+    }
+    .user-row a {
+      color: #93c5fd;
+      text-decoration: none;
+      border: 1px solid rgba(147, 197, 253, 0.35);
+      border-radius: 6px;
+      padding: 0.25rem 0.5rem;
+    }
+    .user-actions {
+      display: flex;
+      flex-wrap: wrap;
+      gap: 0.35rem;
+      align-items: center;
+      justify-content: flex-end;
+    }
+    #admin-users-feedback:not(:empty) {
+      padding: 0.5rem 0.65rem;
+      border-radius: 8px;
+      font-size: 0.85rem;
+      margin: 0.5rem 0;
+    }
+    #admin-users-feedback.ok {
+      background: rgba(34, 197, 94, 0.12);
+      border: 1px solid rgba(74, 222, 128, 0.35);
+      color: #bbf7d0;
+    }
+    #admin-users-feedback.err {
+      background: rgba(248, 113, 113, 0.1);
+      border: 1px solid rgba(248, 113, 113, 0.35);
+      color: #fecaca;
+    }
+    .user-edit-form {
+      margin-top: 1rem;
+      padding-top: 1rem;
+      border-top: 1px solid rgba(148, 163, 184, 0.25);
+    }
+    .user-edit-form label { display: block; margin-bottom: 0.65rem; }
+    .user-edit-form input[type='text'],
+    .user-edit-form input[type='password'] {
+      width: 100%;
+      max-width: 320px;
+      padding: 0.45rem 0.55rem;
+      border-radius: 8px;
+      border: 1px solid #64748b;
+      background: #0f172a;
+      color: #e2e8f0;
+      margin-top: 0.25rem;
+    }
+    .user-edit-form .edit-actions {
+      display: flex; flex-wrap: wrap; gap: 0.5rem; margin-top: 0.65rem;
+    }
+    .user-edit-form .super-line {
+      display: flex; align-items: center; gap: 0.5rem;
+      font-size: 0.85rem; color: #cbd5e1; margin-bottom: 0.65rem;
+    }
+    .user-edit-form .super-line input { accent-color: #3b82f6; }
+  </style>
+</head>
+<body>
+  <main class="home-card">
+    <h1>Manage users</h1>
+    <p class="note">Superuser-only. Add accounts via invite link, edit roles, or remove users.</p>
+    <div class="nav">
+      <a class="btn btn-ghost" href="/">← Home</a>
+      <a class="btn btn-ghost" href="/editor">Open editor</a>
+      <span id="auth-greeting"></span>
+      <button type="button" class="btn btn-ghost hidden" id="btn-logout">Sign out</button>
+    </div>
+
+    <div id="not-allowed" class="hidden">
+      <p style="color:#fca5a5">You need to be signed in as a superuser to manage users.
+        <a href="/login?next=/users" style="color:#93c5fd">Sign in</a></p>
+    </div>
+
+    <section id="users-panel" class="users-panel hidden">
+      <strong>Accounts</strong>
+      <div id="admin-users-feedback" role="status" aria-live="polite"></div>
+      <div id="users-list" class="users-list"></div>
+      <div id="user-edit-form" class="user-edit-form hidden">
+        <strong id="user-edit-heading">Edit account</strong>
+        <p class="note" style="margin: 0.35rem 0 0.5rem">Change login name or admin role; set a password only when you mean to reset it.</p>
+        <input type="hidden" id="edit-user-id" autocomplete="off" />
+        <label for="edit-user-username">Username
+          <input type="text" id="edit-user-username" name="username" autocomplete="username" minlength="3" maxlength="64" />
+        </label>
+        <label for="edit-user-password">New password
+          <input type="password" id="edit-user-password" name="password" autocomplete="new-password" minlength="8" maxlength="128" placeholder="Leave blank to keep current" />
+        </label>
+        <label class="super-line">
+          <input type="checkbox" id="edit-user-super" />
+          Superuser (can manage accounts and invites)
+        </label>
+        <div class="edit-actions">
+          <button type="button" class="btn btn-primary" id="edit-user-save">Save changes</button>
+          <button type="button" class="btn btn-ghost" id="edit-user-cancel">Cancel</button>
+        </div>
+      </div>
+    </section>
+
+    <section id="invite-panel" class="invite-panel hidden">
+      <strong>Add users via invite link</strong>
+      <p class="note" style="margin-top:0.4rem">
+        Each link lets <strong>one</strong> person create their own account at <code>/register?invite=…</code> with a password they choose. After it is used, create a new link for the next person.
+      </p>
+      <div class="invite-row">
+        <input id="invite-email" type="email" placeholder="new.user@example.com" autocomplete="email" />
+        <button type="button" class="btn btn-primary" id="invite-create-btn">Email invite</button>
+        <button type="button" class="btn btn-ghost" id="invite-link-btn">Invite link only</button>
+      </div>
+      <div id="invite-result" class="invite-result"></div>
+      <button type="button" class="btn btn-ghost hidden" id="invite-copy-btn" aria-label="Copy invite link">Copy invite link</button>
+    </section>
+  </main>
+  <script>
+    let currentAdminUserId = null;
+
+    function formatApiDetail(body) {
+      if (!body || body.detail === undefined || body.detail === null) return '';
+      const d = body.detail;
+      if (typeof d === 'string') return d;
+      if (Array.isArray(d))
+        return d.map((item) => (typeof item === 'object' && item && item.msg ? String(item.msg) : JSON.stringify(item))).join(' ');
+      return String(d);
+    }
+
+    function setAdminUsersFeedback(kind, msg) {
+      const el = document.getElementById('admin-users-feedback');
+      if (!el) return;
+      el.textContent = msg || '';
+      el.classList.remove('ok', 'err');
+      if (kind === 'ok') el.classList.add('ok');
+      if (kind === 'err') el.classList.add('err');
+    }
+
+    async function refreshUsersList(viewerId) {
+      const usersList = document.getElementById('users-list');
+      if (!usersList) return;
+      usersList.textContent = 'Loading users...';
+      try {
+        const res = await fetch('/api/users', { credentials: 'include' });
+        const users = await res.json().catch(() => []);
+        if (!res.ok) {
+          usersList.textContent = 'Unable to load users.';
+          return;
+        }
+        usersList.innerHTML = '';
+        for (const user of users) {
+          const row = document.createElement('div');
+          row.className = 'user-row';
+          const name = document.createElement('span');
+          name.textContent = `${user.username}${user.is_superuser ? ' (admin)' : ''}`;
+          const actions = document.createElement('div');
+          actions.className = 'user-actions';
+          const link = document.createElement('a');
+          link.href = `/editor?workspace_user_id=${encodeURIComponent(String(user.id))}`;
+          link.textContent = 'Open workspace';
+          const editBtn = document.createElement('button');
+          editBtn.type = 'button';
+          editBtn.className = 'btn btn-ghost';
+          editBtn.textContent = 'Edit';
+          editBtn.title = `Edit ${user.username}`;
+          editBtn.addEventListener('click', () => openUserEdit(user.id, user.username, user.is_superuser));
+          const delBtn = document.createElement('button');
+          delBtn.type = 'button';
+          delBtn.className = 'btn btn-ghost btn-danger';
+          delBtn.textContent = 'Remove';
+          const isSelf = Number(user.id) === Number(viewerId);
+          delBtn.disabled = isSelf;
+          delBtn.title = isSelf ? 'You cannot delete your own account here' : 'Permanently remove this user';
+          delBtn.addEventListener('click', async () => {
+            const ok = confirm(`Remove user “${user.username}”? Their workspace folder stays on disk until you delete it manually.`);
+            if (!ok) return;
+            delBtn.disabled = true;
+            setAdminUsersFeedback('', '');
+            try {
+              const dres = await fetch(`/api/users/${encodeURIComponent(String(user.id))}`, {
+                method: 'DELETE', credentials: 'include',
+              });
+              const body = await dres.json().catch(() => ({}));
+              if (!dres.ok) {
+                setAdminUsersFeedback('err', formatApiDetail(body) || dres.statusText || 'Could not remove user');
+                delBtn.disabled = false;
+                return;
+              }
+              setAdminUsersFeedback('ok', `Removed ${user.username}.`);
+              await refreshUsersList(viewerId);
+            } catch (err) {
+              setAdminUsersFeedback('err', String(err.message || err));
+              delBtn.disabled = false;
+            }
+          });
+          actions.appendChild(editBtn);
+          actions.appendChild(link);
+          actions.appendChild(delBtn);
+          row.appendChild(name);
+          row.appendChild(actions);
+          usersList.appendChild(row);
+        }
+      } catch (_err) {
+        usersList.textContent = 'Unable to load users.';
+      }
+    }
+
+    function closeUserEdit() {
+      const sheet = document.getElementById('user-edit-form');
+      if (sheet) sheet.classList.add('hidden');
+    }
+
+    function openUserEdit(userId, username, isSuperuser) {
+      document.getElementById('edit-user-id').value = String(userId);
+      document.getElementById('edit-user-username').value = username;
+      document.getElementById('edit-user-password').value = '';
+      document.getElementById('edit-user-super').checked = Boolean(isSuperuser);
+      document.getElementById('user-edit-heading').textContent = `Edit @${username}`;
+      document.getElementById('user-edit-form').classList.remove('hidden');
+    }
+
+    document.getElementById('edit-user-cancel').addEventListener('click', () => closeUserEdit());
+
+    document.getElementById('edit-user-save').addEventListener('click', async () => {
+      const id = document.getElementById('edit-user-id').value;
+      const u = document.getElementById('edit-user-username').value.trim();
+      const pw = document.getElementById('edit-user-password').value;
+      const superU = document.getElementById('edit-user-super').checked;
+      const saveBtn = document.getElementById('edit-user-save');
+      setAdminUsersFeedback('', '');
+      if (!u || u.length < 3) {
+        setAdminUsersFeedback('err', 'Username must be at least 3 characters.');
+        return;
+      }
+      const payload = { username: u, is_superuser: superU };
+      const tpw = pw.trim();
+      if (tpw.length > 0) {
+        if (tpw.length < 8) {
+          setAdminUsersFeedback('err', 'New password must be at least 8 characters (or leave blank).');
+          return;
+        }
+        payload.password = tpw;
+      }
+      saveBtn.disabled = true;
+      try {
+        const res = await fetch(`/api/users/${encodeURIComponent(String(id))}`, {
+          method: 'PATCH',
+          credentials: 'include',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify(payload),
+        });
+        const body = await res.json().catch(() => ({}));
+        if (!res.ok) {
+          setAdminUsersFeedback('err', formatApiDetail(body) || res.statusText || 'Update failed');
+          saveBtn.disabled = false;
+          return;
+        }
+        setAdminUsersFeedback('ok', `Updated @${body.username}.`);
+        closeUserEdit();
+        await refreshUsersList(currentAdminUserId);
+      } catch (err) {
+        setAdminUsersFeedback('err', String(err.message || err));
+      }
+      saveBtn.disabled = false;
+    });
+
+    document.getElementById('btn-logout').addEventListener('click', async () => {
+      await fetch('/api/auth/logout', { method: 'POST', credentials: 'include' });
+      window.location.href = '/';
+    });
+
+    function showInviteOutcome(inviteUrl, headline) {
+      const result = document.getElementById('invite-result');
+      const copyBtn = document.getElementById('invite-copy-btn');
+      result.textContent = '';
+      const line = document.createElement('p');
+      line.style.margin = '0 0 0.35rem 0';
+      line.textContent = headline;
+      const a = document.createElement('a');
+      a.href = inviteUrl;
+      a.textContent = inviteUrl;
+      a.style.color = '#93c5fd';
+      a.style.wordBreak = 'break-all';
+      result.appendChild(line);
+      result.appendChild(a);
+      copyBtn.classList.remove('hidden');
+      copyBtn.dataset.inviteUrl = inviteUrl;
+    }
+
+    function clearInviteOutcome() {
+      const result = document.getElementById('invite-result');
+      const copyBtn = document.getElementById('invite-copy-btn');
+      result.textContent = '';
+      copyBtn.classList.add('hidden');
+      copyBtn.textContent = 'Copy invite link';
+      delete copyBtn.dataset.inviteUrl;
+    }
+
+    document.getElementById('invite-copy-btn').addEventListener('click', async () => {
+      const copyBtn = document.getElementById('invite-copy-btn');
+      const url = copyBtn.dataset.inviteUrl;
+      if (!url) return;
+      try {
+        await navigator.clipboard.writeText(url);
+        copyBtn.textContent = 'Copied!';
+        setTimeout(() => { copyBtn.textContent = 'Copy invite link'; }, 2000);
+      } catch (_e) {
+        copyBtn.textContent = 'Copy failed — select the link above';
+        setTimeout(() => { copyBtn.textContent = 'Copy invite link'; }, 2500);
+      }
+    });
+
+    document.getElementById('invite-create-btn').addEventListener('click', async () => {
+      const emailInput = document.getElementById('invite-email');
+      const result = document.getElementById('invite-result');
+      const email = (emailInput.value || '').trim();
+      clearInviteOutcome();
+      if (!email) {
+        result.textContent = 'Enter an email address first.';
+        return;
+      }
+      try {
+        const res = await fetch('/api/users/invites', {
+          method: 'POST',
+          credentials: 'include',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ email, expires_days: 7 }),
+        });
+        const body = await res.json().catch(() => ({}));
+        if (!res.ok) {
+          result.textContent = formatApiDetail(body) || res.statusText || 'Failed to create invite';
+          return;
+        }
+        const headline = body.delivered
+          ? 'Email sent. They can also use this link to register:'
+          : 'Email not sent (SMTP not configured). Share this registration link:';
+        showInviteOutcome(body.invite_url, headline);
+      } catch (err) {
+        result.textContent = String(err.message || err);
+      }
+    });
+
+    document.getElementById('invite-link-btn').addEventListener('click', async () => {
+      const result = document.getElementById('invite-result');
+      clearInviteOutcome();
+      try {
+        const res = await fetch('/api/users/invites', {
+          method: 'POST',
+          credentials: 'include',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ email: null, expires_days: 7 }),
+        });
+        const body = await res.json().catch(() => ({}));
+        if (!res.ok) {
+          result.textContent = formatApiDetail(body) || res.statusText || 'Failed to create invite link';
+          return;
+        }
+        showInviteOutcome(body.invite_url, 'Share this link so they can create an account:');
+      } catch (err) {
+        result.textContent = String(err.message || err);
+      }
+    });
+
+    async function init() {
+      const greet = document.getElementById('auth-greeting');
+      const logout = document.getElementById('btn-logout');
+      const usersPanel = document.getElementById('users-panel');
+      const invitePanel = document.getElementById('invite-panel');
+      const blocked = document.getElementById('not-allowed');
+
+      const st = await fetch('/api/auth/status').catch(() => null);
+      if (!st || !st.ok) {
+        blocked.classList.remove('hidden');
+        return;
+      }
+      const status = await st.json();
+      if (!status.auth_enabled) {
+        // Auth disabled — anyone can poke /api/users; show panels regardless.
+        usersPanel.classList.remove('hidden');
+        invitePanel.classList.remove('hidden');
+        await refreshUsersList(null);
+        return;
+      }
+      const me = await fetch('/api/auth/me', { credentials: 'include' });
+      if (!me.ok) {
+        blocked.classList.remove('hidden');
+        return;
+      }
+      const j = await me.json();
+      if (!j.user || !j.user.is_superuser) {
+        blocked.classList.remove('hidden');
+        greet.textContent = `Signed in as ${j.user.username}`;
+        logout.classList.remove('hidden');
+        return;
+      }
+      currentAdminUserId = j.user.id;
+      greet.textContent = `Signed in as ${j.user.username} (admin)`;
+      logout.classList.remove('hidden');
+      usersPanel.classList.remove('hidden');
+      invitePanel.classList.remove('hidden');
+      await refreshUsersList(j.user.id);
+    }
+    init();
+  </script>
+</body>
+</html>

src/static/zip-utils.js

@@ -0,0 +1,204 @@
+/**
+ * Tiny zero-dependency ZIP encoder. STORE-only (no compression) — fine for
+ * Python source which is small, gzip would only save a few KB. Kept inline
+ * here so local-mode export works on every browser, including the ones
+ * (Firefox/Safari/Brave-without-flag) that have no folder picker.
+ *
+ * Format reference: APPNOTE.TXT 6.3.x
+ */
+
+let _crcTable = null;
+function crcTable() {
+  if (_crcTable) return _crcTable;
+  const t = new Uint32Array(256);
+  for (let i = 0; i < 256; i++) {
+    let c = i;
+    for (let j = 0; j < 8; j++) c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+    t[i] = c;
+  }
+  _crcTable = t;
+  return t;
+}
+
+function crc32(bytes) {
+  const tbl = crcTable();
+  let c = 0xffffffff;
+  for (let i = 0; i < bytes.length; i++) c = tbl[(c ^ bytes[i]) & 0xff] ^ (c >>> 8);
+  return (c ^ 0xffffffff) >>> 0;
+}
+
+function dosTime(d) {
+  return ((d.getHours() << 11) | (d.getMinutes() << 5) | (d.getSeconds() >> 1)) & 0xffff;
+}
+function dosDate(d) {
+  return (((d.getFullYear() - 1980) << 9) | ((d.getMonth() + 1) << 5) | d.getDate()) & 0xffff;
+}
+
+/**
+ * Build an uncompressed ZIP from a list of `{ name, content }` entries.
+ * `content` may be a string or a Uint8Array.
+ *
+ * Returns a Blob (`application/zip`).
+ */
+export function createZip(entries) {
+  const enc = new TextEncoder();
+  const date = new Date();
+  const time = dosTime(date);
+  const ddate = dosDate(date);
+  const parts = [];
+  const central = [];
+  let offset = 0;
+
+  for (const entry of entries) {
+    const data = typeof entry.content === 'string' ? enc.encode(entry.content) : entry.content;
+    const nameBytes = enc.encode(entry.name);
+    const crc = crc32(data);
+
+    const local = new ArrayBuffer(30 + nameBytes.length);
+    const lv = new DataView(local);
+    lv.setUint32(0, 0x04034b50, true);
+    lv.setUint16(4, 20, true);
+    lv.setUint16(6, 0x0800, true); // bit 11 = UTF-8 filename
+    lv.setUint16(8, 0, true);
+    lv.setUint16(10, time, true);
+    lv.setUint16(12, ddate, true);
+    lv.setUint32(14, crc, true);
+    lv.setUint32(18, data.length, true);
+    lv.setUint32(22, data.length, true);
+    lv.setUint16(26, nameBytes.length, true);
+    lv.setUint16(28, 0, true);
+    new Uint8Array(local, 30).set(nameBytes);
+    parts.push(local);
+    parts.push(data);
+
+    const cd = new ArrayBuffer(46 + nameBytes.length);
+    const cv = new DataView(cd);
+    cv.setUint32(0, 0x02014b50, true);
+    cv.setUint16(4, 0x031e, true); // made by: unix + zip 3.0
+    cv.setUint16(6, 20, true);
+    cv.setUint16(8, 0x0800, true);
+    cv.setUint16(10, 0, true);
+    cv.setUint16(12, time, true);
+    cv.setUint16(14, ddate, true);
+    cv.setUint32(16, crc, true);
+    cv.setUint32(20, data.length, true);
+    cv.setUint32(24, data.length, true);
+    cv.setUint16(28, nameBytes.length, true);
+    cv.setUint16(30, 0, true);
+    cv.setUint16(32, 0, true);
+    cv.setUint16(34, 0, true);
+    cv.setUint16(36, 0, true);
+    cv.setUint32(38, 0, true);
+    cv.setUint32(42, offset, true);
+    new Uint8Array(cd, 46).set(nameBytes);
+    central.push(cd);
+
+    offset += local.byteLength + data.length;
+  }
+
+  const cdOffset = offset;
+  let cdSize = 0;
+  for (const cd of central) {
+    parts.push(cd);
+    cdSize += cd.byteLength;
+  }
+
+  const eocd = new ArrayBuffer(22);
+  const ev = new DataView(eocd);
+  ev.setUint32(0, 0x06054b50, true);
+  ev.setUint16(4, 0, true);
+  ev.setUint16(6, 0, true);
+  ev.setUint16(8, entries.length, true);
+  ev.setUint16(10, entries.length, true);
+  ev.setUint32(12, cdSize, true);
+  ev.setUint32(16, cdOffset, true);
+  ev.setUint16(20, 0, true);
+  parts.push(eocd);
+
+  return new Blob(parts, { type: 'application/zip' });
+}
+
+/**
+ * Parse an uncompressed-or-DEFLATEd ZIP buffer into an array of
+ * `{ name, content }` entries (text). Skips directory entries (those that
+ * end with '/'). Throws if the buffer is not a valid ZIP archive.
+ *
+ * Compression methods supported:
+ *   - 0 (STORE)
+ *   - 8 (DEFLATE) — decompressed via the browser's `DecompressionStream`
+ *     ('deflate-raw'), available in Chrome/Edge/Brave 113+, Firefox 113+,
+ *     Safari 16.4+. If the browser is too old we surface a clear error.
+ */
+export async function readZip(arrayBuffer) {
+  const buf = arrayBuffer instanceof ArrayBuffer ? arrayBuffer : arrayBuffer.buffer;
+  const view = new DataView(buf);
+  if (buf.byteLength < 22) throw new Error('Not a ZIP file (too small)');
+
+  // EOCD signature scan from the end (max 64 KiB comment).
+  let eocd = -1;
+  const minScan = Math.max(0, buf.byteLength - 22 - 65535);
+  for (let i = buf.byteLength - 22; i >= minScan; i--) {
+    if (view.getUint32(i, true) === 0x06054b50) {
+      eocd = i;
+      break;
+    }
+  }
+  if (eocd === -1) throw new Error('Not a ZIP file (no end-of-central-directory)');
+  const totalEntries = view.getUint16(eocd + 10, true);
+  const cdOffset = view.getUint32(eocd + 16, true);
+
+  const dec = new TextDecoder();
+  const out = [];
+  let p = cdOffset;
+  for (let i = 0; i < totalEntries; i++) {
+    if (view.getUint32(p, true) !== 0x02014b50) {
+      throw new Error('Bad central-directory entry');
+    }
+    const method = view.getUint16(p + 10, true);
+    const compSize = view.getUint32(p + 20, true);
+    const uncompSize = view.getUint32(p + 24, true);
+    const nameLen = view.getUint16(p + 28, true);
+    const extraLen = view.getUint16(p + 30, true);
+    const commentLen = view.getUint16(p + 32, true);
+    const localOff = view.getUint32(p + 42, true);
+    const name = dec.decode(new Uint8Array(buf, p + 46, nameLen));
+    p += 46 + nameLen + extraLen + commentLen;
+
+    // Directory entry — skip; createFolder happens implicitly when we
+    // write a child file under that path.
+    if (name.endsWith('/')) continue;
+
+    const lview = new DataView(buf, localOff, 30);
+    if (lview.getUint32(0, true) !== 0x04034b50) {
+      throw new Error(`Bad local header for "${name}"`);
+    }
+    const lNameLen = lview.getUint16(26, true);
+    const lExtraLen = lview.getUint16(28, true);
+    const dataOff = localOff + 30 + lNameLen + lExtraLen;
+
+    let bytes;
+    if (method === 0) {
+      bytes = new Uint8Array(buf, dataOff, uncompSize);
+    } else if (method === 8) {
+      if (typeof DecompressionStream === 'undefined') {
+        throw new Error(
+          `"${name}" is DEFLATE-compressed but this browser has no DecompressionStream`
+        );
+      }
+      const compressed = new Uint8Array(buf, dataOff, compSize);
+      const stream = new ReadableStream({
+        start(controller) {
+          controller.enqueue(compressed);
+          controller.close();
+        },
+      }).pipeThrough(new DecompressionStream('deflate-raw'));
+      bytes = new Uint8Array(await new Response(stream).arrayBuffer());
+    } else {
+      throw new Error(`Unsupported compression method ${method} on "${name}"`);
+    }
+
+    out.push({ name, content: dec.decode(bytes) });
+  }
+  return out;
+}
+

tests/test_api.py

@@ -9,14 +9,23 @@ def test_root_serves_html(client):
     response = client.get("/")
     assert response.status_code == 200
     assert "text/html" in response.headers["content-type"]
-    assert "Python Editor" in response.text
+    assert "LED Editor" in response.text
 
 
 def test_editor_route_serves_editor_html(client):
     response = client.get("/editor")
     assert response.status_code == 200
     assert "text/html" in response.headers["content-type"]
-    assert "Python Editor" in response.text
+    assert "LED Editor" in response.text
+
+
+def test_lib_served_directly_from_repo_bundle(client, tmp_path):
+    """`lib/` reads come straight from repo `lib/`; no workspace cache is created."""
+    resp = client.get("/api/file/lib/machine.py")
+    assert resp.status_code == 200
+    body = resp.json().get("content", "")
+    assert "class Pin" in body and len(body) > 0
+    assert not (tmp_path / "lib").exists()
 
 
 def test_list_files_hides_dotfiles_and_reports_sizes(client, tmp_path):
@@ -57,17 +66,14 @@ def test_save_file_collapses_duplicate_scoped_prefix(client, tmp_path):
 
 
 def test_lib_folder_is_read_only_for_mutations(client, tmp_path):
-    lib_dir = tmp_path / "lib"
-    lib_dir.mkdir(exist_ok=True)
-    (lib_dir / "helper.py").write_text("x = 1\n", encoding="utf-8")
     code_dir = tmp_path / "code"
-    code_dir.mkdir()
+    code_dir.mkdir(exist_ok=True)
     (code_dir / "main.py").write_text("print('ok')\n", encoding="utf-8")
 
     save_blocked = client.post("/api/file/lib/new.txt", json={"content": "nope"})
     assert save_blocked.status_code == 403
 
-    delete_blocked = client.delete("/api/file/lib/helper.py")
+    delete_blocked = client.delete("/api/file/lib/machine.py")
     assert delete_blocked.status_code == 403
 
     move_blocked = client.post(
@@ -109,7 +115,7 @@ def test_read_file_non_utf8_returns_400(client, tmp_path):
 
 def test_delete_file_success_and_errors(client, tmp_path):
     target = tmp_path / "code" / "delete-me.txt"
-    target.parent.mkdir()
+    target.parent.mkdir(exist_ok=True)
     target.write_text("x", encoding="utf-8")
 
     ok = client.delete("/api/file/code/delete-me.txt")
@@ -213,7 +219,7 @@ def test_folder_create_and_delete(client, tmp_path):
 
 
 def test_create_folder_collapses_duplicate_scoped_prefix(client, tmp_path):
-    (tmp_path / "code").mkdir()
+    (tmp_path / "code").mkdir(exist_ok=True)
     create = client.post("/api/folder/new/code/code/nested", json={"path": "ignored"})
     assert create.status_code == 200
     assert (tmp_path / "code" / "nested").is_dir()
@@ -224,23 +230,23 @@ def test_folder_delete_errors(client, tmp_path):
     missing = client.delete("/api/folder/code/missing")
     assert missing.status_code == 404
 
-    (tmp_path / "code").mkdir()
+    (tmp_path / "code").mkdir(exist_ok=True)
     (tmp_path / "code" / "file.txt").write_text("x", encoding="utf-8")
     not_dir = client.delete("/api/folder/code/file.txt")
     assert not_dir.status_code == 400
 
 
 def test_workspace_py_sources_returns_python_files(client, tmp_path):
-    (tmp_path / "code").mkdir()
+    (tmp_path / "code").mkdir(exist_ok=True)
     (tmp_path / "code" / "app.py").write_text("x = 1\n", encoding="utf-8")
-    (tmp_path / "lib").mkdir(exist_ok=True)
-    (tmp_path / "lib" / "util.py").write_text("def f():\n    pass\n", encoding="utf-8")
 
     response = client.get("/api/workspace/py-sources")
     assert response.status_code == 200
     files = response.json()["files"]
     assert files["code/app.py"] == "x = 1\n"
-    assert "lib/util.py" in files
+    # Bundled stubs from repo `lib/` are merged in automatically.
+    assert "lib/machine.py" in files
+    assert "lib/neopixel.py" in files
 
 
 def test_api_requires_bearer_when_editor_api_key_set(tmp_path, monkeypatch):
@@ -265,7 +271,9 @@ def test_api_requires_bearer_when_editor_api_key_set(tmp_path, monkeypatch):
         assert ok.status_code == 200
 
 
-def test_create_app_startup_creates_lib(tmp_path, monkeypatch):
+def test_create_app_startup_does_not_seed_workspace_lib(tmp_path, monkeypatch):
+    """Bundle stubs are read directly from repo `lib/`, so startup must not create
+    a `WORKSPACE_ROOT/lib` cache."""
     import editor_app.config as config
     import editor_app.db.session as db_sess
     import editor_app.main as main
@@ -283,4 +291,4 @@ def test_create_app_startup_creates_lib(tmp_path, monkeypatch):
     assert not (tmp_path / "lib").exists()
     with TestClient(main.app) as _client:
         _client.get("/api/auth/status")
-    assert (tmp_path / "lib").is_dir()
+    assert not (tmp_path / "lib").exists()

tests/test_auth.py

@@ -18,7 +18,7 @@ def _reload_app(tmp_path, monkeypatch, **env):
     monkeypatch.delenv("BOOTSTRAP_ADMIN_PASSWORD", raising=False)
     for k, v in env.items():
         monkeypatch.setenv(k, v)
-    config.WORKSPACE_ROOT = tmp_path
+    monkeypatch.setattr(config, "WORKSPACE_ROOT", tmp_path)
     db_sess.reset_engine()
     importlib.reload(main)
     return main.app
@@ -31,6 +31,32 @@ def test_auth_status_public(tmp_path, monkeypatch):
         assert r.json() == {"auth_enabled": False, "register_open": True, "invite_required": False}
 
 
+def test_auth_invite_only_defaults_on(monkeypatch, tmp_path):
+    """When AUTH_INVITE_ONLY is unset, require invites (deployment-safe default)."""
+    import editor_app.config as config
+    import editor_app.db.session as db_sess
+    import editor_app.main as main
+
+    monkeypatch.setenv("WORKSPACE_ROOT", str(tmp_path))
+    monkeypatch.setenv("AUTH_DATABASE_PATH", str(tmp_path / "auth.db"))
+    monkeypatch.setenv("AUTH_REGISTER_OPEN", "true")
+    monkeypatch.setenv("AUTH_ENABLED", "true")
+    monkeypatch.delenv("AUTH_INVITE_ONLY", raising=False)
+    monkeypatch.delenv("EDITOR_API_KEY", raising=False)
+    monkeypatch.delenv("BOOTSTRAP_ADMIN_USERNAME", raising=False)
+    monkeypatch.delenv("BOOTSTRAP_ADMIN_PASSWORD", raising=False)
+    config.WORKSPACE_ROOT = tmp_path
+    db_sess.reset_engine()
+    importlib.reload(main)
+
+    with TestClient(main.app) as client:
+        st = client.get("/api/auth/status")
+        assert st.status_code == 200
+        assert st.json()["invite_required"] is True
+        denied = client.post("/api/auth/register", json={"username": "noc", "password": "password99"})
+        assert denied.status_code == 403
+
+
 def test_register_login_and_api_access(tmp_path, monkeypatch):
     with TestClient(
         _reload_app(tmp_path, monkeypatch, AUTH_ENABLED="true", AUTH_REGISTER_OPEN="true")
@@ -58,6 +84,39 @@ def test_register_login_and_api_access(tmp_path, monkeypatch):
         assert client.get("/api/files").status_code == 401
 
 
+def test_new_user_workspace_has_default_main_py(tmp_path, monkeypatch):
+    with TestClient(
+        _reload_app(tmp_path, monkeypatch, AUTH_ENABLED="true", AUTH_REGISTER_OPEN="true")
+    ) as client:
+        reg = client.post("/api/auth/register", json={"username": "alice", "password": "password99"})
+        assert reg.status_code == 200
+        assert reg.json()["username"] == "alice"
+        uid = reg.json()["id"]
+        user_root = tmp_path / "users" / f"alice-{uid}"
+        code_root = user_root / "code"
+        demos_dir = user_root / "demos"
+        on_disk = code_root / "main.py"
+        assert on_disk.is_file()
+        assert on_disk.read_text(encoding="utf-8") == 'print("Hello, World!")\n'
+        canonical = ("pattern_rainbow_demo.py", "pattern_twinkle_demo.py", "pattern_chase_demo.py")
+        for fname in canonical:
+            cp = demos_dir / fname
+            assert cp.is_file(), f"missing bundled copy demos/{fname} (workspace must ship with app)"
+            text = cp.read_text(encoding="utf-8")
+            assert len(text.strip()) > 20
+            assert "from led_patterns" not in text
+            assert "import led_patterns" not in text
+
+        assert client.post("/api/auth/login", json={"username": "alice", "password": "password99"}).status_code == 200
+        fetched = client.get("/api/file/code/main.py")
+        assert fetched.status_code == 200
+        assert fetched.json()["filename"] == "main.py"
+        assert 'Hello, World!' in fetched.json()["content"]
+        chase = client.get("/api/file/demos/pattern_chase_demo.py")
+        assert chase.status_code == 200
+        assert "knight_rider_scanner_frame" in chase.json()["content"]
+
+
 def test_second_user_not_superuser(tmp_path, monkeypatch):
     with TestClient(
         _reload_app(tmp_path, monkeypatch, AUTH_ENABLED="true", AUTH_REGISTER_OPEN="true")
@@ -134,7 +193,54 @@ def test_invite_required_blocks_public_register(tmp_path, monkeypatch):
         assert blocked.status_code == 403
 
 
-def test_superuser_lists_and_creates_users(tmp_path, monkeypatch):
+def test_superuser_can_patch_user_account(tmp_path, monkeypatch):
+    with TestClient(
+        _reload_app(tmp_path, monkeypatch, AUTH_ENABLED="true", AUTH_REGISTER_OPEN="true")
+    ) as client:
+        client.post("/api/auth/register", json={"username": "admin", "password": "password99"})
+        client.post("/api/auth/login", json={"username": "admin", "password": "password99"})
+        invite = client.post("/api/users/invites", json={"email": None, "expires_days": 7})
+        token = invite.json()["invite_url"].split("invite=", 1)[1]
+        client.post("/api/auth/logout")
+        sub = client.post(
+            "/api/auth/register",
+            json={"username": "subacc", "password": "original99", "invite_token": token},
+        ).json()
+        uid = sub["id"]
+        client.post("/api/auth/login", json={"username": "admin", "password": "password99"})
+
+        pat = client.patch(
+            f"/api/users/{uid}",
+            json={"username": "renamed", "is_superuser": True, "password": "renewedpw8"},
+        )
+        assert pat.status_code == 200
+        assert pat.json()["username"] == "renamed"
+        assert pat.json()["is_superuser"] is True
+
+        client.post("/api/auth/logout")
+        assert client.post(
+            "/api/auth/login",
+            json={"username": "renamed", "password": "renewedpw8"},
+        ).status_code == 200
+
+
+def test_superuser_cannot_demote_last_admin(tmp_path, monkeypatch):
+    with TestClient(
+        _reload_app(tmp_path, monkeypatch, AUTH_ENABLED="true", AUTH_REGISTER_OPEN="true")
+    ) as client:
+        client.post("/api/auth/register", json={"username": "solo_admin", "password": "password99"})
+        client.post("/api/auth/login", json={"username": "solo_admin", "password": "password99"})
+        uid = client.get("/api/auth/me").json()["user"]["id"]
+        demote = client.patch(
+            f"/api/users/{uid}",
+            json={"username": "solo_admin", "is_superuser": False},
+        )
+        assert demote.status_code == 400
+        detail = demote.json().get("detail") or ""
+        assert "last" in detail.lower() or "administrator" in detail.lower()
+
+
+def test_superuser_lists_users_after_invite_signup(tmp_path, monkeypatch):
     with TestClient(
         _reload_app(tmp_path, monkeypatch, AUTH_ENABLED="true", AUTH_REGISTER_OPEN="true")
     ) as client:
@@ -145,14 +251,20 @@ def test_superuser_lists_and_creates_users(tmp_path, monkeypatch):
         assert listed.status_code == 200
         assert len(listed.json()) == 1
 
-        created = client.post(
-            "/api/users",
-            json={"username": "sub", "password": "password99", "is_superuser": False},
-        )
-        assert created.status_code == 200
-        assert created.json()["username"] == "sub"
-        assert created.json()["is_superuser"] is False
+        invite = client.post("/api/users/invites", json={"email": None, "expires_days": 7})
+        assert invite.status_code == 200
+        token = invite.json()["invite_url"].split("invite=", 1)[1]
 
+        client.post("/api/auth/logout")
+        reg = client.post(
+            "/api/auth/register",
+            json={"username": "sub", "password": "password99", "invite_token": token},
+        )
+        assert reg.status_code == 200
+        assert reg.json()["username"] == "sub"
+        assert reg.json()["is_superuser"] is False
+
+        client.post("/api/auth/login", json={"username": "admin", "password": "password99"})
         names = {u["username"] for u in client.get("/api/users").json()}
         assert names == {"admin", "sub"}
 
@@ -194,10 +306,16 @@ def test_users_have_isolated_workspaces(tmp_path, monkeypatch):
 
 
 def test_lib_is_shared_read_only_across_users(tmp_path, monkeypatch):
+    """`lib/` lives at the repo root (single source of truth), not under WORKSPACE_ROOT,
+    so we patch `config.PROJECT_ROOT` to give the test its own isolated lib bundle."""
+    import editor_app.config as config
+
     shared_lib = tmp_path / "lib"
     shared_lib.mkdir(parents=True, exist_ok=True)
     (shared_lib / "shared.py").write_text("VALUE = 42\n", encoding="utf-8")
 
+    monkeypatch.setattr(config, "PROJECT_ROOT", tmp_path)
+
     with TestClient(
         _reload_app(tmp_path, monkeypatch, AUTH_ENABLED="true", AUTH_REGISTER_OPEN="true")
     ) as client:

tests/test_internal.py

@@ -43,3 +43,4 @@ def test_collect_python_sources_skips_hidden_and_binary(tmp_path):
     out = filesystem.collect_python_sources()
     assert out["code/ok.py"] == "a = 1\n"
     assert "bad.py" not in out
+    assert "lib/machine.py" in out, "shared lib stubs should always be merged for Jedi / Pyodide"

tests/test_led_patterns.py

@@ -4,7 +4,8 @@ from pathlib import Path
 
 def _load_patterns_module():
     repo_root = Path(__file__).resolve().parents[1]
-    module_path = repo_root / "workspace" / "code" / "led_patterns.py"
+    # Canonical home for shipped demos — `workspace/` is gitignored.
+    module_path = repo_root / "src" / "static" / "bundled-demos" / "demo" / "led_patterns.py"
     spec = importlib.util.spec_from_file_location("led_patterns", module_path)
     module = importlib.util.module_from_spec(spec)
     assert spec is not None and spec.loader is not None
@@ -30,6 +31,33 @@ def test_chase_frame_has_head_and_tail():
     assert sum(1 for c in frame if c != (0, 0, 0)) == 2
 
 
+def test_bounce_head_pingpongs_off_ends():
+    patterns = _load_patterns_module()
+    bounce = patterns._bounce_head_index
+    assert bounce(5, 0) == 0 and bounce(5, 4) == 4
+    assert bounce(5, 5) == 3 and bounce(5, 8) == 1 and bounce(5, 16) == bounce(5, 0)
+
+
+def test_scanner_bounce_has_head_and_fading_tail():
+    patterns = _load_patterns_module()
+    frame = patterns.scanner_bounce_frame(
+        8, 20, head_color=(80, 10, 10), tail_color=(20, 50, 90), tail_len=4
+    )
+    assert len(frame) == 8
+    bright = max(range(8), key=lambda i: sum(frame[i]))
+    assert sum(frame[bright]) >= 80
+
+
+def test_knight_rider_tail_falls_off():
+    patterns = _load_patterns_module()
+    fr = patterns.knight_rider_scanner_frame(16, 55, tail_len=8, falloff_gamma=3.0)
+    assert len(fr) == 16
+    reds_sorted = sorted(fr[i][0] for i in range(16) if sum(fr[i]) > 0)
+    assert len(reds_sorted) >= 2
+    assert reds_sorted[-1] >= 200
+    assert reds_sorted[0] < reds_sorted[-1] * 0.5
+
+
 def test_twinkle_frame_is_deterministic_for_same_inputs():
     patterns = _load_patterns_module()
     a = patterns.twinkle_frame(20, frame=9, seed=777, sparkles=4)

workspace/code/led_patterns.py

@@ -1,67 +0,0 @@
-"""LED pattern helpers inspired by embedded NeoPixel drivers."""
-
-from __future__ import annotations
-
-import random
-
-
-Color = tuple[int, int, int]
-
-
-def _clamp(channel: int) -> int:
-    return max(0, min(255, int(channel)))
-
-
-def wheel(pos: int) -> Color:
-    """Return a rainbow color for position 0-255."""
-    pos = 255 - (pos & 255)
-    if pos < 85:
-        return (_clamp(255 - pos * 3), 0, _clamp(pos * 3))
-    if pos < 170:
-        pos -= 85
-        return (0, _clamp(pos * 3), _clamp(255 - pos * 3))
-    pos -= 170
-    return (_clamp(pos * 3), _clamp(255 - pos * 3), 0)
-
-
-def rainbow_frame(led_count: int, frame: int, step: int = 4) -> list[Color]:
-    """Generate one rainbow frame across all LEDs."""
-    if led_count <= 0:
-        return []
-    return [wheel((i * 256 // led_count + frame * step) & 255) for i in range(led_count)]
-
-
-def chase_frame(
-    led_count: int,
-    frame: int,
-    color: Color = (255, 120, 0),
-    tail: Color = (16, 0, 0),
-) -> list[Color]:
-    """Generate a two-pixel chase pattern."""
-    if led_count <= 0:
-        return []
-    out: list[Color] = [(0, 0, 0) for _ in range(led_count)]
-    head = frame % led_count
-    trail = (head - 1) % led_count
-    out[trail] = tuple(_clamp(v) for v in tail)  # type: ignore[assignment]
-    out[head] = tuple(_clamp(v) for v in color)  # type: ignore[assignment]
-    return out
-
-
-def twinkle_frame(
-    led_count: int,
-    frame: int,
-    base: Color = (0, 0, 8),
-    sparkle: Color = (255, 255, 180),
-    sparkles: int = 3,
-    seed: int = 1337,
-) -> list[Color]:
-    """Generate deterministic twinkle frames for testing/replay."""
-    if led_count <= 0:
-        return []
-    out: list[Color] = [tuple(_clamp(v) for v in base) for _ in range(led_count)]  # type: ignore[list-item]
-    rng = random.Random(seed + frame)
-    for _ in range(min(max(0, sparkles), led_count)):
-        idx = rng.randrange(led_count)
-        out[idx] = tuple(_clamp(v) for v in sparkle)  # type: ignore[assignment]
-    return out

workspace/code/pattern_chase_demo.py

@@ -1,20 +0,0 @@
-"""Chase pattern demo using led_patterns helpers."""
-
-from machine import Pin
-import neopixel
-import time
-
-from led_patterns import chase_frame
-
-
-np = neopixel.NeoPixel(Pin(4), 24)
-
-for frame in range(120):
-    frame_colors = chase_frame(len(np), frame, color=(0, 220, 255), tail=(0, 40, 55))
-    for i, color in enumerate(frame_colors):
-        np[i] = color
-    np.write()
-    time.sleep(0.05)
-
-np.fill((0, 0, 0))
-np.write()

workspace/code/pattern_rainbow_demo.py

@@ -1,20 +0,0 @@
-"""Rainbow pattern demo using led_patterns helpers."""
-
-from machine import Pin
-import neopixel
-import time
-
-from led_patterns import rainbow_frame
-
-
-np = neopixel.NeoPixel(Pin(4), 256)
-
-for frame in range(120):
-    frame_colors = rainbow_frame(len(np), frame, step=5)
-    for i, color in enumerate(frame_colors):
-        np[i] = color
-    np.write()
-    time.sleep(0.05)
-
-np.fill((0, 0, 0))
-np.write()

workspace/code/pattern_twinkle_demo.py

@@ -1,26 +0,0 @@
-"""Twinkle pattern demo using led_patterns helpers."""
-
-from machine import Pin
-import neopixel
-import time
-
-from led_patterns import twinkle_frame
-
-
-np = neopixel.NeoPixel(Pin(4), 36)
-
-for frame in range(120):
-    frame_colors = twinkle_frame(
-        len(np),
-        frame,
-        base=(0, 0, 6),
-        sparkle=(255, 210, 130),
-        sparkles=5,
-    )
-    for i, color in enumerate(frame_colors):
-        np[i] = color
-    np.write()
-    time.sleep(0.08)
-
-np.fill((0, 0, 0))
-np.write()

workspace/lib/helpers.py

@@ -1,5 +0,0 @@
-"""Shared helpers (read-only on server; copied into Pyodide when you run)."""
-
-
-def greet(name: str) -> str:
-    return f"Hello, {name}!"

workspace/lib/led_patterns.py

@@ -1,68 +0,0 @@
-"""Compatibility pattern helpers for NeoPixel demos.
-
-This file mirrors `workspace/code/led_patterns.py` so imports like
-`from led_patterns import ...` work even in older worker sessions that only
-include `/workspace/lib` in `sys.path`.
-"""
-
-from __future__ import annotations
-
-import random
-
-
-Color = tuple[int, int, int]
-
-
-def _clamp(channel: int) -> int:
-    return max(0, min(255, int(channel)))
-
-
-def wheel(pos: int) -> Color:
-    pos = 255 - (pos & 255)
-    if pos < 85:
-        return (_clamp(255 - pos * 3), 0, _clamp(pos * 3))
-    if pos < 170:
-        pos -= 85
-        return (0, _clamp(pos * 3), _clamp(255 - pos * 3))
-    pos -= 170
-    return (_clamp(pos * 3), _clamp(255 - pos * 3), 0)
-
-
-def rainbow_frame(led_count: int, frame: int, step: int = 4) -> list[Color]:
-    if led_count <= 0:
-        return []
-    return [wheel((i * 256 // led_count + frame * step) & 255) for i in range(led_count)]
-
-
-def chase_frame(
-    led_count: int,
-    frame: int,
-    color: Color = (255, 120, 0),
-    tail: Color = (16, 0, 0),
-) -> list[Color]:
-    if led_count <= 0:
-        return []
-    out: list[Color] = [(0, 0, 0) for _ in range(led_count)]
-    head = frame % led_count
-    trail = (head - 1) % led_count
-    out[trail] = tuple(_clamp(v) for v in tail)  # type: ignore[assignment]
-    out[head] = tuple(_clamp(v) for v in color)  # type: ignore[assignment]
-    return out
-
-
-def twinkle_frame(
-    led_count: int,
-    frame: int,
-    base: Color = (0, 0, 8),
-    sparkle: Color = (255, 255, 180),
-    sparkles: int = 3,
-    seed: int = 1337,
-) -> list[Color]:
-    if led_count <= 0:
-        return []
-    out: list[Color] = [tuple(_clamp(v) for v in base) for _ in range(led_count)]  # type: ignore[list-item]
-    rng = random.Random(seed + frame)
-    for _ in range(min(max(0, sparkles), led_count)):
-        idx = rng.randrange(led_count)
-        out[idx] = tuple(_clamp(v) for v in sparkle)  # type: ignore[assignment]
-    return out

workspace/lib/machine.py

@@ -1,19 +0,0 @@
-"""Minimal MicroPython-style machine module mock for browser simulation."""
-
-
-class Pin:
-    IN = 0
-    OUT = 1
-    PULL_UP = 2
-    PULL_DOWN = 3
-
-    def __init__(self, pin_id: int, mode: int = OUT, value: int = 0):
-        self.id = int(pin_id)
-        self.mode = int(mode)
-        self._value = 1 if value else 0
-
-    def value(self, new_value=None):
-        if new_value is None:
-            return self._value
-        self._value = 1 if int(new_value) else 0
-        return self._value