Phase 2: Volume Wizard, GPU & device passthrough (0.2.0)

Backend:
- gpu_service: detect NVIDIA (nvidia-smi) + AMD/Intel (/dev/dri, sysfs);
  inject helpers (nvidia deploy.reservations, /dev/dri + groups + LIBVA)
- volume_service: list/orphaned/prune volumes; NFS/SMB/named/bind/tmpfs
  YAML generation (generate-yaml)
- device_service: USB/TTY/DRI detection + sandboxed host path browser
- compose_edit_service: server-side merge of volume/gpu/device fragments
- routers: volumes (+host paths), editor (services/add-volume/set-gpu/
  add-device/remove-device/set-privileged), system gpus+devices
- compose: bind-mount /dev:ro for detection

Frontend:
- split-pane StackEditor with helper panel (service picker + tabs)
- VolumeWizard (bind/named/nfs/smb/tmpfs) + HostPathBrowser
- GPUSelector, DevicePanel; api clients for volumes/editor/system

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/services/device_service.py

@@ -0,0 +1,154 @@
+"""Host device detection (USB, serial/TTY, DRI) and host filesystem browser."""
+from __future__ import annotations
+
+import glob
+import os
+from dataclasses import asdict, dataclass
+from typing import Optional
+
+from config import settings
+
+
+@dataclass
+class HostDevice:
+    path: str
+    kind: str  # "usb" | "tty" | "dri" | "other"
+    name: str = ""
+
+    def to_dict(self) -> dict:
+        return asdict(self)
+
+
+def _read(path: str) -> str:
+    try:
+        with open(path, "r", encoding="utf-8", errors="replace") as fh:
+            return fh.read().strip()
+    except OSError:
+        return ""
+
+
+def _usb_devices() -> list[HostDevice]:
+    devices: list[HostDevice] = []
+    # /dev/bus/usb/<bus>/<dev>
+    for path in sorted(glob.glob("/dev/bus/usb/*/*")):
+        name = ""
+        # Best-effort name lookup via sysfs is non-trivial to map; leave generic.
+        devices.append(HostDevice(path=path, kind="usb", name=name or "USB device"))
+    return devices
+
+
+def _usb_names_from_sysfs() -> list[HostDevice]:
+    """Richer USB list from sysfs with product/manufacturer strings."""
+    out: list[HostDevice] = []
+    for dev in sorted(glob.glob("/sys/bus/usb/devices/*")):
+        busnum = _read(os.path.join(dev, "busnum"))
+        devnum = _read(os.path.join(dev, "devnum"))
+        if not busnum or not devnum:
+            continue
+        product = _read(os.path.join(dev, "product"))
+        manufacturer = _read(os.path.join(dev, "manufacturer"))
+        label = " ".join(p for p in (manufacturer, product) if p) or "USB device"
+        path = f"/dev/bus/usb/{int(busnum):03d}/{int(devnum):03d}"
+        out.append(HostDevice(path=path, kind="usb", name=label))
+    return out
+
+
+def _tty_devices() -> list[HostDevice]:
+    devices: list[HostDevice] = []
+    patterns = ["/dev/ttyUSB*", "/dev/ttyACM*", "/dev/ttyAMA*", "/dev/serial/by-id/*"]
+    for pattern in patterns:
+        for path in sorted(glob.glob(pattern)):
+            base = os.path.basename(path)
+            driver = _read(f"/sys/class/tty/{base}/device/driver/module/name") or ""
+            devices.append(
+                HostDevice(path=path, kind="tty", name=driver or "Serial device")
+            )
+    return devices
+
+
+def _dri_devices() -> list[HostDevice]:
+    return [
+        HostDevice(path=p, kind="dri", name="GPU render node")
+        for p in sorted(glob.glob("/dev/dri/*"))
+    ]
+
+
+def detect_devices() -> dict:
+    usb = _usb_names_from_sysfs() or _usb_devices()
+    return {
+        "usb": [d.to_dict() for d in usb],
+        "tty": [d.to_dict() for d in _tty_devices()],
+        "dri": [d.to_dict() for d in _dri_devices()],
+    }
+
+
+# --------------------------------------------------------------------------- #
+# Host filesystem browser (sandboxed)
+# --------------------------------------------------------------------------- #
+
+
+def _real_root(path: str) -> str:
+    """Map a logical host path into the container view (HOST_ROOT_PREFIX)."""
+    prefix = settings.HOST_ROOT_PREFIX.rstrip("/")
+    if prefix:
+        return prefix + path
+    return path
+
+
+def _is_allowed(path: str) -> bool:
+    norm = os.path.normpath(path)
+    for root in settings.ALLOWED_BROWSE_ROOTS:
+        root = os.path.normpath(root)
+        if root == "/" or norm == root or norm.startswith(root + os.sep):
+            return True
+    return False
+
+
+class BrowseError(Exception):
+    pass
+
+
+def browse(path: str = "/", show_hidden: bool = False) -> dict:
+    path = os.path.normpath(path or "/")
+    if not path.startswith("/"):
+        raise BrowseError("Path must be absolute")
+    if not _is_allowed(path):
+        raise BrowseError("Path is outside the allowed browse roots")
+
+    real = _real_root(path)
+    if not os.path.isdir(real):
+        raise BrowseError(f"Not a directory: {path}")
+
+    entries = []
+    try:
+        names = os.listdir(real)
+    except PermissionError as exc:
+        raise BrowseError(f"Permission denied: {path}") from exc
+
+    for name in sorted(names):
+        if not show_hidden and name.startswith("."):
+            continue
+        full_real = os.path.join(real, name)
+        try:
+            st = os.lstat(full_real)
+            is_dir = os.path.isdir(full_real)
+            entries.append(
+                {
+                    "name": name,
+                    "type": "dir" if is_dir else "file",
+                    "size": st.st_size if not is_dir else None,
+                    "permissions": oct(st.st_mode & 0o777),
+                }
+            )
+        except OSError:
+            continue
+
+    # Sort: dirs first, then files, both alphabetical.
+    entries.sort(key=lambda e: (e["type"] != "dir", e["name"].lower()))
+    parent = os.path.dirname(path) if path != "/" else None
+    return {
+        "path": path,
+        "parent": parent,
+        "roots": settings.ALLOWED_BROWSE_ROOTS,
+        "entries": entries,
+    }