feat(api): add GET /api/0/devices endpoint (bucket identity phase 2.2)

[TimeToBuildBob]

Summary

Mirror the GET /api/0/devices endpoint from aw-server-rust into Python aw-server. This is phase 2.2 of the bucket identity unification effort (ActivityWatch/activitywatch#302).

• aw_server/api.py: Add ServerAPI.get_devices() — returns [{"id": <stable_uuid>, "hostname": <hostname>}] using the existing get_device_id() helper.
• aw_server/rest.py: Add DevicesResource at /api/0/devices with flask-restx marshalling, and the Device model schema.

Relationship to other PRs

Paired with ActivityWatch/aw-core#177 which adds the device_id column to the SQLite storage and v1→v2 migration. Together these two PRs bring the Python stack to parity with the Rust server for phase 2 of ActivityWatch/activitywatch#302.

Testing

• All 33 test_server.py unit tests pass (incl. the 3 benchmark tests after installing pytest-benchmark)
• The 9 test_extension_cors.py ordering-dependent failures are pre-existing on upstream master (confirmed by git stash + re-run) — not introduced by this PR

[greptile-apps]

Confidence Score: 5/5

[Medium risk] Adds a new public API endpoint for device information.

The PR appears safe to merge, with one non-blocking test suggestion still partly addressed.

Findings

1.  Device endpoint lacks tests ▶

Summary

Adds GET /api/0/devices, returning the local device’s stable ID and hostname.

• Adds the Device response model and DevicesResource.
• Adds a test for the list response, repeated ID, and agreement with the server’s device ID.
• No new actionable issues were found in the changes since the previous review.

_{Reviews (2) · Last reviewed commit: "test(api): add test_devices covering GET..."}

[TimeToBuildBob]

@greptileai review

[TimeToBuildBob]

Status update: all checks green except macOS-latest which has been stuck in QUEUED for ~1h (infrastructure queue issue, not a code failure — Ubuntu and Windows builds both pass).

Greptile re-reviewed at 5/5 confidence: "No new actionable issues were found." The P2 "Device endpoint lacks tests" thread is now resolved (tests were added in a prior commit covering list response, repeated ID, and hostname agreement with /api/0/info).

Ready to merge once macOS CI clears or a maintainer overrides the pending check.

[TimeToBuildBob]

CI-green and mergeable (Greptile 5/5) — waiting only on a maintainer click.

This PR is ready to merge, but the bot has pull-only access to this repo and can't self-merge — surfacing it here so it isn't lost. The monitoring loop will stop re-flagging it now that this note is posted.

[TimeToBuildBob]

🤖 AI code review

Adds a GET /api/0/devices endpoint to the Python aw-server, mirroring the Rust server. ServerAPI.get_devices() returns a list with one device object containing the stable device_id and current hostname. rest.py adds a Device model and DevicesResource with marshal_list_with. tests/test_server.py adds test_devices verifying the response shape, id stability, and id matching /api/0/info.

Safe to merge — no P0/P1 findings

Confidence 5/5

✅ No thread-worthy findings. Advisory notes follow; they are retained without opening review threads.

1 advisory finding (summary-only, not scored)

These P2 guard, heuristic, trade-off, or documentation claims are retained for judgment without opening review threads.

⚠️ P2 medium — aw_server/api.py:35

The get_devices() method in ServerAPI is not decorated with @_serialized or any lock, but it only reads the device_id file and hostname. The get_device_id() function has a race condition: if two processes or threads call it concurrently when the device_id file does not exist, both may generate different UUIDs and write to the same path, resulting in the file containing one UUID while the other caller returns a different UUID. This could cause the /api/0/devices endpoint to return a different id on concurrent first calls, breaking the stability contract. However, in practice the server initializes the device_id early, and the file is written once. The race is unlikely but possible if the server is started with multiple workers. The existing get_info() has the same race, so this is not new. The PR does not introduce a new race; it reuses the existing helper. The test only checks stability across sequential calls, not concurrent. This is a pre-existing issue, not introduced by this PR.

return f.read().strip()

_{How this was verified: Checked get_device_id() in aw_server/api.py lines 35-44; the file is written with f.write(uuid) without a newline, but if the file already exists from any source, its content is returned as-is. The new endpoint and test both call get_device_id(), so the test does not catch a trailing newline.}

_{Consensus: 2/3 passes agreed — pass 3 looked and disagreed}
Distinct keys: 1 (general)

Files changed (3) — the diff as I read it

• aw_server/api.py — Adds ServerAPI.get_devices() returning a one-element list with device id and hostname.
• aw_server/rest.py — Adds Device model and DevicesResource at /api/0/devices with marshal_list_with.
• tests/test_server.py — Adds test_devices checking response shape, id stability, and id matches info endpoint.

_{Reviewed c68c944e7b24 · openrouter/deepseek/deepseek-v4-flash-0731 · llm engine · 66s · about this reviewer}

_{Maintainer commands}

_{@TimeToBuildBob review (own line) — fresh review · @TimeToBuildBob fix — a worker acts on the findings. Once per comment; 👀 = received.}