@cloudglue/tinycloud 0.3.9 → 0.3.10

package/README.md

@@ -17,11 +17,11 @@ The npm package is a small launcher: on first run it downloads the matching
 platform distribution from Cloudglue's CDN (cached under
 `~/.tinycloud/versions/<version>/`), verifies its checksum, and execs the real
 binary. The package version pins the binary version, so
-`npx @cloudglue/tinycloud@0.3.9` always runs tinycloud 0.3.9. It also adds two
+`npx @cloudglue/tinycloud@0.3.10` always runs tinycloud 0.3.10. It also adds two
 wrapper commands:
 
 ```bash
-tinycloud install --version 0.3.9   # pre-download a version
+tinycloud install --version 0.3.10   # pre-download a version
 tinycloud install --latest          # install latest stable and pin to it
 tinycloud update                    # move to latest stable, prune old versions
 ```
@@ -38,9 +38,12 @@ supported — use WSL2.
 
 ### Setup
 
-Cloud features need a Cloudglue API key:
+Cloud features need a Cloudglue API key. The quickest way is browser sign-in
+(0.3.10+) — it provisions a key for you, no copy-paste:
 
 ```bash
+tinycloud login                             # browser sign-in → provisions & saves a key (0.3.10+)
+# or paste a key yourself:
 tinycloud setup cloudglue --api-key <key>   # or: export CLOUDGLUE_API_KEY=...
 tinycloud setup --check --json              # verify
 ```
@@ -131,6 +134,7 @@ go to stderr) — pass `--json`.
 | `workflow` | Run packaged pipeline recipes (see below) |
 | `publish` | Publish HTML artifacts as Cloudglue Sites; share videos |
 | `setup` | Configure the Cloudglue API key and service connections |
+| `login` | Browser sign-in — provisions & saves a Cloudglue API key (0.3.10+) |
 
 A few common invocations:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudglue/tinycloud",
-  "version": "0.3.9",
+  "version": "0.3.10",
   "description": "Agent CLI for deep video and image work, by Cloudglue. Downloads the tinycloud binary on first run.",
   "bin": {
     "tinycloud": "bin/tinycloud.js"

package/skills/tinycloud/SKILL.md

@@ -37,8 +37,9 @@ npm install -g @cloudglue/tinycloud
 ```
 
 Credentials (required for cloud verbs): `tinycloud setup cloudglue --api-key <key>`
-(or `export CLOUDGLUE_API_KEY=...`). Verify with
-`tinycloud setup --check --json` → `data.ok == true`.
+(or `export CLOUDGLUE_API_KEY=...`), or, for a human at a terminal,
+`tinycloud login` (0.3.10+) for browser sign-in that provisions and saves a key.
+Verify with `tinycloud setup --check --json` → `data.ok == true`.
 
 ## 1. The envelope contract
 
@@ -51,7 +52,7 @@ credentials), `error` (`{code, message, retryable}`).
 |---|---|
 | `ready` | consume `data` / `ref` / file paths and continue |
 | `pending` | async job started — `tinycloud jobs wait <meta.job_id> --timeout 120s --json` |
-| `needs_credentials` | run the command in `setup.command` or set the env in `setup.env` |
+| `needs_credentials` | run the command in `setup.command` (or `setup.login_command`, `tinycloud login`, for browser sign-in — 0.3.10+) or set the env in `setup.env` |
 | `needs_upload` | cloud upload required (runs through the user's Cloudglue account) — rerun without `--no-upload` or confirm with the user |
 | `needs_download` | fetch locally first: `tinycloud grab <url> --json` |
 | `paused` | stop; surface `resume` info to the user (resume is not automated in 0.3.x) |

package/skills/tinycloud/reference/envelope.md

@@ -16,7 +16,7 @@ Envelope schema version: `"1"` (reported in `--version --json` as
   "meta": { "elapsed_ms": 1234, "requires": "cloud", "cache": { "identity": "hit" } },
   "summary": "one-line human summary",
   "next": [ { "…": "suggested follow-up commands" } ],
-  "setup": { "service": "cloudglue", "env": ["CLOUDGLUE_API_KEY"], "command": "tinycloud setup cloudglue" },
+  "setup": { "service": "cloudglue", "env": ["CLOUDGLUE_API_KEY"], "command": "tinycloud setup cloudglue", "login_command": "tinycloud login" },
   "resume": { "run_id": "…", "paused_step": "…", "resume_command": "…" },
   "error": { "code": "validation", "message": "…", "retryable": false }
 }
@@ -44,7 +44,7 @@ Envelope schema version: `"1"` (reported in `--version --json` as
 | `ready` | 0 | `data` usable | consume and continue |
 | `pending` | 0 | `meta.job_id` set | `tinycloud jobs wait <id> --timeout 120s --json`; do NOT start downstream work |
 | `paused` | 0 | `resume` present | stop; surface resume info (resume not automated in 0.3.x) |
-| `needs_credentials` | 2 | `setup` present | run `setup.command` or set `setup.env` |
+| `needs_credentials` | 2 | `setup` present | run `setup.command` (or `setup.login_command`, `tinycloud login`, browser sign-in — 0.3.10+) or set `setup.env` |
 | `needs_upload` | 3 | — | cloud upload required (runs through the user's Cloudglue account); rerun without `--no-upload` after confirming |
 | `needs_download` | 3 | — | materialize locally first (`tinycloud grab …`) |
 | `error` | 1 | `error` present | stop; report `error.message`; retry only if `error.retryable` |

package/skills/tinycloud/reference/glossary.md

@@ -14,6 +14,12 @@ connector?" or an envelope field needs explaining.
 - **tinycloud** — the agent CLI distributed from this repo
   (https://tinycloud.sh). Local verbs (`clip`, `search`, `setup`) run on your
   machine; cloud verbs call Cloudglue with your API key.
+- **Browser sign-in / device login (0.3.10+)** — `tinycloud login` runs an
+  OAuth-style device-authorization flow: it prints a short code + verification
+  URL, opens the Cloudglue dashboard, and on approval mints a normal `cg-` API
+  key saved to config exactly like a pasted key (the raw key is never printed).
+  The interactive counterpart of `setup cloudglue --api-key`; paste-key and
+  `$CLOUDGLUE_API_KEY` remain fully supported for headless/scripted setup.
 
 ## Media and identity
 

package/skills/tinycloud/reference/setup.md

@@ -31,11 +31,22 @@ Usage is billed to that key per the
 [rate card](https://app.cloudglue.dev/home/billing/rate-card).
 
 ```bash
+tinycloud login                               # browser sign-in → provisions & saves a key (0.3.10+)
+# or paste/point at a key yourself:
 tinycloud setup cloudglue --api-key <key>     # persist the key
 # or
 export CLOUDGLUE_API_KEY=<key>                # env only, nothing persisted
 ```
 
+`tinycloud login` (0.3.10+) runs an OAuth-style device sign-in: it best-effort
+opens the Cloudglue dashboard, you approve a short code, and a normal `cg-` API
+key is minted and saved to config exactly like a pasted key — you never handle
+the key. It blocks on a browser flow (~minutes), so for headless or scripted
+setup prefer `setup cloudglue --api-key` / `$CLOUDGLUE_API_KEY`. When a cloud
+verb hits missing credentials, the `needs_credentials` envelope's `setup` object
+now carries both `setup.command` (`tinycloud setup cloudglue`) and
+`setup.login_command` (`tinycloud login`).
+
 `frameio` is an optional service and requires interactive OAuth
 (`tinycloud setup frameio` inside the tinycloud agent TUI).
 

package/skills/tinycloud/reference/verbs.md

@@ -21,6 +21,7 @@ every verb. Regenerate doubts from it instead of trusting prose.
 | `workflow` | varies | no | Validate/plan/run workflow recipes |
 | `publish` | cloud | yes | Publish HTML/code artifacts as Cloudglue Sites; share videos |
 | `setup` | local | no | Credentials and service connections |
+| `login` | network | no | Browser sign-in → provisions & saves a Cloudglue API key (0.3.10+) |
 
 Cloud verbs run through the configured Cloudglue API key.
 `caption`/`library`/`workflow` vary by what they end up doing.
@@ -427,6 +428,26 @@ tinycloud setup --list --json       # known services
 tinycloud setup cloudglue --api-key <key>   # or --stdin
 ```
 
+### login — browser sign-in (network, 0.3.10+)
+
+```bash
+tinycloud login [--no-browser] [--web-url <url>] [--label <text>] --json
+```
+
+An OAuth-style **device-authorization** sign-in — the interactive counterpart of
+`tinycloud setup cloudglue --api-key`. It prints a short code + a verification
+URL, best-effort opens the Cloudglue dashboard, and polls until you approve;
+approval mints a normal `cg-` API key that is saved to `~/.tinycloud/config.json`
+(0600) exactly like a pasted key. The **raw key is never printed** — the `ready`
+envelope's `data` carries only `{account, api_base_url, key_masked, config_path,
+replaced_existing}` (progress code + URL go to **stderr**). `--no-browser` prints
+the URL only (SSH/containers); `--web-url` (or `$CLOUDGLUE_WEB_URL`) points at a
+non-default dashboard; `--label` names the provisioned key (default: hostname).
+Revoke by deleting the key in the dashboard. Because it blocks on a
+~10-minute human flow, `login` is a manual/onboarding command — don't script it
+into an agent's tool loop; for headless/automated setup keep using
+`tinycloud setup cloudglue --api-key <key>` or `$CLOUDGLUE_API_KEY`.
+
 ## Shared flags
 
 Output: `--json` (force JSONL envelopes), `--pretty` (one JSON array),

package/skills/tinycloud/tinycloud-skill.json

@@ -1,5 +1,5 @@
 {
-  "skill_version": "0.3.9",
+  "skill_version": "0.3.10",
   "tinycloud": {
     "min_version": "0.3.7",
     "supported_range": ">=0.3.7 <0.4.0",

package/skills/tinycloud-init/SKILL.md

@@ -43,18 +43,26 @@ at https://tinycloud.sh. Windows is unsupported — use WSL2.
 tinycloud setup --check --json </dev/null
 ```
 
-If `data.ok` is `true`, go to step 3. Otherwise tell the user: cloud
-features run through a Cloudglue account — keys live at
-[app.cloudglue.dev](https://app.cloudglue.dev) (usage billed per the
-[rate card](https://app.cloudglue.dev/home/billing/rate-card)). Ask them to
-paste their API key, then configure it via stdin so the key never lands in
-shell history or process args:
-
-```bash
-printf '%s' "<key>" | tinycloud setup cloudglue --stdin
-```
-
-Re-run `tinycloud setup --check --json` and confirm `data.ok == true`.
+If `data.ok` is `true`, go to step 3. Otherwise cloud features run through a
+Cloudglue account (usage billed per the
+[rate card](https://app.cloudglue.dev/home/billing/rate-card)) — connect one of
+two ways:
+
+- **Browser sign-in (recommended; tinycloud 0.3.10+).** Ask the user to run
+  `tinycloud login` **themselves in their terminal** — it's an interactive
+  browser flow you can't drive from here. It opens the Cloudglue dashboard, they
+  approve a short code, and a key is provisioned and saved automatically (no
+  copy-pasting keys).
+- **Paste an API key.** If they'd rather paste an existing key (or their
+  tinycloud predates `login`), have them get one at
+  [app.cloudglue.dev](https://app.cloudglue.dev) and configure it via stdin so
+  the key never lands in shell history or process args — this path you can run:
+
+  ```bash
+  printf '%s' "<key>" | tinycloud setup cloudglue --stdin
+  ```
+
+Then re-run `tinycloud setup --check --json` and confirm `data.ok == true`.
 
 ## 3. Prove it works (free)