@glash/cli 0.2.35 → 0.2.37

package/commands/deploy.mjs

@@ -711,9 +711,12 @@ function sourceUploadPartSize(value) {
 }
 
 function sourceUploadConcurrency(flags = {}) {
-  const raw = flags['source-concurrency'] ?? process.env.GLASH_SOURCE_UPLOAD_CONCURRENCY ?? '4';
+  // Default 3: fewer simultaneous part uploads means each connection gets more of
+  // a constrained uplink and finishes before it can be reset mid-stream. Override
+  // with --source-concurrency or GLASH_SOURCE_UPLOAD_CONCURRENCY.
+  const raw = flags['source-concurrency'] ?? process.env.GLASH_SOURCE_UPLOAD_CONCURRENCY ?? '3';
   const parsed = Number(raw);
-  if (!Number.isFinite(parsed) || parsed < 1) return 4;
+  if (!Number.isFinite(parsed) || parsed < 1) return 3;
   return Math.max(1, Math.min(8, Math.floor(parsed)));
 }
 

package/commands/login.mjs

@@ -1,14 +1,107 @@
+import { spawn } from 'node:child_process';
+import { platform } from 'node:process';
+import { hostname } from 'node:os';
 import { apiPost } from '../lib/api.mjs';
 import { writeCreds } from '../lib/config.mjs';
-import { prompt, ok, fail } from '../lib/ui.mjs';
+import { prompt, ok, fail, info, warn, color } from '../lib/ui.mjs';
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+function openBrowser(url) {
+  try {
+    const opener = platform === 'darwin' ? 'open' : platform === 'win32' ? 'cmd' : 'xdg-open';
+    const args = platform === 'win32' ? ['/c', 'start', '', url] : [url];
+    spawn(opener, args, { stdio: 'ignore', detached: true }).unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
 
 export async function login({ flags }) {
+  // Explicit password login (headless/CI). Otherwise use browser-based approval.
+  if (flags.email || flags.password) {
+    return passwordLogin(flags);
+  }
+  return browserLogin(flags);
+}
+
+async function browserLogin(flags) {
+  let start;
+  try {
+    start = await apiPost('/auth/cli/device/start', { deviceName: hostname() });
+  } catch (e) {
+    // Older backend without device auth — fall back to password login.
+    warn('Browser login is unavailable; falling back to email/password.');
+    return passwordLogin(flags);
+  }
+
+  const { deviceCode, userCode, verificationUri, verificationUriComplete, interval = 5, expiresIn = 600 } = start;
+  const approveUrl = verificationUriComplete || verificationUri;
+
+  info('');
+  info(`  To sign in, approve this request in your browser:`);
+  info(`    ${color.cyan(approveUrl)}`);
+  info(`  Verification code: ${color.bold(userCode)}`);
+  info('');
+
+  if (flags['no-browser']) {
+    info('  Open the link above to continue.');
+  } else if (openBrowser(approveUrl)) {
+    info(color.dim('  Opened your browser… waiting for approval.'));
+  } else {
+    info('  Could not open a browser automatically — open the link above.');
+  }
+
+  const deadline = Date.now() + expiresIn * 1000;
+  let delay = Math.max(2, interval) * 1000;
+  try {
+    while (Date.now() < deadline) {
+      await sleep(delay);
+      let r;
+      try {
+        r = await apiPost('/auth/cli/device/poll', { deviceCode });
+      } catch (e) {
+        return fail(e.message);
+      }
+      if (r?.status === 'approved' && r.accessToken) {
+        await writeCreds({ token: r.accessToken, email: r.user?.email });
+        return ok(`Signed in as ${r.user?.email ?? 'your account'}`);
+      }
+      if (r?.status === 'denied') return fail('Sign-in was denied in the browser.');
+      if (r?.status === 'expired') return fail('Sign-in request expired. Run `glash login` again.');
+      // status === 'pending' → keep polling.
+    }
+    return fail('Timed out waiting for approval. Run `glash login` again.');
+  } catch (e) {
+    return fail(e.message);
+  }
+}
+
+async function passwordLogin(flags) {
   const email = flags.email || (await prompt('Email: '));
   const password = flags.password || (await prompt('Password: ', { mask: true }));
   if (!email || !password) return fail('email and password required');
 
   try {
-    const r = await apiPost('/auth/login', { email, password });
+    let r = await apiPost('/auth/login', { email, password });
+
+    // Second factor is always required. Complete the email-OTP challenge.
+    if (!r?.accessToken && r?.secondFactorRequired && !r?.challengeId) {
+      r = await apiPost('/auth/login', { email, password, secondFactorMethod: 'email_otp' });
+    }
+    if (!r?.accessToken && (r?.otpRequired || r?.challengeId)) {
+      const code = flags.otp || (await prompt('Enter the 6-digit code sent to your email: '));
+      if (!code) throw new Error('A verification code is required to sign in.');
+      r = await apiPost('/auth/login', {
+        email,
+        password,
+        emailOtpCode: String(code).trim(),
+        loginOtpChallengeId: r.challengeId,
+        secondFactorMethod: 'email_otp',
+      });
+    }
+
     if (!r?.accessToken || !r?.user?.email) {
       throw new Error('Login response was missing a session token. Please try again.');
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glash/cli",
-  "version": "0.2.35",
+  "version": "0.2.37",
   "description": "glashDB command-line interface — deploy projects, pull source + env, manage env vars.",
   "license": "Apache-2.0",
   "homepage": "https://glashdb.com",