@newly/cli 0.1.93 → 0.1.95

package/README.md

@@ -27,30 +27,47 @@ newly email status       # inspect Newly Email setup
 ## Auth
 
 ```bash
-newly login          # opens a browser, stores a session token in ~/.newly/credentials
-newly login --manual # paste the credential instead of using the browser callback
-newly whoami         # show the stored credential: account, API, expiry, file
-newly logout         # delete stored credentials
+newly login           # pick a method in the terminal, store the credential in ~/.newly/credentials
+newly login --email   # emailed six-digit code; never opens a browser
+newly login --google  # or --github: shows a code, you confirm it in the browser
+newly whoami          # show the stored credential: account, API, expiry, file
+newly logout          # revoke the credential and delete it locally
 ```
 
-The token expires. Re-run `newly login` when commands report you're logged out —
-it reports the existing session first and offers to keep it, so running it out of
-habit no longer throws away a working credential.
+Sign-in goes through Better Auth on the Newly control plane (`https://api.newly.app`).
+`--email` finishes entirely in the terminal, so it works over SSH and in
+containers. Google and GitHub use the device flow: the CLI prints a short code,
+you confirm it at `newly.app/cli-auth`, and the credential is minted server-side —
+it never passes through the browser and nothing is posted to localhost.
+
+Re-run `newly login` when commands report you're logged out — it reports the
+existing session first and offers to keep it, so running it out of habit no
+longer throws away a working credential.
+
+`newly logout` revokes the credential server-side as well as deleting it, unless
+you supplied it yourself with `--token` (that one is yours, often shared with CI,
+so it is only removed locally).
 
 `newly whoami` reads the stored credential without calling the API, and exits
 non-zero when there is none or it has expired:
 
 ```
 Account     you@example.com
-API         https://api.newly.app
-Expires     8/30/2026, 5:02:58 PM
+API         https://your-backend.modal.run/api
+Issued by   https://api.newly.app
+Expires     never
 Credential  ~/.newly/credentials
 ```
 
+`API` is where commands go; `Issued by` is where the credential came from, and
+only appears when the two differ — which they do for Newly, because sign-in lives
+on the control plane and the commands do not. `logout` revokes against the
+issuer.
+
 It reports whatever would actually be sent, including a credential supplied
 through `NEWLY_API_TOKEN`, which takes precedence over the saved file. The
 account line is only filled in when the sign-in method revealed an address; the
-browser handoff never sees one.
+device flow does not always see one.
 
 ## Project linking
 
@@ -167,6 +184,7 @@ newly-dev login \
 | `NEWLY_DEV_HOME` | Credentials directory used by `newly-dev` (default: `~/.newly-dev`). |
 | `NEWLY_APP_URL` | Default for `--app-url` at module load. |
 | `NEWLY_DEV_APP_URL` | When set, `newly-dev` surfaces this as `NEWLY_APP_URL`. |
+| `NEWLY_AUTH_API_URL` | Control plane to sign in against (default `https://api.newly.app`). Point it at a dev control plane to log in there. Note this is the issuer, not the API — `--api-url` still names the API. |
 
 ### Typical dev workflow
 

package/dist/commands/login.js

@@ -1,13 +1,17 @@
-import http from 'node:http';
-import crypto from 'node:crypto';
 import { hostname } from 'node:os';
 import { spawn } from 'node:child_process';
 import { ApiClient, ApiError } from '../api.js';
-import { clearCredentials, credentialsDisplayPath, loadCredentials, loginCommandName, normalizeApiUrl, sanitizeAccount, saveCredentials, } from '../config.js';
+import { clearCredentials, credentialsDisplayPath, loadCredentials, loginCommandName, normalizeApiUrl, saveCredentials, } from '../config.js';
 import { acquirePromptIO, ask, PromptAbortedError, select, } from '../prompt.js';
 import { AuthError, createApiKey, fetchProviders, isValidEmail, isValidOtp, normalizeOtp, sendEmailCode, verifyEmailCode, } from '../runCloudAuth.js';
-const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
 export const DEFAULT_RUN_CLOUD_API_URL = 'https://api.run.cloud';
+export const DEFAULT_NEWLY_AUTH_API_URL = 'https://api.newly.app';
+export function authApiUrlFor(isRunCloud, explicitApiUrl) {
+    if (isRunCloud) {
+        return explicitApiUrl ?? process.env.RUN_CLOUD_API_URL ?? DEFAULT_RUN_CLOUD_API_URL;
+    }
+    return process.env.NEWLY_AUTH_API_URL ?? DEFAULT_NEWLY_AUTH_API_URL;
+}
 export function loginChoices(providers) {
     const choices = [];
     if (providers.emailOtp) {
@@ -34,92 +38,6 @@ export function methodFromFlags(flags) {
     }
     return chosen[0] ?? null;
 }
-export async function startCallbackServer(state, appOrigin, timeoutMs) {
-    let resolvePayload;
-    let rejectPayload;
-    const payloadPromise = new Promise((resolve, reject) => {
-        resolvePayload = resolve;
-        rejectPayload = reject;
-    });
-    const timer = setTimeout(() => rejectPayload(new Error(`Login timed out after ${timeoutMs / 1000}s.\n` +
-        "If the browser said the local handoff was blocked, Chrome gates HTTPS→localhost behind a permission: " +
-        'click the icon at the left of the address bar, allow "access to apps on this device", ' +
-        'then run login again (or use --manual).')), timeoutMs);
-    const corsHeaders = {
-        'Access-Control-Allow-Origin': appOrigin,
-        'Access-Control-Allow-Methods': 'POST, OPTIONS',
-        'Access-Control-Allow-Headers': 'content-type',
-        'Access-Control-Allow-Private-Network': 'true',
-    };
-    const server = http.createServer((req, res) => {
-        if (req.method === 'OPTIONS') {
-            res.writeHead(204, corsHeaders);
-            res.end();
-            return;
-        }
-        if (req.method !== 'POST') {
-            res.writeHead(405, corsHeaders);
-            res.end();
-            return;
-        }
-        let body = '';
-        req.on('data', (chunk) => (body += chunk));
-        req.on('end', () => {
-            try {
-                const parsed = JSON.parse(body);
-                if (parsed.state !== state) {
-                    res.writeHead(403, corsHeaders);
-                    res.end('state mismatch');
-                    return;
-                }
-                if (typeof parsed.token !== 'string' ||
-                    parsed.token.length === 0 ||
-                    typeof parsed.expiresIn !== 'number' ||
-                    !Number.isFinite(parsed.expiresIn) ||
-                    parsed.expiresIn <= 0 ||
-                    typeof parsed.apiUrl !== 'string') {
-                    res.writeHead(400, corsHeaders);
-                    res.end('invalid credential payload');
-                    return;
-                }
-                const apiUrl = new URL(parsed.apiUrl);
-                if (!['http:', 'https:'].includes(apiUrl.protocol)) {
-                    res.writeHead(400, corsHeaders);
-                    res.end('invalid API URL');
-                    return;
-                }
-                res.writeHead(200, { ...corsHeaders, 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ ok: true }));
-                clearTimeout(timer);
-                const account = sanitizeAccount(parsed.account);
-                resolvePayload({
-                    token: parsed.token,
-                    expiresIn: parsed.expiresIn,
-                    apiUrl: parsed.apiUrl,
-                    ...(account ? { account } : {}),
-                });
-            }
-            catch {
-                res.writeHead(400, corsHeaders);
-                res.end('bad request');
-            }
-        });
-    });
-    const port = await new Promise((resolve) => {
-        server.listen(0, '127.0.0.1', () => {
-            const addr = server.address();
-            resolve(typeof addr === 'object' && addr ? addr.port : 0);
-        });
-    });
-    return {
-        port,
-        waitForToken: () => payloadPromise,
-        close: () => {
-            clearTimeout(timer);
-            server.close();
-        },
-    };
-}
 export function openBrowser(url) {
     const [cmd, args] = process.platform === 'darwin'
         ? ['open', [url]]
@@ -131,13 +49,9 @@ export function openBrowser(url) {
     });
     child.unref();
 }
-export function cliAuthUrl(appUrl, port, state, provider) {
-    const url = new URL('/cli-auth', appUrl);
-    url.searchParams.set('port', String(port));
-    url.searchParams.set('state', state);
-    if (provider)
-        url.searchParams.set('provider', provider);
-    return url.toString();
+export function commandApiUrls(apiUrl, authApiUrl) {
+    const same = normalizeApiUrl(apiUrl) === normalizeApiUrl(authApiUrl);
+    return { apiUrl, ...(same ? {} : { authApiUrl }) };
 }
 export async function emailLogin(apiUrl, presetEmail, io) {
     const email = presetEmail?.trim()
@@ -179,27 +93,6 @@ function hostLabel() {
         return 'cli';
     }
 }
-export function parseManualCredential(blob) {
-    let parsed;
-    try {
-        parsed = JSON.parse(blob);
-    }
-    catch {
-        throw new Error('Could not parse the pasted credential as JSON. Copy the entire blob shown in the browser and try again.');
-    }
-    const c = parsed;
-    if (typeof c.token !== 'string' || typeof c.expiresIn !== 'number' || typeof c.apiUrl !== 'string') {
-        throw new Error('Pasted credential is missing required fields (expected JSON with token, expiresIn, apiUrl). ' +
-            'Copy the entire blob shown in the browser.');
-    }
-    const account = sanitizeAccount(c.account);
-    return {
-        token: c.token,
-        expiresIn: c.expiresIn,
-        apiUrl: c.apiUrl,
-        ...(account ? { account } : {}),
-    };
-}
 export async function verifyRunCloudCredential(apiUrl, token) {
     try {
         await new ApiClient(normalizeApiUrl(apiUrl), token).get('/run-cloud/account');
@@ -241,6 +134,7 @@ export function whoamiReport(creds) {
     const rows = [
         ['Account', creds.account ?? 'not recorded (browser sign-in never sees an address)'],
         ['API', creds.apiUrl],
+        ...(creds.authApiUrl ? [['Issued by', creds.authApiUrl]] : []),
         ['Expires', expiresAtLabel(creds) ?? 'never'],
         ['Credential', credentialsDisplayPath()],
     ];
@@ -274,9 +168,9 @@ export function registerLogin(program) {
         .command('login')
         .description(isRunCloud
         ? 'Log in with your run.cloud account: email, Google, or GitHub'
-        : 'Log in with your Newly account via the browser')
+        : 'Log in with your Newly account: email, Google, or GitHub')
         .option('--app-url <url>', 'product web app URL', defaultAppUrl)
-        .option('--manual', 'newly skin only: paste the credential from the browser instead of using the local callback', false)
+        .option('--manual', 'deprecated no-op: the browser→localhost paste fallback is gone (device flow works headless)', false)
         .option('--api-url <url>', 'explicit API URL (skips browser; use with --token)')
         .option('--token <token>', 'explicit credential token (skips browser; use with --api-url)')
         .option('--expires-in <seconds>', 'session lifetime when using --token (default 7 days)', (v) => Number(v), 604800)
@@ -319,30 +213,18 @@ export function registerLogin(program) {
                 console.log(`  Keeping the credential at ${credentialsDisplayPath()}\n`);
                 return;
             }
-            if (opts.manual && !isRunCloud) {
-                const { createInterface } = await import('node:readline/promises');
-                const rl = createInterface({ input: process.stdin, output: process.stdout });
-                const blob = await rl.question('Paste the credential from the browser: ');
-                rl.close();
-                const parsed = parseManualCredential(blob);
-                saveCredentials({
-                    token: parsed.token,
-                    apiUrl: parsed.apiUrl,
-                    appUrl: opts.appUrl,
-                    expiresAt: Math.floor(Date.now() / 1000) + parsed.expiresIn,
-                    ...(parsed.account ? { account: parsed.account } : {}),
-                });
-                console.log('Logged in.');
-                return;
+            if (opts.manual) {
+                console.log('Note: --manual is a no-op now — sign-in never posts to localhost, so it works over SSH and headless already.');
             }
+            const authApiUrl = authApiUrlFor(isRunCloud, opts.apiUrl);
             let socialProvider;
-            if (isRunCloud && !opts.browser) {
-                const authApiUrl = opts.apiUrl ?? process.env.RUN_CLOUD_API_URL ?? DEFAULT_RUN_CLOUD_API_URL;
+            if (!opts.browser) {
                 let method = methodFromFlags(opts);
                 const terminal = method === 'email' || !method ? acquirePromptIO() : null;
                 try {
+                    let providers = null;
                     if (!method && terminal) {
-                        const providers = await fetchProviders(authApiUrl);
+                        providers = await fetchProviders(authApiUrl);
                         const choices = loginChoices(providers);
                         if (choices.length === 0) {
                             throw new Error(`${authApiUrl} has no sign-in methods enabled.`);
@@ -351,20 +233,27 @@ export function registerLogin(program) {
                     }
                     if (method === 'email') {
                         const preset = typeof opts.email === 'string' ? opts.email : undefined;
+                        providers ??= await fetchProviders(authApiUrl);
                         const { email, token } = await emailLogin(authApiUrl, preset, terminal?.io);
                         saveCredentials({
                             token,
-                            apiUrl: authApiUrl,
                             appUrl: opts.appUrl,
                             expiresAt: Number.MAX_SAFE_INTEGER,
                             revocable: true,
                             account: email,
+                            ...commandApiUrls(providers.cliApiUrl ?? authApiUrl, authApiUrl),
                         });
                         console.log(`\n  Signed in as ${email}`);
                         console.log(`  Credential saved to ${credentialsDisplayPath()}\n`);
                         console.log('  Try:');
-                        console.log('    runcloud ios create --open');
-                        console.log('    runcloud sandbox run "echo hello"');
+                        if (isRunCloud) {
+                            console.log('    runcloud ios create --open');
+                            console.log('    runcloud sandbox run "echo hello"');
+                        }
+                        else {
+                            console.log('    newly whoami');
+                            console.log('    newly status');
+                        }
                         return;
                     }
                 }
@@ -374,54 +263,24 @@ export function registerLogin(program) {
                 if (method === 'google' || method === 'github')
                     socialProvider = method;
             }
-            if (isRunCloud) {
-                if (opts.manual) {
-                    console.log('Note: --manual is no longer needed for run.cloud — `runcloud login` works over SSH and headless via device flow.');
-                }
-                const apiUrl = opts.apiUrl ?? process.env.RUN_CLOUD_API_URL ?? DEFAULT_RUN_CLOUD_API_URL;
-                const { runDeviceLogin } = await import('../deviceLogin.js');
-                const payload = await runDeviceLogin({
-                    apiUrl,
-                    appUrl: opts.appUrl,
-                    provider: socialProvider,
-                    openBrowser,
-                });
-                await verifyRunCloudCredential(payload.apiUrl, payload.token);
-                saveCredentials({
-                    token: payload.token,
-                    apiUrl: payload.apiUrl,
-                    appUrl: opts.appUrl,
-                    expiresAt: Math.floor(Date.now() / 1000) + payload.expiresIn,
-                    revocable: true,
-                    ...(payload.account ? { account: payload.account } : {}),
-                });
-                console.log(`Logged in. Credentials saved to ${credentialsDisplayPath()}`);
-                return;
-            }
-            const state = crypto.randomBytes(16).toString('hex');
-            const appOrigin = new URL(opts.appUrl).origin;
-            const { port, waitForToken, close } = await startCallbackServer(state, appOrigin, LOGIN_TIMEOUT_MS);
-            const loginUrl = cliAuthUrl(opts.appUrl, port, state, socialProvider);
-            console.log(`Opening your browser to authorize the CLI…\n  ${loginUrl}\n`);
-            console.log("If the browser doesn't open, paste the URL above into it manually.");
-            openBrowser(loginUrl);
-            try {
-                const payload = await waitForToken();
-                if (isRunCloud)
-                    await verifyRunCloudCredential(payload.apiUrl, payload.token);
-                saveCredentials({
-                    token: payload.token,
-                    apiUrl: payload.apiUrl,
-                    appUrl: opts.appUrl,
-                    expiresAt: Math.floor(Date.now() / 1000) + payload.expiresIn,
-                    ...(payload.account ? { account: payload.account } : {}),
-                });
-                console.log(`Logged in${payload.account ? ` as ${payload.account}` : ''}. ` +
-                    `Credentials saved to ${credentialsDisplayPath()}`);
-            }
-            finally {
-                close();
-            }
+            const { runDeviceLogin } = await import('../deviceLogin.js');
+            const payload = await runDeviceLogin({
+                apiUrl: authApiUrl,
+                appUrl: opts.appUrl,
+                provider: socialProvider,
+                openBrowser,
+            });
+            await verifyRunCloudCredential(authApiUrl, payload.token);
+            saveCredentials({
+                token: payload.token,
+                appUrl: opts.appUrl,
+                expiresAt: Math.floor(Date.now() / 1000) + payload.expiresIn,
+                revocable: true,
+                ...(payload.account ? { account: payload.account } : {}),
+                ...commandApiUrls(payload.apiUrl, authApiUrl),
+            });
+            console.log(`Logged in${payload.account ? ` as ${payload.account}` : ''}. ` +
+                `Credentials saved to ${credentialsDisplayPath()}`);
         }
         catch (e) {
             if (e instanceof PromptAbortedError) {
@@ -449,13 +308,11 @@ export function registerLogin(program) {
     });
     program
         .command('logout')
-        .description(isRunCloud
-        ? 'Revoke this machine’s credential and delete it locally'
-        : 'Delete the stored CLI credential')
+        .description('Revoke this machine’s credential and delete it locally')
         .action(async () => {
         const creds = loadCredentials();
-        if (isRunCloud && creds?.revocable) {
-            console.log(await revokeRunCloudCredential(creds.apiUrl, creds.token));
+        if (creds?.revocable) {
+            console.log(await revokeRunCloudCredential(creds.authApiUrl ?? creds.apiUrl, creds.token));
         }
         clearCredentials();
         console.log('Logged out.');

package/dist/commands/sandbox.js

@@ -358,8 +358,17 @@ export function registerSandbox(program) {
         else
             console.log(renderSandbox(exposedRecord, 'created'));
     }));
-    withOutput(sandbox.command('list').description('List sandboxes').option('--state <state>', 'filter by state')).action((opts) => run(async () => {
-        const qs = opts.state ? `?state=${encodeURIComponent(opts.state)}` : '';
+    withOutput(sandbox
+        .command('list')
+        .description('List sandboxes')
+        .option('--state <state>', 'filter by state')
+        .option('--name <name>', 'filter by name (exact)')).action((opts) => run(async () => {
+        const query = new URLSearchParams();
+        if (opts.state)
+            query.set('state', opts.state);
+        if (opts.name)
+            query.set('name', opts.name);
+        const qs = query.size ? `?${query}` : '';
         const api = runCloudApi();
         const [data, boxes] = await Promise.all([
             api.get(`/run-cloud/sandboxes${qs}`),
@@ -525,6 +534,17 @@ export function registerSandbox(program) {
                 console.log(`${style.green('✓')} ${lifecycle.pastTense} ${id}`);
         }));
     }
+    withOutput(sandbox
+        .command('rename')
+        .description('Change a sandbox name (the label `list --name` filters on)')
+        .argument('<id>', 'sandbox id')
+        .argument('<name>', 'new name; pass "" to clear it')).action((id, name, opts) => run(async () => {
+        const record = await runCloudApi().post(`/run-cloud/sandboxes/${encodeURIComponent(id)}/name`, { name });
+        if (opts.json)
+            printJson(record);
+        else
+            console.log(`${style.green('✓')} Renamed ${id} to ${name || '(no name)'}`);
+    }));
     withOutput(sandbox
         .command('logs')
         .description('Show saved console logs (available after a sandbox is deleted)')

package/dist/deviceLogin.js

@@ -1,10 +1,11 @@
-import { normalizeApiUrl, sanitizeAccount } from "./config.js";
+import { loginCommandName, normalizeApiUrl, sanitizeAccount } from "./config.js";
 export async function runDeviceLogin(deps) {
     const fetchFn = deps.fetchFn ?? fetch;
     const log = deps.log ?? ((m) => console.log(m));
     const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     const now = deps.now ?? (() => Date.now());
     const base = normalizeApiUrl(deps.apiUrl);
+    const retry = loginCommandName();
     const startRes = await fetchFn(`${base}/run-cloud/cli-auth/device`, {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -23,7 +24,7 @@ export async function runDeviceLogin(deps) {
     const deadline = now() + start.expires_in * 1000;
     for (;;) {
         if (now() >= deadline)
-            throw new Error("Login timed out. Run `runcloud login` again.");
+            throw new Error(`Login timed out. Run \`${retry}\` again.`);
         await sleep(intervalMs);
         const res = await fetchFn(`${base}/run-cloud/cli-auth/token`, {
             method: "POST",
@@ -48,7 +49,7 @@ export async function runDeviceLogin(deps) {
             continue;
         }
         if (error === "access_denied")
-            throw new Error("Authorization was denied. Run `runcloud login` again.");
-        throw new Error("The login code expired. Run `runcloud login` again.");
+            throw new Error(`Authorization was denied. Run \`${retry}\` again.`);
+        throw new Error(`The login code expired. Run \`${retry}\` again.`);
     }
 }

package/dist/runCloudAuth.js

@@ -41,11 +41,13 @@ export async function fetchProviders(apiUrl) {
     if (!response.ok)
         throw new AuthError(await readError(response), response.status);
     const payload = (await response.json());
+    const cliApiUrl = typeof payload.cliApiUrl === 'string' ? payload.cliApiUrl.trim() : '';
     return {
         emailOtp: payload.emailOtp === true,
         google: payload.google === true,
         github: payload.github === true,
         apple: payload.apple === true,
+        ...(cliApiUrl ? { cliApiUrl } : {}),
     };
 }
 export async function sendEmailCode(apiUrl, email) {

package/dist/version.js

@@ -1 +1 @@
-export const CLI_VERSION = '0.1.93';
+export const CLI_VERSION = '0.1.95';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newly/cli",
-  "version": "0.1.93",
+  "version": "0.1.95",
   "description": "Develop, provision, and deploy Newly backends from your terminal",
   "license": "UNLICENSED",
   "type": "module",