@runloop/rl-cli 1.8.0 → 1.10.0

package/dist/commands/devbox/scp.js

@@ -1,64 +1,205 @@
 /**
  * SCP files to/from devbox command
+ *
+ * Supports standard SCP-like syntax where the devbox ID (dbx_*) is used as a hostname:
+ *   rli devbox scp dbx_abc123:/remote/path ./local/path          # download
+ *   rli devbox scp ./local/path dbx_abc123:/remote/path          # upload
+ *   rli devbox scp root@dbx_abc123:/remote/path ./local/path     # explicit user
+ *   rli devbox scp dbx_src:/file dbx_dst:/file                   # devbox-to-devbox
+ *
+ * If no user is specified for a remote path, the devbox's configured user is used.
+ * Paths without a dbx_ hostname are treated as local paths.
+ *
+ * Devbox-to-devbox transfers use scp -3 to route data through the local machine,
+ * with a temporary SSH config so each devbox uses its own key.
  */
-import { exec } from "child_process";
+import { execFile } from "child_process";
 import { promisify } from "util";
+import { writeFile, unlink } from "fs/promises";
+import { join } from "path";
+import { tmpdir } from "os";
+import { randomUUID } from "crypto";
 import { getClient } from "../../utils/client.js";
 import { output, outputError } from "../../utils/output.js";
-import { getSSHKey, getProxyCommand, checkSSHTools } from "../../utils/ssh.js";
-const execAsync = promisify(exec);
-export async function scpFiles(devboxId, options) {
+import { getSSHKey, getProxyCommand, checkSSHTools, } from "../../utils/ssh.js";
+const execFileAsync = promisify(execFile);
+/**
+ * Parse an SCP-style path into its components.
+ *
+ * Supported formats:
+ *   user@dbx_id:path  -> remote with explicit user
+ *   dbx_id:path       -> remote with default user
+ *   /local/path       -> local (absolute)
+ *   ./relative        -> local (relative)
+ *   filename          -> local (bare filename, no colon)
+ */
+export function parseSCPPath(input) {
+    // Match [user@]host:path where host is a devbox ID (dbx_*).
+    // This avoids false positives on local paths that happen to contain colons.
+    const match = input.match(/^(?:([^@/:]+)@)?(dbx_[^@/:]+):(.*)$/);
+    if (match) {
+        return {
+            user: match[1] || undefined,
+            host: match[2],
+            path: match[3],
+            isRemote: true,
+        };
+    }
+    return { path: input, isRemote: false };
+}
+/**
+ * Resolve a devbox ID to its SSH info and default user.
+ */
+export async function resolveRemote(devboxId) {
+    const client = getClient();
+    const devbox = await client.devboxes.retrieve(devboxId);
+    const defaultUser = devbox.launch_parameters?.user_parameters?.username || "user";
+    const sshInfo = await getSSHKey(devboxId);
+    if (!sshInfo) {
+        throw new Error(`Failed to create SSH key for ${devboxId}`);
+    }
+    return { devboxId, defaultUser, sshInfo };
+}
+/**
+ * Build the SCP command for a single-remote transfer (local <-> devbox).
+ */
+export function buildSCPCommand(opts) {
+    const scpCommand = [
+        "scp",
+        "-i",
+        opts.sshInfo.keyfilePath,
+        "-o",
+        `ProxyCommand=${opts.proxyCommand}`,
+        "-o",
+        "StrictHostKeyChecking=no",
+    ];
+    if (opts.scpOptions) {
+        scpCommand.push(...opts.scpOptions.split(" "));
+    }
+    // Build src argument
+    if (opts.parsedSrc.isRemote) {
+        const user = opts.parsedSrc.user || opts.defaultUser;
+        scpCommand.push(`${user}@${opts.sshInfo.url}:${opts.parsedSrc.path}`);
+    }
+    else {
+        scpCommand.push(opts.parsedSrc.path);
+    }
+    // Build dst argument
+    if (opts.parsedDst.isRemote) {
+        const user = opts.parsedDst.user || opts.defaultUser;
+        scpCommand.push(`${user}@${opts.sshInfo.url}:${opts.parsedDst.path}`);
+    }
+    else {
+        scpCommand.push(opts.parsedDst.path);
+    }
+    return scpCommand;
+}
+/**
+ * Build the SCP command for a dual-remote transfer (devbox -> devbox).
+ * Uses scp -3 to route data through the local machine and a temporary
+ * SSH config file so each devbox resolves to its own key/proxy.
+ */
+export function buildDualRemoteSCPCommand(opts) {
+    const scpCommand = [
+        "scp",
+        "-3",
+        "-F",
+        opts.sshConfigPath,
+        "-o",
+        "StrictHostKeyChecking=no",
+    ];
+    if (opts.scpOptions) {
+        scpCommand.push(...opts.scpOptions.split(" "));
+    }
+    const srcUser = opts.parsedSrc.user || opts.srcRemote.defaultUser;
+    scpCommand.push(`${srcUser}@${opts.srcRemote.sshInfo.url}:${opts.parsedSrc.path}`);
+    const dstUser = opts.parsedDst.user || opts.dstRemote.defaultUser;
+    scpCommand.push(`${dstUser}@${opts.dstRemote.sshInfo.url}:${opts.parsedDst.path}`);
+    return scpCommand;
+}
+/**
+ * Generate a temporary SSH config file for dual-remote transfers.
+ * Maps each devbox URL to its identity file and proxy command.
+ */
+export function generateSCPConfig(remotes, proxyCommand) {
+    return remotes
+        .map((r) => `Host ${r.sshInfo.url}\n` +
+        `  IdentityFile ${r.sshInfo.keyfilePath}\n` +
+        `  ProxyCommand ${proxyCommand}\n` +
+        `  StrictHostKeyChecking no`)
+        .join("\n\n");
+}
+export async function scpFiles(src, dst, options) {
     try {
         // Check if SSH tools are available
         const sshToolsAvailable = await checkSSHTools();
         if (!sshToolsAvailable) {
             outputError("SSH tools (ssh, scp, openssl) are not available on this system");
         }
-        const client = getClient();
-        // Get devbox details to determine user
-        const devbox = await client.devboxes.retrieve(devboxId);
-        const user = devbox.launch_parameters?.user_parameters?.username || "user";
-        // Get SSH key
-        const sshInfo = await getSSHKey(devboxId);
-        if (!sshInfo) {
-            outputError("Failed to create SSH key");
+        const parsedSrc = parseSCPPath(src);
+        const parsedDst = parseSCPPath(dst);
+        if (!parsedSrc.isRemote && !parsedDst.isRemote) {
+            outputError("At least one of src or dst must be a remote devbox path (e.g. dbx_<id>:/path)");
         }
         const proxyCommand = getProxyCommand();
-        const scpCommand = [
-            "scp",
-            "-i",
-            sshInfo.keyfilePath,
-            "-o",
-            `ProxyCommand=${proxyCommand}`,
-            "-o",
-            "StrictHostKeyChecking=no",
-        ];
-        if (options.scpOptions) {
-            scpCommand.push(...options.scpOptions.split(" "));
-        }
-        // Handle remote paths (starting with :)
-        if (options.src.startsWith(":")) {
-            scpCommand.push(`${user}@${sshInfo.url}:${options.src.slice(1)}`);
-            scpCommand.push(options.dst);
-        }
-        else {
-            scpCommand.push(options.src);
-            if (options.dst.startsWith(":")) {
-                scpCommand.push(`${user}@${sshInfo.url}:${options.dst.slice(1)}`);
+        let scpCommand;
+        if (parsedSrc.isRemote && parsedDst.isRemote) {
+            // Both sides are remote devboxes — resolve both in parallel
+            const [srcRemote, dstRemote] = await Promise.all([
+                resolveRemote(parsedSrc.host),
+                resolveRemote(parsedDst.host),
+            ]);
+            // Write a temporary SSH config so scp can find the right key per host
+            const configContent = generateSCPConfig([srcRemote, dstRemote], proxyCommand);
+            const configPath = join(tmpdir(), `rli-scp-${randomUUID()}.conf`);
+            const configHeader = "# Temporary SSH config generated by `rli devbox scp` for a dual-remote transfer.\n" +
+                "# Safe to delete.\n\n";
+            await writeFile(configPath, configHeader + configContent, {
+                mode: 0o600,
+            });
+            try {
+                scpCommand = buildDualRemoteSCPCommand({
+                    srcRemote,
+                    dstRemote,
+                    proxyCommand,
+                    parsedSrc,
+                    parsedDst,
+                    sshConfigPath: configPath,
+                    scpOptions: options.scpOptions,
+                });
+                const [cmd, ...args] = scpCommand;
+                await execFileAsync(cmd, args);
             }
-            else {
-                scpCommand.push(options.dst);
+            finally {
+                // Clean up the temp SSH config file.
+                // Note: SSH key files in ~/.runloop/ssh_keys/ are intentionally kept —
+                // they're shared across rli commands (ssh, scp, etc.).
+                await unlink(configPath).catch(() => { });
             }
         }
-        await execAsync(scpCommand.join(" "));
+        else {
+            // Single remote — one side is local
+            const devboxId = parsedSrc.isRemote ? parsedSrc.host : parsedDst.host;
+            const remote = await resolveRemote(devboxId);
+            scpCommand = buildSCPCommand({
+                sshInfo: remote.sshInfo,
+                proxyCommand,
+                parsedSrc,
+                parsedDst,
+                defaultUser: remote.defaultUser,
+                scpOptions: options.scpOptions,
+            });
+            const [cmd, ...args] = scpCommand;
+            await execFileAsync(cmd, args);
+        }
         // Default: just output the destination for easy scripting
         if (!options.output || options.output === "text") {
-            console.log(options.dst);
+            console.log(dst);
         }
         else {
             output({
-                source: options.src,
-                destination: options.dst,
+                source: src,
+                destination: dst,
             }, { format: options.output, defaultFormat: "json" });
         }
     }

package/dist/commands/devbox/tunnel.js

@@ -6,6 +6,7 @@ import { getClient } from "../../utils/client.js";
 import { output, outputError } from "../../utils/output.js";
 import { processUtils } from "../../utils/processUtils.js";
 import { getSSHKey, getProxyCommand, checkSSHTools } from "../../utils/ssh.js";
+import { openInBrowser } from "../../utils/browser.js";
 export async function createTunnel(devboxId, options) {
     try {
         // Check if SSH tools are available
@@ -60,25 +61,9 @@ export async function createTunnel(devboxId, options) {
         // Open browser if --open flag is set
         if (options.open) {
             // Small delay to let the tunnel establish
-            setTimeout(async () => {
-                const { exec } = await import("child_process");
-                const platform = process.platform;
-                let openCommand;
-                if (platform === "darwin") {
-                    openCommand = `open "${tunnelUrl}"`;
-                }
-                else if (platform === "win32") {
-                    openCommand = `start "${tunnelUrl}"`;
-                }
-                else {
-                    openCommand = `xdg-open "${tunnelUrl}"`;
-                }
-                exec(openCommand, (error) => {
-                    if (error) {
-                        console.log(`\nCould not open browser: ${error.message}`);
-                    }
-                });
-            }, 1000);
+            setTimeout(() => {
+                openInBrowser(tunnelUrl);
+            }, 1000); // TODO: Not going to need this soon with tunnels v2
         }
         tunnelProcess.on("close", (code) => {
             console.log("\nTunnel closed.");

package/dist/commands/gateway-config/create.js

@@ -0,0 +1,53 @@
+/**
+ * Create gateway config command
+ */
+import { getClient } from "../../utils/client.js";
+import { output, outputError } from "../../utils/output.js";
+import { validateGatewayConfig } from "../../utils/gatewayConfigValidation.js";
+export async function createGatewayConfig(options) {
+    try {
+        const client = getClient();
+        // Validate that exactly one auth type is specified
+        if (options.bearerAuth && options.headerAuth) {
+            outputError("Cannot specify both --bearer-auth and --header-auth. Choose one.");
+            return;
+        }
+        // Default to bearer if neither is specified
+        const authType = options.headerAuth ? "header" : "bearer";
+        // Validate all fields using shared validation
+        const validation = validateGatewayConfig({
+            name: options.name,
+            endpoint: options.endpoint,
+            authType,
+            authKey: options.headerAuth,
+        }, { requireName: true, requireEndpoint: true });
+        if (!validation.valid) {
+            outputError(validation.errors.join("\n"));
+            return;
+        }
+        const { sanitized } = validation;
+        // Build auth mechanism
+        const authMechanism = {
+            type: sanitized.authType,
+        };
+        if (sanitized.authType === "header" && sanitized.authKey) {
+            authMechanism.key = sanitized.authKey;
+        }
+        const config = await client.gatewayConfigs.create({
+            name: sanitized.name,
+            endpoint: sanitized.endpoint,
+            auth_mechanism: authMechanism,
+            description: options.description?.trim() || undefined,
+        });
+        // Default: just output the ID for easy scripting
+        if (!options.output || options.output === "text") {
+            console.log(config.id);
+        }
+        else {
+            output(config, { format: options.output, defaultFormat: "json" });
+        }
+    }
+    catch (error) {
+        outputError("Failed to create gateway config", error);
+    }
+}

package/dist/commands/gateway-config/delete.js

@@ -0,0 +1,21 @@
+/**
+ * Delete gateway config command
+ */
+import { getClient } from "../../utils/client.js";
+import { output, outputError } from "../../utils/output.js";
+export async function deleteGatewayConfig(id, options = {}) {
+    try {
+        const client = getClient();
+        await client.gatewayConfigs.delete(id);
+        // Default: just output the ID for easy scripting
+        if (!options.output || options.output === "text") {
+            console.log(id);
+        }
+        else {
+            output({ id, status: "deleted" }, { format: options.output, defaultFormat: "json" });
+        }
+    }
+    catch (error) {
+        outputError("Failed to delete gateway config", error);
+    }
+}

package/dist/commands/gateway-config/get.js

@@ -0,0 +1,18 @@
+/**
+ * Get gateway config command - supports lookup by ID or name
+ */
+import { getGatewayConfigByIdOrName } from "../../services/gatewayConfigService.js";
+import { output, outputError } from "../../utils/output.js";
+export async function getGatewayConfig(options) {
+    try {
+        const config = await getGatewayConfigByIdOrName(options.id);
+        if (!config) {
+            outputError(`Gateway config not found: ${options.id}`);
+            return;
+        }
+        output(config, { format: options.output, defaultFormat: "json" });
+    }
+    catch (error) {
+        outputError("Failed to get gateway config", error);
+    }
+}