htmlhost-cli 2.10.0 → 2.12.0

package/README.md

@@ -33,7 +33,7 @@ htmlhost deploy page.html
 ## Commands
 
 ### `htmlhost login`
-Authenticate with an API token. Generate one at [htmlhost.co/settings#keys](https://htmlhost.co/settings#keys).
+Sign in by approving in your browser: it opens htmlhost.co, you check the code matches and click Approve. Nothing to paste, so an AI agent can run it for you (without a terminal attached it waits 90 seconds, then the next `htmlhost login` finishes). For CI, save a token from [htmlhost.co/settings#keys](https://htmlhost.co/settings#keys) with `htmlhost login --token <token>`.
 
 ### `htmlhost deploy [file|dir] [options]`
 Deploy an HTML project and get a live URL.
@@ -174,7 +174,7 @@ htmlhost agents --no-claude  # don't touch CLAUDE.md
 The same guide is at https://htmlhost.co/agents.md.
 
 ### `htmlhost list`
-List all your sites with titles, sizes, TTL, and expiry. Multi-page sites are marked with 📄.
+List all your sites with titles, sizes, TTL, and expiry. Multi-page sites are marked with 📄. Sites shared with you as a collaborator follow under **Shared with you**, with their owner: `clone`, `deploy` and `versions` work on them with your own sign-in; only the owner can delete them.
 
 ### `htmlhost open <slug>`
 Open a deployed site in the default browser.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "htmlhost-cli",
-  "version": "2.10.0",
+  "version": "2.12.0",
   "description": "Deploy HTML files from the terminal — htmlhost.co CLI",
   "type": "module",
   "bin": {

package/src/cli.mjs

@@ -5,7 +5,7 @@ import { bold, dim, cyan, err } from "./ui.mjs";
 import { ApiError } from "./api.mjs";
 import { startUpdateCheck, applyUpdate } from "./update.mjs";
 
-const VERSION = "2.10.0";
+const VERSION = "2.12.0";
 
 const HELP = `
   ${bold("htmlhost")} ${dim(`v${VERSION}`)} — deploy HTML from the terminal
@@ -17,12 +17,12 @@ const HELP = `
     ${cyan("htmlhost pull")} [slug] [opts]        Pull remote changes to local
     ${cyan("htmlhost clone")} <slug> [dir]        Clone a site to a local directory
     ${cyan("htmlhost agents")} [dir]             Teach your AI coding tool htmlhost (AGENTS.md)
-    ${cyan("htmlhost recipients")} [slug] [cmd]  Manage form notification recipients
-    ${cyan("htmlhost list")}                     List your sites
+    ${cyan("htmlhost recipients")} [slug] [cmd]  Manage form notification recipients (owner)
+    ${cyan("htmlhost list")}                     List your sites and ones shared with you
     ${cyan("htmlhost versions")} [slug]         List a site's published versions
     ${cyan("htmlhost rollback")} [slug] [ver]    Make an earlier version live again (Pro)
-    ${cyan("htmlhost delete")} <slug>            Delete a site
-    ${cyan("htmlhost login")}                    Authenticate with an API token
+    ${cyan("htmlhost delete")} <slug>            Delete a site (owner)
+    ${cyan("htmlhost login")}                    Sign in (approve in your browser)
     ${cyan("htmlhost whoami")}                   Show current user
     ${cyan("htmlhost logout")}                   Remove saved token
     ${cyan("htmlhost open")} <slug>              Open a site in the browser
@@ -58,6 +58,9 @@ const HELP = `
     ${cyan("recipients resend")} [slug] <ref>   Resend a pending invitation
     --force, -f       Skip confirmation on remove
 
+  ${bold("Login options:")}
+    --token <token>   Save an API token from Settings → API keys (CI)
+
   ${bold("Delete options:")}
     --force, -f       Skip confirmation prompt
 
@@ -123,7 +126,7 @@ export async function run(argv) {
     switch (command) {
       case "login": {
         const { login } = await import("./commands/login.mjs");
-        await login();
+        await login(args);
         break;
       }
       case "logout": {

package/src/commands/deploy.mjs

@@ -1,5 +1,5 @@
 import { readFileSync, statSync, readdirSync, existsSync } from "node:fs";
-import { basename, resolve, dirname, join } from "node:path";
+import { basename, resolve, dirname, join, sep } from "node:path";
 import { createInterface } from "node:readline";
 import { createHash } from "node:crypto";
 import { post } from "../api.mjs";
@@ -666,7 +666,9 @@ export function findAllFiles(baseDir, currentDir) {
     if (entry.isDirectory()) {
       results.push(...findAllFiles(baseDir, fullPath));
     } else if (entry.isFile()) {
-      const relativePath = fullPath.slice(baseDir.length + 1);
+      // Always with "/": on Windows the path has "\", which would publish
+      // assets\logo.png, an address no browser can ask for.
+      const relativePath = fullPath.slice(baseDir.length + 1).split(sep).join("/");
       let size;
       try {
         size = statSync(fullPath).size;

package/src/commands/list.mjs

@@ -2,7 +2,8 @@ import { get } from "../api.mjs";
 import { dim, cyan, bold, formatBytes, yellow } from "../ui.mjs";
 
 /**
- * htmlhost list — show all sites.
+ * htmlhost list — show all sites: your own, then the ones shared with you
+ * (you can clone, deploy and restore those, not delete them).
  */
 export async function list({ json = false } = {}) {
   const data = await get("/api/sites");
@@ -13,8 +14,9 @@ export async function list({ json = false } = {}) {
   }
 
   const sites = data.sites || [];
+  const shared = data.shared || [];
 
-  if (sites.length === 0) {
+  if (sites.length === 0 && shared.length === 0) {
     console.log("");
     console.log(`  ${dim("No sites yet.")} Deploy one with: ${cyan("htmlhost deploy index.html")}`);
     console.log("");
@@ -48,6 +50,17 @@ export async function list({ json = false } = {}) {
     );
   }
 
+  if (shared.length) {
+    const sharedSlugW = Math.max(14, ...shared.map((s) => s.slug.length)) + 2;
+    console.log("");
+    console.log(`  ${bold("Shared with you")} ${dim("(clone, deploy and restore; only the owner can delete)")}`);
+    console.log(`  ${dim(pad("SLUG", sharedSlugW) + pad("TITLE", 30) + "OWNER")}`);
+    for (const s of shared) {
+      const title = truncate(s.title && s.title !== s.slug ? s.title : "", 28);
+      console.log(`  ${pad(cyan(s.slug), sharedSlugW)}${pad(dim(title), 30)}${dim(s.owner || "")}`);
+    }
+  }
+
   console.log("");
   console.log(
     `  ${bold(String(sites.length))} sites · ${formatBytes(data.usage.totalBytes)} used` +

package/src/commands/login.mjs

@@ -1,61 +1,152 @@
-import { writeConfig, getApi } from "../config.mjs";
-import { ok, err, info, dim, cyan, bold } from "../ui.mjs";
+/**
+ * htmlhost login [--token <token>]
+ *
+ * Signs in by browser approval: asks htmlhost.co for a sign-in, opens the
+ * approval page and waits until the owner approves, then saves the new API
+ * token to ~/.htmlhostrc. Nothing to type, so an AI agent can run it: without a
+ * terminal attached it waits 90 seconds, then keeps the sign-in so the next
+ * `htmlhost login` picks it up. `--token` saves a token from Settings → API keys
+ * (CI). A server without browser sign-in falls back to pasting a token.
+ */
+import { hostname } from "node:os";
 import { createInterface } from "node:readline";
 import { exec } from "node:child_process";
+import { readConfig, writeConfig, getApi } from "../config.mjs";
+import { ok, err, info, dim, cyan, bold } from "../ui.mjs";
 
-export async function login() {
-  const settingsUrl = `${getApi()}/settings#keys`;
-
-  console.log("");
-  info(`Log in to ${cyan(bold("htmlhost.co"))}`);
-
-  // Auto-open the browser; fall back to showing the URL if it fails
-  const browserCmd =
-    process.platform === "darwin" ? "open" :
-    process.platform === "win32" ? "start" :
-    "xdg-open";
+/** How long a run without a terminal (an agent) waits before leaving the sign-in pending. */
+const AGENT_WAIT_MS = 90_000;
 
-  exec(`${browserCmd} ${settingsUrl}`, (error) => {
-    if (error) {
-      console.log(`${dim("  Generate a token at")} ${settingsUrl}`);
-    }
-  });
+function openBrowser(url) {
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? 'start ""' : "xdg-open";
+  exec(`${cmd} "${url}"`, () => {});
+}
 
-  console.log(`${dim("  Opening")} ${cyan(settingsUrl)}${dim(" in your browser…")}`);
-  console.log("");
+async function saveToken(token) {
+  info("Verifying…");
+  const res = await fetch(`${getApi()}/api/tokens/me`, { headers: { Authorization: `Bearer ${token}` } });
+  if (!res.ok) {
+    err("Invalid or expired token.");
+    process.exit(1);
+  }
+  const data = await res.json();
+  writeConfig({ token, api: getApi(), pendingLogin: undefined });
+  ok(`Logged in as ${cyan(data.email)} (${data.plan})`);
+  console.log(`${dim("  Token saved to ~/.htmlhostrc")}`);
+}
 
+/** The old way, for servers without browser sign-in: paste a token from Settings → API keys. */
+async function pasteLogin() {
+  const settingsUrl = `${getApi()}/settings#keys`;
+  openBrowser(settingsUrl);
+  console.log(`${dim("  Opening")} ${cyan(settingsUrl)}${dim(" in your browser…")}\n`);
   const token = await new Promise((resolve) => {
     const rl = createInterface({ input: process.stdin, output: process.stdout });
-    rl.question(`  Paste your API token: `, (answer) => {
+    rl.question("  Paste your API token: ", (answer) => {
       rl.close();
       resolve(answer.trim());
     });
   });
-
   if (!token) {
     err("No token provided.");
     process.exit(1);
   }
+  await saveToken(token);
+}
 
-  // Validate the token
-  info("Verifying…");
-
+/** A new sign-in, or null when the server doesn't offer browser sign-in. */
+async function startLogin() {
+  let res;
   try {
-    const res = await fetch(`${getApi()}/api/tokens/me`, {
-      headers: { Authorization: `Bearer ${token}` },
+    res = await fetch(`${getApi()}/api/cli-login`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-HTMLHost-Client": "cli" },
+      body: JSON.stringify({ client: "cli", deviceName: hostname() }),
     });
+  } catch (e) {
+    err(`Connection failed: ${e.message}`);
+    process.exit(1);
+  }
+  if (res.status === 404 || res.status === 405) return null;
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    err(data.error || `Couldn't start sign-in (HTTP ${res.status}).`);
+    process.exit(1);
+  }
+  const pending = {
+    deviceCode: data.deviceCode,
+    userCode: data.userCode,
+    verifyUrl: data.verifyUrl,
+    interval: data.interval || 3,
+    expiresAt: Date.now() + (data.expiresIn || 600) * 1000,
+    api: getApi(),
+  };
+  writeConfig({ pendingLogin: pending });
+  openBrowser(pending.verifyUrl);
+  return pending;
+}
 
-    if (!res.ok) {
-      err("Invalid or expired token.");
+export async function login(args = []) {
+  const at = args.indexOf("--token");
+  if (at >= 0) {
+    if (!args[at + 1]) {
+      err("Give the token after --token.");
       process.exit(1);
     }
+    return saveToken(args[at + 1]);
+  }
 
-    const data = await res.json();
-    writeConfig({ token, api: getApi() });
-    ok(`Logged in as ${cyan(data.email)} (${data.plan})`);
-    console.log(`${dim("  Token saved to ~/.htmlhostrc")}`);
-  } catch (e) {
-    err(`Connection failed: ${e.message}`);
-    process.exit(1);
+  console.log("");
+  info(`Log in to ${cyan(bold("htmlhost.co"))}`);
+
+  const saved = readConfig().pendingLogin;
+  let pending = saved && saved.api === getApi() && saved.expiresAt > Date.now() + 5_000 ? saved : null;
+  if (!pending) {
+    pending = await startLogin();
+    if (!pending) return pasteLogin();
+  }
+
+  console.log(`${dim("  Approve this sign-in in your browser:")} ${cyan(pending.verifyUrl)}`);
+  console.log(`${dim("  Check it shows the code")} ${bold(pending.userCode)}\n`);
+
+  const until = Math.min(pending.expiresAt, process.stdin.isTTY ? Infinity : Date.now() + AGENT_WAIT_MS);
+  let interval = pending.interval * 1000;
+  while (Date.now() < until) {
+    await new Promise((r) => setTimeout(r, interval));
+    let data;
+    try {
+      const res = await fetch(`${getApi()}/api/cli-login/poll`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ deviceCode: pending.deviceCode }),
+      });
+      data = await res.json();
+    } catch {
+      continue; // a dropped connection: try again next round
+    }
+    if (data.status === "approved") {
+      writeConfig({ token: data.token, api: getApi(), pendingLogin: undefined });
+      ok(`Logged in as ${cyan(data.email || "your account")}`);
+      console.log(`${dim("  Token saved to ~/.htmlhostrc")}`);
+      return;
+    }
+    if (data.status === "slow_down") interval += 1000;
+    else if (data.status === "denied" || data.status === "expired") {
+      writeConfig({ pendingLogin: undefined });
+      err(data.status === "denied" ? "Sign-in cancelled in the browser." : "This sign-in expired. Run `htmlhost login` again.");
+      process.exit(1);
+    } else if (data.status === "too_many_tokens") {
+      writeConfig({ pendingLogin: undefined });
+      err(`Your account has 10 API keys. Remove one at ${getApi()}/settings#keys, then run \`htmlhost login\` again.`);
+      process.exit(1);
+    }
+  }
+
+  if (pending.expiresAt <= Date.now()) {
+    writeConfig({ pendingLogin: undefined });
+    err("This sign-in expired. Run `htmlhost login` again.");
+  } else {
+    err(`Not signed in yet. Approve at ${pending.verifyUrl} (code ${pending.userCode}), then run \`htmlhost login\` again to finish.`);
   }
+  process.exit(1);
 }