nukebase 2.1.1 → 2.1.2

package/README.md

@@ -18,9 +18,9 @@ signed in at once; each project folder knows which account owns it, so you can
 deploy to different accounts from different terminals at the same time.
 
 ```
-nukebase login                     approve in your browser
+nukebase login                     approve in your browser, or enter the code it shows on any device
 nukebase login --email you@x.com   add another account
-nukebase login --device            from SSH or a machine without a browser
+nukebase login --device            only the code (SSH, a VM, no browser)
 nukebase accounts                  list signed-in accounts
 nukebase use you@x.com             default for commands outside a project
 nukebase logout you@x.com          sign out one account

package/bin/nukebase.js

@@ -37,9 +37,11 @@ New here? Run: npx nukebase start
   signs you in, creates a project and downloads it, ready to build
 
 Accounts
-  login                      sign in by approving in your browser
+  login                      sign in: approve in your browser, or enter the
+                             code it shows on any device (VM / SSH)
   login --email you@x.com    sign in as a specific account (adds it; others stay)
-  login --device             sign in from SSH or a machine without a browser
+  login --device             only the code (no browser is opened)
+  login --browser            only the browser (no code)
   login --email-link         sign in with an emailed link instead
   login --password           username + password (the master account)
   logout <email>             sign out one account

package/lib/account-commands.js

@@ -62,9 +62,14 @@ async function loginCommand(args) {
     if (!email) email = (await askLine('Email: ')).trim().toLowerCase();
     if (!email.includes('@')) fail('An email address is required.');
     out = await login.emailLink(api, email);
-  } else {
+  } else if (args.has('browser')) {
     method = 'browser';
     out = await login.browser(api, { email });
+  } else {
+    // Browser and device code together, whichever is approved first, so a
+    // VM or SSH session can sign in too.
+    method = 'browser';
+    out = await login.browserOrDevice(api, { email });
   }
 
   // Signing in again replaces this machine's token for that account; sign the
@@ -456,6 +461,7 @@ async function startCommand(args) {
   const { parse } = require('./args');
   const passFlags = [];
   for (const f of ['api', 'region']) if (args.get(f)) passFlags.push(`--${f}`, args.get(f));
+  for (const f of ['device', 'browser']) if (args.has(f)) passFlags.push(`--${f}`);
 
   const emailArg = args.positional.find(a => a.includes('@')) || args.get('as');
   console.log('\n  Welcome to NukeBase.');
@@ -471,7 +477,9 @@ async function startCommand(args) {
       : (creds.getDefault() || list[0]);
   }
   if (!acct) {
-    console.log('\n  Confirm your Claude session: click Confirm in the browser window that opens.');
+    console.log(args.has('device')
+      ? '\n  Sign in: open the link below on any device and enter the code.'
+      : '\n  Confirm your Claude session: click Confirm in the browser window that opens,\n  or, with no browser on this machine, enter the code shown below on any device.');
     await loginCommand(parse(['login', ...(emailArg ? ['--email', emailArg] : []), ...passFlags]));
     acct = emailArg ? creds.find(emailArg) : (creds.getDefault() || creds.list()[0]);
     if (!acct) fail('Sign-in did not finish. Run: npx nukebase start');

package/lib/login.js

@@ -4,6 +4,9 @@
 //   browser     open /cli-auth.html, approve, a one-time code comes back to a
 //               local server, swapped (with a PKCE secret) for the token
 //   device      a short code to type on the website, for SSH / no browser
+//   browserOrDevice  both at once, whichever is approved first: the default,
+//               so a VM or SSH session (where a browser elsewhere cannot reach
+//               this machine's 127.0.0.1) can still sign in
 //   emailLink   the email sign-in link, delivered back to a local server
 //   password    username + password (the master account)
 //
@@ -76,8 +79,11 @@ function startLoopback(state) {
       finish.res({ query: q, reply });
     });
     const timer = setTimeout(() => { server.close(); finish.rej(new Error('No response within 5 minutes. Run nukebase login again.')); }, LOGIN_TIMEOUT_MS);
+    // Stop waiting (the device code won instead). Settling an already
+    // settled promise is a no-op, so this is safe after a callback too.
+    const close = () => { clearTimeout(timer); server.close(); finish.rej(new Error('Cancelled')); };
     server.on('error', rejectStart);
-    server.listen(0, '127.0.0.1', () => resolveStart({ port: server.address().port, result }));
+    server.listen(0, '127.0.0.1', () => resolveStart({ port: server.address().port, result, close }));
   });
 }
 
@@ -102,11 +108,13 @@ function needsNewerServer(r, api) {
   }
 }
 
-async function browser(api, { email } = {}) {
+// Start a browser sign-in: the loopback server and the approval URL. finish()
+// waits for the approval and swaps its code for the token; close() gives up.
+async function browserStart(api, { email } = {}) {
   const state = b64url(crypto.randomBytes(24));
   const verifier = b64url(crypto.randomBytes(32));
   const challenge = b64url(crypto.createHash('sha256').update(verifier).digest());
-  const { port, result } = await startLoopback(state);
+  const { port, result, close } = await startLoopback(state);
 
   const url = new URL(`${api}/cli-auth.html`);
   url.searchParams.set('port', String(port));
@@ -115,56 +123,110 @@ async function browser(api, { email } = {}) {
   url.searchParams.set('device', deviceName());
   if (email) url.searchParams.set('email', email);
 
+  async function finish() {
+    // The usual reason for a long wait: no account yet, so no sign-in email
+    // ever arrives (the server doesn't say which addresses have accounts).
+    const hint = setTimeout(() => {
+      console.log(`\n  Still waiting. No account yet? Sign up at ${api}/start.html first, then run this again.`);
+    }, 90 * 1000);
+    hint.unref();
+    const { query: q, reply } = await result.finally(() => clearTimeout(hint));
+    if (q.error) throw new Error('Sign-in was cancelled in the browser.');
+    try {
+      if (!q.code) throw new Error('The browser did not return a sign-in code.');
+      const r = await postJson(`${api}/cli/token`, { code: q.code, verifier });
+      needsNewerServer(r, api);
+      if (!r.ok) throw new Error(r.data.error || `Sign-in failed (${r.status})`);
+      // Signed in: finish the browser on the dashboard, which says so.
+      reply({ redirect: `${api}/?cli=signed-in` });
+      return r.data;
+    } catch (e) {
+      reply({ error: e.message });
+      throw e;
+    }
+  }
+  return { url: url.toString(), finish, close };
+}
+
+async function browser(api, { email } = {}) {
+  const b = await browserStart(api, { email });
   console.log('\n  Opening your browser to approve this CLI. If it doesn\'t open, visit:');
-  console.log(`  ${url}\n`);
+  console.log(`  ${b.url}\n`);
   console.log('  Waiting for approval…  (Ctrl+C to cancel)');
-  openBrowser(url.toString());
-
-  // The usual reason for a long wait: no account yet, so no sign-in email
-  // ever arrives (the server doesn't say which addresses have accounts).
-  const hint = setTimeout(() => {
-    console.log(`\n  Still waiting. No account yet? Sign up at ${api}/start.html first, then run this again.`);
-  }, 90 * 1000);
-  hint.unref();
-  const { query: q, reply } = await result.finally(() => clearTimeout(hint));
-  if (q.error) throw new Error('Sign-in was cancelled in the browser.');
-  try {
-    if (!q.code) throw new Error('The browser did not return a sign-in code.');
-    const r = await postJson(`${api}/cli/token`, { code: q.code, verifier });
-    needsNewerServer(r, api);
-    if (!r.ok) throw new Error(r.data.error || `Sign-in failed (${r.status})`);
-    // Signed in: finish the browser on the dashboard, which says so.
-    reply({ redirect: `${api}/?cli=signed-in` });
-    return r.data;
-  } catch (e) {
-    reply({ error: e.message });
-    throw e;
-  }
+  openBrowser(b.url);
+  return b.finish();
 }
 
-async function device(api) {
+async function deviceStart(api) {
   const start = await postJson(`${api}/cli/device-start`, { device: deviceName() });
   needsNewerServer(start, api);
   if (!start.ok) throw new Error(start.data.error || `Could not start sign-in (${start.status})`);
-  const { deviceCode, userCode, verifyUrl, interval = 5, expiresIn = 600 } = start.data;
-
-  console.log('\n  On any device, open:');
-  console.log(`    ${verifyUrl}`);
-  console.log('  and enter this code:\n');
-  console.log(`    ${userCode}\n`);
-  console.log(`  Waiting for approval…  (expires in ${Math.round(expiresIn / 60)} minutes)`);
+  return start.data;
+}
 
+// Poll until the code is approved. `stop.cancelled` ends it quietly (the
+// browser won instead), resolving null.
+async function devicePoll(api, { deviceCode, interval = 5, expiresIn = 600 }, stop = {}) {
   let wait = Math.max(interval, 2) * 1000;
   const deadline = Date.now() + expiresIn * 1000;
   while (Date.now() < deadline) {
-    await new Promise(r => setTimeout(r, wait));
+    await new Promise(r => setTimeout(r, wait).unref());
+    if (stop.cancelled) return null;
     const r = await postJson(`${api}/cli/device-poll`, { deviceCode });
-    if (r.status === 410) throw new Error('The code expired. Run nukebase login --device again.');
+    if (stop.cancelled) return null;
+    if (r.status === 410) throw new Error('The code expired. Run nukebase login again.');
     if (!r.ok) throw new Error(r.data.error || `Sign-in failed (${r.status})`);
     if (r.data.status === 'slow_down') { wait += 1000; continue; }
     if (r.data.status === 'approved') return { uid: r.data.uid, token: r.data.token, label: r.data.label };
   }
-  throw new Error('The code expired. Run nukebase login --device again.');
+  throw new Error('The code expired. Run nukebase login again.');
+}
+
+async function device(api) {
+  const d = await deviceStart(api);
+  console.log('\n  On any device, open:');
+  console.log(`    ${d.verifyUrl}`);
+  console.log('  and enter this code:\n');
+  console.log(`    ${d.userCode}\n`);
+  console.log(`  Waiting for approval…  (expires in ${Math.round((d.expiresIn || 600) / 60)} minutes)`);
+  return devicePoll(api, d);
+}
+
+// The default sign-in: open the browser AND show a device code, and take
+// whichever is approved first. On a laptop the browser wins as before; on a
+// VM or over SSH there is no browser here, and a browser elsewhere cannot
+// reach this machine's 127.0.0.1, so the code is the way in. A server too old
+// for device codes gets the browser alone, exactly as before.
+async function browserOrDevice(api, { email } = {}) {
+  let d = null;
+  try { d = await deviceStart(api); } catch {}
+  if (!d || !d.deviceCode) return browser(api, { email });
+
+  const b = await browserStart(api, { email });
+  console.log('\n  Opening your browser to approve this CLI. If it doesn\'t open, visit:');
+  console.log(`  ${b.url}\n`);
+  console.log('  No browser on this machine (a VM, SSH, a container)? On any phone or computer, open');
+  console.log(`    ${d.verifyUrl}`);
+  console.log(`  and enter the code  ${d.userCode}\n`);
+  console.log('  Waiting for approval…  (Ctrl+C to cancel)');
+  openBrowser(b.url);
+
+  const stop = { cancelled: false };
+  const viaBrowser = b.finish();
+  const viaDevice = devicePoll(api, d, stop).then((out) => out || new Promise(() => {}));
+  // A failed leg (the browser's 5-minute wait running out, say) must not end
+  // the sign-in while the other can still be approved: Promise.any settles on
+  // the first success and fails only when both have failed.
+  try {
+    return await Promise.any([viaBrowser, viaDevice]);
+  } catch (e) {
+    const first = (e && e.errors && e.errors.find(x => x && x.message !== 'Cancelled')) || e;
+    throw first;
+  } finally {
+    stop.cancelled = true;
+    viaBrowser.catch(() => {});
+    b.close();
+  }
 }
 
 // Swap an ordinary session for a CLI token, then sign the session out.
@@ -208,4 +270,4 @@ async function password(api, username, pass) {
   return { ...out, label: out.label || username };
 }
 
-module.exports = { browser, device, emailLink, password, exchange, deviceName };
+module.exports = { browser, browserOrDevice, device, emailLink, password, exchange, deviceName };

package/lib/project-commands.js

@@ -1190,7 +1190,7 @@ async function regionTransfer() {
     if (!acct) {
       console.log(`\n🔑 Signing in to ${targetHost} as ${toEmail}...`);
       try {
-        const out = await loginFlows.browser(targetApi, { email: toEmail });
+        const out = await loginFlows.browserOrDevice(targetApi, { email: toEmail });
         creds.put(out.uid, { label: out.label, api: targetApi, token: out.token, method: 'browser', created: Date.now(), lastUsed: Date.now() });
         acct = creds.get(out.uid);
       } catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nukebase",
-  "version": "2.1.1",
+  "version": "2.1.2",
   "description": "NukeBase CLI: create, deploy and manage NukeBase projects",
   "bin": {
     "nukebase": "bin/nukebase.js"