nukebase 2.1.1 → 2.2.0

package/README.md

@@ -18,9 +18,9 @@ signed in at once; each project folder knows which account owns it, so you can
 deploy to different accounts from different terminals at the same time.
 
 ```
-nukebase login                     approve in your browser
+nukebase login                     approve in your browser, or enter the code it shows on any device
 nukebase login --email you@x.com   add another account
-nukebase login --device            from SSH or a machine without a browser
+nukebase login --device            only the code (SSH, a VM, no browser)
 nukebase accounts                  list signed-in accounts
 nukebase use you@x.com             default for commands outside a project
 nukebase logout you@x.com          sign out one account

package/bin/nukebase.js

@@ -37,9 +37,11 @@ New here? Run: npx nukebase start
   signs you in, creates a project and downloads it, ready to build
 
 Accounts
-  login                      sign in by approving in your browser
+  login                      sign in: approve in your browser, or enter the
+                             code it shows on any device (VM / SSH)
   login --email you@x.com    sign in as a specific account (adds it; others stay)
-  login --device             sign in from SSH or a machine without a browser
+  login --device             only the code (no browser is opened)
+  login --browser            only the browser (no code)
   login --email-link         sign in with an emailed link instead
   login --password           username + password (the master account)
   logout <email>             sign out one account
@@ -77,6 +79,9 @@ In a project folder (runs as the account that owns the project)
   domain                     connect a custom domain, step by step
   domain <name> [--email e]  connect in one go (DNS already set)
   domain remove              disconnect the custom domain
+  domain email               send the app's emails from the custom domain
+                             (--root | --sub, --reply-to you@gmail.com, --wait)
+  domain email remove        go back to sending from nukebase.com
   logs [--follow]            recent log output; --follow streams
   download [--out f.zip]     the project ZIP, exactly as the server has it
   regiontransfer [region]    move this project to another region, step by step

package/lib/account-commands.js

@@ -62,9 +62,14 @@ async function loginCommand(args) {
     if (!email) email = (await askLine('Email: ')).trim().toLowerCase();
     if (!email.includes('@')) fail('An email address is required.');
     out = await login.emailLink(api, email);
-  } else {
+  } else if (args.has('browser')) {
     method = 'browser';
     out = await login.browser(api, { email });
+  } else {
+    // Browser and device code together, whichever is approved first, so a
+    // VM or SSH session can sign in too.
+    method = 'browser';
+    out = await login.browserOrDevice(api, { email });
   }
 
   // Signing in again replaces this machine's token for that account; sign the
@@ -456,6 +461,7 @@ async function startCommand(args) {
   const { parse } = require('./args');
   const passFlags = [];
   for (const f of ['api', 'region']) if (args.get(f)) passFlags.push(`--${f}`, args.get(f));
+  for (const f of ['device', 'browser']) if (args.has(f)) passFlags.push(`--${f}`);
 
   const emailArg = args.positional.find(a => a.includes('@')) || args.get('as');
   console.log('\n  Welcome to NukeBase.');
@@ -471,7 +477,9 @@ async function startCommand(args) {
       : (creds.getDefault() || list[0]);
   }
   if (!acct) {
-    console.log('\n  Confirm your Claude session: click Confirm in the browser window that opens.');
+    console.log(args.has('device')
+      ? '\n  Sign in: open the link below on any device and enter the code.'
+      : '\n  Confirm your Claude session: click Confirm in the browser window that opens,\n  or, with no browser on this machine, enter the code shown below on any device.');
     await loginCommand(parse(['login', ...(emailArg ? ['--email', emailArg] : []), ...passFlags]));
     acct = emailArg ? creds.find(emailArg) : (creds.getDefault() || creds.list()[0]);
     if (!acct) fail('Sign-in did not finish. Run: npx nukebase start');

package/lib/args.js

@@ -6,7 +6,7 @@
 // `--name=value` works too.
 
 const VALUE_FLAGS = new Set([
-  'region', 'api', 'as', 'tier', 'streams', 'out', 'email', 'to', 'include', 'name'
+  'region', 'api', 'as', 'tier', 'streams', 'out', 'email', 'to', 'include', 'name', 'reply-to'
 ]);
 
 const SHORT = { y: 'yes', f: 'follow', h: 'help', v: 'version' };

package/lib/login.js

@@ -4,6 +4,9 @@
 //   browser     open /cli-auth.html, approve, a one-time code comes back to a
 //               local server, swapped (with a PKCE secret) for the token
 //   device      a short code to type on the website, for SSH / no browser
+//   browserOrDevice  both at once, whichever is approved first: the default,
+//               so a VM or SSH session (where a browser elsewhere cannot reach
+//               this machine's 127.0.0.1) can still sign in
 //   emailLink   the email sign-in link, delivered back to a local server
 //   password    username + password (the master account)
 //
@@ -76,8 +79,11 @@ function startLoopback(state) {
       finish.res({ query: q, reply });
     });
     const timer = setTimeout(() => { server.close(); finish.rej(new Error('No response within 5 minutes. Run nukebase login again.')); }, LOGIN_TIMEOUT_MS);
+    // Stop waiting (the device code won instead). Settling an already
+    // settled promise is a no-op, so this is safe after a callback too.
+    const close = () => { clearTimeout(timer); server.close(); finish.rej(new Error('Cancelled')); };
     server.on('error', rejectStart);
-    server.listen(0, '127.0.0.1', () => resolveStart({ port: server.address().port, result }));
+    server.listen(0, '127.0.0.1', () => resolveStart({ port: server.address().port, result, close }));
   });
 }
 
@@ -102,11 +108,13 @@ function needsNewerServer(r, api) {
   }
 }
 
-async function browser(api, { email } = {}) {
+// Start a browser sign-in: the loopback server and the approval URL. finish()
+// waits for the approval and swaps its code for the token; close() gives up.
+async function browserStart(api, { email } = {}) {
   const state = b64url(crypto.randomBytes(24));
   const verifier = b64url(crypto.randomBytes(32));
   const challenge = b64url(crypto.createHash('sha256').update(verifier).digest());
-  const { port, result } = await startLoopback(state);
+  const { port, result, close } = await startLoopback(state);
 
   const url = new URL(`${api}/cli-auth.html`);
   url.searchParams.set('port', String(port));
@@ -115,56 +123,110 @@ async function browser(api, { email } = {}) {
   url.searchParams.set('device', deviceName());
   if (email) url.searchParams.set('email', email);
 
+  async function finish() {
+    // The usual reason for a long wait: no account yet, so no sign-in email
+    // ever arrives (the server doesn't say which addresses have accounts).
+    const hint = setTimeout(() => {
+      console.log(`\n  Still waiting. No account yet? Sign up at ${api}/start.html first, then run this again.`);
+    }, 90 * 1000);
+    hint.unref();
+    const { query: q, reply } = await result.finally(() => clearTimeout(hint));
+    if (q.error) throw new Error('Sign-in was cancelled in the browser.');
+    try {
+      if (!q.code) throw new Error('The browser did not return a sign-in code.');
+      const r = await postJson(`${api}/cli/token`, { code: q.code, verifier });
+      needsNewerServer(r, api);
+      if (!r.ok) throw new Error(r.data.error || `Sign-in failed (${r.status})`);
+      // Signed in: finish the browser on the dashboard, which says so.
+      reply({ redirect: `${api}/?cli=signed-in` });
+      return r.data;
+    } catch (e) {
+      reply({ error: e.message });
+      throw e;
+    }
+  }
+  return { url: url.toString(), finish, close };
+}
+
+async function browser(api, { email } = {}) {
+  const b = await browserStart(api, { email });
   console.log('\n  Opening your browser to approve this CLI. If it doesn\'t open, visit:');
-  console.log(`  ${url}\n`);
+  console.log(`  ${b.url}\n`);
   console.log('  Waiting for approval…  (Ctrl+C to cancel)');
-  openBrowser(url.toString());
-
-  // The usual reason for a long wait: no account yet, so no sign-in email
-  // ever arrives (the server doesn't say which addresses have accounts).
-  const hint = setTimeout(() => {
-    console.log(`\n  Still waiting. No account yet? Sign up at ${api}/start.html first, then run this again.`);
-  }, 90 * 1000);
-  hint.unref();
-  const { query: q, reply } = await result.finally(() => clearTimeout(hint));
-  if (q.error) throw new Error('Sign-in was cancelled in the browser.');
-  try {
-    if (!q.code) throw new Error('The browser did not return a sign-in code.');
-    const r = await postJson(`${api}/cli/token`, { code: q.code, verifier });
-    needsNewerServer(r, api);
-    if (!r.ok) throw new Error(r.data.error || `Sign-in failed (${r.status})`);
-    // Signed in: finish the browser on the dashboard, which says so.
-    reply({ redirect: `${api}/?cli=signed-in` });
-    return r.data;
-  } catch (e) {
-    reply({ error: e.message });
-    throw e;
-  }
+  openBrowser(b.url);
+  return b.finish();
 }
 
-async function device(api) {
+async function deviceStart(api) {
   const start = await postJson(`${api}/cli/device-start`, { device: deviceName() });
   needsNewerServer(start, api);
   if (!start.ok) throw new Error(start.data.error || `Could not start sign-in (${start.status})`);
-  const { deviceCode, userCode, verifyUrl, interval = 5, expiresIn = 600 } = start.data;
-
-  console.log('\n  On any device, open:');
-  console.log(`    ${verifyUrl}`);
-  console.log('  and enter this code:\n');
-  console.log(`    ${userCode}\n`);
-  console.log(`  Waiting for approval…  (expires in ${Math.round(expiresIn / 60)} minutes)`);
+  return start.data;
+}
 
+// Poll until the code is approved. `stop.cancelled` ends it quietly (the
+// browser won instead), resolving null.
+async function devicePoll(api, { deviceCode, interval = 5, expiresIn = 600 }, stop = {}) {
   let wait = Math.max(interval, 2) * 1000;
   const deadline = Date.now() + expiresIn * 1000;
   while (Date.now() < deadline) {
-    await new Promise(r => setTimeout(r, wait));
+    await new Promise(r => setTimeout(r, wait).unref());
+    if (stop.cancelled) return null;
     const r = await postJson(`${api}/cli/device-poll`, { deviceCode });
-    if (r.status === 410) throw new Error('The code expired. Run nukebase login --device again.');
+    if (stop.cancelled) return null;
+    if (r.status === 410) throw new Error('The code expired. Run nukebase login again.');
     if (!r.ok) throw new Error(r.data.error || `Sign-in failed (${r.status})`);
     if (r.data.status === 'slow_down') { wait += 1000; continue; }
     if (r.data.status === 'approved') return { uid: r.data.uid, token: r.data.token, label: r.data.label };
   }
-  throw new Error('The code expired. Run nukebase login --device again.');
+  throw new Error('The code expired. Run nukebase login again.');
+}
+
+async function device(api) {
+  const d = await deviceStart(api);
+  console.log('\n  On any device, open:');
+  console.log(`    ${d.verifyUrl}`);
+  console.log('  and enter this code:\n');
+  console.log(`    ${d.userCode}\n`);
+  console.log(`  Waiting for approval…  (expires in ${Math.round((d.expiresIn || 600) / 60)} minutes)`);
+  return devicePoll(api, d);
+}
+
+// The default sign-in: open the browser AND show a device code, and take
+// whichever is approved first. On a laptop the browser wins as before; on a
+// VM or over SSH there is no browser here, and a browser elsewhere cannot
+// reach this machine's 127.0.0.1, so the code is the way in. A server too old
+// for device codes gets the browser alone, exactly as before.
+async function browserOrDevice(api, { email } = {}) {
+  let d = null;
+  try { d = await deviceStart(api); } catch {}
+  if (!d || !d.deviceCode) return browser(api, { email });
+
+  const b = await browserStart(api, { email });
+  console.log('\n  Opening your browser to approve this CLI. If it doesn\'t open, visit:');
+  console.log(`  ${b.url}\n`);
+  console.log('  No browser on this machine (a VM, SSH, a container)? On any phone or computer, open');
+  console.log(`    ${d.verifyUrl}`);
+  console.log(`  and enter the code  ${d.userCode}\n`);
+  console.log('  Waiting for approval…  (Ctrl+C to cancel)');
+  openBrowser(b.url);
+
+  const stop = { cancelled: false };
+  const viaBrowser = b.finish();
+  const viaDevice = devicePoll(api, d, stop).then((out) => out || new Promise(() => {}));
+  // A failed leg (the browser's 5-minute wait running out, say) must not end
+  // the sign-in while the other can still be approved: Promise.any settles on
+  // the first success and fails only when both have failed.
+  try {
+    return await Promise.any([viaBrowser, viaDevice]);
+  } catch (e) {
+    const first = (e && e.errors && e.errors.find(x => x && x.message !== 'Cancelled')) || e;
+    throw first;
+  } finally {
+    stop.cancelled = true;
+    viaBrowser.catch(() => {});
+    b.close();
+  }
 }
 
 // Swap an ordinary session for a CLI token, then sign the session out.
@@ -208,4 +270,4 @@ async function password(api, username, pass) {
   return { ...out, label: out.label || username };
 }
 
-module.exports = { browser, device, emailLink, password, exchange, deviceName };
+module.exports = { browser, browserOrDevice, device, emailLink, password, exchange, deviceName };

package/lib/project-commands.js

@@ -854,6 +854,7 @@ async function deleteProject() {
 // nukebase domain                          guided: DNS records, wait, connect
 // nukebase domain <name> [--email you@x]   one shot, for scripts (no waiting)
 // nukebase domain remove                   disconnect it
+// nukebase domain email [remove]           send the app's emails from it
 //
 // The guided flow is the dashboard's modal in the terminal: it prints the two
 // A records and the ownership TXT (nukebase.<domain> = nukebase-uid=<uid>,
@@ -878,6 +879,11 @@ async function domainCommand() {
     process.exit(0);
   }
 
+  if (sub === 'email') {
+    await emailDomainCommand(args.positional[1] || null);
+    process.exit(0);
+  }
+
   const email = args.get('email') || (String(accountLabel).includes('@') ? accountLabel : null);
 
   // One shot: name given, no hand-holding. Scripts and people who already
@@ -892,6 +898,7 @@ async function domainCommand() {
       await waitForDns(sub, ip, needTxt);
     }
     await connectDomain(sub, email);
+    if (args.has('email-domain')) await emailDomainCommand(null);
     process.exit(0);
   }
 
@@ -923,6 +930,13 @@ async function domainCommand() {
 
   // Step 3 — the server does the real verification and issues the cert.
   await connectDomain(domain, email);
+
+  // Optional: the app's emails from this domain too.
+  if (args.has('email-domain') || await confirm(`\n✉️  Send this app's emails from ${domain} too (instead of nukebase.com)? (y/n) `)) {
+    await emailDomainCommand(null);
+  } else {
+    console.log('   Later: nukebase domain email');
+  }
   process.exit(0);
 
   async function currentDomain() {
@@ -931,6 +945,106 @@ async function domainCommand() {
   }
 }
 
+// nukebase domain email [--root | --sub] [--reply-to you@gmail.com] [--wait]
+// nukebase domain email remove
+//
+// Send the app's emails (sign-in links today) from its custom domain:
+// login@theirapp.com, replies to --reply-to. The sending domain is either the
+// custom domain itself (--root) or mail.<domain> (--sub; safest when the
+// domain already has email). Prints the two DNS records to add, then waits
+// for the mail provider to verify them (Enter to check now, Ctrl+C to leave
+// it: the server keeps checking every 10 minutes for a week). Run again to
+// see the status, change the Reply-To, or switch between --root and --sub.
+async function emailDomainCommand(action) {
+  if (action === 'remove') {
+    if (!(await confirm(`Stop sending ${project}'s emails from its domain? They go back to nukebase.com. (y/n) `))) {
+      console.log('Aborted.'); process.exit(1);
+    }
+    await projectPost('/remove-email-domain', {}, { label: 'email remove' });
+    console.log('✓ Email sending domain removed. Emails are sent from nukebase.com again.');
+    return;
+  }
+
+  const check = await projectPost('/email-domain-check', {}, { label: 'email' });
+  const domain = check.domain;
+  const current = check.current;
+  const wantRoot = args.has('root') ? true : args.has('sub') ? false : null;
+  const replyTo = args.get('reply-to');
+  const changing = wantRoot !== null && (!current || current.root !== wantRoot);
+
+  let rec = current;
+  if (!current || changing || replyTo !== undefined) {
+    let root = wantRoot;
+    if (root === null) root = current ? current.root : null;
+    if (root === null) {
+      const suggestRoot = check.suggested === 'root';
+      console.log(`\n✉️  Send ${project}'s emails from ${domain}\n`);
+      console.log(`   1) login@${domain}`);
+      console.log(`      ${check.hasEmail ? 'This domain already has email set up' + (check.spf ? ' (you will update its SPF record)' : '') + '.' : 'Recommended: this domain has no email set up yet.'}`);
+      console.log(`   2) login@${domain}, sent via mail.${domain}`);
+      console.log('      Safest if you already use email on this domain: its records are not touched.\n');
+      if (process.stdin.isTTY && !AUTO_YES) {
+        const a = (await askLine(`   Choose 1 or 2 [${suggestRoot ? 1 : 2}]: `)).trim();
+        root = a === '1' ? true : a === '2' ? false : suggestRoot;
+      } else {
+        root = suggestRoot;
+      }
+    }
+    let reply = replyTo;
+    if (reply === undefined && !current && process.stdin.isTTY && !AUTO_YES) {
+      reply = (await askLine('   Where should replies go? (e.g. you@gmail.com, Enter to skip): ')).trim();
+    }
+    const body = { root };
+    if (typeof reply === 'string') body.replyTo = reply;
+    rec = (await projectPost('/email-domain', body, { label: 'email' })).emailDomain;
+  }
+
+  printEmailRecords(rec);
+  if (rec.status === 'verified') return;
+  if (!args.has('wait') && (!process.stdin.isTTY || AUTO_YES)) {
+    console.log('   The server checks every 10 minutes. See the status with: nukebase domain email');
+    return;
+  }
+  await waitForEmailDomain();
+}
+
+function printEmailRecords(rec) {
+  const ok = rec.status === 'verified';
+  console.log(`\n   Sending domain: ${rec.name}   ${ok ? `✓ verified — emails go out as login@${rec.fromDomain || rec.name}` : '… waiting for DNS'}`);
+  if (rec.replyTo) console.log(`   Replies go to:  ${rec.replyTo}`);
+  if (ok) { console.log(''); return; }
+  console.log('\n   At your registrar, add these DNS records:\n');
+  for (const r of rec.records || []) {
+    console.log(`     ${r.valid ? '✓' : '…'} TXT   ${r.host}`);
+    if (r.replace) console.log('            REPLACE your existing SPF record (only one is allowed) with:');
+    console.log(`            ${r.value}\n`);
+  }
+}
+
+async function waitForEmailDomain() {
+  console.log('   Waiting for verification. Enter to check now, Ctrl+C to stop (the server keeps checking).\n');
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  let poke = null;
+  rl.on('line', () => { if (poke) poke(); });
+  const wait = (ms) => new Promise(res => { poke = res; setTimeout(res, ms); });
+  try {
+    for (;;) {
+      const r = await projectPost('/email-domain-status', {}, { label: 'email status' });
+      const rec = r.emailDomain;
+      if (!rec) { console.log('\n   The sending domain is gone. Run: nukebase domain email'); return; }
+      const marks = (rec.records || []).map(x => `${x.valid ? '✓' : '…'} ${x.kind.toUpperCase()}`).join('   ');
+      process.stdout.write(`\r   ${marks}      `);
+      if (rec.status === 'verified') {
+        console.log(`\n\n✓ Verified. ${project}'s emails now go out as login@${rec.fromDomain || rec.name}.`);
+        return;
+      }
+      await wait(20000);
+    }
+  } finally {
+    rl.close();
+  }
+}
+
 async function connectDomain(domain, email) {
   console.log(`🔐 Step 3 — verifying DNS from the server and issuing SSL for ${domain} (up to a minute)...`);
   const r = await projectPost('/custom-domain', email ? { domain, email } : { domain }, {
@@ -1190,7 +1304,7 @@ async function regionTransfer() {
     if (!acct) {
       console.log(`\n🔑 Signing in to ${targetHost} as ${toEmail}...`);
       try {
-        const out = await loginFlows.browser(targetApi, { email: toEmail });
+        const out = await loginFlows.browserOrDevice(targetApi, { email: toEmail });
         creds.put(out.uid, { label: out.label, api: targetApi, token: out.token, method: 'browser', created: Date.now(), lastUsed: Date.now() });
         acct = creds.get(out.uid);
       } catch (e) {
@@ -1289,6 +1403,14 @@ async function regionTransfer() {
     if (r.status !== 0) {
       console.error(`\n⚠️  The domain was not connected on ${target}. It still works on ${source}.`);
       console.error(`   Finish later with: nukebase domain ${customDomain} --region ${target} --wait${asArgs.length ? ' ' + asArgs.join(' ') : ''}`);
+    } else if (node.emailDomain && node.emailDomain.name) {
+      // Same sending domain on the target: the mail provider already has it
+      // verified (its DNS records do not change), so the target adopts it.
+      const em = node.emailDomain;
+      const emArgs = ['domain', 'email', em.root ? '--root' : '--sub', '--region', target, '--yes', ...asArgs];
+      if (em.replyTo) emArgs.push('--reply-to', em.replyTo);
+      const e = spawnSync(process.execPath, [BIN, ...emArgs], { stdio: 'inherit', cwd: root });
+      if (e.status !== 0) console.error(`   Email sending: finish later with: nukebase domain email --region ${target}${asArgs.length ? ' ' + asArgs.join(' ') : ''}`);
     }
   } else {
     console.log(`  Skipped. ${customDomain} stays on ${source} for now. When ready:`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nukebase",
-  "version": "2.1.1",
+  "version": "2.2.0",
   "description": "NukeBase CLI: create, deploy and manage NukeBase projects",
   "bin": {
     "nukebase": "bin/nukebase.js"