pockethost 3.0.0 → 4.0.0

package/CHANGELOG.md

@@ -2,6 +2,41 @@
 
 Formerly published as `phio`. Versions below 3.0.0 are phio's history.
 
+## 4.0.0
+
+### Major Changes
+
+- The CLI signs in with a personal access token only. Email/password login is gone: `pockethost login` opens
+  Account → API Tokens and saves the token you paste (`pockethost login <token>` works too), and
+  `POCKETHOST_USERNAME`/`POCKETHOST_PASSWORD` are ignored with a message pointing to `POCKETHOST_TOKEN`. A login saved
+  by 3.x no longer works; run `pockethost login` once.
+- `list`, `link` and `logs` work with a token and show only the instances the token can reach. `logs` streams over
+  the instance's HTTPS endpoint, so it works from CI.
+- `sftp`, `deploy --sftp` and `dev --sftp` no longer register an SSH key for you, because tokens can't add SSH keys.
+  Add the CLI's public key under Account → Keys once; the CLI prints it when it's missing. Keys registered by earlier
+  versions keep working.
+- `info` shows the token, linked instance and whether the SFTP key is on your account.
+- Dropped the `pocketbase` dependency.
+
+## 3.1.0
+
+### Minor Changes
+
+- `deploy` and `dev` now upload over HTTPS instead of SFTP. The CLI sends a list of file hashes, uploads only the
+  files PocketHost doesn't have yet (compressed), and PocketHost swaps the new set in all at once, restarting the
+  instance when anything outside `pb_public` changed. Files in the deployed folders that aren't in your project are
+  removed. Dotfiles (for example `pb_public/.well-known/`) are now deployed; `.git*` and `node_modules` stay excluded.
+- Personal access tokens: set `POCKETHOST_TOKEN`, or run `pockethost token set` / `pockethost login --token`. Deploys
+  need no password or SSH key, so CI works on fresh runners (previously a new runner generated a new deploy key that
+  didn't match the registered `PocketHost CLI` key).
+- New `pockethost token [set|clear|status]`. `info` shows the token in use. `logout` also removes a saved token.
+- `deploy --commit <sha>` and `-m/--message <note>` are recorded with each deploy (`$GITHUB_SHA` is used
+  automatically).
+- `--sftp` on `deploy` and `dev` keeps the previous SFTP sync.
+- PocketHost no longer runs `bun install` when `package.json`, `bun.lock(b)` or `patches/` change (over SFTP or the
+  deploy API). Those files are copied as-is, and an existing `node_modules` on the instance is left alone. Bundle npm
+  code your hooks need into `pb_hooks`.
+
 ## 3.0.0
 
 ### Major Changes

package/README.md

@@ -16,14 +16,15 @@ npm install -g pockethost
 npm rm -g phio && npm i -g pockethost
 ```
 
-Everything carries over on first run: your login and deploy key are copied from phio's config folder (`~/.config/phio-nodejs` on Linux), `.phioconfig` is
+Your deploy key is copied from phio's config folder (`~/.config/phio-nodejs` on Linux), `.phioconfig` is
 renamed to `.pockethostconfig` (commit it), and the `PHIO_*` environment variables keep working with a warning until
 you rename them to `POCKETHOST_*`.
 
 ## Commands
 
 ```bash
-pockethost login
+pockethost login [token]     # save a personal access token
+pockethost token [set|clear|status]
 pockethost logout
 pockethost info          # alias: pockethost whoami
 pockethost list          # alias: pockethost ls
@@ -34,12 +35,15 @@ pockethost sftp [instance]
 pockethost logs [instance]
 ```
 
-- **`pockethost dev`**: watch local changes and sync over SFTP
-- **`pockethost deploy`**: one-shot SFTP sync
+- **`pockethost dev`**: watch local changes and deploy them
+- **`pockethost deploy`**: deploy once
+- **`pockethost login`**: open Account → API Tokens and save the token you paste
+- **`pockethost token`**: save, clear, or check the token
 - **`pockethost sftp`**: interactive SFTP session (uses system `sftp` when available)
 - **`pockethost logs`**: tail instance logs
 
-`dev` and `deploy` accept `-v/--verbose`, `-i/--include`, and `-e/--exclude`.
+`dev` and `deploy` accept `-v/--verbose`, `-i/--include`, `-e/--exclude`, and `--sftp` (sync over SFTP instead of
+HTTPS). `deploy` also takes `--commit <sha>` and `-m/--message <note>`.
 
 Default includes: `pb_*`, `package.json`, `bun.lock`, `bun.lockb`, `patches/**`.
 
@@ -64,12 +68,50 @@ This writes `.pockethostconfig`:
 Older project files (`.phioconfig`, `package.json` → `pockethost.instanceName`, `pockethost.json`) are migrated to
 `.pockethostconfig` automatically on first use.
 
-## Deploy key
+## How deploys work
 
-`pockethost dev` and `pockethost deploy` sync over **SFTP** (`ftp.pockethost.io:2222`) using an Ed25519 deploy key
-stored under `POCKETHOST_HOME` (default `~/.config/pockethost/`). The CLI auto-registers a **`PocketHost CLI`** key
-under Account → Keys on first use (an existing **`Phio`** key from phio is reused). Run `pockethost info` to inspect
-key status.
+`deploy` and `dev` talk to the instance over HTTPS (`https://<instance>.pockethost.io/_ph/deploy/v1`):
+
+1. Send a manifest of `{ path: sha256 }` for the matched files.
+2. Upload only the files the server is missing, as one gzip bundle per ~32 MB.
+3. Commit: the server swaps the file set in atomically (stopping the instance when anything outside `pb_public`
+   changes) and starts the instance again.
+
+PocketHost doesn't install npm packages. `package.json`, `bun.lock(b)` and `patches/` are copied as plain files. Bundle
+any npm code your hooks need into `pb_hooks`.
+
+Only `pb_*` folders (never `pb_data`), `package.json`, `bun.lock(b)` and `patches/` are deployed. Files in those folders
+on the instance that aren't in your project are removed. `node_modules` and `.git*` are never touched.
+
+## Authentication
+
+The CLI signs in with a personal access token (`ph_pat_…`) only. Every command uses, in order:
+
+1. `POCKETHOST_TOKEN`
+2. the token saved by `pockethost login` (or `pockethost token set`)
+
+Create tokens under [Account → API Tokens](https://app.pockethost.io/account/tokens). A token sees only the instances
+you give it; `list`, `link` and `logs` need read access, `deploy` and `dev` need write access. Email/password login
+was removed in 4.0.
+
+Deploy from GitHub Actions:
+
+```yaml
+- run: npx pockethost@latest deploy myapp-${{ github.ref_name }}
+  env:
+    POCKETHOST_TOKEN: ${{ secrets.POCKETHOST_TOKEN }}
+```
+
+Docs: https://pockethost.io/docs/deploy-from-ci
+
+## SSH key (`--sftp` and `pockethost sftp`)
+
+`pockethost dev --sftp`, `pockethost deploy --sftp` and `pockethost sftp` use **SFTP** (`ftp.pockethost.io:2222`)
+with an Ed25519 key stored under `POCKETHOST_HOME` (default `~/.config/pockethost/`), created on first use. Tokens
+can't add SSH keys, so add the public key (`pockethost_deploy_ed25519.pub`) under
+[Account → Keys](https://app.pockethost.io/account/keys) once; the CLI prints it if it's missing. Keys you registered
+with an earlier version (`PocketHost CLI` or `Phio`) keep working. `pockethost info` shows whether the key is on your
+account.
 
 Customer docs: https://pockethost.io/docs/cli
 
@@ -77,15 +119,14 @@ Customer docs: https://pockethost.io/docs/cli
 
 | Variable | Purpose |
 | -------- | ------- |
-| `POCKETHOST_USERNAME` | Override saved email (non-interactive login) |
-| `POCKETHOST_PASSWORD` | Override saved password |
+| `POCKETHOST_TOKEN` | Personal access token (CI); overrides the saved one |
 | `POCKETHOST_INSTANCE_NAME` | Override linked instance name |
 | `POCKETHOST_MOTHERSHIP_URL` | Override mothership API URL |
 | `POCKETHOST_HOME` | Override config directory |
 | `POCKETHOST_PROJECT_DIR` | Override project root detection |
 
 Environment variables take precedence over `.pockethostconfig`. The old `PHIO_*` names still work (with a deprecation
-warning) and will be removed in the next major version.
+warning) and will be removed in a future major version.
 
 ## Development (monorepo)