runcloud 0.1.105 → 0.1.107

package/README.md

@@ -64,6 +64,8 @@ runcloud ios create --model iphone --install ./MyApp.app   # boot a simulator an
 runcloud ios list                                          # list active sessions
 runcloud ios get <id>                                      # inspect a session (viewer URL, status)
 runcloud ios open-url myapp://path --id <id>               # open a URL or deep link
+runcloud ios logs <id> --tail 200                          # read logs from this lease
+runcloud ios logs <id> --follow                            # follow new log entries
 runcloud ios delete <id>                                   # release the session
 
 # Android works the same under `runcloud android …`
@@ -74,6 +76,10 @@ Useful `create` flags: `--region`, `--display-name`, `--inactivity-timeout 3m`,
 `--hard-timeout 1h`, `--install-asset <name-or-id>`, `--rm` (release when the
 command exits), `--json`.
 
+The same `logs` commands work for Android. Snapshots are limited to the active
+lease and accept 1 to 1,000 lines. In follow mode, `--json` emits one JSON object
+per line.
+
 ### Tunnel a local dev server into a simulator
 
 ```bash

package/dist/commands/run-cloud.js

@@ -65,6 +65,40 @@ function formatRecord(value) {
         .map(([k, v]) => `${k}: ${typeof v === 'object' ? JSON.stringify(v) : String(v)}`)
         .join('\n');
 }
+export function consumeSimulatorLogSse(raw) {
+    const entries = [];
+    let offset = 0;
+    let separator = /\r?\n\r?\n/.exec(raw.slice(offset));
+    while (separator) {
+        const frameEnd = offset + separator.index;
+        const frame = raw.slice(offset, frameEnd);
+        offset = frameEnd + separator[0].length;
+        const data = frame
+            .split(/\r?\n/)
+            .filter((line) => line.startsWith('data:'))
+            .map((line) => line.slice('data:'.length).trimStart())
+            .join('\n');
+        if (data) {
+            let value;
+            try {
+                value = JSON.parse(data);
+            }
+            catch {
+                throw new Error('Simulator log stream returned invalid JSON');
+            }
+            const entry = value;
+            if (!entry || typeof entry.timestamp !== 'string' || typeof entry.message !== 'string') {
+                throw new Error('Simulator log stream returned an invalid entry');
+            }
+            entries.push({ timestamp: entry.timestamp, message: entry.message });
+        }
+        separator = /\r?\n\r?\n/.exec(raw.slice(offset));
+    }
+    return { entries, remainder: raw.slice(offset) };
+}
+function writeSimulatorLogEntry(entry, json) {
+    console.log(json ? JSON.stringify(entry) : entry.message);
+}
 function parseLabels(labels) {
     const out = {};
     for (const raw of labels ?? []) {
@@ -338,6 +372,46 @@ function registerSimulatorCommands(program, platform) {
         .action((url, opts) => action(async () => {
         print(await client().post(`/run-cloud/${platform}/${encodeURIComponent(opts.id)}/open-url`, { url }), opts);
     }));
+    simulator
+        .command('logs')
+        .description(`Read or follow logs from ${article} active ${label} session`)
+        .argument('<id>')
+        .option('--tail <lines>', 'number of retained lines to return (1-1000)')
+        .option('-f, --follow', 'follow new log entries', false)
+        .option('--json', 'output JSON; follow mode emits one object per line', false)
+        .action((id, opts) => action(async () => {
+        if (opts.follow && opts.tail !== undefined) {
+            throw new Error('--tail cannot be combined with --follow');
+        }
+        const path = `/run-cloud/${platform}/${encodeURIComponent(id)}/logs`;
+        if (!opts.follow) {
+            const tail = opts.tail === undefined ? 200 : Number(opts.tail);
+            if (!Number.isInteger(tail) || tail < 1 || tail > 1_000) {
+                throw new Error('--tail must be an integer from 1 to 1000');
+            }
+            const snapshot = await client().get(`${path}?tail=${tail}`);
+            if (opts.json) {
+                print(snapshot, opts);
+                return;
+            }
+            const entries = Array.isArray(snapshot.entries) ? snapshot.entries : [];
+            for (const entry of entries)
+                writeSimulatorLogEntry(entry, false);
+            if (entries.length === 0)
+                console.error('No simulator logs captured for this lease.');
+            return;
+        }
+        let pending = '';
+        for await (const chunk of client().stream(`${path}?follow=1`)) {
+            const parsed = consumeSimulatorLogSse(`${pending}${chunk}`);
+            pending = parsed.remainder;
+            if (pending.length > 1024 * 1024) {
+                throw new Error('Simulator log stream returned an oversized incomplete event');
+            }
+            for (const entry of parsed.entries)
+                writeSimulatorLogEntry(entry, opts.json === true);
+        }
+    }));
     return simulator;
 }
 async function action(fn) {

package/dist/commands/sandbox.js

@@ -263,6 +263,33 @@ function secretSelector(opts) {
 function collectRepeatable(value, previous) {
     return [...previous, value];
 }
+export function parseTagPairs(values) {
+    return values.map((raw) => {
+        const at = raw.indexOf('=');
+        if (at <= 0) {
+            throw new Error(`--tag must be key=value (got ${JSON.stringify(raw)})`);
+        }
+        return [raw.slice(0, at), raw.slice(at + 1)];
+    });
+}
+export async function resolveSandboxByTag(api, tags) {
+    if (tags.length === 0) {
+        throw new Error('Provide a sandbox id, or --tag key=value to find one.');
+    }
+    const query = new URLSearchParams();
+    for (const [key, value] of parseTagPairs(tags))
+        query.append('tag', `${key}:${value}`);
+    const data = await api.get(`/run-cloud/sandboxes?${query}`);
+    const items = data?.items ?? [];
+    if (items.length === 0) {
+        throw new Error(`No sandbox matches ${tags.join(' ')}.`);
+    }
+    if (items.length > 1) {
+        const listed = items.map((s) => `  ${s.id}${s.name ? `  ${s.name}` : ''}`).join('\n');
+        throw new Error(`${items.length} sandboxes match ${tags.join(' ')} — narrow it, or pass an id:\n${listed}`);
+    }
+    return items[0].id;
+}
 export function registerSandbox(program) {
     const sandbox = program.command('sandbox').description('Spawn and control microVM sandboxes');
     const defaultHelp = new Help();
@@ -362,12 +389,16 @@ export function registerSandbox(program) {
         .command('list')
         .description('List sandboxes')
         .option('--state <state>', 'filter by state')
-        .option('--name <name>', 'filter by name (exact)')).action((opts) => run(async () => {
+        .option('--name <name>', 'filter by name (exact)')
+        .option('--tag <key=value>', 'filter by tag; repeatable, and a sandbox must carry every one', collectRepeatable, [])).action((opts) => run(async () => {
         const query = new URLSearchParams();
         if (opts.state)
             query.set('state', opts.state);
         if (opts.name)
             query.set('name', opts.name);
+        for (const [key, value] of parseTagPairs(opts.tag ?? [])) {
+            query.append('tag', `${key}:${value}`);
+        }
         const qs = query.size ? `?${query}` : '';
         const api = runCloudApi();
         const [data, boxes] = await Promise.all([
@@ -384,6 +415,23 @@ export function registerSandbox(program) {
         else
             console.log(renderSandboxList(items));
     }));
+    withOutput(sandbox
+        .command('tag')
+        .description('Set or remove tags on a sandbox')
+        .argument('<id>', 'sandbox id')
+        .argument('<pairs...>', 'key=value to set, or key= to remove')).action((id, pairs, opts) => run(async () => {
+        const tags = Object.fromEntries(parseTagPairs(pairs).map(([key, value]) => [key, value === '' ? null : value]));
+        const updated = await runCloudApi().patch(`/run-cloud/sandboxes/${encodeURIComponent(id)}/tags`, { tags });
+        if (opts.json)
+            printJson(updated);
+        else {
+            const applied = (updated?.tags ?? {});
+            const entries = Object.entries(applied);
+            console.log(entries.length === 0
+                ? `${id} now has no tags`
+                : `${id}\n${entries.map(([k, v]) => `  ${k}=${v}`).join('\n')}`);
+        }
+    }));
     withOutput(sandbox
         .command('get')
         .description('Inspect a sandbox, including its public hostname when exposed')
@@ -497,15 +545,17 @@ export function registerSandbox(program) {
     sandbox
         .command('shell')
         .description('Open an interactive shell (resumes paused sandboxes)')
-        .argument('<id>', 'sandbox id')
-        .action((id) => run(async () => {
+        .argument('[id]', 'sandbox id; omit when using --tag')
+        .option('--tag <key=value>', 'find the sandbox by tag instead of id; repeatable, must match exactly one', collectRepeatable, [])
+        .action((id, opts) => run(async () => {
         const credentials = requireCredentials();
         const api = new ApiClient(credentials.apiUrl, credentials.token);
-        await prepareSandboxShell(api, id);
+        const sandboxId = id ?? (await resolveSandboxByTag(api, opts.tag ?? []));
+        await prepareSandboxShell(api, sandboxId);
         process.exitCode = await runSandboxShell({
             apiUrl: credentials.apiUrl,
             token: credentials.token,
-            sandboxId: id,
+            sandboxId,
         });
     }));
     for (const lifecycle of [

package/dist/version.js

@@ -1 +1 @@
-export const CLI_VERSION = '0.1.105';
+export const CLI_VERSION = '0.1.107';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runcloud",
-  "version": "0.1.105",
+  "version": "0.1.107",
   "description": "Create and control run.cloud remote mobile simulators and cloud sandboxes",
   "license": "Apache-2.0",
   "keywords": [

package/skills/run-cloud-ios-simulator/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: run-cloud-ios-simulator
-description: Operate run.cloud iOS simulator and Android emulator sessions with the CLI or TypeScript SDK. Use for creating, installing, inspecting, embedding, smoke-testing, connecting local Metro, capturing iOS screenshots, injecting iOS media, or releasing remote mobile sessions.
+description: Operate run.cloud iOS simulator and Android emulator sessions with the CLI or TypeScript SDK. Use for creating, installing, inspecting, reading device logs, embedding, smoke-testing, connecting local Metro, capturing iOS screenshots, injecting iOS media, or releasing remote mobile sessions.
 ---
 
 # Operate run.cloud Mobile Sessions
@@ -61,6 +61,7 @@ The shared mobile lifecycle is:
 - `runcloud ios|android list [--all]`
 - `runcloud ios|android get <id>`
 - `runcloud ios|android open-url <url> --id <id>`
+- `runcloud ios|android logs <id> [--tail N|--follow]`
 - `runcloud ios|android delete <id>`
 
 Create accepts `--model`, `--region`, `--display-name`, repeatable `--label`,
@@ -84,6 +85,21 @@ iOS needs an Apple Silicon simulator-compatible `.app`, `.zip`, `.tar.gz`, or
 `.ipa` artifact. A device-signed App Store IPA is not a substitute. Android
 needs an emulator-compatible artifact such as an APK.
 
+## Diagnose App Failures
+
+Read up to 1,000 retained entries from the current lease:
+
+```bash
+runcloud ios logs "$SESSION_ID" --tail 1000
+runcloud android logs "$SESSION_ID" --tail 1000
+```
+
+Use `--follow` while reproducing an issue, and add `--json` when another tool
+will consume the entries. `--tail` and `--follow` are mutually exclusive.
+Before releasing a failed session, always capture a bounded snapshot and keep
+the relevant entries with the test evidence. A follow stream contains only new
+entries and is not a substitute for the retained snapshot.
+
 ## Connect Local Development
 
 Connect a local Metro or mock server to an active iOS session:
@@ -136,9 +152,9 @@ try {
 The mobile SDK surface is:
 
 - `cloud.account()` and `cloud.usage({ orgId? })`
-- `cloud.ios`: `create`, `list`, `get`, `openUrl`, `screenshot`,
+- `cloud.ios`: `create`, `list`, `get`, `openUrl`, `logs`, `followLogs`, `screenshot`,
   `uploadVideo`, `uploadMicrophoneAudio`, `delete`
-- `cloud.android`: `create`, `list`, `get`, `openUrl`, `delete`
+- `cloud.android`: `create`, `list`, `get`, `openUrl`, `logs`, `followLogs`, `delete`
 - `cloud.simulators`: runtime-platform `create`, `list`, `get`, `openUrl`,
   `delete`
 - `cloud.assets`: `upload`, `list`, `delete`

package/skills/run-cloud-sandboxes/SKILL.md

@@ -204,6 +204,76 @@ signed browser desktop. The CLI also provides `screenshot`, `click`, `type`,
 and `key` subcommands for explicit pixel-coordinate automation. Keep signed
 desktop URLs private and inspect each subcommand's help before automation.
 
+## Tag Sandboxes, and Find Them Again
+
+Tags are arbitrary `key=value` metadata on a lease. They are how an operator
+gets from a symptom back to the machine that caused it, and they **outlive the
+sandbox** — so "which sandbox ran this?" is still answerable after the VM is
+gone, which is usually when you are asking.
+
+Tag on create, or on an existing sandbox:
+
+```bash
+runcloud sandbox create --image runcloud/agent-base   # then:
+runcloud sandbox tag sbx_123 newly.run=run-42 owner=qasim
+runcloud sandbox tag sbx_123 owner=          # empty value removes the key
+```
+
+Find by tag — repeatable, and a sandbox must carry every one:
+
+```bash
+runcloud sandbox list --tag newly.run=run-42 --json
+runcloud sandbox shell --tag newly.run=run-42   # resolves, then opens a shell
+```
+
+`shell --tag` refuses to guess: no match and several matches are both errors,
+and the ambiguous case lists what it found. Opening a shell on the wrong
+machine is worse than being told to be precise.
+
+Reserved keys the platform sets itself — do not overwrite them:
+
+| key | meaning |
+| --- | --- |
+| `newly.kind` | what created it (`ci`, …) |
+| `newly.run` | the CI run id |
+| `newly.environment` | the CI environment id |
+| `newly.session` / `newly.role` | Newly session association, for simulators |
+
+### Debugging when you have only a log line
+
+The control plane logs a sandbox's tags on **create** and **destroy**, so the
+first step needs no API token and no database access:
+
+```bash
+gcloud logging read \
+  'resource.labels.service_name="cp-api-dev" AND jsonPayload.message="run.cloud sandbox created"' \
+  --limit 20 --freshness=6h --format=json
+```
+
+Then either query as a normal user (`runcloud sandbox list --tag …`), or use the
+ops endpoint, which is org-agnostic and audited — the right tool when you do not
+know whose org it was:
+
+```
+GET /diagnose/sandbox?tag=newly.run:run-42
+```
+
+It is gated by an ops OIDC token, not a user credential: mint one by
+impersonating the `cp-diagnose-ops-<env>` service account, which every engineer
+can do. Destroyed sandboxes are included on purpose.
+
+**Credentials.** The CLI defaults to **prod**. For dev, set both:
+
+```bash
+export RUN_CLOUD_API_URL=https://cp-api-dev-97683904813.us-east4.run.app
+export RUN_CLOUD_API_TOKEN=...   # RUN_CLOUD_DEV_API_TOKEN in secrets/dev.yaml
+```
+
+Key names do not match the env vars, and `sops` needs
+`gcloud auth application-default login` rather than plain `gcloud auth login` —
+see the Secrets section of the root `CLAUDE.md`/`AGENTS.md` before concluding
+you lack access.
+
 ## Guardrails
 
 - Destroy every sandbox created during a task unless the user explicitly asks
@@ -215,3 +285,5 @@ desktop URLs private and inspect each subcommand's help before automation.
   URLs in logs, screenshots, PR comments, or chat output.
 - Do not claim that CLI-only lifecycle, image, secret-group, desktop, or stable
   hostname commands are TypeScript SDK methods.
+- Do not overwrite a `newly.*` tag; the platform sets those and support reads
+  them. Add your own key instead.