runcloud 0.1.15 → 0.1.17

package/dist/commands/secrets.js

@@ -0,0 +1,203 @@
+import { readFileSync } from 'node:fs';
+import { ApiClient, friendlyApiError } from '../api.js';
+import { requireCredentials } from '../config.js';
+import { promptHidden } from '../prompt.js';
+function api() {
+    const credentials = requireCredentials();
+    return new ApiClient(credentials.apiUrl, credentials.token);
+}
+async function run(fn) {
+    try {
+        await fn();
+    }
+    catch (err) {
+        console.error(friendlyApiError(err));
+        process.exitCode = 1;
+    }
+}
+function orgQuery(org, extra = {}) {
+    const params = new URLSearchParams(extra);
+    if (org)
+        params.set('orgId', org);
+    const qs = params.toString();
+    return qs ? `?${qs}` : '';
+}
+export function parseDotenv(text) {
+    const entries = {};
+    for (const raw of text.split('\n')) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const withoutExport = line.startsWith('export ') ? line.slice('export '.length).trim() : line;
+        const eq = withoutExport.indexOf('=');
+        if (eq <= 0)
+            continue;
+        const name = withoutExport.slice(0, eq).trim();
+        let value = withoutExport.slice(eq + 1).trim();
+        if ((value.startsWith('"') && value.endsWith('"') && value.length >= 2) ||
+            (value.startsWith("'") && value.endsWith("'") && value.length >= 2)) {
+            value = value.slice(1, -1);
+        }
+        entries[name] = value;
+    }
+    return entries;
+}
+export function parseJsonEntries(text) {
+    const parsed = JSON.parse(text);
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('--from-json needs a JSON object of name → value');
+    }
+    const entries = {};
+    for (const [name, value] of Object.entries(parsed)) {
+        if (typeof value !== 'string') {
+            throw new Error(`--from-json: "${name}" is not a string; secrets are strings`);
+        }
+        entries[name] = value;
+    }
+    return entries;
+}
+async function readStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(Buffer.from(chunk));
+    return Buffer.concat(chunks).toString('utf8');
+}
+export function registerSecrets(program) {
+    const groups = program
+        .command('secret-group')
+        .description('Create and manage secret groups a sandbox can attach');
+    groups
+        .command('create')
+        .description('Create a group together with its contents')
+        .argument('<group>', 'group name, e.g. aws')
+        .argument('[unsupported...]', 'not accepted: a value cannot be passed as an argument')
+        .option('--from-dotenv <path>', 'read KEY=VALUE lines from a .env file')
+        .option('--from-json <path>', 'read a JSON object of name → value')
+        .option('--key <name>', 'prompt for this value (hidden); repeatable', collect, [])
+        .option('--force', 'replace the group if it already exists', false)
+        .option('--org <id>', 'organization to store it in')
+        .action((group, unsupported, opts) => run(async () => {
+        if (unsupported.length > 0) {
+            throw new Error(`values cannot be passed as arguments (got "${unsupported[0]?.split('=')[0]}=…"). ` +
+                'An argument lands in your shell history, in `ps` output, and in CI logs. ' +
+                'Use --from-dotenv <path>, --from-json <path>, or --key <name> for a hidden prompt.');
+        }
+        const entries = {};
+        if (opts.fromDotenv)
+            Object.assign(entries, parseDotenv(readFileSync(opts.fromDotenv, 'utf8')));
+        if (opts.fromJson)
+            Object.assign(entries, parseJsonEntries(readFileSync(opts.fromJson, 'utf8')));
+        for (const name of opts.key) {
+            entries[name] = await promptHidden(`${name}: `);
+        }
+        if (Object.keys(entries).length === 0) {
+            throw new Error('nothing to store: pass --from-dotenv <path>, --from-json <path>, or --key <name>. ' +
+                'A value cannot be given as an argument — it would land in your shell history.');
+        }
+        const body = { entries };
+        if (opts.force)
+            body.force = true;
+        await api().put(`/run-cloud/secret-groups/${encodeURIComponent(group)}${orgQuery(opts.org)}`, body);
+        console.log(`secret group ${group}: ${Object.keys(entries).length} secret(s) stored`);
+    }));
+    groups
+        .command('list')
+        .description('List secret groups')
+        .option('--json', 'output JSON', false)
+        .option('--org <id>', 'organization to read from')
+        .action((opts) => run(async () => {
+        const data = await api().get(`/run-cloud/secret-groups${orgQuery(opts.org)}`);
+        const rows = (data?.groups ?? []);
+        if (opts.json) {
+            console.log(JSON.stringify(rows, null, 2));
+            return;
+        }
+        if (rows.length === 0) {
+            console.log('no secret groups yet — runcloud secret-group create <name> --from-dotenv <path>');
+            return;
+        }
+        for (const row of rows)
+            console.log(`${row.group}\t${row.secretCount} secret(s)\t${row.updatedAt}`);
+    }));
+    groups
+        .command('show')
+        .description('List the names in a group (never values)')
+        .argument('<group>', 'group name')
+        .option('--json', 'output JSON', false)
+        .option('--org <id>', 'organization to read from')
+        .action((group, opts) => run(async () => {
+        const data = await api().get(`/run-cloud/secrets${orgQuery(opts.org)}`);
+        const rows = (data?.secrets ?? []).filter((row) => row.group === group);
+        if (opts.json) {
+            console.log(JSON.stringify(rows, null, 2));
+            return;
+        }
+        if (rows.length === 0) {
+            console.log(`no secret group ${group}`);
+            return;
+        }
+        for (const row of rows) {
+            console.log(row.kind === 'file' ? `${row.name}\tfile → ${row.filePath}` : `${row.name}\tenv`);
+        }
+    }));
+    groups
+        .command('rm')
+        .description('Delete a group and every secret in it')
+        .argument('<group>', 'group name')
+        .option('--org <id>', 'organization to delete from')
+        .action((group, opts) => run(async () => {
+        await api().delete(`/run-cloud/secret-groups/${encodeURIComponent(group)}${orgQuery(opts.org)}`);
+        console.log(`secret group ${group} deleted`);
+    }));
+    const secrets = program
+        .command('secrets')
+        .description('Set and remove individual secrets inside a group');
+    secrets
+        .command('set')
+        .description('Store one environment-variable secret, reading the value from stdin')
+        .argument('<name>', 'secret name, e.g. AWS_SESSION_TOKEN')
+        .requiredOption('--group <group>', 'group to store it in')
+        .option('--stdin', 'read the value from stdin', false)
+        .option('--org <id>', 'organization to store it in')
+        .action((name, opts) => run(async () => {
+        const value = opts.stdin ? (await readStdin()).replace(/\n$/, '') : await promptHidden(`${name}: `);
+        if (!value)
+            throw new Error(`no value read for ${name}`);
+        await api().put(`/run-cloud/secrets/${encodeURIComponent(name)}${orgQuery(opts.org)}`, {
+            group: opts.group,
+            value,
+            kind: 'env',
+        });
+        console.log(`${opts.group}/${name} stored`);
+    }));
+    secrets
+        .command('set-file')
+        .description('Store a file secret, written into the sandbox at --path')
+        .argument('<name>', 'secret name, e.g. sa.json')
+        .requiredOption('--group <group>', 'group to store it in')
+        .requiredOption('--path <path>', 'path inside the sandbox, relative to its home')
+        .requiredOption('--from-file <path>', 'local file to read the contents from')
+        .option('--org <id>', 'organization to store it in')
+        .action((name, opts) => run(async () => {
+        await api().put(`/run-cloud/secrets/${encodeURIComponent(name)}${orgQuery(opts.org)}`, {
+            group: opts.group,
+            value: readFileSync(opts.fromFile, 'utf8'),
+            kind: 'file',
+            filePath: opts.path,
+        });
+        console.log(`${opts.group}/${name} stored → ${opts.path}`);
+    }));
+    secrets
+        .command('rm')
+        .description('Remove one secret from a group')
+        .argument('<name>', 'secret name')
+        .requiredOption('--group <group>', 'group it lives in')
+        .option('--org <id>', 'organization to delete from')
+        .action((name, opts) => run(async () => {
+        await api().delete(`/run-cloud/secrets/${encodeURIComponent(name)}${orgQuery(opts.org, { group: opts.group })}`);
+        console.log(`${opts.group}/${name} deleted`);
+    }));
+}
+function collect(value, previous) {
+    return [...previous, value];
+}

package/dist/prompt.js

@@ -150,3 +150,47 @@ export async function ask(question, options = {}) {
         rl.close();
     }
 }
+export async function promptHidden(label) {
+    const acquired = acquirePromptIO();
+    if (!acquired) {
+        const chunks = [];
+        for await (const chunk of process.stdin)
+            chunks.push(Buffer.from(chunk));
+        return chunks.join('').replace(/\n$/, '');
+    }
+    const { io, close } = acquired;
+    const input = io.input;
+    const output = io.output;
+    output.write(label);
+    input.setRawMode?.(true);
+    emitKeypressEvents(input);
+    input.resume();
+    return await new Promise((resolve, reject) => {
+        let value = '';
+        const finish = (fn) => {
+            input.setRawMode?.(false);
+            input.pause();
+            input.removeListener('keypress', onKeypress);
+            output.write('\n');
+            close();
+            fn();
+        };
+        function onKeypress(_str, key) {
+            if (key.ctrl && key.name === 'c') {
+                finish(() => reject(new Error('cancelled')));
+                return;
+            }
+            if (key.name === 'return' || key.name === 'enter') {
+                finish(() => resolve(value));
+                return;
+            }
+            if (key.name === 'backspace') {
+                value = value.slice(0, -1);
+                return;
+            }
+            if (key.sequence && !key.ctrl && !key.meta)
+                value += key.sequence;
+        }
+        input.on('keypress', onKeypress);
+    });
+}

package/dist/run-cloud.js

@@ -4,6 +4,7 @@ import { registerImage } from './commands/image.js';
 import { registerLogin } from './commands/login.js';
 import { registerRunCloud } from './commands/run-cloud.js';
 import { registerSandbox } from './commands/sandbox.js';
+import { registerSecrets } from './commands/secrets.js';
 import { CLI_VERSION } from './version.js';
 const program = new Command('runcloud')
     .description('Create and control remote mobile simulators and microVM sandboxes')
@@ -11,5 +12,6 @@ const program = new Command('runcloud')
 registerLogin(program);
 registerRunCloud(program);
 registerSandbox(program);
+registerSecrets(program);
 registerImage(program);
 await program.parseAsync(process.argv);

package/dist/sandboxExec.js

@@ -0,0 +1,91 @@
+import WebSocket from 'ws';
+export function streamExitCode(frame) {
+    const code = frame.code ?? frame.exit_code ?? 0;
+    return Number.isSafeInteger(code) ? code : undefined;
+}
+export function shellCommand(argv) {
+    if (argv.length === 1)
+        return argv[0] ?? '';
+    return argv
+        .map((part) => `'${part.replaceAll("'", "'\"'\"'")}'`)
+        .join(' ');
+}
+export function runSandboxCommand(input) {
+    const url = new URL(`/run-cloud/sandboxes/${encodeURIComponent(input.sandboxId)}/exec/stream?mode=command`, input.apiUrl);
+    url.protocol = url.protocol === 'https:' ? 'wss:' : 'ws:';
+    const socket = input.createSocket?.(url.toString(), {
+        headers: { Authorization: `Bearer ${input.token}` },
+    }) ??
+        new WebSocket(url, {
+            headers: { Authorization: `Bearer ${input.token}` },
+        });
+    return new Promise((resolve, reject) => {
+        const stdout = [];
+        const stderr = [];
+        let exitCode;
+        let settled = false;
+        const finish = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            if (error) {
+                reject(error);
+                return;
+            }
+            if (exitCode === undefined) {
+                reject(new Error('sandbox exec stream closed before reporting an exit code'));
+                return;
+            }
+            resolve({
+                exit_code: exitCode,
+                stdout: Buffer.concat(stdout).toString('utf8'),
+                stderr: Buffer.concat(stderr).toString('utf8'),
+            });
+        };
+        socket.once('open', () => socket.send(JSON.stringify(input.request)));
+        socket.on('message', (raw) => {
+            let frame;
+            try {
+                frame = JSON.parse(raw.toString());
+            }
+            catch {
+                socket.close(1002, 'invalid exec frame');
+                finish(new Error('sandbox exec stream returned invalid JSON'));
+                return;
+            }
+            if (frame.stream === 'stdout' || frame.stream === 'stderr') {
+                if (typeof frame.data !== 'string')
+                    return;
+                const chunk = Buffer.from(frame.data, 'base64');
+                if (frame.stream === 'stdout') {
+                    stdout.push(chunk);
+                    input.onStdout?.(chunk);
+                }
+                else {
+                    stderr.push(chunk);
+                    input.onStderr?.(chunk);
+                }
+                return;
+            }
+            if (frame.stream === 'exit') {
+                const code = streamExitCode(frame);
+                if (code === undefined) {
+                    socket.close(1002, 'invalid exit code');
+                    finish(new Error('sandbox exec stream returned an invalid exit code'));
+                    return;
+                }
+                exitCode = code;
+                socket.close(1000);
+            }
+        });
+        socket.once('error', (error) => finish(error));
+        socket.once('close', (code, reason) => {
+            if (exitCode !== undefined)
+                finish();
+            else {
+                finish(new Error(reason.toString() ||
+                    `sandbox exec stream closed before completion (${code})`));
+            }
+        });
+    });
+}

package/dist/shellSession.js

@@ -46,8 +46,10 @@ export async function runShellSession(input) {
                     const target = frame.stream === 'stderr' ? stderr : stdout;
                     target.write(Buffer.from(frame.data, 'base64'));
                 }
-                else if (frame.stream === 'exit' && typeof frame.exit_code === 'number') {
-                    exitCode = frame.exit_code;
+                else if (frame.stream === 'exit') {
+                    const code = frame.code ?? frame.exit_code ?? 0;
+                    if (Number.isSafeInteger(code))
+                        exitCode = code;
                 }
             }
             catch {

package/dist/terminal.js

@@ -0,0 +1,158 @@
+const ANSI_PATTERN = /\u001b\[[0-9;]*m/g;
+function supportsColor(stream) {
+    return stream.isTTY === true && process.env.NO_COLOR === undefined;
+}
+function paint(code, value, stream = process.stdout) {
+    return supportsColor(stream) ? `\u001b[${code}m${value}\u001b[0m` : value;
+}
+export const style = {
+    bold: (value, stream) => paint(1, value, stream),
+    dim: (value, stream) => paint(2, value, stream),
+    red: (value, stream) => paint(31, value, stream),
+    green: (value, stream) => paint(32, value, stream),
+    yellow: (value, stream) => paint(33, value, stream),
+    blue: (value, stream) => paint(34, value, stream),
+    cyan: (value, stream) => paint(36, value, stream),
+};
+function visibleLength(value) {
+    return value.replace(ANSI_PATTERN, '').length;
+}
+function truncate(value, maxWidth) {
+    if (!maxWidth || visibleLength(value) <= maxWidth)
+        return value;
+    if (maxWidth <= 1)
+        return '…';
+    return `${value.slice(0, maxWidth - 1)}…`;
+}
+function pad(value, width) {
+    return `${value}${' '.repeat(Math.max(0, width - visibleLength(value)))}`;
+}
+export function renderTable(title, columns, rows) {
+    if (rows.length === 0)
+        return title;
+    const cells = rows.map((row) => Object.fromEntries(columns.map((column) => [
+        column.key,
+        truncate(row[column.key] === undefined || row[column.key] === null ? '—' : String(row[column.key]), column.maxWidth),
+    ])));
+    const widths = Object.fromEntries(columns.map((column) => [
+        column.key,
+        Math.max(visibleLength(column.label), ...cells.map((row) => visibleLength(row[column.key]))),
+    ]));
+    const line = (row) => columns
+        .map((column, index) => {
+        const value = row[column.key];
+        return index === columns.length - 1 ? value : pad(value, widths[column.key]);
+    })
+        .join('  ')
+        .trimEnd();
+    const header = Object.fromEntries(columns.map((column) => [column.key, style.dim(column.label)]));
+    return `${style.bold(title)}\n\n${line(header)}\n${cells.map((row) => line(row)).join('\n')}`;
+}
+export function renderDetails(title, fields, footer) {
+    const visibleFields = fields.filter(({ value }) => value !== undefined && value !== null && value !== '');
+    const labelWidth = Math.max(...visibleFields.map(({ label }) => label.length), 0);
+    const lines = visibleFields.map(({ label, value }) => `  ${style.dim(pad(label, labelWidth))}  ${String(value)}`);
+    return [style.bold(title), ...lines, footer ? `\n${footer}` : undefined]
+        .filter((value) => value !== undefined)
+        .join('\n');
+}
+export function formatState(state) {
+    const value = typeof state === 'string' && state ? state : 'unknown';
+    if (value === 'running' || value === 'ready')
+        return style.green(value);
+    if (['building', 'building_image', 'pending', 'starting', 'destroying'].includes(value)) {
+        return style.yellow(value.replaceAll('_', ' '));
+    }
+    if (value === 'paused' || value === 'archived' || value === 'stopped') {
+        return style.blue(value);
+    }
+    if (value === 'failed' || value === 'interrupted' || value === 'destroyed') {
+        return style.red(value);
+    }
+    return value.replaceAll('_', ' ');
+}
+function rounded(value, fractionDigits = 1) {
+    return Number.isInteger(value) ? String(value) : value.toFixed(fractionDigits).replace(/\.0$/, '');
+}
+export function formatCpu(milliCpu) {
+    if (typeof milliCpu !== 'number' || !Number.isFinite(milliCpu))
+        return undefined;
+    return `${rounded(milliCpu / 1000, 3)} CPU`;
+}
+export function formatMib(mebibytes) {
+    if (typeof mebibytes !== 'number' || !Number.isFinite(mebibytes))
+        return undefined;
+    if (mebibytes >= 1024)
+        return `${rounded(mebibytes / 1024)} GiB`;
+    return `${rounded(mebibytes)} MiB`;
+}
+export function formatSeconds(seconds) {
+    if (typeof seconds !== 'number' || !Number.isFinite(seconds))
+        return undefined;
+    if (seconds === 0)
+        return 'never';
+    if (seconds < 60)
+        return `${rounded(seconds)}s`;
+    if (seconds < 3600)
+        return `${rounded(seconds / 60)}m`;
+    if (seconds < 86_400)
+        return `${rounded(seconds / 3600)}h`;
+    return `${rounded(seconds / 86_400)}d`;
+}
+export function formatAge(value, now = Date.now()) {
+    if (typeof value !== 'string')
+        return undefined;
+    const timestamp = Date.parse(value);
+    if (!Number.isFinite(timestamp))
+        return value;
+    const seconds = Math.max(0, Math.floor((now - timestamp) / 1000));
+    if (seconds < 5)
+        return 'just now';
+    return `${formatSeconds(seconds)} ago`;
+}
+export function shortDigest(value) {
+    if (typeof value !== 'string' || !value)
+        return undefined;
+    const digest = value.startsWith('sha256:') ? value.slice(7) : value;
+    return digest.slice(0, 12);
+}
+export function printJson(value) {
+    console.log(JSON.stringify(value, null, 2));
+}
+export class StatusLine {
+    lastMessage;
+    frame = 0;
+    update(message) {
+        if (process.stderr.isTTY) {
+            const frames = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+            const prefix = style.cyan(frames[this.frame++ % frames.length], process.stderr);
+            process.stderr.write(`\r\u001b[2K${prefix} ${message}`);
+            this.lastMessage = message;
+            return;
+        }
+        if (message !== this.lastMessage) {
+            process.stderr.write(`→ ${message}\n`);
+            this.lastMessage = message;
+        }
+    }
+    succeed(message) {
+        this.finish(`${style.green('✓', process.stderr)} ${message}`);
+    }
+    fail(message) {
+        this.finish(`${style.red('✗', process.stderr)} ${message}`);
+    }
+    clear() {
+        if (process.stderr.isTTY && this.lastMessage)
+            process.stderr.write('\r\u001b[2K');
+        this.lastMessage = undefined;
+    }
+    finish(message) {
+        if (process.stderr.isTTY && this.lastMessage) {
+            process.stderr.write(`\r\u001b[2K${message}\n`);
+        }
+        else {
+            process.stderr.write(`${message}\n`);
+        }
+        this.lastMessage = undefined;
+    }
+}

package/dist/version.js

@@ -1 +1 @@
-export const CLI_VERSION = '0.1.15';
+export const CLI_VERSION = '0.1.17';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runcloud",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "description": "Create and control run.cloud remote mobile simulators and cloud sandboxes",
   "license": "Apache-2.0",
   "keywords": [