runcloud 0.1.5 → 0.1.6

package/dist/api.js

@@ -9,7 +9,8 @@ export class ApiError extends Error {
 }
 function parsedErrorDetail(body) {
     try {
-        const detail = JSON.parse(body).detail;
+        const parsed = JSON.parse(body);
+        const detail = parsed.detail ?? parsed.error ?? parsed.message;
         if (typeof detail === 'string')
             return detail;
         if (detail !== undefined)
@@ -161,8 +162,10 @@ function detailSuffix(err) {
 }
 function headline(err) {
     if (err instanceof ApiError) {
-        if (err.status === 401)
-            return 'Session expired or invalid — run `newly login`.';
+        if (err.status === 401) {
+            const command = (process.argv[1] ?? '').includes('run-cloud') ? 'runcloud login' : 'newly login';
+            return `Session expired or invalid — run \`${command}\`.`;
+        }
         if (err.status === 403)
             return err.detail ? `Forbidden: ${err.detail}` : 'Forbidden.';
         if (err.status === 404)

package/dist/commands/login.js

@@ -15,6 +15,7 @@ export async function startCallbackServer(state, appOrigin, timeoutMs) {
         'Access-Control-Allow-Origin': appOrigin,
         'Access-Control-Allow-Methods': 'POST, OPTIONS',
         'Access-Control-Allow-Headers': 'content-type',
+        'Access-Control-Allow-Private-Network': 'true',
     };
     const server = http.createServer((req, res) => {
         if (req.method === 'OPTIONS') {
@@ -37,6 +38,22 @@ export async function startCallbackServer(state, appOrigin, timeoutMs) {
                     res.end('state mismatch');
                     return;
                 }
+                if (typeof parsed.token !== 'string' ||
+                    parsed.token.length === 0 ||
+                    typeof parsed.expiresIn !== 'number' ||
+                    !Number.isFinite(parsed.expiresIn) ||
+                    parsed.expiresIn <= 0 ||
+                    typeof parsed.apiUrl !== 'string') {
+                    res.writeHead(400, corsHeaders);
+                    res.end('invalid credential payload');
+                    return;
+                }
+                const apiUrl = new URL(parsed.apiUrl);
+                if (!['http:', 'https:'].includes(apiUrl.protocol)) {
+                    res.writeHead(400, corsHeaders);
+                    res.end('invalid API URL');
+                    return;
+                }
                 res.writeHead(200, { ...corsHeaders, 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ ok: true }));
                 clearTimeout(timer);
@@ -74,6 +91,12 @@ function openBrowser(url) {
     });
     child.unref();
 }
+export function cliAuthUrl(appUrl, port, state) {
+    const url = new URL('/cli-auth', appUrl);
+    url.searchParams.set('port', String(port));
+    url.searchParams.set('state', state);
+    return url.toString();
+}
 export function parseManualCredential(blob) {
     let parsed;
     try {
@@ -90,12 +113,13 @@ export function parseManualCredential(blob) {
     return { token: c.token, expiresIn: c.expiresIn, apiUrl: c.apiUrl };
 }
 export function registerLogin(program) {
-    const defaultAppUrl = program.name() === 'runcloud'
+    const isRunCloud = program.name() === 'runcloud';
+    const defaultAppUrl = isRunCloud
         ? process.env.RUN_CLOUD_APP_URL ?? 'https://run.cloud'
         : process.env.NEWLY_APP_URL ?? 'https://newly.app';
     program
         .command('login')
-        .description('Log in with your Newly account via the browser')
+        .description(`Log in with your ${isRunCloud ? 'run.cloud' : 'Newly'} account via the browser`)
         .option('--app-url <url>', 'product web app URL', defaultAppUrl)
         .option('--manual', 'paste the credential from the browser instead of using the local callback', false)
         .option('--api-url <url>', 'explicit API URL (skips browser; use with --token)')
@@ -105,36 +129,57 @@ export function registerLogin(program) {
         try {
             const hasApiUrl = typeof opts.apiUrl === 'string' && opts.apiUrl.length > 0;
             const hasToken = typeof opts.token === 'string' && opts.token.length > 0;
-            if (hasApiUrl !== hasToken) {
+            if (!isRunCloud && hasApiUrl !== hasToken) {
                 throw new Error('--api-url and --token must be provided together for headless login.');
             }
-            if (hasApiUrl && hasToken) {
+            if (isRunCloud && hasApiUrl && !hasToken) {
+                throw new Error('--api-url requires --token for headless login.');
+            }
+            if (hasToken) {
+                if (isRunCloud && !opts.token.startsWith('rc_live_')) {
+                    throw new Error('runcloud login requires a Better Auth API key beginning with rc_live_.');
+                }
+                const apiUrl = isRunCloud
+                    ? opts.apiUrl ?? process.env.RUN_CLOUD_API_URL ?? 'https://api.newly.app'
+                    : opts.apiUrl;
                 try {
-                    new URL(opts.apiUrl);
+                    new URL(apiUrl);
                 }
                 catch {
-                    throw new Error(`--api-url is not a valid URL: ${opts.apiUrl}`);
+                    throw new Error(`--api-url is not a valid URL: ${apiUrl}`);
                 }
                 saveCredentials({
                     token: opts.token,
-                    apiUrl: opts.apiUrl,
+                    apiUrl,
                     appUrl: opts.appUrl,
-                    expiresAt: Math.floor(Date.now() / 1000) + opts.expiresIn,
+                    expiresAt: isRunCloud
+                        ? Number.MAX_SAFE_INTEGER
+                        : Math.floor(Date.now() / 1000) + opts.expiresIn,
                 });
-                console.log(`Logged in headlessly. Credentials written for API ${opts.apiUrl}.`);
+                console.log(`Logged in headlessly. Credentials written for API ${apiUrl}.`);
                 return;
             }
             if (opts.manual) {
+                if (isRunCloud) {
+                    const manualUrl = `${opts.appUrl.replace(/\/$/, '')}/cli-auth?manual=1`;
+                    console.log(`Opening your browser to authorize the CLI…\n  ${manualUrl}\n`);
+                    openBrowser(manualUrl);
+                }
                 const { createInterface } = await import('node:readline/promises');
                 const rl = createInterface({ input: process.stdin, output: process.stdout });
                 const blob = await rl.question('Paste the credential from the browser: ');
                 rl.close();
                 const parsed = parseManualCredential(blob);
+                if (isRunCloud && !parsed.token.startsWith('rc_live_')) {
+                    throw new Error('The browser did not return a Better Auth run.cloud API key.');
+                }
                 saveCredentials({
                     token: parsed.token,
                     apiUrl: parsed.apiUrl,
                     appUrl: opts.appUrl,
-                    expiresAt: Math.floor(Date.now() / 1000) + parsed.expiresIn,
+                    expiresAt: isRunCloud
+                        ? Number.MAX_SAFE_INTEGER
+                        : Math.floor(Date.now() / 1000) + parsed.expiresIn,
                 });
                 console.log('Logged in.');
                 return;
@@ -142,17 +187,22 @@ export function registerLogin(program) {
             const state = crypto.randomBytes(16).toString('hex');
             const appOrigin = new URL(opts.appUrl).origin;
             const { port, waitForToken, close } = await startCallbackServer(state, appOrigin, LOGIN_TIMEOUT_MS);
-            const loginUrl = `${opts.appUrl}/cli-auth?port=${port}&state=${state}`;
+            const loginUrl = cliAuthUrl(opts.appUrl, port, state);
             console.log(`Opening your browser to authorize the CLI…\n  ${loginUrl}\n`);
             console.log("If the browser doesn't open, paste the URL above into it manually.");
             openBrowser(loginUrl);
             try {
                 const payload = await waitForToken();
+                if (isRunCloud && !payload.token.startsWith('rc_live_')) {
+                    throw new Error('The browser did not return a Better Auth run.cloud API key.');
+                }
                 saveCredentials({
                     token: payload.token,
                     apiUrl: payload.apiUrl,
                     appUrl: opts.appUrl,
-                    expiresAt: Math.floor(Date.now() / 1000) + payload.expiresIn,
+                    expiresAt: isRunCloud
+                        ? Number.MAX_SAFE_INTEGER
+                        : Math.floor(Date.now() / 1000) + payload.expiresIn,
                 });
                 console.log(`Logged in. Credentials saved to ${credentialsDisplayPath()}`);
             }

package/dist/commands/sandbox.js

@@ -1,37 +1,8 @@
-import { friendlyApiError } from '../api.js';
-class CpClient {
-    baseUrl;
-    token;
-    constructor(baseUrl, token) {
-        this.baseUrl = baseUrl;
-        this.token = token;
-    }
-    async request(method, path, body) {
-        const res = await fetch(`${this.baseUrl}${path}`, {
-            method,
-            headers: { Authorization: `Bearer ${this.token}`, 'Content-Type': 'application/json' },
-            body: body !== undefined ? JSON.stringify(body) : undefined,
-        });
-        const text = await res.text();
-        if (!res.ok) {
-            let msg = text;
-            try {
-                msg = JSON.parse(text).error ?? text;
-            }
-            catch {
-            }
-            throw new Error(`control plane ${res.status}: ${msg}`);
-        }
-        return text ? JSON.parse(text) : null;
-    }
-}
-function cp(opts) {
-    const baseUrl = (opts.cpUrl || process.env.SBX_API_URL || 'http://127.0.0.1:8080').replace(/\/+$/, '');
-    const token = opts.cpToken || process.env.SBX_TOKEN;
-    if (!token) {
-        throw new Error('No control-plane token: set SBX_TOKEN or pass --cp-token.');
-    }
-    return new CpClient(baseUrl, token);
+import { ApiClient, friendlyApiError } from '../api.js';
+import { requireCredentials } from '../config.js';
+function runCloudApi() {
+    const credentials = requireCredentials();
+    return new ApiClient(credentials.apiUrl, credentials.token);
 }
 function print(value, opts) {
     if (opts.json) {
@@ -62,39 +33,39 @@ async function run(fn) {
         process.exitCode = 1;
     }
 }
-function withCp(cmd) {
-    return cmd
-        .option('--cp-url <url>', 'control-plane base URL (default $SBX_API_URL or http://127.0.0.1:8080)')
-        .option('--cp-token <token>', 'control-plane org token (or $SBX_TOKEN; required)')
-        .option('--json', 'output JSON', false);
+function withOutput(cmd) {
+    return cmd.option('--json', 'output JSON', false);
 }
 export function registerSandbox(program) {
     const sandbox = program.command('sandbox').description('Spawn and control microVM sandboxes');
-    withCp(sandbox
+    withOutput(sandbox
         .command('create')
         .description('Spawn a microVM sandbox')
         .option('--image <ref>', 'base image', 'newly/agent-base')
         .option('--size <class>', 'size preset', 's-2')
         .option('--region <region>', 'placement region')
-        .option('--name <name>', 'human-readable name')).action((opts) => run(async () => {
-        const body = { size_class: opts.size, image: opts.image };
+        .option('--name <name>', 'human-readable name')
+        .option('--org <id>', 'billing and ownership organization')).action((opts) => run(async () => {
+        const body = { size: opts.size, image: opts.image };
         if (opts.name)
             body.name = opts.name;
         if (opts.region)
             body.region = opts.region;
-        print(await cp(opts).request('POST', '/v1/sandboxes', body), opts);
+        if (opts.org)
+            body.orgId = opts.org;
+        print(await runCloudApi().post('/run-cloud/sandboxes', body), opts);
     }));
-    withCp(sandbox.command('list').description('List sandboxes').option('--state <state>', 'filter by state')).action((opts) => run(async () => {
+    withOutput(sandbox.command('list').description('List sandboxes').option('--state <state>', 'filter by state')).action((opts) => run(async () => {
         const qs = opts.state ? `?state=${encodeURIComponent(opts.state)}` : '';
-        const data = await cp(opts).request('GET', `/v1/sandboxes${qs}`);
+        const data = await runCloudApi().get(`/run-cloud/sandboxes${qs}`);
         print(data?.items ?? [], opts);
     }));
-    withCp(sandbox
+    withOutput(sandbox
         .command('exec')
         .description('Run a command in a sandbox (via /bin/sh -c)')
         .argument('<id>', 'sandbox id')
         .argument('<cmd...>', 'command to run, e.g. npm run build')).action((id, cmdParts, opts) => run(async () => {
-        const r = await cp(opts).request('POST', `/v1/sandboxes/${encodeURIComponent(id)}/exec`, {
+        const r = await runCloudApi().post(`/run-cloud/sandboxes/${encodeURIComponent(id)}/exec`, {
             cmd: ['/bin/sh', '-c', cmdParts.join(' ')],
         });
         if (opts.json) {
@@ -108,13 +79,13 @@ export function registerSandbox(program) {
         }
         process.exitCode = r.exit_code ?? 0;
     }));
-    withCp(sandbox
+    withOutput(sandbox
         .command('logs')
         .description('Show recent sandbox logs (one-shot journalctl tail; streaming is a follow-up)')
         .argument('<id>', 'sandbox id')
         .option('--lines <n>', 'number of lines to tail', '200')).action((id, opts) => run(async () => {
         const n = Number(opts.lines) || 200;
-        const r = await cp(opts).request('POST', `/v1/sandboxes/${encodeURIComponent(id)}/exec`, {
+        const r = await runCloudApi().post(`/run-cloud/sandboxes/${encodeURIComponent(id)}/exec`, {
             cmd: [
                 '/bin/sh',
                 '-c',
@@ -128,8 +99,8 @@ export function registerSandbox(program) {
         process.stdout.write(r.stdout ?? '');
         process.stderr.write(r.stderr ?? '');
     }));
-    withCp(sandbox.command('rm').description('Destroy a sandbox').argument('<id>', 'sandbox id')).action((id, opts) => run(async () => {
-        await cp(opts).request('DELETE', `/v1/sandboxes/${encodeURIComponent(id)}`);
+    withOutput(sandbox.command('rm').description('Destroy a sandbox').argument('<id>', 'sandbox id')).action((id, opts) => run(async () => {
+        await runCloudApi().delete(`/run-cloud/sandboxes/${encodeURIComponent(id)}`);
         if (!opts.json)
             console.log(`destroyed ${id}`);
     }));

package/dist/config.js

@@ -41,10 +41,10 @@ export function loadCredentials() {
     const envApiUrl = isRunCloud()
         ? process.env.RUN_CLOUD_API_URL
         : process.env.NEWLY_API_URL;
-    if (envToken?.trim() && envApiUrl?.trim()) {
+    if (envToken?.trim() && (isRunCloud() || envApiUrl?.trim())) {
         return {
             token: envToken.trim(),
-            apiUrl: normalizeApiUrl(envApiUrl.trim()),
+            apiUrl: normalizeApiUrl(envApiUrl?.trim() || 'https://api.newly.app'),
             appUrl: isRunCloud()
                 ? process.env.RUN_CLOUD_APP_URL ?? 'https://run.cloud'
                 : process.env.NEWLY_APP_URL ?? 'https://newly.app',
@@ -105,6 +105,10 @@ export function requireCredentials() {
     if (!creds) {
         throw new Error(`Not logged in (or session expired). Run: ${loginCommandName()}`);
     }
+    if (isRunCloud() && !creds.token.startsWith('rc_live_')) {
+        throw new Error('Legacy run.cloud credentials are no longer supported. Run `runcloud login` to sign in ' +
+            'with Better Auth.');
+    }
     return creds;
 }
 export function writeProjectLink(dir, link) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runcloud",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Create and control run.cloud remote mobile simulator sessions",
   "license": "UNLICENSED",
   "type": "module",