runcloud 0.1.6 → 0.1.9

package/dist/commands/login.js

@@ -1,8 +1,39 @@
 import http from 'node:http';
 import crypto from 'node:crypto';
+import { hostname } from 'node:os';
 import { spawn } from 'node:child_process';
-import { clearCredentials, credentialsDisplayPath, saveCredentials } from '../config.js';
+import { ApiClient, ApiError } from '../api.js';
+import { clearCredentials, credentialsDisplayPath, normalizeApiUrl, saveCredentials } from '../config.js';
+import { acquirePromptIO, ask, PromptAbortedError, select, } from '../prompt.js';
+import { AuthError, createApiKey, fetchProviders, isValidEmail, isValidOtp, normalizeOtp, sendEmailCode, verifyEmailCode, } from '../runCloudAuth.js';
 const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+export const DEFAULT_RUN_CLOUD_API_URL = 'https://api.run.cloud';
+export function loginChoices(providers) {
+    const choices = [];
+    if (providers.emailOtp) {
+        choices.push({ value: 'email', label: 'Email', hint: 'a code is sent to your inbox' });
+    }
+    if (providers.google) {
+        choices.push({ value: 'google', label: 'Google', hint: 'opens your browser' });
+    }
+    if (providers.github) {
+        choices.push({ value: 'github', label: 'GitHub', hint: 'opens your browser' });
+    }
+    return choices;
+}
+export function methodFromFlags(flags) {
+    const chosen = [];
+    if (flags.email)
+        chosen.push('email');
+    if (flags.google)
+        chosen.push('google');
+    if (flags.github)
+        chosen.push('github');
+    if (chosen.length > 1) {
+        throw new Error(`Pick one sign-in method: ${chosen.map((m) => `--${m}`).join(' and ')} conflict.`);
+    }
+    return chosen[0] ?? null;
+}
 export async function startCallbackServer(state, appOrigin, timeoutMs) {
     let resolvePayload;
     let rejectPayload;
@@ -10,7 +41,10 @@ export async function startCallbackServer(state, appOrigin, timeoutMs) {
         resolvePayload = resolve;
         rejectPayload = reject;
     });
-    const timer = setTimeout(() => rejectPayload(new Error(`Login timed out after ${timeoutMs / 1000}s`)), timeoutMs);
+    const timer = setTimeout(() => rejectPayload(new Error(`Login timed out after ${timeoutMs / 1000}s.\n` +
+        "If the browser said the local handoff was blocked, Chrome gates HTTPS→localhost behind a permission: " +
+        'click the icon at the left of the address bar, allow "access to apps on this device", ' +
+        'then run login again (or use --manual).')), timeoutMs);
     const corsHeaders = {
         'Access-Control-Allow-Origin': appOrigin,
         'Access-Control-Allow-Methods': 'POST, OPTIONS',
@@ -91,12 +125,54 @@ function openBrowser(url) {
     });
     child.unref();
 }
-export function cliAuthUrl(appUrl, port, state) {
+export function cliAuthUrl(appUrl, port, state, provider) {
     const url = new URL('/cli-auth', appUrl);
     url.searchParams.set('port', String(port));
     url.searchParams.set('state', state);
+    if (provider)
+        url.searchParams.set('provider', provider);
     return url.toString();
 }
+export async function emailLogin(apiUrl, presetEmail, io) {
+    const email = presetEmail?.trim()
+        ? presetEmail.trim()
+        : await ask('  Email: ', {
+            io,
+            validate: (value) => (isValidEmail(value) ? null : 'That does not look like an email address.'),
+        });
+    if (!isValidEmail(email))
+        throw new Error(`Not a valid email address: ${email}`);
+    await sendEmailCode(apiUrl, email);
+    console.log(`  Code sent to ${email}\n`);
+    let session = null;
+    for (let attempt = 1; attempt <= 3 && !session; attempt += 1) {
+        const code = await ask('  Code: ', {
+            io,
+            validate: (value) => (isValidOtp(value) ? null : 'Codes are six digits.'),
+        });
+        try {
+            session = await verifyEmailCode(apiUrl, email, normalizeOtp(code));
+        }
+        catch (e) {
+            const wrongCode = e instanceof AuthError && (e.status === 400 || e.status === 401);
+            if (!wrongCode || attempt === 3)
+                throw e;
+            console.log(`  ${e.message} — try again.\n`);
+        }
+    }
+    if (!session)
+        throw new Error('Could not verify the code.');
+    const token = await createApiKey(apiUrl, session.sessionToken, `runcloud CLI (${hostLabel()})`);
+    return { email, token };
+}
+function hostLabel() {
+    try {
+        return hostname() || 'cli';
+    }
+    catch {
+        return 'cli';
+    }
+}
 export function parseManualCredential(blob) {
     let parsed;
     try {
@@ -112,6 +188,19 @@ export function parseManualCredential(blob) {
     }
     return { token: c.token, expiresIn: c.expiresIn, apiUrl: c.apiUrl };
 }
+export async function verifyRunCloudCredential(apiUrl, token) {
+    try {
+        await new ApiClient(normalizeApiUrl(apiUrl), token).get('/run-cloud/account');
+    }
+    catch (e) {
+        if (e instanceof ApiError && (e.status === 401 || e.status === 403)) {
+            throw new Error(`${apiUrl} rejected this credential (${e.status}). Make sure you signed in to the account ` +
+                'you want the CLI to use, then run login again.');
+        }
+        console.warn(`Warning: could not verify the credential against ${apiUrl} ` +
+            `(${e instanceof Error ? e.message : String(e)}). Saving it anyway.`);
+    }
+}
 export function registerLogin(program) {
     const isRunCloud = program.name() === 'runcloud';
     const defaultAppUrl = isRunCloud
@@ -119,12 +208,18 @@ export function registerLogin(program) {
         : process.env.NEWLY_APP_URL ?? 'https://newly.app';
     program
         .command('login')
-        .description(`Log in with your ${isRunCloud ? 'run.cloud' : 'Newly'} account via the browser`)
+        .description(isRunCloud
+        ? 'Log in with your run.cloud account: email, Google, or GitHub'
+        : 'Log in with your Newly account via the browser')
         .option('--app-url <url>', 'product web app URL', defaultAppUrl)
         .option('--manual', 'paste the credential from the browser instead of using the local callback', false)
         .option('--api-url <url>', 'explicit API URL (skips browser; use with --token)')
         .option('--token <token>', 'explicit credential token (skips browser; use with --api-url)')
         .option('--expires-in <seconds>', 'session lifetime when using --token (default 7 days)', (v) => Number(v), 604800)
+        .option('--email [address]', 'sign in with an emailed code, without a browser')
+        .option('--google', 'sign in with Google', false)
+        .option('--github', 'sign in with GitHub', false)
+        .option('--browser', 'skip the picker and use the browser handoff', false)
         .action(async (opts) => {
         try {
             const hasApiUrl = typeof opts.apiUrl === 'string' && opts.apiUrl.length > 0;
@@ -136,11 +231,8 @@ export function registerLogin(program) {
                 throw new Error('--api-url requires --token for headless login.');
             }
             if (hasToken) {
-                if (isRunCloud && !opts.token.startsWith('rc_live_')) {
-                    throw new Error('runcloud login requires a Better Auth API key beginning with rc_live_.');
-                }
                 const apiUrl = isRunCloud
-                    ? opts.apiUrl ?? process.env.RUN_CLOUD_API_URL ?? 'https://api.newly.app'
+                    ? opts.apiUrl ?? process.env.RUN_CLOUD_API_URL ?? 'https://api.run.cloud'
                     : opts.apiUrl;
                 try {
                     new URL(apiUrl);
@@ -170,39 +262,70 @@ export function registerLogin(program) {
                 const blob = await rl.question('Paste the credential from the browser: ');
                 rl.close();
                 const parsed = parseManualCredential(blob);
-                if (isRunCloud && !parsed.token.startsWith('rc_live_')) {
-                    throw new Error('The browser did not return a Better Auth run.cloud API key.');
-                }
+                if (isRunCloud)
+                    await verifyRunCloudCredential(parsed.apiUrl, parsed.token);
                 saveCredentials({
                     token: parsed.token,
                     apiUrl: parsed.apiUrl,
                     appUrl: opts.appUrl,
-                    expiresAt: isRunCloud
-                        ? Number.MAX_SAFE_INTEGER
-                        : Math.floor(Date.now() / 1000) + parsed.expiresIn,
+                    expiresAt: Math.floor(Date.now() / 1000) + parsed.expiresIn,
                 });
                 console.log('Logged in.');
                 return;
             }
+            let socialProvider;
+            if (isRunCloud && !opts.browser) {
+                const authApiUrl = opts.apiUrl ?? process.env.RUN_CLOUD_API_URL ?? DEFAULT_RUN_CLOUD_API_URL;
+                let method = methodFromFlags(opts);
+                const terminal = method === 'email' || !method ? acquirePromptIO() : null;
+                try {
+                    if (!method && terminal) {
+                        const providers = await fetchProviders(authApiUrl);
+                        const choices = loginChoices(providers);
+                        if (choices.length === 0) {
+                            throw new Error(`${authApiUrl} has no sign-in methods enabled.`);
+                        }
+                        method = await select('  How do you want to sign in?', choices, terminal.io);
+                    }
+                    if (method === 'email') {
+                        const preset = typeof opts.email === 'string' ? opts.email : undefined;
+                        const { email, token } = await emailLogin(authApiUrl, preset, terminal?.io);
+                        saveCredentials({
+                            token,
+                            apiUrl: authApiUrl,
+                            appUrl: opts.appUrl,
+                            expiresAt: Number.MAX_SAFE_INTEGER,
+                        });
+                        console.log(`\n  Signed in as ${email}`);
+                        console.log(`  Credential saved to ${credentialsDisplayPath()}\n`);
+                        console.log('  Try:');
+                        console.log('    runcloud ios create --open');
+                        console.log('    runcloud sandbox run "echo hello"');
+                        return;
+                    }
+                }
+                finally {
+                    terminal?.close();
+                }
+                if (method === 'google' || method === 'github')
+                    socialProvider = method;
+            }
             const state = crypto.randomBytes(16).toString('hex');
             const appOrigin = new URL(opts.appUrl).origin;
             const { port, waitForToken, close } = await startCallbackServer(state, appOrigin, LOGIN_TIMEOUT_MS);
-            const loginUrl = cliAuthUrl(opts.appUrl, port, state);
+            const loginUrl = cliAuthUrl(opts.appUrl, port, state, socialProvider);
             console.log(`Opening your browser to authorize the CLI…\n  ${loginUrl}\n`);
             console.log("If the browser doesn't open, paste the URL above into it manually.");
             openBrowser(loginUrl);
             try {
                 const payload = await waitForToken();
-                if (isRunCloud && !payload.token.startsWith('rc_live_')) {
-                    throw new Error('The browser did not return a Better Auth run.cloud API key.');
-                }
+                if (isRunCloud)
+                    await verifyRunCloudCredential(payload.apiUrl, payload.token);
                 saveCredentials({
                     token: payload.token,
                     apiUrl: payload.apiUrl,
                     appUrl: opts.appUrl,
-                    expiresAt: isRunCloud
-                        ? Number.MAX_SAFE_INTEGER
-                        : Math.floor(Date.now() / 1000) + payload.expiresIn,
+                    expiresAt: Math.floor(Date.now() / 1000) + payload.expiresIn,
                 });
                 console.log(`Logged in. Credentials saved to ${credentialsDisplayPath()}`);
             }
@@ -211,6 +334,11 @@ export function registerLogin(program) {
             }
         }
         catch (e) {
+            if (e instanceof PromptAbortedError) {
+                console.log('Cancelled.');
+                process.exitCode = 130;
+                return;
+            }
             console.error(e instanceof Error ? e.message : String(e));
             process.exitCode = 1;
         }

package/dist/commands/run-cloud.js

@@ -3,6 +3,7 @@ import { cpSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFil
 import { basename, dirname, join, resolve } from 'node:path';
 import { homedir } from 'node:os';
 import { fileURLToPath, pathToFileURL } from 'node:url';
+import { createHash } from 'node:crypto';
 import { ApiClient, friendlyApiError } from '../api.js';
 import { requireCredentials } from '../config.js';
 export const RUN_CLOUD_SKILL = `---
@@ -17,10 +18,10 @@ Use this skill when a user asks an agent to create, inspect, smoke test, debug,
 
 ## Requirements
 
-- Read SDK credentials from \`RUN_CLOUD_API_KEY\`. Never print it, commit it, or write it into a skill file. The SDK uses \`RUN_CLOUD_API_URL\` when set and otherwise defaults to \`https://api.newly.app\`.
+- Read SDK credentials from \`RUN_CLOUD_API_KEY\`. Never print it, commit it, or write it into a skill file. The SDK uses \`RUN_CLOUD_API_URL\` when set and otherwise defaults to \`https://api.run.cloud\`.
 - Authenticate the CLI with either a saved \`runcloud login\` credential or \`RUN_CLOUD_API_KEY\` together with \`RUN_CLOUD_API_URL\`. Do not require both a saved login and an API key.
 - The TypeScript SDK requires Node.js 20 or newer.
-- The account must have run.cloud access, available capacity, and a positive run.cloud balance.
+- The account must have run.cloud access, available capacity, and organization credit.
 - App artifacts must match the target platform. iOS sessions need simulator-compatible builds; Android sessions need Android-compatible artifacts such as APKs.
 
 ## TypeScript SDK
@@ -75,7 +76,7 @@ Or authenticate non-interactively with both required environment variables:
 
 \`\`\`bash
 export RUN_CLOUD_API_KEY="rc_live_..."
-export RUN_CLOUD_API_URL="https://api.newly.app"
+export RUN_CLOUD_API_URL="https://api.run.cloud"
 \`\`\`
 
 Then inspect the account:
@@ -95,6 +96,17 @@ runcloud ios delete "$SESSION_ID" --json
 
 Use the corresponding \`runcloud android\` commands with an Android artifact for Android emulator sessions.
 
+Download checksum-verified onboarding artifacts when no local build is
+available:
+
+\`\`\`bash
+runcloud sample download ios
+runcloud ios create --install ./run-cloud-sample-ios.app.tar.gz
+
+runcloud sample download android
+runcloud android create --install ./run-cloud-sample-android.apk
+\`\`\`
+
 ## Runnable SDK Example
 
 The maintained example checks account state, creates iOS and Android sessions, opens a URL on each, and releases both sessions:
@@ -113,7 +125,6 @@ Use \`--platform ios\` or \`--platform android\` for one platform. Use \`--json\
 These published demos exercise multi-simulator workflows:
 
 \`\`\`bash
-runcloud demo run parallel-simulators --open
 runcloud demo run eight-device-mosaic --open
 runcloud demo run live-camera-relay --open
 \`\`\`
@@ -219,10 +230,58 @@ function installSkill(opts) {
     return results;
 }
 const RUN_CLOUD_DEMOS = [
-    'parallel-simulators',
     'eight-device-mosaic',
     'live-camera-relay',
 ];
+export const RUN_CLOUD_SAMPLES = {
+    ios: {
+        filename: 'run-cloud-sample-ios.app.tar.gz',
+        url: 'https://run.cloud/downloads/run-cloud-sample-ios.app.tar.gz',
+        sha256: '09c437b1f299d41f79a8453611d99b8b1e4a3f5198dd871f4dad183362f944b3',
+        byteSize: 19_516,
+    },
+    android: {
+        filename: 'run-cloud-sample-android.apk',
+        url: 'https://run.cloud/downloads/run-cloud-sample-android.apk',
+        sha256: '892d4441a24757fc88852d29abe87d42d14f04921cbe89802e369dad6e46edba',
+        byteSize: 6_521_225,
+    },
+};
+function samplePlatform(value) {
+    if (value === 'ios' || value === 'android')
+        return value;
+    throw new Error(`Unknown sample platform: ${value}. Choose ios or android.`);
+}
+function shellQuote(value) {
+    return `'${value.replaceAll("'", "'\\''")}'`;
+}
+export async function downloadRunCloudSample(rawPlatform, opts = {}, fetchSample = fetch, samples = RUN_CLOUD_SAMPLES) {
+    const platform = samplePlatform(rawPlatform);
+    const sample = samples[platform];
+    const target = resolve(opts.output ?? sample.filename);
+    if (existsSync(target) && !opts.force) {
+        throw new Error(`${target} already exists. Pass --force to overwrite it.`);
+    }
+    const response = await fetchSample(sample.url);
+    if (!response.ok) {
+        throw new Error(`Could not download the ${platform} sample: HTTP ${response.status}`);
+    }
+    const body = Buffer.from(await response.arrayBuffer());
+    const sha256 = createHash('sha256').update(body).digest('hex');
+    if (body.byteLength !== sample.byteSize || sha256 !== sample.sha256) {
+        throw new Error(`The ${platform} sample failed its checksum verification.`);
+    }
+    mkdirSync(dirname(target), { recursive: true });
+    writeFileSync(target, body);
+    return {
+        platform,
+        path: target,
+        url: sample.url,
+        sha256,
+        byteSize: body.byteLength,
+        next: `runcloud ${platform} create --install ${shellQuote(target)}`,
+    };
+}
 function experimentalWebRtcEnabled() {
     return ['1', 'true', 'yes', 'on'].includes((process.env.RUN_CLOUD_EXPERIMENTAL_WEBRTC ?? '').trim().toLowerCase());
 }
@@ -247,7 +306,7 @@ function demoDirectory(name) {
         throw new Error(`The ${name} demo is missing from this runcloud package.`);
     return source;
 }
-export function initRunCloudDemo(name = 'parallel-simulators', directory, opts = {}) {
+export function initRunCloudDemo(name = 'eight-device-mosaic', directory, opts = {}) {
     const source = demoDirectory(name);
     const target = resolve(directory ?? `run-cloud-${name}`);
     if (existsSync(target)) {
@@ -258,13 +317,11 @@ export function initRunCloudDemo(name = 'parallel-simulators', directory, opts =
     cpSync(source, target, { recursive: true });
     return { example: name, path: target, status: 'created' };
 }
-export async function runCloudDemo(name = 'parallel-simulators', opts = {}, loadDemo = async (url) => (await import(url))) {
+export async function runCloudDemo(name = 'eight-device-mosaic', opts = {}, loadDemo = async (url) => (await import(url))) {
     if (name === 'eight-device-mosaic' && opts.duration) {
         throw new Error('The eight-device mosaic uses a fixed 10-minute lease and does not accept --duration.');
     }
     const args = [];
-    if (opts.count)
-        args.push('--count', opts.count);
     if (opts.duration)
         args.push('--duration', opts.duration);
     if (opts.open)
@@ -323,7 +380,7 @@ function registerSimulatorCommands(program, platform) {
         .option('--codec <auto|mjpeg|webrtc>', 'force the simulator viewer stream codec', 'auto')
         .option('--rm', 'release the session when this command exits', false)
         .option('--json', 'output JSON', false)
-        .addOption(new Option('--dev-host <host>', 'dev-only: target a specific serve-sim fleet host').hideHelp())
+        .addOption(new Option('--dev-host <host>', 'dev-only: target a specific simulator fleet host').hideHelp())
         .action((opts) => action(async () => {
         print(await createSimulatorSession(platform, opts), opts);
     }));
@@ -373,11 +430,25 @@ async function action(fn) {
     }
 }
 export function registerRunCloud(program) {
+    const sample = program
+        .command('sample')
+        .alias('samples')
+        .description('Download installable onboarding sample apps');
+    sample
+        .command('download')
+        .description('Download a checksum-verified iOS or Android sample app')
+        .argument('<ios|android>', 'sample platform')
+        .option('-o, --output <path>', 'output file')
+        .option('--force', 'overwrite an existing output file', false)
+        .option('--json', 'output JSON', false)
+        .action((platform, opts) => action(async () => {
+        print(await downloadRunCloudSample(platform, opts), opts);
+    }));
     const demo = program.command('demo').description('Create and run run.cloud demo projects');
     demo
         .command('init')
         .description('Scaffold a standalone demo project')
-        .argument('[name]', 'demo to create', 'parallel-simulators')
+        .argument('[name]', 'demo to create', 'eight-device-mosaic')
         .argument('[directory]', 'output directory')
         .option('--force', 'overwrite an existing output directory', false)
         .option('--json', 'output JSON', false)
@@ -387,16 +458,15 @@ export function registerRunCloud(program) {
     demo
         .command('run')
         .description('Run a bundled demo without scaffolding a project')
-        .argument('[name]', 'demo to run', 'parallel-simulators')
-        .option('--count <2|3>', 'number of sessions (parallel-simulators only)')
-        .option('--duration <seconds>', 'duration for parallel-simulators and live-camera-relay')
+        .argument('[name]', 'demo to run', 'eight-device-mosaic')
+        .option('--duration <seconds>', 'duration for live-camera-relay')
         .option('--open', 'open the demo viewer or live sessions in the browser', false)
         .action((name, opts) => action(async () => {
         await runCloudDemo(name, opts);
     }));
     program
         .command('account')
-        .description('Show run.cloud entitlement and metered balance')
+        .description('Show run.cloud account and organization access')
         .option('--json', 'output JSON', false)
         .action((opts) => action(async () => {
         print(await client().get('/run-cloud/account'), opts);