runcloud 0.1.8 → 0.1.9

package/dist/api.js

@@ -1,3 +1,4 @@
+import { loginCommandName } from './config.js';
 export class ApiError extends Error {
     status;
     detail;
@@ -165,7 +166,7 @@ function detailSuffix(err) {
 function headline(err) {
     if (err instanceof ApiError) {
         if (err.status === 401) {
-            const command = (process.argv[1] ?? '').includes('run-cloud') ? 'runcloud login' : 'newly login';
+            const command = loginCommandName();
             return `Session expired or invalid — run \`${command}\`.`;
         }
         if (err.status === 403)

package/dist/commands/environment.js

@@ -1,6 +1,6 @@
 import { createInterface } from 'node:readline/promises';
 import { ApiClient, friendlyApiError } from '../api.js';
-import { runEnvironmentDatabaseShell } from '../environmentShell.js';
+import { runEnvironmentDatabaseShell } from '../shellSession.js';
 import { clearEnvironmentSelection, readEnvironmentSelection, requireCredentials, requireEnvironmentSelection, resolveProject, writeEnvironmentSelection, } from '../config.js';
 const POLL_INTERVAL_MS = 2_000;
 const POLL_TIMEOUT_MS = 10 * 60 * 1_000;

package/dist/commands/login.js

@@ -1,9 +1,39 @@
 import http from 'node:http';
 import crypto from 'node:crypto';
+import { hostname } from 'node:os';
 import { spawn } from 'node:child_process';
 import { ApiClient, ApiError } from '../api.js';
 import { clearCredentials, credentialsDisplayPath, normalizeApiUrl, saveCredentials } from '../config.js';
+import { acquirePromptIO, ask, PromptAbortedError, select, } from '../prompt.js';
+import { AuthError, createApiKey, fetchProviders, isValidEmail, isValidOtp, normalizeOtp, sendEmailCode, verifyEmailCode, } from '../runCloudAuth.js';
 const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+export const DEFAULT_RUN_CLOUD_API_URL = 'https://api.run.cloud';
+export function loginChoices(providers) {
+    const choices = [];
+    if (providers.emailOtp) {
+        choices.push({ value: 'email', label: 'Email', hint: 'a code is sent to your inbox' });
+    }
+    if (providers.google) {
+        choices.push({ value: 'google', label: 'Google', hint: 'opens your browser' });
+    }
+    if (providers.github) {
+        choices.push({ value: 'github', label: 'GitHub', hint: 'opens your browser' });
+    }
+    return choices;
+}
+export function methodFromFlags(flags) {
+    const chosen = [];
+    if (flags.email)
+        chosen.push('email');
+    if (flags.google)
+        chosen.push('google');
+    if (flags.github)
+        chosen.push('github');
+    if (chosen.length > 1) {
+        throw new Error(`Pick one sign-in method: ${chosen.map((m) => `--${m}`).join(' and ')} conflict.`);
+    }
+    return chosen[0] ?? null;
+}
 export async function startCallbackServer(state, appOrigin, timeoutMs) {
     let resolvePayload;
     let rejectPayload;
@@ -95,12 +125,54 @@ function openBrowser(url) {
     });
     child.unref();
 }
-export function cliAuthUrl(appUrl, port, state) {
+export function cliAuthUrl(appUrl, port, state, provider) {
     const url = new URL('/cli-auth', appUrl);
     url.searchParams.set('port', String(port));
     url.searchParams.set('state', state);
+    if (provider)
+        url.searchParams.set('provider', provider);
     return url.toString();
 }
+export async function emailLogin(apiUrl, presetEmail, io) {
+    const email = presetEmail?.trim()
+        ? presetEmail.trim()
+        : await ask('  Email: ', {
+            io,
+            validate: (value) => (isValidEmail(value) ? null : 'That does not look like an email address.'),
+        });
+    if (!isValidEmail(email))
+        throw new Error(`Not a valid email address: ${email}`);
+    await sendEmailCode(apiUrl, email);
+    console.log(`  Code sent to ${email}\n`);
+    let session = null;
+    for (let attempt = 1; attempt <= 3 && !session; attempt += 1) {
+        const code = await ask('  Code: ', {
+            io,
+            validate: (value) => (isValidOtp(value) ? null : 'Codes are six digits.'),
+        });
+        try {
+            session = await verifyEmailCode(apiUrl, email, normalizeOtp(code));
+        }
+        catch (e) {
+            const wrongCode = e instanceof AuthError && (e.status === 400 || e.status === 401);
+            if (!wrongCode || attempt === 3)
+                throw e;
+            console.log(`  ${e.message} — try again.\n`);
+        }
+    }
+    if (!session)
+        throw new Error('Could not verify the code.');
+    const token = await createApiKey(apiUrl, session.sessionToken, `runcloud CLI (${hostLabel()})`);
+    return { email, token };
+}
+function hostLabel() {
+    try {
+        return hostname() || 'cli';
+    }
+    catch {
+        return 'cli';
+    }
+}
 export function parseManualCredential(blob) {
     let parsed;
     try {
@@ -136,12 +208,18 @@ export function registerLogin(program) {
         : process.env.NEWLY_APP_URL ?? 'https://newly.app';
     program
         .command('login')
-        .description(`Log in with your ${isRunCloud ? 'run.cloud' : 'Newly'} account via the browser`)
+        .description(isRunCloud
+        ? 'Log in with your run.cloud account: email, Google, or GitHub'
+        : 'Log in with your Newly account via the browser')
         .option('--app-url <url>', 'product web app URL', defaultAppUrl)
         .option('--manual', 'paste the credential from the browser instead of using the local callback', false)
         .option('--api-url <url>', 'explicit API URL (skips browser; use with --token)')
         .option('--token <token>', 'explicit credential token (skips browser; use with --api-url)')
         .option('--expires-in <seconds>', 'session lifetime when using --token (default 7 days)', (v) => Number(v), 604800)
+        .option('--email [address]', 'sign in with an emailed code, without a browser')
+        .option('--google', 'sign in with Google', false)
+        .option('--github', 'sign in with GitHub', false)
+        .option('--browser', 'skip the picker and use the browser handoff', false)
         .action(async (opts) => {
         try {
             const hasApiUrl = typeof opts.apiUrl === 'string' && opts.apiUrl.length > 0;
@@ -154,7 +232,7 @@ export function registerLogin(program) {
             }
             if (hasToken) {
                 const apiUrl = isRunCloud
-                    ? opts.apiUrl ?? process.env.RUN_CLOUD_API_URL ?? 'https://api.newly.app'
+                    ? opts.apiUrl ?? process.env.RUN_CLOUD_API_URL ?? 'https://api.run.cloud'
                     : opts.apiUrl;
                 try {
                     new URL(apiUrl);
@@ -195,10 +273,47 @@ export function registerLogin(program) {
                 console.log('Logged in.');
                 return;
             }
+            let socialProvider;
+            if (isRunCloud && !opts.browser) {
+                const authApiUrl = opts.apiUrl ?? process.env.RUN_CLOUD_API_URL ?? DEFAULT_RUN_CLOUD_API_URL;
+                let method = methodFromFlags(opts);
+                const terminal = method === 'email' || !method ? acquirePromptIO() : null;
+                try {
+                    if (!method && terminal) {
+                        const providers = await fetchProviders(authApiUrl);
+                        const choices = loginChoices(providers);
+                        if (choices.length === 0) {
+                            throw new Error(`${authApiUrl} has no sign-in methods enabled.`);
+                        }
+                        method = await select('  How do you want to sign in?', choices, terminal.io);
+                    }
+                    if (method === 'email') {
+                        const preset = typeof opts.email === 'string' ? opts.email : undefined;
+                        const { email, token } = await emailLogin(authApiUrl, preset, terminal?.io);
+                        saveCredentials({
+                            token,
+                            apiUrl: authApiUrl,
+                            appUrl: opts.appUrl,
+                            expiresAt: Number.MAX_SAFE_INTEGER,
+                        });
+                        console.log(`\n  Signed in as ${email}`);
+                        console.log(`  Credential saved to ${credentialsDisplayPath()}\n`);
+                        console.log('  Try:');
+                        console.log('    runcloud ios create --open');
+                        console.log('    runcloud sandbox run "echo hello"');
+                        return;
+                    }
+                }
+                finally {
+                    terminal?.close();
+                }
+                if (method === 'google' || method === 'github')
+                    socialProvider = method;
+            }
             const state = crypto.randomBytes(16).toString('hex');
             const appOrigin = new URL(opts.appUrl).origin;
             const { port, waitForToken, close } = await startCallbackServer(state, appOrigin, LOGIN_TIMEOUT_MS);
-            const loginUrl = cliAuthUrl(opts.appUrl, port, state);
+            const loginUrl = cliAuthUrl(opts.appUrl, port, state, socialProvider);
             console.log(`Opening your browser to authorize the CLI…\n  ${loginUrl}\n`);
             console.log("If the browser doesn't open, paste the URL above into it manually.");
             openBrowser(loginUrl);
@@ -219,6 +334,11 @@ export function registerLogin(program) {
             }
         }
         catch (e) {
+            if (e instanceof PromptAbortedError) {
+                console.log('Cancelled.');
+                process.exitCode = 130;
+                return;
+            }
             console.error(e instanceof Error ? e.message : String(e));
             process.exitCode = 1;
         }

package/dist/commands/run-cloud.js

@@ -18,7 +18,7 @@ Use this skill when a user asks an agent to create, inspect, smoke test, debug,
 
 ## Requirements
 
-- Read SDK credentials from \`RUN_CLOUD_API_KEY\`. Never print it, commit it, or write it into a skill file. The SDK uses \`RUN_CLOUD_API_URL\` when set and otherwise defaults to \`https://api.newly.app\`.
+- Read SDK credentials from \`RUN_CLOUD_API_KEY\`. Never print it, commit it, or write it into a skill file. The SDK uses \`RUN_CLOUD_API_URL\` when set and otherwise defaults to \`https://api.run.cloud\`.
 - Authenticate the CLI with either a saved \`runcloud login\` credential or \`RUN_CLOUD_API_KEY\` together with \`RUN_CLOUD_API_URL\`. Do not require both a saved login and an API key.
 - The TypeScript SDK requires Node.js 20 or newer.
 - The account must have run.cloud access, available capacity, and organization credit.
@@ -76,7 +76,7 @@ Or authenticate non-interactively with both required environment variables:
 
 \`\`\`bash
 export RUN_CLOUD_API_KEY="rc_live_..."
-export RUN_CLOUD_API_URL="https://api.newly.app"
+export RUN_CLOUD_API_URL="https://api.run.cloud"
 \`\`\`
 
 Then inspect the account:

package/dist/commands/sandbox.js

@@ -4,6 +4,7 @@ import { writeFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { ApiClient, friendlyApiError } from '../api.js';
 import { requireCredentials } from '../config.js';
+import { runSandboxShell } from '../shellSession.js';
 import { registerBoxAccessCommands } from './boxAccess.js';
 const MAX_SANDBOX_DISK_GIB = 2048;
 const DEFAULT_BOX_CPU_CORES = 2;
@@ -151,6 +152,18 @@ export function registerSandbox(program) {
         }
         process.exitCode = r.exit_code ?? 0;
     }));
+    sandbox
+        .command('shell')
+        .description('Open an interactive shell in a running sandbox')
+        .argument('<id>', 'sandbox id')
+        .action((id) => run(async () => {
+        const credentials = requireCredentials();
+        process.exitCode = await runSandboxShell({
+            apiUrl: credentials.apiUrl,
+            token: credentials.token,
+            sandboxId: id,
+        });
+    }));
     withOutput(sandbox
         .command('logs')
         .description('Show recent sandbox logs (one-shot journalctl tail; streaming is a follow-up)')

package/dist/config.js

@@ -1,17 +1,13 @@
 import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { basename, join } from 'node:path';
-function isRunCloud() {
-    const invoked = basename(process.argv[1] ?? '');
-    return invoked === 'runcloud' || invoked === 'run-cloud.js';
+export function isRunCloud() {
+    const names = [process.argv[1], process.execPath].map((path) => basename(path ?? ''));
+    return names.some((name) => name === 'runcloud' || name === 'run-cloud' || name === 'run-cloud.js');
 }
 function credentialsHome() {
-    if (process.env.RUN_CLOUD_HOME)
-        return process.env.RUN_CLOUD_HOME;
-    if (process.env.NEWLY_HOME)
-        return process.env.NEWLY_HOME;
     if (isRunCloud())
-        return join(homedir(), '.run-cloud');
+        return process.env.RUN_CLOUD_HOME ?? join(homedir(), '.run-cloud');
     return process.env.NEWLY_HOME ?? join(homedir(), '.newly');
 }
 function credentialsPath() {
@@ -22,7 +18,7 @@ export function credentialsDisplayPath() {
     const home = homedir();
     return path.startsWith(home) ? `~${path.slice(home.length)}` : path;
 }
-function loginCommandName() {
+export function loginCommandName() {
     return isRunCloud() ? 'runcloud login' : 'newly login';
 }
 export function normalizeApiUrl(url) {
@@ -44,7 +40,7 @@ export function loadCredentials() {
     if (envToken?.trim() && (isRunCloud() || envApiUrl?.trim())) {
         return {
             token: envToken.trim(),
-            apiUrl: normalizeApiUrl(envApiUrl?.trim() || 'https://api.newly.app'),
+            apiUrl: normalizeApiUrl(envApiUrl?.trim() || 'https://api.run.cloud'),
             appUrl: isRunCloud()
                 ? process.env.RUN_CLOUD_APP_URL ?? 'https://run.cloud'
                 : process.env.NEWLY_APP_URL ?? 'https://newly.app',

package/dist/prompt.js

@@ -0,0 +1,150 @@
+import { openSync, closeSync } from 'node:fs';
+import { emitKeypressEvents } from 'node:readline';
+import { ReadStream } from 'node:tty';
+function defaultIO() {
+    return { input: process.stdin, output: process.stdout };
+}
+export function openControllingTerminal() {
+    let fd;
+    try {
+        fd = openSync('/dev/tty', 'r+');
+    }
+    catch {
+        return null;
+    }
+    try {
+        const input = new ReadStream(fd);
+        if (!input.isTTY)
+            throw new Error('/dev/tty is not a terminal');
+        return {
+            io: { input, output: process.stdout },
+            close: () => {
+                try {
+                    input.destroy();
+                    closeSync(fd);
+                }
+                catch {
+                }
+            },
+        };
+    }
+    catch {
+        try {
+            closeSync(fd);
+        }
+        catch {
+        }
+        return null;
+    }
+}
+export function acquirePromptIO() {
+    const stdinIO = defaultIO();
+    if (isInteractive(stdinIO))
+        return { io: stdinIO, close: () => { } };
+    return openControllingTerminal();
+}
+export function isInteractive(io = defaultIO()) {
+    return Boolean(io.input.isTTY && typeof io.input.setRawMode === 'function');
+}
+export function canPrompt() {
+    if (isInteractive())
+        return true;
+    const terminal = openControllingTerminal();
+    if (!terminal)
+        return false;
+    terminal.close();
+    return true;
+}
+export class PromptAbortedError extends Error {
+    constructor() {
+        super('Cancelled.');
+        this.name = 'PromptAbortedError';
+    }
+}
+function render(io, question, choices, selected, first) {
+    if (!first)
+        io.output.write(`\x1b[${choices.length + 1}A\x1b[J`);
+    else
+        io.output.write(`\n${question}\n\n`);
+    if (!first)
+        io.output.write('\n');
+    const width = Math.max(...choices.map((choice) => choice.label.length));
+    for (const [index, choice] of choices.entries()) {
+        const active = index === selected;
+        const marker = active ? '❯' : ' ';
+        const label = active ? `\x1b[36m${choice.label}\x1b[0m` : choice.label;
+        const padding = ' '.repeat(width - choice.label.length + 4);
+        const hint = choice.hint ? `\x1b[90m${padding}${choice.hint}\x1b[0m` : '';
+        io.output.write(`  ${marker} ${label}${hint}\n`);
+    }
+}
+export async function select(question, choices, io = defaultIO()) {
+    if (choices.length === 0)
+        throw new Error('select() needs at least one choice');
+    if (choices.length === 1)
+        return choices[0].value;
+    return new Promise((resolve, reject) => {
+        let selected = 0;
+        let first = true;
+        emitKeypressEvents(io.input);
+        io.input.setRawMode?.(true);
+        io.input.resume();
+        render(io, question, choices, selected, first);
+        first = false;
+        const finish = (action) => {
+            io.input.setRawMode?.(false);
+            io.input.pause();
+            io.input.removeListener('keypress', onKeypress);
+            io.output.write('\n');
+            action();
+        };
+        function onKeypress(chunk, key) {
+            const name = key?.name ?? '';
+            if ((key?.ctrl && name === 'c') || name === 'escape') {
+                finish(() => reject(new PromptAbortedError()));
+                return;
+            }
+            if (name === 'return' || name === 'enter') {
+                finish(() => resolve(choices[selected].value));
+                return;
+            }
+            if (name === 'up' || name === 'k') {
+                selected = (selected - 1 + choices.length) % choices.length;
+            }
+            else if (name === 'down' || name === 'j' || name === 'tab') {
+                selected = (selected + 1) % choices.length;
+            }
+            else if (/^[1-9]$/.test(chunk ?? '')) {
+                const index = Number(chunk) - 1;
+                if (index < choices.length)
+                    selected = index;
+            }
+            else {
+                return;
+            }
+            render(io, question, choices, selected, first);
+        }
+        io.input.on('keypress', onKeypress);
+    });
+}
+export async function ask(question, options = {}) {
+    const { validate, attempts = 3, io = defaultIO() } = options;
+    const { createInterface } = await import('node:readline/promises');
+    const rl = createInterface({ input: io.input, output: io.output });
+    try {
+        for (let attempt = 1; attempt <= attempts; attempt += 1) {
+            const answer = (await rl.question(question)).trim();
+            const problem = validate?.(answer) ?? null;
+            if (!problem)
+                return answer;
+            io.output.write(`  ${problem}\n`);
+            if (attempt === attempts) {
+                throw new Error(`${problem} Giving up after ${attempts} attempts.`);
+            }
+        }
+        throw new Error('unreachable');
+    }
+    finally {
+        rl.close();
+    }
+}

package/dist/run-cloud.js

@@ -1,13 +1,12 @@
 #!/usr/bin/env node
-import { readFileSync } from 'node:fs';
 import { Command } from 'commander';
 import { registerLogin } from './commands/login.js';
 import { registerRunCloud } from './commands/run-cloud.js';
 import { registerSandbox } from './commands/sandbox.js';
-const { version } = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+import { CLI_VERSION } from './version.js';
 const program = new Command('runcloud')
     .description('Create and control remote mobile simulators and microVM sandboxes')
-    .version(version);
+    .version(CLI_VERSION);
 registerLogin(program);
 registerRunCloud(program);
 registerSandbox(program);

package/dist/runCloudAuth.js

@@ -0,0 +1,79 @@
+const SESSION_TOKEN_HEADER = 'set-auth-token';
+export class AuthError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = 'AuthError';
+    }
+}
+function apiBase(apiUrl) {
+    return apiUrl.replace(/\/+$/, '');
+}
+async function readError(response) {
+    const body = await response.text();
+    try {
+        const parsed = JSON.parse(body);
+        return parsed.error ?? parsed.message ?? body.slice(0, 200);
+    }
+    catch {
+        return body.slice(0, 200) || response.statusText;
+    }
+}
+async function post(apiUrl, path, body, token) {
+    const response = await fetch(`${apiBase(apiUrl)}${path}`, {
+        method: 'POST',
+        headers: {
+            'content-type': 'application/json',
+            ...(token ? { authorization: `Bearer ${token}` } : {}),
+        },
+        body: JSON.stringify(body),
+    });
+    if (!response.ok)
+        throw new AuthError(await readError(response), response.status);
+    const sessionToken = response.headers.get(SESSION_TOKEN_HEADER);
+    const text = await response.text();
+    const data = (text ? JSON.parse(text) : {});
+    return { data, sessionToken: sessionToken?.trim() || null };
+}
+export async function fetchProviders(apiUrl) {
+    const response = await fetch(`${apiBase(apiUrl)}/auth/web/providers`);
+    if (!response.ok)
+        throw new AuthError(await readError(response), response.status);
+    const payload = (await response.json());
+    return {
+        emailOtp: payload.emailOtp === true,
+        google: payload.google === true,
+        github: payload.github === true,
+        apple: payload.apple === true,
+    };
+}
+export async function sendEmailCode(apiUrl, email) {
+    await post(apiUrl, '/api/auth/email-otp/send-verification-otp', { email, type: 'sign-in' });
+}
+export async function verifyEmailCode(apiUrl, email, otp) {
+    const { data, sessionToken } = await post(apiUrl, '/api/auth/sign-in/email-otp', { email, otp, name: email.split('@')[0] || 'Run Cloud user' });
+    if (!sessionToken) {
+        throw new AuthError(`${apiUrl} accepted the code but did not return a session token.`, 502);
+    }
+    return {
+        user: { id: data.user?.id ?? '', email: data.user?.email ?? email },
+        sessionToken,
+    };
+}
+export async function createApiKey(apiUrl, sessionToken, name) {
+    const { data } = await post(apiUrl, '/run-cloud/api-keys', { name }, sessionToken);
+    const key = data.apiKey?.key;
+    if (!key)
+        throw new AuthError(`${apiUrl} did not return an API key.`, 502);
+    return key;
+}
+export function isValidEmail(value) {
+    return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value.trim());
+}
+export function normalizeOtp(value) {
+    return value.replace(/[\s-]/g, '');
+}
+export function isValidOtp(value) {
+    return /^\d{6}$/.test(normalizeOtp(value));
+}

package/dist/{environmentShell.js → shellSession.js}

@@ -1,9 +1,9 @@
 import WebSocket from 'ws';
-export async function runEnvironmentDatabaseShell(input) {
+export async function runShellSession(input) {
     const stdin = input.stdin ?? process.stdin;
     const stdout = input.stdout ?? process.stdout;
     const stderr = input.stderr ?? process.stderr;
-    const url = new URL(`/environment-databases/${encodeURIComponent(input.databaseId)}/shell`, input.apiUrl);
+    const url = new URL(input.path, input.apiUrl);
     url.protocol = url.protocol === 'https:' ? 'wss:' : 'ws:';
     const createWebSocket = input.createWebSocket ?? ((address, options) => new WebSocket(address, options));
     const socket = createWebSocket(url.toString(), {
@@ -60,7 +60,7 @@ export async function runEnvironmentDatabaseShell(input) {
         socket.once('close', (code, reason) => {
             restore();
             if (code >= 4400) {
-                reject(new Error(reason.toString() || `Database shell rejected (${code})`));
+                reject(new Error(reason.toString() || `${input.label} rejected (${code})`));
             }
             else {
                 resolve(exitCode);
@@ -68,3 +68,17 @@ export async function runEnvironmentDatabaseShell(input) {
         });
     });
 }
+export function runEnvironmentDatabaseShell(input) {
+    return runShellSession({
+        ...input,
+        path: `/environment-databases/${encodeURIComponent(input.databaseId)}/shell`,
+        label: 'Database shell',
+    });
+}
+export function runSandboxShell(input) {
+    return runShellSession({
+        ...input,
+        path: `/run-cloud/sandboxes/${encodeURIComponent(input.sandboxId)}/exec/stream`,
+        label: 'Sandbox shell',
+    });
+}

package/dist/version.js

@@ -0,0 +1 @@
+export const CLI_VERSION = '0.1.9';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runcloud",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "Create and control run.cloud remote mobile simulators and cloud sandboxes",
   "license": "UNLICENSED",
   "type": "module",