runcloud 0.2.183 → 0.2.189

package/dist/commands/build.js

@@ -481,7 +481,7 @@ export function registerBuild(program) {
             }
             const { client } = makeClient();
             const projectId = opts.remoteSource
-                ? opts.project || readProjectLink(opts.sourcePath ?? '.')?.projectId
+                ? (opts.project ? resolveProject(process.cwd(), opts.project) : readProjectLink(opts.sourcePath ?? '.')?.projectId)
                 : resolveProject(process.cwd(), opts.project);
             if (platform === 'android') {
                 await runAndroidSimulatorBuild(client, projectId, opts);

package/dist/commands/dogfood.js

@@ -0,0 +1,435 @@
+import { execFile } from 'node:child_process';
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { createInterface } from 'node:readline';
+import { promisify } from 'node:util';
+import { ApiClient, friendlyApiError } from '../api.js';
+import { requireCredentials } from '../config.js';
+const execFileAsync = promisify(execFile);
+export const DOGFOOD_SECRET_GROUP = 'newly-dogfood';
+export const DOGFOOD_AGENT_ACCOUNT = 'newly-dogfood-agent@newly-v3-dev.iam.gserviceaccount.com';
+export const DEFAULT_DOGFOOD_MODEL = 'deepseek-v4-1-flash';
+export const CREDS_REFRESH_MS = 40 * 60 * 1000;
+function dogfoodStatePath() {
+    return join(process.env.NEWLY_HOME ?? join(homedir(), '.newly'), 'dogfood.json');
+}
+function readState() {
+    try {
+        return JSON.parse(readFileSync(dogfoodStatePath(), 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function writeState(state) {
+    const path = dogfoodStatePath();
+    mkdirSync(join(path, '..'), { recursive: true });
+    writeFileSync(path, JSON.stringify(state, null, 2) + '\n', { mode: 0o600 });
+}
+function dogfoodSessionPath() {
+    return join(process.env.NEWLY_HOME ?? join(homedir(), '.newly'), 'dogfood-session');
+}
+function readDogfoodSession() {
+    try {
+        return JSON.parse(readFileSync(dogfoodSessionPath(), 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function writeDogfoodSession(session) {
+    const path = dogfoodSessionPath();
+    mkdirSync(join(path, '..'), { recursive: true });
+    writeFileSync(path, JSON.stringify(session, null, 2) + '\n', { mode: 0o600 });
+    chmodSync(path, 0o600);
+}
+function dogfoodApiUrl() {
+    return (process.env.NEWLY_AUTH_API_URL ?? requireCredentials().apiUrl).replace(/\/$/, '');
+}
+function api() {
+    const apiUrl = dogfoodApiUrl();
+    const session = readDogfoodSession();
+    if (!session || session.apiUrl !== apiUrl) {
+        throw new Error(`not signed in to ${apiUrl} for dogfood: run \`newly dogfood login\` (scripts/dogfood.sh login)`);
+    }
+    return { client: new ApiClient(apiUrl, session.token), apiUrl };
+}
+const postJson = (fetchFn, url, body) => fetchFn(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) });
+export async function sendSignInCode(apiUrl, email, fetchFn = fetch) {
+    const sent = await postJson(fetchFn, `${apiUrl}/api/auth/email-otp/send-verification-otp`, { email, type: 'sign-in' });
+    if (!sent.ok)
+        throw new Error(`could not send a sign-in code to ${email} (HTTP ${sent.status})`);
+}
+export async function verifySignInCode(apiUrl, email, code, fetchFn = fetch) {
+    const otp = code.trim();
+    if (!otp)
+        throw new Error('no code entered');
+    const signedIn = await postJson(fetchFn, `${apiUrl}/api/auth/sign-in/email-otp`, { email, otp });
+    if (!signedIn.ok)
+        throw new Error(`sign-in refused (HTTP ${signedIn.status}); check the code and try again`);
+    const token = signedIn.headers.get('set-auth-token');
+    if (!token)
+        throw new Error('sign-in succeeded but no session token came back');
+    return token;
+}
+function ask(question) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolve) => rl.question(question, (answer) => { rl.close(); resolve(answer); }));
+}
+function projectIdFrom(explicit, apiUrl) {
+    if (explicit)
+        return explicit;
+    const state = readState();
+    if (state && state.apiUrl === apiUrl)
+        return state.projectId;
+    throw new Error('no dogfood project yet: run `newly dogfood setup` (or pass --project <id>)');
+}
+async function run(fn) {
+    try {
+        await fn();
+    }
+    catch (err) {
+        console.error(friendlyApiError(err));
+        process.exitCode = 1;
+    }
+}
+const defaultExec = (file, args, env) => execFileAsync(file, args, { env: env ?? process.env, maxBuffer: 64 * 1024 * 1024 });
+export async function mintDogfoodGcpToken(exec = defaultExec) {
+    try {
+        const { stdout } = await exec('gcloud', [
+            'auth',
+            'print-access-token',
+            `--impersonate-service-account=${DOGFOOD_AGENT_ACCOUNT}`,
+        ]);
+        const token = stdout.trim();
+        if (!token)
+            throw new Error('gcloud printed no token');
+        return token;
+    }
+    catch (err) {
+        throw new Error(`could not impersonate ${DOGFOOD_AGENT_ACCOUNT}: ${errorText(err)}\n` +
+            'You need roles/iam.serviceAccountTokenCreator on it (eng-debuggers@natively.dev members have it) ' +
+            'and a current `gcloud auth login`.');
+    }
+}
+export async function readGithubToken(opts, exec = defaultExec) {
+    if (opts.tokenFile) {
+        const token = readFileSync(opts.tokenFile, 'utf8').trim();
+        if (!token)
+            throw new Error(`${opts.tokenFile} is empty`);
+        return { token, source: 'file' };
+    }
+    const env = opts.env ?? process.env;
+    const fromEnv = (env.GH_TOKEN ?? env.GITHUB_TOKEN ?? '').trim();
+    if (fromEnv)
+        return { token: fromEnv, source: 'env' };
+    try {
+        const { stdout } = await exec('gh', ['auth', 'token']);
+        const token = stdout.trim();
+        if (token)
+            return { token, source: 'gh-cli' };
+    }
+    catch {
+    }
+    throw new Error('no GitHub token: pass --github-token-file <path> (a fine-grained token on newly-app/newly with ' +
+        'Contents and Pull requests read/write is recommended), set GH_TOKEN, or `gh auth login`.');
+}
+export async function verifySopsBoundary(repoRoot, gcpToken, exec = defaultExec) {
+    const env = { ...process.env, GOOGLE_OAUTH_ACCESS_TOKEN: gcpToken };
+    delete env.GOOGLE_CREDENTIALS;
+    delete env.GOOGLE_APPLICATION_CREDENTIALS;
+    const attempt = async (file) => {
+        try {
+            await exec('sops', ['decrypt', '--output', '/dev/null', join(repoRoot, file)], env);
+            return { ok: true, error: '' };
+        }
+        catch (err) {
+            return { ok: false, error: errorText(err) };
+        }
+    };
+    const dev = await attempt('secrets/dev.yaml');
+    const prod = await attempt('secrets/prod.yaml');
+    const detail = [
+        dev.ok ? 'secrets/dev.yaml: decrypts' : `secrets/dev.yaml: FAILED (${dev.error.split('\n')[0]})`,
+        prod.ok ? 'secrets/prod.yaml: DECRYPTS — this must not happen' : 'secrets/prod.yaml: refused',
+    ].join('\n');
+    return { dev: dev.ok, prodRefused: !prod.ok, detail };
+}
+function errorText(err) {
+    if (err && typeof err === 'object' && 'stderr' in err && typeof err.stderr === 'string' && err.stderr.trim()) {
+        return err.stderr.trim();
+    }
+    return err instanceof Error ? err.message : String(err);
+}
+async function projectOrgId(client, projectId) {
+    const project = await client.get(`/projects/${encodeURIComponent(projectId)}`);
+    const orgId = project?.org_id ?? project?.orgId ?? project?.project?.org_id ?? project?.project?.orgId;
+    if (typeof orgId !== 'string' || !orgId)
+        throw new Error(`could not read the org of project ${projectId}`);
+    return orgId;
+}
+export async function pushDogfoodCreds(client, projectId, entries) {
+    const orgId = await projectOrgId(client, projectId);
+    await client.put(`/orgs/${encodeURIComponent(orgId)}/secret-groups/${DOGFOOD_SECRET_GROUP}`, {
+        entries,
+        exposeToSandbox: true,
+        force: true,
+    });
+}
+async function credsOnce(opts) {
+    const { client, apiUrl } = api();
+    const projectId = projectIdFrom(opts.project, apiUrl);
+    const entries = {};
+    const github = await readGithubToken({ tokenFile: opts.githubTokenFile });
+    entries.GH_TOKEN = github.token;
+    if (github.source === 'gh-cli') {
+        console.log('GitHub: using your gh CLI token (all of its scopes). A fine-grained token is safer: --github-token-file.');
+    }
+    if (opts.gcp)
+        entries.GOOGLE_OAUTH_ACCESS_TOKEN = await mintDogfoodGcpToken();
+    await pushDogfoodCreds(client, projectId, entries);
+    console.log(`${new Date().toISOString()} credentials pushed to project ${projectId}: ${Object.keys(entries).join(', ')}` +
+        (opts.gcp ? ' (GCP token valid ~1h)' : ''));
+}
+export function dogfoodSessionBody(opts) {
+    const body = {
+        kind: 'interactive',
+        harness: 'claude-code',
+        dogfood: { baseRef: opts.baseRef },
+        agentModel: opts.model,
+    };
+    const prompt = opts.prompt.trim();
+    if (prompt)
+        body.initialPrompt = prompt;
+    return body;
+}
+export function renderEvent(raw) {
+    const type = raw.type ?? raw.event?.type;
+    const data = (raw.data ?? raw.event?.data ?? {});
+    switch (type) {
+        case 'text_delta':
+            return typeof data.delta === 'string' ? data.delta : null;
+        case 'user_message':
+            return typeof data.text === 'string' ? `\n\n› ${data.text}\n` : null;
+        case 'tool_call': {
+            const input = data.input ?? data.args;
+            const summary = input === undefined ? '' : JSON.stringify(input);
+            return `\n  ▸ ${String(data.name ?? 'tool')} ${summary.length > 160 ? `${summary.slice(0, 157)}...` : summary}\n`;
+        }
+        case 'tool_result':
+            return data.isError === true || data.ok === false ? `  ✗ ${String(data.output ?? 'tool failed').slice(0, 300)}\n` : null;
+        case 'ask_user':
+            return `\n? ${String(data.question ?? 'The agent has a question')}\n`;
+        case 'error':
+            return `\n! ${String(data.message ?? 'error')}\n`;
+        case 'turn_complete': {
+            const cost = typeof data.costUsd === 'number' ? ` · $${data.costUsd.toFixed(2)}` : '';
+            return `\n— turn complete${cost}\n`;
+        }
+        case 'session_started':
+            return '— session started\n';
+        case 'run_parked':
+            return '— session parked (send a message to wake it)\n';
+        default:
+            return null;
+    }
+}
+function eventsFrom(body) {
+    if (Array.isArray(body))
+        return body;
+    const events = body?.events;
+    return Array.isArray(events) ? events : [];
+}
+async function attach(client, sessionId, opts) {
+    let afterSeq = 0;
+    let stopped = false;
+    const rl = createInterface({ input: process.stdin });
+    rl.on('line', (line) => {
+        const text = line.trim();
+        if (!text)
+            return;
+        if (text === '/quit' || text === '/exit') {
+            stopped = true;
+            rl.close();
+            return;
+        }
+        if (text === '/cancel') {
+            void client.post(`/sessions/${sessionId}/cancel`, {}).catch((err) => console.error(friendlyApiError(err)));
+            return;
+        }
+        const body = { text };
+        if (opts.model)
+            body.agentModel = opts.model;
+        void client.post(`/sessions/${sessionId}/messages`, body).catch((err) => console.error(friendlyApiError(err)));
+    });
+    rl.on('close', () => {
+        stopped = true;
+    });
+    console.log(`attached to ${sessionId} — type a message and Enter to send; /cancel stops the turn; /quit detaches.`);
+    while (!stopped) {
+        try {
+            const body = await client.get(`/sessions/${sessionId}/events?after_seq=${afterSeq}&limit=500`);
+            for (const event of eventsFrom(body)) {
+                if (typeof event.seq === 'number')
+                    afterSeq = Math.max(afterSeq, event.seq);
+                const text = renderEvent(event);
+                if (text)
+                    process.stdout.write(text);
+            }
+        }
+        catch (err) {
+            console.error(friendlyApiError(err));
+        }
+        await new Promise((resolve) => setTimeout(resolve, 1000));
+    }
+}
+async function repoRoot() {
+    try {
+        const { stdout } = await defaultExec('git', ['rev-parse', '--show-toplevel']);
+        const root = stdout.trim();
+        return existsSync(join(root, 'secrets', 'dev.yaml')) ? root : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function registerDogfood(program) {
+    const dogfood = program
+        .command('dogfood')
+        .description('Newly agent sessions that work on the Newly monorepo itself (staff, feature-flagged)');
+    dogfood
+        .command('login')
+        .description('Sign in to the control plane for dogfood commands (email code; separate from `newly login`)')
+        .option('--email <email>', 'your staff email (default: the `newly login` account)')
+        .option('--code <code>', 'finish a sign-in with the emailed code (when no terminal can prompt)')
+        .action((opts) => run(async () => {
+        const apiUrl = dogfoodApiUrl();
+        let email = opts.email;
+        if (!email) {
+            try {
+                email = requireCredentials().account;
+            }
+            catch {
+            }
+        }
+        if (!email)
+            email = (await ask('Email: ')).trim();
+        if (!email)
+            throw new Error('an email is required');
+        let code = opts.code;
+        if (!code) {
+            await sendSignInCode(apiUrl, email);
+            console.log(`Sent a sign-in code to ${email} (${apiUrl}).`);
+            if (!process.stdin.isTTY) {
+                console.log('Finish with: scripts/dogfood.sh login --code <code from the email>');
+                return;
+            }
+            code = await ask('Code from the email: ');
+        }
+        const token = await verifySignInCode(apiUrl, email, code);
+        writeDogfoodSession({ apiUrl, token, account: email });
+        await new ApiClient(apiUrl, token).get('/projects');
+        console.log(`Signed in as ${email}. Next: \`newly dogfood setup\`.`);
+    }));
+    dogfood
+        .command('setup')
+        .description('Create or adopt your dogfood project and verify credentials end to end')
+        .option('--project <id>', 'adopt an existing project instead of creating one')
+        .option('--name <name>', 'name for a new project', 'Newly (dogfood)')
+        .option('--github-token-file <path>', 'GitHub token to give sessions (default: GH_TOKEN, then gh CLI)')
+        .action((opts) => run(async () => {
+        const { client, apiUrl } = api();
+        console.log(`control plane: ${apiUrl}`);
+        console.log('1/4 GCP: minting a dogfood-agent token by impersonation...');
+        const gcpToken = await mintDogfoodGcpToken();
+        console.log('    ok');
+        console.log('2/4 SOPS: dev must decrypt, prod must be refused...');
+        const root = await repoRoot();
+        if (root) {
+            const result = await verifySopsBoundary(root, gcpToken);
+            console.log(result.detail.replace(/^/gm, '    '));
+            if (!result.prodRefused)
+                throw new Error('the dogfood token can decrypt prod — stop and report this');
+            if (!result.dev)
+                throw new Error('the dogfood token cannot decrypt dev; see the error above');
+        }
+        else {
+            console.log('    skipped: run setup from a monorepo checkout to verify (needs secrets/*.yaml and sops >= 3.10)');
+        }
+        console.log('3/4 GitHub: reading a token...');
+        const github = await readGithubToken({ tokenFile: opts.githubTokenFile });
+        console.log(`    ok (${github.source})`);
+        console.log('4/4 Project...');
+        let projectId = opts.project ?? (readState()?.apiUrl === apiUrl ? readState()?.projectId : undefined);
+        if (!projectId) {
+            const listing = await client.get('/projects');
+            const orgId = listing?.defaultOrgId;
+            if (typeof orgId !== 'string' || !orgId)
+                throw new Error('could not find your workspace to create the project in');
+            const created = await client.post(`/orgs/${encodeURIComponent(orgId)}/projects`, { name: opts.name });
+            projectId = (created?.id ?? created?.projectId ?? created?.project?.id);
+            if (!projectId)
+                throw new Error('project created but no id came back');
+            console.log(`    created ${projectId}`);
+        }
+        else {
+            console.log(`    using ${projectId}`);
+        }
+        writeState({ projectId, apiUrl });
+        await pushDogfoodCreds(client, projectId, { GH_TOKEN: github.token, GOOGLE_OAUTH_ACCESS_TOKEN: gcpToken });
+        console.log('    credentials stored as the project\'s "newly-dogfood" secret group (dogfood sessions only)');
+        console.log('\nNext: `newly dogfood creds --watch` in a spare terminal (keeps the GCP token fresh),');
+        console.log('then `newly dogfood start "<what to do>"`.');
+    }));
+    dogfood
+        .command('creds')
+        .description('Mint fresh credentials and give them to your dogfood sessions')
+        .option('--project <id>', 'dogfood project (default: the one setup created)')
+        .option('--github-token-file <path>', 'GitHub token file (default: GH_TOKEN, then gh CLI)')
+        .option('--no-gcp', 'do not mint a GCP token (sessions then cannot use sops)')
+        .option('--watch', `keep refreshing every ${CREDS_REFRESH_MS / 60_000} minutes`, false)
+        .action((opts) => run(async () => {
+        await credsOnce(opts);
+        if (!opts.watch)
+            return;
+        for (;;) {
+            await new Promise((resolve) => setTimeout(resolve, CREDS_REFRESH_MS));
+            try {
+                await credsOnce(opts);
+            }
+            catch (err) {
+                console.error(`${new Date().toISOString()} refresh failed: ${friendlyApiError(err)}`);
+            }
+        }
+    }));
+    dogfood
+        .command('start')
+        .description('Start a dogfood session on the Newly monorepo')
+        .argument('[prompt...]', 'what the agent should do')
+        .option('--project <id>', 'dogfood project (default: the one setup created)')
+        .option('--model <id>', 'agent model', DEFAULT_DOGFOOD_MODEL)
+        .option('--base-ref <ref>', 'branch of newly-app/newly to start from', 'main')
+        .option('--no-attach', 'print the session id and exit')
+        .action((promptWords, opts) => run(async () => {
+        const { client, apiUrl } = api();
+        const projectId = projectIdFrom(opts.project, apiUrl);
+        const body = dogfoodSessionBody({ model: opts.model, baseRef: opts.baseRef, prompt: promptWords.join(' ') });
+        const created = await client.post(`/projects/${encodeURIComponent(projectId)}/sessions`, body);
+        const sessionId = (created?.id ?? created?.sessionId ?? created?.session?.id);
+        if (!sessionId)
+            throw new Error('session created but no id came back');
+        console.log(`session ${sessionId} (project ${projectId}, model ${opts.model})`);
+        if (opts.attach)
+            await attach(client, sessionId, { model: opts.model });
+    }));
+    dogfood
+        .command('attach')
+        .description('Follow a session in the terminal and send it messages')
+        .argument('<sessionId>', 'session id')
+        .option('--model <id>', 'agent model for the messages you send')
+        .action((sessionId, opts) => run(async () => {
+        const { client } = api();
+        await attach(client, sessionId, opts);
+    }));
+}

package/dist/commands/link.js

@@ -1,11 +1,12 @@
-import { readProjectLink, writeProjectLink } from '../config.js';
+import { readProjectLink, resolveProject, writeProjectLink } from '../config.js';
 export function registerLink(program) {
     program
         .command('link')
         .argument('<project-id>', 'Newly project id')
         .description('Associate the current directory with a project (no download) so deploy/status/logs work here')
-        .action((projectId) => {
+        .action((projectRef) => {
         const dir = process.cwd();
+        const projectId = resolveProject(dir, projectRef);
         const existing = readProjectLink(dir);
         writeProjectLink(dir, {
             projectId,

package/dist/commands/pull.js

@@ -29,7 +29,7 @@ export function registerPull(program) {
             const client = new ApiClient(creds.apiUrl, creds.token);
             const query = opts.branch ? `?branch=${encodeURIComponent(opts.branch)}` : '';
             console.log(`Downloading project ${projectId}${opts.branch ? ` (branch ${opts.branch})` : ''}…`);
-            const res = (await client.get(`/newly_backend/repo_archive/${projectId}${query}`));
+            const res = (await client.get(`/newly_backend/repo_archive/${encodeURIComponent(projectId)}${query}`));
             const data = Buffer.from(await res.arrayBuffer());
             if (opts.force) {
                 const keep = await snapshotTopLevelEntries(data);

package/dist/commands/run-cloud.js

@@ -1,4 +1,4 @@
-import { Option } from 'commander';
+import { InvalidArgumentError, Option } from 'commander';
 import { cpSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { basename, dirname, extname, join, resolve } from 'node:path';
 import { homedir } from 'node:os';
@@ -7,6 +7,22 @@ import { createHash, randomUUID } from 'node:crypto';
 import { ApiClient, ApiError, ApiTransportError, friendlyApiError } from '../api.js';
 import { requireCredentials } from '../config.js';
 import { recordSimulatorAudio } from './run-cloud-audio.js';
+export const IOS_SIMULATOR_CAPABILITIES = ['HealthKit', 'HomeKit', 'WidgetKit', 'SpeechSynthesis', 'Contacts', 'Calendars'];
+export const IOS_PLATFORM_VERSIONS = ['26.5'];
+export const IOS_DEVICE_NAMES = ['iPhone 17e'];
+export function runCloudIosOptions(opts) {
+    const capabilities = [...new Set(opts.capability ?? [])];
+    if (!capabilities.length && !opts.platformVersion && !opts.deviceName)
+        return {};
+    return {
+        platformName: 'iOS',
+        'runcloud:options': {
+            ...(capabilities.length ? { capabilities } : {}),
+            ...(opts.platformVersion ? { platformVersion: opts.platformVersion } : {}),
+            ...(opts.deviceName ? { deviceName: opts.deviceName } : {}),
+        },
+    };
+}
 export const SIMULATOR_KEYS = [
     'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm',
     'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z',
@@ -962,6 +978,7 @@ async function createSimulatorSession(platform, opts) {
         autoDelete: opts.rm,
         codec: requestedCodec(opts.codec),
         ...(opts.devHost ? { devHost: opts.devHost } : {}),
+        ...(platform === 'ios' ? runCloudIosOptions(opts) : {}),
     });
 }
 async function openSimulatorSessionUrl(platform, sessionId, url) {
@@ -1041,6 +1058,19 @@ function registerSimulatorCommands(program, platform) {
         .option('--rm', 'release the session when this command exits', false)
         .option('--json', 'output JSON', false)
         .addOption(new Option('--dev-host <host>', 'dev-only: target a specific simulator fleet host').hideHelp());
+    if (platform === 'ios') {
+        createCommand
+            .addOption(new Option('--capability <name>', 'iOS capability to turn on (repeatable); see run.cloud/docs/ios/capabilities')
+            .choices(IOS_SIMULATOR_CAPABILITIES)
+            .argParser((value, previous = []) => {
+            if (!IOS_SIMULATOR_CAPABILITIES.includes(value)) {
+                throw new InvalidArgumentError(`Allowed choices are ${IOS_SIMULATOR_CAPABILITIES.join(', ')}.`);
+            }
+            return [...previous, value];
+        }))
+            .addOption(new Option('--platform-version <version>', 'iOS runtime version').choices(IOS_PLATFORM_VERSIONS))
+            .addOption(new Option('--device-name <name>', 'simulator device type').choices(IOS_DEVICE_NAMES));
+    }
     simulator.command('audio')
         .description('Capture simulator speaker output as a WAV file')
         .argument('<id>', 'session id')

package/dist/config.js

@@ -31,6 +31,9 @@ export function credentialsDisplayPath() {
     return path.startsWith(home) ? `~${path.slice(home.length)}` : path;
 }
 export function loginCommandName() {
+    const override = process.env.NEWLY_LOGIN_COMMAND?.trim();
+    if (override)
+        return override;
     return isRunCloud() ? 'runcloud login' : 'newly login';
 }
 export function normalizeApiUrl(url) {
@@ -123,22 +126,33 @@ export function writeProjectLink(dir, link) {
     const gitignorePath = join(linkDir, '.gitignore');
     if (!existsSync(gitignorePath))
         writeFileSync(gitignorePath, '*\n');
-    writeFileSync(join(linkDir, 'project.json'), JSON.stringify(link, null, 2) + '\n');
+    const clean = { ...link, projectId: projectIdFrom(link.projectId) };
+    writeFileSync(join(linkDir, 'project.json'), JSON.stringify(clean, null, 2) + '\n');
 }
 export function readProjectLink(dir) {
     const path = join(dir, '.newly', 'project.json');
     if (!existsSync(path))
         return null;
     try {
-        return JSON.parse(readFileSync(path, 'utf8'));
+        const link = JSON.parse(readFileSync(path, 'utf8'));
+        return typeof link.projectId === 'string' ? { ...link, projectId: projectIdFrom(link.projectId) } : link;
     }
     catch {
         return null;
     }
 }
+export function projectIdFrom(ref) {
+    const parts = ref.trim().split(/[?#]/)[0].split('/').filter(Boolean);
+    const at = parts.indexOf('projects');
+    return (at >= 0 ? parts[at + 1] : parts.at(-1)) ?? '';
+}
 export function resolveProject(dir, explicit) {
-    if (explicit)
-        return explicit;
+    if (explicit) {
+        const id = projectIdFrom(explicit);
+        if (!id)
+            throw new Error(`Not a project id: ${explicit}`);
+        return id;
+    }
     const managedSessionProjectId = process.env['NEWLY_PROJECT_ID'];
     if (managedSessionProjectId)
         return managedSessionProjectId;

package/dist/index.js

@@ -24,6 +24,7 @@ import { registerEnvironment } from './commands/environment.js';
 import { registerAppStore } from './commands/appStore.js';
 import { registerUpdate } from './commands/update.js';
 import { registerToken } from './commands/token.js';
+import { registerDogfood } from './commands/dogfood.js';
 import { CLI_VERSION } from './version.js';
 const program = new Command('newly')
     .description('Develop, provision, and deploy Newly backends')
@@ -52,4 +53,5 @@ registerEnvironment(program);
 registerAppStore(program);
 registerUpdate(program);
 registerToken(program);
+registerDogfood(program);
 await program.parseAsync(process.argv);

package/dist/services-manifest.js

@@ -3,7 +3,7 @@ import { join } from 'node:path';
 export const DEFAULT_BACKEND_SERVICES = [
     { name: 'api', path: 'api-service', type: 'worker', schema: 'api', secrets: 'api', public: true },
 ];
-const SERVICE_NAME = /^[a-z][a-z0-9-]{0,31}$/;
+const SERVICE_NAME = /^(?!prod-)[a-z][a-z0-9-]{0,31}$/;
 export function readBackendServices(dir) {
     const manifestPath = join(dir, 'backend', 'newly.services.json');
     if (!existsSync(manifestPath))

package/dist/version.js

@@ -1 +1 @@
-export const CLI_VERSION = '0.2.183';
+export const CLI_VERSION = '0.2.189';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runcloud",
-  "version": "0.2.183",
+  "version": "0.2.189",
   "description": "Create and control run.cloud remote mobile simulators and cloud sandboxes",
   "license": "Apache-2.0",
   "keywords": [

package/skills/run-cloud-sandboxes/SKILL.md

@@ -364,6 +364,7 @@ warm-parked and resumable is the most expensive mistake available here.
 | `host-state-reconcile` | paused | the host had already parked it and the control plane caught up. The pause happened earlier than this event says |
 | `host-reconcile` `reap-sweep` | destroyed | the platform reclaimed it |
 | `boot-failure` `placement-timeout` `request-timeout` `scheduler` | never ran | capacity or image, not the workload |
+| `orphaned-placement` | never ran | the control plane restarted while placing it (stuck in pending/starting); create it again |
 | `image-built` `image-build-failure` | varies | an async image build finished or failed |
 | `startup-recover` `volume-lease-invalid` `replica-fork-resume-failure` | varies | platform recovery paths |