runcloud 0.2.188 → 0.2.190

package/dist/commands/dogfood.js

@@ -4,7 +4,7 @@ import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { createInterface } from 'node:readline';
 import { promisify } from 'node:util';
-import { ApiClient, friendlyApiError } from '../api.js';
+import { ApiClient, ApiError, friendlyApiError } from '../api.js';
 import { requireCredentials } from '../config.js';
 const execFileAsync = promisify(execFile);
 export const DOGFOOD_SECRET_GROUP = 'newly-dogfood';
@@ -171,26 +171,57 @@ async function projectOrgId(client, projectId) {
 }
 export async function pushDogfoodCreds(client, projectId, entries) {
     const orgId = await projectOrgId(client, projectId);
-    await client.put(`/orgs/${encodeURIComponent(orgId)}/secret-groups/${DOGFOOD_SECRET_GROUP}`, {
-        entries,
-        exposeToSandbox: true,
-        force: true,
-    });
+    const path = `/orgs/${encodeURIComponent(orgId)}/secret-groups/${DOGFOOD_SECRET_GROUP}`;
+    if (Object.keys(entries).length === 0) {
+        try {
+            await client.delete(path);
+        }
+        catch (err) {
+            if (!(err instanceof ApiError && err.status === 404))
+                throw err;
+        }
+        return;
+    }
+    await client.put(path, { entries, exposeToSandbox: true, force: true });
+}
+export async function fetchServerCredentials(client) {
+    try {
+        const status = await client.get('/dogfood');
+        const provided = status?.serverCredentials;
+        return { github: provided?.github === true, gcp: provided?.gcp === true };
+    }
+    catch (err) {
+        if (err instanceof ApiError && err.status === 404)
+            return { github: false, gcp: false };
+        throw err;
+    }
+}
+export function credentialsToSupply(server, opts) {
+    return { github: Boolean(opts.githubTokenFile) || !server.github, gcp: opts.gcp && !server.gcp };
 }
 async function credsOnce(opts) {
     const { client, apiUrl } = api();
     const projectId = projectIdFrom(opts.project, apiUrl);
+    const supply = credentialsToSupply(await fetchServerCredentials(client), opts);
+    if (!supply.github && !supply.gcp) {
+        await pushDogfoodCreds(client, projectId, {});
+        console.log(`${apiUrl} mints the sessions' GitHub and GCP tokens itself; cleared any stored ones.`);
+        return false;
+    }
     const entries = {};
-    const github = await readGithubToken({ tokenFile: opts.githubTokenFile });
-    entries.GH_TOKEN = github.token;
-    if (github.source === 'gh-cli') {
-        console.log('GitHub: using your gh CLI token (all of its scopes). A fine-grained token is safer: --github-token-file.');
+    if (supply.github) {
+        const github = await readGithubToken({ tokenFile: opts.githubTokenFile });
+        entries.GH_TOKEN = github.token;
+        if (github.source === 'gh-cli') {
+            console.log('GitHub: using your gh CLI token (all of its scopes). A fine-grained token is safer: --github-token-file.');
+        }
     }
-    if (opts.gcp)
+    if (supply.gcp)
         entries.GOOGLE_OAUTH_ACCESS_TOKEN = await mintDogfoodGcpToken();
     await pushDogfoodCreds(client, projectId, entries);
     console.log(`${new Date().toISOString()} credentials pushed to project ${projectId}: ${Object.keys(entries).join(', ')}` +
-        (opts.gcp ? ' (GCP token valid ~1h)' : ''));
+        (supply.gcp ? ' (GCP token valid ~1h)' : ''));
+    return supply.gcp;
 }
 export function dogfoodSessionBody(opts) {
     const body = {
@@ -341,25 +372,40 @@ export function registerDogfood(program) {
         .action((opts) => run(async () => {
         const { client, apiUrl } = api();
         console.log(`control plane: ${apiUrl}`);
-        console.log('1/4 GCP: minting a dogfood-agent token by impersonation...');
-        const gcpToken = await mintDogfoodGcpToken();
-        console.log('    ok');
-        console.log('2/4 SOPS: dev must decrypt, prod must be refused...');
-        const root = await repoRoot();
-        if (root) {
-            const result = await verifySopsBoundary(root, gcpToken);
-            console.log(result.detail.replace(/^/gm, '    '));
-            if (!result.prodRefused)
-                throw new Error('the dogfood token can decrypt prod — stop and report this');
-            if (!result.dev)
-                throw new Error('the dogfood token cannot decrypt dev; see the error above');
+        const supply = credentialsToSupply(await fetchServerCredentials(client), { githubTokenFile: opts.githubTokenFile, gcp: true });
+        const entries = {};
+        if (supply.gcp) {
+            console.log('1/4 GCP: minting a dogfood-agent token by impersonation...');
+            const gcpToken = await mintDogfoodGcpToken();
+            entries.GOOGLE_OAUTH_ACCESS_TOKEN = gcpToken;
+            console.log('    ok');
+            console.log('2/4 SOPS: dev must decrypt, prod must be refused...');
+            const root = await repoRoot();
+            if (root) {
+                const result = await verifySopsBoundary(root, gcpToken);
+                console.log(result.detail.replace(/^/gm, '    '));
+                if (!result.prodRefused)
+                    throw new Error('the dogfood token can decrypt prod — stop and report this');
+                if (!result.dev)
+                    throw new Error('the dogfood token cannot decrypt dev; see the error above');
+            }
+            else {
+                console.log('    skipped: run setup from a monorepo checkout to verify (needs secrets/*.yaml and sops >= 3.10)');
+            }
         }
         else {
-            console.log('    skipped: run setup from a monorepo checkout to verify (needs secrets/*.yaml and sops >= 3.10)');
+            console.log("1/4 GCP: the control plane mints the dogfood agent's token itself (dev sops key only)");
+            console.log("2/4 SOPS: nothing to prove from here; the agent account's IAM is the boundary");
+        }
+        if (supply.github) {
+            console.log('3/4 GitHub: reading a token...');
+            const github = await readGithubToken({ tokenFile: opts.githubTokenFile });
+            entries.GH_TOKEN = github.token;
+            console.log(`    ok (${github.source})`);
+        }
+        else {
+            console.log('3/4 GitHub: the control plane gives sessions a Newly GitHub App token (the dogfood repo only)');
         }
-        console.log('3/4 GitHub: reading a token...');
-        const github = await readGithubToken({ tokenFile: opts.githubTokenFile });
-        console.log(`    ok (${github.source})`);
         console.log('4/4 Project...');
         let projectId = opts.project ?? (readState()?.apiUrl === apiUrl ? readState()?.projectId : undefined);
         if (!projectId) {
@@ -377,10 +423,17 @@ export function registerDogfood(program) {
             console.log(`    using ${projectId}`);
         }
         writeState({ projectId, apiUrl });
-        await pushDogfoodCreds(client, projectId, { GH_TOKEN: github.token, GOOGLE_OAUTH_ACCESS_TOKEN: gcpToken });
-        console.log('    credentials stored as the project\'s "newly-dogfood" secret group (dogfood sessions only)');
-        console.log('\nNext: `newly dogfood creds --watch` in a spare terminal (keeps the GCP token fresh),');
-        console.log('then `newly dogfood start "<what to do>"`.');
+        await pushDogfoodCreds(client, projectId, entries);
+        console.log(Object.keys(entries).length > 0
+            ? '    credentials stored as the project\'s "newly-dogfood" secret group (dogfood sessions only)'
+            : '    no credentials stored: the control plane supplies them (any earlier ones were removed)');
+        if (supply.gcp) {
+            console.log('\nNext: `newly dogfood creds --watch` in a spare terminal (keeps the GCP token fresh),');
+            console.log('then `newly dogfood start "<what to do>"`.');
+        }
+        else {
+            console.log('\nNext: `newly dogfood start "<what to do>"`.');
+        }
     }));
     dogfood
         .command('creds')
@@ -390,8 +443,8 @@ export function registerDogfood(program) {
         .option('--no-gcp', 'do not mint a GCP token (sessions then cannot use sops)')
         .option('--watch', `keep refreshing every ${CREDS_REFRESH_MS / 60_000} minutes`, false)
         .action((opts) => run(async () => {
-        await credsOnce(opts);
-        if (!opts.watch)
+        const mintedGcp = await credsOnce(opts);
+        if (!opts.watch || !mintedGcp)
             return;
         for (;;) {
             await new Promise((resolve) => setTimeout(resolve, CREDS_REFRESH_MS));

package/dist/config.js

@@ -31,6 +31,9 @@ export function credentialsDisplayPath() {
     return path.startsWith(home) ? `~${path.slice(home.length)}` : path;
 }
 export function loginCommandName() {
+    const override = process.env.NEWLY_LOGIN_COMMAND?.trim();
+    if (override)
+        return override;
     return isRunCloud() ? 'runcloud login' : 'newly login';
 }
 export function normalizeApiUrl(url) {

package/dist/version.js

@@ -1 +1 @@
-export const CLI_VERSION = '0.2.188';
+export const CLI_VERSION = '0.2.190';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runcloud",
-  "version": "0.2.188",
+  "version": "0.2.190",
   "description": "Create and control run.cloud remote mobile simulators and cloud sandboxes",
   "license": "Apache-2.0",
   "keywords": [