unoverse 0.1.34 → 0.1.36

package/lib/create.mjs

@@ -31,6 +31,17 @@ async function ask(rl, q) {
  * pre-encoded base64 `user:token` blob that docker config (and the starter's own
  * `docr` setting) uses. Wrapping the second shape in base64 AGAIN is how a valid
  * credential gets refused, so detect it and pass it through untouched. */
+/** The raw dop_v1 token, whichever shape was pasted. docker login needs the raw form,
+ * so the base64 user:token blob is decoded before anything downstream sees it. */
+function rawToken(token) {
+  if (/^[A-Za-z0-9+/]+=*$/.test(token) && !token.startsWith("dop_v1_")) {
+    const decoded = Buffer.from(token, "base64").toString("utf8");
+    const m = /^([\x20-\x7e]+):[\x20-\x7e]+$/.exec(decoded);
+    if (m) return m[1];
+  }
+  return token;
+}
+
 function registryAuth(token) {
   if (/^[A-Za-z0-9+/]+=*$/.test(token)) {
     const decoded = Buffer.from(token, "base64").toString("utf8");
@@ -93,6 +104,24 @@ function resolveTarget(nameArg) {
 /** Human name for the target, for messages that should not say "./.". */
 const label = (dir) => (dir === "." ? "this folder" : `./${dir}`);
 
+function dockerUp() {
+  return spawnSync("docker", ["info"], { stdio: "ignore" }).status === 0;
+}
+
+/** The ONLY honest validation is the operation itself. create used to probe the auth
+ * realm with its own HTTP call and say "token accepted", then docker login failed on
+ * the same credential two minutes later — the tool approving a token with a weaker
+ * check than the one that counts. When Docker is up, validation IS docker login (and
+ * the credential lands in the keychain, so nothing downstream logs in again). */
+function dockerLogin(token) {
+  const r = spawnSync("docker", ["login", REGISTRY_HOST, "-u", token, "--password-stdin"], {
+    input: token,
+    encoding: "utf8",
+  });
+  const err = (r.stderr || "").split("\n").filter((l) => l && !/^WARNING/i.test(l)).pop() || "";
+  return { ok: r.status === 0, err };
+}
+
 function download(dir, stripComponents = 1, filter = "") {
   mkdirSync(dir, { recursive: true });
   const r = spawnSync(
@@ -237,20 +266,32 @@ export async function create(nameArg) {
 
       console.log(`\n  ${cyan("A universe needs a registry access token.")}`);
       console.log(`  ${dim("It authorizes the platform's images. Your Unoverse admin issues it.")}\n`);
-      const token = await ask(rl, "Registry access token: ");
-      if (!token) {
-        fail("no token. The universe kit is available to licensed operators");
-        process.exit(1);
-      }
-      process.stdout.write("  validating against the registry...");
-      const valid = await validateRegistryToken(token);
-      console.log("");
-      if (!valid) {
-        fail("that token was refused by the registry");
-        console.log(`  ${dim("Check it with your Unoverse admin, then try again.")}`);
-        process.exit(1);
+      const useDocker = dockerUp();
+      let token;
+      // A refused token re-asks RIGHT HERE. Being thrown out of the wizard to run
+      // create again is its own bug.
+      for (;;) {
+        token = rawToken(await ask(rl, "Registry access token: "));
+        if (!token) {
+          fail("no token. The universe kit is available to licensed operators");
+          process.exit(1);
+        }
+        process.stdout.write("  validating against the registry...");
+        if (useDocker) {
+          const res = dockerLogin(token);
+          console.log("");
+          if (res.ok) { ok("token accepted"); break; }
+          fail("the registry refused it:");
+          console.log(`      ${dim(res.err)}`);
+          console.log(`  ${dim("Paste the registry token from your admin (dop_v1_…), or Ctrl-C to stop.")}\n`);
+        } else {
+          const valid = await validateRegistryToken(token);
+          console.log("");
+          if (valid) { ok("token accepted"); break; }
+          fail("that token was refused by the registry");
+          console.log(`  ${dim("Check it with your Unoverse admin, or Ctrl-C to stop.")}\n`);
+        }
       }
-      ok("token accepted");
 
       download(name);
       ok(`universe scaffolded in ${label(name)}`);
@@ -280,7 +321,7 @@ export async function create(nameArg) {
       const r = spawnSync("bash", [operatorScript, "init"], {
         stdio: "inherit",
         cwd: name,
-        env: { ...process.env, UNOVERSE_DOCR_TOKEN: token },
+        env: { ...process.env, UNOVERSE_DOCR_TOKEN: rawToken(token) },
       });
       if (r.status !== 0) {
         fail(`setup did not finish. Run 'unoverse start'${name === "." ? "" : ` in ./${name}`} to pick it back up`);

package/operator/lib/init.sh

@@ -160,13 +160,17 @@ cmd_init() {
 
   # THE DOWNLOAD STARTS NOW (see the block at the top of this file).
   if [ "$DOCKER_OK" = "1" ]; then
-    if echo "$DOCR_TOKEN" | docker login "$DOCR_REGISTRY" -u "$DOCR_TOKEN" --password-stdin >/dev/null 2>&1; then
+    local login_err
+    if login_err=$(echo "$DOCR_TOKEN" | docker login "$DOCR_REGISTRY" -u "$DOCR_TOKEN" --password-stdin 2>&1 >/dev/null); then
       start_background_pull
       echo ""
       echo -e "  ${CYAN}⬇${NC} ${DIM}Platform images are downloading in the background while you configure${NC}"
       echo ""
     else
-      warn "Registry login failed with this token. Images will not pull until it is fixed"
+      # The REASON, not just the fact: a swallowed docker error left "login failed"
+      # undiagnosable when create had just validated the same credential.
+      warn "Registry login failed. Images will not pull until it is fixed"
+      echo "$login_err" | grep -vi "warning" | head -3 | sed 's/^/      /'
     fi
   fi
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.34",
+  "version": "0.1.36",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",