uplink-cli 0.1.39 → 0.2.0

package/AGENTS.md

@@ -3,17 +3,20 @@
 For agents (Cursor, Claude Code, Codex, Windsurf, and similar) to use Uplink **non-interactively**.
 
 Install: `npm install -g uplink-cli` or `npx uplink-cli …`  
+Until **0.2.0** is on npm: `npm install -g github:firstprinciplecode/uplink#v0.2.0`  
 Package name: `uplink-cli` · Binary: `uplink`
 
 ## Auth
 
+- `uplink tunnel create` automatically creates guest access when no token exists. Guest access includes **1 active tunnel**, expiring after **24 hours**.
 - Use `AGENTCLOUD_TOKEN` (bearer). Prefer stdin over argv:
   ```bash
   echo "$TOKEN" | uplink --token-stdin …
   ```
+- Humans: `uplink login --email you@example.com` then `--code 123456`. This upgrades current guest access, preserves its tunnel, and unlocks persistent features. Credentials are saved to `~/.uplink/credentials` (chmod 600).
 - API base: `--api-base https://api.uplink.spot` or `AGENTCLOUD_API_BASE`.
 
-## Signup (no auth required)
+## Explicit guest token (optional)
 
 ```bash
 uplink signup --json
@@ -26,6 +29,8 @@ Save `token` from the JSON — it is shown only once. Then:
 export AGENTCLOUD_TOKEN='…'
 ```
 
+Explicit signup creates guest access. A later email login upgrades that guest account when the current token is available.
+
 ## Machine-mode contract
 
 | Rule | Detail |
@@ -37,8 +42,12 @@ export AGENTCLOUD_TOKEN='…'
 | Exit `20` | network |
 | Exit `30` | server / unknown |
 
+Guest accounts can share one local port and use public domain search. Hosting, databases, aliases, and custom domains require a verified email account. Gate error: `ACCOUNT_VERIFICATION_REQUIRED`.
+
 Premium aliases may return `ALIAS_NOT_ENABLED` / `ALIAS_LIMIT_REACHED`.
 
+Free hosting (new accounts): **1 app**, **100 MB** of live artifacts, **no custom domains**, app **sleeps after 30 minutes idle**. Errors: `HOST_APP_LIMIT_REACHED`, `HOST_STORAGE_LIMIT_REACHED`, `HOST_DOMAIN_NOT_ENABLED`. Check quota: the `hosting` object on `GET /v1/me`.
+
 ## Tunnels (share localhost)
 
 `tunnel create` **creates the API record and starts the local client** so the public URL works. Use `--api-only` only if you will start the client yourself.
@@ -110,6 +119,7 @@ The bare `uplink domains` search TUI is **optional** and not bundled with npm
 uplink domains providers connect godaddy --token-env GODADDY_PAT --json
 uplink domains providers connect cloudflare --token-env CF_API_TOKEN --json
 uplink domains providers connect hostinger --token-env HOSTINGER_API_TOKEN --json
+uplink domains providers connect dreamhost --token-env DREAMHOST_API_KEY --json
 uplink domains providers connect namecheap --token-env NAMECHEAP_API_KEY --user-env NAMECHEAP_API_USER --json
 uplink domains providers list --json
 uplink domains providers disconnect godaddy --json
@@ -123,7 +133,7 @@ echo "$TOKEN" | uplink --token-stdin host domains list --id app_xxx --json
 echo "$TOKEN" | uplink --token-stdin host domains remove --id app_xxx --hostname example.com --json
 ```
 
-Do not treat RDAP “available” as buyable unless `domains check` says `buyable: true`. Purchase is not wired yet.
+`domains check` works without a registrar: it falls back to public DNS/RDAP and returns `provider: "public"` with no price. Do not treat RDAP “available” as buyable unless `domains check` says `buyable: true`. Purchase is not wired yet.
 
 ## Databases (optional)
 
@@ -142,6 +152,10 @@ echo "$TOKEN" | uplink --token-stdin db delete --id db_xxx --yes --json
 | Auth errors | Missing/invalid `AGENTCLOUD_TOKEN`; use `--token-stdin` |
 | `ALIAS_NOT_ENABLED` | Account does not have permanent aliases |
 | Domain search TUI missing | Expected on npm — use `domains list` / `check` / `host domains *` |
+| `HOST_APP_LIMIT_REACHED` | Free plan is 1 hosted app — delete one or the account needs hosting granted |
+| `HOST_STORAGE_LIMIT_REACHED` | Upload exceeds the 100 MB free hosting budget |
+| `HOST_DOMAIN_NOT_ENABLED` | Custom domains are paid — `*.host.uplink.spot` still works |
+| First request after idle is slow | Free apps sleep after 30 minutes; the router wakes them |
 | Hosting stuck `queued` | Edge builder/runner issue — check `host status` / `host logs` |
 
 ## Interactive menu
@@ -157,5 +171,7 @@ Agents should prefer the non-interactive commands above.
 ## More
 
 - Menu map: `docs/MENU_STRUCTURE.md`
+- Hosting: `docs/HOSTING.md`
+- Product: `docs/PRODUCT.md`
 - Website: https://uplink.spot
-- npm: https://www.npmjs.com/package/uplink-cli
+- npm: https://www.npmjs.com/package/uplink-cli (0.2.0 pending; use the GitHub tag until then)

package/CHANGELOG.md

@@ -0,0 +1,15 @@
+# Changelog
+
+## 0.2.0 — 2026-08-28
+
+Tagged on GitHub. npm publish is pending org auth (`firstprinciplellc`). Until then install from the tag (see README).
+
+- **Guest access** — `tunnel create` and the interactive menu mint a guest token when none exists (1 active tunnel, 24-hour expiry). Stored in `~/.uplink/credentials`.
+- **Email login** — `uplink login --email` / `--code` upgrades that guest account, keeps the tunnel, and unlocks hosting, databases, and registrar inventory.
+- **Public domain check** — `uplink domains check` works with no registrar (DNS + RDAP). Connect a registrar for price.
+- **DreamHost** — inventory adapter; DNS-scoped keys and multiple `--token-env` names are supported.
+- **GoDaddy** — stop falling back to the v1 API on rate-limit / auth errors.
+
+## 0.1.39 — 2026-08-27
+
+Current version on npm. Agent-ready CLI: `--json`, `--token-stdin`, tunnels, hosting, domains.

package/README.md

@@ -14,23 +14,40 @@
 Learn more at [uplink.spot](https://uplink.spot)
 
 ## Install
+
+**npm (current published: 0.1.39)** — guest login and DreamHost land in **0.2.0**, tagged on GitHub, npm publish waiting on org auth.
+
 ```bash
+# Until 0.2.0 is on npm:
+npm install -g github:firstprinciplecode/uplink#v0.2.0
+
+# After publish:
 npm install -g uplink-cli
-# or
 npx uplink-cli --help
 ```
 
-## Authenticate (no browser)
+Changelog: [CHANGELOG.md](./CHANGELOG.md). Product overview: [docs/PRODUCT.md](./docs/PRODUCT.md). Hosting: [docs/HOSTING.md](./docs/HOSTING.md).
+
+## Start without signup
 ```bash
-uplink signup --json                     # creates account + token
-# or interactive: uplink (Get Started)
-export AGENTCLOUD_TOKEN=your-token-here  # save securely
+# Guest token is created and saved automatically
+uplink tunnel create --port 3000 --json
 ```
 
+Guest access includes one active tunnel for 24 hours and public domain search.
+
+## Unlock persistent features
+```bash
+uplink login --email you@example.com
+uplink login --email you@example.com --code 123456 --json
+```
+
+Email verification preserves the guest tunnel and unlocks hosting, databases, and registrar features. Aliases and custom domains still depend on the account plan.
+
 ## Quick start (agents)
 ```bash
-# Create tunnel + start local client (URL works immediately)
-echo "$AGENTCLOUD_TOKEN" | uplink --token-stdin tunnel create --port 3000 --json
+# Creates guest access automatically when needed
+uplink tunnel create --port 3000 --json
 
 # List / stop
 echo "$AGENTCLOUD_TOKEN" | uplink --token-stdin tunnel list --json
@@ -69,6 +86,7 @@ echo "$AGENTCLOUD_TOKEN" | uplink --token-stdin \
 
 ## Key commands
 - `uplink menu` — interactive UI
+- `uplink login --email <email> [--code <code>] [--json]`
 - `uplink signup --json`
 - `uplink tunnel create --port <p> [--alias <a>] [--json]` — starts client
 - `uplink tunnel list|stats|stop|alias-set|alias-delete --json`
@@ -86,13 +104,16 @@ export TUNNEL_DOMAIN=x.uplink.spot
 
 ## Troubleshooting
 - URL not live — ensure something is listening on the port and the client started (`tunnel list` → `connected`)
-- Auth errors — verify `AGENTCLOUD_TOKEN`; prefer `--token-stdin`
+- Auth errors — verify `AGENTCLOUD_TOKEN` or `~/.uplink/credentials`; prefer `--token-stdin` for agents
 - Relay errors — `TUNNEL_CTRL=tunnel.uplink.spot:7071`
 - Domain search TUI — not bundled on npm; use `domains list` / `check` / `host domains *`
 
 ## Docs
 - Agents: [AGENTS.md](./AGENTS.md)
+- Product: [docs/PRODUCT.md](./docs/PRODUCT.md)
+- Hosting: [docs/HOSTING.md](./docs/HOSTING.md)
 - Menu: [docs/MENU_STRUCTURE.md](./docs/MENU_STRUCTURE.md)
+- Changelog: [CHANGELOG.md](./CHANGELOG.md)
 
 ## License
 MIT — see [LICENSE](./LICENSE)

package/cli/src/index.ts

@@ -5,6 +5,7 @@ import { devCommand } from "./subcommands/dev";
 import { adminCommand } from "./subcommands/admin";
 import { menuCommand } from "./subcommands/menu";
 import { tunnelCommand } from "./subcommands/tunnel";
+import { loginCommand } from "./subcommands/login";
 import { signupCommand } from "./subcommands/signup";
 import { systemCommand } from "./subcommands/system";
 import { hostCommand } from "./subcommands/host";
@@ -12,6 +13,7 @@ import { domainsCommand } from "./subcommands/domains";
 import { readFileSync } from "fs";
 import { join } from "path";
 import { ensureApiBase, parseTokenEnv } from "./utils/api-base";
+import { readStoredCredentials } from "./utils/credentials";
 import { handleError } from "./utils/machine";
 
 // Get version from package.json (CommonJS build: __dirname available)
@@ -32,6 +34,7 @@ program.addCommand(devCommand);
 program.addCommand(adminCommand);
 program.addCommand(tunnelCommand);
 program.addCommand(signupCommand);
+program.addCommand(loginCommand);
 program.addCommand(systemCommand);
 program.addCommand(menuCommand);
 program.addCommand(hostCommand);
@@ -71,6 +74,14 @@ program.hook("preAction", async (thisCommand) => {
     if (!process.env.AGENTCLOUD_API_BASE && parsed.apiBase) {
       process.env.AGENTCLOUD_API_BASE = parsed.apiBase;
     }
+  } else {
+    const stored = readStoredCredentials();
+    if (stored?.token && !process.env.AGENTCLOUD_TOKEN) {
+      process.env.AGENTCLOUD_TOKEN = stored.token;
+      if (!process.env.AGENTCLOUD_API_BASE && stored.apiBase) {
+        process.env.AGENTCLOUD_API_BASE = stored.apiBase;
+      }
+    }
   }
 
   const isInteractive = Boolean(process.stdin.isTTY && process.stdout.isTTY && !opts.json);

package/cli/src/registrars/dreamhost.ts

@@ -0,0 +1,129 @@
+import type { InventoryDomain, RegistrarAdapter, RegistrarCredentials } from "./types";
+
+const BASE = "https://api.dreamhost.com/";
+const NO_ACCESS = "this_key_cannot_access_this_cmd";
+
+type DreamhostEnvelope = {
+  result?: string;
+  data?: unknown;
+  reason?: string;
+};
+
+function keysOf(creds: RegistrarCredentials): string[] {
+  const keys = [creds.apiKey || creds.token, ...(creds.extraTokens || [])];
+  return [...new Set(keys.filter((key): key is string => Boolean(key)))];
+}
+
+async function dreamhostCmd(key: string, cmd: string): Promise<unknown> {
+  const url = `${BASE}?key=${encodeURIComponent(key)}&cmd=${encodeURIComponent(cmd)}&format=json`;
+  const res = await fetch(url, { headers: { Accept: "application/json" } });
+  const text = await res.text();
+  let body: DreamhostEnvelope;
+  try {
+    body = text ? (JSON.parse(text) as DreamhostEnvelope) : {};
+  } catch {
+    throw new Error(`DreamHost returned a non-JSON response (HTTP ${res.status})`);
+  }
+  if (!res.ok || body.result !== "success") {
+    const detail = body.reason || (typeof body.data === "string" ? body.data : "") || `HTTP ${res.status}`;
+    throw new Error(`DreamHost ${cmd} failed: ${detail}`);
+  }
+  return body.data;
+}
+
+function rowsOf(data: unknown): Array<Record<string, unknown>> {
+  if (!Array.isArray(data)) return [];
+  return data.filter((row): row is Record<string, unknown> => Boolean(row) && typeof row === "object");
+}
+
+function domainOf(row: Record<string, unknown>): string | undefined {
+  const value = row.domain ?? row.name ?? row.domain_name;
+  return typeof value === "string" && value.includes(".") ? value.toLowerCase() : undefined;
+}
+
+function expiryOf(row: Record<string, unknown>): string | undefined {
+  const value = row.expires ?? row.expiry ?? row.expiration_date;
+  return typeof value === "string" && value ? value : undefined;
+}
+
+/**
+ * DreamHost API keys are scoped per command. Panel keys with domain access can
+ * list registrations; DNS-only keys can still reveal the account's domains via
+ * dns-list_records zones, so each lookup falls through that chain.
+ */
+async function listForKey(key: string): Promise<InventoryDomain[]> {
+  const out: InventoryDomain[] = [];
+  const seen = new Set<string>();
+  const push = (domain: string | undefined, expiresAt?: string) => {
+    if (!domain || seen.has(domain)) return;
+    seen.add(domain);
+    out.push({ domain, provider: "dreamhost", status: "owned", expiresAt });
+  };
+
+  let lastError: Error | null = null;
+  for (const cmd of ["domain-list_registrations", "domain-list_domains"]) {
+    try {
+      for (const row of rowsOf(await dreamhostCmd(key, cmd))) {
+        push(domainOf(row), expiryOf(row));
+      }
+      if (out.length > 0) return out;
+    } catch (error) {
+      lastError = error instanceof Error ? error : new Error(String(error));
+      if (!lastError.message.includes(NO_ACCESS)) throw lastError;
+    }
+  }
+
+  try {
+    for (const row of rowsOf(await dreamhostCmd(key, "dns-list_records"))) {
+      const zone = row.zone;
+      if (typeof zone === "string" && zone.includes(".")) push(zone.toLowerCase());
+    }
+    return out;
+  } catch (error) {
+    const err = error instanceof Error ? error : new Error(String(error));
+    throw lastError && err.message.includes(NO_ACCESS) ? lastError : err;
+  }
+}
+
+export const dreamhostAdapter: RegistrarAdapter = {
+  id: "dreamhost",
+  label: "DreamHost",
+  connectHelp:
+    "Panel API key(s); DNS-scoped keys work too. --token-env DREAMHOST_API_KEY (comma-separate env names for multiple accounts)",
+  async verify(creds) {
+    const keys = keysOf(creds);
+    if (keys.length === 0) throw new Error("DreamHost API key is missing");
+    for (const key of keys) {
+      await listForKey(key);
+    }
+    return creds;
+  },
+  async listDomains(creds) {
+    const out: InventoryDomain[] = [];
+    const seen = new Set<string>();
+    const errors: string[] = [];
+    for (const key of keysOf(creds)) {
+      try {
+        for (const item of await listForKey(key)) {
+          if (seen.has(item.domain)) continue;
+          seen.add(item.domain);
+          out.push(item);
+        }
+      } catch (error) {
+        errors.push(error instanceof Error ? error.message : String(error));
+      }
+    }
+    if (out.length === 0 && errors.length > 0) throw new Error(errors.join("; "));
+    return out.sort((a, b) => a.domain.localeCompare(b.domain));
+  },
+  async check(creds, domain) {
+    // DreamHost has no availability API; it can only confirm ownership.
+    // Throw for unowned domains so `domains check` falls through to a
+    // provider that can quote (or the public DNS/RDAP fallback).
+    const owned = await this.listDomains(creds);
+    if (owned.some((item) => item.domain === domain.toLowerCase())) {
+      return { domain, provider: "dreamhost", status: "owned", buyable: false };
+    }
+    throw new Error("DreamHost cannot check availability for domains outside the account");
+  },
+};

package/cli/src/registrars/godaddy.ts

@@ -80,6 +80,12 @@ export const godaddyAdapter: RegistrarAdapter = {
       return { domain, provider: "godaddy", status: "taken", buyable: false };
     }
 
+    // Fall back only when this API version is unavailable. Retrying a 401,
+    // 429, or 5xx against v1 wastes quota and can hide the real failure.
+    if (v3.status !== 404 && v3.status !== 405) {
+      throw httpError(v3, await v3.text());
+    }
+
     const v1 = await godaddyFetch(
       creds,
       `/v1/domains/available?domain=${encodeURIComponent(domain)}`

package/cli/src/registrars/index.ts

@@ -1,4 +1,5 @@
 import { cloudflareAdapter } from "./cloudflare";
+import { dreamhostAdapter } from "./dreamhost";
 import { godaddyAdapter } from "./godaddy";
 import { hostingerAdapter } from "./hostinger";
 import { namecheapAdapter } from "./namecheap";
@@ -10,6 +11,7 @@ export const adapters: RegistrarAdapter[] = [
   cloudflareAdapter,
   hostingerAdapter,
   namecheapAdapter,
+  dreamhostAdapter,
 ];
 
 const byId = new Map(adapters.map((adapter) => [adapter.id, adapter]));

package/cli/src/registrars/types.ts

@@ -1,4 +1,4 @@
-export const PROVIDER_IDS = ["godaddy", "cloudflare", "hostinger", "namecheap"] as const;
+export const PROVIDER_IDS = ["godaddy", "cloudflare", "hostinger", "namecheap", "dreamhost"] as const;
 export type ProviderId = (typeof PROVIDER_IDS)[number];
 
 export function isProviderId(value: string): value is ProviderId {
@@ -10,6 +10,8 @@ export type RegistrarCredentials = {
   apiUser?: string;
   apiKey?: string;
   accountId?: string;
+  /** Additional API keys for providers with multiple accounts (e.g. DreamHost). */
+  extraTokens?: string[];
 };
 
 export type InventoryDomain = {

package/cli/src/subcommands/domains.ts

@@ -14,8 +14,13 @@ import {
   type RegistrarCredentials,
 } from "../registrars";
 import { canPrompt, promptSecret, readEnvValue } from "../registrars/secret";
+import {
+  checkDomainAvailability,
+  formatPublicAvailability,
+} from "../utils/domain-availability";
 
-const CHECK_ORDER: ProviderId[] = ["godaddy", "cloudflare", "hostinger", "namecheap"];
+// DreamHost last: it can only confirm ownership, not quote availability.
+const CHECK_ORDER: ProviderId[] = ["godaddy", "cloudflare", "hostinger", "namecheap", "dreamhost"];
 
 function parseProvider(raw?: string): ProviderId | undefined {
   if (!raw) return undefined;
@@ -49,15 +54,22 @@ async function credentialsFromFlags(
     return { apiKey, apiUser };
   }
 
-  const token = opts.tokenEnv
-    ? readEnvValue(opts.tokenEnv)
+  // --token-env accepts a comma-separated list of env names for providers
+  // with multiple accounts (e.g. dreamhost).
+  const envNames = (opts.tokenEnv || "")
+    .split(",")
+    .map((name) => name.trim())
+    .filter(Boolean);
+  const tokens = envNames.length
+    ? envNames.map((name) => readEnvValue(name))
     : interactive
-      ? await promptSecret(`${provider} API token: `)
-      : "";
-  if (!token) {
+      ? [await promptSecret(`${provider} API token: `)].filter(Boolean)
+      : [];
+  if (tokens.length === 0 || !tokens[0]) {
     throw new Error(`${provider} needs --token-env <VAR> (do not pass the secret on the command line)`);
   }
-  const creds: RegistrarCredentials = { token };
+  const creds: RegistrarCredentials = { token: tokens[0] };
+  if (tokens.length > 1) creds.extraTokens = tokens.slice(1);
   if (opts.accountEnv) creds.accountId = readEnvValue(opts.accountEnv);
   return creds;
 }
@@ -88,12 +100,6 @@ async function listInventory(providerFilter?: ProviderId): Promise<InventoryDoma
 
 async function quoteDomain(domain: string, providerFilter?: ProviderId): Promise<DomainQuote> {
   const store = readRegistrarStore();
-  const inventory = await listInventory(providerFilter).catch(() => [] as InventoryDomain[]);
-  const owned = inventory.find((item) => item.domain === domain);
-  if (owned) {
-    return { domain, provider: owned.provider, status: "owned", buyable: false };
-  }
-
   const ids = providerFilter
     ? [providerFilter]
     : CHECK_ORDER.filter((id) => store[id]);
@@ -138,7 +144,7 @@ domainsCommand.action(() => {
 domainsCommand
   .command("list")
   .description("List domains owned at connected registrars")
-  .option("--provider <id>", "Only this provider (godaddy|cloudflare|hostinger|namecheap)")
+  .option("--provider <id>", "Only this provider (godaddy|cloudflare|hostinger|namecheap|dreamhost)")
   .option("--json", "Output JSON", false)
   .action(async (opts) => {
     try {
@@ -163,7 +169,7 @@ domainsCommand
 
 domainsCommand
   .command("check")
-  .description("Ask a connected registrar if a domain is buyable, and at what price")
+  .description("Check domain availability (public DNS/RDAP; connected registrars add price)")
   .argument("<domain>", "Domain name (e.g. example.com)")
   .option("--provider <id>", "Which registrar to ask")
   .option("--json", "Output JSON", false)
@@ -172,6 +178,27 @@ domainsCommand
       const domain = String(domainArg).trim().toLowerCase();
       if (!domain.includes(".")) throw new Error("Pass a full domain like example.com");
       const provider = parseProvider(opts.provider);
+
+      // No registrar connected: fall back to public DNS/RDAP availability.
+      const store = readRegistrarStore();
+      const hasRegistrar = provider ? Boolean(store[provider]) : CHECK_ORDER.some((id) => store[id]);
+      if (!hasRegistrar) {
+        const result = await checkDomainAvailability(domain);
+        if (opts.json) {
+          printJson({
+            domain: result.domain,
+            provider: "public",
+            status: result.status,
+            buyable: null,
+            detail: result.detail,
+            note: "Connect a registrar for price and purchase info.",
+          });
+          return;
+        }
+        console.log(formatPublicAvailability(result));
+        return;
+      }
+
       const quote = await quoteDomain(domain, provider);
       if (opts.json) {
         printJson(quote);
@@ -217,8 +244,8 @@ providers
 providers
   .command("connect")
   .description("Save a registrar credential after a live check")
-  .argument("<provider>", "godaddy | cloudflare | hostinger | namecheap")
-  .option("--token-env <name>", "Env var holding the API token or Namecheap API key")
+  .argument("<provider>", "godaddy | cloudflare | hostinger | namecheap | dreamhost")
+  .option("--token-env <name>", "Env var holding the API token (comma-separate names for multiple keys)")
   .option("--user-env <name>", "Env var holding the Namecheap API user")
   .option("--account-env <name>", "Env var holding a Cloudflare account id (optional)")
   .option("--json", "Output JSON", false)
@@ -226,7 +253,7 @@ providers
     try {
       const provider = String(providerArg).toLowerCase();
       if (!isProviderId(provider)) {
-        throw new Error(`Unknown provider: ${providerArg}. Use godaddy, cloudflare, hostinger, or namecheap`);
+        throw new Error(`Unknown provider: ${providerArg}. Use godaddy, cloudflare, hostinger, namecheap, or dreamhost`);
       }
       const adapter = getAdapter(provider);
       const creds = await credentialsFromFlags(provider, opts);
@@ -250,7 +277,7 @@ providers
 providers
   .command("disconnect")
   .description("Remove a saved registrar credential")
-  .argument("<provider>", "godaddy | cloudflare | hostinger | namecheap")
+  .argument("<provider>", "godaddy | cloudflare | hostinger | namecheap | dreamhost")
   .option("--json", "Output JSON", false)
   .action((providerArg: string, opts) => {
     try {

package/cli/src/subcommands/login.ts

@@ -0,0 +1,85 @@
+import { Command } from "commander";
+import { createInterface } from "readline";
+import { handleError, printJson } from "../utils/machine";
+import { formatTokenForEnv, getResolvedApiBase } from "../utils/api-base";
+import { isEmail, normalizeEmail, persistLogin, requestLoginCode, verifyLoginCode } from "../utils/login-flow";
+
+function prompt(question: string): Promise<string> {
+  return new Promise((resolve) => {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve(answer);
+    });
+  });
+}
+
+export const loginCommand = new Command("login")
+  .description("Continue with email to unlock persistent features")
+  .option("--email <email>", "Email to send the login code to")
+  .option("--code <code>", "6-digit code from email (completes login)")
+  .option("--no-save", "Do not write ~/.uplink/credentials")
+  .option("--json", "Output JSON", false)
+  .action(async (opts) => {
+    try {
+      const json = Boolean(opts.json);
+      let email = opts.email ? normalizeEmail(opts.email) : "";
+      if (!email) {
+        if (json) {
+          console.error("Provide --email. To finish login, also pass --code.");
+          process.exit(2);
+        }
+        email = normalizeEmail(await prompt("Email: "));
+      }
+      if (!isEmail(email)) {
+        console.error("Invalid email.");
+        process.exit(2);
+      }
+
+      const codeOpt = opts.code ? String(opts.code).trim() : "";
+
+      if (!codeOpt) {
+        await requestLoginCode(email);
+        if (json) {
+          printJson({ ok: true, email, message: "OTP sent. Run again with --email and --code." });
+          return;
+        }
+        console.log(`Code sent to ${email}.`);
+        opts.code = (await prompt("Code: ")).trim();
+      }
+
+      const code = String(opts.code || "").trim();
+      if (!/^\d{6}$/.test(code)) {
+        console.error("Code must be 6 digits.");
+        process.exit(2);
+      }
+
+      const result = await verifyLoginCode(email, code);
+      const apiBase = getResolvedApiBase();
+      const save = opts.save !== false;
+      let savedTo: string | null = null;
+      if (save) {
+        savedTo = persistLogin(result, email);
+      }
+
+      if (json) {
+        printJson({ ...result, email, savedTo });
+        return;
+      }
+
+      const tokenExport = formatTokenForEnv(result.token, apiBase);
+      console.log("Logged in.");
+      console.log("");
+      console.log(`  Email:    ${email}`);
+      console.log(`  User ID:  ${result.userId}`);
+      console.log(`  Token:    ${result.token}`);
+      if (savedTo) console.log(`  Saved:    ${savedTo}`);
+      console.log("");
+      if (!savedTo) {
+        console.log("To use this token:");
+        console.log(`  export AGENTCLOUD_TOKEN="${tokenExport}"`);
+      }
+    } catch (error) {
+      handleError(error, { json: opts.json });
+    }
+  });

package/cli/src/subcommands/menu/menus/domain-check.ts

@@ -0,0 +1,34 @@
+import { launchDomainking, resolveDomainkingEntry } from "../../../utils/launchDomainking";
+import { runCliCapture } from "./hosting";
+
+type Deps = {
+  promptLine: (question: string) => Promise<string>;
+  restoreRawMode: () => void;
+};
+
+/**
+ * Shared "find a domain" action: the Domainking search TUI when it is
+ * available, otherwise an inline prompt against `uplink domains check`
+ * (which works without a registrar via public DNS/RDAP).
+ */
+export function buildFindDomainAction(deps: Deps): () => Promise<string> {
+  return async () => {
+    if (resolveDomainkingEntry()) {
+      deps.restoreRawMode();
+      return launchDomainking();
+    }
+
+    const domain = (await deps.promptLine("Domain to check (e.g. example.com, or back): "))
+      .trim()
+      .toLowerCase();
+    deps.restoreRawMode();
+    if (!domain || domain === "back") return "";
+    if (!domain.includes(".")) return "Pass a full domain like example.com";
+
+    try {
+      return runCliCapture(["domains", "check", domain]) || `${domain}: no result.`;
+    } catch (error) {
+      return error instanceof Error ? error.message : String(error);
+    }
+  };
+}

package/cli/src/subcommands/menu/menus/domains.ts

@@ -1,6 +1,6 @@
 import type { SelectOption } from "../inline-tree-select";
 import type { MenuChoice } from "../types";
-import { launchDomainking } from "../../../utils/launchDomainking";
+import { buildFindDomainAction } from "./domain-check";
 import { parseHostedApps, runCli, runCliCapture } from "./hosting";
 
 type Deps = {
@@ -18,6 +18,7 @@ const PROVIDER_OPTIONS: SelectOption[] = [
   { label: "Cloudflare", value: "cloudflare" },
   { label: "Hostinger", value: "hostinger" },
   { label: "Namecheap", value: "namecheap" },
+  { label: "DreamHost", value: "dreamhost" },
 ];
 
 async function pickHostedApp(
@@ -114,10 +115,7 @@ export function buildDomainsMenu(deps: Deps): MenuChoice {
       },
       {
         label: "Find a domain",
-        action: async () => {
-          restoreRawMode();
-          return launchDomainking();
-        },
+        action: buildFindDomainAction(deps),
       },
       {
         label: "Attach to app",
@@ -180,7 +178,7 @@ export function buildDomainsMenu(deps: Deps): MenuChoice {
           return [
             "Uplink lists domains you already own at connected registrars, then attaches them to hosted apps.",
             "",
-            "  My domains  — inventory from GoDaddy / Cloudflare / Hostinger / Namecheap",
+            "  My domains  — inventory from GoDaddy / Cloudflare / Hostinger / Namecheap / DreamHost",
             "  Connect     — save a registrar token (same as the CLI)",
             "  Find        — search names that are not yours yet",
             "  Attach      — bind a hostname to a hosted app",