Skip to content

v0.3.10 — browser sign-in: `tinycloud login`

Choose a tag to compare

View all tags
@kdr kdr released this 12 Jul 20:37
· 19 commits to main since this release
v0.3.10
acd324c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

tinycloud 0.3.10 adds a Claude-Code / gh auth login-style first-run experience: sign in to Cloudglue with your browser, no copy-pasting API keys. The rest of the command surface is unchanged from 0.3.9, and paste-a-key setup is fully backward compatible — so existing agents and skills keep working as-is.

✨ New: browser sign-in

tinycloud login

Runs an OAuth-style device-authorization flow: the CLI prints a short code + verification URL and best-effort opens the Cloudglue dashboard. You approve the code, pick an account, and a normal cg- API key is minted and saved to ~/.tinycloud/config.json (0600) — exactly like a pasted key. You never see or handle the raw key (it never appears on stdout, in envelopes, or in logs — masked only).

  • New login verb (feature login.v1), present in commands --json. Cost class network, no auth required.
  • --no-browser prints the URL only (SSH/containers); --web-url / $CLOUDGLUE_WEB_URL targets a non-default dashboard; --label names the provisioned key (default: hostname).
  • Also wired into the interactive first-run chooser, /login, /setup, and /factory-reset, with a consistent ☁ Signed in as … confirmation.
  • needs_credentials envelopes now advertise setup.login_command (tinycloud login) alongside setup.command, so tools can surface the browser path.
  • Revoke anytime by deleting the key in the dashboard. Paste-a-key (tinycloud setup cloudglue --api-key <key>) and $CLOUDGLUE_API_KEY remain fully supported for headless/scripted setup.

🛡️ Hardening

  • Config is written owner-only (0600) through a single unified writer, and every config write re-reads from disk before merging so a concurrent writer during the minutes-long sign-in poll is never clobbered.
  • Write-before-success discipline throughout: the provisioned key is persisted before any success is shown, and a save failure yields a clear "run it again" message (with correct consumed-code vs. preferences-only guidance) rather than a stranded key or a crash.
  • A cancel (Ctrl-C / Esc) that races a completing sign-in never persists a credential after you cancel.

Install / upgrade

npm install -g @cloudglue/tinycloud@latest    # or: tinycloud update
# or
curl -fsSL https://app.cloudglue.dev/tinycloud.sh | bash

The launcher downloads and checksum-verifies the matching platform binary on first run (darwin-arm64/x64, linux-x64/arm64).

Assets 2
Loading