Prepare for tinycloud 0.3.10: browser sign-in (tinycloud login) device-auth flow - #17
Merged
Conversation
…ice-auth flow Version parity + additive docs for the 0.3.10 binary, which adds a new `login` verb (feature `login.v1`) — an OAuth-style device-authorization browser sign-in that provisions and saves a normal Cloudglue API key exactly like a pasted key (raw key never printed). It's a real command present in `commands --json` (16 verbs now; cost class network, no auth), excluded only from the LLM agent's tool set because it blocks on an interactive flow. - Versions → 0.3.10: package.json, plugin.json, marketplace.json (×2), tinycloud-skill.json skill_version. - Floor KEPT at 0.3.7 (min_version + required_features unchanged): `login` is an onboarding/credentials convenience, not a video op — requiring it would hard-fail the whole skill on 0.3.7-0.3.9 for no video reason. Paste-key + $CLOUDGLUE_API_KEY remain the documented fallback. Preflight/skill.json stay in sync (23 features, >=0.3.7 <0.4.0). - Docs (additive, version-annotated): verbs.md (login row + section), setup.md and SKILL.md credentials paths, tinycloud-init step 2 (browser sign-in as the recommended connect method, user-run; stdin paste as the agent-drivable fallback), envelope.md + SKILL.md needs_credentials row (setup.login_command), glossary.md term, README Commands table + Setup, CLAUDE.md verb count/CDN. Verified against the real 0.3.10 dist tarball (version 0.3.10+1364424, feature login.v1 present, `login` in commands --json, command_spec_revision 3105fe90fed9): npm test 42/42, shellcheck, plugin validate, preflight/skill sync, and smoke-test.sh (EXPECTED_VERSION=0.3.10) all green.
amyxst
approved these changes
Jul 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Version parity + additive docs for the 0.3.10 binary (built from the private
source repo). 0.3.10 adds a new
loginverb — an OAuth-styledevice-authorization browser sign-in that provisions and saves a normal
Cloudglue
cg-API key exactly like a pasted key (the raw key never touchesstdout, envelopes, or logs). It's a real command present in
commands --json(16 verbs now; cost class
network,requires_auth: false, featurelogin.v1),excluded only from the LLM agent's tool set because it blocks on a ~10-minute
interactive flow.
Contract delta (0.3.9 → 0.3.10)
commands --json+login)features[]+login.v1)command_spec_revision8c3f3adafd663105fe90fed9loginemitskind: "login",data = {account, api_base_url, key_masked, config_path, replaced_existing}.needs_credentialsenvelopes now also carrysetup.login_command(tinycloud login) alongsidesetup.command.Changes
package.json,.claude-plugin/plugin.json,.claude-plugin/marketplace.json(×2),skills/tinycloud/tinycloud-skill.jsonskill_version.min_version+required_featuresunchanged, sopreflight ↔ skill.json stay in sync — 23 features,
>=0.3.7 <0.4.0).loginis an onboarding/credentials convenience, not a video operation — requiring it
would hard-fail the whole skill on 0.3.7–0.3.9 for no video-op reason. This is
the 0.3.8 pattern (additive, version-annotated, floor kept). Paste-key +
$CLOUDGLUE_API_KEYremain the documented fallback.verbs.md(login table row + section),setup.mdandthe main
SKILL.mdcredentials paths,tinycloud-initstep 2 (browsersign-in as the recommended connect method — user-run, since it's interactive;
stdin paste as the agent-drivable fallback),
envelope.md+SKILL.mdneeds_credentialsrow (setup.login_command),glossary.mdterm,READMECommands table + Setup,
CLAUDE.mdverb count/login/CDN prose.Verification (against the real 0.3.10 dist tarball)
Extracted
tinycloud-darwin-arm64.tar.gz→version 0.3.10+1364424,login.v1present,loginincommands --json,command_spec_revision 3105fe90fed9.npm test— 42/42 pass (offline unit + e2e + skills)shellcheck install.sh scripts/smoke-test.sh skills/tinycloud/scripts/preflight.sh— cleanclaude plugin validate .— passedTINYCLOUD_CMD=<extracted> EXPECTED_VERSION=0.3.10 bash scripts/smoke-test.sh— all passRelease sequencing (post-merge)
Per the runbook: CDN upload (8 tarballs + 4 sidecars + manifest,
channels.stable= 0.3.10) + broad invalidation +
generate-manifest --checkbefore merge →merge → tag
v0.3.10→publish-npm.yml(OIDC trusted publish, gates on thelive CDN check) → manual GitHub release
v0.3.10 --latest.Note
Low Risk
Documentation and version-metadata only; no launcher, installer, or preflight feature-gate changes—paste-key auth paths are unchanged.
Overview
Release 0.3.10 — version strings move to 0.3.10 in
package.json, Claude plugin metadata, andtinycloud-skill.jsonskill_version; maintainer examples inCLAUDE.mdfollow the same pin. Skill min_version stays 0.3.7 (no newrequired_featuresforlogin.v1).Documents the 0.3.10 binary contract: 16 verbs in
commands --json(addslogin/login.v1) — device-authorization browser sign-in that saves a maskedcg-API key like paste-key setup, withsetup.login_commandonneeds_credentialsenvelopes alongsidesetup.command.Onboarding docs now recommend
tinycloud loginfor humans (README,tinycloud-init,setup.md,verbs.md,glossary.md, mainSKILL.md,envelope.md) while keepingsetup cloudglue --stdin/$CLOUDGLUE_API_KEYfor agents and headless flows.Reviewed by Cursor Bugbot for commit 8d26112. Bugbot is set up for automated code reviews on this repo. Configure here.