All four implementations had the wrong credential priority order: env vars
were checked before accounts.csv even when an explicit --account N index
was provided.
Correct priority order implemented in all four:
1. Explicit -p/-k flags (function arguments)
2. --account N => accounts.csv row N (bypasses env vars)
3. UNSANDBOX_PUBLIC_KEY / UNSANDBOX_SECRET_KEY env vars
4. ~/.unsandbox/accounts.csv row 0 (or UNSANDBOX_ACCOUNT env)
5. ./accounts.csv row 0
Changes per file:
- un.r: rewrote get_credentials() with correct priority, added account_index
param, added --account N to parse_args(), replaced get_api_keys() calls in
all cmd_* functions with get_credentials(account_index=args$account_index)
- un.raku: rewrote get-credentials() with correct priority, pre-parse
--account N in MAIN before dispatch, added Int :$account-index param to
all cmd-* functions and thread account-index through get-credentials calls
- un.jl: added load_accounts_csv() and get_credentials() functions with full
5-tier priority, added --account to all ArgParse subcommand tables, wired
account_index through all cmd function get_api_keys calls
- un.groovy: rewrote getCredentials() and getCredentialsStatic() with correct
priority (added loadAccountsFromCsv/loadCsvAccounts helpers), rewrote
getApiKeys() to delegate to getCredentials(), added accountIndex field to
Args class, added --account N to parseArgs(), wired accountIndex through
all cmdXxx function calls
Adds --resize ID --vcpu N flag to resize running services live.
PATCH /services/{id} with {"vcpu": 1-8} applies CPU/memory limits
without restart. Memory formula: 2GB per vCPU.
Implements encrypted vault for storing service environment variables:
- service env status <id> - Check vault status (GET /services/:id/env)
- service env set <id> -e KEY=VAL - Set vault contents (PUT /services/:id/env)
- service env export <id> - Export vault as .env format (POST /services/:id/env/export)
- service env delete <id> - Delete vault (DELETE /services/:id/env)
- Auto-vault on service creation with -e or --env-file flags
All implementations use HMAC-SHA256 authentication and text/plain content type
for vault PUT requests.
All 38+ implementations now support:
- session -f FILE: Upload files to /tmp/ in session container
- service -f FILE: Upload files to /tmp/ in service container
- service --bootstrap-file FILE: Read bootstrap script from file
When timestamp auth fails (401 with timestamp in error), show helpful message:
- Error: Request timestamp expired (must be within 5 minutes of server time)
- Your computer's clock may have drifted.
- NTP sync commands for Linux/macOS/Windows
Updated: un.awk, un.cpp, un.cr, un.d, un.dart, un.groovy, un.jl, un.kt, un.nim, un.ps1, un.rs, un.tcl, un.ts, un.v
- Update all un.* implementations to use HMAC-SHA256 signing
- Headers: Authorization (Bearer public_key), X-Timestamp, X-Signature
- Signature: HMAC-SHA256(secret_key, "timestamp:METHOD:path:body")
- Fix test suite issues (bash arithmetic, ES module compat, TCL shebang)
- Add CLAUDE.md with inception testing documentation
- Update README.md with HMAC auth and dependency table
- All 38 implementations pass inception test via un2
- Validate API keys via portal endpoint
- Show key status, tier, expiration with color-coded output
- Add --extend flag to open browser for key renewal
- Update .gitignore for compiled binaries
- Update README with key command documentation
Support service_type for SRV records (minecraft, mumble, teamspeak, source, tcp, udp).
Each implementation now parses --type and sends service_type in the JSON payload.
