@alumbwe/anvil 1.0.41 → 1.0.49

package/bin/anvil.js

@@ -26,6 +26,24 @@ const PKG_ROOT = path.resolve(HERE, '..')
 const ENTRY = path.join(PKG_ROOT, 'src', 'entry.ts')
 const IS_WIN = process.platform === 'win32'
 const BUN_EXE = IS_WIN ? 'bun.exe' : 'bun'
+const COMPILED_BINARY = IS_WIN
+  ? path.join(HERE, 'anvil.exe')
+  : path.join(HERE, 'anvil')
+
+// Release installs include a compiled binary. Prefer it so the global npm
+// shim runs the same build as `cli/bin/anvil.exe` and does not require Bun.
+if (!process.versions.bun && fs.existsSync(COMPILED_BINARY)) {
+  const result = spawnSync(COMPILED_BINARY, process.argv.slice(2), {
+    stdio: 'inherit',
+    env: process.env,
+    windowsHide: true,
+  })
+  if (result.error) {
+    console.error(`Failed to start compiled Anvil (${COMPILED_BINARY}):`, result.error.message)
+    process.exit(1)
+  }
+  process.exit(result.status ?? (result.signal ? 1 : 0))
+}
 
 /** Check that a candidate command is a working bun executable. */
 function isBun(cmd) {

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@alumbwe/anvil",
-  "version": "1.0.41",
+  "version": "1.0.49",
   "private": false,
   "type": "module",
   "bin": {
-    "anvil": "./bin/anvil.js"
+    "anvil": "bin/anvil.js"
   },
   "files": [
     "bin/anvil.js",
@@ -13,10 +13,16 @@
     "vendor/",
     "tsconfig.json",
     "bunfig.toml",
-    "!src/__tests__/",
-    "!src/testing/",
-    "!src/smoke/",
-    "!src/dist-private/"
+    "!**/__tests__/**",
+    "!**/__mocks__/**",
+    "!**/__fixtures__/**",
+    "!**/*.test.*",
+    "!**/*.spec.*",
+    "!**/testing/**",
+    "!**/smoke/**",
+    "!src/dist-private/**",
+    "!**/*.map",
+    "!**/*.tsbuildinfo"
   ],
   "repository": {
     "type": "git",
@@ -63,6 +69,7 @@
     "node-machine-id": "^1.1.12",
     "open": "^10.1.0",
     "partial-json": "^0.1.7",
+    "picocolors": "^1.1.1",
     "pino": "9.4.0",
     "posthog-node": "^5.8.0",
     "react": "^19.0.0",

package/src/agents/bundled-agents.generated.ts

@@ -4,7 +4,7 @@
  * This file is generated by scripts/prebuild-agents.ts
  * It contains all bundled agent definitions from the agents/ directory.
  * 
- * Generated at: 2026-09-11T11:23:27.005Z
+ * Generated at: 2026-11-01T15:44:55.857Z
  * Agent count: 80
  */
 

package/src/entry.ts

@@ -1,5 +1,10 @@
 #!/usr/bin/env bun
 
+// MUST be first: applies production defaults for NEXT_PUBLIC_* before any
+// module in the import graph evaluates `@anvil/common/env`, which validates
+// the client env at import time and throws on machines without an env file.
+import './pre-init/client-env'
+
 import {
   isTerminalCommandBrokerInvocation,
   serveTerminalCommandBroker,

package/src/index.tsx

@@ -27,6 +27,8 @@ import { App } from './app'
 import { loadPackageVersion, parseArgs } from './cli-args'
 import { handlePublish } from './commands/publish'
 import { runPlainLogin } from './login/plain-login'
+import { ensureSignedIn } from './login/supabase-auth'
+import { isManagedGatewayMode } from '@anvil/common/constants/deepseek-direct'
 import { initializeApp } from './init/init-app'
 import { loadEnvLocal } from './setup/load-env'
 import { runKeySetup } from './setup/key-setup'
@@ -248,19 +250,40 @@ async function main(): Promise<void> {
     process.exit(0)
   }
 
-  // First-run: if required API keys are missing, launch the setup wizard.
-  // This runs BEFORE the TUI renderer so it can use plain console I/O.
-  if (!process.env.DEEPSEEK_API_KEY || !process.env.GEMINI_API_KEY) {
+  // First-run: required local API keys. In managed gateway mode the DeepSeek
+  // (model) key lives on the SERVER — the gateway injects it — so the CLI must
+  // Managed mode does not require local provider keys. In direct development
+  // mode both provider keys are required locally.
+  const gatewayMode = isManagedGatewayMode()
+  // Managed mode keeps both model keys in Supabase; an installed CLI only
+  // needs its stored Supabase access token. Local provider keys are required
+  // only for direct development mode.
+  if (!gatewayMode && (!process.env.DEEPSEEK_API_KEY || !process.env.GEMINI_API_KEY)) {
     const result = await runKeySetup(process.cwd())
     if (!result.allRequired) {
       console.error(
-        '\n  DeepSeek and Gemini API keys are required.\n' +
+        '\n  Required API keys are missing.\n' +
         '  Run with `setup` to reconfigure, or set them in .env.local manually.\n',
       )
       process.exit(1)
     }
   }
 
+  // Managed gateway mode: `anvil` recognizes whether you're signed in and, if
+  // not, launches the browser sign-in before starting. (Direct mode and the
+  // login/setup commands are handled above and need no gate here.)
+  if (gatewayMode && !isPublishCommand) {
+    try {
+      await ensureSignedIn()
+      setApiClientAuthToken(getAuthToken())
+    } catch {
+      console.error(
+        '\n  Sign-in required to use Anvil. Run `anvil login` and try again.\n',
+      )
+      process.exit(1)
+    }
+  }
+
   // Show project picker only when user starts at the home directory or an ancestor
   const projectRoot = getProjectRoot()
   const homeDir = os.homedir()

package/src/login/plain-login.ts

@@ -1,8 +1,14 @@
 import { AnalyticsEvent } from '@anvil/common/constants/analytics-events'
+import { isManagedGatewayMode } from '@anvil/common/constants/deepseek-direct'
 import { cyan, green, red, yellow, bold } from 'picocolors'
 
 import { LOGIN_WEBSITE_URL } from './constants'
 import { generateLoginUrl, pollLoginStatus } from './login-flow'
+import {
+  isSupabaseAuthConfigured,
+  loginViaBrowser,
+  signInWithPassword,
+} from './supabase-auth'
 import {
   flushAnalytics,
   identifyUser,
@@ -23,7 +29,61 @@ import type { User } from '../utils/auth'
  * This is the escape hatch for remote/SSH environments where the TUI's
  * clipboard and browser integration don't work.
  */
+/**
+ * Managed gateway mode: authenticate with Supabase (the cli-agent gateway
+ * verifies a Supabase JWT). Opens the browser to the hosted sign-in page and
+ * captures the session via a local loopback callback. Non-interactive when
+ * ANVIL_LOGIN_EMAIL + ANVIL_LOGIN_PASSWORD are set.
+ */
+export async function runSupabaseLogin(): Promise<void> {
+  console.log()
+  console.log(bold('Anvil Login'))
+  console.log()
+
+  const envEmail = process.env.ANVIL_LOGIN_EMAIL
+  const envPassword = process.env.ANVIL_LOGIN_PASSWORD
+
+  try {
+    let user
+    if (envEmail && envPassword) {
+      console.log(`Signing in as ${envEmail}...`)
+      user = await signInWithPassword(envEmail, envPassword)
+    } else {
+      console.log('Waiting for you to finish signing in in your browser…')
+      user = await loginViaBrowser()
+    }
+
+    if (user.id) {
+      identifyUser(user.id, { email: user.email, anvil: IS_ANVIL })
+      trackEvent(AnalyticsEvent.LOGIN, {
+        userId: user.id,
+        via: 'plain_command',
+        hasEmail: Boolean(user.email),
+        hasName: Boolean(user.name),
+      })
+      await flushAnalytics()
+    }
+
+    console.log()
+    console.log(green(`✓ Logged in as ${user.name} (${user.email})`))
+    console.log()
+    console.log('You can now run ' + cyan('anvil') + ' to start.')
+    process.exit(0)
+  } catch (error) {
+    console.error(
+      red(`Login failed: ${error instanceof Error ? error.message : String(error)}`),
+    )
+    process.exit(1)
+  }
+}
+
 export async function runPlainLogin(): Promise<void> {
+  // Managed gateway mode uses Supabase auth (the gateway verifies a Supabase
+  // JWT), not the Anvil device-code flow.
+  if (isManagedGatewayMode() && isSupabaseAuthConfigured()) {
+    return runSupabaseLogin()
+  }
+
   const fingerprintId = await getFingerprintId()
 
   console.log()

package/src/login/supabase-auth.ts

@@ -0,0 +1,346 @@
+/**
+ * supabase-auth.ts — CLI authentication for managed gateway mode.
+ *
+ * The cli-agent gateway authenticates each request with a Supabase JWT
+ * (`sb.auth.getUser(token)`). So in managed mode the CLI must hold a Supabase
+ * session, not an Anvil API key. This module talks to Supabase's GoTrue REST
+ * API directly (no extra dependency), stores the session in the normal
+ * credentials file as `authToken` (= access token) plus the refresh token and
+ * expiry, and refreshes the access token before it expires.
+ *
+ * Supported sign-in methods:
+ *   - email OTP: requestEmailOtp() → verifyEmailOtp()
+ *   - email + password: signInWithPassword()
+ */
+
+import http from 'node:http'
+
+import open from 'open'
+
+import { logger } from '../utils/logger'
+import { getUserCredentials, saveUserCredentials, type User } from '../utils/auth'
+
+/** GoTrue session as returned by /token and /verify. */
+interface SupabaseSession {
+  access_token: string
+  refresh_token: string
+  expires_at?: number
+  expires_in?: number
+  user?: {
+    id?: string
+    email?: string
+    user_metadata?: { name?: string; full_name?: string }
+  }
+}
+
+function supabaseUrl(): string | undefined {
+  const url = process.env.SUPABASE_URL ?? process.env.NEXT_PUBLIC_SUPABASE_URL
+  return url ? url.replace(/\/+$/, '') : undefined
+}
+
+/** The anon/publishable key — GoTrue requires it as the `apikey` header. */
+function supabaseAnonKey(): string | undefined {
+  return (
+    process.env.SUPABASE_PUBLISHABLE_KEY ??
+    process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY ??
+    process.env.SUPABASE_ANON_KEY ??
+    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY
+  )
+}
+
+/** True when Supabase auth can run (URL + anon key configured). */
+export function isSupabaseAuthConfigured(): boolean {
+  return Boolean(supabaseUrl() && supabaseAnonKey())
+}
+
+function authConfig(): { url: string; anonKey: string } {
+  const url = supabaseUrl()
+  const anonKey = supabaseAnonKey()
+  if (!url || !anonKey) {
+    throw new Error(
+      'Supabase is not configured. Set SUPABASE_URL and SUPABASE_PUBLISHABLE_KEY.',
+    )
+  }
+  return { url, anonKey }
+}
+
+async function gotrue(
+  path: string,
+  body: Record<string, unknown>,
+): Promise<SupabaseSession> {
+  const { url, anonKey } = authConfig()
+  const res = await fetch(`${url}/auth/v1${path}`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      apikey: anonKey,
+      Authorization: `Bearer ${anonKey}`,
+    },
+    body: JSON.stringify(body),
+  })
+  const text = await res.text()
+  let json: unknown
+  try {
+    json = text ? JSON.parse(text) : {}
+  } catch {
+    json = {}
+  }
+  if (!res.ok) {
+    const message =
+      (json as { error_description?: string; msg?: string; error?: string })
+        ?.error_description ??
+      (json as { msg?: string }).msg ??
+      (json as { error?: string }).error ??
+      `Supabase auth failed (${res.status})`
+    throw new Error(message)
+  }
+  return json as SupabaseSession
+}
+
+/** Normalize a session's expiry to epoch seconds. */
+function expiresAtOf(session: SupabaseSession): number {
+  if (typeof session.expires_at === 'number') return session.expires_at
+  const ttl = typeof session.expires_in === 'number' ? session.expires_in : 3600
+  return Math.floor(Date.now() / 1000) + ttl
+}
+
+/** Map a Supabase session to the credentials `User` shape and persist it. */
+export function saveSupabaseSession(session: SupabaseSession): User {
+  const meta = session.user?.user_metadata
+  const user: User = {
+    id: session.user?.id,
+    email: session.user?.email ?? '',
+    name: meta?.name ?? meta?.full_name ?? session.user?.email ?? 'Anvil user',
+    authToken: session.access_token,
+    refreshToken: session.refresh_token,
+    expiresAt: expiresAtOf(session),
+    provider: 'supabase',
+  }
+  saveUserCredentials(user)
+  return user
+}
+
+/** Send an email OTP (6-digit code / magic link) for sign-in or signup. */
+export async function requestEmailOtp(email: string): Promise<void> {
+  await gotrue('/otp', { email, create_user: true })
+}
+
+/** Verify an email OTP code and persist the resulting session. */
+export async function verifyEmailOtp(email: string, token: string): Promise<User> {
+  const session = await gotrue('/verify', { type: 'email', email, token })
+  return saveSupabaseSession(session)
+}
+
+/** Sign in with email + password and persist the resulting session. */
+export async function signInWithPassword(
+  email: string,
+  password: string,
+): Promise<User> {
+  const session = await gotrue('/token?grant_type=password', { email, password })
+  return saveSupabaseSession(session)
+}
+
+/** Exchange a refresh token for a new session and persist it. */
+async function refreshSupabaseSession(refreshToken: string): Promise<User> {
+  const session = await gotrue('/token?grant_type=refresh_token', {
+    refresh_token: refreshToken,
+  })
+  return saveSupabaseSession(session)
+}
+
+// ── Browser sign-in (loopback) ─────────────────────────────────────────────
+
+/** Hosted sign-in page that completes auth in the browser, then redirects the
+ *  session back to the CLI's loopback callback. Override with ANVIL_LOGIN_URL. */
+export function getLoginPageUrl(): string {
+  return (
+    process.env.ANVIL_LOGIN_URL ?? 'https://cli.tryanvil.dev/login'
+  ).replace(/\/+$/, '')
+}
+
+/** Decode a JWT payload (no verification — only for display id/email). */
+function decodeJwt(token: string): { sub?: string; email?: string } {
+  try {
+    const part = token.split('.')[1] ?? ''
+    const json = Buffer.from(
+      part.replace(/-/g, '+').replace(/_/g, '/'),
+      'base64',
+    ).toString('utf8')
+    return JSON.parse(json)
+  } catch {
+    return {}
+  }
+}
+
+/** Served on the loopback /callback: reads the URL fragment and posts the
+ *  tokens back to this same server (same-origin, so no mixed-content issues). */
+function callbackHtml(): string {
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>Anvil — signing in</title>
+<style>body{margin:0;height:100vh;display:grid;place-items:center;background:#0a0a0a;color:#f5f5f5;font:15px/1.5 -apple-system,BlinkMacSystemFont,"Segoe UI",system-ui,sans-serif}div{text-align:center}p{color:#a0a0a0}</style>
+</head><body><div><h2>Signing you in…</h2><p id="m">One moment.</p></div>
+<script>
+(function(){
+  var p = new URLSearchParams(location.hash.replace(/^#/,''));
+  var body = {access_token:p.get('access_token'),refresh_token:p.get('refresh_token'),expires_at:p.get('expires_at')};
+  if(!body.access_token){document.getElementById('m').textContent='No token found. Return to the terminal and run anvil login again.';return;}
+  fetch('/token',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(body)})
+    .then(function(){document.getElementById('m').textContent='You are signed in. You can close this tab and return to your terminal.';})
+    .catch(function(){document.getElementById('m').textContent='Could not reach the CLI. Is "anvil login" still running?';});
+})();
+</script></body></html>`
+}
+
+/**
+ * Open the browser to the hosted sign-in page and capture the session via a
+ * local loopback callback (the gh/vercel-style flow). Resolves once the
+ * browser posts back the Supabase session, which is then persisted.
+ */
+export async function loginViaBrowser(timeoutMs = 300_000): Promise<User> {
+  if (!isSupabaseAuthConfigured()) {
+    throw new Error(
+      'Supabase is not configured. Set SUPABASE_URL and SUPABASE_PUBLISHABLE_KEY.',
+    )
+  }
+
+  return new Promise<User>((resolve, reject) => {
+    let settled = false
+    const server = http.createServer((req, res) => {
+      const url = new URL(req.url ?? '/', 'http://127.0.0.1')
+      if (req.method === 'GET' && url.pathname === '/callback') {
+        res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' })
+        res.end(callbackHtml())
+        return
+      }
+      if (req.method === 'POST' && url.pathname === '/token') {
+        let data = ''
+        req.on('data', (c) => {
+          data += c
+          if (data.length > 1_000_000) req.destroy()
+        })
+        req.on('end', () => {
+          try {
+            const parsed = JSON.parse(data || '{}') as {
+              access_token?: string
+              refresh_token?: string
+              expires_at?: string
+            }
+            if (!parsed.access_token) {
+              res.writeHead(400)
+              res.end('{"error":"no token"}')
+              return
+            }
+            const claims = decodeJwt(parsed.access_token)
+            const user = saveSupabaseSession({
+              access_token: parsed.access_token,
+              refresh_token: parsed.refresh_token ?? '',
+              expires_at: parsed.expires_at ? Number(parsed.expires_at) : undefined,
+              user: {
+                id: claims.sub,
+                email: claims.email,
+              },
+            })
+            res.writeHead(200, { 'content-type': 'application/json' })
+            res.end('{"ok":true}')
+            finish(() => resolve(user))
+          } catch (error) {
+            res.writeHead(500)
+            res.end('{"error":"bad request"}')
+            finish(() =>
+              reject(error instanceof Error ? error : new Error(String(error))),
+            )
+          }
+        })
+        return
+      }
+      res.writeHead(404)
+      res.end('not found')
+    })
+
+    const timer = setTimeout(
+      () => finish(() => reject(new Error('Login timed out. Please run anvil login again.'))),
+      timeoutMs,
+    )
+
+    function finish(then: () => void) {
+      if (settled) return
+      settled = true
+      clearTimeout(timer)
+      // Give the browser a beat to receive the 200 before the socket closes.
+      setTimeout(() => {
+        try {
+          server.close()
+        } catch {
+          /* already closed */
+        }
+        then()
+      }, 150)
+    }
+
+    server.on('error', (error) => finish(() => reject(error)))
+    server.listen(0, '127.0.0.1', () => {
+      const address = server.address()
+      const port = typeof address === 'object' && address ? address.port : 0
+      const redirectUri = `http://127.0.0.1:${port}/callback`
+      const loginUrl = `${getLoginPageUrl()}?redirect_uri=${encodeURIComponent(redirectUri)}`
+      console.log('\nOpening your browser to sign in…')
+      console.log(loginUrl, '\n')
+      void open(loginUrl).catch(() => {
+        console.log('Could not open a browser automatically — open the URL above.')
+      })
+    })
+  })
+}
+
+/** True when a Supabase session is already stored. */
+export function hasSupabaseSession(): boolean {
+  const user = getUserCredentials()
+  return Boolean(user?.provider === 'supabase' && user.authToken)
+}
+
+/**
+ * Ensure the user is signed in for managed gateway mode. No-op when a Supabase
+ * session already exists. Non-interactive with ANVIL_LOGIN_EMAIL/PASSWORD;
+ * otherwise opens the browser sign-in. Throws if sign-in doesn't complete.
+ */
+export async function ensureSignedIn(): Promise<void> {
+  if (hasSupabaseSession()) return
+  const email = process.env.ANVIL_LOGIN_EMAIL
+  const password = process.env.ANVIL_LOGIN_PASSWORD
+  if (email && password) {
+    await signInWithPassword(email, password)
+    return
+  }
+  await loginViaBrowser()
+}
+
+/** Seconds of headroom before expiry at which we proactively refresh. */
+const REFRESH_SKEW_SECONDS = 60
+
+/**
+ * Ensure the stored Supabase access token is still valid, refreshing it when
+ * it is within {@link REFRESH_SKEW_SECONDS} of expiry. No-op for non-Supabase
+ * credentials (direct/anvil). Returns the current valid access token, or
+ * undefined when there is nothing to refresh / refresh failed.
+ */
+export async function ensureFreshAuthToken(): Promise<string | undefined> {
+  const user = getUserCredentials()
+  if (!user || user.provider !== 'supabase') return user?.authToken
+  const now = Math.floor(Date.now() / 1000)
+  const notExpiring =
+    typeof user.expiresAt === 'number' &&
+    user.expiresAt - REFRESH_SKEW_SECONDS > now
+  if (notExpiring) return user.authToken
+  if (!user.refreshToken) return user.authToken
+  try {
+    const refreshed = await refreshSupabaseSession(user.refreshToken)
+    return refreshed.authToken
+  } catch (error) {
+    logger.warn(
+      { error: error instanceof Error ? error.message : String(error) },
+      'Supabase token refresh failed; using the existing token',
+    )
+    return user.authToken
+  }
+}

package/src/pre-init/client-env.ts

@@ -0,0 +1,17 @@
+// Apply production defaults for NEXT_PUBLIC_* vars BEFORE anything that
+// imports `@anvil/common/env`, which validates the client env at import time
+// and throws on a machine without an env file (any global npm install).
+//
+// Must be imported before `./index` in `entry.ts`, mirroring the tree-sitter
+// pre-init: both prepare runtime state the eagerly-evaluated import graph
+// needs at module-evaluation time.
+//
+// Gap-filling only: real values already in process.env (from ~/.env.local,
+// the shell, or --define flags baked into compiled binaries) always win.
+import { CLIENT_ENV_DEFAULTS } from '../utils/client-env-defaults'
+
+for (const [key, value] of Object.entries(CLIENT_ENV_DEFAULTS)) {
+  if (process.env[key] === undefined) {
+    process.env[key] = value
+  }
+}

package/src/utils/anvil-client.ts

@@ -3,6 +3,7 @@ import { AskUserBridge } from '@anvil/common/utils/ask-user-bridge'
 import { AnvilClient } from '@anvil/sdk'
 
 import { getAuthTokenDetails } from './auth'
+import { ensureFreshAuthToken } from '../login/supabase-auth'
 import { getCliEnv, getSystemProcessEnv } from './env'
 import { loadAgentDefinitions } from './local-agent-registry'
 import { logger } from './logger'
@@ -48,6 +49,9 @@ export function resetAnvilClient(): void {
 
 export async function getAnvilClient(): Promise<AnvilClient | null> {
   if (!clientInstance) {
+    // Managed gateway mode: refresh the Supabase access token if it is near
+    // expiry before reading it (no-op for direct/anvil credentials).
+    await ensureFreshAuthToken()
     const { token: apiKey } = getAuthTokenDetails()
 
     if (!apiKey) {

package/src/utils/auth.ts

@@ -2,7 +2,10 @@ import fs from 'fs'
 import path from 'path'
 
 import { getCiEnv } from '@anvil/common/env-ci'
-import { getDirectDeepSeekApiKey } from '@anvil/common/constants/deepseek-direct'
+import {
+  getDirectDeepSeekApiKey,
+  isManagedGatewayMode,
+} from '@anvil/common/constants/deepseek-direct'
 import { z } from 'zod'
 
 
@@ -21,6 +24,13 @@ const userSchema = z.object({
   fingerprintId: z.string().optional(),
   fingerprintHash: z.string().optional(),
   credits: z.number().optional(),
+  // Managed gateway mode (Supabase): `authToken` holds the Supabase access
+  // token (a JWT the cli-agent gateway verifies). These let the CLI refresh it
+  // without a re-login. Optional + additive, so existing credentials still parse.
+  provider: z.string().optional(),
+  refreshToken: z.string().optional(),
+  /** Access-token expiry, epoch seconds. */
+  expiresAt: z.number().optional(),
 })
 
 export type User = z.infer<typeof userSchema>
@@ -117,10 +127,12 @@ export const getAuthTokenDetails = (
     return { token: envToken, source: 'environment' }
   }
 
-  // Direct-to-DeepSeek mode: the DeepSeek key doubles as the auth token so
-  // the CLI treats the user as authenticated without a Anvil backend.
+  // Direct-to-DeepSeek mode: the DeepSeek key doubles as the auth token so the
+  // CLI treats the user as authenticated without an Anvil backend. In managed
+  // gateway mode this does NOT apply — the gateway needs a real Supabase JWT,
+  // so a local DeepSeek key must never count as being signed in.
   const deepseekToken = getDirectDeepSeekApiKey()
-  if (deepseekToken) {
+  if (deepseekToken && !isManagedGatewayMode()) {
     return { token: deepseekToken, source: 'environment' }
   }
 

package/src/utils/client-env-defaults.ts

@@ -0,0 +1,28 @@
+/**
+ * Production defaults for the NEXT_PUBLIC_* client env vars.
+ *
+ * `@anvil/common/env` validates all NEXT_PUBLIC_* vars at *import time*, so a
+ * global npm install (no .env.local anywhere on the machine) dies before any
+ * of our code runs. These defaults — all public-by-design values, the same
+ * set `cli/scripts/build-binary.ts` bakes into compiled binaries — are applied
+ * to `process.env` at pre-init so the CLI boots on any machine, cmd or
+ * PowerShell, with or without an env file.
+ *
+ * IMPORTANT: the pre-init loader (`cli/src/pre-init/client-env.ts`) imports
+ * this table, and `build-binary.ts` reads it at build time. Keep the two in
+ * sync through this module — never duplicate the values.
+ *
+ * User-set values always win: the loader only fills gaps, it never overwrites
+ * anything already in process.env (including values Bun loads from
+ * .env.local in dev, and the --define flags baked into binaries).
+ */
+export const CLIENT_ENV_DEFAULTS: Readonly<Record<string, string>> = {
+  NEXT_PUBLIC_CB_ENVIRONMENT: 'prod',
+  NEXT_PUBLIC_ANVIL_APP_URL: 'https://anvil.dev',
+  NEXT_PUBLIC_SUPPORT_EMAIL: 'support@anvil.dev',
+  NEXT_PUBLIC_POSTHOG_API_KEY: 'phc_placeholder',
+  NEXT_PUBLIC_POSTHOG_HOST_URL: 'https://us.i.posthog.com',
+  NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY: 'pk_placeholder',
+  NEXT_PUBLIC_STRIPE_CUSTOMER_PORTAL: 'https://billing.stripe.com/portal',
+  NEXT_PUBLIC_WEB_PORT: '3000',
+}