@alumbwe/anvil 1.0.49 → 1.0.51

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alumbwe/anvil",
-  "version": "1.0.49",
+  "version": "1.0.51",
   "private": false,
   "type": "module",
   "bin": {

package/src/agents/bundled-agents.generated.ts

@@ -4,7 +4,7 @@
  * This file is generated by scripts/prebuild-agents.ts
  * It contains all bundled agent definitions from the agents/ directory.
  * 
- * Generated at: 2026-11-01T15:44:55.857Z
+ * Generated at: 2026-11-01T17:04:31.434Z
  * Agent count: 80
  */
 

package/src/index.tsx

@@ -220,24 +220,27 @@ async function main(): Promise<void> {
 
   const isLoginCommand = command === 'login'
   const isPublishCommand = command === 'publish'
-  const hasAgentOverride = Boolean(agent?.trim())
-
-  await initializeApp({ cwd })
+  const hasAgentOverride = Boolean(agent?.trim())
+
+  // Login is intentionally independent of project initialization. It must
+  // work from any directory and must not create project state before auth.
+  if (isLoginCommand) {
+    await runPlainLogin()
+    return
+  }
+
+  await initializeApp({ cwd })
 
   // Load .env.local into process.env so API keys are available at runtime.
   // This replaces the old --env=inline build flag — keys are no longer baked
   // into the binary.
-  loadEnvLocal()
+  if (!isManagedGatewayMode()) {
+    loadEnvLocal()
+  }
 
   // Set the auth token for the API client
   setApiClientAuthToken(getAuthToken())
 
-  // Handle login command before rendering the app
-  if (isLoginCommand) {
-    await runPlainLogin()
-    return
-  }
-
   // Handle setup command (or first-run key wizard)
   const isSetupCommand = command === 'setup'
   if (isSetupCommand) {

package/src/login/plain-login.ts

@@ -5,9 +5,8 @@ import { cyan, green, red, yellow, bold } from 'picocolors'
 import { LOGIN_WEBSITE_URL } from './constants'
 import { generateLoginUrl, pollLoginStatus } from './login-flow'
 import {
-  isSupabaseAuthConfigured,
+  hasSupabaseSession,
   loginViaBrowser,
-  signInWithPassword,
 } from './supabase-auth'
 import {
   flushAnalytics,
@@ -40,18 +39,14 @@ export async function runSupabaseLogin(): Promise<void> {
   console.log(bold('Anvil Login'))
   console.log()
 
-  const envEmail = process.env.ANVIL_LOGIN_EMAIL
-  const envPassword = process.env.ANVIL_LOGIN_PASSWORD
+  if (hasSupabaseSession()) {
+    console.log(green('Already signed in to Anvil on this machine.'))
+    console.log('Run `anvil logout` before signing in with a different account.')
+    return
+  }
 
   try {
-    let user
-    if (envEmail && envPassword) {
-      console.log(`Signing in as ${envEmail}...`)
-      user = await signInWithPassword(envEmail, envPassword)
-    } else {
-      console.log('Waiting for you to finish signing in in your browser…')
-      user = await loginViaBrowser()
-    }
+    const user = await loginViaBrowser()
 
     if (user.id) {
       identifyUser(user.id, { email: user.email, anvil: IS_ANVIL })
@@ -80,7 +75,7 @@ export async function runSupabaseLogin(): Promise<void> {
 export async function runPlainLogin(): Promise<void> {
   // Managed gateway mode uses Supabase auth (the gateway verifies a Supabase
   // JWT), not the Anvil device-code flow.
-  if (isManagedGatewayMode() && isSupabaseAuthConfigured()) {
+  if (isManagedGatewayMode()) {
     return runSupabaseLogin()
   }
 

package/src/login/supabase-auth.ts

@@ -20,6 +20,13 @@ import open from 'open'
 import { logger } from '../utils/logger'
 import { getUserCredentials, saveUserCredentials, type User } from '../utils/auth'
 
+// Managed installs authenticate against the hosted Anvil Supabase project.
+// This is a publishable client key; provider/service secrets remain server-side.
+const MANAGED_SUPABASE_URL =
+  'https://tqolntrdmbbaptmxihtq.supabase.co'
+const MANAGED_SUPABASE_PUBLISHABLE_KEY =
+  'sb_publishable_r6L6tZj0xSxwaY0nehNHAw_9XpkQkie'
+
 /** GoTrue session as returned by /token and /verify. */
 interface SupabaseSession {
   access_token: string
@@ -34,18 +41,12 @@ interface SupabaseSession {
 }
 
 function supabaseUrl(): string | undefined {
-  const url = process.env.SUPABASE_URL ?? process.env.NEXT_PUBLIC_SUPABASE_URL
-  return url ? url.replace(/\/+$/, '') : undefined
+  return MANAGED_SUPABASE_URL
 }
 
 /** The anon/publishable key — GoTrue requires it as the `apikey` header. */
 function supabaseAnonKey(): string | undefined {
-  return (
-    process.env.SUPABASE_PUBLISHABLE_KEY ??
-    process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY ??
-    process.env.SUPABASE_ANON_KEY ??
-    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY
-  )
+  return MANAGED_SUPABASE_PUBLISHABLE_KEY
 }
 
 /** True when Supabase auth can run (URL + anon key configured). */
@@ -153,9 +154,7 @@ async function refreshSupabaseSession(refreshToken: string): Promise<User> {
 /** Hosted sign-in page that completes auth in the browser, then redirects the
  *  session back to the CLI's loopback callback. Override with ANVIL_LOGIN_URL. */
 export function getLoginPageUrl(): string {
-  return (
-    process.env.ANVIL_LOGIN_URL ?? 'https://cli.tryanvil.dev/login'
-  ).replace(/\/+$/, '')
+  return 'https://cli.tryanvil.dev/login'
 }
 
 /** Decode a JWT payload (no verification — only for display id/email). */
@@ -306,12 +305,6 @@ export function hasSupabaseSession(): boolean {
  */
 export async function ensureSignedIn(): Promise<void> {
   if (hasSupabaseSession()) return
-  const email = process.env.ANVIL_LOGIN_EMAIL
-  const password = process.env.ANVIL_LOGIN_PASSWORD
-  if (email && password) {
-    await signInWithPassword(email, password)
-    return
-  }
   await loginViaBrowser()
 }
 

package/src/utils/auth.ts

@@ -122,7 +122,7 @@ export const getAuthTokenDetails = (
     return { token: userCredentials.authToken, source: 'credentials' }
   }
 
-  const envToken = ciEnv.ANVIL_API_KEY
+  const envToken = isManagedGatewayMode() ? undefined : ciEnv.ANVIL_API_KEY
   if (envToken) {
     return { token: envToken, source: 'environment' }
   }

package/vendor/@anvil/common/src/constants/deepseek-direct.ts

@@ -50,10 +50,7 @@ export const isDirectDeepSeekMode = (): boolean =>
  * identity (no external account backend is required).
  */
 export const getManagedGatewayUrl = (): string | undefined => {
-  // ANVIL_GATEWAY_URL remains an escape hatch for development and tests, but
-  // production installs must not depend on a locally supplied environment.
-  const explicit = process.env.ANVIL_GATEWAY_URL?.trim()
-  return (explicit || MANAGED_GATEWAY_URL).replace(/\/+$/, '')
+  return MANAGED_GATEWAY_URL
 }
 
 /** True when the managed gateway is configured (see {@link getManagedGatewayUrl}). */

package/vendor/@anvil/sdk/dist/index.cjs

@@ -34585,8 +34585,7 @@ var DEFAULT_DIRECT_DEEPSEEK_MODEL = "deepseek-v4-pro";
 var getDirectDeepSeekApiKey = () => process.env.DEEPSEEK_API_KEY;
 var isDirectDeepSeekMode = () => Boolean(getDirectDeepSeekApiKey());
 var getManagedGatewayUrl = () => {
-  const explicit = process.env.ANVIL_GATEWAY_URL?.trim();
-  return (explicit || MANAGED_GATEWAY_URL).replace(/\/+$/, "");
+  return MANAGED_GATEWAY_URL;
 };
 var isManagedGatewayMode = () => Boolean(getManagedGatewayUrl());
 function remapModelForDirectDeepSeek(model) {
@@ -52329,5 +52328,5 @@ function setTreeSitterWasmPath2(wasmPath) {
   setTreeSitterWasmPath(wasmPath);
 }
 
-//# debugId=5C15E7A7E1B3AA1764756E2164756E21
+//# debugId=91505A07A7B3B56B64756E2164756E21
 //# sourceMappingURL=index.cjs.map

package/vendor/@anvil/sdk/dist/index.mjs

@@ -34502,8 +34502,7 @@ var DEFAULT_DIRECT_DEEPSEEK_MODEL = "deepseek-v4-pro";
 var getDirectDeepSeekApiKey = () => process.env.DEEPSEEK_API_KEY;
 var isDirectDeepSeekMode = () => Boolean(getDirectDeepSeekApiKey());
 var getManagedGatewayUrl = () => {
-  const explicit = process.env.ANVIL_GATEWAY_URL?.trim();
-  return (explicit || MANAGED_GATEWAY_URL).replace(/\/+$/, "");
+  return MANAGED_GATEWAY_URL;
 };
 var isManagedGatewayMode = () => Boolean(getManagedGatewayUrl());
 function remapModelForDirectDeepSeek(model) {
@@ -52322,5 +52321,5 @@ export {
   ANVIL_BINARY
 };
 
-//# debugId=B50622D584101C2364756E2164756E21
+//# debugId=EA738E5B98C042E564756E2164756E21
 //# sourceMappingURL=index.mjs.map