@animaapp/cli 0.2.1 → 0.3.1

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command6 } from "commander";
+import { Command as Command9 } from "commander";
 
 // src/commands/create.ts
 import { Command } from "commander";
@@ -47,6 +47,16 @@ function deleteCredentials() {
     return false;
   }
 }
+function clearStorage() {
+  const had = deleteCredentials();
+  try {
+    if (fs.existsSync(CONFIG_DIR) && fs.readdirSync(CONFIG_DIR).length === 0) {
+      fs.rmdirSync(CONFIG_DIR);
+    }
+  } catch {
+  }
+  return had;
+}
 function getCredentialsPath() {
   return CREDENTIALS_FILE;
 }
@@ -97,9 +107,6 @@ function validationError(message, detail) {
 function apiError(message, detail) {
   return new CliError("API_ERROR", message, EXIT_CODES.API_ERROR, detail);
 }
-function streamError(message) {
-  return new CliError("STREAM_ERROR", message, EXIT_CODES.API_ERROR);
-}
 function timeoutError() {
   return new CliError(
     "TIMEOUT",
@@ -121,139 +128,151 @@ function resolveAuth() {
     };
   }
   if (creds) {
+    if (creds.tokenType === "agent" && creds.expiresAt && new Date(creds.expiresAt) <= /* @__PURE__ */ new Date()) {
+      throw authError("Your agent token has expired. Run: anima login");
+    }
     return {
       token: creds.token,
       teamId: creds.teamId,
       figmaToken: process.env.FIGMA_TOKEN || creds.figmaToken,
-      source: "file"
+      source: "file",
+      tokenType: creds.tokenType
     };
   }
-  throw authError(
-    "No API token found. Set ANIMA_API_TOKEN env var or run: anima auth --token <token>\nGet your token at: https://dev.animaapp.com > Settings > API Keys"
-  );
+  throw authError("No credentials found. Run: anima login\n(or set the ANIMA_API_TOKEN env var)");
 }
 
-// src/api/client.ts
-async function streamGeneration(url, body, headers, callbacks = {}, timeoutMs = 6e5, signal) {
-  const controller = new AbortController();
-  const combinedSignal = signal ?? controller.signal;
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    const response = await fetch(url, {
-      method: "POST",
-      headers: {
-        ...headers,
-        "Content-Type": "application/json",
-        Accept: "text/event-stream"
-      },
-      body: JSON.stringify(body),
-      signal: combinedSignal
+// src/api/mcp.ts
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { CallToolResultSchema, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
+
+// src/output/log.ts
+import fs2 from "fs";
+import path2 from "path";
+var logPath = null;
+var REDACT_KEY = /token|authorization|secret|password|_auth|api[-_]?key/i;
+var REDACTED = "***REDACTED***";
+function initLogger(filePath) {
+  const target = filePath || process.env.ANIMA_LOG_FILE;
+  if (!target || logPath) return;
+  logPath = path2.resolve(target);
+  fs2.mkdirSync(path2.dirname(logPath), { recursive: true });
+  logEvent("log_started", { pid: process.pid, argv: process.argv.slice(2) });
+}
+function logEvent(event, data) {
+  if (!logPath) return;
+  const entry = { ts: (/* @__PURE__ */ new Date()).toISOString(), event, ...data ? redact(data) : {} };
+  fs2.appendFileSync(logPath, JSON.stringify(entry) + "\n");
+}
+function redact(value) {
+  const out = {};
+  for (const [key, val] of Object.entries(value)) {
+    if (REDACT_KEY.test(key)) {
+      out[key] = REDACTED;
+    } else if (val && typeof val === "object" && !Array.isArray(val)) {
+      out[key] = redact(val);
+    } else {
+      out[key] = val;
+    }
+  }
+  return out;
+}
+
+// src/version.ts
+import { createRequire } from "module";
+var { version } = createRequire(import.meta.url)("../package.json");
+
+// src/api/mcp.ts
+var MCP_PATH = "/v1/mcp";
+var CLIENT_INFO = { name: "anima-cli", version };
+var DEFAULT_TIMEOUT_MS = 6e5;
+var AnimaMcpClient = class {
+  #client;
+  #transport;
+  #url;
+  constructor(config) {
+    const headers = {
+      Authorization: `Bearer ${config.token}`
+    };
+    if (config.teamId) headers["X-Team-Id"] = config.teamId;
+    if (config.figmaToken) headers["X-Figma-Token"] = config.figmaToken;
+    this.#url = new URL(MCP_PATH, config.apiBaseUrl).toString();
+    this.#transport = new StreamableHTTPClientTransport(new URL(this.#url), {
+      requestInit: { headers }
     });
-    if (!response.ok) {
-      const errorText = await response.text();
-      let detail;
-      try {
-        detail = JSON.parse(errorText);
-      } catch {
-        detail = errorText;
-      }
-      throw apiError(
-        `API returned ${response.status}: ${response.statusText}`,
-        detail
+    this.#client = new Client(CLIENT_INFO, { capabilities: {} });
+  }
+  async connect() {
+    logEvent("mcp_connect", { url: this.#url });
+    try {
+      await this.#client.connect(this.#transport);
+    } catch (err) {
+      logEvent("mcp_connect_failed", { url: this.#url, error: err?.message });
+      throw connectionError(err);
+    }
+  }
+  /**
+   * Call a tool and return its parsed result. Anima tools return a single JSON
+   * text block; a `{ success: false }` payload is a normal result, so callers
+   * still inspect `success` themselves.
+   */
+  async callTool(name, args, options = {}) {
+    logEvent("mcp_tool_call", { tool: name, arguments: args });
+    let result;
+    try {
+      result = await this.#client.callTool(
+        { name, arguments: args },
+        CallToolResultSchema,
+        {
+          timeout: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+          resetTimeoutOnProgress: true,
+          onprogress: options.onProgress ? (p) => options.onProgress({ progress: p.progress, total: p.total, message: p.message }) : void 0
+        }
       );
+    } catch (err) {
+      logEvent("mcp_tool_error", { tool: name, error: err?.message });
+      if (err?.code === ErrorCode.RequestTimeout) {
+        throw timeoutError();
+      }
+      throw err;
     }
-    if (!response.body) {
-      throw streamError("Response body is null");
+    logEvent("mcp_tool_result", { tool: name, isError: result.isError ?? false });
+    const content = Array.isArray(result.content) ? result.content : [];
+    const text = content.find((c) => c.type === "text")?.text;
+    if (result.isError) {
+      throw apiError(text || "MCP tool returned an error");
     }
-    return await parseSSEStream(
-      response.body,
-      (data, result) => {
-        switch (data.type) {
-          case "queueing":
-            callbacks.onQueueing?.(data.payload.sessionId);
-            break;
-          case "start":
-            result.sessionId = data.sessionId;
-            callbacks.onStart?.(data.sessionId);
-            break;
-          case "progress_messages_updated":
-            callbacks.onProgress?.(data.payload.progressMessages);
-            break;
-          case "generating_code":
-            if (data.payload.status === "success") {
-              result.files = data.payload.files;
-            }
-            callbacks.onGeneratingCode?.(data.payload.progress);
-            break;
-          case "assets_list":
-            result.assets = data.payload.assets;
-            break;
-          case "codegen_completed":
-          case "generation_completed":
-            callbacks.onCompleted?.();
-            break;
-          case "error":
-            throw apiError(
-              `${data.payload.errorName}: ${data.payload.reason}`,
-              data.payload
-            );
-          case "done":
-            result.tokenUsage = data.payload.tokenUsage;
-            result.sessionId = data.payload.sessionId;
-            return true;
-        }
-        return false;
-      },
-      { sessionId: "", files: {}, tokenUsage: 0 }
-    );
-  } catch (err) {
-    if (err instanceof Error && err.name === "AbortError") {
-      throw timeoutError();
+    if (!text) {
+      throw apiError("MCP tool returned no text content");
+    }
+    try {
+      return JSON.parse(text);
+    } catch {
+      return text;
     }
-    throw err;
-  } finally {
-    clearTimeout(timer);
   }
-}
-async function parseSSEStream(body, handler, initial) {
-  const reader = body.getReader();
-  const decoder = new TextDecoder();
-  let buffer = "";
-  const result = { ...initial };
+  async close() {
+    await this.#transport.close().catch(() => {
+    });
+  }
+};
+async function withMcp(config, fn) {
+  const client = new AnimaMcpClient(config);
+  await client.connect();
   try {
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      buffer += decoder.decode(value, { stream: true });
-      const lines = buffer.split("\n");
-      buffer = lines.pop() || "";
-      for (const line of lines) {
-        if (!line.trim() || line.startsWith(":")) continue;
-        if (line.startsWith("data: ")) {
-          let data;
-          try {
-            data = JSON.parse(line.slice(6));
-          } catch {
-            continue;
-          }
-          const isDone = handler(data, result);
-          if (isDone) return result;
-        }
-      }
-    }
+    return await fn(client);
   } finally {
-    reader.cancel();
+    await client.close();
   }
-  throw streamError("Connection closed before receiving 'done' message");
 }
-function buildHeaders(token, teamId) {
-  const headers = {
-    Authorization: `Bearer ${token}`
-  };
-  if (teamId) {
-    headers["X-Team-Id"] = teamId;
-  }
-  return headers;
+function connectionError(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  return new CliError(
+    "CONNECTION_ERROR",
+    `Could not reach the Anima MCP endpoint: ${message}`,
+    1
+  );
 }
 
 // src/output/formatter.ts
@@ -409,50 +428,81 @@ function normalizeNodeId(nodeId) {
   return nodeId.replace(/-/g, ":");
 }
 
-// src/commands/create.ts
+// src/config/store.ts
+import fs3 from "fs";
+import path3 from "path";
+import os2 from "os";
+var CONFIG_DIR2 = path3.join(os2.homedir(), ".config", "anima");
+var CONFIG_FILE = path3.join(CONFIG_DIR2, "config.json");
 var DEFAULT_API_URL = "https://public-api.animaapp.com";
+var CONFIG_KEYS = {
+  "api-url": "apiUrl"
+};
+function isConfigKey(key) {
+  return key in CONFIG_KEYS;
+}
+function configKeys() {
+  return Object.keys(CONFIG_KEYS);
+}
+function readConfig() {
+  try {
+    if (!fs3.existsSync(CONFIG_FILE)) return {};
+    const parsed = JSON.parse(fs3.readFileSync(CONFIG_FILE, "utf-8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function setConfig(key, value) {
+  const merged = { ...readConfig(), [CONFIG_KEYS[key]]: value };
+  fs3.mkdirSync(CONFIG_DIR2, { recursive: true });
+  fs3.writeFileSync(CONFIG_FILE, JSON.stringify(merged, null, 2) + "\n");
+}
+function unsetConfig(key) {
+  const config = readConfig();
+  const field = CONFIG_KEYS[key];
+  if (!(field in config)) return false;
+  delete config[field];
+  fs3.mkdirSync(CONFIG_DIR2, { recursive: true });
+  fs3.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2) + "\n");
+  return true;
+}
+function getConfigPath() {
+  return CONFIG_FILE;
+}
+function resolveApiUrl(flagValue) {
+  return flagValue || process.env.ANIMA_API_URL || readConfig().apiUrl || DEFAULT_API_URL;
+}
+
+// src/commands/create.ts
 var PLAYGROUND_BASE = "https://dev.animaapp.com/chat";
-var createCommand = new Command("create").description("Create app from prompt, URL, or Figma design (3-7 min)").requiredOption("-t, --type <type>", "Generation type: p2c, l2c, or f2c").option("-p, --prompt <prompt>", "Text prompt (p2c)").option("-u, --url <url>", "Website URL (l2c)").option("--file-key <key>", "Figma file key or URL (f2c)").option("--nodes <nodes>", "Figma node IDs, comma-separated (f2c)").option("--figma-token <token>", "Figma personal access token (f2c)").option("--framework <fw>", "react | html", "react").option("--styling <style>", "tailwind | css | plain_css | css_modules | inline_styles", "tailwind").option("--language <lang>", "typescript | javascript").option("--ui-library <lib>", "mui | antd | shadcn | clean_react").option("--guidelines <text>", "Additional constraints (p2c only)").option("--json", "Output as JSON").option("--timeout <ms>", "Timeout in milliseconds", "600000").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL", DEFAULT_API_URL).action(async (opts) => {
+var createCommand = new Command("create").description("Create app from prompt, URL, or Figma design (3-7 min)").requiredOption("-t, --type <type>", "Generation type: p2c, l2c, or f2c").option("-p, --prompt <prompt>", "Text prompt (p2c)").option("-u, --url <url>", "Website URL (l2c)").option("--file-key <key>", "Figma file key or URL (f2c)").option("--nodes <nodes>", "Figma node IDs, comma-separated (f2c)").option("--figma-token <token>", "Figma personal access token (f2c)").option("--framework <fw>", "react | html", "react").option("--styling <style>", "tailwind | css | plain_css | css_modules | inline_styles", "tailwind").option("--language <lang>", "typescript | javascript").option("--ui-library <lib>", "mui | antd | shadcn | clean_react").option("--guidelines <text>", "Additional constraints (p2c only)").option("--json", "Output as JSON").option("--timeout <ms>", "Timeout in milliseconds", "600000").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (opts) => {
   const mode = detectOutputMode(opts);
+  initLogger(opts.logFile);
   const progress = new ProgressReporter(mode, opts.verbose);
   try {
     const type = opts.type;
     validateCreateOptions(type, opts);
     const auth = resolveAuth();
-    const headers = buildHeaders(auth.token, auth.teamId);
-    const { endpoint, body } = buildCreateRequest(type, opts, auth.figmaToken);
+    const figmaToken = type === "f2c" ? resolveFigmaToken(opts, auth.figmaToken) : void 0;
+    const args = buildCreateArgs(type, opts);
     progress.start(`Creating ${type.toUpperCase()} playground...`);
-    const result = await streamGeneration(
-      `${opts.apiUrl}${endpoint}`,
-      body,
-      headers,
-      {
-        onQueueing: () => progress.update("Queued, waiting..."),
-        onStart: (sid) => progress.update(`Started (${sid.slice(0, 8)}...)...`),
-        onProgress: (msgs) => {
-          const running = msgs.find((m) => m.status === "running");
-          if (running) progress.update(running.title);
-        },
-        onGeneratingCode: (pct) => progress.update(`Generating code (${pct}%)...`),
-        onCompleted: () => progress.update("Finalizing...")
-      },
-      parseInt(opts.timeout, 10)
+    const result = await withMcp(
+      { apiBaseUrl: resolveApiUrl(opts.apiUrl), token: auth.token, teamId: auth.teamId, figmaToken },
+      (client) => client.callTool("playground-create", args, {
+        timeoutMs: parseInt(opts.timeout, 10),
+        onProgress: (p) => progress.update(p.message ?? `Generating (${Math.round(p.progress)}%)...`)
+      })
     );
-    const playgroundUrl = `${PLAYGROUND_BASE}/${result.sessionId}`;
+    if (!result.success || !result.sessionId) {
+      throw apiError(result.reason || result.error || "Generation failed", result);
+    }
+    const playgroundUrl = result.playgroundUrl || `${PLAYGROUND_BASE}/${result.sessionId}`;
     progress.succeed("Playground created!");
     if (mode === "pretty") {
-      printSessionResult({
-        sessionId: result.sessionId,
-        playgroundUrl,
-        tokenUsage: result.tokenUsage
-      });
+      printSessionResult({ sessionId: result.sessionId, playgroundUrl });
     } else {
-      outputResult(mode, {
-        success: true,
-        sessionId: result.sessionId,
-        playgroundUrl,
-        tokenUsage: result.tokenUsage
-      });
+      outputResult(mode, { success: true, sessionId: result.sessionId, playgroundUrl });
     }
   } catch (err) {
     progress.fail("Failed");
@@ -481,42 +531,32 @@ function validateCreateOptions(type, opts) {
     throw validationError("--file-key is required for f2c type");
   }
 }
-function buildCreateRequest(type, opts, storedFigmaToken) {
+function resolveFigmaToken(opts, stored) {
+  const figmaToken = opts.figmaToken || process.env.FIGMA_TOKEN || stored;
+  if (!figmaToken) {
+    throw validationError(
+      "Figma token required for f2c. Use --figma-token, set FIGMA_TOKEN env var, or run: anima auth --figma-token <token>\nGet one at: https://www.figma.com > Settings > Personal access tokens"
+    );
+  }
+  return figmaToken;
+}
+function buildCreateArgs(type, opts) {
   const language = opts.language ?? (opts.framework === "react" ? "typescript" : void 0);
-  const conventions = {
+  const args = {
+    type,
     framework: opts.framework,
-    language,
-    styling: opts.styling,
-    uiLibrary: opts.uiLibrary
+    styling: opts.styling
   };
-  Object.keys(conventions).forEach((key) => {
-    if (conventions[key] === void 0) {
-      delete conventions[key];
-    }
-  });
+  if (language) args.language = language;
+  if (opts.uiLibrary) args.uiLibrary = opts.uiLibrary;
   switch (type) {
     case "p2c":
-      return {
-        endpoint: "/v1/p2c",
-        body: {
-          params: {
-            prompt: opts.prompt,
-            conventions,
-            ...opts.guidelines ? { guidelines: opts.guidelines } : {}
-          }
-        }
-      };
+      args.prompt = opts.prompt;
+      if (opts.guidelines) args.guidelines = opts.guidelines;
+      break;
     case "l2c":
-      return {
-        endpoint: "/v1/l2c",
-        body: {
-          params: {
-            input: { type: "url", url: opts.url },
-            conventions,
-            assetsStorage: { type: "bundled" }
-          }
-        }
-      };
+      args.url = opts.url;
+      break;
     case "f2c": {
       const { fileKey, nodeId: parsedNodeId } = parseFigmaUrl(opts.fileKey);
       let nodesId = [];
@@ -525,123 +565,19 @@ function buildCreateRequest(type, opts, storedFigmaToken) {
       } else if (parsedNodeId) {
         nodesId = [parsedNodeId];
       }
-      const figmaToken = opts.figmaToken || process.env.FIGMA_TOKEN || storedFigmaToken;
-      if (!figmaToken) {
-        throw validationError(
-          "Figma token required for f2c. Use --figma-token, set FIGMA_TOKEN env var, or run: anima auth --figma-token <token>\nGet one at: https://www.figma.com > Settings > Personal access tokens"
-        );
-      }
-      return {
-        endpoint: "/v1/codegen",
-        body: {
-          fileKey,
-          nodesId,
-          figmaToken,
-          framework: conventions.framework,
-          language: conventions.language,
-          styling: conventions.styling,
-          uiLibrary: conventions.uiLibrary
-        }
-      };
+      args.fileKey = fileKey;
+      args.nodesId = nodesId;
+      break;
     }
   }
+  return args;
 }
 
 // src/commands/publish.ts
 import { Command as Command2 } from "commander";
-
-// src/api/mcp-client.ts
-async function callMCPTool(apiBaseUrl, token, teamId, toolName, args) {
-  const request = {
-    jsonrpc: "2.0",
-    id: 1,
-    method: "tools/call",
-    params: {
-      name: toolName,
-      arguments: args
-    }
-  };
-  const headers = {
-    "Content-Type": "application/json",
-    Accept: "application/json, text/event-stream",
-    Authorization: `Bearer ${token}`
-  };
-  if (teamId) {
-    headers["X-Team-Id"] = teamId;
-  }
-  const response = await fetch(`${apiBaseUrl}/v1/mcp`, {
-    method: "POST",
-    headers,
-    body: JSON.stringify(request)
-  });
-  if (!response.ok) {
-    const errorText = await response.text();
-    throw apiError(`MCP request failed (${response.status}): ${errorText}`);
-  }
-  const contentType = response.headers.get("content-type") || "";
-  if (contentType.includes("text/event-stream")) {
-    return parseMCPSSEResponse(response);
-  }
-  const data = await response.json();
-  return extractMCPResult(data);
-}
-async function parseMCPSSEResponse(response) {
-  if (!response.body) {
-    throw streamError("Response body is null");
-  }
-  const reader = response.body.getReader();
-  const decoder = new TextDecoder();
-  let buffer = "";
-  let lastData = null;
-  try {
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      buffer += decoder.decode(value, { stream: true });
-      const lines = buffer.split("\n");
-      buffer = lines.pop() || "";
-      for (const line of lines) {
-        if (!line.trim() || line.startsWith(":")) continue;
-        if (line.startsWith("data: ")) {
-          try {
-            const parsed = JSON.parse(line.slice(6));
-            if (parsed.jsonrpc === "2.0") {
-              lastData = parsed;
-            }
-          } catch {
-          }
-        }
-      }
-    }
-  } finally {
-    reader.cancel();
-  }
-  if (!lastData) {
-    throw apiError("MCP SSE stream ended without a JSON-RPC response");
-  }
-  return extractMCPResult(lastData);
-}
-function extractMCPResult(data) {
-  if (data.error) {
-    throw apiError(`MCP tool error: ${data.error.message}`);
-  }
-  if (!data.result?.content?.length) {
-    throw apiError("MCP tool returned empty result");
-  }
-  const textContent = data.result.content.find((c) => c.type === "text");
-  if (!textContent) {
-    throw apiError("MCP tool returned no text content");
-  }
-  try {
-    return JSON.parse(textContent.text);
-  } catch {
-    return textContent.text;
-  }
-}
-
-// src/commands/publish.ts
-var publishCommand = new Command2("publish").description("Deploy playground to live URL or npm package (1-3 min)").argument("<sessionId>", "Session ID from create command").option("--mode <mode>", "webapp | designSystem", "webapp").option("--package-name <name>", "NPM package name (designSystem mode)").option("--package-version <version>", "NPM package version (designSystem mode)").option("--json", "Output as JSON").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL", "https://public-api.animaapp.com").action(async (sessionId, opts) => {
+var publishCommand = new Command2("publish").description("Deploy playground to live URL or npm package (1-3 min)").argument("<sessionId>", "Session ID from create command").option("--mode <mode>", "webapp | designSystem", "webapp").option("--package-name <name>", "NPM package name (designSystem mode)").option("--package-version <version>", "NPM package version (designSystem mode)").option("--json", "Output as JSON").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (sessionId, opts) => {
   const mode = detectOutputMode(opts);
+  initLogger(opts.logFile);
   const progress = new ProgressReporter(mode, opts.verbose);
   try {
     if (!["webapp", "designSystem"].includes(opts.mode)) {
@@ -660,12 +596,11 @@ var publishCommand = new Command2("publish").description("Deploy playground to l
     if (opts.packageName) args.packageName = opts.packageName;
     if (opts.packageVersion) args.packageVersion = opts.packageVersion;
     progress.start(`Publishing as ${opts.mode}...`);
-    const result = await callMCPTool(
-      opts.apiUrl,
-      auth.token,
-      auth.teamId,
-      "playground-publish",
-      args
+    const result = await withMcp(
+      { apiBaseUrl: resolveApiUrl(opts.apiUrl), token: auth.token, teamId: auth.teamId },
+      (client) => client.callTool("playground-publish", args, {
+        onProgress: (p) => progress.update(p.message ?? "Publishing...")
+      })
     );
     if (!result.success) {
       throw new CliError(
@@ -713,20 +648,24 @@ var publishCommand = new Command2("publish").description("Deploy playground to l
 import { Command as Command3 } from "commander";
 
 // src/utils/files.ts
-import fs2 from "fs";
-import path2 from "path";
+import fs4 from "fs";
+import path4 from "path";
 function writeFilesToDisk(files, outputDir) {
-  fs2.mkdirSync(outputDir, { recursive: true });
+  fs4.mkdirSync(outputDir, { recursive: true });
   let count = 0;
+  const resolvedOutput = path4.resolve(outputDir);
   for (const [filePath, fileContent] of Object.entries(files)) {
-    const fullPath = path2.join(outputDir, filePath);
-    const dirPath = path2.dirname(fullPath);
-    fs2.mkdirSync(dirPath, { recursive: true });
+    const fullPath = path4.resolve(outputDir, filePath);
+    if (!fullPath.startsWith(resolvedOutput + path4.sep)) {
+      throw new Error(`Path traversal detected: ${filePath}`);
+    }
+    const dirPath = path4.dirname(fullPath);
+    fs4.mkdirSync(dirPath, { recursive: true });
     if (fileContent.isBinary) {
       const buffer = Buffer.from(fileContent.content, "base64");
-      fs2.writeFileSync(fullPath, buffer);
+      fs4.writeFileSync(fullPath, buffer);
     } else {
-      fs2.writeFileSync(fullPath, fileContent.content, "utf-8");
+      fs4.writeFileSync(fullPath, fileContent.content, "utf-8");
     }
     count++;
   }
@@ -734,9 +673,9 @@ function writeFilesToDisk(files, outputDir) {
 }
 
 // src/commands/codegen.ts
-var DEFAULT_API_URL2 = "https://public-api.animaapp.com";
-var codegenCommand = new Command3("codegen").description("Convert Figma design to code files (no playground)").requiredOption("--file-key <key>", "Figma file key or URL").option("--nodes <nodes>", "Figma node IDs, comma-separated").option("--figma-token <token>", "Figma personal access token (or set FIGMA_TOKEN env var)").option("-o, --output <dir>", "Output directory", "./generated").option("--framework <fw>", "react | html", "react").option("--styling <style>", "tailwind | css | plain_css | css_modules | inline_styles", "tailwind").option("--language <lang>", "typescript | javascript").option("--ui-library <lib>", "mui | antd | shadcn | clean_react").option("--json", "Output as JSON").option("--timeout <ms>", "Timeout in milliseconds", "600000").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL", DEFAULT_API_URL2).action(async (opts) => {
+var codegenCommand = new Command3("codegen").description("Convert Figma design to code files (no playground)").requiredOption("--file-key <key>", "Figma file key or URL").option("--nodes <nodes>", "Figma node IDs, comma-separated").option("--figma-token <token>", "Figma personal access token (or set FIGMA_TOKEN env var)").option("-o, --output <dir>", "Output directory", "./generated").option("--framework <fw>", "react | html", "react").option("--styling <style>", "tailwind | plain_css", "tailwind").option("--language <lang>", "typescript | javascript").option("--ui-library <lib>", "mui | antd | shadcn | clean_react").option("--json", "Output as JSON").option("--timeout <ms>", "Timeout in milliseconds", "600000").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (opts) => {
   const mode = detectOutputMode(opts);
+  initLogger(opts.logFile);
   const progress = new ProgressReporter(mode, opts.verbose);
   try {
     const { fileKey, nodeId: parsedNodeId } = parseFigmaUrl(opts.fileKey);
@@ -752,40 +691,32 @@ var codegenCommand = new Command3("codegen").description("Convert Figma design t
       );
     }
     const auth = resolveAuth();
-    const figmaToken = opts.figmaToken || auth.figmaToken;
+    const figmaToken = opts.figmaToken || process.env.FIGMA_TOKEN || auth.figmaToken;
     if (!figmaToken) {
       throw validationError(
         "Figma token required. Use --figma-token, set FIGMA_TOKEN env var, or run: anima auth --figma-token <token>\nGet one at: https://www.figma.com > Settings > Personal access tokens"
       );
     }
-    const headers = buildHeaders(auth.token, auth.teamId);
     const language = opts.language ?? (opts.framework === "react" ? "typescript" : void 0);
-    const requestBody = {
+    const args = {
       fileKey,
       nodesId,
-      figmaToken,
       framework: opts.framework,
-      language,
-      styling: opts.styling,
-      uiLibrary: opts.uiLibrary
+      styling: opts.styling
     };
+    if (language) args.language = language;
+    if (opts.uiLibrary) args.uiLibrary = opts.uiLibrary;
     progress.start("Generating code from Figma...");
-    const result = await streamGeneration(
-      `${opts.apiUrl}/v1/codegen`,
-      requestBody,
-      headers,
-      {
-        onQueueing: () => progress.update("Queued, waiting..."),
-        onStart: (sid) => progress.update(`Started (${sid.slice(0, 8)}...)...`),
-        onProgress: (msgs) => {
-          const running = msgs.find((m) => m.status === "running");
-          if (running) progress.update(running.title);
-        },
-        onGeneratingCode: (pct) => progress.update(`Generating code (${pct}%)...`),
-        onCompleted: () => progress.update("Writing files...")
-      },
-      parseInt(opts.timeout, 10)
+    const result = await withMcp(
+      { apiBaseUrl: resolveApiUrl(opts.apiUrl), token: auth.token, teamId: auth.teamId, figmaToken },
+      (client) => client.callTool("codegen-figma_to_code", args, {
+        timeoutMs: parseInt(opts.timeout, 10),
+        onProgress: (p) => progress.update(p.message ?? `Generating (${Math.round(p.progress)}%)...`)
+      })
     );
+    if (!result.success || !result.files) {
+      throw apiError(result.reason || result.error || "Code generation failed", result);
+    }
     const count = writeFilesToDisk(result.files, opts.output);
     progress.succeed(`Generated ${count} files`);
     if (mode === "pretty") {
@@ -813,19 +744,11 @@ var codegenCommand = new Command3("codegen").description("Convert Figma design t
   }
 });
 
-// src/commands/download.ts
+// src/commands/getGitToken.ts
 import { Command as Command4 } from "commander";
-import fs4 from "fs";
-import path4 from "path";
-import { pipeline as pipeline2 } from "stream/promises";
-import { createWriteStream } from "fs";
-import { Readable as Readable2 } from "stream";
+import chalk2 from "chalk";
 
-// src/utils/download.ts
-import fs3 from "fs";
-import path3 from "path";
-import { pipeline } from "stream/promises";
-import { Readable } from "stream";
+// src/utils/playgroundUrl.ts
 function parsePlaygroundUrl(input) {
   if (!input.includes("/")) {
     return input;
@@ -843,66 +766,61 @@ function parsePlaygroundUrl(input) {
   }
 }
 
-// src/commands/download.ts
-var DEFAULT_API_URL3 = "https://public-api.animaapp.com";
-var downloadCommand = new Command4("download").description("Download project from an Anima playground").argument("<playgroundUrl>", "Playground URL or session ID").option("-o, --output <dir>", "Output directory", "./downloaded").option("--json", "Output as JSON").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL", DEFAULT_API_URL3).action(async (playgroundUrl, opts) => {
+// src/utils/gitToken.ts
+function parseGitTokenResponse(text) {
+  const denied = text.match(/^Error \((\w+)\): ([\s\S]*)$/);
+  if (denied) {
+    throw apiError(`Git access ${denied[1]}: ${denied[2].trim()}`);
+  }
+  const url = text.match(/git clone (\S+)/)?.[1];
+  if (!url) {
+    throw apiError(`Unexpected response from project-get_git_token: ${text.slice(0, 200)}`);
+  }
+  const access = text.match(/\*\*(ro|rw)\*\*/)?.[1];
+  const expiresAt = text.match(/expires at (\S+)/)?.[1];
+  return { gitRemoteUrl: url, access: access ?? "ro", expiresAt };
+}
+
+// src/commands/getGitToken.ts
+var getGitTokenCommand = new Command4("get-git-token").description("Mint a short-lived git remote URL for a playground (clone/push with git)").argument("<playgroundUrl>", "Playground URL or session ID").option("--json", "Output as JSON").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (playgroundUrl, opts) => {
   const mode = detectOutputMode(opts);
+  initLogger(opts.logFile);
   const progress = new ProgressReporter(mode, opts.verbose);
   try {
     const sessionId = parsePlaygroundUrl(playgroundUrl);
     const auth = resolveAuth();
-    progress.start("Requesting download...");
-    const result = await callMCPTool(
-      opts.apiUrl,
-      auth.token,
-      auth.teamId,
-      "project-download_from_playground",
-      { playgroundUrl: `https://dev.animaapp.com/chat/${sessionId}` }
+    progress.start("Requesting git access...");
+    const response = await withMcp(
+      { apiBaseUrl: resolveApiUrl(opts.apiUrl), token: auth.token, teamId: auth.teamId },
+      (client) => client.callTool("project-get_git_token", { session_id: sessionId })
     );
-    if (!result.success) {
-      throw apiError(
-        result.error || "Download failed",
-        result
-      );
-    }
-    const downloadUrl = result.downloadUrl;
-    const fileCount = result.fileCount;
-    if (!downloadUrl) {
-      throw apiError("No download URL returned");
-    }
-    progress.update(`Downloading zip (${fileCount} files)...`);
-    const zipPath = path4.join(opts.output, "__download.zip");
-    fs4.mkdirSync(opts.output, { recursive: true });
-    const zipResponse = await fetch(downloadUrl);
-    if (!zipResponse.ok || !zipResponse.body) {
-      throw apiError(`Failed to download zip: ${zipResponse.status}`);
-    }
-    await pipeline2(
-      Readable2.fromWeb(zipResponse.body),
-      createWriteStream(zipPath)
-    );
-    progress.update("Extracting...");
-    const { execSync } = await import("child_process");
-    try {
-      execSync(`unzip -o -q "${zipPath}" -d "${opts.output}"`, {
-        stdio: "pipe"
-      });
-    } catch {
-      execSync(`tar -xf "${zipPath}" -C "${opts.output}"`, {
-        stdio: "pipe"
-      });
-    }
-    fs4.unlinkSync(zipPath);
-    const count = countFiles(opts.output);
-    progress.succeed(`Downloaded ${count} files`);
+    const grant = parseGitTokenResponse(response);
+    logEvent("git_token_granted", { sessionId, access: grant.access, expiresAt: grant.expiresAt });
+    progress.succeed(`Git access granted (${grant.access === "rw" ? "read-write" : "read-only"})`);
     if (mode === "pretty") {
-      printFilesWritten(opts.output, count);
+      console.log();
+      console.log(`  ${chalk2.cyan(`git clone ${grant.gitRemoteUrl}`)}`);
+      console.log();
+      if (grant.access === "rw") {
+        console.log("  Commit and push to update the live playground.");
+      } else {
+        console.log("  Read-only: cloning works, pushing will be rejected.");
+      }
+      if (grant.expiresAt) {
+        console.log(
+          `  The URL embeds a token that expires at ${grant.expiresAt} and cannot be renewed;
+  re-run this command and ${chalk2.cyan("git remote set-url origin <new url>")} to keep pushing.`
+        );
+      }
+      console.log("  Treat the URL as a secret \u2014 it grants access to this playground.");
+      console.log();
     } else {
       outputResult(mode, {
         success: true,
-        output: opts.output,
-        fileCount: count,
-        sessionId
+        sessionId,
+        gitRemoteUrl: grant.gitRemoteUrl,
+        access: grant.access,
+        expiresAt: grant.expiresAt
       });
     }
   } catch (err) {
@@ -918,71 +836,12 @@ var downloadCommand = new Command4("download").description("Download project fro
     throw err;
   }
 });
-function countFiles(dir) {
-  let count = 0;
-  for (const entry of fs4.readdirSync(dir, { withFileTypes: true })) {
-    if (entry.isDirectory()) {
-      count += countFiles(path4.join(dir, entry.name));
-    } else {
-      count++;
-    }
-  }
-  return count;
-}
 
 // src/commands/auth.ts
 import { Command as Command5 } from "commander";
-import chalk2 from "chalk";
-
-// src/auth/oauth.ts
-import http from "http";
-import open from "open";
-var OAUTH_PORT = 19284;
-var OAUTH_BASE = "https://dev.animaapp.com";
-async function loginWithBrowser() {
-  return new Promise((resolve, reject) => {
-    const server = http.createServer((req, res) => {
-      const url = new URL(req.url, `http://localhost:${OAUTH_PORT}`);
-      if (url.pathname === "/callback") {
-        const token = url.searchParams.get("token");
-        const teamId = url.searchParams.get("teamId") ?? void 0;
-        if (!token) {
-          res.writeHead(400, { "Content-Type": "text/html" });
-          res.end(
-            "<html><body><h1>Error</h1><p>No token received. Please try again.</p></body></html>"
-          );
-          server.close();
-          reject(new Error("No token received from OAuth flow"));
-          return;
-        }
-        writeCredentials({ token, teamId });
-        res.writeHead(200, { "Content-Type": "text/html" });
-        res.end(
-          "<html><body><h1>Authenticated!</h1><p>You can close this window and return to the terminal.</p></body></html>"
-        );
-        server.close();
-        resolve({ token, teamId });
-      }
-    });
-    server.listen(OAUTH_PORT, () => {
-      const authUrl = `${OAUTH_BASE}/cli-auth?redirect=http://localhost:${OAUTH_PORT}/callback`;
-      open(authUrl);
-    });
-    server.on("error", (err) => {
-      reject(
-        new Error(`Failed to start OAuth callback server: ${err.message}`)
-      );
-    });
-    setTimeout(() => {
-      server.close();
-      reject(new Error("OAuth login timed out after 5 minutes"));
-    }, 3e5);
-  });
-}
-
-// src/commands/auth.ts
-var DEFAULT_API_URL4 = "https://public-api.animaapp.com";
-var authCommand = new Command5("auth").description("Manage authentication").option("--token <token>", "Store Anima API token").option("--figma-token <token>", "Store Figma personal access token").option("--team-id <teamId>", "Team ID to associate with token").option("--login", "Login via browser OAuth flow").option("--status", "Show current auth status").option("--logout", "Clear stored credentials").option("--json", "Output as JSON").option("--api-url <url>", "API base URL", DEFAULT_API_URL4).action(async (opts) => {
+import chalk3 from "chalk";
+var DEFAULT_API_URL2 = "https://public-api.animaapp.com";
+var authCommand = new Command5("auth").description("Manage authentication").option("--token <token>", "Store Anima API token").option("--figma-token <token>", "Store Figma personal access token").option("--team-id <teamId>", "Team ID to associate with token").option("--status", "Show current auth status").option("--logout", "Clear stored credentials (alias for `anima logout`)").option("--json", "Output as JSON").option("--api-url <url>", "API base URL", DEFAULT_API_URL2).action(async (opts) => {
   const mode = detectOutputMode(opts);
   try {
     if (opts.token || opts.figmaToken) {
@@ -1015,22 +874,8 @@ var authCommand = new Command5("auth").description("Manage authentication").opti
       }
       return;
     }
-    if (opts.login) {
-      if (mode === "pretty") {
-        printInfo("Opening browser for authentication...");
-      }
-      const result = await loginWithBrowser();
-      if (mode === "pretty") {
-        printSuccess("Authenticated successfully!");
-        printKeyValue("Token", result.token.slice(0, 8) + "...");
-        if (result.teamId) printKeyValue("Team ID", result.teamId);
-      } else {
-        outputResult(mode, { success: true, action: "logged_in" });
-      }
-      return;
-    }
     if (opts.logout) {
-      const deleted = deleteCredentials();
+      const deleted = clearStorage();
       if (mode === "pretty") {
         if (deleted) {
           printSuccess("Credentials cleared");
@@ -1052,14 +897,18 @@ var authCommand = new Command5("auth").description("Manage authentication").opti
           printSuccess("Token configured");
           printKeyValue("Source", sourceName);
           printKeyValue("Anima token", auth.token.slice(0, 12) + "..." + auth.token.slice(-4));
+          printKeyValue("Token type", auth.tokenType === "agent" ? "agent (scoped, revocable)" : "personal/API");
+          if (creds?.tokenType === "agent" && creds.expiresAt) printKeyValue("Expires", creds.expiresAt);
           if (auth.teamId) printKeyValue("Team ID", auth.teamId);
           printKeyValue("Figma token", hasFigma ? "configured" : "not set (needed for codegen/f2c)");
         } else {
           outputResult(mode, {
             success: true,
             source: auth.source,
+            tokenType: auth.tokenType ?? "personal",
             tokenPreview: auth.token.slice(0, 12) + "..." + auth.token.slice(-4),
             teamId: auth.teamId,
+            expiresAt: creds?.tokenType === "agent" ? creds.expiresAt : void 0,
             figmaToken: hasFigma
           });
         }
@@ -1079,20 +928,194 @@ var authCommand = new Command5("auth").description("Manage authentication").opti
     if (mode === "pretty") {
       console.log();
       printInfo("Auth commands:");
-      console.log(`  ${chalk2.cyan("anima auth --token <T>")}                   Save Anima API token`);
-      console.log(`  ${chalk2.cyan("anima auth --figma-token <T>")}             Save Figma token`);
-      console.log(`  ${chalk2.cyan("anima auth --token <T> --figma-token <T>")} Save both at once`);
-      console.log(`  ${chalk2.cyan("anima auth --login")}                       Login via browser`);
-      console.log(`  ${chalk2.cyan("anima auth --status")}                      Check auth status`);
-      console.log(`  ${chalk2.cyan("anima auth --logout")}                      Clear all credentials`);
+      console.log(`  ${chalk3.cyan("anima login")}                    Log in (device flow \u2014 approve on any browser)`);
+      console.log(`  ${chalk3.cyan("anima logout")}                   Clear all credentials`);
+      console.log(`  ${chalk3.cyan("anima auth --status")}            Check auth status`);
+      console.log(`  ${chalk3.cyan("anima auth --figma-token <T>")}   Save Figma token (needed for codegen/f2c)`);
       console.log();
-      console.log(`  Anima token: ${chalk2.cyan.underline("https://dev.animaapp.com")} > Settings > API Keys`);
-      console.log(`  Figma token: ${chalk2.cyan.underline("https://www.figma.com")} > Settings > Personal access tokens`);
+      console.log(`  Figma token: ${chalk3.cyan.underline("https://www.figma.com")} > Settings > Personal access tokens`);
       console.log();
     } else {
       outputResult(mode, {
         success: true,
-        message: "Use --token, --login, --status, or --logout"
+        message: "Run `anima login`, or use --status / --logout / --figma-token"
+      });
+    }
+  } catch (err) {
+    if (err instanceof CliError) {
+      if (mode === "pretty") {
+        printError(err.message);
+      } else {
+        outputError(mode, { code: err.code, message: err.message });
+      }
+      process.exit(err.exitCode);
+    }
+    throw err;
+  }
+});
+
+// src/commands/login.ts
+import { Command as Command6 } from "commander";
+import chalk4 from "chalk";
+import open from "open";
+
+// src/auth/device.ts
+var DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+var DEFAULT_CLIENT_NAME = "Anima CLI";
+var defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function decodeJwtPayload(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return void 0;
+    return JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
+  } catch {
+    return void 0;
+  }
+}
+async function loginWithDeviceFlow(options) {
+  const fetchFn = options.fetchFn ?? fetch;
+  const sleep = options.sleepFn ?? defaultSleep;
+  const base = options.apiUrl.replace(/\/$/, "");
+  const startUrl = `${base}/oauth/device_authorization`;
+  logEvent("device_authorization_request", { url: startUrl });
+  const startResponse = await fetchFn(startUrl, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ client_name: options.clientName ?? DEFAULT_CLIENT_NAME }).toString()
+  });
+  logEvent("device_authorization_response", { url: startUrl, status: startResponse.status });
+  if (!startResponse.ok) {
+    const detail = await startResponse.text().catch(() => "");
+    logEvent("device_authorization_failed", { url: startUrl, status: startResponse.status, body: detail.slice(0, 500) });
+    const hint = startResponse.status === 404 ? ` \u2014 no device endpoint at ${startUrl}. Check --api-url points to an API that has the device grant deployed.` : "";
+    throw new CliError(
+      "API_ERROR",
+      `Device authorization failed (HTTP ${startResponse.status})${hint}`,
+      EXIT_CODES.API_ERROR
+    );
+  }
+  const start = await startResponse.json();
+  options.onVerification({
+    userCode: start.user_code,
+    verificationUri: start.verification_uri,
+    verificationUriComplete: start.verification_uri_complete,
+    expiresInSeconds: start.expires_in
+  });
+  let intervalMs = Math.max(1, start.interval) * 1e3;
+  const deadline = Date.now() + start.expires_in * 1e3;
+  while (Date.now() < deadline) {
+    await sleep(intervalMs);
+    const pollResponse = await fetchFn(`${base}/oauth/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: DEVICE_GRANT_TYPE,
+        device_code: start.device_code
+      }).toString()
+    });
+    const body = await pollResponse.json();
+    logEvent("device_token_poll", { status: pollResponse.status, error: body.error });
+    if (pollResponse.ok && typeof body.access_token === "string") {
+      const token = body.access_token;
+      const claims = decodeJwtPayload(token);
+      const result = {
+        token,
+        teamId: typeof claims?.team_id === "string" ? claims.team_id : void 0,
+        agentId: typeof claims?.agent_id === "string" ? claims.agent_id : void 0,
+        expiresAt: typeof claims?.exp === "number" ? new Date(claims.exp * 1e3).toISOString() : void 0
+      };
+      writeCredentials({
+        token: result.token,
+        teamId: result.teamId,
+        tokenType: "agent",
+        agentId: result.agentId,
+        expiresAt: result.expiresAt
+      });
+      return result;
+    }
+    switch (body.error) {
+      case "authorization_pending":
+        continue;
+      case "slow_down":
+        intervalMs += 5e3;
+        continue;
+      case "access_denied":
+        throw authError("The authorization request was denied.");
+      case "expired_token":
+        throw authError("The device code expired before approval. Run the login again.");
+      default:
+        throw new CliError(
+          "API_ERROR",
+          `Unexpected token response: ${body.error ?? `HTTP ${pollResponse.status}`}`,
+          EXIT_CODES.API_ERROR
+        );
+    }
+  }
+  throw authError("The device code expired before approval. Run the login again.");
+}
+
+// src/commands/login.ts
+var loginCommand = new Command6("login").description("Log in via the device flow \u2014 approve in a browser on any device").option("--client-name <name>", "How this CLI appears on the consent screen", "Anima CLI").option("--no-open", "Do not try to open the verification page in a browser").option("--json", "Output as JSON").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").option(
+  "--print-mcp-config",
+  "After login, also print an MCP server config (includes the token) to paste into an MCP-capable agent"
+).action(async (opts) => {
+  const mode = detectOutputMode(opts);
+  initLogger(opts.logFile);
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  try {
+    const result = await loginWithDeviceFlow({
+      apiUrl,
+      clientName: opts.clientName,
+      onVerification: (info) => {
+        if (mode === "pretty") {
+          console.log();
+          printInfo("To connect, open the verification page and enter this code:");
+          console.log();
+          console.log(`    ${chalk4.cyan.underline(info.verificationUri)}`);
+          console.log();
+          console.log(`    ${chalk4.bold.white(info.userCode)}`);
+          console.log();
+          printInfo(`Waiting for approval\u2026 (code expires in ${Math.round(info.expiresInSeconds / 60)} minutes)`);
+        } else {
+          process.stderr.write(
+            JSON.stringify({
+              event: "verification_required",
+              verificationUri: info.verificationUri,
+              verificationUriComplete: info.verificationUriComplete,
+              userCode: info.userCode,
+              expiresIn: info.expiresInSeconds
+            }) + "\n"
+          );
+        }
+        if (mode === "pretty" && opts.open) {
+          open(info.verificationUriComplete).catch(() => {
+          });
+        }
+      }
+    });
+    const mcpConfig = opts.printMcpConfig ? buildMcpConfig(apiUrl, result.token) : void 0;
+    if (mode === "pretty") {
+      printSuccess("Connected!");
+      printKeyValue("Credentials", getCredentialsPath());
+      if (result.agentId) printKeyValue("Agent", result.agentId);
+      if (result.teamId) printKeyValue("Team ID", result.teamId);
+      if (result.expiresAt) printKeyValue("Token expires", result.expiresAt);
+      printInfo("This is a scoped agent token \u2014 it acts within what you approved, and your team can revoke it.");
+      if (mcpConfig) {
+        console.log();
+        printInfo("MCP server config (token expires ~7 days \u2014 re-run `anima login` to refresh):");
+        console.log();
+        console.log(JSON.stringify(mcpConfig, null, 2));
+      }
+    } else {
+      outputResult(mode, {
+        success: true,
+        action: "logged_in",
+        tokenType: "agent",
+        agentId: result.agentId,
+        teamId: result.teamId,
+        expiresAt: result.expiresAt,
+        ...mcpConfig ? { mcpConfig } : {}
       });
     }
   } catch (err) {
@@ -1107,45 +1130,146 @@ var authCommand = new Command5("auth").description("Manage authentication").opti
     throw err;
   }
 });
+function buildMcpConfig(apiUrl, token) {
+  return {
+    mcpServers: {
+      anima: {
+        type: "http",
+        url: `${apiUrl.replace(/\/$/, "")}/v1/mcp`,
+        headers: { Authorization: `Bearer ${token}` }
+      }
+    }
+  };
+}
+
+// src/commands/logout.ts
+import { Command as Command7 } from "commander";
+var logoutCommand = new Command7("logout").description("Clear all stored credentials (Anima + Figma tokens) from this machine").option("--json", "Output as JSON").action((opts) => {
+  const mode = detectOutputMode(opts);
+  const hadCredentials = clearStorage();
+  if (mode === "pretty") {
+    if (hadCredentials) {
+      printSuccess("Logged out \u2014 all credentials cleared from " + getCredentialsPath());
+    } else {
+      printInfo("No stored credentials found");
+    }
+  } else {
+    outputResult(mode, { success: true, action: "logged_out", hadCredentials });
+  }
+});
+
+// src/commands/config.ts
+import { Command as Command8 } from "commander";
+var configCommand = new Command8("config").description(
+  `Store CLI preferences (keys: ${configKeys().join(", ")})`
+);
+configCommand.command("set <key> <value>").description("Set a config value").option("--json", "Output as JSON").action((key, value, opts) => {
+  const mode = detectOutputMode(opts);
+  assertKey(key);
+  if (key === "api-url") assertUrl(value);
+  setConfig(key, value);
+  if (mode === "pretty") printSuccess(`Set ${key} = ${value}`);
+  else outputResult(mode, { success: true, action: "config_set", key, value });
+});
+configCommand.command("get <key>").description("Print a config value").option("--json", "Output as JSON").action((key, opts) => {
+  const mode = detectOutputMode(opts);
+  assertKey(key);
+  const value = readConfig()[CONFIG_KEYS[key]];
+  if (mode === "pretty") {
+    if (value) console.log(value);
+    else printInfo(`${key} is not set`);
+  } else {
+    outputResult(mode, { success: true, key, value: value ?? null });
+  }
+});
+configCommand.command("list").alias("ls").description("Show all config values and where the API URL resolves from").option("--json", "Output as JSON").action((opts) => {
+  const mode = detectOutputMode(opts);
+  const config = readConfig();
+  const resolvedApiUrl = resolveApiUrl();
+  if (mode === "pretty") {
+    printInfo("Config: " + getConfigPath());
+    printKeyValue("api-url", config.apiUrl ?? `(default) ${DEFAULT_API_URL}`);
+    if (process.env.ANIMA_API_URL) {
+      printInfo(`ANIMA_API_URL env is set \u2014 it overrides config (effective: ${resolvedApiUrl})`);
+    }
+  } else {
+    outputResult(mode, {
+      success: true,
+      path: getConfigPath(),
+      config,
+      resolved: { apiUrl: resolvedApiUrl }
+    });
+  }
+});
+configCommand.command("unset <key>").description("Remove a config value").option("--json", "Output as JSON").action((key, opts) => {
+  const mode = detectOutputMode(opts);
+  assertKey(key);
+  const removed = unsetConfig(key);
+  if (mode === "pretty") {
+    if (removed) printSuccess(`Unset ${key}`);
+    else printInfo(`${key} was not set`);
+  } else {
+    outputResult(mode, { success: true, action: "config_unset", key, removed });
+  }
+});
+function assertKey(key) {
+  if (!isConfigKey(key)) {
+    throw validationError(`Unknown config key "${key}". Valid keys: ${configKeys().join(", ")}`);
+  }
+}
+function assertUrl(value) {
+  try {
+    new URL(value);
+  } catch {
+    throw validationError(`"${value}" is not a valid URL`);
+  }
+}
 
 // src/index.ts
-var program = new Command6().name("anima").description(
+var program = new Command9().name("anima").description(
   `Anima CLI - Generate production-ready apps from prompts, URLs, or Figma designs.
 
 AUTHENTICATION:
-  Set ANIMA_API_TOKEN env var or run: npx @animaapp/cli auth --token <token>
-  Get key: https://dev.animaapp.com > Settings > API Keys
+  Run: npx @animaapp/cli login
+  Approve in a browser on any device \u2014 the CLI receives a scoped agent token
+  (stored in ~/.config/anima/). CI/automation can set ANIMA_API_TOKEN instead.
 
 TIMING (important for AI agents):
-  create   \u2192 3-7 minutes (SSE streaming, set timeout to 600000ms)
-  publish  \u2192 1-3 minutes
-  codegen  \u2192 2-5 minutes
-  download \u2192 seconds
+  create        \u2192 3-7 minutes (keep the default 600000ms timeout)
+  publish       \u2192 1-3 minutes
+  codegen       \u2192 2-5 minutes
+  get-git-token \u2192 seconds
   The --timeout default is 600000ms (10 min). Do NOT reduce it.
 
 COMMANDS:
-  create    Create app from prompt, URL, or Figma design
-  publish   Deploy playground to live URL or npm package
-  codegen   Convert Figma design to code files (no playground)
-  download  Download project from an Anima playground
-  auth      Manage authentication (token stored in ~/.config/anima/)
+  login          Log in via the device flow (no browser needed on this machine)
+  logout         Clear all stored credentials from this machine
+  create         Create app from prompt, URL, or Figma design
+  publish        Deploy playground to live URL or npm package
+  codegen        Convert Figma design to code files (no playground)
+  get-git-token  Mint a git remote URL for a playground; clone/edit/push with git
+  config         Store CLI preferences (e.g. a default API URL)
+  auth           Inspect or manage credentials (status / figma token)
 
 EXAMPLES:
-  npx @animaapp/cli auth --token <your-token>
+  npx @animaapp/cli login
   npx @animaapp/cli create -t p2c -p "SaaS dashboard with sidebar and analytics"
   npx @animaapp/cli create -t l2c -u https://stripe.com
   npx @animaapp/cli create -t f2c --file-key abc --nodes 42:15
   npx @animaapp/cli publish abc123xyz
   npx @animaapp/cli codegen --file-key abc --nodes 42:15 -o ./components
-  npx @animaapp/cli download https://dev.animaapp.com/chat/abc123xyz
+  npx @animaapp/cli get-git-token https://dev.animaapp.com/chat/abc123xyz
 
 OUTPUT: JSON to stdout when piped (for AI tools), pretty text in terminals.
   Progress is streamed to stderr via --verbose when in JSON mode.`
-).version("0.1.0", "-v, --version");
+).version(version, "-v, --version");
+program.addCommand(loginCommand);
+program.addCommand(logoutCommand);
 program.addCommand(createCommand);
 program.addCommand(publishCommand);
 program.addCommand(codegenCommand);
-program.addCommand(downloadCommand);
+program.addCommand(getGitTokenCommand);
+program.addCommand(configCommand);
 program.addCommand(authCommand);
 program.parseAsync(process.argv).catch((err) => {
   if (err instanceof CliError) {