@anyforge/control 0.2.0 → 0.2.2

package/README.md

@@ -32,6 +32,10 @@ Pick whichever suits the moment — the choices aren't mutually exclusive over t
 
 > The `.env` written in per-repo mode contains a live `ANYFORGE_API_KEY`. The CLI warns if your repo's `.gitignore` doesn't already exclude `.env`. **Add it before committing.**
 
+### Why `ANTHROPIC_AUTH_TOKEN`, not `ANTHROPIC_API_KEY`?
+
+Claude Code recognises both, but they behave differently. `ANTHROPIC_API_KEY` is sent as `X-Api-Key` and — when an OAuth Console login is also present — surfaces an "Auth conflict: Using ANTHROPIC_API_KEY instead of Anthropic Console key" warning, and can cascade into a "selected model may not exist" error. `ANTHROPIC_AUTH_TOKEN` is sent as `Authorization: Bearer …`, is documented for "routing through an LLM gateway or proxy", out-ranks the OAuth login cleanly, and matches the bearer-token shape AnyForge expects. We patch the token form, and on every install we explicitly delete any stale `ANTHROPIC_API_KEY` left behind by older versions.
+
 ## Commands
 
 | | |

package/dist/commands/init.js

@@ -1,4 +1,5 @@
 import { promises as fs } from 'fs';
+import { homedir } from 'os';
 import { join } from 'path';
 import open from 'open';
 import prompts from 'prompts';
@@ -65,13 +66,32 @@ export async function runInit(opts) {
         // eslint-disable-next-line no-console
         console.log(dim('  Set ANTHROPIC_BASE_URL=' + endpoint + '/v1/anthropic and'));
         // eslint-disable-next-line no-console
-        console.log(dim('  ANTHROPIC_API_KEY=<your AnyForge key> manually if needed.'));
+        console.log(dim('  ANTHROPIC_AUTH_TOKEN=<your AnyForge key> manually if needed.'));
     }
     else {
         summarisePatches(patches);
     }
     // eslint-disable-next-line no-console
     console.log();
+    if (await hasClaudeCodeLogin()) {
+        // Claude Code shows an "Auth conflict" warning when both a /login
+        // credential and an env-token are set — even though the token wins
+        // by precedence (#2 vs #6), the warning is cosmetic-but-loud. The
+        // only way to silence it is to stay logged out: /logout once, then
+        // skip the login prompt on the next launch.
+        // eslint-disable-next-line no-console
+        console.log(yellow('  ⚠ Existing Claude Code login detected (~/.claude/.credentials.json).'));
+        // eslint-disable-next-line no-console
+        console.log(dim('    Claude Code will work, but it will warn that both a token and a'));
+        // eslint-disable-next-line no-console
+        console.log(dim('    /login key are set. To silence the warning:'));
+        // eslint-disable-next-line no-console
+        console.log(dim('      1) run `claude /logout`,'));
+        // eslint-disable-next-line no-console
+        console.log(dim('      2) on the next launch, skip the login prompt (Esc / Ctrl+C).'));
+        // eslint-disable-next-line no-console
+        console.log(dim('    The AnyForge token in settings.local.json is enough on its own.'));
+    }
     if (scope === 'repo') {
         // eslint-disable-next-line no-console
         console.log(dim('  Re-run this command in another repo to patch it too,'));
@@ -112,6 +132,20 @@ async function pollForToken(args) {
     }
     throw new Error('Authorisation timed out (15 min). Re-run `anyforge init`.');
 }
+async function hasClaudeCodeLogin() {
+    // Claude Code's docs document the credentials file at
+    // ~/.claude/.credentials.json (Linux/Windows) or the macOS Keychain.
+    // We can only see the file on Linux/Windows. On macOS the keychain
+    // is invisible to us, so this check is best-effort — false negatives
+    // are fine since the warning is just a hint.
+    try {
+        await fs.access(join(homedir(), '.claude', '.credentials.json'));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 async function isGitRepoRoot(cwd) {
     // git worktrees use a `.git` file pointing at the real gitdir, so
     // accept either a directory or a regular file.

package/dist/lib/configPatch.js

@@ -65,7 +65,12 @@ async function patchClaudeCode(opts) {
     }
     const env = (json.env ?? {});
     env.ANTHROPIC_BASE_URL = `${opts.endpoint}/v1/anthropic`;
-    env.ANTHROPIC_API_KEY = opts.apiKey;
+    env.ANTHROPIC_AUTH_TOKEN = opts.apiKey;
+    // Strip stale ANTHROPIC_API_KEY from prior installs — keeping
+    // both set re-triggers the auth-conflict warning even though
+    // ANTHROPIC_AUTH_TOKEN is what we actually want Claude Code
+    // to use.
+    delete env.ANTHROPIC_API_KEY;
     json.env = env;
     await fs.writeFile(path, JSON.stringify(json, null, 2) + '\n');
     // eslint-disable-next-line no-console
@@ -93,7 +98,7 @@ async function patchRepoEnv(opts) {
         SENTINEL_BEGIN,
         `ANYFORGE_API_KEY=${opts.apiKey}`,
         `ANTHROPIC_BASE_URL=${opts.endpoint}/v1/anthropic`,
-        `ANTHROPIC_API_KEY=${opts.apiKey}`,
+        `ANTHROPIC_AUTH_TOKEN=${opts.apiKey}`,
         `OPENAI_BASE_URL=${opts.endpoint}/v1/openai`,
         `OPENAI_API_KEY=${opts.apiKey}`,
         SENTINEL_END,
@@ -177,9 +182,10 @@ async function ensureShellRcExports(opts) {
         SENTINEL_BEGIN,
         `export ANYFORGE_API_KEY="${opts.apiKey}"`,
         `export ANTHROPIC_BASE_URL="${opts.endpoint}/v1/anthropic"`,
-        `export ANTHROPIC_API_KEY="${opts.apiKey}"`,
+        `export ANTHROPIC_AUTH_TOKEN="${opts.apiKey}"`,
         `export OPENAI_BASE_URL="${opts.endpoint}/v1/openai"`,
         `export OPENAI_API_KEY="${opts.apiKey}"`,
+        `unset ANTHROPIC_API_KEY 2>/dev/null || true`,
         SENTINEL_END,
         '',
     ].join('\n');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anyforge/control",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "AnyForge Control CLI — governed LLM proxy for Claude Code, Cursor, Cline, and any agent that talks to OpenAI- or Anthropic-shape APIs.",
   "license": "Apache-2.0",
   "homepage": "https://anyforge.ai",