@anyship/cli 0.1.0 → 0.2.0

package/README.md

@@ -21,15 +21,24 @@ never hand-pick files.
 
 ### `anyship login`
 
-Validate an `anyship_sk_…` key against the control plane and store it in
-`~/.anyship/config.json` (mode `0600`). After this, `deploy` and `mcp`
-authenticate automatically — no `--env`, no token in your shell history.
+Run **`anyship login`** with no arguments and it opens your browser to sign in
+(OAuth) — the same login you use for the anyship connector, no key required. It
+stores the resulting token in `~/.anyship/config.json` (mode `0600`), refreshing
+it automatically. This is the common path now that most people connect with
+browser login.
+
+Prefer an API key (CI, scripts)? Pass one and it's validated + stored instead:
 
 ```bash
-anyship login --key anyship_sk_…      # or: echo $KEY | anyship login --with-token
-anyship logout                        # remove stored credentials
+anyship login                          # browser login (OAuth) — no key
+anyship login --key anyship_sk_…       # or an API key: echo $KEY | anyship login --with-token
+anyship logout                         # remove stored credentials
 ```
 
+`deploy` and `mcp` then authenticate automatically. If neither a key nor a stored
+token is present, `deploy` triggers the browser login on first use; the `mcp`
+server uses only stored auth (run `anyship login` once first).
+
 ### `anyship deploy [path]`
 
 Archive and deploy a project directory (defaults to `.`). anyship detects the
@@ -60,11 +69,14 @@ files and never handles your API key.
 
 ## Configuration
 
-Key and control-plane URL resolve in this order:
+Auth resolves in this order — an **API key** if you have one, otherwise **OAuth**:
 
-1. explicit flag (`--key` / `--api`)
-2. environment (`ANYSHIP_API_KEY` / `ANYSHIP_API_URL`)
-3. stored login (`~/.anyship/config.json`)
+1. `--key` flag
+2. `ANYSHIP_API_KEY` env
+3. a stored API key (`~/.anyship/config.json`)
 4. an `mcp_servers.anyship` entry in `~/.codex/config.toml`
+5. a stored **OAuth token** (`~/.anyship/config.json`, auto-refreshed)
+6. otherwise → browser login (interactive commands only)
 
-Requires Node.js 18+.
+The control-plane URL comes from `--api`, `ANYSHIP_API_URL`, the stored config, or
+the default. Requires Node.js 18+.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anyship/cli",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "anyship CLI — deploy a local project directory, run a local MCP server for AI agents, and log in.",
   "type": "module",
   "bin": {

package/src/config.mjs

@@ -13,13 +13,12 @@ export function anyshipConfigPath(home = homedir()) {
   return join(anyshipConfigDir(home), "config.json");
 }
 
+// Returns the whole stored object (apiKey, apiUrl, oauth, …) so writes preserve
+// every field — the OAuth token block must survive an apiKey/apiUrl patch.
 export function readAnyshipConfig(home = homedir()) {
   try {
     const parsed = JSON.parse(readFileSync(anyshipConfigPath(home), "utf8"));
-    return {
-      apiKey: typeof parsed.apiKey === "string" ? parsed.apiKey : undefined,
-      apiUrl: typeof parsed.apiUrl === "string" ? parsed.apiUrl : undefined,
-    };
+    return parsed && typeof parsed === "object" ? parsed : {};
   } catch {
     return {};
   }

package/src/deploy-directory.mjs

@@ -5,6 +5,7 @@ import { homedir } from "node:os";
 import { basename, join, relative, resolve } from "node:path";
 import { zipSync } from "fflate";
 import { readAnyshipConfig } from "./config.mjs";
+import { browserLogin, storedAccessToken } from "./oauth.mjs";
 
 export const DEFAULT_API = "https://drydock.anyship.workers.dev";
 
@@ -130,6 +131,25 @@ export function apiUrl(args, config = codexAnyshipConfig(), stored = readAnyship
   ).replace(/\/+$/, "");
 }
 
+// Bearer for control-plane calls. Precedence: an API key (flag / env / stored /
+// codex config) → a stored OAuth token (refreshed if expiring) → an interactive
+// browser login. The no-key OAuth path is the common one now that most users
+// connect anyship with browser login. Pass opts.interactive === false to fail
+// instead of opening a browser (CI / non-interactive).
+export async function resolveBearer(args, io, opts = {}) {
+  const stored = readAnyshipConfig(opts.home);
+  const key = apiKey(args, undefined, stored);
+  if (key) return key;
+  const api = apiUrl(args, undefined, stored);
+  const existing = await storedAccessToken(api, { home: opts.home, fetch: opts.fetch });
+  if (existing) return existing;
+  if (opts.interactive === false) {
+    throw new Error("not authenticated — set ANYSHIP_API_KEY or run `anyship login`");
+  }
+  const oauth = await browserLogin(api, io, { home: opts.home, fetch: opts.fetch });
+  return oauth.accessToken;
+}
+
 function pathParts(rel) {
   return rel.replace(/\\/g, "/").split("/").filter(Boolean);
 }
@@ -220,12 +240,9 @@ export async function deployDirectory(args, hooks = {}) {
 
   if (args.dryRun) return { dryRun: true, ...summary };
 
-  const config = codexAnyshipConfig();
-  const key = apiKey(args, config);
-  if (!key) {
-    throw new Error("missing Anyship API key; set ANYSHIP_API_KEY or configure global mcp_servers.anyship");
-  }
-  const api = apiUrl(args, config);
+  const api = apiUrl(args);
+  const io = hooks.io ?? { stdout: () => {}, stderr: (t) => process.stderr.write(`${t}\n`) };
+  const token = await resolveBearer(args, io, { interactive: hooks.interactive });
   hooks.onUpload?.({ ...summary, api });
 
   const form = new FormData();
@@ -235,7 +252,7 @@ export async function deployDirectory(args, hooks = {}) {
 
   const res = await fetch(`${api}/api/deploy-from-archive`, {
     method: "POST",
-    headers: { Authorization: `Bearer ${key}` },
+    headers: { Authorization: `Bearer ${token}` },
     body: form,
   });
   const text = await res.text();

package/src/login.mjs

@@ -4,6 +4,7 @@
 // no --env and no token in shell history.
 import { createInterface } from "node:readline";
 import { DEFAULT_API } from "./deploy-directory.mjs";
+import { browserLogin } from "./oauth.mjs";
 import {
   anyshipConfigPath,
   clearAnyshipConfig,
@@ -66,17 +67,17 @@ function promptSecret(query, input, output) {
   });
 }
 
+// An explicitly-supplied key (flag / env / piped). Returns "" when none — that's
+// the signal to fall back to browser-login OAuth.
 async function resolveKey(args, deps) {
   if (args.key) return args.key.trim();
+  if (process.env.ANYSHIP_API_KEY) return process.env.ANYSHIP_API_KEY.trim();
   const input = deps.input ?? process.stdin;
-  const output = deps.output ?? process.stdout;
   // Piped input (scripts, `echo $KEY | anyship login --with-token`).
   if (args.withToken || !input.isTTY) {
     const piped = await readAll(input);
     if (piped.trim()) return piped.trim();
   }
-  // Interactive, hidden.
-  if (input.isTTY) return (await promptSecret("Paste your anyship API key (anyship_sk_…): ", input, output)).trim();
   return "";
 }
 
@@ -108,13 +109,19 @@ export async function runLogin(argv, io = defaultIo(), deps = {}) {
     io.stdout(loginUsage());
     return 0;
   }
+  const api = (args.api || process.env.ANYSHIP_API_URL || readAnyshipConfig(deps.home).apiUrl || DEFAULT_API).replace(/\/+$/, "");
   const key = await resolveKey(args, deps);
-  if (!key) throw new Error("no API key provided — pass --key, pipe it with --with-token, or run interactively");
+
+  // No key supplied → browser-login OAuth (the common case). A key → validate + store.
+  if (!key) {
+    await browserLogin(api, io, deps);
+    io.stdout("✅ Signed in to anyship. `anyship deploy` and `anyship mcp` are now authenticated.");
+    return 0;
+  }
+
   if (!/^anyship_sk_/.test(key)) {
     io.stderr("warning: keys usually start with 'anyship_sk_'; continuing anyway");
   }
-  const api = (args.api || process.env.ANYSHIP_API_URL || readAnyshipConfig(deps.home).apiUrl || DEFAULT_API).replace(/\/+$/, "");
-
   const who = await validateKey(api, key, deps.fetch ?? fetch);
   // Only persist a non-default URL so the default can still shift centrally.
   const patch = { apiKey: key };

package/src/mcp-server.mjs

@@ -10,6 +10,7 @@
 // whatever tools the platform exposes — only `deploy` is handled locally.
 
 import { deployDirectory, apiKey, apiUrl, codexAnyshipConfig } from "./deploy-directory.mjs";
+import { storedAccessToken } from "./oauth.mjs";
 import { createInterface } from "node:readline";
 import { resolve } from "node:path";
 
@@ -51,15 +52,28 @@ const LOCAL_DEPLOY_TOOL = {
 // limitation — irrelevant here, where deploy reads the disk directly.
 const LOCAL_OVERRIDDEN = new Set(["deploy", "deploy_archive", "cli_instructions"]);
 
-// Forward a JSON-RPC call to the remote control-plane /mcp with the stored key.
+// Bearer for the remote proxy: an API key (test-injected, env, stored, or codex
+// config) or a stored OAuth token from a prior `anyship login`. This background
+// server never opens a browser — the user authenticates once with `anyship login`
+// (which does the browser flow); here we only use what's already stored.
+async function remoteBearer(deps) {
+  const config = deps.config ?? codexAnyshipConfig();
+  const key = deps.apiKey ? deps.apiKey({}, config) : apiKey({}, config);
+  if (key) return key;
+  const api = deps.apiUrl ? deps.apiUrl({}, config) : apiUrl({}, config);
+  const oauthTok = await storedAccessToken(api);
+  if (oauthTok) return oauthTok;
+  throw new Error("not authenticated — run `anyship login` first");
+}
+
+// Forward a JSON-RPC call to the remote control-plane /mcp.
 async function remoteProxy(method, params, deps) {
   const config = deps.config ?? codexAnyshipConfig();
-  const api = deps.apiUrl?.({}, config) ?? apiUrl({}, config);
-  const key = deps.apiKey?.({}, config) ?? apiKey({}, config);
-  if (!key) throw new Error("missing Anyship API key; start this server with ANYSHIP_API_KEY set");
+  const api = deps.apiUrl ? deps.apiUrl({}, config) : apiUrl({}, config);
+  const token = await remoteBearer(deps);
   const res = await (deps.fetch ?? fetch)(`${api}/mcp`, {
     method: "POST",
-    headers: { Authorization: `Bearer ${key}`, "Content-Type": "application/json" },
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
     body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params }),
   });
   const data = await res.json().catch(() => null);
@@ -76,7 +90,7 @@ async function localDeploy(args, deps) {
       ? JSON.stringify(args.env)
       : undefined;
   const runDeploy = deps.deployDirectory ?? deployDirectory;
-  const result = await runDeploy({ project, path, env });
+  const result = await runDeploy({ project, path, env }, { interactive: false });
   const root = resolve(path);
   const message = result?.response?.message ?? "Deploying. Poll deployment_status for progress.";
   const depId = result?.response?.deployment?.id;

package/src/oauth.mjs

@@ -0,0 +1,162 @@
+// Browser-login OAuth for the CLI — the same flow an MCP client runs, so a user
+// who connected anyship with browser login (no API key) can also use the CLI.
+// Loopback Authorization Code + PKCE: discover the auth server, dynamically
+// register, open the browser, catch the redirect on 127.0.0.1, exchange the code
+// for tokens, and store them in ~/.anyship/config.json. Refreshes on expiry.
+import { createServer } from "node:http";
+import { createHash, randomBytes } from "node:crypto";
+import { spawn } from "node:child_process";
+import { readAnyshipConfig, writeAnyshipConfig } from "./config.mjs";
+
+const b64url = (b) => Buffer.from(b).toString("base64url");
+
+async function discover(api, fetchImpl) {
+  const res = await fetchImpl(`${api}/.well-known/oauth-authorization-server`);
+  if (!res.ok) throw new Error(`OAuth discovery failed at ${api} (HTTP ${res.status})`);
+  const meta = await res.json();
+  if (!meta?.authorization_endpoint || !meta?.token_endpoint || !meta?.registration_endpoint) {
+    throw new Error(`${api} does not advertise the OAuth endpoints needed for login`);
+  }
+  return meta;
+}
+
+function openBrowser(url) {
+  const p = process.platform;
+  const [cmd, args] =
+    p === "darwin" ? ["open", [url]] : p === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  try {
+    spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
+  } catch {
+    /* headless / no browser — the URL is printed for manual use */
+  }
+}
+
+// Loopback server on an ephemeral port; resolves with the OAuth redirect params.
+function startCallbackServer() {
+  return new Promise((resolve) => {
+    let resolveCode;
+    const waitForCode = new Promise((r) => (resolveCode = r));
+    const server = createServer((req, res) => {
+      const u = new URL(req.url, "http://127.0.0.1");
+      if (u.pathname !== "/callback") {
+        res.writeHead(404);
+        res.end();
+        return;
+      }
+      res.writeHead(200, { "content-type": "text/html" });
+      res.end(
+        "<!doctype html><body style='font:16px/1.5 system-ui;text-align:center;padding:48px'>" +
+          "<h2>anyship — signed in ✓</h2><p>You can close this tab and return to your terminal.</p>",
+      );
+      resolveCode({ code: u.searchParams.get("code"), state: u.searchParams.get("state") });
+    });
+    server.listen(0, "127.0.0.1", () => resolve({ server, port: server.address().port, waitForCode }));
+  });
+}
+
+// Run the full interactive browser login and persist the tokens. Returns the
+// stored oauth block.
+export async function browserLogin(api, io = defaultIo(), deps = {}) {
+  const fetchImpl = deps.fetch ?? fetch;
+  const meta = await discover(api, fetchImpl);
+
+  const { server, port, waitForCode } = await startCallbackServer();
+  const redirectUri = `http://127.0.0.1:${port}/callback`;
+  try {
+    const reg = await fetchImpl(meta.registration_endpoint, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        client_name: "Anyship CLI",
+        redirect_uris: [redirectUri],
+        token_endpoint_auth_method: "none",
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+      }),
+    });
+    const client = await reg.json().catch(() => null);
+    if (!client?.client_id) throw new Error("OAuth client registration failed");
+
+    const verifier = b64url(randomBytes(32));
+    const challenge = b64url(createHash("sha256").update(verifier).digest());
+    const state = b64url(randomBytes(16));
+    const authUrl = `${meta.authorization_endpoint}?${new URLSearchParams({
+      response_type: "code",
+      client_id: client.client_id,
+      redirect_uri: redirectUri,
+      scope: "openid profile email offline_access",
+      state,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+    })}`;
+    io.stderr(`Opening your browser to sign in to anyship…\nIf it doesn't open, visit:\n  ${authUrl}`);
+    openBrowser(authUrl);
+
+    const got = await waitForCode;
+    if (got.state !== state) throw new Error("OAuth state mismatch — aborting");
+    if (!got.code) throw new Error("no authorization code returned");
+
+    const tok = await fetchImpl(meta.token_endpoint, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        code: got.code,
+        redirect_uri: redirectUri,
+        client_id: client.client_id,
+        code_verifier: verifier,
+      }).toString(),
+    });
+    const t = await tok.json().catch(() => null);
+    if (!t?.access_token) throw new Error("token exchange failed");
+
+    const oauth = {
+      apiUrl: api,
+      clientId: client.client_id,
+      accessToken: t.access_token,
+      refreshToken: t.refresh_token || null,
+      expiresAt: t.expires_in ? Date.now() + t.expires_in * 1000 : null,
+    };
+    writeAnyshipConfig({ oauth }, deps.home);
+    io.stderr("Signed in to anyship.");
+    return oauth;
+  } finally {
+    server.close();
+  }
+}
+
+// Return a valid stored access token (refreshing if near expiry), or null if
+// there's no usable OAuth token for this api.
+export async function storedAccessToken(api, deps = {}) {
+  const oauth = readAnyshipConfig(deps.home).oauth;
+  if (!oauth?.accessToken || oauth.apiUrl !== api) return null;
+  if (!oauth.expiresAt || oauth.expiresAt - Date.now() > 60_000) return oauth.accessToken;
+  if (!oauth.refreshToken) return null;
+
+  const fetchImpl = deps.fetch ?? fetch;
+  const meta = await discover(api, fetchImpl).catch(() => null);
+  if (!meta?.token_endpoint) return null;
+  const res = await fetchImpl(meta.token_endpoint, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: oauth.refreshToken,
+      client_id: oauth.clientId,
+    }).toString(),
+  }).catch(() => null);
+  const t = res && (await res.json().catch(() => null));
+  if (!t?.access_token) return null;
+  const updated = {
+    ...oauth,
+    accessToken: t.access_token,
+    refreshToken: t.refresh_token || oauth.refreshToken,
+    expiresAt: t.expires_in ? Date.now() + t.expires_in * 1000 : null,
+  };
+  writeAnyshipConfig({ oauth: updated }, deps.home);
+  return updated.accessToken;
+}
+
+function defaultIo() {
+  return { stdout: (t) => console.log(t), stderr: (t) => console.error(t) };
+}