@anyship/cli 0.1.0

package/README.md

@@ -0,0 +1,70 @@
+# @anyship/cli
+
+Command-line companion for [anyship](https://anyship.dev) — deploy a local
+project directory to a live URL, or run a local MCP server so an AI agent (Claude
+Code, Codex) can deploy directories directly.
+
+```bash
+npx @anyship/cli login          # save your anyship API key (validated + stored 0600)
+npx @anyship/cli deploy .        # deploy the current directory
+```
+
+## Why a local CLI
+
+anyship's control plane is a remote service — it can't read your disk. This CLI
+runs on your machine, so it gathers your project itself: it uses `git ls-files`
+(respecting `.gitignore`) and uploads everything that isn't ignored, excluding
+`node_modules`, build output, caches, `.env` files, and local databases. You
+never hand-pick files.
+
+## Commands
+
+### `anyship login`
+
+Validate an `anyship_sk_…` key against the control plane and store it in
+`~/.anyship/config.json` (mode `0600`). After this, `deploy` and `mcp`
+authenticate automatically — no `--env`, no token in your shell history.
+
+```bash
+anyship login --key anyship_sk_…      # or: echo $KEY | anyship login --with-token
+anyship logout                        # remove stored credentials
+```
+
+### `anyship deploy [path]`
+
+Archive and deploy a project directory (defaults to `.`). anyship detects the
+stack, builds if needed, and returns a live URL.
+
+```bash
+anyship deploy --project my-app .
+anyship deploy --project my-app . --dry-run   # list what would be uploaded
+```
+
+Options: `--project <name>`, `--api <url>`, `--key <token>`, `--env <json>`,
+`--dry-run`, `--json`.
+
+### `anyship mcp`
+
+Run a local [MCP](https://modelcontextprotocol.io) server over stdio. Its
+`deploy` tool takes a **directory path** and gathers the files for you; every
+other tool (`list_projects`, `deployment_status`, `add_domain`, `logs`, …) is
+proxied to the control plane. Add it to Claude Code:
+
+```bash
+anyship login
+claude mcp add anyship -- npx -y @anyship/cli mcp
+```
+
+Then in any conversation: **"deploy this to anyship."** The agent never selects
+files and never handles your API key.
+
+## Configuration
+
+Key and control-plane URL resolve in this order:
+
+1. explicit flag (`--key` / `--api`)
+2. environment (`ANYSHIP_API_KEY` / `ANYSHIP_API_URL`)
+3. stored login (`~/.anyship/config.json`)
+4. an `mcp_servers.anyship` entry in `~/.codex/config.toml`
+
+Requires Node.js 18+.

package/bin/anyship.mjs

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import { runCli } from "../src/index.mjs";
+
+try {
+  const code = await runCli(process.argv.slice(2));
+  process.exitCode = code;
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+}

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@anyship/cli",
+  "version": "0.1.0",
+  "description": "anyship CLI — deploy a local project directory, run a local MCP server for AI agents, and log in.",
+  "type": "module",
+  "bin": {
+    "anyship": "./bin/anyship.mjs"
+  },
+  "exports": {
+    ".": "./src/index.mjs"
+  },
+  "files": [
+    "bin",
+    "src"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "anyship",
+    "deploy",
+    "cloudflare",
+    "mcp",
+    "cli"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/anyship/drydock.git",
+    "directory": "packages/cli"
+  },
+  "homepage": "https://github.com/anyship/drydock/tree/main/packages/cli#readme",
+  "bugs": {
+    "url": "https://github.com/anyship/drydock/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "fflate": "^0.8.2"
+  }
+}

package/src/config.mjs

@@ -0,0 +1,50 @@
+// Stored anyship credentials: `~/.anyship/config.json` (0600). Written by
+// `anyship login`, read by `deploy` and the local MCP server so the key the user
+// logged in with "just works" — no --env, no token pasted per command.
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, chmodSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+export function anyshipConfigDir(home = homedir()) {
+  return join(home, ".anyship");
+}
+
+export function anyshipConfigPath(home = homedir()) {
+  return join(anyshipConfigDir(home), "config.json");
+}
+
+export function readAnyshipConfig(home = homedir()) {
+  try {
+    const parsed = JSON.parse(readFileSync(anyshipConfigPath(home), "utf8"));
+    return {
+      apiKey: typeof parsed.apiKey === "string" ? parsed.apiKey : undefined,
+      apiUrl: typeof parsed.apiUrl === "string" ? parsed.apiUrl : undefined,
+    };
+  } catch {
+    return {};
+  }
+}
+
+export function writeAnyshipConfig(patch, home = homedir()) {
+  const dir = anyshipConfigDir(home);
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const path = anyshipConfigPath(home);
+  const merged = { ...readAnyshipConfig(home), ...patch };
+  for (const key of Object.keys(merged)) {
+    if (merged[key] == null) delete merged[key];
+  }
+  writeFileSync(path, `${JSON.stringify(merged, null, 2)}\n`, { mode: 0o600 });
+  // writeFileSync's mode only applies on create; force it in case the file existed.
+  try {
+    chmodSync(path, 0o600);
+  } catch {
+    /* best effort (e.g. Windows) */
+  }
+  return path;
+}
+
+export function clearAnyshipConfig(home = homedir()) {
+  if (!existsSync(anyshipConfigPath(home))) return false;
+  rmSync(anyshipConfigPath(home));
+  return true;
+}

package/src/deploy-directory.mjs

@@ -0,0 +1,316 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { readFile, readdir, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { basename, join, relative, resolve } from "node:path";
+import { zipSync } from "fflate";
+import { readAnyshipConfig } from "./config.mjs";
+
+export const DEFAULT_API = "https://drydock.anyship.workers.dev";
+
+export const EXCLUDED_DIRS = new Set([
+  ".git",
+  ".codex",
+  ".agents",
+  ".wrangler",
+  "node_modules",
+  "dist",
+  "build",
+  ".next",
+  ".svelte-kit",
+  ".output",
+  ".vite",
+  ".turbo",
+  ".cache",
+  "coverage",
+]);
+
+export function deployUsage(commandName = "anyship deploy") {
+  return `Usage: ${commandName} --project <name> [path]
+
+Options:
+  --project <name>   anyship project name
+  --api <url>        control-plane URL (defaults to ~/.codex/config.toml, ANYSHIP_API_URL, or ${DEFAULT_API})
+  --key <token>      anyship API key (defaults to ANYSHIP_API_KEY or ~/.codex/config.toml)
+  --env <json>       JSON object of env vars/secrets to merge for the project
+  --dry-run          Print the files that would be archived without uploading
+  --json             Print dry-run output as JSON
+
+The archive uses git ls-files when available, respects .gitignore, and excludes
+node_modules/build outputs/caches/secrets/local DB files.`;
+}
+
+export function parseDeployArgs(argv) {
+  const args = { path: "." };
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--help" || arg === "-h") {
+      args.help = true;
+      continue;
+    }
+    if (arg === "--dry-run") {
+      args.dryRun = true;
+      continue;
+    }
+    if (arg === "--json") {
+      args.json = true;
+      continue;
+    }
+    if (arg === "--project") {
+      args.project = requiredValue(argv, i, arg);
+      i += 1;
+      continue;
+    }
+    if (arg === "--api") {
+      args.api = requiredValue(argv, i, arg);
+      i += 1;
+      continue;
+    }
+    if (arg === "--key") {
+      args.key = requiredValue(argv, i, arg);
+      i += 1;
+      continue;
+    }
+    if (arg === "--env") {
+      args.env = requiredValue(argv, i, arg);
+      i += 1;
+      continue;
+    }
+    if (!arg.startsWith("-")) {
+      args.path = arg;
+      continue;
+    }
+    throw new Error(`unknown argument: ${arg}`);
+  }
+  if (!args.help && !args.project) throw new Error("--project is required");
+  return args;
+}
+
+function requiredValue(argv, index, flag) {
+  const value = argv[index + 1];
+  if (!value || value.startsWith("--")) throw new Error(`${flag} requires a value`);
+  return value;
+}
+
+export function codexAnyshipConfig(home = homedir()) {
+  const configPath = join(home, ".codex", "config.toml");
+  if (!existsSync(configPath)) return {};
+  const lines = readFileSync(configPath, "utf8").split(/\n/);
+  const start = lines.findIndex((line) => /^\[mcp_servers\.("?anyship"?)\]\s*$/.test(line.trim()));
+  if (start < 0) return {};
+  const section = [];
+  for (let i = start; i < lines.length; i += 1) {
+    if (i !== start && lines[i].trim().startsWith("[")) break;
+    section.push(lines[i]);
+  }
+  const text = section.join("\n");
+  const url = text.match(/url\s*=\s*"([^"]+)"/)?.[1]?.replace(/\/mcp\/?$/, "");
+  const token = text.match(/Bearer ([^"]+)/)?.[1]?.trim();
+  return { url, token };
+}
+
+export function apiKey(args, config = codexAnyshipConfig(), stored = readAnyshipConfig()) {
+  return (
+    args.key ||
+    process.env.ANYSHIP_API_KEY ||
+    process.env.ANYSHP_API_KEY ||
+    stored.apiKey ||
+    config.token ||
+    ""
+  );
+}
+
+export function apiUrl(args, config = codexAnyshipConfig(), stored = readAnyshipConfig()) {
+  return (
+    args.api ||
+    process.env.ANYSHIP_API_URL ||
+    stored.apiUrl ||
+    config.url ||
+    DEFAULT_API
+  ).replace(/\/+$/, "");
+}
+
+function pathParts(rel) {
+  return rel.replace(/\\/g, "/").split("/").filter(Boolean);
+}
+
+function inExcludedDir(rel) {
+  return pathParts(rel).some((part) => EXCLUDED_DIRS.has(part));
+}
+
+function isSecretEnv(rel) {
+  const base = basename(rel);
+  return base === ".env" || (base.startsWith(".env.") && base !== ".env.example");
+}
+
+function isLocalDb(rel) {
+  return /\.(sqlite|sqlite3|db|db3)(?:-(?:wal|shm))?$/i.test(basename(rel));
+}
+
+export function isIncluded(rel) {
+  if (!rel || rel.startsWith("..") || inExcludedDir(rel)) return false;
+  if (isSecretEnv(rel)) return false;
+  if (isLocalDb(rel)) return false;
+  if (rel.endsWith(".log")) return false;
+  return true;
+}
+
+export function gitFiles(root) {
+  try {
+    execFileSync("git", ["rev-parse", "--is-inside-work-tree"], {
+      cwd: root,
+      stdio: ["ignore", "ignore", "ignore"],
+    });
+    const out = execFileSync("git", ["ls-files", "-co", "--exclude-standard"], {
+      cwd: root,
+      encoding: "utf8",
+    });
+    return out.split("\n").map((s) => s.trim()).filter(Boolean);
+  } catch {
+    return null;
+  }
+}
+
+export async function walkFiles(root, dir = root, out = []) {
+  for (const entry of await readdir(dir, { withFileTypes: true })) {
+    const abs = join(dir, entry.name);
+    const rel = relative(root, abs);
+    if (!isIncluded(rel)) continue;
+    if (entry.isDirectory()) await walkFiles(root, abs, out);
+    else if (entry.isFile()) out.push(rel);
+  }
+  return out;
+}
+
+export async function sourceFiles(root) {
+  const fromGit = gitFiles(root);
+  const files = fromGit ?? await walkFiles(root);
+  return files.filter(isIncluded).sort();
+}
+
+export async function buildZip(root) {
+  const files = await sourceFiles(root);
+  if (files.length === 0) throw new Error("no source files found");
+  const entries = {};
+  let total = 0;
+  for (const rel of files) {
+    const abs = join(root, rel);
+    const st = await stat(abs).catch(() => null);
+    if (!st?.isFile()) continue;
+    const bytes = new Uint8Array(await readFile(abs));
+    entries[rel] = bytes;
+    total += bytes.length;
+  }
+  const includedFiles = Object.keys(entries).sort();
+  if (includedFiles.length === 0) throw new Error("no source files found after filtering");
+  return { zip: zipSync(entries), files: includedFiles, total };
+}
+
+export async function deployDirectory(args, hooks = {}) {
+  const root = resolve(args.path ?? ".");
+  const { zip, files, total } = await buildZip(root);
+  const summary = {
+    project: args.project,
+    root,
+    files,
+    fileCount: files.length,
+    sourceBytes: total,
+    archiveBytes: zip.length,
+  };
+
+  if (args.dryRun) return { dryRun: true, ...summary };
+
+  const config = codexAnyshipConfig();
+  const key = apiKey(args, config);
+  if (!key) {
+    throw new Error("missing Anyship API key; set ANYSHIP_API_KEY or configure global mcp_servers.anyship");
+  }
+  const api = apiUrl(args, config);
+  hooks.onUpload?.({ ...summary, api });
+
+  const form = new FormData();
+  form.append("project", args.project);
+  if (args.env) form.append("env", args.env);
+  form.append("file", new Blob([zip], { type: "application/zip" }), `${basename(root) || "source"}.zip`);
+
+  const res = await fetch(`${api}/api/deploy-from-archive`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${key}` },
+    body: form,
+  });
+  const text = await res.text();
+  const data = parseJson(text);
+  if (!res.ok) {
+    throw new Error(apiErrorMessage(res.status, data, text));
+  }
+  return { dryRun: false, ...summary, api, response: data ?? text };
+}
+
+export function apiErrorMessage(status, data, text = "") {
+  if (data && Array.isArray(data.missingEnv) && data.missingEnv.length > 0) {
+    const missing = data.missingEnv
+      .map((item) => {
+        const name = typeof item?.name === "string" ? item.name : "";
+        const hint = typeof item?.hint === "string" ? item.hint : "";
+        if (!name) return null;
+        return `  ${name}${hint ? ` - ${hint}` : ""}`;
+      })
+      .filter(Boolean);
+    return [
+      data.message || data.error || `upload failed (${status})`,
+      "",
+      "Missing environment variables:",
+      ...missing,
+      "",
+      "Re-run with --env '{\"NAME\":\"value\"}' or configure those variables on the project.",
+    ].join("\n");
+  }
+  return data?.error || data?.message || text || `upload failed (${status})`;
+}
+
+function parseJson(text) {
+  if (!text) return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
+}
+
+export async function runDeploy(argv, io = defaultIo(), options = {}) {
+  const commandName = options.commandName ?? "anyship deploy";
+  const args = parseDeployArgs(argv);
+  if (args.help) {
+    io.stdout(deployUsage(commandName));
+    return 0;
+  }
+  const result = await deployDirectory(args, {
+    onUpload: (summary) => {
+      io.stderr(
+        `Uploading ${summary.fileCount} files (${summary.sourceBytes} source bytes, ${summary.archiveBytes} zipped) from ${summary.root}`,
+      );
+    },
+  });
+  if (result.dryRun) {
+    io.stdout(args.json ? JSON.stringify(result, null, 2) : formatDryRun(result));
+  } else {
+    io.stdout(JSON.stringify(result.response, null, 2));
+  }
+  return 0;
+}
+
+function formatDryRun(result) {
+  return [
+    `Dry run for "${result.project}" from ${result.root}`,
+    `${result.fileCount} files, ${result.sourceBytes} source bytes, ${result.archiveBytes} zipped`,
+    "",
+    ...result.files.map((file) => `  ${file}`),
+  ].join("\n");
+}
+
+function defaultIo() {
+  return {
+    stdout: (text) => console.log(text),
+    stderr: (text) => console.error(text),
+  };
+}

package/src/index.mjs

@@ -0,0 +1,46 @@
+import { runDeploy } from "./deploy-directory.mjs";
+import { runMcpServer } from "./mcp-server.mjs";
+import { runLogin, runLogout } from "./login.mjs";
+
+export function usage(commandName = "anyship") {
+  return `Usage: ${commandName} <command>
+
+Commands:
+  login    Save your anyship API key so deploy/mcp authenticate automatically
+  logout   Remove stored credentials
+  deploy   Upload a complete safe source archive and deploy it to anyship
+  mcp      Run a local MCP server (stdio) so an AI agent can deploy directories directly
+
+Run "${commandName} <command> --help" for command options.`;
+}
+
+export async function runCli(argv, io = defaultIo()) {
+  const [command, ...rest] = argv;
+  if (!command || command === "--help" || command === "-h" || command === "help") {
+    io.stdout(usage());
+    return 0;
+  }
+  if (command === "login") {
+    return runLogin(rest, io);
+  }
+  if (command === "logout") {
+    return runLogout(rest, io);
+  }
+  if (command === "deploy") {
+    return runDeploy(rest, io, { commandName: "anyship deploy" });
+  }
+  if (command === "mcp") {
+    // Long-lived: reads JSON-RPC on stdin, writes on stdout. Configured in a
+    // client via `claude mcp add anyship -- npx -y @anyship/cli mcp` (after
+    // `anyship login`, no --env needed).
+    return runMcpServer();
+  }
+  throw new Error(`unknown command: ${command}`);
+}
+
+function defaultIo() {
+  return {
+    stdout: (text) => console.log(text),
+    stderr: (text) => console.error(text),
+  };
+}

package/src/login.mjs

@@ -0,0 +1,140 @@
+// `anyship login` / `anyship logout`. Login validates an anyship_sk_… key against
+// the control plane (via the API-key-authenticated /mcp `whoami`) and stores it
+// in ~/.anyship/config.json, so `deploy` and the local MCP server pick it up with
+// no --env and no token in shell history.
+import { createInterface } from "node:readline";
+import { DEFAULT_API } from "./deploy-directory.mjs";
+import {
+  anyshipConfigPath,
+  clearAnyshipConfig,
+  readAnyshipConfig,
+  writeAnyshipConfig,
+} from "./config.mjs";
+
+export function loginUsage(commandName = "anyship login") {
+  return `Usage: ${commandName} [options]
+
+Options:
+  --key <token>    anyship API key (anyship_sk_…); omit to read from stdin or a prompt
+  --with-token     read the key from stdin (for scripts / piping)
+  --api <url>      control-plane URL (defaults to ANYSHIP_API_URL or ${DEFAULT_API})
+
+Validates the key and saves it to ~/.anyship/config.json (0600). After this,
+\`anyship deploy\` and \`anyship mcp\` authenticate automatically.`;
+}
+
+export function parseLoginArgs(argv) {
+  const args = {};
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--help" || arg === "-h") args.help = true;
+    else if (arg === "--with-token") args.withToken = true;
+    else if (arg === "--key") args.key = requiredValue(argv, (i += 1), arg);
+    else if (arg === "--api") args.api = requiredValue(argv, (i += 1), arg);
+    else throw new Error(`unknown argument: ${arg}`);
+  }
+  return args;
+}
+
+function requiredValue(argv, index, flag) {
+  const value = argv[index];
+  if (!value || value.startsWith("--")) throw new Error(`${flag} requires a value`);
+  return value;
+}
+
+function readAll(stream) {
+  return new Promise((resolve, reject) => {
+    let data = "";
+    stream.setEncoding?.("utf8");
+    stream.on("data", (chunk) => (data += chunk));
+    stream.on("end", () => resolve(data));
+    stream.on("error", reject);
+  });
+}
+
+// Prompt for the key without echoing it to the terminal.
+function promptSecret(query, input, output) {
+  return new Promise((resolve) => {
+    const rl = createInterface({ input, output, terminal: true });
+    output.write(query);
+    rl._writeToOutput = () => {}; // mute keystroke echo
+    rl.question("", (answer) => {
+      output.write("\n");
+      rl.close();
+      resolve(answer);
+    });
+  });
+}
+
+async function resolveKey(args, deps) {
+  if (args.key) return args.key.trim();
+  const input = deps.input ?? process.stdin;
+  const output = deps.output ?? process.stdout;
+  // Piped input (scripts, `echo $KEY | anyship login --with-token`).
+  if (args.withToken || !input.isTTY) {
+    const piped = await readAll(input);
+    if (piped.trim()) return piped.trim();
+  }
+  // Interactive, hidden.
+  if (input.isTTY) return (await promptSecret("Paste your anyship API key (anyship_sk_…): ", input, output)).trim();
+  return "";
+}
+
+// Validate a key by calling the API-key-authenticated /mcp `whoami`. Returns the
+// human-readable account line, or throws with an actionable message.
+export async function validateKey(api, key, fetchImpl = fetch) {
+  let res;
+  try {
+    res = await fetchImpl(`${api}/mcp`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${key}`, "Content-Type": "application/json" },
+      body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name: "whoami", arguments: {} } }),
+    });
+  } catch {
+    throw new Error(`could not reach ${api} — check the URL and your connection`);
+  }
+  if (res.status === 401) throw new Error("that key was rejected (401) — check the anyship_sk_… token");
+  const data = await res.json().catch(() => null);
+  if (!res.ok || !data) throw new Error(`unexpected response from ${api}/mcp (HTTP ${res.status})`);
+  if (data.error) throw new Error(data.error.message || "validation failed");
+  const text = data.result?.content?.[0]?.text ?? "";
+  if (data.result?.isError) throw new Error(text || "validation failed");
+  return text;
+}
+
+export async function runLogin(argv, io = defaultIo(), deps = {}) {
+  const args = parseLoginArgs(argv);
+  if (args.help) {
+    io.stdout(loginUsage());
+    return 0;
+  }
+  const key = await resolveKey(args, deps);
+  if (!key) throw new Error("no API key provided — pass --key, pipe it with --with-token, or run interactively");
+  if (!/^anyship_sk_/.test(key)) {
+    io.stderr("warning: keys usually start with 'anyship_sk_'; continuing anyway");
+  }
+  const api = (args.api || process.env.ANYSHIP_API_URL || readAnyshipConfig(deps.home).apiUrl || DEFAULT_API).replace(/\/+$/, "");
+
+  const who = await validateKey(api, key, deps.fetch ?? fetch);
+  // Only persist a non-default URL so the default can still shift centrally.
+  const patch = { apiKey: key };
+  if (args.api) patch.apiUrl = api;
+  const path = writeAnyshipConfig(patch, deps.home);
+
+  io.stdout(`✅ ${who.split("\n")[0]}`);
+  io.stdout(`Saved credentials to ${path}. \`anyship deploy\` and \`anyship mcp\` are now authenticated.`);
+  return 0;
+}
+
+export function runLogout(_argv, io = defaultIo(), deps = {}) {
+  const removed = clearAnyshipConfig(deps.home);
+  io.stdout(removed ? `Logged out — removed ${anyshipConfigPath(deps.home)}.` : "No stored anyship credentials.");
+  return 0;
+}
+
+function defaultIo() {
+  return {
+    stdout: (text) => console.log(text),
+    stderr: (text) => console.error(text),
+  };
+}

package/src/mcp-server.mjs

@@ -0,0 +1,178 @@
+// Local (stdio) MCP server for anyship. This is the piece that removes the
+// "remote server can't read your disk" seam: it runs on the user's machine, so
+// `deploy` takes a directory PATH, gathers every file that isn't gitignored
+// (reusing the CLI's git-aware archive), and uploads with the key this process
+// was started with. The agent never selects files and never touches a token.
+//
+// Everything that isn't a local-filesystem operation (list_projects,
+// deployment_status, add_domain, logs, whoami, …) is proxied verbatim to the
+// remote control-plane `/mcp`, so this server automatically stays in sync with
+// whatever tools the platform exposes — only `deploy` is handled locally.
+
+import { deployDirectory, apiKey, apiUrl, codexAnyshipConfig } from "./deploy-directory.mjs";
+import { createInterface } from "node:readline";
+import { resolve } from "node:path";
+
+const PROTOCOL_VERSION = "2025-06-18";
+const SERVER_INFO = { name: "anyship", version: "0.1.0" };
+
+const SERVER_INSTRUCTIONS = [
+  "anyship deploys a web app to a live URL. To deploy a project on disk, call `deploy` with the project name and the directory path — anyship gathers every file that isn't gitignored (via git), uploads it, detects the stack, and builds. You never select, list, or exclude files, and you never handle an API key: this server is already authenticated.",
+  "",
+  "Point `deploy` at the project's web root — the folder holding index.html / package.json (defaults to the current directory).",
+  "",
+  "Deploys are async: `deploy` returns a \"building\" status. Poll `deployment_status` for the project until it reports deployed or failed (cold builds take ~1–4 min); don't redeploy just because it isn't live yet. Redeploying the same project name updates the same site.",
+].join("\n");
+
+// The local `deploy` tool: a directory path, not inline files.
+const LOCAL_DEPLOY_TOOL = {
+  name: "deploy",
+  description:
+    "Deploy a local project directory to a live URL. Give the project name and the directory path; anyship gathers every file that isn't gitignored (via git ls-files), uploads it, detects the stack, and builds. You never list, select, or exclude files — .gitignore already decides what ships. Deploys are async; poll deployment_status until deployed or failed. Redeploying the same project name updates the same site.",
+  inputSchema: {
+    type: "object",
+    properties: {
+      project: { type: "string", description: "Project name, e.g. 'my-landing-page'. Reused across deploys." },
+      path: {
+        type: "string",
+        description: "Path to the project directory to deploy (its web root — the folder holding index.html / package.json). Defaults to the current directory.",
+      },
+      env: {
+        type: "object",
+        additionalProperties: { type: "string" },
+        description: "Environment variables / secrets to merge for the project. Stored encrypted and injected as Worker secrets.",
+      },
+    },
+    required: ["project"],
+  },
+};
+
+// Tools the remote exposes that only exist to work around the no-local-files
+// limitation — irrelevant here, where deploy reads the disk directly.
+const LOCAL_OVERRIDDEN = new Set(["deploy", "deploy_archive", "cli_instructions"]);
+
+// Forward a JSON-RPC call to the remote control-plane /mcp with the stored key.
+async function remoteProxy(method, params, deps) {
+  const config = deps.config ?? codexAnyshipConfig();
+  const api = deps.apiUrl?.({}, config) ?? apiUrl({}, config);
+  const key = deps.apiKey?.({}, config) ?? apiKey({}, config);
+  if (!key) throw new Error("missing Anyship API key; start this server with ANYSHIP_API_KEY set");
+  const res = await (deps.fetch ?? fetch)(`${api}/mcp`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${key}`, "Content-Type": "application/json" },
+    body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params }),
+  });
+  const data = await res.json().catch(() => null);
+  if (!data) throw new Error(`unexpected response from ${api}/mcp (${res.status})`);
+  return data;
+}
+
+async function localDeploy(args, deps) {
+  const project = String(args?.project ?? "").trim();
+  if (!project) throw new Error("`project` is required");
+  const path = typeof args?.path === "string" && args.path.trim() ? args.path : ".";
+  const env =
+    args?.env && typeof args.env === "object" && !Array.isArray(args.env)
+      ? JSON.stringify(args.env)
+      : undefined;
+  const runDeploy = deps.deployDirectory ?? deployDirectory;
+  const result = await runDeploy({ project, path, env });
+  const root = resolve(path);
+  const message = result?.response?.message ?? "Deploying. Poll deployment_status for progress.";
+  const depId = result?.response?.deployment?.id;
+  return (
+    `🚧 Uploaded ${result.fileCount} file${result.fileCount === 1 ? "" : "s"} from ${root} for "${project}"` +
+    `${depId ? ` (deployment ${depId})` : ""}.\n${message}`
+  );
+}
+
+// Core message handler — pure and injectable so it can be unit-tested without a
+// real socket or process. Returns a JSON-RPC response object, or null for
+// notifications.
+export async function handleMcpMessage(msg, deps = {}) {
+  const { id, method, params } = msg ?? {};
+  const isNotification = id === undefined || id === null;
+
+  try {
+    switch (method) {
+      case "initialize":
+        return {
+          jsonrpc: "2.0",
+          id,
+          result: {
+            protocolVersion: params?.protocolVersion || PROTOCOL_VERSION,
+            capabilities: { tools: {} },
+            serverInfo: SERVER_INFO,
+            instructions: SERVER_INSTRUCTIONS,
+          },
+        };
+      case "tools/list": {
+        // Local deploy first, then whatever else the platform offers (proxied).
+        let tools = [LOCAL_DEPLOY_TOOL];
+        try {
+          const remote = await remoteProxy("tools/list", {}, deps);
+          const extra = (remote?.result?.tools ?? []).filter((t) => !LOCAL_OVERRIDDEN.has(t.name));
+          tools = [LOCAL_DEPLOY_TOOL, ...extra];
+        } catch (e) {
+          // Offline / no key: still advertise local deploy so the agent can act.
+          deps.onWarn?.(e instanceof Error ? e.message : String(e));
+        }
+        return { jsonrpc: "2.0", id, result: { tools } };
+      }
+      case "ping":
+        return { jsonrpc: "2.0", id, result: {} };
+      case "tools/call": {
+        const name = params?.name;
+        const args = params?.arguments ?? {};
+        if (name === "deploy") {
+          const text = await localDeploy(args, deps);
+          return { jsonrpc: "2.0", id, result: { content: [{ type: "text", text }] } };
+        }
+        // Proxy any other tool to the remote control plane unchanged.
+        const data = await remoteProxy("tools/call", { name, arguments: args }, deps);
+        if (data?.error) throw new Error(data.error.message ?? "remote tool error");
+        return { jsonrpc: "2.0", id, result: data?.result ?? { content: [] } };
+      }
+      default:
+        if (isNotification || method?.startsWith("notifications/")) return null;
+        return { jsonrpc: "2.0", id: id ?? null, error: { code: -32601, message: `method not found: ${method}` } };
+    }
+  } catch (e) {
+    const message = e instanceof Error ? e.message : String(e);
+    if (isNotification) return null;
+    if (method === "tools/call") {
+      return { jsonrpc: "2.0", id, result: { content: [{ type: "text", text: message }], isError: true } };
+    }
+    return { jsonrpc: "2.0", id: id ?? null, error: { code: -32603, message } };
+  }
+}
+
+// Run the stdio loop: newline-delimited JSON-RPC in, one JSON object per line
+// out. stdout is reserved for protocol messages; diagnostics go to stderr.
+export async function runMcpServer(deps = {}) {
+  const input = deps.input ?? process.stdin;
+  const write = deps.write ?? ((line) => process.stdout.write(line + "\n"));
+  const warn = deps.onWarn ?? ((m) => process.stderr.write(`[anyship mcp] ${m}\n`));
+
+  const rl = createInterface({ input, crlfDelay: Infinity });
+  for await (const line of rl) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    let msg;
+    try {
+      msg = JSON.parse(trimmed);
+    } catch {
+      write(JSON.stringify({ jsonrpc: "2.0", id: null, error: { code: -32700, message: "parse error" } }));
+      continue;
+    }
+    const messages = Array.isArray(msg) ? msg : [msg];
+    const out = [];
+    for (const m of messages) {
+      const res = await handleMcpMessage(m, { ...deps, onWarn: warn });
+      if (res) out.push(res);
+    }
+    if (out.length === 0) continue; // only notifications
+    write(JSON.stringify(Array.isArray(msg) ? out : out[0]));
+  }
+  return 0;
+}