@anyship/cli 0.2.1 → 0.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anyship/cli",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "anyship CLI — deploy a local project directory, run a local MCP server for AI agents, and log in.",
   "type": "module",
   "bin": {

package/src/config.mjs

@@ -13,8 +13,8 @@ export function anyshipConfigPath(home = homedir()) {
   return join(anyshipConfigDir(home), "config.json");
 }
 
-// Returns the whole stored object (apiKey, apiUrl, oauth, …) so writes preserve
-// every field — the OAuth token block must survive an apiKey/apiUrl patch.
+// Returns the whole stored object (apiKey, apiUrl, …) so a patch write preserves
+// any fields it doesn't touch.
 export function readAnyshipConfig(home = homedir()) {
   try {
     const parsed = JSON.parse(readFileSync(anyshipConfigPath(home), "utf8"));

package/src/deploy-directory.mjs

@@ -5,7 +5,6 @@ import { homedir } from "node:os";
 import { basename, join, relative, resolve } from "node:path";
 import { zipSync } from "fflate";
 import { readAnyshipConfig } from "./config.mjs";
-import { browserLogin, storedAccessToken } from "./oauth.mjs";
 
 export const DEFAULT_API = "https://drydock.anyship.workers.dev";
 
@@ -31,8 +30,8 @@ export function deployUsage(commandName = "anyship deploy") {
 
 Options:
   --project <name>   anyship project name
-  --api <url>        control-plane URL (defaults to ~/.codex/config.toml, ANYSHIP_API_URL, or ${DEFAULT_API})
-  --key <token>      anyship API key (defaults to ANYSHIP_API_KEY or ~/.codex/config.toml)
+  --api <url>        control-plane URL (defaults to your MCP connector config, ANYSHIP_API_URL, or ${DEFAULT_API})
+  --key <token>      anyship API key (defaults to ANYSHIP_API_KEY, ~/.anyship, or the key in your MCP connector config — ~/.codex/config.toml or ~/.claude.json)
   --env <json>       JSON object of env vars/secrets to merge for the project
   --dry-run          Print the files that would be archived without uploading
   --json             Print dry-run output as JSON
@@ -110,7 +109,49 @@ export function codexAnyshipConfig(home = homedir()) {
   return { url, token };
 }
 
-export function apiKey(args, config = codexAnyshipConfig(), stored = readAnyshipConfig()) {
+// Read the anyship connector's key/url from Claude Code's MCP config
+// (~/.claude.json). The connector is stored with the key baked into an
+// `Authorization: Bearer` header, either at the top level or under a per-project
+// `projects[<path>].mcpServers`. Prefer an entry that actually carries a token.
+export function claudeCodeAnyshipConfig(home = homedir()) {
+  const configPath = join(home, ".claude.json");
+  if (!existsSync(configPath)) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(configPath, "utf8"));
+  } catch {
+    return {};
+  }
+  const fromServers = (servers) => {
+    const entry = servers?.anyship;
+    if (!entry || typeof entry !== "object") return null;
+    const url = typeof entry.url === "string" ? entry.url.replace(/\/mcp\/?$/, "") : undefined;
+    const auth = (entry.headers && (entry.headers.Authorization || entry.headers.authorization)) || "";
+    const token = /Bearer\s+(anyship_sk_[A-Za-z0-9]+)/.exec(auth)?.[1];
+    return url || token ? { url, token } : null;
+  };
+  const found = [];
+  const push = (r) => { if (r) found.push(r); };
+  push(fromServers(parsed.mcpServers));
+  if (parsed.projects && typeof parsed.projects === "object") {
+    for (const proj of Object.values(parsed.projects)) push(fromServers(proj?.mcpServers));
+  }
+  return found.find((c) => c.token) || found[0] || {};
+}
+
+// The anyship connector config from whichever MCP client the user set up —
+// Codex (~/.codex/config.toml) or Claude Code (~/.claude.json). Prefer whichever
+// actually carries a key, so configuring the connector is enough for the CLI too
+// (no separate `anyship login`).
+export function mcpConnectorConfig(home = homedir()) {
+  const codex = codexAnyshipConfig(home);
+  if (codex.token) return codex;
+  const claudeCode = claudeCodeAnyshipConfig(home);
+  if (claudeCode.token) return claudeCode;
+  return codex.url ? codex : claudeCode;
+}
+
+export function apiKey(args, config = mcpConnectorConfig(), stored = readAnyshipConfig()) {
   return (
     args.key ||
     process.env.ANYSHIP_API_KEY ||
@@ -121,7 +162,7 @@ export function apiKey(args, config = codexAnyshipConfig(), stored = readAnyship
   );
 }
 
-export function apiUrl(args, config = codexAnyshipConfig(), stored = readAnyshipConfig()) {
+export function apiUrl(args, config = mcpConnectorConfig(), stored = readAnyshipConfig()) {
   return (
     args.api ||
     process.env.ANYSHIP_API_URL ||
@@ -131,23 +172,16 @@ export function apiUrl(args, config = codexAnyshipConfig(), stored = readAnyship
   ).replace(/\/+$/, "");
 }
 
-// Bearer for control-plane calls. Precedence: an API key (flag / env / stored /
-// codex config) → a stored OAuth token (refreshed if expiring) → an interactive
-// browser login. The no-key OAuth path is the common one now that most users
-// connect anyship with browser login. Pass opts.interactive === false to fail
-// instead of opening a browser (CI / non-interactive).
+// Bearer for control-plane calls: the anyship_sk_ API key (flag / env / stored /
+// codex config). The API key is the only credential — there is no OAuth. Fails
+// loudly when none is set rather than falling back to any other account.
 export async function resolveBearer(args, io, opts = {}) {
   const stored = readAnyshipConfig(opts.home);
   const key = apiKey(args, undefined, stored);
   if (key) return key;
-  const api = apiUrl(args, undefined, stored);
-  const existing = await storedAccessToken(api, { home: opts.home, fetch: opts.fetch });
-  if (existing) return existing;
-  if (opts.interactive === false) {
-    throw new Error("not authenticated — set ANYSHIP_API_KEY or run `anyship login`");
-  }
-  const oauth = await browserLogin(api, io, { home: opts.home, fetch: opts.fetch });
-  return oauth.accessToken;
+  throw new Error(
+    "not authenticated — pass --key anyship_sk_…, set ANYSHIP_API_KEY, or run `anyship login --key anyship_sk_…`. Get your key from the anyship dashboard.",
+  );
 }
 
 function pathParts(rel) {

package/src/login.mjs

@@ -4,7 +4,6 @@
 // no --env and no token in shell history.
 import { createInterface } from "node:readline";
 import { DEFAULT_API } from "./deploy-directory.mjs";
-import { browserLogin } from "./oauth.mjs";
 import {
   anyshipConfigPath,
   clearAnyshipConfig,
@@ -67,8 +66,8 @@ function promptSecret(query, input, output) {
   });
 }
 
-// An explicitly-supplied key (flag / env / piped). Returns "" when none — that's
-// the signal to fall back to browser-login OAuth.
+// An explicitly-supplied key (flag / env / piped). Returns "" when none — login
+// then errors, since an anyship_sk_ key is the only credential.
 async function resolveKey(args, deps) {
   if (args.key) return args.key.trim();
   if (process.env.ANYSHIP_API_KEY) return process.env.ANYSHIP_API_KEY.trim();
@@ -112,11 +111,11 @@ export async function runLogin(argv, io = defaultIo(), deps = {}) {
   const api = (args.api || process.env.ANYSHIP_API_URL || readAnyshipConfig(deps.home).apiUrl || DEFAULT_API).replace(/\/+$/, "");
   const key = await resolveKey(args, deps);
 
-  // No key supplied → browser-login OAuth (the common case). A key → validate + store.
+  // An anyship_sk_ key is the only credential — no browser login.
   if (!key) {
-    await browserLogin(api, io, deps);
-    io.stdout("✅ Signed in to anyship. `anyship deploy` and `anyship mcp` are now authenticated.");
-    return 0;
+    throw new Error(
+      "no API key provided. Pass --key anyship_sk_…, set ANYSHIP_API_KEY, or pipe it with --with-token. Get your key from the anyship dashboard.",
+    );
   }
 
   if (!/^anyship_sk_/.test(key)) {

package/src/mcp-server.mjs

@@ -9,8 +9,7 @@
 // remote control-plane `/mcp`, so this server automatically stays in sync with
 // whatever tools the platform exposes — only `deploy` is handled locally.
 
-import { deployDirectory, apiKey, apiUrl, codexAnyshipConfig } from "./deploy-directory.mjs";
-import { storedAccessToken } from "./oauth.mjs";
+import { deployDirectory, apiKey, apiUrl, mcpConnectorConfig } from "./deploy-directory.mjs";
 import { createInterface } from "node:readline";
 import { resolve } from "node:path";
 
@@ -52,23 +51,19 @@ const LOCAL_DEPLOY_TOOL = {
 // limitation — irrelevant here, where deploy reads the disk directly.
 const LOCAL_OVERRIDDEN = new Set(["deploy", "deploy_archive", "cli_instructions"]);
 
-// Bearer for the remote proxy: an API key (test-injected, env, stored, or codex
-// config) or a stored OAuth token from a prior `anyship login`. This background
-// server never opens a browser — the user authenticates once with `anyship login`
-// (which does the browser flow); here we only use what's already stored.
+// Bearer for the remote proxy: the anyship_sk_ API key (test-injected, env,
+// ~/.anyship, or the MCP connector config — Codex or Claude Code). The API key
+// is the only credential.
 async function remoteBearer(deps) {
-  const config = deps.config ?? codexAnyshipConfig();
+  const config = deps.config ?? mcpConnectorConfig();
   const key = deps.apiKey ? deps.apiKey({}, config) : apiKey({}, config);
   if (key) return key;
-  const api = deps.apiUrl ? deps.apiUrl({}, config) : apiUrl({}, config);
-  const oauthTok = await storedAccessToken(api);
-  if (oauthTok) return oauthTok;
-  throw new Error("not authenticated — run `anyship login` first");
+  throw new Error("not authenticated — set ANYSHIP_API_KEY or run `anyship login --key anyship_sk_…`");
 }
 
 // Forward a JSON-RPC call to the remote control-plane /mcp.
 async function remoteProxy(method, params, deps) {
-  const config = deps.config ?? codexAnyshipConfig();
+  const config = deps.config ?? mcpConnectorConfig();
   const api = deps.apiUrl ? deps.apiUrl({}, config) : apiUrl({}, config);
   const token = await remoteBearer(deps);
   const res = await (deps.fetch ?? fetch)(`${api}/mcp`, {

package/src/oauth.mjs

@@ -1,164 +0,0 @@
-// Browser-login OAuth for the CLI — the same flow an MCP client runs, so a user
-// who connected anyship with browser login (no API key) can also use the CLI.
-// Loopback Authorization Code + PKCE: discover the auth server, dynamically
-// register, open the browser, catch the redirect on 127.0.0.1, exchange the code
-// for tokens, and store them in ~/.anyship/config.json. Refreshes on expiry.
-import { createServer } from "node:http";
-import { createHash, randomBytes } from "node:crypto";
-import { spawn } from "node:child_process";
-import { readAnyshipConfig, writeAnyshipConfig } from "./config.mjs";
-
-const b64url = (b) => Buffer.from(b).toString("base64url");
-
-async function discover(api, fetchImpl) {
-  const res = await fetchImpl(`${api}/.well-known/oauth-authorization-server`);
-  if (!res.ok) throw new Error(`OAuth discovery failed at ${api} (HTTP ${res.status})`);
-  const meta = await res.json();
-  if (!meta?.authorization_endpoint || !meta?.token_endpoint || !meta?.registration_endpoint) {
-    throw new Error(`${api} does not advertise the OAuth endpoints needed for login`);
-  }
-  return meta;
-}
-
-function openBrowser(url) {
-  const p = process.platform;
-  const [cmd, args] =
-    p === "darwin" ? ["open", [url]] : p === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
-  try {
-    spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
-  } catch {
-    /* headless / no browser — the URL is printed for manual use */
-  }
-}
-
-// Loopback server on an ephemeral port; resolves with the OAuth redirect params.
-function startCallbackServer() {
-  return new Promise((resolve) => {
-    let resolveCode;
-    const waitForCode = new Promise((r) => (resolveCode = r));
-    const server = createServer((req, res) => {
-      const u = new URL(req.url, "http://127.0.0.1");
-      if (u.pathname !== "/callback") {
-        res.writeHead(404);
-        res.end();
-        return;
-      }
-      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-      res.end(
-        "<!doctype html><html><head><meta charset='utf-8'></head>" +
-          "<body style='font:16px/1.5 system-ui;text-align:center;padding:48px'>" +
-          "<h2>anyship — signed in ✓</h2><p>You can close this tab and return to your terminal.</p>" +
-          "</body></html>",
-      );
-      resolveCode({ code: u.searchParams.get("code"), state: u.searchParams.get("state") });
-    });
-    server.listen(0, "127.0.0.1", () => resolve({ server, port: server.address().port, waitForCode }));
-  });
-}
-
-// Run the full interactive browser login and persist the tokens. Returns the
-// stored oauth block.
-export async function browserLogin(api, io = defaultIo(), deps = {}) {
-  const fetchImpl = deps.fetch ?? fetch;
-  const meta = await discover(api, fetchImpl);
-
-  const { server, port, waitForCode } = await startCallbackServer();
-  const redirectUri = `http://127.0.0.1:${port}/callback`;
-  try {
-    const reg = await fetchImpl(meta.registration_endpoint, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({
-        client_name: "Anyship CLI",
-        redirect_uris: [redirectUri],
-        token_endpoint_auth_method: "none",
-        grant_types: ["authorization_code", "refresh_token"],
-        response_types: ["code"],
-      }),
-    });
-    const client = await reg.json().catch(() => null);
-    if (!client?.client_id) throw new Error("OAuth client registration failed");
-
-    const verifier = b64url(randomBytes(32));
-    const challenge = b64url(createHash("sha256").update(verifier).digest());
-    const state = b64url(randomBytes(16));
-    const authUrl = `${meta.authorization_endpoint}?${new URLSearchParams({
-      response_type: "code",
-      client_id: client.client_id,
-      redirect_uri: redirectUri,
-      scope: "openid profile email offline_access",
-      state,
-      code_challenge: challenge,
-      code_challenge_method: "S256",
-    })}`;
-    io.stderr(`Opening your browser to sign in to anyship…\nIf it doesn't open, visit:\n  ${authUrl}`);
-    openBrowser(authUrl);
-
-    const got = await waitForCode;
-    if (got.state !== state) throw new Error("OAuth state mismatch — aborting");
-    if (!got.code) throw new Error("no authorization code returned");
-
-    const tok = await fetchImpl(meta.token_endpoint, {
-      method: "POST",
-      headers: { "content-type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        grant_type: "authorization_code",
-        code: got.code,
-        redirect_uri: redirectUri,
-        client_id: client.client_id,
-        code_verifier: verifier,
-      }).toString(),
-    });
-    const t = await tok.json().catch(() => null);
-    if (!t?.access_token) throw new Error("token exchange failed");
-
-    const oauth = {
-      apiUrl: api,
-      clientId: client.client_id,
-      accessToken: t.access_token,
-      refreshToken: t.refresh_token || null,
-      expiresAt: t.expires_in ? Date.now() + t.expires_in * 1000 : null,
-    };
-    writeAnyshipConfig({ oauth }, deps.home);
-    io.stderr("Signed in to anyship.");
-    return oauth;
-  } finally {
-    server.close();
-  }
-}
-
-// Return a valid stored access token (refreshing if near expiry), or null if
-// there's no usable OAuth token for this api.
-export async function storedAccessToken(api, deps = {}) {
-  const oauth = readAnyshipConfig(deps.home).oauth;
-  if (!oauth?.accessToken || oauth.apiUrl !== api) return null;
-  if (!oauth.expiresAt || oauth.expiresAt - Date.now() > 60_000) return oauth.accessToken;
-  if (!oauth.refreshToken) return null;
-
-  const fetchImpl = deps.fetch ?? fetch;
-  const meta = await discover(api, fetchImpl).catch(() => null);
-  if (!meta?.token_endpoint) return null;
-  const res = await fetchImpl(meta.token_endpoint, {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "refresh_token",
-      refresh_token: oauth.refreshToken,
-      client_id: oauth.clientId,
-    }).toString(),
-  }).catch(() => null);
-  const t = res && (await res.json().catch(() => null));
-  if (!t?.access_token) return null;
-  const updated = {
-    ...oauth,
-    accessToken: t.access_token,
-    refreshToken: t.refresh_token || oauth.refreshToken,
-    expiresAt: t.expires_in ? Date.now() + t.expires_in * 1000 : null,
-  };
-  writeAnyshipConfig({ oauth: updated }, deps.home);
-  return updated.accessToken;
-}
-
-function defaultIo() {
-  return { stdout: (t) => console.log(t), stderr: (t) => console.error(t) };
-}