@anyship/cli 0.2.1 → 0.3.1

package/README.md

@@ -21,23 +21,20 @@ never hand-pick files.
 
 ### `anyship login`
 
-Run **`anyship login`** with no arguments and it opens your browser to sign in
-(OAuth) — the same login you use for the anyship connector, no key required. It
-stores the resulting token in `~/.anyship/config.json` (mode `0600`), refreshing
-it automatically. This is the common path now that most people connect with
-browser login.
-
-Prefer an API key (CI, scripts)? Pass one and it's validated + stored instead:
+An **`anyship_sk_…` API key is the only credential — there is no browser/OAuth
+login.** `anyship login` takes your key, validates it against the control plane,
+and stores it in `~/.anyship/config.json` (mode `0600`), so `deploy` and `mcp`
+authenticate automatically afterward. Grab the key from the anyship dashboard.
 
 ```bash
-anyship login                          # browser login (OAuth) — no key
-anyship login --key anyship_sk_…       # or an API key: echo $KEY | anyship login --with-token
+anyship login --key anyship_sk_…       # validate + store the key
+echo $KEY | anyship login --with-token # or pipe it (CI / scripts — no key in shell history)
 anyship logout                         # remove stored credentials
 ```
 
-`deploy` and `mcp` then authenticate automatically. If neither a key nor a stored
-token is present, `deploy` triggers the browser login on first use; the `mcp`
-server uses only stored auth (run `anyship login` once first).
+If no key is present, `login` errors telling you to supply one — it never opens a
+browser. (OAuth exists only for **dashboard** sign-in — Google/GitHub — never for
+the CLI, MCP, or deploy.)
 
 ### `anyship deploy [path]`
 
@@ -60,7 +57,7 @@ other tool (`list_projects`, `deployment_status`, `add_domain`, `logs`, …) is
 proxied to the control plane. Add it to Claude Code:
 
 ```bash
-anyship login
+anyship login --key anyship_sk_…
 claude mcp add anyship -- npx -y @anyship/cli mcp
 ```
 
@@ -69,14 +66,15 @@ files and never handles your API key.
 
 ## Configuration
 
-Auth resolves in this order — an **API key** if you have one, otherwise **OAuth**:
+The `anyship_sk_…` API key is the only credential. It resolves in this order (first
+hit wins); if none is found, the command fails loudly rather than falling back to
+any other account:
 
 1. `--key` flag
 2. `ANYSHIP_API_KEY` env
-3. a stored API key (`~/.anyship/config.json`)
-4. an `mcp_servers.anyship` entry in `~/.codex/config.toml`
-5. a stored **OAuth token** (`~/.anyship/config.json`, auto-refreshed)
-6. otherwise → browser login (interactive commands only)
+3. a stored key (`~/.anyship/config.json`, written by `anyship login`)
+4. the anyship MCP-connector key from an existing client config — `~/.codex/config.toml`
+   or `~/.claude.json` (so configuring the connector is enough for the CLI too)
 
-The control-plane URL comes from `--api`, `ANYSHIP_API_URL`, the stored config, or
-the default. Requires Node.js 18+.
+There is no OAuth token and no browser-login fallback. The control-plane URL comes
+from `--api`, `ANYSHIP_API_URL`, the stored config, or the default. Requires Node.js 18+.

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@anyship/cli",
-  "version": "0.2.1",
+  "version": "0.3.1",
   "description": "anyship CLI — deploy a local project directory, run a local MCP server for AI agents, and log in.",
   "type": "module",
   "bin": {
-    "anyship": "./bin/anyship.mjs"
+    "anyship": "bin/anyship.mjs"
   },
   "exports": {
     ".": "./src/index.mjs"

package/src/config.mjs

@@ -13,8 +13,8 @@ export function anyshipConfigPath(home = homedir()) {
   return join(anyshipConfigDir(home), "config.json");
 }
 
-// Returns the whole stored object (apiKey, apiUrl, oauth, …) so writes preserve
-// every field — the OAuth token block must survive an apiKey/apiUrl patch.
+// Returns the whole stored object (apiKey, apiUrl, …) so a patch write preserves
+// any fields it doesn't touch.
 export function readAnyshipConfig(home = homedir()) {
   try {
     const parsed = JSON.parse(readFileSync(anyshipConfigPath(home), "utf8"));

package/src/deploy-directory.mjs

@@ -5,7 +5,6 @@ import { homedir } from "node:os";
 import { basename, join, relative, resolve } from "node:path";
 import { zipSync } from "fflate";
 import { readAnyshipConfig } from "./config.mjs";
-import { browserLogin, storedAccessToken } from "./oauth.mjs";
 
 export const DEFAULT_API = "https://drydock.anyship.workers.dev";
 
@@ -31,8 +30,8 @@ export function deployUsage(commandName = "anyship deploy") {
 
 Options:
   --project <name>   anyship project name
-  --api <url>        control-plane URL (defaults to ~/.codex/config.toml, ANYSHIP_API_URL, or ${DEFAULT_API})
-  --key <token>      anyship API key (defaults to ANYSHIP_API_KEY or ~/.codex/config.toml)
+  --api <url>        control-plane URL (defaults to your MCP connector config, ANYSHIP_API_URL, or ${DEFAULT_API})
+  --key <token>      anyship API key (defaults to ANYSHIP_API_KEY, ~/.anyship, or the key in your MCP connector config — ~/.codex/config.toml or ~/.claude.json)
   --env <json>       JSON object of env vars/secrets to merge for the project
   --dry-run          Print the files that would be archived without uploading
   --json             Print dry-run output as JSON
@@ -110,7 +109,49 @@ export function codexAnyshipConfig(home = homedir()) {
   return { url, token };
 }
 
-export function apiKey(args, config = codexAnyshipConfig(), stored = readAnyshipConfig()) {
+// Read the anyship connector's key/url from Claude Code's MCP config
+// (~/.claude.json). The connector is stored with the key baked into an
+// `Authorization: Bearer` header, either at the top level or under a per-project
+// `projects[<path>].mcpServers`. Prefer an entry that actually carries a token.
+export function claudeCodeAnyshipConfig(home = homedir()) {
+  const configPath = join(home, ".claude.json");
+  if (!existsSync(configPath)) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(configPath, "utf8"));
+  } catch {
+    return {};
+  }
+  const fromServers = (servers) => {
+    const entry = servers?.anyship;
+    if (!entry || typeof entry !== "object") return null;
+    const url = typeof entry.url === "string" ? entry.url.replace(/\/mcp\/?$/, "") : undefined;
+    const auth = (entry.headers && (entry.headers.Authorization || entry.headers.authorization)) || "";
+    const token = /Bearer\s+(anyship_sk_[A-Za-z0-9]+)/.exec(auth)?.[1];
+    return url || token ? { url, token } : null;
+  };
+  const found = [];
+  const push = (r) => { if (r) found.push(r); };
+  push(fromServers(parsed.mcpServers));
+  if (parsed.projects && typeof parsed.projects === "object") {
+    for (const proj of Object.values(parsed.projects)) push(fromServers(proj?.mcpServers));
+  }
+  return found.find((c) => c.token) || found[0] || {};
+}
+
+// The anyship connector config from whichever MCP client the user set up —
+// Codex (~/.codex/config.toml) or Claude Code (~/.claude.json). Prefer whichever
+// actually carries a key, so configuring the connector is enough for the CLI too
+// (no separate `anyship login`).
+export function mcpConnectorConfig(home = homedir()) {
+  const codex = codexAnyshipConfig(home);
+  if (codex.token) return codex;
+  const claudeCode = claudeCodeAnyshipConfig(home);
+  if (claudeCode.token) return claudeCode;
+  return codex.url ? codex : claudeCode;
+}
+
+export function apiKey(args, config = mcpConnectorConfig(), stored = readAnyshipConfig()) {
   return (
     args.key ||
     process.env.ANYSHIP_API_KEY ||
@@ -121,7 +162,7 @@ export function apiKey(args, config = codexAnyshipConfig(), stored = readAnyship
   );
 }
 
-export function apiUrl(args, config = codexAnyshipConfig(), stored = readAnyshipConfig()) {
+export function apiUrl(args, config = mcpConnectorConfig(), stored = readAnyshipConfig()) {
   return (
     args.api ||
     process.env.ANYSHIP_API_URL ||
@@ -131,23 +172,16 @@ export function apiUrl(args, config = codexAnyshipConfig(), stored = readAnyship
   ).replace(/\/+$/, "");
 }
 
-// Bearer for control-plane calls. Precedence: an API key (flag / env / stored /
-// codex config) → a stored OAuth token (refreshed if expiring) → an interactive
-// browser login. The no-key OAuth path is the common one now that most users
-// connect anyship with browser login. Pass opts.interactive === false to fail
-// instead of opening a browser (CI / non-interactive).
+// Bearer for control-plane calls: the anyship_sk_ API key (flag / env / stored /
+// codex config). The API key is the only credential — there is no OAuth. Fails
+// loudly when none is set rather than falling back to any other account.
 export async function resolveBearer(args, io, opts = {}) {
   const stored = readAnyshipConfig(opts.home);
   const key = apiKey(args, undefined, stored);
   if (key) return key;
-  const api = apiUrl(args, undefined, stored);
-  const existing = await storedAccessToken(api, { home: opts.home, fetch: opts.fetch });
-  if (existing) return existing;
-  if (opts.interactive === false) {
-    throw new Error("not authenticated — set ANYSHIP_API_KEY or run `anyship login`");
-  }
-  const oauth = await browserLogin(api, io, { home: opts.home, fetch: opts.fetch });
-  return oauth.accessToken;
+  throw new Error(
+    "not authenticated — pass --key anyship_sk_…, set ANYSHIP_API_KEY, or run `anyship login --key anyship_sk_…`. Get your key from the anyship dashboard.",
+  );
 }
 
 function pathParts(rel) {

package/src/login.mjs

@@ -4,7 +4,6 @@
 // no --env and no token in shell history.
 import { createInterface } from "node:readline";
 import { DEFAULT_API } from "./deploy-directory.mjs";
-import { browserLogin } from "./oauth.mjs";
 import {
   anyshipConfigPath,
   clearAnyshipConfig,
@@ -67,8 +66,8 @@ function promptSecret(query, input, output) {
   });
 }
 
-// An explicitly-supplied key (flag / env / piped). Returns "" when none — that's
-// the signal to fall back to browser-login OAuth.
+// An explicitly-supplied key (flag / env / piped). Returns "" when none — login
+// then errors, since an anyship_sk_ key is the only credential.
 async function resolveKey(args, deps) {
   if (args.key) return args.key.trim();
   if (process.env.ANYSHIP_API_KEY) return process.env.ANYSHIP_API_KEY.trim();
@@ -112,11 +111,11 @@ export async function runLogin(argv, io = defaultIo(), deps = {}) {
   const api = (args.api || process.env.ANYSHIP_API_URL || readAnyshipConfig(deps.home).apiUrl || DEFAULT_API).replace(/\/+$/, "");
   const key = await resolveKey(args, deps);
 
-  // No key supplied → browser-login OAuth (the common case). A key → validate + store.
+  // An anyship_sk_ key is the only credential — no browser login.
   if (!key) {
-    await browserLogin(api, io, deps);
-    io.stdout("✅ Signed in to anyship. `anyship deploy` and `anyship mcp` are now authenticated.");
-    return 0;
+    throw new Error(
+      "no API key provided. Pass --key anyship_sk_…, set ANYSHIP_API_KEY, or pipe it with --with-token. Get your key from the anyship dashboard.",
+    );
   }
 
   if (!/^anyship_sk_/.test(key)) {

package/src/mcp-server.mjs

@@ -9,16 +9,23 @@
 // remote control-plane `/mcp`, so this server automatically stays in sync with
 // whatever tools the platform exposes — only `deploy` is handled locally.
 
-import { deployDirectory, apiKey, apiUrl, codexAnyshipConfig } from "./deploy-directory.mjs";
-import { storedAccessToken } from "./oauth.mjs";
+import { deployDirectory, apiKey, apiUrl, mcpConnectorConfig } from "./deploy-directory.mjs";
 import { createInterface } from "node:readline";
 import { resolve } from "node:path";
 
 const PROTOCOL_VERSION = "2025-06-18";
 const SERVER_INFO = { name: "anyship", version: "0.1.0" };
 
+// The AUTH paragraph is load-bearing — keep it this explicit. This server runs
+// from the CLI, which already holds the credential, so an agent should never
+// think about auth; past agents mistook a generic "requires authentication"
+// prompt for an OAuth step and stalled. Shut that down here, permanently.
 const SERVER_INSTRUCTIONS = [
-  "anyship deploys a web app to a live URL. To deploy a project on disk, call `deploy` with the project name and the directory path — anyship gathers every file that isn't gitignored (via git), uploads it, detects the stack, and builds. You never select, list, or exclude files, and you never handle an API key: this server is already authenticated.",
+  "anyship deploys a web app to a live URL. To deploy a project on disk, call `deploy` with the project name and the directory path — anyship gathers every file that isn't gitignored (via git), uploads it, detects the stack, and builds. You never select, list, or exclude files.",
+  "",
+  "DEPLOY is deterministic; you are not — run the one call and trust it, and do NOT reason about, verify, or optimize any part of it. This tool does 100% of the work. Do NOT: choose which subdirectory to send, run a build yourself, generate or read config files, hunt for a 'web root'/output dir, dry-run to inspect files, or judge size. Point it at the project's top-level directory and let anyship handle detection, build, and what to serve. If a deploy fails, read its error — don't predict failures beforehand.",
+  "",
+  "AUTH — you do not deal with this, at all. This server runs from the anyship CLI, which already holds the credential, so it is authenticated for you. Treat auth as an invisible, solved detail: there is NO OAuth and NO sign-in flow, and no token for you to obtain, paste, or ask anyone for (the only credential is an `anyship_sk_` API key the CLI supplies automatically). Never tell the user to \"authorize\" / \"connect\" / \"sign in\", never ask for auth codes, tokens, or callback URLs, and never report auth (or a client's generic \"requires authentication\" prompt) as a reason you can't deploy. Just call the tools. The ONE exception: if a tool actually returns `not authenticated`, the whole fix is one shell command the user runs once — `anyship login --key anyship_sk_…` — then retry.",
   "",
   "Point `deploy` at the project's web root — the folder holding index.html / package.json (defaults to the current directory).",
   "",
@@ -52,23 +59,19 @@ const LOCAL_DEPLOY_TOOL = {
 // limitation — irrelevant here, where deploy reads the disk directly.
 const LOCAL_OVERRIDDEN = new Set(["deploy", "deploy_archive", "cli_instructions"]);
 
-// Bearer for the remote proxy: an API key (test-injected, env, stored, or codex
-// config) or a stored OAuth token from a prior `anyship login`. This background
-// server never opens a browser — the user authenticates once with `anyship login`
-// (which does the browser flow); here we only use what's already stored.
+// Bearer for the remote proxy: the anyship_sk_ API key (test-injected, env,
+// ~/.anyship, or the MCP connector config — Codex or Claude Code). The API key
+// is the only credential.
 async function remoteBearer(deps) {
-  const config = deps.config ?? codexAnyshipConfig();
+  const config = deps.config ?? mcpConnectorConfig();
   const key = deps.apiKey ? deps.apiKey({}, config) : apiKey({}, config);
   if (key) return key;
-  const api = deps.apiUrl ? deps.apiUrl({}, config) : apiUrl({}, config);
-  const oauthTok = await storedAccessToken(api);
-  if (oauthTok) return oauthTok;
-  throw new Error("not authenticated — run `anyship login` first");
+  throw new Error("not authenticated — set ANYSHIP_API_KEY or run `anyship login --key anyship_sk_…`");
 }
 
 // Forward a JSON-RPC call to the remote control-plane /mcp.
 async function remoteProxy(method, params, deps) {
-  const config = deps.config ?? codexAnyshipConfig();
+  const config = deps.config ?? mcpConnectorConfig();
   const api = deps.apiUrl ? deps.apiUrl({}, config) : apiUrl({}, config);
   const token = await remoteBearer(deps);
   const res = await (deps.fetch ?? fetch)(`${api}/mcp`, {

package/src/oauth.mjs

@@ -1,164 +0,0 @@
-// Browser-login OAuth for the CLI — the same flow an MCP client runs, so a user
-// who connected anyship with browser login (no API key) can also use the CLI.
-// Loopback Authorization Code + PKCE: discover the auth server, dynamically
-// register, open the browser, catch the redirect on 127.0.0.1, exchange the code
-// for tokens, and store them in ~/.anyship/config.json. Refreshes on expiry.
-import { createServer } from "node:http";
-import { createHash, randomBytes } from "node:crypto";
-import { spawn } from "node:child_process";
-import { readAnyshipConfig, writeAnyshipConfig } from "./config.mjs";
-
-const b64url = (b) => Buffer.from(b).toString("base64url");
-
-async function discover(api, fetchImpl) {
-  const res = await fetchImpl(`${api}/.well-known/oauth-authorization-server`);
-  if (!res.ok) throw new Error(`OAuth discovery failed at ${api} (HTTP ${res.status})`);
-  const meta = await res.json();
-  if (!meta?.authorization_endpoint || !meta?.token_endpoint || !meta?.registration_endpoint) {
-    throw new Error(`${api} does not advertise the OAuth endpoints needed for login`);
-  }
-  return meta;
-}
-
-function openBrowser(url) {
-  const p = process.platform;
-  const [cmd, args] =
-    p === "darwin" ? ["open", [url]] : p === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
-  try {
-    spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
-  } catch {
-    /* headless / no browser — the URL is printed for manual use */
-  }
-}
-
-// Loopback server on an ephemeral port; resolves with the OAuth redirect params.
-function startCallbackServer() {
-  return new Promise((resolve) => {
-    let resolveCode;
-    const waitForCode = new Promise((r) => (resolveCode = r));
-    const server = createServer((req, res) => {
-      const u = new URL(req.url, "http://127.0.0.1");
-      if (u.pathname !== "/callback") {
-        res.writeHead(404);
-        res.end();
-        return;
-      }
-      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-      res.end(
-        "<!doctype html><html><head><meta charset='utf-8'></head>" +
-          "<body style='font:16px/1.5 system-ui;text-align:center;padding:48px'>" +
-          "<h2>anyship — signed in ✓</h2><p>You can close this tab and return to your terminal.</p>" +
-          "</body></html>",
-      );
-      resolveCode({ code: u.searchParams.get("code"), state: u.searchParams.get("state") });
-    });
-    server.listen(0, "127.0.0.1", () => resolve({ server, port: server.address().port, waitForCode }));
-  });
-}
-
-// Run the full interactive browser login and persist the tokens. Returns the
-// stored oauth block.
-export async function browserLogin(api, io = defaultIo(), deps = {}) {
-  const fetchImpl = deps.fetch ?? fetch;
-  const meta = await discover(api, fetchImpl);
-
-  const { server, port, waitForCode } = await startCallbackServer();
-  const redirectUri = `http://127.0.0.1:${port}/callback`;
-  try {
-    const reg = await fetchImpl(meta.registration_endpoint, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({
-        client_name: "Anyship CLI",
-        redirect_uris: [redirectUri],
-        token_endpoint_auth_method: "none",
-        grant_types: ["authorization_code", "refresh_token"],
-        response_types: ["code"],
-      }),
-    });
-    const client = await reg.json().catch(() => null);
-    if (!client?.client_id) throw new Error("OAuth client registration failed");
-
-    const verifier = b64url(randomBytes(32));
-    const challenge = b64url(createHash("sha256").update(verifier).digest());
-    const state = b64url(randomBytes(16));
-    const authUrl = `${meta.authorization_endpoint}?${new URLSearchParams({
-      response_type: "code",
-      client_id: client.client_id,
-      redirect_uri: redirectUri,
-      scope: "openid profile email offline_access",
-      state,
-      code_challenge: challenge,
-      code_challenge_method: "S256",
-    })}`;
-    io.stderr(`Opening your browser to sign in to anyship…\nIf it doesn't open, visit:\n  ${authUrl}`);
-    openBrowser(authUrl);
-
-    const got = await waitForCode;
-    if (got.state !== state) throw new Error("OAuth state mismatch — aborting");
-    if (!got.code) throw new Error("no authorization code returned");
-
-    const tok = await fetchImpl(meta.token_endpoint, {
-      method: "POST",
-      headers: { "content-type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        grant_type: "authorization_code",
-        code: got.code,
-        redirect_uri: redirectUri,
-        client_id: client.client_id,
-        code_verifier: verifier,
-      }).toString(),
-    });
-    const t = await tok.json().catch(() => null);
-    if (!t?.access_token) throw new Error("token exchange failed");
-
-    const oauth = {
-      apiUrl: api,
-      clientId: client.client_id,
-      accessToken: t.access_token,
-      refreshToken: t.refresh_token || null,
-      expiresAt: t.expires_in ? Date.now() + t.expires_in * 1000 : null,
-    };
-    writeAnyshipConfig({ oauth }, deps.home);
-    io.stderr("Signed in to anyship.");
-    return oauth;
-  } finally {
-    server.close();
-  }
-}
-
-// Return a valid stored access token (refreshing if near expiry), or null if
-// there's no usable OAuth token for this api.
-export async function storedAccessToken(api, deps = {}) {
-  const oauth = readAnyshipConfig(deps.home).oauth;
-  if (!oauth?.accessToken || oauth.apiUrl !== api) return null;
-  if (!oauth.expiresAt || oauth.expiresAt - Date.now() > 60_000) return oauth.accessToken;
-  if (!oauth.refreshToken) return null;
-
-  const fetchImpl = deps.fetch ?? fetch;
-  const meta = await discover(api, fetchImpl).catch(() => null);
-  if (!meta?.token_endpoint) return null;
-  const res = await fetchImpl(meta.token_endpoint, {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "refresh_token",
-      refresh_token: oauth.refreshToken,
-      client_id: oauth.clientId,
-    }).toString(),
-  }).catch(() => null);
-  const t = res && (await res.json().catch(() => null));
-  if (!t?.access_token) return null;
-  const updated = {
-    ...oauth,
-    accessToken: t.access_token,
-    refreshToken: t.refresh_token || oauth.refreshToken,
-    expiresAt: t.expires_in ? Date.now() + t.expires_in * 1000 : null,
-  };
-  writeAnyshipConfig({ oauth: updated }, deps.home);
-  return updated.accessToken;
-}
-
-function defaultIo() {
-  return { stdout: (t) => console.log(t), stderr: (t) => console.error(t) };
-}