@anyship/cli 0.3.0 → 0.3.1

package/README.md

@@ -21,23 +21,20 @@ never hand-pick files.
 
 ### `anyship login`
 
-Run **`anyship login`** with no arguments and it opens your browser to sign in
-(OAuth) — the same login you use for the anyship connector, no key required. It
-stores the resulting token in `~/.anyship/config.json` (mode `0600`), refreshing
-it automatically. This is the common path now that most people connect with
-browser login.
-
-Prefer an API key (CI, scripts)? Pass one and it's validated + stored instead:
+An **`anyship_sk_…` API key is the only credential — there is no browser/OAuth
+login.** `anyship login` takes your key, validates it against the control plane,
+and stores it in `~/.anyship/config.json` (mode `0600`), so `deploy` and `mcp`
+authenticate automatically afterward. Grab the key from the anyship dashboard.
 
 ```bash
-anyship login                          # browser login (OAuth) — no key
-anyship login --key anyship_sk_…       # or an API key: echo $KEY | anyship login --with-token
+anyship login --key anyship_sk_…       # validate + store the key
+echo $KEY | anyship login --with-token # or pipe it (CI / scripts — no key in shell history)
 anyship logout                         # remove stored credentials
 ```
 
-`deploy` and `mcp` then authenticate automatically. If neither a key nor a stored
-token is present, `deploy` triggers the browser login on first use; the `mcp`
-server uses only stored auth (run `anyship login` once first).
+If no key is present, `login` errors telling you to supply one — it never opens a
+browser. (OAuth exists only for **dashboard** sign-in — Google/GitHub — never for
+the CLI, MCP, or deploy.)
 
 ### `anyship deploy [path]`
 
@@ -60,7 +57,7 @@ other tool (`list_projects`, `deployment_status`, `add_domain`, `logs`, …) is
 proxied to the control plane. Add it to Claude Code:
 
 ```bash
-anyship login
+anyship login --key anyship_sk_…
 claude mcp add anyship -- npx -y @anyship/cli mcp
 ```
 
@@ -69,14 +66,15 @@ files and never handles your API key.
 
 ## Configuration
 
-Auth resolves in this order — an **API key** if you have one, otherwise **OAuth**:
+The `anyship_sk_…` API key is the only credential. It resolves in this order (first
+hit wins); if none is found, the command fails loudly rather than falling back to
+any other account:
 
 1. `--key` flag
 2. `ANYSHIP_API_KEY` env
-3. a stored API key (`~/.anyship/config.json`)
-4. an `mcp_servers.anyship` entry in `~/.codex/config.toml`
-5. a stored **OAuth token** (`~/.anyship/config.json`, auto-refreshed)
-6. otherwise → browser login (interactive commands only)
+3. a stored key (`~/.anyship/config.json`, written by `anyship login`)
+4. the anyship MCP-connector key from an existing client config — `~/.codex/config.toml`
+   or `~/.claude.json` (so configuring the connector is enough for the CLI too)
 
-The control-plane URL comes from `--api`, `ANYSHIP_API_URL`, the stored config, or
-the default. Requires Node.js 18+.
+There is no OAuth token and no browser-login fallback. The control-plane URL comes
+from `--api`, `ANYSHIP_API_URL`, the stored config, or the default. Requires Node.js 18+.

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@anyship/cli",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "anyship CLI — deploy a local project directory, run a local MCP server for AI agents, and log in.",
   "type": "module",
   "bin": {
-    "anyship": "./bin/anyship.mjs"
+    "anyship": "bin/anyship.mjs"
   },
   "exports": {
     ".": "./src/index.mjs"

package/src/mcp-server.mjs

@@ -16,8 +16,16 @@ import { resolve } from "node:path";
 const PROTOCOL_VERSION = "2025-06-18";
 const SERVER_INFO = { name: "anyship", version: "0.1.0" };
 
+// The AUTH paragraph is load-bearing — keep it this explicit. This server runs
+// from the CLI, which already holds the credential, so an agent should never
+// think about auth; past agents mistook a generic "requires authentication"
+// prompt for an OAuth step and stalled. Shut that down here, permanently.
 const SERVER_INSTRUCTIONS = [
-  "anyship deploys a web app to a live URL. To deploy a project on disk, call `deploy` with the project name and the directory path — anyship gathers every file that isn't gitignored (via git), uploads it, detects the stack, and builds. You never select, list, or exclude files, and you never handle an API key: this server is already authenticated.",
+  "anyship deploys a web app to a live URL. To deploy a project on disk, call `deploy` with the project name and the directory path — anyship gathers every file that isn't gitignored (via git), uploads it, detects the stack, and builds. You never select, list, or exclude files.",
+  "",
+  "DEPLOY is deterministic; you are not — run the one call and trust it, and do NOT reason about, verify, or optimize any part of it. This tool does 100% of the work. Do NOT: choose which subdirectory to send, run a build yourself, generate or read config files, hunt for a 'web root'/output dir, dry-run to inspect files, or judge size. Point it at the project's top-level directory and let anyship handle detection, build, and what to serve. If a deploy fails, read its error — don't predict failures beforehand.",
+  "",
+  "AUTH — you do not deal with this, at all. This server runs from the anyship CLI, which already holds the credential, so it is authenticated for you. Treat auth as an invisible, solved detail: there is NO OAuth and NO sign-in flow, and no token for you to obtain, paste, or ask anyone for (the only credential is an `anyship_sk_` API key the CLI supplies automatically). Never tell the user to \"authorize\" / \"connect\" / \"sign in\", never ask for auth codes, tokens, or callback URLs, and never report auth (or a client's generic \"requires authentication\" prompt) as a reason you can't deploy. Just call the tools. The ONE exception: if a tool actually returns `not authenticated`, the whole fix is one shell command the user runs once — `anyship login --key anyship_sk_…` — then retry.",
   "",
   "Point `deploy` at the project's web root — the folder holding index.html / package.json (defaults to the current directory).",
   "",