@anyship/cli 0.3.0 → 0.3.2

package/README.md

@@ -21,23 +21,20 @@ never hand-pick files.
 
 ### `anyship login`
 
-Run **`anyship login`** with no arguments and it opens your browser to sign in
-(OAuth) — the same login you use for the anyship connector, no key required. It
-stores the resulting token in `~/.anyship/config.json` (mode `0600`), refreshing
-it automatically. This is the common path now that most people connect with
-browser login.
-
-Prefer an API key (CI, scripts)? Pass one and it's validated + stored instead:
+An **`anyship_sk_…` API key is the only credential — there is no browser/OAuth
+login.** `anyship login` takes your key, validates it against the control plane,
+and stores it in `~/.anyship/config.json` (mode `0600`), so `deploy` and `mcp`
+authenticate automatically afterward. Grab the key from the anyship dashboard.
 
 ```bash
-anyship login                          # browser login (OAuth) — no key
-anyship login --key anyship_sk_…       # or an API key: echo $KEY | anyship login --with-token
+anyship login --key anyship_sk_…       # validate + store the key
+echo $KEY | anyship login --with-token # or pipe it (CI / scripts — no key in shell history)
 anyship logout                         # remove stored credentials
 ```
 
-`deploy` and `mcp` then authenticate automatically. If neither a key nor a stored
-token is present, `deploy` triggers the browser login on first use; the `mcp`
-server uses only stored auth (run `anyship login` once first).
+If no key is present, `login` errors telling you to supply one — it never opens a
+browser. (OAuth exists only for **dashboard** sign-in — Google/GitHub — never for
+the CLI, MCP, or deploy.)
 
 ### `anyship deploy [path]`
 
@@ -47,36 +44,88 @@ stack, builds if needed, and returns a live URL.
 ```bash
 anyship deploy --project my-app .
 anyship deploy --project my-app . --dry-run   # list what would be uploaded
+anyship status --project my-app --watch       # poll until deployed or failed
 ```
 
 Options: `--project <name>`, `--api <url>`, `--key <token>`, `--env <json>`,
 `--dry-run`, `--json`.
 
+### `anyship status --project <name>`
+
+Show deployment status for a project — same information as the MCP
+`deployment_status` tool, via the REST API (not `/mcp`).
+
+```bash
+anyship status --project my-app
+anyship status --project my-app --watch --interval 15
+```
+
+Options: `--project <name>`, `--api <url>`, `--key <token>`, `--json`, `--watch`,
+`--interval <sec>`.
+
 ### `anyship mcp`
 
 Run a local [MCP](https://modelcontextprotocol.io) server over stdio. Its
 `deploy` tool takes a **directory path** and gathers the files for you; every
 other tool (`list_projects`, `deployment_status`, `add_domain`, `logs`, …) is
-proxied to the control plane. Add it to Claude Code:
+proxied to the control plane.
+
+**Claude Code**
 
 ```bash
-anyship login
-claude mcp add anyship -- npx -y @anyship/cli mcp
+anyship login --key anyship_sk_…
+claude mcp add --scope user anyship -e ANYSHIP_API_KEY=anyship_sk_… -- npx -y @anyship/cli@latest mcp
+```
+
+**Cursor** (`~/.cursor/mcp.json`), **Claude Desktop** (`claude_desktop_config.json`), and **Codex** (`~/.codex/config.toml`):
+
+Electron-based clients spawn MCP with a minimal environment — bare `npx` can fail
+before the server starts. Wrap the launch in your login shell so `npx` resolves
+from your normal PATH (nvm, Homebrew, fnm, …). Use `zsh` on macOS, `bash` on
+Linux:
+
+```json
+{
+  "mcpServers": {
+    "anyship": {
+      "command": "zsh",
+      "args": ["-lc", "npx -y @anyship/cli@latest mcp"],
+      "env": { "ANYSHIP_API_KEY": "anyship_sk_…" }
+    }
+  }
+}
+```
+
+Codex (`~/.codex/config.toml`) — same idea:
+
+```toml
+[mcp_servers.anyship]
+command = "zsh"
+args = ["-lc", "npx -y @anyship/cli@latest mcp"]
+
+[mcp_servers.anyship.env]
+ANYSHIP_API_KEY = "anyship_sk_…"
 ```
 
 Then in any conversation: **"deploy this to anyship."** The agent never selects
 files and never handles your API key.
 
+> The `@latest` tag is deliberate: the stdio server is long-lived and `npx`
+> caches by spec, so an unpinned `@anyship/cli` keeps launching whatever version
+> is already cached — a republish would never reach you. `@latest` re-resolves
+> against the registry each time the client (re)starts the server. Keep it pinned.
+
 ## Configuration
 
-Auth resolves in this order — an **API key** if you have one, otherwise **OAuth**:
+The `anyship_sk_…` API key is the only credential. It resolves in this order (first
+hit wins); if none is found, the command fails loudly rather than falling back to
+any other account:
 
 1. `--key` flag
 2. `ANYSHIP_API_KEY` env
-3. a stored API key (`~/.anyship/config.json`)
-4. an `mcp_servers.anyship` entry in `~/.codex/config.toml`
-5. a stored **OAuth token** (`~/.anyship/config.json`, auto-refreshed)
-6. otherwise → browser login (interactive commands only)
+3. a stored key (`~/.anyship/config.json`, written by `anyship login`)
+4. the anyship MCP-connector key from an existing client config — `~/.codex/config.toml`
+   or `~/.claude.json` (so configuring the connector is enough for the CLI too)
 
-The control-plane URL comes from `--api`, `ANYSHIP_API_URL`, the stored config, or
-the default. Requires Node.js 18+.
+There is no OAuth token and no browser-login fallback. The control-plane URL comes
+from `--api`, `ANYSHIP_API_URL`, the stored config, or the default. Requires Node.js 18+.

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@anyship/cli",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "anyship CLI — deploy a local project directory, run a local MCP server for AI agents, and log in.",
   "type": "module",
   "bin": {
-    "anyship": "./bin/anyship.mjs"
+    "anyship": "bin/anyship.mjs"
   },
   "exports": {
     ".": "./src/index.mjs"

package/src/deploy-directory.mjs

@@ -96,16 +96,26 @@ export function codexAnyshipConfig(home = homedir()) {
   const configPath = join(home, ".codex", "config.toml");
   if (!existsSync(configPath)) return {};
   const lines = readFileSync(configPath, "utf8").split(/\n/);
-  const start = lines.findIndex((line) => /^\[mcp_servers\.("?anyship"?)\]\s*$/.test(line.trim()));
-  if (start < 0) return {};
-  const section = [];
-  for (let i = start; i < lines.length; i += 1) {
-    if (i !== start && lines[i].trim().startsWith("[")) break;
-    section.push(lines[i]);
-  }
-  const text = section.join("\n");
+  const sectionText = (header) => {
+    const start = lines.findIndex((line) => line.trim() === header);
+    if (start < 0) return "";
+    const section = [];
+    for (let i = start; i < lines.length; i += 1) {
+      if (i !== start && lines[i].trim().startsWith("[")) break;
+      section.push(lines[i]);
+    }
+    return section.join("\n");
+  };
+  const main = sectionText("[mcp_servers.anyship]");
+  const env = sectionText("[mcp_servers.anyship.env]");
+  if (!main && !env) return {};
+  const text = `${main}\n${env}`;
   const url = text.match(/url\s*=\s*"([^"]+)"/)?.[1]?.replace(/\/mcp\/?$/, "");
-  const token = text.match(/Bearer ([^"]+)/)?.[1]?.trim();
+  const bearer = text.match(/Bearer ([^"]+)/)?.[1]?.trim();
+  const envKey =
+    text.match(/ANYSHIP_API_KEY\s*=\s*"([^"]+)"/)?.[1]?.trim() ||
+    text.match(/ANYSHIP_API_KEY\s*=\s*'([^']+)'/)?.[1]?.trim();
+  const token = bearer || envKey;
   return { url, token };
 }
 
@@ -127,7 +137,10 @@ export function claudeCodeAnyshipConfig(home = homedir()) {
     if (!entry || typeof entry !== "object") return null;
     const url = typeof entry.url === "string" ? entry.url.replace(/\/mcp\/?$/, "") : undefined;
     const auth = (entry.headers && (entry.headers.Authorization || entry.headers.authorization)) || "";
-    const token = /Bearer\s+(anyship_sk_[A-Za-z0-9]+)/.exec(auth)?.[1];
+    const bearer = /Bearer\s+(anyship_sk_[A-Za-z0-9]+)/.exec(auth)?.[1];
+    const envKey =
+      typeof entry.env?.ANYSHIP_API_KEY === "string" ? entry.env.ANYSHIP_API_KEY.trim() : undefined;
+    const token = bearer || envKey;
     return url || token ? { url, token } : null;
   };
   const found = [];

package/src/index.mjs

@@ -1,6 +1,7 @@
 import { runDeploy } from "./deploy-directory.mjs";
 import { runMcpServer } from "./mcp-server.mjs";
 import { runLogin, runLogout } from "./login.mjs";
+import { runStatus } from "./status.mjs";
 
 export function usage(commandName = "anyship") {
   return `Usage: ${commandName} <command>
@@ -9,6 +10,7 @@ Commands:
   login    Save your anyship API key so deploy/mcp authenticate automatically
   logout   Remove stored credentials
   deploy   Upload a complete safe source archive and deploy it to anyship
+  status   Show deployment status for a project (poll with --watch after deploy)
   mcp      Run a local MCP server (stdio) so an AI agent can deploy directories directly
 
 Run "${commandName} <command> --help" for command options.`;
@@ -29,9 +31,12 @@ export async function runCli(argv, io = defaultIo()) {
   if (command === "deploy") {
     return runDeploy(rest, io, { commandName: "anyship deploy" });
   }
+  if (command === "status") {
+    return runStatus(rest, io, { commandName: "anyship status" });
+  }
   if (command === "mcp") {
     // Long-lived: reads JSON-RPC on stdin, writes on stdout. Configured in a
-    // client via `claude mcp add anyship -- npx -y @anyship/cli mcp` (after
+    // client via `claude mcp add anyship -- npx -y @anyship/cli@latest mcp` (after
     // `anyship login`, no --env needed).
     return runMcpServer();
   }

package/src/mcp-server.mjs

@@ -16,8 +16,16 @@ import { resolve } from "node:path";
 const PROTOCOL_VERSION = "2025-06-18";
 const SERVER_INFO = { name: "anyship", version: "0.1.0" };
 
+// The AUTH paragraph is load-bearing — keep it this explicit. This server runs
+// from the CLI, which already holds the credential, so an agent should never
+// think about auth; past agents mistook a generic "requires authentication"
+// prompt for an OAuth step and stalled. Shut that down here, permanently.
 const SERVER_INSTRUCTIONS = [
-  "anyship deploys a web app to a live URL. To deploy a project on disk, call `deploy` with the project name and the directory path — anyship gathers every file that isn't gitignored (via git), uploads it, detects the stack, and builds. You never select, list, or exclude files, and you never handle an API key: this server is already authenticated.",
+  "anyship deploys a web app to a live URL. To deploy a project on disk, call `deploy` with the project name and the directory path — anyship gathers every file that isn't gitignored (via git), uploads it, detects the stack, and builds. You never select, list, or exclude files.",
+  "",
+  "DEPLOY is deterministic; you are not — run the one call and trust it, and do NOT reason about, verify, or optimize any part of it. This tool does 100% of the work. Do NOT: choose which subdirectory to send, run a build yourself, generate or read config files, hunt for a 'web root'/output dir, dry-run to inspect files, or judge size. Point it at the project's top-level directory and let anyship handle detection, build, and what to serve. If a deploy fails, read its error — don't predict failures beforehand.",
+  "",
+  "AUTH — you do not deal with this, at all. This server runs from the anyship CLI, which already holds the credential, so it is authenticated for you. Treat auth as an invisible, solved detail: there is NO OAuth and NO sign-in flow, and no token for you to obtain, paste, or ask anyone for (the only credential is an `anyship_sk_` API key the CLI supplies automatically). Never tell the user to \"authorize\" / \"connect\" / \"sign in\", never ask for auth codes, tokens, or callback URLs, and never report auth (or a client's generic \"requires authentication\" prompt) as a reason you can't deploy. Just call the tools. The ONE exception: if a tool actually returns `not authenticated`, the whole fix is one shell command the user runs once — `anyship login --key anyship_sk_…` — then retry.",
   "",
   "Point `deploy` at the project's web root — the folder holding index.html / package.json (defaults to the current directory).",
   "",

package/src/status.mjs

@@ -0,0 +1,136 @@
+import {
+  apiErrorMessage,
+  apiUrl,
+  mcpConnectorConfig,
+  resolveBearer,
+} from "./deploy-directory.mjs";
+
+function parseJson(text) {
+  if (!text) return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
+}
+
+export function statusUsage(commandName = "anyship status") {
+  return `Usage: ${commandName} --project <name>
+
+Options:
+  --project <name>   anyship project name
+  --api <url>        control-plane URL (defaults to ANYSHIP_API_URL, ~/.anyship, or MCP connector config)
+  --key <token>      anyship API key (defaults to ANYSHIP_API_KEY, ~/.anyship, or MCP connector config)
+  --json             Print the full JSON response
+  --watch            Poll until the latest deployment is deployed or failed
+  --interval <sec>   Seconds between polls when --watch is set (default 10)`;
+}
+
+export function parseStatusArgs(argv) {
+  const args = { interval: 10 };
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--help" || arg === "-h") {
+      args.help = true;
+      continue;
+    }
+    if (arg === "--json") {
+      args.json = true;
+      continue;
+    }
+    if (arg === "--watch") {
+      args.watch = true;
+      continue;
+    }
+    if (arg === "--project") {
+      args.project = requiredValue(argv, i, arg);
+      i += 1;
+      continue;
+    }
+    if (arg === "--api") {
+      args.api = requiredValue(argv, i, arg);
+      i += 1;
+      continue;
+    }
+    if (arg === "--key") {
+      args.key = requiredValue(argv, i, arg);
+      i += 1;
+      continue;
+    }
+    if (arg === "--interval") {
+      const raw = Number(requiredValue(argv, i, arg));
+      if (!Number.isFinite(raw) || raw < 1) throw new Error("--interval must be a positive number");
+      args.interval = raw;
+      i += 1;
+      continue;
+    }
+    throw new Error(`unknown argument: ${arg}`);
+  }
+  if (!args.help && !args.project) throw new Error("--project is required");
+  return args;
+}
+
+function requiredValue(argv, index, flag) {
+  const value = argv[index + 1];
+  if (!value || value.startsWith("--")) throw new Error(`${flag} requires a value`);
+  return value;
+}
+
+export async function fetchProjectStatus(args, hooks = {}) {
+  const config = hooks.config ?? mcpConnectorConfig();
+  const api = hooks.apiUrl ? hooks.apiUrl(args, config) : apiUrl(args, config);
+  const io = hooks.io ?? { stdout: () => {}, stderr: (t) => process.stderr.write(`${t}\n`) };
+  const token = await resolveBearer(args, io, { interactive: hooks.interactive ?? false });
+  const fetchImpl = hooks.fetch ?? fetch;
+  const res = await fetchImpl(
+    `${api}/api/deploy-from-archive/status?project=${encodeURIComponent(args.project)}`,
+    { headers: { Authorization: `Bearer ${token}` } },
+  );
+  const text = await res.text();
+  const data = parseJson(text);
+  if (!res.ok) {
+    throw new Error(apiErrorMessage(res.status, data, text));
+  }
+  return data ?? {};
+}
+
+function terminalStatus(status) {
+  return status === "deployed" || status === "failed";
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+export async function runStatus(argv, io = defaultIo(), options = {}) {
+  const commandName = options.commandName ?? "anyship status";
+  const args = parseStatusArgs(argv);
+  if (args.help) {
+    io.stdout(statusUsage(commandName));
+    return 0;
+  }
+
+  do {
+    const status = await fetchProjectStatus(args, {
+      io,
+      interactive: false,
+      fetch: options.fetch,
+    });
+    if (args.json) {
+      io.stdout(JSON.stringify(status, null, 2));
+    } else {
+      io.stdout(String(status.message ?? "No status available."));
+    }
+    if (!args.watch || terminalStatus(status.latest?.status)) break;
+    await sleep(args.interval * 1000);
+  } while (true);
+
+  return 0;
+}
+
+function defaultIo() {
+  return {
+    stdout: (text) => console.log(text),
+    stderr: (text) => console.error(text),
+  };
+}