@anyslate/cli 0.1.0 → 0.2.0

package/src/commands/login.mjs

@@ -1,30 +1,58 @@
-// `anyslate login` — write `~/.anyslate/cli.json` with the user's MCP token.
+// `anyslate login` - validate credentials, then write `~/.anyslate/cli.json`.
 //
-// Mint the token in the desktop app at Settings → AI Memory → Connect → Mint
-// MCP Token (Professional tier only). Then:
+// Mint the token in the desktop app at Avatar (top-right) → API Tokens →
+// Create Token (available on every current tier). Then:
 //
 //   anyslate login --token <BEARER>
 //   anyslate login --token <BEARER> --handle <HANDLE_ID>
 //   anyslate login --token <BEARER> --api-url https://anyslate-mcp-service-development.<workers-dev-url>
 //
-// The file is written with mode 0600 — only the current user can read it.
+// The file is written with mode 0600 - only the current user can read it.
+//
+// W3: `login` used to perform ZERO network I/O — its imports were three
+// node: builtins. It accepted a token that is not a token and a hostname that
+// cannot resolve, printing success and exiting 0 for both. It now:
+//   1. checks token format,
+//   2. resolves URL shape (MUST precede any token verdict — a wrong URL 404s
+//      before auth middleware and masks the real answer),
+//   3. runs one live GET {root}/mcp/auth/verify,
+//   4. warns on a missing memory:write scope,
+//   5. writes the file ONLY on success.
+// `--force` writes anyway; `--no-verify` skips the probe (air-gapped setup).
 
 import { mkdirSync, writeFileSync, readFileSync } from 'node:fs';
-import { homedir } from 'node:os';
 import { join } from 'node:path';
+import { DEFAULT_API_URL, anyslateDir, isCaptureDisabled, normalizeApiRoot } from '../config.mjs';
+import { checkUrlShape, isValidTokenFormat, probeVerify, scopeWarning, tokenPreview } from '../verify.mjs';
+import { makeIo } from '../io.mjs';
 
 /**
  * @param {string[]} argv  arguments after `login`
+ * @param {{fetchImpl?: typeof fetch, env?: NodeJS.ProcessEnv}} [deps]
  * @returns {Promise<number>}
  */
-export async function runLogin(argv) {
+export async function runLogin(argv, deps = {}) {
+  const env = deps.env ?? process.env;
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const { out, err } = makeIo(deps);
   const flags = parseFlags(argv);
+
   if (!flags.token) {
-    process.stderr.write('usage: anyslate login --token <BEARER> [--handle <ID>] [--api-url <URL>]\n');
+    err.write(
+      'usage: anyslate login --token <BEARER> [--handle <ID>] [--api-url <URL>] [--force] [--no-verify]\n',
+    );
     return 2;
   }
 
-  const dir = join(homedir(), '.anyslate');
+  if (isCaptureDisabled(env)) {
+    // login is setup, not capture — it still runs, but say so, because the
+    // shell it was run in will capture nothing afterwards.
+    err.write(
+      'anyslate: note — ANYSLATE_DISABLE is set, so capture is off in this shell. `login` still writes your config.\n',
+    );
+  }
+
+  const dir = anyslateDir(env);
   const path = join(dir, 'cli.json');
   let existing = {};
   try {
@@ -33,35 +61,99 @@ export async function runLogin(argv) {
     existing = {};
   }
 
+  // --- 1. Token format ----------------------------------------------------
+  if (!isValidTokenFormat(flags.token)) {
+    const msg =
+      `anyslate: that doesn't look like an AnySlate token (expected as_mcp_… or as_oauth_…, got "${tokenPreview(flags.token)}").\n` +
+      'anyslate: mint one in the desktop app at Avatar (top-right) → API Tokens → Create Token.\n';
+    if (!flags.force) {
+      err.write(msg);
+      return 1;
+    }
+    err.write(msg);
+    err.write('anyslate: --force given — writing anyway.\n');
+  }
+
+  // --- 2. URL shape (MUST precede any token verdict) ----------------------
+  // Preserve the merge semantics — `login --token <new>` alone keeps the
+  // stored apiUrl — but re-normalize the merged value so a previously-bad
+  // apiUrl cannot survive a re-login.
+  const mergedUrl = flags.apiUrl ?? existing.apiUrl ?? existing.api_url ?? DEFAULT_API_URL;
+  const shape = checkUrlShape(mergedUrl);
+  if (!shape.ok) {
+    err.write(`${shape.message}\n`);
+    if (!flags.force) return 1;
+    err.write('anyslate: --force given — writing anyway.\n');
+  }
+  const root = shape.ok ? shape.root : normalizeApiRoot(mergedUrl);
+
+  if (shape.ok && shape.normalized) {
+    out.write(
+      `anyslate: apiUrl "${shape.original}" ends in /mcp — the CLI wants the service ROOT and appends /mcp itself.\n` +
+        `anyslate: using "${root}". Run \`anyslate login --api-url ${root}\` to persist.\n`,
+    );
+  }
+
+  // --- 3. Live probe ------------------------------------------------------
+  let verified = null;
+  if (flags.noVerify) {
+    err.write('anyslate: --no-verify given — skipping the live connection check.\n');
+  } else {
+    verified = await probeVerify({ root, token: flags.token, fetchImpl });
+    if (!verified.ok) {
+      err.write(`${verified.message}\n`);
+      if (!flags.force) {
+        err.write(
+          'anyslate: nothing was written. Re-run with a working --token/--api-url, or `--force` to write anyway, or `--no-verify` to skip the check.\n',
+        );
+        return 1;
+      }
+      err.write('anyslate: --force given — writing anyway.\n');
+    } else {
+      out.write(`${verified.message}\n`);
+      // --- 4. Scope check (warn, never block) -----------------------------
+      const warning = scopeWarning(verified.scopes);
+      if (warning) err.write(`${warning}\n`);
+    }
+  }
+
+  // --- 5. Write only on success (or --force / --no-verify) ----------------
   const next = {
     ...existing,
     mcp_token: flags.token,
     handle: flags.handle ?? existing.handle ?? null,
-    apiUrl: flags.apiUrl ?? existing.apiUrl ?? 'https://mcp.anyslate.io',
+    apiUrl: root,
   };
+  delete next.api_url; // collapse the legacy alias so only one key can drift
 
   try {
     mkdirSync(dir, { recursive: true, mode: 0o700 });
     writeFileSync(path, JSON.stringify(next, null, 2), { mode: 0o600 });
   } catch (e) {
-    process.stderr.write(`anyslate login: write failed (${e?.message ?? e})\n`);
+    err.write(`anyslate login: write failed (${e?.message ?? e})\n`);
     return 1;
   }
 
-  process.stdout.write(`anyslate: wrote ${path}\n`);
-  process.stdout.write(`  apiUrl: ${next.apiUrl}\n`);
-  process.stdout.write(`  handle: ${next.handle ?? '(none — bearer token only)'}\n`);
+  out.write(`anyslate: wrote ${path}\n`);
+  out.write(`  apiUrl: ${next.apiUrl}\n`);
+  out.write(`  handle: ${next.handle ?? '(none — bearer token only)'}\n`);
+  if (verified?.ok && verified.defaultHandleId) {
+    out.write(`  token is bound to handle: ${verified.defaultHandleId} (server-side scope)\n`);
+  }
+  out.write('anyslate: run `anyslate doctor` to verify the full setup.\n');
   return 0;
 }
 
 /** @param {string[]} argv */
 function parseFlags(argv) {
-  const out = {};
+  const out = { force: false, noVerify: false };
   for (let i = 0; i < argv.length; i += 1) {
     const a = argv[i];
     if (a === '--token' && argv[i + 1]) out.token = argv[++i];
     else if (a === '--handle' && argv[i + 1]) out.handle = argv[++i];
     else if ((a === '--api-url' || a === '--api_url') && argv[i + 1]) out.apiUrl = argv[++i];
+    else if (a === '--force') out.force = true;
+    else if (a === '--no-verify' || a === '--skip-verify') out.noVerify = true;
   }
   return out;
 }

package/src/commands/upload-artifact.mjs

@@ -1,4 +1,4 @@
-// `anyslate upload-artifact` — upload a file (or stdin) as an MCP artifact.
+// `anyslate upload-artifact` - upload a file (or stdin) as an MCP artifact.
 //
 // Usage:
 //   anyslate upload-artifact --session <id> --kind code_block --file ./diff.patch
@@ -6,63 +6,120 @@
 //
 // Returns the cloud://artifact/<id> URI on stdout (one per line) so callers
 // can pipe it into a subsequent `anyslate checkpoint --note ...` if desired.
+//
+// W11: `--file` used to `readFileSync(path, 'utf8')`, which silently mangles
+// binaries (measured: 64 raw bytes in → 124 bytes uploaded, exit 0). The
+// `upload_artifact` MCP tool is a TEXT channel, so we detect and refuse rather
+// than pretend. Both `--file` and stdin honour the same 5 MB cap; the stdin
+// path must never fall back to readStdin's 1 MB default.
 
 import { readFileSync } from 'node:fs';
 import { basename } from 'node:path';
-import { loadConfig, requireToken } from '../config.mjs';
-import { callTool } from '../mcp-client.mjs';
-import { readStdin } from '../stdin.mjs';
+import { loadConfig, requireToken, apiUrlNormalizationNotice, DISABLED_NOTICE } from '../config.mjs';
+import { callTool, formatCallFailure } from '../mcp-client.mjs';
+import { readStdin, stdinTimeoutFromEnv } from '../stdin.mjs';
+import { recordRun } from '../runlog.mjs';
+import { VERSION } from '../version.mjs';
+import { makeIo } from '../io.mjs';
 
 const ALLOWED_KINDS = new Set([
   'code_block', 'file_path', 'error_message', 'shell_command',
   'config_snippet', 'url_reference', 'fenced_quote',
 ]);
 
-const MAX_CONTENT_BYTES = 5_000_000;
+export const MAX_CONTENT_BYTES = 5_000_000;
+
+/** Uploading over a pipe may legitimately be slow; give stdin more idle room. */
+const STDIN_IDLE_TIMEOUT_MS = 60_000;
+
+/**
+ * A Buffer round-trips through utf8 iff it *is* valid utf8. Node replaces
+ * invalid sequences with U+FFFD, so re-encoding produces different bytes.
+ *
+ * @param {Buffer} buf
+ * @returns {boolean}
+ */
+export function isValidUtf8(buf) {
+  return Buffer.compare(Buffer.from(buf.toString('utf8'), 'utf8'), buf) === 0;
+}
 
 /**
  * @param {string[]} argv  arguments after `upload-artifact`
+ * @param {{env?: NodeJS.ProcessEnv, fetchImpl?: typeof fetch, stdin?: NodeJS.ReadableStream}} [deps]
  * @returns {Promise<number>}
  */
-export async function runUploadArtifact(argv) {
+export async function runUploadArtifact(argv, deps = {}) {
+  const env = deps.env ?? process.env;
+  const { out, err } = makeIo(deps);
   const flags = parseFlags(argv);
   if (!flags.session || !flags.kind) {
-    process.stderr.write('usage: anyslate upload-artifact --session <id> --kind <kind> [--file <path> | <stdin>] [--language <lang>] [--path-hint <name>]\n');
-    process.stderr.write(`  kinds: ${[...ALLOWED_KINDS].join(', ')}\n`);
+    err.write('usage: anyslate upload-artifact --session <id> --kind <kind> [--file <path> | <stdin>] [--language <lang>] [--path-hint <name>]\n');
+    err.write(`  kinds: ${[...ALLOWED_KINDS].join(', ')}\n`);
     return 2;
   }
   if (!ALLOWED_KINDS.has(flags.kind)) {
-    process.stderr.write(`anyslate upload-artifact: unsupported kind: ${flags.kind}\n`);
+    err.write(`anyslate upload-artifact: unsupported kind: ${flags.kind}\n`);
     return 2;
   }
 
-  const cfg = loadConfig();
+  const cfg = loadConfig(env);
+  if (cfg.disabled) {
+    err.write(`${DISABLED_NOTICE}\n`);
+    return 0;
+  }
+
+  const notice = apiUrlNormalizationNotice(cfg);
+  if (notice) err.write(notice);
+
   const tokenCheck = requireToken(cfg);
   if (!tokenCheck.ok) {
-    process.stderr.write(`anyslate upload-artifact: ${tokenCheck.error}\n`);
+    err.write(`anyslate upload-artifact: ${tokenCheck.error}\n`);
+    recordRun({ command: 'upload-artifact', ok: false, apiUrl: cfg.apiUrl, error: tokenCheck.error, version: VERSION, exitCode: 1 }, env);
     return 1;
   }
 
   let content;
   let pathHint = flags.pathHint;
   if (flags.file) {
+    let buf;
     try {
-      content = readFileSync(flags.file, 'utf8');
-      if (!pathHint) pathHint = basename(flags.file);
+      buf = readFileSync(flags.file);
     } catch (e) {
-      process.stderr.write(`anyslate upload-artifact: cannot read ${flags.file} (${e?.message ?? e})\n`);
+      err.write(`anyslate upload-artifact: cannot read ${flags.file} (${e?.message ?? e})\n`);
+      return 1;
+    }
+    if (buf.byteLength > MAX_CONTENT_BYTES) {
+      err.write(`anyslate upload-artifact: content exceeds ${MAX_CONTENT_BYTES} byte cap\n`);
       return 1;
     }
+    if (!isValidUtf8(buf)) {
+      err.write(
+        `anyslate: ${flags.file} is not valid UTF-8. Binary artifacts are not supported by upload-artifact.\n`,
+      );
+      return 1;
+    }
+    content = buf.toString('utf8');
+    if (!pathHint) pathHint = basename(flags.file);
   } else {
-    content = await readStdin();
+    // The 5 MB cap MUST be passed explicitly — readStdin's default is 1 MB and
+    // silently truncates.
+    try {
+      content = await readStdin(deps.stdin ?? process.stdin, {
+        maxBytes: MAX_CONTENT_BYTES,
+        timeoutMs: stdinTimeoutFromEnv(env, STDIN_IDLE_TIMEOUT_MS),
+      });
+    } catch (e) {
+      err.write(`anyslate upload-artifact: stdin read failed (${e?.message ?? e})\n`);
+      return 1;
+    }
   }
 
   if (!content || !content.length) {
-    process.stderr.write('anyslate upload-artifact: empty content (provide --file or pipe data on stdin)\n');
+    err.write('anyslate upload-artifact: empty content (provide --file or pipe data on stdin)\n');
     return 1;
   }
   if (Buffer.byteLength(content, 'utf8') > MAX_CONTENT_BYTES) {
-    process.stderr.write(`anyslate upload-artifact: content exceeds ${MAX_CONTENT_BYTES} byte cap\n`);
+    err.write(`anyslate upload-artifact: content exceeds ${MAX_CONTENT_BYTES} byte cap\n`);
     return 1;
   }
 
@@ -81,20 +138,69 @@ export async function runUploadArtifact(argv) {
       token: cfg.mcpToken,
       toolName: 'upload_artifact',
       args,
+      fetchImpl: deps.fetchImpl,
     });
     if (!res.ok) {
-      const msg = typeof res.data === 'string' ? res.data : JSON.stringify(res.data);
-      process.stderr.write(`anyslate upload-artifact: server ${res.status} — ${msg}\n`);
+      const message = formatCallFailure('anyslate upload-artifact', res);
+      err.write(message);
+      recordRun(
+        {
+          command: 'upload-artifact',
+          ok: false,
+          apiUrl: cfg.apiUrl,
+          status: res.status,
+          isError: !!res.isError,
+          networkError: !!res.networkError,
+          error: message.trim(),
+          version: VERSION,
+          exitCode: 1,
+        },
+        env,
+      );
       return 1;
     }
-    process.stdout.write(`${JSON.stringify(res.data)}\n`);
+    recordRun({ command: 'upload-artifact', ok: true, apiUrl: cfg.apiUrl, status: res.status, version: VERSION, exitCode: 0 }, env);
+    out.write(`${formatUploadArtifactOutput(res.data)}\n`);
     return 0;
   } catch (e) {
-    process.stderr.write(`anyslate upload-artifact: request failed (${e?.message ?? e})\n`);
+    const message = `anyslate upload-artifact: request failed (${e?.message ?? e})\n`;
+    err.write(message);
+    recordRun({ command: 'upload-artifact', ok: false, apiUrl: cfg.apiUrl, error: message.trim(), version: VERSION, exitCode: 1 }, env);
     return 1;
   }
 }
 
+/**
+ * @param {unknown} data
+ * @returns {string}
+ */
+export function formatUploadArtifactOutput(data) {
+  const uri = extractArtifactUri(data);
+  return uri || JSON.stringify(data);
+}
+
+/**
+ * @param {unknown} data
+ * @returns {string|null}
+ */
+function extractArtifactUri(data) {
+  if (typeof data === 'string') {
+    return data.startsWith('cloud://artifact/') ? data : null;
+  }
+  if (!data || typeof data !== 'object') return null;
+  for (const key of ['cloud_uri', 'cloudUri', 'uri', 'artifact_uri', 'artifactUri']) {
+    const v = data[key];
+    if (typeof v === 'string' && v.startsWith('cloud://artifact/')) return v;
+  }
+  const artifact = data.artifact;
+  if (artifact && typeof artifact === 'object') {
+    const nestedUri = extractArtifactUri(artifact);
+    if (nestedUri) return nestedUri;
+  }
+  const id = data.artifact_id || data.artifactId || data.id;
+  return typeof id === 'string' && id.length > 0 ? `cloud://artifact/${id}` : null;
+}
+
 /** @param {string[]} argv */
 function parseFlags(argv) {
   const out = {};

package/src/config.mjs

@@ -10,7 +10,14 @@
 //
 // All file reads tolerate missing / unreadable files; the CLI fails open so
 // `anyslate hook session-start` never breaks a Claude Code session because of
-// a missing config — it just no-ops with a warning to stderr.
+// a missing config - it just no-ops with a warning to stderr.
+//
+// URL normalization (W1): the CLI wants the service ROOT and appends `/mcp`
+// itself. A config whose apiUrl already ends in `/mcp` produced `/mcp/mcp` and
+// a permanent 404 that masked every token verdict (the 404 fires at
+// app.notFound() BEFORE auth middleware). We therefore normalize on the READ
+// path, not only in `login`, so already-broken configs self-heal without a
+// re-login.
 
 import { readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
@@ -18,22 +25,70 @@ import { join } from 'node:path';
 
 export const DEFAULT_API_URL = 'https://mcp.anyslate.io';
 
-const CONFIG_PATHS = [
-  () => join(homedir(), '.anyslate', 'cli.json'),
-  () => join(homedir(), '.anyslate', 'session.json'),
-];
+/** Where the desktop app / CLI keep their state. `ANYSLATE_HOME` overrides. */
+export function anyslateDir(env = process.env) {
+  if (env.ANYSLATE_HOME && env.ANYSLATE_HOME.trim()) return env.ANYSLATE_HOME.trim();
+  return join(homedir(), '.anyslate');
+}
+
+export function configPaths(env = process.env) {
+  const dir = anyslateDir(env);
+  return [join(dir, 'cli.json'), join(dir, 'session.json')];
+}
+
+/**
+ * Strip trailing slashes AND every trailing `/mcp` segment.
+ *
+ * `(\/mcp)+$` — not `\/mcp$`. The single-segment form leaves an already
+ * double-suffixed `…/mcp/mcp` broken (defect #45).
+ *
+ * @param {unknown} u
+ * @returns {string}
+ */
+export function normalizeApiRoot(u) {
+  return String(u ?? '')
+    .trim()
+    .replace(/\/+$/, '')
+    .replace(/(\/mcp)+$/i, '');
+}
+
+/**
+ * The dedicated capture kill switch (Q5). Deliberately NOT implemented by
+ * changing the falsy-coalescing of ANYSLATE_MCP_TOKEN — an empty string there
+ * still falls through to the file token, and scripts that clear variables by
+ * emptying them must keep working.
+ *
+ * @param {NodeJS.ProcessEnv} env
+ * @returns {boolean}
+ */
+export function isCaptureDisabled(env = process.env) {
+  const v = env.ANYSLATE_DISABLE;
+  if (v === undefined || v === null) return false;
+  const s = String(v).trim().toLowerCase();
+  if (s === '' || s === '0' || s === 'false' || s === 'no' || s === 'off') return false;
+  return true;
+}
+
+export const DISABLED_NOTICE =
+  'anyslate: ANYSLATE_DISABLE is set — capture disabled for this shell (no network call made).';
 
 /**
  * @param {NodeJS.ProcessEnv} env
  * @param {() => string[]} [paths] override for tests
- * @returns {{apiUrl: string, mcpToken: string|null, handle: string|null, source: string}}
+ * @returns {{
+ *   apiUrl: string, apiUrlRaw: string, apiUrlNormalized: boolean,
+ *   mcpToken: string|null, handle: string|null,
+ *   source: string, sources: {apiUrl: string, mcpToken: string, handle: string},
+ *   disabled: boolean
+ * }}
  */
 export function loadConfig(env = process.env, paths) {
-  const candidates = paths ? paths() : CONFIG_PATHS.map((fn) => fn());
+  const candidates = paths ? paths() : configPaths(env);
 
-  /** @type {{apiUrl?: string, mcp_token?: string, handle?: string}} */
+  /** @type {{apiUrl?: string, api_url?: string, mcp_token?: string, token?: string, handle?: string}} */
   let fileConfig = {};
   let source = 'env';
+  let filePath = null;
   for (const p of candidates) {
     try {
       const raw = readFileSync(p, 'utf8');
@@ -41,18 +96,61 @@ export function loadConfig(env = process.env, paths) {
       if (parsed && typeof parsed === 'object') {
         fileConfig = parsed;
         source = p;
+        filePath = p;
         break;
       }
     } catch {
-      // ignore — fall through to next candidate
+      // ignore - fall through to next candidate
     }
   }
 
-  const apiUrl = (env.ANYSLATE_API_URL || fileConfig.apiUrl || fileConfig.api_url || DEFAULT_API_URL).replace(/\/+$/, '');
+  // Per-key provenance. `source` alone is misleading: it names the file that
+  // parsed, while an env var may still be winning for an individual key
+  // (defect #38 / W4 check #1).
+  const layerOf = (envValue, fileValue) => {
+    if (envValue) return 'env';
+    if (fileValue) return filePath ?? 'default';
+    return 'default';
+  };
+
+  const apiUrlRaw = String(
+    env.ANYSLATE_API_URL || fileConfig.apiUrl || fileConfig.api_url || DEFAULT_API_URL,
+  ).trim();
+  const apiUrl = normalizeApiRoot(apiUrlRaw);
+  const apiUrlNormalized = apiUrl !== apiUrlRaw.replace(/\/+$/, '');
+
   const mcpToken = env.ANYSLATE_MCP_TOKEN || fileConfig.mcp_token || fileConfig.token || null;
   const handle = env.ANYSLATE_HANDLE || fileConfig.handle || null;
 
-  return { apiUrl, mcpToken, handle, source };
+  return {
+    apiUrl,
+    apiUrlRaw,
+    apiUrlNormalized,
+    mcpToken,
+    handle,
+    source,
+    sources: {
+      apiUrl: layerOf(env.ANYSLATE_API_URL, fileConfig.apiUrl || fileConfig.api_url),
+      mcpToken: layerOf(env.ANYSLATE_MCP_TOKEN, fileConfig.mcp_token || fileConfig.token),
+      handle: layerOf(env.ANYSLATE_HANDLE, fileConfig.handle),
+    },
+    disabled: isCaptureDisabled(env),
+  };
+}
+
+/**
+ * Exact user-facing notice for a rewritten apiUrl. Silent correction teaches
+ * the user nothing, so every command that resolves a rewritten URL says so.
+ *
+ * @param {{apiUrlRaw: string, apiUrl: string, apiUrlNormalized: boolean}} cfg
+ * @returns {string|null}
+ */
+export function apiUrlNormalizationNotice(cfg) {
+  if (!cfg?.apiUrlNormalized) return null;
+  return (
+    `anyslate: apiUrl "${cfg.apiUrlRaw}" ends in /mcp — the CLI wants the service ROOT and appends /mcp itself.\n` +
+    `anyslate: using "${cfg.apiUrl}". Run \`anyslate login --api-url ${cfg.apiUrl}\` to persist.\n`
+  );
 }
 
 /**
@@ -64,7 +162,7 @@ export function requireToken(cfg) {
     return {
       ok: false,
       error:
-        'no MCP token configured. Run `anyslate login --token <BEARER>` or set ANYSLATE_MCP_TOKEN. Mint a token at Settings → AI Memory → Connect in the AnySlate desktop app.',
+        'no MCP token configured. Run `anyslate login --token <BEARER>` or set ANYSLATE_MCP_TOKEN. Mint a token in the AnySlate desktop app at Avatar (top-right) → API Tokens.',
     };
   }
   return { ok: true };