@anyslate/cli 0.2.0 → 0.3.1

package/src/commands/login.mjs

@@ -1,65 +1,144 @@
-// `anyslate login` - validate credentials, then write `~/.anyslate/cli.json`.
+// `anyslate login` - two credential paths, one config file.
 //
-// Mint the token in the desktop app at Avatar (top-right) → API Tokens →
-// Create Token (available on every current tier). Then:
+//   anyslate login                        OAuth browser flow (default, humans)
+//   anyslate login --api-url <root>       ... against dev / a local wrangler
+//   anyslate login --token as_mcp_…       static token (CI, air-gapped, scripts)
 //
-//   anyslate login --token <BEARER>
-//   anyslate login --token <BEARER> --handle <HANDLE_ID>
-//   anyslate login --token <BEARER> --api-url https://anyslate-mcp-service-development.<workers-dev-url>
+// The static-token path is UNCHANGED and stays first-class. It is the only one
+// that works where no browser exists, and a long-lived token is the right shape
+// for a CI secret. `--token` is therefore the switch between the two paths: its
+// presence selects the static flow, its absence selects OAuth.
 //
-// The file is written with mode 0600 - only the current user can read it.
-//
-// W3: `login` used to perform ZERO network I/O — its imports were three
-// node: builtins. It accepted a token that is not a token and a hostname that
-// cannot resolve, printing success and exiting 0 for both. It now:
-//   1. checks token format,
-//   2. resolves URL shape (MUST precede any token verdict — a wrong URL 404s
-//      before auth middleware and masks the real answer),
-//   3. runs one live GET {root}/mcp/auth/verify,
-//   4. warns on a missing memory:write scope,
-//   5. writes the file ONLY on success.
+// Ordering in the static path is load-bearing and is preserved verbatim:
+//   1. token format,
+//   2. URL shape (MUST precede any token verdict — a wrong URL 404s before auth
+//      middleware and masks the real answer),
+//   3. one live GET {root}/mcp/auth/verify,
+//   4. scope warning,
+//   5. write ONLY on success.
 // `--force` writes anyway; `--no-verify` skips the probe (air-gapped setup).
+//
+// The OAuth path ends at the same place — one `/mcp/auth/verify` probe, the same
+// printed verdict line — so "logged in" means exactly one thing regardless of
+// how the credential was obtained.
 
-import { mkdirSync, writeFileSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { DEFAULT_API_URL, anyslateDir, isCaptureDisabled, normalizeApiRoot } from '../config.mjs';
 import { checkUrlShape, isValidTokenFormat, probeVerify, scopeWarning, tokenPreview } from '../verify.mjs';
+import { readConfigFile, writeConfigFile } from '../credentials.mjs';
+import {
+  DEFAULT_CALLBACK_TIMEOUT_S,
+  REGISTERED_REDIRECT_URI,
+  buildAuthorizeUrl,
+  discover,
+  exchangeCode,
+  generatePkce,
+  generateState,
+  openBrowser,
+  registerClient,
+  startCallbackServer,
+} from '../oauth.mjs';
 import { makeIo } from '../io.mjs';
 
+export const USAGE =
+  'usage: anyslate login [--api-url <URL>] [--no-browser] [--timeout <seconds>] [--handle <ID>]\n' +
+  '       anyslate login --token <BEARER> [--handle <ID>] [--api-url <URL>] [--force] [--no-verify]\n' +
+  '\n' +
+  '  With no --token, `login` opens your browser and signs you in with OAuth.\n' +
+  '  --token keeps the static-token path for CI and air-gapped setups.';
+
 /**
  * @param {string[]} argv  arguments after `login`
- * @param {{fetchImpl?: typeof fetch, env?: NodeJS.ProcessEnv}} [deps]
+ * @param {{fetchImpl?: typeof fetch, env?: NodeJS.ProcessEnv,
+ *          openBrowserImpl?: typeof openBrowser,
+ *          onAuthorizeUrl?: (url: string, ctx: object) => unknown}} [deps]
  * @returns {Promise<number>}
  */
 export async function runLogin(argv, deps = {}) {
-  const env = deps.env ?? process.env;
-  const fetchImpl = deps.fetchImpl ?? fetch;
-  const { out, err } = makeIo(deps);
   const flags = parseFlags(argv);
-
-  if (!flags.token) {
-    err.write(
-      'usage: anyslate login --token <BEARER> [--handle <ID>] [--api-url <URL>] [--force] [--no-verify]\n',
-    );
+  if (flags.help) {
+    makeIo(deps).err.write(`${USAGE}\n`);
     return 2;
   }
+  return flags.token ? runTokenLogin(flags, deps) : runOauthLogin(flags, deps);
+}
+
+// ---------------------------------------------------------------------------
+// Shared
+// ---------------------------------------------------------------------------
+
+/**
+ * Resolve the service root for `login`.
+ *
+ * `--api-url` wins. When it is ABSENT the answer is always production — the
+ * stored value is deliberately NOT inherited.
+ *
+ * Inheriting it (the pre-0.3.1 behaviour) meant that once anything had written
+ * a non-production apiUrl — a past `--api-url` run, or a stale config from an
+ * older build — a bare `anyslate login` silently kept signing in to that
+ * environment. A user who typed the shortest possible command got a non-obvious
+ * endpoint, and a non-production hostname ended up in the URL printed to the
+ * terminal and opened in a browser. Sign-in is the one place the target must be
+ * explicit rather than sticky: pass `--api-url` for dev or local, omit it for
+ * production. Every other command still reads the stored apiUrl as before —
+ * this override applies to `login` only.
+ */
+function resolveRoot(flags, existing, io) {
+  const stored = existing.apiUrl ?? existing.api_url ?? null;
+  const merged = flags.apiUrl ?? DEFAULT_API_URL;
+  const shape = checkUrlShape(merged);
+  const root = shape.ok ? shape.root : normalizeApiRoot(merged);
 
-  if (isCaptureDisabled(env)) {
-    // login is setup, not capture — it still runs, but say so, because the
-    // shell it was run in will capture nothing afterwards.
-    err.write(
-      'anyslate: note — ANYSLATE_DISABLE is set, so capture is off in this shell. `login` still writes your config.\n',
+  // Say so when we are switching them off a stored non-production endpoint, so
+  // the change of target is never silent in either direction.
+  if (!flags.apiUrl && stored) {
+    const storedRoot = normalizeApiRoot(stored);
+    if (storedRoot && storedRoot !== root) {
+      io.out.write(
+        `anyslate: signing in to production (${root}).\n` +
+          `anyslate: your config points at ${storedRoot} — pass \`--api-url ${storedRoot}\` to sign in there instead.\n`,
+      );
+    }
+  }
+
+  if (shape.ok && shape.normalized) {
+    io.out.write(
+      `anyslate: apiUrl "${shape.original}" ends in /mcp — the CLI wants the service ROOT and appends /mcp itself.\n` +
+        `anyslate: using "${root}". Run \`anyslate login --api-url ${root}\` to persist.\n`,
     );
   }
+  return { shape, root };
+}
+
+function noteIfCaptureDisabled(env, io) {
+  if (!isCaptureDisabled(env)) return;
+  io.err.write(
+    'anyslate: note — ANYSLATE_DISABLE is set, so capture is off in this shell. `login` still writes your config.\n',
+  );
+}
 
-  const dir = anyslateDir(env);
-  const path = join(dir, 'cli.json');
-  let existing = {};
+function hostOf(root) {
   try {
-    existing = JSON.parse(readFileSync(path, 'utf8')) || {};
+    return new URL(root).host;
   } catch {
-    existing = {};
+    return root;
   }
+}
+
+// ---------------------------------------------------------------------------
+// Static token path (behaviour unchanged)
+// ---------------------------------------------------------------------------
+
+async function runTokenLogin(flags, deps) {
+  const env = deps.env ?? process.env;
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const io = makeIo(deps);
+  const { out, err } = io;
+
+  noteIfCaptureDisabled(env, io);
+
+  const path = join(anyslateDir(env), 'cli.json');
+  const existing = readConfigFile(env);
 
   // --- 1. Token format ----------------------------------------------------
   if (!isValidTokenFormat(flags.token)) {
@@ -75,24 +154,12 @@ export async function runLogin(argv, deps = {}) {
   }
 
   // --- 2. URL shape (MUST precede any token verdict) ----------------------
-  // Preserve the merge semantics — `login --token <new>` alone keeps the
-  // stored apiUrl — but re-normalize the merged value so a previously-bad
-  // apiUrl cannot survive a re-login.
-  const mergedUrl = flags.apiUrl ?? existing.apiUrl ?? existing.api_url ?? DEFAULT_API_URL;
-  const shape = checkUrlShape(mergedUrl);
+  const { shape, root } = resolveRoot(flags, existing, io);
   if (!shape.ok) {
     err.write(`${shape.message}\n`);
     if (!flags.force) return 1;
     err.write('anyslate: --force given — writing anyway.\n');
   }
-  const root = shape.ok ? shape.root : normalizeApiRoot(mergedUrl);
-
-  if (shape.ok && shape.normalized) {
-    out.write(
-      `anyslate: apiUrl "${shape.original}" ends in /mcp — the CLI wants the service ROOT and appends /mcp itself.\n` +
-        `anyslate: using "${root}". Run \`anyslate login --api-url ${root}\` to persist.\n`,
-    );
-  }
 
   // --- 3. Live probe ------------------------------------------------------
   let verified = null;
@@ -127,8 +194,7 @@ export async function runLogin(argv, deps = {}) {
   delete next.api_url; // collapse the legacy alias so only one key can drift
 
   try {
-    mkdirSync(dir, { recursive: true, mode: 0o700 });
-    writeFileSync(path, JSON.stringify(next, null, 2), { mode: 0o600 });
+    writeConfigFile(next, env);
   } catch (e) {
     err.write(`anyslate login: write failed (${e?.message ?? e})\n`);
     return 1;
@@ -144,9 +210,205 @@ export async function runLogin(argv, deps = {}) {
   return 0;
 }
 
+// ---------------------------------------------------------------------------
+// OAuth browser path
+// ---------------------------------------------------------------------------
+
+async function runOauthLogin(flags, deps) {
+  const env = deps.env ?? process.env;
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const io = makeIo(deps);
+  const { out, err } = io;
+
+  if (flags.timeoutInvalid) {
+    err.write('anyslate: --timeout takes a positive number of seconds.\n');
+    return 2;
+  }
+
+  noteIfCaptureDisabled(env, io);
+
+  const existing = readConfigFile(env);
+  const { shape, root } = resolveRoot(flags, existing, io);
+  if (!shape.ok) {
+    err.write(`${shape.message}\n`);
+    return 1;
+  }
+  const host = hostOf(root);
+
+  // --- 1. Discovery. No guessed endpoint paths, ever. ---------------------
+  const discovery = await discover({ root, fetchImpl });
+  if (!discovery.ok) {
+    err.write(`${discovery.message}\n`);
+    return 1;
+  }
+
+  // --- 2. Client id: cached per root, because DCR is 10/hour --------------
+  const clients = existing.oauth_clients && typeof existing.oauth_clients === 'object' ? existing.oauth_clients : {};
+  let clientId = typeof clients[root] === 'string' && clients[root] ? clients[root] : null;
+  let registered = false;
+  if (clientId) {
+    out.write(`anyslate: reusing this CLI's registered OAuth client for ${host}.\n`);
+  } else {
+    const reg = await registerClient({
+      registrationEndpoint: discovery.registrationEndpoint,
+      redirectUri: REGISTERED_REDIRECT_URI,
+      fetchImpl,
+    });
+    if (!reg.ok) {
+      err.write(`${reg.message}\n`);
+      return 1;
+    }
+    clientId = reg.clientId;
+    registered = true;
+    // Persist immediately, BEFORE the browser round trip. A user who closes the
+    // consent tab must not burn a second registration on their next attempt.
+    try {
+      writeConfigFile({ ...readConfigFile(env), oauth_clients: { ...clients, [root]: clientId } }, env);
+    } catch {
+      err.write('anyslate: warning — could not cache the client registration; the next login will register again.\n');
+    }
+  }
+
+  // --- 3. PKCE + state ----------------------------------------------------
+  const pkce = generatePkce();
+  const state = generateState();
+
+  // --- 4. Loopback listener on an ephemeral port --------------------------
+  const timeoutMs = (flags.timeout ?? DEFAULT_CALLBACK_TIMEOUT_S) * 1000;
+  let listener;
+  try {
+    listener = await startCallbackServer({ state, timeoutMs });
+  } catch (e) {
+    err.write(`anyslate: could not bind a loopback port for the OAuth callback (${e?.message ?? e}).\n`);
+    return 1;
+  }
+
+  try {
+    const authorizeUrl = buildAuthorizeUrl({
+      authorizationEndpoint: discovery.authorizationEndpoint,
+      clientId,
+      redirectUri: listener.redirectUri,
+      codeChallenge: pkce.challenge,
+      state,
+      resource: discovery.resource,
+    });
+
+    // --- 5. Browser -------------------------------------------------------
+    out.write(`anyslate: signing in to ${host}${registered ? ' (registered this CLI)' : ''}.\n`);
+    if (flags.noBrowser) {
+      out.write('anyslate: --no-browser given. Open this URL to authorize:\n');
+    } else {
+      const opened = (deps.openBrowserImpl ?? openBrowser)(authorizeUrl);
+      out.write(
+        opened.ok
+          ? 'anyslate: opened your browser. If nothing appeared, open this URL:\n'
+          : `anyslate: could not launch a browser (${opened.error ?? 'unknown error'}). Open this URL:\n`,
+      );
+    }
+    // Printed on BOTH paths. A browser that reported success but silently failed
+    // to appear would otherwise leave the user at a hung prompt with no way in.
+    out.write(`\n  ${authorizeUrl}\n\n`);
+    out.write(`anyslate: waiting up to ${Math.round(timeoutMs / 1000)}s for the callback on ${listener.redirectUri} …\n`);
+
+    await deps.onAuthorizeUrl?.(authorizeUrl, { redirectUri: listener.redirectUri, state, root });
+
+    // --- 6. Callback (state validated inside the listener) ----------------
+    const callback = await listener.waitForResult();
+    if (!callback.ok) {
+      err.write(`${callback.message}\n`);
+      return 1;
+    }
+
+    // --- 7. Token exchange ------------------------------------------------
+    const exchanged = await exchangeCode({
+      tokenEndpoint: discovery.tokenEndpoint,
+      code: callback.code,
+      redirectUri: listener.redirectUri,
+      codeVerifier: pkce.verifier,
+      clientId,
+      resource: discovery.resource,
+      fetchImpl,
+    });
+    if (!exchanged.ok) {
+      err.write(`${exchanged.message}\n`);
+      return 1;
+    }
+
+    const oauth = {
+      client_id: clientId,
+      access_token: exchanged.tokens.access_token,
+      refresh_token: exchanged.tokens.refresh_token,
+      expires_at: exchanged.tokens.expires_at,
+      // Cached so an unattended refresh costs one request rather than three.
+      // Bound to `root` so switching environments re-discovers instead of
+      // reusing dev's token endpoint against prod.
+      token_endpoint: discovery.tokenEndpoint,
+      resource: discovery.resource,
+      root,
+    };
+
+    // --- 8. Verify, exactly as the static path does -----------------------
+    let verified = null;
+    if (flags.noVerify) {
+      err.write('anyslate: --no-verify given — skipping the live connection check.\n');
+    } else {
+      verified = await probeVerify({ root, token: oauth.access_token, fetchImpl });
+      if (verified.ok) {
+        out.write(`${verified.message}\n`);
+        const warning = scopeWarning(verified.scopes);
+        if (warning) err.write(`${warning}\n`);
+      } else {
+        err.write(`${verified.message}\n`);
+        if (!flags.force) {
+          err.write('anyslate: nothing was written. Re-run `anyslate login`, or pass --force to write anyway.\n');
+          return 1;
+        }
+        err.write('anyslate: --force given — writing anyway.\n');
+      }
+    }
+
+    // --- 9. Persist -------------------------------------------------------
+    const path = join(anyslateDir(env), 'cli.json');
+    let handle = null;
+    try {
+      const current = readConfigFile(env);
+      handle = flags.handle ?? current.handle ?? null;
+      const next = {
+        ...current,
+        apiUrl: root,
+        handle,
+        oauth_clients: { ...(current.oauth_clients ?? {}), [root]: clientId },
+        oauth,
+      };
+      delete next.api_url;
+      writeConfigFile(next, env);
+    } catch (e) {
+      err.write(`anyslate login: write failed (${e?.message ?? e})\n`);
+      return 1;
+    }
+
+    out.write(`anyslate: wrote ${path}\n`);
+    out.write(`  apiUrl: ${root}\n`);
+    out.write('  auth:   oauth (browser)\n');
+    out.write(`  handle: ${handle ?? '(none — bearer token only)'}\n`);
+    out.write(
+      `  access token expires ${oauth.expires_at}${
+        oauth.refresh_token ? '; it refreshes automatically' : ' (no refresh token issued)'
+      }\n`,
+    );
+    if (verified?.ok && verified.defaultHandleId) {
+      out.write(`  token is bound to handle: ${verified.defaultHandleId} (server-side scope)\n`);
+    }
+    out.write('anyslate: run `anyslate doctor` to verify the full setup.\n');
+    return 0;
+  } finally {
+    await listener.close();
+  }
+}
+
 /** @param {string[]} argv */
 function parseFlags(argv) {
-  const out = { force: false, noVerify: false };
+  const out = { force: false, noVerify: false, noBrowser: false, help: false };
   for (let i = 0; i < argv.length; i += 1) {
     const a = argv[i];
     if (a === '--token' && argv[i + 1]) out.token = argv[++i];
@@ -154,6 +416,14 @@ function parseFlags(argv) {
     else if ((a === '--api-url' || a === '--api_url') && argv[i + 1]) out.apiUrl = argv[++i];
     else if (a === '--force') out.force = true;
     else if (a === '--no-verify' || a === '--skip-verify') out.noVerify = true;
+    else if (a === '--no-browser') out.noBrowser = true;
+    else if (a === '--timeout' && argv[i + 1]) {
+      const seconds = Number(argv[++i]);
+      if (Number.isFinite(seconds) && seconds > 0) out.timeout = seconds;
+      else out.timeoutInvalid = true;
+    } else if (a === '--help' || a === '-h') out.help = true;
   }
   return out;
 }
+
+export const __testing = { parseFlags };

package/src/commands/logout.mjs

@@ -0,0 +1,131 @@
+// `anyslate logout` - revoke the OAuth session, then clear local credentials.
+//
+// This was genuinely missing. Before OAuth the only way to "log out" was to
+// hand-edit or delete `~/.anyslate/cli.json`, which also threw away the apiUrl
+// and handle — so the documented recovery was "delete the file and set
+// everything up again". With refresh tokens that gap becomes a security
+// problem, not just an annoyance: a 30-day refresh token stays live on disk
+// with no supported way to invalidate it.
+//
+// ORDER MATTERS, AND SO DOES FAILING SOFT. Revoke first (best effort), clear
+// second, ALWAYS. If revocation is skipped on a network error the user is left
+// holding a credential they believe is dead. If clearing is skipped because
+// revocation failed, `logout` becomes unusable exactly when it is most needed —
+// offline, or against a server that is down. So a failed revoke is reported and
+// the local credential is removed regardless.
+//
+// What is deliberately NOT removed: `apiUrl`, `handle`, and the cached
+// `oauth_clients` map. The client registration is not a credential (it grants
+// nothing on its own), and dropping it would burn one of the 10-per-hour
+// Dynamic Client Registrations on the next login.
+
+import { join } from 'node:path';
+import { anyslateDir, loadConfig } from '../config.mjs';
+import { readConfigFile, writeConfigFile } from '../credentials.mjs';
+import { discover, revocationEndpointFor, revokeToken } from '../oauth.mjs';
+import { makeIo } from '../io.mjs';
+
+/**
+ * @param {string[]} argv  arguments after `logout`
+ * @param {{env?: NodeJS.ProcessEnv, fetchImpl?: typeof fetch}} [deps]
+ * @returns {Promise<number>}
+ */
+export async function runLogout(argv = [], deps = {}) {
+  const env = deps.env ?? process.env;
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const { out, err } = makeIo(deps);
+  const flags = parseFlags(argv);
+
+  const cfg = loadConfig(env);
+  const current = readConfigFile(env);
+  const oauth = current.oauth && typeof current.oauth === 'object' ? current.oauth : null;
+  const hadOauth = !!(oauth && (oauth.access_token || oauth.refresh_token));
+  const hadStatic = !!(current.mcp_token || current.token);
+
+  if (!hadOauth && !hadStatic) {
+    out.write('anyslate: no stored credentials — nothing to log out of.\n');
+    if (env.ANYSLATE_MCP_TOKEN) {
+      out.write('anyslate: note — ANYSLATE_MCP_TOKEN is set in your environment; unset it to fully sign out.\n');
+    }
+    return 0;
+  }
+
+  // --- 1. Revoke (best effort) --------------------------------------------
+  if (hadOauth && !flags.local) {
+    const root = oauth.root || cfg.apiUrl;
+    const discovery = await discover({ root, fetchImpl });
+    const endpoint = revocationEndpointFor(discovery.ok ? discovery : null, root);
+
+    // Revoke the refresh token first: it is the long-lived one (30 days), and
+    // it is what an attacker with a stale config file would actually use.
+    const targets = [
+      oauth.refresh_token ? { token: oauth.refresh_token, hint: 'refresh_token' } : null,
+      oauth.access_token ? { token: oauth.access_token, hint: 'access_token' } : null,
+    ].filter(Boolean);
+
+    let revoked = 0;
+    let failed = null;
+    for (const t of targets) {
+      const res = await revokeToken({
+        revocationEndpoint: endpoint,
+        token: t.token,
+        clientId: oauth.client_id,
+        tokenTypeHint: t.hint,
+        fetchImpl,
+      });
+      if (res.ok) revoked += 1;
+      else failed = res.detail ?? 'unknown error';
+    }
+
+    if (revoked === targets.length) {
+      out.write(`anyslate: revoked the OAuth session at ${hostOf(endpoint)}.\n`);
+    } else {
+      err.write(
+        `anyslate: warning — could not revoke the OAuth session at ${hostOf(endpoint)} (${failed}). ` +
+          'Clearing the local credentials anyway; revoke the token in the app if that matters.\n',
+      );
+    }
+  } else if (hadOauth && flags.local) {
+    err.write('anyslate: --local given — skipping revocation; the server-side session stays live until it expires.\n');
+  }
+
+  // --- 2. Clear (always) ---------------------------------------------------
+  const path = join(anyslateDir(env), 'cli.json');
+  try {
+    const disk = readConfigFile(env);
+    delete disk.oauth;
+    delete disk.mcp_token;
+    delete disk.token;
+    writeConfigFile(disk, env);
+  } catch (e) {
+    err.write(`anyslate logout: could not update ${path} (${e?.message ?? e})\n`);
+    return 1;
+  }
+
+  const cleared = [hadOauth && 'OAuth session', hadStatic && 'static token'].filter(Boolean).join(' and ');
+  out.write(`anyslate: cleared the ${cleared} from ${path}.\n`);
+  out.write('anyslate: apiUrl and handle were kept. Run `anyslate login` to sign in again.\n');
+  if (env.ANYSLATE_MCP_TOKEN) {
+    err.write(
+      'anyslate: warning — ANYSLATE_MCP_TOKEN is still set in your environment and overrides the config, so capture keeps working. Unset it to fully sign out.\n',
+    );
+  }
+  return 0;
+}
+
+function hostOf(url) {
+  try {
+    return new URL(url).host;
+  } catch {
+    return String(url);
+  }
+}
+
+/** @param {string[]} argv */
+function parseFlags(argv) {
+  const out = { local: false };
+  for (const a of argv) {
+    if (a === '--local' || a === '--no-revoke') out.local = true;
+  }
+  return out;
+}

package/src/commands/upload-artifact.mjs

@@ -16,7 +16,8 @@
 import { readFileSync } from 'node:fs';
 import { basename } from 'node:path';
 import { loadConfig, requireToken, apiUrlNormalizationNotice, DISABLED_NOTICE } from '../config.mjs';
-import { callTool, formatCallFailure } from '../mcp-client.mjs';
+import { formatCallFailure } from '../mcp-client.mjs';
+import { callToolWithAuth, formatAuthFailure } from '../auth.mjs';
 import { readStdin, stdinTimeoutFromEnv } from '../stdin.mjs';
 import { recordRun } from '../runlog.mjs';
 import { VERSION } from '../version.mjs';
@@ -71,10 +72,11 @@ export async function runUploadArtifact(argv, deps = {}) {
   const notice = apiUrlNormalizationNotice(cfg);
   if (notice) err.write(notice);
 
-  const tokenCheck = requireToken(cfg);
-  if (!tokenCheck.ok) {
-    err.write(`anyslate upload-artifact: ${tokenCheck.error}\n`);
-    recordRun({ command: 'upload-artifact', ok: false, apiUrl: cfg.apiUrl, error: tokenCheck.error, version: VERSION, exitCode: 1 }, env);
+  // Presence only — an expired OAuth token is refreshed by callToolWithAuth.
+  if (cfg.authMode === 'none') {
+    const error = requireToken({ mcpToken: null }).error;
+    err.write(`anyslate upload-artifact: ${error}\n`);
+    recordRun({ command: 'upload-artifact', ok: false, apiUrl: cfg.apiUrl, error, version: VERSION, exitCode: 1 }, env);
     return 1;
   }
 
@@ -133,15 +135,17 @@ export async function runUploadArtifact(argv, deps = {}) {
   if (pathHint) args.path_hint = pathHint;
 
   try {
-    const res = await callTool({
-      apiUrl: cfg.apiUrl,
-      token: cfg.mcpToken,
+    const res = await callToolWithAuth({
+      cfg,
+      env,
       toolName: 'upload_artifact',
       args,
       fetchImpl: deps.fetchImpl,
     });
+    if (res.authWarning) err.write(`${res.authWarning}\n`);
     if (!res.ok) {
-      const message = formatCallFailure('anyslate upload-artifact', res);
+      const message =
+        formatAuthFailure('anyslate upload-artifact', res) ?? formatCallFailure('anyslate upload-artifact', res);
       err.write(message);
       recordRun(
         {