@mcp-use/cli 2.21.5-canary.2 → 3.0.0-canary.3

package/dist/commands/auth.d.ts

@@ -5,10 +5,16 @@ import type { ProfileInfo } from "../utils/api.js";
  */
 export declare function promptOrgSelection(profiles: ProfileInfo[], defaultProfileId?: string | null): Promise<ProfileInfo | null>;
 /**
- * Login command - opens browser for OAuth flow
+ * Login command using OAuth 2.0 Device Authorization Grant (RFC 8628).
+ *
+ * Supports three modes:
+ *   - Interactive device flow (default): opens browser, user enters a code
+ *   - --api-key <key>: non-interactive, stores the given key directly
+ *   - MCP_USE_API_KEY env var: same as --api-key (for CI/CD)
  */
 export declare function loginCommand(options?: {
     silent?: boolean;
+    apiKey?: string;
 }): Promise<void>;
 /**
  * Logout command - revokes API key and deletes config

package/dist/commands/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAgSnD;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,WAAW,EAAE,EACvB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,GAC/B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CA6C7B;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,CAAC,EAAE;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuJhB;AAED;;GAEG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CA8BnD;AAED;;GAEG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CA+DnD"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAoGnD;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,WAAW,EAAE,EACvB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,GAC/B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CA6C7B;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,OAAO,CAAC,EAAE;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyJhB;AAED;;GAEG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CA8BnD;AAED;;GAEG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAwEnD"}

package/dist/index.cjs

@@ -1150,10 +1150,6 @@ var open_default = open;
 var import_vite_plugin_singlefile = require("vite-plugin-singlefile");
 var import_zod = require("zod");
 
-// src/commands/auth.ts
-var import_node_crypto = __toESM(require("crypto"), 1);
-var import_node_http = require("http");
-
 // src/utils/config.ts
 var import_node_fs4 = require("fs");
 var import_node_os3 = __toESM(require("os"), 1);
@@ -1205,6 +1201,10 @@ async function getProfileId() {
 async function getWebUrl() {
   return DEFAULT_WEB_URL;
 }
+async function getAuthBaseUrl() {
+  const apiUrl = await getApiUrl();
+  return apiUrl.replace(/\/api\/v1$/, "");
+}
 
 // src/utils/api.ts
 var McpUseAPI = class _McpUseAPI {
@@ -1256,6 +1256,13 @@ var McpUseAPI = class _McpUseAPI {
         signal: controller.signal
       });
       clearTimeout(timeoutId);
+      if (response.status === 401) {
+        const err = new Error(
+          "Your session has expired or your API key is invalid."
+        );
+        err.status = 401;
+        throw err;
+      }
       if (!response.ok) {
         const error = await response.text();
         throw new Error(`API request failed: ${response.status} ${error}`);
@@ -1272,17 +1279,19 @@ var McpUseAPI = class _McpUseAPI {
     }
   }
   /**
-   * Create API key using JWT token
+   * Create a persistent API key using a Better Auth access token.
+   * Calls Better Auth's built-in POST /api/auth/api-key/create endpoint.
    */
-  async createApiKey(jwtToken, name = "CLI") {
-    const url = `${this.baseUrl}/api-key`;
+  async createApiKeyWithAccessToken(accessToken, name = "CLI") {
+    const authBase = await getAuthBaseUrl();
+    const url = `${authBase}/api/auth/api-key/create`;
     const response = await fetch(url, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        Authorization: `Bearer ${jwtToken}`
+        Authorization: `Bearer ${accessToken}`
       },
-      body: JSON.stringify({ name })
+      body: JSON.stringify({ name, prefix: "mcp_" })
     });
     if (!response.ok) {
       const error = await response.text();
@@ -1543,273 +1552,65 @@ var McpUseAPI = class _McpUseAPI {
 };
 
 // src/commands/auth.ts
-var LOGIN_TIMEOUT = 3e5;
-async function findAvailablePort(startPort = 8765) {
-  for (let port = startPort; port < startPort + 100; port++) {
-    try {
-      await new Promise((resolve2, reject) => {
-        const server = (0, import_node_http.createServer)();
-        server.once("error", reject);
-        server.once("listening", () => {
-          server.close();
-          resolve2();
-        });
-        server.listen(port);
-      });
-      return port;
-    } catch {
-      continue;
-    }
+var DEVICE_CLIENT_ID = "mcp-use-cli";
+var DEVICE_POLL_TIMEOUT = 18e5;
+async function requestDeviceCode(authBaseUrl) {
+  const url = `${authBaseUrl}/api/auth/device/code`;
+  const response = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      client_id: DEVICE_CLIENT_ID,
+      scope: "openid profile email"
+    })
+  });
+  if (!response.ok) {
+    const error = await response.text();
+    throw new Error(
+      `Failed to request device code: ${response.status} ${error}`
+    );
   }
-  throw new Error("No available ports found");
+  return response.json();
 }
-async function startCallbackServer(port, expectedState) {
-  return new Promise((resolve2, reject) => {
-    let tokenResolver = null;
-    const tokenPromise = new Promise((res) => {
-      tokenResolver = res;
+async function pollForDeviceToken(authBaseUrl, deviceCode, intervalSeconds) {
+  let pollingInterval = intervalSeconds;
+  const deadline = Date.now() + DEVICE_POLL_TIMEOUT;
+  while (Date.now() < deadline) {
+    const delayMs = pollingInterval * 1e3;
+    await new Promise((r) => setTimeout(r, delayMs));
+    const url = `${authBaseUrl}/api/auth/device/token`;
+    const response = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        device_code: deviceCode,
+        client_id: DEVICE_CLIENT_ID
+      })
     });
-    const server = (0, import_node_http.createServer)(
-      {
-        maxHeaderSize: 65536
-        // 64KB - handle very long JWT tokens in URL (increased from default 8192)
-      },
-      (req, res) => {
-        if (req.url?.startsWith("/callback")) {
-          const url = new URL(req.url, `http://localhost:${port}`);
-          const token = url.searchParams.get("token");
-          const state = url.searchParams.get("state");
-          if (state !== expectedState) {
-            res.writeHead(400, { "Content-Type": "text/html" });
-            res.end(`
-              <!DOCTYPE html>
-              <html>
-                <head>
-                  <title>Security Error</title>
-                  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-                  <style>
-                    body {
-                      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
-                      display: flex;
-                      justify-content: center;
-                      align-items: center;
-                      min-height: 100vh;
-                      background: #000;
-                      padding: 1rem;
-                      margin: 0;
-                    }
-                    .container {
-                      max-width: 28rem;
-                      padding: 3rem;
-                      text-align: center;
-                      background: rgba(255, 255, 255, 0.1);
-                      backdrop-filter: blur(40px);
-                      border: 1px solid rgba(255, 255, 255, 0.2);
-                      border-radius: 1.5rem;
-                    }
-                    h1 { color: #fff; font-size: 2rem; margin-bottom: 1rem; }
-                    p { color: rgba(255, 255, 255, 0.8); font-size: 1rem; }
-                  </style>
-                </head>
-                <body>
-                  <div class="container">
-                    <h1>Security Error</h1>
-                    <p>Invalid state parameter. Please try logging in again.</p>
-                  </div>
-                </body>
-              </html>
-            `);
-            return;
-          }
-          if (token && tokenResolver) {
-            res.writeHead(200, { "Content-Type": "text/html" });
-            res.end(`
-              <!DOCTYPE html>
-              <html>
-                <head>
-                  <title>Login Successful</title>
-                  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-                  <style>
-                    * {
-                      margin: 0;
-                      padding: 0;
-                      box-sizing: border-box;
-                    }
-                    body {
-                      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
-                      display: flex;
-                      justify-content: center;
-                      align-items: center;
-                      min-height: 100vh;
-                      background: #000;
-                      padding: 1rem;
-                    }
-                    .container {
-                      width: 100%;
-                      max-width: 28rem;
-                      padding: 3rem;
-                      text-align: center;
-                      -webkit-backdrop-filter: blur(40px);
-                      border: 1px solid rgba(255, 255, 255, 0.2);
-                      border-radius: 1.5rem;
-                      box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.5);
-                    }
-                    .icon-container {
-                      display: inline-flex;
-                      align-items: center;
-                      justify-content: center;
-                      width: 6rem;
-                      height: 6rem;
-                      margin-bottom: 2rem;
-                      background: rgba(255, 255, 255, 0.1);
-                      backdrop-filter: blur(10px);
-                      -webkit-backdrop-filter: blur(10px);
-                      border-radius: 50%;
-                    }
-                    .checkmark {
-                      font-size: 4rem;
-                      color: #fff;
-                      line-height: 1;
-                      animation: scaleIn 0.5s ease-out;
-                    }
-                    @keyframes scaleIn {
-                      from {
-                        transform: scale(0);
-                        opacity: 0;
-                      }
-                      to {
-                        transform: scale(1);
-                        opacity: 1;
-                      }
-                    }
-                    h1 {
-                      color: #fff;
-                      margin: 0 0 1rem 0;
-                      font-size: 2.5rem;
-                      font-weight: 700;
-                      letter-spacing: -0.025em;
-                    }
-                    p {
-                      color: rgba(255, 255, 255, 0.8);
-                      margin: 0 0 2rem 0;
-                      font-size: 1.125rem;
-                      line-height: 1.5;
-                    }
-                    .spinner {
-                      display: inline-block;
-                      width: 2rem;
-                      height: 2rem;
-                      border: 3px solid rgba(255, 255, 255, 0.3);
-                      border-top-color: #fff;
-                      border-radius: 50%;
-                      animation: spin 0.8s linear infinite;
-                    }
-                    @keyframes spin {
-                      to { transform: rotate(360deg); }
-                    }
-                    .footer {
-                      margin-top: 2rem;
-                      color: rgba(255, 255, 255, 0.6);
-                      font-size: 0.875rem;
-                    }
-                  </style>
-                </head>
-                <body>
-                  <div class="container">
-                    <h1>Authentication Successful!</h1>
-                    <p>You can now close this window and return to the CLI.</p>
-                  </div>
-                </body>
-              </html>
-            `);
-            tokenResolver(token);
-          } else {
-            res.writeHead(400, { "Content-Type": "text/html" });
-            res.end(`
-              <!DOCTYPE html>
-              <html>
-                <head>
-                  <title>Login Failed</title>
-                  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-                  <style>
-                    * {
-                      margin: 0;
-                      padding: 0;
-                      box-sizing: border-box;
-                    }
-                    body {
-                      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
-                      display: flex;
-                      justify-content: center;
-                      align-items: center;
-                      min-height: 100vh;
-                      background: #000;
-                      padding: 1rem;
-                    }
-                    .container {
-                      width: 100%;
-                      max-width: 28rem;
-                      padding: 3rem;
-                      text-align: center;
-                      background: rgba(255, 255, 255, 0.1);
-                      backdrop-filter: blur(40px);
-                      -webkit-backdrop-filter: blur(40px);
-                      border: 1px solid rgba(255, 255, 255, 0.2);
-                      border-radius: 1.5rem;
-                      box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.5);
-                    }
-                    .icon-container {
-                      display: inline-flex;
-                      align-items: center;
-                      justify-content: center;
-                      width: 6rem;
-                      height: 6rem;
-                      margin-bottom: 2rem;
-                      background: rgba(255, 255, 255, 0.1);
-                      backdrop-filter: blur(10px);
-                      -webkit-backdrop-filter: blur(10px);
-                      border-radius: 50%;
-                    }
-                    .cross {
-                      font-size: 4rem;
-                      color: #fff;
-                      line-height: 1;
-                    }
-                    h1 {
-                      color: #fff;
-                      margin: 0 0 1rem 0;
-                      font-size: 2.5rem;
-                      font-weight: 700;
-                      letter-spacing: -0.025em;
-                    }
-                    p {
-                      color: rgba(255, 255, 255, 0.8);
-                      margin: 0;
-                      font-size: 1.125rem;
-                      line-height: 1.5;
-                    }
-                  </style>
-                </head>
-                <body>
-                  <div class="container">
-                    <div class="icon-container">
-                      <div class="cross">\u2717</div>
-                    </div>
-                    <h1>Login Failed</h1>
-                    <p>No token received. Please try again.</p>
-                  </div>
-                </body>
-              </html>
-            `);
-          }
-        }
+    const data = await response.json();
+    if (data.access_token) {
+      return data.access_token;
+    }
+    if (data.error) {
+      switch (data.error) {
+        case "authorization_pending":
+          break;
+        case "slow_down":
+          pollingInterval += 5;
+          break;
+        case "access_denied":
+          throw new Error("Authorization was denied by the user.");
+        case "expired_token":
+          throw new Error("The device code has expired. Please try again.");
+        default:
+          throw new Error(
+            data.error_description || `Device auth error: ${data.error}`
+          );
       }
-    );
-    server.listen(port, () => {
-      resolve2({ server, token: tokenPromise });
-    });
-    server.on("error", reject);
-  });
+    }
+  }
+  throw new Error("Login timed out. Please try again.");
 }
 async function promptOrgSelection(profiles, defaultProfileId) {
   if (profiles.length === 0) return null;
@@ -1852,64 +1653,76 @@ Enter number [${defaultDisplay}]: `),
 }
 async function loginCommand(options) {
   try {
+    const directKey = options?.apiKey || process.env.MCP_USE_API_KEY;
+    if (directKey) {
+      await writeConfig({ apiKey: directKey });
+      if (!options?.silent) {
+        console.log(source_default.green.bold("\u2713 API key saved."));
+        try {
+          const api2 = await McpUseAPI.create();
+          const authInfo = await api2.testAuth();
+          console.log(source_default.gray(`  Authenticated as ${authInfo.email}`));
+        } catch {
+          console.log(
+            source_default.gray(
+              "  (could not verify key \u2014 will be checked on next command)"
+            )
+          );
+        }
+      }
+      return;
+    }
     if (await isLoggedIn()) {
       if (!options?.silent) {
         console.log(
           source_default.yellow(
-            "\u26A0\uFE0F  You are already logged in. Run 'npx mcp-use logout' first if you want to login with a different account."
+            "You are already logged in. Run 'npx mcp-use logout' first if you want to login with a different account."
           )
         );
       }
       return;
     }
-    console.log(source_default.cyan.bold("\u{1F510} Logging in to Manufact cloud...\n"));
-    const state = import_node_crypto.default.randomBytes(32).toString("hex");
-    const port = await findAvailablePort();
-    const redirectUri = `http://localhost:${port}/callback`;
-    console.log(source_default.gray(`Starting local server on port ${port}...`));
-    const { server, token } = await startCallbackServer(port, state);
-    const webUrl = await getWebUrl();
-    const loginUrl = `${webUrl}/auth/cli?redirect_uri=${encodeURIComponent(redirectUri)}&state=${state}`;
-    console.log(source_default.gray(`Opening browser to ${webUrl}/auth/cli...
-`));
-    console.log(
-      source_default.white(
-        "If the browser doesn't open automatically, please visit:\n" + source_default.cyan(loginUrl)
-      )
-    );
-    await open_default(loginUrl);
-    console.log(
-      source_default.gray("\nWaiting for authentication... (this may take a moment)")
-    );
-    const jwtToken = await Promise.race([
-      token,
-      new Promise(
-        (_, reject) => setTimeout(
-          () => reject(new Error("Login timeout - please try again")),
-          LOGIN_TIMEOUT
-        )
-      )
-    ]);
-    server.close();
-    console.log(
-      source_default.gray("Received authentication token, creating API key...")
+    console.log(source_default.cyan.bold("Logging in to mcp-use cloud...\n"));
+    const authBaseUrl = await getAuthBaseUrl();
+    const deviceResp = await requestDeviceCode(authBaseUrl);
+    const {
+      device_code,
+      user_code,
+      verification_uri,
+      verification_uri_complete,
+      interval
+    } = deviceResp;
+    const displayCode = user_code.length === 8 ? `${user_code.slice(0, 4)}-${user_code.slice(4)}` : user_code;
+    console.log(source_default.white("  Visit: ") + source_default.cyan(verification_uri));
+    console.log(source_default.white("  Code:  ") + source_default.bold.white(displayCode));
+    console.log();
+    const urlToOpen = verification_uri_complete || verification_uri;
+    try {
+      await open_default(urlToOpen);
+      console.log(source_default.gray("  Browser opened. Waiting for approval..."));
+    } catch {
+      console.log(source_default.gray("  Open the URL above in your browser."));
+    }
+    const accessToken = await pollForDeviceToken(
+      authBaseUrl,
+      device_code,
+      interval || 5
     );
+    console.log(source_default.gray("\n  Creating persistent API key..."));
     const api = await McpUseAPI.create();
-    const apiKeyResponse = await api.createApiKey(jwtToken, "CLI");
-    await writeConfig({
-      apiKey: apiKeyResponse.api_key
-    });
+    const keyResp = await api.createApiKeyWithAccessToken(accessToken, "CLI");
+    await writeConfig({ apiKey: keyResp.key });
     console.log(source_default.green.bold("\n\u2713 Successfully logged in!"));
     try {
-      const api2 = await McpUseAPI.create();
-      const authInfo = await api2.testAuth();
-      console.log(source_default.cyan.bold("\n\u{1F464} Current user:\n"));
-      console.log(source_default.white("Email:   ") + source_default.cyan(authInfo.email));
-      console.log(source_default.white("User ID: ") + source_default.gray(authInfo.user_id));
-      const apiKey = await getApiKey();
-      if (apiKey) {
-        const masked = apiKey.substring(0, 6) + "...";
-        console.log(source_default.white("API Key: ") + source_default.gray(masked));
+      const freshApi = await McpUseAPI.create();
+      const authInfo = await freshApi.testAuth();
+      console.log(source_default.cyan.bold("\nCurrent user:\n"));
+      console.log(source_default.white("  Email:   ") + source_default.cyan(authInfo.email));
+      console.log(source_default.white("  User ID: ") + source_default.gray(authInfo.user_id));
+      const storedKey = await getApiKey();
+      if (storedKey) {
+        const masked = storedKey.substring(0, 8) + "...";
+        console.log(source_default.white("  API Key: ") + source_default.gray(masked));
       }
       const profiles = authInfo.profiles ?? [];
       if (profiles.length > 0) {
@@ -1932,25 +1745,25 @@ async function loginCommand(options) {
           });
           const slug = selectedProfile.slug ? source_default.gray(` (${selectedProfile.slug})`) : "";
           console.log(
-            source_default.white("Org:     ") + source_default.cyan(selectedProfile.profile_name) + slug
+            source_default.white("  Org:     ") + source_default.cyan(selectedProfile.profile_name) + slug
           );
         }
       }
-    } catch (error) {
+    } catch {
       console.log(
         source_default.gray(
           `
-Your API key has been saved to ${source_default.white("~/.mcp-use/config.json")}`
+  Your API key has been saved to ${source_default.white("~/.mcp-use/config.json")}`
         )
       );
     }
     console.log(
       source_default.gray(
-        "\nYou can now deploy your MCP servers with " + source_default.white("npx mcp-use deploy")
+        "\n  Deploy your MCP servers with " + source_default.white("npx mcp-use deploy")
       )
     );
     console.log(
-      source_default.gray("To logout later, run " + source_default.white("npx mcp-use logout"))
+      source_default.gray("  To logout, run " + source_default.white("npx mcp-use logout"))
     );
   } catch (error) {
     throw new Error(
@@ -2023,10 +1836,20 @@ async function whoamiCommand() {
       }
     }
   } catch (error) {
-    console.error(
-      source_default.red.bold("\n\u2717 Failed to get user info:"),
-      source_default.red(error instanceof Error ? error.message : "Unknown error")
-    );
+    if (error?.status === 401) {
+      console.error(
+        source_default.red("\nYour session has expired or your API key is invalid.")
+      );
+      console.log(
+        source_default.gray(`Run ${source_default.white("mcp-use login")} to re-authenticate.
+`)
+      );
+    } else {
+      console.error(
+        source_default.red.bold("\n\u2717 Failed to get user info:"),
+        source_default.red(error instanceof Error ? error.message : "Unknown error")
+      );
+    }
     process.exit(1);
   }
 }
@@ -5187,7 +5010,7 @@ async function isPortAvailable(port, host = "localhost") {
     return true;
   }
 }
-async function findAvailablePort2(startPort, host = "localhost") {
+async function findAvailablePort(startPort, host = "localhost") {
   for (let port = startPort; port < startPort + 100; port++) {
     if (await isPortAvailable(port, host)) {
       return port;
@@ -5478,7 +5301,7 @@ if (container && Component) {
         `${widgetName}-metadata`
       );
       await fs10.mkdir(metadataTempDir, { recursive: true });
-      const { createServer: createServer2 } = await import("vite");
+      const { createServer } = await import("vite");
       const nodeStubsPlugin = {
         name: "node-stubs",
         enforce: "pre",
@@ -5505,7 +5328,7 @@ export default PostHog;
           return null;
         }
       };
-      const metadataServer = await createServer2({
+      const metadataServer = await createServer({
         root: metadataTempDir,
         cacheDir: import_node_path8.default.join(metadataTempDir, ".vite-cache"),
         plugins: [nodeStubsPlugin, tailwindcss(), react()],
@@ -6070,7 +5893,7 @@ program.command("dev").description("Run development server with auto-reload and
     displayPackageVersions(projectPath);
     if (!await isPortAvailable(port, host)) {
       console.log(source_default.yellow.bold(`\u26A0\uFE0F  Port ${port} is already in use`));
-      const availablePort = await findAvailablePort2(port, host);
+      const availablePort = await findAvailablePort(port, host);
       console.log(source_default.green.bold(`\u2713 Using port ${availablePort} instead`));
       port = availablePort;
     }
@@ -6905,9 +6728,12 @@ Looked for:
     process.exit(1);
   }
 });
-program.command("login").description("Login to Manufact cloud").action(async () => {
+program.command("login").description("Login to mcp-use cloud").option(
+  "--api-key <key>",
+  "Login with an API key directly (non-interactive, for CI/CD)"
+).action(async (opts) => {
   try {
-    await loginCommand();
+    await loginCommand({ apiKey: opts.apiKey });
     process.exit(0);
   } catch (error) {
     console.error(