apiblaze 0.20.11 → 0.20.14

package/dist/index.js

@@ -1024,7 +1024,7 @@ var import_commander = require("commander");
 var import_chalk53 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.20.11";
+var version = "0.20.14";
 
 // src/index.ts
 init_types();
@@ -2251,7 +2251,7 @@ async function runCreate(opts = {}) {
     const { classifyTargetInput: classifyTargetInput2 } = await Promise.resolve().then(() => (init_spec_or_target(), spec_or_target_exports));
     const c = await classifyTargetInput2(opts.target, fail);
     if (c.kind === "spec") {
-      console.log(import_chalk11.default.dim(`  --target is an OpenAPI document (${c.source}) \u2014 creating FROM the spec.`));
+      if (!opts.json) console.log(import_chalk11.default.dim(`  --target is an OpenAPI document (${c.source}) \u2014 creating FROM the spec.`));
       opts.openapi = opts.target;
       opts.target = void 0;
     }
@@ -2261,7 +2261,7 @@ async function runCreate(opts = {}) {
     await runAnonymousCreate(opts);
     return;
   }
-  const interactive = !!process.stdin.isTTY && !opts.json;
+  const interactive = !!process.stdin.isTTY && !opts.json && !opts.auto;
   if (opts.apikey && opts.oauth !== void 0 && opts.oauth !== false) fail("Pass either --apikey or --oauth, not both.");
   const oauthPlan = parseOauthFlag(opts.oauth);
   const auth = (oauthPlan ? oauthPlan.auth : opts.apikey ? "api_key" : opts.auth ?? "api_key").toLowerCase();
@@ -2323,8 +2323,12 @@ async function runCreate(opts = {}) {
 `);
       break;
     }
+  } else if (opts.auto) {
+    name = await pickGeneratedName(opts, teamId);
+    if (!opts.json) console.log(`${import_chalk11.default.cyan("\u2192")} Your API will live at ${import_chalk11.default.bold(`https://${name}.abz.run`)}
+`);
   } else {
-    fail("--name is required in non-interactive mode.");
+    fail("--name is required in non-interactive mode.", "Or pass --auto to have one generated for you.");
   }
   let openapiContent = null;
   if (opts.openapi !== void 0) {
@@ -2354,7 +2358,7 @@ async function runCreate(opts = {}) {
   } else {
     fail("--target is required in non-interactive mode (a server base URL, a local OpenAPI file, or a remote OpenAPI URL).");
   }
-  if (interactive && !opts.yes) {
+  if (interactive && !opts.yes && !opts.auto) {
     const { default: inquirer3 } = await import("inquirer");
     console.log(`${import_chalk11.default.cyan("\u2192")} Auth: ${import_chalk11.default.bold(auth)}${auth === "api_key" ? " \u2014 consumers send an X-API-Key header" : oauthPlan ? ` \u2014 ${oauthPlan.summary}` : ""}`);
     const { ok } = await inquirer3.prompt([{
@@ -2370,7 +2374,7 @@ async function runCreate(opts = {}) {
   }
   const chosenTenant = await chooseTenantForCreate(teamId, name, {
     tenant: opts.tenant,
-    yes: opts.yes,
+    yes: opts.yes || opts.auto,
     json: opts.json
   });
   const spinner = !opts.json ? (0, import_ora5.default)("Creating proxy (tenant, keys, dev portal)...").start() : null;
@@ -2432,8 +2436,29 @@ async function applyCreateToggles(name, opts) {
   if (opts.identified) await runIdentifiedToggle2(name, "require", toggleOpts);
   if (opts.iam) await runIamToggle2(name, "on", toggleOpts);
 }
+function deriveNameFrom(source) {
+  if (!source) return null;
+  try {
+    const host = new URL(source).hostname;
+    let base2 = normalizeName(host.split(".")[0]);
+    if (base2.length < 3) base2 = normalizeName(host);
+    if (base2.length < 3) return null;
+    return `${base2}${Math.random().toString(36).slice(2, 6)}`;
+  } catch {
+    return null;
+  }
+}
+async function pickGeneratedName(opts, teamId) {
+  const source = opts.target ?? opts.openapi;
+  for (let attempt = 0; attempt < 4; attempt++) {
+    const candidate = (attempt === 0 ? deriveNameFrom(source) : null) ?? randomProxyName();
+    const check = await checkProxyName(candidate, teamId, opts.apiversion).catch(() => null);
+    if (!check || check.canUseProjectName && check.canUseApiVersion) return candidate;
+  }
+  fail("Could not find a free generated proxy name. Pass --name explicitly.");
+}
 async function runAnonymousCreate(opts) {
-  const interactive = !!process.stdin.isTTY && !opts.json;
+  const interactive = !!process.stdin.isTTY && !opts.json && !opts.auto;
   if (!opts.json) {
     console.log(import_chalk11.default.bold("\nCreate an API proxy"));
     console.log(import_chalk11.default.dim("Not logged in \u2014 creating an anonymous proxy. You can claim it to your account within 30 days.\n"));
@@ -2495,6 +2520,10 @@ async function runAnonymousCreate(opts) {
       fail("A source is required: pass --target, or target/openapi/github in --config.");
     }
   }
+  if (name === void 0 && opts.auto) {
+    const nameSource = target || (typeof opts.openapi === "string" ? opts.openapi : void 0);
+    name = deriveNameFrom(nameSource) ?? randomProxyName();
+  }
   if (target) {
     body.target = target;
     body.target_url = target;
@@ -8360,14 +8389,17 @@ var os4 = __toESM(require("os"));
 var path6 = __toESM(require("path"));
 var import_child_process2 = require("child_process");
 var import_chalk46 = __toESM(require("chalk"));
-var run = (cmd, args, opts = {}) => (0, import_child_process2.spawnSync)(cmd, args, {
+var useShell = process.platform === "win32";
+var winQuote = (a) => /^[A-Za-z0-9_\-.:/\\=]+$/.test(a) ? a : `"${a.replace(/"/g, '""')}"`;
+var run = (cmd, args, opts = {}) => (0, import_child_process2.spawnSync)(cmd, useShell ? args.map(winQuote) : args, {
   encoding: "utf-8",
-  stdio: opts.inherit ? ["ignore", "inherit", "inherit"] : ["ignore", "pipe", "pipe"],
-  timeout: opts.inherit ? void 0 : 15e3,
-  shell: process.platform === "win32"
-  // .cmd shims on Windows
+  stdio: opts.interactive ? ["inherit", "inherit", "inherit"] : opts.inherit ? ["ignore", "inherit", "inherit"] : ["ignore", "pipe", "pipe"],
+  timeout: opts.inherit || opts.interactive ? void 0 : 15e3,
+  shell: useShell
 });
+var detected = null;
 function detectExternalClis() {
+  if (detected) return detected;
   const found = [];
   for (const [kind, label3] of [["claude", "Claude CLI"], ["codex", "Codex CLI"]]) {
     try {
@@ -8376,15 +8408,50 @@ function detectExternalClis() {
     } catch {
     }
   }
+  detected = found;
   return found;
 }
-function claudeInstallArgs(spec2) {
+var OURS = /\.mcp\.(abz\.run|tryabz\.run|apiblaze\.com)\b/;
+var mask = (k) => k.length > 14 ? `${k.slice(0, 10)}\u2026${k.slice(-4)}` : "\u2022\u2022\u2022";
+async function verifyMcpEndpoint(spec2) {
+  try {
+    const headers = { "Content-Type": "application/json" };
+    if (spec2.apiKey) headers["X-API-Key"] = spec2.apiKey;
+    if (spec2.endUserId) headers["X-End-User-Id"] = spec2.endUserId;
+    const res = await fetch(spec2.url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list" }),
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!res.ok) return { ok: false, status: res.status, tools: 0 };
+    const body = await res.json().catch(() => null);
+    if (!spec2.apiKey) return { ok: true, status: res.status, tools: body?.result?.tools?.length ?? 0 };
+    if (body?.error) return { ok: false, status: res.status, tools: 0 };
+    return { ok: true, status: res.status, tools: body?.result?.tools?.length ?? 0 };
+  } catch {
+    return { ok: false, status: 0, tools: 0 };
+  }
+}
+function claudeInstallArgs(spec2, masked = false) {
   const args = ["mcp", "add", "--transport", "http", spec2.name, spec2.url];
-  if (spec2.apiKey) args.push("--header", `X-API-Key: ${spec2.apiKey}`);
+  if (spec2.apiKey) args.push("--header", `X-API-Key: ${masked ? mask(spec2.apiKey) : spec2.apiKey}`);
+  if (spec2.endUserId) args.push("--header", `X-End-User-Id: ${spec2.endUserId}`);
   return args;
 }
 function installIntoClaude(spec2) {
-  run("claude", ["mcp", "remove", spec2.name]);
+  const existing = run("claude", ["mcp", "get", spec2.name]);
+  if (existing.status === 0) {
+    const desc = existing.stdout || "";
+    if (!OURS.test(desc)) {
+      return {
+        ok: false,
+        conflict: true,
+        error: `Claude CLI already has an MCP server named "${spec2.name}" that is not an APIblaze proxy \u2014 not touching it. Remove or rename it (claude mcp remove ${spec2.name}) and re-run.`
+      };
+    }
+    run("claude", ["mcp", "remove", spec2.name]);
+  }
   const r = run("claude", claudeInstallArgs(spec2));
   if (r.status === 0) return { ok: true };
   return { ok: false, error: (r.stderr || r.stdout || `exit ${r.status}`).trim().slice(0, 400) };
@@ -8400,23 +8467,69 @@ function codexConfigPath() {
 var tomlStr = (s) => `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 function codexServerBlock(spec2) {
   const lines = [`[mcp_servers.${tomlStr(spec2.name)}]`, `url = ${tomlStr(spec2.url)}`];
-  if (spec2.apiKey) lines.push(`http_headers = { "X-API-Key" = ${tomlStr(spec2.apiKey)} }`);
+  const headers = [];
+  if (spec2.apiKey) headers.push(`"X-API-Key" = ${tomlStr(spec2.apiKey)}`);
+  if (spec2.endUserId) headers.push(`"X-End-User-Id" = ${tomlStr(spec2.endUserId)}`);
+  if (headers.length) lines.push(`http_headers = { ${headers.join(", ")} }`);
   return lines.join("\n") + "\n";
 }
+function codexSectionRanges(lines, name) {
+  const esc = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const header = new RegExp(`^\\[mcp_servers\\.(?:"${esc}"|${esc})\\]\\s*(#.*)?$`);
+  const anyHeader = /^\s*\[[^\]]+\]\s*(#.*)?$/;
+  const ranges = [];
+  for (let i = 0; i < lines.length; i++) {
+    if (!header.test(lines[i])) continue;
+    let end = lines.length;
+    for (let j = i + 1; j < lines.length; j++) {
+      if (anyHeader.test(lines[j])) {
+        end = j;
+        break;
+      }
+    }
+    ranges.push({ start: i, end });
+    i = end - 1;
+  }
+  return ranges;
+}
 function installIntoCodex(spec2) {
   const file = codexConfigPath();
   try {
     fs10.mkdirSync(path6.dirname(file), { recursive: true });
     let text = "";
+    let existed = true;
     try {
       text = fs10.readFileSync(file, "utf-8");
     } catch {
+      existed = false;
+    }
+    const lines = text.split("\n");
+    const ranges = codexSectionRanges(lines, spec2.name);
+    for (const r of ranges) {
+      const body = lines.slice(r.start, r.end).join("\n");
+      const url = body.match(/^\s*url\s*=\s*"([^"]*)"/m)?.[1];
+      if (url && !OURS.test(url) || !url && /^\s*command\s*=/m.test(body)) {
+        return {
+          ok: false,
+          conflict: true,
+          path: file,
+          error: `~/.codex/config.toml already has an MCP server named "${spec2.name}" that is not an APIblaze proxy \u2014 not touching it. Rename or remove that block and re-run.`
+        };
+      }
+    }
+    for (const r of [...ranges].reverse()) lines.splice(r.start, r.end - r.start);
+    let cleaned = lines.join("\n");
+    if (cleaned.length && !cleaned.endsWith("\n")) cleaned += "\n";
+    if (cleaned.length && !cleaned.endsWith("\n\n")) cleaned += "\n";
+    const tmp = `${file}.tmp-${process.pid}`;
+    fs10.writeFileSync(tmp, cleaned + codexServerBlock(spec2), { encoding: "utf-8", mode: 384 });
+    fs10.renameSync(tmp, file);
+    if (!existed) {
+      try {
+        fs10.chmodSync(file, 384);
+      } catch {
+      }
     }
-    const esc = spec2.name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const section = new RegExp(`(^|\\n)\\[mcp_servers\\.(?:"${esc}"|${esc})\\][^\\[]*`, "g");
-    const cleaned = text.replace(section, "$1");
-    const sep = cleaned.length && !cleaned.endsWith("\n\n") ? cleaned.endsWith("\n") ? "\n" : "\n\n" : "";
-    fs10.writeFileSync(file, cleaned + sep + codexServerBlock(spec2), "utf-8");
     return { ok: true, path: file };
   } catch (err) {
     return { ok: false, error: err instanceof Error ? err.message : String(err), path: file };
@@ -8431,44 +8544,64 @@ var shellQuote = (s) => `"${s.replace(/(["\\$`])/g, "\\$1")}"`;
 function renderCommand(argv) {
   return argv.map((a, i) => i === 0 || /^[A-Za-z0-9_@%+=:,./-]+$/.test(a) ? a : shellQuote(a)).join(" ");
 }
-function installAndDemo(cli, spec2, question, log = console.log) {
+function refreshInstall(cli, spec2) {
+  const r = cli === "claude" ? installIntoClaude(spec2) : installIntoCodex(spec2);
+  return r.ok;
+}
+async function installAndDemo(cli, spec2, getQuestion, log = console.log) {
   if (cli.kind === "claude") {
     log(`
-  ${import_chalk46.default.dim("$")} ${renderCommand(["claude", ...claudeInstallArgs(spec2)])}`);
+  ${import_chalk46.default.dim("$")} ${renderCommand(["claude", ...claudeInstallArgs(spec2, true)])}`);
     const r = installIntoClaude(spec2);
     if (!r.ok) {
-      log(import_chalk46.default.red(`  Install failed: ${r.error}`));
+      log(import_chalk46.default.red(`  ${r.conflict ? "" : "Install failed: "}${r.error}`));
       return false;
     }
     log(`  ${import_chalk46.default.green("\u2714")} MCP ${import_chalk46.default.bold(spec2.name)} added to Claude CLI (local scope \u2014 this directory).`);
+    if (spec2.apiKey) log(import_chalk46.default.dim("     The API key is stored in Claude's local MCP config for this directory."));
   } else {
     const r = installIntoCodex(spec2);
     if (!r.ok) {
-      log(import_chalk46.default.red(`  Could not write ${r.path}: ${r.error}`));
+      log(import_chalk46.default.red(`  ${r.conflict ? "" : `Could not write ${r.path}: `}${r.error}`));
       return false;
     }
     log(`  ${import_chalk46.default.green("\u2714")} MCP ${import_chalk46.default.bold(spec2.name)} added to ${r.path}.`);
   }
   if (!spec2.apiKey) {
-    log(import_chalk46.default.dim(`  This proxy authenticates by login: the first call from ${cli.label} will open its sign-in.`));
+    const loginArgv = cli.kind === "claude" ? ["claude", "mcp", "login", spec2.name] : ["codex", "mcp", "login", spec2.name];
     log(`
-  ${import_chalk46.default.bold(`Your ${cli.label} is now able to talk to the ${spec2.projectLabel} API.`)}`);
-    return true;
+  ${import_chalk46.default.dim("This proxy authenticates by login \u2014 signing you in:")}`);
+    log(`  ${import_chalk46.default.dim("$")} ${renderCommand(loginArgv)}`);
+    const r = run(loginArgv[0], loginArgv.slice(1), { interactive: true });
+    if (r.status !== 0) {
+      log(import_chalk46.default.yellow(`  Sign-in didn't complete (exit ${r.status ?? "?"}). Run \`${renderCommand(loginArgv)}\` yourself, then chat away.`));
+      return true;
+    }
+    log(`  ${import_chalk46.default.green("\u2714")} Signed in.`);
   }
   const oneShot = cli.kind === "claude" ? claudeOneShot : codexOneShot;
   const abilities = `What are the tool abilities of the MCP server "${spec2.name}"? List them briefly.`;
   log(`
-  ${import_chalk46.default.dim("Checking what the MCP exposes\u2026")}`);
+  ${import_chalk46.default.dim("Checking what the API can do\u2026")}`);
   log(`  ${import_chalk46.default.dim("$")} ${renderCommand(cli.kind === "claude" ? ["claude", "-p", abilities, "--allowedTools", `mcp__${spec2.name}__*`] : ["codex", "exec", abilities])}
 `);
-  oneShot(spec2, abilities);
+  const check = oneShot(spec2, abilities);
+  if (check.status !== 0) {
+    log(import_chalk46.default.yellow(`
+  ${cli.label} exited with ${check.status ?? "no status"} \u2014 the MCP is installed, but the demo call failed.`));
+    log(import_chalk46.default.yellow(`  Open ${cli.label} and try it there${cli.kind === "claude" ? " (use /mcp to inspect the connection)" : ""}.`));
+    return true;
+  }
+  const question = await getQuestion();
   if (question) {
     log(`
   ${import_chalk46.default.dim("Your question, through " + cli.label + ":")}`);
     const shown = cli.kind === "claude" ? ["claude", "-p", question, "--allowedTools", `mcp__${spec2.name}__*`] : ["codex", "exec", question];
     log(`  ${import_chalk46.default.dim("$")} ${renderCommand(shown)}
 `);
-    oneShot(spec2, question);
+    const ans = oneShot(spec2, question);
+    if (ans.status !== 0) log(import_chalk46.default.yellow(`
+  ${cli.label} exited with ${ans.status ?? "no status"} on that one \u2014 the MCP stays installed.`));
   }
   log(`
   ${import_chalk46.default.bold(`Your ${cli.label} is now able to talk to the ${spec2.projectLabel} API.`)}`);
@@ -9694,6 +9827,14 @@ async function runRepl(p, initialMessages) {
           p.anon = false;
           claimApichat(p, loadCredentials()?.apiblazeUserId);
           console.log(import_chalk47.default.dim(`  Workspace claimed \u2014 chat now routes on ${p.mcpHost}. History preserved.`));
+          const entry = loadApichats().find((a) => apichatKey(a) === apichatKey(p));
+          for (const [cli, state] of Object.entries(entry?.cliOffer ?? {})) {
+            if (state === "installed" && (cli === "claude" || cli === "codex")) {
+              if (refreshInstall(cli, buildInstallSpec(p))) {
+                console.log(import_chalk47.default.dim(`  ${cli === "claude" ? "Claude" : "Codex"} CLI's MCP entry updated to the new host.`));
+              }
+            }
+          }
         }
       } catch (err) {
         console.log(import_chalk47.default.red(`  Claim failed: ${err instanceof Error ? err.message : String(err)}`));
@@ -9714,61 +9855,137 @@ async function runRepl(p, initialMessages) {
   }
   console.log(import_chalk47.default.dim("\nBye."));
 }
-function rememberCliOffer(projectId, cli, state) {
+function offerKey(p) {
+  return apichatKey(p);
+}
+function rememberCliOffer(p, cli, state) {
   const list = loadApichats();
-  const i = list.findIndex((a) => a.projectId === projectId);
+  const i = list.findIndex((a) => apichatKey(a) === offerKey(p));
   if (i < 0) return;
   list[i].cliOffer = { ...list[i].cliOffer ?? {}, [cli]: state };
   list[i].updatedAt = (/* @__PURE__ */ new Date()).toISOString();
   writeApichats(list);
 }
-async function maybeInstallExternalCli(p, opts) {
-  const spec2 = {
+function buildInstallSpec(p) {
+  return {
     name: p.projectId,
     url: `https://${p.mcpHost}/${p.version}/${p.environment}`,
     // consumerAuth means the door is a login — install bare, the CLI signs in.
     apiKey: p.consumerAuth ? void 0 : p.dpKey,
+    endUserId: p.endUserId,
     projectLabel: p.projectId
   };
-  const clis = detectExternalClis();
-  if (opts.installMcp) {
-    const want = opts.installMcp.toLowerCase();
-    if (want !== "claude" && want !== "codex") fail4(`--install-mcp takes "claude" or "codex", not "${opts.installMcp}".`);
-    const cli = clis.find((c) => c.kind === want);
+}
+async function verifyAndHealMcpHost(p) {
+  const ok = (await verifyMcpEndpoint(buildInstallSpec(p))).ok;
+  if (ok) return true;
+  const flipped = p.mcpHost.includes(".mcp.tryabz.run") ? p.mcpHost.replace(".mcp.tryabz.run", ".mcp.abz.run") : p.mcpHost.replace(".mcp.abz.run", ".mcp.tryabz.run");
+  if (flipped === p.mcpHost) return false;
+  const prev = p.mcpHost;
+  p.mcpHost = flipped;
+  if ((await verifyMcpEndpoint(buildInstallSpec(p))).ok) {
+    const list = loadApichats();
+    const i = list.findIndex((a) => apichatKey(a) === offerKey(p));
+    if (i >= 0) {
+      list[i].mcpHost = flipped;
+      list[i].updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+      writeApichats(list);
+    }
+    return true;
+  }
+  p.mcpHost = prev;
+  return false;
+}
+async function maybeInstallExternalCli(p, opts) {
+  const forced = (opts.installMcp ?? "").toLowerCase();
+  if (forced && forced !== "claude" && forced !== "codex") {
+    fail4(`--install-mcp takes "claude" or "codex", not "${opts.installMcp}".`);
+  }
+  if (!forced && !process.stdin.isTTY) return false;
+  const offer = loadApichats().find((a) => apichatKey(a) === offerKey(p))?.cliOffer ?? {};
+  if (forced) {
+    const cli = detectExternalClis().find((c) => c.kind === forced);
     if (!cli) fail4(
-      `${want === "claude" ? "Claude" : "Codex"} CLI not found on this machine.`,
-      want === "claude" ? "Install it: npm install -g @anthropic-ai/claude-code" : "Install it: npm install -g @openai/codex"
+      `${forced === "claude" ? "Claude" : "Codex"} CLI not found on this machine.`,
+      forced === "claude" ? "Install it: npm install -g @anthropic-ai/claude-code" : "Install it: npm install -g @openai/codex"
     );
-    const question2 = opts.prompt ?? (process.stdin.isTTY ? await askApiQuestion() : void 0);
-    const ran2 = installAndDemo(cli, spec2, question2);
-    if (ran2) rememberCliOffer(p.projectId, cli.kind, "installed");
+    if (!await ensureInstallableDoor(p, opts)) return false;
+    if (!await verifyAndHealMcpHost(p)) {
+      fail4(`The MCP endpoint https://${p.mcpHost}/${p.version}/${p.environment} is not answering \u2014 not installing it into ${cli.label}.`);
+    }
+    const ran2 = await installAndDemo(cli, buildInstallSpec(p), () => resolveQuestion(opts));
+    if (ran2) rememberCliOffer(p, cli.kind, "installed");
     return ran2;
   }
-  if (!process.stdin.isTTY || clis.length === 0) return false;
-  const offer = loadApichats().find((a) => a.projectId === p.projectId)?.cliOffer ?? {};
+  const clis = detectExternalClis();
+  if (clis.length === 0) return false;
+  for (const c of clis) {
+    if (offer[c.kind] === "installed" && await verifyAndHealMcpHost(p)) {
+      refreshInstall(c.kind, buildInstallSpec(p));
+    }
+  }
   const fresh = clis.filter((c) => !offer[c.kind]);
   if (fresh.length === 0) return false;
   const { default: inquirer3 } = await import("inquirer");
   const names = fresh.map((c) => c.label).join(" and ");
+  const targetName = fresh.length > 1 ? "one of them" : fresh[0].label;
   const { pick: pick2 } = await inquirer3.prompt([{
     type: "list",
     name: "pick",
-    message: `I see ${names} ${fresh.length > 1 ? "are" : "is"} installed on this computer. Add the MCP for this proxy so you can chat with your API from there directly?`,
+    message: `I see ${names} ${fresh.length > 1 ? "are" : "is"} installed on this computer. Do you want to add the MCP for this proxy to ${targetName} so you can chat with your API from there directly, or chat here directly?`,
     choices: [
-      ...fresh.map((c) => ({ name: `Yes \u2014 add it to ${c.label}`, value: c })),
-      { name: "No \u2014 chat here instead", value: "no" }
+      ...fresh.map((c) => ({ name: c.label, value: c })),
+      { name: "Chat here directly", value: "here" }
     ]
   }]);
-  if (pick2 === "no") {
-    for (const c of fresh) rememberCliOffer(p.projectId, c.kind, "declined");
+  if (pick2 === "here") {
+    for (const c of fresh) rememberCliOffer(p, c.kind, "declined");
+    if (p.consumerAuth && p.teamId && p.tenant) {
+      try {
+        await ensureConsumerLogin(p.teamId, p.tenant, p.version);
+      } catch (err) {
+        console.log(import_chalk47.default.yellow(`  Sign-in didn't complete (${err instanceof Error ? err.message : String(err)}) \u2014 the first chat turn will retry it.`));
+      }
+    }
+    return false;
+  }
+  if (!await ensureInstallableDoor(p, opts)) return false;
+  if (!await verifyAndHealMcpHost(p)) {
+    console.log(import_chalk47.default.red(`  The MCP endpoint https://${p.mcpHost}/${p.version}/${p.environment} is not answering \u2014 not installing it into ${pick2.label}. Chat here instead.`));
     return false;
   }
-  const question = opts.prompt ?? await askApiQuestion();
-  const ran = installAndDemo(pick2, spec2, question);
-  if (ran) rememberCliOffer(p.projectId, pick2.kind, "installed");
+  const ran = await installAndDemo(pick2, buildInstallSpec(p), () => resolveQuestion(opts));
+  if (ran) {
+    rememberCliOffer(p, pick2.kind, "installed");
+    if (p.anon) {
+      console.log(import_chalk47.default.dim(`  Anonymous workspace \u2014 run \`apiblaze apichat ${p.projectId}\` and /claim to keep it (and this MCP) beyond 30 days.`));
+    }
+  }
   return ran;
 }
-async function askApiQuestion() {
+async function ensureInstallableDoor(p, opts) {
+  if (p.dpKey || p.consumerAuth) return true;
+  if (!process.stdin.isTTY) {
+    fail4(
+      `Can't tell how "${p.projectId}" authenticates (no key on file).`,
+      "Pass --apikey <key> for a key-door proxy, or open it interactively once first."
+    );
+  }
+  const { default: inquirer3 } = await import("inquirer");
+  const { key } = await inquirer3.prompt([{
+    type: "password",
+    name: "key",
+    mask: "*",
+    message: `API key for ${p.projectId} (leave empty if it uses a login):`
+  }]);
+  if (typeof key === "string" && key.trim()) p.dpKey = key.trim();
+  else p.consumerAuth = true;
+  void opts;
+  return true;
+}
+async function resolveQuestion(opts) {
+  if (opts.prompt) return opts.prompt;
+  if (!process.stdin.isTTY) return void 0;
   const { default: inquirer3 } = await import("inquirer");
   const { q } = await inquirer3.prompt([{
     type: "input",
@@ -9778,8 +9995,18 @@ async function askApiQuestion() {
   const t = (q ?? "").trim();
   return t || void 0;
 }
+async function startChat(p, messages, opts) {
+  if (opts.prompt) {
+    await replTurn(p, messages, opts.prompt);
+    saveTranscript(p, messages);
+    if (!process.stdin.isTTY) return;
+  } else if (!process.stdin.isTTY) {
+    fail4('Interactive chat needs a terminal. Pass -p "<question>" for a one-shot answer.');
+  }
+  await runRepl(p, messages);
+}
 async function runApichat(opts) {
-  setVerbose(opts.verbose !== false);
+  setVerbose(opts.verbose === true);
   console.log(import_chalk47.default.bold("\napichat \u2014 turn any API into a chat\n"));
   if (opts.target && !opts.openapispec) {
     const { classifyTargetInput: classifyTargetInput2 } = await Promise.resolve().then(() => (init_spec_or_target(), spec_or_target_exports));
@@ -9793,7 +10020,7 @@ async function runApichat(opts) {
   if (opts.project) {
     const opened = await openDirectProject(opts.project, opts);
     if (await maybeInstallExternalCli(opened.p, opts)) return;
-    await runRepl(opened.p, opened.messages);
+    await startChat(opened.p, opened.messages, opts);
     return;
   }
   if (!opts.openapispec && !opts.target) {
@@ -9803,7 +10030,7 @@ async function runApichat(opts) {
     const resumed = await noArgsMenu(opts);
     if (resumed) {
       if (await maybeInstallExternalCli(resumed.p, opts)) return;
-      await runRepl(resumed.p, resumed.messages);
+      await startChat(resumed.p, resumed.messages, opts);
       return;
     }
   }
@@ -9857,8 +10084,8 @@ async function runApichat(opts) {
   if (p.anon) {
     console.log(import_chalk47.default.dim("\n  Anonymous workspace \u2014 /claim inside the chat to log in and keep it beyond 30 days."));
   }
-  if (await maybeInstallExternalCli(p, opts)) return;
-  await runRepl(p);
+  if (mcpUrl && await maybeInstallExternalCli(p, opts)) return;
+  await startChat(p, [], opts);
 }
 
 // src/commands/consumer.ts
@@ -10243,14 +10470,14 @@ async function runAnonymousInit(root, router, opts) {
 }
 async function runSidecar(opts) {
   const root = path8.resolve(opts.dir ?? process.cwd());
-  const detected = detectNextProject(root);
-  if (!detected.found) {
+  const detected2 = detectNextProject(root);
+  if (!detected2.found) {
     console.log(import_chalk49.default.yellow(`No Next.js project detected in ${root}.`));
     console.log("Create one (e.g. `npx create-next-app`) and re-run `apiblaze init` inside it.");
     return;
   }
   if (!loadCredentials() && !readEnvKey(root)) {
-    await runAnonymousInit(root, detected.router, opts);
+    await runAnonymousInit(root, detected2.router, opts);
     return;
   }
   if (!loadCredentials()) {
@@ -10292,7 +10519,7 @@ async function runSidecar(opts) {
   installSidecarPackage(root);
   let inspectorPath = null;
   if (!opts.noInspector) {
-    inspectorPath = generateInspector(root, detected.router);
+    inspectorPath = generateInspector(root, detected2.router);
     if (inspectorPath) console.log(`  ${import_chalk49.default.green("\u2713")} inspector at ${inspectorPath}`);
   }
   console.log("");
@@ -11066,7 +11293,7 @@ program.command("login").description("Authenticate with APIblaze").option("--tea
     process.exit(1);
   }
 });
-program.command("create").description("Create a new API proxy (no login needed \u2014 without auth it creates an anonymous proxy and prints a claim URL)").option("--name <name>", "Proxy name (becomes <name>.abz.run)").option("--target <url|file>", "What to proxy \u2014 pass ANY of: a target server base URL (https://httpbin.org), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml). Spec inputs are detected automatically; routes, API version and environments then come from the spec").addOption(new import_commander.Option("--openapi <file|url>", "Deprecated alias \u2014 --target now detects spec files/URLs itself").hideHelp()).addOption(new import_commander.Option("--openapispec <file|url>", "Deprecated alias for --openapi").hideHelp()).option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Auth type: api_key | none | oauth", "api_key").option("--apikey", "Protect with API keys and print the bootstrap keys (the default, made explicit). Consumers send X-API-Key.").option("--oauth [config]", `Login door. Bare = APIblaze-hosted GitHub sign-in. '{"iss","aud","jwks"}' = trust YOUR hosted login's JWTs. '{"provider","clientId","clientSecret"}' = APIblaze-hosted login page with YOUR OAuth app (github \xB7 google \xB7 microsoft \xB7 facebook \xB7 auth0).`).option("--identified", "Require every call to identify its end user (X-End-User-Id or a login token); unattributed calls are rejected").option("--iam", "Turn IAM on for the proxy's tenant so users & groups apply to identified calls").option("--apiversion <version>", "API version to create (e.g. 2.0.0). Creating a new version of a proxy you own adds a version to the existing project.").option("--tenant <slug>", "Tenant to attach the proxy to (created if new). Omitted \u2192 your team's most-recently-used tenant.").option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--new-session", "Start a fresh anonymous session (do not group with prior anonymous creates)").option("--json", "Output machine-readable JSON (non-interactive)").action(async (opts) => {
+program.command("create").description("Create a new API proxy (no login needed \u2014 without auth it creates an anonymous proxy and prints a claim URL)").option("--name <name>", "Proxy name (becomes <name>.abz.run)").option("--target <url|file>", "What to proxy \u2014 pass ANY of: a target server base URL (https://httpbin.org), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml). Spec inputs are detected automatically; routes, API version and environments then come from the spec").addOption(new import_commander.Option("--openapi <file|url>", "Deprecated alias \u2014 --target now detects spec files/URLs itself").hideHelp()).addOption(new import_commander.Option("--openapispec <file|url>", "Deprecated alias for --openapi").hideHelp()).option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Auth type: api_key | none | oauth", "api_key").option("--apikey", "Protect with API keys and print the bootstrap keys (the default, made explicit). Consumers send X-API-Key.").option("--oauth [config]", `Login door. Bare = APIblaze-hosted GitHub sign-in. '{"iss","aud","jwks"}' = trust YOUR hosted login's JWTs. '{"provider","clientId","clientSecret"}' = APIblaze-hosted login page with YOUR OAuth app (github \xB7 google \xB7 microsoft \xB7 facebook \xB7 auth0).`).option("--identified", "Require every call to identify its end user (X-End-User-Id or a login token); unattributed calls are rejected").option("--iam", "Turn IAM on for the proxy's tenant so users & groups apply to identified calls").option("--apiversion <version>", "API version to create (e.g. 2.0.0). Creating a new version of a proxy you own adds a version to the existing project.").option("--tenant <slug>", "Tenant to attach the proxy to (created if new). Omitted \u2192 your team's most-recently-used tenant.").option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--auto", "Zero prompts, start to finish: generates the proxy name when --name is omitted (from the target host, salted), takes every confirmation as yes, auto-picks the tenant. Implies --yes.").option("--new-session", "Start a fresh anonymous session (do not group with prior anonymous creates)").option("--json", "Output machine-readable JSON (non-interactive)").action(async (opts) => {
   try {
     await runCreate({ ...opts, openapi: opts.openapi ?? opts.openapispec });
   } catch (err) {
@@ -11079,7 +11306,7 @@ agent.command("authz").description("Chat to design and turn on access rules for
 program.command("rule").description("Author an object-level access rule in plain English, in one shot (billed per turn)").argument("<rule>", 'The rule in plain English, e.g. "users see only their own rows"').argument("<project>", "Project name or id").option("--enforce", "Turn enforcement on immediately (default: shadow-publish only)").option("--apiversion <version>", "API version (defaults to the project's)").action(action((rule, project, opts) => runRule(rule, project, opts)));
 agent.command("openapi").description("Chat to build your API spec from real traffic").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").action(action((project, apiVersion) => runOpenapi(project, apiVersion)));
 agent.command("mcp").description("Chat to build an MCP server for an API").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").option("--environment <env>", "Environment to publish (default: prod)").action(action((project, apiVersion, opts) => runMcp(project, apiVersion, opts)));
-program.command("apichat [project]").description("Turn any API into a chat: point at an OpenAPI spec \u2014 or chat an EXISTING proxy by name (no login needed)").option("--target <url|file>", "What to chat with \u2014 pass ANY of: a target server base URL (spec auto-discovered at /openapi.json etc.), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml)").addOption(new import_commander.Option("--openapi <file|url>", "Deprecated alias \u2014 --target now detects spec files/URLs itself").hideHelp()).addOption(new import_commander.Option("--openapispec <file|url>", "Deprecated alias for --openapi").hideHelp()).option("--name <name>", "Proxy name (defaults to the target host)").option("--apiversion <version>", "API version to create (e.g. 1.0.0)").option("--environment <env>", "Environment to chat against (default: prod anonymous / dev logged-in)").option("--access <mode>", 'Who can call this API once connected (e.g. via Claude): "open" = anyone who signs in, "invite" = only you + emails you pre-approve. Default: invite when logged in, open when anonymous.').option("--target-auth-env <ENV_VAR>", "Read the upstream credential from this env var (CI-safe; required when there is no TTY and the API needs auth)").option("--force", "Proceed even if the API uses oauth2/openIdConnect target auth (you configure target auth yourself later)").option("-y, --yes", "Skip confirmation prompts").option("--tenant <slug>", "Tenant (consumer namespace: portal, login, users) for the new proxy; omit to be asked").option("--apikey <key>", "Use this API key for the proxy's door (api_key proxies). Without it, apichat detects the door and asks \u2014 or runs the consumer login for OAuth doors.").option("--xenduserid <id>", "Assert this end-user id (X-End-User-Id) \u2014 required by proxies with identified/pre-approved enforcement; you are asked for one when the proxy demands it.").option("--no-verbose", "Hide the per-turn proxy curl trace (shown by default for apichat)").option("-p, --prompt <question>", "One-shot question piped through the external agent CLI after the MCP install (used with --install-mcp or the install offer)").option("--install-mcp <cli>", "Install this proxy's MCP into an external agent CLI without asking: claude | codex. Also re-offers after an earlier decline.").action(action((project, opts) => runApichat({ ...opts, project, openapispec: opts.openapispec ?? opts.openapi })));
+program.command("apichat [project]").description("Turn any API into a chat: point at an OpenAPI spec \u2014 or chat an EXISTING proxy by name (no login needed)").option("--target <url|file>", "What to chat with \u2014 pass ANY of: a target server base URL (spec auto-discovered at /openapi.json etc.), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml)").addOption(new import_commander.Option("--openapi <file|url>", "Deprecated alias \u2014 --target now detects spec files/URLs itself").hideHelp()).addOption(new import_commander.Option("--openapispec <file|url>", "Deprecated alias for --openapi").hideHelp()).option("--name <name>", "Proxy name (defaults to the target host)").option("--apiversion <version>", "API version to create (e.g. 1.0.0)").option("--environment <env>", "Environment to chat against (default: prod anonymous / dev logged-in)").option("--access <mode>", 'Who can call this API once connected (e.g. via Claude): "open" = anyone who signs in, "invite" = only you + emails you pre-approve. Default: invite when logged in, open when anonymous.').option("--target-auth-env <ENV_VAR>", "Read the upstream credential from this env var (CI-safe; required when there is no TTY and the API needs auth)").option("--force", "Proceed even if the API uses oauth2/openIdConnect target auth (you configure target auth yourself later)").option("-y, --yes", "Skip confirmation prompts").option("--tenant <slug>", "Tenant (consumer namespace: portal, login, users) for the new proxy; omit to be asked").option("--apikey <key>", "Use this API key for the proxy's door (api_key proxies). Without it, apichat detects the door and asks \u2014 or runs the consumer login for OAuth doors.").option("--xenduserid <id>", "Assert this end-user id (X-End-User-Id) \u2014 required by proxies with identified/pre-approved enforcement; you are asked for one when the proxy demands it.").option("--verbose", "Show the per-turn proxy curl trace (hidden by default)").option("-p, --prompt <question>", "One-shot question: answered through the external agent CLI after an MCP install, or by apichat itself (exits after answering when there is no TTY)").option("--install-mcp <cli>", "Install this proxy's MCP into an external agent CLI without asking: claude | codex. Also re-offers after an earlier decline.").action(action((project, opts) => runApichat({ ...opts, project, openapispec: opts.openapispec ?? opts.openapi })));
 var llm = program.command("llm").description("Manage a local LLM provider key for chat (optional \u2014 lifts model quality, bills your key)");
 llm.command("set-key").description("Store an LLM provider key locally (OpenRouter/Anthropic/DeepSeek/OpenAI)").argument("[key]", "The API key (omit to enter it hidden at a prompt)").option("--model <id>", "Model id to use with this key (e.g. anthropic/claude-haiku-4.5)").action(action((key, opts) => runLlmSetKey(key, opts)));
 llm.command("show").description("Show the locally stored LLM key (masked)").action(action(() => runLlmShow()));
@@ -11244,14 +11471,15 @@ ${groupedCommandHelp()}
 Tips:
   \u2022 \`apiblaze config <project>\` browses EVERY setting & feature (works logged-out to explore).
   \u2022 Add --verbose to any command to see the equivalent API calls.
+  \u2022 Add --auto to \`create\` for a scriptable run: no prompts, no TTY needed, proxy name generated.
   \u2022 Full API reference: https://api.apiblaze.com/openapi.json
   \u2022 Run \`apiblaze <command> --help\` (e.g. \`apiblaze consumer --help\`) for sub-commands.
 
 Examples:
-  $ npx apiblaze apichat --openapi https://pokeapi.co/openapi.yaml  # chat with any API
+  $ npx apiblaze apichat --target https://pokeapi.co/openapi.yaml  # chat with any API
   $ npx apiblaze agent                                   # just chat
   $ npx apiblaze create --target https://api.example.com # one-line API
-  $ npx apiblaze create --openapi https://pokeapi.co/openapi.yaml  # build it from a spec URL
+  $ npx apiblaze create --target https://pokeapi.co/openapi.yaml --auto  # zero prompts, name generated
   $ npx apiblaze search gmail                            # find a recipe (no login needed)
   $ npx apiblaze install @julien/gmail                   # someone's whole working setup, your credentials
   $ npx apiblaze publish mygmail                         # share yours back, as @yourgithubhandle/mygmail

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.20.11",
+  "version": "0.20.14",
   "description": "APIblaze CLI — Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy",
   "keywords": [
     "apiblaze",