codebyplan 1.13.5 → 1.13.7

package/README.md

@@ -10,7 +10,7 @@ npx codebyplan setup
 
 This will:
 
-1. Prompt for your API key (get one at [codebyplan.com/settings/api-keys](https://codebyplan.com/settings/api-keys))
+1. Sign you in via OAuth (a browser window opens automatically; no API key needed)
 2. Configure Claude Code to connect via remote MCP
 3. Optionally link a repository
 
@@ -18,7 +18,7 @@ This will:
 
 ### `codebyplan setup`
 
-Interactive setup wizard. Configures your API key and MCP server connection.
+Interactive setup wizard. Authenticates via OAuth and configures the MCP server connection.
 
 ### `codebyplan config`
 
@@ -129,14 +129,15 @@ Claude Code connects to CodeByPlan via a remote MCP server. The `setup` command
 {
   "mcpServers": {
     "codebyplan": {
-      "url": "https://www.codebyplan.com/mcp",
-      "headers": { "x-api-key": "your-api-key" }
+      "type": "http",
+      "url": "https://mcp.codebyplan.com/mcp"
     }
   }
 }
 ```
 
+Authentication is handled via OAuth Bearer — no API key is stored in this file.
+
 ## Learn More
 
 - [codebyplan.com](https://codebyplan.com)
-- [API Keys](https://codebyplan.com/settings/api-keys)

package/dist/cli.js

@@ -14,7 +14,7 @@ var VERSION, PACKAGE_NAME;
 var init_version = __esm({
   "src/lib/version.ts"() {
     "use strict";
-    VERSION = "1.13.5";
+    VERSION = "1.13.7";
     PACKAGE_NAME = "codebyplan";
   }
 });
@@ -148,8 +148,7 @@ var init_gitignore_block = __esm({
       ".claude/scheduled_tasks.lock",
       ".codebyplan/device.local.json",
       ".codebyplan/statusline.local.json",
-      ".codebyplan.local.json",
-      ".mcp.json"
+      ".codebyplan.local.json"
     ];
     GITIGNORE_BLOCK_START = "# >>> codebyplan (managed) >>>";
     GITIGNORE_BLOCK_END = "# <<< codebyplan <<<";
@@ -1230,7 +1229,7 @@ async function readConfig(path8) {
   }
 }
 function buildMcpEntry() {
-  return { url: mcpEndpoint() };
+  return { type: "http", url: mcpEndpoint() };
 }
 async function writeMcpConfig(scope) {
   const configPath = getConfigPath(scope);
@@ -1391,11 +1390,6 @@ async function runSetup() {
     const configPath = await writeMcpConfig(scope);
     console.log(`  Done! Config written to ${configPath}
 `);
-    if (auth.kind === "legacy" && scope === "project") {
-      console.log(
-        "  Note: .mcp.json contains your API key \u2014 add it to .gitignore.\n"
-      );
-    }
     let repos = [];
     try {
       repos = await fetchRepos(auth);
@@ -1782,8 +1776,9 @@ async function rewriteConfig(path8, config, newUrl) {
   if (!servers) return false;
   const entry = servers.codebyplan;
   if (!entry) return false;
-  if (!entryHasLegacyApiKey(entry) && entry.url === newUrl) return false;
-  servers.codebyplan = { url: newUrl };
+  if (!entryHasLegacyApiKey(entry) && entry.url === newUrl && entry.type === "http")
+    return false;
+  servers.codebyplan = { type: "http", url: newUrl };
   await writeFile7(path8, JSON.stringify(config, null, 2) + "\n", "utf-8");
   return true;
 }
@@ -1803,7 +1798,7 @@ async function runUpgradeAuth() {
   }
   if (migrated === 0) {
     console.log(
-      "  No legacy x-api-key MCP entries found \u2014 nothing to migrate."
+      "  All codebyplan MCP entries are already up to date \u2014 nothing to change."
     );
   } else {
     console.log(
@@ -5230,7 +5225,9 @@ var init_settings_merge = __esm({
       "fastModePerSessionOptIn",
       "effortLevel",
       "showClearContextOnPlanAccept",
-      "syntaxHighlightingDisabled"
+      "syntaxHighlightingDisabled",
+      "remoteControlAtStartup",
+      "agentPushNotifEnabled"
     ];
   }
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codebyplan",
-  "version": "1.13.5",
+  "version": "1.13.7",
   "description": "CLI for CodeByPlan — AI-powered development planning and tracking",
   "type": "module",
   "bin": {

package/templates/settings.project.base.json

@@ -23,6 +23,8 @@
   "disableSkillShellExecution": false,
   "skipWebFetchPreflight": false,
   "fastModePerSessionOptIn": false,
+  "remoteControlAtStartup": true,
+  "agentPushNotifEnabled": true,
   "effortLevel": "xhigh",
   "statusLine": {
     "type": "command",

package/templates/skills/cbp-git-worktree-create/SKILL.md

@@ -113,7 +113,7 @@ git worktree add "$WORKTREE_PATH" "$BRANCH_NAME"
 
 ### Step 6: Set Up MCP Connection
 
-Copy `.mcp.json` from the main repo to the worktree. The config points at the remote MCP endpoint (`https://codebyplan.com/mcp`) and reads the API key from the environment, so no path rewriting is needed:
+Copy `.mcp.json` from the main repo to the worktree. The file is committed and contains only the public MCP URL (no secret), so this is a plain `cp` — no path rewriting or key substitution needed:
 
 ```bash
 cp "$MAIN_REPO/.mcp.json" "$WORKTREE_PATH/.mcp.json"
@@ -125,10 +125,8 @@ Expected shape (do NOT rewrite paths — this is remote HTTP):
 {
   "mcpServers": {
     "codebyplan": {
-      "url": "https://codebyplan.com/mcp",
-      "headers": {
-        "x-api-key": "${CODEBYPLAN_API_KEY}"
-      }
+      "type": "http",
+      "url": "https://mcp.codebyplan.com/mcp"
     }
   }
 }
@@ -136,7 +134,7 @@ Expected shape (do NOT rewrite paths — this is remote HTTP):
 
 ### Step 7: Set Up Environment
 
-Copy `.env.local` from the main repo to the worktree (contains `CODEBYPLAN_API_KEY` and any other local env):
+Copy `.env.local` from the main repo to the worktree (contains the app's environment variables such as Supabase keys and feature flags — MCP auth is OAuth Bearer handled by Claude Code, not a key in this file):
 
 ```bash
 cp "$MAIN_REPO/.env.local" "$WORKTREE_PATH/.env.local"
@@ -214,8 +212,7 @@ No need to mark as `skip-worktree` — the committed files are merge-safe per CH
 **CodeByPlan**: Registered (worktree ID: [id])
 
 ### Setup
-- MCP: connected (remote endpoint)
-- API key: copied from main repo `.env.local`
+- MCP: connected (remote endpoint, OAuth Bearer)
 - `.claude/` files: full copy on disk (rules, skills, hooks, agents, context)
 
 ### Next Steps