feat(cloud): default login to api.specnaut.com — no prompt, no Convex URL - #417
Merged
Conversation
… URL `specnaut cloud login` on a fresh machine used to prompt for a raw `*.convex.site` deployment URL. That was both friction (Specnaut Cloud is a single hosted service — there is nothing for the user to look up) and an implementation leak (the prompt literally exposed Convex as the backend). Resolve the API URL to the canonical `https://api.specnaut.com` by default, so login just opens the browser with zero prompts. `--api-url` and an `api_url` in `backlog-config.yml` remain as escape hatches for dev / self-hosted deployments. The interactive URL prompt is removed. The `#400` trust model is preserved verbatim: a config-supplied URL with no prior creds still requires confirmation; the CLI-shipped `default` source is baked into the signed binary, so it is inherently trusted like `--api-url`. Note: must not ship until api.specnaut.com resolves to the Convex HTTP endpoint (custom domain), otherwise login breaks. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
kevinkod
added a commit
that referenced
this pull request
Aug 4, 2026
… URL (#417) Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
specnaut cloud loginon a fresh machine prompted for a rawhttps://your-deployment.convex.siteURL. Two problems:*.convex.site, exposing Convex as the backend to every user.What
https://api.specnaut.comwhen there's no--api-urlflag and noapi_urlinbacklog-config.yml. Login now opens the browser with zero prompts.--api-url <url>andapi_url:inbacklog-config.ymlstay as escape hatches for dev / self-hosted deployments.*.convex.siteexample from the config stub + the bundled backlogSKILL.md.Trust model (#400) — preserved verbatim
The anti-phishing rule is unchanged: a config-supplied URL with no prior credentials still requires an explicit confirmation before authenticating. The new
defaultsource is baked into the signed binary (not attacker-controllable), so it's inherently trusted — same as an explicit--api-url. Covered by the updatedcloud_login_trust_test.ts.Agent adoption
specnaut cloud login(andspecnaut login) no longer asks for a deployment URL — it defaults tohttps://api.specnaut.com. If your project's.specnaut/backlog-config.ymlpinsapi_urlto a raw*.convex.sitehost, you can delete that line to use the branded default (keep it only for a dev / self-hosted deployment). No re-login is required; existing credentials keep working.Tests
Full suite green (1035 passed). Updated the trust + label tests for the
defaultsource;cloud tokenno-creds guidance still exits 1 as before.🤖 Generated with Claude Code