Skip to content

App record creation from the CLI — no browser gate (v1.64.3.0)#32

Merged
time-attack merged 3 commits into
mainfrom
time-attack/appleship-cli-autonomy
Jul 24, 2026
Merged

App record creation from the CLI — no browser gate (v1.64.3.0)#32
time-attack merged 3 commits into
mainfrom
time-attack/appleship-cli-autonomy

Conversation

@time-attack

@time-attack time-attack commented Jul 24, 2026

Copy link
Copy Markdown
Owner

A live release run declared "create the app record on App Store Connect — the API cannot do this" a hard manual gate. The public API can't, but the CLI can: asc web apps create uses Apple web-session auth (the same iris mechanism fastlane produce has used for a decade) and is documented by asc as the canonical app-creation path.

The Apple release adapter now:

  • creates the app record via asc web apps create --name --bundle-id --sku (cached session → fully headless; fresh login supports programmatic 2FA via --two-factor-code-command / ASC_WEB_2FA_CODE_COMMAND when the user approves a local code source, with hand-off as fallback)
  • registers bundle IDs via asc web bundle-ids (create preflight built in)
  • never stores or echoes the Apple ID password; the session cache is the credential
  • shrinks web residue to: membership purchase, first .p8 key download, agreements, banking/tax (still consent-gated browser drive per v1.64.2.0)

Test evidence: test:gstack2 gate green (parity 4,359), release-hardening 11/11 (package.json/VERSION synced). Live asc web verification requires Apple ID credentials, so the contract change rides asc's documented behavior (asc web --help, v3.1.1); flagged for a credentialed smoke run on first real use.

🤖 Generated with Claude Code


Summary by cubic

App record creation now runs from the CLI with asc web apps create, removing the browser gate and enabling headless Apple releases. Bundle ID registration is also handled via asc web bundle-ids, shrinking web-only steps.

  • New Features
    • Create app records via asc web apps create --name --bundle-id --sku using a cached web session; fresh logins support 2FA via --two-factor-code-command/ASC_WEB_2FA_CODE_COMMAND.
    • Do not store or echo the Apple ID password; the session cache is the credential.
    • Register bundle IDs with asc web bundle-ids (includes create preflight).
    • Update docs (skills/ship/references/APPLE-RELEASE.md, CHANGELOG.md) and bump version to 1.64.3.0.
    • Web-only residue: membership purchase, first .p8 key, agreements, banking/tax.

Written for commit 5a7a6e1. Summary will update on new commits.

Review in cubic

Sinabina and others added 3 commits July 23, 2026 17:12
asc web apps create (Apple web-session, same mechanism as fastlane
produce) creates the app record headlessly with a cached session;
fresh logins support programmatic 2FA via --two-factor-code-command.
Web residue shrinks to membership, first .p8, agreements, banking/tax.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@time-attack
time-attack merged commit 6a8ae74 into main Jul 24, 2026
0 of 2 checks passed
@cursor

cursor Bot commented Jul 24, 2026

Copy link
Copy Markdown

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant