Tokens and auth

The CLI stores .artifactcafe/config.json in the published folder on first publish. It contains the artifact id, review URL, API URL, and publish token needed for future versions.

• The API returns the publish token once; the CLI doesn't print it.
• The CLI auto-adds .artifactcafe/ to an existing .gitignore.
• If you lose the file (or don't want to check it in for CI), set ARTIFACT_CAFE_TOKEN in the environment: the CLI falls back to it when .artifactcafe/config.json is missing or doesn't cover --artifact <id>. ARTIFACT_CAFE_URL overrides the API URL the same way. If you don't have the token, publish a new artifact and share the new URL.
• The same is true of the read/act commands — comments (including --wait), protect, and open accept --artifact <id> (or ARTIFACT_CAFE_ARTIFACT_ID) with ARTIFACT_CAFE_TOKEN or a signed-in account key, so the live agent loop can run from a machine that never held the folder.
• If you're signed in, artifact-cafe link binds the folder to one of your artifacts (pick it from your account — no id to type) and writes .artifactcafe/config.json without a token. Owner actions then authorize via your login, so nothing secret lands on disk; the folder is inert until you sign in.
• The CLI shows the claim link once on first publish. The link turns an anonymous artifact into an owned artifact after sign-in.
• Owners can revoke an artifact's publish token from the dashboard (open the artifact's settings → Agent → Revoke token) to cut an agent off. A replacement is never issued — owner sign-in or an API key covers everything afterwards.