@algolia/wizard 0.10.0 → 0.11.0

package/dist/main.js

@@ -17,6 +17,9 @@ function npxArgs(args) {
   return ["--yes", "@algolia/cli@latest", ...args];
 }
 var shell = process.platform === "win32";
+function mask(text, secret) {
+  return secret ? text.replaceAll(secret, "***") : text;
+}
 function lineSplitter(emit) {
   let buffer = "";
   return {
@@ -40,9 +43,10 @@ var stderrSink = (stream, line) => {
   if (stream === "stdout") return;
   wizardSink(stream, line);
 };
-function runAlgoliaCli(args, { onOutput } = {}) {
+function runAlgoliaCli(args, { onOutput, redact } = {}) {
   const store = useWizard.getState();
-  const logId = store.logStart("tool", `algolia ${args.join(" ")}`);
+  const command = mask(args.join(" "), redact);
+  const logId = store.logStart("tool", `algolia ${command}`);
   return new Promise((resolve4, reject) => {
     const child = spawn("npx", npxArgs(args), { shell });
     let stdout = "";
@@ -71,13 +75,13 @@ function runAlgoliaCli(args, { onOutput } = {}) {
         const failed = stderr.trim();
         let detail = "";
         if (failed) {
-          detail = `: ${failed}`;
+          detail = `: ${mask(failed, redact)}`;
         } else if (stdout.trim()) {
           detail = " (no stderr; stdout withheld \u2014 it may contain credentials)";
         }
         reject(
           new Error(
-            `Algolia CLI \`${args.join(" ")}\` failed (exit ${code})${detail}`
+            `Algolia CLI \`${command}\` failed (exit ${code})${detail}`
           )
         );
       }
@@ -158,10 +162,14 @@ import { join, resolve } from "node:path";
 function rootDir() {
   return process.env.WIZARD_HOME ?? join(homedir(), ".algolia");
 }
-function projectSlug(cwd = process.cwd()) {
+var pinnedRoot;
+function setProjectRoot(cwd) {
+  pinnedRoot = resolve(cwd);
+}
+function projectSlug(cwd = pinnedRoot ?? process.cwd()) {
   return resolve(cwd).replace(/[/\\:]+/g, "-").replace(/^-+/, "") || "root";
 }
-function stateDir(cwd = process.cwd()) {
+function stateDir(cwd = pinnedRoot ?? process.cwd()) {
   return join(rootDir(), projectSlug(cwd));
 }
 
@@ -1743,18 +1751,17 @@ import "zod";
 import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
 import { join as join5 } from "node:path";
 var configFile = () => join5(stateDir(), "config.json");
-var DEFAULT_CONFIG = {
+var defaultConfig = () => ({
   version: 1,
   aiConsent: false,
-  workflowsRun: [],
-  searchApiKeys: {}
-};
+  workflowsRun: []
+});
 async function loadConfig() {
   try {
     const raw = await readFile2(configFile(), "utf8");
-    return { ...DEFAULT_CONFIG, ...JSON.parse(raw) };
+    return { ...defaultConfig(), ...JSON.parse(raw) };
   } catch {
-    return { ...DEFAULT_CONFIG };
+    return defaultConfig();
   }
 }
 async function saveConfig(config) {
@@ -1766,38 +1773,6 @@ async function recordWorkflowRun(workflowId, completedAt) {
   config.workflowsRun.push({ workflowId, completedAt });
   await saveConfig(config);
 }
-function isStoredSearchKey(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const { appId, key } = value;
-  return typeof appId === "string" && !!appId && typeof key === "string" && !!key;
-}
-function storedSearchKeys(config) {
-  const stored = config.searchApiKeys;
-  if (typeof stored !== "object" || stored === null || Array.isArray(stored)) {
-    return {};
-  }
-  return stored;
-}
-async function getStoredSearchKey(index, appId) {
-  const entry = storedSearchKeys(await loadConfig())[index];
-  if (!isStoredSearchKey(entry) || entry.appId !== appId) return void 0;
-  return entry.key;
-}
-async function storeSearchKey(index, appId, key) {
-  const config = await loadConfig();
-  config.searchApiKeys = {
-    ...storedSearchKeys(config),
-    [index]: { appId, key }
-  };
-  await saveConfig(config);
-}
-async function forgetSearchKey(index) {
-  const config = await loadConfig();
-  const remaining = { ...storedSearchKeys(config) };
-  delete remaining[index];
-  config.searchApiKeys = remaining;
-  await saveConfig(config);
-}
 
 // src/core/orchestrator.ts
 function defineStep(step) {
@@ -2063,6 +2038,42 @@ function parseJson(text) {
   }
 }
 
+// src/lib/envAppId.ts
+import { readFile as readFile3 } from "node:fs/promises";
+import { join as join6 } from "node:path";
+var ENV_FILES = [".env", ".env.local"];
+var APP_ID_LINE = /^[ \t]*(?:export[ \t]+)?([A-Z0-9_]*ALGOLIA_APP(?:LICATION)?_ID)[ \t]*=[ \t]*(.*)$/gm;
+async function findEnvApplicationId(root = process.cwd()) {
+  for (const file of ENV_FILES) {
+    let content;
+    try {
+      content = await readFile3(join6(root, file), "utf8");
+    } catch (err) {
+      if (err.code !== "ENOENT") {
+        logger.warn(
+          { file, err },
+          "could not read env file for an application id"
+        );
+      }
+      continue;
+    }
+    for (const [, name, raw] of content.matchAll(APP_ID_LINE)) {
+      const id = readValue(raw);
+      if (id) {
+        logger.info({ file, name, app: id }, "found an application id in env");
+        return { id, name, file };
+      }
+    }
+  }
+  return null;
+}
+function readValue(raw) {
+  const trimmed = raw.trim();
+  const quoted = trimmed.match(/^(['"])(.*)\1/);
+  const value = quoted ? quoted[2].trim() : trimmed.replace(/\s+#.*$/, "").trim();
+  return value.length > 0 && !value.startsWith("<") ? value : null;
+}
+
 // src/lib/algoliaAppPicker.ts
 function secondaryFor(app) {
   return app.plan ? { kind: "badge", value: app.plan } : void 0;
@@ -2077,7 +2088,7 @@ function selectAndReport(app) {
   );
   return selectApplication(app.id);
 }
-async function promptForApplication() {
+async function promptForApplication(leadIn = []) {
   const store = useWizard.getState();
   const apps = await listApplications();
   if (apps.length === 0) {
@@ -2091,9 +2102,13 @@ async function promptForApplication() {
       { app: only.id },
       "single application on the account; selecting it"
     );
+    for (const line of leadIn) store.pushCliOutput("stdout", line);
     return selectAndReport(only);
   }
-  const messages = ["Which Algolia application should the wizard work in?"];
+  const messages = [
+    ...leadIn,
+    "Which Algolia application should the wizard work in?"
+  ];
   for (; ; ) {
     const choice = await store.requestUserInput({
       prompt: "Select an application",
@@ -2119,12 +2134,46 @@ async function promptForApplication() {
     }
   }
 }
+async function confirmEnvApplication(env, current) {
+  const useEnv = `Use ${env.id} (from ${env.file})`;
+  const choice = await useWizard.getState().requestUserInput({
+    prompt: "Select an application",
+    promptType: "multipleChoice",
+    options: [
+      useEnv,
+      current ? `Use ${labelFor(current)} (already selected)` : "Pick a different application"
+    ],
+    messages: [
+      `${env.file} already sets ${env.name}=${env.id}.`,
+      "Which Algolia application should the wizard work in?"
+    ]
+  });
+  return choice === useEnv;
+}
+async function selectEnvApplication(env) {
+  try {
+    return await selectAndReport({ id: env.id, name: "" });
+  } catch (err) {
+    logger.warn(
+      { app: env.id, err: err.message },
+      "could not select the application named in env; falling back to the picker"
+    );
+    return promptForApplication([
+      `Could not select ${env.id} from ${env.file} \u2014 it may have been removed, or this account may not have access to it.`
+    ]);
+  }
+}
 async function ensureApplication() {
-  return await currentApplication() ?? await promptForApplication();
+  const current = await currentApplication();
+  const env = await findEnvApplicationId();
+  if (env && env.id !== current?.id && await confirmEnvApplication(env, current)) {
+    return selectEnvApplication(env);
+  }
+  return current ?? await promptForApplication();
 }
 
 // src/workflows/default.ts
-import { z as z27 } from "zod";
+import { z as z28 } from "zod";
 
 // src/actions/listIndices.ts
 import { z as z5 } from "zod";
@@ -2208,7 +2257,7 @@ import { readdir } from "node:fs/promises";
 
 // src/lib/tools/path.ts
 import { lstat } from "node:fs/promises";
-import { resolve as resolve2, relative, isAbsolute, dirname as dirname3, join as join6, sep } from "node:path";
+import { resolve as resolve2, relative, isAbsolute, dirname as dirname3, join as join7, sep } from "node:path";
 function resolveInRoot(ctx, path) {
   const target = resolve2(ctx.cwd, path);
   const rel = relative(ctx.root, target);
@@ -2224,7 +2273,7 @@ async function hasSymlinkParent(ctx, target) {
   let current = ctx.root;
   const parts = relative(ctx.root, dirname3(target)).split(sep).filter(Boolean);
   for (const part of parts) {
-    current = join6(current, part);
+    current = join7(current, part);
     try {
       if ((await lstat(current)).isSymbolicLink()) return true;
     } catch (err) {
@@ -2245,9 +2294,9 @@ function listFilesTool(ctx) {
       if (++ctx.counts.list > ctx.limits.list) {
         return `Refused: list limit (${ctx.limits.list}) reached. Stop listing and proceed with the information you already have.`;
       }
-      const resolved = resolveInRoot(ctx, ".");
-      if (!resolved.ok) return resolved.error;
-      const entries = await readdir(resolved.target, { withFileTypes: true });
+      const resolved2 = resolveInRoot(ctx, ".");
+      if (!resolved2.ok) return resolved2.error;
+      const entries = await readdir(resolved2.target, { withFileTypes: true });
       return entries.map((e) => e.isDirectory() ? `${e.name}/` : e.name).join("\n");
     }
   });
@@ -2265,14 +2314,14 @@ function changeDirectoryTool(ctx) {
     }),
     execute: async ({ path }) => {
       logger.info({ path }, "called changeDirectory tool");
-      const resolved = resolveInRoot(ctx, path);
-      if (!resolved.ok) return resolved.error;
+      const resolved2 = resolveInRoot(ctx, path);
+      if (!resolved2.ok) return resolved2.error;
       try {
-        const info = await stat(resolved.target);
+        const info = await stat(resolved2.target);
         if (!info.isDirectory()) {
           return `Error changing directory to ${path}: not a directory`;
         }
-        ctx.cwd = resolved.target;
+        ctx.cwd = resolved2.target;
         return `Changed working directory to ${ctx.cwd}`;
       } catch (err) {
         return `Error changing directory to ${path}: ${err.message}`;
@@ -2302,7 +2351,7 @@ function reportStatusTool(output) {
 // src/lib/tools/readFile.ts
 import { tool as tool4 } from "ai";
 import z9 from "zod";
-import { readFile as readFile3 } from "node:fs/promises";
+import { readFile as readFile4 } from "node:fs/promises";
 
 // src/lib/tools/env.ts
 import { basename } from "node:path";
@@ -2337,11 +2386,11 @@ function readFileTool(ctx) {
         return `Refused: read limit (${ctx.limits.read}) reached. Stop reading and proceed with the information you already have.`;
       }
       logger.info({ filePath }, "called readFile tool");
-      const resolved = resolveInRoot(ctx, filePath);
-      if (!resolved.ok) return resolved.error;
+      const resolved2 = resolveInRoot(ctx, filePath);
+      if (!resolved2.ok) return resolved2.error;
       try {
-        const content = await readFile3(resolved.target, "utf8");
-        return isEnvFile(resolved.target) ? redactEnvValues(content) : content;
+        const content = await readFile4(resolved2.target, "utf8");
+        return isEnvFile(resolved2.target) ? redactEnvValues(content) : content;
       } catch (err) {
         return `Error reading ${filePath}: ${err.message}`;
       }
@@ -2363,17 +2412,17 @@ function writeFileTool(ctx) {
     }),
     execute: async ({ filePath, content }) => {
       logger.info({ filePath }, "called writeFile tool");
-      const resolved = resolveInRoot(ctx, filePath);
-      if (resolved.ok === false) return resolved.error;
-      if (isSecretEnvFile(resolved.target)) {
+      const resolved2 = resolveInRoot(ctx, filePath);
+      if (resolved2.ok === false) return resolved2.error;
+      if (isSecretEnvFile(resolved2.target)) {
         return `Refused: ${filePath} holds secrets. Use the writeCredentials tool to set Algolia environment variables, passing this file path.`;
       }
       try {
-        if (await hasSymlinkParent(ctx, resolved.target)) {
-          return `Refused: ${resolved.target} is outside the repo root (${ctx.root}).`;
+        if (await hasSymlinkParent(ctx, resolved2.target)) {
+          return `Refused: ${resolved2.target} is outside the repo root (${ctx.root}).`;
         }
-        await mkdir3(dirname4(resolved.target), { recursive: true });
-        await writeFile3(resolved.target, content, "utf8");
+        await mkdir3(dirname4(resolved2.target), { recursive: true });
+        await writeFile3(resolved2.target, content, "utf8");
         return `Wrote to ${filePath}`;
       } catch (err) {
         return `Error writing ${filePath}: ${err.message}`;
@@ -2384,12 +2433,93 @@ function writeFileTool(ctx) {
 
 // src/lib/tools/writeAlgoliaCredentials.ts
 import { tool as tool6 } from "ai";
-import z12 from "zod";
-import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4 } from "node:fs/promises";
+import z13 from "zod";
+import { mkdir as mkdir4, readFile as readFile5, writeFile as writeFile4 } from "node:fs/promises";
 import { dirname as dirname5 } from "node:path";
 
 // src/lib/algoliaApiKey.ts
+import { z as z12 } from "zod";
+
+// src/lib/keychain.ts
+import { deletePassword, getPassword, setPassword } from "cross-keychain";
 import { z as z11 } from "zod";
+var SERVICE = "algolia-wizard";
+var ACCOUNT = "api-keys";
+var storedKeysSchema = z11.record(z11.string(), z11.string());
+function entryId(kind, index, appId) {
+  return `${kind}:${appId}:${index}`;
+}
+async function loadKeys() {
+  const raw = await getPassword(SERVICE, ACCOUNT);
+  if (!raw) return {};
+  let payload;
+  try {
+    payload = JSON.parse(raw);
+  } catch {
+    payload = null;
+  }
+  const keys = storedKeysSchema.safeParse(payload);
+  if (!keys.success) {
+    logger.warn("the stored API keys are unreadable; treating them as empty");
+    return {};
+  }
+  return keys.data;
+}
+var queue = Promise.resolve();
+function serialized(op) {
+  const next = queue.then(op);
+  queue = next.catch(() => {
+  });
+  return next;
+}
+async function readStoredKey(kind, index, appId) {
+  try {
+    return (await loadKeys())[entryId(kind, index, appId)] ?? null;
+  } catch (err) {
+    logger.warn(
+      { err: err.message, kind, index, appId },
+      "could not read the API key from the keychain"
+    );
+    return null;
+  }
+}
+function storeKey(kind, index, appId, value) {
+  return serialized(async () => {
+    const id = entryId(kind, index, appId);
+    try {
+      const keys = await loadKeys();
+      await setPassword(
+        SERVICE,
+        ACCOUNT,
+        JSON.stringify({ ...keys, [id]: value })
+      );
+      if ((await loadKeys())[id] !== value) {
+        throw new Error("the keychain did not store the value");
+      }
+    } catch (err) {
+      logger.warn(
+        { err: err.message, kind, index, appId },
+        "could not store the API key in the keychain; the next run will create another"
+      );
+    }
+  });
+}
+function deleteStoredKeys() {
+  return serialized(async () => {
+    try {
+      await deletePassword(SERVICE, ACCOUNT);
+    } catch (err) {
+      const message = err.message;
+      if (/not found/i.test(message)) return;
+      logger.warn(
+        { err: message },
+        "could not delete the API keys from the keychain"
+      );
+    }
+  });
+}
+
+// src/lib/algoliaApiKey.ts
 var WRITE_ACLS = [
   "addObject",
   "deleteObject",
@@ -2397,58 +2527,21 @@ var WRITE_ACLS = [
   "editSettings",
   "listIndexes"
 ];
-var WRITE_ACL_SET = new Set(WRITE_ACLS);
-var apiKeySchema = z11.object({
-  value: z11.string().min(1),
-  acl: z11.array(z11.string()).default([]),
-  indexes: z11.array(z11.string()).default([])
-});
-var apiKeyListSchema = z11.object({
-  items: z11.array(apiKeySchema).optional(),
-  keys: z11.array(apiKeySchema).optional()
-}).transform((o) => o.items ?? o.keys ?? []);
-var createdKeySchema = z11.object({
-  key: z11.string().min(1).optional(),
-  value: z11.string().min(1).optional()
+var createdKeySchema = z12.object({
+  key: z12.string().min(1).optional(),
+  value: z12.string().min(1).optional()
 }).transform((o) => o.key ?? o.value);
-function canReuseForWrites(key, index) {
-  return WRITE_ACLS.every((acl) => key.acl.includes(acl)) && key.acl.every((acl) => WRITE_ACL_SET.has(acl)) && key.indexes.includes(index);
-}
-async function resolveWriteKey(index) {
-  const stdout = await runAlgoliaCli(["apikeys", "list", "-o", "json"]);
-  const existing = apiKeyListSchema.parse(JSON.parse(stdout)).find((key) => canReuseForWrites(key, index))?.value;
-  if (existing) {
-    logger.info({ index }, "reusing existing write API key");
-    return existing;
-  }
-  logger.info({ index }, "no reusable write key found; creating one");
-  const created = await runAlgoliaCli([
-    "apikeys",
-    "create",
-    "--indices",
-    index,
-    "--acl",
-    WRITE_ACLS.join(","),
-    "--description",
-    `wizard write key for ${index}`,
-    "-o",
-    "json"
-  ]);
-  const writeKey = createdKeySchema.parse(JSON.parse(created));
-  if (!writeKey) throw new Error("apikeys create returned no key value");
-  return writeKey;
-}
-async function createSearchOnlyKey(index) {
-  logger.info({ index }, "creating a search-only API key");
+async function createKey(index, acls, description) {
+  logger.info({ index, acls }, "creating an API key");
   const stdout = await runAlgoliaCli([
     "apikeys",
     "create",
     "--acl",
-    "search",
+    acls.join(","),
     "--indices",
     index,
     "--description",
-    `Algolia Wizard search-only key for ${index}`,
+    description,
     "-o",
     "json"
   ]);
@@ -2462,49 +2555,72 @@ async function createSearchOnlyKey(index) {
   if (!created) throw new Error("apikeys create returned no key value");
   return created;
 }
-async function apiKeyExists(key) {
+async function keyExists(key) {
   try {
-    await runAlgoliaCli(["apikeys", "get", key, "-o", "json"]);
+    await runAlgoliaCli(["apikeys", "get", key, "-o", "json"], { redact: key });
     return true;
   } catch (err) {
-    return !/does not exist|not found|404/i.test(err.message);
+    return !/does not exist/i.test(err.message);
   }
 }
-async function resolveSearchOnlyKey(index, appId, envKey) {
-  if (envKey) {
-    await recordSearchKey(index, appId, envKey);
-    return { key: envKey, source: "env" };
-  }
-  const stored = await getStoredSearchKey(index, appId);
+var resolved = /* @__PURE__ */ new Map();
+async function forgetResolvedKeys() {
+  resolved.clear();
+  await deleteStoredKeys();
+}
+function resolveKey(kind, index, appId, acls, description) {
+  const cacheKey = `${kind}:${appId}:${index}`;
+  const cached = resolved.get(cacheKey);
+  if (cached) return cached;
+  const pending = provisionKey(kind, index, appId, acls, description).catch(
+    (err) => {
+      resolved.delete(cacheKey);
+      throw err;
+    }
+  );
+  resolved.set(cacheKey, pending);
+  return pending;
+}
+async function provisionKey(kind, index, appId, acls, description) {
+  const stored = await readStoredKey(kind, index, appId);
   if (stored) {
-    if (await apiKeyExists(stored)) {
-      logger.info({ index, appId }, "reusing the stored search-only API key");
-      return { key: stored, source: "config" };
+    if (await keyExists(stored)) {
+      logger.info({ kind, index, appId }, "reusing the stored API key");
+      return { key: stored, source: "keychain" };
     }
-    logger.warn(
-      { index, appId },
-      "the stored search-only API key no longer exists; creating a replacement"
+    logger.info(
+      { kind, index, appId },
+      "the stored API key no longer exists; creating another"
     );
-    await forgetSearchKey(index);
   }
-  const key = await createSearchOnlyKey(index);
-  await recordSearchKey(index, appId, key);
+  const key = await createKey(index, acls, description);
+  await storeKey(kind, index, appId, key);
   return { key, source: "created" };
 }
-async function recordSearchKey(index, appId, key) {
-  try {
-    await storeSearchKey(index, appId, key);
-  } catch (err) {
-    logger.warn(
-      { err: err.message, index },
-      "could not record the search-only API key; a later run may create another"
-    );
-  }
+function resolveWriteKey(index, appId) {
+  return resolveKey(
+    "write",
+    index,
+    appId,
+    WRITE_ACLS,
+    `Algolia Wizard write key for ${index} index`
+  );
+}
+async function resolveSearchOnlyKey(index, appId, envKey) {
+  if (envKey) return { key: envKey, source: "env" };
+  return resolveKey(
+    "search",
+    index,
+    appId,
+    ["search"],
+    `Algolia Wizard search-only key for ${index} index`
+  );
 }
 
 // src/lib/tools/writeAlgoliaCredentials.ts
 var APP_ID_VAR = "ALGOLIA_APPLICATION_ID";
 var API_KEY_VAR = "ALGOLIA_WRITE_API_KEY";
+var INDEX_NAME_VAR = "ALGOLIA_INDEX_NAME";
 function appendEnv(content, entries) {
   const prefix = content.length > 0 && !content.endsWith("\n") ? "\n" : "";
   const lines = entries.map(([name, value]) => `${name}=${value}
@@ -2514,53 +2630,111 @@ function appendEnv(content, entries) {
 function hasEnv(content, name) {
   return new RegExp(`^(\\s*(?:export\\s+)?${name})\\s*=`, "m").test(content);
 }
+function readEnv(content, name) {
+  const found = content.match(
+    new RegExp(`^\\s*(?:export\\s+)?${name}\\s*=\\s*(.*)$`, "m")
+  );
+  if (!found) return null;
+  const raw = found[1].trim();
+  const quoted = raw.match(/^(['"])(.*)\1/);
+  const value = quoted ? quoted[2] : raw.replace(/\s+#.*$/, "");
+  return value.length > 0 ? value : null;
+}
+function upsertEnv(content, name, value) {
+  if (!hasEnv(content, name)) return appendEnv(content, [[name, value]]);
+  return content.replace(
+    new RegExp(`^\\s*(?:export\\s+)?${name}\\s*=.*$`, "gm"),
+    () => `${name}=${value}`
+  );
+}
 function writeCredentialsTool(ctx) {
   return tool6({
-    description: `Write the active Algolia credentials (${APP_ID_VAR} and ${API_KEY_VAR}) into the given env file. The credentials come from the selected Algolia application, with a write key scoped to the target index; you only pass the path to the env file (e.g. ".env"). If the file already defines ${APP_ID_VAR} or ${API_KEY_VAR}, the write is skipped and existing values are left untouched.`,
-    inputSchema: z12.object({
-      filePath: z12.string().describe(
+    description: `Write the active Algolia credentials (${APP_ID_VAR} and ${API_KEY_VAR}) and the target index name (${INDEX_NAME_VAR}) into the given env file. The credentials come from the selected Algolia application, with a write key scoped to the target index; you only pass the path to the env file. ${INDEX_NAME_VAR} is always set to this run's target index, replacing any value already there. An ${APP_ID_VAR} or ${API_KEY_VAR} the file already gives a value is left untouched; a missing or blank one is filled in when it can be paired with the selected application.`,
+    inputSchema: z13.object({
+      filePath: z13.string().describe(
         'Path to the env file to write credentials into (e.g. ".env")'
       )
     }),
     execute: async ({ filePath }) => {
       logger.info({ filePath }, "called writeCredentials tool");
-      const resolved = resolveInRoot(ctx, filePath);
-      if (resolved.ok === false) return resolved.error;
+      const resolved2 = resolveInRoot(ctx, filePath);
+      if (resolved2.ok === false) return resolved2.error;
       const targetIndex = useWizard.getState().targetIndex;
       if (!targetIndex) {
         return "Error: no target index is set for this run, so a scoped write key cannot be provisioned.";
       }
-      let appId;
-      let writeKey;
-      try {
-        appId = (await requireApplication()).id;
-        writeKey = await resolveWriteKey(targetIndex);
-      } catch (err) {
-        return `Error: could not resolve Algolia credentials (${err.message}). Ask the user to authenticate with the Algolia CLI first.`;
-      }
+      let existing = "";
+      let present;
       try {
-        if (await hasSymlinkParent(ctx, resolved.target)) {
-          return `Refused: ${resolved.target} is outside the repo root (${ctx.root}).`;
+        if (await hasSymlinkParent(ctx, resolved2.target)) {
+          return `Refused: ${resolved2.target} is outside the repo root (${ctx.root}).`;
         }
-        let existing = "";
         try {
-          existing = await readFile4(resolved.target, "utf8");
+          existing = await readFile5(resolved2.target, "utf8");
         } catch (err) {
           if (err.code !== "ENOENT") throw err;
         }
-        const present = [APP_ID_VAR, API_KEY_VAR].filter(
-          (name) => hasEnv(existing, name)
+        present = [APP_ID_VAR, API_KEY_VAR].filter(
+          (name) => readEnv(existing, name) !== null
         );
+      } catch (err) {
+        return `Error writing credentials to ${filePath}: ${err.message}`;
+      }
+      const credentials = [];
+      const notes = [];
+      const fileAppId = readEnv(existing, APP_ID_VAR);
+      const fileKey = readEnv(existing, API_KEY_VAR);
+      const fileIndex = readEnv(existing, INDEX_NAME_VAR);
+      if (fileAppId === null || fileKey === null) {
+        try {
+          const selected = (await requireApplication()).id;
+          if (fileAppId === null) credentials.push([APP_ID_VAR, selected]);
+          if (fileKey === null) {
+            if (fileAppId !== null && fileAppId !== selected) {
+              notes.push(
+                `No ${API_KEY_VAR} was provisioned: ${filePath} names application ${fileAppId}, but ${selected} is selected. Tell the user to remove ${APP_ID_VAR} from ${filePath} and re-run so a matching pair can be written, or to fill in a ${API_KEY_VAR} for ${fileAppId} by hand.`
+              );
+            } else {
+              credentials.push([
+                API_KEY_VAR,
+                (await resolveWriteKey(targetIndex, selected)).key
+              ]);
+            }
+          } else {
+            notes.push(
+              `The existing ${API_KEY_VAR} must belong to application ${selected} or writes will fail.`
+            );
+          }
+        } catch (err) {
+          return `Error: could not resolve Algolia credentials (${err.message}). Ask the user to authenticate with the Algolia CLI first.`;
+        }
+      }
+      try {
+        const updated = [
+          ...credentials,
+          // Unconditional, unlike the credentials: the write key is scoped to
+          // the run's index, so a stale name left in the file earns a 403.
+          [INDEX_NAME_VAR, targetIndex]
+        ].reduce(
+          (content, [name, value]) => upsertEnv(content, name, value),
+          existing
+        );
+        await mkdir4(dirname5(resolved2.target), { recursive: true });
+        await writeFile4(resolved2.target, updated, "utf8");
+        const sentences = [
+          `Wrote ${[...credentials.map(([name]) => name), INDEX_NAME_VAR].join(", ")} to ${filePath}.`
+        ];
+        if (fileIndex !== null && fileIndex !== targetIndex) {
+          sentences.push(
+            `That replaced the ${INDEX_NAME_VAR} already there ("${fileIndex}"), which this run does not target.`
+          );
+        }
         if (present.length > 0) {
-          return `Skipped: ${filePath} already defines ${present.join(" and ")}. Leaving existing credentials untouched.`;
+          sentences.push(
+            `Skipped ${present.join(" and ")}: already defined there.`
+          );
         }
-        const envWithCredentials = appendEnv(existing, [
-          [APP_ID_VAR, appId],
-          [API_KEY_VAR, writeKey]
-        ]);
-        await mkdir4(dirname5(resolved.target), { recursive: true });
-        await writeFile4(resolved.target, envWithCredentials, "utf8");
-        return `Wrote Algolia credentials to ${filePath}`;
+        return [...sentences, ...notes].join(" ");
       } catch (err) {
         return `Error writing credentials to ${filePath}: ${err.message}`;
       }
@@ -2570,16 +2744,16 @@ function writeCredentialsTool(ctx) {
 
 // src/lib/tools/searchFiles.ts
 import { tool as tool7 } from "ai";
-import z13 from "zod";
-import { readdir as readdir2, readFile as readFile5 } from "node:fs/promises";
-import { join as join7 } from "node:path";
+import z14 from "zod";
+import { readdir as readdir2, readFile as readFile6 } from "node:fs/promises";
+import { join as join8 } from "node:path";
 var MAX_QUERY_LENGTH = 1e3;
 async function walkFiles(dir) {
   const skip = /* @__PURE__ */ new Set(["node_modules", ".git", "dist"]);
   const out = [];
   for (const e of await readdir2(dir, { withFileTypes: true })) {
     if (e.name.startsWith(".") || skip.has(e.name)) continue;
-    const full = join7(dir, e.name);
+    const full = join8(dir, e.name);
     if (e.isDirectory()) out.push(...await walkFiles(full));
     else if (e.isFile()) out.push(full);
   }
@@ -2588,9 +2762,9 @@ async function walkFiles(dir) {
 function searchFilesTool(ctx) {
   return tool7({
     description: "Search file contents for a JavaScript regular expression (RegExp syntax, not grep/PCRE). Returns matching lines as file:line:text.",
-    inputSchema: z13.object({
-      query: z13.string().describe("JavaScript RegExp pattern to search for"),
-      path: z13.string().optional().describe("Directory to search in (default: cwd)")
+    inputSchema: z14.object({
+      query: z14.string().describe("JavaScript RegExp pattern to search for"),
+      path: z14.string().optional().describe("Directory to search in (default: cwd)")
     }),
     execute: async ({ query, path = "." }) => {
       logger.info({ query, path }, "called searchFiles tool");
@@ -2600,8 +2774,8 @@ function searchFilesTool(ctx) {
       if (query.length > MAX_QUERY_LENGTH) {
         return `Refused: query exceeds ${MAX_QUERY_LENGTH} characters. Use a shorter pattern.`;
       }
-      const resolved = resolveInRoot(ctx, path);
-      if (!resolved.ok) return resolved.error;
+      const resolved2 = resolveInRoot(ctx, path);
+      if (!resolved2.ok) return resolved2.error;
       let re;
       try {
         re = new RegExp(query);
@@ -2609,10 +2783,10 @@ function searchFilesTool(ctx) {
         return `Invalid regex: ${err.message}`;
       }
       const matches = [];
-      for (const file of await walkFiles(resolved.target)) {
+      for (const file of await walkFiles(resolved2.target)) {
         let content;
         try {
-          content = await readFile5(file, "utf8");
+          content = await readFile6(file, "utf8");
         } catch {
           continue;
         }
@@ -2634,7 +2808,7 @@ function searchFilesTool(ctx) {
 
 // src/lib/tools/verifyImplementation.ts
 import { tool as tool8 } from "ai";
-import z14 from "zod";
+import z15 from "zod";
 
 // src/lib/tools/utils/runCommand.ts
 import { spawn as spawn2 } from "node:child_process";
@@ -2656,9 +2830,9 @@ function runCommand(command, args, cwd) {
 }
 
 // src/lib/tools/utils/packageManager.ts
-import { readFile as readFile6 } from "node:fs/promises";
+import { readFile as readFile7 } from "node:fs/promises";
 import { existsSync } from "node:fs";
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 var LOCKFILES = [
   ["pnpm-lock.yaml", "pnpm"],
   ["yarn.lock", "yarn"],
@@ -2667,13 +2841,13 @@ var LOCKFILES = [
   ["package-lock.json", "npm"]
 ];
 async function readPackageJson(cwd = process.cwd()) {
-  return JSON.parse(await readFile6(join8(cwd, "package.json"), "utf8"));
+  return JSON.parse(await readFile7(join9(cwd, "package.json"), "utf8"));
 }
 function packageManagerFrom(pkg) {
   return pkg.packageManager?.split("@")[0] ?? "npm";
 }
 function packageManagerFromLockfile(cwd) {
-  return LOCKFILES.find(([file]) => existsSync(join8(cwd, file)))?.[1];
+  return LOCKFILES.find(([file]) => existsSync(join9(cwd, file)))?.[1];
 }
 async function detectPackageManager(cwd) {
   try {
@@ -2714,7 +2888,7 @@ async function runRepoVerificationCheck() {
 function verifyImplementationTool() {
   return tool8({
     description: "Run the repo's mechanical verification check for generated implementation changes. Detects lint/typecheck/check from package.json and returns structured pass/fail evidence for the verifier to interpret.",
-    inputSchema: z14.object(),
+    inputSchema: z15.object(),
     execute: async () => {
       logger.info("called verifyImplementation tool");
       return runRepoVerificationCheck();
@@ -2728,7 +2902,7 @@ import { createAnthropic } from "@ai-sdk/anthropic";
 import { nanoid as nanoid2 } from "nanoid";
 import { mkdir as mkdir5, writeFile as writeFile5 } from "node:fs/promises";
 import { dirname as dirname6 } from "node:path";
-import z15 from "zod";
+import z16 from "zod";
 var DATA_DIR = ".algolia-wizard/data";
 var RECORD_MODEL = "claude-haiku-4-5";
 var MAX_RECORDS = 100;
@@ -2740,17 +2914,17 @@ var anthropic = createAnthropic({
 function generateRecordTool(ctx) {
   return tool9({
     description: "Generate realistic sample records for an entity and write them to a JSON file in the worktree. Provide the entity name and its attributes; this tool asks a model to invent varied, realistic values, each with a unique objectID, and returns the file path to read them from at runtime. Do not invent the record values or objectIDs yourself, and do not inline the returned records into the script \u2014 call this tool and read the file it writes.",
-    inputSchema: z15.object({
-      entityName: z15.string().describe("Name of the entity to generate records for."),
-      attributes: z15.array(z15.string()).describe("Attribute names each record must contain."),
-      count: z15.number().int().min(1).max(MAX_RECORDS).default(10).describe(`How many records to generate (max ${MAX_RECORDS}).`),
-      hint: z15.string().optional().describe("Optional context to steer realistic values.")
+    inputSchema: z16.object({
+      entityName: z16.string().describe("Name of the entity to generate records for."),
+      attributes: z16.array(z16.string()).describe("Attribute names each record must contain."),
+      count: z16.number().int().min(1).max(MAX_RECORDS).default(10).describe(`How many records to generate (max ${MAX_RECORDS}).`),
+      hint: z16.string().optional().describe("Optional context to steer realistic values.")
     }),
     execute: async ({ entityName, attributes, count, hint }) => {
       logger.info({ entityName, count }, "called generateRecord tool");
       try {
-        const value = z15.union([z15.string(), z15.number(), z15.boolean(), z15.null()]);
-        const recordSchema = z15.object(
+        const value = z16.union([z16.string(), z16.number(), z16.boolean(), z16.null()]);
+        const recordSchema = z16.object(
           Object.fromEntries(attributes.map((attr) => [attr, value]))
         );
         const generateBatch = async (batchCount) => {
@@ -2760,8 +2934,8 @@ function generateRecordTool(ctx) {
               const { output } = await generateText({
                 model: anthropic(RECORD_MODEL),
                 output: Output.object({
-                  schema: z15.object({
-                    records: z15.array(recordSchema).length(batchCount)
+                  schema: z16.object({
+                    records: z16.array(recordSchema).length(batchCount)
                   })
                 }),
                 prompt: [
@@ -2797,13 +2971,13 @@ function generateRecordTool(ctx) {
         }));
         const slug = entityName.toLowerCase().replace(/[^a-z0-9]+/g, "-");
         const relPath = `${DATA_DIR}/${slug}.json`;
-        const resolved = resolveInRoot(ctx, relPath);
-        if (resolved.ok === false) return resolved.error;
-        if (await hasSymlinkParent(ctx, resolved.target)) {
-          return `Refused: ${resolved.target} is outside the repo root (${ctx.root}).`;
+        const resolved2 = resolveInRoot(ctx, relPath);
+        if (resolved2.ok === false) return resolved2.error;
+        if (await hasSymlinkParent(ctx, resolved2.target)) {
+          return `Refused: ${resolved2.target} is outside the repo root (${ctx.root}).`;
         }
-        await mkdir5(dirname6(resolved.target), { recursive: true });
-        await writeFile5(resolved.target, JSON.stringify(records, null, 2), "utf8");
+        await mkdir5(dirname6(resolved2.target), { recursive: true });
+        await writeFile5(resolved2.target, JSON.stringify(records, null, 2), "utf8");
         logger.info({ entityName, count: records.length, relPath }, "generateRecord wrote records to disk");
         return {
           filePath: relPath,
@@ -2819,12 +2993,12 @@ function generateRecordTool(ctx) {
 
 // src/lib/tools/notifyUser.ts
 import { tool as tool10 } from "ai";
-import z16 from "zod";
+import z17 from "zod";
 function notifyUserTool() {
   return tool10({
     description: `Give the user a brief, high-level update on what you are currently doing or about to do next. This is for the big picture (e.g. "Reading through your data models", "Writing the search UI") \u2014 not granular detail like individual tool calls, which are already logged separately. Call it when you start a new phase of work or your focus shifts, just not on every step, enough to keep the user engaged. Don't say things like "starting", just describe what you are doing. Don't mention tool calls themselves, just general direction of the work.`,
-    inputSchema: z16.object({
-      message: z16.string().describe(
+    inputSchema: z17.object({
+      message: z17.string().describe(
         "Short, plain-language description of what you are doing now."
       )
     }),
@@ -3004,10 +3178,10 @@ async function runAgent(req) {
 }
 
 // src/actions/detectLanguage.ts
-import z19 from "zod";
-var detectLanguageSchema = z19.object({
-  languages: z19.array(z19.object({ name: z19.string(), version: z19.string() })),
-  frameworks: z19.array(z19.object({ name: z19.string(), version: z19.string() }))
+import z20 from "zod";
+var detectLanguageSchema = z20.object({
+  languages: z20.array(z20.object({ name: z20.string(), version: z20.string() })),
+  frameworks: z20.array(z20.object({ name: z20.string(), version: z20.string() }))
 });
 var detectLanguage = () => runAgent({
   instructions: [
@@ -3025,31 +3199,31 @@ var detectLanguage = () => runAgent({
 });
 
 // src/actions/analyzeCodebase.ts
-import z20 from "zod";
+import z21 from "zod";
 var READONLY_TOOLS = [
   "listFiles",
   "changeDirectory",
   "readFile",
   "searchFiles"
 ];
-var ingestionAnalysisSchema = z20.object({
-  ingestionAnalysis: z20.array(
-    z20.object({
-      name: z20.string(),
-      paths: z20.array(z20.string()),
+var ingestionAnalysisSchema = z21.object({
+  ingestionAnalysis: z21.array(
+    z21.object({
+      name: z21.string(),
+      paths: z21.array(z21.string()),
       // indexable fields the agent found for this entity
-      attributes: z20.array(z20.string())
+      attributes: z21.array(z21.string())
     })
   )
 });
-var searchImplementationAnalysisSchema = z20.object({
-  searchImplementationAnalysis: z20.string()
+var searchImplementationAnalysisSchema = z21.object({
+  searchImplementationAnalysis: z21.string()
 });
-var verificationSchema = z20.object({
-  verification: z20.array(z20.string())
+var verificationSchema = z21.object({
+  verification: z21.array(z21.string())
 });
 var confirmedEntitiesFieldSchema = ingestionAnalysisSchema.shape.ingestionAnalysis.optional();
-var analyzeCodebaseSchema = z20.object({
+var analyzeCodebaseSchema = z21.object({
   ingestionAnalysis: ingestionAnalysisSchema.shape.ingestionAnalysis.optional(),
   searchImplementationAnalysis: searchImplementationAnalysisSchema.shape.searchImplementationAnalysis.optional(),
   verification: verificationSchema.shape.verification.optional(),
@@ -3111,7 +3285,7 @@ async function runAnalysis(mode, extraInstructions = []) {
 // package.json
 var package_default = {
   name: "@algolia/wizard",
-  version: "0.10.0",
+  version: "0.11.0",
   description: "Magically implement Algolia functionality in your codebase",
   type: "module",
   engines: {
@@ -3162,6 +3336,7 @@ var package_default = {
     "@hono/node-server": "^2.0.10",
     "@segment/analytics-node": "^3.1.0",
     ai: "^6.0.190",
+    "cross-keychain": "^1.1.0",
     dotenv: "^17.4.2",
     hono: "^4.12.27",
     ink: "^7.0.5",
@@ -3229,8 +3404,8 @@ async function askList(ctx, prompt, { required = false } = {}) {
 }
 
 // src/actions/confirmLanguage.ts
-import z22 from "zod";
-var confirmLanguageSchema = z22.object({
+import z23 from "zod";
+var confirmLanguageSchema = z23.object({
   languages: detectLanguageSchema.shape.languages
 });
 async function confirmLanguage(ctx) {
@@ -3251,8 +3426,8 @@ async function confirmLanguage(ctx) {
 }
 
 // src/actions/confirmFramework.ts
-import z23 from "zod";
-var confirmFrameworkSchema = z23.object({
+import z24 from "zod";
+var confirmFrameworkSchema = z24.object({
   frameworks: detectLanguageSchema.shape.frameworks
 });
 var CURATED_FRAMEWORKS = [
@@ -3380,8 +3555,8 @@ async function promptUser(ctx, params) {
 }
 
 // src/actions/confirmEntities.ts
-import z24 from "zod";
-var confirmEntitiesSchema = z24.object({
+import z25 from "zod";
+var confirmEntitiesSchema = z25.object({
   // Final detection — the focused re-run may supersede project-scan's.
   ingestionAnalysis: ingestionAnalysisSchema.shape.ingestionAnalysis.optional(),
   confirmedEntities: confirmedEntitiesFieldSchema
@@ -3451,15 +3626,15 @@ async function confirmEntities(ctx) {
 }
 
 // src/actions/review.ts
-import { z as z25 } from "zod";
-var reviewSchema = z25.object({
+import { z as z26 } from "zod";
+var reviewSchema = z26.object({
   // Broad, high-level takeaways grouped by theme (e.g. ingestion, search UI),
   // not one entry per workflow step — a step's raw output can be a long,
   // multi-paragraph blob (see implement.ts's summaries.join), and mirroring
   // that 1:1 is what made the old per-step summary an unreadable wall of text.
-  summaryPoints: z25.array(z25.string()),
-  reviewPrompt: z25.string(),
-  nextSteps: z25.array(z25.string())
+  summaryPoints: z26.array(z26.string()),
+  reviewPrompt: z26.string(),
+  nextSteps: z26.array(z26.string())
 });
 function formatCompletedSteps(steps) {
   if (!steps.length) return "(no prior steps completed)";
@@ -3510,16 +3685,16 @@ ${formatCompletedSteps(ctx.completedSteps)}`,
 };
 
 // src/actions/implement.ts
-import z26 from "zod";
+import z27 from "zod";
 
 // src/lib/worktree.ts
 import { execFile, spawn as spawn3 } from "node:child_process";
-import { copyFile, mkdir as mkdir6, readdir as readdir3, readFile as readFile7, stat as stat2, writeFile as writeFile6 } from "node:fs/promises";
+import { copyFile, mkdir as mkdir6, readdir as readdir3, readFile as readFile8, stat as stat2, writeFile as writeFile6 } from "node:fs/promises";
 import {
   basename as basename2,
   dirname as dirname7,
   isAbsolute as isAbsolute2,
-  join as join9,
+  join as join10,
   relative as relative2,
   resolve as resolve3
 } from "node:path";
@@ -3553,7 +3728,7 @@ async function isWorkingTreeDirty(repoRoot) {
   return out.trim().length > 0;
 }
 async function pruneOldWorktrees(repoRoot) {
-  const dir = join9(stateDir(repoRoot), "worktrees");
+  const dir = join10(stateDir(repoRoot), "worktrees");
   const stale = (await readdir3(dir).catch(() => [])).filter((name) => /^wizard-implement-\d+$/.test(name)).sort().reverse().slice(MAX_WIZARD_WORKTREES - 1);
   for (const slug of stale) {
     const branch = slug.replace("wizard-implement-", WIZARD_BRANCH_PREFIX);
@@ -3564,7 +3739,7 @@ async function pruneOldWorktrees(repoRoot) {
         "worktree",
         "remove",
         "--force",
-        join9(dir, slug)
+        join10(dir, slug)
       ]);
       await git(["-C", repoRoot, "branch", "-D", branch]);
     } catch (err) {
@@ -3578,7 +3753,7 @@ async function pruneOldWorktrees(repoRoot) {
 async function createWorktree(repoRoot) {
   const branch = `${WIZARD_BRANCH_PREFIX}${Date.now()}`;
   const dirSlug = branch.replace(/\//g, "-");
-  const path = join9(stateDir(repoRoot), "worktrees", dirSlug);
+  const path = join10(stateDir(repoRoot), "worktrees", dirSlug);
   await git(["-C", repoRoot, "worktree", "prune"]);
   await pruneOldWorktrees(repoRoot);
   await mkdir6(dirname7(path), { recursive: true });
@@ -3698,8 +3873,8 @@ async function copyUploadIntoWorktree(repoRoot, worktreePath, ingestDir, sourceP
   } catch {
     return { ok: false, reason: `"${sourcePath}" does not exist` };
   }
-  const relPath = join9(ingestDir, basename2(source));
-  const dest = join9(worktreePath, relPath);
+  const relPath = join10(ingestDir, basename2(source));
+  const dest = join10(worktreePath, relPath);
   try {
     await mkdir6(dirname7(dest), { recursive: true });
     await copyFile(source, dest);
@@ -3717,7 +3892,7 @@ function hasEnvVar(content, name) {
 async function readEnvVar(worktreePath, name) {
   let content;
   try {
-    content = await readFile7(join9(worktreePath, ".env"), "utf8");
+    content = await readFile8(join10(worktreePath, ".env"), "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
     return void 0;
@@ -3732,10 +3907,10 @@ async function readEnvVar(worktreePath, name) {
   return value;
 }
 async function writeSearchEnvValues(worktreePath, vars) {
-  const target = join9(worktreePath, ".env");
+  const target = join10(worktreePath, ".env");
   let existing = "";
   try {
-    existing = await readFile7(target, "utf8");
+    existing = await readFile8(target, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
   }
@@ -3805,13 +3980,13 @@ async function confirmDirtyWorkingTree(ctx, repoRoot) {
 
 // src/lib/algoliaDocs.ts
 import { readFileSync, readdirSync, existsSync as existsSync2 } from "node:fs";
-import { dirname as dirname8, join as join10 } from "node:path";
+import { dirname as dirname8, join as join11 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-var DOCS_SUBPATH = join10("docs", "algolia-sdk");
+var DOCS_SUBPATH = join11("docs", "algolia-sdk");
 function findDocsDir() {
   let dir = dirname8(fileURLToPath2(import.meta.url));
   for (; ; ) {
-    const candidate = join10(dir, DOCS_SUBPATH);
+    const candidate = join11(dir, DOCS_SUBPATH);
     if (existsSync2(candidate)) return candidate;
     const parent = dirname8(dir);
     if (parent === dir) return void 0;
@@ -3834,7 +4009,7 @@ function loadAlgoliaDoc(language) {
     );
     return "";
   }
-  return readFileSync(join10(docsDir, files[0]), "utf8").trim();
+  return readFileSync(join11(docsDir, files[0]), "utf8").trim();
 }
 function getNamedDoc(name, language) {
   const docsDir = findDocsDir();
@@ -3842,7 +4017,7 @@ function getNamedDoc(name, language) {
     logger.warn("docs/algolia-sdk not found");
     return "";
   }
-  const file = join10(docsDir, `${name}-${language}.md`);
+  const file = join11(docsDir, `${name}-${language}.md`);
   if (!existsSync2(file)) {
     logger.warn({ name, language }, "named SDK reference not found");
     return "";
@@ -3869,34 +4044,34 @@ function shellQuote(value) {
 }
 
 // src/actions/implement.ts
-var implementSchema = z26.object({
-  filesChanged: z26.array(z26.string()),
-  summary: z26.string(),
-  worktreePath: z26.string().optional(),
-  ingestCommand: z26.string().optional(),
-  ingestScriptRan: z26.boolean().optional(),
-  ingestRecordCount: z26.number().optional(),
-  ingestDurationMs: z26.number().optional(),
-  ingestionSource: z26.enum(["local", "fileUpload", "generated"]),
-  searchEnvVars: z26.array(
-    z26.object({
-      name: z26.string(),
-      value: z26.string()
+var implementSchema = z27.object({
+  filesChanged: z27.array(z27.string()),
+  summary: z27.string(),
+  worktreePath: z27.string().optional(),
+  ingestCommand: z27.string().optional(),
+  ingestScriptRan: z27.boolean().optional(),
+  ingestRecordCount: z27.number().optional(),
+  ingestDurationMs: z27.number().optional(),
+  ingestionSource: z27.enum(["local", "fileUpload", "generated"]),
+  searchEnvVars: z27.array(
+    z27.object({
+      name: z27.string(),
+      value: z27.string()
     })
   ).optional()
 });
-var implementationOutputSchema = z26.object({
-  summary: z26.string(),
+var implementationOutputSchema = z27.object({
+  summary: z27.string(),
   // Ingestion only: a structured pair the wizard turns into an argv, never a
   // free-form command string. `runtime` is allowlisted and `entrypoint` is
   // validated worktree-relative, so the agent cannot inject extra commands.
-  runtime: z26.enum(INGEST_RUNTIMES).optional(),
-  entrypoint: z26.string().optional()
+  runtime: z27.enum(INGEST_RUNTIMES).optional(),
+  entrypoint: z27.string().optional()
 });
-var verificationOutputSchema = z26.object({
-  summary: z26.string(),
-  sufficient: z26.boolean(),
-  additionalInstructions: z26.string().optional()
+var verificationOutputSchema = z27.object({
+  summary: z27.string(),
+  sufficient: z27.boolean(),
+  additionalInstructions: z27.string().optional()
 });
 var MAX_IMPLEMENT_VERIFICATION_ATTEMPTS = 3;
 var DEFAULT_IMPLEMENT_USE_CASES = ["ingestion", "search"];
@@ -3941,13 +4116,17 @@ function publicEnvPrefix(language) {
 }
 var APP_ID_VAR_SUFFIX = "ALGOLIA_APP_ID";
 var SEARCH_KEY_VAR_SUFFIX = "ALGOLIA_SEARCH_API_KEY";
+var INDEX_VAR_SUFFIX = "ALGOLIA_INDEX_NAME";
 function appIdVar(language) {
   return `${publicEnvPrefix(language)}${APP_ID_VAR_SUFFIX}`;
 }
 function searchKeyVar(language) {
   return `${publicEnvPrefix(language)}${SEARCH_KEY_VAR_SUFFIX}`;
 }
-function searchEnvVars(language, appId, searchKey) {
+function searchIndexVar(language) {
+  return `${publicEnvPrefix(language)}${INDEX_VAR_SUFFIX}`;
+}
+function searchEnvVars(language, index, appId, searchKey) {
   return [
     {
       name: appIdVar(language),
@@ -3956,12 +4135,21 @@ function searchEnvVars(language, appId, searchKey) {
     {
       name: searchKeyVar(language),
       value: searchKey ?? "<your-algolia-search-only-api-key>"
+    },
+    // Wizard-supplied rather than written into the generated code, because an
+    // agent that retypes the name (appending the project name, re-casing it)
+    // leaves the UI querying an index that does not exist.
+    {
+      name: searchIndexVar(language),
+      value: index
     }
   ];
 }
 function baseInstructions(input) {
   return [
-    `Target Algolia index: ${input.targetIndex}`,
+    // Agents have renamed this (e.g. appending the project name), which the
+    // index-scoped keys then reject with a 403.
+    `Target Algolia index, to be used exactly as written \u2014 never renamed, re-cased, prefixed, or suffixed: "${input.targetIndex}"`,
     `Project languages and frameworks: ${JSON.stringify(input.language)}`,
     "Make minimal, idiomatic changes; do not touch unrelated code."
   ];
@@ -3995,6 +4183,7 @@ function ingestionInstructions(input) {
       `Create an ingestion script under "${input.ingestDir}/" at the repo root.`,
       `Ingest only these confirmed entities (name, source paths, attributes): ${JSON.stringify(input.confirmed)}.`,
       `Ingesting writes to Algolia, so the script needs a write API key and App ID \u2014 read them from the ${API_KEY_VAR} and ${APP_ID_VAR} environment variables rather than hardcoding them. The wizard sets these when it runs the script.`,
+      `Read the index name from the ${INDEX_NAME_VAR} environment variable, which the wizard sets to "${input.targetIndex}". Never hardcode an index name or derive one from the project, file, or entity name \u2014 the write key only works for that exact index. Exit with an error if ${INDEX_NAME_VAR} is unset.`,
       "Use the appropriate Algolia package in the ingestion script. Do not use the raw HTTP API.",
       "After a successful ingest, the script must print exactly one line to stdout in the form `ALGOLIA_WIZARD_RECORD_COUNT=<n>`, where <n> is the total number of records pushed to Algolia. Print it last, on its own line, with no surrounding text.",
       getNamedDoc("save-records", "js"),
@@ -4012,7 +4201,8 @@ function searchInstructions(input) {
     `Build the search UI for ${input.uiFramework}.`,
     "Follow the Algolia JS SDK reference below for client setup and InstantSearch wiring; prefer it over prior knowledge:",
     doc,
-    `Add the search UI at ${input.searchLocation ? `"${input.searchLocation}"` : "the best shared, always-rendered layout location (e.g. a header/nav component)"} so it is reachable across the app \u2014 at least a working SearchBox and Hits against the "${input.targetIndex}" index.`,
+    `Add the search UI at ${input.searchLocation ? `"${input.searchLocation}"` : "the best shared, always-rendered layout location (e.g. a header/nav component)"} so it is reachable across the app \u2014 at least a working SearchBox and Hits against the target index.`,
+    `Read the index name from the ${searchIndexVar(input.language)} env var, which the wizard sets to "${input.targetIndex}". Never hardcode an index name or derive one from the project, file, or component name.`,
     // The key is provisioned only after verification passes, so the agent never
     // sees one. It must also leave .env alone: the wizard reads that file to
     // decide whether a key already exists, and an agent-invented value there
@@ -4022,7 +4212,7 @@ function searchInstructions(input) {
     // ".env" right after this step, so a renamed prefix would leave the code
     // reading a var the wizard never wrote.
     `Use exactly these public env var names in the code: ${input.searchEnvVars.map(({ name }) => name).join(", ")}.`,
-    "Read the App ID and a search-only API key from public env vars; never hardcode them. A search-only key is safe to expose client-side.",
+    "Read the App ID, the search-only API key, and the index name from public env vars; never hardcode them. A search-only key is safe to expose client-side.",
     'Add any Algolia/InstantSearch packages you import to package.json "dependencies" with a valid version range; the wizard installs them in the worktree after you finish.',
     "The summary should be extremely concise; do not mention env var setup or manual testing steps \u2014 the wizard writes the resolved credentials to .env and reports that separately."
   ];
@@ -4206,9 +4396,7 @@ async function implement(ctx, useCases = DEFAULT_IMPLEMENT_USE_CASES, existingWo
       targetIndex,
       language,
       appId,
-      // Names only: the search-only key is provisioned after verification, so
-      // every value here is still a placeholder when the agent reads them.
-      searchEnvVars: searchEnvVars(language, appId),
+      searchEnvVars: searchEnvVars(language, targetIndex, appId),
       ingestDir: INGEST_DIR,
       ingestionSource,
       uploadFilePath,
@@ -4295,7 +4483,7 @@ async function implement(ctx, useCases = DEFAULT_IMPLEMENT_USE_CASES, existingWo
         }) === true;
         if (runNow) {
           const ingestApp = await requireApplication();
-          const writeKey = await resolveWriteKey(targetIndex);
+          const writeKey = (await resolveWriteKey(targetIndex, ingestApp.id)).key;
           ctx.notify({ messages: [`Writing records to "${targetIndex}"\u2026`] });
           const scriptLogId = ctx.logStart("runIngestScript", {
             runtime: ingestRuntime,
@@ -4308,7 +4496,8 @@ async function implement(ctx, useCases = DEFAULT_IMPLEMENT_USE_CASES, existingWo
             ingestEntrypoint,
             {
               [APP_ID_VAR]: ingestApp.id,
-              [API_KEY_VAR]: writeKey
+              [API_KEY_VAR]: writeKey,
+              [INDEX_NAME_VAR]: targetIndex
             }
           );
           ctx.logEnd(scriptLogId, run2.ok ? "success" : "error");
@@ -4429,14 +4618,14 @@ ${run2.output}` : status;
       let searchKeyError;
       if (appId) {
         try {
-          const resolved = await resolveSearchOnlyKey(
+          const resolved2 = await resolveSearchOnlyKey(
             targetIndex,
             appId,
             envSearchKey
           );
-          searchKey = resolved.key;
+          searchKey = resolved2.key;
           summaries.push(
-            resolved.source === "created" ? `Created a new search-only Algolia API key for the "${targetIndex}" index in app ${appId} \u2014 safe to expose in frontend code.` : `Reused the existing search-only Algolia API key for the "${targetIndex}" index in app ${appId}.`
+            resolved2.source === "created" ? `Created a new search-only Algolia API key for the "${targetIndex}" index in app ${appId} \u2014 safe to expose in frontend code.` : `Reused the existing search-only Algolia API key for the "${targetIndex}" index in app ${appId}.`
           );
         } catch (err) {
           searchKeyError = err.message;
@@ -4446,7 +4635,12 @@ ${run2.output}` : status;
           );
         }
       }
-      finalSearchEnvVars = searchEnvVars(language, appId, searchKey);
+      finalSearchEnvVars = searchEnvVars(
+        language,
+        targetIndex,
+        appId,
+        searchKey
+      );
       const resolvedSearchEnvVars = finalSearchEnvVars.filter(
         (v) => !v.value.startsWith("<")
       );
@@ -4555,8 +4749,8 @@ var defaultWorkflow = {
     defineStep({
       id: "select-index",
       title: "Set up index",
-      outputSchema: z27.object({
-        selection: z27.string()
+      outputSchema: z28.object({
+        selection: z28.string()
       }),
       run: (ctx) => selectIndexStep(ctx)
     }),
@@ -4798,7 +4992,11 @@ Options:
   --no-telemetry   Send no telemetry or analytics for this run.
   --reset-on-run   Wipe this project's wizard state (run state, AI consent,
                    worktrees) before starting, so the run behaves like a
-                   first-ever run. Algolia credentials are not touched.
+                   first-ever run. Also drops every API key the wizard has
+                   stored in your keychain (or, where the platform has none,
+                   the encrypted file it falls back to \u2014 see CONTRIBUTING.md),
+                   for this project and any other, so later runs create new
+                   ones. Your Algolia login is not touched.
   -h, --help       Print this message.`;
 function parseCliArgs(argv) {
   const positionals = [];
@@ -4835,10 +5033,11 @@ function parseCliArgs(argv) {
 
 // src/lib/resetState.ts
 import { readdir as readdir4, rm as rm2 } from "node:fs/promises";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 var KEEP = ["wizard.log"];
 async function resetProjectState() {
   const dir = stateDir();
+  await forgetResolvedKeys();
   let entries;
   try {
     entries = await readdir4(dir);
@@ -4847,7 +5046,9 @@ async function resetProjectState() {
   }
   const targets = entries.filter((name) => !KEEP.includes(name));
   await Promise.all(
-    targets.map((name) => rm2(join11(dir, name), { recursive: true, force: true }))
+    targets.map(
+      (name) => rm2(join12(dir, name), { recursive: true, force: true })
+    )
   );
   return { dir, removed: targets };
 }
@@ -4855,6 +5056,7 @@ async function resetProjectState() {
 // src/main.tsx
 import { jsx as jsx14 } from "react/jsx-runtime";
 async function startup() {
+  setProjectRoot(process.cwd());
   let args;
   try {
     args = parseCliArgs(process.argv.slice(2));