@algolia/wizard 0.9.0-rc.84.75 → 0.9.0-rc.87.83

package/dist/main.js

@@ -4,7 +4,7 @@
 import { render } from "ink";
 
 // src/ui/App.tsx
-import { Box as Box14, Text as Text14, useApp, useInput as useInput6, useWindowSize as useWindowSize7 } from "ink";
+import { Box as Box16, Text as Text16, useApp, useInput as useInput7, useWindowSize as useWindowSize8 } from "ink";
 
 // src/core/store.ts
 import { create } from "zustand";
@@ -12,32 +12,128 @@ import { nanoid } from "nanoid";
 
 // src/lib/algoliaCli.ts
 import { spawn } from "node:child_process";
-import { createRequire } from "node:module";
-var require2 = createRequire(import.meta.url);
-function algoliaCliEntry() {
-  return require2.resolve("@algolia/cli/bin/run.js");
+import { z } from "zod";
+
+// src/lib/logger.ts
+import pino from "pino";
+import { join as join2, dirname } from "node:path";
+import { devNull } from "node:os";
+import { mkdirSync, openSync, closeSync } from "node:fs";
+
+// src/core/constants.ts
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+function rootDir() {
+  return process.env.WIZARD_HOME ?? join(homedir(), ".algolia");
 }
-function runAlgoliaCli(args) {
+function projectSlug(cwd = process.cwd()) {
+  return resolve(cwd).replace(/[/\\:]+/g, "-").replace(/^-+/, "") || "root";
+}
+function stateDir(cwd = process.cwd()) {
+  return join(rootDir(), projectSlug(cwd));
+}
+
+// src/lib/logger.ts
+var STDERR_FD = 2;
+function resolveDest() {
+  const target = process.env.VITEST ? devNull : process.env.WIZARD_LOG ?? join2(stateDir(), "wizard.log");
+  try {
+    mkdirSync(dirname(target), { recursive: true });
+    closeSync(openSync(target, "a"));
+    return target;
+  } catch {
+    return STDERR_FD;
+  }
+}
+function logDestination() {
+  return pino.destination({ dest: resolveDest(), sync: false });
+}
+var logger = pino(
+  { level: process.env.LOG_LEVEL ?? "info" },
+  logDestination()
+);
+
+// src/lib/algoliaCli.ts
+function npxArgs(args) {
+  return ["--yes", "@algolia/cli@latest", ...args];
+}
+var shell = process.platform === "win32";
+function lineSplitter(emit) {
+  let buffer = "";
+  return {
+    push(chunk) {
+      buffer += chunk;
+      const lines = buffer.split("\n");
+      buffer = lines.pop() ?? "";
+      for (const line of lines) emit(line.replace(/\r$/, ""));
+    },
+    flush() {
+      if (buffer) emit(buffer.replace(/\r$/, ""));
+      buffer = "";
+    }
+  };
+}
+var wizardSink = (stream, line) => {
+  if (!line.trim()) return;
+  useWizard.getState().pushCliOutput(stream, line);
+};
+var stderrSink = (stream, line) => {
+  if (stream === "stdout") return;
+  wizardSink(stream, line);
+};
+function runAlgoliaCli(args, { onOutput } = {}) {
+  const store = useWizard.getState();
+  const logId = store.logStart("tool", `algolia ${args.join(" ")}`);
   return new Promise((resolve4, reject) => {
-    const child = spawn(process.execPath, [algoliaCliEntry(), ...args]);
+    const child = spawn("npx", npxArgs(args), { shell });
     let stdout = "";
     let stderr = "";
-    child.stdout.on("data", (chunk) => stdout += chunk);
-    child.stderr.on("data", (chunk) => stderr += chunk);
+    const splitters = {
+      stdout: lineSplitter((line) => onOutput?.("stdout", line)),
+      stderr: lineSplitter((line) => onOutput?.("stderr", line))
+    };
+    child.stdout.on("data", (chunk) => {
+      const text = String(chunk);
+      stdout += text;
+      splitters.stdout.push(text);
+    });
+    child.stderr.on("data", (chunk) => {
+      const text = String(chunk);
+      stderr += text;
+      splitters.stderr.push(text);
+    });
     child.on("error", reject);
     child.on("close", (code) => {
+      splitters.stdout.flush();
+      splitters.stderr.flush();
       if (code === 0) {
         resolve4(stdout);
       } else {
-        const detail = stderr.trim() || stdout.trim();
+        const failed = stderr.trim();
+        let detail = "";
+        if (failed) {
+          detail = `: ${failed}`;
+        } else if (stdout.trim()) {
+          detail = " (no stderr; stdout withheld \u2014 it may contain credentials)";
+        }
         reject(
           new Error(
-            `Algolia CLI \`${args.join(" ")}\` failed (exit ${code})${detail ? `: ${detail}` : ""}`
+            `Algolia CLI \`${args.join(" ")}\` failed (exit ${code})${detail}`
           )
         );
       }
     });
-  });
+  }).then(
+    (out) => {
+      useWizard.getState().logEnd(logId, "success");
+      return out;
+    },
+    (err) => {
+      useWizard.getState().logEnd(logId, "error");
+      logger.warn({ err, args }, "Algolia CLI command failed");
+      throw err;
+    }
+  );
 }
 async function getUser() {
   let raw;
@@ -52,19 +148,23 @@ async function getUser() {
     return null;
   }
 }
-function runAuthLogin() {
-  return new Promise((resolve4, reject) => {
-    const child = spawn(
-      process.execPath,
-      [algoliaCliEntry(), "auth", "login", "--default"],
-      { stdio: "inherit" }
-    );
-    child.on("error", reject);
-    child.on("close", (code) => {
-      if (code === 0) resolve4();
-      else reject(new Error(`Algolia authentication failed (exit ${code}).`));
-    });
+var loginResultSchema = z.object({
+  success: z.boolean(),
+  email: z.string().optional()
+});
+async function runAuthLogin() {
+  const raw = await runAlgoliaCli(["auth", "login", "--non-interactive"], {
+    onOutput: stderrSink
   });
+  let parsed;
+  try {
+    parsed = loginResultSchema.safeParse(JSON.parse(raw));
+  } catch {
+    parsed = void 0;
+  }
+  if (parsed?.success && !parsed.data.success) {
+    throw new Error("Algolia sign-in did not report success.");
+  }
 }
 
 // src/lib/auth.ts
@@ -88,45 +188,6 @@ function refreshAuthToken() {
   return inFlightRefresh;
 }
 
-// src/lib/logger.ts
-import pino from "pino";
-import { join as join2, dirname } from "node:path";
-import { devNull } from "node:os";
-import { mkdirSync, openSync, closeSync } from "node:fs";
-
-// src/core/constants.ts
-import { homedir } from "node:os";
-import { join, resolve } from "node:path";
-function rootDir() {
-  return process.env.WIZARD_HOME ?? join(homedir(), ".algolia");
-}
-function projectSlug(cwd = process.cwd()) {
-  return resolve(cwd).replace(/[/\\:]+/g, "-").replace(/^-+/, "") || "root";
-}
-function stateDir(cwd = process.cwd()) {
-  return join(rootDir(), projectSlug(cwd));
-}
-
-// src/lib/logger.ts
-var STDERR_FD = 2;
-function resolveDest() {
-  const target = process.env.VITEST ? devNull : process.env.WIZARD_LOG ?? join2(stateDir(), "wizard.log");
-  try {
-    mkdirSync(dirname(target), { recursive: true });
-    closeSync(openSync(target, "a"));
-    return target;
-  } catch {
-    return STDERR_FD;
-  }
-}
-function logDestination() {
-  return pino.destination({ dest: resolveDest(), sync: false });
-}
-var logger = pino(
-  { level: process.env.LOG_LEVEL ?? "info" },
-  logDestination()
-);
-
 // src/lib/proxyFetch.ts
 var PROXY_BASE_URL = process.env.PROXY_BASE_URL ?? "https://proxy-624203421261.us-east4.run.app";
 var PROXY_AUTH_REJECTED_HEADER = "x-wizard-proxy-auth";
@@ -171,6 +232,7 @@ function describeInputValue(value) {
   return Array.isArray(value) ? value.join(", ") : value;
 }
 var NOTICE_INTERVAL_MS = 2e3;
+var CLI_OUTPUT_LIMIT = 200;
 var useWizard = create((set, get) => ({
   phase: "idle",
   homeScreen: "home",
@@ -182,22 +244,21 @@ var useWizard = create((set, get) => ({
   notices: [],
   _noticeQueue: [],
   _noticeTimer: null,
+  cliOutput: [],
+  targetIndex: null,
   logs: [],
   error: null,
   inputReq: null,
   _resolve: null,
-  // Advances past the welcome screen. Only meaningful from 'idle' — once the
-  // workflow is running there's nothing left to confirm.
-  // Reset `homeScreen` so preflight shows Welcome, not the Learn more sub-view.
+  // `endAuth` lands on 'preflight', not 'idle': sign-in happens after the
+  // welcome screen, so going back would gate the run a second time.
+  beginAuth: () => set({ phase: "authenticating", cliOutput: [] }),
+  endAuth: () => set((s) => s.phase === "authenticating" ? { phase: "preflight" } : {}),
   confirmStart: () => set(
     (s) => s.phase === "idle" ? { phase: "preflight", homeScreen: "home" } : {}
   ),
-  // Welcome sub-view navigation; leaves `phase` untouched so the workflow stays paused.
   openLearnMore: () => set({ homeScreen: "learnMore" }),
   backToHome: () => set({ homeScreen: "home" }),
-  // Resolves once the phase leaves 'idle', whether that happens before or
-  // after this is called (the welcome screen's enter handler is what
-  // drives the transition via `confirmStart`).
   waitForStart: () => new Promise((resolve4) => {
     if (get().phase !== "idle") {
       resolve4();
@@ -220,15 +281,19 @@ var useWizard = create((set, get) => ({
   syncSteps: (steps, currentStepIndex) => set({ steps, currentStepIndex }),
   setActiveStep: (index) => {
     get()._clearNoticeQueue();
-    set({ phase: "running", currentStepIndex: index, output: "", notices: [] });
+    set({
+      phase: "running",
+      currentStepIndex: index,
+      output: "",
+      notices: [],
+      cliOutput: []
+    });
   },
   setUser: (user) => set({ user }),
   appendToken: (text) => set((s) => ({ output: s.output + text })),
   clearOutput: () => set({ output: "" }),
-  // Renders the first notice of a burst immediately, then holds later
-  // arrivals in `_noticeQueue` and drains one per `NOTICE_INTERVAL_MS` —
-  // the timer stays armed through an empty drain so the cooldown always
-  // covers the time since the last render, even across bursts.
+  // The timer stays armed through an empty drain, so the spacing covers the
+  // time since the last render even across bursts.
   pushNotice: (notice) => {
     const { notices, _noticeQueue, _noticeTimer } = get();
     if (_noticeTimer === null) {
@@ -261,6 +326,13 @@ var useWizard = create((set, get) => ({
     get()._clearNoticeQueue();
     set({ notices: [] });
   },
+  pushCliOutput: (stream, text) => set((s) => ({
+    cliOutput: [...s.cliOutput, { id: nanoid(), stream, text }].slice(
+      -CLI_OUTPUT_LIMIT
+    )
+  })),
+  clearCliOutput: () => set({ cliOutput: [] }),
+  setTargetIndex: (index) => set({ targetIndex: index }),
   logStart: (kind, name, input) => {
     const id = nanoid();
     set((s) => ({
@@ -283,9 +355,6 @@ var useWizard = create((set, get) => ({
       _resolve: resolve4
     });
   }),
-  // Logs what the user picked — not the prompt text that was shown, which
-  // may repeat or duplicate on-screen content and isn't the useful signal
-  // here.
   submitInput: async (value) => {
     await markInteraction();
     get()._resolve?.(value);
@@ -305,6 +374,8 @@ var useWizard = create((set, get) => ({
       currentStepIndex: 0,
       output: "",
       notices: [],
+      cliOutput: [],
+      targetIndex: null,
       logs: [],
       error: null,
       inputReq: null,
@@ -313,16 +384,100 @@ var useWizard = create((set, get) => ({
   }
 }));
 
+// src/ui/CliOutput.tsx
+import { Box, Text, useWindowSize } from "ink";
+
+// src/ui/theme.ts
+var MARKER = {
+  pending: "\u25CB",
+  running: "\u25D0",
+  done: "\u2713",
+  error: "\u2716"
+};
+var BRAND = "#003DFF";
+var SECONDARY = "#5468FF";
+var DANGER = "#F86E7E";
+var COLORS = {
+  brand: BRAND,
+  primary: "#E6EDF3",
+  secondary: SECONDARY,
+  strong: "#FFFFFF",
+  muted: "#8B949E",
+  dim: "#484F58",
+  highlight: { bg: "#12331C", fg: "#4ADE80" },
+  badge: "#E3B341",
+  danger: DANGER,
+  success: "#4ADE80",
+  bg: {
+    main: "#0B0E14",
+    sidebar: "#14171E"
+  },
+  border: "#30363D",
+  accent: "#76A0FF",
+  status: {
+    pending: "gray",
+    running: "#76A0FF",
+    done: "#4ADE80",
+    error: DANGER
+  }
+};
+
+// src/ui/CliOutput.tsx
+import { jsxs } from "react/jsx-runtime";
+var CLI_MARKER = "\u203A";
+var RESERVED_ROWS = 16;
+var MAX_ROWS = 12;
+var PANEL_TEXT_WIDTH = 45;
+var URL_PATTERN = /https?:\/\//;
+function rowCost(text) {
+  return URL_PATTERN.test(text) ? Math.max(1, Math.ceil(text.length / PANEL_TEXT_WIDTH)) : 1;
+}
+function CliOutput() {
+  const cliOutput = useWizard((s) => s.cliOutput);
+  const { rows } = useWindowSize();
+  if (!cliOutput.length) return null;
+  const rowBudget = Math.min(Math.max(rows - RESERVED_ROWS, 3), MAX_ROWS);
+  const visible = [];
+  let usedRows = 0;
+  for (let i = cliOutput.length - 1; i >= 0; i--) {
+    const cost = rowCost(cliOutput[i].text);
+    if (usedRows + cost > rowBudget && visible.length > 0) break;
+    visible.unshift(cliOutput[i]);
+    usedRows += cost;
+  }
+  const hidden = cliOutput.length - visible.length;
+  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", marginBottom: 1, children: [
+    hidden > 0 && /* @__PURE__ */ jsxs(Text, { color: COLORS.dim, children: [
+      "\u2191 ",
+      hidden,
+      " earlier line(s)"
+    ] }),
+    visible.map((line) => /* @__PURE__ */ jsxs(
+      Text,
+      {
+        color: line.stream === "stderr" ? COLORS.muted : COLORS.dim,
+        wrap: URL_PATTERN.test(line.text) ? "wrap" : "truncate",
+        children: [
+          CLI_MARKER,
+          " ",
+          line.text
+        ]
+      },
+      line.id
+    ))
+  ] });
+}
+
 // src/ui/Notices.tsx
-import { Box as Box2, Text as Text2, useWindowSize as useWindowSize2 } from "ink";
+import { Box as Box3, Text as Text3, useWindowSize as useWindowSize3 } from "ink";
 import { useEffect as useEffect2, useState as useState2 } from "react";
 
 // src/ui/Table.tsx
-import { Box, Text, measureElement, useWindowSize } from "ink";
+import { Box as Box2, Text as Text2, measureElement, useWindowSize as useWindowSize2 } from "ink";
 import { useEffect, useRef, useState } from "react";
 import { jsx } from "react/jsx-runtime";
 function Table({ columns, rows }) {
-  const { columns: termCols } = useWindowSize();
+  const { columns: termCols } = useWindowSize2();
   const ref = useRef(null);
   const [width, setWidth] = useState(0);
   useEffect(() => {
@@ -330,7 +485,7 @@ function Table({ columns, rows }) {
   }, [termCols, columns, rows]);
   if (rows.length === 0) return null;
   const lines = formatTable(columns, rows, width || void 0);
-  return /* @__PURE__ */ jsx(Box, { flexDirection: "column", ref, children: lines.map((line, i) => /* @__PURE__ */ jsx(Text, { wrap: "truncate", children: line }, `tbl-${i}`)) });
+  return /* @__PURE__ */ jsx(Box2, { flexDirection: "column", ref, children: lines.map((line, i) => /* @__PURE__ */ jsx(Text2, { wrap: "truncate", children: line }, `tbl-${i}`)) });
 }
 function formatTable(columns, rows, width) {
   const natural = columns.map(
@@ -370,48 +525,13 @@ function resize(widths, budget) {
 }
 var truncate = (s, width) => s.length <= width ? s : width <= 1 ? s.slice(0, width) : `${s.slice(0, width - 1)}\u2026`;
 
-// src/ui/theme.ts
-var MARKER = {
-  pending: "\u25CB",
-  running: "\u25D0",
-  done: "\u2713",
-  error: "\u2716"
-};
-var BRAND = "#003DFF";
-var SECONDARY = "#5468FF";
-var DANGER = "#F86E7E";
-var COLORS = {
-  brand: BRAND,
-  primary: "#E6EDF3",
-  secondary: SECONDARY,
-  strong: "#FFFFFF",
-  muted: "#8B949E",
-  dim: "#484F58",
-  highlight: { bg: "#12331C", fg: "#4ADE80" },
-  badge: "#E3B341",
-  danger: DANGER,
-  success: "#4ADE80",
-  bg: {
-    main: "#0B0E14",
-    sidebar: "#14171E"
-  },
-  border: "#30363D",
-  accent: "#76A0FF",
-  status: {
-    pending: "gray",
-    running: "#76A0FF",
-    done: "#4ADE80",
-    error: DANGER
-  }
-};
-
 // src/ui/Notices.tsx
-import { jsx as jsx2, jsxs } from "react/jsx-runtime";
+import { jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
 var AGENT_MARKER = "\u2726";
-var RESERVED_ROWS = 14;
-var PANEL_TEXT_WIDTH = 45;
+var RESERVED_ROWS2 = 14;
+var PANEL_TEXT_WIDTH2 = 45;
 function messageLineCount(text) {
-  return Math.max(1, Math.ceil(text.length / PANEL_TEXT_WIDTH));
+  return Math.max(1, Math.ceil(text.length / PANEL_TEXT_WIDTH2));
 }
 function noticeLineCount(notice) {
   const messageLines = (notice.messages ?? []).reduce((sum, m) => {
@@ -422,7 +542,7 @@ function noticeLineCount(notice) {
   return messageLines + tableLines;
 }
 function fitVisibleNotices(notices, windowRows) {
-  const budget = Math.max(windowRows - RESERVED_ROWS, 3);
+  const budget = Math.max(windowRows - RESERVED_ROWS2, 3);
   let used = 0;
   let count = 0;
   for (let i = notices.length - 1; i >= 0; i--) {
@@ -455,7 +575,7 @@ function parseHex(hex) {
 }
 function Notices() {
   const notices = useWizard((s) => s.notices);
-  const { rows: windowRows } = useWindowSize2();
+  const { rows: windowRows } = useWindowSize3();
   const visible = fitVisibleNotices(notices, windowRows);
   const [pulseStep, setPulseStep] = useState2(0);
   useEffect2(() => {
@@ -472,14 +592,14 @@ function Notices() {
   }, []);
   if (!visible.length) return null;
   const pulseColor = PULSE_COLORS[pulseStep];
-  return /* @__PURE__ */ jsx2(Box2, { flexDirection: "column", gap: 1, marginBottom: 1, children: visible.map((notice, i) => {
+  return /* @__PURE__ */ jsx2(Box3, { flexDirection: "column", gap: 1, marginBottom: 1, children: visible.map((notice, i) => {
     const isLatest = i === visible.length - 1;
-    return /* @__PURE__ */ jsxs(Box2, { flexDirection: "column", children: [
+    return /* @__PURE__ */ jsxs2(Box3, { flexDirection: "column", children: [
       notice.messages?.map((m, j) => {
         const line = typeof m === "string" ? { text: m } : m;
         const prefix = j === 0 ? `${AGENT_MARKER} ` : "  ";
-        return /* @__PURE__ */ jsxs(
-          Text2,
+        return /* @__PURE__ */ jsxs2(
+          Text3,
           {
             color: isLatest && !line.color ? pulseColor : line.color ?? COLORS.dim,
             bold: line.bold,
@@ -497,41 +617,99 @@ function Notices() {
 }
 
 // src/ui/PromptInput.tsx
-import { Box as Box6, Text as Text6, useInput as useInput2 } from "ink";
+import { Box as Box8, Text as Text8, useInput as useInput3 } from "ink";
 import TextInput from "ink-text-input";
 import { useState as useState5 } from "react";
 
+// src/ui/CommandApproval.tsx
+import { Box as Box5, Text as Text5, useInput } from "ink";
+
 // src/ui/NextAction.tsx
-import { Box as Box3, Text as Text3 } from "ink";
-import { Fragment, jsx as jsx3, jsxs as jsxs2 } from "react/jsx-runtime";
+import { Box as Box4, Text as Text4 } from "ink";
+import { Fragment, jsx as jsx3, jsxs as jsxs3 } from "react/jsx-runtime";
 function NextAction({
   action,
   keyHint,
   hierarchy = "primary"
 }) {
-  return /* @__PURE__ */ jsxs2(Box3, { flexDirection: "row", gap: 1, children: [
-    hierarchy === "primary" && /* @__PURE__ */ jsx3(Text3, { color: COLORS.success, bold: true, children: `> ${action}` }),
-    hierarchy === "secondary" && /* @__PURE__ */ jsxs2(Fragment, { children: [
-      /* @__PURE__ */ jsx3(Text3, { color: COLORS.success, bold: true, children: `>` }),
-      /* @__PURE__ */ jsx3(Text3, { color: COLORS.primary, bold: true, children: action })
+  return /* @__PURE__ */ jsxs3(Box4, { flexDirection: "row", gap: 1, children: [
+    hierarchy === "primary" && /* @__PURE__ */ jsx3(Text4, { color: COLORS.success, bold: true, children: `> ${action}` }),
+    hierarchy === "secondary" && /* @__PURE__ */ jsxs3(Fragment, { children: [
+      /* @__PURE__ */ jsx3(Text4, { color: COLORS.success, bold: true, children: `>` }),
+      /* @__PURE__ */ jsx3(Text4, { color: COLORS.primary, bold: true, children: action })
     ] }),
-    /* @__PURE__ */ jsxs2(Box3, { children: [
-      /* @__PURE__ */ jsx3(Text3, { color: COLORS.muted, children: "press " }),
-      /* @__PURE__ */ jsx3(Text3, { color: COLORS.muted, children: `[` }),
-      /* @__PURE__ */ jsx3(Text3, { color: COLORS.primary, children: keyHint }),
-      /* @__PURE__ */ jsx3(Text3, { color: COLORS.muted, children: `]` })
+    /* @__PURE__ */ jsxs3(Box4, { children: [
+      /* @__PURE__ */ jsx3(Text4, { color: COLORS.muted, children: "press " }),
+      /* @__PURE__ */ jsx3(Text4, { color: COLORS.muted, children: `[` }),
+      /* @__PURE__ */ jsx3(Text4, { color: COLORS.primary, children: keyHint }),
+      /* @__PURE__ */ jsx3(Text4, { color: COLORS.muted, children: `]` })
+    ] })
+  ] });
+}
+
+// src/ui/CommandApproval.tsx
+import { jsx as jsx4, jsxs as jsxs4 } from "react/jsx-runtime";
+function CommandApproval({
+  command,
+  onDecide
+}) {
+  useInput((input, key) => {
+    if (key.return) onDecide("approve");
+    else if (key.escape) onDecide("reject");
+    else if (input.toLowerCase() === "a") onDecide("always");
+  });
+  return /* @__PURE__ */ jsxs4(Box5, { flexDirection: "column", gap: 1, children: [
+    /* @__PURE__ */ jsx4(Text5, { color: COLORS.primary, bold: true, children: "Run this command?" }),
+    /* @__PURE__ */ jsxs4(
+      Box5,
+      {
+        flexDirection: "column",
+        paddingLeft: 2,
+        borderStyle: "single",
+        borderColor: COLORS.success,
+        borderTop: false,
+        borderBottom: false,
+        borderRight: false,
+        gap: 1,
+        children: [
+          /* @__PURE__ */ jsxs4(Box5, { children: [
+            /* @__PURE__ */ jsx4(Text5, { color: COLORS.muted, children: "$ " }),
+            /* @__PURE__ */ jsx4(Text5, { color: COLORS.strong, wrap: "wrap", children: command.command })
+          ] }),
+          /* @__PURE__ */ jsxs4(Box5, { gap: 1, children: [
+            /* @__PURE__ */ jsx4(Text5, { color: COLORS.muted, children: "in:" }),
+            /* @__PURE__ */ jsx4(Text5, { color: COLORS.muted, wrap: "wrap", children: command.cwd })
+          ] }),
+          command.explanation && /* @__PURE__ */ jsxs4(Box5, { gap: 1, children: [
+            /* @__PURE__ */ jsx4(Text5, { color: COLORS.muted, children: "why:" }),
+            /* @__PURE__ */ jsx4(Text5, { color: COLORS.accent, wrap: "wrap", children: command.explanation })
+          ] })
+        ]
+      }
+    ),
+    /* @__PURE__ */ jsxs4(Box5, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx4(NextAction, { action: "approve", keyHint: "enter" }),
+      /* @__PURE__ */ jsx4(NextAction, { action: "reject", keyHint: "esc", hierarchy: "secondary" }),
+      /* @__PURE__ */ jsx4(
+        NextAction,
+        {
+          action: "approve, and don't ask again for this command",
+          keyHint: "a",
+          hierarchy: "secondary"
+        }
+      )
     ] })
   ] });
 }
 
 // src/ui/SelectPrompt.tsx
-import { Box as Box5, Text as Text5, useInput, useWindowSize as useWindowSize4 } from "ink";
+import { Box as Box7, Text as Text7, useInput as useInput2, useWindowSize as useWindowSize5 } from "ink";
 import { useLayoutEffect as useLayoutEffect2, useRef as useRef3, useState as useState4 } from "react";
 
 // src/ui/ScrollView.tsx
-import { Box as Box4, Text as Text4, measureElement as measureElement2, useWindowSize as useWindowSize3 } from "ink";
+import { Box as Box6, Text as Text6, measureElement as measureElement2, useWindowSize as useWindowSize4 } from "ink";
 import { useCallback, useLayoutEffect, useRef as useRef2, useState as useState3 } from "react";
-import { jsxs as jsxs3 } from "react/jsx-runtime";
+import { jsxs as jsxs5 } from "react/jsx-runtime";
 var INDICATOR_ROWS = 2;
 function fittedWidth(node, columns) {
   let left = 0;
@@ -546,7 +724,7 @@ function useScrollWindow({
   followBottom = false
 }) {
   const viewportRef = useRef2(null);
-  const { columns } = useWindowSize3();
+  const { columns } = useWindowSize4();
   const [size, setSize] = useState3(
     null
   );
@@ -601,14 +779,14 @@ function useScrollWindow({
   };
 }
 function ScrollView({ scroll, children }) {
-  return /* @__PURE__ */ jsxs3(Box4, { ref: scroll.viewportRef, flexDirection: "column", flexGrow: 1, children: [
-    scroll.hiddenAbove > 0 && /* @__PURE__ */ jsxs3(Text4, { color: COLORS.dim, children: [
+  return /* @__PURE__ */ jsxs5(Box6, { ref: scroll.viewportRef, flexDirection: "column", flexGrow: 1, children: [
+    scroll.hiddenAbove > 0 && /* @__PURE__ */ jsxs5(Text6, { color: COLORS.dim, children: [
       "\u2191 ",
       scroll.hiddenAbove,
       " more"
     ] }),
     children,
-    scroll.hiddenBelow > 0 && /* @__PURE__ */ jsxs3(Text4, { color: COLORS.dim, children: [
+    scroll.hiddenBelow > 0 && /* @__PURE__ */ jsxs5(Text6, { color: COLORS.dim, children: [
       "\u2193 ",
       scroll.hiddenBelow,
       " more"
@@ -617,7 +795,7 @@ function ScrollView({ scroll, children }) {
 }
 
 // src/ui/SelectPrompt.tsx
-import { jsx as jsx4, jsxs as jsxs4 } from "react/jsx-runtime";
+import { jsx as jsx5, jsxs as jsxs6 } from "react/jsx-runtime";
 var CANCEL = "cancel";
 var ARROW_WIDTH = 4;
 var COLUMN_GAP = 2;
@@ -648,7 +826,7 @@ function SelectPrompt({
   if (multi) hints.push({ key: "[space]", label: "select" });
   hints.push({ key: "[enter]", label: "confirm" });
   const containerRef = useRef3(null);
-  const { columns } = useWindowSize4();
+  const { columns } = useWindowSize5();
   const [width, setWidth] = useState4(columns);
   useLayoutEffect2(() => {
     if (!containerRef.current) return;
@@ -679,7 +857,7 @@ function SelectPrompt({
     revealIndex(index);
   }, [index, revealIndex]);
   const visible = rows.slice(scroll.offset, scroll.offset + scroll.capacity);
-  useInput((input, key) => {
+  useInput2((input, key) => {
     if (rows.length === 0) return;
     if (key.upArrow || input === "k") {
       setIndex((i) => (i - 1 + rows.length) % rows.length);
@@ -702,56 +880,56 @@ function SelectPrompt({
       }
     }
   });
-  return /* @__PURE__ */ jsx4(Box5, { ref: containerRef, flexGrow: 1, children: /* @__PURE__ */ jsxs4(Box5, { flexDirection: "column", gap: 1, width, children: [
-    /* @__PURE__ */ jsxs4(Box5, { flexDirection: "column", gap: 1, flexShrink: 0, children: [
-      error && /* @__PURE__ */ jsx4(Text5, { color: COLORS.danger, children: error }),
-      messages?.map((m, i) => /* @__PURE__ */ jsx4(Text5, { color: COLORS.muted, children: m }, `msg-${i}`)),
-      table && /* @__PURE__ */ jsx4(Table, { columns: table.columns, rows: table.rows }),
-      /* @__PURE__ */ jsxs4(Box5, { flexDirection: "column", children: [
-        question && /* @__PURE__ */ jsx4(Text5, { color: COLORS.muted, children: question }),
-        helpText && /* @__PURE__ */ jsx4(Text5, { color: COLORS.dim, children: helpText })
+  return /* @__PURE__ */ jsx5(Box7, { ref: containerRef, flexGrow: 1, children: /* @__PURE__ */ jsxs6(Box7, { flexDirection: "column", gap: 1, width, children: [
+    /* @__PURE__ */ jsxs6(Box7, { flexDirection: "column", gap: 1, flexShrink: 0, children: [
+      error && /* @__PURE__ */ jsx5(Text7, { color: COLORS.danger, children: error }),
+      messages?.map((m, i) => /* @__PURE__ */ jsx5(Text7, { color: COLORS.muted, children: m }, `msg-${i}`)),
+      table && /* @__PURE__ */ jsx5(Table, { columns: table.columns, rows: table.rows }),
+      /* @__PURE__ */ jsxs6(Box7, { flexDirection: "column", children: [
+        question && /* @__PURE__ */ jsx5(Text7, { color: COLORS.muted, children: question }),
+        helpText && /* @__PURE__ */ jsx5(Text7, { color: COLORS.dim, children: helpText })
       ] })
     ] }),
-    /* @__PURE__ */ jsx4(ScrollView, { scroll, children: visible.map((option, visibleIndex) => {
+    /* @__PURE__ */ jsx5(ScrollView, { scroll, children: visible.map((option, visibleIndex) => {
       const i = scroll.offset + visibleIndex;
       const highlighted = i === index;
       const isCancel = i === cancelIndex;
       const bullet = multi && !isCancel ? checked.has(i) ? "\u25CF " : "\u25CB " : "";
       const sec = isCancel ? void 0 : secondary?.[i];
       const labelColor = highlighted ? COLORS.highlight.fg : void 0;
-      const label = /* @__PURE__ */ jsxs4(Text5, { color: labelColor, wrap: "truncate", children: [
+      const label = /* @__PURE__ */ jsxs6(Text7, { color: labelColor, wrap: "truncate", children: [
         highlighted ? "\u276F   " : "    ",
         bullet,
         option
       ] });
       const isText = sec?.kind === "text";
-      return /* @__PURE__ */ jsxs4(
-        Box5,
+      return /* @__PURE__ */ jsxs6(
+        Box7,
         {
           width: isText ? "100%" : barWidth,
           paddingX: 1,
           paddingY: 1,
           backgroundColor: highlighted ? COLORS.highlight.bg : void 0,
           children: [
-            /* @__PURE__ */ jsx4(Box5, { width: isText ? labelWidth : barLabelWidth, children: label }),
-            isText && textWidth > 0 && /* @__PURE__ */ jsx4(Box5, { width: textWidth, children: /* @__PURE__ */ jsx4(
-              Text5,
+            /* @__PURE__ */ jsx5(Box7, { width: isText ? labelWidth : barLabelWidth, children: label }),
+            isText && textWidth > 0 && /* @__PURE__ */ jsx5(Box7, { width: textWidth, children: /* @__PURE__ */ jsx5(
+              Text7,
               {
                 wrap: "truncate",
                 color: highlighted ? COLORS.primary : COLORS.muted,
                 children: sec.value
               }
             ) }),
-            sec?.kind === "badge" && /* @__PURE__ */ jsx4(Box5, { width: badgeWidth, justifyContent: "flex-end", children: /* @__PURE__ */ jsx4(Text5, { color: COLORS.badge, wrap: "truncate", children: sec.value }) })
+            sec?.kind === "badge" && /* @__PURE__ */ jsx5(Box7, { width: badgeWidth, justifyContent: "flex-end", children: /* @__PURE__ */ jsx5(Text7, { color: COLORS.badge, wrap: "truncate", children: sec.value }) })
           ]
         },
         `row-${i}`
       );
     }) }),
-    /* @__PURE__ */ jsx4(Box5, { flexShrink: 0, children: /* @__PURE__ */ jsx4(Text5, { children: hints.map(({ key, label }, i) => /* @__PURE__ */ jsxs4(Text5, { children: [
+    /* @__PURE__ */ jsx5(Box7, { flexShrink: 0, children: /* @__PURE__ */ jsx5(Text7, { children: hints.map(({ key, label }, i) => /* @__PURE__ */ jsxs6(Text7, { children: [
       i > 0 ? "   " : "",
-      /* @__PURE__ */ jsx4(Text5, { color: COLORS.primary, children: key }),
-      /* @__PURE__ */ jsxs4(Text5, { color: COLORS.dim, children: [
+      /* @__PURE__ */ jsx5(Text7, { color: COLORS.primary, children: key }),
+      /* @__PURE__ */ jsxs6(Text7, { color: COLORS.dim, children: [
         " ",
         label
       ] })
@@ -760,23 +938,23 @@ function SelectPrompt({
 }
 
 // src/ui/PromptInput.tsx
-import { jsx as jsx5, jsxs as jsxs5 } from "react/jsx-runtime";
+import { jsx as jsx6, jsxs as jsxs7 } from "react/jsx-runtime";
 var ACCEPT_REJECT_OPTIONS = ["Accept", "Reject"];
 function EnterToContinuePrompt({
   question,
   messages,
   onDecide
 }) {
-  useInput2((_input, key) => {
+  useInput3((_input, key) => {
     if (key.return) onDecide(true);
     else if (key.escape) onDecide(false);
   });
-  return /* @__PURE__ */ jsxs5(Box6, { flexDirection: "column", gap: 1, children: [
-    messages?.map((m, i) => /* @__PURE__ */ jsx5(Text6, { color: COLORS.muted, children: m }, `msg-${i}`)),
-    question && /* @__PURE__ */ jsx5(Text6, { color: COLORS.primary, children: question }),
-    /* @__PURE__ */ jsxs5(Box6, { gap: 1, flexDirection: "column", children: [
-      /* @__PURE__ */ jsx5(NextAction, { action: "continue", keyHint: "enter" }),
-      /* @__PURE__ */ jsx5(NextAction, { action: "decline", keyHint: "esc", hierarchy: "secondary" })
+  return /* @__PURE__ */ jsxs7(Box8, { flexDirection: "column", gap: 1, children: [
+    messages?.map((m, i) => /* @__PURE__ */ jsx6(Text8, { color: COLORS.muted, children: m }, `msg-${i}`)),
+    question && /* @__PURE__ */ jsx6(Text8, { color: COLORS.primary, children: question }),
+    /* @__PURE__ */ jsxs7(Box8, { gap: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsx6(NextAction, { action: "continue", keyHint: "enter" }),
+      /* @__PURE__ */ jsx6(NextAction, { action: "decline", keyHint: "esc", hierarchy: "secondary" })
     ] })
   ] });
 }
@@ -784,11 +962,11 @@ function PromptInput() {
   const { phase, inputReq, submitInput } = useWizard();
   const [draft, setDraft] = useState5("");
   if (phase === "done" || phase === "error") {
-    return /* @__PURE__ */ jsx5(Box6, { marginTop: 1, children: /* @__PURE__ */ jsx5(Text6, { color: "gray", dimColor: true, children: "Press Enter or Esc to exit" }) });
+    return /* @__PURE__ */ jsx6(Box8, { marginTop: 1, children: /* @__PURE__ */ jsx6(Text8, { color: "gray", dimColor: true, children: "Press Enter or Esc to exit" }) });
   }
   if (phase !== "awaitingInput" || !inputReq) return null;
   if (inputReq.promptType === "multipleChoice") {
-    return /* @__PURE__ */ jsx5(Box6, { flexGrow: 1, children: /* @__PURE__ */ jsx5(
+    return /* @__PURE__ */ jsx6(Box8, { flexGrow: 1, children: /* @__PURE__ */ jsx6(
       SelectPrompt,
       {
         question: inputReq.prompt,
@@ -805,7 +983,7 @@ function PromptInput() {
     ) });
   }
   if (inputReq.promptType === "multiSelect") {
-    return /* @__PURE__ */ jsx5(Box6, { flexGrow: 1, children: /* @__PURE__ */ jsx5(
+    return /* @__PURE__ */ jsx6(Box8, { flexGrow: 1, children: /* @__PURE__ */ jsx6(
       SelectPrompt,
       {
         multi: true,
@@ -820,7 +998,7 @@ function PromptInput() {
     ) });
   }
   if (inputReq.promptType === "notice") {
-    return /* @__PURE__ */ jsx5(Box6, { flexGrow: 1, children: /* @__PURE__ */ jsx5(
+    return /* @__PURE__ */ jsx6(Box8, { flexGrow: 1, children: /* @__PURE__ */ jsx6(
       SelectPrompt,
       {
         question: inputReq.prompt,
@@ -831,7 +1009,7 @@ function PromptInput() {
     ) });
   }
   if (inputReq.promptType === "enterToContinue") {
-    return /* @__PURE__ */ jsx5(
+    return /* @__PURE__ */ jsx6(
       EnterToContinuePrompt,
       {
         question: inputReq.prompt,
@@ -840,9 +1018,12 @@ function PromptInput() {
       }
     );
   }
+  if (inputReq.promptType === "commandApproval" && inputReq.command) {
+    return /* @__PURE__ */ jsx6(CommandApproval, { command: inputReq.command, onDecide: submitInput });
+  }
   if (inputReq.promptType === "acceptReject") {
     const labels = inputReq.options?.length ? inputReq.options : ACCEPT_REJECT_OPTIONS;
-    return /* @__PURE__ */ jsx5(Box6, { flexGrow: 1, children: /* @__PURE__ */ jsx5(
+    return /* @__PURE__ */ jsx6(Box8, { flexGrow: 1, children: /* @__PURE__ */ jsx6(
       SelectPrompt,
       {
         question: inputReq.prompt,
@@ -853,15 +1034,15 @@ function PromptInput() {
       }
     ) });
   }
-  return /* @__PURE__ */ jsxs5(Box6, { flexDirection: "column", children: [
-    inputReq.error && /* @__PURE__ */ jsx5(Text6, { color: COLORS.danger, children: inputReq.error }),
-    inputReq.messages?.map((m, i) => /* @__PURE__ */ jsx5(Text6, { color: COLORS.muted, children: m }, `msg-${i}`)),
-    /* @__PURE__ */ jsxs5(Box6, { children: [
-      /* @__PURE__ */ jsxs5(Text6, { color: COLORS.primary, children: [
+  return /* @__PURE__ */ jsxs7(Box8, { flexDirection: "column", children: [
+    inputReq.error && /* @__PURE__ */ jsx6(Text8, { color: COLORS.danger, children: inputReq.error }),
+    inputReq.messages?.map((m, i) => /* @__PURE__ */ jsx6(Text8, { color: COLORS.muted, children: m }, `msg-${i}`)),
+    /* @__PURE__ */ jsxs7(Box8, { children: [
+      /* @__PURE__ */ jsxs7(Text8, { color: COLORS.primary, children: [
         inputReq.prompt,
         " "
       ] }),
-      /* @__PURE__ */ jsx5(
+      /* @__PURE__ */ jsx6(
         TextInput,
         {
           value: draft,
@@ -879,7 +1060,7 @@ function PromptInput() {
 // src/ui/Welcome.tsx
 import { dirname as dirname2, join as join3 } from "node:path";
 import { fileURLToPath } from "node:url";
-import { Box as Box7, Spacer, Text as Text7, useInput as useInput3, useWindowSize as useWindowSize5 } from "ink";
+import { Box as Box9, Spacer, Text as Text9, useInput as useInput4, useWindowSize as useWindowSize6 } from "ink";
 
 // src/ui/copy/welcome.ts
 var sidebarItems = [
@@ -892,12 +1073,12 @@ var sidebarItems = [
     description: "push 100 records to Algolia in seconds"
   },
   {
-    title: "detect your framework",
-    description: "React, Vue, Angular, Vanilla JS"
+    title: "detect your stack",
+    description: "whatever language and framework you already use"
   },
   {
     title: "scaffold a search UI",
-    description: "a styled InstantSearch component, wired into your app"
+    description: "a search box and results, wired into your app"
   },
   {
     title: "ship it",
@@ -907,28 +1088,28 @@ var sidebarItems = [
 
 // src/ui/Welcome.tsx
 import Image, { InkPictureProvider } from "ink-picture";
-import { jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
+import { jsx as jsx7, jsxs as jsxs8 } from "react/jsx-runtime";
 var IMAGE_PATH = join3(dirname2(fileURLToPath(import.meta.url)), "algolia.png");
 function SidebarItem({
   title,
   description
 }) {
-  return /* @__PURE__ */ jsxs6(Box7, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsxs6(Box7, { gap: 1, children: [
-      /* @__PURE__ */ jsx6(Text7, { color: COLORS.success, children: "\u2192" }),
-      /* @__PURE__ */ jsx6(Text7, { color: COLORS.strong, bold: true, children: title })
+  return /* @__PURE__ */ jsxs8(Box9, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsxs8(Box9, { gap: 1, children: [
+      /* @__PURE__ */ jsx7(Text9, { color: COLORS.success, children: "\u2192" }),
+      /* @__PURE__ */ jsx7(Text9, { color: COLORS.strong, bold: true, children: title })
     ] }),
-    /* @__PURE__ */ jsxs6(Box7, { flexDirection: "row", gap: 2, children: [
-      /* @__PURE__ */ jsx6(Spacer, {}),
-      /* @__PURE__ */ jsx6(Text7, { color: COLORS.muted, children: description })
+    /* @__PURE__ */ jsxs8(Box9, { flexDirection: "row", gap: 2, children: [
+      /* @__PURE__ */ jsx7(Spacer, {}),
+      /* @__PURE__ */ jsx7(Text9, { color: COLORS.muted, children: description })
     ] })
   ] });
 }
 function Welcome() {
   const confirmStart = useWizard((s) => s.confirmStart);
   const openLearnMore = useWizard((s) => s.openLearnMore);
-  const { rows } = useWindowSize5();
-  useInput3((input, key) => {
+  const { rows } = useWindowSize6();
+  useInput4((input, key) => {
     if (key.return) confirmStart();
     else if (input === "i") openLearnMore();
   });
@@ -946,16 +1127,16 @@ function Welcome() {
   if (rows < 30) {
     layout = scales["small"];
   }
-  return /* @__PURE__ */ jsxs6(Box7, { flexDirection: "row", justifyContent: "space-between", width: "100%", children: [
-    /* @__PURE__ */ jsx6(
-      Box7,
+  return /* @__PURE__ */ jsxs8(Box9, { flexDirection: "row", justifyContent: "space-between", width: "100%", children: [
+    /* @__PURE__ */ jsx7(
+      Box9,
       {
         paddingY: layout.main.padding.y,
         paddingX: layout.main.padding.x,
         flexDirection: "column",
         justifyContent: "center",
-        children: /* @__PURE__ */ jsxs6(Box7, { flexDirection: "column", gap: 2, children: [
-          /* @__PURE__ */ jsx6(InkPictureProvider, { children: /* @__PURE__ */ jsx6(
+        children: /* @__PURE__ */ jsxs8(Box9, { flexDirection: "column", gap: 2, children: [
+          /* @__PURE__ */ jsx7(InkPictureProvider, { children: /* @__PURE__ */ jsx7(
             Image,
             {
               src: IMAGE_PATH,
@@ -966,16 +1147,16 @@ function Welcome() {
               protocol: "halfBlock"
             }
           ) }),
-          /* @__PURE__ */ jsx6(Text7, { color: COLORS.muted, children: "\u2726 From zero \u2192 working search in ~10 minutes" }),
-          /* @__PURE__ */ jsxs6(Box7, { gap: 1, flexDirection: "column", children: [
-            /* @__PURE__ */ jsx6(NextAction, { action: "start wizard", keyHint: "enter" }),
-            /* @__PURE__ */ jsx6(NextAction, { action: "learn more", keyHint: "i", hierarchy: "secondary" })
+          /* @__PURE__ */ jsx7(Text9, { color: COLORS.muted, children: "\u2726 From zero \u2192 working search in ~10 minutes" }),
+          /* @__PURE__ */ jsxs8(Box9, { gap: 1, flexDirection: "column", children: [
+            /* @__PURE__ */ jsx7(NextAction, { action: "start wizard", keyHint: "enter" }),
+            /* @__PURE__ */ jsx7(NextAction, { action: "learn more", keyHint: "i", hierarchy: "secondary" })
           ] })
         ] })
       }
     ),
-    /* @__PURE__ */ jsxs6(
-      Box7,
+    /* @__PURE__ */ jsxs8(
+      Box9,
       {
         backgroundColor: COLORS.bg.sidebar,
         width: 40,
@@ -985,8 +1166,8 @@ function Welcome() {
         flexDirection: "column",
         justifyContent: "center",
         children: [
-          /* @__PURE__ */ jsx6(Text7, { color: COLORS.muted, children: "WHAT THIS WIZARD WILL DO" }),
-          sidebarItems.map((i, idx) => /* @__PURE__ */ jsx6(SidebarItem, { title: i.title, description: i.description }, idx))
+          /* @__PURE__ */ jsx7(Text9, { color: COLORS.muted, children: "WHAT THIS WIZARD WILL DO" }),
+          sidebarItems.map((i, idx) => /* @__PURE__ */ jsx7(SidebarItem, { title: i.title, description: i.description }, idx))
         ]
       }
     )
@@ -995,7 +1176,7 @@ function Welcome() {
 
 // src/ui/LearnMore.tsx
 import { Fragment as Fragment2 } from "react";
-import { Box as Box8, Text as Text8, useInput as useInput4, useWindowSize as useWindowSize6 } from "ink";
+import { Box as Box10, Text as Text10, useInput as useInput5, useWindowSize as useWindowSize7 } from "ink";
 
 // src/ui/copy/learn-more.ts
 var accessIntro = "Everything runs locally on your machine. Nothing is written or sent without an explicit yes from you.";
@@ -1003,12 +1184,17 @@ var accessItems = [
   {
     tag: "READ",
     title: "Project files",
-    description: "reads package.json, configs & source to detect your stack. Read-only; nothing is uploaded."
+    description: "reads manifests, configs & source to detect your stack. Read-only; nothing is uploaded."
   },
   {
     tag: "WRITE",
     title: "Code changes",
-    description: "creates & edits files (search UI, config). Shown as a diff first \u2014 nothing lands without your approval."
+    description: "creates & edits files (search UI, config) in a throwaway git worktree \u2014 your checkout is never touched."
+  },
+  {
+    tag: "EXEC",
+    title: "Setup commands",
+    description: "runs dependency installs, the ingestion script & your own checks. Every command is shown in full and needs your OK; its output is shown as-is, so a command that prints a secret will display it."
   },
   {
     tag: "NET",
@@ -1018,13 +1204,13 @@ var accessItems = [
   {
     tag: "KEY",
     title: "Credentials",
-    description: "saves your Admin API key to .env and adds it to .gitignore."
+    description: "writes your Algolia app id and a search-only key (safe to expose) to .env in the worktree."
   }
 ];
 var neverItems = [
   "Send your source code to a model or third party",
   "Commit or push to git",
-  "Touch files outside your project directory"
+  "Run a command you haven't approved"
 ];
 var policyLinks = [
   { label: "Terms", url: "https://www.algolia.com/policies/terms" },
@@ -1032,10 +1218,11 @@ var policyLinks = [
 ];
 
 // src/ui/LearnMore.tsx
-import { jsx as jsx7, jsxs as jsxs7 } from "react/jsx-runtime";
+import { jsx as jsx8, jsxs as jsxs9 } from "react/jsx-runtime";
 var TAG_COLORS = {
   READ: COLORS.success,
   WRITE: COLORS.badge,
+  EXEC: COLORS.danger,
   NET: COLORS.accent,
   KEY: COLORS.muted
 };
@@ -1048,25 +1235,25 @@ function NeverLine({
 }) {
   const used = segments.reduce((n, s) => n + s.text.length, 0);
   const rightPad = Math.max(0, width - 2 - NEVER_BOX_PAD_X - used);
-  return /* @__PURE__ */ jsxs7(Text8, { children: [
-    /* @__PURE__ */ jsx7(Text8, { color: COLORS.danger, children: "\u2502" }),
+  return /* @__PURE__ */ jsxs9(Text10, { children: [
+    /* @__PURE__ */ jsx8(Text10, { color: COLORS.danger, children: "\u2502" }),
     " ".repeat(NEVER_BOX_PAD_X),
-    segments.map((s, i) => /* @__PURE__ */ jsx7(Text8, { color: s.color, bold: s.bold, children: s.text }, i)),
+    segments.map((s, i) => /* @__PURE__ */ jsx8(Text10, { color: s.color, bold: s.bold, children: s.text }, i)),
     " ".repeat(rightPad),
-    /* @__PURE__ */ jsx7(Text8, { color: COLORS.danger, children: "\u2502" })
+    /* @__PURE__ */ jsx8(Text10, { color: COLORS.danger, children: "\u2502" })
   ] });
 }
 function LearnMore() {
   const confirmStart = useWizard((s) => s.confirmStart);
   const backToHome = useWizard((s) => s.backToHome);
-  const { columns } = useWindowSize6();
+  const { columns } = useWindowSize7();
   const dividerWidth = Math.max(0, columns - PADDING_X * 2);
-  useInput4((_input, key) => {
+  useInput5((_input, key) => {
     if (key.escape) backToHome();
     else if (key.return) confirmStart();
   });
-  return /* @__PURE__ */ jsxs7(
-    Box8,
+  return /* @__PURE__ */ jsxs9(
+    Box10,
     {
       flexDirection: "column",
       paddingX: PADDING_X,
@@ -1074,31 +1261,31 @@ function LearnMore() {
       width: "100%",
       gap: 1,
       children: [
-        /* @__PURE__ */ jsx7(Text8, { color: COLORS.strong, bold: true, children: "What algolia wizard accesses" }),
-        /* @__PURE__ */ jsx7(Text8, { color: COLORS.muted, children: accessIntro }),
-        /* @__PURE__ */ jsx7(Box8, { flexDirection: "column", children: accessItems.map((item) => /* @__PURE__ */ jsxs7(Box8, { flexDirection: "column", marginTop: 1, children: [
-          /* @__PURE__ */ jsx7(Text8, { color: COLORS.border, children: "\u2500".repeat(dividerWidth) }),
-          /* @__PURE__ */ jsxs7(Box8, { flexDirection: "row", gap: 1, marginTop: 1, children: [
-            /* @__PURE__ */ jsx7(Box8, { width: TAG_COLUMN_WIDTH, flexShrink: 0, children: /* @__PURE__ */ jsx7(Text8, { color: TAG_COLORS[item.tag], bold: true, children: `[${item.tag}]` }) }),
-            /* @__PURE__ */ jsx7(Box8, { flexDirection: "column", children: /* @__PURE__ */ jsxs7(Text8, { children: [
-              /* @__PURE__ */ jsx7(Text8, { color: COLORS.strong, bold: true, children: item.title }),
-              /* @__PURE__ */ jsx7(Text8, { color: COLORS.muted, children: ` \u2014 ${item.description}` })
+        /* @__PURE__ */ jsx8(Text10, { color: COLORS.strong, bold: true, children: "What algolia wizard accesses" }),
+        /* @__PURE__ */ jsx8(Text10, { color: COLORS.muted, children: accessIntro }),
+        /* @__PURE__ */ jsx8(Box10, { flexDirection: "column", children: accessItems.map((item) => /* @__PURE__ */ jsxs9(Box10, { flexDirection: "column", marginTop: 1, children: [
+          /* @__PURE__ */ jsx8(Text10, { color: COLORS.border, children: "\u2500".repeat(dividerWidth) }),
+          /* @__PURE__ */ jsxs9(Box10, { flexDirection: "row", gap: 1, marginTop: 1, children: [
+            /* @__PURE__ */ jsx8(Box10, { width: TAG_COLUMN_WIDTH, flexShrink: 0, children: /* @__PURE__ */ jsx8(Text10, { color: TAG_COLORS[item.tag], bold: true, children: `[${item.tag}]` }) }),
+            /* @__PURE__ */ jsx8(Box10, { flexDirection: "column", children: /* @__PURE__ */ jsxs9(Text10, { children: [
+              /* @__PURE__ */ jsx8(Text10, { color: COLORS.strong, bold: true, children: item.title }),
+              /* @__PURE__ */ jsx8(Text10, { color: COLORS.muted, children: ` \u2014 ${item.description}` })
             ] }) })
           ] })
         ] }, item.tag)) }),
-        /* @__PURE__ */ jsxs7(Box8, { marginTop: 1, flexDirection: "column", children: [
-          /* @__PURE__ */ jsx7(Text8, { color: COLORS.danger, children: `\u256D${"\u2500".repeat(Math.max(0, dividerWidth - 2))}\u256E` }),
-          /* @__PURE__ */ jsx7(NeverLine, { width: dividerWidth }),
-          /* @__PURE__ */ jsx7(
+        /* @__PURE__ */ jsxs9(Box10, { marginTop: 1, flexDirection: "column", children: [
+          /* @__PURE__ */ jsx8(Text10, { color: COLORS.danger, children: `\u256D${"\u2500".repeat(Math.max(0, dividerWidth - 2))}\u256E` }),
+          /* @__PURE__ */ jsx8(NeverLine, { width: dividerWidth }),
+          /* @__PURE__ */ jsx8(
             NeverLine,
             {
               width: dividerWidth,
               segments: [{ text: "I NEVER", color: COLORS.danger, bold: true }]
             }
           ),
-          neverItems.map((item) => /* @__PURE__ */ jsxs7(Fragment2, { children: [
-            /* @__PURE__ */ jsx7(NeverLine, { width: dividerWidth }),
-            /* @__PURE__ */ jsx7(
+          neverItems.map((item) => /* @__PURE__ */ jsxs9(Fragment2, { children: [
+            /* @__PURE__ */ jsx8(NeverLine, { width: dividerWidth }),
+            /* @__PURE__ */ jsx8(
               NeverLine,
               {
                 width: dividerWidth,
@@ -1110,24 +1297,24 @@ function LearnMore() {
               }
             )
           ] }, item)),
-          /* @__PURE__ */ jsx7(NeverLine, { width: dividerWidth }),
-          /* @__PURE__ */ jsx7(Text8, { color: COLORS.danger, children: `\u2570${"\u2500".repeat(Math.max(0, dividerWidth - 2))}\u256F` })
+          /* @__PURE__ */ jsx8(NeverLine, { width: dividerWidth }),
+          /* @__PURE__ */ jsx8(Text10, { color: COLORS.danger, children: `\u2570${"\u2500".repeat(Math.max(0, dividerWidth - 2))}\u256F` })
         ] }),
-        /* @__PURE__ */ jsx7(Box8, { marginTop: 1, flexDirection: "column", children: policyLinks.map((link) => /* @__PURE__ */ jsxs7(Box8, { flexDirection: "row", gap: 1, children: [
-          /* @__PURE__ */ jsx7(Text8, { color: COLORS.strong, bold: true, children: `${link.label}:` }),
-          /* @__PURE__ */ jsx7(Text8, { color: COLORS.accent, children: link.url })
+        /* @__PURE__ */ jsx8(Box10, { marginTop: 1, flexDirection: "column", children: policyLinks.map((link) => /* @__PURE__ */ jsxs9(Box10, { flexDirection: "row", gap: 1, children: [
+          /* @__PURE__ */ jsx8(Text10, { color: COLORS.strong, bold: true, children: `${link.label}:` }),
+          /* @__PURE__ */ jsx8(Text10, { color: COLORS.accent, children: link.url })
         ] }, link.label)) }),
-        /* @__PURE__ */ jsxs7(Box8, { marginTop: 1, flexDirection: "row", gap: 3, children: [
-          /* @__PURE__ */ jsxs7(Box8, { flexDirection: "row", gap: 1, children: [
-            /* @__PURE__ */ jsx7(Text8, { color: COLORS.muted, children: "[" }),
-            /* @__PURE__ */ jsx7(Text8, { color: COLORS.primary, children: "esc" }),
-            /* @__PURE__ */ jsx7(Text8, { color: COLORS.muted, children: "] back" })
+        /* @__PURE__ */ jsxs9(Box10, { marginTop: 1, flexDirection: "row", gap: 3, children: [
+          /* @__PURE__ */ jsxs9(Box10, { flexDirection: "row", gap: 1, children: [
+            /* @__PURE__ */ jsx8(Text10, { color: COLORS.muted, children: "[" }),
+            /* @__PURE__ */ jsx8(Text10, { color: COLORS.primary, children: "esc" }),
+            /* @__PURE__ */ jsx8(Text10, { color: COLORS.muted, children: "] back" })
           ] }),
-          /* @__PURE__ */ jsxs7(Box8, { flexDirection: "row", gap: 1, children: [
-            /* @__PURE__ */ jsx7(Text8, { color: COLORS.muted, children: "[" }),
-            /* @__PURE__ */ jsx7(Text8, { color: COLORS.primary, children: "enter" }),
-            /* @__PURE__ */ jsx7(Text8, { color: COLORS.muted, children: "]" }),
-            /* @__PURE__ */ jsx7(Text8, { color: COLORS.success, bold: true, children: "start wizard" })
+          /* @__PURE__ */ jsxs9(Box10, { flexDirection: "row", gap: 1, children: [
+            /* @__PURE__ */ jsx8(Text10, { color: COLORS.muted, children: "[" }),
+            /* @__PURE__ */ jsx8(Text10, { color: COLORS.primary, children: "enter" }),
+            /* @__PURE__ */ jsx8(Text10, { color: COLORS.muted, children: "]" }),
+            /* @__PURE__ */ jsx8(Text10, { color: COLORS.success, bold: true, children: "start wizard" })
           ] })
         ] })
       ]
@@ -1136,10 +1323,10 @@ function LearnMore() {
 }
 
 // src/ui/Sidebar.tsx
-import { Box as Box11, Text as Text11 } from "ink";
+import { Box as Box13, Text as Text13 } from "ink";
 
 // src/ui/Steps.tsx
-import { Box as Box9, Text as Text9 } from "ink";
+import { Box as Box11, Text as Text11 } from "ink";
 import Spinner from "ink-spinner";
 
 // src/core/persistence.ts
@@ -1168,12 +1355,12 @@ async function clearWorkflowState(workflowId) {
 }
 
 // src/ui/Steps.tsx
-import { jsx as jsx8, jsxs as jsxs8 } from "react/jsx-runtime";
+import { jsx as jsx9, jsxs as jsxs10 } from "react/jsx-runtime";
 function Steps() {
   const { steps } = useWizard();
   const visibleSteps = steps.filter(isStepVisible);
-  return /* @__PURE__ */ jsx8(Box9, { flexDirection: "column", gap: 1, children: visibleSteps.map((s) => /* @__PURE__ */ jsx8(Box9, { flexDirection: "column", children: /* @__PURE__ */ jsxs8(Text9, { color: COLORS.status[s.status], children: [
-    s.status === "running" ? /* @__PURE__ */ jsx8(Spinner, { type: "dots" }) : MARKER[s.status],
+  return /* @__PURE__ */ jsx9(Box11, { flexDirection: "column", gap: 1, children: visibleSteps.map((s) => /* @__PURE__ */ jsx9(Box11, { flexDirection: "column", children: /* @__PURE__ */ jsxs10(Text11, { color: COLORS.status[s.status], children: [
+    s.status === "running" ? /* @__PURE__ */ jsx9(Spinner, { type: "dots" }) : MARKER[s.status],
     " ",
     s.title
   ] }) }, s.id)) });
@@ -1182,27 +1369,27 @@ function CurrentStep() {
   const { steps } = useWizard();
   const currentStep = steps.filter(isStepVisible).find((s) => s.status === "running");
   if (!currentStep) return null;
-  return /* @__PURE__ */ jsxs8(Text9, { color: COLORS.status.running, children: [
-    /* @__PURE__ */ jsx8(Spinner, { type: "dots" }),
+  return /* @__PURE__ */ jsxs10(Text11, { color: COLORS.status.running, children: [
+    /* @__PURE__ */ jsx9(Spinner, { type: "dots" }),
     " ",
     ` ${currentStep.title}`
   ] });
 }
 
 // src/ui/Progress.tsx
-import { Box as Box10, Text as Text10 } from "ink";
-import { jsx as jsx9, jsxs as jsxs9 } from "react/jsx-runtime";
+import { Box as Box12, Text as Text12 } from "ink";
+import { jsx as jsx10, jsxs as jsxs11 } from "react/jsx-runtime";
 function Progress() {
   const { steps, currentStepIndex } = useWizard();
   const visibleSteps = steps.filter(isStepVisible);
   if (visibleSteps.length === 0) return null;
   const visibleCountThroughCurrent = steps.slice(0, currentStepIndex + 1).filter(isStepVisible).length;
   const activeStepNumber = Math.max(1, visibleCountThroughCurrent);
-  return /* @__PURE__ */ jsxs9(Box10, { flexDirection: "row", gap: 1, children: [
-    /* @__PURE__ */ jsx9(Text10, { color: COLORS.muted, children: "STEP" }),
-    /* @__PURE__ */ jsx9(Text10, { bold: true, children: activeStepNumber }),
-    /* @__PURE__ */ jsx9(Text10, { bold: true, children: "/" }),
-    /* @__PURE__ */ jsx9(Text10, { bold: true, children: visibleSteps.length })
+  return /* @__PURE__ */ jsxs11(Box12, { flexDirection: "row", gap: 1, children: [
+    /* @__PURE__ */ jsx10(Text12, { color: COLORS.muted, children: "STEP" }),
+    /* @__PURE__ */ jsx10(Text12, { bold: true, children: activeStepNumber }),
+    /* @__PURE__ */ jsx10(Text12, { bold: true, children: "/" }),
+    /* @__PURE__ */ jsx10(Text12, { bold: true, children: visibleSteps.length })
   ] });
 }
 
@@ -1213,10 +1400,10 @@ var sidebarCommands = [
 ];
 
 // src/ui/Sidebar.tsx
-import { jsx as jsx10, jsxs as jsxs10 } from "react/jsx-runtime";
+import { jsx as jsx11, jsxs as jsxs12 } from "react/jsx-runtime";
 function Sidebar() {
-  return /* @__PURE__ */ jsxs10(
-    Box11,
+  return /* @__PURE__ */ jsxs12(
+    Box13,
     {
       backgroundColor: "#14171E",
       width: 30,
@@ -1225,16 +1412,16 @@ function Sidebar() {
       flexDirection: "column",
       justifyContent: "space-between",
       children: [
-        /* @__PURE__ */ jsxs10(Box11, { flexDirection: "column", gap: 1, children: [
-          /* @__PURE__ */ jsx10(Text11, { color: COLORS.muted, children: "PROGRESS" }),
-          /* @__PURE__ */ jsx10(Steps, {})
+        /* @__PURE__ */ jsxs12(Box13, { flexDirection: "column", gap: 1, children: [
+          /* @__PURE__ */ jsx11(Text13, { color: COLORS.muted, children: "PROGRESS" }),
+          /* @__PURE__ */ jsx11(Steps, {})
         ] }),
-        /* @__PURE__ */ jsxs10(Box11, { flexDirection: "column", gap: 1, children: [
-          /* @__PURE__ */ jsx10(Progress, {}),
-          /* @__PURE__ */ jsx10(Box11, { flexDirection: "column", children: sidebarCommands.map((c) => {
-            return /* @__PURE__ */ jsxs10(Box11, { flexDirection: "row", gap: 1, children: [
-              /* @__PURE__ */ jsx10(Text11, { color: COLORS.primary, children: `[${c.keyHint}]` }),
-              /* @__PURE__ */ jsx10(Text11, { color: COLORS.muted, children: c.description })
+        /* @__PURE__ */ jsxs12(Box13, { flexDirection: "column", gap: 1, children: [
+          /* @__PURE__ */ jsx11(Progress, {}),
+          /* @__PURE__ */ jsx11(Box13, { flexDirection: "column", children: sidebarCommands.map((c) => {
+            return /* @__PURE__ */ jsxs12(Box13, { flexDirection: "row", gap: 1, children: [
+              /* @__PURE__ */ jsx11(Text13, { color: COLORS.primary, children: `[${c.keyHint}]` }),
+              /* @__PURE__ */ jsx11(Text13, { color: COLORS.muted, children: c.description })
             ] });
           }) })
         ] })
@@ -1244,12 +1431,12 @@ function Sidebar() {
 }
 
 // src/ui/Ribbon.tsx
-import { Box as Box12, Text as Text12 } from "ink";
-import { jsx as jsx11, jsxs as jsxs11 } from "react/jsx-runtime";
+import { Box as Box14, Text as Text14 } from "ink";
+import { jsx as jsx12, jsxs as jsxs13 } from "react/jsx-runtime";
 function Ribbon() {
   const firstCommand = sidebarCommands[0];
-  return /* @__PURE__ */ jsxs11(
-    Box12,
+  return /* @__PURE__ */ jsxs13(
+    Box14,
     {
       backgroundColor: "#14171E",
       flexDirection: "row",
@@ -1257,11 +1444,11 @@ function Ribbon() {
       paddingX: 2,
       paddingY: 1,
       children: [
-        /* @__PURE__ */ jsx11(Progress, {}),
-        /* @__PURE__ */ jsx11(CurrentStep, {}),
-        /* @__PURE__ */ jsxs11(Box12, { flexDirection: "row", gap: 1, children: [
-          /* @__PURE__ */ jsx11(Text12, { color: COLORS.primary, children: `[${firstCommand.keyHint}]` }),
-          /* @__PURE__ */ jsx11(Text12, { color: COLORS.muted, children: firstCommand.description })
+        /* @__PURE__ */ jsx12(Progress, {}),
+        /* @__PURE__ */ jsx12(CurrentStep, {}),
+        /* @__PURE__ */ jsxs13(Box14, { flexDirection: "row", gap: 1, children: [
+          /* @__PURE__ */ jsx12(Text14, { color: COLORS.primary, children: `[${firstCommand.keyHint}]` }),
+          /* @__PURE__ */ jsx12(Text14, { color: COLORS.muted, children: firstCommand.description })
         ] })
       ]
     }
@@ -1272,8 +1459,8 @@ function Ribbon() {
 import { useState as useState6 } from "react";
 
 // src/ui/Logs.tsx
-import { Box as Box13, Text as Text13, useInput as useInput5 } from "ink";
-import { jsx as jsx12, jsxs as jsxs12 } from "react/jsx-runtime";
+import { Box as Box15, Text as Text15, useInput as useInput6 } from "ink";
+import { jsx as jsx13, jsxs as jsxs14 } from "react/jsx-runtime";
 var KIND_COLOR = {
   tool: COLORS.primary,
   prompt: COLORS.badge
@@ -1304,14 +1491,14 @@ function formatTimestamp(ms) {
 function Logs() {
   const logs = useWizard((s) => s.logs);
   const scroll = useScrollWindow({ itemCount: logs.length, followBottom: true });
-  useInput5((_input, key) => {
+  useInput6((_input, key) => {
     if (key.upArrow) scroll.scrollBy(-1);
     else if (key.downArrow) scroll.scrollBy(1);
   });
   const visible = logs.slice(scroll.offset, scroll.offset + scroll.capacity);
-  return /* @__PURE__ */ jsxs12(Box13, { flexDirection: "column", paddingX: 4, paddingY: 2, flexGrow: 1, children: [
-    logs.length === 0 && /* @__PURE__ */ jsx12(Text13, { color: COLORS.dim, children: "No logs yet." }),
-    /* @__PURE__ */ jsx12(ScrollView, { scroll, children: visible.map((entry) => {
+  return /* @__PURE__ */ jsxs14(Box15, { flexDirection: "column", paddingX: 4, paddingY: 2, flexGrow: 1, children: [
+    logs.length === 0 && /* @__PURE__ */ jsx13(Text15, { color: COLORS.dim, children: "No logs yet." }),
+    /* @__PURE__ */ jsx13(ScrollView, { scroll, children: visible.map((entry) => {
       const timestamp = `[${formatTimestamp(entry.startedAt)}]`;
       const durationText = entry.kind === "tool" && entry.durationMs !== void 0 ? `${entry.durationMs}ms` : "";
       const rawPreview = rawInputText(entry.input);
@@ -1321,14 +1508,14 @@ function Logs() {
       const name = truncate2(entry.name, budget);
       budget -= name.length;
       const preview = rawPreview ? truncate2(rawPreview, budget) : "";
-      return /* @__PURE__ */ jsxs12(Box13, { flexDirection: "row", gap: ROW_GAP, children: [
-        /* @__PURE__ */ jsx12(Text13, { color: COLORS.dim, children: timestamp }),
-        /* @__PURE__ */ jsx12(Text13, { color: logNameColor(entry), wrap: "truncate", children: name }),
-        preview && /* @__PURE__ */ jsx12(Text13, { color: COLORS.dim, wrap: "truncate", children: preview }),
-        durationText && /* @__PURE__ */ jsx12(Text13, { color: COLORS.dim, children: durationText })
+      return /* @__PURE__ */ jsxs14(Box15, { flexDirection: "row", gap: ROW_GAP, children: [
+        /* @__PURE__ */ jsx13(Text15, { color: COLORS.dim, children: timestamp }),
+        /* @__PURE__ */ jsx13(Text15, { color: logNameColor(entry), wrap: "truncate", children: name }),
+        preview && /* @__PURE__ */ jsx13(Text15, { color: COLORS.dim, wrap: "truncate", children: preview }),
+        durationText && /* @__PURE__ */ jsx13(Text15, { color: COLORS.dim, children: durationText })
       ] }, entry.id);
     }) }),
-    /* @__PURE__ */ jsx12(Text13, { color: COLORS.dim, children: "\u2191/\u2193 scroll" })
+    /* @__PURE__ */ jsx13(Text15, { color: COLORS.dim, children: "\u2191/\u2193 scroll" })
   ] });
 }
 
@@ -1520,15 +1707,15 @@ function track(event, payload) {
 }
 
 // src/ui/App.tsx
-import { jsx as jsx13, jsxs as jsxs13 } from "react/jsx-runtime";
+import { jsx as jsx14, jsxs as jsxs15 } from "react/jsx-runtime";
 function App() {
   const { phase, error, homeScreen, currentStepIndex, steps, inputReq } = useWizard();
   const { exit } = useApp();
-  const { columns, rows } = useWindowSize7();
+  const { columns, rows } = useWindowSize8();
   const [showLogs, setShowLogs] = useState6(false);
   const finished = phase === "done" || phase === "error";
   const currentStep = steps[currentStepIndex];
-  useInput6(
+  useInput7(
     (_input, key) => {
       if (key.return) {
         exit();
@@ -1536,8 +1723,8 @@ function App() {
     },
     { isActive: finished }
   );
-  useInput6((_input, key) => {
-    if (phase === "idle" || phase === "preflight") return;
+  useInput7((_input, key) => {
+    if (phase === "idle" || phase === "authenticating") return;
     if (key.tab) {
       setShowLogs(!showLogs);
       track("AI Wizard Interaction", {
@@ -1547,49 +1734,45 @@ function App() {
       });
     }
   });
-  const escOwnedElsewhere = phase === "idle" || phase === "awaitingInput" && inputReq?.promptType === "enterToContinue";
-  useInput6((_input, key) => {
+  const escOwnedElsewhere = phase === "idle" || phase === "authenticating" || phase === "awaitingInput" && (inputReq?.promptType === "enterToContinue" || inputReq?.promptType === "commandApproval");
+  useInput7((_input, key) => {
     if (escOwnedElsewhere) return;
     if (key.escape) {
       track("AI Wizard Interaction", {
         context: "global",
         key: "esc",
-        // No step is active until `startWorkflow` — report the phase instead.
         currentStep: currentStep?.id ?? phase
       });
       exit();
     }
   });
-  const mainWindowVisible = phase === "running" || phase === "awaitingInput" || phase === "error" || phase === "done";
+  const mainWindowVisible = phase === "authenticating" || phase === "preflight" || phase === "running" || phase === "awaitingInput" || phase === "error" || phase === "done";
   const flexDirection = columns > 90 ? "row" : "column";
   const showSidebar = flexDirection === "row";
-  return /* @__PURE__ */ jsxs13(
-    Box14,
-    {
-      backgroundColor: COLORS.bg.main,
-      flexDirection: "row",
-      width: columns,
-      minHeight: rows,
-      children: [
-        mainWindowVisible && // Ink sizes the root by width only, so without a cap the scrolling
-        // lists in here grow to their content instead of windowing (see
-        // `useScrollWindow`). The home screens below stay uncapped: they are
-        // long static copy that would be clipped rather than windowed.
-        /* @__PURE__ */ jsxs13(
-          Box14,
-          {
-            flexDirection,
-            width: "100%",
-            maxHeight: rows,
-            justifyContent: "space-between",
-            children: [
-              showLogs ? /* @__PURE__ */ jsx13(Logs, {}) : (
-                /* Fill the space the sidebar/ribbon leaves — width beside the
-                   sidebar, height above the ribbon. The height matters even
-                   stacked: it is what the prompt's scrolling list measures itself
-                   against (see SelectPrompt). */
-                /* @__PURE__ */ jsxs13(
-                  Box14,
+  const scrollsPastViewport = phase === "idle" && homeScreen === "learnMore";
+  return (
+    /* Clamped to exactly the viewport: a taller frame makes Ink clear and repaint
+       the whole screen, and the scrolling throws off its cursor arithmetic —
+       flicker and leftover rows. */
+    /* @__PURE__ */ jsxs15(
+      Box16,
+      {
+        backgroundColor: COLORS.bg.main,
+        flexDirection: "row",
+        width: columns,
+        height: scrollsPastViewport ? void 0 : rows,
+        overflow: scrollsPastViewport ? "visible" : "hidden",
+        children: [
+          mainWindowVisible && /* @__PURE__ */ jsxs15(
+            Box16,
+            {
+              flexDirection,
+              width: "100%",
+              maxHeight: rows,
+              justifyContent: "space-between",
+              children: [
+                showLogs ? /* @__PURE__ */ jsx14(Logs, {}) : /* @__PURE__ */ jsxs15(
+                  Box16,
                   {
                     flexDirection: "column",
                     paddingX: 4,
@@ -1597,24 +1780,29 @@ function App() {
                     width: showSidebar ? 70 : "100%",
                     flexGrow: 1,
                     children: [
-                      /* @__PURE__ */ jsx13(Notices, {}),
-                      /* @__PURE__ */ jsx13(PromptInput, {}),
-                      phase === "running" && showSidebar && /* @__PURE__ */ jsx13(Box14, { marginTop: 1, children: /* @__PURE__ */ jsx13(CurrentStep, {}) }),
-                      phase === "error" && error && /* @__PURE__ */ jsx13(Box14, { marginTop: 1, children: /* @__PURE__ */ jsxs13(Text14, { color: COLORS.status.error, children: [
+                      phase === "authenticating" && /* @__PURE__ */ jsxs15(Box16, { flexDirection: "column", marginBottom: 1, children: [
+                        /* @__PURE__ */ jsx14(Text16, { color: COLORS.strong, bold: true, children: "Signing in to Algolia" }),
+                        /* @__PURE__ */ jsx14(Text16, { color: COLORS.muted, children: "A browser window will open \u2014 complete sign-in there." })
+                      ] }),
+                      /* @__PURE__ */ jsx14(CliOutput, {}),
+                      /* @__PURE__ */ jsx14(Notices, {}),
+                      /* @__PURE__ */ jsx14(PromptInput, {}),
+                      phase === "running" && showSidebar && /* @__PURE__ */ jsx14(Box16, { marginTop: 1, children: /* @__PURE__ */ jsx14(CurrentStep, {}) }),
+                      phase === "error" && error && /* @__PURE__ */ jsx14(Box16, { marginTop: 1, children: /* @__PURE__ */ jsxs15(Text16, { color: COLORS.status.error, children: [
                         "\u2716 ",
                         error
                       ] }) })
                     ]
                   }
-                )
-              ),
-              showSidebar ? /* @__PURE__ */ jsx13(Sidebar, {}) : /* @__PURE__ */ jsx13(Ribbon, {})
-            ]
-          }
-        ),
-        (phase === "idle" || phase === "preflight") && (homeScreen === "learnMore" ? /* @__PURE__ */ jsx13(LearnMore, {}) : /* @__PURE__ */ jsx13(Welcome, {}))
-      ]
-    }
+                ),
+                showSidebar ? /* @__PURE__ */ jsx14(Sidebar, {}) : /* @__PURE__ */ jsx14(Ribbon, {})
+              ]
+            }
+          ),
+          phase === "idle" && (homeScreen === "learnMore" ? /* @__PURE__ */ jsx14(LearnMore, {}) : /* @__PURE__ */ jsx14(Welcome, {}))
+        ]
+      }
+    )
   );
 }
 
@@ -1628,7 +1816,8 @@ var configFile = () => join5(stateDir(), "config.json");
 var DEFAULT_CONFIG = {
   version: 1,
   aiConsent: false,
-  workflowsRun: []
+  workflowsRun: [],
+  searchApiKeys: {}
 };
 async function loadConfig() {
   try {
@@ -1647,6 +1836,38 @@ async function recordWorkflowRun(workflowId, completedAt) {
   config.workflowsRun.push({ workflowId, completedAt });
   await saveConfig(config);
 }
+function isStoredSearchKey(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const { appId, key } = value;
+  return typeof appId === "string" && !!appId && typeof key === "string" && !!key;
+}
+function storedSearchKeys(config) {
+  const stored = config.searchApiKeys;
+  if (typeof stored !== "object" || stored === null || Array.isArray(stored)) {
+    return {};
+  }
+  return stored;
+}
+async function getStoredSearchKey(index, appId) {
+  const entry = storedSearchKeys(await loadConfig())[index];
+  if (!isStoredSearchKey(entry) || entry.appId !== appId) return void 0;
+  return entry.key;
+}
+async function storeSearchKey(index, appId, key) {
+  const config = await loadConfig();
+  config.searchApiKeys = {
+    ...storedSearchKeys(config),
+    [index]: { appId, key }
+  };
+  await saveConfig(config);
+}
+async function forgetSearchKey(index) {
+  const config = await loadConfig();
+  const remaining = { ...storedSearchKeys(config) };
+  delete remaining[index];
+  config.searchApiKeys = remaining;
+  await saveConfig(config);
+}
 
 // src/core/orchestrator.ts
 function defineStep(step) {
@@ -1691,7 +1912,7 @@ async function ensureConsent() {
   if (config.aiConsent) return;
   const store = useWizard.getState();
   const answer = await store.requestUserInput({
-    prompt: "Wizard will make AI-authored changes to this repository.",
+    prompt: "Wizard will make AI-authored changes to this repository, and will propose shell commands to set it up. You approve each command before it runs.",
     promptType: "enterToContinue",
     options: []
   });
@@ -1850,61 +2071,138 @@ async function runWorkflow(workflow, appId) {
   }
 }
 
-// src/lib/algoliaProfile.ts
-import { readFile as readFile3 } from "node:fs/promises";
-import { createRequire as createRequire2 } from "node:module";
-import { homedir as homedir2 } from "node:os";
-import { join as join6 } from "node:path";
-import { parse as parseToml } from "toml";
-var require3 = createRequire2(import.meta.url);
-function configPath() {
-  const base = process.env.XDG_CONFIG_HOME || join6(homedir2(), ".config");
-  return join6(base, "algolia", "config.toml");
-}
-function profilesFromConfig(tomlText) {
-  let parsed;
+// src/lib/algoliaApp.ts
+import { z as z4 } from "zod";
+var applicationSchema = z4.object({
+  id: z4.string().min(1),
+  name: z4.string().default(""),
+  plan: z4.string().optional()
+});
+var listSchema = z4.array(
+  z4.object({
+    id: z4.string().min(1),
+    name: z4.string().default(""),
+    plan_label: z4.string().optional()
+  }).transform(({ id, name, plan_label }) => ({ id, name, plan: plan_label }))
+);
+async function currentApplication() {
+  let raw;
   try {
-    parsed = parseToml(tomlText);
+    raw = await runAlgoliaCli(["application", "current", "-o", "json"]);
   } catch {
-    return [];
+    return null;
+  }
+  const parsed = applicationSchema.safeParse(parseJson(raw));
+  return parsed.success ? parsed.data : null;
+}
+async function requireApplication() {
+  const app = await currentApplication();
+  if (!app) {
+    throw new Error(
+      "No Algolia application is selected. Run `npx @algolia/cli@latest application select` and restart the wizard."
+    );
   }
-  const profiles = Object.entries(parsed).filter(
-    ([, t]) => typeof t.application_id === "string" && typeof t.api_key === "string"
-  ).map(([name, t]) => ({
-    name,
-    appId: t.application_id,
-    apiKey: t.api_key,
-    isDefault: t.default === true
-  }));
-  profiles.sort((a, b) => Number(b.isDefault) - Number(a.isDefault));
-  return profiles.map(({ name, appId, apiKey }) => ({ name, appId, apiKey }));
-}
-async function loadActiveProfile() {
-  let profiles;
+  return app;
+}
+async function listApplications() {
+  const raw = await runAlgoliaCli(["application", "list", "-o", "json"]);
+  const parsed = listSchema.safeParse(parseJson(raw));
+  if (!parsed.success) {
+    throw new Error("Could not read the list of Algolia applications.");
+  }
+  return parsed.data;
+}
+async function selectApplication(id) {
+  const raw = await runAlgoliaCli(
+    ["application", "select", "--non-interactive", "--app-id", id],
+    { onOutput: stderrSink }
+  );
+  const parsed = applicationSchema.safeParse(parseJson(raw));
+  if (!parsed.success) {
+    throw new Error(
+      `Selected application ${id}, but the Algolia CLI returned an unreadable result.`
+    );
+  }
+  return parsed.data;
+}
+function parseJson(text) {
   try {
-    profiles = profilesFromConfig(await readFile3(configPath(), "utf8"));
+    return JSON.parse(text);
   } catch {
-    profiles = [];
+    return void 0;
   }
-  const profile = profiles[0];
-  if (!profile) {
+}
+
+// src/lib/algoliaAppPicker.ts
+function secondaryFor(app) {
+  return app.plan ? { kind: "badge", value: app.plan } : void 0;
+}
+function labelFor(app) {
+  return app.name.trim() ? `${app.name} \u2014 ${app.id}` : app.id;
+}
+function selectAndReport(app) {
+  useWizard.getState().pushCliOutput(
+    "stdout",
+    `Selecting ${labelFor(app)} \u2014 provisioning its API key\u2026`
+  );
+  return selectApplication(app.id);
+}
+async function promptForApplication() {
+  const store = useWizard.getState();
+  const apps = await listApplications();
+  if (apps.length === 0) {
     throw new Error(
-      "No Algolia profile is configured. Run `npx @algolia/cli auth login` to authenticate."
+      "This Algolia account has no applications. Create one in the Algolia dashboard, or with `npx @algolia/cli@latest application create`, then restart the wizard."
     );
   }
-  return profile;
+  if (apps.length === 1) {
+    const only = apps[0];
+    logger.info(
+      { app: only.id },
+      "single application on the account; selecting it"
+    );
+    return selectAndReport(only);
+  }
+  const messages = ["Which Algolia application should the wizard work in?"];
+  for (; ; ) {
+    const choice = await store.requestUserInput({
+      prompt: "Select an application",
+      promptType: "multipleChoice",
+      options: apps.map(labelFor),
+      secondary: apps.map(secondaryFor),
+      messages
+    });
+    const chosen = apps.find((app) => labelFor(app) === choice);
+    if (!chosen) {
+      throw new Error("Application picker received an unexpected selection");
+    }
+    try {
+      return await selectAndReport(chosen);
+    } catch (err) {
+      logger.warn(
+        { app: chosen.id, err: err.message },
+        "application select failed; re-prompting"
+      );
+      messages.push(
+        `Could not select \u201C${labelFor(chosen)}\u201D. It may have been removed \u2014 pick another.`
+      );
+    }
+  }
+}
+async function ensureApplication() {
+  return await currentApplication() ?? await promptForApplication();
 }
 
 // src/workflows/default.ts
-import { z as z25 } from "zod";
+import { z as z27 } from "zod";
 
 // src/actions/listIndices.ts
-import { z as z3 } from "zod";
-var indicesListSchema = z3.object({
-  items: z3.array(
-    z3.object({
-      name: z3.string(),
-      entries: z3.number().default(0)
+import { z as z5 } from "zod";
+var indicesListSchema = z5.object({
+  items: z5.array(
+    z5.object({
+      name: z5.string(),
+      entries: z5.number().default(0)
     })
   )
 });
@@ -1975,12 +2273,12 @@ import "zod";
 
 // src/lib/tools/listFiles.ts
 import { tool } from "ai";
-import z4 from "zod";
+import z6 from "zod";
 import { readdir } from "node:fs/promises";
 
 // src/lib/tools/path.ts
 import { lstat } from "node:fs/promises";
-import { resolve as resolve2, relative, isAbsolute, dirname as dirname3, join as join7, sep } from "node:path";
+import { resolve as resolve2, relative, isAbsolute, dirname as dirname3, join as join6, sep } from "node:path";
 function resolveInRoot(ctx, path) {
   const target = resolve2(ctx.cwd, path);
   const rel = relative(ctx.root, target);
@@ -1996,7 +2294,7 @@ async function hasSymlinkParent(ctx, target) {
   let current = ctx.root;
   const parts = relative(ctx.root, dirname3(target)).split(sep).filter(Boolean);
   for (const part of parts) {
-    current = join7(current, part);
+    current = join6(current, part);
     try {
       if ((await lstat(current)).isSymbolicLink()) return true;
     } catch (err) {
@@ -2011,7 +2309,7 @@ async function hasSymlinkParent(ctx, target) {
 function listFilesTool(ctx) {
   return tool({
     description: "List files in the current working directory",
-    inputSchema: z4.object(),
+    inputSchema: z6.object(),
     execute: async () => {
       logger.info("called listFiles tool");
       if (++ctx.counts.list > ctx.limits.list) {
@@ -2027,13 +2325,13 @@ function listFilesTool(ctx) {
 
 // src/lib/tools/changeDirectory.ts
 import { tool as tool2 } from "ai";
-import z5 from "zod";
+import z7 from "zod";
 import { stat } from "node:fs/promises";
 function changeDirectoryTool(ctx) {
   return tool2({
     description: "Change the current working directory. Subsequent file operations resolve relative to it. Returns the new working directory.",
-    inputSchema: z5.object({
-      path: z5.string().describe("Directory to change into")
+    inputSchema: z7.object({
+      path: z7.string().describe("Directory to change into")
     }),
     execute: async ({ path }) => {
       logger.info({ path }, "called changeDirectory tool");
@@ -2055,13 +2353,13 @@ function changeDirectoryTool(ctx) {
 
 // src/lib/tools/reportStatus.ts
 import { tool as tool3 } from "ai";
-import z6 from "zod";
+import z8 from "zod";
 function reportStatusTool(output) {
   return tool3({
     description: "Report the status of your execution. Return a reason in case of failure.",
-    inputSchema: z6.object({
-      status: z6.enum(["success", "fail"]),
-      reason: z6.string().optional(),
+    inputSchema: z8.object({
+      status: z8.enum(["success", "fail"]),
+      reason: z8.string().optional(),
       output
     }),
     execute: async ({ status, reason, output: output2 }) => {
@@ -2073,8 +2371,8 @@ function reportStatusTool(output) {
 
 // src/lib/tools/readFile.ts
 import { tool as tool4 } from "ai";
-import z7 from "zod";
-import { readFile as readFile4 } from "node:fs/promises";
+import z9 from "zod";
+import { readFile as readFile3 } from "node:fs/promises";
 
 // src/lib/tools/env.ts
 import { basename } from "node:path";
@@ -2101,8 +2399,8 @@ function redactEnvValues(content) {
 function readFileTool(ctx) {
   return tool4({
     description: "Read the contents of a file at the given path",
-    inputSchema: z7.object({
-      filePath: z7.string().describe("Path to the file to read")
+    inputSchema: z9.object({
+      filePath: z9.string().describe("Path to the file to read")
     }),
     execute: async ({ filePath }) => {
       if (++ctx.counts.read > ctx.limits.read) {
@@ -2112,7 +2410,7 @@ function readFileTool(ctx) {
       const resolved = resolveInRoot(ctx, filePath);
       if (!resolved.ok) return resolved.error;
       try {
-        const content = await readFile4(resolved.target, "utf8");
+        const content = await readFile3(resolved.target, "utf8");
         return isEnvFile(resolved.target) ? redactEnvValues(content) : content;
       } catch (err) {
         return `Error reading ${filePath}: ${err.message}`;
@@ -2123,15 +2421,15 @@ function readFileTool(ctx) {
 
 // src/lib/tools/writeFile.ts
 import { tool as tool5 } from "ai";
-import z8 from "zod";
+import z10 from "zod";
 import { mkdir as mkdir3, writeFile as writeFile3 } from "node:fs/promises";
 import { dirname as dirname4 } from "node:path";
 function writeFileTool(ctx) {
   return tool5({
     description: "Write content to a file at the given path, overwriting it. To set Algolia credentials in an env file, use writeCredentials instead of this tool.",
-    inputSchema: z8.object({
-      filePath: z8.string().describe("Path to the file to write"),
-      content: z8.string().describe("Content to write to the file")
+    inputSchema: z10.object({
+      filePath: z10.string().describe("Path to the file to write"),
+      content: z10.string().describe("Content to write to the file")
     }),
     execute: async ({ filePath, content }) => {
       logger.info({ filePath }, "called writeFile tool");
@@ -2156,9 +2454,145 @@ function writeFileTool(ctx) {
 
 // src/lib/tools/writeAlgoliaCredentials.ts
 import { tool as tool6 } from "ai";
-import z9 from "zod";
-import { mkdir as mkdir4, readFile as readFile5, writeFile as writeFile4 } from "node:fs/promises";
+import z12 from "zod";
+import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4 } from "node:fs/promises";
 import { dirname as dirname5 } from "node:path";
+
+// src/lib/algoliaApiKey.ts
+import { z as z11 } from "zod";
+var WRITE_ACLS = [
+  "addObject",
+  "deleteObject",
+  "settings",
+  "editSettings",
+  "listIndexes"
+];
+var WRITE_ACL_SET = new Set(WRITE_ACLS);
+var apiKeySchema = z11.object({
+  value: z11.string().min(1),
+  acl: z11.array(z11.string()).default([]),
+  indexes: z11.array(z11.string()).default([])
+});
+var apiKeyListSchema = z11.union([
+  z11.array(apiKeySchema),
+  z11.object({
+    items: z11.array(apiKeySchema).optional(),
+    keys: z11.array(apiKeySchema).optional()
+  })
+]).transform((o) => Array.isArray(o) ? o : o.items ?? o.keys ?? []);
+function parseCliJson(schema, stdout, command) {
+  let raw;
+  try {
+    raw = JSON.parse(stdout);
+  } catch {
+    throw new Error(`Algolia CLI \`${command}\` returned unreadable JSON.`);
+  }
+  const parsed = schema.safeParse(raw);
+  if (!parsed.success) {
+    throw new Error(
+      `Algolia CLI \`${command}\` returned JSON in an unexpected shape.`
+    );
+  }
+  return parsed.data;
+}
+var createdKeySchema = z11.object({
+  key: z11.string().min(1).optional(),
+  value: z11.string().min(1).optional()
+}).transform((o) => o.key ?? o.value);
+function canReuseForWrites(key, index) {
+  return WRITE_ACLS.every((acl) => key.acl.includes(acl)) && key.acl.every((acl) => WRITE_ACL_SET.has(acl)) && key.indexes.includes(index);
+}
+async function resolveWriteKey(index) {
+  const stdout = await runAlgoliaCli(["apikeys", "list", "-o", "json"]);
+  const existing = parseCliJson(apiKeyListSchema, stdout, "apikeys list").find(
+    (key) => canReuseForWrites(key, index)
+  )?.value;
+  if (existing) {
+    logger.info({ index }, "reusing existing write API key");
+    return existing;
+  }
+  logger.info({ index }, "no reusable write key found; creating one");
+  const created = await runAlgoliaCli([
+    "apikeys",
+    "create",
+    "--indices",
+    index,
+    "--acl",
+    WRITE_ACLS.join(","),
+    "--description",
+    `wizard write key for ${index}`,
+    "-o",
+    "json"
+  ]);
+  const writeKey = parseCliJson(createdKeySchema, created, "apikeys create");
+  if (!writeKey) throw new Error("apikeys create returned no key value");
+  return writeKey;
+}
+async function createSearchOnlyKey(index) {
+  logger.info({ index }, "creating a search-only API key");
+  const stdout = await runAlgoliaCli([
+    "apikeys",
+    "create",
+    "--acl",
+    "search",
+    "--indices",
+    index,
+    "--description",
+    `Algolia Wizard search-only key for ${index}`,
+    "-o",
+    "json"
+  ]);
+  let payload;
+  try {
+    payload = JSON.parse(stdout);
+  } catch {
+    throw new Error("apikeys create returned output that is not valid JSON");
+  }
+  const created = createdKeySchema.parse(payload);
+  if (!created) throw new Error("apikeys create returned no key value");
+  return created;
+}
+async function apiKeyExists(key) {
+  try {
+    await runAlgoliaCli(["apikeys", "get", key, "-o", "json"]);
+    return true;
+  } catch (err) {
+    return !/does not exist|not found|404/i.test(err.message);
+  }
+}
+async function resolveSearchOnlyKey(index, appId, envKey) {
+  if (envKey) {
+    await recordSearchKey(index, appId, envKey);
+    return { key: envKey, source: "env" };
+  }
+  const stored = await getStoredSearchKey(index, appId);
+  if (stored) {
+    if (await apiKeyExists(stored)) {
+      logger.info({ index, appId }, "reusing the stored search-only API key");
+      return { key: stored, source: "config" };
+    }
+    logger.warn(
+      { index, appId },
+      "the stored search-only API key no longer exists; creating a replacement"
+    );
+    await forgetSearchKey(index);
+  }
+  const key = await createSearchOnlyKey(index);
+  await recordSearchKey(index, appId, key);
+  return { key, source: "created" };
+}
+async function recordSearchKey(index, appId, key) {
+  try {
+    await storeSearchKey(index, appId, key);
+  } catch (err) {
+    logger.warn(
+      { err: err.message, index },
+      "could not record the search-only API key; a later run may create another"
+    );
+  }
+}
+
+// src/lib/tools/writeAlgoliaCredentials.ts
 var APP_ID_VAR = "ALGOLIA_APPLICATION_ID";
 var API_KEY_VAR = "ALGOLIA_WRITE_API_KEY";
 function appendEnv(content, entries) {
@@ -2172,9 +2606,9 @@ function hasEnv(content, name) {
 }
 function writeCredentialsTool(ctx) {
   return tool6({
-    description: `Write the active Algolia credentials (${APP_ID_VAR} and ${API_KEY_VAR}) into the given env file. The credentials are read from the local Algolia CLI profile; you only pass the path to the env file (e.g. ".env"). If the file already defines ${APP_ID_VAR} or ${API_KEY_VAR}, the write is skipped and existing values are left untouched.`,
-    inputSchema: z9.object({
-      filePath: z9.string().describe(
+    description: `Write the active Algolia credentials (${APP_ID_VAR} and ${API_KEY_VAR}) into the given env file. The credentials come from the selected Algolia application, with a write key scoped to the target index; you only pass the path to the env file (e.g. ".env"). If the file already defines ${APP_ID_VAR} or ${API_KEY_VAR}, the write is skipped and existing values are left untouched.`,
+    inputSchema: z12.object({
+      filePath: z12.string().describe(
         'Path to the env file to write credentials into (e.g. ".env")'
       )
     }),
@@ -2182,11 +2616,17 @@ function writeCredentialsTool(ctx) {
       logger.info({ filePath }, "called writeCredentials tool");
       const resolved = resolveInRoot(ctx, filePath);
       if (resolved.ok === false) return resolved.error;
-      let profile;
+      const targetIndex = useWizard.getState().targetIndex;
+      if (!targetIndex) {
+        return "Error: no target index is set for this run, so a scoped write key cannot be provisioned.";
+      }
+      let appId;
+      let writeKey;
       try {
-        profile = await loadActiveProfile();
-      } catch {
-        return "Error: no Algolia profile is configured, so credentials cannot be written. Ask the user to authenticate with the Algolia CLI first.";
+        appId = (await requireApplication()).id;
+        writeKey = await resolveWriteKey(targetIndex);
+      } catch (err) {
+        return `Error: could not resolve Algolia credentials (${err.message}). Ask the user to authenticate with the Algolia CLI first.`;
       }
       try {
         if (await hasSymlinkParent(ctx, resolved.target)) {
@@ -2194,7 +2634,7 @@ function writeCredentialsTool(ctx) {
         }
         let existing = "";
         try {
-          existing = await readFile5(resolved.target, "utf8");
+          existing = await readFile4(resolved.target, "utf8");
         } catch (err) {
           if (err.code !== "ENOENT") throw err;
         }
@@ -2205,8 +2645,8 @@ function writeCredentialsTool(ctx) {
           return `Skipped: ${filePath} already defines ${present.join(" and ")}. Leaving existing credentials untouched.`;
         }
         const envWithCredentials = appendEnv(existing, [
-          [APP_ID_VAR, profile.appId],
-          [API_KEY_VAR, profile.apiKey]
+          [APP_ID_VAR, appId],
+          [API_KEY_VAR, writeKey]
         ]);
         await mkdir4(dirname5(resolved.target), { recursive: true });
         await writeFile4(resolved.target, envWithCredentials, "utf8");
@@ -2220,16 +2660,24 @@ function writeCredentialsTool(ctx) {
 
 // src/lib/tools/searchFiles.ts
 import { tool as tool7 } from "ai";
-import z10 from "zod";
-import { readdir as readdir2, readFile as readFile6 } from "node:fs/promises";
-import { join as join8 } from "node:path";
+import z13 from "zod";
+import { readdir as readdir2, readFile as readFile5 } from "node:fs/promises";
+import { join as join7 } from "node:path";
 var MAX_QUERY_LENGTH = 1e3;
+var SKIP_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  "dist",
+  "build",
+  "vendor",
+  "venv",
+  "__pycache__",
+  "target"
+]);
 async function walkFiles(dir) {
-  const skip = /* @__PURE__ */ new Set(["node_modules", ".git", "dist"]);
   const out = [];
   for (const e of await readdir2(dir, { withFileTypes: true })) {
-    if (e.name.startsWith(".") || skip.has(e.name)) continue;
-    const full = join8(dir, e.name);
+    if (e.name.startsWith(".") || SKIP_DIRS.has(e.name)) continue;
+    const full = join7(dir, e.name);
     if (e.isDirectory()) out.push(...await walkFiles(full));
     else if (e.isFile()) out.push(full);
   }
@@ -2238,9 +2686,9 @@ async function walkFiles(dir) {
 function searchFilesTool(ctx) {
   return tool7({
     description: "Search file contents for a JavaScript regular expression (RegExp syntax, not grep/PCRE). Returns matching lines as file:line:text.",
-    inputSchema: z10.object({
-      query: z10.string().describe("JavaScript RegExp pattern to search for"),
-      path: z10.string().optional().describe("Directory to search in (default: cwd)")
+    inputSchema: z13.object({
+      query: z13.string().describe("JavaScript RegExp pattern to search for"),
+      path: z13.string().optional().describe("Directory to search in (default: cwd)")
     }),
     execute: async ({ query, path = "." }) => {
       logger.info({ query, path }, "called searchFiles tool");
@@ -2262,7 +2710,7 @@ function searchFilesTool(ctx) {
       for (const file of await walkFiles(resolved.target)) {
         let content;
         try {
-          content = await readFile6(file, "utf8");
+          content = await readFile5(file, "utf8");
         } catch {
           continue;
         }
@@ -2282,92 +2730,194 @@ function searchFilesTool(ctx) {
   });
 }
 
-// src/lib/tools/verifyImplementation.ts
+// src/lib/tools/runShell.ts
 import { tool as tool8 } from "ai";
-import z11 from "zod";
+import z14 from "zod";
+import { relative as relative2 } from "node:path";
 
-// src/lib/tools/utils/runCommand.ts
+// src/lib/tools/utils/runShell.ts
 import { spawn as spawn2 } from "node:child_process";
-function runCommand(command, args, cwd) {
+
+// src/lib/tools/context.ts
+var DEFAULT_TOOL_LIMITS = {
+  list: 10,
+  search: 10,
+  read: 20,
+  match: 100,
+  shell: 30
+};
+var DEFAULT_SHELL_TIMEOUT_MS = 10 * 60 * 1e3;
+async function refuseByDefault() {
+  return "reject";
+}
+function createShellContext(overrides = {}) {
+  return {
+    env: async () => ({}),
+    timeoutMs: DEFAULT_SHELL_TIMEOUT_MS,
+    approved: /* @__PURE__ */ new Set(),
+    executions: [],
+    approve: refuseByDefault,
+    ...overrides
+  };
+}
+function createToolContext(limits = DEFAULT_TOOL_LIMITS, cwd = process.cwd(), shell2 = createShellContext()) {
+  return {
+    root: cwd,
+    cwd,
+    limits: { ...limits },
+    counts: { list: 0, search: 0, read: 0, shell: 0 },
+    shell: shell2
+  };
+}
+
+// src/lib/tools/utils/runShell.ts
+var SIGKILL_DELAY_MS = 5e3;
+var HEAD_CHARS = 4e3;
+var TAIL_CHARS = 8e3;
+function truncateOutput(output) {
+  if (output.length <= HEAD_CHARS + TAIL_CHARS) return output;
+  const omitted = output.length - HEAD_CHARS - TAIL_CHARS;
+  return [
+    output.slice(0, HEAD_CHARS),
+    `
+\u2026 [${omitted} characters omitted] \u2026
+`,
+    output.slice(-TAIL_CHARS)
+  ].join("");
+}
+function runShell(command, opts) {
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_SHELL_TIMEOUT_MS;
+  const startedAt = Date.now();
   return new Promise((resolve4) => {
     let output = "";
-    const child = spawn2(command, args, {
-      cwd,
-      stdio: ["ignore", "pipe", "pipe"]
+    let timedOut = false;
+    let settled = false;
+    const child = spawn2(command, {
+      shell: true,
+      cwd: opts.cwd,
+      stdio: ["ignore", "pipe", "pipe"],
+      env: { ...process.env, ...opts.env }
     });
+    const finish = (exitCode) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      clearTimeout(killTimer);
+      resolve4({
+        exitCode,
+        output: truncateOutput(output.trim()),
+        timedOut,
+        durationMs: Date.now() - startedAt
+      });
+    };
+    let killTimer;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      output += `
+[timed out after ${timeoutMs}ms]`;
+      child.kill("SIGTERM");
+      killTimer = setTimeout(() => child.kill("SIGKILL"), SIGKILL_DELAY_MS);
+    }, timeoutMs);
     child.stdout?.on("data", (d) => output += d);
     child.stderr?.on("data", (d) => output += d);
-    child.on(
-      "error",
-      (err) => resolve4({ code: 1, output: `Failed to run ${command}: ${err.message}` })
-    );
-    child.on("close", (code) => resolve4({ code: code ?? 1, output }));
+    child.on("error", (err) => {
+      output += `Failed to run ${command}: ${err.message}`;
+      finish(1);
+    });
+    child.on("close", (code) => finish(code ?? 1));
   });
 }
 
-// src/lib/tools/utils/packageManager.ts
-import { readFile as readFile7 } from "node:fs/promises";
-import { existsSync } from "node:fs";
-import { join as join9 } from "node:path";
-var LOCKFILES = [
-  ["pnpm-lock.yaml", "pnpm"],
-  ["yarn.lock", "yarn"],
-  ["bun.lockb", "bun"],
-  ["bun.lock", "bun"],
-  ["package-lock.json", "npm"]
-];
-async function readPackageJson(cwd = process.cwd()) {
-  return JSON.parse(await readFile7(join9(cwd, "package.json"), "utf8"));
-}
-function packageManagerFrom(pkg) {
-  return pkg.packageManager?.split("@")[0] ?? "npm";
-}
-function packageManagerFromLockfile(cwd) {
-  return LOCKFILES.find(([file]) => existsSync(join9(cwd, file)))?.[1];
-}
-async function detectPackageManager(cwd) {
-  try {
-    const pkg = await readPackageJson(cwd);
-    if (pkg.packageManager) return packageManagerFrom(pkg);
-  } catch {
-  }
-  return packageManagerFromLockfile(cwd) ?? "npm";
-}
-
-// src/lib/tools/repoVerification.ts
-var VERIFICATION_SCRIPT_CANDIDATES = ["lint", "typecheck", "check"];
-async function runRepoVerificationCheck() {
-  let pkg;
-  try {
-    pkg = await readPackageJson();
-  } catch (err) {
-    const limitation = `Could not read package.json to detect verification conventions: ${err.message}`;
-    return { ok: false, checks: [], limitation };
-  }
-  const scripts = pkg.scripts ?? {};
-  const present = VERIFICATION_SCRIPT_CANDIDATES.filter((s) => s in scripts);
-  if (present.length === 0) {
-    const limitation = `No verification script found in package.json (looked for: ${VERIFICATION_SCRIPT_CANDIDATES.join(", ")}).`;
-    return { ok: false, checks: [], limitation };
-  }
-  const pm = await detectPackageManager(process.cwd());
-  const checks = [];
-  for (const script of present) {
-    const command = `${pm} run ${script}`;
-    const { code, output } = await runCommand(pm, ["run", script]);
-    checks.push({ command, exitCode: code, ok: code === 0, output: output.trim() });
-  }
-  return { ok: checks.every((c) => c.ok), checks };
+// src/lib/tools/runShell.ts
+function approvalKey(cwd, command) {
+  return `${cwd}\0${command}`;
+}
+function storeApproval(root) {
+  return async (req) => {
+    const rel = relative2(root, req.cwd);
+    const answer = await useWizard.getState().requestUserInput({
+      prompt: "Run this command?",
+      promptType: "commandApproval",
+      options: [],
+      command: {
+        ...req,
+        cwd: rel === "" || rel.startsWith("..") ? req.cwd : rel
+      }
+    });
+    return answer === "approve" || answer === "always" ? answer : "reject";
+  };
 }
-
-// src/lib/tools/verifyImplementation.ts
-function verifyImplementationTool() {
+function runShellTool(ctx) {
   return tool8({
-    description: "Run the repo's mechanical verification check for generated implementation changes. Detects lint/typecheck/check from package.json and returns structured pass/fail evidence for the verifier to interpret.",
-    inputSchema: z11.object(),
-    execute: async () => {
-      logger.info("called verifyImplementation tool");
-      return runRepoVerificationCheck();
+    description: "Run a shell command in the project. Use this for anything the project needs done in its own ecosystem: installing dependencies, running a script you wrote, running the project's lint/typecheck/test commands. The user sees and approves every command before it runs, so write a clear `explanation`. If the user rejects a command, do not retry it \u2014 propose a different approach.",
+    inputSchema: z14.object({
+      command: z14.string().describe(
+        "The command to run, exactly as it would be typed in a shell. Pipes, && and redirects are allowed."
+      ),
+      cwd: z14.string().optional().describe(
+        "Directory to run in, relative to the project root. Defaults to the project root."
+      ),
+      explanation: z14.string().describe(
+        "One short line telling the user what this command does and why, including any side effect (e.g. writes records to Algolia). This is what they approve against."
+      )
+    }),
+    execute: async ({ command, cwd, explanation }) => {
+      if (++ctx.counts.shell > ctx.limits.shell) {
+        return `Refused: command limit (${ctx.limits.shell}) reached. Stop running commands and report what you have.`;
+      }
+      const resolved = resolveInRoot(ctx, cwd ?? ".");
+      if (!resolved.ok) return resolved.error;
+      logger.info({ command, cwd: resolved.target }, "called runShell tool");
+      const key = approvalKey(resolved.target, command);
+      const decision = ctx.shell.approved.has(key) ? "approve" : await ctx.shell.approve({
+        command,
+        cwd: resolved.target,
+        explanation
+      });
+      if (decision === "reject") {
+        ctx.shell.executions.push({
+          command,
+          cwd: resolved.target,
+          approved: false
+        });
+        logger.info({ command }, "runShell: user rejected the command");
+        return "The user rejected this command. Do not retry it. Propose a different command, or report the limitation via reportStatus.";
+      }
+      if (decision === "always") ctx.shell.approved.add(key);
+      useWizard.getState().pushNotice({ messages: [`Running: ${command}`] });
+      const env = await ctx.shell.env().catch((err) => {
+        logger.warn({ err, command }, "runShell: could not resolve command env");
+        return {};
+      });
+      const run2 = await (ctx.shell.run ?? runShell)(command, {
+        cwd: resolved.target,
+        env,
+        timeoutMs: ctx.shell.timeoutMs
+      });
+      logger.info(
+        {
+          command,
+          exitCode: run2.exitCode,
+          timedOut: run2.timedOut,
+          durationMs: run2.durationMs
+        },
+        "runShell finished"
+      );
+      await markInteraction();
+      ctx.shell.executions.push({
+        command,
+        cwd: resolved.target,
+        approved: true,
+        exitCode: run2.exitCode,
+        output: run2.output,
+        timedOut: run2.timedOut,
+        durationMs: run2.durationMs
+      });
+      return {
+        exitCode: run2.exitCode,
+        timedOut: run2.timedOut,
+        output: run2.output
+      };
     }
   });
 }
@@ -2378,7 +2928,7 @@ import { createAnthropic } from "@ai-sdk/anthropic";
 import { nanoid as nanoid2 } from "nanoid";
 import { mkdir as mkdir5, writeFile as writeFile5 } from "node:fs/promises";
 import { dirname as dirname6 } from "node:path";
-import z12 from "zod";
+import z15 from "zod";
 var DATA_DIR = ".algolia-wizard/data";
 var RECORD_MODEL = "claude-haiku-4-5";
 var MAX_RECORDS = 100;
@@ -2390,17 +2940,17 @@ var anthropic = createAnthropic({
 function generateRecordTool(ctx) {
   return tool9({
     description: "Generate realistic sample records for an entity and write them to a JSON file in the worktree. Provide the entity name and its attributes; this tool asks a model to invent varied, realistic values, each with a unique objectID, and returns the file path to read them from at runtime. Do not invent the record values or objectIDs yourself, and do not inline the returned records into the script \u2014 call this tool and read the file it writes.",
-    inputSchema: z12.object({
-      entityName: z12.string().describe("Name of the entity to generate records for."),
-      attributes: z12.array(z12.string()).describe("Attribute names each record must contain."),
-      count: z12.number().int().min(1).max(MAX_RECORDS).default(10).describe(`How many records to generate (max ${MAX_RECORDS}).`),
-      hint: z12.string().optional().describe("Optional context to steer realistic values.")
+    inputSchema: z15.object({
+      entityName: z15.string().describe("Name of the entity to generate records for."),
+      attributes: z15.array(z15.string()).describe("Attribute names each record must contain."),
+      count: z15.number().int().min(1).max(MAX_RECORDS).default(10).describe(`How many records to generate (max ${MAX_RECORDS}).`),
+      hint: z15.string().optional().describe("Optional context to steer realistic values.")
     }),
     execute: async ({ entityName, attributes, count, hint }) => {
       logger.info({ entityName, count }, "called generateRecord tool");
       try {
-        const value = z12.union([z12.string(), z12.number(), z12.boolean(), z12.null()]);
-        const recordSchema = z12.object(
+        const value = z15.union([z15.string(), z15.number(), z15.boolean(), z15.null()]);
+        const recordSchema = z15.object(
           Object.fromEntries(attributes.map((attr) => [attr, value]))
         );
         const generateBatch = async (batchCount) => {
@@ -2410,8 +2960,8 @@ function generateRecordTool(ctx) {
               const { output } = await generateText({
                 model: anthropic(RECORD_MODEL),
                 output: Output.object({
-                  schema: z12.object({
-                    records: z12.array(recordSchema).length(batchCount)
+                  schema: z15.object({
+                    records: z15.array(recordSchema).length(batchCount)
                   })
                 }),
                 prompt: [
@@ -2458,7 +3008,7 @@ function generateRecordTool(ctx) {
         return {
           filePath: relPath,
           count: records.length,
-          message: `Wrote ${records.length} records to ${relPath}. Read and parse this file in the script at runtime (e.g. JSON.parse(readFileSync(...)) in Node/Bun, json.load(open(...)) in Python) \u2014 do not inline the records as literals.`
+          message: `Wrote ${records.length} records to ${relPath}. Read and parse this file in the script at runtime using your language's standard JSON support \u2014 do not inline the records as literals.`
         };
       } catch (err) {
         return `Error generating records: ${err.message}`;
@@ -2469,12 +3019,12 @@ function generateRecordTool(ctx) {
 
 // src/lib/tools/notifyUser.ts
 import { tool as tool10 } from "ai";
-import z13 from "zod";
+import z16 from "zod";
 function notifyUserTool() {
   return tool10({
     description: `Give the user a brief, high-level update on what you are currently doing or about to do next. This is for the big picture (e.g. "Reading through your data models", "Writing the search UI") \u2014 not granular detail like individual tool calls, which are already logged separately. Call it when you start a new phase of work or your focus shifts, just not on every step, enough to keep the user engaged. Don't say things like "starting", just describe what you are doing. Don't mention tool calls themselves, just general direction of the work.`,
-    inputSchema: z13.object({
-      message: z13.string().describe(
+    inputSchema: z16.object({
+      message: z16.string().describe(
         "Short, plain-language description of what you are doing now."
       )
     }),
@@ -2486,22 +3036,6 @@ function notifyUserTool() {
   });
 }
 
-// src/lib/tools/context.ts
-var DEFAULT_TOOL_LIMITS = {
-  list: 10,
-  search: 10,
-  read: 20,
-  match: 100
-};
-function createToolContext(limits = DEFAULT_TOOL_LIMITS, cwd = process.cwd()) {
-  return {
-    root: cwd,
-    cwd,
-    limits,
-    counts: { list: 0, search: 0, read: 0 }
-  };
-}
-
 // src/lib/tools/index.ts
 function withLogging(name, def) {
   const execute = def.execute;
@@ -2533,10 +3067,7 @@ function createTools(ctx, { output, tools }) {
       writeCredentialsTool(ctx)
     ),
     searchFiles: withLogging("searchFiles", searchFilesTool(ctx)),
-    verifyImplementation: withLogging(
-      "verifyImplementation",
-      verifyImplementationTool()
-    ),
+    runShell: withLogging("runShell", runShellTool(ctx)),
     generateRecord: withLogging("generateRecord", generateRecordTool(ctx)),
     notifyUser: withLogging("notifyUser", notifyUserTool())
   };
@@ -2571,7 +3102,7 @@ async function runAgent(req) {
     baseURL: PROXY_BASE_URL,
     fetch: proxyFetch
   });
-  const toolContext = createToolContext();
+  const toolContext = req.toolContext ?? createToolContext();
   const readTools = ["readFile", "searchFiles", "listFiles"];
   const hasReadTools = !req.tools || req.tools.some((t) => readTools.includes(t));
   const instructions = [
@@ -2636,7 +3167,11 @@ async function runAgent(req) {
     "runAgent finished"
   );
   logger.info(
-    { counts: toolContext.counts, limits: toolContext.limits },
+    {
+      counts: toolContext.counts,
+      limits: toolContext.limits,
+      commandsRun: toolContext.shell.executions.length
+    },
     "tool usage"
   );
   const toolResults = await stream.toolResults;
@@ -2654,16 +3189,16 @@ async function runAgent(req) {
 }
 
 // src/actions/detectLanguage.ts
-import z16 from "zod";
-var detectLanguageSchema = z16.object({
-  languages: z16.array(z16.object({ name: z16.string(), version: z16.string() })),
-  frameworks: z16.array(z16.object({ name: z16.string(), version: z16.string() }))
+import z19 from "zod";
+var detectLanguageSchema = z19.object({
+  languages: z19.array(z19.object({ name: z19.string(), version: z19.string() })),
+  frameworks: z19.array(z19.object({ name: z19.string(), version: z19.string() }))
 });
 var detectLanguage = () => runAgent({
   instructions: [
     "Analyze the codebase and determine the programming languages and frameworks used",
-    "If a superset language is found, exclude the subset language. TS-over-JS.",
-    "If a meta-framework is used, exclude the framework. Next-over-React.",
+    "If a superset language is found, exclude the subset language (e.g. TypeScript over JavaScript).",
+    "If a meta-framework is used, exclude the framework it builds on (e.g. Next.js over React, Rails over Rack).",
     "Return the exact version",
     "Exclude things like CSS frameworks, build tools, or testing frameworks",
     'Use as few tools as possible, but do not guess. If you cant find the answer, say "unknown"',
@@ -2675,31 +3210,31 @@ var detectLanguage = () => runAgent({
 });
 
 // src/actions/analyzeCodebase.ts
-import z17 from "zod";
+import z20 from "zod";
 var READONLY_TOOLS = [
   "listFiles",
   "changeDirectory",
   "readFile",
   "searchFiles"
 ];
-var ingestionAnalysisSchema = z17.object({
-  ingestionAnalysis: z17.array(
-    z17.object({
-      name: z17.string(),
-      paths: z17.array(z17.string()),
+var ingestionAnalysisSchema = z20.object({
+  ingestionAnalysis: z20.array(
+    z20.object({
+      name: z20.string(),
+      paths: z20.array(z20.string()),
       // indexable fields the agent found for this entity
-      attributes: z17.array(z17.string())
+      attributes: z20.array(z20.string())
     })
   )
 });
-var searchImplementationAnalysisSchema = z17.object({
-  searchImplementationAnalysis: z17.string()
+var searchImplementationAnalysisSchema = z20.object({
+  searchImplementationAnalysis: z20.string()
 });
-var verificationSchema = z17.object({
-  verification: z17.array(z17.string())
+var verificationSchema = z20.object({
+  verification: z20.array(z20.string())
 });
 var confirmedEntitiesFieldSchema = ingestionAnalysisSchema.shape.ingestionAnalysis.optional();
-var analyzeCodebaseSchema = z17.object({
+var analyzeCodebaseSchema = z20.object({
   ingestionAnalysis: ingestionAnalysisSchema.shape.ingestionAnalysis.optional(),
   searchImplementationAnalysis: searchImplementationAnalysisSchema.shape.searchImplementationAnalysis.optional(),
   verification: verificationSchema.shape.verification.optional(),
@@ -2761,7 +3296,7 @@ async function runAnalysis(mode, extraInstructions = []) {
 // package.json
 var package_default = {
   name: "@algolia/wizard",
-  version: "0.9.0-rc.84.75",
+  version: "0.9.0-rc.87.83",
   description: "Magically implement Algolia functionality in your codebase",
   type: "module",
   engines: {
@@ -2809,7 +3344,6 @@ var package_default = {
   dependencies: {
     "@ai-sdk/anthropic": "^3.0.81",
     "@ai-sdk/openai-compatible": "^2.0.47",
-    "@algolia/cli": "^5.11.0",
     "@hono/node-server": "^2.0.10",
     "@segment/analytics-node": "^3.1.0",
     ai: "^6.0.190",
@@ -2823,7 +3357,6 @@ var package_default = {
     nanoid: "^5.1.15",
     pino: "^10.3.1",
     react: "^19.2.7",
-    toml: "^4.1.1",
     varlock: "^1.5.1",
     zod: "^4.4.3",
     zustand: "^5.0.14"
@@ -2881,8 +3414,8 @@ async function askList(ctx, prompt, { required = false } = {}) {
 }
 
 // src/actions/confirmLanguage.ts
-import z19 from "zod";
-var confirmLanguageSchema = z19.object({
+import z22 from "zod";
+var confirmLanguageSchema = z22.object({
   languages: detectLanguageSchema.shape.languages
 });
 async function confirmLanguage(ctx) {
@@ -2903,17 +3436,19 @@ async function confirmLanguage(ctx) {
 }
 
 // src/actions/confirmFramework.ts
-import z20 from "zod";
-var confirmFrameworkSchema = z20.object({
+import z23 from "zod";
+var confirmFrameworkSchema = z23.object({
   frameworks: detectLanguageSchema.shape.frameworks
 });
 var CURATED_FRAMEWORKS = [
   "Next.js",
   "React",
   "Vue",
-  "Angular",
-  "Svelte",
-  "Vanilla JS"
+  "Vanilla JS",
+  "Django",
+  "Laravel",
+  "Rails",
+  "Symfony"
 ];
 var OTHER_OPTION = "Other";
 var normalize = (s) => s.toLowerCase().replace(/[^a-z0-9]/g, "");
@@ -2926,12 +3461,15 @@ var FRAMEWORK_ALIASES = {
   vuejs: "vue",
   angular: "angular",
   angularjs: "angular",
-  svelte: "svelte",
-  sveltekit: "svelte",
   vanillajs: "vanillajs",
   vanilla: "vanillajs",
   javascript: "vanillajs",
-  js: "vanillajs"
+  js: "vanillajs",
+  django: "django",
+  laravel: "laravel",
+  rails: "rails",
+  rubyonrails: "rails",
+  symfony: "symfony"
 };
 var isSameFramework = (a, b) => {
   const x = FRAMEWORK_ALIASES[normalize(a)] ?? normalize(a);
@@ -3032,8 +3570,8 @@ async function promptUser(ctx, params) {
 }
 
 // src/actions/confirmEntities.ts
-import z21 from "zod";
-var confirmEntitiesSchema = z21.object({
+import z24 from "zod";
+var confirmEntitiesSchema = z24.object({
   // Final detection — the focused re-run may supersede project-scan's.
   ingestionAnalysis: ingestionAnalysisSchema.shape.ingestionAnalysis.optional(),
   confirmedEntities: confirmedEntitiesFieldSchema
@@ -3103,15 +3641,15 @@ async function confirmEntities(ctx) {
 }
 
 // src/actions/review.ts
-import { z as z22 } from "zod";
-var reviewSchema = z22.object({
+import { z as z25 } from "zod";
+var reviewSchema = z25.object({
   // Broad, high-level takeaways grouped by theme (e.g. ingestion, search UI),
   // not one entry per workflow step — a step's raw output can be a long,
   // multi-paragraph blob (see implement.ts's summaries.join), and mirroring
   // that 1:1 is what made the old per-step summary an unreadable wall of text.
-  summaryPoints: z22.array(z22.string()),
-  reviewPrompt: z22.string(),
-  nextSteps: z22.array(z22.string())
+  summaryPoints: z25.array(z25.string()),
+  reviewPrompt: z25.string(),
+  nextSteps: z25.array(z25.string())
 });
 function formatCompletedSteps(steps) {
   if (!steps.length) return "(no prior steps completed)";
@@ -3162,19 +3700,12 @@ ${formatCompletedSteps(ctx.completedSteps)}`,
 };
 
 // src/actions/implement.ts
-import z24 from "zod";
+import z26 from "zod";
 
 // src/lib/worktree.ts
-import { execFile, spawn as spawn3 } from "node:child_process";
-import { copyFile, mkdir as mkdir6, readdir as readdir3, readFile as readFile8, stat as stat2, writeFile as writeFile6 } from "node:fs/promises";
-import {
-  basename as basename2,
-  dirname as dirname7,
-  isAbsolute as isAbsolute2,
-  join as join10,
-  relative as relative2,
-  resolve as resolve3
-} from "node:path";
+import { execFile } from "node:child_process";
+import { copyFile, mkdir as mkdir6, readdir as readdir3, readFile as readFile6, stat as stat2, writeFile as writeFile6 } from "node:fs/promises";
+import { basename as basename2, dirname as dirname7, isAbsolute as isAbsolute2, join as join8, resolve as resolve3 } from "node:path";
 var MAX_BUFFER = 32 * 1024 * 1024;
 var MAX_WIZARD_WORKTREES = 3;
 var WIZARD_BRANCH_PREFIX = "wizard/implement-";
@@ -3205,7 +3736,7 @@ async function isWorkingTreeDirty(repoRoot) {
   return out.trim().length > 0;
 }
 async function pruneOldWorktrees(repoRoot) {
-  const dir = join10(stateDir(repoRoot), "worktrees");
+  const dir = join8(stateDir(repoRoot), "worktrees");
   const stale = (await readdir3(dir).catch(() => [])).filter((name) => /^wizard-implement-\d+$/.test(name)).sort().reverse().slice(MAX_WIZARD_WORKTREES - 1);
   for (const slug of stale) {
     const branch = slug.replace("wizard-implement-", WIZARD_BRANCH_PREFIX);
@@ -3216,7 +3747,7 @@ async function pruneOldWorktrees(repoRoot) {
         "worktree",
         "remove",
         "--force",
-        join10(dir, slug)
+        join8(dir, slug)
       ]);
       await git(["-C", repoRoot, "branch", "-D", branch]);
     } catch (err) {
@@ -3230,113 +3761,13 @@ async function pruneOldWorktrees(repoRoot) {
 async function createWorktree(repoRoot) {
   const branch = `${WIZARD_BRANCH_PREFIX}${Date.now()}`;
   const dirSlug = branch.replace(/\//g, "-");
-  const path = join10(stateDir(repoRoot), "worktrees", dirSlug);
+  const path = join8(stateDir(repoRoot), "worktrees", dirSlug);
   await git(["-C", repoRoot, "worktree", "prune"]);
   await pruneOldWorktrees(repoRoot);
   await mkdir6(dirname7(path), { recursive: true });
   await git(["-C", repoRoot, "worktree", "add", "-b", branch, path, "HEAD"]);
   return { path, branch };
 }
-async function installWorktreeDeps(worktreePath) {
-  try {
-    await readPackageJson(worktreePath);
-  } catch {
-    return { ok: true, output: "no package.json; skipped install" };
-  }
-  const pm = await detectPackageManager(worktreePath);
-  return new Promise((resolve4) => {
-    let output = "";
-    const child = spawn3(pm, ["install"], {
-      cwd: worktreePath,
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    child.stdout?.on("data", (d) => output += d);
-    child.stderr?.on("data", (d) => output += d);
-    child.on(
-      "error",
-      (err) => resolve4({
-        ok: false,
-        output: `Failed to run ${pm} install: ${err.message}`
-      })
-    );
-    child.on(
-      "close",
-      (code) => resolve4({ ok: code === 0, output: output.trim() })
-    );
-  });
-}
-var INGEST_RUNTIMES = ["node", "python", "python3", "bun"];
-function validateIngestEntrypoint(worktreePath, entrypoint) {
-  if (!entrypoint || entrypoint.startsWith("-")) {
-    return {
-      ok: false,
-      reason: `entrypoint "${entrypoint}" is not a plain file path`
-    };
-  }
-  const target = resolve3(worktreePath, entrypoint);
-  const rel = relative2(worktreePath, target);
-  if (rel.startsWith("..") || isAbsolute2(rel)) {
-    return {
-      ok: false,
-      reason: `entrypoint "${entrypoint}" resolves outside the worktree`
-    };
-  }
-  return { ok: true, target };
-}
-async function runIngestScript(worktreePath, runtime, entrypoint, env = {}) {
-  if (!INGEST_RUNTIMES.includes(runtime)) {
-    return {
-      ran: false,
-      ok: false,
-      output: "",
-      reason: `runtime "${runtime}" is not an allowed interpreter (${INGEST_RUNTIMES.join(", ")})`
-    };
-  }
-  const validated = validateIngestEntrypoint(worktreePath, entrypoint);
-  if (!validated.ok) {
-    return { ran: false, ok: false, output: "", reason: validated.reason };
-  }
-  try {
-    if (!(await stat2(validated.target)).isFile()) {
-      return {
-        ran: false,
-        ok: false,
-        output: "",
-        reason: `entrypoint "${entrypoint}" is not a file`
-      };
-    }
-  } catch {
-    return {
-      ran: false,
-      ok: false,
-      output: "",
-      reason: `entrypoint "${entrypoint}" does not exist`
-    };
-  }
-  return new Promise((resolveRun) => {
-    let output = "";
-    const child = spawn3(runtime, [entrypoint], {
-      cwd: worktreePath,
-      shell: false,
-      stdio: ["ignore", "pipe", "pipe"],
-      env: { ...process.env, ...env }
-    });
-    child.stdout?.on("data", (d) => output += d);
-    child.stderr?.on("data", (d) => output += d);
-    child.on(
-      "error",
-      (err) => resolveRun({
-        ran: true,
-        ok: false,
-        output: `Failed to run ${runtime} ${entrypoint}: ${err.message}`
-      })
-    );
-    child.on(
-      "close",
-      (code) => resolveRun({ ran: true, ok: code === 0, output: output.trim() })
-    );
-  });
-}
 async function copyUploadIntoWorktree(repoRoot, worktreePath, ingestDir, sourcePath) {
   const trimmed = sourcePath.trim();
   if (!trimmed) {
@@ -3350,8 +3781,8 @@ async function copyUploadIntoWorktree(repoRoot, worktreePath, ingestDir, sourceP
   } catch {
     return { ok: false, reason: `"${sourcePath}" does not exist` };
   }
-  const relPath = join10(ingestDir, basename2(source));
-  const dest = join10(worktreePath, relPath);
+  const relPath = join8(ingestDir, basename2(source));
+  const dest = join8(worktreePath, relPath);
   try {
     await mkdir6(dirname7(dest), { recursive: true });
     await copyFile(source, dest);
@@ -3366,11 +3797,28 @@ async function copyUploadIntoWorktree(repoRoot, worktreePath, ingestDir, sourceP
 function hasEnvVar(content, name) {
   return new RegExp(`^(\\s*(?:export\\s+)?${name})\\s*=`, "m").test(content);
 }
+async function readEnvVar(worktreePath, name) {
+  let content;
+  try {
+    content = await readFile6(join8(worktreePath, ".env"), "utf8");
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+    return void 0;
+  }
+  const match = new RegExp(
+    `^[ \\t]*(?:export[ \\t]+)?${name}[ \\t]*=[ \\t]*(.*)$`,
+    "m"
+  ).exec(content);
+  if (!match) return void 0;
+  const value = match[1].trim().replace(/^(['"])(.*)\1$/, "$2").trim();
+  if (!value || value.startsWith("<")) return void 0;
+  return value;
+}
 async function writeSearchEnvValues(worktreePath, vars) {
-  const target = join10(worktreePath, ".env");
+  const target = join8(worktreePath, ".env");
   let existing = "";
   try {
-    existing = await readFile8(target, "utf8");
+    existing = await readFile6(target, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
   }
@@ -3438,64 +3886,16 @@ async function confirmDirtyWorkingTree(ctx, repoRoot) {
   }
 }
 
-// src/lib/algoliaApiKey.ts
-import { z as z23 } from "zod";
-var SAFE_ACLS = /* @__PURE__ */ new Set(["search", "browse", "listIndexes"]);
-var apiKeySchema = z23.object({
-  value: z23.string().min(1),
-  acl: z23.array(z23.string()).default([]),
-  indexes: z23.array(z23.string()).default([])
-});
-var apiKeyListSchema = z23.object({
-  items: z23.array(apiKeySchema).optional(),
-  keys: z23.array(apiKeySchema).optional()
-}).transform((o) => o.items ?? o.keys ?? []);
-var createdKeySchema = z23.object({
-  key: z23.string().min(1).optional(),
-  value: z23.string().min(1).optional()
-});
-function canReuse(key, index) {
-  return key.acl.includes("search") && key.acl.every((acl) => SAFE_ACLS.has(acl)) && (key.indexes.length === 0 || key.indexes.includes("*") || key.indexes.includes(index));
-}
-async function createSearchKey(index) {
-  const stdout = await runAlgoliaCli([
-    "apikeys",
-    "create",
-    "--indices",
-    index,
-    "--acl",
-    "search,browse",
-    "--description",
-    `wizard search-only key for ${index}`,
-    "-o",
-    "json"
-  ]);
-  const { key, value } = createdKeySchema.parse(JSON.parse(stdout));
-  const created = key ?? value;
-  if (!created) throw new Error("apikeys create returned no key value");
-  return created;
-}
-async function resolveSearchOnlyKey(index) {
-  const stdout = await runAlgoliaCli(["apikeys", "list", "-o", "json"]);
-  const existing = apiKeyListSchema.parse(JSON.parse(stdout)).find((key) => canReuse(key, index))?.value;
-  if (existing) {
-    logger.info({ index }, "reusing existing search-only API key");
-    return existing;
-  }
-  logger.info({ index }, "no reusable search-only key found; creating one");
-  return createSearchKey(index);
-}
-
 // src/lib/algoliaDocs.ts
-import { readFileSync, readdirSync, existsSync as existsSync2 } from "node:fs";
-import { dirname as dirname8, join as join11 } from "node:path";
+import { readFileSync, readdirSync, existsSync } from "node:fs";
+import { dirname as dirname8, join as join9 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-var DOCS_SUBPATH = join11("docs", "algolia-sdk");
+var DOCS_SUBPATH = join9("docs", "algolia-sdk");
 function findDocsDir() {
   let dir = dirname8(fileURLToPath2(import.meta.url));
   for (; ; ) {
-    const candidate = join11(dir, DOCS_SUBPATH);
-    if (existsSync2(candidate)) return candidate;
+    const candidate = join9(dir, DOCS_SUBPATH);
+    if (existsSync(candidate)) return candidate;
     const parent = dirname8(dir);
     if (parent === dir) return void 0;
     dir = parent;
@@ -3517,7 +3917,7 @@ function loadAlgoliaDoc(language) {
     );
     return "";
   }
-  return readFileSync(join11(docsDir, files[0]), "utf8").trim();
+  return readFileSync(join9(docsDir, files[0]), "utf8").trim();
 }
 function getNamedDoc(name, language) {
   const docsDir = findDocsDir();
@@ -3525,14 +3925,15 @@ function getNamedDoc(name, language) {
     logger.warn("docs/algolia-sdk not found");
     return "";
   }
-  const file = join11(docsDir, `${name}-${language}.md`);
-  if (!existsSync2(file)) {
+  const file = join9(docsDir, `${name}-${language}.md`);
+  if (!existsSync(file)) {
     logger.warn({ name, language }, "named SDK reference not found");
     return "";
   }
   return readFileSync(file, "utf8").trim();
 }
 function getFrameworkSpecificDoc(frameworks) {
+  if (frameworks.length === 0) return "";
   const fw = frameworks.map((f) => f.toLowerCase());
   if (fw.includes("vue") || fw.includes("nuxt")) {
     return loadAlgoliaDoc("vue");
@@ -3540,9 +3941,6 @@ function getFrameworkSpecificDoc(frameworks) {
   if (fw.includes("react") || fw.includes("next.js")) {
     return loadAlgoliaDoc("react");
   }
-  if (fw.includes("angular")) {
-    return loadAlgoliaDoc("angular");
-  }
   return loadAlgoliaDoc("js");
 }
 
@@ -3552,78 +3950,63 @@ function shellQuote(value) {
 }
 
 // src/actions/implement.ts
-var implementSchema = z24.object({
-  filesChanged: z24.array(z24.string()),
-  summary: z24.string(),
-  // Absolute path to the throwaway worktree holding the generated changes, so
-  // the user can open it (`cd <worktreePath>`) or inspect the diff
-  // (`git -C <worktreePath> status/diff`).
-  worktreePath: z24.string().optional(),
-  ingestCommand: z24.string().optional(),
-  // True when the user accepted the run-now prompt and the wizard executed the
-  // ingestion script; downstream steps use this to avoid telling the user to run
-  // a script that already ran.
-  ingestScriptRan: z24.boolean().optional(),
-  // Records ingested by the run-now execution, parsed from the script's
-  // machine-readable count line; absent when the script didn't run or emitted
-  // no parseable count.
-  ingestRecordCount: z24.number().optional(),
-  // Wall-clock duration of the run-now ingestion execution, in ms.
-  ingestDurationMs: z24.number().optional(),
-  ingestionSource: z24.enum(["local", "fileUpload", "generated"]),
-  // Suggested names/values, built from framework detection. The search agent is
-  // instructed to rename the prefix if it doesn't match the project's build
-  // tool, so the names it actually wrote can differ — treat these as hints, not
-  // ground truth (the agent's summary carries the final names).
-  searchEnvVars: z24.array(
-    z24.object({
-      name: z24.string(),
-      value: z24.string()
+var implementSchema = z26.object({
+  filesChanged: z26.array(z26.string()),
+  summary: z26.string(),
+  worktreePath: z26.string().optional(),
+  ingestCommand: z26.string().optional(),
+  ingestScriptRan: z26.boolean().optional(),
+  ingestRecordCount: z26.number().optional(),
+  ingestDurationMs: z26.number().optional(),
+  ingestionSource: z26.enum(["local", "fileUpload", "generated"]),
+  searchEnvVars: z26.array(
+    z26.object({
+      name: z26.string(),
+      value: z26.string()
     })
   ).optional()
 });
-var implementationOutputSchema = z24.object({
-  summary: z24.string(),
-  // Ingestion only: how to run the generated script, as a structured pair the
-  // wizard turns into an argv (`<runtime> <entrypoint>`) — never a free-form
-  // command string. `runtime` is constrained to an allowlisted interpreter and
-  // `entrypoint` is validated to a worktree-relative path before execution, so
-  // the agent cannot inject extra commands or swap the interpreter.
-  runtime: z24.enum(INGEST_RUNTIMES).optional(),
-  entrypoint: z24.string().optional()
+var implementationOutputSchema = z26.object({
+  summary: z26.string(),
+  ingestCommand: z26.string().optional()
 });
-var verificationOutputSchema = z24.object({
-  summary: z24.string(),
-  sufficient: z24.boolean(),
-  additionalInstructions: z24.string().optional()
+var verificationOutputSchema = z26.object({
+  summary: z26.string(),
+  sufficient: z26.boolean(),
+  additionalInstructions: z26.string().optional()
 });
 var MAX_IMPLEMENT_VERIFICATION_ATTEMPTS = 3;
 var DEFAULT_IMPLEMENT_USE_CASES = ["ingestion", "search"];
 var INGEST_DIR = ".algolia-wizard";
-function detectUiFramework(language) {
-  const names = language.frameworks.map((f) => f.name.toLowerCase());
-  if (names.some((n) => n.includes("vue") || n.includes("nuxt"))) return "Vue";
-  if (names.some((n) => n.includes("react") || n.includes("next")))
-    return "React";
-  if (names.some((n) => n.includes("angular"))) return "Angular";
-  return "JavaScript";
-}
-function frameworksForDoc(framework) {
-  switch (framework) {
-    case "React":
-      return ["react"];
-    case "Vue":
-      return ["vue"];
-    case "Angular":
-      return ["angular"];
-    case "JavaScript":
-      return [];
-  }
+var JS_LANGUAGES = ["javascript", "typescript", "jsx", "tsx", "node"];
+function lower(entries) {
+  return entries.map((entry) => entry.name.toLowerCase());
 }
-function publicEnvPrefix(language) {
-  const frameworkNames = language.frameworks.map(
-    (framework) => framework.name.toLowerCase()
+function isJsProject(language) {
+  return lower(language.languages).some(
+    (name) => JS_LANGUAGES.some((js) => name.includes(js))
+  );
+}
+var UI_FRAMEWORKS = [
+  { match: ["vue", "nuxt"], target: "Vue", doc: "vue" },
+  { match: ["react", "next"], target: "React", doc: "react" },
+  { match: ["angular"], target: "Angular" }
+];
+function matchUiFramework(language) {
+  const names = lower(language.frameworks);
+  return UI_FRAMEWORKS.find(
+    (ui) => ui.match.some((needle) => names.some((name) => name.includes(needle)))
   );
+}
+function searchUiTarget(language) {
+  return matchUiFramework(language)?.target ?? language.frameworks[0]?.name ?? (isJsProject(language) ? "JavaScript" : "this project");
+}
+function frameworksForDoc(language) {
+  if (!isJsProject(language)) return [];
+  return [matchUiFramework(language)?.doc ?? "js"];
+}
+function publicEnvPrefix(language) {
+  const frameworkNames = lower(language.frameworks);
   if (frameworkNames.some((name) => name.includes("next"))) {
     return "NEXT_PUBLIC_";
   }
@@ -3636,17 +4019,24 @@ function publicEnvPrefix(language) {
   if (frameworkNames.some((name) => name.includes("vite"))) {
     return "VITE_";
   }
-  return "PUBLIC_";
+  return isJsProject(language) ? "PUBLIC_" : "";
+}
+var APP_ID_VAR_SUFFIX = "ALGOLIA_APP_ID";
+var SEARCH_KEY_VAR_SUFFIX = "ALGOLIA_SEARCH_API_KEY";
+function appIdVar(language) {
+  return `${publicEnvPrefix(language)}${APP_ID_VAR_SUFFIX}`;
+}
+function searchKeyVar(language) {
+  return `${publicEnvPrefix(language)}${SEARCH_KEY_VAR_SUFFIX}`;
 }
 function searchEnvVars(language, appId, searchKey) {
-  const prefix = publicEnvPrefix(language);
   return [
     {
-      name: `${prefix}ALGOLIA_APP_ID`,
+      name: appIdVar(language),
       value: appId ?? "<your-algolia-app-id>"
     },
     {
-      name: `${prefix}ALGOLIA_SEARCH_API_KEY`,
+      name: searchKeyVar(language),
       value: searchKey ?? "<your-algolia-search-only-api-key>"
     }
   ];
@@ -3655,7 +4045,10 @@ function baseInstructions(input) {
   return [
     `Target Algolia index: ${input.targetIndex}`,
     `Project languages and frameworks: ${JSON.stringify(input.language)}`,
-    "Make minimal, idiomatic changes; do not touch unrelated code."
+    "Make minimal, idiomatic changes; do not touch unrelated code.",
+    `Commands run through a shell on ${process.platform}. Write commands that work there.`,
+    "Use the project's own tooling for every command \u2014 its package manager, task runner, and test/lint commands. Do not assume a JavaScript toolchain.",
+    "runShell needs the developer to approve each command, so give every call a clear `explanation` naming what it does and any side effect. If a command is rejected, do not retry it \u2014 take a different approach or report the limitation."
   ];
 }
 function sourceSpecificInstructions(input) {
@@ -3667,9 +4060,6 @@ function sourceSpecificInstructions(input) {
       "Add env vars for any local source access (DB URL, API base, file paths) that is not a fixed repo path."
     ],
     fileUpload: [
-      // The wizard already copied the developer's file into the worktree at this
-      // exact path, so the agent must read it directly — never search for or
-      // substitute another file.
       `Records come from the developer's file, already copied into the worktree at "${input.uploadFilePath}". Read and parse that exact file.`,
       "Parse by extension: JSON = array of objects; CSV/TSV = header row maps to keys.",
       "Map parsed columns/fields to the confirmed entity attributes.",
@@ -3678,46 +4068,60 @@ function sourceSpecificInstructions(input) {
     generated: [
       "No real data source exists; use sample records for each confirmed entity.",
       "Call the generateRecord tool once per entity (entityName, attributes, count 20-50); it invents the values and unique objectIDs and writes them to a JSON file in the worktree, returning the file path. Do not write records or objectIDs yourself.",
-      "In the script, read and parse each returned file path at runtime (e.g. JSON.parse(readFileSync(...)) in Node/Bun, json.load(open(...)) in Python) instead of inlining the records as literals.",
+      "In the script, read and parse each returned file path at runtime using your language's standard JSON support, instead of inlining the records as literals.",
       "Add a prominent TODO where the developer swaps the generated records (and the JSON file under `.algolia-wizard/data/`) for their real record source."
     ]
   };
   return byLine[input.ingestionSource];
 }
+function algoliaClientDoc(input) {
+  const doc = getNamedDoc("save-records", "js");
+  if (!doc) return [];
+  if (isJsProject(input.language)) return [doc];
+  return [
+    "The reference below is written in JavaScript. Use it for the method names, arguments, and record shape, then translate to this project's language and its official Algolia client:",
+    doc
+  ];
+}
 function ingestionInstructions(input) {
   return [
     ...input.confirmed && input.confirmed.length ? [
       `Create an ingestion script under "${input.ingestDir}/" at the repo root.`,
       `Ingest only these confirmed entities (name, source paths, attributes): ${JSON.stringify(input.confirmed)}.`,
       `Ingesting writes to Algolia, so the script needs a write API key and App ID \u2014 read them from the ${API_KEY_VAR} and ${APP_ID_VAR} environment variables rather than hardcoding them. The wizard sets these when it runs the script.`,
-      "Use the appropriate Algolia package in the ingestion script. Do not use the raw HTTP API.",
+      "Write the script in the project's primary language, using Algolia's official client for that language. Do not use the raw HTTP API.",
       "After a successful ingest, the script must print exactly one line to stdout in the form `ALGOLIA_WIZARD_RECORD_COUNT=<n>`, where <n> is the total number of records pushed to Algolia. Print it last, on its own line, with no surrounding text.",
-      getNamedDoc("save-records", "js"),
-      'Add algoliasearch to package.json "dependencies" with a valid version range; the wizard installs the worktree deps after you finish.',
+      ...algoliaClientDoc(input),
+      "Install the Algolia client with the project's own package manager via runShell, declaring it in whatever manifest the project uses (e.g. package.json, requirements.txt, Gemfile, go.mod, composer.json) so the dependency is not just installed ad hoc.",
+      'Then run the script yourself via runShell, and report the command you ran as "ingestCommand" so the developer can re-run it. Its explanation must say that running it writes records to Algolia.',
       "The summary should be extremely concise.",
-      `Return how to run the script as two fields, not a command string: "runtime" (one of ${INGEST_RUNTIMES.join(", ")}) and "entrypoint" (the script path relative to the worktree root, e.g. "${input.ingestDir}/ingest.mjs"). The wizard runs \`<runtime> <entrypoint>\` directly, so the entrypoint must be a plain path with no flags or arguments. Write a script one of those interpreters can run as-is.`,
       ...sourceSpecificInstructions(input)
     ] : []
   ];
 }
 function searchInstructions(input) {
-  const doc = getFrameworkSpecificDoc(frameworksForDoc(input.uiFramework));
+  const doc = getFrameworkSpecificDoc(frameworksForDoc(input.language));
   return [
     "Implement an in-app Algolia search experience.",
-    `Build the search UI for ${input.uiFramework}.`,
-    "Follow the Algolia JS SDK reference below for client setup and InstantSearch wiring; prefer it over prior knowledge:",
-    doc,
-    `Add the search UI at ${input.searchLocation ? `"${input.searchLocation}"` : "the best shared, always-rendered layout location (e.g. a header/nav component)"} so it is reachable across the app \u2014 at least a working SearchBox and Hits against the "${input.targetIndex}" index.`,
-    "Read the App ID and a search-only API key from public env vars; never hardcode them. A search-only key is safe to expose client-side.",
-    // appId always resolves (loadActiveProfile throws otherwise); only the
-    // search-only key is best-effort and can fall back to a placeholder.
-    `Values: App ID "${input.appId}", search-only key ${input.searchKey ? `"${input.searchKey}"` : "(placeholder for the developer to fill in)"}.`,
-    // Names are fixed, not the agent's to rename: the wizard writes the
-    // resolved app id / search-only key into ".env" under these exact names
-    // right after this step, so a renamed prefix here would leave the code
+    `Build the search UI for ${input.searchUiTarget}.`,
+    ...doc ? [
+      "Follow the Algolia SDK reference below for client setup and search UI wiring; prefer it over prior knowledge:",
+      doc
+    ] : [
+      "No bundled Algolia SDK reference exists for this stack, so rely on the project's own conventions and Algolia's official client for its language. Do not invent APIs \u2014 keep to the documented search endpoint and its parameters."
+    ],
+    `Add the search UI at ${input.searchLocation ? `"${input.searchLocation}"` : "the best shared, always-rendered layout location (e.g. a header/nav component)"} so it is reachable across the app \u2014 at least a working search input and results list against the "${input.targetIndex}" index.`,
+    "Read the App ID and a search-only API key from env vars; never hardcode them. A search-only key is safe to expose client-side.",
+    // The key is provisioned only after verification passes, so the agent never
+    // sees one. It must also leave .env alone: the wizard reads that file to
+    // decide whether a key already exists, and an agent-invented value there
+    // would be reused as if it were real.
+    `Add Algolia App ID "${input.appId}"; leave the search-only key as a placeholder. Do not create or edit .env \u2014 the wizard writes the resolved key there itself.`,
+    // Not the agent's to rename: the wizard writes these exact names into
+    // ".env" right after this step, so a renamed prefix would leave the code
     // reading a var the wizard never wrote.
-    `Use exactly these public env var names in the code: ${input.searchEnvVars.map(({ name }) => name).join(", ")}.`,
-    'Add any Algolia/InstantSearch packages you import to package.json "dependencies" with a valid version range; the wizard installs them in the worktree after you finish.',
+    `Use exactly these env var names in the code: ${input.searchEnvVars.map(({ name }) => name).join(", ")}.`,
+    "Install any Algolia packages you import with the project's own package manager via runShell, and declare them in the project's dependency manifest.",
     "The summary should be extremely concise; do not mention env var setup or manual testing steps \u2014 the wizard writes the resolved credentials to .env and reports that separately."
   ];
 }
@@ -3725,11 +4129,12 @@ function verificationInstructions(input) {
   return [
     "Verify the Algolia implementation changes in the current worktree.",
     `Verification tools found in the codebase: ${JSON.stringify(input.findings.verification ?? [])}.`,
-    "Call verifyImplementation at least once; it runs every repo-defined lint/typecheck/check script and returns per-check results plus an aggregate ok.",
-    "For issues caused by the implementation, make minimal fixes with writeFile and re-run verifyImplementation.",
-    "Do not make speculative fixes when verifyImplementation cannot run, no checks exist, or failures are unrelated to these changes \u2014 note the limitation in your summary.",
+    "Run the project's own checks (lint, type check, tests) via runShell, using the commands the project actually defines \u2014 its task runner, manifest scripts, or Makefile. Run every check that applies, not just the first.",
+    "This worktree starts with no installed dependencies. If a check fails because packages or modules are missing, install the dependencies via runShell and re-run it rather than changing the code.",
+    "For issues caused by the implementation, make minimal fixes with writeFile and re-run the checks.",
+    "Do not make speculative fixes when no checks exist, a check cannot run, or failures are unrelated to these changes \u2014 note the limitation in your summary.",
     "Do not add new Algolia functionality here; only validate and make minimal correctness fixes.",
-    `Do not modify "${input.ingestDir}/" unless verifyImplementation reports an actionable issue in its files.`,
+    `Do not modify "${input.ingestDir}/" unless a check reports an actionable issue in its files.`,
     "Always call reportStatus with status=success once verification has run, even when sufficient=false.",
     "Set sufficient=true only when the implementation is complete and checks pass (or fail for a clearly unrelated reason).",
     "Set sufficient=false when the implementation is incomplete or has implementation-caused failures; include concrete additionalInstructions for the next pass."
@@ -3750,14 +4155,15 @@ var IMPLEMENT_CONFIG = {
   }
 };
 var useCaseToolMap = {
-  ingestion: [...FS_READ_TOOLS, "writeFile", "writeCredentials", "notifyUser"],
-  search: [...FS_READ_TOOLS, "writeFile", "notifyUser"],
-  verification: [
+  ingestion: [
     ...FS_READ_TOOLS,
     "writeFile",
-    "verifyImplementation",
+    "writeCredentials",
+    "runShell",
     "notifyUser"
-  ]
+  ],
+  search: [...FS_READ_TOOLS, "writeFile", "runShell", "notifyUser"],
+  verification: [...FS_READ_TOOLS, "writeFile", "runShell", "notifyUser"]
 };
 function toolsForUseCase(useCase, ingestionSource) {
   const tools = useCaseToolMap[useCase];
@@ -3780,15 +4186,31 @@ function formatSummary(useCase, summary) {
   const label = useCase === "ingestion" ? "Ingestion" : useCase === "search" ? "Search" : "Verification";
   return `${label}: ${summary}`;
 }
-function buildIngestCommand(worktree, runtime, entrypoint) {
-  return `cd ${shellQuote(worktree)} && ${runtime} ${shellQuote(entrypoint)}`;
-}
 function parseIngestRecordCount(output) {
   const match = output.match(/ALGOLIA_WIZARD_RECORD_COUNT=(\d+)/);
   if (!match) return void 0;
   const count = Number(match[1]);
   return Number.isFinite(count) ? count : void 0;
 }
+function ingestOutcome(executions, ingestCommand) {
+  const newestFirst = [...executions].reverse();
+  const withCount = newestFirst.filter(
+    (e) => parseIngestRecordCount(e.output ?? "") != null
+  );
+  const succeeded = newestFirst.filter((e) => e.approved && e.exitCode === 0);
+  return {
+    run: succeeded.find((e) => e.command === ingestCommand) ?? succeeded.find((e) => withCount.includes(e)),
+    recordCount: parseIngestRecordCount(withCount[0]?.output ?? "")
+  };
+}
+var PLACEHOLDER_WRITE_KEY = "ALGOLIA_WRITE_KEY_PLACEHOLDER";
+function makeToolContext(worktree, env = async () => ({})) {
+  return createToolContext(
+    DEFAULT_TOOL_LIMITS,
+    worktree,
+    createShellContext({ env, approve: storeApproval(worktree) })
+  );
+}
 function verificationRetryInstructions(verification) {
   return [
     `Implementation insufficient. Address these findings before reporting completion: ${verification.additionalInstructions ?? verification.summary}`
@@ -3858,6 +4280,7 @@ async function implement(ctx, useCases = DEFAULT_IMPLEMENT_USE_CASES, existingWo
     }
   }
   const targetIndex = selected?.selection;
+  useWizard.getState().setTargetIndex(targetIndex ?? null);
   await assertGitRepoWithHead(repoRoot);
   if (await isWorkingTreeDirty(repoRoot)) {
     await confirmDirtyWorkingTree(ctx, repoRoot);
@@ -3866,17 +4289,12 @@ async function implement(ctx, useCases = DEFAULT_IMPLEMENT_USE_CASES, existingWo
   const confirmed2 = normalized.confirmedEntities;
   const searchLocation = normalized.searchImplementationAnalysis;
   let appId;
-  let searchKey;
+  let ingestAppId;
   if (useCases.includes("search")) {
-    appId = (await loadActiveProfile()).appId;
-    try {
-      searchKey = await resolveSearchOnlyKey(targetIndex);
-    } catch (err) {
-      logger.warn(
-        { err: err.message },
-        "implement: could not resolve a search-only API key; the agent will scaffold a placeholder"
-      );
-    }
+    appId = (await requireApplication()).id;
+  }
+  if (useCases.includes("ingestion")) {
+    ingestAppId = appId ?? (await requireApplication()).id;
   }
   const worktree = existingWorktreePath ?? (await createWorktree(repoRoot)).path;
   try {
@@ -3908,53 +4326,58 @@ async function implement(ctx, useCases = DEFAULT_IMPLEMENT_USE_CASES, existingWo
       targetIndex,
       language,
       appId,
-      searchKey,
-      searchEnvVars: searchEnvVars(language, appId, searchKey),
+      // Names only: the search-only key is provisioned after verification, so
+      // every value here is still a placeholder when the agent reads them.
+      searchEnvVars: searchEnvVars(language, appId),
       ingestDir: INGEST_DIR,
       ingestionSource,
       uploadFilePath,
-      // language.frameworks already prefers the confirm-framework step output,
-      // so the user's confirmed stack (not just raw detection) picks the flavor.
-      uiFramework: detectUiFramework(language)
+      searchUiTarget: searchUiTarget(language)
     };
     const summaries = [];
     if (uploadWarning) summaries.push(uploadWarning);
+    let envSearchKey;
+    let envAppIdMismatch = false;
+    if (useCases.includes("search") && appId) {
+      const envAppId = await readEnvVar(worktree, appIdVar(language));
+      if (envAppId === appId) {
+        envSearchKey = await readEnvVar(worktree, searchKeyVar(language));
+      } else if (envAppId) {
+        envAppIdMismatch = true;
+        summaries.push(
+          `\u26A0\uFE0F .env already sets ${appIdVar(language)}=${envAppId}, but the active Algolia application is ${appId}. The wizard left those values alone \u2014 update ${appIdVar(language)} and ${searchKeyVar(language)} by hand, or searches will fail.`
+        );
+        logger.warn(
+          { envAppId, appId },
+          "implement: .env holds credentials for a different Algolia application; not reusing its search key"
+        );
+      }
+    }
+    let finalSearchEnvVars = input.searchEnvVars;
     let agentRuns = 0;
-    let ingestRuntime;
-    let ingestEntrypoint;
+    let ingestCommand;
     let ingestScriptRan = false;
     let ingestRecordCount;
     let ingestDurationMs;
-    let installFailed = false;
     let ingestOutcomeMessage;
+    const ingestionTools = ingestAppId ? makeToolContext(worktree, async () => ({
+      [APP_ID_VAR]: ingestAppId,
+      [API_KEY_VAR]: PLACEHOLDER_WRITE_KEY
+    })) : void 0;
+    const searchTools = makeToolContext(worktree);
     async function runImplementationUseCase(currentUseCase, extraInstructions = []) {
       if (agentRuns > 0) ctx.recordStepExecution();
       agentRuns += 1;
-      const result = await runAgent({
+      return runAgent({
         instructions: buildAgentInstructions(
           currentUseCase,
           input,
           extraInstructions
         ),
         tools: toolsForUseCase(currentUseCase, input.ingestionSource),
-        outputSchema: implementationOutputSchema
-      });
-      ctx.notify({
-        messages: [`Installing dependencies for ${currentUseCase}\u2026`]
+        outputSchema: implementationOutputSchema,
+        toolContext: currentUseCase === "ingestion" ? ingestionTools ?? searchTools : searchTools
       });
-      const installLogId = ctx.logStart("installWorktreeDeps", {
-        useCase: currentUseCase
-      });
-      const install = await installWorktreeDeps(worktree);
-      ctx.logEnd(installLogId, install.ok ? "success" : "error");
-      if (!install.ok) {
-        installFailed = true;
-        logger.warn(
-          { useCase: currentUseCase, output: install.output },
-          "implement: dependency install in worktree failed; generated commands may not run until deps are installed"
-        );
-      }
-      return result;
     }
     async function runVerificationUseCase() {
       if (agentRuns > 0) ctx.recordStepExecution();
@@ -3962,111 +4385,55 @@ async function implement(ctx, useCases = DEFAULT_IMPLEMENT_USE_CASES, existingWo
       return runAgent({
         instructions: buildAgentInstructions("verification", input),
         tools: toolsForUseCase("verification"),
-        outputSchema: verificationOutputSchema
+        outputSchema: verificationOutputSchema,
+        toolContext: searchTools
       });
     }
     if (useCases.includes("ingestion")) {
-      const { summary, runtime, entrypoint } = await runImplementationUseCase("ingestion");
-      summaries.push(formatSummary("ingestion", summary));
-      ingestRuntime = runtime;
-      ingestEntrypoint = entrypoint;
-      if (ingestRuntime && ingestEntrypoint && !installFailed) {
-        ctx.clearNotices();
-        const runNow = await ctx.requestUserInput({
-          prompt: `Run the ingestion script now? This writes records to the "${targetIndex}" index.`,
-          promptType: "acceptReject",
-          options: ["Yes", "No"],
-          messages: []
-        }) === true;
-        if (runNow) {
-          const profile = await loadActiveProfile();
-          ctx.notify({ messages: [`Writing records to "${targetIndex}"\u2026`] });
-          const scriptLogId = ctx.logStart("runIngestScript", {
-            runtime: ingestRuntime,
-            entrypoint: ingestEntrypoint
+      const result = await runImplementationUseCase("ingestion");
+      summaries.push(formatSummary("ingestion", result.summary));
+      ingestCommand = result.ingestCommand;
+      const executions = (ingestionTools ?? searchTools).shell.executions;
+      const { run: ingestRun, recordCount } = ingestOutcome(
+        executions,
+        ingestCommand
+      );
+      ingestScriptRan = ingestRun != null;
+      ingestRecordCount = recordCount;
+      ingestDurationMs = ingestRun?.durationMs;
+      if (ingestScriptRan) {
+        ingestOutcomeMessage = `\u2705 Ingestion succeeded${ingestRecordCount != null ? ` \u2014 ${ingestRecordCount} record(s) indexed.` : "."}`;
+        if (ingestRecordCount != null) {
+          track("AI Wizard Ingest Successful", {
+            entity_name: confirmed2?.map((e) => e.name).join(", ") || "unknown",
+            record_count: ingestRecordCount,
+            duration_ms: ingestDurationMs ?? 0
           });
-          const startedAt = Date.now();
-          const run2 = await runIngestScript(
-            worktree,
-            ingestRuntime,
-            ingestEntrypoint,
-            {
-              [APP_ID_VAR]: profile.appId,
-              [API_KEY_VAR]: profile.apiKey
-            }
-          );
-          ctx.logEnd(scriptLogId, run2.ok ? "success" : "error");
-          ingestScriptRan = run2.ran && run2.ok;
-          if (ingestScriptRan) {
-            ingestDurationMs = Date.now() - startedAt;
-            ingestRecordCount = parseIngestRecordCount(run2.output);
-            if (ingestRecordCount != null) {
-              track("AI Wizard Ingest Successful", {
-                entity_name: confirmed2?.map((e) => e.name).join(", ") || "unknown",
-                record_count: ingestRecordCount,
-                duration_ms: ingestDurationMs
-              });
-            }
-          }
-          let summaryLine;
-          let outcomeMessage;
-          if (!run2.ran) {
-            summaryLine = `\u26A0\uFE0F Skipped running the ingestion script: ${run2.reason}`;
-            outcomeMessage = `\u26A0\uFE0F The ingestion script did not run: ${run2.reason}`;
-            logger.warn(
-              {
-                runtime: ingestRuntime,
-                entrypoint: ingestEntrypoint,
-                reason: run2.reason
-              },
-              "implement: refused to auto-run ingestion script"
-            );
-            track("Error", {
-              step: "Push Data",
-              error: `ingestion script skipped: ${run2.reason}`,
-              product_area: "AI Wizard"
-            });
-          } else if (run2.ok) {
-            const status = "Ingestion run: succeeded.";
-            summaryLine = run2.output ? `${status}
-${run2.output}` : status;
-            outcomeMessage = `\u2705 Ingestion succeeded${ingestRecordCount != null ? ` \u2014 ${ingestRecordCount} record(s) indexed.` : "."}`;
-          } else {
-            const status = "\u26A0\uFE0F Ingestion run failed:";
-            summaryLine = run2.output ? `${status}
-${run2.output}` : status;
-            outcomeMessage = `\u274C Ingestion failed.${run2.output ? ` ${run2.output}` : ""}`;
-            logger.warn(
-              {
-                runtime: ingestRuntime,
-                entrypoint: ingestEntrypoint,
-                output: run2.output
-              },
-              "implement: ingestion script run failed"
-            );
-            track("Error", {
-              step: "Push Data",
-              error: run2.output || "ingestion script exited non-zero",
-              product_area: "AI Wizard"
-            });
-          }
-          summaries.push(summaryLine);
-          ingestOutcomeMessage = outcomeMessage;
         }
+      } else {
+        const rejected = executions.some((e) => !e.approved);
+        const reason = rejected ? "you declined to run it" : "no successful run was recorded";
+        ingestOutcomeMessage = `\u26A0\uFE0F Records were not indexed \u2014 ${reason}.${ingestCommand ? " Run the command below when you are ready." : ""}`;
+        summaries.push(`\u26A0\uFE0F The ingestion script did not run: ${reason}.`);
+        logger.warn(
+          { ingestCommand, rejected, commandsRun: executions.length },
+          "implement: ingestion script did not complete successfully"
+        );
+        track("Error", {
+          step: "Push Data",
+          error: `ingestion did not run: ${reason}`,
+          product_area: "AI Wizard"
+        });
       }
       const commandMessages = [`Open the worktree: cd ${shellQuote(worktree)}`];
-      if (ingestRuntime && ingestEntrypoint) {
-        commandMessages.push(
-          `Ingestion command: ${buildIngestCommand(worktree, ingestRuntime, ingestEntrypoint)}`
-        );
+      if (ingestCommand) {
+        commandMessages.push(`Ingestion command: ${ingestCommand}`);
       }
       await ctx.requestUserInput({
-        // No question being asked here, just an acknowledgement — the
-        // continue/decline hints below already say "continue".
         prompt: "",
         promptType: "enterToContinue",
         options: [],
-        messages: ingestOutcomeMessage ? [ingestOutcomeMessage, ...commandMessages] : commandMessages
+        messages: [ingestOutcomeMessage, ...commandMessages]
       });
     }
     if (useCases.includes("search")) {
@@ -4111,7 +4478,29 @@ ${run2.output}` : status;
         }
         extraInstructions = verificationRetryInstructions(verification);
       }
-      const resolvedSearchEnvVars = input.searchEnvVars.filter(
+      let searchKey;
+      let searchKeyError;
+      if (appId) {
+        try {
+          const resolved = await resolveSearchOnlyKey(
+            targetIndex,
+            appId,
+            envSearchKey
+          );
+          searchKey = resolved.key;
+          summaries.push(
+            resolved.source === "created" ? `Created a new search-only Algolia API key for the "${targetIndex}" index in app ${appId} \u2014 safe to expose in frontend code.` : `Reused the existing search-only Algolia API key for the "${targetIndex}" index in app ${appId}.`
+          );
+        } catch (err) {
+          searchKeyError = err.message;
+          logger.warn(
+            { err: searchKeyError },
+            "implement: could not provision a search-only API key; the .env value stays a placeholder"
+          );
+        }
+      }
+      finalSearchEnvVars = searchEnvVars(language, appId, searchKey);
+      const resolvedSearchEnvVars = finalSearchEnvVars.filter(
         (v) => !v.value.startsWith("<")
       );
       if (resolvedSearchEnvVars.length > 0) {
@@ -4122,13 +4511,29 @@ ${run2.output}` : status;
         if (written.length > 0) {
           summaries.push(`Wrote ${written.join(", ")} to .env.`);
         }
+        const stale = [];
+        for (const v of resolvedSearchEnvVars) {
+          if (written.includes(v.name)) continue;
+          const current = await readEnvVar(worktree, v.name);
+          if (current && current !== v.value) stale.push(v);
+        }
+        if (stale.length > 0 && !envAppIdMismatch) {
+          summaries.push(
+            `\u26A0\uFE0F .env already assigns a different value to ${stale.map((v) => `${v.name} (should be ${v.value})`).join(", ")} \u2014 the wizard left it alone. Fix it by hand, or searches will fail.`
+          );
+          logger.warn(
+            { vars: stale.map((v) => v.name) },
+            "implement: .env holds different values for the resolved search credentials; not overwriting them"
+          );
+        }
       }
-      const unresolvedSearchEnvVars = input.searchEnvVars.filter(
+      const unresolvedSearchEnvVars = finalSearchEnvVars.filter(
         (v) => v.value.startsWith("<")
       );
       if (unresolvedSearchEnvVars.length > 0) {
         summaries.push(
-          `Could not resolve a value for ${unresolvedSearchEnvVars.map((v) => v.name).join(", ")} \u2014 fill it in manually in .env.`
+          `Could not resolve a value for ${unresolvedSearchEnvVars.map((v) => v.name).join(", ")} \u2014 fill it in manually in .env.` + // Without the reason the line is a dead end.
+          (searchKeyError ? ` Reason: ${searchKeyError}` : "")
         );
       }
     } else {
@@ -4140,27 +4545,18 @@ ${run2.output}` : status;
         "implement: agent reported success but no files changed in the worktree"
       );
     }
-    if (installFailed) {
-      summaries.push(
-        '\u26A0\uFE0F Dependency install in the worktree failed. Run your package manager install in the worktree before the command below, or it will fail with "Cannot find module".'
-      );
-    }
     return {
       ingestionSource,
       filesChanged,
       summary: summaries.join("\n\n"),
       worktreePath: worktree,
-      ...useCases.includes("ingestion") && ingestRuntime && ingestEntrypoint ? {
-        ingestCommand: buildIngestCommand(
-          worktree,
-          ingestRuntime,
-          ingestEntrypoint
-        ),
+      ...useCases.includes("ingestion") && ingestCommand ? {
+        ingestCommand,
         ingestScriptRan,
         ...ingestRecordCount != null ? { ingestRecordCount } : {},
         ...ingestDurationMs != null ? { ingestDurationMs } : {}
       } : {},
-      ...useCases.includes("search") ? { searchEnvVars: input.searchEnvVars } : {}
+      ...useCases.includes("search") ? { searchEnvVars: finalSearchEnvVars } : {}
     };
   } finally {
     process.chdir(repoRoot);
@@ -4203,8 +4599,8 @@ var defaultWorkflow = {
     defineStep({
       id: "select-index",
       title: "Set up index",
-      outputSchema: z25.object({
-        selection: z25.string()
+      outputSchema: z27.object({
+        selection: z27.string()
       }),
       run: (ctx) => selectIndexStep(ctx)
     }),
@@ -4483,7 +4879,7 @@ function parseCliArgs(argv) {
 
 // src/lib/resetState.ts
 import { readdir as readdir4, rm as rm2 } from "node:fs/promises";
-import { join as join12 } from "node:path";
+import { join as join10 } from "node:path";
 var KEEP = ["wizard.log"];
 async function resetProjectState() {
   const dir = stateDir();
@@ -4495,13 +4891,13 @@ async function resetProjectState() {
   }
   const targets = entries.filter((name) => !KEEP.includes(name));
   await Promise.all(
-    targets.map((name) => rm2(join12(dir, name), { recursive: true, force: true }))
+    targets.map((name) => rm2(join10(dir, name), { recursive: true, force: true }))
   );
   return { dir, removed: targets };
 }
 
 // src/main.tsx
-import { jsx as jsx14 } from "react/jsx-runtime";
+import { jsx as jsx15 } from "react/jsx-runtime";
 async function startup() {
   let args;
   try {
@@ -4550,31 +4946,38 @@ ${formatStepList(workflow)}`);
 }
 async function run(workflow) {
   const store = useWizard.getState();
-  let instance = render(/* @__PURE__ */ jsx14(App, {}), { incrementalRendering: true });
+  const instance = render(/* @__PURE__ */ jsx15(App, {}), { incrementalRendering: true });
+  await store.waitForStart();
   let user = await getUser();
   if (!user) {
-    await instance.waitUntilRenderFlush();
-    instance.cleanup();
+    store.beginAuth();
     try {
       await runAuthLogin();
     } catch (err) {
-      console.error(err instanceof Error ? err.message : String(err));
+      store.setError(err instanceof Error ? err.message : String(err));
+      await instance.waitUntilExit();
       process.exit(1);
     }
-    instance = render(/* @__PURE__ */ jsx14(App, {}), { incrementalRendering: true });
+    store.endAuth();
     user = await getUser();
     if (!user) {
       store.setError(
-        "Authentication completed but no Algolia user was returned. Try running `npx @algolia/cli auth login` directly."
+        "Authentication completed but no Algolia user was returned. Try running `npx @algolia/cli@latest auth login` directly."
       );
       await instance.waitUntilExit();
       process.exit(1);
     }
   }
   store.setUser(user);
-  const profile = await loadActiveProfile();
-  await store.waitForStart();
-  runWorkflow(workflow, profile?.appId);
+  let app;
+  try {
+    app = await ensureApplication();
+  } catch (err) {
+    store.setError(err instanceof Error ? err.message : String(err));
+    await instance.waitUntilExit();
+    process.exit(1);
+  }
+  runWorkflow(workflow, app.id);
 }
 var started = await startup();
 if (typeof started === "number") {