@algolia/wizard 0.9.0-rc.85.78 → 0.9.0-rc.87.86

package/dist/main.js

@@ -4,7 +4,7 @@
 import { render } from "ink";
 
 // src/ui/App.tsx
-import { Box as Box15, Text as Text15, useApp, useInput as useInput6, useWindowSize as useWindowSize8 } from "ink";
+import { Box as Box16, Text as Text16, useApp, useInput as useInput7, useWindowSize as useWindowSize8 } from "ink";
 
 // src/core/store.ts
 import { create } from "zustand";
@@ -13,10 +13,60 @@ import { nanoid } from "nanoid";
 // src/lib/algoliaCli.ts
 import { spawn } from "node:child_process";
 import { z } from "zod";
+
+// src/lib/logger.ts
+import pino from "pino";
+import { join as join2, dirname } from "node:path";
+import { devNull } from "node:os";
+import { mkdirSync, openSync, closeSync } from "node:fs";
+
+// src/core/constants.ts
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+function rootDir() {
+  return process.env.WIZARD_HOME ?? join(homedir(), ".algolia");
+}
+var pinnedRoot;
+function setProjectRoot(cwd) {
+  pinnedRoot = resolve(cwd);
+}
+function projectSlug(cwd = pinnedRoot ?? process.cwd()) {
+  return resolve(cwd).replace(/[/\\:]+/g, "-").replace(/^-+/, "") || "root";
+}
+function stateDir(cwd = pinnedRoot ?? process.cwd()) {
+  return join(rootDir(), projectSlug(cwd));
+}
+
+// src/lib/logger.ts
+var STDERR_FD = 2;
+function resolveDest() {
+  const target = process.env.VITEST ? devNull : process.env.WIZARD_LOG ?? join2(stateDir(), "wizard.log");
+  try {
+    mkdirSync(dirname(target), { recursive: true });
+    closeSync(openSync(target, "a"));
+    return target;
+  } catch {
+    return STDERR_FD;
+  }
+}
+function logDestination() {
+  return pino.destination({ dest: resolveDest(), sync: false });
+}
+var logger = pino(
+  { level: process.env.LOG_LEVEL ?? "info" },
+  logDestination()
+);
+
+// src/lib/algoliaCli.ts
 function npxArgs(args) {
   return ["--yes", "@algolia/cli@latest", ...args];
 }
 var shell = process.platform === "win32";
+function childEnv(withoutAdminKey) {
+  if (!withoutAdminKey) return void 0;
+  const { ALGOLIA_API_KEY: _adminKey, ...rest } = process.env;
+  return rest;
+}
 function lineSplitter(emit) {
   let buffer = "";
   return {
@@ -40,11 +90,14 @@ var stderrSink = (stream, line) => {
   if (stream === "stdout") return;
   wizardSink(stream, line);
 };
-function runAlgoliaCli(args, { onOutput } = {}) {
+function runAlgoliaCli(args, { onOutput, withoutAdminKey } = {}) {
   const store = useWizard.getState();
   const logId = store.logStart("tool", `algolia ${args.join(" ")}`);
   return new Promise((resolve4, reject) => {
-    const child = spawn("npx", npxArgs(args), { shell });
+    const child = spawn("npx", npxArgs(args), {
+      shell,
+      env: childEnv(withoutAdminKey)
+    });
     let stdout = "";
     let stderr = "";
     const splitters = {
@@ -89,6 +142,7 @@ function runAlgoliaCli(args, { onOutput } = {}) {
     },
     (err) => {
       useWizard.getState().logEnd(logId, "error");
+      logger.warn({ err, args }, "Algolia CLI command failed");
       throw err;
     }
   );
@@ -146,45 +200,6 @@ function refreshAuthToken() {
   return inFlightRefresh;
 }
 
-// src/lib/logger.ts
-import pino from "pino";
-import { join as join2, dirname } from "node:path";
-import { devNull } from "node:os";
-import { mkdirSync, openSync, closeSync } from "node:fs";
-
-// src/core/constants.ts
-import { homedir } from "node:os";
-import { join, resolve } from "node:path";
-function rootDir() {
-  return process.env.WIZARD_HOME ?? join(homedir(), ".algolia");
-}
-function projectSlug(cwd = process.cwd()) {
-  return resolve(cwd).replace(/[/\\:]+/g, "-").replace(/^-+/, "") || "root";
-}
-function stateDir(cwd = process.cwd()) {
-  return join(rootDir(), projectSlug(cwd));
-}
-
-// src/lib/logger.ts
-var STDERR_FD = 2;
-function resolveDest() {
-  const target = process.env.VITEST ? devNull : process.env.WIZARD_LOG ?? join2(stateDir(), "wizard.log");
-  try {
-    mkdirSync(dirname(target), { recursive: true });
-    closeSync(openSync(target, "a"));
-    return target;
-  } catch {
-    return STDERR_FD;
-  }
-}
-function logDestination() {
-  return pino.destination({ dest: resolveDest(), sync: false });
-}
-var logger = pino(
-  { level: process.env.LOG_LEVEL ?? "info" },
-  logDestination()
-);
-
 // src/lib/proxyFetch.ts
 var PROXY_BASE_URL = process.env.PROXY_BASE_URL ?? "https://proxy-624203421261.us-east4.run.app";
 var PROXY_AUTH_REJECTED_HEADER = "x-wizard-proxy-auth";
@@ -614,10 +629,13 @@ function Notices() {
 }
 
 // src/ui/PromptInput.tsx
-import { Box as Box7, Text as Text7, useInput as useInput2 } from "ink";
+import { Box as Box8, Text as Text8, useInput as useInput3 } from "ink";
 import TextInput from "ink-text-input";
 import { useState as useState5 } from "react";
 
+// src/ui/CommandApproval.tsx
+import { Box as Box5, Text as Text5, useInput } from "ink";
+
 // src/ui/NextAction.tsx
 import { Box as Box4, Text as Text4 } from "ink";
 import { Fragment, jsx as jsx3, jsxs as jsxs3 } from "react/jsx-runtime";
@@ -641,14 +659,69 @@ function NextAction({
   ] });
 }
 
+// src/ui/CommandApproval.tsx
+import { jsx as jsx4, jsxs as jsxs4 } from "react/jsx-runtime";
+function CommandApproval({
+  command,
+  onDecide
+}) {
+  useInput((input, key) => {
+    if (key.return) onDecide("approve");
+    else if (key.escape) onDecide("reject");
+    else if (input.toLowerCase() === "a") onDecide("always");
+  });
+  return /* @__PURE__ */ jsxs4(Box5, { flexDirection: "column", gap: 1, children: [
+    /* @__PURE__ */ jsx4(Text5, { color: COLORS.primary, bold: true, children: "Run this command?" }),
+    /* @__PURE__ */ jsxs4(
+      Box5,
+      {
+        flexDirection: "column",
+        paddingLeft: 2,
+        borderStyle: "single",
+        borderColor: COLORS.success,
+        borderTop: false,
+        borderBottom: false,
+        borderRight: false,
+        gap: 1,
+        children: [
+          /* @__PURE__ */ jsxs4(Box5, { children: [
+            /* @__PURE__ */ jsx4(Text5, { color: COLORS.muted, children: "$ " }),
+            /* @__PURE__ */ jsx4(Text5, { color: COLORS.strong, wrap: "wrap", children: command.command })
+          ] }),
+          /* @__PURE__ */ jsxs4(Box5, { gap: 1, children: [
+            /* @__PURE__ */ jsx4(Text5, { color: COLORS.muted, children: "in:" }),
+            /* @__PURE__ */ jsx4(Text5, { color: COLORS.muted, wrap: "wrap", children: command.cwd })
+          ] }),
+          command.explanation && /* @__PURE__ */ jsxs4(Box5, { gap: 1, children: [
+            /* @__PURE__ */ jsx4(Text5, { color: COLORS.muted, children: "why:" }),
+            /* @__PURE__ */ jsx4(Text5, { color: COLORS.accent, wrap: "wrap", children: command.explanation })
+          ] })
+        ]
+      }
+    ),
+    /* @__PURE__ */ jsxs4(Box5, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx4(NextAction, { action: "approve", keyHint: "enter" }),
+      /* @__PURE__ */ jsx4(NextAction, { action: "reject", keyHint: "esc", hierarchy: "secondary" }),
+      /* @__PURE__ */ jsx4(
+        NextAction,
+        {
+          action: "approve, and don't ask again for this command",
+          keyHint: "a",
+          hierarchy: "secondary"
+        }
+      )
+    ] })
+  ] });
+}
+
 // src/ui/SelectPrompt.tsx
-import { Box as Box6, Text as Text6, useInput, useWindowSize as useWindowSize5 } from "ink";
+import { Box as Box7, Text as Text7, useInput as useInput2, useWindowSize as useWindowSize5 } from "ink";
 import { useLayoutEffect as useLayoutEffect2, useRef as useRef3, useState as useState4 } from "react";
 
 // src/ui/ScrollView.tsx
-import { Box as Box5, Text as Text5, measureElement as measureElement2, useWindowSize as useWindowSize4 } from "ink";
+import { Box as Box6, Text as Text6, measureElement as measureElement2, useWindowSize as useWindowSize4 } from "ink";
 import { useCallback, useLayoutEffect, useRef as useRef2, useState as useState3 } from "react";
-import { jsxs as jsxs4 } from "react/jsx-runtime";
+import { jsxs as jsxs5 } from "react/jsx-runtime";
 var INDICATOR_ROWS = 2;
 function fittedWidth(node, columns) {
   let left = 0;
@@ -718,14 +791,14 @@ function useScrollWindow({
   };
 }
 function ScrollView({ scroll, children }) {
-  return /* @__PURE__ */ jsxs4(Box5, { ref: scroll.viewportRef, flexDirection: "column", flexGrow: 1, children: [
-    scroll.hiddenAbove > 0 && /* @__PURE__ */ jsxs4(Text5, { color: COLORS.dim, children: [
+  return /* @__PURE__ */ jsxs5(Box6, { ref: scroll.viewportRef, flexDirection: "column", flexGrow: 1, children: [
+    scroll.hiddenAbove > 0 && /* @__PURE__ */ jsxs5(Text6, { color: COLORS.dim, children: [
       "\u2191 ",
       scroll.hiddenAbove,
       " more"
     ] }),
     children,
-    scroll.hiddenBelow > 0 && /* @__PURE__ */ jsxs4(Text5, { color: COLORS.dim, children: [
+    scroll.hiddenBelow > 0 && /* @__PURE__ */ jsxs5(Text6, { color: COLORS.dim, children: [
       "\u2193 ",
       scroll.hiddenBelow,
       " more"
@@ -734,7 +807,7 @@ function ScrollView({ scroll, children }) {
 }
 
 // src/ui/SelectPrompt.tsx
-import { jsx as jsx4, jsxs as jsxs5 } from "react/jsx-runtime";
+import { jsx as jsx5, jsxs as jsxs6 } from "react/jsx-runtime";
 var CANCEL = "cancel";
 var ARROW_WIDTH = 4;
 var COLUMN_GAP = 2;
@@ -796,7 +869,7 @@ function SelectPrompt({
     revealIndex(index);
   }, [index, revealIndex]);
   const visible = rows.slice(scroll.offset, scroll.offset + scroll.capacity);
-  useInput((input, key) => {
+  useInput2((input, key) => {
     if (rows.length === 0) return;
     if (key.upArrow || input === "k") {
       setIndex((i) => (i - 1 + rows.length) % rows.length);
@@ -819,56 +892,56 @@ function SelectPrompt({
       }
     }
   });
-  return /* @__PURE__ */ jsx4(Box6, { ref: containerRef, flexGrow: 1, children: /* @__PURE__ */ jsxs5(Box6, { flexDirection: "column", gap: 1, width, children: [
-    /* @__PURE__ */ jsxs5(Box6, { flexDirection: "column", gap: 1, flexShrink: 0, children: [
-      error && /* @__PURE__ */ jsx4(Text6, { color: COLORS.danger, children: error }),
-      messages?.map((m, i) => /* @__PURE__ */ jsx4(Text6, { color: COLORS.muted, children: m }, `msg-${i}`)),
-      table && /* @__PURE__ */ jsx4(Table, { columns: table.columns, rows: table.rows }),
-      /* @__PURE__ */ jsxs5(Box6, { flexDirection: "column", children: [
-        question && /* @__PURE__ */ jsx4(Text6, { color: COLORS.muted, children: question }),
-        helpText && /* @__PURE__ */ jsx4(Text6, { color: COLORS.dim, children: helpText })
+  return /* @__PURE__ */ jsx5(Box7, { ref: containerRef, flexGrow: 1, children: /* @__PURE__ */ jsxs6(Box7, { flexDirection: "column", gap: 1, width, children: [
+    /* @__PURE__ */ jsxs6(Box7, { flexDirection: "column", gap: 1, flexShrink: 0, children: [
+      error && /* @__PURE__ */ jsx5(Text7, { color: COLORS.danger, children: error }),
+      messages?.map((m, i) => /* @__PURE__ */ jsx5(Text7, { color: COLORS.muted, children: m }, `msg-${i}`)),
+      table && /* @__PURE__ */ jsx5(Table, { columns: table.columns, rows: table.rows }),
+      /* @__PURE__ */ jsxs6(Box7, { flexDirection: "column", children: [
+        question && /* @__PURE__ */ jsx5(Text7, { color: COLORS.muted, children: question }),
+        helpText && /* @__PURE__ */ jsx5(Text7, { color: COLORS.dim, children: helpText })
       ] })
     ] }),
-    /* @__PURE__ */ jsx4(ScrollView, { scroll, children: visible.map((option, visibleIndex) => {
+    /* @__PURE__ */ jsx5(ScrollView, { scroll, children: visible.map((option, visibleIndex) => {
       const i = scroll.offset + visibleIndex;
       const highlighted = i === index;
       const isCancel = i === cancelIndex;
       const bullet = multi && !isCancel ? checked.has(i) ? "\u25CF " : "\u25CB " : "";
       const sec = isCancel ? void 0 : secondary?.[i];
       const labelColor = highlighted ? COLORS.highlight.fg : void 0;
-      const label = /* @__PURE__ */ jsxs5(Text6, { color: labelColor, wrap: "truncate", children: [
+      const label = /* @__PURE__ */ jsxs6(Text7, { color: labelColor, wrap: "truncate", children: [
         highlighted ? "\u276F   " : "    ",
         bullet,
         option
       ] });
       const isText = sec?.kind === "text";
-      return /* @__PURE__ */ jsxs5(
-        Box6,
+      return /* @__PURE__ */ jsxs6(
+        Box7,
         {
           width: isText ? "100%" : barWidth,
           paddingX: 1,
           paddingY: 1,
           backgroundColor: highlighted ? COLORS.highlight.bg : void 0,
           children: [
-            /* @__PURE__ */ jsx4(Box6, { width: isText ? labelWidth : barLabelWidth, children: label }),
-            isText && textWidth > 0 && /* @__PURE__ */ jsx4(Box6, { width: textWidth, children: /* @__PURE__ */ jsx4(
-              Text6,
+            /* @__PURE__ */ jsx5(Box7, { width: isText ? labelWidth : barLabelWidth, children: label }),
+            isText && textWidth > 0 && /* @__PURE__ */ jsx5(Box7, { width: textWidth, children: /* @__PURE__ */ jsx5(
+              Text7,
               {
                 wrap: "truncate",
                 color: highlighted ? COLORS.primary : COLORS.muted,
                 children: sec.value
               }
             ) }),
-            sec?.kind === "badge" && /* @__PURE__ */ jsx4(Box6, { width: badgeWidth, justifyContent: "flex-end", children: /* @__PURE__ */ jsx4(Text6, { color: COLORS.badge, wrap: "truncate", children: sec.value }) })
+            sec?.kind === "badge" && /* @__PURE__ */ jsx5(Box7, { width: badgeWidth, justifyContent: "flex-end", children: /* @__PURE__ */ jsx5(Text7, { color: COLORS.badge, wrap: "truncate", children: sec.value }) })
           ]
         },
         `row-${i}`
       );
     }) }),
-    /* @__PURE__ */ jsx4(Box6, { flexShrink: 0, children: /* @__PURE__ */ jsx4(Text6, { children: hints.map(({ key, label }, i) => /* @__PURE__ */ jsxs5(Text6, { children: [
+    /* @__PURE__ */ jsx5(Box7, { flexShrink: 0, children: /* @__PURE__ */ jsx5(Text7, { children: hints.map(({ key, label }, i) => /* @__PURE__ */ jsxs6(Text7, { children: [
       i > 0 ? "   " : "",
-      /* @__PURE__ */ jsx4(Text6, { color: COLORS.primary, children: key }),
-      /* @__PURE__ */ jsxs5(Text6, { color: COLORS.dim, children: [
+      /* @__PURE__ */ jsx5(Text7, { color: COLORS.primary, children: key }),
+      /* @__PURE__ */ jsxs6(Text7, { color: COLORS.dim, children: [
         " ",
         label
       ] })
@@ -877,23 +950,23 @@ function SelectPrompt({
 }
 
 // src/ui/PromptInput.tsx
-import { jsx as jsx5, jsxs as jsxs6 } from "react/jsx-runtime";
+import { jsx as jsx6, jsxs as jsxs7 } from "react/jsx-runtime";
 var ACCEPT_REJECT_OPTIONS = ["Accept", "Reject"];
 function EnterToContinuePrompt({
   question,
   messages,
   onDecide
 }) {
-  useInput2((_input, key) => {
+  useInput3((_input, key) => {
     if (key.return) onDecide(true);
     else if (key.escape) onDecide(false);
   });
-  return /* @__PURE__ */ jsxs6(Box7, { flexDirection: "column", gap: 1, children: [
-    messages?.map((m, i) => /* @__PURE__ */ jsx5(Text7, { color: COLORS.muted, children: m }, `msg-${i}`)),
-    question && /* @__PURE__ */ jsx5(Text7, { color: COLORS.primary, children: question }),
-    /* @__PURE__ */ jsxs6(Box7, { gap: 1, flexDirection: "column", children: [
-      /* @__PURE__ */ jsx5(NextAction, { action: "continue", keyHint: "enter" }),
-      /* @__PURE__ */ jsx5(NextAction, { action: "decline", keyHint: "esc", hierarchy: "secondary" })
+  return /* @__PURE__ */ jsxs7(Box8, { flexDirection: "column", gap: 1, children: [
+    messages?.map((m, i) => /* @__PURE__ */ jsx6(Text8, { color: COLORS.muted, children: m }, `msg-${i}`)),
+    question && /* @__PURE__ */ jsx6(Text8, { color: COLORS.primary, children: question }),
+    /* @__PURE__ */ jsxs7(Box8, { gap: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsx6(NextAction, { action: "continue", keyHint: "enter" }),
+      /* @__PURE__ */ jsx6(NextAction, { action: "decline", keyHint: "esc", hierarchy: "secondary" })
     ] })
   ] });
 }
@@ -901,11 +974,11 @@ function PromptInput() {
   const { phase, inputReq, submitInput } = useWizard();
   const [draft, setDraft] = useState5("");
   if (phase === "done" || phase === "error") {
-    return /* @__PURE__ */ jsx5(Box7, { marginTop: 1, children: /* @__PURE__ */ jsx5(Text7, { color: "gray", dimColor: true, children: "Press Enter or Esc to exit" }) });
+    return /* @__PURE__ */ jsx6(Box8, { marginTop: 1, children: /* @__PURE__ */ jsx6(Text8, { color: "gray", dimColor: true, children: "Press Enter or Esc to exit" }) });
   }
   if (phase !== "awaitingInput" || !inputReq) return null;
   if (inputReq.promptType === "multipleChoice") {
-    return /* @__PURE__ */ jsx5(Box7, { flexGrow: 1, children: /* @__PURE__ */ jsx5(
+    return /* @__PURE__ */ jsx6(Box8, { flexGrow: 1, children: /* @__PURE__ */ jsx6(
       SelectPrompt,
       {
         question: inputReq.prompt,
@@ -922,7 +995,7 @@ function PromptInput() {
     ) });
   }
   if (inputReq.promptType === "multiSelect") {
-    return /* @__PURE__ */ jsx5(Box7, { flexGrow: 1, children: /* @__PURE__ */ jsx5(
+    return /* @__PURE__ */ jsx6(Box8, { flexGrow: 1, children: /* @__PURE__ */ jsx6(
       SelectPrompt,
       {
         multi: true,
@@ -937,7 +1010,7 @@ function PromptInput() {
     ) });
   }
   if (inputReq.promptType === "notice") {
-    return /* @__PURE__ */ jsx5(Box7, { flexGrow: 1, children: /* @__PURE__ */ jsx5(
+    return /* @__PURE__ */ jsx6(Box8, { flexGrow: 1, children: /* @__PURE__ */ jsx6(
       SelectPrompt,
       {
         question: inputReq.prompt,
@@ -948,7 +1021,7 @@ function PromptInput() {
     ) });
   }
   if (inputReq.promptType === "enterToContinue") {
-    return /* @__PURE__ */ jsx5(
+    return /* @__PURE__ */ jsx6(
       EnterToContinuePrompt,
       {
         question: inputReq.prompt,
@@ -957,9 +1030,12 @@ function PromptInput() {
       }
     );
   }
+  if (inputReq.promptType === "commandApproval" && inputReq.command) {
+    return /* @__PURE__ */ jsx6(CommandApproval, { command: inputReq.command, onDecide: submitInput });
+  }
   if (inputReq.promptType === "acceptReject") {
     const labels = inputReq.options?.length ? inputReq.options : ACCEPT_REJECT_OPTIONS;
-    return /* @__PURE__ */ jsx5(Box7, { flexGrow: 1, children: /* @__PURE__ */ jsx5(
+    return /* @__PURE__ */ jsx6(Box8, { flexGrow: 1, children: /* @__PURE__ */ jsx6(
       SelectPrompt,
       {
         question: inputReq.prompt,
@@ -970,15 +1046,15 @@ function PromptInput() {
       }
     ) });
   }
-  return /* @__PURE__ */ jsxs6(Box7, { flexDirection: "column", children: [
-    inputReq.error && /* @__PURE__ */ jsx5(Text7, { color: COLORS.danger, children: inputReq.error }),
-    inputReq.messages?.map((m, i) => /* @__PURE__ */ jsx5(Text7, { color: COLORS.muted, children: m }, `msg-${i}`)),
-    /* @__PURE__ */ jsxs6(Box7, { children: [
-      /* @__PURE__ */ jsxs6(Text7, { color: COLORS.primary, children: [
+  return /* @__PURE__ */ jsxs7(Box8, { flexDirection: "column", children: [
+    inputReq.error && /* @__PURE__ */ jsx6(Text8, { color: COLORS.danger, children: inputReq.error }),
+    inputReq.messages?.map((m, i) => /* @__PURE__ */ jsx6(Text8, { color: COLORS.muted, children: m }, `msg-${i}`)),
+    /* @__PURE__ */ jsxs7(Box8, { children: [
+      /* @__PURE__ */ jsxs7(Text8, { color: COLORS.primary, children: [
         inputReq.prompt,
         " "
       ] }),
-      /* @__PURE__ */ jsx5(
+      /* @__PURE__ */ jsx6(
         TextInput,
         {
           value: draft,
@@ -996,7 +1072,7 @@ function PromptInput() {
 // src/ui/Welcome.tsx
 import { dirname as dirname2, join as join3 } from "node:path";
 import { fileURLToPath } from "node:url";
-import { Box as Box8, Spacer, Text as Text8, useInput as useInput3, useWindowSize as useWindowSize6 } from "ink";
+import { Box as Box9, Spacer, Text as Text9, useInput as useInput4, useWindowSize as useWindowSize6 } from "ink";
 
 // src/ui/copy/welcome.ts
 var sidebarItems = [
@@ -1009,12 +1085,12 @@ var sidebarItems = [
     description: "push 100 records to Algolia in seconds"
   },
   {
-    title: "detect your framework",
-    description: "React, Vue, Angular, Vanilla JS"
+    title: "detect your stack",
+    description: "whatever language and framework you already use"
   },
   {
     title: "scaffold a search UI",
-    description: "a styled InstantSearch component, wired into your app"
+    description: "a search box and results, wired into your app"
   },
   {
     title: "ship it",
@@ -1024,20 +1100,20 @@ var sidebarItems = [
 
 // src/ui/Welcome.tsx
 import Image, { InkPictureProvider } from "ink-picture";
-import { jsx as jsx6, jsxs as jsxs7 } from "react/jsx-runtime";
+import { jsx as jsx7, jsxs as jsxs8 } from "react/jsx-runtime";
 var IMAGE_PATH = join3(dirname2(fileURLToPath(import.meta.url)), "algolia.png");
 function SidebarItem({
   title,
   description
 }) {
-  return /* @__PURE__ */ jsxs7(Box8, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsxs7(Box8, { gap: 1, children: [
-      /* @__PURE__ */ jsx6(Text8, { color: COLORS.success, children: "\u2192" }),
-      /* @__PURE__ */ jsx6(Text8, { color: COLORS.strong, bold: true, children: title })
+  return /* @__PURE__ */ jsxs8(Box9, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsxs8(Box9, { gap: 1, children: [
+      /* @__PURE__ */ jsx7(Text9, { color: COLORS.success, children: "\u2192" }),
+      /* @__PURE__ */ jsx7(Text9, { color: COLORS.strong, bold: true, children: title })
     ] }),
-    /* @__PURE__ */ jsxs7(Box8, { flexDirection: "row", gap: 2, children: [
-      /* @__PURE__ */ jsx6(Spacer, {}),
-      /* @__PURE__ */ jsx6(Text8, { color: COLORS.muted, children: description })
+    /* @__PURE__ */ jsxs8(Box9, { flexDirection: "row", gap: 2, children: [
+      /* @__PURE__ */ jsx7(Spacer, {}),
+      /* @__PURE__ */ jsx7(Text9, { color: COLORS.muted, children: description })
     ] })
   ] });
 }
@@ -1045,7 +1121,7 @@ function Welcome() {
   const confirmStart = useWizard((s) => s.confirmStart);
   const openLearnMore = useWizard((s) => s.openLearnMore);
   const { rows } = useWindowSize6();
-  useInput3((input, key) => {
+  useInput4((input, key) => {
     if (key.return) confirmStart();
     else if (input === "i") openLearnMore();
   });
@@ -1063,16 +1139,16 @@ function Welcome() {
   if (rows < 30) {
     layout = scales["small"];
   }
-  return /* @__PURE__ */ jsxs7(Box8, { flexDirection: "row", justifyContent: "space-between", width: "100%", children: [
-    /* @__PURE__ */ jsx6(
-      Box8,
+  return /* @__PURE__ */ jsxs8(Box9, { flexDirection: "row", justifyContent: "space-between", width: "100%", children: [
+    /* @__PURE__ */ jsx7(
+      Box9,
       {
         paddingY: layout.main.padding.y,
         paddingX: layout.main.padding.x,
         flexDirection: "column",
         justifyContent: "center",
-        children: /* @__PURE__ */ jsxs7(Box8, { flexDirection: "column", gap: 2, children: [
-          /* @__PURE__ */ jsx6(InkPictureProvider, { children: /* @__PURE__ */ jsx6(
+        children: /* @__PURE__ */ jsxs8(Box9, { flexDirection: "column", gap: 2, children: [
+          /* @__PURE__ */ jsx7(InkPictureProvider, { children: /* @__PURE__ */ jsx7(
             Image,
             {
               src: IMAGE_PATH,
@@ -1083,16 +1159,16 @@ function Welcome() {
               protocol: "halfBlock"
             }
           ) }),
-          /* @__PURE__ */ jsx6(Text8, { color: COLORS.muted, children: "\u2726 From zero \u2192 working search in ~10 minutes" }),
-          /* @__PURE__ */ jsxs7(Box8, { gap: 1, flexDirection: "column", children: [
-            /* @__PURE__ */ jsx6(NextAction, { action: "start wizard", keyHint: "enter" }),
-            /* @__PURE__ */ jsx6(NextAction, { action: "learn more", keyHint: "i", hierarchy: "secondary" })
+          /* @__PURE__ */ jsx7(Text9, { color: COLORS.muted, children: "\u2726 From zero \u2192 working search in ~10 minutes" }),
+          /* @__PURE__ */ jsxs8(Box9, { gap: 1, flexDirection: "column", children: [
+            /* @__PURE__ */ jsx7(NextAction, { action: "start wizard", keyHint: "enter" }),
+            /* @__PURE__ */ jsx7(NextAction, { action: "learn more", keyHint: "i", hierarchy: "secondary" })
           ] })
         ] })
       }
     ),
-    /* @__PURE__ */ jsxs7(
-      Box8,
+    /* @__PURE__ */ jsxs8(
+      Box9,
       {
         backgroundColor: COLORS.bg.sidebar,
         width: 40,
@@ -1102,8 +1178,8 @@ function Welcome() {
         flexDirection: "column",
         justifyContent: "center",
         children: [
-          /* @__PURE__ */ jsx6(Text8, { color: COLORS.muted, children: "WHAT THIS WIZARD WILL DO" }),
-          sidebarItems.map((i, idx) => /* @__PURE__ */ jsx6(SidebarItem, { title: i.title, description: i.description }, idx))
+          /* @__PURE__ */ jsx7(Text9, { color: COLORS.muted, children: "WHAT THIS WIZARD WILL DO" }),
+          sidebarItems.map((i, idx) => /* @__PURE__ */ jsx7(SidebarItem, { title: i.title, description: i.description }, idx))
         ]
       }
     )
@@ -1112,7 +1188,7 @@ function Welcome() {
 
 // src/ui/LearnMore.tsx
 import { Fragment as Fragment2 } from "react";
-import { Box as Box9, Text as Text9, useInput as useInput4, useWindowSize as useWindowSize7 } from "ink";
+import { Box as Box10, Text as Text10, useInput as useInput5, useWindowSize as useWindowSize7 } from "ink";
 
 // src/ui/copy/learn-more.ts
 var accessIntro = "Everything runs locally on your machine. Nothing is written or sent without an explicit yes from you.";
@@ -1120,12 +1196,17 @@ var accessItems = [
   {
     tag: "READ",
     title: "Project files",
-    description: "reads package.json, configs & source to detect your stack. Read-only; nothing is uploaded."
+    description: "reads manifests, configs & source to detect your stack. Read-only; nothing is uploaded."
   },
   {
     tag: "WRITE",
     title: "Code changes",
-    description: "creates & edits files (search UI, config). Shown as a diff first \u2014 nothing lands without your approval."
+    description: "creates & edits files (search UI, config) in a throwaway git worktree \u2014 your checkout is never touched."
+  },
+  {
+    tag: "EXEC",
+    title: "Setup commands",
+    description: "runs dependency installs, the ingestion script & your own checks. Every command is shown in full and needs your OK; its output is shown as-is, so a command that prints a secret will display it."
   },
   {
     tag: "NET",
@@ -1135,13 +1216,13 @@ var accessItems = [
   {
     tag: "KEY",
     title: "Credentials",
-    description: "saves your Admin API key to .env and adds it to .gitignore."
+    description: "writes your Algolia app id and a search-only key (safe to expose) to .env in the worktree."
   }
 ];
 var neverItems = [
   "Send your source code to a model or third party",
   "Commit or push to git",
-  "Touch files outside your project directory"
+  "Run a command you haven't approved"
 ];
 var policyLinks = [
   { label: "Terms", url: "https://www.algolia.com/policies/terms" },
@@ -1149,10 +1230,11 @@ var policyLinks = [
 ];
 
 // src/ui/LearnMore.tsx
-import { jsx as jsx7, jsxs as jsxs8 } from "react/jsx-runtime";
+import { jsx as jsx8, jsxs as jsxs9 } from "react/jsx-runtime";
 var TAG_COLORS = {
   READ: COLORS.success,
   WRITE: COLORS.badge,
+  EXEC: COLORS.danger,
   NET: COLORS.accent,
   KEY: COLORS.muted
 };
@@ -1165,12 +1247,12 @@ function NeverLine({
 }) {
   const used = segments.reduce((n, s) => n + s.text.length, 0);
   const rightPad = Math.max(0, width - 2 - NEVER_BOX_PAD_X - used);
-  return /* @__PURE__ */ jsxs8(Text9, { children: [
-    /* @__PURE__ */ jsx7(Text9, { color: COLORS.danger, children: "\u2502" }),
+  return /* @__PURE__ */ jsxs9(Text10, { children: [
+    /* @__PURE__ */ jsx8(Text10, { color: COLORS.danger, children: "\u2502" }),
     " ".repeat(NEVER_BOX_PAD_X),
-    segments.map((s, i) => /* @__PURE__ */ jsx7(Text9, { color: s.color, bold: s.bold, children: s.text }, i)),
+    segments.map((s, i) => /* @__PURE__ */ jsx8(Text10, { color: s.color, bold: s.bold, children: s.text }, i)),
     " ".repeat(rightPad),
-    /* @__PURE__ */ jsx7(Text9, { color: COLORS.danger, children: "\u2502" })
+    /* @__PURE__ */ jsx8(Text10, { color: COLORS.danger, children: "\u2502" })
   ] });
 }
 function LearnMore() {
@@ -1178,12 +1260,12 @@ function LearnMore() {
   const backToHome = useWizard((s) => s.backToHome);
   const { columns } = useWindowSize7();
   const dividerWidth = Math.max(0, columns - PADDING_X * 2);
-  useInput4((_input, key) => {
+  useInput5((_input, key) => {
     if (key.escape) backToHome();
     else if (key.return) confirmStart();
   });
-  return /* @__PURE__ */ jsxs8(
-    Box9,
+  return /* @__PURE__ */ jsxs9(
+    Box10,
     {
       flexDirection: "column",
       paddingX: PADDING_X,
@@ -1191,31 +1273,31 @@ function LearnMore() {
       width: "100%",
       gap: 1,
       children: [
-        /* @__PURE__ */ jsx7(Text9, { color: COLORS.strong, bold: true, children: "What algolia wizard accesses" }),
-        /* @__PURE__ */ jsx7(Text9, { color: COLORS.muted, children: accessIntro }),
-        /* @__PURE__ */ jsx7(Box9, { flexDirection: "column", children: accessItems.map((item) => /* @__PURE__ */ jsxs8(Box9, { flexDirection: "column", marginTop: 1, children: [
-          /* @__PURE__ */ jsx7(Text9, { color: COLORS.border, children: "\u2500".repeat(dividerWidth) }),
-          /* @__PURE__ */ jsxs8(Box9, { flexDirection: "row", gap: 1, marginTop: 1, children: [
-            /* @__PURE__ */ jsx7(Box9, { width: TAG_COLUMN_WIDTH, flexShrink: 0, children: /* @__PURE__ */ jsx7(Text9, { color: TAG_COLORS[item.tag], bold: true, children: `[${item.tag}]` }) }),
-            /* @__PURE__ */ jsx7(Box9, { flexDirection: "column", children: /* @__PURE__ */ jsxs8(Text9, { children: [
-              /* @__PURE__ */ jsx7(Text9, { color: COLORS.strong, bold: true, children: item.title }),
-              /* @__PURE__ */ jsx7(Text9, { color: COLORS.muted, children: ` \u2014 ${item.description}` })
+        /* @__PURE__ */ jsx8(Text10, { color: COLORS.strong, bold: true, children: "What algolia wizard accesses" }),
+        /* @__PURE__ */ jsx8(Text10, { color: COLORS.muted, children: accessIntro }),
+        /* @__PURE__ */ jsx8(Box10, { flexDirection: "column", children: accessItems.map((item) => /* @__PURE__ */ jsxs9(Box10, { flexDirection: "column", marginTop: 1, children: [
+          /* @__PURE__ */ jsx8(Text10, { color: COLORS.border, children: "\u2500".repeat(dividerWidth) }),
+          /* @__PURE__ */ jsxs9(Box10, { flexDirection: "row", gap: 1, marginTop: 1, children: [
+            /* @__PURE__ */ jsx8(Box10, { width: TAG_COLUMN_WIDTH, flexShrink: 0, children: /* @__PURE__ */ jsx8(Text10, { color: TAG_COLORS[item.tag], bold: true, children: `[${item.tag}]` }) }),
+            /* @__PURE__ */ jsx8(Box10, { flexDirection: "column", children: /* @__PURE__ */ jsxs9(Text10, { children: [
+              /* @__PURE__ */ jsx8(Text10, { color: COLORS.strong, bold: true, children: item.title }),
+              /* @__PURE__ */ jsx8(Text10, { color: COLORS.muted, children: ` \u2014 ${item.description}` })
             ] }) })
           ] })
         ] }, item.tag)) }),
-        /* @__PURE__ */ jsxs8(Box9, { marginTop: 1, flexDirection: "column", children: [
-          /* @__PURE__ */ jsx7(Text9, { color: COLORS.danger, children: `\u256D${"\u2500".repeat(Math.max(0, dividerWidth - 2))}\u256E` }),
-          /* @__PURE__ */ jsx7(NeverLine, { width: dividerWidth }),
-          /* @__PURE__ */ jsx7(
+        /* @__PURE__ */ jsxs9(Box10, { marginTop: 1, flexDirection: "column", children: [
+          /* @__PURE__ */ jsx8(Text10, { color: COLORS.danger, children: `\u256D${"\u2500".repeat(Math.max(0, dividerWidth - 2))}\u256E` }),
+          /* @__PURE__ */ jsx8(NeverLine, { width: dividerWidth }),
+          /* @__PURE__ */ jsx8(
             NeverLine,
             {
               width: dividerWidth,
               segments: [{ text: "I NEVER", color: COLORS.danger, bold: true }]
             }
           ),
-          neverItems.map((item) => /* @__PURE__ */ jsxs8(Fragment2, { children: [
-            /* @__PURE__ */ jsx7(NeverLine, { width: dividerWidth }),
-            /* @__PURE__ */ jsx7(
+          neverItems.map((item) => /* @__PURE__ */ jsxs9(Fragment2, { children: [
+            /* @__PURE__ */ jsx8(NeverLine, { width: dividerWidth }),
+            /* @__PURE__ */ jsx8(
               NeverLine,
               {
                 width: dividerWidth,
@@ -1227,24 +1309,24 @@ function LearnMore() {
               }
             )
           ] }, item)),
-          /* @__PURE__ */ jsx7(NeverLine, { width: dividerWidth }),
-          /* @__PURE__ */ jsx7(Text9, { color: COLORS.danger, children: `\u2570${"\u2500".repeat(Math.max(0, dividerWidth - 2))}\u256F` })
+          /* @__PURE__ */ jsx8(NeverLine, { width: dividerWidth }),
+          /* @__PURE__ */ jsx8(Text10, { color: COLORS.danger, children: `\u2570${"\u2500".repeat(Math.max(0, dividerWidth - 2))}\u256F` })
         ] }),
-        /* @__PURE__ */ jsx7(Box9, { marginTop: 1, flexDirection: "column", children: policyLinks.map((link) => /* @__PURE__ */ jsxs8(Box9, { flexDirection: "row", gap: 1, children: [
-          /* @__PURE__ */ jsx7(Text9, { color: COLORS.strong, bold: true, children: `${link.label}:` }),
-          /* @__PURE__ */ jsx7(Text9, { color: COLORS.accent, children: link.url })
+        /* @__PURE__ */ jsx8(Box10, { marginTop: 1, flexDirection: "column", children: policyLinks.map((link) => /* @__PURE__ */ jsxs9(Box10, { flexDirection: "row", gap: 1, children: [
+          /* @__PURE__ */ jsx8(Text10, { color: COLORS.strong, bold: true, children: `${link.label}:` }),
+          /* @__PURE__ */ jsx8(Text10, { color: COLORS.accent, children: link.url })
         ] }, link.label)) }),
-        /* @__PURE__ */ jsxs8(Box9, { marginTop: 1, flexDirection: "row", gap: 3, children: [
-          /* @__PURE__ */ jsxs8(Box9, { flexDirection: "row", gap: 1, children: [
-            /* @__PURE__ */ jsx7(Text9, { color: COLORS.muted, children: "[" }),
-            /* @__PURE__ */ jsx7(Text9, { color: COLORS.primary, children: "esc" }),
-            /* @__PURE__ */ jsx7(Text9, { color: COLORS.muted, children: "] back" })
+        /* @__PURE__ */ jsxs9(Box10, { marginTop: 1, flexDirection: "row", gap: 3, children: [
+          /* @__PURE__ */ jsxs9(Box10, { flexDirection: "row", gap: 1, children: [
+            /* @__PURE__ */ jsx8(Text10, { color: COLORS.muted, children: "[" }),
+            /* @__PURE__ */ jsx8(Text10, { color: COLORS.primary, children: "esc" }),
+            /* @__PURE__ */ jsx8(Text10, { color: COLORS.muted, children: "] back" })
           ] }),
-          /* @__PURE__ */ jsxs8(Box9, { flexDirection: "row", gap: 1, children: [
-            /* @__PURE__ */ jsx7(Text9, { color: COLORS.muted, children: "[" }),
-            /* @__PURE__ */ jsx7(Text9, { color: COLORS.primary, children: "enter" }),
-            /* @__PURE__ */ jsx7(Text9, { color: COLORS.muted, children: "]" }),
-            /* @__PURE__ */ jsx7(Text9, { color: COLORS.success, bold: true, children: "start wizard" })
+          /* @__PURE__ */ jsxs9(Box10, { flexDirection: "row", gap: 1, children: [
+            /* @__PURE__ */ jsx8(Text10, { color: COLORS.muted, children: "[" }),
+            /* @__PURE__ */ jsx8(Text10, { color: COLORS.primary, children: "enter" }),
+            /* @__PURE__ */ jsx8(Text10, { color: COLORS.muted, children: "]" }),
+            /* @__PURE__ */ jsx8(Text10, { color: COLORS.success, bold: true, children: "start wizard" })
           ] })
         ] })
       ]
@@ -1253,10 +1335,10 @@ function LearnMore() {
 }
 
 // src/ui/Sidebar.tsx
-import { Box as Box12, Text as Text12 } from "ink";
+import { Box as Box13, Text as Text13 } from "ink";
 
 // src/ui/Steps.tsx
-import { Box as Box10, Text as Text10 } from "ink";
+import { Box as Box11, Text as Text11 } from "ink";
 import Spinner from "ink-spinner";
 
 // src/core/persistence.ts
@@ -1285,12 +1367,12 @@ async function clearWorkflowState(workflowId) {
 }
 
 // src/ui/Steps.tsx
-import { jsx as jsx8, jsxs as jsxs9 } from "react/jsx-runtime";
+import { jsx as jsx9, jsxs as jsxs10 } from "react/jsx-runtime";
 function Steps() {
   const { steps } = useWizard();
   const visibleSteps = steps.filter(isStepVisible);
-  return /* @__PURE__ */ jsx8(Box10, { flexDirection: "column", gap: 1, children: visibleSteps.map((s) => /* @__PURE__ */ jsx8(Box10, { flexDirection: "column", children: /* @__PURE__ */ jsxs9(Text10, { color: COLORS.status[s.status], children: [
-    s.status === "running" ? /* @__PURE__ */ jsx8(Spinner, { type: "dots" }) : MARKER[s.status],
+  return /* @__PURE__ */ jsx9(Box11, { flexDirection: "column", gap: 1, children: visibleSteps.map((s) => /* @__PURE__ */ jsx9(Box11, { flexDirection: "column", children: /* @__PURE__ */ jsxs10(Text11, { color: COLORS.status[s.status], children: [
+    s.status === "running" ? /* @__PURE__ */ jsx9(Spinner, { type: "dots" }) : MARKER[s.status],
     " ",
     s.title
   ] }) }, s.id)) });
@@ -1299,27 +1381,27 @@ function CurrentStep() {
   const { steps } = useWizard();
   const currentStep = steps.filter(isStepVisible).find((s) => s.status === "running");
   if (!currentStep) return null;
-  return /* @__PURE__ */ jsxs9(Text10, { color: COLORS.status.running, children: [
-    /* @__PURE__ */ jsx8(Spinner, { type: "dots" }),
+  return /* @__PURE__ */ jsxs10(Text11, { color: COLORS.status.running, children: [
+    /* @__PURE__ */ jsx9(Spinner, { type: "dots" }),
     " ",
     ` ${currentStep.title}`
   ] });
 }
 
 // src/ui/Progress.tsx
-import { Box as Box11, Text as Text11 } from "ink";
-import { jsx as jsx9, jsxs as jsxs10 } from "react/jsx-runtime";
+import { Box as Box12, Text as Text12 } from "ink";
+import { jsx as jsx10, jsxs as jsxs11 } from "react/jsx-runtime";
 function Progress() {
   const { steps, currentStepIndex } = useWizard();
   const visibleSteps = steps.filter(isStepVisible);
   if (visibleSteps.length === 0) return null;
   const visibleCountThroughCurrent = steps.slice(0, currentStepIndex + 1).filter(isStepVisible).length;
   const activeStepNumber = Math.max(1, visibleCountThroughCurrent);
-  return /* @__PURE__ */ jsxs10(Box11, { flexDirection: "row", gap: 1, children: [
-    /* @__PURE__ */ jsx9(Text11, { color: COLORS.muted, children: "STEP" }),
-    /* @__PURE__ */ jsx9(Text11, { bold: true, children: activeStepNumber }),
-    /* @__PURE__ */ jsx9(Text11, { bold: true, children: "/" }),
-    /* @__PURE__ */ jsx9(Text11, { bold: true, children: visibleSteps.length })
+  return /* @__PURE__ */ jsxs11(Box12, { flexDirection: "row", gap: 1, children: [
+    /* @__PURE__ */ jsx10(Text12, { color: COLORS.muted, children: "STEP" }),
+    /* @__PURE__ */ jsx10(Text12, { bold: true, children: activeStepNumber }),
+    /* @__PURE__ */ jsx10(Text12, { bold: true, children: "/" }),
+    /* @__PURE__ */ jsx10(Text12, { bold: true, children: visibleSteps.length })
   ] });
 }
 
@@ -1330,10 +1412,10 @@ var sidebarCommands = [
 ];
 
 // src/ui/Sidebar.tsx
-import { jsx as jsx10, jsxs as jsxs11 } from "react/jsx-runtime";
+import { jsx as jsx11, jsxs as jsxs12 } from "react/jsx-runtime";
 function Sidebar() {
-  return /* @__PURE__ */ jsxs11(
-    Box12,
+  return /* @__PURE__ */ jsxs12(
+    Box13,
     {
       backgroundColor: "#14171E",
       width: 30,
@@ -1342,16 +1424,16 @@ function Sidebar() {
       flexDirection: "column",
       justifyContent: "space-between",
       children: [
-        /* @__PURE__ */ jsxs11(Box12, { flexDirection: "column", gap: 1, children: [
-          /* @__PURE__ */ jsx10(Text12, { color: COLORS.muted, children: "PROGRESS" }),
-          /* @__PURE__ */ jsx10(Steps, {})
+        /* @__PURE__ */ jsxs12(Box13, { flexDirection: "column", gap: 1, children: [
+          /* @__PURE__ */ jsx11(Text13, { color: COLORS.muted, children: "PROGRESS" }),
+          /* @__PURE__ */ jsx11(Steps, {})
         ] }),
-        /* @__PURE__ */ jsxs11(Box12, { flexDirection: "column", gap: 1, children: [
-          /* @__PURE__ */ jsx10(Progress, {}),
-          /* @__PURE__ */ jsx10(Box12, { flexDirection: "column", children: sidebarCommands.map((c) => {
-            return /* @__PURE__ */ jsxs11(Box12, { flexDirection: "row", gap: 1, children: [
-              /* @__PURE__ */ jsx10(Text12, { color: COLORS.primary, children: `[${c.keyHint}]` }),
-              /* @__PURE__ */ jsx10(Text12, { color: COLORS.muted, children: c.description })
+        /* @__PURE__ */ jsxs12(Box13, { flexDirection: "column", gap: 1, children: [
+          /* @__PURE__ */ jsx11(Progress, {}),
+          /* @__PURE__ */ jsx11(Box13, { flexDirection: "column", children: sidebarCommands.map((c) => {
+            return /* @__PURE__ */ jsxs12(Box13, { flexDirection: "row", gap: 1, children: [
+              /* @__PURE__ */ jsx11(Text13, { color: COLORS.primary, children: `[${c.keyHint}]` }),
+              /* @__PURE__ */ jsx11(Text13, { color: COLORS.muted, children: c.description })
             ] });
           }) })
         ] })
@@ -1361,12 +1443,12 @@ function Sidebar() {
 }
 
 // src/ui/Ribbon.tsx
-import { Box as Box13, Text as Text13 } from "ink";
-import { jsx as jsx11, jsxs as jsxs12 } from "react/jsx-runtime";
+import { Box as Box14, Text as Text14 } from "ink";
+import { jsx as jsx12, jsxs as jsxs13 } from "react/jsx-runtime";
 function Ribbon() {
   const firstCommand = sidebarCommands[0];
-  return /* @__PURE__ */ jsxs12(
-    Box13,
+  return /* @__PURE__ */ jsxs13(
+    Box14,
     {
       backgroundColor: "#14171E",
       flexDirection: "row",
@@ -1374,11 +1456,11 @@ function Ribbon() {
       paddingX: 2,
       paddingY: 1,
       children: [
-        /* @__PURE__ */ jsx11(Progress, {}),
-        /* @__PURE__ */ jsx11(CurrentStep, {}),
-        /* @__PURE__ */ jsxs12(Box13, { flexDirection: "row", gap: 1, children: [
-          /* @__PURE__ */ jsx11(Text13, { color: COLORS.primary, children: `[${firstCommand.keyHint}]` }),
-          /* @__PURE__ */ jsx11(Text13, { color: COLORS.muted, children: firstCommand.description })
+        /* @__PURE__ */ jsx12(Progress, {}),
+        /* @__PURE__ */ jsx12(CurrentStep, {}),
+        /* @__PURE__ */ jsxs13(Box14, { flexDirection: "row", gap: 1, children: [
+          /* @__PURE__ */ jsx12(Text14, { color: COLORS.primary, children: `[${firstCommand.keyHint}]` }),
+          /* @__PURE__ */ jsx12(Text14, { color: COLORS.muted, children: firstCommand.description })
         ] })
       ]
     }
@@ -1389,8 +1471,8 @@ function Ribbon() {
 import { useState as useState6 } from "react";
 
 // src/ui/Logs.tsx
-import { Box as Box14, Text as Text14, useInput as useInput5 } from "ink";
-import { jsx as jsx12, jsxs as jsxs13 } from "react/jsx-runtime";
+import { Box as Box15, Text as Text15, useInput as useInput6 } from "ink";
+import { jsx as jsx13, jsxs as jsxs14 } from "react/jsx-runtime";
 var KIND_COLOR = {
   tool: COLORS.primary,
   prompt: COLORS.badge
@@ -1421,14 +1503,14 @@ function formatTimestamp(ms) {
 function Logs() {
   const logs = useWizard((s) => s.logs);
   const scroll = useScrollWindow({ itemCount: logs.length, followBottom: true });
-  useInput5((_input, key) => {
+  useInput6((_input, key) => {
     if (key.upArrow) scroll.scrollBy(-1);
     else if (key.downArrow) scroll.scrollBy(1);
   });
   const visible = logs.slice(scroll.offset, scroll.offset + scroll.capacity);
-  return /* @__PURE__ */ jsxs13(Box14, { flexDirection: "column", paddingX: 4, paddingY: 2, flexGrow: 1, children: [
-    logs.length === 0 && /* @__PURE__ */ jsx12(Text14, { color: COLORS.dim, children: "No logs yet." }),
-    /* @__PURE__ */ jsx12(ScrollView, { scroll, children: visible.map((entry) => {
+  return /* @__PURE__ */ jsxs14(Box15, { flexDirection: "column", paddingX: 4, paddingY: 2, flexGrow: 1, children: [
+    logs.length === 0 && /* @__PURE__ */ jsx13(Text15, { color: COLORS.dim, children: "No logs yet." }),
+    /* @__PURE__ */ jsx13(ScrollView, { scroll, children: visible.map((entry) => {
       const timestamp = `[${formatTimestamp(entry.startedAt)}]`;
       const durationText = entry.kind === "tool" && entry.durationMs !== void 0 ? `${entry.durationMs}ms` : "";
       const rawPreview = rawInputText(entry.input);
@@ -1438,14 +1520,14 @@ function Logs() {
       const name = truncate2(entry.name, budget);
       budget -= name.length;
       const preview = rawPreview ? truncate2(rawPreview, budget) : "";
-      return /* @__PURE__ */ jsxs13(Box14, { flexDirection: "row", gap: ROW_GAP, children: [
-        /* @__PURE__ */ jsx12(Text14, { color: COLORS.dim, children: timestamp }),
-        /* @__PURE__ */ jsx12(Text14, { color: logNameColor(entry), wrap: "truncate", children: name }),
-        preview && /* @__PURE__ */ jsx12(Text14, { color: COLORS.dim, wrap: "truncate", children: preview }),
-        durationText && /* @__PURE__ */ jsx12(Text14, { color: COLORS.dim, children: durationText })
+      return /* @__PURE__ */ jsxs14(Box15, { flexDirection: "row", gap: ROW_GAP, children: [
+        /* @__PURE__ */ jsx13(Text15, { color: COLORS.dim, children: timestamp }),
+        /* @__PURE__ */ jsx13(Text15, { color: logNameColor(entry), wrap: "truncate", children: name }),
+        preview && /* @__PURE__ */ jsx13(Text15, { color: COLORS.dim, wrap: "truncate", children: preview }),
+        durationText && /* @__PURE__ */ jsx13(Text15, { color: COLORS.dim, children: durationText })
       ] }, entry.id);
     }) }),
-    /* @__PURE__ */ jsx12(Text14, { color: COLORS.dim, children: "\u2191/\u2193 scroll" })
+    /* @__PURE__ */ jsx13(Text15, { color: COLORS.dim, children: "\u2191/\u2193 scroll" })
   ] });
 }
 
@@ -1637,7 +1719,7 @@ function track(event, payload) {
 }
 
 // src/ui/App.tsx
-import { jsx as jsx13, jsxs as jsxs14 } from "react/jsx-runtime";
+import { jsx as jsx14, jsxs as jsxs15 } from "react/jsx-runtime";
 function App() {
   const { phase, error, homeScreen, currentStepIndex, steps, inputReq } = useWizard();
   const { exit } = useApp();
@@ -1645,7 +1727,7 @@ function App() {
   const [showLogs, setShowLogs] = useState6(false);
   const finished = phase === "done" || phase === "error";
   const currentStep = steps[currentStepIndex];
-  useInput6(
+  useInput7(
     (_input, key) => {
       if (key.return) {
         exit();
@@ -1653,7 +1735,7 @@ function App() {
     },
     { isActive: finished }
   );
-  useInput6((_input, key) => {
+  useInput7((_input, key) => {
     if (phase === "idle" || phase === "authenticating") return;
     if (key.tab) {
       setShowLogs(!showLogs);
@@ -1664,8 +1746,8 @@ function App() {
       });
     }
   });
-  const escOwnedElsewhere = phase === "idle" || phase === "authenticating" || phase === "awaitingInput" && inputReq?.promptType === "enterToContinue";
-  useInput6((_input, key) => {
+  const escOwnedElsewhere = phase === "idle" || phase === "authenticating" || phase === "awaitingInput" && (inputReq?.promptType === "enterToContinue" || inputReq?.promptType === "commandApproval");
+  useInput7((_input, key) => {
     if (escOwnedElsewhere) return;
     if (key.escape) {
       track("AI Wizard Interaction", {
@@ -1684,8 +1766,8 @@ function App() {
     /* Clamped to exactly the viewport: a taller frame makes Ink clear and repaint
        the whole screen, and the scrolling throws off its cursor arithmetic —
        flicker and leftover rows. */
-    /* @__PURE__ */ jsxs14(
-      Box15,
+    /* @__PURE__ */ jsxs15(
+      Box16,
       {
         backgroundColor: COLORS.bg.main,
         flexDirection: "row",
@@ -1693,16 +1775,16 @@ function App() {
         height: scrollsPastViewport ? void 0 : rows,
         overflow: scrollsPastViewport ? "visible" : "hidden",
         children: [
-          mainWindowVisible && /* @__PURE__ */ jsxs14(
-            Box15,
+          mainWindowVisible && /* @__PURE__ */ jsxs15(
+            Box16,
             {
               flexDirection,
               width: "100%",
               maxHeight: rows,
               justifyContent: "space-between",
               children: [
-                showLogs ? /* @__PURE__ */ jsx13(Logs, {}) : /* @__PURE__ */ jsxs14(
-                  Box15,
+                showLogs ? /* @__PURE__ */ jsx14(Logs, {}) : /* @__PURE__ */ jsxs15(
+                  Box16,
                   {
                     flexDirection: "column",
                     paddingX: 4,
@@ -1710,26 +1792,26 @@ function App() {
                     width: showSidebar ? 70 : "100%",
                     flexGrow: 1,
                     children: [
-                      phase === "authenticating" && /* @__PURE__ */ jsxs14(Box15, { flexDirection: "column", marginBottom: 1, children: [
-                        /* @__PURE__ */ jsx13(Text15, { color: COLORS.strong, bold: true, children: "Signing in to Algolia" }),
-                        /* @__PURE__ */ jsx13(Text15, { color: COLORS.muted, children: "A browser window will open \u2014 complete sign-in there." })
+                      phase === "authenticating" && /* @__PURE__ */ jsxs15(Box16, { flexDirection: "column", marginBottom: 1, children: [
+                        /* @__PURE__ */ jsx14(Text16, { color: COLORS.strong, bold: true, children: "Signing in to Algolia" }),
+                        /* @__PURE__ */ jsx14(Text16, { color: COLORS.muted, children: "A browser window will open \u2014 complete sign-in there." })
                       ] }),
-                      /* @__PURE__ */ jsx13(CliOutput, {}),
-                      /* @__PURE__ */ jsx13(Notices, {}),
-                      /* @__PURE__ */ jsx13(PromptInput, {}),
-                      phase === "running" && showSidebar && /* @__PURE__ */ jsx13(Box15, { marginTop: 1, children: /* @__PURE__ */ jsx13(CurrentStep, {}) }),
-                      phase === "error" && error && /* @__PURE__ */ jsx13(Box15, { marginTop: 1, children: /* @__PURE__ */ jsxs14(Text15, { color: COLORS.status.error, children: [
+                      /* @__PURE__ */ jsx14(CliOutput, {}),
+                      /* @__PURE__ */ jsx14(Notices, {}),
+                      /* @__PURE__ */ jsx14(PromptInput, {}),
+                      phase === "running" && showSidebar && /* @__PURE__ */ jsx14(Box16, { marginTop: 1, children: /* @__PURE__ */ jsx14(CurrentStep, {}) }),
+                      phase === "error" && error && /* @__PURE__ */ jsx14(Box16, { marginTop: 1, children: /* @__PURE__ */ jsxs15(Text16, { color: COLORS.status.error, children: [
                         "\u2716 ",
                         error
                       ] }) })
                     ]
                   }
                 ),
-                showSidebar ? /* @__PURE__ */ jsx13(Sidebar, {}) : /* @__PURE__ */ jsx13(Ribbon, {})
+                showSidebar ? /* @__PURE__ */ jsx14(Sidebar, {}) : /* @__PURE__ */ jsx14(Ribbon, {})
               ]
             }
           ),
-          phase === "idle" && (homeScreen === "learnMore" ? /* @__PURE__ */ jsx13(LearnMore, {}) : /* @__PURE__ */ jsx13(Welcome, {}))
+          phase === "idle" && (homeScreen === "learnMore" ? /* @__PURE__ */ jsx14(LearnMore, {}) : /* @__PURE__ */ jsx14(Welcome, {}))
         ]
       }
     )
@@ -1743,17 +1825,17 @@ import "zod";
 import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
 import { join as join5 } from "node:path";
 var configFile = () => join5(stateDir(), "config.json");
-var DEFAULT_CONFIG = {
+var defaultConfig = () => ({
   version: 1,
   aiConsent: false,
   workflowsRun: []
-};
+});
 async function loadConfig() {
   try {
     const raw = await readFile2(configFile(), "utf8");
-    return { ...DEFAULT_CONFIG, ...JSON.parse(raw) };
+    return { ...defaultConfig(), ...JSON.parse(raw) };
   } catch {
-    return { ...DEFAULT_CONFIG };
+    return defaultConfig();
   }
 }
 async function saveConfig(config) {
@@ -1809,7 +1891,7 @@ async function ensureConsent() {
   if (config.aiConsent) return;
   const store = useWizard.getState();
   const answer = await store.requestUserInput({
-    prompt: "Wizard will make AI-authored changes to this repository.",
+    prompt: "Wizard will make AI-authored changes to this repository, and will propose shell commands to set it up. You approve each command before it runs.",
     promptType: "enterToContinue",
     options: []
   });
@@ -2212,9 +2294,9 @@ function listFilesTool(ctx) {
       if (++ctx.counts.list > ctx.limits.list) {
         return `Refused: list limit (${ctx.limits.list}) reached. Stop listing and proceed with the information you already have.`;
       }
-      const resolved = resolveInRoot(ctx, ".");
-      if (!resolved.ok) return resolved.error;
-      const entries = await readdir(resolved.target, { withFileTypes: true });
+      const resolved2 = resolveInRoot(ctx, ".");
+      if (!resolved2.ok) return resolved2.error;
+      const entries = await readdir(resolved2.target, { withFileTypes: true });
       return entries.map((e) => e.isDirectory() ? `${e.name}/` : e.name).join("\n");
     }
   });
@@ -2232,14 +2314,14 @@ function changeDirectoryTool(ctx) {
     }),
     execute: async ({ path }) => {
       logger.info({ path }, "called changeDirectory tool");
-      const resolved = resolveInRoot(ctx, path);
-      if (!resolved.ok) return resolved.error;
+      const resolved2 = resolveInRoot(ctx, path);
+      if (!resolved2.ok) return resolved2.error;
       try {
-        const info = await stat(resolved.target);
+        const info = await stat(resolved2.target);
         if (!info.isDirectory()) {
           return `Error changing directory to ${path}: not a directory`;
         }
-        ctx.cwd = resolved.target;
+        ctx.cwd = resolved2.target;
         return `Changed working directory to ${ctx.cwd}`;
       } catch (err) {
         return `Error changing directory to ${path}: ${err.message}`;
@@ -2304,11 +2386,11 @@ function readFileTool(ctx) {
         return `Refused: read limit (${ctx.limits.read}) reached. Stop reading and proceed with the information you already have.`;
       }
       logger.info({ filePath }, "called readFile tool");
-      const resolved = resolveInRoot(ctx, filePath);
-      if (!resolved.ok) return resolved.error;
+      const resolved2 = resolveInRoot(ctx, filePath);
+      if (!resolved2.ok) return resolved2.error;
       try {
-        const content = await readFile3(resolved.target, "utf8");
-        return isEnvFile(resolved.target) ? redactEnvValues(content) : content;
+        const content = await readFile3(resolved2.target, "utf8");
+        return isEnvFile(resolved2.target) ? redactEnvValues(content) : content;
       } catch (err) {
         return `Error reading ${filePath}: ${err.message}`;
       }
@@ -2330,17 +2412,17 @@ function writeFileTool(ctx) {
     }),
     execute: async ({ filePath, content }) => {
       logger.info({ filePath }, "called writeFile tool");
-      const resolved = resolveInRoot(ctx, filePath);
-      if (resolved.ok === false) return resolved.error;
-      if (isSecretEnvFile(resolved.target)) {
+      const resolved2 = resolveInRoot(ctx, filePath);
+      if (resolved2.ok === false) return resolved2.error;
+      if (isSecretEnvFile(resolved2.target)) {
         return `Refused: ${filePath} holds secrets. Use the writeCredentials tool to set Algolia environment variables, passing this file path.`;
       }
       try {
-        if (await hasSymlinkParent(ctx, resolved.target)) {
-          return `Refused: ${resolved.target} is outside the repo root (${ctx.root}).`;
+        if (await hasSymlinkParent(ctx, resolved2.target)) {
+          return `Refused: ${resolved2.target} is outside the repo root (${ctx.root}).`;
         }
-        await mkdir3(dirname4(resolved.target), { recursive: true });
-        await writeFile3(resolved.target, content, "utf8");
+        await mkdir3(dirname4(resolved2.target), { recursive: true });
+        await writeFile3(resolved2.target, content, "utf8");
         return `Wrote to ${filePath}`;
       } catch (err) {
         return `Error writing ${filePath}: ${err.message}`;
@@ -2357,7 +2439,40 @@ import { dirname as dirname5 } from "node:path";
 
 // src/lib/algoliaApiKey.ts
 import { z as z11 } from "zod";
-var SAFE_ACLS = /* @__PURE__ */ new Set(["search", "browse", "listIndexes"]);
+
+// src/lib/keychain.ts
+import { getPassword, setPassword } from "cross-keychain";
+var SERVICE = "algolia-wizard";
+function account(kind, index, appId) {
+  return `${kind}:${appId}:${index}`;
+}
+async function readStoredKey(kind, index, appId) {
+  try {
+    return await getPassword(SERVICE, account(kind, index, appId));
+  } catch (err) {
+    logger.warn(
+      { err: err.message, kind, index, appId },
+      "could not read the API key from the keychain"
+    );
+    return null;
+  }
+}
+async function storeKey(kind, index, appId, value) {
+  const name = account(kind, index, appId);
+  try {
+    await setPassword(SERVICE, name, value);
+    if (await getPassword(SERVICE, name) !== value) {
+      throw new Error("the keychain did not store the value");
+    }
+  } catch (err) {
+    logger.warn(
+      { err: err.message, kind, index, appId },
+      "could not store the API key in the keychain; the next run will create another"
+    );
+  }
+}
+
+// src/lib/algoliaApiKey.ts
 var WRITE_ACLS = [
   "addObject",
   "deleteObject",
@@ -2365,83 +2480,88 @@ var WRITE_ACLS = [
   "editSettings",
   "listIndexes"
 ];
-var WRITE_ACL_SET = new Set(WRITE_ACLS);
-var apiKeySchema = z11.object({
-  value: z11.string().min(1),
-  acl: z11.array(z11.string()).default([]),
-  indexes: z11.array(z11.string()).default([])
-});
-var apiKeyListSchema = z11.object({
-  items: z11.array(apiKeySchema).optional(),
-  keys: z11.array(apiKeySchema).optional()
-}).transform((o) => o.items ?? o.keys ?? []);
 var createdKeySchema = z11.object({
   key: z11.string().min(1).optional(),
   value: z11.string().min(1).optional()
-});
-function canReuse(key, index) {
-  return key.acl.includes("search") && key.acl.every((acl) => SAFE_ACLS.has(acl)) && (key.indexes.length === 0 || key.indexes.includes("*") || key.indexes.includes(index));
-}
-async function createSearchKey(index) {
-  const stdout = await runAlgoliaCli([
-    "apikeys",
-    "create",
-    "--indices",
-    index,
-    "--acl",
-    "search,browse",
-    "--description",
-    `wizard search-only key for ${index}`,
-    "-o",
-    "json"
-  ]);
-  const { key, value } = createdKeySchema.parse(JSON.parse(stdout));
-  const created = key ?? value;
+}).transform((o) => o.key ?? o.value);
+async function createKey(index, acls, description) {
+  logger.info({ index, acls }, "creating an API key");
+  const stdout = await runAlgoliaCli(
+    [
+      "apikeys",
+      "create",
+      "--acl",
+      acls.join(","),
+      "--indices",
+      index,
+      "--description",
+      description,
+      "-o",
+      "json"
+    ],
+    { withoutAdminKey: true }
+  );
+  let payload;
+  try {
+    payload = JSON.parse(stdout);
+  } catch {
+    throw new Error("apikeys create returned output that is not valid JSON");
+  }
+  const created = createdKeySchema.parse(payload);
   if (!created) throw new Error("apikeys create returned no key value");
   return created;
 }
-function canReuseForWrites(key, index) {
-  return WRITE_ACLS.every((acl) => key.acl.includes(acl)) && key.acl.every((acl) => WRITE_ACL_SET.has(acl)) && key.indexes.includes(index);
+var resolved = /* @__PURE__ */ new Map();
+function forgetResolvedKeys() {
+  resolved.clear();
 }
-async function resolveWriteKey(index) {
-  const stdout = await runAlgoliaCli(["apikeys", "list", "-o", "json"]);
-  const existing = apiKeyListSchema.parse(JSON.parse(stdout)).find((key2) => canReuseForWrites(key2, index))?.value;
-  if (existing) {
-    logger.info({ index }, "reusing existing write API key");
-    return existing;
+function resolveKey(kind, index, appId, acls, description) {
+  const cacheKey = `${kind}:${appId}:${index}`;
+  const cached = resolved.get(cacheKey);
+  if (cached) return cached;
+  const pending = provisionKey(kind, index, appId, acls, description).catch(
+    (err) => {
+      resolved.delete(cacheKey);
+      throw err;
+    }
+  );
+  resolved.set(cacheKey, pending);
+  return pending;
+}
+async function provisionKey(kind, index, appId, acls, description) {
+  const stored = await readStoredKey(kind, index, appId);
+  if (stored) {
+    logger.info({ kind, index, appId }, "reusing the stored API key");
+    return { key: stored, source: "keychain" };
   }
-  logger.info({ index }, "no reusable write key found; creating one");
-  const created = await runAlgoliaCli([
-    "apikeys",
-    "create",
-    "--indices",
+  const key = await createKey(index, acls, description);
+  await storeKey(kind, index, appId, key);
+  return { key, source: "created" };
+}
+function resolveWriteKey(index, appId) {
+  return resolveKey(
+    "write",
     index,
-    "--acl",
-    WRITE_ACLS.join(","),
-    "--description",
-    `wizard write key for ${index}`,
-    "-o",
-    "json"
-  ]);
-  const { key, value } = createdKeySchema.parse(JSON.parse(created));
-  const writeKey = key ?? value;
-  if (!writeKey) throw new Error("apikeys create returned no key value");
-  return writeKey;
-}
-async function resolveSearchOnlyKey(index) {
-  const stdout = await runAlgoliaCli(["apikeys", "list", "-o", "json"]);
-  const existing = apiKeyListSchema.parse(JSON.parse(stdout)).find((key) => canReuse(key, index))?.value;
-  if (existing) {
-    logger.info({ index }, "reusing existing search-only API key");
-    return existing;
-  }
-  logger.info({ index }, "no reusable search-only key found; creating one");
-  return createSearchKey(index);
+    appId,
+    WRITE_ACLS,
+    `Algolia Wizard write key for ${index} index`
+  );
+}
+async function resolveSearchOnlyKey(index, appId, envKey) {
+  if (envKey) return { key: envKey, source: "env" };
+  return resolveKey(
+    "search",
+    index,
+    appId,
+    ["search"],
+    `Algolia Wizard search-only key for ${index} index`
+  );
 }
 
 // src/lib/tools/writeAlgoliaCredentials.ts
 var APP_ID_VAR = "ALGOLIA_APPLICATION_ID";
 var API_KEY_VAR = "ALGOLIA_WRITE_API_KEY";
+var INDEX_NAME_VAR = "ALGOLIA_INDEX_NAME";
 function appendEnv(content, entries) {
   const prefix = content.length > 0 && !content.endsWith("\n") ? "\n" : "";
   const lines = entries.map(([name, value]) => `${name}=${value}
@@ -2451,9 +2571,16 @@ function appendEnv(content, entries) {
 function hasEnv(content, name) {
   return new RegExp(`^(\\s*(?:export\\s+)?${name})\\s*=`, "m").test(content);
 }
+function upsertEnv(content, name, value) {
+  if (!hasEnv(content, name)) return appendEnv(content, [[name, value]]);
+  return content.replace(
+    new RegExp(`^\\s*(?:export\\s+)?${name}\\s*=.*$`, "m"),
+    `${name}=${value}`
+  );
+}
 function writeCredentialsTool(ctx) {
   return tool6({
-    description: `Write the active Algolia credentials (${APP_ID_VAR} and ${API_KEY_VAR}) into the given env file. The credentials come from the selected Algolia application, with a write key scoped to the target index; you only pass the path to the env file (e.g. ".env"). If the file already defines ${APP_ID_VAR} or ${API_KEY_VAR}, the write is skipped and existing values are left untouched.`,
+    description: `Write the active Algolia credentials (${APP_ID_VAR} and ${API_KEY_VAR}) and the target index name (${INDEX_NAME_VAR}) into the given env file. The credentials come from the selected Algolia application, with a write key scoped to the target index; you only pass the path to the env file (e.g. ".env"). Any name the file already defines is left untouched.`,
     inputSchema: z12.object({
       filePath: z12.string().describe(
         'Path to the env file to write credentials into (e.g. ".env")'
@@ -2461,43 +2588,51 @@ function writeCredentialsTool(ctx) {
     }),
     execute: async ({ filePath }) => {
       logger.info({ filePath }, "called writeCredentials tool");
-      const resolved = resolveInRoot(ctx, filePath);
-      if (resolved.ok === false) return resolved.error;
+      const resolved2 = resolveInRoot(ctx, filePath);
+      if (resolved2.ok === false) return resolved2.error;
       const targetIndex = useWizard.getState().targetIndex;
       if (!targetIndex) {
         return "Error: no target index is set for this run, so a scoped write key cannot be provisioned.";
       }
-      let appId;
-      let writeKey;
+      let existing = "";
+      let present;
       try {
-        appId = (await requireApplication()).id;
-        writeKey = await resolveWriteKey(targetIndex);
-      } catch (err) {
-        return `Error: could not resolve Algolia credentials (${err.message}). Ask the user to authenticate with the Algolia CLI first.`;
-      }
-      try {
-        if (await hasSymlinkParent(ctx, resolved.target)) {
-          return `Refused: ${resolved.target} is outside the repo root (${ctx.root}).`;
+        if (await hasSymlinkParent(ctx, resolved2.target)) {
+          return `Refused: ${resolved2.target} is outside the repo root (${ctx.root}).`;
         }
-        let existing = "";
         try {
-          existing = await readFile4(resolved.target, "utf8");
+          existing = await readFile4(resolved2.target, "utf8");
         } catch (err) {
           if (err.code !== "ENOENT") throw err;
         }
-        const present = [APP_ID_VAR, API_KEY_VAR].filter(
+        present = [APP_ID_VAR, API_KEY_VAR].filter(
           (name) => hasEnv(existing, name)
         );
-        if (present.length > 0) {
-          return `Skipped: ${filePath} already defines ${present.join(" and ")}. Leaving existing credentials untouched.`;
+      } catch (err) {
+        return `Error writing credentials to ${filePath}: ${err.message}`;
+      }
+      let credentials = [];
+      if (present.length === 0) {
+        try {
+          const appId = (await requireApplication()).id;
+          credentials = [
+            [APP_ID_VAR, appId],
+            [API_KEY_VAR, (await resolveWriteKey(targetIndex, appId)).key]
+          ];
+        } catch (err) {
+          return `Error: could not resolve Algolia credentials (${err.message}). Ask the user to authenticate with the Algolia CLI first.`;
         }
-        const envWithCredentials = appendEnv(existing, [
-          [APP_ID_VAR, appId],
-          [API_KEY_VAR, writeKey]
-        ]);
-        await mkdir4(dirname5(resolved.target), { recursive: true });
-        await writeFile4(resolved.target, envWithCredentials, "utf8");
-        return `Wrote Algolia credentials to ${filePath}`;
+      }
+      try {
+        const updated = upsertEnv(
+          appendEnv(existing, credentials),
+          INDEX_NAME_VAR,
+          targetIndex
+        );
+        await mkdir4(dirname5(resolved2.target), { recursive: true });
+        await writeFile4(resolved2.target, updated, "utf8");
+        const wrote = `Wrote ${[...credentials.map(([name]) => name), INDEX_NAME_VAR].join(", ")} to ${filePath}`;
+        return present.length > 0 ? `${wrote}. Skipped ${present.join(" and ")}: already defined there.` : wrote;
       } catch (err) {
         return `Error writing credentials to ${filePath}: ${err.message}`;
       }
@@ -2511,11 +2646,19 @@ import z13 from "zod";
 import { readdir as readdir2, readFile as readFile5 } from "node:fs/promises";
 import { join as join7 } from "node:path";
 var MAX_QUERY_LENGTH = 1e3;
+var SKIP_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  "dist",
+  "build",
+  "vendor",
+  "venv",
+  "__pycache__",
+  "target"
+]);
 async function walkFiles(dir) {
-  const skip = /* @__PURE__ */ new Set(["node_modules", ".git", "dist"]);
   const out = [];
   for (const e of await readdir2(dir, { withFileTypes: true })) {
-    if (e.name.startsWith(".") || skip.has(e.name)) continue;
+    if (e.name.startsWith(".") || SKIP_DIRS.has(e.name)) continue;
     const full = join7(dir, e.name);
     if (e.isDirectory()) out.push(...await walkFiles(full));
     else if (e.isFile()) out.push(full);
@@ -2537,8 +2680,8 @@ function searchFilesTool(ctx) {
       if (query.length > MAX_QUERY_LENGTH) {
         return `Refused: query exceeds ${MAX_QUERY_LENGTH} characters. Use a shorter pattern.`;
       }
-      const resolved = resolveInRoot(ctx, path);
-      if (!resolved.ok) return resolved.error;
+      const resolved2 = resolveInRoot(ctx, path);
+      if (!resolved2.ok) return resolved2.error;
       let re;
       try {
         re = new RegExp(query);
@@ -2546,7 +2689,7 @@ function searchFilesTool(ctx) {
         return `Invalid regex: ${err.message}`;
       }
       const matches = [];
-      for (const file of await walkFiles(resolved.target)) {
+      for (const file of await walkFiles(resolved2.target)) {
         let content;
         try {
           content = await readFile5(file, "utf8");
@@ -2569,92 +2712,194 @@ function searchFilesTool(ctx) {
   });
 }
 
-// src/lib/tools/verifyImplementation.ts
+// src/lib/tools/runShell.ts
 import { tool as tool8 } from "ai";
 import z14 from "zod";
+import { relative as relative2 } from "node:path";
 
-// src/lib/tools/utils/runCommand.ts
+// src/lib/tools/utils/runShell.ts
 import { spawn as spawn2 } from "node:child_process";
-function runCommand(command, args, cwd) {
+
+// src/lib/tools/context.ts
+var DEFAULT_TOOL_LIMITS = {
+  list: 10,
+  search: 10,
+  read: 20,
+  match: 100,
+  shell: 30
+};
+var DEFAULT_SHELL_TIMEOUT_MS = 10 * 60 * 1e3;
+async function refuseByDefault() {
+  return "reject";
+}
+function createShellContext(overrides = {}) {
+  return {
+    env: async () => ({}),
+    timeoutMs: DEFAULT_SHELL_TIMEOUT_MS,
+    approved: /* @__PURE__ */ new Set(),
+    executions: [],
+    approve: refuseByDefault,
+    ...overrides
+  };
+}
+function createToolContext(limits = DEFAULT_TOOL_LIMITS, cwd = process.cwd(), shell2 = createShellContext()) {
+  return {
+    root: cwd,
+    cwd,
+    limits: { ...limits },
+    counts: { list: 0, search: 0, read: 0, shell: 0 },
+    shell: shell2
+  };
+}
+
+// src/lib/tools/utils/runShell.ts
+var SIGKILL_DELAY_MS = 5e3;
+var HEAD_CHARS = 4e3;
+var TAIL_CHARS = 8e3;
+function truncateOutput(output) {
+  if (output.length <= HEAD_CHARS + TAIL_CHARS) return output;
+  const omitted = output.length - HEAD_CHARS - TAIL_CHARS;
+  return [
+    output.slice(0, HEAD_CHARS),
+    `
+\u2026 [${omitted} characters omitted] \u2026
+`,
+    output.slice(-TAIL_CHARS)
+  ].join("");
+}
+function runShell(command, opts) {
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_SHELL_TIMEOUT_MS;
+  const startedAt = Date.now();
   return new Promise((resolve4) => {
     let output = "";
-    const child = spawn2(command, args, {
-      cwd,
-      stdio: ["ignore", "pipe", "pipe"]
+    let timedOut = false;
+    let settled = false;
+    const child = spawn2(command, {
+      shell: true,
+      cwd: opts.cwd,
+      stdio: ["ignore", "pipe", "pipe"],
+      env: { ...process.env, ...opts.env }
     });
+    const finish = (exitCode) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      clearTimeout(killTimer);
+      resolve4({
+        exitCode,
+        output: truncateOutput(output.trim()),
+        timedOut,
+        durationMs: Date.now() - startedAt
+      });
+    };
+    let killTimer;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      output += `
+[timed out after ${timeoutMs}ms]`;
+      child.kill("SIGTERM");
+      killTimer = setTimeout(() => child.kill("SIGKILL"), SIGKILL_DELAY_MS);
+    }, timeoutMs);
     child.stdout?.on("data", (d) => output += d);
     child.stderr?.on("data", (d) => output += d);
-    child.on(
-      "error",
-      (err) => resolve4({ code: 1, output: `Failed to run ${command}: ${err.message}` })
-    );
-    child.on("close", (code) => resolve4({ code: code ?? 1, output }));
+    child.on("error", (err) => {
+      output += `Failed to run ${command}: ${err.message}`;
+      finish(1);
+    });
+    child.on("close", (code) => finish(code ?? 1));
   });
 }
 
-// src/lib/tools/utils/packageManager.ts
-import { readFile as readFile6 } from "node:fs/promises";
-import { existsSync } from "node:fs";
-import { join as join8 } from "node:path";
-var LOCKFILES = [
-  ["pnpm-lock.yaml", "pnpm"],
-  ["yarn.lock", "yarn"],
-  ["bun.lockb", "bun"],
-  ["bun.lock", "bun"],
-  ["package-lock.json", "npm"]
-];
-async function readPackageJson(cwd = process.cwd()) {
-  return JSON.parse(await readFile6(join8(cwd, "package.json"), "utf8"));
-}
-function packageManagerFrom(pkg) {
-  return pkg.packageManager?.split("@")[0] ?? "npm";
-}
-function packageManagerFromLockfile(cwd) {
-  return LOCKFILES.find(([file]) => existsSync(join8(cwd, file)))?.[1];
-}
-async function detectPackageManager(cwd) {
-  try {
-    const pkg = await readPackageJson(cwd);
-    if (pkg.packageManager) return packageManagerFrom(pkg);
-  } catch {
-  }
-  return packageManagerFromLockfile(cwd) ?? "npm";
-}
-
-// src/lib/tools/repoVerification.ts
-var VERIFICATION_SCRIPT_CANDIDATES = ["lint", "typecheck", "check"];
-async function runRepoVerificationCheck() {
-  let pkg;
-  try {
-    pkg = await readPackageJson();
-  } catch (err) {
-    const limitation = `Could not read package.json to detect verification conventions: ${err.message}`;
-    return { ok: false, checks: [], limitation };
-  }
-  const scripts = pkg.scripts ?? {};
-  const present = VERIFICATION_SCRIPT_CANDIDATES.filter((s) => s in scripts);
-  if (present.length === 0) {
-    const limitation = `No verification script found in package.json (looked for: ${VERIFICATION_SCRIPT_CANDIDATES.join(", ")}).`;
-    return { ok: false, checks: [], limitation };
-  }
-  const pm = await detectPackageManager(process.cwd());
-  const checks = [];
-  for (const script of present) {
-    const command = `${pm} run ${script}`;
-    const { code, output } = await runCommand(pm, ["run", script]);
-    checks.push({ command, exitCode: code, ok: code === 0, output: output.trim() });
-  }
-  return { ok: checks.every((c) => c.ok), checks };
+// src/lib/tools/runShell.ts
+function approvalKey(cwd, command) {
+  return `${cwd}\0${command}`;
+}
+function storeApproval(root) {
+  return async (req) => {
+    const rel = relative2(root, req.cwd);
+    const answer = await useWizard.getState().requestUserInput({
+      prompt: "Run this command?",
+      promptType: "commandApproval",
+      options: [],
+      command: {
+        ...req,
+        cwd: rel === "" || rel.startsWith("..") ? req.cwd : rel
+      }
+    });
+    return answer === "approve" || answer === "always" ? answer : "reject";
+  };
 }
-
-// src/lib/tools/verifyImplementation.ts
-function verifyImplementationTool() {
+function runShellTool(ctx) {
   return tool8({
-    description: "Run the repo's mechanical verification check for generated implementation changes. Detects lint/typecheck/check from package.json and returns structured pass/fail evidence for the verifier to interpret.",
-    inputSchema: z14.object(),
-    execute: async () => {
-      logger.info("called verifyImplementation tool");
-      return runRepoVerificationCheck();
+    description: "Run a shell command in the project. Use this for anything the project needs done in its own ecosystem: installing dependencies, running a script you wrote, running the project's lint/typecheck/test commands. The user sees and approves every command before it runs, so write a clear `explanation`. If the user rejects a command, do not retry it \u2014 propose a different approach.",
+    inputSchema: z14.object({
+      command: z14.string().describe(
+        "The command to run, exactly as it would be typed in a shell. Pipes, && and redirects are allowed."
+      ),
+      cwd: z14.string().optional().describe(
+        "Directory to run in, relative to the project root. Defaults to the project root."
+      ),
+      explanation: z14.string().describe(
+        "One short line telling the user what this command does and why, including any side effect (e.g. writes records to Algolia). This is what they approve against."
+      )
+    }),
+    execute: async ({ command, cwd, explanation }) => {
+      if (++ctx.counts.shell > ctx.limits.shell) {
+        return `Refused: command limit (${ctx.limits.shell}) reached. Stop running commands and report what you have.`;
+      }
+      const resolved2 = resolveInRoot(ctx, cwd ?? ".");
+      if (!resolved2.ok) return resolved2.error;
+      logger.info({ command, cwd: resolved2.target }, "called runShell tool");
+      const key = approvalKey(resolved2.target, command);
+      const decision = ctx.shell.approved.has(key) ? "approve" : await ctx.shell.approve({
+        command,
+        cwd: resolved2.target,
+        explanation
+      });
+      if (decision === "reject") {
+        ctx.shell.executions.push({
+          command,
+          cwd: resolved2.target,
+          approved: false
+        });
+        logger.info({ command }, "runShell: user rejected the command");
+        return "The user rejected this command. Do not retry it. Propose a different command, or report the limitation via reportStatus.";
+      }
+      if (decision === "always") ctx.shell.approved.add(key);
+      useWizard.getState().pushNotice({ messages: [`Running: ${command}`] });
+      const env = await ctx.shell.env().catch((err) => {
+        logger.warn({ err, command }, "runShell: could not resolve command env");
+        return {};
+      });
+      const run2 = await (ctx.shell.run ?? runShell)(command, {
+        cwd: resolved2.target,
+        env,
+        timeoutMs: ctx.shell.timeoutMs
+      });
+      logger.info(
+        {
+          command,
+          exitCode: run2.exitCode,
+          timedOut: run2.timedOut,
+          durationMs: run2.durationMs
+        },
+        "runShell finished"
+      );
+      await markInteraction();
+      ctx.shell.executions.push({
+        command,
+        cwd: resolved2.target,
+        approved: true,
+        exitCode: run2.exitCode,
+        output: run2.output,
+        timedOut: run2.timedOut,
+        durationMs: run2.durationMs
+      });
+      return {
+        exitCode: run2.exitCode,
+        timedOut: run2.timedOut,
+        output: run2.output
+      };
     }
   });
 }
@@ -2734,18 +2979,18 @@ function generateRecordTool(ctx) {
         }));
         const slug = entityName.toLowerCase().replace(/[^a-z0-9]+/g, "-");
         const relPath = `${DATA_DIR}/${slug}.json`;
-        const resolved = resolveInRoot(ctx, relPath);
-        if (resolved.ok === false) return resolved.error;
-        if (await hasSymlinkParent(ctx, resolved.target)) {
-          return `Refused: ${resolved.target} is outside the repo root (${ctx.root}).`;
+        const resolved2 = resolveInRoot(ctx, relPath);
+        if (resolved2.ok === false) return resolved2.error;
+        if (await hasSymlinkParent(ctx, resolved2.target)) {
+          return `Refused: ${resolved2.target} is outside the repo root (${ctx.root}).`;
         }
-        await mkdir5(dirname6(resolved.target), { recursive: true });
-        await writeFile5(resolved.target, JSON.stringify(records, null, 2), "utf8");
+        await mkdir5(dirname6(resolved2.target), { recursive: true });
+        await writeFile5(resolved2.target, JSON.stringify(records, null, 2), "utf8");
         logger.info({ entityName, count: records.length, relPath }, "generateRecord wrote records to disk");
         return {
           filePath: relPath,
           count: records.length,
-          message: `Wrote ${records.length} records to ${relPath}. Read and parse this file in the script at runtime (e.g. JSON.parse(readFileSync(...)) in Node/Bun, json.load(open(...)) in Python) \u2014 do not inline the records as literals.`
+          message: `Wrote ${records.length} records to ${relPath}. Read and parse this file in the script at runtime using your language's standard JSON support \u2014 do not inline the records as literals.`
         };
       } catch (err) {
         return `Error generating records: ${err.message}`;
@@ -2773,22 +3018,6 @@ function notifyUserTool() {
   });
 }
 
-// src/lib/tools/context.ts
-var DEFAULT_TOOL_LIMITS = {
-  list: 10,
-  search: 10,
-  read: 20,
-  match: 100
-};
-function createToolContext(limits = DEFAULT_TOOL_LIMITS, cwd = process.cwd()) {
-  return {
-    root: cwd,
-    cwd,
-    limits,
-    counts: { list: 0, search: 0, read: 0 }
-  };
-}
-
 // src/lib/tools/index.ts
 function withLogging(name, def) {
   const execute = def.execute;
@@ -2820,10 +3049,7 @@ function createTools(ctx, { output, tools }) {
       writeCredentialsTool(ctx)
     ),
     searchFiles: withLogging("searchFiles", searchFilesTool(ctx)),
-    verifyImplementation: withLogging(
-      "verifyImplementation",
-      verifyImplementationTool()
-    ),
+    runShell: withLogging("runShell", runShellTool(ctx)),
     generateRecord: withLogging("generateRecord", generateRecordTool(ctx)),
     notifyUser: withLogging("notifyUser", notifyUserTool())
   };
@@ -2858,7 +3084,7 @@ async function runAgent(req) {
     baseURL: PROXY_BASE_URL,
     fetch: proxyFetch
   });
-  const toolContext = createToolContext();
+  const toolContext = req.toolContext ?? createToolContext();
   const readTools = ["readFile", "searchFiles", "listFiles"];
   const hasReadTools = !req.tools || req.tools.some((t) => readTools.includes(t));
   const instructions = [
@@ -2923,7 +3149,11 @@ async function runAgent(req) {
     "runAgent finished"
   );
   logger.info(
-    { counts: toolContext.counts, limits: toolContext.limits },
+    {
+      counts: toolContext.counts,
+      limits: toolContext.limits,
+      commandsRun: toolContext.shell.executions.length
+    },
     "tool usage"
   );
   const toolResults = await stream.toolResults;
@@ -2949,8 +3179,8 @@ var detectLanguageSchema = z19.object({
 var detectLanguage = () => runAgent({
   instructions: [
     "Analyze the codebase and determine the programming languages and frameworks used",
-    "If a superset language is found, exclude the subset language. TS-over-JS.",
-    "If a meta-framework is used, exclude the framework. Next-over-React.",
+    "If a superset language is found, exclude the subset language (e.g. TypeScript over JavaScript).",
+    "If a meta-framework is used, exclude the framework it builds on (e.g. Next.js over React, Rails over Rack).",
     "Return the exact version",
     "Exclude things like CSS frameworks, build tools, or testing frameworks",
     'Use as few tools as possible, but do not guess. If you cant find the answer, say "unknown"',
@@ -3048,7 +3278,7 @@ async function runAnalysis(mode, extraInstructions = []) {
 // package.json
 var package_default = {
   name: "@algolia/wizard",
-  version: "0.9.0-rc.85.78",
+  version: "0.9.0-rc.87.86",
   description: "Magically implement Algolia functionality in your codebase",
   type: "module",
   engines: {
@@ -3099,6 +3329,7 @@ var package_default = {
     "@hono/node-server": "^2.0.10",
     "@segment/analytics-node": "^3.1.0",
     ai: "^6.0.190",
+    "cross-keychain": "^1.1.0",
     dotenv: "^17.4.2",
     hono: "^4.12.27",
     ink: "^7.0.5",
@@ -3196,9 +3427,11 @@ var CURATED_FRAMEWORKS = [
   "Next.js",
   "React",
   "Vue",
-  "Angular",
-  "Svelte",
-  "Vanilla JS"
+  "Vanilla JS",
+  "Django",
+  "Laravel",
+  "Rails",
+  "Symfony"
 ];
 var OTHER_OPTION = "Other";
 var normalize = (s) => s.toLowerCase().replace(/[^a-z0-9]/g, "");
@@ -3211,12 +3444,15 @@ var FRAMEWORK_ALIASES = {
   vuejs: "vue",
   angular: "angular",
   angularjs: "angular",
-  svelte: "svelte",
-  sveltekit: "svelte",
   vanillajs: "vanillajs",
   vanilla: "vanillajs",
   javascript: "vanillajs",
-  js: "vanillajs"
+  js: "vanillajs",
+  django: "django",
+  laravel: "laravel",
+  rails: "rails",
+  rubyonrails: "rails",
+  symfony: "symfony"
 };
 var isSameFramework = (a, b) => {
   const x = FRAMEWORK_ALIASES[normalize(a)] ?? normalize(a);
@@ -3450,16 +3686,9 @@ ${formatCompletedSteps(ctx.completedSteps)}`,
 import z26 from "zod";
 
 // src/lib/worktree.ts
-import { execFile, spawn as spawn3 } from "node:child_process";
-import { copyFile, mkdir as mkdir6, readdir as readdir3, readFile as readFile7, stat as stat2, writeFile as writeFile6 } from "node:fs/promises";
-import {
-  basename as basename2,
-  dirname as dirname7,
-  isAbsolute as isAbsolute2,
-  join as join9,
-  relative as relative2,
-  resolve as resolve3
-} from "node:path";
+import { execFile } from "node:child_process";
+import { copyFile, mkdir as mkdir6, readdir as readdir3, readFile as readFile6, stat as stat2, writeFile as writeFile6 } from "node:fs/promises";
+import { basename as basename2, dirname as dirname7, isAbsolute as isAbsolute2, join as join8, resolve as resolve3 } from "node:path";
 var MAX_BUFFER = 32 * 1024 * 1024;
 var MAX_WIZARD_WORKTREES = 3;
 var WIZARD_BRANCH_PREFIX = "wizard/implement-";
@@ -3490,7 +3719,7 @@ async function isWorkingTreeDirty(repoRoot) {
   return out.trim().length > 0;
 }
 async function pruneOldWorktrees(repoRoot) {
-  const dir = join9(stateDir(repoRoot), "worktrees");
+  const dir = join8(stateDir(repoRoot), "worktrees");
   const stale = (await readdir3(dir).catch(() => [])).filter((name) => /^wizard-implement-\d+$/.test(name)).sort().reverse().slice(MAX_WIZARD_WORKTREES - 1);
   for (const slug of stale) {
     const branch = slug.replace("wizard-implement-", WIZARD_BRANCH_PREFIX);
@@ -3501,7 +3730,7 @@ async function pruneOldWorktrees(repoRoot) {
         "worktree",
         "remove",
         "--force",
-        join9(dir, slug)
+        join8(dir, slug)
       ]);
       await git(["-C", repoRoot, "branch", "-D", branch]);
     } catch (err) {
@@ -3515,113 +3744,13 @@ async function pruneOldWorktrees(repoRoot) {
 async function createWorktree(repoRoot) {
   const branch = `${WIZARD_BRANCH_PREFIX}${Date.now()}`;
   const dirSlug = branch.replace(/\//g, "-");
-  const path = join9(stateDir(repoRoot), "worktrees", dirSlug);
+  const path = join8(stateDir(repoRoot), "worktrees", dirSlug);
   await git(["-C", repoRoot, "worktree", "prune"]);
   await pruneOldWorktrees(repoRoot);
   await mkdir6(dirname7(path), { recursive: true });
   await git(["-C", repoRoot, "worktree", "add", "-b", branch, path, "HEAD"]);
   return { path, branch };
 }
-async function installWorktreeDeps(worktreePath) {
-  try {
-    await readPackageJson(worktreePath);
-  } catch {
-    return { ok: true, output: "no package.json; skipped install" };
-  }
-  const pm = await detectPackageManager(worktreePath);
-  return new Promise((resolve4) => {
-    let output = "";
-    const child = spawn3(pm, ["install"], {
-      cwd: worktreePath,
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    child.stdout?.on("data", (d) => output += d);
-    child.stderr?.on("data", (d) => output += d);
-    child.on(
-      "error",
-      (err) => resolve4({
-        ok: false,
-        output: `Failed to run ${pm} install: ${err.message}`
-      })
-    );
-    child.on(
-      "close",
-      (code) => resolve4({ ok: code === 0, output: output.trim() })
-    );
-  });
-}
-var INGEST_RUNTIMES = ["node", "python", "python3", "bun"];
-function validateIngestEntrypoint(worktreePath, entrypoint) {
-  if (!entrypoint || entrypoint.startsWith("-")) {
-    return {
-      ok: false,
-      reason: `entrypoint "${entrypoint}" is not a plain file path`
-    };
-  }
-  const target = resolve3(worktreePath, entrypoint);
-  const rel = relative2(worktreePath, target);
-  if (rel.startsWith("..") || isAbsolute2(rel)) {
-    return {
-      ok: false,
-      reason: `entrypoint "${entrypoint}" resolves outside the worktree`
-    };
-  }
-  return { ok: true, target };
-}
-async function runIngestScript(worktreePath, runtime, entrypoint, env = {}) {
-  if (!INGEST_RUNTIMES.includes(runtime)) {
-    return {
-      ran: false,
-      ok: false,
-      output: "",
-      reason: `runtime "${runtime}" is not an allowed interpreter (${INGEST_RUNTIMES.join(", ")})`
-    };
-  }
-  const validated = validateIngestEntrypoint(worktreePath, entrypoint);
-  if (!validated.ok) {
-    return { ran: false, ok: false, output: "", reason: validated.reason };
-  }
-  try {
-    if (!(await stat2(validated.target)).isFile()) {
-      return {
-        ran: false,
-        ok: false,
-        output: "",
-        reason: `entrypoint "${entrypoint}" is not a file`
-      };
-    }
-  } catch {
-    return {
-      ran: false,
-      ok: false,
-      output: "",
-      reason: `entrypoint "${entrypoint}" does not exist`
-    };
-  }
-  return new Promise((resolveRun) => {
-    let output = "";
-    const child = spawn3(runtime, [entrypoint], {
-      cwd: worktreePath,
-      shell: false,
-      stdio: ["ignore", "pipe", "pipe"],
-      env: { ...process.env, ...env }
-    });
-    child.stdout?.on("data", (d) => output += d);
-    child.stderr?.on("data", (d) => output += d);
-    child.on(
-      "error",
-      (err) => resolveRun({
-        ran: true,
-        ok: false,
-        output: `Failed to run ${runtime} ${entrypoint}: ${err.message}`
-      })
-    );
-    child.on(
-      "close",
-      (code) => resolveRun({ ran: true, ok: code === 0, output: output.trim() })
-    );
-  });
-}
 async function copyUploadIntoWorktree(repoRoot, worktreePath, ingestDir, sourcePath) {
   const trimmed = sourcePath.trim();
   if (!trimmed) {
@@ -3635,8 +3764,8 @@ async function copyUploadIntoWorktree(repoRoot, worktreePath, ingestDir, sourceP
   } catch {
     return { ok: false, reason: `"${sourcePath}" does not exist` };
   }
-  const relPath = join9(ingestDir, basename2(source));
-  const dest = join9(worktreePath, relPath);
+  const relPath = join8(ingestDir, basename2(source));
+  const dest = join8(worktreePath, relPath);
   try {
     await mkdir6(dirname7(dest), { recursive: true });
     await copyFile(source, dest);
@@ -3651,11 +3780,28 @@ async function copyUploadIntoWorktree(repoRoot, worktreePath, ingestDir, sourceP
 function hasEnvVar(content, name) {
   return new RegExp(`^(\\s*(?:export\\s+)?${name})\\s*=`, "m").test(content);
 }
+async function readEnvVar(worktreePath, name) {
+  let content;
+  try {
+    content = await readFile6(join8(worktreePath, ".env"), "utf8");
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+    return void 0;
+  }
+  const match = new RegExp(
+    `^[ \\t]*(?:export[ \\t]+)?${name}[ \\t]*=[ \\t]*(.*)$`,
+    "m"
+  ).exec(content);
+  if (!match) return void 0;
+  const value = match[1].trim().replace(/^(['"])(.*)\1$/, "$2").trim();
+  if (!value || value.startsWith("<")) return void 0;
+  return value;
+}
 async function writeSearchEnvValues(worktreePath, vars) {
-  const target = join9(worktreePath, ".env");
+  const target = join8(worktreePath, ".env");
   let existing = "";
   try {
-    existing = await readFile7(target, "utf8");
+    existing = await readFile6(target, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
   }
@@ -3724,15 +3870,15 @@ async function confirmDirtyWorkingTree(ctx, repoRoot) {
 }
 
 // src/lib/algoliaDocs.ts
-import { readFileSync, readdirSync, existsSync as existsSync2 } from "node:fs";
-import { dirname as dirname8, join as join10 } from "node:path";
+import { readFileSync, readdirSync, existsSync } from "node:fs";
+import { dirname as dirname8, join as join9 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-var DOCS_SUBPATH = join10("docs", "algolia-sdk");
+var DOCS_SUBPATH = join9("docs", "algolia-sdk");
 function findDocsDir() {
   let dir = dirname8(fileURLToPath2(import.meta.url));
   for (; ; ) {
-    const candidate = join10(dir, DOCS_SUBPATH);
-    if (existsSync2(candidate)) return candidate;
+    const candidate = join9(dir, DOCS_SUBPATH);
+    if (existsSync(candidate)) return candidate;
     const parent = dirname8(dir);
     if (parent === dir) return void 0;
     dir = parent;
@@ -3754,7 +3900,7 @@ function loadAlgoliaDoc(language) {
     );
     return "";
   }
-  return readFileSync(join10(docsDir, files[0]), "utf8").trim();
+  return readFileSync(join9(docsDir, files[0]), "utf8").trim();
 }
 function getNamedDoc(name, language) {
   const docsDir = findDocsDir();
@@ -3762,14 +3908,15 @@ function getNamedDoc(name, language) {
     logger.warn("docs/algolia-sdk not found");
     return "";
   }
-  const file = join10(docsDir, `${name}-${language}.md`);
-  if (!existsSync2(file)) {
+  const file = join9(docsDir, `${name}-${language}.md`);
+  if (!existsSync(file)) {
     logger.warn({ name, language }, "named SDK reference not found");
     return "";
   }
   return readFileSync(file, "utf8").trim();
 }
 function getFrameworkSpecificDoc(frameworks) {
+  if (frameworks.length === 0) return "";
   const fw = frameworks.map((f) => f.toLowerCase());
   if (fw.includes("vue") || fw.includes("nuxt")) {
     return loadAlgoliaDoc("vue");
@@ -3777,9 +3924,6 @@ function getFrameworkSpecificDoc(frameworks) {
   if (fw.includes("react") || fw.includes("next.js")) {
     return loadAlgoliaDoc("react");
   }
-  if (fw.includes("angular")) {
-    return loadAlgoliaDoc("angular");
-  }
   return loadAlgoliaDoc("js");
 }
 
@@ -3807,11 +3951,7 @@ var implementSchema = z26.object({
 });
 var implementationOutputSchema = z26.object({
   summary: z26.string(),
-  // Ingestion only: a structured pair the wizard turns into an argv, never a
-  // free-form command string. `runtime` is allowlisted and `entrypoint` is
-  // validated worktree-relative, so the agent cannot inject extra commands.
-  runtime: z26.enum(INGEST_RUNTIMES).optional(),
-  entrypoint: z26.string().optional()
+  ingestCommand: z26.string().optional()
 });
 var verificationOutputSchema = z26.object({
   summary: z26.string(),
@@ -3821,30 +3961,35 @@ var verificationOutputSchema = z26.object({
 var MAX_IMPLEMENT_VERIFICATION_ATTEMPTS = 3;
 var DEFAULT_IMPLEMENT_USE_CASES = ["ingestion", "search"];
 var INGEST_DIR = ".algolia-wizard";
-function detectUiFramework(language) {
-  const names = language.frameworks.map((f) => f.name.toLowerCase());
-  if (names.some((n) => n.includes("vue") || n.includes("nuxt"))) return "Vue";
-  if (names.some((n) => n.includes("react") || n.includes("next")))
-    return "React";
-  if (names.some((n) => n.includes("angular"))) return "Angular";
-  return "JavaScript";
-}
-function frameworksForDoc(framework) {
-  switch (framework) {
-    case "React":
-      return ["react"];
-    case "Vue":
-      return ["vue"];
-    case "Angular":
-      return ["angular"];
-    case "JavaScript":
-      return [];
-  }
+var JS_LANGUAGES = ["javascript", "typescript", "jsx", "tsx", "node"];
+function lower(entries) {
+  return entries.map((entry) => entry.name.toLowerCase());
 }
-function publicEnvPrefix(language) {
-  const frameworkNames = language.frameworks.map(
-    (framework) => framework.name.toLowerCase()
+function isJsProject(language) {
+  return lower(language.languages).some(
+    (name) => JS_LANGUAGES.some((js) => name.includes(js))
+  );
+}
+var UI_FRAMEWORKS = [
+  { match: ["vue", "nuxt"], target: "Vue", doc: "vue" },
+  { match: ["react", "next"], target: "React", doc: "react" },
+  { match: ["angular"], target: "Angular" }
+];
+function matchUiFramework(language) {
+  const names = lower(language.frameworks);
+  return UI_FRAMEWORKS.find(
+    (ui) => ui.match.some((needle) => names.some((name) => name.includes(needle)))
   );
+}
+function searchUiTarget(language) {
+  return matchUiFramework(language)?.target ?? language.frameworks[0]?.name ?? (isJsProject(language) ? "JavaScript" : "this project");
+}
+function frameworksForDoc(language) {
+  if (!isJsProject(language)) return [];
+  return [matchUiFramework(language)?.doc ?? "js"];
+}
+function publicEnvPrefix(language) {
+  const frameworkNames = lower(language.frameworks);
   if (frameworkNames.some((name) => name.includes("next"))) {
     return "NEXT_PUBLIC_";
   }
@@ -3857,26 +4002,49 @@ function publicEnvPrefix(language) {
   if (frameworkNames.some((name) => name.includes("vite"))) {
     return "VITE_";
   }
-  return "PUBLIC_";
+  return isJsProject(language) ? "PUBLIC_" : "";
+}
+var APP_ID_VAR_SUFFIX = "ALGOLIA_APP_ID";
+var SEARCH_KEY_VAR_SUFFIX = "ALGOLIA_SEARCH_API_KEY";
+var INDEX_VAR_SUFFIX = "ALGOLIA_INDEX_NAME";
+function appIdVar(language) {
+  return `${publicEnvPrefix(language)}${APP_ID_VAR_SUFFIX}`;
+}
+function searchKeyVar(language) {
+  return `${publicEnvPrefix(language)}${SEARCH_KEY_VAR_SUFFIX}`;
 }
-function searchEnvVars(language, appId, searchKey) {
-  const prefix = publicEnvPrefix(language);
+function searchIndexVar(language) {
+  return `${publicEnvPrefix(language)}${INDEX_VAR_SUFFIX}`;
+}
+function searchEnvVars(language, index, appId, searchKey) {
   return [
     {
-      name: `${prefix}ALGOLIA_APP_ID`,
+      name: appIdVar(language),
       value: appId ?? "<your-algolia-app-id>"
     },
     {
-      name: `${prefix}ALGOLIA_SEARCH_API_KEY`,
+      name: searchKeyVar(language),
       value: searchKey ?? "<your-algolia-search-only-api-key>"
+    },
+    // Wizard-supplied rather than written into the generated code, because an
+    // agent that retypes the name (appending the project name, re-casing it)
+    // leaves the UI querying an index that does not exist.
+    {
+      name: searchIndexVar(language),
+      value: index
     }
   ];
 }
 function baseInstructions(input) {
   return [
-    `Target Algolia index: ${input.targetIndex}`,
+    // Agents have renamed this (e.g. appending the project name), which the
+    // index-scoped keys then reject with a 403.
+    `Target Algolia index, to be used exactly as written \u2014 never renamed, re-cased, prefixed, or suffixed: "${input.targetIndex}"`,
     `Project languages and frameworks: ${JSON.stringify(input.language)}`,
-    "Make minimal, idiomatic changes; do not touch unrelated code."
+    "Make minimal, idiomatic changes; do not touch unrelated code.",
+    `Commands run through a shell on ${process.platform}. Write commands that work there.`,
+    "Use the project's own tooling for every command \u2014 its package manager, task runner, and test/lint commands. Do not assume a JavaScript toolchain.",
+    "runShell needs the developer to approve each command, so give every call a clear `explanation` naming what it does and any side effect. If a command is rejected, do not retry it \u2014 take a different approach or report the limitation."
   ];
 }
 function sourceSpecificInstructions(input) {
@@ -3896,43 +4064,62 @@ function sourceSpecificInstructions(input) {
     generated: [
       "No real data source exists; use sample records for each confirmed entity.",
       "Call the generateRecord tool once per entity (entityName, attributes, count 20-50); it invents the values and unique objectIDs and writes them to a JSON file in the worktree, returning the file path. Do not write records or objectIDs yourself.",
-      "In the script, read and parse each returned file path at runtime (e.g. JSON.parse(readFileSync(...)) in Node/Bun, json.load(open(...)) in Python) instead of inlining the records as literals.",
+      "In the script, read and parse each returned file path at runtime using your language's standard JSON support, instead of inlining the records as literals.",
       "Add a prominent TODO where the developer swaps the generated records (and the JSON file under `.algolia-wizard/data/`) for their real record source."
     ]
   };
   return byLine[input.ingestionSource];
 }
+function algoliaClientDoc(input) {
+  const doc = getNamedDoc("save-records", "js");
+  if (!doc) return [];
+  if (isJsProject(input.language)) return [doc];
+  return [
+    "The reference below is written in JavaScript. Use it for the method names, arguments, and record shape, then translate to this project's language and its official Algolia client:",
+    doc
+  ];
+}
 function ingestionInstructions(input) {
   return [
     ...input.confirmed && input.confirmed.length ? [
       `Create an ingestion script under "${input.ingestDir}/" at the repo root.`,
       `Ingest only these confirmed entities (name, source paths, attributes): ${JSON.stringify(input.confirmed)}.`,
       `Ingesting writes to Algolia, so the script needs a write API key and App ID \u2014 read them from the ${API_KEY_VAR} and ${APP_ID_VAR} environment variables rather than hardcoding them. The wizard sets these when it runs the script.`,
-      "Use the appropriate Algolia package in the ingestion script. Do not use the raw HTTP API.",
+      `Read the index name from the ${INDEX_NAME_VAR} environment variable, which the wizard sets to "${input.targetIndex}". Never hardcode an index name or derive one from the project, file, or entity name \u2014 the write key only works for that exact index. Exit with an error if ${INDEX_NAME_VAR} is unset.`,
+      "Write the script in the project's primary language, using Algolia's official client for that language. Do not use the raw HTTP API.",
       "After a successful ingest, the script must print exactly one line to stdout in the form `ALGOLIA_WIZARD_RECORD_COUNT=<n>`, where <n> is the total number of records pushed to Algolia. Print it last, on its own line, with no surrounding text.",
-      getNamedDoc("save-records", "js"),
-      'Add algoliasearch to package.json "dependencies" with a valid version range; the wizard installs the worktree deps after you finish.',
+      ...algoliaClientDoc(input),
+      "Install the Algolia client with the project's own package manager via runShell, declaring it in whatever manifest the project uses (e.g. package.json, requirements.txt, Gemfile, go.mod, composer.json) so the dependency is not just installed ad hoc.",
+      'Then run the script yourself via runShell, and report the command you ran as "ingestCommand" so the developer can re-run it. Its explanation must say that running it writes records to Algolia.',
       "The summary should be extremely concise.",
-      `Return how to run the script as two fields, not a command string: "runtime" (one of ${INGEST_RUNTIMES.join(", ")}) and "entrypoint" (the script path relative to the worktree root, e.g. "${input.ingestDir}/ingest.mjs"). The wizard runs \`<runtime> <entrypoint>\` directly, so the entrypoint must be a plain path with no flags or arguments. Write a script one of those interpreters can run as-is.`,
       ...sourceSpecificInstructions(input)
     ] : []
   ];
 }
 function searchInstructions(input) {
-  const doc = getFrameworkSpecificDoc(frameworksForDoc(input.uiFramework));
+  const doc = getFrameworkSpecificDoc(frameworksForDoc(input.language));
   return [
     "Implement an in-app Algolia search experience.",
-    `Build the search UI for ${input.uiFramework}.`,
-    "Follow the Algolia JS SDK reference below for client setup and InstantSearch wiring; prefer it over prior knowledge:",
-    doc,
-    `Add the search UI at ${input.searchLocation ? `"${input.searchLocation}"` : "the best shared, always-rendered layout location (e.g. a header/nav component)"} so it is reachable across the app \u2014 at least a working SearchBox and Hits against the "${input.targetIndex}" index.`,
-    "Read the App ID and a search-only API key from public env vars; never hardcode them. A search-only key is safe to expose client-side.",
-    `Values: App ID "${input.appId}", search-only key ${input.searchKey ? `"${input.searchKey}"` : "(placeholder for the developer to fill in)"}.`,
+    `Build the search UI for ${input.searchUiTarget}.`,
+    ...doc ? [
+      "Follow the Algolia SDK reference below for client setup and search UI wiring; prefer it over prior knowledge:",
+      doc
+    ] : [
+      "No bundled Algolia SDK reference exists for this stack, so rely on the project's own conventions and Algolia's official client for its language. Do not invent APIs \u2014 keep to the documented search endpoint and its parameters."
+    ],
+    `Add the search UI at ${input.searchLocation ? `"${input.searchLocation}"` : "the best shared, always-rendered layout location (e.g. a header/nav component)"} so it is reachable across the app \u2014 at least a working search input and results list against the target index.`,
+    `Read the index name from the ${searchIndexVar(input.language)} env var, which the wizard sets to "${input.targetIndex}". Never hardcode an index name or derive one from the project, file, or component name.`,
+    "Read the App ID, the search-only API key, and the index name from env vars; never hardcode them. A search-only key is safe to expose client-side.",
+    // The key is provisioned only after verification passes, so the agent never
+    // sees one. It must also leave .env alone: the wizard reads that file to
+    // decide whether a key already exists, and an agent-invented value there
+    // would be reused as if it were real.
+    `Add Algolia App ID "${input.appId}"; leave the search-only key as a placeholder. Do not create or edit .env \u2014 the wizard writes the resolved key there itself.`,
     // Not the agent's to rename: the wizard writes these exact names into
     // ".env" right after this step, so a renamed prefix would leave the code
     // reading a var the wizard never wrote.
-    `Use exactly these public env var names in the code: ${input.searchEnvVars.map(({ name }) => name).join(", ")}.`,
-    'Add any Algolia/InstantSearch packages you import to package.json "dependencies" with a valid version range; the wizard installs them in the worktree after you finish.',
+    `Use exactly these env var names in the code: ${input.searchEnvVars.map(({ name }) => name).join(", ")}.`,
+    "Install any Algolia packages you import with the project's own package manager via runShell, and declare them in the project's dependency manifest.",
     "The summary should be extremely concise; do not mention env var setup or manual testing steps \u2014 the wizard writes the resolved credentials to .env and reports that separately."
   ];
 }
@@ -3940,11 +4127,12 @@ function verificationInstructions(input) {
   return [
     "Verify the Algolia implementation changes in the current worktree.",
     `Verification tools found in the codebase: ${JSON.stringify(input.findings.verification ?? [])}.`,
-    "Call verifyImplementation at least once; it runs every repo-defined lint/typecheck/check script and returns per-check results plus an aggregate ok.",
-    "For issues caused by the implementation, make minimal fixes with writeFile and re-run verifyImplementation.",
-    "Do not make speculative fixes when verifyImplementation cannot run, no checks exist, or failures are unrelated to these changes \u2014 note the limitation in your summary.",
+    "Run the project's own checks (lint, type check, tests) via runShell, using the commands the project actually defines \u2014 its task runner, manifest scripts, or Makefile. Run every check that applies, not just the first.",
+    "This worktree starts with no installed dependencies. If a check fails because packages or modules are missing, install the dependencies via runShell and re-run it rather than changing the code.",
+    "For issues caused by the implementation, make minimal fixes with writeFile and re-run the checks.",
+    "Do not make speculative fixes when no checks exist, a check cannot run, or failures are unrelated to these changes \u2014 note the limitation in your summary.",
     "Do not add new Algolia functionality here; only validate and make minimal correctness fixes.",
-    `Do not modify "${input.ingestDir}/" unless verifyImplementation reports an actionable issue in its files.`,
+    `Do not modify "${input.ingestDir}/" unless a check reports an actionable issue in its files.`,
     "Always call reportStatus with status=success once verification has run, even when sufficient=false.",
     "Set sufficient=true only when the implementation is complete and checks pass (or fail for a clearly unrelated reason).",
     "Set sufficient=false when the implementation is incomplete or has implementation-caused failures; include concrete additionalInstructions for the next pass."
@@ -3965,14 +4153,15 @@ var IMPLEMENT_CONFIG = {
   }
 };
 var useCaseToolMap = {
-  ingestion: [...FS_READ_TOOLS, "writeFile", "writeCredentials", "notifyUser"],
-  search: [...FS_READ_TOOLS, "writeFile", "notifyUser"],
-  verification: [
+  ingestion: [
     ...FS_READ_TOOLS,
     "writeFile",
-    "verifyImplementation",
+    "writeCredentials",
+    "runShell",
     "notifyUser"
-  ]
+  ],
+  search: [...FS_READ_TOOLS, "writeFile", "runShell", "notifyUser"],
+  verification: [...FS_READ_TOOLS, "writeFile", "runShell", "notifyUser"]
 };
 function toolsForUseCase(useCase, ingestionSource) {
   const tools = useCaseToolMap[useCase];
@@ -3995,15 +4184,30 @@ function formatSummary(useCase, summary) {
   const label = useCase === "ingestion" ? "Ingestion" : useCase === "search" ? "Search" : "Verification";
   return `${label}: ${summary}`;
 }
-function buildIngestCommand(worktree, runtime, entrypoint) {
-  return `cd ${shellQuote(worktree)} && ${runtime} ${shellQuote(entrypoint)}`;
-}
 function parseIngestRecordCount(output) {
   const match = output.match(/ALGOLIA_WIZARD_RECORD_COUNT=(\d+)/);
   if (!match) return void 0;
   const count = Number(match[1]);
   return Number.isFinite(count) ? count : void 0;
 }
+function ingestOutcome(executions, ingestCommand) {
+  const newestFirst = [...executions].reverse();
+  const withCount = newestFirst.filter(
+    (e) => parseIngestRecordCount(e.output ?? "") != null
+  );
+  const succeeded = newestFirst.filter((e) => e.approved && e.exitCode === 0);
+  return {
+    run: succeeded.find((e) => e.command === ingestCommand) ?? succeeded.find((e) => withCount.includes(e)),
+    recordCount: parseIngestRecordCount(withCount[0]?.output ?? "")
+  };
+}
+function makeToolContext(worktree, env = async () => ({})) {
+  return createToolContext(
+    DEFAULT_TOOL_LIMITS,
+    worktree,
+    createShellContext({ env, approve: storeApproval(worktree) })
+  );
+}
 function verificationRetryInstructions(verification) {
   return [
     `Implementation insufficient. Address these findings before reporting completion: ${verification.additionalInstructions ?? verification.summary}`
@@ -4082,17 +4286,12 @@ async function implement(ctx, useCases = DEFAULT_IMPLEMENT_USE_CASES, existingWo
   const confirmed2 = normalized.confirmedEntities;
   const searchLocation = normalized.searchImplementationAnalysis;
   let appId;
-  let searchKey;
+  let ingestAppId;
   if (useCases.includes("search")) {
     appId = (await requireApplication()).id;
-    try {
-      searchKey = await resolveSearchOnlyKey(targetIndex);
-    } catch (err) {
-      logger.warn(
-        { err: err.message },
-        "implement: could not resolve a search-only API key; the agent will scaffold a placeholder"
-      );
-    }
+  }
+  if (useCases.includes("ingestion")) {
+    ingestAppId = appId ?? (await requireApplication()).id;
   }
   const worktree = existingWorktreePath ?? (await createWorktree(repoRoot)).path;
   try {
@@ -4124,51 +4323,60 @@ async function implement(ctx, useCases = DEFAULT_IMPLEMENT_USE_CASES, existingWo
       targetIndex,
       language,
       appId,
-      searchKey,
-      searchEnvVars: searchEnvVars(language, appId, searchKey),
+      // Names only: the search-only key is provisioned after verification, so
+      // every value here is still a placeholder when the agent reads them.
+      searchEnvVars: searchEnvVars(language, targetIndex, appId),
       ingestDir: INGEST_DIR,
       ingestionSource,
       uploadFilePath,
-      uiFramework: detectUiFramework(language)
+      searchUiTarget: searchUiTarget(language)
     };
     const summaries = [];
     if (uploadWarning) summaries.push(uploadWarning);
+    let envSearchKey;
+    let envAppIdMismatch = false;
+    if (useCases.includes("search") && appId) {
+      const envAppId = await readEnvVar(worktree, appIdVar(language));
+      if (envAppId === appId) {
+        envSearchKey = await readEnvVar(worktree, searchKeyVar(language));
+      } else if (envAppId) {
+        envAppIdMismatch = true;
+        summaries.push(
+          `\u26A0\uFE0F .env already sets ${appIdVar(language)}=${envAppId}, but the active Algolia application is ${appId}. The wizard left those values alone \u2014 update ${appIdVar(language)} and ${searchKeyVar(language)} by hand, or searches will fail.`
+        );
+        logger.warn(
+          { envAppId, appId },
+          "implement: .env holds credentials for a different Algolia application; not reusing its search key"
+        );
+      }
+    }
+    let finalSearchEnvVars = input.searchEnvVars;
     let agentRuns = 0;
-    let ingestRuntime;
-    let ingestEntrypoint;
+    let ingestCommand;
     let ingestScriptRan = false;
     let ingestRecordCount;
     let ingestDurationMs;
-    let installFailed = false;
     let ingestOutcomeMessage;
+    const ingestKeyAppId = ingestAppId;
+    const ingestionTools = ingestKeyAppId ? makeToolContext(worktree, async () => ({
+      [APP_ID_VAR]: ingestKeyAppId,
+      [API_KEY_VAR]: (await resolveWriteKey(targetIndex, ingestKeyAppId)).key,
+      [INDEX_NAME_VAR]: targetIndex
+    })) : void 0;
+    const searchTools = makeToolContext(worktree);
     async function runImplementationUseCase(currentUseCase, extraInstructions = []) {
       if (agentRuns > 0) ctx.recordStepExecution();
       agentRuns += 1;
-      const result = await runAgent({
+      return runAgent({
         instructions: buildAgentInstructions(
           currentUseCase,
           input,
           extraInstructions
         ),
         tools: toolsForUseCase(currentUseCase, input.ingestionSource),
-        outputSchema: implementationOutputSchema
-      });
-      ctx.notify({
-        messages: [`Installing dependencies for ${currentUseCase}\u2026`]
+        outputSchema: implementationOutputSchema,
+        toolContext: currentUseCase === "ingestion" ? ingestionTools ?? searchTools : searchTools
       });
-      const installLogId = ctx.logStart("installWorktreeDeps", {
-        useCase: currentUseCase
-      });
-      const install = await installWorktreeDeps(worktree);
-      ctx.logEnd(installLogId, install.ok ? "success" : "error");
-      if (!install.ok) {
-        installFailed = true;
-        logger.warn(
-          { useCase: currentUseCase, output: install.output },
-          "implement: dependency install in worktree failed; generated commands may not run until deps are installed"
-        );
-      }
-      return result;
     }
     async function runVerificationUseCase() {
       if (agentRuns > 0) ctx.recordStepExecution();
@@ -4176,110 +4384,55 @@ async function implement(ctx, useCases = DEFAULT_IMPLEMENT_USE_CASES, existingWo
       return runAgent({
         instructions: buildAgentInstructions("verification", input),
         tools: toolsForUseCase("verification"),
-        outputSchema: verificationOutputSchema
+        outputSchema: verificationOutputSchema,
+        toolContext: searchTools
       });
     }
     if (useCases.includes("ingestion")) {
-      const { summary, runtime, entrypoint } = await runImplementationUseCase("ingestion");
-      summaries.push(formatSummary("ingestion", summary));
-      ingestRuntime = runtime;
-      ingestEntrypoint = entrypoint;
-      if (ingestRuntime && ingestEntrypoint && !installFailed) {
-        ctx.clearNotices();
-        const runNow = await ctx.requestUserInput({
-          prompt: `Run the ingestion script now? This writes records to the "${targetIndex}" index.`,
-          promptType: "acceptReject",
-          options: ["Yes", "No"],
-          messages: []
-        }) === true;
-        if (runNow) {
-          const ingestApp = await requireApplication();
-          const writeKey = await resolveWriteKey(targetIndex);
-          ctx.notify({ messages: [`Writing records to "${targetIndex}"\u2026`] });
-          const scriptLogId = ctx.logStart("runIngestScript", {
-            runtime: ingestRuntime,
-            entrypoint: ingestEntrypoint
+      const result = await runImplementationUseCase("ingestion");
+      summaries.push(formatSummary("ingestion", result.summary));
+      ingestCommand = result.ingestCommand;
+      const executions = (ingestionTools ?? searchTools).shell.executions;
+      const { run: ingestRun, recordCount } = ingestOutcome(
+        executions,
+        ingestCommand
+      );
+      ingestScriptRan = ingestRun != null;
+      ingestRecordCount = recordCount;
+      ingestDurationMs = ingestRun?.durationMs;
+      if (ingestScriptRan) {
+        ingestOutcomeMessage = `\u2705 Ingestion succeeded${ingestRecordCount != null ? ` \u2014 ${ingestRecordCount} record(s) indexed.` : "."}`;
+        if (ingestRecordCount != null) {
+          track("AI Wizard Ingest Successful", {
+            entity_name: confirmed2?.map((e) => e.name).join(", ") || "unknown",
+            record_count: ingestRecordCount,
+            duration_ms: ingestDurationMs ?? 0
           });
-          const startedAt = Date.now();
-          const run2 = await runIngestScript(
-            worktree,
-            ingestRuntime,
-            ingestEntrypoint,
-            {
-              [APP_ID_VAR]: ingestApp.id,
-              [API_KEY_VAR]: writeKey
-            }
-          );
-          ctx.logEnd(scriptLogId, run2.ok ? "success" : "error");
-          ingestScriptRan = run2.ran && run2.ok;
-          if (ingestScriptRan) {
-            ingestDurationMs = Date.now() - startedAt;
-            ingestRecordCount = parseIngestRecordCount(run2.output);
-            if (ingestRecordCount != null) {
-              track("AI Wizard Ingest Successful", {
-                entity_name: confirmed2?.map((e) => e.name).join(", ") || "unknown",
-                record_count: ingestRecordCount,
-                duration_ms: ingestDurationMs
-              });
-            }
-          }
-          let summaryLine;
-          let outcomeMessage;
-          if (!run2.ran) {
-            summaryLine = `\u26A0\uFE0F Skipped running the ingestion script: ${run2.reason}`;
-            outcomeMessage = `\u26A0\uFE0F The ingestion script did not run: ${run2.reason}`;
-            logger.warn(
-              {
-                runtime: ingestRuntime,
-                entrypoint: ingestEntrypoint,
-                reason: run2.reason
-              },
-              "implement: refused to auto-run ingestion script"
-            );
-            track("Error", {
-              step: "Push Data",
-              error: `ingestion script skipped: ${run2.reason}`,
-              product_area: "AI Wizard"
-            });
-          } else if (run2.ok) {
-            const status = "Ingestion run: succeeded.";
-            summaryLine = run2.output ? `${status}
-${run2.output}` : status;
-            outcomeMessage = `\u2705 Ingestion succeeded${ingestRecordCount != null ? ` \u2014 ${ingestRecordCount} record(s) indexed.` : "."}`;
-          } else {
-            const status = "\u26A0\uFE0F Ingestion run failed:";
-            summaryLine = run2.output ? `${status}
-${run2.output}` : status;
-            outcomeMessage = `\u274C Ingestion failed.${run2.output ? ` ${run2.output}` : ""}`;
-            logger.warn(
-              {
-                runtime: ingestRuntime,
-                entrypoint: ingestEntrypoint,
-                output: run2.output
-              },
-              "implement: ingestion script run failed"
-            );
-            track("Error", {
-              step: "Push Data",
-              error: run2.output || "ingestion script exited non-zero",
-              product_area: "AI Wizard"
-            });
-          }
-          summaries.push(summaryLine);
-          ingestOutcomeMessage = outcomeMessage;
         }
+      } else {
+        const rejected = executions.some((e) => !e.approved);
+        const reason = rejected ? "you declined to run it" : "no successful run was recorded";
+        ingestOutcomeMessage = `\u26A0\uFE0F Records were not indexed \u2014 ${reason}.${ingestCommand ? " Run the command below when you are ready." : ""}`;
+        summaries.push(`\u26A0\uFE0F The ingestion script did not run: ${reason}.`);
+        logger.warn(
+          { ingestCommand, rejected, commandsRun: executions.length },
+          "implement: ingestion script did not complete successfully"
+        );
+        track("Error", {
+          step: "Push Data",
+          error: `ingestion did not run: ${reason}`,
+          product_area: "AI Wizard"
+        });
       }
       const commandMessages = [`Open the worktree: cd ${shellQuote(worktree)}`];
-      if (ingestRuntime && ingestEntrypoint) {
-        commandMessages.push(
-          `Ingestion command: ${buildIngestCommand(worktree, ingestRuntime, ingestEntrypoint)}`
-        );
+      if (ingestCommand) {
+        commandMessages.push(`Ingestion command: ${ingestCommand}`);
       }
       await ctx.requestUserInput({
         prompt: "",
         promptType: "enterToContinue",
         options: [],
-        messages: ingestOutcomeMessage ? [ingestOutcomeMessage, ...commandMessages] : commandMessages
+        messages: [ingestOutcomeMessage, ...commandMessages]
       });
     }
     if (useCases.includes("search")) {
@@ -4324,7 +4477,34 @@ ${run2.output}` : status;
         }
         extraInstructions = verificationRetryInstructions(verification);
       }
-      const resolvedSearchEnvVars = input.searchEnvVars.filter(
+      let searchKey;
+      let searchKeyError;
+      if (appId) {
+        try {
+          const resolved2 = await resolveSearchOnlyKey(
+            targetIndex,
+            appId,
+            envSearchKey
+          );
+          searchKey = resolved2.key;
+          summaries.push(
+            resolved2.source === "created" ? `Created a new search-only Algolia API key for the "${targetIndex}" index in app ${appId} \u2014 safe to expose in frontend code.` : `Reused the existing search-only Algolia API key for the "${targetIndex}" index in app ${appId}.`
+          );
+        } catch (err) {
+          searchKeyError = err.message;
+          logger.warn(
+            { err: searchKeyError },
+            "implement: could not provision a search-only API key; the .env value stays a placeholder"
+          );
+        }
+      }
+      finalSearchEnvVars = searchEnvVars(
+        language,
+        targetIndex,
+        appId,
+        searchKey
+      );
+      const resolvedSearchEnvVars = finalSearchEnvVars.filter(
         (v) => !v.value.startsWith("<")
       );
       if (resolvedSearchEnvVars.length > 0) {
@@ -4335,13 +4515,29 @@ ${run2.output}` : status;
         if (written.length > 0) {
           summaries.push(`Wrote ${written.join(", ")} to .env.`);
         }
+        const stale = [];
+        for (const v of resolvedSearchEnvVars) {
+          if (written.includes(v.name)) continue;
+          const current = await readEnvVar(worktree, v.name);
+          if (current && current !== v.value) stale.push(v);
+        }
+        if (stale.length > 0 && !envAppIdMismatch) {
+          summaries.push(
+            `\u26A0\uFE0F .env already assigns a different value to ${stale.map((v) => `${v.name} (should be ${v.value})`).join(", ")} \u2014 the wizard left it alone. Fix it by hand, or searches will fail.`
+          );
+          logger.warn(
+            { vars: stale.map((v) => v.name) },
+            "implement: .env holds different values for the resolved search credentials; not overwriting them"
+          );
+        }
       }
-      const unresolvedSearchEnvVars = input.searchEnvVars.filter(
+      const unresolvedSearchEnvVars = finalSearchEnvVars.filter(
         (v) => v.value.startsWith("<")
       );
       if (unresolvedSearchEnvVars.length > 0) {
         summaries.push(
-          `Could not resolve a value for ${unresolvedSearchEnvVars.map((v) => v.name).join(", ")} \u2014 fill it in manually in .env.`
+          `Could not resolve a value for ${unresolvedSearchEnvVars.map((v) => v.name).join(", ")} \u2014 fill it in manually in .env.` + // Without the reason the line is a dead end.
+          (searchKeyError ? ` Reason: ${searchKeyError}` : "")
         );
       }
     } else {
@@ -4353,27 +4549,18 @@ ${run2.output}` : status;
         "implement: agent reported success but no files changed in the worktree"
       );
     }
-    if (installFailed) {
-      summaries.push(
-        '\u26A0\uFE0F Dependency install in the worktree failed. Run your package manager install in the worktree before the command below, or it will fail with "Cannot find module".'
-      );
-    }
     return {
       ingestionSource,
       filesChanged,
       summary: summaries.join("\n\n"),
       worktreePath: worktree,
-      ...useCases.includes("ingestion") && ingestRuntime && ingestEntrypoint ? {
-        ingestCommand: buildIngestCommand(
-          worktree,
-          ingestRuntime,
-          ingestEntrypoint
-        ),
+      ...useCases.includes("ingestion") && ingestCommand ? {
+        ingestCommand,
         ingestScriptRan,
         ...ingestRecordCount != null ? { ingestRecordCount } : {},
         ...ingestDurationMs != null ? { ingestDurationMs } : {}
       } : {},
-      ...useCases.includes("search") ? { searchEnvVars: input.searchEnvVars } : {}
+      ...useCases.includes("search") ? { searchEnvVars: finalSearchEnvVars } : {}
     };
   } finally {
     process.chdir(repoRoot);
@@ -4696,10 +4883,11 @@ function parseCliArgs(argv) {
 
 // src/lib/resetState.ts
 import { readdir as readdir4, rm as rm2 } from "node:fs/promises";
-import { join as join11 } from "node:path";
+import { join as join10 } from "node:path";
 var KEEP = ["wizard.log"];
 async function resetProjectState() {
   const dir = stateDir();
+  forgetResolvedKeys();
   let entries;
   try {
     entries = await readdir4(dir);
@@ -4708,14 +4896,17 @@ async function resetProjectState() {
   }
   const targets = entries.filter((name) => !KEEP.includes(name));
   await Promise.all(
-    targets.map((name) => rm2(join11(dir, name), { recursive: true, force: true }))
+    targets.map(
+      (name) => rm2(join10(dir, name), { recursive: true, force: true })
+    )
   );
   return { dir, removed: targets };
 }
 
 // src/main.tsx
-import { jsx as jsx14 } from "react/jsx-runtime";
+import { jsx as jsx15 } from "react/jsx-runtime";
 async function startup() {
+  setProjectRoot(process.cwd());
   let args;
   try {
     args = parseCliArgs(process.argv.slice(2));
@@ -4763,7 +4954,7 @@ ${formatStepList(workflow)}`);
 }
 async function run(workflow) {
   const store = useWizard.getState();
-  const instance = render(/* @__PURE__ */ jsx14(App, {}), { incrementalRendering: true });
+  const instance = render(/* @__PURE__ */ jsx15(App, {}), { incrementalRendering: true });
   await store.waitForStart();
   let user = await getUser();
   if (!user) {