@algolia/wizard 0.9.0-rc.87.83 → 0.9.0-rc.87.86

package/dist/main.js

@@ -26,10 +26,14 @@ import { join, resolve } from "node:path";
 function rootDir() {
   return process.env.WIZARD_HOME ?? join(homedir(), ".algolia");
 }
-function projectSlug(cwd = process.cwd()) {
+var pinnedRoot;
+function setProjectRoot(cwd) {
+  pinnedRoot = resolve(cwd);
+}
+function projectSlug(cwd = pinnedRoot ?? process.cwd()) {
   return resolve(cwd).replace(/[/\\:]+/g, "-").replace(/^-+/, "") || "root";
 }
-function stateDir(cwd = process.cwd()) {
+function stateDir(cwd = pinnedRoot ?? process.cwd()) {
   return join(rootDir(), projectSlug(cwd));
 }
 
@@ -58,6 +62,11 @@ function npxArgs(args) {
   return ["--yes", "@algolia/cli@latest", ...args];
 }
 var shell = process.platform === "win32";
+function childEnv(withoutAdminKey) {
+  if (!withoutAdminKey) return void 0;
+  const { ALGOLIA_API_KEY: _adminKey, ...rest } = process.env;
+  return rest;
+}
 function lineSplitter(emit) {
   let buffer = "";
   return {
@@ -81,11 +90,14 @@ var stderrSink = (stream, line) => {
   if (stream === "stdout") return;
   wizardSink(stream, line);
 };
-function runAlgoliaCli(args, { onOutput } = {}) {
+function runAlgoliaCli(args, { onOutput, withoutAdminKey } = {}) {
   const store = useWizard.getState();
   const logId = store.logStart("tool", `algolia ${args.join(" ")}`);
   return new Promise((resolve4, reject) => {
-    const child = spawn("npx", npxArgs(args), { shell });
+    const child = spawn("npx", npxArgs(args), {
+      shell,
+      env: childEnv(withoutAdminKey)
+    });
     let stdout = "";
     let stderr = "";
     const splitters = {
@@ -1813,18 +1825,17 @@ import "zod";
 import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
 import { join as join5 } from "node:path";
 var configFile = () => join5(stateDir(), "config.json");
-var DEFAULT_CONFIG = {
+var defaultConfig = () => ({
   version: 1,
   aiConsent: false,
-  workflowsRun: [],
-  searchApiKeys: {}
-};
+  workflowsRun: []
+});
 async function loadConfig() {
   try {
     const raw = await readFile2(configFile(), "utf8");
-    return { ...DEFAULT_CONFIG, ...JSON.parse(raw) };
+    return { ...defaultConfig(), ...JSON.parse(raw) };
   } catch {
-    return { ...DEFAULT_CONFIG };
+    return defaultConfig();
   }
 }
 async function saveConfig(config) {
@@ -1836,38 +1847,6 @@ async function recordWorkflowRun(workflowId, completedAt) {
   config.workflowsRun.push({ workflowId, completedAt });
   await saveConfig(config);
 }
-function isStoredSearchKey(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const { appId, key } = value;
-  return typeof appId === "string" && !!appId && typeof key === "string" && !!key;
-}
-function storedSearchKeys(config) {
-  const stored = config.searchApiKeys;
-  if (typeof stored !== "object" || stored === null || Array.isArray(stored)) {
-    return {};
-  }
-  return stored;
-}
-async function getStoredSearchKey(index, appId) {
-  const entry = storedSearchKeys(await loadConfig())[index];
-  if (!isStoredSearchKey(entry) || entry.appId !== appId) return void 0;
-  return entry.key;
-}
-async function storeSearchKey(index, appId, key) {
-  const config = await loadConfig();
-  config.searchApiKeys = {
-    ...storedSearchKeys(config),
-    [index]: { appId, key }
-  };
-  await saveConfig(config);
-}
-async function forgetSearchKey(index) {
-  const config = await loadConfig();
-  const remaining = { ...storedSearchKeys(config) };
-  delete remaining[index];
-  config.searchApiKeys = remaining;
-  await saveConfig(config);
-}
 
 // src/core/orchestrator.ts
 function defineStep(step) {
@@ -2315,9 +2294,9 @@ function listFilesTool(ctx) {
       if (++ctx.counts.list > ctx.limits.list) {
         return `Refused: list limit (${ctx.limits.list}) reached. Stop listing and proceed with the information you already have.`;
       }
-      const resolved = resolveInRoot(ctx, ".");
-      if (!resolved.ok) return resolved.error;
-      const entries = await readdir(resolved.target, { withFileTypes: true });
+      const resolved2 = resolveInRoot(ctx, ".");
+      if (!resolved2.ok) return resolved2.error;
+      const entries = await readdir(resolved2.target, { withFileTypes: true });
       return entries.map((e) => e.isDirectory() ? `${e.name}/` : e.name).join("\n");
     }
   });
@@ -2335,14 +2314,14 @@ function changeDirectoryTool(ctx) {
     }),
     execute: async ({ path }) => {
       logger.info({ path }, "called changeDirectory tool");
-      const resolved = resolveInRoot(ctx, path);
-      if (!resolved.ok) return resolved.error;
+      const resolved2 = resolveInRoot(ctx, path);
+      if (!resolved2.ok) return resolved2.error;
       try {
-        const info = await stat(resolved.target);
+        const info = await stat(resolved2.target);
         if (!info.isDirectory()) {
           return `Error changing directory to ${path}: not a directory`;
         }
-        ctx.cwd = resolved.target;
+        ctx.cwd = resolved2.target;
         return `Changed working directory to ${ctx.cwd}`;
       } catch (err) {
         return `Error changing directory to ${path}: ${err.message}`;
@@ -2407,11 +2386,11 @@ function readFileTool(ctx) {
         return `Refused: read limit (${ctx.limits.read}) reached. Stop reading and proceed with the information you already have.`;
       }
       logger.info({ filePath }, "called readFile tool");
-      const resolved = resolveInRoot(ctx, filePath);
-      if (!resolved.ok) return resolved.error;
+      const resolved2 = resolveInRoot(ctx, filePath);
+      if (!resolved2.ok) return resolved2.error;
       try {
-        const content = await readFile3(resolved.target, "utf8");
-        return isEnvFile(resolved.target) ? redactEnvValues(content) : content;
+        const content = await readFile3(resolved2.target, "utf8");
+        return isEnvFile(resolved2.target) ? redactEnvValues(content) : content;
       } catch (err) {
         return `Error reading ${filePath}: ${err.message}`;
       }
@@ -2433,17 +2412,17 @@ function writeFileTool(ctx) {
     }),
     execute: async ({ filePath, content }) => {
       logger.info({ filePath }, "called writeFile tool");
-      const resolved = resolveInRoot(ctx, filePath);
-      if (resolved.ok === false) return resolved.error;
-      if (isSecretEnvFile(resolved.target)) {
+      const resolved2 = resolveInRoot(ctx, filePath);
+      if (resolved2.ok === false) return resolved2.error;
+      if (isSecretEnvFile(resolved2.target)) {
         return `Refused: ${filePath} holds secrets. Use the writeCredentials tool to set Algolia environment variables, passing this file path.`;
       }
       try {
-        if (await hasSymlinkParent(ctx, resolved.target)) {
-          return `Refused: ${resolved.target} is outside the repo root (${ctx.root}).`;
+        if (await hasSymlinkParent(ctx, resolved2.target)) {
+          return `Refused: ${resolved2.target} is outside the repo root (${ctx.root}).`;
         }
-        await mkdir3(dirname4(resolved.target), { recursive: true });
-        await writeFile3(resolved.target, content, "utf8");
+        await mkdir3(dirname4(resolved2.target), { recursive: true });
+        await writeFile3(resolved2.target, content, "utf8");
         return `Wrote to ${filePath}`;
       } catch (err) {
         return `Error writing ${filePath}: ${err.message}`;
@@ -2460,6 +2439,40 @@ import { dirname as dirname5 } from "node:path";
 
 // src/lib/algoliaApiKey.ts
 import { z as z11 } from "zod";
+
+// src/lib/keychain.ts
+import { getPassword, setPassword } from "cross-keychain";
+var SERVICE = "algolia-wizard";
+function account(kind, index, appId) {
+  return `${kind}:${appId}:${index}`;
+}
+async function readStoredKey(kind, index, appId) {
+  try {
+    return await getPassword(SERVICE, account(kind, index, appId));
+  } catch (err) {
+    logger.warn(
+      { err: err.message, kind, index, appId },
+      "could not read the API key from the keychain"
+    );
+    return null;
+  }
+}
+async function storeKey(kind, index, appId, value) {
+  const name = account(kind, index, appId);
+  try {
+    await setPassword(SERVICE, name, value);
+    if (await getPassword(SERVICE, name) !== value) {
+      throw new Error("the keychain did not store the value");
+    }
+  } catch (err) {
+    logger.warn(
+      { err: err.message, kind, index, appId },
+      "could not store the API key in the keychain; the next run will create another"
+    );
+  }
+}
+
+// src/lib/algoliaApiKey.ts
 var WRITE_ACLS = [
   "addObject",
   "deleteObject",
@@ -2467,81 +2480,27 @@ var WRITE_ACLS = [
   "editSettings",
   "listIndexes"
 ];
-var WRITE_ACL_SET = new Set(WRITE_ACLS);
-var apiKeySchema = z11.object({
-  value: z11.string().min(1),
-  acl: z11.array(z11.string()).default([]),
-  indexes: z11.array(z11.string()).default([])
-});
-var apiKeyListSchema = z11.union([
-  z11.array(apiKeySchema),
-  z11.object({
-    items: z11.array(apiKeySchema).optional(),
-    keys: z11.array(apiKeySchema).optional()
-  })
-]).transform((o) => Array.isArray(o) ? o : o.items ?? o.keys ?? []);
-function parseCliJson(schema, stdout, command) {
-  let raw;
-  try {
-    raw = JSON.parse(stdout);
-  } catch {
-    throw new Error(`Algolia CLI \`${command}\` returned unreadable JSON.`);
-  }
-  const parsed = schema.safeParse(raw);
-  if (!parsed.success) {
-    throw new Error(
-      `Algolia CLI \`${command}\` returned JSON in an unexpected shape.`
-    );
-  }
-  return parsed.data;
-}
 var createdKeySchema = z11.object({
   key: z11.string().min(1).optional(),
   value: z11.string().min(1).optional()
 }).transform((o) => o.key ?? o.value);
-function canReuseForWrites(key, index) {
-  return WRITE_ACLS.every((acl) => key.acl.includes(acl)) && key.acl.every((acl) => WRITE_ACL_SET.has(acl)) && key.indexes.includes(index);
-}
-async function resolveWriteKey(index) {
-  const stdout = await runAlgoliaCli(["apikeys", "list", "-o", "json"]);
-  const existing = parseCliJson(apiKeyListSchema, stdout, "apikeys list").find(
-    (key) => canReuseForWrites(key, index)
-  )?.value;
-  if (existing) {
-    logger.info({ index }, "reusing existing write API key");
-    return existing;
-  }
-  logger.info({ index }, "no reusable write key found; creating one");
-  const created = await runAlgoliaCli([
-    "apikeys",
-    "create",
-    "--indices",
-    index,
-    "--acl",
-    WRITE_ACLS.join(","),
-    "--description",
-    `wizard write key for ${index}`,
-    "-o",
-    "json"
-  ]);
-  const writeKey = parseCliJson(createdKeySchema, created, "apikeys create");
-  if (!writeKey) throw new Error("apikeys create returned no key value");
-  return writeKey;
-}
-async function createSearchOnlyKey(index) {
-  logger.info({ index }, "creating a search-only API key");
-  const stdout = await runAlgoliaCli([
-    "apikeys",
-    "create",
-    "--acl",
-    "search",
-    "--indices",
-    index,
-    "--description",
-    `Algolia Wizard search-only key for ${index}`,
-    "-o",
-    "json"
-  ]);
+async function createKey(index, acls, description) {
+  logger.info({ index, acls }, "creating an API key");
+  const stdout = await runAlgoliaCli(
+    [
+      "apikeys",
+      "create",
+      "--acl",
+      acls.join(","),
+      "--indices",
+      index,
+      "--description",
+      description,
+      "-o",
+      "json"
+    ],
+    { withoutAdminKey: true }
+  );
   let payload;
   try {
     payload = JSON.parse(stdout);
@@ -2552,49 +2511,57 @@ async function createSearchOnlyKey(index) {
   if (!created) throw new Error("apikeys create returned no key value");
   return created;
 }
-async function apiKeyExists(key) {
-  try {
-    await runAlgoliaCli(["apikeys", "get", key, "-o", "json"]);
-    return true;
-  } catch (err) {
-    return !/does not exist|not found|404/i.test(err.message);
-  }
+var resolved = /* @__PURE__ */ new Map();
+function forgetResolvedKeys() {
+  resolved.clear();
 }
-async function resolveSearchOnlyKey(index, appId, envKey) {
-  if (envKey) {
-    await recordSearchKey(index, appId, envKey);
-    return { key: envKey, source: "env" };
-  }
-  const stored = await getStoredSearchKey(index, appId);
-  if (stored) {
-    if (await apiKeyExists(stored)) {
-      logger.info({ index, appId }, "reusing the stored search-only API key");
-      return { key: stored, source: "config" };
+function resolveKey(kind, index, appId, acls, description) {
+  const cacheKey = `${kind}:${appId}:${index}`;
+  const cached = resolved.get(cacheKey);
+  if (cached) return cached;
+  const pending = provisionKey(kind, index, appId, acls, description).catch(
+    (err) => {
+      resolved.delete(cacheKey);
+      throw err;
     }
-    logger.warn(
-      { index, appId },
-      "the stored search-only API key no longer exists; creating a replacement"
-    );
-    await forgetSearchKey(index);
+  );
+  resolved.set(cacheKey, pending);
+  return pending;
+}
+async function provisionKey(kind, index, appId, acls, description) {
+  const stored = await readStoredKey(kind, index, appId);
+  if (stored) {
+    logger.info({ kind, index, appId }, "reusing the stored API key");
+    return { key: stored, source: "keychain" };
   }
-  const key = await createSearchOnlyKey(index);
-  await recordSearchKey(index, appId, key);
+  const key = await createKey(index, acls, description);
+  await storeKey(kind, index, appId, key);
   return { key, source: "created" };
 }
-async function recordSearchKey(index, appId, key) {
-  try {
-    await storeSearchKey(index, appId, key);
-  } catch (err) {
-    logger.warn(
-      { err: err.message, index },
-      "could not record the search-only API key; a later run may create another"
-    );
-  }
+function resolveWriteKey(index, appId) {
+  return resolveKey(
+    "write",
+    index,
+    appId,
+    WRITE_ACLS,
+    `Algolia Wizard write key for ${index} index`
+  );
+}
+async function resolveSearchOnlyKey(index, appId, envKey) {
+  if (envKey) return { key: envKey, source: "env" };
+  return resolveKey(
+    "search",
+    index,
+    appId,
+    ["search"],
+    `Algolia Wizard search-only key for ${index} index`
+  );
 }
 
 // src/lib/tools/writeAlgoliaCredentials.ts
 var APP_ID_VAR = "ALGOLIA_APPLICATION_ID";
 var API_KEY_VAR = "ALGOLIA_WRITE_API_KEY";
+var INDEX_NAME_VAR = "ALGOLIA_INDEX_NAME";
 function appendEnv(content, entries) {
   const prefix = content.length > 0 && !content.endsWith("\n") ? "\n" : "";
   const lines = entries.map(([name, value]) => `${name}=${value}
@@ -2604,9 +2571,16 @@ function appendEnv(content, entries) {
 function hasEnv(content, name) {
   return new RegExp(`^(\\s*(?:export\\s+)?${name})\\s*=`, "m").test(content);
 }
+function upsertEnv(content, name, value) {
+  if (!hasEnv(content, name)) return appendEnv(content, [[name, value]]);
+  return content.replace(
+    new RegExp(`^\\s*(?:export\\s+)?${name}\\s*=.*$`, "m"),
+    `${name}=${value}`
+  );
+}
 function writeCredentialsTool(ctx) {
   return tool6({
-    description: `Write the active Algolia credentials (${APP_ID_VAR} and ${API_KEY_VAR}) into the given env file. The credentials come from the selected Algolia application, with a write key scoped to the target index; you only pass the path to the env file (e.g. ".env"). If the file already defines ${APP_ID_VAR} or ${API_KEY_VAR}, the write is skipped and existing values are left untouched.`,
+    description: `Write the active Algolia credentials (${APP_ID_VAR} and ${API_KEY_VAR}) and the target index name (${INDEX_NAME_VAR}) into the given env file. The credentials come from the selected Algolia application, with a write key scoped to the target index; you only pass the path to the env file (e.g. ".env"). Any name the file already defines is left untouched.`,
     inputSchema: z12.object({
       filePath: z12.string().describe(
         'Path to the env file to write credentials into (e.g. ".env")'
@@ -2614,43 +2588,51 @@ function writeCredentialsTool(ctx) {
     }),
     execute: async ({ filePath }) => {
       logger.info({ filePath }, "called writeCredentials tool");
-      const resolved = resolveInRoot(ctx, filePath);
-      if (resolved.ok === false) return resolved.error;
+      const resolved2 = resolveInRoot(ctx, filePath);
+      if (resolved2.ok === false) return resolved2.error;
       const targetIndex = useWizard.getState().targetIndex;
       if (!targetIndex) {
         return "Error: no target index is set for this run, so a scoped write key cannot be provisioned.";
       }
-      let appId;
-      let writeKey;
-      try {
-        appId = (await requireApplication()).id;
-        writeKey = await resolveWriteKey(targetIndex);
-      } catch (err) {
-        return `Error: could not resolve Algolia credentials (${err.message}). Ask the user to authenticate with the Algolia CLI first.`;
-      }
+      let existing = "";
+      let present;
       try {
-        if (await hasSymlinkParent(ctx, resolved.target)) {
-          return `Refused: ${resolved.target} is outside the repo root (${ctx.root}).`;
+        if (await hasSymlinkParent(ctx, resolved2.target)) {
+          return `Refused: ${resolved2.target} is outside the repo root (${ctx.root}).`;
         }
-        let existing = "";
         try {
-          existing = await readFile4(resolved.target, "utf8");
+          existing = await readFile4(resolved2.target, "utf8");
         } catch (err) {
           if (err.code !== "ENOENT") throw err;
         }
-        const present = [APP_ID_VAR, API_KEY_VAR].filter(
+        present = [APP_ID_VAR, API_KEY_VAR].filter(
           (name) => hasEnv(existing, name)
         );
-        if (present.length > 0) {
-          return `Skipped: ${filePath} already defines ${present.join(" and ")}. Leaving existing credentials untouched.`;
+      } catch (err) {
+        return `Error writing credentials to ${filePath}: ${err.message}`;
+      }
+      let credentials = [];
+      if (present.length === 0) {
+        try {
+          const appId = (await requireApplication()).id;
+          credentials = [
+            [APP_ID_VAR, appId],
+            [API_KEY_VAR, (await resolveWriteKey(targetIndex, appId)).key]
+          ];
+        } catch (err) {
+          return `Error: could not resolve Algolia credentials (${err.message}). Ask the user to authenticate with the Algolia CLI first.`;
         }
-        const envWithCredentials = appendEnv(existing, [
-          [APP_ID_VAR, appId],
-          [API_KEY_VAR, writeKey]
-        ]);
-        await mkdir4(dirname5(resolved.target), { recursive: true });
-        await writeFile4(resolved.target, envWithCredentials, "utf8");
-        return `Wrote Algolia credentials to ${filePath}`;
+      }
+      try {
+        const updated = upsertEnv(
+          appendEnv(existing, credentials),
+          INDEX_NAME_VAR,
+          targetIndex
+        );
+        await mkdir4(dirname5(resolved2.target), { recursive: true });
+        await writeFile4(resolved2.target, updated, "utf8");
+        const wrote = `Wrote ${[...credentials.map(([name]) => name), INDEX_NAME_VAR].join(", ")} to ${filePath}`;
+        return present.length > 0 ? `${wrote}. Skipped ${present.join(" and ")}: already defined there.` : wrote;
       } catch (err) {
         return `Error writing credentials to ${filePath}: ${err.message}`;
       }
@@ -2698,8 +2680,8 @@ function searchFilesTool(ctx) {
       if (query.length > MAX_QUERY_LENGTH) {
         return `Refused: query exceeds ${MAX_QUERY_LENGTH} characters. Use a shorter pattern.`;
       }
-      const resolved = resolveInRoot(ctx, path);
-      if (!resolved.ok) return resolved.error;
+      const resolved2 = resolveInRoot(ctx, path);
+      if (!resolved2.ok) return resolved2.error;
       let re;
       try {
         re = new RegExp(query);
@@ -2707,7 +2689,7 @@ function searchFilesTool(ctx) {
         return `Invalid regex: ${err.message}`;
       }
       const matches = [];
-      for (const file of await walkFiles(resolved.target)) {
+      for (const file of await walkFiles(resolved2.target)) {
         let content;
         try {
           content = await readFile5(file, "utf8");
@@ -2865,19 +2847,19 @@ function runShellTool(ctx) {
       if (++ctx.counts.shell > ctx.limits.shell) {
         return `Refused: command limit (${ctx.limits.shell}) reached. Stop running commands and report what you have.`;
       }
-      const resolved = resolveInRoot(ctx, cwd ?? ".");
-      if (!resolved.ok) return resolved.error;
-      logger.info({ command, cwd: resolved.target }, "called runShell tool");
-      const key = approvalKey(resolved.target, command);
+      const resolved2 = resolveInRoot(ctx, cwd ?? ".");
+      if (!resolved2.ok) return resolved2.error;
+      logger.info({ command, cwd: resolved2.target }, "called runShell tool");
+      const key = approvalKey(resolved2.target, command);
       const decision = ctx.shell.approved.has(key) ? "approve" : await ctx.shell.approve({
         command,
-        cwd: resolved.target,
+        cwd: resolved2.target,
         explanation
       });
       if (decision === "reject") {
         ctx.shell.executions.push({
           command,
-          cwd: resolved.target,
+          cwd: resolved2.target,
           approved: false
         });
         logger.info({ command }, "runShell: user rejected the command");
@@ -2890,7 +2872,7 @@ function runShellTool(ctx) {
         return {};
       });
       const run2 = await (ctx.shell.run ?? runShell)(command, {
-        cwd: resolved.target,
+        cwd: resolved2.target,
         env,
         timeoutMs: ctx.shell.timeoutMs
       });
@@ -2906,7 +2888,7 @@ function runShellTool(ctx) {
       await markInteraction();
       ctx.shell.executions.push({
         command,
-        cwd: resolved.target,
+        cwd: resolved2.target,
         approved: true,
         exitCode: run2.exitCode,
         output: run2.output,
@@ -2997,13 +2979,13 @@ function generateRecordTool(ctx) {
         }));
         const slug = entityName.toLowerCase().replace(/[^a-z0-9]+/g, "-");
         const relPath = `${DATA_DIR}/${slug}.json`;
-        const resolved = resolveInRoot(ctx, relPath);
-        if (resolved.ok === false) return resolved.error;
-        if (await hasSymlinkParent(ctx, resolved.target)) {
-          return `Refused: ${resolved.target} is outside the repo root (${ctx.root}).`;
+        const resolved2 = resolveInRoot(ctx, relPath);
+        if (resolved2.ok === false) return resolved2.error;
+        if (await hasSymlinkParent(ctx, resolved2.target)) {
+          return `Refused: ${resolved2.target} is outside the repo root (${ctx.root}).`;
         }
-        await mkdir5(dirname6(resolved.target), { recursive: true });
-        await writeFile5(resolved.target, JSON.stringify(records, null, 2), "utf8");
+        await mkdir5(dirname6(resolved2.target), { recursive: true });
+        await writeFile5(resolved2.target, JSON.stringify(records, null, 2), "utf8");
         logger.info({ entityName, count: records.length, relPath }, "generateRecord wrote records to disk");
         return {
           filePath: relPath,
@@ -3296,7 +3278,7 @@ async function runAnalysis(mode, extraInstructions = []) {
 // package.json
 var package_default = {
   name: "@algolia/wizard",
-  version: "0.9.0-rc.87.83",
+  version: "0.9.0-rc.87.86",
   description: "Magically implement Algolia functionality in your codebase",
   type: "module",
   engines: {
@@ -3347,6 +3329,7 @@ var package_default = {
     "@hono/node-server": "^2.0.10",
     "@segment/analytics-node": "^3.1.0",
     ai: "^6.0.190",
+    "cross-keychain": "^1.1.0",
     dotenv: "^17.4.2",
     hono: "^4.12.27",
     ink: "^7.0.5",
@@ -4023,13 +4006,17 @@ function publicEnvPrefix(language) {
 }
 var APP_ID_VAR_SUFFIX = "ALGOLIA_APP_ID";
 var SEARCH_KEY_VAR_SUFFIX = "ALGOLIA_SEARCH_API_KEY";
+var INDEX_VAR_SUFFIX = "ALGOLIA_INDEX_NAME";
 function appIdVar(language) {
   return `${publicEnvPrefix(language)}${APP_ID_VAR_SUFFIX}`;
 }
 function searchKeyVar(language) {
   return `${publicEnvPrefix(language)}${SEARCH_KEY_VAR_SUFFIX}`;
 }
-function searchEnvVars(language, appId, searchKey) {
+function searchIndexVar(language) {
+  return `${publicEnvPrefix(language)}${INDEX_VAR_SUFFIX}`;
+}
+function searchEnvVars(language, index, appId, searchKey) {
   return [
     {
       name: appIdVar(language),
@@ -4038,12 +4025,21 @@ function searchEnvVars(language, appId, searchKey) {
     {
       name: searchKeyVar(language),
       value: searchKey ?? "<your-algolia-search-only-api-key>"
+    },
+    // Wizard-supplied rather than written into the generated code, because an
+    // agent that retypes the name (appending the project name, re-casing it)
+    // leaves the UI querying an index that does not exist.
+    {
+      name: searchIndexVar(language),
+      value: index
     }
   ];
 }
 function baseInstructions(input) {
   return [
-    `Target Algolia index: ${input.targetIndex}`,
+    // Agents have renamed this (e.g. appending the project name), which the
+    // index-scoped keys then reject with a 403.
+    `Target Algolia index, to be used exactly as written \u2014 never renamed, re-cased, prefixed, or suffixed: "${input.targetIndex}"`,
     `Project languages and frameworks: ${JSON.stringify(input.language)}`,
     "Make minimal, idiomatic changes; do not touch unrelated code.",
     `Commands run through a shell on ${process.platform}. Write commands that work there.`,
@@ -4089,6 +4085,7 @@ function ingestionInstructions(input) {
       `Create an ingestion script under "${input.ingestDir}/" at the repo root.`,
       `Ingest only these confirmed entities (name, source paths, attributes): ${JSON.stringify(input.confirmed)}.`,
       `Ingesting writes to Algolia, so the script needs a write API key and App ID \u2014 read them from the ${API_KEY_VAR} and ${APP_ID_VAR} environment variables rather than hardcoding them. The wizard sets these when it runs the script.`,
+      `Read the index name from the ${INDEX_NAME_VAR} environment variable, which the wizard sets to "${input.targetIndex}". Never hardcode an index name or derive one from the project, file, or entity name \u2014 the write key only works for that exact index. Exit with an error if ${INDEX_NAME_VAR} is unset.`,
       "Write the script in the project's primary language, using Algolia's official client for that language. Do not use the raw HTTP API.",
       "After a successful ingest, the script must print exactly one line to stdout in the form `ALGOLIA_WIZARD_RECORD_COUNT=<n>`, where <n> is the total number of records pushed to Algolia. Print it last, on its own line, with no surrounding text.",
       ...algoliaClientDoc(input),
@@ -4110,8 +4107,9 @@ function searchInstructions(input) {
     ] : [
       "No bundled Algolia SDK reference exists for this stack, so rely on the project's own conventions and Algolia's official client for its language. Do not invent APIs \u2014 keep to the documented search endpoint and its parameters."
     ],
-    `Add the search UI at ${input.searchLocation ? `"${input.searchLocation}"` : "the best shared, always-rendered layout location (e.g. a header/nav component)"} so it is reachable across the app \u2014 at least a working search input and results list against the "${input.targetIndex}" index.`,
-    "Read the App ID and a search-only API key from env vars; never hardcode them. A search-only key is safe to expose client-side.",
+    `Add the search UI at ${input.searchLocation ? `"${input.searchLocation}"` : "the best shared, always-rendered layout location (e.g. a header/nav component)"} so it is reachable across the app \u2014 at least a working search input and results list against the target index.`,
+    `Read the index name from the ${searchIndexVar(input.language)} env var, which the wizard sets to "${input.targetIndex}". Never hardcode an index name or derive one from the project, file, or component name.`,
+    "Read the App ID, the search-only API key, and the index name from env vars; never hardcode them. A search-only key is safe to expose client-side.",
     // The key is provisioned only after verification passes, so the agent never
     // sees one. It must also leave .env alone: the wizard reads that file to
     // decide whether a key already exists, and an agent-invented value there
@@ -4203,7 +4201,6 @@ function ingestOutcome(executions, ingestCommand) {
     recordCount: parseIngestRecordCount(withCount[0]?.output ?? "")
   };
 }
-var PLACEHOLDER_WRITE_KEY = "ALGOLIA_WRITE_KEY_PLACEHOLDER";
 function makeToolContext(worktree, env = async () => ({})) {
   return createToolContext(
     DEFAULT_TOOL_LIMITS,
@@ -4328,7 +4325,7 @@ async function implement(ctx, useCases = DEFAULT_IMPLEMENT_USE_CASES, existingWo
       appId,
       // Names only: the search-only key is provisioned after verification, so
       // every value here is still a placeholder when the agent reads them.
-      searchEnvVars: searchEnvVars(language, appId),
+      searchEnvVars: searchEnvVars(language, targetIndex, appId),
       ingestDir: INGEST_DIR,
       ingestionSource,
       uploadFilePath,
@@ -4360,9 +4357,11 @@ async function implement(ctx, useCases = DEFAULT_IMPLEMENT_USE_CASES, existingWo
     let ingestRecordCount;
     let ingestDurationMs;
     let ingestOutcomeMessage;
-    const ingestionTools = ingestAppId ? makeToolContext(worktree, async () => ({
-      [APP_ID_VAR]: ingestAppId,
-      [API_KEY_VAR]: PLACEHOLDER_WRITE_KEY
+    const ingestKeyAppId = ingestAppId;
+    const ingestionTools = ingestKeyAppId ? makeToolContext(worktree, async () => ({
+      [APP_ID_VAR]: ingestKeyAppId,
+      [API_KEY_VAR]: (await resolveWriteKey(targetIndex, ingestKeyAppId)).key,
+      [INDEX_NAME_VAR]: targetIndex
     })) : void 0;
     const searchTools = makeToolContext(worktree);
     async function runImplementationUseCase(currentUseCase, extraInstructions = []) {
@@ -4482,14 +4481,14 @@ async function implement(ctx, useCases = DEFAULT_IMPLEMENT_USE_CASES, existingWo
       let searchKeyError;
       if (appId) {
         try {
-          const resolved = await resolveSearchOnlyKey(
+          const resolved2 = await resolveSearchOnlyKey(
             targetIndex,
             appId,
             envSearchKey
           );
-          searchKey = resolved.key;
+          searchKey = resolved2.key;
           summaries.push(
-            resolved.source === "created" ? `Created a new search-only Algolia API key for the "${targetIndex}" index in app ${appId} \u2014 safe to expose in frontend code.` : `Reused the existing search-only Algolia API key for the "${targetIndex}" index in app ${appId}.`
+            resolved2.source === "created" ? `Created a new search-only Algolia API key for the "${targetIndex}" index in app ${appId} \u2014 safe to expose in frontend code.` : `Reused the existing search-only Algolia API key for the "${targetIndex}" index in app ${appId}.`
           );
         } catch (err) {
           searchKeyError = err.message;
@@ -4499,7 +4498,12 @@ async function implement(ctx, useCases = DEFAULT_IMPLEMENT_USE_CASES, existingWo
           );
         }
       }
-      finalSearchEnvVars = searchEnvVars(language, appId, searchKey);
+      finalSearchEnvVars = searchEnvVars(
+        language,
+        targetIndex,
+        appId,
+        searchKey
+      );
       const resolvedSearchEnvVars = finalSearchEnvVars.filter(
         (v) => !v.value.startsWith("<")
       );
@@ -4883,6 +4887,7 @@ import { join as join10 } from "node:path";
 var KEEP = ["wizard.log"];
 async function resetProjectState() {
   const dir = stateDir();
+  forgetResolvedKeys();
   let entries;
   try {
     entries = await readdir4(dir);
@@ -4891,7 +4896,9 @@ async function resetProjectState() {
   }
   const targets = entries.filter((name) => !KEEP.includes(name));
   await Promise.all(
-    targets.map((name) => rm2(join10(dir, name), { recursive: true, force: true }))
+    targets.map(
+      (name) => rm2(join10(dir, name), { recursive: true, force: true })
+    )
   );
   return { dir, removed: targets };
 }
@@ -4899,6 +4906,7 @@ async function resetProjectState() {
 // src/main.tsx
 import { jsx as jsx15 } from "react/jsx-runtime";
 async function startup() {
+  setProjectRoot(process.cwd());
   let args;
   try {
     args = parseCliArgs(process.argv.slice(2));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@algolia/wizard",
-  "version": "0.9.0-rc.87.83",
+  "version": "0.9.0-rc.87.86",
   "description": "Magically implement Algolia functionality in your codebase",
   "type": "module",
   "engines": {
@@ -51,6 +51,7 @@
     "@hono/node-server": "^2.0.10",
     "@segment/analytics-node": "^3.1.0",
     "ai": "^6.0.190",
+    "cross-keychain": "^1.1.0",
     "dotenv": "^17.4.2",
     "hono": "^4.12.27",
     "ink": "^7.0.5",