@enterpriseai/cli 3.19.2 → 3.19.4

package/dist/commands/init.d.ts

@@ -34,6 +34,7 @@ export declare function resolveTemplateClonePlan(templateSource: string, version
 export declare function buildTemplateInstallArgs(from: string): string[];
 export declare function canRunTemplateScripts(from: string, trustTemplateScripts: boolean): boolean;
 export declare function consumeLastInitBinding(): InitTenantAppBinding | undefined;
+/** Scaffolds an app and its managed guidance, with optional AI tool selection for generated instructions. */
 export declare const initCommand: Command;
 export interface CreateCommandOptions {
     from: string;
@@ -79,6 +80,7 @@ export declare function resolveCreateCompletionPublicApiUrl(publicApiUrl: string
  * the operator's choice on a state-changing app create.
  */
 export declare function resolveCreateTenantContext(publicApiUrl: string, options: CreateCommandOptions): ReturnType<typeof resolveActiveTenantContext>;
+/** Builds init arguments from create's validated binding, onboarding answers, and selected AI tool. */
 export declare function buildForwardedInitArgs(nameArg: string | undefined, options: CreateCommandOptions, answers?: CreateOnboardingAnswers, tenantId?: string): string[];
 /**
  * Next-step copy for guided create. A failed or unchecked builder readiness must
@@ -104,6 +106,8 @@ interface ExistingAppSelection {
 }
 /** Select one exact app enrollment and derive its recorded runtime tenant. */
 export declare function selectExistingAppSelection(payload: unknown, requestedAppKey: string): ExistingAppSelection;
+/** Serialize init writers; existing-target rename is atomic, not a filesystem compare-and-swap. */
+export declare function updateInitProjectFile(targetDir: string, name: ".gitignore" | ".env.local", update: (content: Buffer) => Buffer, mode?: number): Promise<void>;
 export declare function isMissingGitIdentity(error: unknown): boolean;
 export declare function describeGitCommitFailure(error: unknown): string;
 export {};

package/dist/commands/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgCpC,OAAO,EAEL,0BAA0B,EAI3B,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EAML,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AA2BvB,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAgCxE;AAED,mGAAmG;AACnG,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAO1F;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAWhE;AAgBD,KAAK,YAAY,GACb,OAAO,GACP,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,aAAa,CAAC;AAsDlB,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAsDD,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,OAAO,GACb,MAAM,CAmCR;AAUD,wBAAgB,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAEvE;AAID;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQlE;AAED,wBAAgB,wBAAwB,CACtC,cAAc,EAAE,MAAM,EACtB,eAAe,CAAC,EAAE,MAAM,GACvB,iBAAiB,CAqCnB;AA4ED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAI/D;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,oBAAoB,EAAE,OAAO,GAC5B,OAAO,CAET;AAQD,wBAAgB,sBAAsB,IAAI,oBAAoB,GAAG,SAAS,CAIzE;AAED,eAAO,MAAM,WAAW,SAshBpB,CAAC;AAEL,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,UAAU,uBAAuB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,SAgFtB,CAAC;AA0EL,wHAAwH;AACxH,wBAAgB,mCAAmC,CAAC,YAAY,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAGnH;AAaD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,oBAAoB,GAC5B,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAM/C;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,uBAAuB,EACjC,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM,EAAE,CAgCV;AAqND;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,OAAO,EACrB,MAAM,EAAE,YAAY,GACnB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAoBtC;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOjD;AAoKD,UAAU,oBAAoB;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzC;AAuGD,UAAU,oBAAoB;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB;AAgBD,8EAA8E;AAC9E,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,OAAO,EAChB,eAAe,EAAE,MAAM,GACtB,oBAAoB,CAyCtB;AA2VD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAK5D;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAS/D"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsCpC,OAAO,EAEL,0BAA0B,EAI3B,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EAML,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AA2BvB,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAgCxE;AAED,mGAAmG;AACnG,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAO1F;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAWhE;AAgBD,KAAK,YAAY,GACb,OAAO,GACP,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,aAAa,CAAC;AAsDlB,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAsDD,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,OAAO,GACb,MAAM,CAmCR;AAUD,wBAAgB,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAEvE;AAID;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQlE;AAED,wBAAgB,wBAAwB,CACtC,cAAc,EAAE,MAAM,EACtB,eAAe,CAAC,EAAE,MAAM,GACvB,iBAAiB,CAqCnB;AA4ED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAI/D;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,oBAAoB,EAAE,OAAO,GAC5B,OAAO,CAET;AAQD,wBAAgB,sBAAsB,IAAI,oBAAoB,GAAG,SAAS,CAIzE;AAED,6GAA6G;AAC7G,eAAO,MAAM,WAAW,SAiiBpB,CAAC;AAEL,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,UAAU,uBAAuB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,SAgFtB,CAAC;AA0EL,wHAAwH;AACxH,wBAAgB,mCAAmC,CAAC,YAAY,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAGnH;AAaD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,oBAAoB,GAC5B,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAM/C;AAED,uGAAuG;AACvG,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,uBAAuB,EACjC,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM,EAAE,CAkCV;AAqND;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,OAAO,EACrB,MAAM,EAAE,YAAY,GACnB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAoBtC;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOjD;AAwKD,UAAU,oBAAoB;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzC;AAuGD,UAAU,oBAAoB;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB;AAgBD,8EAA8E;AAC9E,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,OAAO,EAChB,eAAe,EAAE,MAAM,GACtB,oBAAoB,CAyCtB;AA+UD,mGAAmG;AACnG,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,YAAY,GAAG,YAAY,EACjC,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,EACnC,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAyBf;AAkHD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAK5D;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAS/D"}

package/dist/commands/init.js

@@ -6,7 +6,8 @@ import { execFile } from "node:child_process";
 import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
 import { promisify } from "node:util";
-import { readFile, writeFile, access, mkdir, rm, cp, mkdtemp, chmod, realpath, } from "node:fs/promises";
+import { constants } from "node:fs";
+import { readFile, writeFile, access, mkdir, rm, cp, mkdtemp, chmod, realpath, lstat, open, link, rename, unlink, } from "node:fs/promises";
 import { basename, join, resolve } from "node:path";
 import { randomBytes } from "node:crypto";
 import ora from "ora";
@@ -19,7 +20,7 @@ import { browserLogin, isAuthenticated, loadTokens, resolveAuthConfig, storeToke
 import { publicApiUrlForHomeRegion, resolveActiveTenantContext, resolveMainCompanyTenantId, resolvePublicApiUrl, } from "../lib/tenant-context.js";
 import { buildTenantHierarchy, promptForTenantFromHierarchy, } from "../lib/tenant-hierarchy.js";
 import { isManagedPublicRequestTimeout, parseApiError, readManagedPublicResponseText, PlatformAPIClient, } from "../lib/api.js";
-import { findProjectRoot, patchEnvFile } from "../lib/config.js";
+import { entraScopeEnvPatch, findProjectRoot, patchEnvContent } from "../lib/config.js";
 import { pullCloudEnvValues } from "../lib/cloud-env.js";
 import { findGuidance } from "../lib/error-guidance/match.js";
 import { formatGuidanceText } from "../lib/error-guidance/render.js";
@@ -319,6 +320,7 @@ export function consumeLastInitBinding() {
     lastInitBinding = undefined;
     return binding;
 }
+/** Scaffolds an app and its managed guidance, with optional AI tool selection for generated instructions. */
 export const initCommand = new Command("init")
     .description("Scaffold a new application")
     .argument("[name]", "Name for the app (kebab-case)")
@@ -340,6 +342,7 @@ export const initCommand = new Command("init")
     .option("--binding-receipt-nonce <uuid>", "Fresh UUID binding this invocation to its private receipt")
     .option("--app-key <key>", "Bind the local project to an existing app instead of creating a new app")
     .option("--template-version <tag>", "Scaffold from a specific published app-template release (for example v1.2.0)")
+    .option("--tool <tool>", "AI tool to prepare for: codex, claude, vscode, grok, or antigravity")
     .option("--no-splash", "Skip the interactive EAI wordmark")
     .addHelpText("after", `
 Gofer AI CLI assets are installed by default:
@@ -356,6 +359,7 @@ repo or local path.
 Use --no-gofer only when you need a bare app scaffold.
 `)
     .action(async (nameArg, options) => {
+    const aiTool = validateCreateAiTool(options.tool);
     if ((options.bindingReceipt !== undefined || options.bindingReceiptNonce !== undefined)
         && (!options.skipPrompts || !nameArg))
         throw new Error("Init binding receipts require a named --skip-prompts invocation.");
@@ -525,13 +529,16 @@ Use --no-gofer only when you need a bare app scaffold.
     // Step 3: Generate .env.local with placeholders
     const envSpinner = startEaiStep("Generating .env.local...");
     try {
+        await ensureLocalEnvIgnored(targetDir);
         const envContent = generateEnvFile(initOptions);
-        await writeFile(join(targetDir, ".env.local"), envContent, "utf-8");
+        await updateInitProjectFile(targetDir, ".env.local", () => Buffer.from(envContent), 0o600);
         await hydrateEnvFromLoginContext(targetDir, initOptions.name, initOptions.parentTenantId, initOptions.tenantId, initOptions.tenantHomeRegion, initOptions.appKey);
         envSpinner.succeed("Generated .env.local");
     }
-    catch (_err) {
+    catch (err) {
         envSpinner.fail("Failed to generate .env.local");
+        out.error(errMsg(err));
+        process.exit(1);
     }
     // Step 4: Generate Object Types scaffold
     const typesSpinner = startEaiStep("Creating Object Types scaffold...");
@@ -697,6 +704,9 @@ Use --no-gofer only when you need a bare app scaffold.
         out.nestedDim(`Run ${chalk.cyan("eai provision entra")} inside the project to set up Entra authentication.`);
     }
     out.nestedDim(`Template: ${templatePlan.displaySource}`);
+    if (aiTool) {
+        out.nestedInfo(`AI tool: ${CREATE_AI_TOOL_LABELS[aiTool]}. Run \`eai start\` in the project to open your AI workspace.`);
+    }
     if (options.gofer) {
         out.nestedDim("Gofer: run eai start to open this project in a detected AI workspace with the public EAI skill.");
     }
@@ -820,6 +830,7 @@ export function resolveCreateTenantContext(publicApiUrl, options) {
         tenantId: options.companyTenant || options.tenant,
     });
 }
+/** Builds init arguments from create's validated binding, onboarding answers, and selected AI tool. */
 export function buildForwardedInitArgs(nameArg, options, answers, tenantId) {
     const appName = answers?.name || nameArg;
     const args = [];
@@ -862,6 +873,9 @@ export function buildForwardedInitArgs(nameArg, options, answers, tenantId) {
     if (options.packageProfile) {
         args.push("--package-profile", options.packageProfile);
     }
+    const aiTool = answers?.aiTool || validateCreateAiTool(options.tool);
+    if (aiTool)
+        args.push("--tool", aiTool);
     return args;
 }
 async function runCreatePreflight() {
@@ -1103,24 +1117,27 @@ async function provisionEntraInline(targetDir, appName, tenantId, publicApiUrl)
             out.warn(`The app registration ${result.clientId} exists, but the workspace allowlist was not updated. Run \`eai provision entra --force --debug\` after platform access is fixed.`);
             return false;
         }
+        const scopeEnv = entraScopeEnvPatch(result.scopes);
         if (result.clientSecret) {
-            await patchEnvFile(targetDir, {
+            await patchInitEnvFile(targetDir, {
                 ENTRA_CLIENT_ID: result.clientId,
                 ENTRA_CLIENT_SECRET: result.clientSecret,
                 AUTH_URL: authEndpointUrl,
                 NEXTAUTH_URL: authSiteUrl,
                 AUTH_TRUST_HOST: "true",
+                ...scopeEnv,
             });
             spinner.succeed(`Entra app registration ${result.existing ? "confirmed" : "created"}: ${chalk.dim(result.clientId)}`);
             out.warn("The client secret has been written to .env.local and cannot be retrieved again.");
             return true;
         }
         if (result.existing) {
-            await patchEnvFile(targetDir, {
+            await patchInitEnvFile(targetDir, {
                 ENTRA_CLIENT_ID: result.clientId,
                 AUTH_URL: authEndpointUrl,
                 NEXTAUTH_URL: authSiteUrl,
                 AUTH_TRUST_HOST: "true",
+                ...scopeEnv,
             });
             const hydratedSecret = await hydrateCloudSecret(targetDir, appName);
             spinner.succeed(`Entra app registration confirmed: ${chalk.dim(result.clientId)}`);
@@ -1155,7 +1172,7 @@ async function hydrateCloudSecret(targetDir, appName) {
         if (!secret) {
             return false;
         }
-        await patchEnvFile(targetDir, { ENTRA_CLIENT_SECRET: secret });
+        await patchInitEnvFile(targetDir, { ENTRA_CLIENT_SECRET: secret });
         return true;
     }
     catch {
@@ -1503,6 +1520,9 @@ async function hydrateEnvFromLoginContext(targetDir, appName, parentTenantId, pl
     const envKey = appName.replace(/-/g, "_").toUpperCase();
     const regionalPublicApiUrl = publicApiUrlForHomeRegion(tenantHomeRegion);
     const profileName = getActiveProfile();
+    // Persist only the selector. Private profile auth/API settings and CLI tokens
+    // remain in the user's local CLI configuration, outside the app repository.
+    patches.EAI_PROFILE = profileName;
     const profileConfig = await loadProfileConfig(profileName);
     if (profileConfig?.publicApiUrl) {
         patches.BASE_URL_PUBLIC_API = profileConfig.publicApiUrl;
@@ -1552,7 +1572,147 @@ async function hydrateEnvFromLoginContext(targetDir, appName, parentTenantId, pl
         patches.NEXT_PUBLIC_EAI_APP_KEY = appKey;
     }
     if (Object.keys(patches).length > 0) {
-        await patchEnvFile(targetDir, patches);
+        await patchInitEnvFile(targetDir, patches);
+    }
+}
+/** Apply every init hydration/provisioning patch through the protected credential writer. */
+async function patchInitEnvFile(targetDir, patches) {
+    await updateInitProjectFile(targetDir, ".env.local", content => Buffer.from(patchEnvContent(content.toString("utf8"), patches)), 0o600);
+}
+async function ensureLocalEnvIgnored(targetDir) {
+    await updateInitProjectFile(targetDir, ".gitignore", (content) => {
+        // Last-match precedence also protects custom templates which unignore env files.
+        const separator = content.length && content[content.length - 1] !== 10 ? "\n" : "";
+        return Buffer.concat([content, Buffer.from(`${separator}\n# Local app credentials and EAI CLI profile selector\n/.env.local\n/.env.local.eai-*.tmp\n`)]);
+    });
+}
+/** Serialize init writers; existing-target rename is atomic, not a filesystem compare-and-swap. */
+export async function updateInitProjectFile(targetDir, name, update, mode) {
+    const root = await realpath(targetDir);
+    const parent = await lstat(root);
+    const lockPath = join(root, `${name}.eai-init.lock`);
+    const lock = await open(lockPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+    const ownedLock = await lock.stat();
+    const assertLock = async () => {
+        const current = await lstat(lockPath);
+        if (!current.isFile() || current.nlink !== 1 || current.dev !== ownedLock.dev || current.ino !== ownedLock.ino) {
+            throw new Error(`Project ${name} initialization lock changed; inspect the project files before retrying.`);
+        }
+    };
+    const releaseOwnedLock = async () => {
+        await lock.close();
+        try {
+            const current = await lstat(lockPath);
+            if (current.isFile() && current.nlink === 1 && current.dev === ownedLock.dev && current.ino === ownedLock.ino)
+                await unlink(lockPath);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    };
+    try {
+        await assertLock();
+        await updateLockedInitProjectFile(root, parent, name, update, mode, assertLock);
+    }
+    finally {
+        await releaseOwnedLock();
+    }
+}
+async function updateLockedInitProjectFile(root, parent, name, update, mode, assertLock) {
+    const path = join(root, name);
+    const maxBytes = 1024 * 1024;
+    const unsafe = () => new Error(`Project ${name} must be an unlinked regular file within 1 MiB.`);
+    const sameFile = (left, right) => left.dev === right.dev && left.ino === right.ino
+        && left.size === right.size && left.mtimeMs === right.mtimeMs && left.ctimeMs === right.ctimeMs
+        && left.mode === right.mode && right.isFile() && right.nlink === 1;
+    const statLeaf = async () => {
+        try {
+            return await lstat(path);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return null;
+            throw error;
+        }
+    };
+    const original = await statLeaf();
+    if (original && (!original.isFile() || original.isSymbolicLink() || original.nlink !== 1 || original.size > maxBytes))
+        throw unsafe();
+    let content = Buffer.alloc(0);
+    if (original) {
+        const file = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0));
+        try {
+            const opened = await file.stat();
+            if (!sameFile(original, opened))
+                throw unsafe();
+            const buffer = Buffer.alloc(maxBytes + 1);
+            let length = 0;
+            while (length < buffer.length) {
+                const { bytesRead } = await file.read(buffer, length, buffer.length - length, null);
+                if (!bytesRead)
+                    break;
+                length += bytesRead;
+            }
+            if (length !== original.size || length > maxBytes || !sameFile(original, await file.stat()))
+                throw unsafe();
+            content = buffer.subarray(0, length);
+        }
+        finally {
+            await file.close();
+        }
+    }
+    const assertUnchanged = async () => {
+        const current = await statLeaf();
+        const parentAfter = await lstat(root);
+        if ((original ? !current || !sameFile(original, current) : current !== null)
+            || parent.dev !== parentAfter.dev || parent.ino !== parentAfter.ino || !parentAfter.isDirectory()) {
+            throw new Error(`Project ${name} changed during initialization; retry after checking the project files.`);
+        }
+    };
+    await assertUnchanged();
+    const updated = update(content);
+    const temporary = join(root, `${name}.eai-${randomBytes(16).toString("hex")}.tmp`);
+    const file = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+    const ownedTemporary = await file.stat();
+    const removeOwnedTemporary = async () => {
+        try {
+            const current = await lstat(temporary);
+            if (current.isFile() && current.dev === ownedTemporary.dev && current.ino === ownedTemporary.ino)
+                await unlink(temporary);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    };
+    try {
+        await file.writeFile(updated);
+        await file.chmod(mode ?? (original ? original.mode & 0o777 : 0o666 & ~process.umask()));
+        await file.sync();
+        const written = await file.stat();
+        if (!sameFile(written, await lstat(temporary)))
+            throw unsafe();
+        await assertLock();
+        await assertUnchanged();
+        // link publishes an absent target without replacing a concurrent occupant.
+        // Existing targets are rechecked under the cooperative lock, then renamed.
+        if (original)
+            await rename(temporary, path);
+        else {
+            await link(temporary, path);
+            await removeOwnedTemporary();
+        }
+        const published = await statLeaf();
+        const parentAfter = await lstat(root);
+        if (!published || !sameFile(await file.stat(), published)
+            || parent.dev !== parentAfter.dev || parent.ino !== parentAfter.ino || !parentAfter.isDirectory()) {
+            throw new Error(`Project ${name} publication could not be verified; inspect the project files before retrying.`);
+        }
+    }
+    finally {
+        await file.close();
+        await removeOwnedTemporary();
     }
 }
 function toDisplayName(name) {
@@ -2298,6 +2458,25 @@ await client.resources.create('MyType', { title: 'Hello' });
 | \`eai deploy trigger\` | Trigger deployment |
 | \`eai verify\` | Platform connectivity check |
 | \`eai doctor\` | Diagnose issues |
+| \`eai support\` | Review and approve a support report |
+
+## Support after an unresolved EAI error
+
+After an \`eai\` command fails, run \`eai errors explain <code-or-reason> --format json\`.
+Follow its diagnostics, approval requirements, and fixes once. Stop at its retry limit.
+If the command still fails, prepare a report with
+\`eai support --source harness --tool <current-tool> --format json\`.
+Use \`codex\`, \`claude\`, \`vscode\`, \`grok\`, or \`antigravity\` for \`<current-tool>\`.
+This command previews the locally redacted bundle in a noninteractive harness.
+Show the person the bundle summary and ask for explicit consent in the chat.
+Only after they approve that bundle, repeat the command with \`--yes --no-open\` and give them the returned link.
+If the bundle changes, show it again and ask for fresh consent. Never assume consent or run \`--yes\` automatically.
+Keep secrets, tokens, raw logs, and local \`.env\` values out of the chat.
+The CLI creates the draft; the AI never calls the support API itself.
+Report content stays in the draft body. The Support link fragment carries only its id and token.
+If sign-in is unavailable, give the person the plain Support page link returned by the CLI.
+In the welcome reply, say: If anything fails, say "get help" or type \`eai support\`; I can prepare a report for you to approve.
+If the person asks for help with a silent failure, start with the same report preview.
 
 ## App Delivery Checklist