@glasstrace/sdk 1.1.0 → 1.1.2

package/dist/cli/init.cjs

@@ -39,547 +39,96 @@ function formatAgentName(name) {
     gemini: "Gemini",
     cursor: "Cursor",
     windsurf: "Windsurf",
-    generic: "Generic"
+    generic: "Generic helper"
   };
   return displayNames[name];
 }
-var MCP_ENDPOINT, NEXT_CONFIG_NAMES;
+var NEXT_CONFIG_NAMES;
 var init_constants = __esm({
   "src/cli/constants.ts"() {
     "use strict";
-    MCP_ENDPOINT = "https://api.glasstrace.dev/mcp";
     NEXT_CONFIG_NAMES = ["next.config.ts", "next.config.js", "next.config.mjs"];
   }
 });
 
-// src/cli/scaffolder.ts
-function identityFingerprint(token) {
-  return `sha256:${(0, import_node_crypto.createHash)("sha256").update(token).digest("hex")}`;
-}
-function hasRegisterGlasstraceCall(content) {
-  return content.split("\n").some((line) => {
-    const uncommented = line.replace(/\/\/.*$/, "");
-    return /\bregisterGlasstrace\s*\(/.test(uncommented);
-  });
-}
-function injectRegisterGlasstrace(content) {
-  if (hasRegisterGlasstraceCall(content)) {
-    return { injected: false, content };
-  }
-  const registerFnRegex = /export\s+(?:async\s+)?function\s+register\s*\([^)]*\)\s*\{/;
-  const match = registerFnRegex.exec(content);
-  if (!match) {
-    return { injected: false, content };
-  }
-  const afterBrace = content.slice(match.index + match[0].length);
-  const indentMatch = /\n([ \t]+)/.exec(afterBrace);
-  const indent = indentMatch ? indentMatch[1] : "  ";
-  const importLine = 'import { registerGlasstrace } from "@glasstrace/sdk";\n';
-  const hasGlasstraceImport2 = content.includes("@glasstrace/sdk");
-  const insertPoint = match.index + match[0].length;
-  const callInjection = `
-${indent}// Glasstrace must be registered before other instrumentation
-${indent}registerGlasstrace();
-`;
-  let modified;
-  if (hasGlasstraceImport2) {
-    const importRegex = /import\s*\{([^}]+)\}\s*from\s*["']@glasstrace\/sdk["']/;
-    const importMatch = importRegex.exec(content);
-    if (importMatch) {
-      const specifiers = importMatch[1];
-      const alreadyImported = specifiers.split(",").some((s) => s.trim() === "registerGlasstrace");
-      if (alreadyImported) {
-        modified = content.slice(0, insertPoint) + callInjection + content.slice(insertPoint);
-      } else {
-        const existingImports = specifiers.trimEnd();
-        const separator = existingImports.endsWith(",") ? " " : ", ";
-        const updatedImport = `import { ${existingImports.trim()}${separator}registerGlasstrace } from "@glasstrace/sdk"`;
-        modified = content.replace(importMatch[0], updatedImport);
-        const newMatch = registerFnRegex.exec(modified);
-        if (newMatch) {
-          const newInsertPoint = newMatch.index + newMatch[0].length;
-          modified = modified.slice(0, newInsertPoint) + callInjection + modified.slice(newInsertPoint);
-        }
-      }
-    } else {
-      modified = importLine + content;
-      const newMatch = registerFnRegex.exec(modified);
-      if (newMatch) {
-        const newInsertPoint = newMatch.index + newMatch[0].length;
-        modified = modified.slice(0, newInsertPoint) + callInjection + modified.slice(newInsertPoint);
-      }
+// ../../node_modules/zod/v4/core/core.js
+// @__NO_SIDE_EFFECTS__
+function $constructor(name, initializer3, params) {
+  function init(inst, def) {
+    if (!inst._zod) {
+      Object.defineProperty(inst, "_zod", {
+        value: {
+          def,
+          constr: _,
+          traits: /* @__PURE__ */ new Set()
+        },
+        enumerable: false
+      });
     }
-  } else {
-    modified = importLine + content.slice(0, insertPoint) + callInjection + content.slice(insertPoint);
-  }
-  return { injected: true, content: modified };
-}
-function resolveInstrumentationTarget(projectRoot) {
-  const rootExisting = [];
-  const srcExisting = [];
-  for (const name of INSTRUMENTATION_FILENAMES) {
-    const rootPath = path.join(projectRoot, name);
-    if (isRegularFile(rootPath)) {
-      rootExisting.push(rootPath);
+    if (inst._zod.traits.has(name)) {
+      return;
     }
-    const srcPath = path.join(projectRoot, "src", name);
-    if (isRegularFile(srcPath)) {
-      srcExisting.push(srcPath);
+    inst._zod.traits.add(name);
+    initializer3(inst, def);
+    const proto = _.prototype;
+    const keys = Object.keys(proto);
+    for (let i = 0; i < keys.length; i++) {
+      const k = keys[i];
+      if (!(k in inst)) {
+        inst[k] = proto[k].bind(inst);
+      }
     }
   }
-  const existing = [...rootExisting, ...srcExisting];
-  if (rootExisting.length > 0 && srcExisting.length > 0) {
-    return {
-      target: null,
-      layout: null,
-      existing,
-      rootExisting,
-      srcExisting,
-      conflict: true
-    };
-  }
-  if (srcExisting.length > 0) {
-    return {
-      target: srcExisting[0],
-      layout: "src",
-      existing,
-      rootExisting,
-      srcExisting,
-      conflict: false
-    };
-  }
-  if (rootExisting.length > 0) {
-    return {
-      target: rootExisting[0],
-      layout: "root",
-      existing,
-      rootExisting,
-      srcExisting,
-      conflict: false
-    };
-  }
-  const srcDir = path.join(projectRoot, "src");
-  const layout = isDirectory(srcDir) ? "src" : "root";
-  const target = layout === "src" ? path.join(projectRoot, "src", "instrumentation.ts") : path.join(projectRoot, "instrumentation.ts");
-  return {
-    target,
-    layout,
-    existing,
-    rootExisting,
-    srcExisting,
-    conflict: false
-  };
-}
-function isDirectory(p) {
-  try {
-    return fs.statSync(p).isDirectory();
-  } catch {
-    return false;
+  const Parent = params?.Parent ?? Object;
+  class Definition extends Parent {
   }
-}
-function isRegularFile(p) {
-  try {
-    const stat2 = fs.lstatSync(p);
-    if (stat2.isSymbolicLink()) {
-      return fs.statSync(p).isFile();
+  Object.defineProperty(Definition, "name", { value: name });
+  function _(def) {
+    var _a2;
+    const inst = params?.Parent ? new Definition() : this;
+    init(inst, def);
+    (_a2 = inst._zod).deferred ?? (_a2.deferred = []);
+    for (const fn of inst._zod.deferred) {
+      fn();
     }
-    return stat2.isFile();
-  } catch {
-    return false;
+    return inst;
   }
-}
-function appendRegisterFunction(content) {
-  const importLine = 'import { registerGlasstrace } from "@glasstrace/sdk";\n';
-  const functionBlock = "\nexport async function register() {\n  // Glasstrace must be registered before Prisma instrumentation\n  // to ensure all ORM spans are captured correctly.\n  // If you use @prisma/instrumentation, import it after this call.\n  registerGlasstrace();\n}\n";
-  let withImport = content;
-  const hasGlasstraceImport2 = content.includes("@glasstrace/sdk");
-  if (!hasGlasstraceImport2) {
-    withImport = importLine + content;
-  } else {
-    const importRegex = /import\s*\{([^}]+)\}\s*from\s*["']@glasstrace\/sdk["']/;
-    const importMatch = importRegex.exec(content);
-    if (importMatch) {
-      const specifiers = importMatch[1];
-      const alreadyImported = specifiers.split(",").some((s) => s.trim() === "registerGlasstrace");
-      if (!alreadyImported) {
-        const existingImports = specifiers.trimEnd();
-        const separator = existingImports.endsWith(",") ? " " : ", ";
-        const updatedImport = `import { ${existingImports.trim()}${separator}registerGlasstrace } from "@glasstrace/sdk"`;
-        withImport = content.replace(importMatch[0], updatedImport);
-      }
-    } else {
-      withImport = importLine + content;
+  Object.defineProperty(_, "init", { value: init });
+  Object.defineProperty(_, Symbol.hasInstance, {
+    value: (inst) => {
+      if (params?.Parent && inst instanceof params.Parent)
+        return true;
+      return inst?._zod?.traits?.has(name);
     }
-  }
-  const trailingNewline = withImport.endsWith("\n") ? "" : "\n";
-  return withImport + trailingNewline + functionBlock;
-}
-async function defaultInstrumentationPrompt(question, defaultValue) {
-  if (!process.stdin.isTTY) return defaultValue;
-  const readline2 = await import("node:readline");
-  const rl = readline2.createInterface({
-    input: process.stdin,
-    output: process.stdout
-  });
-  return new Promise((resolve2) => {
-    const suffix = defaultValue ? " [Y/n] " : " [y/N] ";
-    rl.question(question + suffix, (answer) => {
-      rl.close();
-      const trimmed = answer.trim().toLowerCase();
-      if (trimmed === "") {
-        resolve2(defaultValue);
-        return;
-      }
-      resolve2(trimmed === "y" || trimmed === "yes");
-    });
   });
+  Object.defineProperty(_, "name", { value: name });
+  return _;
 }
-async function scaffoldInstrumentation(projectRoot, options = {}) {
-  const target = resolveInstrumentationTarget(projectRoot);
-  if (target.conflict) {
-    return {
-      action: "conflict",
-      // Point the user at the `src/` variant — modern Next.js apps with a
-      // `src/` directory load from there, so that's the merge target. The
-      // competing path is reported separately for the error message.
-      filePath: target.srcExisting[0],
-      conflictingPath: target.rootExisting[0]
+function config(newConfig) {
+  if (newConfig)
+    Object.assign(globalConfig, newConfig);
+  return globalConfig;
+}
+var NEVER, $brand, $ZodAsyncError, $ZodEncodeError, globalConfig;
+var init_core = __esm({
+  "../../node_modules/zod/v4/core/core.js"() {
+    "use strict";
+    NEVER = Object.freeze({
+      status: "aborted"
+    });
+    $brand = /* @__PURE__ */ Symbol("zod_brand");
+    $ZodAsyncError = class extends Error {
+      constructor() {
+        super(`Encountered Promise during synchronous parse. Use .parseAsync() instead.`);
+      }
     };
-  }
-  const filePath = target.target;
-  const layout = target.layout;
-  if (filePath === null || layout === null) {
-    return { action: "unrecognized" };
-  }
-  const force = options.force === true;
-  const prompt = options.prompt ?? defaultInstrumentationPrompt;
-  if (!fs.existsSync(filePath)) {
-    const content = `import { registerGlasstrace } from "@glasstrace/sdk";
-
-export async function register() {
-  // Glasstrace must be registered before Prisma instrumentation
-  // to ensure all ORM spans are captured correctly.
-  // If you use @prisma/instrumentation, import it after this call.
-  registerGlasstrace();
-}
-`;
-    fs.mkdirSync(path.dirname(filePath), { recursive: true });
-    fs.writeFileSync(filePath, content, "utf-8");
-    return { action: "created", filePath, layout };
-  }
-  const existing = fs.readFileSync(filePath, "utf-8");
-  if (hasRegisterGlasstraceCall(existing)) {
-    return { action: "already-registered", filePath, layout };
-  }
-  if (!force) {
-    const approved = await prompt(
-      `Merge registerGlasstrace() into ${path.relative(projectRoot, filePath)}?`,
-      false
-    );
-    if (!approved) {
-      return { action: "skipped", filePath, layout };
-    }
-  }
-  const injectResult = injectRegisterGlasstrace(existing);
-  if (injectResult.injected) {
-    fs.writeFileSync(filePath, injectResult.content, "utf-8");
-    return { action: "injected", filePath, layout };
-  }
-  const appended = appendRegisterFunction(existing);
-  fs.writeFileSync(filePath, appended, "utf-8");
-  return { action: "appended", filePath, layout };
-}
-async function scaffoldNextConfig(projectRoot) {
-  let configPath;
-  let configName;
-  for (const name of NEXT_CONFIG_NAMES) {
-    const candidate = path.join(projectRoot, name);
-    if (fs.existsSync(candidate)) {
-      configPath = candidate;
-      configName = name;
-      break;
-    }
-  }
-  if (configPath === void 0 || configName === void 0) {
-    return null;
-  }
-  const existing = fs.readFileSync(configPath, "utf-8");
-  if (existing.trim().length === 0) {
-    return { modified: false, reason: "empty-file" };
-  }
-  if (existing.includes("withGlasstraceConfig")) {
-    return { modified: false, reason: "already-wrapped" };
-  }
-  const isESM = configName.endsWith(".ts") || configName.endsWith(".mjs");
-  if (isESM) {
-    const importLine = 'import { withGlasstraceConfig } from "@glasstrace/sdk";\n';
-    const wrapResult2 = wrapExport(existing);
-    if (!wrapResult2.wrapped) {
-      return { modified: false, reason: "no-export" };
-    }
-    const modified2 = importLine + "\n" + wrapResult2.content;
-    fs.writeFileSync(configPath, modified2, "utf-8");
-    return { modified: true };
-  }
-  const requireLine = 'const { withGlasstraceConfig } = require("@glasstrace/sdk");\n';
-  const wrapResult = wrapCJSExport(existing);
-  if (!wrapResult.wrapped) {
-    return { modified: false, reason: "no-export" };
-  }
-  const modified = requireLine + "\n" + wrapResult.content;
-  fs.writeFileSync(configPath, modified, "utf-8");
-  return { modified: true };
-}
-function wrapExport(content) {
-  const marker = "export default";
-  const idx = content.lastIndexOf(marker);
-  if (idx === -1) {
-    return { content, wrapped: false };
-  }
-  const preamble = content.slice(0, idx);
-  const exprRaw = content.slice(idx + marker.length);
-  const expr = exprRaw.trim().replace(/;?\s*$/, "");
-  if (expr.length === 0) {
-    return { content, wrapped: false };
-  }
-  return {
-    content: preamble + `export default withGlasstraceConfig(${expr});
-`,
-    wrapped: true
-  };
-}
-function wrapCJSExport(content) {
-  const cjsMarker = "module.exports";
-  const cjsIdx = content.lastIndexOf(cjsMarker);
-  if (cjsIdx === -1) {
-    return { content, wrapped: false };
-  }
-  const preamble = content.slice(0, cjsIdx);
-  const afterMarker = content.slice(cjsIdx + cjsMarker.length);
-  const eqMatch = /^\s*=\s*/.exec(afterMarker);
-  if (!eqMatch) {
-    return { content, wrapped: false };
-  }
-  const exprRaw = afterMarker.slice(eqMatch[0].length);
-  const expr = exprRaw.trim().replace(/;?\s*$/, "");
-  if (expr.length === 0) {
-    return { content, wrapped: false };
-  }
-  return {
-    content: preamble + `module.exports = withGlasstraceConfig(${expr});
-`,
-    wrapped: true
-  };
-}
-function readEnvLocalApiKey(content) {
-  let last = null;
-  const regex = /^\s*GLASSTRACE_API_KEY\s*=\s*(.*)$/gm;
-  let match;
-  while ((match = regex.exec(content)) !== null) {
-    const raw = match[1].trim();
-    if (raw === "") continue;
-    const unquoted = raw.replace(/^(['"])(.*)\1$/, "$2");
-    if (unquoted === "" || unquoted === "your_key_here") continue;
-    last = unquoted;
-  }
-  return last;
-}
-function isDevApiKey(value) {
-  if (value === null || value === void 0) return false;
-  return value.trim().startsWith("gt_dev_");
-}
-async function scaffoldEnvLocal(projectRoot) {
-  const filePath = path.join(projectRoot, ".env.local");
-  if (fs.existsSync(filePath)) {
-    const existing = fs.readFileSync(filePath, "utf-8");
-    if (/^\s*#?\s*GLASSTRACE_API_KEY\s*=/m.test(existing)) {
-      return false;
-    }
-    const separator = existing.endsWith("\n") ? "" : "\n";
-    fs.writeFileSync(filePath, existing + separator + "# GLASSTRACE_API_KEY=your_key_here\n", "utf-8");
-    return true;
-  }
-  fs.writeFileSync(filePath, "# GLASSTRACE_API_KEY=your_key_here\n", "utf-8");
-  return true;
-}
-async function addCoverageMapEnv(projectRoot) {
-  const filePath = path.join(projectRoot, ".env.local");
-  if (!fs.existsSync(filePath)) {
-    fs.writeFileSync(filePath, "GLASSTRACE_COVERAGE_MAP=true\n", "utf-8");
-    return true;
-  }
-  const existing = fs.readFileSync(filePath, "utf-8");
-  const keyRegex = /^(\s*GLASSTRACE_COVERAGE_MAP\s*=\s*)(.*)$/m;
-  const keyMatch = keyRegex.exec(existing);
-  if (keyMatch) {
-    const currentValue = keyMatch[2].trim();
-    if (currentValue === "true") {
-      return false;
-    }
-    const updated = existing.replace(keyRegex, `${keyMatch[1]}true`);
-    fs.writeFileSync(filePath, updated, "utf-8");
-    return true;
-  }
-  const separator = existing.endsWith("\n") ? "" : "\n";
-  fs.writeFileSync(filePath, existing + separator + "GLASSTRACE_COVERAGE_MAP=true\n", "utf-8");
-  return true;
-}
-async function scaffoldGitignore(projectRoot) {
-  const filePath = path.join(projectRoot, ".gitignore");
-  if (fs.existsSync(filePath)) {
-    const existing = fs.readFileSync(filePath, "utf-8");
-    const lines = existing.split("\n").map((l) => l.trim());
-    if (lines.includes(".glasstrace/")) {
-      return false;
-    }
-    const separator = existing.endsWith("\n") ? "" : "\n";
-    fs.writeFileSync(filePath, existing + separator + ".glasstrace/\n", "utf-8");
-    return true;
-  }
-  fs.writeFileSync(filePath, ".glasstrace/\n", "utf-8");
-  return true;
-}
-function mcpConfigMatches(existingContent, expectedContent) {
-  const trimmedExpected = expectedContent.trim();
-  try {
-    const existingParsed = JSON.parse(existingContent);
-    const expectedParsed = JSON.parse(trimmedExpected);
-    return JSON.stringify(canonicalize(existingParsed)) === JSON.stringify(canonicalize(expectedParsed));
-  } catch {
-  }
-  return existingContent.trim() === trimmedExpected;
-}
-function canonicalize(value) {
-  if (Array.isArray(value)) {
-    return value.map(canonicalize);
-  }
-  if (value !== null && typeof value === "object") {
-    const obj = value;
-    const sorted = {};
-    for (const key of Object.keys(obj).sort()) {
-      sorted[key] = canonicalize(obj[key]);
-    }
-    return sorted;
-  }
-  return value;
-}
-async function scaffoldMcpMarker(projectRoot, anonKey) {
-  const dirPath = path.join(projectRoot, ".glasstrace");
-  const markerPath = path.join(dirPath, "mcp-connected");
-  const keyHash = identityFingerprint(anonKey);
-  if (fs.existsSync(markerPath)) {
-    try {
-      const existing = JSON.parse(fs.readFileSync(markerPath, "utf-8"));
-      if (existing.keyHash === keyHash) {
-        return false;
-      }
-    } catch {
-    }
-  }
-  fs.mkdirSync(dirPath, { recursive: true, mode: 448 });
-  const marker = JSON.stringify(
-    { keyHash, configuredAt: (/* @__PURE__ */ new Date()).toISOString() },
-    null,
-    2
-  );
-  fs.writeFileSync(markerPath, marker, { mode: 384 });
-  fs.chmodSync(markerPath, 384);
-  return true;
-}
-var import_node_crypto, fs, path, INSTRUMENTATION_FILENAMES;
-var init_scaffolder = __esm({
-  "src/cli/scaffolder.ts"() {
-    "use strict";
-    import_node_crypto = require("node:crypto");
-    fs = __toESM(require("node:fs"), 1);
-    path = __toESM(require("node:path"), 1);
-    init_constants();
-    INSTRUMENTATION_FILENAMES = [
-      "instrumentation.ts",
-      "instrumentation.js",
-      "instrumentation.mjs"
-    ];
-  }
-});
-
-// ../../node_modules/zod/v4/core/core.js
-// @__NO_SIDE_EFFECTS__
-function $constructor(name, initializer3, params) {
-  function init(inst, def) {
-    if (!inst._zod) {
-      Object.defineProperty(inst, "_zod", {
-        value: {
-          def,
-          constr: _,
-          traits: /* @__PURE__ */ new Set()
-        },
-        enumerable: false
-      });
-    }
-    if (inst._zod.traits.has(name)) {
-      return;
-    }
-    inst._zod.traits.add(name);
-    initializer3(inst, def);
-    const proto = _.prototype;
-    const keys = Object.keys(proto);
-    for (let i = 0; i < keys.length; i++) {
-      const k = keys[i];
-      if (!(k in inst)) {
-        inst[k] = proto[k].bind(inst);
-      }
-    }
-  }
-  const Parent = params?.Parent ?? Object;
-  class Definition extends Parent {
-  }
-  Object.defineProperty(Definition, "name", { value: name });
-  function _(def) {
-    var _a2;
-    const inst = params?.Parent ? new Definition() : this;
-    init(inst, def);
-    (_a2 = inst._zod).deferred ?? (_a2.deferred = []);
-    for (const fn of inst._zod.deferred) {
-      fn();
-    }
-    return inst;
-  }
-  Object.defineProperty(_, "init", { value: init });
-  Object.defineProperty(_, Symbol.hasInstance, {
-    value: (inst) => {
-      if (params?.Parent && inst instanceof params.Parent)
-        return true;
-      return inst?._zod?.traits?.has(name);
-    }
-  });
-  Object.defineProperty(_, "name", { value: name });
-  return _;
-}
-function config(newConfig) {
-  if (newConfig)
-    Object.assign(globalConfig, newConfig);
-  return globalConfig;
-}
-var NEVER, $brand, $ZodAsyncError, $ZodEncodeError, globalConfig;
-var init_core = __esm({
-  "../../node_modules/zod/v4/core/core.js"() {
-    "use strict";
-    NEVER = Object.freeze({
-      status: "aborted"
-    });
-    $brand = /* @__PURE__ */ Symbol("zod_brand");
-    $ZodAsyncError = class extends Error {
-      constructor() {
-        super(`Encountered Promise during synchronous parse. Use .parseAsync() instead.`);
-      }
-    };
-    $ZodEncodeError = class extends Error {
-      constructor(name) {
-        super(`Encountered unidirectional transform during encode: ${name}`);
-        this.name = "ZodEncodeError";
-      }
-    };
-    globalConfig = {};
+    $ZodEncodeError = class extends Error {
+      constructor(name) {
+        super(`Encountered unidirectional transform during encode: ${name}`);
+        this.name = "ZodEncodeError";
+      }
+    };
+    globalConfig = {};
   }
 });
 
@@ -15141,6 +14690,22 @@ async function readAnonKey(projectRoot) {
   }
   return null;
 }
+async function readClaimedKey(projectRoot) {
+  const root = projectRoot ?? process.cwd();
+  const modules = await loadFsPath();
+  if (!modules) return null;
+  const keyPath = modules.path.join(root, GLASSTRACE_DIR, CLAIMED_KEY_FILE);
+  try {
+    const content = await modules.fs.readFile(keyPath, "utf-8");
+    const trimmed = content.trim();
+    const parsed = DevApiKeySchema.safeParse(trimmed);
+    if (parsed.success) {
+      return parsed.data;
+    }
+  } catch {
+  }
+  return null;
+}
 async function getOrCreateAnonKey(projectRoot) {
   const root = projectRoot ?? process.cwd();
   const existingKey = await readAnonKey(root);
@@ -15182,21 +14747,208 @@ async function getOrCreateAnonKey(projectRoot) {
       } catch {
       }
     }
-    ephemeralKeyCache.set(root, newKey);
-    console.warn(
-      `[glasstrace] Failed to persist anonymous key to ${keyPath}: ${err instanceof Error ? err.message : String(err)}. Using ephemeral key.`
-    );
-    return newKey;
+    ephemeralKeyCache.set(root, newKey);
+    console.warn(
+      `[glasstrace] Failed to persist anonymous key to ${keyPath}: ${err instanceof Error ? err.message : String(err)}. Using ephemeral key.`
+    );
+    return newKey;
+  }
+}
+var GLASSTRACE_DIR, ANON_KEY_FILE, CLAIMED_KEY_FILE, fsPathCache, ephemeralKeyCache;
+var init_anon_key = __esm({
+  "src/anon-key.ts"() {
+    "use strict";
+    init_dist();
+    GLASSTRACE_DIR = ".glasstrace";
+    ANON_KEY_FILE = "anon_key";
+    CLAIMED_KEY_FILE = "claimed-key";
+    ephemeralKeyCache = /* @__PURE__ */ new Map();
+  }
+});
+
+// src/mcp-runtime.ts
+async function loadFsPath2() {
+  if (fsPathCache2 !== void 0) return fsPathCache2;
+  try {
+    const [fs10, path10] = await Promise.all([
+      import("node:fs/promises"),
+      import("node:path")
+    ]);
+    fsPathCache2 = { fs: fs10, path: path10 };
+    return fsPathCache2;
+  } catch {
+    fsPathCache2 = null;
+    return null;
+  }
+}
+function identityFingerprint(token) {
+  return `sha256:${(0, import_node_crypto.createHash)("sha256").update(token).digest("hex")}`;
+}
+function mcpConfigMatches(existingContent, expectedContent) {
+  const trimmedExpected = expectedContent.trim();
+  try {
+    const existingParsed = JSON.parse(existingContent);
+    const expectedParsed = JSON.parse(trimmedExpected);
+    return JSON.stringify(canonicalize(existingParsed)) === JSON.stringify(canonicalize(expectedParsed));
+  } catch {
+  }
+  return existingContent.trim() === trimmedExpected;
+}
+function canonicalize(value) {
+  if (Array.isArray(value)) {
+    return value.map(canonicalize);
+  }
+  if (value !== null && typeof value === "object") {
+    const obj = value;
+    const sorted = {};
+    for (const key of Object.keys(obj).sort()) {
+      sorted[key] = canonicalize(obj[key]);
+    }
+    return sorted;
+  }
+  return value;
+}
+function readEnvLocalApiKey(content) {
+  let last = null;
+  const regex = /^\s*GLASSTRACE_API_KEY\s*=\s*(.*)$/gm;
+  let match;
+  while ((match = regex.exec(content)) !== null) {
+    const raw = match[1].trim();
+    if (raw === "") continue;
+    const unquoted = raw.replace(/^(['"])(.*)\1$/, "$2");
+    if (unquoted === "" || unquoted === "your_key_here") continue;
+    last = unquoted;
+  }
+  return last;
+}
+function isDevApiKey(value) {
+  if (value === null || value === void 0) return false;
+  return value.trim().startsWith("gt_dev_");
+}
+function isAnonApiKey(value) {
+  if (value === null || value === void 0) return false;
+  return AnonApiKeySchema.safeParse(value).success;
+}
+async function resolveEffectiveMcpCredential(projectRoot) {
+  const root = projectRoot ?? process.cwd();
+  const warnings = [];
+  const envLocalKey = await readEnvLocalDevKey(root, warnings);
+  const claimedKey = envLocalKey === null ? await readClaimedKey(root) : null;
+  const anonKey = await readAnonKey(root);
+  let effective = null;
+  if (envLocalKey !== null) {
+    effective = { source: "env-local", key: envLocalKey };
+  } else if (claimedKey !== null) {
+    effective = { source: "claimed-key", key: claimedKey };
+    warnings.push("claimed-key-only");
+  } else if (anonKey !== null) {
+    effective = { source: "anon", key: anonKey };
+  }
+  return { effective, anonKey, warnings };
+}
+async function readEnvLocalDevKey(root, warnings) {
+  const modules = await loadFsPath2();
+  if (!modules) return null;
+  const envPath = modules.path.join(root, ".env.local");
+  let content;
+  try {
+    content = await modules.fs.readFile(envPath, "utf-8");
+  } catch {
+    return null;
+  }
+  const raw = readEnvLocalApiKey(content);
+  if (raw === null) return null;
+  const parsed = DevApiKeySchema.safeParse(raw);
+  if (!parsed.success) {
+    warnings.push("malformed-env-local");
+    return null;
+  }
+  return parsed.data;
+}
+async function readMcpMarker(projectRoot) {
+  const root = projectRoot ?? process.cwd();
+  const modules = await loadFsPath2();
+  if (!modules) return { status: "absent" };
+  const markerPath = modules.path.join(root, GLASSTRACE_DIR2, MCP_MARKER_FILE);
+  let content;
+  try {
+    content = await modules.fs.readFile(markerPath, "utf-8");
+  } catch {
+    return { status: "absent" };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(content);
+  } catch {
+    return { status: "corrupted" };
+  }
+  if (parsed === null || typeof parsed !== "object") {
+    return { status: "corrupted" };
+  }
+  const obj = parsed;
+  const version2 = obj["version"];
+  if (version2 === void 0) {
+    const keyHash = obj["keyHash"];
+    if (typeof keyHash !== "string" || keyHash === "") {
+      return { status: "corrupted" };
+    }
+    return {
+      status: "valid",
+      credentialSource: "anon",
+      credentialHash: keyHash
+    };
+  }
+  if (version2 === 2) {
+    const source = obj["credentialSource"];
+    const hash2 = obj["credentialHash"];
+    if (source !== "env-local" && source !== "claimed-key" && source !== "anon" || typeof hash2 !== "string" || hash2 === "") {
+      return { status: "corrupted" };
+    }
+    return {
+      status: "valid",
+      credentialSource: source,
+      credentialHash: hash2
+    };
+  }
+  if (typeof version2 === "number" && version2 > 2) {
+    return { status: "unknown-version" };
   }
+  return { status: "corrupted" };
 }
-var GLASSTRACE_DIR, ANON_KEY_FILE, fsPathCache, ephemeralKeyCache;
-var init_anon_key = __esm({
-  "src/anon-key.ts"() {
+async function writeMcpMarker(projectRoot, target) {
+  const modules = await loadFsPath2();
+  if (!modules) return false;
+  const dirPath = modules.path.join(projectRoot, GLASSTRACE_DIR2);
+  const markerPath = modules.path.join(dirPath, MCP_MARKER_FILE);
+  const state = await readMcpMarker(projectRoot);
+  if (state.status === "valid" && state.credentialSource === target.credentialSource && state.credentialHash === target.credentialHash) {
+    return false;
+  }
+  await modules.fs.mkdir(dirPath, { recursive: true, mode: 448 });
+  const body = JSON.stringify(
+    {
+      version: 2,
+      credentialSource: target.credentialSource,
+      credentialHash: target.credentialHash,
+      configuredAt: (/* @__PURE__ */ new Date()).toISOString()
+    },
+    null,
+    2
+  );
+  await modules.fs.writeFile(markerPath, body, { mode: 384 });
+  await modules.fs.chmod(markerPath, 384);
+  return true;
+}
+var import_node_crypto, MCP_ENDPOINT, fsPathCache2, MCP_MARKER_FILE, GLASSTRACE_DIR2;
+var init_mcp_runtime = __esm({
+  "src/mcp-runtime.ts"() {
     "use strict";
+    import_node_crypto = require("node:crypto");
     init_dist();
-    GLASSTRACE_DIR = ".glasstrace";
-    ANON_KEY_FILE = "anon_key";
-    ephemeralKeyCache = /* @__PURE__ */ new Map();
+    init_anon_key();
+    MCP_ENDPOINT = "https://api.glasstrace.dev/mcp";
+    MCP_MARKER_FILE = "mcp-connected";
+    GLASSTRACE_DIR2 = ".glasstrace";
   }
 });
 
@@ -15360,12 +15112,12 @@ var init_detect = __esm({
 });
 
 // src/agent-detection/configs.ts
-function generateMcpConfig(agent, endpoint, anonKey) {
+function generateMcpConfig(agent, endpoint, bearer) {
   if (!endpoint || endpoint.trim() === "") {
     throw new Error("endpoint must not be empty");
   }
-  if (!anonKey || anonKey.trim() === "") {
-    throw new Error("anonKey must not be empty");
+  if (!bearer || bearer.trim() === "") {
+    throw new Error("bearer must not be empty");
   }
   switch (agent.name) {
     case "claude":
@@ -15376,7 +15128,7 @@ function generateMcpConfig(agent, endpoint, anonKey) {
               type: "http",
               url: endpoint,
               headers: {
-                Authorization: `Bearer ${anonKey}`
+                Authorization: `Bearer ${bearer}`
               }
             }
           }
@@ -15400,7 +15152,7 @@ function generateMcpConfig(agent, endpoint, anonKey) {
             glasstrace: {
               httpUrl: endpoint,
               headers: {
-                Authorization: `Bearer ${anonKey}`
+                Authorization: `Bearer ${bearer}`
               }
             }
           }
@@ -15415,7 +15167,7 @@ function generateMcpConfig(agent, endpoint, anonKey) {
             glasstrace: {
               url: endpoint,
               headers: {
-                Authorization: `Bearer ${anonKey}`
+                Authorization: `Bearer ${bearer}`
               }
             }
           }
@@ -15430,7 +15182,7 @@ function generateMcpConfig(agent, endpoint, anonKey) {
             glasstrace: {
               serverUrl: endpoint,
               headers: {
-                Authorization: `Bearer ${anonKey}`
+                Authorization: `Bearer ${bearer}`
               }
             }
           }
@@ -15445,7 +15197,7 @@ function generateMcpConfig(agent, endpoint, anonKey) {
             glasstrace: {
               url: endpoint,
               headers: {
-                Authorization: `Bearer ${anonKey}`
+                Authorization: `Bearer ${bearer}`
               }
             }
           }
@@ -16743,677 +16495,1107 @@ async function runUninit(options) {
         }
       }
     }
-  } catch (err) {
-    errors.push(
-      `Failed to process .gitignore: ${err instanceof Error ? err.message : String(err)}`
+  } catch (err) {
+    errors.push(
+      `Failed to process .gitignore: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  try {
+    for (const configFile of MCP_CONFIG_FILES) {
+      const configPath = path5.join(projectRoot, configFile);
+      if (!fs5.existsSync(configPath)) {
+        continue;
+      }
+      const content = fs5.readFileSync(configPath, "utf-8");
+      const result = processJsonMcpConfig(content);
+      if (result.action === "deleted") {
+        if (!dryRun) {
+          fs5.unlinkSync(configPath);
+        }
+        summary.push(`${prefix}Deleted ${configFile}`);
+      } else if (result.action === "removed-key" && result.content !== void 0) {
+        if (!dryRun) {
+          fs5.writeFileSync(configPath, result.content, "utf-8");
+        }
+        summary.push(`${prefix}Removed glasstrace from ${configFile}`);
+      }
+    }
+    const codexConfigPath = path5.join(projectRoot, ".codex", "config.toml");
+    if (fs5.existsSync(codexConfigPath)) {
+      const content = fs5.readFileSync(codexConfigPath, "utf-8");
+      const tomlResult = processTomlMcpConfig(content);
+      if (tomlResult.action === "deleted") {
+        if (!dryRun) {
+          fs5.unlinkSync(codexConfigPath);
+        }
+        summary.push(`${prefix}Deleted .codex/config.toml`);
+      } else if (tomlResult.action === "removed-section" && tomlResult.content !== void 0) {
+        if (!dryRun) {
+          fs5.writeFileSync(codexConfigPath, tomlResult.content, "utf-8");
+        }
+        summary.push(`${prefix}Removed glasstrace from .codex/config.toml`);
+      }
+    }
+    const hasWindsurfMarkers = fs5.existsSync(path5.join(projectRoot, ".windsurfrules")) || fs5.existsSync(path5.join(projectRoot, ".windsurf"));
+    if (hasWindsurfMarkers) {
+      const windsurfConfigPath = path5.join(
+        os.homedir(),
+        ".codeium",
+        "windsurf",
+        "mcp_config.json"
+      );
+      if (fs5.existsSync(windsurfConfigPath)) {
+        const content = fs5.readFileSync(windsurfConfigPath, "utf-8");
+        const windsurfResult = processJsonMcpConfig(content);
+        const home = os.homedir();
+        const displayPath = windsurfConfigPath.startsWith(home) ? "~" + windsurfConfigPath.slice(home.length) : windsurfConfigPath;
+        if (windsurfResult.action === "deleted") {
+          if (!dryRun) {
+            fs5.unlinkSync(windsurfConfigPath);
+          }
+          summary.push(
+            `${prefix}Deleted global Windsurf config (${displayPath})`
+          );
+        } else if (windsurfResult.action === "removed-key" && windsurfResult.content !== void 0) {
+          if (!dryRun) {
+            fs5.writeFileSync(windsurfConfigPath, windsurfResult.content, "utf-8");
+          }
+          summary.push(
+            `${prefix}Removed glasstrace from global Windsurf config (${displayPath})`
+          );
+        }
+      }
+    }
+  } catch (err) {
+    errors.push(
+      `Failed to process MCP config: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  try {
+    for (const infoFile of AGENT_INFO_FILES) {
+      const filePath = path5.join(projectRoot, infoFile);
+      if (!fs5.existsSync(filePath)) {
+        continue;
+      }
+      const content = fs5.readFileSync(filePath, "utf-8");
+      const result = removeMarkerSection(content);
+      if (result.removed) {
+        if (result.content.trim().length === 0) {
+          if (!dryRun) {
+            fs5.unlinkSync(filePath);
+          }
+          summary.push(`${prefix}Deleted ${infoFile} (only contained Glasstrace section)`);
+        } else {
+          if (!dryRun) {
+            fs5.writeFileSync(filePath, result.content, "utf-8");
+          }
+          summary.push(`${prefix}Removed Glasstrace section from ${infoFile}`);
+        }
+      }
+    }
+  } catch (err) {
+    errors.push(
+      `Failed to process agent info files: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (summary.length === 0 && errors.length === 0) {
+    summary.push("No Glasstrace artifacts found \u2014 nothing to do.");
+  }
+  return { exitCode: errors.length > 0 ? 1 : 0, summary, warnings, errors };
+}
+var fs5, os, path5, MCP_CONFIG_FILES, AGENT_INFO_FILES;
+var init_uninit = __esm({
+  "src/cli/uninit.ts"() {
+    "use strict";
+    fs5 = __toESM(require("node:fs"), 1);
+    os = __toESM(require("node:os"), 1);
+    path5 = __toESM(require("node:path"), 1);
+    init_constants();
+    init_mcp_runtime();
+    init_discovery_file();
+    MCP_CONFIG_FILES = [".mcp.json", ".cursor/mcp.json", ".gemini/settings.json"];
+    AGENT_INFO_FILES = [
+      "CLAUDE.md",
+      "codex.md",
+      ".cursorrules"
+    ];
+  }
+});
+
+// src/cli/mcp-add.ts
+var mcp_add_exports = {};
+__export(mcp_add_exports, {
+  mcpAdd: () => mcpAdd,
+  registerViaCli: () => registerViaCli
+});
+async function registerViaCli(agent, bearer) {
+  if (!agent.cliAvailable) {
+    return false;
+  }
+  if (agent.name !== "codex" && !isAnonApiKey(bearer)) {
+    return false;
+  }
+  try {
+    switch (agent.name) {
+      case "claude": {
+        const payload = JSON.stringify({
+          type: "http",
+          url: MCP_ENDPOINT,
+          headers: { Authorization: `Bearer ${bearer}` }
+        });
+        await execFileAsync("claude", [
+          "mcp",
+          "add-json",
+          "glasstrace",
+          payload,
+          "--scope",
+          "project"
+        ]);
+        return true;
+      }
+      case "codex": {
+        await execFileAsync("codex", [
+          "mcp",
+          "add",
+          "glasstrace",
+          "--url",
+          MCP_ENDPOINT
+        ]);
+        const configPath = agent.mcpConfigPath;
+        if (configPath !== null && fs6.existsSync(configPath)) {
+          const content = fs6.readFileSync(configPath, "utf-8");
+          if (!content.includes("bearer_token_env_var")) {
+            const appendContent = content.endsWith("\n") ? "" : "\n";
+            fs6.writeFileSync(
+              configPath,
+              content + appendContent + 'bearer_token_env_var = "GLASSTRACE_API_KEY"\n',
+              "utf-8"
+            );
+          }
+        }
+        process.stderr.write(
+          "  Note: Set GLASSTRACE_API_KEY environment variable for Codex authentication.\n"
+        );
+        return true;
+      }
+      case "gemini": {
+        await execFileAsync("gemini", [
+          "mcp",
+          "add",
+          "--transport",
+          "http",
+          "--header",
+          `Authorization: Bearer ${bearer}`,
+          "glasstrace",
+          MCP_ENDPOINT
+        ]);
+        return true;
+      }
+      default:
+        return false;
+    }
+  } catch {
+    return false;
+  }
+}
+async function markerMatchesEffective(projectRoot, effective) {
+  const state = await readMcpMarker(projectRoot);
+  if (state.status !== "valid") return false;
+  return state.credentialHash === identityFingerprint(effective.key);
+}
+async function mcpAdd(options) {
+  const force = options?.force ?? false;
+  const dryRun = options?.dryRun ?? false;
+  const projectRoot = process.cwd();
+  const messages = [];
+  const resolved = await resolveEffectiveMcpCredential(projectRoot);
+  if (resolved.effective === null) {
+    return {
+      exitCode: 1,
+      results: [],
+      messages: ["Error: Run `glasstrace init` first to generate an API key."]
+    };
+  }
+  if (resolved.warnings.includes("claimed-key-only")) {
+    messages.push(
+      "Note: dev key was loaded from .glasstrace/claimed-key. Copy it into .env.local so your app and Codex pick it up automatically."
+    );
+  }
+  const markerPath = path6.join(projectRoot, ".glasstrace", "mcp-connected");
+  if (fs6.existsSync(markerPath) && !force) {
+    if (await markerMatchesEffective(projectRoot, resolved.effective)) {
+      return {
+        exitCode: 0,
+        results: [],
+        messages: ["MCP already configured. Use --force to reconfigure."]
+      };
+    }
+    messages.push(
+      "Detected a credential change since MCP was last configured. Refreshing MCP config so queries use the current account credential."
+    );
+  }
+  const agents = await detectAgents(projectRoot);
+  const detectedNonGeneric = agents.filter((a) => a.name !== "generic");
+  const genericAgent = agents.find((a) => a.name === "generic");
+  const targetAgents = genericAgent ? [...detectedNonGeneric, genericAgent] : detectedNonGeneric;
+  if (dryRun) {
+    messages.push("Dry run: would perform the following actions:", "");
+    for (const agent of targetAgents) {
+      const name = formatAgentName(agent.name);
+      if (agent.cliAvailable && resolved.effective.source === "anon") {
+        messages.push(
+          `  ${name}: Register via CLI (${agent.name} mcp add)`
+        );
+      } else if (agent.mcpConfigPath !== null) {
+        messages.push(
+          `  ${name}: Write config to ${agent.mcpConfigPath}`
+        );
+      }
+      if (agent.infoFilePath !== null) {
+        messages.push(
+          `  ${name}: Inject info section into ${agent.infoFilePath}`
+        );
+      }
+    }
+    messages.push(
+      "",
+      "  Update .gitignore with MCP config paths",
+      "  Create .glasstrace/mcp-connected marker"
     );
+    return { exitCode: 0, results: [], messages };
   }
-  try {
-    for (const configFile of MCP_CONFIG_FILES) {
-      const configPath = path5.join(projectRoot, configFile);
-      if (!fs5.existsSync(configPath)) {
-        continue;
-      }
-      const content = fs5.readFileSync(configPath, "utf-8");
-      const result = processJsonMcpConfig(content);
-      if (result.action === "deleted") {
-        if (!dryRun) {
-          fs5.unlinkSync(configPath);
-        }
-        summary.push(`${prefix}Deleted ${configFile}`);
-      } else if (result.action === "removed-key" && result.content !== void 0) {
-        if (!dryRun) {
-          fs5.writeFileSync(configPath, result.content, "utf-8");
-        }
-        summary.push(`${prefix}Removed glasstrace from ${configFile}`);
-      }
-    }
-    const codexConfigPath = path5.join(projectRoot, ".codex", "config.toml");
-    if (fs5.existsSync(codexConfigPath)) {
-      const content = fs5.readFileSync(codexConfigPath, "utf-8");
-      const tomlResult = processTomlMcpConfig(content);
-      if (tomlResult.action === "deleted") {
-        if (!dryRun) {
-          fs5.unlinkSync(codexConfigPath);
-        }
-        summary.push(`${prefix}Deleted .codex/config.toml`);
-      } else if (tomlResult.action === "removed-section" && tomlResult.content !== void 0) {
-        if (!dryRun) {
-          fs5.writeFileSync(codexConfigPath, tomlResult.content, "utf-8");
+  const results = [];
+  const bearer = resolved.effective.key;
+  for (const agent of targetAgents) {
+    const name = formatAgentName(agent.name);
+    if (agent.name !== "generic") {
+      const cliSuccess = await registerViaCli(agent, bearer);
+      if (cliSuccess) {
+        const infoContent = generateInfoSection(agent, MCP_ENDPOINT);
+        if (infoContent !== "") {
+          await injectInfoSection(agent, infoContent, projectRoot);
         }
-        summary.push(`${prefix}Removed glasstrace from .codex/config.toml`);
+        results.push({
+          agent: agent.name,
+          success: true,
+          method: "cli",
+          message: `${name}: Registered via CLI`
+        });
+        continue;
       }
     }
-    const hasWindsurfMarkers = fs5.existsSync(path5.join(projectRoot, ".windsurfrules")) || fs5.existsSync(path5.join(projectRoot, ".windsurf"));
-    if (hasWindsurfMarkers) {
-      const windsurfConfigPath = path5.join(
-        os.homedir(),
-        ".codeium",
-        "windsurf",
-        "mcp_config.json"
-      );
-      if (fs5.existsSync(windsurfConfigPath)) {
-        const content = fs5.readFileSync(windsurfConfigPath, "utf-8");
-        const windsurfResult = processJsonMcpConfig(content);
-        const home = os.homedir();
-        const displayPath = windsurfConfigPath.startsWith(home) ? "~" + windsurfConfigPath.slice(home.length) : windsurfConfigPath;
-        if (windsurfResult.action === "deleted") {
-          if (!dryRun) {
-            fs5.unlinkSync(windsurfConfigPath);
-          }
-          summary.push(
-            `${prefix}Deleted global Windsurf config (${displayPath})`
-          );
-        } else if (windsurfResult.action === "removed-key" && windsurfResult.content !== void 0) {
-          if (!dryRun) {
-            fs5.writeFileSync(windsurfConfigPath, windsurfResult.content, "utf-8");
+    if (agent.mcpConfigPath !== null) {
+      try {
+        const configContent = generateMcpConfig(agent, MCP_ENDPOINT, bearer);
+        await writeMcpConfig(agent, configContent, projectRoot);
+        if (fs6.existsSync(agent.mcpConfigPath)) {
+          const infoContent = generateInfoSection(agent, MCP_ENDPOINT);
+          if (infoContent !== "") {
+            await injectInfoSection(agent, infoContent, projectRoot);
           }
-          summary.push(
-            `${prefix}Removed glasstrace from global Windsurf config (${displayPath})`
-          );
+          results.push({
+            agent: agent.name,
+            success: true,
+            method: "file",
+            message: `${name}: Configured via ${agent.mcpConfigPath}`
+          });
+          continue;
         }
+        results.push({
+          agent: agent.name,
+          success: false,
+          method: "file",
+          message: `${name}: Failed to write config to ${agent.mcpConfigPath} (permission denied)`
+        });
+        continue;
+      } catch (err) {
+        results.push({
+          agent: agent.name,
+          success: false,
+          method: "file",
+          message: `${name}: Failed - ${err instanceof Error ? err.message : String(err)}`
+        });
+        continue;
       }
     }
-  } catch (err) {
-    errors.push(
-      `Failed to process MCP config: ${err instanceof Error ? err.message : String(err)}`
+    results.push({
+      agent: agent.name,
+      success: false,
+      method: "skipped",
+      message: `${name}: No registration method available`
+    });
+  }
+  await updateGitignore(
+    [".mcp.json", ".cursor/mcp.json", ".gemini/settings.json", ".codex/config.toml"],
+    projectRoot
+  );
+  const anySuccess = results.some((r) => r.success);
+  if (anySuccess) {
+    await writeMcpMarker(projectRoot, {
+      credentialSource: resolved.effective.source,
+      credentialHash: identityFingerprint(resolved.effective.key)
+    });
+  }
+  messages.push("", "MCP registration summary:");
+  for (const result of results) {
+    const icon = result.success ? "+" : "-";
+    messages.push(`  [${icon}] ${result.message}`);
+  }
+  if (results.length === 0) {
+    messages.push(
+      "  No agents detected. Place agent marker files (e.g., CLAUDE.md, .cursor/) in your project."
     );
   }
-  try {
-    for (const infoFile of AGENT_INFO_FILES) {
-      const filePath = path5.join(projectRoot, infoFile);
-      if (!fs5.existsSync(filePath)) {
-        continue;
-      }
-      const content = fs5.readFileSync(filePath, "utf-8");
-      const result = removeMarkerSection(content);
-      if (result.removed) {
-        if (result.content.trim().length === 0) {
-          if (!dryRun) {
-            fs5.unlinkSync(filePath);
-          }
-          summary.push(`${prefix}Deleted ${infoFile} (only contained Glasstrace section)`);
-        } else {
-          if (!dryRun) {
-            fs5.writeFileSync(filePath, result.content, "utf-8");
-          }
-          summary.push(`${prefix}Removed Glasstrace section from ${infoFile}`);
-        }
+  const detectedNonGenericResults = results.filter(
+    (r) => detectedNonGeneric.some((a) => a.name === r.agent)
+  );
+  const allDetectedNonGenericFailed = detectedNonGeneric.length > 0 && !detectedNonGenericResults.some((r) => r.success);
+  if (allDetectedNonGenericFailed) {
+    messages.push(
+      "",
+      "All detected agent registrations failed. Check errors above."
+    );
+    return { exitCode: 1, results, messages };
+  }
+  if (!anySuccess && results.length > 0) {
+    messages.push(
+      "",
+      "All agent registrations failed. Check errors above."
+    );
+    return { exitCode: 1, results, messages };
+  }
+  if (anySuccess) {
+    messages.push("", "MCP registration complete.");
+  }
+  return { exitCode: 0, results, messages };
+}
+var import_node_child_process2, fs6, path6, import_node_util, execFileAsync;
+var init_mcp_add = __esm({
+  "src/cli/mcp-add.ts"() {
+    "use strict";
+    import_node_child_process2 = require("node:child_process");
+    fs6 = __toESM(require("node:fs"), 1);
+    path6 = __toESM(require("node:path"), 1);
+    import_node_util = require("node:util");
+    init_mcp_runtime();
+    init_detect();
+    init_configs();
+    init_inject();
+    init_constants();
+    execFileAsync = (0, import_node_util.promisify)(import_node_child_process2.execFile);
+  }
+});
+
+// src/cli/validate.ts
+var validate_exports = {};
+__export(validate_exports, {
+  hasGlasstraceImport: () => hasGlasstraceImport,
+  hasRegisterGlasstraceImport: () => hasRegisterGlasstraceImport,
+  runValidate: () => runValidate
+});
+function hasGlasstraceImport(content) {
+  return /@glasstrace\/sdk/.test(content);
+}
+function hasRegisterGlasstraceImport(content) {
+  const match = /import\s*\{([^}]+)\}\s*from\s*["']@glasstrace\/sdk["']/;
+  const importMatch = match.exec(content);
+  if (!importMatch) return false;
+  return importMatch[1].split(",").map((s) => s.trim()).includes("registerGlasstrace");
+}
+async function runValidate(options) {
+  const { projectRoot } = options;
+  const issues = [];
+  const glasstraceDir = path7.join(projectRoot, ".glasstrace");
+  const instrumentationPath = path7.join(projectRoot, "instrumentation.ts");
+  const markerPath = path7.join(glasstraceDir, "mcp-connected");
+  const glasstraceDirExists = isDirectorySafe(glasstraceDir);
+  const instrumentationExists = fs7.existsSync(instrumentationPath);
+  const instrumentationContent = instrumentationExists ? safeReadFile(instrumentationPath) : null;
+  const markerExists = fs7.existsSync(markerPath);
+  const mcpConfigsPresent = MCP_CONFIG_CANDIDATES.filter(
+    (rel) => fs7.existsSync(path7.join(projectRoot, rel))
+  );
+  if (glasstraceDirExists) {
+    if (instrumentationContent === null || !hasRegisterGlasstraceImport(instrumentationContent)) {
+      issues.push({
+        code: "glasstrace-dir-without-register-import",
+        message: ".glasstrace/ exists but instrumentation.ts is missing the registerGlasstrace import.",
+        fix: "Run `npx glasstrace init` to re-scaffold instrumentation.ts, or remove .glasstrace/ if the SDK is no longer in use."
+      });
+    }
+  }
+  if (!glasstraceDirExists && instrumentationContent !== null) {
+    if (hasGlasstraceImport(instrumentationContent)) {
+      issues.push({
+        code: "sdk-import-without-glasstrace-dir",
+        message: "instrumentation.ts imports from @glasstrace/sdk but .glasstrace/ is missing.",
+        fix: "Run `npx glasstrace init` to recreate .glasstrace/, or `npx glasstrace uninit` to fully remove the SDK."
+      });
+    }
+  }
+  if (markerExists && mcpConfigsPresent.length === 0) {
+    issues.push({
+      code: "mcp-marker-without-configs",
+      message: ".glasstrace/mcp-connected marker is present but no MCP config files were found.",
+      fix: "Run `npx glasstrace mcp add --force` to regenerate MCP configs, or delete .glasstrace/mcp-connected."
+    });
+  }
+  if (!markerExists && mcpConfigsPresent.length > 0) {
+    issues.push({
+      code: "mcp-configs-without-marker",
+      message: `MCP config files exist (${mcpConfigsPresent.join(", ")}) but .glasstrace/mcp-connected marker is missing.`,
+      fix: "Run `npx glasstrace init` to re-register the marker, or `npx glasstrace uninit` to fully remove MCP configuration."
+    });
+  }
+  if (markerExists) {
+    try {
+      const [markerState, resolved] = await Promise.all([
+        readMcpMarker(projectRoot),
+        resolveEffectiveMcpCredential(projectRoot)
+      ]);
+      if (markerState.status === "valid" && resolved.effective !== null && markerState.credentialHash !== identityFingerprint(resolved.effective.key)) {
+        issues.push({
+          code: "mcp-helper-stale-credential",
+          message: "Managed MCP configs were last refreshed with a different credential than the project is now using. MCP queries may return no traces while the dashboard sees them.",
+          fix: "Run `npx glasstrace mcp add --force` to refresh managed MCP configs with the current credential."
+        });
       }
+    } catch {
     }
-  } catch (err) {
-    errors.push(
-      `Failed to process agent info files: ${err instanceof Error ? err.message : String(err)}`
+  }
+  const summary = [];
+  if (issues.length === 0) {
+    summary.push("Glasstrace install state is consistent.");
+  } else {
+    summary.push(
+      `Detected ${issues.length} inconsistenc${issues.length === 1 ? "y" : "ies"} in Glasstrace install state:`
     );
   }
-  if (summary.length === 0 && errors.length === 0) {
-    summary.push("No Glasstrace artifacts found \u2014 nothing to do.");
+  return {
+    exitCode: issues.length > 0 ? 1 : 0,
+    summary,
+    issues
+  };
+}
+function safeReadFile(filePath) {
+  try {
+    return fs7.readFileSync(filePath, "utf-8");
+  } catch {
+    return null;
   }
-  return { exitCode: errors.length > 0 ? 1 : 0, summary, warnings, errors };
 }
-var fs5, os, path5, MCP_CONFIG_FILES, AGENT_INFO_FILES;
-var init_uninit = __esm({
-  "src/cli/uninit.ts"() {
+function isDirectorySafe(dirPath) {
+  try {
+    if (!fs7.existsSync(dirPath)) return false;
+    return fs7.statSync(dirPath).isDirectory();
+  } catch {
+    return false;
+  }
+}
+var fs7, path7, MCP_CONFIG_CANDIDATES;
+var init_validate = __esm({
+  "src/cli/validate.ts"() {
     "use strict";
-    fs5 = __toESM(require("node:fs"), 1);
-    os = __toESM(require("node:os"), 1);
-    path5 = __toESM(require("node:path"), 1);
-    init_constants();
-    init_scaffolder();
-    init_discovery_file();
-    MCP_CONFIG_FILES = [".mcp.json", ".cursor/mcp.json", ".gemini/settings.json"];
-    AGENT_INFO_FILES = [
-      "CLAUDE.md",
-      "codex.md",
-      ".cursorrules"
+    fs7 = __toESM(require("node:fs"), 1);
+    path7 = __toESM(require("node:path"), 1);
+    init_mcp_runtime();
+    MCP_CONFIG_CANDIDATES = [
+      ".mcp.json",
+      ".cursor/mcp.json",
+      ".gemini/settings.json",
+      ".codex/config.toml",
+      ".glasstrace/mcp.json"
     ];
   }
 });
 
-// src/cli/mcp-add.ts
-var mcp_add_exports = {};
-__export(mcp_add_exports, {
-  mcpAdd: () => mcpAdd
+// src/cli/status.ts
+var status_exports = {};
+__export(status_exports, {
+  runStatus: () => runStatus
 });
-async function registerViaCli(agent, anonKey) {
-  if (!agent.cliAvailable) {
+function runStatus(options) {
+  const root = options.projectRoot;
+  return {
+    installed: checkInstalled(root),
+    initialized: checkInitialized(root),
+    instrumentation: checkInstrumentation(root),
+    configWrapped: checkConfigWrapped(root),
+    anonKey: checkAnonKey(root),
+    mcpConfigured: checkMcpConfigured(root),
+    agents: checkAgents(root),
+    runtime: readRuntimeState(root)
+  };
+}
+function checkInstalled(root) {
+  try {
+    const pkgPath = path8.join(root, "package.json");
+    const content = fs8.readFileSync(pkgPath, "utf-8");
+    const pkg = JSON.parse(content);
+    const deps = pkg["dependencies"];
+    const devDeps = pkg["devDependencies"];
+    return deps != null && "@glasstrace/sdk" in deps || devDeps != null && "@glasstrace/sdk" in devDeps;
+  } catch {
     return false;
   }
+}
+function checkInitialized(root) {
   try {
-    switch (agent.name) {
-      case "claude": {
-        const payload = JSON.stringify({
-          type: "http",
-          url: MCP_ENDPOINT,
-          headers: { Authorization: `Bearer ${anonKey}` }
-        });
-        await execFileAsync("claude", [
-          "mcp",
-          "add-json",
-          "glasstrace",
-          payload,
-          "--scope",
-          "project"
-        ]);
-        return true;
-      }
-      case "codex": {
-        await execFileAsync("codex", [
-          "mcp",
-          "add",
-          "glasstrace",
-          "--url",
-          MCP_ENDPOINT
-        ]);
-        const configPath = agent.mcpConfigPath;
-        if (configPath !== null && fs6.existsSync(configPath)) {
-          const content = fs6.readFileSync(configPath, "utf-8");
-          if (!content.includes("bearer_token_env_var")) {
-            const appendContent = content.endsWith("\n") ? "" : "\n";
-            fs6.writeFileSync(
-              configPath,
-              content + appendContent + 'bearer_token_env_var = "GLASSTRACE_API_KEY"\n',
-              "utf-8"
-            );
-          }
-        }
-        process.stderr.write(
-          "  Note: Set GLASSTRACE_API_KEY environment variable for Codex authentication.\n"
-        );
+    return fs8.statSync(path8.join(root, ".glasstrace")).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function checkInstrumentation(root) {
+  for (const name of INSTRUMENTATION_FILES) {
+    try {
+      const content = fs8.readFileSync(path8.join(root, name), "utf-8");
+      if (content.includes("registerGlasstrace")) {
         return true;
       }
-      case "gemini": {
-        await execFileAsync("gemini", [
-          "mcp",
-          "add",
-          "--transport",
-          "http",
-          "--header",
-          `Authorization: Bearer ${anonKey}`,
-          "glasstrace",
-          MCP_ENDPOINT
-        ]);
+    } catch {
+    }
+  }
+  return false;
+}
+function checkConfigWrapped(root) {
+  for (const name of NEXT_CONFIG_NAMES) {
+    try {
+      const content = fs8.readFileSync(path8.join(root, name), "utf-8");
+      if (content.includes("withGlasstraceConfig")) {
         return true;
       }
-      default:
-        return false;
+    } catch {
     }
+  }
+  return false;
+}
+function checkAnonKey(root) {
+  try {
+    return fs8.statSync(path8.join(root, ".glasstrace", "anon_key")).isFile();
   } catch {
     return false;
   }
 }
-async function mcpAdd(options) {
-  const force = options?.force ?? false;
-  const dryRun = options?.dryRun ?? false;
-  const projectRoot = process.cwd();
-  const messages = [];
-  const anonKey = await readAnonKey(projectRoot);
-  if (anonKey === null) {
-    return {
-      exitCode: 1,
-      results: [],
-      messages: ["Error: Run `glasstrace init` first to generate an API key."]
-    };
-  }
-  const markerPath = path6.join(projectRoot, ".glasstrace", "mcp-connected");
-  if (fs6.existsSync(markerPath) && !force) {
-    return {
-      exitCode: 0,
-      results: [],
-      messages: ["MCP already configured. Use --force to reconfigure."]
-    };
-  }
-  const agents = await detectAgents(projectRoot);
-  const detectedNonGeneric = agents.filter((a) => a.name !== "generic");
-  const targetAgents = detectedNonGeneric.length > 0 ? detectedNonGeneric : agents.filter((a) => a.name === "generic");
-  if (dryRun) {
-    messages.push("Dry run: would perform the following actions:", "");
-    for (const agent of targetAgents) {
-      const name = formatAgentName(agent.name);
-      if (agent.cliAvailable) {
-        messages.push(
-          `  ${name}: Register via CLI (${agent.name} mcp add)`
-        );
-      } else if (agent.mcpConfigPath !== null) {
-        messages.push(
-          `  ${name}: Write config to ${agent.mcpConfigPath}`
-        );
+function checkMcpConfigured(root) {
+  for (const name of MCP_JSON_FILES) {
+    try {
+      const content = fs8.readFileSync(path8.join(root, name), "utf-8");
+      const parsed = JSON.parse(content);
+      const mcpServers = parsed["mcpServers"];
+      if (mcpServers && typeof mcpServers === "object" && "glasstrace" in mcpServers) {
+        return true;
       }
-      if (agent.infoFilePath !== null) {
-        messages.push(
-          `  ${name}: Inject info section into ${agent.infoFilePath}`
-        );
+    } catch {
+    }
+  }
+  for (const name of MCP_TOML_FILES) {
+    try {
+      const content = fs8.readFileSync(path8.join(root, name), "utf-8");
+      if (content.includes("[mcp_servers.glasstrace]")) {
+        return true;
       }
+    } catch {
     }
-    messages.push(
-      "",
-      "  Update .gitignore with MCP config paths",
-      "  Create .glasstrace/mcp-connected marker"
-    );
-    return { exitCode: 0, results: [], messages };
   }
-  const results = [];
-  for (const agent of targetAgents) {
-    const name = formatAgentName(agent.name);
-    if (agent.name !== "generic") {
-      const cliSuccess = await registerViaCli(agent, anonKey);
-      if (cliSuccess) {
-        const infoContent = generateInfoSection(agent, MCP_ENDPOINT);
-        if (infoContent !== "") {
-          await injectInfoSection(agent, infoContent, projectRoot);
-        }
-        results.push({
-          agent: agent.name,
-          success: true,
-          method: "cli",
-          message: `${name}: Registered via CLI`
-        });
-        continue;
+  return false;
+}
+function checkAgents(root) {
+  const found = [];
+  for (const name of AGENT_INFO_FILES2) {
+    try {
+      const content = fs8.readFileSync(path8.join(root, name), "utf-8");
+      const hasHtmlMarkers = content.includes("<!-- glasstrace:mcp:start -->") && content.includes("<!-- glasstrace:mcp:end -->");
+      const hasHashMarkers = content.includes("# glasstrace:mcp:start") && content.includes("# glasstrace:mcp:end");
+      if (hasHtmlMarkers || hasHashMarkers) {
+        found.push(name);
       }
+    } catch {
     }
-    if (agent.mcpConfigPath !== null) {
-      try {
-        const configContent = generateMcpConfig(agent, MCP_ENDPOINT, anonKey);
-        await writeMcpConfig(agent, configContent, projectRoot);
-        if (fs6.existsSync(agent.mcpConfigPath)) {
-          const infoContent = generateInfoSection(agent, MCP_ENDPOINT);
-          if (infoContent !== "") {
-            await injectInfoSection(agent, infoContent, projectRoot);
+  }
+  return found;
+}
+function readRuntimeState(root) {
+  const empty = {
+    available: false,
+    stale: false,
+    coreState: null,
+    authState: null,
+    otelState: null,
+    otelScenario: null,
+    updatedAt: null,
+    pid: null
+  };
+  try {
+    const filePath = path8.join(root, ".glasstrace", "runtime-state.json");
+    const content = fs8.readFileSync(filePath, "utf-8");
+    const parsed = JSON.parse(content);
+    const updatedAt = typeof parsed.updatedAt === "string" ? parsed.updatedAt : null;
+    const pid = typeof parsed.pid === "number" ? parsed.pid : null;
+    const core = parsed.core;
+    const auth = parsed.auth;
+    const otel = parsed.otel;
+    const coreState = typeof core?.state === "string" ? core.state : null;
+    const authState = typeof auth?.state === "string" ? auth.state : null;
+    const otelState = typeof otel?.state === "string" ? otel.state : null;
+    const otelScenario = typeof otel?.scenario === "string" ? otel.scenario : null;
+    let stale = false;
+    if (coreState === "SHUTDOWN") {
+      stale = false;
+    } else if (updatedAt) {
+      const updatedMs = new Date(updatedAt).getTime();
+      const age = Number.isFinite(updatedMs) ? Date.now() - updatedMs : Infinity;
+      if (age > STALE_THRESHOLD_MS) {
+        if (pid && pid > 0) {
+          try {
+            process.kill(pid, 0);
+            stale = false;
+          } catch (err) {
+            const code = err?.code;
+            if (code === "EPERM") {
+              stale = false;
+            } else {
+              stale = true;
+            }
           }
-          results.push({
-            agent: agent.name,
-            success: true,
-            method: "file",
-            message: `${name}: Configured via ${agent.mcpConfigPath}`
-          });
-          continue;
+        } else {
+          stale = true;
         }
-        results.push({
-          agent: agent.name,
-          success: false,
-          method: "file",
-          message: `${name}: Failed to write config to ${agent.mcpConfigPath} (permission denied)`
-        });
-        continue;
-      } catch (err) {
-        results.push({
-          agent: agent.name,
-          success: false,
-          method: "file",
-          message: `${name}: Failed - ${err instanceof Error ? err.message : String(err)}`
-        });
-        continue;
       }
     }
-    results.push({
-      agent: agent.name,
-      success: false,
-      method: "skipped",
-      message: `${name}: No registration method available`
-    });
-  }
-  await updateGitignore(
-    [".mcp.json", ".cursor/mcp.json", ".gemini/settings.json", ".codex/config.toml"],
-    projectRoot
-  );
-  const anySuccess = results.some((r) => r.success);
-  if (anySuccess) {
-    await scaffoldMcpMarker(projectRoot, anonKey);
-  }
-  messages.push("", "MCP registration summary:");
-  for (const result of results) {
-    const icon = result.success ? "+" : "-";
-    messages.push(`  [${icon}] ${result.message}`);
-  }
-  if (results.length === 0) {
-    messages.push(
-      "  No agents detected. Place agent marker files (e.g., CLAUDE.md, .cursor/) in your project."
-    );
-  }
-  if (!anySuccess && results.length > 0) {
-    messages.push(
-      "",
-      "All agent registrations failed. Check errors above."
-    );
-    return { exitCode: 1, results, messages };
-  }
-  if (anySuccess) {
-    messages.push("", "MCP registration complete.");
+    return {
+      available: true,
+      stale,
+      coreState,
+      authState,
+      otelState,
+      otelScenario,
+      updatedAt,
+      pid
+    };
+  } catch {
+    return empty;
   }
-  return { exitCode: 0, results, messages };
 }
-var import_node_child_process2, fs6, path6, import_node_util, execFileAsync;
-var init_mcp_add = __esm({
-  "src/cli/mcp-add.ts"() {
+var fs8, path8, MCP_JSON_FILES, MCP_TOML_FILES, AGENT_INFO_FILES2, INSTRUMENTATION_FILES, STALE_THRESHOLD_MS;
+var init_status = __esm({
+  "src/cli/status.ts"() {
     "use strict";
-    import_node_child_process2 = require("node:child_process");
-    fs6 = __toESM(require("node:fs"), 1);
-    path6 = __toESM(require("node:path"), 1);
-    import_node_util = require("node:util");
-    init_anon_key();
-    init_detect();
-    init_configs();
-    init_inject();
-    init_scaffolder();
+    fs8 = __toESM(require("node:fs"), 1);
+    path8 = __toESM(require("node:path"), 1);
     init_constants();
-    execFileAsync = (0, import_node_util.promisify)(import_node_child_process2.execFile);
+    MCP_JSON_FILES = [".mcp.json", ".cursor/mcp.json", ".gemini/settings.json", ".glasstrace/mcp.json"];
+    MCP_TOML_FILES = [".codex/config.toml"];
+    AGENT_INFO_FILES2 = [
+      "CLAUDE.md",
+      "codex.md",
+      ".cursorrules"
+    ];
+    INSTRUMENTATION_FILES = [
+      "instrumentation.ts",
+      "instrumentation.js",
+      "instrumentation.mjs",
+      "src/instrumentation.ts",
+      "src/instrumentation.js",
+      "src/instrumentation.mjs"
+    ];
+    STALE_THRESHOLD_MS = 3e4;
   }
 });
 
-// src/cli/validate.ts
-var validate_exports = {};
-__export(validate_exports, {
-  hasGlasstraceImport: () => hasGlasstraceImport,
-  hasRegisterGlasstraceImport: () => hasRegisterGlasstraceImport,
-  runValidate: () => runValidate
+// src/cli/init.ts
+var init_exports = {};
+__export(init_exports, {
+  decideMcpConfigAction: () => decideMcpConfigAction,
+  gitignoreExcludesDiscoveryFile: () => gitignoreExcludesDiscoveryFile,
+  meetsNodeVersion: () => meetsNodeVersion,
+  rollbackSteps: () => rollbackSteps,
+  runInit: () => runInit,
+  verifyAnonKeyRegistration: () => verifyAnonKeyRegistration
 });
-function hasGlasstraceImport(content) {
-  return /@glasstrace\/sdk/.test(content);
-}
-function hasRegisterGlasstraceImport(content) {
-  const match = /import\s*\{([^}]+)\}\s*from\s*["']@glasstrace\/sdk["']/;
-  const importMatch = match.exec(content);
-  if (!importMatch) return false;
-  return importMatch[1].split(",").map((s) => s.trim()).includes("registerGlasstrace");
+module.exports = __toCommonJS(init_exports);
+var fs9 = __toESM(require("node:fs"), 1);
+var path9 = __toESM(require("node:path"), 1);
+var readline = __toESM(require("node:readline"), 1);
+
+// src/cli/scaffolder.ts
+var fs = __toESM(require("node:fs"), 1);
+var path = __toESM(require("node:path"), 1);
+init_constants();
+function hasRegisterGlasstraceCall(content) {
+  return content.split("\n").some((line) => {
+    const uncommented = line.replace(/\/\/.*$/, "");
+    return /\bregisterGlasstrace\s*\(/.test(uncommented);
+  });
 }
-function runValidate(options) {
-  const { projectRoot } = options;
-  const issues = [];
-  const glasstraceDir = path7.join(projectRoot, ".glasstrace");
-  const instrumentationPath = path7.join(projectRoot, "instrumentation.ts");
-  const markerPath = path7.join(glasstraceDir, "mcp-connected");
-  const glasstraceDirExists = isDirectorySafe(glasstraceDir);
-  const instrumentationExists = fs7.existsSync(instrumentationPath);
-  const instrumentationContent = instrumentationExists ? safeReadFile(instrumentationPath) : null;
-  const markerExists = fs7.existsSync(markerPath);
-  const mcpConfigsPresent = MCP_CONFIG_CANDIDATES.filter(
-    (rel) => fs7.existsSync(path7.join(projectRoot, rel))
-  );
-  if (glasstraceDirExists) {
-    if (instrumentationContent === null || !hasRegisterGlasstraceImport(instrumentationContent)) {
-      issues.push({
-        code: "glasstrace-dir-without-register-import",
-        message: ".glasstrace/ exists but instrumentation.ts is missing the registerGlasstrace import.",
-        fix: "Run `npx glasstrace init` to re-scaffold instrumentation.ts, or remove .glasstrace/ if the SDK is no longer in use."
-      });
+function injectRegisterGlasstrace(content) {
+  if (hasRegisterGlasstraceCall(content)) {
+    return { injected: false, content };
+  }
+  const registerFnRegex = /export\s+(?:async\s+)?function\s+register\s*\([^)]*\)\s*\{/;
+  const match = registerFnRegex.exec(content);
+  if (!match) {
+    return { injected: false, content };
+  }
+  const afterBrace = content.slice(match.index + match[0].length);
+  const indentMatch = /\n([ \t]+)/.exec(afterBrace);
+  const indent = indentMatch ? indentMatch[1] : "  ";
+  const importLine = 'import { registerGlasstrace } from "@glasstrace/sdk";\n';
+  const hasGlasstraceImport2 = content.includes("@glasstrace/sdk");
+  const insertPoint = match.index + match[0].length;
+  const callInjection = `
+${indent}// Glasstrace must be registered before other instrumentation
+${indent}registerGlasstrace();
+`;
+  let modified;
+  if (hasGlasstraceImport2) {
+    const importRegex = /import\s*\{([^}]+)\}\s*from\s*["']@glasstrace\/sdk["']/;
+    const importMatch = importRegex.exec(content);
+    if (importMatch) {
+      const specifiers = importMatch[1];
+      const alreadyImported = specifiers.split(",").some((s) => s.trim() === "registerGlasstrace");
+      if (alreadyImported) {
+        modified = content.slice(0, insertPoint) + callInjection + content.slice(insertPoint);
+      } else {
+        const existingImports = specifiers.trimEnd();
+        const separator = existingImports.endsWith(",") ? " " : ", ";
+        const updatedImport = `import { ${existingImports.trim()}${separator}registerGlasstrace } from "@glasstrace/sdk"`;
+        modified = content.replace(importMatch[0], updatedImport);
+        const newMatch = registerFnRegex.exec(modified);
+        if (newMatch) {
+          const newInsertPoint = newMatch.index + newMatch[0].length;
+          modified = modified.slice(0, newInsertPoint) + callInjection + modified.slice(newInsertPoint);
+        }
+      }
+    } else {
+      modified = importLine + content;
+      const newMatch = registerFnRegex.exec(modified);
+      if (newMatch) {
+        const newInsertPoint = newMatch.index + newMatch[0].length;
+        modified = modified.slice(0, newInsertPoint) + callInjection + modified.slice(newInsertPoint);
+      }
     }
+  } else {
+    modified = importLine + content.slice(0, insertPoint) + callInjection + content.slice(insertPoint);
   }
-  if (!glasstraceDirExists && instrumentationContent !== null) {
-    if (hasGlasstraceImport(instrumentationContent)) {
-      issues.push({
-        code: "sdk-import-without-glasstrace-dir",
-        message: "instrumentation.ts imports from @glasstrace/sdk but .glasstrace/ is missing.",
-        fix: "Run `npx glasstrace init` to recreate .glasstrace/, or `npx glasstrace uninit` to fully remove the SDK."
-      });
+  return { injected: true, content: modified };
+}
+var INSTRUMENTATION_FILENAMES = [
+  "instrumentation.ts",
+  "instrumentation.js",
+  "instrumentation.mjs"
+];
+function resolveInstrumentationTarget(projectRoot) {
+  const rootExisting = [];
+  const srcExisting = [];
+  for (const name of INSTRUMENTATION_FILENAMES) {
+    const rootPath = path.join(projectRoot, name);
+    if (isRegularFile(rootPath)) {
+      rootExisting.push(rootPath);
+    }
+    const srcPath = path.join(projectRoot, "src", name);
+    if (isRegularFile(srcPath)) {
+      srcExisting.push(srcPath);
     }
   }
-  if (markerExists && mcpConfigsPresent.length === 0) {
-    issues.push({
-      code: "mcp-marker-without-configs",
-      message: ".glasstrace/mcp-connected marker is present but no MCP config files were found.",
-      fix: "Run `npx glasstrace mcp add --force` to regenerate MCP configs, or delete .glasstrace/mcp-connected."
-    });
+  const existing = [...rootExisting, ...srcExisting];
+  if (rootExisting.length > 0 && srcExisting.length > 0) {
+    return {
+      target: null,
+      layout: null,
+      existing,
+      rootExisting,
+      srcExisting,
+      conflict: true
+    };
   }
-  if (!markerExists && mcpConfigsPresent.length > 0) {
-    issues.push({
-      code: "mcp-configs-without-marker",
-      message: `MCP config files exist (${mcpConfigsPresent.join(", ")}) but .glasstrace/mcp-connected marker is missing.`,
-      fix: "Run `npx glasstrace init` to re-register the marker, or `npx glasstrace uninit` to fully remove MCP configuration."
-    });
+  if (srcExisting.length > 0) {
+    return {
+      target: srcExisting[0],
+      layout: "src",
+      existing,
+      rootExisting,
+      srcExisting,
+      conflict: false
+    };
   }
-  const summary = [];
-  if (issues.length === 0) {
-    summary.push("Glasstrace install state is consistent.");
-  } else {
-    summary.push(
-      `Detected ${issues.length} inconsistenc${issues.length === 1 ? "y" : "ies"} in Glasstrace install state:`
-    );
+  if (rootExisting.length > 0) {
+    return {
+      target: rootExisting[0],
+      layout: "root",
+      existing,
+      rootExisting,
+      srcExisting,
+      conflict: false
+    };
   }
+  const srcDir = path.join(projectRoot, "src");
+  const layout = isDirectory(srcDir) ? "src" : "root";
+  const target = layout === "src" ? path.join(projectRoot, "src", "instrumentation.ts") : path.join(projectRoot, "instrumentation.ts");
   return {
-    exitCode: issues.length > 0 ? 1 : 0,
-    summary,
-    issues
+    target,
+    layout,
+    existing,
+    rootExisting,
+    srcExisting,
+    conflict: false
   };
 }
-function safeReadFile(filePath) {
+function isDirectory(p) {
   try {
-    return fs7.readFileSync(filePath, "utf-8");
+    return fs.statSync(p).isDirectory();
   } catch {
-    return null;
+    return false;
   }
 }
-function isDirectorySafe(dirPath) {
+function isRegularFile(p) {
   try {
-    if (!fs7.existsSync(dirPath)) return false;
-    return fs7.statSync(dirPath).isDirectory();
+    const stat2 = fs.lstatSync(p);
+    if (stat2.isSymbolicLink()) {
+      return fs.statSync(p).isFile();
+    }
+    return stat2.isFile();
   } catch {
     return false;
   }
 }
-var fs7, path7, MCP_CONFIG_CANDIDATES;
-var init_validate = __esm({
-  "src/cli/validate.ts"() {
-    "use strict";
-    fs7 = __toESM(require("node:fs"), 1);
-    path7 = __toESM(require("node:path"), 1);
-    MCP_CONFIG_CANDIDATES = [
-      ".mcp.json",
-      ".cursor/mcp.json",
-      ".gemini/settings.json",
-      ".codex/config.toml"
-    ];
+function appendRegisterFunction(content) {
+  const importLine = 'import { registerGlasstrace } from "@glasstrace/sdk";\n';
+  const functionBlock = "\nexport async function register() {\n  // Glasstrace must be registered before Prisma instrumentation\n  // to ensure all ORM spans are captured correctly.\n  // If you use @prisma/instrumentation, import it after this call.\n  registerGlasstrace();\n}\n";
+  let withImport = content;
+  const hasGlasstraceImport2 = content.includes("@glasstrace/sdk");
+  if (!hasGlasstraceImport2) {
+    withImport = importLine + content;
+  } else {
+    const importRegex = /import\s*\{([^}]+)\}\s*from\s*["']@glasstrace\/sdk["']/;
+    const importMatch = importRegex.exec(content);
+    if (importMatch) {
+      const specifiers = importMatch[1];
+      const alreadyImported = specifiers.split(",").some((s) => s.trim() === "registerGlasstrace");
+      if (!alreadyImported) {
+        const existingImports = specifiers.trimEnd();
+        const separator = existingImports.endsWith(",") ? " " : ", ";
+        const updatedImport = `import { ${existingImports.trim()}${separator}registerGlasstrace } from "@glasstrace/sdk"`;
+        withImport = content.replace(importMatch[0], updatedImport);
+      }
+    } else {
+      withImport = importLine + content;
+    }
   }
-});
-
-// src/cli/status.ts
-var status_exports = {};
-__export(status_exports, {
-  runStatus: () => runStatus
-});
-function runStatus(options) {
-  const root = options.projectRoot;
-  return {
-    installed: checkInstalled(root),
-    initialized: checkInitialized(root),
-    instrumentation: checkInstrumentation(root),
-    configWrapped: checkConfigWrapped(root),
-    anonKey: checkAnonKey(root),
-    mcpConfigured: checkMcpConfigured(root),
-    agents: checkAgents(root),
-    runtime: readRuntimeState(root)
-  };
+  const trailingNewline = withImport.endsWith("\n") ? "" : "\n";
+  return withImport + trailingNewline + functionBlock;
 }
-function checkInstalled(root) {
-  try {
-    const pkgPath = path8.join(root, "package.json");
-    const content = fs8.readFileSync(pkgPath, "utf-8");
-    const pkg = JSON.parse(content);
-    const deps = pkg["dependencies"];
-    const devDeps = pkg["devDependencies"];
-    return deps != null && "@glasstrace/sdk" in deps || devDeps != null && "@glasstrace/sdk" in devDeps;
-  } catch {
-    return false;
+async function defaultInstrumentationPrompt(question, defaultValue) {
+  if (!process.stdin.isTTY) return defaultValue;
+  const readline2 = await import("node:readline");
+  const rl = readline2.createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  return new Promise((resolve2) => {
+    const suffix = defaultValue ? " [Y/n] " : " [y/N] ";
+    rl.question(question + suffix, (answer) => {
+      rl.close();
+      const trimmed = answer.trim().toLowerCase();
+      if (trimmed === "") {
+        resolve2(defaultValue);
+        return;
+      }
+      resolve2(trimmed === "y" || trimmed === "yes");
+    });
+  });
+}
+async function scaffoldInstrumentation(projectRoot, options = {}) {
+  const target = resolveInstrumentationTarget(projectRoot);
+  if (target.conflict) {
+    return {
+      action: "conflict",
+      // Point the user at the `src/` variant — modern Next.js apps with a
+      // `src/` directory load from there, so that's the merge target. The
+      // competing path is reported separately for the error message.
+      filePath: target.srcExisting[0],
+      conflictingPath: target.rootExisting[0]
+    };
+  }
+  const filePath = target.target;
+  const layout = target.layout;
+  if (filePath === null || layout === null) {
+    return { action: "unrecognized" };
   }
+  const force = options.force === true;
+  const prompt = options.prompt ?? defaultInstrumentationPrompt;
+  if (!fs.existsSync(filePath)) {
+    const content = `import { registerGlasstrace } from "@glasstrace/sdk";
+
+export async function register() {
+  // Glasstrace must be registered before Prisma instrumentation
+  // to ensure all ORM spans are captured correctly.
+  // If you use @prisma/instrumentation, import it after this call.
+  registerGlasstrace();
 }
-function checkInitialized(root) {
-  try {
-    return fs8.statSync(path8.join(root, ".glasstrace")).isDirectory();
-  } catch {
-    return false;
+`;
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, content, "utf-8");
+    return { action: "created", filePath, layout };
+  }
+  const existing = fs.readFileSync(filePath, "utf-8");
+  if (hasRegisterGlasstraceCall(existing)) {
+    return { action: "already-registered", filePath, layout };
   }
+  if (!force) {
+    const approved = await prompt(
+      `Merge registerGlasstrace() into ${path.relative(projectRoot, filePath)}?`,
+      false
+    );
+    if (!approved) {
+      return { action: "skipped", filePath, layout };
+    }
+  }
+  const injectResult = injectRegisterGlasstrace(existing);
+  if (injectResult.injected) {
+    fs.writeFileSync(filePath, injectResult.content, "utf-8");
+    return { action: "injected", filePath, layout };
+  }
+  const appended = appendRegisterFunction(existing);
+  fs.writeFileSync(filePath, appended, "utf-8");
+  return { action: "appended", filePath, layout };
 }
-function checkInstrumentation(root) {
-  for (const name of INSTRUMENTATION_FILES) {
-    try {
-      const content = fs8.readFileSync(path8.join(root, name), "utf-8");
-      if (content.includes("registerGlasstrace")) {
-        return true;
-      }
-    } catch {
+async function scaffoldNextConfig(projectRoot) {
+  let configPath;
+  let configName;
+  for (const name of NEXT_CONFIG_NAMES) {
+    const candidate = path.join(projectRoot, name);
+    if (fs.existsSync(candidate)) {
+      configPath = candidate;
+      configName = name;
+      break;
     }
   }
-  return false;
-}
-function checkConfigWrapped(root) {
-  for (const name of NEXT_CONFIG_NAMES) {
-    try {
-      const content = fs8.readFileSync(path8.join(root, name), "utf-8");
-      if (content.includes("withGlasstraceConfig")) {
-        return true;
-      }
-    } catch {
+  if (configPath === void 0 || configName === void 0) {
+    return null;
+  }
+  const existing = fs.readFileSync(configPath, "utf-8");
+  if (existing.trim().length === 0) {
+    return { modified: false, reason: "empty-file" };
+  }
+  if (existing.includes("withGlasstraceConfig")) {
+    return { modified: false, reason: "already-wrapped" };
+  }
+  const isESM = configName.endsWith(".ts") || configName.endsWith(".mjs");
+  if (isESM) {
+    const importLine = 'import { withGlasstraceConfig } from "@glasstrace/sdk";\n';
+    const wrapResult2 = wrapExport(existing);
+    if (!wrapResult2.wrapped) {
+      return { modified: false, reason: "no-export" };
     }
+    const modified2 = importLine + "\n" + wrapResult2.content;
+    fs.writeFileSync(configPath, modified2, "utf-8");
+    return { modified: true };
   }
-  return false;
+  const requireLine = 'const { withGlasstraceConfig } = require("@glasstrace/sdk");\n';
+  const wrapResult = wrapCJSExport(existing);
+  if (!wrapResult.wrapped) {
+    return { modified: false, reason: "no-export" };
+  }
+  const modified = requireLine + "\n" + wrapResult.content;
+  fs.writeFileSync(configPath, modified, "utf-8");
+  return { modified: true };
 }
-function checkAnonKey(root) {
-  try {
-    return fs8.statSync(path8.join(root, ".glasstrace", "anon_key")).isFile();
-  } catch {
-    return false;
+function wrapExport(content) {
+  const marker = "export default";
+  const idx = content.lastIndexOf(marker);
+  if (idx === -1) {
+    return { content, wrapped: false };
+  }
+  const preamble = content.slice(0, idx);
+  const exprRaw = content.slice(idx + marker.length);
+  const expr = exprRaw.trim().replace(/;?\s*$/, "");
+  if (expr.length === 0) {
+    return { content, wrapped: false };
   }
+  return {
+    content: preamble + `export default withGlasstraceConfig(${expr});
+`,
+    wrapped: true
+  };
 }
-function checkMcpConfigured(root) {
-  for (const name of MCP_JSON_FILES) {
-    try {
-      const content = fs8.readFileSync(path8.join(root, name), "utf-8");
-      const parsed = JSON.parse(content);
-      const mcpServers = parsed["mcpServers"];
-      if (mcpServers && typeof mcpServers === "object" && "glasstrace" in mcpServers) {
-        return true;
-      }
-    } catch {
-    }
+function wrapCJSExport(content) {
+  const cjsMarker = "module.exports";
+  const cjsIdx = content.lastIndexOf(cjsMarker);
+  if (cjsIdx === -1) {
+    return { content, wrapped: false };
   }
-  for (const name of MCP_TOML_FILES) {
-    try {
-      const content = fs8.readFileSync(path8.join(root, name), "utf-8");
-      if (content.includes("[mcp_servers.glasstrace]")) {
-        return true;
-      }
-    } catch {
-    }
+  const preamble = content.slice(0, cjsIdx);
+  const afterMarker = content.slice(cjsIdx + cjsMarker.length);
+  const eqMatch = /^\s*=\s*/.exec(afterMarker);
+  if (!eqMatch) {
+    return { content, wrapped: false };
   }
-  return false;
+  const exprRaw = afterMarker.slice(eqMatch[0].length);
+  const expr = exprRaw.trim().replace(/;?\s*$/, "");
+  if (expr.length === 0) {
+    return { content, wrapped: false };
+  }
+  return {
+    content: preamble + `module.exports = withGlasstraceConfig(${expr});
+`,
+    wrapped: true
+  };
 }
-function checkAgents(root) {
-  const found = [];
-  for (const name of AGENT_INFO_FILES2) {
-    try {
-      const content = fs8.readFileSync(path8.join(root, name), "utf-8");
-      const hasHtmlMarkers = content.includes("<!-- glasstrace:mcp:start -->") && content.includes("<!-- glasstrace:mcp:end -->");
-      const hasHashMarkers = content.includes("# glasstrace:mcp:start") && content.includes("# glasstrace:mcp:end");
-      if (hasHtmlMarkers || hasHashMarkers) {
-        found.push(name);
-      }
-    } catch {
+async function scaffoldEnvLocal(projectRoot) {
+  const filePath = path.join(projectRoot, ".env.local");
+  if (fs.existsSync(filePath)) {
+    const existing = fs.readFileSync(filePath, "utf-8");
+    if (/^\s*#?\s*GLASSTRACE_API_KEY\s*=/m.test(existing)) {
+      return false;
     }
+    const separator = existing.endsWith("\n") ? "" : "\n";
+    fs.writeFileSync(filePath, existing + separator + "# GLASSTRACE_API_KEY=your_key_here\n", "utf-8");
+    return true;
   }
-  return found;
+  fs.writeFileSync(filePath, "# GLASSTRACE_API_KEY=your_key_here\n", "utf-8");
+  return true;
 }
-function readRuntimeState(root) {
-  const empty = {
-    available: false,
-    stale: false,
-    coreState: null,
-    authState: null,
-    otelState: null,
-    otelScenario: null,
-    updatedAt: null,
-    pid: null
-  };
-  try {
-    const filePath = path8.join(root, ".glasstrace", "runtime-state.json");
-    const content = fs8.readFileSync(filePath, "utf-8");
-    const parsed = JSON.parse(content);
-    const updatedAt = typeof parsed.updatedAt === "string" ? parsed.updatedAt : null;
-    const pid = typeof parsed.pid === "number" ? parsed.pid : null;
-    const core = parsed.core;
-    const auth = parsed.auth;
-    const otel = parsed.otel;
-    const coreState = typeof core?.state === "string" ? core.state : null;
-    const authState = typeof auth?.state === "string" ? auth.state : null;
-    const otelState = typeof otel?.state === "string" ? otel.state : null;
-    const otelScenario = typeof otel?.scenario === "string" ? otel.scenario : null;
-    let stale = false;
-    if (coreState === "SHUTDOWN") {
-      stale = false;
-    } else if (updatedAt) {
-      const updatedMs = new Date(updatedAt).getTime();
-      const age = Number.isFinite(updatedMs) ? Date.now() - updatedMs : Infinity;
-      if (age > STALE_THRESHOLD_MS) {
-        if (pid && pid > 0) {
-          try {
-            process.kill(pid, 0);
-            stale = false;
-          } catch (err) {
-            const code = err?.code;
-            if (code === "EPERM") {
-              stale = false;
-            } else {
-              stale = true;
-            }
-          }
-        } else {
-          stale = true;
-        }
-      }
+async function addCoverageMapEnv(projectRoot) {
+  const filePath = path.join(projectRoot, ".env.local");
+  if (!fs.existsSync(filePath)) {
+    fs.writeFileSync(filePath, "GLASSTRACE_COVERAGE_MAP=true\n", "utf-8");
+    return true;
+  }
+  const existing = fs.readFileSync(filePath, "utf-8");
+  const keyRegex = /^(\s*GLASSTRACE_COVERAGE_MAP\s*=\s*)(.*)$/m;
+  const keyMatch = keyRegex.exec(existing);
+  if (keyMatch) {
+    const currentValue = keyMatch[2].trim();
+    if (currentValue === "true") {
+      return false;
     }
-    return {
-      available: true,
-      stale,
-      coreState,
-      authState,
-      otelState,
-      otelScenario,
-      updatedAt,
-      pid
-    };
-  } catch {
-    return empty;
+    const updated = existing.replace(keyRegex, `${keyMatch[1]}true`);
+    fs.writeFileSync(filePath, updated, "utf-8");
+    return true;
   }
+  const separator = existing.endsWith("\n") ? "" : "\n";
+  fs.writeFileSync(filePath, existing + separator + "GLASSTRACE_COVERAGE_MAP=true\n", "utf-8");
+  return true;
 }
-var fs8, path8, MCP_JSON_FILES, MCP_TOML_FILES, AGENT_INFO_FILES2, INSTRUMENTATION_FILES, STALE_THRESHOLD_MS;
-var init_status = __esm({
-  "src/cli/status.ts"() {
-    "use strict";
-    fs8 = __toESM(require("node:fs"), 1);
-    path8 = __toESM(require("node:path"), 1);
-    init_constants();
-    MCP_JSON_FILES = [".mcp.json", ".cursor/mcp.json", ".gemini/settings.json", ".glasstrace/mcp.json"];
-    MCP_TOML_FILES = [".codex/config.toml"];
-    AGENT_INFO_FILES2 = [
-      "CLAUDE.md",
-      "codex.md",
-      ".cursorrules"
-    ];
-    INSTRUMENTATION_FILES = [
-      "instrumentation.ts",
-      "instrumentation.js",
-      "instrumentation.mjs",
-      "src/instrumentation.ts",
-      "src/instrumentation.js",
-      "src/instrumentation.mjs"
-    ];
-    STALE_THRESHOLD_MS = 3e4;
+async function scaffoldGitignore(projectRoot) {
+  const filePath = path.join(projectRoot, ".gitignore");
+  if (fs.existsSync(filePath)) {
+    const existing = fs.readFileSync(filePath, "utf-8");
+    const lines = existing.split("\n").map((l) => l.trim());
+    if (lines.includes(".glasstrace/")) {
+      return false;
+    }
+    const separator = existing.endsWith("\n") ? "" : "\n";
+    fs.writeFileSync(filePath, existing + separator + ".glasstrace/\n", "utf-8");
+    return true;
   }
-});
+  fs.writeFileSync(filePath, ".glasstrace/\n", "utf-8");
+  return true;
+}
 
 // src/cli/init.ts
-var init_exports = {};
-__export(init_exports, {
-  decideMcpConfigAction: () => decideMcpConfigAction,
-  gitignoreExcludesDiscoveryFile: () => gitignoreExcludesDiscoveryFile,
-  meetsNodeVersion: () => meetsNodeVersion,
-  rollbackSteps: () => rollbackSteps,
-  runInit: () => runInit,
-  verifyAnonKeyRegistration: () => verifyAnonKeyRegistration
-});
-module.exports = __toCommonJS(init_exports);
-var fs9 = __toESM(require("node:fs"), 1);
-var path9 = __toESM(require("node:path"), 1);
-var readline = __toESM(require("node:readline"), 1);
-init_scaffolder();
+init_mcp_runtime();
 
 // src/import-graph.ts
 var fs2 = __toESM(require("node:fs/promises"), 1);
@@ -18332,6 +18514,9 @@ Then add this as the first statement in your register() function:
       );
     }
     let anyConfigWritten = false;
+    let anyConfigRewrittenWithBearer = false;
+    const resolved = await resolveEffectiveMcpCredential(projectRoot);
+    const bearer = resolved.effective?.key ?? anonKey;
     if (isCI) {
       const genericAgent = {
         name: "generic",
@@ -18340,7 +18525,7 @@ Then add this as the first statement in your register() function:
         cliAvailable: false,
         registrationCommand: null
       };
-      const genericConfig = generateMcpConfig(genericAgent, MCP_ENDPOINT, anonKey);
+      const genericConfig = generateMcpConfig(genericAgent, MCP_ENDPOINT, bearer);
       const decision = await decideMcpConfigAction({
         configPath: genericAgent.mcpConfigPath,
         expectedContent: genericConfig,
@@ -18348,6 +18533,9 @@ Then add this as the first statement in your register() function:
       });
       if (decision !== "skip") {
         await writeMcpConfig(genericAgent, genericConfig, projectRoot);
+        if (genericAgent.mcpConfigPath !== null && fs9.existsSync(genericAgent.mcpConfigPath)) {
+          anyConfigRewrittenWithBearer = true;
+        }
       }
       if (genericAgent.mcpConfigPath !== null && fs9.existsSync(genericAgent.mcpConfigPath)) {
         anyConfigWritten = true;
@@ -18368,17 +18556,18 @@ Then add this as the first statement in your register() function:
           cliAvailable: false,
           registrationCommand: null
         };
-        const genericConfig = generateMcpConfig(genericAgent, MCP_ENDPOINT, anonKey);
+        const genericConfig = generateMcpConfig(genericAgent, MCP_ENDPOINT, bearer);
         await writeMcpConfig(genericAgent, genericConfig, projectRoot);
         if (genericAgent.mcpConfigPath !== null && fs9.existsSync(genericAgent.mcpConfigPath)) {
           anyConfigWritten = true;
+          anyConfigRewrittenWithBearer = true;
         }
         agents = [];
       }
       const configuredNames = [];
       for (const agent of agents) {
         try {
-          const configContent = generateMcpConfig(agent, MCP_ENDPOINT, anonKey);
+          const configContent = generateMcpConfig(agent, MCP_ENDPOINT, bearer);
           const decision = await decideMcpConfigAction({
             configPath: agent.mcpConfigPath,
             expectedContent: configContent,
@@ -18399,6 +18588,7 @@ Then add this as the first statement in your register() function:
             continue;
           }
           anyConfigWritten = true;
+          anyConfigRewrittenWithBearer = true;
           const infoContent = generateInfoSection(agent, MCP_ENDPOINT);
           if (infoContent !== "") {
             await injectInfoSection(agent, infoContent, projectRoot);
@@ -18422,8 +18612,13 @@ Then add this as the first statement in your register() function:
       [".mcp.json", ".cursor/mcp.json", ".gemini/settings.json", ".codex/config.toml"],
       projectRoot
     );
-    if (anyConfigWritten) {
-      const markerCreated = await scaffoldMcpMarker(projectRoot, anonKey);
+    if (anyConfigRewrittenWithBearer) {
+      const markerSource = resolved.effective?.source ?? "anon";
+      const markerHash = identityFingerprint(bearer);
+      const markerCreated = await writeMcpMarker(projectRoot, {
+        credentialSource: markerSource,
+        credentialHash: markerHash
+      });
       if (markerCreated) {
         summary.push("Created .glasstrace/mcp-connected marker");
       }
@@ -18492,7 +18687,7 @@ async function verifyAnonKeyRegistration(projectRoot) {
   }
   const baseConfig = resolveConfig({ apiKey: devKey });
   const config2 = { ...baseConfig, apiKey: devKey };
-  const sdkVersion = true ? "1.1.0" : "0.0.0-dev";
+  const sdkVersion = true ? "1.1.2" : "0.0.0-dev";
   const result = await verifyInitReachable(config2, anonKey, sdkVersion);
   if (result.ok) {
     return { outcome: "verified" };