@kylewadegrove/cutline-mcp-cli 0.1.0 → 0.2.0

package/dist/commands/login.d.ts

@@ -1,3 +1,4 @@
 export declare function loginCommand(options: {
     staging?: boolean;
+    signup?: boolean;
 }): Promise<void>;

package/dist/commands/login.js

@@ -9,6 +9,7 @@ const chalk_1 = __importDefault(require("chalk"));
 const ora_1 = __importDefault(require("ora"));
 const callback_js_1 = require("../auth/callback.js");
 const keychain_js_1 = require("../auth/keychain.js");
+const config_store_js_1 = require("../utils/config-store.js");
 const config_js_1 = require("../utils/config.js");
 async function exchangeCustomToken(customToken, apiKey) {
     const response = await fetch(`https://identitytoolkit.googleapis.com/v1/accounts:signInWithCustomToken?key=${apiKey}`, {
@@ -31,15 +32,20 @@ async function exchangeCustomToken(customToken, apiKey) {
 }
 async function loginCommand(options) {
     const config = (0, config_js_1.getConfig)(options);
-    console.log(chalk_1.default.bold('\n🔐 Cutline MCP Authentication\n'));
+    if (options.signup) {
+        console.log(chalk_1.default.bold('\n🚀 Cutline MCP - Create Account\n'));
+    }
+    else {
+        console.log(chalk_1.default.bold('\n🔐 Cutline MCP Authentication\n'));
+    }
     if (options.staging) {
         console.log(chalk_1.default.yellow('  ⚠️  Using STAGING environment\n'));
     }
     if (!config.FIREBASE_API_KEY) {
-        const varName = options.staging ? 'FIREBASE_API_KEY_STAGING' : 'FIREBASE_API_KEY';
-        console.error(chalk_1.default.red(`Error: ${varName} environment variable is required.`));
+        console.error(chalk_1.default.red(`Error: FIREBASE_API_KEY or NEXT_PUBLIC_FIREBASE_API_KEY environment variable is required.`));
         console.error(chalk_1.default.gray('Please set it before running this command:'));
-        console.error(chalk_1.default.cyan(`  export ${varName}=AIzaSy...`));
+        console.error(chalk_1.default.cyan(`  export FIREBASE_API_KEY=AIzaSy...`));
+        console.error(chalk_1.default.gray('  (or use NEXT_PUBLIC_FIREBASE_API_KEY for consistency with web app config)'));
         process.exit(1);
     }
     const spinner = (0, ora_1.default)('Starting authentication flow...').start();
@@ -48,17 +54,41 @@ async function loginCommand(options) {
         spinner.text = 'Waiting for authentication...';
         const serverPromise = (0, callback_js_1.startCallbackServer)();
         // Open browser
-        const authUrl = `${config.AUTH_URL}?callback=${encodeURIComponent(config.CALLBACK_URL)}`;
+        let authUrl = `${config.AUTH_URL}?callback=${encodeURIComponent(config.CALLBACK_URL)}`;
+        if (options.signup) {
+            authUrl += '&mode=signup';
+        }
         await (0, open_1.default)(authUrl);
-        spinner.text = 'Browser opened - please complete authentication';
+        spinner.text = options.signup
+            ? 'Browser opened - please create your account'
+            : 'Browser opened - please sign in or create an account';
         // Wait for callback with custom token
         const result = await serverPromise;
         // Exchange custom token for refresh token
         spinner.text = 'Exchanging token...';
         const { refreshToken, email } = await exchangeCustomToken(result.token, config.FIREBASE_API_KEY);
         // Store refresh token
-        await (0, keychain_js_1.storeRefreshToken)(refreshToken);
+        try {
+            await (0, keychain_js_1.storeRefreshToken)(refreshToken);
+        }
+        catch (error) {
+            console.warn(chalk_1.default.yellow('  ⚠️  Could not save to Keychain (skipping)'));
+        }
+        // Always save to file config (cross-platform)
+        try {
+            (0, config_store_js_1.saveConfig)({
+                refreshToken,
+                environment: options.staging ? 'staging' : 'production',
+                firebaseApiKey: config.FIREBASE_API_KEY
+            });
+        }
+        catch (error) {
+            console.error(chalk_1.default.red('  ✗ Failed to save config file:'), error);
+        }
         spinner.succeed(chalk_1.default.green('Successfully authenticated!'));
+        // Show environment indicator
+        const envLabel = options.staging ? chalk_1.default.yellow('STAGING') : chalk_1.default.green('PRODUCTION');
+        console.log(chalk_1.default.gray(`  Environment: ${envLabel}`));
         if (email || result.email) {
             console.log(chalk_1.default.gray(`  Logged in as: ${email || result.email}`));
         }

package/dist/commands/status.js

@@ -47,9 +47,8 @@ async function statusCommand(options) {
         // Get config for API key
         const config = (0, config_js_1.getConfig)(options);
         if (!config.FIREBASE_API_KEY) {
-            const varName = options.staging ? 'FIREBASE_API_KEY_STAGING' : 'FIREBASE_API_KEY';
             spinner.fail(chalk_1.default.red('Configuration error'));
-            console.error(chalk_1.default.red(`  ${varName} environment variable is required.`));
+            console.error(chalk_1.default.red(`  FIREBASE_API_KEY or NEXT_PUBLIC_FIREBASE_API_KEY environment variable is required.`));
             process.exit(1);
         }
         // Exchange refresh token for ID token
@@ -57,7 +56,7 @@ async function statusCommand(options) {
         const idToken = await exchangeRefreshToken(refreshToken, config.FIREBASE_API_KEY);
         // Initialize Firebase Admin with correct project ID
         if (firebase_admin_1.default.apps.length === 0) {
-            const projectId = options.staging ? 'demo-makerkit' : 'makerkit-todo-app';
+            const projectId = options.staging ? 'cutline-staging' : 'cutline-prod';
             firebase_admin_1.default.initializeApp({ projectId });
         }
         // Verify the ID token

package/dist/commands/upgrade.d.ts

@@ -0,0 +1,3 @@
+export declare function upgradeCommand(options: {
+    staging?: boolean;
+}): Promise<void>;

package/dist/commands/upgrade.js

@@ -0,0 +1,99 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.upgradeCommand = upgradeCommand;
+const open_1 = __importDefault(require("open"));
+const chalk_1 = __importDefault(require("chalk"));
+const ora_1 = __importDefault(require("ora"));
+const callback_js_1 = require("../auth/callback.js");
+const keychain_js_1 = require("../auth/keychain.js");
+const config_store_js_1 = require("../utils/config-store.js");
+const config_js_1 = require("../utils/config.js");
+async function exchangeCustomToken(customToken, apiKey) {
+    const response = await fetch(`https://identitytoolkit.googleapis.com/v1/accounts:signInWithCustomToken?key=${apiKey}`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            token: customToken,
+            returnSecureToken: true,
+        }),
+    });
+    if (!response.ok) {
+        const error = await response.text();
+        throw new Error(`Failed to exchange custom token: ${error}`);
+    }
+    const data = await response.json();
+    return {
+        refreshToken: data.refreshToken,
+        email: data.email,
+    };
+}
+async function upgradeCommand(options) {
+    const config = (0, config_js_1.getConfig)(options);
+    console.log(chalk_1.default.bold('\n⬆️  Cutline MCP - Upgrade to Premium\n'));
+    if (options.staging) {
+        console.log(chalk_1.default.yellow('  ⚠️  Using STAGING environment\n'));
+    }
+    if (!config.FIREBASE_API_KEY) {
+        console.error(chalk_1.default.red(`Error: FIREBASE_API_KEY environment variable is required.`));
+        process.exit(1);
+    }
+    // Determine upgrade URL based on environment
+    const baseUrl = options.staging
+        ? 'https://cutline-staging.web.app'
+        : 'https://thecutline.ai';
+    console.log(chalk_1.default.gray('  Opening upgrade page in your browser...\n'));
+    console.log(chalk_1.default.dim('  After upgrading, your MCP session will be refreshed automatically.\n'));
+    const spinner = (0, ora_1.default)('Waiting for upgrade and re-authentication...').start();
+    try {
+        // Start callback server for re-auth after upgrade
+        const serverPromise = (0, callback_js_1.startCallbackServer)();
+        // Open upgrade page with callback for re-auth
+        // The upgrade page will redirect to mcp-auth after successful upgrade
+        const upgradeUrl = `${baseUrl}/upgrade?mcp_callback=${encodeURIComponent(config.CALLBACK_URL)}`;
+        await (0, open_1.default)(upgradeUrl);
+        spinner.text = 'Browser opened - complete your upgrade, then re-authenticate';
+        // Wait for callback with new token (after upgrade + re-auth)
+        const result = await serverPromise;
+        // Exchange custom token for refresh token
+        spinner.text = 'Refreshing your session...';
+        const { refreshToken, email } = await exchangeCustomToken(result.token, config.FIREBASE_API_KEY);
+        // Store refresh token
+        try {
+            await (0, keychain_js_1.storeRefreshToken)(refreshToken);
+        }
+        catch (error) {
+            console.warn(chalk_1.default.yellow('  ⚠️  Could not save to Keychain (skipping)'));
+        }
+        // Save to file config
+        try {
+            (0, config_store_js_1.saveConfig)({
+                refreshToken,
+                environment: options.staging ? 'staging' : 'production',
+                firebaseApiKey: config.FIREBASE_API_KEY
+            });
+        }
+        catch (error) {
+            console.error(chalk_1.default.red('  ✗ Failed to save config file:'), error);
+        }
+        spinner.succeed(chalk_1.default.green('Upgrade complete! Session refreshed.'));
+        const envLabel = options.staging ? chalk_1.default.yellow('STAGING') : chalk_1.default.green('PRODUCTION');
+        console.log(chalk_1.default.gray(`  Environment: ${envLabel}`));
+        if (email || result.email) {
+            console.log(chalk_1.default.gray(`  Account: ${email || result.email}`));
+        }
+        console.log(chalk_1.default.green('\n  ✨ Premium features are now available!\n'));
+        console.log(chalk_1.default.dim('  Try:'), chalk_1.default.cyan('exploration_graduate'), chalk_1.default.dim('to run a full Deep Dive\n'));
+    }
+    catch (error) {
+        spinner.fail(chalk_1.default.red('Upgrade flow failed'));
+        if (error instanceof Error) {
+            console.error(chalk_1.default.red(`  ${error.message}`));
+        }
+        console.log(chalk_1.default.gray('\n  You can also upgrade at:'), chalk_1.default.cyan(`${baseUrl}/upgrade`));
+        console.log(chalk_1.default.gray('  Then run:'), chalk_1.default.cyan('cutline-mcp login'), chalk_1.default.gray('to refresh your session\n'));
+        process.exit(1);
+    }
+}

package/dist/index.js

@@ -5,6 +5,7 @@ const commander_1 = require("commander");
 const login_js_1 = require("./commands/login.js");
 const logout_js_1 = require("./commands/logout.js");
 const status_js_1 = require("./commands/status.js");
+const upgrade_js_1 = require("./commands/upgrade.js");
 const program = new commander_1.Command();
 program
     .name('cutline-mcp')
@@ -14,6 +15,7 @@ program
     .command('login')
     .description('Authenticate with Cutline and store credentials')
     .option('--staging', 'Use staging environment')
+    .option('--signup', 'Open sign-up page instead of sign-in')
     .action(login_js_1.loginCommand);
 program
     .command('logout')
@@ -24,4 +26,9 @@ program
     .description('Show current authentication status')
     .option('--staging', 'Use staging environment')
     .action(status_js_1.statusCommand);
+program
+    .command('upgrade')
+    .description('Upgrade to Premium and refresh your session')
+    .option('--staging', 'Use staging environment')
+    .action(upgrade_js_1.upgradeCommand);
 program.parse();

package/dist/utils/config-store.d.ts

@@ -0,0 +1,8 @@
+export interface McpConfig {
+    refreshToken?: string;
+    environment?: 'production' | 'staging';
+    firebaseApiKey?: string;
+}
+export declare function saveConfig(config: McpConfig): void;
+export declare function loadConfig(): McpConfig;
+export declare function getRefreshTokenFromFile(): string | null;

package/dist/utils/config-store.js

@@ -0,0 +1,40 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.saveConfig = saveConfig;
+exports.loadConfig = loadConfig;
+exports.getRefreshTokenFromFile = getRefreshTokenFromFile;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const os_1 = __importDefault(require("os"));
+const CONFIG_DIR = path_1.default.join(os_1.default.homedir(), '.cutline-mcp');
+const CONFIG_FILE = path_1.default.join(CONFIG_DIR, 'config.json');
+function ensureConfigDir() {
+    if (!fs_1.default.existsSync(CONFIG_DIR)) {
+        fs_1.default.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    }
+}
+function saveConfig(config) {
+    ensureConfigDir();
+    const current = loadConfig();
+    const newConfig = { ...current, ...config };
+    fs_1.default.writeFileSync(CONFIG_FILE, JSON.stringify(newConfig, null, 2), { mode: 0o600 });
+}
+function loadConfig() {
+    try {
+        if (fs_1.default.existsSync(CONFIG_FILE)) {
+            const content = fs_1.default.readFileSync(CONFIG_FILE, 'utf-8');
+            return JSON.parse(content);
+        }
+    }
+    catch (e) {
+        // Ignore errors, return empty config
+    }
+    return {};
+}
+function getRefreshTokenFromFile() {
+    const config = loadConfig();
+    return config.refreshToken || null;
+}

package/dist/utils/config.js

@@ -6,12 +6,16 @@ function getConfig(options = {}) {
         return {
             AUTH_URL: process.env.CUTLINE_AUTH_URL || 'https://cutline-staging.web.app/mcp-auth',
             CALLBACK_URL: 'http://localhost:8765',
-            FIREBASE_API_KEY: process.env.FIREBASE_API_KEY_STAGING || process.env.FIREBASE_API_KEY || 'AIzaSyAAqU_euGAMtJoXp0sECblAIndifCp0pmE',
+            // For environment-scoped secrets, use FIREBASE_API_KEY (GitHub Actions will scope it to staging environment)
+            // Also support NEXT_PUBLIC_FIREBASE_API_KEY for consistency with web app config
+            FIREBASE_API_KEY: process.env.FIREBASE_API_KEY || process.env.NEXT_PUBLIC_FIREBASE_API_KEY || 'AIzaSyAAqU_euGAMtJoXp0sECblAIndifCp0pmE',
         };
     }
     return {
         AUTH_URL: process.env.CUTLINE_AUTH_URL || 'https://thecutline.ai/mcp-auth',
         CALLBACK_URL: 'http://localhost:8765',
-        FIREBASE_API_KEY: process.env.FIREBASE_API_KEY || 'AIzaSyDW7846oQfvFU3Vnc1DELj4XdlvvYFjaIU',
+        // For environment-scoped secrets, use FIREBASE_API_KEY (GitHub Actions will scope it to production environment)
+        // Also support NEXT_PUBLIC_FIREBASE_API_KEY for consistency with web app config
+        FIREBASE_API_KEY: process.env.FIREBASE_API_KEY || process.env.NEXT_PUBLIC_FIREBASE_API_KEY || 'AIzaSyAYBQt7A-a_mxn5SuXPHUpyIlm0eCn42N8',
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@kylewadegrove/cutline-mcp-cli",
-    "version": "0.1.0",
+    "version": "0.2.0",
     "description": "CLI tool for authenticating with Cutline MCP servers",
     "main": "dist/index.js",
     "bin": {
@@ -39,4 +39,4 @@
     "publishConfig": {
         "access": "public"
     }
-}
+}

package/src/commands/login.ts

@@ -3,6 +3,7 @@ import chalk from 'chalk';
 import ora from 'ora';
 import { startCallbackServer } from '../auth/callback.js';
 import { storeRefreshToken } from '../auth/keychain.js';
+import { saveConfig } from '../utils/config-store.js';
 import { getConfig } from '../utils/config.js';
 
 async function exchangeCustomToken(customToken: string, apiKey: string): Promise<{ refreshToken: string; email?: string }> {
@@ -30,19 +31,24 @@ async function exchangeCustomToken(customToken: string, apiKey: string): Promise
     };
 }
 
-export async function loginCommand(options: { staging?: boolean }) {
+export async function loginCommand(options: { staging?: boolean; signup?: boolean }) {
     const config = getConfig(options);
-    console.log(chalk.bold('\n🔐 Cutline MCP Authentication\n'));
+    
+    if (options.signup) {
+        console.log(chalk.bold('\n🚀 Cutline MCP - Create Account\n'));
+    } else {
+        console.log(chalk.bold('\n🔐 Cutline MCP Authentication\n'));
+    }
 
     if (options.staging) {
         console.log(chalk.yellow('  ⚠️  Using STAGING environment\n'));
     }
 
     if (!config.FIREBASE_API_KEY) {
-        const varName = options.staging ? 'FIREBASE_API_KEY_STAGING' : 'FIREBASE_API_KEY';
-        console.error(chalk.red(`Error: ${varName} environment variable is required.`));
+        console.error(chalk.red(`Error: FIREBASE_API_KEY or NEXT_PUBLIC_FIREBASE_API_KEY environment variable is required.`));
         console.error(chalk.gray('Please set it before running this command:'));
-        console.error(chalk.cyan(`  export ${varName}=AIzaSy...`));
+        console.error(chalk.cyan(`  export FIREBASE_API_KEY=AIzaSy...`));
+        console.error(chalk.gray('  (or use NEXT_PUBLIC_FIREBASE_API_KEY for consistency with web app config)'));
         process.exit(1);
     }
 
@@ -54,9 +60,14 @@ export async function loginCommand(options: { staging?: boolean }) {
         const serverPromise = startCallbackServer();
 
         // Open browser
-        const authUrl = `${config.AUTH_URL}?callback=${encodeURIComponent(config.CALLBACK_URL)}`;
+        let authUrl = `${config.AUTH_URL}?callback=${encodeURIComponent(config.CALLBACK_URL)}`;
+        if (options.signup) {
+            authUrl += '&mode=signup';
+        }
         await open(authUrl);
-        spinner.text = 'Browser opened - please complete authentication';
+        spinner.text = options.signup 
+            ? 'Browser opened - please create your account' 
+            : 'Browser opened - please sign in or create an account';
 
         // Wait for callback with custom token
         const result = await serverPromise;
@@ -66,10 +77,29 @@ export async function loginCommand(options: { staging?: boolean }) {
         const { refreshToken, email } = await exchangeCustomToken(result.token, config.FIREBASE_API_KEY);
 
         // Store refresh token
-        await storeRefreshToken(refreshToken);
+        try {
+            await storeRefreshToken(refreshToken);
+        } catch (error) {
+            console.warn(chalk.yellow('  ⚠️  Could not save to Keychain (skipping)'));
+        }
+
+        // Always save to file config (cross-platform)
+        try {
+            saveConfig({ 
+                refreshToken,
+                environment: options.staging ? 'staging' : 'production',
+                firebaseApiKey: config.FIREBASE_API_KEY
+            });
+        } catch (error) {
+            console.error(chalk.red('  ✗ Failed to save config file:'), error);
+        }
 
         spinner.succeed(chalk.green('Successfully authenticated!'));
 
+        // Show environment indicator
+        const envLabel = options.staging ? chalk.yellow('STAGING') : chalk.green('PRODUCTION');
+        console.log(chalk.gray(`  Environment: ${envLabel}`));
+
         if (email || result.email) {
             console.log(chalk.gray(`  Logged in as: ${email || result.email}`));
         }

package/src/commands/status.ts

@@ -52,9 +52,8 @@ export async function statusCommand(options: { staging?: boolean }) {
         const config = getConfig(options);
 
         if (!config.FIREBASE_API_KEY) {
-            const varName = options.staging ? 'FIREBASE_API_KEY_STAGING' : 'FIREBASE_API_KEY';
             spinner.fail(chalk.red('Configuration error'));
-            console.error(chalk.red(`  ${varName} environment variable is required.`));
+            console.error(chalk.red(`  FIREBASE_API_KEY or NEXT_PUBLIC_FIREBASE_API_KEY environment variable is required.`));
             process.exit(1);
         }
 
@@ -64,7 +63,7 @@ export async function statusCommand(options: { staging?: boolean }) {
 
         // Initialize Firebase Admin with correct project ID
         if (admin.apps.length === 0) {
-            const projectId = options.staging ? 'demo-makerkit' : 'makerkit-todo-app';
+            const projectId = options.staging ? 'cutline-staging' : 'cutline-prod';
             admin.initializeApp({ projectId });
         }
 

package/src/commands/upgrade.ts

@@ -0,0 +1,118 @@
+import open from 'open';
+import chalk from 'chalk';
+import ora from 'ora';
+import { startCallbackServer } from '../auth/callback.js';
+import { storeRefreshToken } from '../auth/keychain.js';
+import { saveConfig } from '../utils/config-store.js';
+import { getConfig } from '../utils/config.js';
+
+async function exchangeCustomToken(customToken: string, apiKey: string): Promise<{ refreshToken: string; email?: string }> {
+    const response = await fetch(
+        `https://identitytoolkit.googleapis.com/v1/accounts:signInWithCustomToken?key=${apiKey}`,
+        {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                token: customToken,
+                returnSecureToken: true,
+            }),
+        }
+    );
+
+    if (!response.ok) {
+        const error = await response.text();
+        throw new Error(`Failed to exchange custom token: ${error}`);
+    }
+
+    const data = await response.json();
+    return {
+        refreshToken: data.refreshToken,
+        email: data.email,
+    };
+}
+
+export async function upgradeCommand(options: { staging?: boolean }) {
+    const config = getConfig(options);
+    
+    console.log(chalk.bold('\n⬆️  Cutline MCP - Upgrade to Premium\n'));
+
+    if (options.staging) {
+        console.log(chalk.yellow('  ⚠️  Using STAGING environment\n'));
+    }
+
+    if (!config.FIREBASE_API_KEY) {
+        console.error(chalk.red(`Error: FIREBASE_API_KEY environment variable is required.`));
+        process.exit(1);
+    }
+
+    // Determine upgrade URL based on environment
+    const baseUrl = options.staging 
+        ? 'https://cutline-staging.web.app' 
+        : 'https://thecutline.ai';
+    
+    console.log(chalk.gray('  Opening upgrade page in your browser...\n'));
+    console.log(chalk.dim('  After upgrading, your MCP session will be refreshed automatically.\n'));
+
+    const spinner = ora('Waiting for upgrade and re-authentication...').start();
+
+    try {
+        // Start callback server for re-auth after upgrade
+        const serverPromise = startCallbackServer();
+
+        // Open upgrade page with callback for re-auth
+        // The upgrade page will redirect to mcp-auth after successful upgrade
+        const upgradeUrl = `${baseUrl}/upgrade?mcp_callback=${encodeURIComponent(config.CALLBACK_URL)}`;
+        await open(upgradeUrl);
+        
+        spinner.text = 'Browser opened - complete your upgrade, then re-authenticate';
+
+        // Wait for callback with new token (after upgrade + re-auth)
+        const result = await serverPromise;
+
+        // Exchange custom token for refresh token
+        spinner.text = 'Refreshing your session...';
+        const { refreshToken, email } = await exchangeCustomToken(result.token, config.FIREBASE_API_KEY);
+
+        // Store refresh token
+        try {
+            await storeRefreshToken(refreshToken);
+        } catch (error) {
+            console.warn(chalk.yellow('  ⚠️  Could not save to Keychain (skipping)'));
+        }
+
+        // Save to file config
+        try {
+            saveConfig({ 
+                refreshToken,
+                environment: options.staging ? 'staging' : 'production',
+                firebaseApiKey: config.FIREBASE_API_KEY
+            });
+        } catch (error) {
+            console.error(chalk.red('  ✗ Failed to save config file:'), error);
+        }
+
+        spinner.succeed(chalk.green('Upgrade complete! Session refreshed.'));
+
+        const envLabel = options.staging ? chalk.yellow('STAGING') : chalk.green('PRODUCTION');
+        console.log(chalk.gray(`  Environment: ${envLabel}`));
+
+        if (email || result.email) {
+            console.log(chalk.gray(`  Account: ${email || result.email}`));
+        }
+
+        console.log(chalk.green('\n  ✨ Premium features are now available!\n'));
+        console.log(chalk.dim('  Try:'), chalk.cyan('exploration_graduate'), chalk.dim('to run a full Deep Dive\n'));
+
+    } catch (error) {
+        spinner.fail(chalk.red('Upgrade flow failed'));
+
+        if (error instanceof Error) {
+            console.error(chalk.red(`  ${error.message}`));
+        }
+
+        console.log(chalk.gray('\n  You can also upgrade at:'), chalk.cyan(`${baseUrl}/upgrade`));
+        console.log(chalk.gray('  Then run:'), chalk.cyan('cutline-mcp login'), chalk.gray('to refresh your session\n'));
+
+        process.exit(1);
+    }
+}

package/src/index.ts

@@ -3,6 +3,7 @@ import { Command } from 'commander';
 import { loginCommand } from './commands/login.js';
 import { logoutCommand } from './commands/logout.js';
 import { statusCommand } from './commands/status.js';
+import { upgradeCommand } from './commands/upgrade.js';
 
 const program = new Command();
 
@@ -15,6 +16,7 @@ program
     .command('login')
     .description('Authenticate with Cutline and store credentials')
     .option('--staging', 'Use staging environment')
+    .option('--signup', 'Open sign-up page instead of sign-in')
     .action(loginCommand);
 
 program
@@ -28,4 +30,10 @@ program
     .option('--staging', 'Use staging environment')
     .action(statusCommand);
 
+program
+    .command('upgrade')
+    .description('Upgrade to Premium and refresh your session')
+    .option('--staging', 'Use staging environment')
+    .action(upgradeCommand);
+
 program.parse();

package/src/utils/config-store.ts

@@ -0,0 +1,43 @@
+
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+
+const CONFIG_DIR = path.join(os.homedir(), '.cutline-mcp');
+const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
+
+export interface McpConfig {
+    refreshToken?: string;
+    environment?: 'production' | 'staging';
+    firebaseApiKey?: string; // Store the API key used during login for reference
+}
+
+function ensureConfigDir() {
+    if (!fs.existsSync(CONFIG_DIR)) {
+        fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    }
+}
+
+export function saveConfig(config: McpConfig) {
+    ensureConfigDir();
+    const current = loadConfig();
+    const newConfig = { ...current, ...config };
+    fs.writeFileSync(CONFIG_FILE, JSON.stringify(newConfig, null, 2), { mode: 0o600 });
+}
+
+export function loadConfig(): McpConfig {
+    try {
+        if (fs.existsSync(CONFIG_FILE)) {
+            const content = fs.readFileSync(CONFIG_FILE, 'utf-8');
+            return JSON.parse(content);
+        }
+    } catch (e) {
+        // Ignore errors, return empty config
+    }
+    return {};
+}
+
+export function getRefreshTokenFromFile(): string | null {
+    const config = loadConfig();
+    return config.refreshToken || null;
+}

package/src/utils/config.ts

@@ -9,13 +9,17 @@ export function getConfig(options: { staging?: boolean } = {}): Config {
         return {
             AUTH_URL: process.env.CUTLINE_AUTH_URL || 'https://cutline-staging.web.app/mcp-auth',
             CALLBACK_URL: 'http://localhost:8765',
-            FIREBASE_API_KEY: process.env.FIREBASE_API_KEY_STAGING || process.env.FIREBASE_API_KEY || 'AIzaSyAAqU_euGAMtJoXp0sECblAIndifCp0pmE',
+            // For environment-scoped secrets, use FIREBASE_API_KEY (GitHub Actions will scope it to staging environment)
+            // Also support NEXT_PUBLIC_FIREBASE_API_KEY for consistency with web app config
+            FIREBASE_API_KEY: process.env.FIREBASE_API_KEY || process.env.NEXT_PUBLIC_FIREBASE_API_KEY || 'AIzaSyAAqU_euGAMtJoXp0sECblAIndifCp0pmE',
         };
     }
 
     return {
         AUTH_URL: process.env.CUTLINE_AUTH_URL || 'https://thecutline.ai/mcp-auth',
         CALLBACK_URL: 'http://localhost:8765',
-        FIREBASE_API_KEY: process.env.FIREBASE_API_KEY || 'AIzaSyDW7846oQfvFU3Vnc1DELj4XdlvvYFjaIU',
+        // For environment-scoped secrets, use FIREBASE_API_KEY (GitHub Actions will scope it to production environment)
+        // Also support NEXT_PUBLIC_FIREBASE_API_KEY for consistency with web app config
+        FIREBASE_API_KEY: process.env.FIREBASE_API_KEY || process.env.NEXT_PUBLIC_FIREBASE_API_KEY || 'AIzaSyAYBQt7A-a_mxn5SuXPHUpyIlm0eCn42N8',
     };
 }