@mushi-mushi/cli 0.17.2 → 0.18.1

package/dist/index.js

@@ -1,207 +1,52 @@
 #!/usr/bin/env node
+import {
+  API_TIMEOUT_MS,
+  CONFIG_PATH,
+  MUSHI_CLI_VERSION,
+  apiCall,
+  die,
+  fmtDate,
+  installSignalHandlers,
+  loadConfig,
+  pad,
+  requireConfig,
+  saveConfig
+} from "./chunk-LKJ7KLBC.js";
+import {
+  TEST_REPORT_FETCH_TIMEOUT_MS,
+  assertEndpoint,
+  normalizeEndpoint,
+  resolveCloudEndpoint
+} from "./chunk-LDPFTQLE.js";
 
 // src/index.ts
 import { Command } from "commander";
 
-// src/errors.ts
-var EXIT_CODE_MAP = {
-  E_AUTH_MISSING: 2,
-  E_AUTH_INVALID: 2,
-  E_PROJECT_MISSING: 2,
-  E_ENDPOINT_INVALID: 2,
-  E_INVALID_INPUT: 2,
-  E_NOT_INTERACTIVE: 2,
-  E_NETWORK: 3,
-  E_TIMEOUT: 3,
-  E_API_ERROR: 3,
-  E_RATE_LIMITED: 3,
-  E_FILE_NOT_FOUND: 1,
-  E_FILE_PERMISSION: 1,
-  E_FRESHNESS_STALE: 1,
-  E_INTERRUPTED: 130,
-  // 128 + SIGINT (2). POSIX convention.
-  E_INTERNAL: 1
-};
-var MushiCliError = class extends Error {
-  code;
-  hint;
-  cause;
-  constructor(code, message, hint, cause) {
-    super(message);
-    this.name = "MushiCliError";
-    this.code = code;
-    if (hint) this.hint = hint;
-    if (cause !== void 0) this.cause = cause;
-  }
-  /** Exit code POSIX-aware shell scripts should branch on. */
-  get exitCode() {
-    return EXIT_CODE_MAP[this.code];
-  }
-  /**
-   * Format for `--json` output. Used by the JSON writer when a CLI
-   * subcommand was invoked with `--json` and an error escapes.
-   */
-  toJSON() {
-    return {
-      error: {
-        code: this.code,
-        message: this.message,
-        ...this.hint ? { hint: this.hint } : {}
-      }
-    };
-  }
-};
-
-// src/signals.ts
-var installed = false;
-var activeController = null;
-function installSignalHandlers() {
-  if (installed) return;
-  installed = true;
-  const abortAndExit = (signal) => {
-    activeController?.abort(
-      new MushiCliError(
-        "E_INTERRUPTED",
-        `aborted by ${signal}`,
-        "partial state on the server is safe to retry \u2014 re-run the same command"
-      )
-    );
-    const code = signal === "SIGINT" ? 130 : signal === "SIGTERM" ? 143 : 1;
-    process.nextTick(() => {
-      process.exit(code);
-    });
-  };
-  process.on("SIGINT", () => abortAndExit("SIGINT"));
-  process.on("SIGTERM", () => abortAndExit("SIGTERM"));
-}
-function getAbortSignal(external) {
-  if (external) return external.signal;
-  if (!activeController || activeController.signal.aborted) {
-    activeController = new AbortController();
-  }
-  return activeController.signal;
-}
-
-// src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.17.2" : "0.0.0-dev";
-
-// src/config.ts
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
-import { homedir } from "os";
-import { dirname, join } from "path";
-var SECURE_FILE_MODE = 384;
-var SECURE_DIR_MODE = 448;
-function resolveXdgConfigPath() {
-  const xdg = process.env["XDG_CONFIG_HOME"];
-  if (xdg && xdg.length > 0) {
-    return join(xdg, "mushi", "config.json");
-  }
-  if (process.platform === "win32") {
-    const appData = process.env["APPDATA"];
-    if (appData && appData.length > 0) {
-      return join(appData, "mushi", "config.json");
-    }
-  }
-  return join(homedir(), ".config", "mushi", "config.json");
-}
-var LEGACY_CONFIG_PATH = join(homedir(), ".mushirc");
-var CONFIG_PATH = resolveXdgConfigPath();
-function loadConfig(path = CONFIG_PATH) {
-  let file = {};
-  if (existsSync(path)) {
-    tightenPermissions(path);
-    try {
-      file = JSON.parse(readFileSync(path, "utf-8"));
-    } catch {
-    }
-  } else if (path === CONFIG_PATH && existsSync(LEGACY_CONFIG_PATH)) {
-    file = migrateLegacyConfig() ?? {};
-  }
-  const endpointFromEnv = process.env["MUSHI_API_ENDPOINT"] ?? process.env["MUSHI_ENDPOINT"] ?? void 0;
-  const fromEnv = {
-    ...process.env["MUSHI_API_KEY"] ? { apiKey: process.env["MUSHI_API_KEY"] } : {},
-    ...process.env["MUSHI_PROJECT_ID"] ? { projectId: process.env["MUSHI_PROJECT_ID"] } : {},
-    ...endpointFromEnv ? { endpoint: endpointFromEnv } : {}
-  };
-  return { ...file, ...fromEnv };
-}
-function saveConfig(config, path = CONFIG_PATH) {
-  const dir = dirname(path);
-  if (!existsSync(dir)) {
-    mkdirSync(dir, { recursive: true, mode: SECURE_DIR_MODE });
-  } else {
-    tightenDirPermissions(dir);
-  }
-  writeFileSync(path, JSON.stringify(config, null, 2), { mode: SECURE_FILE_MODE });
-  tightenPermissions(path);
-}
-function migrateLegacyConfig(legacyPath = LEGACY_CONFIG_PATH, destPath = CONFIG_PATH) {
-  if (!existsSync(legacyPath)) return null;
-  let parsed;
-  try {
-    parsed = JSON.parse(readFileSync(legacyPath, "utf-8"));
-  } catch {
-    return null;
-  }
-  const dir = dirname(destPath);
-  if (!existsSync(dir)) {
-    mkdirSync(dir, { recursive: true, mode: SECURE_DIR_MODE });
-  }
-  try {
-    renameSync(legacyPath, destPath);
-  } catch {
-    writeFileSync(destPath, JSON.stringify(parsed, null, 2), { mode: SECURE_FILE_MODE });
-    try {
-      unlinkSync(legacyPath);
-    } catch {
-    }
-  }
-  tightenPermissions(destPath);
-  tightenDirPermissions(dir);
-  return parsed;
-}
-function tightenPermissions(path) {
-  if (process.platform === "win32") return;
-  try {
-    const current = statSync(path).mode & 511;
-    if (current !== SECURE_FILE_MODE) chmodSync(path, SECURE_FILE_MODE);
-  } catch {
-  }
-}
-function tightenDirPermissions(path) {
-  if (process.platform === "win32") return;
-  try {
-    const current = statSync(path).mode & 511;
-    if (current !== SECURE_DIR_MODE) chmodSync(path, SECURE_DIR_MODE);
-  } catch {
-  }
-}
-
 // src/init.ts
 import * as p from "@clack/prompts";
 import { spawn } from "child_process";
 import { randomUUID } from "crypto";
-import { appendFileSync, existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
-import { join as join4 } from "path";
+import { appendFileSync, existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { join as join3 } from "path";
 
 // src/detect.ts
-import { readFileSync as readFileSync2, existsSync as existsSync2 } from "fs";
-import { join as join2 } from "path";
+import { readFileSync, existsSync } from "fs";
+import { join } from "path";
 var FRAMEWORKS = {
   next: {
     id: "next",
     label: "Next.js",
     packageName: "@mushi-mushi/react",
     needsWebPackage: false,
-    snippet: (apiKey, projectId) => `// app/providers.tsx (or pages/_app.tsx for /pages router)
+    snippet: () => `// app/providers.tsx (or pages/_app.tsx for /pages router)
 'use client'
 import { MushiProvider } from '@mushi-mushi/react'
 
 export function Providers({ children }: { children: React.ReactNode }) {
   return (
     <MushiProvider config={{
-      projectId: '${projectId}',
-      apiKey: '${apiKey}',
+      projectId: process.env.NEXT_PUBLIC_MUSHI_PROJECT_ID!,
+      apiKey: process.env.NEXT_PUBLIC_MUSHI_API_KEY!,
     }}>
       {children}
     </MushiProvider>
@@ -213,13 +58,13 @@ export function Providers({ children }: { children: React.ReactNode }) {
     label: "React",
     packageName: "@mushi-mushi/react",
     needsWebPackage: false,
-    snippet: (apiKey, projectId) => `// src/main.tsx
+    snippet: () => `// src/main.tsx
 import { MushiProvider } from '@mushi-mushi/react'
 
 createRoot(document.getElementById('root')!).render(
   <MushiProvider config={{
-    projectId: '${projectId}',
-    apiKey: '${apiKey}',
+    projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
+    apiKey: import.meta.env.VITE_MUSHI_API_KEY,
   }}>
     <App />
   </MushiProvider>
@@ -229,57 +74,58 @@ createRoot(document.getElementById('root')!).render(
     id: "vue",
     label: "Vue 3",
     packageName: "@mushi-mushi/vue",
-    needsWebPackage: true,
-    snippet: (apiKey, projectId) => `// src/main.ts
+    needsWebPackage: false,
+    snippet: () => `// src/main.ts
 import { MushiPlugin } from '@mushi-mushi/vue'
-import { Mushi } from '@mushi-mushi/web'
 
-app.use(MushiPlugin, { projectId: '${projectId}', apiKey: '${apiKey}' })
-Mushi.init({ projectId: '${projectId}', apiKey: '${apiKey}' })`
+app.use(MushiPlugin, {
+  projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
+  apiKey: import.meta.env.VITE_MUSHI_API_KEY,
+})`
   },
   nuxt: {
     id: "nuxt",
     label: "Nuxt",
     packageName: "@mushi-mushi/vue",
-    needsWebPackage: true,
-    snippet: (apiKey, projectId) => `// plugins/mushi.client.ts
+    needsWebPackage: false,
+    snippet: () => `// plugins/mushi.client.ts
 import { MushiPlugin } from '@mushi-mushi/vue'
-import { Mushi } from '@mushi-mushi/web'
 
 export default defineNuxtPlugin((nuxtApp) => {
   nuxtApp.vueApp.use(MushiPlugin, {
-    projectId: '${projectId}',
-    apiKey: '${apiKey}',
+    projectId: import.meta.env.NUXT_PUBLIC_MUSHI_PROJECT_ID,
+    apiKey: import.meta.env.NUXT_PUBLIC_MUSHI_API_KEY,
   })
-  Mushi.init({ projectId: '${projectId}', apiKey: '${apiKey}' })
 })`
   },
   svelte: {
     id: "svelte",
     label: "Svelte",
     packageName: "@mushi-mushi/svelte",
-    needsWebPackage: true,
-    snippet: (apiKey, projectId) => `// src/main.ts (or +layout.svelte for SvelteKit)
+    needsWebPackage: false,
+    snippet: () => `// src/main.ts
 import { initMushi } from '@mushi-mushi/svelte'
-import { Mushi } from '@mushi-mushi/web'
 
-initMushi({ projectId: '${projectId}', apiKey: '${apiKey}' })
-Mushi.init({ projectId: '${projectId}', apiKey: '${apiKey}' })`
+initMushi({
+  projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
+  apiKey: import.meta.env.VITE_MUSHI_API_KEY,
+})`
   },
   sveltekit: {
     id: "sveltekit",
     label: "SvelteKit",
     packageName: "@mushi-mushi/svelte",
-    needsWebPackage: true,
-    snippet: (apiKey, projectId) => `// src/routes/+layout.svelte
+    needsWebPackage: false,
+    snippet: () => `// src/routes/+layout.svelte
 <script>
   import { onMount } from 'svelte'
-  import { initMushi } from '@mushi-mushi/svelte'
 
   onMount(async () => {
-    const { Mushi } = await import('@mushi-mushi/web')
-    initMushi({ projectId: '${projectId}', apiKey: '${apiKey}' })
-    Mushi.init({ projectId: '${projectId}', apiKey: '${apiKey}' })
+    const { initMushi } = await import('@mushi-mushi/svelte')
+    initMushi({
+      projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
+      apiKey: import.meta.env.VITE_MUSHI_API_KEY,
+    })
   })
 </script>`
   },
@@ -287,29 +133,33 @@ Mushi.init({ projectId: '${projectId}', apiKey: '${apiKey}' })`
     id: "angular",
     label: "Angular",
     packageName: "@mushi-mushi/angular",
-    needsWebPackage: true,
-    snippet: (apiKey, projectId) => `// src/main.ts
+    needsWebPackage: false,
+    snippet: () => `// src/main.ts
 import { provideMushi } from '@mushi-mushi/angular'
-import { Mushi } from '@mushi-mushi/web'
 
 bootstrapApplication(AppComponent, {
   providers: [
-    provideMushi({ projectId: '${projectId}', apiKey: '${apiKey}' }),
+    provideMushi({
+      projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
+      apiKey: import.meta.env.VITE_MUSHI_API_KEY,
+    }),
   ],
-})
-Mushi.init({ projectId: '${projectId}', apiKey: '${apiKey}' })`
+})`
   },
   expo: {
     id: "expo",
     label: "Expo",
     packageName: "@mushi-mushi/react-native",
     needsWebPackage: false,
-    snippet: (apiKey, projectId) => `// App.tsx
+    snippet: () => `// App.tsx
 import { MushiProvider } from '@mushi-mushi/react-native'
 
 export default function App() {
   return (
-    <MushiProvider projectId="${projectId}" apiKey="${apiKey}">
+    <MushiProvider
+      projectId={process.env.EXPO_PUBLIC_MUSHI_PROJECT_ID!}
+      apiKey={process.env.EXPO_PUBLIC_MUSHI_API_KEY!}
+    >
       <YourApp />
     </MushiProvider>
   )
@@ -320,12 +170,15 @@ export default function App() {
     label: "React Native",
     packageName: "@mushi-mushi/react-native",
     needsWebPackage: false,
-    snippet: (apiKey, projectId) => `// App.tsx
+    snippet: () => `// App.tsx
 import { MushiProvider } from '@mushi-mushi/react-native'
 
 export default function App() {
   return (
-    <MushiProvider projectId="${projectId}" apiKey="${apiKey}">
+    <MushiProvider
+      projectId={process.env.MUSHI_PROJECT_ID!}
+      apiKey={process.env.MUSHI_API_KEY!}
+    >
       <YourApp />
     </MushiProvider>
   )
@@ -342,24 +195,27 @@ export default function App() {
      * `TypeError: Mushi.init is not a function`. The accompanying admin
      * console snippet (apps/admin/src/lib/sdkSnippets.ts) emits the same
      * `Mushi.configure(...)` shape; both are pinned by tests. */
-    snippet: (apiKey, projectId) => `// src/main.ts \u2014 after install, run \`npx cap sync\`
+    snippet: () => `// src/main.ts \u2014 after install, run \`npx cap sync\`
 import { Mushi } from '@mushi-mushi/capacitor'
 
-await Mushi.configure({ projectId: '${projectId}', apiKey: '${apiKey}' })`
+await Mushi.configure({
+  projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
+  apiKey: import.meta.env.VITE_MUSHI_API_KEY,
+})`
   },
   express: {
     id: "express",
     label: "Express",
     packageName: "@mushi-mushi/node",
     needsWebPackage: false,
-    snippet: (apiKey, projectId) => `// src/instrument.ts \u2014 load with: node --import ./dist/instrument.js
+    snippet: () => `// src/instrument.ts \u2014 load with: node --import ./dist/instrument.js
 import { MushiNodeClient, attachUnhandledHook } from '@mushi-mushi/node'
 import { mushiExpressErrorHandler } from '@mushi-mushi/node/express'
 import type { Express } from 'express'
 
 export const mushi = new MushiNodeClient({
-  projectId: '${projectId}',
-  apiKey: '${apiKey}',
+  projectId: process.env.MUSHI_PROJECT_ID!,
+  apiKey: process.env.MUSHI_API_KEY!,
   environment: process.env.NODE_ENV ?? 'production',
 })
 attachUnhandledHook({ client: mushi })
@@ -373,14 +229,14 @@ export function attachMushi(app: Express) {
     label: "Fastify",
     packageName: "@mushi-mushi/node",
     needsWebPackage: false,
-    snippet: (apiKey, projectId) => `// src/instrument.ts \u2014 load with: node --import ./dist/instrument.js
+    snippet: () => `// src/instrument.ts \u2014 load with: node --import ./dist/instrument.js
 import { MushiNodeClient, attachUnhandledHook } from '@mushi-mushi/node'
 import { mushiFastifyPlugin } from '@mushi-mushi/node/fastify'
 import Fastify from 'fastify'
 
 export const mushi = new MushiNodeClient({
-  projectId: '${projectId}',
-  apiKey: '${apiKey}',
+  projectId: process.env.MUSHI_PROJECT_ID!,
+  apiKey: process.env.MUSHI_API_KEY!,
   environment: process.env.NODE_ENV ?? 'production',
 })
 attachUnhandledHook({ client: mushi })
@@ -393,14 +249,14 @@ mushiFastifyPlugin(app, { client: mushi })`
     label: "Hono",
     packageName: "@mushi-mushi/node",
     needsWebPackage: false,
-    snippet: (apiKey, projectId) => `// src/instrument.ts \u2014 load with: node --import ./dist/instrument.js
+    snippet: () => `// src/instrument.ts \u2014 load with: node --import ./dist/instrument.js
 import { MushiNodeClient, attachUnhandledHook } from '@mushi-mushi/node'
 import { mushiHonoErrorHandler } from '@mushi-mushi/node/hono'
 import { Hono } from 'hono'
 
 export const mushi = new MushiNodeClient({
-  projectId: '${projectId}',
-  apiKey: '${apiKey}',
+  projectId: process.env.MUSHI_PROJECT_ID!,
+  apiKey: process.env.MUSHI_API_KEY!,
   environment: process.env.NODE_ENV ?? 'production',
 })
 attachUnhandledHook({ client: mushi })
@@ -417,17 +273,20 @@ app.onError(
     label: "Vanilla JS / unknown",
     packageName: "@mushi-mushi/web",
     needsWebPackage: false,
-    snippet: (apiKey, projectId) => `// Anywhere in your client bundle
+    snippet: () => `// Anywhere in your client bundle
 import { Mushi } from '@mushi-mushi/web'
 
-Mushi.init({ projectId: '${projectId}', apiKey: '${apiKey}' })`
+Mushi.init({
+  projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
+  apiKey: import.meta.env.VITE_MUSHI_API_KEY,
+})`
   }
 };
 function readPackageJson(cwd) {
-  const path = join2(cwd, "package.json");
-  if (!existsSync2(path)) return null;
+  const path = join(cwd, "package.json");
+  if (!existsSync(path)) return null;
   try {
-    return JSON.parse(readFileSync2(path, "utf-8"));
+    return JSON.parse(readFileSync(path, "utf-8"));
   } catch {
     return null;
   }
@@ -448,21 +307,21 @@ function detectFramework(cwd, pkg) {
   if (deps.has("express")) return FRAMEWORKS.express;
   if (deps.has("fastify")) return FRAMEWORKS.fastify;
   if (deps.has("hono") || deps.has("@hono/hono")) return FRAMEWORKS.hono;
-  if (existsSync2(join2(cwd, "next.config.js")) || existsSync2(join2(cwd, "next.config.ts"))) {
+  if (existsSync(join(cwd, "next.config.js")) || existsSync(join(cwd, "next.config.ts"))) {
     return FRAMEWORKS.next;
   }
-  if (existsSync2(join2(cwd, "nuxt.config.ts")) || existsSync2(join2(cwd, "nuxt.config.js"))) {
+  if (existsSync(join(cwd, "nuxt.config.ts")) || existsSync(join(cwd, "nuxt.config.js"))) {
     return FRAMEWORKS.nuxt;
   }
-  if (existsSync2(join2(cwd, "svelte.config.js"))) return FRAMEWORKS.svelte;
-  if (existsSync2(join2(cwd, "angular.json"))) return FRAMEWORKS.angular;
+  if (existsSync(join(cwd, "svelte.config.js"))) return FRAMEWORKS.svelte;
+  if (existsSync(join(cwd, "angular.json"))) return FRAMEWORKS.angular;
   return FRAMEWORKS.vanilla;
 }
 function detectPackageManager(cwd) {
-  if (existsSync2(join2(cwd, "bun.lockb")) || existsSync2(join2(cwd, "bun.lock"))) return "bun";
-  if (existsSync2(join2(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync2(join2(cwd, "yarn.lock"))) return "yarn";
-  if (existsSync2(join2(cwd, "package-lock.json"))) return "npm";
+  if (existsSync(join(cwd, "bun.lockb")) || existsSync(join(cwd, "bun.lock"))) return "bun";
+  if (existsSync(join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync(join(cwd, "yarn.lock"))) return "yarn";
+  if (existsSync(join(cwd, "package-lock.json"))) return "npm";
   const userAgent = process.env.npm_config_user_agent ?? "";
   if (userAgent.startsWith("bun")) return "bun";
   if (userAgent.startsWith("pnpm")) return "pnpm";
@@ -481,6 +340,18 @@ function envVarsToWrite(apiKey, projectId, framework) {
       `MUSHI_API_KEY=${apiKey}`
     ].join("\n");
   }
+  if (framework.id === "react-native") {
+    return [
+      `MUSHI_PROJECT_ID=${projectId}`,
+      `MUSHI_API_KEY=${apiKey}`
+    ].join("\n");
+  }
+  if (framework.id === "expo") {
+    return [
+      `EXPO_PUBLIC_MUSHI_PROJECT_ID=${projectId}`,
+      `EXPO_PUBLIC_MUSHI_API_KEY=${apiKey}`
+    ].join("\n");
+  }
   const prefix = framework.id === "next" ? "NEXT_PUBLIC_" : framework.id === "nuxt" ? "NUXT_PUBLIC_" : "VITE_";
   return [
     `${prefix}MUSHI_PROJECT_ID=${projectId}`,
@@ -496,41 +367,6 @@ function collectDeps(pkg) {
   ]);
 }
 
-// src/endpoint.ts
-var TEST_REPORT_TIMEOUT_MS = 1e4;
-var TEST_REPORT_FETCH_TIMEOUT_MS = TEST_REPORT_TIMEOUT_MS;
-var CLOUD_API_ENDPOINT = "https://dxptnwrhwsqckaftyymj.supabase.co/functions/v1/api";
-function resolveCloudEndpoint(explicit) {
-  if (explicit?.trim()) return explicit.trim();
-  const fromEnv = process.env.MUSHI_API_ENDPOINT?.trim();
-  if (fromEnv) return fromEnv;
-  return CLOUD_API_ENDPOINT;
-}
-function assertEndpoint(url) {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw new Error(`Invalid endpoint URL: ${url}`);
-  }
-  const host = parsed.hostname;
-  const isLocal = host === "localhost" || host === "127.0.0.1" || host === "::1" || host.endsWith(".local");
-  if (parsed.protocol !== "https:" && !isLocal) {
-    throw new Error(`Endpoint must use https:// (got ${parsed.protocol}//${host}).`);
-  }
-  return normalizeEndpoint(parsed.origin + parsed.pathname);
-}
-function normalizeEndpoint(url) {
-  if (!url) {
-    throw new Error(
-      "No API endpoint configured. Run `mushi init` or set MUSHI_API_ENDPOINT. Set endpoint to your Supabase edge function URL, e.g. https://xyz.supabase.co/functions/v1/api"
-    );
-  }
-  let end = url.length;
-  while (end > 0 && url.charCodeAt(end - 1) === 47) end--;
-  return url.slice(0, end);
-}
-
 // src/freshness.ts
 var REGISTRY = "https://registry.npmjs.org";
 var DEFAULT_TIMEOUT_MS = 2e3;
@@ -591,8 +427,8 @@ function parse(version) {
 }
 
 // src/monorepo.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3, readdirSync, statSync as statSync2 } from "fs";
-import { dirname as dirname2, join as join3, resolve } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync2, readdirSync, statSync } from "fs";
+import { dirname, join as join2, resolve } from "path";
 var WORKSPACE_GLOB_CANDIDATES = ["apps/*", "packages/*", "examples/*"];
 var FRAMEWORK_DEPS = {
   next: "Next.js",
@@ -609,9 +445,9 @@ var FRAMEWORK_DEPS = {
 function detectWorkspaceHint(cwd) {
   const root = findWorkspaceRoot(cwd);
   if (!root) return null;
-  const rootPkg = readPackageJsonSafely(join3(root, "package.json"));
+  const rootPkg = readPackageJsonSafely(join2(root, "package.json"));
   if (rootPkg && getFrameworkFromPkg(rootPkg)) return null;
-  const source = existsSync3(join3(root, "pnpm-workspace.yaml")) ? "pnpm-workspace" : root === cwd ? "package-json" : "parent";
+  const source = existsSync2(join2(root, "pnpm-workspace.yaml")) ? "pnpm-workspace" : root === cwd ? "package-json" : "parent";
   const apps = collectAppsFromGlobs(root);
   if (apps.length === 0) return null;
   return { root, apps, source };
@@ -620,15 +456,15 @@ function findWorkspaceRoot(start) {
   let dir = resolve(start);
   for (let i = 0; i < 8; i++) {
     if (isWorkspaceRoot(dir)) return dir;
-    const parent = dirname2(dir);
+    const parent = dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
   return null;
 }
 function isWorkspaceRoot(dir) {
-  if (existsSync3(join3(dir, "pnpm-workspace.yaml"))) return true;
-  const pkg = readPackageJsonSafely(join3(dir, "package.json"));
+  if (existsSync2(join2(dir, "pnpm-workspace.yaml"))) return true;
+  const pkg = readPackageJsonSafely(join2(dir, "package.json"));
   if (!pkg) return false;
   return Boolean(pkg.workspaces);
 }
@@ -636,8 +472,8 @@ function collectAppsFromGlobs(root) {
   const results = [];
   for (const glob of WORKSPACE_GLOB_CANDIDATES) {
     const prefix = glob.replace("/*", "");
-    const parentDir = join3(root, prefix);
-    if (!existsSync3(parentDir)) continue;
+    const parentDir = join2(root, prefix);
+    if (!existsSync2(parentDir)) continue;
     let entries;
     try {
       entries = readdirSync(parentDir);
@@ -645,7 +481,7 @@ function collectAppsFromGlobs(root) {
       continue;
     }
     for (const entry of entries) {
-      const pkgPath = join3(parentDir, entry, "package.json");
+      const pkgPath = join2(parentDir, entry, "package.json");
       if (!isFileSafe(pkgPath)) continue;
       const pkg = readPackageJsonSafely(pkgPath);
       if (!pkg) continue;
@@ -663,14 +499,14 @@ function collectAppsFromGlobs(root) {
 function readPackageJsonSafely(path) {
   if (!isFileSafe(path)) return null;
   try {
-    return JSON.parse(readFileSync3(path, "utf-8"));
+    return JSON.parse(readFileSync2(path, "utf-8"));
   } catch {
     return null;
   }
 }
 function isFileSafe(path) {
   try {
-    return existsSync3(path) && statSync2(path).isFile();
+    return existsSync2(path) && statSync(path).isFile();
   } catch {
     return false;
   }
@@ -690,7 +526,7 @@ function getFrameworkFromPkg(pkg) {
 // src/init.ts
 var ENV_FILES = [".env.local", ".env"];
 var PROJECT_ID_PATTERN = /^(?:proj_[A-Za-z0-9_-]{10,}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
-var API_KEY_PATTERN = /^mushi_[A-Za-z0-9_-]{10,}$/;
+var API_KEY_PATTERN = /^(mushi_|mush_pk_)[A-Za-z0-9_-]{10,}$/;
 async function runInit(options = {}) {
   const cwd = options.cwd ?? process.cwd();
   ensureInteractiveOrBailOut(options);
@@ -850,10 +686,10 @@ function runCommand(pm, packages, cwd) {
   });
 }
 function writeEnvFile(cwd, apiKey, projectId, framework) {
-  const target = ENV_FILES.find((f) => existsSync4(join4(cwd, f))) ?? ENV_FILES[0];
-  const targetPath = join4(cwd, target);
+  const target = ENV_FILES.find((f) => existsSync3(join3(cwd, f))) ?? ENV_FILES[0];
+  const targetPath = join3(cwd, target);
   const newVars = envVarsToWrite(apiKey, projectId, framework);
-  const existing = existsSync4(targetPath) ? readFileSync4(targetPath, "utf-8") : "";
+  const existing = existsSync3(targetPath) ? readFileSync3(targetPath, "utf-8") : "";
   if (existing.includes("MUSHI_PROJECT_ID")) {
     p.log.warn(`Existing MUSHI_* vars found in ${target} \u2014 leaving them untouched.`);
     return;
@@ -888,12 +724,12 @@ function escapeRegexChar(ch) {
   return /[-/\\^$+?.()|[\]{}]/.test(ch) ? `\\${ch}` : ch;
 }
 function warnIfMissingFromGitignore(cwd, envFile) {
-  const gitignorePath = join4(cwd, ".gitignore");
-  if (!existsSync4(gitignorePath)) {
+  const gitignorePath = join3(cwd, ".gitignore");
+  if (!existsSync3(gitignorePath)) {
     p.log.warn(`No .gitignore found \u2014 make sure ${envFile} is not committed.`);
     return;
   }
-  const content = readFileSync4(gitignorePath, "utf-8");
+  const content = readFileSync3(gitignorePath, "utf-8");
   if (!isEnvFileCoveredByGitignore(content, envFile)) {
     p.log.warn(`${envFile} is not in .gitignore \u2014 add it before committing.`);
   }
@@ -902,8 +738,8 @@ function persistCliConfig(apiKey, projectId, endpoint) {
   const existing = loadConfig();
   saveConfig({ ...existing, apiKey, projectId, endpoint });
 }
-function printNextSteps(framework, apiKey, projectId, enableRewards = false) {
-  p.note(framework.snippet(apiKey, projectId), "Add this to your app:");
+function printNextSteps(framework, _apiKey, _projectId, enableRewards = false) {
+  p.note(framework.snippet(), "Add this to your app:");
   if (enableRewards) {
     const badgeSnippet = framework.id === "react" ? `// Add to your user menu or profile UI:
 import { MushiRewardsBadge } from '@mushi-mushi/react';
@@ -1169,130 +1005,6 @@ function runMigrate(opts = {}) {
   return { matches };
 }
 
-// src/cli-shared.ts
-var API_TIMEOUT_MS = 15e3;
-async function apiCall(path, config, options = {}) {
-  const endpoint = config.endpoint;
-  if (!endpoint) {
-    return {
-      ok: false,
-      error: {
-        code: "NO_ENDPOINT",
-        message: "No API endpoint configured.\n  Run: mushi login --api-key <key> --endpoint <url> --project-id <id>\n  Or:  export MUSHI_API_ENDPOINT=https://<project-ref>.supabase.co/functions/v1/api"
-      }
-    };
-  }
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), API_TIMEOUT_MS);
-  const signals = [controller.signal, getAbortSignal()];
-  const compositeSignal = AbortSignal.any ? AbortSignal.any(signals) : controller.signal;
-  try {
-    const res = await fetch(`${endpoint}${path}`, {
-      ...options,
-      signal: compositeSignal,
-      headers: {
-        "Content-Type": "application/json",
-        // `apiKeyAuth` reads X-Mushi-Api-Key; the Authorization header is a
-        // fallback accepted by some older middleware. Both are sent.
-        "Authorization": `Bearer ${config.apiKey ?? ""}`,
-        "X-Mushi-Api-Key": config.apiKey ?? "",
-        "X-Mushi-Project": config.projectId ?? "",
-        "X-Mushi-Cli-Version": MUSHI_CLI_VERSION,
-        ...options.headers
-      }
-    });
-    clearTimeout(timer);
-    let body;
-    const contentType = res.headers.get("content-type") ?? "";
-    if (contentType.includes("application/json")) {
-      try {
-        body = await res.json();
-      } catch {
-        body = null;
-      }
-    } else {
-      const text2 = await res.text();
-      try {
-        body = JSON.parse(text2);
-      } catch {
-        body = {
-          ok: false,
-          error: {
-            code: `HTTP_${res.status}`,
-            message: text2.trim().slice(0, 300) || `HTTP ${res.status}`
-          }
-        };
-      }
-    }
-    if (!res.ok && typeof body === "object" && body !== null && !("ok" in body)) {
-      const b = body;
-      return {
-        ok: false,
-        httpStatus: res.status,
-        error: {
-          code: b["code"] ?? `HTTP_${res.status}`,
-          message: b["message"] ?? `Request failed (${res.status})`
-        }
-      };
-    }
-    return body;
-  } catch (err) {
-    clearTimeout(timer);
-    if (err instanceof Error && err.name === "AbortError") {
-      return {
-        ok: false,
-        error: {
-          code: "TIMEOUT",
-          message: `Request timed out after ${API_TIMEOUT_MS / 1e3}s. Check your network or endpoint.`
-        }
-      };
-    }
-    return {
-      ok: false,
-      error: {
-        code: "NETWORK_ERROR",
-        message: err instanceof Error ? err.message : String(err)
-      }
-    };
-  }
-}
-function die(result, exitCode = 1) {
-  const { code, message } = result.error;
-  const status = result.httpStatus ? ` [${result.httpStatus}]` : "";
-  process.stderr.write(`error${status}: ${code} \u2014 ${message}
-`);
-  process.exit(exitCode);
-}
-function requireConfig(opts = {}) {
-  const config = loadConfig();
-  if (!config.apiKey) {
-    process.stderr.write(
-      "error: API key not configured.\n  Run:  mushi login --api-key <key> --endpoint <url>\n  Or:   export MUSHI_API_KEY=<key>\n"
-    );
-    process.exit(2);
-  }
-  if (!config.endpoint) {
-    process.stderr.write(
-      "error: API endpoint not configured.\n  Run:  mushi login --endpoint https://<ref>.supabase.co/functions/v1/api\n  Or:   export MUSHI_API_ENDPOINT=<url>\n"
-    );
-    process.exit(2);
-  }
-  if (opts.needsProject && !config.projectId) {
-    process.stderr.write(
-      "error: Project ID not configured.\n  Run:  mushi login --project-id <uuid>\n  Or:   export MUSHI_PROJECT_ID=<uuid>\n  Find your project ID: https://kensaur.us/mushi-mushi/projects\n"
-    );
-    process.exit(2);
-  }
-  return config;
-}
-function fmtDate(iso) {
-  if (!iso) return "\u2014";
-  return new Date(iso).toLocaleString(void 0, { dateStyle: "short", timeStyle: "short" });
-}
-function pad(s, width) {
-  return s.length >= width ? s : s + " ".repeat(width - s.length);
-}
-
 // src/commands/account.ts
 function registerAccountCommands(program2) {
   program2.command("init").description("Set up the Mushi Mushi SDK in this project (auto-detects framework)").option("--project-id <id>", "Skip the prompt \u2014 pass UUID from the Projects page").option("--api-key <key>", "Skip the prompt \u2014 pass the API key (CI only)").option("--framework <id>", "Force a framework (next, react, vue, nuxt, svelte, sveltekit, angular, expo, react-native, capacitor, vanilla)").option("--skip-install", "Print the install command instead of running it").option("-y, --yes", "Accept detected framework without prompting").option("--cwd <path>", "Run the wizard in a different directory").option("--endpoint <url>", "Override the Mushi API endpoint (self-hosted)").option("--skip-test-report", 'Skip the end-of-wizard "send a test report" prompt').action(async (opts) => {
@@ -1311,17 +1023,78 @@ function registerAccountCommands(program2) {
     const { matches } = runMigrate({ cwd: opts.cwd, json: opts.json });
     if (matches.length === 0) process.exit(1);
   });
-  program2.command("login").description("Save API credentials to ~/.mushirc (mode 0o600)").requiredOption("--api-key <key>", "Mushi API key (mushi_...)").option("--endpoint <url>", "Supabase edge function URL").option("--project-id <id>", "Project UUID (from the Projects page)").addHelpText("after", `
+  program2.command("login").description("Authenticate the CLI \u2014 opens browser to get your API key, or pass --api-key to skip").option("--api-key <key>", "Mushi API key (mushi_...) \u2014 skip the browser flow").option("--endpoint <url>", "Supabase edge function URL (defaults to Mushi Cloud)").option("--project-id <id>", "Project UUID \u2014 skip the whoami project-list prompt").option("--no-browser", "Skip opening the browser (print sign-in URL instead)").addHelpText("after", `
 Examples:
-  mushi login --api-key mushi_xxx --endpoint https://xyz.supabase.co/functions/v1/api
-  mushi login --api-key mushi_xxx --project-id 542b34e0-019e-41fe-b900-7b637717bb86`).action((opts) => {
+  mushi login                         # browser-guided: open console \u2192 paste key
+  mushi login --api-key mushi_xxx     # non-interactive: save key directly
+  mushi login --api-key mushi_xxx --project-id <uuid>`).action(async (opts) => {
+    const { CLOUD_API_ENDPOINT, resolveCloudEndpoint: resolveCloudEndpoint2 } = await import("./endpoint-DGS73AVM.js");
+    const { apiCall: apiCall2 } = await import("./cli-shared-FZWLZCCR.js");
+    const endpoint = opts.endpoint ? resolveCloudEndpoint2(opts.endpoint) : CLOUD_API_ENDPOINT;
+    const consoleUrl = "https://kensaur.us/mushi-mushi/projects";
+    let apiKey = opts.apiKey;
+    let projectId = opts.projectId;
+    if (!apiKey) {
+      const signInUrl = "https://kensaur.us/mushi-mushi/sign-in";
+      console.log("");
+      console.log("  Mushi login \u2014 browser-guided");
+      console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+      if (opts.browser !== false) {
+        console.log("  Opening the Mushi console in your browser\u2026");
+        try {
+          const { exec } = await import("child_process");
+          const openCmd = process.platform === "win32" ? `start "" "${signInUrl}"` : process.platform === "darwin" ? `open "${signInUrl}"` : `xdg-open "${signInUrl}"`;
+          exec(openCmd);
+        } catch {
+        }
+      } else {
+        console.log(`  Sign in at: ${signInUrl}`);
+      }
+      console.log("");
+      console.log("  After signing in, go to Projects \u2192 API Keys \u2192 New key");
+      console.log("  then paste the key below.");
+      console.log("");
+      const { createInterface } = await import("readline");
+      const rl = createInterface({ input: process.stdin, output: process.stdout });
+      const ask = (q) => new Promise((resolve4) => rl.question(q, (a) => resolve4(a.trim())));
+      apiKey = await ask("  API key (mushi_...): ");
+      if (!projectId) {
+        projectId = await ask(`  Project ID (uuid, or leave blank to list projects): `);
+        if (!projectId) projectId = void 0;
+      }
+      rl.close();
+      if (!apiKey) {
+        process.stderr.write("\nerror: API key is required.\n");
+        process.exit(2);
+      }
+    }
     const config = loadConfig();
-    config.apiKey = opts.apiKey;
-    if (opts.endpoint) config.endpoint = assertEndpoint(opts.endpoint);
-    if (opts.projectId) config.projectId = opts.projectId;
+    config.apiKey = apiKey;
+    config.endpoint = endpoint;
+    if (projectId) config.projectId = projectId;
     saveConfig(config);
-    console.log("\u2713 Credentials saved to ~/.mushirc (mode 0o600)");
-    console.log("  Run 'mushi whoami' to verify the connection.");
+    console.log("");
+    console.log("  \u2713 Credentials saved to ~/.config/mushi/config.json");
+    const verifyResult = await apiCall2(
+      "/v1/sync/whoami",
+      { apiKey, endpoint, projectId }
+    );
+    if (!verifyResult.ok) {
+      console.warn(`  \u26A0  Key saved, but verification failed: ${verifyResult.error?.message ?? "unknown error"}`);
+      console.warn(`     Check your key at: ${consoleUrl}`);
+      return;
+    }
+    const d = verifyResult.data;
+    if (!projectId && d.project_id) {
+      config.projectId = d.project_id;
+      saveConfig(config);
+      console.log(`  \u2713 Project: ${d.project_name} (${d.project_id})`);
+    } else if (d.project_name) {
+      console.log(`  \u2713 Project: ${d.project_name} (${d.project_id})`);
+    }
+    console.log(`  \u2713 Endpoint: ${endpoint}`);
+    console.log("");
+    console.log("  Run 'mushi whoami' to verify \xB7 'mushi init' to set up the SDK");
   });
   program2.command("whoami").description("Verify API key and display project info").option("--json", "Machine-readable JSON output").addHelpText("after", `
 Verifies that MUSHI_API_KEY is valid and shows which project it belongs to.
@@ -1390,7 +1163,7 @@ Useful after 'mushi login' to confirm credentials are correct.`).action(async (o
     console.log(`Fixes:   ${d.fixes_count} total \xB7 ${d.fixes_merged} merged`);
     console.log(`Lessons: ${d.lessons_count} active rules`);
   });
-  program2.command("config").description("View or update CLI config (stored in ~/.mushirc)").argument("[key]", "Config key to set: apiKey | endpoint | projectId").argument("[value]", "New value").addHelpText("after", `
+  program2.command("config").description("View or update CLI config (stored in ~/.config/mushi/config.json)").argument("[key]", "Config key to set: apiKey | endpoint | projectId").argument("[value]", "New value").addHelpText("after", `
 Keys:
   apiKey     \u2014 Mushi API key (mushi_...)
   endpoint   \u2014 Supabase edge function URL
@@ -1844,7 +1617,7 @@ AI code review context.
 Typical CI usage:
   MUSHI_API_KEY=$KEY MUSHI_PROJECT_ID=$PID MUSHI_API_ENDPOINT=$URL \\
     npx @mushi-mushi/cli sync-lessons --cwd .`).action(async (opts) => {
-    const { writeFile: writeFile2, mkdir: mkdir2 } = await import("fs/promises");
+    const { writeFile: writeFile3, mkdir: mkdir2 } = await import("fs/promises");
     const nodePath = await import("path");
     const config = requireConfig();
     const cwd = opts.cwd ?? process.cwd();
@@ -1872,7 +1645,7 @@ Typical CI usage:
       return;
     }
     await mkdir2(nodePath.dirname(target), { recursive: true });
-    await writeFile2(target, JSON.stringify(output, null, 2) + "\n", "utf8");
+    await writeFile3(target, JSON.stringify(output, null, 2) + "\n", "utf8");
     if (opts.json) {
       console.log(JSON.stringify({ ok: true, path: target, count: lessons2.length }));
     } else {
@@ -1885,14 +1658,14 @@ Typical CI usage:
 import { createReadStream } from "fs";
 import { readFile, readdir } from "fs/promises";
 import { createHash } from "crypto";
-import { join as join5, relative, basename } from "path";
+import { join as join4, relative, basename } from "path";
 import * as p2 from "@clack/prompts";
 async function findMapFiles(dir) {
   const results = [];
   async function walk(current) {
     const entries = await readdir(current, { withFileTypes: true });
     for (const e of entries) {
-      const full = join5(current, e.name);
+      const full = join4(current, e.name);
       if (e.isDirectory()) {
         await walk(full);
       } else if (e.isFile() && (e.name.endsWith(".js.map") || e.name.endsWith(".css.map"))) {
@@ -2067,7 +1840,7 @@ Examples:
   mushi index ./src
   mushi index ./src --language ts --dry-run`).action(async (path, opts) => {
     const config = requireConfig({ needsProject: true });
-    const { readdir: readdir2, readFile: readFile3, stat } = await import("fs/promises");
+    const { readdir: readdir2, readFile: readFile4, stat } = await import("fs/promises");
     const nodePath = await import("path");
     const SKIP = /node_modules|\.git|dist|build|\.next|\.turbo|coverage/;
     const EXTS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".py", ".go", ".rs"]);
@@ -2094,7 +1867,7 @@ Examples:
 `);
         continue;
       }
-      const source = await readFile3(file, "utf8");
+      const source = await readFile4(file, "utf8");
       const relative2 = nodePath.relative(root, file).replaceAll("\\", "/");
       count++;
       bytes += source.length;
@@ -2141,6 +1914,56 @@ Examples:
   });
 }
 
+// src/mcp-config.ts
+import { mkdir, readFile as readFile2, writeFile } from "fs/promises";
+import { dirname as dirname2 } from "path";
+var DEFAULT_MUSHI_FEATURES = "triage,fixes,inventory,setup,docs";
+async function writeMcpServerEntry(opts) {
+  const { configPath, serverName, serverBlock, dryRun = false } = opts;
+  let merged = { mcpServers: {} };
+  let created = false;
+  try {
+    const existing = await readFile2(configPath, "utf8");
+    try {
+      merged = JSON.parse(existing);
+    } catch {
+      merged = { mcpServers: {} };
+    }
+  } catch {
+    created = true;
+    merged = { mcpServers: {} };
+  }
+  const servers = merged.mcpServers ?? {};
+  servers[serverName] = serverBlock;
+  merged.mcpServers = servers;
+  const output = JSON.stringify(merged, null, 2) + "\n";
+  if (!dryRun) {
+    await mkdir(dirname2(configPath), { recursive: true });
+    await writeFile(configPath, output, "utf8");
+  }
+  return { created, path: configPath };
+}
+function buildMcpServerBlock(opts) {
+  return {
+    command: "npx",
+    args: ["-y", "@mushi-mushi/mcp@latest"],
+    env: {
+      MUSHI_API_ENDPOINT: opts.endpoint,
+      MUSHI_PROJECT_ID: opts.projectId,
+      MUSHI_API_KEY: opts.apiKey,
+      MUSHI_FEATURES: DEFAULT_MUSHI_FEATURES
+    }
+  };
+}
+function buildMcpServerName(opts) {
+  if (opts.legacy) return "mushi";
+  if (opts.projectName) {
+    const slug = opts.projectName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 24);
+    return `mushi-${slug}`;
+  }
+  return `mushi-${(opts.projectId ?? "unknown").slice(0, 8)}`;
+}
+
 // src/commands/project.ts
 function registerProjectCommands(program2) {
   const project = program2.command("project").description("Project management");
@@ -2155,8 +1978,8 @@ Typical first-time flow:
   # Browser opens \u2192 sign up / magic-link \u2192 come back to terminal
   # CLI writes .env.local and .cursor/mcp.json
   # mushi whoami to confirm`).action(async (opts) => {
-    const { writeFile: writeFile2, mkdir: mkdir2 } = await import("fs/promises");
-    const { existsSync: existsSync5 } = await import("fs");
+    const { writeFile: writeFile3 } = await import("fs/promises");
+    const { existsSync: existsSync4 } = await import("fs");
     const nodePath = await import("path");
     const endpoint = opts.endpoint ?? loadConfig().endpoint ?? "https://api.mushimushi.dev";
     const signUpUrl = "https://kensaur.us/mushi-mushi/sign-up";
@@ -2203,41 +2026,15 @@ Typical first-time flow:
       `MUSHI_API_KEY=${apiKey}`,
       ""
     ];
-    const envExisting = existsSync5(envPath);
-    await writeFile2(envPath, envLines.join("\n"), "utf8");
+    const envExisting = existsSync4(envPath);
+    await writeFile3(envPath, envLines.join("\n"), "utf8");
     console.log(`
   \u2713 ${envExisting ? "Updated" : "Created"} .env.local`);
-    const mcpDir = nodePath.join(cwd, ".cursor");
-    await mkdir2(mcpDir, { recursive: true });
-    const mcpPath = nodePath.join(mcpDir, "mcp.json");
-    const mcpJson = {
-      mcpServers: {
-        mushi: {
-          command: "npx",
-          args: ["-y", "@mushi-mushi/mcp@latest"],
-          env: {
-            MUSHI_API_ENDPOINT: endpoint,
-            MUSHI_PROJECT_ID: projectId,
-            MUSHI_API_KEY: apiKey
-          }
-        }
-      }
-    };
-    const mcpExisting = existsSync5(mcpPath);
-    if (mcpExisting) {
-      try {
-        const { readFile: readFile3 } = await import("fs/promises");
-        const raw = JSON.parse(await readFile3(mcpPath, "utf8"));
-        const existing = raw;
-        existing.mcpServers = { ...existing.mcpServers ?? {}, mushi: mcpJson.mcpServers.mushi };
-        await writeFile2(mcpPath, JSON.stringify(existing, null, 2) + "\n", "utf8");
-      } catch {
-        await writeFile2(mcpPath, JSON.stringify(mcpJson, null, 2) + "\n", "utf8");
-      }
-    } else {
-      await writeFile2(mcpPath, JSON.stringify(mcpJson, null, 2) + "\n", "utf8");
-    }
-    console.log(`  \u2713 ${mcpExisting ? "Updated" : "Created"} .cursor/mcp.json`);
+    const mcpPath = nodePath.join(cwd, ".cursor", "mcp.json");
+    const serverName = buildMcpServerName({ legacy: true });
+    const serverBlock = buildMcpServerBlock({ endpoint, projectId, apiKey });
+    const { created: mcpCreated } = await writeMcpServerEntry({ configPath: mcpPath, serverName, serverBlock });
+    console.log(`  \u2713 ${mcpCreated ? "Created" : "Updated"} .cursor/mcp.json`);
     console.log("");
     console.log('  Done! Restart Cursor and ask: "list mushi tools"');
     console.log("  Run `mushi whoami` to verify the connection.");
@@ -2247,9 +2044,10 @@ Typical first-time flow:
 
 // src/commands/setup.ts
 function registerSetupCommands(program2) {
-  program2.command("setup").description("Wire Mushi into your IDE with one command").option("--ide <ide>", "Target IDE: cursor | claude | continue | zed", "cursor").option("--project-slug <slug>", "Override the project slug in the server name (default: project ID prefix)").option("--with-rules", "Also write the .cursorrules / .claude/rules/mushi.md lesson-library hook").option("--dry-run", "Print what would be written without making changes").addHelpText("after", `
+  program2.command("setup").description("Wire Mushi into your IDE with one command").option("--ide <ide>", "Target IDE: cursor | claude | continue | zed", "cursor").option("--project-slug <slug>", "Override the project slug in the server name (default: fetched from API or ID prefix)").option("--all-projects", "Write a separate mushi-<name> server entry for every accessible project").option("--with-rules", "Also write the .cursorrules / .claude/rules/mushi.md lesson-library hook").option("--dry-run", "Print what would be written without making changes").addHelpText("after", `
 Examples:
   mushi setup                         # wire Cursor (default)
+  mushi setup --all-projects          # one server entry per accessible project
   mushi setup --ide claude            # wire Claude Code
   mushi setup --ide cursor --with-rules  # also write .cursorrules
 
@@ -2259,12 +2057,48 @@ Supported IDEs:
   continue  \u2014 writes .continue/mcp.json
   zed       \u2014 writes ~/.config/zed/settings.json mcpServers block
 
-The command reads credentials from ~/.mushirc (run \`mushi login\` first).`).action(async (opts) => {
-    const { writeFile: writeFile2, mkdir: mkdir2, readFile: readFile3 } = await import("fs/promises");
-    const { existsSync: existsSync5 } = await import("fs");
+The command reads credentials from ~/.config/mushi/config.json (run \`mushi login\` first).`).action(async (opts) => {
+    const { writeFile: writeFile3, mkdir: mkdir2, readFile: readFile4 } = await import("fs/promises");
+    const { existsSync: existsSync4 } = await import("fs");
     const nodePath = await import("path");
     const os = await import("os");
     const config = requireConfig({ needsProject: true });
+    const redactKeyForDisplay = (text2) => {
+      const key = config.apiKey;
+      if (!key) return text2;
+      const masked = key.length > 12 ? `${key.slice(0, 10)}\u2026${key.slice(-2)}` : "\u2022\u2022\u2022\u2022";
+      return text2.split(key).join(masked);
+    };
+    let slug;
+    if (opts.projectSlug) {
+      slug = opts.projectSlug;
+    } else {
+      try {
+        const res = await fetch(
+          `${config.endpoint?.replace(/\/$/, "")}/v1/admin/mcp/projects`,
+          {
+            headers: {
+              "X-Mushi-Api-Key": config.apiKey ?? "",
+              "X-Mushi-Project": config.projectId ?? ""
+            },
+            signal: AbortSignal.timeout(5e3)
+          }
+        );
+        if (res.ok) {
+          const body = await res.json();
+          const project = body?.data?.projects?.find((p3) => p3.id === config.projectId);
+          if (project?.name) {
+            slug = project.name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 24);
+          } else {
+            slug = config.projectId?.slice(0, 8) ?? "mushi";
+          }
+        } else {
+          slug = config.projectId?.slice(0, 8) ?? "mushi";
+        }
+      } catch {
+        slug = config.projectId?.slice(0, 8) ?? "mushi";
+      }
+    }
     const IDE_CONFIG = {
       cursor: { dir: ".cursor", file: "mcp.json", format: "mcp-json" },
       claude: { dir: ".claude", file: "mcp.json", format: "mcp-json" },
@@ -2278,7 +2112,23 @@ The command reads credentials from ~/.mushirc (run \`mushi login\` first).`).act
       process.exit(2);
     }
     const cwd = process.cwd();
-    const slug = opts.projectSlug ?? (config.projectId?.slice(0, 8) ?? "mushi");
+    let allProjectsList = null;
+    if (opts.allProjects && config.endpoint && config.apiKey) {
+      try {
+        const res = await fetch(
+          `${config.endpoint.replace(/\/$/, "")}/v1/admin/mcp/projects`,
+          {
+            headers: { "X-Mushi-Api-Key": config.apiKey, "X-Mushi-Project": config.projectId ?? "" },
+            signal: AbortSignal.timeout(8e3)
+          }
+        );
+        if (res.ok) {
+          const body = await res.json();
+          allProjectsList = body?.data?.projects ?? [];
+        }
+      } catch {
+      }
+    }
     const serverName = `mushi-${slug}`;
     const mcpServerBlock = {
       command: "npx",
@@ -2292,31 +2142,38 @@ The command reads credentials from ~/.mushirc (run \`mushi login\` first).`).act
     const configDir = ideEntry.dir.startsWith("/") ? ideEntry.dir : nodePath.join(cwd, ideEntry.dir);
     const configPath = nodePath.join(configDir, ideEntry.file);
     if (ideEntry.format === "mcp-json") {
-      let merged = { mcpServers: {} };
-      if (existsSync5(configPath)) {
-        try {
-          const raw = await readFile3(configPath, "utf8");
-          merged = JSON.parse(raw);
-        } catch {
+      if (allProjectsList && allProjectsList.length > 0) {
+        for (const p3 of allProjectsList) {
+          const pServerName = buildMcpServerName({ projectId: p3.id, projectName: p3.name ?? void 0 });
+          const pBlock = buildMcpServerBlock({
+            endpoint: config.endpoint,
+            projectId: p3.id,
+            apiKey: config.apiKey
+          });
+          if (!opts.dryRun) {
+            await writeMcpServerEntry({ configPath, serverName: pServerName, serverBlock: pBlock });
+          }
+        }
+        if (opts.dryRun) {
+          console.log(`[dry-run] Would add ${allProjectsList.length} mushi-* entries to ${configPath}`);
+        } else {
+          console.log(`\u2713 Added ${allProjectsList.length} mushi-* server entries (${allProjectsList.map((p3) => p3.name ?? p3.id.slice(0, 8)).join(", ")})`);
         }
-      }
-      const servers = merged.mcpServers ?? {};
-      servers[serverName] = mcpServerBlock;
-      merged.mcpServers = servers;
-      const output = JSON.stringify(merged, null, 2) + "\n";
-      if (opts.dryRun) {
-        console.log(`[dry-run] Would write ${configPath}:`);
-        console.log(output);
       } else {
-        await mkdir2(configDir, { recursive: true });
-        await writeFile2(configPath, output, "utf8");
-        console.log(`\u2713 Written ${configPath}`);
+        if (opts.dryRun) {
+          const preview = JSON.stringify({ mcpServers: { [serverName]: mcpServerBlock } }, null, 2) + "\n";
+          console.log(`[dry-run] Would write ${configPath}:`);
+          console.log(redactKeyForDisplay(preview));
+        } else {
+          await writeMcpServerEntry({ configPath, serverName, serverBlock: mcpServerBlock });
+          console.log(`\u2713 Written ${configPath}`);
+        }
       }
     } else if (ideEntry.format === "zed") {
       let settings = {};
-      if (existsSync5(configPath)) {
+      if (existsSync4(configPath)) {
         try {
-          const raw = await readFile3(configPath, "utf8");
+          const raw = await readFile4(configPath, "utf8");
           settings = JSON.parse(raw);
         } catch {
         }
@@ -2338,10 +2195,10 @@ The command reads credentials from ~/.mushirc (run \`mushi login\` first).`).act
       const output = JSON.stringify(settings, null, 2) + "\n";
       if (opts.dryRun) {
         console.log(`[dry-run] Would write ${configPath}:`);
-        console.log(output);
+        console.log(redactKeyForDisplay(output));
       } else {
         await mkdir2(configDir, { recursive: true });
-        await writeFile2(configPath, output, "utf8");
+        await writeFile3(configPath, output, "utf8");
         console.log(`\u2713 Written ${configPath}`);
       }
     }
@@ -2375,7 +2232,7 @@ The command reads credentials from ~/.mushirc (run \`mushi login\` first).`).act
         if (opts.dryRun) {
           console.log(`[dry-run] Would write ${rulesPath}`);
         } else {
-          await writeFile2(rulesPath, rulesContent, "utf8");
+          await writeFile3(rulesPath, rulesContent, "utf8");
           console.log(`\u2713 Written .cursorrules`);
         }
       } else if (opts.ide === "claude") {
@@ -2385,7 +2242,7 @@ The command reads credentials from ~/.mushirc (run \`mushi login\` first).`).act
           console.log(`[dry-run] Would write ${rulesPath}`);
         } else {
           await mkdir2(rulesDir, { recursive: true });
-          await writeFile2(rulesPath, rulesContent, "utf8");
+          await writeFile3(rulesPath, rulesContent, "utf8");
           console.log(`\u2713 Written .claude/rules/mushi.md`);
         }
       }
@@ -2515,7 +2372,7 @@ function renderNudgeExplainer(phase) {
 
 // src/sanitize-config.ts
 var PROJECT_ID_RE = /^(?:proj_[A-Za-z0-9_-]{10,}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
-var API_KEY_RE = /^mushi_[A-Za-z0-9_-]{10,}$/;
+var API_KEY_RE = /^(mushi_|mush_pk_)[A-Za-z0-9_-]{10,}$/;
 function sanitizeApiKey(raw) {
   const key = raw.replace(/[\r\n\0]/g, "");
   if (!API_KEY_RE.test(key)) {
@@ -2662,11 +2519,11 @@ async function checkEndpointReachability(endpoint, doFetch = globalThis.fetch) {
 }
 async function checkSdkInstall(cwd) {
   try {
-    const { readFile: readFile3 } = await import("fs/promises");
-    const { join: join7, resolve: resolve4 } = await import("path");
+    const { readFile: readFile4 } = await import("fs/promises");
+    const { join: join6, resolve: resolve4 } = await import("path");
     const root = resolve4(cwd);
-    const pkgPath = join7(root, "package.json");
-    const pkg = JSON.parse(await readFile3(pkgPath, "utf8"));
+    const pkgPath = join6(root, "package.json");
+    const pkg = JSON.parse(await readFile4(pkgPath, "utf8"));
     const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
     const sdks = [
       "@mushi-mushi/react",
@@ -2674,11 +2531,11 @@ async function checkSdkInstall(cwd) {
       "@mushi-mushi/core",
       "@mushi-mushi/react-native"
     ];
-    const installed2 = sdks.filter((s) => deps[s]);
+    const installed = sdks.filter((s) => deps[s]);
     return {
       name: "SDK installed in this repo",
-      ok: installed2.length > 0,
-      detail: installed2.length > 0 ? installed2.map((s) => `${s}@${deps[s]}`).join(", ") : "No @mushi-mushi/* package in package.json \u2014 run `mushi init` to install"
+      ok: installed.length > 0,
+      detail: installed.length > 0 ? installed.map((s) => `${s}@${deps[s]}`).join(", ") : "No @mushi-mushi/* package in package.json \u2014 run `mushi init` to install"
     };
   } catch {
     return null;
@@ -2844,18 +2701,18 @@ async function checkQaStoriesHealth(config, doFetch = globalThis.fetch) {
 async function checkHostAppWiring(cwd) {
   const checks = [];
   try {
-    const { readFile: readFile3, access } = await import("fs/promises");
-    const { join: join7, resolve: resolve4 } = await import("path");
+    const { readFile: readFile4, access } = await import("fs/promises");
+    const { join: join6, resolve: resolve4 } = await import("path");
     const root = resolve4(cwd);
-    const pkgPath = join7(root, "package.json");
-    const pkg = JSON.parse(await readFile3(pkgPath, "utf8"));
+    const pkgPath = join6(root, "package.json");
+    const pkg = JSON.parse(await readFile4(pkgPath, "utf8"));
     const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
     const isCapHybrid = Boolean(deps["@capacitor/core"] && deps["react"]);
     const envCandidates = [".env.local", ".env"];
     let envContent = "";
     for (const f of envCandidates) {
       try {
-        envContent = await readFile3(join7(root, f), "utf8");
+        envContent = await readFile4(join6(root, f), "utf8");
         break;
       } catch {
       }
@@ -2869,7 +2726,7 @@ async function checkHostAppWiring(cwd) {
     });
     let mcpPresent = false;
     try {
-      await access(join7(root, ".cursor", "mcp.json"));
+      await access(join6(root, ".cursor", "mcp.json"));
       mcpPresent = true;
     } catch {
     }
@@ -2900,18 +2757,128 @@ async function checkHostAppWiring(cwd) {
   }
   return checks;
 }
+async function checkMcpConfig(config, cwd, doFetch = globalThis.fetch) {
+  const checks = [];
+  const { readFile: readFile4 } = await import("fs/promises");
+  const { join: join6, resolve: resolve4 } = await import("path");
+  const { homedir } = await import("os");
+  const root = resolve4(cwd);
+  const candidates = [
+    join6(root, ".cursor", "mcp.json"),
+    join6(homedir(), ".cursor", "mcp.json")
+  ];
+  let mcpPath = null;
+  let mcpRaw = null;
+  for (const candidate of candidates) {
+    try {
+      mcpRaw = await readFile4(candidate, "utf8");
+      mcpPath = candidate;
+      break;
+    } catch {
+    }
+  }
+  if (!mcpPath || !mcpRaw) {
+    checks.push({
+      name: "[mcp] mcp.json present",
+      ok: false,
+      detail: "No .cursor/mcp.json found in cwd or ~/.cursor/. Run `mushi setup` to create it."
+    });
+    return checks;
+  }
+  checks.push({
+    name: "[mcp] mcp.json present",
+    ok: true,
+    detail: `Found at ${mcpPath}`
+  });
+  let mcpConfig = {};
+  try {
+    mcpConfig = JSON.parse(mcpRaw);
+  } catch {
+    checks.push({ name: "[mcp] mcp.json valid JSON", ok: false, detail: "mcp.json is not valid JSON \u2014 regenerate with `mushi setup`." });
+    return checks;
+  }
+  const servers = mcpConfig.mcpServers ?? {};
+  const mushiEntries = Object.entries(servers).filter(([k]) => k === "mushi" || k.startsWith("mushi-"));
+  if (mushiEntries.length === 0) {
+    checks.push({
+      name: "[mcp] mushi server entry",
+      ok: false,
+      detail: "No mushi or mushi-* server found in mcpServers. Run `mushi setup` to add one."
+    });
+    return checks;
+  }
+  checks.push({
+    name: "[mcp] mushi server entry",
+    ok: true,
+    detail: `Found: ${mushiEntries.map(([k]) => k).join(", ")}`
+  });
+  let anyKeyValid = false;
+  let anyEndpointSet = false;
+  for (const [, srv] of mushiEntries) {
+    const s = srv;
+    const env = s.env ?? {};
+    const key = env["MUSHI_API_KEY"] ?? "";
+    const endpoint = env["MUSHI_API_ENDPOINT"] ?? "";
+    if (key.startsWith("mushi_")) anyKeyValid = true;
+    if (endpoint.includes("supabase.co") || endpoint.includes("localhost")) anyEndpointSet = true;
+  }
+  checks.push({
+    name: "[mcp] MUSHI_API_KEY set",
+    ok: anyKeyValid,
+    detail: anyKeyValid ? "At least one mushi server has a valid mushi_* API key" : "No mushi_* API key found in any mushi server env. Re-run `mushi setup` to regenerate."
+  });
+  checks.push({
+    name: "[mcp] MUSHI_API_ENDPOINT set",
+    ok: anyEndpointSet,
+    detail: anyEndpointSet ? "MUSHI_API_ENDPOINT is present and looks valid" : "MUSHI_API_ENDPOINT missing or not a Supabase URL. Re-run `mushi setup`."
+  });
+  if (anyKeyValid && anyEndpointSet && config.apiKey && config.endpoint) {
+    try {
+      const { endpoint, apiKey } = sanitizeCliCredentials(config);
+      const res = await doFetch(`${endpoint}/v1/admin/mcp/account-overview`, {
+        headers: apiKeyHeaders(apiKey, config.projectId),
+        signal: AbortSignal.timeout(6e3)
+      });
+      if (res.ok) {
+        const body = await res.json();
+        const projectCount = body?.data?.total ?? 0;
+        checks.push({
+          name: "[mcp] account-overview reachable",
+          ok: true,
+          detail: `Key is valid; ${projectCount} accessible project${projectCount === 1 ? "" : "s"}`
+        });
+      } else {
+        checks.push({
+          name: "[mcp] account-overview reachable",
+          ok: false,
+          detail: `GET /v1/admin/mcp/account-overview \u2192 HTTP ${res.status}. Verify the API key is active.`
+        });
+      }
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      checks.push({
+        name: "[mcp] account-overview reachable",
+        ok: false,
+        detail: `Probe failed: ${msg}. Check MUSHI_API_ENDPOINT and network connectivity.`
+      });
+    }
+  }
+  return checks;
+}
 var FIX_HINTS = {
   "CLI config file": "Run `mushi connect --endpoint <url> --project-id <uuid> --api-key mushi_xxx` or `mushi config endpoint <url>`.",
   "API key configured": "Mint a key in the console (Projects \u2192 API Keys) then `mushi login --api-key mushi_xxx`.",
   "Project ID configured": "Copy the project UUID from the console Projects page \u2192 `mushi config projectId <uuid>`.",
   "Endpoint reachable": "Check your network and that MUSHI_API_ENDPOINT points at `\u2026/functions/v1/api`.",
   "[ingest]": "Open the console Onboarding wizard \u2192 Install SDK \u2192 submit a test report, or run `mushi connect --wait`.",
-  "[server]": "Open Settings \u2192 Integrations: connect GitHub, index codebase, add Anthropic BYOK key, enable autofix."
+  "[server]": "Open Settings \u2192 Integrations: connect GitHub, index codebase, add Anthropic BYOK key, enable autofix.",
+  "[mcp]": "Run `mushi setup` to regenerate .cursor/mcp.json with a fresh API key and endpoint."
 };
 function fixHintForCheck(name) {
   if (FIX_HINTS[name]) return FIX_HINTS[name];
   if (name.startsWith("[ingest]")) return FIX_HINTS["[ingest]"];
   if (name.startsWith("[server]") || name.startsWith("[preflight]")) return FIX_HINTS["[server]"];
+  if (name.startsWith("[mcp]")) return FIX_HINTS["[mcp]"];
   return void 0;
 }
 async function runDoctor(config, options = {}) {
@@ -2941,6 +2908,10 @@ async function runDoctor(config, options = {}) {
     const hostChecks = await checkHostAppWiring(options.cwd ?? process.cwd());
     checks.push(...hostChecks);
   }
+  if (options.mcp) {
+    const mcpChecks = await checkMcpConfig(config, options.cwd ?? process.cwd(), doFetch);
+    checks.push(...mcpChecks);
+  }
   return { checks, ready: checks.every((c) => c.ok) };
 }
 function formatDoctorResult(result) {
@@ -2987,9 +2958,9 @@ async function planUpgrade(cwd) {
     ...pkg?.dependencies ?? {},
     ...pkg?.devDependencies ?? {}
   };
-  const installed2 = MUSHI_PACKAGES.filter((name) => deps[name]);
+  const installed = MUSHI_PACKAGES.filter((name) => deps[name]);
   const entries = await Promise.all(
-    installed2.map(async (name) => {
+    installed.map(async (name) => {
       const current = deps[name] ?? "";
       const currentCore = current.replace(/^[\^~>=<]*/, "");
       if (!/^\d/.test(currentCore)) {
@@ -3061,8 +3032,8 @@ async function runUpgrade(opts = {}) {
 }
 
 // src/connect.ts
-import { appendFile, mkdir, readFile as readFile2, writeFile } from "fs/promises";
-import { join as join6, resolve as resolve3 } from "path";
+import { appendFile, readFile as readFile3, writeFile as writeFile2 } from "fs/promises";
+import { join as join5, resolve as resolve3 } from "path";
 function envKeyPresent(content, key) {
   const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   return new RegExp(`^${escaped}=`, "m").test(content);
@@ -3074,7 +3045,7 @@ ${lines.join("\n")}
 `;
   let existing = null;
   try {
-    existing = await readFile2(path, "utf8");
+    existing = await readFile3(path, "utf8");
   } catch {
   }
   if (existing !== null) {
@@ -3089,15 +3060,15 @@ ${needs.join("\n")}
 `, "utf8");
     return true;
   }
-  await writeFile(path, block, "utf8");
+  await writeFile2(path, block, "utf8");
   return true;
 }
 async function ensureMcpJsonGitignored(cwd, messages) {
-  const gitignorePath = join6(cwd, ".gitignore");
+  const gitignorePath = join5(cwd, ".gitignore");
   const patterns = [".cursor/mcp.json", ".cursor/"];
   let content = null;
   try {
-    content = await readFile2(gitignorePath, "utf8");
+    content = await readFile3(gitignorePath, "utf8");
   } catch {
   }
   if (content === null) {
@@ -3128,7 +3099,7 @@ async function runConnect(opts, baseConfig = {}) {
     const pkg = readPackageJson(cwd);
     const framework = detectFramework(cwd, pkg);
     const lines = envVarsToWrite(opts.apiKey, opts.projectId, framework).split("\n");
-    envPath = join6(cwd, ".env.local");
+    envPath = join5(cwd, ".env.local");
     const wrote = await mergeEnvFile(envPath, lines);
     messages.push(
       wrote ? `\u2713 Env vars merged into ${envPath}` : `\u2713 Env vars already present in ${envPath} (existing values left untouched)`
@@ -3142,28 +3113,15 @@ async function runConnect(opts, baseConfig = {}) {
   }
   let mcpPath = null;
   if (opts.wireIde !== false) {
-    const mcpDir = join6(cwd, ".cursor");
-    mcpPath = join6(mcpDir, "mcp.json");
-    const serverName = `mushi-${opts.projectId.slice(0, 8)}`;
-    const mcpServerBlock = {
-      command: "npx",
-      args: ["-y", "@mushi-mushi/mcp@latest"],
-      env: {
-        MUSHI_API_ENDPOINT: endpoint,
-        MUSHI_PROJECT_ID: opts.projectId,
-        MUSHI_API_KEY: opts.apiKey
-      }
-    };
-    let merged = { mcpServers: {} };
-    try {
-      merged = JSON.parse(await readFile2(mcpPath, "utf8"));
-    } catch {
-    }
-    const servers = merged.mcpServers ?? {};
-    servers[serverName] = mcpServerBlock;
-    merged.mcpServers = servers;
-    await mkdir(mcpDir, { recursive: true });
-    await writeFile(mcpPath, JSON.stringify(merged, null, 2) + "\n", "utf8");
+    const mcpDir = join5(cwd, ".cursor");
+    mcpPath = join5(mcpDir, "mcp.json");
+    const serverName = buildMcpServerName({ projectId: opts.projectId });
+    const serverBlock = buildMcpServerBlock({
+      endpoint,
+      projectId: opts.projectId,
+      apiKey: opts.apiKey
+    });
+    await writeMcpServerEntry({ configPath: mcpPath, serverName, serverBlock });
     await ensureMcpJsonGitignored(cwd, messages);
     messages.push(`\u2713 Wired ${mcpPath} \u2014 restart Cursor and run "list mushi tools"`);
   }
@@ -3379,12 +3337,15 @@ Examples:
   ).option(
     "--host-app",
     "Verify host-app wiring: Mushi env vars, Cursor MCP config, Capacitor hybrid SDK notes."
+  ).option(
+    "--mcp",
+    "Check Cursor MCP config: verify mushi-* server entry, credentials, and probe account-overview connectivity."
   ).option(
     "--fix",
     "Apply safe local fixes when checks fail: write missing .env.local lines and wire Cursor MCP config."
   ).action(async (opts) => {
     const config = loadConfig();
-    const doctorOpts = { cwd: opts.cwd, server: opts.server, ingest: opts.ingest, qaStories: opts.qaStories, hostApp: opts.hostApp };
+    const doctorOpts = { cwd: opts.cwd, server: opts.server, ingest: opts.ingest, qaStories: opts.qaStories, hostApp: opts.hostApp, mcp: opts.mcp };
     let result = await runDoctor(config, doctorOpts);
     if (!result.ready && opts.fix && config.apiKey && config.projectId && config.endpoint) {
       const connectResult = await runConnect({
@@ -3396,7 +3357,7 @@ Examples:
         wireIde: true
       }, config);
       for (const msg of connectResult.messages) console.log(msg);
-      result = await runDoctor(config, doctorOpts);
+      result = await runDoctor(config, { ...doctorOpts, mcp: opts.mcp });
     }
     const { checks } = result;
     if (opts.json) {