@mushi-mushi/cli 0.18.2 → 0.20.0

package/dist/index.js

@@ -1,18 +1,26 @@
 #!/usr/bin/env node
 import {
-  API_TIMEOUT_MS,
-  CONFIG_PATH,
-  MUSHI_CLI_VERSION,
-  apiCall,
-  die,
-  fmtDate,
-  installSignalHandlers,
+  FRAMEWORKS,
+  apiKeyHeaders,
+  buildMcpServerBlock,
+  buildMcpServerName,
+  detectFramework,
+  detectPackageManager,
+  envVarsToWrite,
+  fetchIngestSetup,
+  installCommand,
   loadConfig,
-  pad,
-  requireConfig,
-  saveConfig
-} from "./chunk-A2NHESSJ.js";
+  readPackageJson,
+  runConnect,
+  sanitizeApiKey,
+  sanitizeCliCredentials,
+  sanitizeEndpoint,
+  sanitizeProjectId,
+  saveConfig,
+  writeMcpServerEntry
+} from "./chunk-D5IDNBJO.js";
 import {
+  CLOUD_API_ENDPOINT,
   TEST_REPORT_FETCH_TIMEOUT_MS,
   assertEndpoint,
   normalizeEndpoint,
@@ -22,6 +30,88 @@ import {
 // src/index.ts
 import { Command } from "commander";
 
+// src/errors.ts
+var EXIT_CODE_MAP = {
+  E_AUTH_MISSING: 2,
+  E_AUTH_INVALID: 2,
+  E_PROJECT_MISSING: 2,
+  E_ENDPOINT_INVALID: 2,
+  E_INVALID_INPUT: 2,
+  E_NOT_INTERACTIVE: 2,
+  E_NETWORK: 3,
+  E_TIMEOUT: 3,
+  E_API_ERROR: 3,
+  E_RATE_LIMITED: 3,
+  E_FILE_NOT_FOUND: 1,
+  E_FILE_PERMISSION: 1,
+  E_FRESHNESS_STALE: 1,
+  E_INTERRUPTED: 130,
+  // 128 + SIGINT (2). POSIX convention.
+  E_INTERNAL: 1
+};
+var MushiCliError = class extends Error {
+  code;
+  hint;
+  cause;
+  constructor(code, message, hint, cause) {
+    super(message);
+    this.name = "MushiCliError";
+    this.code = code;
+    if (hint) this.hint = hint;
+    if (cause !== void 0) this.cause = cause;
+  }
+  /** Exit code POSIX-aware shell scripts should branch on. */
+  get exitCode() {
+    return EXIT_CODE_MAP[this.code];
+  }
+  /**
+   * Format for `--json` output. Used by the JSON writer when a CLI
+   * subcommand was invoked with `--json` and an error escapes.
+   */
+  toJSON() {
+    return {
+      error: {
+        code: this.code,
+        message: this.message,
+        ...this.hint ? { hint: this.hint } : {}
+      }
+    };
+  }
+};
+
+// src/signals.ts
+var installed = false;
+var activeController = null;
+function installSignalHandlers() {
+  if (installed) return;
+  installed = true;
+  const abortAndExit = (signal) => {
+    activeController?.abort(
+      new MushiCliError(
+        "E_INTERRUPTED",
+        `aborted by ${signal}`,
+        "partial state on the server is safe to retry \u2014 re-run the same command"
+      )
+    );
+    const code = signal === "SIGINT" ? 130 : signal === "SIGTERM" ? 143 : 1;
+    process.nextTick(() => {
+      process.exit(code);
+    });
+  };
+  process.on("SIGINT", () => abortAndExit("SIGINT"));
+  process.on("SIGTERM", () => abortAndExit("SIGTERM"));
+}
+function getAbortSignal(external) {
+  if (external) return external.signal;
+  if (!activeController || activeController.signal.aborted) {
+    activeController = new AbortController();
+  }
+  return activeController.signal;
+}
+
+// src/version.ts
+var MUSHI_CLI_VERSION = true ? "0.20.0" : "0.0.0-dev";
+
 // src/init.ts
 import * as p from "@clack/prompts";
 import { spawn } from "child_process";
@@ -29,342 +119,382 @@ import { randomUUID } from "crypto";
 import { appendFileSync, existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
 import { join as join3 } from "path";
 
-// src/detect.ts
-import { readFileSync, existsSync } from "fs";
-import { join } from "path";
-var FRAMEWORKS = {
-  next: {
-    id: "next",
-    label: "Next.js",
-    packageName: "@mushi-mushi/react",
-    needsWebPackage: false,
-    snippet: () => `// app/providers.tsx (or pages/_app.tsx for /pages router)
-'use client'
-import { MushiProvider } from '@mushi-mushi/react'
-
-export function Providers({ children }: { children: React.ReactNode }) {
-  return (
-    <MushiProvider config={{
-      projectId: process.env.NEXT_PUBLIC_MUSHI_PROJECT_ID!,
-      apiKey: process.env.NEXT_PUBLIC_MUSHI_API_KEY!,
-    }}>
-      {children}
-    </MushiProvider>
-  )
-}`
-  },
-  react: {
-    id: "react",
-    label: "React",
-    packageName: "@mushi-mushi/react",
-    needsWebPackage: false,
-    snippet: () => `// src/main.tsx
-import { MushiProvider } from '@mushi-mushi/react'
-
-createRoot(document.getElementById('root')!).render(
-  <MushiProvider config={{
-    projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
-    apiKey: import.meta.env.VITE_MUSHI_API_KEY,
-  }}>
-    <App />
-  </MushiProvider>
-)`
-  },
-  vue: {
-    id: "vue",
-    label: "Vue 3",
-    packageName: "@mushi-mushi/vue",
-    needsWebPackage: false,
-    snippet: () => `// src/main.ts
-import { MushiPlugin } from '@mushi-mushi/vue'
-
-app.use(MushiPlugin, {
-  projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
-  apiKey: import.meta.env.VITE_MUSHI_API_KEY,
-})`
-  },
-  nuxt: {
-    id: "nuxt",
-    label: "Nuxt",
-    packageName: "@mushi-mushi/vue",
-    needsWebPackage: false,
-    snippet: () => `// plugins/mushi.client.ts
-import { MushiPlugin } from '@mushi-mushi/vue'
-
-export default defineNuxtPlugin((nuxtApp) => {
-  nuxtApp.vueApp.use(MushiPlugin, {
-    projectId: import.meta.env.NUXT_PUBLIC_MUSHI_PROJECT_ID,
-    apiKey: import.meta.env.NUXT_PUBLIC_MUSHI_API_KEY,
-  })
-})`
-  },
-  svelte: {
-    id: "svelte",
-    label: "Svelte",
-    packageName: "@mushi-mushi/svelte",
-    needsWebPackage: false,
-    snippet: () => `// src/main.ts
-import { initMushi } from '@mushi-mushi/svelte'
-
-initMushi({
-  projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
-  apiKey: import.meta.env.VITE_MUSHI_API_KEY,
-})`
-  },
-  sveltekit: {
-    id: "sveltekit",
-    label: "SvelteKit",
-    packageName: "@mushi-mushi/svelte",
-    needsWebPackage: false,
-    snippet: () => `// src/routes/+layout.svelte
-<script>
-  import { onMount } from 'svelte'
-
-  onMount(async () => {
-    const { initMushi } = await import('@mushi-mushi/svelte')
-    initMushi({
-      projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
-      apiKey: import.meta.env.VITE_MUSHI_API_KEY,
-    })
-  })
-</script>`
-  },
-  angular: {
-    id: "angular",
-    label: "Angular",
-    packageName: "@mushi-mushi/angular",
-    needsWebPackage: false,
-    snippet: () => `// src/main.ts
-import { provideMushi } from '@mushi-mushi/angular'
-
-bootstrapApplication(AppComponent, {
-  providers: [
-    provideMushi({
-      projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
-      apiKey: import.meta.env.VITE_MUSHI_API_KEY,
-    }),
-  ],
-})`
-  },
-  expo: {
-    id: "expo",
-    label: "Expo",
-    packageName: "@mushi-mushi/react-native",
-    needsWebPackage: false,
-    snippet: () => `// App.tsx
-import { MushiProvider } from '@mushi-mushi/react-native'
-
-export default function App() {
-  return (
-    <MushiProvider
-      projectId={process.env.EXPO_PUBLIC_MUSHI_PROJECT_ID!}
-      apiKey={process.env.EXPO_PUBLIC_MUSHI_API_KEY!}
-    >
-      <YourApp />
-    </MushiProvider>
-  )
-}`
-  },
-  "react-native": {
-    id: "react-native",
-    label: "React Native",
-    packageName: "@mushi-mushi/react-native",
-    needsWebPackage: false,
-    snippet: () => `// App.tsx
-import { MushiProvider } from '@mushi-mushi/react-native'
-
-export default function App() {
-  return (
-    <MushiProvider
-      projectId={process.env.MUSHI_PROJECT_ID!}
-      apiKey={process.env.MUSHI_API_KEY!}
-    >
-      <YourApp />
-    </MushiProvider>
-  )
-}`
-  },
-  capacitor: {
-    id: "capacitor",
-    label: "Capacitor (Ionic)",
-    packageName: "@mushi-mushi/capacitor",
-    needsWebPackage: false,
-    /* The Capacitor plugin's public API is `Mushi.configure(...)`, not
-     * `Mushi.init(...)` — see packages/capacitor/src/definitions.ts. We
-     * shipped the wrong call here for two releases and users got a runtime
-     * `TypeError: Mushi.init is not a function`. The accompanying admin
-     * console snippet (apps/admin/src/lib/sdkSnippets.ts) emits the same
-     * `Mushi.configure(...)` shape; both are pinned by tests. */
-    snippet: () => `// src/main.ts \u2014 after install, run \`npx cap sync\`
-import { Mushi } from '@mushi-mushi/capacitor'
-
-await Mushi.configure({
-  projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
-  apiKey: import.meta.env.VITE_MUSHI_API_KEY,
-})`
-  },
-  express: {
-    id: "express",
-    label: "Express",
-    packageName: "@mushi-mushi/node",
-    needsWebPackage: false,
-    snippet: () => `// src/instrument.ts \u2014 load with: node --import ./dist/instrument.js
-import { MushiNodeClient, attachUnhandledHook } from '@mushi-mushi/node'
-import { mushiExpressErrorHandler } from '@mushi-mushi/node/express'
-import type { Express } from 'express'
-
-export const mushi = new MushiNodeClient({
-  projectId: process.env.MUSHI_PROJECT_ID!,
-  apiKey: process.env.MUSHI_API_KEY!,
-  environment: process.env.NODE_ENV ?? 'production',
-})
-attachUnhandledHook({ client: mushi })
-
-export function attachMushi(app: Express) {
-  app.use(mushiExpressErrorHandler({ client: mushi }))
-}`
-  },
-  fastify: {
-    id: "fastify",
-    label: "Fastify",
-    packageName: "@mushi-mushi/node",
-    needsWebPackage: false,
-    snippet: () => `// src/instrument.ts \u2014 load with: node --import ./dist/instrument.js
-import { MushiNodeClient, attachUnhandledHook } from '@mushi-mushi/node'
-import { mushiFastifyPlugin } from '@mushi-mushi/node/fastify'
-import Fastify from 'fastify'
-
-export const mushi = new MushiNodeClient({
-  projectId: process.env.MUSHI_PROJECT_ID!,
-  apiKey: process.env.MUSHI_API_KEY!,
-  environment: process.env.NODE_ENV ?? 'production',
-})
-attachUnhandledHook({ client: mushi })
-
-const app = Fastify()
-mushiFastifyPlugin(app, { client: mushi })`
-  },
-  hono: {
-    id: "hono",
-    label: "Hono",
-    packageName: "@mushi-mushi/node",
-    needsWebPackage: false,
-    snippet: () => `// src/instrument.ts \u2014 load with: node --import ./dist/instrument.js
-import { MushiNodeClient, attachUnhandledHook } from '@mushi-mushi/node'
-import { mushiHonoErrorHandler } from '@mushi-mushi/node/hono'
-import { Hono } from 'hono'
-
-export const mushi = new MushiNodeClient({
-  projectId: process.env.MUSHI_PROJECT_ID!,
-  apiKey: process.env.MUSHI_API_KEY!,
-  environment: process.env.NODE_ENV ?? 'production',
-})
-attachUnhandledHook({ client: mushi })
-
-const app = new Hono()
-app.onError(
-  mushiHonoErrorHandler({ client: mushi }, (err, c) =>
-    c.text('Internal Server Error', 500),
-  ),
-)`
-  },
-  vanilla: {
-    id: "vanilla",
-    label: "Vanilla JS / unknown",
-    packageName: "@mushi-mushi/web",
-    needsWebPackage: false,
-    snippet: () => `// Anywhere in your client bundle
-import { Mushi } from '@mushi-mushi/web'
-
-Mushi.init({
-  projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
-  apiKey: import.meta.env.VITE_MUSHI_API_KEY,
-})`
+// src/console-url.ts
+import { existsSync, readFileSync } from "fs";
+import { dirname, join } from "path";
+var HOSTED_CONSOLE_BASE = "https://kensaur.us/mushi-mushi/admin";
+var LOCAL_ADMIN_URL = "http://localhost:6464";
+var LOCAL_PROBE_MS = 800;
+function normalizeConsoleBase(url) {
+  const trimmed = url.trim();
+  let end = trimmed.length;
+  while (end > 0 && trimmed.charCodeAt(end - 1) === 47) end--;
+  return trimmed.slice(0, end);
+}
+function consoleUrl(base, route) {
+  const normalizedRoute = route.startsWith("/") ? route : `/${route}`;
+  return `${normalizeConsoleBase(base)}${normalizedRoute}`;
+}
+function resolveConsoleUrlFromEnv() {
+  const raw = process.env["MUSHI_CONSOLE_URL"]?.trim();
+  return raw ? normalizeConsoleBase(raw) : void 0;
+}
+function isInsideMushiMonorepo(cwd) {
+  let dir = cwd;
+  for (let depth = 0; depth < 14; depth += 1) {
+    const pkgPath = join(dir, "package.json");
+    if (existsSync(pkgPath)) {
+      try {
+        const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+        if (pkg.name === "mushi-mushi") return true;
+      } catch {
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
   }
-};
-function readPackageJson(cwd) {
-  const path = join(cwd, "package.json");
-  if (!existsSync(path)) return null;
+  return false;
+}
+async function probeLocalAdminConsole() {
   try {
-    return JSON.parse(readFileSync(path, "utf-8"));
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), LOCAL_PROBE_MS);
+    const res = await fetch(LOCAL_ADMIN_URL, {
+      signal: controller.signal,
+      method: "HEAD"
+    });
+    clearTimeout(timer);
+    if (res.ok || res.status === 404 || res.status === 401) {
+      return LOCAL_ADMIN_URL;
+    }
   } catch {
-    return null;
   }
+  return null;
+}
+function resolveConsoleUrlSync(cwd = process.cwd()) {
+  const fromEnv = resolveConsoleUrlFromEnv();
+  if (fromEnv) return fromEnv;
+  const config = loadConfig();
+  if (config.consoleUrl) return normalizeConsoleBase(config.consoleUrl);
+  if (isInsideMushiMonorepo(cwd)) return LOCAL_ADMIN_URL;
+  return HOSTED_CONSOLE_BASE;
+}
+async function resolveConsoleUrl(options) {
+  const fromEnv = resolveConsoleUrlFromEnv();
+  if (fromEnv) return fromEnv;
+  const config = loadConfig();
+  if (config.consoleUrl) return normalizeConsoleBase(config.consoleUrl);
+  const local = await probeLocalAdminConsole();
+  if (local) return local;
+  const cwd = options?.cwd ?? process.cwd();
+  if (isInsideMushiMonorepo(cwd)) return LOCAL_ADMIN_URL;
+  return HOSTED_CONSOLE_BASE;
+}
+function projectIdHint(base) {
+  return `Where to find it: ${consoleUrl(base, "/projects")} \u2192 select your project \u2192 click the UUID chip to copy (or copy it from the panel right after you create the project).`;
+}
+function apiKeyHint(base) {
+  return `Where to find it: ${consoleUrl(base, "/onboarding?tab=verify")} \u2192 Generate API key (SDK ingest needs report:write \u2014 not Settings \u2192 BYOK keys). Treat it like a password \u2014 env file only, never commit.`;
+}
+function cliSetupDeepLink(base) {
+  return consoleUrl(base, "/onboarding?tab=steps&setup=cli");
+}
+function reportsUrl(base, reportId) {
+  return reportId ? consoleUrl(base, `/reports/${reportId}`) : consoleUrl(base, "/reports");
+}
+async function openInBrowser(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    return;
+  }
+  const safeUrl = parsed.toString();
+  const { spawn: spawn2 } = await import("child_process");
+  const [command, args] = process.platform === "win32" ? (
+    // Open via rundll32's FileProtocolHandler rather than `cmd /c start`.
+    // `start` is a cmd builtin, so the URL would be re-parsed by cmd.exe and
+    // characters like `&` / `|` / `^` could still break out — exactly the
+    // injection surface CodeQL flags. rundll32 never invokes a shell: the URL
+    // is handed to the default browser as one opaque argument.
+    ["rundll32", ["url.dll,FileProtocolHandler", safeUrl]]
+  ) : process.platform === "darwin" ? ["open", [safeUrl]] : ["xdg-open", [safeUrl]];
+  await new Promise((resolve3) => {
+    try {
+      const child = spawn2(command, [...args], { stdio: "ignore", shell: false });
+      child.on("error", () => resolve3());
+      child.on("exit", () => resolve3());
+      child.unref();
+    } catch {
+      resolve3();
+    }
+  });
+}
+
+// src/cli-shared.ts
+var API_TIMEOUT_MS = 15e3;
+async function apiCall(path, config, options = {}) {
+  const endpoint = config.endpoint;
+  if (!endpoint) {
+    return {
+      ok: false,
+      error: {
+        code: "NO_ENDPOINT",
+        message: "No API endpoint configured.\n  Run: mushi login --api-key <key> --endpoint <url> --project-id <id>\n  Or:  export MUSHI_API_ENDPOINT=https://<project-ref>.supabase.co/functions/v1/api"
+      }
+    };
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), API_TIMEOUT_MS);
+  const signals = [controller.signal, getAbortSignal()];
+  const compositeSignal = AbortSignal.any ? AbortSignal.any(signals) : controller.signal;
+  try {
+    const res = await fetch(`${endpoint}${path}`, {
+      ...options,
+      signal: compositeSignal,
+      headers: {
+        "Content-Type": "application/json",
+        // `apiKeyAuth` reads X-Mushi-Api-Key; the Authorization header is a
+        // fallback accepted by some older middleware. Both are sent.
+        "Authorization": `Bearer ${config.apiKey ?? ""}`,
+        "X-Mushi-Api-Key": config.apiKey ?? "",
+        "X-Mushi-Project": config.projectId ?? "",
+        "X-Mushi-Cli-Version": MUSHI_CLI_VERSION,
+        ...options.headers
+      }
+    });
+    clearTimeout(timer);
+    let body;
+    const contentType = res.headers.get("content-type") ?? "";
+    if (contentType.includes("application/json")) {
+      try {
+        body = await res.json();
+      } catch {
+        body = null;
+      }
+    } else {
+      const text2 = await res.text();
+      try {
+        body = JSON.parse(text2);
+      } catch {
+        body = {
+          ok: false,
+          error: {
+            code: `HTTP_${res.status}`,
+            message: text2.trim().slice(0, 300) || `HTTP ${res.status}`
+          }
+        };
+      }
+    }
+    if (!res.ok && typeof body === "object" && body !== null && !("ok" in body)) {
+      const b = body;
+      return {
+        ok: false,
+        httpStatus: res.status,
+        error: {
+          code: b["code"] ?? `HTTP_${res.status}`,
+          message: b["message"] ?? `Request failed (${res.status})`
+        }
+      };
+    }
+    return body;
+  } catch (err) {
+    clearTimeout(timer);
+    if (err instanceof Error && err.name === "AbortError") {
+      return {
+        ok: false,
+        error: {
+          code: "TIMEOUT",
+          message: `Request timed out after ${API_TIMEOUT_MS / 1e3}s. Check your network or endpoint.`
+        }
+      };
+    }
+    return {
+      ok: false,
+      error: {
+        code: "NETWORK_ERROR",
+        message: err instanceof Error ? err.message : String(err)
+      }
+    };
+  }
+}
+function die(result, exitCode = 1) {
+  const { code, message } = result.error;
+  const status = result.httpStatus ? ` [${result.httpStatus}]` : "";
+  process.stderr.write(`error${status}: ${code} \u2014 ${message}
+`);
+  process.exit(exitCode);
 }
-function detectFramework(cwd, pkg) {
-  const deps = collectDeps(pkg);
-  if (deps.has("next")) return FRAMEWORKS.next;
-  if (deps.has("nuxt")) return FRAMEWORKS.nuxt;
-  if (deps.has("@sveltejs/kit")) return FRAMEWORKS.sveltekit;
-  if (deps.has("@angular/core")) return FRAMEWORKS.angular;
-  if (deps.has("expo")) return FRAMEWORKS.expo;
-  if (deps.has("react-native")) return FRAMEWORKS["react-native"];
-  if (deps.has("@capacitor/core") && deps.has("react")) return FRAMEWORKS.react;
-  if (deps.has("@capacitor/core")) return FRAMEWORKS.capacitor;
-  if (deps.has("svelte")) return FRAMEWORKS.svelte;
-  if (deps.has("vue")) return FRAMEWORKS.vue;
-  if (deps.has("react")) return FRAMEWORKS.react;
-  if (deps.has("express")) return FRAMEWORKS.express;
-  if (deps.has("fastify")) return FRAMEWORKS.fastify;
-  if (deps.has("hono") || deps.has("@hono/hono")) return FRAMEWORKS.hono;
-  if (existsSync(join(cwd, "next.config.js")) || existsSync(join(cwd, "next.config.ts"))) {
-    return FRAMEWORKS.next;
+function requireConfig(opts = {}) {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    process.stderr.write(
+      "error: API key not configured.\n  Run:  mushi login --api-key <key>\n  Or:   export MUSHI_API_KEY=<key>\n"
+    );
+    process.exit(2);
   }
-  if (existsSync(join(cwd, "nuxt.config.ts")) || existsSync(join(cwd, "nuxt.config.js"))) {
-    return FRAMEWORKS.nuxt;
+  if (!config.endpoint) {
+    config.endpoint = process.env.MUSHI_API_ENDPOINT?.trim() || CLOUD_API_ENDPOINT;
   }
-  if (existsSync(join(cwd, "svelte.config.js"))) return FRAMEWORKS.svelte;
-  if (existsSync(join(cwd, "angular.json"))) return FRAMEWORKS.angular;
-  return FRAMEWORKS.vanilla;
+  if (opts.needsProject && !config.projectId) {
+    process.stderr.write(
+      "error: Project ID not configured.\n  Run:  mushi login --project-id <uuid>\n  Or:   export MUSHI_PROJECT_ID=<uuid>\n  Find your project ID: " + consoleUrl(resolveConsoleUrlSync(), "/projects") + "\n"
+    );
+    process.exit(2);
+  }
+  return config;
 }
-function detectPackageManager(cwd) {
-  if (existsSync(join(cwd, "bun.lockb")) || existsSync(join(cwd, "bun.lock"))) return "bun";
-  if (existsSync(join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync(join(cwd, "yarn.lock"))) return "yarn";
-  if (existsSync(join(cwd, "package-lock.json"))) return "npm";
-  const userAgent = process.env.npm_config_user_agent ?? "";
-  if (userAgent.startsWith("bun")) return "bun";
-  if (userAgent.startsWith("pnpm")) return "pnpm";
-  if (userAgent.startsWith("yarn")) return "yarn";
-  return "npm";
+function fmtDate(iso) {
+  if (!iso) return "\u2014";
+  return new Date(iso).toLocaleString(void 0, { dateStyle: "short", timeStyle: "short" });
 }
-function installCommand(pm, packages) {
-  const verb = pm === "npm" ? "install" : "add";
-  return `${pm} ${verb} ${packages.join(" ")}`;
+function pad(s, width) {
+  return s.length >= width ? s : s + " ".repeat(width - s.length);
 }
-var SERVER_FRAMEWORK_IDS = /* @__PURE__ */ new Set(["express", "fastify", "hono"]);
-function envVarsToWrite(apiKey, projectId, framework) {
-  if (SERVER_FRAMEWORK_IDS.has(framework.id)) {
-    return [
-      `MUSHI_PROJECT_ID=${projectId}`,
-      `MUSHI_API_KEY=${apiKey}`
-    ].join("\n");
+
+// src/device-auth.ts
+var DEVICE_FETCH_TIMEOUT_MS = 15e3;
+function trimTrailingSlash(endpoint) {
+  let end = endpoint.length;
+  while (end > 0 && endpoint.charCodeAt(end - 1) === 47) end--;
+  return endpoint.slice(0, end);
+}
+async function deviceFetch(url, init = {}) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), DEVICE_FETCH_TIMEOUT_MS);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
   }
-  if (framework.id === "react-native") {
-    return [
-      `MUSHI_PROJECT_ID=${projectId}`,
-      `MUSHI_API_KEY=${apiKey}`
-    ].join("\n");
+}
+async function startDeviceAuth(endpoint) {
+  const base = trimTrailingSlash(endpoint);
+  const res = await deviceFetch(`${base}/v1/cli/auth/device/start`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" }
+  });
+  const json = await res.json().catch(() => null);
+  if (!res.ok || !json?.ok || !json.data) {
+    throw new Error(json?.error?.message ?? `Could not start browser sign-in (HTTP ${res.status}).`);
   }
-  if (framework.id === "expo") {
-    return [
-      `EXPO_PUBLIC_MUSHI_PROJECT_ID=${projectId}`,
-      `EXPO_PUBLIC_MUSHI_API_KEY=${apiKey}`
-    ].join("\n");
+  return json.data;
+}
+async function pollDeviceToken(endpoint, deviceCode) {
+  const base = trimTrailingSlash(endpoint);
+  try {
+    const res = await deviceFetch(`${base}/v1/cli/auth/device/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ device_code: deviceCode })
+    });
+    const json = await res.json().catch(() => ({}));
+    if (res.ok && json.ok && json.data?.cli_token) {
+      return { status: "approved", cliToken: json.data.cli_token, userId: json.data.user_id };
+    }
+    switch (json.error) {
+      case "authorization_pending":
+        return { status: "pending" };
+      case "access_denied":
+        return { status: "denied" };
+      case "expired_token":
+        return { status: "expired" };
+      default:
+        return {
+          status: "error",
+          message: json.error_description ?? json.error ?? `HTTP ${res.status}`,
+          // 5xx is a server hiccup the next poll may clear; a 4xx is a definitive
+          // rejection (already claimed / invalid_grant) that won't fix itself.
+          retryable: res.status >= 500
+        };
+    }
+  } catch (err) {
+    return { status: "error", message: err instanceof Error ? err.message : String(err), retryable: true };
   }
-  const prefix = framework.id === "next" ? "NEXT_PUBLIC_" : framework.id === "nuxt" ? "NUXT_PUBLIC_" : "VITE_";
-  return [
-    `${prefix}MUSHI_PROJECT_ID=${projectId}`,
-    `${prefix}MUSHI_API_KEY=${apiKey}`
-  ].join("\n");
 }
-function collectDeps(pkg) {
-  if (!pkg) return /* @__PURE__ */ new Set();
-  return /* @__PURE__ */ new Set([
-    ...Object.keys(pkg.dependencies ?? {}),
-    ...Object.keys(pkg.devDependencies ?? {}),
-    ...Object.keys(pkg.peerDependencies ?? {})
-  ]);
+var defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function waitForCliToken(endpoint, session, opts = {}) {
+  const sleep = opts.sleep ?? defaultSleep;
+  const now = opts.now ?? Date.now;
+  const intervalMs = (session.interval || 5) * 1e3;
+  const deadline = now() + (session.expires_in || 600) * 1e3;
+  const maxConsecutiveErrors = opts.maxConsecutiveErrors ?? 5;
+  let consecutiveErrors = 0;
+  while (now() < deadline) {
+    await sleep(intervalMs);
+    const outcome = await pollDeviceToken(endpoint, session.device_code);
+    switch (outcome.status) {
+      case "approved":
+        return outcome.cliToken;
+      case "pending":
+        consecutiveErrors = 0;
+        opts.onPending?.();
+        continue;
+      case "denied":
+        throw new Error("Login was denied in the browser.");
+      case "expired":
+        throw new Error("The login code expired. Run sign-in again.");
+      case "error":
+        if (!outcome.retryable) {
+          throw new Error(outcome.message);
+        }
+        consecutiveErrors += 1;
+        if (consecutiveErrors >= maxConsecutiveErrors) {
+          throw new Error(outcome.message);
+        }
+        opts.onTransientError?.(outcome.message, consecutiveErrors);
+        continue;
+    }
+  }
+  throw new Error("Login timed out before approval. Run sign-in again.");
+}
+function cliAuthHeaders(cliToken) {
+  return {
+    "Content-Type": "application/json",
+    Authorization: `Bearer ${cliToken}`
+  };
+}
+async function listProjects(endpoint, cliToken) {
+  const base = trimTrailingSlash(endpoint);
+  try {
+    const res = await deviceFetch(`${base}/v1/cli/projects`, { headers: cliAuthHeaders(cliToken) });
+    const json = await res.json().catch(() => null);
+    if (res.ok && json?.ok) return json.data?.projects ?? [];
+  } catch {
+  }
+  return [];
+}
+async function createProject(endpoint, cliToken, name) {
+  const base = trimTrailingSlash(endpoint);
+  const res = await deviceFetch(`${base}/v1/cli/projects`, {
+    method: "POST",
+    headers: cliAuthHeaders(cliToken),
+    body: JSON.stringify({ name })
+  });
+  const json = await res.json().catch(() => null);
+  if (!res.ok || !json?.ok || !json.data) {
+    throw new Error(json?.error?.message ?? `Could not create project (HTTP ${res.status}).`);
+  }
+  const { id, name: created, slug, apiKey } = json.data;
+  return { id, name: created, slug, apiKey: apiKey ?? null };
+}
+async function mintProjectKey(endpoint, cliToken, projectId) {
+  const base = trimTrailingSlash(endpoint);
+  try {
+    const res = await deviceFetch(`${base}/v1/cli/projects/${projectId}/keys`, {
+      method: "POST",
+      headers: cliAuthHeaders(cliToken),
+      body: JSON.stringify({})
+    });
+    const json = await res.json().catch(() => null);
+    if (res.ok && json?.ok) return json.data?.key ?? null;
+  } catch {
+  }
+  return null;
 }
 
 // src/freshness.ts
@@ -428,7 +558,7 @@ function parse(version) {
 
 // src/monorepo.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2, readdirSync, statSync } from "fs";
-import { dirname, join as join2, resolve } from "path";
+import { dirname as dirname2, join as join2, resolve } from "path";
 var WORKSPACE_GLOB_CANDIDATES = ["apps/*", "packages/*", "examples/*"];
 var FRAMEWORK_DEPS = {
   next: "Next.js",
@@ -456,7 +586,7 @@ function findWorkspaceRoot(start) {
   let dir = resolve(start);
   for (let i = 0; i < 8; i++) {
     if (isWorkspaceRoot(dir)) return dir;
-    const parent = dirname(dir);
+    const parent = dirname2(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -547,7 +677,10 @@ async function runInit(options = {}) {
   }
   const detected = detectFramework(cwd, pkg);
   const framework = await chooseFramework(detected, options);
-  const credentials = await collectCredentials(options);
+  const consoleBase = await resolveConsoleUrl({ cwd });
+  const endpoint = resolveCloudEndpoint(options.endpoint);
+  const credentials = await acquireCredentials(options, consoleBase, endpoint);
+  await verifyCredentials(credentials, options, consoleBase);
   const pm = detectPackageManager(cwd);
   const packagesToInstall = framework.needsWebPackage ? [framework.packageName, "@mushi-mushi/web"] : [framework.packageName];
   if (!options.skipInstall) {
@@ -555,12 +688,12 @@ async function runInit(options = {}) {
   } else {
     p.log.info(`Skipped install. Run \`${installCommand(pm, packagesToInstall)}\` yourself.`);
   }
-  const endpoint = resolveCloudEndpoint(options.endpoint);
   writeEnvFile(cwd, credentials.apiKey, credentials.projectId, framework);
   persistCliConfig(credentials.apiKey, credentials.projectId, endpoint);
   const enableRewards = await maybeEnableRewards(options);
-  printNextSteps(framework, credentials.apiKey, credentials.projectId, enableRewards);
-  await maybeSendTestReport(credentials, { ...options, endpoint });
+  printNextSteps(framework, consoleBase, enableRewards);
+  await maybeSendTestReport(credentials, { ...options, endpoint, consoleBase });
+  await maybeOfferConnect(credentials, options, consoleBase);
   p.outro("Setup complete. Happy bug squashing \u{1F41B}");
 }
 function ensureInteractiveOrBailOut(options) {
@@ -601,25 +734,165 @@ async function chooseFramework(detected, options) {
   }
   return FRAMEWORKS[confirmed];
 }
-async function collectCredentials(options) {
+async function acquireCredentials(options, consoleBase, endpoint) {
+  if (options.projectId && options.apiKey) {
+    return {
+      projectId: sanitizeSecret(options.projectId),
+      apiKey: sanitizeSecret(options.apiKey)
+    };
+  }
+  const existing = loadConfig();
+  if (!options.projectId && !options.apiKey && existing.projectId && existing.apiKey) {
+    const reuse = options.yes ? true : await p.confirm({
+      message: "Use the Mushi credentials saved from your last sign-in?",
+      initialValue: true
+    });
+    if (p.isCancel(reuse)) {
+      p.cancel("Aborted.");
+      process.exit(0);
+    }
+    if (reuse) {
+      return {
+        projectId: sanitizeSecret(existing.projectId),
+        apiKey: sanitizeSecret(existing.apiKey)
+      };
+    }
+  }
+  if (options.yes) {
+    const creds = await runBrowserSignIn(options, endpoint);
+    if (creds) return creds;
+    p.log.warn("Browser sign-in didn't complete \u2014 switching to manual entry.");
+  } else {
+    const method = await p.select({
+      message: "Connect this app to Mushi",
+      initialValue: "browser",
+      options: [
+        {
+          value: "browser",
+          label: "Sign in with your browser",
+          hint: "Recommended \u2014 no copy-paste, creates the project + key for you"
+        },
+        {
+          value: "manual",
+          label: "Paste a Project ID + API key",
+          hint: "Self-hosted or expert setup"
+        }
+      ]
+    });
+    if (p.isCancel(method)) {
+      p.cancel("Aborted.");
+      process.exit(0);
+    }
+    if (method === "browser") {
+      const creds = await runBrowserSignIn(options, endpoint);
+      if (creds) return creds;
+      p.log.warn("Browser sign-in didn't complete \u2014 switching to manual entry.");
+    }
+  }
+  return collectCredentialsManually(options, consoleBase);
+}
+async function runBrowserSignIn(options, endpoint) {
+  const startSpin = p.spinner();
+  startSpin.start("Starting secure browser sign-in\u2026");
+  let session;
+  try {
+    session = await startDeviceAuth(endpoint);
+  } catch (err) {
+    startSpin.stop("Could not start browser sign-in.");
+    p.log.warn(err instanceof Error ? err.message : String(err));
+    return null;
+  }
+  startSpin.stop("Browser sign-in ready.");
+  p.log.step(`Confirmation code: ${session.user_code}`);
+  p.log.info(`Opening ${session.verification_uri}`);
+  try {
+    await openInBrowser(session.verification_uri);
+  } catch {
+  }
+  p.log.message("Approve the request in your browser to continue. (Ctrl+C to cancel)");
+  const waitSpin = p.spinner();
+  waitSpin.start("Waiting for you to approve in the browser\u2026");
+  let cliToken;
+  try {
+    cliToken = await waitForCliToken(endpoint, session);
+  } catch (err) {
+    waitSpin.stop("Browser sign-in didn't complete.");
+    p.log.warn(err instanceof Error ? err.message : String(err));
+    return null;
+  }
+  waitSpin.stop("Approved.");
+  let projectId = options.projectId ? sanitizeSecret(options.projectId) : void 0;
+  let apiKey;
+  if (!projectId) {
+    let projects = [];
+    try {
+      projects = await listProjects(endpoint, cliToken);
+    } catch {
+    }
+    const NEW = "__new__";
+    const choice = await p.select({
+      message: "Choose a project",
+      initialValue: projects[0]?.id ?? NEW,
+      options: [
+        ...projects.map((pr) => ({ value: pr.id, label: pr.name, hint: pr.id.slice(0, 8) })),
+        { value: NEW, label: "Create a new project", hint: "mints an SDK key automatically" }
+      ]
+    });
+    if (p.isCancel(choice)) {
+      p.cancel("Aborted.");
+      process.exit(0);
+    }
+    if (choice === NEW) {
+      const name = await p.text({
+        message: "Project name",
+        placeholder: "My app",
+        validate: (v) => v && v.trim().length > 0 ? void 0 : "Required"
+      });
+      if (p.isCancel(name)) {
+        p.cancel("Aborted.");
+        process.exit(0);
+      }
+      const createSpin = p.spinner();
+      createSpin.start(`Creating "${name.trim()}"\u2026`);
+      try {
+        const created = await createProject(endpoint, cliToken, name.trim());
+        projectId = created.id;
+        apiKey = created.apiKey ?? void 0;
+        createSpin.stop(`Created project "${created.name}".`);
+      } catch (err) {
+        createSpin.stop("Could not create the project.");
+        p.log.warn(err instanceof Error ? err.message : String(err));
+        return null;
+      }
+    } else {
+      projectId = choice;
+    }
+  }
+  if (projectId && !apiKey) {
+    apiKey = await mintProjectKey(endpoint, cliToken, projectId) ?? void 0;
+  }
+  if (!projectId || !apiKey) return null;
+  return { apiKey, projectId };
+}
+async function collectCredentialsManually(options, consoleBase) {
   const existing = loadConfig();
   const rawProjectId = options.projectId ?? existing.projectId ?? await promptText({
     message: "Project ID",
     placeholder: "e.g. bdafa28d-b153-482f-bd4f-42981f3fd3a4",
-    hint: "Where to find it: https://kensaur.us/mushi-mushi/projects \u2192 click your project \u2192 copy the UUID below the project name.",
-    validate: (v) => PROJECT_ID_PATTERN.test(v.trim()) ? void 0 : "Expected a UUID (e.g. bdafa28d-b153-482f-bd4f-42981f3fd3a4) \u2014 copy it from the Mushi admin console Projects page."
+    hint: projectIdHint(consoleBase),
+    validate: (v) => PROJECT_ID_PATTERN.test(v.trim()) ? void 0 : "Expected a UUID \u2014 copy it from the Projects page or the panel right after you create a project."
   });
   const rawApiKey = options.apiKey ?? existing.apiKey ?? await promptText({
     message: "API key",
     placeholder: "mushi_xxxxxxxxxxxx",
-    hint: "Where to find it: https://kensaur.us/mushi-mushi/settings \u2192 API Keys tab. Treat it like a password \u2014 env file only, never commit it.",
+    hint: apiKeyHint(consoleBase),
     validate: (v) => API_KEY_PATTERN.test(v) ? void 0 : "Expected format: mushi_ followed by 10+ alphanumeric characters"
   });
   const projectId = sanitizeSecret(rawProjectId);
   const apiKey = sanitizeSecret(rawApiKey);
   if (!PROJECT_ID_PATTERN.test(projectId)) {
     throw new Error(
-      `Invalid project ID. Expected a UUID (e.g. bdafa28d-b153-482f-bd4f-42981f3fd3a4) or the proj_* prefixed form. Got: ${redact(projectId)} \u2014 copy it from the Projects page in the Mushi console at https://kensaur.us/mushi-mushi/projects`
+      `Invalid project ID. Expected a UUID (e.g. bdafa28d-b153-482f-bd4f-42981f3fd3a4) or the proj_* prefixed form. Got: ${redact(projectId)} \u2014 copy it from ${projectIdHint(consoleBase)}`
     );
   }
   if (!API_KEY_PATTERN.test(apiKey)) {
@@ -629,6 +902,23 @@ async function collectCredentials(options) {
   }
   return { projectId, apiKey };
 }
+async function verifyCredentials(credentials, options, consoleBase) {
+  const endpoint = resolveCloudEndpoint(options.endpoint);
+  const spinner3 = p.spinner();
+  spinner3.start("Verifying credentials\u2026");
+  const result = await apiCall(
+    "/v1/sync/whoami",
+    { apiKey: credentials.apiKey, projectId: credentials.projectId, endpoint }
+  );
+  if (!result.ok) {
+    spinner3.stop("Credentials could not be verified.");
+    p.log.error(result.error?.message ?? "Authentication failed.");
+    p.log.info(`Double-check values in the console:
+  ${cliSetupDeepLink(consoleBase)}`);
+    throw new Error("Credential verification failed \u2014 fix Project ID / API key and re-run.");
+  }
+  spinner3.stop(`Connected to ${result.data.project_name}`);
+}
 function sanitizeSecret(raw) {
   return raw.trim().replace(/^['"]|['"]$/g, "").replace(/[\r\n\0]/g, "");
 }
@@ -671,7 +961,7 @@ async function installPackages(pm, packages, cwd) {
 function runCommand(pm, packages, cwd) {
   const verb = pm === "npm" ? "install" : "add";
   const command = process.platform === "win32" ? `${pm}.cmd` : pm;
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve3, reject) => {
     const child = spawn(command, [verb, ...packages], {
       stdio: "inherit",
       shell: false,
@@ -680,7 +970,7 @@ function runCommand(pm, packages, cwd) {
     });
     child.on("error", reject);
     child.on("exit", (code) => {
-      if (code === 0) resolve4();
+      if (code === 0) resolve3();
       else reject(new Error(`${pm} exited with code ${code ?? "null"}`));
     });
   });
@@ -738,7 +1028,7 @@ function persistCliConfig(apiKey, projectId, endpoint) {
   const existing = loadConfig();
   saveConfig({ ...existing, apiKey, projectId, endpoint });
 }
-function printNextSteps(framework, _apiKey, _projectId, enableRewards = false) {
+function printNextSteps(framework, consoleBase, enableRewards = false) {
   p.note(framework.snippet(), "Add this to your app:");
   if (enableRewards) {
     const badgeSnippet = framework.id === "react" ? `// Add to your user menu or profile UI:
@@ -749,13 +1039,44 @@ import { MushiRewardsBadge } from '@mushi-mushi/react';
 // import { MushiRewardsBadge } from '@mushi-mushi/react';
 // <MushiRewardsBadge showPoints />`;
     p.note(badgeSnippet, "Rewards badge snippet:");
-    p.log.info("Enable rewards in your project settings at https://kensaur.us/mushi-mushi/rewards");
+    p.log.info(`Enable rewards in your project settings at ${consoleUrl(consoleBase, "/rewards")}`);
     p.log.info("Users will earn points for bug reports, screen navigation, and app activity.");
   }
   p.log.message("Verify the install:");
   p.log.message("  \u2022 Start your dev server");
   p.log.message("  \u2022 Look for the \u{1F41B} button in the bottom-right corner (or shake on mobile)");
-  p.log.message("  \u2022 Submit a test report \u2014 it should appear at https://kensaur.us/mushi-mushi/reports");
+  p.log.message(`  \u2022 Submit a test report \u2014 it should appear at ${reportsUrl(consoleBase)}`);
+  p.log.info(
+    "Tip: `mushi connect --write-env --wire-ide --wait` also wires Cursor MCP and waits for SDK heartbeat."
+  );
+}
+async function maybeOfferConnect(credentials, options, _consoleBase) {
+  if (options.yes) return;
+  const answer = await p.confirm({
+    message: "Run `mushi connect --write-env --wire-ide --wait` now? (SDK env + Cursor MCP + heartbeat check)",
+    initialValue: false
+  });
+  if (p.isCancel(answer) || !answer) return;
+  const endpoint = resolveCloudEndpoint(options.endpoint);
+  try {
+    const { runConnect: runConnect2 } = await import("./connect-W2Q6N7K3.js");
+    await runConnect2({
+      apiKey: credentials.apiKey,
+      projectId: credentials.projectId,
+      endpoint,
+      cwd: options.cwd,
+      writeEnv: true,
+      wireIde: true,
+      wait: true
+    });
+  } catch (err) {
+    p.log.warn(
+      err instanceof Error ? err.message : String(err)
+    );
+    p.log.info(
+      "You can run manually: mushi connect --write-env --wire-ide --wait"
+    );
+  }
 }
 async function maybeEnableRewards(options) {
   if (options.yes) return false;
@@ -826,8 +1147,8 @@ async function maybeSendTestReport(credentials, options) {
       reportId = body.data?.reportId;
     } catch {
     }
-    const reportPath = reportId ? `/reports/${reportId}` : "/reports";
-    p.log.success(`View it at https://kensaur.us/mushi-mushi/admin${reportPath}`);
+    const consoleBase = options.consoleBase ?? resolveConsoleUrlSync(options.cwd);
+    p.log.success(`View it at ${reportsUrl(consoleBase, reportId)}`);
   } catch (err) {
     const aborted = err instanceof Error && err.name === "AbortError";
     spinner3.stop(aborted ? "Timed out reaching the Mushi API." : "Could not reach the Mushi API.");
@@ -1023,78 +1344,189 @@ function registerAccountCommands(program2) {
     const { matches } = runMigrate({ cwd: opts.cwd, json: opts.json });
     if (matches.length === 0) process.exit(1);
   });
-  program2.command("login").description("Authenticate the CLI \u2014 opens browser to get your API key, or pass --api-key to skip").option("--api-key <key>", "Mushi API key (mushi_...) \u2014 skip the browser flow").option("--endpoint <url>", "Supabase edge function URL (defaults to Mushi Cloud)").option("--project-id <id>", "Project UUID \u2014 skip the whoami project-list prompt").option("--no-browser", "Skip opening the browser (print sign-in URL instead)").addHelpText("after", `
+  program2.command("login").description("Authenticate the CLI via browser (zero copy-paste), or pass --api-key to skip").option("--api-key <key>", "API key (mushi_...) \u2014 non-interactive / CI path").option("--endpoint <url>", "Override the Mushi API endpoint (self-hosted)").option("--project-id <id>", "Project UUID \u2014 skip the project picker").option("--no-browser", "Print the verification URL instead of opening the browser").addHelpText("after", `
 Examples:
-  mushi login                         # browser-guided: open console \u2192 paste key
-  mushi login --api-key mushi_xxx     # non-interactive: save key directly
+  mushi login                              # browser-guided (recommended)
+  mushi login --api-key mushi_xxx         # non-interactive / CI
   mushi login --api-key mushi_xxx --project-id <uuid>`).action(async (opts) => {
-    const { CLOUD_API_ENDPOINT, resolveCloudEndpoint: resolveCloudEndpoint2 } = await import("./endpoint-DGS73AVM.js");
-    const { apiCall: apiCall2 } = await import("./cli-shared-XH3XYIS7.js");
-    const endpoint = opts.endpoint ? resolveCloudEndpoint2(opts.endpoint) : CLOUD_API_ENDPOINT;
-    const consoleUrl = "https://kensaur.us/mushi-mushi/projects";
+    const { CLOUD_API_ENDPOINT: CLOUD_API_ENDPOINT2, resolveCloudEndpoint: resolveCloudEndpoint2 } = await import("./endpoint-DGS73AVM.js");
+    const endpoint = opts.endpoint ? resolveCloudEndpoint2(opts.endpoint) : CLOUD_API_ENDPOINT2;
+    const consoleBase = await resolveConsoleUrl();
     let apiKey = opts.apiKey;
     let projectId = opts.projectId;
-    if (!apiKey) {
-      const signInUrl = "https://kensaur.us/mushi-mushi/sign-in";
+    if (apiKey) {
+      const config2 = loadConfig();
+      config2.apiKey = apiKey;
+      config2.endpoint = endpoint;
+      if (projectId) config2.projectId = projectId;
+      config2.consoleUrl = consoleBase;
+      saveConfig(config2);
       console.log("");
-      console.log("  Mushi login \u2014 browser-guided");
-      console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-      if (opts.browser !== false) {
-        console.log("  Opening the Mushi console in your browser\u2026");
-        try {
-          const { exec } = await import("child_process");
-          const openCmd = process.platform === "win32" ? `start "" "${signInUrl}"` : process.platform === "darwin" ? `open "${signInUrl}"` : `xdg-open "${signInUrl}"`;
-          exec(openCmd);
-        } catch {
+      console.log("  \u2713 Credentials saved.");
+      const verifyResult = await apiCall(
+        "/v1/sync/whoami",
+        { apiKey, endpoint, projectId }
+      );
+      if (!verifyResult.ok) {
+        console.warn(`  \u26A0  Key saved, but verification failed: ${verifyResult.error?.message ?? "unknown error"}`);
+        console.warn(`     Check your key at: ${cliSetupDeepLink(consoleBase)}`);
+        return;
+      }
+      const d = verifyResult.data;
+      if (d.project_name) {
+        if (!projectId && d.project_id) {
+          config2.projectId = d.project_id;
+          saveConfig(config2);
         }
-      } else {
-        console.log(`  Sign in at: ${signInUrl}`);
+        console.log(`  \u2713 Project: ${d.project_name} (${d.project_id})`);
+      }
+      console.log(`  \u2713 Endpoint: ${endpoint}`);
+      console.log("");
+      console.log("  Run 'mushi whoami' to verify \xB7 'mushi init' to set up the SDK");
+      return;
+    }
+    console.log("");
+    console.log("  Mushi login");
+    console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    let deviceData;
+    try {
+      deviceData = await startDeviceAuth(endpoint);
+    } catch (err) {
+      process.stderr.write(`
+error: Could not start login session: ${err instanceof Error ? err.message : String(err)}
+`);
+      process.stderr.write(`  Fallback: mushi login --api-key <key> --project-id <uuid>
+`);
+      process.exit(1);
+    }
+    const verifyUrl = deviceData.verification_uri;
+    console.log("");
+    console.log(`  Your confirmation code: ${deviceData.user_code}`);
+    console.log("");
+    if (opts.browser !== false) {
+      console.log("  Opening the Mushi console in your browser\u2026");
+      try {
+        await openInBrowser(verifyUrl);
+      } catch {
+      }
+    }
+    console.log(`  If the browser didn't open: ${verifyUrl}`);
+    console.log("");
+    console.log("  Waiting for you to approve in the browser\u2026  (Ctrl+C to cancel)");
+    let cliToken = null;
+    const pollIntervalMs = (deviceData.interval ?? 5) * 1e3;
+    const deadline = Date.now() + (deviceData.expires_in ?? 600) * 1e3;
+    const MAX_CONSECUTIVE_ERRORS = 5;
+    let consecutiveErrors = 0;
+    while (Date.now() < deadline) {
+      await new Promise((r) => setTimeout(r, pollIntervalMs));
+      const outcome = await pollDeviceToken(endpoint, deviceData.device_code);
+      if (outcome.status === "approved") {
+        cliToken = outcome.cliToken;
+        break;
+      }
+      if (outcome.status === "pending") {
+        consecutiveErrors = 0;
+        process.stdout.write(".");
+        continue;
+      }
+      if (outcome.status === "error") {
+        if (outcome.retryable) {
+          consecutiveErrors += 1;
+          if (consecutiveErrors < MAX_CONSECUTIVE_ERRORS) {
+            process.stdout.write("\xB7");
+            continue;
+          }
+        }
+        console.log("");
+        process.stderr.write(`
+error: ${outcome.message}
+`);
+        process.exit(1);
       }
       console.log("");
-      console.log("  After signing in, go to Projects \u2192 API Keys \u2192 New key");
-      console.log("  then paste the key below.");
+      if (outcome.status === "denied") {
+        process.stderr.write("\nerror: Login denied in the browser.\n");
+      } else if (outcome.status === "expired") {
+        process.stderr.write("\nerror: Login code expired. Run mushi login again.\n");
+      }
+      process.exit(1);
+    }
+    if (!cliToken) {
       console.log("");
+      process.stderr.write("\nerror: Login timed out. Run mushi login again.\n");
+      process.exit(1);
+    }
+    console.log("");
+    console.log("  \u2713 Approved!");
+    const projectsList = await listProjects(endpoint, cliToken);
+    let chosenProjectId = projectId;
+    let chosenProjectName;
+    if (!chosenProjectId) {
       const { createInterface } = await import("readline");
       const rl = createInterface({ input: process.stdin, output: process.stdout });
-      const ask = (q) => new Promise((resolve4) => rl.question(q, (a) => resolve4(a.trim())));
-      apiKey = await ask("  API key (mushi_...): ");
-      if (!projectId) {
-        projectId = await ask(`  Project ID (uuid, or leave blank to list projects): `);
-        if (!projectId) projectId = void 0;
+      const ask = (q) => new Promise((resolve3) => rl.question(q, (a) => resolve3(a.trim())));
+      if (projectsList.length > 0) {
+        console.log("");
+        console.log("  Your projects:");
+        projectsList.forEach((p3, i) => {
+          console.log(`    ${i + 1}. ${p3.name} (${p3.id})`);
+        });
+        console.log(`    ${projectsList.length + 1}. Create a new project`);
+        console.log("");
+        const choice = await ask(`  Pick a project [1-${projectsList.length + 1}]: `);
+        const num = parseInt(choice, 10);
+        if (num >= 1 && num <= projectsList.length) {
+          const picked = projectsList[num - 1];
+          chosenProjectId = picked.id;
+          chosenProjectName = picked.name;
+        }
       }
-      rl.close();
-      if (!apiKey) {
-        process.stderr.write("\nerror: API key is required.\n");
-        process.exit(2);
+      if (!chosenProjectId) {
+        console.log("");
+        const newName = await ask("  Project name: ");
+        rl.close();
+        if (!newName.trim()) {
+          process.stderr.write("\nerror: Project name is required.\n");
+          process.exit(2);
+        }
+        try {
+          const created = await createProject(endpoint, cliToken, newName.trim());
+          chosenProjectId = created.id;
+          chosenProjectName = created.name;
+          apiKey = created.apiKey ?? void 0;
+          console.log(`  \u2713 Created project "${chosenProjectName}"`);
+        } catch (err) {
+          process.stderr.write(`
+error: Could not create project: ${err instanceof Error ? err.message : String(err)}
+`);
+          process.exit(1);
+        }
+      } else {
+        rl.close();
+      }
+    }
+    if (!apiKey && chosenProjectId) {
+      try {
+        apiKey = await mintProjectKey(endpoint, cliToken, chosenProjectId) ?? void 0;
+      } catch {
       }
     }
     const config = loadConfig();
-    config.apiKey = apiKey;
     config.endpoint = endpoint;
-    if (projectId) config.projectId = projectId;
+    config.consoleUrl = consoleBase;
+    if (chosenProjectId) config.projectId = chosenProjectId;
+    if (apiKey) config.apiKey = apiKey;
     saveConfig(config);
     console.log("");
-    console.log("  \u2713 Credentials saved to ~/.config/mushi/config.json");
-    const verifyResult = await apiCall2(
-      "/v1/sync/whoami",
-      { apiKey, endpoint, projectId }
-    );
-    if (!verifyResult.ok) {
-      console.warn(`  \u26A0  Key saved, but verification failed: ${verifyResult.error?.message ?? "unknown error"}`);
-      console.warn(`     Check your key at: ${consoleUrl}`);
-      return;
-    }
-    const d = verifyResult.data;
-    if (!projectId && d.project_id) {
-      config.projectId = d.project_id;
-      saveConfig(config);
-      console.log(`  \u2713 Project: ${d.project_name} (${d.project_id})`);
-    } else if (d.project_name) {
-      console.log(`  \u2713 Project: ${d.project_name} (${d.project_id})`);
+    if (chosenProjectName) console.log(`  \u2713 Project: ${chosenProjectName}`);
+    if (apiKey) {
+      console.log(`  \u2713 SDK key saved (${apiKey.slice(0, 12)}\u2026)`);
+    } else {
+      console.log(`  \u2139  Get an SDK key at: ${apiKeyHint(consoleBase)}`);
     }
-    console.log(`  \u2713 Endpoint: ${endpoint}`);
     console.log("");
-    console.log("  Run 'mushi whoami' to verify \xB7 'mushi init' to set up the SDK");
+    console.log("  Run 'mushi init' to set up the SDK in this project.");
   });
   program2.command("whoami").description("Verify API key and display project info").option("--json", "Machine-readable JSON output").addHelpText("after", `
 Verifies that MUSHI_API_KEY is valid and shows which project it belongs to.
@@ -1617,7 +2049,7 @@ AI code review context.
 Typical CI usage:
   MUSHI_API_KEY=$KEY MUSHI_PROJECT_ID=$PID MUSHI_API_ENDPOINT=$URL \\
     npx @mushi-mushi/cli sync-lessons --cwd .`).action(async (opts) => {
-    const { writeFile: writeFile3, mkdir: mkdir2 } = await import("fs/promises");
+    const { writeFile, mkdir } = await import("fs/promises");
     const nodePath = await import("path");
     const config = requireConfig();
     const cwd = opts.cwd ?? process.cwd();
@@ -1644,8 +2076,8 @@ Typical CI usage:
       console.log(JSON.stringify(output, null, 2));
       return;
     }
-    await mkdir2(nodePath.dirname(target), { recursive: true });
-    await writeFile3(target, JSON.stringify(output, null, 2) + "\n", "utf8");
+    await mkdir(nodePath.dirname(target), { recursive: true });
+    await writeFile(target, JSON.stringify(output, null, 2) + "\n", "utf8");
     if (opts.json) {
       console.log(JSON.stringify({ ok: true, path: target, count: lessons2.length }));
     } else {
@@ -1677,11 +2109,11 @@ async function findMapFiles(dir) {
   return results;
 }
 function fileHash(path) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve3, reject) => {
     const hash = createHash("sha256");
     const stream = createReadStream(path);
     stream.on("data", (chunk) => hash.update(chunk));
-    stream.on("end", () => resolve4(hash.digest("hex")));
+    stream.on("end", () => resolve3(hash.digest("hex")));
     stream.on("error", reject);
   });
 }
@@ -1828,7 +2260,7 @@ function registerDiagnosticsCommands(program2) {
       console.log(`\u2713 Test report submitted`);
       console.log(`  ID:     ${d.reportId}`);
       console.log(`  Status: ${d.status}`);
-      console.log(`  View:   https://kensaur.us/mushi-mushi/reports/${d.reportId}`);
+      console.log(`  View:   ${reportsUrl(resolveConsoleUrlSync(), d.reportId)}`);
     }
   });
   program2.command("index <path>").description("Walk a local repo and upload code chunks to the Mushi RAG indexer").option("--language <lang>", "Limit to one language: ts, tsx, js, py, go, rs").option("--dry-run", "Show what would be uploaded without sending").option("--json", "Machine-readable summary: { files, bytes }").addHelpText("after", `
@@ -1840,7 +2272,7 @@ Examples:
   mushi index ./src
   mushi index ./src --language ts --dry-run`).action(async (path, opts) => {
     const config = requireConfig({ needsProject: true });
-    const { readdir: readdir2, readFile: readFile4, stat } = await import("fs/promises");
+    const { readdir: readdir2, readFile: readFile2, stat } = await import("fs/promises");
     const nodePath = await import("path");
     const SKIP = /node_modules|\.git|dist|build|\.next|\.turbo|coverage/;
     const EXTS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".py", ".go", ".rs"]);
@@ -1867,7 +2299,7 @@ Examples:
 `);
         continue;
       }
-      const source = await readFile4(file, "utf8");
+      const source = await readFile2(file, "utf8");
       const relative2 = nodePath.relative(root, file).replaceAll("\\", "/");
       count++;
       bytes += source.length;
@@ -1914,108 +2346,127 @@ Examples:
   });
 }
 
-// src/mcp-config.ts
-import { mkdir, readFile as readFile2, writeFile } from "fs/promises";
-import { dirname as dirname2 } from "path";
-var DEFAULT_MUSHI_FEATURES = "triage,fixes,inventory,setup,docs";
-async function writeMcpServerEntry(opts) {
-  const { configPath, serverName, serverBlock, dryRun = false } = opts;
-  let merged = { mcpServers: {} };
-  let created = false;
-  try {
-    const existing = await readFile2(configPath, "utf8");
-    try {
-      merged = JSON.parse(existing);
-    } catch {
-      merged = { mcpServers: {} };
-    }
-  } catch {
-    created = true;
-    merged = { mcpServers: {} };
-  }
-  const servers = merged.mcpServers ?? {};
-  servers[serverName] = serverBlock;
-  merged.mcpServers = servers;
-  const output = JSON.stringify(merged, null, 2) + "\n";
-  if (!dryRun) {
-    await mkdir(dirname2(configPath), { recursive: true });
-    await writeFile(configPath, output, "utf8");
-  }
-  return { created, path: configPath };
-}
-function buildMcpServerBlock(opts) {
-  return {
-    command: "npx",
-    args: ["-y", "@mushi-mushi/mcp@latest"],
-    env: {
-      MUSHI_API_ENDPOINT: opts.endpoint,
-      MUSHI_PROJECT_ID: opts.projectId,
-      MUSHI_API_KEY: opts.apiKey,
-      MUSHI_FEATURES: DEFAULT_MUSHI_FEATURES
-    }
-  };
-}
-function buildMcpServerName(opts) {
-  if (opts.legacy) return "mushi";
-  if (opts.projectName) {
-    const slug = opts.projectName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 24);
-    return `mushi-${slug}`;
-  }
-  return `mushi-${(opts.projectId ?? "unknown").slice(0, 8)}`;
-}
-
 // src/commands/project.ts
 function registerProjectCommands(program2) {
   const project = program2.command("project").description("Project management");
-  project.command("create").description("Create a new Mushi project, mint an API key, and write config files").option("--name <name>", "Project name (skip the prompt)").option("--no-browser", "Skip opening the browser for the sign-up / magic-link step").option("--endpoint <url>", "Override API endpoint (self-hosted)").addHelpText("after", `
-Creates a project on app.mushimushi.dev, mints an API key with mcp:read+write scope,
-and writes the following to the current directory:
+  project.command("create").description("Create or select a Mushi project via browser sign-in, then write config files").option("--name <name>", "Project name for a new project (skips the prompt)").option("--no-browser", "Print the verification URL instead of opening the browser").option("--endpoint <url>", "Override API endpoint (self-hosted)").addHelpText("after", `
+Signs you in through the browser (no copy-paste), creates or selects a project,
+mints a report:write SDK key, and writes the following to the current directory:
   .env.local            \u2014 MUSHI_API_KEY, MUSHI_PROJECT_ID, MUSHI_API_ENDPOINT
   .cursor/mcp.json      \u2014 pre-filled mcpServers.mushi block for Cursor
 
 Typical first-time flow:
   npx mushi-mushi project create
-  # Browser opens \u2192 sign up / magic-link \u2192 come back to terminal
+  # Browser opens \u2192 click Approve \u2192 pick or create a project
   # CLI writes .env.local and .cursor/mcp.json
   # mushi whoami to confirm`).action(async (opts) => {
-    const { writeFile: writeFile3 } = await import("fs/promises");
+    const { writeFile } = await import("fs/promises");
     const { existsSync: existsSync4 } = await import("fs");
     const nodePath = await import("path");
-    const endpoint = opts.endpoint ?? loadConfig().endpoint ?? "https://api.mushimushi.dev";
-    const signUpUrl = "https://kensaur.us/mushi-mushi/sign-up";
+    const savedConfig = loadConfig();
+    const endpoint = resolveCloudEndpoint(
+      opts.endpoint ?? process.env.MUSHI_API_ENDPOINT?.trim() ?? savedConfig.endpoint
+    );
+    const consoleBase = await resolveConsoleUrl();
     console.log("");
     console.log("  Mushi project create");
     console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
     console.log("");
+    let session;
+    try {
+      session = await startDeviceAuth(endpoint);
+    } catch (err) {
+      process.stderr.write(`
+error: Could not start browser sign-in: ${err instanceof Error ? err.message : String(err)}
+`);
+      process.stderr.write("  Fallback: mushi login --api-key <key> --project-id <uuid>\n");
+      process.exit(1);
+    }
+    console.log(`  Confirmation code: ${session.user_code}`);
+    console.log("");
     if (opts.browser !== false) {
-      console.log("  1. Opening the Mushi sign-up page in your browser...");
+      console.log("  Opening the Mushi console in your browser\u2026");
       try {
-        const { exec } = await import("child_process");
-        const openCmd = process.platform === "win32" ? `start "" "${signUpUrl}"` : process.platform === "darwin" ? `open "${signUpUrl}"` : `xdg-open "${signUpUrl}"`;
-        exec(openCmd);
+        await openInBrowser(session.verification_uri);
       } catch {
       }
-    } else {
-      console.log(`  1. Sign up or log in at: ${signUpUrl}`);
     }
+    console.log(`  If the browser didn't open: ${session.verification_uri}`);
     console.log("");
-    console.log("  2. Create a project in the console, then paste your credentials below.");
-    console.log("     (Settings \u2192 API Keys \u2192 New key \u2192 Copy as .env.local)");
+    console.log("  Waiting for you to approve in the browser\u2026  (Ctrl+C to cancel)");
+    let cliToken;
+    try {
+      cliToken = await waitForCliToken(endpoint, session, {
+        onPending: () => process.stdout.write("."),
+        onTransientError: () => process.stdout.write("\xB7")
+      });
+    } catch (err) {
+      console.log("");
+      process.stderr.write(`
+error: ${err instanceof Error ? err.message : String(err)}
+`);
+      process.exit(1);
+    }
     console.log("");
+    console.log("  \u2713 Approved!");
+    const projectsList = await listProjects(endpoint, cliToken);
     const { createInterface } = await import("readline");
     const rl = createInterface({ input: process.stdin, output: process.stdout });
-    const ask = (q) => new Promise((resolve4) => rl.question(q, (a) => resolve4(a.trim())));
-    const projectId = await ask("  Project ID (uuid): ");
-    const apiKey = await ask("  API key (mushi_...): ");
+    const ask = (q) => new Promise((resolve3) => rl.question(q, (a) => resolve3(a.trim())));
+    let chosen;
+    let projectId;
+    let projectName;
+    let apiKey;
+    if (!opts.name && projectsList.length > 0) {
+      console.log("");
+      console.log("  Your projects:");
+      projectsList.forEach((pr, i) => {
+        console.log(`    ${i + 1}. ${pr.name} (${pr.id})`);
+      });
+      console.log(`    ${projectsList.length + 1}. Create a new project`);
+      console.log("");
+      const choice = await ask(`  Pick a project [1-${projectsList.length + 1}]: `);
+      const num = parseInt(choice, 10);
+      if (num >= 1 && num <= projectsList.length) {
+        chosen = projectsList[num - 1];
+        projectId = chosen.id;
+        projectName = chosen.name;
+      }
+    }
+    if (!projectId) {
+      const newName = opts.name?.trim() || await ask("  Project name: ");
+      if (!newName) {
+        rl.close();
+        process.stderr.write("\nerror: Project name is required.\n");
+        process.exit(2);
+      }
+      try {
+        const created = await createProject(endpoint, cliToken, newName);
+        projectId = created.id;
+        projectName = created.name;
+        apiKey = created.apiKey ?? void 0;
+        console.log(`  \u2713 Created project "${projectName}"`);
+      } catch (err) {
+        rl.close();
+        process.stderr.write(`
+error: Could not create project: ${err instanceof Error ? err.message : String(err)}
+`);
+        process.exit(1);
+      }
+    }
     rl.close();
+    if (projectId && !apiKey) {
+      apiKey = await mintProjectKey(endpoint, cliToken, projectId) ?? void 0;
+    }
     if (!projectId || !apiKey) {
-      process.stderr.write("\nerror: Project ID and API key are required.\n");
-      process.exit(2);
+      process.stderr.write("\nerror: Could not obtain an SDK key for the project. Run `mushi login` and try again.\n");
+      process.exit(1);
     }
     const config = loadConfig();
     config.apiKey = apiKey;
     config.endpoint = endpoint;
     config.projectId = projectId;
+    config.consoleUrl = consoleBase;
     saveConfig(config);
     const cwd = process.cwd();
     const envPath = nodePath.join(cwd, ".env.local");
@@ -2027,7 +2478,7 @@ Typical first-time flow:
       ""
     ];
     const envExisting = existsSync4(envPath);
-    await writeFile3(envPath, envLines.join("\n"), "utf8");
+    await writeFile(envPath, envLines.join("\n"), "utf8");
     console.log(`
   \u2713 ${envExisting ? "Updated" : "Created"} .env.local`);
     const mcpPath = nodePath.join(cwd, ".cursor", "mcp.json");
@@ -2044,7 +2495,7 @@ Typical first-time flow:
 
 // src/commands/setup.ts
 function registerSetupCommands(program2) {
-  program2.command("setup").description("Wire Mushi into your IDE with one command").option("--ide <ide>", "Target IDE: cursor | claude | continue | zed", "cursor").option("--project-slug <slug>", "Override the project slug in the server name (default: fetched from API or ID prefix)").option("--all-projects", "Write a separate mushi-<name> server entry for every accessible project").option("--with-rules", "Also write the .cursorrules / .claude/rules/mushi.md lesson-library hook").option("--dry-run", "Print what would be written without making changes").addHelpText("after", `
+  program2.command("setup").description("Wire Cursor MCP into your IDE (reads ~/.config/mushi/config.json \u2014 run `mushi login` first)").option("--ide <ide>", "Target IDE: cursor | claude | continue | zed", "cursor").option("--project-slug <slug>", "Override the project slug in the server name (default: fetched from API or ID prefix)").option("--all-projects", "Write a separate mushi-<name> server entry for every accessible project").option("--with-rules", "Also write the .cursorrules / .claude/rules/mushi.md lesson-library hook").option("--dry-run", "Print what would be written without making changes").addHelpText("after", `
 Examples:
   mushi setup                         # wire Cursor (default)
   mushi setup --all-projects          # one server entry per accessible project
@@ -2058,7 +2509,7 @@ Supported IDEs:
   zed       \u2014 writes ~/.config/zed/settings.json mcpServers block
 
 The command reads credentials from ~/.config/mushi/config.json (run \`mushi login\` first).`).action(async (opts) => {
-    const { writeFile: writeFile3, mkdir: mkdir2, readFile: readFile4 } = await import("fs/promises");
+    const { writeFile, mkdir, readFile: readFile2 } = await import("fs/promises");
     const { existsSync: existsSync4 } = await import("fs");
     const nodePath = await import("path");
     const os = await import("os");
@@ -2173,7 +2624,7 @@ The command reads credentials from ~/.config/mushi/config.json (run \`mushi logi
       let settings = {};
       if (existsSync4(configPath)) {
         try {
-          const raw = await readFile4(configPath, "utf8");
+          const raw = await readFile2(configPath, "utf8");
           settings = JSON.parse(raw);
         } catch {
         }
@@ -2197,8 +2648,8 @@ The command reads credentials from ~/.config/mushi/config.json (run \`mushi logi
         console.log(`[dry-run] Would write ${configPath}:`);
         console.log(redactKeyForDisplay(output));
       } else {
-        await mkdir2(configDir, { recursive: true });
-        await writeFile3(configPath, output, "utf8");
+        await mkdir(configDir, { recursive: true });
+        await writeFile(configPath, output, "utf8");
         console.log(`\u2713 Written ${configPath}`);
       }
     }
@@ -2232,7 +2683,7 @@ The command reads credentials from ~/.config/mushi/config.json (run \`mushi logi
         if (opts.dryRun) {
           console.log(`[dry-run] Would write ${rulesPath}`);
         } else {
-          await writeFile3(rulesPath, rulesContent, "utf8");
+          await writeFile(rulesPath, rulesContent, "utf8");
           console.log(`\u2713 Written .cursorrules`);
         }
       } else if (opts.ide === "claude") {
@@ -2241,8 +2692,8 @@ The command reads credentials from ~/.config/mushi/config.json (run \`mushi logi
         if (opts.dryRun) {
           console.log(`[dry-run] Would write ${rulesPath}`);
         } else {
-          await mkdir2(rulesDir, { recursive: true });
-          await writeFile3(rulesPath, rulesContent, "utf8");
+          await mkdir(rulesDir, { recursive: true });
+          await writeFile(rulesPath, rulesContent, "utf8");
           console.log(`\u2713 Written .claude/rules/mushi.md`);
         }
       }
@@ -2370,117 +2821,6 @@ function renderNudgeExplainer(phase) {
   return lines.join("\n");
 }
 
-// src/sanitize-config.ts
-var PROJECT_ID_RE = /^(?:proj_[A-Za-z0-9_-]{10,}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
-var API_KEY_RE = /^(mushi_|mush_pk_)[A-Za-z0-9_-]{10,}$/;
-function sanitizeApiKey(raw) {
-  const key = raw.replace(/[\r\n\0]/g, "");
-  if (!API_KEY_RE.test(key)) {
-    throw new Error(
-      "Invalid API key in config \u2014 run `mushi login --api-key <key>` to refresh credentials."
-    );
-  }
-  return key;
-}
-function sanitizeProjectId(raw) {
-  const id = raw.trim();
-  if (!PROJECT_ID_RE.test(id)) {
-    throw new Error(
-      "Invalid project ID in config \u2014 expected a UUID or proj_* slug from the admin console."
-    );
-  }
-  return id;
-}
-function sanitizeEndpoint(raw) {
-  return assertEndpoint(normalizeEndpoint(raw));
-}
-function sanitizeCliCredentials(config) {
-  if (!config.endpoint || !config.apiKey || !config.projectId) {
-    throw new Error("Missing endpoint, apiKey, or projectId");
-  }
-  return {
-    endpoint: sanitizeEndpoint(config.endpoint),
-    apiKey: sanitizeApiKey(config.apiKey),
-    projectId: sanitizeProjectId(config.projectId)
-  };
-}
-function apiKeyHeaders(apiKey, projectId) {
-  const headers = {
-    Authorization: `Bearer ${apiKey}`,
-    "X-Mushi-Api-Key": apiKey
-  };
-  if (projectId) headers["X-Mushi-Project"] = projectId;
-  return headers;
-}
-
-// src/heartbeat-wait.ts
-var IngestSetupHttpError = class extends Error {
-  status;
-  constructor(status) {
-    super(`ingest-setup HTTP ${status}`);
-    this.name = "IngestSetupHttpError";
-    this.status = status;
-  }
-};
-var NON_RETRYABLE_STATUSES = /* @__PURE__ */ new Set([401, 403, 404]);
-async function fetchIngestSetup(config, doFetch = globalThis.fetch) {
-  const endpoint = sanitizeEndpoint(config.endpoint);
-  const apiKey = sanitizeApiKey(config.apiKey);
-  const projectId = config.projectId ? sanitizeProjectId(config.projectId) : void 0;
-  const res = await doFetch(`${endpoint}/v1/sync/ingest-setup`, {
-    headers: apiKeyHeaders(apiKey, projectId),
-    signal: AbortSignal.timeout(8e3)
-  });
-  if (!res.ok) {
-    if (NON_RETRYABLE_STATUSES.has(res.status)) throw new IngestSetupHttpError(res.status);
-    return null;
-  }
-  const body = await res.json();
-  return body.ok && body.data ? body.data : null;
-}
-async function waitForIngestReady(options) {
-  const doFetch = options.fetch ?? globalThis.fetch;
-  const maxAttempts = options.maxAttempts ?? 40;
-  const intervalMs = options.intervalMs ?? 3e3;
-  let lastPayload = null;
-  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-    if (options.signal?.aborted) {
-      return { ok: false, payload: lastPayload, attempts: attempt - 1, reason: "aborted" };
-    }
-    try {
-      lastPayload = await fetchIngestSetup(
-        { endpoint: options.endpoint, apiKey: options.apiKey, projectId: options.projectId },
-        doFetch
-      );
-      if (lastPayload) {
-        options.onPoll?.(lastPayload, attempt);
-        if (lastPayload.ready) {
-          return { ok: true, payload: lastPayload, attempts: attempt, reason: "ready" };
-        }
-        const sdkStep = lastPayload.steps.find((s) => s.id === "sdk_installed");
-        if (sdkStep?.complete) {
-          return { ok: true, payload: lastPayload, attempts: attempt, reason: "heartbeat" };
-        }
-      }
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      if (err instanceof IngestSetupHttpError) {
-        return { ok: false, payload: lastPayload, attempts: attempt, reason: "unauthorized", error: msg };
-      }
-      if (options.signal?.aborted) {
-        return { ok: false, payload: lastPayload, attempts: attempt, reason: "aborted", error: msg };
-      }
-      if (attempt === maxAttempts) {
-        return { ok: false, payload: lastPayload, attempts: attempt, reason: "fetch-error", error: msg };
-      }
-    }
-    if (attempt < maxAttempts) {
-      await new Promise((r) => setTimeout(r, intervalMs));
-    }
-  }
-  return { ok: false, payload: lastPayload, attempts: maxAttempts, reason: "timeout" };
-}
-
 // src/doctor.ts
 function checkCliConfig(config) {
   return [
@@ -2519,11 +2859,11 @@ async function checkEndpointReachability(endpoint, doFetch = globalThis.fetch) {
 }
 async function checkSdkInstall(cwd) {
   try {
-    const { readFile: readFile4 } = await import("fs/promises");
-    const { join: join6, resolve: resolve4 } = await import("path");
-    const root = resolve4(cwd);
-    const pkgPath = join6(root, "package.json");
-    const pkg = JSON.parse(await readFile4(pkgPath, "utf8"));
+    const { readFile: readFile2 } = await import("fs/promises");
+    const { join: join5, resolve: resolve3 } = await import("path");
+    const root = resolve3(cwd);
+    const pkgPath = join5(root, "package.json");
+    const pkg = JSON.parse(await readFile2(pkgPath, "utf8"));
     const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
     const sdks = [
       "@mushi-mushi/react",
@@ -2531,11 +2871,11 @@ async function checkSdkInstall(cwd) {
       "@mushi-mushi/core",
       "@mushi-mushi/react-native"
     ];
-    const installed = sdks.filter((s) => deps[s]);
+    const installed2 = sdks.filter((s) => deps[s]);
     return {
       name: "SDK installed in this repo",
-      ok: installed.length > 0,
-      detail: installed.length > 0 ? installed.map((s) => `${s}@${deps[s]}`).join(", ") : "No @mushi-mushi/* package in package.json \u2014 run `mushi init` to install"
+      ok: installed2.length > 0,
+      detail: installed2.length > 0 ? installed2.map((s) => `${s}@${deps[s]}`).join(", ") : "No @mushi-mushi/* package in package.json \u2014 run `mushi init` to install"
     };
   } catch {
     return null;
@@ -2701,18 +3041,18 @@ async function checkQaStoriesHealth(config, doFetch = globalThis.fetch) {
 async function checkHostAppWiring(cwd) {
   const checks = [];
   try {
-    const { readFile: readFile4, access } = await import("fs/promises");
-    const { join: join6, resolve: resolve4 } = await import("path");
-    const root = resolve4(cwd);
-    const pkgPath = join6(root, "package.json");
-    const pkg = JSON.parse(await readFile4(pkgPath, "utf8"));
+    const { readFile: readFile2, access } = await import("fs/promises");
+    const { join: join5, resolve: resolve3 } = await import("path");
+    const root = resolve3(cwd);
+    const pkgPath = join5(root, "package.json");
+    const pkg = JSON.parse(await readFile2(pkgPath, "utf8"));
     const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
     const isCapHybrid = Boolean(deps["@capacitor/core"] && deps["react"]);
     const envCandidates = [".env.local", ".env"];
     let envContent = "";
     for (const f of envCandidates) {
       try {
-        envContent = await readFile4(join6(root, f), "utf8");
+        envContent = await readFile2(join5(root, f), "utf8");
         break;
       } catch {
       }
@@ -2726,7 +3066,7 @@ async function checkHostAppWiring(cwd) {
     });
     let mcpPresent = false;
     try {
-      await access(join6(root, ".cursor", "mcp.json"));
+      await access(join5(root, ".cursor", "mcp.json"));
       mcpPresent = true;
     } catch {
     }
@@ -2759,19 +3099,19 @@ async function checkHostAppWiring(cwd) {
 }
 async function checkMcpConfig(config, cwd, doFetch = globalThis.fetch) {
   const checks = [];
-  const { readFile: readFile4 } = await import("fs/promises");
-  const { join: join6, resolve: resolve4 } = await import("path");
+  const { readFile: readFile2 } = await import("fs/promises");
+  const { join: join5, resolve: resolve3 } = await import("path");
   const { homedir } = await import("os");
-  const root = resolve4(cwd);
+  const root = resolve3(cwd);
   const candidates = [
-    join6(root, ".cursor", "mcp.json"),
-    join6(homedir(), ".cursor", "mcp.json")
+    join5(root, ".cursor", "mcp.json"),
+    join5(homedir(), ".cursor", "mcp.json")
   ];
   let mcpPath = null;
   let mcpRaw = null;
   for (const candidate of candidates) {
     try {
-      mcpRaw = await readFile4(candidate, "utf8");
+      mcpRaw = await readFile2(candidate, "utf8");
       mcpPath = candidate;
       break;
     } catch {
@@ -2958,9 +3298,9 @@ async function planUpgrade(cwd) {
     ...pkg?.dependencies ?? {},
     ...pkg?.devDependencies ?? {}
   };
-  const installed = MUSHI_PACKAGES.filter((name) => deps[name]);
+  const installed2 = MUSHI_PACKAGES.filter((name) => deps[name]);
   const entries = await Promise.all(
-    installed.map(async (name) => {
+    installed2.map(async (name) => {
       const current = deps[name] ?? "";
       const currentCore = current.replace(/^[\^~>=<]*/, "");
       if (!/^\d/.test(currentCore)) {
@@ -3031,136 +3371,6 @@ async function runUpgrade(opts = {}) {
   };
 }
 
-// src/connect.ts
-import { appendFile, readFile as readFile3, writeFile as writeFile2 } from "fs/promises";
-import { join as join5, resolve as resolve3 } from "path";
-function envKeyPresent(content, key) {
-  const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  return new RegExp(`^${escaped}=`, "m").test(content);
-}
-async function mergeEnvFile(path, lines) {
-  const block = `
-# Mushi \u2014 added by mushi connect
-${lines.join("\n")}
-`;
-  let existing = null;
-  try {
-    existing = await readFile3(path, "utf8");
-  } catch {
-  }
-  if (existing !== null) {
-    const needs = lines.filter((line) => {
-      const key = line.split("=")[0];
-      return !envKeyPresent(existing, key);
-    });
-    if (needs.length === 0) return false;
-    await appendFile(path, `
-# Mushi \u2014 added by mushi connect
-${needs.join("\n")}
-`, "utf8");
-    return true;
-  }
-  await writeFile2(path, block, "utf8");
-  return true;
-}
-async function ensureMcpJsonGitignored(cwd, messages) {
-  const gitignorePath = join5(cwd, ".gitignore");
-  const patterns = [".cursor/mcp.json", ".cursor/"];
-  let content = null;
-  try {
-    content = await readFile3(gitignorePath, "utf8");
-  } catch {
-  }
-  if (content === null) {
-    messages.push(
-      "\u26A0 No .gitignore found \u2014 .cursor/mcp.json contains your API key. Add `.cursor/mcp.json` before committing."
-    );
-    return;
-  }
-  const covered = patterns.some((p3) => content.split("\n").some((line) => line.trim() === p3 || line.trim() === `${p3}/`));
-  if (covered) return;
-  await appendFile(gitignorePath, "\n# Mushi \u2014 keep MCP credentials out of git\n.cursor/mcp.json\n", "utf8");
-  messages.push("\u2713 Added .cursor/mcp.json to .gitignore (contains API key)");
-}
-async function runConnect(opts, baseConfig = {}) {
-  const cwd = resolve3(opts.cwd ?? process.cwd());
-  const endpoint = assertEndpoint(opts.endpoint);
-  const messages = [];
-  const config = {
-    ...baseConfig,
-    apiKey: opts.apiKey,
-    projectId: opts.projectId,
-    endpoint
-  };
-  saveConfig(config);
-  messages.push(`\u2713 Credentials saved to ${CONFIG_PATH}`);
-  let envPath = null;
-  if (opts.writeEnv !== false) {
-    const pkg = readPackageJson(cwd);
-    const framework = detectFramework(cwd, pkg);
-    const lines = envVarsToWrite(opts.apiKey, opts.projectId, framework).split("\n");
-    envPath = join5(cwd, ".env.local");
-    const wrote = await mergeEnvFile(envPath, lines);
-    messages.push(
-      wrote ? `\u2713 Env vars merged into ${envPath}` : `\u2713 Env vars already present in ${envPath} (existing values left untouched)`
-    );
-    const deps = { ...pkg?.dependencies ?? {}, ...pkg?.devDependencies ?? {} };
-    if (deps["@capacitor/core"] && deps["react"]) {
-      messages.push(
-        "\u2139 Capacitor + React detected \u2014 install @mushi-mushi/web (or @mushi-mushi/react) and call initMushi() in main.tsx. Optional @mushi-mushi/capacitor for native shell parity."
-      );
-    }
-  }
-  let mcpPath = null;
-  if (opts.wireIde !== false) {
-    const mcpDir = join5(cwd, ".cursor");
-    mcpPath = join5(mcpDir, "mcp.json");
-    const serverName = buildMcpServerName({ projectId: opts.projectId });
-    const serverBlock = buildMcpServerBlock({
-      endpoint,
-      projectId: opts.projectId,
-      apiKey: opts.apiKey
-    });
-    await writeMcpServerEntry({ configPath: mcpPath, serverName, serverBlock });
-    await ensureMcpJsonGitignored(cwd, messages);
-    messages.push(`\u2713 Wired ${mcpPath} \u2014 restart Cursor and run "list mushi tools"`);
-  }
-  let heartbeat = null;
-  if (opts.wait) {
-    const timeoutSec = opts.waitTimeoutSec ?? 120;
-    const maxAttempts = Math.max(1, Math.ceil(timeoutSec * 1e3 / 3e3));
-    messages.push(`\u2026 Waiting for SDK heartbeat (up to ${timeoutSec}s) \u2014 start your dev server with the snippet installed`);
-    heartbeat = await waitForIngestReady({
-      endpoint,
-      apiKey: opts.apiKey,
-      projectId: opts.projectId,
-      maxAttempts,
-      onPoll: (payload, attempt) => {
-        if (!opts.json && attempt % 3 === 0) {
-          const sdk = payload.steps.find((s) => s.id === "sdk_installed");
-          const seen = payload.diagnostic?.last_sdk_seen_at ?? "never";
-          process.stdout.write(`  poll ${attempt}: sdk_installed=${sdk?.complete ? "yes" : "no"} last_seen=${seen}
-`);
-        }
-      }
-    });
-    if (heartbeat.ok) {
-      const label = heartbeat.reason === "heartbeat" ? "SDK heartbeat detected" : "Ingest setup complete";
-      messages.push(`\u2713 ${label} \u2014 ingest pipeline is live`);
-    } else if (heartbeat.reason === "unauthorized") {
-      messages.push(
-        `\u2717 The backend rejected these credentials (${heartbeat.error ?? "auth error"}). Double-check --api-key, --project-id, and --endpoint, then re-run \`mushi connect --wait\`.`
-      );
-    } else {
-      messages.push(
-        `\u2717 No heartbeat before timeout (${heartbeat.reason}). Confirm env vars are in your build, restart the dev server, then re-run \`mushi connect --wait\`.`
-      );
-    }
-  }
-  const ok = !opts.wait || Boolean(heartbeat?.ok);
-  return { ok, envPath, mcpPath, heartbeat, messages };
-}
-
 // src/commands/fix.ts
 function registerFixCommands(program2) {
   const fixCmd = program2.command("fix").description("Dispatch an agentic fix for a report");
@@ -3302,7 +3512,7 @@ Examples:
     }
     if (result.plan.entries.length === 0) process.exit(1);
   });
-  program2.command("connect").description("Save credentials, merge env vars, wire Cursor MCP, optionally wait for SDK heartbeat").option("--api-key <key>", "Mushi API key (mushi_\u2026) \u2014 or set MUSHI_API_KEY to keep it out of shell history").requiredOption("--project-id <id>", "Project UUID").requiredOption("--endpoint <url>", "Supabase edge function URL").option("--cwd <path>", "Target repo").option("--no-env", "Skip writing .env.local").option("--no-ide", "Skip writing .cursor/mcp.json").option("--wait", "Poll ingest-setup until SDK heartbeat lands").option("--wait-timeout <sec>", "Max seconds for --wait", "120").option("--json", "Machine-readable output").addHelpText("after", `
+  program2.command("connect").description("Save credentials, merge env vars, wire Cursor MCP, optionally wait for SDK heartbeat").option("--api-key <key>", "Mushi API key (mushi_\u2026) \u2014 or set MUSHI_API_KEY to keep it out of shell history").requiredOption("--project-id <id>", "Project UUID").requiredOption("--endpoint <url>", "Supabase edge function URL").option("--cwd <path>", "Target repo").option("--write-env", "Force-write SDK env vars to .env.local (default; overrides --no-env)").option("--wire-ide", "Force-wire Cursor MCP into .cursor/mcp.json (default; overrides --no-ide)").option("--no-env", "Skip writing .env.local").option("--no-ide", "Skip writing .cursor/mcp.json").option("--wait", "Poll ingest-setup until SDK heartbeat lands").option("--wait-timeout <sec>", "Max seconds for --wait", "120").option("--json", "Machine-readable output").addHelpText("after", `
 Examples:
   MUSHI_API_KEY=mushi_xxx mushi connect --project-id <uuid> --endpoint https://<ref>.supabase.co/functions/v1/api --wait
   mushi connect --api-key mushi_xxx --project-id <uuid> --endpoint <url> --no-ide`).action(async (opts) => {
@@ -3316,8 +3526,10 @@ Examples:
       projectId: opts.projectId,
       endpoint: opts.endpoint,
       cwd: opts.cwd,
-      writeEnv: opts.env !== false,
-      wireIde: opts.ide !== false,
+      // Explicit --write-env / --wire-ide force the action on even if --no-env /
+      // --no-ide was also passed; otherwise writing is the default.
+      writeEnv: opts.writeEnv === true ? true : opts.env !== false,
+      wireIde: opts.wireIde === true ? true : opts.ide !== false,
       wait: opts.wait,
       waitTimeoutSec: parseInt(opts.waitTimeout, 10) || 120,
       json: opts.json
@@ -3987,9 +4199,9 @@ Recent runs for story ${storyId.slice(0, 8)}\u2026:
         }
       }
     }
-    const consoleUrl = config.consoleUrl ?? "https://app.mushi.ai";
+    const consoleUrl2 = config.consoleUrl ?? "https://app.mushi.ai";
     console.log(`
-   Open in console: ${consoleUrl}/qa-coverage?story=${storyId}`);
+   Open in console: ${consoleUrl2}/qa-coverage?story=${storyId}`);
     console.log(`   Tip: run 'mushi config consoleUrl <url>' to override (e.g. http://localhost:6464 for local dev)`);
     console.log();
   });
@@ -4433,8 +4645,8 @@ ${"\u2500".repeat(60)}`);
 installSignalHandlers();
 var program = new Command().name("mushi").description("Mushi Mushi CLI \u2014 set up the SDK, manage bug reports, monitor pipeline").version(MUSHI_CLI_VERSION).addHelpText("after", `
 Environment variables:
-  MUSHI_API_KEY        Project API key (from Settings \u2192 API Keys in the console)
-  MUSHI_PROJECT_ID     Project UUID    (from the Projects page in the console)
+  MUSHI_API_KEY        SDK ingest key (report:write scope \u2014 from Onboarding \u2192 Verify in the console)
+  MUSHI_PROJECT_ID     Project UUID   (from the Projects page in the console)
   MUSHI_API_ENDPOINT   Supabase edge function URL
                        e.g. https://<ref>.supabase.co/functions/v1/api
 
@@ -4444,7 +4656,7 @@ Exit codes:
   2  configuration error (missing credentials or endpoint)
   3  not found (resource does not exist)
 
-Console: https://kensaur.us/mushi-mushi/
+Console: https://kensaur.us/mushi-mushi/admin
 Docs:    https://github.com/kensaurus/mushi-mushi`);
 registerAccountCommands(program);
 registerDeployCommands(program);