@mushi-mushi/cli 0.18.2 → 0.20.0

package/dist/init.js

@@ -1,3 +1,13 @@
+import {
+  MUSHI_CLI_VERSION
+} from "./chunk-6LM2KW4S.js";
+import {
+  TEST_REPORT_FETCH_TIMEOUT_MS,
+  loadConfig,
+  normalizeEndpoint,
+  resolveCloudEndpoint,
+  saveConfig
+} from "./chunk-XEXYGDQV.js";
 import {
   FRAMEWORKS,
   detectFramework,
@@ -6,9 +16,6 @@ import {
   installCommand,
   readPackageJson
 } from "./chunk-7Q44KWGN.js";
-import {
-  MUSHI_CLI_VERSION
-} from "./chunk-E4IZPV6D.js";
 
 // src/init.ts
 import * as p from "@clack/prompts";
@@ -17,117 +24,359 @@ import { randomUUID } from "crypto";
 import { appendFileSync, existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
 import { join as join3 } from "path";
 
-// src/config.ts
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
-import { homedir } from "os";
+// src/console-url.ts
+import { existsSync, readFileSync } from "fs";
 import { dirname, join } from "path";
-var SECURE_FILE_MODE = 384;
-var SECURE_DIR_MODE = 448;
-function resolveXdgConfigPath() {
-  const xdg = process.env["XDG_CONFIG_HOME"];
-  if (xdg && xdg.length > 0) {
-    return join(xdg, "mushi", "config.json");
-  }
-  if (process.platform === "win32") {
-    const appData = process.env["APPDATA"];
-    if (appData && appData.length > 0) {
-      return join(appData, "mushi", "config.json");
+var HOSTED_CONSOLE_BASE = "https://kensaur.us/mushi-mushi/admin";
+var LOCAL_ADMIN_URL = "http://localhost:6464";
+var LOCAL_PROBE_MS = 800;
+function normalizeConsoleBase(url) {
+  const trimmed = url.trim();
+  let end = trimmed.length;
+  while (end > 0 && trimmed.charCodeAt(end - 1) === 47) end--;
+  return trimmed.slice(0, end);
+}
+function consoleUrl(base, route) {
+  const normalizedRoute = route.startsWith("/") ? route : `/${route}`;
+  return `${normalizeConsoleBase(base)}${normalizedRoute}`;
+}
+function resolveConsoleUrlFromEnv() {
+  const raw = process.env["MUSHI_CONSOLE_URL"]?.trim();
+  return raw ? normalizeConsoleBase(raw) : void 0;
+}
+function isInsideMushiMonorepo(cwd) {
+  let dir = cwd;
+  for (let depth = 0; depth < 14; depth += 1) {
+    const pkgPath = join(dir, "package.json");
+    if (existsSync(pkgPath)) {
+      try {
+        const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+        if (pkg.name === "mushi-mushi") return true;
+      } catch {
+      }
     }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
   }
-  return join(homedir(), ".config", "mushi", "config.json");
+  return false;
 }
-var LEGACY_CONFIG_PATH = join(homedir(), ".mushirc");
-var CONFIG_PATH = resolveXdgConfigPath();
-function loadConfig(path = CONFIG_PATH) {
-  let file = {};
-  if (existsSync(path)) {
-    tightenPermissions(path);
-    try {
-      file = JSON.parse(readFileSync(path, "utf-8"));
-    } catch {
+async function probeLocalAdminConsole() {
+  try {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), LOCAL_PROBE_MS);
+    const res = await fetch(LOCAL_ADMIN_URL, {
+      signal: controller.signal,
+      method: "HEAD"
+    });
+    clearTimeout(timer);
+    if (res.ok || res.status === 404 || res.status === 401) {
+      return LOCAL_ADMIN_URL;
     }
-  } else if (path === CONFIG_PATH && existsSync(LEGACY_CONFIG_PATH)) {
-    file = migrateLegacyConfig() ?? {};
-  }
-  const endpointFromEnv = process.env["MUSHI_API_ENDPOINT"] ?? process.env["MUSHI_ENDPOINT"] ?? void 0;
-  const fromEnv = {
-    ...process.env["MUSHI_API_KEY"] ? { apiKey: process.env["MUSHI_API_KEY"] } : {},
-    ...process.env["MUSHI_PROJECT_ID"] ? { projectId: process.env["MUSHI_PROJECT_ID"] } : {},
-    ...endpointFromEnv ? { endpoint: endpointFromEnv } : {}
-  };
-  return { ...file, ...fromEnv };
-}
-function saveConfig(config, path = CONFIG_PATH) {
-  const dir = dirname(path);
-  if (!existsSync(dir)) {
-    mkdirSync(dir, { recursive: true, mode: SECURE_DIR_MODE });
-  } else {
-    tightenDirPermissions(dir);
+  } catch {
   }
-  writeFileSync(path, JSON.stringify(config, null, 2), { mode: SECURE_FILE_MODE });
-  tightenPermissions(path);
+  return null;
+}
+function resolveConsoleUrlSync(cwd = process.cwd()) {
+  const fromEnv = resolveConsoleUrlFromEnv();
+  if (fromEnv) return fromEnv;
+  const config = loadConfig();
+  if (config.consoleUrl) return normalizeConsoleBase(config.consoleUrl);
+  if (isInsideMushiMonorepo(cwd)) return LOCAL_ADMIN_URL;
+  return HOSTED_CONSOLE_BASE;
+}
+async function resolveConsoleUrl(options) {
+  const fromEnv = resolveConsoleUrlFromEnv();
+  if (fromEnv) return fromEnv;
+  const config = loadConfig();
+  if (config.consoleUrl) return normalizeConsoleBase(config.consoleUrl);
+  const local = await probeLocalAdminConsole();
+  if (local) return local;
+  const cwd = options?.cwd ?? process.cwd();
+  if (isInsideMushiMonorepo(cwd)) return LOCAL_ADMIN_URL;
+  return HOSTED_CONSOLE_BASE;
 }
-function migrateLegacyConfig(legacyPath = LEGACY_CONFIG_PATH, destPath = CONFIG_PATH) {
-  if (!existsSync(legacyPath)) return null;
+function projectIdHint(base) {
+  return `Where to find it: ${consoleUrl(base, "/projects")} \u2192 select your project \u2192 click the UUID chip to copy (or copy it from the panel right after you create the project).`;
+}
+function apiKeyHint(base) {
+  return `Where to find it: ${consoleUrl(base, "/onboarding?tab=verify")} \u2192 Generate API key (SDK ingest needs report:write \u2014 not Settings \u2192 BYOK keys). Treat it like a password \u2014 env file only, never commit.`;
+}
+function cliSetupDeepLink(base) {
+  return consoleUrl(base, "/onboarding?tab=steps&setup=cli");
+}
+function reportsUrl(base, reportId) {
+  return reportId ? consoleUrl(base, `/reports/${reportId}`) : consoleUrl(base, "/reports");
+}
+async function openInBrowser(url) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync(legacyPath, "utf-8"));
+    parsed = new URL(url);
   } catch {
-    return null;
+    return;
   }
-  const dir = dirname(destPath);
-  if (!existsSync(dir)) {
-    mkdirSync(dir, { recursive: true, mode: SECURE_DIR_MODE });
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    return;
   }
-  try {
-    renameSync(legacyPath, destPath);
-  } catch {
-    writeFileSync(destPath, JSON.stringify(parsed, null, 2), { mode: SECURE_FILE_MODE });
+  const safeUrl = parsed.toString();
+  const { spawn: spawn2 } = await import("child_process");
+  const [command, args] = process.platform === "win32" ? (
+    // Open via rundll32's FileProtocolHandler rather than `cmd /c start`.
+    // `start` is a cmd builtin, so the URL would be re-parsed by cmd.exe and
+    // characters like `&` / `|` / `^` could still break out — exactly the
+    // injection surface CodeQL flags. rundll32 never invokes a shell: the URL
+    // is handed to the default browser as one opaque argument.
+    ["rundll32", ["url.dll,FileProtocolHandler", safeUrl]]
+  ) : process.platform === "darwin" ? ["open", [safeUrl]] : ["xdg-open", [safeUrl]];
+  await new Promise((resolve2) => {
     try {
-      unlinkSync(legacyPath);
+      const child = spawn2(command, [...args], { stdio: "ignore", shell: false });
+      child.on("error", () => resolve2());
+      child.on("exit", () => resolve2());
+      child.unref();
     } catch {
+      resolve2();
+    }
+  });
+}
+
+// src/signals.ts
+var activeController = null;
+function getAbortSignal(external) {
+  if (external) return external.signal;
+  if (!activeController || activeController.signal.aborted) {
+    activeController = new AbortController();
+  }
+  return activeController.signal;
+}
+
+// src/cli-shared.ts
+var API_TIMEOUT_MS = 15e3;
+async function apiCall(path, config, options = {}) {
+  const endpoint = config.endpoint;
+  if (!endpoint) {
+    return {
+      ok: false,
+      error: {
+        code: "NO_ENDPOINT",
+        message: "No API endpoint configured.\n  Run: mushi login --api-key <key> --endpoint <url> --project-id <id>\n  Or:  export MUSHI_API_ENDPOINT=https://<project-ref>.supabase.co/functions/v1/api"
+      }
+    };
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), API_TIMEOUT_MS);
+  const signals = [controller.signal, getAbortSignal()];
+  const compositeSignal = AbortSignal.any ? AbortSignal.any(signals) : controller.signal;
+  try {
+    const res = await fetch(`${endpoint}${path}`, {
+      ...options,
+      signal: compositeSignal,
+      headers: {
+        "Content-Type": "application/json",
+        // `apiKeyAuth` reads X-Mushi-Api-Key; the Authorization header is a
+        // fallback accepted by some older middleware. Both are sent.
+        "Authorization": `Bearer ${config.apiKey ?? ""}`,
+        "X-Mushi-Api-Key": config.apiKey ?? "",
+        "X-Mushi-Project": config.projectId ?? "",
+        "X-Mushi-Cli-Version": MUSHI_CLI_VERSION,
+        ...options.headers
+      }
+    });
+    clearTimeout(timer);
+    let body;
+    const contentType = res.headers.get("content-type") ?? "";
+    if (contentType.includes("application/json")) {
+      try {
+        body = await res.json();
+      } catch {
+        body = null;
+      }
+    } else {
+      const text2 = await res.text();
+      try {
+        body = JSON.parse(text2);
+      } catch {
+        body = {
+          ok: false,
+          error: {
+            code: `HTTP_${res.status}`,
+            message: text2.trim().slice(0, 300) || `HTTP ${res.status}`
+          }
+        };
+      }
+    }
+    if (!res.ok && typeof body === "object" && body !== null && !("ok" in body)) {
+      const b = body;
+      return {
+        ok: false,
+        httpStatus: res.status,
+        error: {
+          code: b["code"] ?? `HTTP_${res.status}`,
+          message: b["message"] ?? `Request failed (${res.status})`
+        }
+      };
     }
+    return body;
+  } catch (err) {
+    clearTimeout(timer);
+    if (err instanceof Error && err.name === "AbortError") {
+      return {
+        ok: false,
+        error: {
+          code: "TIMEOUT",
+          message: `Request timed out after ${API_TIMEOUT_MS / 1e3}s. Check your network or endpoint.`
+        }
+      };
+    }
+    return {
+      ok: false,
+      error: {
+        code: "NETWORK_ERROR",
+        message: err instanceof Error ? err.message : String(err)
+      }
+    };
   }
-  tightenPermissions(destPath);
-  tightenDirPermissions(dir);
-  return parsed;
 }
-function tightenPermissions(path) {
-  if (process.platform === "win32") return;
+
+// src/device-auth.ts
+var DEVICE_FETCH_TIMEOUT_MS = 15e3;
+function trimTrailingSlash(endpoint) {
+  let end = endpoint.length;
+  while (end > 0 && endpoint.charCodeAt(end - 1) === 47) end--;
+  return endpoint.slice(0, end);
+}
+async function deviceFetch(url, init = {}) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), DEVICE_FETCH_TIMEOUT_MS);
   try {
-    const current = statSync(path).mode & 511;
-    if (current !== SECURE_FILE_MODE) chmodSync(path, SECURE_FILE_MODE);
-  } catch {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function startDeviceAuth(endpoint) {
+  const base = trimTrailingSlash(endpoint);
+  const res = await deviceFetch(`${base}/v1/cli/auth/device/start`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" }
+  });
+  const json = await res.json().catch(() => null);
+  if (!res.ok || !json?.ok || !json.data) {
+    throw new Error(json?.error?.message ?? `Could not start browser sign-in (HTTP ${res.status}).`);
+  }
+  return json.data;
+}
+async function pollDeviceToken(endpoint, deviceCode) {
+  const base = trimTrailingSlash(endpoint);
+  try {
+    const res = await deviceFetch(`${base}/v1/cli/auth/device/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ device_code: deviceCode })
+    });
+    const json = await res.json().catch(() => ({}));
+    if (res.ok && json.ok && json.data?.cli_token) {
+      return { status: "approved", cliToken: json.data.cli_token, userId: json.data.user_id };
+    }
+    switch (json.error) {
+      case "authorization_pending":
+        return { status: "pending" };
+      case "access_denied":
+        return { status: "denied" };
+      case "expired_token":
+        return { status: "expired" };
+      default:
+        return {
+          status: "error",
+          message: json.error_description ?? json.error ?? `HTTP ${res.status}`,
+          // 5xx is a server hiccup the next poll may clear; a 4xx is a definitive
+          // rejection (already claimed / invalid_grant) that won't fix itself.
+          retryable: res.status >= 500
+        };
+    }
+  } catch (err) {
+    return { status: "error", message: err instanceof Error ? err.message : String(err), retryable: true };
+  }
+}
+var defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function waitForCliToken(endpoint, session, opts = {}) {
+  const sleep = opts.sleep ?? defaultSleep;
+  const now = opts.now ?? Date.now;
+  const intervalMs = (session.interval || 5) * 1e3;
+  const deadline = now() + (session.expires_in || 600) * 1e3;
+  const maxConsecutiveErrors = opts.maxConsecutiveErrors ?? 5;
+  let consecutiveErrors = 0;
+  while (now() < deadline) {
+    await sleep(intervalMs);
+    const outcome = await pollDeviceToken(endpoint, session.device_code);
+    switch (outcome.status) {
+      case "approved":
+        return outcome.cliToken;
+      case "pending":
+        consecutiveErrors = 0;
+        opts.onPending?.();
+        continue;
+      case "denied":
+        throw new Error("Login was denied in the browser.");
+      case "expired":
+        throw new Error("The login code expired. Run sign-in again.");
+      case "error":
+        if (!outcome.retryable) {
+          throw new Error(outcome.message);
+        }
+        consecutiveErrors += 1;
+        if (consecutiveErrors >= maxConsecutiveErrors) {
+          throw new Error(outcome.message);
+        }
+        opts.onTransientError?.(outcome.message, consecutiveErrors);
+        continue;
+    }
   }
+  throw new Error("Login timed out before approval. Run sign-in again.");
+}
+function cliAuthHeaders(cliToken) {
+  return {
+    "Content-Type": "application/json",
+    Authorization: `Bearer ${cliToken}`
+  };
 }
-function tightenDirPermissions(path) {
-  if (process.platform === "win32") return;
+async function listProjects(endpoint, cliToken) {
+  const base = trimTrailingSlash(endpoint);
   try {
-    const current = statSync(path).mode & 511;
-    if (current !== SECURE_DIR_MODE) chmodSync(path, SECURE_DIR_MODE);
+    const res = await deviceFetch(`${base}/v1/cli/projects`, { headers: cliAuthHeaders(cliToken) });
+    const json = await res.json().catch(() => null);
+    if (res.ok && json?.ok) return json.data?.projects ?? [];
   } catch {
   }
+  return [];
 }
-
-// src/endpoint.ts
-var TEST_REPORT_TIMEOUT_MS = 1e4;
-var TEST_REPORT_FETCH_TIMEOUT_MS = TEST_REPORT_TIMEOUT_MS;
-var CLOUD_API_ENDPOINT = "https://dxptnwrhwsqckaftyymj.supabase.co/functions/v1/api";
-function resolveCloudEndpoint(explicit) {
-  if (explicit?.trim()) return explicit.trim();
-  const fromEnv = process.env.MUSHI_API_ENDPOINT?.trim();
-  if (fromEnv) return fromEnv;
-  return CLOUD_API_ENDPOINT;
+async function createProject(endpoint, cliToken, name) {
+  const base = trimTrailingSlash(endpoint);
+  const res = await deviceFetch(`${base}/v1/cli/projects`, {
+    method: "POST",
+    headers: cliAuthHeaders(cliToken),
+    body: JSON.stringify({ name })
+  });
+  const json = await res.json().catch(() => null);
+  if (!res.ok || !json?.ok || !json.data) {
+    throw new Error(json?.error?.message ?? `Could not create project (HTTP ${res.status}).`);
+  }
+  const { id, name: created, slug, apiKey } = json.data;
+  return { id, name: created, slug, apiKey: apiKey ?? null };
 }
-function normalizeEndpoint(url) {
-  if (!url) {
-    throw new Error(
-      "No API endpoint configured. Run `mushi init` or set MUSHI_API_ENDPOINT. Set endpoint to your Supabase edge function URL, e.g. https://xyz.supabase.co/functions/v1/api"
-    );
+async function mintProjectKey(endpoint, cliToken, projectId) {
+  const base = trimTrailingSlash(endpoint);
+  try {
+    const res = await deviceFetch(`${base}/v1/cli/projects/${projectId}/keys`, {
+      method: "POST",
+      headers: cliAuthHeaders(cliToken),
+      body: JSON.stringify({})
+    });
+    const json = await res.json().catch(() => null);
+    if (res.ok && json?.ok) return json.data?.key ?? null;
+  } catch {
   }
-  let end = url.length;
-  while (end > 0 && url.charCodeAt(end - 1) === 47) end--;
-  return url.slice(0, end);
+  return null;
 }
 
 // src/freshness.ts
@@ -190,7 +439,7 @@ function parse(version) {
 }
 
 // src/monorepo.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, readdirSync, statSync as statSync2 } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync2, readdirSync, statSync } from "fs";
 import { dirname as dirname2, join as join2, resolve } from "path";
 var WORKSPACE_GLOB_CANDIDATES = ["apps/*", "packages/*", "examples/*"];
 var FRAMEWORK_DEPS = {
@@ -269,7 +518,7 @@ function readPackageJsonSafely(path) {
 }
 function isFileSafe(path) {
   try {
-    return existsSync2(path) && statSync2(path).isFile();
+    return existsSync2(path) && statSync(path).isFile();
   } catch {
     return false;
   }
@@ -310,7 +559,10 @@ async function runInit(options = {}) {
   }
   const detected = detectFramework(cwd, pkg);
   const framework = await chooseFramework(detected, options);
-  const credentials = await collectCredentials(options);
+  const consoleBase = await resolveConsoleUrl({ cwd });
+  const endpoint = resolveCloudEndpoint(options.endpoint);
+  const credentials = await acquireCredentials(options, consoleBase, endpoint);
+  await verifyCredentials(credentials, options, consoleBase);
   const pm = detectPackageManager(cwd);
   const packagesToInstall = framework.needsWebPackage ? [framework.packageName, "@mushi-mushi/web"] : [framework.packageName];
   if (!options.skipInstall) {
@@ -318,12 +570,12 @@ async function runInit(options = {}) {
   } else {
     p.log.info(`Skipped install. Run \`${installCommand(pm, packagesToInstall)}\` yourself.`);
   }
-  const endpoint = resolveCloudEndpoint(options.endpoint);
   writeEnvFile(cwd, credentials.apiKey, credentials.projectId, framework);
   persistCliConfig(credentials.apiKey, credentials.projectId, endpoint);
   const enableRewards = await maybeEnableRewards(options);
-  printNextSteps(framework, credentials.apiKey, credentials.projectId, enableRewards);
-  await maybeSendTestReport(credentials, { ...options, endpoint });
+  printNextSteps(framework, consoleBase, enableRewards);
+  await maybeSendTestReport(credentials, { ...options, endpoint, consoleBase });
+  await maybeOfferConnect(credentials, options, consoleBase);
   p.outro("Setup complete. Happy bug squashing \u{1F41B}");
 }
 function ensureInteractiveOrBailOut(options) {
@@ -364,25 +616,165 @@ async function chooseFramework(detected, options) {
   }
   return FRAMEWORKS[confirmed];
 }
-async function collectCredentials(options) {
+async function acquireCredentials(options, consoleBase, endpoint) {
+  if (options.projectId && options.apiKey) {
+    return {
+      projectId: sanitizeSecret(options.projectId),
+      apiKey: sanitizeSecret(options.apiKey)
+    };
+  }
+  const existing = loadConfig();
+  if (!options.projectId && !options.apiKey && existing.projectId && existing.apiKey) {
+    const reuse = options.yes ? true : await p.confirm({
+      message: "Use the Mushi credentials saved from your last sign-in?",
+      initialValue: true
+    });
+    if (p.isCancel(reuse)) {
+      p.cancel("Aborted.");
+      process.exit(0);
+    }
+    if (reuse) {
+      return {
+        projectId: sanitizeSecret(existing.projectId),
+        apiKey: sanitizeSecret(existing.apiKey)
+      };
+    }
+  }
+  if (options.yes) {
+    const creds = await runBrowserSignIn(options, endpoint);
+    if (creds) return creds;
+    p.log.warn("Browser sign-in didn't complete \u2014 switching to manual entry.");
+  } else {
+    const method = await p.select({
+      message: "Connect this app to Mushi",
+      initialValue: "browser",
+      options: [
+        {
+          value: "browser",
+          label: "Sign in with your browser",
+          hint: "Recommended \u2014 no copy-paste, creates the project + key for you"
+        },
+        {
+          value: "manual",
+          label: "Paste a Project ID + API key",
+          hint: "Self-hosted or expert setup"
+        }
+      ]
+    });
+    if (p.isCancel(method)) {
+      p.cancel("Aborted.");
+      process.exit(0);
+    }
+    if (method === "browser") {
+      const creds = await runBrowserSignIn(options, endpoint);
+      if (creds) return creds;
+      p.log.warn("Browser sign-in didn't complete \u2014 switching to manual entry.");
+    }
+  }
+  return collectCredentialsManually(options, consoleBase);
+}
+async function runBrowserSignIn(options, endpoint) {
+  const startSpin = p.spinner();
+  startSpin.start("Starting secure browser sign-in\u2026");
+  let session;
+  try {
+    session = await startDeviceAuth(endpoint);
+  } catch (err) {
+    startSpin.stop("Could not start browser sign-in.");
+    p.log.warn(err instanceof Error ? err.message : String(err));
+    return null;
+  }
+  startSpin.stop("Browser sign-in ready.");
+  p.log.step(`Confirmation code: ${session.user_code}`);
+  p.log.info(`Opening ${session.verification_uri}`);
+  try {
+    await openInBrowser(session.verification_uri);
+  } catch {
+  }
+  p.log.message("Approve the request in your browser to continue. (Ctrl+C to cancel)");
+  const waitSpin = p.spinner();
+  waitSpin.start("Waiting for you to approve in the browser\u2026");
+  let cliToken;
+  try {
+    cliToken = await waitForCliToken(endpoint, session);
+  } catch (err) {
+    waitSpin.stop("Browser sign-in didn't complete.");
+    p.log.warn(err instanceof Error ? err.message : String(err));
+    return null;
+  }
+  waitSpin.stop("Approved.");
+  let projectId = options.projectId ? sanitizeSecret(options.projectId) : void 0;
+  let apiKey;
+  if (!projectId) {
+    let projects = [];
+    try {
+      projects = await listProjects(endpoint, cliToken);
+    } catch {
+    }
+    const NEW = "__new__";
+    const choice = await p.select({
+      message: "Choose a project",
+      initialValue: projects[0]?.id ?? NEW,
+      options: [
+        ...projects.map((pr) => ({ value: pr.id, label: pr.name, hint: pr.id.slice(0, 8) })),
+        { value: NEW, label: "Create a new project", hint: "mints an SDK key automatically" }
+      ]
+    });
+    if (p.isCancel(choice)) {
+      p.cancel("Aborted.");
+      process.exit(0);
+    }
+    if (choice === NEW) {
+      const name = await p.text({
+        message: "Project name",
+        placeholder: "My app",
+        validate: (v) => v && v.trim().length > 0 ? void 0 : "Required"
+      });
+      if (p.isCancel(name)) {
+        p.cancel("Aborted.");
+        process.exit(0);
+      }
+      const createSpin = p.spinner();
+      createSpin.start(`Creating "${name.trim()}"\u2026`);
+      try {
+        const created = await createProject(endpoint, cliToken, name.trim());
+        projectId = created.id;
+        apiKey = created.apiKey ?? void 0;
+        createSpin.stop(`Created project "${created.name}".`);
+      } catch (err) {
+        createSpin.stop("Could not create the project.");
+        p.log.warn(err instanceof Error ? err.message : String(err));
+        return null;
+      }
+    } else {
+      projectId = choice;
+    }
+  }
+  if (projectId && !apiKey) {
+    apiKey = await mintProjectKey(endpoint, cliToken, projectId) ?? void 0;
+  }
+  if (!projectId || !apiKey) return null;
+  return { apiKey, projectId };
+}
+async function collectCredentialsManually(options, consoleBase) {
   const existing = loadConfig();
   const rawProjectId = options.projectId ?? existing.projectId ?? await promptText({
     message: "Project ID",
     placeholder: "e.g. bdafa28d-b153-482f-bd4f-42981f3fd3a4",
-    hint: "Where to find it: https://kensaur.us/mushi-mushi/projects \u2192 click your project \u2192 copy the UUID below the project name.",
-    validate: (v) => PROJECT_ID_PATTERN.test(v.trim()) ? void 0 : "Expected a UUID (e.g. bdafa28d-b153-482f-bd4f-42981f3fd3a4) \u2014 copy it from the Mushi admin console Projects page."
+    hint: projectIdHint(consoleBase),
+    validate: (v) => PROJECT_ID_PATTERN.test(v.trim()) ? void 0 : "Expected a UUID \u2014 copy it from the Projects page or the panel right after you create a project."
   });
   const rawApiKey = options.apiKey ?? existing.apiKey ?? await promptText({
     message: "API key",
     placeholder: "mushi_xxxxxxxxxxxx",
-    hint: "Where to find it: https://kensaur.us/mushi-mushi/settings \u2192 API Keys tab. Treat it like a password \u2014 env file only, never commit it.",
+    hint: apiKeyHint(consoleBase),
     validate: (v) => API_KEY_PATTERN.test(v) ? void 0 : "Expected format: mushi_ followed by 10+ alphanumeric characters"
   });
   const projectId = sanitizeSecret(rawProjectId);
   const apiKey = sanitizeSecret(rawApiKey);
   if (!PROJECT_ID_PATTERN.test(projectId)) {
     throw new Error(
-      `Invalid project ID. Expected a UUID (e.g. bdafa28d-b153-482f-bd4f-42981f3fd3a4) or the proj_* prefixed form. Got: ${redact(projectId)} \u2014 copy it from the Projects page in the Mushi console at https://kensaur.us/mushi-mushi/projects`
+      `Invalid project ID. Expected a UUID (e.g. bdafa28d-b153-482f-bd4f-42981f3fd3a4) or the proj_* prefixed form. Got: ${redact(projectId)} \u2014 copy it from ${projectIdHint(consoleBase)}`
     );
   }
   if (!API_KEY_PATTERN.test(apiKey)) {
@@ -392,6 +784,23 @@ async function collectCredentials(options) {
   }
   return { projectId, apiKey };
 }
+async function verifyCredentials(credentials, options, consoleBase) {
+  const endpoint = resolveCloudEndpoint(options.endpoint);
+  const spinner2 = p.spinner();
+  spinner2.start("Verifying credentials\u2026");
+  const result = await apiCall(
+    "/v1/sync/whoami",
+    { apiKey: credentials.apiKey, projectId: credentials.projectId, endpoint }
+  );
+  if (!result.ok) {
+    spinner2.stop("Credentials could not be verified.");
+    p.log.error(result.error?.message ?? "Authentication failed.");
+    p.log.info(`Double-check values in the console:
+  ${cliSetupDeepLink(consoleBase)}`);
+    throw new Error("Credential verification failed \u2014 fix Project ID / API key and re-run.");
+  }
+  spinner2.stop(`Connected to ${result.data.project_name}`);
+}
 function sanitizeSecret(raw) {
   return raw.trim().replace(/^['"]|['"]$/g, "").replace(/[\r\n\0]/g, "");
 }
@@ -501,7 +910,7 @@ function persistCliConfig(apiKey, projectId, endpoint) {
   const existing = loadConfig();
   saveConfig({ ...existing, apiKey, projectId, endpoint });
 }
-function printNextSteps(framework, _apiKey, _projectId, enableRewards = false) {
+function printNextSteps(framework, consoleBase, enableRewards = false) {
   p.note(framework.snippet(), "Add this to your app:");
   if (enableRewards) {
     const badgeSnippet = framework.id === "react" ? `// Add to your user menu or profile UI:
@@ -512,13 +921,44 @@ import { MushiRewardsBadge } from '@mushi-mushi/react';
 // import { MushiRewardsBadge } from '@mushi-mushi/react';
 // <MushiRewardsBadge showPoints />`;
     p.note(badgeSnippet, "Rewards badge snippet:");
-    p.log.info("Enable rewards in your project settings at https://kensaur.us/mushi-mushi/rewards");
+    p.log.info(`Enable rewards in your project settings at ${consoleUrl(consoleBase, "/rewards")}`);
     p.log.info("Users will earn points for bug reports, screen navigation, and app activity.");
   }
   p.log.message("Verify the install:");
   p.log.message("  \u2022 Start your dev server");
   p.log.message("  \u2022 Look for the \u{1F41B} button in the bottom-right corner (or shake on mobile)");
-  p.log.message("  \u2022 Submit a test report \u2014 it should appear at https://kensaur.us/mushi-mushi/reports");
+  p.log.message(`  \u2022 Submit a test report \u2014 it should appear at ${reportsUrl(consoleBase)}`);
+  p.log.info(
+    "Tip: `mushi connect --write-env --wire-ide --wait` also wires Cursor MCP and waits for SDK heartbeat."
+  );
+}
+async function maybeOfferConnect(credentials, options, _consoleBase) {
+  if (options.yes) return;
+  const answer = await p.confirm({
+    message: "Run `mushi connect --write-env --wire-ide --wait` now? (SDK env + Cursor MCP + heartbeat check)",
+    initialValue: false
+  });
+  if (p.isCancel(answer) || !answer) return;
+  const endpoint = resolveCloudEndpoint(options.endpoint);
+  try {
+    const { runConnect } = await import("./connect-IC7I76Z2.js");
+    await runConnect({
+      apiKey: credentials.apiKey,
+      projectId: credentials.projectId,
+      endpoint,
+      cwd: options.cwd,
+      writeEnv: true,
+      wireIde: true,
+      wait: true
+    });
+  } catch (err) {
+    p.log.warn(
+      err instanceof Error ? err.message : String(err)
+    );
+    p.log.info(
+      "You can run manually: mushi connect --write-env --wire-ide --wait"
+    );
+  }
 }
 async function maybeEnableRewards(options) {
   if (options.yes) return false;
@@ -589,8 +1029,8 @@ async function maybeSendTestReport(credentials, options) {
       reportId = body.data?.reportId;
     } catch {
     }
-    const reportPath = reportId ? `/reports/${reportId}` : "/reports";
-    p.log.success(`View it at https://kensaur.us/mushi-mushi/admin${reportPath}`);
+    const consoleBase = options.consoleBase ?? resolveConsoleUrlSync(options.cwd);
+    p.log.success(`View it at ${reportsUrl(consoleBase, reportId)}`);
   } catch (err) {
     const aborted = err instanceof Error && err.name === "AbortError";
     spinner2.stop(aborted ? "Timed out reaching the Mushi API." : "Could not reach the Mushi API.");