@mushi-mushi/cli 0.19.0 → 0.20.0

package/dist/chunk-6LM2KW4S.js

@@ -0,0 +1,6 @@
+// src/version.ts
+var MUSHI_CLI_VERSION = true ? "0.20.0" : "0.0.0-dev";
+
+export {
+  MUSHI_CLI_VERSION
+};

package/dist/index.js

@@ -110,7 +110,7 @@ function getAbortSignal(external) {
 }
 
 // src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.19.0" : "0.0.0-dev";
+var MUSHI_CLI_VERSION = true ? "0.20.0" : "0.0.0-dev";
 
 // src/init.ts
 import * as p from "@clack/prompts";
@@ -126,7 +126,10 @@ var HOSTED_CONSOLE_BASE = "https://kensaur.us/mushi-mushi/admin";
 var LOCAL_ADMIN_URL = "http://localhost:6464";
 var LOCAL_PROBE_MS = 800;
 function normalizeConsoleBase(url) {
-  return url.trim().replace(/\/+$/, "");
+  const trimmed = url.trim();
+  let end = trimmed.length;
+  while (end > 0 && trimmed.charCodeAt(end - 1) === 47) end--;
+  return trimmed.slice(0, end);
 }
 function consoleUrl(base, route) {
   const normalizedRoute = route.startsWith("/") ? route : `/${route}`;
@@ -201,10 +204,34 @@ function reportsUrl(base, reportId) {
   return reportId ? consoleUrl(base, `/reports/${reportId}`) : consoleUrl(base, "/reports");
 }
 async function openInBrowser(url) {
-  const { exec } = await import("child_process");
-  const openCmd = process.platform === "win32" ? `start "" "${url}"` : process.platform === "darwin" ? `open "${url}"` : `xdg-open "${url}"`;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    return;
+  }
+  const safeUrl = parsed.toString();
+  const { spawn: spawn2 } = await import("child_process");
+  const [command, args] = process.platform === "win32" ? (
+    // Open via rundll32's FileProtocolHandler rather than `cmd /c start`.
+    // `start` is a cmd builtin, so the URL would be re-parsed by cmd.exe and
+    // characters like `&` / `|` / `^` could still break out — exactly the
+    // injection surface CodeQL flags. rundll32 never invokes a shell: the URL
+    // is handed to the default browser as one opaque argument.
+    ["rundll32", ["url.dll,FileProtocolHandler", safeUrl]]
+  ) : process.platform === "darwin" ? ["open", [safeUrl]] : ["xdg-open", [safeUrl]];
   await new Promise((resolve3) => {
-    exec(openCmd, () => resolve3());
+    try {
+      const child = spawn2(command, [...args], { stdio: "ignore", shell: false });
+      child.on("error", () => resolve3());
+      child.on("exit", () => resolve3());
+      child.unref();
+    } catch {
+      resolve3();
+    }
   });
 }
 
@@ -329,6 +356,147 @@ function pad(s, width) {
   return s.length >= width ? s : s + " ".repeat(width - s.length);
 }
 
+// src/device-auth.ts
+var DEVICE_FETCH_TIMEOUT_MS = 15e3;
+function trimTrailingSlash(endpoint) {
+  let end = endpoint.length;
+  while (end > 0 && endpoint.charCodeAt(end - 1) === 47) end--;
+  return endpoint.slice(0, end);
+}
+async function deviceFetch(url, init = {}) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), DEVICE_FETCH_TIMEOUT_MS);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function startDeviceAuth(endpoint) {
+  const base = trimTrailingSlash(endpoint);
+  const res = await deviceFetch(`${base}/v1/cli/auth/device/start`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" }
+  });
+  const json = await res.json().catch(() => null);
+  if (!res.ok || !json?.ok || !json.data) {
+    throw new Error(json?.error?.message ?? `Could not start browser sign-in (HTTP ${res.status}).`);
+  }
+  return json.data;
+}
+async function pollDeviceToken(endpoint, deviceCode) {
+  const base = trimTrailingSlash(endpoint);
+  try {
+    const res = await deviceFetch(`${base}/v1/cli/auth/device/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ device_code: deviceCode })
+    });
+    const json = await res.json().catch(() => ({}));
+    if (res.ok && json.ok && json.data?.cli_token) {
+      return { status: "approved", cliToken: json.data.cli_token, userId: json.data.user_id };
+    }
+    switch (json.error) {
+      case "authorization_pending":
+        return { status: "pending" };
+      case "access_denied":
+        return { status: "denied" };
+      case "expired_token":
+        return { status: "expired" };
+      default:
+        return {
+          status: "error",
+          message: json.error_description ?? json.error ?? `HTTP ${res.status}`,
+          // 5xx is a server hiccup the next poll may clear; a 4xx is a definitive
+          // rejection (already claimed / invalid_grant) that won't fix itself.
+          retryable: res.status >= 500
+        };
+    }
+  } catch (err) {
+    return { status: "error", message: err instanceof Error ? err.message : String(err), retryable: true };
+  }
+}
+var defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function waitForCliToken(endpoint, session, opts = {}) {
+  const sleep = opts.sleep ?? defaultSleep;
+  const now = opts.now ?? Date.now;
+  const intervalMs = (session.interval || 5) * 1e3;
+  const deadline = now() + (session.expires_in || 600) * 1e3;
+  const maxConsecutiveErrors = opts.maxConsecutiveErrors ?? 5;
+  let consecutiveErrors = 0;
+  while (now() < deadline) {
+    await sleep(intervalMs);
+    const outcome = await pollDeviceToken(endpoint, session.device_code);
+    switch (outcome.status) {
+      case "approved":
+        return outcome.cliToken;
+      case "pending":
+        consecutiveErrors = 0;
+        opts.onPending?.();
+        continue;
+      case "denied":
+        throw new Error("Login was denied in the browser.");
+      case "expired":
+        throw new Error("The login code expired. Run sign-in again.");
+      case "error":
+        if (!outcome.retryable) {
+          throw new Error(outcome.message);
+        }
+        consecutiveErrors += 1;
+        if (consecutiveErrors >= maxConsecutiveErrors) {
+          throw new Error(outcome.message);
+        }
+        opts.onTransientError?.(outcome.message, consecutiveErrors);
+        continue;
+    }
+  }
+  throw new Error("Login timed out before approval. Run sign-in again.");
+}
+function cliAuthHeaders(cliToken) {
+  return {
+    "Content-Type": "application/json",
+    Authorization: `Bearer ${cliToken}`
+  };
+}
+async function listProjects(endpoint, cliToken) {
+  const base = trimTrailingSlash(endpoint);
+  try {
+    const res = await deviceFetch(`${base}/v1/cli/projects`, { headers: cliAuthHeaders(cliToken) });
+    const json = await res.json().catch(() => null);
+    if (res.ok && json?.ok) return json.data?.projects ?? [];
+  } catch {
+  }
+  return [];
+}
+async function createProject(endpoint, cliToken, name) {
+  const base = trimTrailingSlash(endpoint);
+  const res = await deviceFetch(`${base}/v1/cli/projects`, {
+    method: "POST",
+    headers: cliAuthHeaders(cliToken),
+    body: JSON.stringify({ name })
+  });
+  const json = await res.json().catch(() => null);
+  if (!res.ok || !json?.ok || !json.data) {
+    throw new Error(json?.error?.message ?? `Could not create project (HTTP ${res.status}).`);
+  }
+  const { id, name: created, slug, apiKey } = json.data;
+  return { id, name: created, slug, apiKey: apiKey ?? null };
+}
+async function mintProjectKey(endpoint, cliToken, projectId) {
+  const base = trimTrailingSlash(endpoint);
+  try {
+    const res = await deviceFetch(`${base}/v1/cli/projects/${projectId}/keys`, {
+      method: "POST",
+      headers: cliAuthHeaders(cliToken),
+      body: JSON.stringify({})
+    });
+    const json = await res.json().catch(() => null);
+    if (res.ok && json?.ok) return json.data?.key ?? null;
+  } catch {
+  }
+  return null;
+}
+
 // src/freshness.ts
 var REGISTRY = "https://registry.npmjs.org";
 var DEFAULT_TIMEOUT_MS = 2e3;
@@ -510,8 +678,8 @@ async function runInit(options = {}) {
   const detected = detectFramework(cwd, pkg);
   const framework = await chooseFramework(detected, options);
   const consoleBase = await resolveConsoleUrl({ cwd });
-  await maybeGuideConsoleSetup(options, consoleBase);
-  const credentials = await collectCredentials(options, consoleBase);
+  const endpoint = resolveCloudEndpoint(options.endpoint);
+  const credentials = await acquireCredentials(options, consoleBase, endpoint);
   await verifyCredentials(credentials, options, consoleBase);
   const pm = detectPackageManager(cwd);
   const packagesToInstall = framework.needsWebPackage ? [framework.packageName, "@mushi-mushi/web"] : [framework.packageName];
@@ -520,7 +688,6 @@ async function runInit(options = {}) {
   } else {
     p.log.info(`Skipped install. Run \`${installCommand(pm, packagesToInstall)}\` yourself.`);
   }
-  const endpoint = resolveCloudEndpoint(options.endpoint);
   writeEnvFile(cwd, credentials.apiKey, credentials.projectId, framework);
   persistCliConfig(credentials.apiKey, credentials.projectId, endpoint);
   const enableRewards = await maybeEnableRewards(options);
@@ -567,63 +734,17 @@ async function chooseFramework(detected, options) {
   }
   return FRAMEWORKS[confirmed];
 }
-async function maybeGuideConsoleSetup(options, consoleBase) {
-  if (options.yes) return;
-  if (options.projectId && options.apiKey) return;
-  const existing = loadConfig();
-  if (existing.projectId && existing.apiKey) return;
-  const choice = await p.select({
-    message: "Do you already have a Mushi project?",
-    options: [
-      {
-        value: "create",
-        label: "No \u2014 open the console to create one",
-        hint: "Recommended for first-time setup"
-      },
-      {
-        value: "have",
-        label: "Yes \u2014 I have Project ID + API key",
-        hint: "Paste values from the admin console"
-      },
-      {
-        value: "login",
-        label: "Use mushi login first",
-        hint: "Run `mushi login` in another terminal, then re-run this wizard"
-      }
-    ]
-  });
-  if (p.isCancel(choice)) {
-    p.cancel("Aborted.");
-    process.exit(0);
-  }
-  if (choice === "login") {
-    p.log.info("Run `mushi login` to save credentials, then re-run `mushi init`.");
-    p.cancel("Aborted.");
-    process.exit(0);
-  }
-  if (choice !== "create") return;
-  const setupUrl = cliSetupDeepLink(consoleBase);
-  p.log.info(`Opening the Mushi console:
-  ${setupUrl}`);
-  await openInBrowser(setupUrl);
-  p.log.message("In the console:");
-  p.log.message("  1. Enter a project name and click Create");
-  p.log.message("  2. Copy the Project ID from the success panel");
-  p.log.message("  3. Generate an API key (Verify tab \u2014 report:write scope)");
-  p.log.message("  4. Return here and paste both values");
-  const ready = await p.confirm({
-    message: "Created your project and ready to paste credentials?",
-    initialValue: false
-  });
-  if (p.isCancel(ready) || !ready) {
-    p.log.warn(`Finish in the console first: ${setupUrl}`);
+async function acquireCredentials(options, consoleBase, endpoint) {
+  if (options.projectId && options.apiKey) {
+    return {
+      projectId: sanitizeSecret(options.projectId),
+      apiKey: sanitizeSecret(options.apiKey)
+    };
   }
-}
-async function collectCredentials(options, consoleBase) {
   const existing = loadConfig();
   if (!options.projectId && !options.apiKey && existing.projectId && existing.apiKey) {
     const reuse = options.yes ? true : await p.confirm({
-      message: "Use Project ID + API key from ~/.config/mushi/config.json?",
+      message: "Use the Mushi credentials saved from your last sign-in?",
       initialValue: true
     });
     if (p.isCancel(reuse)) {
@@ -637,6 +758,124 @@ async function collectCredentials(options, consoleBase) {
       };
     }
   }
+  if (options.yes) {
+    const creds = await runBrowserSignIn(options, endpoint);
+    if (creds) return creds;
+    p.log.warn("Browser sign-in didn't complete \u2014 switching to manual entry.");
+  } else {
+    const method = await p.select({
+      message: "Connect this app to Mushi",
+      initialValue: "browser",
+      options: [
+        {
+          value: "browser",
+          label: "Sign in with your browser",
+          hint: "Recommended \u2014 no copy-paste, creates the project + key for you"
+        },
+        {
+          value: "manual",
+          label: "Paste a Project ID + API key",
+          hint: "Self-hosted or expert setup"
+        }
+      ]
+    });
+    if (p.isCancel(method)) {
+      p.cancel("Aborted.");
+      process.exit(0);
+    }
+    if (method === "browser") {
+      const creds = await runBrowserSignIn(options, endpoint);
+      if (creds) return creds;
+      p.log.warn("Browser sign-in didn't complete \u2014 switching to manual entry.");
+    }
+  }
+  return collectCredentialsManually(options, consoleBase);
+}
+async function runBrowserSignIn(options, endpoint) {
+  const startSpin = p.spinner();
+  startSpin.start("Starting secure browser sign-in\u2026");
+  let session;
+  try {
+    session = await startDeviceAuth(endpoint);
+  } catch (err) {
+    startSpin.stop("Could not start browser sign-in.");
+    p.log.warn(err instanceof Error ? err.message : String(err));
+    return null;
+  }
+  startSpin.stop("Browser sign-in ready.");
+  p.log.step(`Confirmation code: ${session.user_code}`);
+  p.log.info(`Opening ${session.verification_uri}`);
+  try {
+    await openInBrowser(session.verification_uri);
+  } catch {
+  }
+  p.log.message("Approve the request in your browser to continue. (Ctrl+C to cancel)");
+  const waitSpin = p.spinner();
+  waitSpin.start("Waiting for you to approve in the browser\u2026");
+  let cliToken;
+  try {
+    cliToken = await waitForCliToken(endpoint, session);
+  } catch (err) {
+    waitSpin.stop("Browser sign-in didn't complete.");
+    p.log.warn(err instanceof Error ? err.message : String(err));
+    return null;
+  }
+  waitSpin.stop("Approved.");
+  let projectId = options.projectId ? sanitizeSecret(options.projectId) : void 0;
+  let apiKey;
+  if (!projectId) {
+    let projects = [];
+    try {
+      projects = await listProjects(endpoint, cliToken);
+    } catch {
+    }
+    const NEW = "__new__";
+    const choice = await p.select({
+      message: "Choose a project",
+      initialValue: projects[0]?.id ?? NEW,
+      options: [
+        ...projects.map((pr) => ({ value: pr.id, label: pr.name, hint: pr.id.slice(0, 8) })),
+        { value: NEW, label: "Create a new project", hint: "mints an SDK key automatically" }
+      ]
+    });
+    if (p.isCancel(choice)) {
+      p.cancel("Aborted.");
+      process.exit(0);
+    }
+    if (choice === NEW) {
+      const name = await p.text({
+        message: "Project name",
+        placeholder: "My app",
+        validate: (v) => v && v.trim().length > 0 ? void 0 : "Required"
+      });
+      if (p.isCancel(name)) {
+        p.cancel("Aborted.");
+        process.exit(0);
+      }
+      const createSpin = p.spinner();
+      createSpin.start(`Creating "${name.trim()}"\u2026`);
+      try {
+        const created = await createProject(endpoint, cliToken, name.trim());
+        projectId = created.id;
+        apiKey = created.apiKey ?? void 0;
+        createSpin.stop(`Created project "${created.name}".`);
+      } catch (err) {
+        createSpin.stop("Could not create the project.");
+        p.log.warn(err instanceof Error ? err.message : String(err));
+        return null;
+      }
+    } else {
+      projectId = choice;
+    }
+  }
+  if (projectId && !apiKey) {
+    apiKey = await mintProjectKey(endpoint, cliToken, projectId) ?? void 0;
+  }
+  if (!projectId || !apiKey) return null;
+  return { apiKey, projectId };
+}
+async function collectCredentialsManually(options, consoleBase) {
+  const existing = loadConfig();
   const rawProjectId = options.projectId ?? existing.projectId ?? await promptText({
     message: "Project ID",
     placeholder: "e.g. bdafa28d-b153-482f-bd4f-42981f3fd3a4",
@@ -1151,15 +1390,7 @@ Examples:
     console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
     let deviceData;
     try {
-      const res = await fetch(`${endpoint}/v1/cli/auth/device/start`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" }
-      });
-      const json = await res.json();
-      if (!res.ok || !json.ok || !json.data) {
-        throw new Error(json.error?.message ?? `HTTP ${res.status}`);
-      }
-      deviceData = json.data;
+      deviceData = await startDeviceAuth(endpoint);
     } catch (err) {
       process.stderr.write(`
 error: Could not start login session: ${err instanceof Error ? err.message : String(err)}
@@ -1185,42 +1416,41 @@ error: Could not start login session: ${err instanceof Error ? err.message : Str
     let cliToken = null;
     const pollIntervalMs = (deviceData.interval ?? 5) * 1e3;
     const deadline = Date.now() + (deviceData.expires_in ?? 600) * 1e3;
+    const MAX_CONSECUTIVE_ERRORS = 5;
+    let consecutiveErrors = 0;
     while (Date.now() < deadline) {
       await new Promise((r) => setTimeout(r, pollIntervalMs));
-      try {
-        const pollRes = await fetch(`${endpoint}/v1/cli/auth/device/token`, {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({ device_code: deviceData.device_code })
-        });
-        const pollJson = await pollRes.json();
-        if (pollRes.ok && pollJson.ok && pollJson.data?.cli_token) {
-          cliToken = pollJson.data.cli_token;
-          break;
-        }
-        const errCode = pollJson.error ?? "";
-        if (errCode === "authorization_pending") {
-          process.stdout.write(".");
-          continue;
-        }
-        if (errCode === "access_denied") {
-          console.log("");
-          process.stderr.write("\nerror: Login denied in the browser.\n");
-          process.exit(1);
-        }
-        if (errCode === "expired_token") {
-          console.log("");
-          process.stderr.write("\nerror: Login code expired. Run mushi login again.\n");
-          process.exit(1);
+      const outcome = await pollDeviceToken(endpoint, deviceData.device_code);
+      if (outcome.status === "approved") {
+        cliToken = outcome.cliToken;
+        break;
+      }
+      if (outcome.status === "pending") {
+        consecutiveErrors = 0;
+        process.stdout.write(".");
+        continue;
+      }
+      if (outcome.status === "error") {
+        if (outcome.retryable) {
+          consecutiveErrors += 1;
+          if (consecutiveErrors < MAX_CONSECUTIVE_ERRORS) {
+            process.stdout.write("\xB7");
+            continue;
+          }
         }
-        throw new Error(pollJson.error_description ?? errCode ?? `HTTP ${pollRes.status}`);
-      } catch (err) {
         console.log("");
         process.stderr.write(`
-error: Poll failed: ${err instanceof Error ? err.message : String(err)}
+error: ${outcome.message}
 `);
         process.exit(1);
       }
+      console.log("");
+      if (outcome.status === "denied") {
+        process.stderr.write("\nerror: Login denied in the browser.\n");
+      } else if (outcome.status === "expired") {
+        process.stderr.write("\nerror: Login code expired. Run mushi login again.\n");
+      }
+      process.exit(1);
     }
     if (!cliToken) {
       console.log("");
@@ -1229,17 +1459,7 @@ error: Poll failed: ${err instanceof Error ? err.message : String(err)}
     }
     console.log("");
     console.log("  \u2713 Approved!");
-    const cliHeaders = {
-      "Content-Type": "application/json",
-      "Authorization": `Bearer ${cliToken}`
-    };
-    let projectsList = [];
-    try {
-      const listRes = await fetch(`${endpoint}/v1/cli/projects`, { headers: cliHeaders });
-      const listJson = await listRes.json();
-      if (listRes.ok && listJson.ok) projectsList = listJson.data?.projects ?? [];
-    } catch {
-    }
+    const projectsList = await listProjects(endpoint, cliToken);
     let chosenProjectId = projectId;
     let chosenProjectName;
     if (!chosenProjectId) {
@@ -1271,18 +1491,10 @@ error: Poll failed: ${err instanceof Error ? err.message : String(err)}
           process.exit(2);
         }
         try {
-          const createRes = await fetch(`${endpoint}/v1/cli/projects`, {
-            method: "POST",
-            headers: cliHeaders,
-            body: JSON.stringify({ name: newName.trim() })
-          });
-          const createJson = await createRes.json();
-          if (!createRes.ok || !createJson.ok || !createJson.data) {
-            throw new Error(createJson.error?.message ?? `HTTP ${createRes.status}`);
-          }
-          chosenProjectId = createJson.data.id;
-          chosenProjectName = createJson.data.name;
-          apiKey = createJson.data.apiKey ?? void 0;
+          const created = await createProject(endpoint, cliToken, newName.trim());
+          chosenProjectId = created.id;
+          chosenProjectName = created.name;
+          apiKey = created.apiKey ?? void 0;
           console.log(`  \u2713 Created project "${chosenProjectName}"`);
         } catch (err) {
           process.stderr.write(`
@@ -1296,15 +1508,7 @@ error: Could not create project: ${err instanceof Error ? err.message : String(e
     }
     if (!apiKey && chosenProjectId) {
       try {
-        const keyRes = await fetch(`${endpoint}/v1/cli/projects/${chosenProjectId}/keys`, {
-          method: "POST",
-          headers: cliHeaders,
-          body: JSON.stringify({})
-        });
-        const keyJson = await keyRes.json();
-        if (keyRes.ok && keyJson.ok) {
-          apiKey = keyJson.data?.key ?? void 0;
-        }
+        apiKey = await mintProjectKey(endpoint, cliToken, chosenProjectId) ?? void 0;
       } catch {
       }
     }
@@ -2145,56 +2349,124 @@ Examples:
 // src/commands/project.ts
 function registerProjectCommands(program2) {
   const project = program2.command("project").description("Project management");
-  project.command("create").description("Create a new Mushi project, mint an API key, and write config files").option("--name <name>", "Project name (skip the prompt)").option("--no-browser", "Skip opening the browser for the sign-up / magic-link step").option("--endpoint <url>", "Override API endpoint (self-hosted)").addHelpText("after", `
-Creates a project on the Mushi console, mints an API key with mcp:read+write scope,
-and writes the following to the current directory:
+  project.command("create").description("Create or select a Mushi project via browser sign-in, then write config files").option("--name <name>", "Project name for a new project (skips the prompt)").option("--no-browser", "Print the verification URL instead of opening the browser").option("--endpoint <url>", "Override API endpoint (self-hosted)").addHelpText("after", `
+Signs you in through the browser (no copy-paste), creates or selects a project,
+mints a report:write SDK key, and writes the following to the current directory:
   .env.local            \u2014 MUSHI_API_KEY, MUSHI_PROJECT_ID, MUSHI_API_ENDPOINT
   .cursor/mcp.json      \u2014 pre-filled mcpServers.mushi block for Cursor
 
 Typical first-time flow:
   npx mushi-mushi project create
-  # Browser opens \u2192 sign up / magic-link \u2192 come back to terminal
+  # Browser opens \u2192 click Approve \u2192 pick or create a project
   # CLI writes .env.local and .cursor/mcp.json
   # mushi whoami to confirm`).action(async (opts) => {
     const { writeFile } = await import("fs/promises");
     const { existsSync: existsSync4 } = await import("fs");
     const nodePath = await import("path");
-    const endpoint = opts.endpoint ?? loadConfig().endpoint ?? "https://api.mushimushi.dev";
-    const consoleBase = resolveConsoleUrlSync();
-    const signUpUrl = consoleUrl(consoleBase, "/sign-up");
+    const savedConfig = loadConfig();
+    const endpoint = resolveCloudEndpoint(
+      opts.endpoint ?? process.env.MUSHI_API_ENDPOINT?.trim() ?? savedConfig.endpoint
+    );
+    const consoleBase = await resolveConsoleUrl();
     console.log("");
     console.log("  Mushi project create");
     console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
     console.log("");
+    let session;
+    try {
+      session = await startDeviceAuth(endpoint);
+    } catch (err) {
+      process.stderr.write(`
+error: Could not start browser sign-in: ${err instanceof Error ? err.message : String(err)}
+`);
+      process.stderr.write("  Fallback: mushi login --api-key <key> --project-id <uuid>\n");
+      process.exit(1);
+    }
+    console.log(`  Confirmation code: ${session.user_code}`);
+    console.log("");
     if (opts.browser !== false) {
-      console.log("  1. Opening the Mushi sign-up page in your browser...");
+      console.log("  Opening the Mushi console in your browser\u2026");
       try {
-        const { exec } = await import("child_process");
-        const openCmd = process.platform === "win32" ? `start "" "${signUpUrl}"` : process.platform === "darwin" ? `open "${signUpUrl}"` : `xdg-open "${signUpUrl}"`;
-        exec(openCmd);
+        await openInBrowser(session.verification_uri);
       } catch {
       }
-    } else {
-      console.log(`  1. Sign up or log in at: ${signUpUrl}`);
     }
+    console.log(`  If the browser didn't open: ${session.verification_uri}`);
     console.log("");
-    console.log("  2. Create a project in the console, then paste your credentials below.");
-    console.log("     (Settings \u2192 API Keys \u2192 New key \u2192 Copy as .env.local)");
+    console.log("  Waiting for you to approve in the browser\u2026  (Ctrl+C to cancel)");
+    let cliToken;
+    try {
+      cliToken = await waitForCliToken(endpoint, session, {
+        onPending: () => process.stdout.write("."),
+        onTransientError: () => process.stdout.write("\xB7")
+      });
+    } catch (err) {
+      console.log("");
+      process.stderr.write(`
+error: ${err instanceof Error ? err.message : String(err)}
+`);
+      process.exit(1);
+    }
     console.log("");
+    console.log("  \u2713 Approved!");
+    const projectsList = await listProjects(endpoint, cliToken);
     const { createInterface } = await import("readline");
     const rl = createInterface({ input: process.stdin, output: process.stdout });
     const ask = (q) => new Promise((resolve3) => rl.question(q, (a) => resolve3(a.trim())));
-    const projectId = await ask("  Project ID (uuid): ");
-    const apiKey = await ask("  API key (mushi_...): ");
+    let chosen;
+    let projectId;
+    let projectName;
+    let apiKey;
+    if (!opts.name && projectsList.length > 0) {
+      console.log("");
+      console.log("  Your projects:");
+      projectsList.forEach((pr, i) => {
+        console.log(`    ${i + 1}. ${pr.name} (${pr.id})`);
+      });
+      console.log(`    ${projectsList.length + 1}. Create a new project`);
+      console.log("");
+      const choice = await ask(`  Pick a project [1-${projectsList.length + 1}]: `);
+      const num = parseInt(choice, 10);
+      if (num >= 1 && num <= projectsList.length) {
+        chosen = projectsList[num - 1];
+        projectId = chosen.id;
+        projectName = chosen.name;
+      }
+    }
+    if (!projectId) {
+      const newName = opts.name?.trim() || await ask("  Project name: ");
+      if (!newName) {
+        rl.close();
+        process.stderr.write("\nerror: Project name is required.\n");
+        process.exit(2);
+      }
+      try {
+        const created = await createProject(endpoint, cliToken, newName);
+        projectId = created.id;
+        projectName = created.name;
+        apiKey = created.apiKey ?? void 0;
+        console.log(`  \u2713 Created project "${projectName}"`);
+      } catch (err) {
+        rl.close();
+        process.stderr.write(`
+error: Could not create project: ${err instanceof Error ? err.message : String(err)}
+`);
+        process.exit(1);
+      }
+    }
     rl.close();
+    if (projectId && !apiKey) {
+      apiKey = await mintProjectKey(endpoint, cliToken, projectId) ?? void 0;
+    }
     if (!projectId || !apiKey) {
-      process.stderr.write("\nerror: Project ID and API key are required.\n");
-      process.exit(2);
+      process.stderr.write("\nerror: Could not obtain an SDK key for the project. Run `mushi login` and try again.\n");
+      process.exit(1);
     }
     const config = loadConfig();
     config.apiKey = apiKey;
     config.endpoint = endpoint;
     config.projectId = projectId;
+    config.consoleUrl = consoleBase;
     saveConfig(config);
     const cwd = process.cwd();
     const envPath = nodePath.join(cwd, ".env.local");
@@ -3240,7 +3512,7 @@ Examples:
     }
     if (result.plan.entries.length === 0) process.exit(1);
   });
-  program2.command("connect").description("Save credentials, merge env vars, wire Cursor MCP, optionally wait for SDK heartbeat").option("--api-key <key>", "Mushi API key (mushi_\u2026) \u2014 or set MUSHI_API_KEY to keep it out of shell history").requiredOption("--project-id <id>", "Project UUID").requiredOption("--endpoint <url>", "Supabase edge function URL").option("--cwd <path>", "Target repo").option("--write-env", "Write SDK env vars to .env.local (default: enabled)").option("--wire-ide", "Wire Cursor MCP into .cursor/mcp.json (default: enabled)").option("--no-env", "Skip writing .env.local").option("--no-ide", "Skip writing .cursor/mcp.json").option("--wait", "Poll ingest-setup until SDK heartbeat lands").option("--wait-timeout <sec>", "Max seconds for --wait", "120").option("--json", "Machine-readable output").addHelpText("after", `
+  program2.command("connect").description("Save credentials, merge env vars, wire Cursor MCP, optionally wait for SDK heartbeat").option("--api-key <key>", "Mushi API key (mushi_\u2026) \u2014 or set MUSHI_API_KEY to keep it out of shell history").requiredOption("--project-id <id>", "Project UUID").requiredOption("--endpoint <url>", "Supabase edge function URL").option("--cwd <path>", "Target repo").option("--write-env", "Force-write SDK env vars to .env.local (default; overrides --no-env)").option("--wire-ide", "Force-wire Cursor MCP into .cursor/mcp.json (default; overrides --no-ide)").option("--no-env", "Skip writing .env.local").option("--no-ide", "Skip writing .cursor/mcp.json").option("--wait", "Poll ingest-setup until SDK heartbeat lands").option("--wait-timeout <sec>", "Max seconds for --wait", "120").option("--json", "Machine-readable output").addHelpText("after", `
 Examples:
   MUSHI_API_KEY=mushi_xxx mushi connect --project-id <uuid> --endpoint https://<ref>.supabase.co/functions/v1/api --wait
   mushi connect --api-key mushi_xxx --project-id <uuid> --endpoint <url> --no-ide`).action(async (opts) => {
@@ -3254,8 +3526,10 @@ Examples:
       projectId: opts.projectId,
       endpoint: opts.endpoint,
       cwd: opts.cwd,
-      writeEnv: opts.env !== false,
-      wireIde: opts.ide !== false,
+      // Explicit --write-env / --wire-ide force the action on even if --no-env /
+      // --no-ide was also passed; otherwise writing is the default.
+      writeEnv: opts.writeEnv === true ? true : opts.env !== false,
+      wireIde: opts.wireIde === true ? true : opts.ide !== false,
       wait: opts.wait,
       waitTimeoutSec: parseInt(opts.waitTimeout, 10) || 120,
       json: opts.json

package/dist/init.js

@@ -1,6 +1,6 @@
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-T4XX5FMH.js";
+} from "./chunk-6LM2KW4S.js";
 import {
   TEST_REPORT_FETCH_TIMEOUT_MS,
   loadConfig,
@@ -31,7 +31,10 @@ var HOSTED_CONSOLE_BASE = "https://kensaur.us/mushi-mushi/admin";
 var LOCAL_ADMIN_URL = "http://localhost:6464";
 var LOCAL_PROBE_MS = 800;
 function normalizeConsoleBase(url) {
-  return url.trim().replace(/\/+$/, "");
+  const trimmed = url.trim();
+  let end = trimmed.length;
+  while (end > 0 && trimmed.charCodeAt(end - 1) === 47) end--;
+  return trimmed.slice(0, end);
 }
 function consoleUrl(base, route) {
   const normalizedRoute = route.startsWith("/") ? route : `/${route}`;
@@ -106,10 +109,34 @@ function reportsUrl(base, reportId) {
   return reportId ? consoleUrl(base, `/reports/${reportId}`) : consoleUrl(base, "/reports");
 }
 async function openInBrowser(url) {
-  const { exec } = await import("child_process");
-  const openCmd = process.platform === "win32" ? `start "" "${url}"` : process.platform === "darwin" ? `open "${url}"` : `xdg-open "${url}"`;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    return;
+  }
+  const safeUrl = parsed.toString();
+  const { spawn: spawn2 } = await import("child_process");
+  const [command, args] = process.platform === "win32" ? (
+    // Open via rundll32's FileProtocolHandler rather than `cmd /c start`.
+    // `start` is a cmd builtin, so the URL would be re-parsed by cmd.exe and
+    // characters like `&` / `|` / `^` could still break out — exactly the
+    // injection surface CodeQL flags. rundll32 never invokes a shell: the URL
+    // is handed to the default browser as one opaque argument.
+    ["rundll32", ["url.dll,FileProtocolHandler", safeUrl]]
+  ) : process.platform === "darwin" ? ["open", [safeUrl]] : ["xdg-open", [safeUrl]];
   await new Promise((resolve2) => {
-    exec(openCmd, () => resolve2());
+    try {
+      const child = spawn2(command, [...args], { stdio: "ignore", shell: false });
+      child.on("error", () => resolve2());
+      child.on("exit", () => resolve2());
+      child.unref();
+    } catch {
+      resolve2();
+    }
   });
 }
 
@@ -211,6 +238,147 @@ async function apiCall(path, config, options = {}) {
   }
 }
 
+// src/device-auth.ts
+var DEVICE_FETCH_TIMEOUT_MS = 15e3;
+function trimTrailingSlash(endpoint) {
+  let end = endpoint.length;
+  while (end > 0 && endpoint.charCodeAt(end - 1) === 47) end--;
+  return endpoint.slice(0, end);
+}
+async function deviceFetch(url, init = {}) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), DEVICE_FETCH_TIMEOUT_MS);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function startDeviceAuth(endpoint) {
+  const base = trimTrailingSlash(endpoint);
+  const res = await deviceFetch(`${base}/v1/cli/auth/device/start`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" }
+  });
+  const json = await res.json().catch(() => null);
+  if (!res.ok || !json?.ok || !json.data) {
+    throw new Error(json?.error?.message ?? `Could not start browser sign-in (HTTP ${res.status}).`);
+  }
+  return json.data;
+}
+async function pollDeviceToken(endpoint, deviceCode) {
+  const base = trimTrailingSlash(endpoint);
+  try {
+    const res = await deviceFetch(`${base}/v1/cli/auth/device/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ device_code: deviceCode })
+    });
+    const json = await res.json().catch(() => ({}));
+    if (res.ok && json.ok && json.data?.cli_token) {
+      return { status: "approved", cliToken: json.data.cli_token, userId: json.data.user_id };
+    }
+    switch (json.error) {
+      case "authorization_pending":
+        return { status: "pending" };
+      case "access_denied":
+        return { status: "denied" };
+      case "expired_token":
+        return { status: "expired" };
+      default:
+        return {
+          status: "error",
+          message: json.error_description ?? json.error ?? `HTTP ${res.status}`,
+          // 5xx is a server hiccup the next poll may clear; a 4xx is a definitive
+          // rejection (already claimed / invalid_grant) that won't fix itself.
+          retryable: res.status >= 500
+        };
+    }
+  } catch (err) {
+    return { status: "error", message: err instanceof Error ? err.message : String(err), retryable: true };
+  }
+}
+var defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function waitForCliToken(endpoint, session, opts = {}) {
+  const sleep = opts.sleep ?? defaultSleep;
+  const now = opts.now ?? Date.now;
+  const intervalMs = (session.interval || 5) * 1e3;
+  const deadline = now() + (session.expires_in || 600) * 1e3;
+  const maxConsecutiveErrors = opts.maxConsecutiveErrors ?? 5;
+  let consecutiveErrors = 0;
+  while (now() < deadline) {
+    await sleep(intervalMs);
+    const outcome = await pollDeviceToken(endpoint, session.device_code);
+    switch (outcome.status) {
+      case "approved":
+        return outcome.cliToken;
+      case "pending":
+        consecutiveErrors = 0;
+        opts.onPending?.();
+        continue;
+      case "denied":
+        throw new Error("Login was denied in the browser.");
+      case "expired":
+        throw new Error("The login code expired. Run sign-in again.");
+      case "error":
+        if (!outcome.retryable) {
+          throw new Error(outcome.message);
+        }
+        consecutiveErrors += 1;
+        if (consecutiveErrors >= maxConsecutiveErrors) {
+          throw new Error(outcome.message);
+        }
+        opts.onTransientError?.(outcome.message, consecutiveErrors);
+        continue;
+    }
+  }
+  throw new Error("Login timed out before approval. Run sign-in again.");
+}
+function cliAuthHeaders(cliToken) {
+  return {
+    "Content-Type": "application/json",
+    Authorization: `Bearer ${cliToken}`
+  };
+}
+async function listProjects(endpoint, cliToken) {
+  const base = trimTrailingSlash(endpoint);
+  try {
+    const res = await deviceFetch(`${base}/v1/cli/projects`, { headers: cliAuthHeaders(cliToken) });
+    const json = await res.json().catch(() => null);
+    if (res.ok && json?.ok) return json.data?.projects ?? [];
+  } catch {
+  }
+  return [];
+}
+async function createProject(endpoint, cliToken, name) {
+  const base = trimTrailingSlash(endpoint);
+  const res = await deviceFetch(`${base}/v1/cli/projects`, {
+    method: "POST",
+    headers: cliAuthHeaders(cliToken),
+    body: JSON.stringify({ name })
+  });
+  const json = await res.json().catch(() => null);
+  if (!res.ok || !json?.ok || !json.data) {
+    throw new Error(json?.error?.message ?? `Could not create project (HTTP ${res.status}).`);
+  }
+  const { id, name: created, slug, apiKey } = json.data;
+  return { id, name: created, slug, apiKey: apiKey ?? null };
+}
+async function mintProjectKey(endpoint, cliToken, projectId) {
+  const base = trimTrailingSlash(endpoint);
+  try {
+    const res = await deviceFetch(`${base}/v1/cli/projects/${projectId}/keys`, {
+      method: "POST",
+      headers: cliAuthHeaders(cliToken),
+      body: JSON.stringify({})
+    });
+    const json = await res.json().catch(() => null);
+    if (res.ok && json?.ok) return json.data?.key ?? null;
+  } catch {
+  }
+  return null;
+}
+
 // src/freshness.ts
 var REGISTRY = "https://registry.npmjs.org";
 var DEFAULT_TIMEOUT_MS = 2e3;
@@ -392,8 +560,8 @@ async function runInit(options = {}) {
   const detected = detectFramework(cwd, pkg);
   const framework = await chooseFramework(detected, options);
   const consoleBase = await resolveConsoleUrl({ cwd });
-  await maybeGuideConsoleSetup(options, consoleBase);
-  const credentials = await collectCredentials(options, consoleBase);
+  const endpoint = resolveCloudEndpoint(options.endpoint);
+  const credentials = await acquireCredentials(options, consoleBase, endpoint);
   await verifyCredentials(credentials, options, consoleBase);
   const pm = detectPackageManager(cwd);
   const packagesToInstall = framework.needsWebPackage ? [framework.packageName, "@mushi-mushi/web"] : [framework.packageName];
@@ -402,7 +570,6 @@ async function runInit(options = {}) {
   } else {
     p.log.info(`Skipped install. Run \`${installCommand(pm, packagesToInstall)}\` yourself.`);
   }
-  const endpoint = resolveCloudEndpoint(options.endpoint);
   writeEnvFile(cwd, credentials.apiKey, credentials.projectId, framework);
   persistCliConfig(credentials.apiKey, credentials.projectId, endpoint);
   const enableRewards = await maybeEnableRewards(options);
@@ -449,63 +616,17 @@ async function chooseFramework(detected, options) {
   }
   return FRAMEWORKS[confirmed];
 }
-async function maybeGuideConsoleSetup(options, consoleBase) {
-  if (options.yes) return;
-  if (options.projectId && options.apiKey) return;
-  const existing = loadConfig();
-  if (existing.projectId && existing.apiKey) return;
-  const choice = await p.select({
-    message: "Do you already have a Mushi project?",
-    options: [
-      {
-        value: "create",
-        label: "No \u2014 open the console to create one",
-        hint: "Recommended for first-time setup"
-      },
-      {
-        value: "have",
-        label: "Yes \u2014 I have Project ID + API key",
-        hint: "Paste values from the admin console"
-      },
-      {
-        value: "login",
-        label: "Use mushi login first",
-        hint: "Run `mushi login` in another terminal, then re-run this wizard"
-      }
-    ]
-  });
-  if (p.isCancel(choice)) {
-    p.cancel("Aborted.");
-    process.exit(0);
-  }
-  if (choice === "login") {
-    p.log.info("Run `mushi login` to save credentials, then re-run `mushi init`.");
-    p.cancel("Aborted.");
-    process.exit(0);
-  }
-  if (choice !== "create") return;
-  const setupUrl = cliSetupDeepLink(consoleBase);
-  p.log.info(`Opening the Mushi console:
-  ${setupUrl}`);
-  await openInBrowser(setupUrl);
-  p.log.message("In the console:");
-  p.log.message("  1. Enter a project name and click Create");
-  p.log.message("  2. Copy the Project ID from the success panel");
-  p.log.message("  3. Generate an API key (Verify tab \u2014 report:write scope)");
-  p.log.message("  4. Return here and paste both values");
-  const ready = await p.confirm({
-    message: "Created your project and ready to paste credentials?",
-    initialValue: false
-  });
-  if (p.isCancel(ready) || !ready) {
-    p.log.warn(`Finish in the console first: ${setupUrl}`);
+async function acquireCredentials(options, consoleBase, endpoint) {
+  if (options.projectId && options.apiKey) {
+    return {
+      projectId: sanitizeSecret(options.projectId),
+      apiKey: sanitizeSecret(options.apiKey)
+    };
   }
-}
-async function collectCredentials(options, consoleBase) {
   const existing = loadConfig();
   if (!options.projectId && !options.apiKey && existing.projectId && existing.apiKey) {
     const reuse = options.yes ? true : await p.confirm({
-      message: "Use Project ID + API key from ~/.config/mushi/config.json?",
+      message: "Use the Mushi credentials saved from your last sign-in?",
       initialValue: true
     });
     if (p.isCancel(reuse)) {
@@ -519,6 +640,124 @@ async function collectCredentials(options, consoleBase) {
       };
     }
   }
+  if (options.yes) {
+    const creds = await runBrowserSignIn(options, endpoint);
+    if (creds) return creds;
+    p.log.warn("Browser sign-in didn't complete \u2014 switching to manual entry.");
+  } else {
+    const method = await p.select({
+      message: "Connect this app to Mushi",
+      initialValue: "browser",
+      options: [
+        {
+          value: "browser",
+          label: "Sign in with your browser",
+          hint: "Recommended \u2014 no copy-paste, creates the project + key for you"
+        },
+        {
+          value: "manual",
+          label: "Paste a Project ID + API key",
+          hint: "Self-hosted or expert setup"
+        }
+      ]
+    });
+    if (p.isCancel(method)) {
+      p.cancel("Aborted.");
+      process.exit(0);
+    }
+    if (method === "browser") {
+      const creds = await runBrowserSignIn(options, endpoint);
+      if (creds) return creds;
+      p.log.warn("Browser sign-in didn't complete \u2014 switching to manual entry.");
+    }
+  }
+  return collectCredentialsManually(options, consoleBase);
+}
+async function runBrowserSignIn(options, endpoint) {
+  const startSpin = p.spinner();
+  startSpin.start("Starting secure browser sign-in\u2026");
+  let session;
+  try {
+    session = await startDeviceAuth(endpoint);
+  } catch (err) {
+    startSpin.stop("Could not start browser sign-in.");
+    p.log.warn(err instanceof Error ? err.message : String(err));
+    return null;
+  }
+  startSpin.stop("Browser sign-in ready.");
+  p.log.step(`Confirmation code: ${session.user_code}`);
+  p.log.info(`Opening ${session.verification_uri}`);
+  try {
+    await openInBrowser(session.verification_uri);
+  } catch {
+  }
+  p.log.message("Approve the request in your browser to continue. (Ctrl+C to cancel)");
+  const waitSpin = p.spinner();
+  waitSpin.start("Waiting for you to approve in the browser\u2026");
+  let cliToken;
+  try {
+    cliToken = await waitForCliToken(endpoint, session);
+  } catch (err) {
+    waitSpin.stop("Browser sign-in didn't complete.");
+    p.log.warn(err instanceof Error ? err.message : String(err));
+    return null;
+  }
+  waitSpin.stop("Approved.");
+  let projectId = options.projectId ? sanitizeSecret(options.projectId) : void 0;
+  let apiKey;
+  if (!projectId) {
+    let projects = [];
+    try {
+      projects = await listProjects(endpoint, cliToken);
+    } catch {
+    }
+    const NEW = "__new__";
+    const choice = await p.select({
+      message: "Choose a project",
+      initialValue: projects[0]?.id ?? NEW,
+      options: [
+        ...projects.map((pr) => ({ value: pr.id, label: pr.name, hint: pr.id.slice(0, 8) })),
+        { value: NEW, label: "Create a new project", hint: "mints an SDK key automatically" }
+      ]
+    });
+    if (p.isCancel(choice)) {
+      p.cancel("Aborted.");
+      process.exit(0);
+    }
+    if (choice === NEW) {
+      const name = await p.text({
+        message: "Project name",
+        placeholder: "My app",
+        validate: (v) => v && v.trim().length > 0 ? void 0 : "Required"
+      });
+      if (p.isCancel(name)) {
+        p.cancel("Aborted.");
+        process.exit(0);
+      }
+      const createSpin = p.spinner();
+      createSpin.start(`Creating "${name.trim()}"\u2026`);
+      try {
+        const created = await createProject(endpoint, cliToken, name.trim());
+        projectId = created.id;
+        apiKey = created.apiKey ?? void 0;
+        createSpin.stop(`Created project "${created.name}".`);
+      } catch (err) {
+        createSpin.stop("Could not create the project.");
+        p.log.warn(err instanceof Error ? err.message : String(err));
+        return null;
+      }
+    } else {
+      projectId = choice;
+    }
+  }
+  if (projectId && !apiKey) {
+    apiKey = await mintProjectKey(endpoint, cliToken, projectId) ?? void 0;
+  }
+  if (!projectId || !apiKey) return null;
+  return { apiKey, projectId };
+}
+async function collectCredentialsManually(options, consoleBase) {
+  const existing = loadConfig();
   const rawProjectId = options.projectId ?? existing.projectId ?? await promptText({
     message: "Project ID",
     placeholder: "e.g. bdafa28d-b153-482f-bd4f-42981f3fd3a4",

package/dist/version.js

@@ -1,6 +1,6 @@
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-T4XX5FMH.js";
+} from "./chunk-6LM2KW4S.js";
 export {
   MUSHI_CLI_VERSION
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mushi-mushi/cli",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "license": "MIT",
   "description": "CLI for Mushi Mushi — `mushi init` wizard installs the right SDK for your framework, plus report triage and pipeline health commands",
   "bin": {

package/dist/chunk-T4XX5FMH.js

@@ -1,6 +0,0 @@
-// src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.19.0" : "0.0.0-dev";
-
-export {
-  MUSHI_CLI_VERSION
-};