@mushi-mushi/cli 0.23.0 → 0.23.1

package/README.md

@@ -86,6 +86,20 @@ Monorepo awareness: if you run the wizard at a workspace root with no framework
 
 Console URL resolution: `MUSHI_CONSOLE_URL` → saved `consoleUrl` in config → localhost `:6464` probe → mushi-mushi monorepo heuristic → hosted default. Saved on successful `mushi login`.
 
+### Browser sign-in reliability
+
+Device auth (RFC 8628) uses a stable per-machine `client_id` stored in
+`~/.config/mushi/config.json`. Starting a new login on the same machine supersedes
+any older pending approval for that id.
+
+During token polling the CLI retries **429** and **408** responses automatically.
+If saved credentials exist, re-running the wizard validates them with
+`GET /v1/sync/whoami` before reinstalling.
+
+The browser approval page waits until the CLI actually claims the token (not
+just when you click Approve). Full flow + troubleshooting:
+[CLI ↔ console loop](https://kensaur.us/mushi-mushi/docs/quickstart/cli-console-loop).
+
 ## Install globally
 
 ```bash
@@ -212,6 +226,18 @@ the CLI never points users at a 404. This safety property is unit-pinned in
 `packages/cli/src/migrate.test.ts` (positive control + negative control +
 real-catalog regression guard).
 
+### `mushi completion`
+
+Prints a tab-completion script for bash, zsh, or fish, generated from the
+CLI's live command tree — so it never drifts as commands are added.
+
+```bash
+eval "$(mushi completion bash)"                      # try it for the current session
+mushi completion bash >> ~/.bashrc                   # bash: persist across sessions
+mushi completion zsh > "${fpath[1]}/_mushi"           # zsh: needs a dir already on $fpath
+mushi completion fish > ~/.config/fish/completions/mushi.fish
+```
+
 ### `mushi doctor`
 
 Checks CLI and SDK health. **Ingest and dispatch (server) checks run by

package/dist/chunk-I4UK3WTN.js

@@ -0,0 +1,6 @@
+// src/version.ts
+var MUSHI_CLI_VERSION = true ? "0.23.1" : "0.0.0-dev";
+
+export {
+  MUSHI_CLI_VERSION
+};

package/dist/{chunk-GSQO35YD.js → chunk-M6L22NJU.js}

@@ -10,6 +10,7 @@ import { appendFile, readFile as readFile2, writeFile as writeFile2 } from "fs/p
 import { join as join4, resolve } from "path";
 
 // src/config.ts
+import { randomUUID } from "crypto";
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
 import { homedir } from "os";
 import { dirname, join } from "path";
@@ -50,6 +51,18 @@ function loadConfig(path = CONFIG_PATH) {
   };
   return { ...file, ...fromEnv };
 }
+function ensureClientId(path = CONFIG_PATH) {
+  const existing = loadConfig(path);
+  if (existing.clientId && /^[A-Za-z0-9_-]{8,64}$/.test(existing.clientId)) {
+    return existing.clientId;
+  }
+  const clientId = `cli_${randomUUID().replace(/-/g, "")}`;
+  try {
+    saveConfig({ ...existing, clientId }, path);
+  } catch {
+  }
+  return clientId;
+}
 function saveConfig(config, path = CONFIG_PATH) {
   const dir = dirname(path);
   if (!existsSync(dir)) {
@@ -103,7 +116,7 @@ function tightenDirPermissions(path) {
 }
 
 // src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.23.0" : "0.0.0-dev";
+var MUSHI_CLI_VERSION = true ? "0.23.1" : "0.0.0-dev";
 
 // src/errors.ts
 var EXIT_CODE_MAP = {
@@ -1214,6 +1227,7 @@ export {
   installSignalHandlers,
   MUSHI_CLI_VERSION,
   loadConfig,
+  ensureClientId,
   saveConfig,
   FRAMEWORKS,
   readPackageJson,

package/dist/{chunk-WLLFV26V.js → chunk-NZ64LBLU.js}

@@ -1,8 +1,9 @@
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-BY5SZYRO.js";
+} from "./chunk-I4UK3WTN.js";
 
 // src/config.ts
+import { randomUUID } from "crypto";
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
 import { homedir } from "os";
 import { dirname, join } from "path";
@@ -43,6 +44,18 @@ function loadConfig(path = CONFIG_PATH) {
   };
   return { ...file, ...fromEnv };
 }
+function ensureClientId(path = CONFIG_PATH) {
+  const existing = loadConfig(path);
+  if (existing.clientId && /^[A-Za-z0-9_-]{8,64}$/.test(existing.clientId)) {
+    return existing.clientId;
+  }
+  const clientId = `cli_${randomUUID().replace(/-/g, "")}`;
+  try {
+    saveConfig({ ...existing, clientId }, path);
+  } catch {
+  }
+  return clientId;
+}
 function saveConfig(config, path = CONFIG_PATH) {
   const dir = dirname(path);
   if (!existsSync(dir)) {
@@ -405,6 +418,7 @@ async function apiCall(path, config, options = {}) {
 export {
   CONFIG_PATH,
   loadConfig,
+  ensureClientId,
   saveConfig,
   consoleUrl,
   resolveConsoleUrlSync,

package/dist/{connect-XFVSH4JZ.js → connect-5VPUYE6H.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runConnect
-} from "./chunk-GSQO35YD.js";
+} from "./chunk-M6L22NJU.js";
 import "./chunk-LDPFTQLE.js";
 export {
   runConnect

package/dist/{connect-KX4UGY6Z.js → connect-IWFKKXGZ.js}

@@ -4,13 +4,13 @@ import {
   normalizeEndpoint,
   requireUuid,
   saveConfig
-} from "./chunk-WLLFV26V.js";
+} from "./chunk-NZ64LBLU.js";
 import {
   detectFramework,
   envVarsToWrite,
   readPackageJson
 } from "./chunk-AIZRI665.js";
-import "./chunk-BY5SZYRO.js";
+import "./chunk-I4UK3WTN.js";
 
 // src/connect.ts
 import { appendFile, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";

package/dist/index.js

@@ -12,6 +12,7 @@ import {
   detectFramework,
   detectPackageManager,
   die,
+  ensureClientId,
   envVarsToWrite,
   fetchIngestSetup,
   fmtDate,
@@ -36,7 +37,7 @@ import {
   sanitizeProjectId,
   saveConfig,
   writeMcpServerEntry
-} from "./chunk-GSQO35YD.js";
+} from "./chunk-M6L22NJU.js";
 import {
   TEST_REPORT_FETCH_TIMEOUT_MS,
   assertEndpoint,
@@ -56,6 +57,7 @@ import { join as join2 } from "path";
 
 // src/device-auth.ts
 var DEVICE_FETCH_TIMEOUT_MS = 15e3;
+var DEFAULT_SLOW_DOWN_MS = 5e3;
 function trimTrailingSlash(endpoint) {
   let end = endpoint.length;
   while (end > 0 && endpoint.charCodeAt(end - 1) === 47) end--;
@@ -70,11 +72,12 @@ async function deviceFetch(url, init = {}) {
     clearTimeout(timer);
   }
 }
-async function startDeviceAuth(endpoint) {
+async function startDeviceAuth(endpoint, clientId) {
   const base = trimTrailingSlash(endpoint);
   const res = await deviceFetch(`${base}/v1/cli/auth/device/start`, {
     method: "POST",
-    headers: { "Content-Type": "application/json" }
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(clientId ? { client_id: clientId } : {})
   });
   const json = await res.json().catch(() => null);
   if (!res.ok || !json?.ok || !json.data) {
@@ -97,6 +100,12 @@ async function pollDeviceToken(endpoint, deviceCode) {
     switch (json.error) {
       case "authorization_pending":
         return { status: "pending" };
+      case "slow_down": {
+        const retryAfterHeader = res.headers?.get?.("Retry-After");
+        const retryAfterSeconds = retryAfterHeader ? Number(retryAfterHeader) : NaN;
+        const retryAfterMs = Number.isFinite(retryAfterSeconds) && retryAfterSeconds > 0 ? retryAfterSeconds * 1e3 : DEFAULT_SLOW_DOWN_MS;
+        return { status: "slow_down", retryAfterMs };
+      }
       case "access_denied":
         return { status: "denied" };
       case "expired_token":
@@ -105,9 +114,11 @@ async function pollDeviceToken(endpoint, deviceCode) {
         return {
           status: "error",
           message: json.error_description ?? json.error ?? `HTTP ${res.status}`,
-          // 5xx is a server hiccup the next poll may clear; a 4xx is a definitive
-          // rejection (already claimed / invalid_grant) that won't fix itself.
-          retryable: res.status >= 500
+          // 5xx is a server hiccup the next poll may clear; 408 (gateway
+          // timeout) is equally transient. Any other 4xx is a definitive
+          // rejection (already claimed / invalid_grant) that won't fix
+          // itself. (429/slow_down is handled above as its own outcome.)
+          retryable: res.status >= 500 || res.status === 408
         };
     }
   } catch (err) {
@@ -118,7 +129,7 @@ var defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
 async function waitForCliToken(endpoint, session, opts = {}) {
   const sleep = opts.sleep ?? defaultSleep;
   const now = opts.now ?? Date.now;
-  const intervalMs = (session.interval || 5) * 1e3;
+  let intervalMs = (session.interval || 5) * 1e3;
   const deadline = now() + (session.expires_in || 600) * 1e3;
   const maxConsecutiveErrors = opts.maxConsecutiveErrors ?? 5;
   let consecutiveErrors = 0;
@@ -136,6 +147,11 @@ async function waitForCliToken(endpoint, session, opts = {}) {
         consecutiveErrors = 0;
         opts.onPending?.();
         continue;
+      case "slow_down":
+        consecutiveErrors = 0;
+        intervalMs = Math.max(intervalMs, outcome.retryAfterMs);
+        opts.onSlowDown?.(outcome.retryAfterMs);
+        continue;
       case "denied":
         throw new Error("Login was denied in the browser.");
       case "expired":
@@ -431,7 +447,10 @@ async function runInit(options = {}) {
   const detected = detectFramework(cwd, pkg);
   const framework = await chooseFramework(detected, options);
   const consoleBase = await resolveConsoleUrl({ cwd });
-  const endpoint = resolveCloudEndpoint(options.endpoint);
+  const endpoint = resolveCloudEndpoint(
+    options.endpoint ?? process.env.MUSHI_API_ENDPOINT?.trim() ?? loadConfig().endpoint
+  );
+  options = { ...options, endpoint };
   const credentials = await acquireCredentials(options, consoleBase, endpoint);
   await verifyCredentials(credentials, options, consoleBase);
   const pm = detectPackageManager(cwd);
@@ -542,14 +561,14 @@ async function acquireCredentials(options, consoleBase, endpoint) {
       p.log.warn("Browser sign-in didn't complete \u2014 switching to manual entry.");
     }
   }
-  return collectCredentialsManually(options, consoleBase);
+  return collectCredentialsManually(options, consoleBase, endpoint);
 }
 async function runBrowserSignIn(options, endpoint, consoleBase) {
   const startSpin = p.spinner();
   startSpin.start("Starting secure browser sign-in\u2026");
   let session;
   try {
-    session = await startDeviceAuth(endpoint);
+    session = await startDeviceAuth(endpoint, ensureClientId());
   } catch (err) {
     startSpin.stop("Could not start browser sign-in.");
     p.log.warn(err instanceof Error ? err.message : String(err));
@@ -647,15 +666,36 @@ async function runBrowserSignIn(options, endpoint, consoleBase) {
   if (!projectId || !apiKey) return null;
   return { apiKey, projectId };
 }
-async function collectCredentialsManually(options, consoleBase) {
+async function collectCredentialsManually(options, consoleBase, endpoint) {
   const existing = loadConfig();
-  const rawProjectId = options.projectId ?? existing.projectId ?? await promptText({
+  let savedProjectId = existing.projectId;
+  let savedApiKey = existing.apiKey;
+  if (!options.projectId && !options.apiKey && savedProjectId && savedApiKey) {
+    p.log.info(
+      `Found saved credentials from a previous sign-in (project ${sanitizeSecret(savedProjectId).slice(0, 8)}\u2026).`
+    );
+    const checkSpin = p.spinner();
+    checkSpin.start("Checking saved credentials\u2026");
+    const check = await apiCall("/v1/sync/whoami", {
+      apiKey: sanitizeSecret(savedApiKey),
+      projectId: sanitizeSecret(savedProjectId),
+      endpoint
+    });
+    if (check.ok) {
+      checkSpin.stop(`Saved credentials still work (${check.data.project_name}).`);
+    } else {
+      checkSpin.stop("Saved credentials no longer authenticate \u2014 enter fresh ones below.");
+      savedProjectId = void 0;
+      savedApiKey = void 0;
+    }
+  }
+  const rawProjectId = options.projectId ?? savedProjectId ?? await promptText({
     message: "Project ID",
     placeholder: "e.g. bdafa28d-b153-482f-bd4f-42981f3fd3a4",
     hint: projectIdHint(consoleBase),
     validate: (v) => PROJECT_ID_PATTERN.test(v.trim()) ? void 0 : "Expected a UUID \u2014 copy it from the Projects page or the panel right after you create a project."
   });
-  const rawApiKey = options.apiKey ?? existing.apiKey ?? await promptText({
+  const rawApiKey = options.apiKey ?? savedApiKey ?? await promptText({
     message: "API key",
     placeholder: "mushi_xxxxxxxxxxxx",
     hint: apiKeyHint(consoleBase),
@@ -686,10 +726,22 @@ async function verifyCredentials(credentials, options, consoleBase) {
   if (!result.ok) {
     spinner3.stop("Credentials could not be verified.");
     p.log.error(result.error?.message ?? "Authentication failed.");
-    p.log.info(`Double-check values in the console:
-  ${cliSetupDeepLink(consoleBase)}`);
+    p.log.warn("Setup did NOT complete: nothing was installed and no env vars were written.");
+    p.log.info(
+      [
+        "To recover:",
+        '  \u2022 Re-run `npx mushi-mushi` and choose "Sign in with your browser", or',
+        `  \u2022 Double-check the Project ID / API key in the console: ${cliSetupDeepLink(consoleBase)}`
+      ].join("\n")
+    );
     throw new Error("Credential verification failed \u2014 fix Project ID / API key and re-run.");
   }
+  if (result.data.project_id && result.data.project_id !== credentials.projectId) {
+    p.log.warn(
+      `Project ID ${redact(credentials.projectId)} doesn't match this API key's project \u2014 using the key's actual project (${result.data.project_name}) instead.`
+    );
+    credentials.projectId = result.data.project_id;
+  }
   spinner3.stop(`Connected to ${result.data.project_name}`);
 }
 function sanitizeSecret(raw) {
@@ -858,7 +910,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect: runConnect2 } = await import("./connect-XFVSH4JZ.js");
+    const { runConnect: runConnect2 } = await import("./connect-5VPUYE6H.js");
     await runConnect2({
       apiKey: credentials.apiKey,
       projectId: credentials.projectId,
@@ -1201,7 +1253,7 @@ Examples:
     }
     let deviceData;
     try {
-      deviceData = await startDeviceAuth(endpoint);
+      deviceData = await startDeviceAuth(endpoint, ensureClientId());
     } catch (err) {
       process.stderr.write(`
 error: Could not start login session: ${err instanceof Error ? err.message : String(err)}
@@ -2208,7 +2260,7 @@ Typical first-time flow:
     console.log("");
     let session;
     try {
-      session = await startDeviceAuth(endpoint);
+      session = await startDeviceAuth(endpoint, ensureClientId());
     } catch (err) {
       process.stderr.write(`
 error: Could not start browser sign-in: ${err instanceof Error ? err.message : String(err)}
@@ -4789,6 +4841,131 @@ Examples:
   });
 }
 
+// src/commands/completion-cli.ts
+import { Argument } from "commander";
+
+// src/completion.ts
+var SUPPORTED_SHELLS = ["bash", "zsh", "fish"];
+function isSupportedShell(value) {
+  return SUPPORTED_SHELLS.includes(value);
+}
+function buildCommandTree(program2) {
+  return program2.commands.filter((cmd) => cmd.name() !== "help").map((cmd) => ({
+    name: cmd.name(),
+    subcommands: cmd.commands.filter((sub) => sub.name() !== "help").map((sub) => sub.name()).sort()
+  })).sort((a, b) => a.name.localeCompare(b.name));
+}
+var COMPLETION_ARG_VALUES = [...SUPPORTED_SHELLS];
+function subcommandsFor(tree, name) {
+  if (name === "completion") return COMPLETION_ARG_VALUES;
+  return tree.find((n) => n.name === name)?.subcommands ?? [];
+}
+function generateBash(tree) {
+  const topLevel = tree.map((n) => n.name).join(" ");
+  const cases = tree.map((n) => {
+    const subs = subcommandsFor(tree, n.name);
+    if (subs.length === 0) return null;
+    return `    ${n.name})
+      COMPREPLY=( $(compgen -W "${subs.join(" ")}" -- "$cur") )
+      ;;`;
+  }).filter((line) => line !== null).join("\n");
+  return `###-begin-mushi-completion-###
+# mushi(1) completion \u2014 https://github.com/kensaurus/mushi-mushi
+# Install: mushi completion bash >> ~/.bashrc   (then restart your shell)
+_mushi_completion() {
+  local cur
+  cur="\${COMP_WORDS[COMP_CWORD]}"
+  COMPREPLY=()
+
+  if [ "$COMP_CWORD" -eq 1 ]; then
+    COMPREPLY=( $(compgen -W "${topLevel}" -- "$cur") )
+    return 0
+  fi
+
+  case "\${COMP_WORDS[1]}" in
+${cases}
+    *)
+      ;;
+  esac
+}
+complete -F _mushi_completion mushi
+###-end-mushi-completion-###
+`;
+}
+function generateZsh(tree) {
+  const topLevel = tree.map((n) => n.name).join(" ");
+  const cases = tree.map((n) => {
+    const subs = subcommandsFor(tree, n.name);
+    if (subs.length === 0) return null;
+    return `    ${n.name})
+      local -a subcmds; subcmds=(${subs.join(" ")})
+      _describe '${n.name} subcommand' subcmds
+      ;;`;
+  }).filter((line) => line !== null).join("\n");
+  return `#compdef mushi
+# mushi(1) completion \u2014 https://github.com/kensaurus/mushi-mushi
+# Install: mushi completion zsh > "\${fpath[1]}/_mushi"   (then restart your shell)
+_mushi() {
+  local -a top_level
+  top_level=(${topLevel})
+
+  if (( CURRENT == 2 )); then
+    _describe 'command' top_level
+    return
+  fi
+
+  case "\${words[2]}" in
+${cases}
+    *)
+      ;;
+  esac
+}
+
+_mushi
+`;
+}
+function generateFish(tree) {
+  const topLevel = tree.map((n) => n.name).join(" ");
+  const lines = [
+    "# mushi(1) completion \u2014 https://github.com/kensaurus/mushi-mushi",
+    "# Install: mushi completion fish > ~/.config/fish/completions/mushi.fish",
+    `complete -c mushi -f -n "__fish_use_subcommand" -a "${topLevel}"`
+  ];
+  for (const n of tree) {
+    const subs = subcommandsFor(tree, n.name);
+    if (subs.length === 0) continue;
+    lines.push(`complete -c mushi -f -n "__fish_seen_subcommand_from ${n.name}" -a "${subs.join(" ")}"`);
+  }
+  return lines.join("\n") + "\n";
+}
+function generateCompletionScript(shell, tree) {
+  switch (shell) {
+    case "bash":
+      return generateBash(tree);
+    case "zsh":
+      return generateZsh(tree);
+    case "fish":
+      return generateFish(tree);
+  }
+}
+
+// src/commands/completion-cli.ts
+function registerCompletionCommand(program2) {
+  program2.command("completion").description("Print a shell completion script for bash, zsh, or fish").addArgument(new Argument("<shell>", "Target shell").choices([...SUPPORTED_SHELLS])).addHelpText("after", `
+Examples:
+  eval "$(mushi completion bash)"                      # try it for the current session
+  mushi completion bash >> ~/.bashrc                   # bash: persist across sessions
+  mushi completion zsh > "\${fpath[1]}/_mushi"           # zsh: needs a dir already on $fpath
+  mushi completion fish > ~/.config/fish/completions/mushi.fish`).action((shell) => {
+    if (!isSupportedShell(shell)) {
+      console.error(`Unsupported shell "${shell}". Supported: ${SUPPORTED_SHELLS.join(", ")}`);
+      process.exit(2);
+    }
+    const tree = buildCommandTree(program2);
+    console.log(generateCompletionScript(shell, tree));
+  });
+}
+
 // src/index.ts
 installSignalHandlers();
 var program = new Command().name("mushi").description("Mushi CLI \u2014 set up the SDK, triage a report, fix from your editor").version(MUSHI_CLI_VERSION).addHelpText("after", `
@@ -4827,6 +5004,7 @@ registerQaCommands(program);
 registerAuditCommands(program);
 registerSkillsCommands(program);
 registerBillingCommands(program);
+registerCompletionCommand(program);
 program.parseAsync().catch((err) => {
   printAndExit(err);
 });

package/dist/init.js

@@ -4,6 +4,7 @@ import {
   apiKeyHint,
   cliSetupDeepLink,
   consoleUrl,
+  ensureClientId,
   loadConfig,
   normalizeEndpoint,
   openInBrowser,
@@ -13,7 +14,7 @@ import {
   resolveConsoleUrl,
   resolveConsoleUrlSync,
   saveConfig
-} from "./chunk-WLLFV26V.js";
+} from "./chunk-NZ64LBLU.js";
 import {
   FRAMEWORKS,
   detectFramework,
@@ -24,7 +25,7 @@ import {
 } from "./chunk-AIZRI665.js";
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-BY5SZYRO.js";
+} from "./chunk-I4UK3WTN.js";
 
 // src/init.ts
 import * as p from "@clack/prompts";
@@ -35,6 +36,7 @@ import { join as join2 } from "path";
 
 // src/device-auth.ts
 var DEVICE_FETCH_TIMEOUT_MS = 15e3;
+var DEFAULT_SLOW_DOWN_MS = 5e3;
 function trimTrailingSlash(endpoint) {
   let end = endpoint.length;
   while (end > 0 && endpoint.charCodeAt(end - 1) === 47) end--;
@@ -49,11 +51,12 @@ async function deviceFetch(url, init = {}) {
     clearTimeout(timer);
   }
 }
-async function startDeviceAuth(endpoint) {
+async function startDeviceAuth(endpoint, clientId) {
   const base = trimTrailingSlash(endpoint);
   const res = await deviceFetch(`${base}/v1/cli/auth/device/start`, {
     method: "POST",
-    headers: { "Content-Type": "application/json" }
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(clientId ? { client_id: clientId } : {})
   });
   const json = await res.json().catch(() => null);
   if (!res.ok || !json?.ok || !json.data) {
@@ -76,6 +79,12 @@ async function pollDeviceToken(endpoint, deviceCode) {
     switch (json.error) {
       case "authorization_pending":
         return { status: "pending" };
+      case "slow_down": {
+        const retryAfterHeader = res.headers?.get?.("Retry-After");
+        const retryAfterSeconds = retryAfterHeader ? Number(retryAfterHeader) : NaN;
+        const retryAfterMs = Number.isFinite(retryAfterSeconds) && retryAfterSeconds > 0 ? retryAfterSeconds * 1e3 : DEFAULT_SLOW_DOWN_MS;
+        return { status: "slow_down", retryAfterMs };
+      }
       case "access_denied":
         return { status: "denied" };
       case "expired_token":
@@ -84,9 +93,11 @@ async function pollDeviceToken(endpoint, deviceCode) {
         return {
           status: "error",
           message: json.error_description ?? json.error ?? `HTTP ${res.status}`,
-          // 5xx is a server hiccup the next poll may clear; a 4xx is a definitive
-          // rejection (already claimed / invalid_grant) that won't fix itself.
-          retryable: res.status >= 500
+          // 5xx is a server hiccup the next poll may clear; 408 (gateway
+          // timeout) is equally transient. Any other 4xx is a definitive
+          // rejection (already claimed / invalid_grant) that won't fix
+          // itself. (429/slow_down is handled above as its own outcome.)
+          retryable: res.status >= 500 || res.status === 408
         };
     }
   } catch (err) {
@@ -97,7 +108,7 @@ var defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
 async function waitForCliToken(endpoint, session, opts = {}) {
   const sleep = opts.sleep ?? defaultSleep;
   const now = opts.now ?? Date.now;
-  const intervalMs = (session.interval || 5) * 1e3;
+  let intervalMs = (session.interval || 5) * 1e3;
   const deadline = now() + (session.expires_in || 600) * 1e3;
   const maxConsecutiveErrors = opts.maxConsecutiveErrors ?? 5;
   let consecutiveErrors = 0;
@@ -115,6 +126,11 @@ async function waitForCliToken(endpoint, session, opts = {}) {
         consecutiveErrors = 0;
         opts.onPending?.();
         continue;
+      case "slow_down":
+        consecutiveErrors = 0;
+        intervalMs = Math.max(intervalMs, outcome.retryAfterMs);
+        opts.onSlowDown?.(outcome.retryAfterMs);
+        continue;
       case "denied":
         throw new Error("Login was denied in the browser.");
       case "expired":
@@ -390,7 +406,10 @@ async function runInit(options = {}) {
   const detected = detectFramework(cwd, pkg);
   const framework = await chooseFramework(detected, options);
   const consoleBase = await resolveConsoleUrl({ cwd });
-  const endpoint = resolveCloudEndpoint(options.endpoint);
+  const endpoint = resolveCloudEndpoint(
+    options.endpoint ?? process.env.MUSHI_API_ENDPOINT?.trim() ?? loadConfig().endpoint
+  );
+  options = { ...options, endpoint };
   const credentials = await acquireCredentials(options, consoleBase, endpoint);
   await verifyCredentials(credentials, options, consoleBase);
   const pm = detectPackageManager(cwd);
@@ -501,14 +520,14 @@ async function acquireCredentials(options, consoleBase, endpoint) {
       p.log.warn("Browser sign-in didn't complete \u2014 switching to manual entry.");
     }
   }
-  return collectCredentialsManually(options, consoleBase);
+  return collectCredentialsManually(options, consoleBase, endpoint);
 }
 async function runBrowserSignIn(options, endpoint, consoleBase) {
   const startSpin = p.spinner();
   startSpin.start("Starting secure browser sign-in\u2026");
   let session;
   try {
-    session = await startDeviceAuth(endpoint);
+    session = await startDeviceAuth(endpoint, ensureClientId());
   } catch (err) {
     startSpin.stop("Could not start browser sign-in.");
     p.log.warn(err instanceof Error ? err.message : String(err));
@@ -606,15 +625,36 @@ async function runBrowserSignIn(options, endpoint, consoleBase) {
   if (!projectId || !apiKey) return null;
   return { apiKey, projectId };
 }
-async function collectCredentialsManually(options, consoleBase) {
+async function collectCredentialsManually(options, consoleBase, endpoint) {
   const existing = loadConfig();
-  const rawProjectId = options.projectId ?? existing.projectId ?? await promptText({
+  let savedProjectId = existing.projectId;
+  let savedApiKey = existing.apiKey;
+  if (!options.projectId && !options.apiKey && savedProjectId && savedApiKey) {
+    p.log.info(
+      `Found saved credentials from a previous sign-in (project ${sanitizeSecret(savedProjectId).slice(0, 8)}\u2026).`
+    );
+    const checkSpin = p.spinner();
+    checkSpin.start("Checking saved credentials\u2026");
+    const check = await apiCall("/v1/sync/whoami", {
+      apiKey: sanitizeSecret(savedApiKey),
+      projectId: sanitizeSecret(savedProjectId),
+      endpoint
+    });
+    if (check.ok) {
+      checkSpin.stop(`Saved credentials still work (${check.data.project_name}).`);
+    } else {
+      checkSpin.stop("Saved credentials no longer authenticate \u2014 enter fresh ones below.");
+      savedProjectId = void 0;
+      savedApiKey = void 0;
+    }
+  }
+  const rawProjectId = options.projectId ?? savedProjectId ?? await promptText({
     message: "Project ID",
     placeholder: "e.g. bdafa28d-b153-482f-bd4f-42981f3fd3a4",
     hint: projectIdHint(consoleBase),
     validate: (v) => PROJECT_ID_PATTERN.test(v.trim()) ? void 0 : "Expected a UUID \u2014 copy it from the Projects page or the panel right after you create a project."
   });
-  const rawApiKey = options.apiKey ?? existing.apiKey ?? await promptText({
+  const rawApiKey = options.apiKey ?? savedApiKey ?? await promptText({
     message: "API key",
     placeholder: "mushi_xxxxxxxxxxxx",
     hint: apiKeyHint(consoleBase),
@@ -645,10 +685,22 @@ async function verifyCredentials(credentials, options, consoleBase) {
   if (!result.ok) {
     spinner2.stop("Credentials could not be verified.");
     p.log.error(result.error?.message ?? "Authentication failed.");
-    p.log.info(`Double-check values in the console:
-  ${cliSetupDeepLink(consoleBase)}`);
+    p.log.warn("Setup did NOT complete: nothing was installed and no env vars were written.");
+    p.log.info(
+      [
+        "To recover:",
+        '  \u2022 Re-run `npx mushi-mushi` and choose "Sign in with your browser", or',
+        `  \u2022 Double-check the Project ID / API key in the console: ${cliSetupDeepLink(consoleBase)}`
+      ].join("\n")
+    );
     throw new Error("Credential verification failed \u2014 fix Project ID / API key and re-run.");
   }
+  if (result.data.project_id && result.data.project_id !== credentials.projectId) {
+    p.log.warn(
+      `Project ID ${redact(credentials.projectId)} doesn't match this API key's project \u2014 using the key's actual project (${result.data.project_name}) instead.`
+    );
+    credentials.projectId = result.data.project_id;
+  }
   spinner2.stop(`Connected to ${result.data.project_name}`);
 }
 function sanitizeSecret(raw) {
@@ -817,7 +869,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect } = await import("./connect-KX4UGY6Z.js");
+    const { runConnect } = await import("./connect-IWFKKXGZ.js");
     await runConnect({
       apiKey: credentials.apiKey,
       projectId: credentials.projectId,

package/dist/version.js

@@ -1,6 +1,6 @@
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-BY5SZYRO.js";
+} from "./chunk-I4UK3WTN.js";
 export {
   MUSHI_CLI_VERSION
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mushi-mushi/cli",
-  "version": "0.23.0",
+  "version": "0.23.1",
   "license": "MIT",
   "description": "CLI for Mushi Mushi — `mushi init` wizard installs the right SDK for your framework, plus report triage and pipeline health commands",
   "bin": {

package/dist/chunk-BY5SZYRO.js

@@ -1,6 +0,0 @@
-// src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.23.0" : "0.0.0-dev";
-
-export {
-  MUSHI_CLI_VERSION
-};