@mushi-mushi/cli 0.23.1 → 0.25.0

package/dist/index.js

@@ -37,7 +37,7 @@ import {
   sanitizeProjectId,
   saveConfig,
   writeMcpServerEntry
-} from "./chunk-M6L22NJU.js";
+} from "./chunk-3JRQN6S4.js";
 import {
   TEST_REPORT_FETCH_TIMEOUT_MS,
   assertEndpoint,
@@ -81,7 +81,9 @@ async function startDeviceAuth(endpoint, clientId) {
   });
   const json = await res.json().catch(() => null);
   if (!res.ok || !json?.ok || !json.data) {
-    throw new Error(json?.error?.message ?? `Could not start browser sign-in (HTTP ${res.status}).`);
+    throw new Error(
+      json?.error?.message ?? `Could not start browser sign-in (HTTP ${res.status}).`
+    );
   }
   return json.data;
 }
@@ -122,10 +124,15 @@ async function pollDeviceToken(endpoint, deviceCode) {
         };
     }
   } catch (err) {
-    return { status: "error", message: err instanceof Error ? err.message : String(err), retryable: true };
+    return {
+      status: "error",
+      message: err instanceof Error ? err.message : String(err),
+      retryable: true
+    };
   }
 }
 var defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+var deviceAuthRetryDelayMs = 1e3;
 async function waitForCliToken(endpoint, session, opts = {}) {
   const sleep = opts.sleep ?? defaultSleep;
   const now = opts.now ?? Date.now;
@@ -176,19 +183,51 @@ function cliAuthHeaders(cliToken) {
     Authorization: `Bearer ${cliToken}`
   };
 }
+var DeviceAuthRequestError = class extends Error {
+  step;
+  status;
+  retryable;
+  constructor(step, message, status) {
+    super(message);
+    this.name = "DeviceAuthRequestError";
+    this.step = step;
+    this.status = status;
+    this.retryable = status === void 0 || status >= 500 || status === 408;
+  }
+};
+async function withOneRetry(run) {
+  try {
+    return await run();
+  } catch (err) {
+    if (err instanceof DeviceAuthRequestError && err.retryable) {
+      if (deviceAuthRetryDelayMs > 0) {
+        await defaultSleep(deviceAuthRetryDelayMs);
+      }
+      return run();
+    }
+    throw err;
+  }
+}
 async function listProjects(endpoint, cliToken) {
   const base = trimTrailingSlash(endpoint);
-  try {
-    const res = await deviceFetch(`${base}/v1/cli/projects`, { headers: cliAuthHeaders(cliToken) });
+  return withOneRetry(async () => {
+    let res;
+    try {
+      res = await deviceFetch(`${base}/v1/cli/projects`, { headers: cliAuthHeaders(cliToken) });
+    } catch (err) {
+      throw new DeviceAuthRequestError(
+        "list_projects",
+        `Could not reach ${base}/v1/cli/projects: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
     const json = await res.json().catch(() => null);
     if (res.ok && json?.ok) return json.data?.projects ?? [];
-  } catch (err) {
-    console.error(
-      "[mushi] Failed to list projects:",
-      err instanceof Error ? err.message : err
+    throw new DeviceAuthRequestError(
+      "list_projects",
+      json?.error?.message ?? `Could not list projects (HTTP ${res.status}).`,
+      res.status
     );
-  }
-  return [];
+  });
 }
 async function createProject(endpoint, cliToken, name) {
   const base = trimTrailingSlash(endpoint);
@@ -206,17 +245,26 @@ async function createProject(endpoint, cliToken, name) {
 }
 async function mintProjectKey(endpoint, cliToken, projectId) {
   const base = trimTrailingSlash(endpoint);
+  let res;
   try {
-    const res = await deviceFetch(`${base}/v1/cli/projects/${projectId}/keys`, {
+    res = await deviceFetch(`${base}/v1/cli/projects/${projectId}/keys`, {
       method: "POST",
       headers: cliAuthHeaders(cliToken),
       body: JSON.stringify({})
     });
-    const json = await res.json().catch(() => null);
-    if (res.ok && json?.ok) return json.data?.key ?? null;
-  } catch {
+  } catch (err) {
+    throw new DeviceAuthRequestError(
+      "mint_key",
+      `Could not reach ${base}/v1/cli/projects/\u2026/keys: ${err instanceof Error ? err.message : String(err)}`
+    );
   }
-  return null;
+  const json = await res.json().catch(() => null);
+  if (res.ok && json?.ok && json.data?.key) return json.data.key;
+  throw new DeviceAuthRequestError(
+    "mint_key",
+    json?.error?.message ?? `Could not mint an SDK key (HTTP ${res.status}).`,
+    res.status
+  );
 }
 
 // src/freshness.ts
@@ -460,8 +508,16 @@ async function runInit(options = {}) {
   } else {
     p.log.info(`Skipped install. Run \`${installCommand(pm, packagesToInstall)}\` yourself.`);
   }
-  await writeEnvFile(cwd, credentials.apiKey, credentials.projectId, framework, endpoint, Boolean(options.yes));
+  await writeEnvFile(
+    cwd,
+    credentials.apiKey,
+    credentials.projectId,
+    framework,
+    endpoint,
+    Boolean(options.yes)
+  );
   persistCliConfig(credentials.apiKey, credentials.projectId, endpoint);
+  emitWizardFunnelEvent(credentials, endpoint, "wizard_env_written", { framework: framework.id });
   const enableRewards = await maybeEnableRewards(options);
   printNextSteps(framework, consoleBase, enableRewards);
   await maybeSendTestReport(credentials, { ...options, endpoint, consoleBase });
@@ -533,7 +589,9 @@ async function acquireCredentials(options, consoleBase, endpoint) {
   if (options.yes) {
     const creds = await runBrowserSignIn(options, endpoint, consoleBase);
     if (creds) return creds;
-    p.log.warn("Browser sign-in didn't complete \u2014 switching to manual entry.");
+    p.log.warn(
+      "Browser sign-in didn't complete \u2014 switching to manual entry. Run `npx mushi-mushi doctor --auth` to diagnose the sign-in path."
+    );
   } else {
     const method = await p.select({
       message: "Connect this app to Mushi",
@@ -558,7 +616,9 @@ async function acquireCredentials(options, consoleBase, endpoint) {
     if (method === "browser") {
       const creds = await runBrowserSignIn(options, endpoint, consoleBase);
       if (creds) return creds;
-      p.log.warn("Browser sign-in didn't complete \u2014 switching to manual entry.");
+      p.log.warn(
+        "Browser sign-in didn't complete \u2014 switching to manual entry. Run `npx mushi-mushi doctor --auth` to diagnose the sign-in path."
+      );
     }
   }
   return collectCredentialsManually(options, consoleBase, endpoint);
@@ -599,7 +659,9 @@ async function runBrowserSignIn(options, endpoint, consoleBase) {
     fetchSpin.start("Loading your projects\u2026");
     try {
       projects = await listProjects(endpoint, cliToken);
-      fetchSpin.stop(projects.length > 0 ? `Found ${projects.length} project(s).` : "No projects yet.");
+      fetchSpin.stop(
+        projects.length > 0 ? `Found ${projects.length} project(s).` : "No projects yet."
+      );
     } catch (err) {
       fetchSpin.stop("Could not load projects \u2014 you can still create a new one.");
       p.log.warn(err instanceof Error ? err.message : String(err));
@@ -647,19 +709,14 @@ async function runBrowserSignIn(options, endpoint, consoleBase) {
     const keySpin = p.spinner();
     keySpin.start("Minting SDK key\u2026");
     try {
-      const minted = await mintProjectKey(endpoint, cliToken, projectId);
-      apiKey = minted ?? void 0;
-      if (!apiKey) {
-        keySpin.stop("Could not mint an API key.");
-        p.log.warn(
-          `Open the console Verify tab to generate a key manually: ${consoleUrl(consoleBase, "/onboarding?tab=verify")}`
-        );
-        return null;
-      }
+      apiKey = await mintProjectKey(endpoint, cliToken, projectId);
       keySpin.stop("SDK key ready.");
     } catch (err) {
       keySpin.stop("Could not mint an API key.");
       p.log.warn(err instanceof Error ? err.message : String(err));
+      p.log.warn(
+        `You're signed in, but key minting failed. Generate one manually in the console Verify tab: ${consoleUrl(consoleBase, "/onboarding?tab=verify")}`
+      );
       return null;
     }
   }
@@ -719,10 +776,11 @@ async function verifyCredentials(credentials, options, consoleBase) {
   const endpoint = resolveCloudEndpoint(options.endpoint);
   const spinner3 = p.spinner();
   spinner3.start("Verifying credentials\u2026");
-  const result = await apiCall(
-    "/v1/sync/whoami",
-    { apiKey: credentials.apiKey, projectId: credentials.projectId, endpoint }
-  );
+  const result = await apiCall("/v1/sync/whoami", {
+    apiKey: credentials.apiKey,
+    projectId: credentials.projectId,
+    endpoint
+  });
   if (!result.ok) {
     spinner3.stop("Credentials could not be verified.");
     p.log.error(result.error?.message ?? "Authentication failed.");
@@ -877,6 +935,20 @@ function persistCliConfig(apiKey, projectId, endpoint) {
   const existing = loadConfig();
   saveConfig({ ...existing, apiKey, projectId, endpoint });
 }
+function emitWizardFunnelEvent(credentials, endpoint, event, metadata = {}) {
+  if (process.env.MUSHI_NO_TELEMETRY) return;
+  void fetch(`${endpoint.replace(/\/$/, "")}/v1/cli/funnel`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "X-Mushi-Api-Key": credentials.apiKey,
+      "X-Mushi-Project": credentials.projectId
+    },
+    body: JSON.stringify({ event, source: "cli", metadata }),
+    signal: AbortSignal.timeout(4e3)
+  }).catch(() => {
+  });
+}
 function printNextSteps(framework, consoleBase, enableRewards = false) {
   p.note(framework.snippet(), "Add this to your app:");
   if (enableRewards) {
@@ -910,7 +982,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect: runConnect2 } = await import("./connect-5VPUYE6H.js");
+    const { runConnect: runConnect2 } = await import("./connect-22IHGT2L.js");
     await runConnect2({
       apiKey: credentials.apiKey,
       projectId: credentials.projectId,
@@ -921,12 +993,8 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
       wait: true
     });
   } catch (err) {
-    p.log.warn(
-      err instanceof Error ? err.message : String(err)
-    );
-    p.log.info(
-      "You can run manually: mushi connect --write-env --wire-ide --wait"
-    );
+    p.log.warn(err instanceof Error ? err.message : String(err));
+    p.log.info("You can run manually: mushi connect --write-env --wire-ide --wait");
   }
 }
 async function maybeEnableRewards(options) {
@@ -1203,189 +1271,7 @@ Examples:
   mushi login                              # browser-guided (recommended)
   mushi login --api-key mushi_xxx         # non-interactive / CI
   mushi login --api-key mushi_xxx --project-id <uuid>
-  mushi login --upgrade-scope             # re-auth to add mcp:read + mcp:write to your key`).action(async (opts) => {
-    const { CLOUD_API_ENDPOINT, resolveCloudEndpoint: resolveCloudEndpoint2 } = await import("./endpoint-DGS73AVM.js");
-    const endpoint = opts.endpoint ? resolveCloudEndpoint2(opts.endpoint) : CLOUD_API_ENDPOINT;
-    const consoleBase = await resolveConsoleUrl();
-    let apiKey = opts.apiKey;
-    let projectId = opts.projectId;
-    if (apiKey) {
-      const config2 = loadConfig();
-      config2.apiKey = apiKey;
-      config2.endpoint = endpoint;
-      if (projectId) config2.projectId = projectId;
-      config2.consoleUrl = consoleBase;
-      saveConfig(config2);
-      console.log("");
-      console.log("  \u2713 Credentials saved.");
-      const verifyResult = await apiCall(
-        "/v1/sync/whoami",
-        { apiKey, endpoint, projectId }
-      );
-      if (!verifyResult.ok) {
-        console.warn(`  \u26A0  Key saved, but verification failed: ${verifyResult.error?.message ?? "unknown error"}`);
-        console.warn(`     Check your key at: ${cliSetupDeepLink(consoleBase)}`);
-        return;
-      }
-      const d = verifyResult.data;
-      if (d.project_name) {
-        if (!projectId && d.project_id) {
-          config2.projectId = d.project_id;
-          saveConfig(config2);
-        }
-        console.log(`  \u2713 Project: ${d.project_name} (${d.project_id})`);
-      }
-      console.log(`  \u2713 Endpoint: ${endpoint}`);
-      console.log("");
-      console.log("  Run 'mushi whoami' to verify \xB7 'mushi init' to set up the SDK");
-      return;
-    }
-    console.log("");
-    if (opts.upgradeScope) {
-      console.log("  Mushi login \u2014 scope upgrade");
-      console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-      console.log("  Re-authenticating to mint a new key with report:write + mcp:read + mcp:write scopes.");
-      console.log("  This lets the CLI admin commands (including writes) and MCP server both work with a single key.");
-      console.log("");
-    } else {
-      console.log("  Mushi login");
-      console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-    }
-    let deviceData;
-    try {
-      deviceData = await startDeviceAuth(endpoint, ensureClientId());
-    } catch (err) {
-      process.stderr.write(`
-error: Could not start login session: ${err instanceof Error ? err.message : String(err)}
-`);
-      process.stderr.write(`  Fallback: mushi login --api-key <key> --project-id <uuid>
-`);
-      process.exit(1);
-    }
-    const verifyUrl = deviceData.verification_uri;
-    if (opts.browser !== false) {
-      try {
-        await openInBrowser(verifyUrl);
-      } catch {
-      }
-    }
-    printAuthBanner(deviceData.user_code, verifyUrl);
-    let cliToken = null;
-    const pollIntervalMs = (deviceData.interval ?? 5) * 1e3;
-    const deadline = Date.now() + (deviceData.expires_in ?? 600) * 1e3;
-    const MAX_CONSECUTIVE_ERRORS = 5;
-    let consecutiveErrors = 0;
-    let firstPoll = true;
-    while (Date.now() < deadline) {
-      if (!firstPoll) {
-        await new Promise((r) => setTimeout(r, pollIntervalMs));
-      }
-      firstPoll = false;
-      const outcome = await pollDeviceToken(endpoint, deviceData.device_code);
-      if (outcome.status === "approved") {
-        cliToken = outcome.cliToken;
-        break;
-      }
-      if (outcome.status === "pending") {
-        consecutiveErrors = 0;
-        continue;
-      }
-      if (outcome.status === "error") {
-        if (outcome.retryable) {
-          consecutiveErrors += 1;
-          if (consecutiveErrors < MAX_CONSECUTIVE_ERRORS) continue;
-        }
-        printAuthFailed("error", outcome.message);
-        process.exit(1);
-      }
-      if (outcome.status === "denied") {
-        printAuthFailed("denied");
-        process.exit(1);
-      }
-      if (outcome.status === "expired") {
-        printAuthFailed("timeout");
-        process.exit(1);
-      }
-    }
-    if (!cliToken) {
-      printAuthFailed("timeout");
-      process.exit(1);
-    }
-    printAuthApproved();
-    const projectsList = await listProjects(endpoint, cliToken);
-    let chosenProjectId = projectId;
-    let chosenProjectName;
-    if (!chosenProjectId) {
-      const { createInterface } = await import("readline");
-      const rl = createInterface({ input: process.stdin, output: process.stdout });
-      const ask = (q) => new Promise((resolve3) => rl.question(q, (a) => resolve3(a.trim())));
-      if (projectsList.length > 0) {
-        console.log("");
-        console.log("  Your projects:");
-        projectsList.forEach((p3, i) => {
-          console.log(`    ${i + 1}. ${p3.name} (${p3.id})`);
-        });
-        console.log(`    ${projectsList.length + 1}. Create a new project`);
-        console.log("");
-        const choice = await ask(`  Pick a project [1-${projectsList.length + 1}]: `);
-        const num = parseInt(choice, 10);
-        if (num >= 1 && num <= projectsList.length) {
-          const picked = projectsList[num - 1];
-          chosenProjectId = picked.id;
-          chosenProjectName = picked.name;
-        }
-      }
-      if (!chosenProjectId) {
-        console.log("");
-        const newName = await ask("  Project name: ");
-        rl.close();
-        if (!newName.trim()) {
-          process.stderr.write("\nerror: Project name is required.\n");
-          process.exit(2);
-        }
-        try {
-          const created = await createProject(endpoint, cliToken, newName.trim());
-          chosenProjectId = created.id;
-          chosenProjectName = created.name;
-          apiKey = created.apiKey ?? void 0;
-          console.log(`  \u2713 Created project "${chosenProjectName}"`);
-        } catch (err) {
-          process.stderr.write(`
-error: Could not create project: ${err instanceof Error ? err.message : String(err)}
-`);
-          process.exit(1);
-        }
-      } else {
-        rl.close();
-      }
-    }
-    if (!apiKey && chosenProjectId) {
-      try {
-        apiKey = await mintProjectKey(endpoint, cliToken, chosenProjectId) ?? void 0;
-      } catch {
-      }
-    }
-    const config = loadConfig();
-    config.endpoint = endpoint;
-    config.consoleUrl = consoleBase;
-    if (chosenProjectId) config.projectId = chosenProjectId;
-    if (apiKey) config.apiKey = apiKey;
-    saveConfig(config);
-    console.log("");
-    if (chosenProjectName) console.log(`  \u2713 Project: ${chosenProjectName}`);
-    if (apiKey) {
-      console.log(`  \u2713 Full-scope CLI key saved (${apiKey.slice(0, 12)}\u2026)`);
-      console.log(`    Scopes: report:write \xB7 mcp:read \xB7 mcp:write \u2014 SDK + MCP + admin CLI (incl. writes) all work with this key`);
-    } else {
-      console.log(`  \u2139  Get an SDK key at: ${apiKeyHint(consoleBase)}`);
-    }
-    console.log("");
-    if (opts.upgradeScope) {
-      console.log("  Key upgraded! Re-run 'mushi setup' to update your .cursor/mcp.json, then restart Cursor.");
-    } else {
-      console.log("  Run 'mushi init' to set up the SDK in this project.");
-    }
-  });
+  mushi login --upgrade-scope             # re-auth to add mcp:read + mcp:write to your key`).action(runLogin);
   program2.command("whoami").description("Verify API key and display project info").option("--json", "Machine-readable JSON output").addHelpText("after", `
 Verifies that MUSHI_API_KEY is valid and shows which project it belongs to.
 Useful after 'mushi login' to confirm credentials are correct.`).action(async (opts) => {
@@ -1477,6 +1363,189 @@ Examples:
     }
   });
 }
+async function runLogin(opts) {
+  const { CLOUD_API_ENDPOINT, resolveCloudEndpoint: resolveCloudEndpoint2 } = await import("./endpoint-DGS73AVM.js");
+  const endpoint = opts.endpoint ? resolveCloudEndpoint2(opts.endpoint) : CLOUD_API_ENDPOINT;
+  const consoleBase = await resolveConsoleUrl();
+  let apiKey = opts.apiKey;
+  let projectId = opts.projectId;
+  if (apiKey) {
+    const config2 = loadConfig();
+    config2.apiKey = apiKey;
+    config2.endpoint = endpoint;
+    if (projectId) config2.projectId = projectId;
+    config2.consoleUrl = consoleBase;
+    saveConfig(config2);
+    console.log("");
+    console.log("  \u2713 Credentials saved.");
+    const verifyResult = await apiCall(
+      "/v1/sync/whoami",
+      { apiKey, endpoint, projectId }
+    );
+    if (!verifyResult.ok) {
+      console.warn(`  \u26A0  Key saved, but verification failed: ${verifyResult.error?.message ?? "unknown error"}`);
+      console.warn(`     Check your key at: ${cliSetupDeepLink(consoleBase)}`);
+      return;
+    }
+    const d = verifyResult.data;
+    if (d.project_name) {
+      if (!projectId && d.project_id) {
+        config2.projectId = d.project_id;
+        saveConfig(config2);
+      }
+      console.log(`  \u2713 Project: ${d.project_name} (${d.project_id})`);
+    }
+    console.log(`  \u2713 Endpoint: ${endpoint}`);
+    console.log("");
+    console.log("  Run 'mushi whoami' to verify \xB7 'mushi init' to set up the SDK");
+    return;
+  }
+  console.log("");
+  if (opts.upgradeScope) {
+    console.log("  Mushi login \u2014 scope upgrade");
+    console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    console.log("  Re-authenticating to mint a new key with report:write + mcp:read + mcp:write scopes.");
+    console.log("  This lets the CLI admin commands (including writes) and MCP server both work with a single key.");
+    console.log("");
+  } else {
+    console.log("  Mushi login");
+    console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  }
+  let deviceData;
+  try {
+    deviceData = await startDeviceAuth(endpoint, ensureClientId());
+  } catch (err) {
+    process.stderr.write(`
+error: Could not start login session: ${err instanceof Error ? err.message : String(err)}
+`);
+    process.stderr.write(`  Fallback: mushi login --api-key <key> --project-id <uuid>
+`);
+    process.exit(1);
+  }
+  const verifyUrl = deviceData.verification_uri;
+  if (opts.browser !== false) {
+    try {
+      await openInBrowser(verifyUrl);
+    } catch {
+    }
+  }
+  printAuthBanner(deviceData.user_code, verifyUrl);
+  let cliToken = null;
+  const pollIntervalMs = (deviceData.interval ?? 5) * 1e3;
+  const deadline = Date.now() + (deviceData.expires_in ?? 600) * 1e3;
+  const MAX_CONSECUTIVE_ERRORS = 5;
+  let consecutiveErrors = 0;
+  let firstPoll = true;
+  while (Date.now() < deadline) {
+    if (!firstPoll) {
+      await new Promise((r) => setTimeout(r, pollIntervalMs));
+    }
+    firstPoll = false;
+    const outcome = await pollDeviceToken(endpoint, deviceData.device_code);
+    if (outcome.status === "approved") {
+      cliToken = outcome.cliToken;
+      break;
+    }
+    if (outcome.status === "pending") {
+      consecutiveErrors = 0;
+      continue;
+    }
+    if (outcome.status === "error") {
+      if (outcome.retryable) {
+        consecutiveErrors += 1;
+        if (consecutiveErrors < MAX_CONSECUTIVE_ERRORS) continue;
+      }
+      printAuthFailed("error", outcome.message);
+      process.exit(1);
+    }
+    if (outcome.status === "denied") {
+      printAuthFailed("denied");
+      process.exit(1);
+    }
+    if (outcome.status === "expired") {
+      printAuthFailed("timeout");
+      process.exit(1);
+    }
+  }
+  if (!cliToken) {
+    printAuthFailed("timeout");
+    process.exit(1);
+  }
+  printAuthApproved();
+  const projectsList = await listProjects(endpoint, cliToken);
+  let chosenProjectId = projectId;
+  let chosenProjectName;
+  if (!chosenProjectId) {
+    const { createInterface } = await import("readline");
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const ask = (q) => new Promise((resolve3) => rl.question(q, (a) => resolve3(a.trim())));
+    if (projectsList.length > 0) {
+      console.log("");
+      console.log("  Your projects:");
+      projectsList.forEach((p3, i) => {
+        console.log(`    ${i + 1}. ${p3.name} (${p3.id})`);
+      });
+      console.log(`    ${projectsList.length + 1}. Create a new project`);
+      console.log("");
+      const choice = await ask(`  Pick a project [1-${projectsList.length + 1}]: `);
+      const num = parseInt(choice, 10);
+      if (num >= 1 && num <= projectsList.length) {
+        const picked = projectsList[num - 1];
+        chosenProjectId = picked.id;
+        chosenProjectName = picked.name;
+      }
+    }
+    if (!chosenProjectId) {
+      console.log("");
+      const newName = await ask("  Project name: ");
+      rl.close();
+      if (!newName.trim()) {
+        process.stderr.write("\nerror: Project name is required.\n");
+        process.exit(2);
+      }
+      try {
+        const created = await createProject(endpoint, cliToken, newName.trim());
+        chosenProjectId = created.id;
+        chosenProjectName = created.name;
+        apiKey = created.apiKey ?? void 0;
+        console.log(`  \u2713 Created project "${chosenProjectName}"`);
+      } catch (err) {
+        process.stderr.write(`
+error: Could not create project: ${err instanceof Error ? err.message : String(err)}
+`);
+        process.exit(1);
+      }
+    } else {
+      rl.close();
+    }
+  }
+  if (!apiKey && chosenProjectId) {
+    try {
+      apiKey = await mintProjectKey(endpoint, cliToken, chosenProjectId) ?? void 0;
+    } catch {
+    }
+  }
+  const config = loadConfig();
+  config.endpoint = endpoint;
+  config.consoleUrl = consoleBase;
+  if (chosenProjectId) config.projectId = chosenProjectId;
+  if (apiKey) config.apiKey = apiKey;
+  saveConfig(config);
+  console.log("");
+  if (chosenProjectName) console.log(`  \u2713 Project: ${chosenProjectName}`);
+  if (apiKey) {
+    console.log(`  \u2713 Full-scope CLI key saved (${apiKey.slice(0, 12)}\u2026)`);
+    console.log(`    Scopes: report:write \xB7 mcp:read \xB7 mcp:write \u2014 SDK + MCP + admin CLI (incl. writes) all work with this key`);
+  } else {
+    console.log(`  \u2139  Get an SDK key at: ${apiKeyHint(consoleBase)}`);
+  }
+  console.log("");
+  if (opts.upgradeScope) {
+    console.log("  Key upgraded! Re-run 'mushi setup' to update your .cursor/mcp.json, then restart Cursor.");
+  } else {
+    console.log("  Run 'mushi init' to set up the SDK in this project.");
+  }
+}
 
 // src/commands/deploy.ts
 function registerDeployCommands(program2) {
@@ -2361,8 +2430,11 @@ error: Could not create project: ${err instanceof Error ? err.message : String(e
 }
 
 // src/commands/setup.ts
+function resolveLoginEndpoint(optsEndpoint, existingConfigEndpoint, envEndpoint) {
+  return optsEndpoint ?? existingConfigEndpoint ?? envEndpoint?.trim();
+}
 function registerSetupCommands(program2) {
-  program2.command("setup").description("Wire Cursor MCP into your IDE (reads ~/.config/mushi/config.json \u2014 run `mushi login` first)").option("--ide <ide>", "Target IDE: cursor | claude | continue | zed", "cursor").option("--project-slug <slug>", "Override the project slug in the server name (default: fetched from API or ID prefix)").option("--all-projects", "Write a separate mushi-<name> server entry for every accessible project").option("--with-rules", "Also write the .cursorrules / .claude/rules/mushi.md lesson-library hook").option("--dry-run", "Print what would be written without making changes").option("--verify", "Probe the MCP key after writing to confirm it has mcp:read scope (default: on)").option("--no-verify", "Skip the post-write key probe").addHelpText("after", `
+  program2.command("setup").description("Wire Cursor MCP into your IDE (reads ~/.config/mushi/config.json \u2014 run `mushi login` first)").option("--ide <ide>", "Target IDE: cursor | claude | continue | zed", "cursor").option("--project-slug <slug>", "Override the project slug in the server name (default: fetched from API or ID prefix)").option("--all-projects", "Write a separate mushi-<name> server entry for every accessible project").option("--with-rules", "Also write the .cursorrules / .claude/rules/mushi.md lesson-library hook").option("--dry-run", "Print what would be written without making changes").option("--verify", "Probe the MCP key after writing to confirm it has mcp:read scope (default: on)").option("--no-verify", "Skip the post-write key probe").option("--endpoint <url>", "Override the Mushi API endpoint (self-hosted) \u2014 used for first-run login if not yet configured").addHelpText("after", `
 Examples:
   mushi setup                         # wire Cursor (default)
   mushi setup --all-projects          # one server entry per accessible project
@@ -2380,6 +2452,11 @@ The command reads credentials from ~/.config/mushi/config.json (run \`mushi logi
     const { existsSync: existsSync3 } = await import("fs");
     const nodePath2 = await import("path");
     const os = await import("os");
+    const existingConfig = loadConfig();
+    if (!existingConfig.apiKey) {
+      const endpoint = resolveLoginEndpoint(opts.endpoint, existingConfig.endpoint, process.env.MUSHI_API_ENDPOINT);
+      await runLogin({ endpoint });
+    }
     const config = requireConfig({ needsProject: true });
     const redactKeyForDisplay = (text2) => {
       const key = config.apiKey;
@@ -3193,6 +3270,88 @@ async function checkEndpointReachability(endpoint, doFetch = globalThis.fetch) {
     return { name: "Endpoint reachable", ok: false, detail: `Fetch failed: ${msg}` };
   }
 }
+async function checkCliAuthPath(config, doFetch = globalThis.fetch) {
+  const checks = [];
+  if (!config.endpoint) {
+    return [
+      {
+        name: "Sign-in route reachable",
+        ok: false,
+        detail: "No endpoint configured \u2014 run `npx mushi-mushi` or pass MUSHI_API_ENDPOINT."
+      }
+    ];
+  }
+  const base = sanitizeEndpoint(config.endpoint);
+  let dateHeader = null;
+  try {
+    const res = await doFetch(`${base}/v1/cli/auth/device/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ device_code: "doctor-probe" }),
+      signal: AbortSignal.timeout(8e3)
+    });
+    dateHeader = res.headers?.get?.("date") ?? null;
+    const signInRouteReachable = res.status === 400 || res.status === 429;
+    checks.push({
+      name: "Sign-in route reachable",
+      ok: signInRouteReachable,
+      detail: signInRouteReachable ? `POST ${base}/v1/cli/auth/device/token \u2192 ${res.status} (route deployed and answering)` : `POST ${base}/v1/cli/auth/device/token \u2192 ${res.status} \u2014 expected HTTP 400 (invalid device_code) or 429 (slow_down); the API may be down or mis-deployed.`
+    });
+  } catch (err) {
+    checks.push({
+      name: "Sign-in route reachable",
+      ok: false,
+      detail: `Fetch failed: ${err instanceof Error ? err.message : String(err)} \u2014 check network/proxy/firewall to ${base}.`
+    });
+  }
+  if (dateHeader) {
+    const serverMs = Date.parse(dateHeader);
+    if (!Number.isNaN(serverMs)) {
+      const skewSec = Math.round(Math.abs(Date.now() - serverMs) / 1e3);
+      const ok = skewSec <= 120;
+      checks.push({
+        name: "System clock in sync",
+        ok,
+        warn: !ok && skewSec <= 300,
+        detail: ok ? `Local clock within ${skewSec}s of the server.` : `Local clock is ${skewSec}s off the server \u2014 sign-in codes expire fast; fix your system time.`
+      });
+    }
+  }
+  if (config.apiKey && config.projectId) {
+    try {
+      const res = await doFetch(`${base}/v1/sync/whoami`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          ...apiKeyHeaders(config.apiKey, config.projectId)
+        },
+        body: JSON.stringify({}),
+        signal: AbortSignal.timeout(8e3)
+      });
+      const json = await res.json().catch(() => null);
+      const ok = res.ok && json?.ok === true;
+      checks.push({
+        name: "Saved credentials valid",
+        ok,
+        detail: ok ? `API key resolves to project "${json?.data?.project_name ?? config.projectId}".` : `${json?.error?.message ?? `whoami \u2192 HTTP ${res.status}`} \u2014 re-run \`npx mushi-mushi\` to sign in again.`
+      });
+    } catch (err) {
+      checks.push({
+        name: "Saved credentials valid",
+        ok: false,
+        detail: `whoami fetch failed: ${err instanceof Error ? err.message : String(err)}`
+      });
+    }
+  } else {
+    checks.push({
+      name: "Saved credentials valid",
+      ok: true,
+      warn: true,
+      detail: "No saved CLI credentials yet \u2014 normal before the first successful sign-in."
+    });
+  }
+  return checks;
+}
 async function checkSdkInstall(cwd) {
   try {
     const { readFile: readFile3 } = await import("fs/promises");
@@ -3229,13 +3388,10 @@ async function checkServerPreflight(config, doFetch = globalThis.fetch) {
   }
   try {
     const { endpoint, apiKey, projectId } = sanitizeCliCredentials(config);
-    const res = await doFetch(
-      `${endpoint}/v1/admin/projects/${projectId}/preflight`,
-      {
-        headers: apiKeyHeaders(apiKey, projectId),
-        signal: AbortSignal.timeout(8e3)
-      }
-    );
+    const res = await doFetch(`${endpoint}/v1/admin/projects/${projectId}/preflight`, {
+      headers: apiKeyHeaders(apiKey, projectId),
+      signal: AbortSignal.timeout(8e3)
+    });
     if (res.ok) {
       const body = await res.json();
       const serverChecks = body.data?.checks ?? [];
@@ -3291,7 +3447,13 @@ async function checkIngestSetup(config, doFetch = globalThis.fetch) {
       doFetch
     );
     if (!data) {
-      return [{ name: "Ingest setup", ok: false, detail: "Request to /v1/sync/ingest-setup failed or returned invalid payload" }];
+      return [
+        {
+          name: "Ingest setup",
+          ok: false,
+          detail: "Request to /v1/sync/ingest-setup failed or returned invalid payload"
+        }
+      ];
     }
     const steps = data.steps ?? [];
     const checks = steps.filter((s) => s.required).map((s) => ({
@@ -3327,22 +3489,27 @@ async function checkQaStoriesHealth(config, doFetch = globalThis.fetch) {
   try {
     const { endpoint, apiKey, projectId } = sanitizeCliCredentials(config);
     const headers = apiKeyHeaders(apiKey, projectId);
-    const storiesRes = await doFetch(
-      `${endpoint}/v1/admin/projects/${projectId}/qa-coverage`,
-      {
-        headers,
-        signal: AbortSignal.timeout(8e3)
-      }
-    );
+    const storiesRes = await doFetch(`${endpoint}/v1/admin/projects/${projectId}/qa-coverage`, {
+      headers,
+      signal: AbortSignal.timeout(8e3)
+    });
     if (!storiesRes.ok) {
-      checks.push({ name: "[qa] Fetch QA stories", ok: false, detail: `HTTP ${storiesRes.status}` });
+      checks.push({
+        name: "[qa] Fetch QA stories",
+        ok: false,
+        detail: `HTTP ${storiesRes.status}`
+      });
       return checks;
     }
     const storiesBody = await storiesRes.json();
     const stories = storiesBody.data?.coverage ?? [];
     const enabled = stories.filter((s) => s.enabled);
     if (enabled.length === 0) {
-      checks.push({ name: "[qa] Enabled QA stories", ok: true, detail: "No enabled stories \u2014 create one at /qa-coverage" });
+      checks.push({
+        name: "[qa] Enabled QA stories",
+        ok: true,
+        detail: "No enabled stories \u2014 create one at /qa-coverage"
+      });
       return checks;
     }
     checks.push({
@@ -3411,7 +3578,9 @@ async function checkHostAppWiring(cwd) {
       }
     }
     const hasProjectId = /VITE_MUSHI_PROJECT_ID=|NEXT_PUBLIC_MUSHI_PROJECT_ID=|MUSHI_PROJECT_ID=/.test(envContent);
-    const hasApiKey = /VITE_MUSHI_API_KEY=|NEXT_PUBLIC_MUSHI_API_KEY=|MUSHI_API_KEY=/.test(envContent);
+    const hasApiKey = /VITE_MUSHI_API_KEY=|NEXT_PUBLIC_MUSHI_API_KEY=|MUSHI_API_KEY=/.test(
+      envContent
+    );
     checks.push({
       name: "[host] Mushi env vars in .env.local",
       ok: hasProjectId && hasApiKey,
@@ -3456,10 +3625,7 @@ async function checkMcpConfig(config, cwd, doFetch = globalThis.fetch) {
   const { join: join4, resolve: resolve3 } = await import("path");
   const { homedir } = await import("os");
   const root = resolve3(cwd);
-  const candidates = [
-    join4(root, ".cursor", "mcp.json"),
-    join4(homedir(), ".cursor", "mcp.json")
-  ];
+  const candidates = [join4(root, ".cursor", "mcp.json"), join4(homedir(), ".cursor", "mcp.json")];
   let mcpPath = null;
   let mcpRaw = null;
   for (const candidate of candidates) {
@@ -3497,11 +3663,17 @@ async function checkMcpConfig(config, cwd, doFetch = globalThis.fetch) {
   try {
     mcpConfig = JSON.parse(mcpRaw);
   } catch {
-    checks.push({ name: "[mcp] mcp.json valid JSON", ok: false, detail: "mcp.json is not valid JSON \u2014 regenerate with `mushi setup`." });
+    checks.push({
+      name: "[mcp] mcp.json valid JSON",
+      ok: false,
+      detail: "mcp.json is not valid JSON \u2014 regenerate with `mushi setup`."
+    });
     return checks;
   }
   const servers = mcpConfig.mcpServers ?? {};
-  const mushiEntries = Object.entries(servers).filter(([k]) => k === "mushi" || k.startsWith("mushi-"));
+  const mushiEntries = Object.entries(servers).filter(
+    ([k]) => k === "mushi" || k.startsWith("mushi-")
+  );
   if (mushiEntries.length === 0) {
     checks.push({
       name: "[mcp] mushi server entry",
@@ -3621,7 +3793,9 @@ async function checkOnboardingStatus(config, _consoleBase, cwd, doFetch = global
       } catch {
       }
     }
-    const hasEnvVars = /(?:VITE_|NEXT_PUBLIC_|EXPO_PUBLIC_|NUXT_PUBLIC_)?MUSHI_PROJECT_ID=/.test(envContent);
+    const hasEnvVars = /(?:VITE_|NEXT_PUBLIC_|EXPO_PUBLIC_|NUXT_PUBLIC_)?MUSHI_PROJECT_ID=/.test(
+      envContent
+    );
     if (!hasEnvVars) {
       return {
         nextAction: "Write env vars to your app: run `npx mushi-mushi` or `mushi connect --write-env`",
@@ -3710,6 +3884,9 @@ async function runDoctor(config, options = {}) {
     const mcpChecks = await checkMcpConfig(config, options.cwd ?? process.cwd(), doFetch);
     checks.push(...mcpChecks);
   }
+  if (isFull || options.auth) {
+    checks.push(...await checkCliAuthPath(config, doFetch));
+  }
   const heartbeatPassed = checks.some((c) => c.name === "[ingest] Last SDK heartbeat" && c.ok);
   if (heartbeatPassed) {
     const idx = checks.findIndex((c) => c.name === "SDK installed in this repo" && !c.ok);
@@ -3742,8 +3919,10 @@ function formatDoctorResult(result) {
   const warned = result.checks.filter((c) => c.ok && c.warn);
   if (failed.length === 0) {
     if (warned.length > 0) {
-      lines.push(`
-All checks passed with ${warned.length} advisory warning${warned.length === 1 ? "" : "s"}. The CLI is ready.`);
+      lines.push(
+        `
+All checks passed with ${warned.length} advisory warning${warned.length === 1 ? "" : "s"}. The CLI is ready.`
+      );
     } else {
       lines.push("\nAll checks passed. The CLI is ready.");
     }
@@ -3768,6 +3947,9 @@ function registerDoctorCommand(program2) {
   ).option(
     "--mcp",
     "Check Cursor MCP config: verify mushi-* server entry, credentials, and probe account-overview connectivity."
+  ).option(
+    "--auth",
+    "Diagnose the browser sign-in handshake: device-auth route reachability, system clock skew, and saved-credential validity. Run this when `npx mushi-mushi` browser sign-in does not complete."
   ).option(
     "--fix",
     "Apply safe local fixes when checks fail: write missing .env.local lines and wire Cursor MCP config."
@@ -3777,54 +3959,60 @@ function registerDoctorCommand(program2) {
   ).option(
     "--full",
     "Run ALL check categories (server, ingest, host-app, mcp, qa-stories) in one shot. Good for first-run diagnostics. Exit 0 only when all checks pass."
-  ).action(async (opts) => {
-    const config = loadConfig();
-    if (opts.onboarding) {
-      const cwd = opts.cwd ?? process.cwd();
-      const consoleBase = await resolveConsoleUrl({ cwd });
-      const status = await checkOnboardingStatus(config, consoleBase, cwd);
-      const base = consoleBase.replace(/\/$/, "");
-      if (status.done) {
-        console.log(`OK  Setup complete. ${status.nextAction}`);
-        console.log(`    ${base}${status.ctaPath}`);
-      } else {
-        console.log(`\u2192 Next: ${status.nextAction}`);
-        console.log(`    Open: ${base}${status.ctaPath}`);
+  ).action(
+    async (opts) => {
+      const config = loadConfig();
+      if (opts.onboarding) {
+        const cwd = opts.cwd ?? process.cwd();
+        const consoleBase = await resolveConsoleUrl({ cwd });
+        const status = await checkOnboardingStatus(config, consoleBase, cwd);
+        const base = consoleBase.replace(/\/$/, "");
+        if (status.done) {
+          console.log(`OK  Setup complete. ${status.nextAction}`);
+          console.log(`    ${base}${status.ctaPath}`);
+        } else {
+          console.log(`\u2192 Next: ${status.nextAction}`);
+          console.log(`    Open: ${base}${status.ctaPath}`);
+        }
+        if (!status.done) process.exit(1);
+        return;
       }
-      if (!status.done) process.exit(1);
-      return;
-    }
-    const doctorOpts = {
-      cwd: opts.cwd,
-      server: opts.server,
-      ingest: opts.ingest,
-      qaStories: opts.qaStories,
-      hostApp: opts.hostApp,
-      mcp: opts.mcp,
-      full: opts.full
-    };
-    let result = await runDoctor(config, doctorOpts);
-    if (!result.ready && opts.fix && config.apiKey && config.projectId && config.endpoint) {
-      const connectResult = await runConnect({
-        apiKey: config.apiKey,
-        projectId: config.projectId,
-        endpoint: config.endpoint,
-        cwd: opts.cwd ?? process.cwd(),
-        writeEnv: true,
-        wireIde: true
-      }, config);
-      for (const msg of connectResult.messages) console.log(msg);
-      result = await runDoctor(config, { ...doctorOpts, mcp: opts.mcp });
-    }
-    const { checks } = result;
-    if (opts.json) {
-      console.log(JSON.stringify({ checks, ready: result.ready }, null, 2));
+      const doctorOpts = {
+        cwd: opts.cwd,
+        server: opts.server,
+        ingest: opts.ingest,
+        qaStories: opts.qaStories,
+        hostApp: opts.hostApp,
+        mcp: opts.mcp,
+        auth: opts.auth,
+        full: opts.full
+      };
+      let result = await runDoctor(config, doctorOpts);
+      if (!result.ready && opts.fix && config.apiKey && config.projectId && config.endpoint) {
+        const connectResult = await runConnect(
+          {
+            apiKey: config.apiKey,
+            projectId: config.projectId,
+            endpoint: config.endpoint,
+            cwd: opts.cwd ?? process.cwd(),
+            writeEnv: true,
+            wireIde: true
+          },
+          config
+        );
+        for (const msg of connectResult.messages) console.log(msg);
+        result = await runDoctor(config, { ...doctorOpts, mcp: opts.mcp });
+      }
+      const { checks } = result;
+      if (opts.json) {
+        console.log(JSON.stringify({ checks, ready: result.ready }, null, 2));
+        if (!result.ready) process.exit(1);
+        return;
+      }
+      console.log(formatDoctorResult(result));
       if (!result.ready) process.exit(1);
-      return;
     }
-    console.log(formatDoctorResult(result));
-    if (!result.ready) process.exit(1);
-  });
+  );
 }
 
 // src/commands/reset-cli.ts