@mushi-mushi/cli 0.26.0 → 0.27.0

package/dist/{chunk-L3LUPBFG.js → chunk-TZL3F3GT.js}

@@ -1,12 +1,55 @@
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-MCVRTQAI.js";
+} from "./chunk-LFZ5ZIBI.js";
+import {
+  __require
+} from "./chunk-3RG5ZIWI.js";
 
 // src/config.ts
 import { randomUUID } from "crypto";
+import { spawnSync } from "child_process";
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
 import { homedir } from "os";
 import { dirname, join } from "path";
+
+// src/keychain.ts
+var KEYCHAIN_SERVICE = "mushi-cli";
+function accountName(profile = "default") {
+  return `api-key:${profile}`;
+}
+var _EntryClass = void 0;
+function getEntryClass() {
+  if (_EntryClass === void 0) {
+    try {
+      const mod = __require("@napi-rs/keyring");
+      _EntryClass = mod.Entry ?? null;
+    } catch {
+      _EntryClass = null;
+    }
+  }
+  return _EntryClass ?? null;
+}
+function tryLoadKeyFromKeychain(profile = "default") {
+  const EntryClass = getEntryClass();
+  if (!EntryClass) return null;
+  try {
+    const entry = new EntryClass(KEYCHAIN_SERVICE, accountName(profile));
+    const key = entry.getPassword();
+    return key && key.length > 0 ? key : null;
+  } catch {
+    return null;
+  }
+}
+
+// src/config.ts
+var DEFAULT_PROFILE = "default";
+function isMultiProfileFile(value) {
+  return typeof value === "object" && value !== null && "profiles" in value && typeof value.profiles === "object" && value.profiles !== null;
+}
+function resolveProfileName(explicit, fileActive) {
+  const fromEnv = process.env["MUSHI_PROFILE"]?.trim();
+  return explicit?.trim() || fromEnv || fileActive || DEFAULT_PROFILE;
+}
 var SECURE_FILE_MODE = 384;
 var SECURE_DIR_MODE = 448;
 function resolveXdgConfigPath() {
@@ -24,17 +67,28 @@ function resolveXdgConfigPath() {
 }
 var LEGACY_CONFIG_PATH = join(homedir(), ".mushirc");
 var CONFIG_PATH = resolveXdgConfigPath();
-function loadConfig(path = CONFIG_PATH) {
+function loadConfig(path = CONFIG_PATH, opts = {}) {
   let file = {};
   if (existsSync(path)) {
     tightenPermissions(path);
     try {
-      file = JSON.parse(readFileSync(path, "utf-8"));
+      const parsed = JSON.parse(readFileSync(path, "utf-8"));
+      if (isMultiProfileFile(parsed)) {
+        const name = resolveProfileName(opts.profile, parsed.activeProfile);
+        file = parsed.profiles[name] ?? {};
+      } else {
+        file = parsed ?? {};
+      }
     } catch {
     }
   } else if (path === CONFIG_PATH && existsSync(LEGACY_CONFIG_PATH)) {
     file = migrateLegacyConfig() ?? {};
   }
+  const profile = resolveProfileName(opts.profile, void 0);
+  const keychainKey = tryLoadKeyFromKeychain(profile);
+  if (keychainKey) {
+    file = { ...file, apiKey: keychainKey };
+  }
   const endpointFromEnv = process.env["MUSHI_API_ENDPOINT"] ?? process.env["MUSHI_ENDPOINT"] ?? void 0;
   const fromEnv = {
     ...process.env["MUSHI_API_KEY"] ? { apiKey: process.env["MUSHI_API_KEY"] } : {},
@@ -56,14 +110,47 @@ function ensureClientId(path = CONFIG_PATH) {
   }
   return clientId;
 }
-function saveConfig(config, path = CONFIG_PATH) {
+function maybeShowTelemetryNotice(config, path = CONFIG_PATH) {
+  if (config.telemetryNoticeShown) return;
+  if (process.env.MUSHI_NO_TELEMETRY) {
+    saveConfig({ ...config, telemetryNoticeShown: true }, path);
+    return;
+  }
+  console.log("");
+  console.log("  \u{1F4CA} Mushi collects minimal anonymous usage data to improve the CLI");
+  console.log("  (funnel step + error category \u2014 never your code or bug content).");
+  console.log("  To opt out: export MUSHI_NO_TELEMETRY=1");
+  console.log("");
+  saveConfig({ ...config, telemetryNoticeShown: true }, path);
+}
+function saveConfig(config, path = CONFIG_PATH, opts = {}) {
   const dir = dirname(path);
   if (!existsSync(dir)) {
     mkdirSync(dir, { recursive: true, mode: SECURE_DIR_MODE });
   } else {
     tightenDirPermissions(dir);
   }
-  writeFileSync(path, JSON.stringify(config, null, 2), { mode: SECURE_FILE_MODE });
+  let existing = null;
+  try {
+    existing = JSON.parse(readFileSync(path, "utf-8"));
+  } catch {
+    existing = null;
+  }
+  const wantsProfile = opts.profile !== void 0 || process.env["MUSHI_PROFILE"] !== void 0 || isMultiProfileFile(existing);
+  if (!wantsProfile) {
+    writeFileSync(path, JSON.stringify(config, null, 2), { mode: SECURE_FILE_MODE });
+    tightenPermissions(path);
+    return;
+  }
+  const file = isMultiProfileFile(existing) ? { version: 2, activeProfile: existing.activeProfile || DEFAULT_PROFILE, profiles: { ...existing.profiles } } : {
+    version: 2,
+    activeProfile: DEFAULT_PROFILE,
+    // A pre-existing flat file becomes the default profile.
+    profiles: { [DEFAULT_PROFILE]: existing ?? {} }
+  };
+  const target = resolveProfileName(opts.profile, file.activeProfile);
+  file.profiles[target] = config;
+  writeFileSync(path, JSON.stringify(file, null, 2), { mode: SECURE_FILE_MODE });
   tightenPermissions(path);
 }
 function migrateLegacyConfig(legacyPath = LEGACY_CONFIG_PATH, destPath = CONFIG_PATH) {
@@ -92,7 +179,10 @@ function migrateLegacyConfig(legacyPath = LEGACY_CONFIG_PATH, destPath = CONFIG_
   return parsed;
 }
 function tightenPermissions(path) {
-  if (process.platform === "win32") return;
+  if (process.platform === "win32") {
+    tightenWindowsAcl(path, "file");
+    return;
+  }
   try {
     const current = statSync(path).mode & 511;
     if (current !== SECURE_FILE_MODE) chmodSync(path, SECURE_FILE_MODE);
@@ -100,13 +190,40 @@ function tightenPermissions(path) {
   }
 }
 function tightenDirPermissions(path) {
-  if (process.platform === "win32") return;
+  if (process.platform === "win32") {
+    tightenWindowsAcl(path, "dir");
+    return;
+  }
   try {
     const current = statSync(path).mode & 511;
     if (current !== SECURE_DIR_MODE) chmodSync(path, SECURE_DIR_MODE);
   } catch {
   }
 }
+var _cachedWindowsUser = void 0;
+var _aclTightened = /* @__PURE__ */ new Set();
+function getWindowsUser() {
+  if (_cachedWindowsUser !== void 0) return _cachedWindowsUser;
+  try {
+    const result = spawnSync("whoami", [], { encoding: "utf8", timeout: 500 });
+    _cachedWindowsUser = result.stdout?.trim() || null;
+  } catch {
+    _cachedWindowsUser = null;
+  }
+  return _cachedWindowsUser;
+}
+function tightenWindowsAcl(path, type) {
+  if (_aclTightened.has(path)) return;
+  try {
+    const user = getWindowsUser();
+    if (!user) return;
+    const args = [path, "/inheritance:r", `/grant:r`, `${user}:F`, `SYSTEM:F`];
+    if (type === "dir") args.push("/T");
+    spawnSync("icacls", args, { encoding: "utf8", timeout: 1e3 });
+    _aclTightened.add(path);
+  } catch {
+  }
+}
 
 // src/console-url.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
@@ -415,10 +532,122 @@ async function apiCall(path, config, options = {}) {
   }
 }
 
+// src/sanitize-config.ts
+var PROJECT_ID_RE = /^(?:proj_[A-Za-z0-9_-]{10,}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
+var API_KEY_RE = /^(mushi_|mush_pk_)[A-Za-z0-9_-]{10,}$/;
+function sanitizeApiKey(raw) {
+  const key = raw.replace(/[\r\n\0]/g, "");
+  if (!API_KEY_RE.test(key)) {
+    throw new Error(
+      "Invalid API key in config \u2014 run `mushi login --api-key <key>` to refresh credentials."
+    );
+  }
+  return key;
+}
+function sanitizeProjectId(raw) {
+  const id = raw.trim();
+  if (!PROJECT_ID_RE.test(id)) {
+    throw new Error(
+      "Invalid project ID in config \u2014 expected a UUID or proj_* slug from the admin console."
+    );
+  }
+  return id;
+}
+function sanitizeEndpoint(raw) {
+  return assertEndpoint(normalizeEndpoint(raw));
+}
+function sanitizeCliCredentials(config) {
+  if (!config.endpoint || !config.apiKey || !config.projectId) {
+    throw new Error("Missing endpoint, apiKey, or projectId");
+  }
+  return {
+    endpoint: sanitizeEndpoint(config.endpoint),
+    apiKey: sanitizeApiKey(config.apiKey),
+    projectId: sanitizeProjectId(config.projectId)
+  };
+}
+function apiKeyHeaders(apiKey, projectId) {
+  const headers = {
+    Authorization: `Bearer ${apiKey}`,
+    "X-Mushi-Api-Key": apiKey
+  };
+  if (projectId) headers["X-Mushi-Project"] = projectId;
+  return headers;
+}
+
+// src/heartbeat-wait.ts
+var IngestSetupHttpError = class extends Error {
+  status;
+  constructor(status) {
+    super(`ingest-setup HTTP ${status}`);
+    this.name = "IngestSetupHttpError";
+    this.status = status;
+  }
+};
+var NON_RETRYABLE_STATUSES = /* @__PURE__ */ new Set([401, 403, 404]);
+async function fetchIngestSetup(config, doFetch = globalThis.fetch) {
+  const endpoint = sanitizeEndpoint(config.endpoint);
+  const apiKey = sanitizeApiKey(config.apiKey);
+  const projectId = config.projectId ? sanitizeProjectId(config.projectId) : void 0;
+  const res = await doFetch(`${endpoint}/v1/sync/ingest-setup`, {
+    headers: apiKeyHeaders(apiKey, projectId),
+    signal: AbortSignal.timeout(8e3)
+  });
+  if (!res.ok) {
+    if (NON_RETRYABLE_STATUSES.has(res.status)) throw new IngestSetupHttpError(res.status);
+    return null;
+  }
+  const body = await res.json();
+  return body.ok && body.data ? body.data : null;
+}
+async function waitForIngestReady(options) {
+  const doFetch = options.fetch ?? globalThis.fetch;
+  const maxAttempts = options.maxAttempts ?? 40;
+  const intervalMs = options.intervalMs ?? 3e3;
+  let lastPayload = null;
+  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+    if (options.signal?.aborted) {
+      return { ok: false, payload: lastPayload, attempts: attempt - 1, reason: "aborted" };
+    }
+    try {
+      lastPayload = await fetchIngestSetup(
+        { endpoint: options.endpoint, apiKey: options.apiKey, projectId: options.projectId },
+        doFetch
+      );
+      if (lastPayload) {
+        options.onPoll?.(lastPayload, attempt);
+        if (lastPayload.ready) {
+          return { ok: true, payload: lastPayload, attempts: attempt, reason: "ready" };
+        }
+        const sdkStep = lastPayload.steps.find((s) => s.id === "sdk_installed");
+        if (sdkStep?.complete) {
+          return { ok: true, payload: lastPayload, attempts: attempt, reason: "heartbeat" };
+        }
+      }
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (err instanceof IngestSetupHttpError) {
+        return { ok: false, payload: lastPayload, attempts: attempt, reason: "unauthorized", error: msg };
+      }
+      if (options.signal?.aborted) {
+        return { ok: false, payload: lastPayload, attempts: attempt, reason: "aborted", error: msg };
+      }
+      if (attempt === maxAttempts) {
+        return { ok: false, payload: lastPayload, attempts: attempt, reason: "fetch-error", error: msg };
+      }
+    }
+    if (attempt < maxAttempts) {
+      await new Promise((r) => setTimeout(r, intervalMs));
+    }
+  }
+  return { ok: false, payload: lastPayload, attempts: maxAttempts, reason: "timeout" };
+}
+
 export {
   CONFIG_PATH,
   loadConfig,
   ensureClientId,
+  maybeShowTelemetryNotice,
   saveConfig,
   consoleUrl,
   resolveConsoleUrlSync,
@@ -433,5 +662,10 @@ export {
   assertEndpoint,
   normalizeEndpoint,
   requireUuid,
-  apiCall
+  apiCall,
+  sanitizeEndpoint,
+  sanitizeCliCredentials,
+  apiKeyHeaders,
+  fetchIngestSetup,
+  waitForIngestReady
 };

package/dist/{connect-HCWJ6NXP.js → connect-FAXWVFG2.js}

@@ -1,122 +1,24 @@
 import {
   CONFIG_PATH,
   assertEndpoint,
-  normalizeEndpoint,
   requireUuid,
-  saveConfig
-} from "./chunk-L3LUPBFG.js";
-import "./chunk-MCVRTQAI.js";
+  saveConfig,
+  waitForIngestReady
+} from "./chunk-TZL3F3GT.js";
+import {
+  MUSHI_MCP_PIN_SPEC
+} from "./chunk-LFZ5ZIBI.js";
 import {
   detectFramework,
   envVarsToWrite,
   readPackageJson
 } from "./chunk-AIZRI665.js";
+import "./chunk-3RG5ZIWI.js";
 
 // src/connect.ts
 import { appendFile, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
 import { join, resolve } from "path";
 
-// src/sanitize-config.ts
-var PROJECT_ID_RE = /^(?:proj_[A-Za-z0-9_-]{10,}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
-var API_KEY_RE = /^(mushi_|mush_pk_)[A-Za-z0-9_-]{10,}$/;
-function sanitizeApiKey(raw) {
-  const key = raw.replace(/[\r\n\0]/g, "");
-  if (!API_KEY_RE.test(key)) {
-    throw new Error(
-      "Invalid API key in config \u2014 run `mushi login --api-key <key>` to refresh credentials."
-    );
-  }
-  return key;
-}
-function sanitizeProjectId(raw) {
-  const id = raw.trim();
-  if (!PROJECT_ID_RE.test(id)) {
-    throw new Error(
-      "Invalid project ID in config \u2014 expected a UUID or proj_* slug from the admin console."
-    );
-  }
-  return id;
-}
-function sanitizeEndpoint(raw) {
-  return assertEndpoint(normalizeEndpoint(raw));
-}
-function apiKeyHeaders(apiKey, projectId) {
-  const headers = {
-    Authorization: `Bearer ${apiKey}`,
-    "X-Mushi-Api-Key": apiKey
-  };
-  if (projectId) headers["X-Mushi-Project"] = projectId;
-  return headers;
-}
-
-// src/heartbeat-wait.ts
-var IngestSetupHttpError = class extends Error {
-  status;
-  constructor(status) {
-    super(`ingest-setup HTTP ${status}`);
-    this.name = "IngestSetupHttpError";
-    this.status = status;
-  }
-};
-var NON_RETRYABLE_STATUSES = /* @__PURE__ */ new Set([401, 403, 404]);
-async function fetchIngestSetup(config, doFetch = globalThis.fetch) {
-  const endpoint = sanitizeEndpoint(config.endpoint);
-  const apiKey = sanitizeApiKey(config.apiKey);
-  const projectId = config.projectId ? sanitizeProjectId(config.projectId) : void 0;
-  const res = await doFetch(`${endpoint}/v1/sync/ingest-setup`, {
-    headers: apiKeyHeaders(apiKey, projectId),
-    signal: AbortSignal.timeout(8e3)
-  });
-  if (!res.ok) {
-    if (NON_RETRYABLE_STATUSES.has(res.status)) throw new IngestSetupHttpError(res.status);
-    return null;
-  }
-  const body = await res.json();
-  return body.ok && body.data ? body.data : null;
-}
-async function waitForIngestReady(options) {
-  const doFetch = options.fetch ?? globalThis.fetch;
-  const maxAttempts = options.maxAttempts ?? 40;
-  const intervalMs = options.intervalMs ?? 3e3;
-  let lastPayload = null;
-  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-    if (options.signal?.aborted) {
-      return { ok: false, payload: lastPayload, attempts: attempt - 1, reason: "aborted" };
-    }
-    try {
-      lastPayload = await fetchIngestSetup(
-        { endpoint: options.endpoint, apiKey: options.apiKey, projectId: options.projectId },
-        doFetch
-      );
-      if (lastPayload) {
-        options.onPoll?.(lastPayload, attempt);
-        if (lastPayload.ready) {
-          return { ok: true, payload: lastPayload, attempts: attempt, reason: "ready" };
-        }
-        const sdkStep = lastPayload.steps.find((s) => s.id === "sdk_installed");
-        if (sdkStep?.complete) {
-          return { ok: true, payload: lastPayload, attempts: attempt, reason: "heartbeat" };
-        }
-      }
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      if (err instanceof IngestSetupHttpError) {
-        return { ok: false, payload: lastPayload, attempts: attempt, reason: "unauthorized", error: msg };
-      }
-      if (options.signal?.aborted) {
-        return { ok: false, payload: lastPayload, attempts: attempt, reason: "aborted", error: msg };
-      }
-      if (attempt === maxAttempts) {
-        return { ok: false, payload: lastPayload, attempts: attempt, reason: "fetch-error", error: msg };
-      }
-    }
-    if (attempt < maxAttempts) {
-      await new Promise((r) => setTimeout(r, intervalMs));
-    }
-  }
-  return { ok: false, payload: lastPayload, attempts: maxAttempts, reason: "timeout" };
-}
-
 // src/mcp-config.ts
 import { mkdir, readFile, writeFile } from "fs/promises";
 import { dirname } from "path";
@@ -149,11 +51,11 @@ async function writeMcpServerEntry(opts) {
 function buildMcpServerBlock(opts) {
   return {
     command: "npx",
-    args: ["-y", "@mushi-mushi/mcp@latest"],
+    args: ["-y", MUSHI_MCP_PIN_SPEC],
     env: {
       MUSHI_API_ENDPOINT: opts.endpoint,
       MUSHI_PROJECT_ID: opts.projectId,
-      MUSHI_API_KEY: opts.apiKey,
+      MUSHI_API_KEY: opts.inlineKey ? opts.apiKey : "${MUSHI_API_KEY}",
       MUSHI_FEATURES: DEFAULT_MUSHI_FEATURES
     }
   };
@@ -254,11 +156,14 @@ async function runConnect(opts, baseConfig = {}) {
     const serverBlock = buildMcpServerBlock({
       endpoint,
       projectId,
-      apiKey: opts.apiKey
+      apiKey: opts.apiKey,
+      inlineKey: false
+      // use ${MUSHI_API_KEY} placeholder; caller must export the key
     });
     await writeMcpServerEntry({ configPath: mcpPath, serverName, serverBlock });
     await ensureMcpJsonGitignored(cwd, messages);
     messages.push(`\u2713 Wired ${mcpPath} \u2014 restart Cursor and run "list mushi tools"`);
+    messages.push(`  Set MUSHI_API_KEY="${opts.apiKey}" in your shell / .env.local before restarting the IDE.`);
   }
   let heartbeat = null;
   if (opts.wait) {

package/dist/{connect-PKWAK4GL.js → connect-QHVFH77E.js}

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
 import {
   runConnect
-} from "./chunk-VIHWH3IG.js";
-import "./chunk-TYVJU4AH.js";
+} from "./chunk-7JZUKNN5.js";
+import "./chunk-MXD5UNMP.js";
 import "./chunk-LDPFTQLE.js";
+import "./chunk-PDX44BCA.js";
 export {
   runConnect
 };

package/dist/detect.js

@@ -8,6 +8,7 @@ import {
   isFrameworkId,
   readPackageJson
 } from "./chunk-AIZRI665.js";
+import "./chunk-3RG5ZIWI.js";
 export {
   FRAMEWORKS,
   FRAMEWORK_IDS,

package/dist/{endpoint-DGS73AVM.js → endpoint-TEBF4IH6.js}

@@ -6,6 +6,7 @@ import {
   normalizeEndpoint,
   resolveCloudEndpoint
 } from "./chunk-LDPFTQLE.js";
+import "./chunk-PDX44BCA.js";
 export {
   CLOUD_API_ENDPOINT,
   TEST_REPORT_FETCH_TIMEOUT_MS,