@mushi-mushi/cli 0.27.0 → 0.28.0

package/dist/{chunk-7JZUKNN5.js → chunk-FJETUM25.js}

@@ -2,7 +2,12 @@
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-MXD5UNMP.js";
+} from "./chunk-UVO4A2G6.js";
+import {
+  detectFramework,
+  envVarsToWrite,
+  readPackageJson
+} from "./chunk-KOBEOGNF.js";
 import {
   CLOUD_API_ENDPOINT,
   assertEndpoint,
@@ -14,7 +19,7 @@ import {
 
 // src/connect.ts
 import { appendFile, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
-import { join as join4, resolve } from "path";
+import { join as join3, resolve } from "path";
 
 // src/config.ts
 import { randomUUID } from "crypto";
@@ -69,6 +74,11 @@ var DEFAULT_PROFILE = "default";
 function isMultiProfileFile(value) {
   return typeof value === "object" && value !== null && "profiles" in value && typeof value.profiles === "object" && value.profiles !== null;
 }
+function savedSdkKeyFor(config, projectId) {
+  const saved = config.sdkKey;
+  if (!projectId || !saved || typeof saved !== "object") return void 0;
+  return saved.projectId === projectId && typeof saved.key === "string" && saved.key ? saved.key : void 0;
+}
 function resolveProfileName(explicit, fileActive) {
   const fromEnv = process.env["MUSHI_PROFILE"]?.trim();
   return explicit?.trim() || fromEnv || fileActive || DEFAULT_PROFILE;
@@ -670,446 +680,6 @@ function pad(s, width) {
   return s.length >= width ? s : s + " ".repeat(width - s.length);
 }
 
-// src/detect.ts
-import { readFileSync as readFileSync3, existsSync as existsSync3 } from "fs";
-import { join as join3 } from "path";
-var FRAMEWORKS = {
-  next: {
-    id: "next",
-    label: "Next.js",
-    packageName: "@mushi-mushi/react",
-    needsWebPackage: false,
-    snippet: () => `// app/providers.tsx (or pages/_app.tsx for /pages router)
-'use client'
-import { MushiProvider } from '@mushi-mushi/react'
-
-export function Providers({ children }: { children: React.ReactNode }) {
-  return (
-    <MushiProvider config={{
-      projectId: process.env.NEXT_PUBLIC_MUSHI_PROJECT_ID!,
-      apiKey: process.env.NEXT_PUBLIC_MUSHI_API_KEY!,
-    }}>
-      {children}
-    </MushiProvider>
-  )
-}`
-  },
-  react: {
-    id: "react",
-    label: "React",
-    packageName: "@mushi-mushi/react",
-    needsWebPackage: false,
-    snippet: () => `// src/main.tsx
-import { MushiProvider } from '@mushi-mushi/react'
-
-createRoot(document.getElementById('root')!).render(
-  <MushiProvider config={{
-    projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
-    apiKey: import.meta.env.VITE_MUSHI_API_KEY,
-  }}>
-    <App />
-  </MushiProvider>
-)`
-  },
-  cra: {
-    id: "cra",
-    label: "Create React App",
-    packageName: "@mushi-mushi/react",
-    needsWebPackage: false,
-    // CRA inlines only REACT_APP_*-prefixed vars into process.env at build time.
-    snippet: () => `// src/index.tsx
-import { MushiProvider } from '@mushi-mushi/react'
-
-root.render(
-  <MushiProvider config={{
-    projectId: process.env.REACT_APP_MUSHI_PROJECT_ID,
-    apiKey: process.env.REACT_APP_MUSHI_API_KEY,
-  }}>
-    <App />
-  </MushiProvider>
-)`
-  },
-  remix: {
-    id: "remix",
-    label: "Remix",
-    packageName: "@mushi-mushi/react",
-    needsWebPackage: false,
-    // Remix doesn't inline client env. Expose public values at runtime via the
-    // root loader + window.ENV (works on both the classic compiler and Vite).
-    snippet: () => `// app/root.tsx
-import { MushiProvider } from '@mushi-mushi/react'
-import { useLoaderData } from '@remix-run/react'
-
-export async function loader() {
-  return { ENV: {
-    MUSHI_PROJECT_ID: process.env.MUSHI_PROJECT_ID,
-    MUSHI_API_KEY: process.env.MUSHI_API_KEY,
-  } }
-}
-
-export default function App() {
-  const { ENV } = useLoaderData<typeof loader>()
-  return (
-    <html>
-      <body>
-        <MushiProvider config={{ projectId: ENV.MUSHI_PROJECT_ID, apiKey: ENV.MUSHI_API_KEY }}>
-          <Outlet />
-        </MushiProvider>
-        <Scripts />
-      </body>
-    </html>
-  )
-}`
-  },
-  astro: {
-    id: "astro",
-    label: "Astro",
-    packageName: "@mushi-mushi/web",
-    needsWebPackage: false,
-    // Astro exposes only PUBLIC_*-prefixed vars to client code (Vite-based).
-    snippet: () => `---
-// src/layouts/Layout.astro (add this <script> once, e.g. in your base layout)
----
-<script>
-  import { Mushi } from '@mushi-mushi/web'
-  Mushi.init({
-    projectId: import.meta.env.PUBLIC_MUSHI_PROJECT_ID,
-    apiKey: import.meta.env.PUBLIC_MUSHI_API_KEY,
-  })
-</script>`
-  },
-  solid: {
-    id: "solid",
-    label: "Solid",
-    packageName: "@mushi-mushi/web",
-    needsWebPackage: false,
-    // Solid / SolidStart are Vite-based → VITE_*-prefixed client env.
-    snippet: () => `// src/index.tsx (or src/app.tsx for SolidStart)
-import { onMount } from 'solid-js'
-import { Mushi } from '@mushi-mushi/web'
-
-onMount(() => {
-  Mushi.init({
-    projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
-    apiKey: import.meta.env.VITE_MUSHI_API_KEY,
-  })
-})`
-  },
-  vue: {
-    id: "vue",
-    label: "Vue 3",
-    packageName: "@mushi-mushi/vue",
-    needsWebPackage: false,
-    snippet: () => `// src/main.ts
-import { MushiPlugin } from '@mushi-mushi/vue'
-
-app.use(MushiPlugin, {
-  projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
-  apiKey: import.meta.env.VITE_MUSHI_API_KEY,
-})`
-  },
-  nuxt: {
-    id: "nuxt",
-    label: "Nuxt",
-    packageName: "@mushi-mushi/vue",
-    needsWebPackage: false,
-    snippet: () => `// plugins/mushi.client.ts
-import { MushiPlugin } from '@mushi-mushi/vue'
-
-export default defineNuxtPlugin((nuxtApp) => {
-  nuxtApp.vueApp.use(MushiPlugin, {
-    projectId: import.meta.env.NUXT_PUBLIC_MUSHI_PROJECT_ID,
-    apiKey: import.meta.env.NUXT_PUBLIC_MUSHI_API_KEY,
-  })
-})`
-  },
-  svelte: {
-    id: "svelte",
-    label: "Svelte",
-    packageName: "@mushi-mushi/svelte",
-    needsWebPackage: false,
-    snippet: () => `// src/main.ts
-import { initMushi } from '@mushi-mushi/svelte'
-
-initMushi({
-  projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
-  apiKey: import.meta.env.VITE_MUSHI_API_KEY,
-})`
-  },
-  sveltekit: {
-    id: "sveltekit",
-    label: "SvelteKit",
-    packageName: "@mushi-mushi/svelte",
-    needsWebPackage: false,
-    snippet: () => `// src/routes/+layout.svelte
-<script>
-  import { onMount } from 'svelte'
-
-  onMount(async () => {
-    const { initMushi } = await import('@mushi-mushi/svelte')
-    initMushi({
-      projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
-      apiKey: import.meta.env.VITE_MUSHI_API_KEY,
-    })
-  })
-</script>`
-  },
-  angular: {
-    id: "angular",
-    label: "Angular",
-    packageName: "@mushi-mushi/angular",
-    needsWebPackage: false,
-    snippet: () => `// src/main.ts
-import { provideMushi } from '@mushi-mushi/angular'
-
-bootstrapApplication(AppComponent, {
-  providers: [
-    provideMushi({
-      projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
-      apiKey: import.meta.env.VITE_MUSHI_API_KEY,
-    }),
-  ],
-})`
-  },
-  expo: {
-    id: "expo",
-    label: "Expo",
-    packageName: "@mushi-mushi/react-native",
-    needsWebPackage: false,
-    snippet: () => `// App.tsx
-import { MushiProvider } from '@mushi-mushi/react-native'
-
-export default function App() {
-  return (
-    <MushiProvider
-      projectId={process.env.EXPO_PUBLIC_MUSHI_PROJECT_ID!}
-      apiKey={process.env.EXPO_PUBLIC_MUSHI_API_KEY!}
-    >
-      <YourApp />
-    </MushiProvider>
-  )
-}`
-  },
-  "react-native": {
-    id: "react-native",
-    label: "React Native",
-    packageName: "@mushi-mushi/react-native",
-    needsWebPackage: false,
-    snippet: () => `// App.tsx
-import { MushiProvider } from '@mushi-mushi/react-native'
-
-export default function App() {
-  return (
-    <MushiProvider
-      projectId={process.env.MUSHI_PROJECT_ID!}
-      apiKey={process.env.MUSHI_API_KEY!}
-    >
-      <YourApp />
-    </MushiProvider>
-  )
-}`
-  },
-  capacitor: {
-    id: "capacitor",
-    label: "Capacitor (Ionic)",
-    packageName: "@mushi-mushi/capacitor",
-    needsWebPackage: false,
-    /* The Capacitor plugin's public API is `Mushi.configure(...)`, not
-     * `Mushi.init(...)` — see packages/capacitor/src/definitions.ts. We
-     * shipped the wrong call here for two releases and users got a runtime
-     * `TypeError: Mushi.init is not a function`. The accompanying admin
-     * console snippet (apps/admin/src/lib/sdkSnippets.ts) emits the same
-     * `Mushi.configure(...)` shape; both are pinned by tests. */
-    snippet: () => `// src/main.ts \u2014 after install, run \`npx cap sync\`
-import { Mushi } from '@mushi-mushi/capacitor'
-
-await Mushi.configure({
-  projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
-  apiKey: import.meta.env.VITE_MUSHI_API_KEY,
-})`
-  },
-  express: {
-    id: "express",
-    label: "Express",
-    packageName: "@mushi-mushi/node",
-    needsWebPackage: false,
-    snippet: () => `// src/instrument.ts \u2014 load with: node --import ./dist/instrument.js
-import { MushiNodeClient, attachUnhandledHook } from '@mushi-mushi/node'
-import { mushiExpressErrorHandler } from '@mushi-mushi/node/express'
-import type { Express } from 'express'
-
-export const mushi = new MushiNodeClient({
-  projectId: process.env.MUSHI_PROJECT_ID!,
-  apiKey: process.env.MUSHI_API_KEY!,
-  environment: process.env.NODE_ENV ?? 'production',
-})
-attachUnhandledHook({ client: mushi })
-
-export function attachMushi(app: Express) {
-  app.use(mushiExpressErrorHandler({ client: mushi }))
-}`
-  },
-  fastify: {
-    id: "fastify",
-    label: "Fastify",
-    packageName: "@mushi-mushi/node",
-    needsWebPackage: false,
-    snippet: () => `// src/instrument.ts \u2014 load with: node --import ./dist/instrument.js
-import { MushiNodeClient, attachUnhandledHook } from '@mushi-mushi/node'
-import { mushiFastifyPlugin } from '@mushi-mushi/node/fastify'
-import Fastify from 'fastify'
-
-export const mushi = new MushiNodeClient({
-  projectId: process.env.MUSHI_PROJECT_ID!,
-  apiKey: process.env.MUSHI_API_KEY!,
-  environment: process.env.NODE_ENV ?? 'production',
-})
-attachUnhandledHook({ client: mushi })
-
-const app = Fastify()
-mushiFastifyPlugin(app, { client: mushi })`
-  },
-  hono: {
-    id: "hono",
-    label: "Hono",
-    packageName: "@mushi-mushi/node",
-    needsWebPackage: false,
-    snippet: () => `// src/instrument.ts \u2014 load with: node --import ./dist/instrument.js
-import { MushiNodeClient, attachUnhandledHook } from '@mushi-mushi/node'
-import { mushiHonoErrorHandler } from '@mushi-mushi/node/hono'
-import { Hono } from 'hono'
-
-export const mushi = new MushiNodeClient({
-  projectId: process.env.MUSHI_PROJECT_ID!,
-  apiKey: process.env.MUSHI_API_KEY!,
-  environment: process.env.NODE_ENV ?? 'production',
-})
-attachUnhandledHook({ client: mushi })
-
-const app = new Hono()
-app.onError(
-  mushiHonoErrorHandler({ client: mushi }, (err, c) =>
-    c.text('Internal Server Error', 500),
-  ),
-)`
-  },
-  vanilla: {
-    id: "vanilla",
-    label: "Vanilla JS / unknown",
-    packageName: "@mushi-mushi/web",
-    needsWebPackage: false,
-    snippet: () => `// Anywhere in your client bundle
-import { Mushi } from '@mushi-mushi/web'
-
-Mushi.init({
-  projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
-  apiKey: import.meta.env.VITE_MUSHI_API_KEY,
-})`
-  }
-};
-function readPackageJson(cwd) {
-  const path = join3(cwd, "package.json");
-  if (!existsSync3(path)) return null;
-  try {
-    return JSON.parse(readFileSync3(path, "utf-8"));
-  } catch {
-    return null;
-  }
-}
-function detectFramework(cwd, pkg) {
-  const deps = collectDeps(pkg);
-  if (deps.has("next")) return FRAMEWORKS.next;
-  if (deps.has("nuxt")) return FRAMEWORKS.nuxt;
-  if (deps.has("@sveltejs/kit")) return FRAMEWORKS.sveltekit;
-  if (deps.has("@angular/core")) return FRAMEWORKS.angular;
-  if (deps.has("expo")) return FRAMEWORKS.expo;
-  if (deps.has("react-native")) return FRAMEWORKS["react-native"];
-  if (deps.has("@remix-run/react") || deps.has("@remix-run/node") || deps.has("@remix-run/serve")) {
-    return FRAMEWORKS.remix;
-  }
-  if (deps.has("astro")) return FRAMEWORKS.astro;
-  if (deps.has("@solidjs/start") || deps.has("solid-js")) return FRAMEWORKS.solid;
-  if (deps.has("@capacitor/core") && deps.has("react")) return FRAMEWORKS.react;
-  if (deps.has("@capacitor/core")) return FRAMEWORKS.capacitor;
-  if (deps.has("svelte")) return FRAMEWORKS.svelte;
-  if (deps.has("vue")) return FRAMEWORKS.vue;
-  if (deps.has("react-scripts")) return FRAMEWORKS.cra;
-  if (deps.has("react")) return FRAMEWORKS.react;
-  if (deps.has("express")) return FRAMEWORKS.express;
-  if (deps.has("fastify")) return FRAMEWORKS.fastify;
-  if (deps.has("hono") || deps.has("@hono/hono")) return FRAMEWORKS.hono;
-  if (existsSync3(join3(cwd, "next.config.js")) || existsSync3(join3(cwd, "next.config.ts"))) {
-    return FRAMEWORKS.next;
-  }
-  if (existsSync3(join3(cwd, "nuxt.config.ts")) || existsSync3(join3(cwd, "nuxt.config.js"))) {
-    return FRAMEWORKS.nuxt;
-  }
-  if (existsSync3(join3(cwd, "svelte.config.js"))) return FRAMEWORKS.svelte;
-  if (existsSync3(join3(cwd, "angular.json"))) return FRAMEWORKS.angular;
-  if (existsSync3(join3(cwd, "remix.config.js")) || existsSync3(join3(cwd, "remix.config.ts"))) {
-    return FRAMEWORKS.remix;
-  }
-  if (existsSync3(join3(cwd, "astro.config.mjs")) || existsSync3(join3(cwd, "astro.config.ts")) || existsSync3(join3(cwd, "astro.config.js"))) {
-    return FRAMEWORKS.astro;
-  }
-  return FRAMEWORKS.vanilla;
-}
-function detectPackageManager(cwd) {
-  if (existsSync3(join3(cwd, "bun.lockb")) || existsSync3(join3(cwd, "bun.lock"))) return "bun";
-  if (existsSync3(join3(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync3(join3(cwd, "yarn.lock"))) return "yarn";
-  if (existsSync3(join3(cwd, "package-lock.json"))) return "npm";
-  const userAgent = process.env.npm_config_user_agent ?? "";
-  if (userAgent.startsWith("bun")) return "bun";
-  if (userAgent.startsWith("pnpm")) return "pnpm";
-  if (userAgent.startsWith("yarn")) return "yarn";
-  return "npm";
-}
-function installCommand(pm, packages) {
-  const verb = pm === "npm" ? "install" : "add";
-  return `${pm} ${verb} ${packages.join(" ")}`;
-}
-var SERVER_FRAMEWORK_IDS = /* @__PURE__ */ new Set(["express", "fastify", "hono"]);
-function envVarsToWrite(apiKey, projectId, framework, endpoint) {
-  const CLOUD_ENDPOINT = "https://dxptnwrhwsqckaftyymj.supabase.co/functions/v1/api";
-  const endpointLine = endpoint && endpoint !== CLOUD_ENDPOINT ? `MUSHI_API_ENDPOINT=${endpoint}` : null;
-  if (SERVER_FRAMEWORK_IDS.has(framework.id)) {
-    return [
-      `MUSHI_PROJECT_ID=${projectId}`,
-      `MUSHI_API_KEY=${apiKey}`,
-      endpointLine
-    ].filter(Boolean).join("\n");
-  }
-  if (framework.id === "react-native" || framework.id === "remix") {
-    return [
-      `MUSHI_PROJECT_ID=${projectId}`,
-      `MUSHI_API_KEY=${apiKey}`,
-      endpointLine
-    ].filter(Boolean).join("\n");
-  }
-  if (framework.id === "expo") {
-    return [
-      `EXPO_PUBLIC_MUSHI_PROJECT_ID=${projectId}`,
-      `EXPO_PUBLIC_MUSHI_API_KEY=${apiKey}`,
-      endpointLine ? `EXPO_PUBLIC_${endpointLine}` : null
-    ].filter(Boolean).join("\n");
-  }
-  const prefix = framework.id === "next" ? "NEXT_PUBLIC_" : framework.id === "nuxt" ? "NUXT_PUBLIC_" : framework.id === "cra" ? "REACT_APP_" : framework.id === "astro" ? "PUBLIC_" : "VITE_";
-  return [
-    `${prefix}MUSHI_PROJECT_ID=${projectId}`,
-    `${prefix}MUSHI_API_KEY=${apiKey}`,
-    endpointLine ? `${prefix}${endpointLine}` : null
-  ].filter(Boolean).join("\n");
-}
-function collectDeps(pkg) {
-  if (!pkg) return /* @__PURE__ */ new Set();
-  return /* @__PURE__ */ new Set([
-    ...Object.keys(pkg.dependencies ?? {}),
-    ...Object.keys(pkg.devDependencies ?? {}),
-    ...Object.keys(pkg.peerDependencies ?? {})
-  ]);
-}
-
 // src/sanitize-config.ts
 var PROJECT_ID_RE = /^(?:proj_[A-Za-z0-9_-]{10,}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
 var API_KEY_RE = /^(mushi_|mush_pk_)[A-Za-z0-9_-]{10,}$/;
@@ -1221,55 +791,133 @@ async function waitForIngestReady(options) {
   return { ok: false, payload: lastPayload, attempts: maxAttempts, reason: "timeout" };
 }
 
+// src/key-scopes.ts
+var SDK_KEY_SCOPES = ["report:write"];
+var CLI_KEY_SCOPES = ["report:write", "mcp:read"];
+var FULL_CLI_KEY_SCOPES = ["report:write", "mcp:read", "mcp:write"];
+var SDK_KEY_LABEL = "sdk-ingest";
+var CLI_KEY_LABEL = "cli-login";
+async function probeKeyScope(endpoint, apiKey, projectId, doFetch = globalThis.fetch) {
+  let base = endpoint;
+  while (base.endsWith("/")) base = base.slice(0, -1);
+  let res;
+  try {
+    res = await doFetch(`${base}/v1/admin/mcp/account-overview`, {
+      headers: { "X-Mushi-Api-Key": apiKey, "X-Mushi-Project": projectId },
+      signal: AbortSignal.timeout(8e3)
+    });
+  } catch (err) {
+    return { result: "unreachable", message: err instanceof Error ? err.message : String(err) };
+  }
+  if (res.ok) return { result: "mcp", status: res.status };
+  if (res.status === 401) return { result: "invalid", status: res.status };
+  if (res.status === 403) {
+    const body = await res.json().catch(() => null);
+    const code = body?.error?.code ?? body?.code;
+    if (code === "INSUFFICIENT_SCOPE") return { result: "ingest-only", status: res.status };
+  }
+  return { result: "unknown", status: res.status };
+}
+function describeUnsafeSdkKey(probe, endpoint) {
+  switch (probe.result) {
+    case "mcp":
+      return "this key can read your bug reports (mcp scope), and SDK env vars ship inside the app bundle";
+    case "invalid":
+      return "the backend rejected this key";
+    case "unreachable":
+      return `could not reach ${endpoint} to confirm the key is ingest-only (${probe.message ?? "network error"})`;
+    case "unknown":
+      return `could not confirm the key is ingest-only (HTTP ${probe.status ?? "?"})`;
+    case "ingest-only":
+      return "the key is ingest-only";
+  }
+}
+
 // src/mcp-config.ts
 import { mkdir, readFile, writeFile } from "fs/promises";
 import { dirname as dirname3 } from "path";
 var DEFAULT_MUSHI_FEATURES = "triage,fixes,inventory,setup,docs";
+var MCP_CLIENTS = ["cursor", "claude", "continue", "zed"];
+function isMcpClient(value) {
+  return typeof value === "string" && MCP_CLIENTS.includes(value);
+}
+var MCP_CLIENT_LABEL = {
+  cursor: "Cursor",
+  claude: "Claude Code",
+  continue: "Continue",
+  zed: "Zed"
+};
+function buildHostedMcpServerBlock(url) {
+  return { type: "http", url };
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 async function writeMcpServerEntry(opts) {
   const { configPath, serverName, serverBlock, dryRun = false } = opts;
-  let merged = { mcpServers: {} };
-  let created = false;
+  let existing = null;
   try {
-    const existing = await readFile(configPath, "utf8");
+    existing = await readFile(configPath, "utf8");
+  } catch {
+    existing = null;
+  }
+  let merged = {};
+  if (existing !== null && existing.trim() !== "") {
+    let parsed;
     try {
-      merged = JSON.parse(existing);
+      parsed = JSON.parse(existing);
     } catch {
-      merged = { mcpServers: {} };
+      throw new Error(`${configPath} is not valid JSON \u2014 fix or remove it, then re-run (nothing was written).`);
     }
-  } catch {
-    created = true;
-    merged = { mcpServers: {} };
+    if (!isPlainObject(parsed)) {
+      throw new Error(`${configPath} is not a JSON object \u2014 fix or remove it, then re-run (nothing was written).`);
+    }
+    merged = parsed;
   }
-  const servers = merged.mcpServers ?? {};
-  servers[serverName] = serverBlock;
-  merged.mcpServers = servers;
+  const currentServers = merged.mcpServers;
+  if (currentServers !== void 0 && !isPlainObject(currentServers)) {
+    throw new Error(`${configPath} has an "mcpServers" field that is not an object \u2014 fix it, then re-run (nothing was written).`);
+  }
+  merged.mcpServers = { ...currentServers ?? {}, [serverName]: serverBlock };
   const output = JSON.stringify(merged, null, 2) + "\n";
   if (!dryRun) {
     await mkdir(dirname3(configPath), { recursive: true });
     await writeFile(configPath, output, "utf8");
   }
-  return { created, path: configPath };
+  return { created: existing === null, path: configPath };
+}
+function apiKeyPlaceholderFor(client) {
+  switch (client) {
+    case "cursor":
+      return "${env:MUSHI_API_KEY}";
+    case "claude":
+      return "${MUSHI_API_KEY:-}";
+    case "continue":
+    case "zed":
+      return null;
+  }
 }
 function buildMcpServerBlock(opts) {
+  const keyValue = opts.inlineKey ? opts.apiKey : apiKeyPlaceholderFor(opts.client);
   return {
     command: "npx",
     args: ["-y", MUSHI_MCP_PIN_SPEC],
     env: {
       MUSHI_API_ENDPOINT: opts.endpoint,
       MUSHI_PROJECT_ID: opts.projectId,
-      MUSHI_API_KEY: opts.inlineKey ? opts.apiKey : "${MUSHI_API_KEY}",
+      ...keyValue !== null ? { MUSHI_API_KEY: keyValue } : {},
       MUSHI_FEATURES: DEFAULT_MUSHI_FEATURES
     }
   };
 }
-function printKeyExportHint(apiKey) {
-  console.log("");
-  console.log("  Your API key was NOT written into the config file (prevents git leaks).");
-  console.log("  Add it to your shell profile or .env.local:");
-  console.log("");
-  console.log(`    export MUSHI_API_KEY="${apiKey}"`);
+function printKeyExportHint(client, configPath = CONFIG_PATH) {
   console.log("");
-  console.log("  Then restart your IDE. To write the key inline instead, re-run with --inline-key.");
+  console.log("  No API key was written into the MCP config (safe to commit).");
+  console.log(`  The MCP server uses the key \`mushi login\` saved in ${configPath}.`);
+  if (apiKeyPlaceholderFor(client) !== null) {
+    console.log(`  To use a different key, export MUSHI_API_KEY in the environment ${MCP_CLIENT_LABEL[client]} is launched from.`);
+  }
+  console.log("  To write the key into the file instead (keep it out of git), re-run with --inline-key.");
 }
 function buildMcpServerName(opts) {
   if (opts.legacy) return "mushi";
@@ -1281,6 +929,12 @@ function buildMcpServerName(opts) {
 }
 
 // src/connect.ts
+async function resolveSdkEnvKey(opts) {
+  const candidate = opts.sdkKey ?? savedSdkKeyFor(opts.baseConfig, opts.projectId) ?? opts.apiKey;
+  const probe = await opts.probe(opts.endpoint, candidate, opts.projectId);
+  if (probe.result === "ingest-only") return { ok: true, key: candidate };
+  return { ok: false, reason: describeUnsafeSdkKey(probe, opts.endpoint) };
+}
 function envKeyPresent(content, key) {
   const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   return new RegExp(`^${escaped}=`, "m").test(content);
@@ -1310,44 +964,41 @@ ${needs.join("\n")}
   await writeFile2(path, block, "utf8");
   return true;
 }
-async function ensureMcpJsonGitignored(cwd, messages) {
-  const gitignorePath = join4(cwd, ".gitignore");
-  const patterns = [".cursor/mcp.json", ".cursor/"];
-  let content = null;
-  try {
-    content = await readFile2(gitignorePath, "utf8");
-  } catch {
-  }
-  if (content === null) {
-    messages.push(
-      "\u26A0 No .gitignore found \u2014 .cursor/mcp.json contains your API key. Add `.cursor/mcp.json` before committing."
-    );
-    return;
-  }
-  const covered = patterns.some((p) => content.split("\n").some((line) => line.trim() === p || line.trim() === `${p}/`));
-  if (covered) return;
-  await appendFile(gitignorePath, "\n# Mushi \u2014 keep MCP credentials out of git\n.cursor/mcp.json\n", "utf8");
-  messages.push("\u2713 Added .cursor/mcp.json to .gitignore (contains API key)");
-}
 async function runConnect(opts, baseConfig = {}) {
   const cwd = resolve(opts.cwd ?? process.cwd());
   const endpoint = assertEndpoint(opts.endpoint);
   const projectId = requireUuid(opts.projectId, "projectId");
   const messages = [];
+  const writeEnv = opts.writeEnv !== false;
+  const sdkEnvKey = writeEnv ? await resolveSdkEnvKey({
+    sdkKey: opts.sdkKey,
+    apiKey: opts.apiKey,
+    projectId,
+    endpoint,
+    baseConfig,
+    probe: opts.probeKeyScope ?? probeKeyScope
+  }) : null;
   const config = {
     ...baseConfig,
     apiKey: opts.apiKey,
     projectId,
-    endpoint
+    endpoint,
+    ...sdkEnvKey?.ok ? { sdkKey: { projectId, key: sdkEnvKey.key } } : {}
   };
   saveConfig(config);
   messages.push(`\u2713 Credentials saved to ${CONFIG_PATH}`);
   let envPath = null;
-  if (opts.writeEnv !== false) {
+  let envRefused = false;
+  if (sdkEnvKey && !sdkEnvKey.ok) {
+    envRefused = true;
+    messages.push(
+      `\u2717 Did not write SDK env vars: ${sdkEnvKey.reason}. Pass an ingest-only key with --sdk-key <key> (console \u2192 Projects \u2192 API keys, scope report:write), or run \`npx mushi-mushi\`, which mints one.`
+    );
+  } else if (sdkEnvKey?.ok) {
     const pkg = readPackageJson(cwd);
     const framework = detectFramework(cwd, pkg);
-    const lines = envVarsToWrite(opts.apiKey, projectId, framework).split("\n");
-    envPath = join4(cwd, ".env.local");
+    const lines = envVarsToWrite(sdkEnvKey.key, projectId, framework).split("\n");
+    envPath = join3(cwd, ".env.local");
     const wrote = await mergeEnvFile(envPath, lines);
     messages.push(
       wrote ? `\u2713 Env vars merged into ${envPath}` : `\u2713 Env vars already present in ${envPath} (existing values left untouched)`
@@ -1361,20 +1012,20 @@ async function runConnect(opts, baseConfig = {}) {
   }
   let mcpPath = null;
   if (opts.wireIde !== false) {
-    const mcpDir = join4(cwd, ".cursor");
-    mcpPath = join4(mcpDir, "mcp.json");
+    const mcpDir = join3(cwd, ".cursor");
+    mcpPath = join3(mcpDir, "mcp.json");
     const serverName = buildMcpServerName({ projectId });
     const serverBlock = buildMcpServerBlock({
       endpoint,
       projectId,
       apiKey: opts.apiKey,
+      client: "cursor",
       inlineKey: false
-      // use ${MUSHI_API_KEY} placeholder; caller must export the key
+      // no secret in the file; the MCP server reads the saved CLI key
     });
     await writeMcpServerEntry({ configPath: mcpPath, serverName, serverBlock });
-    await ensureMcpJsonGitignored(cwd, messages);
     messages.push(`\u2713 Wired ${mcpPath} \u2014 restart Cursor and run "list mushi tools"`);
-    messages.push(`  Set MUSHI_API_KEY="${opts.apiKey}" in your shell / .env.local before restarting the IDE.`);
+    messages.push(`  The MCP server reads the key saved in ${CONFIG_PATH} (export MUSHI_API_KEY before launching Cursor to override it).`);
   }
   let heartbeat = null;
   if (opts.wait) {
@@ -1408,7 +1059,7 @@ async function runConnect(opts, baseConfig = {}) {
       );
     }
   }
-  const ok = !opts.wait || Boolean(heartbeat?.ok);
+  const ok = !envRefused && (!opts.wait || Boolean(heartbeat?.ok));
   return { ok, envPath, mcpPath, heartbeat, messages };
 }
 
@@ -1416,19 +1067,22 @@ export {
   printAndExit,
   installSignalHandlers,
   trySaveKeyToKeychain,
+  savedSdkKeyFor,
   resolveProfileName,
+  CONFIG_PATH,
   loadConfig,
   ensureClientId,
   maybeShowTelemetryNotice,
   saveConfig,
   listProfiles,
   setActiveProfile,
-  FRAMEWORKS,
-  readPackageJson,
-  detectFramework,
-  detectPackageManager,
-  installCommand,
-  envVarsToWrite,
+  SDK_KEY_SCOPES,
+  CLI_KEY_SCOPES,
+  FULL_CLI_KEY_SCOPES,
+  SDK_KEY_LABEL,
+  CLI_KEY_LABEL,
+  probeKeyScope,
+  describeUnsafeSdkKey,
   consoleUrl,
   resolveConsoleUrlSync,
   resolveConsoleUrl,
@@ -1453,9 +1107,14 @@ export {
   sanitizeCliCredentials,
   apiKeyHeaders,
   fetchIngestSetup,
+  MCP_CLIENTS,
+  isMcpClient,
+  MCP_CLIENT_LABEL,
+  buildHostedMcpServerBlock,
   writeMcpServerEntry,
   buildMcpServerBlock,
   printKeyExportHint,
   buildMcpServerName,
+  resolveSdkEnvKey,
   runConnect
 };