@mushi-mushi/cli 0.27.0 → 0.28.0

package/dist/init.js

@@ -1,28 +1,34 @@
 import {
-  TEST_REPORT_FETCH_TIMEOUT_MS,
+  CLI_KEY_LABEL,
+  CLI_KEY_SCOPES,
+  SDK_KEY_LABEL,
+  SDK_KEY_SCOPES,
   apiCall,
   apiKeyHeaders,
   apiKeyHint,
   cliSetupDeepLink,
   consoleUrl,
+  describeUnsafeSdkKey,
   ensureClientId,
   fetchIngestSetup,
   loadConfig,
   maybeShowTelemetryNotice,
-  normalizeEndpoint,
   openInBrowser,
+  probeKeyScope,
   projectIdHint,
   reportsUrl,
-  resolveCloudEndpoint,
   resolveConsoleUrl,
   resolveConsoleUrlSync,
+  resolveProfileName,
   sanitizeCliCredentials,
   sanitizeEndpoint,
-  saveConfig
-} from "./chunk-TZL3F3GT.js";
+  saveConfig,
+  savedSdkKeyFor,
+  trySaveKeyToKeychain
+} from "./chunk-AV3RKAEE.js";
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-LFZ5ZIBI.js";
+} from "./chunk-U2VGB63C.js";
 import {
   FRAMEWORKS,
   detectFramework,
@@ -31,6 +37,12 @@ import {
   installCommand,
   readPackageJson
 } from "./chunk-AIZRI665.js";
+import {
+  CLOUD_API_ENDPOINT,
+  TEST_REPORT_FETCH_TIMEOUT_MS,
+  normalizeEndpoint,
+  resolveCloudEndpoint
+} from "./chunk-SXSI2W6Z.js";
 import "./chunk-3RG5ZIWI.js";
 
 // src/init.ts
@@ -255,6 +267,49 @@ async function mintProjectKey(endpoint, cliToken, projectId, opts = {}) {
   );
 }
 
+// src/auth-ui.ts
+var LINE = "\u2500".repeat(58);
+function printAuthBanner(userCode, verificationUri) {
+  console.log("");
+  console.log(`  \u250C${LINE}\u2510`);
+  console.log(`  \u2502  Browser sign-in \u2014 follow these 3 steps              \u2502`);
+  console.log(`  \u251C${LINE}\u2524`);
+  console.log(`  \u2502                                                        \u2502`);
+  console.log(`  \u2502  1. A browser tab will open (or visit the URL below)  \u2502`);
+  console.log(`  \u2502  2. Sign in if prompted, then click "Approve"         \u2502`);
+  console.log(`  \u2502  3. Come back here \u2014 setup continues automatically    \u2502`);
+  console.log(`  \u2502                                                        \u2502`);
+  console.log(`  \u251C${LINE}\u2524`);
+  console.log(`  \u2502  Verification code (show in browser \u2014 NOT terminal):  \u2502`);
+  console.log(`  \u2502                                                        \u2502`);
+  console.log(`  \u2502    ${userCode.padEnd(52)}\u2502`);
+  console.log(`  \u2502                                                        \u2502`);
+  console.log(`  \u2502  \u26A0  Do NOT paste or type this code in your terminal   \u2502`);
+  console.log(`  \u2514${LINE}\u2518`);
+  console.log("");
+  console.log(`  If the browser didn't open, visit this URL and approve:`);
+  console.log(`    ${verificationUri}`);
+  console.log("");
+  console.log("  \u23F3 Waiting for browser approval\u2026 (Ctrl+C to cancel)");
+  console.log("");
+}
+
+// src/login.ts
+function slugify(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+}
+function defaultProjectName(packageName, cwd) {
+  const fromPkg = packageName?.replace(/^@[^/]+\//, "").trim();
+  if (fromPkg) return fromPkg;
+  const parts = cwd.split(/[\\/]/).filter(Boolean);
+  return parts[parts.length - 1] || "my-app";
+}
+function chooseProjectNonInteractive(projects, preferredName) {
+  const wanted = slugify(preferredName);
+  const match = projects.find((p2) => slugify(p2.name) === wanted || p2.slug !== void 0 && slugify(p2.slug) === wanted);
+  return match ? { kind: "existing", id: match.id, name: match.name } : { kind: "new", name: preferredName };
+}
+
 // src/freshness.ts
 var REGISTRY = "https://registry.npmjs.org";
 var DEFAULT_TIMEOUT_MS = 2e3;
@@ -411,50 +466,27 @@ function getFrameworkFromPkg(pkg) {
   return void 0;
 }
 
-// src/auth-ui.ts
-var LINE = "\u2500".repeat(58);
-function printAuthBanner(userCode, verificationUri) {
-  console.log("");
-  console.log(`  \u250C${LINE}\u2510`);
-  console.log(`  \u2502  Browser sign-in \u2014 follow these 3 steps              \u2502`);
-  console.log(`  \u251C${LINE}\u2524`);
-  console.log(`  \u2502                                                        \u2502`);
-  console.log(`  \u2502  1. A browser tab will open (or visit the URL below)  \u2502`);
-  console.log(`  \u2502  2. Sign in if prompted, then click "Approve"         \u2502`);
-  console.log(`  \u2502  3. Come back here \u2014 setup continues automatically    \u2502`);
-  console.log(`  \u2502                                                        \u2502`);
-  console.log(`  \u251C${LINE}\u2524`);
-  console.log(`  \u2502  Verification code (show in browser \u2014 NOT terminal):  \u2502`);
-  console.log(`  \u2502                                                        \u2502`);
-  console.log(`  \u2502    ${userCode.padEnd(52)}\u2502`);
-  console.log(`  \u2502                                                        \u2502`);
-  console.log(`  \u2502  \u26A0  Do NOT paste or type this code in your terminal   \u2502`);
-  console.log(`  \u2514${LINE}\u2518`);
-  console.log("");
-  console.log(`  If the browser didn't open, visit this URL and approve:`);
-  console.log(`    ${verificationUri}`);
-  console.log("");
-  console.log("  \u23F3 Waiting for browser approval\u2026 (Ctrl+C to cancel)");
-  console.log("");
-}
-
 // src/doctor.ts
+var SIGN_IN_HINT = "Run `npx mushi-mushi` in your app folder \u2014 browser sign-in saves the API key, project and endpoint.";
 function checkCliConfig(config) {
   return [
     {
+      // No saved endpoint is not a failure: every command falls back to Mushi
+      // Cloud (endpoint.ts), so reporting "No endpoint" first sent people
+      // hunting for a URL they never needed.
       name: "CLI config file",
-      ok: Boolean(config.endpoint),
-      detail: config.endpoint ? `endpoint=${config.endpoint}` : "No endpoint \u2014 set MUSHI_API_ENDPOINT, run `mushi connect`, or `mushi config endpoint <url>`"
+      ok: true,
+      detail: config.endpoint ? `endpoint=${config.endpoint}` : `endpoint=${CLOUD_API_ENDPOINT} (Mushi Cloud default \u2014 set MUSHI_API_ENDPOINT for a self-hosted backend)`
     },
     {
       name: "API key configured",
       ok: Boolean(config.apiKey),
-      detail: config.apiKey ? `apiKey=${config.apiKey.slice(0, 8)}\u2026${config.apiKey.slice(-4)}` : "No API key set \u2014 run `mushi login --api-key <key>`"
+      detail: config.apiKey ? `apiKey=${config.apiKey.slice(0, 8)}\u2026${config.apiKey.slice(-4)}` : "No API key saved."
     },
     {
       name: "Project ID configured",
       ok: Boolean(config.projectId),
-      detail: config.projectId ? `projectId=${config.projectId}` : "No default project \u2014 set via `mushi config projectId <uuid>`"
+      detail: config.projectId ? `projectId=${config.projectId}` : "No default project saved."
     }
   ];
 }
@@ -476,16 +508,7 @@ async function checkEndpointReachability(endpoint, doFetch = globalThis.fetch) {
 }
 async function checkCliAuthPath(config, doFetch = globalThis.fetch) {
   const checks = [];
-  if (!config.endpoint) {
-    return [
-      {
-        name: "Sign-in route reachable",
-        ok: false,
-        detail: "No endpoint configured \u2014 run `npx mushi-mushi` or pass MUSHI_API_ENDPOINT."
-      }
-    ];
-  }
-  const base = sanitizeEndpoint(config.endpoint);
+  const base = sanitizeEndpoint(config.endpoint ?? CLOUD_API_ENDPOINT);
   let dateHeader = null;
   try {
     const res = await doFetch(`${base}/v1/cli/auth/device/token`, {
@@ -568,13 +591,18 @@ async function checkSdkInstall(cwd) {
       "@mushi-mushi/react",
       "@mushi-mushi/web",
       "@mushi-mushi/core",
-      "@mushi-mushi/react-native"
+      "@mushi-mushi/react-native",
+      "@mushi-mushi/vue",
+      "@mushi-mushi/svelte",
+      "@mushi-mushi/angular",
+      "@mushi-mushi/capacitor",
+      "@mushi-mushi/node"
     ];
     const installed = sdks.filter((s) => deps[s]);
     return {
       name: "SDK installed in this repo",
       ok: installed.length > 0,
-      detail: installed.length > 0 ? installed.map((s) => `${s}@${deps[s]}`).join(", ") : "No @mushi-mushi/* package in package.json \u2014 run `mushi init` to install"
+      detail: installed.length > 0 ? installed.map((s) => `${s}@${deps[s]}`).join(", ") : "No @mushi-mushi/* package in package.json \u2014 run `npx mushi-mushi` to install"
     };
   } catch {
     return null;
@@ -790,16 +818,19 @@ async function checkHostAppWiring(cwd) {
       ok: hasProjectId && hasApiKey,
       detail: hasProjectId && hasApiKey ? "VITE_/MUSHI_ project id + API key found" : "Run `mushi connect --write-env` or add VITE_MUSHI_PROJECT_ID + VITE_MUSHI_API_KEY"
     });
-    let mcpPresent = false;
-    try {
-      await access(join3(root, ".cursor", "mcp.json"));
-      mcpPresent = true;
-    } catch {
+    let mcpFound = null;
+    for (const rel of [".mcp.json", join3(".cursor", "mcp.json")]) {
+      try {
+        await access(join3(root, rel));
+        mcpFound = rel;
+        break;
+      } catch {
+      }
     }
     checks.push({
-      name: "[host] Cursor MCP config",
-      ok: mcpPresent,
-      detail: mcpPresent ? ".cursor/mcp.json present" : "Run `mushi connect` to wire MCP for two-way reporter replies"
+      name: "[host] MCP config",
+      ok: mcpFound !== null,
+      detail: mcpFound ? `${mcpFound} present` : "No .mcp.json (Claude Code) or .cursor/mcp.json (Cursor) \u2014 run `npx mushi-mushi setup --ide claude` or `--ide cursor` for two-way reporter replies"
     });
     if (isCapHybrid) {
       const hasWebSdk = Boolean(deps["@mushi-mushi/web"] || deps["@mushi-mushi/react"]);
@@ -888,95 +919,140 @@ async function checkHashRouterCapture(cwd) {
     }
   ];
 }
-async function checkMcpConfig(config, cwd, doFetch = globalThis.fetch) {
-  const checks = [];
+function isJsonObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeProjectPath(path) {
+  const slashed = path.replace(/\\/g, "/").replace(/\/+$/, "");
+  return process.platform === "win32" ? slashed.toLowerCase() : slashed;
+}
+async function collectMcpSources(root, home) {
   const { readFile } = await import("fs/promises");
-  const { join: join3, resolve: resolve2 } = await import("path");
-  const { homedir } = await import("os");
-  const root = resolve2(cwd);
-  const candidates = [join3(root, ".cursor", "mcp.json"), join3(homedir(), ".cursor", "mcp.json")];
-  let mcpPath = null;
-  let mcpRaw = null;
-  for (const candidate of candidates) {
+  const { join: join3 } = await import("path");
+  const sources = [];
+  const invalid = [];
+  const plainFiles = [
+    { path: join3(root, ".mcp.json"), claudeCode: true },
+    { path: join3(root, ".cursor", "mcp.json"), claudeCode: false },
+    { path: join3(home, ".cursor", "mcp.json"), claudeCode: false }
+  ];
+  for (const file of plainFiles) {
+    let raw;
     try {
-      const raw = await readFile(candidate, "utf8");
-      let parsed = {};
-      try {
-        parsed = JSON.parse(raw);
-      } catch {
-      }
-      const hasEntries = Object.keys(parsed.mcpServers ?? {}).length > 0;
-      if (!hasEntries && candidates.indexOf(candidate) < candidates.length - 1) {
-        continue;
-      }
-      mcpRaw = raw;
-      mcpPath = candidate;
-      break;
+      raw = await readFile(file.path, "utf8");
     } catch {
+      continue;
+    }
+    try {
+      const parsed = JSON.parse(raw);
+      const servers = isJsonObject(parsed) && isJsonObject(parsed.mcpServers) ? parsed.mcpServers : {};
+      sources.push({ path: file.path, servers, claudeCode: file.claudeCode });
+    } catch {
+      invalid.push(file.path);
+    }
+  }
+  const claudeJsonPath = join3(home, ".claude.json");
+  try {
+    const parsed = JSON.parse(await readFile(claudeJsonPath, "utf8"));
+    if (isJsonObject(parsed)) {
+      const servers = isJsonObject(parsed.mcpServers) ? { ...parsed.mcpServers } : {};
+      const projects = isJsonObject(parsed.projects) ? parsed.projects : {};
+      const wanted = normalizeProjectPath(root);
+      for (const [projectPath, entry] of Object.entries(projects)) {
+        if (normalizeProjectPath(projectPath) === wanted && isJsonObject(entry) && isJsonObject(entry.mcpServers)) {
+          Object.assign(servers, entry.mcpServers);
+        }
+      }
+      sources.push({ path: claudeJsonPath, servers, claudeCode: true });
+    }
+  } catch {
+  }
+  return { sources, invalid };
+}
+function assessMushiEntry(source, name, entry, cliKeySaved) {
+  const label = `${name} (${source.path})`;
+  if (!isJsonObject(entry)) return { usable: false, stdio: false, detail: `${label}: not an object` };
+  if (typeof entry.url === "string") {
+    if (source.claudeCode && entry.type !== "http" && entry.type !== "sse") {
+      return {
+        usable: false,
+        stdio: false,
+        detail: `${label}: has a url but no "type": "http" \u2014 Claude Code skips it`
+      };
     }
+    return { usable: true, stdio: false, detail: `${label}: hosted OAuth \u2014 sign in from the IDE's MCP panel` };
+  }
+  const env = isJsonObject(entry.env) ? entry.env : {};
+  const key = env.MUSHI_API_KEY;
+  const endpoint = env.MUSHI_API_ENDPOINT;
+  if (typeof endpoint === "string" && !/^https?:\/\//.test(endpoint) && !/^\$\{.+\}$/.test(endpoint)) {
+    return { usable: false, stdio: true, detail: `${label}: MUSHI_API_ENDPOINT is not a URL` };
+  }
+  if (typeof key === "string" && key.startsWith("mushi_")) {
+    return { usable: true, stdio: true, detail: `${label}: key written inline` };
+  }
+  if (key === void 0 || typeof key === "string" && /^\$\{.*\}$/.test(key)) {
+    return cliKeySaved ? { usable: true, stdio: true, detail: `${label}: key from MUSHI_API_KEY or the saved CLI config` } : {
+      usable: false,
+      stdio: true,
+      detail: `${label}: reads the key from MUSHI_API_KEY or the CLI config, and neither is set`
+    };
   }
-  if (!mcpPath || !mcpRaw) {
+  return { usable: false, stdio: true, detail: `${label}: MUSHI_API_KEY is neither a mushi_ key nor a placeholder` };
+}
+async function checkMcpConfig(config, cwd, doFetch = globalThis.fetch, home) {
+  const checks = [];
+  const { resolve: resolve2 } = await import("path");
+  const { homedir } = await import("os");
+  const root = resolve2(cwd);
+  const { sources, invalid } = await collectMcpSources(root, home ?? homedir());
+  if (invalid.length > 0) {
     checks.push({
-      name: "[mcp] mcp.json present",
+      name: "[mcp] MCP config valid JSON",
       ok: false,
-      detail: "No .cursor/mcp.json found in cwd or ~/.cursor/. Run `mushi setup` to create it."
+      detail: `Not valid JSON: ${invalid.join(", ")}`
     });
+  }
+  if (sources.length === 0) {
+    if (invalid.length === 0) {
+      checks.push({
+        name: "[mcp] MCP config present",
+        ok: false,
+        detail: "No .mcp.json, .cursor/mcp.json, ~/.cursor/mcp.json or ~/.claude.json found."
+      });
+    }
     return checks;
   }
   checks.push({
-    name: "[mcp] mcp.json present",
+    name: "[mcp] MCP config present",
     ok: true,
-    detail: `Found at ${mcpPath}`
+    detail: `Found: ${sources.map((s) => s.path).join(", ")}`
   });
-  let mcpConfig = {};
-  try {
-    mcpConfig = JSON.parse(mcpRaw);
-  } catch {
-    checks.push({
-      name: "[mcp] mcp.json valid JSON",
-      ok: false,
-      detail: "mcp.json is not valid JSON \u2014 regenerate with `mushi setup`."
-    });
-    return checks;
-  }
-  const servers = mcpConfig.mcpServers ?? {};
-  const mushiEntries = Object.entries(servers).filter(
-    ([k]) => k === "mushi" || k.startsWith("mushi-")
+  const mushiEntries = sources.flatMap(
+    (source) => Object.entries(source.servers).filter(([name]) => name === "mushi" || name.startsWith("mushi-")).map(([name, entry]) => ({ source, name, entry }))
   );
   if (mushiEntries.length === 0) {
     checks.push({
       name: "[mcp] mushi server entry",
       ok: false,
-      detail: "No mushi or mushi-* server found in mcpServers. Run `mushi setup` to add one."
+      detail: "No mushi or mushi-* server in any MCP config."
     });
     return checks;
   }
   checks.push({
     name: "[mcp] mushi server entry",
     ok: true,
-    detail: `Found: ${mushiEntries.map(([k]) => k).join(", ")}`
-  });
-  let anyKeyValid = false;
-  let anyEndpointSet = false;
-  for (const [, srv] of mushiEntries) {
-    const s = srv;
-    const env = s.env ?? {};
-    const key = env["MUSHI_API_KEY"] ?? "";
-    const endpoint = env["MUSHI_API_ENDPOINT"] ?? "";
-    if (key.startsWith("mushi_")) anyKeyValid = true;
-    if (endpoint.includes("supabase.co") || endpoint.includes("localhost")) anyEndpointSet = true;
-  }
-  checks.push({
-    name: "[mcp] MUSHI_API_KEY set",
-    ok: anyKeyValid,
-    detail: anyKeyValid ? "At least one mushi server has a valid mushi_* API key" : "No mushi_* API key found in any mushi server env. Re-run `mushi setup` to regenerate."
+    detail: `Found: ${mushiEntries.map(({ name }) => name).join(", ")}`
   });
+  const assessed = mushiEntries.map(
+    ({ source, name, entry }) => assessMushiEntry(source, name, entry, Boolean(config.apiKey))
+  );
   checks.push({
-    name: "[mcp] MUSHI_API_ENDPOINT set",
-    ok: anyEndpointSet,
-    detail: anyEndpointSet ? "MUSHI_API_ENDPOINT is present and looks valid" : "MUSHI_API_ENDPOINT missing or not a Supabase URL. Re-run `mushi setup`."
+    name: "[mcp] mushi entries usable",
+    ok: assessed.every((a) => a.usable),
+    detail: assessed.map((a) => a.detail).join("; ")
   });
-  if (anyKeyValid && anyEndpointSet && config.apiKey && config.endpoint) {
+  if (assessed.some((a) => a.stdio && a.usable) && config.apiKey && config.endpoint) {
     try {
       const { endpoint, apiKey } = sanitizeCliCredentials(config);
       const res = await doFetch(`${endpoint}/v1/admin/mcp/account-overview`, {
@@ -1020,13 +1096,13 @@ async function checkMcpConfig(config, cwd, doFetch = globalThis.fetch) {
   return checks;
 }
 var FIX_HINTS = {
-  "CLI config file": "Run `mushi connect --endpoint <url> --project-id <uuid> --api-key mushi_xxx` or `mushi config endpoint <url>`.",
-  "API key configured": "Mint a key in the console (Projects \u2192 API Keys) then `mushi login --api-key mushi_xxx`.",
-  "Project ID configured": "Copy the project UUID from the console Projects page \u2192 `mushi config projectId <uuid>`.",
+  "Mushi set up here": "Run `npx mushi-mushi` in your app folder \u2014 it signs you in, installs the SDK and writes the env vars.",
+  "API key configured": SIGN_IN_HINT,
+  "Project ID configured": SIGN_IN_HINT,
   "Endpoint reachable": "Check your network and that MUSHI_API_ENDPOINT points at `\u2026/functions/v1/api`.",
   "[ingest]": "Open the console Onboarding wizard \u2192 Install SDK \u2192 submit a test report, or run `mushi connect --wait`.",
   "[server]": "Open Settings \u2192 Integrations: connect GitHub, index codebase, add Anthropic BYOK key, enable autofix.",
-  "[mcp]": "Run `mushi setup` to regenerate .cursor/mcp.json with a fresh API key and endpoint."
+  "[mcp]": "Run `npx mushi-mushi setup --ide cursor` (or `--ide claude`) to rewrite the Mushi MCP entry."
 };
 function fixHintForCheck(name) {
   if (FIX_HINTS[name]) return FIX_HINTS[name];
@@ -1135,11 +1211,23 @@ async function runDoctor(config, options = {}) {
   const isFull = options.full === true;
   const runServer = isFull || options.server !== false;
   const runIngest = isFull || options.ingest !== false;
+  const sdkCheck = await checkSdkInstall(options.cwd ?? process.cwd());
+  if (!config.apiKey && !config.projectId && !sdkCheck?.ok && !options.auth && !isFull) {
+    return {
+      ready: false,
+      checks: [
+        {
+          name: "Mushi set up here",
+          ok: false,
+          detail: "Not set up yet \u2014 no saved Mushi credentials and no Mushi SDK in this folder."
+        }
+      ]
+    };
+  }
   checks.push(...checkCliConfig(config));
   if (config.endpoint) {
     checks.push(await checkEndpointReachability(config.endpoint, doFetch));
   }
-  const sdkCheck = await checkSdkInstall(options.cwd ?? process.cwd());
   if (sdkCheck) checks.push(sdkCheck);
   if (sdkCheck?.ok && !sdkCheck.warn) {
     const { findSdkImport } = await import("./snippet-inject-7ABYE57O.js");
@@ -1199,13 +1287,17 @@ function formatDoctorResult(result) {
   const WARN = "WARN";
   const FAIL = "FAIL";
   const lines = [];
+  const printedHints = /* @__PURE__ */ new Set();
   for (const c of result.checks) {
     const icon = !c.ok ? FAIL : c.warn ? WARN : PASS;
     lines.push(`${icon} ${c.name}`);
     if (c.detail) lines.push(`  ${c.detail}`);
     if (!c.ok) {
       const hint = fixHintForCheck(c.name);
-      if (hint) lines.push(`  \u2192 Fix: ${hint}`);
+      if (hint && !printedHints.has(hint)) {
+        printedHints.add(hint);
+        lines.push(`  \u2192 Fix: ${hint}`);
+      }
     }
   }
   const failed = result.checks.filter((c) => !c.ok);
@@ -1229,6 +1321,9 @@ ${failed.length} check${failed.length === 1 ? "" : "s"} failed.`);
 
 // src/init.ts
 var ENV_FILES = [".env.local", ".env"];
+function isInteractive() {
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY);
+}
 var PROJECT_ID_PATTERN = /^(?:proj_[A-Za-z0-9_-]{10,}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
 var API_KEY_PATTERN = /^(mushi_|mush_pk_)[A-Za-z0-9_-]{10,}$/;
 async function runInit(options = {}) {
@@ -1238,6 +1333,7 @@ async function runInit(options = {}) {
     return;
   }
   ensureInteractiveOrBailOut(options);
+  if (!isInteractive()) options = { ...options, yes: true };
   p.intro("Mushi setup");
   await printFreshnessHint();
   warnIfWorkspaceRoot(cwd);
@@ -1245,6 +1341,10 @@ async function runInit(options = {}) {
   maybeSuggestAudit(pkg);
   if (!pkg) {
     p.log.warn("No package.json found in this directory.");
+    if (!isInteractive()) {
+      p.cancel("Aborted. Run from your project root, or pass --cwd <path>.");
+      process.exit(1);
+    }
     const cont = await p.confirm({
       message: "Continue anyway? (Mushi will install into the current folder)",
       initialValue: false
@@ -1272,13 +1372,13 @@ async function runInit(options = {}) {
   }
   await writeEnvFile(
     cwd,
-    credentials.apiKey,
+    credentials.sdkKey,
     credentials.projectId,
     framework,
     endpoint,
     Boolean(options.yes)
   );
-  persistCliConfig(credentials.apiKey, credentials.projectId, endpoint);
+  persistCliConfig(credentials, endpoint);
   emitWizardFunnelEvent(credentials, endpoint, "wizard_env_written", { framework: framework.id });
   const enableRewards = await maybeEnableRewards(options);
   await maybeInjectSnippet(cwd, framework, options);
@@ -1311,14 +1411,11 @@ function maybeSuggestAudit(pkg) {
   }
 }
 function ensureInteractiveOrBailOut(options) {
-  const isTTY = Boolean(process.stdin.isTTY && process.stdout.isTTY);
-  if (isTTY) return;
-  const hasAllFlags = Boolean(
-    (options.framework || options.yes) && options.projectId && options.apiKey
-  );
-  if (hasAllFlags) return;
+  if (isInteractive()) return;
+  if (options.yes) return;
+  if (options.framework && options.projectId && options.apiKey) return;
   process.stderr.write(
-    "mushi-mushi: non-interactive terminal detected.\nPass all of --yes (or --framework), --project-id, and --api-key to run unattended.\nExample: npx mushi-mushi --yes --project-id <uuid-from-console> --api-key mushi_xxx\nYour project ID is the UUID shown in the Projects page of the Mushi admin console.\n"
+    "mushi-mushi: non-interactive terminal detected.\nRe-run with --yes to set up without prompts: it reuses the credentials saved by\n`npx mushi-mushi login`, or prints a sign-in URL and waits while you approve it in a browser.\nExample: npx mushi-mushi --yes\nCI with no browser: npx mushi-mushi --yes --project-id <uuid> --api-key <ingest-only key>\n"
   );
   process.exit(1);
 }
@@ -1349,14 +1446,16 @@ async function chooseFramework(detected, options) {
   return FRAMEWORKS[confirmed];
 }
 async function acquireCredentials(options, consoleBase, endpoint) {
+  const probe = (e, k, pid) => probeKeyScope(e, k, pid);
   if (options.projectId && options.apiKey) {
-    return {
-      projectId: sanitizeSecret(options.projectId),
-      apiKey: sanitizeSecret(options.apiKey)
-    };
+    const projectId = sanitizeSecret(options.projectId);
+    const sdkKey = sanitizeSecret(options.apiKey);
+    await assertUserKeyIsIngestOnly(sdkKey, projectId, endpoint, probe);
+    return { projectId, sdkKey };
   }
   const existing = loadConfig();
   maybeShowTelemetryNotice(existing);
+  let browserTried = false;
   if (!options.projectId && !options.apiKey && existing.projectId && existing.apiKey) {
     const reuse = options.yes ? true : await p.confirm({
       message: "Use the Mushi credentials saved from your last sign-in?",
@@ -1367,13 +1466,32 @@ async function acquireCredentials(options, consoleBase, endpoint) {
       process.exit(0);
     }
     if (reuse) {
-      return {
-        projectId: sanitizeSecret(existing.projectId),
-        apiKey: sanitizeSecret(existing.apiKey)
-      };
+      const saved = await resolveSavedCredentials(
+        { projectId: existing.projectId, apiKey: existing.apiKey, sdkKey: existing.sdkKey },
+        endpoint,
+        probe
+      );
+      if (saved.kind === "ready") return saved.credentials;
+      if (saved.kind === "needs-sdk-key") {
+        p.log.info(
+          "Your saved sign-in key can read bug reports, so it stays in the CLI config. Approve one browser sign-in to mint a separate ingest-only key for the app's env vars."
+        );
+        browserTried = true;
+        const creds = await runBrowserSignIn(options, endpoint, consoleBase, {
+          projectId: saved.projectId,
+          cliKey: saved.cliKey
+        });
+        if (creds) return creds;
+      } else {
+        p.log.warn(`Saved credentials can't be reused (${saved.reason}) \u2014 signing in again.`);
+      }
     }
   }
-  if (options.yes) {
+  if (browserTried) {
+    p.log.warn(
+      "Browser sign-in didn't complete \u2014 switching to manual entry. Run `npx mushi-mushi doctor --auth` to diagnose the sign-in path."
+    );
+  } else if (options.yes) {
     const creds = await runBrowserSignIn(options, endpoint, consoleBase);
     if (creds) return creds;
     p.log.warn(
@@ -1408,9 +1526,70 @@ async function acquireCredentials(options, consoleBase, endpoint) {
       );
     }
   }
-  return collectCredentialsManually(options, consoleBase, endpoint);
+  return collectCredentialsManually(options, consoleBase, endpoint, probe);
+}
+async function assertUserKeyIsIngestOnly(key, projectId, endpoint, probe) {
+  const result = await probe(endpoint, key, projectId);
+  if (result.result === "mcp" || result.result === "unknown") {
+    throw new Error(
+      `Not writing this API key into your app's env vars: ${describeUnsafeSdkKey(result, endpoint)}. Use an ingest-only (report:write) key from the console, or leave out --api-key to sign in with the browser, which mints one.`
+    );
+  }
+}
+async function resolveSavedCredentials(saved, endpoint, probe) {
+  const projectId = sanitizeSecret(saved.projectId);
+  const apiKey = sanitizeSecret(saved.apiKey);
+  const savedSdkKey = savedSdkKeyFor(saved, projectId);
+  if (savedSdkKey) {
+    const sdkProbe = await probe(endpoint, savedSdkKey, projectId);
+    if (sdkProbe.result === "ingest-only") {
+      return { kind: "ready", credentials: { projectId, sdkKey: savedSdkKey, cliKey: apiKey } };
+    }
+  }
+  const cliProbe = await probe(endpoint, apiKey, projectId);
+  if (cliProbe.result === "ingest-only") {
+    return { kind: "ready", credentials: { projectId, sdkKey: apiKey } };
+  }
+  if (cliProbe.result === "mcp") {
+    return { kind: "needs-sdk-key", projectId, cliKey: apiKey };
+  }
+  return { kind: "unusable", reason: describeUnsafeSdkKey(cliProbe, endpoint) };
+}
+async function mintWizardKeys(deps, args) {
+  let projectId;
+  let createdName;
+  let sdkKey = null;
+  if (args.target.kind === "new") {
+    const created = await deps.createProject(args.endpoint, args.cliToken, args.target.name, {
+      scopes: SDK_KEY_SCOPES
+    });
+    projectId = created.id;
+    createdName = created.name;
+    sdkKey = created.apiKey;
+  } else {
+    projectId = args.target.projectId;
+  }
+  if (!sdkKey) {
+    sdkKey = await deps.mintProjectKey(args.endpoint, args.cliToken, projectId, {
+      scopes: SDK_KEY_SCOPES,
+      label: SDK_KEY_LABEL
+    });
+  }
+  let cliKey;
+  let cliKeyError;
+  if (args.withCliKey) {
+    try {
+      cliKey = await deps.mintProjectKey(args.endpoint, args.cliToken, projectId, {
+        scopes: CLI_KEY_SCOPES,
+        label: CLI_KEY_LABEL
+      });
+    } catch (err) {
+      cliKeyError = err instanceof Error ? err.message : String(err);
+    }
+  }
+  return { projectId, createdName, sdkKey, cliKey, cliKeyError };
 }
-async function runBrowserSignIn(options, endpoint, consoleBase) {
+async function runBrowserSignIn(options, endpoint, consoleBase, preset) {
   const startSpin = p.spinner();
   startSpin.start("Starting secure browser sign-in\u2026");
   let session;
@@ -1438,9 +1617,11 @@ async function runBrowserSignIn(options, endpoint, consoleBase) {
     return null;
   }
   waitSpin.stop("Approved.");
-  let projectId = options.projectId ? sanitizeSecret(options.projectId) : void 0;
-  let apiKey;
-  if (!projectId) {
+  const presetProjectId = preset?.projectId ?? (options.projectId ? sanitizeSecret(options.projectId) : void 0);
+  let target;
+  if (presetProjectId) {
+    target = { kind: "existing", projectId: presetProjectId };
+  } else {
     let projects = [];
     const fetchSpin = p.spinner();
     fetchSpin.start("Loading your projects\u2026");
@@ -1450,91 +1631,117 @@ async function runBrowserSignIn(options, endpoint, consoleBase) {
         projects.length > 0 ? `Found ${projects.length} project(s).` : "No projects yet."
       );
     } catch (err) {
+      if (!isInteractive()) {
+        fetchSpin.stop("Could not load projects.");
+        p.log.warn(err instanceof Error ? err.message : String(err));
+        return null;
+      }
       fetchSpin.stop("Could not load projects \u2014 you can still create a new one.");
       p.log.warn(err instanceof Error ? err.message : String(err));
     }
-    const NEW = "__new__";
-    const choice = await p.select({
-      message: "Choose a project",
-      initialValue: projects[0]?.id ?? NEW,
-      options: [
-        ...projects.map((pr) => ({ value: pr.id, label: pr.name, hint: pr.id.slice(0, 8) })),
-        { value: NEW, label: "Create a new project", hint: "mints an SDK key automatically" }
-      ]
-    });
-    if (p.isCancel(choice)) {
-      p.cancel("Aborted.");
-      process.exit(0);
-    }
-    if (choice === NEW) {
-      const name = await p.text({
-        message: "Project name",
-        placeholder: "My app",
-        validate: (v) => v && v.trim().length > 0 ? void 0 : "Required"
+    if (!isInteractive()) {
+      const cwd = options.cwd ?? process.cwd();
+      const choice = chooseProjectNonInteractive(
+        projects,
+        defaultProjectName(readPackageJson(cwd)?.name, cwd)
+      );
+      if (choice.kind === "existing") {
+        p.log.info(`Using project "${choice.name}" (matches this app \u2014 pass --project-id to pick another).`);
+        target = { kind: "existing", projectId: choice.id };
+      } else {
+        p.log.info(`Creating project "${choice.name}" (no project matches this app \u2014 pass --project-id to use an existing one).`);
+        target = { kind: "new", name: choice.name };
+      }
+    } else {
+      const NEW = "__new__";
+      const choice = await p.select({
+        message: "Choose a project",
+        initialValue: projects[0]?.id ?? NEW,
+        options: [
+          ...projects.map((pr) => ({ value: pr.id, label: pr.name, hint: pr.id.slice(0, 8) })),
+          { value: NEW, label: "Create a new project", hint: "mints an SDK key automatically" }
+        ]
       });
-      if (p.isCancel(name)) {
+      if (p.isCancel(choice)) {
         p.cancel("Aborted.");
         process.exit(0);
       }
-      const createSpin = p.spinner();
-      createSpin.start(`Creating "${name.trim()}"\u2026`);
-      try {
-        const created = await createProject(endpoint, cliToken, name.trim(), {
-          scopes: ["report:write", "mcp:read"]
+      if (choice === NEW) {
+        const name = await p.text({
+          message: "Project name",
+          placeholder: "My app",
+          validate: (v) => v && v.trim().length > 0 ? void 0 : "Required"
         });
-        projectId = created.id;
-        apiKey = created.apiKey ?? void 0;
-        createSpin.stop(`Created project "${created.name}".`);
-      } catch (err) {
-        createSpin.stop("Could not create the project.");
-        p.log.warn(err instanceof Error ? err.message : String(err));
-        return null;
+        if (p.isCancel(name)) {
+          p.cancel("Aborted.");
+          process.exit(0);
+        }
+        target = { kind: "new", name: name.trim() };
+      } else {
+        target = { kind: "existing", projectId: choice };
       }
-    } else {
-      projectId = choice;
     }
   }
-  if (projectId && !apiKey) {
-    const keySpin = p.spinner();
-    keySpin.start("Minting SDK key\u2026");
-    try {
-      apiKey = await mintProjectKey(endpoint, cliToken, projectId, {
-        scopes: ["report:write", "mcp:read"]
-      });
-      keySpin.stop("SDK key ready.");
-    } catch (err) {
-      keySpin.stop("Could not mint an API key.");
-      p.log.warn(err instanceof Error ? err.message : String(err));
+  const keySpin = p.spinner();
+  keySpin.start(target.kind === "new" ? `Creating "${target.name}"\u2026` : "Minting keys\u2026");
+  let minted;
+  try {
+    minted = await mintWizardKeys(
+      { createProject, mintProjectKey },
+      { endpoint, cliToken, target, withCliKey: !preset }
+    );
+  } catch (err) {
+    keySpin.stop(target.kind === "new" ? "Could not create the project." : "Could not mint an API key.");
+    p.log.warn(err instanceof Error ? err.message : String(err));
+    if (target.kind === "existing") {
       p.log.warn(
         `You're signed in, but key minting failed. Generate one manually in the console Verify tab: ${consoleUrl(consoleBase, "/onboarding?tab=verify")}`
       );
-      return null;
     }
+    return null;
   }
-  if (!projectId || !apiKey) return null;
-  return { apiKey, projectId };
+  keySpin.stop(
+    minted.createdName ? `Created project "${minted.createdName}" with an ingest-only SDK key.` : "SDK key ready (ingest-only)."
+  );
+  if (minted.cliKeyError) {
+    p.log.warn(
+      `The CLI/MCP key could not be minted (${minted.cliKeyError}). The SDK install continues; run \`npx mushi-mushi login\` later for MCP and admin commands.`
+    );
+  }
+  return {
+    projectId: minted.projectId,
+    sdkKey: minted.sdkKey,
+    cliKey: preset?.cliKey ?? minted.cliKey
+  };
 }
-async function collectCredentialsManually(options, consoleBase, endpoint) {
+async function collectCredentialsManually(options, consoleBase, endpoint, probe) {
   const existing = loadConfig();
   let savedProjectId = existing.projectId;
-  let savedApiKey = existing.apiKey;
-  if (!options.projectId && !options.apiKey && savedProjectId && savedApiKey) {
+  let savedApiKey;
+  if (!isInteractive() && !(options.projectId && options.apiKey)) {
+    throw new Error(
+      "Browser sign-in didn't complete and this terminal cannot prompt for a key. Re-run `npx mushi-mushi --yes` and approve the sign-in in the browser, or pass --project-id and an ingest-only --api-key."
+    );
+  }
+  if (!options.projectId && !options.apiKey && savedProjectId && existing.apiKey) {
+    const projectIdForCheck = sanitizeSecret(savedProjectId);
+    const candidate = savedSdkKeyFor(existing, projectIdForCheck) ?? sanitizeSecret(existing.apiKey);
     p.log.info(
-      `Found saved credentials from a previous sign-in (project ${sanitizeSecret(savedProjectId).slice(0, 8)}\u2026).`
+      `Found saved credentials from a previous sign-in (project ${projectIdForCheck.slice(0, 8)}\u2026).`
     );
     const checkSpin = p.spinner();
     checkSpin.start("Checking saved credentials\u2026");
-    const check = await apiCall("/v1/sync/whoami", {
-      apiKey: sanitizeSecret(savedApiKey),
-      projectId: sanitizeSecret(savedProjectId),
-      endpoint
-    });
-    if (check.ok) {
-      checkSpin.stop(`Saved credentials still work (${check.data.project_name}).`);
-    } else {
+    const check = await probe(endpoint, candidate, projectIdForCheck);
+    if (check.result === "ingest-only") {
+      checkSpin.stop("Saved ingest key still works.");
+      savedApiKey = candidate;
+    } else if (check.result === "mcp") {
+      checkSpin.stop("Saved key can read reports, so it can't go into your app's env \u2014 paste an ingest-only key below.");
+    } else if (check.result === "invalid") {
       checkSpin.stop("Saved credentials no longer authenticate \u2014 enter fresh ones below.");
       savedProjectId = void 0;
-      savedApiKey = void 0;
+    } else {
+      checkSpin.stop(`Could not check the saved key (${describeUnsafeSdkKey(check, endpoint)}) \u2014 enter one below.`);
     }
   }
   const rawProjectId = options.projectId ?? savedProjectId ?? await promptText({
@@ -1561,17 +1768,29 @@ async function collectCredentialsManually(options, consoleBase, endpoint) {
       `Invalid API key. Expected format: mushi_[A-Za-z0-9_-]{10,}. Got: ${redact(apiKey)}`
     );
   }
-  return { projectId, apiKey };
+  if (apiKey !== savedApiKey) {
+    await assertUserKeyIsIngestOnly(apiKey, projectId, endpoint, probe);
+  }
+  return { projectId, sdkKey: apiKey };
 }
 async function verifyCredentials(credentials, options, consoleBase) {
   const endpoint = resolveCloudEndpoint(options.endpoint);
   const spinner2 = p.spinner();
   spinner2.start("Verifying credentials\u2026");
   const result = await apiCall("/v1/sync/whoami", {
-    apiKey: credentials.apiKey,
+    apiKey: credentials.sdkKey,
     projectId: credentials.projectId,
     endpoint
   });
+  if (!result.ok && (result.error.code === "NETWORK_ERROR" || result.error.code === "TIMEOUT")) {
+    spinner2.stop(`Could not reach ${endpoint}.`);
+    p.log.error(result.error.message);
+    p.log.warn("Setup did NOT complete: nothing was installed and no env vars were written.");
+    p.log.info(
+      "Check your network, proxy or VPN, or pass --endpoint <url> if you run a self-hosted backend, then re-run `npx mushi-mushi`."
+    );
+    throw new Error(`Could not reach the Mushi API at ${endpoint} \u2014 nothing was changed.`);
+  }
   if (!result.ok) {
     spinner2.stop("Credentials could not be verified.");
     p.log.error(result.error?.message ?? "Authentication failed.");
@@ -1727,9 +1946,24 @@ function warnIfMissingFromGitignore(cwd, envFile) {
     p.log.warn(`${envFile} is not in .gitignore \u2014 add it before committing.`);
   }
 }
-function persistCliConfig(apiKey, projectId, endpoint) {
+function planCliConfigUpdate(existing, credentials, endpoint) {
+  const keepSavedKey = existing.projectId === credentials.projectId && Boolean(existing.apiKey);
+  const apiKey = credentials.cliKey ?? (keepSavedKey ? existing.apiKey : credentials.sdkKey);
+  return {
+    ...existing,
+    apiKey,
+    projectId: credentials.projectId,
+    endpoint,
+    sdkKey: { projectId: credentials.projectId, key: credentials.sdkKey }
+  };
+}
+function persistCliConfig(credentials, endpoint) {
   const existing = loadConfig();
-  saveConfig({ ...existing, apiKey, projectId, endpoint });
+  const next = planCliConfigUpdate(existing, credentials, endpoint);
+  saveConfig(next);
+  if (next.apiKey && next.apiKey !== existing.apiKey) {
+    trySaveKeyToKeychain(next.apiKey, resolveProfileName());
+  }
 }
 function emitWizardFunnelEvent(credentials, endpoint, event, metadata = {}) {
   if (process.env.MUSHI_NO_TELEMETRY) return;
@@ -1737,7 +1971,7 @@ function emitWizardFunnelEvent(credentials, endpoint, event, metadata = {}) {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
-      "X-Mushi-Api-Key": credentials.apiKey,
+      "X-Mushi-Api-Key": credentials.sdkKey,
       "X-Mushi-Project": credentials.projectId
     },
     body: JSON.stringify({ event, source: "cli", metadata }),
@@ -1788,7 +2022,7 @@ import { MushiRewardsBadge } from '@mushi-mushi/react';
     [
       "  [ ] 1. Paste the init snippet above into your app entry file",
       "  [ ] 2. Start your dev server",
-      "  [ ] 3. Run: mushi connect --write-env --wire-ide --wait",
+      "  [ ] 3. Wire your editor: npx mushi-mushi setup --ide cursor   (or --ide claude)",
       `  [ ] 4. Open the Verify tab to send a test report: ${consoleUrl(consoleBase, "/onboarding?tab=verify")}`
     ].join("\n"),
     "Next steps:"
@@ -1803,16 +2037,22 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect } = await import("./connect-FAXWVFG2.js");
-    await runConnect({
-      apiKey: credentials.apiKey,
-      projectId: credentials.projectId,
-      endpoint,
-      cwd: options.cwd,
-      writeEnv: true,
-      wireIde: true,
-      wait: true
-    });
+    const { runConnect } = await import("./connect-C673EKS3.js");
+    const saved = loadConfig();
+    const result = await runConnect(
+      {
+        apiKey: saved.apiKey ?? credentials.sdkKey,
+        sdkKey: credentials.sdkKey,
+        projectId: credentials.projectId,
+        endpoint,
+        cwd: options.cwd,
+        writeEnv: true,
+        wireIde: true,
+        wait: true
+      },
+      saved
+    );
+    for (const line of result.messages) p.log.message(line);
   } catch (err) {
     p.log.warn(err instanceof Error ? err.message : String(err));
     p.log.info("You can run manually: mushi connect --write-env --wire-ide --wait");
@@ -1852,7 +2092,7 @@ async function maybeSendTestReport(credentials, options) {
       signal: controller.signal,
       headers: {
         "Content-Type": "application/json",
-        "X-Mushi-Api-Key": credentials.apiKey,
+        "X-Mushi-Api-Key": credentials.sdkKey,
         "X-Mushi-Project": credentials.projectId
       },
       body: JSON.stringify({
@@ -1931,6 +2171,9 @@ function isSameDirectory(a, b) {
 }
 export {
   isEnvFileCoveredByGitignore,
+  mintWizardKeys,
+  planCliConfigUpdate,
+  resolveSavedCredentials,
   runInit,
   sanitizeSecret
 };