@mushi-mushi/cli 0.27.1 → 0.28.0

package/dist/{connect-5EQA7G3U.js → connect-C673EKS3.js}

@@ -1,18 +1,23 @@
 import {
   CONFIG_PATH,
-  assertEndpoint,
+  describeUnsafeSdkKey,
+  probeKeyScope,
   requireUuid,
   saveConfig,
+  savedSdkKeyFor,
   waitForIngestReady
-} from "./chunk-M7CDSRZM.js";
+} from "./chunk-AV3RKAEE.js";
 import {
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-XLGHUOKY.js";
+} from "./chunk-U2VGB63C.js";
 import {
   detectFramework,
   envVarsToWrite,
   readPackageJson
 } from "./chunk-AIZRI665.js";
+import {
+  assertEndpoint
+} from "./chunk-SXSI2W6Z.js";
 import "./chunk-3RG5ZIWI.js";
 
 // src/connect.ts
@@ -23,39 +28,62 @@ import { join, resolve } from "path";
 import { mkdir, readFile, writeFile } from "fs/promises";
 import { dirname } from "path";
 var DEFAULT_MUSHI_FEATURES = "triage,fixes,inventory,setup,docs";
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 async function writeMcpServerEntry(opts) {
   const { configPath, serverName, serverBlock, dryRun = false } = opts;
-  let merged = { mcpServers: {} };
-  let created = false;
+  let existing = null;
   try {
-    const existing = await readFile(configPath, "utf8");
+    existing = await readFile(configPath, "utf8");
+  } catch {
+    existing = null;
+  }
+  let merged = {};
+  if (existing !== null && existing.trim() !== "") {
+    let parsed;
     try {
-      merged = JSON.parse(existing);
+      parsed = JSON.parse(existing);
     } catch {
-      merged = { mcpServers: {} };
+      throw new Error(`${configPath} is not valid JSON \u2014 fix or remove it, then re-run (nothing was written).`);
     }
-  } catch {
-    created = true;
-    merged = { mcpServers: {} };
+    if (!isPlainObject(parsed)) {
+      throw new Error(`${configPath} is not a JSON object \u2014 fix or remove it, then re-run (nothing was written).`);
+    }
+    merged = parsed;
+  }
+  const currentServers = merged.mcpServers;
+  if (currentServers !== void 0 && !isPlainObject(currentServers)) {
+    throw new Error(`${configPath} has an "mcpServers" field that is not an object \u2014 fix it, then re-run (nothing was written).`);
   }
-  const servers = merged.mcpServers ?? {};
-  servers[serverName] = serverBlock;
-  merged.mcpServers = servers;
+  merged.mcpServers = { ...currentServers ?? {}, [serverName]: serverBlock };
   const output = JSON.stringify(merged, null, 2) + "\n";
   if (!dryRun) {
     await mkdir(dirname(configPath), { recursive: true });
     await writeFile(configPath, output, "utf8");
   }
-  return { created, path: configPath };
+  return { created: existing === null, path: configPath };
+}
+function apiKeyPlaceholderFor(client) {
+  switch (client) {
+    case "cursor":
+      return "${env:MUSHI_API_KEY}";
+    case "claude":
+      return "${MUSHI_API_KEY:-}";
+    case "continue":
+    case "zed":
+      return null;
+  }
 }
 function buildMcpServerBlock(opts) {
+  const keyValue = opts.inlineKey ? opts.apiKey : apiKeyPlaceholderFor(opts.client);
   return {
     command: "npx",
     args: ["-y", MUSHI_MCP_PIN_SPEC],
     env: {
       MUSHI_API_ENDPOINT: opts.endpoint,
       MUSHI_PROJECT_ID: opts.projectId,
-      MUSHI_API_KEY: opts.inlineKey ? opts.apiKey : "${MUSHI_API_KEY}",
+      ...keyValue !== null ? { MUSHI_API_KEY: keyValue } : {},
       MUSHI_FEATURES: DEFAULT_MUSHI_FEATURES
     }
   };
@@ -70,6 +98,12 @@ function buildMcpServerName(opts) {
 }
 
 // src/connect.ts
+async function resolveSdkEnvKey(opts) {
+  const candidate = opts.sdkKey ?? savedSdkKeyFor(opts.baseConfig, opts.projectId) ?? opts.apiKey;
+  const probe = await opts.probe(opts.endpoint, candidate, opts.projectId);
+  if (probe.result === "ingest-only") return { ok: true, key: candidate };
+  return { ok: false, reason: describeUnsafeSdkKey(probe, opts.endpoint) };
+}
 function envKeyPresent(content, key) {
   const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   return new RegExp(`^${escaped}=`, "m").test(content);
@@ -99,43 +133,40 @@ ${needs.join("\n")}
   await writeFile2(path, block, "utf8");
   return true;
 }
-async function ensureMcpJsonGitignored(cwd, messages) {
-  const gitignorePath = join(cwd, ".gitignore");
-  const patterns = [".cursor/mcp.json", ".cursor/"];
-  let content = null;
-  try {
-    content = await readFile2(gitignorePath, "utf8");
-  } catch {
-  }
-  if (content === null) {
-    messages.push(
-      "\u26A0 No .gitignore found \u2014 .cursor/mcp.json contains your API key. Add `.cursor/mcp.json` before committing."
-    );
-    return;
-  }
-  const covered = patterns.some((p) => content.split("\n").some((line) => line.trim() === p || line.trim() === `${p}/`));
-  if (covered) return;
-  await appendFile(gitignorePath, "\n# Mushi \u2014 keep MCP credentials out of git\n.cursor/mcp.json\n", "utf8");
-  messages.push("\u2713 Added .cursor/mcp.json to .gitignore (contains API key)");
-}
 async function runConnect(opts, baseConfig = {}) {
   const cwd = resolve(opts.cwd ?? process.cwd());
   const endpoint = assertEndpoint(opts.endpoint);
   const projectId = requireUuid(opts.projectId, "projectId");
   const messages = [];
+  const writeEnv = opts.writeEnv !== false;
+  const sdkEnvKey = writeEnv ? await resolveSdkEnvKey({
+    sdkKey: opts.sdkKey,
+    apiKey: opts.apiKey,
+    projectId,
+    endpoint,
+    baseConfig,
+    probe: opts.probeKeyScope ?? probeKeyScope
+  }) : null;
   const config = {
     ...baseConfig,
     apiKey: opts.apiKey,
     projectId,
-    endpoint
+    endpoint,
+    ...sdkEnvKey?.ok ? { sdkKey: { projectId, key: sdkEnvKey.key } } : {}
   };
   saveConfig(config);
   messages.push(`\u2713 Credentials saved to ${CONFIG_PATH}`);
   let envPath = null;
-  if (opts.writeEnv !== false) {
+  let envRefused = false;
+  if (sdkEnvKey && !sdkEnvKey.ok) {
+    envRefused = true;
+    messages.push(
+      `\u2717 Did not write SDK env vars: ${sdkEnvKey.reason}. Pass an ingest-only key with --sdk-key <key> (console \u2192 Projects \u2192 API keys, scope report:write), or run \`npx mushi-mushi\`, which mints one.`
+    );
+  } else if (sdkEnvKey?.ok) {
     const pkg = readPackageJson(cwd);
     const framework = detectFramework(cwd, pkg);
-    const lines = envVarsToWrite(opts.apiKey, projectId, framework).split("\n");
+    const lines = envVarsToWrite(sdkEnvKey.key, projectId, framework).split("\n");
     envPath = join(cwd, ".env.local");
     const wrote = await mergeEnvFile(envPath, lines);
     messages.push(
@@ -157,13 +188,13 @@ async function runConnect(opts, baseConfig = {}) {
       endpoint,
       projectId,
       apiKey: opts.apiKey,
+      client: "cursor",
       inlineKey: false
-      // use ${MUSHI_API_KEY} placeholder; caller must export the key
+      // no secret in the file; the MCP server reads the saved CLI key
     });
     await writeMcpServerEntry({ configPath: mcpPath, serverName, serverBlock });
-    await ensureMcpJsonGitignored(cwd, messages);
     messages.push(`\u2713 Wired ${mcpPath} \u2014 restart Cursor and run "list mushi tools"`);
-    messages.push(`  Set MUSHI_API_KEY="${opts.apiKey}" in your shell / .env.local before restarting the IDE.`);
+    messages.push(`  The MCP server reads the key saved in ${CONFIG_PATH} (export MUSHI_API_KEY before launching Cursor to override it).`);
   }
   let heartbeat = null;
   if (opts.wait) {
@@ -197,9 +228,10 @@ async function runConnect(opts, baseConfig = {}) {
       );
     }
   }
-  const ok = !opts.wait || Boolean(heartbeat?.ok);
+  const ok = !envRefused && (!opts.wait || Boolean(heartbeat?.ok));
   return { ok, envPath, mcpPath, heartbeat, messages };
 }
 export {
+  resolveSdkEnvKey,
   runConnect
 };

package/dist/detect-4PYRZXVK.js

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+import {
+  FRAMEWORKS,
+  FRAMEWORK_IDS,
+  detectFramework,
+  detectPackageManager,
+  envVarsToWrite,
+  installCommand,
+  isFrameworkId,
+  readPackageJson
+} from "./chunk-KOBEOGNF.js";
+import "./chunk-PDX44BCA.js";
+export {
+  FRAMEWORKS,
+  FRAMEWORK_IDS,
+  detectFramework,
+  detectPackageManager,
+  envVarsToWrite,
+  installCommand,
+  isFrameworkId,
+  readPackageJson
+};

package/dist/endpoint-NHECZL47.js

@@ -0,0 +1,15 @@
+import {
+  CLOUD_API_ENDPOINT,
+  TEST_REPORT_FETCH_TIMEOUT_MS,
+  assertEndpoint,
+  normalizeEndpoint,
+  resolveCloudEndpoint
+} from "./chunk-SXSI2W6Z.js";
+import "./chunk-3RG5ZIWI.js";
+export {
+  CLOUD_API_ENDPOINT,
+  TEST_REPORT_FETCH_TIMEOUT_MS,
+  assertEndpoint,
+  normalizeEndpoint,
+  resolveCloudEndpoint
+};

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+
+export {  }