@mushi-mushi/cli 0.27.1 → 0.28.0

package/dist/index.js

@@ -1,22 +1,28 @@
 #!/usr/bin/env node
 import {
-  FRAMEWORKS,
+  CLI_KEY_LABEL,
+  CLI_KEY_SCOPES,
+  CONFIG_PATH,
+  FULL_CLI_KEY_SCOPES,
+  MCP_CLIENTS,
+  MCP_CLIENT_LABEL,
+  SDK_KEY_LABEL,
+  SDK_KEY_SCOPES,
   apiCall,
   apiKeyHeaders,
   apiKeyHint,
+  buildHostedMcpServerBlock,
   buildMcpServerBlock,
   buildMcpServerName,
   cliSetupDeepLink,
   consoleUrl,
-  detectFramework,
-  detectPackageManager,
+  describeUnsafeSdkKey,
   die,
   ensureClientId,
-  envVarsToWrite,
   fetchIngestSetup,
   fmtDate,
-  installCommand,
   installSignalHandlers,
+  isMcpClient,
   listProfiles,
   loadConfig,
   maybeShowTelemetryNotice,
@@ -27,8 +33,8 @@ import {
   printKeyExportHint,
   printResult,
   probeEndpointHealth,
+  probeKeyScope,
   projectIdHint,
-  readPackageJson,
   reportsUrl,
   requireConfig,
   requireUuid,
@@ -41,16 +47,26 @@ import {
   sanitizeEndpoint,
   sanitizeProjectId,
   saveConfig,
+  savedSdkKeyFor,
   setActiveProfile,
   setGlobalOutputFormat,
   trySaveKeyToKeychain,
   writeMcpServerEntry
-} from "./chunk-NNB2NONG.js";
+} from "./chunk-FJETUM25.js";
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-DBAEB56N.js";
+} from "./chunk-UVO4A2G6.js";
+import {
+  FRAMEWORKS,
+  detectFramework,
+  detectPackageManager,
+  envVarsToWrite,
+  installCommand,
+  readPackageJson
+} from "./chunk-KOBEOGNF.js";
 import {
+  CLOUD_API_ENDPOINT,
   TEST_REPORT_FETCH_TIMEOUT_MS,
   assertEndpoint,
   normalizeEndpoint,
@@ -315,162 +331,6 @@ async function revokeProjectKey(endpoint, cliToken, projectId, keyPrefix, newKey
   );
 }
 
-// src/freshness.ts
-var REGISTRY = "https://registry.npmjs.org";
-var DEFAULT_TIMEOUT_MS = 2e3;
-async function checkFreshness(packageName, currentVersion, opts = {}) {
-  if (!opts.ignoreOptOut && process.env.MUSHI_NO_UPDATE_CHECK === "1") return null;
-  const registry = opts.registry ?? REGISTRY;
-  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    const res = await fetch(
-      `${registry}/${encodeURIComponent(packageName)}/latest`,
-      {
-        signal: controller.signal,
-        headers: { Accept: "application/json" }
-      }
-    );
-    if (!res.ok) return null;
-    const body = await res.json();
-    const latest = typeof body.version === "string" ? body.version : null;
-    if (!latest) return null;
-    return {
-      current: currentVersion,
-      latest,
-      isOutdated: isNewerStableVersion(latest, currentVersion)
-    };
-  } catch {
-    return null;
-  } finally {
-    clearTimeout(timer);
-  }
-}
-function isNewerStableVersion(latest, current) {
-  const latestCore = stripPreRelease(latest);
-  if (hasPreReleaseTag(latest)) return false;
-  const [la, lb, lc] = parse(latestCore);
-  const [ca, cb, cc] = parse(stripPreRelease(current));
-  if (la !== ca) return la > ca;
-  if (lb !== cb) return lb > cb;
-  return lc > cc;
-}
-function stripPreRelease(version) {
-  const idx = version.search(/[-+]/);
-  return idx === -1 ? version : version.slice(0, idx);
-}
-function hasPreReleaseTag(version) {
-  const plus = version.indexOf("+");
-  const hyphen = version.indexOf("-");
-  return hyphen !== -1 && (plus === -1 || hyphen < plus);
-}
-function parse(version) {
-  const parts = version.split(".").map((part) => Number(part));
-  return [
-    Number.isFinite(parts[0]) ? parts[0] : 0,
-    Number.isFinite(parts[1]) ? parts[1] : 0,
-    Number.isFinite(parts[2]) ? parts[2] : 0
-  ];
-}
-
-// src/monorepo.ts
-import { existsSync, readFileSync, readdirSync, statSync } from "fs";
-import { dirname, join, resolve } from "path";
-var WORKSPACE_GLOB_CANDIDATES = ["apps/*", "packages/*", "examples/*"];
-var FRAMEWORK_DEPS = {
-  next: "Next.js",
-  nuxt: "Nuxt",
-  "@sveltejs/kit": "SvelteKit",
-  "@angular/core": "Angular",
-  expo: "Expo",
-  "react-native": "React Native",
-  "@capacitor/core": "Capacitor",
-  svelte: "Svelte",
-  vue: "Vue",
-  react: "React"
-};
-function detectWorkspaceHint(cwd) {
-  const root = findWorkspaceRoot(cwd);
-  if (!root) return null;
-  const rootPkg = readPackageJsonSafely(join(root, "package.json"));
-  if (rootPkg && getFrameworkFromPkg(rootPkg)) return null;
-  const source = existsSync(join(root, "pnpm-workspace.yaml")) ? "pnpm-workspace" : root === cwd ? "package-json" : "parent";
-  const apps = collectAppsFromGlobs(root);
-  if (apps.length === 0) return null;
-  return { root, apps, source };
-}
-function findWorkspaceRoot(start) {
-  let dir = resolve(start);
-  for (let i = 0; i < 8; i++) {
-    if (isWorkspaceRoot(dir)) return dir;
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return null;
-}
-function isWorkspaceRoot(dir) {
-  if (existsSync(join(dir, "pnpm-workspace.yaml"))) return true;
-  const pkg = readPackageJsonSafely(join(dir, "package.json"));
-  if (!pkg) return false;
-  return Boolean(pkg.workspaces);
-}
-function collectAppsFromGlobs(root) {
-  const results = [];
-  for (const glob of WORKSPACE_GLOB_CANDIDATES) {
-    const prefix = glob.replace("/*", "");
-    const parentDir = join(root, prefix);
-    if (!existsSync(parentDir)) continue;
-    let entries;
-    try {
-      entries = readdirSync(parentDir);
-    } catch {
-      continue;
-    }
-    for (const entry of entries) {
-      const pkgPath = join(parentDir, entry, "package.json");
-      if (!isFileSafe(pkgPath)) continue;
-      const pkg = readPackageJsonSafely(pkgPath);
-      if (!pkg) continue;
-      const framework = getFrameworkFromPkg(pkg);
-      if (!framework) continue;
-      results.push({
-        name: pkg.name ?? `${prefix}/${entry}`,
-        relativePath: `${prefix}/${entry}`,
-        framework
-      });
-    }
-  }
-  return results;
-}
-function readPackageJsonSafely(path) {
-  if (!isFileSafe(path)) return null;
-  try {
-    return JSON.parse(readFileSync(path, "utf-8"));
-  } catch {
-    return null;
-  }
-}
-function isFileSafe(path) {
-  try {
-    return existsSync(path) && statSync(path).isFile();
-  } catch {
-    return false;
-  }
-}
-function getFrameworkFromPkg(pkg) {
-  const deps = {
-    ...pkg.dependencies ?? {},
-    ...pkg.devDependencies ?? {},
-    ...pkg.peerDependencies ?? {}
-  };
-  for (const dep of Object.keys(FRAMEWORK_DEPS)) {
-    if (dep in deps) return FRAMEWORK_DEPS[dep];
-  }
-  return void 0;
-}
-
 // src/auth-ui.ts
 var LINE = "\u2500".repeat(58);
 function printAuthBanner(userCode, verificationUri) {
@@ -518,54 +378,449 @@ function printAuthFailed(reason, detail) {
   console.log("");
 }
 
-// src/doctor.ts
-function checkCliConfig(config) {
-  return [
-    {
-      name: "CLI config file",
-      ok: Boolean(config.endpoint),
-      detail: config.endpoint ? `endpoint=${config.endpoint}` : "No endpoint \u2014 set MUSHI_API_ENDPOINT, run `mushi connect`, or `mushi config endpoint <url>`"
-    },
-    {
-      name: "API key configured",
-      ok: Boolean(config.apiKey),
-      detail: config.apiKey ? `apiKey=${config.apiKey.slice(0, 8)}\u2026${config.apiKey.slice(-4)}` : "No API key set \u2014 run `mushi login --api-key <key>`"
-    },
-    {
-      name: "Project ID configured",
-      ok: Boolean(config.projectId),
-      detail: config.projectId ? `projectId=${config.projectId}` : "No default project \u2014 set via `mushi config projectId <uuid>`"
+// src/login.ts
+function getPostLoginBannerMessage(opts) {
+  if (opts.suppressPostLoginBanner) return null;
+  if (opts.upgradeScope) {
+    return "  Key upgraded! Re-run 'mushi setup' to update your IDE's MCP config, then restart the IDE.";
+  }
+  return "  Run 'mushi init' to set up the SDK in this project.";
+}
+function printPostLoginBanner(opts) {
+  const message = getPostLoginBannerMessage(opts);
+  if (message) console.log(message);
+}
+var MAX_CONSECUTIVE_ERRORS = 5;
+async function pollUntilApproved(endpoint, deviceData, deps) {
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? Date.now;
+  let pollIntervalMs = (deviceData.interval ?? 5) * 1e3;
+  const deadline = now() + (deviceData.expires_in ?? 600) * 1e3;
+  let consecutiveErrors = 0;
+  let firstPoll = true;
+  while (now() < deadline) {
+    if (!firstPoll) {
+      await sleep(pollIntervalMs);
     }
-  ];
+    firstPoll = false;
+    const outcome = await deps.poll(endpoint, deviceData.device_code);
+    switch (outcome.status) {
+      case "approved":
+        return { status: "approved", cliToken: outcome.cliToken };
+      case "pending":
+        consecutiveErrors = 0;
+        continue;
+      case "slow_down":
+        consecutiveErrors = 0;
+        pollIntervalMs = Math.max(pollIntervalMs, outcome.retryAfterMs);
+        continue;
+      case "error":
+        if (outcome.retryable) {
+          consecutiveErrors += 1;
+          if (consecutiveErrors < MAX_CONSECUTIVE_ERRORS) continue;
+        }
+        return { status: "error", message: outcome.message };
+      case "denied":
+        return { status: "denied" };
+      case "expired":
+        return { status: "timeout" };
+    }
+  }
+  return { status: "timeout" };
 }
-async function checkEndpointReachability(endpoint, doFetch = globalThis.fetch) {
-  try {
-    const safeEndpoint = sanitizeEndpoint(endpoint);
-    const res = await doFetch(`${safeEndpoint}/health`, {
-      signal: AbortSignal.timeout(5e3)
+async function resolveProjectChoice(projectsList, ask) {
+  if (projectsList.length > 0) {
+    console.log("");
+    console.log("  Your projects:");
+    projectsList.forEach((p3, i) => {
+      console.log(`    ${i + 1}. ${p3.name} (${p3.id})`);
     });
-    return {
-      name: "Endpoint reachable",
-      ok: res.status === 200,
-      detail: `GET ${safeEndpoint}/health \u2192 ${res.status}`
-    };
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    return { name: "Endpoint reachable", ok: false, detail: `Fetch failed: ${msg}` };
+    console.log(`    ${projectsList.length + 1}. Create a new project`);
+    console.log("");
+    const choice = await ask(`  Pick a project [1-${projectsList.length + 1}]: `);
+    const num = parseInt(choice, 10);
+    if (num >= 1 && num <= projectsList.length) {
+      const picked = projectsList[num - 1];
+      return { kind: "picked", id: picked.id, name: picked.name };
+    }
   }
-}
-async function checkCliAuthPath(config, doFetch = globalThis.fetch) {
-  const checks = [];
-  if (!config.endpoint) {
-    return [
+  console.log("");
+  const newName = (await ask("  Project name: ")).trim();
+  if (!newName) return { kind: "empty_name" };
+  return { kind: "create", name: newName };
+}
+function slugify(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+}
+function defaultProjectName(packageName, cwd) {
+  const fromPkg = packageName?.replace(/^@[^/]+\//, "").trim();
+  if (fromPkg) return fromPkg;
+  const parts = cwd.split(/[\\/]/).filter(Boolean);
+  return parts[parts.length - 1] || "my-app";
+}
+function chooseProjectNonInteractive(projects, preferredName) {
+  const wanted = slugify(preferredName);
+  const match = projects.find((p3) => slugify(p3.name) === wanted || p3.slug !== void 0 && slugify(p3.slug) === wanted);
+  return match ? { kind: "existing", id: match.id, name: match.name } : { kind: "new", name: preferredName };
+}
+async function runLogin(opts = {}) {
+  const { CLOUD_API_ENDPOINT: CLOUD_API_ENDPOINT2, resolveCloudEndpoint: resolveCloudEndpoint2 } = await import("./endpoint-TEBF4IH6.js");
+  const endpoint = opts.endpoint ? resolveCloudEndpoint2(opts.endpoint) : CLOUD_API_ENDPOINT2;
+  const consoleBase = await resolveConsoleUrl();
+  let apiKey = opts.apiKey;
+  let projectId = opts.projectId;
+  if (apiKey) {
+    const config2 = loadConfig();
+    config2.apiKey = apiKey;
+    config2.endpoint = endpoint;
+    if (projectId) config2.projectId = projectId;
+    config2.consoleUrl = consoleBase;
+    saveConfig(config2);
+    console.log("");
+    console.log("  \u2713 Credentials saved.");
+    const verifyResult = await apiCall("/v1/sync/whoami", { apiKey, endpoint, projectId });
+    if (!verifyResult.ok) {
+      console.warn(`  \u26A0  Key saved, but verification failed: ${verifyResult.error?.message ?? "unknown error"}`);
+      console.warn(`     Check your key at: ${cliSetupDeepLink(consoleBase)}`);
+      return;
+    }
+    const d = verifyResult.data;
+    if (d.project_name) {
+      if (!projectId && d.project_id) {
+        config2.projectId = d.project_id;
+        saveConfig(config2);
+      }
+      console.log(`  \u2713 Project: ${d.project_name} (${d.project_id})`);
+    }
+    console.log(`  \u2713 Endpoint: ${endpoint}`);
+    console.log("");
+    if (!opts.suppressPostLoginBanner) {
+      console.log("  Run 'mushi whoami' to verify \xB7 'mushi init' to set up the SDK");
+    }
+    return;
+  }
+  if (!opts.suppressPostLoginBanner) {
+    console.log("");
+  }
+  if (opts.upgradeScope) {
+    console.log("  Mushi login \u2014 scope upgrade");
+    console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    console.log("  Re-authenticating to mint a new key with report:write + mcp:read + mcp:write scopes.");
+    console.log("  This lets the CLI admin commands (including writes) and MCP server both work with a single key.");
+    console.log("");
+  } else if (!opts.suppressPostLoginBanner) {
+    console.log("  Mushi login");
+    console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  }
+  let deviceData;
+  try {
+    deviceData = await startDeviceAuth(endpoint, ensureClientId());
+  } catch (err) {
+    process.stderr.write(`
+error: Could not start login session: ${err instanceof Error ? err.message : String(err)}
+`);
+    process.stderr.write(`  Fallback: mushi login --api-key <key> --project-id <uuid>
+`);
+    process.exit(1);
+  }
+  const verifyUrl = deviceData.verification_uri;
+  if (opts.browser !== false) {
+    try {
+      await openInBrowser(verifyUrl);
+    } catch {
+    }
+  }
+  printAuthBanner(deviceData.user_code, verifyUrl);
+  const pollResult = await pollUntilApproved(endpoint, deviceData, {
+    poll: pollDeviceToken
+  });
+  if (pollResult.status !== "approved") {
+    if (pollResult.status === "denied") printAuthFailed("denied");
+    else if (pollResult.status === "error") printAuthFailed("error", pollResult.message);
+    else printAuthFailed("timeout");
+    process.exit(1);
+  }
+  const cliToken = pollResult.cliToken;
+  printAuthApproved();
+  const projectsList = await listProjects(endpoint, cliToken);
+  let chosenProjectId = projectId;
+  let chosenProjectName;
+  const mintScopes = opts.upgradeScope ? FULL_CLI_KEY_SCOPES : CLI_KEY_SCOPES;
+  if (!chosenProjectId) {
+    let choice;
+    if (process.stdin.isTTY) {
+      const { createInterface } = await import("readline");
+      const rl = createInterface({ input: process.stdin, output: process.stdout });
+      const ask = (q) => new Promise((resolve3) => rl.question(q, (a) => resolve3(a.trim())));
+      choice = await resolveProjectChoice(projectsList, ask);
+      rl.close();
+    } else {
+      const { readPackageJson: readPackageJson2 } = await import("./detect-4PYRZXVK.js");
+      const cwd = process.cwd();
+      const nonInteractive = chooseProjectNonInteractive(
+        projectsList,
+        defaultProjectName(readPackageJson2(cwd)?.name, cwd)
+      );
+      choice = nonInteractive.kind === "existing" ? { kind: "picked", id: nonInteractive.id, name: nonInteractive.name } : { kind: "create", name: nonInteractive.name };
+      console.log(
+        choice.kind === "picked" ? `  Using project "${choice.name}" (matches this folder \u2014 pass --project-id to pick another).` : `  Creating project "${choice.name}" (no project matches this folder \u2014 pass --project-id to use an existing one).`
+      );
+    }
+    if (choice.kind === "empty_name") {
+      process.stderr.write("\nerror: Project name is required.\n");
+      process.exit(2);
+    }
+    if (choice.kind === "picked") {
+      chosenProjectId = choice.id;
+      chosenProjectName = choice.name;
+    } else {
+      try {
+        const created = await createProject(endpoint, cliToken, choice.name, { scopes: mintScopes });
+        chosenProjectId = created.id;
+        chosenProjectName = created.name;
+        apiKey = created.apiKey ?? void 0;
+        console.log(`  \u2713 Created project "${chosenProjectName}"`);
+      } catch (err) {
+        process.stderr.write(`
+error: Could not create project: ${err instanceof Error ? err.message : String(err)}
+`);
+        process.exit(1);
+      }
+    }
+  }
+  if (!apiKey && chosenProjectId) {
+    try {
+      apiKey = await mintProjectKey(endpoint, cliToken, chosenProjectId, { scopes: mintScopes }) ?? void 0;
+    } catch {
+    }
+  }
+  const config = loadConfig();
+  config.endpoint = endpoint;
+  config.consoleUrl = consoleBase;
+  if (chosenProjectId) config.projectId = chosenProjectId;
+  if (apiKey) config.apiKey = apiKey;
+  saveConfig(config);
+  if (apiKey) {
+    const profile = resolveProfileName(void 0, config.activeProfile);
+    trySaveKeyToKeychain(apiKey, profile);
+  }
+  console.log("");
+  if (chosenProjectName) console.log(`  \u2713 Project: ${chosenProjectName}`);
+  if (apiKey) {
+    if (opts.upgradeScope) {
+      console.log(`  \u2713 Full-scope CLI key saved (${apiKey.slice(0, 12)}\u2026)`);
+      console.log(`    Scopes: report:write \xB7 mcp:read \xB7 mcp:write \u2014 SDK + MCP + admin CLI (incl. writes) all work with this key`);
+    } else {
+      console.log(`  \u2713 CLI key saved (${apiKey.slice(0, 12)}\u2026)`);
+      console.log(`    Scopes: report:write \xB7 mcp:read \u2014 SDK ingest + MCP read tools.`);
+      console.log(`    Admin writes (billing cap, fix merge, pipeline start) need: mushi login --upgrade-scope`);
+    }
+  } else {
+    console.log(`  \u2139  Get an SDK key at: ${apiKeyHint(consoleBase)}`);
+  }
+  console.log("");
+  printPostLoginBanner(opts);
+}
+
+// src/freshness.ts
+var REGISTRY = "https://registry.npmjs.org";
+var DEFAULT_TIMEOUT_MS = 2e3;
+async function checkFreshness(packageName, currentVersion, opts = {}) {
+  if (!opts.ignoreOptOut && process.env.MUSHI_NO_UPDATE_CHECK === "1") return null;
+  const registry = opts.registry ?? REGISTRY;
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetch(
+      `${registry}/${encodeURIComponent(packageName)}/latest`,
       {
-        name: "Sign-in route reachable",
-        ok: false,
-        detail: "No endpoint configured \u2014 run `npx mushi-mushi` or pass MUSHI_API_ENDPOINT."
+        signal: controller.signal,
+        headers: { Accept: "application/json" }
       }
-    ];
+    );
+    if (!res.ok) return null;
+    const body = await res.json();
+    const latest = typeof body.version === "string" ? body.version : null;
+    if (!latest) return null;
+    return {
+      current: currentVersion,
+      latest,
+      isOutdated: isNewerStableVersion(latest, currentVersion)
+    };
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function isNewerStableVersion(latest, current) {
+  const latestCore = stripPreRelease(latest);
+  if (hasPreReleaseTag(latest)) return false;
+  const [la, lb, lc] = parse(latestCore);
+  const [ca, cb, cc] = parse(stripPreRelease(current));
+  if (la !== ca) return la > ca;
+  if (lb !== cb) return lb > cb;
+  return lc > cc;
+}
+function stripPreRelease(version) {
+  const idx = version.search(/[-+]/);
+  return idx === -1 ? version : version.slice(0, idx);
+}
+function hasPreReleaseTag(version) {
+  const plus = version.indexOf("+");
+  const hyphen = version.indexOf("-");
+  return hyphen !== -1 && (plus === -1 || hyphen < plus);
+}
+function parse(version) {
+  const parts = version.split(".").map((part) => Number(part));
+  return [
+    Number.isFinite(parts[0]) ? parts[0] : 0,
+    Number.isFinite(parts[1]) ? parts[1] : 0,
+    Number.isFinite(parts[2]) ? parts[2] : 0
+  ];
+}
+
+// src/monorepo.ts
+import { existsSync, readFileSync, readdirSync, statSync } from "fs";
+import { dirname, join, resolve } from "path";
+var WORKSPACE_GLOB_CANDIDATES = ["apps/*", "packages/*", "examples/*"];
+var FRAMEWORK_DEPS = {
+  next: "Next.js",
+  nuxt: "Nuxt",
+  "@sveltejs/kit": "SvelteKit",
+  "@angular/core": "Angular",
+  expo: "Expo",
+  "react-native": "React Native",
+  "@capacitor/core": "Capacitor",
+  svelte: "Svelte",
+  vue: "Vue",
+  react: "React"
+};
+function detectWorkspaceHint(cwd) {
+  const root = findWorkspaceRoot(cwd);
+  if (!root) return null;
+  const rootPkg = readPackageJsonSafely(join(root, "package.json"));
+  if (rootPkg && getFrameworkFromPkg(rootPkg)) return null;
+  const source = existsSync(join(root, "pnpm-workspace.yaml")) ? "pnpm-workspace" : root === cwd ? "package-json" : "parent";
+  const apps = collectAppsFromGlobs(root);
+  if (apps.length === 0) return null;
+  return { root, apps, source };
+}
+function findWorkspaceRoot(start) {
+  let dir = resolve(start);
+  for (let i = 0; i < 8; i++) {
+    if (isWorkspaceRoot(dir)) return dir;
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
   }
-  const base = sanitizeEndpoint(config.endpoint);
+  return null;
+}
+function isWorkspaceRoot(dir) {
+  if (existsSync(join(dir, "pnpm-workspace.yaml"))) return true;
+  const pkg = readPackageJsonSafely(join(dir, "package.json"));
+  if (!pkg) return false;
+  return Boolean(pkg.workspaces);
+}
+function collectAppsFromGlobs(root) {
+  const results = [];
+  for (const glob of WORKSPACE_GLOB_CANDIDATES) {
+    const prefix = glob.replace("/*", "");
+    const parentDir = join(root, prefix);
+    if (!existsSync(parentDir)) continue;
+    let entries;
+    try {
+      entries = readdirSync(parentDir);
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      const pkgPath = join(parentDir, entry, "package.json");
+      if (!isFileSafe(pkgPath)) continue;
+      const pkg = readPackageJsonSafely(pkgPath);
+      if (!pkg) continue;
+      const framework = getFrameworkFromPkg(pkg);
+      if (!framework) continue;
+      results.push({
+        name: pkg.name ?? `${prefix}/${entry}`,
+        relativePath: `${prefix}/${entry}`,
+        framework
+      });
+    }
+  }
+  return results;
+}
+function readPackageJsonSafely(path) {
+  if (!isFileSafe(path)) return null;
+  try {
+    return JSON.parse(readFileSync(path, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function isFileSafe(path) {
+  try {
+    return existsSync(path) && statSync(path).isFile();
+  } catch {
+    return false;
+  }
+}
+function getFrameworkFromPkg(pkg) {
+  const deps = {
+    ...pkg.dependencies ?? {},
+    ...pkg.devDependencies ?? {},
+    ...pkg.peerDependencies ?? {}
+  };
+  for (const dep of Object.keys(FRAMEWORK_DEPS)) {
+    if (dep in deps) return FRAMEWORK_DEPS[dep];
+  }
+  return void 0;
+}
+
+// src/doctor.ts
+var SIGN_IN_HINT = "Run `npx mushi-mushi` in your app folder \u2014 browser sign-in saves the API key, project and endpoint.";
+function checkCliConfig(config) {
+  return [
+    {
+      // No saved endpoint is not a failure: every command falls back to Mushi
+      // Cloud (endpoint.ts), so reporting "No endpoint" first sent people
+      // hunting for a URL they never needed.
+      name: "CLI config file",
+      ok: true,
+      detail: config.endpoint ? `endpoint=${config.endpoint}` : `endpoint=${CLOUD_API_ENDPOINT} (Mushi Cloud default \u2014 set MUSHI_API_ENDPOINT for a self-hosted backend)`
+    },
+    {
+      name: "API key configured",
+      ok: Boolean(config.apiKey),
+      detail: config.apiKey ? `apiKey=${config.apiKey.slice(0, 8)}\u2026${config.apiKey.slice(-4)}` : "No API key saved."
+    },
+    {
+      name: "Project ID configured",
+      ok: Boolean(config.projectId),
+      detail: config.projectId ? `projectId=${config.projectId}` : "No default project saved."
+    }
+  ];
+}
+async function checkEndpointReachability(endpoint, doFetch = globalThis.fetch) {
+  try {
+    const safeEndpoint = sanitizeEndpoint(endpoint);
+    const res = await doFetch(`${safeEndpoint}/health`, {
+      signal: AbortSignal.timeout(5e3)
+    });
+    return {
+      name: "Endpoint reachable",
+      ok: res.status === 200,
+      detail: `GET ${safeEndpoint}/health \u2192 ${res.status}`
+    };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return { name: "Endpoint reachable", ok: false, detail: `Fetch failed: ${msg}` };
+  }
+}
+async function checkCliAuthPath(config, doFetch = globalThis.fetch) {
+  const checks = [];
+  const base = sanitizeEndpoint(config.endpoint ?? CLOUD_API_ENDPOINT);
   let dateHeader = null;
   try {
     const res = await doFetch(`${base}/v1/cli/auth/device/token`, {
@@ -639,22 +894,27 @@ async function checkCliAuthPath(config, doFetch = globalThis.fetch) {
 async function checkSdkInstall(cwd) {
   try {
     const { readFile: readFile3 } = await import("fs/promises");
-    const { join: join4, resolve: resolve3 } = await import("path");
+    const { join: join5, resolve: resolve3 } = await import("path");
     const root = resolve3(cwd);
-    const pkgPath = join4(root, "package.json");
+    const pkgPath = join5(root, "package.json");
     const pkg = JSON.parse(await readFile3(pkgPath, "utf8"));
     const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
     const sdks = [
       "@mushi-mushi/react",
       "@mushi-mushi/web",
       "@mushi-mushi/core",
-      "@mushi-mushi/react-native"
+      "@mushi-mushi/react-native",
+      "@mushi-mushi/vue",
+      "@mushi-mushi/svelte",
+      "@mushi-mushi/angular",
+      "@mushi-mushi/capacitor",
+      "@mushi-mushi/node"
     ];
     const installed = sdks.filter((s) => deps[s]);
     return {
       name: "SDK installed in this repo",
       ok: installed.length > 0,
-      detail: installed.length > 0 ? installed.map((s) => `${s}@${deps[s]}`).join(", ") : "No @mushi-mushi/* package in package.json \u2014 run `mushi init` to install"
+      detail: installed.length > 0 ? installed.map((s) => `${s}@${deps[s]}`).join(", ") : "No @mushi-mushi/* package in package.json \u2014 run `npx mushi-mushi` to install"
     };
   } catch {
     return null;
@@ -846,9 +1106,9 @@ async function checkHostAppWiring(cwd) {
   const checks = [];
   try {
     const { readFile: readFile3, access } = await import("fs/promises");
-    const { join: join4, resolve: resolve3 } = await import("path");
+    const { join: join5, resolve: resolve3 } = await import("path");
     const root = resolve3(cwd);
-    const pkgPath = join4(root, "package.json");
+    const pkgPath = join5(root, "package.json");
     const pkg = JSON.parse(await readFile3(pkgPath, "utf8"));
     const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
     const isCapHybrid = Boolean(deps["@capacitor/core"] && deps["react"]);
@@ -856,7 +1116,7 @@ async function checkHostAppWiring(cwd) {
     let envContent = "";
     for (const f of envCandidates) {
       try {
-        envContent = await readFile3(join4(root, f), "utf8");
+        envContent = await readFile3(join5(root, f), "utf8");
         break;
       } catch {
       }
@@ -870,16 +1130,19 @@ async function checkHostAppWiring(cwd) {
       ok: hasProjectId && hasApiKey,
       detail: hasProjectId && hasApiKey ? "VITE_/MUSHI_ project id + API key found" : "Run `mushi connect --write-env` or add VITE_MUSHI_PROJECT_ID + VITE_MUSHI_API_KEY"
     });
-    let mcpPresent = false;
-    try {
-      await access(join4(root, ".cursor", "mcp.json"));
-      mcpPresent = true;
-    } catch {
+    let mcpFound = null;
+    for (const rel of [".mcp.json", join5(".cursor", "mcp.json")]) {
+      try {
+        await access(join5(root, rel));
+        mcpFound = rel;
+        break;
+      } catch {
+      }
     }
     checks.push({
-      name: "[host] Cursor MCP config",
-      ok: mcpPresent,
-      detail: mcpPresent ? ".cursor/mcp.json present" : "Run `mushi connect` to wire MCP for two-way reporter replies"
+      name: "[host] MCP config",
+      ok: mcpFound !== null,
+      detail: mcpFound ? `${mcpFound} present` : "No .mcp.json (Claude Code) or .cursor/mcp.json (Cursor) \u2014 run `npx mushi-mushi setup --ide claude` or `--ide cursor` for two-way reporter replies"
     });
     if (isCapHybrid) {
       const hasWebSdk = Boolean(deps["@mushi-mushi/web"] || deps["@mushi-mushi/react"]);
@@ -912,7 +1175,7 @@ var HASH_ROUTER_PATTERNS = [
 var HASH_TEMPLATE_PATTERN = /['"`]#\//;
 async function scanDirForPattern(dir, patterns, maxDepth = 6, maxFiles = 2e3) {
   const { readdir: readdir2, readFile: readFile3 } = await import("fs/promises");
-  const { join: join4 } = await import("path");
+  const { join: join5 } = await import("path");
   let count = 0;
   async function walk(d, depth) {
     if (depth > maxDepth || count > maxFiles) return null;
@@ -924,7 +1187,7 @@ async function scanDirForPattern(dir, patterns, maxDepth = 6, maxFiles = 2e3) {
     }
     for (const e of entries) {
       if (e.name.startsWith(".") || e.name === "node_modules" || e.name === "dist") continue;
-      const full = join4(d, e.name);
+      const full = join5(d, e.name);
       if (e.isDirectory()) {
         const found = await walk(full, depth + 1);
         if (found) return found;
@@ -941,7 +1204,7 @@ async function scanDirForPattern(dir, patterns, maxDepth = 6, maxFiles = 2e3) {
   }
   const { resolve: resolve3 } = await import("path");
   for (const sub of ["src", "app", "pages", "lib", "components"]) {
-    const found = await walk(join4(resolve3(dir), sub), 0);
+    const found = await walk(join5(resolve3(dir), sub), 0);
     if (found) return found;
   }
   return walk(resolve3(dir), 0);
@@ -968,95 +1231,140 @@ async function checkHashRouterCapture(cwd) {
     }
   ];
 }
-async function checkMcpConfig(config, cwd, doFetch = globalThis.fetch) {
-  const checks = [];
+function isJsonObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeProjectPath(path) {
+  const slashed = path.replace(/\\/g, "/").replace(/\/+$/, "");
+  return process.platform === "win32" ? slashed.toLowerCase() : slashed;
+}
+async function collectMcpSources(root, home) {
   const { readFile: readFile3 } = await import("fs/promises");
-  const { join: join4, resolve: resolve3 } = await import("path");
-  const { homedir } = await import("os");
-  const root = resolve3(cwd);
-  const candidates = [join4(root, ".cursor", "mcp.json"), join4(homedir(), ".cursor", "mcp.json")];
-  let mcpPath = null;
-  let mcpRaw = null;
-  for (const candidate of candidates) {
+  const { join: join5 } = await import("path");
+  const sources = [];
+  const invalid = [];
+  const plainFiles = [
+    { path: join5(root, ".mcp.json"), claudeCode: true },
+    { path: join5(root, ".cursor", "mcp.json"), claudeCode: false },
+    { path: join5(home, ".cursor", "mcp.json"), claudeCode: false }
+  ];
+  for (const file of plainFiles) {
+    let raw;
     try {
-      const raw = await readFile3(candidate, "utf8");
-      let parsed = {};
-      try {
-        parsed = JSON.parse(raw);
-      } catch {
-      }
-      const hasEntries = Object.keys(parsed.mcpServers ?? {}).length > 0;
-      if (!hasEntries && candidates.indexOf(candidate) < candidates.length - 1) {
-        continue;
-      }
-      mcpRaw = raw;
-      mcpPath = candidate;
-      break;
+      raw = await readFile3(file.path, "utf8");
     } catch {
+      continue;
+    }
+    try {
+      const parsed = JSON.parse(raw);
+      const servers = isJsonObject(parsed) && isJsonObject(parsed.mcpServers) ? parsed.mcpServers : {};
+      sources.push({ path: file.path, servers, claudeCode: file.claudeCode });
+    } catch {
+      invalid.push(file.path);
     }
   }
-  if (!mcpPath || !mcpRaw) {
+  const claudeJsonPath = join5(home, ".claude.json");
+  try {
+    const parsed = JSON.parse(await readFile3(claudeJsonPath, "utf8"));
+    if (isJsonObject(parsed)) {
+      const servers = isJsonObject(parsed.mcpServers) ? { ...parsed.mcpServers } : {};
+      const projects = isJsonObject(parsed.projects) ? parsed.projects : {};
+      const wanted = normalizeProjectPath(root);
+      for (const [projectPath, entry] of Object.entries(projects)) {
+        if (normalizeProjectPath(projectPath) === wanted && isJsonObject(entry) && isJsonObject(entry.mcpServers)) {
+          Object.assign(servers, entry.mcpServers);
+        }
+      }
+      sources.push({ path: claudeJsonPath, servers, claudeCode: true });
+    }
+  } catch {
+  }
+  return { sources, invalid };
+}
+function assessMushiEntry(source, name, entry, cliKeySaved) {
+  const label = `${name} (${source.path})`;
+  if (!isJsonObject(entry)) return { usable: false, stdio: false, detail: `${label}: not an object` };
+  if (typeof entry.url === "string") {
+    if (source.claudeCode && entry.type !== "http" && entry.type !== "sse") {
+      return {
+        usable: false,
+        stdio: false,
+        detail: `${label}: has a url but no "type": "http" \u2014 Claude Code skips it`
+      };
+    }
+    return { usable: true, stdio: false, detail: `${label}: hosted OAuth \u2014 sign in from the IDE's MCP panel` };
+  }
+  const env = isJsonObject(entry.env) ? entry.env : {};
+  const key = env.MUSHI_API_KEY;
+  const endpoint = env.MUSHI_API_ENDPOINT;
+  if (typeof endpoint === "string" && !/^https?:\/\//.test(endpoint) && !/^\$\{.+\}$/.test(endpoint)) {
+    return { usable: false, stdio: true, detail: `${label}: MUSHI_API_ENDPOINT is not a URL` };
+  }
+  if (typeof key === "string" && key.startsWith("mushi_")) {
+    return { usable: true, stdio: true, detail: `${label}: key written inline` };
+  }
+  if (key === void 0 || typeof key === "string" && /^\$\{.*\}$/.test(key)) {
+    return cliKeySaved ? { usable: true, stdio: true, detail: `${label}: key from MUSHI_API_KEY or the saved CLI config` } : {
+      usable: false,
+      stdio: true,
+      detail: `${label}: reads the key from MUSHI_API_KEY or the CLI config, and neither is set`
+    };
+  }
+  return { usable: false, stdio: true, detail: `${label}: MUSHI_API_KEY is neither a mushi_ key nor a placeholder` };
+}
+async function checkMcpConfig(config, cwd, doFetch = globalThis.fetch, home) {
+  const checks = [];
+  const { resolve: resolve3 } = await import("path");
+  const { homedir } = await import("os");
+  const root = resolve3(cwd);
+  const { sources, invalid } = await collectMcpSources(root, home ?? homedir());
+  if (invalid.length > 0) {
     checks.push({
-      name: "[mcp] mcp.json present",
+      name: "[mcp] MCP config valid JSON",
       ok: false,
-      detail: "No .cursor/mcp.json found in cwd or ~/.cursor/. Run `mushi setup` to create it."
+      detail: `Not valid JSON: ${invalid.join(", ")}`
     });
+  }
+  if (sources.length === 0) {
+    if (invalid.length === 0) {
+      checks.push({
+        name: "[mcp] MCP config present",
+        ok: false,
+        detail: "No .mcp.json, .cursor/mcp.json, ~/.cursor/mcp.json or ~/.claude.json found."
+      });
+    }
     return checks;
   }
   checks.push({
-    name: "[mcp] mcp.json present",
+    name: "[mcp] MCP config present",
     ok: true,
-    detail: `Found at ${mcpPath}`
+    detail: `Found: ${sources.map((s) => s.path).join(", ")}`
   });
-  let mcpConfig = {};
-  try {
-    mcpConfig = JSON.parse(mcpRaw);
-  } catch {
-    checks.push({
-      name: "[mcp] mcp.json valid JSON",
-      ok: false,
-      detail: "mcp.json is not valid JSON \u2014 regenerate with `mushi setup`."
-    });
-    return checks;
-  }
-  const servers = mcpConfig.mcpServers ?? {};
-  const mushiEntries = Object.entries(servers).filter(
-    ([k]) => k === "mushi" || k.startsWith("mushi-")
+  const mushiEntries = sources.flatMap(
+    (source) => Object.entries(source.servers).filter(([name]) => name === "mushi" || name.startsWith("mushi-")).map(([name, entry]) => ({ source, name, entry }))
   );
   if (mushiEntries.length === 0) {
     checks.push({
       name: "[mcp] mushi server entry",
       ok: false,
-      detail: "No mushi or mushi-* server found in mcpServers. Run `mushi setup` to add one."
+      detail: "No mushi or mushi-* server in any MCP config."
     });
     return checks;
   }
   checks.push({
     name: "[mcp] mushi server entry",
     ok: true,
-    detail: `Found: ${mushiEntries.map(([k]) => k).join(", ")}`
-  });
-  let anyKeyValid = false;
-  let anyEndpointSet = false;
-  for (const [, srv] of mushiEntries) {
-    const s = srv;
-    const env = s.env ?? {};
-    const key = env["MUSHI_API_KEY"] ?? "";
-    const endpoint = env["MUSHI_API_ENDPOINT"] ?? "";
-    if (key.startsWith("mushi_")) anyKeyValid = true;
-    if (endpoint.includes("supabase.co") || endpoint.includes("localhost")) anyEndpointSet = true;
-  }
-  checks.push({
-    name: "[mcp] MUSHI_API_KEY set",
-    ok: anyKeyValid,
-    detail: anyKeyValid ? "At least one mushi server has a valid mushi_* API key" : "No mushi_* API key found in any mushi server env. Re-run `mushi setup` to regenerate."
+    detail: `Found: ${mushiEntries.map(({ name }) => name).join(", ")}`
   });
+  const assessed = mushiEntries.map(
+    ({ source, name, entry }) => assessMushiEntry(source, name, entry, Boolean(config.apiKey))
+  );
   checks.push({
-    name: "[mcp] MUSHI_API_ENDPOINT set",
-    ok: anyEndpointSet,
-    detail: anyEndpointSet ? "MUSHI_API_ENDPOINT is present and looks valid" : "MUSHI_API_ENDPOINT missing or not a Supabase URL. Re-run `mushi setup`."
+    name: "[mcp] mushi entries usable",
+    ok: assessed.every((a) => a.usable),
+    detail: assessed.map((a) => a.detail).join("; ")
   });
-  if (anyKeyValid && anyEndpointSet && config.apiKey && config.endpoint) {
+  if (assessed.some((a) => a.stdio && a.usable) && config.apiKey && config.endpoint) {
     try {
       const { endpoint, apiKey } = sanitizeCliCredentials(config);
       const res = await doFetch(`${endpoint}/v1/admin/mcp/account-overview`, {
@@ -1100,13 +1408,13 @@ async function checkMcpConfig(config, cwd, doFetch = globalThis.fetch) {
   return checks;
 }
 var FIX_HINTS = {
-  "CLI config file": "Run `mushi connect --endpoint <url> --project-id <uuid> --api-key mushi_xxx` or `mushi config endpoint <url>`.",
-  "API key configured": "Mint a key in the console (Projects \u2192 API Keys) then `mushi login --api-key mushi_xxx`.",
-  "Project ID configured": "Copy the project UUID from the console Projects page \u2192 `mushi config projectId <uuid>`.",
+  "Mushi set up here": "Run `npx mushi-mushi` in your app folder \u2014 it signs you in, installs the SDK and writes the env vars.",
+  "API key configured": SIGN_IN_HINT,
+  "Project ID configured": SIGN_IN_HINT,
   "Endpoint reachable": "Check your network and that MUSHI_API_ENDPOINT points at `\u2026/functions/v1/api`.",
   "[ingest]": "Open the console Onboarding wizard \u2192 Install SDK \u2192 submit a test report, or run `mushi connect --wait`.",
   "[server]": "Open Settings \u2192 Integrations: connect GitHub, index codebase, add Anthropic BYOK key, enable autofix.",
-  "[mcp]": "Run `mushi setup` to regenerate .cursor/mcp.json with a fresh API key and endpoint."
+  "[mcp]": "Run `npx mushi-mushi setup --ide cursor` (or `--ide claude`) to rewrite the Mushi MCP entry."
 };
 function fixHintForCheck(name) {
   if (FIX_HINTS[name]) return FIX_HINTS[name];
@@ -1132,12 +1440,12 @@ async function checkOnboardingStatus(config, _consoleBase, cwd, doFetch = global
   }
   try {
     const { readFile: readFile3 } = await import("fs/promises");
-    const { join: join4, resolve: resolve3 } = await import("path");
+    const { join: join5, resolve: resolve3 } = await import("path");
     const root = resolve3(cwd);
     let envContent = "";
     for (const f of [".env.local", ".env"]) {
       try {
-        envContent = await readFile3(join4(root, f), "utf8");
+        envContent = await readFile3(join5(root, f), "utf8");
         break;
       } catch {
       }
@@ -1203,7 +1511,7 @@ async function checkOnboardingStatus(config, _consoleBase, cwd, doFetch = global
 }
 async function checkVersionDrift(cwd, doFetch) {
   const checks = [];
-  const { MUSHI_CLI_VERSION: MUSHI_CLI_VERSION2 } = await import("./version-AYMUW3UQ.js");
+  const { MUSHI_CLI_VERSION: MUSHI_CLI_VERSION2 } = await import("./version-VR37VEE4.js");
   if (MUSHI_CLI_VERSION2 === "0.0.0-dev") return checks;
   const parse2 = (v) => {
     const m = v.replace(/^[~^]/, "").match(/^(\d+)\.(\d+)\.(\d+)/);
@@ -1233,8 +1541,8 @@ async function checkVersionDrift(cwd, doFetch) {
   }
   try {
     const { readFile: readFile3 } = await import("fs/promises");
-    const { join: join4 } = await import("path");
-    const pkg = JSON.parse(await readFile3(join4(cwd, "package.json"), "utf8"));
+    const { join: join5 } = await import("path");
+    const pkg = JSON.parse(await readFile3(join5(cwd, "package.json"), "utf8"));
     const deps = { ...pkg.dependencies, ...pkg.devDependencies };
     const candidates = Object.entries(deps).filter(([name]) => name.startsWith("@mushi-mushi/")).filter(([, v]) => /^[~^]?\d/.test(v));
     const drifted = (await Promise.all(
@@ -1301,11 +1609,23 @@ async function runDoctor(config, options = {}) {
   const isFull = options.full === true;
   const runServer = isFull || options.server !== false;
   const runIngest = isFull || options.ingest !== false;
+  const sdkCheck = await checkSdkInstall(options.cwd ?? process.cwd());
+  if (!config.apiKey && !config.projectId && !sdkCheck?.ok && !options.auth && !isFull) {
+    return {
+      ready: false,
+      checks: [
+        {
+          name: "Mushi set up here",
+          ok: false,
+          detail: "Not set up yet \u2014 no saved Mushi credentials and no Mushi SDK in this folder."
+        }
+      ]
+    };
+  }
   checks.push(...checkCliConfig(config));
   if (config.endpoint) {
     checks.push(await checkEndpointReachability(config.endpoint, doFetch));
   }
-  const sdkCheck = await checkSdkInstall(options.cwd ?? process.cwd());
   if (sdkCheck) checks.push(sdkCheck);
   if (sdkCheck?.ok && !sdkCheck.warn) {
     const { findSdkImport } = await import("./snippet-inject-CCXILWYZ.js");
@@ -1365,13 +1685,17 @@ function formatDoctorResult(result) {
   const WARN = "WARN";
   const FAIL = "FAIL";
   const lines = [];
+  const printedHints = /* @__PURE__ */ new Set();
   for (const c of result.checks) {
     const icon = !c.ok ? FAIL : c.warn ? WARN : PASS;
     lines.push(`${icon} ${c.name}`);
     if (c.detail) lines.push(`  ${c.detail}`);
     if (!c.ok) {
       const hint = fixHintForCheck(c.name);
-      if (hint) lines.push(`  \u2192 Fix: ${hint}`);
+      if (hint && !printedHints.has(hint)) {
+        printedHints.add(hint);
+        lines.push(`  \u2192 Fix: ${hint}`);
+      }
     }
   }
   const failed = result.checks.filter((c) => !c.ok);
@@ -1395,6 +1719,9 @@ ${failed.length} check${failed.length === 1 ? "" : "s"} failed.`);
 
 // src/init.ts
 var ENV_FILES = [".env.local", ".env"];
+function isInteractive() {
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY);
+}
 var PROJECT_ID_PATTERN = /^(?:proj_[A-Za-z0-9_-]{10,}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
 var API_KEY_PATTERN = /^(mushi_|mush_pk_)[A-Za-z0-9_-]{10,}$/;
 async function runInit(options = {}) {
@@ -1404,6 +1731,7 @@ async function runInit(options = {}) {
     return;
   }
   ensureInteractiveOrBailOut(options);
+  if (!isInteractive()) options = { ...options, yes: true };
   p.intro("Mushi setup");
   await printFreshnessHint();
   warnIfWorkspaceRoot(cwd);
@@ -1411,6 +1739,10 @@ async function runInit(options = {}) {
   maybeSuggestAudit(pkg);
   if (!pkg) {
     p.log.warn("No package.json found in this directory.");
+    if (!isInteractive()) {
+      p.cancel("Aborted. Run from your project root, or pass --cwd <path>.");
+      process.exit(1);
+    }
     const cont = await p.confirm({
       message: "Continue anyway? (Mushi will install into the current folder)",
       initialValue: false
@@ -1438,13 +1770,13 @@ async function runInit(options = {}) {
   }
   await writeEnvFile(
     cwd,
-    credentials.apiKey,
+    credentials.sdkKey,
     credentials.projectId,
     framework,
     endpoint,
     Boolean(options.yes)
   );
-  persistCliConfig(credentials.apiKey, credentials.projectId, endpoint);
+  persistCliConfig(credentials, endpoint);
   emitWizardFunnelEvent(credentials, endpoint, "wizard_env_written", { framework: framework.id });
   const enableRewards = await maybeEnableRewards(options);
   await maybeInjectSnippet(cwd, framework, options);
@@ -1477,14 +1809,11 @@ function maybeSuggestAudit(pkg) {
   }
 }
 function ensureInteractiveOrBailOut(options) {
-  const isTTY = Boolean(process.stdin.isTTY && process.stdout.isTTY);
-  if (isTTY) return;
-  const hasAllFlags = Boolean(
-    (options.framework || options.yes) && options.projectId && options.apiKey
-  );
-  if (hasAllFlags) return;
+  if (isInteractive()) return;
+  if (options.yes) return;
+  if (options.framework && options.projectId && options.apiKey) return;
   process.stderr.write(
-    "mushi-mushi: non-interactive terminal detected.\nPass all of --yes (or --framework), --project-id, and --api-key to run unattended.\nExample: npx mushi-mushi --yes --project-id <uuid-from-console> --api-key mushi_xxx\nYour project ID is the UUID shown in the Projects page of the Mushi admin console.\n"
+    "mushi-mushi: non-interactive terminal detected.\nRe-run with --yes to set up without prompts: it reuses the credentials saved by\n`npx mushi-mushi login`, or prints a sign-in URL and waits while you approve it in a browser.\nExample: npx mushi-mushi --yes\nCI with no browser: npx mushi-mushi --yes --project-id <uuid> --api-key <ingest-only key>\n"
   );
   process.exit(1);
 }
@@ -1515,14 +1844,16 @@ async function chooseFramework(detected, options) {
   return FRAMEWORKS[confirmed];
 }
 async function acquireCredentials(options, consoleBase, endpoint) {
+  const probe = (e, k, pid) => probeKeyScope(e, k, pid);
   if (options.projectId && options.apiKey) {
-    return {
-      projectId: sanitizeSecret(options.projectId),
-      apiKey: sanitizeSecret(options.apiKey)
-    };
+    const projectId = sanitizeSecret(options.projectId);
+    const sdkKey = sanitizeSecret(options.apiKey);
+    await assertUserKeyIsIngestOnly(sdkKey, projectId, endpoint, probe);
+    return { projectId, sdkKey };
   }
   const existing = loadConfig();
   maybeShowTelemetryNotice(existing);
+  let browserTried = false;
   if (!options.projectId && !options.apiKey && existing.projectId && existing.apiKey) {
     const reuse = options.yes ? true : await p.confirm({
       message: "Use the Mushi credentials saved from your last sign-in?",
@@ -1533,13 +1864,32 @@ async function acquireCredentials(options, consoleBase, endpoint) {
       process.exit(0);
     }
     if (reuse) {
-      return {
-        projectId: sanitizeSecret(existing.projectId),
-        apiKey: sanitizeSecret(existing.apiKey)
-      };
+      const saved = await resolveSavedCredentials(
+        { projectId: existing.projectId, apiKey: existing.apiKey, sdkKey: existing.sdkKey },
+        endpoint,
+        probe
+      );
+      if (saved.kind === "ready") return saved.credentials;
+      if (saved.kind === "needs-sdk-key") {
+        p.log.info(
+          "Your saved sign-in key can read bug reports, so it stays in the CLI config. Approve one browser sign-in to mint a separate ingest-only key for the app's env vars."
+        );
+        browserTried = true;
+        const creds = await runBrowserSignIn(options, endpoint, consoleBase, {
+          projectId: saved.projectId,
+          cliKey: saved.cliKey
+        });
+        if (creds) return creds;
+      } else {
+        p.log.warn(`Saved credentials can't be reused (${saved.reason}) \u2014 signing in again.`);
+      }
     }
   }
-  if (options.yes) {
+  if (browserTried) {
+    p.log.warn(
+      "Browser sign-in didn't complete \u2014 switching to manual entry. Run `npx mushi-mushi doctor --auth` to diagnose the sign-in path."
+    );
+  } else if (options.yes) {
     const creds = await runBrowserSignIn(options, endpoint, consoleBase);
     if (creds) return creds;
     p.log.warn(
@@ -1574,9 +1924,70 @@ async function acquireCredentials(options, consoleBase, endpoint) {
       );
     }
   }
-  return collectCredentialsManually(options, consoleBase, endpoint);
+  return collectCredentialsManually(options, consoleBase, endpoint, probe);
+}
+async function assertUserKeyIsIngestOnly(key, projectId, endpoint, probe) {
+  const result = await probe(endpoint, key, projectId);
+  if (result.result === "mcp" || result.result === "unknown") {
+    throw new Error(
+      `Not writing this API key into your app's env vars: ${describeUnsafeSdkKey(result, endpoint)}. Use an ingest-only (report:write) key from the console, or leave out --api-key to sign in with the browser, which mints one.`
+    );
+  }
+}
+async function resolveSavedCredentials(saved, endpoint, probe) {
+  const projectId = sanitizeSecret(saved.projectId);
+  const apiKey = sanitizeSecret(saved.apiKey);
+  const savedSdkKey = savedSdkKeyFor(saved, projectId);
+  if (savedSdkKey) {
+    const sdkProbe = await probe(endpoint, savedSdkKey, projectId);
+    if (sdkProbe.result === "ingest-only") {
+      return { kind: "ready", credentials: { projectId, sdkKey: savedSdkKey, cliKey: apiKey } };
+    }
+  }
+  const cliProbe = await probe(endpoint, apiKey, projectId);
+  if (cliProbe.result === "ingest-only") {
+    return { kind: "ready", credentials: { projectId, sdkKey: apiKey } };
+  }
+  if (cliProbe.result === "mcp") {
+    return { kind: "needs-sdk-key", projectId, cliKey: apiKey };
+  }
+  return { kind: "unusable", reason: describeUnsafeSdkKey(cliProbe, endpoint) };
 }
-async function runBrowserSignIn(options, endpoint, consoleBase) {
+async function mintWizardKeys(deps, args) {
+  let projectId;
+  let createdName;
+  let sdkKey = null;
+  if (args.target.kind === "new") {
+    const created = await deps.createProject(args.endpoint, args.cliToken, args.target.name, {
+      scopes: SDK_KEY_SCOPES
+    });
+    projectId = created.id;
+    createdName = created.name;
+    sdkKey = created.apiKey;
+  } else {
+    projectId = args.target.projectId;
+  }
+  if (!sdkKey) {
+    sdkKey = await deps.mintProjectKey(args.endpoint, args.cliToken, projectId, {
+      scopes: SDK_KEY_SCOPES,
+      label: SDK_KEY_LABEL
+    });
+  }
+  let cliKey;
+  let cliKeyError;
+  if (args.withCliKey) {
+    try {
+      cliKey = await deps.mintProjectKey(args.endpoint, args.cliToken, projectId, {
+        scopes: CLI_KEY_SCOPES,
+        label: CLI_KEY_LABEL
+      });
+    } catch (err) {
+      cliKeyError = err instanceof Error ? err.message : String(err);
+    }
+  }
+  return { projectId, createdName, sdkKey, cliKey, cliKeyError };
+}
+async function runBrowserSignIn(options, endpoint, consoleBase, preset) {
   const startSpin = p.spinner();
   startSpin.start("Starting secure browser sign-in\u2026");
   let session;
@@ -1604,9 +2015,11 @@ async function runBrowserSignIn(options, endpoint, consoleBase) {
     return null;
   }
   waitSpin.stop("Approved.");
-  let projectId = options.projectId ? sanitizeSecret(options.projectId) : void 0;
-  let apiKey;
-  if (!projectId) {
+  const presetProjectId = preset?.projectId ?? (options.projectId ? sanitizeSecret(options.projectId) : void 0);
+  let target;
+  if (presetProjectId) {
+    target = { kind: "existing", projectId: presetProjectId };
+  } else {
     let projects = [];
     const fetchSpin = p.spinner();
     fetchSpin.start("Loading your projects\u2026");
@@ -1616,91 +2029,117 @@ async function runBrowserSignIn(options, endpoint, consoleBase) {
         projects.length > 0 ? `Found ${projects.length} project(s).` : "No projects yet."
       );
     } catch (err) {
+      if (!isInteractive()) {
+        fetchSpin.stop("Could not load projects.");
+        p.log.warn(err instanceof Error ? err.message : String(err));
+        return null;
+      }
       fetchSpin.stop("Could not load projects \u2014 you can still create a new one.");
       p.log.warn(err instanceof Error ? err.message : String(err));
     }
-    const NEW = "__new__";
-    const choice = await p.select({
-      message: "Choose a project",
-      initialValue: projects[0]?.id ?? NEW,
-      options: [
-        ...projects.map((pr) => ({ value: pr.id, label: pr.name, hint: pr.id.slice(0, 8) })),
-        { value: NEW, label: "Create a new project", hint: "mints an SDK key automatically" }
-      ]
-    });
-    if (p.isCancel(choice)) {
-      p.cancel("Aborted.");
-      process.exit(0);
-    }
-    if (choice === NEW) {
-      const name = await p.text({
-        message: "Project name",
-        placeholder: "My app",
-        validate: (v) => v && v.trim().length > 0 ? void 0 : "Required"
+    if (!isInteractive()) {
+      const cwd = options.cwd ?? process.cwd();
+      const choice = chooseProjectNonInteractive(
+        projects,
+        defaultProjectName(readPackageJson(cwd)?.name, cwd)
+      );
+      if (choice.kind === "existing") {
+        p.log.info(`Using project "${choice.name}" (matches this app \u2014 pass --project-id to pick another).`);
+        target = { kind: "existing", projectId: choice.id };
+      } else {
+        p.log.info(`Creating project "${choice.name}" (no project matches this app \u2014 pass --project-id to use an existing one).`);
+        target = { kind: "new", name: choice.name };
+      }
+    } else {
+      const NEW = "__new__";
+      const choice = await p.select({
+        message: "Choose a project",
+        initialValue: projects[0]?.id ?? NEW,
+        options: [
+          ...projects.map((pr) => ({ value: pr.id, label: pr.name, hint: pr.id.slice(0, 8) })),
+          { value: NEW, label: "Create a new project", hint: "mints an SDK key automatically" }
+        ]
       });
-      if (p.isCancel(name)) {
+      if (p.isCancel(choice)) {
         p.cancel("Aborted.");
         process.exit(0);
       }
-      const createSpin = p.spinner();
-      createSpin.start(`Creating "${name.trim()}"\u2026`);
-      try {
-        const created = await createProject(endpoint, cliToken, name.trim(), {
-          scopes: ["report:write", "mcp:read"]
+      if (choice === NEW) {
+        const name = await p.text({
+          message: "Project name",
+          placeholder: "My app",
+          validate: (v) => v && v.trim().length > 0 ? void 0 : "Required"
         });
-        projectId = created.id;
-        apiKey = created.apiKey ?? void 0;
-        createSpin.stop(`Created project "${created.name}".`);
-      } catch (err) {
-        createSpin.stop("Could not create the project.");
-        p.log.warn(err instanceof Error ? err.message : String(err));
-        return null;
+        if (p.isCancel(name)) {
+          p.cancel("Aborted.");
+          process.exit(0);
+        }
+        target = { kind: "new", name: name.trim() };
+      } else {
+        target = { kind: "existing", projectId: choice };
       }
-    } else {
-      projectId = choice;
     }
   }
-  if (projectId && !apiKey) {
-    const keySpin = p.spinner();
-    keySpin.start("Minting SDK key\u2026");
-    try {
-      apiKey = await mintProjectKey(endpoint, cliToken, projectId, {
-        scopes: ["report:write", "mcp:read"]
-      });
-      keySpin.stop("SDK key ready.");
-    } catch (err) {
-      keySpin.stop("Could not mint an API key.");
-      p.log.warn(err instanceof Error ? err.message : String(err));
+  const keySpin = p.spinner();
+  keySpin.start(target.kind === "new" ? `Creating "${target.name}"\u2026` : "Minting keys\u2026");
+  let minted;
+  try {
+    minted = await mintWizardKeys(
+      { createProject, mintProjectKey },
+      { endpoint, cliToken, target, withCliKey: !preset }
+    );
+  } catch (err) {
+    keySpin.stop(target.kind === "new" ? "Could not create the project." : "Could not mint an API key.");
+    p.log.warn(err instanceof Error ? err.message : String(err));
+    if (target.kind === "existing") {
       p.log.warn(
         `You're signed in, but key minting failed. Generate one manually in the console Verify tab: ${consoleUrl(consoleBase, "/onboarding?tab=verify")}`
       );
-      return null;
     }
+    return null;
   }
-  if (!projectId || !apiKey) return null;
-  return { apiKey, projectId };
+  keySpin.stop(
+    minted.createdName ? `Created project "${minted.createdName}" with an ingest-only SDK key.` : "SDK key ready (ingest-only)."
+  );
+  if (minted.cliKeyError) {
+    p.log.warn(
+      `The CLI/MCP key could not be minted (${minted.cliKeyError}). The SDK install continues; run \`npx mushi-mushi login\` later for MCP and admin commands.`
+    );
+  }
+  return {
+    projectId: minted.projectId,
+    sdkKey: minted.sdkKey,
+    cliKey: preset?.cliKey ?? minted.cliKey
+  };
 }
-async function collectCredentialsManually(options, consoleBase, endpoint) {
+async function collectCredentialsManually(options, consoleBase, endpoint, probe) {
   const existing = loadConfig();
   let savedProjectId = existing.projectId;
-  let savedApiKey = existing.apiKey;
-  if (!options.projectId && !options.apiKey && savedProjectId && savedApiKey) {
+  let savedApiKey;
+  if (!isInteractive() && !(options.projectId && options.apiKey)) {
+    throw new Error(
+      "Browser sign-in didn't complete and this terminal cannot prompt for a key. Re-run `npx mushi-mushi --yes` and approve the sign-in in the browser, or pass --project-id and an ingest-only --api-key."
+    );
+  }
+  if (!options.projectId && !options.apiKey && savedProjectId && existing.apiKey) {
+    const projectIdForCheck = sanitizeSecret(savedProjectId);
+    const candidate = savedSdkKeyFor(existing, projectIdForCheck) ?? sanitizeSecret(existing.apiKey);
     p.log.info(
-      `Found saved credentials from a previous sign-in (project ${sanitizeSecret(savedProjectId).slice(0, 8)}\u2026).`
+      `Found saved credentials from a previous sign-in (project ${projectIdForCheck.slice(0, 8)}\u2026).`
     );
     const checkSpin = p.spinner();
     checkSpin.start("Checking saved credentials\u2026");
-    const check = await apiCall("/v1/sync/whoami", {
-      apiKey: sanitizeSecret(savedApiKey),
-      projectId: sanitizeSecret(savedProjectId),
-      endpoint
-    });
-    if (check.ok) {
-      checkSpin.stop(`Saved credentials still work (${check.data.project_name}).`);
-    } else {
+    const check = await probe(endpoint, candidate, projectIdForCheck);
+    if (check.result === "ingest-only") {
+      checkSpin.stop("Saved ingest key still works.");
+      savedApiKey = candidate;
+    } else if (check.result === "mcp") {
+      checkSpin.stop("Saved key can read reports, so it can't go into your app's env \u2014 paste an ingest-only key below.");
+    } else if (check.result === "invalid") {
       checkSpin.stop("Saved credentials no longer authenticate \u2014 enter fresh ones below.");
       savedProjectId = void 0;
-      savedApiKey = void 0;
+    } else {
+      checkSpin.stop(`Could not check the saved key (${describeUnsafeSdkKey(check, endpoint)}) \u2014 enter one below.`);
     }
   }
   const rawProjectId = options.projectId ?? savedProjectId ?? await promptText({
@@ -1727,17 +2166,29 @@ async function collectCredentialsManually(options, consoleBase, endpoint) {
       `Invalid API key. Expected format: mushi_[A-Za-z0-9_-]{10,}. Got: ${redact(apiKey)}`
     );
   }
-  return { projectId, apiKey };
+  if (apiKey !== savedApiKey) {
+    await assertUserKeyIsIngestOnly(apiKey, projectId, endpoint, probe);
+  }
+  return { projectId, sdkKey: apiKey };
 }
 async function verifyCredentials(credentials, options, consoleBase) {
   const endpoint = resolveCloudEndpoint(options.endpoint);
   const spinner3 = p.spinner();
   spinner3.start("Verifying credentials\u2026");
   const result = await apiCall("/v1/sync/whoami", {
-    apiKey: credentials.apiKey,
+    apiKey: credentials.sdkKey,
     projectId: credentials.projectId,
     endpoint
   });
+  if (!result.ok && (result.error.code === "NETWORK_ERROR" || result.error.code === "TIMEOUT")) {
+    spinner3.stop(`Could not reach ${endpoint}.`);
+    p.log.error(result.error.message);
+    p.log.warn("Setup did NOT complete: nothing was installed and no env vars were written.");
+    p.log.info(
+      "Check your network, proxy or VPN, or pass --endpoint <url> if you run a self-hosted backend, then re-run `npx mushi-mushi`."
+    );
+    throw new Error(`Could not reach the Mushi API at ${endpoint} \u2014 nothing was changed.`);
+  }
   if (!result.ok) {
     spinner3.stop("Credentials could not be verified.");
     p.log.error(result.error?.message ?? "Authentication failed.");
@@ -1893,9 +2344,24 @@ function warnIfMissingFromGitignore(cwd, envFile) {
     p.log.warn(`${envFile} is not in .gitignore \u2014 add it before committing.`);
   }
 }
-function persistCliConfig(apiKey, projectId, endpoint) {
+function planCliConfigUpdate(existing, credentials, endpoint) {
+  const keepSavedKey = existing.projectId === credentials.projectId && Boolean(existing.apiKey);
+  const apiKey = credentials.cliKey ?? (keepSavedKey ? existing.apiKey : credentials.sdkKey);
+  return {
+    ...existing,
+    apiKey,
+    projectId: credentials.projectId,
+    endpoint,
+    sdkKey: { projectId: credentials.projectId, key: credentials.sdkKey }
+  };
+}
+function persistCliConfig(credentials, endpoint) {
   const existing = loadConfig();
-  saveConfig({ ...existing, apiKey, projectId, endpoint });
+  const next = planCliConfigUpdate(existing, credentials, endpoint);
+  saveConfig(next);
+  if (next.apiKey && next.apiKey !== existing.apiKey) {
+    trySaveKeyToKeychain(next.apiKey, resolveProfileName());
+  }
 }
 function emitWizardFunnelEvent(credentials, endpoint, event, metadata = {}) {
   if (process.env.MUSHI_NO_TELEMETRY) return;
@@ -1903,7 +2369,7 @@ function emitWizardFunnelEvent(credentials, endpoint, event, metadata = {}) {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
-      "X-Mushi-Api-Key": credentials.apiKey,
+      "X-Mushi-Api-Key": credentials.sdkKey,
       "X-Mushi-Project": credentials.projectId
     },
     body: JSON.stringify({ event, source: "cli", metadata }),
@@ -1954,7 +2420,7 @@ import { MushiRewardsBadge } from '@mushi-mushi/react';
     [
       "  [ ] 1. Paste the init snippet above into your app entry file",
       "  [ ] 2. Start your dev server",
-      "  [ ] 3. Run: mushi connect --write-env --wire-ide --wait",
+      "  [ ] 3. Wire your editor: npx mushi-mushi setup --ide cursor   (or --ide claude)",
       `  [ ] 4. Open the Verify tab to send a test report: ${consoleUrl(consoleBase, "/onboarding?tab=verify")}`
     ].join("\n"),
     "Next steps:"
@@ -1963,353 +2429,143 @@ import { MushiRewardsBadge } from '@mushi-mushi/react';
 async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (options.yes) return;
   const answer = await p.confirm({
-    message: "Run `mushi connect --write-env --wire-ide --wait` now? (SDK env + Cursor MCP + heartbeat check)",
-    initialValue: false
-  });
-  if (p.isCancel(answer) || !answer) return;
-  const endpoint = resolveCloudEndpoint(options.endpoint);
-  try {
-    const { runConnect: runConnect2 } = await import("./connect-TWO2ZNFB.js");
-    await runConnect2({
-      apiKey: credentials.apiKey,
-      projectId: credentials.projectId,
-      endpoint,
-      cwd: options.cwd,
-      writeEnv: true,
-      wireIde: true,
-      wait: true
-    });
-  } catch (err) {
-    p.log.warn(err instanceof Error ? err.message : String(err));
-    p.log.info("You can run manually: mushi connect --write-env --wire-ide --wait");
-  }
-}
-async function maybeEnableRewards(options) {
-  if (options.yes) return false;
-  const answer = await p.confirm({
-    message: "Enable Mushi Rewards? (users earn points for bug reports + app activity)",
-    initialValue: false
-  });
-  if (p.isCancel(answer)) return false;
-  return Boolean(answer);
-}
-async function maybeSendTestReport(credentials, options) {
-  if (options.sendTestReport === false) return;
-  let shouldSend;
-  if (options.sendTestReport === true || options.yes) {
-    shouldSend = true;
-  } else {
-    const answer = await p.confirm({
-      message: "Send a test report now to verify the pipeline?",
-      initialValue: true
-    });
-    if (p.isCancel(answer)) return;
-    shouldSend = answer;
-  }
-  if (!shouldSend) return;
-  const endpoint = normalizeEndpoint(resolveCloudEndpoint(options.endpoint));
-  const spinner3 = p.spinner();
-  spinner3.start("Sending test report\u2026");
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), TEST_REPORT_FETCH_TIMEOUT_MS);
-  try {
-    const res = await fetch(`${endpoint}/v1/reports`, {
-      method: "POST",
-      signal: controller.signal,
-      headers: {
-        "Content-Type": "application/json",
-        "X-Mushi-Api-Key": credentials.apiKey,
-        "X-Mushi-Project": credentials.projectId
-      },
-      body: JSON.stringify({
-        projectId: credentials.projectId,
-        description: "Test report from the mushi-mushi setup wizard",
-        category: "other",
-        reporterToken: `wizard-${randomUUID()}`,
-        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-        environment: {
-          url: "cli://wizard",
-          userAgent: `mushi-wizard/${process.platform}-${process.arch}`,
-          platform: process.platform,
-          language: "en",
-          viewport: { width: 0, height: 0 },
-          referrer: "",
-          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-          timezone: Intl.DateTimeFormat().resolvedOptions().timeZone
-        }
-      })
-    });
-    if (!res.ok) {
-      spinner3.stop(`Test report rejected (HTTP ${res.status}).`);
-      p.log.warn(
-        res.status === 401 || res.status === 403 ? "Credentials did not authenticate \u2014 double-check the project ID and API key." : "Skipping test report. You can retry with `mushi test`."
-      );
-      return;
-    }
-    spinner3.stop("Test report sent.");
-    let reportId;
-    try {
-      const body = await res.json();
-      reportId = body.data?.reportId;
-    } catch {
-    }
-    const consoleBase = options.consoleBase ?? resolveConsoleUrlSync(options.cwd);
-    p.log.success(`View it at ${reportsUrl(consoleBase, reportId)}`);
-  } catch (err) {
-    const aborted = err instanceof Error && err.name === "AbortError";
-    spinner3.stop(aborted ? "Timed out reaching the Mushi API." : "Could not reach the Mushi API.");
-    p.log.warn(err instanceof Error ? err.message : String(err));
-  } finally {
-    clearTimeout(timer);
-  }
-}
-async function printFreshnessHint() {
-  const result = await checkFreshness("mushi-mushi", MUSHI_CLI_VERSION);
-  if (!result || !result.isOutdated) return;
-  p.log.info(
-    `A newer version of mushi-mushi is available: ${result.current} \u2192 ${result.latest}. Run \`npx mushi-mushi@latest\` to get the freshest wizard.`
-  );
-}
-function warnIfWorkspaceRoot(cwd) {
-  let hint;
-  try {
-    hint = detectWorkspaceHint(cwd);
-  } catch {
-    return;
-  }
-  if (!hint || hint.apps.length === 0) return;
-  const hasFrameworkAtCwd = hint.apps.some(
-    (app) => isSameDirectory(cwd, resolveWorkspaceAppPath(hint.root, app.relativePath))
-  );
-  if (hasFrameworkAtCwd) return;
-  const apps = hint.apps.slice(0, 5).map((app) => `  \u2022 ${app.relativePath} (${app.framework})`).join("\n");
-  p.log.warn(
-    `You appear to be at a workspace root (source: ${hint.source}). Mushi will install into the current directory, which has no framework dep. You probably meant one of these sub-packages:
-${apps}
-Run \`mushi init --cwd <path>\` \u2014 or re-run the wizard from inside that package.`
-  );
-}
-function resolveWorkspaceAppPath(root, relativePath) {
-  return `${root}/${relativePath}`.replace(/\\/g, "/");
-}
-function isSameDirectory(a, b) {
-  return a.replace(/\\/g, "/").replace(/\/+$/, "") === b.replace(/\\/g, "/").replace(/\/+$/, "");
-}
-
-// src/login.ts
-function getPostLoginBannerMessage(opts) {
-  if (opts.suppressPostLoginBanner) return null;
-  if (opts.upgradeScope) {
-    return "  Key upgraded! Re-run 'mushi setup' to update your .cursor/mcp.json, then restart Cursor.";
-  }
-  return "  Run 'mushi init' to set up the SDK in this project.";
-}
-function printPostLoginBanner(opts) {
-  const message = getPostLoginBannerMessage(opts);
-  if (message) console.log(message);
-}
-var MAX_CONSECUTIVE_ERRORS = 5;
-async function pollUntilApproved(endpoint, deviceData, deps) {
-  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-  const now = deps.now ?? Date.now;
-  let pollIntervalMs = (deviceData.interval ?? 5) * 1e3;
-  const deadline = now() + (deviceData.expires_in ?? 600) * 1e3;
-  let consecutiveErrors = 0;
-  let firstPoll = true;
-  while (now() < deadline) {
-    if (!firstPoll) {
-      await sleep(pollIntervalMs);
-    }
-    firstPoll = false;
-    const outcome = await deps.poll(endpoint, deviceData.device_code);
-    switch (outcome.status) {
-      case "approved":
-        return { status: "approved", cliToken: outcome.cliToken };
-      case "pending":
-        consecutiveErrors = 0;
-        continue;
-      case "slow_down":
-        consecutiveErrors = 0;
-        pollIntervalMs = Math.max(pollIntervalMs, outcome.retryAfterMs);
-        continue;
-      case "error":
-        if (outcome.retryable) {
-          consecutiveErrors += 1;
-          if (consecutiveErrors < MAX_CONSECUTIVE_ERRORS) continue;
-        }
-        return { status: "error", message: outcome.message };
-      case "denied":
-        return { status: "denied" };
-      case "expired":
-        return { status: "timeout" };
-    }
-  }
-  return { status: "timeout" };
-}
-async function resolveProjectChoice(projectsList, ask) {
-  if (projectsList.length > 0) {
-    console.log("");
-    console.log("  Your projects:");
-    projectsList.forEach((p3, i) => {
-      console.log(`    ${i + 1}. ${p3.name} (${p3.id})`);
-    });
-    console.log(`    ${projectsList.length + 1}. Create a new project`);
-    console.log("");
-    const choice = await ask(`  Pick a project [1-${projectsList.length + 1}]: `);
-    const num = parseInt(choice, 10);
-    if (num >= 1 && num <= projectsList.length) {
-      const picked = projectsList[num - 1];
-      return { kind: "picked", id: picked.id, name: picked.name };
-    }
-  }
-  console.log("");
-  const newName = (await ask("  Project name: ")).trim();
-  if (!newName) return { kind: "empty_name" };
-  return { kind: "create", name: newName };
-}
-async function runLogin(opts = {}) {
-  const { CLOUD_API_ENDPOINT, resolveCloudEndpoint: resolveCloudEndpoint2 } = await import("./endpoint-TEBF4IH6.js");
-  const endpoint = opts.endpoint ? resolveCloudEndpoint2(opts.endpoint) : CLOUD_API_ENDPOINT;
-  const consoleBase = await resolveConsoleUrl();
-  let apiKey = opts.apiKey;
-  let projectId = opts.projectId;
-  if (apiKey) {
-    const config2 = loadConfig();
-    config2.apiKey = apiKey;
-    config2.endpoint = endpoint;
-    if (projectId) config2.projectId = projectId;
-    config2.consoleUrl = consoleBase;
-    saveConfig(config2);
-    console.log("");
-    console.log("  \u2713 Credentials saved.");
-    const verifyResult = await apiCall("/v1/sync/whoami", { apiKey, endpoint, projectId });
-    if (!verifyResult.ok) {
-      console.warn(`  \u26A0  Key saved, but verification failed: ${verifyResult.error?.message ?? "unknown error"}`);
-      console.warn(`     Check your key at: ${cliSetupDeepLink(consoleBase)}`);
-      return;
-    }
-    const d = verifyResult.data;
-    if (d.project_name) {
-      if (!projectId && d.project_id) {
-        config2.projectId = d.project_id;
-        saveConfig(config2);
-      }
-      console.log(`  \u2713 Project: ${d.project_name} (${d.project_id})`);
-    }
-    console.log(`  \u2713 Endpoint: ${endpoint}`);
-    console.log("");
-    if (!opts.suppressPostLoginBanner) {
-      console.log("  Run 'mushi whoami' to verify \xB7 'mushi init' to set up the SDK");
-    }
-    return;
-  }
-  if (!opts.suppressPostLoginBanner) {
-    console.log("");
-  }
-  if (opts.upgradeScope) {
-    console.log("  Mushi login \u2014 scope upgrade");
-    console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-    console.log("  Re-authenticating to mint a new key with report:write + mcp:read + mcp:write scopes.");
-    console.log("  This lets the CLI admin commands (including writes) and MCP server both work with a single key.");
-    console.log("");
-  } else if (!opts.suppressPostLoginBanner) {
-    console.log("  Mushi login");
-    console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-  }
-  let deviceData;
+    message: "Run `mushi connect --write-env --wire-ide --wait` now? (SDK env + Cursor MCP + heartbeat check)",
+    initialValue: false
+  });
+  if (p.isCancel(answer) || !answer) return;
+  const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    deviceData = await startDeviceAuth(endpoint, ensureClientId());
+    const { runConnect: runConnect2 } = await import("./connect-63GYZLFM.js");
+    const saved = loadConfig();
+    const result = await runConnect2(
+      {
+        apiKey: saved.apiKey ?? credentials.sdkKey,
+        sdkKey: credentials.sdkKey,
+        projectId: credentials.projectId,
+        endpoint,
+        cwd: options.cwd,
+        writeEnv: true,
+        wireIde: true,
+        wait: true
+      },
+      saved
+    );
+    for (const line of result.messages) p.log.message(line);
   } catch (err) {
-    process.stderr.write(`
-error: Could not start login session: ${err instanceof Error ? err.message : String(err)}
-`);
-    process.stderr.write(`  Fallback: mushi login --api-key <key> --project-id <uuid>
-`);
-    process.exit(1);
-  }
-  const verifyUrl = deviceData.verification_uri;
-  if (opts.browser !== false) {
-    try {
-      await openInBrowser(verifyUrl);
-    } catch {
-    }
+    p.log.warn(err instanceof Error ? err.message : String(err));
+    p.log.info("You can run manually: mushi connect --write-env --wire-ide --wait");
   }
-  printAuthBanner(deviceData.user_code, verifyUrl);
-  const pollResult = await pollUntilApproved(endpoint, deviceData, {
-    poll: pollDeviceToken
+}
+async function maybeEnableRewards(options) {
+  if (options.yes) return false;
+  const answer = await p.confirm({
+    message: "Enable Mushi Rewards? (users earn points for bug reports + app activity)",
+    initialValue: false
   });
-  if (pollResult.status !== "approved") {
-    if (pollResult.status === "denied") printAuthFailed("denied");
-    else if (pollResult.status === "error") printAuthFailed("error", pollResult.message);
-    else printAuthFailed("timeout");
-    process.exit(1);
+  if (p.isCancel(answer)) return false;
+  return Boolean(answer);
+}
+async function maybeSendTestReport(credentials, options) {
+  if (options.sendTestReport === false) return;
+  let shouldSend;
+  if (options.sendTestReport === true || options.yes) {
+    shouldSend = true;
+  } else {
+    const answer = await p.confirm({
+      message: "Send a test report now to verify the pipeline?",
+      initialValue: true
+    });
+    if (p.isCancel(answer)) return;
+    shouldSend = answer;
   }
-  const cliToken = pollResult.cliToken;
-  printAuthApproved();
-  const projectsList = await listProjects(endpoint, cliToken);
-  let chosenProjectId = projectId;
-  let chosenProjectName;
-  const mintScopes = opts.upgradeScope ? ["report:write", "mcp:read", "mcp:write"] : ["report:write", "mcp:read"];
-  if (!chosenProjectId) {
-    const { createInterface } = await import("readline");
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
-    const ask = (q) => new Promise((resolve3) => rl.question(q, (a) => resolve3(a.trim())));
-    const choice = await resolveProjectChoice(projectsList, ask);
-    rl.close();
-    if (choice.kind === "empty_name") {
-      process.stderr.write("\nerror: Project name is required.\n");
-      process.exit(2);
-    }
-    if (choice.kind === "picked") {
-      chosenProjectId = choice.id;
-      chosenProjectName = choice.name;
-    } else {
-      try {
-        const created = await createProject(endpoint, cliToken, choice.name, { scopes: mintScopes });
-        chosenProjectId = created.id;
-        chosenProjectName = created.name;
-        apiKey = created.apiKey ?? void 0;
-        console.log(`  \u2713 Created project "${chosenProjectName}"`);
-      } catch (err) {
-        process.stderr.write(`
-error: Could not create project: ${err instanceof Error ? err.message : String(err)}
-`);
-        process.exit(1);
-      }
+  if (!shouldSend) return;
+  const endpoint = normalizeEndpoint(resolveCloudEndpoint(options.endpoint));
+  const spinner3 = p.spinner();
+  spinner3.start("Sending test report\u2026");
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TEST_REPORT_FETCH_TIMEOUT_MS);
+  try {
+    const res = await fetch(`${endpoint}/v1/reports`, {
+      method: "POST",
+      signal: controller.signal,
+      headers: {
+        "Content-Type": "application/json",
+        "X-Mushi-Api-Key": credentials.sdkKey,
+        "X-Mushi-Project": credentials.projectId
+      },
+      body: JSON.stringify({
+        projectId: credentials.projectId,
+        description: "Test report from the mushi-mushi setup wizard",
+        category: "other",
+        reporterToken: `wizard-${randomUUID()}`,
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        environment: {
+          url: "cli://wizard",
+          userAgent: `mushi-wizard/${process.platform}-${process.arch}`,
+          platform: process.platform,
+          language: "en",
+          viewport: { width: 0, height: 0 },
+          referrer: "",
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          timezone: Intl.DateTimeFormat().resolvedOptions().timeZone
+        }
+      })
+    });
+    if (!res.ok) {
+      spinner3.stop(`Test report rejected (HTTP ${res.status}).`);
+      p.log.warn(
+        res.status === 401 || res.status === 403 ? "Credentials did not authenticate \u2014 double-check the project ID and API key." : "Skipping test report. You can retry with `mushi test`."
+      );
+      return;
     }
-  }
-  if (!apiKey && chosenProjectId) {
+    spinner3.stop("Test report sent.");
+    let reportId;
     try {
-      apiKey = await mintProjectKey(endpoint, cliToken, chosenProjectId, { scopes: mintScopes }) ?? void 0;
+      const body = await res.json();
+      reportId = body.data?.reportId;
     } catch {
     }
+    const consoleBase = options.consoleBase ?? resolveConsoleUrlSync(options.cwd);
+    p.log.success(`View it at ${reportsUrl(consoleBase, reportId)}`);
+  } catch (err) {
+    const aborted = err instanceof Error && err.name === "AbortError";
+    spinner3.stop(aborted ? "Timed out reaching the Mushi API." : "Could not reach the Mushi API.");
+    p.log.warn(err instanceof Error ? err.message : String(err));
+  } finally {
+    clearTimeout(timer);
   }
-  const config = loadConfig();
-  config.endpoint = endpoint;
-  config.consoleUrl = consoleBase;
-  if (chosenProjectId) config.projectId = chosenProjectId;
-  if (apiKey) config.apiKey = apiKey;
-  saveConfig(config);
-  if (apiKey) {
-    const profile = resolveProfileName(void 0, config.activeProfile);
-    trySaveKeyToKeychain(apiKey, profile);
-  }
-  console.log("");
-  if (chosenProjectName) console.log(`  \u2713 Project: ${chosenProjectName}`);
-  if (apiKey) {
-    if (opts.upgradeScope) {
-      console.log(`  \u2713 Full-scope CLI key saved (${apiKey.slice(0, 12)}\u2026)`);
-      console.log(`    Scopes: report:write \xB7 mcp:read \xB7 mcp:write \u2014 SDK + MCP + admin CLI (incl. writes) all work with this key`);
-    } else {
-      console.log(`  \u2713 CLI key saved (${apiKey.slice(0, 12)}\u2026)`);
-      console.log(`    Scopes: report:write \xB7 mcp:read \u2014 SDK ingest + MCP read tools.`);
-      console.log(`    Admin writes (billing cap, fix merge, pipeline start) need: mushi login --upgrade-scope`);
-    }
-  } else {
-    console.log(`  \u2139  Get an SDK key at: ${apiKeyHint(consoleBase)}`);
+}
+async function printFreshnessHint() {
+  const result = await checkFreshness("mushi-mushi", MUSHI_CLI_VERSION);
+  if (!result || !result.isOutdated) return;
+  p.log.info(
+    `A newer version of mushi-mushi is available: ${result.current} \u2192 ${result.latest}. Run \`npx mushi-mushi@latest\` to get the freshest wizard.`
+  );
+}
+function warnIfWorkspaceRoot(cwd) {
+  let hint;
+  try {
+    hint = detectWorkspaceHint(cwd);
+  } catch {
+    return;
   }
-  console.log("");
-  printPostLoginBanner(opts);
+  if (!hint || hint.apps.length === 0) return;
+  const hasFrameworkAtCwd = hint.apps.some(
+    (app) => isSameDirectory(cwd, resolveWorkspaceAppPath(hint.root, app.relativePath))
+  );
+  if (hasFrameworkAtCwd) return;
+  const apps = hint.apps.slice(0, 5).map((app) => `  \u2022 ${app.relativePath} (${app.framework})`).join("\n");
+  p.log.warn(
+    `You appear to be at a workspace root (source: ${hint.source}). Mushi will install into the current directory, which has no framework dep. You probably meant one of these sub-packages:
+${apps}
+Run \`mushi init --cwd <path>\` \u2014 or re-run the wizard from inside that package.`
+  );
+}
+function resolveWorkspaceAppPath(root, relativePath) {
+  return `${root}/${relativePath}`.replace(/\\/g, "/");
+}
+function isSameDirectory(a, b) {
+  return a.replace(/\\/g, "/").replace(/\/+$/, "") === b.replace(/\\/g, "/").replace(/\/+$/, "");
 }
 
 // src/migrate.ts
@@ -2562,8 +2818,9 @@ Useful after 'mushi login' to confirm credentials are correct.`).action(async (o
     console.log("");
     console.log(`Fixes:   ${d.fixes_count} total \xB7 ${d.fixes_merged} merged`);
     console.log(`Lessons: ${d.lessons_count} active rules`);
+    console.log(await formatActivationLine(config));
   });
-  program2.command("config").description("View or update CLI config (stored in ~/.config/mushi/config.json)").argument("[key]", "Config key to set: apiKey | endpoint | projectId").argument("[value]", "New value").addHelpText("after", `
+  program2.command("config").description(`View or update CLI config (stored in ${CONFIG_PATH})`).argument("[key]", "Config key to set: apiKey | endpoint | projectId").argument("[value]", "New value").addHelpText("after", `
 Keys:
   apiKey     \u2014 Mushi API key (mushi_...)
   endpoint   \u2014 Supabase edge function URL
@@ -2587,11 +2844,33 @@ Examples:
       saveConfig(config);
       console.log(`\u2713 Set ${key}`);
     } else {
-      const safe = { ...config, apiKey: config.apiKey ? `${config.apiKey.slice(0, 10)}\u2026` : void 0 };
+      const safe = {
+        ...config,
+        apiKey: config.apiKey ? `${config.apiKey.slice(0, 10)}\u2026` : void 0,
+        sdkKey: typeof config.sdkKey?.key === "string" ? { ...config.sdkKey, key: `${config.sdkKey.key.slice(0, 10)}\u2026` } : void 0
+      };
       console.log(JSON.stringify(safe, null, 2));
     }
   });
 }
+async function formatActivationLine(config) {
+  const qs = config.projectId ? `?project_id=${encodeURIComponent(config.projectId)}` : "";
+  const result = await apiCall(`/v1/admin/activation${qs}`, config);
+  if (!result.ok) {
+    const code = result.error.code.toUpperCase();
+    const status = result.httpStatus ?? 0;
+    if (status === 401 || status === 403 || /SCOPE|UNAUTHORIZED|FORBIDDEN|TOKEN/.test(code)) {
+      return "Activation: (needs mcp:read \u2014 run `mushi login --upgrade-scope`)";
+    }
+    return `Activation: unavailable (${result.error.code})`;
+  }
+  const d = result.data;
+  const stats = d.stats ?? {};
+  const firstAt = stats.first_report_at ?? stats.firstReportAt ?? null;
+  const reportCount = typeof stats.reportCount === "number" ? stats.reportCount : 0;
+  const firstReport = firstAt ? String(firstAt).slice(0, 10) : reportCount > 0 ? "received" : "none yet";
+  return `Activation: ${d.phase ?? "ingest"} \xB7 first report ${firstReport}`;
+}
 
 // src/commands/deploy.ts
 function registerDeployCommands(program2) {
@@ -3389,7 +3668,8 @@ async function writeProjectBootstrapFiles(opts) {
   const serverBlock = buildMcpServerBlock({
     endpoint: opts.endpoint,
     projectId: opts.projectId,
-    apiKey: opts.apiKey
+    apiKey: opts.apiKey,
+    client: "cursor"
   });
   const { created: mcpCreated } = await writeMcpServerEntry({
     configPath: mcpPath,
@@ -3525,38 +3805,121 @@ error: Could not create project: ${err instanceof Error ? err.message : String(e
 }
 
 // src/commands/setup.ts
+import { join as join4 } from "path";
 function resolveLoginEndpoint(optsEndpoint, existingConfigEndpoint, envEndpoint) {
   return optsEndpoint ?? existingConfigEndpoint ?? envEndpoint?.trim();
 }
+function resolveMcpConfigTarget(ide, cwd, home) {
+  switch (ide) {
+    case "cursor":
+      return { dir: join4(cwd, ".cursor"), path: join4(cwd, ".cursor", "mcp.json"), format: "mcp-json", repoLocal: true };
+    case "claude":
+      return { dir: cwd, path: join4(cwd, ".mcp.json"), format: "mcp-json", repoLocal: true };
+    case "continue":
+      return { dir: join4(cwd, ".continue"), path: join4(cwd, ".continue", "mcp.json"), format: "mcp-json", repoLocal: true };
+    case "zed":
+      return {
+        dir: join4(home, ".config", "zed"),
+        path: join4(home, ".config", "zed", "settings.json"),
+        format: "zed",
+        repoLocal: false
+      };
+  }
+}
+function deriveHostedMcpUrl(endpoint) {
+  return /\/api\/?$/.test(endpoint) ? endpoint.replace(/\/api\/?$/, "/mcp") : null;
+}
+function buildSetupServerBlock(opts) {
+  const stdioBlock = buildMcpServerBlock({
+    endpoint: opts.endpoint,
+    projectId: opts.projectId,
+    apiKey: opts.apiKey,
+    client: opts.ide,
+    inlineKey: opts.inlineKey
+  });
+  const wantsHosted = (opts.ide === "cursor" || opts.ide === "claude") && !opts.stdio && !opts.allProjects;
+  if (!wantsHosted) return { block: stdioBlock, hosted: false };
+  const hostedUrl = deriveHostedMcpUrl(opts.endpoint);
+  if (!hostedUrl) {
+    return {
+      block: stdioBlock,
+      hosted: false,
+      note: "Note: endpoint does not end in /api \u2014 cannot derive the hosted MCP URL; writing a local stdio entry instead."
+    };
+  }
+  return { block: buildHostedMcpServerBlock(hostedUrl), hosted: true };
+}
+function buildZedServerBlock(opts) {
+  const { env } = buildMcpServerBlock({ ...opts, client: "zed" });
+  return {
+    command: { path: "npx", args: ["-y", MUSHI_MCP_PIN_SPEC], env },
+    settings: {}
+  };
+}
+function slugifyProjectName(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 24);
+}
 function registerSetupCommands(program2) {
-  program2.command("setup").description("Wire Cursor MCP into your IDE (reads ~/.config/mushi/config.json \u2014 run `mushi login` first)").option("--ide <ide>", "Target IDE: cursor | claude | continue | zed", "cursor").option("--project-slug <slug>", "Override the project slug in the server name (default: fetched from API or ID prefix)").option("--all-projects", "Write a separate mushi-<name> server entry for every accessible project").option("--with-rules", "Also write the .cursorrules / .claude/rules/mushi.md lesson-library hook").option("--dry-run", "Print what would be written without making changes").option("--verify", "Probe the MCP key after writing to confirm it has mcp:read scope (default: on)").option("--no-verify", "Skip the post-write key probe").option("--endpoint <url>", "Override the Mushi API endpoint (self-hosted) \u2014 used for first-run login if not yet configured").option("--stdio", "Write a local stdio entry with an API key instead of the hosted OAuth URL (cursor/claude default is hosted OAuth \u2014 no key on disk)").option("--ci", "Alias for --stdio: headless environments cannot drive the browser OAuth flow").option("--inline-key", "Write the literal API key into the mcp.json env block (default: write ${MUSHI_API_KEY} placeholder to prevent accidental git leaks)").addHelpText("after", `
+  program2.command("setup").description(`Wire the Mushi MCP server into Cursor, Claude Code, Continue or Zed (reads ${CONFIG_PATH} \u2014 signs you in first if needed)`).option("--ide <ide>", `Target IDE: ${MCP_CLIENTS.join(" | ")}`, "cursor").option("--project-slug <slug>", "Override the project slug in the server name (default: fetched from API or ID prefix)").option("--all-projects", "Write a separate mushi-<name> server entry for every accessible project").option("--with-rules", "Also write the .cursorrules / .claude/rules/mushi.md lesson-library hook").option("--dry-run", "Print what would be written without making changes (never signs in or saves anything)").option("--verify", "Probe the MCP key after writing to confirm it has mcp:read scope (default: on)").option("--no-verify", "Skip the post-write key probe").option("--endpoint <url>", "Override the Mushi API endpoint (self-hosted) \u2014 used for first-run login if not yet configured").option("--stdio", "Write a local stdio entry instead of the hosted OAuth URL (cursor/claude default is hosted OAuth \u2014 no key on disk)").option("--ci", "Alias for --stdio: headless environments cannot drive the browser OAuth flow").option("--inline-key", "Write the literal API key into the stdio env block (default: no key in the file \u2014 the server reads your saved CLI key)").addHelpText("after", `
 Examples:
   mushi setup                         # wire Cursor (default: hosted OAuth \u2014 sign in from the IDE, no key on disk)
-  mushi setup --stdio                 # local stdio entry with an API key (previous behavior)
+  mushi setup --ide claude            # wire Claude Code (.mcp.json at the repo root)
+  mushi setup --stdio                 # local stdio entry that reads your saved CLI key
   mushi setup --ci                    # same as --stdio, for headless/CI environments
   mushi setup --all-projects          # one server entry per accessible project (stdio)
-  mushi setup --ide claude            # wire Claude Code
   mushi setup --ide cursor --with-rules  # also write .cursorrules
+  mushi setup --ide claude --dry-run  # preview the entry; signs nothing in, writes nothing
 
 Supported IDEs:
-  cursor    \u2014 writes .cursor/mcp.json
-  claude    \u2014 writes .claude/mcp.json (Claude Code / Claude Desktop)
-  continue  \u2014 writes .continue/mcp.json (stdio only)
-  zed       \u2014 writes ~/.config/zed/settings.json mcpServers block (stdio only)
+  cursor    \u2014 merges into .cursor/mcp.json
+  claude    \u2014 merges into .mcp.json at the repo root (Claude Code project scope)
+  continue  \u2014 merges into .continue/mcp.json (stdio only)
+  zed       \u2014 merges into ~/.config/zed/settings.json context_servers (stdio only)
 
 For cursor and claude the default entry is the hosted MCP URL: your IDE opens
 the browser consent page on first use (OAuth + PKCE) and stores a revocable
 key for you \u2014 nothing sensitive is written to the repo. Pass --stdio/--ci to
-get the local subprocess entry with an API key instead.
+get the local subprocess entry instead; it reads the key from the CLI config
+unless you pass --inline-key.
 
-The command reads credentials from ~/.config/mushi/config.json. If you are not logged in yet, it runs browser sign-in first, then writes MCP config.`).action(async (opts) => {
+Credentials are read from the CLI config at:
+  ${CONFIG_PATH}
+If you are not signed in yet, setup runs browser sign-in first, then writes the MCP config.`).action(async (opts) => {
     const { writeFile: writeFile3, mkdir, readFile: readFile3 } = await import("fs/promises");
-    const { existsSync: existsSync3 } = await import("fs");
     const nodePath2 = await import("path");
     const os = await import("os");
+    const ide = opts.ide;
+    if (!isMcpClient(ide)) {
+      process.stderr.write(`error: unsupported IDE "${opts.ide}". Supported: ${MCP_CLIENTS.join(", ")}
+`);
+      process.exit(2);
+    }
+    const ideLabel = MCP_CLIENT_LABEL[ide];
+    const cwd = process.cwd();
+    const target = resolveMcpConfigTarget(ide, cwd, os.homedir());
+    const configPath = target.path;
+    const inlineKey = Boolean(opts.inlineKey);
+    const useStdio = Boolean(opts.stdio || opts.ci);
     const existingConfig = loadConfig();
     if (!existingConfig.apiKey) {
       const endpoint = resolveLoginEndpoint(opts.endpoint, existingConfig.endpoint, process.env.MUSHI_API_ENDPOINT);
+      if (opts.dryRun) {
+        const { block } = buildSetupServerBlock({
+          ide,
+          endpoint: resolveCloudEndpoint(endpoint),
+          projectId: "<project-id>",
+          apiKey: "mushi_\u2026",
+          stdio: useStdio,
+          allProjects: Boolean(opts.allProjects),
+          inlineKey
+        });
+        const name = `mushi-${opts.projectSlug ?? "<project>"}`;
+        const preview = target.format === "zed" ? { context_servers: { [name]: buildZedServerBlock({ endpoint: resolveCloudEndpoint(endpoint), projectId: "<project-id>", apiKey: "mushi_\u2026", inlineKey }) } } : { mcpServers: { [name]: block } };
+        console.log("[dry-run] Not signed in \u2014 a real run starts browser sign-in first. Nothing was sent or saved.");
+        console.log(`[dry-run] Would merge into ${configPath}:`);
+        console.log(JSON.stringify(preview, null, 2));
+        return;
+      }
       await runLogin({ endpoint, suppressPostLoginBanner: true });
       console.log("  Continuing MCP setup\u2026");
       console.log("");
@@ -3586,11 +3949,7 @@ The command reads credentials from ~/.config/mushi/config.json. If you are not l
         if (res.ok) {
           const body = await res.json();
           const project = body?.data?.projects?.find((p3) => p3.id === config.projectId);
-          if (project?.name) {
-            slug = project.name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 24);
-          } else {
-            slug = config.projectId?.slice(0, 8) ?? "mushi";
-          }
+          slug = project?.name ? slugifyProjectName(project.name) : config.projectId?.slice(0, 8) ?? "mushi";
         } else {
           slug = config.projectId?.slice(0, 8) ?? "mushi";
         }
@@ -3598,19 +3957,6 @@ The command reads credentials from ~/.config/mushi/config.json. If you are not l
         slug = config.projectId?.slice(0, 8) ?? "mushi";
       }
     }
-    const IDE_CONFIG = {
-      cursor: { dir: ".cursor", file: "mcp.json", format: "mcp-json" },
-      claude: { dir: ".claude", file: "mcp.json", format: "mcp-json" },
-      continue: { dir: ".continue", file: "mcp.json", format: "mcp-json" },
-      zed: { dir: nodePath2.join(os.homedir(), ".config", "zed"), file: "settings.json", format: "zed" }
-    };
-    const ideEntry = IDE_CONFIG[opts.ide];
-    if (!ideEntry) {
-      process.stderr.write(`error: unsupported IDE "${opts.ide}". Supported: ${Object.keys(IDE_CONFIG).join(", ")}
-`);
-      process.exit(2);
-    }
-    const cwd = process.cwd();
     let allProjectsList = null;
     if (opts.allProjects && config.endpoint && config.apiKey) {
       try {
@@ -3629,23 +3975,26 @@ The command reads credentials from ~/.config/mushi/config.json. If you are not l
       }
     }
     const serverName = `mushi-${slug}`;
-    const canDeriveHostedUrl = /\/api\/?$/.test(config.endpoint ?? "");
-    const useHostedOauth = (opts.ide === "cursor" || opts.ide === "claude") && !opts.stdio && !opts.ci && !opts.allProjects && canDeriveHostedUrl;
-    if ((opts.ide === "cursor" || opts.ide === "claude") && !opts.stdio && !opts.ci && !opts.allProjects && !canDeriveHostedUrl) {
-      console.log("Note: endpoint does not end in /api \u2014 cannot derive the hosted MCP URL; writing a local stdio entry instead.");
-    }
-    const hostedMcpUrl = (config.endpoint ?? "").replace(/\/api\/?$/, "/mcp");
-    const hostedServerBlock = { url: hostedMcpUrl };
-    const inlineKey = !!opts.inlineKey;
-    const mcpServerBlock = buildMcpServerBlock({
+    const writeEntry = async (name, serverBlock) => {
+      try {
+        await writeMcpServerEntry({ configPath, serverName: name, serverBlock });
+      } catch (err) {
+        process.stderr.write(`error: ${err instanceof Error ? err.message : String(err)}
+`);
+        process.exit(1);
+      }
+    };
+    const { block: chosenBlock, hosted: useHostedOauth, note: note2 } = buildSetupServerBlock({
+      ide,
       endpoint: config.endpoint,
       projectId: config.projectId ?? "",
       apiKey: config.apiKey,
+      stdio: useStdio,
+      allProjects: Boolean(opts.allProjects),
       inlineKey
     });
-    const configDir = nodePath2.isAbsolute(ideEntry.dir) ? ideEntry.dir : nodePath2.join(cwd, ideEntry.dir);
-    const configPath = nodePath2.join(configDir, ideEntry.file);
-    if (ideEntry.format === "mcp-json") {
+    if (note2) console.log(note2);
+    if (target.format === "mcp-json") {
       if (allProjectsList && allProjectsList.length > 0) {
         for (const p3 of allProjectsList) {
           const pServerName = buildMcpServerName({ projectId: p3.id, projectName: p3.name ?? void 0 });
@@ -3653,66 +4002,72 @@ The command reads credentials from ~/.config/mushi/config.json. If you are not l
             endpoint: config.endpoint,
             projectId: p3.id,
             apiKey: config.apiKey,
+            client: ide,
             inlineKey
           });
           if (!opts.dryRun) {
-            await writeMcpServerEntry({ configPath, serverName: pServerName, serverBlock: pBlock });
+            await writeEntry(pServerName, pBlock);
           }
         }
         if (opts.dryRun) {
           console.log(`[dry-run] Would add ${allProjectsList.length} mushi-* entries to ${configPath}`);
         } else {
           console.log(`\u2713 Added ${allProjectsList.length} mushi-* server entries (${allProjectsList.map((p3) => p3.name ?? p3.id.slice(0, 8)).join(", ")})`);
+          if (!inlineKey) printKeyExportHint(ide);
         }
       } else {
-        const chosenBlock = useHostedOauth ? hostedServerBlock : mcpServerBlock;
         if (opts.dryRun) {
           const preview = JSON.stringify({ mcpServers: { [serverName]: chosenBlock } }, null, 2) + "\n";
-          console.log(`[dry-run] Would write ${configPath}:`);
+          console.log(`[dry-run] Would merge into ${configPath}:`);
           console.log(redactKeyForDisplay(preview));
         } else {
-          await writeMcpServerEntry({ configPath, serverName, serverBlock: chosenBlock });
+          await writeEntry(serverName, chosenBlock);
           console.log(`\u2713 Written ${configPath}`);
           if (useHostedOauth) {
             console.log("  Hosted MCP with OAuth login \u2014 no API key was written to this file.");
-            console.log(`  Restart ${opts.ide === "cursor" ? "Cursor" : "Claude Code"}, open the MCP panel (/mcp in Claude Code), pick "${serverName}" and sign in via the browser.`);
+            console.log(`  Restart ${ideLabel}, open the MCP panel (/mcp in Claude Code), pick "${serverName}" and sign in via the browser.`);
+            if (ide === "claude") {
+              console.log("  Claude Code asks you to approve servers from .mcp.json the first time \u2014 approve this one.");
+            }
             console.log("  Prefer a local key-based entry (headless/CI)? Re-run with --stdio.");
-          } else if (!inlineKey && config.apiKey) {
-            printKeyExportHint(config.apiKey);
+          } else if (!inlineKey) {
+            printKeyExportHint(ide);
           }
         }
       }
-    } else if (ideEntry.format === "zed") {
+    } else {
       let settings = {};
-      if (existsSync3(configPath)) {
+      let raw = null;
+      try {
+        raw = await readFile3(configPath, "utf8");
+      } catch {
+      }
+      if (raw !== null && raw.trim() !== "") {
         try {
-          const raw = await readFile3(configPath, "utf8");
           settings = JSON.parse(raw);
         } catch {
+          process.stderr.write(`error: ${configPath} is not plain JSON \u2014 add the "${serverName}" entry by hand (run with --dry-run to print it).
+`);
+          process.exit(1);
         }
       }
       const servers = settings.context_servers ?? {};
-      servers[serverName] = {
-        command: {
-          path: "npx",
-          args: ["-y", MUSHI_MCP_PIN_SPEC],
-          env: {
-            MUSHI_API_ENDPOINT: config.endpoint,
-            MUSHI_PROJECT_ID: config.projectId ?? "",
-            MUSHI_API_KEY: inlineKey ? config.apiKey : "${MUSHI_API_KEY}"
-          }
-        },
-        settings: {}
-      };
+      servers[serverName] = buildZedServerBlock({
+        endpoint: config.endpoint,
+        projectId: config.projectId ?? "",
+        apiKey: config.apiKey,
+        inlineKey
+      });
       settings.context_servers = servers;
       const output = JSON.stringify(settings, null, 2) + "\n";
       if (opts.dryRun) {
         console.log(`[dry-run] Would write ${configPath}:`);
         console.log(redactKeyForDisplay(output));
       } else {
-        await mkdir(configDir, { recursive: true });
+        await mkdir(target.dir, { recursive: true });
         await writeFile3(configPath, output, "utf8");
         console.log(`\u2713 Written ${configPath}`);
+        if (!inlineKey) printKeyExportHint(ide);
       }
     }
     if (opts.withRules) {
@@ -3740,7 +4095,7 @@ The command reads credentials from ~/.config/mushi/config.json. If you are not l
         "<!-- run `mushi sync-lessons` to refresh -->",
         ""
       ].join("\n");
-      if (opts.ide === "cursor") {
+      if (ide === "cursor") {
         const rulesPath = nodePath2.join(cwd, ".cursorrules");
         if (opts.dryRun) {
           console.log(`[dry-run] Would write ${rulesPath}`);
@@ -3748,7 +4103,7 @@ The command reads credentials from ~/.config/mushi/config.json. If you are not l
           await writeFile3(rulesPath, rulesContent, "utf8");
           console.log(`\u2713 Written .cursorrules`);
         }
-      } else if (opts.ide === "claude") {
+      } else if (ide === "claude") {
         const rulesDir = nodePath2.join(cwd, ".claude", "rules");
         const rulesPath = nodePath2.join(rulesDir, "mushi.md");
         if (opts.dryRun) {
@@ -3775,7 +4130,7 @@ The command reads credentials from ~/.config/mushi/config.json. If you are not l
             }
           );
           if (probeRes.ok) {
-            console.log("\u2713 MCP key valid \u2014 restart Cursor (or your IDE) to activate");
+            console.log(`\u2713 MCP key valid \u2014 restart ${ideLabel} to activate`);
             if (!process.env.MUSHI_NO_TELEMETRY) void fetch(
               `${config.endpoint.replace(/\/$/, "")}/v1/cli/funnel`,
               {
@@ -3811,17 +4166,17 @@ The command reads credentials from ~/.config/mushi/config.json. If you are not l
                 if (answer === "" || answer === "y" || answer === "yes") {
                   await runLogin({ endpoint: opts.endpoint, upgradeScope: true, suppressPostLoginBanner: true });
                   const fresh = loadConfig();
-                  if (fresh.apiKey && ideEntry.format === "mcp-json" && !allProjectsList) {
-                    await writeMcpServerEntry({
-                      configPath,
+                  if (fresh.apiKey && target.format === "mcp-json" && !allProjectsList) {
+                    await writeEntry(
                       serverName,
-                      serverBlock: buildMcpServerBlock({
+                      buildMcpServerBlock({
                         endpoint: fresh.endpoint ?? config.endpoint,
                         projectId: fresh.projectId ?? config.projectId ?? "",
                         apiKey: fresh.apiKey,
+                        client: ide,
                         inlineKey
                       })
-                    });
+                    );
                     console.log(`\u2713 Rewrote ${configPath} with the upgraded key`);
                     const reprobe = await fetch(
                       `${(fresh.endpoint ?? config.endpoint)?.replace(/\/$/, "")}/v1/admin/mcp/account-overview`,
@@ -3835,7 +4190,7 @@ The command reads credentials from ~/.config/mushi/config.json. If you are not l
                     ).catch(() => null);
                     if (reprobe?.ok) {
                       upgraded = true;
-                      console.log("\u2713 MCP key valid \u2014 restart Cursor (or your IDE) to activate");
+                      console.log(`\u2713 MCP key valid \u2014 restart ${ideLabel} to activate`);
                     } else {
                       console.log(`\u26A0  Re-probe after upgrade returned HTTP ${reprobe?.status ?? "error"} \u2014 run \`mushi doctor --mcp\`.`);
                     }
@@ -3860,24 +4215,23 @@ The command reads credentials from ~/.config/mushi/config.json. If you are not l
         }
       }
       console.log("");
-      console.log(`Done! Restart ${opts.ide === "cursor" ? "Cursor" : opts.ide === "claude" ? "Claude Code" : opts.ide} and ask: "list mushi tools"`);
+      console.log(`Done! Restart ${ideLabel} and ask: "list mushi tools"`);
       if (!opts.withRules) {
         console.log(`Tip: run with --with-rules to also write the lesson-library coding hook.`);
       }
-      const configRelPath = nodePath2.isAbsolute(ideEntry.dir) ? configPath : nodePath2.relative(cwd, configPath);
-      if (useHostedOauth) {
+      const configRelPath = target.repoLocal ? nodePath2.relative(cwd, configPath) : configPath;
+      if (!inlineKey) {
         console.log(`
-Note: ${configRelPath} holds no secrets (OAuth login) \u2014 safe to commit and share with your team.`);
-      } else if (!nodePath2.isAbsolute(ideEntry.dir)) {
+Note: ${configRelPath} holds no secrets \u2014 safe to commit and share with your team.`);
+      } else if (target.repoLocal) {
         const gitignorePath = nodePath2.join(cwd, ".gitignore");
         const ignoreLine = configRelPath.replaceAll("\\", "/");
         try {
-          const { readFile: readFile4, writeFile: writeFile4 } = await import("fs/promises");
-          const existing = await readFile4(gitignorePath, "utf8").catch(() => "");
+          const existing = await readFile3(gitignorePath, "utf8").catch(() => "");
           const lines = existing.split(/\r?\n/);
           if (!lines.some((l) => l.trim() === ignoreLine)) {
             const sep = existing.endsWith("\n") || existing === "" ? "" : "\n";
-            await writeFile4(
+            await writeFile3(
               gitignorePath,
               `${existing}${sep}# Mushi MCP config holds a plaintext API key
 ${ignoreLine}
@@ -4333,8 +4687,21 @@ async function planUpgrade(cwd) {
     installCmd: toBump.length > 0 ? installCommand(pm, toBump) : null
   };
 }
+function evaluateUpgradeCheckExit(plan) {
+  if (plan.entries.length === 0) return 1;
+  const semverEntries = plan.entries.filter((e) => /^\d/.test(e.current.replace(/^[\^~>=<]*/, "")));
+  if (semverEntries.length === 0) return 0;
+  if (semverEntries.every((e) => e.latest === null)) return 2;
+  if (plan.entries.some((e) => e.willUpgrade)) return 1;
+  return 0;
+}
 async function runUpgrade(opts = {}) {
   const plan = await planUpgrade(opts.cwd ?? process.cwd());
+  if (opts.check) {
+    const exit = evaluateUpgradeCheckExit(plan);
+    const message = exit === 0 ? "All installed Mushi packages are already at the latest stable version." : exit === 2 ? "Could not reach the npm registry to check for updates \u2014 try again in a moment." : plan.entries.length === 0 ? "No @mushi-mushi/* packages in package.json \u2014 run `mushi init` first." : "One or more Mushi packages are behind the latest stable npm release.";
+    return { plan, upgraded: false, message };
+  }
   if (plan.entries.length === 0) {
     return {
       plan,
@@ -4483,28 +4850,37 @@ ${via}` };
 
 // src/commands/upgrade-cli.ts
 function registerUpgradeCommand(program2) {
-  program2.command("upgrade").description("Bump installed @mushi-mushi/* packages to the latest stable npm release").option("--cwd <path>", "Target repo (default: cwd)").option("--self", "Upgrade the globally-installed `mushi` CLI itself (not the project SDK deps)").option("--dry-run", "Print the install command without running it").option("--json", "Machine-readable plan + result").addHelpText("after", `
+  program2.command("upgrade").description("Bump installed @mushi-mushi/* packages to the latest stable npm release").option("--cwd <path>", "Target repo (default: cwd)").option("--self", "Upgrade the globally-installed `mushi` CLI itself (not the project SDK deps)").option("--dry-run", "Print the install command without running it").option("--check", "Plan only: exit 0 current, 1 outdated, 2 registry unreachable").option("--json", "Machine-readable plan + result").addHelpText("after", `
 Examples:
   mushi upgrade
   mushi upgrade --dry-run
+  mushi upgrade --check         # CI freshness (no install)
   mushi upgrade --self          # upgrade the CLI binary itself
   mushi upgrade --self --dry-run
   mushi upgrade --cwd ../glot.it`).action(async (opts) => {
     if (opts.self) {
-      const selfResult = await runSelfUpgrade({ dryRun: opts.dryRun });
+      const selfResult = await runSelfUpgrade({ dryRun: opts.dryRun || opts.check });
       if (opts.json) {
         console.log(JSON.stringify(selfResult, null, 2));
       } else {
         console.log(selfResult.message);
       }
-      if (!selfResult.upgraded && selfResult.command && !opts.dryRun) {
+      if (!selfResult.upgraded && selfResult.command && !opts.dryRun && !opts.check) {
         process.exit(1);
       }
       return;
     }
-    const result = await runUpgrade({ cwd: opts.cwd, dryRun: opts.dryRun, json: opts.json });
+    const result = await runUpgrade({
+      cwd: opts.cwd,
+      dryRun: opts.dryRun,
+      json: opts.json,
+      check: opts.check
+    });
     if (opts.json) {
-      console.log(JSON.stringify(result, null, 2));
+      console.log(JSON.stringify({
+        ...result,
+        ...opts.check ? { exit: evaluateUpgradeCheckExit(result.plan) } : {}
+      }, null, 2));
     } else {
       console.log(result.message);
       for (const e of result.plan.entries) {
@@ -4512,6 +4888,9 @@ Examples:
         console.log(`  ${e.name}@${e.current} ${tag}`);
       }
     }
+    if (opts.check) {
+      process.exit(evaluateUpgradeCheckExit(result.plan));
+    }
     if (!result.upgraded && result.plan.entries.some((e) => e.willUpgrade) && !opts.dryRun) {
       process.exit(1);
     }
@@ -4521,10 +4900,18 @@ Examples:
 
 // src/commands/connect-cli.ts
 function registerConnectCommand(program2) {
-  program2.command("connect").description("Save credentials, merge env vars, wire Cursor MCP, optionally wait for SDK heartbeat").option("--api-key <key>", "Mushi API key (mushi_\u2026) \u2014 or set MUSHI_API_KEY to keep it out of shell history").requiredOption("--project-id <id>", "Project UUID").requiredOption("--endpoint <url>", "Supabase edge function URL").option("--cwd <path>", "Target repo").option("--write-env", "Force-write SDK env vars to .env.local (default; overrides --no-env)").option("--wire-ide", "Force-wire Cursor MCP into .cursor/mcp.json (default; overrides --no-ide)").option("--no-env", "Skip writing .env.local").option("--no-ide", "Skip writing .cursor/mcp.json").option("--wait", "Poll ingest-setup until SDK heartbeat lands").option("--wait-timeout <sec>", "Max seconds for --wait", "120").option("--json", "Machine-readable output").addHelpText("after", `
+  program2.command("connect").description("Save credentials, merge env vars, wire Cursor MCP, optionally wait for SDK heartbeat").option("--api-key <key>", "Mushi API key (mushi_\u2026) saved to the CLI config \u2014 or set MUSHI_API_KEY to keep it out of shell history").option(
+    "--sdk-key <key>",
+    "Ingest-only (report:write) key for the SDK env vars \u2014 or set MUSHI_SDK_KEY. Default: the key saved for this project, else --api-key if it is ingest-only"
+  ).requiredOption("--project-id <id>", "Project UUID").requiredOption("--endpoint <url>", "Supabase edge function URL").option("--cwd <path>", "Target repo").option("--write-env", "Force-write SDK env vars to .env.local (default; overrides --no-env)").option("--wire-ide", "Force-wire Cursor MCP into .cursor/mcp.json (default; overrides --no-ide)").option("--no-env", "Skip writing .env.local").option("--no-ide", "Skip writing .cursor/mcp.json").option("--wait", "Poll ingest-setup until SDK heartbeat lands").option("--wait-timeout <sec>", "Max seconds for --wait", "120").option("--json", "Machine-readable output").addHelpText("after", `
 Examples:
   MUSHI_API_KEY=mushi_xxx mushi connect --project-id <uuid> --endpoint https://<ref>.supabase.co/functions/v1/api --wait
-  mushi connect --api-key mushi_xxx --project-id <uuid> --endpoint <url> --no-ide`).action(async (opts) => {
+  mushi connect --api-key mushi_xxx --project-id <uuid> --endpoint <url> --no-ide
+  MUSHI_API_KEY=mushi_cli MUSHI_SDK_KEY=mushi_ingest mushi connect --project-id <uuid> --endpoint <url>
+
+SDK env vars (VITE_ / NEXT_PUBLIC_ / EXPO_PUBLIC_ \u2026) ship inside your app bundle,
+so connect only writes a key the backend confirms is ingest-only (report:write).
+A key that can read reports is refused for .env.local; it still works for the CLI and MCP.`).action(async (opts) => {
     const apiKey = process.env.MUSHI_API_KEY ?? opts.apiKey;
     if (!apiKey) {
       console.error("Provide the API key via the MUSHI_API_KEY env var (recommended) or --api-key <key>.");
@@ -4532,6 +4919,7 @@ Examples:
     }
     const result = await runConnect({
       apiKey,
+      sdkKey: process.env.MUSHI_SDK_KEY?.trim() || opts.sdkKey,
       projectId: opts.projectId,
       endpoint: opts.endpoint,
       cwd: opts.cwd,
@@ -4540,7 +4928,7 @@ Examples:
       wait: opts.wait,
       waitTimeoutSec: parseInt(opts.waitTimeout, 10) || 120,
       json: opts.json
-    });
+    }, loadConfig());
     if (opts.json) {
       console.log(JSON.stringify(result, null, 2));
     } else {
@@ -6212,7 +6600,7 @@ function registerSelfhostCommands(program2) {
     "Base URL of your deployed admin console (e.g. https://your-domain.example.com/admin)"
   ).option(
     "--endpoint <url>",
-    "Mushi API endpoint to use for the proof step (default: from ~/.config/mushi/config.json)"
+    `Mushi API endpoint to use for the proof step (default: from ${CONFIG_PATH})`
   ).option(
     "--skip-deploy",
     "Skip function deploys (run db push + secrets only)"
@@ -6241,7 +6629,7 @@ After "up" completes:
     "Check the health of a self-hosted deployment (calls GET /v1/admin/doctor)"
   ).option(
     "--endpoint <url>",
-    "Mushi API endpoint (default: from ~/.config/mushi/config.json)"
+    `Mushi API endpoint (default: from ${CONFIG_PATH})`
   ).option("--json", "Machine-readable JSON output").addHelpText(
     "after",
     `