@mushi-mushi/cli 0.30.2 → 0.30.4

package/dist/{chunk-AHDD44WU.js → chunk-26JWYLCK.js}

@@ -2,17 +2,17 @@
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-X67SYMCO.js";
+} from "./chunk-F7TLL2FB.js";
+import {
+  CLOUD_API_ENDPOINT,
+  assertEndpoint,
+  normalizeEndpoint
+} from "./chunk-LGGE3LH7.js";
 import {
   detectFramework,
   envVarsToWrite,
   readPackageJson
 } from "./chunk-KOBEOGNF.js";
-import {
-  CLOUD_API_ENDPOINT,
-  assertEndpoint,
-  normalizeEndpoint
-} from "./chunk-LDPFTQLE.js";
 import {
   __require
 } from "./chunk-PDX44BCA.js";
@@ -122,11 +122,13 @@ function loadConfig(path = CONFIG_PATH, opts = {}) {
   if (keychainKey) {
     file = { ...file, apiKey: keychainKey };
   }
-  const endpointFromEnv = process.env["MUSHI_API_ENDPOINT"] ?? process.env["MUSHI_ENDPOINT"] ?? void 0;
+  const endpointFromEnv = process.env["MUSHI_API_ENDPOINT"]?.trim() || process.env["MUSHI_ENDPOINT"]?.trim() || void 0;
   const fromEnv = {
     ...process.env["MUSHI_API_KEY"] ? { apiKey: process.env["MUSHI_API_KEY"] } : {},
     ...process.env["MUSHI_PROJECT_ID"] ? { projectId: process.env["MUSHI_PROJECT_ID"] } : {},
-    ...endpointFromEnv ? { endpoint: endpointFromEnv } : {},
+    // Saved endpoints are normalized by assertEndpoint; the env value isn't,
+    // so strip trailing slashes here (no `.../api//v1/...` in any caller).
+    ...endpointFromEnv ? { endpoint: normalizeEndpoint(endpointFromEnv) } : {},
     ...process.env["MUSHI_CONSOLE_URL"] ? { consoleUrl: process.env["MUSHI_CONSOLE_URL"].trim() } : {}
   };
   return { ...file, ...fromEnv };
@@ -564,7 +566,7 @@ function normalizeApiError(error, httpStatus) {
 }
 async function apiCall(path, config, options = {}, callOptions = {}) {
   const timeoutMs = callOptions.timeoutMs ?? API_TIMEOUT_MS;
-  const endpoint = config.endpoint;
+  const endpoint = config.endpoint ? normalizeEndpoint(config.endpoint) : config.endpoint;
   if (!endpoint) {
     return {
       ok: false,
@@ -878,8 +880,8 @@ var MCP_CLIENT_LABEL = {
   continue: "Continue",
   zed: "Zed"
 };
-function buildHostedMcpServerBlock(url) {
-  return { type: "http", url };
+function buildHostedMcpServerBlock(url, oauth) {
+  return oauth ? { type: "http", url, oauth } : { type: "http", url };
 }
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);

package/dist/{chunk-SXSI2W6Z.js → chunk-2DMHQVRU.js}

@@ -2,6 +2,14 @@
 var TEST_REPORT_TIMEOUT_MS = 1e4;
 var TEST_REPORT_FETCH_TIMEOUT_MS = TEST_REPORT_TIMEOUT_MS;
 var CLOUD_API_ENDPOINT = "https://dxptnwrhwsqckaftyymj.supabase.co/functions/v1/api";
+var CLOUD_MCP_OAUTH_URL = "https://kensaur.us/mushi-mushi/hosted-mcp/";
+function firstEndpoint(...candidates) {
+  for (const c of candidates) {
+    const v = c?.trim();
+    if (v) return v;
+  }
+  return void 0;
+}
 function resolveCloudEndpoint(explicit) {
   if (explicit?.trim()) return explicit.trim();
   const fromEnv = process.env.MUSHI_API_ENDPOINT?.trim();
@@ -36,6 +44,8 @@ function normalizeEndpoint(url) {
 export {
   TEST_REPORT_FETCH_TIMEOUT_MS,
   CLOUD_API_ENDPOINT,
+  CLOUD_MCP_OAUTH_URL,
+  firstEndpoint,
   resolveCloudEndpoint,
   assertEndpoint,
   normalizeEndpoint

package/dist/chunk-F7TLL2FB.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+
+// src/version.ts
+var MUSHI_CLI_VERSION = true ? "0.30.4" : "0.0.0-dev";
+var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.25.0";
+
+export {
+  MUSHI_CLI_VERSION,
+  MUSHI_MCP_PIN_SPEC
+};

package/dist/{chunk-LDPFTQLE.js → chunk-LGGE3LH7.js}

@@ -4,6 +4,14 @@
 var TEST_REPORT_TIMEOUT_MS = 1e4;
 var TEST_REPORT_FETCH_TIMEOUT_MS = TEST_REPORT_TIMEOUT_MS;
 var CLOUD_API_ENDPOINT = "https://dxptnwrhwsqckaftyymj.supabase.co/functions/v1/api";
+var CLOUD_MCP_OAUTH_URL = "https://kensaur.us/mushi-mushi/hosted-mcp/";
+function firstEndpoint(...candidates) {
+  for (const c of candidates) {
+    const v = c?.trim();
+    if (v) return v;
+  }
+  return void 0;
+}
 function resolveCloudEndpoint(explicit) {
   if (explicit?.trim()) return explicit.trim();
   const fromEnv = process.env.MUSHI_API_ENDPOINT?.trim();
@@ -38,6 +46,8 @@ function normalizeEndpoint(url) {
 export {
   TEST_REPORT_FETCH_TIMEOUT_MS,
   CLOUD_API_ENDPOINT,
+  CLOUD_MCP_OAUTH_URL,
+  firstEndpoint,
   resolveCloudEndpoint,
   assertEndpoint,
   normalizeEndpoint

package/dist/chunk-ODY6NZY2.js

@@ -0,0 +1,8 @@
+// src/version.ts
+var MUSHI_CLI_VERSION = true ? "0.30.4" : "0.0.0-dev";
+var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.25.0";
+
+export {
+  MUSHI_CLI_VERSION,
+  MUSHI_MCP_PIN_SPEC
+};

package/dist/{chunk-AJ6TRLJX.js → chunk-SV6HHYWE.js}

@@ -1,10 +1,10 @@
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-P7JI5H57.js";
+} from "./chunk-ODY6NZY2.js";
 import {
   assertEndpoint,
   normalizeEndpoint
-} from "./chunk-SXSI2W6Z.js";
+} from "./chunk-2DMHQVRU.js";
 import {
   __require
 } from "./chunk-3RG5ZIWI.js";
@@ -108,11 +108,13 @@ function loadConfig(path = CONFIG_PATH, opts = {}) {
   if (keychainKey) {
     file = { ...file, apiKey: keychainKey };
   }
-  const endpointFromEnv = process.env["MUSHI_API_ENDPOINT"] ?? process.env["MUSHI_ENDPOINT"] ?? void 0;
+  const endpointFromEnv = process.env["MUSHI_API_ENDPOINT"]?.trim() || process.env["MUSHI_ENDPOINT"]?.trim() || void 0;
   const fromEnv = {
     ...process.env["MUSHI_API_KEY"] ? { apiKey: process.env["MUSHI_API_KEY"] } : {},
     ...process.env["MUSHI_PROJECT_ID"] ? { projectId: process.env["MUSHI_PROJECT_ID"] } : {},
-    ...endpointFromEnv ? { endpoint: endpointFromEnv } : {},
+    // Saved endpoints are normalized by assertEndpoint; the env value isn't,
+    // so strip trailing slashes here (no `.../api//v1/...` in any caller).
+    ...endpointFromEnv ? { endpoint: normalizeEndpoint(endpointFromEnv) } : {},
     ...process.env["MUSHI_CONSOLE_URL"] ? { consoleUrl: process.env["MUSHI_CONSOLE_URL"].trim() } : {}
   };
   return { ...file, ...fromEnv };
@@ -495,7 +497,7 @@ function normalizeApiError(error, httpStatus) {
 }
 async function apiCall(path, config, options = {}, callOptions = {}) {
   const timeoutMs = callOptions.timeoutMs ?? API_TIMEOUT_MS;
-  const endpoint = config.endpoint;
+  const endpoint = config.endpoint ? normalizeEndpoint(config.endpoint) : config.endpoint;
   if (!endpoint) {
     return {
       ok: false,

package/dist/{connect-MJFNVD6I.js → connect-XPSH7MK3.js}

@@ -2,10 +2,10 @@
 import {
   resolveSdkEnvKey,
   runConnect
-} from "./chunk-AHDD44WU.js";
-import "./chunk-X67SYMCO.js";
+} from "./chunk-26JWYLCK.js";
+import "./chunk-F7TLL2FB.js";
+import "./chunk-LGGE3LH7.js";
 import "./chunk-KOBEOGNF.js";
-import "./chunk-LDPFTQLE.js";
 import "./chunk-PDX44BCA.js";
 export {
   resolveSdkEnvKey,

package/dist/{connect-4TSPUKYX.js → connect-YDQ65VJY.js}

@@ -6,10 +6,10 @@ import {
   saveConfig,
   savedSdkKeyFor,
   waitForIngestReady
-} from "./chunk-AJ6TRLJX.js";
+} from "./chunk-SV6HHYWE.js";
 import {
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-P7JI5H57.js";
+} from "./chunk-ODY6NZY2.js";
 import {
   detectFramework,
   envVarsToWrite,
@@ -17,7 +17,7 @@ import {
 } from "./chunk-AIZRI665.js";
 import {
   assertEndpoint
-} from "./chunk-SXSI2W6Z.js";
+} from "./chunk-2DMHQVRU.js";
 import "./chunk-3RG5ZIWI.js";
 
 // src/connect.ts

package/dist/{endpoint-NHECZL47.js → endpoint-GXIRH2BW.js}

@@ -1,15 +1,19 @@
 import {
   CLOUD_API_ENDPOINT,
+  CLOUD_MCP_OAUTH_URL,
   TEST_REPORT_FETCH_TIMEOUT_MS,
   assertEndpoint,
+  firstEndpoint,
   normalizeEndpoint,
   resolveCloudEndpoint
-} from "./chunk-SXSI2W6Z.js";
+} from "./chunk-2DMHQVRU.js";
 import "./chunk-3RG5ZIWI.js";
 export {
   CLOUD_API_ENDPOINT,
+  CLOUD_MCP_OAUTH_URL,
   TEST_REPORT_FETCH_TIMEOUT_MS,
   assertEndpoint,
+  firstEndpoint,
   normalizeEndpoint,
   resolveCloudEndpoint
 };

package/dist/{endpoint-TEBF4IH6.js → endpoint-KI5FMW2S.js}

@@ -1,16 +1,20 @@
 #!/usr/bin/env node
 import {
   CLOUD_API_ENDPOINT,
+  CLOUD_MCP_OAUTH_URL,
   TEST_REPORT_FETCH_TIMEOUT_MS,
   assertEndpoint,
+  firstEndpoint,
   normalizeEndpoint,
   resolveCloudEndpoint
-} from "./chunk-LDPFTQLE.js";
+} from "./chunk-LGGE3LH7.js";
 import "./chunk-PDX44BCA.js";
 export {
   CLOUD_API_ENDPOINT,
+  CLOUD_MCP_OAUTH_URL,
   TEST_REPORT_FETCH_TIMEOUT_MS,
   assertEndpoint,
+  firstEndpoint,
   normalizeEndpoint,
   resolveCloudEndpoint
 };

package/dist/index.js

@@ -53,11 +53,20 @@ import {
   setGlobalOutputFormat,
   trySaveKeyToKeychain,
   writeMcpServerEntry
-} from "./chunk-AHDD44WU.js";
+} from "./chunk-26JWYLCK.js";
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-X67SYMCO.js";
+} from "./chunk-F7TLL2FB.js";
+import {
+  CLOUD_API_ENDPOINT,
+  CLOUD_MCP_OAUTH_URL,
+  TEST_REPORT_FETCH_TIMEOUT_MS,
+  assertEndpoint,
+  firstEndpoint,
+  normalizeEndpoint,
+  resolveCloudEndpoint
+} from "./chunk-LGGE3LH7.js";
 import {
   FRAMEWORKS,
   detectFramework,
@@ -66,13 +75,6 @@ import {
   installCommand,
   readPackageJson
 } from "./chunk-KOBEOGNF.js";
-import {
-  CLOUD_API_ENDPOINT,
-  TEST_REPORT_FETCH_TIMEOUT_MS,
-  assertEndpoint,
-  normalizeEndpoint,
-  resolveCloudEndpoint
-} from "./chunk-LDPFTQLE.js";
 import "./chunk-PDX44BCA.js";
 
 // src/index.ts
@@ -225,15 +227,15 @@ var DeviceAuthRequestError = class extends Error {
     this.retryable = status === void 0 || status >= 500 || status === 408;
   }
 };
-async function withOneRetry(run2) {
+async function withOneRetry(run) {
   try {
-    return await run2();
+    return await run();
   } catch (err) {
     if (err instanceof DeviceAuthRequestError && err.retryable) {
       if (deviceAuthRetryDelayMs > 0) {
         await defaultSleep(deviceAuthRetryDelayMs);
       }
-      return run2();
+      return run();
     }
     throw err;
   }
@@ -465,7 +467,7 @@ function chooseProjectNonInteractive(projects, preferredName) {
   return match ? { kind: "existing", id: match.id, name: match.name } : { kind: "new", name: preferredName };
 }
 async function runLogin(opts = {}) {
-  const { CLOUD_API_ENDPOINT: CLOUD_API_ENDPOINT2, resolveCloudEndpoint: resolveCloudEndpoint2 } = await import("./endpoint-TEBF4IH6.js");
+  const { CLOUD_API_ENDPOINT: CLOUD_API_ENDPOINT2, resolveCloudEndpoint: resolveCloudEndpoint2 } = await import("./endpoint-KI5FMW2S.js");
   const endpoint = opts.endpoint ? resolveCloudEndpoint2(opts.endpoint) : CLOUD_API_ENDPOINT2;
   const consoleBase = await resolveConsoleUrl();
   let apiKey = opts.apiKey;
@@ -1185,7 +1187,7 @@ var HASH_ROUTER_PATTERNS = [
   /location\.hash\b/,
   /addEventListener\(['"]hashchange['"]/
 ];
-var HASH_TEMPLATE_PATTERN = /['"`]#\//;
+var HASH_TEMPLATE_PATTERN = /['"`]\/?#\//;
 async function scanDirForPattern(dir, patterns, maxDepth = 6, maxFiles = 2e3) {
   const { readdir: readdir2, readFile: readFile3 } = await import("fs/promises");
   const { join: join11 } = await import("path");
@@ -1294,6 +1296,19 @@ async function collectMcpSources(root, home) {
   }
   return { sources, invalid };
 }
+function claudeOAuthCannotDiscover(entry, url) {
+  let host;
+  try {
+    host = new URL(url).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  if (!host.endsWith(".supabase.co")) return false;
+  const headers = isJsonObject(entry.headers) ? Object.keys(entry.headers).map((h) => h.toLowerCase()) : [];
+  if (headers.includes("authorization") || headers.includes("x-mushi-api-key")) return false;
+  const oauth = isJsonObject(entry.oauth) ? entry.oauth : {};
+  return typeof oauth.authServerMetadataUrl !== "string" || oauth.authServerMetadataUrl.length === 0;
+}
 function assessMushiEntry(source, name, entry, cliKeySaved) {
   const label = `${name} (${source.path})`;
   if (!isJsonObject(entry)) return { usable: false, stdio: false, detail: `${label}: not an object` };
@@ -1305,6 +1320,13 @@ function assessMushiEntry(source, name, entry, cliKeySaved) {
         detail: `${label}: has a url but no "type": "http" \u2014 Claude Code skips it`
       };
     }
+    if (source.claudeCode && claudeOAuthCannotDiscover(entry, entry.url)) {
+      return {
+        usable: false,
+        stdio: false,
+        detail: `${label}: Claude Code sign-in cannot find OAuth metadata on a supabase.co URL ("Dynamic Client Registration rejected (HTTP 404)") \u2014 use ${CLOUD_MCP_OAUTH_URL} for Mushi Cloud, or add "oauth": { "authServerMetadataUrl": "<url>/.well-known/oauth-authorization-server" }`
+      };
+    }
     return { usable: true, stdio: false, detail: `${label}: hosted OAuth \u2014 sign in from the IDE's MCP panel` };
   }
   const env = isJsonObject(entry.env) ? entry.env : {};
@@ -1524,7 +1546,7 @@ async function checkOnboardingStatus(config, _consoleBase, cwd, doFetch = global
 }
 async function checkVersionDrift(cwd, doFetch) {
   const checks = [];
-  const { MUSHI_CLI_VERSION: MUSHI_CLI_VERSION2 } = await import("./version-5BNKTJFR.js");
+  const { MUSHI_CLI_VERSION: MUSHI_CLI_VERSION2 } = await import("./version-35BA3FDB.js");
   if (MUSHI_CLI_VERSION2 === "0.0.0-dev") return checks;
   const parse2 = (v) => {
     const m = v.replace(/^[~^]/, "").match(/^(\d+)\.(\d+)\.(\d+)/);
@@ -1769,7 +1791,7 @@ async function runInit(options = {}) {
   const framework = await chooseFramework(detected, options);
   const consoleBase = await resolveConsoleUrl({ cwd });
   const endpoint = resolveCloudEndpoint(
-    options.endpoint ?? process.env.MUSHI_API_ENDPOINT?.trim() ?? loadConfig().endpoint
+    firstEndpoint(options.endpoint, process.env.MUSHI_API_ENDPOINT, loadConfig().endpoint)
   );
   options = { ...options, endpoint };
   const credentials = await acquireCredentials(options, consoleBase, endpoint);
@@ -2448,7 +2470,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect: runConnect2 } = await import("./connect-MJFNVD6I.js");
+    const { runConnect: runConnect2 } = await import("./connect-XPSH7MK3.js");
     const saved = loadConfig();
     const result = await runConnect2(
       {
@@ -3673,7 +3695,8 @@ async function writeProjectBootstrapFiles(opts) {
   try {
     existing = await readFile2(envPath, "utf8");
     envUpdated = true;
-  } catch {
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
   }
   const MUSHI_LINE_RE = /^(NEXT_PUBLIC_|NUXT_PUBLIC_|VITE_|EXPO_PUBLIC_)?MUSHI_[A-Z_]+=.*/gm;
   const MUSHI_COMMENT_RE = /^# Mushi MCP\b.*/gm;
@@ -3715,7 +3738,7 @@ Typical first-time flow:
   # mushi whoami to confirm`).action(async (opts) => {
     const savedConfig = loadConfig();
     const endpoint = resolveCloudEndpoint(
-      opts.endpoint ?? process.env.MUSHI_API_ENDPOINT?.trim() ?? savedConfig.endpoint
+      firstEndpoint(opts.endpoint, process.env.MUSHI_API_ENDPOINT, savedConfig.endpoint)
     );
     const consoleBase = await resolveConsoleUrl();
     console.log("");
@@ -3867,7 +3890,14 @@ function buildSetupServerBlock(opts) {
       note: "Note: endpoint does not end in /api \u2014 cannot derive the hosted MCP URL; writing a local stdio entry instead."
     };
   }
-  return { block: buildHostedMcpServerBlock(hostedUrl), hosted: true };
+  return { block: hostedOAuthBlock(opts.ide, opts.endpoint, hostedUrl), hosted: true };
+}
+function hostedOAuthBlock(ide, endpoint, hostedUrl) {
+  if (endpoint.replace(/\/+$/, "") === CLOUD_API_ENDPOINT) return buildHostedMcpServerBlock(CLOUD_MCP_OAUTH_URL);
+  if (ide !== "claude") return buildHostedMcpServerBlock(hostedUrl);
+  return buildHostedMcpServerBlock(hostedUrl, {
+    authServerMetadataUrl: `${hostedUrl}/.well-known/oauth-authorization-server`
+  });
 }
 function buildZedServerBlock(opts) {
   const { env } = buildMcpServerBlock({ ...opts, client: "zed" });
@@ -4681,17 +4711,17 @@ function registerNudgeCommand(program2) {
     }
     const phase = opts.phase;
     const overrides = {};
-    const parseNumericFlag = (flag, raw, min) => {
+    const parseNumericFlag = (flag, raw, min, integer = false) => {
       const n = Number(raw);
-      if (!Number.isFinite(n) || n < min) {
+      if (!Number.isFinite(n) || n < min || integer && !Number.isInteger(n)) {
         console.error(
-          `error: --${flag} must be a finite number >= ${min} (got "${raw}")`
+          `error: --${flag} must be a finite ${integer ? "integer" : "number"} >= ${min} (got "${raw}")`
         );
         process.exit(1);
       }
       return n;
     };
-    if (opts.max !== void 0) overrides.maxProactivePerSession = parseNumericFlag("max", opts.max, 1);
+    if (opts.max !== void 0) overrides.maxProactivePerSession = parseNumericFlag("max", opts.max, 1, true);
     if (opts.cooldown !== void 0) overrides.dismissCooldownHours = parseNumericFlag("cooldown", opts.cooldown, 0);
     if (opts.dwell !== void 0) overrides.pageDwellMinutes = parseNumericFlag("dwell", opts.dwell, 0);
     if (opts.welcome !== void 0) overrides.firstSessionSeconds = parseNumericFlag("welcome", opts.welcome, 0);
@@ -5169,18 +5199,18 @@ function registerTddCommands(program2) {
           config
         );
         if (!runsRes.ok) break;
-        const run2 = runsRes.data.runs.find((r) => r.id === res.data.runId);
-        if (!run2) break;
-        if (run2.status === "completed") {
+        const run = runsRes.data.runs.find((r) => r.id === res.data.runId);
+        if (!run) break;
+        if (run.status === "completed") {
           console.log(`
-\u2713 Done! ${run2.pages_crawled ?? 0} pages crawled.`);
-          if (run2.proposal_id) console.log(`  Proposal id: ${run2.proposal_id}`);
+\u2713 Done! ${run.pages_crawled ?? 0} pages crawled.`);
+          if (run.proposal_id) console.log(`  Proposal id: ${run.proposal_id}`);
           console.log(`  Review in the console: Inventory \u2192 Discovery \u2192 Past proposals`);
           break;
         }
-        if (run2.status === "failed") {
+        if (run.status === "failed") {
           console.error(`
-\u2717 Crawl failed: ${run2.error_message ?? "unknown"}`);
+\u2717 Crawl failed: ${run.error_message ?? "unknown"}`);
           process.exit(1);
         }
         process.stdout.write(".");
@@ -5940,9 +5970,9 @@ Examples:
     }
     if (data.gate_runs.length > 0) {
       console.log("\nGate Results:");
-      for (const run2 of data.gate_runs) {
-        const g = run2.status === "pass" ? "OK" : run2.status === "fail" ? "FAIL" : "SKIP";
-        console.log(`  ${g} ${run2.gate.padEnd(22)} ${run2.status}  (${run2.findings_count} finding${run2.findings_count !== 1 ? "s" : ""})`);
+      for (const run of data.gate_runs) {
+        const g = run.status === "pass" ? "OK" : run.status === "fail" ? "FAIL" : "SKIP";
+        console.log(`  ${g} ${run.gate.padEnd(22)} ${run.status}  (${run.findings_count} finding${run.findings_count !== 1 ? "s" : ""})`);
       }
     }
     const refresh = data.gate_refresh;
@@ -6225,25 +6255,25 @@ Pipeline started!
       console.log(JSON.stringify(result.data, null, 2));
       return;
     }
-    const run2 = result.data;
-    const statusIcon = run2.status === "completed" ? "\u2705" : run2.status === "failed" ? "\u274C" : run2.status === "running" ? "\u23F3" : "\u26AA";
+    const run = result.data;
+    const statusIcon = run.status === "completed" ? "\u2705" : run.status === "failed" ? "\u274C" : run.status === "running" ? "\u23F3" : "\u26AA";
     console.log(`
-${statusIcon}  Pipeline ${runId.slice(0, 8)} \xB7 ${run2.root_skill_slug} \xB7 ${run2.mode}
+${statusIcon}  Pipeline ${runId.slice(0, 8)} \xB7 ${run.root_skill_slug} \xB7 ${run.mode}
 `);
-    const steps = run2.steps ?? [];
+    const steps = run.steps ?? [];
     for (const step of steps) {
       const icon = step.status === "passed" ? "\u2705" : step.status === "failed" ? "\u274C" : step.status === "running" ? "\u23F3" : "\u26AA";
       const pr = step.pr_url ? ` \u2192 ${step.pr_url}` : "";
       console.log(`  ${icon} Step ${step.step_index + 1}: ${step.skill_slug}${pr}`);
       if (step.notes) console.log(`        ${step.notes}`);
     }
-    if (run2.context_packet) {
+    if (run.context_packet) {
       console.log(`
 ${"\u2500".repeat(60)}`);
       console.log(`Context Packet (paste into your Cursor agent):
 `);
-      console.log(run2.context_packet.slice(0, 6e3));
-      if (run2.context_packet.length > 6e3) console.log("\n\u2026 [truncated \u2014 full packet via --json]");
+      console.log(run.context_packet.slice(0, 6e3));
+      if (run.context_packet.length > 6e3) console.log("\n\u2026 [truncated \u2014 full packet via --json]");
     }
     console.log();
   });
@@ -6505,7 +6535,7 @@ Examples:
 }
 
 // src/commands/selfhost.ts
-import { execSync as execSync3, spawnSync } from "child_process";
+import { spawnSync } from "child_process";
 import { randomBytes } from "crypto";
 function hasSupabaseCli() {
   try {
@@ -6515,28 +6545,28 @@ function hasSupabaseCli() {
     return false;
   }
 }
-function run(cmd, opts) {
-  if (opts.printOnly) {
-    console.log(`  $ ${cmd}`);
-    return { ok: true, stdout: "", stderr: "" };
-  }
-  const label = opts.label ?? cmd.slice(0, 60);
-  process.stdout.write(`  \u203A ${label} \u2026 `);
-  try {
-    const out = execSync3(cmd, {
-      cwd: opts.cwd,
-      encoding: "utf8",
-      timeout: 3e5,
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    process.stdout.write("\u2713\n");
-    return { ok: true, stdout: out, stderr: "" };
-  } catch (err) {
+function selfhostStepCommand(step) {
+  return `supabase ${step.args.join(" ")}${step.mayFail ? " || true" : ""}`;
+}
+function runSupabase(args, opts) {
+  process.stdout.write(`  \u203A ${opts.label} \u2026 `);
+  const r = spawnSync("supabase", args, {
+    cwd: opts.cwd,
+    encoding: "utf8",
+    timeout: 3e5,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (r.error || r.status !== 0) {
     process.stdout.write("\u2717\n");
-    const msg = (err instanceof Error ? err.message : String(err)).trim();
-    const stderr = err.stderr ?? "";
-    return { ok: false, stdout: "", stderr: stderr || msg };
+    const stderr = (r.stderr ?? "").trim();
+    return {
+      ok: false,
+      stdout: r.stdout ?? "",
+      stderr: stderr || r.error?.message || `exited with ${r.status ?? r.signal}`
+    };
   }
+  process.stdout.write("\u2713\n");
+  return { ok: true, stdout: r.stdout, stderr: "" };
 }
 var REQUIRED_FUNCTIONS = [
   "api",
@@ -6546,55 +6576,43 @@ var REQUIRED_FUNCTIONS = [
   "fix-worker",
   "webhooks-github-indexer"
 ];
-async function runSelfhostUp(opts) {
-  const supabaseDir = opts.cwd ? `${opts.cwd}/packages/server/supabase` : "packages/server/supabase";
-  const printOnly = !!(opts.printCommands || !hasSupabaseCli());
-  if (printOnly) {
-    console.log("");
-    console.log("supabase CLI not found (or --print-commands was passed).");
-    console.log("Run the following commands manually:\n");
-  } else {
-    console.log("");
-    console.log("mushi selfhost up \u2014 deploying self-hosted Mushi Mushi\n");
-  }
+function buildSelfhostSteps(opts, printOnly, internalToken) {
   const steps = [];
   if (opts.projectRef && !/^[a-z0-9-]+$/i.test(opts.projectRef)) {
-    process.stderr.write(`\u2717 --project-ref must be alphanumeric (got: ${opts.projectRef}).
-`);
-    process.exit(1);
+    return { ok: false, error: `--project-ref must be alphanumeric (got: ${opts.projectRef}).` };
   }
   if (opts.projectRef) {
     steps.push({
       label: `link to Supabase project ${opts.projectRef}`,
-      cmd: `supabase link --project-ref ${opts.projectRef}`,
+      args: ["link", "--project-ref", opts.projectRef],
       critical: true
     });
   }
   steps.push({
     label: "apply database migrations",
-    cmd: "supabase db push",
+    args: ["db", "push"],
     critical: true
   });
   if (opts.anthropicKey && printOnly) {
     steps.push({
       label: "set ANTHROPIC_API_KEY secret",
-      cmd: "supabase secrets set ANTHROPIC_API_KEY=sk-ant-..."
+      args: ["secrets", "set", "ANTHROPIC_API_KEY=sk-ant-..."]
     });
   } else if (opts.anthropicKey) {
     if (!/^[A-Za-z0-9_-]+$/.test(opts.anthropicKey)) {
-      process.stderr.write(
-        "\u2717 --anthropic-key contains characters that cannot be passed through the shell safely.\n  Set it manually instead: supabase secrets set ANTHROPIC_API_KEY=<your key>\n"
-      );
-      process.exit(1);
+      return {
+        ok: false,
+        error: "--anthropic-key does not look like an API key (letters, digits, - and _ only).\n  Set it manually instead: supabase secrets set ANTHROPIC_API_KEY=<your key>"
+      };
     }
     steps.push({
       label: "set ANTHROPIC_API_KEY secret",
-      cmd: `supabase secrets set ANTHROPIC_API_KEY=${opts.anthropicKey}`
+      args: ["secrets", "set", `ANTHROPIC_API_KEY=${opts.anthropicKey}`]
     });
   } else if (printOnly) {
     steps.push({
       label: "set ANTHROPIC_API_KEY secret",
-      cmd: "supabase secrets set ANTHROPIC_API_KEY=sk-ant-..."
+      args: ["secrets", "set", "ANTHROPIC_API_KEY=sk-ant-..."]
     });
   }
   if (opts.adminBaseUrl) {
@@ -6606,43 +6624,65 @@ async function runSelfhostUp(opts) {
       adminUrlOk = false;
     }
     if (!adminUrlOk) {
-      process.stderr.write(
-        `\u2717 --admin-base-url must be a plain http(s) URL (got: ${opts.adminBaseUrl}).
-`
-      );
-      process.exit(1);
+      return { ok: false, error: `--admin-base-url must be a plain http(s) URL (got: ${opts.adminBaseUrl}).` };
     }
     steps.push({
       label: "set ADMIN_BASE_URL secret",
-      cmd: `supabase secrets set ADMIN_BASE_URL=${opts.adminBaseUrl}`
+      args: ["secrets", "set", `ADMIN_BASE_URL=${opts.adminBaseUrl}`]
     });
   }
-  const internalToken = randomBytes(32).toString("hex");
   steps.push({
     label: "set MUSHI_INTERNAL_CALLER_SECRET (recovery cron auth)",
-    cmd: `supabase secrets set MUSHI_INTERNAL_CALLER_SECRET=${printOnly ? "<openssl rand -hex 32>" : internalToken}`
+    args: [
+      "secrets",
+      "set",
+      `MUSHI_INTERNAL_CALLER_SECRET=${printOnly ? "<openssl rand -hex 32>" : internalToken}`
+    ]
   });
   if (!opts.skipDeploy) {
     for (const fn of REQUIRED_FUNCTIONS) {
       steps.push({
         label: `deploy edge function: ${fn}`,
-        cmd: `supabase functions deploy ${fn} --no-verify-jwt`
+        args: ["functions", "deploy", fn, "--no-verify-jwt"]
       });
     }
   }
   steps.push({
     label: "create screenshots storage bucket",
-    cmd: "supabase storage create screenshots --public || true"
+    args: ["storage", "create", "screenshots", "--public"],
+    mayFail: true
   });
+  return { ok: true, steps };
+}
+async function runSelfhostUp(opts) {
+  const supabaseDir = opts.cwd ? `${opts.cwd}/packages/server/supabase` : "packages/server/supabase";
+  const printOnly = !!(opts.printCommands || !hasSupabaseCli());
+  if (printOnly) {
+    console.log("");
+    console.log("supabase CLI not found (or --print-commands was passed).");
+    console.log("Run the following commands manually:\n");
+  } else {
+    console.log("");
+    console.log("mushi selfhost up \u2014 deploying self-hosted Mushi Mushi\n");
+  }
+  const built = buildSelfhostSteps(opts, printOnly, randomBytes(32).toString("hex"));
+  if (!built.ok) {
+    process.stderr.write(`\u2717 ${built.error}
+`);
+    process.exit(1);
+  }
   let aborted = false;
-  for (const step of steps) {
+  for (const step of built.steps) {
     if (printOnly) {
       console.log(`# ${step.label}`);
-      run(step.cmd, { printOnly: true });
+      console.log(`  $ ${selfhostStepCommand(step)}`);
       console.log("");
     } else {
-      const result = run(step.cmd, { label: step.label, cwd: supabaseDir });
-      if (!result.ok) {
+      const result = runSupabase(step.args, { label: step.label, cwd: supabaseDir });
+      if (!result.ok && step.mayFail) {
+        process.stdout.write(`    (fine if it already exists) ${result.stderr.split("\n")[0]}
+`);
+      } else if (!result.ok) {
         if (result.stderr) {
           process.stderr.write(`    ${result.stderr.split("\n")[0]}
 `);
@@ -10685,8 +10725,8 @@ function registerUxRunsCommands(program2) {
       console.log(JSON.stringify(result.data, null, 2));
       return;
     }
-    const { run: run2, surfaces } = result.data;
-    if (run2.branch) console.log(`Kept changes: ${run2.branch}
+    const { run, surfaces } = result.data;
+    if (run.branch) console.log(`Kept changes: ${run.branch}
 `);
     const order = ["regressed", "reverted", "blocked", "iterating", "baseline", "accepted", "skipped", "pending"];
     for (const s of [...surfaces].sort((a, b) => order.indexOf(a.status) - order.indexOf(b.status))) {

package/dist/init.d.ts

@@ -87,8 +87,9 @@ declare function createProject(endpoint: string, cliToken: string, name: string,
 /**
  * Mint a fresh report:write key for an existing project (raw keys can't be
  * recovered, so selecting a project always mints a new one). Throws
- * DeviceAuthRequestError on failure (after one transient retry) so the wizard
- * can tell the user WHY minting failed instead of a bare "could not mint".
+ * DeviceAuthRequestError on failure (a single attempt, no retry — minting isn't
+ * idempotent) so the wizard can tell the user WHY minting failed instead of a
+ * bare "could not mint".
  */
 declare function mintProjectKey(endpoint: string, cliToken: string, projectId: string, opts?: {
     /**

package/dist/init.js

@@ -25,10 +25,10 @@ import {
   saveConfig,
   savedSdkKeyFor,
   trySaveKeyToKeychain
-} from "./chunk-AJ6TRLJX.js";
+} from "./chunk-SV6HHYWE.js";
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-P7JI5H57.js";
+} from "./chunk-ODY6NZY2.js";
 import {
   FRAMEWORKS,
   detectFramework,
@@ -39,10 +39,12 @@ import {
 } from "./chunk-AIZRI665.js";
 import {
   CLOUD_API_ENDPOINT,
+  CLOUD_MCP_OAUTH_URL,
   TEST_REPORT_FETCH_TIMEOUT_MS,
+  firstEndpoint,
   normalizeEndpoint,
   resolveCloudEndpoint
-} from "./chunk-SXSI2W6Z.js";
+} from "./chunk-2DMHQVRU.js";
 import "./chunk-3RG5ZIWI.js";
 
 // src/init.ts
@@ -860,7 +862,7 @@ var HASH_ROUTER_PATTERNS = [
   /location\.hash\b/,
   /addEventListener\(['"]hashchange['"]/
 ];
-var HASH_TEMPLATE_PATTERN = /['"`]#\//;
+var HASH_TEMPLATE_PATTERN = /['"`]\/?#\//;
 async function scanDirForPattern(dir, patterns, maxDepth = 6, maxFiles = 2e3) {
   const { readdir, readFile } = await import("fs/promises");
   const { join: join3 } = await import("path");
@@ -969,6 +971,19 @@ async function collectMcpSources(root, home) {
   }
   return { sources, invalid };
 }
+function claudeOAuthCannotDiscover(entry, url) {
+  let host;
+  try {
+    host = new URL(url).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  if (!host.endsWith(".supabase.co")) return false;
+  const headers = isJsonObject(entry.headers) ? Object.keys(entry.headers).map((h) => h.toLowerCase()) : [];
+  if (headers.includes("authorization") || headers.includes("x-mushi-api-key")) return false;
+  const oauth = isJsonObject(entry.oauth) ? entry.oauth : {};
+  return typeof oauth.authServerMetadataUrl !== "string" || oauth.authServerMetadataUrl.length === 0;
+}
 function assessMushiEntry(source, name, entry, cliKeySaved) {
   const label = `${name} (${source.path})`;
   if (!isJsonObject(entry)) return { usable: false, stdio: false, detail: `${label}: not an object` };
@@ -980,6 +995,13 @@ function assessMushiEntry(source, name, entry, cliKeySaved) {
         detail: `${label}: has a url but no "type": "http" \u2014 Claude Code skips it`
       };
     }
+    if (source.claudeCode && claudeOAuthCannotDiscover(entry, entry.url)) {
+      return {
+        usable: false,
+        stdio: false,
+        detail: `${label}: Claude Code sign-in cannot find OAuth metadata on a supabase.co URL ("Dynamic Client Registration rejected (HTTP 404)") \u2014 use ${CLOUD_MCP_OAUTH_URL} for Mushi Cloud, or add "oauth": { "authServerMetadataUrl": "<url>/.well-known/oauth-authorization-server" }`
+      };
+    }
     return { usable: true, stdio: false, detail: `${label}: hosted OAuth \u2014 sign in from the IDE's MCP panel` };
   }
   const env = isJsonObject(entry.env) ? entry.env : {};
@@ -1358,7 +1380,7 @@ async function runInit(options = {}) {
   const framework = await chooseFramework(detected, options);
   const consoleBase = await resolveConsoleUrl({ cwd });
   const endpoint = resolveCloudEndpoint(
-    options.endpoint ?? process.env.MUSHI_API_ENDPOINT?.trim() ?? loadConfig().endpoint
+    firstEndpoint(options.endpoint, process.env.MUSHI_API_ENDPOINT, loadConfig().endpoint)
   );
   options = { ...options, endpoint };
   const credentials = await acquireCredentials(options, consoleBase, endpoint);
@@ -2037,7 +2059,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect } = await import("./connect-4TSPUKYX.js");
+    const { runConnect } = await import("./connect-YDQ65VJY.js");
     const saved = loadConfig();
     const result = await runConnect(
       {

package/dist/{version-5BNKTJFR.js → version-35BA3FDB.js}

@@ -2,7 +2,7 @@
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-X67SYMCO.js";
+} from "./chunk-F7TLL2FB.js";
 import "./chunk-PDX44BCA.js";
 export {
   MUSHI_CLI_VERSION,

package/dist/version.d.ts

@@ -14,6 +14,6 @@ declare const MUSHI_CLI_VERSION: string;
  * setup refreshes the pin. Synced to packages/mcp/package.json by
  * `scripts/sync-mcp-pin.mjs` — never hand-edit the version.
  */
-declare const MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.24.5";
+declare const MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.25.0";
 
 export { MUSHI_CLI_VERSION, MUSHI_MCP_PIN_SPEC };

package/dist/version.js

@@ -1,7 +1,7 @@
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-P7JI5H57.js";
+} from "./chunk-ODY6NZY2.js";
 import "./chunk-3RG5ZIWI.js";
 export {
   MUSHI_CLI_VERSION,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mushi-mushi/cli",
-  "version": "0.30.2",
+  "version": "0.30.4",
   "license": "MIT",
   "description": "Mushi CLI: SDK setup, MCP wiring, bug triage. The bug mediator for AI-built apps: plain-English diagnosis + a ready fix, in your editor.",
   "bin": {

package/dist/chunk-P7JI5H57.js

@@ -1,8 +0,0 @@
-// src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.30.2" : "0.0.0-dev";
-var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.24.5";
-
-export {
-  MUSHI_CLI_VERSION,
-  MUSHI_MCP_PIN_SPEC
-};

package/dist/chunk-X67SYMCO.js

@@ -1,10 +0,0 @@
-#!/usr/bin/env node
-
-// src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.30.2" : "0.0.0-dev";
-var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.24.5";
-
-export {
-  MUSHI_CLI_VERSION,
-  MUSHI_MCP_PIN_SPEC
-};