@mushi-mushi/cli 0.30.3 → 0.30.4

package/dist/{chunk-ZRDGR4TV.js → chunk-26JWYLCK.js}

@@ -2,17 +2,17 @@
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-VJZVFEMZ.js";
+} from "./chunk-F7TLL2FB.js";
+import {
+  CLOUD_API_ENDPOINT,
+  assertEndpoint,
+  normalizeEndpoint
+} from "./chunk-LGGE3LH7.js";
 import {
   detectFramework,
   envVarsToWrite,
   readPackageJson
 } from "./chunk-KOBEOGNF.js";
-import {
-  CLOUD_API_ENDPOINT,
-  assertEndpoint,
-  normalizeEndpoint
-} from "./chunk-LDPFTQLE.js";
 import {
   __require
 } from "./chunk-PDX44BCA.js";
@@ -122,11 +122,13 @@ function loadConfig(path = CONFIG_PATH, opts = {}) {
   if (keychainKey) {
     file = { ...file, apiKey: keychainKey };
   }
-  const endpointFromEnv = process.env["MUSHI_API_ENDPOINT"] ?? process.env["MUSHI_ENDPOINT"] ?? void 0;
+  const endpointFromEnv = process.env["MUSHI_API_ENDPOINT"]?.trim() || process.env["MUSHI_ENDPOINT"]?.trim() || void 0;
   const fromEnv = {
     ...process.env["MUSHI_API_KEY"] ? { apiKey: process.env["MUSHI_API_KEY"] } : {},
     ...process.env["MUSHI_PROJECT_ID"] ? { projectId: process.env["MUSHI_PROJECT_ID"] } : {},
-    ...endpointFromEnv ? { endpoint: endpointFromEnv } : {},
+    // Saved endpoints are normalized by assertEndpoint; the env value isn't,
+    // so strip trailing slashes here (no `.../api//v1/...` in any caller).
+    ...endpointFromEnv ? { endpoint: normalizeEndpoint(endpointFromEnv) } : {},
     ...process.env["MUSHI_CONSOLE_URL"] ? { consoleUrl: process.env["MUSHI_CONSOLE_URL"].trim() } : {}
   };
   return { ...file, ...fromEnv };
@@ -564,7 +566,7 @@ function normalizeApiError(error, httpStatus) {
 }
 async function apiCall(path, config, options = {}, callOptions = {}) {
   const timeoutMs = callOptions.timeoutMs ?? API_TIMEOUT_MS;
-  const endpoint = config.endpoint;
+  const endpoint = config.endpoint ? normalizeEndpoint(config.endpoint) : config.endpoint;
   if (!endpoint) {
     return {
       ok: false,
@@ -878,8 +880,8 @@ var MCP_CLIENT_LABEL = {
   continue: "Continue",
   zed: "Zed"
 };
-function buildHostedMcpServerBlock(url) {
-  return { type: "http", url };
+function buildHostedMcpServerBlock(url, oauth) {
+  return oauth ? { type: "http", url, oauth } : { type: "http", url };
 }
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);

package/dist/{chunk-SXSI2W6Z.js → chunk-2DMHQVRU.js}

@@ -2,6 +2,14 @@
 var TEST_REPORT_TIMEOUT_MS = 1e4;
 var TEST_REPORT_FETCH_TIMEOUT_MS = TEST_REPORT_TIMEOUT_MS;
 var CLOUD_API_ENDPOINT = "https://dxptnwrhwsqckaftyymj.supabase.co/functions/v1/api";
+var CLOUD_MCP_OAUTH_URL = "https://kensaur.us/mushi-mushi/hosted-mcp/";
+function firstEndpoint(...candidates) {
+  for (const c of candidates) {
+    const v = c?.trim();
+    if (v) return v;
+  }
+  return void 0;
+}
 function resolveCloudEndpoint(explicit) {
   if (explicit?.trim()) return explicit.trim();
   const fromEnv = process.env.MUSHI_API_ENDPOINT?.trim();
@@ -36,6 +44,8 @@ function normalizeEndpoint(url) {
 export {
   TEST_REPORT_FETCH_TIMEOUT_MS,
   CLOUD_API_ENDPOINT,
+  CLOUD_MCP_OAUTH_URL,
+  firstEndpoint,
   resolveCloudEndpoint,
   assertEndpoint,
   normalizeEndpoint

package/dist/chunk-F7TLL2FB.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+
+// src/version.ts
+var MUSHI_CLI_VERSION = true ? "0.30.4" : "0.0.0-dev";
+var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.25.0";
+
+export {
+  MUSHI_CLI_VERSION,
+  MUSHI_MCP_PIN_SPEC
+};

package/dist/{chunk-LDPFTQLE.js → chunk-LGGE3LH7.js}

@@ -4,6 +4,14 @@
 var TEST_REPORT_TIMEOUT_MS = 1e4;
 var TEST_REPORT_FETCH_TIMEOUT_MS = TEST_REPORT_TIMEOUT_MS;
 var CLOUD_API_ENDPOINT = "https://dxptnwrhwsqckaftyymj.supabase.co/functions/v1/api";
+var CLOUD_MCP_OAUTH_URL = "https://kensaur.us/mushi-mushi/hosted-mcp/";
+function firstEndpoint(...candidates) {
+  for (const c of candidates) {
+    const v = c?.trim();
+    if (v) return v;
+  }
+  return void 0;
+}
 function resolveCloudEndpoint(explicit) {
   if (explicit?.trim()) return explicit.trim();
   const fromEnv = process.env.MUSHI_API_ENDPOINT?.trim();
@@ -38,6 +46,8 @@ function normalizeEndpoint(url) {
 export {
   TEST_REPORT_FETCH_TIMEOUT_MS,
   CLOUD_API_ENDPOINT,
+  CLOUD_MCP_OAUTH_URL,
+  firstEndpoint,
   resolveCloudEndpoint,
   assertEndpoint,
   normalizeEndpoint

package/dist/chunk-ODY6NZY2.js

@@ -0,0 +1,8 @@
+// src/version.ts
+var MUSHI_CLI_VERSION = true ? "0.30.4" : "0.0.0-dev";
+var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.25.0";
+
+export {
+  MUSHI_CLI_VERSION,
+  MUSHI_MCP_PIN_SPEC
+};

package/dist/{chunk-LBVNX3PN.js → chunk-SV6HHYWE.js}

@@ -1,10 +1,10 @@
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-ZQFQRBNL.js";
+} from "./chunk-ODY6NZY2.js";
 import {
   assertEndpoint,
   normalizeEndpoint
-} from "./chunk-SXSI2W6Z.js";
+} from "./chunk-2DMHQVRU.js";
 import {
   __require
 } from "./chunk-3RG5ZIWI.js";
@@ -108,11 +108,13 @@ function loadConfig(path = CONFIG_PATH, opts = {}) {
   if (keychainKey) {
     file = { ...file, apiKey: keychainKey };
   }
-  const endpointFromEnv = process.env["MUSHI_API_ENDPOINT"] ?? process.env["MUSHI_ENDPOINT"] ?? void 0;
+  const endpointFromEnv = process.env["MUSHI_API_ENDPOINT"]?.trim() || process.env["MUSHI_ENDPOINT"]?.trim() || void 0;
   const fromEnv = {
     ...process.env["MUSHI_API_KEY"] ? { apiKey: process.env["MUSHI_API_KEY"] } : {},
     ...process.env["MUSHI_PROJECT_ID"] ? { projectId: process.env["MUSHI_PROJECT_ID"] } : {},
-    ...endpointFromEnv ? { endpoint: endpointFromEnv } : {},
+    // Saved endpoints are normalized by assertEndpoint; the env value isn't,
+    // so strip trailing slashes here (no `.../api//v1/...` in any caller).
+    ...endpointFromEnv ? { endpoint: normalizeEndpoint(endpointFromEnv) } : {},
     ...process.env["MUSHI_CONSOLE_URL"] ? { consoleUrl: process.env["MUSHI_CONSOLE_URL"].trim() } : {}
   };
   return { ...file, ...fromEnv };
@@ -495,7 +497,7 @@ function normalizeApiError(error, httpStatus) {
 }
 async function apiCall(path, config, options = {}, callOptions = {}) {
   const timeoutMs = callOptions.timeoutMs ?? API_TIMEOUT_MS;
-  const endpoint = config.endpoint;
+  const endpoint = config.endpoint ? normalizeEndpoint(config.endpoint) : config.endpoint;
   if (!endpoint) {
     return {
       ok: false,

package/dist/{connect-RZUYFR66.js → connect-XPSH7MK3.js}

@@ -2,10 +2,10 @@
 import {
   resolveSdkEnvKey,
   runConnect
-} from "./chunk-ZRDGR4TV.js";
-import "./chunk-VJZVFEMZ.js";
+} from "./chunk-26JWYLCK.js";
+import "./chunk-F7TLL2FB.js";
+import "./chunk-LGGE3LH7.js";
 import "./chunk-KOBEOGNF.js";
-import "./chunk-LDPFTQLE.js";
 import "./chunk-PDX44BCA.js";
 export {
   resolveSdkEnvKey,

package/dist/{connect-Y77XNVUP.js → connect-YDQ65VJY.js}

@@ -6,10 +6,10 @@ import {
   saveConfig,
   savedSdkKeyFor,
   waitForIngestReady
-} from "./chunk-LBVNX3PN.js";
+} from "./chunk-SV6HHYWE.js";
 import {
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-ZQFQRBNL.js";
+} from "./chunk-ODY6NZY2.js";
 import {
   detectFramework,
   envVarsToWrite,
@@ -17,7 +17,7 @@ import {
 } from "./chunk-AIZRI665.js";
 import {
   assertEndpoint
-} from "./chunk-SXSI2W6Z.js";
+} from "./chunk-2DMHQVRU.js";
 import "./chunk-3RG5ZIWI.js";
 
 // src/connect.ts

package/dist/{endpoint-NHECZL47.js → endpoint-GXIRH2BW.js}

@@ -1,15 +1,19 @@
 import {
   CLOUD_API_ENDPOINT,
+  CLOUD_MCP_OAUTH_URL,
   TEST_REPORT_FETCH_TIMEOUT_MS,
   assertEndpoint,
+  firstEndpoint,
   normalizeEndpoint,
   resolveCloudEndpoint
-} from "./chunk-SXSI2W6Z.js";
+} from "./chunk-2DMHQVRU.js";
 import "./chunk-3RG5ZIWI.js";
 export {
   CLOUD_API_ENDPOINT,
+  CLOUD_MCP_OAUTH_URL,
   TEST_REPORT_FETCH_TIMEOUT_MS,
   assertEndpoint,
+  firstEndpoint,
   normalizeEndpoint,
   resolveCloudEndpoint
 };

package/dist/{endpoint-TEBF4IH6.js → endpoint-KI5FMW2S.js}

@@ -1,16 +1,20 @@
 #!/usr/bin/env node
 import {
   CLOUD_API_ENDPOINT,
+  CLOUD_MCP_OAUTH_URL,
   TEST_REPORT_FETCH_TIMEOUT_MS,
   assertEndpoint,
+  firstEndpoint,
   normalizeEndpoint,
   resolveCloudEndpoint
-} from "./chunk-LDPFTQLE.js";
+} from "./chunk-LGGE3LH7.js";
 import "./chunk-PDX44BCA.js";
 export {
   CLOUD_API_ENDPOINT,
+  CLOUD_MCP_OAUTH_URL,
   TEST_REPORT_FETCH_TIMEOUT_MS,
   assertEndpoint,
+  firstEndpoint,
   normalizeEndpoint,
   resolveCloudEndpoint
 };

package/dist/index.js

@@ -53,11 +53,20 @@ import {
   setGlobalOutputFormat,
   trySaveKeyToKeychain,
   writeMcpServerEntry
-} from "./chunk-ZRDGR4TV.js";
+} from "./chunk-26JWYLCK.js";
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-VJZVFEMZ.js";
+} from "./chunk-F7TLL2FB.js";
+import {
+  CLOUD_API_ENDPOINT,
+  CLOUD_MCP_OAUTH_URL,
+  TEST_REPORT_FETCH_TIMEOUT_MS,
+  assertEndpoint,
+  firstEndpoint,
+  normalizeEndpoint,
+  resolveCloudEndpoint
+} from "./chunk-LGGE3LH7.js";
 import {
   FRAMEWORKS,
   detectFramework,
@@ -66,13 +75,6 @@ import {
   installCommand,
   readPackageJson
 } from "./chunk-KOBEOGNF.js";
-import {
-  CLOUD_API_ENDPOINT,
-  TEST_REPORT_FETCH_TIMEOUT_MS,
-  assertEndpoint,
-  normalizeEndpoint,
-  resolveCloudEndpoint
-} from "./chunk-LDPFTQLE.js";
 import "./chunk-PDX44BCA.js";
 
 // src/index.ts
@@ -465,7 +467,7 @@ function chooseProjectNonInteractive(projects, preferredName) {
   return match ? { kind: "existing", id: match.id, name: match.name } : { kind: "new", name: preferredName };
 }
 async function runLogin(opts = {}) {
-  const { CLOUD_API_ENDPOINT: CLOUD_API_ENDPOINT2, resolveCloudEndpoint: resolveCloudEndpoint2 } = await import("./endpoint-TEBF4IH6.js");
+  const { CLOUD_API_ENDPOINT: CLOUD_API_ENDPOINT2, resolveCloudEndpoint: resolveCloudEndpoint2 } = await import("./endpoint-KI5FMW2S.js");
   const endpoint = opts.endpoint ? resolveCloudEndpoint2(opts.endpoint) : CLOUD_API_ENDPOINT2;
   const consoleBase = await resolveConsoleUrl();
   let apiKey = opts.apiKey;
@@ -1185,7 +1187,7 @@ var HASH_ROUTER_PATTERNS = [
   /location\.hash\b/,
   /addEventListener\(['"]hashchange['"]/
 ];
-var HASH_TEMPLATE_PATTERN = /['"`]#\//;
+var HASH_TEMPLATE_PATTERN = /['"`]\/?#\//;
 async function scanDirForPattern(dir, patterns, maxDepth = 6, maxFiles = 2e3) {
   const { readdir: readdir2, readFile: readFile3 } = await import("fs/promises");
   const { join: join11 } = await import("path");
@@ -1294,6 +1296,19 @@ async function collectMcpSources(root, home) {
   }
   return { sources, invalid };
 }
+function claudeOAuthCannotDiscover(entry, url) {
+  let host;
+  try {
+    host = new URL(url).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  if (!host.endsWith(".supabase.co")) return false;
+  const headers = isJsonObject(entry.headers) ? Object.keys(entry.headers).map((h) => h.toLowerCase()) : [];
+  if (headers.includes("authorization") || headers.includes("x-mushi-api-key")) return false;
+  const oauth = isJsonObject(entry.oauth) ? entry.oauth : {};
+  return typeof oauth.authServerMetadataUrl !== "string" || oauth.authServerMetadataUrl.length === 0;
+}
 function assessMushiEntry(source, name, entry, cliKeySaved) {
   const label = `${name} (${source.path})`;
   if (!isJsonObject(entry)) return { usable: false, stdio: false, detail: `${label}: not an object` };
@@ -1305,6 +1320,13 @@ function assessMushiEntry(source, name, entry, cliKeySaved) {
         detail: `${label}: has a url but no "type": "http" \u2014 Claude Code skips it`
       };
     }
+    if (source.claudeCode && claudeOAuthCannotDiscover(entry, entry.url)) {
+      return {
+        usable: false,
+        stdio: false,
+        detail: `${label}: Claude Code sign-in cannot find OAuth metadata on a supabase.co URL ("Dynamic Client Registration rejected (HTTP 404)") \u2014 use ${CLOUD_MCP_OAUTH_URL} for Mushi Cloud, or add "oauth": { "authServerMetadataUrl": "<url>/.well-known/oauth-authorization-server" }`
+      };
+    }
     return { usable: true, stdio: false, detail: `${label}: hosted OAuth \u2014 sign in from the IDE's MCP panel` };
   }
   const env = isJsonObject(entry.env) ? entry.env : {};
@@ -1524,7 +1546,7 @@ async function checkOnboardingStatus(config, _consoleBase, cwd, doFetch = global
 }
 async function checkVersionDrift(cwd, doFetch) {
   const checks = [];
-  const { MUSHI_CLI_VERSION: MUSHI_CLI_VERSION2 } = await import("./version-HJSICWYN.js");
+  const { MUSHI_CLI_VERSION: MUSHI_CLI_VERSION2 } = await import("./version-35BA3FDB.js");
   if (MUSHI_CLI_VERSION2 === "0.0.0-dev") return checks;
   const parse2 = (v) => {
     const m = v.replace(/^[~^]/, "").match(/^(\d+)\.(\d+)\.(\d+)/);
@@ -1769,7 +1791,7 @@ async function runInit(options = {}) {
   const framework = await chooseFramework(detected, options);
   const consoleBase = await resolveConsoleUrl({ cwd });
   const endpoint = resolveCloudEndpoint(
-    options.endpoint ?? process.env.MUSHI_API_ENDPOINT?.trim() ?? loadConfig().endpoint
+    firstEndpoint(options.endpoint, process.env.MUSHI_API_ENDPOINT, loadConfig().endpoint)
   );
   options = { ...options, endpoint };
   const credentials = await acquireCredentials(options, consoleBase, endpoint);
@@ -2448,7 +2470,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect: runConnect2 } = await import("./connect-RZUYFR66.js");
+    const { runConnect: runConnect2 } = await import("./connect-XPSH7MK3.js");
     const saved = loadConfig();
     const result = await runConnect2(
       {
@@ -3673,7 +3695,8 @@ async function writeProjectBootstrapFiles(opts) {
   try {
     existing = await readFile2(envPath, "utf8");
     envUpdated = true;
-  } catch {
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
   }
   const MUSHI_LINE_RE = /^(NEXT_PUBLIC_|NUXT_PUBLIC_|VITE_|EXPO_PUBLIC_)?MUSHI_[A-Z_]+=.*/gm;
   const MUSHI_COMMENT_RE = /^# Mushi MCP\b.*/gm;
@@ -3715,7 +3738,7 @@ Typical first-time flow:
   # mushi whoami to confirm`).action(async (opts) => {
     const savedConfig = loadConfig();
     const endpoint = resolveCloudEndpoint(
-      opts.endpoint ?? process.env.MUSHI_API_ENDPOINT?.trim() ?? savedConfig.endpoint
+      firstEndpoint(opts.endpoint, process.env.MUSHI_API_ENDPOINT, savedConfig.endpoint)
     );
     const consoleBase = await resolveConsoleUrl();
     console.log("");
@@ -3867,7 +3890,14 @@ function buildSetupServerBlock(opts) {
       note: "Note: endpoint does not end in /api \u2014 cannot derive the hosted MCP URL; writing a local stdio entry instead."
     };
   }
-  return { block: buildHostedMcpServerBlock(hostedUrl), hosted: true };
+  return { block: hostedOAuthBlock(opts.ide, opts.endpoint, hostedUrl), hosted: true };
+}
+function hostedOAuthBlock(ide, endpoint, hostedUrl) {
+  if (endpoint.replace(/\/+$/, "") === CLOUD_API_ENDPOINT) return buildHostedMcpServerBlock(CLOUD_MCP_OAUTH_URL);
+  if (ide !== "claude") return buildHostedMcpServerBlock(hostedUrl);
+  return buildHostedMcpServerBlock(hostedUrl, {
+    authServerMetadataUrl: `${hostedUrl}/.well-known/oauth-authorization-server`
+  });
 }
 function buildZedServerBlock(opts) {
   const { env } = buildMcpServerBlock({ ...opts, client: "zed" });
@@ -4681,17 +4711,17 @@ function registerNudgeCommand(program2) {
     }
     const phase = opts.phase;
     const overrides = {};
-    const parseNumericFlag = (flag, raw, min) => {
+    const parseNumericFlag = (flag, raw, min, integer = false) => {
       const n = Number(raw);
-      if (!Number.isFinite(n) || n < min) {
+      if (!Number.isFinite(n) || n < min || integer && !Number.isInteger(n)) {
         console.error(
-          `error: --${flag} must be a finite number >= ${min} (got "${raw}")`
+          `error: --${flag} must be a finite ${integer ? "integer" : "number"} >= ${min} (got "${raw}")`
         );
         process.exit(1);
       }
       return n;
     };
-    if (opts.max !== void 0) overrides.maxProactivePerSession = parseNumericFlag("max", opts.max, 1);
+    if (opts.max !== void 0) overrides.maxProactivePerSession = parseNumericFlag("max", opts.max, 1, true);
     if (opts.cooldown !== void 0) overrides.dismissCooldownHours = parseNumericFlag("cooldown", opts.cooldown, 0);
     if (opts.dwell !== void 0) overrides.pageDwellMinutes = parseNumericFlag("dwell", opts.dwell, 0);
     if (opts.welcome !== void 0) overrides.firstSessionSeconds = parseNumericFlag("welcome", opts.welcome, 0);

package/dist/init.d.ts

@@ -87,8 +87,9 @@ declare function createProject(endpoint: string, cliToken: string, name: string,
 /**
  * Mint a fresh report:write key for an existing project (raw keys can't be
  * recovered, so selecting a project always mints a new one). Throws
- * DeviceAuthRequestError on failure (after one transient retry) so the wizard
- * can tell the user WHY minting failed instead of a bare "could not mint".
+ * DeviceAuthRequestError on failure (a single attempt, no retry — minting isn't
+ * idempotent) so the wizard can tell the user WHY minting failed instead of a
+ * bare "could not mint".
  */
 declare function mintProjectKey(endpoint: string, cliToken: string, projectId: string, opts?: {
     /**

package/dist/init.js

@@ -25,10 +25,10 @@ import {
   saveConfig,
   savedSdkKeyFor,
   trySaveKeyToKeychain
-} from "./chunk-LBVNX3PN.js";
+} from "./chunk-SV6HHYWE.js";
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-ZQFQRBNL.js";
+} from "./chunk-ODY6NZY2.js";
 import {
   FRAMEWORKS,
   detectFramework,
@@ -39,10 +39,12 @@ import {
 } from "./chunk-AIZRI665.js";
 import {
   CLOUD_API_ENDPOINT,
+  CLOUD_MCP_OAUTH_URL,
   TEST_REPORT_FETCH_TIMEOUT_MS,
+  firstEndpoint,
   normalizeEndpoint,
   resolveCloudEndpoint
-} from "./chunk-SXSI2W6Z.js";
+} from "./chunk-2DMHQVRU.js";
 import "./chunk-3RG5ZIWI.js";
 
 // src/init.ts
@@ -860,7 +862,7 @@ var HASH_ROUTER_PATTERNS = [
   /location\.hash\b/,
   /addEventListener\(['"]hashchange['"]/
 ];
-var HASH_TEMPLATE_PATTERN = /['"`]#\//;
+var HASH_TEMPLATE_PATTERN = /['"`]\/?#\//;
 async function scanDirForPattern(dir, patterns, maxDepth = 6, maxFiles = 2e3) {
   const { readdir, readFile } = await import("fs/promises");
   const { join: join3 } = await import("path");
@@ -969,6 +971,19 @@ async function collectMcpSources(root, home) {
   }
   return { sources, invalid };
 }
+function claudeOAuthCannotDiscover(entry, url) {
+  let host;
+  try {
+    host = new URL(url).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  if (!host.endsWith(".supabase.co")) return false;
+  const headers = isJsonObject(entry.headers) ? Object.keys(entry.headers).map((h) => h.toLowerCase()) : [];
+  if (headers.includes("authorization") || headers.includes("x-mushi-api-key")) return false;
+  const oauth = isJsonObject(entry.oauth) ? entry.oauth : {};
+  return typeof oauth.authServerMetadataUrl !== "string" || oauth.authServerMetadataUrl.length === 0;
+}
 function assessMushiEntry(source, name, entry, cliKeySaved) {
   const label = `${name} (${source.path})`;
   if (!isJsonObject(entry)) return { usable: false, stdio: false, detail: `${label}: not an object` };
@@ -980,6 +995,13 @@ function assessMushiEntry(source, name, entry, cliKeySaved) {
         detail: `${label}: has a url but no "type": "http" \u2014 Claude Code skips it`
       };
     }
+    if (source.claudeCode && claudeOAuthCannotDiscover(entry, entry.url)) {
+      return {
+        usable: false,
+        stdio: false,
+        detail: `${label}: Claude Code sign-in cannot find OAuth metadata on a supabase.co URL ("Dynamic Client Registration rejected (HTTP 404)") \u2014 use ${CLOUD_MCP_OAUTH_URL} for Mushi Cloud, or add "oauth": { "authServerMetadataUrl": "<url>/.well-known/oauth-authorization-server" }`
+      };
+    }
     return { usable: true, stdio: false, detail: `${label}: hosted OAuth \u2014 sign in from the IDE's MCP panel` };
   }
   const env = isJsonObject(entry.env) ? entry.env : {};
@@ -1358,7 +1380,7 @@ async function runInit(options = {}) {
   const framework = await chooseFramework(detected, options);
   const consoleBase = await resolveConsoleUrl({ cwd });
   const endpoint = resolveCloudEndpoint(
-    options.endpoint ?? process.env.MUSHI_API_ENDPOINT?.trim() ?? loadConfig().endpoint
+    firstEndpoint(options.endpoint, process.env.MUSHI_API_ENDPOINT, loadConfig().endpoint)
   );
   options = { ...options, endpoint };
   const credentials = await acquireCredentials(options, consoleBase, endpoint);
@@ -2037,7 +2059,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect } = await import("./connect-Y77XNVUP.js");
+    const { runConnect } = await import("./connect-YDQ65VJY.js");
     const saved = loadConfig();
     const result = await runConnect(
       {

package/dist/{version-HJSICWYN.js → version-35BA3FDB.js}

@@ -2,7 +2,7 @@
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-VJZVFEMZ.js";
+} from "./chunk-F7TLL2FB.js";
 import "./chunk-PDX44BCA.js";
 export {
   MUSHI_CLI_VERSION,

package/dist/version.d.ts

@@ -14,6 +14,6 @@ declare const MUSHI_CLI_VERSION: string;
  * setup refreshes the pin. Synced to packages/mcp/package.json by
  * `scripts/sync-mcp-pin.mjs` — never hand-edit the version.
  */
-declare const MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.24.6";
+declare const MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.25.0";
 
 export { MUSHI_CLI_VERSION, MUSHI_MCP_PIN_SPEC };

package/dist/version.js

@@ -1,7 +1,7 @@
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-ZQFQRBNL.js";
+} from "./chunk-ODY6NZY2.js";
 import "./chunk-3RG5ZIWI.js";
 export {
   MUSHI_CLI_VERSION,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mushi-mushi/cli",
-  "version": "0.30.3",
+  "version": "0.30.4",
   "license": "MIT",
   "description": "Mushi CLI: SDK setup, MCP wiring, bug triage. The bug mediator for AI-built apps: plain-English diagnosis + a ready fix, in your editor.",
   "bin": {

package/dist/chunk-VJZVFEMZ.js

@@ -1,10 +0,0 @@
-#!/usr/bin/env node
-
-// src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.30.3" : "0.0.0-dev";
-var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.24.6";
-
-export {
-  MUSHI_CLI_VERSION,
-  MUSHI_MCP_PIN_SPEC
-};

package/dist/chunk-ZQFQRBNL.js

@@ -1,8 +0,0 @@
-// src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.30.3" : "0.0.0-dev";
-var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.24.6";
-
-export {
-  MUSHI_CLI_VERSION,
-  MUSHI_MCP_PIN_SPEC
-};