@mushi-mushi/cli 0.30.3 → 0.30.5

package/dist/{chunk-SXSI2W6Z.js → chunk-2DMHQVRU.js}

@@ -2,6 +2,14 @@
 var TEST_REPORT_TIMEOUT_MS = 1e4;
 var TEST_REPORT_FETCH_TIMEOUT_MS = TEST_REPORT_TIMEOUT_MS;
 var CLOUD_API_ENDPOINT = "https://dxptnwrhwsqckaftyymj.supabase.co/functions/v1/api";
+var CLOUD_MCP_OAUTH_URL = "https://kensaur.us/mushi-mushi/hosted-mcp/";
+function firstEndpoint(...candidates) {
+  for (const c of candidates) {
+    const v = c?.trim();
+    if (v) return v;
+  }
+  return void 0;
+}
 function resolveCloudEndpoint(explicit) {
   if (explicit?.trim()) return explicit.trim();
   const fromEnv = process.env.MUSHI_API_ENDPOINT?.trim();
@@ -36,6 +44,8 @@ function normalizeEndpoint(url) {
 export {
   TEST_REPORT_FETCH_TIMEOUT_MS,
   CLOUD_API_ENDPOINT,
+  CLOUD_MCP_OAUTH_URL,
+  firstEndpoint,
   resolveCloudEndpoint,
   assertEndpoint,
   normalizeEndpoint

package/dist/chunk-AZZNO4T4.js

@@ -0,0 +1,8 @@
+// src/version.ts
+var MUSHI_CLI_VERSION = true ? "0.30.5" : "0.0.0-dev";
+var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.26.0";
+
+export {
+  MUSHI_CLI_VERSION,
+  MUSHI_MCP_PIN_SPEC
+};

package/dist/{chunk-LBVNX3PN.js → chunk-EZJN53QO.js}

@@ -1,24 +1,23 @@
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-ZQFQRBNL.js";
+} from "./chunk-AZZNO4T4.js";
 import {
   assertEndpoint,
   normalizeEndpoint
-} from "./chunk-SXSI2W6Z.js";
-import {
-  __require
-} from "./chunk-3RG5ZIWI.js";
+} from "./chunk-2DMHQVRU.js";
 
 // src/keychain.ts
+import { createRequire } from "module";
 var KEYCHAIN_SERVICE = "mushi-cli";
 function accountName(profile = "default") {
   return `api-key:${profile}`;
 }
 var _EntryClass = void 0;
 function getEntryClass() {
+  if (process.env["MUSHI_NO_KEYCHAIN"]) return null;
   if (_EntryClass === void 0) {
     try {
-      const mod = __require("@napi-rs/keyring");
+      const mod = createRequire(import.meta.url)("@napi-rs/keyring");
       _EntryClass = mod.Entry ?? null;
     } catch {
       _EntryClass = null;
@@ -108,11 +107,13 @@ function loadConfig(path = CONFIG_PATH, opts = {}) {
   if (keychainKey) {
     file = { ...file, apiKey: keychainKey };
   }
-  const endpointFromEnv = process.env["MUSHI_API_ENDPOINT"] ?? process.env["MUSHI_ENDPOINT"] ?? void 0;
+  const endpointFromEnv = process.env["MUSHI_API_ENDPOINT"]?.trim() || process.env["MUSHI_ENDPOINT"]?.trim() || void 0;
   const fromEnv = {
     ...process.env["MUSHI_API_KEY"] ? { apiKey: process.env["MUSHI_API_KEY"] } : {},
     ...process.env["MUSHI_PROJECT_ID"] ? { projectId: process.env["MUSHI_PROJECT_ID"] } : {},
-    ...endpointFromEnv ? { endpoint: endpointFromEnv } : {},
+    // Saved endpoints are normalized by assertEndpoint; the env value isn't,
+    // so strip trailing slashes here (no `.../api//v1/...` in any caller).
+    ...endpointFromEnv ? { endpoint: normalizeEndpoint(endpointFromEnv) } : {},
     ...process.env["MUSHI_CONSOLE_URL"] ? { consoleUrl: process.env["MUSHI_CONSOLE_URL"].trim() } : {}
   };
   return { ...file, ...fromEnv };
@@ -495,7 +496,7 @@ function normalizeApiError(error, httpStatus) {
 }
 async function apiCall(path, config, options = {}, callOptions = {}) {
   const timeoutMs = callOptions.timeoutMs ?? API_TIMEOUT_MS;
-  const endpoint = config.endpoint;
+  const endpoint = config.endpoint ? normalizeEndpoint(config.endpoint) : config.endpoint;
   if (!endpoint) {
     return {
       ok: false,

package/dist/{chunk-ZRDGR4TV.js → chunk-HVNXKTTL.js}

@@ -2,20 +2,17 @@
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-VJZVFEMZ.js";
-import {
-  detectFramework,
-  envVarsToWrite,
-  readPackageJson
-} from "./chunk-KOBEOGNF.js";
+} from "./chunk-LKC2BEKQ.js";
 import {
   CLOUD_API_ENDPOINT,
   assertEndpoint,
   normalizeEndpoint
-} from "./chunk-LDPFTQLE.js";
+} from "./chunk-LGGE3LH7.js";
 import {
-  __require
-} from "./chunk-PDX44BCA.js";
+  detectFramework,
+  envVarsToWrite,
+  readPackageJson
+} from "./chunk-KOBEOGNF.js";
 
 // src/connect.ts
 import { appendFile, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
@@ -29,15 +26,17 @@ import { homedir } from "os";
 import { dirname, join } from "path";
 
 // src/keychain.ts
+import { createRequire } from "module";
 var KEYCHAIN_SERVICE = "mushi-cli";
 function accountName(profile = "default") {
   return `api-key:${profile}`;
 }
 var _EntryClass = void 0;
 function getEntryClass() {
+  if (process.env["MUSHI_NO_KEYCHAIN"]) return null;
   if (_EntryClass === void 0) {
     try {
-      const mod = __require("@napi-rs/keyring");
+      const mod = createRequire(import.meta.url)("@napi-rs/keyring");
       _EntryClass = mod.Entry ?? null;
     } catch {
       _EntryClass = null;
@@ -68,6 +67,21 @@ function tryLoadKeyFromKeychain(profile = "default") {
     return null;
   }
 }
+function tryDeleteKeyFromKeychain(profile = "default") {
+  const EntryClass = getEntryClass();
+  if (!EntryClass) return;
+  try {
+    const entry = new EntryClass(KEYCHAIN_SERVICE, accountName(profile));
+    entry.deletePassword();
+  } catch {
+  }
+}
+function syncKeychainAfterKeyChange(apiKey, profile = "default") {
+  if (tryLoadKeyFromKeychain(profile) === null) return "none";
+  if (trySaveKeyToKeychain(apiKey, profile) && tryLoadKeyFromKeychain(profile) === apiKey) return "updated";
+  tryDeleteKeyFromKeychain(profile);
+  return "removed";
+}
 
 // src/config.ts
 var DEFAULT_PROFILE = "default";
@@ -122,11 +136,13 @@ function loadConfig(path = CONFIG_PATH, opts = {}) {
   if (keychainKey) {
     file = { ...file, apiKey: keychainKey };
   }
-  const endpointFromEnv = process.env["MUSHI_API_ENDPOINT"] ?? process.env["MUSHI_ENDPOINT"] ?? void 0;
+  const endpointFromEnv = process.env["MUSHI_API_ENDPOINT"]?.trim() || process.env["MUSHI_ENDPOINT"]?.trim() || void 0;
   const fromEnv = {
     ...process.env["MUSHI_API_KEY"] ? { apiKey: process.env["MUSHI_API_KEY"] } : {},
     ...process.env["MUSHI_PROJECT_ID"] ? { projectId: process.env["MUSHI_PROJECT_ID"] } : {},
-    ...endpointFromEnv ? { endpoint: endpointFromEnv } : {},
+    // Saved endpoints are normalized by assertEndpoint; the env value isn't,
+    // so strip trailing slashes here (no `.../api//v1/...` in any caller).
+    ...endpointFromEnv ? { endpoint: normalizeEndpoint(endpointFromEnv) } : {},
     ...process.env["MUSHI_CONSOLE_URL"] ? { consoleUrl: process.env["MUSHI_CONSOLE_URL"].trim() } : {}
   };
   return { ...file, ...fromEnv };
@@ -564,7 +580,7 @@ function normalizeApiError(error, httpStatus) {
 }
 async function apiCall(path, config, options = {}, callOptions = {}) {
   const timeoutMs = callOptions.timeoutMs ?? API_TIMEOUT_MS;
-  const endpoint = config.endpoint;
+  const endpoint = config.endpoint ? normalizeEndpoint(config.endpoint) : config.endpoint;
   if (!endpoint) {
     return {
       ok: false,
@@ -878,8 +894,8 @@ var MCP_CLIENT_LABEL = {
   continue: "Continue",
   zed: "Zed"
 };
-function buildHostedMcpServerBlock(url) {
-  return { type: "http", url };
+function buildHostedMcpServerBlock(url, oauth) {
+  return oauth ? { type: "http", url, oauth } : { type: "http", url };
 }
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -1099,6 +1115,7 @@ export {
   printAndExit,
   installSignalHandlers,
   trySaveKeyToKeychain,
+  syncKeychainAfterKeyChange,
   savedSdkKeyFor,
   resolveProfileName,
   CONFIG_PATH,

package/dist/{chunk-LDPFTQLE.js → chunk-LGGE3LH7.js}

@@ -4,6 +4,14 @@
 var TEST_REPORT_TIMEOUT_MS = 1e4;
 var TEST_REPORT_FETCH_TIMEOUT_MS = TEST_REPORT_TIMEOUT_MS;
 var CLOUD_API_ENDPOINT = "https://dxptnwrhwsqckaftyymj.supabase.co/functions/v1/api";
+var CLOUD_MCP_OAUTH_URL = "https://kensaur.us/mushi-mushi/hosted-mcp/";
+function firstEndpoint(...candidates) {
+  for (const c of candidates) {
+    const v = c?.trim();
+    if (v) return v;
+  }
+  return void 0;
+}
 function resolveCloudEndpoint(explicit) {
   if (explicit?.trim()) return explicit.trim();
   const fromEnv = process.env.MUSHI_API_ENDPOINT?.trim();
@@ -38,6 +46,8 @@ function normalizeEndpoint(url) {
 export {
   TEST_REPORT_FETCH_TIMEOUT_MS,
   CLOUD_API_ENDPOINT,
+  CLOUD_MCP_OAUTH_URL,
+  firstEndpoint,
   resolveCloudEndpoint,
   assertEndpoint,
   normalizeEndpoint

package/dist/chunk-LKC2BEKQ.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+
+// src/version.ts
+var MUSHI_CLI_VERSION = true ? "0.30.5" : "0.0.0-dev";
+var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.26.0";
+
+export {
+  MUSHI_CLI_VERSION,
+  MUSHI_MCP_PIN_SPEC
+};

package/dist/{connect-RZUYFR66.js → connect-36PCIH7N.js}

@@ -2,11 +2,10 @@
 import {
   resolveSdkEnvKey,
   runConnect
-} from "./chunk-ZRDGR4TV.js";
-import "./chunk-VJZVFEMZ.js";
+} from "./chunk-HVNXKTTL.js";
+import "./chunk-LKC2BEKQ.js";
+import "./chunk-LGGE3LH7.js";
 import "./chunk-KOBEOGNF.js";
-import "./chunk-LDPFTQLE.js";
-import "./chunk-PDX44BCA.js";
 export {
   resolveSdkEnvKey,
   runConnect

package/dist/{connect-Y77XNVUP.js → connect-TY6YTXQD.js}

@@ -6,10 +6,10 @@ import {
   saveConfig,
   savedSdkKeyFor,
   waitForIngestReady
-} from "./chunk-LBVNX3PN.js";
+} from "./chunk-EZJN53QO.js";
 import {
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-ZQFQRBNL.js";
+} from "./chunk-AZZNO4T4.js";
 import {
   detectFramework,
   envVarsToWrite,
@@ -17,8 +17,7 @@ import {
 } from "./chunk-AIZRI665.js";
 import {
   assertEndpoint
-} from "./chunk-SXSI2W6Z.js";
-import "./chunk-3RG5ZIWI.js";
+} from "./chunk-2DMHQVRU.js";
 
 // src/connect.ts
 import { appendFile, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";

package/dist/{detect-4PYRZXVK.js → detect-WZT5X6LP.js}

@@ -9,7 +9,6 @@ import {
   isFrameworkId,
   readPackageJson
 } from "./chunk-KOBEOGNF.js";
-import "./chunk-PDX44BCA.js";
 export {
   FRAMEWORKS,
   FRAMEWORK_IDS,

package/dist/detect.js

@@ -8,7 +8,6 @@ import {
   isFrameworkId,
   readPackageJson
 } from "./chunk-AIZRI665.js";
-import "./chunk-3RG5ZIWI.js";
 export {
   FRAMEWORKS,
   FRAMEWORK_IDS,

package/dist/{endpoint-NHECZL47.js → endpoint-M662BOJN.js}

@@ -1,15 +1,18 @@
 import {
   CLOUD_API_ENDPOINT,
+  CLOUD_MCP_OAUTH_URL,
   TEST_REPORT_FETCH_TIMEOUT_MS,
   assertEndpoint,
+  firstEndpoint,
   normalizeEndpoint,
   resolveCloudEndpoint
-} from "./chunk-SXSI2W6Z.js";
-import "./chunk-3RG5ZIWI.js";
+} from "./chunk-2DMHQVRU.js";
 export {
   CLOUD_API_ENDPOINT,
+  CLOUD_MCP_OAUTH_URL,
   TEST_REPORT_FETCH_TIMEOUT_MS,
   assertEndpoint,
+  firstEndpoint,
   normalizeEndpoint,
   resolveCloudEndpoint
 };

package/dist/{endpoint-TEBF4IH6.js → endpoint-MJATXOXM.js}

@@ -1,16 +1,19 @@
 #!/usr/bin/env node
 import {
   CLOUD_API_ENDPOINT,
+  CLOUD_MCP_OAUTH_URL,
   TEST_REPORT_FETCH_TIMEOUT_MS,
   assertEndpoint,
+  firstEndpoint,
   normalizeEndpoint,
   resolveCloudEndpoint
-} from "./chunk-LDPFTQLE.js";
-import "./chunk-PDX44BCA.js";
+} from "./chunk-LGGE3LH7.js";
 export {
   CLOUD_API_ENDPOINT,
+  CLOUD_MCP_OAUTH_URL,
   TEST_REPORT_FETCH_TIMEOUT_MS,
   assertEndpoint,
+  firstEndpoint,
   normalizeEndpoint,
   resolveCloudEndpoint
 };

package/dist/index.js

@@ -51,13 +51,23 @@ import {
   savedSdkKeyFor,
   setActiveProfile,
   setGlobalOutputFormat,
+  syncKeychainAfterKeyChange,
   trySaveKeyToKeychain,
   writeMcpServerEntry
-} from "./chunk-ZRDGR4TV.js";
+} from "./chunk-HVNXKTTL.js";
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-VJZVFEMZ.js";
+} from "./chunk-LKC2BEKQ.js";
+import {
+  CLOUD_API_ENDPOINT,
+  CLOUD_MCP_OAUTH_URL,
+  TEST_REPORT_FETCH_TIMEOUT_MS,
+  assertEndpoint,
+  firstEndpoint,
+  normalizeEndpoint,
+  resolveCloudEndpoint
+} from "./chunk-LGGE3LH7.js";
 import {
   FRAMEWORKS,
   detectFramework,
@@ -66,14 +76,6 @@ import {
   installCommand,
   readPackageJson
 } from "./chunk-KOBEOGNF.js";
-import {
-  CLOUD_API_ENDPOINT,
-  TEST_REPORT_FETCH_TIMEOUT_MS,
-  assertEndpoint,
-  normalizeEndpoint,
-  resolveCloudEndpoint
-} from "./chunk-LDPFTQLE.js";
-import "./chunk-PDX44BCA.js";
 
 // src/index.ts
 import { Command } from "commander";
@@ -465,7 +467,7 @@ function chooseProjectNonInteractive(projects, preferredName) {
   return match ? { kind: "existing", id: match.id, name: match.name } : { kind: "new", name: preferredName };
 }
 async function runLogin(opts = {}) {
-  const { CLOUD_API_ENDPOINT: CLOUD_API_ENDPOINT2, resolveCloudEndpoint: resolveCloudEndpoint2 } = await import("./endpoint-TEBF4IH6.js");
+  const { CLOUD_API_ENDPOINT: CLOUD_API_ENDPOINT2, resolveCloudEndpoint: resolveCloudEndpoint2 } = await import("./endpoint-MJATXOXM.js");
   const endpoint = opts.endpoint ? resolveCloudEndpoint2(opts.endpoint) : CLOUD_API_ENDPOINT2;
   const consoleBase = await resolveConsoleUrl();
   let apiKey = opts.apiKey;
@@ -556,7 +558,7 @@ error: Could not start login session: ${err instanceof Error ? err.message : Str
       choice = await resolveProjectChoice(projectsList, ask);
       rl.close();
     } else {
-      const { readPackageJson: readPackageJson2 } = await import("./detect-4PYRZXVK.js");
+      const { readPackageJson: readPackageJson2 } = await import("./detect-WZT5X6LP.js");
       const cwd = process.cwd();
       const nonInteractive = chooseProjectNonInteractive(
         projectsList,
@@ -1185,7 +1187,7 @@ var HASH_ROUTER_PATTERNS = [
   /location\.hash\b/,
   /addEventListener\(['"]hashchange['"]/
 ];
-var HASH_TEMPLATE_PATTERN = /['"`]#\//;
+var HASH_TEMPLATE_PATTERN = /['"`]\/?#\//;
 async function scanDirForPattern(dir, patterns, maxDepth = 6, maxFiles = 2e3) {
   const { readdir: readdir2, readFile: readFile3 } = await import("fs/promises");
   const { join: join11 } = await import("path");
@@ -1294,6 +1296,19 @@ async function collectMcpSources(root, home) {
   }
   return { sources, invalid };
 }
+function claudeOAuthCannotDiscover(entry, url) {
+  let host;
+  try {
+    host = new URL(url).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  if (!host.endsWith(".supabase.co")) return false;
+  const headers = isJsonObject(entry.headers) ? Object.keys(entry.headers).map((h) => h.toLowerCase()) : [];
+  if (headers.includes("authorization") || headers.includes("x-mushi-api-key")) return false;
+  const oauth = isJsonObject(entry.oauth) ? entry.oauth : {};
+  return typeof oauth.authServerMetadataUrl !== "string" || oauth.authServerMetadataUrl.length === 0;
+}
 function assessMushiEntry(source, name, entry, cliKeySaved) {
   const label = `${name} (${source.path})`;
   if (!isJsonObject(entry)) return { usable: false, stdio: false, detail: `${label}: not an object` };
@@ -1305,6 +1320,13 @@ function assessMushiEntry(source, name, entry, cliKeySaved) {
         detail: `${label}: has a url but no "type": "http" \u2014 Claude Code skips it`
       };
     }
+    if (source.claudeCode && claudeOAuthCannotDiscover(entry, entry.url)) {
+      return {
+        usable: false,
+        stdio: false,
+        detail: `${label}: Claude Code sign-in cannot find OAuth metadata on a supabase.co URL ("Dynamic Client Registration rejected (HTTP 404)") \u2014 use ${CLOUD_MCP_OAUTH_URL} for Mushi Cloud, or add "oauth": { "authServerMetadataUrl": "<url>/.well-known/oauth-authorization-server" }`
+      };
+    }
     return { usable: true, stdio: false, detail: `${label}: hosted OAuth \u2014 sign in from the IDE's MCP panel` };
   }
   const env = isJsonObject(entry.env) ? entry.env : {};
@@ -1524,7 +1546,7 @@ async function checkOnboardingStatus(config, _consoleBase, cwd, doFetch = global
 }
 async function checkVersionDrift(cwd, doFetch) {
   const checks = [];
-  const { MUSHI_CLI_VERSION: MUSHI_CLI_VERSION2 } = await import("./version-HJSICWYN.js");
+  const { MUSHI_CLI_VERSION: MUSHI_CLI_VERSION2 } = await import("./version-AAAJ5462.js");
   if (MUSHI_CLI_VERSION2 === "0.0.0-dev") return checks;
   const parse2 = (v) => {
     const m = v.replace(/^[~^]/, "").match(/^(\d+)\.(\d+)\.(\d+)/);
@@ -1641,7 +1663,7 @@ async function runDoctor(config, options = {}) {
   }
   if (sdkCheck) checks.push(sdkCheck);
   if (sdkCheck?.ok && !sdkCheck.warn) {
-    const { findSdkImport } = await import("./snippet-inject-CCXILWYZ.js");
+    const { findSdkImport } = await import("./snippet-inject-LPRWTQDE.js");
     const imported = await findSdkImport(options.cwd ?? process.cwd());
     checks.push(
       imported ? { name: "SDK init snippet wired", ok: true, detail: `Found SDK usage in ${imported.file}` } : {
@@ -1769,7 +1791,7 @@ async function runInit(options = {}) {
   const framework = await chooseFramework(detected, options);
   const consoleBase = await resolveConsoleUrl({ cwd });
   const endpoint = resolveCloudEndpoint(
-    options.endpoint ?? process.env.MUSHI_API_ENDPOINT?.trim() ?? loadConfig().endpoint
+    firstEndpoint(options.endpoint, process.env.MUSHI_API_ENDPOINT, loadConfig().endpoint)
   );
   options = { ...options, endpoint };
   const credentials = await acquireCredentials(options, consoleBase, endpoint);
@@ -2392,7 +2414,7 @@ function emitWizardFunnelEvent(credentials, endpoint, event, metadata = {}) {
 }
 async function maybeInjectSnippet(cwd, framework, options) {
   if (options.yes || !process.stdin.isTTY) return;
-  const { ENTRY_CANDIDATES, injectSnippet, MUSHI_MARKER_START } = await import("./snippet-inject-CCXILWYZ.js");
+  const { ENTRY_CANDIDATES, injectSnippet, MUSHI_MARKER_START } = await import("./snippet-inject-LPRWTQDE.js");
   const candidates = ENTRY_CANDIDATES[framework.id];
   if (!candidates) return;
   const { readFile: readFile3, writeFile: writeFile3 } = await import("fs/promises");
@@ -2448,7 +2470,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect: runConnect2 } = await import("./connect-RZUYFR66.js");
+    const { runConnect: runConnect2 } = await import("./connect-36PCIH7N.js");
     const saved = loadConfig();
     const result = await runConnect2(
       {
@@ -2862,6 +2884,7 @@ Examples:
       const safeValue = key === "endpoint" ? assertEndpoint(value) : value;
       config[key] = safeValue;
       saveConfig(config);
+      if (key === "apiKey") syncKeychainAfterKeyChange(safeValue, resolveProfileName());
       console.log(`\u2713 Set ${key}`);
     } else {
       const safe = {
@@ -3673,7 +3696,8 @@ async function writeProjectBootstrapFiles(opts) {
   try {
     existing = await readFile2(envPath, "utf8");
     envUpdated = true;
-  } catch {
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
   }
   const MUSHI_LINE_RE = /^(NEXT_PUBLIC_|NUXT_PUBLIC_|VITE_|EXPO_PUBLIC_)?MUSHI_[A-Z_]+=.*/gm;
   const MUSHI_COMMENT_RE = /^# Mushi MCP\b.*/gm;
@@ -3715,7 +3739,7 @@ Typical first-time flow:
   # mushi whoami to confirm`).action(async (opts) => {
     const savedConfig = loadConfig();
     const endpoint = resolveCloudEndpoint(
-      opts.endpoint ?? process.env.MUSHI_API_ENDPOINT?.trim() ?? savedConfig.endpoint
+      firstEndpoint(opts.endpoint, process.env.MUSHI_API_ENDPOINT, savedConfig.endpoint)
     );
     const consoleBase = await resolveConsoleUrl();
     console.log("");
@@ -3867,7 +3891,14 @@ function buildSetupServerBlock(opts) {
       note: "Note: endpoint does not end in /api \u2014 cannot derive the hosted MCP URL; writing a local stdio entry instead."
     };
   }
-  return { block: buildHostedMcpServerBlock(hostedUrl), hosted: true };
+  return { block: hostedOAuthBlock(opts.ide, opts.endpoint, hostedUrl), hosted: true };
+}
+function hostedOAuthBlock(ide, endpoint, hostedUrl) {
+  if (endpoint.replace(/\/+$/, "") === CLOUD_API_ENDPOINT) return buildHostedMcpServerBlock(CLOUD_MCP_OAUTH_URL);
+  if (ide !== "claude") return buildHostedMcpServerBlock(hostedUrl);
+  return buildHostedMcpServerBlock(hostedUrl, {
+    authServerMetadataUrl: `${hostedUrl}/.well-known/oauth-authorization-server`
+  });
 }
 function buildZedServerBlock(opts) {
   const { env } = buildMcpServerBlock({ ...opts, client: "zed" });
@@ -4681,17 +4712,17 @@ function registerNudgeCommand(program2) {
     }
     const phase = opts.phase;
     const overrides = {};
-    const parseNumericFlag = (flag, raw, min) => {
+    const parseNumericFlag = (flag, raw, min, integer = false) => {
       const n = Number(raw);
-      if (!Number.isFinite(n) || n < min) {
+      if (!Number.isFinite(n) || n < min || integer && !Number.isInteger(n)) {
         console.error(
-          `error: --${flag} must be a finite number >= ${min} (got "${raw}")`
+          `error: --${flag} must be a finite ${integer ? "integer" : "number"} >= ${min} (got "${raw}")`
         );
         process.exit(1);
       }
       return n;
     };
-    if (opts.max !== void 0) overrides.maxProactivePerSession = parseNumericFlag("max", opts.max, 1);
+    if (opts.max !== void 0) overrides.maxProactivePerSession = parseNumericFlag("max", opts.max, 1, true);
     if (opts.cooldown !== void 0) overrides.dismissCooldownHours = parseNumericFlag("cooldown", opts.cooldown, 0);
     if (opts.dwell !== void 0) overrides.pageDwellMinutes = parseNumericFlag("dwell", opts.dwell, 0);
     if (opts.welcome !== void 0) overrides.firstSessionSeconds = parseNumericFlag("welcome", opts.welcome, 0);
@@ -5373,6 +5404,7 @@ function registerKeysCommands(program2) {
     const oldPrefix = oldKey?.slice(0, 12) ?? "(none)";
     config.apiKey = newKey;
     saveConfig(config);
+    syncKeychainAfterKeyChange(newKey, resolveProfileName());
     let serverRevoked = false;
     if (oldKey && config.projectId) {
       const revokeResult = await revokeProjectKey(

package/dist/init.d.ts

@@ -87,8 +87,9 @@ declare function createProject(endpoint: string, cliToken: string, name: string,
 /**
  * Mint a fresh report:write key for an existing project (raw keys can't be
  * recovered, so selecting a project always mints a new one). Throws
- * DeviceAuthRequestError on failure (after one transient retry) so the wizard
- * can tell the user WHY minting failed instead of a bare "could not mint".
+ * DeviceAuthRequestError on failure (a single attempt, no retry — minting isn't
+ * idempotent) so the wizard can tell the user WHY minting failed instead of a
+ * bare "could not mint".
  */
 declare function mintProjectKey(endpoint: string, cliToken: string, projectId: string, opts?: {
     /**

package/dist/init.js

@@ -25,10 +25,10 @@ import {
   saveConfig,
   savedSdkKeyFor,
   trySaveKeyToKeychain
-} from "./chunk-LBVNX3PN.js";
+} from "./chunk-EZJN53QO.js";
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-ZQFQRBNL.js";
+} from "./chunk-AZZNO4T4.js";
 import {
   FRAMEWORKS,
   detectFramework,
@@ -39,11 +39,12 @@ import {
 } from "./chunk-AIZRI665.js";
 import {
   CLOUD_API_ENDPOINT,
+  CLOUD_MCP_OAUTH_URL,
   TEST_REPORT_FETCH_TIMEOUT_MS,
+  firstEndpoint,
   normalizeEndpoint,
   resolveCloudEndpoint
-} from "./chunk-SXSI2W6Z.js";
-import "./chunk-3RG5ZIWI.js";
+} from "./chunk-2DMHQVRU.js";
 
 // src/init.ts
 import * as p from "@clack/prompts";
@@ -860,7 +861,7 @@ var HASH_ROUTER_PATTERNS = [
   /location\.hash\b/,
   /addEventListener\(['"]hashchange['"]/
 ];
-var HASH_TEMPLATE_PATTERN = /['"`]#\//;
+var HASH_TEMPLATE_PATTERN = /['"`]\/?#\//;
 async function scanDirForPattern(dir, patterns, maxDepth = 6, maxFiles = 2e3) {
   const { readdir, readFile } = await import("fs/promises");
   const { join: join3 } = await import("path");
@@ -969,6 +970,19 @@ async function collectMcpSources(root, home) {
   }
   return { sources, invalid };
 }
+function claudeOAuthCannotDiscover(entry, url) {
+  let host;
+  try {
+    host = new URL(url).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  if (!host.endsWith(".supabase.co")) return false;
+  const headers = isJsonObject(entry.headers) ? Object.keys(entry.headers).map((h) => h.toLowerCase()) : [];
+  if (headers.includes("authorization") || headers.includes("x-mushi-api-key")) return false;
+  const oauth = isJsonObject(entry.oauth) ? entry.oauth : {};
+  return typeof oauth.authServerMetadataUrl !== "string" || oauth.authServerMetadataUrl.length === 0;
+}
 function assessMushiEntry(source, name, entry, cliKeySaved) {
   const label = `${name} (${source.path})`;
   if (!isJsonObject(entry)) return { usable: false, stdio: false, detail: `${label}: not an object` };
@@ -980,6 +994,13 @@ function assessMushiEntry(source, name, entry, cliKeySaved) {
         detail: `${label}: has a url but no "type": "http" \u2014 Claude Code skips it`
       };
     }
+    if (source.claudeCode && claudeOAuthCannotDiscover(entry, entry.url)) {
+      return {
+        usable: false,
+        stdio: false,
+        detail: `${label}: Claude Code sign-in cannot find OAuth metadata on a supabase.co URL ("Dynamic Client Registration rejected (HTTP 404)") \u2014 use ${CLOUD_MCP_OAUTH_URL} for Mushi Cloud, or add "oauth": { "authServerMetadataUrl": "<url>/.well-known/oauth-authorization-server" }`
+      };
+    }
     return { usable: true, stdio: false, detail: `${label}: hosted OAuth \u2014 sign in from the IDE's MCP panel` };
   }
   const env = isJsonObject(entry.env) ? entry.env : {};
@@ -1230,7 +1251,7 @@ async function runDoctor(config, options = {}) {
   }
   if (sdkCheck) checks.push(sdkCheck);
   if (sdkCheck?.ok && !sdkCheck.warn) {
-    const { findSdkImport } = await import("./snippet-inject-7ABYE57O.js");
+    const { findSdkImport } = await import("./snippet-inject-NDAPEL2T.js");
     const imported = await findSdkImport(options.cwd ?? process.cwd());
     checks.push(
       imported ? { name: "SDK init snippet wired", ok: true, detail: `Found SDK usage in ${imported.file}` } : {
@@ -1358,7 +1379,7 @@ async function runInit(options = {}) {
   const framework = await chooseFramework(detected, options);
   const consoleBase = await resolveConsoleUrl({ cwd });
   const endpoint = resolveCloudEndpoint(
-    options.endpoint ?? process.env.MUSHI_API_ENDPOINT?.trim() ?? loadConfig().endpoint
+    firstEndpoint(options.endpoint, process.env.MUSHI_API_ENDPOINT, loadConfig().endpoint)
   );
   options = { ...options, endpoint };
   const credentials = await acquireCredentials(options, consoleBase, endpoint);
@@ -1981,7 +2002,7 @@ function emitWizardFunnelEvent(credentials, endpoint, event, metadata = {}) {
 }
 async function maybeInjectSnippet(cwd, framework, options) {
   if (options.yes || !process.stdin.isTTY) return;
-  const { ENTRY_CANDIDATES, injectSnippet, MUSHI_MARKER_START } = await import("./snippet-inject-7ABYE57O.js");
+  const { ENTRY_CANDIDATES, injectSnippet, MUSHI_MARKER_START } = await import("./snippet-inject-NDAPEL2T.js");
   const candidates = ENTRY_CANDIDATES[framework.id];
   if (!candidates) return;
   const { readFile, writeFile } = await import("fs/promises");
@@ -2037,7 +2058,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect } = await import("./connect-Y77XNVUP.js");
+    const { runConnect } = await import("./connect-TY6YTXQD.js");
     const saved = loadConfig();
     const result = await runConnect(
       {

package/dist/{snippet-inject-CCXILWYZ.js → snippet-inject-LPRWTQDE.js}

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-import "./chunk-PDX44BCA.js";
 
 // src/snippet-inject.ts
 import { readFile, readdir } from "fs/promises";

package/dist/{snippet-inject-7ABYE57O.js → snippet-inject-NDAPEL2T.js}

@@ -1,5 +1,3 @@
-import "./chunk-3RG5ZIWI.js";
-
 // src/snippet-inject.ts
 import { readFile, readdir } from "fs/promises";
 import { join } from "path";

package/dist/{version-HJSICWYN.js → version-AAAJ5462.js}

@@ -2,8 +2,7 @@
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-VJZVFEMZ.js";
-import "./chunk-PDX44BCA.js";
+} from "./chunk-LKC2BEKQ.js";
 export {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC

package/dist/version.d.ts

@@ -14,6 +14,6 @@ declare const MUSHI_CLI_VERSION: string;
  * setup refreshes the pin. Synced to packages/mcp/package.json by
  * `scripts/sync-mcp-pin.mjs` — never hand-edit the version.
  */
-declare const MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.24.6";
+declare const MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.26.0";
 
 export { MUSHI_CLI_VERSION, MUSHI_MCP_PIN_SPEC };

package/dist/version.js

@@ -1,8 +1,7 @@
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-ZQFQRBNL.js";
-import "./chunk-3RG5ZIWI.js";
+} from "./chunk-AZZNO4T4.js";
 export {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC

package/dist/wizard-args.js

@@ -2,7 +2,6 @@ import {
   FRAMEWORK_IDS,
   isFrameworkId
 } from "./chunk-AIZRI665.js";
-import "./chunk-3RG5ZIWI.js";
 
 // src/wizard-args.ts
 var MIN_NODE_MAJOR = 20;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mushi-mushi/cli",
-  "version": "0.30.3",
+  "version": "0.30.5",
   "license": "MIT",
   "description": "Mushi CLI: SDK setup, MCP wiring, bug triage. The bug mediator for AI-built apps: plain-English diagnosis + a ready fix, in your editor.",
   "bin": {

package/dist/chunk-3RG5ZIWI.js

@@ -1,10 +0,0 @@
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
-
-export {
-  __require
-};

package/dist/chunk-PDX44BCA.js

@@ -1,11 +0,0 @@
-#!/usr/bin/env node
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
-
-export {
-  __require
-};

package/dist/chunk-VJZVFEMZ.js

@@ -1,10 +0,0 @@
-#!/usr/bin/env node
-
-// src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.30.3" : "0.0.0-dev";
-var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.24.6";
-
-export {
-  MUSHI_CLI_VERSION,
-  MUSHI_MCP_PIN_SPEC
-};

package/dist/chunk-ZQFQRBNL.js

@@ -1,8 +0,0 @@
-// src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.30.3" : "0.0.0-dev";
-var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.24.6";
-
-export {
-  MUSHI_CLI_VERSION,
-  MUSHI_MCP_PIN_SPEC
-};