@mushi-mushi/cli 0.34.0 → 0.35.0

package/dist/{chunk-VECP4KOK.js → chunk-T36WTCFM.js}

@@ -1,29 +1,143 @@
 #!/usr/bin/env node
 import {
-  MUSHI_CLI_VERSION,
-  MUSHI_MCP_PIN_SPEC
-} from "./chunk-FPVAQNHT.js";
+  MUSHI_CLI_VERSION
+} from "./chunk-GNTEONTU.js";
 import {
   CLOUD_API_ENDPOINT,
-  assertEndpoint,
   normalizeEndpoint
 } from "./chunk-LGGE3LH7.js";
-import {
-  detectFramework,
-  envVarsToWrite,
-  readPackageJson
-} from "./chunk-KOBEOGNF.js";
 
-// src/connect.ts
-import { appendFile, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
-import { join as join3, resolve } from "path";
+// src/errors.ts
+var EXIT_CODE_MAP = {
+  E_AUTH_MISSING: 2,
+  E_AUTH_INVALID: 2,
+  E_PROJECT_MISSING: 2,
+  E_ENDPOINT_INVALID: 2,
+  E_INVALID_INPUT: 2,
+  E_NOT_INTERACTIVE: 2,
+  E_NETWORK: 3,
+  E_TIMEOUT: 3,
+  E_API_ERROR: 3,
+  E_RATE_LIMITED: 3,
+  E_FILE_NOT_FOUND: 1,
+  E_FILE_PERMISSION: 1,
+  E_FRESHNESS_STALE: 1,
+  E_INTERRUPTED: 130,
+  // 128 + SIGINT (2). POSIX convention.
+  E_INTERNAL: 1
+};
+var MushiCliError = class extends Error {
+  code;
+  hint;
+  cause;
+  constructor(code, message, hint, cause) {
+    super(message);
+    this.name = "MushiCliError";
+    this.code = code;
+    if (hint) this.hint = hint;
+    if (cause !== void 0) this.cause = cause;
+  }
+  /** Exit code POSIX-aware shell scripts should branch on. */
+  get exitCode() {
+    return EXIT_CODE_MAP[this.code];
+  }
+  /**
+   * Format for `--json` output. Used by the JSON writer when a CLI
+   * subcommand was invoked with `--json` and an error escapes.
+   */
+  toJSON() {
+    return {
+      error: {
+        code: this.code,
+        message: this.message,
+        ...this.hint ? { hint: this.hint } : {}
+      }
+    };
+  }
+};
+function printAndExit(err, asJson = false) {
+  const cliErr = err instanceof MushiCliError ? err : new MushiCliError(
+    "E_INTERNAL",
+    err instanceof Error ? err.message : String(err),
+    "this is unexpected \u2014 re-run with MUSHI_DEBUG=1 and report at https://github.com/kensaurus/mushi-mushi/issues",
+    err
+  );
+  if (asJson) {
+    process.stderr.write(JSON.stringify(cliErr.toJSON()) + "\n");
+  } else {
+    process.stderr.write(`error [${cliErr.code}]: ${cliErr.message}
+`);
+    if (cliErr.hint) process.stderr.write(`  \u2192 fix: ${cliErr.hint}
+`);
+  }
+  if (process.env.MUSHI_CLI_JSON_LOG === "1" || process.env.CI === "true") {
+    process.stderr.write(
+      JSON.stringify({
+        ts: (/* @__PURE__ */ new Date()).toISOString(),
+        level: "error",
+        scope: "mushi:cli",
+        ...cliErr.toJSON(),
+        exitCode: cliErr.exitCode
+      }) + "\n"
+    );
+  }
+  process.exit(cliErr.exitCode);
+}
 
-// src/config.ts
-import { randomUUID } from "crypto";
-import { spawnSync } from "child_process";
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
-import { homedir } from "os";
-import { dirname, join } from "path";
+// src/signals.ts
+var installed = false;
+var activeController = null;
+var interrupted = null;
+var cleanups = /* @__PURE__ */ new Set();
+var INTERRUPT_CLEANUP_MS = 8e3;
+function onInterrupt(fn) {
+  cleanups.add(fn);
+  return () => {
+    cleanups.delete(fn);
+  };
+}
+function interruptedBy() {
+  return interrupted;
+}
+async function handleInterrupt(signal, exit = (code) => process.exit(code), budgetMs = INTERRUPT_CLEANUP_MS) {
+  const code = signal === "SIGINT" ? 130 : signal === "SIGTERM" ? 143 : 1;
+  if (interrupted) {
+    exit(code);
+    return;
+  }
+  interrupted = signal;
+  activeController?.abort(
+    new MushiCliError(
+      "E_INTERRUPTED",
+      `aborted by ${signal}`,
+      "partial state on the server is safe to retry \u2014 re-run the same command"
+    )
+  );
+  if (cleanups.size) {
+    let timer;
+    const budget = new Promise((resolve) => {
+      timer = setTimeout(resolve, budgetMs);
+    });
+    const all = Promise.allSettled([...cleanups].map(async (fn) => fn(signal)));
+    await Promise.race([all, budget]);
+    clearTimeout(timer);
+  }
+  await new Promise((resolve) => process.nextTick(resolve));
+  exit(code);
+}
+function installSignalHandlers() {
+  if (installed) return;
+  installed = true;
+  process.on("SIGINT", () => void handleInterrupt("SIGINT"));
+  process.on("SIGTERM", () => void handleInterrupt("SIGTERM"));
+}
+function getAbortSignal(external) {
+  if (external) return external.signal;
+  if (!activeController || activeController.signal.aborted) {
+    activeController = new AbortController();
+  }
+  return activeController.signal;
+}
 
 // src/keychain.ts
 import { createRequire } from "module";
@@ -44,12 +158,19 @@ function getEntryClass() {
   }
   return _EntryClass ?? null;
 }
+function isKeychainEnabled() {
+  if (process.env["MUSHI_NO_KEYCHAIN"]) return false;
+  return getEntryClass() !== null;
+}
 function trySaveKeyToKeychain(apiKey, profile = "default") {
+  return saveSecret(accountName(profile), apiKey);
+}
+function saveSecret(account, apiKey) {
   if (!apiKey) return false;
   const EntryClass = getEntryClass();
   if (!EntryClass) return false;
   try {
-    const entry = new EntryClass(KEYCHAIN_SERVICE, accountName(profile));
+    const entry = new EntryClass(KEYCHAIN_SERVICE, account);
     entry.setPassword(apiKey);
     return true;
   } catch {
@@ -57,10 +178,13 @@ function trySaveKeyToKeychain(apiKey, profile = "default") {
   }
 }
 function tryLoadKeyFromKeychain(profile = "default") {
+  return loadSecret(accountName(profile));
+}
+function loadSecret(account) {
   const EntryClass = getEntryClass();
   if (!EntryClass) return null;
   try {
-    const entry = new EntryClass(KEYCHAIN_SERVICE, accountName(profile));
+    const entry = new EntryClass(KEYCHAIN_SERVICE, account);
     const key = entry.getPassword();
     return key && key.length > 0 ? key : null;
   } catch {
@@ -68,10 +192,13 @@ function tryLoadKeyFromKeychain(profile = "default") {
   }
 }
 function tryDeleteKeyFromKeychain(profile = "default") {
+  deleteSecret(accountName(profile));
+}
+function deleteSecret(account) {
   const EntryClass = getEntryClass();
   if (!EntryClass) return;
   try {
-    const entry = new EntryClass(KEYCHAIN_SERVICE, accountName(profile));
+    const entry = new EntryClass(KEYCHAIN_SERVICE, account);
     entry.deletePassword();
   } catch {
   }
@@ -82,8 +209,23 @@ function syncKeychainAfterKeyChange(apiKey, profile = "default") {
   tryDeleteKeyFromKeychain(profile);
   return "removed";
 }
+var WORKER_KEY_ACCOUNT = "worker-key";
+function trySaveWorkerKey(key) {
+  return saveSecret(WORKER_KEY_ACCOUNT, key);
+}
+function tryLoadWorkerKey() {
+  return loadSecret(WORKER_KEY_ACCOUNT);
+}
+function tryDeleteWorkerKey() {
+  deleteSecret(WORKER_KEY_ACCOUNT);
+}
 
 // src/config.ts
+import { randomUUID } from "crypto";
+import { spawnSync } from "child_process";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
 var DEFAULT_PROFILE = "default";
 function isMultiProfileFile(value) {
   return typeof value === "object" && value !== null && "profiles" in value && typeof value.profiles === "object" && value.profiles !== null;
@@ -308,138 +450,6 @@ function tightenWindowsAcl(path, type) {
   }
 }
 
-// src/errors.ts
-var EXIT_CODE_MAP = {
-  E_AUTH_MISSING: 2,
-  E_AUTH_INVALID: 2,
-  E_PROJECT_MISSING: 2,
-  E_ENDPOINT_INVALID: 2,
-  E_INVALID_INPUT: 2,
-  E_NOT_INTERACTIVE: 2,
-  E_NETWORK: 3,
-  E_TIMEOUT: 3,
-  E_API_ERROR: 3,
-  E_RATE_LIMITED: 3,
-  E_FILE_NOT_FOUND: 1,
-  E_FILE_PERMISSION: 1,
-  E_FRESHNESS_STALE: 1,
-  E_INTERRUPTED: 130,
-  // 128 + SIGINT (2). POSIX convention.
-  E_INTERNAL: 1
-};
-var MushiCliError = class extends Error {
-  code;
-  hint;
-  cause;
-  constructor(code, message, hint, cause) {
-    super(message);
-    this.name = "MushiCliError";
-    this.code = code;
-    if (hint) this.hint = hint;
-    if (cause !== void 0) this.cause = cause;
-  }
-  /** Exit code POSIX-aware shell scripts should branch on. */
-  get exitCode() {
-    return EXIT_CODE_MAP[this.code];
-  }
-  /**
-   * Format for `--json` output. Used by the JSON writer when a CLI
-   * subcommand was invoked with `--json` and an error escapes.
-   */
-  toJSON() {
-    return {
-      error: {
-        code: this.code,
-        message: this.message,
-        ...this.hint ? { hint: this.hint } : {}
-      }
-    };
-  }
-};
-function printAndExit(err, asJson = false) {
-  const cliErr = err instanceof MushiCliError ? err : new MushiCliError(
-    "E_INTERNAL",
-    err instanceof Error ? err.message : String(err),
-    "this is unexpected \u2014 re-run with MUSHI_DEBUG=1 and report at https://github.com/kensaurus/mushi-mushi/issues",
-    err
-  );
-  if (asJson) {
-    process.stderr.write(JSON.stringify(cliErr.toJSON()) + "\n");
-  } else {
-    process.stderr.write(`error [${cliErr.code}]: ${cliErr.message}
-`);
-    if (cliErr.hint) process.stderr.write(`  \u2192 fix: ${cliErr.hint}
-`);
-  }
-  if (process.env.MUSHI_CLI_JSON_LOG === "1" || process.env.CI === "true") {
-    process.stderr.write(
-      JSON.stringify({
-        ts: (/* @__PURE__ */ new Date()).toISOString(),
-        level: "error",
-        scope: "mushi:cli",
-        ...cliErr.toJSON(),
-        exitCode: cliErr.exitCode
-      }) + "\n"
-    );
-  }
-  process.exit(cliErr.exitCode);
-}
-
-// src/signals.ts
-var installed = false;
-var activeController = null;
-var interrupted = null;
-var cleanups = /* @__PURE__ */ new Set();
-var INTERRUPT_CLEANUP_MS = 8e3;
-function onInterrupt(fn) {
-  cleanups.add(fn);
-  return () => {
-    cleanups.delete(fn);
-  };
-}
-function interruptedBy() {
-  return interrupted;
-}
-async function handleInterrupt(signal, exit = (code) => process.exit(code), budgetMs = INTERRUPT_CLEANUP_MS) {
-  const code = signal === "SIGINT" ? 130 : signal === "SIGTERM" ? 143 : 1;
-  if (interrupted) {
-    exit(code);
-    return;
-  }
-  interrupted = signal;
-  activeController?.abort(
-    new MushiCliError(
-      "E_INTERRUPTED",
-      `aborted by ${signal}`,
-      "partial state on the server is safe to retry \u2014 re-run the same command"
-    )
-  );
-  if (cleanups.size) {
-    let timer;
-    const budget = new Promise((resolve2) => {
-      timer = setTimeout(resolve2, budgetMs);
-    });
-    const all = Promise.allSettled([...cleanups].map(async (fn) => fn(signal)));
-    await Promise.race([all, budget]);
-    clearTimeout(timer);
-  }
-  await new Promise((resolve2) => process.nextTick(resolve2));
-  exit(code);
-}
-function installSignalHandlers() {
-  if (installed) return;
-  installed = true;
-  process.on("SIGINT", () => void handleInterrupt("SIGINT"));
-  process.on("SIGTERM", () => void handleInterrupt("SIGTERM"));
-}
-function getAbortSignal(external) {
-  if (external) return external.signal;
-  if (!activeController || activeController.signal.aborted) {
-    activeController = new AbortController();
-  }
-  return activeController.signal;
-}
-
 // src/console-url.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { dirname as dirname2, join as join2 } from "path";
@@ -544,14 +554,14 @@ async function openInBrowser(url) {
     // is handed to the default browser as one opaque argument.
     ["rundll32", ["url.dll,FileProtocolHandler", safeUrl]]
   ) : process.platform === "darwin" ? ["open", [safeUrl]] : ["xdg-open", [safeUrl]];
-  await new Promise((resolve2) => {
+  await new Promise((resolve) => {
     try {
       const child = spawn(command, [...args], { stdio: "ignore", shell: false, detached: process.platform !== "win32" });
-      child.once("spawn", () => resolve2());
-      child.once("error", () => resolve2());
+      child.once("spawn", () => resolve());
+      child.once("error", () => resolve());
       child.unref();
     } catch {
-      resolve2();
+      resolve();
     }
   });
 }
@@ -752,389 +762,6 @@ function pad(s, width) {
   return s.length >= width ? s : s + " ".repeat(width - s.length);
 }
 
-// src/sanitize-config.ts
-var PROJECT_ID_RE = /^(?:proj_[A-Za-z0-9_-]{10,}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
-var API_KEY_RE = /^(mushi_|mush_pk_)[A-Za-z0-9_-]{10,}$/;
-function sanitizeApiKey(raw) {
-  const key = raw.replace(/[\r\n\0]/g, "");
-  if (!API_KEY_RE.test(key)) {
-    throw new Error(
-      "Invalid API key in config \u2014 run `mushi login --api-key <key>` to refresh credentials."
-    );
-  }
-  return key;
-}
-function sanitizeProjectId(raw) {
-  const id = raw.trim();
-  if (!PROJECT_ID_RE.test(id)) {
-    throw new Error(
-      "Invalid project ID in config \u2014 expected a UUID or proj_* slug from the admin console."
-    );
-  }
-  return id;
-}
-function sanitizeEndpoint(raw) {
-  return assertEndpoint(normalizeEndpoint(raw));
-}
-function sanitizeCliCredentials(config) {
-  if (!config.endpoint || !config.apiKey || !config.projectId) {
-    throw new Error("Missing endpoint, apiKey, or projectId");
-  }
-  return {
-    endpoint: sanitizeEndpoint(config.endpoint),
-    apiKey: sanitizeApiKey(config.apiKey),
-    projectId: sanitizeProjectId(config.projectId)
-  };
-}
-function apiKeyHeaders(apiKey, projectId) {
-  const headers = {
-    Authorization: `Bearer ${apiKey}`,
-    "X-Mushi-Api-Key": apiKey
-  };
-  if (projectId) headers["X-Mushi-Project"] = projectId;
-  return headers;
-}
-
-// src/heartbeat-wait.ts
-var IngestSetupHttpError = class extends Error {
-  status;
-  constructor(status) {
-    super(`ingest-setup HTTP ${status}`);
-    this.name = "IngestSetupHttpError";
-    this.status = status;
-  }
-};
-var NON_RETRYABLE_STATUSES = /* @__PURE__ */ new Set([401, 403, 404]);
-async function fetchIngestSetup(config, doFetch = globalThis.fetch) {
-  const endpoint = sanitizeEndpoint(config.endpoint);
-  const apiKey = sanitizeApiKey(config.apiKey);
-  const projectId = config.projectId ? sanitizeProjectId(config.projectId) : void 0;
-  const res = await doFetch(`${endpoint}/v1/sync/ingest-setup`, {
-    headers: apiKeyHeaders(apiKey, projectId),
-    signal: AbortSignal.timeout(8e3)
-  });
-  if (!res.ok) {
-    if (NON_RETRYABLE_STATUSES.has(res.status)) throw new IngestSetupHttpError(res.status);
-    return null;
-  }
-  const body = await res.json();
-  return body.ok && body.data ? body.data : null;
-}
-async function waitForIngestReady(options) {
-  const doFetch = options.fetch ?? globalThis.fetch;
-  const maxAttempts = options.maxAttempts ?? 40;
-  const intervalMs = options.intervalMs ?? 3e3;
-  let lastPayload = null;
-  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-    if (options.signal?.aborted) {
-      return { ok: false, payload: lastPayload, attempts: attempt - 1, reason: "aborted" };
-    }
-    try {
-      lastPayload = await fetchIngestSetup(
-        { endpoint: options.endpoint, apiKey: options.apiKey, projectId: options.projectId },
-        doFetch
-      );
-      if (lastPayload) {
-        options.onPoll?.(lastPayload, attempt);
-        if (lastPayload.ready) {
-          return { ok: true, payload: lastPayload, attempts: attempt, reason: "ready" };
-        }
-        const sdkStep = lastPayload.steps.find((s) => s.id === "sdk_installed");
-        if (sdkStep?.complete) {
-          return { ok: true, payload: lastPayload, attempts: attempt, reason: "heartbeat" };
-        }
-      }
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      if (err instanceof IngestSetupHttpError) {
-        return { ok: false, payload: lastPayload, attempts: attempt, reason: "unauthorized", error: msg };
-      }
-      if (options.signal?.aborted) {
-        return { ok: false, payload: lastPayload, attempts: attempt, reason: "aborted", error: msg };
-      }
-      if (attempt === maxAttempts) {
-        return { ok: false, payload: lastPayload, attempts: attempt, reason: "fetch-error", error: msg };
-      }
-    }
-    if (attempt < maxAttempts) {
-      await new Promise((r) => setTimeout(r, intervalMs));
-    }
-  }
-  return { ok: false, payload: lastPayload, attempts: maxAttempts, reason: "timeout" };
-}
-
-// src/key-scopes.ts
-var SDK_KEY_SCOPES = ["report:write"];
-var CLI_KEY_SCOPES = ["report:write", "mcp:read"];
-var FULL_CLI_KEY_SCOPES = ["report:write", "mcp:read", "mcp:write"];
-var SDK_KEY_LABEL = "sdk-ingest";
-var CLI_KEY_LABEL = "cli-login";
-async function probeKeyScope(endpoint, apiKey, projectId, doFetch = globalThis.fetch) {
-  let base = endpoint;
-  while (base.endsWith("/")) base = base.slice(0, -1);
-  let res;
-  try {
-    res = await doFetch(`${base}/v1/admin/mcp/account-overview`, {
-      headers: { "X-Mushi-Api-Key": apiKey, "X-Mushi-Project": projectId },
-      signal: AbortSignal.timeout(8e3)
-    });
-  } catch (err) {
-    return { result: "unreachable", message: err instanceof Error ? err.message : String(err) };
-  }
-  if (res.ok) return { result: "mcp", status: res.status };
-  if (res.status === 401) return { result: "invalid", status: res.status };
-  if (res.status === 403) {
-    const body = await res.json().catch(() => null);
-    const code = body?.error?.code ?? body?.code;
-    if (code === "INSUFFICIENT_SCOPE") return { result: "ingest-only", status: res.status };
-  }
-  return { result: "unknown", status: res.status };
-}
-function describeUnsafeSdkKey(probe, endpoint) {
-  switch (probe.result) {
-    case "mcp":
-      return "this key can read your bug reports (mcp scope), and SDK env vars ship inside the app bundle";
-    case "invalid":
-      return "the backend rejected this key";
-    case "unreachable":
-      return `could not reach ${endpoint} to confirm the key is ingest-only (${probe.message ?? "network error"})`;
-    case "unknown":
-      return `could not confirm the key is ingest-only (HTTP ${probe.status ?? "?"})`;
-    case "ingest-only":
-      return "the key is ingest-only";
-  }
-}
-
-// src/mcp-config.ts
-import { mkdir, readFile, writeFile } from "fs/promises";
-import { dirname as dirname3 } from "path";
-var DEFAULT_MUSHI_FEATURES = "triage,fixes,inventory,setup,docs";
-var MCP_CLIENTS = ["cursor", "claude", "continue", "zed"];
-function isMcpClient(value) {
-  return typeof value === "string" && MCP_CLIENTS.includes(value);
-}
-var MCP_CLIENT_LABEL = {
-  cursor: "Cursor",
-  claude: "Claude Code",
-  continue: "Continue",
-  zed: "Zed"
-};
-function buildHostedMcpServerBlock(url, oauth) {
-  return oauth ? { type: "http", url, oauth } : { type: "http", url };
-}
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-async function writeMcpServerEntry(opts) {
-  const { configPath, serverName, serverBlock, dryRun = false } = opts;
-  let existing = null;
-  try {
-    existing = await readFile(configPath, "utf8");
-  } catch {
-    existing = null;
-  }
-  let merged = {};
-  if (existing !== null && existing.trim() !== "") {
-    let parsed;
-    try {
-      parsed = JSON.parse(existing);
-    } catch {
-      throw new Error(`${configPath} is not valid JSON \u2014 fix or remove it, then re-run (nothing was written).`);
-    }
-    if (!isPlainObject(parsed)) {
-      throw new Error(`${configPath} is not a JSON object \u2014 fix or remove it, then re-run (nothing was written).`);
-    }
-    merged = parsed;
-  }
-  const currentServers = merged.mcpServers;
-  if (currentServers !== void 0 && !isPlainObject(currentServers)) {
-    throw new Error(`${configPath} has an "mcpServers" field that is not an object \u2014 fix it, then re-run (nothing was written).`);
-  }
-  merged.mcpServers = { ...currentServers ?? {}, [serverName]: serverBlock };
-  const output = JSON.stringify(merged, null, 2) + "\n";
-  if (!dryRun) {
-    await mkdir(dirname3(configPath), { recursive: true });
-    await writeFile(configPath, output, "utf8");
-  }
-  return { created: existing === null, path: configPath };
-}
-function apiKeyPlaceholderFor(client) {
-  switch (client) {
-    case "cursor":
-      return "${env:MUSHI_API_KEY}";
-    case "claude":
-      return "${MUSHI_API_KEY:-}";
-    case "continue":
-    case "zed":
-      return null;
-  }
-}
-function buildMcpServerBlock(opts) {
-  const keyValue = opts.inlineKey ? opts.apiKey : apiKeyPlaceholderFor(opts.client);
-  return {
-    command: "npx",
-    args: ["-y", MUSHI_MCP_PIN_SPEC],
-    env: {
-      MUSHI_API_ENDPOINT: opts.endpoint,
-      MUSHI_PROJECT_ID: opts.projectId,
-      ...keyValue !== null ? { MUSHI_API_KEY: keyValue } : {},
-      MUSHI_FEATURES: DEFAULT_MUSHI_FEATURES
-    }
-  };
-}
-function printKeyExportHint(client, configPath = CONFIG_PATH) {
-  console.log("");
-  console.log("  No API key was written into the MCP config (safe to commit).");
-  console.log(`  The MCP server uses the key \`mushi login\` saved in ${configPath}.`);
-  if (apiKeyPlaceholderFor(client) !== null) {
-    console.log(`  To use a different key, export MUSHI_API_KEY in the environment ${MCP_CLIENT_LABEL[client]} is launched from.`);
-  }
-  console.log("  To write the key into the file instead (keep it out of git), re-run with --inline-key.");
-}
-function buildMcpServerName(opts) {
-  if (opts.legacy) return "mushi";
-  if (opts.projectName) {
-    const slug = opts.projectName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 24);
-    return `mushi-${slug}`;
-  }
-  return `mushi-${(opts.projectId ?? "unknown").slice(0, 8)}`;
-}
-
-// src/connect.ts
-async function resolveSdkEnvKey(opts) {
-  const candidate = opts.sdkKey ?? savedSdkKeyFor(opts.baseConfig, opts.projectId) ?? opts.apiKey;
-  const probe = await opts.probe(opts.endpoint, candidate, opts.projectId);
-  if (probe.result === "ingest-only") return { ok: true, key: candidate };
-  return { ok: false, reason: describeUnsafeSdkKey(probe, opts.endpoint) };
-}
-function envKeyPresent(content, key) {
-  const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  return new RegExp(`^${escaped}=`, "m").test(content);
-}
-async function mergeEnvFile(path, lines) {
-  const block = `
-# Mushi \u2014 added by mushi connect
-${lines.join("\n")}
-`;
-  let existing = null;
-  try {
-    existing = await readFile2(path, "utf8");
-  } catch {
-  }
-  if (existing !== null) {
-    const needs = lines.filter((line) => {
-      const key = line.split("=")[0];
-      return !envKeyPresent(existing, key);
-    });
-    if (needs.length === 0) return false;
-    await appendFile(path, `
-# Mushi \u2014 added by mushi connect
-${needs.join("\n")}
-`, "utf8");
-    return true;
-  }
-  await writeFile2(path, block, "utf8");
-  return true;
-}
-async function runConnect(opts, baseConfig = {}) {
-  const cwd = resolve(opts.cwd ?? process.cwd());
-  const endpoint = assertEndpoint(opts.endpoint);
-  const projectId = requireUuid(opts.projectId, "projectId");
-  const messages = [];
-  const writeEnv = opts.writeEnv !== false;
-  const sdkEnvKey = writeEnv ? await resolveSdkEnvKey({
-    sdkKey: opts.sdkKey,
-    apiKey: opts.apiKey,
-    projectId,
-    endpoint,
-    baseConfig,
-    probe: opts.probeKeyScope ?? probeKeyScope
-  }) : null;
-  const config = {
-    ...baseConfig,
-    apiKey: opts.apiKey,
-    projectId,
-    endpoint,
-    ...sdkEnvKey?.ok ? { sdkKey: { projectId, key: sdkEnvKey.key } } : {}
-  };
-  saveConfig(config);
-  messages.push(`\u2713 Credentials saved to ${CONFIG_PATH}`);
-  let envPath = null;
-  let envRefused = false;
-  if (sdkEnvKey && !sdkEnvKey.ok) {
-    envRefused = true;
-    messages.push(
-      `\u2717 Did not write SDK env vars: ${sdkEnvKey.reason}. Pass an ingest-only key with --sdk-key <key> (console \u2192 Projects \u2192 API keys, scope report:write), or run \`npx mushi-mushi\`, which mints one.`
-    );
-  } else if (sdkEnvKey?.ok) {
-    const pkg = readPackageJson(cwd);
-    const framework = detectFramework(cwd, pkg);
-    const lines = envVarsToWrite(sdkEnvKey.key, projectId, framework).split("\n");
-    envPath = join3(cwd, ".env.local");
-    const wrote = await mergeEnvFile(envPath, lines);
-    messages.push(
-      wrote ? `\u2713 Env vars merged into ${envPath}` : `\u2713 Env vars already present in ${envPath} (existing values left untouched)`
-    );
-    const deps = { ...pkg?.dependencies ?? {}, ...pkg?.devDependencies ?? {} };
-    if (deps["@capacitor/core"] && deps["react"]) {
-      messages.push(
-        "\u2139 Capacitor + React detected \u2014 install @mushi-mushi/web (or @mushi-mushi/react) and call initMushi() in main.tsx. Optional @mushi-mushi/capacitor for native shell parity."
-      );
-    }
-  }
-  let mcpPath = null;
-  if (opts.wireIde !== false) {
-    const mcpDir = join3(cwd, ".cursor");
-    mcpPath = join3(mcpDir, "mcp.json");
-    const serverName = buildMcpServerName({ projectId });
-    const serverBlock = buildMcpServerBlock({
-      endpoint,
-      projectId,
-      apiKey: opts.apiKey,
-      client: "cursor",
-      inlineKey: false
-      // no secret in the file; the MCP server reads the saved CLI key
-    });
-    await writeMcpServerEntry({ configPath: mcpPath, serverName, serverBlock });
-    messages.push(`\u2713 Wired ${mcpPath} \u2014 restart Cursor and run "list mushi tools"`);
-    messages.push(`  The MCP server reads the key saved in ${CONFIG_PATH} (export MUSHI_API_KEY before launching Cursor to override it).`);
-  }
-  let heartbeat = null;
-  if (opts.wait) {
-    const timeoutSec = opts.waitTimeoutSec ?? 120;
-    const maxAttempts = Math.max(1, Math.ceil(timeoutSec * 1e3 / 3e3));
-    messages.push(`\u2026 Waiting for SDK heartbeat (up to ${timeoutSec}s) \u2014 start your dev server with the snippet installed`);
-    heartbeat = await waitForIngestReady({
-      endpoint,
-      apiKey: opts.apiKey,
-      projectId,
-      maxAttempts,
-      onPoll: (payload, attempt) => {
-        if (!opts.json && attempt % 3 === 0) {
-          const sdk = payload.steps.find((s) => s.id === "sdk_installed");
-          const seen = payload.diagnostic?.last_sdk_seen_at ?? "never";
-          process.stdout.write(`  poll ${attempt}: sdk_installed=${sdk?.complete ? "yes" : "no"} last_seen=${seen}
-`);
-        }
-      }
-    });
-    if (heartbeat.ok) {
-      const label = heartbeat.reason === "heartbeat" ? "SDK heartbeat detected" : "Ingest setup complete";
-      messages.push(`\u2713 ${label} \u2014 ingest pipeline is live`);
-    } else if (heartbeat.reason === "unauthorized") {
-      messages.push(
-        `\u2717 The backend rejected these credentials (${heartbeat.error ?? "auth error"}). Double-check --api-key, --project-id, and --endpoint, then re-run \`mushi connect --wait\`.`
-      );
-    } else {
-      messages.push(
-        `\u2717 No heartbeat before timeout (${heartbeat.reason}). Confirm env vars are in your build, restart the dev server, then re-run \`mushi connect --wait\`.`
-      );
-    }
-  }
-  const ok = !envRefused && (!opts.wait || Boolean(heartbeat?.ok));
-  return { ok, envPath, mcpPath, heartbeat, messages };
-}
-
 export {
   MushiCliError,
   printAndExit,
@@ -1142,8 +769,12 @@ export {
   interruptedBy,
   installSignalHandlers,
   getAbortSignal,
+  isKeychainEnabled,
   trySaveKeyToKeychain,
   syncKeychainAfterKeyChange,
+  trySaveWorkerKey,
+  tryLoadWorkerKey,
+  tryDeleteWorkerKey,
   savedSdkKeyFor,
   resolveProfileName,
   CONFIG_PATH,
@@ -1153,13 +784,6 @@ export {
   saveConfig,
   listProfiles,
   setActiveProfile,
-  SDK_KEY_SCOPES,
-  CLI_KEY_SCOPES,
-  FULL_CLI_KEY_SCOPES,
-  SDK_KEY_LABEL,
-  CLI_KEY_LABEL,
-  probeKeyScope,
-  describeUnsafeSdkKey,
   consoleUrl,
   resolveConsoleUrlSync,
   resolveConsoleUrl,
@@ -1177,21 +801,5 @@ export {
   die,
   requireConfig,
   fmtDate,
-  pad,
-  sanitizeApiKey,
-  sanitizeProjectId,
-  sanitizeEndpoint,
-  sanitizeCliCredentials,
-  apiKeyHeaders,
-  fetchIngestSetup,
-  MCP_CLIENTS,
-  isMcpClient,
-  MCP_CLIENT_LABEL,
-  buildHostedMcpServerBlock,
-  writeMcpServerEntry,
-  buildMcpServerBlock,
-  printKeyExportHint,
-  buildMcpServerName,
-  resolveSdkEnvKey,
-  runConnect
+  pad
 };