@mushi-mushi/cli 0.36.0 → 0.36.2

package/README.md

@@ -21,7 +21,7 @@ npm install -g @mushi-mushi/cli      # optional: a global `mushi` command
 
 The wizard detects your framework and package manager, checks your credentials, installs the right SDK, writes framework-prefixed env vars (`NEXT_PUBLIC_`, `VITE_`, `EXPO_PUBLIC_`…) to `.env.local`, prints the snippet to paste, and offers to send a test report. It never overwrites an existing env var or edits your code.
 
-**Credentials** come from the [console](https://kensaur.us/mushi-mushi/admin): the **project ID** is on the Projects page; the **API key** is under **Setup → Verify → Generate API key** (`report:write`), not the AI keys in Settings. No project yet? The wizard can open the console for you.
+**Credentials** come from the [console](https://kensaur.us/mushi-mushi/admin): the **project ID** is on the **Manage apps** page; the **API key** is under **Set up → Test it → Generate API key** (`report:write`), not the AI keys in Settings. No project yet? The wizard can open the console for you.
 
 For your editor, `mushi setup` writes the hosted MCP entry by default: the editor opens a browser sign-in on first use and no key is stored on disk. Add `--stdio` for a local server instead.
 
@@ -32,7 +32,7 @@ For your editor, `mushi setup` writes the hosted MCP entry by default: the edito
 | Set up | `init`, `login`, `setup`, `connect`, `doctor`, `test` (send a test report), `upgrade`, `nudge`, `completion`, `profile` |
 | Bugs | `reports list/show/search/triage`, `lessons list/show`, `sentry import` |
 | Fixes | `fix <reportId>`, `fixes tail/merge/refresh-ci/review/verify`, `verify workflow` |
-| Local agent | `work` (a Cursor agent on your own computer fixes a report; you push), `worker install/status/revoke` (keeps it running, steered from the console) |
+| Local agent | `work` (the Cursor CLI or Claude Code on your own computer fixes a report; `mushi work` pushes and opens the draft PR with your `git` and `gh`), `worker install/status/revoke` (keeps it running, steered from the console) |
 | Ship | `sourcemaps upload`, `deploy check`, `migrate`, `audit`, `releases` |
 | Test and UX | `qa stories/runs/run`, `tdd gen/pending/approve/improve`, `stories map`, `ux` (including `ux fresh-eyes`, the first-time user test) |
 | CI | `runner status/compare/bill`: where your tests run, what they cost, and whether a red check was your code or the machine |
@@ -45,7 +45,7 @@ For your editor, `mushi setup` writes the hosted MCP entry by default: the edito
 ```bash
 mushi doctor --fix                                  # check SDK, ingest and dispatch; fix what's safe locally
 mushi reports list --status new --severity critical # what broke
-mushi fix <reportId> --wait                         # an agent opens a draft PR for it (your own AI key)
+mushi fix <reportId> --wait                         # the built-in fixer opens a draft PR for it
 mushi fixes merge <fixId>                           # merge it and mark the report Fixed
 mushi upgrade                                       # bump @mushi-mushi/* to the latest stable
 mushi upgrade --check                               # CI: exit 0 current, 1 outdated, 2 registry down
@@ -62,7 +62,7 @@ MUSHI_API_KEY=mushi_xxx mushi connect --project-id <uuid> --endpoint <url> --wai
 
 Other `init` flags: `--framework next`, `--cwd apps/web` (monorepos), `--endpoint <url>` (self-hosted), `--skip-install`, `--audit` (check an existing install instead).
 
-**What needs your own key.** Reading reports, diagnoses and fix prompts does not. `mushi fix` hands the report to an agent that runs on your own key: Anthropic for the built-in fixer (the default), or Cursor with `--agent cursor_cloud`. `mushi work` runs a Cursor agent on your own computer instead.
+**What needs your own key.** Reading reports, diagnoses and fix prompts does not. `mushi fix` hands the report to the built-in fixer by default (`--agent claude_code`): it uses your own Anthropic or OpenAI key when you have added one, and on hosted Mushi Mushi it falls back to Mushi Mushi's key when you have not. `--agent cursor_cloud` needs your own Cursor key. `mushi work` runs the Cursor CLI or Claude Code (`--agent claude`, CLI 0.36.0 or later) on your own computer instead, on the account that tool is signed in to.
 
 ## Environment variables
 

package/dist/{chunk-NHE5JMLQ.js → chunk-2JOEQQOU.js}

@@ -9,10 +9,10 @@ import {
   requireUuid,
   saveConfig,
   savedSdkKeyFor
-} from "./chunk-T2NBO4WL.js";
+} from "./chunk-H6HZNVVT.js";
 import {
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-MV3SEIJM.js";
+} from "./chunk-YYDQ3IYE.js";
 import {
   assertEndpoint,
   normalizeEndpoint

package/dist/chunk-76LVDUR5.js

@@ -0,0 +1,8 @@
+// src/version.ts
+var MUSHI_CLI_VERSION = true ? "0.36.2" : "0.0.0-dev";
+var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.30.7";
+
+export {
+  MUSHI_CLI_VERSION,
+  MUSHI_MCP_PIN_SPEC
+};

package/dist/{chunk-T2NBO4WL.js → chunk-H6HZNVVT.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-MV3SEIJM.js";
+} from "./chunk-YYDQ3IYE.js";
 import {
   CLOUD_API_ENDPOINT,
   normalizeEndpoint
@@ -14,6 +14,7 @@ var EXIT_CODE_MAP = {
   E_PROJECT_MISSING: 2,
   E_ENDPOINT_INVALID: 2,
   E_INVALID_INPUT: 2,
+  E_WRONG_REPO: 2,
   E_NOT_INTERACTIVE: 2,
   E_NETWORK: 3,
   E_TIMEOUT: 3,
@@ -771,6 +772,7 @@ export {
   getAbortSignal,
   isKeychainEnabled,
   trySaveKeyToKeychain,
+  tryLoadKeyFromKeychain,
   syncKeychainAfterKeyChange,
   trySaveWorkerKey,
   tryLoadWorkerKey,

package/dist/{chunk-YJ5Z6ZDX.js → chunk-OKT53MJ7.js}

@@ -8,10 +8,10 @@ import {
   requireConfig,
   requireUuid,
   tryLoadWorkerKey
-} from "./chunk-T2NBO4WL.js";
+} from "./chunk-H6HZNVVT.js";
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-MV3SEIJM.js";
+} from "./chunk-YYDQ3IYE.js";
 
 // src/worker/daemon.ts
 import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
@@ -405,6 +405,43 @@ ${run.stderr}`).trim();
 ${text.slice(-2e3)}` : text);
 }
 
+// src/commands/work-repo.ts
+function redactRemote(url) {
+  return url.trim().replace(/^([a-z][a-z0-9+.-]*:\/\/)[^@/]*@/i, "$1");
+}
+function normaliseRepoUrl(url) {
+  let s = url.trim();
+  if (!s) return null;
+  const proto = /^[a-z][a-z0-9+.-]*:\/\//i.exec(s);
+  if (proto) {
+    s = s.slice(proto[0].length).replace(/^[^@/]*@/, "");
+    s = s.replace(/^([^/:]+):\d+(?=\/|$)/, "$1");
+  } else {
+    s = s.replace(/^[^@/]*@/, "");
+    s = s.replace(/^([^/:]+):(?!\/)/, "$1/");
+  }
+  s = s.replace(/\/+$/, "").replace(/\.git$/i, "").replace(/\/+$/, "").toLowerCase();
+  if (!s) return null;
+  const parts = s.split("/").filter(Boolean);
+  if (parts.length === 2 && !parts[0].includes(".")) parts.unshift("github.com");
+  return parts.length ? parts.join("/") : null;
+}
+function originMatchesRepos(origin, repoUrls) {
+  if (!repoUrls.length) return true;
+  const o = origin ? normaliseRepoUrl(origin) : null;
+  if (!o) return false;
+  return repoUrls.some((u) => normaliseRepoUrl(u) === o);
+}
+function wrongRepoMessage(o) {
+  if (!o.repoUrls?.length || originMatchesRepos(o.origin, o.repoUrls)) return null;
+  const project = o.projectName ? `${o.projectName}${o.projectId ? ` (${o.projectId})` : ""}` : o.projectId ?? "this key's project";
+  const origin = o.origin ? redactRemote(o.origin) : "(no origin remote)";
+  return {
+    message: `Wrong repo: your Mushi key belongs to ${project}, which is linked to ${o.repoUrls.join(", ")}, but ${o.repoDir} has origin ${origin}. mushi work would apply that project's reports to this repo, so it stopped before claiming anything.`,
+    hint: "In this repo, run `mushi login --upgrade-scope --project-id <the project for this repo>`, or pass --repo-dir with a clone of the linked repo. For a monorepo or a fork, pass --any-repo to skip this check."
+  };
+}
+
 // src/commands/work.ts
 import { spawn } from "child_process";
 import { createHash as createHash2 } from "crypto";
@@ -452,7 +489,7 @@ function cap(text, max) {
   return t.length > max ? `${t.slice(0, max)} [cut]` : t;
 }
 function failureTail(r, max = 600) {
-  const t = [r.stdout, r.stderr].map((x) => x.trim()).filter(Boolean).join("\n").replace(/[ \t]+/g, " ");
+  const t = stripVTControlCharacters2([r.stdout, r.stderr].map((x) => x.trim()).filter(Boolean).join("\n")).replace(/[ \t]+/g, " ");
   const lines = t.split("\n").map((l) => l.trim()).filter(Boolean);
   const kept = [];
   let size = 0;
@@ -1020,10 +1057,15 @@ async function installDeps(wt, log) {
   const cmd = installCommand((f) => existsSync(join2(wt, f)));
   if (!cmd) return;
   log(`  deps: ${cmd[0]} ${cmd[1][0]} (so the agent can run tests and the commit hooks work)`);
-  let r = await runProc(cmd[0], cmd[1], { cwd: wt, timeoutMs: 10 * 6e4 });
-  if (r.code !== 0) r = await runProc(cmd[0], cmd[1], { cwd: wt, timeoutMs: 10 * 6e4 });
+  const [bin, args] = windowsShim(cmd, process.platform);
+  let r = await runProc(bin, args, { cwd: wt, timeoutMs: 10 * 6e4 });
+  if (r.code !== 0) r = await runProc(bin, args, { cwd: wt, timeoutMs: 10 * 6e4 });
   if (r.code !== 0) log(`  deps: install failed twice, the agent works without them (${failureTail(r, 300)})`);
 }
+function windowsShim(cmd, platform) {
+  if (platform !== "win32") return cmd;
+  return ["cmd.exe", ["/d", "/s", "/c", cmd[0], ...cmd[1]]];
+}
 function isMissingModuleFailure(message) {
   return /ERR_MODULE_NOT_FOUND|Cannot find (package|module)/.test(message);
 }
@@ -1091,10 +1133,29 @@ function missingWriteScope(scopes, projectId) {
   const have = scopes.length ? scopes.join(", ") : "no scopes";
   return `This CLI key has ${have}; mushi work also needs mcp:write to record the fix and queue its review. Run: mushi login --upgrade-scope${projectId ? ` --project-id ${projectId}` : ""}`;
 }
-async function requireWriteScope(cfg) {
+async function readWhoami(cfg) {
   const res = await apiCall("/v1/sync/whoami", cfg);
-  const scopes = res.ok ? res.data?.scopes : void 0;
-  const problem = missingWriteScope(scopes, cfg.projectId);
+  return res.ok ? res.data : void 0;
+}
+async function originOf(repoDir) {
+  if (!existsSync(repoDir)) return null;
+  const r = await runProc("git", ["remote", "get-url", "origin"], { cwd: repoDir, timeoutMs: 3e4 });
+  const url = r.code === 0 ? r.stdout.trim() : "";
+  return url || null;
+}
+async function requireRightRepo(whoami, repoDir) {
+  if (!whoami?.repo_urls?.length) return;
+  const problem = wrongRepoMessage({
+    projectName: whoami.project_name,
+    projectId: whoami.project_id,
+    repoUrls: whoami.repo_urls,
+    origin: await originOf(repoDir),
+    repoDir
+  });
+  if (problem) throw new MushiCliError("E_WRONG_REPO", problem.message, problem.hint);
+}
+function requireWriteScope(cfg, whoami) {
+  const problem = missingWriteScope(whoami?.scopes, cfg.projectId);
   if (problem) throw new MushiCliError("E_AUTH_MISSING", problem, `mushi login --upgrade-scope${cfg.projectId ? ` --project-id ${cfg.projectId}` : ""}`);
 }
 function stopLine(agent, left, what) {
@@ -1102,14 +1163,14 @@ function stopLine(agent, left, what) {
   return `Stopped: the ${spec.label} agent could not run (out of usage or signed out). ${left} ${what}${left === 1 ? "" : "s"} left untouched and can be picked up again; the run was closed without a retry cooldown. Check: ${spec.bin} ${spec.status.join(" ")}`;
 }
 function registerWorkCommands(program) {
-  program.command("work").description("Fix reports with a coding agent on this machine (the Cursor CLI or Claude Code); pushes and opens the draft PR with your git and gh").option("--repo-dir <path>", "A clone of the app repo (only worktrees are created in it); not with --daemon").option("--project <id>", "Project id (overrides MUSHI_PROJECT_ID)").option("--agent <name>", "Local agent: cursor (cursor-agent, default) or claude (Claude Code, claude -p); with --daemon, overrides the worker config's agent").option("--model <id>", "Model for the agent (cursor: cursor-agent --list-models; claude: opus, sonnet, haiku or a claude-\u2026 id)").option("--max <n>", "Reports per run", "3").option("--report <id>", "Work on this report only").option("--followups", 'Instead of new reports: fix the Opus "fix first" findings on PRs mushi work opened, and push to them').option("--keep", "Keep the worktree after the run").option("--dry-run", "Show what would run; change nothing").option("--json", "Machine-readable JSON output").option("--daemon", "Run as a local worker: register this machine, send a heartbeat every 60 s, take the console's lane settings and claim reports (set up with `mushi worker install`)").option("--worker-config <path>", "With --daemon: the lanes file (default ~/.config/mushi/worker.json)").action(async (opts) => {
+  program.command("work").description("Fix reports with a coding agent on this machine (the Cursor CLI or Claude Code); pushes and opens the draft PR with your git and gh").option("--repo-dir <path>", "A clone of the app repo (only worktrees are created in it); not with --daemon").option("--project <id>", "Project id (overrides MUSHI_PROJECT_ID)").option("--agent <name>", "Local agent: cursor (cursor-agent, default) or claude (Claude Code, claude -p); with --daemon, overrides the worker config's agent").option("--model <id>", "Model for the agent (cursor: cursor-agent --list-models; claude: opus, sonnet, haiku or a claude-\u2026 id)").option("--max <n>", "Reports per run", "3").option("--report <id>", "Work on this report only").option("--followups", 'Instead of new reports: fix the Opus "fix first" findings on PRs mushi work opened, and push to them').option("--keep", "Keep the worktree after the run").option("--dry-run", "Show what would run; change nothing").option("--any-repo", "Skip the check that the clone is a repo the key's project is linked to (a monorepo or a fork)").option("--json", "Machine-readable JSON output").option("--daemon", "Run as a local worker: register this machine, send a heartbeat every 60 s, take the console's lane settings and claim reports (set up with `mushi worker install`)").option("--worker-config <path>", "With --daemon: the lanes file (default ~/.config/mushi/worker.json)").action(async (opts) => {
     const agent = parseLocalAgent(opts.agent);
     if (opts.daemon) {
       if (opts.repoDir || opts.report || opts.followups) {
         throw new MushiCliError("E_INVALID_INPUT", "--daemon takes its lanes and clones from the worker config, not from --repo-dir, --report or --followups.", "mushi worker install");
       }
-      const { runDaemon: runDaemon2 } = await import("./daemon-ZGSTNMAY.js");
-      await runDaemon2({ configPath: opts.workerConfig, ...opts.agent !== void 0 ? { agent } : {} });
+      const { runDaemon: runDaemon2 } = await import("./daemon-D3BEJ4ZR.js");
+      await runDaemon2({ configPath: opts.workerConfig, ...opts.agent !== void 0 ? { agent } : {}, ...opts.anyRepo ? { anyRepo: true } : {} });
       return;
     }
     if (!opts.repoDir) throw new MushiCliError("E_INVALID_INPUT", "mushi work needs --repo-dir <clone>.", "mushi work --repo-dir ~/src/my-app");
@@ -1125,6 +1186,8 @@ function registerWorkCommands(program) {
     };
     const warn = (l) => process.stderr.write(`${l}
 `);
+    const whoami = await readWhoami(cfg);
+    if (!opts.anyRepo) await requireRightRepo(whoami, repoDir);
     if (opts.followups) {
       const listed = await api(`/v1/admin/projects/${cfg.projectId}/local-followups`);
       const due = listed.fixes.slice(0, max);
@@ -1136,7 +1199,7 @@ function registerWorkCommands(program) {
         return;
       }
       await preflight(repoDir, warn, agent);
-      await requireWriteScope(cfg);
+      requireWriteScope(cfg, whoami);
       const results2 = [];
       for (const f of due) {
         if (interruptedBy()) break;
@@ -1167,7 +1230,7 @@ function registerWorkCommands(program) {
       return;
     }
     await preflight(repoDir, warn, agent);
-    await requireWriteScope(cfg);
+    requireWriteScope(cfg, whoami);
     const results = [];
     for (const d of picked) {
       if (interruptedBy()) break;
@@ -2874,6 +2937,7 @@ async function runDaemon(opts = {}) {
   if (gh.code !== 0) process.stdout.write("worker: gh is not signed in on this machine; lanes take nothing until it is (run: gh auth login).\n");
   const repos = /* @__PURE__ */ new Map();
   const notReady = /* @__PURE__ */ new Map();
+  const origins = /* @__PURE__ */ new Map();
   for (const lane of cfg.lanes) {
     const g = await runProc("git", ["rev-parse", "--git-dir"], { cwd: lane.repoDir, timeoutMs: 3e4 });
     if (g.code !== 0) {
@@ -2885,8 +2949,28 @@ async function runDaemon(opts = {}) {
     const origin = await runProc("git", ["remote", "get-url", "origin"], { cwd: lane.repoDir, timeoutMs: 3e4 });
     const repo = origin.code === 0 ? repoOfRemote(origin.stdout) : null;
     if (repo) repos.set(lane.name, repo);
+    if (origin.code === 0 && origin.stdout.trim()) origins.set(lane.name, origin.stdout.trim());
   }
   const conf = { apiKey: key, endpoint };
+  if (!opts.anyRepo) {
+    const who = await apiCall("/v1/sync/whoami", conf, {}, { timeoutMs: 3e4 });
+    if (who.ok) {
+      for (const lane of cfg.lanes) {
+        if (notReady.has(lane.name) || lane.projectId !== who.data.project_id) continue;
+        const problem = wrongRepoMessage({
+          projectName: who.data.project_name,
+          projectId: who.data.project_id,
+          repoUrls: who.data.repo_urls,
+          origin: origins.get(lane.name) ?? null,
+          repoDir: lane.repoDir
+        });
+        if (!problem) continue;
+        process.stdout.write(`worker: lane ${lane.name}: ${problem.message} The lane stays out until it is fixed (or restart with --any-repo).
+`);
+        notReady.set(lane.name, `Its clone is not a repo ${who.data.project_name || "this project"} is linked to (${who.data.repo_urls.join(", ")}); point the lane at a clone of one, or restart the worker with --any-repo`);
+      }
+    }
+  }
   let wake = () => void 0;
   const readings = createHostReadings({
     ...cursorAccount ? { cursorAccount } : {},

package/dist/{chunk-GHG5XKGP.js → chunk-TN2IZOY7.js}

@@ -1,6 +1,6 @@
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-FRVELHB4.js";
+} from "./chunk-76LVDUR5.js";
 import {
   assertEndpoint,
   normalizeEndpoint
@@ -415,6 +415,7 @@ var EXIT_CODE_MAP = {
   E_PROJECT_MISSING: 2,
   E_ENDPOINT_INVALID: 2,
   E_INVALID_INPUT: 2,
+  E_WRONG_REPO: 2,
   E_NOT_INTERACTIVE: 2,
   E_NETWORK: 3,
   E_TIMEOUT: 3,

package/dist/chunk-YYDQ3IYE.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+
+// src/version.ts
+var MUSHI_CLI_VERSION = true ? "0.36.2" : "0.0.0-dev";
+var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.30.7";
+
+export {
+  MUSHI_CLI_VERSION,
+  MUSHI_MCP_PIN_SPEC
+};

package/dist/{connect-CHLNFDG5.js → connect-W4VHAQIQ.js}

@@ -6,10 +6,10 @@ import {
   saveConfig,
   savedSdkKeyFor,
   waitForIngestReady
-} from "./chunk-GHG5XKGP.js";
+} from "./chunk-TN2IZOY7.js";
 import {
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-FRVELHB4.js";
+} from "./chunk-76LVDUR5.js";
 import {
   detectFramework,
   envVarsToWrite,

package/dist/{connect-GVDAI3RJ.js → connect-YZMEO7Y5.js}

@@ -2,10 +2,10 @@
 import {
   resolveSdkEnvKey,
   runConnect
-} from "./chunk-NHE5JMLQ.js";
+} from "./chunk-2JOEQQOU.js";
 import "./chunk-KOBEOGNF.js";
-import "./chunk-T2NBO4WL.js";
-import "./chunk-MV3SEIJM.js";
+import "./chunk-H6HZNVVT.js";
+import "./chunk-YYDQ3IYE.js";
 import "./chunk-LGGE3LH7.js";
 export {
   resolveSdkEnvKey,

package/dist/{daemon-ZGSTNMAY.js → daemon-D3BEJ4ZR.js}

@@ -10,9 +10,9 @@ import {
   readWorkerKey,
   runDaemon,
   workerHostId
-} from "./chunk-YJ5Z6ZDX.js";
-import "./chunk-T2NBO4WL.js";
-import "./chunk-MV3SEIJM.js";
+} from "./chunk-OKT53MJ7.js";
+import "./chunk-H6HZNVVT.js";
+import "./chunk-YYDQ3IYE.js";
 import "./chunk-LGGE3LH7.js";
 export {
   assertWorkerKey,

package/dist/index.js

@@ -22,7 +22,7 @@ import {
   sanitizeEndpoint,
   sanitizeProjectId,
   writeMcpServerEntry
-} from "./chunk-NHE5JMLQ.js";
+} from "./chunk-2JOEQQOU.js";
 import {
   FRAMEWORKS,
   detectFramework,
@@ -50,7 +50,7 @@ import {
   registerUxCommands,
   registerWorkCommands,
   validateWorkerConfig
-} from "./chunk-YJ5Z6ZDX.js";
+} from "./chunk-OKT53MJ7.js";
 import {
   CONFIG_PATH,
   MushiCliError,
@@ -86,13 +86,14 @@ import {
   setGlobalOutputFormat,
   syncKeychainAfterKeyChange,
   tryDeleteWorkerKey,
+  tryLoadKeyFromKeychain,
   trySaveKeyToKeychain,
   trySaveWorkerKey
-} from "./chunk-T2NBO4WL.js";
+} from "./chunk-H6HZNVVT.js";
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-MV3SEIJM.js";
+} from "./chunk-YYDQ3IYE.js";
 import {
   CLOUD_API_ENDPOINT,
   CLOUD_MCP_OAUTH_URL,
@@ -427,6 +428,17 @@ function printAuthFailed(reason, detail) {
   console.log("");
 }
 
+// src/env-key-override.ts
+function envKeyOverrideLines(env, savedKey, platform = process.platform) {
+  const envKey = env.MUSHI_API_KEY?.trim();
+  if (!envKey || savedKey && envKey === savedKey) return [];
+  const where = platform === "win32" ? 'Remove it under Windows Settings \u2192 System \u2192 About \u2192 Advanced system settings \u2192 Environment Variables, or open a new terminal after `[Environment]::SetEnvironmentVariable("MUSHI_API_KEY", $null, "User")` in PowerShell.' : "Remove the `export MUSHI_API_KEY=\u2026` line from your shell profile, or run `unset MUSHI_API_KEY` in this terminal.";
+  return [
+    `\u26A0 MUSHI_API_KEY is set in your environment (${envKey.slice(0, 12)}\u2026), and it overrides ${savedKey ? `the saved key (${savedKey.slice(0, 12)}\u2026)` : "the saved key"}.`,
+    `  Commands in this terminal use the environment key. ${where}`
+  ];
+}
+
 // src/login.ts
 function getPostLoginBannerMessage(opts) {
   if (opts.suppressPostLoginBanner) return null;
@@ -674,8 +686,10 @@ error: Could not create project: ${err instanceof Error ? err.message : String(e
     if (opts.upgradeScope) {
       console.log(`  \u2713 Full-scope CLI key saved (${apiKey.slice(0, 12)}\u2026)`);
       console.log(`    Scopes: report:write \xB7 mcp:read \xB7 mcp:write \u2014 SDK + MCP + admin CLI (incl. writes) all work with this key`);
+      for (const line of envKeyOverrideLines(process.env, apiKey)) console.log(`  ${line}`);
     } else {
       console.log(`  \u2713 CLI key saved (${apiKey.slice(0, 12)}\u2026)`);
+      for (const line of envKeyOverrideLines(process.env, apiKey)) console.log(`  ${line}`);
       console.log(`    Scopes: report:write \xB7 mcp:read \u2014 SDK ingest + MCP read tools.`);
       console.log(`    Admin writes (mushi work, fix merge, billing cap, pipeline start) need: mushi login --upgrade-scope${chosenProjectId ? ` --project-id ${chosenProjectId}` : ""}`);
     }
@@ -1595,7 +1609,7 @@ async function checkOnboardingStatus(config, _consoleBase, cwd, doFetch = global
 }
 async function checkVersionDrift(cwd, doFetch) {
   const checks = [];
-  const { MUSHI_CLI_VERSION: MUSHI_CLI_VERSION2 } = await import("./version-673M6J44.js");
+  const { MUSHI_CLI_VERSION: MUSHI_CLI_VERSION2 } = await import("./version-TOLAY73N.js");
   if (MUSHI_CLI_VERSION2 === "0.0.0-dev") return checks;
   const parse2 = (v) => {
     const m = v.replace(/^[~^]/, "").match(/^(\d+)\.(\d+)\.(\d+)/);
@@ -2568,7 +2582,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect: runConnect2 } = await import("./connect-GVDAI3RJ.js");
+    const { runConnect: runConnect2 } = await import("./connect-YZMEO7Y5.js");
     const saved = loadConfig();
     const result = await runConnect2(
       {
@@ -2915,6 +2929,7 @@ Useful after 'mushi login' to confirm credentials are correct.`).action(async (o
           console.log("    Mint one on the console MCP page, or run `mushi login`.");
         }
       }
+      for (const line of envKeyOverrideLines(process.env, tryLoadKeyFromKeychain() ?? void 0)) console.log(`  ${line}`);
     }
   });
   program2.command("ping").description("Check connectivity to the Mushi backend").option("--json", "Machine-readable JSON output").action(async (opts) => {

package/dist/init.js

@@ -25,10 +25,10 @@ import {
   saveConfig,
   savedSdkKeyFor,
   trySaveKeyToKeychain
-} from "./chunk-GHG5XKGP.js";
+} from "./chunk-TN2IZOY7.js";
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-FRVELHB4.js";
+} from "./chunk-76LVDUR5.js";
 import {
   FRAMEWORKS,
   detectFramework,
@@ -2127,7 +2127,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect } = await import("./connect-CHLNFDG5.js");
+    const { runConnect } = await import("./connect-W4VHAQIQ.js");
     const saved = loadConfig();
     const result = await runConnect(
       {

package/dist/{version-673M6J44.js → version-TOLAY73N.js}

@@ -2,7 +2,7 @@
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-MV3SEIJM.js";
+} from "./chunk-YYDQ3IYE.js";
 export {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC

package/dist/version.d.ts

@@ -14,6 +14,6 @@ declare const MUSHI_CLI_VERSION: string;
  * setup refreshes the pin. Synced to packages/mcp/package.json by
  * `scripts/sync-mcp-pin.mjs` — never hand-edit the version.
  */
-declare const MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.30.5";
+declare const MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.30.7";
 
 export { MUSHI_CLI_VERSION, MUSHI_MCP_PIN_SPEC };

package/dist/version.js

@@ -1,7 +1,7 @@
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-FRVELHB4.js";
+} from "./chunk-76LVDUR5.js";
 export {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mushi-mushi/cli",
-  "version": "0.36.0",
+  "version": "0.36.2",
   "license": "MIT",
   "description": "Mushi Mushi CLI: SDK setup, MCP wiring, triage. Bug fixing for AI-built apps: plain-English diagnosis + a ready fix, in your editor.",
   "bin": {

package/dist/chunk-FRVELHB4.js

@@ -1,8 +0,0 @@
-// src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.36.0" : "0.0.0-dev";
-var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.30.5";
-
-export {
-  MUSHI_CLI_VERSION,
-  MUSHI_MCP_PIN_SPEC
-};

package/dist/chunk-MV3SEIJM.js

@@ -1,10 +0,0 @@
-#!/usr/bin/env node
-
-// src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.36.0" : "0.0.0-dev";
-var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.30.5";
-
-export {
-  MUSHI_CLI_VERSION,
-  MUSHI_MCP_PIN_SPEC
-};