@productbrain/cli 0.1.0-beta.32 → 0.1.0-beta.34

package/dist/lib/client.js

@@ -12,6 +12,7 @@
 import { getConfig } from './config.js';
 import { readSession } from './session.js';
 import { CLIError, ErrorCode } from './errors.js';
+import { withSpinner } from './spinner.js';
 /**
  * Map MCP server error codes to CLIError categories.
  * Keeps backward compat: McpError.code is still a free string from the server,
@@ -86,43 +87,99 @@ function rethrowWithGuidance(err, siteUrl) {
  * Throws on network/timeout errors so the caller can distinguish "bad key" from "can't reach server".
  */
 export async function validateKey(apiKey, siteUrl, timeoutMs = 5000) {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), timeoutMs);
-    try {
-        const res = await fetch(`${siteUrl}/api/mcp`, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                Authorization: `Bearer ${apiKey}`,
-            },
-            body: JSON.stringify({ fn: 'resolveWorkspace', args: {} }),
-            signal: controller.signal,
-        });
-        clearTimeout(timer);
-        if (res.status === 401 || res.status === 403) {
-            return { valid: false, error: 'Invalid API key.' };
+    return withSpinner('Validating API key', async () => {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        try {
+            const res = await fetch(`${siteUrl}/api/mcp`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    Authorization: `Bearer ${apiKey}`,
+                },
+                body: JSON.stringify({ fn: 'resolveWorkspace', args: {} }),
+                signal: controller.signal,
+            });
+            clearTimeout(timer);
+            if (res.status === 401 || res.status === 403) {
+                return { valid: false, error: 'Invalid API key.' };
+            }
+            if (!res.ok) {
+                const json = (await res.json().catch(() => ({})));
+                return { valid: false, error: json.error ?? `Server error (${res.status})` };
+            }
+            const json = (await res.json());
+            if (json.error) {
+                return { valid: false, error: json.error };
+            }
+            return { valid: true, workspaceId: json.data?._id ?? 'unknown' };
         }
-        if (!res.ok) {
-            const json = (await res.json().catch(() => ({})));
-            return { valid: false, error: json.error ?? `Server error (${res.status})` };
-        }
-        const json = (await res.json());
-        if (json.error) {
-            return { valid: false, error: json.error };
+        catch (err) {
+            clearTimeout(timer);
+            // Re-throw network/timeout errors — caller handles the "offline" case
+            throw err;
         }
-        return { valid: true, workspaceId: json.data?._id ?? 'unknown' };
-    }
-    catch (err) {
-        clearTimeout(timer);
-        // Re-throw network/timeout errors — caller handles the "offline" case
-        throw err;
-    }
+    });
+}
+/**
+ * Map MCP function names to human-friendly spinner labels.
+ * Unknown functions get a generic fallback.
+ */
+const SPINNER_LABELS = {
+    orient: 'Loading workspace overview',
+    'entries.get': 'Loading entry',
+    'entries.search': 'Searching entries',
+    'entries.create': 'Creating entry',
+    'entries.update': 'Updating entry',
+    'capture-quick': 'Capturing to Chain',
+    'propose-capture': 'Preparing capture',
+    'commit-entry': 'Committing entry',
+    'agent.startSession': 'Starting session',
+    'agent.closeSession': 'Closing session',
+    'agent.touchSession': 'Refreshing session',
+    resolveWorkspace: 'Resolving workspace',
+    'onboarding.chat': 'Thinking',
+    context: 'Loading context',
+    'entries.relate': 'Creating relation',
+    'entries.unrelate': 'Removing relation',
+    constellation: 'Loading constellation',
+};
+/** Get a human-friendly spinner label for an MCP function name. */
+export function spinnerLabel(fn) {
+    return SPINNER_LABELS[fn] || `Loading ${fn.replace(/\./g, ' ')}`;
 }
 export async function mcpCall(fn, args = {}) {
     const { apiKey, siteUrl } = getConfig();
-    let res;
+    const label = spinnerLabel(fn);
+    return withSpinner(label, async () => {
+        let res;
+        try {
+            res = await fetch(`${siteUrl}/api/mcp`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    Authorization: `Bearer ${apiKey}`,
+                },
+                body: JSON.stringify({ fn, args }),
+            });
+        }
+        catch (err) {
+            rethrowWithGuidance(err, siteUrl);
+        }
+        const json = (await res.json());
+        if (!res.ok || json.error) {
+            throw new McpError(json.error ?? res.statusText, json.code, json.details);
+        }
+        return json.data;
+    });
+}
+/**
+ * Raw fetch to the MCP gateway — no spinner, swallows errors.
+ * Used for fire-and-forget operations (e.g. session touch) where visible feedback is noise.
+ */
+async function mcpFetchRaw(fn, args, apiKey, siteUrl) {
     try {
-        res = await fetch(`${siteUrl}/api/mcp`, {
+        await fetch(`${siteUrl}/api/mcp`, {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
@@ -131,14 +188,9 @@ export async function mcpCall(fn, args = {}) {
             body: JSON.stringify({ fn, args }),
         });
     }
-    catch (err) {
-        rethrowWithGuidance(err, siteUrl);
+    catch {
+        // Best-effort — silently swallow all errors
     }
-    const json = (await res.json());
-    if (!res.ok || json.error) {
-        throw new McpError(json.error ?? res.statusText, json.code, json.details);
-    }
-    return json.data;
 }
 /**
  * mcpCall variant that injects X-Agent-Session-Id header for write operations.
@@ -153,6 +205,7 @@ export async function mcpCall(fn, args = {}) {
 export async function mcpCallWithSession(fn, args = {}) {
     const { apiKey, siteUrl } = getConfig();
     const session = readSession();
+    const label = spinnerLabel(fn);
     const headers = {
         'Content-Type': 'application/json',
         Authorization: `Bearer ${apiKey}`,
@@ -160,27 +213,30 @@ export async function mcpCallWithSession(fn, args = {}) {
     if (session?.sessionId) {
         headers['X-Agent-Session-Id'] = session.sessionId;
     }
-    let res;
-    try {
-        res = await fetch(`${siteUrl}/api/mcp`, {
-            method: 'POST',
-            headers,
-            body: JSON.stringify({ fn, args }),
-        });
-    }
-    catch (err) {
-        rethrowWithGuidance(err, siteUrl);
-    }
-    const json = (await res.json());
-    if (!res.ok || json.error) {
-        throw new McpError(json.error ?? res.statusText, json.code, json.details);
-    }
+    const result = await withSpinner(label, async () => {
+        let res;
+        try {
+            res = await fetch(`${siteUrl}/api/mcp`, {
+                method: 'POST',
+                headers,
+                body: JSON.stringify({ fn, args }),
+            });
+        }
+        catch (err) {
+            rethrowWithGuidance(err, siteUrl);
+        }
+        const json = (await res.json());
+        if (!res.ok || json.error) {
+            throw new McpError(json.error ?? res.statusText, json.code, json.details);
+        }
+        return json.data;
+    });
     // Fire-and-forget session touch — best-effort, never blocks the write response.
-    // Only touch when a session is active. Uses mcpCall (not mcpCallWithSession) to
-    // avoid recursion.
+    // Uses mcpFetchRaw (not mcpCall) to avoid recursion and suppress the visible spinner
+    // that would appear if mcpCall were used here (background ops are silent noise).
     if (session?.sessionId) {
-        mcpCall('agent.touchSession', { sessionId: session.sessionId }).catch(() => { });
+        void mcpFetchRaw('agent.touchSession', { sessionId: session.sessionId }, apiKey, siteUrl);
     }
-    return json.data;
+    return result;
 }
 //# sourceMappingURL=client.js.map

package/dist/lib/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAalD;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,UAAU,CAAC;IAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,MAAM,CAAC;IACtE,IAAI,IAAI,KAAK,mBAAmB;QAAE,OAAO,YAAY,CAAC;IACtD,IAAI,IAAI,KAAK,kBAAkB;QAAE,OAAO,SAAS,CAAC;IAClD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,4FAA4F;AAC5F,MAAM,OAAO,QAAS,SAAQ,QAAQ;IACpC,OAAO,CAA2B;IAElC,YAAY,OAAe,EAAE,IAAa,EAAE,OAAiC;QAC3E,KAAK,CAAC,OAAO,EAAE;YACb,IAAI,EAAG,IAAuB,IAAI,SAAS,CAAC,QAAQ;YACpD,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,qEAAqE;AACrE,2EAA2E;AAC3E,yEAAyE;AACzE,iDAAiD;AACjD,IAAI,CAAC;IACH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAClE,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,UAAU,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnE,mBAAmB,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAAC,MAAM,CAAC;IACP,8EAA8E;AAChF,CAAC;AAED,yEAAyE;AACzE,SAAS,mBAAmB,CAAC,GAAY,EAAE,OAAe;IACxD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,GAAG,KAAK,cAAc,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;QACvC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QACjE,MAAM,SAAS,GAAG,KAAK;YACrB,CAAC,CAAC,0BAA0B,KAAK,0CAA0C;gBACzE,gEAAgE;gBAChE,+DAA+D;YACjE,CAAC,CAAC,oFAAoF;gBACpF,uDAAuD;gBACvD,aAAa,IAAI,wCAAwC;gBACzD,qDAAqD;gBACrD,uEAAuE,CAAC;QAC5E,MAAM,IAAI,QAAQ,CAAC,mBAAmB,IAAI,GAAG,EAAE;YAC7C,IAAI,EAAE,SAAS,CAAC,mBAAmB;YACnC,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,OAAe,EACf,SAAS,GAAG,IAAI;IAEhB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAE9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;YAC5C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;YAC1D,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,YAAY,CAAC,KAAK,CAAC,CAAC;QAEpB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;YACxE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,iBAAiB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;QAC/E,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgD,CAAC;QAC/E,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC7C,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,SAAS,EAAE,CAAC;IACnE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,sEAAsE;QACtE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,EAAU,EACV,OAAgC,EAAE;IAElC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;IAExC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;YACtC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmF,CAAC;IAClH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC,IAAS,CAAC;AACxB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAU,EACV,OAAgC,EAAE;IAElC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAE9B,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,aAAa,EAAE,UAAU,MAAM,EAAE;KAClC,CAAC;IACF,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,oBAAoB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IACpD,CAAC;IAED,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;YACtC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmF,CAAC;IAClH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5E,CAAC;IAED,gFAAgF;IAChF,gFAAgF;IAChF,mBAAmB;IACnB,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,IAAI,CAAC,IAAS,CAAC;AACxB,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAY3C;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,UAAU,CAAC;IAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,MAAM,CAAC;IACtE,IAAI,IAAI,KAAK,mBAAmB;QAAE,OAAO,YAAY,CAAC;IACtD,IAAI,IAAI,KAAK,kBAAkB;QAAE,OAAO,SAAS,CAAC;IAClD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,4FAA4F;AAC5F,MAAM,OAAO,QAAS,SAAQ,QAAQ;IACpC,OAAO,CAA2B;IAElC,YAAY,OAAe,EAAE,IAAa,EAAE,OAAiC;QAC3E,KAAK,CAAC,OAAO,EAAE;YACb,IAAI,EAAG,IAAuB,IAAI,SAAS,CAAC,QAAQ;YACpD,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,qEAAqE;AACrE,2EAA2E;AAC3E,yEAAyE;AACzE,iDAAiD;AACjD,IAAI,CAAC;IACH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAClE,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,UAAU,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnE,mBAAmB,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAAC,MAAM,CAAC;IACP,8EAA8E;AAChF,CAAC;AAED,yEAAyE;AACzE,SAAS,mBAAmB,CAAC,GAAY,EAAE,OAAe;IACxD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,GAAG,KAAK,cAAc,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;QACvC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QACjE,MAAM,SAAS,GAAG,KAAK;YACrB,CAAC,CAAC,0BAA0B,KAAK,0CAA0C;gBACzE,gEAAgE;gBAChE,+DAA+D;YACjE,CAAC,CAAC,oFAAoF;gBACpF,uDAAuD;gBACvD,aAAa,IAAI,wCAAwC;gBACzD,qDAAqD;gBACrD,uEAAuE,CAAC;QAC5E,MAAM,IAAI,QAAQ,CAAC,mBAAmB,IAAI,GAAG,EAAE;YAC7C,IAAI,EAAE,SAAS,CAAC,mBAAmB;YACnC,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,OAAe,EACf,SAAS,GAAG,IAAI;IAEhB,OAAO,WAAW,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAE9D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;gBAC5C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;iBAClC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;gBAC1D,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,YAAY,CAAC,KAAK,CAAC,CAAC;YAEpB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;YACrD,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;gBACxE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,iBAAiB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;YAC/E,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgD,CAAC;YAC/E,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACf,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAC7C,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,SAAS,EAAE,CAAC;QACnE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,sEAAsE;YACtE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,cAAc,GAA2B;IAC7C,MAAM,EAAE,4BAA4B;IACpC,aAAa,EAAE,eAAe;IAC9B,gBAAgB,EAAE,mBAAmB;IACrC,gBAAgB,EAAE,gBAAgB;IAClC,gBAAgB,EAAE,gBAAgB;IAClC,eAAe,EAAE,oBAAoB;IACrC,iBAAiB,EAAE,mBAAmB;IACtC,cAAc,EAAE,kBAAkB;IAClC,oBAAoB,EAAE,kBAAkB;IACxC,oBAAoB,EAAE,iBAAiB;IACvC,oBAAoB,EAAE,oBAAoB;IAC1C,gBAAgB,EAAE,qBAAqB;IACvC,iBAAiB,EAAE,UAAU;IAC7B,OAAO,EAAE,iBAAiB;IAC1B,gBAAgB,EAAE,mBAAmB;IACrC,kBAAkB,EAAE,mBAAmB;IACvC,aAAa,EAAE,uBAAuB;CACvC,CAAC;AAEF,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAC,EAAU;IACrC,OAAO,cAAc,CAAC,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,EAAU,EACV,OAAgC,EAAE;IAElC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAE/B,OAAO,WAAW,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QACnC,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;gBACtC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;iBAClC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmF,CAAC;QAClH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1B,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,IAAI,CAAC,IAAS,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW,CACxB,EAAU,EACV,IAA6B,EAC7B,MAAc,EACd,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAU,EACV,OAAgC,EAAE;IAElC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAE/B,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,aAAa,EAAE,UAAU,MAAM,EAAE;KAClC,CAAC;IACF,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,oBAAoB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAI,KAAK,EAAE,KAAK,IAAI,EAAE;QACpD,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;gBACtC,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmF,CAAC;QAClH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1B,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,IAAI,CAAC,IAAS,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,qFAAqF;IACrF,iFAAiF;IACjF,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;QACvB,KAAK,WAAW,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5F,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/lib/config.d.ts

@@ -1,9 +1,10 @@
 /**
  * CLI config — reads PRODUCTBRAIN_API_KEY + CONVEX_SITE_URL from:
  * 1. Environment variables (always highest priority)
- * 2. Profile system (~/.config/productbrain/profiles/{name}.env)
- * 3. Legacy ~/.config/productbrain/.env (auto-migrated to profiles on first use)
- * 4. CWD .env.mcp / packages/mcp-server/.env.mcp / .env
+ * 2. Project config: .productbrain/config.json in CWD (WP-303 S0)
+ * 3. Profile system (~/.config/productbrain/profiles/{name}.env)
+ * 4. Legacy ~/.config/productbrain/.env (auto-migrated to profiles on first use)
+ * 5. CWD .env.mcp / packages/mcp-server/.env.mcp / .env
  *
  * Config loading is lazy — loadEnv() runs on first getConfig()/getConfigOrGuide() call.
  * This enables profile switching without import-time side effects (TEN-1276).
@@ -12,6 +13,36 @@
  */
 declare const HOME_CONFIG_DIR: string;
 declare const HOME_ENV_PATH: string;
+/** Project config shape — .productbrain/config.json */
+interface ProjectConfig {
+    apiKey?: string;
+    siteUrl?: string;
+}
+/**
+ * Read .productbrain/config.json from CWD.
+ * Returns null if file missing. Warns to stderr on invalid JSON but does not throw.
+ */
+declare function readProjectConfig(): ProjectConfig | null;
+/** Config source in resolution priority order. */
+export type ConfigSource = 'env' | 'project' | 'profile' | 'cwd' | 'default';
+/** Result of the full config resolution cascade. */
+export interface ResolvedConfig {
+    apiKey?: string;
+    siteUrl: string;
+    source: ConfigSource;
+}
+/**
+ * Run the full config resolution cascade and return a typed result.
+ * Resolution order:
+ * 1. Environment variables (highest priority)
+ * 2. Project config (.productbrain/config.json in CWD)
+ * 3. Profile system (~/.config/productbrain/profiles/{name}.env)
+ * 4. Legacy home config (~/.config/productbrain/.env)
+ * 5. CWD .env files (.env.mcp, packages/mcp-server/.env.mcp, .env)
+ *
+ * siteUrl always has a value (falls back to DEFAULT_SITE_URL).
+ */
+export declare function resolveConfig(): ResolvedConfig;
 /** Reset env loaded state — used for profile switching. */
 export declare function resetConfigCache(): void;
 export declare function getConfig(): {
@@ -22,11 +53,33 @@ export type Config = {
     apiKey: string;
     siteUrl: string;
 };
+/** Discriminated union result for non-throwing config access. */
+export type ConfigResult = {
+    ok: true;
+    apiKey: string;
+    siteUrl: string;
+    source: ConfigSource;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Non-throwing alternative to getConfig().
+ *
+ * Architecture: getConfig() is the primary path for commands that require auth — it
+ * throws CLIError when the key is missing, which is correct for API call paths.
+ * getConfigSafe() is for status/probe surfaces (no-args dashboard, init) that need
+ * to check config availability without crashing. Both paths are intentional and
+ * coexist by design — see WP-303 review (DW#5).
+ *
+ * Uses resolveConfig() directly (no loadEnv) to avoid env var pollution affecting source attribution.
+ */
+export declare function getConfigSafe(): ConfigResult;
 /**
  * Get config; if key is missing and stdin is a TTY, run guided flow (y/n → paste key → save → retry).
  * @param retry Called after saving key so the original command runs in-process.
  * @returns Config, or null if we ran retry (caller should return without running again).
  */
 export declare function getConfigOrGuide(retry: () => Promise<void>): Promise<Config | null>;
-export { HOME_CONFIG_DIR, HOME_ENV_PATH };
+export { HOME_CONFIG_DIR, HOME_ENV_PATH, readProjectConfig };
 //# sourceMappingURL=config.d.ts.map

package/dist/lib/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH,QAAA,MAAM,eAAe,QAAgD,CAAC;AACtE,QAAA,MAAM,aAAa,QAAmC,CAAC;AAkDvD,2DAA2D;AAC3D,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAsED,wBAAgB,SAAS,IAAI;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAiB/D;AAED,MAAM,MAAM,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgBzF;AAED,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAUH,QAAA,MAAM,eAAe,QAAgD,CAAC;AACtE,QAAA,MAAM,aAAa,QAAmC,CAAC;AAUvD,uDAAuD;AACvD,UAAU,aAAa;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,iBAAS,iBAAiB,IAAI,aAAa,GAAG,IAAI,CAuBjD;AAED,kDAAkD;AAClD,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,SAAS,GAAG,SAAS,GAAG,KAAK,GAAG,SAAS,CAAC;AAE7E,oDAAoD;AACpD,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,IAAI,cAAc,CAkE9C;AAiED,2DAA2D;AAC3D,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AA6DD,wBAAgB,SAAS,IAAI;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CA0B/D;AAED,MAAM,MAAM,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,iEAAiE;AACjE,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GACnE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,IAAI,YAAY,CAiB5C;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoBzF;AAED,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/lib/config.js

@@ -1,9 +1,10 @@
 /**
  * CLI config — reads PRODUCTBRAIN_API_KEY + CONVEX_SITE_URL from:
  * 1. Environment variables (always highest priority)
- * 2. Profile system (~/.config/productbrain/profiles/{name}.env)
- * 3. Legacy ~/.config/productbrain/.env (auto-migrated to profiles on first use)
- * 4. CWD .env.mcp / packages/mcp-server/.env.mcp / .env
+ * 2. Project config: .productbrain/config.json in CWD (WP-303 S0)
+ * 3. Profile system (~/.config/productbrain/profiles/{name}.env)
+ * 4. Legacy ~/.config/productbrain/.env (auto-migrated to profiles on first use)
+ * 5. CWD .env.mcp / packages/mcp-server/.env.mcp / .env
  *
  * Config loading is lazy — loadEnv() runs on first getConfig()/getConfigOrGuide() call.
  * This enables profile switching without import-time side effects (TEN-1276).
@@ -13,9 +14,10 @@
 import { readFileSync, existsSync, mkdirSync, writeFileSync } from 'fs';
 import { resolve } from 'path';
 import { homedir } from 'os';
-import { createInterface } from 'readline';
 import { DEFAULT_SITE_URL, isDevMode } from './constants.js';
 import { resolveProfileConfig } from './profiles.js';
+import { CLIError, ErrorCode } from './errors.js';
+import { confirm as promptConfirm, password as promptPassword } from './prompts.js';
 const HOME_CONFIG_DIR = resolve(homedir(), '.config', 'productbrain');
 const HOME_ENV_PATH = resolve(HOME_CONFIG_DIR, '.env');
 const CWD_ENV_PATHS = ['.env.mcp', 'packages/mcp-server/.env.mcp', '.env'];
@@ -23,6 +25,119 @@ const CWD_ENV_PATHS = ['.env.mcp', 'packages/mcp-server/.env.mcp', '.env'];
 const NON_TTY_MESSAGE = 'No API key. Set PRODUCTBRAIN_API_KEY or run pb login.';
 /** Track whether env has been loaded to avoid redundant file reads. */
 let envLoaded = false;
+/**
+ * Read .productbrain/config.json from CWD.
+ * Returns null if file missing. Warns to stderr on invalid JSON but does not throw.
+ */
+function readProjectConfig() {
+    const configPath = resolve(process.cwd(), '.productbrain', 'config.json');
+    if (!existsSync(configPath))
+        return null;
+    try {
+        const raw = readFileSync(configPath, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+            process.stderr.write('Warning: .productbrain/config.json is not a JSON object, skipping.\n');
+            return null;
+        }
+        const result = {};
+        if (typeof parsed.apiKey === 'string' && parsed.apiKey) {
+            result.apiKey = parsed.apiKey;
+        }
+        if (typeof parsed.siteUrl === 'string' && parsed.siteUrl) {
+            result.siteUrl = parsed.siteUrl;
+        }
+        return result;
+    }
+    catch {
+        process.stderr.write('Warning: .productbrain/config.json contains invalid JSON, skipping.\n');
+        return null;
+    }
+}
+/**
+ * Run the full config resolution cascade and return a typed result.
+ * Resolution order:
+ * 1. Environment variables (highest priority)
+ * 2. Project config (.productbrain/config.json in CWD)
+ * 3. Profile system (~/.config/productbrain/profiles/{name}.env)
+ * 4. Legacy home config (~/.config/productbrain/.env)
+ * 5. CWD .env files (.env.mcp, packages/mcp-server/.env.mcp, .env)
+ *
+ * siteUrl always has a value (falls back to DEFAULT_SITE_URL).
+ */
+export function resolveConfig() {
+    // 1. Env vars — check directly, don't mutate process.env
+    const envKey = process.env.PRODUCTBRAIN_API_KEY;
+    const envSite = process.env.CONVEX_SITE_URL;
+    if (envKey) {
+        return {
+            apiKey: envKey,
+            siteUrl: (envSite || DEFAULT_SITE_URL).replace(/\/$/, ''),
+            source: 'env',
+        };
+    }
+    // 2. Project config
+    const projectConfig = readProjectConfig();
+    if (projectConfig?.apiKey) {
+        return {
+            apiKey: projectConfig.apiKey,
+            siteUrl: (projectConfig.siteUrl || envSite || DEFAULT_SITE_URL).replace(/\/$/, ''),
+            source: 'project',
+        };
+    }
+    // 3. Profile system
+    const profileConfig = resolveProfileConfig();
+    if (profileConfig?.apiKey) {
+        return {
+            apiKey: profileConfig.apiKey,
+            siteUrl: (profileConfig.siteUrl || envSite || DEFAULT_SITE_URL).replace(/\/$/, ''),
+            source: 'profile',
+        };
+    }
+    // 4. Legacy home config
+    if (existsSync(HOME_ENV_PATH)) {
+        const vars = parseEnvVars(readFileSync(HOME_ENV_PATH, 'utf8'));
+        if (vars['PRODUCTBRAIN_API_KEY']) {
+            return {
+                apiKey: vars['PRODUCTBRAIN_API_KEY'],
+                siteUrl: (vars['CONVEX_SITE_URL'] || envSite || DEFAULT_SITE_URL).replace(/\/$/, ''),
+                source: 'profile',
+            };
+        }
+    }
+    // 5. CWD .env files
+    for (const p of CWD_ENV_PATHS) {
+        const full = resolve(process.cwd(), p);
+        if (existsSync(full)) {
+            const vars = parseEnvVars(readFileSync(full, 'utf8'));
+            if (vars['PRODUCTBRAIN_API_KEY']) {
+                return {
+                    apiKey: vars['PRODUCTBRAIN_API_KEY'],
+                    siteUrl: (vars['CONVEX_SITE_URL'] || envSite || DEFAULT_SITE_URL).replace(/\/$/, ''),
+                    source: 'cwd',
+                };
+            }
+            break;
+        }
+    }
+    // 6. No API key found anywhere — return with siteUrl default
+    return {
+        apiKey: undefined,
+        siteUrl: (envSite || DEFAULT_SITE_URL).replace(/\/$/, ''),
+        source: 'default',
+    };
+}
+/** Parse env file content and return key-value pairs (without mutating process.env). */
+function parseEnvVars(content) {
+    const vars = {};
+    for (const line of content.split('\n')) {
+        const m = line.match(/^([^#=]+)=(.*)$/);
+        if (m) {
+            vars[m[1].trim()] = m[2].trim().replace(/^["']|["']$/g, '');
+        }
+    }
+    return vars;
+}
 function parseEnvContent(content) {
     for (const line of content.split('\n')) {
         const m = line.match(/^([^#=]+)=(.*)$/);
@@ -35,10 +150,20 @@ function loadEnv() {
     if (envLoaded)
         return;
     envLoaded = true;
-    // 1. Try profile system first (handles auto-migration from legacy .env)
+    // 1. Try project config first (WP-303 S0)
+    const projectConfig = readProjectConfig();
+    if (projectConfig) {
+        if (!process.env.PRODUCTBRAIN_API_KEY && projectConfig.apiKey) {
+            process.env.PRODUCTBRAIN_API_KEY = projectConfig.apiKey;
+        }
+        if (!process.env.CONVEX_SITE_URL && projectConfig.siteUrl) {
+            process.env.CONVEX_SITE_URL = projectConfig.siteUrl;
+        }
+    }
+    // 2. Try profile system (handles auto-migration from legacy .env)
     const profileConfig = resolveProfileConfig();
     if (profileConfig) {
-        // Only set if not already set by env vars (env vars always win)
+        // Only set if not already set by env vars or project config
         if (!process.env.PRODUCTBRAIN_API_KEY) {
             process.env.PRODUCTBRAIN_API_KEY = profileConfig.apiKey;
         }
@@ -46,11 +171,11 @@ function loadEnv() {
             process.env.CONVEX_SITE_URL = profileConfig.siteUrl;
         }
     }
-    // 2. Legacy home config (in case profiles didn't find it)
+    // 3. Legacy home config (in case profiles didn't find it)
     if (existsSync(HOME_ENV_PATH)) {
         parseEnvContent(readFileSync(HOME_ENV_PATH, 'utf8'));
     }
-    // 3. CWD env files
+    // 4. CWD env files
     for (const p of CWD_ENV_PATHS) {
         const full = resolve(process.cwd(), p);
         if (existsSync(full)) {
@@ -63,36 +188,30 @@ function loadEnv() {
 export function resetConfigCache() {
     envLoaded = false;
 }
-function question(rl, prompt) {
-    return new Promise((resolve) => {
-        rl.question(prompt, (answer) => resolve((answer ?? '').trim().toLowerCase()));
-    });
-}
-function questionRaw(rl, prompt) {
-    return new Promise((resolve) => {
-        rl.question(prompt, (answer) => resolve((answer ?? '').trim()));
-    });
-}
 /**
  * Guided flow when key is missing (TTY only). Per docs/cli-unauthenticated-user-journey.md.
  * Returns true if we saved and ran retry; false if user said No (caller should exit).
  */
 async function runGuidedFlow(retry) {
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
-    console.log('Do you have an API key from Product Brain? (y/n)');
-    console.log('  Get one: Product Brain app → Settings → API Keys');
-    const hasKey = await question(rl, '> ');
-    if (hasKey !== 'y' && hasKey !== 'yes') {
+    const hasKey = await promptConfirm({
+        message: 'Do you have an API key from Product Brain?',
+        initialValue: false,
+    });
+    if (!hasKey) {
         console.log('Get your key: Product Brain app → Settings → API Keys. Then run: pb login');
-        rl.close();
         process.exit(0);
     }
-    let apiKey = await questionRaw(rl, 'Paste your API key (pb_sk_...): ');
-    if (!apiKey || !apiKey.startsWith('pb_sk_')) {
+    let apiKey = await promptPassword({
+        message: 'Paste your API key (pb_sk_...)',
+        validate: (v) => (!v ? 'Key is required' : undefined),
+    });
+    if (!apiKey.startsWith('pb_sk_')) {
         console.log('Key must start with pb_sk_. Try again or run pb login.');
-        apiKey = await questionRaw(rl, 'Paste your API key (pb_sk_...): ');
+        apiKey = await promptPassword({
+            message: 'Paste your API key (pb_sk_...)',
+            validate: (v) => (!v || !v.startsWith('pb_sk_') ? 'Key must start with pb_sk_' : undefined),
+        });
     }
-    rl.close();
     if (!apiKey || !apiKey.startsWith('pb_sk_')) {
         console.log('Get your key: Product Brain app → Settings → API Keys. Then run: pb login');
         process.exit(0);
@@ -125,14 +244,48 @@ export function getConfig() {
     const apiKey = process.env.PRODUCTBRAIN_API_KEY ?? '';
     const siteUrl = (process.env.CONVEX_SITE_URL ?? DEFAULT_SITE_URL).replace(/\/$/, '');
     if (!apiKey || !apiKey.startsWith('pb_sk_')) {
-        throw new Error(NON_TTY_MESSAGE);
+        throw new CLIError(NON_TTY_MESSAGE, {
+            code: ErrorCode.AUTH_MISSING,
+            category: 'auth',
+            guidance: 'Set PRODUCTBRAIN_API_KEY or run `pb login`.',
+        });
     }
     const allowHttp = isDevMode() && siteUrl.startsWith('http://localhost');
     if (!siteUrl.startsWith('https://') && !allowHttp) {
-        throw new Error(`CONVEX_SITE_URL must use HTTPS (got "${siteUrl.slice(0, 30)}…"). API keys must not be sent over unencrypted connections.`);
+        throw new CLIError(`CONVEX_SITE_URL must use HTTPS (got "${siteUrl.slice(0, 30)}…"). API keys must not be sent over unencrypted connections.`, {
+            code: ErrorCode.CONFIG_INVALID,
+            category: 'config',
+            guidance: 'Set CONVEX_SITE_URL to an https:// URL.',
+        });
     }
     return { apiKey, siteUrl };
 }
+/**
+ * Non-throwing alternative to getConfig().
+ *
+ * Architecture: getConfig() is the primary path for commands that require auth — it
+ * throws CLIError when the key is missing, which is correct for API call paths.
+ * getConfigSafe() is for status/probe surfaces (no-args dashboard, init) that need
+ * to check config availability without crashing. Both paths are intentional and
+ * coexist by design — see WP-303 review (DW#5).
+ *
+ * Uses resolveConfig() directly (no loadEnv) to avoid env var pollution affecting source attribution.
+ */
+export function getConfigSafe() {
+    const resolved = resolveConfig();
+    if (!resolved.apiKey || !resolved.apiKey.startsWith('pb_sk_')) {
+        return { ok: false, reason: 'No API key. Run pb login or set PRODUCTBRAIN_API_KEY.' };
+    }
+    const siteUrl = resolved.siteUrl;
+    const allowHttp = isDevMode() && siteUrl.startsWith('http://localhost');
+    if (!siteUrl.startsWith('https://') && !allowHttp) {
+        return {
+            ok: false,
+            reason: `CONVEX_SITE_URL must use HTTPS (got "${siteUrl.slice(0, 30)}…"). API keys must not be sent over unencrypted connections.`,
+        };
+    }
+    return { ok: true, apiKey: resolved.apiKey, siteUrl, source: resolved.source };
+}
 /**
  * Get config; if key is missing and stdin is a TTY, run guided flow (y/n → paste key → save → retry).
  * @param retry Called after saving key so the original command runs in-process.
@@ -147,10 +300,14 @@ export async function getConfigOrGuide(retry) {
         return { apiKey, siteUrl };
     }
     if (!process.stdin.isTTY) {
-        throw new Error(NON_TTY_MESSAGE);
+        throw new CLIError(NON_TTY_MESSAGE, {
+            code: ErrorCode.AUTH_MISSING,
+            category: 'auth',
+            guidance: 'Set PRODUCTBRAIN_API_KEY or run `pb login`.',
+        });
     }
     const didRetry = await runGuidedFlow(retry);
     return didRetry ? null : null;
 }
-export { HOME_CONFIG_DIR, HOME_ENV_PATH };
+export { HOME_CONFIG_DIR, HOME_ENV_PATH, readProjectConfig };
 //# sourceMappingURL=config.js.map