@vibekiln/cutline-mcp-cli 0.4.0 → 0.4.2

package/dist/auth/keychain.js

@@ -10,7 +10,6 @@ export async function deleteRefreshToken() {
     const config = loadConfig();
     if (!config.refreshToken)
         return false;
-    delete config.refreshToken;
-    saveConfig(config);
+    saveConfig({ ...config, refreshToken: undefined });
     return true;
 }

package/dist/commands/setup.js

@@ -67,12 +67,12 @@ async function fetchProducts(idToken, options) {
             headers: { Authorization: `Bearer ${idToken}` },
         });
         if (!res.ok)
-            return [];
+            return { products: [], requestOk: false };
         const data = await res.json();
-        return data.products ?? [];
+        return { products: data.products ?? [], requestOk: true };
     }
     catch {
-        return [];
+        return { products: [], requestOk: false };
     }
 }
 function prompt(question) {
@@ -237,12 +237,51 @@ export async function setupCommand(options) {
     const projectRoot = resolve(options.projectRoot ?? process.cwd());
     const configPath = join(projectRoot, '.cutline', 'config.json');
     const hasExistingConfig = existsSync(configPath);
-    let graphConnected = hasExistingConfig;
-    if (tier === 'premium' && idToken && !hasExistingConfig) {
+    let existingConfig = null;
+    let hasUsableExistingConfig = false;
+    let graphConnected = false;
+    if (hasExistingConfig) {
+        try {
+            existingConfig = JSON.parse(readFileSync(configPath, 'utf-8'));
+            hasUsableExistingConfig = Boolean(existingConfig?.product_id);
+            graphConnected = hasUsableExistingConfig;
+        }
+        catch {
+            existingConfig = null;
+            hasUsableExistingConfig = false;
+            graphConnected = false;
+        }
+    }
+    // Validate that an existing binding is visible to the current account.
+    // This prevents showing "connected" when the repo has a product_id from
+    // a different account.
+    if (hasUsableExistingConfig && idToken) {
+        const currentEmail = (email ?? '').trim().toLowerCase();
+        const boundEmail = String(existingConfig?.linked_email ?? '').trim().toLowerCase();
+        if (boundEmail && currentEmail && boundEmail !== currentEmail) {
+            graphConnected = false;
+            hasUsableExistingConfig = false;
+            console.log(chalk.yellow(`  Existing product binding is for ${existingConfig?.linked_email}, not ${email}.`));
+            console.log(chalk.dim('  Will not use this graph for the current account.\n'));
+        }
+        else {
+            const { products, requestOk } = await fetchProducts(idToken, { staging: options.staging });
+            if (requestOk) {
+                const canAccessBoundProduct = products.some((p) => p.id === existingConfig?.product_id);
+                if (!canAccessBoundProduct) {
+                    graphConnected = false;
+                    hasUsableExistingConfig = false;
+                    console.log(chalk.yellow(`  Existing product graph is not accessible from ${email}.`));
+                    console.log(chalk.dim('  Re-linking is required for this account.\n'));
+                }
+            }
+        }
+    }
+    if (tier === 'premium' && idToken && !hasUsableExistingConfig) {
         const productSpinner = ora('Fetching your product graphs...').start();
-        const products = await fetchProducts(idToken, { staging: options.staging });
+        const { products, requestOk } = await fetchProducts(idToken, { staging: options.staging });
         productSpinner.stop();
-        if (products.length > 0) {
+        if (requestOk && products.length > 0) {
             console.log(chalk.bold('  Connect to a product graph\n'));
             products.forEach((p, i) => {
                 const date = p.createdAt ? chalk.dim(` (${new Date(p.createdAt).toLocaleDateString()})`) : '';
@@ -260,6 +299,7 @@ export async function setupCommand(options) {
                 writeFileSync(configPath, JSON.stringify({
                     product_id: selected.id,
                     product_name: selected.name,
+                    linked_email: email ?? null,
                 }, null, 2) + '\n');
                 console.log(chalk.green(`\n  ✓ Connected to "${selected.name}"`));
                 console.log(chalk.dim(`    ${configPath}\n`));
@@ -269,16 +309,20 @@ export async function setupCommand(options) {
                 console.log(chalk.dim('\n  Skipped. Run `cutline-mcp setup` again to connect later.\n'));
             }
         }
-        else {
+        else if (requestOk) {
             console.log(chalk.dim('  No completed product graphs found.'));
             console.log(chalk.dim('  Ask your AI agent to "Run a deep dive on my product idea" first,'));
             console.log(chalk.dim('  then re-run'), chalk.cyan('cutline-mcp setup'), chalk.dim('to connect it.'));
             console.log();
         }
+        else {
+            console.log(chalk.yellow('  Could not verify product graphs (network/auth issue).'));
+            console.log(chalk.dim('  Re-run'), chalk.cyan('cutline-mcp setup'), chalk.dim('after auth/network is healthy.\n'));
+        }
     }
-    else if (hasExistingConfig) {
+    else if (hasUsableExistingConfig) {
         try {
-            const existing = JSON.parse(readFileSync(configPath, 'utf-8'));
+            const existing = existingConfig ?? JSON.parse(readFileSync(configPath, 'utf-8'));
             console.log(chalk.green(`  ✓ Connected to product graph:`), chalk.white(existing.product_name || existing.product_id));
             console.log();
         }

package/dist/servers/cutline-server.js

@@ -7076,6 +7076,12 @@ async function handleSecurityScan(genericGraphId, uid, args, deps) {
       total: scaFindings.length,
       critical: scaFindings.filter((f) => f.severity === "critical").length,
       high: scaFindings.filter((f) => f.severity === "high").length,
+      all: scaFindings.map((f) => ({
+        id: f.id,
+        package: `${f.package_name}@${f.package_version}`,
+        severity: f.severity,
+        fix: f.fixed_version ? `Upgrade to ${f.fixed_version}` : void 0
+      })),
       top: scaFindings.slice(0, 5).map((f) => ({
         id: f.id,
         package: `${f.package_name}@${f.package_version}`,
@@ -7093,7 +7099,7 @@ function deltaStr(current, previous) {
     return " (no change)";
   return diff > 0 ? ` (**+${diff}** since last scan)` : ` (**${diff}** since last scan)`;
 }
-function formatAuditOutput(result, reportId, publicSiteUrl = "https://thecutline.ai", hiddenAuditDimensions = []) {
+function formatAuditOutput(result, reportId, publicSiteUrl = "https://thecutline.ai", hiddenAuditDimensions = [], fullReport = false) {
   const m = result.metrics;
   const p = result.previousMetrics;
   const isRescan = !!p;
@@ -7169,11 +7175,12 @@ function formatAuditOutput(result, reportId, publicSiteUrl = "https://thecutline
   if (securityVisible && result.scaFindings && result.scaFindings.total > 0) {
     const sca = result.scaFindings;
     lines.push(``, `## Dependency Vulnerabilities (SCA)`, ``, `**${sca.total} known vulnerabilities** found (${sca.critical} critical, ${sca.high} high)`, ``);
-    for (const v of sca.top) {
+    const scaEntries = fullReport && sca.all?.length ? sca.all : sca.top;
+    for (const v of scaEntries) {
       const fix = v.fix ? ` \u2192 ${v.fix}` : "";
       lines.push(`- **[${v.severity.toUpperCase()}]** ${v.package}: ${v.id}${fix}`);
     }
-    if (sca.total > sca.top.length) {
+    if (!fullReport && sca.total > sca.top.length) {
       lines.push(`- ...and ${sca.total - sca.top.length} more`);
     }
   }
@@ -7181,24 +7188,32 @@ function formatAuditOutput(result, reportId, publicSiteUrl = "https://thecutline
   const totalFindings = visibleFindings.length;
   const criticalCount = visibleFindings.filter((g) => g.severity === "critical" || g.severity === "high").length;
   if (totalFindings > 0) {
-    const topFinding = visibleFindings[0];
-    lines.push(``, `## #1 Finding \u2014 Fix This Now`, ``, `**[${topFinding.severity.toUpperCase()}] ${topFinding.title}**`, `*Category: ${topFinding.category}*`, ``, topFinding.description || "Address this finding to improve your readiness scores.", ``, `> Fix this issue, then re-run \`code_audit\` to see your scores improve.`);
-    const remaining = visibleFindings.slice(1);
-    if (remaining.length > 0) {
-      lines.push(``, `## ${remaining.length} More Finding${remaining.length > 1 ? "s" : ""} Detected`);
-      const teaserLimit = Math.min(remaining.length, 5);
-      for (let i = 0; i < teaserLimit; i++) {
-        lines.push(`- [${remaining[i].severity.toUpperCase()}] ${remaining[i].title}`);
+    if (fullReport) {
+      lines.push(``, `## Findings`, ``);
+      for (const finding of visibleFindings) {
+        lines.push(`**[${finding.severity.toUpperCase()}] ${finding.title}**`, `*Category: ${finding.category}*`, finding.description || "Address this finding to improve your readiness scores.", ``);
       }
-      if (remaining.length > teaserLimit) {
-        lines.push(`- ... and **${remaining.length - teaserLimit} more**`);
+      lines.push(`> Re-run \`code_audit\` after fixes to measure score improvements.`);
+    } else {
+      const topFinding = visibleFindings[0];
+      lines.push(``, `## #1 Finding \u2014 Fix This Now`, ``, `**[${topFinding.severity.toUpperCase()}] ${topFinding.title}**`, `*Category: ${topFinding.category}*`, ``, topFinding.description || "Address this finding to improve your readiness scores.", ``, `> Fix this issue, then re-run \`code_audit\` to see your scores improve.`);
+      const remaining = visibleFindings.slice(1);
+      if (remaining.length > 0) {
+        lines.push(``, `## ${remaining.length} More Finding${remaining.length > 1 ? "s" : ""} Detected`);
+        const teaserLimit = Math.min(remaining.length, 5);
+        for (let i = 0; i < teaserLimit; i++) {
+          lines.push(`- [${remaining[i].severity.toUpperCase()}] ${remaining[i].title}`);
+        }
+        if (remaining.length > teaserLimit) {
+          lines.push(`- ... and **${remaining.length - teaserLimit} more**`);
+        }
       }
     }
   }
   lines.push(``, `---`, ``);
-  if (totalFindings > 1) {
+  if (!fullReport && totalFindings > 1) {
     lines.push(`### Unlock Full Analysis`, ``, `You fixed one \u2014 **${totalFindings - 1} findings** remain (${criticalCount} critical/high).`, `Upgrade to Cutline Pro for:`, `- Full details and remediation for every finding`, `- Prioritized RGR remediation plans your coding agent can execute`, `- Product-specific deep dive with feature-level constraint mapping`, `- Continuous score tracking with this audit as a baseline prior`, ``, `\u2192 Run \`cutline-mcp upgrade\` or visit **https://thecutline.ai/upgrade**`);
-  } else if (totalFindings === 1) {
+  } else if (totalFindings >= 1) {
     lines.push(`### Next Steps`, ``, `Fix the finding above, then re-scan to see your scores improve.`, `When ready, run a **deep dive** for product-specific analysis \u2014`, `these generic scores will serve as a prior for your product graph.`);
   } else {
     lines.push(`### Next Steps`, ``, `No critical findings detected. Run a **deep dive** for product-specific`, `analysis with feature coverage and the generic scores as a prior.`);
@@ -8423,15 +8438,17 @@ Why AI: ${idea.whyAI}`
             return "engineering";
           return "security";
         };
+        let hasPremiumSubscription = false;
         {
           const rateInfo = await getScanRateLimit();
+          hasPremiumSubscription = rateInfo.subscription === "active" || rateInfo.subscription === "trialing";
           const now = /* @__PURE__ */ new Date();
           const resetAt = rateInfo.periodStart ? new Date(rateInfo.periodStart) : /* @__PURE__ */ new Date(0);
           const monthStart = new Date(now.getFullYear(), now.getMonth(), 1);
           if (resetAt < monthStart) {
             await updateScanRateLimit({ free_scan_counter: { count: 1, reset_at: now.toISOString() } });
           } else if (rateInfo.scanCount >= 3) {
-            if (rateInfo.subscription !== "active" && rateInfo.subscription !== "trialing") {
+            if (!hasPremiumSubscription) {
               throw new McpError(ErrorCode.InvalidRequest, "Free scan limit reached (3/month). Run `cutline-mcp upgrade` in your terminal, or visit https://thecutline.ai/upgrade");
             }
           } else {
@@ -8500,7 +8517,7 @@ Why AI: ${idea.whyAI}`
           console.error("[code_audit] Report persistence failed (non-fatal):", e);
         }
         return {
-          content: [{ type: "text", text: formatAuditOutput(result, reportId, reportSiteUrl, hiddenAuditDimensions) }]
+          content: [{ type: "text", text: formatAuditOutput(result, reportId, reportSiteUrl, hiddenAuditDimensions, hasPremiumSubscription) }]
         };
       }
       const authCtx = await resolveAuthContext(args.auth_token);

package/dist/utils/config-store.js

@@ -12,6 +12,13 @@ export function saveConfig(config) {
     ensureConfigDir();
     const current = loadConfig();
     const newConfig = { ...current, ...config };
+    // Treat explicit undefined values as key deletion so callers can clear
+    // persisted fields (for example during logout).
+    for (const [key, value] of Object.entries(config)) {
+        if (value === undefined) {
+            delete newConfig[key];
+        }
+    }
     // Remove legacy fields that are no longer stored (e.g. firebaseApiKey)
     // to prevent stale values from causing cross-project auth mismatches
     delete newConfig.firebaseApiKey;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@vibekiln/cutline-mcp-cli",
-    "version": "0.4.0",
+    "version": "0.4.2",
     "description": "CLI and MCP servers for Cutline — authenticate, then run constraint-aware MCP servers in Cursor or any MCP client.",
     "type": "module",
     "main": "dist/index.js",