@vibekiln/cutline-mcp-cli 0.4.1 → 0.4.2

package/dist/commands/setup.js

@@ -67,12 +67,12 @@ async function fetchProducts(idToken, options) {
             headers: { Authorization: `Bearer ${idToken}` },
         });
         if (!res.ok)
-            return [];
+            return { products: [], requestOk: false };
         const data = await res.json();
-        return data.products ?? [];
+        return { products: data.products ?? [], requestOk: true };
     }
     catch {
-        return [];
+        return { products: [], requestOk: false };
     }
 }
 function prompt(question) {
@@ -237,12 +237,51 @@ export async function setupCommand(options) {
     const projectRoot = resolve(options.projectRoot ?? process.cwd());
     const configPath = join(projectRoot, '.cutline', 'config.json');
     const hasExistingConfig = existsSync(configPath);
-    let graphConnected = hasExistingConfig;
-    if (tier === 'premium' && idToken && !hasExistingConfig) {
+    let existingConfig = null;
+    let hasUsableExistingConfig = false;
+    let graphConnected = false;
+    if (hasExistingConfig) {
+        try {
+            existingConfig = JSON.parse(readFileSync(configPath, 'utf-8'));
+            hasUsableExistingConfig = Boolean(existingConfig?.product_id);
+            graphConnected = hasUsableExistingConfig;
+        }
+        catch {
+            existingConfig = null;
+            hasUsableExistingConfig = false;
+            graphConnected = false;
+        }
+    }
+    // Validate that an existing binding is visible to the current account.
+    // This prevents showing "connected" when the repo has a product_id from
+    // a different account.
+    if (hasUsableExistingConfig && idToken) {
+        const currentEmail = (email ?? '').trim().toLowerCase();
+        const boundEmail = String(existingConfig?.linked_email ?? '').trim().toLowerCase();
+        if (boundEmail && currentEmail && boundEmail !== currentEmail) {
+            graphConnected = false;
+            hasUsableExistingConfig = false;
+            console.log(chalk.yellow(`  Existing product binding is for ${existingConfig?.linked_email}, not ${email}.`));
+            console.log(chalk.dim('  Will not use this graph for the current account.\n'));
+        }
+        else {
+            const { products, requestOk } = await fetchProducts(idToken, { staging: options.staging });
+            if (requestOk) {
+                const canAccessBoundProduct = products.some((p) => p.id === existingConfig?.product_id);
+                if (!canAccessBoundProduct) {
+                    graphConnected = false;
+                    hasUsableExistingConfig = false;
+                    console.log(chalk.yellow(`  Existing product graph is not accessible from ${email}.`));
+                    console.log(chalk.dim('  Re-linking is required for this account.\n'));
+                }
+            }
+        }
+    }
+    if (tier === 'premium' && idToken && !hasUsableExistingConfig) {
         const productSpinner = ora('Fetching your product graphs...').start();
-        const products = await fetchProducts(idToken, { staging: options.staging });
+        const { products, requestOk } = await fetchProducts(idToken, { staging: options.staging });
         productSpinner.stop();
-        if (products.length > 0) {
+        if (requestOk && products.length > 0) {
             console.log(chalk.bold('  Connect to a product graph\n'));
             products.forEach((p, i) => {
                 const date = p.createdAt ? chalk.dim(` (${new Date(p.createdAt).toLocaleDateString()})`) : '';
@@ -260,6 +299,7 @@ export async function setupCommand(options) {
                 writeFileSync(configPath, JSON.stringify({
                     product_id: selected.id,
                     product_name: selected.name,
+                    linked_email: email ?? null,
                 }, null, 2) + '\n');
                 console.log(chalk.green(`\n  ✓ Connected to "${selected.name}"`));
                 console.log(chalk.dim(`    ${configPath}\n`));
@@ -269,16 +309,20 @@ export async function setupCommand(options) {
                 console.log(chalk.dim('\n  Skipped. Run `cutline-mcp setup` again to connect later.\n'));
             }
         }
-        else {
+        else if (requestOk) {
             console.log(chalk.dim('  No completed product graphs found.'));
             console.log(chalk.dim('  Ask your AI agent to "Run a deep dive on my product idea" first,'));
             console.log(chalk.dim('  then re-run'), chalk.cyan('cutline-mcp setup'), chalk.dim('to connect it.'));
             console.log();
         }
+        else {
+            console.log(chalk.yellow('  Could not verify product graphs (network/auth issue).'));
+            console.log(chalk.dim('  Re-run'), chalk.cyan('cutline-mcp setup'), chalk.dim('after auth/network is healthy.\n'));
+        }
     }
-    else if (hasExistingConfig) {
+    else if (hasUsableExistingConfig) {
         try {
-            const existing = JSON.parse(readFileSync(configPath, 'utf-8'));
+            const existing = existingConfig ?? JSON.parse(readFileSync(configPath, 'utf-8'));
             console.log(chalk.green(`  ✓ Connected to product graph:`), chalk.white(existing.product_name || existing.product_id));
             console.log();
         }

package/dist/servers/cutline-server.js

@@ -7076,6 +7076,12 @@ async function handleSecurityScan(genericGraphId, uid, args, deps) {
       total: scaFindings.length,
       critical: scaFindings.filter((f) => f.severity === "critical").length,
       high: scaFindings.filter((f) => f.severity === "high").length,
+      all: scaFindings.map((f) => ({
+        id: f.id,
+        package: `${f.package_name}@${f.package_version}`,
+        severity: f.severity,
+        fix: f.fixed_version ? `Upgrade to ${f.fixed_version}` : void 0
+      })),
       top: scaFindings.slice(0, 5).map((f) => ({
         id: f.id,
         package: `${f.package_name}@${f.package_version}`,
@@ -7169,11 +7175,12 @@ function formatAuditOutput(result, reportId, publicSiteUrl = "https://thecutline
   if (securityVisible && result.scaFindings && result.scaFindings.total > 0) {
     const sca = result.scaFindings;
     lines.push(``, `## Dependency Vulnerabilities (SCA)`, ``, `**${sca.total} known vulnerabilities** found (${sca.critical} critical, ${sca.high} high)`, ``);
-    for (const v of sca.top) {
+    const scaEntries = fullReport && sca.all?.length ? sca.all : sca.top;
+    for (const v of scaEntries) {
       const fix = v.fix ? ` \u2192 ${v.fix}` : "";
       lines.push(`- **[${v.severity.toUpperCase()}]** ${v.package}: ${v.id}${fix}`);
     }
-    if (sca.total > sca.top.length) {
+    if (!fullReport && sca.total > sca.top.length) {
       lines.push(`- ...and ${sca.total - sca.top.length} more`);
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@vibekiln/cutline-mcp-cli",
-    "version": "0.4.1",
+    "version": "0.4.2",
     "description": "CLI and MCP servers for Cutline — authenticate, then run constraint-aware MCP servers in Cursor or any MCP client.",
     "type": "module",
     "main": "dist/index.js",