@vibekiln/cutline-mcp-cli 0.4.1 → 0.4.3

package/dist/commands/init.js

@@ -204,6 +204,9 @@ function ensureGitignore(projectRoot, patterns) {
 export async function initCommand(options) {
     const projectRoot = resolve(options.projectRoot ?? process.cwd());
     const config = readCutlineConfig(projectRoot);
+    const scanUrl = options.staging
+        ? 'https://cutline-staging.web.app/scan'
+        : 'https://thecutline.ai/scan';
     console.log(chalk.bold('\n🔧 Cutline Init\n'));
     // Authenticate and determine tier
     const spinner = ora('Checking authentication...').start();
@@ -212,6 +215,8 @@ export async function initCommand(options) {
     if (!auth) {
         spinner.warn(chalk.yellow('Not authenticated — generating free-tier rules'));
         console.log(chalk.dim('  Run `cutline-mcp login` to authenticate for richer config.\n'));
+        console.log(chalk.dim('  Or run a quick scan in the web app:'), chalk.cyan(scanUrl));
+        console.log();
     }
     else {
         tier = auth.tier;
@@ -292,6 +297,7 @@ export async function initCommand(options) {
     else if (tier === 'free') {
         console.log(chalk.dim('\n  Upgrade to Premium for product-specific constraint graphs and .cutline.md'));
         console.log(chalk.dim('  →'), chalk.cyan('cutline-mcp upgrade'), chalk.dim('or https://thecutline.ai/upgrade'));
+        console.log(chalk.dim('  Free scan in browser:'), chalk.cyan(scanUrl));
     }
     if (generatedApiKey) {
         console.log();

package/dist/commands/setup.js

@@ -67,12 +67,12 @@ async function fetchProducts(idToken, options) {
             headers: { Authorization: `Bearer ${idToken}` },
         });
         if (!res.ok)
-            return [];
+            return { products: [], requestOk: false };
         const data = await res.json();
-        return data.products ?? [];
+        return { products: data.products ?? [], requestOk: true };
     }
     catch {
-        return [];
+        return { products: [], requestOk: false };
     }
 }
 function prompt(question) {
@@ -237,12 +237,51 @@ export async function setupCommand(options) {
     const projectRoot = resolve(options.projectRoot ?? process.cwd());
     const configPath = join(projectRoot, '.cutline', 'config.json');
     const hasExistingConfig = existsSync(configPath);
-    let graphConnected = hasExistingConfig;
-    if (tier === 'premium' && idToken && !hasExistingConfig) {
+    let existingConfig = null;
+    let hasUsableExistingConfig = false;
+    let graphConnected = false;
+    if (hasExistingConfig) {
+        try {
+            existingConfig = JSON.parse(readFileSync(configPath, 'utf-8'));
+            hasUsableExistingConfig = Boolean(existingConfig?.product_id);
+            graphConnected = hasUsableExistingConfig;
+        }
+        catch {
+            existingConfig = null;
+            hasUsableExistingConfig = false;
+            graphConnected = false;
+        }
+    }
+    // Validate that an existing binding is visible to the current account.
+    // This prevents showing "connected" when the repo has a product_id from
+    // a different account.
+    if (hasUsableExistingConfig && idToken) {
+        const currentEmail = (email ?? '').trim().toLowerCase();
+        const boundEmail = String(existingConfig?.linked_email ?? '').trim().toLowerCase();
+        if (boundEmail && currentEmail && boundEmail !== currentEmail) {
+            graphConnected = false;
+            hasUsableExistingConfig = false;
+            console.log(chalk.yellow(`  Existing product binding is for ${existingConfig?.linked_email}, not ${email}.`));
+            console.log(chalk.dim('  Will not use this graph for the current account.\n'));
+        }
+        else {
+            const { products, requestOk } = await fetchProducts(idToken, { staging: options.staging });
+            if (requestOk) {
+                const canAccessBoundProduct = products.some((p) => p.id === existingConfig?.product_id);
+                if (!canAccessBoundProduct) {
+                    graphConnected = false;
+                    hasUsableExistingConfig = false;
+                    console.log(chalk.yellow(`  Existing product graph is not accessible from ${email}.`));
+                    console.log(chalk.dim('  Re-linking is required for this account.\n'));
+                }
+            }
+        }
+    }
+    if (tier === 'premium' && idToken && !hasUsableExistingConfig) {
         const productSpinner = ora('Fetching your product graphs...').start();
-        const products = await fetchProducts(idToken, { staging: options.staging });
+        const { products, requestOk } = await fetchProducts(idToken, { staging: options.staging });
         productSpinner.stop();
-        if (products.length > 0) {
+        if (requestOk && products.length > 0) {
             console.log(chalk.bold('  Connect to a product graph\n'));
             products.forEach((p, i) => {
                 const date = p.createdAt ? chalk.dim(` (${new Date(p.createdAt).toLocaleDateString()})`) : '';
@@ -260,6 +299,7 @@ export async function setupCommand(options) {
                 writeFileSync(configPath, JSON.stringify({
                     product_id: selected.id,
                     product_name: selected.name,
+                    linked_email: email ?? null,
                 }, null, 2) + '\n');
                 console.log(chalk.green(`\n  ✓ Connected to "${selected.name}"`));
                 console.log(chalk.dim(`    ${configPath}\n`));
@@ -269,16 +309,20 @@ export async function setupCommand(options) {
                 console.log(chalk.dim('\n  Skipped. Run `cutline-mcp setup` again to connect later.\n'));
             }
         }
-        else {
+        else if (requestOk) {
             console.log(chalk.dim('  No completed product graphs found.'));
             console.log(chalk.dim('  Ask your AI agent to "Run a deep dive on my product idea" first,'));
             console.log(chalk.dim('  then re-run'), chalk.cyan('cutline-mcp setup'), chalk.dim('to connect it.'));
             console.log();
         }
+        else {
+            console.log(chalk.yellow('  Could not verify product graphs (network/auth issue).'));
+            console.log(chalk.dim('  Re-run'), chalk.cyan('cutline-mcp setup'), chalk.dim('after auth/network is healthy.\n'));
+        }
     }
-    else if (hasExistingConfig) {
+    else if (hasUsableExistingConfig) {
         try {
-            const existing = JSON.parse(readFileSync(configPath, 'utf-8'));
+            const existing = existingConfig ?? JSON.parse(readFileSync(configPath, 'utf-8'));
             console.log(chalk.green(`  ✓ Connected to product graph:`), chalk.white(existing.product_name || existing.product_id));
             console.log();
         }

package/dist/servers/{chunk-6Y3AEXE3.js → chunk-X2B5QUWO.js}

@@ -305,13 +305,17 @@ function getHiddenAuditDimensions() {
   const normalized = [...new Set(hidden.map((d) => String(d).trim().toLowerCase()).filter((d) => allowed.has(d)))];
   return normalized;
 }
-function getStoredApiKey() {
+function getStoredApiKey(options) {
+  const includeConfig = options?.includeConfig ?? true;
   if (process.env.CUTLINE_API_KEY) {
     return {
       apiKey: process.env.CUTLINE_API_KEY,
       environment: process.env.CUTLINE_ENV === "staging" ? "staging" : "production"
     };
   }
+  if (!includeConfig) {
+    return null;
+  }
   const config = readLocalCutlineConfig();
   if (config?.apiKey) {
     return { apiKey: config.apiKey, environment: config.environment };
@@ -406,12 +410,15 @@ function getSiteUrl(environment) {
   return environment === "staging" ? "https://cutline-staging.web.app" : "https://thecutline.ai";
 }
 async function getPublicSiteUrlForCurrentAuth() {
+  const stored = await getStoredToken();
+  if (stored?.environment) {
+    return getSiteUrl(stored.environment);
+  }
   const apiKeyInfo = getStoredApiKey();
   if (apiKeyInfo?.environment) {
     return getSiteUrl(apiKeyInfo.environment);
   }
-  const stored = await getStoredToken();
-  return getSiteUrl(stored?.environment);
+  return getSiteUrl();
 }
 var cachedBaseUrl;
 var cachedIdToken;
@@ -455,27 +462,34 @@ async function exchangeRefreshForId(refreshToken, environment) {
   return data.id_token;
 }
 async function resolveAuth() {
-  const apiKeyInfo = getStoredApiKey();
-  if (apiKeyInfo) {
+  const envApiKeyInfo = getStoredApiKey({ includeConfig: false });
+  if (envApiKeyInfo) {
     return {
-      baseUrl: getBaseUrl(apiKeyInfo.environment),
-      idToken: apiKeyInfo.apiKey
+      baseUrl: getBaseUrl(envApiKeyInfo.environment),
+      idToken: envApiKeyInfo.apiKey
     };
   }
   if (cachedIdToken && Date.now() < tokenExpiresAt && cachedBaseUrl) {
     return { baseUrl: cachedBaseUrl, idToken: cachedIdToken };
   }
   const stored = await getStoredToken();
-  if (!stored) {
-    throw new Error("Not authenticated. Run 'cutline-mcp login' or set CUTLINE_API_KEY.");
+  if (stored) {
+    const env = stored.environment || "production";
+    const baseUrl = getBaseUrl(env);
+    const idToken = await exchangeRefreshForId(stored.refreshToken, env);
+    cachedBaseUrl = baseUrl;
+    cachedIdToken = idToken;
+    tokenExpiresAt = Date.now() + 50 * 60 * 1e3;
+    return { baseUrl, idToken };
+  }
+  const configApiKeyInfo = getStoredApiKey();
+  if (configApiKeyInfo) {
+    return {
+      baseUrl: getBaseUrl(configApiKeyInfo.environment),
+      idToken: configApiKeyInfo.apiKey
+    };
   }
-  const env = stored.environment || "production";
-  const baseUrl = getBaseUrl(env);
-  const idToken = await exchangeRefreshForId(stored.refreshToken, env);
-  cachedBaseUrl = baseUrl;
-  cachedIdToken = idToken;
-  tokenExpiresAt = Date.now() + 50 * 60 * 1e3;
-  return { baseUrl, idToken };
+  throw new Error("Not authenticated. Run 'cutline-mcp login' or set CUTLINE_API_KEY.");
 }
 async function proxy(action, params = {}) {
   const { baseUrl, idToken } = await resolveAuth();

package/dist/servers/cutline-server.js

@@ -75,7 +75,7 @@ import {
   upsertEntities,
   upsertNodes,
   validateRequestSize
-} from "./chunk-6Y3AEXE3.js";
+} from "./chunk-X2B5QUWO.js";
 import {
   GraphTraverser,
   computeGenericGraphMetrics,
@@ -7076,6 +7076,12 @@ async function handleSecurityScan(genericGraphId, uid, args, deps) {
       total: scaFindings.length,
       critical: scaFindings.filter((f) => f.severity === "critical").length,
       high: scaFindings.filter((f) => f.severity === "high").length,
+      all: scaFindings.map((f) => ({
+        id: f.id,
+        package: `${f.package_name}@${f.package_version}`,
+        severity: f.severity,
+        fix: f.fixed_version ? `Upgrade to ${f.fixed_version}` : void 0
+      })),
       top: scaFindings.slice(0, 5).map((f) => ({
         id: f.id,
         package: `${f.package_name}@${f.package_version}`,
@@ -7169,11 +7175,12 @@ function formatAuditOutput(result, reportId, publicSiteUrl = "https://thecutline
   if (securityVisible && result.scaFindings && result.scaFindings.total > 0) {
     const sca = result.scaFindings;
     lines.push(``, `## Dependency Vulnerabilities (SCA)`, ``, `**${sca.total} known vulnerabilities** found (${sca.critical} critical, ${sca.high} high)`, ``);
-    for (const v of sca.top) {
+    const scaEntries = fullReport && sca.all?.length ? sca.all : sca.top;
+    for (const v of scaEntries) {
       const fix = v.fix ? ` \u2192 ${v.fix}` : "";
       lines.push(`- **[${v.severity.toUpperCase()}]** ${v.package}: ${v.id}${fix}`);
     }
-    if (sca.total > sca.top.length) {
+    if (!fullReport && sca.total > sca.top.length) {
       lines.push(`- ...and ${sca.total - sca.top.length} more`);
     }
   }

package/dist/servers/{data-client-PPEF2XUI.js → data-client-AQ5DGSAR.js}

@@ -78,7 +78,7 @@ import {
   upsertEdges,
   upsertEntities,
   upsertNodes
-} from "./chunk-6Y3AEXE3.js";
+} from "./chunk-X2B5QUWO.js";
 export {
   addEdges,
   addEntity,

package/dist/servers/exploration-server.js

@@ -14,7 +14,7 @@ import {
   requirePremiumWithAutoAuth,
   updateExplorationSession,
   validateRequestSize
-} from "./chunk-6Y3AEXE3.js";
+} from "./chunk-X2B5QUWO.js";
 
 // ../mcp/dist/mcp/src/exploration-server.js
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";

package/dist/servers/integrations-server.js

@@ -13,7 +13,7 @@ import {
   requirePremiumWithAutoAuth,
   validateAuth,
   validateRequestSize
-} from "./chunk-6Y3AEXE3.js";
+} from "./chunk-X2B5QUWO.js";
 
 // ../mcp/dist/mcp/src/integrations-server.js
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";

package/dist/servers/output-server.js

@@ -13,7 +13,7 @@ import {
   mapErrorToMcp,
   requirePremiumWithAutoAuth,
   validateRequestSize
-} from "./chunk-6Y3AEXE3.js";
+} from "./chunk-X2B5QUWO.js";
 
 // ../mcp/dist/mcp/src/output-server.js
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";

package/dist/servers/premortem-server.js

@@ -27,7 +27,7 @@ import {
   updatePremortem,
   validateAuth,
   validateRequestSize
-} from "./chunk-6Y3AEXE3.js";
+} from "./chunk-X2B5QUWO.js";
 
 // ../mcp/dist/mcp/src/premortem-server.js
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";

package/dist/servers/tools-server.js

@@ -21,7 +21,7 @@ import {
   requirePremiumWithAutoAuth,
   validateAuth,
   validateRequestSize
-} from "./chunk-6Y3AEXE3.js";
+} from "./chunk-X2B5QUWO.js";
 
 // ../mcp/dist/mcp/src/tools-server.js
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@vibekiln/cutline-mcp-cli",
-    "version": "0.4.1",
+    "version": "0.4.3",
     "description": "CLI and MCP servers for Cutline — authenticate, then run constraint-aware MCP servers in Cursor or any MCP client.",
     "type": "module",
     "main": "dist/index.js",