@zivis/cli 0.1.0-alpha.4 → 0.1.0-alpha.40

package/dist/commands/inspect/index.js

@@ -0,0 +1,136 @@
+import * as crypto from "node:crypto";
+import * as fs from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import { exec } from "node:child_process";
+import { promisify } from "node:util";
+import { detectProjectBinding } from "@zivis/mcp/project-binding";
+import { runExtractor } from "../../internal/extractor/index.js";
+import { buildRepoGraphArtifact } from "../../internal/extractor/graph-builder.js";
+const execAsync = promisify(exec);
+function collect(value, previous) {
+    return previous.concat([value]);
+}
+export function registerInspectCommands(program) {
+    program
+        .command("inspect")
+        .description("build a local repo graph artifact (services, endpoints, external deps) — local-only, no network")
+        .option("--root <dir>", "repo root to inspect (default: cwd)")
+        .option("--out <file>", "write artifact JSON to a file (default: <user-cache>/repos/<repo-id>/inspect/runs/<run-id>.json; '-' for stdout)")
+        .option("--privacy-audit", "print exactly what would be sent without writing to cache or sending — never makes network calls")
+        .option("--lang <list>", "comma-separated subset of adapters: typescript,go,python")
+        .option("--ignore <pattern>", "extra ignore pattern (repeatable)", collect, [])
+        .option("--application <id>", "set provenance.application_id (default: from .zivis/project.json if present)")
+        .option("--repo-id <id>", "override repo identifier (default: hash of git remote, fallback to hash of root path)")
+        .option("--commit <sha>", "override commit SHA (default: from `git rev-parse HEAD`)")
+        .option("--branch <name>", "override branch (default: from `git rev-parse --abbrev-ref HEAD`)")
+        .action(async (opts) => {
+        const rootDir = path.resolve(opts.root ?? process.cwd());
+        const cliPkg = await readCliPackage();
+        const langs = opts.lang
+            ? String(opts.lang).split(",").map((s) => s.trim()).filter(Boolean)
+            : undefined;
+        const result = await runExtractor({
+            rootDir,
+            languages: langs,
+            extraIgnores: opts.ignore,
+            extractorVersion: cliPkg.version,
+        });
+        const gitMeta = await readGitMetadata(rootDir);
+        const applicationId = opts.application ?? detectProjectBinding(rootDir)?.binding.applicationId;
+        const repoId = opts.repoId ?? deriveRepoId(gitMeta.remoteUrl, rootDir);
+        const commitSha = opts.commit ?? gitMeta.commitSha;
+        const branch = opts.branch ?? gitMeta.branch;
+        const artifact = buildRepoGraphArtifact(result, {
+            applicationId,
+            repoId,
+            commitSha,
+            branch,
+            analysisMode: "local",
+        });
+        if (opts.privacyAudit) {
+            process.stdout.write(JSON.stringify(artifact, null, 2) + "\n");
+            printSummary(artifact, "PRIVACY AUDIT — nothing was written or sent");
+            return;
+        }
+        if (opts.out === "-") {
+            process.stdout.write(JSON.stringify(artifact, null, 2) + "\n");
+            printSummary(artifact);
+            return;
+        }
+        const outPath = opts.out
+            ? path.isAbsolute(opts.out)
+                ? opts.out
+                : path.join(rootDir, opts.out)
+            : defaultCacheOutPath(repoId, commitSha, artifact.extracted_at);
+        await fs.mkdir(path.dirname(outPath), { recursive: true });
+        await fs.writeFile(outPath, JSON.stringify(artifact, null, 2) + "\n");
+        printSummary(artifact, `wrote ${outPath}`);
+    });
+}
+async function readCliPackage() {
+    const here = path.dirname(new URL(import.meta.url).pathname);
+    const pkgPath = path.join(here, "../../../package.json");
+    const raw = await fs.readFile(pkgPath, "utf8");
+    return JSON.parse(raw);
+}
+async function readGitMetadata(rootDir) {
+    const out = {};
+    out.remoteUrl = await tryGit(rootDir, "remote get-url origin");
+    out.commitSha = await tryGit(rootDir, "rev-parse HEAD");
+    out.branch = await tryGit(rootDir, "rev-parse --abbrev-ref HEAD");
+    return out;
+}
+async function tryGit(cwd, args) {
+    try {
+        const { stdout } = await execAsync(`git ${args}`, { cwd });
+        const value = stdout.trim();
+        return value || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function deriveRepoId(remoteUrl, rootDir) {
+    if (remoteUrl) {
+        return "remote-" + sha256Short(remoteUrl);
+    }
+    return "path-" + sha256Short(rootDir);
+}
+function sha256Short(value) {
+    return crypto.createHash("sha256").update(value).digest("hex").slice(0, 16);
+}
+function userCacheRoot() {
+    const home = os.homedir();
+    if (process.platform === "darwin") {
+        return path.join(home, "Library", "Caches", "zivis");
+    }
+    if (process.platform === "win32") {
+        const localAppData = process.env.LOCALAPPDATA ?? path.join(home, "AppData", "Local");
+        return path.join(localAppData, "zivis", "Cache");
+    }
+    const xdg = process.env.XDG_CACHE_HOME;
+    return path.join(xdg ?? path.join(home, ".cache"), "zivis");
+}
+function defaultCacheOutPath(repoId, commitSha, extractedAt) {
+    const runId = formatRunId(commitSha, extractedAt);
+    return path.join(userCacheRoot(), "repos", repoId, "inspect", "runs", `${runId}.json`);
+}
+function formatRunId(commitSha, extractedAt) {
+    const compactTs = extractedAt.replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
+    if (!commitSha)
+        return `nogit-${compactTs}`;
+    return `${commitSha.slice(0, 7)}-${compactTs}`;
+}
+function printSummary(artifact, suffix) {
+    const services = artifact.nodes.filter((n) => n.type === "service").length;
+    const endpoints = artifact.nodes.filter((n) => n.type === "endpoint").length;
+    const deps = artifact.nodes.filter((n) => n.type === "external_dependency").length;
+    const exposes = artifact.edges.filter((e) => e.type === "exposes").length;
+    const dependsOn = artifact.edges.filter((e) => e.type === "depends_on").length;
+    const langs = artifact.scope.languages?.join(",") ?? "(none)";
+    process.stderr.write(`\n[zivis inspect] ${artifact.scope.files_scanned} files scanned in ${artifact.scope.duration_ms}ms (langs: ${langs})\n` +
+        `  ${artifact.nodes.length} nodes  (${services} services, ${endpoints} endpoints, ${deps} external deps)\n` +
+        `  ${artifact.edges.length} edges  (${exposes} exposes, ${dependsOn} depends_on)\n` +
+        (suffix ? `  ${suffix}\n` : ""));
+}

package/dist/commands/mcp/index.js

@@ -1,6 +1,8 @@
+import * as path from "node:path";
+import * as readline from "node:readline/promises";
 import { startServer } from "@zivis/mcp/server";
 import { DEFAULT_CONFIG } from "@zivis/mcp/types";
-import { setupCursor, setupVsCodeCopilot, setupVsCodeClaude, setupClaudeCodeCli, setupCline, setupWindsurf, printClaudeCodeManual, } from "../../internal/ide-setup.js";
+import { setupCursorWorkspace, setupVsCodeCopilot, setupVsCodeClaude, setupClaudeCodeCli, setupCline, setupWindsurf, printClaudeCodeManual, writeGuidance, } from "../../internal/ide-setup.js";
 const KNOWN_CLIENTS = [
     "cursor",
     "claude-code",
@@ -10,50 +12,84 @@ const KNOWN_CLIENTS = [
     "vscode-copilot",
     "vscode-claude",
 ];
+function toGuidanceClient(client) {
+    switch (client) {
+        case "cursor": return "cursor";
+        case "claude-code-cli": return "claude-code-cli";
+        case "vscode-copilot": return "vscode-copilot";
+        case "vscode-claude": return "vscode-claude";
+        case "cline": return "cline";
+        case "windsurf": return "windsurf";
+        default: return null;
+    }
+}
+async function promptYesNo(question) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        const answer = (await rl.question(question)).trim().toLowerCase();
+        return answer !== "n" && answer !== "no";
+    }
+    finally {
+        rl.close();
+    }
+}
 export function registerMcpCommands(program) {
     const mcp = program.command("mcp").description("MCP server for IDE integration");
     mcp
         .command("serve")
         .description("start the stdio MCP server (called by your IDE, not directly)")
-        .action(async () => {
-        await startServer(DEFAULT_CONFIG);
+        .option("-w, --workspace <path>", "workspace root for project binding detection (auto-set by IDE config, do not pass manually)")
+        .action(async (opts) => {
+        const config = { ...DEFAULT_CONFIG };
+        if (opts.workspace) {
+            config.workspacePath = path.resolve(opts.workspace);
+        }
+        await startServer(config);
     });
     mcp
         .command("install")
-        .description("write MCP config for a supported IDE client")
+        .description("write MCP config for a supported IDE client (run from your project root)")
         .option("--client <name>", `target client (${KNOWN_CLIENTS.join(" | ")})`)
-        .option("-s, --session <name>", "include ZIVIS_SESSION env var")
+        .option("--package <name>", "which ZIVIS MCP package to register: 'builder' (default, @zivis/mcp-builder, citizen-dev surface) or 'appsec' (@zivis/mcp, DevSecOps surface)", "builder")
+        .option("--with-guidance", "also write IDE guidance files so the AI knows when to suggest security checks (no prompt). Only applies to the appsec package; builder ships its own cadence block via zivis_setup.")
+        .option("--no-guidance", "skip writing IDE guidance files (no prompt)")
         .action(async (opts) => {
         const client = opts.client?.toLowerCase();
-        const session = opts.session;
+        const pkgArg = opts.package?.toLowerCase() ?? "builder";
         if (!client) {
             console.error("Specify a client with --client <name>:");
             for (const c of KNOWN_CLIENTS)
                 console.error(`  zivis mcp install --client ${c}`);
             process.exit(1);
         }
+        if (pkgArg !== "appsec" && pkgArg !== "builder") {
+            console.error(`Unknown --package value: ${pkgArg}`);
+            console.error("Supported: appsec, builder");
+            process.exit(1);
+        }
+        const pkg = pkgArg;
         try {
             switch (client) {
                 case "cursor":
-                    await setupCursor(session);
+                    await setupCursorWorkspace(pkg);
                     break;
                 case "claude-code":
-                    printClaudeCodeManual(session);
+                    printClaudeCodeManual(pkg);
                     break;
                 case "claude-code-cli":
-                    await setupClaudeCodeCli(session);
+                    await setupClaudeCodeCli(pkg);
                     break;
                 case "cline":
-                    await setupCline(session);
+                    await setupCline(pkg);
                     break;
                 case "windsurf":
-                    await setupWindsurf(session);
+                    await setupWindsurf(pkg);
                     break;
                 case "vscode-copilot":
-                    await setupVsCodeCopilot(session);
+                    await setupVsCodeCopilot(pkg);
                     break;
                 case "vscode-claude":
-                    await setupVsCodeClaude(session);
+                    await setupVsCodeClaude(pkg);
                     break;
                 default:
                     console.error(`Unknown client: ${client}`);
@@ -65,6 +101,37 @@ export function registerMcpCommands(program) {
             console.error("Install failed:", err instanceof Error ? err.message : err);
             process.exit(1);
         }
+        if (client === "claude-code")
+            return;
+        if (pkg === "builder")
+            return;
+        const guidanceClient = toGuidanceClient(client);
+        if (!guidanceClient)
+            return;
+        let shouldWrite;
+        if (opts.withGuidance) {
+            shouldWrite = true;
+        }
+        else if (opts.guidance === false) {
+            shouldWrite = false;
+        }
+        else {
+            console.log("");
+            shouldWrite = await promptYesNo("Write ZIVIS guidance files so your IDE knows when to suggest security checks?\n" +
+                "(Adds a rule/instruction file to the project. You can edit or remove it anytime.) [Y/n] ");
+        }
+        if (shouldWrite) {
+            try {
+                const files = writeGuidance({ cwd: process.cwd(), client: guidanceClient });
+                if (files.length > 0) {
+                    console.log(`✓ Wrote guidance files:`);
+                    for (const f of files)
+                        console.log(`  ${f}`);
+                }
+            }
+            catch (err) {
+                console.warn(`  Warning: Could not write guidance files: ${err instanceof Error ? err.message : err}`);
+            }
+        }
     });
 }
-//# sourceMappingURL=index.js.map

package/dist/commands/open/index.d.ts

@@ -1,10 +1,2 @@
-/**
- * `zivis open` — Build and (by default) launch a vscode:// or cursor:// deep link
- * that opens a ZIVIS artifact in the ZIVIS Code IDE extension. Use `--ide cursor`
- * for Cursor. With --print, emit the URI to stdout for piping/sharing.
- *
- * Mirrors the URI shape emitted by the `zivis_open_in_ide` MCP tool and the
- * web app's buildIdeLink() helper. See docs/platform/integrations/IDE-DEEP-LINKS.md.
- */
 import type { Command } from "commander";
 export declare function registerOpenCommands(program: Command): void;

package/dist/commands/open/index.js

@@ -1,11 +1,3 @@
-/**
- * `zivis open` — Build and (by default) launch a vscode:// or cursor:// deep link
- * that opens a ZIVIS artifact in the ZIVIS Code IDE extension. Use `--ide cursor`
- * for Cursor. With --print, emit the URI to stdout for piping/sharing.
- *
- * Mirrors the URI shape emitted by the `zivis_open_in_ide` MCP tool and the
- * web app's buildIdeLink() helper. See docs/platform/integrations/IDE-DEEP-LINKS.md.
- */
 const KINDS = ["diagram", "document", "threat-model"];
 export function registerOpenCommands(program) {
     program
@@ -47,11 +39,8 @@ export function registerOpenCommands(program) {
             console.log(uri);
             return;
         }
-        // Lazy-import `open` so --print stays dependency-free in environments
-        // (e.g. headless CI) where launching a URL handler would fail or hang.
         const { default: open } = await import("open");
         await open(uri);
         console.log(uri);
     });
 }
-//# sourceMappingURL=index.js.map

package/dist/commands/scan/index.js

@@ -1,8 +1,8 @@
 import { ApiClient } from "@zivis/mcp/api-client";
-import { DEFAULT_CONFIG } from "@zivis/mcp/types";
+import { resolveConfigFromBinding } from "@zivis/mcp/project-binding";
 const VALID_TARGET_TYPES = ["ai_chat", "web_app", "api"];
 function buildClient(opts) {
-    const config = opts.session ? { ...DEFAULT_CONFIG, session: opts.session } : DEFAULT_CONFIG;
+    const config = opts.session ? { ...resolveConfigFromBinding(process.cwd()), session: opts.session } : resolveConfigFromBinding(process.cwd());
     return new ApiClient(config);
 }
 export function registerScanCommands(program) {
@@ -118,11 +118,6 @@ export function registerScanCommands(program) {
         }
     });
 }
-/**
- * Map customer-facing ApplicationType to the RT scan's targetType enum.
- * The two enums differ historically: ApplicationType is product-shape,
- * targetType is what the RT runner needs to know about the wire format.
- */
 function appTypeToTargetType(appType) {
     switch (appType) {
         case "agent":
@@ -131,10 +126,10 @@ function appTypeToTargetType(appType) {
             return "ai_chat";
         case "rest_api":
             return "api";
+        case "application":
         case "ad_hoc_url":
             return "web_app";
         default:
             return undefined;
     }
 }
-//# sourceMappingURL=index.js.map

package/dist/commands/target/index.js

@@ -4,8 +4,6 @@ import { getStorageName } from "../../internal/target-auth/keychain.js";
 import { decodeJwtPayload } from "../../internal/target-auth/workos.js";
 const DEFAULT_PERSONA = "default";
 function warnDeprecated() {
-    // stderr so it doesn't pollute stdout (CLI scripts pipe `zivis target token`
-    // straight into curl). One line, no color codes — keeps grep-friendly.
     console.error("[zivis] WARNING: 'zivis target' is deprecated; use 'zivis app' instead.");
 }
 export function registerTargetCommands(program) {
@@ -143,4 +141,3 @@ export function registerTargetCommands(program) {
         console.log(`✓ Cleared tokens for target ${targetId} (persona: ${opts.persona})`);
     });
 }
-//# sourceMappingURL=index.js.map

package/dist/commands/tm/index.js

@@ -1,20 +1,19 @@
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { ApiClient } from "@zivis/mcp/api-client";
-import { DEFAULT_CONFIG } from "@zivis/mcp/types";
+import { resolveConfigFromBinding } from "@zivis/mcp/project-binding";
 import { getEphemeralCreds } from "../../internal/target-auth/index.js";
 import { runExtractor } from "../../internal/extractor/index.js";
 function buildClient(opts) {
     const config = opts.session
-        ? { ...DEFAULT_CONFIG, session: opts.session }
-        : DEFAULT_CONFIG;
+        ? { ...resolveConfigFromBinding(process.cwd()), session: opts.session }
+        : resolveConfigFromBinding(process.cwd());
     return new ApiClient(config);
 }
 function collect(value, previous) {
     return previous.concat([value]);
 }
 function defaultOutPath(extractedAt) {
-    // .zivis/extracted/<iso-no-colons>.json — matches the doc's example.
     const ts = extractedAt.replace(/[:.]/g, "-");
     return `.zivis/extracted/${ts}.json`;
 }
@@ -80,9 +79,6 @@ export function registerTmCommands(program) {
             process.exit(1);
         });
         const parsed = JSON.parse(raw);
-        // Only fields the PATCH endpoint accepts. tm pull dumps the full
-        // record; tm push only sends the editable subset, so a round-trip
-        // edit cycle Just Works.
         const payload = {};
         for (const k of ["name", "description", "status", "campaignId"]) {
             if (parsed[k] !== undefined)
@@ -123,8 +119,6 @@ export function registerTmCommands(program) {
             extractorVersion: cliPkg.version,
         });
         if (opts.privacyAudit) {
-            // Prints the entire object that WOULD be sent to ZIVIS via --apply.
-            // Never makes a network call; the extractor itself is local-only.
             process.stdout.write(JSON.stringify(result, null, 2) + "\n");
             process.stderr.write(`\n[zivis] Privacy audit: ${result.scope.filesScanned} files scanned, ` +
                 `${result.components.length} component(s), ${result.externalServices.length} external service(s), ` +
@@ -263,4 +257,3 @@ export function registerTmCommands(program) {
         }
     });
 }
-//# sourceMappingURL=index.js.map

package/dist/index.js

@@ -4,10 +4,13 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import { registerAuthCommands } from "./commands/auth/index.js";
+import { initCommand as authInitCommand } from "./commands/auth/init.js";
 import { registerAppCommands } from "./commands/app/index.js";
 import { registerTargetCommands } from "./commands/target/index.js";
 import { registerTmCommands } from "./commands/tm/index.js";
 import { registerScanCommands } from "./commands/scan/index.js";
+import { registerCheckCommands } from "./commands/check/index.js";
+import { registerInspectCommands } from "./commands/inspect/index.js";
 import { registerMcpCommands } from "./commands/mcp/index.js";
 import { registerCreditsCommands } from "./commands/credits/index.js";
 import { registerOpenCommands } from "./commands/open/index.js";
@@ -26,11 +29,21 @@ program
     .name("zivis")
     .description("ZIVIS CLI — threat modeling, scans, and MCP server")
     .version(getVersion(), "-v, --version", "show version");
+program
+    .command("init")
+    .description("interactive setup: authenticate, pick org, and bind this repo (alias for `zivis auth init`)")
+    .option("-s, --session <name>", "named session for multi-tenant")
+    .option("--skip-mint-key", "skip MCP API key mint after successful OAuth")
+    .action(async (opts) => {
+    await authInitCommand(opts);
+});
 registerAuthCommands(program);
+registerCheckCommands(program);
 registerAppCommands(program);
 registerTargetCommands(program);
 registerTmCommands(program);
 registerScanCommands(program);
+registerInspectCommands(program);
 registerMcpCommands(program);
 registerCreditsCommands(program);
 registerOpenCommands(program);
@@ -38,4 +51,3 @@ program.parseAsync(process.argv).catch((err) => {
     console.error(err instanceof Error ? err.message : err);
     process.exit(1);
 });
-//# sourceMappingURL=index.js.map

package/dist/internal/binding-token-mint.d.ts

@@ -0,0 +1,33 @@
+import { type ZivisConfig } from "@zivis/mcp/types";
+export type MintBindingTokenResult = {
+    ok: true;
+    keyName: string;
+    key: string;
+    orgName: string;
+    workosOrgId: string;
+} | {
+    ok: false;
+    error: string;
+};
+export declare function mintLocalProjectBindingToken(params: {
+    config: ZivisConfig;
+    session: string;
+    accessToken: string;
+    cwd: string;
+}): Promise<MintBindingTokenResult>;
+export interface TryAutoMintOptions {
+    cwd: string;
+    sessionName: string;
+    accessToken: string;
+    skip?: boolean;
+    warnOnFailure: boolean;
+}
+export declare function tryAutoMintBindingTokenAfterLogin(opts: TryAutoMintOptions): Promise<{
+    ran: boolean;
+    ok: boolean;
+    message?: string;
+}>;
+export declare function discardOauthAfterLogin(params: {
+    session: string | undefined;
+    config: ZivisConfig;
+}): Promise<void>;

package/dist/internal/binding-token-mint.js

@@ -0,0 +1,174 @@
+import * as os from "node:os";
+import * as crypto from "node:crypto";
+import * as child_process from "node:child_process";
+import { getSessionAccount, keychainClearSession, keychainRead, keychainStore, } from "@zivis/mcp/auth";
+import { decodeJwtPayload } from "@zivis/mcp/auth/jwt";
+import { DEFAULT_CONFIG, credentialStorageFromConfig } from "@zivis/mcp/types";
+import { detectProjectBinding, resolveConfigFromBinding } from "@zivis/mcp/project-binding";
+function getRepoFingerprint(cwd) {
+    try {
+        const remote = child_process
+            .execSync("git remote get-url origin 2>/dev/null", { cwd, encoding: "utf8" })
+            .trim();
+        if (remote) {
+            return crypto.createHash("sha256").update(remote).digest("hex").slice(0, 12);
+        }
+    }
+    catch {
+    }
+    return crypto.createHash("sha256").update(cwd).digest("hex").slice(0, 12);
+}
+export async function mintLocalProjectBindingToken(params) {
+    const { config, session, accessToken, cwd } = params;
+    const credentialStorage = credentialStorageFromConfig(config);
+    const repoFingerprint = getRepoFingerprint(cwd);
+    const hostname = os.hostname();
+    let bindResult;
+    try {
+        const response = await fetch(`${config.apiBaseUrl}/api/auth/bind`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                "Content-Type": "application/json",
+                "User-Agent": "@zivis/cli",
+            },
+            body: JSON.stringify({ repoFingerprint, hostname }),
+        });
+        if (!response.ok) {
+            const body = (await response.json().catch(() => ({})));
+            return {
+                ok: false,
+                error: body.message ?? body.error ?? `HTTP ${response.status}`,
+            };
+        }
+        bindResult = (await response.json());
+    }
+    catch (err) {
+        return {
+            ok: false,
+            error: err instanceof Error ? err.message : String(err),
+        };
+    }
+    const apiKeyAccount = `apikey.${session}`;
+    try {
+        await keychainStore(apiKeyAccount, bindResult.key, credentialStorage);
+    }
+    catch (err) {
+        return {
+            ok: false,
+            error: err instanceof Error ? err.message : "Failed to store key in OS keychain",
+        };
+    }
+    return {
+        ok: true,
+        keyName: bindResult.keyName,
+        key: bindResult.key,
+        orgName: bindResult.orgName,
+        workosOrgId: bindResult.workosOrgId,
+    };
+}
+export async function tryAutoMintBindingTokenAfterLogin(opts) {
+    if (opts.skip) {
+        return { ran: false, ok: true };
+    }
+    const fullConfig = { ...DEFAULT_CONFIG, ...resolveConfigFromBinding(opts.cwd) };
+    const claims = decodeJwtPayload(opts.accessToken);
+    const jwtOrgId = claims?.org_id;
+    if (!jwtOrgId) {
+        return {
+            ran: false,
+            ok: true,
+            message: "JWT has no org_id — skipped MCP binding-key mint.",
+        };
+    }
+    const detected = detectProjectBinding(opts.cwd);
+    const bindingOrg = detected?.binding.workosOrgId;
+    const bindingSession = detected?.binding.session;
+    if (!bindingOrg || !bindingSession) {
+        return {
+            ran: false,
+            ok: true,
+            message: "No project binding with workosOrgId — skipped MCP binding-key mint.",
+        };
+    }
+    if (bindingOrg !== jwtOrgId) {
+        const msg = `JWT org does not match project binding — skipped MCP binding-key mint.`;
+        if (opts.warnOnFailure) {
+            console.log("");
+            console.log(`  WARNING: ${msg}`);
+        }
+        return { ran: false, ok: false, message: msg };
+    }
+    if (bindingSession !== opts.sessionName) {
+        const msg = `Session "${opts.sessionName}" does not match binding session "${bindingSession}" — skipped MCP binding-key mint.`;
+        if (opts.warnOnFailure) {
+            console.log("");
+            console.log(`  WARNING: ${msg}`);
+        }
+        return { ran: false, ok: false, message: msg };
+    }
+    const st = credentialStorageFromConfig(fullConfig);
+    const existing = await keychainRead(`apikey.${bindingSession}`, st).catch(() => null);
+    if (existing) {
+        console.log("");
+        console.log(`✓ MCP API key already present for session "${bindingSession}" — skipped mint.`);
+        return { ran: false, ok: true };
+    }
+    console.log("");
+    console.log("Minting Local Project Binding Token for MCP (one-time per machine/session)…");
+    const result = await mintLocalProjectBindingToken({
+        config: fullConfig,
+        session: bindingSession,
+        accessToken: opts.accessToken,
+        cwd: opts.cwd,
+    });
+    if (!result.ok) {
+        const msg = result.error;
+        if (opts.warnOnFailure) {
+            printMintFailureBanner(msg);
+        }
+        return { ran: true, ok: false, message: msg };
+    }
+    console.log(`✓ MCP API key stored (${result.keyName}; org: ${result.orgName})`);
+    return { ran: true, ok: true };
+}
+export async function discardOauthAfterLogin(params) {
+    const storage = credentialStorageFromConfig(params.config);
+    try {
+        await keychainClearSession(params.session, storage);
+    }
+    catch {
+    }
+    const leftover = await keychainRead(getSessionAccount(params.session), storage).catch(() => null);
+    if (leftover) {
+        const account = getSessionAccount(params.session);
+        const service = `${storage.keychainPrefix}.${account}`;
+        console.error("");
+        console.error(`  WARNING: OAuth tokens are still present in the keychain (${service}).`);
+        console.error("  Possible cause: keychain access was denied, or older builds left");
+        console.error("  duplicate entries that the OS doesn't surface in a single delete.");
+        console.error("  Force-clean with:");
+        console.error(`    while security delete-generic-password -a zivis-mcp -s '${service}' 2>/dev/null; do :; done`);
+        console.error("");
+    }
+}
+function printMintFailureBanner(message) {
+    const bar = "═".repeat(70);
+    console.error("");
+    console.error(bar);
+    console.error("  ACTION REQUIRED — MCP API KEY WAS NOT MINTED");
+    console.error(bar);
+    console.error("");
+    console.error(`  Reason: ${message}`);
+    console.error("");
+    console.error("  Why this matters:");
+    console.error("    The MCP server in your IDE authenticates with an org-scoped");
+    console.error("    API key. Without it, every zivis_* tool call will fail with");
+    console.error("    \"Not authenticated\" until you mint one.");
+    console.error("");
+    console.error("  To fix, run from this repo:");
+    console.error("    zivis auth bind");
+    console.error("");
+    console.error(bar);
+    console.error("");
+}

package/dist/internal/extractor/adapters/go/index.d.ts

@@ -1,7 +1,3 @@
-/**
- * Go language adapter. Same shape as the TypeScript adapter — manifest
- * pass + AST pass — different parser + framework table.
- */
 import type { LanguageAdapter } from "../../types.js";
 export declare const goAdapter: LanguageAdapter;
 export declare const _stdlibFrameworkSet: Set<string>;