create-snipara 1.3.28 → 1.3.30

package/README.md

@@ -121,6 +121,7 @@ Keep the package roles simple:
 
 - `create-snipara` = connect the user to Hosted MCP Context + Memory
 - `create-snipara --github` = connect the current GitHub repository through the browser approval flow for repository sync and PR Answer Packs
+- `snipara-openclaw-install` = OpenClaw-only wrapper for Hosted MCP config plus OpenClaw env and hook setup
 - `snipara-business` = prepare business context from local or mounted folders
 - Hosted MCP = the runtime surface the LLM actually uses after setup
 
@@ -287,7 +288,10 @@ npx create-snipara --advanced
 # Sandbox-only local execution
 npx create-snipara --runtime-only
 
-# Non-interactive setup with an existing API key
+# Safer non-interactive setup with an existing API key
+SNIPARA_API_KEY=snp-xxx npx create-snipara -y --slug my-project
+
+# Compatibility path; prints a warning because CLI args can leak
 npx create-snipara -y --api-key snp-xxx --slug my-project
 
 # Open GitHub automation after setup when a GitHub remote is detected
@@ -307,11 +311,17 @@ npx create-snipara repair --with-runtime
 npx create-snipara upgrade --with-runtime
 ```
 
+When `.mcp.json` contains a live API key, `create-snipara` writes it with
+restrictive permissions (`600`) where the platform supports it. Do not hardcode
+keys in checked-in config files; prefer environment variables, the browser auth
+flow, or the interactive hidden prompt.
+
 ## Packaging Model
 
 The intended split is:
 
 - `create-snipara`: Context + Memory onboarding, auth, config, inspect, repair, and upgrade
+- `snipara-openclaw-install`: OpenClaw-only setup wrapper that remains narrower than `create-snipara`
 - `snipara-companion`: default local workflow helper; legacy `rlm-hook` commands remain compatible
 - `snipara-mcp`: local stdio bridge, client-package development, compatibility, and testing
 - `snipara-sandbox`: optional local execution engine
@@ -333,6 +343,10 @@ that client has a useful local hook surface. Codex, Gemini, VS Code, Continue,
 ChatGPT, and custom clients are treated as MCP-first: they get the hosted MCP
 configuration/reference and agent instructions, not invented local hooks.
 
+OpenClaw is the specialized exception: use `snipara-openclaw-install` for a
+single OpenClaw-focused setup command, or use `create-snipara` plus
+`snipara-openclaw-hooks` when you want the explicit base setup path.
+
 This keeps setup and runtime separated while still giving the user one obvious command to start from.
 
 ## Generated Local Pack
@@ -403,6 +417,8 @@ Recommended explanation to users:
 Existing manual API keys passed to `create-snipara --api-key` should start with `snp-`;
 legacy `rlm_` keys remain accepted for migration. When `create-snipara` provisions a
 new account through the browser flow, Snipara returns a new `snp-` key from the current hosted API.
+Prefer `SNIPARA_API_KEY` or the interactive prompt over `--api-key`; CLI
+arguments can be visible in shell history and process listings.
 
 | Tooling                                             | Snipara API key            | LLM API key |
 | --------------------------------------------------- | -------------------------- | ----------- |

package/dist/index.js

@@ -13,7 +13,7 @@ import { homedir } from "os";
 // package.json
 var package_default = {
   name: "create-snipara",
-  version: "1.3.28",
+  version: "1.3.30",
   description: "Onboard Snipara Hosted MCP Context + Memory with auth, companion workflows, and optional Snipara Sandbox",
   main: "dist/index.js",
   type: "module",
@@ -468,6 +468,9 @@ async function gatherConfiguration(options) {
   if (providedApiKey && !isManualApiKey(providedApiKey)) {
     throw new Error(manualApiKeyValidationMessage());
   }
+  if (providedApiKey) {
+    warnApiKeyCliExposure();
+  }
   if (options.yes) {
     return buildAnswersFromProfile({
       projectSlug: options.slug || detectedSlug || "my-project",
@@ -891,6 +894,13 @@ function isManualApiKey(value) {
 function manualApiKeyValidationMessage() {
   return "API key should start with snp- or legacy rlm_";
 }
+function warnApiKeyCliExposure() {
+  console.log(
+    chalk.yellow(
+      "   \u26A0\uFE0F  --api-key can be exposed in shell history or process lists. Prefer SNIPARA_API_KEY or the interactive prompt for future runs."
+    )
+  );
+}
 function isProvisionedApiKey(value) {
   return value.trim().startsWith("snp-");
 }
@@ -1079,7 +1089,11 @@ async function createMcpConfig(answers) {
       headers: {}
     };
   }
-  fs.writeFileSync(mcpConfigPath, JSON.stringify(mcpConfig, null, 2) + "\n");
+  fs.writeFileSync(mcpConfigPath, JSON.stringify(mcpConfig, null, 2) + "\n", { mode: 384 });
+  try {
+    fs.chmodSync(mcpConfigPath, 384);
+  } catch {
+  }
   console.log(chalk.green("   \u2713 Created .mcp.json"));
   ensureGitignoreEntry(".mcp.json", "# Snipara MCP config (contains API key)");
   if (answers.aiClient === "claude-desktop") {
@@ -1645,7 +1659,7 @@ async function createCompanionConfig(answers) {
     apiUrl: API_URL
   };
   const workspaceConfig = {
-    projectId: answers.projectId || (typeof existingWorkspaceConfig.projectId === "string" && existingWorkspaceConfig.projectId ? existingWorkspaceConfig.projectId : answers.projectSlug),
+    projectId: answers.projectSlug,
     sessionId: typeof existingWorkspaceConfig.sessionId === "string" && existingWorkspaceConfig.sessionId ? existingWorkspaceConfig.sessionId : `sess_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`
   };
   fs.writeFileSync(globalConfigPath, JSON.stringify(globalConfig, null, 2) + "\n");
@@ -1732,7 +1746,7 @@ function getClientGuidance(client) {
   ];
 }
 function getCompanionCommands(answers) {
-  const projectIdFlag = answers.projectId ? ` --project-id ${answers.projectId}` : "";
+  const projectFlag = answers.projectSlug ? ` --project ${answers.projectSlug}` : "";
   const clientFlag = getCompanionInitClientFlag(answers.aiClient);
   const businessOnboardingCommands = answers.installCompanion ? [
     {
@@ -1764,7 +1778,7 @@ function getCompanionCommands(answers) {
   return [
     {
       title: "Bootstrap local companion",
-      command: `${COMPANION_COMMAND_NAME} init${clientFlag}${projectIdFlag}`,
+      command: `${COMPANION_COMMAND_NAME} init${clientFlag}${projectFlag}`,
       purpose: "Re-run local companion setup if this workstation needs to refresh browser login or project selection."
     },
     {
@@ -2745,6 +2759,9 @@ function loadExistingAnswers(options) {
   if (providedApiKey && !isManualApiKey(providedApiKey)) {
     throw new Error(manualApiKeyValidationMessage());
   }
+  if (providedApiKey) {
+    warnApiKeyCliExposure();
+  }
   const envApiKey = readApiKeyFromEnvFiles();
   const apiKey = providedApiKey || envApiKey || "YOUR_API_KEY_HERE";
   const apiKeyType = effectiveProfile === "runtime-only" ? "none" : providedApiKey || envApiKey ? "api" : "none";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-snipara",
-  "version": "1.3.28",
+  "version": "1.3.30",
   "description": "Onboard Snipara Hosted MCP Context + Memory with auth, companion workflows, and optional Snipara Sandbox",
   "main": "dist/index.js",
   "type": "module",