pinsay-cli 0.7.2 → 0.8.0

package/README.md

@@ -17,8 +17,8 @@ npx pinsay-cli init
 
 | Command | What it does |
 |---|---|
-| `npx pinsay-cli init` | Configure a repo (server, project, widget snippet, skills) |
-| `npx pinsay-cli login` / `whoami` / `logout` | Sign in once per machine; check / clear credentials |
+| `npx pinsay-cli init` | Configure a repo (project, widget snippet, skills) |
+| `npx pinsay-cli login` / `whoami` / `logout` | Sign in (asks: this machine or this repo only); check / clear credentials |
 | `npx pinsay-cli list` / `get <id>` | List pending feedback; inspect one comment |
 | `npx pinsay-cli apply` | Generate the fix-it prompt for your AI tool, then record what changed |
 | `npx pinsay-cli apply --plan` | Preview proposed edits without touching code |
@@ -38,7 +38,7 @@ npx pinsay-cli init
 
 ## API keys
 
-Keys look like `pnsy_` + 40 hex characters. They resolve in this order: `PINSAY_API_KEY` env var → `.pinsay/credentials.env` → the per-machine store (`~/.config/pointer/credentials.json`, mode 0600, never committed).
+Keys look like `pnsy_` + 40 hex characters. They resolve in this order: `PINSAY_API_KEY` env var → `.pinsay/credentials.env` → the per-machine store (`~/.config/pinsay/credentials.json`, mode 0600, never committed).
 
 ## MCP (Claude Code / Cursor)
 

package/dist/cli.js

@@ -15,7 +15,7 @@ var init_build_constants = __esm({
   "src/build-constants.ts"() {
     "use strict";
     BUILD_DEFAULT_SERVER = true ? "https://app.pinsay.dev" : "https://app.pinsay.dev";
-    BUILD_CLI_VERSION = true ? "0.7.2" : "0.0.0-dev";
+    BUILD_CLI_VERSION = true ? "0.8.0" : "0.0.0-dev";
   }
 });
 
@@ -124,8 +124,6 @@ async function writeCredentials(cwd2, token, extra = {}) {
   const file = join(cwd2, CREDENTIALS_FILE);
   await fs.mkdir(dirname(file), { recursive: true });
   const lines = [`PINSAY_API_KEY=${token}`];
-  if (extra.server)
-    lines.push(`PINSAY_SERVER=${extra.server}`);
   if (extra.project)
     lines.push(`PINSAY_PROJECT=${extra.project}`);
   await fs.writeFile(file, lines.join("\n") + "\n", { encoding: "utf8", mode: 384 });
@@ -278,38 +276,83 @@ function normalizeServerOrigin(server) {
     return server.replace(/\/+$/, "");
   }
 }
+function configBase() {
+  if (process.platform === "win32") {
+    return process.env.APPDATA || join10(homedir(), "AppData", "Roaming");
+  }
+  return process.env.XDG_CONFIG_HOME || join10(homedir(), ".config");
+}
 function globalConfigDir() {
   if (process.env.PINSAY_CONFIG_DIR)
     return process.env.PINSAY_CONFIG_DIR;
-  if (process.platform === "win32") {
-    return join10(process.env.APPDATA || join10(homedir(), "AppData", "Roaming"), "pointer");
-  }
-  return join10(process.env.XDG_CONFIG_HOME || join10(homedir(), ".config"), "pointer");
+  return join10(configBase(), DIR_NAME);
 }
 function globalCredentialsPath() {
   return join10(globalConfigDir(), "credentials.json");
 }
+function legacyGlobalCredentialsPath() {
+  if (process.env.PINSAY_CONFIG_DIR)
+    return void 0;
+  return join10(configBase(), LEGACY_DIR_NAME, "credentials.json");
+}
 function globalCacheDir() {
   if (process.env.PINSAY_CONFIG_DIR)
     return join10(process.env.PINSAY_CONFIG_DIR, "cache");
   if (process.platform === "win32") {
-    return join10(process.env.LOCALAPPDATA || join10(homedir(), "AppData", "Local"), "pointer", "cache");
+    return join10(process.env.LOCALAPPDATA || join10(homedir(), "AppData", "Local"), DIR_NAME, "cache");
   }
-  return join10(process.env.XDG_CACHE_HOME || join10(homedir(), ".cache"), "pointer");
+  return join10(process.env.XDG_CACHE_HOME || join10(homedir(), ".cache"), DIR_NAME);
 }
 function tokenCacheFile(server, apiKey) {
   const hash = createHash("sha256").update(`${normalizeServerOrigin(server)}:${apiKey}`).digest("hex").slice(0, 32);
   return join10(globalCacheDir(), `${hash}.json`);
 }
+function isCredentialStore(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return false;
+  return Object.values(value).every(
+    (entry) => !!entry && typeof entry === "object" && typeof entry.apiKey === "string"
+  );
+}
 async function readGlobalStore() {
+  let raw;
+  try {
+    raw = await fs10.readFile(globalCredentialsPath(), "utf8");
+  } catch (err) {
+    if (err?.code === "ENOENT")
+      return migrateLegacyStore();
+    return {};
+  }
   try {
-    const raw = await fs10.readFile(globalCredentialsPath(), "utf8");
     const parsed = JSON.parse(raw);
     return parsed && typeof parsed === "object" ? parsed : {};
   } catch {
     return {};
   }
 }
+async function migrateLegacyStore() {
+  const legacyFile = legacyGlobalCredentialsPath();
+  if (!legacyFile)
+    return {};
+  let legacy;
+  try {
+    legacy = JSON.parse(await fs10.readFile(legacyFile, "utf8"));
+  } catch {
+    return {};
+  }
+  if (!isCredentialStore(legacy))
+    return {};
+  try {
+    await writeGlobalStore(legacy);
+  } catch {
+    return legacy;
+  }
+  await fs10.rm(legacyFile, { force: true }).catch(() => {
+  });
+  await fs10.rmdir(dirname4(legacyFile)).catch(() => {
+  });
+  return legacy;
+}
 async function writeGlobalStore(store) {
   const file = globalCredentialsPath();
   await fs10.mkdir(dirname4(file), { recursive: true });
@@ -332,9 +375,12 @@ async function saveGlobalCredential(server, entry) {
 async function removeGlobalCredential(server) {
   const store = await readGlobalStore();
   const origin = normalizeServerOrigin(server);
-  if (!(origin in store))
+  const origins = origin === "https://app.pinsay.dev" ? [origin, "https://api.pinsay.dev"] : [origin];
+  const present = origins.filter((o) => o in store);
+  if (present.length === 0)
     return false;
-  delete store[origin];
+  for (const o of present)
+    delete store[o];
   await writeGlobalStore(store);
   return true;
 }
@@ -364,9 +410,39 @@ async function removeStaleRepoTokenCache(root) {
   await fs10.rm(join10(root, ".pinsay", ".token_cache"), { force: true }).catch(() => {
   });
 }
+var DIR_NAME, LEGACY_DIR_NAME;
 var init_credentials = __esm({
   "src/credentials.ts"() {
     "use strict";
+    DIR_NAME = "pinsay";
+    LEGACY_DIR_NAME = "pointer";
+  }
+});
+
+// src/server.ts
+function resolveServer() {
+  const override = process.env.PINSAY_SERVER?.trim();
+  return canonicalServer(override || BUILD_DEFAULT_SERVER).replace(/\/+$/, "");
+}
+async function serverSettingError(cwd2, parsed) {
+  const server = resolveServer();
+  if (parsed["server"] !== void 0) {
+    return `--server was removed: this CLI talks only to ${server}.`;
+  }
+  const root = await findRepoRoot(cwd2);
+  const config = await readConfig(root).catch(() => ({}));
+  if (config.server && normalizeServerOrigin(config.server) !== normalizeServerOrigin(server)) {
+    return `.pinsay/config.json sets "server": "${config.server}", but this CLI talks only to ${server}.
+Remove the "server" line from .pinsay/config.json, then run the command again.`;
+  }
+  return null;
+}
+var init_server = __esm({
+  "src/server.ts"() {
+    "use strict";
+    init_build_constants();
+    init_config();
+    init_credentials();
   }
 });
 
@@ -931,11 +1007,7 @@ function mapEnvironmentToString(env) {
 async function getClient(cwd2, parsed, opts = {}) {
   const root = await findRepoRoot(cwd2);
   const config = await readConfig(root);
-  const server = ((typeof parsed["server"] === "string" ? parsed["server"] : config.server) || BUILD_DEFAULT_SERVER).replace(/\/$/, "");
-  if (!server) {
-    console.error("No server configured.");
-    process.exit(2);
-  }
+  const server = resolveServer();
   const explicitKey = typeof parsed["key"] === "string" ? parsed["key"] : void 0;
   const token = await resolveToken(server, root, explicitKey);
   const apiKey = explicitKey || await readApiKey(root, server);
@@ -1145,8 +1217,8 @@ var init_comments = __esm({
     init_resolve();
     init_api();
     init_auth();
-    init_build_constants();
     init_projection();
+    init_server();
   }
 });
 
@@ -1261,7 +1333,7 @@ function assertInteractive() {
   if (process.stdin.isTTY)
     return;
   console.error(
-    "\x1B[31mThis command is interactive, but stdin is not a terminal.\x1B[0m\nPiped input, CI, and some editor-embedded shells have no TTY, so there is no way to ask you anything.\n\nEither run it in a real terminal, or pass every answer as a flag:\n  npx -y pinsay-cli init --server <url> --key ptr_... --project <key> --environment local --yes\n\nRun 'npx -y pinsay-cli init --help' for the full list of flags."
+    "\x1B[31mThis command is interactive, but stdin is not a terminal.\x1B[0m\nPiped input, CI, and some editor-embedded shells have no TTY, so there is no way to ask you anything.\n\nEither run it in a real terminal, or pass every answer as a flag:\n  npx -y pinsay-cli init --key ptr_... --project <key> --yes\n\nRun 'npx -y pinsay-cli init --help' for the full list of flags."
   );
   process.exit(2);
 }
@@ -2271,6 +2343,7 @@ async function writeStackFile(cwd2, stack, projectKey) {
 
 // src/checks.ts
 init_credentials();
+init_server();
 var execFileAsync = promisify(execFile);
 function tooOldMessage(cliVersion, min) {
   return `CLI ${cliVersion} is older than the server requires (${min}). Upgrade with: npx -y pinsay@latest`;
@@ -2308,7 +2381,7 @@ async function fetchWithTimeout(url, ms, init) {
 async function runInitChecks(cwd2, overrides = {}, cliVersion = "0.0.0") {
   const checks = [];
   const config = await readConfig(cwd2);
-  const server = (overrides.server || config.server || "").replace(/\/$/, "");
+  const server = (overrides.server || resolveServer()).replace(/\/$/, "");
   const multiProject = isMultiProject(config);
   const allProjects = listProjects(config);
   const projectTargets = multiProject && overrides.project ? allProjects.filter((p) => p.key === overrides.project) : allProjects;
@@ -3355,7 +3428,35 @@ async function runDeviceLogin(server, options = {}) {
   return { ok: false, reason: "expired" };
 }
 
+// src/key-scope.ts
+var KEY_SCOPE_QUESTION = "Where should this API key be stored?";
+var KEY_SCOPE_GLOBAL = "Global \u2014 this machine, every repo (~/.config/pinsay/credentials.json)";
+var KEY_SCOPE_REPO = "Repo \u2014 .pinsay/credentials.env in this repo only (gitignored)";
+function scopeFromFlags(options) {
+  const raw = options["scope"];
+  if (typeof raw === "string") {
+    const value = raw.toLowerCase();
+    if (value !== "global" && value !== "repo") {
+      return { error: `Invalid --scope "${raw}". Valid values: global, repo.` };
+    }
+    return { scope: value };
+  }
+  if (options["local-credentials"] === true)
+    return { scope: "repo" };
+  return {};
+}
+function decideKeyScope(flagScope, interactive) {
+  if (flagScope)
+    return flagScope;
+  return interactive ? "ask" : "global";
+}
+async function askKeyScope() {
+  const choice = await select(KEY_SCOPE_QUESTION, [KEY_SCOPE_GLOBAL, KEY_SCOPE_REPO]);
+  return choice === KEY_SCOPE_REPO ? "repo" : "global";
+}
+
 // src/commands/init.ts
+init_server();
 async function initCommand(cwd2, options = {}) {
   const isYes = options["yes"] || options["json"];
   const isJson = options["json"];
@@ -3373,12 +3474,9 @@ async function initCommand(cwd2, options = {}) {
   const pathFlag = typeof options["path"] === "string" ? String(options["path"]).replace(/^\.\/+/, "").replace(/\/+$/, "") : void 0;
   const isAddProject = Boolean(pathFlag);
   const configIsMulti = isMultiProject(config);
-  const isJoin = !isAddProject && Boolean(config.server) && (Boolean(config.project) || configIsMulti);
+  const isJoin = !isAddProject && (Boolean(config.project) || configIsMulti);
   const mode = isJoin ? "join" : "install";
-  let server = options["server"] || config.server || canonicalServer(process.env.PINSAY_SERVER) || BUILD_DEFAULT_SERVER;
-  if (!isYes && !options["server"] && !config.server) {
-    server = await ask("Server URL", { default: server });
-  }
+  const server = resolveServer();
   const scopeFlag = typeof options["scope"] === "string" ? String(options["scope"]).toLowerCase() : void 0;
   if (scopeFlag !== void 0 && scopeFlag !== "global" && scopeFlag !== "repo") {
     console.error(`Invalid --scope "${options["scope"]}". Valid values: global, repo.`);
@@ -3521,11 +3619,7 @@ async function initCommand(cwd2, options = {}) {
   if (freshlyAuthenticated) {
     let saveGlobally = !localCredentialsFlag;
     if (saveGlobally && !isYes && scopeFlag === void 0) {
-      const choice = await select("Where should this API key be stored?", [
-        "Global \u2014 this machine, every repo (~/.config/pointer/credentials.json)",
-        "Repo \u2014 .pinsay/credentials.env in this repo only (gitignored)"
-      ]);
-      saveGlobally = choice.startsWith("Global");
+      saveGlobally = await askKeyScope() === "global";
     }
     if (saveGlobally) {
       await saveGlobalCredential(server, { apiKey: key, email: me?.email, displayName: me?.displayName });
@@ -3534,7 +3628,7 @@ async function initCommand(cwd2, options = {}) {
     }
   }
   if (writeLocalCreds) {
-    await writeCredentials(cwd2, key, { server });
+    await writeCredentials(cwd2, key);
   }
   await upsertGitignore(cwd2, product, options["skills-dir"] || config.skillsDir);
   if (isJoin && configIsMulti) {
@@ -3856,7 +3950,6 @@ and the pinsay-init skill uses them to mount the widget for you afterwards.
   }
   const injectedHtml = injected ? filesMod.find((f) => f.toLowerCase().endsWith(".html"))?.replace(`${cwd2}/`, "") : void 0;
   const configPatch = {
-    server,
     project: finalProjectKey,
     aiTool: tool,
     skillsDir: options["skills-dir"],
@@ -3868,7 +3961,7 @@ and the pinsay-init skill uses them to mount the widget for you afterwards.
   await writeConfig(cwd2, configPatch);
   filesMod.push(".pinsay/config.json");
   if (writeLocalCreds) {
-    await writeCredentials(cwd2, key, { server, project: finalProjectKey });
+    await writeCredentials(cwd2, key, { project: finalProjectKey });
     filesMod.push(".pinsay/credentials.env");
   }
   filesMod.push(".gitignore");
@@ -3912,7 +4005,7 @@ and the pinsay-init skill uses them to mount the widget for you afterwards.
   const cyan = (s) => `\x1B[36m${s}\x1B[0m`;
   const rule = dim("\u2500".repeat(60));
   const envLabel = environmentPinned ? envs.length > 1 ? envs.join(", ") : env : null;
-  const keyLine = keyLivesGlobally ? `this machine's global store ${dim("(~/.config/pointer/credentials.json)")}` : `.pinsay/credentials.env ${dim("(gitignored)")}`;
+  const keyLine = keyLivesGlobally ? `this machine's global store ${dim("(~/.config/pinsay/credentials.json)")}` : `.pinsay/credentials.env ${dim("(gitignored)")}`;
   if (isJoin) {
     console.log(`
 ${rule}
@@ -3944,7 +4037,7 @@ ${rule}`);
 ${bold("Next")}  Reviewers open the widget through the ${product} Chrome extension \u2014 nothing was injected.
 
 ${installLine}
-  2. Extension \u2192 Options \u2192 set server ${server}; sign in with your ${product} account.
+  2. Open the extension and sign in with your ${product} account.
   3. Open your app, click the extension icon, choose project ${dim(finalProjectKey)}, Activate.
   4. Then ${bold("npx pinsay-cli list")} / ${bold("apply")} as usual.
       ${dim(`Dashboard: ${branding.urls?.app || server}`)}`);
@@ -4426,7 +4519,6 @@ async function handleMultiProjectSetup(args) {
   for (const r of results)
     projectsMap[r.key] = r.entry;
   await writeConfigFull(cwd2, {
-    server,
     aiTool: tool,
     skillsDir: (options["skills-dir"] || config.skillsDir) ?? void 0,
     cliVersion: BUILD_CLI_VERSION,
@@ -4434,7 +4526,7 @@ async function handleMultiProjectSetup(args) {
     projects: projectsMap
   });
   if (writeLocalCreds) {
-    await writeCredentials(cwd2, key, { server });
+    await writeCredentials(cwd2, key);
   }
   await postEvent(server, token, {
     type: "installed",
@@ -4471,6 +4563,7 @@ import { promises as fs15 } from "node:fs";
 import { join as join15 } from "node:path";
 init_api();
 init_credentials();
+init_server();
 var ICON = { ok: "\u2714", warn: "\u26A0", error: "\u2718" };
 function exitCodeFor(checks) {
   const failed = checks.filter((c) => c.status === "error");
@@ -4500,11 +4593,12 @@ async function doctorCommand(cwd2, options, cliVersion) {
     }
     return 0;
   }
-  let checks = await runInitChecks(cwd2, { server: options.server, project: options.project }, cliVersion);
+  const server = (options.server || resolveServer()).replace(/\/$/, "");
+  let checks = await runInitChecks(cwd2, { server, project: options.project }, cliVersion);
   if (options.fix) {
-    const repaired = await applyFixes(cwd2, checks);
+    const repaired = await applyFixes(cwd2, checks, server);
     if (repaired.length > 0) {
-      checks = await runInitChecks(cwd2, { server: options.server, project: options.project }, cliVersion);
+      checks = await runInitChecks(cwd2, { server, project: options.project }, cliVersion);
     }
   }
   const code = exitCodeFor(checks);
@@ -4534,7 +4628,7 @@ async function reportRun(cwd2, options, checks, ok) {
     return;
   try {
     const config = await readConfig(cwd2);
-    const server = (options.server || config.server || "").replace(/\/$/, "");
+    const server = (options.server || resolveServer()).replace(/\/$/, "");
     if (!server)
       return;
     const { key: apiKey } = await resolveApiKey(cwd2, server);
@@ -4551,10 +4645,9 @@ async function reportRun(cwd2, options, checks, ok) {
   } catch {
   }
 }
-async function applyFixes(cwd2, checks) {
+async function applyFixes(cwd2, checks, server) {
   const repaired = [];
   const config = await readConfig(cwd2);
-  const server = (config.server || "").replace(/\/$/, "");
   let token;
   const tokenFor = async () => {
     if (token)
@@ -4626,6 +4719,7 @@ init_config();
 init_api();
 import { promises as fs16 } from "node:fs";
 import { dirname as dirname7, join as join16 } from "node:path";
+init_server();
 function sourceFor(path) {
   if (path.endsWith("pinsay.sh"))
     return "/pinsay.sh";
@@ -4649,9 +4743,9 @@ async function updateCommand(cwd2, options) {
   for (const f of removedLegacyFiles)
     console.log(`\x1B[2mremoved legacy ${f}\x1B[0m`);
   const config = await readConfig(cwd2);
-  const server = (options.server || config.server || "").replace(/\/$/, "");
-  if (!server) {
-    console.error("No server configured \u2014 run `npx -y pinsay-cli init` first.");
+  const server = (options.server || resolveServer()).replace(/\/$/, "");
+  if (!config.project && !isMultiProject(config)) {
+    console.error("No .pinsay/config.json here \u2014 run `npx -y pinsay-cli init` first.");
     return 1;
   }
   let served = null;
@@ -4659,7 +4753,7 @@ async function updateCommand(cwd2, options) {
     const meta = await api(server, "/api/meta");
     served = meta?.skillVersion ?? null;
   } catch {
-    console.error(`Could not reach ${server} \u2014 check the URL.`);
+    console.error(`Could not reach ${server}.`);
     return 1;
   }
   const files = skillFilesFor(config);
@@ -5506,6 +5600,16 @@ function headSha(cwd2) {
   }
   return result.stdout.trim();
 }
+function resolveCommit(ref, cwd2) {
+  const result = spawnSync2("git", ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`], {
+    cwd: cwd2,
+    encoding: "utf8"
+  });
+  if (result.status !== 0) {
+    throw new Error(`Not a commit in this repository: ${ref}`);
+  }
+  return result.stdout.trim();
+}
 function getRemoteUrl(cwd2, remote = "origin") {
   const result = spawnSync2("git", ["remote", "get-url", remote], {
     cwd: cwd2,
@@ -5666,11 +5770,21 @@ async function markApplied(options, ctx) {
   const warning = delegationWarning(projectCtx.delegation ?? "auto", models);
   if (warning)
     console.error(warning);
+  let existingSha;
+  if (options.noCommit) {
+    try {
+      existingSha = resolveCommit(options.commit ?? "HEAD", ctx.cwd);
+    } catch (err) {
+      console.error(err.message);
+      process.exit(1);
+    }
+  }
   if (options.dryRun) {
     console.log(`[dry-run] Would mark comment ${options.id} as applied`);
     console.log(`[dry-run] Reply: ${options.reply}`);
     console.log(`[dry-run] AppliedBy: ${appliedByLabel}`);
     console.log(`[dry-run] Models: ${describeModels(models)}`);
+    console.log(`[dry-run] Commit: ${existingSha ?? "a new commit of the staged changes"}`);
     return {
       committed: false,
       patchedIds: typeof options.id === "number" ? [options.id] : []
@@ -5698,6 +5812,9 @@ async function markApplied(options, ctx) {
       sha = headSha(ctx.cwd);
       const remote = getRemoteUrl(ctx.cwd);
       commitUrl = commitUrlFor(sha, remote);
+    } else {
+      sha = existingSha;
+      commitUrl = sha ? commitUrlFor(sha, getRemoteUrl(ctx.cwd)) : null;
     }
     for (const item of pending) {
       await api(ctx.server, `/api/comments/${item.id}`, {
@@ -5746,6 +5863,9 @@ async function markApplied(options, ctx) {
       sha = headSha(ctx.cwd);
       const remote = getRemoteUrl(ctx.cwd);
       commitUrl = commitUrlFor(sha, remote);
+    } else {
+      sha = existingSha;
+      commitUrl = sha ? commitUrlFor(sha, getRemoteUrl(ctx.cwd)) : null;
     }
     await api(ctx.server, `/api/comments/${id}`, {
       method: "PATCH",
@@ -5797,6 +5917,7 @@ function describeFilter(filter) {
 
 // src/commands/apply.ts
 init_projection();
+init_server();
 async function exitIfWorkspaceFrozen(server, token) {
   if (!token)
     return;
@@ -5845,11 +5966,7 @@ function parseModelFlags(parsed) {
 async function applyCommand(cwd2, parsed, positionals = []) {
   const root = await findRepoRoot(cwd2);
   const config = await readConfig(root);
-  const server = ((typeof parsed["server"] === "string" ? parsed["server"] : config.server) || BUILD_DEFAULT_SERVER).replace(/\/$/, "");
-  if (!server) {
-    console.error("No server configured. Run `npx pinsay-cli init` or pass --server.");
-    process.exit(2);
-  }
+  const server = resolveServer();
   const projectFlag = typeof parsed["project"] === "string" ? parsed["project"] : void 0;
   const resolved = resolveProject(config, cwd2, root, projectFlag);
   const markVal = parsed["mark"];
@@ -5914,6 +6031,11 @@ async function applyCommand(cwd2, parsed, positionals = []) {
     }
     const noCommit = parsed["no-commit"] === true;
     const dryRun = parsed["dry-run"] === true;
+    const commitRef = typeof parsed["commit"] === "string" ? parsed["commit"] : void 0;
+    if (commitRef && !noCommit) {
+      console.error("--commit <sha> needs --no-commit (plain --mark records the commit it makes).");
+      process.exit(2);
+    }
     const toolExplicit = typeof parsed["tool"] === "string" ? parsed["tool"] : void 0;
     const tool2 = toolExplicit || config.aiTool;
     if (!toolExplicit && config.aiTool) {
@@ -5942,6 +6064,7 @@ async function applyCommand(cwd2, parsed, positionals = []) {
         id: markId,
         reply,
         noCommit,
+        commit: commitRef,
         dryRun,
         tool: tool2,
         models,
@@ -12436,10 +12559,11 @@ async function runMcpServer(ctx, logFile) {
 }
 
 // src/commands/mcp.ts
+init_server();
 async function mcpCommand(cwd2, parsed = {}) {
   const root = await findRepoRoot(cwd2);
   const config = await readConfig(root).catch(() => ({}));
-  const server = ((typeof parsed["server"] === "string" ? parsed["server"] : config.server) || canonicalServer(process.env.PINSAY_SERVER) || BUILD_DEFAULT_SERVER).replace(/\/$/, "");
+  const server = resolveServer();
   const projectFlag = typeof parsed["project"] === "string" ? parsed["project"] : void 0;
   const project = projectFlag || config.project || process.env.PINSAY_PROJECT || "";
   const explicitKey = typeof parsed["key"] === "string" ? parsed["key"] : void 0;
@@ -12476,11 +12600,15 @@ async function mcpCommand(cwd2, parsed = {}) {
 init_config();
 init_api();
 init_credentials();
-init_build_constants();
+init_server();
 async function loginCommand(cwd2, options = {}) {
+  const flags = scopeFromFlags(options);
+  if (flags.error) {
+    console.error(flags.error);
+    process.exit(2);
+  }
   const root = await findRepoRoot(cwd2);
-  const config = await readConfig(root).catch(() => ({}));
-  const server = ((typeof options["server"] === "string" ? options["server"] : void 0) || config.server || canonicalServer(process.env.PINSAY_SERVER) || BUILD_DEFAULT_SERVER).replace(/\/$/, "");
+  const server = resolveServer();
   const branding = await getBranding(server);
   const product = branding.productName;
   const flagKey = typeof options["key"] === "string" ? options["key"] : void 0;
@@ -12515,14 +12643,14 @@ async function loginCommand(cwd2, options = {}) {
     console.error("No key provided and no terminal to sign in from \u2014 run `npx pinsay-cli login --key <key>` or set PINSAY_API_KEY.");
     process.exit(2);
   }
-  const scope = typeof options["scope"] === "string" ? String(options["scope"]).toLowerCase() : "global";
-  if (scope !== "global" && scope !== "repo") {
-    console.error(`Invalid --scope "${options["scope"]}". Valid values: global, repo.`);
-    process.exit(2);
-  }
+  const interactive = Boolean(process.stdin.isTTY) && options["yes"] !== true;
+  const decided = decideKeyScope(flags.scope, interactive);
+  const scope = decided === "ask" ? await askKeyScope() : decided;
+  closePrompts();
   const who = me?.displayName ? `${me.displayName}${me?.email ? ` (${me.email})` : ""}` : me?.email ?? "you";
   if (scope === "repo") {
-    await writeCredentials(root, key, { server });
+    await writeCredentials(root, key);
+    await upsertGitignore(root, product);
     console.log(`\u2714 Signed in to ${server} as ${who} \u2014 saved to .pinsay/credentials.env (this repo only; overrides the global store here)`);
     process.exit(0);
   }
@@ -12532,13 +12660,10 @@ async function loginCommand(cwd2, options = {}) {
 }
 
 // src/commands/logout.ts
-init_config();
 init_credentials();
-init_build_constants();
-async function logoutCommand(cwd2, options = {}) {
-  const root = await findRepoRoot(cwd2);
-  const config = await readConfig(root).catch(() => ({}));
-  const server = ((typeof options["server"] === "string" ? options["server"] : void 0) || config.server || canonicalServer(process.env.PINSAY_SERVER) || BUILD_DEFAULT_SERVER).replace(/\/$/, "");
+init_server();
+async function logoutCommand(_cwd, options = {}) {
+  const server = resolveServer();
   const origin = normalizeServerOrigin(server);
   const removed = await removeGlobalCredential(server);
   if (options["json"] === true) {
@@ -12555,11 +12680,10 @@ async function logoutCommand(cwd2, options = {}) {
 init_config();
 init_api();
 init_credentials();
-init_build_constants();
+init_server();
 async function whoamiCommand(cwd2, options = {}) {
   const root = await findRepoRoot(cwd2);
-  const config = await readConfig(root).catch(() => ({}));
-  const server = ((typeof options["server"] === "string" ? options["server"] : void 0) || config.server || canonicalServer(process.env.PINSAY_SERVER) || BUILD_DEFAULT_SERVER).replace(/\/$/, "");
+  const server = resolveServer();
   const isJson = options["json"] === true;
   const { key, source } = await resolveApiKey(root, server);
   if (!key) {
@@ -12599,6 +12723,7 @@ async function whoamiCommand(cwd2, options = {}) {
 // src/cli.ts
 init_build_constants();
 init_api();
+init_server();
 import { argv, cwd } from "node:process";
 function parseArgs(args) {
   const parsed = {};
@@ -12655,8 +12780,8 @@ Usage: npx pinsay-cli <command> [options]
 
 Commands:
   init      Set up the feedback widget in your project
-  login     Authenticate once per machine (saves a key for every repo)
-  logout    Remove this machine's saved key for a server
+  login     Sign in and save your API key (this machine, or this repo only)
+  logout    Remove this machine's saved key
   whoami    Show the signed-in account and where the API key came from
   doctor    Diagnose an install and report what is wrong
   update    Refresh the served skills to the server's current version
@@ -12687,13 +12812,19 @@ async function main() {
       process.exit(0);
     }
   }
+  if (command !== "map" && !parsed["help"]) {
+    const serverError = await serverSettingError(cwd(), parsed);
+    if (serverError) {
+      console.error(serverError);
+      process.exit(2);
+    }
+  }
   if (command === "init") {
     if (parsed["help"]) {
       console.log(`
 Usage: npx pinsay-cli init [options]
 
 Options:
-  --server <url>           Feedback server URL
   --key <key>              API key
   --project <key>          Project key
   --create <name>          Create project with name
@@ -12712,9 +12843,10 @@ Options:
   --no-skills              Skip skills installation
   --no-design              Skip design token detection
   --source-map             Wire in the Vite plugin that stamps component source hashes
-  --scope <global|repo>    Where the API key is stored: global (default \u2014 this machine, all repos,
-                           ~/.config/pointer/credentials.json) or repo (.pinsay/credentials.env,
-                           gitignored, this repo only). --local-credentials is an alias for --scope repo
+  --scope <global|repo>    Where the API key is stored, without asking: global (this machine, all
+                           repos, ~/.config/pinsay/credentials.json; the default with --yes) or
+                           repo (.pinsay/credentials.env, gitignored, this repo only).
+                           --local-credentials is an alias for --scope repo
   --no-browser             When signing in in the browser (first run, no key resolved yet), print
                            the link/code but don't try to open a browser
   -y, --yes                Non-interactive
@@ -12729,21 +12861,21 @@ Options:
       console.log(`
 Usage: npx pinsay-cli login [options]
 
-Authenticate once per machine and save the result to
-~/.config/pointer/credentials.json (honours $XDG_CONFIG_HOME / $PINSAY_CONFIG_DIR), keyed by
-server. Every repo on this machine then resolves a key for that server without being asked again.
+Sign in and save your API key. On a terminal it asks where to save it:
+  Global  this machine, every repo (~/.config/pinsay/credentials.json, honours $XDG_CONFIG_HOME)
+  Repo    .pinsay/credentials.env in this repo only (gitignored)
+With no terminal (CI, a pipe) or with --yes it saves globally, unless --scope repo is given.
 
 With no --key on a real terminal, opens your browser to sign in (mirrors \`gh auth login\`): prints
 a link and a short code, waits for you to approve it in the dashboard, then saves the personal API
-key it hands back. Pass --key to skip the browser and validate a pasted key instead, unchanged from
-before.
+key it hands back. Pass --key to skip the browser and validate a pasted key instead.
 
 Options:
-  --server <url>          Server URL (default: this repo's .pinsay/config.json, then $PINSAY_SERVER)
   --key <key>             API key \u2014 skips the browser flow entirely
   --no-browser            Print the sign-in link/code but don't try to open a browser
-  --scope <global|repo>   global (default): save for every repo on this machine;
-                          repo: write .pinsay/credentials.env in the current repo only
+  --scope <global|repo>   Where to save the key, without asking
+  --local-credentials     Alias for --scope repo
+  -y, --yes               Don't ask; save globally unless --scope repo is given
   -h, --help              Show this help
 `);
       process.exit(0);
@@ -12754,10 +12886,9 @@ Options:
       console.log(`
 Usage: npx pinsay-cli logout [options]
 
-Removes this machine's saved global key for a server.
+Removes this machine's saved global key.
 
 Options:
-  --server <url>     Server URL (default: this repo's .pinsay/config.json, then $PINSAY_SERVER)
   --json             Emit { ok, server, removed } as JSON
   -h, --help         Show this help
 `);
@@ -12773,7 +12904,6 @@ Prints the server, the signed-in account, and which of env/repo/global answered
 never the key itself.
 
 Options:
-  --server <url>     Server URL (default: this repo's .pinsay/config.json, then $PINSAY_SERVER)
   --json             Emit { ok, server, displayName, email, source } as JSON
   -h, --help         Show this help
 `);
@@ -12788,7 +12918,6 @@ Usage: npx pinsay-cli doctor [options]
 Checks an existing install and prints one line per check.
 
 Options:
-  --server <url>     Override the server from .pinsay/config.json
   --project <key>    Override the project key
   --json             Emit { ok, checks } as JSON
   --fix              Apply the idempotent repairs (gitignore, skills, stack)
@@ -12804,7 +12933,6 @@ Exit codes:
       process.exit(0);
     }
     const code = await doctorCommand(cwd(), {
-      server: typeof parsed["server"] === "string" ? parsed["server"] : void 0,
       project: typeof parsed["project"] === "string" ? parsed["project"] : void 0,
       json: parsed["json"] === true,
       fix: parsed["fix"] === true,
@@ -12816,17 +12944,15 @@ Exit codes:
       console.log(`
 Usage: npx pinsay-cli update [options]
 
-Refreshes the AI skills and pinsay.sh from the configured server.
+Refreshes the AI skills and pinsay.sh from the server.
 
 Options:
-  --server <url>     Override the server from .pinsay/config.json
   --check            Report what is out of date without writing anything
   -h, --help         Show this help
 `);
       process.exit(0);
     }
     const code = await updateCommand(cwd(), {
-      server: typeof parsed["server"] === "string" ? parsed["server"] : void 0,
       check: parsed["check"] === true
     });
     process.exit(code);
@@ -12842,7 +12968,8 @@ Options:
   --tool <name>      Hand off prompt to claude, opencode, cursor, or clipboard
   --mark <id>|all    Commit staged changes and mark comment(s) applied
   --reply <text>     Reply text for applied comment (required with --mark)
-  --no-commit        Skip git commit during --mark (PATCH only)
+  --no-commit        Mark without committing: the fix is already committed (records --commit, default HEAD)
+  --commit <sha>     With --no-commit: the commit that holds the fix (default HEAD)
   --dry-run          Print what --mark would do without making git/API changes
   --models <list>    Every model that worked on the item, with its role, for --mark/--fail:
                      "<id>=<role>,<id>=<role>" (role: planner|implementer|reviewer, optional;
@@ -12946,7 +13073,6 @@ Start the PinSay stdio MCP server for AI tools.
 
 Options:
   --log <file>       Log MCP server traffic to file
-  --server <url>     Feedback server URL
   --project <key>    Project key
   --key <key>        API key
   -h, --help         Show this help

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinsay-cli",
-  "version": "0.7.2",
+  "version": "0.8.0",
   "description": "Click-to-comment feedback for your web app: install the widget, then turn pending comments into AI apply prompts.",
   "type": "module",
   "license": "MIT",
@@ -12,7 +12,7 @@
     "directory": "."
   },
   "bugs": {
-    "url": "https://github.com/moamen-ui/pinsay-api/issues"
+    "url": "https://github.com/moamen-ui/pinsay-cli/issues"
   },
   "keywords": [
     "feedback",
@@ -38,7 +38,7 @@
   "scripts": {
     "build": "node build.mjs",
     "typecheck": "tsc --noEmit",
-    "test": "node --import tsx --test test/*.test.ts test/**/*.test.ts",
+    "test": "node --import tsx --import ./test/setup.ts --test test/*.test.ts test/**/*.test.ts",
     "prepublishOnly": "npm run typecheck && npm test && npm run build"
   },
   "devDependencies": {