From a0efecd39af991087c9a8fc6c1640a668385663f Mon Sep 17 00:00:00 2001
From: haz <hani.abuzeid@columbusglobal.com>
Date: Fri, 10 Apr 2026 14:36:51 +0200
Subject: [PATCH] feat!: setup-wizard :nail-care:

---
 src/bin/setup.ts | 28 +++++++++++++++++++---------
 1 file changed, 19 insertions(+), 9 deletions(-)

diff --git a/src/bin/setup.ts b/src/bin/setup.ts
index 2fc1695..838c682 100644
--- a/src/bin/setup.ts
+++ b/src/bin/setup.ts
@@ -106,6 +106,15 @@ async function main() {
     dryRun = dryRunAnswer.toLowerCase() === 'y';
   }
 
+  // Audit log
+  console.error(
+    '\nAudit log records every tool call (timestamp, tool, params, result).',
+  );
+  console.error(
+    'Leave blank to disable, or enter a file path (~ is expanded).',
+  );
+  const auditLog = await ask('Audit log path', '~/.crystallize-mcp/audit.log');
+
   // Keychain offer — only if tokens were entered and keychain is reachable
   const hasSecrets = tokenId || tokenSecret || staticToken;
   let useKeychain = false;
@@ -138,7 +147,8 @@ async function main() {
     console.error('✅ Tokens saved to OS keychain.');
   }
 
-  // Build env config — omit secrets if stored in keychain
+  // Build env config — always write all vars so the config is self-documenting.
+  // Omit secrets if stored in keychain.
   const env: Record<string, string> = {
     CRYSTALLIZE_TENANT_IDENTIFIER: tenant,
   };
@@ -156,14 +166,11 @@ async function main() {
       env.CRYSTALLIZE_STATIC_AUTH_TOKEN = staticToken;
     }
   }
-  if (accessMode !== 'read') {
-    env.CRYSTALLIZE_ACCESS_MODE = accessMode;
-  }
-  if (piiMode !== 'full') {
-    env.CRYSTALLIZE_PII_MODE = piiMode;
-  }
-  if (dryRun) {
-    env.CRYSTALLIZE_DRY_RUN = 'true';
+  env.CRYSTALLIZE_ACCESS_MODE = accessMode;
+  env.CRYSTALLIZE_PII_MODE = piiMode;
+  env.CRYSTALLIZE_DRY_RUN = dryRun ? 'true' : 'false';
+  if (auditLog) {
+    env.CRYSTALLIZE_AUDIT_LOG = auditLog;
   }
 
   // Build MCP config entry
@@ -292,6 +299,9 @@ async function main() {
       'Dry-run: enabled (mutations will be previewed, not executed)',
     );
   }
+  if (auditLog) {
+    console.error(`Audit log: ${auditLog}`);
+  }
   console.error('');
 
   rl.close();