@meltstudio/meltctl 5.15.0 → 5.17.0

package/dist/index.js

@@ -7450,7 +7450,7 @@ var CLI_VERSION;
 var init_version = __esm({
   "src/utils/version.ts"() {
     "use strict";
-    CLI_VERSION = "5.15.0";
+    CLI_VERSION = "5.17.0";
   }
 });
 
@@ -26583,7 +26583,7 @@ function createPlansResource(config2) {
       const path10 = `/plans${query ? `?${query}` : ""}`;
       const { data, status } = await apiFetch(config2, path10);
       if (status === 403)
-        throw new Error("Access denied. Only Team Managers can list plans.");
+        throw new Error(`Access denied. ${data.error ?? ""}`.trim());
       if (status !== 200)
         throw new Error(data.error ?? `Failed to list plans (${status})`);
       return data;
@@ -26591,7 +26591,7 @@ function createPlansResource(config2) {
     async get(id) {
       const { data, status } = await apiFetch(config2, `/plans/${id}`);
       if (status === 403)
-        throw new Error("Access denied. Only Team Managers can view plans.");
+        throw new Error(`Access denied. ${data.error ?? ""}`.trim());
       if (status === 404)
         throw new Error(`Plan not found: ${id}`);
       if (status !== 200)
@@ -27211,8 +27211,9 @@ function createBoardAuditsResource(config2) {
 // ../sdk/dist/resources/pm.js
 function unwrap(label, response, okStatus = 200) {
   const okStatuses = Array.isArray(okStatus) ? okStatus : [okStatus];
-  if (response.status === 403)
-    throw new Error(`Access denied (${label})`);
+  if (response.status === 403) {
+    throw new Error(response.data.error ? `Access denied (${label}): ${response.data.error}` : `Access denied (${label})`);
+  }
   if (!okStatuses.includes(response.status)) {
     throw new Error(response.data.error ?? `Failed: ${label} (${response.status})`);
   }
@@ -42621,6 +42622,10 @@ async function getClient() {
 // src/commands/skills.ts
 var MARKER_FILE = ".melt-skills.json";
 function getSkillsRoot() {
+  const configDir = process.env["CLAUDE_CONFIG_DIR"];
+  if (configDir) {
+    return path5.join(configDir, "skills");
+  }
   return path5.join(os5.homedir(), ".claude", "skills");
 }
 function getSkillsRoots() {
@@ -42732,7 +42737,7 @@ async function skillsInstallCommand(opts) {
     );
     process.exit(1);
   }
-  const roots = getSkillsRoots();
+  const roots = opts.path ? [path5.resolve(opts.path)] : getSkillsRoots();
   const stale = opts.force ? roots : roots.filter((root) => readMarker(root)?.version !== manifest.version);
   if (stale.length === 0) {
     console.log(
@@ -53253,7 +53258,7 @@ function createPlansResource2(config2) {
       const path22 = `/plans${query ? `?${query}` : ""}`;
       const { data, status } = await apiFetch2(config2, path22);
       if (status === 403)
-        throw new Error("Access denied. Only Team Managers can list plans.");
+        throw new Error(`Access denied. ${data.error ?? ""}`.trim());
       if (status !== 200)
         throw new Error(data.error ?? `Failed to list plans (${status})`);
       return data;
@@ -53261,7 +53266,7 @@ function createPlansResource2(config2) {
     async get(id) {
       const { data, status } = await apiFetch2(config2, `/plans/${id}`);
       if (status === 403)
-        throw new Error("Access denied. Only Team Managers can view plans.");
+        throw new Error(`Access denied. ${data.error ?? ""}`.trim());
       if (status === 404)
         throw new Error(`Plan not found: ${id}`);
       if (status !== 200)
@@ -53855,8 +53860,9 @@ function createBoardAuditsResource2(config2) {
 }
 function unwrap2(label, response, okStatus = 200) {
   const okStatuses = Array.isArray(okStatus) ? okStatus : [okStatus];
-  if (response.status === 403)
-    throw new Error(`Access denied (${label})`);
+  if (response.status === 403) {
+    throw new Error(response.data.error ? `Access denied (${label}): ${response.data.error}` : `Access denied (${label})`);
+  }
   if (!okStatuses.includes(response.status)) {
     throw new Error(response.data.error ?? `Failed: ${label} (${response.status})`);
   }
@@ -55246,7 +55252,7 @@ function registerProjectTools(server, getClient2) {
     "list_projects",
     {
       title: "List projects",
-      description: "Lists Melt projects the authenticated user can see. Defaults: hasPM=true (only actively-managed projects), includeInternal=false (Melt's own internal projects hidden). Use this to resolve a project's name to its numeric `projectId` before calling any other tool. Returns id, name, client, project manager, and repo count per project.",
+      description: "Lists Melt projects the authenticated user can see. Managers see every project; non-managers (devs) see only the projects they're assigned to, PM, or recently worked on \u2014 a project missing from this list is out of their scope, not nonexistent. Defaults: hasPM=true (only actively-managed projects), includeInternal=false (Melt's own internal projects hidden). Use this to resolve a project's name to its numeric `projectId` before calling any other tool. Returns id, name, client, project manager, and repo count per project.",
       inputSchema: {
         hasPM: external_exports.boolean().optional().describe(
           "Default true. When true, only projects with a project manager assigned are returned (recommended for AI agent flows). Set false to include unmanaged projects."
@@ -55262,7 +55268,7 @@ function registerProjectTools(server, getClient2) {
     "get_project_settings",
     {
       title: "Get project settings",
-      description: 'Returns the project\'s PM-skills settings: cadence (weekly/biweekly/monthly), start_day, demo_day, team_size, velocity_override, Linear workspace, Notion URLs, code repo path, tech-support contact, default language, project glossary, project stage, default jump duration weeks. Includes a `warnings` array flagging settings whose absence breaks downstream behavior (e.g., "calculator: missing teamSize"). Returns sensible defaults if no settings row exists yet (cadence=weekly, start_day=Monday, demo_day=Friday, defaultLanguage=English, defaultJumpDurationWeeks=1).',
+      description: 'Returns the project\'s PM-skills settings: cadence (weekly/biweekly/monthly), start_day, demo_day, team_size, velocity_override, Linear workspace, Notion URLs, code repo path, tech-support contact, default language, project glossary, project stage, default jump duration weeks. Includes a `warnings` array flagging settings whose absence breaks downstream behavior (e.g., "calculator: missing teamSize"). Returns sensible defaults if no settings row exists yet (cadence=weekly, start_day=Monday, demo_day=Friday, defaultLanguage=English, defaultJumpDurationWeeks=1). Non-managers get a 403 for projects outside their assigned/recently-worked scope \u2014 explain the scoping to the user instead of retrying.',
       inputSchema: {
         projectId: external_exports.number().int().positive().describe("Strapi project id from list_projects.")
       }
@@ -55318,7 +55324,7 @@ function registerProjectTools(server, getClient2) {
     "get_project_context",
     {
       title: "Get project context",
-      description: "Read-only project identity + the PM-owned canonical project stage. Returns: projectId, projectName, client, pmEmail, repos[], projectStage (prototype | early_revenue | growth | scale | null), projectStageSetBy, projectStageSetAt. Call this at the start of an audit run instead of trusting AGENTS.md self-declaration \u2014 the stage drives audit calibration. Auth-only (no manager check), so devs running the audit skill from their own machine can call it directly.",
+      description: "Read-only project identity + the PM-owned canonical project stage. Returns: projectId, projectName, client, pmEmail, repos[], projectStage (prototype | early_revenue | growth | scale | null), projectStageSetBy, projectStageSetAt. Call this at the start of an audit run instead of trusting AGENTS.md self-declaration \u2014 the stage drives audit calibration. Auth-only (no manager check), so devs running the audit skill from their own machine can call it directly for their own projects; a 403 means the project is outside the dev's assigned/recently-worked scope \u2014 explain the scoping instead of retrying.",
       inputSchema: {
         projectId: external_exports.number().int().positive().describe("Strapi project id from list_projects.")
       }
@@ -55372,7 +55378,7 @@ function registerPhaseTools(server, getClient2) {
     "list_phases",
     {
       title: "List phases",
-      description: "Lists phases on a project. Each entry includes target_shape, computed current_shape, primary flag, active flag, the assigned features (with their stage_snapshot at join time + live current_stage), and timestamps. Includes closed phases when includeClosed=true.",
+      description: "Lists phases on a project. Each entry includes target_shape, computed current_shape, primary flag, active flag, the assigned features (with their stage_snapshot at join time + live current_stage), and timestamps. Includes closed phases when includeClosed=true. Non-managers get a 403 for projects outside their assigned/recently-worked scope \u2014 explain the scoping to the user instead of retrying.",
       inputSchema: {
         projectId: external_exports.number().int().positive(),
         includeClosed: external_exports.boolean().optional().describe("Default false. Set true to include closed phases as history.")
@@ -55574,7 +55580,7 @@ function registerFeatureTools(server, getClient2) {
     "list_features",
     {
       title: "List features",
-      description: "Lists features on the project. Each entry has id, name, category, description, current_stage, status, prd_path, client_notes, and starting_point. Per-phase target stage + Linear epic live on the phase membership (see list_phases), not the feature row. Optional filters narrow server-side: phaseId returns only features assigned to that phase; status / category / currentStage filter on the matching column.",
+      description: "Lists features on the project. Each entry has id, name, category, description, current_stage, status, prd_path, client_notes, and starting_point. Per-phase target stage + Linear epic live on the phase membership (see list_phases), not the feature row. Optional filters narrow server-side: phaseId returns only features assigned to that phase; status / category / currentStage filter on the matching column. Non-managers get a 403 for projects outside their assigned/recently-worked scope \u2014 explain the scoping to the user instead of retrying.",
       inputSchema: {
         projectId: external_exports.number().int().positive(),
         phaseId: external_exports.string().uuid().optional().describe("Limit to features assigned to this phase (phase_features join)."),
@@ -55690,7 +55696,7 @@ function registerPlanTools(server, getClient2) {
     "list_plans",
     {
       title: "List plans",
-      description: "Lists recent dev-submitted plans (list view \u2014 no plan content). Each entry has id, project, repository, author email, branch, commit, ticket id, status, and the aggregate rubric score if scored. Filterable by projectId, status, author (email), ticket id, repository. Defaults to no filters; pass `limit` to cap the return size. Use `get_plan` to read a plan's full markdown content.",
+      description: "Lists recent dev-submitted plans (list view \u2014 no plan content). Each entry has id, project, repository, author email, branch, commit, ticket id, status, and the aggregate rubric score if scored. Filterable by projectId, status, author (email), ticket id, repository. Defaults to no filters; pass `limit` to cap the return size. Use `get_plan` to read a plan's full markdown content. Managers see every plan; non-managers see plans they authored plus plans on repos of their assigned/recently-worked projects.",
       inputSchema: {
         projectId: external_exports.number().int().positive().optional().describe("Strapi project id from list_projects. Omit to list across all projects."),
         status: external_exports.string().optional().describe("Common values: 'submitted', 'in_review', 'completed'."),
@@ -55708,7 +55714,7 @@ function registerPlanTools(server, getClient2) {
     "get_plan",
     {
       title: "Get plan",
-      description: "Returns one plan's full detail including the markdown `content`, `scoreSummary` (per-rubric-dimension scoring output), and any metadata the dev submitted. Use this after `list_plans` when the agent needs to read what the plan actually says.",
+      description: "Returns one plan's full detail including the markdown `content`, `scoreSummary` (per-rubric-dimension scoring output), and any metadata the dev submitted. Use this after `list_plans` when the agent needs to read what the plan actually says. Non-managers can read their own plans plus plans on repos of their assigned/recently-worked projects; anything else returns a 403 \u2014 explain the scoping to the user instead of retrying.",
       inputSchema: {
         planId: external_exports.string().uuid()
       }
@@ -55783,7 +55789,7 @@ function registerProjectHealthTools(server, getClient2) {
     "get_project_health",
     {
       title: "Get project health",
-      description: "Composite read-only snapshot of one project's health: 0-100 score; `issues` \u2014 the full list of open health issues (each with label, dimension, severity, and a one-line howToFix), which are the EXACT items shown on the project's dashboard health card (e.g. 'PM silent in active cycle', 'Roadmap status differs from Linear', 'No roadmap'); audit-freshness numbers, findings (critical/high/missing/warning counts), board-audit aggregate + age, ticket counts (open/started/overdue), standup compliance (last 14 days), plan recency, last CLI activity, and the project's RSK risks (open/mitigated counts, red-zone count, top 3 open risks with impact \xD7 probability scores AND the PM's latest weekly status comment on each one). Risks + comments come from a weekly mirror of the RSK Linear board, refreshed every Tuesday evening right after the team's risk-review meeting \u2014 so 'latestComment' is normally the just-logged update for the week. Use this for 'how's project X doing?' / 'what needs attention on X?' questions \u2014 prefer surfacing the `issues` list (worst severity first) over just the score. Pulls in one round trip what would otherwise be 8+ separate tool calls; score + issues match the dashboard's project cards.",
+      description: "Composite read-only snapshot of one project's health: 0-100 score; `issues` \u2014 the full list of open health issues (each with label, dimension, severity, and a one-line howToFix), which are the EXACT items shown on the project's dashboard health card (e.g. 'PM silent in active cycle', 'Roadmap status differs from Linear', 'No roadmap'); audit-freshness numbers, findings (critical/high/missing/warning counts), board-audit aggregate + age, ticket counts (open/started/overdue), standup compliance (last 14 days), plan recency, last CLI activity, and the project's RSK risks (open/mitigated counts, red-zone count, top 3 open risks with impact \xD7 probability scores AND the PM's latest weekly status comment on each one). Risks + comments come from a weekly mirror of the RSK Linear board, refreshed every Tuesday evening right after the team's risk-review meeting \u2014 so 'latestComment' is normally the just-logged update for the week. Use this for 'how's project X doing?' / 'what needs attention on X?' questions \u2014 prefer surfacing the `issues` list (worst severity first) over just the score. Pulls in one round trip what would otherwise be 8+ separate tool calls; score + issues match the dashboard's project cards. Non-managers get a 403 for projects outside their assigned/recently-worked scope \u2014 explain the scoping to the user instead of retrying.",
       inputSchema: {
         projectId: external_exports.number().int().positive().describe(
           "Strapi project id from list_projects. The project must have at least one linked repository \u2014 otherwise the score is undefined and the tool returns 422."
@@ -55836,7 +55842,7 @@ function registerFindingsTools(server, getClient2) {
     "list_findings",
     {
       title: "List audit findings",
-      description: "Lists code/security/UX audit findings. Each finding carries its check code, category, status (pass/warning/missing/na), severity (critical/high/medium/low), effort (low/medium/high \u2014 how much work the fix is, independent of severity), repository, and evidence (file/symbol) so you can see exactly what to fix. Filter by projectId, repository, status, severity, effort, or auditType. Results are ordered worst-first (missing > warning, then critical > high > \u2026). Use this to answer 'what's open on the app I'm working on?' \u2014 pass status='missing' or severity='critical' to focus on what matters, or effort='low' with severity='high'/'critical' to find cheap high-leverage wins. Read-only and open to any @meltstudio.co user.",
+      description: "Lists code/security/UX audit findings. Each finding carries its check code, category, status (pass/warning/missing/na), severity (critical/high/medium/low), effort (low/medium/high \u2014 how much work the fix is, independent of severity), repository, and evidence (file/symbol) so you can see exactly what to fix. Filter by projectId, repository, status, severity, effort, or auditType. Results are ordered worst-first (missing > warning, then critical > high > \u2026). Use this to answer 'what's open on the app I'm working on?' \u2014 pass status='missing' or severity='critical' to focus on what matters, or effort='low' with severity='high'/'critical' to find cheap high-leverage wins. Read-only; managers see every finding, while non-managers see only findings on repos of their assigned/recently-worked projects (an empty result may mean out-of-scope, not clean).",
       inputSchema: {
         projectId: external_exports.number().int().positive().optional().describe("Strapi project id \u2014 scopes findings to that project\u2019s repos."),
         repository: external_exports.string().optional().describe("Full repo slug, e.g. 'MeltStudio/atlas-api'. Scopes to a single repo."),
@@ -56050,7 +56056,7 @@ ${source_default.dim("  /melt-dev-security-audit   Run a security posture audit
 ${source_default.dim("  /melt-dev-help             Answer questions about the development playbook")}
 
 ${source_default.bold("Setup")}
-${source_default.dim("  skills install         Install the dev skills (/melt-dev-*) into Claude Code (+ Cursor)")}
+${source_default.dim("  skills install         Install the dev skills (/melt-dev-*) into Claude Code (+ Cursor; respects CLAUDE_CONFIG_DIR, or --path <dir>)")}
 
 ${source_default.bold("Admin Commands")} ${source_default.dim("(used by skills and team managers):")}
 ${source_default.dim("  audit submit [file]    Submit an audit report")}
@@ -56091,7 +56097,9 @@ program2.command("mcp").description(
   await mcpCommand();
 });
 var skills = program2.command("skills").description("install the Melt dev skills (/melt-dev-*) into Claude Code");
-skills.command("install").description("install the Melt dev skills into ~/.claude/skills/ (re-run to update)").option("--force", "reinstall even if already up to date").action(async (options) => {
+skills.command("install").description(
+  "install the Melt dev skills into ~/.claude/skills/ (re-run to update; respects CLAUDE_CONFIG_DIR)"
+).option("--force", "reinstall even if already up to date").option("--path <dir>", "install into this directory only (overrides CLAUDE_CONFIG_DIR)").action(async (options) => {
   await skillsInstallCommand(options);
 });
 var project = program2.command("project").description("manage project configuration").addHelpText(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meltstudio/meltctl",
-  "version": "5.15.0",
+  "version": "5.17.0",
   "description": "AI-first development tooling for Melt teams — companion CLI for the org-distributed Claude Code dev skills",
   "main": "dist/index.js",
   "type": "module",