@mushi-mushi/cli 0.11.2 → 0.13.0

package/README.md

@@ -52,6 +52,9 @@ mushi --version
 
 ```bash
 mushi login --api-key mushi_xxx     # store credentials in ~/.mushirc (mode 0o600)
+mushi connect --api-key mushi_xxx --project-id <uuid> --endpoint <url> --wait
+                                     # one-shot wiring: ~/.mushirc + .env.local + .cursor/mcp.json + heartbeat wait
+mushi upgrade                        # bump installed @mushi-mushi/* packages to latest stable
 mushi status                         # project overview
 mushi reports list                   # recent reports
 mushi reports show <id>              # one report
@@ -65,6 +68,51 @@ mushi config endpoint https://...    # set API endpoint (https:// required outsi
 mushi sourcemaps upload --release <ver> --dir <dist>   # upload .js.map / .css.map (sha256-idempotent)
 ```
 
+### `mushi connect`
+
+Non-interactive equivalent of `mushi init` for agents and scripts — wires a
+repo to an existing project in one shot:
+
+1. Saves credentials to `~/.mushirc` (mode `0o600`).
+2. Merges `MUSHI_*` / framework-prefixed env vars into `.env.local` —
+   existing keys are never overwritten (skip with `--no-env`).
+3. Writes the `@mushi-mushi/mcp` server block into `.cursor/mcp.json` and
+   ensures that file is gitignored, since it embeds the API key (skip with
+   `--no-ide`).
+4. With `--wait`, polls `GET /v1/sync/ingest-setup` every 3 s until the SDK
+   heartbeat (or first report) lands, up to `--wait-timeout <sec>`
+   (default 120). Rejected credentials (401/403/404) fail fast instead of
+   polling out the timeout.
+
+```bash
+# Recommended: pass the key via env so it stays out of shell history
+MUSHI_API_KEY=mushi_xxx mushi connect --project-id <uuid> \
+  --endpoint https://<ref>.supabase.co/functions/v1/api --wait
+mushi connect --api-key mushi_xxx --project-id <uuid> --endpoint <url> --no-ide --json
+```
+
+Exits non-zero when `--wait` times out or credentials are rejected, so it
+composes in setup scripts and CI.
+
+### `mushi upgrade`
+
+Reads `package.json`, checks the npm registry for each installed
+`@mushi-mushi/*` package, and runs the right install command for your package
+manager (npm / pnpm / yarn / bun) to bump them to the latest stable release.
+
+```bash
+mushi upgrade               # plan + install
+mushi upgrade --dry-run     # print the install command without running it
+mushi upgrade --json        # machine-readable plan + result
+mushi upgrade --cwd ../app  # target another repo
+```
+
+Pre-release versions are never auto-selected, registry versions are validated
+against strict semver before being interpolated into the install command, and
+non-registry specifiers (`workspace:`, `file:`, git URLs, dist-tags) are left
+untouched. Legacy `@mushi-mushi/react` installs get a migration note pointing
+at `@mushi-mushi/web`.
+
 ### `mushi sourcemaps upload`
 
 Recursively scans `--dir` for `.js.map` and `.css.map` files and uploads them
@@ -110,6 +158,7 @@ reachability only.
 ```bash
 mushi doctor                  # local checks only
 mushi doctor --server         # + calls /preflight on the backend (all 4 dispatch checks)
+mushi doctor --ingest         # + calls /v1/sync/ingest-setup (API key → heartbeat → first report)
 mushi doctor --json           # machine-readable JSON output (exits 1 if any check fails)
 ```
 
@@ -135,6 +184,13 @@ server checks (`key` values returned by the endpoint):
 `--server` requires `adminOrApiKey` credentials — set `MUSHI_API_KEY` to an
 admin key (not a public SDK key).
 
+With `--ingest`, also calls `GET /v1/sync/ingest-setup` (authenticated with the
+SDK API key) and reports each **required ingest step** — project exists, active
+API key, SDK heartbeat, at least one ingested report — plus a
+`Last SDK heartbeat` diagnostic with the timestamp and endpoint host. This is
+the same payload `mushi connect --wait` polls, so a failing step here tells you
+exactly why the banner isn't showing up.
+
 ### `mushi reset <projectId>`
 
 Archives a project and wipes its test data so the full onboarding flow can be
@@ -169,3 +225,9 @@ Exits automatically when the job reaches a terminal status (`completed`,
 ## License
 
 MIT
+
+
+<!-- mushi-readme-stats-footer -->
+---
+
+<sub>Monorepo scale (June 2026): 43 edge functions · 234 SQL migrations · 13 outbound plugins · 11 inbound adapters. Canonical counts: <a href="https://github.com/kensaurus/mushi-mushi/blob/master/docs/stats.md">docs/stats.md</a> · <code>pnpm docs-stats</code></sub>

package/dist/chunk-IMDLL4EO.js

@@ -0,0 +1,6 @@
+// src/version.ts
+var MUSHI_CLI_VERSION = true ? "0.13.0" : "0.0.0-dev";
+
+export {
+  MUSHI_CLI_VERSION
+};

package/dist/index.js

@@ -35,10 +35,11 @@ function loadConfig(path = CONFIG_PATH) {
   } else if (path === CONFIG_PATH && existsSync(LEGACY_CONFIG_PATH)) {
     file = migrateLegacyConfig() ?? {};
   }
+  const endpointFromEnv = process.env["MUSHI_API_ENDPOINT"] ?? process.env["MUSHI_ENDPOINT"] ?? void 0;
   const fromEnv = {
     ...process.env["MUSHI_API_KEY"] ? { apiKey: process.env["MUSHI_API_KEY"] } : {},
     ...process.env["MUSHI_PROJECT_ID"] ? { projectId: process.env["MUSHI_PROJECT_ID"] } : {},
-    ...process.env["MUSHI_API_ENDPOINT"] ? { endpoint: process.env["MUSHI_API_ENDPOINT"] } : {}
+    ...endpointFromEnv ? { endpoint: endpointFromEnv } : {}
   };
   return { ...file, ...fromEnv };
 }
@@ -444,7 +445,7 @@ function normalizeEndpoint(url) {
 var REGISTRY = "https://registry.npmjs.org";
 var DEFAULT_TIMEOUT_MS = 2e3;
 async function checkFreshness(packageName, currentVersion, opts = {}) {
-  if (process.env.MUSHI_NO_UPDATE_CHECK === "1") return null;
+  if (!opts.ignoreOptOut && process.env.MUSHI_NO_UPDATE_CHECK === "1") return null;
   const registry = opts.registry ?? REGISTRY;
   const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const controller = new AbortController();
@@ -482,11 +483,13 @@ function isNewerStableVersion(latest, current) {
   return lc > cc;
 }
 function stripPreRelease(version) {
-  const idx = version.indexOf("-");
+  const idx = version.search(/[-+]/);
   return idx === -1 ? version : version.slice(0, idx);
 }
 function hasPreReleaseTag(version) {
-  return version.includes("-");
+  const plus = version.indexOf("+");
+  const hyphen = version.indexOf("-");
+  return hyphen !== -1 && (plus === -1 || hyphen < plus);
 }
 function parse(version) {
   const parts = version.split(".").map((part) => Number(part));
@@ -595,7 +598,7 @@ function getFrameworkFromPkg(pkg) {
 }
 
 // src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.11.2" : "0.0.0-dev";
+var MUSHI_CLI_VERSION = true ? "0.13.0" : "0.0.0-dev";
 
 // src/init.ts
 var ENV_FILES = [".env.local", ".env"];
@@ -744,7 +747,7 @@ async function installPackages(pm, packages, cwd) {
 function runCommand(pm, packages, cwd) {
   const verb = pm === "npm" ? "install" : "add";
   const command = process.platform === "win32" ? `${pm}.cmd` : pm;
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve4, reject) => {
     const child = spawn(command, [verb, ...packages], {
       stdio: "inherit",
       shell: false,
@@ -753,7 +756,7 @@ function runCommand(pm, packages, cwd) {
     });
     child.on("error", reject);
     child.on("exit", (code) => {
-      if (code === 0) resolve2();
+      if (code === 0) resolve4();
       else reject(new Error(`${pm} exited with code ${code ?? "null"}`));
     });
   });
@@ -1108,11 +1111,11 @@ async function findMapFiles(dir) {
   return results;
 }
 function fileHash(path) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve4, reject) => {
     const hash = createHash("sha256");
     const stream = createReadStream(path);
     stream.on("data", (chunk) => hash.update(chunk));
-    stream.on("end", () => resolve2(hash.digest("hex")));
+    stream.on("end", () => resolve4(hash.digest("hex")));
     stream.on("error", reject);
   });
 }
@@ -1416,13 +1419,82 @@ function renderNudgeExplainer(phase) {
   return lines.join("\n");
 }
 
+// src/heartbeat-wait.ts
+var IngestSetupHttpError = class extends Error {
+  status;
+  constructor(status) {
+    super(`ingest-setup HTTP ${status}`);
+    this.name = "IngestSetupHttpError";
+    this.status = status;
+  }
+};
+var NON_RETRYABLE_STATUSES = /* @__PURE__ */ new Set([401, 403, 404]);
+async function fetchIngestSetup(config, doFetch = globalThis.fetch) {
+  const res = await doFetch(`${config.endpoint}/v1/sync/ingest-setup`, {
+    headers: {
+      Authorization: `Bearer ${config.apiKey}`,
+      "X-Mushi-Api-Key": config.apiKey,
+      ...config.projectId ? { "X-Mushi-Project": config.projectId } : {}
+    },
+    signal: AbortSignal.timeout(8e3)
+  });
+  if (!res.ok) {
+    if (NON_RETRYABLE_STATUSES.has(res.status)) throw new IngestSetupHttpError(res.status);
+    return null;
+  }
+  const body = await res.json();
+  return body.ok && body.data ? body.data : null;
+}
+async function waitForIngestReady(options) {
+  const doFetch = options.fetch ?? globalThis.fetch;
+  const maxAttempts = options.maxAttempts ?? 40;
+  const intervalMs = options.intervalMs ?? 3e3;
+  let lastPayload = null;
+  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+    if (options.signal?.aborted) {
+      return { ok: false, payload: lastPayload, attempts: attempt - 1, reason: "aborted" };
+    }
+    try {
+      lastPayload = await fetchIngestSetup(
+        { endpoint: options.endpoint, apiKey: options.apiKey, projectId: options.projectId },
+        doFetch
+      );
+      if (lastPayload) {
+        options.onPoll?.(lastPayload, attempt);
+        if (lastPayload.ready) {
+          return { ok: true, payload: lastPayload, attempts: attempt, reason: "ready" };
+        }
+        const sdkStep = lastPayload.steps.find((s) => s.id === "sdk_installed");
+        if (sdkStep?.complete) {
+          return { ok: true, payload: lastPayload, attempts: attempt, reason: "heartbeat" };
+        }
+      }
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (err instanceof IngestSetupHttpError) {
+        return { ok: false, payload: lastPayload, attempts: attempt, reason: "unauthorized", error: msg };
+      }
+      if (options.signal?.aborted) {
+        return { ok: false, payload: lastPayload, attempts: attempt, reason: "aborted", error: msg };
+      }
+      if (attempt === maxAttempts) {
+        return { ok: false, payload: lastPayload, attempts: attempt, reason: "fetch-error", error: msg };
+      }
+    }
+    if (attempt < maxAttempts) {
+      await new Promise((r) => setTimeout(r, intervalMs));
+    }
+  }
+  return { ok: false, payload: lastPayload, attempts: maxAttempts, reason: "timeout" };
+}
+
 // src/doctor.ts
 function checkCliConfig(config) {
   return [
     {
       name: "CLI config file",
       ok: Boolean(config.endpoint),
-      detail: config.endpoint ? `endpoint=${config.endpoint}` : "No endpoint in ~/.mushirc \u2014 run `mushi init` or `mushi config endpoint <url>`"
+      detail: config.endpoint ? `endpoint=${config.endpoint}` : "No endpoint \u2014 set MUSHI_API_ENDPOINT, run `mushi connect`, or `mushi config endpoint <url>`"
     },
     {
       name: "API key configured",
@@ -1453,11 +1525,11 @@ async function checkEndpointReachability(endpoint, doFetch = globalThis.fetch) {
 }
 async function checkSdkInstall(cwd) {
   try {
-    const { readFile: readFile2 } = await import("fs/promises");
-    const { join: join6, resolve: resolve2 } = await import("path");
-    const root = resolve2(cwd);
-    const pkgPath = join6(root, "package.json");
-    const pkg = JSON.parse(await readFile2(pkgPath, "utf8"));
+    const { readFile: readFile3 } = await import("fs/promises");
+    const { join: join7, resolve: resolve4 } = await import("path");
+    const root = resolve4(cwd);
+    const pkgPath = join7(root, "package.json");
+    const pkg = JSON.parse(await readFile3(pkgPath, "utf8"));
     const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
     const sdks = [
       "@mushi-mushi/react",
@@ -1519,6 +1591,44 @@ async function checkServerPreflight(config, doFetch = globalThis.fetch) {
     return [{ name: "Server preflight", ok: false, detail: `Fetch failed: ${msg}` }];
   }
 }
+async function checkIngestSetup(config, doFetch = globalThis.fetch) {
+  if (!config.apiKey || !config.endpoint) {
+    return [
+      {
+        name: "Ingest setup",
+        ok: false,
+        detail: "Need apiKey and endpoint. Run `mushi connect`."
+      }
+    ];
+  }
+  try {
+    const data = await fetchIngestSetup(
+      { endpoint: config.endpoint, apiKey: config.apiKey, projectId: config.projectId },
+      doFetch
+    );
+    if (!data) {
+      return [{ name: "Ingest setup", ok: false, detail: "Request to /v1/sync/ingest-setup failed or returned invalid payload" }];
+    }
+    const steps = data.steps ?? [];
+    const checks = steps.filter((s) => s.required).map((s) => ({
+      name: `[ingest] ${s.label}`,
+      ok: s.complete,
+      detail: s.hint ?? ""
+    }));
+    const diag = data.diagnostic;
+    if (diag?.last_sdk_seen_at) {
+      checks.push({
+        name: "[ingest] Last SDK heartbeat",
+        ok: true,
+        detail: `${diag.last_sdk_seen_at}${diag.last_sdk_endpoint_host ? ` @ ${diag.last_sdk_endpoint_host}` : ""}`
+      });
+    }
+    return checks.length > 0 ? checks : [{ name: "Ingest setup", ok: false, detail: "Empty response from /v1/sync/ingest-setup" }];
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return [{ name: "Ingest setup", ok: false, detail: `Fetch failed: ${msg}` }];
+  }
+}
 async function runDoctor(config, options = {}) {
   const doFetch = options.fetch ?? globalThis.fetch;
   const checks = [];
@@ -1532,6 +1642,10 @@ async function runDoctor(config, options = {}) {
     const serverChecks = await checkServerPreflight(config, doFetch);
     checks.push(...serverChecks);
   }
+  if (options.ingest) {
+    const ingestChecks = await checkIngestSetup(config, doFetch);
+    checks.push(...ingestChecks);
+  }
   return { checks, ready: checks.every((c) => c.ok) };
 }
 function formatDoctorResult(result) {
@@ -1553,6 +1667,232 @@ ${failed.length} check${failed.length === 1 ? "" : "s"} failed.`);
   return lines.join("\n");
 }
 
+// src/upgrade.ts
+import { resolve as resolve2 } from "path";
+import { execSync } from "child_process";
+var SAFE_NPM_VERSION = /^\d+\.\d+\.\d+(-[\w.]+)?$/;
+var MUSHI_PACKAGES = [
+  "@mushi-mushi/web",
+  "@mushi-mushi/core",
+  "@mushi-mushi/react",
+  "@mushi-mushi/react-native",
+  "@mushi-mushi/capacitor",
+  "@mushi-mushi/node",
+  "@mushi-mushi/cli"
+];
+async function planUpgrade(cwd) {
+  const root = resolve2(cwd);
+  const pkg = readPackageJson(root);
+  const pm = detectPackageManager(root);
+  const deps = {
+    ...pkg?.dependencies ?? {},
+    ...pkg?.devDependencies ?? {}
+  };
+  const installed2 = MUSHI_PACKAGES.filter((name) => deps[name]);
+  const entries = await Promise.all(
+    installed2.map(async (name) => {
+      const current = deps[name] ?? "";
+      const currentCore = current.replace(/^[\^~>=<]*/, "");
+      if (!/^\d/.test(currentCore)) {
+        return { name, current, latest: null, willUpgrade: false };
+      }
+      const freshness = await checkFreshness(name, currentCore, {
+        timeoutMs: 4e3,
+        ignoreOptOut: true
+      });
+      const latest = freshness?.latest ?? null;
+      const safeLatest = latest && SAFE_NPM_VERSION.test(latest) ? latest : null;
+      const willUpgrade = Boolean(freshness?.isOutdated && safeLatest);
+      return {
+        name,
+        current,
+        latest: safeLatest,
+        willUpgrade,
+        migrateToWeb: name === "@mushi-mushi/react" && willUpgrade
+      };
+    })
+  );
+  const toBump = entries.filter((e) => e.willUpgrade && e.latest).map((e) => `${e.name}@${e.latest}`);
+  return {
+    cwd: root,
+    packageManager: pm,
+    entries,
+    installCmd: toBump.length > 0 ? installCommand(pm, toBump) : null
+  };
+}
+async function runUpgrade(opts = {}) {
+  const plan = await planUpgrade(opts.cwd ?? process.cwd());
+  if (plan.entries.length === 0) {
+    return {
+      plan,
+      upgraded: false,
+      message: "No @mushi-mushi/* packages in package.json \u2014 run `mushi init` first."
+    };
+  }
+  if (!plan.installCmd) {
+    const semverEntries = plan.entries.filter((e) => /\d/.test(e.current));
+    const allChecksFailed = semverEntries.length > 0 && semverEntries.every((e) => e.latest === null);
+    return {
+      plan,
+      upgraded: false,
+      message: allChecksFailed ? "Could not reach the npm registry to check for updates \u2014 try again in a moment." : "All installed Mushi packages are already at the latest stable version."
+    };
+  }
+  if (opts.dryRun) {
+    return { plan, upgraded: false, message: `[dry-run] Would run: ${plan.installCmd}` };
+  }
+  try {
+    execSync(plan.installCmd, { cwd: plan.cwd, stdio: "inherit", env: process.env });
+  } catch {
+    return {
+      plan,
+      upgraded: false,
+      message: `Install command failed \u2014 fix the error above or run it manually:
+  ${plan.installCmd}`
+    };
+  }
+  const reactEntry = plan.entries.find((e) => e.migrateToWeb);
+  const migrateNote = reactEntry ? "\nNote: @mushi-mushi/react is legacy \u2014 prefer @mushi-mushi/web for Vite/Capacitor/SPA apps." : "";
+  return {
+    plan,
+    upgraded: true,
+    message: `Upgraded Mushi SDK packages.
+  ${plan.installCmd}${migrateNote}`
+  };
+}
+
+// src/connect.ts
+import { appendFile, mkdir, readFile as readFile2, writeFile } from "fs/promises";
+import { existsSync as existsSync5 } from "fs";
+import { join as join6, resolve as resolve3 } from "path";
+function envKeyPresent(content, key) {
+  const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`^${escaped}=`, "m").test(content);
+}
+async function mergeEnvFile(path, lines) {
+  const block = `
+# Mushi \u2014 added by mushi connect
+${lines.join("\n")}
+`;
+  if (existsSync5(path)) {
+    const content = await readFile2(path, "utf8");
+    const needs = lines.filter((line) => {
+      const key = line.split("=")[0];
+      return !envKeyPresent(content, key);
+    });
+    if (needs.length === 0) return false;
+    await appendFile(path, `
+# Mushi \u2014 added by mushi connect
+${needs.join("\n")}
+`, "utf8");
+    return true;
+  }
+  await writeFile(path, block, "utf8");
+  return true;
+}
+async function ensureMcpJsonGitignored(cwd, messages) {
+  const gitignorePath = join6(cwd, ".gitignore");
+  const patterns = [".cursor/mcp.json", ".cursor/"];
+  if (!existsSync5(gitignorePath)) {
+    messages.push(
+      "\u26A0 No .gitignore found \u2014 .cursor/mcp.json contains your API key. Add `.cursor/mcp.json` before committing."
+    );
+    return;
+  }
+  const content = await readFile2(gitignorePath, "utf8");
+  const covered = patterns.some((p3) => content.split("\n").some((line) => line.trim() === p3 || line.trim() === `${p3}/`));
+  if (covered) return;
+  await appendFile(gitignorePath, "\n# Mushi \u2014 keep MCP credentials out of git\n.cursor/mcp.json\n", "utf8");
+  messages.push("\u2713 Added .cursor/mcp.json to .gitignore (contains API key)");
+}
+async function runConnect(opts, baseConfig = {}) {
+  const cwd = resolve3(opts.cwd ?? process.cwd());
+  const endpoint = assertEndpoint(opts.endpoint);
+  const messages = [];
+  const config = {
+    ...baseConfig,
+    apiKey: opts.apiKey,
+    projectId: opts.projectId,
+    endpoint
+  };
+  saveConfig(config);
+  messages.push(`\u2713 Credentials saved to ${CONFIG_PATH}`);
+  let envPath = null;
+  if (opts.writeEnv !== false) {
+    const pkg = readPackageJson(cwd);
+    const framework = detectFramework(cwd, pkg);
+    const lines = envVarsToWrite(opts.apiKey, opts.projectId, framework).split("\n");
+    envPath = join6(cwd, ".env.local");
+    const wrote = await mergeEnvFile(envPath, lines);
+    messages.push(
+      wrote ? `\u2713 Env vars merged into ${envPath}` : `\u2713 Env vars already present in ${envPath} (existing values left untouched)`
+    );
+  }
+  let mcpPath = null;
+  if (opts.wireIde !== false) {
+    const mcpDir = join6(cwd, ".cursor");
+    mcpPath = join6(mcpDir, "mcp.json");
+    const serverName = `mushi-${opts.projectId.slice(0, 8)}`;
+    const mcpServerBlock = {
+      command: "npx",
+      args: ["-y", "@mushi-mushi/mcp@latest"],
+      env: {
+        MUSHI_API_ENDPOINT: endpoint,
+        MUSHI_PROJECT_ID: opts.projectId,
+        MUSHI_API_KEY: opts.apiKey
+      }
+    };
+    let merged = { mcpServers: {} };
+    if (existsSync5(mcpPath)) {
+      try {
+        merged = JSON.parse(await readFile2(mcpPath, "utf8"));
+      } catch {
+      }
+    }
+    const servers = merged.mcpServers ?? {};
+    servers[serverName] = mcpServerBlock;
+    merged.mcpServers = servers;
+    await mkdir(mcpDir, { recursive: true });
+    await writeFile(mcpPath, JSON.stringify(merged, null, 2) + "\n", "utf8");
+    await ensureMcpJsonGitignored(cwd, messages);
+    messages.push(`\u2713 Wired ${mcpPath} \u2014 restart Cursor and run "list mushi tools"`);
+  }
+  let heartbeat = null;
+  if (opts.wait) {
+    const timeoutSec = opts.waitTimeoutSec ?? 120;
+    const maxAttempts = Math.max(1, Math.ceil(timeoutSec * 1e3 / 3e3));
+    messages.push(`\u2026 Waiting for SDK heartbeat (up to ${timeoutSec}s) \u2014 start your dev server with the snippet installed`);
+    heartbeat = await waitForIngestReady({
+      endpoint,
+      apiKey: opts.apiKey,
+      projectId: opts.projectId,
+      maxAttempts,
+      onPoll: (payload, attempt) => {
+        if (!opts.json && attempt % 3 === 0) {
+          const sdk = payload.steps.find((s) => s.id === "sdk_installed");
+          const seen = payload.diagnostic?.last_sdk_seen_at ?? "never";
+          process.stdout.write(`  poll ${attempt}: sdk_installed=${sdk?.complete ? "yes" : "no"} last_seen=${seen}
+`);
+        }
+      }
+    });
+    if (heartbeat.ok) {
+      const label = heartbeat.reason === "heartbeat" ? "SDK heartbeat detected" : "Ingest setup complete";
+      messages.push(`\u2713 ${label} \u2014 ingest pipeline is live`);
+    } else if (heartbeat.reason === "unauthorized") {
+      messages.push(
+        `\u2717 The backend rejected these credentials (${heartbeat.error ?? "auth error"}). Double-check --api-key, --project-id, and --endpoint, then re-run \`mushi connect --wait\`.`
+      );
+    } else {
+      messages.push(
+        `\u2717 No heartbeat before timeout (${heartbeat.reason}). Confirm env vars are in your build, restart the dev server, then re-run \`mushi connect --wait\`.`
+      );
+    }
+  }
+  const ok = !opts.wait || Boolean(heartbeat?.ok);
+  return { ok, envPath, mcpPath, heartbeat, messages };
+}
+
 // src/index.ts
 installSignalHandlers();
 var API_TIMEOUT_MS = 15e3;
@@ -2016,6 +2356,31 @@ reports.command("dismiss <id>").description("Dismiss a report (not a real bug /
     console.log(`\u2713 Dismissed report ${id}`);
   }
 });
+reports.command("reply <id> <message>").description("Send a visible reply to the reporter widget for a report").option("--author <name>", 'Display name for the sender (default: "Mushi Admin")').option("--json", "Machine-readable JSON output").addHelpText("after", `
+Examples:
+  mushi reports reply abc123 "Thanks for reporting \u2014 fixing this in the next release."
+  mushi reports reply abc123 "Can you share a screenshot?" --author "Alice"`).action(async (id, message, opts) => {
+  const config = requireConfig();
+  const body = { message };
+  if (opts.author) body["author_name"] = opts.author;
+  const result = await apiCall(`/v1/sync/reports/${id}/reply`, config, {
+    method: "POST",
+    body: JSON.stringify(body)
+  });
+  if (!result.ok) {
+    if (result.httpStatus === 404 || result.error.code === "NOT_FOUND") {
+      process.stderr.write(`error: report "${id}" not found
+`);
+      process.exit(3);
+    }
+    die(result);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+  } else {
+    console.log(`\u2713 Reply sent to reporter for report ${id}`);
+  }
+});
 reports.command("search <query>").description("Search reports by keyword in summary and description").option("--limit <n>", "Max results (1\u201350)", "10").option("--status <status>", "Filter by status").option("--json", "Machine-readable JSON output").addHelpText("after", `
 Examples:
   mushi reports search "login button"
@@ -2117,7 +2482,7 @@ AI code review context.
 Typical CI usage:
   MUSHI_API_KEY=$KEY MUSHI_PROJECT_ID=$PID MUSHI_API_ENDPOINT=$URL \\
     npx @mushi-mushi/cli sync-lessons --cwd .`).action(async (opts) => {
-  const { writeFile, mkdir } = await import("fs/promises");
+  const { writeFile: writeFile2, mkdir: mkdir2 } = await import("fs/promises");
   const nodePath = await import("path");
   const config = requireConfig();
   const cwd = opts.cwd ?? process.cwd();
@@ -2144,8 +2509,8 @@ Typical CI usage:
     console.log(JSON.stringify(output, null, 2));
     return;
   }
-  await mkdir(nodePath.dirname(target), { recursive: true });
-  await writeFile(target, JSON.stringify(output, null, 2) + "\n", "utf8");
+  await mkdir2(nodePath.dirname(target), { recursive: true });
+  await writeFile2(target, JSON.stringify(output, null, 2) + "\n", "utf8");
   if (opts.json) {
     console.log(JSON.stringify({ ok: true, path: target, count: lessons2.length }));
   } else {
@@ -2194,7 +2559,7 @@ Examples:
   mushi index ./src
   mushi index ./src --language ts --dry-run`).action(async (path, opts) => {
   const config = requireConfig({ needsProject: true });
-  const { readdir: readdir2, readFile: readFile2, stat } = await import("fs/promises");
+  const { readdir: readdir2, readFile: readFile3, stat } = await import("fs/promises");
   const nodePath = await import("path");
   const SKIP = /node_modules|\.git|dist|build|\.next|\.turbo|coverage/;
   const EXTS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".py", ".go", ".rs"]);
@@ -2221,7 +2586,7 @@ Examples:
 `);
       continue;
     }
-    const source = await readFile2(file, "utf8");
+    const source = await readFile3(file, "utf8");
     const relative2 = nodePath.relative(root, file).replaceAll("\\", "/");
     count++;
     bytes += source.length;
@@ -2278,8 +2643,8 @@ Typical first-time flow:
   # Browser opens \u2192 sign up / magic-link \u2192 come back to terminal
   # CLI writes .env.local and .cursor/mcp.json
   # mushi whoami to confirm`).action(async (opts) => {
-  const { writeFile, mkdir } = await import("fs/promises");
-  const { existsSync: existsSync5 } = await import("fs");
+  const { writeFile: writeFile2, mkdir: mkdir2 } = await import("fs/promises");
+  const { existsSync: existsSync6 } = await import("fs");
   const nodePath = await import("path");
   const endpoint = opts.endpoint ?? loadConfig().endpoint ?? "https://api.mushimushi.dev";
   const signUpUrl = "https://kensaur.us/mushi-mushi/sign-up";
@@ -2304,7 +2669,7 @@ Typical first-time flow:
   console.log("");
   const { createInterface } = await import("readline");
   const rl = createInterface({ input: process.stdin, output: process.stdout });
-  const ask = (q) => new Promise((resolve2) => rl.question(q, (a) => resolve2(a.trim())));
+  const ask = (q) => new Promise((resolve4) => rl.question(q, (a) => resolve4(a.trim())));
   const projectId = await ask("  Project ID (uuid): ");
   const apiKey = await ask("  API key (mushi_...): ");
   rl.close();
@@ -2326,18 +2691,18 @@ Typical first-time flow:
     `MUSHI_API_KEY=${apiKey}`,
     ""
   ];
-  const envExisting = existsSync5(envPath);
-  await writeFile(envPath, envLines.join("\n"), "utf8");
+  const envExisting = existsSync6(envPath);
+  await writeFile2(envPath, envLines.join("\n"), "utf8");
   console.log(`
   \u2713 ${envExisting ? "Updated" : "Created"} .env.local`);
   const mcpDir = nodePath.join(cwd, ".cursor");
-  await mkdir(mcpDir, { recursive: true });
+  await mkdir2(mcpDir, { recursive: true });
   const mcpPath = nodePath.join(mcpDir, "mcp.json");
   const mcpJson = {
     mcpServers: {
       mushi: {
         command: "npx",
-        args: ["-y", "mushi-mcp@latest"],
+        args: ["-y", "@mushi-mushi/mcp@latest"],
         env: {
           MUSHI_API_ENDPOINT: endpoint,
           MUSHI_PROJECT_ID: projectId,
@@ -2346,19 +2711,19 @@ Typical first-time flow:
       }
     }
   };
-  const mcpExisting = existsSync5(mcpPath);
+  const mcpExisting = existsSync6(mcpPath);
   if (mcpExisting) {
     try {
-      const { readFile: readFile2 } = await import("fs/promises");
-      const raw = JSON.parse(await readFile2(mcpPath, "utf8"));
+      const { readFile: readFile3 } = await import("fs/promises");
+      const raw = JSON.parse(await readFile3(mcpPath, "utf8"));
       const existing = raw;
       existing.mcpServers = { ...existing.mcpServers ?? {}, mushi: mcpJson.mcpServers.mushi };
-      await writeFile(mcpPath, JSON.stringify(existing, null, 2) + "\n", "utf8");
+      await writeFile2(mcpPath, JSON.stringify(existing, null, 2) + "\n", "utf8");
     } catch {
-      await writeFile(mcpPath, JSON.stringify(mcpJson, null, 2) + "\n", "utf8");
+      await writeFile2(mcpPath, JSON.stringify(mcpJson, null, 2) + "\n", "utf8");
     }
   } else {
-    await writeFile(mcpPath, JSON.stringify(mcpJson, null, 2) + "\n", "utf8");
+    await writeFile2(mcpPath, JSON.stringify(mcpJson, null, 2) + "\n", "utf8");
   }
   console.log(`  \u2713 ${mcpExisting ? "Updated" : "Created"} .cursor/mcp.json`);
   console.log("");
@@ -2379,8 +2744,8 @@ Supported IDEs:
   zed       \u2014 writes ~/.config/zed/settings.json mcpServers block
 
 The command reads credentials from ~/.mushirc (run \`mushi login\` first).`).action(async (opts) => {
-  const { writeFile, mkdir, readFile: readFile2 } = await import("fs/promises");
-  const { existsSync: existsSync5 } = await import("fs");
+  const { writeFile: writeFile2, mkdir: mkdir2, readFile: readFile3 } = await import("fs/promises");
+  const { existsSync: existsSync6 } = await import("fs");
   const nodePath = await import("path");
   const os = await import("os");
   const config = requireConfig({ needsProject: true });
@@ -2401,7 +2766,7 @@ The command reads credentials from ~/.mushirc (run \`mushi login\` first).`).act
   const serverName = `mushi-${slug}`;
   const mcpServerBlock = {
     command: "npx",
-    args: ["-y", "mushi-mcp@latest"],
+    args: ["-y", "@mushi-mushi/mcp@latest"],
     env: {
       MUSHI_API_ENDPOINT: config.endpoint,
       MUSHI_PROJECT_ID: config.projectId ?? "",
@@ -2412,9 +2777,9 @@ The command reads credentials from ~/.mushirc (run \`mushi login\` first).`).act
   const configPath = nodePath.join(configDir, ideEntry.file);
   if (ideEntry.format === "mcp-json") {
     let merged = { mcpServers: {} };
-    if (existsSync5(configPath)) {
+    if (existsSync6(configPath)) {
       try {
-        const raw = await readFile2(configPath, "utf8");
+        const raw = await readFile3(configPath, "utf8");
         merged = JSON.parse(raw);
       } catch {
       }
@@ -2427,15 +2792,15 @@ The command reads credentials from ~/.mushirc (run \`mushi login\` first).`).act
       console.log(`[dry-run] Would write ${configPath}:`);
       console.log(output);
     } else {
-      await mkdir(configDir, { recursive: true });
-      await writeFile(configPath, output, "utf8");
+      await mkdir2(configDir, { recursive: true });
+      await writeFile2(configPath, output, "utf8");
       console.log(`\u2713 Written ${configPath}`);
     }
   } else if (ideEntry.format === "zed") {
     let settings = {};
-    if (existsSync5(configPath)) {
+    if (existsSync6(configPath)) {
       try {
-        const raw = await readFile2(configPath, "utf8");
+        const raw = await readFile3(configPath, "utf8");
         settings = JSON.parse(raw);
       } catch {
       }
@@ -2444,7 +2809,7 @@ The command reads credentials from ~/.mushirc (run \`mushi login\` first).`).act
     servers[serverName] = {
       command: {
         path: "npx",
-        args: ["-y", "mushi-mcp@latest"],
+        args: ["-y", "@mushi-mushi/mcp@latest"],
         env: {
           MUSHI_API_ENDPOINT: config.endpoint,
           MUSHI_PROJECT_ID: config.projectId ?? "",
@@ -2459,8 +2824,8 @@ The command reads credentials from ~/.mushirc (run \`mushi login\` first).`).act
       console.log(`[dry-run] Would write ${configPath}:`);
       console.log(output);
     } else {
-      await mkdir(configDir, { recursive: true });
-      await writeFile(configPath, output, "utf8");
+      await mkdir2(configDir, { recursive: true });
+      await writeFile2(configPath, output, "utf8");
       console.log(`\u2713 Written ${configPath}`);
     }
   }
@@ -2494,7 +2859,7 @@ The command reads credentials from ~/.mushirc (run \`mushi login\` first).`).act
       if (opts.dryRun) {
         console.log(`[dry-run] Would write ${rulesPath}`);
       } else {
-        await writeFile(rulesPath, rulesContent, "utf8");
+        await writeFile2(rulesPath, rulesContent, "utf8");
         console.log(`\u2713 Written .cursorrules`);
       }
     } else if (opts.ide === "claude") {
@@ -2503,8 +2868,8 @@ The command reads credentials from ~/.mushirc (run \`mushi login\` first).`).act
       if (opts.dryRun) {
         console.log(`[dry-run] Would write ${rulesPath}`);
       } else {
-        await mkdir(rulesDir, { recursive: true });
-        await writeFile(rulesPath, rulesContent, "utf8");
+        await mkdir2(rulesDir, { recursive: true });
+        await writeFile2(rulesPath, rulesContent, "utf8");
         console.log(`\u2713 Written .claude/rules/mushi.md`);
       }
     }
@@ -2558,6 +2923,7 @@ Examples:
   emitEvent("dispatch.start", { reportId, agent: opts.agent, model: opts.model ?? null });
   const body = {
     reportId,
+    projectId: cfg.projectId,
     agent: opts.agent
   };
   if (opts.agent === "cursor_cloud") {
@@ -2638,14 +3004,64 @@ program.command("nudge").description(
   }
   console.log(renderNudgeSnippet({ phase, overrides }));
 });
+program.command("upgrade").description("Bump installed @mushi-mushi/* packages to the latest stable npm release").option("--cwd <path>", "Target repo (default: cwd)").option("--dry-run", "Print the install command without running it").option("--json", "Machine-readable plan + result").addHelpText("after", `
+Examples:
+  mushi upgrade
+  mushi upgrade --dry-run
+  mushi upgrade --cwd ../glot.it`).action(async (opts) => {
+  const result = await runUpgrade({ cwd: opts.cwd, dryRun: opts.dryRun, json: opts.json });
+  if (opts.json) {
+    console.log(JSON.stringify(result, null, 2));
+  } else {
+    console.log(result.message);
+    for (const e of result.plan.entries) {
+      const tag = e.willUpgrade && e.latest ? `\u2192 v${e.latest}` : "(current)";
+      console.log(`  ${e.name}@${e.current} ${tag}`);
+    }
+  }
+  if (!result.upgraded && result.plan.entries.some((e) => e.willUpgrade) && !opts.dryRun) {
+    process.exit(1);
+  }
+  if (result.plan.entries.length === 0) process.exit(1);
+});
+program.command("connect").description("Save credentials, merge env vars, wire Cursor MCP, optionally wait for SDK heartbeat").option("--api-key <key>", "Mushi API key (mushi_\u2026) \u2014 or set MUSHI_API_KEY to keep it out of shell history").requiredOption("--project-id <id>", "Project UUID").requiredOption("--endpoint <url>", "Supabase edge function URL").option("--cwd <path>", "Target repo").option("--no-env", "Skip writing .env.local").option("--no-ide", "Skip writing .cursor/mcp.json").option("--wait", "Poll ingest-setup until SDK heartbeat lands").option("--wait-timeout <sec>", "Max seconds for --wait", "120").option("--json", "Machine-readable output").addHelpText("after", `
+Examples:
+  MUSHI_API_KEY=mushi_xxx mushi connect --project-id <uuid> --endpoint https://<ref>.supabase.co/functions/v1/api --wait
+  mushi connect --api-key mushi_xxx --project-id <uuid> --endpoint <url> --no-ide`).action(async (opts) => {
+  const apiKey = process.env.MUSHI_API_KEY ?? opts.apiKey;
+  if (!apiKey) {
+    console.error("Provide the API key via the MUSHI_API_KEY env var (recommended) or --api-key <key>.");
+    process.exit(1);
+  }
+  const result = await runConnect({
+    apiKey,
+    projectId: opts.projectId,
+    endpoint: opts.endpoint,
+    cwd: opts.cwd,
+    writeEnv: opts.env !== false,
+    wireIde: opts.ide !== false,
+    wait: opts.wait,
+    waitTimeoutSec: parseInt(opts.waitTimeout, 10) || 120,
+    json: opts.json
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(result, null, 2));
+  } else {
+    for (const line of result.messages) console.log(line);
+  }
+  if (!result.ok) process.exit(1);
+});
 program.command("doctor").description(
   "Run pre-flight checks: CLI config, endpoint reachability, API key shape, SDK install status, and (with --server) the same 4 dispatch-readiness checks shown in the Mushi console. Mirrors the in-console dispatch preflight so you can spot setup gaps before opening the admin UI."
 ).option("--cwd <path>", "Run package detection from a different directory").option("--json", "Machine-readable output").option(
   "--server",
   "Also call GET /preflight on the backend and include the 4 dispatch checks (GitHub repo, codebase indexed, Anthropic key, autofix enabled). Requires a configured projectId and API key."
+).option(
+  "--ingest",
+  "Also call GET /v1/sync/ingest-setup for the 4 required ingest steps (API key, SDK heartbeat, first report). Composable with --server."
 ).action(async (opts) => {
   const config = loadConfig();
-  const result = await runDoctor(config, { cwd: opts.cwd, server: opts.server });
+  const result = await runDoctor(config, { cwd: opts.cwd, server: opts.server, ingest: opts.ingest });
   const { checks } = result;
   if (opts.json) {
     console.log(JSON.stringify({ checks, ready: result.ready }, null, 2));
@@ -2756,4 +3172,208 @@ fixes.command("tail").description(
     }
   }
 });
-program.parse();
+var stories = program.command("stories").description("TDD story mapping and test generation");
+stories.command("map").description("Crawl a live app URL and automatically discover user stories (writes inventory proposal)").requiredOption("--url <url>", "Live app URL to crawl (e.g. https://your-app.vercel.app)").option("--max-pages <n>", "Max pages to crawl", "20").option("--provider <p>", "Crawl provider: firecrawl (default) or browserbase", "firecrawl").option("--cursor-refine", "Open a Cursor Cloud PR to refine the draft against repo code").option("--wait", "Wait for the crawl to complete and print results").action(async (opts) => {
+  const config = loadConfig();
+  if (!config.apiKey || !config.projectId) {
+    console.error("Run `mushi login` and `mushi init` first");
+    process.exit(1);
+  }
+  const res = await apiCall(
+    `/v1/admin/inventory/${config.projectId}/map-from-live`,
+    config,
+    {
+      method: "POST",
+      body: JSON.stringify({
+        base_url: opts.url,
+        max_pages: parseInt(opts.maxPages, 10),
+        provider: opts.provider,
+        cursor_cloud_refine: opts.cursorRefine ?? false
+      })
+    }
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error.message}`);
+    process.exit(1);
+  }
+  console.log(`\u2713 Crawl started \u2014 run id: ${res.data.runId}`);
+  console.log(`  Crawling ${opts.url} with ${opts.provider}\u2026`);
+  if (opts.wait) {
+    console.log("  Polling for results\u2026");
+    for (let i = 0; i < 40; i++) {
+      await new Promise((r) => setTimeout(r, 5e3));
+      const runsRes = await apiCall(
+        `/v1/admin/inventory/${config.projectId}/map-runs`,
+        config
+      );
+      if (!runsRes.ok) break;
+      const run = runsRes.data.runs.find((r) => r.id === res.data.runId);
+      if (!run) break;
+      if (run.status === "completed") {
+        console.log(`
+\u2713 Done! ${run.pages_crawled ?? 0} pages crawled.`);
+        if (run.proposal_id) console.log(`  Proposal id: ${run.proposal_id}`);
+        console.log(`  Review in the console: Inventory \u2192 Discovery \u2192 Past proposals`);
+        break;
+      }
+      if (run.status === "failed") {
+        console.error(`
+\u2717 Crawl failed: ${run.error_message ?? "unknown"}`);
+        process.exit(1);
+      }
+      process.stdout.write(".");
+    }
+  }
+});
+var tdd = program.command("tdd").description("TDD test generation and management");
+tdd.command("gen <storyId>").description("Generate a Playwright TDD test from an inventory user story id").option("--mode <m>", "Gate mode: auto (run immediately) | review (needs approval) | approve (manual)", "review").option("--no-pr", "Skip opening a GitHub PR").action(async (storyId, opts) => {
+  const config = loadConfig();
+  if (!config.apiKey || !config.projectId) {
+    console.error("Run `mushi login` first");
+    process.exit(1);
+  }
+  console.log(`Generating TDD test for story: ${storyId}\u2026`);
+  const res = await apiCall(
+    `/v1/admin/inventory/${config.projectId}/stories/${storyId}/generate-test`,
+    config,
+    { method: "POST", body: JSON.stringify({ automation_mode: opts.mode, open_pr: opts.pr }) }
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error.message}`);
+    process.exit(1);
+  }
+  console.log(`\u2713 Test generated \u2014 qa_story id: ${res.data.qaStoryId}`);
+  console.log(`  Approval status: ${res.data.approvalStatus}`);
+  if (res.data.prUrl) console.log(`  PR: ${res.data.prUrl}`);
+  if (res.data.needsHumanReview) console.log(`  \u26A0 Human review recommended \u2014 some selectors or flows are uncertain.`);
+});
+tdd.command("improve").description("Run PDCA auto-improve on recently failed QA tests").action(async () => {
+  const config = loadConfig();
+  if (!config.apiKey || !config.projectId) {
+    console.error("Run `mushi login` first");
+    process.exit(1);
+  }
+  console.log("Running PDCA QA story improver\u2026");
+  const res = await apiCall(
+    "/v1/admin/pdca/improve-qa-stories",
+    config,
+    { method: "POST", body: JSON.stringify({ project_id: config.projectId }) }
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error.message}`);
+    process.exit(1);
+  }
+  console.log(`\u2713 Improved ${res.data.improved} QA stories.`);
+});
+tdd.command("run <qaStoryId>").description("Trigger a manual run for a QA story").action(async (qaStoryId) => {
+  const config = loadConfig();
+  if (!config.apiKey || !config.projectId) {
+    console.error("Run `mushi login` first");
+    process.exit(1);
+  }
+  const res = await apiCall(
+    `/v1/admin/projects/${config.projectId}/qa-stories/${qaStoryId}/run`,
+    config,
+    { method: "POST" }
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error.message}`);
+    process.exit(1);
+  }
+  console.log(`\u2713 Run queued \u2014 id: ${res.data.runId}`);
+});
+tdd.command("pending").description("List QA tests pending review").action(async () => {
+  const config = loadConfig();
+  if (!config.apiKey || !config.projectId) {
+    console.error("Run `mushi login` first");
+    process.exit(1);
+  }
+  const res = await apiCall(
+    `/v1/admin/inventory/${config.projectId}/stories/pending-review`,
+    config
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error.message}`);
+    process.exit(1);
+  }
+  if (res.data.stories.length === 0) {
+    console.log("No stories pending review.");
+    return;
+  }
+  console.log(`${res.data.stories.length} stories pending review:
+`);
+  for (const s of res.data.stories) {
+    console.log(`  ${s.id}  ${s.name}${s.origin_story_node_id ? ` (story: ${s.origin_story_node_id})` : ""}`);
+    if (s.generated_pr_url) console.log(`     PR: ${s.generated_pr_url}`);
+  }
+  console.log(`
+Approve: mushi tdd approve <id>`);
+});
+tdd.command("approve <qaStoryId>").description("Approve a pending QA story (enables it in the schedule)").option("--reject", "Reject instead of approve").action(async (qaStoryId, opts) => {
+  const config = loadConfig();
+  if (!config.apiKey || !config.projectId) {
+    console.error("Run `mushi login` first");
+    process.exit(1);
+  }
+  const status = opts.reject ? "rejected" : "approved";
+  const res = await apiCall(
+    `/v1/admin/inventory/${config.projectId}/stories/${qaStoryId}/approval`,
+    config,
+    { method: "PATCH", body: JSON.stringify({ status }) }
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error.message}`);
+    process.exit(1);
+  }
+  console.log(`\u2713 Story ${status}.`);
+});
+var keys = program.command("keys").description("Manage API key pool (BYOK)");
+keys.command("list").description("List all API keys in the pool with their status").action(async () => {
+  const config = loadConfig();
+  if (!config.apiKey || !config.projectId) {
+    console.error("Run `mushi login` first");
+    process.exit(1);
+  }
+  const res = await apiCall(
+    `/v1/admin/byok/keys?project_id=${encodeURIComponent(config.projectId)}`,
+    config
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error.message}`);
+    process.exit(1);
+  }
+  if (res.data.keys.length === 0) {
+    console.log("No keys configured.");
+    return;
+  }
+  for (const k of res.data.keys) {
+    const cooldown = k.cooldown_until && new Date(k.cooldown_until) > /* @__PURE__ */ new Date() ? ` [cooldown until ${new Date(k.cooldown_until).toLocaleTimeString()}]` : "";
+    console.log(`${k.provider_slug.padEnd(14)} [${k.status}] p=${k.priority} ${k.label ?? "(no label)"}${cooldown} \u2014 ${k.id}`);
+  }
+});
+keys.command("add").description("Add a new API key to the pool").requiredOption("--provider <p>", "Provider: anthropic, openai, firecrawl, browserbase, cursor").option("--key <k>", "The API key value (prefer the MUSHI_BYOK_KEY env var to keep it out of shell history)").option("--label <l>", "Human-readable label").option("--priority <n>", "Priority (lower = higher priority)", "100").action(async (opts) => {
+  const config = loadConfig();
+  if (!config.apiKey || !config.projectId) {
+    console.error("Run `mushi login` first");
+    process.exit(1);
+  }
+  const key = process.env.MUSHI_BYOK_KEY ?? opts.key;
+  if (!key) {
+    console.error("Provide the key via the MUSHI_BYOK_KEY env var (recommended) or --key <value>.");
+    process.exit(1);
+  }
+  const res = await apiCall(
+    "/v1/admin/byok/keys",
+    config,
+    { method: "POST", body: JSON.stringify({ project_id: config.projectId, provider_slug: opts.provider, key, label: opts.label, priority: parseInt(opts.priority, 10) }) }
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error.message}`);
+    process.exit(1);
+  }
+  console.log(`\u2713 Key added \u2014 id: ${res.data.id}`);
+});
+program.parseAsync().catch((err) => {
+  console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+  process.exit(1);
+});

package/dist/init.js

@@ -8,7 +8,7 @@ import {
 } from "./chunk-NYPX5KXR.js";
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-GPF6KFBM.js";
+} from "./chunk-IMDLL4EO.js";
 
 // src/init.ts
 import * as p from "@clack/prompts";
@@ -49,10 +49,11 @@ function loadConfig(path = CONFIG_PATH) {
   } else if (path === CONFIG_PATH && existsSync(LEGACY_CONFIG_PATH)) {
     file = migrateLegacyConfig() ?? {};
   }
+  const endpointFromEnv = process.env["MUSHI_API_ENDPOINT"] ?? process.env["MUSHI_ENDPOINT"] ?? void 0;
   const fromEnv = {
     ...process.env["MUSHI_API_KEY"] ? { apiKey: process.env["MUSHI_API_KEY"] } : {},
     ...process.env["MUSHI_PROJECT_ID"] ? { projectId: process.env["MUSHI_PROJECT_ID"] } : {},
-    ...process.env["MUSHI_API_ENDPOINT"] ? { endpoint: process.env["MUSHI_API_ENDPOINT"] } : {}
+    ...endpointFromEnv ? { endpoint: endpointFromEnv } : {}
   };
   return { ...file, ...fromEnv };
 }
@@ -126,7 +127,7 @@ function normalizeEndpoint(url) {
 var REGISTRY = "https://registry.npmjs.org";
 var DEFAULT_TIMEOUT_MS = 2e3;
 async function checkFreshness(packageName, currentVersion, opts = {}) {
-  if (process.env.MUSHI_NO_UPDATE_CHECK === "1") return null;
+  if (!opts.ignoreOptOut && process.env.MUSHI_NO_UPDATE_CHECK === "1") return null;
   const registry = opts.registry ?? REGISTRY;
   const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const controller = new AbortController();
@@ -164,11 +165,13 @@ function isNewerStableVersion(latest, current) {
   return lc > cc;
 }
 function stripPreRelease(version) {
-  const idx = version.indexOf("-");
+  const idx = version.search(/[-+]/);
   return idx === -1 ? version : version.slice(0, idx);
 }
 function hasPreReleaseTag(version) {
-  return version.includes("-");
+  const plus = version.indexOf("+");
+  const hyphen = version.indexOf("-");
+  return hyphen !== -1 && (plus === -1 || hyphen < plus);
 }
 function parse(version) {
   const parts = version.split(".").map((part) => Number(part));

package/dist/version.js

@@ -1,6 +1,6 @@
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-GPF6KFBM.js";
+} from "./chunk-IMDLL4EO.js";
 export {
   MUSHI_CLI_VERSION
 };

package/package.json

@@ -1,28 +1,22 @@
 {
   "name": "@mushi-mushi/cli",
-  "version": "0.11.2",
+  "version": "0.13.0",
   "license": "MIT",
   "description": "CLI for Mushi Mushi — `mushi init` wizard installs the right SDK for your framework, plus report triage and pipeline health commands",
   "bin": {
     "mushi": "./dist/index.js"
   },
-  "scripts": {
-    "build": "tsup",
-    "lint": "eslint src/",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit"
-  },
   "dependencies": {
     "@clack/prompts": "^1.3.0",
     "commander": "^14.0.3"
   },
   "devDependencies": {
-    "@mushi-mushi/eslint-config": "workspace:*",
     "@types/node": "^22.19.17",
     "eslint": "^10.3.0",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.5"
+    "vitest": "^4.1.5",
+    "@mushi-mushi/eslint-config": "0.0.0"
   },
   "author": "Kenji Sakuramoto",
   "repository": {
@@ -109,5 +103,11 @@
   "type": "module",
   "engines": {
     "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsup",
+    "lint": "eslint src/",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
   }
-}
+}

package/dist/chunk-GPF6KFBM.js

@@ -1,6 +0,0 @@
-// src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.11.2" : "0.0.0-dev";
-
-export {
-  MUSHI_CLI_VERSION
-};