@mushi-mushi/cli 0.13.0 → 0.14.0

package/dist/chunk-4W6VOIQT.js

@@ -0,0 +1,6 @@
+// src/version.ts
+var MUSHI_CLI_VERSION = true ? "0.14.0" : "0.0.0-dev";
+
+export {
+  MUSHI_CLI_VERSION
+};

package/dist/index.js

@@ -598,7 +598,7 @@ function getFrameworkFromPkg(pkg) {
 }
 
 // src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.13.0" : "0.0.0-dev";
+var MUSHI_CLI_VERSION = true ? "0.14.0" : "0.0.0-dev";
 
 // src/init.ts
 var ENV_FILES = [".env.local", ".env"];
@@ -1430,10 +1430,11 @@ var IngestSetupHttpError = class extends Error {
 };
 var NON_RETRYABLE_STATUSES = /* @__PURE__ */ new Set([401, 403, 404]);
 async function fetchIngestSetup(config, doFetch = globalThis.fetch) {
+  const safeKey = config.apiKey.replace(/[\r\n]/g, "");
   const res = await doFetch(`${config.endpoint}/v1/sync/ingest-setup`, {
     headers: {
-      Authorization: `Bearer ${config.apiKey}`,
-      "X-Mushi-Api-Key": config.apiKey,
+      Authorization: `Bearer ${safeKey}`,
+      "X-Mushi-Api-Key": safeKey,
       ...config.projectId ? { "X-Mushi-Project": config.projectId } : {}
     },
     signal: AbortSignal.timeout(8e3)
@@ -1575,7 +1576,7 @@ async function checkServerPreflight(config, doFetch = globalThis.fetch) {
       return serverChecks.map((sc) => ({
         name: `[server] ${sc.label}`,
         ok: sc.ready,
-        detail: sc.hint
+        detail: sc.ready ? "" : sc.hint
       }));
     }
     const text2 = await res.text().catch(() => "");
@@ -1613,7 +1614,7 @@ async function checkIngestSetup(config, doFetch = globalThis.fetch) {
     const checks = steps.filter((s) => s.required).map((s) => ({
       name: `[ingest] ${s.label}`,
       ok: s.complete,
-      detail: s.hint ?? ""
+      detail: s.complete ? "" : s.hint ?? ""
     }));
     const diag = data.diagnostic;
     if (diag?.last_sdk_seen_at) {
@@ -1629,6 +1630,94 @@ async function checkIngestSetup(config, doFetch = globalThis.fetch) {
     return [{ name: "Ingest setup", ok: false, detail: `Fetch failed: ${msg}` }];
   }
 }
+async function checkQaStoriesHealth(config, doFetch = globalThis.fetch) {
+  if (!config.projectId || !config.apiKey || !config.endpoint) {
+    return [
+      {
+        name: "QA stories health",
+        ok: false,
+        detail: "Need projectId, apiKey, and endpoint for QA story checks."
+      }
+    ];
+  }
+  const checks = [];
+  try {
+    const storiesRes = await doFetch(
+      `${config.endpoint}/v1/admin/projects/${config.projectId}/qa-coverage`,
+      {
+        headers: {
+          Authorization: `Bearer ${config.apiKey}`,
+          "X-Mushi-Api-Key": config.apiKey,
+          "X-Mushi-Project": config.projectId
+        },
+        signal: AbortSignal.timeout(8e3)
+      }
+    );
+    if (!storiesRes.ok) {
+      checks.push({ name: "[qa] Fetch QA stories", ok: false, detail: `HTTP ${storiesRes.status}` });
+      return checks;
+    }
+    const storiesBody = await storiesRes.json();
+    const stories2 = storiesBody.data?.coverage ?? [];
+    const enabled = stories2.filter((s) => s.enabled);
+    if (enabled.length === 0) {
+      checks.push({ name: "[qa] Enabled QA stories", ok: true, detail: "No enabled stories \u2014 create one at /qa-coverage" });
+      return checks;
+    }
+    checks.push({
+      name: "[qa] Enabled QA stories",
+      ok: true,
+      detail: `${enabled.length} enabled story/stories configured`
+    });
+    const slackRes = await doFetch(
+      `${config.endpoint}/v1/admin/projects/${config.projectId}/integrations/probe/slack`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${config.apiKey}`,
+          "X-Mushi-Api-Key": config.apiKey,
+          "X-Mushi-Project": config.projectId
+        },
+        signal: AbortSignal.timeout(6e3)
+      }
+    );
+    const slackBody = slackRes.ok ? await slackRes.json() : null;
+    const slackOk = slackBody?.status === "ok";
+    checks.push({
+      name: "[qa] Slack notifications configured",
+      ok: slackOk,
+      detail: slackOk ? "Slack connected \u2014 failures will notify your channel" : "Slack not connected \u2014 you won't be notified when stories fail. Visit /integrations \u2192 Add to Slack."
+    });
+    const fcRes = await doFetch(
+      `${config.endpoint}/v1/admin/projects/${config.projectId}/integrations/probe/firecrawl`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${config.apiKey}`,
+          "X-Mushi-Api-Key": config.apiKey,
+          "X-Mushi-Project": config.projectId
+        },
+        signal: AbortSignal.timeout(6e3)
+      }
+    );
+    const fcBody = fcRes.ok ? await fcRes.json() : null;
+    const hasFirecrawlStories = enabled.some(
+      (s) => !s.browser_provider || s.browser_provider === "firecrawl_actions"
+    );
+    if (hasFirecrawlStories) {
+      const fcOk = fcBody?.status === "ok";
+      checks.push({
+        name: "[qa] Firecrawl API key configured",
+        ok: fcOk,
+        detail: fcOk ? "Firecrawl key is resolvable \u2014 stories will run without Unauthorized errors" : "No Firecrawl key found \u2014 enabled stories using firecrawl_actions will 401. Add a key at /integrations \u2192 BYOK keys."
+      });
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    checks.push({ name: "[qa] QA stories health", ok: false, detail: `Fetch failed: ${msg}` });
+  }
+  return checks;
+}
 async function runDoctor(config, options = {}) {
   const doFetch = options.fetch ?? globalThis.fetch;
   const checks = [];
@@ -1646,6 +1735,10 @@ async function runDoctor(config, options = {}) {
     const ingestChecks = await checkIngestSetup(config, doFetch);
     checks.push(...ingestChecks);
   }
+  if (options.qaStories) {
+    const qaChecks = await checkQaStoriesHealth(config, doFetch);
+    checks.push(...qaChecks);
+  }
   return { checks, ready: checks.every((c) => c.ok) };
 }
 function formatDoctorResult(result) {
@@ -1654,7 +1747,7 @@ function formatDoctorResult(result) {
   const lines = [];
   for (const c of result.checks) {
     lines.push(`${c.ok ? PASS : FAIL} ${c.name}`);
-    lines.push(`  ${c.detail}`);
+    if (c.detail) lines.push(`  ${c.detail}`);
   }
   const failed = result.checks.filter((c) => !c.ok);
   if (failed.length === 0) {
@@ -1763,7 +1856,6 @@ async function runUpgrade(opts = {}) {
 
 // src/connect.ts
 import { appendFile, mkdir, readFile as readFile2, writeFile } from "fs/promises";
-import { existsSync as existsSync5 } from "fs";
 import { join as join6, resolve as resolve3 } from "path";
 function envKeyPresent(content, key) {
   const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -1774,11 +1866,15 @@ async function mergeEnvFile(path, lines) {
 # Mushi \u2014 added by mushi connect
 ${lines.join("\n")}
 `;
-  if (existsSync5(path)) {
-    const content = await readFile2(path, "utf8");
+  let existing = null;
+  try {
+    existing = await readFile2(path, "utf8");
+  } catch {
+  }
+  if (existing !== null) {
     const needs = lines.filter((line) => {
       const key = line.split("=")[0];
-      return !envKeyPresent(content, key);
+      return !envKeyPresent(existing, key);
     });
     if (needs.length === 0) return false;
     await appendFile(path, `
@@ -1793,13 +1889,17 @@ ${needs.join("\n")}
 async function ensureMcpJsonGitignored(cwd, messages) {
   const gitignorePath = join6(cwd, ".gitignore");
   const patterns = [".cursor/mcp.json", ".cursor/"];
-  if (!existsSync5(gitignorePath)) {
+  let content = null;
+  try {
+    content = await readFile2(gitignorePath, "utf8");
+  } catch {
+  }
+  if (content === null) {
     messages.push(
       "\u26A0 No .gitignore found \u2014 .cursor/mcp.json contains your API key. Add `.cursor/mcp.json` before committing."
     );
     return;
   }
-  const content = await readFile2(gitignorePath, "utf8");
   const covered = patterns.some((p3) => content.split("\n").some((line) => line.trim() === p3 || line.trim() === `${p3}/`));
   if (covered) return;
   await appendFile(gitignorePath, "\n# Mushi \u2014 keep MCP credentials out of git\n.cursor/mcp.json\n", "utf8");
@@ -1843,11 +1943,9 @@ async function runConnect(opts, baseConfig = {}) {
       }
     };
     let merged = { mcpServers: {} };
-    if (existsSync5(mcpPath)) {
-      try {
-        merged = JSON.parse(await readFile2(mcpPath, "utf8"));
-      } catch {
-      }
+    try {
+      merged = JSON.parse(await readFile2(mcpPath, "utf8"));
+    } catch {
     }
     const servers = merged.mcpServers ?? {};
     servers[serverName] = mcpServerBlock;
@@ -2139,7 +2237,7 @@ Examples:
   mushi config endpoint https://...   # set endpoint
   mushi config projectId <uuid>       # set project`).action((key, value) => {
   const config = loadConfig();
-  const ALLOWED_KEYS = /* @__PURE__ */ new Set(["apiKey", "endpoint", "projectId"]);
+  const ALLOWED_KEYS = /* @__PURE__ */ new Set(["apiKey", "endpoint", "projectId", "consoleUrl"]);
   if (key && value) {
     if (!ALLOWED_KEYS.has(key)) {
       process.stderr.write(`error: unknown config key "${key}". Allowed: ${[...ALLOWED_KEYS].join(", ")}
@@ -2644,7 +2742,7 @@ Typical first-time flow:
   # CLI writes .env.local and .cursor/mcp.json
   # mushi whoami to confirm`).action(async (opts) => {
   const { writeFile: writeFile2, mkdir: mkdir2 } = await import("fs/promises");
-  const { existsSync: existsSync6 } = await import("fs");
+  const { existsSync: existsSync5 } = await import("fs");
   const nodePath = await import("path");
   const endpoint = opts.endpoint ?? loadConfig().endpoint ?? "https://api.mushimushi.dev";
   const signUpUrl = "https://kensaur.us/mushi-mushi/sign-up";
@@ -2691,7 +2789,7 @@ Typical first-time flow:
     `MUSHI_API_KEY=${apiKey}`,
     ""
   ];
-  const envExisting = existsSync6(envPath);
+  const envExisting = existsSync5(envPath);
   await writeFile2(envPath, envLines.join("\n"), "utf8");
   console.log(`
   \u2713 ${envExisting ? "Updated" : "Created"} .env.local`);
@@ -2711,7 +2809,7 @@ Typical first-time flow:
       }
     }
   };
-  const mcpExisting = existsSync6(mcpPath);
+  const mcpExisting = existsSync5(mcpPath);
   if (mcpExisting) {
     try {
       const { readFile: readFile3 } = await import("fs/promises");
@@ -2745,7 +2843,7 @@ Supported IDEs:
 
 The command reads credentials from ~/.mushirc (run \`mushi login\` first).`).action(async (opts) => {
   const { writeFile: writeFile2, mkdir: mkdir2, readFile: readFile3 } = await import("fs/promises");
-  const { existsSync: existsSync6 } = await import("fs");
+  const { existsSync: existsSync5 } = await import("fs");
   const nodePath = await import("path");
   const os = await import("os");
   const config = requireConfig({ needsProject: true });
@@ -2777,7 +2875,7 @@ The command reads credentials from ~/.mushirc (run \`mushi login\` first).`).act
   const configPath = nodePath.join(configDir, ideEntry.file);
   if (ideEntry.format === "mcp-json") {
     let merged = { mcpServers: {} };
-    if (existsSync6(configPath)) {
+    if (existsSync5(configPath)) {
       try {
         const raw = await readFile3(configPath, "utf8");
         merged = JSON.parse(raw);
@@ -2798,7 +2896,7 @@ The command reads credentials from ~/.mushirc (run \`mushi login\` first).`).act
     }
   } else if (ideEntry.format === "zed") {
     let settings = {};
-    if (existsSync6(configPath)) {
+    if (existsSync5(configPath)) {
       try {
         const raw = await readFile3(configPath, "utf8");
         settings = JSON.parse(raw);
@@ -3059,9 +3157,12 @@ program.command("doctor").description(
 ).option(
   "--ingest",
   "Also call GET /v1/sync/ingest-setup for the 4 required ingest steps (API key, SDK heartbeat, first report). Composable with --server."
+).option(
+  "--qa-stories",
+  "Check enabled QA stories for common setup issues: missing Firecrawl key, missing target URL, Slack not connected. Requires --server credentials."
 ).action(async (opts) => {
   const config = loadConfig();
-  const result = await runDoctor(config, { cwd: opts.cwd, server: opts.server, ingest: opts.ingest });
+  const result = await runDoctor(config, { cwd: opts.cwd, server: opts.server, ingest: opts.ingest, qaStories: opts.qaStories });
   const { checks } = result;
   if (opts.json) {
     console.log(JSON.stringify({ checks, ready: result.ready }, null, 2));
@@ -3373,6 +3474,373 @@ keys.command("add").description("Add a new API key to the pool").requiredOption(
   }
   console.log(`\u2713 Key added \u2014 id: ${res.data.id}`);
 });
+var integrations = program.command("integrations").description("Manage service integrations");
+integrations.command("list").description("List all configured integrations and their current health status").option("--json", "Machine-readable output").action(async (opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(2);
+  }
+  if (!config.projectId) {
+    console.error("No projectId. Run `mushi config projectId <uuid>`");
+    process.exit(2);
+  }
+  const result = await apiCall(
+    `/v1/admin/projects/${config.projectId}/integrations`,
+    config
+  );
+  const rawResult = result;
+  if (!rawResult.integrations && !result.ok) {
+    console.error("Failed:", result.error);
+    process.exit(1);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(rawResult, null, 2));
+    return;
+  }
+  const rows = rawResult.integrations ?? [];
+  if (rows.length === 0) {
+    console.log("No integrations configured. Visit the Integrations page to connect services.");
+    return;
+  }
+  const icons = {
+    slack: "\u{1F514}",
+    github: "\u{1F419}",
+    sentry: "\u{1FAB2}",
+    langfuse: "\u{1F52D}",
+    discord: "\u{1F4AC}",
+    linear: "\u{1F4D0}",
+    jira: "\u{1F5C2}\uFE0F",
+    cursor_cloud: "\u{1F5B1}\uFE0F",
+    claude_code_agent: "\u{1F916}"
+  };
+  console.log("\nIntegrations:\n");
+  for (const row of rows) {
+    const icon = icons[row.kind] ?? "\u{1F50C}";
+    const statusIcon = row.status === "ok" ? "\u2705" : row.status === "error" ? "\u274C" : "\u26AA";
+    console.log(`  ${icon}  ${row.kind.padEnd(20)} ${statusIcon}  ${row.detail ?? ""}`);
+  }
+  console.log();
+});
+integrations.command("test <kind>").description(
+  "Run a health probe for a specific integration (e.g. slack, sentry, github, langfuse, discord, cursor_cloud, claude_code_agent)"
+).option("--json", "Machine-readable output").action(async (kind, opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(2);
+  }
+  if (!config.projectId) {
+    console.error("No projectId. Run `mushi config projectId <uuid>`");
+    process.exit(2);
+  }
+  const result = await apiCall(
+    `/v1/admin/projects/${config.projectId}/integrations/probe/${kind}`,
+    config,
+    { method: "POST" }
+  );
+  if (!result.ok) {
+    console.error("Request failed:", result.error);
+    process.exit(1);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
+  }
+  const probeOk = result.data?.status === "ok";
+  console.log(
+    probeOk ? `\u2705  ${kind} integration is healthy${result.data.detail ? ": " + result.data.detail : ""}` : `\u274C  ${kind} integration check failed${result.data.detail ? ": " + result.data.detail : ""}`
+  );
+  if (!probeOk) process.exit(1);
+});
+var slack = program.command("slack").description("Slack integration commands");
+slack.command("status").description("Show whether Slack is connected and which channel receives notifications").option("--json", "Machine-readable output").action(async (opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(2);
+  }
+  if (!config.projectId) {
+    console.error("No projectId. Run `mushi config projectId <uuid>`");
+    process.exit(2);
+  }
+  const result = await apiCall(
+    `/v1/admin/projects/${config.projectId}/integrations/probe/slack`,
+    config,
+    { method: "POST" }
+  );
+  if (!result.ok) {
+    console.error("Request failed:", result.error);
+    process.exit(1);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
+  }
+  if (result.data?.status === "ok") {
+    console.log("\u2705  Slack connected");
+    if (result.data.detail) console.log(`    ${result.data.detail}`);
+    console.log("\n    To change the channel or notification prefs, visit /integrations in the Mushi console.");
+  } else {
+    console.log("\u26AA  Slack not connected");
+    console.log('    Visit /integrations in the Mushi console and click "Add to Slack".');
+  }
+});
+slack.command("test").description("Send a test Slack notification to confirm the current channel is working").option("--json", "Machine-readable output").action(async (opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(2);
+  }
+  if (!config.projectId) {
+    console.error("No projectId. Run `mushi config projectId <uuid>`");
+    process.exit(2);
+  }
+  const result = await apiCall(
+    `/v1/admin/projects/${config.projectId}/integrations/slack/test`,
+    config,
+    { method: "POST" }
+  );
+  if (!result.ok) {
+    console.error("Request failed:", result.error);
+    process.exit(1);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
+  }
+  if (result.data?.ok) {
+    console.log("\u2705  Test message sent! Check your Slack channel.");
+  } else {
+    console.error("\u274C  Test failed:", result.data?.error ?? "unknown error");
+    process.exit(1);
+  }
+});
+var qa = program.command("qa").description("QA story management");
+qa.command("stories").description("List QA stories for the current project").option("--json", "Machine-readable output").option("-n, --limit <n>", "Max stories to return (not applied server-side; all stories returned)", "20").action(async (opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(2);
+  }
+  if (!config.projectId) {
+    console.error("No projectId. Run `mushi config projectId <uuid>`");
+    process.exit(2);
+  }
+  const result = await apiCall(
+    `/v1/admin/projects/${config.projectId}/qa-coverage`,
+    config
+  );
+  if (!result.ok) {
+    console.error("Failed:", result.error);
+    process.exit(1);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
+  }
+  const stories2 = result.data?.coverage ?? [];
+  if (stories2.length === 0) {
+    console.log("No QA stories yet. Create one at /qa-coverage in the Mushi console.");
+    return;
+  }
+  console.log(`
+QA Stories (${stories2.length}):
+`);
+  for (const s of stories2) {
+    const statusIcon = s.last_run_status === "passed" ? "\u2705" : s.last_run_status === "failed" ? "\u274C" : s.last_run_status === "error" ? "\u{1F6A8}" : "\u26AA";
+    const enabled = s.enabled ? "" : " [disabled]";
+    const sid = s.story_id ?? s.id ?? "\u2014";
+    console.log(`  ${statusIcon}  ${s.name.slice(0, 50).padEnd(52)}  ${sid}${enabled}`);
+  }
+  console.log(`
+   Use 'mushi qa runs <storyId>' to see recent runs for a story.`);
+  console.log();
+});
+qa.command("runs <storyId>").description("Show recent runs for a QA story, including error heads").option("--json", "Machine-readable output").option("-n, --limit <n>", "Max runs to return", "10").action(async (storyId, opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(2);
+  }
+  if (!config.projectId) {
+    console.error("No projectId. Run `mushi config projectId <uuid>`");
+    process.exit(2);
+  }
+  const limit = parseInt(opts.limit ?? "10", 10);
+  const result = await apiCall(
+    `/v1/admin/projects/${config.projectId}/qa-stories/${storyId}/runs?limit=${limit}`,
+    config
+  );
+  if (!result.ok) {
+    console.error("Failed:", result.error);
+    process.exit(1);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
+  }
+  const runs = result.data?.runs ?? [];
+  if (runs.length === 0) {
+    console.log("No runs yet for this story. Trigger one with `mushi qa run <storyId>`.");
+    return;
+  }
+  console.log(`
+Recent runs for story ${storyId.slice(0, 8)}\u2026:
+`);
+  for (const r of runs) {
+    const statusIcon = r.status === "passed" ? "\u2705" : r.status === "failed" ? "\u274C" : r.status === "error" ? "\u{1F6A8}" : "\u23F3";
+    const ts = r.created_at ? new Date(r.created_at).toISOString().slice(0, 16).replace("T", " ") : "\u2014";
+    const latency = r.latency_ms ? ` (${(r.latency_ms / 1e3).toFixed(1)}s)` : "";
+    console.log(`  ${statusIcon}  ${ts}${latency}  ${r.id.slice(0, 8)}`);
+    if (r.error_message) {
+      console.log(`       Error: ${r.error_message.slice(0, 120)}`);
+    }
+    if (r.assertion_failures?.length) {
+      for (const af of r.assertion_failures.slice(0, 3)) {
+        console.log(`       \xB7 ${String(af).slice(0, 100)}`);
+      }
+    }
+  }
+  const consoleUrl = config.consoleUrl ?? "https://app.mushi.ai";
+  console.log(`
+   Open in console: ${consoleUrl}/qa-coverage?story=${storyId}`);
+  console.log(`   Tip: run 'mushi config consoleUrl http://localhost:6464' to set your local console URL`);
+  console.log();
+});
+qa.command("run <storyId>").description("Manually trigger a QA story run (fire-and-forget; check results with `mushi qa runs <id>`)").option("--json", "Machine-readable output").action(async (storyId, opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(2);
+  }
+  if (!config.projectId) {
+    console.error("No projectId. Run `mushi config projectId <uuid>`");
+    process.exit(2);
+  }
+  const result = await apiCall(
+    `/v1/admin/projects/${config.projectId}/qa-stories/${storyId}/run`,
+    config,
+    { method: "POST" }
+  );
+  if (!result.ok) {
+    console.error("Failed:", result.error);
+    process.exit(1);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
+  }
+  const runId = result.data?.run_id;
+  if (runId) {
+    console.log(`\u25B6  Run triggered: ${runId.slice(0, 8)}\u2026`);
+    console.log(`   Check results: mushi qa runs ${storyId}`);
+  } else {
+    console.error("\u274C  Trigger failed: no run_id in response", JSON.stringify(result.data));
+    process.exit(1);
+  }
+});
+program.command("audit").description("Run a full-stack health audit for the current project").option("--json", "Machine-readable JSON output").option("--project-id <id>", "Project ID to audit (defaults to MUSHI_PROJECT_ID from config)").addHelpText("after", `
+Description:
+  Fans out to the Mushi backend to run a full-stack health audit:
+    \u2022 DB schema + Supabase advisors (requires Supabase PAT in API Keys)
+    \u2022 Recent backend error logs
+    \u2022 Tables without RLS enabled
+    \u2022 Gate results: API contract (G3), spec drift (G6), orphan endpoints (G7),
+      unknown frontend calls (G8), schema drift, status claim (G5)
+
+  Returns a PM-readable scorecard with severity-ranked findings.
+
+  Prerequisites:
+    1. Configure your Supabase PAT: mushi settings set supabase-pat <token>
+    2. Set supabase_project_ref in Admin \u2192 Settings \u2192 Project.
+
+Examples:
+  mushi audit
+  mushi audit --json
+  mushi audit --project-id abc123`).action(async (opts) => {
+  const config = requireConfig();
+  const projectId = opts.projectId ?? config.projectId;
+  if (!projectId) {
+    process.stderr.write("error: project ID required. Run `mushi login` or pass --project-id\n");
+    process.exit(1);
+  }
+  const headers = {
+    "Content-Type": "application/json",
+    "X-Mushi-Project-Id": projectId
+  };
+  const jwt = config.jwt ?? null;
+  const apiKey = config.apiKey ?? null;
+  if (jwt) {
+    headers["Authorization"] = `Bearer ${jwt}`;
+  } else if (apiKey) {
+    headers["X-Mushi-Api-Key"] = apiKey;
+  } else {
+    process.stderr.write("error: no credentials found. Run `mushi login` first.\n");
+    process.exit(1);
+  }
+  if (!opts.json) process.stdout.write("Running full-stack audit\u2026 ");
+  try {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 3e4);
+    const res = await fetch(
+      `${config.endpoint}/v1/admin/projects/${projectId}/audit`,
+      { method: "POST", headers, body: "{}", signal: controller.signal }
+    );
+    clearTimeout(timer);
+    const body = await res.json();
+    if (!res.ok || !body.ok) {
+      if (opts.json) {
+        console.log(JSON.stringify(body));
+        process.exit(1);
+      }
+      process.stdout.write("FAIL\n");
+      process.stderr.write(`error: ${body.error?.message ?? `HTTP ${res.status}`}
+`);
+      process.exit(1);
+    }
+    if (opts.json) {
+      console.log(JSON.stringify(body.data, null, 2));
+      return;
+    }
+    const data = body.data;
+    const overallGlyph = data.summary.overall === "fail" ? "\u274C" : data.summary.overall === "warn" ? "\u26A0\uFE0F " : "\u2705";
+    process.stdout.write(`${overallGlyph}
+
+`);
+    console.log(`Full-Stack Audit \u2014 ${new Date(data.audit_at).toLocaleString()}`);
+    console.log(`Backend linked: ${data.backend_linked ? "yes" : "no (configure Supabase PAT + project ref)"}`);
+    console.log(`Summary: ${data.summary.error_count} error(s) \xB7 ${data.summary.warn_count} warning(s)
+`);
+    if (data.findings.length === 0) {
+      console.log("  \u2713 No findings. Your project looks healthy.");
+    } else {
+      for (const f of data.findings) {
+        const icon = f.severity === "error" ? "\u{1F534}" : f.severity === "warn" ? "\u{1F7E1}" : "\u2139\uFE0F ";
+        console.log(`  ${icon} ${f.title}`);
+        console.log(`     ${f.detail.slice(0, 120)}${f.detail.length > 120 ? "\u2026" : ""}`);
+      }
+    }
+    if (data.gate_runs.length > 0) {
+      console.log("\nGate Results:");
+      for (const run of data.gate_runs) {
+        const g = run.status === "pass" ? "\u2713" : run.status === "fail" ? "\u2717" : "~";
+        console.log(`  ${g} ${run.gate.padEnd(22)} ${run.status}  (${run.findings_count} finding${run.findings_count !== 1 ? "s" : ""})`);
+      }
+    }
+    if (data.summary.overall === "fail") process.exit(1);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (opts.json) {
+      console.log(JSON.stringify({ ok: false, error: msg }));
+    } else {
+      process.stdout.write("ERROR\n");
+      process.stderr.write(`error: ${msg}
+`);
+    }
+    process.exit(1);
+  }
+});
 program.parseAsync().catch((err) => {
   console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
   process.exit(1);

package/dist/init.js

@@ -8,7 +8,7 @@ import {
 } from "./chunk-NYPX5KXR.js";
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-IMDLL4EO.js";
+} from "./chunk-4W6VOIQT.js";
 
 // src/init.ts
 import * as p from "@clack/prompts";

package/dist/version.js

@@ -1,6 +1,6 @@
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-IMDLL4EO.js";
+} from "./chunk-4W6VOIQT.js";
 export {
   MUSHI_CLI_VERSION
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mushi-mushi/cli",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "license": "MIT",
   "description": "CLI for Mushi Mushi — `mushi init` wizard installs the right SDK for your framework, plus report triage and pipeline health commands",
   "bin": {

package/dist/chunk-IMDLL4EO.js

@@ -1,6 +0,0 @@
-// src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.13.0" : "0.0.0-dev";
-
-export {
-  MUSHI_CLI_VERSION
-};