@mushi-mushi/cli 0.13.0 → 0.15.0

package/dist/chunk-UTST6AEP.js

@@ -0,0 +1,6 @@
+// src/version.ts
+var MUSHI_CLI_VERSION = true ? "0.15.0" : "0.0.0-dev";
+
+export {
+  MUSHI_CLI_VERSION
+};

package/dist/index.js

@@ -598,7 +598,7 @@ function getFrameworkFromPkg(pkg) {
 }
 
 // src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.13.0" : "0.0.0-dev";
+var MUSHI_CLI_VERSION = true ? "0.15.0" : "0.0.0-dev";
 
 // src/init.ts
 var ENV_FILES = [".env.local", ".env"];
@@ -1088,6 +1088,49 @@ function runMigrate(opts = {}) {
   return { matches };
 }
 
+// src/sanitize-config.ts
+var PROJECT_ID_RE = /^(?:proj_[A-Za-z0-9_-]{10,}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
+var API_KEY_RE = /^mushi_[A-Za-z0-9_-]{10,}$/;
+function sanitizeApiKey(raw) {
+  const key = raw.replace(/[\r\n\0]/g, "");
+  if (!API_KEY_RE.test(key)) {
+    throw new Error(
+      "Invalid API key in config \u2014 run `mushi login --api-key <key>` to refresh credentials."
+    );
+  }
+  return key;
+}
+function sanitizeProjectId(raw) {
+  const id = raw.trim();
+  if (!PROJECT_ID_RE.test(id)) {
+    throw new Error(
+      "Invalid project ID in config \u2014 expected a UUID or proj_* slug from the admin console."
+    );
+  }
+  return id;
+}
+function sanitizeEndpoint(raw) {
+  return assertEndpoint(normalizeEndpoint(raw));
+}
+function sanitizeCliCredentials(config) {
+  if (!config.endpoint || !config.apiKey || !config.projectId) {
+    throw new Error("Missing endpoint, apiKey, or projectId");
+  }
+  return {
+    endpoint: sanitizeEndpoint(config.endpoint),
+    apiKey: sanitizeApiKey(config.apiKey),
+    projectId: sanitizeProjectId(config.projectId)
+  };
+}
+function apiKeyHeaders(apiKey, projectId) {
+  const headers = {
+    Authorization: `Bearer ${apiKey}`,
+    "X-Mushi-Api-Key": apiKey
+  };
+  if (projectId) headers["X-Mushi-Project"] = projectId;
+  return headers;
+}
+
 // src/sourcemaps.ts
 import { createReadStream } from "fs";
 import { readFile, readdir } from "fs/promises";
@@ -1430,12 +1473,11 @@ var IngestSetupHttpError = class extends Error {
 };
 var NON_RETRYABLE_STATUSES = /* @__PURE__ */ new Set([401, 403, 404]);
 async function fetchIngestSetup(config, doFetch = globalThis.fetch) {
-  const res = await doFetch(`${config.endpoint}/v1/sync/ingest-setup`, {
-    headers: {
-      Authorization: `Bearer ${config.apiKey}`,
-      "X-Mushi-Api-Key": config.apiKey,
-      ...config.projectId ? { "X-Mushi-Project": config.projectId } : {}
-    },
+  const endpoint = sanitizeEndpoint(config.endpoint);
+  const apiKey = sanitizeApiKey(config.apiKey);
+  const projectId = config.projectId ? sanitizeProjectId(config.projectId) : void 0;
+  const res = await doFetch(`${endpoint}/v1/sync/ingest-setup`, {
+    headers: apiKeyHeaders(apiKey, projectId),
     signal: AbortSignal.timeout(8e3)
   });
   if (!res.ok) {
@@ -1510,13 +1552,14 @@ function checkCliConfig(config) {
 }
 async function checkEndpointReachability(endpoint, doFetch = globalThis.fetch) {
   try {
-    const res = await doFetch(`${endpoint}/health`, {
+    const safeEndpoint = sanitizeEndpoint(endpoint);
+    const res = await doFetch(`${safeEndpoint}/health`, {
       signal: AbortSignal.timeout(5e3)
     });
     return {
       name: "Endpoint reachable",
       ok: res.status === 200,
-      detail: `GET ${endpoint}/health \u2192 ${res.status}`
+      detail: `GET ${safeEndpoint}/health \u2192 ${res.status}`
     };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -1558,14 +1601,11 @@ async function checkServerPreflight(config, doFetch = globalThis.fetch) {
     ];
   }
   try {
+    const { endpoint, apiKey, projectId } = sanitizeCliCredentials(config);
     const res = await doFetch(
-      `${config.endpoint}/v1/admin/projects/${config.projectId}/preflight`,
+      `${endpoint}/v1/admin/projects/${projectId}/preflight`,
       {
-        headers: {
-          Authorization: `Bearer ${config.apiKey}`,
-          "X-Mushi-Api-Key": config.apiKey,
-          "X-Mushi-Project": config.projectId
-        },
+        headers: apiKeyHeaders(apiKey, projectId),
         signal: AbortSignal.timeout(8e3)
       }
     );
@@ -1575,7 +1615,7 @@ async function checkServerPreflight(config, doFetch = globalThis.fetch) {
       return serverChecks.map((sc) => ({
         name: `[server] ${sc.label}`,
         ok: sc.ready,
-        detail: sc.hint
+        detail: sc.ready ? "" : sc.hint
       }));
     }
     const text2 = await res.text().catch(() => "");
@@ -1613,7 +1653,7 @@ async function checkIngestSetup(config, doFetch = globalThis.fetch) {
     const checks = steps.filter((s) => s.required).map((s) => ({
       name: `[ingest] ${s.label}`,
       ok: s.complete,
-      detail: s.hint ?? ""
+      detail: s.complete ? "" : s.hint ?? ""
     }));
     const diag = data.diagnostic;
     if (diag?.last_sdk_seen_at) {
@@ -1629,6 +1669,84 @@ async function checkIngestSetup(config, doFetch = globalThis.fetch) {
     return [{ name: "Ingest setup", ok: false, detail: `Fetch failed: ${msg}` }];
   }
 }
+async function checkQaStoriesHealth(config, doFetch = globalThis.fetch) {
+  if (!config.projectId || !config.apiKey || !config.endpoint) {
+    return [
+      {
+        name: "QA stories health",
+        ok: false,
+        detail: "Need projectId, apiKey, and endpoint for QA story checks."
+      }
+    ];
+  }
+  const checks = [];
+  try {
+    const { endpoint, apiKey, projectId } = sanitizeCliCredentials(config);
+    const headers = apiKeyHeaders(apiKey, projectId);
+    const storiesRes = await doFetch(
+      `${endpoint}/v1/admin/projects/${projectId}/qa-coverage`,
+      {
+        headers,
+        signal: AbortSignal.timeout(8e3)
+      }
+    );
+    if (!storiesRes.ok) {
+      checks.push({ name: "[qa] Fetch QA stories", ok: false, detail: `HTTP ${storiesRes.status}` });
+      return checks;
+    }
+    const storiesBody = await storiesRes.json();
+    const stories2 = storiesBody.data?.coverage ?? [];
+    const enabled = stories2.filter((s) => s.enabled);
+    if (enabled.length === 0) {
+      checks.push({ name: "[qa] Enabled QA stories", ok: true, detail: "No enabled stories \u2014 create one at /qa-coverage" });
+      return checks;
+    }
+    checks.push({
+      name: "[qa] Enabled QA stories",
+      ok: true,
+      detail: `${enabled.length} enabled story/stories configured`
+    });
+    const slackRes = await doFetch(
+      `${endpoint}/v1/admin/projects/${projectId}/integrations/probe/slack`,
+      {
+        method: "POST",
+        headers,
+        signal: AbortSignal.timeout(6e3)
+      }
+    );
+    const slackBody = slackRes.ok ? await slackRes.json() : null;
+    const slackOk = slackBody?.status === "ok";
+    checks.push({
+      name: "[qa] Slack notifications configured",
+      ok: slackOk,
+      detail: slackOk ? "Slack connected \u2014 failures will notify your channel" : "Slack not connected \u2014 you won't be notified when stories fail. Visit /integrations \u2192 Add to Slack."
+    });
+    const fcRes = await doFetch(
+      `${endpoint}/v1/admin/projects/${projectId}/integrations/probe/firecrawl`,
+      {
+        method: "POST",
+        headers,
+        signal: AbortSignal.timeout(6e3)
+      }
+    );
+    const fcBody = fcRes.ok ? await fcRes.json() : null;
+    const hasFirecrawlStories = enabled.some(
+      (s) => !s.browser_provider || s.browser_provider === "firecrawl_actions"
+    );
+    if (hasFirecrawlStories) {
+      const fcOk = fcBody?.status === "ok";
+      checks.push({
+        name: "[qa] Firecrawl API key configured",
+        ok: fcOk,
+        detail: fcOk ? "Firecrawl key is resolvable \u2014 stories will run without Unauthorized errors" : "No Firecrawl key found \u2014 enabled stories using firecrawl_actions will 401. Add a key at /integrations \u2192 BYOK keys."
+      });
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    checks.push({ name: "[qa] QA stories health", ok: false, detail: `Fetch failed: ${msg}` });
+  }
+  return checks;
+}
 async function runDoctor(config, options = {}) {
   const doFetch = options.fetch ?? globalThis.fetch;
   const checks = [];
@@ -1646,6 +1764,10 @@ async function runDoctor(config, options = {}) {
     const ingestChecks = await checkIngestSetup(config, doFetch);
     checks.push(...ingestChecks);
   }
+  if (options.qaStories) {
+    const qaChecks = await checkQaStoriesHealth(config, doFetch);
+    checks.push(...qaChecks);
+  }
   return { checks, ready: checks.every((c) => c.ok) };
 }
 function formatDoctorResult(result) {
@@ -1654,7 +1776,7 @@ function formatDoctorResult(result) {
   const lines = [];
   for (const c of result.checks) {
     lines.push(`${c.ok ? PASS : FAIL} ${c.name}`);
-    lines.push(`  ${c.detail}`);
+    if (c.detail) lines.push(`  ${c.detail}`);
   }
   const failed = result.checks.filter((c) => !c.ok);
   if (failed.length === 0) {
@@ -1763,7 +1885,6 @@ async function runUpgrade(opts = {}) {
 
 // src/connect.ts
 import { appendFile, mkdir, readFile as readFile2, writeFile } from "fs/promises";
-import { existsSync as existsSync5 } from "fs";
 import { join as join6, resolve as resolve3 } from "path";
 function envKeyPresent(content, key) {
   const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -1774,11 +1895,15 @@ async function mergeEnvFile(path, lines) {
 # Mushi \u2014 added by mushi connect
 ${lines.join("\n")}
 `;
-  if (existsSync5(path)) {
-    const content = await readFile2(path, "utf8");
+  let existing = null;
+  try {
+    existing = await readFile2(path, "utf8");
+  } catch {
+  }
+  if (existing !== null) {
     const needs = lines.filter((line) => {
       const key = line.split("=")[0];
-      return !envKeyPresent(content, key);
+      return !envKeyPresent(existing, key);
     });
     if (needs.length === 0) return false;
     await appendFile(path, `
@@ -1793,13 +1918,17 @@ ${needs.join("\n")}
 async function ensureMcpJsonGitignored(cwd, messages) {
   const gitignorePath = join6(cwd, ".gitignore");
   const patterns = [".cursor/mcp.json", ".cursor/"];
-  if (!existsSync5(gitignorePath)) {
+  let content = null;
+  try {
+    content = await readFile2(gitignorePath, "utf8");
+  } catch {
+  }
+  if (content === null) {
     messages.push(
       "\u26A0 No .gitignore found \u2014 .cursor/mcp.json contains your API key. Add `.cursor/mcp.json` before committing."
     );
     return;
   }
-  const content = await readFile2(gitignorePath, "utf8");
   const covered = patterns.some((p3) => content.split("\n").some((line) => line.trim() === p3 || line.trim() === `${p3}/`));
   if (covered) return;
   await appendFile(gitignorePath, "\n# Mushi \u2014 keep MCP credentials out of git\n.cursor/mcp.json\n", "utf8");
@@ -1843,11 +1972,9 @@ async function runConnect(opts, baseConfig = {}) {
       }
     };
     let merged = { mcpServers: {} };
-    if (existsSync5(mcpPath)) {
-      try {
-        merged = JSON.parse(await readFile2(mcpPath, "utf8"));
-      } catch {
-      }
+    try {
+      merged = JSON.parse(await readFile2(mcpPath, "utf8"));
+    } catch {
     }
     const servers = merged.mcpServers ?? {};
     servers[serverName] = mcpServerBlock;
@@ -2139,7 +2266,7 @@ Examples:
   mushi config endpoint https://...   # set endpoint
   mushi config projectId <uuid>       # set project`).action((key, value) => {
   const config = loadConfig();
-  const ALLOWED_KEYS = /* @__PURE__ */ new Set(["apiKey", "endpoint", "projectId"]);
+  const ALLOWED_KEYS = /* @__PURE__ */ new Set(["apiKey", "endpoint", "projectId", "consoleUrl"]);
   if (key && value) {
     if (!ALLOWED_KEYS.has(key)) {
       process.stderr.write(`error: unknown config key "${key}". Allowed: ${[...ALLOWED_KEYS].join(", ")}
@@ -2644,7 +2771,7 @@ Typical first-time flow:
   # CLI writes .env.local and .cursor/mcp.json
   # mushi whoami to confirm`).action(async (opts) => {
   const { writeFile: writeFile2, mkdir: mkdir2 } = await import("fs/promises");
-  const { existsSync: existsSync6 } = await import("fs");
+  const { existsSync: existsSync5 } = await import("fs");
   const nodePath = await import("path");
   const endpoint = opts.endpoint ?? loadConfig().endpoint ?? "https://api.mushimushi.dev";
   const signUpUrl = "https://kensaur.us/mushi-mushi/sign-up";
@@ -2691,7 +2818,7 @@ Typical first-time flow:
     `MUSHI_API_KEY=${apiKey}`,
     ""
   ];
-  const envExisting = existsSync6(envPath);
+  const envExisting = existsSync5(envPath);
   await writeFile2(envPath, envLines.join("\n"), "utf8");
   console.log(`
   \u2713 ${envExisting ? "Updated" : "Created"} .env.local`);
@@ -2711,7 +2838,7 @@ Typical first-time flow:
       }
     }
   };
-  const mcpExisting = existsSync6(mcpPath);
+  const mcpExisting = existsSync5(mcpPath);
   if (mcpExisting) {
     try {
       const { readFile: readFile3 } = await import("fs/promises");
@@ -2745,7 +2872,7 @@ Supported IDEs:
 
 The command reads credentials from ~/.mushirc (run \`mushi login\` first).`).action(async (opts) => {
   const { writeFile: writeFile2, mkdir: mkdir2, readFile: readFile3 } = await import("fs/promises");
-  const { existsSync: existsSync6 } = await import("fs");
+  const { existsSync: existsSync5 } = await import("fs");
   const nodePath = await import("path");
   const os = await import("os");
   const config = requireConfig({ needsProject: true });
@@ -2777,7 +2904,7 @@ The command reads credentials from ~/.mushirc (run \`mushi login\` first).`).act
   const configPath = nodePath.join(configDir, ideEntry.file);
   if (ideEntry.format === "mcp-json") {
     let merged = { mcpServers: {} };
-    if (existsSync6(configPath)) {
+    if (existsSync5(configPath)) {
       try {
         const raw = await readFile3(configPath, "utf8");
         merged = JSON.parse(raw);
@@ -2798,7 +2925,7 @@ The command reads credentials from ~/.mushirc (run \`mushi login\` first).`).act
     }
   } else if (ideEntry.format === "zed") {
     let settings = {};
-    if (existsSync6(configPath)) {
+    if (existsSync5(configPath)) {
       try {
         const raw = await readFile3(configPath, "utf8");
         settings = JSON.parse(raw);
@@ -3059,9 +3186,12 @@ program.command("doctor").description(
 ).option(
   "--ingest",
   "Also call GET /v1/sync/ingest-setup for the 4 required ingest steps (API key, SDK heartbeat, first report). Composable with --server."
+).option(
+  "--qa-stories",
+  "Check enabled QA stories for common setup issues: missing Firecrawl key, missing target URL, Slack not connected. Requires --server credentials."
 ).action(async (opts) => {
   const config = loadConfig();
-  const result = await runDoctor(config, { cwd: opts.cwd, server: opts.server, ingest: opts.ingest });
+  const result = await runDoctor(config, { cwd: opts.cwd, server: opts.server, ingest: opts.ingest, qaStories: opts.qaStories });
   const { checks } = result;
   if (opts.json) {
     console.log(JSON.stringify({ checks, ready: result.ready }, null, 2));
@@ -3373,7 +3503,636 @@ keys.command("add").description("Add a new API key to the pool").requiredOption(
   }
   console.log(`\u2713 Key added \u2014 id: ${res.data.id}`);
 });
+var integrations = program.command("integrations").description("Manage service integrations");
+integrations.command("list").description("List all configured integrations and their current health status").option("--json", "Machine-readable output").action(async (opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(2);
+  }
+  if (!config.projectId) {
+    console.error("No projectId. Run `mushi config projectId <uuid>`");
+    process.exit(2);
+  }
+  const result = await apiCall(
+    `/v1/admin/projects/${config.projectId}/integrations`,
+    config
+  );
+  const rawResult = result;
+  if (!rawResult.integrations && !result.ok) {
+    console.error("Failed:", result.error);
+    process.exit(1);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(rawResult, null, 2));
+    return;
+  }
+  const rows = rawResult.integrations ?? [];
+  if (rows.length === 0) {
+    console.log("No integrations configured. Visit the Integrations page to connect services.");
+    return;
+  }
+  const icons = {
+    slack: "\u{1F514}",
+    github: "\u{1F419}",
+    sentry: "\u{1FAB2}",
+    langfuse: "\u{1F52D}",
+    discord: "\u{1F4AC}",
+    linear: "\u{1F4D0}",
+    jira: "\u{1F5C2}\uFE0F",
+    cursor_cloud: "\u{1F5B1}\uFE0F",
+    claude_code_agent: "\u{1F916}"
+  };
+  console.log("\nIntegrations:\n");
+  for (const row of rows) {
+    const icon = icons[row.kind] ?? "\u{1F50C}";
+    const statusIcon = row.status === "ok" ? "\u2705" : row.status === "error" ? "\u274C" : "\u26AA";
+    console.log(`  ${icon}  ${row.kind.padEnd(20)} ${statusIcon}  ${row.detail ?? ""}`);
+  }
+  console.log();
+});
+integrations.command("test <kind>").description(
+  "Run a health probe for a specific integration (e.g. slack, sentry, github, langfuse, discord, cursor_cloud, claude_code_agent)"
+).option("--json", "Machine-readable output").action(async (kind, opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(2);
+  }
+  if (!config.projectId) {
+    console.error("No projectId. Run `mushi config projectId <uuid>`");
+    process.exit(2);
+  }
+  const result = await apiCall(
+    `/v1/admin/projects/${config.projectId}/integrations/probe/${kind}`,
+    config,
+    { method: "POST" }
+  );
+  if (!result.ok) {
+    console.error("Request failed:", result.error);
+    process.exit(1);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
+  }
+  const probeOk = result.data?.status === "ok";
+  console.log(
+    probeOk ? `\u2705  ${kind} integration is healthy${result.data.detail ? ": " + result.data.detail : ""}` : `\u274C  ${kind} integration check failed${result.data.detail ? ": " + result.data.detail : ""}`
+  );
+  if (!probeOk) process.exit(1);
+});
+var slack = program.command("slack").description("Slack integration commands");
+slack.command("status").description("Show whether Slack is connected and which channel receives notifications").option("--json", "Machine-readable output").action(async (opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(2);
+  }
+  if (!config.projectId) {
+    console.error("No projectId. Run `mushi config projectId <uuid>`");
+    process.exit(2);
+  }
+  const result = await apiCall(
+    `/v1/admin/projects/${config.projectId}/integrations/probe/slack`,
+    config,
+    { method: "POST" }
+  );
+  if (!result.ok) {
+    console.error("Request failed:", result.error);
+    process.exit(1);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
+  }
+  if (result.data?.status === "ok") {
+    console.log("\u2705  Slack connected");
+    if (result.data.detail) console.log(`    ${result.data.detail}`);
+    console.log("\n    To change the channel or notification prefs, visit /integrations in the Mushi console.");
+  } else {
+    console.log("\u26AA  Slack not connected");
+    console.log('    Visit /integrations in the Mushi console and click "Add to Slack".');
+  }
+});
+slack.command("test").description("Send a test Slack notification to confirm the current channel is working").option("--json", "Machine-readable output").action(async (opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(2);
+  }
+  if (!config.projectId) {
+    console.error("No projectId. Run `mushi config projectId <uuid>`");
+    process.exit(2);
+  }
+  const result = await apiCall(
+    `/v1/admin/projects/${config.projectId}/integrations/slack/test`,
+    config,
+    { method: "POST" }
+  );
+  if (!result.ok) {
+    console.error("Request failed:", result.error);
+    process.exit(1);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
+  }
+  if (result.data?.ok) {
+    console.log("\u2705  Test message sent! Check your Slack channel.");
+  } else {
+    console.error("\u274C  Test failed:", result.data?.error ?? "unknown error");
+    process.exit(1);
+  }
+});
+var qa = program.command("qa").description("QA story management");
+qa.command("stories").description("List QA stories for the current project").option("--json", "Machine-readable output").option("-n, --limit <n>", "Max stories to return (not applied server-side; all stories returned)", "20").action(async (opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(2);
+  }
+  if (!config.projectId) {
+    console.error("No projectId. Run `mushi config projectId <uuid>`");
+    process.exit(2);
+  }
+  const result = await apiCall(
+    `/v1/admin/projects/${config.projectId}/qa-coverage`,
+    config
+  );
+  if (!result.ok) {
+    console.error("Failed:", result.error);
+    process.exit(1);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
+  }
+  const stories2 = result.data?.coverage ?? [];
+  if (stories2.length === 0) {
+    console.log("No QA stories yet. Create one at /qa-coverage in the Mushi console.");
+    return;
+  }
+  console.log(`
+QA Stories (${stories2.length}):
+`);
+  for (const s of stories2) {
+    const statusIcon = s.last_run_status === "passed" ? "\u2705" : s.last_run_status === "failed" ? "\u274C" : s.last_run_status === "error" ? "\u{1F6A8}" : "\u26AA";
+    const enabled = s.enabled ? "" : " [disabled]";
+    const sid = s.story_id ?? s.id ?? "\u2014";
+    console.log(`  ${statusIcon}  ${s.name.slice(0, 50).padEnd(52)}  ${sid}${enabled}`);
+  }
+  console.log(`
+   Use 'mushi qa runs <storyId>' to see recent runs for a story.`);
+  console.log();
+});
+qa.command("runs <storyId>").description("Show recent runs for a QA story, including error heads").option("--json", "Machine-readable output").option("-n, --limit <n>", "Max runs to return", "10").action(async (storyId, opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(2);
+  }
+  if (!config.projectId) {
+    console.error("No projectId. Run `mushi config projectId <uuid>`");
+    process.exit(2);
+  }
+  const limit = parseInt(opts.limit ?? "10", 10);
+  const result = await apiCall(
+    `/v1/admin/projects/${config.projectId}/qa-stories/${storyId}/runs?limit=${limit}`,
+    config
+  );
+  if (!result.ok) {
+    console.error("Failed:", result.error);
+    process.exit(1);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
+  }
+  const runs = result.data?.runs ?? [];
+  if (runs.length === 0) {
+    console.log("No runs yet for this story. Trigger one with `mushi qa run <storyId>`.");
+    return;
+  }
+  console.log(`
+Recent runs for story ${storyId.slice(0, 8)}\u2026:
+`);
+  for (const r of runs) {
+    const statusIcon = r.status === "passed" ? "\u2705" : r.status === "failed" ? "\u274C" : r.status === "error" ? "\u{1F6A8}" : "\u23F3";
+    const ts = r.created_at ? new Date(r.created_at).toISOString().slice(0, 16).replace("T", " ") : "\u2014";
+    const latency = r.latency_ms ? ` (${(r.latency_ms / 1e3).toFixed(1)}s)` : "";
+    console.log(`  ${statusIcon}  ${ts}${latency}  ${r.id.slice(0, 8)}`);
+    if (r.error_message) {
+      console.log(`       Error: ${r.error_message.slice(0, 120)}`);
+    }
+    if (r.assertion_failures?.length) {
+      for (const af of r.assertion_failures.slice(0, 3)) {
+        console.log(`       \xB7 ${String(af).slice(0, 100)}`);
+      }
+    }
+  }
+  const consoleUrl = config.consoleUrl ?? "https://app.mushi.ai";
+  console.log(`
+   Open in console: ${consoleUrl}/qa-coverage?story=${storyId}`);
+  console.log(`   Tip: run 'mushi config consoleUrl http://localhost:6464' to set your local console URL`);
+  console.log();
+});
+qa.command("run <storyId>").description("Manually trigger a QA story run (fire-and-forget; check results with `mushi qa runs <id>`)").option("--json", "Machine-readable output").action(async (storyId, opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(2);
+  }
+  if (!config.projectId) {
+    console.error("No projectId. Run `mushi config projectId <uuid>`");
+    process.exit(2);
+  }
+  const result = await apiCall(
+    `/v1/admin/projects/${config.projectId}/qa-stories/${storyId}/run`,
+    config,
+    { method: "POST" }
+  );
+  if (!result.ok) {
+    console.error("Failed:", result.error);
+    process.exit(1);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
+  }
+  const runId = result.data?.run_id;
+  if (runId) {
+    console.log(`\u25B6  Run triggered: ${runId.slice(0, 8)}\u2026`);
+    console.log(`   Check results: mushi qa runs ${storyId}`);
+  } else {
+    console.error("\u274C  Trigger failed: no run_id in response", JSON.stringify(result.data));
+    process.exit(1);
+  }
+});
+program.command("audit").description("Run a full-stack health audit for the current project").option("--json", "Machine-readable JSON output").option("--project-id <id>", "Project ID to audit (defaults to MUSHI_PROJECT_ID from config)").addHelpText("after", `
+Description:
+  Fans out to the Mushi backend to run a full-stack health audit:
+    \u2022 DB schema + Supabase advisors (requires Supabase PAT in API Keys)
+    \u2022 Recent backend error logs
+    \u2022 Tables without RLS enabled
+    \u2022 Gate results: API contract (G3), spec drift (G6), orphan endpoints (G7),
+      unknown frontend calls (G8), schema drift, status claim (G5)
+
+  Returns a PM-readable scorecard with severity-ranked findings.
+
+  Prerequisites:
+    1. Configure your Supabase PAT: mushi settings set supabase-pat <token>
+    2. Set supabase_project_ref in Admin \u2192 Settings \u2192 Project.
+
+Examples:
+  mushi audit
+  mushi audit --json
+  mushi audit --project-id abc123`).action(async (opts) => {
+  const config = requireConfig();
+  const rawProjectId = opts.projectId ?? config.projectId;
+  if (!rawProjectId) {
+    process.stderr.write("error: project ID required. Run `mushi login` or pass --project-id\n");
+    process.exit(1);
+  }
+  let endpoint;
+  let projectId;
+  try {
+    endpoint = sanitizeEndpoint(config.endpoint);
+    projectId = sanitizeProjectId(rawProjectId);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`error: ${msg}
+`);
+    process.exit(2);
+  }
+  const headers = {
+    "Content-Type": "application/json",
+    "X-Mushi-Project-Id": projectId
+  };
+  const jwt = config.jwt ?? null;
+  const apiKey = config.apiKey ?? null;
+  if (jwt) {
+    headers["Authorization"] = `Bearer ${jwt.replace(/[\r\n\0]/g, "")}`;
+  } else if (apiKey) {
+    headers["X-Mushi-Api-Key"] = sanitizeApiKey(apiKey);
+  } else {
+    process.stderr.write("error: no credentials found. Run `mushi login` first.\n");
+    process.exit(1);
+  }
+  if (!opts.json) process.stdout.write("Running full-stack audit\u2026 ");
+  try {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 3e4);
+    const res = await fetch(
+      `${endpoint}/v1/admin/projects/${projectId}/audit`,
+      { method: "POST", headers, body: "{}", signal: controller.signal }
+    );
+    clearTimeout(timer);
+    const body = await res.json();
+    if (!res.ok || !body.ok) {
+      if (opts.json) {
+        console.log(JSON.stringify(body));
+        process.exit(1);
+      }
+      process.stdout.write("FAIL\n");
+      process.stderr.write(`error: ${body.error?.message ?? `HTTP ${res.status}`}
+`);
+      process.exit(1);
+    }
+    if (opts.json) {
+      console.log(JSON.stringify(body.data, null, 2));
+      return;
+    }
+    const data = body.data;
+    const overallGlyph = data.summary.overall === "fail" ? "\u274C" : data.summary.overall === "warn" ? "\u26A0\uFE0F " : "\u2705";
+    process.stdout.write(`${overallGlyph}
+
+`);
+    console.log(`Full-Stack Audit \u2014 ${new Date(data.audit_at).toLocaleString()}`);
+    console.log(`Backend linked: ${data.backend_linked ? "yes" : "no (configure Supabase PAT + project ref)"}`);
+    console.log(`Summary: ${data.summary.error_count} error(s) \xB7 ${data.summary.warn_count} warning(s)
+`);
+    if (data.findings.length === 0) {
+      console.log("  \u2713 No findings. Your project looks healthy.");
+    } else {
+      for (const f of data.findings) {
+        const icon = f.severity === "error" ? "\u{1F534}" : f.severity === "warn" ? "\u{1F7E1}" : "\u2139\uFE0F ";
+        console.log(`  ${icon} ${f.title}`);
+        console.log(`     ${f.detail.slice(0, 120)}${f.detail.length > 120 ? "\u2026" : ""}`);
+      }
+    }
+    if (data.gate_runs.length > 0) {
+      console.log("\nGate Results:");
+      for (const run of data.gate_runs) {
+        const g = run.status === "pass" ? "\u2713" : run.status === "fail" ? "\u2717" : "~";
+        console.log(`  ${g} ${run.gate.padEnd(22)} ${run.status}  (${run.findings_count} finding${run.findings_count !== 1 ? "s" : ""})`);
+      }
+    }
+    if (data.summary.overall === "fail") process.exit(1);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (opts.json) {
+      console.log(JSON.stringify({ ok: false, error: msg }));
+    } else {
+      process.stdout.write("ERROR\n");
+      process.stderr.write(`error: ${msg}
+`);
+    }
+    process.exit(1);
+  }
+});
 program.parseAsync().catch((err) => {
   console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
   process.exit(1);
 });
+var skills = program.command("skills").description("Manage agent skill catalog");
+skills.command("list").description("List all skills in the catalog").option("--category <cat>", "Filter by category (workflow, debug, test, audit, \u2026)").option("--search <q>", "Search slug, title, or description").option("--page <n>", "Page number (default 1)", "1").option("--limit <n>", "Max results per page (1\u2013200, default 200)", "200").option("--json", "Machine-readable output").action(async (opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(2);
+  }
+  const qs = new URLSearchParams();
+  if (opts.category) qs.set("category", opts.category);
+  if (opts.search) qs.set("q", opts.search);
+  qs.set("page", String(Math.max(1, parseInt(opts.page) || 1)));
+  qs.set("limit", String(Math.min(Math.max(1, parseInt(opts.limit) || 200), 200)));
+  const result = await apiCall(
+    `/v1/admin/skills?${qs}`,
+    config
+  );
+  if (!result.ok) {
+    console.error("Failed:", result.error);
+    process.exit(1);
+  }
+  const rows = result.data ?? [];
+  if (opts.json) {
+    console.log(JSON.stringify({ skills: rows, count: rows.length }, null, 2));
+    return;
+  }
+  if (rows.length === 0) {
+    console.log("No skills in catalog. Add a source with `mushi skills sync`.");
+    return;
+  }
+  console.log(`
+Skill catalog (${rows.length} skills):
+`);
+  let lastCat = "";
+  for (const s of rows) {
+    if (s.category !== lastCat) {
+      lastCat = s.category;
+      console.log(`
+  [${s.category}]`);
+    }
+    const chain = s.chain_slugs?.length ? ` \u2192 ${s.chain_slugs.length} steps` : "";
+    console.log(`    ${s.slug.padEnd(40)} ${s.title}${chain}`);
+  }
+  console.log();
+});
+skills.command("show <slug>").description("Show full details and chain for a skill").action(async (slug) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(2);
+  }
+  const result = await apiCall(`/v1/admin/skills/${slug}`, config);
+  if (!result.ok) {
+    console.error("Skill not found:", slug);
+    process.exit(1);
+  }
+  const s = result.data;
+  console.log(`
+${s.title} (${s.slug})
+${"\u2500".repeat(50)}`);
+  console.log(`Category:  ${s.category}`);
+  console.log(`Chain:     ${s.chain_slugs?.length ? s.chain_slugs.join(" \u2192 ") : "none"}`);
+  console.log(`
+Description:
+  ${s.description}
+`);
+});
+skills.command("sync").description("Trigger skill sync for all configured skill sources").option("--source-id <id>", "Sync only a specific source ID").action(async (opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(2);
+  }
+  if (!config.projectId) {
+    console.error("No projectId. Run `mushi config projectId <uuid>`");
+    process.exit(2);
+  }
+  let ids;
+  if (opts.sourceId) {
+    ids = [opts.sourceId];
+  } else {
+    const sourcesResult = await apiCall(
+      `/v1/admin/skills/sources?project_id=${config.projectId}`,
+      config
+    );
+    if (!sourcesResult.ok) {
+      console.error("Failed to list sources:", sourcesResult.error);
+      process.exit(1);
+    }
+    ids = (sourcesResult.data ?? []).map((s) => s.id);
+  }
+  if (ids.length === 0) {
+    console.log("No skill sources configured. Add one in the Skill Pipelines console page.");
+    return;
+  }
+  for (const id of ids) {
+    console.log(`Syncing source ${id.slice(0, 8)}\u2026`);
+    const result = await apiCall(
+      `/v1/admin/skills/sources/${id}/sync`,
+      config,
+      { method: "POST" }
+    );
+    if (!result.ok) {
+      console.error("  Sync failed:", result.error);
+    } else console.log(`  Done: ${result.data?.synced ?? 0} synced, ${result.data?.skipped ?? 0} skipped, ${result.data?.errors ?? 0} errors`);
+  }
+  console.log();
+});
+var pipeline = program.command("pipeline").description("Manage skill pipeline runs");
+pipeline.command("start <reportId>").description("Start a skill pipeline for a report").requiredOption("--skill <slug>", "Root skill slug (e.g. workflow-fix-and-ship)").option("--mode <mode>", "Execution mode: handoff (default) or cloud", "handoff").option("--json", "Machine-readable output").action(async (reportId, opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(2);
+  }
+  if (!config.projectId) {
+    console.error("No projectId. Run `mushi config projectId <uuid>`");
+    process.exit(2);
+  }
+  const result = await apiCall(
+    `/v1/admin/skills/pipelines`,
+    config,
+    {
+      method: "POST",
+      body: JSON.stringify({
+        project_id: config.projectId,
+        root_skill_slug: opts.skill,
+        report_id: reportId,
+        mode: opts.mode
+      })
+    }
+  );
+  if (!result.ok) {
+    console.error("Failed:", result.error);
+    process.exit(1);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
+  }
+  const runId = result.data?.id ?? "";
+  const chain = result.data?.chain_slugs ?? [];
+  console.log(`
+Pipeline started!
+`);
+  console.log(`  Run ID:  ${runId.slice(0, 8)}\u2026  (full: ${runId})`);
+  console.log(`  Skill:   ${opts.skill}`);
+  console.log(`  Chain:   ${chain.length > 0 ? chain.join(" \u2192 ") : "(root only)"}`);
+  console.log(`  Mode:    ${opts.mode}`);
+  if (opts.mode === "handoff") {
+    console.log(`
+  Get context packet:  mushi pipeline watch ${runId.slice(0, 8)}`);
+    console.log(`  Check in step 0:     mushi pipeline checkin ${runId.slice(0, 8)} --step 0 --status passed`);
+  }
+  console.log();
+});
+pipeline.command("watch <runIdOrPrefix>").description("Watch a pipeline run and print the context packet").option("--json", "Machine-readable output").action(async (runIdOrPrefix, opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(2);
+  }
+  let runId = runIdOrPrefix;
+  if (runIdOrPrefix.length < 36) {
+    const list = await apiCall(
+      `/v1/admin/skills/pipelines?project_id=${config.projectId}&limit=50`,
+      config
+    );
+    if (!list.ok) {
+      console.error("Failed:", list.error);
+      process.exit(1);
+    }
+    const match = list.data.find((r) => r.id.startsWith(runIdOrPrefix));
+    if (!match) {
+      console.error("Run not found:", runIdOrPrefix);
+      process.exit(1);
+    }
+    runId = match.id;
+  }
+  const result = await apiCall(
+    `/v1/admin/skills/pipelines/${runId}`,
+    config
+  );
+  if (!result.ok) {
+    console.error("Failed:", result.error);
+    process.exit(1);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
+  }
+  const run = result.data;
+  const statusIcon = run.status === "completed" ? "\u2705" : run.status === "failed" ? "\u274C" : run.status === "running" ? "\u23F3" : "\u26AA";
+  console.log(`
+${statusIcon}  Pipeline ${runId.slice(0, 8)} \xB7 ${run.root_skill_slug} \xB7 ${run.mode}
+`);
+  const steps = run.steps ?? [];
+  for (const step of steps) {
+    const icon = step.status === "passed" ? "\u2705" : step.status === "failed" ? "\u274C" : step.status === "running" ? "\u23F3" : "\u26AA";
+    const pr = step.pr_url ? ` \u2192 ${step.pr_url}` : "";
+    console.log(`  ${icon} Step ${step.step_index + 1}: ${step.skill_slug}${pr}`);
+    if (step.notes) console.log(`        ${step.notes}`);
+  }
+  if (run.context_packet) {
+    console.log(`
+${"\u2500".repeat(60)}`);
+    console.log(`Context Packet (paste into your Cursor agent):
+`);
+    console.log(run.context_packet.slice(0, 6e3));
+    if (run.context_packet.length > 6e3) console.log("\n\u2026 [truncated \u2014 full packet via --json]");
+  }
+  console.log();
+});
+pipeline.command("checkin <runIdOrPrefix>").description("Check in a pipeline step (CLI agent reports status after completing a step)").requiredOption("--step <n>", "Step index (0-based)", parseInt).requiredOption("--status <status>", "Step status: passed | failed | running | skipped").option("--notes <text>", "Optional notes / output summary").option("--pr-url <url>", "PR URL opened during this step").action(async (runIdOrPrefix, opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(2);
+  }
+  let runId = runIdOrPrefix;
+  if (runIdOrPrefix.length < 36) {
+    const list = await apiCall(
+      `/v1/admin/skills/pipelines?project_id=${config.projectId}&limit=50`,
+      config
+    );
+    if (!list.ok) {
+      console.error("Failed:", list.error);
+      process.exit(1);
+    }
+    const match = list.data.find((r) => r.id.startsWith(runIdOrPrefix));
+    if (!match) {
+      console.error("Run not found:", runIdOrPrefix);
+      process.exit(1);
+    }
+    runId = match.id;
+  }
+  const result = await apiCall(
+    `/v1/admin/skills/pipelines/${runId}/steps/${opts.step}/checkin`,
+    config,
+    {
+      method: "POST",
+      body: JSON.stringify({ status: opts.status, notes: opts.notes, pr_url: opts.prUrl })
+    }
+  );
+  if (!result.ok) {
+    console.error("Failed:", result.error);
+    process.exit(1);
+  }
+  console.log(`  Step ${opts.step} \u2192 ${opts.status}. Console live flow updated.`);
+  console.log(`  Next: mushi pipeline watch ${runId.slice(0, 8)}`);
+  console.log();
+});

package/dist/init.js

@@ -8,7 +8,7 @@ import {
 } from "./chunk-NYPX5KXR.js";
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-IMDLL4EO.js";
+} from "./chunk-UTST6AEP.js";
 
 // src/init.ts
 import * as p from "@clack/prompts";

package/dist/version.js

@@ -1,6 +1,6 @@
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-IMDLL4EO.js";
+} from "./chunk-UTST6AEP.js";
 export {
   MUSHI_CLI_VERSION
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mushi-mushi/cli",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "license": "MIT",
   "description": "CLI for Mushi Mushi — `mushi init` wizard installs the right SDK for your framework, plus report triage and pipeline health commands",
   "bin": {

package/dist/chunk-IMDLL4EO.js

@@ -1,6 +0,0 @@
-// src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.13.0" : "0.0.0-dev";
-
-export {
-  MUSHI_CLI_VERSION
-};