@mushi-mushi/cli 0.14.0 → 0.16.0

package/README.md

@@ -215,6 +215,77 @@ mushi fixes tail --report-id 11111111-2222-3333-4444-555555555555
 Exits automatically when the job reaches a terminal status (`completed`,
 `failed`, `cancelled`, `skipped`).
 
+### `mushi fixes merge <fixId>`
+
+Squash-merge (or merge/rebase) the fix PR on GitHub and run the same post-merge
+bookkeeping as the admin console: `merged_at`, report → **Fixed**, reporter
+notification, `fix.applied` webhooks.
+
+```bash
+mushi fixes merge 75199dde-f726-404a-b5f7-be17bf7a3a46
+mushi fixes merge <fixId> --method squash    # default
+mushi fixes merge <fixId> --method merge
+mushi fixes merge <fixId> --method rebase
+mushi fixes merge <fixId> --json
+```
+
+Requires an admin API key with `mcp:write` scope and a connected GitHub App or PAT.
+Draft PRs are auto-readied via GraphQL before merge.
+
+### `mushi fixes refresh-ci <fixId>`
+
+Pull the latest GitHub Actions check-run status on demand (same as **Refresh CI
+status** in the console). Useful when webhooks drop or you just pushed to the PR
+branch.
+
+```bash
+mushi fixes refresh-ci <fixId>
+mushi fixes refresh-ci <fixId> --json
+```
+
+---
+
+## QA coverage & TDD
+
+```bash
+mushi stories map --url https://your-app.com --wait
+mushi tdd gen <storyId> --mode review
+mushi tdd pending
+mushi tdd approve <qaStoryId>
+mushi tdd improve
+mushi qa stories
+mushi qa runs <storyId>
+mushi qa run <storyId>
+mushi qa audit
+```
+
+---
+
+## Skill pipelines
+
+```bash
+mushi skills list [--category workflow] [--search "fix"]
+mushi skills show workflow-fix-and-ship
+mushi skills sync
+
+mushi pipeline start <reportId> --skill workflow-fix-and-ship [--mode cloud|handoff]
+mushi pipeline watch <runId-or-prefix>
+mushi pipeline checkin <runId-or-prefix> --step 0 --status passed
+```
+
+---
+
+## Integrations & BYOK
+
+```bash
+mushi integrations list
+mushi integrations test slack|sentry|github
+mushi keys list
+MUSHI_BYOK_KEY=sk-ant-... mushi keys add --provider anthropic --label "Backup"
+mushi slack status
+mushi slack test
+```
+
 ## Security notes
 
 - `~/.mushirc` is written with mode `0o600` on Unix. Legacy configs with looser permissions are tightened on load.

package/dist/chunk-BCTHNCIY.js

@@ -0,0 +1,6 @@
+// src/version.ts
+var MUSHI_CLI_VERSION = true ? "0.16.0" : "0.0.0-dev";
+
+export {
+  MUSHI_CLI_VERSION
+};

package/dist/index.js

@@ -598,7 +598,7 @@ function getFrameworkFromPkg(pkg) {
 }
 
 // src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.14.0" : "0.0.0-dev";
+var MUSHI_CLI_VERSION = true ? "0.16.0" : "0.0.0-dev";
 
 // src/init.ts
 var ENV_FILES = [".env.local", ".env"];
@@ -1088,6 +1088,49 @@ function runMigrate(opts = {}) {
   return { matches };
 }
 
+// src/sanitize-config.ts
+var PROJECT_ID_RE = /^(?:proj_[A-Za-z0-9_-]{10,}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
+var API_KEY_RE = /^mushi_[A-Za-z0-9_-]{10,}$/;
+function sanitizeApiKey(raw) {
+  const key = raw.replace(/[\r\n\0]/g, "");
+  if (!API_KEY_RE.test(key)) {
+    throw new Error(
+      "Invalid API key in config \u2014 run `mushi login --api-key <key>` to refresh credentials."
+    );
+  }
+  return key;
+}
+function sanitizeProjectId(raw) {
+  const id = raw.trim();
+  if (!PROJECT_ID_RE.test(id)) {
+    throw new Error(
+      "Invalid project ID in config \u2014 expected a UUID or proj_* slug from the admin console."
+    );
+  }
+  return id;
+}
+function sanitizeEndpoint(raw) {
+  return assertEndpoint(normalizeEndpoint(raw));
+}
+function sanitizeCliCredentials(config) {
+  if (!config.endpoint || !config.apiKey || !config.projectId) {
+    throw new Error("Missing endpoint, apiKey, or projectId");
+  }
+  return {
+    endpoint: sanitizeEndpoint(config.endpoint),
+    apiKey: sanitizeApiKey(config.apiKey),
+    projectId: sanitizeProjectId(config.projectId)
+  };
+}
+function apiKeyHeaders(apiKey, projectId) {
+  const headers = {
+    Authorization: `Bearer ${apiKey}`,
+    "X-Mushi-Api-Key": apiKey
+  };
+  if (projectId) headers["X-Mushi-Project"] = projectId;
+  return headers;
+}
+
 // src/sourcemaps.ts
 import { createReadStream } from "fs";
 import { readFile, readdir } from "fs/promises";
@@ -1430,13 +1473,11 @@ var IngestSetupHttpError = class extends Error {
 };
 var NON_RETRYABLE_STATUSES = /* @__PURE__ */ new Set([401, 403, 404]);
 async function fetchIngestSetup(config, doFetch = globalThis.fetch) {
-  const safeKey = config.apiKey.replace(/[\r\n]/g, "");
-  const res = await doFetch(`${config.endpoint}/v1/sync/ingest-setup`, {
-    headers: {
-      Authorization: `Bearer ${safeKey}`,
-      "X-Mushi-Api-Key": safeKey,
-      ...config.projectId ? { "X-Mushi-Project": config.projectId } : {}
-    },
+  const endpoint = sanitizeEndpoint(config.endpoint);
+  const apiKey = sanitizeApiKey(config.apiKey);
+  const projectId = config.projectId ? sanitizeProjectId(config.projectId) : void 0;
+  const res = await doFetch(`${endpoint}/v1/sync/ingest-setup`, {
+    headers: apiKeyHeaders(apiKey, projectId),
     signal: AbortSignal.timeout(8e3)
   });
   if (!res.ok) {
@@ -1511,13 +1552,14 @@ function checkCliConfig(config) {
 }
 async function checkEndpointReachability(endpoint, doFetch = globalThis.fetch) {
   try {
-    const res = await doFetch(`${endpoint}/health`, {
+    const safeEndpoint = sanitizeEndpoint(endpoint);
+    const res = await doFetch(`${safeEndpoint}/health`, {
       signal: AbortSignal.timeout(5e3)
     });
     return {
       name: "Endpoint reachable",
       ok: res.status === 200,
-      detail: `GET ${endpoint}/health \u2192 ${res.status}`
+      detail: `GET ${safeEndpoint}/health \u2192 ${res.status}`
     };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -1559,14 +1601,11 @@ async function checkServerPreflight(config, doFetch = globalThis.fetch) {
     ];
   }
   try {
+    const { endpoint, apiKey, projectId } = sanitizeCliCredentials(config);
     const res = await doFetch(
-      `${config.endpoint}/v1/admin/projects/${config.projectId}/preflight`,
+      `${endpoint}/v1/admin/projects/${projectId}/preflight`,
       {
-        headers: {
-          Authorization: `Bearer ${config.apiKey}`,
-          "X-Mushi-Api-Key": config.apiKey,
-          "X-Mushi-Project": config.projectId
-        },
+        headers: apiKeyHeaders(apiKey, projectId),
         signal: AbortSignal.timeout(8e3)
       }
     );
@@ -1642,14 +1681,12 @@ async function checkQaStoriesHealth(config, doFetch = globalThis.fetch) {
   }
   const checks = [];
   try {
+    const { endpoint, apiKey, projectId } = sanitizeCliCredentials(config);
+    const headers = apiKeyHeaders(apiKey, projectId);
     const storiesRes = await doFetch(
-      `${config.endpoint}/v1/admin/projects/${config.projectId}/qa-coverage`,
+      `${endpoint}/v1/admin/projects/${projectId}/qa-coverage`,
       {
-        headers: {
-          Authorization: `Bearer ${config.apiKey}`,
-          "X-Mushi-Api-Key": config.apiKey,
-          "X-Mushi-Project": config.projectId
-        },
+        headers,
         signal: AbortSignal.timeout(8e3)
       }
     );
@@ -1670,14 +1707,10 @@ async function checkQaStoriesHealth(config, doFetch = globalThis.fetch) {
       detail: `${enabled.length} enabled story/stories configured`
     });
     const slackRes = await doFetch(
-      `${config.endpoint}/v1/admin/projects/${config.projectId}/integrations/probe/slack`,
+      `${endpoint}/v1/admin/projects/${projectId}/integrations/probe/slack`,
       {
         method: "POST",
-        headers: {
-          Authorization: `Bearer ${config.apiKey}`,
-          "X-Mushi-Api-Key": config.apiKey,
-          "X-Mushi-Project": config.projectId
-        },
+        headers,
         signal: AbortSignal.timeout(6e3)
       }
     );
@@ -1689,14 +1722,10 @@ async function checkQaStoriesHealth(config, doFetch = globalThis.fetch) {
       detail: slackOk ? "Slack connected \u2014 failures will notify your channel" : "Slack not connected \u2014 you won't be notified when stories fail. Visit /integrations \u2192 Add to Slack."
     });
     const fcRes = await doFetch(
-      `${config.endpoint}/v1/admin/projects/${config.projectId}/integrations/probe/firecrawl`,
+      `${endpoint}/v1/admin/projects/${projectId}/integrations/probe/firecrawl`,
       {
         method: "POST",
-        headers: {
-          Authorization: `Bearer ${config.apiKey}`,
-          "X-Mushi-Api-Key": config.apiKey,
-          "X-Mushi-Project": config.projectId
-        },
+        headers,
         signal: AbortSignal.timeout(6e3)
       }
     );
@@ -3273,6 +3302,79 @@ fixes.command("tail").description(
     }
   }
 });
+fixes.command("merge <fixId>").description(
+  "Squash-merge the fix PR on GitHub and mark the report Fixed (same as console merge)"
+).option(
+  "--method <method>",
+  "GitHub merge method: squash (default), merge, or rebase",
+  "squash"
+).option("--json", "Machine-readable JSON output").action(async (fixId, opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(1);
+  }
+  if (!config.endpoint) {
+    console.error("No endpoint configured. Run `mushi init`");
+    process.exit(1);
+  }
+  const method = opts.method;
+  if (!["squash", "merge", "rebase"].includes(method)) {
+    console.error("--method must be squash, merge, or rebase");
+    process.exit(1);
+  }
+  const result = await apiCall(`/v1/admin/fixes/${fixId}/merge`, config, {
+    method: "POST",
+    body: JSON.stringify({ mergeMethod: method })
+  });
+  if (!result.ok) {
+    if (opts.json) {
+      console.log(JSON.stringify({ ok: false, error: result.error }, null, 2));
+    } else {
+      console.error("Merge failed:", result.error.message);
+    }
+    process.exit(1);
+  }
+  const data = result.data ?? {};
+  if (opts.json) {
+    console.log(JSON.stringify({ ok: true, ...data }, null, 2));
+    return;
+  }
+  if (data.alreadyMerged) {
+    console.log(`PR was already merged. Report status: ${data.reportStatus ?? "unknown"}`);
+  } else {
+    console.log(`Merged successfully. Report status: ${data.reportStatus ?? "fixed"}`);
+  }
+});
+fixes.command("refresh-ci <fixId>").description("Pull latest GitHub Actions check-run status for a fix attempt (on-demand ci-sync)").option("--json", "Machine-readable JSON output").action(async (fixId, opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(1);
+  }
+  if (!config.endpoint) {
+    console.error("No endpoint configured. Run `mushi init`");
+    process.exit(1);
+  }
+  const result = await apiCall(`/v1/admin/fixes/${fixId}/refresh-ci`, config, { method: "POST" });
+  if (!result.ok) {
+    if (opts.json) {
+      console.log(JSON.stringify({ ok: false, error: result.error }, null, 2));
+    } else {
+      console.error("CI refresh failed:", result.error.message);
+    }
+    process.exit(1);
+  }
+  const data = result.data ?? {};
+  if (opts.json) {
+    console.log(JSON.stringify({ ok: true, ...data }, null, 2));
+    return;
+  }
+  const status = data.check_run_status ?? "unknown";
+  const conclusion = data.check_run_conclusion ?? "\u2014";
+  const updated = data.check_run_updated_at ? new Date(data.check_run_updated_at).toISOString() : "\u2014";
+  console.log(`CI status: ${status} \xB7 conclusion: ${conclusion} \xB7 updated: ${updated}`);
+});
 var stories = program.command("stories").description("TDD story mapping and test generation");
 stories.command("map").description("Crawl a live app URL and automatically discover user stories (writes inventory proposal)").requiredOption("--url <url>", "Live app URL to crawl (e.g. https://your-app.vercel.app)").option("--max-pages <n>", "Max pages to crawl", "20").option("--provider <p>", "Crawl provider: firecrawl (default) or browserbase", "firecrawl").option("--cursor-refine", "Open a Cursor Cloud PR to refine the draft against repo code").option("--wait", "Wait for the crawl to complete and print results").action(async (opts) => {
   const config = loadConfig();
@@ -3760,11 +3862,22 @@ Examples:
   mushi audit --json
   mushi audit --project-id abc123`).action(async (opts) => {
   const config = requireConfig();
-  const projectId = opts.projectId ?? config.projectId;
-  if (!projectId) {
+  const rawProjectId = opts.projectId ?? config.projectId;
+  if (!rawProjectId) {
     process.stderr.write("error: project ID required. Run `mushi login` or pass --project-id\n");
     process.exit(1);
   }
+  let endpoint;
+  let projectId;
+  try {
+    endpoint = sanitizeEndpoint(config.endpoint);
+    projectId = sanitizeProjectId(rawProjectId);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`error: ${msg}
+`);
+    process.exit(2);
+  }
   const headers = {
     "Content-Type": "application/json",
     "X-Mushi-Project-Id": projectId
@@ -3772,9 +3885,9 @@ Examples:
   const jwt = config.jwt ?? null;
   const apiKey = config.apiKey ?? null;
   if (jwt) {
-    headers["Authorization"] = `Bearer ${jwt}`;
+    headers["Authorization"] = `Bearer ${jwt.replace(/[\r\n\0]/g, "")}`;
   } else if (apiKey) {
-    headers["X-Mushi-Api-Key"] = apiKey;
+    headers["X-Mushi-Api-Key"] = sanitizeApiKey(apiKey);
   } else {
     process.stderr.write("error: no credentials found. Run `mushi login` first.\n");
     process.exit(1);
@@ -3784,7 +3897,7 @@ Examples:
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), 3e4);
     const res = await fetch(
-      `${config.endpoint}/v1/admin/projects/${projectId}/audit`,
+      `${endpoint}/v1/admin/projects/${projectId}/audit`,
       { method: "POST", headers, body: "{}", signal: controller.signal }
     );
     clearTimeout(timer);
@@ -3845,3 +3958,254 @@ program.parseAsync().catch((err) => {
   console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
   process.exit(1);
 });
+var skills = program.command("skills").description("Manage agent skill catalog");
+skills.command("list").description("List all skills in the catalog").option("--category <cat>", "Filter by category (workflow, debug, test, audit, \u2026)").option("--search <q>", "Search slug, title, or description").option("--page <n>", "Page number (default 1)", "1").option("--limit <n>", "Max results per page (1\u2013200, default 200)", "200").option("--json", "Machine-readable output").action(async (opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(2);
+  }
+  const qs = new URLSearchParams();
+  if (opts.category) qs.set("category", opts.category);
+  if (opts.search) qs.set("q", opts.search);
+  qs.set("page", String(Math.max(1, parseInt(opts.page) || 1)));
+  qs.set("limit", String(Math.min(Math.max(1, parseInt(opts.limit) || 200), 200)));
+  const result = await apiCall(
+    `/v1/admin/skills?${qs}`,
+    config
+  );
+  if (!result.ok) {
+    console.error("Failed:", result.error);
+    process.exit(1);
+  }
+  const rows = result.data ?? [];
+  if (opts.json) {
+    console.log(JSON.stringify({ skills: rows, count: rows.length }, null, 2));
+    return;
+  }
+  if (rows.length === 0) {
+    console.log("No skills in catalog. Add a source with `mushi skills sync`.");
+    return;
+  }
+  console.log(`
+Skill catalog (${rows.length} skills):
+`);
+  let lastCat = "";
+  for (const s of rows) {
+    if (s.category !== lastCat) {
+      lastCat = s.category;
+      console.log(`
+  [${s.category}]`);
+    }
+    const chain = s.chain_slugs?.length ? ` \u2192 ${s.chain_slugs.length} steps` : "";
+    console.log(`    ${s.slug.padEnd(40)} ${s.title}${chain}`);
+  }
+  console.log();
+});
+skills.command("show <slug>").description("Show full details and chain for a skill").action(async (slug) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(2);
+  }
+  const result = await apiCall(`/v1/admin/skills/${slug}`, config);
+  if (!result.ok) {
+    console.error("Skill not found:", slug);
+    process.exit(1);
+  }
+  const s = result.data;
+  console.log(`
+${s.title} (${s.slug})
+${"\u2500".repeat(50)}`);
+  console.log(`Category:  ${s.category}`);
+  console.log(`Chain:     ${s.chain_slugs?.length ? s.chain_slugs.join(" \u2192 ") : "none"}`);
+  console.log(`
+Description:
+  ${s.description}
+`);
+});
+skills.command("sync").description("Trigger skill sync for all configured skill sources").option("--source-id <id>", "Sync only a specific source ID").action(async (opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(2);
+  }
+  if (!config.projectId) {
+    console.error("No projectId. Run `mushi config projectId <uuid>`");
+    process.exit(2);
+  }
+  let ids;
+  if (opts.sourceId) {
+    ids = [opts.sourceId];
+  } else {
+    const sourcesResult = await apiCall(
+      `/v1/admin/skills/sources?project_id=${config.projectId}`,
+      config
+    );
+    if (!sourcesResult.ok) {
+      console.error("Failed to list sources:", sourcesResult.error);
+      process.exit(1);
+    }
+    ids = (sourcesResult.data ?? []).map((s) => s.id);
+  }
+  if (ids.length === 0) {
+    console.log("No skill sources configured. Add one in the Skill Pipelines console page.");
+    return;
+  }
+  for (const id of ids) {
+    console.log(`Syncing source ${id.slice(0, 8)}\u2026`);
+    const result = await apiCall(
+      `/v1/admin/skills/sources/${id}/sync`,
+      config,
+      { method: "POST" }
+    );
+    if (!result.ok) {
+      console.error("  Sync failed:", result.error);
+    } else console.log(`  Done: ${result.data?.synced ?? 0} synced, ${result.data?.skipped ?? 0} skipped, ${result.data?.errors ?? 0} errors`);
+  }
+  console.log();
+});
+var pipeline = program.command("pipeline").description("Manage skill pipeline runs");
+pipeline.command("start <reportId>").description("Start a skill pipeline for a report").requiredOption("--skill <slug>", "Root skill slug (e.g. workflow-fix-and-ship)").option("--mode <mode>", "Execution mode: handoff (default) or cloud", "handoff").option("--json", "Machine-readable output").action(async (reportId, opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(2);
+  }
+  if (!config.projectId) {
+    console.error("No projectId. Run `mushi config projectId <uuid>`");
+    process.exit(2);
+  }
+  const result = await apiCall(
+    `/v1/admin/skills/pipelines`,
+    config,
+    {
+      method: "POST",
+      body: JSON.stringify({
+        project_id: config.projectId,
+        root_skill_slug: opts.skill,
+        report_id: reportId,
+        mode: opts.mode
+      })
+    }
+  );
+  if (!result.ok) {
+    console.error("Failed:", result.error);
+    process.exit(1);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
+  }
+  const runId = result.data?.id ?? "";
+  const chain = result.data?.chain_slugs ?? [];
+  console.log(`
+Pipeline started!
+`);
+  console.log(`  Run ID:  ${runId.slice(0, 8)}\u2026  (full: ${runId})`);
+  console.log(`  Skill:   ${opts.skill}`);
+  console.log(`  Chain:   ${chain.length > 0 ? chain.join(" \u2192 ") : "(root only)"}`);
+  console.log(`  Mode:    ${opts.mode}`);
+  if (opts.mode === "handoff") {
+    console.log(`
+  Get context packet:  mushi pipeline watch ${runId.slice(0, 8)}`);
+    console.log(`  Check in step 0:     mushi pipeline checkin ${runId.slice(0, 8)} --step 0 --status passed`);
+  }
+  console.log();
+});
+pipeline.command("watch <runIdOrPrefix>").description("Watch a pipeline run and print the context packet").option("--json", "Machine-readable output").action(async (runIdOrPrefix, opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(2);
+  }
+  let runId = runIdOrPrefix;
+  if (runIdOrPrefix.length < 36) {
+    const list = await apiCall(
+      `/v1/admin/skills/pipelines?project_id=${config.projectId}&limit=50`,
+      config
+    );
+    if (!list.ok) {
+      console.error("Failed:", list.error);
+      process.exit(1);
+    }
+    const match = list.data.find((r) => r.id.startsWith(runIdOrPrefix));
+    if (!match) {
+      console.error("Run not found:", runIdOrPrefix);
+      process.exit(1);
+    }
+    runId = match.id;
+  }
+  const result = await apiCall(
+    `/v1/admin/skills/pipelines/${runId}`,
+    config
+  );
+  if (!result.ok) {
+    console.error("Failed:", result.error);
+    process.exit(1);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
+  }
+  const run = result.data;
+  const statusIcon = run.status === "completed" ? "\u2705" : run.status === "failed" ? "\u274C" : run.status === "running" ? "\u23F3" : "\u26AA";
+  console.log(`
+${statusIcon}  Pipeline ${runId.slice(0, 8)} \xB7 ${run.root_skill_slug} \xB7 ${run.mode}
+`);
+  const steps = run.steps ?? [];
+  for (const step of steps) {
+    const icon = step.status === "passed" ? "\u2705" : step.status === "failed" ? "\u274C" : step.status === "running" ? "\u23F3" : "\u26AA";
+    const pr = step.pr_url ? ` \u2192 ${step.pr_url}` : "";
+    console.log(`  ${icon} Step ${step.step_index + 1}: ${step.skill_slug}${pr}`);
+    if (step.notes) console.log(`        ${step.notes}`);
+  }
+  if (run.context_packet) {
+    console.log(`
+${"\u2500".repeat(60)}`);
+    console.log(`Context Packet (paste into your Cursor agent):
+`);
+    console.log(run.context_packet.slice(0, 6e3));
+    if (run.context_packet.length > 6e3) console.log("\n\u2026 [truncated \u2014 full packet via --json]");
+  }
+  console.log();
+});
+pipeline.command("checkin <runIdOrPrefix>").description("Check in a pipeline step (CLI agent reports status after completing a step)").requiredOption("--step <n>", "Step index (0-based)", parseInt).requiredOption("--status <status>", "Step status: passed | failed | running | skipped").option("--notes <text>", "Optional notes / output summary").option("--pr-url <url>", "PR URL opened during this step").action(async (runIdOrPrefix, opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    console.error("Run `mushi login` first");
+    process.exit(2);
+  }
+  let runId = runIdOrPrefix;
+  if (runIdOrPrefix.length < 36) {
+    const list = await apiCall(
+      `/v1/admin/skills/pipelines?project_id=${config.projectId}&limit=50`,
+      config
+    );
+    if (!list.ok) {
+      console.error("Failed:", list.error);
+      process.exit(1);
+    }
+    const match = list.data.find((r) => r.id.startsWith(runIdOrPrefix));
+    if (!match) {
+      console.error("Run not found:", runIdOrPrefix);
+      process.exit(1);
+    }
+    runId = match.id;
+  }
+  const result = await apiCall(
+    `/v1/admin/skills/pipelines/${runId}/steps/${opts.step}/checkin`,
+    config,
+    {
+      method: "POST",
+      body: JSON.stringify({ status: opts.status, notes: opts.notes, pr_url: opts.prUrl })
+    }
+  );
+  if (!result.ok) {
+    console.error("Failed:", result.error);
+    process.exit(1);
+  }
+  console.log(`  Step ${opts.step} \u2192 ${opts.status}. Console live flow updated.`);
+  console.log(`  Next: mushi pipeline watch ${runId.slice(0, 8)}`);
+  console.log();
+});

package/dist/init.js

@@ -8,7 +8,7 @@ import {
 } from "./chunk-NYPX5KXR.js";
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-4W6VOIQT.js";
+} from "./chunk-BCTHNCIY.js";
 
 // src/init.ts
 import * as p from "@clack/prompts";

package/dist/version.js

@@ -1,6 +1,6 @@
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-4W6VOIQT.js";
+} from "./chunk-BCTHNCIY.js";
 export {
   MUSHI_CLI_VERSION
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mushi-mushi/cli",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "license": "MIT",
   "description": "CLI for Mushi Mushi — `mushi init` wizard installs the right SDK for your framework, plus report triage and pipeline health commands",
   "bin": {

package/dist/chunk-4W6VOIQT.js

@@ -1,6 +0,0 @@
-// src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.14.0" : "0.0.0-dev";
-
-export {
-  MUSHI_CLI_VERSION
-};