@mushi-mushi/cli 0.23.1 → 0.24.0

package/dist/{chunk-M6L22NJU.js → chunk-BWASDQI6.js}

@@ -116,7 +116,7 @@ function tightenDirPermissions(path) {
 }
 
 // src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.23.1" : "0.0.0-dev";
+var MUSHI_CLI_VERSION = true ? "0.24.0" : "0.0.0-dev";
 
 // src/errors.ts
 var EXIT_CODE_MAP = {

package/dist/{chunk-NZ64LBLU.js → chunk-GUVGTFVK.js}

@@ -1,6 +1,6 @@
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-I4UK3WTN.js";
+} from "./chunk-X74T7JKC.js";
 
 // src/config.ts
 import { randomUUID } from "crypto";

package/dist/chunk-X74T7JKC.js

@@ -0,0 +1,6 @@
+// src/version.ts
+var MUSHI_CLI_VERSION = true ? "0.24.0" : "0.0.0-dev";
+
+export {
+  MUSHI_CLI_VERSION
+};

package/dist/{connect-IWFKKXGZ.js → connect-7LTQRBEW.js}

@@ -4,13 +4,13 @@ import {
   normalizeEndpoint,
   requireUuid,
   saveConfig
-} from "./chunk-NZ64LBLU.js";
+} from "./chunk-GUVGTFVK.js";
 import {
   detectFramework,
   envVarsToWrite,
   readPackageJson
 } from "./chunk-AIZRI665.js";
-import "./chunk-I4UK3WTN.js";
+import "./chunk-X74T7JKC.js";
 
 // src/connect.ts
 import { appendFile, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";

package/dist/{connect-5VPUYE6H.js → connect-KKN62YK2.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runConnect
-} from "./chunk-M6L22NJU.js";
+} from "./chunk-BWASDQI6.js";
 import "./chunk-LDPFTQLE.js";
 export {
   runConnect

package/dist/index.js

@@ -37,7 +37,7 @@ import {
   sanitizeProjectId,
   saveConfig,
   writeMcpServerEntry
-} from "./chunk-M6L22NJU.js";
+} from "./chunk-BWASDQI6.js";
 import {
   TEST_REPORT_FETCH_TIMEOUT_MS,
   assertEndpoint,
@@ -81,7 +81,9 @@ async function startDeviceAuth(endpoint, clientId) {
   });
   const json = await res.json().catch(() => null);
   if (!res.ok || !json?.ok || !json.data) {
-    throw new Error(json?.error?.message ?? `Could not start browser sign-in (HTTP ${res.status}).`);
+    throw new Error(
+      json?.error?.message ?? `Could not start browser sign-in (HTTP ${res.status}).`
+    );
   }
   return json.data;
 }
@@ -122,10 +124,15 @@ async function pollDeviceToken(endpoint, deviceCode) {
         };
     }
   } catch (err) {
-    return { status: "error", message: err instanceof Error ? err.message : String(err), retryable: true };
+    return {
+      status: "error",
+      message: err instanceof Error ? err.message : String(err),
+      retryable: true
+    };
   }
 }
 var defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+var deviceAuthRetryDelayMs = 1e3;
 async function waitForCliToken(endpoint, session, opts = {}) {
   const sleep = opts.sleep ?? defaultSleep;
   const now = opts.now ?? Date.now;
@@ -176,19 +183,51 @@ function cliAuthHeaders(cliToken) {
     Authorization: `Bearer ${cliToken}`
   };
 }
+var DeviceAuthRequestError = class extends Error {
+  step;
+  status;
+  retryable;
+  constructor(step, message, status) {
+    super(message);
+    this.name = "DeviceAuthRequestError";
+    this.step = step;
+    this.status = status;
+    this.retryable = status === void 0 || status >= 500 || status === 408;
+  }
+};
+async function withOneRetry(run) {
+  try {
+    return await run();
+  } catch (err) {
+    if (err instanceof DeviceAuthRequestError && err.retryable) {
+      if (deviceAuthRetryDelayMs > 0) {
+        await defaultSleep(deviceAuthRetryDelayMs);
+      }
+      return run();
+    }
+    throw err;
+  }
+}
 async function listProjects(endpoint, cliToken) {
   const base = trimTrailingSlash(endpoint);
-  try {
-    const res = await deviceFetch(`${base}/v1/cli/projects`, { headers: cliAuthHeaders(cliToken) });
+  return withOneRetry(async () => {
+    let res;
+    try {
+      res = await deviceFetch(`${base}/v1/cli/projects`, { headers: cliAuthHeaders(cliToken) });
+    } catch (err) {
+      throw new DeviceAuthRequestError(
+        "list_projects",
+        `Could not reach ${base}/v1/cli/projects: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
     const json = await res.json().catch(() => null);
     if (res.ok && json?.ok) return json.data?.projects ?? [];
-  } catch (err) {
-    console.error(
-      "[mushi] Failed to list projects:",
-      err instanceof Error ? err.message : err
+    throw new DeviceAuthRequestError(
+      "list_projects",
+      json?.error?.message ?? `Could not list projects (HTTP ${res.status}).`,
+      res.status
     );
-  }
-  return [];
+  });
 }
 async function createProject(endpoint, cliToken, name) {
   const base = trimTrailingSlash(endpoint);
@@ -206,17 +245,28 @@ async function createProject(endpoint, cliToken, name) {
 }
 async function mintProjectKey(endpoint, cliToken, projectId) {
   const base = trimTrailingSlash(endpoint);
-  try {
-    const res = await deviceFetch(`${base}/v1/cli/projects/${projectId}/keys`, {
-      method: "POST",
-      headers: cliAuthHeaders(cliToken),
-      body: JSON.stringify({})
-    });
+  return withOneRetry(async () => {
+    let res;
+    try {
+      res = await deviceFetch(`${base}/v1/cli/projects/${projectId}/keys`, {
+        method: "POST",
+        headers: cliAuthHeaders(cliToken),
+        body: JSON.stringify({})
+      });
+    } catch (err) {
+      throw new DeviceAuthRequestError(
+        "mint_key",
+        `Could not reach ${base}/v1/cli/projects/\u2026/keys: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
     const json = await res.json().catch(() => null);
-    if (res.ok && json?.ok) return json.data?.key ?? null;
-  } catch {
-  }
-  return null;
+    if (res.ok && json?.ok && json.data?.key) return json.data.key;
+    throw new DeviceAuthRequestError(
+      "mint_key",
+      json?.error?.message ?? `Could not mint an SDK key (HTTP ${res.status}).`,
+      res.ok ? void 0 : res.status
+    );
+  });
 }
 
 // src/freshness.ts
@@ -460,8 +510,16 @@ async function runInit(options = {}) {
   } else {
     p.log.info(`Skipped install. Run \`${installCommand(pm, packagesToInstall)}\` yourself.`);
   }
-  await writeEnvFile(cwd, credentials.apiKey, credentials.projectId, framework, endpoint, Boolean(options.yes));
+  await writeEnvFile(
+    cwd,
+    credentials.apiKey,
+    credentials.projectId,
+    framework,
+    endpoint,
+    Boolean(options.yes)
+  );
   persistCliConfig(credentials.apiKey, credentials.projectId, endpoint);
+  emitWizardFunnelEvent(credentials, endpoint, "wizard_env_written", { framework: framework.id });
   const enableRewards = await maybeEnableRewards(options);
   printNextSteps(framework, consoleBase, enableRewards);
   await maybeSendTestReport(credentials, { ...options, endpoint, consoleBase });
@@ -533,7 +591,9 @@ async function acquireCredentials(options, consoleBase, endpoint) {
   if (options.yes) {
     const creds = await runBrowserSignIn(options, endpoint, consoleBase);
     if (creds) return creds;
-    p.log.warn("Browser sign-in didn't complete \u2014 switching to manual entry.");
+    p.log.warn(
+      "Browser sign-in didn't complete \u2014 switching to manual entry. Run `npx mushi-mushi doctor --auth` to diagnose the sign-in path."
+    );
   } else {
     const method = await p.select({
       message: "Connect this app to Mushi",
@@ -558,7 +618,9 @@ async function acquireCredentials(options, consoleBase, endpoint) {
     if (method === "browser") {
       const creds = await runBrowserSignIn(options, endpoint, consoleBase);
       if (creds) return creds;
-      p.log.warn("Browser sign-in didn't complete \u2014 switching to manual entry.");
+      p.log.warn(
+        "Browser sign-in didn't complete \u2014 switching to manual entry. Run `npx mushi-mushi doctor --auth` to diagnose the sign-in path."
+      );
     }
   }
   return collectCredentialsManually(options, consoleBase, endpoint);
@@ -599,7 +661,9 @@ async function runBrowserSignIn(options, endpoint, consoleBase) {
     fetchSpin.start("Loading your projects\u2026");
     try {
       projects = await listProjects(endpoint, cliToken);
-      fetchSpin.stop(projects.length > 0 ? `Found ${projects.length} project(s).` : "No projects yet.");
+      fetchSpin.stop(
+        projects.length > 0 ? `Found ${projects.length} project(s).` : "No projects yet."
+      );
     } catch (err) {
       fetchSpin.stop("Could not load projects \u2014 you can still create a new one.");
       p.log.warn(err instanceof Error ? err.message : String(err));
@@ -647,19 +711,14 @@ async function runBrowserSignIn(options, endpoint, consoleBase) {
     const keySpin = p.spinner();
     keySpin.start("Minting SDK key\u2026");
     try {
-      const minted = await mintProjectKey(endpoint, cliToken, projectId);
-      apiKey = minted ?? void 0;
-      if (!apiKey) {
-        keySpin.stop("Could not mint an API key.");
-        p.log.warn(
-          `Open the console Verify tab to generate a key manually: ${consoleUrl(consoleBase, "/onboarding?tab=verify")}`
-        );
-        return null;
-      }
+      apiKey = await mintProjectKey(endpoint, cliToken, projectId);
       keySpin.stop("SDK key ready.");
     } catch (err) {
       keySpin.stop("Could not mint an API key.");
       p.log.warn(err instanceof Error ? err.message : String(err));
+      p.log.warn(
+        `You're signed in, but key minting failed. Generate one manually in the console Verify tab: ${consoleUrl(consoleBase, "/onboarding?tab=verify")}`
+      );
       return null;
     }
   }
@@ -719,10 +778,11 @@ async function verifyCredentials(credentials, options, consoleBase) {
   const endpoint = resolveCloudEndpoint(options.endpoint);
   const spinner3 = p.spinner();
   spinner3.start("Verifying credentials\u2026");
-  const result = await apiCall(
-    "/v1/sync/whoami",
-    { apiKey: credentials.apiKey, projectId: credentials.projectId, endpoint }
-  );
+  const result = await apiCall("/v1/sync/whoami", {
+    apiKey: credentials.apiKey,
+    projectId: credentials.projectId,
+    endpoint
+  });
   if (!result.ok) {
     spinner3.stop("Credentials could not be verified.");
     p.log.error(result.error?.message ?? "Authentication failed.");
@@ -877,6 +937,20 @@ function persistCliConfig(apiKey, projectId, endpoint) {
   const existing = loadConfig();
   saveConfig({ ...existing, apiKey, projectId, endpoint });
 }
+function emitWizardFunnelEvent(credentials, endpoint, event, metadata = {}) {
+  if (process.env.MUSHI_NO_TELEMETRY) return;
+  void fetch(`${endpoint.replace(/\/$/, "")}/v1/cli/funnel`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "X-Mushi-Api-Key": credentials.apiKey,
+      "X-Mushi-Project": credentials.projectId
+    },
+    body: JSON.stringify({ event, source: "cli", metadata }),
+    signal: AbortSignal.timeout(4e3)
+  }).catch(() => {
+  });
+}
 function printNextSteps(framework, consoleBase, enableRewards = false) {
   p.note(framework.snippet(), "Add this to your app:");
   if (enableRewards) {
@@ -910,7 +984,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect: runConnect2 } = await import("./connect-5VPUYE6H.js");
+    const { runConnect: runConnect2 } = await import("./connect-KKN62YK2.js");
     await runConnect2({
       apiKey: credentials.apiKey,
       projectId: credentials.projectId,
@@ -921,12 +995,8 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
       wait: true
     });
   } catch (err) {
-    p.log.warn(
-      err instanceof Error ? err.message : String(err)
-    );
-    p.log.info(
-      "You can run manually: mushi connect --write-env --wire-ide --wait"
-    );
+    p.log.warn(err instanceof Error ? err.message : String(err));
+    p.log.info("You can run manually: mushi connect --write-env --wire-ide --wait");
   }
 }
 async function maybeEnableRewards(options) {
@@ -3193,6 +3263,88 @@ async function checkEndpointReachability(endpoint, doFetch = globalThis.fetch) {
     return { name: "Endpoint reachable", ok: false, detail: `Fetch failed: ${msg}` };
   }
 }
+async function checkCliAuthPath(config, doFetch = globalThis.fetch) {
+  const checks = [];
+  if (!config.endpoint) {
+    return [
+      {
+        name: "Sign-in route reachable",
+        ok: false,
+        detail: "No endpoint configured \u2014 run `npx mushi-mushi` or pass MUSHI_API_ENDPOINT."
+      }
+    ];
+  }
+  const base = sanitizeEndpoint(config.endpoint);
+  let dateHeader = null;
+  try {
+    const res = await doFetch(`${base}/v1/cli/auth/device/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ device_code: "doctor-probe" }),
+      signal: AbortSignal.timeout(8e3)
+    });
+    dateHeader = res.headers?.get?.("date") ?? null;
+    const signInRouteReachable = res.status === 400 || res.status === 429;
+    checks.push({
+      name: "Sign-in route reachable",
+      ok: signInRouteReachable,
+      detail: signInRouteReachable ? `POST ${base}/v1/cli/auth/device/token \u2192 ${res.status} (route deployed and answering)` : `POST ${base}/v1/cli/auth/device/token \u2192 ${res.status} \u2014 expected HTTP 400 (invalid device_code) or 429 (slow_down); the API may be down or mis-deployed.`
+    });
+  } catch (err) {
+    checks.push({
+      name: "Sign-in route reachable",
+      ok: false,
+      detail: `Fetch failed: ${err instanceof Error ? err.message : String(err)} \u2014 check network/proxy/firewall to ${base}.`
+    });
+  }
+  if (dateHeader) {
+    const serverMs = Date.parse(dateHeader);
+    if (!Number.isNaN(serverMs)) {
+      const skewSec = Math.round(Math.abs(Date.now() - serverMs) / 1e3);
+      const ok = skewSec <= 120;
+      checks.push({
+        name: "System clock in sync",
+        ok,
+        warn: !ok && skewSec <= 300,
+        detail: ok ? `Local clock within ${skewSec}s of the server.` : `Local clock is ${skewSec}s off the server \u2014 sign-in codes expire fast; fix your system time.`
+      });
+    }
+  }
+  if (config.apiKey && config.projectId) {
+    try {
+      const res = await doFetch(`${base}/v1/sync/whoami`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          ...apiKeyHeaders(config.apiKey, config.projectId)
+        },
+        body: JSON.stringify({}),
+        signal: AbortSignal.timeout(8e3)
+      });
+      const json = await res.json().catch(() => null);
+      const ok = res.ok && json?.ok === true;
+      checks.push({
+        name: "Saved credentials valid",
+        ok,
+        detail: ok ? `API key resolves to project "${json?.data?.project_name ?? config.projectId}".` : `${json?.error?.message ?? `whoami \u2192 HTTP ${res.status}`} \u2014 re-run \`npx mushi-mushi\` to sign in again.`
+      });
+    } catch (err) {
+      checks.push({
+        name: "Saved credentials valid",
+        ok: false,
+        detail: `whoami fetch failed: ${err instanceof Error ? err.message : String(err)}`
+      });
+    }
+  } else {
+    checks.push({
+      name: "Saved credentials valid",
+      ok: true,
+      warn: true,
+      detail: "No saved CLI credentials yet \u2014 normal before the first successful sign-in."
+    });
+  }
+  return checks;
+}
 async function checkSdkInstall(cwd) {
   try {
     const { readFile: readFile3 } = await import("fs/promises");
@@ -3229,13 +3381,10 @@ async function checkServerPreflight(config, doFetch = globalThis.fetch) {
   }
   try {
     const { endpoint, apiKey, projectId } = sanitizeCliCredentials(config);
-    const res = await doFetch(
-      `${endpoint}/v1/admin/projects/${projectId}/preflight`,
-      {
-        headers: apiKeyHeaders(apiKey, projectId),
-        signal: AbortSignal.timeout(8e3)
-      }
-    );
+    const res = await doFetch(`${endpoint}/v1/admin/projects/${projectId}/preflight`, {
+      headers: apiKeyHeaders(apiKey, projectId),
+      signal: AbortSignal.timeout(8e3)
+    });
     if (res.ok) {
       const body = await res.json();
       const serverChecks = body.data?.checks ?? [];
@@ -3291,7 +3440,13 @@ async function checkIngestSetup(config, doFetch = globalThis.fetch) {
       doFetch
     );
     if (!data) {
-      return [{ name: "Ingest setup", ok: false, detail: "Request to /v1/sync/ingest-setup failed or returned invalid payload" }];
+      return [
+        {
+          name: "Ingest setup",
+          ok: false,
+          detail: "Request to /v1/sync/ingest-setup failed or returned invalid payload"
+        }
+      ];
     }
     const steps = data.steps ?? [];
     const checks = steps.filter((s) => s.required).map((s) => ({
@@ -3327,22 +3482,27 @@ async function checkQaStoriesHealth(config, doFetch = globalThis.fetch) {
   try {
     const { endpoint, apiKey, projectId } = sanitizeCliCredentials(config);
     const headers = apiKeyHeaders(apiKey, projectId);
-    const storiesRes = await doFetch(
-      `${endpoint}/v1/admin/projects/${projectId}/qa-coverage`,
-      {
-        headers,
-        signal: AbortSignal.timeout(8e3)
-      }
-    );
+    const storiesRes = await doFetch(`${endpoint}/v1/admin/projects/${projectId}/qa-coverage`, {
+      headers,
+      signal: AbortSignal.timeout(8e3)
+    });
     if (!storiesRes.ok) {
-      checks.push({ name: "[qa] Fetch QA stories", ok: false, detail: `HTTP ${storiesRes.status}` });
+      checks.push({
+        name: "[qa] Fetch QA stories",
+        ok: false,
+        detail: `HTTP ${storiesRes.status}`
+      });
       return checks;
     }
     const storiesBody = await storiesRes.json();
     const stories = storiesBody.data?.coverage ?? [];
     const enabled = stories.filter((s) => s.enabled);
     if (enabled.length === 0) {
-      checks.push({ name: "[qa] Enabled QA stories", ok: true, detail: "No enabled stories \u2014 create one at /qa-coverage" });
+      checks.push({
+        name: "[qa] Enabled QA stories",
+        ok: true,
+        detail: "No enabled stories \u2014 create one at /qa-coverage"
+      });
       return checks;
     }
     checks.push({
@@ -3411,7 +3571,9 @@ async function checkHostAppWiring(cwd) {
       }
     }
     const hasProjectId = /VITE_MUSHI_PROJECT_ID=|NEXT_PUBLIC_MUSHI_PROJECT_ID=|MUSHI_PROJECT_ID=/.test(envContent);
-    const hasApiKey = /VITE_MUSHI_API_KEY=|NEXT_PUBLIC_MUSHI_API_KEY=|MUSHI_API_KEY=/.test(envContent);
+    const hasApiKey = /VITE_MUSHI_API_KEY=|NEXT_PUBLIC_MUSHI_API_KEY=|MUSHI_API_KEY=/.test(
+      envContent
+    );
     checks.push({
       name: "[host] Mushi env vars in .env.local",
       ok: hasProjectId && hasApiKey,
@@ -3456,10 +3618,7 @@ async function checkMcpConfig(config, cwd, doFetch = globalThis.fetch) {
   const { join: join4, resolve: resolve3 } = await import("path");
   const { homedir } = await import("os");
   const root = resolve3(cwd);
-  const candidates = [
-    join4(root, ".cursor", "mcp.json"),
-    join4(homedir(), ".cursor", "mcp.json")
-  ];
+  const candidates = [join4(root, ".cursor", "mcp.json"), join4(homedir(), ".cursor", "mcp.json")];
   let mcpPath = null;
   let mcpRaw = null;
   for (const candidate of candidates) {
@@ -3497,11 +3656,17 @@ async function checkMcpConfig(config, cwd, doFetch = globalThis.fetch) {
   try {
     mcpConfig = JSON.parse(mcpRaw);
   } catch {
-    checks.push({ name: "[mcp] mcp.json valid JSON", ok: false, detail: "mcp.json is not valid JSON \u2014 regenerate with `mushi setup`." });
+    checks.push({
+      name: "[mcp] mcp.json valid JSON",
+      ok: false,
+      detail: "mcp.json is not valid JSON \u2014 regenerate with `mushi setup`."
+    });
     return checks;
   }
   const servers = mcpConfig.mcpServers ?? {};
-  const mushiEntries = Object.entries(servers).filter(([k]) => k === "mushi" || k.startsWith("mushi-"));
+  const mushiEntries = Object.entries(servers).filter(
+    ([k]) => k === "mushi" || k.startsWith("mushi-")
+  );
   if (mushiEntries.length === 0) {
     checks.push({
       name: "[mcp] mushi server entry",
@@ -3621,7 +3786,9 @@ async function checkOnboardingStatus(config, _consoleBase, cwd, doFetch = global
       } catch {
       }
     }
-    const hasEnvVars = /(?:VITE_|NEXT_PUBLIC_|EXPO_PUBLIC_|NUXT_PUBLIC_)?MUSHI_PROJECT_ID=/.test(envContent);
+    const hasEnvVars = /(?:VITE_|NEXT_PUBLIC_|EXPO_PUBLIC_|NUXT_PUBLIC_)?MUSHI_PROJECT_ID=/.test(
+      envContent
+    );
     if (!hasEnvVars) {
       return {
         nextAction: "Write env vars to your app: run `npx mushi-mushi` or `mushi connect --write-env`",
@@ -3710,6 +3877,9 @@ async function runDoctor(config, options = {}) {
     const mcpChecks = await checkMcpConfig(config, options.cwd ?? process.cwd(), doFetch);
     checks.push(...mcpChecks);
   }
+  if (isFull || options.auth) {
+    checks.push(...await checkCliAuthPath(config, doFetch));
+  }
   const heartbeatPassed = checks.some((c) => c.name === "[ingest] Last SDK heartbeat" && c.ok);
   if (heartbeatPassed) {
     const idx = checks.findIndex((c) => c.name === "SDK installed in this repo" && !c.ok);
@@ -3742,8 +3912,10 @@ function formatDoctorResult(result) {
   const warned = result.checks.filter((c) => c.ok && c.warn);
   if (failed.length === 0) {
     if (warned.length > 0) {
-      lines.push(`
-All checks passed with ${warned.length} advisory warning${warned.length === 1 ? "" : "s"}. The CLI is ready.`);
+      lines.push(
+        `
+All checks passed with ${warned.length} advisory warning${warned.length === 1 ? "" : "s"}. The CLI is ready.`
+      );
     } else {
       lines.push("\nAll checks passed. The CLI is ready.");
     }
@@ -3768,6 +3940,9 @@ function registerDoctorCommand(program2) {
   ).option(
     "--mcp",
     "Check Cursor MCP config: verify mushi-* server entry, credentials, and probe account-overview connectivity."
+  ).option(
+    "--auth",
+    "Diagnose the browser sign-in handshake: device-auth route reachability, system clock skew, and saved-credential validity. Run this when `npx mushi-mushi` browser sign-in does not complete."
   ).option(
     "--fix",
     "Apply safe local fixes when checks fail: write missing .env.local lines and wire Cursor MCP config."
@@ -3777,54 +3952,60 @@ function registerDoctorCommand(program2) {
   ).option(
     "--full",
     "Run ALL check categories (server, ingest, host-app, mcp, qa-stories) in one shot. Good for first-run diagnostics. Exit 0 only when all checks pass."
-  ).action(async (opts) => {
-    const config = loadConfig();
-    if (opts.onboarding) {
-      const cwd = opts.cwd ?? process.cwd();
-      const consoleBase = await resolveConsoleUrl({ cwd });
-      const status = await checkOnboardingStatus(config, consoleBase, cwd);
-      const base = consoleBase.replace(/\/$/, "");
-      if (status.done) {
-        console.log(`OK  Setup complete. ${status.nextAction}`);
-        console.log(`    ${base}${status.ctaPath}`);
-      } else {
-        console.log(`\u2192 Next: ${status.nextAction}`);
-        console.log(`    Open: ${base}${status.ctaPath}`);
+  ).action(
+    async (opts) => {
+      const config = loadConfig();
+      if (opts.onboarding) {
+        const cwd = opts.cwd ?? process.cwd();
+        const consoleBase = await resolveConsoleUrl({ cwd });
+        const status = await checkOnboardingStatus(config, consoleBase, cwd);
+        const base = consoleBase.replace(/\/$/, "");
+        if (status.done) {
+          console.log(`OK  Setup complete. ${status.nextAction}`);
+          console.log(`    ${base}${status.ctaPath}`);
+        } else {
+          console.log(`\u2192 Next: ${status.nextAction}`);
+          console.log(`    Open: ${base}${status.ctaPath}`);
+        }
+        if (!status.done) process.exit(1);
+        return;
       }
-      if (!status.done) process.exit(1);
-      return;
-    }
-    const doctorOpts = {
-      cwd: opts.cwd,
-      server: opts.server,
-      ingest: opts.ingest,
-      qaStories: opts.qaStories,
-      hostApp: opts.hostApp,
-      mcp: opts.mcp,
-      full: opts.full
-    };
-    let result = await runDoctor(config, doctorOpts);
-    if (!result.ready && opts.fix && config.apiKey && config.projectId && config.endpoint) {
-      const connectResult = await runConnect({
-        apiKey: config.apiKey,
-        projectId: config.projectId,
-        endpoint: config.endpoint,
-        cwd: opts.cwd ?? process.cwd(),
-        writeEnv: true,
-        wireIde: true
-      }, config);
-      for (const msg of connectResult.messages) console.log(msg);
-      result = await runDoctor(config, { ...doctorOpts, mcp: opts.mcp });
-    }
-    const { checks } = result;
-    if (opts.json) {
-      console.log(JSON.stringify({ checks, ready: result.ready }, null, 2));
+      const doctorOpts = {
+        cwd: opts.cwd,
+        server: opts.server,
+        ingest: opts.ingest,
+        qaStories: opts.qaStories,
+        hostApp: opts.hostApp,
+        mcp: opts.mcp,
+        auth: opts.auth,
+        full: opts.full
+      };
+      let result = await runDoctor(config, doctorOpts);
+      if (!result.ready && opts.fix && config.apiKey && config.projectId && config.endpoint) {
+        const connectResult = await runConnect(
+          {
+            apiKey: config.apiKey,
+            projectId: config.projectId,
+            endpoint: config.endpoint,
+            cwd: opts.cwd ?? process.cwd(),
+            writeEnv: true,
+            wireIde: true
+          },
+          config
+        );
+        for (const msg of connectResult.messages) console.log(msg);
+        result = await runDoctor(config, { ...doctorOpts, mcp: opts.mcp });
+      }
+      const { checks } = result;
+      if (opts.json) {
+        console.log(JSON.stringify({ checks, ready: result.ready }, null, 2));
+        if (!result.ready) process.exit(1);
+        return;
+      }
+      console.log(formatDoctorResult(result));
       if (!result.ready) process.exit(1);
-      return;
     }
-    console.log(formatDoctorResult(result));
-    if (!result.ready) process.exit(1);
-  });
+  );
 }
 
 // src/commands/reset-cli.ts

package/dist/init.js

@@ -14,7 +14,7 @@ import {
   resolveConsoleUrl,
   resolveConsoleUrlSync,
   saveConfig
-} from "./chunk-NZ64LBLU.js";
+} from "./chunk-GUVGTFVK.js";
 import {
   FRAMEWORKS,
   detectFramework,
@@ -25,7 +25,7 @@ import {
 } from "./chunk-AIZRI665.js";
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-I4UK3WTN.js";
+} from "./chunk-X74T7JKC.js";
 
 // src/init.ts
 import * as p from "@clack/prompts";
@@ -60,7 +60,9 @@ async function startDeviceAuth(endpoint, clientId) {
   });
   const json = await res.json().catch(() => null);
   if (!res.ok || !json?.ok || !json.data) {
-    throw new Error(json?.error?.message ?? `Could not start browser sign-in (HTTP ${res.status}).`);
+    throw new Error(
+      json?.error?.message ?? `Could not start browser sign-in (HTTP ${res.status}).`
+    );
   }
   return json.data;
 }
@@ -101,10 +103,15 @@ async function pollDeviceToken(endpoint, deviceCode) {
         };
     }
   } catch (err) {
-    return { status: "error", message: err instanceof Error ? err.message : String(err), retryable: true };
+    return {
+      status: "error",
+      message: err instanceof Error ? err.message : String(err),
+      retryable: true
+    };
   }
 }
 var defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+var deviceAuthRetryDelayMs = 1e3;
 async function waitForCliToken(endpoint, session, opts = {}) {
   const sleep = opts.sleep ?? defaultSleep;
   const now = opts.now ?? Date.now;
@@ -155,19 +162,51 @@ function cliAuthHeaders(cliToken) {
     Authorization: `Bearer ${cliToken}`
   };
 }
+var DeviceAuthRequestError = class extends Error {
+  step;
+  status;
+  retryable;
+  constructor(step, message, status) {
+    super(message);
+    this.name = "DeviceAuthRequestError";
+    this.step = step;
+    this.status = status;
+    this.retryable = status === void 0 || status >= 500 || status === 408;
+  }
+};
+async function withOneRetry(run) {
+  try {
+    return await run();
+  } catch (err) {
+    if (err instanceof DeviceAuthRequestError && err.retryable) {
+      if (deviceAuthRetryDelayMs > 0) {
+        await defaultSleep(deviceAuthRetryDelayMs);
+      }
+      return run();
+    }
+    throw err;
+  }
+}
 async function listProjects(endpoint, cliToken) {
   const base = trimTrailingSlash(endpoint);
-  try {
-    const res = await deviceFetch(`${base}/v1/cli/projects`, { headers: cliAuthHeaders(cliToken) });
+  return withOneRetry(async () => {
+    let res;
+    try {
+      res = await deviceFetch(`${base}/v1/cli/projects`, { headers: cliAuthHeaders(cliToken) });
+    } catch (err) {
+      throw new DeviceAuthRequestError(
+        "list_projects",
+        `Could not reach ${base}/v1/cli/projects: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
     const json = await res.json().catch(() => null);
     if (res.ok && json?.ok) return json.data?.projects ?? [];
-  } catch (err) {
-    console.error(
-      "[mushi] Failed to list projects:",
-      err instanceof Error ? err.message : err
+    throw new DeviceAuthRequestError(
+      "list_projects",
+      json?.error?.message ?? `Could not list projects (HTTP ${res.status}).`,
+      res.status
     );
-  }
-  return [];
+  });
 }
 async function createProject(endpoint, cliToken, name) {
   const base = trimTrailingSlash(endpoint);
@@ -185,17 +224,28 @@ async function createProject(endpoint, cliToken, name) {
 }
 async function mintProjectKey(endpoint, cliToken, projectId) {
   const base = trimTrailingSlash(endpoint);
-  try {
-    const res = await deviceFetch(`${base}/v1/cli/projects/${projectId}/keys`, {
-      method: "POST",
-      headers: cliAuthHeaders(cliToken),
-      body: JSON.stringify({})
-    });
+  return withOneRetry(async () => {
+    let res;
+    try {
+      res = await deviceFetch(`${base}/v1/cli/projects/${projectId}/keys`, {
+        method: "POST",
+        headers: cliAuthHeaders(cliToken),
+        body: JSON.stringify({})
+      });
+    } catch (err) {
+      throw new DeviceAuthRequestError(
+        "mint_key",
+        `Could not reach ${base}/v1/cli/projects/\u2026/keys: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
     const json = await res.json().catch(() => null);
-    if (res.ok && json?.ok) return json.data?.key ?? null;
-  } catch {
-  }
-  return null;
+    if (res.ok && json?.ok && json.data?.key) return json.data.key;
+    throw new DeviceAuthRequestError(
+      "mint_key",
+      json?.error?.message ?? `Could not mint an SDK key (HTTP ${res.status}).`,
+      res.ok ? void 0 : res.status
+    );
+  });
 }
 
 // src/freshness.ts
@@ -419,8 +469,16 @@ async function runInit(options = {}) {
   } else {
     p.log.info(`Skipped install. Run \`${installCommand(pm, packagesToInstall)}\` yourself.`);
   }
-  await writeEnvFile(cwd, credentials.apiKey, credentials.projectId, framework, endpoint, Boolean(options.yes));
+  await writeEnvFile(
+    cwd,
+    credentials.apiKey,
+    credentials.projectId,
+    framework,
+    endpoint,
+    Boolean(options.yes)
+  );
   persistCliConfig(credentials.apiKey, credentials.projectId, endpoint);
+  emitWizardFunnelEvent(credentials, endpoint, "wizard_env_written", { framework: framework.id });
   const enableRewards = await maybeEnableRewards(options);
   printNextSteps(framework, consoleBase, enableRewards);
   await maybeSendTestReport(credentials, { ...options, endpoint, consoleBase });
@@ -492,7 +550,9 @@ async function acquireCredentials(options, consoleBase, endpoint) {
   if (options.yes) {
     const creds = await runBrowserSignIn(options, endpoint, consoleBase);
     if (creds) return creds;
-    p.log.warn("Browser sign-in didn't complete \u2014 switching to manual entry.");
+    p.log.warn(
+      "Browser sign-in didn't complete \u2014 switching to manual entry. Run `npx mushi-mushi doctor --auth` to diagnose the sign-in path."
+    );
   } else {
     const method = await p.select({
       message: "Connect this app to Mushi",
@@ -517,7 +577,9 @@ async function acquireCredentials(options, consoleBase, endpoint) {
     if (method === "browser") {
       const creds = await runBrowserSignIn(options, endpoint, consoleBase);
       if (creds) return creds;
-      p.log.warn("Browser sign-in didn't complete \u2014 switching to manual entry.");
+      p.log.warn(
+        "Browser sign-in didn't complete \u2014 switching to manual entry. Run `npx mushi-mushi doctor --auth` to diagnose the sign-in path."
+      );
     }
   }
   return collectCredentialsManually(options, consoleBase, endpoint);
@@ -558,7 +620,9 @@ async function runBrowserSignIn(options, endpoint, consoleBase) {
     fetchSpin.start("Loading your projects\u2026");
     try {
       projects = await listProjects(endpoint, cliToken);
-      fetchSpin.stop(projects.length > 0 ? `Found ${projects.length} project(s).` : "No projects yet.");
+      fetchSpin.stop(
+        projects.length > 0 ? `Found ${projects.length} project(s).` : "No projects yet."
+      );
     } catch (err) {
       fetchSpin.stop("Could not load projects \u2014 you can still create a new one.");
       p.log.warn(err instanceof Error ? err.message : String(err));
@@ -606,19 +670,14 @@ async function runBrowserSignIn(options, endpoint, consoleBase) {
     const keySpin = p.spinner();
     keySpin.start("Minting SDK key\u2026");
     try {
-      const minted = await mintProjectKey(endpoint, cliToken, projectId);
-      apiKey = minted ?? void 0;
-      if (!apiKey) {
-        keySpin.stop("Could not mint an API key.");
-        p.log.warn(
-          `Open the console Verify tab to generate a key manually: ${consoleUrl(consoleBase, "/onboarding?tab=verify")}`
-        );
-        return null;
-      }
+      apiKey = await mintProjectKey(endpoint, cliToken, projectId);
       keySpin.stop("SDK key ready.");
     } catch (err) {
       keySpin.stop("Could not mint an API key.");
       p.log.warn(err instanceof Error ? err.message : String(err));
+      p.log.warn(
+        `You're signed in, but key minting failed. Generate one manually in the console Verify tab: ${consoleUrl(consoleBase, "/onboarding?tab=verify")}`
+      );
       return null;
     }
   }
@@ -678,10 +737,11 @@ async function verifyCredentials(credentials, options, consoleBase) {
   const endpoint = resolveCloudEndpoint(options.endpoint);
   const spinner2 = p.spinner();
   spinner2.start("Verifying credentials\u2026");
-  const result = await apiCall(
-    "/v1/sync/whoami",
-    { apiKey: credentials.apiKey, projectId: credentials.projectId, endpoint }
-  );
+  const result = await apiCall("/v1/sync/whoami", {
+    apiKey: credentials.apiKey,
+    projectId: credentials.projectId,
+    endpoint
+  });
   if (!result.ok) {
     spinner2.stop("Credentials could not be verified.");
     p.log.error(result.error?.message ?? "Authentication failed.");
@@ -836,6 +896,20 @@ function persistCliConfig(apiKey, projectId, endpoint) {
   const existing = loadConfig();
   saveConfig({ ...existing, apiKey, projectId, endpoint });
 }
+function emitWizardFunnelEvent(credentials, endpoint, event, metadata = {}) {
+  if (process.env.MUSHI_NO_TELEMETRY) return;
+  void fetch(`${endpoint.replace(/\/$/, "")}/v1/cli/funnel`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "X-Mushi-Api-Key": credentials.apiKey,
+      "X-Mushi-Project": credentials.projectId
+    },
+    body: JSON.stringify({ event, source: "cli", metadata }),
+    signal: AbortSignal.timeout(4e3)
+  }).catch(() => {
+  });
+}
 function printNextSteps(framework, consoleBase, enableRewards = false) {
   p.note(framework.snippet(), "Add this to your app:");
   if (enableRewards) {
@@ -869,7 +943,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect } = await import("./connect-IWFKKXGZ.js");
+    const { runConnect } = await import("./connect-7LTQRBEW.js");
     await runConnect({
       apiKey: credentials.apiKey,
       projectId: credentials.projectId,
@@ -880,12 +954,8 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
       wait: true
     });
   } catch (err) {
-    p.log.warn(
-      err instanceof Error ? err.message : String(err)
-    );
-    p.log.info(
-      "You can run manually: mushi connect --write-env --wire-ide --wait"
-    );
+    p.log.warn(err instanceof Error ? err.message : String(err));
+    p.log.info("You can run manually: mushi connect --write-env --wire-ide --wait");
   }
 }
 async function maybeEnableRewards(options) {

package/dist/version.js

@@ -1,6 +1,6 @@
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-I4UK3WTN.js";
+} from "./chunk-X74T7JKC.js";
 export {
   MUSHI_CLI_VERSION
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mushi-mushi/cli",
-  "version": "0.23.1",
+  "version": "0.24.0",
   "license": "MIT",
   "description": "CLI for Mushi Mushi — `mushi init` wizard installs the right SDK for your framework, plus report triage and pipeline health commands",
   "bin": {
@@ -11,11 +11,11 @@
     "commander": "^15.0.0"
   },
   "devDependencies": {
-    "@types/node": "^22.19.21",
-    "eslint": "^10.4.1",
+    "@types/node": "^22.20.0",
+    "eslint": "^10.6.0",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.8",
+    "vitest": "^4.1.9",
     "@mushi-mushi/eslint-config": "0.0.0"
   },
   "author": "Kenji Sakuramoto (https://bsky.app/profile/mushimushi.dev)",

package/dist/chunk-I4UK3WTN.js

@@ -1,6 +0,0 @@
-// src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.23.1" : "0.0.0-dev";
-
-export {
-  MUSHI_CLI_VERSION
-};