@mushi-mushi/cli 0.25.0 → 0.26.1

package/dist/init.js

@@ -1,10 +1,12 @@
 import {
   TEST_REPORT_FETCH_TIMEOUT_MS,
   apiCall,
+  apiKeyHeaders,
   apiKeyHint,
   cliSetupDeepLink,
   consoleUrl,
   ensureClientId,
+  fetchIngestSetup,
   loadConfig,
   normalizeEndpoint,
   openInBrowser,
@@ -13,8 +15,13 @@ import {
   resolveCloudEndpoint,
   resolveConsoleUrl,
   resolveConsoleUrlSync,
+  sanitizeCliCredentials,
+  sanitizeEndpoint,
   saveConfig
-} from "./chunk-2WHQONHK.js";
+} from "./chunk-QOY3DULB.js";
+import {
+  MUSHI_CLI_VERSION
+} from "./chunk-PCTMFRKN.js";
 import {
   FRAMEWORKS,
   detectFramework,
@@ -23,9 +30,6 @@ import {
   installCommand,
   readPackageJson
 } from "./chunk-AIZRI665.js";
-import {
-  MUSHI_CLI_VERSION
-} from "./chunk-SS42XQ57.js";
 
 // src/init.ts
 import * as p from "@clack/prompts";
@@ -208,12 +212,12 @@ async function listProjects(endpoint, cliToken) {
     );
   });
 }
-async function createProject(endpoint, cliToken, name) {
+async function createProject(endpoint, cliToken, name, opts = {}) {
   const base = trimTrailingSlash(endpoint);
   const res = await deviceFetch(`${base}/v1/cli/projects`, {
     method: "POST",
     headers: cliAuthHeaders(cliToken),
-    body: JSON.stringify({ name })
+    body: JSON.stringify({ name, ...opts.scopes ? { scopes: opts.scopes } : {} })
   });
   const json = await res.json().catch(() => null);
   if (!res.ok || !json?.ok || !json.data) {
@@ -222,14 +226,17 @@ async function createProject(endpoint, cliToken, name) {
   const { id, name: created, slug, apiKey } = json.data;
   return { id, name: created, slug, apiKey: apiKey ?? null };
 }
-async function mintProjectKey(endpoint, cliToken, projectId) {
+async function mintProjectKey(endpoint, cliToken, projectId, opts = {}) {
   const base = trimTrailingSlash(endpoint);
   let res;
   try {
     res = await deviceFetch(`${base}/v1/cli/projects/${projectId}/keys`, {
       method: "POST",
       headers: cliAuthHeaders(cliToken),
-      body: JSON.stringify({})
+      body: JSON.stringify({
+        ...opts.scopes ? { scopes: opts.scopes } : {},
+        ...opts.label ? { label: opts.label } : {}
+      })
     });
   } catch (err) {
     throw new DeviceAuthRequestError(
@@ -429,17 +436,744 @@ function printAuthBanner(userCode, verificationUri) {
   console.log("");
 }
 
+// src/doctor.ts
+function checkCliConfig(config) {
+  return [
+    {
+      name: "CLI config file",
+      ok: Boolean(config.endpoint),
+      detail: config.endpoint ? `endpoint=${config.endpoint}` : "No endpoint \u2014 set MUSHI_API_ENDPOINT, run `mushi connect`, or `mushi config endpoint <url>`"
+    },
+    {
+      name: "API key configured",
+      ok: Boolean(config.apiKey),
+      detail: config.apiKey ? `apiKey=${config.apiKey.slice(0, 8)}\u2026${config.apiKey.slice(-4)}` : "No API key set \u2014 run `mushi login --api-key <key>`"
+    },
+    {
+      name: "Project ID configured",
+      ok: Boolean(config.projectId),
+      detail: config.projectId ? `projectId=${config.projectId}` : "No default project \u2014 set via `mushi config projectId <uuid>`"
+    }
+  ];
+}
+async function checkEndpointReachability(endpoint, doFetch = globalThis.fetch) {
+  try {
+    const safeEndpoint = sanitizeEndpoint(endpoint);
+    const res = await doFetch(`${safeEndpoint}/health`, {
+      signal: AbortSignal.timeout(5e3)
+    });
+    return {
+      name: "Endpoint reachable",
+      ok: res.status === 200,
+      detail: `GET ${safeEndpoint}/health \u2192 ${res.status}`
+    };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return { name: "Endpoint reachable", ok: false, detail: `Fetch failed: ${msg}` };
+  }
+}
+async function checkCliAuthPath(config, doFetch = globalThis.fetch) {
+  const checks = [];
+  if (!config.endpoint) {
+    return [
+      {
+        name: "Sign-in route reachable",
+        ok: false,
+        detail: "No endpoint configured \u2014 run `npx mushi-mushi` or pass MUSHI_API_ENDPOINT."
+      }
+    ];
+  }
+  const base = sanitizeEndpoint(config.endpoint);
+  let dateHeader = null;
+  try {
+    const res = await doFetch(`${base}/v1/cli/auth/device/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ device_code: "doctor-probe" }),
+      signal: AbortSignal.timeout(8e3)
+    });
+    dateHeader = res.headers?.get?.("date") ?? null;
+    const signInRouteReachable = res.status === 400 || res.status === 429;
+    checks.push({
+      name: "Sign-in route reachable",
+      ok: signInRouteReachable,
+      detail: signInRouteReachable ? `POST ${base}/v1/cli/auth/device/token \u2192 ${res.status} (route deployed and answering)` : `POST ${base}/v1/cli/auth/device/token \u2192 ${res.status} \u2014 expected HTTP 400 (invalid device_code) or 429 (slow_down); the API may be down or mis-deployed.`
+    });
+  } catch (err) {
+    checks.push({
+      name: "Sign-in route reachable",
+      ok: false,
+      detail: `Fetch failed: ${err instanceof Error ? err.message : String(err)} \u2014 check network/proxy/firewall to ${base}.`
+    });
+  }
+  if (dateHeader) {
+    const serverMs = Date.parse(dateHeader);
+    if (!Number.isNaN(serverMs)) {
+      const skewSec = Math.round(Math.abs(Date.now() - serverMs) / 1e3);
+      const ok = skewSec <= 120;
+      checks.push({
+        name: "System clock in sync",
+        ok,
+        warn: !ok && skewSec <= 300,
+        detail: ok ? `Local clock within ${skewSec}s of the server.` : `Local clock is ${skewSec}s off the server \u2014 sign-in codes expire fast; fix your system time.`
+      });
+    }
+  }
+  if (config.apiKey && config.projectId) {
+    try {
+      const res = await doFetch(`${base}/v1/sync/whoami`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          ...apiKeyHeaders(config.apiKey, config.projectId)
+        },
+        body: JSON.stringify({}),
+        signal: AbortSignal.timeout(8e3)
+      });
+      const json = await res.json().catch(() => null);
+      const ok = res.ok && json?.ok === true;
+      checks.push({
+        name: "Saved credentials valid",
+        ok,
+        detail: ok ? `API key resolves to project "${json?.data?.project_name ?? config.projectId}".` : `${json?.error?.message ?? `whoami \u2192 HTTP ${res.status}`} \u2014 re-run \`npx mushi-mushi\` to sign in again.`
+      });
+    } catch (err) {
+      checks.push({
+        name: "Saved credentials valid",
+        ok: false,
+        detail: `whoami fetch failed: ${err instanceof Error ? err.message : String(err)}`
+      });
+    }
+  } else {
+    checks.push({
+      name: "Saved credentials valid",
+      ok: true,
+      warn: true,
+      detail: "No saved CLI credentials yet \u2014 normal before the first successful sign-in."
+    });
+  }
+  return checks;
+}
+async function checkSdkInstall(cwd) {
+  try {
+    const { readFile } = await import("fs/promises");
+    const { join: join3, resolve: resolve2 } = await import("path");
+    const root = resolve2(cwd);
+    const pkgPath = join3(root, "package.json");
+    const pkg = JSON.parse(await readFile(pkgPath, "utf8"));
+    const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
+    const sdks = [
+      "@mushi-mushi/react",
+      "@mushi-mushi/web",
+      "@mushi-mushi/core",
+      "@mushi-mushi/react-native"
+    ];
+    const installed = sdks.filter((s) => deps[s]);
+    return {
+      name: "SDK installed in this repo",
+      ok: installed.length > 0,
+      detail: installed.length > 0 ? installed.map((s) => `${s}@${deps[s]}`).join(", ") : "No @mushi-mushi/* package in package.json \u2014 run `mushi init` to install"
+    };
+  } catch {
+    return null;
+  }
+}
+async function checkServerPreflight(config, doFetch = globalThis.fetch) {
+  if (!config.projectId || !config.apiKey || !config.endpoint) {
+    return [
+      {
+        name: "Server preflight",
+        ok: false,
+        detail: "Need projectId, apiKey, and endpoint. Run `mushi login` and `mushi config projectId <uuid>`."
+      }
+    ];
+  }
+  try {
+    const { endpoint, apiKey, projectId } = sanitizeCliCredentials(config);
+    const res = await doFetch(`${endpoint}/v1/admin/projects/${projectId}/preflight`, {
+      headers: apiKeyHeaders(apiKey, projectId),
+      signal: AbortSignal.timeout(8e3)
+    });
+    if (res.ok) {
+      const body = await res.json();
+      const serverChecks = body.data?.checks ?? [];
+      return serverChecks.map((sc) => ({
+        name: `[server] ${sc.label}`,
+        ok: sc.ready,
+        detail: sc.ready ? "" : sc.hint
+      }));
+    }
+    if (res.status === 403) {
+      let errCode;
+      try {
+        const body = await res.json();
+        errCode = body?.error?.code;
+      } catch {
+      }
+      if (errCode === "INSUFFICIENT_SCOPE") {
+        return [
+          {
+            name: "Server preflight",
+            ok: true,
+            detail: "Skipped \u2014 your key has report:write scope only (pre-Jun 2026 key). Run `mushi login --upgrade-scope` to get mcp:read and run admin checks."
+          }
+        ];
+      }
+    }
+    const text2 = await res.text().catch(() => "");
+    return [
+      {
+        name: "Server preflight",
+        ok: false,
+        detail: `HTTP ${res.status}: ${text2.slice(0, 120)}`
+      }
+    ];
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return [{ name: "Server preflight", ok: false, detail: `Fetch failed: ${msg}` }];
+  }
+}
+async function checkIngestSetup(config, doFetch = globalThis.fetch) {
+  if (!config.apiKey || !config.endpoint) {
+    return [
+      {
+        name: "Ingest setup",
+        ok: false,
+        detail: "Need apiKey and endpoint. Run `mushi connect`."
+      }
+    ];
+  }
+  try {
+    const data = await fetchIngestSetup(
+      { endpoint: config.endpoint, apiKey: config.apiKey, projectId: config.projectId },
+      doFetch
+    );
+    if (!data) {
+      return [
+        {
+          name: "Ingest setup",
+          ok: false,
+          detail: "Request to /v1/sync/ingest-setup failed or returned invalid payload"
+        }
+      ];
+    }
+    const steps = data.steps ?? [];
+    const checks = steps.filter((s) => s.required).map((s) => ({
+      name: `[ingest] ${s.label}`,
+      ok: s.complete,
+      detail: s.complete ? "" : s.hint ?? ""
+    }));
+    const diag = data.diagnostic;
+    if (diag?.last_sdk_seen_at) {
+      checks.push({
+        name: "[ingest] Last SDK heartbeat",
+        ok: true,
+        detail: `${diag.last_sdk_seen_at}${diag.last_sdk_endpoint_host ? ` @ ${diag.last_sdk_endpoint_host}` : ""}`
+      });
+    }
+    return checks.length > 0 ? checks : [{ name: "Ingest setup", ok: false, detail: "Empty response from /v1/sync/ingest-setup" }];
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return [{ name: "Ingest setup", ok: false, detail: `Fetch failed: ${msg}` }];
+  }
+}
+async function checkQaStoriesHealth(config, doFetch = globalThis.fetch) {
+  if (!config.projectId || !config.apiKey || !config.endpoint) {
+    return [
+      {
+        name: "QA stories health",
+        ok: false,
+        detail: "Need projectId, apiKey, and endpoint for QA story checks."
+      }
+    ];
+  }
+  const checks = [];
+  try {
+    const { endpoint, apiKey, projectId } = sanitizeCliCredentials(config);
+    const headers = apiKeyHeaders(apiKey, projectId);
+    const storiesRes = await doFetch(`${endpoint}/v1/admin/projects/${projectId}/qa-coverage`, {
+      headers,
+      signal: AbortSignal.timeout(8e3)
+    });
+    if (!storiesRes.ok) {
+      checks.push({
+        name: "[qa] Fetch QA stories",
+        ok: false,
+        detail: `HTTP ${storiesRes.status}`
+      });
+      return checks;
+    }
+    const storiesBody = await storiesRes.json();
+    const stories = storiesBody.data?.coverage ?? [];
+    const enabled = stories.filter((s) => s.enabled);
+    if (enabled.length === 0) {
+      checks.push({
+        name: "[qa] Enabled QA stories",
+        ok: true,
+        detail: "No enabled stories \u2014 create one at /qa-coverage"
+      });
+      return checks;
+    }
+    checks.push({
+      name: "[qa] Enabled QA stories",
+      ok: true,
+      detail: `${enabled.length} enabled story/stories configured`
+    });
+    const slackRes = await doFetch(
+      `${endpoint}/v1/admin/projects/${projectId}/integrations/probe/slack`,
+      {
+        method: "POST",
+        headers,
+        signal: AbortSignal.timeout(6e3)
+      }
+    );
+    const slackBody = slackRes.ok ? await slackRes.json() : null;
+    const slackOk = slackBody?.status === "ok";
+    checks.push({
+      name: "[qa] Slack notifications configured",
+      ok: slackOk,
+      detail: slackOk ? "Slack connected \u2014 failures will notify your channel" : "Slack not connected \u2014 you won't be notified when stories fail. Visit /integrations \u2192 Add to Slack."
+    });
+    const fcRes = await doFetch(
+      `${endpoint}/v1/admin/projects/${projectId}/integrations/probe/firecrawl`,
+      {
+        method: "POST",
+        headers,
+        signal: AbortSignal.timeout(6e3)
+      }
+    );
+    const fcBody = fcRes.ok ? await fcRes.json() : null;
+    const hasFirecrawlStories = enabled.some(
+      (s) => !s.browser_provider || s.browser_provider === "firecrawl_actions"
+    );
+    if (hasFirecrawlStories) {
+      const fcOk = fcBody?.status === "ok";
+      checks.push({
+        name: "[qa] Firecrawl API key configured",
+        ok: fcOk,
+        detail: fcOk ? "Firecrawl key is resolvable \u2014 stories will run without Unauthorized errors" : "No Firecrawl key found \u2014 enabled stories using firecrawl_actions will 401. Add a key at /integrations \u2192 BYOK keys."
+      });
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    checks.push({ name: "[qa] QA stories health", ok: false, detail: `Fetch failed: ${msg}` });
+  }
+  return checks;
+}
+async function checkHostAppWiring(cwd) {
+  const checks = [];
+  try {
+    const { readFile, access } = await import("fs/promises");
+    const { join: join3, resolve: resolve2 } = await import("path");
+    const root = resolve2(cwd);
+    const pkgPath = join3(root, "package.json");
+    const pkg = JSON.parse(await readFile(pkgPath, "utf8"));
+    const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
+    const isCapHybrid = Boolean(deps["@capacitor/core"] && deps["react"]);
+    const envCandidates = [".env.local", ".env"];
+    let envContent = "";
+    for (const f of envCandidates) {
+      try {
+        envContent = await readFile(join3(root, f), "utf8");
+        break;
+      } catch {
+      }
+    }
+    const hasProjectId = /VITE_MUSHI_PROJECT_ID=|NEXT_PUBLIC_MUSHI_PROJECT_ID=|MUSHI_PROJECT_ID=/.test(envContent);
+    const hasApiKey = /VITE_MUSHI_API_KEY=|NEXT_PUBLIC_MUSHI_API_KEY=|MUSHI_API_KEY=/.test(
+      envContent
+    );
+    checks.push({
+      name: "[host] Mushi env vars in .env.local",
+      ok: hasProjectId && hasApiKey,
+      detail: hasProjectId && hasApiKey ? "VITE_/MUSHI_ project id + API key found" : "Run `mushi connect --write-env` or add VITE_MUSHI_PROJECT_ID + VITE_MUSHI_API_KEY"
+    });
+    let mcpPresent = false;
+    try {
+      await access(join3(root, ".cursor", "mcp.json"));
+      mcpPresent = true;
+    } catch {
+    }
+    checks.push({
+      name: "[host] Cursor MCP config",
+      ok: mcpPresent,
+      detail: mcpPresent ? ".cursor/mcp.json present" : "Run `mushi connect` to wire MCP for two-way reporter replies"
+    });
+    if (isCapHybrid) {
+      const hasWebSdk = Boolean(deps["@mushi-mushi/web"] || deps["@mushi-mushi/react"]);
+      checks.push({
+        name: "[host] Capacitor hybrid \u2014 WebView SDK",
+        ok: hasWebSdk,
+        detail: hasWebSdk ? "Use @mushi-mushi/web or @mushi-mushi/react in the WebView (initMushi in main.tsx)" : "Install @mushi-mushi/web for Capacitor WebView reporting"
+      });
+      checks.push({
+        name: "[host] Capacitor native plugin (optional)",
+        ok: true,
+        detail: deps["@mushi-mushi/capacitor"] ? `@mushi-mushi/capacitor@${deps["@mushi-mushi/capacitor"]} installed` : "Optional: @mushi-mushi/capacitor for native shell parity \u2014 WebView SDK covers most flows"
+      });
+    }
+  } catch {
+    checks.push({
+      name: "[host] Host app detection",
+      ok: false,
+      detail: "No package.json in cwd \u2014 run from your app repo root"
+    });
+  }
+  return checks;
+}
+async function checkMcpConfig(config, cwd, doFetch = globalThis.fetch) {
+  const checks = [];
+  const { readFile } = await import("fs/promises");
+  const { join: join3, resolve: resolve2 } = await import("path");
+  const { homedir } = await import("os");
+  const root = resolve2(cwd);
+  const candidates = [join3(root, ".cursor", "mcp.json"), join3(homedir(), ".cursor", "mcp.json")];
+  let mcpPath = null;
+  let mcpRaw = null;
+  for (const candidate of candidates) {
+    try {
+      const raw = await readFile(candidate, "utf8");
+      let parsed = {};
+      try {
+        parsed = JSON.parse(raw);
+      } catch {
+      }
+      const hasEntries = Object.keys(parsed.mcpServers ?? {}).length > 0;
+      if (!hasEntries && candidates.indexOf(candidate) < candidates.length - 1) {
+        continue;
+      }
+      mcpRaw = raw;
+      mcpPath = candidate;
+      break;
+    } catch {
+    }
+  }
+  if (!mcpPath || !mcpRaw) {
+    checks.push({
+      name: "[mcp] mcp.json present",
+      ok: false,
+      detail: "No .cursor/mcp.json found in cwd or ~/.cursor/. Run `mushi setup` to create it."
+    });
+    return checks;
+  }
+  checks.push({
+    name: "[mcp] mcp.json present",
+    ok: true,
+    detail: `Found at ${mcpPath}`
+  });
+  let mcpConfig = {};
+  try {
+    mcpConfig = JSON.parse(mcpRaw);
+  } catch {
+    checks.push({
+      name: "[mcp] mcp.json valid JSON",
+      ok: false,
+      detail: "mcp.json is not valid JSON \u2014 regenerate with `mushi setup`."
+    });
+    return checks;
+  }
+  const servers = mcpConfig.mcpServers ?? {};
+  const mushiEntries = Object.entries(servers).filter(
+    ([k]) => k === "mushi" || k.startsWith("mushi-")
+  );
+  if (mushiEntries.length === 0) {
+    checks.push({
+      name: "[mcp] mushi server entry",
+      ok: false,
+      detail: "No mushi or mushi-* server found in mcpServers. Run `mushi setup` to add one."
+    });
+    return checks;
+  }
+  checks.push({
+    name: "[mcp] mushi server entry",
+    ok: true,
+    detail: `Found: ${mushiEntries.map(([k]) => k).join(", ")}`
+  });
+  let anyKeyValid = false;
+  let anyEndpointSet = false;
+  for (const [, srv] of mushiEntries) {
+    const s = srv;
+    const env = s.env ?? {};
+    const key = env["MUSHI_API_KEY"] ?? "";
+    const endpoint = env["MUSHI_API_ENDPOINT"] ?? "";
+    if (key.startsWith("mushi_")) anyKeyValid = true;
+    if (endpoint.includes("supabase.co") || endpoint.includes("localhost")) anyEndpointSet = true;
+  }
+  checks.push({
+    name: "[mcp] MUSHI_API_KEY set",
+    ok: anyKeyValid,
+    detail: anyKeyValid ? "At least one mushi server has a valid mushi_* API key" : "No mushi_* API key found in any mushi server env. Re-run `mushi setup` to regenerate."
+  });
+  checks.push({
+    name: "[mcp] MUSHI_API_ENDPOINT set",
+    ok: anyEndpointSet,
+    detail: anyEndpointSet ? "MUSHI_API_ENDPOINT is present and looks valid" : "MUSHI_API_ENDPOINT missing or not a Supabase URL. Re-run `mushi setup`."
+  });
+  if (anyKeyValid && anyEndpointSet && config.apiKey && config.endpoint) {
+    try {
+      const { endpoint, apiKey } = sanitizeCliCredentials(config);
+      const res = await doFetch(`${endpoint}/v1/admin/mcp/account-overview`, {
+        headers: apiKeyHeaders(apiKey, config.projectId),
+        signal: AbortSignal.timeout(6e3)
+      });
+      if (res.ok) {
+        const body = await res.json();
+        const projectCount = body?.data?.total ?? 0;
+        checks.push({
+          name: "[mcp] account-overview reachable",
+          ok: true,
+          detail: `Key is valid; ${projectCount} accessible project${projectCount === 1 ? "" : "s"}`
+        });
+      } else {
+        let detail = `GET /v1/admin/mcp/account-overview \u2192 HTTP ${res.status}. Verify the API key is active.`;
+        try {
+          const errBody = await res.json();
+          const nested = errBody["error"];
+          const errCode = nested?.["code"] ?? errBody["code"] ?? "";
+          if (errCode === "INSUFFICIENT_SCOPE") {
+            detail = `Key has report:write scope only \u2014 run \`mushi login --upgrade-scope\` then \`mushi setup\` to get mcp:read.`;
+          }
+        } catch {
+        }
+        checks.push({
+          name: "[mcp] account-overview reachable",
+          ok: false,
+          detail
+        });
+      }
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      checks.push({
+        name: "[mcp] account-overview reachable",
+        ok: false,
+        detail: `Probe failed: ${msg}. Check MUSHI_API_ENDPOINT and network connectivity.`
+      });
+    }
+  }
+  return checks;
+}
+var FIX_HINTS = {
+  "CLI config file": "Run `mushi connect --endpoint <url> --project-id <uuid> --api-key mushi_xxx` or `mushi config endpoint <url>`.",
+  "API key configured": "Mint a key in the console (Projects \u2192 API Keys) then `mushi login --api-key mushi_xxx`.",
+  "Project ID configured": "Copy the project UUID from the console Projects page \u2192 `mushi config projectId <uuid>`.",
+  "Endpoint reachable": "Check your network and that MUSHI_API_ENDPOINT points at `\u2026/functions/v1/api`.",
+  "[ingest]": "Open the console Onboarding wizard \u2192 Install SDK \u2192 submit a test report, or run `mushi connect --wait`.",
+  "[server]": "Open Settings \u2192 Integrations: connect GitHub, index codebase, add Anthropic BYOK key, enable autofix.",
+  "[mcp]": "Run `mushi setup` to regenerate .cursor/mcp.json with a fresh API key and endpoint."
+};
+function fixHintForCheck(name) {
+  if (FIX_HINTS[name]) return FIX_HINTS[name];
+  if (name.startsWith("[ingest]")) return FIX_HINTS["[ingest]"];
+  if (name.startsWith("[server]") || name.startsWith("[preflight]")) return FIX_HINTS["[server]"];
+  if (name.startsWith("[mcp]")) return FIX_HINTS["[mcp]"];
+  return void 0;
+}
+async function checkVersionDrift(cwd, doFetch) {
+  const checks = [];
+  const { MUSHI_CLI_VERSION: MUSHI_CLI_VERSION2 } = await import("./version.js");
+  if (MUSHI_CLI_VERSION2 === "0.0.0-dev") return checks;
+  const parse2 = (v) => {
+    const m = v.replace(/^[~^]/, "").match(/^(\d+)\.(\d+)\.(\d+)/);
+    return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : [0, 0, 0];
+  };
+  const isBehind = (installed, latest) => {
+    const [a1, a2, a3] = parse2(installed);
+    const [b1, b2, b3] = parse2(latest);
+    return a1 !== b1 ? a1 < b1 : a2 !== b2 ? a2 < b2 : a3 < b3;
+  };
+  try {
+    const res = await doFetch("https://registry.npmjs.org/@mushi-mushi/cli/latest", {
+      signal: AbortSignal.timeout(3e3)
+    });
+    if (res.ok) {
+      const { version: latest } = await res.json();
+      if (latest && isBehind(MUSHI_CLI_VERSION2, latest)) {
+        checks.push({
+          name: "CLI version",
+          ok: true,
+          warn: true,
+          detail: `Installed ${MUSHI_CLI_VERSION2}, latest is ${latest}. Run \`mushi upgrade\` (or npm i -g @mushi-mushi/cli@latest).`
+        });
+      }
+    }
+  } catch {
+  }
+  try {
+    const { readFile } = await import("fs/promises");
+    const { join: join3 } = await import("path");
+    const pkg = JSON.parse(await readFile(join3(cwd, "package.json"), "utf8"));
+    const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+    const candidates = Object.entries(deps).filter(([name]) => name.startsWith("@mushi-mushi/")).filter(([, v]) => /^[~^]?\d/.test(v));
+    const drifted = (await Promise.all(
+      candidates.map(async ([name, v]) => {
+        try {
+          const res = await doFetch(`https://registry.npmjs.org/${name}/latest`, {
+            signal: AbortSignal.timeout(3e3)
+          });
+          if (!res.ok) return null;
+          const { version: latest } = await res.json();
+          return latest && isBehind(v, latest) ? [name, v, latest] : null;
+        } catch {
+          return null;
+        }
+      })
+    )).filter((d) => d !== null);
+    if (drifted.length > 0) {
+      checks.push({
+        name: "SDK version drift",
+        ok: true,
+        warn: true,
+        detail: `${drifted.map(([n, v, l]) => `${n}@${v} (latest ${l})`).join(", ")} \u2014 behind npm latest. Run \`mushi upgrade\` in this repo.`
+      });
+    }
+  } catch {
+  }
+  return checks;
+}
+async function checkPipelineDoctor(config, doFetch) {
+  if (!config.endpoint || !config.apiKey) return [];
+  try {
+    const res = await doFetch(`${config.endpoint.replace(/\/$/, "")}/v1/admin/doctor`, {
+      headers: apiKeyHeaders(config.apiKey),
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (res.status === 401 || res.status === 403) return [];
+    if (!res.ok) {
+      return [{
+        name: "[pipeline] Server doctor",
+        ok: true,
+        warn: true,
+        detail: `GET /v1/admin/doctor returned HTTP ${res.status} \u2014 pipeline health unknown.`
+      }];
+    }
+    const body = await res.json();
+    return (body.data?.checks ?? []).map((ch) => ({
+      name: `[pipeline] ${ch.name}`,
+      ok: ch.status !== "fail",
+      warn: ch.status === "warn",
+      detail: ch.hint ? `${ch.summary} \u2192 Fix: ${ch.hint}` : ch.summary
+    }));
+  } catch {
+    return [{
+      name: "[pipeline] Server doctor",
+      ok: true,
+      warn: true,
+      detail: "Could not reach /v1/admin/doctor (timeout) \u2014 pipeline health unknown."
+    }];
+  }
+}
+async function runDoctor(config, options = {}) {
+  const doFetch = options.fetch ?? globalThis.fetch;
+  const checks = [];
+  const isFull = options.full === true;
+  const runServer = isFull || options.server !== false;
+  const runIngest = isFull || options.ingest !== false;
+  checks.push(...checkCliConfig(config));
+  if (config.endpoint) {
+    checks.push(await checkEndpointReachability(config.endpoint, doFetch));
+  }
+  const sdkCheck = await checkSdkInstall(options.cwd ?? process.cwd());
+  if (sdkCheck) checks.push(sdkCheck);
+  if (sdkCheck?.ok && !sdkCheck.warn) {
+    const { findSdkImport } = await import("./snippet-inject-NDAPEL2T.js");
+    const imported = await findSdkImport(options.cwd ?? process.cwd());
+    checks.push(
+      imported ? { name: "SDK init snippet wired", ok: true, detail: `Found SDK usage in ${imported.file}` } : {
+        name: "SDK init snippet wired",
+        ok: true,
+        warn: true,
+        detail: "Package installed but no @mushi-mushi import found in src/app \u2014 paste the init snippet from `mushi init` into your entry file."
+      }
+    );
+  }
+  if (runServer) {
+    const serverChecks = await checkServerPreflight(config, doFetch);
+    checks.push(...serverChecks);
+    checks.push(...await checkPipelineDoctor(config, doFetch));
+  }
+  checks.push(...await checkVersionDrift(options.cwd ?? process.cwd(), doFetch));
+  if (runIngest) {
+    const ingestChecks = await checkIngestSetup(config, doFetch);
+    checks.push(...ingestChecks);
+  }
+  if (isFull || options.qaStories) {
+    const qaChecks = await checkQaStoriesHealth(config, doFetch);
+    checks.push(...qaChecks);
+  }
+  if (isFull || options.hostApp) {
+    const hostChecks = await checkHostAppWiring(options.cwd ?? process.cwd());
+    checks.push(...hostChecks);
+  }
+  if (isFull || options.mcp) {
+    const mcpChecks = await checkMcpConfig(config, options.cwd ?? process.cwd(), doFetch);
+    checks.push(...mcpChecks);
+  }
+  if (isFull || options.auth) {
+    checks.push(...await checkCliAuthPath(config, doFetch));
+  }
+  const heartbeatPassed = checks.some((c) => c.name === "[ingest] Last SDK heartbeat" && c.ok);
+  if (heartbeatPassed) {
+    const idx = checks.findIndex((c) => c.name === "SDK installed in this repo" && !c.ok);
+    if (idx >= 0) {
+      checks[idx] = {
+        ...checks[idx],
+        ok: true,
+        warn: true,
+        detail: "No @mushi-mushi/* found in cwd package.json \u2014 but live heartbeats confirm the SDK is active. Run from your app repo or install with `mushi init`."
+      };
+    }
+  }
+  return { checks, ready: checks.every((c) => c.ok) };
+}
+function formatDoctorResult(result) {
+  const PASS = "OK";
+  const WARN = "WARN";
+  const FAIL = "FAIL";
+  const lines = [];
+  for (const c of result.checks) {
+    const icon = !c.ok ? FAIL : c.warn ? WARN : PASS;
+    lines.push(`${icon} ${c.name}`);
+    if (c.detail) lines.push(`  ${c.detail}`);
+    if (!c.ok) {
+      const hint = fixHintForCheck(c.name);
+      if (hint) lines.push(`  \u2192 Fix: ${hint}`);
+    }
+  }
+  const failed = result.checks.filter((c) => !c.ok);
+  const warned = result.checks.filter((c) => c.ok && c.warn);
+  if (failed.length === 0) {
+    if (warned.length > 0) {
+      lines.push(
+        `
+All checks passed with ${warned.length} advisory warning${warned.length === 1 ? "" : "s"}. The CLI is ready.`
+      );
+    } else {
+      lines.push("\nAll checks passed. The CLI is ready.");
+    }
+  } else {
+    lines.push(`
+${failed.length} check${failed.length === 1 ? "" : "s"} failed.`);
+    lines.push("Fix the items above and re-run `mushi doctor`.");
+  }
+  return lines.join("\n");
+}
+
 // src/init.ts
 var ENV_FILES = [".env.local", ".env"];
 var PROJECT_ID_PATTERN = /^(?:proj_[A-Za-z0-9_-]{10,}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
 var API_KEY_PATTERN = /^(mushi_|mush_pk_)[A-Za-z0-9_-]{10,}$/;
 async function runInit(options = {}) {
   const cwd = options.cwd ?? process.cwd();
+  if (options.audit) {
+    await runInitAudit(cwd);
+    return;
+  }
   ensureInteractiveOrBailOut(options);
   p.intro("Mushi setup");
   await printFreshnessHint();
   warnIfWorkspaceRoot(cwd);
   const pkg = readPackageJson(cwd);
+  maybeSuggestAudit(pkg);
   if (!pkg) {
     p.log.warn("No package.json found in this directory.");
     const cont = await p.confirm({
@@ -478,11 +1212,35 @@ async function runInit(options = {}) {
   persistCliConfig(credentials.apiKey, credentials.projectId, endpoint);
   emitWizardFunnelEvent(credentials, endpoint, "wizard_env_written", { framework: framework.id });
   const enableRewards = await maybeEnableRewards(options);
+  await maybeInjectSnippet(cwd, framework, options);
   printNextSteps(framework, consoleBase, enableRewards);
   await maybeSendTestReport(credentials, { ...options, endpoint, consoleBase });
   await maybeOfferConnect(credentials, options, consoleBase);
   p.outro("Setup complete.");
 }
+async function runInitAudit(cwd) {
+  p.intro("Mushi setup audit");
+  const config = loadConfig();
+  const result = await runDoctor(config, { cwd, hostApp: true, mcp: true });
+  p.log.message(formatDoctorResult(result));
+  if (result.ready) {
+    p.outro("Audit complete \u2014 setup looks healthy.");
+  } else {
+    p.outro("Audit found issues \u2014 each FAIL line above has a \u2192 Fix hint. `mushi doctor --fix` applies the safe ones.");
+    process.exitCode = 1;
+  }
+}
+function maybeSuggestAudit(pkg) {
+  const deps = {
+    ...pkg?.dependencies,
+    ...pkg?.devDependencies
+  };
+  if (Object.keys(deps).some((d) => d.startsWith("@mushi-mushi/"))) {
+    p.log.info(
+      "A Mushi SDK is already installed here. To health-check the existing setup instead, run `npx mushi-mushi --audit`."
+    );
+  }
+}
 function ensureInteractiveOrBailOut(options) {
   const isTTY = Boolean(process.stdin.isTTY && process.stdout.isTTY);
   if (isTTY) return;
@@ -651,7 +1409,9 @@ async function runBrowserSignIn(options, endpoint, consoleBase) {
       const createSpin = p.spinner();
       createSpin.start(`Creating "${name.trim()}"\u2026`);
       try {
-        const created = await createProject(endpoint, cliToken, name.trim());
+        const created = await createProject(endpoint, cliToken, name.trim(), {
+          scopes: ["report:write", "mcp:read"]
+        });
         projectId = created.id;
         apiKey = created.apiKey ?? void 0;
         createSpin.stop(`Created project "${created.name}".`);
@@ -668,7 +1428,9 @@ async function runBrowserSignIn(options, endpoint, consoleBase) {
     const keySpin = p.spinner();
     keySpin.start("Minting SDK key\u2026");
     try {
-      apiKey = await mintProjectKey(endpoint, cliToken, projectId);
+      apiKey = await mintProjectKey(endpoint, cliToken, projectId, {
+        scopes: ["report:write", "mcp:read"]
+      });
       keySpin.stop("SDK key ready.");
     } catch (err) {
       keySpin.stop("Could not mint an API key.");
@@ -821,7 +1583,12 @@ async function writeEnvFile(cwd, apiKey, projectId, framework, endpoint, overwri
   const target = ENV_FILES.find((f) => existsSync2(join2(cwd, f))) ?? ENV_FILES[0];
   const targetPath = join2(cwd, target);
   const newVars = envVarsToWrite(apiKey, projectId, framework, endpoint);
-  const existing = existsSync2(targetPath) ? readFileSync2(targetPath, "utf-8") : "";
+  let existing = "";
+  try {
+    existing = readFileSync2(targetPath, "utf-8");
+  } catch {
+    existing = "";
+  }
   if (existing.includes("MUSHI_PROJECT_ID")) {
     let shouldOverwrite = overwrite;
     if (!shouldOverwrite) {
@@ -908,6 +1675,31 @@ function emitWizardFunnelEvent(credentials, endpoint, event, metadata = {}) {
   }).catch(() => {
   });
 }
+async function maybeInjectSnippet(cwd, framework, options) {
+  if (options.yes || !process.stdin.isTTY) return;
+  const { ENTRY_CANDIDATES, injectSnippet, MUSHI_MARKER_START } = await import("./snippet-inject-NDAPEL2T.js");
+  const candidates = ENTRY_CANDIDATES[framework.id];
+  if (!candidates) return;
+  const { readFile, writeFile } = await import("fs/promises");
+  const nodePath = await import("path");
+  for (const rel of candidates) {
+    const abs = nodePath.join(cwd, rel);
+    let source;
+    try {
+      source = await readFile(abs, "utf8");
+    } catch {
+      continue;
+    }
+    const alreadyInjected = source.includes(MUSHI_MARKER_START);
+    const confirmed = await p.confirm({
+      message: alreadyInjected ? `Refresh the Mushi init block in ${rel}?` : `Add the Mushi init snippet to ${rel}? (wrapped in markers; re-runs update in place)`
+    });
+    if (p.isCancel(confirmed) || !confirmed) return;
+    await writeFile(abs, injectSnippet(source, framework.snippet()), "utf8");
+    p.log.success(`${alreadyInjected ? "Updated" : "Added"} Mushi init block in ${rel}`);
+    return;
+  }
+}
 function printNextSteps(framework, consoleBase, enableRewards = false) {
   p.note(framework.snippet(), "Add this to your app:");
   if (enableRewards) {
@@ -941,7 +1733,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect } = await import("./connect-XFWRSEMW.js");
+    const { runConnect } = await import("./connect-PXLW4D64.js");
     await runConnect({
       apiKey: credentials.apiKey,
       projectId: credentials.projectId,