@mushi-mushi/cli 0.27.0 → 0.27.1

package/README.md

@@ -440,4 +440,4 @@ The CLI is also importable for tooling (used by `create-mushi-mushi`):
 MIT
 
 <!-- mushi-readme-stats-footer -->
-<sub>Monorepo scale (July 2026): 55 edge functions · 328 SQL migrations · 13 outbound plugins · 11 inbound adapters · 19 pipeline agents. Canonical counts: <a href="https://github.com/kensaurus/mushi-mushi/blob/master/docs/stats.md">docs/stats.md</a> · <code>pnpm docs-stats</code></sub>
+<sub>Monorepo scale (July 2026): 55 edge functions · 331 SQL migrations · 13 outbound plugins · 11 inbound adapters · 19 pipeline agents. Canonical counts: <a href="https://github.com/kensaurus/mushi-mushi/blob/master/docs/stats.md">docs/stats.md</a> · <code>pnpm docs-stats</code></sub>

package/dist/chunk-DBAEB56N.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+
+// src/version.ts
+var MUSHI_CLI_VERSION = true ? "0.27.1" : "0.0.0-dev";
+var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.20.1";
+
+export {
+  MUSHI_CLI_VERSION,
+  MUSHI_MCP_PIN_SPEC
+};

package/dist/{chunk-TZL3F3GT.js → chunk-M7CDSRZM.js}

@@ -1,6 +1,6 @@
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-LFZ5ZIBI.js";
+} from "./chunk-XLGHUOKY.js";
 import {
   __require
 } from "./chunk-3RG5ZIWI.js";

package/dist/{chunk-7JZUKNN5.js → chunk-NNB2NONG.js}

@@ -2,7 +2,7 @@
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-MXD5UNMP.js";
+} from "./chunk-DBAEB56N.js";
 import {
   CLOUD_API_ENDPOINT,
   assertEndpoint,

package/dist/chunk-XLGHUOKY.js

@@ -0,0 +1,8 @@
+// src/version.ts
+var MUSHI_CLI_VERSION = true ? "0.27.1" : "0.0.0-dev";
+var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.20.1";
+
+export {
+  MUSHI_CLI_VERSION,
+  MUSHI_MCP_PIN_SPEC
+};

package/dist/{connect-FAXWVFG2.js → connect-5EQA7G3U.js}

@@ -4,10 +4,10 @@ import {
   requireUuid,
   saveConfig,
   waitForIngestReady
-} from "./chunk-TZL3F3GT.js";
+} from "./chunk-M7CDSRZM.js";
 import {
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-LFZ5ZIBI.js";
+} from "./chunk-XLGHUOKY.js";
 import {
   detectFramework,
   envVarsToWrite,

package/dist/{connect-QHVFH77E.js → connect-TWO2ZNFB.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   runConnect
-} from "./chunk-7JZUKNN5.js";
-import "./chunk-MXD5UNMP.js";
+} from "./chunk-NNB2NONG.js";
+import "./chunk-DBAEB56N.js";
 import "./chunk-LDPFTQLE.js";
 import "./chunk-PDX44BCA.js";
 export {

package/dist/index.js

@@ -45,11 +45,11 @@ import {
   setGlobalOutputFormat,
   trySaveKeyToKeychain,
   writeMcpServerEntry
-} from "./chunk-7JZUKNN5.js";
+} from "./chunk-NNB2NONG.js";
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-MXD5UNMP.js";
+} from "./chunk-DBAEB56N.js";
 import {
   TEST_REPORT_FETCH_TIMEOUT_MS,
   assertEndpoint,
@@ -1203,7 +1203,7 @@ async function checkOnboardingStatus(config, _consoleBase, cwd, doFetch = global
 }
 async function checkVersionDrift(cwd, doFetch) {
   const checks = [];
-  const { MUSHI_CLI_VERSION: MUSHI_CLI_VERSION2 } = await import("./version-F3ZOPM5F.js");
+  const { MUSHI_CLI_VERSION: MUSHI_CLI_VERSION2 } = await import("./version-AYMUW3UQ.js");
   if (MUSHI_CLI_VERSION2 === "0.0.0-dev") return checks;
   const parse2 = (v) => {
     const m = v.replace(/^[~^]/, "").match(/^(\d+)\.(\d+)\.(\d+)/);
@@ -1969,7 +1969,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect: runConnect2 } = await import("./connect-QHVFH77E.js");
+    const { runConnect: runConnect2 } = await import("./connect-TWO2ZNFB.js");
     await runConnect2({
       apiKey: credentials.apiKey,
       projectId: credentials.projectId,
@@ -4844,10 +4844,7 @@ function registerKeysCommands(program2) {
       console.error("Run `mushi login` first");
       process.exit(1);
     }
-    const res = await apiCall(
-      `/v1/admin/byok/keys?project_id=${encodeURIComponent(config.projectId)}`,
-      config
-    );
+    const res = await apiCall(`/v1/admin/byok/keys?project_id=${encodeURIComponent(config.projectId)}`, config);
     if (!res.ok) {
       console.error(`Error: ${res.error.message}`);
       process.exit(1);
@@ -4855,13 +4852,31 @@ function registerKeysCommands(program2) {
     printResult(res.data, {
       json: opts.json,
       render(d) {
-        if (d.keys.length === 0) {
+        const legacyKeys = d.legacyKeys ?? [];
+        if (d.keys.length === 0 && legacyKeys.length === 0) {
           console.log("No keys configured.");
           return;
         }
         for (const k of d.keys) {
           const cooldown = k.cooldown_until && new Date(k.cooldown_until) > /* @__PURE__ */ new Date() ? ` [cooldown until ${new Date(k.cooldown_until).toLocaleTimeString()}]` : "";
-          console.log(`${k.provider_slug.padEnd(14)} [${k.status}] p=${k.priority} ${k.label ?? "(no label)"}${cooldown} \u2014 ${k.id}`);
+          const validation = k.test_status ? ` test=${k.test_status}` : " test=required";
+          const lastTested = k.last_tested_at ? ` tested=${new Date(k.last_tested_at).toISOString()}` : "";
+          const lastUsed = k.last_used_at ? ` used=${new Date(k.last_used_at).toISOString()}` : "";
+          const baseUrl = k.base_url ? ` base=${k.base_url}` : "";
+          const hint = k.key_hint ? ` hint=${k.key_hint}` : "";
+          console.log(
+            `${k.provider_slug.padEnd(14)} [${k.status}]${validation} p=${k.priority} ${k.label ?? "(no label)"}${hint}${baseUrl}${cooldown}${lastTested}${lastUsed} created=${new Date(k.created_at).toISOString()} \u2014 ${k.id}`
+          );
+        }
+        for (const k of legacyKeys) {
+          const validation = k.test_status ? ` test=${k.test_status}` : " test=required";
+          const lastTested = k.last_tested_at ? ` tested=${new Date(k.last_tested_at).toISOString()}` : "";
+          const lastUsed = k.last_used_at ? ` used=${new Date(k.last_used_at).toISOString()}` : "";
+          const created = k.created_at ? ` created=${new Date(k.created_at).toISOString()}` : "";
+          const hint = k.key_hint ? ` hint=${k.key_hint}` : "";
+          console.log(
+            `${k.provider_slug.padEnd(14)} [${k.status}]${validation} legacy${hint}${lastTested}${lastUsed}${created} \u2014 manage in the console`
+          );
         }
       }
     });
@@ -4912,41 +4927,108 @@ function registerKeysCommands(program2) {
       ).catch(() => null);
       serverRevoked = revokeResult?.revoked === 1;
     }
-    printResult({ newPrefix: newKey.slice(0, 12), oldPrefix, serverRevoked }, {
-      json: opts.json,
-      render(d) {
-        console.log(`\u2713 Key rotated.`);
-        console.log(`  Old prefix: ${d.oldPrefix}\u2026  \u2192  New prefix: ${d.newPrefix}\u2026`);
-        console.log(`  New key saved to local config.`);
-        if (d.serverRevoked) {
-          console.log(`  \u2713 Old key revoked on the server.`);
-        } else {
-          console.log(`  \u2139  Old key may still be active \u2014 revoke it at: ${config.consoleUrl ?? "your Mushi console"} \u2192 Settings \u2192 API Keys`);
+    printResult(
+      { newPrefix: newKey.slice(0, 12), oldPrefix, serverRevoked },
+      {
+        json: opts.json,
+        render(d) {
+          console.log(`\u2713 Key rotated.`);
+          console.log(`  Old prefix: ${d.oldPrefix}\u2026  \u2192  New prefix: ${d.newPrefix}\u2026`);
+          console.log(`  New key saved to local config.`);
+          if (d.serverRevoked) {
+            console.log(`  \u2713 Old key revoked on the server.`);
+          } else {
+            console.log(
+              `  \u2139  Old key may still be active \u2014 revoke it at: ${config.consoleUrl ?? "your Mushi console"} \u2192 Settings \u2192 API Keys`
+            );
+          }
         }
       }
-    });
+    );
   });
-  keys.command("add").description("Add a new API key to the pool").requiredOption("--provider <p>", "Provider: anthropic, openai, firecrawl, browserbase, cursor").option("--key <k>", "The API key value (prefer the MUSHI_BYOK_KEY env var to keep it out of shell history)").option("--label <l>", "Human-readable label").option("--priority <n>", "Priority (lower = higher priority)", "100").action(async (opts) => {
+  keys.command("add").description("Add a new API key to the pool").requiredOption("--provider <p>", "Provider: anthropic, openai, firecrawl, browserbase, cursor").option(
+    "--key <k>",
+    "The API key value (prefer the MUSHI_BYOK_KEY env var to keep it out of shell history)"
+  ).option("--label <l>", "Human-readable label").option("--priority <n>", "Priority (lower = higher priority)", "100").option("--base-url <url>", "Allow-listed OpenAI-compatible HTTPS base URL").action(
+    async (opts) => {
+      const config = loadConfig();
+      if (!config.apiKey || !config.projectId) {
+        console.error("Run `mushi login` first");
+        process.exit(1);
+      }
+      const key = process.env.MUSHI_BYOK_KEY ?? opts.key;
+      if (!key) {
+        console.error(
+          "Provide the key via the MUSHI_BYOK_KEY env var (recommended) or --key <value>."
+        );
+        process.exit(1);
+      }
+      const priority = Number(opts.priority);
+      if (!Number.isInteger(priority) || priority < 0 || priority > 1e4) {
+        console.error("Priority must be an integer between 0 and 10000.");
+        process.exit(1);
+      }
+      const res = await apiCall("/v1/admin/byok/keys", config, {
+        method: "POST",
+        body: JSON.stringify({
+          project_id: config.projectId,
+          provider_slug: opts.provider,
+          key,
+          label: opts.label,
+          priority,
+          base_url: opts.baseUrl
+        })
+      });
+      if (!res.ok) {
+        console.error(`Error: ${res.error.message}`);
+        process.exit(1);
+      }
+      if (res.data.validation.status === "ok") {
+        console.log(`\u2713 Key validated and active \u2014 id: ${res.data.id}`);
+        return;
+      }
+      console.log(
+        `! Key saved but quarantined (${res.data.validation.status}) \u2014 id: ${res.data.id}`
+      );
+      console.log(`  ${res.data.validation.detail}`);
+    }
+  );
+  keys.command("test <key-id>").description("Re-test one pooled key and activate it only if validation passes").action(async (keyId) => {
     const config = loadConfig();
     if (!config.apiKey || !config.projectId) {
       console.error("Run `mushi login` first");
       process.exit(1);
     }
-    const key = process.env.MUSHI_BYOK_KEY ?? opts.key;
-    if (!key) {
-      console.error("Provide the key via the MUSHI_BYOK_KEY env var (recommended) or --key <value>.");
+    const res = await apiCall(`/v1/admin/byok/keys/${encodeURIComponent(keyId)}/test`, config, { method: "POST" });
+    if (!res.ok) {
+      console.error(`Error: ${res.error.message}`);
+      process.exit(1);
+    }
+    if (res.data.validation.status === "ok") {
+      console.log(`\u2713 Key validated and active \u2014 id: ${res.data.key.id}`);
+      return;
+    }
+    console.log(
+      `! Key remains quarantined (${res.data.validation.status}) \u2014 id: ${res.data.key.id}`
+    );
+    console.log(`  ${res.data.validation.detail}`);
+  });
+  keys.command("remove <key-id>").description("Permanently remove one pooled key and its Vault secret").action(async (keyId) => {
+    const config = loadConfig();
+    if (!config.apiKey || !config.projectId) {
+      console.error("Run `mushi login` first");
       process.exit(1);
     }
     const res = await apiCall(
-      "/v1/admin/byok/keys",
+      `/v1/admin/byok/keys/${encodeURIComponent(keyId)}`,
       config,
-      { method: "POST", body: JSON.stringify({ project_id: config.projectId, provider_slug: opts.provider, key, label: opts.label, priority: parseInt(opts.priority, 10) }) }
+      { method: "DELETE" }
     );
     if (!res.ok) {
       console.error(`Error: ${res.error.message}`);
       process.exit(1);
     }
-    console.log(`\u2713 Key added \u2014 id: ${res.data.id}`);
+    console.log(`\u2713 Key removed \u2014 id: ${res.data.keyId}`);
   });
 }
 

package/dist/init.js

@@ -19,10 +19,10 @@ import {
   sanitizeCliCredentials,
   sanitizeEndpoint,
   saveConfig
-} from "./chunk-TZL3F3GT.js";
+} from "./chunk-M7CDSRZM.js";
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-LFZ5ZIBI.js";
+} from "./chunk-XLGHUOKY.js";
 import {
   FRAMEWORKS,
   detectFramework,
@@ -1803,7 +1803,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect } = await import("./connect-FAXWVFG2.js");
+    const { runConnect } = await import("./connect-5EQA7G3U.js");
     await runConnect({
       apiKey: credentials.apiKey,
       projectId: credentials.projectId,

package/dist/{version-F3ZOPM5F.js → version-AYMUW3UQ.js}

@@ -2,7 +2,7 @@
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-MXD5UNMP.js";
+} from "./chunk-DBAEB56N.js";
 import "./chunk-PDX44BCA.js";
 export {
   MUSHI_CLI_VERSION,

package/dist/version.d.ts

@@ -14,6 +14,6 @@ declare const MUSHI_CLI_VERSION: string;
  * setup refreshes the pin. Synced to packages/mcp/package.json by
  * `scripts/sync-mcp-pin.mjs` — never hand-edit the version.
  */
-declare const MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.20.0";
+declare const MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.20.1";
 
 export { MUSHI_CLI_VERSION, MUSHI_MCP_PIN_SPEC };

package/dist/version.js

@@ -1,7 +1,7 @@
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-LFZ5ZIBI.js";
+} from "./chunk-XLGHUOKY.js";
 import "./chunk-3RG5ZIWI.js";
 export {
   MUSHI_CLI_VERSION,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mushi-mushi/cli",
-  "version": "0.27.0",
+  "version": "0.27.1",
   "license": "MIT",
   "description": "CLI for Mushi Mushi — `mushi init` wizard installs the right SDK for your framework, plus report triage and pipeline health commands",
   "bin": {

package/dist/chunk-LFZ5ZIBI.js

@@ -1,8 +0,0 @@
-// src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.27.0" : "0.0.0-dev";
-var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.20.0";
-
-export {
-  MUSHI_CLI_VERSION,
-  MUSHI_MCP_PIN_SPEC
-};

package/dist/chunk-MXD5UNMP.js

@@ -1,10 +0,0 @@
-#!/usr/bin/env node
-
-// src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.27.0" : "0.0.0-dev";
-var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.20.0";
-
-export {
-  MUSHI_CLI_VERSION,
-  MUSHI_MCP_PIN_SPEC
-};