@mutagent/cli 0.1.396 → 0.1.398

package/dist/index.js

@@ -425,116 +425,357 @@ var init_config = __esm(() => {
   CREDENTIALS_FILE = join(CREDENTIALS_DIR, "credentials.json");
 });
 
-// src/lib/errors.ts
-function createErrorFromUnknown(error) {
-  if (error instanceof MutagentError) {
-    return error;
+// src/lib/command-path.ts
+function commandPathOf(command) {
+  const names = [];
+  for (let current = command;current.parent; current = current.parent) {
+    names.unshift(current.name());
   }
-  if (error instanceof Error) {
-    return new MutagentError("UNKNOWN_ERROR", error.message, undefined, 1);
-  }
-  return new MutagentError("UNKNOWN_ERROR", typeof error === "string" ? error : "An unknown error occurred", undefined, 1);
+  return names.join(" ");
 }
-function handleError(error, isJson) {
-  if (error instanceof MutagentError) {
-    if (isJson) {
-      const jsonOutput = error.toJSON();
-      if (error instanceof AuthenticationError) {
-        jsonOutput.remediation = {
-          interactive: "mutagent auth login --browser",
-          nonInteractive: "export MUTAGENT_API_KEY=<your-key>",
-          ciCd: "mutagent auth login --api-key <key>"
-        };
-      }
-      if (error instanceof WorkspaceContextError) {
-        jsonOutput.remediation = {
-          setWorkspace: "mutagent workspaces use <name>",
-          listWorkspaces: "mutagent workspaces list"
-        };
-      }
-      if (error instanceof ApiError && error.statusCode === 403) {
-        jsonOutput.remediation = {
-          interactive: "mutagent auth login --browser",
-          nonInteractive: "export MUTAGENT_API_KEY=<your-key>",
-          checkPermissions: "Verify your API key has the required permissions"
-        };
+function setRunningCommandPath(path) {
+  runningPath = path;
+}
+function runningHelpCommand() {
+  return runningPath ? `mutagent ${runningPath} --help` : "mutagent --help";
+}
+var runningPath;
+
+// src/lib/output.ts
+import chalk from "chalk";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
+function setCliVersion(version) {
+  _globalCliVersion = version;
+  _compatCache = null;
+}
+function getCliVersion() {
+  return _globalCliVersion;
+}
+function getCompatMetadata(cliVersion = _globalCliVersion) {
+  if (_compatCache !== null)
+    return _compatCache;
+  let skillVersion = "unknown";
+  let skillMinCliVersion = "unknown";
+  try {
+    const candidatePaths = [
+      join2(process.cwd(), ".claude", "skills", "mutagent-cli", "SKILL.md"),
+      join2(process.cwd(), "mutagent-cli", ".claude", "skills", "mutagent-cli", "SKILL.md")
+    ];
+    for (const p of candidatePaths) {
+      if (existsSync2(p)) {
+        const content = readFileSync2(p, "utf-8");
+        const verMatch = /^\s+skill_version:\s+"?([^"\n]+)"?\s*$/m.exec(content);
+        const minMatch = /^\s+skill_min_cli_version:\s+"?([^"\n]+)"?\s*$/m.exec(content);
+        if (/^metadata:/m.test(content) && !verMatch && !minMatch) {
+          throw new Error("Bundled SKILL.md is missing metadata.skill_version / skill_min_cli_version" + " — re-run `bun run sync-skill` to regenerate.");
+        }
+        if (verMatch?.[1])
+          skillVersion = verMatch[1].trim();
+        if (minMatch?.[1])
+          skillMinCliVersion = minMatch[1].trim();
+        break;
       }
-      if (error.suggestion) {
-        const helpMatch = /^Run:\s+(mutagent\s+[^\n]+--help)/.exec(error.suggestion);
-        const helpCommand = helpMatch ? helpMatch[1] : "mutagent --help";
-        jsonOutput._agentGuidance = {
-          helpCommand,
-          suggestion: error.suggestion
+    }
+  } catch (err) {
+    if (err instanceof Error && err.message.startsWith("Bundled SKILL.md is missing")) {
+      throw err;
+    }
+  }
+  _compatCache = { cliVersion, skillVersion, skillMinCliVersion };
+  return _compatCache;
+}
+function getJsonFlag(command) {
+  if (!command)
+    return false;
+  const parentOpts = command.parent ? command.parent.opts() : null;
+  const ownOpts = command.opts();
+  return Boolean(parentOpts?.json ?? ownOpts.json);
+}
+function startJsonLines() {
+  jsonLines = true;
+}
+function jsonText(value) {
+  return jsonLines ? JSON.stringify(value) : JSON.stringify(value, null, 2);
+}
+function withSuccess(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    return value;
+  if ("success" in value)
+    return value;
+  return { success: true, ...value };
+}
+
+class OutputFormatter {
+  format;
+  constructor(format) {
+    this.format = format;
+  }
+  output(data) {
+    const clean = scrubKnownSuccessDeep(data);
+    if (this.format === "json") {
+      let enriched = withSuccess(clean);
+      if (_globalCliVersion !== "0.0.0" && clean !== null && typeof clean === "object" && !Array.isArray(clean) && "_directive" in clean) {
+        enriched = {
+          ...enriched,
+          _compat: getCompatMetadata(_globalCliVersion)
         };
       }
-      console.log(JSON.stringify(scrubKnownDeep(jsonOutput), null, 2));
+      console.log(jsonText(enriched));
     } else {
-      console.error(`Error: ${scrubKnown(error.message)}`);
-      if (error.name === "TenancyError") {} else if (error instanceof AuthenticationError) {
-        console.error("");
-        console.error(AUTH_REMEDIATION_MESSAGE);
-      } else if (error instanceof WorkspaceContextError) {
-        console.error("");
-        console.error(WORKSPACE_REMEDIATION_MESSAGE);
-      } else if (error instanceof ApiError && error.statusCode === 403) {
-        console.error("");
-        console.error("Access denied. To fix:");
-        console.error("  mutagent auth login --browser    # Re-authenticate");
-        console.error("  export MUTAGENT_API_KEY=mt_xxx   # Or use a different API key");
-      } else if (error instanceof ValidationError) {
-        if (error.suggestion) {
-          console.error(`Suggestion: ${scrubKnown(error.suggestion)}`);
-        }
-        console.error("");
-        console.error("Run `mutagent <command> --help` for usage information.");
-      } else if (error.suggestion) {
-        console.error(`Suggestion: ${scrubKnown(error.suggestion)}`);
-      }
-      if (error.code === "MISSING_ARGUMENTS" || error.code === "INVALID_ARGUMENTS" || error.code === "INVALID_INPUT") {
-        console.error("");
-        console.error("Run `mutagent <command> --help` for usage information.");
-      }
+      this.formatTable(clean);
+    }
+  }
+  formatTable(data) {
+    if (Array.isArray(data)) {
+      this.formatArray(data);
+    } else if (data && typeof data === "object") {
+      this.formatObject(data);
+    } else {
+      console.log(data);
+    }
+  }
+  formatArray(data) {
+    if (data.length === 0) {
+      console.log(chalk.gray("No results"));
+      return;
+    }
+    const firstItem = data[0];
+    if (!firstItem || typeof firstItem !== "object") {
+      data.forEach((item) => {
+        console.log(`  ${String(item)}`);
+      });
+      return;
     }
-    process.exit(error.exitCode);
-  }
-  if (error && typeof error === "object") {
-    const sdkErr = error;
-    if (sdkErr.name === "SDKValidationError" || sdkErr.name === "SDKError" || sdkErr.rawValue !== undefined || sdkErr.rawMessage !== undefined) {
-      const friendlyMessage = scrubKnown(sdkErr.rawMessage ?? sdkErr.message ?? "Request failed");
-      const wrapped = new MutagentError("REQUEST_FAILED", friendlyMessage, "Check your input and try again. Run the command with --help for usage details.");
-      if (isJson) {
-        console.log(JSON.stringify(wrapped.toJSON(), null, 2));
+    const keys = Object.keys(firstItem);
+    const toDisplayString = (val) => {
+      if (val === null || val === undefined)
+        return "";
+      if (typeof val === "object")
+        return JSON.stringify(val);
+      if (typeof val === "string")
+        return val;
+      if (typeof val === "number" || typeof val === "boolean" || typeof val === "bigint") {
+        return val.toString();
+      }
+      return JSON.stringify(val);
+    };
+    const widths = {};
+    keys.forEach((key) => {
+      widths[key] = Math.max(key.length, ...data.map((item) => toDisplayString(item[key]).length));
+    });
+    const header = keys.map((key) => chalk.bold(key.toUpperCase().padEnd(widths[key] ?? 10))).join("  ");
+    console.log(header);
+    console.log(keys.map((key) => "-".repeat(widths[key] ?? 10)).join("  "));
+    data.forEach((item) => {
+      const row = keys.map((key) => {
+        const value = toDisplayString(item[key]);
+        const width = widths[key] ?? 10;
+        return value.padEnd(width).slice(0, width);
+      }).join("  ");
+      console.log(row);
+    });
+    console.log(chalk.gray(`
+${String(data.length)} result(s)`));
+  }
+  formatObject(data) {
+    const maxKeyLength = Math.max(...Object.keys(data).map((k) => k.length));
+    Object.entries(data).forEach(([key, value]) => {
+      const formattedKey = chalk.bold(key.padEnd(maxKeyLength));
+      let formattedValue;
+      if (value === null || value === undefined) {
+        formattedValue = "";
+      } else if (typeof value === "object") {
+        formattedValue = JSON.stringify(value, null, 2);
+      } else if (typeof value === "string") {
+        formattedValue = value;
+      } else if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+        formattedValue = value.toString();
       } else {
-        console.error(`Error: ${wrapped.message}`);
-        if (wrapped.suggestion) {
-          console.error(`Suggestion: ${wrapped.suggestion}`);
-        }
+        formattedValue = JSON.stringify(value);
       }
-      process.exit(1);
+      console.log(`${formattedKey}  ${formattedValue}`);
+    });
+  }
+  success(message) {
+    const text = scrubKnownSuccess(message);
+    if (this.format === "json") {
+      console.log(JSON.stringify({ success: true, message: text }, null, 2));
+    } else {
+      console.log(chalk.green(`✓ ${text}`));
+    }
+  }
+  error(message, code, suggestedAction) {
+    const text = scrubKnownSuccess(message);
+    const action = suggestedAction === undefined ? undefined : scrubKnownSuccess(suggestedAction);
+    if (this.format === "json") {
+      const result = { success: false, error: text };
+      if (code)
+        result.code = code;
+      if (action)
+        result.suggestedAction = action;
+      console.log(JSON.stringify(result, null, 2));
+    } else {
+      console.log(chalk.red(`✗ ${text}`));
+    }
+  }
+  info(message) {
+    if (this.format !== "json") {
+      console.log(chalk.blue(`ℹ ${scrubKnownSuccess(message)}`));
     }
   }
-  const message = error instanceof Error ? scrubKnown(error.message) : "Unknown error";
+  warn(message) {
+    const text = scrubKnownSuccess(message);
+    if (this.format === "json") {
+      console.log(JSON.stringify({ warning: text }, null, 2));
+    } else {
+      console.log(chalk.yellow(`⚠ ${text}`));
+    }
+  }
+}
+function createSpinner(text, isJson) {
+  if (isJson || !process.stderr.isTTY || process.env.CI === "true") {
+    const noop = () => {
+      return;
+    };
+    return {
+      start: noop,
+      stop: noop,
+      succeed: noop,
+      fail: noop
+    };
+  }
+  const start = async () => {
+    const { default: ora } = await import("ora");
+    return ora(text).start();
+  };
+  return { start };
+}
+var _compatCache = null, _globalCliVersion = "0.0.0", jsonLines = false;
+var init_output = __esm(() => {
+  init_known_secrets();
+});
+
+// src/lib/errors.ts
+function exitCodeFor(code) {
+  if (KEY_REJECTED_CODES.has(code))
+    return EXIT_CODES.keyExpiredOrInvalid;
+  if (NOT_SIGNED_IN_CODES.has(code))
+    return EXIT_CODES.notSignedInOrNoWorkspace;
+  return EXIT_CODES.failure;
+}
+function createErrorFromUnknown(error) {
+  if (error instanceof MutagentError) {
+    return error;
+  }
+  const message = error instanceof Error ? error.message : typeof error === "string" ? error : "An unknown error occurred";
+  return new MutagentError("UNKNOWN_ERROR", message);
+}
+function runnableCommand(suggestion) {
+  const line = suggestion?.replace(/^(Run|See|To switch):\s+/, "").trim();
+  return line !== undefined && /^mutagent [^\s]/.test(line) && !/[\n:]|\s\(/.test(line) ? line : undefined;
+}
+function agentGuidance(error, own) {
+  const command = runnableCommand(error.suggestion);
+  const helpMatch = error.suggestion === undefined ? null : /^Run:\s+(mutagent\s+[^\n]+--help)$/.exec(error.suggestion);
+  const signIn = error.exitCode !== EXIT_CODES.failure && error.code !== "WORKSPACE_REQUIRED";
+  return {
+    helpCommand: helpMatch?.[1] ?? runningHelpCommand(),
+    suggestion: error.suggestion,
+    fix: command === undefined ? [] : [command],
+    notes: command === undefined && error.suggestion !== undefined ? [error.suggestion] : [],
+    ...signIn ? { escalate: SIGN_IN_ESCALATION } : {},
+    ...own !== null && typeof own === "object" ? own : {}
+  };
+}
+function errorBody(error) {
+  const body = { ...error.toJSON() };
+  if (error instanceof AuthenticationError)
+    body.remediation = { ...AUTH_REMEDIATION };
+  if (error instanceof WorkspaceContextError) {
+    body.remediation = { setWorkspace: "mutagent workspaces use <name>", listWorkspaces: "mutagent workspaces list" };
+  }
+  if (error instanceof ApiError && error.statusCode === 403) {
+    body.remediation = {
+      interactive: SIGN_IN_COMMAND,
+      nonInteractive: "export MUTAGENT_API_KEY=<your-key>",
+      checkPermissions: "Verify your API key has the required permissions"
+    };
+  }
+  const guidance = agentGuidance(error, body._agentGuidance);
+  body._agentGuidance = guidance;
+  if (typeof body.suggestedAction !== "string" || body.suggestedAction === "") {
+    body.suggestedAction = `Run: ${String(guidance.helpCommand)}`;
+  }
+  return body;
+}
+function printHuman(error) {
+  console.error(`Error: ${scrubKnown(error.message)}`);
+  if (error.name === "TenancyError") {} else if (error instanceof AuthenticationError && error.code === "AUTH_REQUIRED") {
+    console.error("");
+    console.error(AUTH_REMEDIATION_MESSAGE);
+  } else if (error instanceof WorkspaceContextError) {
+    console.error("");
+    console.error(WORKSPACE_REMEDIATION_MESSAGE);
+  } else if (error instanceof ApiError && error.statusCode === 403) {
+    console.error("");
+    console.error("Access denied. To fix:");
+    console.error(`  ${SIGN_IN_COMMAND}             # Re-authenticate`);
+    console.error("  export MUTAGENT_API_KEY=mg_live_...  # Or use a different API key");
+  } else if (error.suggestion) {
+    console.error(`Suggestion: ${scrubKnown(error.suggestion)}`);
+  }
+  const usage = ["MISSING_ARGUMENTS", "INVALID_ARGUMENTS", "INVALID_INPUT", "VALIDATION_ERROR", "UNKNOWN_OPTION", "UNKNOWN_COMMAND"];
+  if (usage.includes(error.code) && !(error.suggestion ?? "").includes(runningHelpCommand())) {
+    console.error("");
+    console.error(`Run \`${runningHelpCommand()}\` for usage information.`);
+  }
+}
+function asSdkError(error) {
+  if (!error || typeof error !== "object")
+    return;
+  const sdkErr = error;
+  if (sdkErr.name !== "SDKValidationError" && sdkErr.name !== "SDKError" && sdkErr.rawValue === undefined && sdkErr.rawMessage === undefined) {
+    return;
+  }
+  return new MutagentError("REQUEST_FAILED", scrubKnown(sdkErr.rawMessage ?? sdkErr.message ?? "Request failed"), "Check your input and try again. Run the command with --help for usage details.");
+}
+function toFailure(error) {
+  return error instanceof MutagentError ? error : asSdkError(error) ?? new MutagentError("UNKNOWN_ERROR", error instanceof Error ? scrubKnown(error.message) : "Unknown error", 'If it keeps happening, report it: mutagent feedback send "<what happened>" --category cli');
+}
+function handleError(error, isJson) {
+  const failure = toFailure(error);
   if (isJson) {
-    console.log(JSON.stringify({ success: false, error: message, code: "UNKNOWN_ERROR" }, null, 2));
+    console.log(jsonText(scrubKnownDeep(errorBody(failure))));
   } else {
-    console.error(`Error: ${message}`);
+    printHuman(failure);
   }
-  process.exit(1);
+  process.exit(failure.exitCode);
 }
-var MutagentError, AUTH_REMEDIATION_MESSAGE, AuthenticationError, ApiError, WORKSPACE_REMEDIATION_MESSAGE, WorkspaceContextError, ValidationError, NetworkError, RateLimitError, NotFoundError;
+var EXIT_CODES, KEY_REJECTED_CODES, NOT_SIGNED_IN_CODES, EXIT_CODES_LINE = "Exit codes: 0 success · 1 failure (usage errors included) · 2 key expired or invalid · 3 not signed in or no workspace", MutagentError, SIGN_IN_COMMAND = "mutagent login --browser", SIGN_IN_WITH_KEY = "export MUTAGENT_API_KEY=<key>, then: mutagent login --json", AUTH_REMEDIATION_MESSAGE, AUTH_REMEDIATION, AuthenticationError, ApiError, WORKSPACE_REMEDIATION_MESSAGE, WorkspaceContextError, ValidationError, NetworkError, RateLimitError, NotFoundError, SIGN_IN_ESCALATION = "Signing in needs a person at a browser, or a MUTAGENT_API_KEY from them.";
 var init_errors = __esm(() => {
   init_known_secrets();
+  init_output();
+  EXIT_CODES = {
+    success: 0,
+    failure: 1,
+    keyExpiredOrInvalid: 2,
+    notSignedInOrNoWorkspace: 3
+  };
+  KEY_REJECTED_CODES = new Set(["AUTH_EXPIRED", "INVALID_API_KEY", "FOREIGN_API_KEY", "API_401", "SANDBOX_TOKEN_REFUSED"]);
+  NOT_SIGNED_IN_CODES = new Set(["AUTH_REQUIRED", "WORKSPACE_REQUIRED"]);
   MutagentError = class MutagentError extends Error {
     code;
     suggestion;
-    exitCode;
-    constructor(code, message, suggestion, exitCode = 1) {
+    constructor(code, message, suggestion) {
       super(message);
       this.code = code;
       this.suggestion = suggestion;
-      this.exitCode = exitCode;
       this.name = "MutagentError";
     }
+    get exitCode() {
+      return exitCodeFor(this.code);
+    }
     toJSON() {
       return {
         success: false,
@@ -546,29 +787,34 @@ var init_errors = __esm(() => {
   };
   AUTH_REMEDIATION_MESSAGE = [
     "Authentication required. Options:",
-    "  Interactive:     mutagent auth login --browser",
+    `  Interactive:     ${SIGN_IN_COMMAND}`,
     "  Non-interactive: export MUTAGENT_API_KEY=<your-key>",
-    "  CI/CD:           mutagent auth login --api-key <key>"
+    `  CI/CD:           ${SIGN_IN_WITH_KEY}`
   ].join(`
 `);
+  AUTH_REMEDIATION = {
+    interactive: SIGN_IN_COMMAND,
+    nonInteractive: "export MUTAGENT_API_KEY=<your-key>",
+    ciCd: SIGN_IN_WITH_KEY
+  };
   AuthenticationError = class AuthenticationError extends MutagentError {
     suggestions;
     cause;
     constructor(message, options = {}) {
-      super("AUTH_REQUIRED", message ?? 'Authentication required. Please run "mutagent auth login"', options.suggestions ? options.suggestions[0] : "Run: mutagent auth login --browser", 2);
+      const suggestion = options.suggestions ? options.suggestions[0] : `Run: ${SIGN_IN_COMMAND}`;
+      super("AUTH_REQUIRED", message ?? "Not signed in. Run: mutagent login", suggestion);
       this.suggestions = options.suggestions ?? [
-        "mutagent auth login --browser",
+        SIGN_IN_COMMAND,
         "export MUTAGENT_API_KEY=<your-key>",
-        "mutagent auth login --api-key <key>"
+        SIGN_IN_WITH_KEY
       ];
-      this.suggestion = options.suggestions ? options.suggestions[0] : "Run: mutagent auth login --browser";
       this.cause = options.cause;
     }
   };
   ApiError = class ApiError extends MutagentError {
     statusCode;
     constructor(status, message) {
-      super(`API_${String(status)}`, scrubKnown(message), status === 401 ? "Check your API key with: mutagent auth status" : undefined, 1);
+      super(`API_${String(status)}`, scrubKnown(message), status === 401 ? "Check your API key with: mutagent auth status" : undefined);
       this.statusCode = status;
     }
   };
@@ -580,19 +826,19 @@ var init_errors = __esm(() => {
 `);
   WorkspaceContextError = class WorkspaceContextError extends MutagentError {
     constructor(message) {
-      super("WORKSPACE_REQUIRED", message ?? "Workspace context is required but not configured", "Run: mutagent workspaces use <name>", 3);
+      super("WORKSPACE_REQUIRED", message ?? "Workspace context is required but not configured", "Run: mutagent workspaces use <name>");
     }
   };
   ValidationError = class ValidationError extends MutagentError {
     constructor(message) {
-      super("VALIDATION_ERROR", message, "Check the command syntax with: mutagent <command> --help", 1);
+      super("VALIDATION_ERROR", message, "Check the command syntax with: mutagent <command> --help");
     }
   };
   NetworkError = class NetworkError extends MutagentError {
     url;
     statusCode;
     constructor(message = "Network error", url, statusCode) {
-      super("NETWORK_ERROR", message, "Check your internet connection and verify the server URL", 5);
+      super("NETWORK_ERROR", message, "Check your internet connection and verify the server URL");
       this.url = url;
       this.statusCode = statusCode;
     }
@@ -604,12 +850,208 @@ var init_errors = __esm(() => {
       this.code = "RATE_LIMIT_ERROR";
       this.suggestion = retryAfter ? `Wait ${String(retryAfter)} seconds before retrying` : "Wait a few seconds before retrying";
       this.retryAfter = retryAfter;
-      this.exitCode = 6;
     }
   };
   NotFoundError = class NotFoundError extends MutagentError {
-    constructor(resource, id) {
-      super("NOT_FOUND", `${resource} not found: ${id}`, `Check the ID and try again. List available ${resource.toLowerCase()}s with the appropriate list command.`, 1);
+    constructor(resource, id, listCommand) {
+      super("NOT_FOUND", `${resource} not found: ${id}`, listCommand === undefined ? `Check the ID and try again. List available ${resource.toLowerCase()}s with the appropriate list command.` : `Run: ${listCommand}`);
+    }
+  };
+});
+
+// src/lib/secret-scan.ts
+function foreignCredential(key) {
+  const hit = FOREIGN_KEY_PREFIXES.find((family) => family.prefix.test(key));
+  if (hit === undefined)
+    return;
+  const label = PATTERNS.find((pattern) => pattern.kind === hit.kind)?.label ?? "credential from another service";
+  return { kind: hit.kind, label };
+}
+function hasCredentialEntropy(candidate) {
+  if (candidate.length < 16)
+    return false;
+  const distinct = new Set(candidate).size;
+  if (distinct < 8)
+    return false;
+  return !/(.)\1{7,}/.test(candidate);
+}
+function maskSecret(secret) {
+  const head = secret.slice(0, 6);
+  return `${head}${"*".repeat(Math.min(12, Math.max(4, secret.length - head.length)))}`;
+}
+function collectHits(content) {
+  const accepted = [];
+  const overlaps = (start, end) => accepted.some((hit) => start < hit.end && end > hit.start);
+  for (const pattern of PATTERNS) {
+    const regex = new RegExp(pattern.regex.source, pattern.regex.flags);
+    let match;
+    while ((match = regex.exec(content)) !== null) {
+      if (match[0].length === 0) {
+        regex.lastIndex += 1;
+        continue;
+      }
+      const captured = match[1];
+      const secret = captured ?? match[0];
+      const start = captured === undefined ? match.index : match.index + match[0].indexOf(captured);
+      const end = start + secret.length;
+      const exemptFromEntropy = pattern.kind === "private-key";
+      if (!exemptFromEntropy && !hasCredentialEntropy(secret))
+        continue;
+      if (overlaps(start, end))
+        continue;
+      accepted.push({ kind: pattern.kind, label: pattern.label, start, end, secret });
+    }
+  }
+  return accepted.sort((a, b) => a.start - b.start);
+}
+function lineOf(content, offset) {
+  let line = 1;
+  for (let i = 0;i < offset && i < content.length; i++) {
+    if (content[i] === `
+`)
+      line++;
+  }
+  return line;
+}
+function redactSecrets(content) {
+  if (!content)
+    return { content, matches: [] };
+  const hits = collectHits(content);
+  if (hits.length === 0)
+    return { content, matches: [] };
+  let out = "";
+  let cursor = 0;
+  for (const hit of hits) {
+    out += content.slice(cursor, hit.start);
+    out += `[REDACTED:${hit.kind}]`;
+    cursor = hit.end;
+  }
+  out += content.slice(cursor);
+  return {
+    content: out,
+    matches: hits.map((hit) => ({
+      kind: hit.kind,
+      label: hit.label,
+      line: lineOf(content, hit.start),
+      preview: maskSecret(hit.secret)
+    }))
+  };
+}
+var PATTERNS, FOREIGN_KEY_PREFIXES;
+var init_secret_scan = __esm(() => {
+  PATTERNS = [
+    {
+      kind: "private-key",
+      label: "Private key block",
+      regex: /-----BEGIN(?: [A-Z]+)* PRIVATE KEY-----[\s\S]*?-----END(?: [A-Z]+)* PRIVATE KEY-----/g
+    },
+    {
+      kind: "anthropic-api-key",
+      label: "Anthropic API key",
+      regex: /sk-ant-[A-Za-z0-9_-]{16,}/g
+    },
+    {
+      kind: "openai-api-key",
+      label: "OpenAI API key",
+      regex: /sk-(?!ant-)(?:proj-)?[A-Za-z0-9_-]{20,}/g
+    },
+    {
+      kind: "aws-access-key-id",
+      label: "AWS access key ID",
+      regex: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g
+    },
+    {
+      kind: "github-token",
+      label: "GitHub token",
+      regex: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b|\bgithub_pat_[A-Za-z0-9_]{22,}\b/g
+    },
+    {
+      kind: "google-api-key",
+      label: "Google API key",
+      regex: /\bAIza[0-9A-Za-z_-]{35}\b/g
+    },
+    {
+      kind: "slack-token",
+      label: "Slack token",
+      regex: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g
+    },
+    {
+      kind: "mutagent-api-key",
+      label: "Mutagent API key",
+      regex: /\bmt_[A-Za-z0-9]{16,}\b/g
+    },
+    {
+      kind: "bearer-token",
+      label: "Bearer token",
+      regex: /\bBearer\s+([A-Za-z0-9._-]{20,})/g
+    },
+    {
+      kind: "generic-assignment",
+      label: "Credential assignment",
+      regex: /(?:api[_-]?key|apikey|secret|password|passwd|token|access[_-]?key)["']?\s*[:=]\s*["']?([A-Za-z0-9._/+-]{16,})/gi
+    }
+  ];
+  FOREIGN_KEY_PREFIXES = [
+    { kind: "anthropic-api-key", prefix: /^sk-ant-/ },
+    { kind: "openai-api-key", prefix: /^sk-/ },
+    { kind: "aws-access-key-id", prefix: /^(?:AKIA|ASIA)[0-9A-Z]/ },
+    { kind: "github-token", prefix: /^(?:gh[pousr]_|github_pat_)/ },
+    { kind: "google-api-key", prefix: /^AIza/ },
+    { kind: "slack-token", prefix: /^xox[baprs]-/ }
+  ];
+});
+
+// src/lib/key-check.ts
+async function checkApiKey(apiKey, endpoint) {
+  let response;
+  try {
+    response = await fetch(`${endpoint}/api/providers`, { headers: { "x-api-key": apiKey } });
+  } catch (error) {
+    return { ok: false, reason: "unreachable", cause: error instanceof Error ? error.message : String(error) };
+  }
+  if (response.ok)
+    return { ok: true };
+  if (response.status === 401 || response.status === 403)
+    return { ok: false, reason: "rejected", status: response.status };
+  return { ok: false, reason: "failed", status: response.status };
+}
+function endpointUnreachableError(endpoint, cause) {
+  const why = cause ? ` (${cause})` : "";
+  return new MutagentError("ENDPOINT_UNREACHABLE", `Could not reach the Mutagent server at ${endpoint}${why}. The API key was not checked.`, "Check the endpoint (MUTAGENT_ENDPOINT or --endpoint) and the network, then run the same command again.");
+}
+function keyCheckError(check, endpoint) {
+  if (check.reason === "unreachable")
+    return endpointUnreachableError(endpoint, check.cause);
+  if (check.reason === "rejected") {
+    return new MutagentError("INVALID_API_KEY", `The API key was rejected by ${endpoint} (HTTP ${String(check.status)}).`, "Run: mutagent login --browser");
+  }
+  return new MutagentError("KEY_CHECK_FAILED", `The Mutagent server at ${endpoint} answered HTTP ${String(check.status)} while checking the API key.`, "Run the same command again; if it keeps failing, check the endpoint with: mutagent config get endpoint");
+}
+function assertMutagentKey(apiKey, source) {
+  const foreign = foreignCredential(apiKey.trim());
+  if (foreign !== undefined)
+    throw new ForeignApiKeyError(source, foreign.label);
+}
+var ForeignApiKeyError;
+var init_key_check = __esm(() => {
+  init_errors();
+  init_secret_scan();
+  ForeignApiKeyError = class ForeignApiKeyError extends MutagentError {
+    constructor(source, label) {
+      super("FOREIGN_API_KEY", `${source} looks like ${/^[AEIOU]/.test(label) ? "an" : "a"} ${label}, not a Mutagent API key. Nothing was sent.`, "Run: mutagent login --browser");
+      this.name = "ForeignApiKeyError";
+    }
+    toJSON() {
+      return {
+        ...super.toJSON(),
+        _agentGuidance: {
+          fix: ["mutagent login --browser"],
+          notes: [
+            "Mutagent API keys come from signing in (mutagent login), or from the dashboard; they start with mg_live_.",
+            "An LLM provider key belongs in the workspace: mutagent providers add --provider <type> --name <name> --api-key <key>"
+          ]
+        }
+      };
     }
   };
 });
@@ -617,6 +1059,7 @@ var init_errors = __esm(() => {
 // src/lib/organization-scope.ts
 var exports_organization_scope = {};
 __export(exports_organization_scope, {
+  workspaceDenied: () => workspaceDenied,
   unreachableServerError: () => unreachableServerError,
   tenancyHeaders: () => tenancyHeaders,
   tenancyFailure: () => tenancyFailure,
@@ -674,20 +1117,22 @@ function parseBody(body) {
   return {};
 }
 function deadKeyError() {
-  return new TenancyError("AUTH_EXPIRED", "Your CLI key expired or was revoked.", "Run: mutagent login", 2);
+  return new TenancyError("AUTH_EXPIRED", "Your CLI key expired or was revoked.", "Run: mutagent login");
+}
+function workspaceDenied(ctx) {
+  const shown = ctx.workspaceName ?? ctx.workspaceId ?? "workspace";
+  if (ctx.workspaceOrigin === "selection") {
+    return new TenancyError(TENANCY_DENIED, `Your saved workspace ${shown} is no longer available to you.`, "Run: mutagent workspaces use <name>");
+  }
+  const where = ctx.organizationName ? ` in ${ctx.organizationName}` : "";
+  return new TenancyError(TENANCY_DENIED, `No workspace "${shown}" among your workspaces${where}.`, "See: mutagent workspaces list");
 }
 function tenancyFailure(status, body, ctx) {
   const parsed = parseBody(body);
   if (status === 401)
     return deadKeyError();
-  if (status === 403 && parsed.code === TENANCY_DENIED) {
-    const shown = ctx.workspaceName ?? ctx.workspaceId ?? "workspace";
-    if (ctx.workspaceOrigin === "selection") {
-      return new TenancyError(TENANCY_DENIED, `Your saved workspace ${shown} is no longer available to you.`, "Run: mutagent workspaces use <name>");
-    }
-    const where = ctx.organizationName ? ` in ${ctx.organizationName}` : "";
-    return new TenancyError(TENANCY_DENIED, `No workspace "${shown}" among your workspaces${where}.`, "See: mutagent workspaces list");
-  }
+  if (status === 403 && parsed.code === TENANCY_DENIED)
+    return workspaceDenied(ctx);
   if (status === 403 && ctx.keyScope === "workspace" && ctx.workspaceOrigin === "override") {
     return new TenancyError("WORKSPACE_KEY_MISMATCH", "This API key only works in its own workspace.", "Run: mutagent login (for a key that can switch workspaces)");
   }
@@ -698,7 +1143,7 @@ function tenancyFailure(status, body, ctx) {
 }
 function noWorkspaceSelected() {
   const fix = envKeyReplacesFile() ? ENV_KEY_WORKSPACE_FIX : "Run: mutagent workspaces use <name>";
-  return new TenancyError("WORKSPACE_REQUIRED", "No workspace selected.", fix, 3);
+  return new TenancyError("WORKSPACE_REQUIRED", "No workspace selected.", fix);
 }
 function envKeyHasNoSelection() {
   return new TenancyError("WORKSPACE_FROM_ENV", "With MUTAGENT_API_KEY set, the workspace comes from --workspace or MUTAGENT_WORKSPACE_ID.", ENV_KEY_WORKSPACE_FIX);
@@ -889,8 +1334,8 @@ var init_organization_scope = __esm(() => {
   init_config();
   UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
   TenancyError = class TenancyError extends MutagentError {
-    constructor(code, what, fix, exitCode = 1) {
-      super(code, `${what} ${fix}`, fix.replace(/^(Run|See|To switch): /, ""), exitCode);
+    constructor(code, what, fix) {
+      super(code, `${what} ${fix}`, fix.replace(/^(Run|See|To switch): /, ""));
       this.name = "TenancyError";
     }
   };
@@ -1485,19 +1930,13 @@ function resetSDKClient() {
   sdkClient = null;
 }
 async function validateApiKey(apiKey, endpoint) {
-  try {
-    const response = await fetch(`${endpoint}/api/providers`, {
-      headers: { "x-api-key": apiKey }
-    });
-    return response.ok;
-  } catch {
-    return false;
-  }
+  return (await checkApiKey(apiKey, endpoint)).ok;
 }
 var SDK_TRANSPORT_ERRORS, sdkClient = null;
 var init_sdk_client = __esm(() => {
   init_errors();
   init_config();
+  init_key_check();
   init_organization_scope();
   init_sdk_debug();
   init_known_secrets();
@@ -1509,209 +1948,7 @@ var init_sdk_client = __esm(() => {
 // src/index.ts
 init_config();
 init_sdk_client();
-
-// src/lib/output.ts
-init_known_secrets();
-import chalk from "chalk";
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import { join as join2 } from "path";
-var _compatCache = null;
-var _globalCliVersion = "0.0.0";
-function setCliVersion(version) {
-  _globalCliVersion = version;
-  _compatCache = null;
-}
-function getCliVersion() {
-  return _globalCliVersion;
-}
-function getCompatMetadata(cliVersion = _globalCliVersion) {
-  if (_compatCache !== null)
-    return _compatCache;
-  let skillVersion = "unknown";
-  let skillMinCliVersion = "unknown";
-  try {
-    const candidatePaths = [
-      join2(process.cwd(), ".claude", "skills", "mutagent-cli", "SKILL.md"),
-      join2(process.cwd(), "mutagent-cli", ".claude", "skills", "mutagent-cli", "SKILL.md")
-    ];
-    for (const p of candidatePaths) {
-      if (existsSync2(p)) {
-        const content = readFileSync2(p, "utf-8");
-        const verMatch = /^\s+skill_version:\s+"?([^"\n]+)"?\s*$/m.exec(content);
-        const minMatch = /^\s+skill_min_cli_version:\s+"?([^"\n]+)"?\s*$/m.exec(content);
-        if (/^metadata:/m.test(content) && !verMatch && !minMatch) {
-          throw new Error("Bundled SKILL.md is missing metadata.skill_version / skill_min_cli_version" + " — re-run `bun run sync-skill` to regenerate.");
-        }
-        if (verMatch?.[1])
-          skillVersion = verMatch[1].trim();
-        if (minMatch?.[1])
-          skillMinCliVersion = minMatch[1].trim();
-        break;
-      }
-    }
-  } catch (err) {
-    if (err instanceof Error && err.message.startsWith("Bundled SKILL.md is missing")) {
-      throw err;
-    }
-  }
-  _compatCache = { cliVersion, skillVersion, skillMinCliVersion };
-  return _compatCache;
-}
-function getJsonFlag(command) {
-  if (!command)
-    return false;
-  const parentOpts = command.parent ? command.parent.opts() : null;
-  const ownOpts = command.opts();
-  return Boolean(parentOpts?.json ?? ownOpts.json);
-}
-
-class OutputFormatter {
-  format;
-  constructor(format2) {
-    this.format = format2;
-  }
-  output(data) {
-    const clean = scrubKnownSuccessDeep(data);
-    if (this.format === "json") {
-      let enriched = clean;
-      if (_globalCliVersion !== "0.0.0" && clean !== null && typeof clean === "object" && !Array.isArray(clean) && "_directive" in clean) {
-        enriched = {
-          ...clean,
-          _compat: getCompatMetadata(_globalCliVersion)
-        };
-      }
-      console.log(JSON.stringify(enriched, null, 2));
-    } else {
-      this.formatTable(clean);
-    }
-  }
-  formatTable(data) {
-    if (Array.isArray(data)) {
-      this.formatArray(data);
-    } else if (data && typeof data === "object") {
-      this.formatObject(data);
-    } else {
-      console.log(data);
-    }
-  }
-  formatArray(data) {
-    if (data.length === 0) {
-      console.log(chalk.gray("No results"));
-      return;
-    }
-    const firstItem = data[0];
-    if (!firstItem || typeof firstItem !== "object") {
-      data.forEach((item) => {
-        console.log(`  ${String(item)}`);
-      });
-      return;
-    }
-    const keys = Object.keys(firstItem);
-    const toDisplayString = (val) => {
-      if (val === null || val === undefined)
-        return "";
-      if (typeof val === "object")
-        return JSON.stringify(val);
-      if (typeof val === "string")
-        return val;
-      if (typeof val === "number" || typeof val === "boolean" || typeof val === "bigint") {
-        return val.toString();
-      }
-      return JSON.stringify(val);
-    };
-    const widths = {};
-    keys.forEach((key) => {
-      widths[key] = Math.max(key.length, ...data.map((item) => toDisplayString(item[key]).length));
-    });
-    const header = keys.map((key) => chalk.bold(key.toUpperCase().padEnd(widths[key] ?? 10))).join("  ");
-    console.log(header);
-    console.log(keys.map((key) => "-".repeat(widths[key] ?? 10)).join("  "));
-    data.forEach((item) => {
-      const row = keys.map((key) => {
-        const value = toDisplayString(item[key]);
-        const width = widths[key] ?? 10;
-        return value.padEnd(width).slice(0, width);
-      }).join("  ");
-      console.log(row);
-    });
-    console.log(chalk.gray(`
-${String(data.length)} result(s)`));
-  }
-  formatObject(data) {
-    const maxKeyLength = Math.max(...Object.keys(data).map((k) => k.length));
-    Object.entries(data).forEach(([key, value]) => {
-      const formattedKey = chalk.bold(key.padEnd(maxKeyLength));
-      let formattedValue;
-      if (value === null || value === undefined) {
-        formattedValue = "";
-      } else if (typeof value === "object") {
-        formattedValue = JSON.stringify(value, null, 2);
-      } else if (typeof value === "string") {
-        formattedValue = value;
-      } else if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
-        formattedValue = value.toString();
-      } else {
-        formattedValue = JSON.stringify(value);
-      }
-      console.log(`${formattedKey}  ${formattedValue}`);
-    });
-  }
-  success(message) {
-    const text = scrubKnownSuccess(message);
-    if (this.format === "json") {
-      console.log(JSON.stringify({ success: true, message: text }, null, 2));
-    } else {
-      console.log(chalk.green(`✓ ${text}`));
-    }
-  }
-  error(message, code, suggestedAction) {
-    const text = scrubKnownSuccess(message);
-    const action = suggestedAction === undefined ? undefined : scrubKnownSuccess(suggestedAction);
-    if (this.format === "json") {
-      const result = { success: false, error: text };
-      if (code)
-        result.code = code;
-      if (action)
-        result.suggestedAction = action;
-      console.log(JSON.stringify(result, null, 2));
-    } else {
-      console.log(chalk.red(`✗ ${text}`));
-    }
-  }
-  info(message) {
-    if (this.format !== "json") {
-      console.log(chalk.blue(`ℹ ${scrubKnownSuccess(message)}`));
-    }
-  }
-  warn(message) {
-    const text = scrubKnownSuccess(message);
-    if (this.format === "json") {
-      console.log(JSON.stringify({ warning: text }, null, 2));
-    } else {
-      console.log(chalk.yellow(`⚠ ${text}`));
-    }
-  }
-}
-function createSpinner(text, isJson) {
-  if (isJson) {
-    const noop = () => {
-      return;
-    };
-    return {
-      start: noop,
-      stop: noop,
-      succeed: noop,
-      fail: noop
-    };
-  }
-  const start = async () => {
-    const { default: ora } = await import("ora");
-    return ora(text).start();
-  };
-  return { start };
-}
-
-// src/index.ts
+init_output();
 init_errors();
 var version = "0.1.0";
 export {
@@ -1727,4 +1964,4 @@ export {
   ApiError
 };
 
-//# debugId=775F42A23F18BBFB64756E2164756E21
+//# debugId=0397F8E1C872BF7364756E2164756E21