optimal-cli 1.0.0 → 1.1.0

package/skills/upload-netsuite/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: upload-netsuite
+description: Upload NetSuite XLSM or CSV financial data into ReturnPro staging tables
+---
+
+## Purpose
+Uploads NetSuite financial exports (XLSM macro-enabled workbooks or CSV files) into `stg_financials_raw`. This is the primary data pipeline for ReturnPro FP&A staging. Handles both single-sheet CSV files and multi-sheet XLSM workbooks (auto-detects format). Supports Wes-style multi-sheet workbooks where each month tab contains that month's data.
+
+## Inputs
+- **file** (required): Absolute path to the NetSuite XLSM or CSV file on disk
+- **month** (optional): Target month as YYYY-MM. Required for CSV files. For XLSM with monthly tabs, auto-detected from sheet names.
+- **dry-run** (optional): Parse and validate without writing to Supabase.
+
+## Steps
+1. Call `lib/returnpro/upload-netsuite.ts::uploadNetsuite(file, month?, options?)` to orchestrate the upload
+2. Detect file format by extension (.xlsm, .xlsx, .csv)
+3. For XLSM/XLSX: check for multi-sheet layout using `hasMonthlySheets()` — if 3+ month-named sheets exist, read per-month tabs (NOT Summary)
+4. For CSV: read single file, require `--month` parameter
+5. Parse rows into staging format: `account_code`, `account_name`, `amount` (as TEXT), `period` (YYYY-MM), `source_file`
+6. Resolve account codes against `dim_account` for validation
+7. Batch-upsert into `stg_financials_raw` (keyed on account_code + period + master_program_id)
+8. Log execution via `lib/kanban.ts::logSkillExecution()`
+
+## Output
+```
+Format: NetSuite XLSM (multi-sheet: Jan, Feb, Mar)
+Parsed 3 months: 2026-01 (91 rows), 2026-02 (89 rows), 2026-03 (93 rows)
+Total inserted: 273  |  Updated: 0  |  Skipped: 0
+```
+
+## CLI Usage
+```bash
+# XLSM with auto-detected monthly tabs
+optimal upload-netsuite --file ~/Downloads/returnpro-data/Solution7-Q1-2026.xlsm
+
+# CSV with explicit month
+optimal upload-netsuite --file ~/Downloads/returnpro-data/netsuite-jan-2026.csv --month 2026-01
+
+# Dry run to preview
+optimal upload-netsuite --file ~/Downloads/returnpro-data/Solution7-Q1-2026.xlsm --dry-run
+```
+
+## Environment
+Requires: `RETURNPRO_SUPABASE_URL`, `RETURNPRO_SUPABASE_SERVICE_KEY`
+
+## Tables Touched
+- `stg_financials_raw` — upsert parsed rows (amount stored as TEXT)
+- `dim_account` — validate account codes
+
+## Gotchas
+- **amount is TEXT**: The `stg_financials_raw.amount` column is TEXT, not NUMERIC. Always CAST before numeric comparisons.
+- **Multi-sheet detection**: `hasMonthlySheets()` triggers when 3+ sheets have month-like names. If present, reads individual month tabs and ignores Summary sheet.
+- **Never run SQL manually**: Use migration files + `supabase db push --linked` for schema changes.
+
+## Status
+Implementation status: Not yet implemented. Spec only. Lib function `lib/returnpro/upload-netsuite.ts` to be extracted from dashboard-returnpro's `/api/staging/upload` route.

package/skills/upload-r1/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: upload-r1
+description: Upload R1 XLSX files parsed with WASM/calamine, aggregate by program, and load into ReturnPro staging
+---
+
+## Purpose
+Uploads R1 reverse-logistics XLSX files into ReturnPro's financial staging tables. The R1 export is parsed using WASM-based calamine (fast XLSX parser without ExcelJS overhead), rows are aggregated by master program, and results are upserted into `stg_financials_raw`. This is one of the primary data ingestion paths for ReturnPro FP&A.
+
+## Inputs
+- **file** (required): Absolute path to the R1 XLSX file on disk
+- **month** (required): Target month as YYYY-MM (e.g., `2026-01`). Used for the staging period column.
+- **dry-run** (optional): Parse and aggregate without writing to Supabase. Useful for previewing row counts.
+
+## Steps
+1. Call `lib/returnpro/upload-r1.ts::uploadR1(file, month, options?)` to orchestrate the upload
+2. Read the XLSX file with WASM/calamine parser (faster than ExcelJS for large files)
+3. Normalize column headers — map R1-specific column names to standard staging fields (account_code, amount, description)
+4. Aggregate rows by `master_program_id` + `account_code` within the target month
+5. Resolve program names to `dim_master_program.id` via fuzzy match
+6. Upsert aggregated rows into `stg_financials_raw` (keyed on account_code + month + master_program_id)
+7. Log execution via `lib/kanban.ts::logSkillExecution()`
+
+## Output
+```
+Parsed R1 XLSX: 1,842 rows across 47 programs
+Aggregated to 312 staging rows for 2026-01
+Inserted: 298  |  Updated: 14  |  Skipped: 0
+```
+
+## CLI Usage
+```bash
+optimal upload-r1 --file ~/Downloads/returnpro-data/R1-January-2026.xlsx --month 2026-01
+optimal upload-r1 --file ~/Downloads/returnpro-data/R1-January-2026.xlsx --month 2026-01 --dry-run
+```
+
+## Environment
+Requires: `RETURNPRO_SUPABASE_URL`, `RETURNPRO_SUPABASE_SERVICE_KEY`
+
+## Tables Touched
+- `stg_financials_raw` — upsert aggregated rows (note: `amount` column is TEXT, not NUMERIC)
+- `dim_master_program` — lookup for program name resolution
+- `dim_account` — lookup for account code validation
+
+## Status
+Implementation status: Not yet implemented. Spec only. Lib function `lib/returnpro/upload-r1.ts` to be extracted from dashboard-returnpro's `/api/r1/` routes.

package/supabase/.temp/cli-latest

@@ -0,0 +1 @@
+v2.75.0

package/supabase/migrations/20250305000001_create_agent_configs.sql

@@ -0,0 +1,36 @@
+-- Create table for storing agent OpenClaw configs
+CREATE TABLE IF NOT EXISTS agent_configs (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  agent_name TEXT NOT NULL UNIQUE,
+  config_json JSONB NOT NULL,
+  version TEXT NOT NULL,
+  created_at TIMESTAMPTZ DEFAULT NOW(),
+  updated_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- Index for faster lookups
+CREATE INDEX IF NOT EXISTS idx_agent_configs_name ON agent_configs(agent_name);
+
+-- Enable RLS
+ALTER TABLE agent_configs ENABLE ROW LEVEL SECURITY;
+
+-- Allow service role full access
+CREATE POLICY "Service role full access" ON agent_configs
+  FOR ALL
+  TO service_role
+  USING (true)
+  WITH CHECK (true);
+
+-- Add updated_at trigger
+CREATE OR REPLACE FUNCTION update_updated_at_column()
+RETURNS TRIGGER AS $$
+BEGIN
+  NEW.updated_at = NOW();
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE TRIGGER update_agent_configs_updated_at
+  BEFORE UPDATE ON agent_configs
+  FOR EACH ROW
+  EXECUTE FUNCTION update_updated_at_column();

package/supabase/migrations/20260305111300_create_cli_config_registry.sql

@@ -0,0 +1,22 @@
+-- create shared config registry for optimal-cli profile sync
+create table if not exists public.cli_config_registry (
+  id uuid primary key default gen_random_uuid(),
+  owner text not null,
+  profile text not null default 'default',
+  config_version text not null,
+  payload jsonb not null,
+  payload_hash text not null,
+  source text not null default 'optimal-cli',
+  updated_by text,
+  updated_at timestamptz not null default now(),
+  created_at timestamptz not null default now(),
+  unique (owner, profile)
+);
+
+create index if not exists idx_cli_config_registry_owner_profile
+  on public.cli_config_registry (owner, profile);
+
+create index if not exists idx_cli_config_registry_updated_at
+  on public.cli_config_registry (updated_at desc);
+
+-- note: rls policies intentionally deferred until auth model is finalized.

package/supabase/migrations/20260306195000_create_kanban_tables.sql

@@ -0,0 +1,97 @@
+-- Kanban tables for 3-way sync: supabase + obsidian + cli
+
+-- Projects table
+CREATE TABLE IF NOT EXISTS cli_projects (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  slug TEXT UNIQUE NOT NULL,
+  name TEXT NOT NULL,
+  description TEXT,
+  status TEXT DEFAULT 'active' CHECK (status IN ('active', 'archived', 'on_hold')),
+  created_at TIMESTAMPTZ DEFAULT NOW(),
+  updated_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- Tasks table
+CREATE TABLE IF NOT EXISTS cli_tasks (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  project_id UUID REFERENCES cli_projects(id) ON DELETE CASCADE,
+  task_id TEXT NOT NULL, -- from obsidian filename, e.g., "task__optimal-cli-shared-config-registry__b7c1d2e3"
+  title TEXT NOT NULL,
+  description TEXT,
+  status TEXT DEFAULT 'pending' CHECK (status IN ('pending', 'in_progress', 'done', 'cancelled')),
+  priority INTEGER DEFAULT 3 CHECK (priority BETWEEN 1 AND 4),
+  owner TEXT, -- agent or person responsible
+  assignee TEXT,
+  tags JSONB DEFAULT '[]',
+  source TEXT, -- e.g., "chat:carlos:2026-03-04"
+  created_at TIMESTAMPTZ DEFAULT NOW(),
+  updated_at TIMESTAMPTZ DEFAULT NOW(),
+  completed_at TIMESTAMPTZ,
+  completed_by TEXT,
+  metadata JSONB DEFAULT '{}',
+  UNIQUE(project_id, task_id)
+);
+
+-- Sync log for tracking changes
+CREATE TABLE IF NOT EXISTS cli_sync_log (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  entity_type TEXT NOT NULL, -- 'project' or 'task'
+  entity_id UUID NOT NULL,
+  action TEXT NOT NULL, -- 'create', 'update', 'delete'
+  source TEXT NOT NULL, -- 'cli', 'obsidian', 'manual'
+  synced_at TIMESTAMPTZ DEFAULT NOW(),
+  payload JSONB
+);
+
+-- Indexes
+CREATE INDEX IF NOT EXISTS idx_tasks_project ON cli_tasks(project_id);
+CREATE INDEX IF NOT EXISTS idx_tasks_status ON cli_tasks(status);
+CREATE INDEX IF NOT EXISTS idx_tasks_owner ON cli_tasks(owner);
+CREATE INDEX IF NOT EXISTS idx_tasks_assignee ON cli_tasks(assignee);
+CREATE INDEX IF NOT EXISTS idx_sync_log_entity ON cli_sync_log(entity_type, entity_id);
+
+-- Enable RLS
+ALTER TABLE cli_projects ENABLE ROW LEVEL SECURITY;
+ALTER TABLE cli_tasks ENABLE ROW LEVEL SECURITY;
+ALTER TABLE cli_sync_log ENABLE ROW LEVEL SECURITY;
+
+-- RLS policies (service role can do everything)
+CREATE POLICY "service_role_full_access_projects" ON cli_projects FOR ALL USING (true) WITH CHECK (true);
+CREATE POLICY "service_role_full_access_tasks" ON cli_tasks FOR ALL USING (true) WITH CHECK (true);
+CREATE POLICY "service_role_full_access_sync_log" ON cli_sync_log FOR ALL USING (true) WITH CHECK (true);
+
+-- Function to update updated_at
+CREATE OR REPLACE FUNCTION update_updated_at()
+RETURNS TRIGGER AS $$
+BEGIN
+  NEW.updated_at = NOW();
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Triggers for updated_at
+CREATE TRIGGER update_projects_updated_at BEFORE UPDATE ON cli_projects
+  FOR EACH ROW EXECUTE FUNCTION update_updated_at();
+
+CREATE TRIGGER update_tasks_updated_at BEFORE UPDATE ON cli_tasks
+  FOR EACH ROW EXECUTE FUNCTION update_updated_at();
+
+-- Insert default project for optimal tasks
+INSERT INTO cli_projects (slug, name, description)
+VALUES ('optimal-tasks', 'Optimal Tasks', 'Main task tracking for optimal agents')
+ON CONFLICT (slug) DO NOTHING;
+
+-- Function to log sync
+CREATE OR REPLACE FUNCTION log_sync(
+  p_entity_type TEXT,
+  p_entity_id UUID,
+  p_action TEXT,
+  p_source TEXT,
+  p_payload JSONB DEFAULT '{}'::JSONB
+)
+RETURNS VOID AS $$
+BEGIN
+  INSERT INTO cli_sync_log (entity_type, entity_id, action, source, payload)
+  VALUES (p_entity_type, p_entity_id, p_action, p_source, p_payload);
+END;
+$$ LANGUAGE plpgsql;

package/tests/config-command-smoke.test.ts

@@ -0,0 +1,395 @@
+/**
+ * Command-level smoke tests for optimal config commands.
+ * These test the CLI surface directly via subprocess invocation.
+ */
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtemp, rm, writeFile, readFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { spawn } from 'node:child_process'
+import { env } from 'node:process'
+
+// Run from the actual project directory, but with a custom HOME for config isolation
+const PROJECT_DIR = '/home/oracle/.openclaw/workspace/optimal-cli'
+
+function runOptimalCli(args: string[], extraEnv: Record<string, string> = {}): Promise<{ stdout: string; stderr: string; code: number }> {
+  return new Promise((resolve) => {
+    const child = spawn('npx', ['tsx', 'bin/optimal.ts', ...args], {
+      cwd: PROJECT_DIR,
+      env: { ...env, ...extraEnv },
+      stdio: ['pipe', 'pipe', 'pipe'],
+    })
+
+    let stdout = ''
+    let stderr = ''
+
+    child.stdout?.on('data', (data) => { stdout += data.toString() })
+    child.stderr?.on('data', (data) => { stderr += data.toString() })
+    child.on('close', (code) => {
+      resolve({ stdout, stderr, code: code ?? 0 })
+    })
+  })
+}
+
+test('config init creates local config file with defaults', async () => {
+  const configDir = await mkdtemp(join(tmpdir(), 'optimal-cli-smoke-'))
+  try {
+    const result = await runOptimalCli(
+      ['config', 'init', '--owner', 'test-smoke', '--profile', 'testprof', '--brand', 'CRE-11TRUST', '--timezone', 'America/New_York'],
+      { OPTIMAL_CONFIG_DIR: configDir, OPTIMAL_CONFIG_OWNER: 'test-smoke' }
+    )
+
+    assert.equal(result.code, 0, `config init failed: ${result.stderr}`)
+    assert.match(result.stdout, /Initialized config/)
+
+    // Verify config file was created
+    const configPath = join(configDir, 'optimal.config.json')
+    const content = await readFile(configPath, 'utf-8')
+    const config = JSON.parse(content)
+
+    assert.equal(config.version, '1.0.0')
+    assert.equal(config.profile.name, 'testprof')
+    assert.equal(config.profile.owner, 'test-smoke')
+    assert.equal(config.defaults.brand, 'CRE-11TRUST')
+    assert.equal(config.defaults.timezone, 'America/New_York')
+
+    // Verify history was created
+    const historyPath = join(configDir, 'config-history.log')
+    const history = await readFile(historyPath, 'utf-8')
+    assert.match(history, /init profile=testprof/)
+  } finally {
+    await rm(configDir, { recursive: true, force: true })
+  }
+})
+
+test('config doctor reports health for existing config', async () => {
+  const configDir = await mkdtemp(join(tmpdir(), 'optimal-cli-smoke-'))
+  try {
+    // First create a config
+    await runOptimalCli(
+      ['config', 'init', '--owner', 'test-doctor', '--profile', 'default', '--brand', 'LIFEINSUR', '--timezone', 'America/Los_Angeles'],
+      { OPTIMAL_CONFIG_DIR: configDir }
+    )
+
+    // Now run doctor
+    const result = await runOptimalCli(
+      ['config', 'doctor'],
+      { OPTIMAL_CONFIG_DIR: configDir }
+    )
+
+    assert.equal(result.code, 0, `config doctor failed: ${result.stderr}`)
+    assert.match(result.stdout, /config: ok/)
+    assert.match(result.stdout, /profile: default/)
+    assert.match(result.stdout, /owner: test-doctor/)
+    assert.match(result.stdout, /version: 1.0.0/)
+    assert.match(result.stdout, /hash:/)
+  } finally {
+    await rm(configDir, { recursive: true, force: true })
+  }
+})
+
+test('config export writes JSON to specified path', async () => {
+  const configDir = await mkdtemp(join(tmpdir(), 'optimal-cli-smoke-'))
+  try {
+    // First create a config
+    await runOptimalCli(
+      ['config', 'init', '--owner', 'test-export', '--profile', 'default'],
+      { OPTIMAL_CONFIG_DIR: configDir }
+    )
+
+    // Export to a temp path
+    const exportPath = join(configDir, 'exported-config.json')
+    const result = await runOptimalCli(
+      ['config', 'export', '--out', exportPath],
+      { OPTIMAL_CONFIG_DIR: configDir }
+    )
+
+    assert.equal(result.code, 0, `config export failed: ${result.stderr}`)
+    assert.match(result.stdout, /Exported config/)
+
+    // Verify exported file
+    const content = await readFile(exportPath, 'utf-8')
+    const config = JSON.parse(content)
+    assert.equal(config.profile.owner, 'test-export')
+  } finally {
+    await rm(configDir, { recursive: true, force: true })
+  }
+})
+
+test('config import reads JSON from specified path', async () => {
+  const configDir = await mkdtemp(join(tmpdir(), 'optimal-cli-smoke-'))
+  try {
+    // Create a config file to import
+    const importPath = join(configDir, 'import-config.json')
+    const configToImport = {
+      version: '1.0.0',
+      profile: { name: 'imported', owner: 'test-import', updated_at: '2026-03-06T15:00:00.000Z' },
+      providers: { supabase: { project_ref: 'test', url: 'https://test.supabase.co', anon_key_present: true }, strapi: { base_url: 'https://test.strapi.com', token_present: true } },
+      defaults: { brand: 'CRE-11TRUST', timezone: 'America/Chicago' },
+      features: { cms: true, tasks: false, deploy: false },
+    }
+    await writeFile(importPath, JSON.stringify(configToImport, null, 2))
+
+    // Import it
+    const result = await runOptimalCli(
+      ['config', 'import', '--in', importPath],
+      { OPTIMAL_CONFIG_DIR: configDir }
+    )
+
+    assert.equal(result.code, 0, `config import failed: ${result.stderr}`)
+    assert.match(result.stdout, /Imported config/)
+
+    // Verify it was imported
+    const configPath = join(configDir, 'optimal.config.json')
+    const content = await readFile(configPath, 'utf-8')
+    const config = JSON.parse(content)
+    assert.equal(config.profile.name, 'imported')
+    assert.equal(config.profile.owner, 'test-import')
+  } finally {
+    await rm(configDir, { recursive: true, force: true })
+  }
+})
+
+test('config sync pull --dry-run shows what would be pulled', async () => {
+  const configDir = await mkdtemp(join(tmpdir(), 'optimal-cli-smoke-'))
+  try {
+    // Create a config first
+    await runOptimalCli(
+      ['config', 'init', '--owner', 'test-pull', '--profile', 'default'],
+      { OPTIMAL_CONFIG_DIR: configDir }
+    )
+
+    // Run dry-run pull
+    const result = await runOptimalCli(
+      ['config', 'sync', 'pull', '--profile', 'default', '--dry-run'],
+      { OPTIMAL_CONFIG_DIR: configDir }
+    )
+
+    assert.equal(result.code, 0, `config sync pull --dry-run failed: ${result.stderr}`)
+    assert.match(result.stdout, /\[dry-run\]/)
+    assert.match(result.stdout, /Would pull profile/)
+    assert.match(result.stdout, /test-pull/)
+  } finally {
+    await rm(configDir, { recursive: true, force: true })
+  }
+})
+
+test('config sync push --dry-run shows what would be pushed', async () => {
+  const configDir = await mkdtemp(join(tmpdir(), 'optimal-cli-smoke-'))
+  try {
+    // Create a config first
+    await runOptimalCli(
+      ['config', 'init', '--owner', 'test-push', '--profile', 'default'],
+      { OPTIMAL_CONFIG_DIR: configDir }
+    )
+
+    // Run dry-run push
+    const result = await runOptimalCli(
+      ['config', 'sync', 'push', '--agent', 'test-push-agent', '--profile', 'default', '--dry-run'],
+      { OPTIMAL_CONFIG_DIR: configDir }
+    )
+
+    assert.equal(result.code, 0, `config sync push --dry-run failed: ${result.stderr}`)
+    assert.match(result.stdout, /\[dry-run\]/)
+    assert.match(result.stdout, /Would push/)
+    assert.match(result.stdout, /test-push-agent/)
+    assert.match(result.stdout, /hash:/)
+  } finally {
+    await rm(configDir, { recursive: true, force: true })
+  }
+})
+
+test('config sync push --force --dry-run shows force flag', async () => {
+  const configDir = await mkdtemp(join(tmpdir(), 'optimal-cli-smoke-'))
+  try {
+    // Create a config first
+    await runOptimalCli(
+      ['config', 'init', '--owner', 'test-force', '--profile', 'default'],
+      { OPTIMAL_CONFIG_DIR: configDir }
+    )
+
+    // Run dry-run push with force
+    const result = await runOptimalCli(
+      ['config', 'sync', 'push', '--agent', 'test-force-agent', '--profile', 'default', '--force', '--dry-run'],
+      { OPTIMAL_CONFIG_DIR: configDir }
+    )
+
+    assert.equal(result.code, 0, `config sync push --force --dry-run failed: ${result.stderr}`)
+    assert.match(result.stdout, /Force: true/)
+  } finally {
+    await rm(configDir, { recursive: true, force: true })
+  }
+})
+
+// Error case tests
+
+test('config doctor fails gracefully when no config exists', async () => {
+  const configDir = await mkdtemp(join(tmpdir(), 'optimal-cli-smoke-'))
+  try {
+    const result = await runOptimalCli(
+      ['config', 'doctor'],
+      { OPTIMAL_CONFIG_DIR: configDir }
+    )
+
+    assert.equal(result.code, 1, `Expected failure code, got: ${result.code}`)
+    // Error message goes to stdout (console.log), not stderr
+    assert.match(result.stdout, /No local config found/)
+  } finally {
+    await rm(configDir, { recursive: true, force: true })
+  }
+})
+
+test('config export fails when no config exists', async () => {
+  const configDir = await mkdtemp(join(tmpdir(), 'optimal-cli-smoke-'))
+  try {
+    const result = await runOptimalCli(
+      ['config', 'export', '--out', join(configDir, 'out.json')],
+      { OPTIMAL_CONFIG_DIR: configDir }
+    )
+
+    assert.equal(result.code, 1, `Expected failure code, got: ${result.code}`)
+    assert.match(result.stderr, /No local config found/)
+  } finally {
+    await rm(configDir, { recursive: true, force: true })
+  }
+})
+
+test('config sync push --dry-run fails when no config exists', async () => {
+  const configDir = await mkdtemp(join(tmpdir(), 'optimal-cli-smoke-'))
+  try {
+    const result = await runOptimalCli(
+      ['config', 'sync', 'push', '--agent', 'test', '--dry-run'],
+      { OPTIMAL_CONFIG_DIR: configDir }
+    )
+
+    assert.equal(result.code, 1, `Expected failure code, got: ${result.code}`)
+    assert.match(result.stderr, /No local config/)
+  } finally {
+    await rm(configDir, { recursive: true, force: true })
+  }
+})
+
+test('config import fails when input file does not exist', async () => {
+  const configDir = await mkdtemp(join(tmpdir(), 'optimal-cli-smoke-'))
+  try {
+    const result = await runOptimalCli(
+      ['config', 'import', '--in', '/nonexistent/path/config.json'],
+      { OPTIMAL_CONFIG_DIR: configDir }
+    )
+
+    assert.equal(result.code, 1, `Expected failure code, got: ${result.code}`)
+    assert.match(result.stderr, /Input file not found/)
+  } finally {
+    await rm(configDir, { recursive: true, force: true })
+  }
+})
+
+test('config sync pull fails gracefully without supabase config', async () => {
+  const configDir = await mkdtemp(join(tmpdir(), 'optimal-cli-smoke-'))
+  try {
+    // Create a config first
+    await runOptimalCli(
+      ['config', 'init', '--owner', 'test-nosupabase', '--profile', 'default'],
+      { OPTIMAL_CONFIG_DIR: configDir }
+    )
+
+    // Try sync pull without supabase env vars - should fail gracefully
+    const result = await runOptimalCli(
+      ['config', 'sync', 'pull', '--profile', 'default'],
+      { 
+        OPTIMAL_CONFIG_DIR: configDir,
+        OPTIMAL_SUPABASE_URL: '',  // empty = not configured
+        OPTIMAL_SUPABASE_ANON_KEY: ''
+      }
+    )
+
+    assert.equal(result.code, 1, `Expected failure code, got: ${result.code}`)
+    // Should mention missing env vars
+    assert.ok(result.stdout.includes('Missing env vars') || result.stderr.includes('Missing env vars'), 
+      `Expected missing env vars error, got: ${result.stdout} ${result.stderr}`)
+  } finally {
+    await rm(configDir, { recursive: true, force: true })
+  }
+})
+
+test('config init --force overwrites existing config', async () => {
+  const configDir = await mkdtemp(join(tmpdir(), 'optimal-cli-smoke-'))
+  try {
+    // Create initial config
+    await runOptimalCli(
+      ['config', 'init', '--owner', 'initial-owner', '--profile', 'default', '--brand', 'CRE-11TRUST'],
+      { OPTIMAL_CONFIG_DIR: configDir }
+    )
+
+    // Verify initial config
+    let configPath = join(configDir, 'optimal.config.json')
+    let content = await readFile(configPath, 'utf-8')
+    let config = JSON.parse(content)
+    assert.equal(config.profile.owner, 'initial-owner')
+
+    // Now init again with --force
+    const result = await runOptimalCli(
+      ['config', 'init', '--owner', 'new-owner', '--profile', 'default', '--brand', 'LIFEINSUR', '--force'],
+      { OPTIMAL_CONFIG_DIR: configDir }
+    )
+
+    assert.equal(result.code, 0, `config init --force failed: ${result.stderr}`)
+    assert.match(result.stdout, /Initialized config/)
+
+    // Verify it was overwritten
+    content = await readFile(configPath, 'utf-8')
+    config = JSON.parse(content)
+    assert.equal(config.profile.owner, 'new-owner')
+    assert.equal(config.defaults.brand, 'LIFEINSUR')
+  } finally {
+    await rm(configDir, { recursive: true, force: true })
+  }
+})
+
+test('config init without --force fails when config exists', async () => {
+  const configDir = await mkdtemp(join(tmpdir(), 'optimal-cli-smoke-'))
+  try {
+    // Create initial config
+    await runOptimalCli(
+      ['config', 'init', '--owner', 'first-owner', '--profile', 'default'],
+      { OPTIMAL_CONFIG_DIR: configDir }
+    )
+
+    // Try to init again without --force - should fail
+    const result = await runOptimalCli(
+      ['config', 'init', '--owner', 'second-owner', '--profile', 'default'],
+      { OPTIMAL_CONFIG_DIR: configDir }
+    )
+
+    assert.equal(result.code, 1, `Expected failure code, got: ${result.code}`)
+    assert.match(result.stderr, /Config already exists/)
+  } finally {
+    await rm(configDir, { recursive: true, force: true })
+  }
+})
+
+// Basic CLI smoke tests
+
+test('--version shows version number', async () => {
+  const result = await runOptimalCli(['--version'], {})
+  assert.equal(result.code, 0, `--version should succeed`)
+  assert.match(result.stdout, /0\./)  // version like 0.1.0
+})
+
+test('--help shows help', async () => {
+  const result = await runOptimalCli(['--help'], {})
+  assert.equal(result.code, 0, `--help should succeed`)
+  assert.match(result.stdout, /Usage:/)
+  assert.match(result.stdout, /Commands:/)
+})
+
+test('config --help shows config subcommands', async () => {
+  const result = await runOptimalCli(['config', '--help'], {})
+  assert.equal(result.code, 0, `config --help should succeed`)
+  assert.match(result.stdout, /init/)
+  assert.match(result.stdout, /doctor/)
+  assert.match(result.stdout, /export/)
+  assert.match(result.stdout, /import/)
+  assert.match(result.stdout, /sync/)
+})