Published package · v0.3.0

CLI reference

The npm package is named marucheck. It installs the executable namedmaru, which keeps normal project commands short and consistent across local and CI environments.

Install

npm install --save-dev --save-exact marucheck@0.3.0
npx --no-install maru --help

Use an exact project dependency for repeatable team and CI execution. A global install is optional: npm install --global marucheck@0.3.0.

Project setup

maru init: Create an idempotent .maru workspace and configuration.
maru scan: Inventory routes, tests, dependencies, CI, and source structure.
maru doctor: Check runtime, Git, package manager, configuration, and test prerequisites.

Change verification

maru risk --diff: Calculate an explainable 0–100 risk score for the current Git diff.
maru plan --diff: Write the requirement-linked verification plan.
maru verify --diff: Run selected checks and write evidence, findings, and the release gate.
maru mutate --diff --max 20: Check whether selected tests reject isolated mutations.

Guardrails and integrations

maru drift check --from observations.json: Compare observed behavior with protected intent.
maru memory search "authorization": Find relevant confirmed bugs and regression tests.
maru challenge prepare --diff: Prepare a bounded brief for a fresh AI-client QA context.
maru ci init: Install the least-privilege GitHub pull-request workflow.
maru mcp: Start the local stdio MCP server.

Quality Contract lifecycle

maru contract create --from requirements.md
maru contract list
maru contract show <contract-id>
maru contract validate [path]
maru contract diff <current> <proposed>
maru contract approve <contract-id> --by <owner>

Creation always produces a draft. Approval is a separate accountable-owner action and writes an immutable, hash-addressed history snapshot.

Output and exit behavior

Generated plans and inventory are written under .maru/generated/.
Run reports and raw execution artifacts are written under .maru/artifacts/.
Confirmed QA memory is stored under .maru/memory/.
Approved contract policies can block; draft and review policies remain advisory unless an independent high-risk or security rule requires a blocking check.
A blocked verification or CI gate returns a non-zero exit code.
Use maru --version to confirm the active package release.