@mushi-mushi/cli 0.22.0 → 0.23.0

package/dist/index.js

@@ -1,16 +1,34 @@
 #!/usr/bin/env node
 import {
   FRAMEWORKS,
+  MUSHI_CLI_VERSION,
+  apiCall,
   apiKeyHeaders,
+  apiKeyHint,
   buildMcpServerBlock,
   buildMcpServerName,
+  cliSetupDeepLink,
+  consoleUrl,
   detectFramework,
   detectPackageManager,
+  die,
   envVarsToWrite,
   fetchIngestSetup,
+  fmtDate,
   installCommand,
+  installSignalHandlers,
   loadConfig,
+  openInBrowser,
+  pad,
+  printAndExit,
+  probeEndpointHealth,
+  projectIdHint,
   readPackageJson,
+  reportsUrl,
+  requireConfig,
+  requireUuid,
+  resolveConsoleUrl,
+  resolveConsoleUrlSync,
   runConnect,
   sanitizeApiKey,
   sanitizeCliCredentials,
@@ -18,9 +36,8 @@ import {
   sanitizeProjectId,
   saveConfig,
   writeMcpServerEntry
-} from "./chunk-R2HPR2FV.js";
+} from "./chunk-GSQO35YD.js";
 import {
-  CLOUD_API_ENDPOINT,
   TEST_REPORT_FETCH_TIMEOUT_MS,
   assertEndpoint,
   normalizeEndpoint,
@@ -30,369 +47,12 @@ import {
 // src/index.ts
 import { Command } from "commander";
 
-// src/errors.ts
-var EXIT_CODE_MAP = {
-  E_AUTH_MISSING: 2,
-  E_AUTH_INVALID: 2,
-  E_PROJECT_MISSING: 2,
-  E_ENDPOINT_INVALID: 2,
-  E_INVALID_INPUT: 2,
-  E_NOT_INTERACTIVE: 2,
-  E_NETWORK: 3,
-  E_TIMEOUT: 3,
-  E_API_ERROR: 3,
-  E_RATE_LIMITED: 3,
-  E_FILE_NOT_FOUND: 1,
-  E_FILE_PERMISSION: 1,
-  E_FRESHNESS_STALE: 1,
-  E_INTERRUPTED: 130,
-  // 128 + SIGINT (2). POSIX convention.
-  E_INTERNAL: 1
-};
-var MushiCliError = class extends Error {
-  code;
-  hint;
-  cause;
-  constructor(code, message, hint, cause) {
-    super(message);
-    this.name = "MushiCliError";
-    this.code = code;
-    if (hint) this.hint = hint;
-    if (cause !== void 0) this.cause = cause;
-  }
-  /** Exit code POSIX-aware shell scripts should branch on. */
-  get exitCode() {
-    return EXIT_CODE_MAP[this.code];
-  }
-  /**
-   * Format for `--json` output. Used by the JSON writer when a CLI
-   * subcommand was invoked with `--json` and an error escapes.
-   */
-  toJSON() {
-    return {
-      error: {
-        code: this.code,
-        message: this.message,
-        ...this.hint ? { hint: this.hint } : {}
-      }
-    };
-  }
-};
-function printAndExit(err, asJson = false) {
-  const cliErr = err instanceof MushiCliError ? err : new MushiCliError(
-    "E_INTERNAL",
-    err instanceof Error ? err.message : String(err),
-    "this is unexpected \u2014 re-run with MUSHI_DEBUG=1 and report at https://github.com/kensaurus/mushi-mushi/issues",
-    err
-  );
-  if (asJson) {
-    process.stderr.write(JSON.stringify(cliErr.toJSON()) + "\n");
-  } else {
-    process.stderr.write(`error [${cliErr.code}]: ${cliErr.message}
-`);
-    if (cliErr.hint) process.stderr.write(`  \u2192 fix: ${cliErr.hint}
-`);
-  }
-  process.exit(cliErr.exitCode);
-}
-
-// src/signals.ts
-var installed = false;
-var activeController = null;
-function installSignalHandlers() {
-  if (installed) return;
-  installed = true;
-  const abortAndExit = (signal) => {
-    activeController?.abort(
-      new MushiCliError(
-        "E_INTERRUPTED",
-        `aborted by ${signal}`,
-        "partial state on the server is safe to retry \u2014 re-run the same command"
-      )
-    );
-    const code = signal === "SIGINT" ? 130 : signal === "SIGTERM" ? 143 : 1;
-    process.nextTick(() => {
-      process.exit(code);
-    });
-  };
-  process.on("SIGINT", () => abortAndExit("SIGINT"));
-  process.on("SIGTERM", () => abortAndExit("SIGTERM"));
-}
-function getAbortSignal(external) {
-  if (external) return external.signal;
-  if (!activeController || activeController.signal.aborted) {
-    activeController = new AbortController();
-  }
-  return activeController.signal;
-}
-
-// src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.22.0" : "0.0.0-dev";
-
 // src/init.ts
 import * as p from "@clack/prompts";
 import { spawn } from "child_process";
 import { randomUUID } from "crypto";
-import { appendFileSync, existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync } from "fs";
-import { join as join3 } from "path";
-
-// src/console-url.ts
-import { existsSync, readFileSync } from "fs";
-import { dirname, join } from "path";
-var HOSTED_CONSOLE_BASE = "https://kensaur.us/mushi-mushi/admin";
-var LOCAL_ADMIN_URL = "http://localhost:6464";
-var LOCAL_PROBE_MS = 800;
-function normalizeConsoleBase(url) {
-  const trimmed = url.trim();
-  let end = trimmed.length;
-  while (end > 0 && trimmed.charCodeAt(end - 1) === 47) end--;
-  return trimmed.slice(0, end);
-}
-function consoleUrl(base, route) {
-  const normalizedRoute = route.startsWith("/") ? route : `/${route}`;
-  return `${normalizeConsoleBase(base)}${normalizedRoute}`;
-}
-function resolveConsoleUrlFromEnv() {
-  const raw = process.env["MUSHI_CONSOLE_URL"]?.trim();
-  return raw ? normalizeConsoleBase(raw) : void 0;
-}
-function isInsideMushiMonorepo(cwd) {
-  let dir = cwd;
-  for (let depth = 0; depth < 14; depth += 1) {
-    const pkgPath = join(dir, "package.json");
-    if (existsSync(pkgPath)) {
-      try {
-        const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
-        if (pkg.name === "mushi-mushi") return true;
-      } catch {
-      }
-    }
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return false;
-}
-async function probeLocalAdminConsole() {
-  try {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), LOCAL_PROBE_MS);
-    const res = await fetch(LOCAL_ADMIN_URL, {
-      signal: controller.signal,
-      method: "HEAD"
-    });
-    clearTimeout(timer);
-    if (res.ok || res.status === 404 || res.status === 401) {
-      return LOCAL_ADMIN_URL;
-    }
-  } catch {
-  }
-  return null;
-}
-function resolveConsoleUrlSync(cwd = process.cwd()) {
-  const fromEnv = resolveConsoleUrlFromEnv();
-  if (fromEnv) return fromEnv;
-  const config = loadConfig();
-  if (config.consoleUrl) return normalizeConsoleBase(config.consoleUrl);
-  if (isInsideMushiMonorepo(cwd)) return LOCAL_ADMIN_URL;
-  return HOSTED_CONSOLE_BASE;
-}
-async function resolveConsoleUrl(options) {
-  const fromEnv = resolveConsoleUrlFromEnv();
-  if (fromEnv) return fromEnv;
-  const config = loadConfig();
-  if (config.consoleUrl) return normalizeConsoleBase(config.consoleUrl);
-  const local = await probeLocalAdminConsole();
-  if (local) return local;
-  const cwd = options?.cwd ?? process.cwd();
-  if (isInsideMushiMonorepo(cwd)) return LOCAL_ADMIN_URL;
-  return HOSTED_CONSOLE_BASE;
-}
-function projectIdHint(base) {
-  return `Where to find it: ${consoleUrl(base, "/projects")} \u2192 select your project \u2192 click the UUID chip to copy (or copy it from the panel right after you create the project).`;
-}
-function apiKeyHint(base) {
-  return `Where to find it: ${consoleUrl(base, "/onboarding?tab=verify")} \u2192 Generate API key (SDK ingest needs report:write \u2014 not Settings \u2192 BYOK keys). Treat it like a password \u2014 env file only, never commit.`;
-}
-function cliSetupDeepLink(base) {
-  return consoleUrl(base, "/onboarding?tab=steps&setup=cli");
-}
-function reportsUrl(base, reportId) {
-  return reportId ? consoleUrl(base, `/reports/${reportId}`) : consoleUrl(base, "/reports");
-}
-async function openInBrowser(url) {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    return;
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    return;
-  }
-  const safeUrl = parsed.toString();
-  const { spawn: spawn2 } = await import("child_process");
-  const [command, args] = process.platform === "win32" ? (
-    // Open via rundll32's FileProtocolHandler rather than `cmd /c start`.
-    // `start` is a cmd builtin, so the URL would be re-parsed by cmd.exe and
-    // characters like `&` / `|` / `^` could still break out — exactly the
-    // injection surface CodeQL flags. rundll32 never invokes a shell: the URL
-    // is handed to the default browser as one opaque argument.
-    ["rundll32", ["url.dll,FileProtocolHandler", safeUrl]]
-  ) : process.platform === "darwin" ? ["open", [safeUrl]] : ["xdg-open", [safeUrl]];
-  await new Promise((resolve3) => {
-    try {
-      const child = spawn2(command, [...args], { stdio: "ignore", shell: false });
-      child.on("error", () => resolve3());
-      child.on("exit", () => resolve3());
-      child.unref();
-    } catch {
-      resolve3();
-    }
-  });
-}
-
-// src/cli-shared.ts
-var API_TIMEOUT_MS = 15e3;
-async function probeEndpointHealth(endpoint) {
-  const t0 = Date.now();
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), API_TIMEOUT_MS);
-  try {
-    const res = await fetch(`${endpoint}/health`, { signal: controller.signal });
-    clearTimeout(timer);
-    const body = res.headers.get("content-type")?.includes("json") ? await res.json().catch(() => ({})) : {};
-    return { ok: res.ok, status: res.status, latencyMs: Date.now() - t0, body };
-  } catch (err) {
-    clearTimeout(timer);
-    throw err;
-  }
-}
-async function apiCall(path, config, options = {}) {
-  const endpoint = config.endpoint;
-  if (!endpoint) {
-    return {
-      ok: false,
-      error: {
-        code: "NO_ENDPOINT",
-        message: "No API endpoint configured.\n  Run: mushi login --api-key <key> --endpoint <url> --project-id <id>\n  Or:  export MUSHI_API_ENDPOINT=https://<project-ref>.supabase.co/functions/v1/api"
-      }
-    };
-  }
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), API_TIMEOUT_MS);
-  const signals = [controller.signal, getAbortSignal()];
-  const compositeSignal = AbortSignal.any ? AbortSignal.any(signals) : controller.signal;
-  try {
-    const res = await fetch(`${endpoint}${path}`, {
-      ...options,
-      signal: compositeSignal,
-      headers: {
-        "Content-Type": "application/json",
-        // `apiKeyAuth` reads X-Mushi-Api-Key; the Authorization header is a
-        // fallback accepted by some older middleware. Both are sent.
-        "Authorization": `Bearer ${config.apiKey ?? ""}`,
-        "X-Mushi-Api-Key": config.apiKey ?? "",
-        "X-Mushi-Project": config.projectId ?? "",
-        "X-Mushi-Cli-Version": MUSHI_CLI_VERSION,
-        ...options.headers
-      }
-    });
-    clearTimeout(timer);
-    let body;
-    const contentType = res.headers.get("content-type") ?? "";
-    if (contentType.includes("application/json")) {
-      try {
-        body = await res.json();
-      } catch {
-        body = null;
-      }
-    } else {
-      const text2 = await res.text();
-      try {
-        body = JSON.parse(text2);
-      } catch {
-        body = {
-          ok: false,
-          error: {
-            code: `HTTP_${res.status}`,
-            message: text2.trim().slice(0, 300) || `HTTP ${res.status}`
-          }
-        };
-      }
-    }
-    if (!res.ok && typeof body === "object" && body !== null && !("ok" in body)) {
-      const b = body;
-      const nested = b["error"];
-      const errCode = nested?.["code"] ?? b["code"] ?? `HTTP_${res.status}`;
-      const errMsg = nested?.["message"] ?? b["message"] ?? `Request failed (${res.status})`;
-      return {
-        ok: false,
-        httpStatus: res.status,
-        error: { code: errCode, message: errMsg }
-      };
-    }
-    return body;
-  } catch (err) {
-    clearTimeout(timer);
-    if (err instanceof Error && err.name === "AbortError") {
-      return {
-        ok: false,
-        error: {
-          code: "TIMEOUT",
-          message: `Request timed out after ${API_TIMEOUT_MS / 1e3}s. Check your network or endpoint.`
-        }
-      };
-    }
-    return {
-      ok: false,
-      error: {
-        code: "NETWORK_ERROR",
-        message: err instanceof Error ? err.message : String(err)
-      }
-    };
-  }
-}
-function die(result, exitCode = 1) {
-  const { code, message } = result.error;
-  const status = result.httpStatus ? ` [${result.httpStatus}]` : "";
-  process.stderr.write(`error${status}: ${code} \u2014 ${message}
-`);
-  if (code === "INSUFFICIENT_SCOPE") {
-    process.stderr.write(
-      "\n  Your current API key does not have the required scope for this command.\n  New keys minted by the wizard already include both scopes. Existing keys\n  can be upgraded with:\n\n    mushi login --upgrade-scope\n\n  Or visit your console \u2192 Projects \u2192 API Keys to mint a new key.\n"
-    );
-  }
-  process.exit(exitCode);
-}
-function requireConfig(opts = {}) {
-  const config = loadConfig();
-  if (!config.apiKey) {
-    printAndExit(new MushiCliError(
-      "E_AUTH_MISSING",
-      "API key not configured.",
-      "Run: mushi login --api-key <key>  Or: export MUSHI_API_KEY=<key>"
-    ));
-  }
-  if (!config.endpoint) {
-    config.endpoint = process.env.MUSHI_API_ENDPOINT?.trim() || CLOUD_API_ENDPOINT;
-  }
-  if (opts.needsProject && !config.projectId) {
-    printAndExit(new MushiCliError(
-      "E_PROJECT_MISSING",
-      "Project ID not configured.",
-      `Run: mushi login --project-id <uuid>  Or find your project ID at ${consoleUrl(resolveConsoleUrlSync(), "/projects")}`
-    ));
-  }
-  return config;
-}
-function fmtDate(iso) {
-  if (!iso) return "\u2014";
-  return new Date(iso).toLocaleString(void 0, { dateStyle: "short", timeStyle: "short" });
-}
-function pad(s, width) {
-  return s.length >= width ? s : s + " ".repeat(width - s.length);
-}
+import { appendFileSync, existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { join as join2 } from "path";
 
 // src/device-auth.ts
 var DEVICE_FETCH_TIMEOUT_MS = 15e3;
@@ -506,7 +166,11 @@ async function listProjects(endpoint, cliToken) {
     const res = await deviceFetch(`${base}/v1/cli/projects`, { headers: cliAuthHeaders(cliToken) });
     const json = await res.json().catch(() => null);
     if (res.ok && json?.ok) return json.data?.projects ?? [];
-  } catch {
+  } catch (err) {
+    console.error(
+      "[mushi] Failed to list projects:",
+      err instanceof Error ? err.message : err
+    );
   }
   return [];
 }
@@ -599,8 +263,8 @@ function parse(version) {
 }
 
 // src/monorepo.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, readdirSync, statSync } from "fs";
-import { dirname as dirname2, join as join2, resolve } from "path";
+import { existsSync, readFileSync, readdirSync, statSync } from "fs";
+import { dirname, join, resolve } from "path";
 var WORKSPACE_GLOB_CANDIDATES = ["apps/*", "packages/*", "examples/*"];
 var FRAMEWORK_DEPS = {
   next: "Next.js",
@@ -617,9 +281,9 @@ var FRAMEWORK_DEPS = {
 function detectWorkspaceHint(cwd) {
   const root = findWorkspaceRoot(cwd);
   if (!root) return null;
-  const rootPkg = readPackageJsonSafely(join2(root, "package.json"));
+  const rootPkg = readPackageJsonSafely(join(root, "package.json"));
   if (rootPkg && getFrameworkFromPkg(rootPkg)) return null;
-  const source = existsSync2(join2(root, "pnpm-workspace.yaml")) ? "pnpm-workspace" : root === cwd ? "package-json" : "parent";
+  const source = existsSync(join(root, "pnpm-workspace.yaml")) ? "pnpm-workspace" : root === cwd ? "package-json" : "parent";
   const apps = collectAppsFromGlobs(root);
   if (apps.length === 0) return null;
   return { root, apps, source };
@@ -628,15 +292,15 @@ function findWorkspaceRoot(start) {
   let dir = resolve(start);
   for (let i = 0; i < 8; i++) {
     if (isWorkspaceRoot(dir)) return dir;
-    const parent = dirname2(dir);
+    const parent = dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
   return null;
 }
 function isWorkspaceRoot(dir) {
-  if (existsSync2(join2(dir, "pnpm-workspace.yaml"))) return true;
-  const pkg = readPackageJsonSafely(join2(dir, "package.json"));
+  if (existsSync(join(dir, "pnpm-workspace.yaml"))) return true;
+  const pkg = readPackageJsonSafely(join(dir, "package.json"));
   if (!pkg) return false;
   return Boolean(pkg.workspaces);
 }
@@ -644,8 +308,8 @@ function collectAppsFromGlobs(root) {
   const results = [];
   for (const glob of WORKSPACE_GLOB_CANDIDATES) {
     const prefix = glob.replace("/*", "");
-    const parentDir = join2(root, prefix);
-    if (!existsSync2(parentDir)) continue;
+    const parentDir = join(root, prefix);
+    if (!existsSync(parentDir)) continue;
     let entries;
     try {
       entries = readdirSync(parentDir);
@@ -653,7 +317,7 @@ function collectAppsFromGlobs(root) {
       continue;
     }
     for (const entry of entries) {
-      const pkgPath = join2(parentDir, entry, "package.json");
+      const pkgPath = join(parentDir, entry, "package.json");
       if (!isFileSafe(pkgPath)) continue;
       const pkg = readPackageJsonSafely(pkgPath);
       if (!pkg) continue;
@@ -671,14 +335,14 @@ function collectAppsFromGlobs(root) {
 function readPackageJsonSafely(path) {
   if (!isFileSafe(path)) return null;
   try {
-    return JSON.parse(readFileSync2(path, "utf-8"));
+    return JSON.parse(readFileSync(path, "utf-8"));
   } catch {
     return null;
   }
 }
 function isFileSafe(path) {
   try {
-    return existsSync2(path) && statSync(path).isFile();
+    return existsSync(path) && statSync(path).isFile();
   } catch {
     return false;
   }
@@ -1085,10 +749,10 @@ function runCommand(pm, packages, cwd) {
   });
 }
 async function writeEnvFile(cwd, apiKey, projectId, framework, endpoint, overwrite) {
-  const target = ENV_FILES.find((f) => existsSync3(join3(cwd, f))) ?? ENV_FILES[0];
-  const targetPath = join3(cwd, target);
+  const target = ENV_FILES.find((f) => existsSync2(join2(cwd, f))) ?? ENV_FILES[0];
+  const targetPath = join2(cwd, target);
   const newVars = envVarsToWrite(apiKey, projectId, framework, endpoint);
-  const existing = existsSync3(targetPath) ? readFileSync3(targetPath, "utf-8") : "";
+  const existing = existsSync2(targetPath) ? readFileSync2(targetPath, "utf-8") : "";
   if (existing.includes("MUSHI_PROJECT_ID")) {
     let shouldOverwrite = overwrite;
     if (!shouldOverwrite) {
@@ -1147,12 +811,12 @@ function escapeRegexChar(ch) {
   return /[-/\\^$+?.()|[\]{}]/.test(ch) ? `\\${ch}` : ch;
 }
 function warnIfMissingFromGitignore(cwd, envFile) {
-  const gitignorePath = join3(cwd, ".gitignore");
-  if (!existsSync3(gitignorePath)) {
+  const gitignorePath = join2(cwd, ".gitignore");
+  if (!existsSync2(gitignorePath)) {
     p.log.warn(`No .gitignore found \u2014 make sure ${envFile} is not committed.`);
     return;
   }
-  const content = readFileSync3(gitignorePath, "utf-8");
+  const content = readFileSync2(gitignorePath, "utf-8");
   if (!isEnvFileCoveredByGitignore(content, envFile)) {
     p.log.warn(`${envFile} is not in .gitignore \u2014 add it before committing.`);
   }
@@ -1194,7 +858,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect: runConnect2 } = await import("./connect-JIEIWTF3.js");
+    const { runConnect: runConnect2 } = await import("./connect-XFVSH4JZ.js");
     await runConnect2({
       apiKey: credentials.apiKey,
       projectId: credentials.projectId,
@@ -1326,7 +990,7 @@ function isSameDirectory(a, b) {
 }
 
 // src/migrate.ts
-var DOCS_BASE = "https://docs.mushimushi.dev";
+var DOCS_BASE = "https://kensaur.us/mushi-mushi/docs";
 var COMPETITOR_PACKAGES = {
   "instabug-to-mushi": [
     "instabug-reactnative",
@@ -1488,8 +1152,8 @@ Examples:
   mushi login --api-key mushi_xxx         # non-interactive / CI
   mushi login --api-key mushi_xxx --project-id <uuid>
   mushi login --upgrade-scope             # re-auth to add mcp:read + mcp:write to your key`).action(async (opts) => {
-    const { CLOUD_API_ENDPOINT: CLOUD_API_ENDPOINT2, resolveCloudEndpoint: resolveCloudEndpoint2 } = await import("./endpoint-DGS73AVM.js");
-    const endpoint = opts.endpoint ? resolveCloudEndpoint2(opts.endpoint) : CLOUD_API_ENDPOINT2;
+    const { CLOUD_API_ENDPOINT, resolveCloudEndpoint: resolveCloudEndpoint2 } = await import("./endpoint-DGS73AVM.js");
+    const endpoint = opts.endpoint ? resolveCloudEndpoint2(opts.endpoint) : CLOUD_API_ENDPOINT;
     const consoleBase = await resolveConsoleUrl();
     let apiKey = opts.apiKey;
     let projectId = opts.projectId;
@@ -2221,14 +1885,14 @@ Typical CI usage:
 import { createReadStream } from "fs";
 import { readFile, readdir } from "fs/promises";
 import { createHash } from "crypto";
-import { join as join4, relative, basename } from "path";
+import { join as join3, relative, basename } from "path";
 import * as p2 from "@clack/prompts";
 async function findMapFiles(dir) {
   const results = [];
   async function walk(current) {
     const entries = await readdir(current, { withFileTypes: true });
     for (const e of entries) {
-      const full = join4(current, e.name);
+      const full = join3(current, e.name);
       if (e.isDirectory()) {
         await walk(full);
       } else if (e.isFile() && (e.name.endsWith(".js.map") || e.name.endsWith(".css.map"))) {
@@ -2403,7 +2067,7 @@ Examples:
   mushi index ./src
   mushi index ./src --language ts --dry-run`).action(async (path, opts) => {
     const config = requireConfig({ needsProject: true });
-    const { readdir: readdir2, readFile: readFile2, stat } = await import("fs/promises");
+    const { readdir: readdir2, readFile: readFile3, stat } = await import("fs/promises");
     const nodePath2 = await import("path");
     const SKIP = /node_modules|\.git|dist|build|\.next|\.turbo|coverage/;
     const EXTS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".py", ".go", ".rs"]);
@@ -2430,7 +2094,7 @@ Examples:
 `);
         continue;
       }
-      const source = await readFile2(file, "utf8");
+      const source = await readFile3(file, "utf8");
       const relative2 = nodePath2.relative(root, file).replaceAll("\\", "/");
       count++;
       bytes += source.length;
@@ -2478,21 +2142,32 @@ Examples:
 }
 
 // src/project-bootstrap.ts
-import { writeFile } from "fs/promises";
-import { existsSync as existsSync4 } from "fs";
+import { writeFile, readFile as readFile2 } from "fs/promises";
 import nodePath from "path";
 async function writeProjectBootstrapFiles(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const envPath = nodePath.join(cwd, ".env.local");
-  const envLines = [
+  const mushiBlock = [
     "# Mushi MCP \u2014 drop into .env.local (gitignored). The MCP binary picks these up on spawn.",
     `MUSHI_API_ENDPOINT=${opts.endpoint}`,
     `MUSHI_PROJECT_ID=${opts.projectId}`,
-    `MUSHI_API_KEY=${opts.apiKey}`,
-    ""
-  ];
-  const envUpdated = existsSync4(envPath);
-  await writeFile(envPath, envLines.join("\n"), "utf8");
+    `MUSHI_API_KEY=${opts.apiKey}`
+  ].join("\n");
+  let existing = "";
+  let envUpdated = false;
+  try {
+    existing = await readFile2(envPath, "utf8");
+    envUpdated = true;
+  } catch {
+  }
+  const MUSHI_LINE_RE = /^(NEXT_PUBLIC_|NUXT_PUBLIC_|VITE_|EXPO_PUBLIC_)?MUSHI_[A-Z_]+=.*/gm;
+  const MUSHI_COMMENT_RE = /^# Mushi MCP\b.*/gm;
+  const stripped = existing.replace(MUSHI_LINE_RE, "").replace(MUSHI_COMMENT_RE, "").replace(/\n{3,}/g, "\n\n").trimEnd();
+  const prefix = stripped.length > 0 ? `${stripped}
+
+` : "";
+  await writeFile(envPath, `${prefix}${mushiBlock}
+`, "utf8");
   const mcpPath = nodePath.join(cwd, ".cursor", "mcp.json");
   const serverName = buildMcpServerName({ legacy: true });
   const serverBlock = buildMcpServerBlock({
@@ -2649,8 +2324,8 @@ Supported IDEs:
   zed       \u2014 writes ~/.config/zed/settings.json mcpServers block
 
 The command reads credentials from ~/.config/mushi/config.json (run \`mushi login\` first).`).action(async (opts) => {
-    const { writeFile: writeFile2, mkdir, readFile: readFile2 } = await import("fs/promises");
-    const { existsSync: existsSync5 } = await import("fs");
+    const { writeFile: writeFile2, mkdir, readFile: readFile3 } = await import("fs/promises");
+    const { existsSync: existsSync3 } = await import("fs");
     const nodePath2 = await import("path");
     const os = await import("os");
     const config = requireConfig({ needsProject: true });
@@ -2762,9 +2437,9 @@ The command reads credentials from ~/.config/mushi/config.json (run \`mushi logi
       }
     } else if (ideEntry.format === "zed") {
       let settings = {};
-      if (existsSync5(configPath)) {
+      if (existsSync3(configPath)) {
         try {
-          const raw = await readFile2(configPath, "utf8");
+          const raw = await readFile3(configPath, "utf8");
           settings = JSON.parse(raw);
         } catch {
         }
@@ -2884,7 +2559,11 @@ The command reads credentials from ~/.config/mushi/config.json (run \`mushi logi
               console.log(`\u26A0  Key probe returned HTTP ${probeRes.status} \u2014 check your credentials.`);
             }
           }
-        } catch {
+        } catch (probeErr) {
+          console.warn(
+            "[mushi setup] API key probe failed \u2014 verify credentials manually.",
+            probeErr instanceof Error ? probeErr.message : probeErr
+          );
         }
       }
       console.log("");
@@ -2923,6 +2602,7 @@ Examples:
 
   # CI: fail the pipeline if the fix errors
   mushi fix $REPORT_ID --agent cursor_cloud --wait && echo "Fix PR opened"`).action(async (reportId, opts) => {
+    requireUuid(reportId, "reportId");
     const cfg = loadConfig();
     if (opts.endpoint) cfg.endpoint = opts.endpoint;
     if (opts.apiKey) cfg.apiKey = opts.apiKey;
@@ -3297,9 +2977,9 @@ async function planUpgrade(cwd) {
     ...pkg?.dependencies ?? {},
     ...pkg?.devDependencies ?? {}
   };
-  const installed2 = MUSHI_PACKAGES.filter((name) => deps[name]);
+  const installed = MUSHI_PACKAGES.filter((name) => deps[name]);
   const entries = await Promise.all(
-    installed2.map(async (name) => {
+    installed.map(async (name) => {
       const current = deps[name] ?? "";
       const currentCore = current.replace(/^[\^~>=<]*/, "");
       if (!/^\d/.test(currentCore)) {
@@ -3463,11 +3143,11 @@ async function checkEndpointReachability(endpoint, doFetch = globalThis.fetch) {
 }
 async function checkSdkInstall(cwd) {
   try {
-    const { readFile: readFile2 } = await import("fs/promises");
-    const { join: join5, resolve: resolve3 } = await import("path");
+    const { readFile: readFile3 } = await import("fs/promises");
+    const { join: join4, resolve: resolve3 } = await import("path");
     const root = resolve3(cwd);
-    const pkgPath = join5(root, "package.json");
-    const pkg = JSON.parse(await readFile2(pkgPath, "utf8"));
+    const pkgPath = join4(root, "package.json");
+    const pkg = JSON.parse(await readFile3(pkgPath, "utf8"));
     const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
     const sdks = [
       "@mushi-mushi/react",
@@ -3475,11 +3155,11 @@ async function checkSdkInstall(cwd) {
       "@mushi-mushi/core",
       "@mushi-mushi/react-native"
     ];
-    const installed2 = sdks.filter((s) => deps[s]);
+    const installed = sdks.filter((s) => deps[s]);
     return {
       name: "SDK installed in this repo",
-      ok: installed2.length > 0,
-      detail: installed2.length > 0 ? installed2.map((s) => `${s}@${deps[s]}`).join(", ") : "No @mushi-mushi/* package in package.json \u2014 run `mushi init` to install"
+      ok: installed.length > 0,
+      detail: installed.length > 0 ? installed.map((s) => `${s}@${deps[s]}`).join(", ") : "No @mushi-mushi/* package in package.json \u2014 run `mushi init` to install"
     };
   } catch {
     return null;
@@ -3662,18 +3342,18 @@ async function checkQaStoriesHealth(config, doFetch = globalThis.fetch) {
 async function checkHostAppWiring(cwd) {
   const checks = [];
   try {
-    const { readFile: readFile2, access } = await import("fs/promises");
-    const { join: join5, resolve: resolve3 } = await import("path");
+    const { readFile: readFile3, access } = await import("fs/promises");
+    const { join: join4, resolve: resolve3 } = await import("path");
     const root = resolve3(cwd);
-    const pkgPath = join5(root, "package.json");
-    const pkg = JSON.parse(await readFile2(pkgPath, "utf8"));
+    const pkgPath = join4(root, "package.json");
+    const pkg = JSON.parse(await readFile3(pkgPath, "utf8"));
     const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
     const isCapHybrid = Boolean(deps["@capacitor/core"] && deps["react"]);
     const envCandidates = [".env.local", ".env"];
     let envContent = "";
     for (const f of envCandidates) {
       try {
-        envContent = await readFile2(join5(root, f), "utf8");
+        envContent = await readFile3(join4(root, f), "utf8");
         break;
       } catch {
       }
@@ -3687,7 +3367,7 @@ async function checkHostAppWiring(cwd) {
     });
     let mcpPresent = false;
     try {
-      await access(join5(root, ".cursor", "mcp.json"));
+      await access(join4(root, ".cursor", "mcp.json"));
       mcpPresent = true;
     } catch {
     }
@@ -3720,19 +3400,19 @@ async function checkHostAppWiring(cwd) {
 }
 async function checkMcpConfig(config, cwd, doFetch = globalThis.fetch) {
   const checks = [];
-  const { readFile: readFile2 } = await import("fs/promises");
-  const { join: join5, resolve: resolve3 } = await import("path");
+  const { readFile: readFile3 } = await import("fs/promises");
+  const { join: join4, resolve: resolve3 } = await import("path");
   const { homedir } = await import("os");
   const root = resolve3(cwd);
   const candidates = [
-    join5(root, ".cursor", "mcp.json"),
-    join5(homedir(), ".cursor", "mcp.json")
+    join4(root, ".cursor", "mcp.json"),
+    join4(homedir(), ".cursor", "mcp.json")
   ];
   let mcpPath = null;
   let mcpRaw = null;
   for (const candidate of candidates) {
     try {
-      const raw = await readFile2(candidate, "utf8");
+      const raw = await readFile3(candidate, "utf8");
       let parsed = {};
       try {
         parsed = JSON.parse(raw);
@@ -3878,13 +3558,13 @@ async function checkOnboardingStatus(config, _consoleBase, cwd, doFetch = global
     };
   }
   try {
-    const { readFile: readFile2 } = await import("fs/promises");
-    const { join: join5, resolve: resolve3 } = await import("path");
+    const { readFile: readFile3 } = await import("fs/promises");
+    const { join: join4, resolve: resolve3 } = await import("path");
     const root = resolve3(cwd);
     let envContent = "";
     for (const f of [".env.local", ".env"]) {
       try {
-        envContent = await readFile2(join5(root, f), "utf8");
+        envContent = await readFile3(join4(root, f), "utf8");
         break;
       } catch {
       }
@@ -5148,6 +4828,5 @@ registerAuditCommands(program);
 registerSkillsCommands(program);
 registerBillingCommands(program);
 program.parseAsync().catch((err) => {
-  console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
-  process.exit(1);
+  printAndExit(err);
 });