@mushi-mushi/cli 0.22.1 → 0.23.1

package/dist/index.js

@@ -1,16 +1,35 @@
 #!/usr/bin/env node
 import {
   FRAMEWORKS,
+  MUSHI_CLI_VERSION,
+  apiCall,
   apiKeyHeaders,
+  apiKeyHint,
   buildMcpServerBlock,
   buildMcpServerName,
+  cliSetupDeepLink,
+  consoleUrl,
   detectFramework,
   detectPackageManager,
+  die,
+  ensureClientId,
   envVarsToWrite,
   fetchIngestSetup,
+  fmtDate,
   installCommand,
+  installSignalHandlers,
   loadConfig,
+  openInBrowser,
+  pad,
+  printAndExit,
+  probeEndpointHealth,
+  projectIdHint,
   readPackageJson,
+  reportsUrl,
+  requireConfig,
+  requireUuid,
+  resolveConsoleUrl,
+  resolveConsoleUrlSync,
   runConnect,
   sanitizeApiKey,
   sanitizeCliCredentials,
@@ -18,9 +37,8 @@ import {
   sanitizeProjectId,
   saveConfig,
   writeMcpServerEntry
-} from "./chunk-R2HPR2FV.js";
+} from "./chunk-M6L22NJU.js";
 import {
-  CLOUD_API_ENDPOINT,
   TEST_REPORT_FETCH_TIMEOUT_MS,
   assertEndpoint,
   normalizeEndpoint,
@@ -30,372 +48,16 @@ import {
 // src/index.ts
 import { Command } from "commander";
 
-// src/errors.ts
-var EXIT_CODE_MAP = {
-  E_AUTH_MISSING: 2,
-  E_AUTH_INVALID: 2,
-  E_PROJECT_MISSING: 2,
-  E_ENDPOINT_INVALID: 2,
-  E_INVALID_INPUT: 2,
-  E_NOT_INTERACTIVE: 2,
-  E_NETWORK: 3,
-  E_TIMEOUT: 3,
-  E_API_ERROR: 3,
-  E_RATE_LIMITED: 3,
-  E_FILE_NOT_FOUND: 1,
-  E_FILE_PERMISSION: 1,
-  E_FRESHNESS_STALE: 1,
-  E_INTERRUPTED: 130,
-  // 128 + SIGINT (2). POSIX convention.
-  E_INTERNAL: 1
-};
-var MushiCliError = class extends Error {
-  code;
-  hint;
-  cause;
-  constructor(code, message, hint, cause) {
-    super(message);
-    this.name = "MushiCliError";
-    this.code = code;
-    if (hint) this.hint = hint;
-    if (cause !== void 0) this.cause = cause;
-  }
-  /** Exit code POSIX-aware shell scripts should branch on. */
-  get exitCode() {
-    return EXIT_CODE_MAP[this.code];
-  }
-  /**
-   * Format for `--json` output. Used by the JSON writer when a CLI
-   * subcommand was invoked with `--json` and an error escapes.
-   */
-  toJSON() {
-    return {
-      error: {
-        code: this.code,
-        message: this.message,
-        ...this.hint ? { hint: this.hint } : {}
-      }
-    };
-  }
-};
-function printAndExit(err, asJson = false) {
-  const cliErr = err instanceof MushiCliError ? err : new MushiCliError(
-    "E_INTERNAL",
-    err instanceof Error ? err.message : String(err),
-    "this is unexpected \u2014 re-run with MUSHI_DEBUG=1 and report at https://github.com/kensaurus/mushi-mushi/issues",
-    err
-  );
-  if (asJson) {
-    process.stderr.write(JSON.stringify(cliErr.toJSON()) + "\n");
-  } else {
-    process.stderr.write(`error [${cliErr.code}]: ${cliErr.message}
-`);
-    if (cliErr.hint) process.stderr.write(`  \u2192 fix: ${cliErr.hint}
-`);
-  }
-  process.exit(cliErr.exitCode);
-}
-
-// src/signals.ts
-var installed = false;
-var activeController = null;
-function installSignalHandlers() {
-  if (installed) return;
-  installed = true;
-  const abortAndExit = (signal) => {
-    activeController?.abort(
-      new MushiCliError(
-        "E_INTERRUPTED",
-        `aborted by ${signal}`,
-        "partial state on the server is safe to retry \u2014 re-run the same command"
-      )
-    );
-    const code = signal === "SIGINT" ? 130 : signal === "SIGTERM" ? 143 : 1;
-    process.nextTick(() => {
-      process.exit(code);
-    });
-  };
-  process.on("SIGINT", () => abortAndExit("SIGINT"));
-  process.on("SIGTERM", () => abortAndExit("SIGTERM"));
-}
-function getAbortSignal(external) {
-  if (external) return external.signal;
-  if (!activeController || activeController.signal.aborted) {
-    activeController = new AbortController();
-  }
-  return activeController.signal;
-}
-
-// src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.22.1" : "0.0.0-dev";
-
 // src/init.ts
 import * as p from "@clack/prompts";
 import { spawn } from "child_process";
 import { randomUUID } from "crypto";
-import { appendFileSync, existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync } from "fs";
-import { join as join3 } from "path";
-
-// src/console-url.ts
-import { existsSync, readFileSync } from "fs";
-import { dirname, join } from "path";
-var HOSTED_CONSOLE_BASE = "https://kensaur.us/mushi-mushi/admin";
-var LOCAL_ADMIN_URL = "http://localhost:6464";
-var LOCAL_PROBE_MS = 800;
-function normalizeConsoleBase(url) {
-  const trimmed = url.trim();
-  let end = trimmed.length;
-  while (end > 0 && trimmed.charCodeAt(end - 1) === 47) end--;
-  return trimmed.slice(0, end);
-}
-function consoleUrl(base, route) {
-  const normalizedRoute = route.startsWith("/") ? route : `/${route}`;
-  return `${normalizeConsoleBase(base)}${normalizedRoute}`;
-}
-function resolveConsoleUrlFromEnv() {
-  const raw = process.env["MUSHI_CONSOLE_URL"]?.trim();
-  return raw ? normalizeConsoleBase(raw) : void 0;
-}
-function isInsideMushiMonorepo(cwd) {
-  let dir = cwd;
-  for (let depth = 0; depth < 14; depth += 1) {
-    const pkgPath = join(dir, "package.json");
-    if (existsSync(pkgPath)) {
-      try {
-        const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
-        if (pkg.name === "mushi-mushi") return true;
-      } catch {
-      }
-    }
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return false;
-}
-async function probeLocalAdminConsole() {
-  try {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), LOCAL_PROBE_MS);
-    const res = await fetch(LOCAL_ADMIN_URL, {
-      signal: controller.signal,
-      method: "HEAD"
-    });
-    clearTimeout(timer);
-    if (res.ok || res.status === 404 || res.status === 401) {
-      return LOCAL_ADMIN_URL;
-    }
-  } catch {
-  }
-  return null;
-}
-function resolveConsoleUrlSync(cwd = process.cwd()) {
-  const fromEnv = resolveConsoleUrlFromEnv();
-  if (fromEnv) return fromEnv;
-  const config = loadConfig();
-  if (config.consoleUrl) return normalizeConsoleBase(config.consoleUrl);
-  if (isInsideMushiMonorepo(cwd)) return LOCAL_ADMIN_URL;
-  return HOSTED_CONSOLE_BASE;
-}
-async function resolveConsoleUrl(options) {
-  const fromEnv = resolveConsoleUrlFromEnv();
-  if (fromEnv) return fromEnv;
-  const config = loadConfig();
-  if (config.consoleUrl) return normalizeConsoleBase(config.consoleUrl);
-  const local = await probeLocalAdminConsole();
-  if (local) return local;
-  const cwd = options?.cwd ?? process.cwd();
-  if (isInsideMushiMonorepo(cwd)) return LOCAL_ADMIN_URL;
-  return HOSTED_CONSOLE_BASE;
-}
-function projectIdHint(base) {
-  return `Where to find it: ${consoleUrl(base, "/projects")} \u2192 select your project \u2192 click the UUID chip to copy (or copy it from the panel right after you create the project).`;
-}
-function apiKeyHint(base) {
-  return `Where to find it: ${consoleUrl(base, "/onboarding?tab=verify")} \u2192 Generate API key (SDK ingest needs report:write \u2014 not Settings \u2192 BYOK keys). Treat it like a password \u2014 env file only, never commit.`;
-}
-function cliSetupDeepLink(base) {
-  return consoleUrl(base, "/onboarding?tab=steps&setup=cli");
-}
-function reportsUrl(base, reportId) {
-  return reportId ? consoleUrl(base, `/reports/${reportId}`) : consoleUrl(base, "/reports");
-}
-async function openInBrowser(url) {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    return;
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    return;
-  }
-  const safeUrl = parsed.toString();
-  const { spawn: spawn2 } = await import("child_process");
-  const [command, args] = process.platform === "win32" ? (
-    // Open via rundll32's FileProtocolHandler rather than `cmd /c start`.
-    // `start` is a cmd builtin, so the URL would be re-parsed by cmd.exe and
-    // characters like `&` / `|` / `^` could still break out — exactly the
-    // injection surface CodeQL flags. rundll32 never invokes a shell: the URL
-    // is handed to the default browser as one opaque argument.
-    ["rundll32", ["url.dll,FileProtocolHandler", safeUrl]]
-  ) : process.platform === "darwin" ? ["open", [safeUrl]] : ["xdg-open", [safeUrl]];
-  await new Promise((resolve3) => {
-    try {
-      const child = spawn2(command, [...args], { stdio: "ignore", shell: false });
-      child.on("error", () => resolve3());
-      child.on("exit", () => resolve3());
-      child.unref();
-    } catch {
-      resolve3();
-    }
-  });
-}
-
-// src/cli-shared.ts
-var API_TIMEOUT_MS = 15e3;
-async function probeEndpointHealth(endpoint) {
-  const t0 = Date.now();
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), API_TIMEOUT_MS);
-  try {
-    const res = await fetch(`${endpoint}/health`, { signal: controller.signal });
-    clearTimeout(timer);
-    const body = res.headers.get("content-type")?.includes("json") ? await res.json().catch(() => ({})) : {};
-    return { ok: res.ok, status: res.status, latencyMs: Date.now() - t0, body };
-  } catch (err) {
-    clearTimeout(timer);
-    throw err;
-  }
-}
-async function apiCall(path, config, options = {}) {
-  const endpoint = config.endpoint;
-  if (!endpoint) {
-    return {
-      ok: false,
-      error: {
-        code: "NO_ENDPOINT",
-        message: "No API endpoint configured.\n  Run: mushi login --api-key <key> --endpoint <url> --project-id <id>\n  Or:  export MUSHI_API_ENDPOINT=https://<project-ref>.supabase.co/functions/v1/api"
-      }
-    };
-  }
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), API_TIMEOUT_MS);
-  const signals = [controller.signal, getAbortSignal()];
-  const compositeSignal = AbortSignal.any ? AbortSignal.any(signals) : controller.signal;
-  try {
-    const res = await fetch(`${endpoint}${path}`, {
-      ...options,
-      signal: compositeSignal,
-      headers: {
-        "Content-Type": "application/json",
-        // `apiKeyAuth` reads X-Mushi-Api-Key; the Authorization header is a
-        // fallback accepted by some older middleware. Both are sent.
-        "Authorization": `Bearer ${config.apiKey ?? ""}`,
-        "X-Mushi-Api-Key": config.apiKey ?? "",
-        "X-Mushi-Project": config.projectId ?? "",
-        "X-Mushi-Cli-Version": MUSHI_CLI_VERSION,
-        ...options.headers
-      }
-    });
-    clearTimeout(timer);
-    let body;
-    const contentType = res.headers.get("content-type") ?? "";
-    if (contentType.includes("application/json")) {
-      try {
-        body = await res.json();
-      } catch {
-        body = null;
-      }
-    } else {
-      const text2 = await res.text();
-      try {
-        body = JSON.parse(text2);
-      } catch {
-        body = {
-          ok: false,
-          error: {
-            code: `HTTP_${res.status}`,
-            message: text2.trim().slice(0, 300) || `HTTP ${res.status}`
-          }
-        };
-      }
-    }
-    if (!res.ok && typeof body === "object" && body !== null && !("ok" in body)) {
-      const b = body;
-      const nested = b["error"];
-      const errCode = nested?.["code"] ?? b["code"] ?? `HTTP_${res.status}`;
-      const errMsg = nested?.["message"] ?? b["message"] ?? `Request failed (${res.status})`;
-      return {
-        ok: false,
-        httpStatus: res.status,
-        error: { code: errCode, message: errMsg }
-      };
-    }
-    return body;
-  } catch (err) {
-    clearTimeout(timer);
-    if (err instanceof Error && err.name === "AbortError") {
-      return {
-        ok: false,
-        error: {
-          code: "TIMEOUT",
-          message: `Request timed out after ${API_TIMEOUT_MS / 1e3}s. Check your network or endpoint.`
-        }
-      };
-    }
-    return {
-      ok: false,
-      error: {
-        code: "NETWORK_ERROR",
-        message: err instanceof Error ? err.message : String(err)
-      }
-    };
-  }
-}
-function die(result, exitCode = 1) {
-  const { code, message } = result.error;
-  const status = result.httpStatus ? ` [${result.httpStatus}]` : "";
-  process.stderr.write(`error${status}: ${code} \u2014 ${message}
-`);
-  if (code === "INSUFFICIENT_SCOPE") {
-    process.stderr.write(
-      "\n  Your current API key does not have the required scope for this command.\n  New keys minted by the wizard already include both scopes. Existing keys\n  can be upgraded with:\n\n    mushi login --upgrade-scope\n\n  Or visit your console \u2192 Projects \u2192 API Keys to mint a new key.\n"
-    );
-  }
-  process.exit(exitCode);
-}
-function requireConfig(opts = {}) {
-  const config = loadConfig();
-  if (!config.apiKey) {
-    printAndExit(new MushiCliError(
-      "E_AUTH_MISSING",
-      "API key not configured.",
-      "Run: mushi login --api-key <key>  Or: export MUSHI_API_KEY=<key>"
-    ));
-  }
-  if (!config.endpoint) {
-    config.endpoint = process.env.MUSHI_API_ENDPOINT?.trim() || CLOUD_API_ENDPOINT;
-  }
-  if (opts.needsProject && !config.projectId) {
-    printAndExit(new MushiCliError(
-      "E_PROJECT_MISSING",
-      "Project ID not configured.",
-      `Run: mushi login --project-id <uuid>  Or find your project ID at ${consoleUrl(resolveConsoleUrlSync(), "/projects")}`
-    ));
-  }
-  return config;
-}
-function fmtDate(iso) {
-  if (!iso) return "\u2014";
-  return new Date(iso).toLocaleString(void 0, { dateStyle: "short", timeStyle: "short" });
-}
-function pad(s, width) {
-  return s.length >= width ? s : s + " ".repeat(width - s.length);
-}
+import { appendFileSync, existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { join as join2 } from "path";
 
 // src/device-auth.ts
 var DEVICE_FETCH_TIMEOUT_MS = 15e3;
+var DEFAULT_SLOW_DOWN_MS = 5e3;
 function trimTrailingSlash(endpoint) {
   let end = endpoint.length;
   while (end > 0 && endpoint.charCodeAt(end - 1) === 47) end--;
@@ -410,11 +72,12 @@ async function deviceFetch(url, init = {}) {
     clearTimeout(timer);
   }
 }
-async function startDeviceAuth(endpoint) {
+async function startDeviceAuth(endpoint, clientId) {
   const base = trimTrailingSlash(endpoint);
   const res = await deviceFetch(`${base}/v1/cli/auth/device/start`, {
     method: "POST",
-    headers: { "Content-Type": "application/json" }
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(clientId ? { client_id: clientId } : {})
   });
   const json = await res.json().catch(() => null);
   if (!res.ok || !json?.ok || !json.data) {
@@ -437,6 +100,12 @@ async function pollDeviceToken(endpoint, deviceCode) {
     switch (json.error) {
       case "authorization_pending":
         return { status: "pending" };
+      case "slow_down": {
+        const retryAfterHeader = res.headers?.get?.("Retry-After");
+        const retryAfterSeconds = retryAfterHeader ? Number(retryAfterHeader) : NaN;
+        const retryAfterMs = Number.isFinite(retryAfterSeconds) && retryAfterSeconds > 0 ? retryAfterSeconds * 1e3 : DEFAULT_SLOW_DOWN_MS;
+        return { status: "slow_down", retryAfterMs };
+      }
       case "access_denied":
         return { status: "denied" };
       case "expired_token":
@@ -445,9 +114,11 @@ async function pollDeviceToken(endpoint, deviceCode) {
         return {
           status: "error",
           message: json.error_description ?? json.error ?? `HTTP ${res.status}`,
-          // 5xx is a server hiccup the next poll may clear; a 4xx is a definitive
-          // rejection (already claimed / invalid_grant) that won't fix itself.
-          retryable: res.status >= 500
+          // 5xx is a server hiccup the next poll may clear; 408 (gateway
+          // timeout) is equally transient. Any other 4xx is a definitive
+          // rejection (already claimed / invalid_grant) that won't fix
+          // itself. (429/slow_down is handled above as its own outcome.)
+          retryable: res.status >= 500 || res.status === 408
         };
     }
   } catch (err) {
@@ -458,7 +129,7 @@ var defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
 async function waitForCliToken(endpoint, session, opts = {}) {
   const sleep = opts.sleep ?? defaultSleep;
   const now = opts.now ?? Date.now;
-  const intervalMs = (session.interval || 5) * 1e3;
+  let intervalMs = (session.interval || 5) * 1e3;
   const deadline = now() + (session.expires_in || 600) * 1e3;
   const maxConsecutiveErrors = opts.maxConsecutiveErrors ?? 5;
   let consecutiveErrors = 0;
@@ -476,6 +147,11 @@ async function waitForCliToken(endpoint, session, opts = {}) {
         consecutiveErrors = 0;
         opts.onPending?.();
         continue;
+      case "slow_down":
+        consecutiveErrors = 0;
+        intervalMs = Math.max(intervalMs, outcome.retryAfterMs);
+        opts.onSlowDown?.(outcome.retryAfterMs);
+        continue;
       case "denied":
         throw new Error("Login was denied in the browser.");
       case "expired":
@@ -506,7 +182,11 @@ async function listProjects(endpoint, cliToken) {
     const res = await deviceFetch(`${base}/v1/cli/projects`, { headers: cliAuthHeaders(cliToken) });
     const json = await res.json().catch(() => null);
     if (res.ok && json?.ok) return json.data?.projects ?? [];
-  } catch {
+  } catch (err) {
+    console.error(
+      "[mushi] Failed to list projects:",
+      err instanceof Error ? err.message : err
+    );
   }
   return [];
 }
@@ -599,8 +279,8 @@ function parse(version) {
 }
 
 // src/monorepo.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, readdirSync, statSync } from "fs";
-import { dirname as dirname2, join as join2, resolve } from "path";
+import { existsSync, readFileSync, readdirSync, statSync } from "fs";
+import { dirname, join, resolve } from "path";
 var WORKSPACE_GLOB_CANDIDATES = ["apps/*", "packages/*", "examples/*"];
 var FRAMEWORK_DEPS = {
   next: "Next.js",
@@ -617,9 +297,9 @@ var FRAMEWORK_DEPS = {
 function detectWorkspaceHint(cwd) {
   const root = findWorkspaceRoot(cwd);
   if (!root) return null;
-  const rootPkg = readPackageJsonSafely(join2(root, "package.json"));
+  const rootPkg = readPackageJsonSafely(join(root, "package.json"));
   if (rootPkg && getFrameworkFromPkg(rootPkg)) return null;
-  const source = existsSync2(join2(root, "pnpm-workspace.yaml")) ? "pnpm-workspace" : root === cwd ? "package-json" : "parent";
+  const source = existsSync(join(root, "pnpm-workspace.yaml")) ? "pnpm-workspace" : root === cwd ? "package-json" : "parent";
   const apps = collectAppsFromGlobs(root);
   if (apps.length === 0) return null;
   return { root, apps, source };
@@ -628,15 +308,15 @@ function findWorkspaceRoot(start) {
   let dir = resolve(start);
   for (let i = 0; i < 8; i++) {
     if (isWorkspaceRoot(dir)) return dir;
-    const parent = dirname2(dir);
+    const parent = dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
   return null;
 }
 function isWorkspaceRoot(dir) {
-  if (existsSync2(join2(dir, "pnpm-workspace.yaml"))) return true;
-  const pkg = readPackageJsonSafely(join2(dir, "package.json"));
+  if (existsSync(join(dir, "pnpm-workspace.yaml"))) return true;
+  const pkg = readPackageJsonSafely(join(dir, "package.json"));
   if (!pkg) return false;
   return Boolean(pkg.workspaces);
 }
@@ -644,8 +324,8 @@ function collectAppsFromGlobs(root) {
   const results = [];
   for (const glob of WORKSPACE_GLOB_CANDIDATES) {
     const prefix = glob.replace("/*", "");
-    const parentDir = join2(root, prefix);
-    if (!existsSync2(parentDir)) continue;
+    const parentDir = join(root, prefix);
+    if (!existsSync(parentDir)) continue;
     let entries;
     try {
       entries = readdirSync(parentDir);
@@ -653,7 +333,7 @@ function collectAppsFromGlobs(root) {
       continue;
     }
     for (const entry of entries) {
-      const pkgPath = join2(parentDir, entry, "package.json");
+      const pkgPath = join(parentDir, entry, "package.json");
       if (!isFileSafe(pkgPath)) continue;
       const pkg = readPackageJsonSafely(pkgPath);
       if (!pkg) continue;
@@ -671,14 +351,14 @@ function collectAppsFromGlobs(root) {
 function readPackageJsonSafely(path) {
   if (!isFileSafe(path)) return null;
   try {
-    return JSON.parse(readFileSync2(path, "utf-8"));
+    return JSON.parse(readFileSync(path, "utf-8"));
   } catch {
     return null;
   }
 }
 function isFileSafe(path) {
   try {
-    return existsSync2(path) && statSync(path).isFile();
+    return existsSync(path) && statSync(path).isFile();
   } catch {
     return false;
   }
@@ -767,7 +447,10 @@ async function runInit(options = {}) {
   const detected = detectFramework(cwd, pkg);
   const framework = await chooseFramework(detected, options);
   const consoleBase = await resolveConsoleUrl({ cwd });
-  const endpoint = resolveCloudEndpoint(options.endpoint);
+  const endpoint = resolveCloudEndpoint(
+    options.endpoint ?? process.env.MUSHI_API_ENDPOINT?.trim() ?? loadConfig().endpoint
+  );
+  options = { ...options, endpoint };
   const credentials = await acquireCredentials(options, consoleBase, endpoint);
   await verifyCredentials(credentials, options, consoleBase);
   const pm = detectPackageManager(cwd);
@@ -878,14 +561,14 @@ async function acquireCredentials(options, consoleBase, endpoint) {
       p.log.warn("Browser sign-in didn't complete \u2014 switching to manual entry.");
     }
   }
-  return collectCredentialsManually(options, consoleBase);
+  return collectCredentialsManually(options, consoleBase, endpoint);
 }
 async function runBrowserSignIn(options, endpoint, consoleBase) {
   const startSpin = p.spinner();
   startSpin.start("Starting secure browser sign-in\u2026");
   let session;
   try {
-    session = await startDeviceAuth(endpoint);
+    session = await startDeviceAuth(endpoint, ensureClientId());
   } catch (err) {
     startSpin.stop("Could not start browser sign-in.");
     p.log.warn(err instanceof Error ? err.message : String(err));
@@ -983,15 +666,36 @@ async function runBrowserSignIn(options, endpoint, consoleBase) {
   if (!projectId || !apiKey) return null;
   return { apiKey, projectId };
 }
-async function collectCredentialsManually(options, consoleBase) {
+async function collectCredentialsManually(options, consoleBase, endpoint) {
   const existing = loadConfig();
-  const rawProjectId = options.projectId ?? existing.projectId ?? await promptText({
+  let savedProjectId = existing.projectId;
+  let savedApiKey = existing.apiKey;
+  if (!options.projectId && !options.apiKey && savedProjectId && savedApiKey) {
+    p.log.info(
+      `Found saved credentials from a previous sign-in (project ${sanitizeSecret(savedProjectId).slice(0, 8)}\u2026).`
+    );
+    const checkSpin = p.spinner();
+    checkSpin.start("Checking saved credentials\u2026");
+    const check = await apiCall("/v1/sync/whoami", {
+      apiKey: sanitizeSecret(savedApiKey),
+      projectId: sanitizeSecret(savedProjectId),
+      endpoint
+    });
+    if (check.ok) {
+      checkSpin.stop(`Saved credentials still work (${check.data.project_name}).`);
+    } else {
+      checkSpin.stop("Saved credentials no longer authenticate \u2014 enter fresh ones below.");
+      savedProjectId = void 0;
+      savedApiKey = void 0;
+    }
+  }
+  const rawProjectId = options.projectId ?? savedProjectId ?? await promptText({
     message: "Project ID",
     placeholder: "e.g. bdafa28d-b153-482f-bd4f-42981f3fd3a4",
     hint: projectIdHint(consoleBase),
     validate: (v) => PROJECT_ID_PATTERN.test(v.trim()) ? void 0 : "Expected a UUID \u2014 copy it from the Projects page or the panel right after you create a project."
   });
-  const rawApiKey = options.apiKey ?? existing.apiKey ?? await promptText({
+  const rawApiKey = options.apiKey ?? savedApiKey ?? await promptText({
     message: "API key",
     placeholder: "mushi_xxxxxxxxxxxx",
     hint: apiKeyHint(consoleBase),
@@ -1022,10 +726,22 @@ async function verifyCredentials(credentials, options, consoleBase) {
   if (!result.ok) {
     spinner3.stop("Credentials could not be verified.");
     p.log.error(result.error?.message ?? "Authentication failed.");
-    p.log.info(`Double-check values in the console:
-  ${cliSetupDeepLink(consoleBase)}`);
+    p.log.warn("Setup did NOT complete: nothing was installed and no env vars were written.");
+    p.log.info(
+      [
+        "To recover:",
+        '  \u2022 Re-run `npx mushi-mushi` and choose "Sign in with your browser", or',
+        `  \u2022 Double-check the Project ID / API key in the console: ${cliSetupDeepLink(consoleBase)}`
+      ].join("\n")
+    );
     throw new Error("Credential verification failed \u2014 fix Project ID / API key and re-run.");
   }
+  if (result.data.project_id && result.data.project_id !== credentials.projectId) {
+    p.log.warn(
+      `Project ID ${redact(credentials.projectId)} doesn't match this API key's project \u2014 using the key's actual project (${result.data.project_name}) instead.`
+    );
+    credentials.projectId = result.data.project_id;
+  }
   spinner3.stop(`Connected to ${result.data.project_name}`);
 }
 function sanitizeSecret(raw) {
@@ -1085,10 +801,10 @@ function runCommand(pm, packages, cwd) {
   });
 }
 async function writeEnvFile(cwd, apiKey, projectId, framework, endpoint, overwrite) {
-  const target = ENV_FILES.find((f) => existsSync3(join3(cwd, f))) ?? ENV_FILES[0];
-  const targetPath = join3(cwd, target);
+  const target = ENV_FILES.find((f) => existsSync2(join2(cwd, f))) ?? ENV_FILES[0];
+  const targetPath = join2(cwd, target);
   const newVars = envVarsToWrite(apiKey, projectId, framework, endpoint);
-  const existing = existsSync3(targetPath) ? readFileSync3(targetPath, "utf-8") : "";
+  const existing = existsSync2(targetPath) ? readFileSync2(targetPath, "utf-8") : "";
   if (existing.includes("MUSHI_PROJECT_ID")) {
     let shouldOverwrite = overwrite;
     if (!shouldOverwrite) {
@@ -1147,12 +863,12 @@ function escapeRegexChar(ch) {
   return /[-/\\^$+?.()|[\]{}]/.test(ch) ? `\\${ch}` : ch;
 }
 function warnIfMissingFromGitignore(cwd, envFile) {
-  const gitignorePath = join3(cwd, ".gitignore");
-  if (!existsSync3(gitignorePath)) {
+  const gitignorePath = join2(cwd, ".gitignore");
+  if (!existsSync2(gitignorePath)) {
     p.log.warn(`No .gitignore found \u2014 make sure ${envFile} is not committed.`);
     return;
   }
-  const content = readFileSync3(gitignorePath, "utf-8");
+  const content = readFileSync2(gitignorePath, "utf-8");
   if (!isEnvFileCoveredByGitignore(content, envFile)) {
     p.log.warn(`${envFile} is not in .gitignore \u2014 add it before committing.`);
   }
@@ -1194,7 +910,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect: runConnect2 } = await import("./connect-JIEIWTF3.js");
+    const { runConnect: runConnect2 } = await import("./connect-5VPUYE6H.js");
     await runConnect2({
       apiKey: credentials.apiKey,
       projectId: credentials.projectId,
@@ -1326,7 +1042,7 @@ function isSameDirectory(a, b) {
 }
 
 // src/migrate.ts
-var DOCS_BASE = "https://docs.mushimushi.dev";
+var DOCS_BASE = "https://kensaur.us/mushi-mushi/docs";
 var COMPETITOR_PACKAGES = {
   "instabug-to-mushi": [
     "instabug-reactnative",
@@ -1488,8 +1204,8 @@ Examples:
   mushi login --api-key mushi_xxx         # non-interactive / CI
   mushi login --api-key mushi_xxx --project-id <uuid>
   mushi login --upgrade-scope             # re-auth to add mcp:read + mcp:write to your key`).action(async (opts) => {
-    const { CLOUD_API_ENDPOINT: CLOUD_API_ENDPOINT2, resolveCloudEndpoint: resolveCloudEndpoint2 } = await import("./endpoint-DGS73AVM.js");
-    const endpoint = opts.endpoint ? resolveCloudEndpoint2(opts.endpoint) : CLOUD_API_ENDPOINT2;
+    const { CLOUD_API_ENDPOINT, resolveCloudEndpoint: resolveCloudEndpoint2 } = await import("./endpoint-DGS73AVM.js");
+    const endpoint = opts.endpoint ? resolveCloudEndpoint2(opts.endpoint) : CLOUD_API_ENDPOINT;
     const consoleBase = await resolveConsoleUrl();
     let apiKey = opts.apiKey;
     let projectId = opts.projectId;
@@ -1537,7 +1253,7 @@ Examples:
     }
     let deviceData;
     try {
-      deviceData = await startDeviceAuth(endpoint);
+      deviceData = await startDeviceAuth(endpoint, ensureClientId());
     } catch (err) {
       process.stderr.write(`
 error: Could not start login session: ${err instanceof Error ? err.message : String(err)}
@@ -2221,14 +1937,14 @@ Typical CI usage:
 import { createReadStream } from "fs";
 import { readFile, readdir } from "fs/promises";
 import { createHash } from "crypto";
-import { join as join4, relative, basename } from "path";
+import { join as join3, relative, basename } from "path";
 import * as p2 from "@clack/prompts";
 async function findMapFiles(dir) {
   const results = [];
   async function walk(current) {
     const entries = await readdir(current, { withFileTypes: true });
     for (const e of entries) {
-      const full = join4(current, e.name);
+      const full = join3(current, e.name);
       if (e.isDirectory()) {
         await walk(full);
       } else if (e.isFile() && (e.name.endsWith(".js.map") || e.name.endsWith(".css.map"))) {
@@ -2544,7 +2260,7 @@ Typical first-time flow:
     console.log("");
     let session;
     try {
-      session = await startDeviceAuth(endpoint);
+      session = await startDeviceAuth(endpoint, ensureClientId());
     } catch (err) {
       process.stderr.write(`
 error: Could not start browser sign-in: ${err instanceof Error ? err.message : String(err)}
@@ -2661,7 +2377,7 @@ Supported IDEs:
 
 The command reads credentials from ~/.config/mushi/config.json (run \`mushi login\` first).`).action(async (opts) => {
     const { writeFile: writeFile2, mkdir, readFile: readFile3 } = await import("fs/promises");
-    const { existsSync: existsSync4 } = await import("fs");
+    const { existsSync: existsSync3 } = await import("fs");
     const nodePath2 = await import("path");
     const os = await import("os");
     const config = requireConfig({ needsProject: true });
@@ -2773,7 +2489,7 @@ The command reads credentials from ~/.config/mushi/config.json (run \`mushi logi
       }
     } else if (ideEntry.format === "zed") {
       let settings = {};
-      if (existsSync4(configPath)) {
+      if (existsSync3(configPath)) {
         try {
           const raw = await readFile3(configPath, "utf8");
           settings = JSON.parse(raw);
@@ -2895,7 +2611,11 @@ The command reads credentials from ~/.config/mushi/config.json (run \`mushi logi
               console.log(`\u26A0  Key probe returned HTTP ${probeRes.status} \u2014 check your credentials.`);
             }
           }
-        } catch {
+        } catch (probeErr) {
+          console.warn(
+            "[mushi setup] API key probe failed \u2014 verify credentials manually.",
+            probeErr instanceof Error ? probeErr.message : probeErr
+          );
         }
       }
       console.log("");
@@ -2934,6 +2654,7 @@ Examples:
 
   # CI: fail the pipeline if the fix errors
   mushi fix $REPORT_ID --agent cursor_cloud --wait && echo "Fix PR opened"`).action(async (reportId, opts) => {
+    requireUuid(reportId, "reportId");
     const cfg = loadConfig();
     if (opts.endpoint) cfg.endpoint = opts.endpoint;
     if (opts.apiKey) cfg.apiKey = opts.apiKey;
@@ -3308,9 +3029,9 @@ async function planUpgrade(cwd) {
     ...pkg?.dependencies ?? {},
     ...pkg?.devDependencies ?? {}
   };
-  const installed2 = MUSHI_PACKAGES.filter((name) => deps[name]);
+  const installed = MUSHI_PACKAGES.filter((name) => deps[name]);
   const entries = await Promise.all(
-    installed2.map(async (name) => {
+    installed.map(async (name) => {
       const current = deps[name] ?? "";
       const currentCore = current.replace(/^[\^~>=<]*/, "");
       if (!/^\d/.test(currentCore)) {
@@ -3475,9 +3196,9 @@ async function checkEndpointReachability(endpoint, doFetch = globalThis.fetch) {
 async function checkSdkInstall(cwd) {
   try {
     const { readFile: readFile3 } = await import("fs/promises");
-    const { join: join5, resolve: resolve3 } = await import("path");
+    const { join: join4, resolve: resolve3 } = await import("path");
     const root = resolve3(cwd);
-    const pkgPath = join5(root, "package.json");
+    const pkgPath = join4(root, "package.json");
     const pkg = JSON.parse(await readFile3(pkgPath, "utf8"));
     const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
     const sdks = [
@@ -3486,11 +3207,11 @@ async function checkSdkInstall(cwd) {
       "@mushi-mushi/core",
       "@mushi-mushi/react-native"
     ];
-    const installed2 = sdks.filter((s) => deps[s]);
+    const installed = sdks.filter((s) => deps[s]);
     return {
       name: "SDK installed in this repo",
-      ok: installed2.length > 0,
-      detail: installed2.length > 0 ? installed2.map((s) => `${s}@${deps[s]}`).join(", ") : "No @mushi-mushi/* package in package.json \u2014 run `mushi init` to install"
+      ok: installed.length > 0,
+      detail: installed.length > 0 ? installed.map((s) => `${s}@${deps[s]}`).join(", ") : "No @mushi-mushi/* package in package.json \u2014 run `mushi init` to install"
     };
   } catch {
     return null;
@@ -3674,9 +3395,9 @@ async function checkHostAppWiring(cwd) {
   const checks = [];
   try {
     const { readFile: readFile3, access } = await import("fs/promises");
-    const { join: join5, resolve: resolve3 } = await import("path");
+    const { join: join4, resolve: resolve3 } = await import("path");
     const root = resolve3(cwd);
-    const pkgPath = join5(root, "package.json");
+    const pkgPath = join4(root, "package.json");
     const pkg = JSON.parse(await readFile3(pkgPath, "utf8"));
     const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
     const isCapHybrid = Boolean(deps["@capacitor/core"] && deps["react"]);
@@ -3684,7 +3405,7 @@ async function checkHostAppWiring(cwd) {
     let envContent = "";
     for (const f of envCandidates) {
       try {
-        envContent = await readFile3(join5(root, f), "utf8");
+        envContent = await readFile3(join4(root, f), "utf8");
         break;
       } catch {
       }
@@ -3698,7 +3419,7 @@ async function checkHostAppWiring(cwd) {
     });
     let mcpPresent = false;
     try {
-      await access(join5(root, ".cursor", "mcp.json"));
+      await access(join4(root, ".cursor", "mcp.json"));
       mcpPresent = true;
     } catch {
     }
@@ -3732,12 +3453,12 @@ async function checkHostAppWiring(cwd) {
 async function checkMcpConfig(config, cwd, doFetch = globalThis.fetch) {
   const checks = [];
   const { readFile: readFile3 } = await import("fs/promises");
-  const { join: join5, resolve: resolve3 } = await import("path");
+  const { join: join4, resolve: resolve3 } = await import("path");
   const { homedir } = await import("os");
   const root = resolve3(cwd);
   const candidates = [
-    join5(root, ".cursor", "mcp.json"),
-    join5(homedir(), ".cursor", "mcp.json")
+    join4(root, ".cursor", "mcp.json"),
+    join4(homedir(), ".cursor", "mcp.json")
   ];
   let mcpPath = null;
   let mcpRaw = null;
@@ -3890,12 +3611,12 @@ async function checkOnboardingStatus(config, _consoleBase, cwd, doFetch = global
   }
   try {
     const { readFile: readFile3 } = await import("fs/promises");
-    const { join: join5, resolve: resolve3 } = await import("path");
+    const { join: join4, resolve: resolve3 } = await import("path");
     const root = resolve3(cwd);
     let envContent = "";
     for (const f of [".env.local", ".env"]) {
       try {
-        envContent = await readFile3(join5(root, f), "utf8");
+        envContent = await readFile3(join4(root, f), "utf8");
         break;
       } catch {
       }
@@ -5120,6 +4841,131 @@ Examples:
   });
 }
 
+// src/commands/completion-cli.ts
+import { Argument } from "commander";
+
+// src/completion.ts
+var SUPPORTED_SHELLS = ["bash", "zsh", "fish"];
+function isSupportedShell(value) {
+  return SUPPORTED_SHELLS.includes(value);
+}
+function buildCommandTree(program2) {
+  return program2.commands.filter((cmd) => cmd.name() !== "help").map((cmd) => ({
+    name: cmd.name(),
+    subcommands: cmd.commands.filter((sub) => sub.name() !== "help").map((sub) => sub.name()).sort()
+  })).sort((a, b) => a.name.localeCompare(b.name));
+}
+var COMPLETION_ARG_VALUES = [...SUPPORTED_SHELLS];
+function subcommandsFor(tree, name) {
+  if (name === "completion") return COMPLETION_ARG_VALUES;
+  return tree.find((n) => n.name === name)?.subcommands ?? [];
+}
+function generateBash(tree) {
+  const topLevel = tree.map((n) => n.name).join(" ");
+  const cases = tree.map((n) => {
+    const subs = subcommandsFor(tree, n.name);
+    if (subs.length === 0) return null;
+    return `    ${n.name})
+      COMPREPLY=( $(compgen -W "${subs.join(" ")}" -- "$cur") )
+      ;;`;
+  }).filter((line) => line !== null).join("\n");
+  return `###-begin-mushi-completion-###
+# mushi(1) completion \u2014 https://github.com/kensaurus/mushi-mushi
+# Install: mushi completion bash >> ~/.bashrc   (then restart your shell)
+_mushi_completion() {
+  local cur
+  cur="\${COMP_WORDS[COMP_CWORD]}"
+  COMPREPLY=()
+
+  if [ "$COMP_CWORD" -eq 1 ]; then
+    COMPREPLY=( $(compgen -W "${topLevel}" -- "$cur") )
+    return 0
+  fi
+
+  case "\${COMP_WORDS[1]}" in
+${cases}
+    *)
+      ;;
+  esac
+}
+complete -F _mushi_completion mushi
+###-end-mushi-completion-###
+`;
+}
+function generateZsh(tree) {
+  const topLevel = tree.map((n) => n.name).join(" ");
+  const cases = tree.map((n) => {
+    const subs = subcommandsFor(tree, n.name);
+    if (subs.length === 0) return null;
+    return `    ${n.name})
+      local -a subcmds; subcmds=(${subs.join(" ")})
+      _describe '${n.name} subcommand' subcmds
+      ;;`;
+  }).filter((line) => line !== null).join("\n");
+  return `#compdef mushi
+# mushi(1) completion \u2014 https://github.com/kensaurus/mushi-mushi
+# Install: mushi completion zsh > "\${fpath[1]}/_mushi"   (then restart your shell)
+_mushi() {
+  local -a top_level
+  top_level=(${topLevel})
+
+  if (( CURRENT == 2 )); then
+    _describe 'command' top_level
+    return
+  fi
+
+  case "\${words[2]}" in
+${cases}
+    *)
+      ;;
+  esac
+}
+
+_mushi
+`;
+}
+function generateFish(tree) {
+  const topLevel = tree.map((n) => n.name).join(" ");
+  const lines = [
+    "# mushi(1) completion \u2014 https://github.com/kensaurus/mushi-mushi",
+    "# Install: mushi completion fish > ~/.config/fish/completions/mushi.fish",
+    `complete -c mushi -f -n "__fish_use_subcommand" -a "${topLevel}"`
+  ];
+  for (const n of tree) {
+    const subs = subcommandsFor(tree, n.name);
+    if (subs.length === 0) continue;
+    lines.push(`complete -c mushi -f -n "__fish_seen_subcommand_from ${n.name}" -a "${subs.join(" ")}"`);
+  }
+  return lines.join("\n") + "\n";
+}
+function generateCompletionScript(shell, tree) {
+  switch (shell) {
+    case "bash":
+      return generateBash(tree);
+    case "zsh":
+      return generateZsh(tree);
+    case "fish":
+      return generateFish(tree);
+  }
+}
+
+// src/commands/completion-cli.ts
+function registerCompletionCommand(program2) {
+  program2.command("completion").description("Print a shell completion script for bash, zsh, or fish").addArgument(new Argument("<shell>", "Target shell").choices([...SUPPORTED_SHELLS])).addHelpText("after", `
+Examples:
+  eval "$(mushi completion bash)"                      # try it for the current session
+  mushi completion bash >> ~/.bashrc                   # bash: persist across sessions
+  mushi completion zsh > "\${fpath[1]}/_mushi"           # zsh: needs a dir already on $fpath
+  mushi completion fish > ~/.config/fish/completions/mushi.fish`).action((shell) => {
+    if (!isSupportedShell(shell)) {
+      console.error(`Unsupported shell "${shell}". Supported: ${SUPPORTED_SHELLS.join(", ")}`);
+      process.exit(2);
+    }
+    const tree = buildCommandTree(program2);
+    console.log(generateCompletionScript(shell, tree));
+  });
+}
+
 // src/index.ts
 installSignalHandlers();
 var program = new Command().name("mushi").description("Mushi CLI \u2014 set up the SDK, triage a report, fix from your editor").version(MUSHI_CLI_VERSION).addHelpText("after", `
@@ -5158,7 +5004,7 @@ registerQaCommands(program);
 registerAuditCommands(program);
 registerSkillsCommands(program);
 registerBillingCommands(program);
+registerCompletionCommand(program);
 program.parseAsync().catch((err) => {
-  console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
-  process.exit(1);
+  printAndExit(err);
 });