@mushi-mushi/cli 0.25.0 → 0.26.0

package/dist/index.js

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
 import {
   FRAMEWORKS,
-  MUSHI_CLI_VERSION,
   apiCall,
   apiKeyHeaders,
   apiKeyHint,
@@ -37,7 +36,10 @@ import {
   sanitizeProjectId,
   saveConfig,
   writeMcpServerEntry
-} from "./chunk-3JRQN6S4.js";
+} from "./chunk-VIHWH3IG.js";
+import {
+  MUSHI_CLI_VERSION
+} from "./chunk-TYVJU4AH.js";
 import {
   TEST_REPORT_FETCH_TIMEOUT_MS,
   assertEndpoint,
@@ -195,15 +197,15 @@ var DeviceAuthRequestError = class extends Error {
     this.retryable = status === void 0 || status >= 500 || status === 408;
   }
 };
-async function withOneRetry(run) {
+async function withOneRetry(run2) {
   try {
-    return await run();
+    return await run2();
   } catch (err) {
     if (err instanceof DeviceAuthRequestError && err.retryable) {
       if (deviceAuthRetryDelayMs > 0) {
         await defaultSleep(deviceAuthRetryDelayMs);
       }
-      return run();
+      return run2();
     }
     throw err;
   }
@@ -519,6 +521,7 @@ async function runInit(options = {}) {
   persistCliConfig(credentials.apiKey, credentials.projectId, endpoint);
   emitWizardFunnelEvent(credentials, endpoint, "wizard_env_written", { framework: framework.id });
   const enableRewards = await maybeEnableRewards(options);
+  await maybeInjectSnippet(cwd, framework, options);
   printNextSteps(framework, consoleBase, enableRewards);
   await maybeSendTestReport(credentials, { ...options, endpoint, consoleBase });
   await maybeOfferConnect(credentials, options, consoleBase);
@@ -862,7 +865,12 @@ async function writeEnvFile(cwd, apiKey, projectId, framework, endpoint, overwri
   const target = ENV_FILES.find((f) => existsSync2(join2(cwd, f))) ?? ENV_FILES[0];
   const targetPath = join2(cwd, target);
   const newVars = envVarsToWrite(apiKey, projectId, framework, endpoint);
-  const existing = existsSync2(targetPath) ? readFileSync2(targetPath, "utf-8") : "";
+  let existing = "";
+  try {
+    existing = readFileSync2(targetPath, "utf-8");
+  } catch {
+    existing = "";
+  }
   if (existing.includes("MUSHI_PROJECT_ID")) {
     let shouldOverwrite = overwrite;
     if (!shouldOverwrite) {
@@ -949,6 +957,31 @@ function emitWizardFunnelEvent(credentials, endpoint, event, metadata = {}) {
   }).catch(() => {
   });
 }
+async function maybeInjectSnippet(cwd, framework, options) {
+  if (options.yes || !process.stdin.isTTY) return;
+  const { ENTRY_CANDIDATES, injectSnippet, MUSHI_MARKER_START } = await import("./snippet-inject-LPRWTQDE.js");
+  const candidates = ENTRY_CANDIDATES[framework.id];
+  if (!candidates) return;
+  const { readFile: readFile3, writeFile: writeFile2 } = await import("fs/promises");
+  const nodePath2 = await import("path");
+  for (const rel of candidates) {
+    const abs = nodePath2.join(cwd, rel);
+    let source;
+    try {
+      source = await readFile3(abs, "utf8");
+    } catch {
+      continue;
+    }
+    const alreadyInjected = source.includes(MUSHI_MARKER_START);
+    const confirmed = await p.confirm({
+      message: alreadyInjected ? `Refresh the Mushi init block in ${rel}?` : `Add the Mushi init snippet to ${rel}? (wrapped in markers; re-runs update in place)`
+    });
+    if (p.isCancel(confirmed) || !confirmed) return;
+    await writeFile2(abs, injectSnippet(source, framework.snippet()), "utf8");
+    p.log.success(`${alreadyInjected ? "Updated" : "Added"} Mushi init block in ${rel}`);
+    return;
+  }
+}
 function printNextSteps(framework, consoleBase, enableRewards = false) {
   p.note(framework.snippet(), "Add this to your app:");
   if (enableRewards) {
@@ -982,7 +1015,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect: runConnect2 } = await import("./connect-22IHGT2L.js");
+    const { runConnect: runConnect2 } = await import("./connect-PKWAK4GL.js");
     await runConnect2({
       apiKey: credentials.apiKey,
       projectId: credentials.projectId,
@@ -1109,6 +1142,211 @@ function isSameDirectory(a, b) {
   return a.replace(/\\/g, "/").replace(/\/+$/, "") === b.replace(/\\/g, "/").replace(/\/+$/, "");
 }
 
+// src/login.ts
+function getPostLoginBannerMessage(opts) {
+  if (opts.suppressPostLoginBanner) return null;
+  if (opts.upgradeScope) {
+    return "  Key upgraded! Re-run 'mushi setup' to update your .cursor/mcp.json, then restart Cursor.";
+  }
+  return "  Run 'mushi init' to set up the SDK in this project.";
+}
+function printPostLoginBanner(opts) {
+  const message = getPostLoginBannerMessage(opts);
+  if (message) console.log(message);
+}
+var MAX_CONSECUTIVE_ERRORS = 5;
+async function pollUntilApproved(endpoint, deviceData, deps) {
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? Date.now;
+  let pollIntervalMs = (deviceData.interval ?? 5) * 1e3;
+  const deadline = now() + (deviceData.expires_in ?? 600) * 1e3;
+  let consecutiveErrors = 0;
+  let firstPoll = true;
+  while (now() < deadline) {
+    if (!firstPoll) {
+      await sleep(pollIntervalMs);
+    }
+    firstPoll = false;
+    const outcome = await deps.poll(endpoint, deviceData.device_code);
+    switch (outcome.status) {
+      case "approved":
+        return { status: "approved", cliToken: outcome.cliToken };
+      case "pending":
+        consecutiveErrors = 0;
+        continue;
+      case "slow_down":
+        consecutiveErrors = 0;
+        pollIntervalMs = Math.max(pollIntervalMs, outcome.retryAfterMs);
+        continue;
+      case "error":
+        if (outcome.retryable) {
+          consecutiveErrors += 1;
+          if (consecutiveErrors < MAX_CONSECUTIVE_ERRORS) continue;
+        }
+        return { status: "error", message: outcome.message };
+      case "denied":
+        return { status: "denied" };
+      case "expired":
+        return { status: "timeout" };
+    }
+  }
+  return { status: "timeout" };
+}
+async function resolveProjectChoice(projectsList, ask) {
+  if (projectsList.length > 0) {
+    console.log("");
+    console.log("  Your projects:");
+    projectsList.forEach((p3, i) => {
+      console.log(`    ${i + 1}. ${p3.name} (${p3.id})`);
+    });
+    console.log(`    ${projectsList.length + 1}. Create a new project`);
+    console.log("");
+    const choice = await ask(`  Pick a project [1-${projectsList.length + 1}]: `);
+    const num = parseInt(choice, 10);
+    if (num >= 1 && num <= projectsList.length) {
+      const picked = projectsList[num - 1];
+      return { kind: "picked", id: picked.id, name: picked.name };
+    }
+  }
+  console.log("");
+  const newName = (await ask("  Project name: ")).trim();
+  if (!newName) return { kind: "empty_name" };
+  return { kind: "create", name: newName };
+}
+async function runLogin(opts = {}) {
+  const { CLOUD_API_ENDPOINT, resolveCloudEndpoint: resolveCloudEndpoint2 } = await import("./endpoint-DGS73AVM.js");
+  const endpoint = opts.endpoint ? resolveCloudEndpoint2(opts.endpoint) : CLOUD_API_ENDPOINT;
+  const consoleBase = await resolveConsoleUrl();
+  let apiKey = opts.apiKey;
+  let projectId = opts.projectId;
+  if (apiKey) {
+    const config2 = loadConfig();
+    config2.apiKey = apiKey;
+    config2.endpoint = endpoint;
+    if (projectId) config2.projectId = projectId;
+    config2.consoleUrl = consoleBase;
+    saveConfig(config2);
+    console.log("");
+    console.log("  \u2713 Credentials saved.");
+    const verifyResult = await apiCall("/v1/sync/whoami", { apiKey, endpoint, projectId });
+    if (!verifyResult.ok) {
+      console.warn(`  \u26A0  Key saved, but verification failed: ${verifyResult.error?.message ?? "unknown error"}`);
+      console.warn(`     Check your key at: ${cliSetupDeepLink(consoleBase)}`);
+      return;
+    }
+    const d = verifyResult.data;
+    if (d.project_name) {
+      if (!projectId && d.project_id) {
+        config2.projectId = d.project_id;
+        saveConfig(config2);
+      }
+      console.log(`  \u2713 Project: ${d.project_name} (${d.project_id})`);
+    }
+    console.log(`  \u2713 Endpoint: ${endpoint}`);
+    console.log("");
+    if (!opts.suppressPostLoginBanner) {
+      console.log("  Run 'mushi whoami' to verify \xB7 'mushi init' to set up the SDK");
+    }
+    return;
+  }
+  if (!opts.suppressPostLoginBanner) {
+    console.log("");
+  }
+  if (opts.upgradeScope) {
+    console.log("  Mushi login \u2014 scope upgrade");
+    console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    console.log("  Re-authenticating to mint a new key with report:write + mcp:read + mcp:write scopes.");
+    console.log("  This lets the CLI admin commands (including writes) and MCP server both work with a single key.");
+    console.log("");
+  } else if (!opts.suppressPostLoginBanner) {
+    console.log("  Mushi login");
+    console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  }
+  let deviceData;
+  try {
+    deviceData = await startDeviceAuth(endpoint, ensureClientId());
+  } catch (err) {
+    process.stderr.write(`
+error: Could not start login session: ${err instanceof Error ? err.message : String(err)}
+`);
+    process.stderr.write(`  Fallback: mushi login --api-key <key> --project-id <uuid>
+`);
+    process.exit(1);
+  }
+  const verifyUrl = deviceData.verification_uri;
+  if (opts.browser !== false) {
+    try {
+      await openInBrowser(verifyUrl);
+    } catch {
+    }
+  }
+  printAuthBanner(deviceData.user_code, verifyUrl);
+  const pollResult = await pollUntilApproved(endpoint, deviceData, {
+    poll: pollDeviceToken
+  });
+  if (pollResult.status !== "approved") {
+    if (pollResult.status === "denied") printAuthFailed("denied");
+    else if (pollResult.status === "error") printAuthFailed("error", pollResult.message);
+    else printAuthFailed("timeout");
+    process.exit(1);
+  }
+  const cliToken = pollResult.cliToken;
+  printAuthApproved();
+  const projectsList = await listProjects(endpoint, cliToken);
+  let chosenProjectId = projectId;
+  let chosenProjectName;
+  if (!chosenProjectId) {
+    const { createInterface } = await import("readline");
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const ask = (q) => new Promise((resolve3) => rl.question(q, (a) => resolve3(a.trim())));
+    const choice = await resolveProjectChoice(projectsList, ask);
+    rl.close();
+    if (choice.kind === "empty_name") {
+      process.stderr.write("\nerror: Project name is required.\n");
+      process.exit(2);
+    }
+    if (choice.kind === "picked") {
+      chosenProjectId = choice.id;
+      chosenProjectName = choice.name;
+    } else {
+      try {
+        const created = await createProject(endpoint, cliToken, choice.name);
+        chosenProjectId = created.id;
+        chosenProjectName = created.name;
+        apiKey = created.apiKey ?? void 0;
+        console.log(`  \u2713 Created project "${chosenProjectName}"`);
+      } catch (err) {
+        process.stderr.write(`
+error: Could not create project: ${err instanceof Error ? err.message : String(err)}
+`);
+        process.exit(1);
+      }
+    }
+  }
+  if (!apiKey && chosenProjectId) {
+    try {
+      apiKey = await mintProjectKey(endpoint, cliToken, chosenProjectId) ?? void 0;
+    } catch {
+    }
+  }
+  const config = loadConfig();
+  config.endpoint = endpoint;
+  config.consoleUrl = consoleBase;
+  if (chosenProjectId) config.projectId = chosenProjectId;
+  if (apiKey) config.apiKey = apiKey;
+  saveConfig(config);
+  console.log("");
+  if (chosenProjectName) console.log(`  \u2713 Project: ${chosenProjectName}`);
+  if (apiKey) {
+    console.log(`  \u2713 Full-scope CLI key saved (${apiKey.slice(0, 12)}\u2026)`);
+    console.log(`    Scopes: report:write \xB7 mcp:read \xB7 mcp:write \u2014 SDK + MCP + admin CLI (incl. writes) all work with this key`);
+  } else {
+    console.log(`  \u2139  Get an SDK key at: ${apiKeyHint(consoleBase)}`);
+  }
+  console.log("");
+  printPostLoginBanner(opts);
+}
+
 // src/migrate.ts
 var DOCS_BASE = "https://kensaur.us/mushi-mushi/docs";
 var COMPETITOR_PACKAGES = {
@@ -1271,7 +1509,9 @@ Examples:
   mushi login                              # browser-guided (recommended)
   mushi login --api-key mushi_xxx         # non-interactive / CI
   mushi login --api-key mushi_xxx --project-id <uuid>
-  mushi login --upgrade-scope             # re-auth to add mcp:read + mcp:write to your key`).action(runLogin);
+  mushi login --upgrade-scope             # re-auth to add mcp:read + mcp:write to your key`).action(async (opts) => {
+    await runLogin(opts);
+  });
   program2.command("whoami").description("Verify API key and display project info").option("--json", "Machine-readable JSON output").addHelpText("after", `
 Verifies that MUSHI_API_KEY is valid and shows which project it belongs to.
 Useful after 'mushi login' to confirm credentials are correct.`).action(async (opts) => {
@@ -1363,189 +1603,6 @@ Examples:
     }
   });
 }
-async function runLogin(opts) {
-  const { CLOUD_API_ENDPOINT, resolveCloudEndpoint: resolveCloudEndpoint2 } = await import("./endpoint-DGS73AVM.js");
-  const endpoint = opts.endpoint ? resolveCloudEndpoint2(opts.endpoint) : CLOUD_API_ENDPOINT;
-  const consoleBase = await resolveConsoleUrl();
-  let apiKey = opts.apiKey;
-  let projectId = opts.projectId;
-  if (apiKey) {
-    const config2 = loadConfig();
-    config2.apiKey = apiKey;
-    config2.endpoint = endpoint;
-    if (projectId) config2.projectId = projectId;
-    config2.consoleUrl = consoleBase;
-    saveConfig(config2);
-    console.log("");
-    console.log("  \u2713 Credentials saved.");
-    const verifyResult = await apiCall(
-      "/v1/sync/whoami",
-      { apiKey, endpoint, projectId }
-    );
-    if (!verifyResult.ok) {
-      console.warn(`  \u26A0  Key saved, but verification failed: ${verifyResult.error?.message ?? "unknown error"}`);
-      console.warn(`     Check your key at: ${cliSetupDeepLink(consoleBase)}`);
-      return;
-    }
-    const d = verifyResult.data;
-    if (d.project_name) {
-      if (!projectId && d.project_id) {
-        config2.projectId = d.project_id;
-        saveConfig(config2);
-      }
-      console.log(`  \u2713 Project: ${d.project_name} (${d.project_id})`);
-    }
-    console.log(`  \u2713 Endpoint: ${endpoint}`);
-    console.log("");
-    console.log("  Run 'mushi whoami' to verify \xB7 'mushi init' to set up the SDK");
-    return;
-  }
-  console.log("");
-  if (opts.upgradeScope) {
-    console.log("  Mushi login \u2014 scope upgrade");
-    console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-    console.log("  Re-authenticating to mint a new key with report:write + mcp:read + mcp:write scopes.");
-    console.log("  This lets the CLI admin commands (including writes) and MCP server both work with a single key.");
-    console.log("");
-  } else {
-    console.log("  Mushi login");
-    console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-  }
-  let deviceData;
-  try {
-    deviceData = await startDeviceAuth(endpoint, ensureClientId());
-  } catch (err) {
-    process.stderr.write(`
-error: Could not start login session: ${err instanceof Error ? err.message : String(err)}
-`);
-    process.stderr.write(`  Fallback: mushi login --api-key <key> --project-id <uuid>
-`);
-    process.exit(1);
-  }
-  const verifyUrl = deviceData.verification_uri;
-  if (opts.browser !== false) {
-    try {
-      await openInBrowser(verifyUrl);
-    } catch {
-    }
-  }
-  printAuthBanner(deviceData.user_code, verifyUrl);
-  let cliToken = null;
-  const pollIntervalMs = (deviceData.interval ?? 5) * 1e3;
-  const deadline = Date.now() + (deviceData.expires_in ?? 600) * 1e3;
-  const MAX_CONSECUTIVE_ERRORS = 5;
-  let consecutiveErrors = 0;
-  let firstPoll = true;
-  while (Date.now() < deadline) {
-    if (!firstPoll) {
-      await new Promise((r) => setTimeout(r, pollIntervalMs));
-    }
-    firstPoll = false;
-    const outcome = await pollDeviceToken(endpoint, deviceData.device_code);
-    if (outcome.status === "approved") {
-      cliToken = outcome.cliToken;
-      break;
-    }
-    if (outcome.status === "pending") {
-      consecutiveErrors = 0;
-      continue;
-    }
-    if (outcome.status === "error") {
-      if (outcome.retryable) {
-        consecutiveErrors += 1;
-        if (consecutiveErrors < MAX_CONSECUTIVE_ERRORS) continue;
-      }
-      printAuthFailed("error", outcome.message);
-      process.exit(1);
-    }
-    if (outcome.status === "denied") {
-      printAuthFailed("denied");
-      process.exit(1);
-    }
-    if (outcome.status === "expired") {
-      printAuthFailed("timeout");
-      process.exit(1);
-    }
-  }
-  if (!cliToken) {
-    printAuthFailed("timeout");
-    process.exit(1);
-  }
-  printAuthApproved();
-  const projectsList = await listProjects(endpoint, cliToken);
-  let chosenProjectId = projectId;
-  let chosenProjectName;
-  if (!chosenProjectId) {
-    const { createInterface } = await import("readline");
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
-    const ask = (q) => new Promise((resolve3) => rl.question(q, (a) => resolve3(a.trim())));
-    if (projectsList.length > 0) {
-      console.log("");
-      console.log("  Your projects:");
-      projectsList.forEach((p3, i) => {
-        console.log(`    ${i + 1}. ${p3.name} (${p3.id})`);
-      });
-      console.log(`    ${projectsList.length + 1}. Create a new project`);
-      console.log("");
-      const choice = await ask(`  Pick a project [1-${projectsList.length + 1}]: `);
-      const num = parseInt(choice, 10);
-      if (num >= 1 && num <= projectsList.length) {
-        const picked = projectsList[num - 1];
-        chosenProjectId = picked.id;
-        chosenProjectName = picked.name;
-      }
-    }
-    if (!chosenProjectId) {
-      console.log("");
-      const newName = await ask("  Project name: ");
-      rl.close();
-      if (!newName.trim()) {
-        process.stderr.write("\nerror: Project name is required.\n");
-        process.exit(2);
-      }
-      try {
-        const created = await createProject(endpoint, cliToken, newName.trim());
-        chosenProjectId = created.id;
-        chosenProjectName = created.name;
-        apiKey = created.apiKey ?? void 0;
-        console.log(`  \u2713 Created project "${chosenProjectName}"`);
-      } catch (err) {
-        process.stderr.write(`
-error: Could not create project: ${err instanceof Error ? err.message : String(err)}
-`);
-        process.exit(1);
-      }
-    } else {
-      rl.close();
-    }
-  }
-  if (!apiKey && chosenProjectId) {
-    try {
-      apiKey = await mintProjectKey(endpoint, cliToken, chosenProjectId) ?? void 0;
-    } catch {
-    }
-  }
-  const config = loadConfig();
-  config.endpoint = endpoint;
-  config.consoleUrl = consoleBase;
-  if (chosenProjectId) config.projectId = chosenProjectId;
-  if (apiKey) config.apiKey = apiKey;
-  saveConfig(config);
-  console.log("");
-  if (chosenProjectName) console.log(`  \u2713 Project: ${chosenProjectName}`);
-  if (apiKey) {
-    console.log(`  \u2713 Full-scope CLI key saved (${apiKey.slice(0, 12)}\u2026)`);
-    console.log(`    Scopes: report:write \xB7 mcp:read \xB7 mcp:write \u2014 SDK + MCP + admin CLI (incl. writes) all work with this key`);
-  } else {
-    console.log(`  \u2139  Get an SDK key at: ${apiKeyHint(consoleBase)}`);
-  }
-  console.log("");
-  if (opts.upgradeScope) {
-    console.log("  Key upgraded! Re-run 'mushi setup' to update your .cursor/mcp.json, then restart Cursor.");
-  } else {
-    console.log("  Run 'mushi init' to set up the SDK in this project.");
-  }
-}
 
 // src/commands/deploy.ts
 function registerDeployCommands(program2) {
@@ -2447,7 +2504,7 @@ Supported IDEs:
   continue  \u2014 writes .continue/mcp.json
   zed       \u2014 writes ~/.config/zed/settings.json mcpServers block
 
-The command reads credentials from ~/.config/mushi/config.json (run \`mushi login\` first).`).action(async (opts) => {
+The command reads credentials from ~/.config/mushi/config.json. If you are not logged in yet, it runs browser sign-in first, then writes MCP config.`).action(async (opts) => {
     const { writeFile: writeFile2, mkdir, readFile: readFile3 } = await import("fs/promises");
     const { existsSync: existsSync3 } = await import("fs");
     const nodePath2 = await import("path");
@@ -2455,7 +2512,9 @@ The command reads credentials from ~/.config/mushi/config.json (run \`mushi logi
     const existingConfig = loadConfig();
     if (!existingConfig.apiKey) {
       const endpoint = resolveLoginEndpoint(opts.endpoint, existingConfig.endpoint, process.env.MUSHI_API_ENDPOINT);
-      await runLogin({ endpoint });
+      await runLogin({ endpoint, suppressPostLoginBanner: true });
+      console.log("  Continuing MCP setup\u2026");
+      console.log("");
     }
     const config = requireConfig({ needsProject: true });
     const redactKeyForDisplay = (text2) => {
@@ -2681,9 +2740,54 @@ The command reads credentials from ~/.config/mushi/config.json (run \`mushi logi
             }
             if (errCode === "INSUFFICIENT_SCOPE") {
               console.log("\n\u26A0  Your key has report:write scope only \u2014 MCP admin tools will not work.");
-              console.log("   New keys minted by the wizard include both scopes automatically.");
-              console.log("   To upgrade an existing key, run:\n");
-              console.log("     mushi login --upgrade-scope\n");
+              const canPrompt = process.stdin.isTTY && process.stdout.isTTY;
+              let upgraded = false;
+              if (canPrompt) {
+                const { createInterface } = await import("readline");
+                const rl = createInterface({ input: process.stdin, output: process.stdout });
+                const answer = await new Promise(
+                  (resolve3) => rl.question("   Upgrade this key now via browser sign-in? [Y/n] ", (a) => resolve3(a.trim().toLowerCase()))
+                );
+                rl.close();
+                if (answer === "" || answer === "y" || answer === "yes") {
+                  await runLogin({ endpoint: opts.endpoint, upgradeScope: true, suppressPostLoginBanner: true });
+                  const fresh = loadConfig();
+                  if (fresh.apiKey && ideEntry.format === "mcp-json" && !allProjectsList) {
+                    await writeMcpServerEntry({
+                      configPath,
+                      serverName,
+                      serverBlock: buildMcpServerBlock({
+                        endpoint: fresh.endpoint ?? config.endpoint,
+                        projectId: fresh.projectId ?? config.projectId ?? "",
+                        apiKey: fresh.apiKey
+                      })
+                    });
+                    console.log(`\u2713 Rewrote ${configPath} with the upgraded key`);
+                    const reprobe = await fetch(
+                      `${(fresh.endpoint ?? config.endpoint)?.replace(/\/$/, "")}/v1/admin/mcp/account-overview`,
+                      {
+                        headers: {
+                          "X-Mushi-Api-Key": fresh.apiKey,
+                          "X-Mushi-Project": fresh.projectId ?? config.projectId ?? ""
+                        },
+                        signal: AbortSignal.timeout(6e3)
+                      }
+                    ).catch(() => null);
+                    if (reprobe?.ok) {
+                      upgraded = true;
+                      console.log("\u2713 MCP key valid \u2014 restart Cursor (or your IDE) to activate");
+                    } else {
+                      console.log(`\u26A0  Re-probe after upgrade returned HTTP ${reprobe?.status ?? "error"} \u2014 run \`mushi doctor --mcp\`.`);
+                    }
+                  } else if (fresh.apiKey) {
+                    console.log("\u2713 Key upgraded \u2014 re-run `mushi setup` to rewrite the IDE config with it.");
+                  }
+                }
+              }
+              if (!upgraded && !canPrompt) {
+                console.log("   To upgrade this key, run:\n");
+                console.log("     mushi login --upgrade-scope\n");
+              }
             } else {
               console.log(`\u26A0  Key probe returned HTTP ${probeRes.status} \u2014 check your credentials.`);
             }
@@ -2701,8 +2805,36 @@ The command reads credentials from ~/.config/mushi/config.json (run \`mushi logi
         console.log(`Tip: run with --with-rules to also write the lesson-library coding hook.`);
       }
       const configRelPath = ideEntry.dir.startsWith("/") ? configPath : nodePath2.relative(cwd, configPath);
-      console.log(`
+      if (!ideEntry.dir.startsWith("/")) {
+        const gitignorePath = nodePath2.join(cwd, ".gitignore");
+        const ignoreLine = configRelPath.replaceAll("\\", "/");
+        try {
+          const { readFile: readFile4, writeFile: writeFile3 } = await import("fs/promises");
+          const existing = await readFile4(gitignorePath, "utf8").catch(() => "");
+          const lines = existing.split(/\r?\n/);
+          if (!lines.some((l) => l.trim() === ignoreLine)) {
+            const sep = existing.endsWith("\n") || existing === "" ? "" : "\n";
+            await writeFile3(
+              gitignorePath,
+              `${existing}${sep}# Mushi MCP config holds a plaintext API key
+${ignoreLine}
+`,
+              "utf8"
+            );
+            console.log(`
+\u2713 Added ${ignoreLine} to .gitignore (it contains your Mushi API key)`);
+          } else {
+            console.log(`
+Note: ${ignoreLine} is gitignored (it contains your Mushi API key).`);
+          }
+        } catch {
+          console.log(`
 Note: ${configRelPath} contains your Mushi API key \u2014 add it to .gitignore if this is a shared repo.`);
+        }
+      } else {
+        console.log(`
+Note: ${configRelPath} contains your Mushi API key.`);
+      }
     }
   });
 }
@@ -3852,6 +3984,100 @@ async function checkOnboardingStatus(config, _consoleBase, cwd, doFetch = global
     done: false
   };
 }
+async function checkVersionDrift(cwd, doFetch) {
+  const checks = [];
+  const { MUSHI_CLI_VERSION: MUSHI_CLI_VERSION2 } = await import("./version-4JARRCFG.js");
+  if (MUSHI_CLI_VERSION2 === "0.0.0-dev") return checks;
+  const parse2 = (v) => {
+    const m = v.replace(/^[~^]/, "").match(/^(\d+)\.(\d+)\.(\d+)/);
+    return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : [0, 0, 0];
+  };
+  const isBehind = (installed, latest) => {
+    const [a1, a2, a3] = parse2(installed);
+    const [b1, b2, b3] = parse2(latest);
+    return a1 !== b1 ? a1 < b1 : a2 !== b2 ? a2 < b2 : a3 < b3;
+  };
+  try {
+    const res = await doFetch("https://registry.npmjs.org/@mushi-mushi/cli/latest", {
+      signal: AbortSignal.timeout(3e3)
+    });
+    if (res.ok) {
+      const { version: latest } = await res.json();
+      if (latest && isBehind(MUSHI_CLI_VERSION2, latest)) {
+        checks.push({
+          name: "CLI version",
+          ok: true,
+          warn: true,
+          detail: `Installed ${MUSHI_CLI_VERSION2}, latest is ${latest}. Run \`mushi upgrade\` (or npm i -g @mushi-mushi/cli@latest).`
+        });
+      }
+    }
+  } catch {
+  }
+  try {
+    const { readFile: readFile3 } = await import("fs/promises");
+    const { join: join4 } = await import("path");
+    const pkg = JSON.parse(await readFile3(join4(cwd, "package.json"), "utf8"));
+    const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+    const candidates = Object.entries(deps).filter(([name]) => name.startsWith("@mushi-mushi/")).filter(([, v]) => /^[~^]?\d/.test(v));
+    const drifted = (await Promise.all(
+      candidates.map(async ([name, v]) => {
+        try {
+          const res = await doFetch(`https://registry.npmjs.org/${name}/latest`, {
+            signal: AbortSignal.timeout(3e3)
+          });
+          if (!res.ok) return null;
+          const { version: latest } = await res.json();
+          return latest && isBehind(v, latest) ? [name, v, latest] : null;
+        } catch {
+          return null;
+        }
+      })
+    )).filter((d) => d !== null);
+    if (drifted.length > 0) {
+      checks.push({
+        name: "SDK version drift",
+        ok: true,
+        warn: true,
+        detail: `${drifted.map(([n, v, l]) => `${n}@${v} (latest ${l})`).join(", ")} \u2014 behind npm latest. Run \`mushi upgrade\` in this repo.`
+      });
+    }
+  } catch {
+  }
+  return checks;
+}
+async function checkPipelineDoctor(config, doFetch) {
+  if (!config.endpoint || !config.apiKey) return [];
+  try {
+    const res = await doFetch(`${config.endpoint.replace(/\/$/, "")}/v1/admin/doctor`, {
+      headers: apiKeyHeaders(config.apiKey),
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (res.status === 401 || res.status === 403) return [];
+    if (!res.ok) {
+      return [{
+        name: "[pipeline] Server doctor",
+        ok: true,
+        warn: true,
+        detail: `GET /v1/admin/doctor returned HTTP ${res.status} \u2014 pipeline health unknown.`
+      }];
+    }
+    const body = await res.json();
+    return (body.data?.checks ?? []).map((ch) => ({
+      name: `[pipeline] ${ch.name}`,
+      ok: ch.status !== "fail",
+      warn: ch.status === "warn",
+      detail: ch.hint ? `${ch.summary} \u2192 Fix: ${ch.hint}` : ch.summary
+    }));
+  } catch {
+    return [{
+      name: "[pipeline] Server doctor",
+      ok: true,
+      warn: true,
+      detail: "Could not reach /v1/admin/doctor (timeout) \u2014 pipeline health unknown."
+    }];
+  }
+}
 async function runDoctor(config, options = {}) {
   const doFetch = options.fetch ?? globalThis.fetch;
   const checks = [];
@@ -3864,10 +4090,24 @@ async function runDoctor(config, options = {}) {
   }
   const sdkCheck = await checkSdkInstall(options.cwd ?? process.cwd());
   if (sdkCheck) checks.push(sdkCheck);
+  if (sdkCheck?.ok && !sdkCheck.warn) {
+    const { findSdkImport } = await import("./snippet-inject-LPRWTQDE.js");
+    const imported = await findSdkImport(options.cwd ?? process.cwd());
+    checks.push(
+      imported ? { name: "SDK init snippet wired", ok: true, detail: `Found SDK usage in ${imported.file}` } : {
+        name: "SDK init snippet wired",
+        ok: true,
+        warn: true,
+        detail: "Package installed but no @mushi-mushi import found in src/app \u2014 paste the init snippet from `mushi init` into your entry file."
+      }
+    );
+  }
   if (runServer) {
     const serverChecks = await checkServerPreflight(config, doFetch);
     checks.push(...serverChecks);
+    checks.push(...await checkPipelineDoctor(config, doFetch));
   }
+  checks.push(...await checkVersionDrift(options.cwd ?? process.cwd(), doFetch));
   if (runIngest) {
     const ingestChecks = await checkIngestSetup(config, doFetch);
     checks.push(...ingestChecks);
@@ -4004,13 +4244,20 @@ function registerDoctorCommand(program2) {
         result = await runDoctor(config, { ...doctorOpts, mcp: opts.mcp });
       }
       const { checks } = result;
+      const hasWarn = checks.some((c) => c.ok && c.warn);
       if (opts.json) {
-        console.log(JSON.stringify({ checks, ready: result.ready }, null, 2));
+        const jsonChecks = checks.map((c) => ({
+          ...c,
+          ...!c.ok ? { hint: fixHintForCheck(c.name) } : {}
+        }));
+        console.log(JSON.stringify({ checks: jsonChecks, ready: result.ready }, null, 2));
         if (!result.ready) process.exit(1);
+        if (hasWarn) process.exit(2);
         return;
       }
       console.log(formatDoctorResult(result));
       if (!result.ready) process.exit(1);
+      if (hasWarn) process.exit(2);
     }
   );
 }
@@ -4090,18 +4337,18 @@ function registerTddCommands(program2) {
           config
         );
         if (!runsRes.ok) break;
-        const run = runsRes.data.runs.find((r) => r.id === res.data.runId);
-        if (!run) break;
-        if (run.status === "completed") {
+        const run2 = runsRes.data.runs.find((r) => r.id === res.data.runId);
+        if (!run2) break;
+        if (run2.status === "completed") {
           console.log(`
-\u2713 Done! ${run.pages_crawled ?? 0} pages crawled.`);
-          if (run.proposal_id) console.log(`  Proposal id: ${run.proposal_id}`);
+\u2713 Done! ${run2.pages_crawled ?? 0} pages crawled.`);
+          if (run2.proposal_id) console.log(`  Proposal id: ${run2.proposal_id}`);
           console.log(`  Review in the console: Inventory \u2192 Discovery \u2192 Past proposals`);
           break;
         }
-        if (run.status === "failed") {
+        if (run2.status === "failed") {
           console.error(`
-\u2717 Crawl failed: ${run.error_message ?? "unknown"}`);
+\u2717 Crawl failed: ${run2.error_message ?? "unknown"}`);
           process.exit(1);
         }
         process.stdout.write(".");
@@ -4629,9 +4876,9 @@ Examples:
       }
       if (data.gate_runs.length > 0) {
         console.log("\nGate Results:");
-        for (const run of data.gate_runs) {
-          const g = run.status === "pass" ? "OK" : run.status === "fail" ? "FAIL" : "SKIP";
-          console.log(`  ${g} ${run.gate.padEnd(22)} ${run.status}  (${run.findings_count} finding${run.findings_count !== 1 ? "s" : ""})`);
+        for (const run2 of data.gate_runs) {
+          const g = run2.status === "pass" ? "OK" : run2.status === "fail" ? "FAIL" : "SKIP";
+          console.log(`  ${g} ${run2.gate.padEnd(22)} ${run2.status}  (${run2.findings_count} finding${run2.findings_count !== 1 ? "s" : ""})`);
         }
       }
       if (data.summary.overall === "fail") process.exit(1);
@@ -4875,25 +5122,25 @@ Pipeline started!
       console.log(JSON.stringify(result.data, null, 2));
       return;
     }
-    const run = result.data;
-    const statusIcon = run.status === "completed" ? "\u2705" : run.status === "failed" ? "\u274C" : run.status === "running" ? "\u23F3" : "\u26AA";
+    const run2 = result.data;
+    const statusIcon = run2.status === "completed" ? "\u2705" : run2.status === "failed" ? "\u274C" : run2.status === "running" ? "\u23F3" : "\u26AA";
     console.log(`
-${statusIcon}  Pipeline ${runId.slice(0, 8)} \xB7 ${run.root_skill_slug} \xB7 ${run.mode}
+${statusIcon}  Pipeline ${runId.slice(0, 8)} \xB7 ${run2.root_skill_slug} \xB7 ${run2.mode}
 `);
-    const steps = run.steps ?? [];
+    const steps = run2.steps ?? [];
     for (const step of steps) {
       const icon = step.status === "passed" ? "\u2705" : step.status === "failed" ? "\u274C" : step.status === "running" ? "\u23F3" : "\u26AA";
       const pr = step.pr_url ? ` \u2192 ${step.pr_url}` : "";
       console.log(`  ${icon} Step ${step.step_index + 1}: ${step.skill_slug}${pr}`);
       if (step.notes) console.log(`        ${step.notes}`);
     }
-    if (run.context_packet) {
+    if (run2.context_packet) {
       console.log(`
 ${"\u2500".repeat(60)}`);
       console.log(`Context Packet (paste into your Cursor agent):
 `);
-      console.log(run.context_packet.slice(0, 6e3));
-      if (run.context_packet.length > 6e3) console.log("\n\u2026 [truncated \u2014 full packet via --json]");
+      console.log(run2.context_packet.slice(0, 6e3));
+      if (run2.context_packet.length > 6e3) console.log("\n\u2026 [truncated \u2014 full packet via --json]");
     }
     console.log();
   });
@@ -5154,6 +5401,338 @@ Examples:
   });
 }
 
+// src/commands/selfhost.ts
+import { execSync as execSync2, spawnSync } from "child_process";
+import { randomBytes } from "crypto";
+function hasSupabaseCli() {
+  try {
+    const r = spawnSync("supabase", ["--version"], { encoding: "utf8", timeout: 5e3 });
+    return r.status === 0;
+  } catch {
+    return false;
+  }
+}
+function run(cmd, opts) {
+  if (opts.printOnly) {
+    console.log(`  $ ${cmd}`);
+    return { ok: true, stdout: "", stderr: "" };
+  }
+  const label = opts.label ?? cmd.slice(0, 60);
+  process.stdout.write(`  \u203A ${label} \u2026 `);
+  try {
+    const out = execSync2(cmd, {
+      cwd: opts.cwd,
+      encoding: "utf8",
+      timeout: 3e5,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    process.stdout.write("\u2713\n");
+    return { ok: true, stdout: out, stderr: "" };
+  } catch (err) {
+    process.stdout.write("\u2717\n");
+    const msg = (err instanceof Error ? err.message : String(err)).trim();
+    const stderr = err.stderr ?? "";
+    return { ok: false, stdout: "", stderr: stderr || msg };
+  }
+}
+var REQUIRED_FUNCTIONS = [
+  "api",
+  "fast-filter",
+  "classify-report",
+  "mcp",
+  "fix-worker",
+  "webhooks-github-indexer"
+];
+async function runSelfhostUp(opts) {
+  const supabaseDir = opts.cwd ? `${opts.cwd}/packages/server/supabase` : "packages/server/supabase";
+  const printOnly = !!(opts.printCommands || !hasSupabaseCli());
+  if (printOnly) {
+    console.log("");
+    console.log("supabase CLI not found (or --print-commands was passed).");
+    console.log("Run the following commands manually:\n");
+  } else {
+    console.log("");
+    console.log("mushi selfhost up \u2014 deploying self-hosted Mushi Mushi\n");
+  }
+  const steps = [];
+  if (opts.projectRef && !/^[a-z0-9-]+$/i.test(opts.projectRef)) {
+    process.stderr.write(`\u2717 --project-ref must be alphanumeric (got: ${opts.projectRef}).
+`);
+    process.exit(1);
+  }
+  if (opts.projectRef) {
+    steps.push({
+      label: `link to Supabase project ${opts.projectRef}`,
+      cmd: `supabase link --project-ref ${opts.projectRef}`,
+      critical: true
+    });
+  }
+  steps.push({
+    label: "apply database migrations",
+    cmd: "supabase db push",
+    critical: true
+  });
+  if (opts.anthropicKey && printOnly) {
+    steps.push({
+      label: "set ANTHROPIC_API_KEY secret",
+      cmd: "supabase secrets set ANTHROPIC_API_KEY=sk-ant-..."
+    });
+  } else if (opts.anthropicKey) {
+    if (!/^[A-Za-z0-9_-]+$/.test(opts.anthropicKey)) {
+      process.stderr.write(
+        "\u2717 --anthropic-key contains characters that cannot be passed through the shell safely.\n  Set it manually instead: supabase secrets set ANTHROPIC_API_KEY=<your key>\n"
+      );
+      process.exit(1);
+    }
+    steps.push({
+      label: "set ANTHROPIC_API_KEY secret",
+      cmd: `supabase secrets set ANTHROPIC_API_KEY=${opts.anthropicKey}`
+    });
+  } else if (printOnly) {
+    steps.push({
+      label: "set ANTHROPIC_API_KEY secret",
+      cmd: "supabase secrets set ANTHROPIC_API_KEY=sk-ant-..."
+    });
+  }
+  if (opts.adminBaseUrl) {
+    let adminUrlOk = false;
+    try {
+      const u = new URL(opts.adminBaseUrl);
+      adminUrlOk = (u.protocol === "https:" || u.protocol === "http:") && /^[A-Za-z0-9:/._~-]+$/.test(opts.adminBaseUrl);
+    } catch {
+      adminUrlOk = false;
+    }
+    if (!adminUrlOk) {
+      process.stderr.write(
+        `\u2717 --admin-base-url must be a plain http(s) URL (got: ${opts.adminBaseUrl}).
+`
+      );
+      process.exit(1);
+    }
+    steps.push({
+      label: "set ADMIN_BASE_URL secret",
+      cmd: `supabase secrets set ADMIN_BASE_URL=${opts.adminBaseUrl}`
+    });
+  }
+  const internalToken = randomBytes(32).toString("hex");
+  steps.push({
+    label: "set MUSHI_INTERNAL_CALLER_SECRET (recovery cron auth)",
+    cmd: `supabase secrets set MUSHI_INTERNAL_CALLER_SECRET=${printOnly ? "<openssl rand -hex 32>" : internalToken}`
+  });
+  if (!opts.skipDeploy) {
+    for (const fn of REQUIRED_FUNCTIONS) {
+      steps.push({
+        label: `deploy edge function: ${fn}`,
+        cmd: `supabase functions deploy ${fn} --no-verify-jwt`
+      });
+    }
+  }
+  steps.push({
+    label: "create screenshots storage bucket",
+    cmd: "supabase storage create screenshots --public || true"
+  });
+  let aborted = false;
+  for (const step of steps) {
+    if (printOnly) {
+      console.log(`# ${step.label}`);
+      run(step.cmd, { printOnly: true });
+      console.log("");
+    } else {
+      const result = run(step.cmd, { label: step.label, cwd: supabaseDir });
+      if (!result.ok) {
+        if (result.stderr) {
+          process.stderr.write(`    ${result.stderr.split("\n")[0]}
+`);
+        }
+        if (step.critical) {
+          process.stderr.write(
+            `
+\u2717 Critical step failed \u2014 resolve the error above and re-run.
+`
+          );
+          process.exit(1);
+        }
+        aborted = true;
+      }
+    }
+  }
+  const endpoint = opts.endpoint || loadConfig().endpoint;
+  if (endpoint) {
+    if (printOnly) {
+      console.log("# seed mushi_runtime_config via API");
+      console.log(
+        `#   mushi login --endpoint ${endpoint} --api-key <key> --project-id <pid>`
+      );
+      console.log(
+        `#   then: supabase sql --file <(echo "INSERT INTO public.mushi_runtime_config(key,value)`
+      );
+      console.log(
+        `#     VALUES ('internal_caller_token','<token>') ON CONFLICT (key) DO UPDATE SET value=EXCLUDED.value,updated_at=now()")`
+      );
+      console.log("");
+    } else if (!aborted) {
+      process.stdout.write(`  \u203A POST /v1/admin/bootstrap \u2026 `);
+      try {
+        const config = loadConfig();
+        if (config.apiKey) {
+          await apiCall("/admin/bootstrap", config, { method: "POST" });
+          process.stdout.write("\u2713\n");
+        } else {
+          process.stdout.write("skipped (not logged in)\n");
+        }
+      } catch {
+        process.stdout.write("warn (non-critical)\n");
+      }
+    }
+  }
+  if (printOnly) {
+    console.log("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    console.log("Once commands above are done, run:");
+    console.log("  mushi selfhost doctor --endpoint <your-endpoint>");
+    return;
+  }
+  if (!aborted && endpoint) {
+    console.log("");
+    console.log("Running proof step\u2026");
+    const probe = await probeEndpointHealth(endpoint).catch(() => null);
+    if (!probe?.ok) {
+      console.log("  WARN  /health did not return 200 \u2014 check function logs.");
+    } else {
+      console.log(`  OK    /health ${probe.status} ${probe.latencyMs}ms`);
+    }
+  }
+  console.log("");
+  if (aborted) {
+    console.log(
+      "Some non-critical steps failed \u2014 check stderr above, then re-run or fix manually."
+    );
+    console.log("Run `mushi selfhost doctor` once the endpoint is reachable.");
+    process.exit(2);
+  } else {
+    console.log("\u2713  selfhost up complete.");
+    console.log("");
+    console.log("Next steps:");
+    console.log(
+      "  1. mushi login --endpoint https://<ref>.supabase.co/functions/v1/api"
+    );
+    console.log("  2. mushi selfhost doctor");
+    console.log("  3. mushi init   (in your app repo)");
+  }
+}
+async function runSelfhostDoctor(opts) {
+  const config = loadConfig();
+  const endpoint = opts.endpoint || config.endpoint;
+  if (!endpoint) {
+    process.stderr.write(
+      "error: endpoint required \u2014 pass --endpoint or run `mushi login` first.\n"
+    );
+    process.exit(1);
+  }
+  let serverChecks = [];
+  try {
+    const res = await fetch(`${endpoint}/v1/admin/doctor`, {
+      headers: config.apiKey ? { Authorization: `Bearer ${config.apiKey}` } : {},
+      signal: AbortSignal.timeout(15e3)
+    });
+    if (res.ok) {
+      const body = await res.json();
+      serverChecks = body.data?.checks ?? [];
+    } else {
+      serverChecks = [
+        {
+          name: "server_doctor",
+          status: "fail",
+          summary: `/v1/admin/doctor returned HTTP ${res.status}`,
+          hint: "401 \u2192 check API key scope (needs mcp:read or admin); 403 \u2192 key not owner of this project"
+        }
+      ];
+    }
+  } catch (err) {
+    serverChecks = [
+      {
+        name: "server_doctor",
+        status: "fail",
+        summary: `unreachable: ${err instanceof Error ? err.message : String(err)}`,
+        hint: `Check that ${endpoint} is deployed and reachable.`
+      }
+    ];
+  }
+  if (opts.json) {
+    const overallStatus = serverChecks.some((c) => c.status === "fail") ? "fail" : serverChecks.some((c) => c.status === "warn") ? "warn" : "pass";
+    console.log(JSON.stringify({ status: overallStatus, checks: serverChecks }, null, 2));
+  } else {
+    for (const check of serverChecks) {
+      const tag = check.status === "pass" ? "OK  " : check.status === "warn" ? "WARN" : "FAIL";
+      console.log(`${tag}  ${check.name}  ${check.summary}`);
+      if (check.hint && check.status !== "pass") {
+        console.log(`      \u2192 Fix: ${check.hint}`);
+      }
+    }
+  }
+  const hasFailure = serverChecks.some((c) => c.status === "fail");
+  const hasWarn = serverChecks.some((c) => c.status === "warn");
+  if (hasFailure) process.exit(1);
+  if (hasWarn) process.exit(2);
+}
+function registerSelfhostCommands(program2) {
+  const selfhost = program2.command("selfhost").description("Self-hosted deployment tools");
+  selfhost.command("up").description(
+    "Bootstrap a self-hosted Mushi Mushi deployment on a Supabase project"
+  ).option(
+    "--project-ref <ref>",
+    "Supabase project ref (runs `supabase link` first)"
+  ).option(
+    "--anthropic-key <key>",
+    "Anthropic API key to set as a Supabase function secret"
+  ).option(
+    "--admin-base-url <url>",
+    "Base URL of your deployed admin console (e.g. https://your-domain.example.com/admin)"
+  ).option(
+    "--endpoint <url>",
+    "Mushi API endpoint to use for the proof step (default: from ~/.config/mushi/config.json)"
+  ).option(
+    "--skip-deploy",
+    "Skip function deploys (run db push + secrets only)"
+  ).option(
+    "--print-commands",
+    "Print the supabase CLI commands instead of running them (non-interactive / CI)"
+  ).option("--cwd <path>", "Root of the mushi-mushi repo checkout").addHelpText(
+    "after",
+    `
+Examples:
+  mushi selfhost up --project-ref abcxyzabcxyz
+  mushi selfhost up --print-commands   # copy-paste mode for CI
+  mushi selfhost up --skip-deploy      # re-run secrets/migrations only
+
+Requires the Supabase CLI (https://supabase.com/docs/guides/cli).
+If not installed, pass --print-commands to get the exact commands.
+
+After "up" completes:
+  mushi selfhost doctor --endpoint https://<ref>.supabase.co/functions/v1/api`
+  ).action(
+    async (opts) => {
+      await runSelfhostUp(opts);
+    }
+  );
+  selfhost.command("doctor").description(
+    "Check the health of a self-hosted deployment (calls GET /v1/admin/doctor)"
+  ).option(
+    "--endpoint <url>",
+    "Mushi API endpoint (default: from ~/.config/mushi/config.json)"
+  ).option("--json", "Machine-readable JSON output").addHelpText(
+    "after",
+    `
+Exit codes: 0 all pass \xB7 2 warnings only \xB7 1 any hard failure
+
+Examples:
+  mushi selfhost doctor
+  mushi selfhost doctor --endpoint https://<ref>.supabase.co/functions/v1/api
+  mushi selfhost doctor --json | jq '.checks[] | select(.status != "pass")'`
+  ).action(async (opts) => {
+    await runSelfhostDoctor(opts);
+  });
+}
+
 // src/index.ts
 installSignalHandlers();
 var program = new Command().name("mushi").description("Mushi CLI \u2014 set up the SDK, triage a report, fix from your editor").version(MUSHI_CLI_VERSION).addHelpText("after", `
@@ -5192,6 +5771,7 @@ registerQaCommands(program);
 registerAuditCommands(program);
 registerSkillsCommands(program);
 registerBillingCommands(program);
+registerSelfhostCommands(program);
 registerCompletionCommand(program);
 program.parseAsync().catch((err) => {
   printAndExit(err);