@mushi-mushi/cli 0.26.1 → 0.27.1

package/dist/index.js

@@ -17,10 +17,15 @@ import {
   fmtDate,
   installCommand,
   installSignalHandlers,
+  listProfiles,
   loadConfig,
+  maybeShowTelemetryNotice,
   openInBrowser,
+  outputIsJson,
   pad,
   printAndExit,
+  printKeyExportHint,
+  printResult,
   probeEndpointHealth,
   projectIdHint,
   readPackageJson,
@@ -29,24 +34,29 @@ import {
   requireUuid,
   resolveConsoleUrl,
   resolveConsoleUrlSync,
+  resolveProfileName,
   runConnect,
   sanitizeApiKey,
   sanitizeCliCredentials,
   sanitizeEndpoint,
   sanitizeProjectId,
   saveConfig,
+  setActiveProfile,
+  setGlobalOutputFormat,
+  trySaveKeyToKeychain,
   writeMcpServerEntry
-} from "./chunk-2ZLYNNA3.js";
+} from "./chunk-NNB2NONG.js";
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-6XYPFV23.js";
+} from "./chunk-DBAEB56N.js";
 import {
   TEST_REPORT_FETCH_TIMEOUT_MS,
   assertEndpoint,
   normalizeEndpoint,
   resolveCloudEndpoint
 } from "./chunk-LDPFTQLE.js";
+import "./chunk-PDX44BCA.js";
 
 // src/index.ts
 import { Command } from "commander";
@@ -272,6 +282,38 @@ async function mintProjectKey(endpoint, cliToken, projectId, opts = {}) {
     res.status
   );
 }
+async function revokeProjectKey(endpoint, cliToken, projectId, keyPrefix, newKeyId) {
+  const base = trimTrailingSlash(endpoint);
+  const url = `${base}/v1/cli/projects/${encodeURIComponent(projectId)}/keys/${encodeURIComponent(keyPrefix)}/revoke`;
+  let res;
+  try {
+    res = await deviceFetch(url, {
+      method: "DELETE",
+      headers: {
+        ...cliAuthHeaders(cliToken),
+        "Content-Type": "application/json"
+      },
+      body: newKeyId ? JSON.stringify({ newKeyId }) : void 0
+    });
+  } catch (err) {
+    throw new DeviceAuthRequestError(
+      "revoke_key",
+      `Could not reach ${url}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  const json = await res.json().catch(() => null);
+  if (res.ok && json?.ok) {
+    return {
+      revoked: json.revoked ?? 0,
+      revokedAt: json.revokedAt
+    };
+  }
+  throw new DeviceAuthRequestError(
+    "revoke_key",
+    json?.error?.message ?? `Could not revoke key (HTTP ${res.status}).`,
+    res.status
+  );
+}
 
 // src/freshness.ts
 var REGISTRY = "https://registry.npmjs.org";
@@ -861,6 +903,71 @@ async function checkHostAppWiring(cwd) {
   }
   return checks;
 }
+var HASH_ROUTER_PATTERNS = [
+  /\bHashRouter\b/,
+  /\bcreateHashRouter\b/,
+  /location\.hash\b/,
+  /addEventListener\(['"]hashchange['"]/
+];
+var HASH_TEMPLATE_PATTERN = /['"`]#\//;
+async function scanDirForPattern(dir, patterns, maxDepth = 6, maxFiles = 2e3) {
+  const { readdir: readdir2, readFile: readFile3 } = await import("fs/promises");
+  const { join: join4 } = await import("path");
+  let count = 0;
+  async function walk(d, depth) {
+    if (depth > maxDepth || count > maxFiles) return null;
+    let entries = [];
+    try {
+      entries = await readdir2(d, { withFileTypes: true });
+    } catch {
+      return null;
+    }
+    for (const e of entries) {
+      if (e.name.startsWith(".") || e.name === "node_modules" || e.name === "dist") continue;
+      const full = join4(d, e.name);
+      if (e.isDirectory()) {
+        const found = await walk(full, depth + 1);
+        if (found) return found;
+      } else if (/\.[cm]?[jt]sx?$/.test(e.name)) {
+        count++;
+        try {
+          const src = await readFile3(full, "utf8");
+          if (patterns.some((p3) => p3.test(src))) return full;
+        } catch {
+        }
+      }
+    }
+    return null;
+  }
+  const { resolve: resolve3 } = await import("path");
+  for (const sub of ["src", "app", "pages", "lib", "components"]) {
+    const found = await walk(join4(resolve3(dir), sub), 0);
+    if (found) return found;
+  }
+  return walk(resolve3(dir), 0);
+}
+async function checkHashRouterCapture(cwd) {
+  const hashFile = await scanDirForPattern(cwd, HASH_ROUTER_PATTERNS);
+  if (!hashFile) return [];
+  const templateFile = await scanDirForPattern(cwd, [HASH_TEMPLATE_PATTERN]);
+  if (templateFile) {
+    return [
+      {
+        name: "[host] Hash-router route capture",
+        ok: true,
+        detail: `Hash-router detected (${hashFile}) and /#/ route templates found in Mushi config \u2014 routes will be captured correctly.`
+      }
+    ];
+  }
+  return [
+    {
+      name: "[host] Hash-router route capture",
+      ok: true,
+      warn: true,
+      detail: `Hash-router detected (${hashFile}) but no /#/ route templates found in your Mushi init call. Add discoverInventory.routeTemplates with /#/-prefixed patterns (e.g. ['/#/article/[slug]']) so Mushi captures parametric hash routes correctly \u2014 without these, all hash navigations appear as a single "/#/" route in the inventory.`
+    }
+  ];
+}
 async function checkMcpConfig(config, cwd, doFetch = globalThis.fetch) {
   const checks = [];
   const { readFile: readFile3 } = await import("fs/promises");
@@ -1096,7 +1203,7 @@ async function checkOnboardingStatus(config, _consoleBase, cwd, doFetch = global
 }
 async function checkVersionDrift(cwd, doFetch) {
   const checks = [];
-  const { MUSHI_CLI_VERSION: MUSHI_CLI_VERSION2 } = await import("./version-5DCYWDRK.js");
+  const { MUSHI_CLI_VERSION: MUSHI_CLI_VERSION2 } = await import("./version-AYMUW3UQ.js");
   if (MUSHI_CLI_VERSION2 === "0.0.0-dev") return checks;
   const parse2 = (v) => {
     const m = v.replace(/^[~^]/, "").match(/^(\d+)\.(\d+)\.(\d+)/);
@@ -1201,7 +1308,7 @@ async function runDoctor(config, options = {}) {
   const sdkCheck = await checkSdkInstall(options.cwd ?? process.cwd());
   if (sdkCheck) checks.push(sdkCheck);
   if (sdkCheck?.ok && !sdkCheck.warn) {
-    const { findSdkImport } = await import("./snippet-inject-LPRWTQDE.js");
+    const { findSdkImport } = await import("./snippet-inject-CCXILWYZ.js");
     const imported = await findSdkImport(options.cwd ?? process.cwd());
     checks.push(
       imported ? { name: "SDK init snippet wired", ok: true, detail: `Found SDK usage in ${imported.file}` } : {
@@ -1229,6 +1336,8 @@ async function runDoctor(config, options = {}) {
   if (isFull || options.hostApp) {
     const hostChecks = await checkHostAppWiring(options.cwd ?? process.cwd());
     checks.push(...hostChecks);
+    const hashChecks = await checkHashRouterCapture(options.cwd ?? process.cwd());
+    checks.push(...hashChecks);
   }
   if (isFull || options.mcp) {
     const mcpChecks = await checkMcpConfig(config, options.cwd ?? process.cwd(), doFetch);
@@ -1413,6 +1522,7 @@ async function acquireCredentials(options, consoleBase, endpoint) {
     };
   }
   const existing = loadConfig();
+  maybeShowTelemetryNotice(existing);
   if (!options.projectId && !options.apiKey && existing.projectId && existing.apiKey) {
     const reuse = options.yes ? true : await p.confirm({
       message: "Use the Mushi credentials saved from your last sign-in?",
@@ -1803,10 +1913,10 @@ function emitWizardFunnelEvent(credentials, endpoint, event, metadata = {}) {
 }
 async function maybeInjectSnippet(cwd, framework, options) {
   if (options.yes || !process.stdin.isTTY) return;
-  const { ENTRY_CANDIDATES, injectSnippet, MUSHI_MARKER_START } = await import("./snippet-inject-LPRWTQDE.js");
+  const { ENTRY_CANDIDATES, injectSnippet, MUSHI_MARKER_START } = await import("./snippet-inject-CCXILWYZ.js");
   const candidates = ENTRY_CANDIDATES[framework.id];
   if (!candidates) return;
-  const { readFile: readFile3, writeFile: writeFile2 } = await import("fs/promises");
+  const { readFile: readFile3, writeFile: writeFile3 } = await import("fs/promises");
   const nodePath2 = await import("path");
   for (const rel of candidates) {
     const abs = nodePath2.join(cwd, rel);
@@ -1821,7 +1931,7 @@ async function maybeInjectSnippet(cwd, framework, options) {
       message: alreadyInjected ? `Refresh the Mushi init block in ${rel}?` : `Add the Mushi init snippet to ${rel}? (wrapped in markers; re-runs update in place)`
     });
     if (p.isCancel(confirmed) || !confirmed) return;
-    await writeFile2(abs, injectSnippet(source, framework.snippet()), "utf8");
+    await writeFile3(abs, injectSnippet(source, framework.snippet()), "utf8");
     p.log.success(`${alreadyInjected ? "Updated" : "Added"} Mushi init block in ${rel}`);
     return;
   }
@@ -1859,7 +1969,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect: runConnect2 } = await import("./connect-2LCLLN7R.js");
+    const { runConnect: runConnect2 } = await import("./connect-TWO2ZNFB.js");
     await runConnect2({
       apiKey: credentials.apiKey,
       projectId: credentials.projectId,
@@ -2058,7 +2168,7 @@ async function resolveProjectChoice(projectsList, ask) {
   return { kind: "create", name: newName };
 }
 async function runLogin(opts = {}) {
-  const { CLOUD_API_ENDPOINT, resolveCloudEndpoint: resolveCloudEndpoint2 } = await import("./endpoint-DGS73AVM.js");
+  const { CLOUD_API_ENDPOINT, resolveCloudEndpoint: resolveCloudEndpoint2 } = await import("./endpoint-TEBF4IH6.js");
   const endpoint = opts.endpoint ? resolveCloudEndpoint2(opts.endpoint) : CLOUD_API_ENDPOINT;
   const consoleBase = await resolveConsoleUrl();
   let apiKey = opts.apiKey;
@@ -2180,6 +2290,10 @@ error: Could not create project: ${err instanceof Error ? err.message : String(e
   if (chosenProjectId) config.projectId = chosenProjectId;
   if (apiKey) config.apiKey = apiKey;
   saveConfig(config);
+  if (apiKey) {
+    const profile = resolveProfileName(void 0, config.activeProfile);
+    trySaveKeyToKeychain(apiKey, profile);
+  }
   console.log("");
   if (chosenProjectName) console.log(`  \u2713 Project: ${chosenProjectName}`);
   if (apiKey) {
@@ -2510,7 +2624,7 @@ function registerDeployCommands(program2) {
 // src/commands/reports.ts
 function registerReportsCommands(program2) {
   const reports = program2.command("reports").description("Manage bug reports");
-  reports.command("list").description("List recent reports for the current project").option("--limit <n>", "Max results (1\u2013100)", "20").option("--status <status>", "Filter by status: new|triaged|in_progress|resolved|dismissed").option("--severity <severity>", "Filter by severity: critical|high|medium|low").option("--search <query>", "Full-text search in summary and description").option("--json", "Machine-readable JSON output").addHelpText("after", `
+  reports.command("list").description("List recent reports for the current project").option("--limit <n>", "Max results (1\u2013100)", "20").option("--status <status>", "Filter by status: new|triaged|in_progress|resolved|dismissed").option("--severity <severity>", "Filter by severity: critical|high|medium|low").option("--search <query>", "Full-text search in summary and description").option("--json", "Output as JSON (alias for -o json)").addHelpText("after", `
 Examples:
   mushi reports list
   mushi reports list --status new --severity critical
@@ -2523,29 +2637,28 @@ Examples:
     if (opts.search) params.set("search", opts.search);
     const result = await apiCall(`/v1/sync/reports?${params}`, config);
     if (!result.ok) die(result);
-    if (opts.json) {
-      console.log(JSON.stringify(result.data, null, 2));
-      return;
-    }
-    const rows = result.data.reports;
-    if (rows.length === 0) {
-      console.log("No reports found.");
-      return;
-    }
-    console.log(`${pad("ID", 38)} ${pad("SEV", 9)} ${pad("STATUS", 12)} ${pad("CREATED", 17)} SUMMARY`);
-    console.log("\u2500".repeat(110));
-    for (const r of rows) {
-      const sev = r.severity ?? "unset";
-      const status = r.status ?? "new";
-      const summary = (r.summary ?? r.description ?? "").slice(0, 50);
-      console.log(`${pad(r.id, 38)} ${pad(sev, 9)} ${pad(status, 12)} ${pad(fmtDate(r.created_at), 17)} ${summary}`);
-    }
-    if (result.data.total > rows.length) {
-      console.log(`
-  \u2026 ${result.data.total - rows.length} more. Use --limit to see more.`);
-    }
+    printResult(result.data, {
+      json: opts.json,
+      render(d) {
+        const rows = d.reports;
+        if (rows.length === 0) {
+          console.log("No reports found.");
+          return;
+        }
+        console.log(`${pad("ID", 38)} ${pad("SEV", 9)} ${pad("STATUS", 12)} ${pad("CREATED", 17)} SUMMARY`);
+        console.log("\u2500".repeat(110));
+        for (const r of rows) {
+          const sev = r.severity ?? "unset";
+          const status = r.status ?? "new";
+          const summary = (r.summary ?? r.description ?? "").slice(0, 50);
+          console.log(`${pad(r.id, 38)} ${pad(sev, 9)} ${pad(status, 12)} ${pad(fmtDate(r.created_at), 17)} ${summary}`);
+        }
+        if (d.total > rows.length) console.log(`
+  \u2026 ${d.total - rows.length} more. Use --limit to see more.`);
+      }
+    });
   });
-  reports.command("thread <id>").description("Show unified timeline for a report (comments, fixes, QA, pipelines)").option("--json", "Machine-readable JSON output").option("--watch", "Poll for new timeline entries (TTY only)").action(async (id, opts) => {
+  reports.command("thread <id>").description("Show unified timeline for a report (comments, fixes, QA, pipelines)").option("--json", "Output as JSON (alias for -o json)").option("--watch", "Poll for new timeline entries (TTY only)").action(async (id, opts) => {
     const config = requireConfig();
     const fetchTimeline = async () => {
       const result = await apiCall(`/v1/sync/reports/${id}/timeline`, config);
@@ -2560,7 +2673,7 @@ Examples:
       return result.data;
     };
     const render = (data) => {
-      if (opts.json) {
+      if (outputIsJson(opts.json)) {
         console.log(JSON.stringify(data, null, 2));
         return;
       }
@@ -2585,7 +2698,7 @@ Examples:
     }
     render(await fetchTimeline());
   });
-  reports.command("show <id>").description("Show full details for a single report").option("--json", "Machine-readable JSON output").action(async (id, opts) => {
+  reports.command("show <id>").description("Show full details for a single report").option("--json", "Output as JSON (alias for -o json)").action(async (id, opts) => {
     const config = requireConfig();
     const result = await apiCall(`/v1/sync/reports/${id}`, config);
     if (!result.ok) {
@@ -2596,30 +2709,28 @@ Examples:
       }
       die(result);
     }
-    if (opts.json) {
-      console.log(JSON.stringify(result.data, null, 2));
-      return;
-    }
-    const r = result.data;
-    console.log(`Report: ${r.id}`);
-    console.log(`  Status:   ${r.status ?? "new"}`);
-    console.log(`  Severity: ${r.severity ?? "unset"}`);
-    console.log(`  Category: ${r.category ?? "\u2014"}`);
-    console.log(`  Created:  ${fmtDate(r.created_at)}`);
-    if (r.summary) console.log(`  Summary:  ${r.summary}`);
-    if (r.description) {
-      console.log(`  Description:`);
-      console.log(`    ${r.description.replace(/\n/g, "\n    ")}`);
-    }
-    if (r.environment?.url) console.log(`  URL:      ${r.environment.url}`);
-    if (r.component) console.log(`  Component: ${r.component}`);
-    if (r.sentry_event_id) console.log(`  Sentry:   ${r.sentry_event_id}`);
-    if (r.fix_id) console.log(`  Fix:      ${r.fix_id}`);
-    if (r.tags && Object.keys(r.tags).length > 0) {
-      console.log(`  Tags:     ${JSON.stringify(r.tags)}`);
-    }
+    printResult(result.data, {
+      json: opts.json,
+      render(r) {
+        console.log(`Report: ${r.id}`);
+        console.log(`  Status:   ${r.status ?? "new"}`);
+        console.log(`  Severity: ${r.severity ?? "unset"}`);
+        console.log(`  Category: ${r.category ?? "\u2014"}`);
+        console.log(`  Created:  ${fmtDate(r.created_at)}`);
+        if (r.summary) console.log(`  Summary:  ${r.summary}`);
+        if (r.description) {
+          console.log(`  Description:`);
+          console.log(`    ${r.description.replace(/\n/g, "\n    ")}`);
+        }
+        if (r.environment?.url) console.log(`  URL:      ${r.environment.url}`);
+        if (r.component) console.log(`  Component: ${r.component}`);
+        if (r.sentry_event_id) console.log(`  Sentry:   ${r.sentry_event_id}`);
+        if (r.fix_id) console.log(`  Fix:      ${r.fix_id}`);
+        if (r.tags && Object.keys(r.tags).length > 0) console.log(`  Tags:     ${JSON.stringify(r.tags)}`);
+      }
+    });
   });
-  reports.command("triage <id>").description("Update the status and/or severity of a report").option("--status <status>", "New status: new|triaged|in_progress|resolved|dismissed").option("--severity <severity>", "New severity: critical|high|medium|low").option("--note <text>", "Internal triage note").option("--json", "Machine-readable JSON output").addHelpText("after", `
+  reports.command("triage <id>").description("Update the status and/or severity of a report").option("--status <status>", "New status: new|triaged|in_progress|resolved|dismissed").option("--severity <severity>", "New severity: critical|high|medium|low").option("--note <text>", "Internal triage note").option("--json", "Output as JSON (alias for -o json)").addHelpText("after", `
 Examples:
   mushi reports triage <id> --status triaged --severity high
   mushi reports triage <id> --status in_progress --note "assigned to @alice"`).action(async (id, opts) => {
@@ -2644,16 +2755,17 @@ Examples:
       }
       die(result);
     }
-    if (opts.json) {
-      console.log(JSON.stringify(result.data, null, 2));
-    } else {
-      console.log(`\u2713 Updated report ${id}`);
-      if (opts.status) console.log(`  Status:   ${opts.status}`);
-      if (opts.severity) console.log(`  Severity: ${opts.severity}`);
-      if (opts.note) console.log(`  Note:     ${opts.note}`);
-    }
+    printResult(result.data, {
+      json: opts.json,
+      render() {
+        console.log(`\u2713 Updated report ${id}`);
+        if (opts.status) console.log(`  Status:   ${opts.status}`);
+        if (opts.severity) console.log(`  Severity: ${opts.severity}`);
+        if (opts.note) console.log(`  Note:     ${opts.note}`);
+      }
+    });
   });
-  reports.command("resolve <id>").description("Mark a report as resolved (shorthand for triage --status resolved)").option("--note <text>", "Resolution note").option("--json", "Machine-readable JSON output").action(async (id, opts) => {
+  reports.command("resolve <id>").description("Mark a report as resolved (shorthand for triage --status resolved)").option("--note <text>", "Resolution note").option("--json", "Output as JSON (alias for -o json)").action(async (id, opts) => {
     const config = requireConfig();
     const body = { status: "resolved" };
     if (opts.note) body["note"] = opts.note;
@@ -2669,14 +2781,15 @@ Examples:
       }
       die(result);
     }
-    if (opts.json) {
-      console.log(JSON.stringify(result.data, null, 2));
-    } else {
-      console.log(`\u2713 Resolved report ${id}`);
-      if (opts.note) console.log(`  Note: ${opts.note}`);
-    }
+    printResult(result.data, {
+      json: opts.json,
+      render() {
+        console.log(`\u2713 Resolved report ${id}`);
+        if (opts.note) console.log(`  Note: ${opts.note}`);
+      }
+    });
   });
-  reports.command("reopen <id>").description("Reopen a resolved or dismissed report").option("--note <text>", "Note explaining the reopen").option("--json", "Machine-readable JSON output").action(async (id, opts) => {
+  reports.command("reopen <id>").description("Reopen a resolved or dismissed report").option("--note <text>", "Note explaining the reopen").option("--json", "Output as JSON (alias for -o json)").action(async (id, opts) => {
     const config = requireConfig();
     const body = { status: "reopened" };
     if (opts.note) body["note"] = opts.note;
@@ -2692,13 +2805,14 @@ Examples:
       }
       die(result);
     }
-    if (opts.json) {
-      console.log(JSON.stringify(result.data, null, 2));
-    } else {
-      console.log(`\u2713 Reopened report ${id}`);
-    }
+    printResult(result.data, {
+      json: opts.json,
+      render() {
+        console.log(`\u2713 Reopened report ${id}`);
+      }
+    });
   });
-  reports.command("verify <id>").description("Mark a fixed report as verified by the reporter (operator shortcut)").option("--note <text>", "Optional audit note").option("--json", "Machine-readable JSON output").action(async (id, opts) => {
+  reports.command("verify <id>").description("Mark a fixed report as verified by the reporter (operator shortcut)").option("--note <text>", "Optional audit note").option("--json", "Output as JSON (alias for -o json)").action(async (id, opts) => {
     const config = requireConfig();
     const body = { status: "verified" };
     if (opts.note) body["note"] = opts.note;
@@ -2707,10 +2821,14 @@ Examples:
       body: JSON.stringify(body)
     });
     if (!result.ok) die(result);
-    if (opts.json) console.log(JSON.stringify(result.data, null, 2));
-    else console.log(`\u2713 Verified report ${id}`);
+    printResult(result.data, {
+      json: opts.json,
+      render() {
+        console.log(`\u2713 Verified report ${id}`);
+      }
+    });
   });
-  reports.command("dismiss <id>").description("Dismiss a report (not a real bug / out of scope)").option("--note <text>", "Reason for dismissal").option("--json", "Machine-readable JSON output").action(async (id, opts) => {
+  reports.command("dismiss <id>").description("Dismiss a report (not a real bug / out of scope)").option("--note <text>", "Reason for dismissal").option("--json", "Output as JSON (alias for -o json)").action(async (id, opts) => {
     const config = requireConfig();
     const body = { status: "dismissed" };
     if (opts.note) body["note"] = opts.note;
@@ -2726,13 +2844,14 @@ Examples:
       }
       die(result);
     }
-    if (opts.json) {
-      console.log(JSON.stringify(result.data, null, 2));
-    } else {
-      console.log(`\u2713 Dismissed report ${id}`);
-    }
+    printResult(result.data, {
+      json: opts.json,
+      render() {
+        console.log(`\u2713 Dismissed report ${id}`);
+      }
+    });
   });
-  reports.command("reply <id> <message>").description("Send a visible reply to the reporter widget for a report").option("--author <name>", 'Display name for the sender (default: "Mushi Admin")').option("--json", "Machine-readable JSON output").addHelpText("after", `
+  reports.command("reply <id> <message>").description("Send a visible reply to the reporter widget for a report").option("--author <name>", 'Display name for the sender (default: "Mushi Admin")').option("--json", "Output as JSON (alias for -o json)").addHelpText("after", `
 Examples:
   mushi reports reply abc123 "Thanks for reporting \u2014 fixing this in the next release."
   mushi reports reply abc123 "Can you share a screenshot?" --author "Alice"`).action(async (id, message, opts) => {
@@ -2751,13 +2870,14 @@ Examples:
       }
       die(result);
     }
-    if (opts.json) {
-      console.log(JSON.stringify(result.data, null, 2));
-    } else {
-      console.log(`\u2713 Reply sent to reporter for report ${id}`);
-    }
+    printResult(result.data, {
+      json: opts.json,
+      render() {
+        console.log(`\u2713 Reply sent to reporter for report ${id}`);
+      }
+    });
   });
-  reports.command("search <query>").description("Search reports by keyword in summary and description").option("--limit <n>", "Max results (1\u201350)", "10").option("--status <status>", "Filter by status").option("--json", "Machine-readable JSON output").addHelpText("after", `
+  reports.command("search <query>").description("Search reports by keyword in summary and description").option("--limit <n>", "Max results (1\u201350)", "10").option("--status <status>", "Filter by status").option("--json", "Output as JSON (alias for -o json)").addHelpText("after", `
 Examples:
   mushi reports search "login button"
   mushi reports search "404 error" --status new --limit 20`).action(async (query, opts) => {
@@ -2767,24 +2887,25 @@ Examples:
     if (opts.status) params.set("status", opts.status);
     const result = await apiCall(`/v1/sync/reports?${params}`, config);
     if (!result.ok) die(result);
-    if (opts.json) {
-      console.log(JSON.stringify(result.data, null, 2));
-      return;
-    }
-    const rows = result.data.reports;
-    if (rows.length === 0) {
-      console.log(`No reports matching "${query}".`);
-      return;
-    }
-    console.log(`${rows.length} result${rows.length === 1 ? "" : "s"} for "${query}":`);
-    console.log("");
-    for (const r of rows) {
-      console.log(`  ${r.id}`);
-      console.log(`    ${r.severity ?? "unset"} \xB7 ${r.status ?? "new"} \xB7 ${fmtDate(r.created_at)}`);
-      const text2 = r.summary ?? r.description ?? "";
-      if (text2) console.log(`    ${text2.slice(0, 80)}`);
-      console.log("");
-    }
+    printResult(result.data, {
+      json: opts.json,
+      render(d) {
+        const rows = d.reports;
+        if (rows.length === 0) {
+          console.log(`No reports matching "${query}".`);
+          return;
+        }
+        console.log(`${rows.length} result${rows.length === 1 ? "" : "s"} for "${query}":`);
+        console.log("");
+        for (const r of rows) {
+          console.log(`  ${r.id}`);
+          console.log(`    ${r.severity ?? "unset"} \xB7 ${r.status ?? "new"} \xB7 ${fmtDate(r.created_at)}`);
+          const text2 = r.summary ?? r.description ?? "";
+          if (text2) console.log(`    ${text2.slice(0, 80)}`);
+          console.log("");
+        }
+      }
+    });
   });
 }
 
@@ -2897,7 +3018,7 @@ AI code review context.
 Typical CI usage:
   MUSHI_API_KEY=$KEY MUSHI_PROJECT_ID=$PID MUSHI_API_ENDPOINT=$URL \\
     npx @mushi-mushi/cli sync-lessons --cwd .`).action(async (opts) => {
-    const { writeFile: writeFile2, mkdir } = await import("fs/promises");
+    const { writeFile: writeFile3, mkdir } = await import("fs/promises");
     const nodePath2 = await import("path");
     const config = requireConfig();
     const cwd = opts.cwd ?? process.cwd();
@@ -2925,7 +3046,7 @@ Typical CI usage:
       return;
     }
     await mkdir(nodePath2.dirname(target), { recursive: true });
-    await writeFile2(target, JSON.stringify(output, null, 2) + "\n", "utf8");
+    await writeFile3(target, JSON.stringify(output, null, 2) + "\n", "utf8");
     if (opts.json) {
       console.log(JSON.stringify({ ok: true, path: target, count: lessons2.length }));
     } else {
@@ -2936,8 +3057,8 @@ Typical CI usage:
 
 // src/sourcemaps.ts
 import { createReadStream } from "fs";
-import { readFile, readdir } from "fs/promises";
-import { createHash } from "crypto";
+import { readFile, readdir, writeFile } from "fs/promises";
+import { createHash, randomUUID as randomUUID2 } from "crypto";
 import { join as join3, relative, basename } from "path";
 import * as p2 from "@clack/prompts";
 async function findMapFiles(dir) {
@@ -2965,7 +3086,31 @@ function fileHash(path) {
     stream.on("error", reject);
   });
 }
-async function uploadFile(filePath, release, endpoint, apiKey) {
+async function injectDebugId(mapPath) {
+  const jsPath = mapPath.endsWith(".js.map") ? mapPath.slice(0, -4) : null;
+  if (!jsPath) return null;
+  const debugId = randomUUID2();
+  try {
+    const jsContents = await readFile(jsPath, "utf-8");
+    if (!jsContents.includes("//# debugId=")) {
+      await writeFile(jsPath, `${jsContents}
+//# debugId=${debugId}`, "utf-8");
+    }
+  } catch {
+  }
+  try {
+    const mapContents = await readFile(mapPath, "utf-8");
+    const parsed = JSON.parse(mapContents);
+    if (!parsed["debugId"]) {
+      parsed["debugId"] = debugId;
+      await writeFile(mapPath, JSON.stringify(parsed), "utf-8");
+    }
+  } catch {
+    return null;
+  }
+  return debugId;
+}
+async function uploadFile(filePath, release, endpoint, apiKey, debugId) {
   const sha256 = await fileHash(filePath);
   try {
     const checkRes = await fetch(
@@ -2984,6 +3129,7 @@ async function uploadFile(filePath, release, endpoint, apiKey) {
   form.append("filename", relative(process.cwd(), filePath).replaceAll("\\", "/"));
   form.append("release", release);
   form.append("sha256", sha256);
+  if (debugId) form.append("debug_id", debugId);
   const res = await fetch(`${endpoint}/v1/sourcemaps`, {
     method: "POST",
     headers: { Authorization: `Bearer ${apiKey}`, "X-Mushi-Api-Key": apiKey },
@@ -3040,6 +3186,20 @@ async function runSourcemapsUpload(opts) {
     p2.outro(`${files.length} file${files.length === 1 ? "" : "s"} would be uploaded`);
     return;
   }
+  const debugIds = /* @__PURE__ */ new Map();
+  if (opts.inject) {
+    const injectSpin = p2.spinner();
+    injectSpin.start("Injecting Debug IDs\u2026");
+    let injected = 0;
+    for (const filePath of files) {
+      const debugId = await injectDebugId(filePath);
+      if (debugId) {
+        debugIds.set(filePath, debugId);
+        injected++;
+      }
+    }
+    injectSpin.stop(`Injected Debug IDs into ${injected} file${injected === 1 ? "" : "s"}`);
+  }
   let uploaded = 0;
   let skipped = 0;
   let failed = 0;
@@ -3047,7 +3207,7 @@ async function runSourcemapsUpload(opts) {
     const rel = relative(process.cwd(), filePath).replaceAll("\\", "/");
     const fs = p2.spinner();
     fs.start(rel);
-    const result = await uploadFile(filePath, opts.release, endpoint, apiKey);
+    const result = await uploadFile(filePath, opts.release, endpoint, apiKey, debugIds.get(filePath));
     if (result.skipped) {
       fs.stop(`\u21A9  ${rel} (already uploaded)`);
       skipped++;
@@ -3078,7 +3238,7 @@ async function runSourcemapsUpload(opts) {
 
 // src/commands/diagnostics.ts
 function registerDiagnosticsCommands(program2) {
-  program2.command("test").description("Submit a synthetic test report to verify the ingestion pipeline end-to-end").option("--json", "Machine-readable JSON output").action(async (opts) => {
+  program2.command("test").description("Submit a synthetic test report to verify the ingestion pipeline end-to-end").option("--json", "Machine-readable JSON output (alias for -o json)").action(async (opts) => {
     const config = requireConfig();
     const result = await apiCall("/v1/reports", config, {
       method: "POST",
@@ -3101,17 +3261,17 @@ function registerDiagnosticsCommands(program2) {
       })
     });
     if (!result.ok) die(result);
-    if (opts.json) {
-      console.log(JSON.stringify(result.data, null, 2));
-    } else {
-      const d = result.data;
-      console.log(`\u2713 Test report submitted`);
-      console.log(`  ID:     ${d.reportId}`);
-      console.log(`  Status: ${d.status}`);
-      console.log(`  View:   ${reportsUrl(resolveConsoleUrlSync(), d.reportId)}`);
-    }
+    printResult(result.data, {
+      json: opts.json,
+      render(d) {
+        console.log(`\u2713 Test report submitted`);
+        console.log(`  ID:     ${d.reportId}`);
+        console.log(`  Status: ${d.status}`);
+        console.log(`  View:   ${reportsUrl(resolveConsoleUrlSync(), d.reportId)}`);
+      }
+    });
   });
-  program2.command("index <path>").description("Walk a local repo and upload code chunks to the Mushi RAG indexer").option("--language <lang>", "Limit to one language: ts, tsx, js, py, go, rs").option("--dry-run", "Show what would be uploaded without sending").option("--json", "Machine-readable summary: { files, bytes }").addHelpText("after", `
+  program2.command("index <path>").description("Walk a local repo and upload code chunks to the Mushi RAG indexer").option("--language <lang>", "Limit to one language: ts, tsx, js, py, go, rs").option("--dry-run", "Show what would be uploaded without sending").option("--json", "Machine-readable summary: { files, bytes } (alias for -o json)").addHelpText("after", `
 Uploads source code into the Mushi vector index so the fix-worker can
 retrieve relevant context when generating patches. Only needed for private
 repos that cannot be auto-indexed via GitHub App.
@@ -3169,8 +3329,9 @@ Examples:
 `);
       }
     }
-    if (opts.json) {
-      console.log(JSON.stringify({ ok: errors === 0, files: count, bytes, errors }));
+    const summary = { ok: errors === 0, files: count, bytes, errors };
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(summary, null, 2));
     } else {
       const kb = (bytes / 1024).toFixed(1);
       console.log(`
@@ -3179,13 +3340,15 @@ Indexed ${count} files (${kb} KB) into project ${config.projectId}${errors ? ` \
     if (errors > 0) process.exit(1);
   });
   const sourcemaps = program2.command("sourcemaps").description("Source map management");
-  sourcemaps.command("upload").description("Upload source maps to Mushi (idempotent, SHA256-keyed) for stack trace symbolication").requiredOption("--release <version>", "Release identifier, e.g. 1.0.0 or a git SHA").option("--dir <path>", "Directory containing .map files", "./dist").option("--dry-run", "List files that would be uploaded without uploading").option("-e, --endpoint <url>", "API endpoint (overrides MUSHI_API_ENDPOINT)").option("--api-key <key>", "API key (overrides MUSHI_API_KEY)").option("--silent", "Suppress progress output").addHelpText("after", `
+  sourcemaps.command("upload").description("Upload source maps to Mushi (idempotent, SHA256-keyed) for stack trace symbolication").requiredOption("--release <version>", "Release identifier, e.g. 1.0.0 or a git SHA").option("--dir <path>", "Directory containing .map files", "./dist").option("--inject", "Inject a Debug ID (UUID) into each .js and .map before uploading for exact stack-trace resolution").option("--dry-run", "List files that would be uploaded without uploading").option("-e, --endpoint <url>", "API endpoint (overrides MUSHI_API_ENDPOINT)").option("--api-key <key>", "API key (overrides MUSHI_API_KEY)").option("--silent", "Suppress progress output").addHelpText("after", `
 Examples:
   mushi sourcemaps upload --release 1.0.0
-  mushi sourcemaps upload --release $(git rev-parse --short HEAD) --dir ./dist`).action(async (opts) => {
+  mushi sourcemaps upload --release $(git rev-parse --short HEAD) --dir ./dist
+  mushi sourcemaps upload --release 1.0.0 --inject   # recommended: adds Debug IDs`).action(async (opts) => {
     await runSourcemapsUpload({
       release: opts.release,
       dir: opts.dir,
+      inject: opts.inject,
       dryRun: opts.dryRun,
       endpoint: opts.endpoint,
       apiKey: opts.apiKey,
@@ -3195,7 +3358,7 @@ Examples:
 }
 
 // src/project-bootstrap.ts
-import { writeFile, readFile as readFile2 } from "fs/promises";
+import { writeFile as writeFile2, readFile as readFile2 } from "fs/promises";
 import nodePath from "path";
 async function writeProjectBootstrapFiles(opts) {
   const cwd = opts.cwd ?? process.cwd();
@@ -3219,7 +3382,7 @@ async function writeProjectBootstrapFiles(opts) {
   const prefix = stripped.length > 0 ? `${stripped}
 
 ` : "";
-  await writeFile(envPath, `${prefix}${mushiBlock}
+  await writeFile2(envPath, `${prefix}${mushiBlock}
 `, "utf8");
   const mcpPath = nodePath.join(cwd, ".cursor", "mcp.json");
   const serverName = buildMcpServerName({ legacy: true });
@@ -3366,7 +3529,7 @@ function resolveLoginEndpoint(optsEndpoint, existingConfigEndpoint, envEndpoint)
   return optsEndpoint ?? existingConfigEndpoint ?? envEndpoint?.trim();
 }
 function registerSetupCommands(program2) {
-  program2.command("setup").description("Wire Cursor MCP into your IDE (reads ~/.config/mushi/config.json \u2014 run `mushi login` first)").option("--ide <ide>", "Target IDE: cursor | claude | continue | zed", "cursor").option("--project-slug <slug>", "Override the project slug in the server name (default: fetched from API or ID prefix)").option("--all-projects", "Write a separate mushi-<name> server entry for every accessible project").option("--with-rules", "Also write the .cursorrules / .claude/rules/mushi.md lesson-library hook").option("--dry-run", "Print what would be written without making changes").option("--verify", "Probe the MCP key after writing to confirm it has mcp:read scope (default: on)").option("--no-verify", "Skip the post-write key probe").option("--endpoint <url>", "Override the Mushi API endpoint (self-hosted) \u2014 used for first-run login if not yet configured").option("--stdio", "Write a local stdio entry with an API key instead of the hosted OAuth URL (cursor/claude default is hosted OAuth \u2014 no key on disk)").option("--ci", "Alias for --stdio: headless environments cannot drive the browser OAuth flow").addHelpText("after", `
+  program2.command("setup").description("Wire Cursor MCP into your IDE (reads ~/.config/mushi/config.json \u2014 run `mushi login` first)").option("--ide <ide>", "Target IDE: cursor | claude | continue | zed", "cursor").option("--project-slug <slug>", "Override the project slug in the server name (default: fetched from API or ID prefix)").option("--all-projects", "Write a separate mushi-<name> server entry for every accessible project").option("--with-rules", "Also write the .cursorrules / .claude/rules/mushi.md lesson-library hook").option("--dry-run", "Print what would be written without making changes").option("--verify", "Probe the MCP key after writing to confirm it has mcp:read scope (default: on)").option("--no-verify", "Skip the post-write key probe").option("--endpoint <url>", "Override the Mushi API endpoint (self-hosted) \u2014 used for first-run login if not yet configured").option("--stdio", "Write a local stdio entry with an API key instead of the hosted OAuth URL (cursor/claude default is hosted OAuth \u2014 no key on disk)").option("--ci", "Alias for --stdio: headless environments cannot drive the browser OAuth flow").option("--inline-key", "Write the literal API key into the mcp.json env block (default: write ${MUSHI_API_KEY} placeholder to prevent accidental git leaks)").addHelpText("after", `
 Examples:
   mushi setup                         # wire Cursor (default: hosted OAuth \u2014 sign in from the IDE, no key on disk)
   mushi setup --stdio                 # local stdio entry with an API key (previous behavior)
@@ -3387,7 +3550,7 @@ key for you \u2014 nothing sensitive is written to the repo. Pass --stdio/--ci t
 get the local subprocess entry with an API key instead.
 
 The command reads credentials from ~/.config/mushi/config.json. If you are not logged in yet, it runs browser sign-in first, then writes MCP config.`).action(async (opts) => {
-    const { writeFile: writeFile2, mkdir, readFile: readFile3 } = await import("fs/promises");
+    const { writeFile: writeFile3, mkdir, readFile: readFile3 } = await import("fs/promises");
     const { existsSync: existsSync3 } = await import("fs");
     const nodePath2 = await import("path");
     const os = await import("os");
@@ -3473,15 +3636,13 @@ The command reads credentials from ~/.config/mushi/config.json. If you are not l
     }
     const hostedMcpUrl = (config.endpoint ?? "").replace(/\/api\/?$/, "/mcp");
     const hostedServerBlock = { url: hostedMcpUrl };
-    const mcpServerBlock = {
-      command: "npx",
-      args: ["-y", MUSHI_MCP_PIN_SPEC],
-      env: {
-        MUSHI_API_ENDPOINT: config.endpoint,
-        MUSHI_PROJECT_ID: config.projectId ?? "",
-        MUSHI_API_KEY: config.apiKey
-      }
-    };
+    const inlineKey = !!opts.inlineKey;
+    const mcpServerBlock = buildMcpServerBlock({
+      endpoint: config.endpoint,
+      projectId: config.projectId ?? "",
+      apiKey: config.apiKey,
+      inlineKey
+    });
     const configDir = nodePath2.isAbsolute(ideEntry.dir) ? ideEntry.dir : nodePath2.join(cwd, ideEntry.dir);
     const configPath = nodePath2.join(configDir, ideEntry.file);
     if (ideEntry.format === "mcp-json") {
@@ -3491,7 +3652,8 @@ The command reads credentials from ~/.config/mushi/config.json. If you are not l
           const pBlock = buildMcpServerBlock({
             endpoint: config.endpoint,
             projectId: p3.id,
-            apiKey: config.apiKey
+            apiKey: config.apiKey,
+            inlineKey
           });
           if (!opts.dryRun) {
             await writeMcpServerEntry({ configPath, serverName: pServerName, serverBlock: pBlock });
@@ -3515,6 +3677,8 @@ The command reads credentials from ~/.config/mushi/config.json. If you are not l
             console.log("  Hosted MCP with OAuth login \u2014 no API key was written to this file.");
             console.log(`  Restart ${opts.ide === "cursor" ? "Cursor" : "Claude Code"}, open the MCP panel (/mcp in Claude Code), pick "${serverName}" and sign in via the browser.`);
             console.log("  Prefer a local key-based entry (headless/CI)? Re-run with --stdio.");
+          } else if (!inlineKey && config.apiKey) {
+            printKeyExportHint(config.apiKey);
           }
         }
       }
@@ -3535,7 +3699,7 @@ The command reads credentials from ~/.config/mushi/config.json. If you are not l
           env: {
             MUSHI_API_ENDPOINT: config.endpoint,
             MUSHI_PROJECT_ID: config.projectId ?? "",
-            MUSHI_API_KEY: config.apiKey
+            MUSHI_API_KEY: inlineKey ? config.apiKey : "${MUSHI_API_KEY}"
           }
         },
         settings: {}
@@ -3547,7 +3711,7 @@ The command reads credentials from ~/.config/mushi/config.json. If you are not l
         console.log(redactKeyForDisplay(output));
       } else {
         await mkdir(configDir, { recursive: true });
-        await writeFile2(configPath, output, "utf8");
+        await writeFile3(configPath, output, "utf8");
         console.log(`\u2713 Written ${configPath}`);
       }
     }
@@ -3581,7 +3745,7 @@ The command reads credentials from ~/.config/mushi/config.json. If you are not l
         if (opts.dryRun) {
           console.log(`[dry-run] Would write ${rulesPath}`);
         } else {
-          await writeFile2(rulesPath, rulesContent, "utf8");
+          await writeFile3(rulesPath, rulesContent, "utf8");
           console.log(`\u2713 Written .cursorrules`);
         }
       } else if (opts.ide === "claude") {
@@ -3591,7 +3755,7 @@ The command reads credentials from ~/.config/mushi/config.json. If you are not l
           console.log(`[dry-run] Would write ${rulesPath}`);
         } else {
           await mkdir(rulesDir, { recursive: true });
-          await writeFile2(rulesPath, rulesContent, "utf8");
+          await writeFile3(rulesPath, rulesContent, "utf8");
           console.log(`\u2713 Written .claude/rules/mushi.md`);
         }
       }
@@ -3654,7 +3818,8 @@ The command reads credentials from ~/.config/mushi/config.json. If you are not l
                       serverBlock: buildMcpServerBlock({
                         endpoint: fresh.endpoint ?? config.endpoint,
                         projectId: fresh.projectId ?? config.projectId ?? "",
-                        apiKey: fresh.apiKey
+                        apiKey: fresh.apiKey,
+                        inlineKey
                       })
                     });
                     console.log(`\u2713 Rewrote ${configPath} with the upgraded key`);
@@ -3707,12 +3872,12 @@ Note: ${configRelPath} holds no secrets (OAuth login) \u2014 safe to commit and
         const gitignorePath = nodePath2.join(cwd, ".gitignore");
         const ignoreLine = configRelPath.replaceAll("\\", "/");
         try {
-          const { readFile: readFile4, writeFile: writeFile3 } = await import("fs/promises");
+          const { readFile: readFile4, writeFile: writeFile4 } = await import("fs/promises");
           const existing = await readFile4(gitignorePath, "utf8").catch(() => "");
           const lines = existing.split(/\r?\n/);
           if (!lines.some((l) => l.trim() === ignoreLine)) {
             const sep = existing.endsWith("\n") || existing === "" ? "" : "\n";
-            await writeFile3(
+            await writeFile4(
               gitignorePath,
               `${existing}${sep}# Mushi MCP config holds a plaintext API key
 ${ignoreLine}
@@ -4209,13 +4374,134 @@ async function runUpgrade(opts = {}) {
   };
 }
 
+// src/self-upgrade.ts
+import { execSync as execSync2 } from "child_process";
+var CLI_PACKAGE = "@mushi-mushi/cli";
+var SAFE_NPM_VERSION2 = /^\d+\.\d+\.\d+(-[\w.]+)?$/;
+function detectInstallMethod(argv1 = process.argv[1] ?? "", userAgent = process.env["npm_config_user_agent"] ?? "") {
+  const path = argv1.replace(/\\/g, "/").toLowerCase();
+  if (path.includes("/_npx/") || path.includes("/.npm/_npx/")) return "npx";
+  if (path.includes("/dlx-") || path.includes("/pnpm/dlx")) return "npx";
+  if (userAgent.startsWith("bun")) return "bun";
+  if (userAgent.startsWith("pnpm")) return "pnpm";
+  if (userAgent.startsWith("yarn")) return "yarn";
+  if (userAgent.startsWith("npm")) return "npm";
+  if (path.includes("/.bun/")) return "bun";
+  if (path.includes("/pnpm/")) return "pnpm";
+  if (path.includes("/yarn/") || path.includes("/.yarn/")) return "yarn";
+  if (path.includes("/npm/") || path.includes("node_modules")) return "npm";
+  return "unknown";
+}
+function selfUpgradeCommand(method, version) {
+  if (!SAFE_NPM_VERSION2.test(version)) return null;
+  const spec = `${CLI_PACKAGE}@${version}`;
+  switch (method) {
+    case "npm":
+      return `npm install -g ${spec}`;
+    case "pnpm":
+      return `pnpm add -g ${spec}`;
+    case "yarn":
+      return `yarn global add ${spec}`;
+    case "bun":
+      return `bun add -g ${spec}`;
+    case "npx":
+    case "unknown":
+    default:
+      return null;
+  }
+}
+async function runSelfUpgrade(opts = {}) {
+  const current = MUSHI_CLI_VERSION;
+  const method = detectInstallMethod();
+  const freshness = await checkFreshness(CLI_PACKAGE, current, {
+    timeoutMs: 4e3,
+    ignoreOptOut: true
+    // an explicit `upgrade --self` must always hit the registry
+  });
+  const latest = freshness?.latest ?? null;
+  const safeLatest = latest && SAFE_NPM_VERSION2.test(latest) ? latest : null;
+  if (!freshness) {
+    return {
+      current,
+      latest: null,
+      method,
+      command: null,
+      upgraded: false,
+      message: "Could not reach the npm registry to check for a newer CLI \u2014 try again in a moment."
+    };
+  }
+  if (!freshness.isOutdated || !safeLatest) {
+    return {
+      current,
+      latest,
+      method,
+      command: null,
+      upgraded: false,
+      message: `mushi CLI is already at the latest stable version (v${current}).`
+    };
+  }
+  const command = selfUpgradeCommand(method, safeLatest);
+  if (!command) {
+    const via = method === "npx" ? "You are running via npx \u2014 the next `npx mushi` will fetch the latest automatically." : `Could not detect how the CLI was installed. Upgrade manually:
+  npm install -g ${CLI_PACKAGE}@${safeLatest}`;
+    return { current, latest, method, command: null, upgraded: false, message: `A newer CLI is available (v${current} \u2192 v${safeLatest}).
+${via}` };
+  }
+  if (opts.dryRun) {
+    return {
+      current,
+      latest,
+      method,
+      command,
+      upgraded: false,
+      message: `[dry-run] Would run: ${command}`
+    };
+  }
+  try {
+    const exec = opts.exec ?? ((cmd) => execSync2(cmd, { stdio: "inherit", env: process.env }));
+    exec(command);
+  } catch {
+    return {
+      current,
+      latest,
+      method,
+      command,
+      upgraded: false,
+      message: `Self-upgrade command failed \u2014 run it manually:
+  ${command}`
+    };
+  }
+  return {
+    current,
+    latest,
+    method,
+    command,
+    upgraded: true,
+    message: `Upgraded mushi CLI: v${current} \u2192 v${safeLatest}.`
+  };
+}
+
 // src/commands/upgrade-cli.ts
 function registerUpgradeCommand(program2) {
-  program2.command("upgrade").description("Bump installed @mushi-mushi/* packages to the latest stable npm release").option("--cwd <path>", "Target repo (default: cwd)").option("--dry-run", "Print the install command without running it").option("--json", "Machine-readable plan + result").addHelpText("after", `
+  program2.command("upgrade").description("Bump installed @mushi-mushi/* packages to the latest stable npm release").option("--cwd <path>", "Target repo (default: cwd)").option("--self", "Upgrade the globally-installed `mushi` CLI itself (not the project SDK deps)").option("--dry-run", "Print the install command without running it").option("--json", "Machine-readable plan + result").addHelpText("after", `
 Examples:
   mushi upgrade
   mushi upgrade --dry-run
+  mushi upgrade --self          # upgrade the CLI binary itself
+  mushi upgrade --self --dry-run
   mushi upgrade --cwd ../glot.it`).action(async (opts) => {
+    if (opts.self) {
+      const selfResult = await runSelfUpgrade({ dryRun: opts.dryRun });
+      if (opts.json) {
+        console.log(JSON.stringify(selfResult, null, 2));
+      } else {
+        console.log(selfResult.message);
+      }
+      if (!selfResult.upgraded && selfResult.command && !opts.dryRun) {
+        process.exit(1);
+      }
+      return;
+    }
     const result = await runUpgrade({ cwd: opts.cwd, dryRun: opts.dryRun, json: opts.json });
     if (opts.json) {
       console.log(JSON.stringify(result, null, 2));
@@ -4552,50 +4838,197 @@ Approve: mushi tdd approve <id>`);
 // src/commands/keys.ts
 function registerKeysCommands(program2) {
   const keys = program2.command("keys").description("Manage API key pool (BYOK)");
-  keys.command("list").description("List all API keys in the pool with their status").action(async () => {
+  keys.command("list").description("List all API keys in the pool with their status").option("--json", "Output as JSON (alias for -o json)").action(async (opts) => {
     const config = loadConfig();
     if (!config.apiKey || !config.projectId) {
       console.error("Run `mushi login` first");
       process.exit(1);
     }
-    const res = await apiCall(
-      `/v1/admin/byok/keys?project_id=${encodeURIComponent(config.projectId)}`,
-      config
-    );
+    const res = await apiCall(`/v1/admin/byok/keys?project_id=${encodeURIComponent(config.projectId)}`, config);
     if (!res.ok) {
       console.error(`Error: ${res.error.message}`);
       process.exit(1);
     }
-    if (res.data.keys.length === 0) {
-      console.log("No keys configured.");
-      return;
+    printResult(res.data, {
+      json: opts.json,
+      render(d) {
+        const legacyKeys = d.legacyKeys ?? [];
+        if (d.keys.length === 0 && legacyKeys.length === 0) {
+          console.log("No keys configured.");
+          return;
+        }
+        for (const k of d.keys) {
+          const cooldown = k.cooldown_until && new Date(k.cooldown_until) > /* @__PURE__ */ new Date() ? ` [cooldown until ${new Date(k.cooldown_until).toLocaleTimeString()}]` : "";
+          const validation = k.test_status ? ` test=${k.test_status}` : " test=required";
+          const lastTested = k.last_tested_at ? ` tested=${new Date(k.last_tested_at).toISOString()}` : "";
+          const lastUsed = k.last_used_at ? ` used=${new Date(k.last_used_at).toISOString()}` : "";
+          const baseUrl = k.base_url ? ` base=${k.base_url}` : "";
+          const hint = k.key_hint ? ` hint=${k.key_hint}` : "";
+          console.log(
+            `${k.provider_slug.padEnd(14)} [${k.status}]${validation} p=${k.priority} ${k.label ?? "(no label)"}${hint}${baseUrl}${cooldown}${lastTested}${lastUsed} created=${new Date(k.created_at).toISOString()} \u2014 ${k.id}`
+          );
+        }
+        for (const k of legacyKeys) {
+          const validation = k.test_status ? ` test=${k.test_status}` : " test=required";
+          const lastTested = k.last_tested_at ? ` tested=${new Date(k.last_tested_at).toISOString()}` : "";
+          const lastUsed = k.last_used_at ? ` used=${new Date(k.last_used_at).toISOString()}` : "";
+          const created = k.created_at ? ` created=${new Date(k.created_at).toISOString()}` : "";
+          const hint = k.key_hint ? ` hint=${k.key_hint}` : "";
+          console.log(
+            `${k.provider_slug.padEnd(14)} [${k.status}]${validation} legacy${hint}${lastTested}${lastUsed}${created} \u2014 manage in the console`
+          );
+        }
+      }
+    });
+  });
+  keys.command("rotate").description("Rotate the project API key stored in local config (mints a fresh key)").option("--json", "Output as JSON (alias for -o json)").action(async (opts) => {
+    const config = loadConfig();
+    if (!config.projectId) {
+      console.error("Run `mushi login` first");
+      process.exit(1);
     }
-    for (const k of res.data.keys) {
-      const cooldown = k.cooldown_until && new Date(k.cooldown_until) > /* @__PURE__ */ new Date() ? ` [cooldown until ${new Date(k.cooldown_until).toLocaleTimeString()}]` : "";
-      console.log(`${k.provider_slug.padEnd(14)} [${k.status}] p=${k.priority} ${k.label ?? "(no label)"}${cooldown} \u2014 ${k.id}`);
+    if (!config.endpoint) {
+      console.error("No endpoint configured \u2014 run `mushi login` first");
+      process.exit(1);
     }
+    console.log("Authenticating to rotate key\u2026");
+    const session = await startDeviceAuth(config.endpoint).catch((err) => {
+      console.error(`Error starting auth: ${err.message}`);
+      process.exit(1);
+    });
+    console.log(`
+  Open this URL to confirm rotation:
+  ${session.verification_uri}`);
+    console.log(`  Enter code: ${session.user_code}
+`);
+    const cliToken = await waitForCliToken(config.endpoint, session).catch((err) => {
+      console.error(`Auth failed: ${err.message}`);
+      process.exit(1);
+    });
+    const existingScopes = Array.isArray(config.scopes) ? config.scopes : ["report:write", "mcp:read"];
+    const newKey = await mintProjectKey(config.endpoint, cliToken, config.projectId, {
+      label: "rotated",
+      scopes: existingScopes
+    }).catch((err) => {
+      console.error(`Could not mint new key: ${err.message}`);
+      process.exit(1);
+    });
+    const oldKey = config.apiKey;
+    const oldPrefix = oldKey?.slice(0, 12) ?? "(none)";
+    config.apiKey = newKey;
+    saveConfig(config);
+    let serverRevoked = false;
+    if (oldKey && config.projectId) {
+      const revokeResult = await revokeProjectKey(
+        config.endpoint,
+        cliToken,
+        config.projectId,
+        oldPrefix
+      ).catch(() => null);
+      serverRevoked = revokeResult?.revoked === 1;
+    }
+    printResult(
+      { newPrefix: newKey.slice(0, 12), oldPrefix, serverRevoked },
+      {
+        json: opts.json,
+        render(d) {
+          console.log(`\u2713 Key rotated.`);
+          console.log(`  Old prefix: ${d.oldPrefix}\u2026  \u2192  New prefix: ${d.newPrefix}\u2026`);
+          console.log(`  New key saved to local config.`);
+          if (d.serverRevoked) {
+            console.log(`  \u2713 Old key revoked on the server.`);
+          } else {
+            console.log(
+              `  \u2139  Old key may still be active \u2014 revoke it at: ${config.consoleUrl ?? "your Mushi console"} \u2192 Settings \u2192 API Keys`
+            );
+          }
+        }
+      }
+    );
   });
-  keys.command("add").description("Add a new API key to the pool").requiredOption("--provider <p>", "Provider: anthropic, openai, firecrawl, browserbase, cursor").option("--key <k>", "The API key value (prefer the MUSHI_BYOK_KEY env var to keep it out of shell history)").option("--label <l>", "Human-readable label").option("--priority <n>", "Priority (lower = higher priority)", "100").action(async (opts) => {
+  keys.command("add").description("Add a new API key to the pool").requiredOption("--provider <p>", "Provider: anthropic, openai, firecrawl, browserbase, cursor").option(
+    "--key <k>",
+    "The API key value (prefer the MUSHI_BYOK_KEY env var to keep it out of shell history)"
+  ).option("--label <l>", "Human-readable label").option("--priority <n>", "Priority (lower = higher priority)", "100").option("--base-url <url>", "Allow-listed OpenAI-compatible HTTPS base URL").action(
+    async (opts) => {
+      const config = loadConfig();
+      if (!config.apiKey || !config.projectId) {
+        console.error("Run `mushi login` first");
+        process.exit(1);
+      }
+      const key = process.env.MUSHI_BYOK_KEY ?? opts.key;
+      if (!key) {
+        console.error(
+          "Provide the key via the MUSHI_BYOK_KEY env var (recommended) or --key <value>."
+        );
+        process.exit(1);
+      }
+      const priority = Number(opts.priority);
+      if (!Number.isInteger(priority) || priority < 0 || priority > 1e4) {
+        console.error("Priority must be an integer between 0 and 10000.");
+        process.exit(1);
+      }
+      const res = await apiCall("/v1/admin/byok/keys", config, {
+        method: "POST",
+        body: JSON.stringify({
+          project_id: config.projectId,
+          provider_slug: opts.provider,
+          key,
+          label: opts.label,
+          priority,
+          base_url: opts.baseUrl
+        })
+      });
+      if (!res.ok) {
+        console.error(`Error: ${res.error.message}`);
+        process.exit(1);
+      }
+      if (res.data.validation.status === "ok") {
+        console.log(`\u2713 Key validated and active \u2014 id: ${res.data.id}`);
+        return;
+      }
+      console.log(
+        `! Key saved but quarantined (${res.data.validation.status}) \u2014 id: ${res.data.id}`
+      );
+      console.log(`  ${res.data.validation.detail}`);
+    }
+  );
+  keys.command("test <key-id>").description("Re-test one pooled key and activate it only if validation passes").action(async (keyId) => {
     const config = loadConfig();
     if (!config.apiKey || !config.projectId) {
       console.error("Run `mushi login` first");
       process.exit(1);
     }
-    const key = process.env.MUSHI_BYOK_KEY ?? opts.key;
-    if (!key) {
-      console.error("Provide the key via the MUSHI_BYOK_KEY env var (recommended) or --key <value>.");
+    const res = await apiCall(`/v1/admin/byok/keys/${encodeURIComponent(keyId)}/test`, config, { method: "POST" });
+    if (!res.ok) {
+      console.error(`Error: ${res.error.message}`);
+      process.exit(1);
+    }
+    if (res.data.validation.status === "ok") {
+      console.log(`\u2713 Key validated and active \u2014 id: ${res.data.key.id}`);
+      return;
+    }
+    console.log(
+      `! Key remains quarantined (${res.data.validation.status}) \u2014 id: ${res.data.key.id}`
+    );
+    console.log(`  ${res.data.validation.detail}`);
+  });
+  keys.command("remove <key-id>").description("Permanently remove one pooled key and its Vault secret").action(async (keyId) => {
+    const config = loadConfig();
+    if (!config.apiKey || !config.projectId) {
+      console.error("Run `mushi login` first");
       process.exit(1);
     }
     const res = await apiCall(
-      "/v1/admin/byok/keys",
+      `/v1/admin/byok/keys/${encodeURIComponent(keyId)}`,
       config,
-      { method: "POST", body: JSON.stringify({ project_id: config.projectId, provider_slug: opts.provider, key, label: opts.label, priority: parseInt(opts.priority, 10) }) }
+      { method: "DELETE" }
     );
     if (!res.ok) {
       console.error(`Error: ${res.error.message}`);
       process.exit(1);
     }
-    console.log(`\u2713 Key added \u2014 id: ${res.data.id}`);
+    console.log(`\u2713 Key removed \u2014 id: ${res.data.keyId}`);
   });
 }
 
@@ -5492,7 +5925,7 @@ Examples:
 }
 
 // src/commands/selfhost.ts
-import { execSync as execSync2, spawnSync } from "child_process";
+import { execSync as execSync3, spawnSync } from "child_process";
 import { randomBytes } from "crypto";
 function hasSupabaseCli() {
   try {
@@ -5510,7 +5943,7 @@ function run(cmd, opts) {
   const label = opts.label ?? cmd.slice(0, 60);
   process.stdout.write(`  \u203A ${label} \u2026 `);
   try {
-    const out = execSync2(cmd, {
+    const out = execSync3(cmd, {
       cwd: opts.cwd,
       encoding: "utf8",
       timeout: 3e5,
@@ -5823,14 +6256,54 @@ Examples:
   });
 }
 
+// src/commands/profile.ts
+function registerProfileCommands(program2) {
+  const profile = program2.command("profile").description("Manage credential profiles (default, staging, per-client)");
+  profile.command("list").alias("ls").description("List all profiles; the active one is marked with *").option("--json", "Machine-readable JSON output").action((opts) => {
+    const { active, profiles } = listProfiles();
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify({ active, profiles }, null, 2));
+      return;
+    }
+    for (const name of profiles.sort()) {
+      const marker = name === active ? "*" : " ";
+      const cfg = loadConfig(void 0, { profile: name });
+      const state = cfg.apiKey ? "configured" : "empty";
+      console.log(`${marker} ${name.padEnd(20)} [${state}]`);
+    }
+  });
+  profile.command("current").description("Print the active profile name").action(() => {
+    console.log(listProfiles().active);
+  });
+  profile.command("use <name>").description("Switch the active profile (creates an empty one if it does not exist)").action((name) => {
+    const safe = name.trim();
+    if (!/^[A-Za-z0-9._-]{1,64}$/.test(safe)) {
+      process.stderr.write("error: profile name must be 1\u201364 chars of [A-Za-z0-9._-]\n");
+      process.exit(2);
+    }
+    const before = listProfiles();
+    setActiveProfile(safe);
+    const isNew = !before.profiles.includes(safe);
+    console.log(`\u2713 Active profile: ${safe}${isNew ? " (new \u2014 run `mushi login` to add credentials)" : ""}`);
+  });
+}
+
 // src/index.ts
 installSignalHandlers();
-var program = new Command().name("mushi").description("Mushi CLI \u2014 set up the SDK, triage a report, fix from your editor").version(MUSHI_CLI_VERSION).addHelpText("after", `
+var program = new Command().name("mushi").description("Mushi CLI \u2014 set up the SDK, triage a report, fix from your editor").version(MUSHI_CLI_VERSION).option("--profile <name>", "Use a named credential profile for this invocation (or set MUSHI_PROFILE)").option("-o, --output <format>", "Output format: text | json", "text").hook("preAction", (_thisCommand, actionCommand) => {
+  const opts = actionCommand.optsWithGlobals();
+  const profile = opts["profile"];
+  if (profile && profile.trim()) {
+    process.env["MUSHI_PROFILE"] = profile.trim();
+  }
+  setGlobalOutputFormat(opts["output"]);
+}).addHelpText("after", `
 Environment variables:
   MUSHI_API_KEY        SDK ingest key (report:write scope \u2014 from Onboarding \u2192 Verify in the console)
   MUSHI_PROJECT_ID     Project UUID   (from the Projects page in the console)
   MUSHI_API_ENDPOINT   Supabase edge function URL
                        e.g. https://<ref>.supabase.co/functions/v1/api
+  MUSHI_PROFILE        Credential profile to use (see \`mushi profile\`)
 
 Exit codes:
   0  success
@@ -5862,6 +6335,7 @@ registerAuditCommands(program);
 registerSkillsCommands(program);
 registerBillingCommands(program);
 registerSelfhostCommands(program);
+registerProfileCommands(program);
 registerCompletionCommand(program);
 program.parseAsync().catch((err) => {
   printAndExit(err);