@mushi-mushi/cli 0.29.2 → 0.30.0

package/dist/index.js

@@ -53,11 +53,11 @@ import {
   setGlobalOutputFormat,
   trySaveKeyToKeychain,
   writeMcpServerEntry
-} from "./chunk-KZW4X6WB.js";
+} from "./chunk-LCCMRMPN.js";
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-MKUU3GHS.js";
+} from "./chunk-27FTLLR2.js";
 import {
   FRAMEWORKS,
   detectFramework,
@@ -273,11 +273,11 @@ async function createProject(endpoint, cliToken, name, opts = {}) {
   const { id, name: created, slug, apiKey } = json2.data;
   return { id, name: created, slug, apiKey: apiKey ?? null };
 }
-async function mintProjectKey(endpoint, cliToken, projectId, opts = {}) {
+async function mintProjectKey(endpoint, cliToken, projectId2, opts = {}) {
   const base = trimTrailingSlash(endpoint);
   let res;
   try {
-    res = await deviceFetch(`${base}/v1/cli/projects/${projectId}/keys`, {
+    res = await deviceFetch(`${base}/v1/cli/projects/${projectId2}/keys`, {
       method: "POST",
       headers: cliAuthHeaders(cliToken),
       body: JSON.stringify({
@@ -299,9 +299,9 @@ async function mintProjectKey(endpoint, cliToken, projectId, opts = {}) {
     res.status
   );
 }
-async function revokeProjectKey(endpoint, cliToken, projectId, keyPrefix, newKeyId) {
+async function revokeProjectKey(endpoint, cliToken, projectId2, keyPrefix, newKeyId) {
   const base = trimTrailingSlash(endpoint);
-  const url = `${base}/v1/cli/projects/${encodeURIComponent(projectId)}/keys/${encodeURIComponent(keyPrefix)}/revoke`;
+  const url = `${base}/v1/cli/projects/${encodeURIComponent(projectId2)}/keys/${encodeURIComponent(keyPrefix)}/revoke`;
   let res;
   try {
     res = await deviceFetch(url, {
@@ -469,17 +469,17 @@ async function runLogin(opts = {}) {
   const endpoint = opts.endpoint ? resolveCloudEndpoint2(opts.endpoint) : CLOUD_API_ENDPOINT2;
   const consoleBase = await resolveConsoleUrl();
   let apiKey = opts.apiKey;
-  let projectId = opts.projectId;
+  let projectId2 = opts.projectId;
   if (apiKey) {
     const config2 = loadConfig();
     config2.apiKey = apiKey;
     config2.endpoint = endpoint;
-    if (projectId) config2.projectId = projectId;
+    if (projectId2) config2.projectId = projectId2;
     config2.consoleUrl = consoleBase;
     saveConfig(config2);
     console.log("");
     console.log("  \u2713 Credentials saved.");
-    const verifyResult = await apiCall("/v1/sync/whoami", { apiKey, endpoint, projectId });
+    const verifyResult = await apiCall("/v1/sync/whoami", { apiKey, endpoint, projectId: projectId2 });
     if (!verifyResult.ok) {
       console.warn(`  \u26A0  Key saved, but verification failed: ${verifyResult.error?.message ?? "unknown error"}`);
       console.warn(`     Check your key at: ${cliSetupDeepLink(consoleBase)}`);
@@ -487,7 +487,7 @@ async function runLogin(opts = {}) {
     }
     const d = verifyResult.data;
     if (d.project_name) {
-      if (!projectId && d.project_id) {
+      if (!projectId2 && d.project_id) {
         config2.projectId = d.project_id;
         saveConfig(config2);
       }
@@ -544,7 +544,7 @@ error: Could not start login session: ${err instanceof Error ? err.message : Str
   const cliToken = pollResult.cliToken;
   printAuthApproved();
   const projectsList = await listProjects(endpoint, cliToken);
-  let chosenProjectId = projectId;
+  let chosenProjectId = projectId2;
   let chosenProjectName;
   const mintScopes = opts.upgradeScope ? FULL_CLI_KEY_SCOPES : CLI_KEY_SCOPES;
   if (!chosenProjectId) {
@@ -589,12 +589,24 @@ error: Could not create project: ${err instanceof Error ? err.message : String(e
       }
     }
   }
+  let mintError = null;
   if (!apiKey && chosenProjectId) {
     try {
       apiKey = await mintProjectKey(endpoint, cliToken, chosenProjectId, { scopes: mintScopes }) ?? void 0;
-    } catch {
+    } catch (err) {
+      mintError = err instanceof Error ? err.message : String(err);
     }
   }
+  if (mintError) {
+    process.stderr.write(`
+  \u2717 No key was created for ${chosenProjectName ?? chosenProjectId}: ${mintError}
+`);
+    if (/owner or admin|forbidden|403/i.test(mintError)) {
+      process.stderr.write("    Only the project's owners and admins can create keys. Ask one of them to make you an admin, then run this again.\n");
+    }
+    process.stderr.write("    Your saved login was not changed.\n\n");
+    process.exit(1);
+  }
   const config = loadConfig();
   config.endpoint = endpoint;
   config.consoleUrl = consoleBase;
@@ -895,9 +907,9 @@ async function checkCliAuthPath(config, doFetch = globalThis.fetch) {
 async function checkSdkInstall(cwd) {
   try {
     const { readFile: readFile3 } = await import("fs/promises");
-    const { join: join10, resolve: resolve7 } = await import("path");
+    const { join: join11, resolve: resolve7 } = await import("path");
     const root = resolve7(cwd);
-    const pkgPath = join10(root, "package.json");
+    const pkgPath = join11(root, "package.json");
     const pkg = JSON.parse(await readFile3(pkgPath, "utf8"));
     const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
     const sdks = [
@@ -932,9 +944,9 @@ async function checkServerPreflight(config, doFetch = globalThis.fetch) {
     ];
   }
   try {
-    const { endpoint, apiKey, projectId } = sanitizeCliCredentials(config);
-    const res = await doFetch(`${endpoint}/v1/admin/projects/${projectId}/preflight`, {
-      headers: apiKeyHeaders(apiKey, projectId),
+    const { endpoint, apiKey, projectId: projectId2 } = sanitizeCliCredentials(config);
+    const res = await doFetch(`${endpoint}/v1/admin/projects/${projectId2}/preflight`, {
+      headers: apiKeyHeaders(apiKey, projectId2),
       signal: AbortSignal.timeout(8e3)
     });
     if (res.ok) {
@@ -1032,9 +1044,9 @@ async function checkQaStoriesHealth(config, doFetch = globalThis.fetch) {
   }
   const checks = [];
   try {
-    const { endpoint, apiKey, projectId } = sanitizeCliCredentials(config);
-    const headers = apiKeyHeaders(apiKey, projectId);
-    const storiesRes = await doFetch(`${endpoint}/v1/admin/projects/${projectId}/qa-coverage`, {
+    const { endpoint, apiKey, projectId: projectId2 } = sanitizeCliCredentials(config);
+    const headers = apiKeyHeaders(apiKey, projectId2);
+    const storiesRes = await doFetch(`${endpoint}/v1/admin/projects/${projectId2}/qa-coverage`, {
       headers,
       signal: AbortSignal.timeout(8e3)
     });
@@ -1063,7 +1075,7 @@ async function checkQaStoriesHealth(config, doFetch = globalThis.fetch) {
       detail: `${enabled.length} enabled story/stories configured`
     });
     const slackRes = await doFetch(
-      `${endpoint}/v1/admin/projects/${projectId}/integrations/probe/slack`,
+      `${endpoint}/v1/admin/projects/${projectId2}/integrations/probe/slack`,
       {
         method: "POST",
         headers,
@@ -1078,7 +1090,7 @@ async function checkQaStoriesHealth(config, doFetch = globalThis.fetch) {
       detail: slackOk ? "Slack connected \u2014 failures will notify your channel" : "Slack not connected \u2014 you won't be notified when stories fail. Visit /integrations \u2192 Add to Slack."
     });
     const fcRes = await doFetch(
-      `${endpoint}/v1/admin/projects/${projectId}/integrations/probe/firecrawl`,
+      `${endpoint}/v1/admin/projects/${projectId2}/integrations/probe/firecrawl`,
       {
         method: "POST",
         headers,
@@ -1107,9 +1119,9 @@ async function checkHostAppWiring(cwd) {
   const checks = [];
   try {
     const { readFile: readFile3, access } = await import("fs/promises");
-    const { join: join10, resolve: resolve7 } = await import("path");
+    const { join: join11, resolve: resolve7 } = await import("path");
     const root = resolve7(cwd);
-    const pkgPath = join10(root, "package.json");
+    const pkgPath = join11(root, "package.json");
     const pkg = JSON.parse(await readFile3(pkgPath, "utf8"));
     const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
     const isCapHybrid = Boolean(deps["@capacitor/core"] && deps["react"]);
@@ -1117,7 +1129,7 @@ async function checkHostAppWiring(cwd) {
     let envContent = "";
     for (const f of envCandidates) {
       try {
-        envContent = await readFile3(join10(root, f), "utf8");
+        envContent = await readFile3(join11(root, f), "utf8");
         break;
       } catch {
       }
@@ -1132,9 +1144,9 @@ async function checkHostAppWiring(cwd) {
       detail: hasProjectId && hasApiKey ? "VITE_/MUSHI_ project id + API key found" : "Run `mushi connect --write-env` or add VITE_MUSHI_PROJECT_ID + VITE_MUSHI_API_KEY"
     });
     let mcpFound = null;
-    for (const rel of [".mcp.json", join10(".cursor", "mcp.json")]) {
+    for (const rel of [".mcp.json", join11(".cursor", "mcp.json")]) {
       try {
-        await access(join10(root, rel));
+        await access(join11(root, rel));
         mcpFound = rel;
         break;
       } catch {
@@ -1176,7 +1188,7 @@ var HASH_ROUTER_PATTERNS = [
 var HASH_TEMPLATE_PATTERN = /['"`]#\//;
 async function scanDirForPattern(dir, patterns, maxDepth = 6, maxFiles = 2e3) {
   const { readdir: readdir2, readFile: readFile3 } = await import("fs/promises");
-  const { join: join10 } = await import("path");
+  const { join: join11 } = await import("path");
   let count = 0;
   async function walk2(d, depth) {
     if (depth > maxDepth || count > maxFiles) return null;
@@ -1188,7 +1200,7 @@ async function scanDirForPattern(dir, patterns, maxDepth = 6, maxFiles = 2e3) {
     }
     for (const e of entries) {
       if (e.name.startsWith(".") || e.name === "node_modules" || e.name === "dist") continue;
-      const full = join10(d, e.name);
+      const full = join11(d, e.name);
       if (e.isDirectory()) {
         const found = await walk2(full, depth + 1);
         if (found) return found;
@@ -1205,7 +1217,7 @@ async function scanDirForPattern(dir, patterns, maxDepth = 6, maxFiles = 2e3) {
   }
   const { resolve: resolve7 } = await import("path");
   for (const sub of ["src", "app", "pages", "lib", "components"]) {
-    const found = await walk2(join10(resolve7(dir), sub), 0);
+    const found = await walk2(join11(resolve7(dir), sub), 0);
     if (found) return found;
   }
   return walk2(resolve7(dir), 0);
@@ -1241,13 +1253,13 @@ function normalizeProjectPath(path) {
 }
 async function collectMcpSources(root, home) {
   const { readFile: readFile3 } = await import("fs/promises");
-  const { join: join10 } = await import("path");
+  const { join: join11 } = await import("path");
   const sources = [];
   const invalid = [];
   const plainFiles = [
-    { path: join10(root, ".mcp.json"), claudeCode: true },
-    { path: join10(root, ".cursor", "mcp.json"), claudeCode: false },
-    { path: join10(home, ".cursor", "mcp.json"), claudeCode: false }
+    { path: join11(root, ".mcp.json"), claudeCode: true },
+    { path: join11(root, ".cursor", "mcp.json"), claudeCode: false },
+    { path: join11(home, ".cursor", "mcp.json"), claudeCode: false }
   ];
   for (const file of plainFiles) {
     let raw;
@@ -1264,7 +1276,7 @@ async function collectMcpSources(root, home) {
       invalid.push(file.path);
     }
   }
-  const claudeJsonPath = join10(home, ".claude.json");
+  const claudeJsonPath = join11(home, ".claude.json");
   try {
     const parsed = JSON.parse(await readFile3(claudeJsonPath, "utf8"));
     if (isJsonObject(parsed)) {
@@ -1441,12 +1453,12 @@ async function checkOnboardingStatus(config, _consoleBase, cwd, doFetch = global
   }
   try {
     const { readFile: readFile3 } = await import("fs/promises");
-    const { join: join10, resolve: resolve7 } = await import("path");
+    const { join: join11, resolve: resolve7 } = await import("path");
     const root = resolve7(cwd);
     let envContent = "";
     for (const f of [".env.local", ".env"]) {
       try {
-        envContent = await readFile3(join10(root, f), "utf8");
+        envContent = await readFile3(join11(root, f), "utf8");
         break;
       } catch {
       }
@@ -1512,7 +1524,7 @@ async function checkOnboardingStatus(config, _consoleBase, cwd, doFetch = global
 }
 async function checkVersionDrift(cwd, doFetch) {
   const checks = [];
-  const { MUSHI_CLI_VERSION: MUSHI_CLI_VERSION2 } = await import("./version-QRFWGGZY.js");
+  const { MUSHI_CLI_VERSION: MUSHI_CLI_VERSION2 } = await import("./version-A2FOZS5T.js");
   if (MUSHI_CLI_VERSION2 === "0.0.0-dev") return checks;
   const parse2 = (v) => {
     const m = v.replace(/^[~^]/, "").match(/^(\d+)\.(\d+)\.(\d+)/);
@@ -1542,8 +1554,8 @@ async function checkVersionDrift(cwd, doFetch) {
   }
   try {
     const { readFile: readFile3 } = await import("fs/promises");
-    const { join: join10 } = await import("path");
-    const pkg = JSON.parse(await readFile3(join10(cwd, "package.json"), "utf8"));
+    const { join: join11 } = await import("path");
+    const pkg = JSON.parse(await readFile3(join11(cwd, "package.json"), "utf8"));
     const deps = { ...pkg.dependencies, ...pkg.devDependencies };
     const candidates = Object.entries(deps).filter(([name]) => name.startsWith("@mushi-mushi/")).filter(([, v]) => /^[~^]?\d/.test(v));
     const drifted = (await Promise.all(
@@ -1847,10 +1859,10 @@ async function chooseFramework(detected, options) {
 async function acquireCredentials(options, consoleBase, endpoint) {
   const probe = (e, k, pid) => probeKeyScope(e, k, pid);
   if (options.projectId && options.apiKey) {
-    const projectId = sanitizeSecret(options.projectId);
+    const projectId2 = sanitizeSecret(options.projectId);
     const sdkKey = sanitizeSecret(options.apiKey);
-    await assertUserKeyIsIngestOnly(sdkKey, projectId, endpoint, probe);
-    return { projectId, sdkKey };
+    await assertUserKeyIsIngestOnly(sdkKey, projectId2, endpoint, probe);
+    return { projectId: projectId2, sdkKey };
   }
   const existing = loadConfig();
   maybeShowTelemetryNotice(existing);
@@ -1927,8 +1939,8 @@ async function acquireCredentials(options, consoleBase, endpoint) {
   }
   return collectCredentialsManually(options, consoleBase, endpoint, probe);
 }
-async function assertUserKeyIsIngestOnly(key, projectId, endpoint, probe) {
-  const result = await probe(endpoint, key, projectId);
+async function assertUserKeyIsIngestOnly(key, projectId2, endpoint, probe) {
+  const result = await probe(endpoint, key, projectId2);
   if (result.result === "mcp" || result.result === "unknown") {
     throw new Error(
       `Not writing this API key into your app's env vars: ${describeUnsafeSdkKey(result, endpoint)}. Use an ingest-only (report:write) key from the console, or leave out --api-key to sign in with the browser, which mints one.`
@@ -1936,40 +1948,40 @@ async function assertUserKeyIsIngestOnly(key, projectId, endpoint, probe) {
   }
 }
 async function resolveSavedCredentials(saved, endpoint, probe) {
-  const projectId = sanitizeSecret(saved.projectId);
+  const projectId2 = sanitizeSecret(saved.projectId);
   const apiKey = sanitizeSecret(saved.apiKey);
-  const savedSdkKey = savedSdkKeyFor(saved, projectId);
+  const savedSdkKey = savedSdkKeyFor(saved, projectId2);
   if (savedSdkKey) {
-    const sdkProbe = await probe(endpoint, savedSdkKey, projectId);
+    const sdkProbe = await probe(endpoint, savedSdkKey, projectId2);
     if (sdkProbe.result === "ingest-only") {
-      return { kind: "ready", credentials: { projectId, sdkKey: savedSdkKey, cliKey: apiKey } };
+      return { kind: "ready", credentials: { projectId: projectId2, sdkKey: savedSdkKey, cliKey: apiKey } };
     }
   }
-  const cliProbe = await probe(endpoint, apiKey, projectId);
+  const cliProbe = await probe(endpoint, apiKey, projectId2);
   if (cliProbe.result === "ingest-only") {
-    return { kind: "ready", credentials: { projectId, sdkKey: apiKey } };
+    return { kind: "ready", credentials: { projectId: projectId2, sdkKey: apiKey } };
   }
   if (cliProbe.result === "mcp") {
-    return { kind: "needs-sdk-key", projectId, cliKey: apiKey };
+    return { kind: "needs-sdk-key", projectId: projectId2, cliKey: apiKey };
   }
   return { kind: "unusable", reason: describeUnsafeSdkKey(cliProbe, endpoint) };
 }
 async function mintWizardKeys(deps, args) {
-  let projectId;
+  let projectId2;
   let createdName;
   let sdkKey = null;
   if (args.target.kind === "new") {
     const created = await deps.createProject(args.endpoint, args.cliToken, args.target.name, {
       scopes: SDK_KEY_SCOPES
     });
-    projectId = created.id;
+    projectId2 = created.id;
     createdName = created.name;
     sdkKey = created.apiKey;
   } else {
-    projectId = args.target.projectId;
+    projectId2 = args.target.projectId;
   }
   if (!sdkKey) {
-    sdkKey = await deps.mintProjectKey(args.endpoint, args.cliToken, projectId, {
+    sdkKey = await deps.mintProjectKey(args.endpoint, args.cliToken, projectId2, {
       scopes: SDK_KEY_SCOPES,
       label: SDK_KEY_LABEL
     });
@@ -1978,7 +1990,7 @@ async function mintWizardKeys(deps, args) {
   let cliKeyError;
   if (args.withCliKey) {
     try {
-      cliKey = await deps.mintProjectKey(args.endpoint, args.cliToken, projectId, {
+      cliKey = await deps.mintProjectKey(args.endpoint, args.cliToken, projectId2, {
         scopes: CLI_KEY_SCOPES,
         label: CLI_KEY_LABEL
       });
@@ -1986,7 +1998,7 @@ async function mintWizardKeys(deps, args) {
       cliKeyError = err instanceof Error ? err.message : String(err);
     }
   }
-  return { projectId, createdName, sdkKey, cliKey, cliKeyError };
+  return { projectId: projectId2, createdName, sdkKey, cliKey, cliKeyError };
 }
 async function runBrowserSignIn(options, endpoint, consoleBase, preset) {
   const startSpin = p.spinner();
@@ -2155,11 +2167,11 @@ async function collectCredentialsManually(options, consoleBase, endpoint, probe)
     hint: apiKeyHint(consoleBase),
     validate: (v) => API_KEY_PATTERN.test(v) ? void 0 : "Expected format: mushi_ followed by 10+ alphanumeric characters"
   });
-  const projectId = sanitizeSecret(rawProjectId);
+  const projectId2 = sanitizeSecret(rawProjectId);
   const apiKey = sanitizeSecret(rawApiKey);
-  if (!PROJECT_ID_PATTERN.test(projectId)) {
+  if (!PROJECT_ID_PATTERN.test(projectId2)) {
     throw new Error(
-      `Invalid project ID. Expected a UUID (e.g. bdafa28d-b153-482f-bd4f-42981f3fd3a4) or the proj_* prefixed form. Got: ${redact(projectId)} \u2014 copy it from ${projectIdHint(consoleBase)}`
+      `Invalid project ID. Expected a UUID (e.g. bdafa28d-b153-482f-bd4f-42981f3fd3a4) or the proj_* prefixed form. Got: ${redact(projectId2)} \u2014 copy it from ${projectIdHint(consoleBase)}`
     );
   }
   if (!API_KEY_PATTERN.test(apiKey)) {
@@ -2168,9 +2180,9 @@ async function collectCredentialsManually(options, consoleBase, endpoint, probe)
     );
   }
   if (apiKey !== savedApiKey) {
-    await assertUserKeyIsIngestOnly(apiKey, projectId, endpoint, probe);
+    await assertUserKeyIsIngestOnly(apiKey, projectId2, endpoint, probe);
   }
-  return { projectId, sdkKey: apiKey };
+  return { projectId: projectId2, sdkKey: apiKey };
 }
 async function verifyCredentials(credentials, options, consoleBase) {
   const endpoint = resolveCloudEndpoint(options.endpoint);
@@ -2267,10 +2279,10 @@ function runCommand(pm, packages, cwd) {
     });
   });
 }
-async function writeEnvFile(cwd, apiKey, projectId, framework, endpoint, overwrite) {
+async function writeEnvFile(cwd, apiKey, projectId2, framework, endpoint, overwrite) {
   const target = ENV_FILES.find((f) => existsSync2(join2(cwd, f))) ?? ENV_FILES[0];
   const targetPath = join2(cwd, target);
-  const newVars = envVarsToWrite(apiKey, projectId, framework, endpoint);
+  const newVars = envVarsToWrite(apiKey, projectId2, framework, endpoint);
   let existing = "";
   try {
     existing = readFileSync2(targetPath, "utf-8");
@@ -2436,7 +2448,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect: runConnect2 } = await import("./connect-NCBKOV6O.js");
+    const { runConnect: runConnect2 } = await import("./connect-KWNFOEUX.js");
     const saved = loadConfig();
     const result = await runConnect2(
       {
@@ -3736,7 +3748,7 @@ error: Could not start browser sign-in: ${err instanceof Error ? err.message : S
     const rl = createInterface({ input: process.stdin, output: process.stdout });
     const ask = (q) => new Promise((resolve7) => rl.question(q, (a) => resolve7(a.trim())));
     let chosen;
-    let projectId;
+    let projectId2;
     let projectName;
     let apiKey;
     if (!opts.name && projectsList.length > 0) {
@@ -3751,11 +3763,11 @@ error: Could not start browser sign-in: ${err instanceof Error ? err.message : S
       const num2 = parseInt(choice, 10);
       if (num2 >= 1 && num2 <= projectsList.length) {
         chosen = projectsList[num2 - 1];
-        projectId = chosen.id;
+        projectId2 = chosen.id;
         projectName = chosen.name;
       }
     }
-    if (!projectId) {
+    if (!projectId2) {
       const newName = opts.name?.trim() || await ask("  Project name: ");
       if (!newName) {
         rl.close();
@@ -3764,7 +3776,7 @@ error: Could not start browser sign-in: ${err instanceof Error ? err.message : S
       }
       try {
         const created = await createProject(endpoint, cliToken, newName);
-        projectId = created.id;
+        projectId2 = created.id;
         projectName = created.name;
         apiKey = created.apiKey ?? void 0;
         console.log(`  \u2713 Created project "${projectName}"`);
@@ -3777,22 +3789,22 @@ error: Could not create project: ${err instanceof Error ? err.message : String(e
       }
     }
     rl.close();
-    if (projectId && !apiKey) {
-      apiKey = await mintProjectKey(endpoint, cliToken, projectId) ?? void 0;
+    if (projectId2 && !apiKey) {
+      apiKey = await mintProjectKey(endpoint, cliToken, projectId2) ?? void 0;
     }
-    if (!projectId || !apiKey) {
+    if (!projectId2 || !apiKey) {
       process.stderr.write("\nerror: Could not obtain an SDK key for the project. Run `mushi login` and try again.\n");
       process.exit(1);
     }
     const config = loadConfig();
     config.apiKey = apiKey;
     config.endpoint = endpoint;
-    config.projectId = projectId;
+    config.projectId = projectId2;
     config.consoleUrl = consoleBase;
     saveConfig(config);
     const { envUpdated, mcpUpdated } = await writeProjectBootstrapFiles({
       endpoint,
-      projectId,
+      projectId: projectId2,
       apiKey
     });
     console.log(`
@@ -5079,9 +5091,9 @@ function registerDoctorCommand(program2) {
 function registerResetCommand(program2) {
   program2.command("reset [projectId]").description(
     "Archive a project and wipe its test data (codebase_files, fix_attempts, reports). Speeds up re-running the full onboarding flow from scratch. Requires `--confirm` to prevent accidents."
-  ).option("--confirm", "Required safety flag \u2014 must pass to proceed").option("--json", "Machine-readable output").action(async (projectId, opts) => {
+  ).option("--confirm", "Required safety flag \u2014 must pass to proceed").option("--json", "Machine-readable output").action(async (projectId2, opts) => {
     const config = loadConfig();
-    const resolvedId = projectId ?? config.projectId;
+    const resolvedId = projectId2 ?? config.projectId;
     if (!config.apiKey) {
       console.error("Run `mushi login` first");
       process.exit(1);
@@ -5383,7 +5395,7 @@ function registerKeysCommands(program2) {
       }
     );
   });
-  keys.command("add").description("Add a new API key to the pool").requiredOption("--provider <p>", "Provider: anthropic, openai, firecrawl, browserbase, cursor, supabase").option(
+  keys.command("add").description("Add a new API key to the pool").requiredOption("--provider <p>", "Provider: anthropic, openai, openrouter, firecrawl, browserbase, cursor, supabase").option(
     "--key <k>",
     "The API key value (prefer the MUSHI_BYOK_KEY env var to keep it out of shell history)"
   ).option("--label <l>", "Human-readable label").option("--priority <n>", "Priority (lower = higher priority)", "100").option("--base-url <url>", "Allow-listed OpenAI-compatible HTTPS base URL").action(
@@ -5872,11 +5884,11 @@ Examples:
       throw new MushiCliError("E_PROJECT_MISSING", "Project ID not configured.", "pass --project-id <id> or run `mushi login --project-id <id>`");
     }
     let endpoint;
-    let projectId;
+    let projectId2;
     let apiKey;
     try {
       endpoint = sanitizeEndpoint(config.endpoint);
-      projectId = sanitizeProjectId(rawProjectId);
+      projectId2 = sanitizeProjectId(rawProjectId);
       apiKey = sanitizeApiKey(config.apiKey);
     } catch (err) {
       throw new MushiCliError("E_INVALID_INPUT", err instanceof Error ? err.message : String(err));
@@ -5884,9 +5896,9 @@ Examples:
     const json2 = outputIsJson(opts.json);
     if (!json2) process.stdout.write("Running full-stack audit\u2026 ");
     const result = await apiCall(
-      `/v1/admin/projects/${projectId}/audit`,
+      `/v1/admin/projects/${projectId2}/audit`,
       { ...config, endpoint, apiKey },
-      { method: "POST", body: "{}", headers: { "X-Mushi-Project-Id": projectId } },
+      { method: "POST", body: "{}", headers: { "X-Mushi-Project-Id": projectId2 } },
       { timeoutMs: AUDIT_TIMEOUT_MS }
     );
     if (!result.ok) {
@@ -5926,6 +5938,14 @@ Examples:
         console.log(`  ${g} ${run2.gate.padEnd(22)} ${run2.status}  (${run2.findings_count} finding${run2.findings_count !== 1 ? "s" : ""})`);
       }
     }
+    const refresh = data.gate_refresh;
+    if (refresh && (refresh.triggered.length > 0 || refresh.skipped.length > 0)) {
+      console.log("\nGate re-runs:");
+      if (refresh.triggered.length > 0) {
+        console.log(`  Started: ${refresh.triggered.join(", ")} (results show in the next audit)`);
+      }
+      for (const s of refresh.skipped) console.log(`  Not re-run: ${s.gate.padEnd(16)} ${oneLine(s.reason, 110)}`);
+    }
     console.log("\nEach gate finding with its file and line: mushi audit findings");
     if (data.summary.overall === "fail") process.exit(1);
   });
@@ -5939,12 +5959,12 @@ Examples:
       throw new MushiCliError("E_INVALID_INPUT", "--severity must be info, warn or error");
     }
     const config = requireConfig();
-    const projectId = resolveProjectId(opts.projectId, config.projectId);
+    const projectId2 = resolveProjectId(opts.projectId, config.projectId);
     const qs = new URLSearchParams();
     if (opts.gate) qs.set("gate", opts.gate);
     if (opts.severity) qs.set("severity", opts.severity);
     const suffix = qs.toString() ? `?${qs}` : "";
-    const result = await apiCall(`/v1/admin/inventory/${projectId}/findings${suffix}`, config);
+    const result = await apiCall(`/v1/admin/inventory/${projectId2}/findings${suffix}`, config);
     if (!result.ok) {
       if (result.error.code === "feature_not_in_plan") {
         process.stderr.write("The per-finding list is not on your plan. `mushi audit` (no subcommand) still runs the summary audit.\n");
@@ -7316,8 +7336,8 @@ Add one step to your existing CI job, after the build step (no new job needed):
   });
   radar.command("show").description("Show every hole check for this project and what each one found").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").action(async (opts) => {
     const config = requireConfig({ needsProject: !opts.projectId });
-    const projectId = requireUuid(opts.projectId ?? config.projectId, "project id");
-    const result = await apiCall(`/v1/admin/projects/${projectId}/radar`, config);
+    const projectId2 = requireUuid(opts.projectId ?? config.projectId, "project id");
+    const result = await apiCall(`/v1/admin/projects/${projectId2}/radar`, config);
     if (!result.ok) die(result);
     if (outputIsJson(opts.json)) {
       console.log(JSON.stringify(result.data, null, 2));
@@ -9088,8 +9108,8 @@ function registerRecipeCommands(program2) {
   });
   recipe.command("show").description("Show this project's recipe: each part and its state").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").action(async (opts) => {
     const config = requireConfig({ needsProject: !opts.projectId });
-    const projectId = requireUuid(opts.projectId ?? config.projectId, "project id");
-    const res = await apiCall(`/v1/admin/projects/${projectId}/recipe`, config);
+    const projectId2 = requireUuid(opts.projectId ?? config.projectId, "project id");
+    const res = await apiCall(`/v1/admin/projects/${projectId2}/recipe`, config);
     if (!res.ok) die(res);
     if (outputIsJson(opts.json)) {
       console.log(JSON.stringify(res.data, null, 2));
@@ -9103,8 +9123,8 @@ function registerRecipeCommands(program2) {
       throw new MushiCliError("E_INVALID_INPUT", `--element must be one of ${SOURCE_ELEMENTS.join(", ")}`);
     }
     const config = requireConfig({ needsProject: !opts.projectId });
-    const projectId = requireUuid(opts.projectId ?? config.projectId, "project id");
-    const res = await apiCall(`/v1/admin/projects/${projectId}/recipe/sources?element=${opts.element}`, config);
+    const projectId2 = requireUuid(opts.projectId ?? config.projectId, "project id");
+    const res = await apiCall(`/v1/admin/projects/${projectId2}/recipe/sources?element=${opts.element}`, config);
     if (!res.ok) die(res);
     if (outputIsJson(opts.json)) {
       console.log(JSON.stringify(res.data, null, 2));
@@ -9123,8 +9143,8 @@ function registerRecipeCommands(program2) {
   recipe.command("change <jobId>").description("One recipe change job: queued, running, pr_opened, rejected or failed").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").action(async (jobId, opts) => {
     const id = requireUuid(jobId, "job id");
     const config = requireConfig({ needsProject: !opts.projectId });
-    const projectId = requireUuid(opts.projectId ?? config.projectId, "project id");
-    const res = await apiCall(`/v1/admin/projects/${projectId}/recipe/changes/${id}`, config);
+    const projectId2 = requireUuid(opts.projectId ?? config.projectId, "project id");
+    const res = await apiCall(`/v1/admin/projects/${projectId2}/recipe/changes/${id}`, config);
     if (!res.ok) die(res);
     if (outputIsJson(opts.json)) {
       console.log(JSON.stringify(res.data, null, 2));
@@ -9418,10 +9438,11 @@ function renderPortfolioFindings(data) {
 }
 function registerPortfolioCommands(program2) {
   const portfolio = program2.command("portfolio").description("Every app in your team on one screen (needs an account-level key)");
-  portfolio.command("show").description("Health, open reports, holes, SDK version and last release for each app").option(ORG_HELP, ORG_DESC).option("--page <n>", "Page of apps (25 per page)", "1").option("--json", "Machine-readable JSON output").action(async (opts) => {
+  portfolio.command("show").description("Health, open reports, holes, SDK version and last release for each app").option(ORG_HELP, ORG_DESC).option("--page <n>", "Page of apps (25 per page)", "1").option("--group <slug>", "Only the apps in this project group (see `mushi portfolio groups list`)").option("--json", "Machine-readable JSON output").action(async (opts) => {
     const config = requireConfig();
     const page = Math.max(1, Number.parseInt(opts.page, 10) || 1);
-    const result = await apiCall(`/v1/admin/orgs/${orgSegment(opts.org)}/portfolio?page=${page}`, config);
+    const group = opts.group ? `&group=${encodeURIComponent(opts.group)}` : "";
+    const result = await apiCall(`/v1/admin/orgs/${orgSegment(opts.org)}/portfolio?page=${page}${group}`, config);
     if (!result.ok) dieOrgError(result);
     if (outputIsJson(opts.json)) {
       console.log(JSON.stringify(result.data, null, 2));
@@ -9449,6 +9470,60 @@ function registerPortfolioCommands(program2) {
     }
     for (const line of renderPortfolioResources(result.data)) console.log(line);
   });
+  const groups = portfolio.command("groups").description("Named groups of apps in your team, for the portfolio filter and project switcher");
+  groups.command("list").description("Each group and how many of your apps are in it").option(ORG_HELP, ORG_DESC).option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const config = requireConfig();
+    const result = await apiCall(`/v1/admin/orgs/${orgSegment(opts.org)}/project-groups`, config);
+    if (!result.ok) dieOrgError(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data.groups, null, 2));
+      return;
+    }
+    if (result.data.groups.length === 0) console.log('No groups yet. Add one: mushi portfolio groups add "Client work"');
+    for (const g of result.data.groups) console.log(`${g.slug.padEnd(24)} ${g.name}  (${g.project_ids.length} app${g.project_ids.length === 1 ? "" : "s"})  ${g.id}`);
+  });
+  groups.command("add <name>").description("Create a group (team owners and admins)").option(ORG_HELP, ORG_DESC).option("--json", "Machine-readable JSON output").action(async (name, opts) => {
+    const config = requireConfig();
+    const result = await apiCall(`/v1/admin/orgs/${orgSegment(opts.org)}/project-groups`, config, {
+      method: "POST",
+      body: JSON.stringify({ name })
+    });
+    if (!result.ok) dieOrgError(result);
+    if (outputIsJson(opts.json)) console.log(JSON.stringify(result.data.group, null, 2));
+    else console.log(`Created "${result.data.group.name}" (${result.data.group.slug}) ${result.data.group.id}`);
+  });
+  groups.command("set <groupId> [projectIds...]").description("Set exactly which apps are in a group (team owners and admins); no ids empties it").option(ORG_HELP, ORG_DESC).action(async (groupId, projectIds, opts) => {
+    const config = requireConfig();
+    const gid = requireUuid(groupId, "group id");
+    const ids = (projectIds ?? []).map((p3) => requireUuid(p3, "project id"));
+    const result = await apiCall(
+      `/v1/admin/orgs/${orgSegment(opts.org)}/project-groups/${gid}/projects`,
+      config,
+      { method: "PUT", body: JSON.stringify({ project_ids: ids }) }
+    );
+    if (!result.ok) dieOrgError(result);
+    console.log(`Added ${result.data.added}, removed ${result.data.removed}.`);
+  });
+  groups.command("rename <groupId> <name>").description("Rename a group (team owners and admins)").option(ORG_HELP, ORG_DESC).action(async (groupId, name, opts) => {
+    const config = requireConfig();
+    const result = await apiCall(
+      `/v1/admin/orgs/${orgSegment(opts.org)}/project-groups/${requireUuid(groupId, "group id")}`,
+      config,
+      { method: "PATCH", body: JSON.stringify({ name }) }
+    );
+    if (!result.ok) dieOrgError(result);
+    console.log(`Renamed to "${result.data.group.name}" (${result.data.group.slug}).`);
+  });
+  groups.command("remove <groupId>").description("Delete a group; its apps stay (team owners and admins)").option(ORG_HELP, ORG_DESC).action(async (groupId, opts) => {
+    const config = requireConfig();
+    const result = await apiCall(
+      `/v1/admin/orgs/${orgSegment(opts.org)}/project-groups/${requireUuid(groupId, "group id")}`,
+      config,
+      { method: "DELETE" }
+    );
+    if (!result.ok) dieOrgError(result);
+    console.log("Group deleted. Its apps are unchanged.");
+  });
   portfolio.command("import <file>").description("Record shared resources from a CSV: kind,external_id,project[,role] (team owners and admins)").option(ORG_HELP, ORG_DESC).option("--json", "Machine-readable JSON output").action(async (file, opts) => {
     const read = readTextFileCapped(file, MAX_RESOURCE_CSV_BYTES);
     if (read.kind === "absent") throw new MushiCliError("E_INVALID_INPUT", `Cannot read ${file}.`);
@@ -9683,8 +9758,8 @@ function registerCodeHealthCommands(program2) {
   const codeHealth = program2.command("code-health").description("Oversized files and bundle size from your CI (Code Health page)");
   codeHealth.command("show").description("Findings from the latest code-health run and the size summary").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--days <n>", "Trend window in days (1-365)", "30").option("--json", "Machine-readable JSON output (includes the trend series)").action(async (opts) => {
     const config = requireConfig();
-    const projectId = resolveProjectId(opts.projectId, config.projectId);
-    const qs = new URLSearchParams({ project_id: projectId, days: opts.days });
+    const projectId2 = resolveProjectId(opts.projectId, config.projectId);
+    const qs = new URLSearchParams({ project_id: projectId2, days: opts.days });
     const result = await apiCall(`/v1/admin/code-health?${qs}`, config);
     if (!result.ok) die(result);
     if (outputIsJson(opts.json)) {
@@ -9695,9 +9770,9 @@ function registerCodeHealthCommands(program2) {
   });
   codeHealth.command("stats").description("Counts only: errors, warnings and oversized files").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").action(async (opts) => {
     const config = requireConfig();
-    const projectId = resolveProjectId(opts.projectId, config.projectId);
+    const projectId2 = resolveProjectId(opts.projectId, config.projectId);
     const result = await apiCall(
-      `/v1/admin/code-health/stats?${new URLSearchParams({ project_id: projectId })}`,
+      `/v1/admin/code-health/stats?${new URLSearchParams({ project_id: projectId2 })}`,
       config
     );
     if (!result.ok) die(result);
@@ -9710,7 +9785,7 @@ function registerCodeHealthCommands(program2) {
       console.log("No code-health run yet.");
       return;
     }
-    console.log(`${d.projectName ?? projectId}: ${d.errorCount} error(s), ${d.warnCount} warning(s), ${d.godFileCount} oversized file(s) \xB7 last run ${fmtDate(d.latestRunAt)}`);
+    console.log(`${d.projectName ?? projectId2}: ${d.errorCount} error(s), ${d.warnCount} warning(s), ${d.godFileCount} oversized file(s) \xB7 last run ${fmtDate(d.latestRunAt)}`);
     if (d.topPriorityLabel) console.log(`Next: ${d.topPriorityLabel}`);
   });
 }
@@ -9805,8 +9880,8 @@ ${r.body_md}`);
   });
   releases.command("draft <version>").description("Draft notes from the fixes merged in a window (nothing is sent)").option("--title <title>", "Release title").option("--since <iso>", "Window start (ISO date); default: since the last release").option("--until <iso>", "Window end (ISO date); default: now").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").action(async (version, opts) => {
     const config = requireConfig();
-    const projectId = resolveProjectId(opts.projectId, config.projectId);
-    const body = { project_id: projectId, version };
+    const projectId2 = resolveProjectId(opts.projectId, config.projectId);
+    const body = { project_id: projectId2, version };
     if (opts.title) body["title"] = opts.title;
     if (opts.since) body["window_start"] = opts.since;
     if (opts.until) body["window_end"] = opts.until;
@@ -9950,9 +10025,9 @@ Examples:
   mushi sentry import --query "is:unresolved level:error" --since-days 7`).action(async (issueIds, opts) => {
     const body = buildSentryImportBody(issueIds, opts);
     const config = requireConfig();
-    const projectId = resolveProjectId(opts.projectId, config.projectId);
+    const projectId2 = resolveProjectId(opts.projectId, config.projectId);
     const result = await apiCall(
-      `/v1/admin/projects/${projectId}/sentry/import`,
+      `/v1/admin/projects/${projectId2}/sentry/import`,
       config,
       { method: "POST", body: JSON.stringify(body) },
       { timeoutMs: IMPORT_TIMEOUT_MS }
@@ -10087,18 +10162,18 @@ function registerBudgetsCommands(program2) {
   const budgets = program2.command("budgets").description("What Mushi may spend for a project: AI budget, auto-fix caps, plan spend cap");
   budgets.command("show").description("Every spend limit and whether auto-fix is on").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").action(async (opts) => {
     const config = requireConfig();
-    const projectId = resolveProjectId(opts.projectId, config.projectId);
-    const qs = new URLSearchParams({ project_id: projectId });
+    const projectId2 = resolveProjectId(opts.projectId, config.projectId);
+    const qs = new URLSearchParams({ project_id: projectId2 });
     const [settings, billing, autofix] = await Promise.all([
       apiCall(`/v1/admin/settings?${qs}`, config),
       apiCall(`/v1/admin/billing/stats?${qs}`, config),
-      apiCall(`/v1/admin/projects/${projectId}/autofix`, config)
+      apiCall(`/v1/admin/projects/${projectId2}/autofix`, config)
     ]);
     if (!settings.ok) die(settings);
     if (!billing.ok) die(billing);
     if (!autofix.ok) die(autofix);
     const view = {
-      projectId,
+      projectId: projectId2,
       limits: pickLimits(settings.data),
       monthlySpendCapUsd: billing.data.monthlySpendCapUsd ?? null,
       autofixEnabled: autofix.data.autofix_enabled
@@ -10114,14 +10189,14 @@ function registerBudgetsCommands(program2) {
       throw new MushiCliError("E_INVALID_INPUT", "Pass on or off.", "e.g. mushi budgets autofix off");
     }
     const config = requireConfig();
-    const projectId = resolveProjectId(opts.projectId, config.projectId);
+    const projectId2 = resolveProjectId(opts.projectId, config.projectId);
     const result = await apiCall(
-      `/v1/admin/projects/${projectId}/autofix/toggle`,
+      `/v1/admin/projects/${projectId2}/autofix/toggle`,
       config,
       { method: "POST", body: JSON.stringify({ enabled: state === "on" }) }
     );
     if (!result.ok) die(result);
-    console.log(`Auto-fix is ${result.data.autofix_enabled ? "on" : "off"} for project ${projectId}.`);
+    console.log(`Auto-fix is ${result.data.autofix_enabled ? "on" : "off"} for project ${projectId2}.`);
   });
 }
 
@@ -10169,9 +10244,9 @@ function registerRepoCommands(program2) {
   repo.command("digest").description("One token-budgeted text of the repo (tree + the files that matter), secrets removed").option("--report <id>", "Start from the files linked to this report's stack trace and fixes").option("--path <folder>", "Only this folder").option("--ref <ref>", "Branch, tag or commit (default: the default branch)").option("--budget <tokens>", "Token budget").option("--include <globs>", "Comma-separated globs a file must match").option("--exclude <globs>", "Comma-separated globs to leave out").option("--out <file>", "Write the digest text to this file instead of stdout").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output (metadata and text)").action(async (opts) => {
     const qs = digestQuery(opts);
     const config = requireConfig();
-    const projectId = resolveProjectId(opts.projectId, config.projectId);
+    const projectId2 = resolveProjectId(opts.projectId, config.projectId);
     const suffix = qs.toString() ? `?${qs}` : "";
-    const result = await apiCall(`/v1/admin/projects/${projectId}/codebase/digest${suffix}`, config, {}, { timeoutMs: DIGEST_TIMEOUT_MS });
+    const result = await apiCall(`/v1/admin/projects/${projectId2}/codebase/digest${suffix}`, config, {}, { timeoutMs: DIGEST_TIMEOUT_MS });
     if (!result.ok) die(result);
     if (outputIsJson(opts.json)) {
       console.log(JSON.stringify(result.data, null, 2));
@@ -10191,8 +10266,8 @@ function registerRepoCommands(program2) {
   const diagram = repo.command("diagram").description("The architecture diagram of your repo");
   diagram.command("show").description("The latest diagram as an outline, and its public page if published").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").action(async (opts) => {
     const config = requireConfig();
-    const projectId = resolveProjectId(opts.projectId, config.projectId);
-    const result = await apiCall(`/v1/admin/projects/${projectId}/codebase/diagram`, config);
+    const projectId2 = resolveProjectId(opts.projectId, config.projectId);
+    const result = await apiCall(`/v1/admin/projects/${projectId2}/codebase/diagram`, config);
     if (!result.ok) die(result);
     if (outputIsJson(opts.json)) {
       console.log(JSON.stringify(result.data, null, 2));
@@ -10202,9 +10277,9 @@ function registerRepoCommands(program2) {
   });
   diagram.command("generate").description("Draw the diagram for the latest commit (reuses the one for that commit unless --force)").option("--force", "Draw it again even if this commit already has one").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").action(async (opts) => {
     const config = requireConfig();
-    const projectId = resolveProjectId(opts.projectId, config.projectId);
+    const projectId2 = resolveProjectId(opts.projectId, config.projectId);
     const result = await apiCall(
-      `/v1/admin/projects/${projectId}/codebase/diagram`,
+      `/v1/admin/projects/${projectId2}/codebase/diagram`,
       config,
       { method: "POST", body: JSON.stringify({ force: opts.force === true }) },
       { timeoutMs: DIAGRAM_TIMEOUT_MS }
@@ -10219,8 +10294,8 @@ function registerRepoCommands(program2) {
   });
   diagram.command("publish").description("Publish the latest diagram as a public page (project owners and admins)").option("--yes", "Confirm: the diagram becomes public").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").action(async (opts) => {
     const config = requireConfig();
-    const projectId = resolveProjectId(opts.projectId, config.projectId);
-    const preview = await apiCall(`/v1/admin/projects/${projectId}/codebase/diagram/publish-preview`, config);
+    const projectId2 = resolveProjectId(opts.projectId, config.projectId);
+    const preview = await apiCall(`/v1/admin/projects/${projectId2}/codebase/diagram/publish-preview`, config);
     if (!preview.ok) die(preview);
     const p3 = preview.data;
     if (!p3.can_publish) {
@@ -10229,7 +10304,7 @@ function registerRepoCommands(program2) {
     console.log(`Will publish to ${p3.url}${p3.repo_private ? " (the repo is private on GitHub)" : ""}.`);
     requireYes(opts.yes, "Publishing makes the diagram public.");
     const result = await apiCall(
-      `/v1/admin/projects/${projectId}/codebase/diagram/publish`,
+      `/v1/admin/projects/${projectId2}/codebase/diagram/publish`,
       config,
       { method: "POST", body: JSON.stringify({ diagram_id: p3.diagram_id, payload_hash: p3.payload_hash }) },
       { timeoutMs: PUBLISH_TIMEOUT_MS2 }
@@ -10245,8 +10320,8 @@ function registerRepoCommands(program2) {
   diagram.command("unpublish").description("Take the public diagram page down").option("--yes", "Confirm the unpublish").option("--project-id <id>", "Project ID (defaults to the configured project)").action(async (opts) => {
     requireYes(opts.yes, "This removes the public diagram page.");
     const config = requireConfig();
-    const projectId = resolveProjectId(opts.projectId, config.projectId);
-    const result = await apiCall(`/v1/admin/projects/${projectId}/codebase/diagram/publish`, config, { method: "DELETE" });
+    const projectId2 = resolveProjectId(opts.projectId, config.projectId);
+    const result = await apiCall(`/v1/admin/projects/${projectId2}/codebase/diagram/publish`, config, { method: "DELETE" });
     if (!result.ok) die(result);
     console.log("The public diagram page is down.");
   });
@@ -10407,7 +10482,7 @@ function registerSpendCommands(program2) {
   });
   spend.command("import <file>").description("Import a bill CSV (FOCUS, AWS CUR, or date,service,cost); a re-import of the same days replaces them").requiredOption("--vendor <vendor>", VENDORS.join(" | ")).option("--project-id <id>", "Put every row on this app (default: match an app column by name or slug)").option(ORG_FLAG2, ORG_DESC3).option("--json", "Machine-readable JSON output").action(async (file, opts) => {
     if (!VENDORS.includes(opts.vendor)) throw new MushiCliError("E_INVALID_INPUT", `--vendor must be one of ${VENDORS.join(", ")}`);
-    const projectId = opts.projectId ? requireUuid(opts.projectId, "project id") : void 0;
+    const projectId2 = opts.projectId ? requireUuid(opts.projectId, "project id") : void 0;
     const read = readTextFileCapped(file, MAX_BILL_CSV_BYTES);
     if (read.kind === "absent") throw new MushiCliError("E_INVALID_INPUT", `Cannot read ${file}.`);
     if (read.kind === "too_large") throw new MushiCliError("E_INVALID_INPUT", `${file} is over 5 MB.`, "export daily rather than hourly rows, or split it by month");
@@ -10416,7 +10491,7 @@ function registerSpendCommands(program2) {
     const result = await apiCall(
       `/v1/admin/orgs/${orgSegment(opts.org)}/spend/imports`,
       config,
-      { method: "POST", body: JSON.stringify({ vendor: opts.vendor, csv, filename: basename2(file), ...projectId ? { projectId } : {} }) },
+      { method: "POST", body: JSON.stringify({ vendor: opts.vendor, csv, filename: basename2(file), ...projectId2 ? { projectId: projectId2 } : {} }) },
       { timeoutMs: IMPORT_TIMEOUT_MS2 }
     );
     if (!result.ok) dieOrgError(result);
@@ -10495,6 +10570,140 @@ function registerDesignCommands(program2) {
   });
 }
 
+// src/commands/ux.ts
+import { spawn as spawn2 } from "child_process";
+import { existsSync as existsSync5 } from "fs";
+import { dirname as dirname3, join as join10 } from "path";
+var UX_PACKAGE = "@mushi-mushi/ux@^0.1.0";
+function cmdQuote(arg) {
+  return /^[\w./:=@-]+$/.test(arg) ? arg : `"${arg.replace(/"/g, '""')}"`;
+}
+var NPX_CLI_CANDIDATES = [
+  join10(dirname3(process.execPath), "node_modules", "npm", "bin", "npx-cli.js"),
+  join10(dirname3(process.execPath), "..", "lib", "node_modules", "npm", "bin", "npx-cli.js")
+];
+function uxCommandLine(args, env = process.env, platform = process.platform, npxCli = NPX_CLI_CANDIDATES, hasFile = existsSync5) {
+  const local = env.MUSHI_UX_BIN?.trim();
+  if (local) return { cmd: process.execPath, argv: [local, ...args], shell: false };
+  const npxArgs = ["--yes", "--package", UX_PACKAGE, "mushi-ux", ...args];
+  const found = (typeof npxCli === "string" ? [npxCli] : npxCli).find((p3) => hasFile(p3));
+  if (found) return { cmd: process.execPath, argv: [found, ...npxArgs], shell: false };
+  if (platform === "win32") return { cmd: "npx", argv: npxArgs.map(cmdQuote), shell: true };
+  return { cmd: "npx", argv: npxArgs, shell: false };
+}
+function registerUxCommands(program2) {
+  program2.command("ux").description("Run your coding agent over every screen of your app and keep only measured UX improvements (local, uses @mushi-mushi/ux)").argument("[args...]", "Passed to mushi-ux: ui | run | discover | login | models | skills | open").allowUnknownOption().helpOption(false).addHelpText(
+    "after",
+    `
+Examples:
+  mushi ux ui                                   # studio: pick agent, model, skill; watch every attempt
+  mushi ux models --agent cursor                # models your Cursor account can use
+  mushi ux discover --url http://localhost:5173
+  mushi ux run --dev "pnpm dev --port {port}" --agent claude-code
+  mushi ux run --dev "pnpm dev --port {port}" --agent cursor --model <id from \`agent --list-models\`>
+  mushi ux --help`
+  ).action((args) => {
+    const { cmd, argv, shell } = uxCommandLine(args);
+    let env = process.env;
+    if (args.includes("--sync")) {
+      const config = requireConfig({ needsProject: true });
+      env = { ...process.env, MUSHI_API_KEY: config.apiKey, MUSHI_PROJECT_ID: config.projectId, MUSHI_API_ENDPOINT: config.endpoint };
+    } else if (args[0] === "ui") {
+      const config = loadConfig();
+      if (config.apiKey && config.projectId) {
+        env = { ...process.env, MUSHI_API_KEY: config.apiKey, MUSHI_PROJECT_ID: config.projectId, ...config.endpoint ? { MUSHI_API_ENDPOINT: config.endpoint } : {} };
+      }
+    }
+    const child = spawn2(cmd, argv, { stdio: "inherit", shell, env });
+    child.on("error", (err) => {
+      process.stderr.write(`error: could not start mushi-ux (${err.message}). Install it with: npm i -g @mushi-mushi/ux
+`);
+      process.exit(1);
+    });
+    child.on("exit", (code) => process.exit(code ?? 1));
+  });
+}
+
+// src/commands/ux-runs.ts
+var STATUS_LABEL = {
+  accepted: "improved",
+  reverted: "rolled back",
+  regressed: "moved by another fix",
+  blocked: "could not load",
+  skipped: "no change needed",
+  iterating: "agent working",
+  baseline: "measuring",
+  pending: "queued"
+};
+var RUN_ID_RE = /^[0-9]{8}-[0-9]{6}-[a-z0-9]{4}$/;
+var KEY_RE = /^[a-z0-9][a-z0-9-]{0,79}$/;
+function projectId() {
+  const config = requireConfig({ needsProject: true });
+  return { config, pid: encodeURIComponent(config.projectId) };
+}
+function requireRunId(runId) {
+  if (!RUN_ID_RE.test(runId)) throw new MushiCliError("E_INVALID_INPUT", `"${runId}" is not a run id (like 20261006-011207-qafu).`);
+  return runId;
+}
+function registerUxRunsCommands(program2) {
+  const runs = program2.command("ux-runs").description("UX runs synced from `mushi ux run --sync`: which screens were improved, rolled back or moved");
+  runs.command("list").description("Recent UX runs for this project").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const { config, pid } = projectId();
+    const result = await apiCall(`/v1/admin/projects/${pid}/ux-runs`, config);
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data.runs, null, 2));
+      return;
+    }
+    if (result.data.runs.length === 0) {
+      console.log('No UX runs yet. Start one with: mushi ux run --dev "pnpm dev --port {port}" --sync');
+      return;
+    }
+    for (const r of result.data.runs) {
+      const c = r.counts;
+      console.log(
+        `${r.local_run_id}  ${r.status.padEnd(7)}  ${r.agent}${r.model ? ` \xB7 ${r.model}` : ""}  improved ${c.accepted ?? 0} \xB7 rolled back ${c.reverted ?? 0} \xB7 moved ${c.regressed ?? 0} \xB7 blocked ${c.blocked ?? 0}`
+      );
+    }
+  });
+  runs.command("show <runId>").description("Every screen of one run, what still needs a look first").option("--json", "Machine-readable JSON output").action(async (runId, opts) => {
+    const { config, pid } = projectId();
+    const result = await apiCall(
+      `/v1/admin/projects/${pid}/ux-runs/${requireRunId(runId)}`,
+      config
+    );
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    const { run: run2, surfaces } = result.data;
+    if (run2.branch) console.log(`Kept changes: ${run2.branch}
+`);
+    const order = ["regressed", "reverted", "blocked", "iterating", "baseline", "accepted", "skipped", "pending"];
+    for (const s of [...surfaces].sort((a, b) => order.indexOf(a.status) - order.indexOf(b.status))) {
+      const score = s.penalty_before !== null ? `  score ${s.penalty_before}${s.penalty_after !== null ? `\u2192${s.penalty_after}` : ""}` : "";
+      console.log(`${(STATUS_LABEL[s.status] ?? s.status).padEnd(22)} ${s.label}  ${s.path}${score}${s.report_id ? "  (filed)" : ""}`);
+      if (s.note) console.log(`${" ".repeat(23)}${s.note}`);
+    }
+  });
+  runs.command("file <runId> <screen>").description("File one screen of a run as a bug (source ux_loop; no AI call)").option("--json", "Machine-readable JSON output").action(async (runId, screen, opts) => {
+    if (!KEY_RE.test(screen)) throw new MushiCliError("E_INVALID_INPUT", `"${screen}" is not a screen key (see \`mushi ux-runs show ${runId}\` --json).`);
+    const { config, pid } = projectId();
+    const result = await apiCall(
+      `/v1/admin/projects/${pid}/ux-runs/${requireRunId(runId)}/surfaces/${screen}/report`,
+      config,
+      { method: "POST", body: "{}" }
+    );
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    console.log(result.data.reused ? `Already filed: report ${result.data.report_id}` : `Filed report ${result.data.report_id}`);
+  });
+}
+
 // src/index.ts
 installSignalHandlers();
 var program = new Command().name("mushi").description("Mushi CLI \u2014 set up the SDK, triage a report, fix from your editor").version(MUSHI_CLI_VERSION).option("--profile <name>", "Use a named credential profile for this invocation (or set MUSHI_PROFILE)").option("-o, --output <format>", "Output format: text | json", "text").hook("preAction", (_thisCommand, actionCommand) => {
@@ -10558,6 +10767,8 @@ registerRepoCommands(program);
 registerAccountsCommands(program);
 registerSpendCommands(program);
 registerDesignCommands(program);
+registerUxCommands(program);
+registerUxRunsCommands(program);
 registerCompletionCommand(program);
 program.parseAsync().catch((err) => {
   printAndExit(err);