@mushi-mushi/cli 0.6.1 → 0.8.0

package/dist/index.js

@@ -10,13 +10,20 @@ import { homedir } from "os";
 var CONFIG_PATH = join(homedir(), ".mushirc");
 var SECURE_FILE_MODE = 384;
 function loadConfig(path = CONFIG_PATH) {
-  if (!existsSync(path)) return {};
-  tightenPermissions(path);
-  try {
-    return JSON.parse(readFileSync(path, "utf-8"));
-  } catch {
-    return {};
+  let file = {};
+  if (existsSync(path)) {
+    tightenPermissions(path);
+    try {
+      file = JSON.parse(readFileSync(path, "utf-8"));
+    } catch {
+    }
   }
+  const fromEnv = {
+    ...process.env["MUSHI_API_KEY"] ? { apiKey: process.env["MUSHI_API_KEY"] } : {},
+    ...process.env["MUSHI_PROJECT_ID"] ? { projectId: process.env["MUSHI_PROJECT_ID"] } : {},
+    ...process.env["MUSHI_API_ENDPOINT"] ? { endpoint: process.env["MUSHI_API_ENDPOINT"] } : {}
+  };
+  return { ...file, ...fromEnv };
 }
 function saveConfig(config, path = CONFIG_PATH) {
   writeFileSync(path, JSON.stringify(config, null, 2), { mode: SECURE_FILE_MODE });
@@ -275,7 +282,6 @@ function collectDeps(pkg) {
 }
 
 // src/endpoint.ts
-var DEFAULT_ENDPOINT = "https://api.mushimushi.dev";
 var TEST_REPORT_TIMEOUT_MS = 1e4;
 var TEST_REPORT_FETCH_TIMEOUT_MS = TEST_REPORT_TIMEOUT_MS;
 function assertEndpoint(url) {
@@ -293,10 +299,14 @@ function assertEndpoint(url) {
   return parsed.origin + (parsed.pathname === "/" ? "" : parsed.pathname);
 }
 function normalizeEndpoint(url) {
-  const input = url ?? DEFAULT_ENDPOINT;
-  let end = input.length;
-  while (end > 0 && input.charCodeAt(end - 1) === 47) end--;
-  return input.slice(0, end);
+  if (!url) {
+    throw new Error(
+      "No API endpoint configured. Run `mushi init` or set MUSHI_API_ENDPOINT. Set endpoint to your Supabase edge function URL, e.g. https://xyz.supabase.co/functions/v1/api"
+    );
+  }
+  let end = url.length;
+  while (end > 0 && url.charCodeAt(end - 1) === 47) end--;
+  return url.slice(0, end);
 }
 
 // src/freshness.ts
@@ -454,11 +464,11 @@ function getFrameworkFromPkg(pkg) {
 }
 
 // src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.6.1" : "0.0.0-dev";
+var MUSHI_CLI_VERSION = true ? "0.8.0" : "0.0.0-dev";
 
 // src/init.ts
 var ENV_FILES = [".env.local", ".env"];
-var PROJECT_ID_PATTERN = /^proj_[A-Za-z0-9_-]{10,}$/;
+var PROJECT_ID_PATTERN = /^(?:proj_[A-Za-z0-9_-]{10,}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
 var API_KEY_PATTERN = /^mushi_[A-Za-z0-9_-]{10,}$/;
 async function runInit(options = {}) {
   const cwd = options.cwd ?? process.cwd();
@@ -490,7 +500,8 @@ async function runInit(options = {}) {
   }
   writeEnvFile(cwd, credentials.apiKey, credentials.projectId, framework);
   persistCliConfig(credentials.apiKey, credentials.projectId);
-  printNextSteps(framework, credentials.apiKey, credentials.projectId);
+  const enableRewards = await maybeEnableRewards(options);
+  printNextSteps(framework, credentials.apiKey, credentials.projectId, enableRewards);
   await maybeSendTestReport(credentials, options);
   p.outro("Setup complete. Happy bug squashing \u{1F41B}");
 }
@@ -502,7 +513,7 @@ function ensureInteractiveOrBailOut(options) {
   );
   if (hasAllFlags) return;
   process.stderr.write(
-    "mushi-mushi: non-interactive terminal detected.\nPass all of --yes (or --framework), --project-id, and --api-key to run unattended.\nExample: npx mushi-mushi --yes --project-id proj_xxx --api-key mushi_xxx\n"
+    "mushi-mushi: non-interactive terminal detected.\nPass all of --yes (or --framework), --project-id, and --api-key to run unattended.\nExample: npx mushi-mushi --yes --project-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx --api-key mushi_xxx\nYour project ID is the UUID shown in the Projects page of the Mushi admin console.\n"
   );
   process.exit(1);
 }
@@ -536,21 +547,22 @@ async function collectCredentials(options) {
   const existing = loadConfig();
   const rawProjectId = options.projectId ?? existing.projectId ?? await promptText({
     message: "Project ID",
-    placeholder: "proj_xxxxxxxxxxxx",
-    hint: "Find this at https://kensaur.us/mushi-mushi/projects",
-    validate: (v) => PROJECT_ID_PATTERN.test(v) ? void 0 : "Expected format: proj_ followed by 10+ alphanumeric characters"
+    placeholder: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
+    hint: "Where to find it: https://kensaur.us/mushi-mushi/projects \u2192 click your project \u2192 copy the UUID below the project name.",
+    validate: (v) => PROJECT_ID_PATTERN.test(v) ? void 0 : "Expected a UUID (xxxxxxxx-xxxx-...) \u2014 copy it from the Mushi admin console Projects page."
   });
   const rawApiKey = options.apiKey ?? existing.apiKey ?? await promptText({
     message: "API key",
     placeholder: "mushi_xxxxxxxxxxxx",
-    hint: "Treat this like a password \u2014 it goes in your env file, not in source.",
+    hint: "Where to find it: https://kensaur.us/mushi-mushi/settings \u2192 API Keys tab. Treat it like a password \u2014 env file only, never commit it.",
     validate: (v) => API_KEY_PATTERN.test(v) ? void 0 : "Expected format: mushi_ followed by 10+ alphanumeric characters"
   });
   const projectId = sanitizeSecret(rawProjectId);
   const apiKey = sanitizeSecret(rawApiKey);
   if (!PROJECT_ID_PATTERN.test(projectId)) {
     throw new Error(
-      `Invalid project ID. Expected format: proj_[A-Za-z0-9_-]{10,}. Got: ${redact(projectId)}`
+      `Invalid project ID. Got: ${redact(projectId)}
+Expected a UUID (e.g. 542b34e0-019e-41fe-b900-7b637717bb86) \u2014 copy it from the Projects page in the Mushi console at https://kensaur.us/mushi-mushi/projects`
     );
   }
   if (!API_KEY_PATTERN.test(apiKey)) {
@@ -568,6 +580,7 @@ function redact(value) {
   return `${value.slice(0, 4)}\u2026${value.slice(-2)}`;
 }
 async function promptText(opts) {
+  if (opts.hint) p.log.info(opts.hint);
   const value = await p.text({
     message: opts.message,
     placeholder: opts.placeholder,
@@ -584,18 +597,17 @@ async function promptText(opts) {
     p.cancel("Aborted.");
     process.exit(0);
   }
-  if (opts.hint) p.log.info(opts.hint);
   return value;
 }
 async function installPackages(pm, packages, cwd) {
   const command = installCommand(pm, packages);
-  const spinner2 = p.spinner();
-  spinner2.start(`Installing ${packages.join(", ")} via ${pm}\u2026`);
+  const spinner3 = p.spinner();
+  spinner3.start(`Installing ${packages.join(", ")} via ${pm}\u2026`);
   try {
     await runCommand(pm, packages, cwd);
-    spinner2.stop(`Installed ${packages.join(", ")}`);
+    spinner3.stop(`Installed ${packages.join(", ")}`);
   } catch (err) {
-    spinner2.stop(`Install failed \u2014 run \`${command}\` manually.`);
+    spinner3.stop(`Install failed \u2014 run \`${command}\` manually.`);
     p.log.error(err instanceof Error ? err.name + ": " + err.message : String(err));
   }
 }
@@ -669,13 +681,34 @@ function persistCliConfig(apiKey, projectId) {
   const existing = loadConfig();
   saveConfig({ ...existing, apiKey, projectId });
 }
-function printNextSteps(framework, apiKey, projectId) {
+function printNextSteps(framework, apiKey, projectId, enableRewards = false) {
   p.note(framework.snippet(apiKey, projectId), "Add this to your app:");
+  if (enableRewards) {
+    const badgeSnippet = framework.id === "react" ? `// Add to your user menu or profile UI:
+import { MushiRewardsBadge } from '@mushi-mushi/react';
+
+// Inside your component:
+<MushiRewardsBadge showPoints />` : `// Add to your user menu:
+// import { MushiRewardsBadge } from '@mushi-mushi/react';
+// <MushiRewardsBadge showPoints />`;
+    p.note(badgeSnippet, "Rewards badge snippet:");
+    p.log.info("Enable rewards in your project settings at https://kensaur.us/mushi-mushi/rewards");
+    p.log.info("Users will earn points for bug reports, screen navigation, and app activity.");
+  }
   p.log.message("Verify the install:");
   p.log.message("  \u2022 Start your dev server");
   p.log.message("  \u2022 Look for the \u{1F41B} button in the bottom-right corner (or shake on mobile)");
   p.log.message("  \u2022 Submit a test report \u2014 it should appear at https://kensaur.us/mushi-mushi/reports");
 }
+async function maybeEnableRewards(options) {
+  if (options.yes) return false;
+  const answer = await p.confirm({
+    message: "Enable Mushi Rewards? (users earn points for bug reports + app activity)",
+    initialValue: false
+  });
+  if (p.isCancel(answer)) return false;
+  return Boolean(answer);
+}
 async function maybeSendTestReport(credentials, options) {
   if (options.sendTestReport === false) return;
   let shouldSend;
@@ -690,8 +723,15 @@ async function maybeSendTestReport(credentials, options) {
     shouldSend = answer;
   }
   if (!shouldSend) return;
-  const spinner2 = p.spinner();
-  spinner2.start("Sending test report\u2026");
+  if (!options.endpoint) {
+    p.note(
+      "No endpoint configured \u2014 skipping test report.\nSet endpoint to your Supabase edge function URL, e.g. https://xyz.supabase.co/functions/v1/api",
+      "Skipped"
+    );
+    return;
+  }
+  const spinner3 = p.spinner();
+  spinner3.start("Sending test report\u2026");
   const endpoint = normalizeEndpoint(options.endpoint);
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), TEST_REPORT_FETCH_TIMEOUT_MS);
@@ -723,17 +763,24 @@ async function maybeSendTestReport(credentials, options) {
       })
     });
     if (!res.ok) {
-      spinner2.stop(`Test report rejected (HTTP ${res.status}).`);
+      spinner3.stop(`Test report rejected (HTTP ${res.status}).`);
       p.log.warn(
         res.status === 401 || res.status === 403 ? "Credentials did not authenticate \u2014 double-check the project ID and API key." : "Skipping test report. You can retry with `mushi test`."
       );
       return;
     }
-    spinner2.stop("Test report sent.");
-    p.log.success("View it at https://kensaur.us/mushi-mushi/reports");
+    spinner3.stop("Test report sent.");
+    let reportId;
+    try {
+      const body = await res.json();
+      reportId = body.data?.reportId;
+    } catch {
+    }
+    const reportPath = reportId ? `/reports/${reportId}` : "/reports";
+    p.log.success(`View it at https://kensaur.us/mushi-mushi/admin${reportPath}`);
   } catch (err) {
     const aborted = err instanceof Error && err.name === "AbortError";
-    spinner2.stop(aborted ? "Timed out reaching the Mushi API." : "Could not reach the Mushi API.");
+    spinner3.stop(aborted ? "Timed out reaching the Mushi API." : "Could not reach the Mushi API.");
     p.log.warn(err instanceof Error ? err.message : String(err));
   } finally {
     clearTimeout(timer);
@@ -828,7 +875,7 @@ var MIGRATE_CATALOG = [
     category: "competitor",
     status: "published",
     detectionLabel: pkgs[0],
-    match: (d) => pkgs.some((p2) => d.has(p2))
+    match: (d) => pkgs.some((p3) => d.has(p3))
   }))
 ];
 function titleForCompetitor(slug) {
@@ -860,10 +907,10 @@ function depsFromPackageJson(pkg) {
 }
 function runMigrate(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
-  const log2 = opts.log ?? ((s) => console.log(s));
+  const log3 = opts.log ?? ((s) => console.log(s));
   const pkg = readPackageJson(cwd);
   if (!pkg) {
-    log2(
+    log3(
       opts.json ? JSON.stringify({ ok: false, error: "no-package-json", cwd, matches: [] }, null, 2) : `No package.json found in ${cwd}. Run \`mushi migrate\` from your project root.`
     );
     return { matches: [] };
@@ -871,7 +918,7 @@ function runMigrate(opts = {}) {
   const deps = depsFromPackageJson(pkg);
   const matches = detectMigrations(deps);
   if (opts.json) {
-    log2(
+    log3(
       JSON.stringify(
         {
           ok: true,
@@ -891,40 +938,302 @@ function runMigrate(opts = {}) {
     return { matches };
   }
   if (matches.length === 0) {
-    log2("No migrations suggested for this project.");
-    log2(`Browse the full catalog: ${DOCS_BASE}/migrations`);
+    log3("No migrations suggested for this project.");
+    log3(`Browse the full catalog: ${DOCS_BASE}/migrations`);
     return { matches };
   }
-  log2(`Suggested migration${matches.length > 1 ? "s" : ""} for this project:`);
-  log2("");
+  log3(`Suggested migration${matches.length > 1 ? "s" : ""} for this project:`);
+  log3("");
   for (const { guide, url } of matches) {
-    log2(`  \u2022 ${guide.title}`);
-    if (guide.detectionLabel) log2(`    detected: ${guide.detectionLabel}`);
-    log2(`    ${guide.summary}`);
-    log2(`    ${url}`);
-    log2("");
+    log3(`  \u2022 ${guide.title}`);
+    if (guide.detectionLabel) log3(`    detected: ${guide.detectionLabel}`);
+    log3(`    ${guide.summary}`);
+    log3(`    ${url}`);
+    log3("");
   }
-  log2(`Browse the full catalog: ${DOCS_BASE}/migrations`);
+  log3(`Browse the full catalog: ${DOCS_BASE}/migrations`);
   return { matches };
 }
 
+// src/sourcemaps.ts
+import { createReadStream } from "fs";
+import { readFile, readdir } from "fs/promises";
+import { createHash } from "crypto";
+import { join as join5, relative, basename } from "path";
+import * as p2 from "@clack/prompts";
+async function findMapFiles(dir) {
+  const results = [];
+  async function walk(current) {
+    const entries = await readdir(current, { withFileTypes: true });
+    for (const e of entries) {
+      const full = join5(current, e.name);
+      if (e.isDirectory()) {
+        await walk(full);
+      } else if (e.isFile() && (e.name.endsWith(".js.map") || e.name.endsWith(".css.map"))) {
+        results.push(full);
+      }
+    }
+  }
+  await walk(dir);
+  return results;
+}
+function fileHash(path) {
+  return new Promise((resolve2, reject) => {
+    const hash = createHash("sha256");
+    const stream = createReadStream(path);
+    stream.on("data", (chunk) => hash.update(chunk));
+    stream.on("end", () => resolve2(hash.digest("hex")));
+    stream.on("error", reject);
+  });
+}
+async function uploadFile(filePath, release, endpoint, apiKey) {
+  const sha256 = await fileHash(filePath);
+  try {
+    const checkRes = await fetch(
+      `${endpoint}/v1/sourcemaps?sha256=${encodeURIComponent(sha256)}&release=${encodeURIComponent(release)}`,
+      { headers: { Authorization: `Bearer ${apiKey}`, "X-Mushi-Api-Key": apiKey } }
+    );
+    if (checkRes.ok) {
+      const json = await checkRes.json();
+      if (json.exists) return { ok: true, skipped: true };
+    }
+  } catch {
+  }
+  const contents = await readFile(filePath);
+  const form = new FormData();
+  form.append("file", new Blob([contents]), basename(filePath));
+  form.append("filename", relative(process.cwd(), filePath).replaceAll("\\", "/"));
+  form.append("release", release);
+  form.append("sha256", sha256);
+  const res = await fetch(`${endpoint}/v1/sourcemaps`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${apiKey}`, "X-Mushi-Api-Key": apiKey },
+    body: form
+  });
+  if (!res.ok) {
+    const text2 = await res.text().catch(() => "");
+    return {
+      ok: false,
+      skipped: false,
+      reason: `HTTP ${res.status}: ${text2.slice(0, 120)}`
+    };
+  }
+  return { ok: true, skipped: false };
+}
+async function runSourcemapsUpload(opts) {
+  const endpoint = opts.endpoint ?? process.env["MUSHI_API_ENDPOINT"] ?? "";
+  const apiKey = opts.apiKey ?? process.env["MUSHI_API_KEY"] ?? "";
+  if (!opts.dryRun && !endpoint) {
+    p2.log.error(
+      "No API endpoint configured. Pass --endpoint <url>, set MUSHI_API_ENDPOINT,\n  or run `mushi config endpoint <url>` to persist it. For Supabase self-hosting,\n  this is your edge-functions URL, e.g. https://xyz.supabase.co/functions/v1/api"
+    );
+    process.exit(1);
+  }
+  if (!opts.dryRun && !apiKey) {
+    p2.log.error("No API key \u2014 set MUSHI_API_KEY or pass --api-key <key>");
+    process.exit(1);
+  }
+  if (!opts.silent) p2.intro(`sourcemaps upload \xB7 release ${opts.release}`);
+  const spin = p2.spinner();
+  spin.start(`Scanning ${opts.dir} for .map files\u2026`);
+  let files;
+  try {
+    files = await findMapFiles(opts.dir);
+  } catch (err) {
+    spin.stop("Scan failed");
+    p2.log.error(
+      `Cannot read ${opts.dir}: ${err instanceof Error ? err.message : String(err)}`
+    );
+    process.exit(1);
+  }
+  spin.stop(
+    `Found ${files.length} map file${files.length === 1 ? "" : "s"}`
+  );
+  if (files.length === 0) {
+    p2.log.warn("No .js.map or .css.map files found \u2014 nothing to upload.");
+    return;
+  }
+  if (opts.dryRun) {
+    p2.log.info("Dry run \u2014 files that would be uploaded:");
+    for (const f of files) {
+      p2.log.message(`  ${relative(process.cwd(), f).replaceAll("\\", "/")}`);
+    }
+    p2.outro(`${files.length} file${files.length === 1 ? "" : "s"} would be uploaded`);
+    return;
+  }
+  let uploaded = 0;
+  let skipped = 0;
+  let failed = 0;
+  for (const filePath of files) {
+    const rel = relative(process.cwd(), filePath).replaceAll("\\", "/");
+    const fs = p2.spinner();
+    fs.start(rel);
+    const result = await uploadFile(filePath, opts.release, endpoint, apiKey);
+    if (result.skipped) {
+      fs.stop(`\u21A9  ${rel} (already uploaded)`);
+      skipped++;
+    } else if (result.ok) {
+      fs.stop(`\u2713  ${rel}`);
+      uploaded++;
+    } else {
+      fs.stop(`\u2717  ${rel} \u2014 ${result.reason ?? "unknown error"}`);
+      failed++;
+    }
+  }
+  const total = files.length;
+  const parts = [
+    `Uploaded ${uploaded} / ${total} file${total === 1 ? "" : "s"}`,
+    skipped > 0 ? `(${skipped} already existed)` : "",
+    failed > 0 ? `\u2014 ${failed} failed` : ""
+  ].filter(Boolean);
+  const summary = parts.join(" ");
+  if (!opts.silent) {
+    if (failed > 0) {
+      p2.log.error(summary);
+    } else {
+      p2.outro(summary);
+    }
+  }
+  if (failed > 0) process.exit(1);
+}
+
 // src/index.ts
+var API_TIMEOUT_MS = 15e3;
 async function apiCall(path, config, options = {}) {
-  const endpoint = config.endpoint ?? DEFAULT_ENDPOINT;
-  const res = await fetch(`${endpoint}${path}`, {
-    ...options,
-    headers: {
-      "Content-Type": "application/json",
-      "Authorization": `Bearer ${config.apiKey}`,
-      "X-Mushi-Api-Key": config.apiKey ?? "",
-      "X-Mushi-Project": config.projectId ?? "",
-      ...options.headers
+  const endpoint = config.endpoint;
+  if (!endpoint) {
+    return {
+      ok: false,
+      error: {
+        code: "NO_ENDPOINT",
+        message: "No API endpoint configured.\n  Run: mushi login --api-key <key> --endpoint <url> --project-id <id>\n  Or:  export MUSHI_API_ENDPOINT=https://<project-ref>.supabase.co/functions/v1/api"
+      }
+    };
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), API_TIMEOUT_MS);
+  try {
+    const res = await fetch(`${endpoint}${path}`, {
+      ...options,
+      signal: controller.signal,
+      headers: {
+        "Content-Type": "application/json",
+        // `apiKeyAuth` reads X-Mushi-Api-Key; the Authorization header is a
+        // fallback accepted by some older middleware. Both are sent.
+        "Authorization": `Bearer ${config.apiKey ?? ""}`,
+        "X-Mushi-Api-Key": config.apiKey ?? "",
+        "X-Mushi-Project": config.projectId ?? "",
+        "X-Mushi-Cli-Version": MUSHI_CLI_VERSION,
+        ...options.headers
+      }
+    });
+    clearTimeout(timer);
+    let body;
+    const contentType = res.headers.get("content-type") ?? "";
+    if (contentType.includes("application/json")) {
+      try {
+        body = await res.json();
+      } catch {
+        body = null;
+      }
+    } else {
+      const text2 = await res.text();
+      try {
+        body = JSON.parse(text2);
+      } catch {
+        body = {
+          ok: false,
+          error: {
+            code: `HTTP_${res.status}`,
+            message: text2.trim().slice(0, 300) || `HTTP ${res.status}`
+          }
+        };
+      }
     }
-  });
-  return res.json();
+    if (!res.ok && typeof body === "object" && body !== null && !("ok" in body)) {
+      const b = body;
+      return {
+        ok: false,
+        httpStatus: res.status,
+        error: {
+          code: b["code"] ?? `HTTP_${res.status}`,
+          message: b["message"] ?? `Request failed (${res.status})`
+        }
+      };
+    }
+    return body;
+  } catch (err) {
+    clearTimeout(timer);
+    if (err instanceof Error && err.name === "AbortError") {
+      return {
+        ok: false,
+        error: {
+          code: "TIMEOUT",
+          message: `Request timed out after ${API_TIMEOUT_MS / 1e3}s. Check your network or endpoint.`
+        }
+      };
+    }
+    return {
+      ok: false,
+      error: {
+        code: "NETWORK_ERROR",
+        message: err instanceof Error ? err.message : String(err)
+      }
+    };
+  }
+}
+function die(result, exitCode = 1) {
+  const { code, message } = result.error;
+  const status = result.httpStatus ? ` [${result.httpStatus}]` : "";
+  process.stderr.write(`error${status}: ${code} \u2014 ${message}
+`);
+  process.exit(exitCode);
+}
+function requireConfig(opts = {}) {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    process.stderr.write(
+      "error: API key not configured.\n  Run:  mushi login --api-key <key> --endpoint <url>\n  Or:   export MUSHI_API_KEY=<key>\n"
+    );
+    process.exit(2);
+  }
+  if (!config.endpoint) {
+    process.stderr.write(
+      "error: API endpoint not configured.\n  Run:  mushi login --endpoint https://<ref>.supabase.co/functions/v1/api\n  Or:   export MUSHI_API_ENDPOINT=<url>\n"
+    );
+    process.exit(2);
+  }
+  if (opts.needsProject && !config.projectId) {
+    process.stderr.write(
+      "error: Project ID not configured.\n  Run:  mushi login --project-id <uuid>\n  Or:   export MUSHI_PROJECT_ID=<uuid>\n  Find your project ID: https://kensaur.us/mushi-mushi/projects\n"
+    );
+    process.exit(2);
+  }
+  return config;
+}
+function fmtDate(iso) {
+  if (!iso) return "\u2014";
+  return new Date(iso).toLocaleString(void 0, { dateStyle: "short", timeStyle: "short" });
+}
+function pad(s, width) {
+  return s.length >= width ? s : s + " ".repeat(width - s.length);
 }
-var program = new Command().name("mushi").description("Mushi Mushi CLI \u2014 set up the SDK, manage bug reports, monitor pipeline").version(MUSHI_CLI_VERSION);
-program.command("init").description("Set up the Mushi Mushi SDK in this project (auto-detects framework)").option("--project-id <id>", "Skip the prompt by passing the project ID").option("--api-key <key>", "Skip the prompt by passing the API key").option("--framework <id>", "Force a framework (next, react, vue, nuxt, svelte, sveltekit, angular, expo, react-native, capacitor, vanilla)").option("--skip-install", "Don't auto-install the SDK package \u2014 print the command instead").option("-y, --yes", "Accept detected framework without prompting").option("--cwd <path>", "Run the wizard in a different directory").option("--endpoint <url>", "Override the Mushi API endpoint (self-hosted)").option("--skip-test-report", 'Skip the end-of-wizard "send a test report" prompt').action(async (opts) => {
+var program = new Command().name("mushi").description("Mushi Mushi CLI \u2014 set up the SDK, manage bug reports, monitor pipeline").version(MUSHI_CLI_VERSION).addHelpText("after", `
+Environment variables:
+  MUSHI_API_KEY        Project API key (from Settings \u2192 API Keys in the console)
+  MUSHI_PROJECT_ID     Project UUID    (from the Projects page in the console)
+  MUSHI_API_ENDPOINT   Supabase edge function URL
+                       e.g. https://<ref>.supabase.co/functions/v1/api
+
+Exit codes:
+  0  success
+  1  API / runtime error
+  2  configuration error (missing credentials or endpoint)
+  3  not found (resource does not exist)
+
+Console: https://kensaur.us/mushi-mushi/
+Docs:    https://github.com/kensaurus/mushi-mushi`);
+program.command("init").description("Set up the Mushi Mushi SDK in this project (auto-detects framework)").option("--project-id <id>", "Skip the prompt \u2014 pass UUID from the Projects page").option("--api-key <key>", "Skip the prompt \u2014 pass the API key (CI only)").option("--framework <id>", "Force a framework (next, react, vue, nuxt, svelte, sveltekit, angular, expo, react-native, capacitor, vanilla)").option("--skip-install", "Print the install command instead of running it").option("-y, --yes", "Accept detected framework without prompting").option("--cwd <path>", "Run the wizard in a different directory").option("--endpoint <url>", "Override the Mushi API endpoint (self-hosted)").option("--skip-test-report", 'Skip the end-of-wizard "send a test report" prompt').action(async (opts) => {
   await runInit({
     projectId: opts.projectId,
     apiKey: opts.apiKey,
@@ -936,112 +1245,503 @@ program.command("init").description("Set up the Mushi Mushi SDK in this project
     sendTestReport: opts.skipTestReport ? false : void 0
   });
 });
-program.command("migrate").description(
-  "Suggest the most relevant Mushi Mushi migration guide based on your package.json"
-).option("--cwd <path>", "Run from a different directory").option("--json", "Machine-readable JSON output").action((opts) => {
+program.command("migrate").description("Suggest the most relevant Mushi Mushi migration guide based on your package.json").option("--cwd <path>", "Run from a different directory").option("--json", "Machine-readable JSON output").action((opts) => {
   const { matches } = runMigrate({ cwd: opts.cwd, json: opts.json });
   if (matches.length === 0) process.exit(1);
 });
-program.command("login").description("Store API key for authentication").requiredOption("--api-key <key>", "API key").option("--endpoint <url>", "API endpoint URL").option("--project-id <id>", "Default project ID").action((opts) => {
+program.command("login").description("Save API credentials to ~/.mushirc (mode 0o600)").requiredOption("--api-key <key>", "Mushi API key (mushi_...)").option("--endpoint <url>", "Supabase edge function URL").option("--project-id <id>", "Project UUID (from the Projects page)").addHelpText("after", `
+Examples:
+  mushi login --api-key mushi_xxx --endpoint https://xyz.supabase.co/functions/v1/api
+  mushi login --api-key mushi_xxx --project-id 542b34e0-019e-41fe-b900-7b637717bb86`).action((opts) => {
   const config = loadConfig();
   config.apiKey = opts.apiKey;
   if (opts.endpoint) config.endpoint = assertEndpoint(opts.endpoint);
   if (opts.projectId) config.projectId = opts.projectId;
   saveConfig(config);
-  console.log("Saved credentials to ~/.mushirc (mode 0o600)");
-});
-program.command("status").description("Show project stats").action(async () => {
-  const config = loadConfig();
-  if (!config.apiKey) {
-    console.error("Run `mushi login` first");
-    process.exit(1);
-  }
-  const data = await apiCall("/v1/admin/stats", config);
-  console.log(JSON.stringify(data, null, 2));
+  console.log("\u2713 Credentials saved to ~/.mushirc (mode 0o600)");
+  console.log("  Run 'mushi whoami' to verify the connection.");
 });
-var reports = program.command("reports").description("Manage bug reports");
-reports.command("list").description("List recent reports").option("--limit <n>", "Max results", "20").option("--status <status>", "Filter by status").option("--json", "JSON output").action(async (opts) => {
-  const config = loadConfig();
-  if (!config.apiKey) {
-    console.error("Run `mushi login` first");
-    process.exit(1);
-  }
-  const params = new URLSearchParams();
-  params.set("limit", opts.limit);
-  if (opts.status) params.set("status", opts.status);
-  const data = await apiCall(`/v1/admin/reports?${params}`, config);
+program.command("whoami").description("Verify API key and display project info").option("--json", "Machine-readable JSON output").addHelpText("after", `
+Verifies that MUSHI_API_KEY is valid and shows which project it belongs to.
+Useful after 'mushi login' to confirm credentials are correct.`).action(async (opts) => {
+  const config = requireConfig();
+  const result = await apiCall("/v1/sync/whoami", config);
+  if (!result.ok) die(result);
   if (opts.json) {
-    console.log(JSON.stringify(data, null, 2));
+    console.log(JSON.stringify(result.data, null, 2));
   } else {
-    const reports2 = data.data?.reports ?? [];
-    for (const r of reports2) {
-      console.log(`${r.id}  ${r.severity ?? "unset"}  ${r.status ?? "new"}  ${(r.summary ?? "").slice(0, 60)}`);
-    }
+    const d = result.data;
+    console.log(`\u2713 Authenticated`);
+    console.log(`  Project:  ${d.project_name} (${d.project_id})`);
+    console.log(`  Endpoint: ${config.endpoint}`);
+    console.log(`  Reports:  ${d.stats.total_reports} total \xB7 ${d.stats.open_reports} open`);
   }
 });
-reports.command("show <id>").description("Show report details").action(async (id) => {
-  const config = loadConfig();
-  if (!config.apiKey) {
-    console.error("Run `mushi login` first");
+program.command("ping").description("Check connectivity to the Mushi backend").option("--json", "Machine-readable JSON output").action(async (opts) => {
+  const config = requireConfig();
+  const t0 = Date.now();
+  try {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), API_TIMEOUT_MS);
+    const res = await fetch(`${config.endpoint}/health`, { signal: controller.signal });
+    clearTimeout(timer);
+    const latency = Date.now() - t0;
+    if (opts.json) {
+      console.log(JSON.stringify({ ok: res.ok, status: res.status, latency_ms: latency }));
+    } else {
+      const symbol = res.ok ? "\u2713" : "\u2717";
+      console.log(`${symbol} ${res.ok ? "OK" : "FAIL"} \u2014 ${res.status} (${latency}ms)`);
+      if (!res.ok) process.exit(1);
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (opts.json) {
+      console.log(JSON.stringify({ ok: false, error: msg, latency_ms: Date.now() - t0 }));
+    } else {
+      process.stderr.write(`\u2717 Unreachable: ${msg}
+`);
+    }
     process.exit(1);
   }
-  const data = await apiCall(`/v1/admin/reports/${id}`, config);
-  console.log(JSON.stringify(data, null, 2));
 });
-reports.command("triage <id>").description("Update report status/severity").option("--status <status>", "New status").option("--severity <severity>", "New severity").action(async (id, opts) => {
-  const config = loadConfig();
-  if (!config.apiKey) {
-    console.error("Run `mushi login` first");
-    process.exit(1);
+program.command("status").description("Show project stats: report counts by severity and status").option("--json", "Machine-readable JSON output").action(async (opts) => {
+  const config = requireConfig();
+  const result = await apiCall("/v1/sync/stats", config);
+  if (!result.ok) die(result);
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
   }
-  const body = {};
-  if (opts.status) body.status = opts.status;
-  if (opts.severity) body.severity = opts.severity;
-  const data = await apiCall(`/v1/admin/reports/${id}`, config, { method: "PATCH", body: JSON.stringify(body) });
-  console.log(JSON.stringify(data, null, 2));
+  const d = result.data;
+  console.log(`Project: ${d.project_name}`);
+  console.log("");
+  console.log("Reports by status:");
+  for (const [status, count] of Object.entries(d.by_status)) {
+    console.log(`  ${pad(status, 14)} ${count}`);
+  }
+  console.log("");
+  console.log("Reports by severity:");
+  for (const [severity, count] of Object.entries(d.by_severity)) {
+    console.log(`  ${pad(severity, 14)} ${count}`);
+  }
+  console.log("");
+  console.log(`Fixes:   ${d.fixes_count} total \xB7 ${d.fixes_merged} merged`);
+  console.log(`Lessons: ${d.lessons_count} active rules`);
 });
-program.command("config").description("View or update CLI config").argument("[key]", "Config key to set").argument("[value]", "Value").action((key, value) => {
+program.command("config").description("View or update CLI config (stored in ~/.mushirc)").argument("[key]", "Config key to set: apiKey | endpoint | projectId").argument("[value]", "New value").addHelpText("after", `
+Keys:
+  apiKey     \u2014 Mushi API key (mushi_...)
+  endpoint   \u2014 Supabase edge function URL
+  projectId  \u2014 Project UUID
+
+Examples:
+  mushi config                        # show all config
+  mushi config apiKey mushi_xxx       # set API key
+  mushi config endpoint https://...   # set endpoint
+  mushi config projectId <uuid>       # set project`).action((key, value) => {
   const config = loadConfig();
+  const ALLOWED_KEYS = /* @__PURE__ */ new Set(["apiKey", "endpoint", "projectId"]);
   if (key && value) {
+    if (!ALLOWED_KEYS.has(key)) {
+      process.stderr.write(`error: unknown config key "${key}". Allowed: ${[...ALLOWED_KEYS].join(", ")}
+`);
+      process.exit(2);
+    }
     const safeValue = key === "endpoint" ? assertEndpoint(value) : value;
     config[key] = safeValue;
     saveConfig(config);
-    console.log(`Set ${key} = ${safeValue}`);
+    console.log(`\u2713 Set ${key}`);
   } else {
-    console.log(JSON.stringify(config, null, 2));
+    const safe = { ...config, apiKey: config.apiKey ? `${config.apiKey.slice(0, 10)}\u2026` : void 0 };
+    console.log(JSON.stringify(safe, null, 2));
   }
 });
 var deploy = program.command("deploy").description("Deployment management");
-deploy.command("check").description("Check edge function health").action(async () => {
-  const config = loadConfig();
-  if (!config.apiKey) {
-    console.error("Run `mushi login` first");
-    process.exit(1);
-  }
-  const endpoint = config.endpoint ?? "https://api.mushimushi.dev";
+deploy.command("check").description("Check edge function health and measure latency").option("--json", "Machine-readable JSON output").action(async (opts) => {
+  const config = requireConfig();
+  const t0 = Date.now();
   try {
-    const res = await fetch(`${endpoint}/health`);
-    console.log(`Health: ${res.status === 200 ? "OK" : "FAIL"} (${res.status})`);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), API_TIMEOUT_MS);
+    const res = await fetch(`${config.endpoint}/health`, { signal: controller.signal });
+    clearTimeout(timer);
+    const latency = Date.now() - t0;
+    const body = res.headers.get("content-type")?.includes("json") ? await res.json().catch(() => ({})) : {};
+    if (opts.json) {
+      console.log(JSON.stringify({ ok: res.ok, status: res.status, latency_ms: latency, ...body }));
+    } else {
+      console.log(`Health: ${res.status === 200 ? "OK" : "FAIL"} (${res.status}) \u2014 ${latency}ms`);
+      if (body["version"]) console.log(`  Version: ${body["version"]}`);
+      if (body["region"]) console.log(`  Region:  ${body["region"]}`);
+    }
+    if (!res.ok) process.exit(1);
   } catch (err) {
-    console.error("Failed:", err);
+    const msg = err instanceof Error ? err.message : String(err);
+    if (opts.json) {
+      console.log(JSON.stringify({ ok: false, error: msg }));
+    } else {
+      process.stderr.write(`error: ${msg}
+`);
+    }
+    process.exit(1);
   }
 });
-program.command("index <path>").description("Walk a local repo and upload code chunks to the RAG indexer (non-GitHub fallback for V5.3 \xA72.3.4)").option("--language <lang>", "Limit to one language (ts, tsx, js, py, go, rs)").option("--dry-run", "Show what would be uploaded without sending").action(async (path, opts) => {
-  const config = loadConfig();
-  if (!config.apiKey) {
-    console.error("Run `mushi login` first");
-    process.exit(1);
+var reports = program.command("reports").description("Manage bug reports");
+reports.command("list").description("List recent reports for the current project").option("--limit <n>", "Max results (1\u2013100)", "20").option("--status <status>", "Filter by status: new|triaged|in_progress|resolved|dismissed").option("--severity <severity>", "Filter by severity: critical|high|medium|low").option("--search <query>", "Full-text search in summary and description").option("--json", "Machine-readable JSON output").addHelpText("after", `
+Examples:
+  mushi reports list
+  mushi reports list --status new --severity critical
+  mushi reports list --search "button not working" --limit 5 --json`).action(async (opts) => {
+  const config = requireConfig();
+  const limit = Math.min(Math.max(1, parseInt(opts.limit) || 20), 100);
+  const params = new URLSearchParams({ limit: String(limit) });
+  if (opts.status) params.set("status", opts.status);
+  if (opts.severity) params.set("severity", opts.severity);
+  if (opts.search) params.set("search", opts.search);
+  const result = await apiCall(`/v1/sync/reports?${params}`, config);
+  if (!result.ok) die(result);
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
   }
-  if (!config.projectId) {
-    console.error("Set projectId via `mushi config projectId <id>`");
-    process.exit(1);
+  const rows = result.data.reports;
+  if (rows.length === 0) {
+    console.log("No reports found.");
+    return;
+  }
+  console.log(`${pad("ID", 38)} ${pad("SEV", 9)} ${pad("STATUS", 12)} ${pad("CREATED", 17)} SUMMARY`);
+  console.log("\u2500".repeat(110));
+  for (const r of rows) {
+    const sev = r.severity ?? "unset";
+    const status = r.status ?? "new";
+    const summary = (r.summary ?? r.description ?? "").slice(0, 50);
+    console.log(`${pad(r.id, 38)} ${pad(sev, 9)} ${pad(status, 12)} ${pad(fmtDate(r.created_at), 17)} ${summary}`);
+  }
+  if (result.data.total > rows.length) {
+    console.log(`
+  \u2026 ${result.data.total - rows.length} more. Use --limit to see more.`);
+  }
+});
+reports.command("show <id>").description("Show full details for a single report").option("--json", "Machine-readable JSON output").action(async (id, opts) => {
+  const config = requireConfig();
+  const result = await apiCall(`/v1/sync/reports/${id}`, config);
+  if (!result.ok) {
+    if (result.httpStatus === 404 || result.error.code === "NOT_FOUND") {
+      process.stderr.write(`error: report "${id}" not found
+`);
+      process.exit(3);
+    }
+    die(result);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
+  }
+  const r = result.data;
+  console.log(`Report: ${r.id}`);
+  console.log(`  Status:   ${r.status ?? "new"}`);
+  console.log(`  Severity: ${r.severity ?? "unset"}`);
+  console.log(`  Category: ${r.category ?? "\u2014"}`);
+  console.log(`  Created:  ${fmtDate(r.created_at)}`);
+  if (r.summary) console.log(`  Summary:  ${r.summary}`);
+  if (r.description) {
+    console.log(`  Description:`);
+    console.log(`    ${r.description.replace(/\n/g, "\n    ")}`);
+  }
+  if (r.environment?.url) console.log(`  URL:      ${r.environment.url}`);
+  if (r.component) console.log(`  Component: ${r.component}`);
+  if (r.sentry_event_id) console.log(`  Sentry:   ${r.sentry_event_id}`);
+  if (r.fix_id) console.log(`  Fix:      ${r.fix_id}`);
+  if (r.tags && Object.keys(r.tags).length > 0) {
+    console.log(`  Tags:     ${JSON.stringify(r.tags)}`);
+  }
+});
+reports.command("triage <id>").description("Update the status and/or severity of a report").option("--status <status>", "New status: new|triaged|in_progress|resolved|dismissed").option("--severity <severity>", "New severity: critical|high|medium|low").option("--note <text>", "Internal triage note").option("--json", "Machine-readable JSON output").addHelpText("after", `
+Examples:
+  mushi reports triage <id> --status triaged --severity high
+  mushi reports triage <id> --status in_progress --note "assigned to @alice"`).action(async (id, opts) => {
+  const config = requireConfig();
+  const body = {};
+  if (opts.status) body["status"] = opts.status;
+  if (opts.severity) body["severity"] = opts.severity;
+  if (opts.note) body["note"] = opts.note;
+  if (Object.keys(body).length === 0) {
+    process.stderr.write("error: provide at least one of --status, --severity, or --note\n");
+    process.exit(2);
+  }
+  const result = await apiCall(`/v1/sync/reports/${id}`, config, {
+    method: "PATCH",
+    body: JSON.stringify(body)
+  });
+  if (!result.ok) {
+    if (result.httpStatus === 404 || result.error.code === "NOT_FOUND") {
+      process.stderr.write(`error: report "${id}" not found
+`);
+      process.exit(3);
+    }
+    die(result);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+  } else {
+    console.log(`\u2713 Updated report ${id}`);
+    if (opts.status) console.log(`  Status:   ${opts.status}`);
+    if (opts.severity) console.log(`  Severity: ${opts.severity}`);
+    if (opts.note) console.log(`  Note:     ${opts.note}`);
+  }
+});
+reports.command("resolve <id>").description("Mark a report as resolved (shorthand for triage --status resolved)").option("--note <text>", "Resolution note").option("--json", "Machine-readable JSON output").action(async (id, opts) => {
+  const config = requireConfig();
+  const body = { status: "resolved" };
+  if (opts.note) body["note"] = opts.note;
+  const result = await apiCall(`/v1/sync/reports/${id}`, config, {
+    method: "PATCH",
+    body: JSON.stringify(body)
+  });
+  if (!result.ok) {
+    if (result.httpStatus === 404 || result.error.code === "NOT_FOUND") {
+      process.stderr.write(`error: report "${id}" not found
+`);
+      process.exit(3);
+    }
+    die(result);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+  } else {
+    console.log(`\u2713 Resolved report ${id}`);
+    if (opts.note) console.log(`  Note: ${opts.note}`);
+  }
+});
+reports.command("reopen <id>").description("Reopen a resolved or dismissed report").option("--note <text>", "Note explaining the reopen").option("--json", "Machine-readable JSON output").action(async (id, opts) => {
+  const config = requireConfig();
+  const body = { status: "new" };
+  if (opts.note) body["note"] = opts.note;
+  const result = await apiCall(`/v1/sync/reports/${id}`, config, {
+    method: "PATCH",
+    body: JSON.stringify(body)
+  });
+  if (!result.ok) {
+    if (result.httpStatus === 404 || result.error.code === "NOT_FOUND") {
+      process.stderr.write(`error: report "${id}" not found
+`);
+      process.exit(3);
+    }
+    die(result);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+  } else {
+    console.log(`\u2713 Reopened report ${id}`);
+  }
+});
+reports.command("dismiss <id>").description("Dismiss a report (not a real bug / out of scope)").option("--note <text>", "Reason for dismissal").option("--json", "Machine-readable JSON output").action(async (id, opts) => {
+  const config = requireConfig();
+  const body = { status: "dismissed" };
+  if (opts.note) body["note"] = opts.note;
+  const result = await apiCall(`/v1/sync/reports/${id}`, config, {
+    method: "PATCH",
+    body: JSON.stringify(body)
+  });
+  if (!result.ok) {
+    if (result.httpStatus === 404 || result.error.code === "NOT_FOUND") {
+      process.stderr.write(`error: report "${id}" not found
+`);
+      process.exit(3);
+    }
+    die(result);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+  } else {
+    console.log(`\u2713 Dismissed report ${id}`);
+  }
+});
+reports.command("search <query>").description("Search reports by keyword in summary and description").option("--limit <n>", "Max results (1\u201350)", "10").option("--status <status>", "Filter by status").option("--json", "Machine-readable JSON output").addHelpText("after", `
+Examples:
+  mushi reports search "login button"
+  mushi reports search "404 error" --status new --limit 20`).action(async (query, opts) => {
+  const config = requireConfig();
+  const limit = Math.min(Math.max(1, parseInt(opts.limit) || 10), 50);
+  const params = new URLSearchParams({ search: query, limit: String(limit) });
+  if (opts.status) params.set("status", opts.status);
+  const result = await apiCall(`/v1/sync/reports?${params}`, config);
+  if (!result.ok) die(result);
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
+  }
+  const rows = result.data.reports;
+  if (rows.length === 0) {
+    console.log(`No reports matching "${query}".`);
+    return;
+  }
+  console.log(`${rows.length} result${rows.length === 1 ? "" : "s"} for "${query}":`);
+  console.log("");
+  for (const r of rows) {
+    console.log(`  ${r.id}`);
+    console.log(`    ${r.severity ?? "unset"} \xB7 ${r.status ?? "new"} \xB7 ${fmtDate(r.created_at)}`);
+    const text2 = r.summary ?? r.description ?? "";
+    if (text2) console.log(`    ${text2.slice(0, 80)}`);
+    console.log("");
+  }
+});
+var lessons = program.command("lessons").description("Manage learned mistake rules");
+lessons.command("list").description("List active lessons (mistake rules) for the current project").option("--severity <sev>", "Filter: info|warn|critical").option("--limit <n>", "Max results (1\u2013200)", "50").option("--json", "Machine-readable JSON output").addHelpText("after", `
+Lessons are mistake rules extracted from past bug reports by the clustering
+pipeline. They are injected into AI code-review context via the MCP server.`).action(async (opts) => {
+  const config = requireConfig();
+  const limit = Math.min(Math.max(1, parseInt(opts.limit) || 50), 200);
+  const params = new URLSearchParams({ limit: String(limit) });
+  if (opts.severity) params.set("severity", opts.severity);
+  const result = await apiCall(`/v1/sync/lessons?${params}`, config);
+  if (!result.ok) die(result);
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
+  }
+  const rows = result.data;
+  if (!Array.isArray(rows) || rows.length === 0) {
+    console.log("No active lessons yet. Reports are clustered nightly.");
+    return;
+  }
+  console.log(`${pad("SEV", 9)} ${pad("FREQ", 6)} RULE`);
+  console.log("\u2500".repeat(90));
+  for (const l of rows) {
+    const sev = l.severity ?? "info";
+    const freq = String(l.frequency ?? 0);
+    const rule = (l.rule_text ?? "").slice(0, 70);
+    console.log(`${pad(sev, 9)} ${pad(freq, 6)} ${rule}`);
+  }
+  console.log(`
+  ${rows.length} active lesson${rows.length === 1 ? "" : "s"}`);
+});
+lessons.command("show <id>").description("Show full detail for a single lesson (rule text, anti-pattern, source reports)").option("--json", "Machine-readable JSON output").action(async (id, opts) => {
+  const config = requireConfig();
+  const result = await apiCall(`/v1/sync/lessons/${id}`, config);
+  if (!result.ok) {
+    if (result.httpStatus === 404 || result.error.code === "NOT_FOUND") {
+      process.stderr.write(`error: lesson "${id}" not found
+`);
+      process.exit(3);
+    }
+    die(result);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
+  }
+  const l = result.data;
+  console.log(`Lesson: ${l.id}`);
+  console.log(`  Severity:  ${l.severity}`);
+  console.log(`  Frequency: ${l.frequency} reports`);
+  if (l.last_reinforced_at) console.log(`  Updated:   ${fmtDate(l.last_reinforced_at)}`);
+  console.log("");
+  console.log(`Rule:`);
+  console.log(`  ${l.rule_text}`);
+  if (l.anti_pattern) {
+    console.log("");
+    console.log(`Anti-pattern:`);
+    console.log(`  ${l.anti_pattern}`);
+  }
+  if (l.summary_paragraph) {
+    console.log("");
+    console.log(`Summary:`);
+    console.log(`  ${l.summary_paragraph}`);
+  }
+});
+program.command("sync-lessons").description("Pull promoted lessons from Mushi and write .mushi/lessons.json into this repo").option("--cwd <path>", "Target directory (default: current working dir)").option("--dry-run", "Print the JSON that would be written without writing anything").option("--json", "Machine-readable output: { ok, path, count }").addHelpText("after", `
+Used in CI to keep .mushi/lessons.json up to date so the Mushi MCP server
+and Cursor rules can inject the latest project-specific mistake rules into
+AI code review context.
+
+Typical CI usage:
+  MUSHI_API_KEY=$KEY MUSHI_PROJECT_ID=$PID MUSHI_API_ENDPOINT=$URL \\
+    npx @mushi-mushi/cli sync-lessons --cwd .`).action(async (opts) => {
+  const { writeFile, mkdir } = await import("fs/promises");
+  const nodePath = await import("path");
+  const config = requireConfig();
+  const cwd = opts.cwd ?? process.cwd();
+  const target = nodePath.join(cwd, ".mushi", "lessons.json");
+  const result = await apiCall("/v1/sync/lessons?limit=500", config);
+  if (!result.ok) die(result);
+  const rows = Array.isArray(result.data) ? result.data : [];
+  const lessons2 = rows.map((l) => ({
+    id: l.id,
+    rule: l.rule_text,
+    anti_pattern: l.anti_pattern ?? void 0,
+    severity: l.severity,
+    frequency: l.frequency,
+    last_reinforced: l.last_reinforced_at?.slice(0, 10) ?? "",
+    cluster_id: l.cluster_id ?? void 0
+  }));
+  const output = {
+    schema_version: "1",
+    project_id: config.projectId ?? "",
+    generated_at: (/* @__PURE__ */ new Date()).toISOString(),
+    lessons: lessons2
+  };
+  if (opts.dryRun) {
+    console.log(JSON.stringify(output, null, 2));
+    return;
+  }
+  await mkdir(nodePath.dirname(target), { recursive: true });
+  await writeFile(target, JSON.stringify(output, null, 2) + "\n", "utf8");
+  if (opts.json) {
+    console.log(JSON.stringify({ ok: true, path: target, count: lessons2.length }));
+  } else {
+    console.log(`\u2713 Wrote ${lessons2.length} lesson${lessons2.length === 1 ? "" : "s"} to ${target}`);
+  }
+});
+program.command("test").description("Submit a synthetic test report to verify the ingestion pipeline end-to-end").option("--json", "Machine-readable JSON output").action(async (opts) => {
+  const config = requireConfig();
+  const result = await apiCall("/v1/reports", config, {
+    method: "POST",
+    body: JSON.stringify({
+      projectId: config.projectId,
+      description: "CLI test report \u2014 verifying ingestion pipeline",
+      category: "other",
+      reporterToken: `cli-test-${Date.now()}`,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      environment: {
+        url: "cli://test",
+        userAgent: `mushi-cli/${MUSHI_CLI_VERSION}`,
+        platform: process.platform,
+        language: "en",
+        viewport: { width: 0, height: 0 },
+        referrer: "",
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        timezone: Intl.DateTimeFormat().resolvedOptions().timeZone
+      }
+    })
+  });
+  if (!result.ok) die(result);
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+  } else {
+    const d = result.data;
+    console.log(`\u2713 Test report submitted`);
+    console.log(`  ID:     ${d.reportId}`);
+    console.log(`  Status: ${d.status}`);
+    console.log(`  View:   https://kensaur.us/mushi-mushi/reports/${d.reportId}`);
   }
-  const { readdir, readFile, stat } = await import("fs/promises");
+});
+program.command("index <path>").description("Walk a local repo and upload code chunks to the Mushi RAG indexer").option("--language <lang>", "Limit to one language: ts, tsx, js, py, go, rs").option("--dry-run", "Show what would be uploaded without sending").option("--json", "Machine-readable summary: { files, bytes }").addHelpText("after", `
+Uploads source code into the Mushi vector index so the fix-worker can
+retrieve relevant context when generating patches. Only needed for private
+repos that cannot be auto-indexed via GitHub App.
+
+Examples:
+  mushi index ./src
+  mushi index ./src --language ts --dry-run`).action(async (path, opts) => {
+  const config = requireConfig({ needsProject: true });
+  const { readdir: readdir2, readFile: readFile2, stat } = await import("fs/promises");
   const nodePath = await import("path");
   const SKIP = /node_modules|\.git|dist|build|\.next|\.turbo|coverage/;
   const EXTS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".py", ".go", ".rs"]);
+  const MAX_FILE_BYTES = 5e5;
   async function* walk(dir) {
-    const entries = await readdir(dir, { withFileTypes: true });
+    const entries = await readdir2(dir, { withFileTypes: true });
     for (const e of entries) {
       const full = nodePath.join(dir, e.name);
       if (SKIP.test(full)) continue;
@@ -1051,60 +1751,60 @@ program.command("index <path>").description("Walk a local repo and upload code c
   }
   let count = 0;
   let bytes = 0;
+  let errors = 0;
   const root = nodePath.resolve(path);
   for await (const file of walk(root)) {
     const lang = nodePath.extname(file).slice(1);
     if (opts.language && opts.language !== lang) continue;
     const stats = await stat(file);
-    if (stats.size > 5e5) continue;
-    const source = await readFile(file, "utf8");
-    const relative = nodePath.relative(root, file).replaceAll("\\", "/");
+    if (stats.size > MAX_FILE_BYTES) {
+      if (!opts.json) process.stdout.write(`  skip  ${nodePath.relative(root, file)} (>${MAX_FILE_BYTES / 1e3}KB)
+`);
+      continue;
+    }
+    const source = await readFile2(file, "utf8");
+    const relative2 = nodePath.relative(root, file).replaceAll("\\", "/");
     count++;
     bytes += source.length;
     if (opts.dryRun) {
-      console.log(`  ${relative} (${source.length} bytes)`);
+      if (!opts.json) process.stdout.write(`  ${relative2} (${source.length} bytes)
+`);
       continue;
     }
-    const res = await apiCall("/v1/admin/codebase/upload", config, {
+    const result = await apiCall("/v1/sync/codebase/upload", config, {
       method: "POST",
-      body: JSON.stringify({
-        projectId: config.projectId,
-        filePath: relative,
-        source
-      })
+      body: JSON.stringify({ projectId: config.projectId, filePath: relative2, source })
     });
-    if (!res.ok) console.error(`  FAIL ${relative}: ${res.error ?? "unknown"}`);
-    else process.stdout.write(`  ${relative} \u2192 ${res.chunks ?? 0} chunks
+    if (!result.ok) {
+      errors++;
+      process.stderr.write(`  FAIL  ${relative2}: ${result.error.message}
 `);
+    } else if (!opts.json) {
+      process.stdout.write(`  ok    ${relative2} \u2192 ${result.data.chunks} chunks
+`);
+    }
   }
-  console.log(`Indexed ${count} files (${(bytes / 1024).toFixed(1)} KB) into project ${config.projectId}`);
-});
-program.command("test").description("Submit a test report to verify pipeline").action(async () => {
-  const config = loadConfig();
-  if (!config.apiKey) {
-    console.error("Run `mushi login` first");
-    process.exit(1);
+  if (opts.json) {
+    console.log(JSON.stringify({ ok: errors === 0, files: count, bytes, errors }));
+  } else {
+    const kb = (bytes / 1024).toFixed(1);
+    console.log(`
+Indexed ${count} files (${kb} KB) into project ${config.projectId}${errors ? ` \u2014 ${errors} failed` : ""}`);
   }
-  const data = await apiCall("/v1/reports", config, {
-    method: "POST",
-    body: JSON.stringify({
-      projectId: config.projectId,
-      description: "CLI test report \u2014 verifying pipeline",
-      category: "other",
-      reporterToken: `cli-test-${Date.now()}`,
-      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      environment: {
-        url: "cli://test",
-        userAgent: "mushi-cli",
-        platform: process.platform,
-        language: "en",
-        viewport: { width: 0, height: 0 },
-        referrer: "",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        timezone: Intl.DateTimeFormat().resolvedOptions().timeZone
-      }
-    })
+  if (errors > 0) process.exit(1);
+});
+var sourcemaps = program.command("sourcemaps").description("Source map management");
+sourcemaps.command("upload").description("Upload source maps to Mushi (idempotent, SHA256-keyed) for stack trace symbolication").requiredOption("--release <version>", "Release identifier, e.g. 1.0.0 or a git SHA").option("--dir <path>", "Directory containing .map files", "./dist").option("--dry-run", "List files that would be uploaded without uploading").option("-e, --endpoint <url>", "API endpoint (overrides MUSHI_API_ENDPOINT)").option("--api-key <key>", "API key (overrides MUSHI_API_KEY)").option("--silent", "Suppress progress output").addHelpText("after", `
+Examples:
+  mushi sourcemaps upload --release 1.0.0
+  mushi sourcemaps upload --release $(git rev-parse --short HEAD) --dir ./dist`).action(async (opts) => {
+  await runSourcemapsUpload({
+    release: opts.release,
+    dir: opts.dir,
+    dryRun: opts.dryRun,
+    endpoint: opts.endpoint,
+    apiKey: opts.apiKey,
+    silent: opts.silent
   });
-  console.log("Test report submitted:", JSON.stringify(data, null, 2));
 });
 program.parse();