@mushi-mushi/cli 0.7.0 → 0.10.0

package/dist/index.js

@@ -4,24 +4,79 @@
 import { Command } from "commander";
 
 // src/config.ts
-import { chmodSync, readFileSync, statSync, writeFileSync, existsSync } from "fs";
-import { join } from "path";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
 import { homedir } from "os";
-var CONFIG_PATH = join(homedir(), ".mushirc");
+import { dirname, join } from "path";
 var SECURE_FILE_MODE = 384;
+var SECURE_DIR_MODE = 448;
+function resolveXdgConfigPath() {
+  const xdg = process.env["XDG_CONFIG_HOME"];
+  if (xdg && xdg.length > 0) {
+    return join(xdg, "mushi", "config.json");
+  }
+  if (process.platform === "win32") {
+    const appData = process.env["APPDATA"];
+    if (appData && appData.length > 0) {
+      return join(appData, "mushi", "config.json");
+    }
+  }
+  return join(homedir(), ".config", "mushi", "config.json");
+}
+var LEGACY_CONFIG_PATH = join(homedir(), ".mushirc");
+var CONFIG_PATH = resolveXdgConfigPath();
 function loadConfig(path = CONFIG_PATH) {
-  if (!existsSync(path)) return {};
-  tightenPermissions(path);
-  try {
-    return JSON.parse(readFileSync(path, "utf-8"));
-  } catch {
-    return {};
+  let file = {};
+  if (existsSync(path)) {
+    tightenPermissions(path);
+    try {
+      file = JSON.parse(readFileSync(path, "utf-8"));
+    } catch {
+    }
+  } else if (path === CONFIG_PATH && existsSync(LEGACY_CONFIG_PATH)) {
+    file = migrateLegacyConfig() ?? {};
   }
+  const fromEnv = {
+    ...process.env["MUSHI_API_KEY"] ? { apiKey: process.env["MUSHI_API_KEY"] } : {},
+    ...process.env["MUSHI_PROJECT_ID"] ? { projectId: process.env["MUSHI_PROJECT_ID"] } : {},
+    ...process.env["MUSHI_API_ENDPOINT"] ? { endpoint: process.env["MUSHI_API_ENDPOINT"] } : {}
+  };
+  return { ...file, ...fromEnv };
 }
 function saveConfig(config, path = CONFIG_PATH) {
+  const dir = dirname(path);
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true, mode: SECURE_DIR_MODE });
+  } else {
+    tightenDirPermissions(dir);
+  }
   writeFileSync(path, JSON.stringify(config, null, 2), { mode: SECURE_FILE_MODE });
   tightenPermissions(path);
 }
+function migrateLegacyConfig(legacyPath = LEGACY_CONFIG_PATH, destPath = CONFIG_PATH) {
+  if (!existsSync(legacyPath)) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(legacyPath, "utf-8"));
+  } catch {
+    return null;
+  }
+  const dir = dirname(destPath);
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true, mode: SECURE_DIR_MODE });
+  }
+  try {
+    renameSync(legacyPath, destPath);
+  } catch {
+    writeFileSync(destPath, JSON.stringify(parsed, null, 2), { mode: SECURE_FILE_MODE });
+    try {
+      unlinkSync(legacyPath);
+    } catch {
+    }
+  }
+  tightenPermissions(destPath);
+  tightenDirPermissions(dir);
+  return parsed;
+}
 function tightenPermissions(path) {
   if (process.platform === "win32") return;
   try {
@@ -30,6 +85,14 @@ function tightenPermissions(path) {
   } catch {
   }
 }
+function tightenDirPermissions(path) {
+  if (process.platform === "win32") return;
+  try {
+    const current = statSync(path).mode & 511;
+    if (current !== SECURE_DIR_MODE) chmodSync(path, SECURE_DIR_MODE);
+  } catch {
+  }
+}
 
 // src/init.ts
 import * as p from "@clack/prompts";
@@ -361,7 +424,7 @@ function parse(version) {
 
 // src/monorepo.ts
 import { existsSync as existsSync3, readFileSync as readFileSync3, readdirSync, statSync as statSync2 } from "fs";
-import { dirname, join as join3, resolve } from "path";
+import { dirname as dirname2, join as join3, resolve } from "path";
 var WORKSPACE_GLOB_CANDIDATES = ["apps/*", "packages/*", "examples/*"];
 var FRAMEWORK_DEPS = {
   next: "Next.js",
@@ -389,7 +452,7 @@ function findWorkspaceRoot(start) {
   let dir = resolve(start);
   for (let i = 0; i < 8; i++) {
     if (isWorkspaceRoot(dir)) return dir;
-    const parent = dirname(dir);
+    const parent = dirname2(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -457,11 +520,11 @@ function getFrameworkFromPkg(pkg) {
 }
 
 // src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.7.0" : "0.0.0-dev";
+var MUSHI_CLI_VERSION = true ? "0.10.0" : "0.0.0-dev";
 
 // src/init.ts
 var ENV_FILES = [".env.local", ".env"];
-var PROJECT_ID_PATTERN = /^proj_[A-Za-z0-9_-]{10,}$/;
+var PROJECT_ID_PATTERN = /^(?:proj_[A-Za-z0-9_-]{10,}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
 var API_KEY_PATTERN = /^mushi_[A-Za-z0-9_-]{10,}$/;
 async function runInit(options = {}) {
   const cwd = options.cwd ?? process.cwd();
@@ -506,7 +569,7 @@ function ensureInteractiveOrBailOut(options) {
   );
   if (hasAllFlags) return;
   process.stderr.write(
-    "mushi-mushi: non-interactive terminal detected.\nPass all of --yes (or --framework), --project-id, and --api-key to run unattended.\nExample: npx mushi-mushi --yes --project-id proj_xxx --api-key mushi_xxx\n"
+    "mushi-mushi: non-interactive terminal detected.\nPass all of --yes (or --framework), --project-id, and --api-key to run unattended.\nExample: npx mushi-mushi --yes --project-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx --api-key mushi_xxx\nYour project ID is the UUID shown in the Projects page of the Mushi admin console.\n"
   );
   process.exit(1);
 }
@@ -540,21 +603,22 @@ async function collectCredentials(options) {
   const existing = loadConfig();
   const rawProjectId = options.projectId ?? existing.projectId ?? await promptText({
     message: "Project ID",
-    placeholder: "proj_xxxxxxxxxxxx",
-    hint: "Find this at https://kensaur.us/mushi-mushi/projects",
-    validate: (v) => PROJECT_ID_PATTERN.test(v) ? void 0 : "Expected format: proj_ followed by 10+ alphanumeric characters"
+    placeholder: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
+    hint: "Where to find it: https://kensaur.us/mushi-mushi/projects \u2192 click your project \u2192 copy the UUID below the project name.",
+    validate: (v) => PROJECT_ID_PATTERN.test(v) ? void 0 : "Expected a UUID (xxxxxxxx-xxxx-...) \u2014 copy it from the Mushi admin console Projects page."
   });
   const rawApiKey = options.apiKey ?? existing.apiKey ?? await promptText({
     message: "API key",
     placeholder: "mushi_xxxxxxxxxxxx",
-    hint: "Treat this like a password \u2014 it goes in your env file, not in source.",
+    hint: "Where to find it: https://kensaur.us/mushi-mushi/settings \u2192 API Keys tab. Treat it like a password \u2014 env file only, never commit it.",
     validate: (v) => API_KEY_PATTERN.test(v) ? void 0 : "Expected format: mushi_ followed by 10+ alphanumeric characters"
   });
   const projectId = sanitizeSecret(rawProjectId);
   const apiKey = sanitizeSecret(rawApiKey);
   if (!PROJECT_ID_PATTERN.test(projectId)) {
     throw new Error(
-      `Invalid project ID. Expected format: proj_[A-Za-z0-9_-]{10,}. Got: ${redact(projectId)}`
+      `Invalid project ID. Got: ${redact(projectId)}
+Expected a UUID (e.g. 542b34e0-019e-41fe-b900-7b637717bb86) \u2014 copy it from the Projects page in the Mushi console at https://kensaur.us/mushi-mushi/projects`
     );
   }
   if (!API_KEY_PATTERN.test(apiKey)) {
@@ -572,6 +636,7 @@ function redact(value) {
   return `${value.slice(0, 4)}\u2026${value.slice(-2)}`;
 }
 async function promptText(opts) {
+  if (opts.hint) p.log.info(opts.hint);
   const value = await p.text({
     message: opts.message,
     placeholder: opts.placeholder,
@@ -588,7 +653,6 @@ async function promptText(opts) {
     p.cancel("Aborted.");
     process.exit(0);
   }
-  if (opts.hint) p.log.info(opts.hint);
   return value;
 }
 async function installPackages(pm, packages, cwd) {
@@ -1089,28 +1153,225 @@ async function runSourcemapsUpload(opts) {
   if (failed > 0) process.exit(1);
 }
 
+// src/errors.ts
+var EXIT_CODE_MAP = {
+  E_AUTH_MISSING: 2,
+  E_AUTH_INVALID: 2,
+  E_PROJECT_MISSING: 2,
+  E_ENDPOINT_INVALID: 2,
+  E_INVALID_INPUT: 2,
+  E_NOT_INTERACTIVE: 2,
+  E_NETWORK: 3,
+  E_TIMEOUT: 3,
+  E_API_ERROR: 3,
+  E_RATE_LIMITED: 3,
+  E_FILE_NOT_FOUND: 1,
+  E_FILE_PERMISSION: 1,
+  E_FRESHNESS_STALE: 1,
+  E_INTERRUPTED: 130,
+  // 128 + SIGINT (2). POSIX convention.
+  E_INTERNAL: 1
+};
+var MushiCliError = class extends Error {
+  code;
+  hint;
+  cause;
+  constructor(code, message, hint, cause) {
+    super(message);
+    this.name = "MushiCliError";
+    this.code = code;
+    if (hint) this.hint = hint;
+    if (cause !== void 0) this.cause = cause;
+  }
+  /** Exit code POSIX-aware shell scripts should branch on. */
+  get exitCode() {
+    return EXIT_CODE_MAP[this.code];
+  }
+  /**
+   * Format for `--json` output. Used by the JSON writer when a CLI
+   * subcommand was invoked with `--json` and an error escapes.
+   */
+  toJSON() {
+    return {
+      error: {
+        code: this.code,
+        message: this.message,
+        ...this.hint ? { hint: this.hint } : {}
+      }
+    };
+  }
+};
+
+// src/signals.ts
+var installed = false;
+var activeController = null;
+function installSignalHandlers() {
+  if (installed) return;
+  installed = true;
+  const abortAndExit = (signal) => {
+    activeController?.abort(
+      new MushiCliError(
+        "E_INTERRUPTED",
+        `aborted by ${signal}`,
+        "partial state on the server is safe to retry \u2014 re-run the same command"
+      )
+    );
+    const code = signal === "SIGINT" ? 130 : signal === "SIGTERM" ? 143 : 1;
+    process.nextTick(() => {
+      process.exit(code);
+    });
+  };
+  process.on("SIGINT", () => abortAndExit("SIGINT"));
+  process.on("SIGTERM", () => abortAndExit("SIGTERM"));
+}
+function getAbortSignal(external) {
+  if (external) return external.signal;
+  if (!activeController || activeController.signal.aborted) {
+    activeController = new AbortController();
+  }
+  return activeController.signal;
+}
+
 // src/index.ts
+installSignalHandlers();
+var API_TIMEOUT_MS = 15e3;
 async function apiCall(path, config, options = {}) {
   const endpoint = config.endpoint;
   if (!endpoint) {
-    throw new Error(
-      "No API endpoint configured. Run `mushi init` or set MUSHI_API_ENDPOINT. Set endpoint to your Supabase edge function URL, e.g. https://xyz.supabase.co/functions/v1/api"
-    );
+    return {
+      ok: false,
+      error: {
+        code: "NO_ENDPOINT",
+        message: "No API endpoint configured.\n  Run: mushi login --api-key <key> --endpoint <url> --project-id <id>\n  Or:  export MUSHI_API_ENDPOINT=https://<project-ref>.supabase.co/functions/v1/api"
+      }
+    };
   }
-  const res = await fetch(`${endpoint}${path}`, {
-    ...options,
-    headers: {
-      "Content-Type": "application/json",
-      "Authorization": `Bearer ${config.apiKey}`,
-      "X-Mushi-Api-Key": config.apiKey ?? "",
-      "X-Mushi-Project": config.projectId ?? "",
-      ...options.headers
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), API_TIMEOUT_MS);
+  const signals = [controller.signal, getAbortSignal()];
+  const compositeSignal = AbortSignal.any ? AbortSignal.any(signals) : controller.signal;
+  try {
+    const res = await fetch(`${endpoint}${path}`, {
+      ...options,
+      signal: compositeSignal,
+      headers: {
+        "Content-Type": "application/json",
+        // `apiKeyAuth` reads X-Mushi-Api-Key; the Authorization header is a
+        // fallback accepted by some older middleware. Both are sent.
+        "Authorization": `Bearer ${config.apiKey ?? ""}`,
+        "X-Mushi-Api-Key": config.apiKey ?? "",
+        "X-Mushi-Project": config.projectId ?? "",
+        "X-Mushi-Cli-Version": MUSHI_CLI_VERSION,
+        ...options.headers
+      }
+    });
+    clearTimeout(timer);
+    let body;
+    const contentType = res.headers.get("content-type") ?? "";
+    if (contentType.includes("application/json")) {
+      try {
+        body = await res.json();
+      } catch {
+        body = null;
+      }
+    } else {
+      const text2 = await res.text();
+      try {
+        body = JSON.parse(text2);
+      } catch {
+        body = {
+          ok: false,
+          error: {
+            code: `HTTP_${res.status}`,
+            message: text2.trim().slice(0, 300) || `HTTP ${res.status}`
+          }
+        };
+      }
     }
-  });
-  return res.json();
+    if (!res.ok && typeof body === "object" && body !== null && !("ok" in body)) {
+      const b = body;
+      return {
+        ok: false,
+        httpStatus: res.status,
+        error: {
+          code: b["code"] ?? `HTTP_${res.status}`,
+          message: b["message"] ?? `Request failed (${res.status})`
+        }
+      };
+    }
+    return body;
+  } catch (err) {
+    clearTimeout(timer);
+    if (err instanceof Error && err.name === "AbortError") {
+      return {
+        ok: false,
+        error: {
+          code: "TIMEOUT",
+          message: `Request timed out after ${API_TIMEOUT_MS / 1e3}s. Check your network or endpoint.`
+        }
+      };
+    }
+    return {
+      ok: false,
+      error: {
+        code: "NETWORK_ERROR",
+        message: err instanceof Error ? err.message : String(err)
+      }
+    };
+  }
 }
-var program = new Command().name("mushi").description("Mushi Mushi CLI \u2014 set up the SDK, manage bug reports, monitor pipeline").version(MUSHI_CLI_VERSION);
-program.command("init").description("Set up the Mushi Mushi SDK in this project (auto-detects framework)").option("--project-id <id>", "Skip the prompt by passing the project ID").option("--api-key <key>", "Skip the prompt by passing the API key").option("--framework <id>", "Force a framework (next, react, vue, nuxt, svelte, sveltekit, angular, expo, react-native, capacitor, vanilla)").option("--skip-install", "Don't auto-install the SDK package \u2014 print the command instead").option("-y, --yes", "Accept detected framework without prompting").option("--cwd <path>", "Run the wizard in a different directory").option("--endpoint <url>", "Override the Mushi API endpoint (self-hosted)").option("--skip-test-report", 'Skip the end-of-wizard "send a test report" prompt').action(async (opts) => {
+function die(result, exitCode = 1) {
+  const { code, message } = result.error;
+  const status = result.httpStatus ? ` [${result.httpStatus}]` : "";
+  process.stderr.write(`error${status}: ${code} \u2014 ${message}
+`);
+  process.exit(exitCode);
+}
+function requireConfig(opts = {}) {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    process.stderr.write(
+      "error: API key not configured.\n  Run:  mushi login --api-key <key> --endpoint <url>\n  Or:   export MUSHI_API_KEY=<key>\n"
+    );
+    process.exit(2);
+  }
+  if (!config.endpoint) {
+    process.stderr.write(
+      "error: API endpoint not configured.\n  Run:  mushi login --endpoint https://<ref>.supabase.co/functions/v1/api\n  Or:   export MUSHI_API_ENDPOINT=<url>\n"
+    );
+    process.exit(2);
+  }
+  if (opts.needsProject && !config.projectId) {
+    process.stderr.write(
+      "error: Project ID not configured.\n  Run:  mushi login --project-id <uuid>\n  Or:   export MUSHI_PROJECT_ID=<uuid>\n  Find your project ID: https://kensaur.us/mushi-mushi/projects\n"
+    );
+    process.exit(2);
+  }
+  return config;
+}
+function fmtDate(iso) {
+  if (!iso) return "\u2014";
+  return new Date(iso).toLocaleString(void 0, { dateStyle: "short", timeStyle: "short" });
+}
+function pad(s, width) {
+  return s.length >= width ? s : s + " ".repeat(width - s.length);
+}
+var program = new Command().name("mushi").description("Mushi Mushi CLI \u2014 set up the SDK, manage bug reports, monitor pipeline").version(MUSHI_CLI_VERSION).addHelpText("after", `
+Environment variables:
+  MUSHI_API_KEY        Project API key (from Settings \u2192 API Keys in the console)
+  MUSHI_PROJECT_ID     Project UUID    (from the Projects page in the console)
+  MUSHI_API_ENDPOINT   Supabase edge function URL
+                       e.g. https://<ref>.supabase.co/functions/v1/api
+
+Exit codes:
+  0  success
+  1  API / runtime error
+  2  configuration error (missing credentials or endpoint)
+  3  not found (resource does not exist)
+
+Console: https://kensaur.us/mushi-mushi/
+Docs:    https://github.com/kensaurus/mushi-mushi`);
+program.command("init").description("Set up the Mushi Mushi SDK in this project (auto-detects framework)").option("--project-id <id>", "Skip the prompt \u2014 pass UUID from the Projects page").option("--api-key <key>", "Skip the prompt \u2014 pass the API key (CI only)").option("--framework <id>", "Force a framework (next, react, vue, nuxt, svelte, sveltekit, angular, expo, react-native, capacitor, vanilla)").option("--skip-install", "Print the install command instead of running it").option("-y, --yes", "Accept detected framework without prompting").option("--cwd <path>", "Run the wizard in a different directory").option("--endpoint <url>", "Override the Mushi API endpoint (self-hosted)").option("--skip-test-report", 'Skip the end-of-wizard "send a test report" prompt').action(async (opts) => {
   await runInit({
     projectId: opts.projectId,
     apiKey: opts.apiKey,
@@ -1122,116 +1383,501 @@ program.command("init").description("Set up the Mushi Mushi SDK in this project
     sendTestReport: opts.skipTestReport ? false : void 0
   });
 });
-program.command("migrate").description(
-  "Suggest the most relevant Mushi Mushi migration guide based on your package.json"
-).option("--cwd <path>", "Run from a different directory").option("--json", "Machine-readable JSON output").action((opts) => {
+program.command("migrate").description("Suggest the most relevant Mushi Mushi migration guide based on your package.json").option("--cwd <path>", "Run from a different directory").option("--json", "Machine-readable JSON output").action((opts) => {
   const { matches } = runMigrate({ cwd: opts.cwd, json: opts.json });
   if (matches.length === 0) process.exit(1);
 });
-program.command("login").description("Store API key for authentication").requiredOption("--api-key <key>", "API key").option("--endpoint <url>", "API endpoint URL").option("--project-id <id>", "Default project ID").action((opts) => {
+program.command("login").description("Save API credentials to ~/.mushirc (mode 0o600)").requiredOption("--api-key <key>", "Mushi API key (mushi_...)").option("--endpoint <url>", "Supabase edge function URL").option("--project-id <id>", "Project UUID (from the Projects page)").addHelpText("after", `
+Examples:
+  mushi login --api-key mushi_xxx --endpoint https://xyz.supabase.co/functions/v1/api
+  mushi login --api-key mushi_xxx --project-id 542b34e0-019e-41fe-b900-7b637717bb86`).action((opts) => {
   const config = loadConfig();
   config.apiKey = opts.apiKey;
   if (opts.endpoint) config.endpoint = assertEndpoint(opts.endpoint);
   if (opts.projectId) config.projectId = opts.projectId;
   saveConfig(config);
-  console.log("Saved credentials to ~/.mushirc (mode 0o600)");
+  console.log("\u2713 Credentials saved to ~/.mushirc (mode 0o600)");
+  console.log("  Run 'mushi whoami' to verify the connection.");
 });
-program.command("status").description("Show project stats").action(async () => {
-  const config = loadConfig();
-  if (!config.apiKey) {
-    console.error("Run `mushi login` first");
-    process.exit(1);
-  }
-  const data = await apiCall("/v1/admin/stats", config);
-  console.log(JSON.stringify(data, null, 2));
-});
-var reports = program.command("reports").description("Manage bug reports");
-reports.command("list").description("List recent reports").option("--limit <n>", "Max results", "20").option("--status <status>", "Filter by status").option("--json", "JSON output").action(async (opts) => {
-  const config = loadConfig();
-  if (!config.apiKey) {
-    console.error("Run `mushi login` first");
-    process.exit(1);
-  }
-  const params = new URLSearchParams();
-  params.set("limit", opts.limit);
-  if (opts.status) params.set("status", opts.status);
-  const data = await apiCall(`/v1/admin/reports?${params}`, config);
+program.command("whoami").description("Verify API key and display project info").option("--json", "Machine-readable JSON output").addHelpText("after", `
+Verifies that MUSHI_API_KEY is valid and shows which project it belongs to.
+Useful after 'mushi login' to confirm credentials are correct.`).action(async (opts) => {
+  const config = requireConfig();
+  const result = await apiCall("/v1/sync/whoami", config);
+  if (!result.ok) die(result);
   if (opts.json) {
-    console.log(JSON.stringify(data, null, 2));
+    console.log(JSON.stringify(result.data, null, 2));
   } else {
-    const reports2 = data.data?.reports ?? [];
-    for (const r of reports2) {
-      console.log(`${r.id}  ${r.severity ?? "unset"}  ${r.status ?? "new"}  ${(r.summary ?? "").slice(0, 60)}`);
-    }
+    const d = result.data;
+    console.log(`\u2713 Authenticated`);
+    console.log(`  Project:  ${d.project_name} (${d.project_id})`);
+    console.log(`  Endpoint: ${config.endpoint}`);
+    console.log(`  Reports:  ${d.stats.total_reports} total \xB7 ${d.stats.open_reports} open`);
   }
 });
-reports.command("show <id>").description("Show report details").action(async (id) => {
-  const config = loadConfig();
-  if (!config.apiKey) {
-    console.error("Run `mushi login` first");
+program.command("ping").description("Check connectivity to the Mushi backend").option("--json", "Machine-readable JSON output").action(async (opts) => {
+  const config = requireConfig();
+  const t0 = Date.now();
+  try {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), API_TIMEOUT_MS);
+    const res = await fetch(`${config.endpoint}/health`, { signal: controller.signal });
+    clearTimeout(timer);
+    const latency = Date.now() - t0;
+    if (opts.json) {
+      console.log(JSON.stringify({ ok: res.ok, status: res.status, latency_ms: latency }));
+    } else {
+      const symbol = res.ok ? "\u2713" : "\u2717";
+      console.log(`${symbol} ${res.ok ? "OK" : "FAIL"} \u2014 ${res.status} (${latency}ms)`);
+      if (!res.ok) process.exit(1);
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (opts.json) {
+      console.log(JSON.stringify({ ok: false, error: msg, latency_ms: Date.now() - t0 }));
+    } else {
+      process.stderr.write(`\u2717 Unreachable: ${msg}
+`);
+    }
     process.exit(1);
   }
-  const data = await apiCall(`/v1/admin/reports/${id}`, config);
-  console.log(JSON.stringify(data, null, 2));
 });
-reports.command("triage <id>").description("Update report status/severity").option("--status <status>", "New status").option("--severity <severity>", "New severity").action(async (id, opts) => {
-  const config = loadConfig();
-  if (!config.apiKey) {
-    console.error("Run `mushi login` first");
-    process.exit(1);
+program.command("status").description("Show project stats: report counts by severity and status").option("--json", "Machine-readable JSON output").action(async (opts) => {
+  const config = requireConfig();
+  const result = await apiCall("/v1/sync/stats", config);
+  if (!result.ok) die(result);
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
   }
-  const body = {};
-  if (opts.status) body.status = opts.status;
-  if (opts.severity) body.severity = opts.severity;
-  const data = await apiCall(`/v1/admin/reports/${id}`, config, { method: "PATCH", body: JSON.stringify(body) });
-  console.log(JSON.stringify(data, null, 2));
+  const d = result.data;
+  console.log(`Project: ${d.project_name}`);
+  console.log("");
+  console.log("Reports by status:");
+  for (const [status, count] of Object.entries(d.by_status)) {
+    console.log(`  ${pad(status, 14)} ${count}`);
+  }
+  console.log("");
+  console.log("Reports by severity:");
+  for (const [severity, count] of Object.entries(d.by_severity)) {
+    console.log(`  ${pad(severity, 14)} ${count}`);
+  }
+  console.log("");
+  console.log(`Fixes:   ${d.fixes_count} total \xB7 ${d.fixes_merged} merged`);
+  console.log(`Lessons: ${d.lessons_count} active rules`);
 });
-program.command("config").description("View or update CLI config").argument("[key]", "Config key to set").argument("[value]", "Value").action((key, value) => {
+program.command("config").description("View or update CLI config (stored in ~/.mushirc)").argument("[key]", "Config key to set: apiKey | endpoint | projectId").argument("[value]", "New value").addHelpText("after", `
+Keys:
+  apiKey     \u2014 Mushi API key (mushi_...)
+  endpoint   \u2014 Supabase edge function URL
+  projectId  \u2014 Project UUID
+
+Examples:
+  mushi config                        # show all config
+  mushi config apiKey mushi_xxx       # set API key
+  mushi config endpoint https://...   # set endpoint
+  mushi config projectId <uuid>       # set project`).action((key, value) => {
   const config = loadConfig();
+  const ALLOWED_KEYS = /* @__PURE__ */ new Set(["apiKey", "endpoint", "projectId"]);
   if (key && value) {
+    if (!ALLOWED_KEYS.has(key)) {
+      process.stderr.write(`error: unknown config key "${key}". Allowed: ${[...ALLOWED_KEYS].join(", ")}
+`);
+      process.exit(2);
+    }
     const safeValue = key === "endpoint" ? assertEndpoint(value) : value;
     config[key] = safeValue;
     saveConfig(config);
-    console.log(`Set ${key} = ${safeValue}`);
+    console.log(`\u2713 Set ${key}`);
   } else {
-    console.log(JSON.stringify(config, null, 2));
+    const safe = { ...config, apiKey: config.apiKey ? `${config.apiKey.slice(0, 10)}\u2026` : void 0 };
+    console.log(JSON.stringify(safe, null, 2));
   }
 });
 var deploy = program.command("deploy").description("Deployment management");
-deploy.command("check").description("Check edge function health").action(async () => {
-  const config = loadConfig();
-  if (!config.apiKey) {
-    console.error("Run `mushi login` first");
+deploy.command("check").description("Check edge function health and measure latency").option("--json", "Machine-readable JSON output").action(async (opts) => {
+  const config = requireConfig();
+  const t0 = Date.now();
+  try {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), API_TIMEOUT_MS);
+    const res = await fetch(`${config.endpoint}/health`, { signal: controller.signal });
+    clearTimeout(timer);
+    const latency = Date.now() - t0;
+    const body = res.headers.get("content-type")?.includes("json") ? await res.json().catch(() => ({})) : {};
+    if (opts.json) {
+      console.log(JSON.stringify({ ok: res.ok, status: res.status, latency_ms: latency, ...body }));
+    } else {
+      console.log(`Health: ${res.status === 200 ? "OK" : "FAIL"} (${res.status}) \u2014 ${latency}ms`);
+      if (body["version"]) console.log(`  Version: ${body["version"]}`);
+      if (body["region"]) console.log(`  Region:  ${body["region"]}`);
+    }
+    if (!res.ok) process.exit(1);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (opts.json) {
+      console.log(JSON.stringify({ ok: false, error: msg }));
+    } else {
+      process.stderr.write(`error: ${msg}
+`);
+    }
     process.exit(1);
   }
-  if (!config.endpoint) {
-    console.error(
-      "No API endpoint configured. Run `mushi init` or set MUSHI_API_ENDPOINT.\nSet endpoint to your Supabase edge function URL, e.g. https://xyz.supabase.co/functions/v1/api"
-    );
-    process.exit(1);
+});
+var reports = program.command("reports").description("Manage bug reports");
+reports.command("list").description("List recent reports for the current project").option("--limit <n>", "Max results (1\u2013100)", "20").option("--status <status>", "Filter by status: new|triaged|in_progress|resolved|dismissed").option("--severity <severity>", "Filter by severity: critical|high|medium|low").option("--search <query>", "Full-text search in summary and description").option("--json", "Machine-readable JSON output").addHelpText("after", `
+Examples:
+  mushi reports list
+  mushi reports list --status new --severity critical
+  mushi reports list --search "button not working" --limit 5 --json`).action(async (opts) => {
+  const config = requireConfig();
+  const limit = Math.min(Math.max(1, parseInt(opts.limit) || 20), 100);
+  const params = new URLSearchParams({ limit: String(limit) });
+  if (opts.status) params.set("status", opts.status);
+  if (opts.severity) params.set("severity", opts.severity);
+  if (opts.search) params.set("search", opts.search);
+  const result = await apiCall(`/v1/sync/reports?${params}`, config);
+  if (!result.ok) die(result);
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
   }
-  const endpoint = config.endpoint;
-  try {
-    const res = await fetch(`${endpoint}/health`);
-    console.log(`Health: ${res.status === 200 ? "OK" : "FAIL"} (${res.status})`);
-  } catch (err) {
-    console.error("Failed:", err);
+  const rows = result.data.reports;
+  if (rows.length === 0) {
+    console.log("No reports found.");
+    return;
+  }
+  console.log(`${pad("ID", 38)} ${pad("SEV", 9)} ${pad("STATUS", 12)} ${pad("CREATED", 17)} SUMMARY`);
+  console.log("\u2500".repeat(110));
+  for (const r of rows) {
+    const sev = r.severity ?? "unset";
+    const status = r.status ?? "new";
+    const summary = (r.summary ?? r.description ?? "").slice(0, 50);
+    console.log(`${pad(r.id, 38)} ${pad(sev, 9)} ${pad(status, 12)} ${pad(fmtDate(r.created_at), 17)} ${summary}`);
+  }
+  if (result.data.total > rows.length) {
+    console.log(`
+  \u2026 ${result.data.total - rows.length} more. Use --limit to see more.`);
   }
 });
-program.command("index <path>").description("Walk a local repo and upload code chunks to the RAG indexer (non-GitHub fallback for V5.3 \xA72.3.4)").option("--language <lang>", "Limit to one language (ts, tsx, js, py, go, rs)").option("--dry-run", "Show what would be uploaded without sending").action(async (path, opts) => {
-  const config = loadConfig();
-  if (!config.apiKey) {
-    console.error("Run `mushi login` first");
-    process.exit(1);
+reports.command("show <id>").description("Show full details for a single report").option("--json", "Machine-readable JSON output").action(async (id, opts) => {
+  const config = requireConfig();
+  const result = await apiCall(`/v1/sync/reports/${id}`, config);
+  if (!result.ok) {
+    if (result.httpStatus === 404 || result.error.code === "NOT_FOUND") {
+      process.stderr.write(`error: report "${id}" not found
+`);
+      process.exit(3);
+    }
+    die(result);
   }
-  if (!config.projectId) {
-    console.error("Set projectId via `mushi config projectId <id>`");
-    process.exit(1);
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
+  }
+  const r = result.data;
+  console.log(`Report: ${r.id}`);
+  console.log(`  Status:   ${r.status ?? "new"}`);
+  console.log(`  Severity: ${r.severity ?? "unset"}`);
+  console.log(`  Category: ${r.category ?? "\u2014"}`);
+  console.log(`  Created:  ${fmtDate(r.created_at)}`);
+  if (r.summary) console.log(`  Summary:  ${r.summary}`);
+  if (r.description) {
+    console.log(`  Description:`);
+    console.log(`    ${r.description.replace(/\n/g, "\n    ")}`);
+  }
+  if (r.environment?.url) console.log(`  URL:      ${r.environment.url}`);
+  if (r.component) console.log(`  Component: ${r.component}`);
+  if (r.sentry_event_id) console.log(`  Sentry:   ${r.sentry_event_id}`);
+  if (r.fix_id) console.log(`  Fix:      ${r.fix_id}`);
+  if (r.tags && Object.keys(r.tags).length > 0) {
+    console.log(`  Tags:     ${JSON.stringify(r.tags)}`);
+  }
+});
+reports.command("triage <id>").description("Update the status and/or severity of a report").option("--status <status>", "New status: new|triaged|in_progress|resolved|dismissed").option("--severity <severity>", "New severity: critical|high|medium|low").option("--note <text>", "Internal triage note").option("--json", "Machine-readable JSON output").addHelpText("after", `
+Examples:
+  mushi reports triage <id> --status triaged --severity high
+  mushi reports triage <id> --status in_progress --note "assigned to @alice"`).action(async (id, opts) => {
+  const config = requireConfig();
+  const body = {};
+  if (opts.status) body["status"] = opts.status;
+  if (opts.severity) body["severity"] = opts.severity;
+  if (opts.note) body["note"] = opts.note;
+  if (Object.keys(body).length === 0) {
+    process.stderr.write("error: provide at least one of --status, --severity, or --note\n");
+    process.exit(2);
+  }
+  const result = await apiCall(`/v1/sync/reports/${id}`, config, {
+    method: "PATCH",
+    body: JSON.stringify(body)
+  });
+  if (!result.ok) {
+    if (result.httpStatus === 404 || result.error.code === "NOT_FOUND") {
+      process.stderr.write(`error: report "${id}" not found
+`);
+      process.exit(3);
+    }
+    die(result);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+  } else {
+    console.log(`\u2713 Updated report ${id}`);
+    if (opts.status) console.log(`  Status:   ${opts.status}`);
+    if (opts.severity) console.log(`  Severity: ${opts.severity}`);
+    if (opts.note) console.log(`  Note:     ${opts.note}`);
+  }
+});
+reports.command("resolve <id>").description("Mark a report as resolved (shorthand for triage --status resolved)").option("--note <text>", "Resolution note").option("--json", "Machine-readable JSON output").action(async (id, opts) => {
+  const config = requireConfig();
+  const body = { status: "resolved" };
+  if (opts.note) body["note"] = opts.note;
+  const result = await apiCall(`/v1/sync/reports/${id}`, config, {
+    method: "PATCH",
+    body: JSON.stringify(body)
+  });
+  if (!result.ok) {
+    if (result.httpStatus === 404 || result.error.code === "NOT_FOUND") {
+      process.stderr.write(`error: report "${id}" not found
+`);
+      process.exit(3);
+    }
+    die(result);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+  } else {
+    console.log(`\u2713 Resolved report ${id}`);
+    if (opts.note) console.log(`  Note: ${opts.note}`);
+  }
+});
+reports.command("reopen <id>").description("Reopen a resolved or dismissed report").option("--note <text>", "Note explaining the reopen").option("--json", "Machine-readable JSON output").action(async (id, opts) => {
+  const config = requireConfig();
+  const body = { status: "new" };
+  if (opts.note) body["note"] = opts.note;
+  const result = await apiCall(`/v1/sync/reports/${id}`, config, {
+    method: "PATCH",
+    body: JSON.stringify(body)
+  });
+  if (!result.ok) {
+    if (result.httpStatus === 404 || result.error.code === "NOT_FOUND") {
+      process.stderr.write(`error: report "${id}" not found
+`);
+      process.exit(3);
+    }
+    die(result);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+  } else {
+    console.log(`\u2713 Reopened report ${id}`);
+  }
+});
+reports.command("dismiss <id>").description("Dismiss a report (not a real bug / out of scope)").option("--note <text>", "Reason for dismissal").option("--json", "Machine-readable JSON output").action(async (id, opts) => {
+  const config = requireConfig();
+  const body = { status: "dismissed" };
+  if (opts.note) body["note"] = opts.note;
+  const result = await apiCall(`/v1/sync/reports/${id}`, config, {
+    method: "PATCH",
+    body: JSON.stringify(body)
+  });
+  if (!result.ok) {
+    if (result.httpStatus === 404 || result.error.code === "NOT_FOUND") {
+      process.stderr.write(`error: report "${id}" not found
+`);
+      process.exit(3);
+    }
+    die(result);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+  } else {
+    console.log(`\u2713 Dismissed report ${id}`);
+  }
+});
+reports.command("search <query>").description("Search reports by keyword in summary and description").option("--limit <n>", "Max results (1\u201350)", "10").option("--status <status>", "Filter by status").option("--json", "Machine-readable JSON output").addHelpText("after", `
+Examples:
+  mushi reports search "login button"
+  mushi reports search "404 error" --status new --limit 20`).action(async (query, opts) => {
+  const config = requireConfig();
+  const limit = Math.min(Math.max(1, parseInt(opts.limit) || 10), 50);
+  const params = new URLSearchParams({ search: query, limit: String(limit) });
+  if (opts.status) params.set("status", opts.status);
+  const result = await apiCall(`/v1/sync/reports?${params}`, config);
+  if (!result.ok) die(result);
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
+  }
+  const rows = result.data.reports;
+  if (rows.length === 0) {
+    console.log(`No reports matching "${query}".`);
+    return;
+  }
+  console.log(`${rows.length} result${rows.length === 1 ? "" : "s"} for "${query}":`);
+  console.log("");
+  for (const r of rows) {
+    console.log(`  ${r.id}`);
+    console.log(`    ${r.severity ?? "unset"} \xB7 ${r.status ?? "new"} \xB7 ${fmtDate(r.created_at)}`);
+    const text2 = r.summary ?? r.description ?? "";
+    if (text2) console.log(`    ${text2.slice(0, 80)}`);
+    console.log("");
+  }
+});
+var lessons = program.command("lessons").description("Manage learned mistake rules");
+lessons.command("list").description("List active lessons (mistake rules) for the current project").option("--severity <sev>", "Filter: info|warn|critical").option("--limit <n>", "Max results (1\u2013200)", "50").option("--json", "Machine-readable JSON output").addHelpText("after", `
+Lessons are mistake rules extracted from past bug reports by the clustering
+pipeline. They are injected into AI code-review context via the MCP server.`).action(async (opts) => {
+  const config = requireConfig();
+  const limit = Math.min(Math.max(1, parseInt(opts.limit) || 50), 200);
+  const params = new URLSearchParams({ limit: String(limit) });
+  if (opts.severity) params.set("severity", opts.severity);
+  const result = await apiCall(`/v1/sync/lessons?${params}`, config);
+  if (!result.ok) die(result);
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
+  }
+  const rows = result.data;
+  if (!Array.isArray(rows) || rows.length === 0) {
+    console.log("No active lessons yet. Reports are clustered nightly.");
+    return;
+  }
+  console.log(`${pad("SEV", 9)} ${pad("FREQ", 6)} RULE`);
+  console.log("\u2500".repeat(90));
+  for (const l of rows) {
+    const sev = l.severity ?? "info";
+    const freq = String(l.frequency ?? 0);
+    const rule = (l.rule_text ?? "").slice(0, 70);
+    console.log(`${pad(sev, 9)} ${pad(freq, 6)} ${rule}`);
+  }
+  console.log(`
+  ${rows.length} active lesson${rows.length === 1 ? "" : "s"}`);
+});
+lessons.command("show <id>").description("Show full detail for a single lesson (rule text, anti-pattern, source reports)").option("--json", "Machine-readable JSON output").action(async (id, opts) => {
+  const config = requireConfig();
+  const result = await apiCall(`/v1/sync/lessons/${id}`, config);
+  if (!result.ok) {
+    if (result.httpStatus === 404 || result.error.code === "NOT_FOUND") {
+      process.stderr.write(`error: lesson "${id}" not found
+`);
+      process.exit(3);
+    }
+    die(result);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+    return;
   }
+  const l = result.data;
+  console.log(`Lesson: ${l.id}`);
+  console.log(`  Severity:  ${l.severity}`);
+  console.log(`  Frequency: ${l.frequency} reports`);
+  if (l.last_reinforced_at) console.log(`  Updated:   ${fmtDate(l.last_reinforced_at)}`);
+  console.log("");
+  console.log(`Rule:`);
+  console.log(`  ${l.rule_text}`);
+  if (l.anti_pattern) {
+    console.log("");
+    console.log(`Anti-pattern:`);
+    console.log(`  ${l.anti_pattern}`);
+  }
+  if (l.summary_paragraph) {
+    console.log("");
+    console.log(`Summary:`);
+    console.log(`  ${l.summary_paragraph}`);
+  }
+});
+program.command("sync-lessons").description("Pull promoted lessons from Mushi and write .mushi/lessons.json into this repo").option("--cwd <path>", "Target directory (default: current working dir)").option("--dry-run", "Print the JSON that would be written without writing anything").option("--json", "Machine-readable output: { ok, path, count }").addHelpText("after", `
+Used in CI to keep .mushi/lessons.json up to date so the Mushi MCP server
+and Cursor rules can inject the latest project-specific mistake rules into
+AI code review context.
+
+Typical CI usage:
+  MUSHI_API_KEY=$KEY MUSHI_PROJECT_ID=$PID MUSHI_API_ENDPOINT=$URL \\
+    npx @mushi-mushi/cli sync-lessons --cwd .`).action(async (opts) => {
+  const { writeFile, mkdir } = await import("fs/promises");
+  const nodePath = await import("path");
+  const config = requireConfig();
+  const cwd = opts.cwd ?? process.cwd();
+  const target = nodePath.join(cwd, ".mushi", "lessons.json");
+  const result = await apiCall("/v1/sync/lessons?limit=500", config);
+  if (!result.ok) die(result);
+  const rows = Array.isArray(result.data) ? result.data : [];
+  const lessons2 = rows.map((l) => ({
+    id: l.id,
+    rule: l.rule_text,
+    anti_pattern: l.anti_pattern ?? void 0,
+    severity: l.severity,
+    frequency: l.frequency,
+    last_reinforced: l.last_reinforced_at?.slice(0, 10) ?? "",
+    cluster_id: l.cluster_id ?? void 0
+  }));
+  const output = {
+    schema_version: "1",
+    project_id: config.projectId ?? "",
+    generated_at: (/* @__PURE__ */ new Date()).toISOString(),
+    lessons: lessons2
+  };
+  if (opts.dryRun) {
+    console.log(JSON.stringify(output, null, 2));
+    return;
+  }
+  await mkdir(nodePath.dirname(target), { recursive: true });
+  await writeFile(target, JSON.stringify(output, null, 2) + "\n", "utf8");
+  if (opts.json) {
+    console.log(JSON.stringify({ ok: true, path: target, count: lessons2.length }));
+  } else {
+    console.log(`\u2713 Wrote ${lessons2.length} lesson${lessons2.length === 1 ? "" : "s"} to ${target}`);
+  }
+});
+program.command("test").description("Submit a synthetic test report to verify the ingestion pipeline end-to-end").option("--json", "Machine-readable JSON output").action(async (opts) => {
+  const config = requireConfig();
+  const result = await apiCall("/v1/reports", config, {
+    method: "POST",
+    body: JSON.stringify({
+      projectId: config.projectId,
+      description: "CLI test report \u2014 verifying ingestion pipeline",
+      category: "other",
+      reporterToken: `cli-test-${Date.now()}`,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      environment: {
+        url: "cli://test",
+        userAgent: `mushi-cli/${MUSHI_CLI_VERSION}`,
+        platform: process.platform,
+        language: "en",
+        viewport: { width: 0, height: 0 },
+        referrer: "",
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        timezone: Intl.DateTimeFormat().resolvedOptions().timeZone
+      }
+    })
+  });
+  if (!result.ok) die(result);
+  if (opts.json) {
+    console.log(JSON.stringify(result.data, null, 2));
+  } else {
+    const d = result.data;
+    console.log(`\u2713 Test report submitted`);
+    console.log(`  ID:     ${d.reportId}`);
+    console.log(`  Status: ${d.status}`);
+    console.log(`  View:   https://kensaur.us/mushi-mushi/reports/${d.reportId}`);
+  }
+});
+program.command("index <path>").description("Walk a local repo and upload code chunks to the Mushi RAG indexer").option("--language <lang>", "Limit to one language: ts, tsx, js, py, go, rs").option("--dry-run", "Show what would be uploaded without sending").option("--json", "Machine-readable summary: { files, bytes }").addHelpText("after", `
+Uploads source code into the Mushi vector index so the fix-worker can
+retrieve relevant context when generating patches. Only needed for private
+repos that cannot be auto-indexed via GitHub App.
+
+Examples:
+  mushi index ./src
+  mushi index ./src --language ts --dry-run`).action(async (path, opts) => {
+  const config = requireConfig({ needsProject: true });
   const { readdir: readdir2, readFile: readFile2, stat } = await import("fs/promises");
   const nodePath = await import("path");
   const SKIP = /node_modules|\.git|dist|build|\.next|\.turbo|coverage/;
   const EXTS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".py", ".go", ".rs"]);
+  const MAX_FILE_BYTES = 5e5;
   async function* walk(dir) {
     const entries = await readdir2(dir, { withFileTypes: true });
     for (const e of entries) {
@@ -1243,64 +1889,53 @@ program.command("index <path>").description("Walk a local repo and upload code c
   }
   let count = 0;
   let bytes = 0;
+  let errors = 0;
   const root = nodePath.resolve(path);
   for await (const file of walk(root)) {
     const lang = nodePath.extname(file).slice(1);
     if (opts.language && opts.language !== lang) continue;
     const stats = await stat(file);
-    if (stats.size > 5e5) continue;
+    if (stats.size > MAX_FILE_BYTES) {
+      if (!opts.json) process.stdout.write(`  skip  ${nodePath.relative(root, file)} (>${MAX_FILE_BYTES / 1e3}KB)
+`);
+      continue;
+    }
     const source = await readFile2(file, "utf8");
     const relative2 = nodePath.relative(root, file).replaceAll("\\", "/");
     count++;
     bytes += source.length;
     if (opts.dryRun) {
-      console.log(`  ${relative2} (${source.length} bytes)`);
+      if (!opts.json) process.stdout.write(`  ${relative2} (${source.length} bytes)
+`);
       continue;
     }
-    const res = await apiCall("/v1/admin/codebase/upload", config, {
+    const result = await apiCall("/v1/sync/codebase/upload", config, {
       method: "POST",
-      body: JSON.stringify({
-        projectId: config.projectId,
-        filePath: relative2,
-        source
-      })
+      body: JSON.stringify({ projectId: config.projectId, filePath: relative2, source })
     });
-    if (!res.ok) console.error(`  FAIL ${relative2}: ${res.error ?? "unknown"}`);
-    else process.stdout.write(`  ${relative2} \u2192 ${res.chunks ?? 0} chunks
+    if (!result.ok) {
+      errors++;
+      process.stderr.write(`  FAIL  ${relative2}: ${result.error.message}
+`);
+    } else if (!opts.json) {
+      process.stdout.write(`  ok    ${relative2} \u2192 ${result.data.chunks} chunks
 `);
+    }
   }
-  console.log(`Indexed ${count} files (${(bytes / 1024).toFixed(1)} KB) into project ${config.projectId}`);
-});
-program.command("test").description("Submit a test report to verify pipeline").action(async () => {
-  const config = loadConfig();
-  if (!config.apiKey) {
-    console.error("Run `mushi login` first");
-    process.exit(1);
+  if (opts.json) {
+    console.log(JSON.stringify({ ok: errors === 0, files: count, bytes, errors }));
+  } else {
+    const kb = (bytes / 1024).toFixed(1);
+    console.log(`
+Indexed ${count} files (${kb} KB) into project ${config.projectId}${errors ? ` \u2014 ${errors} failed` : ""}`);
   }
-  const data = await apiCall("/v1/reports", config, {
-    method: "POST",
-    body: JSON.stringify({
-      projectId: config.projectId,
-      description: "CLI test report \u2014 verifying pipeline",
-      category: "other",
-      reporterToken: `cli-test-${Date.now()}`,
-      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      environment: {
-        url: "cli://test",
-        userAgent: "mushi-cli",
-        platform: process.platform,
-        language: "en",
-        viewport: { width: 0, height: 0 },
-        referrer: "",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        timezone: Intl.DateTimeFormat().resolvedOptions().timeZone
-      }
-    })
-  });
-  console.log("Test report submitted:", JSON.stringify(data, null, 2));
+  if (errors > 0) process.exit(1);
 });
 var sourcemaps = program.command("sourcemaps").description("Source map management");
-sourcemaps.command("upload").description("Upload source map files to the Mushi platform (idempotent, sha256-keyed)").requiredOption("--release <version>", "Release version (e.g. 1.0.0 or git SHA)").option("--dir <path>", "Directory containing source maps", "./dist").option("--dry-run", "List files that would be uploaded without uploading").option("-e, --endpoint <url>", "API endpoint (overrides MUSHI_API_ENDPOINT)").option("--api-key <key>", "API key (overrides MUSHI_API_KEY)").option("--silent", "Suppress progress output (exit code still reflects failure)").action(async (opts) => {
+sourcemaps.command("upload").description("Upload source maps to Mushi (idempotent, SHA256-keyed) for stack trace symbolication").requiredOption("--release <version>", "Release identifier, e.g. 1.0.0 or a git SHA").option("--dir <path>", "Directory containing .map files", "./dist").option("--dry-run", "List files that would be uploaded without uploading").option("-e, --endpoint <url>", "API endpoint (overrides MUSHI_API_ENDPOINT)").option("--api-key <key>", "API key (overrides MUSHI_API_KEY)").option("--silent", "Suppress progress output").addHelpText("after", `
+Examples:
+  mushi sourcemaps upload --release 1.0.0
+  mushi sourcemaps upload --release $(git rev-parse --short HEAD) --dir ./dist`).action(async (opts) => {
   await runSourcemapsUpload({
     release: opts.release,
     dir: opts.dir,
@@ -1310,53 +1945,93 @@ sourcemaps.command("upload").description("Upload source map files to the Mushi p
     silent: opts.silent
   });
 });
-program.command("sync-lessons").description("Sync promoted lessons from Mushi into .mushi/lessons.json in this repo").option("--cwd <path>", "Target directory (default: current working dir)").option("--dry-run", "Print what would be written without writing").option("--json", "Machine-readable JSON output").action(async (opts) => {
-  const { writeFile, mkdir } = await import("fs/promises");
-  const nodePath = await import("path");
-  const config = loadConfig();
-  if (!config.apiKey) {
-    console.error("Run `mushi login` first");
-    process.exit(1);
+var fixCmd = program.command("fix").description("Dispatch an agentic fix for a report");
+fixCmd.argument("<reportId>", "Report UUID to fix").option(
+  "--agent <name>",
+  "Agent adapter: claude_code (default), cursor_cloud, codex, mcp",
+  "claude_code"
+).option(
+  "--model <slug>",
+  "Model override for cursor_cloud (e.g. composer-latest)"
+).option(
+  "--no-auto-pr",
+  "For cursor_cloud: skip automatic PR creation (branch only)"
+).option(
+  "--wait",
+  "Poll until terminal state and exit non-zero on error/cancelled (CI-friendly)"
+).option("-e, --endpoint <url>", "API endpoint (overrides MUSHI_API_ENDPOINT)").option("--api-key <key>", "API key (overrides MUSHI_API_KEY)").option("--project-id <id>", "Project ID (overrides MUSHI_PROJECT_ID)").addHelpText("after", `
+Examples:
+  mushi fix abc123 --agent cursor_cloud --wait
+  mushi fix abc123 --agent cursor_cloud --model composer-latest --no-auto-pr
+  mushi fix abc123 --agent claude_code
+
+  # CI: fail the pipeline if the fix errors
+  mushi fix $REPORT_ID --agent cursor_cloud --wait && echo "Fix PR opened"`).action(async (reportId, opts) => {
+  const cfg = loadConfig();
+  if (opts.endpoint) cfg.endpoint = opts.endpoint;
+  if (opts.apiKey) cfg.apiKey = opts.apiKey;
+  if (opts.projectId) cfg.projectId = opts.projectId;
+  const isTTY = process.stdout.isTTY;
+  const emitEvent = (type, data) => {
+    if (isTTY) {
+      const ts = (/* @__PURE__ */ new Date()).toISOString();
+      console.log(`[${ts}] ${type}`, JSON.stringify(data));
+    } else {
+      process.stdout.write(JSON.stringify({ type, ...data }) + "\n");
+    }
+  };
+  emitEvent("dispatch.start", { reportId, agent: opts.agent, model: opts.model ?? null });
+  const body = {
+    reportId,
+    agent: opts.agent
+  };
+  if (opts.agent === "cursor_cloud") {
+    if (opts.model) body.cursorModel = opts.model;
+    if (!opts.autoPr) body.cursorAutoCreatePR = false;
   }
-  if (!config.projectId) {
-    console.error("Set projectId via `mushi config projectId <id>`");
+  const result = await apiCall("/v1/admin/fixes/dispatch", cfg, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (!result.ok) {
+    console.error("Error dispatching fix:", result.error.message);
     process.exit(1);
   }
-  const cwd = opts.cwd ?? process.cwd();
-  const target = nodePath.join(cwd, ".mushi", "lessons.json");
-  const res = await apiCall(
-    `/v1/admin/lessons?projectId=${config.projectId}&limit=500`,
-    config
-  );
-  if (!res.ok || !res.data) {
-    console.error("Failed to fetch lessons:", res.error ?? JSON.stringify(res));
-    process.exit(1);
+  const { fixId, status, agentId, runId, prUrl } = result.data;
+  emitEvent("dispatch.ok", { fixId, status, agentId, runId, prUrl });
+  if (!opts.wait) {
+    process.exit(0);
   }
-  const lessons = res.data.map((l) => ({
-    id: l.id,
-    rule: l.rule_text,
-    anti_pattern: l.anti_pattern ?? void 0,
-    severity: l.severity,
-    frequency: l.frequency,
-    last_reinforced: l.last_reinforced_at?.slice(0, 10) ?? "",
-    cluster_id: l.cluster_id ?? void 0
-  }));
-  const output = {
-    schema_version: "1",
-    project_id: config.projectId,
-    generated_at: (/* @__PURE__ */ new Date()).toISOString(),
-    lessons
-  };
-  if (opts.dryRun) {
-    console.log(JSON.stringify(output, null, 2));
-    return;
+  if (!fixId) {
+    console.error("No fixId returned \u2014 cannot poll.");
+    process.exit(1);
   }
-  await mkdir(nodePath.dirname(target), { recursive: true });
-  await writeFile(target, JSON.stringify(output, null, 2) + "\n", "utf8");
-  if (opts.json) {
-    console.log(JSON.stringify({ ok: true, path: target, count: lessons.length }));
-  } else {
-    console.log(`\u2713 Wrote ${lessons.length} lessons to ${target}`);
+  const POLL_MS = 5e3;
+  const MAX_POLLS = 120;
+  const TERMINAL = /* @__PURE__ */ new Set(["completed", "failed", "error", "cancelled", "skipped", "skipped_unsupported_agent", "skipped_no_sandbox"]);
+  for (let i = 0; i < MAX_POLLS; i++) {
+    await new Promise((r) => setTimeout(r, POLL_MS));
+    const pollResult = await apiCall(
+      `/v1/admin/fixes/${fixId}`,
+      cfg
+    );
+    if (!pollResult.ok) {
+      emitEvent("poll.error", { error: pollResult.error.message });
+      continue;
+    }
+    const s = pollResult.data.status;
+    emitEvent("fix.status", { status: s, pr_url: pollResult.data.pr_url, cursor_agent_id: pollResult.data.cursor_agent_id });
+    if (s && TERMINAL.has(s)) {
+      const success = s === "completed";
+      if (!success) {
+        console.error(`Fix ended with status: ${s}${pollResult.data.error ? ` \u2014 ${pollResult.data.error}` : ""}`);
+        process.exit(1);
+      }
+      process.exit(0);
+    }
   }
+  console.error("Polling timed out after 10 minutes. The fix may still be running.");
+  process.exit(1);
 });
 program.parse();