From 2f381a1a3c2621c4a0a942ac5ea43dfbfda88052 Mon Sep 17 00:00:00 2001
From: Josh Priddle <jpriddle@me.com>
Date: Fri, 22 May 2026 21:20:45 -0400
Subject: [PATCH 1/2] lint: update linters, fix errors

---
 .golangci.yml                               | 130 ++++++++++++++++++--
 internal/api/client.go                      |   2 +
 internal/api/client_test.go                 |  12 +-
 internal/api/error_test.go                  |   2 +-
 internal/appctx/appctx_test.go              |   4 +-
 internal/cli/root.go                        |  10 +-
 internal/cli/root_test.go                   |   4 +-
 internal/commands/account.go                |   2 +-
 internal/commands/account_api_key.go        |   6 +-
 internal/commands/account_secret.go         |  10 +-
 internal/commands/account_ssh_key.go        |   8 +-
 internal/commands/archive.go                |   6 +-
 internal/commands/auth.go                   |   4 +-
 internal/commands/auth_test.go              |  18 +--
 internal/commands/backup.go                 |   6 +-
 internal/commands/backup_download.go        |   4 +-
 internal/commands/db.go                     |   8 +-
 internal/commands/db_export.go              |  16 +--
 internal/commands/db_export_test.go         |  48 ++++----
 internal/commands/db_import_session.go      |  22 ++--
 internal/commands/db_import_session_test.go |  56 ++++-----
 internal/commands/db_test.go                |   2 +-
 internal/commands/deploy.go                 |  12 +-
 internal/commands/deploy_test.go            |   4 +-
 internal/commands/env.go                    |  10 +-
 internal/commands/env_db.go                 |   4 +-
 internal/commands/env_secret.go             |  10 +-
 internal/commands/event.go                  |   2 +-
 internal/commands/helpers_test.go           |  14 +--
 internal/commands/mcp_test.go               |  16 +--
 internal/commands/php_version.go            |   2 +-
 internal/commands/restore.go                |   6 +-
 internal/commands/site.go                   |  24 ++--
 internal/commands/site_ssh_key.go           |   6 +-
 internal/commands/skill_test.go             |   2 +-
 internal/commands/ssl.go                    |   4 +-
 internal/commands/waf_allowed_referrer.go   |   6 +-
 internal/commands/waf_blocked_ip.go         |   6 +-
 internal/commands/waf_blocked_referrer.go   |   6 +-
 internal/commands/waf_rate_limit.go         |  10 +-
 internal/commands/wait.go                   |   4 +-
 internal/commands/wait_test.go              |   7 +-
 internal/commands/webhook.go                |  10 +-
 internal/config/config.go                   |   4 +-
 internal/config/config_test.go              |  14 +--
 internal/output/output.go                   |   4 +-
 internal/surface/surface_test.go            |   4 +-
 47 files changed, 336 insertions(+), 235 deletions(-)

diff --git a/.golangci.yml b/.golangci.yml
index aa3582b..c04b080 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,20 +1,128 @@
 version: "2"
 
-run:
-  timeout: 3m
-  go: "1.26.1"
-
 linters:
-  # These are enabled by default in v2, listed explicitly for clarity.
-  # Note: gosimple is merged into staticcheck in golangci-lint v2.
   enable:
-    - govet
-    - errcheck
-    - staticcheck
-    - unused
-    - ineffassign
+    # Defaults — golangci-lint's standard set; the correctness backbone
+    - errcheck       # Report unchecked errors (the #1 Go bug source)
+    - govet          # Stdlib vet suite: printf, copylocks, struct tags, …
+    - ineffassign    # Detect assignments whose value is never used
+    - staticcheck    # Large bundle of correctness + simplification checks
+    - unused         # Find unused code (funcs, vars, types, consts)
+
+    # Complexity and test-discipline linters
+    - cyclop         # Cap per-function cyclomatic complexity (max in settings)
+    - gocritic       # Opinionated correctness/style/perf diagnostics
+    - tparallel      # Catch misuse of t.Parallel() (defer-vs-Cleanup, setup races)
+    - testifylint    # Enforce correct testify usage (assert/require, arg order)
+    - thelper        # Require t.Helper() in test helpers (buildXxx, newXxxServer)
+    - usetesting     # Prefer t.Context()/t.Setenv() over context/os equivalents
+
+    # HTTP/Context linters
+    - bodyclose      # Checks whether HTTP response body is closed
+    - noctx          # Find HTTP requests without context.Context
+
+    # Error handling linters
+    - errorlint      # Find code that will cause problems with error wrapping
+    - nilerr         # Find code that returns nil even if it checks error is not nil
+
+    # Code quality linters
+    - misspell       # Check for misspelled English words
+    - unconvert      # Remove unnecessary type conversions
+    - unparam        # Report unused function parameters
+    - wastedassign   # Find wasted assignment statements
+
+    # Security linter
+    - gosec          # Security checker
+
+    # Context and duration linters
+    - contextcheck   # Check function context parameter usage
+    - durationcheck  # Check for two durations multiplied together
+
+    # Naming and completeness linters
+    - errname        # Check error type naming conventions
+    - predeclared    # Find shadowing of Go's predeclared identifiers
+
+  settings:
+    cyclop:
+      # A backstop, not a style gate: today's worst function is 23, so this
+      # allows current code but trips on anything growing meaningfully worse.
+      max-complexity: 25
+
+    errcheck:
+      check-type-assertions: true
+      check-blank: false  # Don't check explicitly ignored errors with _
+      exclude-functions:
+        - fmt.Fprint
+        - fmt.Fprintf
+        - fmt.Fprintln
+        - (*os.File).Close
+        - (net/http.ResponseWriter).Write
+
+    govet:
+      enable-all: true
+      disable:
+        - fieldalignment  # Too noisy for minimal gains
+        - shadow          # Too noisy - variable shadowing is common in Go
+
+    errorlint:
+      asserts: false
+      comparison: false
+
+    gosec:
+      excludes:
+        - G101  # Hardcoded credentials — false positives on *SecretsBasePath /
+                # *KeysBasePath URL constants; tokens come from keyring/env/flag,
+                # never hardcoded.
+        - G104  # Unhandled errors (covered by errcheck)
+        - G115  # Integer overflow conversion — standard Go pattern
+        - G204  # Subprocess with variable — expected in CLI tools
+        - G301  # Directory permissions 0755 — standard for user config dirs
+        - G304  # File path provided as taint input — common in CLI tools
+        - G306  # WriteFile permissions 0644 — fine for non-secret files
+        - G703  # Path traversal via taint — same class as G304; paths derive
+                # from the user's own home/config dir, filenames are constants.
+
+    misspell:
+      locale: US
+
+    staticcheck:
+      checks:
+        - all
+        - -SA1019  # Ignore deprecation warnings (handle separately)
+        - -ST1000  # Package comments — low value for internal CLI
+
+    testifylint:
+      disable:
+        # Tests assert exact JSON-decoded whole numbers (IDs, byte sizes, counts)
+        # which decode as float64; InEpsilon/InDelta would weaken these identity
+        # checks. No test compares results of actual float arithmetic.
+        - float-compare
+
   exclusions:
     rules:
+      # gosec false-positives on test fixtures (e.g. hardcoded fake tokens);
+      # cyclop is noisy on table/dispatch test servers (newSiteTestServer is 33);
+      # bodyclose findings in tests are synthetic NopCloser bodies or nil-response
+      # false positives (the client returns nil on error) — production code is clean.
+      # errcheck stays on for tests — unchecked errors there can mask bugs.
+      - path: _test\.go
+        linters:
+          - gosec
+          - cyclop
+          - bodyclose
+          # unparam flags the uniform test-helper signatures STYLE.md mandates
+          # (buildXxxCmd returning cmd/stdout/stderr, newXxxTestServer(validToken))
+          # even when a given test ignores a return or passes the standard token.
+          - unparam
+      # In tests, bare type assertions on known fixtures (m["k"].(map[string]any))
+      # panic loudly as a test failure rather than masking bugs, so check-type-
+      # assertions noise is excluded here. check-type-assertions still guards
+      # production code, and real unchecked function errors in tests still fire.
       - path: _test\.go
         linters:
           - errcheck
+        text: "Error return value is not checked"
+
+issues:
+  max-issues-per-linter: 0
+  max-same-issues: 0
diff --git a/internal/api/client.go b/internal/api/client.go
index 65b4ce3..2243cb5 100644
--- a/internal/api/client.go
+++ b/internal/api/client.go
@@ -83,6 +83,7 @@ func (c *Client) PutFile(ctx context.Context, url string, file *os.File) (*http.
 		return nil, fmt.Errorf("executing file upload: %w", err)
 	}
 	if resp.StatusCode >= 300 || resp.StatusCode < 200 {
+		defer func() { _ = resp.Body.Close() }()
 		return nil, ParseErrorResponse(resp)
 	}
 	return resp, nil
@@ -155,6 +156,7 @@ func (c *Client) do(req *http.Request) (*http.Response, error) {
 		return nil, err
 	}
 	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		defer func() { _ = resp.Body.Close() }()
 		return nil, ParseErrorResponse(resp)
 	}
 	return resp, nil
diff --git a/internal/api/client_test.go b/internal/api/client_test.go
index 38105a6..bafe83e 100644
--- a/internal/api/client_test.go
+++ b/internal/api/client_test.go
@@ -78,7 +78,7 @@ func TestClient_Get(t *testing.T) {
 	query := url.Values{"page": []string{"1"}, "limit": []string{"10"}}
 	resp, err := c.Get(context.Background(), "/api/v1/items", query)
 	require.NoError(t, err)
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	assert.Equal(t, http.MethodGet, gotMethod)
 	assert.Equal(t, "/api/v1/items", gotPath)
@@ -98,7 +98,7 @@ func TestClient_GetWithoutQuery(t *testing.T) {
 	c := NewClient(srv.URL, "tok", "")
 	resp, err := c.Get(context.Background(), "/test", nil)
 	require.NoError(t, err)
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	assert.Empty(t, gotQuery)
 }
@@ -119,7 +119,7 @@ func TestClient_Post(t *testing.T) {
 	body := map[string]string{"name": "test", "email": "test@example.com"}
 	resp, err := c.Post(context.Background(), "/api/v1/items", body)
 	require.NoError(t, err)
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	assert.Equal(t, http.MethodPost, gotMethod)
 	assert.Equal(t, "application/json", gotContentType)
@@ -143,7 +143,7 @@ func TestClient_Put(t *testing.T) {
 	body := map[string]string{"name": "updated"}
 	resp, err := c.Put(context.Background(), "/api/v1/items/1", body)
 	require.NoError(t, err)
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	assert.Equal(t, http.MethodPut, gotMethod)
 	assert.Equal(t, "updated", gotBody["name"])
@@ -161,7 +161,7 @@ func TestClient_Delete(t *testing.T) {
 	c := NewClient(srv.URL, "tok", "")
 	resp, err := c.Delete(context.Background(), "/api/v1/items/1")
 	require.NoError(t, err)
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	assert.Equal(t, http.MethodDelete, gotMethod)
 	assert.Equal(t, "/api/v1/items/1", gotPath)
@@ -193,7 +193,7 @@ func TestClient_PutFile(t *testing.T) {
 	// PutFile uses the full URL directly (presigned S3 URL), not BaseURL+path.
 	resp, err := c.PutFile(context.Background(), srv.URL+"/upload", f)
 	require.NoError(t, err)
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	assert.Equal(t, http.MethodPut, gotMethod)
 	assert.Equal(t, "vector-cli/test", gotUserAgent)
diff --git a/internal/api/error_test.go b/internal/api/error_test.go
index b31ff84..8690167 100644
--- a/internal/api/error_test.go
+++ b/internal/api/error_test.go
@@ -41,7 +41,7 @@ func TestAPIError_Error_MultipleValidationErrors(t *testing.T) {
 
 func TestAPIError_ImplementsErrorInterface(t *testing.T) {
 	var err error = &APIError{Message: "test"}
-	assert.NotNil(t, err)
+	require.Error(t, err)
 	assert.Equal(t, "test", err.Error())
 }
 
diff --git a/internal/appctx/appctx_test.go b/internal/appctx/appctx_test.go
index a9dbdbe..7a7641f 100644
--- a/internal/appctx/appctx_test.go
+++ b/internal/appctx/appctx_test.go
@@ -13,7 +13,7 @@ import (
 )
 
 func TestNewApp(t *testing.T) {
-	cfg := &config.Config{ApiURL: "https://example.com"}
+	cfg := &config.Config{APIURL: "https://example.com"}
 	client := api.NewClient("https://example.com", "test-key", "")
 
 	app := appctx.NewApp(cfg, client, "")
@@ -24,7 +24,7 @@ func TestNewApp(t *testing.T) {
 }
 
 func TestContextRoundTrip(t *testing.T) {
-	cfg := &config.Config{ApiURL: "https://example.com"}
+	cfg := &config.Config{APIURL: "https://example.com"}
 	client := api.NewClient("https://example.com", "test-key", "")
 	app := appctx.NewApp(cfg, client, "")
 
diff --git a/internal/cli/root.go b/internal/cli/root.go
index 460ec9d..222500c 100644
--- a/internal/cli/root.go
+++ b/internal/cli/root.go
@@ -58,19 +58,19 @@ func NewRootCmd() *cobra.Command {
 			}
 
 			// 3. Build API client
-			client := api.NewClient(cfg.ApiURL, token, "")
+			client := api.NewClient(cfg.APIURL, token, "")
 
 			// 4. Detect output format from --json/--no-json flags
 			jsonFlag, _ := cmd.Flags().GetBool("json")
-			noJsonFlag, _ := cmd.Flags().GetBool("no-json")
-			format := output.DetectFormat(jsonFlag, noJsonFlag)
+			noJSONFlag, _ := cmd.Flags().GetBool("no-json")
+			format := output.DetectFormat(jsonFlag, noJSONFlag)
 
 			// 5. Handle --jq flag
 			jqExpr, _ := cmd.Flags().GetString("jq")
 			var writerOpts []output.WriterOption
 
 			if jqExpr != "" {
-				if noJsonFlag {
+				if noJSONFlag {
 					return fmt.Errorf("--jq and --no-json cannot be used together")
 				}
 
@@ -125,7 +125,7 @@ func NewRootCmd() *cobra.Command {
 	cmd.AddCommand(commands.NewBackupCmd())
 	cmd.AddCommand(commands.NewRestoreCmd())
 	cmd.AddCommand(commands.NewWafCmd())
-	cmd.AddCommand(commands.NewDbCmd())
+	cmd.AddCommand(commands.NewDBCmd())
 	cmd.AddCommand(commands.NewArchiveCmd())
 	cmd.AddCommand(commands.NewMcpCmd())
 	cmd.AddCommand(commands.NewSkillCmd())
diff --git a/internal/cli/root_test.go b/internal/cli/root_test.go
index cc8d9d7..7b3e1c4 100644
--- a/internal/cli/root_test.go
+++ b/internal/cli/root_test.go
@@ -118,7 +118,7 @@ func TestPersistentPreRunE_LoadsDefaultConfig(t *testing.T) {
 	err := cmd.Execute()
 	require.NoError(t, err)
 	require.NotNil(t, captured)
-	assert.Equal(t, "https://api.builtfast.com", captured.Config.ApiURL)
+	assert.Equal(t, "https://api.builtfast.com", captured.Config.APIURL)
 }
 
 func TestPersistentPreRunE_TokenFromFlag(t *testing.T) {
@@ -342,7 +342,7 @@ func TestPersistentPreRunE_CustomAPIURL(t *testing.T) {
 	t.Setenv("VECTOR_CONFIG_DIR", tmpDir)
 
 	// Write custom config
-	cfg := config.Config{ApiURL: "https://custom.api.com"}
+	cfg := config.Config{APIURL: "https://custom.api.com"}
 	data, err := json.MarshalIndent(cfg, "", "  ")
 	require.NoError(t, err)
 	require.NoError(t, os.WriteFile(filepath.Join(tmpDir, "config.json"), data, 0o644))
diff --git a/internal/commands/account.go b/internal/commands/account.go
index d6992ed..025b5a6 100644
--- a/internal/commands/account.go
+++ b/internal/commands/account.go
@@ -59,7 +59,7 @@ func newAccountShowCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
diff --git a/internal/commands/account_api_key.go b/internal/commands/account_api_key.go
index 09cf1a0..041c063 100644
--- a/internal/commands/account_api_key.go
+++ b/internal/commands/account_api_key.go
@@ -61,7 +61,7 @@ func newAccountAPIKeyListCmd() *cobra.Command {
 				if err != nil {
 					return fmt.Errorf("failed to list API keys: %w", err)
 				}
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			data, meta, err := parseResponseWithMeta(body)
@@ -148,7 +148,7 @@ func newAccountAPIKeyCreateCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -210,7 +210,7 @@ func newAccountAPIKeyDeleteCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			output.PrintMessage(cmd.OutOrStdout(), "API key deleted successfully.")
diff --git a/internal/commands/account_secret.go b/internal/commands/account_secret.go
index 1b3ba21..3038236 100644
--- a/internal/commands/account_secret.go
+++ b/internal/commands/account_secret.go
@@ -62,7 +62,7 @@ func newAccountSecretListCmd() *cobra.Command {
 				if err != nil {
 					return fmt.Errorf("failed to list secrets: %w", err)
 				}
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			data, meta, err := parseResponseWithMeta(body)
@@ -134,7 +134,7 @@ func newAccountSecretShowCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -205,7 +205,7 @@ func newAccountSecretCreateCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -282,7 +282,7 @@ func newAccountSecretUpdateCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -345,7 +345,7 @@ func newAccountSecretDeleteCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			app.Output.Message("Secret deleted successfully.")
diff --git a/internal/commands/account_ssh_key.go b/internal/commands/account_ssh_key.go
index 7e00382..41386a2 100644
--- a/internal/commands/account_ssh_key.go
+++ b/internal/commands/account_ssh_key.go
@@ -61,7 +61,7 @@ func newAccountSSHKeyListCmd() *cobra.Command {
 				if err != nil {
 					return fmt.Errorf("failed to list SSH keys: %w", err)
 				}
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			data, meta, err := parseResponseWithMeta(body)
@@ -127,7 +127,7 @@ func newAccountSSHKeyShowCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -187,7 +187,7 @@ func newAccountSSHKeyCreateCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -246,7 +246,7 @@ func newAccountSSHKeyDeleteCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			output.PrintMessage(cmd.OutOrStdout(), "SSH key deleted successfully.")
diff --git a/internal/commands/archive.go b/internal/commands/archive.go
index 74d6319..3e27c19 100644
--- a/internal/commands/archive.go
+++ b/internal/commands/archive.go
@@ -13,7 +13,7 @@ import (
 	"github.com/built-fast/vector-cli/internal/output"
 )
 
-func uploadMultipart(cmd *cobra.Command, app *appctx.App, file *os.File, fileSize int64, filename string, importID string, uploadParts []any) ([]map[string]any, error) {
+func uploadMultipart(cmd *cobra.Command, app *appctx.App, file *os.File, fileSize int64, filename string, uploadParts []any) ([]map[string]any, error) {
 	w := cmd.ErrOrStderr()
 	partCount := int64(len(uploadParts))
 	baseSize := fileSize / partCount
@@ -177,7 +177,7 @@ func newArchiveImportCmd() *cobra.Command {
 					return fmt.Errorf("multipart import session response missing upload parts")
 				}
 
-				completedParts, uploadErr := uploadMultipart(cmd, app, file, fileSize, filename, importID, uploadParts)
+				completedParts, uploadErr := uploadMultipart(cmd, app, file, fileSize, filename, uploadParts)
 				if uploadErr != nil {
 					return uploadErr
 				}
@@ -224,7 +224,7 @@ func newArchiveImportCmd() *cobra.Command {
 			_, _ = fmt.Fprintln(w, "Import started.")
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(runData))
+				return app.Output.JSON(runData)
 			}
 
 			var runItem map[string]any
diff --git a/internal/commands/auth.go b/internal/commands/auth.go
index 860bbb7..39cfdcc 100644
--- a/internal/commands/auth.go
+++ b/internal/commands/auth.go
@@ -265,7 +265,7 @@ func newAuthStatusCmd() *cobra.Command {
 					"account":       whoami.Data.Account,
 					"token_source":  app.TokenSource,
 					"config_dir":    configDir,
-					"api_url":       app.Config.ApiURL,
+					"api_url":       app.Config.APIURL,
 				})
 			}
 
@@ -276,7 +276,7 @@ func newAuthStatusCmd() *cobra.Command {
 				{Key: "Abilities", Value: strings.Join(whoami.Data.Token.Abilities, ", ")},
 				{Key: "Expires", Value: expires},
 				{Key: "Token source", Value: app.TokenSource},
-				{Key: "API URL", Value: app.Config.ApiURL},
+				{Key: "API URL", Value: app.Config.APIURL},
 				{Key: "Config directory", Value: configDir},
 			})
 			return nil
diff --git a/internal/commands/auth_test.go b/internal/commands/auth_test.go
index e8754c9..07c7932 100644
--- a/internal/commands/auth_test.go
+++ b/internal/commands/auth_test.go
@@ -327,7 +327,7 @@ func TestAuthLogin_Integration_ValidToken(t *testing.T) {
 	defer ts.Close()
 
 	// Write config with test server URL
-	cfg := &config.Config{ApiURL: ts.URL}
+	cfg := &config.Config{APIURL: ts.URL}
 	require.NoError(t, config.SaveConfig(cfg))
 
 	root, stdout := buildRootWithAuth()
@@ -352,7 +352,7 @@ func TestAuthLogin_Integration_InvalidToken(t *testing.T) {
 	ts := newTestServer("valid-token")
 	defer ts.Close()
 
-	cfg := &config.Config{ApiURL: ts.URL}
+	cfg := &config.Config{APIURL: ts.URL}
 	require.NoError(t, config.SaveConfig(cfg))
 
 	root, _ := buildRootWithAuth()
@@ -381,7 +381,7 @@ func TestAuthLogin_Integration_EnvToken(t *testing.T) {
 	ts := newTestServer("env-integration-token")
 	defer ts.Close()
 
-	cfg := &config.Config{ApiURL: ts.URL}
+	cfg := &config.Config{APIURL: ts.URL}
 	require.NoError(t, config.SaveConfig(cfg))
 
 	root, _ := buildRootWithAuth()
@@ -512,7 +512,7 @@ func TestAuthLogout_Integration_RemovesToken(t *testing.T) {
 	t.Setenv("VECTOR_NO_KEYRING", "")
 
 	// Save config and token
-	require.NoError(t, config.SaveConfig(&config.Config{ApiURL: "http://localhost"}))
+	require.NoError(t, config.SaveConfig(&config.Config{APIURL: "http://localhost"}))
 	require.NoError(t, config.Save("test-token"))
 
 	// Verify token exists in keyring
@@ -559,10 +559,10 @@ func buildRootWithAuth() (*cobra.Command, *bytes.Buffer) {
 					tokenSource = "keyring"
 				}
 			}
-			client := api.NewClient(cfg.ApiURL, token, "")
+			client := api.NewClient(cfg.APIURL, token, "")
 			jsonFlag, _ := cmd.Flags().GetBool("json")
-			noJsonFlag, _ := cmd.Flags().GetBool("no-json")
-			format := output.DetectFormat(jsonFlag, noJsonFlag)
+			noJSONFlag, _ := cmd.Flags().GetBool("no-json")
+			format := output.DetectFormat(jsonFlag, noJSONFlag)
 			app := appctx.NewApp(cfg, client, tokenSource)
 			app.Output = output.NewWriter(stdout, format)
 			cmd.SetContext(appctx.WithApp(cmd.Context(), app))
@@ -590,7 +590,7 @@ func buildAuthStatusCmd(baseURL, token, tokenSource string, format output.Format
 		Use: "vector",
 		PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
 			cfg := config.DefaultConfig()
-			cfg.ApiURL = baseURL
+			cfg.APIURL = baseURL
 			client := api.NewClient(baseURL, token, "test-agent")
 			app := appctx.NewApp(
 				cfg,
@@ -707,7 +707,7 @@ func TestAuthStatus_Integration_FullFlow(t *testing.T) {
 	defer ts.Close()
 
 	// Save config with test server URL
-	cfg := &config.Config{ApiURL: ts.URL}
+	cfg := &config.Config{APIURL: ts.URL}
 	require.NoError(t, config.SaveConfig(cfg))
 
 	// Step 1: Login
diff --git a/internal/commands/backup.go b/internal/commands/backup.go
index f97831f..1fb0ef0 100644
--- a/internal/commands/backup.go
+++ b/internal/commands/backup.go
@@ -95,7 +95,7 @@ func newBackupListCmd() *cobra.Command {
 				if err != nil {
 					return fmt.Errorf("failed to list backups: %w", err)
 				}
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			data, meta, err := parseResponseWithMeta(body)
@@ -167,7 +167,7 @@ func newBackupShowCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -254,7 +254,7 @@ func newBackupCreateCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
diff --git a/internal/commands/backup_download.go b/internal/commands/backup_download.go
index 2fc9a97..4b43c91 100644
--- a/internal/commands/backup_download.go
+++ b/internal/commands/backup_download.go
@@ -58,7 +58,7 @@ func newBackupDownloadCreateCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -117,7 +117,7 @@ func newBackupDownloadStatusCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
diff --git a/internal/commands/db.go b/internal/commands/db.go
index f67d321..7269c24 100644
--- a/internal/commands/db.go
+++ b/internal/commands/db.go
@@ -4,16 +4,16 @@ import (
 	"github.com/spf13/cobra"
 )
 
-// NewDbCmd creates the db command group.
-func NewDbCmd() *cobra.Command {
+// NewDBCmd creates the db command group.
+func NewDBCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "db",
 		Short: "Manage database operations",
 		Long:  "Manage database operations including import sessions and exports.",
 	}
 
-	cmd.AddCommand(NewDbImportSessionCmd())
-	cmd.AddCommand(NewDbExportCmd())
+	cmd.AddCommand(NewDBImportSessionCmd())
+	cmd.AddCommand(NewDBExportCmd())
 
 	return cmd
 }
diff --git a/internal/commands/db_export.go b/internal/commands/db_export.go
index d3596ab..0cef2ed 100644
--- a/internal/commands/db_export.go
+++ b/internal/commands/db_export.go
@@ -10,21 +10,21 @@ import (
 	"github.com/built-fast/vector-cli/internal/output"
 )
 
-// NewDbExportCmd creates the db export command group.
-func NewDbExportCmd() *cobra.Command {
+// NewDBExportCmd creates the db export command group.
+func NewDBExportCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "export",
 		Short: "Manage database exports",
 		Long:  "Create and check database export requests to download SQL dumps of site databases.",
 	}
 
-	cmd.AddCommand(newDbExportCreateCmd())
-	cmd.AddCommand(newDbExportStatusCmd())
+	cmd.AddCommand(newDBExportCreateCmd())
+	cmd.AddCommand(newDBExportStatusCmd())
 
 	return cmd
 }
 
-func newDbExportCreateCmd() *cobra.Command {
+func newDBExportCreateCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "create <site-id>",
 		Short: "Create a database export",
@@ -63,7 +63,7 @@ func newDbExportCreateCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -87,7 +87,7 @@ func newDbExportCreateCmd() *cobra.Command {
 	return cmd
 }
 
-func newDbExportStatusCmd() *cobra.Command {
+func newDBExportStatusCmd() *cobra.Command {
 	return &cobra.Command{
 		Use:   "status <site-id> <export-id>",
 		Short: "Check database export status",
@@ -122,7 +122,7 @@ func newDbExportStatusCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
diff --git a/internal/commands/db_export_test.go b/internal/commands/db_export_test.go
index 506dd89..067049e 100644
--- a/internal/commands/db_export_test.go
+++ b/internal/commands/db_export_test.go
@@ -69,7 +69,7 @@ var dbExportStatusPendingResponse = map[string]any{
 	"http_status": 200,
 }
 
-func newDbExportTestServer(validToken string) *httptest.Server {
+func newDBExportTestServer(validToken string) *httptest.Server {
 	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		auth := r.Header.Get("Authorization")
 		if auth != "Bearer "+validToken {
@@ -111,10 +111,10 @@ func newDbExportTestServer(validToken string) *httptest.Server {
 // --- Export Create Tests ---
 
 func TestDbExportCreateCmd_TableOutput(t *testing.T) {
-	ts := newDbExportTestServer("valid-token")
+	ts := newDBExportTestServer("valid-token")
 	defer ts.Close()
 
-	cmd, stdout, _ := buildDbCmd(ts.URL, "valid-token", output.Table)
+	cmd, stdout, _ := buildDBCmd(ts.URL, "valid-token", output.Table)
 	cmd.SetArgs([]string{"db", "export", "create", "site-001"})
 
 	err := cmd.Execute()
@@ -126,10 +126,10 @@ func TestDbExportCreateCmd_TableOutput(t *testing.T) {
 }
 
 func TestDbExportCreateCmd_JSONOutput(t *testing.T) {
-	ts := newDbExportTestServer("valid-token")
+	ts := newDBExportTestServer("valid-token")
 	defer ts.Close()
 
-	cmd, stdout, _ := buildDbCmd(ts.URL, "valid-token", output.JSON)
+	cmd, stdout, _ := buildDBCmd(ts.URL, "valid-token", output.JSON)
 	cmd.SetArgs([]string{"db", "export", "create", "site-001"})
 
 	err := cmd.Execute()
@@ -155,7 +155,7 @@ func TestDbExportCreateCmd_HTTPPath(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cmd, _, _ := buildDbCmd(ts.URL, "valid-token", output.Table)
+	cmd, _, _ := buildDBCmd(ts.URL, "valid-token", output.Table)
 	cmd.SetArgs([]string{"db", "export", "create", "site-001"})
 
 	err := cmd.Execute()
@@ -176,7 +176,7 @@ func TestDbExportCreateCmd_WithFormat(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cmd, _, _ := buildDbCmd(ts.URL, "valid-token", output.Table)
+	cmd, _, _ := buildDBCmd(ts.URL, "valid-token", output.Table)
 	cmd.SetArgs([]string{"db", "export", "create", "site-001", "--format", "csv"})
 
 	err := cmd.Execute()
@@ -185,10 +185,10 @@ func TestDbExportCreateCmd_WithFormat(t *testing.T) {
 }
 
 func TestDbExportCreateCmd_MissingArg(t *testing.T) {
-	ts := newDbExportTestServer("valid-token")
+	ts := newDBExportTestServer("valid-token")
 	defer ts.Close()
 
-	cmd, _, _ := buildDbCmd(ts.URL, "valid-token", output.Table)
+	cmd, _, _ := buildDBCmd(ts.URL, "valid-token", output.Table)
 	cmd.SetArgs([]string{"db", "export", "create"})
 
 	err := cmd.Execute()
@@ -197,10 +197,10 @@ func TestDbExportCreateCmd_MissingArg(t *testing.T) {
 }
 
 func TestDbExportCreateCmd_AuthError(t *testing.T) {
-	ts := newDbExportTestServer("valid-token")
+	ts := newDBExportTestServer("valid-token")
 	defer ts.Close()
 
-	cmd, _, _ := buildDbCmd(ts.URL, "bad-token", output.Table)
+	cmd, _, _ := buildDBCmd(ts.URL, "bad-token", output.Table)
 	cmd.SetArgs([]string{"db", "export", "create", "site-001"})
 
 	err := cmd.Execute()
@@ -212,7 +212,7 @@ func TestDbExportCreateCmd_AuthError(t *testing.T) {
 }
 
 func TestDbExportCreateCmd_NoAuth(t *testing.T) {
-	cmd, _, _ := buildDbCmdNoAuth(output.Table)
+	cmd, _, _ := buildDBCmdNoAuth(output.Table)
 	cmd.SetArgs([]string{"db", "export", "create", "site-001"})
 
 	err := cmd.Execute()
@@ -226,10 +226,10 @@ func TestDbExportCreateCmd_NoAuth(t *testing.T) {
 // --- Export Status Tests ---
 
 func TestDbExportStatusCmd_CompletedOutput(t *testing.T) {
-	ts := newDbExportTestServer("valid-token")
+	ts := newDBExportTestServer("valid-token")
 	defer ts.Close()
 
-	cmd, stdout, _ := buildDbCmd(ts.URL, "valid-token", output.Table)
+	cmd, stdout, _ := buildDBCmd(ts.URL, "valid-token", output.Table)
 	cmd.SetArgs([]string{"db", "export", "status", "site-001", "exp-001"})
 
 	err := cmd.Execute()
@@ -248,10 +248,10 @@ func TestDbExportStatusCmd_CompletedOutput(t *testing.T) {
 }
 
 func TestDbExportStatusCmd_PendingOutput(t *testing.T) {
-	ts := newDbExportTestServer("valid-token")
+	ts := newDBExportTestServer("valid-token")
 	defer ts.Close()
 
-	cmd, stdout, _ := buildDbCmd(ts.URL, "valid-token", output.Table)
+	cmd, stdout, _ := buildDBCmd(ts.URL, "valid-token", output.Table)
 	cmd.SetArgs([]string{"db", "export", "status", "site-001", "exp-pending"})
 
 	err := cmd.Execute()
@@ -265,10 +265,10 @@ func TestDbExportStatusCmd_PendingOutput(t *testing.T) {
 }
 
 func TestDbExportStatusCmd_JSONOutput(t *testing.T) {
-	ts := newDbExportTestServer("valid-token")
+	ts := newDBExportTestServer("valid-token")
 	defer ts.Close()
 
-	cmd, stdout, _ := buildDbCmd(ts.URL, "valid-token", output.JSON)
+	cmd, stdout, _ := buildDBCmd(ts.URL, "valid-token", output.JSON)
 	cmd.SetArgs([]string{"db", "export", "status", "site-001", "exp-001"})
 
 	err := cmd.Execute()
@@ -291,7 +291,7 @@ func TestDbExportStatusCmd_HTTPPath(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cmd, _, _ := buildDbCmd(ts.URL, "valid-token", output.Table)
+	cmd, _, _ := buildDBCmd(ts.URL, "valid-token", output.Table)
 	cmd.SetArgs([]string{"db", "export", "status", "site-001", "exp-001"})
 
 	err := cmd.Execute()
@@ -301,10 +301,10 @@ func TestDbExportStatusCmd_HTTPPath(t *testing.T) {
 }
 
 func TestDbExportStatusCmd_MissingArgs(t *testing.T) {
-	ts := newDbExportTestServer("valid-token")
+	ts := newDBExportTestServer("valid-token")
 	defer ts.Close()
 
-	cmd, _, _ := buildDbCmd(ts.URL, "valid-token", output.Table)
+	cmd, _, _ := buildDBCmd(ts.URL, "valid-token", output.Table)
 	cmd.SetArgs([]string{"db", "export", "status", "site-001"})
 
 	err := cmd.Execute()
@@ -313,10 +313,10 @@ func TestDbExportStatusCmd_MissingArgs(t *testing.T) {
 }
 
 func TestDbExportStatusCmd_AuthError(t *testing.T) {
-	ts := newDbExportTestServer("valid-token")
+	ts := newDBExportTestServer("valid-token")
 	defer ts.Close()
 
-	cmd, _, _ := buildDbCmd(ts.URL, "bad-token", output.Table)
+	cmd, _, _ := buildDBCmd(ts.URL, "bad-token", output.Table)
 	cmd.SetArgs([]string{"db", "export", "status", "site-001", "exp-001"})
 
 	err := cmd.Execute()
@@ -330,7 +330,7 @@ func TestDbExportStatusCmd_AuthError(t *testing.T) {
 // --- Help Tests ---
 
 func TestDbExportCmd_Help(t *testing.T) {
-	cmd := NewDbExportCmd()
+	cmd := NewDBExportCmd()
 
 	stdout := new(bytes.Buffer)
 	cmd.SetOut(stdout)
diff --git a/internal/commands/db_import_session.go b/internal/commands/db_import_session.go
index bed8399..38bd593 100644
--- a/internal/commands/db_import_session.go
+++ b/internal/commands/db_import_session.go
@@ -14,22 +14,22 @@ func importsPath(siteID string) string {
 	return sitesBasePath + "/" + siteID + "/imports"
 }
 
-// NewDbImportSessionCmd creates the db import-session command group.
-func NewDbImportSessionCmd() *cobra.Command {
+// NewDBImportSessionCmd creates the db import-session command group.
+func NewDBImportSessionCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "import-session",
 		Short: "Manage database import sessions",
 		Long:  "Manage database import sessions to import SQL dumps into your sites via a presigned upload URL.",
 	}
 
-	cmd.AddCommand(newDbImportSessionCreateCmd())
-	cmd.AddCommand(newDbImportSessionRunCmd())
-	cmd.AddCommand(newDbImportSessionStatusCmd())
+	cmd.AddCommand(newDBImportSessionCreateCmd())
+	cmd.AddCommand(newDBImportSessionRunCmd())
+	cmd.AddCommand(newDBImportSessionStatusCmd())
 
 	return cmd
 }
 
-func newDbImportSessionCreateCmd() *cobra.Command {
+func newDBImportSessionCreateCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "create <site-id>",
 		Short: "Create a database import session",
@@ -104,7 +104,7 @@ func newDbImportSessionCreateCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -154,7 +154,7 @@ func newDbImportSessionCreateCmd() *cobra.Command {
 	return cmd
 }
 
-func newDbImportSessionRunCmd() *cobra.Command {
+func newDBImportSessionRunCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "run <site-id> <import-id>",
 		Short: "Run a database import",
@@ -202,7 +202,7 @@ func newDbImportSessionRunCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -224,7 +224,7 @@ func newDbImportSessionRunCmd() *cobra.Command {
 	return cmd
 }
 
-func newDbImportSessionStatusCmd() *cobra.Command {
+func newDBImportSessionStatusCmd() *cobra.Command {
 	return &cobra.Command{
 		Use:   "status <site-id> <import-id>",
 		Short: "Check database import status",
@@ -259,7 +259,7 @@ func newDbImportSessionStatusCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
diff --git a/internal/commands/db_import_session_test.go b/internal/commands/db_import_session_test.go
index dd82130..74b9207 100644
--- a/internal/commands/db_import_session_test.go
+++ b/internal/commands/db_import_session_test.go
@@ -113,12 +113,12 @@ func newImportSessionTestServer(validToken string) *httptest.Server {
 	}))
 }
 
-func buildDbCmd(baseURL, token string, format output.Format) (*cobra.Command, *bytes.Buffer, *bytes.Buffer) {
+func buildDBCmd(baseURL, token string, format output.Format) (*cobra.Command, *bytes.Buffer, *bytes.Buffer) {
 	stdout := new(bytes.Buffer)
 	stderr := new(bytes.Buffer)
 
 	root := &cobra.Command{Use: "vector"}
-	root.AddCommand(NewDbCmd())
+	root.AddCommand(NewDBCmd())
 
 	root.PersistentPreRunE = func(cmd *cobra.Command, args []string) error {
 		client := api.NewClient(baseURL, token, "")
@@ -134,12 +134,12 @@ func buildDbCmd(baseURL, token string, format output.Format) (*cobra.Command, *b
 	return root, stdout, stderr
 }
 
-func buildDbCmdNoAuth(format output.Format) (*cobra.Command, *bytes.Buffer, *bytes.Buffer) {
+func buildDBCmdNoAuth(format output.Format) (*cobra.Command, *bytes.Buffer, *bytes.Buffer) {
 	stdout := new(bytes.Buffer)
 	stderr := new(bytes.Buffer)
 
 	root := &cobra.Command{Use: "vector"}
-	root.AddCommand(NewDbCmd())
+	root.AddCommand(NewDBCmd())
 
 	root.PersistentPreRunE = func(cmd *cobra.Command, args []string) error {
 		client := api.NewClient("", "", "")
@@ -161,7 +161,7 @@ func TestDbImportSessionCreateCmd_TableOutput(t *testing.T) {
 	ts := newImportSessionTestServer("valid-token")
 	defer ts.Close()
 
-	cmd, stdout, _ := buildDbCmd(ts.URL, "valid-token", output.Table)
+	cmd, stdout, _ := buildDBCmd(ts.URL, "valid-token", output.Table)
 	cmd.SetArgs([]string{"db", "import-session", "create", "site-001", "--content-length", "52428800"})
 
 	err := cmd.Execute()
@@ -179,7 +179,7 @@ func TestDbImportSessionCreateCmd_JSONOutput(t *testing.T) {
 	ts := newImportSessionTestServer("valid-token")
 	defer ts.Close()
 
-	cmd, stdout, _ := buildDbCmd(ts.URL, "valid-token", output.JSON)
+	cmd, stdout, _ := buildDBCmd(ts.URL, "valid-token", output.JSON)
 	cmd.SetArgs([]string{"db", "import-session", "create", "site-001", "--content-length", "52428800"})
 
 	err := cmd.Execute()
@@ -205,7 +205,7 @@ func TestDbImportSessionCreateCmd_HTTPPath(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cmd, _, _ := buildDbCmd(ts.URL, "valid-token", output.Table)
+	cmd, _, _ := buildDBCmd(ts.URL, "valid-token", output.Table)
 	cmd.SetArgs([]string{"db", "import-session", "create", "site-001", "--content-length", "52428800"})
 
 	err := cmd.Execute()
@@ -227,7 +227,7 @@ func TestDbImportSessionCreateCmd_WithOptions(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cmd, _, _ := buildDbCmd(ts.URL, "valid-token", output.Table)
+	cmd, _, _ := buildDBCmd(ts.URL, "valid-token", output.Table)
 	cmd.SetArgs([]string{
 		"db", "import-session", "create", "site-001",
 		"--filename", "dump.sql.gz",
@@ -259,7 +259,7 @@ func TestDbImportSessionCreateCmd_MissingArg(t *testing.T) {
 	ts := newImportSessionTestServer("valid-token")
 	defer ts.Close()
 
-	cmd, _, _ := buildDbCmd(ts.URL, "valid-token", output.Table)
+	cmd, _, _ := buildDBCmd(ts.URL, "valid-token", output.Table)
 	cmd.SetArgs([]string{"db", "import-session", "create"})
 
 	err := cmd.Execute()
@@ -271,7 +271,7 @@ func TestDbImportSessionCreateCmd_AuthError(t *testing.T) {
 	ts := newImportSessionTestServer("valid-token")
 	defer ts.Close()
 
-	cmd, _, _ := buildDbCmd(ts.URL, "bad-token", output.Table)
+	cmd, _, _ := buildDBCmd(ts.URL, "bad-token", output.Table)
 	cmd.SetArgs([]string{"db", "import-session", "create", "site-001", "--content-length", "1024"})
 
 	err := cmd.Execute()
@@ -283,7 +283,7 @@ func TestDbImportSessionCreateCmd_AuthError(t *testing.T) {
 }
 
 func TestDbImportSessionCreateCmd_NoAuth(t *testing.T) {
-	cmd, _, _ := buildDbCmdNoAuth(output.Table)
+	cmd, _, _ := buildDBCmdNoAuth(output.Table)
 	cmd.SetArgs([]string{"db", "import-session", "create", "site-001", "--content-length", "1024"})
 
 	err := cmd.Execute()
@@ -300,7 +300,7 @@ func TestDbImportSessionRunCmd_TableOutput(t *testing.T) {
 	ts := newImportSessionTestServer("valid-token")
 	defer ts.Close()
 
-	cmd, stdout, _ := buildDbCmd(ts.URL, "valid-token", output.Table)
+	cmd, stdout, _ := buildDBCmd(ts.URL, "valid-token", output.Table)
 	cmd.SetArgs([]string{"db", "import-session", "run", "site-001", "imp-001"})
 
 	err := cmd.Execute()
@@ -315,7 +315,7 @@ func TestDbImportSessionRunCmd_JSONOutput(t *testing.T) {
 	ts := newImportSessionTestServer("valid-token")
 	defer ts.Close()
 
-	cmd, stdout, _ := buildDbCmd(ts.URL, "valid-token", output.JSON)
+	cmd, stdout, _ := buildDBCmd(ts.URL, "valid-token", output.JSON)
 	cmd.SetArgs([]string{"db", "import-session", "run", "site-001", "imp-001"})
 
 	err := cmd.Execute()
@@ -338,7 +338,7 @@ func TestDbImportSessionRunCmd_HTTPPath(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cmd, _, _ := buildDbCmd(ts.URL, "valid-token", output.Table)
+	cmd, _, _ := buildDBCmd(ts.URL, "valid-token", output.Table)
 	cmd.SetArgs([]string{"db", "import-session", "run", "site-001", "imp-001"})
 
 	err := cmd.Execute()
@@ -351,7 +351,7 @@ func TestDbImportSessionRunCmd_MissingArgs(t *testing.T) {
 	ts := newImportSessionTestServer("valid-token")
 	defer ts.Close()
 
-	cmd, _, _ := buildDbCmd(ts.URL, "valid-token", output.Table)
+	cmd, _, _ := buildDBCmd(ts.URL, "valid-token", output.Table)
 	cmd.SetArgs([]string{"db", "import-session", "run", "site-001"})
 
 	err := cmd.Execute()
@@ -363,7 +363,7 @@ func TestDbImportSessionRunCmd_AuthError(t *testing.T) {
 	ts := newImportSessionTestServer("valid-token")
 	defer ts.Close()
 
-	cmd, _, _ := buildDbCmd(ts.URL, "bad-token", output.Table)
+	cmd, _, _ := buildDBCmd(ts.URL, "bad-token", output.Table)
 	cmd.SetArgs([]string{"db", "import-session", "run", "site-001", "imp-001"})
 
 	err := cmd.Execute()
@@ -375,7 +375,7 @@ func TestDbImportSessionRunCmd_AuthError(t *testing.T) {
 }
 
 func TestDbImportSessionRunCmd_NoAuth(t *testing.T) {
-	cmd, _, _ := buildDbCmdNoAuth(output.Table)
+	cmd, _, _ := buildDBCmdNoAuth(output.Table)
 	cmd.SetArgs([]string{"db", "import-session", "run", "site-001", "imp-001"})
 
 	err := cmd.Execute()
@@ -392,7 +392,7 @@ func TestDbImportSessionStatusCmd_TableOutput(t *testing.T) {
 	ts := newImportSessionTestServer("valid-token")
 	defer ts.Close()
 
-	cmd, stdout, _ := buildDbCmd(ts.URL, "valid-token", output.Table)
+	cmd, stdout, _ := buildDBCmd(ts.URL, "valid-token", output.Table)
 	cmd.SetArgs([]string{"db", "import-session", "status", "site-001", "imp-001"})
 
 	err := cmd.Execute()
@@ -411,7 +411,7 @@ func TestDbImportSessionStatusCmd_JSONOutput(t *testing.T) {
 	ts := newImportSessionTestServer("valid-token")
 	defer ts.Close()
 
-	cmd, stdout, _ := buildDbCmd(ts.URL, "valid-token", output.JSON)
+	cmd, stdout, _ := buildDBCmd(ts.URL, "valid-token", output.JSON)
 	cmd.SetArgs([]string{"db", "import-session", "status", "site-001", "imp-001"})
 
 	err := cmd.Execute()
@@ -434,7 +434,7 @@ func TestDbImportSessionStatusCmd_HTTPPath(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cmd, _, _ := buildDbCmd(ts.URL, "valid-token", output.Table)
+	cmd, _, _ := buildDBCmd(ts.URL, "valid-token", output.Table)
 	cmd.SetArgs([]string{"db", "import-session", "status", "site-001", "imp-001"})
 
 	err := cmd.Execute()
@@ -447,7 +447,7 @@ func TestDbImportSessionStatusCmd_MissingArgs(t *testing.T) {
 	ts := newImportSessionTestServer("valid-token")
 	defer ts.Close()
 
-	cmd, _, _ := buildDbCmd(ts.URL, "valid-token", output.Table)
+	cmd, _, _ := buildDBCmd(ts.URL, "valid-token", output.Table)
 	cmd.SetArgs([]string{"db", "import-session", "status", "site-001"})
 
 	err := cmd.Execute()
@@ -459,7 +459,7 @@ func TestDbImportSessionStatusCmd_AuthError(t *testing.T) {
 	ts := newImportSessionTestServer("valid-token")
 	defer ts.Close()
 
-	cmd, _, _ := buildDbCmd(ts.URL, "bad-token", output.Table)
+	cmd, _, _ := buildDBCmd(ts.URL, "bad-token", output.Table)
 	cmd.SetArgs([]string{"db", "import-session", "status", "site-001", "imp-001"})
 
 	err := cmd.Execute()
@@ -531,7 +531,7 @@ func TestDbImportSessionCreateCmd_MultipartTableOutput(t *testing.T) {
 	ts := newImportSessionMultipartTestServer("valid-token")
 	defer ts.Close()
 
-	cmd, stdout, _ := buildDbCmd(ts.URL, "valid-token", output.Table)
+	cmd, stdout, _ := buildDBCmd(ts.URL, "valid-token", output.Table)
 	cmd.SetArgs([]string{"db", "import-session", "create", "site-001", "--content-length", "16106127360"})
 
 	err := cmd.Execute()
@@ -554,7 +554,7 @@ func TestDbImportSessionCreateCmd_MultipartJSONOutput(t *testing.T) {
 	ts := newImportSessionMultipartTestServer("valid-token")
 	defer ts.Close()
 
-	cmd, stdout, _ := buildDbCmd(ts.URL, "valid-token", output.JSON)
+	cmd, stdout, _ := buildDBCmd(ts.URL, "valid-token", output.JSON)
 	cmd.SetArgs([]string{"db", "import-session", "create", "site-001", "--content-length", "16106127360"})
 
 	err := cmd.Execute()
@@ -582,7 +582,7 @@ func TestDbImportSessionRunCmd_WithParts(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cmd, stdout, _ := buildDbCmd(ts.URL, "valid-token", output.Table)
+	cmd, stdout, _ := buildDBCmd(ts.URL, "valid-token", output.Table)
 	cmd.SetArgs([]string{
 		"db", "import-session", "run", "site-001", "imp-001",
 		"--parts", `[{"part_number":1,"etag":"\"etag1\""},{"part_number":2,"etag":"\"etag2\""}]`,
@@ -618,7 +618,7 @@ func TestDbImportSessionRunCmd_WithoutParts(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cmd, _, _ := buildDbCmd(ts.URL, "valid-token", output.Table)
+	cmd, _, _ := buildDBCmd(ts.URL, "valid-token", output.Table)
 	cmd.SetArgs([]string{"db", "import-session", "run", "site-001", "imp-001"})
 
 	err := cmd.Execute()
@@ -632,7 +632,7 @@ func TestDbImportSessionRunCmd_InvalidPartsJSON(t *testing.T) {
 	ts := newImportSessionTestServer("valid-token")
 	defer ts.Close()
 
-	cmd, _, _ := buildDbCmd(ts.URL, "valid-token", output.Table)
+	cmd, _, _ := buildDBCmd(ts.URL, "valid-token", output.Table)
 	cmd.SetArgs([]string{
 		"db", "import-session", "run", "site-001", "imp-001",
 		"--parts", "not-valid-json",
@@ -646,7 +646,7 @@ func TestDbImportSessionRunCmd_InvalidPartsJSON(t *testing.T) {
 // --- Help Tests ---
 
 func TestDbImportSessionCmd_Help(t *testing.T) {
-	cmd := NewDbImportSessionCmd()
+	cmd := NewDBImportSessionCmd()
 
 	stdout := new(bytes.Buffer)
 	cmd.SetOut(stdout)
diff --git a/internal/commands/db_test.go b/internal/commands/db_test.go
index 164086d..bb4bd05 100644
--- a/internal/commands/db_test.go
+++ b/internal/commands/db_test.go
@@ -9,7 +9,7 @@ import (
 )
 
 func TestDbCmd_HelpText(t *testing.T) {
-	cmd := NewDbCmd()
+	cmd := NewDBCmd()
 
 	stdout := new(bytes.Buffer)
 	cmd.SetOut(stdout)
diff --git a/internal/commands/deploy.go b/internal/commands/deploy.go
index 5856728..5ad8ab6 100644
--- a/internal/commands/deploy.go
+++ b/internal/commands/deploy.go
@@ -63,7 +63,7 @@ func newDeployListCmd() *cobra.Command {
 				if err != nil {
 					return fmt.Errorf("failed to list deployments: %w", err)
 				}
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			data, meta, err := parseResponseWithMeta(body)
@@ -129,7 +129,7 @@ func newDeployShowCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -221,7 +221,7 @@ func newDeployTriggerCmd() *cobra.Command {
 
 			if !waitEnabled {
 				if app.Output.Format() == output.JSON {
-					return app.Output.JSON(json.RawMessage(data))
+					return app.Output.JSON(data)
 				}
 
 				var item map[string]any
@@ -255,7 +255,7 @@ func newDeployTriggerCmd() *cobra.Command {
 				Interval:         interval,
 				Timeout:          timeout,
 				TerminalStatuses: map[string]bool{"deployed": true},
-				FailedStatuses:   map[string]bool{"failed": true, "cancelled": true},
+				FailedStatuses:   map[string]bool{"failed": true, "canceled": true},
 				Noun:             "Deployment",
 				FormatDisplay:    deployFormatDisplay,
 			}
@@ -357,7 +357,7 @@ func newDeployRollbackCmd() *cobra.Command {
 
 			if !waitEnabled {
 				if app.Output.Format() == output.JSON {
-					return app.Output.JSON(json.RawMessage(data))
+					return app.Output.JSON(data)
 				}
 
 				var item map[string]any
@@ -391,7 +391,7 @@ func newDeployRollbackCmd() *cobra.Command {
 				Interval:         interval,
 				Timeout:          timeout,
 				TerminalStatuses: map[string]bool{"deployed": true},
-				FailedStatuses:   map[string]bool{"failed": true, "cancelled": true},
+				FailedStatuses:   map[string]bool{"failed": true, "canceled": true},
 				Noun:             "Deployment",
 				FormatDisplay:    deployFormatDisplay,
 			}
diff --git a/internal/commands/deploy_test.go b/internal/commands/deploy_test.go
index b81114e..50f12b6 100644
--- a/internal/commands/deploy_test.go
+++ b/internal/commands/deploy_test.go
@@ -886,7 +886,7 @@ func TestDeployRollbackCmd_WaitFailure(t *testing.T) {
 
 	ts := newDeployWaitTestServer("valid-token", []countingResponse{
 		makeDeployPollResponse("dep-006", "pending"),
-		makeDeployPollResponse("dep-006", "cancelled"),
+		makeDeployPollResponse("dep-006", "canceled"),
 	})
 	defer ts.Close()
 
@@ -900,7 +900,7 @@ func TestDeployRollbackCmd_WaitFailure(t *testing.T) {
 	require.ErrorAs(t, err, &apiErr)
 	assert.Equal(t, 1, apiErr.ExitCode)
 	assert.Contains(t, apiErr.Message, "failed status")
-	assert.Contains(t, apiErr.Message, "cancelled")
+	assert.Contains(t, apiErr.Message, "canceled")
 }
 
 func TestDeployRollbackCmd_WaitJSON(t *testing.T) {
diff --git a/internal/commands/env.go b/internal/commands/env.go
index e62c746..8641b8e 100644
--- a/internal/commands/env.go
+++ b/internal/commands/env.go
@@ -68,7 +68,7 @@ func newEnvListCmd() *cobra.Command {
 				if err != nil {
 					return fmt.Errorf("failed to list environments: %w", err)
 				}
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			data, meta, err := parseResponseWithMeta(body)
@@ -137,7 +137,7 @@ func newEnvShowCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -253,7 +253,7 @@ func newEnvCreateCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -351,7 +351,7 @@ func newEnvUpdateCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -432,7 +432,7 @@ func newEnvDeleteCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
diff --git a/internal/commands/env_db.go b/internal/commands/env_db.go
index 645890b..98c7b40 100644
--- a/internal/commands/env_db.go
+++ b/internal/commands/env_db.go
@@ -70,7 +70,7 @@ func newEnvDBPromoteCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -126,7 +126,7 @@ func newEnvDBPromoteStatusCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
diff --git a/internal/commands/env_secret.go b/internal/commands/env_secret.go
index 2c08846..50f320f 100644
--- a/internal/commands/env_secret.go
+++ b/internal/commands/env_secret.go
@@ -63,7 +63,7 @@ func newEnvSecretListCmd() *cobra.Command {
 				if err != nil {
 					return fmt.Errorf("failed to list secrets: %w", err)
 				}
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			data, meta, err := parseResponseWithMeta(body)
@@ -129,7 +129,7 @@ func newEnvSecretShowCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -204,7 +204,7 @@ func newEnvSecretCreateCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -277,7 +277,7 @@ func newEnvSecretUpdateCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -344,7 +344,7 @@ func newEnvSecretDeleteCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			app.Output.Message("Secret deleted successfully.")
diff --git a/internal/commands/event.go b/internal/commands/event.go
index 640f61a..359027b 100644
--- a/internal/commands/event.go
+++ b/internal/commands/event.go
@@ -83,7 +83,7 @@ func newEventListCmd() *cobra.Command {
 				if err != nil {
 					return fmt.Errorf("failed to list events: %w", err)
 				}
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			data, meta, err := parseResponseWithMeta(body)
diff --git a/internal/commands/helpers_test.go b/internal/commands/helpers_test.go
index 8e78694..1579409 100644
--- a/internal/commands/helpers_test.go
+++ b/internal/commands/helpers_test.go
@@ -259,9 +259,9 @@ func TestGetString(t *testing.T) {
 	m := map[string]any{"name": "test", "count": 42, "nil": nil}
 
 	assert.Equal(t, "test", getString(m, "name"))
-	assert.Equal(t, "", getString(m, "missing"))
-	assert.Equal(t, "", getString(m, "count"))
-	assert.Equal(t, "", getString(m, "nil"))
+	assert.Empty(t, getString(m, "missing"))
+	assert.Empty(t, getString(m, "count"))
+	assert.Empty(t, getString(m, "nil"))
 }
 
 func TestGetFloat(t *testing.T) {
@@ -276,10 +276,10 @@ func TestGetFloat(t *testing.T) {
 func TestGetBool(t *testing.T) {
 	m := map[string]any{"active": true, "name": "test", "nil": nil}
 
-	assert.Equal(t, true, getBool(m, "active"))
-	assert.Equal(t, false, getBool(m, "missing"))
-	assert.Equal(t, false, getBool(m, "name"))
-	assert.Equal(t, false, getBool(m, "nil"))
+	assert.True(t, getBool(m, "active"))
+	assert.False(t, getBool(m, "missing"))
+	assert.False(t, getBool(m, "name"))
+	assert.False(t, getBool(m, "nil"))
 }
 
 func TestGetSlice(t *testing.T) {
diff --git a/internal/commands/mcp_test.go b/internal/commands/mcp_test.go
index a8f7c71..a83060b 100644
--- a/internal/commands/mcp_test.go
+++ b/internal/commands/mcp_test.go
@@ -247,9 +247,7 @@ func TestMcpSetupCmd_CodeProjectLevel(t *testing.T) {
 	configPath := filepath.Join(tmpDir, ".mcp.json")
 
 	// Change to temp dir so .mcp.json is created there
-	origDir, _ := os.Getwd()
-	require.NoError(t, os.Chdir(tmpDir))
-	defer func() { _ = os.Chdir(origDir) }()
+	t.Chdir(tmpDir)
 
 	cmd, stdout, _ := buildMcpCmd("test-token-456", output.Table)
 	cmd.SetArgs([]string{"mcp", "setup", "--target", "code"})
@@ -284,9 +282,7 @@ func TestMcpSetupCmd_CodeGlobal(t *testing.T) {
 	configPath := filepath.Join(tmpDir, ".claude.json")
 
 	// Override HOME for the test
-	origHome := os.Getenv("HOME")
-	require.NoError(t, os.Setenv("HOME", tmpDir))
-	defer func() { _ = os.Setenv("HOME", origHome) }()
+	t.Setenv("HOME", tmpDir)
 
 	cmd, stdout, _ := buildMcpCmd("test-token-789", output.Table)
 	cmd.SetArgs([]string{"mcp", "setup", "--target", "code", "--global"})
@@ -315,9 +311,7 @@ func TestMcpSetupCmd_CodeAlreadyConfigured(t *testing.T) {
 	tmpDir := t.TempDir()
 	configPath := filepath.Join(tmpDir, ".mcp.json")
 
-	origDir, _ := os.Getwd()
-	require.NoError(t, os.Chdir(tmpDir))
-	defer func() { _ = os.Chdir(origDir) }()
+	t.Chdir(tmpDir)
 
 	existing := map[string]any{
 		"mcpServers": map[string]any{
@@ -343,9 +337,7 @@ func TestMcpSetupCmd_CodeForceOverwrite(t *testing.T) {
 	tmpDir := t.TempDir()
 	configPath := filepath.Join(tmpDir, ".mcp.json")
 
-	origDir, _ := os.Getwd()
-	require.NoError(t, os.Chdir(tmpDir))
-	defer func() { _ = os.Chdir(origDir) }()
+	t.Chdir(tmpDir)
 
 	existing := map[string]any{
 		"mcpServers": map[string]any{
diff --git a/internal/commands/php_version.go b/internal/commands/php_version.go
index 844d927..ee307c2 100644
--- a/internal/commands/php_version.go
+++ b/internal/commands/php_version.go
@@ -44,7 +44,7 @@ func NewPHPVersionsCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var items []map[string]any
diff --git a/internal/commands/restore.go b/internal/commands/restore.go
index 44d7ec4..a96e29e 100644
--- a/internal/commands/restore.go
+++ b/internal/commands/restore.go
@@ -89,7 +89,7 @@ func newRestoreListCmd() *cobra.Command {
 				if err != nil {
 					return fmt.Errorf("failed to list restores: %w", err)
 				}
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			data, meta, err := parseResponseWithMeta(body)
@@ -161,7 +161,7 @@ func newRestoreShowCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -254,7 +254,7 @@ func newRestoreCreateCmd() *cobra.Command {
 
 			if !waitEnabled {
 				if app.Output.Format() == output.JSON {
-					return app.Output.JSON(json.RawMessage(data))
+					return app.Output.JSON(data)
 				}
 
 				var item map[string]any
diff --git a/internal/commands/site.go b/internal/commands/site.go
index 512f0f2..77ea726 100644
--- a/internal/commands/site.go
+++ b/internal/commands/site.go
@@ -78,7 +78,7 @@ func newSiteListCmd() *cobra.Command {
 				if err != nil {
 					return fmt.Errorf("failed to list sites: %w", err)
 				}
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			data, meta, err := parseResponseWithMeta(body)
@@ -146,7 +146,7 @@ func newSiteShowCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -288,7 +288,7 @@ func newSiteCreateCmd() *cobra.Command {
 
 			if !waitEnabled {
 				if app.Output.Format() == output.JSON {
-					return app.Output.JSON(json.RawMessage(data))
+					return app.Output.JSON(data)
 				}
 
 				var item map[string]any
@@ -491,7 +491,7 @@ func newSiteUpdateCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -559,7 +559,7 @@ func newSiteDeleteCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -630,7 +630,7 @@ func newSiteCloneCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -721,7 +721,7 @@ func newSiteResetSFTPPasswordCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -777,7 +777,7 @@ func newSiteResetDBPasswordCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -837,7 +837,7 @@ func newSitePurgeCacheCmd() *cobra.Command {
 				if err != nil {
 					return fmt.Errorf("failed to purge cache: %w", err)
 				}
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			// Extract message from response
@@ -895,7 +895,7 @@ func newSiteLogsCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var logData map[string]any
@@ -969,7 +969,7 @@ func siteActionRunE(action, method string) func(*cobra.Command, []string) error
 		}
 
 		if app.Output.Format() == output.JSON {
-			return app.Output.JSON(json.RawMessage(data))
+			return app.Output.JSON(data)
 		}
 
 		var item map[string]any
@@ -1011,7 +1011,7 @@ func sitePostActionRunE(subPath, successMsg string) func(*cobra.Command, []strin
 		}
 
 		if app.Output.Format() == output.JSON {
-			return app.Output.JSON(json.RawMessage(data))
+			return app.Output.JSON(data)
 		}
 
 		// Extract message from full response
diff --git a/internal/commands/site_ssh_key.go b/internal/commands/site_ssh_key.go
index 3a495fb..7c2ca09 100644
--- a/internal/commands/site_ssh_key.go
+++ b/internal/commands/site_ssh_key.go
@@ -59,7 +59,7 @@ func newSSHKeyListCmd() *cobra.Command {
 				if err != nil {
 					return fmt.Errorf("failed to list SSH keys: %w", err)
 				}
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			data, meta, err := parseResponseWithMeta(body)
@@ -135,7 +135,7 @@ func newSSHKeyAddCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -193,7 +193,7 @@ func newSSHKeyRemoveCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			app.Output.Message("SSH key removed successfully.")
diff --git a/internal/commands/skill_test.go b/internal/commands/skill_test.go
index f4ec675..b6f47c4 100644
--- a/internal/commands/skill_test.go
+++ b/internal/commands/skill_test.go
@@ -136,7 +136,7 @@ func TestSkillInstallCopyFallback(t *testing.T) {
 	// Verify the Claude skills file is a regular file (not a symlink).
 	linkPath := filepath.Join(claudeDir, "vector", "SKILL.md")
 	_, err := os.Readlink(linkPath)
-	assert.Error(t, err, "expected a regular file, not a symlink")
+	require.Error(t, err, "expected a regular file, not a symlink")
 
 	// Verify content matches.
 	expected, err := skills.Content.ReadFile("vector/SKILL.md")
diff --git a/internal/commands/ssl.go b/internal/commands/ssl.go
index 92a9418..87e59a5 100644
--- a/internal/commands/ssl.go
+++ b/internal/commands/ssl.go
@@ -56,7 +56,7 @@ func newSSLStatusCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -119,7 +119,7 @@ func newSSLNudgeCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			// Extract message from response
diff --git a/internal/commands/waf_allowed_referrer.go b/internal/commands/waf_allowed_referrer.go
index 063de5c..fd56816 100644
--- a/internal/commands/waf_allowed_referrer.go
+++ b/internal/commands/waf_allowed_referrer.go
@@ -60,7 +60,7 @@ func newWafAllowedReferrerListCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var items []map[string]any
@@ -117,7 +117,7 @@ func newWafAllowedReferrerAddCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			app.Output.Message(fmt.Sprintf("Hostname %s added to allowed referrers.", args[1]))
@@ -157,7 +157,7 @@ func newWafAllowedReferrerRemoveCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			app.Output.Message(fmt.Sprintf("Hostname %s removed from allowed referrers.", args[1]))
diff --git a/internal/commands/waf_blocked_ip.go b/internal/commands/waf_blocked_ip.go
index 6c702c2..396b9d3 100644
--- a/internal/commands/waf_blocked_ip.go
+++ b/internal/commands/waf_blocked_ip.go
@@ -60,7 +60,7 @@ func newWafBlockedIPListCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var items []map[string]any
@@ -117,7 +117,7 @@ func newWafBlockedIPAddCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			app.Output.Message(fmt.Sprintf("IP %s added to blocklist.", args[1]))
@@ -157,7 +157,7 @@ func newWafBlockedIPRemoveCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			app.Output.Message(fmt.Sprintf("IP %s removed from blocklist.", args[1]))
diff --git a/internal/commands/waf_blocked_referrer.go b/internal/commands/waf_blocked_referrer.go
index b782471..41d2b5f 100644
--- a/internal/commands/waf_blocked_referrer.go
+++ b/internal/commands/waf_blocked_referrer.go
@@ -60,7 +60,7 @@ func newWafBlockedReferrerListCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var items []map[string]any
@@ -117,7 +117,7 @@ func newWafBlockedReferrerAddCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			app.Output.Message(fmt.Sprintf("Hostname %s added to blocked referrers.", args[1]))
@@ -157,7 +157,7 @@ func newWafBlockedReferrerRemoveCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			app.Output.Message(fmt.Sprintf("Hostname %s removed from blocked referrers.", args[1]))
diff --git a/internal/commands/waf_rate_limit.go b/internal/commands/waf_rate_limit.go
index 4cd2051..12c7322 100644
--- a/internal/commands/waf_rate_limit.go
+++ b/internal/commands/waf_rate_limit.go
@@ -63,7 +63,7 @@ func newWafRateLimitListCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var items []map[string]any
@@ -124,7 +124,7 @@ func newWafRateLimitShowCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -219,7 +219,7 @@ func newWafRateLimitCreateCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -340,7 +340,7 @@ func newWafRateLimitUpdateCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -410,7 +410,7 @@ func newWafRateLimitDeleteCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			app.Output.Message("Rate limit rule deleted successfully.")
diff --git a/internal/commands/wait.go b/internal/commands/wait.go
index 9bb17b8..01da53b 100644
--- a/internal/commands/wait.go
+++ b/internal/commands/wait.go
@@ -141,7 +141,7 @@ func renderWaitDisplay(w io.Writer, cfg *waitConfig, pollCount, estimatedPolls i
 }
 
 // waitForResource polls the API until the resource reaches a terminal or failed
-// status, the timeout expires, or the context is cancelled (e.g., Ctrl+C).
+// status, the timeout expires, or the context is canceled (e.g., Ctrl+C).
 func waitForResource(ctx context.Context, app *appctx.App, cfg *waitConfig) (*waitResult, error) {
 	ctx, stop := signal.NotifyContext(ctx, os.Interrupt)
 	defer stop()
@@ -166,7 +166,7 @@ func waitForResource(ctx context.Context, app *appctx.App, cfg *waitConfig) (*wa
 		select {
 		case <-ctx.Done():
 			return nil, &api.APIError{
-				Message:  fmt.Sprintf("%s wait cancelled", cfg.Noun),
+				Message:  fmt.Sprintf("%s wait canceled", cfg.Noun),
 				ExitCode: 1,
 			}
 		case <-deadline:
diff --git a/internal/commands/wait_test.go b/internal/commands/wait_test.go
index 5e0c3af..309409e 100644
--- a/internal/commands/wait_test.go
+++ b/internal/commands/wait_test.go
@@ -6,7 +6,6 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
-	"strings"
 	"sync/atomic"
 	"testing"
 	"time"
@@ -306,7 +305,7 @@ func TestWaitForResource_RespectsContextCancellation(t *testing.T) {
 	var apiErr *api.APIError
 	require.ErrorAs(t, err, &apiErr)
 	assert.Equal(t, 1, apiErr.ExitCode)
-	assert.Contains(t, apiErr.Message, "cancelled")
+	assert.Contains(t, apiErr.Message, "canceled")
 }
 
 func TestWaitForResource_TimesOut(t *testing.T) {
@@ -421,6 +420,6 @@ func TestWaitForResource_TTYWritesANSI(t *testing.T) {
 
 	altOutput := altBuf.String()
 	// TTY mode should have alt screen enter and exit sequences.
-	assert.True(t, strings.Contains(altOutput, ansiAltScreenEnter), "expected alt screen enter sequence")
-	assert.True(t, strings.Contains(altOutput, ansiAltScreenExit), "expected alt screen exit sequence")
+	assert.Contains(t, altOutput, ansiAltScreenEnter, "expected alt screen enter sequence")
+	assert.Contains(t, altOutput, ansiAltScreenExit, "expected alt screen exit sequence")
 }
diff --git a/internal/commands/webhook.go b/internal/commands/webhook.go
index e0a4a4d..1742306 100644
--- a/internal/commands/webhook.go
+++ b/internal/commands/webhook.go
@@ -63,7 +63,7 @@ func newWebhookListCmd() *cobra.Command {
 				if err != nil {
 					return fmt.Errorf("failed to list webhooks: %w", err)
 				}
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			data, meta, err := parseResponseWithMeta(body)
@@ -129,7 +129,7 @@ func newWebhookShowCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -197,7 +197,7 @@ func newWebhookCreateCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -291,7 +291,7 @@ func newWebhookUpdateCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			var item map[string]any
@@ -350,7 +350,7 @@ func newWebhookDeleteCmd() *cobra.Command {
 			}
 
 			if app.Output.Format() == output.JSON {
-				return app.Output.JSON(json.RawMessage(data))
+				return app.Output.JSON(data)
 			}
 
 			output.PrintMessage(cmd.OutOrStdout(), "Webhook deleted successfully.")
diff --git a/internal/config/config.go b/internal/config/config.go
index 90b37b1..d4c8312 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -12,13 +12,13 @@ const defaultAPIURL = "https://api.builtfast.com"
 
 // Config holds the CLI configuration.
 type Config struct {
-	ApiURL string `json:"api_url"`
+	APIURL string `json:"api_url"`
 }
 
 // DefaultConfig returns a Config with default values.
 func DefaultConfig() *Config {
 	return &Config{
-		ApiURL: defaultAPIURL,
+		APIURL: defaultAPIURL,
 	}
 }
 
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index 9800308..0e80a04 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -11,7 +11,7 @@ import (
 
 func TestDefaultConfig(t *testing.T) {
 	cfg := DefaultConfig()
-	assert.Equal(t, "https://api.builtfast.com", cfg.ApiURL)
+	assert.Equal(t, "https://api.builtfast.com", cfg.APIURL)
 }
 
 func TestLoadConfig_FileMissing(t *testing.T) {
@@ -20,7 +20,7 @@ func TestLoadConfig_FileMissing(t *testing.T) {
 
 	cfg, err := LoadConfig()
 	require.NoError(t, err)
-	assert.Equal(t, "https://api.builtfast.com", cfg.ApiURL)
+	assert.Equal(t, "https://api.builtfast.com", cfg.APIURL)
 }
 
 func TestLoadConfig_ValidFile(t *testing.T) {
@@ -33,7 +33,7 @@ func TestLoadConfig_ValidFile(t *testing.T) {
 
 	cfg, err := LoadConfig()
 	require.NoError(t, err)
-	assert.Equal(t, "https://custom.example.com", cfg.ApiURL)
+	assert.Equal(t, "https://custom.example.com", cfg.APIURL)
 }
 
 func TestLoadConfig_InvalidJSON(t *testing.T) {
@@ -46,7 +46,7 @@ func TestLoadConfig_InvalidJSON(t *testing.T) {
 
 	cfg, err := LoadConfig()
 	assert.Nil(t, cfg)
-	assert.Error(t, err)
+	require.Error(t, err)
 	assert.Contains(t, err.Error(), "invalid JSON in config file")
 }
 
@@ -55,7 +55,7 @@ func TestSaveConfig(t *testing.T) {
 	configDir := filepath.Join(tmpDir, "vector")
 	t.Setenv("VECTOR_CONFIG_DIR", configDir)
 
-	cfg := &Config{ApiURL: "https://custom.example.com"}
+	cfg := &Config{APIURL: "https://custom.example.com"}
 	err := SaveConfig(cfg)
 	require.NoError(t, err)
 
@@ -74,11 +74,11 @@ func TestSaveConfig_RoundTrip(t *testing.T) {
 	tmpDir := t.TempDir()
 	t.Setenv("VECTOR_CONFIG_DIR", tmpDir)
 
-	original := &Config{ApiURL: "https://roundtrip.example.com"}
+	original := &Config{APIURL: "https://roundtrip.example.com"}
 	err := SaveConfig(original)
 	require.NoError(t, err)
 
 	loaded, err := LoadConfig()
 	require.NoError(t, err)
-	assert.Equal(t, original.ApiURL, loaded.ApiURL)
+	assert.Equal(t, original.APIURL, loaded.APIURL)
 }
diff --git a/internal/output/output.go b/internal/output/output.go
index 3119ece..35787cc 100644
--- a/internal/output/output.go
+++ b/internal/output/output.go
@@ -27,11 +27,11 @@ var isTerminalFunc = func() bool {
 // --json flag forces JSON output, --no-json flag forces Table output.
 // When neither flag is set, it checks whether stdout is a terminal:
 // TTY → Table, non-TTY (piped) → JSON.
-func DetectFormat(jsonFlag, noJsonFlag bool) Format {
+func DetectFormat(jsonFlag, noJSONFlag bool) Format {
 	if jsonFlag {
 		return JSON
 	}
-	if noJsonFlag {
+	if noJSONFlag {
 		return Table
 	}
 	if isTerminalFunc() {
diff --git a/internal/surface/surface_test.go b/internal/surface/surface_test.go
index c3a586b..1b4ee95 100644
--- a/internal/surface/surface_test.go
+++ b/internal/surface/surface_test.go
@@ -81,11 +81,11 @@ func TestGenerateExcludesCompletion(t *testing.T) {
 	completion := &cobra.Command{Use: "completion", Short: "Generate completions"}
 	root.AddCommand(completion)
 
-	real := &cobra.Command{
+	realCmd := &cobra.Command{
 		Use:  "status",
 		RunE: func(cmd *cobra.Command, args []string) error { return nil },
 	}
-	root.AddCommand(real)
+	root.AddCommand(realCmd)
 
 	got := Generate(root)
 

From 16e228a785071383f046c323eade09efad8e44a7 Mon Sep 17 00:00:00 2001
From: Josh Priddle <jpriddle@me.com>
Date: Fri, 22 May 2026 21:33:24 -0400
Subject: [PATCH 2/2] fixup

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b604784..b97581c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,7 +32,7 @@ jobs:
       - name: Install golangci-lint
         uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
         with:
-          version: v2.11.3
+          version: v2.12.2
           args: --help
 
       - name: Quality - formatting