diff --git a/cmd/mred/main.go b/cmd/mred/main.go
new file mode 100644
index 0000000..065bbc7
--- /dev/null
+++ b/cmd/mred/main.go
@@ -0,0 +1,12 @@
+// Command mred is the Redmine CLI over the mopac-redmine-go library.
+package main
+
+import (
+	"os"
+
+	"git.knownelement.com/ukrrs/mopac-redmine-go/internal/cli"
+)
+
+func main() {
+	os.Exit(cli.Run(os.Args[1:], os.Stdout, os.Stderr))
+}
diff --git a/internal/cli/cli.go b/internal/cli/cli.go
new file mode 100644
index 0000000..868a523
--- /dev/null
+++ b/internal/cli/cli.go
@@ -0,0 +1,149 @@
+// Package cli implements the mred command line: a thin, machine-friendly
+// front end over the redmine library. Connection settings come from
+// MRED_URL / MRED_KEY env vars or a 0600 --config env file — the API key
+// is never a flag value and never logged. Every command accepts -o json
+// for machine output. Exit codes: 0 ok, 1 usage/config, 2 API error
+// (single-line stderr carrying the http status, parseable).
+package cli
+
+import (
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"git.knownelement.com/ukrrs/mopac-redmine-go/internal/config"
+	"git.knownelement.com/ukrrs/mopac-redmine-go/redmine"
+)
+
+const usage = `mred: Redmine CLI (stdlib-only, library-backed)
+
+Usage:
+  mred issue list -p PROJECT [--status open|all|closed|NAME] [--version NAME] [--limit N] [-o json]
+  mred issue show ID [--with journals] [-o json]
+  mred issue create -p PROJECT -s SUBJECT [--desc FILE|-] [--tracker NAME]
+                    [--priority NAME] [--category NAME] [--version NAME]
+                    [--due DATE] [--parent ID] [--est HOURS] [--note TEXT] [-o json]
+  mred issue update ID [--status NAME] [--priority NAME] [--category NAME]
+                    [--version NAME] [--due DATE] [--done-ratio N]
+                    [--desc FILE|-] [--note TEXT] [-o json]
+  mred version list -p PROJECT [-o json]
+  mred version create -p PROJECT -n NAME [--due DATE] [--status open|closed] [-o json]
+  mred category list -p PROJECT [-o json]
+  mred category create -p PROJECT -n NAME [-o json]
+  mred relation create FROM TO --type blocks|relates [-o json]
+  mred help
+
+Connection: MRED_URL + MRED_KEY env vars, or --config PATH pointing at a
+0600 env file with the same keys. The API key never appears in flags,
+logs, or error output.
+
+Names (--tracker feature, --priority immediate, --status done, --category
+and --version) are resolved case-insensitively against the server's own
+enumerations; issue ids are numeric.
+
+Exit codes: 0 ok, 1 usage/config error, 2 API error (stderr: one line,
+"http NNN" included).`
+
+// Run executes one command; it returns the process exit code.
+func Run(args []string, stdout, stderr io.Writer) int {
+	if len(args) == 0 {
+		fmt.Fprint(stderr, usage)
+		return 1
+	}
+	switch args[0] {
+	case "help", "-h", "--help":
+		fmt.Fprint(stdout, usage)
+		return 0
+	case "issue":
+		return cmdIssue(args[1:], stdout, stderr)
+	case "version":
+		return cmdVersion(args[1:], stdout, stderr)
+	case "category":
+		return cmdCategory(args[1:], stdout, stderr)
+	case "relation":
+		return cmdRelation(args[1:], stdout, stderr)
+	default:
+		fmt.Fprintf(stderr, "mred: unknown command %q\n\n%s\n", args[0], usage)
+		return 1
+	}
+}
+
+// newFlags builds a quiet flag set with the shared --config and -o flags.
+func newFlags(name string, stderr io.Writer) (*flag.FlagSet, *string, *string) {
+	fs := flag.NewFlagSet(name, flag.ContinueOnError)
+	fs.SetOutput(io.Discard)
+	cfg := fs.String("config", "", "env file with MRED_URL/MRED_KEY (must be 0600)")
+	out := fs.String("o", "text", "output format: text|json")
+	return fs, cfg, out
+}
+
+// parseArgs parses flags that may appear AFTER positionals (the standard
+// flag package stops at the first positional; mred's documented surface
+// is "issue update ID --note X", "relation create FROM TO --type blocks").
+// It returns the positional arguments.
+func parseArgs(fs *flag.FlagSet, args []string) ([]string, error) {
+	var positionals []string
+	rest := args
+	for {
+		if err := fs.Parse(rest); err != nil {
+			return nil, err
+		}
+		got := fs.Args()
+		i := 0
+		for i < len(got) && (got[i] == "-" || !strings.HasPrefix(got[i], "-")) {
+			i++
+		}
+		positionals = append(positionals, got[:i]...)
+		if i == len(got) {
+			return positionals, nil
+		}
+		rest = got[i:]
+	}
+}
+
+// client resolves config (env + optional 0600 file) and builds the client.
+// A nil client and non-nil error means exit 1; API failures surface later
+// as exit 2.
+func client(cfgPath string) (*redmine.Client, error) {
+	if cfgPath == "" {
+		cfgPath = os.Getenv("MRED_CONFIG")
+	}
+	if cfgPath == "" {
+		if home, err := os.UserHomeDir(); err == nil {
+			cand := filepath.Join(home, ".config", "mred", "env")
+			if _, err := os.Stat(cand); err == nil {
+				cfgPath = cand
+			}
+		}
+	}
+	cfg, _, err := config.Load(cfgPath)
+	if err != nil {
+		return nil, err
+	}
+	return redmine.New(redmine.Config{BaseURL: cfg.BaseURL, APIKey: cfg.APIKey}), nil
+}
+
+// apiErr reports an API failure the mred way: one line, exit 2.
+func apiErr(stderr io.Writer, err error) int {
+	fmt.Fprintf(stderr, "mred: %v\n", err)
+	return 2
+}
+
+// usageErr reports a usage/config failure: one line, exit 1.
+func usageErr(stderr io.Writer, format string, args ...any) int {
+	fmt.Fprintf(stderr, "mred: "+format+"\n", args...)
+	return 1
+}
+
+// emitJSON pretty-prints v for -o json.
+func emitJSON(stdout io.Writer, v any) {
+	b, err := marshalIndent(v)
+	if err != nil {
+		return // library types are JSON-clean by construction
+	}
+	stdout.Write(b)
+	fmt.Fprintln(stdout)
+}
diff --git a/internal/cli/cli_test.go b/internal/cli/cli_test.go
new file mode 100644
index 0000000..50a2909
--- /dev/null
+++ b/internal/cli/cli_test.go
@@ -0,0 +1,324 @@
+package cli
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+
+	"git.knownelement.com/ukrrs/mopac-redmine-go/internal/fakeredmine"
+)
+
+const testKey = "fake-redmine-key-0123456789"
+
+func boot(t *testing.T) *fakeredmine.Server {
+	t.Helper()
+	srv := fakeredmine.New(testKey)
+	t.Cleanup(srv.Close)
+	t.Setenv("MRED_URL", srv.URL)
+	t.Setenv("MRED_KEY", testKey)
+	return srv
+}
+
+func run(t *testing.T, args ...string) (string, string, int) {
+	t.Helper()
+	var out, errb strings.Builder
+	code := Run(args, &out, &errb)
+	return out.String(), errb.String(), code
+}
+
+func TestUsageErrors(t *testing.T) {
+	boot(t)
+	tests := []struct {
+		name string
+		args []string
+	}{
+		{"no args", nil},
+		{"unknown command", []string{"frobnicate"}},
+		{"issue alone", []string{"issue"}},
+		{"issue list without -p", []string{"issue", "list"}},
+		{"issue show without id", []string{"issue", "show"}},
+		{"issue create without subject", []string{"issue", "create", "-p", "MOPAC"}},
+		{"version create without name", []string{"version", "create", "-p", "MOPAC"}},
+		{"relation create without type", []string{"relation", "create", "1", "2"}},
+		{"relation create bad type", []string{"relation", "create", "1", "2", "--type", "destroys"}},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			out, errb, code := run(t, tt.args...)
+			if code != 1 {
+				t.Fatalf("code = %d (out %q, err %q), want 1", code, out, errb)
+			}
+			if out != "" {
+				t.Errorf("usage error wrote to stdout: %q", out)
+			}
+			if errb == "" {
+				t.Errorf("no diagnostic on stderr")
+			}
+		})
+	}
+}
+
+func TestConfigErrorIsExitOne(t *testing.T) {
+	boot(t)
+	t.Setenv("MRED_URL", "")
+	t.Setenv("MRED_KEY", "")
+	_, errb, code := run(t, "issue", "list", "-p", "MOPAC")
+	if code != 1 {
+		t.Fatalf("code = %d, want 1 (config)", code)
+	}
+	if !strings.Contains(errb, "MRED_URL") {
+		t.Fatalf("stderr = %q", errb)
+	}
+}
+
+func TestIssueCreateFullFlags(t *testing.T) {
+	srv := boot(t)
+	srv.AddVersion(fakeredmine.Version{Name: "Beta", Status: "open"})
+	srv.AddCategory("Quota & Backpressure")
+	parent := srv.AddIssue(fakeredmine.Issue{ProjectID: "MOPAC", Subject: "parent", StatusID: 1, TrackerID: 4, PriorityID: 2})
+
+	out, errb, code := run(t,
+		"issue", "create", "-p", "MOPAC",
+		"-s", "Quota: per-identity usage accounting",
+		"--desc", "-",
+		"--tracker", "feature",
+		"--priority", "immediate",
+		"--category", "quota & backpressure",
+		"--version", "beta",
+		"--due", "2026-08-31",
+		"--parent", itoa(parent),
+		"--est", "8",
+		"--note", "seed note",
+		"-o", "json",
+	)
+	if code != 0 {
+		t.Fatalf("code = %d, stderr = %q", code, errb)
+	}
+	var got struct {
+		Issue struct {
+			ID       int    `json:"id"`
+			Subject  string `json:"subject"`
+			Tracker  struct{ Name string } `json:"tracker"`
+			Priority struct{ Name string } `json:"priority"`
+			FixedVersion struct{ Name string } `json:"fixed_version"`
+		} `json:"issue"`
+	}
+	if err := json.Unmarshal([]byte(out), &got); err != nil {
+		t.Fatalf("stdout not json: %v (%q)", err, out)
+	}
+	i := got.Issue
+	if i.Subject != "Quota: per-identity usage accounting" ||
+		i.Tracker.Name != "Feature" || i.Priority.Name != "Immediate" ||
+		i.FixedVersion.Name != "Beta" {
+		t.Errorf("issue = %+v", i)
+	}
+	stored, ok := srv.Issue(i.ID)
+	if !ok || stored.EstimatedHours == nil || *stored.EstimatedHours != 8 || stored.ParentIssueID != parent {
+		t.Errorf("stored = %+v", stored)
+	}
+}
+
+func TestIssueCreateDescFile(t *testing.T) {
+	srv := boot(t)
+	path := filepath.Join(t.TempDir(), "desc.md")
+	os.WriteFile(path, []byte("## Scope\n- body from file"), 0o600)
+	_, errb, code := run(t, "issue", "create", "-p", "MOPAC", "-s", "from file", "--desc", path)
+	if code != 0 {
+		t.Fatalf("code = %d, stderr = %q", code, errb)
+	}
+	for _, r := range srv.Requests() {
+		if strings.Contains(r.Path, "/issues.json") && r.Method == "POST" {
+			var p struct {
+				Issue struct {
+					Description string `json:"description"`
+				} `json:"issue"`
+			}
+			json.Unmarshal([]byte(r.Body), &p)
+			if p.Issue.Description != "## Scope\n- body from file" {
+				t.Fatalf("description = %q", p.Issue.Description)
+			}
+			return
+		}
+	}
+	t.Fatal("no POST recorded")
+}
+
+func TestIssueListTextAndFilters(t *testing.T) {
+	srv := boot(t)
+	verID := srv.AddVersion(fakeredmine.Version{Name: "Beta", Status: "open"})
+	open := srv.AddIssue(fakeredmine.Issue{ProjectID: "MOPAC", Subject: "open one", StatusID: 1, TrackerID: 2, PriorityID: 2, FixedVersionID: verID})
+	done := srv.AddIssue(fakeredmine.Issue{ProjectID: "MOPAC", Subject: "done one", StatusID: 3, TrackerID: 2, PriorityID: 2})
+
+	out, errb, code := run(t, "issue", "list", "-p", "MOPAC")
+	if code != 0 {
+		t.Fatalf("code = %d, stderr = %q", code, errb)
+	}
+	if !strings.Contains(out, itoa(open)) || strings.Contains(out, itoa(done)) || !strings.Contains(out, "open one") {
+		t.Errorf("text list = %q", out)
+	}
+	if !strings.Contains(out, "Beta") {
+		t.Errorf("list omits version: %q", out)
+	}
+
+	out, _, code = run(t, "issue", "list", "-p", "MOPAC", "--status", "all")
+	if code != 0 || !strings.Contains(out, itoa(done)) {
+		t.Errorf("status all = %q code %d", out, code)
+	}
+
+	out, _, code = run(t, "issue", "list", "-p", "MOPAC", "--version", "Beta")
+	if code != 0 || !strings.Contains(out, itoa(open)) || strings.Contains(out, itoa(done)) {
+		t.Errorf("version filter = %q code %d", out, code)
+	}
+
+	out, _, code = run(t, "issue", "list", "-p", "MOPAC", "-o", "json")
+	if code != 0 {
+		t.Fatalf("json list code %d", code)
+	}
+	var arr struct {
+		Issues []struct {
+			ID int `json:"id"`
+		} `json:"issues"`
+	}
+	if err := json.Unmarshal([]byte(out), &arr); err != nil || len(arr.Issues) != 1 || arr.Issues[0].ID != open {
+		t.Errorf("json list = %q err %v", out, err)
+	}
+}
+
+func TestIssueShowWithJournals(t *testing.T) {
+	srv := boot(t)
+	id := srv.AddIssue(fakeredmine.Issue{
+		ProjectID: "MOPAC", Subject: "shown", StatusID: 2, TrackerID: 2, PriorityID: 3,
+		Description: "body text",
+		Journals:    []fakeredmine.JournalEntry{{ID: 1, Notes: "first note"}},
+	})
+	out, errb, code := run(t, "issue", "show", itoa(id), "--with", "journals")
+	if code != 0 {
+		t.Fatalf("code = %d, stderr = %q", code, errb)
+	}
+	for _, want := range []string{itoa(id), "shown", "body text", "In Progress", "first note"} {
+		if !strings.Contains(out, want) {
+			t.Errorf("show output missing %q:\n%s", want, out)
+		}
+	}
+}
+
+func TestIssueUpdateNoteStatusDoneRatio(t *testing.T) {
+	srv := boot(t)
+	srv.AddVersion(fakeredmine.Version{Name: "Beta", Status: "open"})
+	srv.AddCategory("Briefing")
+	id := srv.AddIssue(fakeredmine.Issue{ProjectID: "MOPAC", Subject: "target", StatusID: 2, TrackerID: 2, PriorityID: 2})
+
+	out, errb, code := run(t, "issue", "update", itoa(id),
+		"--status", "done", "--done-ratio", "100",
+		"--category", "briefing", "--version", "Beta",
+		"--priority", "immediate",
+		"--note", "REPORT delivered")
+	if code != 0 {
+		t.Fatalf("code = %d, stderr = %q", code, errb)
+	}
+	if !strings.Contains(out, itoa(id)) {
+		t.Errorf("update confirmation = %q", out)
+	}
+	stored, _ := srv.Issue(id)
+	if stored.StatusID != 3 || stored.DoneRatio != 100 || stored.CategoryID == 0 || stored.FixedVersionID == 0 || stored.PriorityID != 5 {
+		t.Errorf("stored = %+v", stored)
+	}
+	if len(stored.Journals) != 1 || stored.Journals[0].Notes != "REPORT delivered" {
+		t.Errorf("journals = %+v", stored.Journals)
+	}
+}
+
+func TestVersionCommands(t *testing.T) {
+	boot(t)
+	out, errb, code := run(t, "version", "create", "-p", "MOPAC", "-n", "Beta", "--due", "2026-08-31", "--status", "open")
+	if code != 0 {
+		t.Fatalf("create code = %d, stderr = %q", code, errb)
+	}
+	if !strings.Contains(out, "Beta") {
+		t.Errorf("create out = %q", out)
+	}
+	out, _, code = run(t, "version", "list", "-p", "MOPAC", "-o", "json")
+	if code != 0 {
+		t.Fatalf("list code %d", code)
+	}
+	var arr struct {
+		Versions []struct {
+			Name   string `json:"name"`
+			Status string `json:"status"`
+		} `json:"versions"`
+	}
+	if err := json.Unmarshal([]byte(out), &arr); err != nil || len(arr.Versions) != 1 || arr.Versions[0].Name != "Beta" || arr.Versions[0].Status != "open" {
+		t.Errorf("json = %q err %v", out, err)
+	}
+}
+
+func TestCategoryCommands(t *testing.T) {
+	boot(t)
+	_, errb, code := run(t, "category", "create", "-p", "MOPAC", "-n", "Secrets")
+	if code != 0 {
+		t.Fatalf("create code = %d, stderr = %q", code, errb)
+	}
+	out, _, _ := run(t, "category", "list", "-p", "MOPAC")
+	if !strings.Contains(out, "Secrets") {
+		t.Errorf("list = %q", out)
+	}
+}
+
+func TestRelationCreate(t *testing.T) {
+	srv := boot(t)
+	a := srv.AddIssue(fakeredmine.Issue{ProjectID: "MOPAC", Subject: "a", StatusID: 1, TrackerID: 2, PriorityID: 2})
+	b := srv.AddIssue(fakeredmine.Issue{ProjectID: "MOPAC", Subject: "b", StatusID: 1, TrackerID: 2, PriorityID: 2})
+	out, errb, code := run(t, "relation", "create", itoa(a), itoa(b), "--type", "blocks")
+	if code != 0 {
+		t.Fatalf("code = %d, stderr = %q", code, errb)
+	}
+	if !strings.Contains(out, "blocks") || !strings.Contains(out, itoa(b)) {
+		t.Errorf("out = %q", out)
+	}
+}
+
+func TestAPIErrorIsExitTwo(t *testing.T) {
+	srv := boot(t)
+	srv.Fail = &fakeredmine.FailSpec{Status: 404, Body: `{"errors":["gone %s"]}`}
+	out, errb, code := run(t, "issue", "show", "999")
+	if code != 2 {
+		t.Fatalf("code = %d, want 2", code)
+	}
+	if out != "" {
+		t.Errorf("stdout on API error: %q", out)
+	}
+	lines := strings.Split(strings.TrimRight(errb, "\n"), "\n")
+	if len(lines) != 1 || !strings.Contains(lines[0], "http 404") {
+		t.Fatalf("stderr = %q, want single parseable line with http 404", errb)
+	}
+}
+
+func TestKeyNeverPrinted(t *testing.T) {
+	srv := fakeredmine.New(testKey)
+	t.Cleanup(srv.Close)
+	t.Setenv("MRED_URL", srv.URL)
+	t.Setenv("MRED_KEY", "wrong-key-xyz")
+	_, errb, code := run(t, "issue", "list", "-p", "MOPAC")
+	if code != 2 {
+		t.Fatalf("code = %d, want 2", code)
+	}
+	if strings.Contains(errb, "wrong-key-xyz") || strings.Contains(errb, testKey) {
+		t.Fatalf("stderr leaks a key: %q", errb)
+	}
+	if strings.Count(errb, "\n") != 1 { // one diagnostic line + trailing newline
+		t.Fatalf("stderr not one line: %q", errb)
+	}
+}
+
+func TestHelpExitsZero(t *testing.T) {
+	boot(t)
+	out, _, code := run(t, "help")
+	if code != 0 || !strings.Contains(out, "issue") {
+		t.Fatalf("help code = %d out = %q", code, out)
+	}
+}
+
+func itoa(n int) string { return strconv.Itoa(n) }
diff --git a/internal/cli/commands.go b/internal/cli/commands.go
new file mode 100644
index 0000000..afa1e41
--- /dev/null
+++ b/internal/cli/commands.go
@@ -0,0 +1,541 @@
+package cli
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"strconv"
+	"strings"
+
+	"git.knownelement.com/ukrrs/mopac-redmine-go/redmine"
+)
+
+func marshalIndent(v any) ([]byte, error) { return json.MarshalIndent(v, "", "  ") }
+
+// --- issue -----------------------------------------------------------------
+
+func cmdIssue(args []string, stdout, stderr io.Writer) int {
+	if len(args) == 0 {
+		return usageErr(stderr, "issue: expected list|show|create|update (see mred help)")
+	}
+	sub, rest := args[0], args[1:]
+	switch sub {
+	case "list":
+		return cmdIssueList(rest, stdout, stderr)
+	case "show":
+		return cmdIssueShow(rest, stdout, stderr)
+	case "create":
+		return cmdIssueCreate(rest, stdout, stderr)
+	case "update":
+		return cmdIssueUpdate(rest, stdout, stderr)
+	default:
+		return usageErr(stderr, "issue: unknown subcommand %q", sub)
+	}
+}
+
+func cmdIssueList(args []string, stdout, stderr io.Writer) int {
+	fs, cfgPath, out := newFlags("issue list", stderr)
+	project := fs.String("p", "", "project identifier (required)")
+	status := fs.String("status", "open", "open|all|closed|status name")
+	version := fs.String("version", "", "target version name")
+	limit := fs.Int("limit", 0, "max issues returned (0 = server default)")
+	pos, err := parseArgs(fs, args)
+	if err != nil || len(pos) != 0 || *project == "" {
+		return usageErr(stderr, "issue list: usage: mred issue list -p PROJECT [--status open|all|NAME] [--version NAME] [--limit N]")
+	}
+	c, err := client(*cfgPath)
+	if err != nil {
+		return usageErr(stderr, "%v", err)
+	}
+	ctx := context.Background()
+
+	f := redmine.IssueFilter{Project: *project, Limit: *limit}
+	switch s := *status; s {
+	case "open", "all", "closed":
+		f.Status = map[string]string{"all": redmine.StatusAll}[s]
+		if f.Status == "" {
+			f.Status = s
+		}
+	default:
+		id, err := c.StatusIDByName(ctx, s)
+		if err != nil {
+			return apiErr(stderr, err)
+		}
+		f.Status = strconv.Itoa(id)
+	}
+	if *version != "" {
+		id, err := c.VersionIDByName(ctx, *project, *version)
+		if err != nil {
+			return apiErr(stderr, err)
+		}
+		f.FixedVersion = id
+	}
+
+	issues, _, err := c.ListIssues(ctx, f)
+	if err != nil {
+		return apiErr(stderr, err)
+	}
+	if *out == "json" {
+		emitJSON(stdout, map[string]any{"issues": issues})
+		return 0
+	}
+	for _, i := range issues {
+		line := fmt.Sprintf("%-6d %-14s %s", i.ID, i.Status.Name, i.Subject)
+		if i.FixedVersion.Name != "" {
+			line += "  @" + i.FixedVersion.Name
+		}
+		fmt.Fprintln(stdout, line)
+	}
+	return 0
+}
+
+func cmdIssueShow(args []string, stdout, stderr io.Writer) int {
+	fs, cfgPath, out := newFlags("issue show", stderr)
+	with := fs.String("with", "", "extra sections to include: journals")
+	pos, err := parseArgs(fs, args)
+	if err != nil || len(pos) != 1 {
+		return usageErr(stderr, "issue show: usage: mred issue show ID [--with journals]")
+	}
+	id, err := strconv.Atoi(pos[0])
+	if err != nil {
+		return usageErr(stderr, "issue show: ID must be numeric, got %q", pos[0])
+	}
+	c, err := client(*cfgPath)
+	if err != nil {
+		return usageErr(stderr, "%v", err)
+	}
+	withJournals := false
+	switch *with {
+	case "":
+	case "journals":
+		withJournals = true
+	default:
+		return usageErr(stderr, "issue show: --with understands only journals")
+	}
+	issue, err := c.GetIssue(context.Background(), id, withJournals)
+	if err != nil {
+		return apiErr(stderr, err)
+	}
+	if *out == "json" {
+		emitJSON(stdout, map[string]any{"issue": issue})
+		return 0
+	}
+	printIssue(stdout, issue, withJournals)
+	return 0
+}
+
+func printIssue(w io.Writer, i *redmine.Issue, withJournals bool) {
+	fmt.Fprintf(w, "#%d  %s\n", i.ID, i.Subject)
+	fmt.Fprintf(w, "Tracker: %-10s Status: %-12s Priority: %s\n", i.Tracker.Name, i.Status.Name, i.Priority.Name)
+	meta := "Project: " + i.Project.Name
+	if i.FixedVersion.Name != "" {
+		meta += "  Version: " + i.FixedVersion.Name
+	}
+	if i.Category.Name != "" {
+		meta += "  Category: " + i.Category.Name
+	}
+	if i.Parent.ID != 0 {
+		meta += "  Parent: #" + strconv.Itoa(i.Parent.ID)
+	}
+	fmt.Fprintln(w, meta)
+	facts := ""
+	if i.DueDate != "" {
+		facts += "Due: " + i.DueDate + "  "
+	}
+	if i.EstimatedHours != nil {
+		facts += fmt.Sprintf("Estimate: %gh  ", *i.EstimatedHours)
+	}
+	if i.DoneRatio != 0 {
+		facts += fmt.Sprintf("Done: %d%%  ", i.DoneRatio)
+	}
+	if facts != "" {
+		fmt.Fprintln(w, strings.TrimRight(facts, " "))
+	}
+	fmt.Fprintf(w, "Created: %s  Updated: %s\n", i.CreatedOn, i.UpdatedOn)
+	if i.Description != "" {
+		fmt.Fprintln(w)
+		fmt.Fprintln(w, i.Description)
+	}
+	if withJournals && len(i.Journals) > 0 {
+		fmt.Fprintln(w)
+		fmt.Fprintln(w, "Journals:")
+		for _, j := range i.Journals {
+			fmt.Fprintf(w, "* %s user %d: %s\n", j.CreatedOn, j.UserID, j.Notes)
+		}
+	}
+}
+
+func cmdIssueCreate(args []string, stdout, stderr io.Writer) int {
+	fs, cfgPath, out := newFlags("issue create", stderr)
+	project := fs.String("p", "", "project identifier (required)")
+	subject := fs.String("s", "", "subject (required)")
+	desc := fs.String("desc", "", "description from FILE, or - for stdin")
+	tracker := fs.String("tracker", "", "tracker name (e.g. feature)")
+	priority := fs.String("priority", "", "priority name (e.g. immediate)")
+	category := fs.String("category", "", "category name")
+	version := fs.String("version", "", "target version name")
+	due := fs.String("due", "", "due date YYYY-MM-DD")
+	parent := fs.Int("parent", 0, "parent issue id")
+	est := fs.Float64("est", 0, "estimated hours")
+	note := fs.String("note", "", "create-time journal note")
+	pos, perr := parseArgs(fs, args)
+	if perr != nil || len(pos) != 0 || *project == "" || *subject == "" {
+		return usageErr(stderr, "issue create: usage: mred issue create -p PROJECT -s SUBJECT [flags] (see mred help)")
+	}
+	c, err := client(*cfgPath)
+	if err != nil {
+		return usageErr(stderr, "%v", err)
+	}
+	ctx := context.Background()
+
+	p := redmine.IssueParams{Project: *project, Subject: *subject, DueDate: *due, Notes: *note}
+	if *desc != "" {
+		text, err := readDesc(*desc)
+		if err != nil {
+			return usageErr(stderr, "%v", err)
+		}
+		p.Description = text
+	}
+	if *tracker != "" {
+		if p.TrackerID, err = c.TrackerIDByName(ctx, *tracker); err != nil {
+			return apiErr(stderr, err)
+		}
+	}
+	if *priority != "" {
+		if p.PriorityID, err = c.PriorityIDByName(ctx, *priority); err != nil {
+			return apiErr(stderr, err)
+		}
+	}
+	if *category != "" {
+		if p.CategoryID, err = c.CategoryIDByName(ctx, *project, *category); err != nil {
+			return apiErr(stderr, err)
+		}
+	}
+	if *version != "" {
+		if p.FixedVersionID, err = c.VersionIDByName(ctx, *project, *version); err != nil {
+			return apiErr(stderr, err)
+		}
+	}
+	if *parent != 0 {
+		p.ParentIssueID = *parent
+	}
+	if *est != 0 {
+		p.EstimatedHours = est
+	}
+
+	issue, err := c.CreateIssue(ctx, p)
+	if err != nil {
+		return apiErr(stderr, err)
+	}
+	if *out == "json" {
+		emitJSON(stdout, map[string]any{"issue": issue})
+		return 0
+	}
+	fmt.Fprintf(stdout, "created issue #%d: %s\n", issue.ID, issue.Subject)
+	return 0
+}
+
+func cmdIssueUpdate(args []string, stdout, stderr io.Writer) int {
+	fs, cfgPath, out := newFlags("issue update", stderr)
+	status := fs.String("status", "", "status name (e.g. done, \"In Progress\")")
+	priority := fs.String("priority", "", "priority name")
+	category := fs.String("category", "", "category name")
+	version := fs.String("version", "", "target version name")
+	due := fs.String("due", "", "due date YYYY-MM-DD")
+	doneRatio := fs.Int("done-ratio", -1, "progress percent 0-100")
+	desc := fs.String("desc", "", "replace description from FILE, or - for stdin")
+	note := fs.String("note", "", "append a journal note")
+	pos, perr := parseArgs(fs, args)
+	if perr != nil || len(pos) != 1 {
+		return usageErr(stderr, "issue update: usage: mred issue update ID [flags] (see mred help)")
+	}
+	id, err := strconv.Atoi(pos[0])
+	if err != nil {
+		return usageErr(stderr, "issue update: ID must be numeric, got %q", pos[0])
+	}
+	c, err := client(*cfgPath)
+	if err != nil {
+		return usageErr(stderr, "%v", err)
+	}
+	ctx := context.Background()
+
+	p := redmine.IssueParams{Notes: *note}
+
+	// category/version names resolve within the issue's own project.
+	var projectID string
+	resolveProject := func() (string, error) {
+		if projectID != "" {
+			return projectID, nil
+		}
+		fresh, err := c.GetIssue(ctx, id, false)
+		if err != nil {
+			return "", err
+		}
+		if fresh.Project.ID == 0 {
+			return "", fmt.Errorf("issue #%d carries no project id", id)
+		}
+		projectID = strconv.Itoa(fresh.Project.ID)
+		return projectID, nil
+	}
+	if *status != "" {
+		if p.StatusID, err = c.StatusIDByName(ctx, *status); err != nil {
+			return apiErr(stderr, err)
+		}
+	}
+	if *priority != "" {
+		if p.PriorityID, err = c.PriorityIDByName(ctx, *priority); err != nil {
+			return apiErr(stderr, err)
+		}
+	}
+	if *category != "" {
+		proj, perr := resolveProject()
+		if perr != nil {
+			return apiErr(stderr, perr)
+		}
+		if p.CategoryID, err = c.CategoryIDByName(ctx, proj, *category); err != nil {
+			return apiErr(stderr, err)
+		}
+	}
+	if *version != "" {
+		proj, perr := resolveProject()
+		if perr != nil {
+			return apiErr(stderr, perr)
+		}
+		if p.FixedVersionID, err = c.VersionIDByName(ctx, proj, *version); err != nil {
+			return apiErr(stderr, err)
+		}
+	}
+	if *due != "" {
+		p.DueDate = *due
+	}
+	if *doneRatio >= 0 {
+		p.DoneRatio = *doneRatio
+	}
+	if *desc != "" {
+		text, err := readDesc(*desc)
+		if err != nil {
+			return usageErr(stderr, "%v", err)
+		}
+		p.Description = text
+	}
+
+	if err := c.UpdateIssue(ctx, id, p); err != nil {
+		return apiErr(stderr, err)
+	}
+	if *out == "json" {
+		fresh, err := c.GetIssue(ctx, id, false)
+		if err != nil {
+			return apiErr(stderr, err)
+		}
+		emitJSON(stdout, map[string]any{"issue": fresh})
+		return 0
+	}
+	fmt.Fprintf(stdout, "updated issue #%d\n", id)
+	return 0
+}
+
+// readDesc loads a description from a file, or from stdin when path is "-".
+func readDesc(path string) (string, error) {
+	if path == "-" {
+		b, err := io.ReadAll(os.Stdin)
+		if err != nil {
+			return "", fmt.Errorf("desc: cannot read stdin: %w", err)
+		}
+		return string(b), nil
+	}
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return "", fmt.Errorf("desc: cannot read %s", path)
+	}
+	return string(b), nil
+}
+
+// --- version ----------------------------------------------------------------
+
+func cmdVersion(args []string, stdout, stderr io.Writer) int {
+	if len(args) == 0 {
+		return usageErr(stderr, "version: expected list|create (see mred help)")
+	}
+	sub, rest := args[0], args[1:]
+	switch sub {
+	case "list":
+		return cmdVersionList(rest, stdout, stderr)
+	case "create":
+		return cmdVersionCreate(rest, stdout, stderr)
+	default:
+		return usageErr(stderr, "version: unknown subcommand %q", sub)
+	}
+}
+
+func cmdVersionList(args []string, stdout, stderr io.Writer) int {
+	fs, cfgPath, out := newFlags("version list", stderr)
+	project := fs.String("p", "", "project identifier (required)")
+	pos, err := parseArgs(fs, args)
+	if err != nil || len(pos) != 0 || *project == "" {
+		return usageErr(stderr, "version list: usage: mred version list -p PROJECT")
+	}
+	c, err := client(*cfgPath)
+	if err != nil {
+		return usageErr(stderr, "%v", err)
+	}
+	versions, err := c.ListVersions(context.Background(), *project)
+	if err != nil {
+		return apiErr(stderr, err)
+	}
+	if *out == "json" {
+		emitJSON(stdout, map[string]any{"versions": versions})
+		return 0
+	}
+	for _, v := range versions {
+		fmt.Fprintf(stdout, "%-6d %-10s %s %s\n", v.ID, v.Status, v.Name, dueSuffix(v.DueDate))
+	}
+	return 0
+}
+
+func cmdVersionCreate(args []string, stdout, stderr io.Writer) int {
+	fs, cfgPath, out := newFlags("version create", stderr)
+	project := fs.String("p", "", "project identifier (required)")
+	name := fs.String("n", "", "version name (required)")
+	due := fs.String("due", "", "due date YYYY-MM-DD")
+	status := fs.String("status", "open", "open|closed")
+	pos, err := parseArgs(fs, args)
+	if err != nil || len(pos) != 0 || *project == "" || *name == "" {
+		return usageErr(stderr, "version create: usage: mred version create -p PROJECT -n NAME [--due DATE] [--status open|closed]")
+	}
+	if *status != "open" && *status != "closed" && *status != "locked" {
+		return usageErr(stderr, "version create: --status must be open|closed|locked")
+	}
+	c, err := client(*cfgPath)
+	if err != nil {
+		return usageErr(stderr, "%v", err)
+	}
+	v, err := c.CreateVersion(context.Background(), *project, redmine.VersionParams{
+		Name: *name, DueDate: *due, Status: *status, Sharing: "descendants",
+	})
+	if err != nil {
+		return apiErr(stderr, err)
+	}
+	if *out == "json" {
+		emitJSON(stdout, map[string]any{"version": v})
+		return 0
+	}
+	fmt.Fprintf(stdout, "created version #%d %s (%s) %s\n", v.ID, v.Name, v.Status, dueSuffix(v.DueDate))
+	return 0
+}
+
+func dueSuffix(due string) string {
+	if due == "" {
+		return ""
+	}
+	return "due " + due
+}
+
+// --- category -----------------------------------------------------------------
+
+func cmdCategory(args []string, stdout, stderr io.Writer) int {
+	if len(args) == 0 {
+		return usageErr(stderr, "category: expected list|create (see mred help)")
+	}
+	sub, rest := args[0], args[1:]
+	switch sub {
+	case "list":
+		return cmdCategoryList(rest, stdout, stderr)
+	case "create":
+		return cmdCategoryCreate(rest, stdout, stderr)
+	default:
+		return usageErr(stderr, "category: unknown subcommand %q", sub)
+	}
+}
+
+func cmdCategoryList(args []string, stdout, stderr io.Writer) int {
+	fs, cfgPath, out := newFlags("category list", stderr)
+	project := fs.String("p", "", "project identifier (required)")
+	pos, err := parseArgs(fs, args)
+	if err != nil || len(pos) != 0 || *project == "" {
+		return usageErr(stderr, "category list: usage: mred category list -p PROJECT")
+	}
+	c, err := client(*cfgPath)
+	if err != nil {
+		return usageErr(stderr, "%v", err)
+	}
+	cats, err := c.ListCategories(context.Background(), *project)
+	if err != nil {
+		return apiErr(stderr, err)
+	}
+	if *out == "json" {
+		emitJSON(stdout, map[string]any{"issue_categories": cats})
+		return 0
+	}
+	for _, cat := range cats {
+		fmt.Fprintf(stdout, "%-6d %s\n", cat.ID, cat.Name)
+	}
+	return 0
+}
+
+func cmdCategoryCreate(args []string, stdout, stderr io.Writer) int {
+	fs, cfgPath, out := newFlags("category create", stderr)
+	project := fs.String("p", "", "project identifier (required)")
+	name := fs.String("n", "", "category name (required)")
+	pos, perr := parseArgs(fs, args)
+	if perr != nil || len(pos) != 0 || *project == "" || *name == "" {
+		return usageErr(stderr, "category create: usage: mred category create -p PROJECT -n NAME")
+	}
+	c, err := client(*cfgPath)
+	if err != nil {
+		return usageErr(stderr, "%v", err)
+	}
+	cat, err := c.CreateCategory(context.Background(), *project, *name)
+	if err != nil {
+		return apiErr(stderr, err)
+	}
+	if *out == "json" {
+		emitJSON(stdout, map[string]any{"issue_category": cat})
+		return 0
+	}
+	fmt.Fprintf(stdout, "created category #%d %s\n", cat.ID, cat.Name)
+	return 0
+}
+
+// --- relation -------------------------------------------------------------------
+
+func cmdRelation(args []string, stdout, stderr io.Writer) int {
+	if len(args) == 0 {
+		return usageErr(stderr, "relation: expected create (see mred help)")
+	}
+	if args[0] != "create" {
+		return usageErr(stderr, "relation: unknown subcommand %q", args[0])
+	}
+	fs, cfgPath, out := newFlags("relation create", stderr)
+	relType := fs.String("type", "", "blocks|relates (required)")
+	pos, err := parseArgs(fs, args[1:])
+	if err != nil || len(pos) != 2 || *relType == "" {
+		return usageErr(stderr, "relation create: usage: mred relation create FROM TO --type blocks|relates")
+	}
+	if *relType != "blocks" && *relType != "relates" {
+		return usageErr(stderr, "relation create: --type must be blocks|relates")
+	}
+	from, err := strconv.Atoi(pos[0])
+	if err != nil {
+		return usageErr(stderr, "relation create: FROM must be numeric, got %q", pos[0])
+	}
+	to, err := strconv.Atoi(pos[1])
+	if err != nil {
+		return usageErr(stderr, "relation create: TO must be numeric, got %q", pos[1])
+	}
+	c, err := client(*cfgPath)
+	if err != nil {
+		return usageErr(stderr, "%v", err)
+	}
+	rel, err := c.CreateRelation(context.Background(), from, to, *relType)
+	if err != nil {
+		return apiErr(stderr, err)
+	}
+	if *out == "json" {
+		emitJSON(stdout, map[string]any{"relation": rel})
+		return 0
+	}
+	fmt.Fprintf(stdout, "created relation #%d: %d %s %d\n", rel.ID, from, rel.RelationType, to)
+	return 0
+}
diff --git a/internal/fakeredmine/fakeredmine.go b/internal/fakeredmine/fakeredmine.go
index cb932ca..969938c 100644
--- a/internal/fakeredmine/fakeredmine.go
+++ b/internal/fakeredmine/fakeredmine.go
@@ -14,6 +14,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"sort"
 	"strconv"
 	"strings"
 	"sync"
@@ -308,13 +309,14 @@ func (s *Server) listIssues(q url.Values) (int, string) {
 		}
 	}
 	type out struct {
-		Issues    []Issue `json:"issues"`
-		Total     int     `json:"total_count"`
-		Offset    int     `json:"offset"`
-		Limit     int     `json:"limit"`
+		Issues    []map[string]any `json:"issues"`
+		Total     int              `json:"total_count"`
+		Offset    int              `json:"offset"`
+		Limit     int              `json:"limit"`
 	}
 	o := out{Limit: limit}
-	for _, i := range s.issues {
+	var ids []int
+	for id, i := range s.issues {
 		if proj != "" && i.ProjectID != proj {
 			continue
 		}
@@ -327,7 +329,11 @@ func (s *Server) listIssues(q url.Values) (int, string) {
 		if ver != "" && strconv.Itoa(i.FixedVersionID) != ver {
 			continue
 		}
-		o.Issues = append(o.Issues, *i)
+		ids = append(ids, id)
+	}
+	sort.Ints(ids)
+	for _, id := range ids {
+		o.Issues = append(o.Issues, issueView(s, *s.issues[id], false))
 	}
 	o.Total = len(o.Issues)
 	if len(o.Issues) > limit {