@muggleai/works 5.15.0-staging.105 → 5.15.0

package/config/runtime-targets.json

@@ -11,6 +11,7 @@
     "production": {
       "promptServiceBaseUrl": "https://promptservice.muggle-ai.com",
       "uiBaseUrl": "https://www.muggle-ai.com/muggleTestV0",
+      "dashboardBaseUrl": "https://www.muggle-ai.com/muggleTestV0/dashboard/projects",
       "auth0Domain": "login.muggle-ai.com",
       "auth0ClientId": "UgG5UjoyLksxMciWWKqVpwfWrJ4rFvtT",
       "auth0Audience": "https://muggleai.us.auth0.com/api/v2/",
@@ -19,6 +20,7 @@
     "staging": {
       "promptServiceBaseUrl": "https://staging.promptservice.muggle-ai.com",
       "uiBaseUrl": "https://staging.muggle-ai.com/muggleTestV0",
+      "dashboardBaseUrl": "https://staging.muggle-ai.com/muggleTestV0/dashboard/projects",
       "auth0Domain": "login.staging.muggle-ai.com",
       "auth0ClientId": "C6rmJN3FeX3EuGZdY8qbHpbJVRadxsly",
       "auth0Audience": "https://staging-muggleai.us.auth0.com/api/v2/",
@@ -27,6 +29,7 @@
     "dev": {
       "promptServiceBaseUrl": "http://localhost:5050",
       "uiBaseUrl": "http://localhost:3999/muggleTestV0",
+      "dashboardBaseUrl": "http://localhost:3999/muggleTestV0/dashboard/projects",
       "auth0Domain": "dev-po4mxmz0rd8a0w8w.us.auth0.com",
       "auth0ClientId": "GBvkMdTbCI80XJXnJ90MmbEvXwcWGUtw",
       "auth0Audience": "https://dev-po4mxmz0rd8a0w8w.us.auth0.com/api/v2/",

package/dist/{chunk-GMNAD3B6.js → chunk-FK7XVMVA.js}

@@ -1,4 +1,4 @@
-import { __export, getLogger, getConfig, createChildLogger, buildElectronAppReleaseAssetUrl, getActiveRuntimeTarget, getAuthService, hasApiKey, getElectronAppVersion, getElectronAppDir, getPlatformKey, reconcileProjectPreferences, getDataDir, PREFERENCES_FILE_NAME, isFirstRun, writePreferences, DEFAULT_PREFERENCES, isElectronAppInstalled, getElectronAppChecksums, getChecksumForPlatform, getElectronAppSignedFromVersion, getReleaseSignerIdentityUri, verifyFileChecksum, calculateFileChecksum, initTelemetry, Surface, ServiceName, track, EventName, getQaTools, getLocalQaTools, performLogout, assertDeviceCodeClientProvisioned, performLogin, toolRequiresAuth, getCallerCredentials, hasShownDisclosure, getDisclosureCopy, markDisclosureShown, getBundledElectronAppVersion, getElectronAppVersionSource, getCredentialsFilePath, buildElectronAppChecksumsUrl, __require } from './chunk-J6VC26BI.js';
+import { __export, getLogger, getConfig, createChildLogger, buildElectronAppReleaseAssetUrl, getActiveRuntimeTarget, getAuthService, hasApiKey, getElectronAppVersion, getElectronAppDir, getPlatformKey, reconcileProjectPreferences, getDataDir, PREFERENCES_FILE_NAME, isFirstRun, writePreferences, DEFAULT_PREFERENCES, isElectronAppInstalled, getElectronAppChecksums, getChecksumForPlatform, getElectronAppSignedFromVersion, getReleaseSignerIdentityUri, verifyFileChecksum, calculateFileChecksum, initTelemetry, Surface, ServiceName, track, EventName, getQaTools, getLocalQaTools, performLogout, assertDeviceCodeClientProvisioned, performLogin, toolRequiresAuth, getCallerCredentials, hasShownDisclosure, getDisclosureCopy, markDisclosureShown, getBundledElectronAppVersion, getElectronAppVersionSource, getCredentialsFilePath, buildElectronAppChecksumsUrl, __require } from './chunk-VQZLKLAY.js';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { ListToolsRequestSchema, CallToolRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { v4 } from 'uuid';
@@ -753,7 +753,7 @@ async function resolveGsScreenshotUrls(report, opts) {
     if (gsUrls.length === 0) {
       return report;
     }
-    const mcps = await import('./src-HWRBSSUF.js');
+    const mcps = await import('./src-EHF3T2T2.js');
     const credentials = await mcps.getCallerCredentialsAsync();
     if (!credentials.bearerToken && !credentials.apiKey) {
       stderrWrite(
@@ -806,8 +806,8 @@ var withSentinel = (s) => s ? `${REPORT_SECTION_SENTINEL}
 ${s}` : s;
 async function resolveDashboardBaseUrl(stderrWrite) {
   try {
-    const mcps = await import('./src-HWRBSSUF.js');
-    return `${mcps.resolveActiveProfile().uiBaseUrl}/dashboard/projects`;
+    const mcps = await import('./src-EHF3T2T2.js');
+    return mcps.resolveActiveProfile().dashboardBaseUrl;
   } catch (err) {
     stderrWrite(
       `build-pr-section: could not resolve the runtime target, linking to production: ${errMsg2(err)}

package/dist/{chunk-J6VC26BI.js → chunk-VQZLKLAY.js}

@@ -952,7 +952,37 @@ var TestResultStatus = /* @__PURE__ */ ((TestResultStatus2) => {
 })(TestResultStatus || {});
 
 // packages/mcps/src/mcp/local/services/stored-auth-target.ts
+function decodeJwtPayload(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) {
+      return null;
+    }
+    const payload = parts[1];
+    const decoded = Buffer.from(payload, "base64url").toString("utf-8");
+    return JSON.parse(decoded);
+  } catch {
+    return null;
+  }
+}
+function extractJwtIssuer(token) {
+  const payload = decodeJwtPayload(token);
+  if (!payload || typeof payload.iss !== "string") {
+    return null;
+  }
+  return payload.iss;
+}
+function normalizeIssuerHost(issuer) {
+  return issuer.replace(/^https:\/\//, "").replace(/\/$/, "");
+}
 function isStoredAuthForRuntimeTarget(params) {
+  if (params.tokenIssuer && params.expectedAuth0Domain) {
+    const issuerHost = normalizeIssuerHost(params.tokenIssuer);
+    const expectedHost = normalizeIssuerHost(params.expectedAuth0Domain);
+    if (issuerHost !== expectedHost) {
+      return false;
+    }
+  }
   if (!params.storedRuntimeTarget) {
     return params.activeRuntimeTarget === "production" /* Production */;
   }
@@ -1033,23 +1063,23 @@ var AuthService = class {
       });
       throw new Error(`Failed to start device code flow: ${response.status} ${errorText}`);
     }
-    const data = await response.json();
+    const deviceCodeResponse = await response.json();
     logger6.info("Device code flow started", {
-      userCode: data.user_code,
-      verificationUri: data.verification_uri,
-      expiresIn: data.expires_in
+      userCode: deviceCodeResponse.user_code,
+      verificationUri: deviceCodeResponse.verification_uri,
+      expiresIn: deviceCodeResponse.expires_in
     });
     this.storePendingDeviceCode({
-      deviceCode: data.device_code,
-      userCode: data.user_code,
-      expiresAt: new Date(Date.now() + data.expires_in * 1e3).toISOString()
+      deviceCode: deviceCodeResponse.device_code,
+      userCode: deviceCodeResponse.user_code,
+      expiresAt: new Date(Date.now() + deviceCodeResponse.expires_in * 1e3).toISOString()
     });
-    let browserUrl = data.verification_uri_complete;
+    let browserUrl = deviceCodeResponse.verification_uri_complete;
     if (options?.forceNewSession) {
       this.logout();
       const logoutUrl = new URL(`https://${domain}/v2/logout`);
       logoutUrl.searchParams.set("client_id", clientId);
-      logoutUrl.searchParams.set("returnTo", data.verification_uri_complete);
+      logoutUrl.searchParams.set("returnTo", deviceCodeResponse.verification_uri_complete);
       browserUrl = logoutUrl.toString();
       logger6.info("Force new session: cleared local token, opening logout-redirect URL", {
         logoutUrl: browserUrl
@@ -1067,12 +1097,12 @@ var AuthService = class {
       });
     }
     return {
-      deviceCode: data.device_code,
-      userCode: data.user_code,
-      verificationUri: data.verification_uri,
-      verificationUriComplete: data.verification_uri_complete,
-      expiresIn: data.expires_in,
-      interval: data.interval,
+      deviceCode: deviceCodeResponse.device_code,
+      userCode: deviceCodeResponse.user_code,
+      verificationUri: deviceCodeResponse.verification_uri,
+      verificationUriComplete: deviceCodeResponse.verification_uri_complete,
+      expiresIn: deviceCodeResponse.expires_in,
+      interval: deviceCodeResponse.interval,
       browserOpened: browserOpenResult.opened,
       browserOpenError: browserOpenResult.error
     };
@@ -1103,15 +1133,15 @@ var AuthService = class {
     }
     try {
       const content = fs6.readFileSync(this.pendingDeviceCodePath, "utf-8");
-      const data = JSON.parse(content);
+      const pendingDeviceCodeData = JSON.parse(content);
       const now = /* @__PURE__ */ new Date();
-      const expiresAt = new Date(data.expiresAt);
+      const expiresAt = new Date(pendingDeviceCodeData.expiresAt);
       if (now >= expiresAt) {
         logger6.debug("Pending device code expired");
         this.clearPendingDeviceCode();
         return null;
       }
-      return data.deviceCode;
+      return pendingDeviceCodeData.deviceCode;
     } catch (error) {
       logger6.warn("Failed to read pending device code", {
         error: error instanceof Error ? error.message : String(error)
@@ -1238,9 +1268,9 @@ var AuthService = class {
       pollIntervalMs
     });
     while (Date.now() - startedAt < timeoutMs) {
-      const result = await this.pollDeviceCode(params.deviceCode);
-      if (result.status !== "pending" /* Pending */) {
-        return result;
+      const pollResult = await this.pollDeviceCode(params.deviceCode);
+      if (pollResult.status !== "pending" /* Pending */) {
+        return pollResult;
       }
       const remainingMs = timeoutMs - (Date.now() - startedAt);
       if (remainingMs <= 0) {
@@ -1272,8 +1302,8 @@ var AuthService = class {
         logger6.warn("Failed to get user info", { status: response.status });
         return {};
       }
-      const data = await response.json();
-      return data;
+      const userInfoData = await response.json();
+      return userInfoData;
     } catch (error) {
       logger6.warn("User info request failed", {
         error: error instanceof Error ? error.message : String(error)
@@ -1319,13 +1349,20 @@ var AuthService = class {
       const content = fs6.readFileSync(this.oauthSessionFilePath, "utf-8");
       const storedAuth = JSON.parse(content);
       const activeRuntimeTarget = getActiveRuntimeTarget();
+      const config = getConfig();
+      const expectedAuth0Domain = config.localQa.auth0.domain;
+      const tokenIssuer = extractJwtIssuer(storedAuth.accessToken);
       if (!isStoredAuthForRuntimeTarget({
         storedRuntimeTarget: storedAuth.runtimeTarget,
-        activeRuntimeTarget
+        activeRuntimeTarget,
+        tokenIssuer,
+        expectedAuth0Domain
       })) {
         logger6.warn("Ignoring stored auth issued for a different runtime target", {
           storedRuntimeTarget: storedAuth.runtimeTarget ?? "unrecorded",
-          activeRuntimeTarget
+          activeRuntimeTarget,
+          tokenIssuer: tokenIssuer ?? "undecodable",
+          expectedAuth0Domain
         });
         return null;
       }

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { runCli } from './chunk-GMNAD3B6.js';
-import './chunk-J6VC26BI.js';
+import { runCli } from './chunk-FK7XVMVA.js';
+import './chunk-VQZLKLAY.js';
 
 // src/cli/main.ts
 runCli().catch((error) => {

package/dist/index.js

@@ -1,2 +1,2 @@
-export { src_exports as commands, createUnifiedMcpServer, server_exports as server } from './chunk-GMNAD3B6.js';
-export { createChildLogger, e2e_exports as e2e, getConfig, getLocalQaTools, getLogger, getQaTools, local_exports as localQa, mcp_exports as mcp, e2e_exports as qa, src_exports as shared } from './chunk-J6VC26BI.js';
+export { src_exports as commands, createUnifiedMcpServer, server_exports as server } from './chunk-FK7XVMVA.js';
+export { createChildLogger, e2e_exports as e2e, getConfig, getLocalQaTools, getLogger, getQaTools, local_exports as localQa, mcp_exports as mcp, e2e_exports as qa, src_exports as shared } from './chunk-VQZLKLAY.js';

package/dist/release-manifest.json

@@ -1,7 +1,7 @@
 {
   "release": "5.13.1",
-  "buildId": "run-105-1",
-  "commitSha": "a9e7e8cbb77fd8f9bb3f6c93f55a7b1509705c84",
-  "buildTime": "2026-09-08T23:57:01Z",
+  "buildId": "run-107-1",
+  "commitSha": "04bc87307c2df4dd098aa15befb19a3734923306",
+  "buildTime": "2026-09-09T01:10:17Z",
   "serviceName": "muggle-ai-works-mcp"
 }

package/dist/{src-HWRBSSUF.js → src-EHF3T2T2.js}

@@ -1 +1 @@
-export { DEFAULT_PREFERENCES, ElectronAppReleaseStream, PREFERENCES_FILE_NAME, PREFERENCES_PROJECT_DIR_NAME, PREFERENCES_SCHEMA, PREFERENCES_VERSION, PREFERENCE_ALLOWED_VALUES, PreferenceKey, PreferenceValue, ProjectPreferencesReconcileOutcome, RuntimeTarget, WATCHER_LIFETIME_SECONDS, WATCHER_LIFETIME_UNBOUNDED_SECONDS, assertDeviceCodeClientProvisioned, buildElectronAppChecksumsUrl, buildElectronAppReleaseAssetUrl, buildElectronAppReleaseTag, calculateFileChecksum, createApiKeyWithToken, createChildLogger, deleteApiKeyData, deleteCredentials, e2e_exports as e2e, formatPreferencesOneLiner, getActiveElectronAppReleaseStream, getActiveRuntimeTarget, getApiKey, getApiKeyFilePath, getAuthService, getBundledElectronAppVersion, getCallerCredentials, getCallerCredentialsAsync, getChecksumForPlatform, getConfig, getCredentialsFilePath, getDataDir, getDownloadBaseUrl, getElectronAppChecksums, getElectronAppDir, getElectronAppReleaseTagPrefix, getElectronAppSignedFromVersion, getElectronAppVersion, getElectronAppVersionSource, getLocalQaTools, getLogger, getPlatformKey, getQaTools, getReleaseSignerIdentityUri, getValidApiKeyData, getValidCredentials, hasApiKey, isElectronAppInstalled, isFirstRun, loadApiKeyData, loadCredentials, local_exports as localQa, mcp_exports as mcp, openBrowserUrl, performLogin, performLogout, pollDeviceCode, e2e_exports as qa, reconcileProjectPreferences, resetConfig, resetLogger, resetPreference, resolveActiveProfile, resolveActiveReleaseStream, resolveActiveReleaseTagPrefix, resolveElectronAppPathOrNull, resolvePreferences, resolveRuntimeTarget, saveApiKey, saveApiKeyData, saveCredentials, startDeviceCodeFlow, toolRequiresAuth, validatePreference, verifyFileChecksum, writePreferences } from './chunk-J6VC26BI.js';
+export { DEFAULT_PREFERENCES, ElectronAppReleaseStream, PREFERENCES_FILE_NAME, PREFERENCES_PROJECT_DIR_NAME, PREFERENCES_SCHEMA, PREFERENCES_VERSION, PREFERENCE_ALLOWED_VALUES, PreferenceKey, PreferenceValue, ProjectPreferencesReconcileOutcome, RuntimeTarget, WATCHER_LIFETIME_SECONDS, WATCHER_LIFETIME_UNBOUNDED_SECONDS, assertDeviceCodeClientProvisioned, buildElectronAppChecksumsUrl, buildElectronAppReleaseAssetUrl, buildElectronAppReleaseTag, calculateFileChecksum, createApiKeyWithToken, createChildLogger, deleteApiKeyData, deleteCredentials, e2e_exports as e2e, formatPreferencesOneLiner, getActiveElectronAppReleaseStream, getActiveRuntimeTarget, getApiKey, getApiKeyFilePath, getAuthService, getBundledElectronAppVersion, getCallerCredentials, getCallerCredentialsAsync, getChecksumForPlatform, getConfig, getCredentialsFilePath, getDataDir, getDownloadBaseUrl, getElectronAppChecksums, getElectronAppDir, getElectronAppReleaseTagPrefix, getElectronAppSignedFromVersion, getElectronAppVersion, getElectronAppVersionSource, getLocalQaTools, getLogger, getPlatformKey, getQaTools, getReleaseSignerIdentityUri, getValidApiKeyData, getValidCredentials, hasApiKey, isElectronAppInstalled, isFirstRun, loadApiKeyData, loadCredentials, local_exports as localQa, mcp_exports as mcp, openBrowserUrl, performLogin, performLogout, pollDeviceCode, e2e_exports as qa, reconcileProjectPreferences, resetConfig, resetLogger, resetPreference, resolveActiveProfile, resolveActiveReleaseStream, resolveActiveReleaseTagPrefix, resolveElectronAppPathOrNull, resolvePreferences, resolveRuntimeTarget, saveApiKey, saveApiKeyData, saveCredentials, startDeviceCodeFlow, toolRequiresAuth, validatePreference, verifyFileChecksum, writePreferences } from './chunk-VQZLKLAY.js';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@muggleai/works",
   "mcpName": "io.github.multiplex-ai/muggle",
-  "version": "5.15.0-staging.105",
+  "version": "5.15.0",
   "description": "Ship quality products with AI-powered E2E acceptance testing that validates your web app like a real user — from Claude Code and Cursor to PR.",
   "type": "module",
   "main": "dist/index.js",
@@ -53,7 +53,7 @@
   "muggleConfig": {
     "electronAppVersion": "1.10.3",
     "downloadBaseUrl": "https://github.com/multiplex-ai/muggle-ai-works/releases/download",
-    "runtimeTargetDefault": "staging",
+    "runtimeTargetDefault": "production",
     "checksumsByStream": {
       "production": {
         "win32-x64": "58e2238b1609ceff65b836b4b724b1c4c341d737a15debaa8a71af21b70bc436",