@mushi-mushi/cli 0.18.0 → 0.18.2

package/CONTRIBUTING.md

@@ -58,9 +58,9 @@ packages/
   react-native/  React Native SDK (MIT)
   cli/           CLI tool (MIT)
   mcp/           MCP server for coding agents (MIT)
-  server/        Supabase Edge Functions (BSL)
-  agents/        Agentic fix pipeline (BSL)
-  verify/        Fix verification (BSL)
+  server/        Supabase Edge Functions (AGPLv3)
+  agents/        Agentic fix pipeline (AGPLv3)
+  verify/        Fix verification (AGPLv3)
 apps/
   admin/         Admin dashboard (React + Tailwind)
   docs/          Documentation site (Nextra — apps/docs)
@@ -97,8 +97,10 @@ Guardrails (run locally before pushing):
 pnpm check:docs-stats          # root README stat badges
 pnpm check:sdk-version-matrix  # apps/docs/content/sdks/index.mdx versions
 pnpm check:internal-doc-links  # dead /foo links in MDX
+pnpm check:onboarding-drift    # phantom MCP env vars / stale tool names
 pnpm check:bundle-docs         # @mushi-mushi/web size-limit vs README
 pnpm gen:llms-txt              # regenerate apps/docs/public/llms.txt after nav changes
+pnpm gen:mcp-tools-doc         # regenerate sdks/mcp-tools.generated.mdx from catalog.ts
 ```
 
 README changes on npm packages only appear on [npmjs.com](https://www.npmjs.com) after the next **Changesets publish**.
@@ -115,13 +117,30 @@ Select the affected packages, the semver bump type, and write a summary. The cha
 
 ## Release flow
 
-Releases are fully automated. Maintainers don't run `npm publish` by hand.
+Releases are fully automated once the version PR is merged. Maintainers don't run
+`npm publish` by hand for routine bumps. See **[`docs/DEPLOYMENT.md`](docs/DEPLOYMENT.md)**
+for the full production runbook (edge functions, admin SPA, docs site, migrations).
 
 1. PRs land on `master` with one or more changeset files in `.changeset/`.
-2. `release.yml` runs on every push to `master`. It opens (or updates) a `chore: version packages` PR that bumps every affected `package.json`, rolls up the changelogs, and deletes the consumed changesets.
-3. Merging that "Version Packages" PR re-fires `release.yml`. The publish step authenticates to npm via **OpenID Connect (OIDC) Trusted Publishers** — no long-lived `NPM_TOKEN` is exchanged — and every tarball ships with a **Sigstore provenance attestation** uploaded to the public transparency log.
+   Orphaned changesets (only ignored packages) fail `pnpm check:changeset-orphans`.
+2. `release.yml` runs on every push to `master`. It opens (or updates) a
+   **`chore: version packages`** PR on `changeset-release/master` that bumps
+   affected `package.json` files, rolls up changelogs, and deletes consumed
+   changesets.
+3. **Wait for CI on the version PR.** If checks don't appear (bot-branch
+   suppression), push an empty commit to `changeset-release/master`. If
+   `check:sdk-version-matrix` fails, run `pnpm gen:sdk-version-matrix` on that
+   branch and commit `apps/docs/content/sdks/index.mdx`.
+4. Merge the version PR. The publish step uses **OIDC Trusted Publishers** +
+   Sigstore provenance (with `NPM_TOKEN` only for brand-new package bootstrap).
+5. **Manually dispatch Release** unless a run starts within ~2 minutes:
+   **Actions → Release → Run workflow → `master`**. Squash-merges attributed to
+   `github-actions[bot]` usually suppress the auto `push` trigger — manual
+   dispatch is the normal path, not a fallback of last resort.
 
-If GitHub's anti-loop protection suppresses the auto re-fire (the squash merge can be attributed to `github-actions[bot]`), trigger the workflow manually: **Actions → release → Run workflow → master**.
+```bash
+gh workflow run release.yml --ref master
+```
 
 ### Adding a brand-new publishable package
 
@@ -168,7 +187,7 @@ chore: bump dependencies
 ## License
 
 - SDK packages are MIT — your contributions will be MIT-licensed
-- Server/agents/verify are BSL 1.1 — contributions to those packages fall under BSL
+- Server/agents/verify are AGPLv3 — contributions to those packages fall under AGPLv3
 
 ## Questions?
 

package/README.md

@@ -1,5 +1,8 @@
 # @mushi-mushi/cli
 
+> **Your AI wrote it. Mushi tells you why it broke.**
+> Plain-English diagnosis + a paste-ready fix, right inside Cursor. MIT-licensed SDKs · self-hostable · no second LLM key.
+
 CLI for Mushi Mushi — set up the SDK in one command, then triage reports and monitor the pipeline from your terminal.
 
 ## One-command setup
@@ -51,9 +54,9 @@ mushi --version
 ## Other commands
 
 ```bash
-mushi login --api-key mushi_xxx     # store credentials in ~/.mushirc (mode 0o600)
+mushi login --api-key mushi_xxx     # store credentials in ~/.config/mushi/config.json (mode 0o600)
 mushi connect --api-key mushi_xxx --project-id <uuid> --endpoint <url> --wait
-                                     # one-shot wiring: ~/.mushirc + .env.local + .cursor/mcp.json + heartbeat wait
+                                     # one-shot wiring: ~/.config/mushi/config.json + .env.local + .cursor/mcp.json + heartbeat wait
 mushi upgrade                        # bump installed @mushi-mushi/* packages to latest stable
 mushi status                         # project overview
 mushi reports list                   # recent reports
@@ -73,7 +76,7 @@ mushi sourcemaps upload --release <ver> --dir <dist>   # upload .js.map / .css.m
 Non-interactive equivalent of `mushi init` for agents and scripts — wires a
 repo to an existing project in one shot:
 
-1. Saves credentials to `~/.mushirc` (mode `0o600`).
+1. Saves credentials to `~/.config/mushi/config.json` (mode `0o600`).
 2. Merges `MUSHI_*` / framework-prefixed env vars into `.env.local` —
    existing keys are never overwritten (skip with `--no-env`).
 3. Writes the `@mushi-mushi/mcp` server block into `.cursor/mcp.json` and
@@ -177,7 +180,7 @@ Local checks performed:
 
 | Check | What it verifies |
 |---|---|
-| CLI config | `~/.mushirc` exists, `projectId` and `apiKey` fields are present |
+| CLI config | `~/.config/mushi/config.json` exists, `projectId` and `apiKey` fields are present |
 | Endpoint reachability | `GET /v1/sdk/config?project_id=...` returns 200 |
 | SDK install | `@mushi-mushi/web` or framework-specific SDK is in `node_modules` |
 
@@ -301,7 +304,7 @@ mushi slack test
 
 ## Security notes
 
-- `~/.mushirc` is written with mode `0o600` on Unix. Legacy configs with looser permissions are tightened on load.
+- `~/.config/mushi/config.json` is written with mode `0o600` on Unix. Legacy configs with looser permissions are tightened on load.
 - `--endpoint` values are parsed through `new URL()` and required to use `https://` except for `localhost` / `127.0.0.1` / `*.local`.
 - The `--api-key` flag leaks into `ps -ef` — prefer the interactive prompt on shared machines.
 - Full stack traces on error: `DEBUG=mushi mushi init`.

package/dist/{chunk-S4WQHEGH.js → chunk-7Q44KWGN.js}

@@ -26,15 +26,15 @@ var FRAMEWORKS = {
     label: "Next.js",
     packageName: "@mushi-mushi/react",
     needsWebPackage: false,
-    snippet: (apiKey, projectId) => `// app/providers.tsx (or pages/_app.tsx for /pages router)
+    snippet: () => `// app/providers.tsx (or pages/_app.tsx for /pages router)
 'use client'
 import { MushiProvider } from '@mushi-mushi/react'
 
 export function Providers({ children }: { children: React.ReactNode }) {
   return (
     <MushiProvider config={{
-      projectId: '${projectId}',
-      apiKey: '${apiKey}',
+      projectId: process.env.NEXT_PUBLIC_MUSHI_PROJECT_ID!,
+      apiKey: process.env.NEXT_PUBLIC_MUSHI_API_KEY!,
     }}>
       {children}
     </MushiProvider>
@@ -46,13 +46,13 @@ export function Providers({ children }: { children: React.ReactNode }) {
     label: "React",
     packageName: "@mushi-mushi/react",
     needsWebPackage: false,
-    snippet: (apiKey, projectId) => `// src/main.tsx
+    snippet: () => `// src/main.tsx
 import { MushiProvider } from '@mushi-mushi/react'
 
 createRoot(document.getElementById('root')!).render(
   <MushiProvider config={{
-    projectId: '${projectId}',
-    apiKey: '${apiKey}',
+    projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
+    apiKey: import.meta.env.VITE_MUSHI_API_KEY,
   }}>
     <App />
   </MushiProvider>
@@ -62,57 +62,58 @@ createRoot(document.getElementById('root')!).render(
     id: "vue",
     label: "Vue 3",
     packageName: "@mushi-mushi/vue",
-    needsWebPackage: true,
-    snippet: (apiKey, projectId) => `// src/main.ts
+    needsWebPackage: false,
+    snippet: () => `// src/main.ts
 import { MushiPlugin } from '@mushi-mushi/vue'
-import { Mushi } from '@mushi-mushi/web'
 
-app.use(MushiPlugin, { projectId: '${projectId}', apiKey: '${apiKey}' })
-Mushi.init({ projectId: '${projectId}', apiKey: '${apiKey}' })`
+app.use(MushiPlugin, {
+  projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
+  apiKey: import.meta.env.VITE_MUSHI_API_KEY,
+})`
   },
   nuxt: {
     id: "nuxt",
     label: "Nuxt",
     packageName: "@mushi-mushi/vue",
-    needsWebPackage: true,
-    snippet: (apiKey, projectId) => `// plugins/mushi.client.ts
+    needsWebPackage: false,
+    snippet: () => `// plugins/mushi.client.ts
 import { MushiPlugin } from '@mushi-mushi/vue'
-import { Mushi } from '@mushi-mushi/web'
 
 export default defineNuxtPlugin((nuxtApp) => {
   nuxtApp.vueApp.use(MushiPlugin, {
-    projectId: '${projectId}',
-    apiKey: '${apiKey}',
+    projectId: import.meta.env.NUXT_PUBLIC_MUSHI_PROJECT_ID,
+    apiKey: import.meta.env.NUXT_PUBLIC_MUSHI_API_KEY,
   })
-  Mushi.init({ projectId: '${projectId}', apiKey: '${apiKey}' })
 })`
   },
   svelte: {
     id: "svelte",
     label: "Svelte",
     packageName: "@mushi-mushi/svelte",
-    needsWebPackage: true,
-    snippet: (apiKey, projectId) => `// src/main.ts (or +layout.svelte for SvelteKit)
+    needsWebPackage: false,
+    snippet: () => `// src/main.ts
 import { initMushi } from '@mushi-mushi/svelte'
-import { Mushi } from '@mushi-mushi/web'
 
-initMushi({ projectId: '${projectId}', apiKey: '${apiKey}' })
-Mushi.init({ projectId: '${projectId}', apiKey: '${apiKey}' })`
+initMushi({
+  projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
+  apiKey: import.meta.env.VITE_MUSHI_API_KEY,
+})`
   },
   sveltekit: {
     id: "sveltekit",
     label: "SvelteKit",
     packageName: "@mushi-mushi/svelte",
-    needsWebPackage: true,
-    snippet: (apiKey, projectId) => `// src/routes/+layout.svelte
+    needsWebPackage: false,
+    snippet: () => `// src/routes/+layout.svelte
 <script>
   import { onMount } from 'svelte'
-  import { initMushi } from '@mushi-mushi/svelte'
 
   onMount(async () => {
-    const { Mushi } = await import('@mushi-mushi/web')
-    initMushi({ projectId: '${projectId}', apiKey: '${apiKey}' })
-    Mushi.init({ projectId: '${projectId}', apiKey: '${apiKey}' })
+    const { initMushi } = await import('@mushi-mushi/svelte')
+    initMushi({
+      projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
+      apiKey: import.meta.env.VITE_MUSHI_API_KEY,
+    })
   })
 </script>`
   },
@@ -120,29 +121,33 @@ Mushi.init({ projectId: '${projectId}', apiKey: '${apiKey}' })`
     id: "angular",
     label: "Angular",
     packageName: "@mushi-mushi/angular",
-    needsWebPackage: true,
-    snippet: (apiKey, projectId) => `// src/main.ts
+    needsWebPackage: false,
+    snippet: () => `// src/main.ts
 import { provideMushi } from '@mushi-mushi/angular'
-import { Mushi } from '@mushi-mushi/web'
 
 bootstrapApplication(AppComponent, {
   providers: [
-    provideMushi({ projectId: '${projectId}', apiKey: '${apiKey}' }),
+    provideMushi({
+      projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
+      apiKey: import.meta.env.VITE_MUSHI_API_KEY,
+    }),
   ],
-})
-Mushi.init({ projectId: '${projectId}', apiKey: '${apiKey}' })`
+})`
   },
   expo: {
     id: "expo",
     label: "Expo",
     packageName: "@mushi-mushi/react-native",
     needsWebPackage: false,
-    snippet: (apiKey, projectId) => `// App.tsx
+    snippet: () => `// App.tsx
 import { MushiProvider } from '@mushi-mushi/react-native'
 
 export default function App() {
   return (
-    <MushiProvider projectId="${projectId}" apiKey="${apiKey}">
+    <MushiProvider
+      projectId={process.env.EXPO_PUBLIC_MUSHI_PROJECT_ID!}
+      apiKey={process.env.EXPO_PUBLIC_MUSHI_API_KEY!}
+    >
       <YourApp />
     </MushiProvider>
   )
@@ -153,12 +158,15 @@ export default function App() {
     label: "React Native",
     packageName: "@mushi-mushi/react-native",
     needsWebPackage: false,
-    snippet: (apiKey, projectId) => `// App.tsx
+    snippet: () => `// App.tsx
 import { MushiProvider } from '@mushi-mushi/react-native'
 
 export default function App() {
   return (
-    <MushiProvider projectId="${projectId}" apiKey="${apiKey}">
+    <MushiProvider
+      projectId={process.env.MUSHI_PROJECT_ID!}
+      apiKey={process.env.MUSHI_API_KEY!}
+    >
       <YourApp />
     </MushiProvider>
   )
@@ -175,24 +183,27 @@ export default function App() {
      * `TypeError: Mushi.init is not a function`. The accompanying admin
      * console snippet (apps/admin/src/lib/sdkSnippets.ts) emits the same
      * `Mushi.configure(...)` shape; both are pinned by tests. */
-    snippet: (apiKey, projectId) => `// src/main.ts \u2014 after install, run \`npx cap sync\`
+    snippet: () => `// src/main.ts \u2014 after install, run \`npx cap sync\`
 import { Mushi } from '@mushi-mushi/capacitor'
 
-await Mushi.configure({ projectId: '${projectId}', apiKey: '${apiKey}' })`
+await Mushi.configure({
+  projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
+  apiKey: import.meta.env.VITE_MUSHI_API_KEY,
+})`
   },
   express: {
     id: "express",
     label: "Express",
     packageName: "@mushi-mushi/node",
     needsWebPackage: false,
-    snippet: (apiKey, projectId) => `// src/instrument.ts \u2014 load with: node --import ./dist/instrument.js
+    snippet: () => `// src/instrument.ts \u2014 load with: node --import ./dist/instrument.js
 import { MushiNodeClient, attachUnhandledHook } from '@mushi-mushi/node'
 import { mushiExpressErrorHandler } from '@mushi-mushi/node/express'
 import type { Express } from 'express'
 
 export const mushi = new MushiNodeClient({
-  projectId: '${projectId}',
-  apiKey: '${apiKey}',
+  projectId: process.env.MUSHI_PROJECT_ID!,
+  apiKey: process.env.MUSHI_API_KEY!,
   environment: process.env.NODE_ENV ?? 'production',
 })
 attachUnhandledHook({ client: mushi })
@@ -206,14 +217,14 @@ export function attachMushi(app: Express) {
     label: "Fastify",
     packageName: "@mushi-mushi/node",
     needsWebPackage: false,
-    snippet: (apiKey, projectId) => `// src/instrument.ts \u2014 load with: node --import ./dist/instrument.js
+    snippet: () => `// src/instrument.ts \u2014 load with: node --import ./dist/instrument.js
 import { MushiNodeClient, attachUnhandledHook } from '@mushi-mushi/node'
 import { mushiFastifyPlugin } from '@mushi-mushi/node/fastify'
 import Fastify from 'fastify'
 
 export const mushi = new MushiNodeClient({
-  projectId: '${projectId}',
-  apiKey: '${apiKey}',
+  projectId: process.env.MUSHI_PROJECT_ID!,
+  apiKey: process.env.MUSHI_API_KEY!,
   environment: process.env.NODE_ENV ?? 'production',
 })
 attachUnhandledHook({ client: mushi })
@@ -226,14 +237,14 @@ mushiFastifyPlugin(app, { client: mushi })`
     label: "Hono",
     packageName: "@mushi-mushi/node",
     needsWebPackage: false,
-    snippet: (apiKey, projectId) => `// src/instrument.ts \u2014 load with: node --import ./dist/instrument.js
+    snippet: () => `// src/instrument.ts \u2014 load with: node --import ./dist/instrument.js
 import { MushiNodeClient, attachUnhandledHook } from '@mushi-mushi/node'
 import { mushiHonoErrorHandler } from '@mushi-mushi/node/hono'
 import { Hono } from 'hono'
 
 export const mushi = new MushiNodeClient({
-  projectId: '${projectId}',
-  apiKey: '${apiKey}',
+  projectId: process.env.MUSHI_PROJECT_ID!,
+  apiKey: process.env.MUSHI_API_KEY!,
   environment: process.env.NODE_ENV ?? 'production',
 })
 attachUnhandledHook({ client: mushi })
@@ -250,10 +261,13 @@ app.onError(
     label: "Vanilla JS / unknown",
     packageName: "@mushi-mushi/web",
     needsWebPackage: false,
-    snippet: (apiKey, projectId) => `// Anywhere in your client bundle
+    snippet: () => `// Anywhere in your client bundle
 import { Mushi } from '@mushi-mushi/web'
 
-Mushi.init({ projectId: '${projectId}', apiKey: '${apiKey}' })`
+Mushi.init({
+  projectId: import.meta.env.VITE_MUSHI_PROJECT_ID,
+  apiKey: import.meta.env.VITE_MUSHI_API_KEY,
+})`
   }
 };
 function readPackageJson(cwd) {
@@ -314,6 +328,18 @@ function envVarsToWrite(apiKey, projectId, framework) {
       `MUSHI_API_KEY=${apiKey}`
     ].join("\n");
   }
+  if (framework.id === "react-native") {
+    return [
+      `MUSHI_PROJECT_ID=${projectId}`,
+      `MUSHI_API_KEY=${apiKey}`
+    ].join("\n");
+  }
+  if (framework.id === "expo") {
+    return [
+      `EXPO_PUBLIC_MUSHI_PROJECT_ID=${projectId}`,
+      `EXPO_PUBLIC_MUSHI_API_KEY=${apiKey}`
+    ].join("\n");
+  }
   const prefix = framework.id === "next" ? "NEXT_PUBLIC_" : framework.id === "nuxt" ? "NUXT_PUBLIC_" : "VITE_";
   return [
     `${prefix}MUSHI_PROJECT_ID=${projectId}`,