@mushi-mushi/cli 0.20.0 → 0.22.0

package/CONTRIBUTING.md

@@ -70,7 +70,7 @@ packages/
   react-native/  React Native SDK (MIT)
   cli/           CLI tool (MIT)
   mcp/           MCP server for coding agents (MIT)
-  server/        Supabase Edge Functions (AGPLv3)
+  server/        Supabase Edge Functions (AGPLv3; ee/ is commercial)
   agents/        Agentic fix pipeline (AGPLv3)
   verify/        Fix verification (AGPLv3)
 apps/
@@ -81,6 +81,18 @@ tooling/
   tsconfig/      Shared TypeScript configs
 ```
 
+## What we don't accept
+
+Knowing this upfront saves everyone time.
+
+- **Automated / bulk / AI-slop PRs** — any PR that was opened by a script, an LLM agent acting without meaningful human review, or as part of a parallel bounty-farming sweep is closed on sight. The commit history, branch name, or helper scripts included in the PR make this obvious.
+- **PRs that target the wrong base** — all PRs must branch from and target `master`. PRs targeting `main` or any other branch are closed (and will show an inflated diff that is not your work).
+- **One PR per issue, one issue per PR** — splitting or duplicating work just to collect acknowledgements isn't welcome.
+- **Good-first-issues without claiming first** — comment on the issue to claim it before starting. If two people open PRs for the same issue, the one that commented first is prioritised.
+- **Documentation-only PRs that merely duplicate existing content** — if the information already exists (e.g. in another file in this repo), adding a redundant copy adds noise without value.
+
+If a PR violates these policies it will be closed with a brief explanation. No hard feelings — a genuine contribution on the same issue is always welcome.
+
 ## Making Changes
 
 1. Create a feature branch from `master`
@@ -199,7 +211,7 @@ chore: bump dependencies
 ## License
 
 - SDK packages are MIT — your contributions will be MIT-licensed
-- Server/agents/verify are AGPLv3 — contributions to those packages fall under AGPLv3
+- Server/agents/verify are AGPLv3 — contributions to those packages fall under AGPLv3. A [commercial license](./COMMERCIAL-LICENSE.md) is available for hosted-SaaS use cases that cannot publish modifications. The `packages/server/ee/` directory is source-available but commercial (production use needs a license); contributions there are accepted under the same EE terms.
 
 ## Questions?
 

package/README.md

@@ -1,9 +1,16 @@
 # @mushi-mushi/cli
 
 > **Your AI wrote it. Mushi tells you why it broke.**
-> Plain-English diagnosis + a paste-ready fix, right inside Cursor. MIT-licensed SDKs · self-hostable · no second LLM key.
 
-CLI for Mushi Mushi — set up the SDK in one command, wire Cursor MCP, then triage reports and monitor the pipeline from your terminal.
+Set up the Mushi SDK, wire Cursor MCP, and triage reports from your terminal.
+
+Positioning and product overview: [docs site](https://github.com/kensaurus/mushi-mushi/blob/master/apps/docs/content/quickstart/index.mdx) · [VISION.md](https://github.com/kensaurus/mushi-mushi/blob/master/VISION.md)
+
+## Quick start
+
+```bash
+npx @mushi-mushi/cli init
+```
 
 ## Console ↔ CLI loop
 
@@ -320,7 +327,7 @@ mushi tdd improve
 mushi qa stories
 mushi qa runs <storyId>
 mushi qa run <storyId>
-mushi qa audit
+mushi audit
 ```
 
 ---
@@ -368,7 +375,7 @@ Config file: `~/.config/mushi/config.json` (Unix mode `0o600`; legacy `~/.mushir
 - `~/.config/mushi/config.json` is written with mode `0o600` on Unix. Legacy configs with looser permissions are tightened on load.
 - `--endpoint` values are parsed through `new URL()` and required to use `https://` except for `localhost` / `127.0.0.1` / `*.local`.
 - The `--api-key` flag leaks into `ps -ef` — prefer the interactive prompt on shared machines.
-- Full stack traces on error: `DEBUG=mushi mushi init`.
+- Full stack traces on error: `MUSHI_DEBUG=1 mushi init`.
 
 ## Programmatic imports
 
@@ -383,9 +390,3 @@ The CLI is also importable for tooling (used by `create-mushi-mushi`):
 ## License
 
 MIT
-
-
-<!-- mushi-readme-stats-footer -->
----
-
-<sub>Monorepo scale (June 2026): 47 edge functions · 256 SQL migrations · 13 outbound plugins · 11 inbound adapters · 18 pipeline agents. Canonical counts: <a href="https://github.com/kensaurus/mushi-mushi/blob/master/docs/stats.md">docs/stats.md</a> · <code>pnpm docs-stats</code></sub>

package/SECURITY.md

@@ -113,7 +113,7 @@ What we treat as in-scope attacker capabilities, and what we don't.
 | Compromised Supabase service-role key | ❌ | Treated as a tier-0 incident; would require key rotation and audit-log forensics. Not defendable in software. |
 | Compromise of `kensaurus@gmail.com` | ❌ | Treated as a project-fork event; downstream consumers should pin to the last known-good version and follow the new release channel. |
 | Physical / OS-level attacker on an end-user device | ❌ | Out of scope. |
-| Malicious fork using the Mushi name to ship malware | ❌ (technical) ✅ (legal) | The MIT/BSL grant lets the fork exist; the trademark policy (`TRADEMARK.md`) makes shipping it under the Mushi name an infringement we will pursue. |
+| Malicious fork using the Mushi name to ship malware | ❌ (technical) ✅ (legal) | The MIT / AGPLv3 grant lets the fork exist; the trademark policy (`TRADEMARK.md`) makes shipping it under the Mushi name an infringement we will pursue. |
 
 ## Data handling and PII
 

package/dist/chunk-5KN6S63C.js

@@ -0,0 +1,6 @@
+// src/version.ts
+var MUSHI_CLI_VERSION = true ? "0.22.0" : "0.0.0-dev";
+
+export {
+  MUSHI_CLI_VERSION
+};

package/dist/{chunk-7Q44KWGN.js → chunk-JAUKBLPK.js}

@@ -321,30 +321,36 @@ function installCommand(pm, packages) {
   return `${pm} ${verb} ${packages.join(" ")}`;
 }
 var SERVER_FRAMEWORK_IDS = /* @__PURE__ */ new Set(["express", "fastify", "hono"]);
-function envVarsToWrite(apiKey, projectId, framework) {
+function envVarsToWrite(apiKey, projectId, framework, endpoint) {
+  const CLOUD_ENDPOINT = "https://dxptnwrhwsqckaftyymj.supabase.co/functions/v1/api";
+  const endpointLine = endpoint && endpoint !== CLOUD_ENDPOINT ? `MUSHI_API_ENDPOINT=${endpoint}` : null;
   if (SERVER_FRAMEWORK_IDS.has(framework.id)) {
     return [
       `MUSHI_PROJECT_ID=${projectId}`,
-      `MUSHI_API_KEY=${apiKey}`
-    ].join("\n");
+      `MUSHI_API_KEY=${apiKey}`,
+      endpointLine
+    ].filter(Boolean).join("\n");
   }
   if (framework.id === "react-native") {
     return [
       `MUSHI_PROJECT_ID=${projectId}`,
-      `MUSHI_API_KEY=${apiKey}`
-    ].join("\n");
+      `MUSHI_API_KEY=${apiKey}`,
+      endpointLine
+    ].filter(Boolean).join("\n");
   }
   if (framework.id === "expo") {
     return [
       `EXPO_PUBLIC_MUSHI_PROJECT_ID=${projectId}`,
-      `EXPO_PUBLIC_MUSHI_API_KEY=${apiKey}`
-    ].join("\n");
+      `EXPO_PUBLIC_MUSHI_API_KEY=${apiKey}`,
+      endpointLine ? `EXPO_PUBLIC_${endpointLine}` : null
+    ].filter(Boolean).join("\n");
   }
   const prefix = framework.id === "next" ? "NEXT_PUBLIC_" : framework.id === "nuxt" ? "NUXT_PUBLIC_" : "VITE_";
   return [
     `${prefix}MUSHI_PROJECT_ID=${projectId}`,
-    `${prefix}MUSHI_API_KEY=${apiKey}`
-  ].join("\n");
+    `${prefix}MUSHI_API_KEY=${apiKey}`,
+    endpointLine ? `${prefix}${endpointLine}` : null
+  ].filter(Boolean).join("\n");
 }
 function collectDeps(pkg) {
   if (!pkg) return /* @__PURE__ */ new Set();

package/dist/{chunk-D5IDNBJO.js → chunk-R2HPR2FV.js}

@@ -405,30 +405,36 @@ function installCommand(pm, packages) {
   return `${pm} ${verb} ${packages.join(" ")}`;
 }
 var SERVER_FRAMEWORK_IDS = /* @__PURE__ */ new Set(["express", "fastify", "hono"]);
-function envVarsToWrite(apiKey, projectId, framework) {
+function envVarsToWrite(apiKey, projectId, framework, endpoint) {
+  const CLOUD_ENDPOINT = "https://dxptnwrhwsqckaftyymj.supabase.co/functions/v1/api";
+  const endpointLine = endpoint && endpoint !== CLOUD_ENDPOINT ? `MUSHI_API_ENDPOINT=${endpoint}` : null;
   if (SERVER_FRAMEWORK_IDS.has(framework.id)) {
     return [
       `MUSHI_PROJECT_ID=${projectId}`,
-      `MUSHI_API_KEY=${apiKey}`
-    ].join("\n");
+      `MUSHI_API_KEY=${apiKey}`,
+      endpointLine
+    ].filter(Boolean).join("\n");
   }
   if (framework.id === "react-native") {
     return [
       `MUSHI_PROJECT_ID=${projectId}`,
-      `MUSHI_API_KEY=${apiKey}`
-    ].join("\n");
+      `MUSHI_API_KEY=${apiKey}`,
+      endpointLine
+    ].filter(Boolean).join("\n");
   }
   if (framework.id === "expo") {
     return [
       `EXPO_PUBLIC_MUSHI_PROJECT_ID=${projectId}`,
-      `EXPO_PUBLIC_MUSHI_API_KEY=${apiKey}`
-    ].join("\n");
+      `EXPO_PUBLIC_MUSHI_API_KEY=${apiKey}`,
+      endpointLine ? `EXPO_PUBLIC_${endpointLine}` : null
+    ].filter(Boolean).join("\n");
   }
   const prefix = framework.id === "next" ? "NEXT_PUBLIC_" : framework.id === "nuxt" ? "NUXT_PUBLIC_" : "VITE_";
   return [
     `${prefix}MUSHI_PROJECT_ID=${projectId}`,
-    `${prefix}MUSHI_API_KEY=${apiKey}`
-  ].join("\n");
+    `${prefix}MUSHI_API_KEY=${apiKey}`,
+    endpointLine ? `${prefix}${endpointLine}` : null
+  ].filter(Boolean).join("\n");
 }
 function collectDeps(pkg) {
   if (!pkg) return /* @__PURE__ */ new Set();

package/dist/{connect-IC7I76Z2.js → connect-2RM43XHO.js}

@@ -8,7 +8,7 @@ import {
   detectFramework,
   envVarsToWrite,
   readPackageJson
-} from "./chunk-7Q44KWGN.js";
+} from "./chunk-JAUKBLPK.js";
 
 // src/connect.ts
 import { appendFile, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";

package/dist/{connect-W2Q6N7K3.js → connect-JIEIWTF3.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runConnect
-} from "./chunk-D5IDNBJO.js";
+} from "./chunk-R2HPR2FV.js";
 import "./chunk-LDPFTQLE.js";
 export {
   runConnect

package/dist/detect.d.ts

@@ -25,6 +25,6 @@ declare function readPackageJson(cwd: string): PackageJson | null;
 declare function detectFramework(cwd: string, pkg: PackageJson | null): Framework;
 declare function detectPackageManager(cwd: string): PackageManager;
 declare function installCommand(pm: PackageManager, packages: string[]): string;
-declare function envVarsToWrite(apiKey: string, projectId: string, framework: Framework): string;
+declare function envVarsToWrite(apiKey: string, projectId: string, framework: Framework, endpoint?: string): string;
 
 export { FRAMEWORKS, FRAMEWORK_IDS, type Framework, type FrameworkId, type PackageJson, type PackageManager, detectFramework, detectPackageManager, envVarsToWrite, installCommand, isFrameworkId, readPackageJson };

package/dist/detect.js

@@ -7,7 +7,7 @@ import {
   installCommand,
   isFrameworkId,
   readPackageJson
-} from "./chunk-7Q44KWGN.js";
+} from "./chunk-JAUKBLPK.js";
 export {
   FRAMEWORKS,
   FRAMEWORK_IDS,