@mushi-mushi/cli 0.22.1 → 0.23.0

package/dist/chunk-WLLFV26V.js

@@ -0,0 +1,423 @@
+import {
+  MUSHI_CLI_VERSION
+} from "./chunk-BY5SZYRO.js";
+
+// src/config.ts
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+var SECURE_FILE_MODE = 384;
+var SECURE_DIR_MODE = 448;
+function resolveXdgConfigPath() {
+  const xdg = process.env["XDG_CONFIG_HOME"];
+  if (xdg && xdg.length > 0) {
+    return join(xdg, "mushi", "config.json");
+  }
+  if (process.platform === "win32") {
+    const appData = process.env["APPDATA"];
+    if (appData && appData.length > 0) {
+      return join(appData, "mushi", "config.json");
+    }
+  }
+  return join(homedir(), ".config", "mushi", "config.json");
+}
+var LEGACY_CONFIG_PATH = join(homedir(), ".mushirc");
+var CONFIG_PATH = resolveXdgConfigPath();
+function loadConfig(path = CONFIG_PATH) {
+  let file = {};
+  if (existsSync(path)) {
+    tightenPermissions(path);
+    try {
+      file = JSON.parse(readFileSync(path, "utf-8"));
+    } catch {
+    }
+  } else if (path === CONFIG_PATH && existsSync(LEGACY_CONFIG_PATH)) {
+    file = migrateLegacyConfig() ?? {};
+  }
+  const endpointFromEnv = process.env["MUSHI_API_ENDPOINT"] ?? process.env["MUSHI_ENDPOINT"] ?? void 0;
+  const fromEnv = {
+    ...process.env["MUSHI_API_KEY"] ? { apiKey: process.env["MUSHI_API_KEY"] } : {},
+    ...process.env["MUSHI_PROJECT_ID"] ? { projectId: process.env["MUSHI_PROJECT_ID"] } : {},
+    ...endpointFromEnv ? { endpoint: endpointFromEnv } : {},
+    ...process.env["MUSHI_CONSOLE_URL"] ? { consoleUrl: process.env["MUSHI_CONSOLE_URL"].trim() } : {}
+  };
+  return { ...file, ...fromEnv };
+}
+function saveConfig(config, path = CONFIG_PATH) {
+  const dir = dirname(path);
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true, mode: SECURE_DIR_MODE });
+  } else {
+    tightenDirPermissions(dir);
+  }
+  writeFileSync(path, JSON.stringify(config, null, 2), { mode: SECURE_FILE_MODE });
+  tightenPermissions(path);
+}
+function migrateLegacyConfig(legacyPath = LEGACY_CONFIG_PATH, destPath = CONFIG_PATH) {
+  if (!existsSync(legacyPath)) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(legacyPath, "utf-8"));
+  } catch {
+    return null;
+  }
+  const dir = dirname(destPath);
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true, mode: SECURE_DIR_MODE });
+  }
+  try {
+    renameSync(legacyPath, destPath);
+  } catch {
+    writeFileSync(destPath, JSON.stringify(parsed, null, 2), { mode: SECURE_FILE_MODE });
+    try {
+      unlinkSync(legacyPath);
+    } catch {
+    }
+  }
+  tightenPermissions(destPath);
+  tightenDirPermissions(dir);
+  return parsed;
+}
+function tightenPermissions(path) {
+  if (process.platform === "win32") return;
+  try {
+    const current = statSync(path).mode & 511;
+    if (current !== SECURE_FILE_MODE) chmodSync(path, SECURE_FILE_MODE);
+  } catch {
+  }
+}
+function tightenDirPermissions(path) {
+  if (process.platform === "win32") return;
+  try {
+    const current = statSync(path).mode & 511;
+    if (current !== SECURE_DIR_MODE) chmodSync(path, SECURE_DIR_MODE);
+  } catch {
+  }
+}
+
+// src/console-url.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { dirname as dirname2, join as join2 } from "path";
+var HOSTED_CONSOLE_BASE = "https://kensaur.us/mushi-mushi/admin";
+var LOCAL_ADMIN_URL = "http://localhost:6464";
+var LOCAL_PROBE_MS = 800;
+function normalizeConsoleBase(url) {
+  const trimmed = url.trim();
+  let end = trimmed.length;
+  while (end > 0 && trimmed.charCodeAt(end - 1) === 47) end--;
+  return trimmed.slice(0, end);
+}
+function consoleUrl(base, route) {
+  const normalizedRoute = route.startsWith("/") ? route : `/${route}`;
+  return `${normalizeConsoleBase(base)}${normalizedRoute}`;
+}
+function resolveConsoleUrlFromEnv() {
+  const raw = process.env["MUSHI_CONSOLE_URL"]?.trim();
+  return raw ? normalizeConsoleBase(raw) : void 0;
+}
+function isInsideMushiMonorepo(cwd) {
+  let dir = cwd;
+  for (let depth = 0; depth < 14; depth += 1) {
+    const pkgPath = join2(dir, "package.json");
+    if (existsSync2(pkgPath)) {
+      try {
+        const pkg = JSON.parse(readFileSync2(pkgPath, "utf-8"));
+        if (pkg.name === "mushi-mushi") return true;
+      } catch {
+      }
+    }
+    const parent = dirname2(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return false;
+}
+async function probeLocalAdminConsole() {
+  try {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), LOCAL_PROBE_MS);
+    const res = await fetch(LOCAL_ADMIN_URL, {
+      signal: controller.signal,
+      method: "HEAD"
+    });
+    clearTimeout(timer);
+    if (res.ok || res.status === 404 || res.status === 401) {
+      return LOCAL_ADMIN_URL;
+    }
+  } catch {
+  }
+  return null;
+}
+function resolveConsoleUrlSync(cwd = process.cwd()) {
+  const fromEnv = resolveConsoleUrlFromEnv();
+  if (fromEnv) return fromEnv;
+  const config = loadConfig();
+  if (config.consoleUrl) return normalizeConsoleBase(config.consoleUrl);
+  if (isInsideMushiMonorepo(cwd)) return LOCAL_ADMIN_URL;
+  return HOSTED_CONSOLE_BASE;
+}
+async function resolveConsoleUrl(options) {
+  const fromEnv = resolveConsoleUrlFromEnv();
+  if (fromEnv) return fromEnv;
+  const config = loadConfig();
+  if (config.consoleUrl) return normalizeConsoleBase(config.consoleUrl);
+  const local = await probeLocalAdminConsole();
+  if (local) return local;
+  const cwd = options?.cwd ?? process.cwd();
+  if (isInsideMushiMonorepo(cwd)) return LOCAL_ADMIN_URL;
+  return HOSTED_CONSOLE_BASE;
+}
+function projectIdHint(base) {
+  return `Where to find it: ${consoleUrl(base, "/projects")} \u2192 select your project \u2192 click the UUID chip to copy (or copy it from the panel right after you create the project).`;
+}
+function apiKeyHint(base) {
+  return `Where to find it: ${consoleUrl(base, "/onboarding?tab=verify")} \u2192 Generate API key (SDK ingest needs report:write \u2014 not Settings \u2192 BYOK keys). Treat it like a password \u2014 env file only, never commit.`;
+}
+function cliSetupDeepLink(base) {
+  return consoleUrl(base, "/onboarding?tab=steps&setup=cli");
+}
+function reportsUrl(base, reportId) {
+  return reportId ? consoleUrl(base, `/reports/${reportId}`) : consoleUrl(base, "/reports");
+}
+async function openInBrowser(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    return;
+  }
+  const safeUrl = parsed.toString();
+  const { spawn } = await import("child_process");
+  const [command, args] = process.platform === "win32" ? (
+    // Open via rundll32's FileProtocolHandler rather than `cmd /c start`.
+    // `start` is a cmd builtin, so the URL would be re-parsed by cmd.exe and
+    // characters like `&` / `|` / `^` could still break out — exactly the
+    // injection surface CodeQL flags. rundll32 never invokes a shell: the URL
+    // is handed to the default browser as one opaque argument.
+    ["rundll32", ["url.dll,FileProtocolHandler", safeUrl]]
+  ) : process.platform === "darwin" ? ["open", [safeUrl]] : ["xdg-open", [safeUrl]];
+  await new Promise((resolve) => {
+    try {
+      const child = spawn(command, [...args], { stdio: "ignore", shell: false });
+      child.on("error", () => resolve());
+      child.on("exit", () => resolve());
+      child.unref();
+    } catch {
+      resolve();
+    }
+  });
+}
+
+// src/endpoint.ts
+var TEST_REPORT_TIMEOUT_MS = 1e4;
+var TEST_REPORT_FETCH_TIMEOUT_MS = TEST_REPORT_TIMEOUT_MS;
+var CLOUD_API_ENDPOINT = "https://dxptnwrhwsqckaftyymj.supabase.co/functions/v1/api";
+function resolveCloudEndpoint(explicit) {
+  if (explicit?.trim()) return explicit.trim();
+  const fromEnv = process.env.MUSHI_API_ENDPOINT?.trim();
+  if (fromEnv) return fromEnv;
+  return CLOUD_API_ENDPOINT;
+}
+function assertEndpoint(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(`Invalid endpoint URL: ${url}`);
+  }
+  const host = parsed.hostname;
+  const isLocal = host === "localhost" || host === "127.0.0.1" || host === "::1" || host.endsWith(".local");
+  if (parsed.protocol !== "https:" && !isLocal) {
+    throw new Error(`Endpoint must use https:// (got ${parsed.protocol}//${host}).`);
+  }
+  return normalizeEndpoint(parsed.origin + parsed.pathname);
+}
+function normalizeEndpoint(url) {
+  if (!url) {
+    throw new Error(
+      "No API endpoint configured. Run `mushi init` or set MUSHI_API_ENDPOINT. Set endpoint to your Supabase edge function URL, e.g. https://xyz.supabase.co/functions/v1/api"
+    );
+  }
+  let end = url.length;
+  while (end > 0 && url.charCodeAt(end - 1) === 47) end--;
+  return url.slice(0, end);
+}
+
+// src/errors.ts
+var EXIT_CODE_MAP = {
+  E_AUTH_MISSING: 2,
+  E_AUTH_INVALID: 2,
+  E_PROJECT_MISSING: 2,
+  E_ENDPOINT_INVALID: 2,
+  E_INVALID_INPUT: 2,
+  E_NOT_INTERACTIVE: 2,
+  E_NETWORK: 3,
+  E_TIMEOUT: 3,
+  E_API_ERROR: 3,
+  E_RATE_LIMITED: 3,
+  E_FILE_NOT_FOUND: 1,
+  E_FILE_PERMISSION: 1,
+  E_FRESHNESS_STALE: 1,
+  E_INTERRUPTED: 130,
+  // 128 + SIGINT (2). POSIX convention.
+  E_INTERNAL: 1
+};
+var MushiCliError = class extends Error {
+  code;
+  hint;
+  cause;
+  constructor(code, message, hint, cause) {
+    super(message);
+    this.name = "MushiCliError";
+    this.code = code;
+    if (hint) this.hint = hint;
+    if (cause !== void 0) this.cause = cause;
+  }
+  /** Exit code POSIX-aware shell scripts should branch on. */
+  get exitCode() {
+    return EXIT_CODE_MAP[this.code];
+  }
+  /**
+   * Format for `--json` output. Used by the JSON writer when a CLI
+   * subcommand was invoked with `--json` and an error escapes.
+   */
+  toJSON() {
+    return {
+      error: {
+        code: this.code,
+        message: this.message,
+        ...this.hint ? { hint: this.hint } : {}
+      }
+    };
+  }
+};
+
+// src/signals.ts
+var activeController = null;
+function getAbortSignal(external) {
+  if (external) return external.signal;
+  if (!activeController || activeController.signal.aborted) {
+    activeController = new AbortController();
+  }
+  return activeController.signal;
+}
+
+// src/cli-shared.ts
+var UUID_RX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function requireUuid(value, label = "id") {
+  if (UUID_RX.test(value)) return value;
+  throw new MushiCliError(
+    "E_INVALID_INPUT",
+    `${label} must be a valid UUID`,
+    "copy the full id from `mushi reports list` or the console URL"
+  );
+}
+var API_TIMEOUT_MS = 15e3;
+async function apiCall(path, config, options = {}) {
+  const endpoint = config.endpoint;
+  if (!endpoint) {
+    return {
+      ok: false,
+      error: {
+        code: "NO_ENDPOINT",
+        message: "No API endpoint configured.\n  Run: mushi login --api-key <key> --endpoint <url> --project-id <id>\n  Or:  export MUSHI_API_ENDPOINT=https://<project-ref>.supabase.co/functions/v1/api"
+      }
+    };
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), API_TIMEOUT_MS);
+  const signals = [controller.signal, getAbortSignal()];
+  const compositeSignal = AbortSignal.any ? AbortSignal.any(signals) : controller.signal;
+  try {
+    const res = await fetch(`${endpoint}${path}`, {
+      ...options,
+      signal: compositeSignal,
+      headers: {
+        "Content-Type": "application/json",
+        // `apiKeyAuth` reads X-Mushi-Api-Key; the Authorization header is a
+        // fallback accepted by some older middleware. Both are sent.
+        "Authorization": `Bearer ${config.apiKey ?? ""}`,
+        "X-Mushi-Api-Key": config.apiKey ?? "",
+        "X-Mushi-Project": config.projectId ?? "",
+        "X-Mushi-Cli-Version": MUSHI_CLI_VERSION,
+        ...options.headers
+      }
+    });
+    clearTimeout(timer);
+    let body;
+    const contentType = res.headers.get("content-type") ?? "";
+    if (contentType.includes("application/json")) {
+      try {
+        body = await res.json();
+      } catch {
+        body = null;
+      }
+    } else {
+      const text = await res.text();
+      try {
+        body = JSON.parse(text);
+      } catch {
+        body = {
+          ok: false,
+          error: {
+            code: `HTTP_${res.status}`,
+            message: text.trim().slice(0, 300) || `HTTP ${res.status}`
+          }
+        };
+      }
+    }
+    if (!res.ok && typeof body === "object" && body !== null && !("ok" in body)) {
+      const b = body;
+      const nested = b["error"];
+      const errCode = nested?.["code"] ?? b["code"] ?? `HTTP_${res.status}`;
+      const errMsg = nested?.["message"] ?? b["message"] ?? `Request failed (${res.status})`;
+      return {
+        ok: false,
+        httpStatus: res.status,
+        error: { code: errCode, message: errMsg }
+      };
+    }
+    return body;
+  } catch (err) {
+    clearTimeout(timer);
+    if (err instanceof Error && err.name === "AbortError") {
+      return {
+        ok: false,
+        error: {
+          code: "TIMEOUT",
+          message: `Request timed out after ${API_TIMEOUT_MS / 1e3}s. Check your network or endpoint.`
+        }
+      };
+    }
+    return {
+      ok: false,
+      error: {
+        code: "NETWORK_ERROR",
+        message: err instanceof Error ? err.message : String(err)
+      }
+    };
+  }
+}
+
+export {
+  CONFIG_PATH,
+  loadConfig,
+  saveConfig,
+  consoleUrl,
+  resolveConsoleUrlSync,
+  resolveConsoleUrl,
+  projectIdHint,
+  apiKeyHint,
+  cliSetupDeepLink,
+  reportsUrl,
+  openInBrowser,
+  TEST_REPORT_FETCH_TIMEOUT_MS,
+  resolveCloudEndpoint,
+  assertEndpoint,
+  normalizeEndpoint,
+  requireUuid,
+  apiCall
+};

package/dist/{connect-2RM43XHO.js → connect-KX4UGY6Z.js}

@@ -2,13 +2,15 @@ import {
   CONFIG_PATH,
   assertEndpoint,
   normalizeEndpoint,
+  requireUuid,
   saveConfig
-} from "./chunk-XEXYGDQV.js";
+} from "./chunk-WLLFV26V.js";
 import {
   detectFramework,
   envVarsToWrite,
   readPackageJson
-} from "./chunk-JAUKBLPK.js";
+} from "./chunk-AIZRI665.js";
+import "./chunk-BY5SZYRO.js";
 
 // src/connect.ts
 import { appendFile, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
@@ -217,11 +219,12 @@ async function ensureMcpJsonGitignored(cwd, messages) {
 async function runConnect(opts, baseConfig = {}) {
   const cwd = resolve(opts.cwd ?? process.cwd());
   const endpoint = assertEndpoint(opts.endpoint);
+  const projectId = requireUuid(opts.projectId, "projectId");
   const messages = [];
   const config = {
     ...baseConfig,
     apiKey: opts.apiKey,
-    projectId: opts.projectId,
+    projectId,
     endpoint
   };
   saveConfig(config);
@@ -230,7 +233,7 @@ async function runConnect(opts, baseConfig = {}) {
   if (opts.writeEnv !== false) {
     const pkg = readPackageJson(cwd);
     const framework = detectFramework(cwd, pkg);
-    const lines = envVarsToWrite(opts.apiKey, opts.projectId, framework).split("\n");
+    const lines = envVarsToWrite(opts.apiKey, projectId, framework).split("\n");
     envPath = join(cwd, ".env.local");
     const wrote = await mergeEnvFile(envPath, lines);
     messages.push(
@@ -247,10 +250,10 @@ async function runConnect(opts, baseConfig = {}) {
   if (opts.wireIde !== false) {
     const mcpDir = join(cwd, ".cursor");
     mcpPath = join(mcpDir, "mcp.json");
-    const serverName = buildMcpServerName({ projectId: opts.projectId });
+    const serverName = buildMcpServerName({ projectId });
     const serverBlock = buildMcpServerBlock({
       endpoint,
-      projectId: opts.projectId,
+      projectId,
       apiKey: opts.apiKey
     });
     await writeMcpServerEntry({ configPath: mcpPath, serverName, serverBlock });
@@ -265,7 +268,7 @@ async function runConnect(opts, baseConfig = {}) {
     heartbeat = await waitForIngestReady({
       endpoint,
       apiKey: opts.apiKey,
-      projectId: opts.projectId,
+      projectId,
       maxAttempts,
       onPoll: (payload, attempt) => {
         if (!opts.json && attempt % 3 === 0) {

package/dist/{connect-JIEIWTF3.js → connect-XFVSH4JZ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runConnect
-} from "./chunk-R2HPR2FV.js";
+} from "./chunk-GSQO35YD.js";
 import "./chunk-LDPFTQLE.js";
 export {
   runConnect

package/dist/detect.d.ts

@@ -3,7 +3,7 @@
  * PURPOSE: Pure detection helpers for framework, package manager, and project state.
  *          Kept side-effect-free so the wizard remains unit-testable.
  */
-type FrameworkId = 'next' | 'react' | 'vue' | 'nuxt' | 'svelte' | 'sveltekit' | 'angular' | 'expo' | 'react-native' | 'capacitor' | 'express' | 'fastify' | 'hono' | 'vanilla';
+type FrameworkId = 'next' | 'react' | 'cra' | 'remix' | 'astro' | 'solid' | 'vue' | 'nuxt' | 'svelte' | 'sveltekit' | 'angular' | 'expo' | 'react-native' | 'capacitor' | 'express' | 'fastify' | 'hono' | 'vanilla';
 interface Framework {
     id: FrameworkId;
     label: string;

package/dist/detect.js

@@ -7,7 +7,7 @@ import {
   installCommand,
   isFrameworkId,
   readPackageJson
-} from "./chunk-JAUKBLPK.js";
+} from "./chunk-AIZRI665.js";
 export {
   FRAMEWORKS,
   FRAMEWORK_IDS,