@mushi-mushi/cli 0.27.0 → 0.28.0

package/README.md

@@ -181,10 +181,15 @@ local bumps; use the PR flow when you want review + CI on the dependency change.
 ```bash
 mushi upgrade               # plan + install
 mushi upgrade --dry-run     # print the install command without running it
+mushi upgrade --check       # plan only: exit 0 current, 1 outdated, 2 registry down
 mushi upgrade --json        # machine-readable plan + result
 mushi upgrade --cwd ../app  # target another repo
 ```
 
+`--check` never installs. Use it in a **non-required** CI job so a one-patch
+drift cannot freeze production deploys. Exit `2` (registry unreachable) should
+not fail a required gate — retry or treat as a warning.
+
 Pre-release versions are never auto-selected, registry versions are validated
 against strict semver before being interpolated into the install command, and
 non-registry specifiers (`workspace:`, `file:`, git URLs, dist-tags) are left
@@ -440,4 +445,4 @@ The CLI is also importable for tooling (used by `create-mushi-mushi`):
 MIT
 
 <!-- mushi-readme-stats-footer -->
-<sub>Monorepo scale (July 2026): 55 edge functions · 328 SQL migrations · 13 outbound plugins · 11 inbound adapters · 19 pipeline agents. Canonical counts: <a href="https://github.com/kensaurus/mushi-mushi/blob/master/docs/stats.md">docs/stats.md</a> · <code>pnpm docs-stats</code></sub>
+<sub>Monorepo scale (July 2026): 59 edge functions · 374 SQL migrations · 13 outbound plugins · 11 inbound adapters · 19 pipeline agents. Canonical counts: <a href="https://github.com/kensaurus/mushi-mushi/blob/master/docs/stats.md">docs/stats.md</a> · <code>pnpm docs-stats</code></sub>

package/dist/{chunk-TZL3F3GT.js → chunk-AV3RKAEE.js}

@@ -1,17 +1,14 @@
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-LFZ5ZIBI.js";
+} from "./chunk-U2VGB63C.js";
+import {
+  assertEndpoint,
+  normalizeEndpoint
+} from "./chunk-SXSI2W6Z.js";
 import {
   __require
 } from "./chunk-3RG5ZIWI.js";
 
-// src/config.ts
-import { randomUUID } from "crypto";
-import { spawnSync } from "child_process";
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
-import { homedir } from "os";
-import { dirname, join } from "path";
-
 // src/keychain.ts
 var KEYCHAIN_SERVICE = "mushi-cli";
 function accountName(profile = "default") {
@@ -29,6 +26,18 @@ function getEntryClass() {
   }
   return _EntryClass ?? null;
 }
+function trySaveKeyToKeychain(apiKey, profile = "default") {
+  if (!apiKey) return false;
+  const EntryClass = getEntryClass();
+  if (!EntryClass) return false;
+  try {
+    const entry = new EntryClass(KEYCHAIN_SERVICE, accountName(profile));
+    entry.setPassword(apiKey);
+    return true;
+  } catch {
+    return false;
+  }
+}
 function tryLoadKeyFromKeychain(profile = "default") {
   const EntryClass = getEntryClass();
   if (!EntryClass) return null;
@@ -42,10 +51,20 @@ function tryLoadKeyFromKeychain(profile = "default") {
 }
 
 // src/config.ts
+import { randomUUID } from "crypto";
+import { spawnSync } from "child_process";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
 var DEFAULT_PROFILE = "default";
 function isMultiProfileFile(value) {
   return typeof value === "object" && value !== null && "profiles" in value && typeof value.profiles === "object" && value.profiles !== null;
 }
+function savedSdkKeyFor(config, projectId) {
+  const saved = config.sdkKey;
+  if (!projectId || !saved || typeof saved !== "object") return void 0;
+  return saved.projectId === projectId && typeof saved.key === "string" && saved.key ? saved.key : void 0;
+}
 function resolveProfileName(explicit, fileActive) {
   const fromEnv = process.env["MUSHI_PROFILE"]?.trim();
   return explicit?.trim() || fromEnv || fileActive || DEFAULT_PROFILE;
@@ -225,6 +244,47 @@ function tightenWindowsAcl(path, type) {
   }
 }
 
+// src/key-scopes.ts
+var SDK_KEY_SCOPES = ["report:write"];
+var CLI_KEY_SCOPES = ["report:write", "mcp:read"];
+var SDK_KEY_LABEL = "sdk-ingest";
+var CLI_KEY_LABEL = "cli-login";
+async function probeKeyScope(endpoint, apiKey, projectId, doFetch = globalThis.fetch) {
+  let base = endpoint;
+  while (base.endsWith("/")) base = base.slice(0, -1);
+  let res;
+  try {
+    res = await doFetch(`${base}/v1/admin/mcp/account-overview`, {
+      headers: { "X-Mushi-Api-Key": apiKey, "X-Mushi-Project": projectId },
+      signal: AbortSignal.timeout(8e3)
+    });
+  } catch (err) {
+    return { result: "unreachable", message: err instanceof Error ? err.message : String(err) };
+  }
+  if (res.ok) return { result: "mcp", status: res.status };
+  if (res.status === 401) return { result: "invalid", status: res.status };
+  if (res.status === 403) {
+    const body = await res.json().catch(() => null);
+    const code = body?.error?.code ?? body?.code;
+    if (code === "INSUFFICIENT_SCOPE") return { result: "ingest-only", status: res.status };
+  }
+  return { result: "unknown", status: res.status };
+}
+function describeUnsafeSdkKey(probe, endpoint) {
+  switch (probe.result) {
+    case "mcp":
+      return "this key can read your bug reports (mcp scope), and SDK env vars ship inside the app bundle";
+    case "invalid":
+      return "the backend rejected this key";
+    case "unreachable":
+      return `could not reach ${endpoint} to confirm the key is ingest-only (${probe.message ?? "network error"})`;
+    case "unknown":
+      return `could not confirm the key is ingest-only (HTTP ${probe.status ?? "?"})`;
+    case "ingest-only":
+      return "the key is ingest-only";
+  }
+}
+
 // src/console-url.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { dirname as dirname2, join as join2 } from "path";
@@ -341,41 +401,6 @@ async function openInBrowser(url) {
   });
 }
 
-// src/endpoint.ts
-var TEST_REPORT_TIMEOUT_MS = 1e4;
-var TEST_REPORT_FETCH_TIMEOUT_MS = TEST_REPORT_TIMEOUT_MS;
-var CLOUD_API_ENDPOINT = "https://dxptnwrhwsqckaftyymj.supabase.co/functions/v1/api";
-function resolveCloudEndpoint(explicit) {
-  if (explicit?.trim()) return explicit.trim();
-  const fromEnv = process.env.MUSHI_API_ENDPOINT?.trim();
-  if (fromEnv) return fromEnv;
-  return CLOUD_API_ENDPOINT;
-}
-function assertEndpoint(url) {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw new Error(`Invalid endpoint URL: ${url}`);
-  }
-  const host = parsed.hostname;
-  const isLocal = host === "localhost" || host === "127.0.0.1" || host === "::1" || host.endsWith(".local");
-  if (parsed.protocol !== "https:" && !isLocal) {
-    throw new Error(`Endpoint must use https:// (got ${parsed.protocol}//${host}).`);
-  }
-  return normalizeEndpoint(parsed.origin + parsed.pathname);
-}
-function normalizeEndpoint(url) {
-  if (!url) {
-    throw new Error(
-      "No API endpoint configured. Run `mushi init` or set MUSHI_API_ENDPOINT. Set endpoint to your Supabase edge function URL, e.g. https://xyz.supabase.co/functions/v1/api"
-    );
-  }
-  let end = url.length;
-  while (end > 0 && url.charCodeAt(end - 1) === 47) end--;
-  return url.slice(0, end);
-}
-
 // src/errors.ts
 var EXIT_CODE_MAP = {
   E_AUTH_MISSING: 2,
@@ -644,11 +669,20 @@ async function waitForIngestReady(options) {
 }
 
 export {
+  trySaveKeyToKeychain,
+  savedSdkKeyFor,
+  resolveProfileName,
   CONFIG_PATH,
   loadConfig,
   ensureClientId,
   maybeShowTelemetryNotice,
   saveConfig,
+  SDK_KEY_SCOPES,
+  CLI_KEY_SCOPES,
+  SDK_KEY_LABEL,
+  CLI_KEY_LABEL,
+  probeKeyScope,
+  describeUnsafeSdkKey,
   consoleUrl,
   resolveConsoleUrlSync,
   resolveConsoleUrl,
@@ -657,10 +691,6 @@ export {
   cliSetupDeepLink,
   reportsUrl,
   openInBrowser,
-  TEST_REPORT_FETCH_TIMEOUT_MS,
-  resolveCloudEndpoint,
-  assertEndpoint,
-  normalizeEndpoint,
   requireUuid,
   apiCall,
   sanitizeEndpoint,