@mushi-mushi/cli 0.27.1 → 0.29.0

package/README.md

@@ -181,10 +181,15 @@ local bumps; use the PR flow when you want review + CI on the dependency change.
 ```bash
 mushi upgrade               # plan + install
 mushi upgrade --dry-run     # print the install command without running it
+mushi upgrade --check       # plan only: exit 0 current, 1 outdated, 2 registry down
 mushi upgrade --json        # machine-readable plan + result
 mushi upgrade --cwd ../app  # target another repo
 ```
 
+`--check` never installs. Use it in a **non-required** CI job so a one-patch
+drift cannot freeze production deploys. Exit `2` (registry unreachable) should
+not fail a required gate — retry or treat as a warning.
+
 Pre-release versions are never auto-selected, registry versions are validated
 against strict semver before being interpolated into the install command, and
 non-registry specifiers (`workspace:`, `file:`, git URLs, dist-tags) are left
@@ -440,4 +445,4 @@ The CLI is also importable for tooling (used by `create-mushi-mushi`):
 MIT
 
 <!-- mushi-readme-stats-footer -->
-<sub>Monorepo scale (July 2026): 55 edge functions · 331 SQL migrations · 13 outbound plugins · 11 inbound adapters · 19 pipeline agents. Canonical counts: <a href="https://github.com/kensaurus/mushi-mushi/blob/master/docs/stats.md">docs/stats.md</a> · <code>pnpm docs-stats</code></sub>
+<sub>Monorepo scale (July 2026): 64 edge functions · 410 SQL migrations · 13 outbound plugins · 11 inbound adapters · 19 pipeline agents. Canonical counts: <a href="https://github.com/kensaurus/mushi-mushi/blob/master/docs/stats.md">docs/stats.md</a> · <code>pnpm docs-stats</code></sub>

package/dist/chunk-F4EGZNKA.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+
+// src/version.ts
+var MUSHI_CLI_VERSION = true ? "0.29.0" : "0.0.0-dev";
+var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.24.0";
+
+export {
+  MUSHI_CLI_VERSION,
+  MUSHI_MCP_PIN_SPEC
+};

package/dist/{chunk-M7CDSRZM.js → chunk-FDDSGZSC.js}

@@ -1,17 +1,14 @@
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-XLGHUOKY.js";
+} from "./chunk-UZZUGLI2.js";
+import {
+  assertEndpoint,
+  normalizeEndpoint
+} from "./chunk-SXSI2W6Z.js";
 import {
   __require
 } from "./chunk-3RG5ZIWI.js";
 
-// src/config.ts
-import { randomUUID } from "crypto";
-import { spawnSync } from "child_process";
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
-import { homedir } from "os";
-import { dirname, join } from "path";
-
 // src/keychain.ts
 var KEYCHAIN_SERVICE = "mushi-cli";
 function accountName(profile = "default") {
@@ -29,6 +26,18 @@ function getEntryClass() {
   }
   return _EntryClass ?? null;
 }
+function trySaveKeyToKeychain(apiKey, profile = "default") {
+  if (!apiKey) return false;
+  const EntryClass = getEntryClass();
+  if (!EntryClass) return false;
+  try {
+    const entry = new EntryClass(KEYCHAIN_SERVICE, accountName(profile));
+    entry.setPassword(apiKey);
+    return true;
+  } catch {
+    return false;
+  }
+}
 function tryLoadKeyFromKeychain(profile = "default") {
   const EntryClass = getEntryClass();
   if (!EntryClass) return null;
@@ -42,10 +51,20 @@ function tryLoadKeyFromKeychain(profile = "default") {
 }
 
 // src/config.ts
+import { randomUUID } from "crypto";
+import { spawnSync } from "child_process";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
 var DEFAULT_PROFILE = "default";
 function isMultiProfileFile(value) {
   return typeof value === "object" && value !== null && "profiles" in value && typeof value.profiles === "object" && value.profiles !== null;
 }
+function savedSdkKeyFor(config, projectId) {
+  const saved = config.sdkKey;
+  if (!projectId || !saved || typeof saved !== "object") return void 0;
+  return saved.projectId === projectId && typeof saved.key === "string" && saved.key ? saved.key : void 0;
+}
 function resolveProfileName(explicit, fileActive) {
   const fromEnv = process.env["MUSHI_PROFILE"]?.trim();
   return explicit?.trim() || fromEnv || fileActive || DEFAULT_PROFILE;
@@ -225,6 +244,47 @@ function tightenWindowsAcl(path, type) {
   }
 }
 
+// src/key-scopes.ts
+var SDK_KEY_SCOPES = ["report:write"];
+var CLI_KEY_SCOPES = ["report:write", "mcp:read"];
+var SDK_KEY_LABEL = "sdk-ingest";
+var CLI_KEY_LABEL = "cli-login";
+async function probeKeyScope(endpoint, apiKey, projectId, doFetch = globalThis.fetch) {
+  let base = endpoint;
+  while (base.endsWith("/")) base = base.slice(0, -1);
+  let res;
+  try {
+    res = await doFetch(`${base}/v1/admin/mcp/account-overview`, {
+      headers: { "X-Mushi-Api-Key": apiKey, "X-Mushi-Project": projectId },
+      signal: AbortSignal.timeout(8e3)
+    });
+  } catch (err) {
+    return { result: "unreachable", message: err instanceof Error ? err.message : String(err) };
+  }
+  if (res.ok) return { result: "mcp", status: res.status };
+  if (res.status === 401) return { result: "invalid", status: res.status };
+  if (res.status === 403) {
+    const body = await res.json().catch(() => null);
+    const code = body?.error?.code ?? body?.code;
+    if (code === "INSUFFICIENT_SCOPE") return { result: "ingest-only", status: res.status };
+  }
+  return { result: "unknown", status: res.status };
+}
+function describeUnsafeSdkKey(probe, endpoint) {
+  switch (probe.result) {
+    case "mcp":
+      return "this key can read your bug reports (mcp scope), and SDK env vars ship inside the app bundle";
+    case "invalid":
+      return "the backend rejected this key";
+    case "unreachable":
+      return `could not reach ${endpoint} to confirm the key is ingest-only (${probe.message ?? "network error"})`;
+    case "unknown":
+      return `could not confirm the key is ingest-only (HTTP ${probe.status ?? "?"})`;
+    case "ingest-only":
+      return "the key is ingest-only";
+  }
+}
+
 // src/console-url.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { dirname as dirname2, join as join2 } from "path";
@@ -341,41 +401,6 @@ async function openInBrowser(url) {
   });
 }
 
-// src/endpoint.ts
-var TEST_REPORT_TIMEOUT_MS = 1e4;
-var TEST_REPORT_FETCH_TIMEOUT_MS = TEST_REPORT_TIMEOUT_MS;
-var CLOUD_API_ENDPOINT = "https://dxptnwrhwsqckaftyymj.supabase.co/functions/v1/api";
-function resolveCloudEndpoint(explicit) {
-  if (explicit?.trim()) return explicit.trim();
-  const fromEnv = process.env.MUSHI_API_ENDPOINT?.trim();
-  if (fromEnv) return fromEnv;
-  return CLOUD_API_ENDPOINT;
-}
-function assertEndpoint(url) {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw new Error(`Invalid endpoint URL: ${url}`);
-  }
-  const host = parsed.hostname;
-  const isLocal = host === "localhost" || host === "127.0.0.1" || host === "::1" || host.endsWith(".local");
-  if (parsed.protocol !== "https:" && !isLocal) {
-    throw new Error(`Endpoint must use https:// (got ${parsed.protocol}//${host}).`);
-  }
-  return normalizeEndpoint(parsed.origin + parsed.pathname);
-}
-function normalizeEndpoint(url) {
-  if (!url) {
-    throw new Error(
-      "No API endpoint configured. Run `mushi init` or set MUSHI_API_ENDPOINT. Set endpoint to your Supabase edge function URL, e.g. https://xyz.supabase.co/functions/v1/api"
-    );
-  }
-  let end = url.length;
-  while (end > 0 && url.charCodeAt(end - 1) === 47) end--;
-  return url.slice(0, end);
-}
-
 // src/errors.ts
 var EXIT_CODE_MAP = {
   E_AUTH_MISSING: 2,
@@ -446,7 +471,30 @@ function requireUuid(value, label = "id") {
   );
 }
 var API_TIMEOUT_MS = 15e3;
-async function apiCall(path, config, options = {}) {
+function normalizeApiError(error, httpStatus) {
+  const fallbackCode = httpStatus ? `HTTP_${httpStatus}` : "API_ERROR";
+  if (typeof error === "string") return { code: fallbackCode, message: error };
+  if (error && typeof error === "object") {
+    const e = error;
+    if (typeof e["code"] === "string" && typeof e["message"] === "string") {
+      return e;
+    }
+    const formErrors = Array.isArray(e["formErrors"]) ? e["formErrors"].map(String) : [];
+    const fieldErrors = e["fieldErrors"] && typeof e["fieldErrors"] === "object" ? Object.entries(e["fieldErrors"]).map(
+      ([field, msgs]) => `${field}: ${Array.isArray(msgs) ? msgs.join(", ") : String(msgs)}`
+    ) : [];
+    const parts = [...formErrors, ...fieldErrors];
+    if (parts.length > 0) return { code: "VALIDATION_ERROR", message: parts.join("; ") };
+    return {
+      ...e,
+      code: typeof e["code"] === "string" ? e["code"] : fallbackCode,
+      message: typeof e["message"] === "string" ? e["message"] : `Request failed${httpStatus ? ` (${httpStatus})` : ""}`
+    };
+  }
+  return { code: fallbackCode, message: `Request failed${httpStatus ? ` (${httpStatus})` : ""}` };
+}
+async function apiCall(path, config, options = {}, callOptions = {}) {
+  const timeoutMs = callOptions.timeoutMs ?? API_TIMEOUT_MS;
   const endpoint = config.endpoint;
   if (!endpoint) {
     return {
@@ -458,7 +506,7 @@ async function apiCall(path, config, options = {}) {
     };
   }
   const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), API_TIMEOUT_MS);
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
   const signals = [controller.signal, getAbortSignal()];
   const compositeSignal = AbortSignal.any ? AbortSignal.any(signals) : controller.signal;
   try {
@@ -487,6 +535,7 @@ async function apiCall(path, config, options = {}) {
       }
     } else {
       const text = await res.text();
+      if (callOptions.text && res.ok) return { ok: true, data: text };
       try {
         body = JSON.parse(text);
       } catch {
@@ -510,6 +559,13 @@ async function apiCall(path, config, options = {}) {
         error: { code: errCode, message: errMsg }
       };
     }
+    if (typeof body === "object" && body !== null && body.ok === false) {
+      return {
+        ok: false,
+        httpStatus: res.status,
+        error: normalizeApiError(body.error, res.status)
+      };
+    }
     return body;
   } catch (err) {
     clearTimeout(timer);
@@ -518,7 +574,7 @@ async function apiCall(path, config, options = {}) {
         ok: false,
         error: {
           code: "TIMEOUT",
-          message: `Request timed out after ${API_TIMEOUT_MS / 1e3}s. Check your network or endpoint.`
+          message: `Request timed out after ${timeoutMs / 1e3}s. Check your network or endpoint.`
         }
       };
     }
@@ -644,11 +700,20 @@ async function waitForIngestReady(options) {
 }
 
 export {
+  trySaveKeyToKeychain,
+  savedSdkKeyFor,
+  resolveProfileName,
   CONFIG_PATH,
   loadConfig,
   ensureClientId,
   maybeShowTelemetryNotice,
   saveConfig,
+  SDK_KEY_SCOPES,
+  CLI_KEY_SCOPES,
+  SDK_KEY_LABEL,
+  CLI_KEY_LABEL,
+  probeKeyScope,
+  describeUnsafeSdkKey,
   consoleUrl,
   resolveConsoleUrlSync,
   resolveConsoleUrl,
@@ -657,10 +722,6 @@ export {
   cliSetupDeepLink,
   reportsUrl,
   openInBrowser,
-  TEST_REPORT_FETCH_TIMEOUT_MS,
-  resolveCloudEndpoint,
-  assertEndpoint,
-  normalizeEndpoint,
   requireUuid,
   apiCall,
   sanitizeEndpoint,