@mushi-mushi/cli 0.30.1 → 0.30.3

package/dist/{chunk-BES6PACT.js → chunk-LBVNX3PN.js}

@@ -1,6 +1,6 @@
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-Q77VOS7K.js";
+} from "./chunk-ZQFQRBNL.js";
 import {
   assertEndpoint,
   normalizeEndpoint

package/dist/chunk-VJZVFEMZ.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+
+// src/version.ts
+var MUSHI_CLI_VERSION = true ? "0.30.3" : "0.0.0-dev";
+var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.24.6";
+
+export {
+  MUSHI_CLI_VERSION,
+  MUSHI_MCP_PIN_SPEC
+};

package/dist/chunk-ZQFQRBNL.js

@@ -0,0 +1,8 @@
+// src/version.ts
+var MUSHI_CLI_VERSION = true ? "0.30.3" : "0.0.0-dev";
+var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.24.6";
+
+export {
+  MUSHI_CLI_VERSION,
+  MUSHI_MCP_PIN_SPEC
+};

package/dist/{chunk-5PAFWBPL.js → chunk-ZRDGR4TV.js}

@@ -2,7 +2,7 @@
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-UVAVIRFO.js";
+} from "./chunk-VJZVFEMZ.js";
 import {
   detectFramework,
   envVarsToWrite,

package/dist/{connect-YK4ZIGTY.js → connect-RZUYFR66.js}

@@ -2,8 +2,8 @@
 import {
   resolveSdkEnvKey,
   runConnect
-} from "./chunk-5PAFWBPL.js";
-import "./chunk-UVAVIRFO.js";
+} from "./chunk-ZRDGR4TV.js";
+import "./chunk-VJZVFEMZ.js";
 import "./chunk-KOBEOGNF.js";
 import "./chunk-LDPFTQLE.js";
 import "./chunk-PDX44BCA.js";

package/dist/{connect-36RAPZOG.js → connect-Y77XNVUP.js}

@@ -6,10 +6,10 @@ import {
   saveConfig,
   savedSdkKeyFor,
   waitForIngestReady
-} from "./chunk-BES6PACT.js";
+} from "./chunk-LBVNX3PN.js";
 import {
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-Q77VOS7K.js";
+} from "./chunk-ZQFQRBNL.js";
 import {
   detectFramework,
   envVarsToWrite,

package/dist/index.js

@@ -53,11 +53,11 @@ import {
   setGlobalOutputFormat,
   trySaveKeyToKeychain,
   writeMcpServerEntry
-} from "./chunk-5PAFWBPL.js";
+} from "./chunk-ZRDGR4TV.js";
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-UVAVIRFO.js";
+} from "./chunk-VJZVFEMZ.js";
 import {
   FRAMEWORKS,
   detectFramework,
@@ -225,15 +225,15 @@ var DeviceAuthRequestError = class extends Error {
     this.retryable = status === void 0 || status >= 500 || status === 408;
   }
 };
-async function withOneRetry(run2) {
+async function withOneRetry(run) {
   try {
-    return await run2();
+    return await run();
   } catch (err) {
     if (err instanceof DeviceAuthRequestError && err.retryable) {
       if (deviceAuthRetryDelayMs > 0) {
         await defaultSleep(deviceAuthRetryDelayMs);
       }
-      return run2();
+      return run();
     }
     throw err;
   }
@@ -1524,7 +1524,7 @@ async function checkOnboardingStatus(config, _consoleBase, cwd, doFetch = global
 }
 async function checkVersionDrift(cwd, doFetch) {
   const checks = [];
-  const { MUSHI_CLI_VERSION: MUSHI_CLI_VERSION2 } = await import("./version-A76DBKDU.js");
+  const { MUSHI_CLI_VERSION: MUSHI_CLI_VERSION2 } = await import("./version-HJSICWYN.js");
   if (MUSHI_CLI_VERSION2 === "0.0.0-dev") return checks;
   const parse2 = (v) => {
     const m = v.replace(/^[~^]/, "").match(/^(\d+)\.(\d+)\.(\d+)/);
@@ -2448,7 +2448,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect: runConnect2 } = await import("./connect-YK4ZIGTY.js");
+    const { runConnect: runConnect2 } = await import("./connect-RZUYFR66.js");
     const saved = loadConfig();
     const result = await runConnect2(
       {
@@ -2784,6 +2784,13 @@ Useful after 'mushi login' to confirm credentials are correct.`).action(async (o
       console.log(`  Project:  ${d.project_name} (${d.project_id})`);
       console.log(`  Endpoint: ${config.endpoint}`);
       console.log(`  Reports:  ${d.stats.total_reports} total \xB7 ${d.stats.open_reports} open`);
+      if (d.scopes) {
+        console.log(`  Scopes:   ${d.scopes.length > 0 ? d.scopes.join(", ") : "none"}`);
+        if (!d.scopes.includes("mcp:read") && !d.scopes.includes("mcp:write")) {
+          console.log("  \u26A0 This is an SDK key: it can send reports but not read them. The CLI and MCP need mcp:read.");
+          console.log("    Mint one on the console MCP page, or run `mushi login`.");
+        }
+      }
     }
   });
   program2.command("ping").description("Check connectivity to the Mushi backend").option("--json", "Machine-readable JSON output").action(async (opts) => {
@@ -5162,18 +5169,18 @@ function registerTddCommands(program2) {
           config
         );
         if (!runsRes.ok) break;
-        const run2 = runsRes.data.runs.find((r) => r.id === res.data.runId);
-        if (!run2) break;
-        if (run2.status === "completed") {
+        const run = runsRes.data.runs.find((r) => r.id === res.data.runId);
+        if (!run) break;
+        if (run.status === "completed") {
           console.log(`
-\u2713 Done! ${run2.pages_crawled ?? 0} pages crawled.`);
-          if (run2.proposal_id) console.log(`  Proposal id: ${run2.proposal_id}`);
+\u2713 Done! ${run.pages_crawled ?? 0} pages crawled.`);
+          if (run.proposal_id) console.log(`  Proposal id: ${run.proposal_id}`);
           console.log(`  Review in the console: Inventory \u2192 Discovery \u2192 Past proposals`);
           break;
         }
-        if (run2.status === "failed") {
+        if (run.status === "failed") {
           console.error(`
-\u2717 Crawl failed: ${run2.error_message ?? "unknown"}`);
+\u2717 Crawl failed: ${run.error_message ?? "unknown"}`);
           process.exit(1);
         }
         process.stdout.write(".");
@@ -5933,9 +5940,9 @@ Examples:
     }
     if (data.gate_runs.length > 0) {
       console.log("\nGate Results:");
-      for (const run2 of data.gate_runs) {
-        const g = run2.status === "pass" ? "OK" : run2.status === "fail" ? "FAIL" : "SKIP";
-        console.log(`  ${g} ${run2.gate.padEnd(22)} ${run2.status}  (${run2.findings_count} finding${run2.findings_count !== 1 ? "s" : ""})`);
+      for (const run of data.gate_runs) {
+        const g = run.status === "pass" ? "OK" : run.status === "fail" ? "FAIL" : "SKIP";
+        console.log(`  ${g} ${run.gate.padEnd(22)} ${run.status}  (${run.findings_count} finding${run.findings_count !== 1 ? "s" : ""})`);
       }
     }
     const refresh = data.gate_refresh;
@@ -6218,25 +6225,25 @@ Pipeline started!
       console.log(JSON.stringify(result.data, null, 2));
       return;
     }
-    const run2 = result.data;
-    const statusIcon = run2.status === "completed" ? "\u2705" : run2.status === "failed" ? "\u274C" : run2.status === "running" ? "\u23F3" : "\u26AA";
+    const run = result.data;
+    const statusIcon = run.status === "completed" ? "\u2705" : run.status === "failed" ? "\u274C" : run.status === "running" ? "\u23F3" : "\u26AA";
     console.log(`
-${statusIcon}  Pipeline ${runId.slice(0, 8)} \xB7 ${run2.root_skill_slug} \xB7 ${run2.mode}
+${statusIcon}  Pipeline ${runId.slice(0, 8)} \xB7 ${run.root_skill_slug} \xB7 ${run.mode}
 `);
-    const steps = run2.steps ?? [];
+    const steps = run.steps ?? [];
     for (const step of steps) {
       const icon = step.status === "passed" ? "\u2705" : step.status === "failed" ? "\u274C" : step.status === "running" ? "\u23F3" : "\u26AA";
       const pr = step.pr_url ? ` \u2192 ${step.pr_url}` : "";
       console.log(`  ${icon} Step ${step.step_index + 1}: ${step.skill_slug}${pr}`);
       if (step.notes) console.log(`        ${step.notes}`);
     }
-    if (run2.context_packet) {
+    if (run.context_packet) {
       console.log(`
 ${"\u2500".repeat(60)}`);
       console.log(`Context Packet (paste into your Cursor agent):
 `);
-      console.log(run2.context_packet.slice(0, 6e3));
-      if (run2.context_packet.length > 6e3) console.log("\n\u2026 [truncated \u2014 full packet via --json]");
+      console.log(run.context_packet.slice(0, 6e3));
+      if (run.context_packet.length > 6e3) console.log("\n\u2026 [truncated \u2014 full packet via --json]");
     }
     console.log();
   });
@@ -6498,7 +6505,7 @@ Examples:
 }
 
 // src/commands/selfhost.ts
-import { execSync as execSync3, spawnSync } from "child_process";
+import { spawnSync } from "child_process";
 import { randomBytes } from "crypto";
 function hasSupabaseCli() {
   try {
@@ -6508,28 +6515,28 @@ function hasSupabaseCli() {
     return false;
   }
 }
-function run(cmd, opts) {
-  if (opts.printOnly) {
-    console.log(`  $ ${cmd}`);
-    return { ok: true, stdout: "", stderr: "" };
-  }
-  const label = opts.label ?? cmd.slice(0, 60);
-  process.stdout.write(`  \u203A ${label} \u2026 `);
-  try {
-    const out = execSync3(cmd, {
-      cwd: opts.cwd,
-      encoding: "utf8",
-      timeout: 3e5,
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    process.stdout.write("\u2713\n");
-    return { ok: true, stdout: out, stderr: "" };
-  } catch (err) {
+function selfhostStepCommand(step) {
+  return `supabase ${step.args.join(" ")}${step.mayFail ? " || true" : ""}`;
+}
+function runSupabase(args, opts) {
+  process.stdout.write(`  \u203A ${opts.label} \u2026 `);
+  const r = spawnSync("supabase", args, {
+    cwd: opts.cwd,
+    encoding: "utf8",
+    timeout: 3e5,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (r.error || r.status !== 0) {
     process.stdout.write("\u2717\n");
-    const msg = (err instanceof Error ? err.message : String(err)).trim();
-    const stderr = err.stderr ?? "";
-    return { ok: false, stdout: "", stderr: stderr || msg };
+    const stderr = (r.stderr ?? "").trim();
+    return {
+      ok: false,
+      stdout: r.stdout ?? "",
+      stderr: stderr || r.error?.message || `exited with ${r.status ?? r.signal}`
+    };
   }
+  process.stdout.write("\u2713\n");
+  return { ok: true, stdout: r.stdout, stderr: "" };
 }
 var REQUIRED_FUNCTIONS = [
   "api",
@@ -6539,55 +6546,43 @@ var REQUIRED_FUNCTIONS = [
   "fix-worker",
   "webhooks-github-indexer"
 ];
-async function runSelfhostUp(opts) {
-  const supabaseDir = opts.cwd ? `${opts.cwd}/packages/server/supabase` : "packages/server/supabase";
-  const printOnly = !!(opts.printCommands || !hasSupabaseCli());
-  if (printOnly) {
-    console.log("");
-    console.log("supabase CLI not found (or --print-commands was passed).");
-    console.log("Run the following commands manually:\n");
-  } else {
-    console.log("");
-    console.log("mushi selfhost up \u2014 deploying self-hosted Mushi Mushi\n");
-  }
+function buildSelfhostSteps(opts, printOnly, internalToken) {
   const steps = [];
   if (opts.projectRef && !/^[a-z0-9-]+$/i.test(opts.projectRef)) {
-    process.stderr.write(`\u2717 --project-ref must be alphanumeric (got: ${opts.projectRef}).
-`);
-    process.exit(1);
+    return { ok: false, error: `--project-ref must be alphanumeric (got: ${opts.projectRef}).` };
   }
   if (opts.projectRef) {
     steps.push({
       label: `link to Supabase project ${opts.projectRef}`,
-      cmd: `supabase link --project-ref ${opts.projectRef}`,
+      args: ["link", "--project-ref", opts.projectRef],
       critical: true
     });
   }
   steps.push({
     label: "apply database migrations",
-    cmd: "supabase db push",
+    args: ["db", "push"],
     critical: true
   });
   if (opts.anthropicKey && printOnly) {
     steps.push({
       label: "set ANTHROPIC_API_KEY secret",
-      cmd: "supabase secrets set ANTHROPIC_API_KEY=sk-ant-..."
+      args: ["secrets", "set", "ANTHROPIC_API_KEY=sk-ant-..."]
     });
   } else if (opts.anthropicKey) {
     if (!/^[A-Za-z0-9_-]+$/.test(opts.anthropicKey)) {
-      process.stderr.write(
-        "\u2717 --anthropic-key contains characters that cannot be passed through the shell safely.\n  Set it manually instead: supabase secrets set ANTHROPIC_API_KEY=<your key>\n"
-      );
-      process.exit(1);
+      return {
+        ok: false,
+        error: "--anthropic-key does not look like an API key (letters, digits, - and _ only).\n  Set it manually instead: supabase secrets set ANTHROPIC_API_KEY=<your key>"
+      };
     }
     steps.push({
       label: "set ANTHROPIC_API_KEY secret",
-      cmd: `supabase secrets set ANTHROPIC_API_KEY=${opts.anthropicKey}`
+      args: ["secrets", "set", `ANTHROPIC_API_KEY=${opts.anthropicKey}`]
     });
   } else if (printOnly) {
     steps.push({
       label: "set ANTHROPIC_API_KEY secret",
-      cmd: "supabase secrets set ANTHROPIC_API_KEY=sk-ant-..."
+      args: ["secrets", "set", "ANTHROPIC_API_KEY=sk-ant-..."]
     });
   }
   if (opts.adminBaseUrl) {
@@ -6599,43 +6594,65 @@ async function runSelfhostUp(opts) {
       adminUrlOk = false;
     }
     if (!adminUrlOk) {
-      process.stderr.write(
-        `\u2717 --admin-base-url must be a plain http(s) URL (got: ${opts.adminBaseUrl}).
-`
-      );
-      process.exit(1);
+      return { ok: false, error: `--admin-base-url must be a plain http(s) URL (got: ${opts.adminBaseUrl}).` };
     }
     steps.push({
       label: "set ADMIN_BASE_URL secret",
-      cmd: `supabase secrets set ADMIN_BASE_URL=${opts.adminBaseUrl}`
+      args: ["secrets", "set", `ADMIN_BASE_URL=${opts.adminBaseUrl}`]
     });
   }
-  const internalToken = randomBytes(32).toString("hex");
   steps.push({
     label: "set MUSHI_INTERNAL_CALLER_SECRET (recovery cron auth)",
-    cmd: `supabase secrets set MUSHI_INTERNAL_CALLER_SECRET=${printOnly ? "<openssl rand -hex 32>" : internalToken}`
+    args: [
+      "secrets",
+      "set",
+      `MUSHI_INTERNAL_CALLER_SECRET=${printOnly ? "<openssl rand -hex 32>" : internalToken}`
+    ]
   });
   if (!opts.skipDeploy) {
     for (const fn of REQUIRED_FUNCTIONS) {
       steps.push({
         label: `deploy edge function: ${fn}`,
-        cmd: `supabase functions deploy ${fn} --no-verify-jwt`
+        args: ["functions", "deploy", fn, "--no-verify-jwt"]
       });
     }
   }
   steps.push({
     label: "create screenshots storage bucket",
-    cmd: "supabase storage create screenshots --public || true"
+    args: ["storage", "create", "screenshots", "--public"],
+    mayFail: true
   });
+  return { ok: true, steps };
+}
+async function runSelfhostUp(opts) {
+  const supabaseDir = opts.cwd ? `${opts.cwd}/packages/server/supabase` : "packages/server/supabase";
+  const printOnly = !!(opts.printCommands || !hasSupabaseCli());
+  if (printOnly) {
+    console.log("");
+    console.log("supabase CLI not found (or --print-commands was passed).");
+    console.log("Run the following commands manually:\n");
+  } else {
+    console.log("");
+    console.log("mushi selfhost up \u2014 deploying self-hosted Mushi Mushi\n");
+  }
+  const built = buildSelfhostSteps(opts, printOnly, randomBytes(32).toString("hex"));
+  if (!built.ok) {
+    process.stderr.write(`\u2717 ${built.error}
+`);
+    process.exit(1);
+  }
   let aborted = false;
-  for (const step of steps) {
+  for (const step of built.steps) {
     if (printOnly) {
       console.log(`# ${step.label}`);
-      run(step.cmd, { printOnly: true });
+      console.log(`  $ ${selfhostStepCommand(step)}`);
       console.log("");
     } else {
-      const result = run(step.cmd, { label: step.label, cwd: supabaseDir });
-      if (!result.ok) {
+      const result = runSupabase(step.args, { label: step.label, cwd: supabaseDir });
+      if (!result.ok && step.mayFail) {
+        process.stdout.write(`    (fine if it already exists) ${result.stderr.split("\n")[0]}
+`);
+      } else if (!result.ok) {
         if (result.stderr) {
           process.stderr.write(`    ${result.stderr.split("\n")[0]}
 `);
@@ -10678,8 +10695,8 @@ function registerUxRunsCommands(program2) {
       console.log(JSON.stringify(result.data, null, 2));
       return;
     }
-    const { run: run2, surfaces } = result.data;
-    if (run2.branch) console.log(`Kept changes: ${run2.branch}
+    const { run, surfaces } = result.data;
+    if (run.branch) console.log(`Kept changes: ${run.branch}
 `);
     const order = ["regressed", "reverted", "blocked", "iterating", "baseline", "accepted", "skipped", "pending"];
     for (const s of [...surfaces].sort((a, b) => order.indexOf(a.status) - order.indexOf(b.status))) {

package/dist/init.js

@@ -25,10 +25,10 @@ import {
   saveConfig,
   savedSdkKeyFor,
   trySaveKeyToKeychain
-} from "./chunk-BES6PACT.js";
+} from "./chunk-LBVNX3PN.js";
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-Q77VOS7K.js";
+} from "./chunk-ZQFQRBNL.js";
 import {
   FRAMEWORKS,
   detectFramework,
@@ -2037,7 +2037,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect } = await import("./connect-36RAPZOG.js");
+    const { runConnect } = await import("./connect-Y77XNVUP.js");
     const saved = loadConfig();
     const result = await runConnect(
       {

package/dist/{version-A76DBKDU.js → version-HJSICWYN.js}

@@ -2,7 +2,7 @@
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-UVAVIRFO.js";
+} from "./chunk-VJZVFEMZ.js";
 import "./chunk-PDX44BCA.js";
 export {
   MUSHI_CLI_VERSION,

package/dist/version.d.ts

@@ -14,6 +14,6 @@ declare const MUSHI_CLI_VERSION: string;
  * setup refreshes the pin. Synced to packages/mcp/package.json by
  * `scripts/sync-mcp-pin.mjs` — never hand-edit the version.
  */
-declare const MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.24.4";
+declare const MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.24.6";
 
 export { MUSHI_CLI_VERSION, MUSHI_MCP_PIN_SPEC };

package/dist/version.js

@@ -1,7 +1,7 @@
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-Q77VOS7K.js";
+} from "./chunk-ZQFQRBNL.js";
 import "./chunk-3RG5ZIWI.js";
 export {
   MUSHI_CLI_VERSION,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mushi-mushi/cli",
-  "version": "0.30.1",
+  "version": "0.30.3",
   "license": "MIT",
   "description": "Mushi CLI: SDK setup, MCP wiring, bug triage. The bug mediator for AI-built apps: plain-English diagnosis + a ready fix, in your editor.",
   "bin": {

package/dist/chunk-Q77VOS7K.js

@@ -1,8 +0,0 @@
-// src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.30.1" : "0.0.0-dev";
-var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.24.4";
-
-export {
-  MUSHI_CLI_VERSION,
-  MUSHI_MCP_PIN_SPEC
-};

package/dist/chunk-UVAVIRFO.js

@@ -1,10 +0,0 @@
-#!/usr/bin/env node
-
-// src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.30.1" : "0.0.0-dev";
-var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.24.4";
-
-export {
-  MUSHI_CLI_VERSION,
-  MUSHI_MCP_PIN_SPEC
-};