@mushi-mushi/cli 0.36.1 → 0.36.2

package/dist/{chunk-GLA6OXI3.js → chunk-2JOEQQOU.js}

@@ -9,10 +9,10 @@ import {
   requireUuid,
   saveConfig,
   savedSdkKeyFor
-} from "./chunk-TFNFJXCK.js";
+} from "./chunk-H6HZNVVT.js";
 import {
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-R4ZRRD4B.js";
+} from "./chunk-YYDQ3IYE.js";
 import {
   assertEndpoint,
   normalizeEndpoint

package/dist/{chunk-5DQLHMVZ.js → chunk-76LVDUR5.js}

@@ -1,5 +1,5 @@
 // src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.36.1" : "0.0.0-dev";
+var MUSHI_CLI_VERSION = true ? "0.36.2" : "0.0.0-dev";
 var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.30.7";
 
 export {

package/dist/{chunk-TFNFJXCK.js → chunk-H6HZNVVT.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-R4ZRRD4B.js";
+} from "./chunk-YYDQ3IYE.js";
 import {
   CLOUD_API_ENDPOINT,
   normalizeEndpoint
@@ -14,6 +14,7 @@ var EXIT_CODE_MAP = {
   E_PROJECT_MISSING: 2,
   E_ENDPOINT_INVALID: 2,
   E_INVALID_INPUT: 2,
+  E_WRONG_REPO: 2,
   E_NOT_INTERACTIVE: 2,
   E_NETWORK: 3,
   E_TIMEOUT: 3,

package/dist/{chunk-D3ABBB6H.js → chunk-OKT53MJ7.js}

@@ -8,10 +8,10 @@ import {
   requireConfig,
   requireUuid,
   tryLoadWorkerKey
-} from "./chunk-TFNFJXCK.js";
+} from "./chunk-H6HZNVVT.js";
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-R4ZRRD4B.js";
+} from "./chunk-YYDQ3IYE.js";
 
 // src/worker/daemon.ts
 import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
@@ -405,6 +405,43 @@ ${run.stderr}`).trim();
 ${text.slice(-2e3)}` : text);
 }
 
+// src/commands/work-repo.ts
+function redactRemote(url) {
+  return url.trim().replace(/^([a-z][a-z0-9+.-]*:\/\/)[^@/]*@/i, "$1");
+}
+function normaliseRepoUrl(url) {
+  let s = url.trim();
+  if (!s) return null;
+  const proto = /^[a-z][a-z0-9+.-]*:\/\//i.exec(s);
+  if (proto) {
+    s = s.slice(proto[0].length).replace(/^[^@/]*@/, "");
+    s = s.replace(/^([^/:]+):\d+(?=\/|$)/, "$1");
+  } else {
+    s = s.replace(/^[^@/]*@/, "");
+    s = s.replace(/^([^/:]+):(?!\/)/, "$1/");
+  }
+  s = s.replace(/\/+$/, "").replace(/\.git$/i, "").replace(/\/+$/, "").toLowerCase();
+  if (!s) return null;
+  const parts = s.split("/").filter(Boolean);
+  if (parts.length === 2 && !parts[0].includes(".")) parts.unshift("github.com");
+  return parts.length ? parts.join("/") : null;
+}
+function originMatchesRepos(origin, repoUrls) {
+  if (!repoUrls.length) return true;
+  const o = origin ? normaliseRepoUrl(origin) : null;
+  if (!o) return false;
+  return repoUrls.some((u) => normaliseRepoUrl(u) === o);
+}
+function wrongRepoMessage(o) {
+  if (!o.repoUrls?.length || originMatchesRepos(o.origin, o.repoUrls)) return null;
+  const project = o.projectName ? `${o.projectName}${o.projectId ? ` (${o.projectId})` : ""}` : o.projectId ?? "this key's project";
+  const origin = o.origin ? redactRemote(o.origin) : "(no origin remote)";
+  return {
+    message: `Wrong repo: your Mushi key belongs to ${project}, which is linked to ${o.repoUrls.join(", ")}, but ${o.repoDir} has origin ${origin}. mushi work would apply that project's reports to this repo, so it stopped before claiming anything.`,
+    hint: "In this repo, run `mushi login --upgrade-scope --project-id <the project for this repo>`, or pass --repo-dir with a clone of the linked repo. For a monorepo or a fork, pass --any-repo to skip this check."
+  };
+}
+
 // src/commands/work.ts
 import { spawn } from "child_process";
 import { createHash as createHash2 } from "crypto";
@@ -1096,10 +1133,29 @@ function missingWriteScope(scopes, projectId) {
   const have = scopes.length ? scopes.join(", ") : "no scopes";
   return `This CLI key has ${have}; mushi work also needs mcp:write to record the fix and queue its review. Run: mushi login --upgrade-scope${projectId ? ` --project-id ${projectId}` : ""}`;
 }
-async function requireWriteScope(cfg) {
+async function readWhoami(cfg) {
   const res = await apiCall("/v1/sync/whoami", cfg);
-  const scopes = res.ok ? res.data?.scopes : void 0;
-  const problem = missingWriteScope(scopes, cfg.projectId);
+  return res.ok ? res.data : void 0;
+}
+async function originOf(repoDir) {
+  if (!existsSync(repoDir)) return null;
+  const r = await runProc("git", ["remote", "get-url", "origin"], { cwd: repoDir, timeoutMs: 3e4 });
+  const url = r.code === 0 ? r.stdout.trim() : "";
+  return url || null;
+}
+async function requireRightRepo(whoami, repoDir) {
+  if (!whoami?.repo_urls?.length) return;
+  const problem = wrongRepoMessage({
+    projectName: whoami.project_name,
+    projectId: whoami.project_id,
+    repoUrls: whoami.repo_urls,
+    origin: await originOf(repoDir),
+    repoDir
+  });
+  if (problem) throw new MushiCliError("E_WRONG_REPO", problem.message, problem.hint);
+}
+function requireWriteScope(cfg, whoami) {
+  const problem = missingWriteScope(whoami?.scopes, cfg.projectId);
   if (problem) throw new MushiCliError("E_AUTH_MISSING", problem, `mushi login --upgrade-scope${cfg.projectId ? ` --project-id ${cfg.projectId}` : ""}`);
 }
 function stopLine(agent, left, what) {
@@ -1107,14 +1163,14 @@ function stopLine(agent, left, what) {
   return `Stopped: the ${spec.label} agent could not run (out of usage or signed out). ${left} ${what}${left === 1 ? "" : "s"} left untouched and can be picked up again; the run was closed without a retry cooldown. Check: ${spec.bin} ${spec.status.join(" ")}`;
 }
 function registerWorkCommands(program) {
-  program.command("work").description("Fix reports with a coding agent on this machine (the Cursor CLI or Claude Code); pushes and opens the draft PR with your git and gh").option("--repo-dir <path>", "A clone of the app repo (only worktrees are created in it); not with --daemon").option("--project <id>", "Project id (overrides MUSHI_PROJECT_ID)").option("--agent <name>", "Local agent: cursor (cursor-agent, default) or claude (Claude Code, claude -p); with --daemon, overrides the worker config's agent").option("--model <id>", "Model for the agent (cursor: cursor-agent --list-models; claude: opus, sonnet, haiku or a claude-\u2026 id)").option("--max <n>", "Reports per run", "3").option("--report <id>", "Work on this report only").option("--followups", 'Instead of new reports: fix the Opus "fix first" findings on PRs mushi work opened, and push to them').option("--keep", "Keep the worktree after the run").option("--dry-run", "Show what would run; change nothing").option("--json", "Machine-readable JSON output").option("--daemon", "Run as a local worker: register this machine, send a heartbeat every 60 s, take the console's lane settings and claim reports (set up with `mushi worker install`)").option("--worker-config <path>", "With --daemon: the lanes file (default ~/.config/mushi/worker.json)").action(async (opts) => {
+  program.command("work").description("Fix reports with a coding agent on this machine (the Cursor CLI or Claude Code); pushes and opens the draft PR with your git and gh").option("--repo-dir <path>", "A clone of the app repo (only worktrees are created in it); not with --daemon").option("--project <id>", "Project id (overrides MUSHI_PROJECT_ID)").option("--agent <name>", "Local agent: cursor (cursor-agent, default) or claude (Claude Code, claude -p); with --daemon, overrides the worker config's agent").option("--model <id>", "Model for the agent (cursor: cursor-agent --list-models; claude: opus, sonnet, haiku or a claude-\u2026 id)").option("--max <n>", "Reports per run", "3").option("--report <id>", "Work on this report only").option("--followups", 'Instead of new reports: fix the Opus "fix first" findings on PRs mushi work opened, and push to them').option("--keep", "Keep the worktree after the run").option("--dry-run", "Show what would run; change nothing").option("--any-repo", "Skip the check that the clone is a repo the key's project is linked to (a monorepo or a fork)").option("--json", "Machine-readable JSON output").option("--daemon", "Run as a local worker: register this machine, send a heartbeat every 60 s, take the console's lane settings and claim reports (set up with `mushi worker install`)").option("--worker-config <path>", "With --daemon: the lanes file (default ~/.config/mushi/worker.json)").action(async (opts) => {
     const agent = parseLocalAgent(opts.agent);
     if (opts.daemon) {
       if (opts.repoDir || opts.report || opts.followups) {
         throw new MushiCliError("E_INVALID_INPUT", "--daemon takes its lanes and clones from the worker config, not from --repo-dir, --report or --followups.", "mushi worker install");
       }
-      const { runDaemon: runDaemon2 } = await import("./daemon-VC4WW5GU.js");
-      await runDaemon2({ configPath: opts.workerConfig, ...opts.agent !== void 0 ? { agent } : {} });
+      const { runDaemon: runDaemon2 } = await import("./daemon-D3BEJ4ZR.js");
+      await runDaemon2({ configPath: opts.workerConfig, ...opts.agent !== void 0 ? { agent } : {}, ...opts.anyRepo ? { anyRepo: true } : {} });
       return;
     }
     if (!opts.repoDir) throw new MushiCliError("E_INVALID_INPUT", "mushi work needs --repo-dir <clone>.", "mushi work --repo-dir ~/src/my-app");
@@ -1130,6 +1186,8 @@ function registerWorkCommands(program) {
     };
     const warn = (l) => process.stderr.write(`${l}
 `);
+    const whoami = await readWhoami(cfg);
+    if (!opts.anyRepo) await requireRightRepo(whoami, repoDir);
     if (opts.followups) {
       const listed = await api(`/v1/admin/projects/${cfg.projectId}/local-followups`);
       const due = listed.fixes.slice(0, max);
@@ -1141,7 +1199,7 @@ function registerWorkCommands(program) {
         return;
       }
       await preflight(repoDir, warn, agent);
-      await requireWriteScope(cfg);
+      requireWriteScope(cfg, whoami);
       const results2 = [];
       for (const f of due) {
         if (interruptedBy()) break;
@@ -1172,7 +1230,7 @@ function registerWorkCommands(program) {
       return;
     }
     await preflight(repoDir, warn, agent);
-    await requireWriteScope(cfg);
+    requireWriteScope(cfg, whoami);
     const results = [];
     for (const d of picked) {
       if (interruptedBy()) break;
@@ -2879,6 +2937,7 @@ async function runDaemon(opts = {}) {
   if (gh.code !== 0) process.stdout.write("worker: gh is not signed in on this machine; lanes take nothing until it is (run: gh auth login).\n");
   const repos = /* @__PURE__ */ new Map();
   const notReady = /* @__PURE__ */ new Map();
+  const origins = /* @__PURE__ */ new Map();
   for (const lane of cfg.lanes) {
     const g = await runProc("git", ["rev-parse", "--git-dir"], { cwd: lane.repoDir, timeoutMs: 3e4 });
     if (g.code !== 0) {
@@ -2890,8 +2949,28 @@ async function runDaemon(opts = {}) {
     const origin = await runProc("git", ["remote", "get-url", "origin"], { cwd: lane.repoDir, timeoutMs: 3e4 });
     const repo = origin.code === 0 ? repoOfRemote(origin.stdout) : null;
     if (repo) repos.set(lane.name, repo);
+    if (origin.code === 0 && origin.stdout.trim()) origins.set(lane.name, origin.stdout.trim());
   }
   const conf = { apiKey: key, endpoint };
+  if (!opts.anyRepo) {
+    const who = await apiCall("/v1/sync/whoami", conf, {}, { timeoutMs: 3e4 });
+    if (who.ok) {
+      for (const lane of cfg.lanes) {
+        if (notReady.has(lane.name) || lane.projectId !== who.data.project_id) continue;
+        const problem = wrongRepoMessage({
+          projectName: who.data.project_name,
+          projectId: who.data.project_id,
+          repoUrls: who.data.repo_urls,
+          origin: origins.get(lane.name) ?? null,
+          repoDir: lane.repoDir
+        });
+        if (!problem) continue;
+        process.stdout.write(`worker: lane ${lane.name}: ${problem.message} The lane stays out until it is fixed (or restart with --any-repo).
+`);
+        notReady.set(lane.name, `Its clone is not a repo ${who.data.project_name || "this project"} is linked to (${who.data.repo_urls.join(", ")}); point the lane at a clone of one, or restart the worker with --any-repo`);
+      }
+    }
+  }
   let wake = () => void 0;
   const readings = createHostReadings({
     ...cursorAccount ? { cursorAccount } : {},

package/dist/{chunk-MRQEXRAP.js → chunk-TN2IZOY7.js}

@@ -1,6 +1,6 @@
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-5DQLHMVZ.js";
+} from "./chunk-76LVDUR5.js";
 import {
   assertEndpoint,
   normalizeEndpoint
@@ -415,6 +415,7 @@ var EXIT_CODE_MAP = {
   E_PROJECT_MISSING: 2,
   E_ENDPOINT_INVALID: 2,
   E_INVALID_INPUT: 2,
+  E_WRONG_REPO: 2,
   E_NOT_INTERACTIVE: 2,
   E_NETWORK: 3,
   E_TIMEOUT: 3,

package/dist/{chunk-R4ZRRD4B.js → chunk-YYDQ3IYE.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.36.1" : "0.0.0-dev";
+var MUSHI_CLI_VERSION = true ? "0.36.2" : "0.0.0-dev";
 var MUSHI_MCP_PIN_SPEC = "@mushi-mushi/mcp@0.30.7";
 
 export {

package/dist/{connect-X5OPJFCR.js → connect-W4VHAQIQ.js}

@@ -6,10 +6,10 @@ import {
   saveConfig,
   savedSdkKeyFor,
   waitForIngestReady
-} from "./chunk-MRQEXRAP.js";
+} from "./chunk-TN2IZOY7.js";
 import {
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-5DQLHMVZ.js";
+} from "./chunk-76LVDUR5.js";
 import {
   detectFramework,
   envVarsToWrite,

package/dist/{connect-PJ2KR2FI.js → connect-YZMEO7Y5.js}

@@ -2,10 +2,10 @@
 import {
   resolveSdkEnvKey,
   runConnect
-} from "./chunk-GLA6OXI3.js";
+} from "./chunk-2JOEQQOU.js";
 import "./chunk-KOBEOGNF.js";
-import "./chunk-TFNFJXCK.js";
-import "./chunk-R4ZRRD4B.js";
+import "./chunk-H6HZNVVT.js";
+import "./chunk-YYDQ3IYE.js";
 import "./chunk-LGGE3LH7.js";
 export {
   resolveSdkEnvKey,

package/dist/{daemon-VC4WW5GU.js → daemon-D3BEJ4ZR.js}

@@ -10,9 +10,9 @@ import {
   readWorkerKey,
   runDaemon,
   workerHostId
-} from "./chunk-D3ABBB6H.js";
-import "./chunk-TFNFJXCK.js";
-import "./chunk-R4ZRRD4B.js";
+} from "./chunk-OKT53MJ7.js";
+import "./chunk-H6HZNVVT.js";
+import "./chunk-YYDQ3IYE.js";
 import "./chunk-LGGE3LH7.js";
 export {
   assertWorkerKey,

package/dist/index.js

@@ -22,7 +22,7 @@ import {
   sanitizeEndpoint,
   sanitizeProjectId,
   writeMcpServerEntry
-} from "./chunk-GLA6OXI3.js";
+} from "./chunk-2JOEQQOU.js";
 import {
   FRAMEWORKS,
   detectFramework,
@@ -50,7 +50,7 @@ import {
   registerUxCommands,
   registerWorkCommands,
   validateWorkerConfig
-} from "./chunk-D3ABBB6H.js";
+} from "./chunk-OKT53MJ7.js";
 import {
   CONFIG_PATH,
   MushiCliError,
@@ -89,11 +89,11 @@ import {
   tryLoadKeyFromKeychain,
   trySaveKeyToKeychain,
   trySaveWorkerKey
-} from "./chunk-TFNFJXCK.js";
+} from "./chunk-H6HZNVVT.js";
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-R4ZRRD4B.js";
+} from "./chunk-YYDQ3IYE.js";
 import {
   CLOUD_API_ENDPOINT,
   CLOUD_MCP_OAUTH_URL,
@@ -1609,7 +1609,7 @@ async function checkOnboardingStatus(config, _consoleBase, cwd, doFetch = global
 }
 async function checkVersionDrift(cwd, doFetch) {
   const checks = [];
-  const { MUSHI_CLI_VERSION: MUSHI_CLI_VERSION2 } = await import("./version-5GNUKBUB.js");
+  const { MUSHI_CLI_VERSION: MUSHI_CLI_VERSION2 } = await import("./version-TOLAY73N.js");
   if (MUSHI_CLI_VERSION2 === "0.0.0-dev") return checks;
   const parse2 = (v) => {
     const m = v.replace(/^[~^]/, "").match(/^(\d+)\.(\d+)\.(\d+)/);
@@ -2582,7 +2582,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect: runConnect2 } = await import("./connect-PJ2KR2FI.js");
+    const { runConnect: runConnect2 } = await import("./connect-YZMEO7Y5.js");
     const saved = loadConfig();
     const result = await runConnect2(
       {

package/dist/init.js

@@ -25,10 +25,10 @@ import {
   saveConfig,
   savedSdkKeyFor,
   trySaveKeyToKeychain
-} from "./chunk-MRQEXRAP.js";
+} from "./chunk-TN2IZOY7.js";
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-5DQLHMVZ.js";
+} from "./chunk-76LVDUR5.js";
 import {
   FRAMEWORKS,
   detectFramework,
@@ -2127,7 +2127,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect } = await import("./connect-X5OPJFCR.js");
+    const { runConnect } = await import("./connect-W4VHAQIQ.js");
     const saved = loadConfig();
     const result = await runConnect(
       {

package/dist/{version-5GNUKBUB.js → version-TOLAY73N.js}

@@ -2,7 +2,7 @@
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-R4ZRRD4B.js";
+} from "./chunk-YYDQ3IYE.js";
 export {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC

package/dist/version.js

@@ -1,7 +1,7 @@
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-5DQLHMVZ.js";
+} from "./chunk-76LVDUR5.js";
 export {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mushi-mushi/cli",
-  "version": "0.36.1",
+  "version": "0.36.2",
   "license": "MIT",
   "description": "Mushi Mushi CLI: SDK setup, MCP wiring, triage. Bug fixing for AI-built apps: plain-English diagnosis + a ready fix, in your editor.",
   "bin": {