@mushi-mushi/cli 0.8.0 → 0.10.0

package/CONTRIBUTING.md

@@ -101,6 +101,17 @@ Releases are fully automated. Maintainers don't run `npm publish` by hand.
 
 If GitHub's anti-loop protection suppresses the auto re-fire (the squash merge can be attributed to `github-actions[bot]`), trigger the workflow manually: **Actions → release → Run workflow → master**.
 
+### Known CI/CD quirks and their automatic safeguards
+
+A handful of GitHub-Actions × Changesets edge cases have caused release-pipeline stalls in the past. Each is now caught automatically — keep these in mind when you see the symptom:
+
+| Symptom | Root cause | Automatic safeguard |
+| --- | --- | --- |
+| The `Build & Test` required check never registers on the `chore: version packages` PR — the PR stays "Required check missing" forever | `changeset-release/master` is pushed by `github-actions[bot]`. GitHub silently drops the downstream `pull_request` event to prevent bot loops (observed on PR #45, #102, #124). | `ci.yml` now also triggers on `push` to `changeset-release/master`, so `Build & Test` reports against the head commit directly. No empty-commit nudge needed. |
+| Release workflow fails with `No commits between master and changeset-release/master` after merging a PR with a new changeset. | A `.changeset/*.md` file whose YAML frontmatter only targets packages listed in `.changeset/config.json#ignore` (e.g. `@mushi-mushi/server`, `@mushi-mushi/admin`). `changeset version` produces no bumps, the version PR is empty, the next push errors (PR #102 / #121, 2026-05-19). | `pnpm check:changeset-orphans` runs in both `ci.yml` and `release.yml`. PR CI fails with an actionable message naming the orphan file *before* it can reach master. If you legitimately need to record an internal-only change, omit the changeset entirely — the diff lives in git history. |
+| Release workflow's `Audit signatures of installed dependencies` step fails with `npm ETARGET / No matching version found for @mushi-mushi/<pkg>@<ver>` seconds after the publish step succeeded. | npm's registry CDN can take up to ~30s to propagate a freshly-published manifest. The audit step shells out to `npm install` against the just-published version and races the CDN (observed 2026-05-20, run 26149167393). | The audit step retries with exponential backoff (1, 2, 4, 8, 16, 32s — 63s total) before failing. Sigstore signatures are written at publish time, so a one-off audit failure never indicates a corrupted package — `pnpm view <pkg> version` is the ground truth. |
+| Push to `master` after merging a PR doesn't fire the `Release` workflow. | Same anti-loop protection: when a squash merge is attributed to `github-actions[bot]`, GitHub may suppress the downstream `push` trigger. Sporadic — observed twice in the last 60 days. | `release.yml` keeps `workflow_dispatch` as the manual fallback. Recovery: **Actions → Release → Run workflow → master**. The `Build & Verify` job re-runs identically to the auto-fired path. |
+
 ### Adding a brand-new publishable package
 
 Trusted Publisher bindings are configured **per package** on `npmjs.com` and require the package to already exist on the registry. New packages therefore need a one-time bootstrap before OIDC can take over.

package/dist/chunk-GHDS4VGP.js

@@ -0,0 +1,6 @@
+// src/version.ts
+var MUSHI_CLI_VERSION = true ? "0.10.0" : "0.0.0-dev";
+
+export {
+  MUSHI_CLI_VERSION
+};

package/dist/index.js

@@ -4,11 +4,26 @@
 import { Command } from "commander";
 
 // src/config.ts
-import { chmodSync, readFileSync, statSync, writeFileSync, existsSync } from "fs";
-import { join } from "path";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
 import { homedir } from "os";
-var CONFIG_PATH = join(homedir(), ".mushirc");
+import { dirname, join } from "path";
 var SECURE_FILE_MODE = 384;
+var SECURE_DIR_MODE = 448;
+function resolveXdgConfigPath() {
+  const xdg = process.env["XDG_CONFIG_HOME"];
+  if (xdg && xdg.length > 0) {
+    return join(xdg, "mushi", "config.json");
+  }
+  if (process.platform === "win32") {
+    const appData = process.env["APPDATA"];
+    if (appData && appData.length > 0) {
+      return join(appData, "mushi", "config.json");
+    }
+  }
+  return join(homedir(), ".config", "mushi", "config.json");
+}
+var LEGACY_CONFIG_PATH = join(homedir(), ".mushirc");
+var CONFIG_PATH = resolveXdgConfigPath();
 function loadConfig(path = CONFIG_PATH) {
   let file = {};
   if (existsSync(path)) {
@@ -17,6 +32,8 @@ function loadConfig(path = CONFIG_PATH) {
       file = JSON.parse(readFileSync(path, "utf-8"));
     } catch {
     }
+  } else if (path === CONFIG_PATH && existsSync(LEGACY_CONFIG_PATH)) {
+    file = migrateLegacyConfig() ?? {};
   }
   const fromEnv = {
     ...process.env["MUSHI_API_KEY"] ? { apiKey: process.env["MUSHI_API_KEY"] } : {},
@@ -26,9 +43,40 @@ function loadConfig(path = CONFIG_PATH) {
   return { ...file, ...fromEnv };
 }
 function saveConfig(config, path = CONFIG_PATH) {
+  const dir = dirname(path);
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true, mode: SECURE_DIR_MODE });
+  } else {
+    tightenDirPermissions(dir);
+  }
   writeFileSync(path, JSON.stringify(config, null, 2), { mode: SECURE_FILE_MODE });
   tightenPermissions(path);
 }
+function migrateLegacyConfig(legacyPath = LEGACY_CONFIG_PATH, destPath = CONFIG_PATH) {
+  if (!existsSync(legacyPath)) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(legacyPath, "utf-8"));
+  } catch {
+    return null;
+  }
+  const dir = dirname(destPath);
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true, mode: SECURE_DIR_MODE });
+  }
+  try {
+    renameSync(legacyPath, destPath);
+  } catch {
+    writeFileSync(destPath, JSON.stringify(parsed, null, 2), { mode: SECURE_FILE_MODE });
+    try {
+      unlinkSync(legacyPath);
+    } catch {
+    }
+  }
+  tightenPermissions(destPath);
+  tightenDirPermissions(dir);
+  return parsed;
+}
 function tightenPermissions(path) {
   if (process.platform === "win32") return;
   try {
@@ -37,6 +85,14 @@ function tightenPermissions(path) {
   } catch {
   }
 }
+function tightenDirPermissions(path) {
+  if (process.platform === "win32") return;
+  try {
+    const current = statSync(path).mode & 511;
+    if (current !== SECURE_DIR_MODE) chmodSync(path, SECURE_DIR_MODE);
+  } catch {
+  }
+}
 
 // src/init.ts
 import * as p from "@clack/prompts";
@@ -368,7 +424,7 @@ function parse(version) {
 
 // src/monorepo.ts
 import { existsSync as existsSync3, readFileSync as readFileSync3, readdirSync, statSync as statSync2 } from "fs";
-import { dirname, join as join3, resolve } from "path";
+import { dirname as dirname2, join as join3, resolve } from "path";
 var WORKSPACE_GLOB_CANDIDATES = ["apps/*", "packages/*", "examples/*"];
 var FRAMEWORK_DEPS = {
   next: "Next.js",
@@ -396,7 +452,7 @@ function findWorkspaceRoot(start) {
   let dir = resolve(start);
   for (let i = 0; i < 8; i++) {
     if (isWorkspaceRoot(dir)) return dir;
-    const parent = dirname(dir);
+    const parent = dirname2(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -464,7 +520,7 @@ function getFrameworkFromPkg(pkg) {
 }
 
 // src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.8.0" : "0.0.0-dev";
+var MUSHI_CLI_VERSION = true ? "0.10.0" : "0.0.0-dev";
 
 // src/init.ts
 var ENV_FILES = [".env.local", ".env"];
@@ -1097,7 +1153,87 @@ async function runSourcemapsUpload(opts) {
   if (failed > 0) process.exit(1);
 }
 
+// src/errors.ts
+var EXIT_CODE_MAP = {
+  E_AUTH_MISSING: 2,
+  E_AUTH_INVALID: 2,
+  E_PROJECT_MISSING: 2,
+  E_ENDPOINT_INVALID: 2,
+  E_INVALID_INPUT: 2,
+  E_NOT_INTERACTIVE: 2,
+  E_NETWORK: 3,
+  E_TIMEOUT: 3,
+  E_API_ERROR: 3,
+  E_RATE_LIMITED: 3,
+  E_FILE_NOT_FOUND: 1,
+  E_FILE_PERMISSION: 1,
+  E_FRESHNESS_STALE: 1,
+  E_INTERRUPTED: 130,
+  // 128 + SIGINT (2). POSIX convention.
+  E_INTERNAL: 1
+};
+var MushiCliError = class extends Error {
+  code;
+  hint;
+  cause;
+  constructor(code, message, hint, cause) {
+    super(message);
+    this.name = "MushiCliError";
+    this.code = code;
+    if (hint) this.hint = hint;
+    if (cause !== void 0) this.cause = cause;
+  }
+  /** Exit code POSIX-aware shell scripts should branch on. */
+  get exitCode() {
+    return EXIT_CODE_MAP[this.code];
+  }
+  /**
+   * Format for `--json` output. Used by the JSON writer when a CLI
+   * subcommand was invoked with `--json` and an error escapes.
+   */
+  toJSON() {
+    return {
+      error: {
+        code: this.code,
+        message: this.message,
+        ...this.hint ? { hint: this.hint } : {}
+      }
+    };
+  }
+};
+
+// src/signals.ts
+var installed = false;
+var activeController = null;
+function installSignalHandlers() {
+  if (installed) return;
+  installed = true;
+  const abortAndExit = (signal) => {
+    activeController?.abort(
+      new MushiCliError(
+        "E_INTERRUPTED",
+        `aborted by ${signal}`,
+        "partial state on the server is safe to retry \u2014 re-run the same command"
+      )
+    );
+    const code = signal === "SIGINT" ? 130 : signal === "SIGTERM" ? 143 : 1;
+    process.nextTick(() => {
+      process.exit(code);
+    });
+  };
+  process.on("SIGINT", () => abortAndExit("SIGINT"));
+  process.on("SIGTERM", () => abortAndExit("SIGTERM"));
+}
+function getAbortSignal(external) {
+  if (external) return external.signal;
+  if (!activeController || activeController.signal.aborted) {
+    activeController = new AbortController();
+  }
+  return activeController.signal;
+}
+
 // src/index.ts
+installSignalHandlers();
 var API_TIMEOUT_MS = 15e3;
 async function apiCall(path, config, options = {}) {
   const endpoint = config.endpoint;
@@ -1112,10 +1248,12 @@ async function apiCall(path, config, options = {}) {
   }
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), API_TIMEOUT_MS);
+  const signals = [controller.signal, getAbortSignal()];
+  const compositeSignal = AbortSignal.any ? AbortSignal.any(signals) : controller.signal;
   try {
     const res = await fetch(`${endpoint}${path}`, {
       ...options,
-      signal: controller.signal,
+      signal: compositeSignal,
       headers: {
         "Content-Type": "application/json",
         // `apiKeyAuth` reads X-Mushi-Api-Key; the Authorization header is a
@@ -1807,4 +1945,93 @@ Examples:
     silent: opts.silent
   });
 });
+var fixCmd = program.command("fix").description("Dispatch an agentic fix for a report");
+fixCmd.argument("<reportId>", "Report UUID to fix").option(
+  "--agent <name>",
+  "Agent adapter: claude_code (default), cursor_cloud, codex, mcp",
+  "claude_code"
+).option(
+  "--model <slug>",
+  "Model override for cursor_cloud (e.g. composer-latest)"
+).option(
+  "--no-auto-pr",
+  "For cursor_cloud: skip automatic PR creation (branch only)"
+).option(
+  "--wait",
+  "Poll until terminal state and exit non-zero on error/cancelled (CI-friendly)"
+).option("-e, --endpoint <url>", "API endpoint (overrides MUSHI_API_ENDPOINT)").option("--api-key <key>", "API key (overrides MUSHI_API_KEY)").option("--project-id <id>", "Project ID (overrides MUSHI_PROJECT_ID)").addHelpText("after", `
+Examples:
+  mushi fix abc123 --agent cursor_cloud --wait
+  mushi fix abc123 --agent cursor_cloud --model composer-latest --no-auto-pr
+  mushi fix abc123 --agent claude_code
+
+  # CI: fail the pipeline if the fix errors
+  mushi fix $REPORT_ID --agent cursor_cloud --wait && echo "Fix PR opened"`).action(async (reportId, opts) => {
+  const cfg = loadConfig();
+  if (opts.endpoint) cfg.endpoint = opts.endpoint;
+  if (opts.apiKey) cfg.apiKey = opts.apiKey;
+  if (opts.projectId) cfg.projectId = opts.projectId;
+  const isTTY = process.stdout.isTTY;
+  const emitEvent = (type, data) => {
+    if (isTTY) {
+      const ts = (/* @__PURE__ */ new Date()).toISOString();
+      console.log(`[${ts}] ${type}`, JSON.stringify(data));
+    } else {
+      process.stdout.write(JSON.stringify({ type, ...data }) + "\n");
+    }
+  };
+  emitEvent("dispatch.start", { reportId, agent: opts.agent, model: opts.model ?? null });
+  const body = {
+    reportId,
+    agent: opts.agent
+  };
+  if (opts.agent === "cursor_cloud") {
+    if (opts.model) body.cursorModel = opts.model;
+    if (!opts.autoPr) body.cursorAutoCreatePR = false;
+  }
+  const result = await apiCall("/v1/admin/fixes/dispatch", cfg, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (!result.ok) {
+    console.error("Error dispatching fix:", result.error.message);
+    process.exit(1);
+  }
+  const { fixId, status, agentId, runId, prUrl } = result.data;
+  emitEvent("dispatch.ok", { fixId, status, agentId, runId, prUrl });
+  if (!opts.wait) {
+    process.exit(0);
+  }
+  if (!fixId) {
+    console.error("No fixId returned \u2014 cannot poll.");
+    process.exit(1);
+  }
+  const POLL_MS = 5e3;
+  const MAX_POLLS = 120;
+  const TERMINAL = /* @__PURE__ */ new Set(["completed", "failed", "error", "cancelled", "skipped", "skipped_unsupported_agent", "skipped_no_sandbox"]);
+  for (let i = 0; i < MAX_POLLS; i++) {
+    await new Promise((r) => setTimeout(r, POLL_MS));
+    const pollResult = await apiCall(
+      `/v1/admin/fixes/${fixId}`,
+      cfg
+    );
+    if (!pollResult.ok) {
+      emitEvent("poll.error", { error: pollResult.error.message });
+      continue;
+    }
+    const s = pollResult.data.status;
+    emitEvent("fix.status", { status: s, pr_url: pollResult.data.pr_url, cursor_agent_id: pollResult.data.cursor_agent_id });
+    if (s && TERMINAL.has(s)) {
+      const success = s === "completed";
+      if (!success) {
+        console.error(`Fix ended with status: ${s}${pollResult.data.error ? ` \u2014 ${pollResult.data.error}` : ""}`);
+        process.exit(1);
+      }
+      process.exit(0);
+    }
+  }
+  console.error("Polling timed out after 10 minutes. The fix may still be running.");
+  process.exit(1);
+});
 program.parse();

package/dist/init.js

@@ -8,7 +8,7 @@ import {
 } from "./chunk-XHD3H54W.js";
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-KUQZQFOL.js";
+} from "./chunk-GHDS4VGP.js";
 
 // src/init.ts
 import * as p from "@clack/prompts";
@@ -18,11 +18,26 @@ import { appendFileSync, existsSync as existsSync3, readFileSync as readFileSync
 import { join as join3 } from "path";
 
 // src/config.ts
-import { chmodSync, readFileSync, statSync, writeFileSync, existsSync } from "fs";
-import { join } from "path";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
 import { homedir } from "os";
-var CONFIG_PATH = join(homedir(), ".mushirc");
+import { dirname, join } from "path";
 var SECURE_FILE_MODE = 384;
+var SECURE_DIR_MODE = 448;
+function resolveXdgConfigPath() {
+  const xdg = process.env["XDG_CONFIG_HOME"];
+  if (xdg && xdg.length > 0) {
+    return join(xdg, "mushi", "config.json");
+  }
+  if (process.platform === "win32") {
+    const appData = process.env["APPDATA"];
+    if (appData && appData.length > 0) {
+      return join(appData, "mushi", "config.json");
+    }
+  }
+  return join(homedir(), ".config", "mushi", "config.json");
+}
+var LEGACY_CONFIG_PATH = join(homedir(), ".mushirc");
+var CONFIG_PATH = resolveXdgConfigPath();
 function loadConfig(path = CONFIG_PATH) {
   let file = {};
   if (existsSync(path)) {
@@ -31,6 +46,8 @@ function loadConfig(path = CONFIG_PATH) {
       file = JSON.parse(readFileSync(path, "utf-8"));
     } catch {
     }
+  } else if (path === CONFIG_PATH && existsSync(LEGACY_CONFIG_PATH)) {
+    file = migrateLegacyConfig() ?? {};
   }
   const fromEnv = {
     ...process.env["MUSHI_API_KEY"] ? { apiKey: process.env["MUSHI_API_KEY"] } : {},
@@ -40,9 +57,40 @@ function loadConfig(path = CONFIG_PATH) {
   return { ...file, ...fromEnv };
 }
 function saveConfig(config, path = CONFIG_PATH) {
+  const dir = dirname(path);
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true, mode: SECURE_DIR_MODE });
+  } else {
+    tightenDirPermissions(dir);
+  }
   writeFileSync(path, JSON.stringify(config, null, 2), { mode: SECURE_FILE_MODE });
   tightenPermissions(path);
 }
+function migrateLegacyConfig(legacyPath = LEGACY_CONFIG_PATH, destPath = CONFIG_PATH) {
+  if (!existsSync(legacyPath)) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(legacyPath, "utf-8"));
+  } catch {
+    return null;
+  }
+  const dir = dirname(destPath);
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true, mode: SECURE_DIR_MODE });
+  }
+  try {
+    renameSync(legacyPath, destPath);
+  } catch {
+    writeFileSync(destPath, JSON.stringify(parsed, null, 2), { mode: SECURE_FILE_MODE });
+    try {
+      unlinkSync(legacyPath);
+    } catch {
+    }
+  }
+  tightenPermissions(destPath);
+  tightenDirPermissions(dir);
+  return parsed;
+}
 function tightenPermissions(path) {
   if (process.platform === "win32") return;
   try {
@@ -51,6 +99,14 @@ function tightenPermissions(path) {
   } catch {
   }
 }
+function tightenDirPermissions(path) {
+  if (process.platform === "win32") return;
+  try {
+    const current = statSync(path).mode & 511;
+    if (current !== SECURE_DIR_MODE) chmodSync(path, SECURE_DIR_MODE);
+  } catch {
+  }
+}
 
 // src/endpoint.ts
 var TEST_REPORT_TIMEOUT_MS = 1e4;
@@ -125,7 +181,7 @@ function parse(version) {
 
 // src/monorepo.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2, readdirSync, statSync as statSync2 } from "fs";
-import { dirname, join as join2, resolve } from "path";
+import { dirname as dirname2, join as join2, resolve } from "path";
 var WORKSPACE_GLOB_CANDIDATES = ["apps/*", "packages/*", "examples/*"];
 var FRAMEWORK_DEPS = {
   next: "Next.js",
@@ -153,7 +209,7 @@ function findWorkspaceRoot(start) {
   let dir = resolve(start);
   for (let i = 0; i < 8; i++) {
     if (isWorkspaceRoot(dir)) return dir;
-    const parent = dirname(dir);
+    const parent = dirname2(dir);
     if (parent === dir) break;
     dir = parent;
   }

package/dist/version.js

@@ -1,6 +1,6 @@
 import {
   MUSHI_CLI_VERSION
-} from "./chunk-KUQZQFOL.js";
+} from "./chunk-GHDS4VGP.js";
 export {
   MUSHI_CLI_VERSION
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mushi-mushi/cli",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "license": "MIT",
   "description": "CLI for Mushi Mushi — `mushi init` wizard installs the right SDK for your framework, plus report triage and pipeline health commands",
   "bin": {

package/dist/chunk-KUQZQFOL.js

@@ -1,6 +0,0 @@
-// src/version.ts
-var MUSHI_CLI_VERSION = true ? "0.8.0" : "0.0.0-dev";
-
-export {
-  MUSHI_CLI_VERSION
-};