@mushi-mushi/core 1.18.0 → 1.19.1

package/CONTRIBUTING.md

@@ -27,12 +27,24 @@ pnpm build
 
 ```bash
 pnpm dev          # Start all dev servers (admin on :6464)
+```
+
+| Surface | URL |
+| --- | --- |
+| Admin console | http://localhost:6464 |
+| Docs site | http://localhost:3000 |
+| CLI console override | `MUSHI_CONSOLE_URL=http://localhost:6464` |
+
+```bash
 pnpm test         # Run Vitest across all packages
 pnpm typecheck    # TypeScript checks
 pnpm lint         # ESLint
 pnpm format       # Prettier
+pnpm smoke:cli-setup   # Playwright: onboarding ?setup=cli + success panel (skips headless if unsigned)
 ```
 
+Set `CLI_SETUP_SMOKE_STRICT=1` to fail the smoke script when Playwright is not signed in (CI gate).
+
 Ad-hoc screenshots captured during UI reviews can live temporarily at the repo
 root, but root-level `*.png` files are intentionally ignored. Canonical
 screenshots that should be versioned belong under `docs/screenshots/`.

package/README.md

@@ -38,6 +38,7 @@ Core types, API client, and utilities for the Mushi Mushi SDK.
 | `MushiCaptureExceptionOptions` | 1.0+ — options for `Mushi.captureException(err, opts)`: `level`, `tags`, `extras`, `category`, `userIntent` overrides for the structured report. |
 | `NormalisedException`          | 1.0+ — return type of `normaliseThrown(err)` (`{ name, message, stack?, cause? }`); used internally by `captureException` and exposed for adapters that want to ship their own thin wrappers. |
 | `MushiBannerLink`              | 1.8+ — flat action on the rich banner layout: `{ label, href? }` opens an external URL in a new tab, `{ label, featureRequest: true }` opens the widget in feature-request mode. Consumed via `MushiBannerConfig.links`. |
+| `screenshotSensitiveHint` (on `MushiWidgetConfig`) | 1.19+ — privacy caption under the screenshot preview: `true` = localized default, `string` = custom copy, `false` = hide caption (preview + Remove remain). Console-configurable via `GET /v1/sdk/config`. See [`docs/SDK_SCREENSHOT_PREVIEW.md`](../../docs/SDK_SCREENSHOT_PREVIEW.md). |
 
 Constants: `MUSHI_INTERNAL_HEADER` (`'X-Mushi-Internal'`),
 `MUSHI_INTERNAL_INIT_MARKER`, and the `MushiInternalRequestKind` literal union

package/dist/index.cjs

@@ -43,9 +43,23 @@ function formatBytes(n) {
 }
 
 // src/api-client.ts
+var _credWarningEmitted = false;
 var MUSHI_USER_TOKEN_HEADER = "X-Mushi-User-Token";
+var MUSHI_PROJECT_HEADER = "X-Mushi-Project";
 var MUSHI_SDK_PACKAGE_HEADER = "X-Mushi-SDK-Package";
 var MUSHI_SDK_VERSION_HEADER = "X-Mushi-SDK-Version";
+function buildSdkIngestHeaders(opts) {
+  const headers = {
+    "Content-Type": "application/json",
+    "X-Mushi-Api-Key": opts.apiKey,
+    [MUSHI_PROJECT_HEADER]: opts.projectId
+  };
+  if (opts.sdkPackage) headers[MUSHI_SDK_PACKAGE_HEADER] = opts.sdkPackage;
+  if (opts.sdkVersion) headers[MUSHI_SDK_VERSION_HEADER] = opts.sdkVersion;
+  if (opts.userToken) headers[MUSHI_USER_TOKEN_HEADER] = opts.userToken;
+  if (opts.internalKind) headers[MUSHI_INTERNAL_HEADER] = opts.internalKind;
+  return headers;
+}
 var DEFAULT_API_ENDPOINT = "https://dxptnwrhwsqckaftyymj.supabase.co/functions/v1/api";
 var MUSHI_INTERNAL_HEADER = "X-Mushi-Internal";
 var MUSHI_INTERNAL_INIT_MARKER = "__mushiInternal";
@@ -72,13 +86,14 @@ function createApiClient(options) {
       const response = await fetch(url, {
         method,
         headers: {
-          "Content-Type": "application/json",
-          "X-Mushi-Api-Key": apiKey,
-          "X-Mushi-Project": projectId,
-          ...sdkPackage ? { [MUSHI_SDK_PACKAGE_HEADER]: sdkPackage } : {},
-          ...sdkVersion ? { [MUSHI_SDK_VERSION_HEADER]: sdkVersion } : {},
-          ...userToken ? { [MUSHI_USER_TOKEN_HEADER]: userToken } : {},
-          ...internalKind ? { [MUSHI_INTERNAL_HEADER]: internalKind } : {},
+          ...buildSdkIngestHeaders({
+            apiKey,
+            projectId,
+            sdkPackage,
+            sdkVersion,
+            userToken,
+            internalKind
+          }),
           ...extraHeaders
         },
         body: body ? JSON.stringify(body) : void 0,
@@ -98,6 +113,12 @@ function createApiClient(options) {
       }
       if (!response.ok) {
         const errorBody = await response.json().catch(() => ({}));
+        if ((response.status === 401 || response.status === 403) && !_credWarningEmitted) {
+          _credWarningEmitted = true;
+          console.error(
+            `[Mushi] Credentials rejected (HTTP ${response.status}). Check your Project ID and API key scope (must be "report:write"). Get the correct values at: https://kensaur.us/mushi-mushi/admin/projects`
+          );
+        }
         if (response.status >= 500 && retries > 0) {
           await sleep(getBackoffDelay(maxRetries - retries));
           return request(method, path, body, retries - 1, internalKind, extraHeaders);
@@ -1000,6 +1021,30 @@ function createOfflineQueue(config = {}) {
       lsWrite(rows);
     }
   }
+  async function removeRow(backend, rowId) {
+    try {
+      if (backend === "indexeddb") await idbDelete(rowId);
+      else lsDelete(rowId);
+    } catch (err) {
+      queueLog.debug("Offline queue: row removal failed (will age out)", {
+        id: rowId,
+        err: String(err)
+      });
+    }
+  }
+  async function persistRow(backend, row) {
+    try {
+      if (backend === "indexeddb") await idbPutRow(row);
+      else lsUpdateRow(row);
+      return true;
+    } catch (err) {
+      queueLog.debug("Offline queue: row persist failed", {
+        id: row.id,
+        err: String(err)
+      });
+      return false;
+    }
+  }
   async function enqueue(report) {
     if (!enabled) return;
     const currentSize = await size();
@@ -1045,12 +1090,7 @@ function createOfflineQueue(config = {}) {
     for (const row of rows) {
       if (isExpired(row, now)) {
         const rowId = row.id;
-        try {
-          if (backend === "indexeddb") await idbDelete(rowId);
-          else lsDelete(rowId);
-        } catch {
-          lsDelete(rowId);
-        }
+        await removeRow(backend, rowId);
         queueLog.debug("Offline queue: evicting stale report", { id: rowId });
       } else {
         fresh.push(row);
@@ -1065,23 +1105,13 @@ function createOfflineQueue(config = {}) {
       const rowId = row.id;
       const report = await unwrapForSend(row);
       if (!report) {
-        try {
-          if (backend === "indexeddb") await idbDelete(rowId);
-          else lsDelete(rowId);
-        } catch {
-          lsDelete(rowId);
-        }
+        await removeRow(backend, rowId);
         failed++;
         continue;
       }
       const result = await client.submitReport(report);
       if (result.ok) {
-        try {
-          if (backend === "indexeddb") await idbDelete(rowId);
-          else lsDelete(rowId);
-        } catch {
-          lsDelete(rowId);
-        }
+        await removeRow(backend, rowId);
         sent++;
       } else {
         const permanent = result.error?.code === "HTTP_400" || result.error?.code === "HTTP_413" || result.error?.code === "HTTP_422" || result.error?.code === "INGEST_ERROR" || result.error?.code === "VALIDATION_ERROR" || // A payload that exceeds the size guard will never shrink on its own;
@@ -1093,21 +1123,11 @@ function createOfflineQueue(config = {}) {
         );
         const transient = !permanent && (result.error?.code === "NETWORK_ERROR" || result.error?.code === "HTTP_403" || result.error?.code === "HTTP_429" || result.error?.code === "HTTP_502" || result.error?.code === "HTTP_503" || result.error?.code === "HTTP_504" || typeof result.error?.code === "string" && result.error.code.startsWith("HTTP_5"));
         if (permanent) {
-          try {
-            if (backend === "indexeddb") await idbDelete(rowId);
-            else lsDelete(rowId);
-          } catch {
-            lsDelete(rowId);
-          }
+          await removeRow(backend, rowId);
         } else if (transient) {
           const nextAttempts = rowAttempts(row) + 1;
           if (nextAttempts >= MAX_DELIVERY_ATTEMPTS) {
-            try {
-              if (backend === "indexeddb") await idbDelete(rowId);
-              else lsDelete(rowId);
-            } catch {
-              lsDelete(rowId);
-            }
+            await removeRow(backend, rowId);
             queueLog.warn("Offline queue: giving up on report after repeated failures", {
               id: rowId,
               attempts: nextAttempts,
@@ -1115,17 +1135,20 @@ function createOfflineQueue(config = {}) {
             });
           } else {
             row.attempts = nextAttempts;
-            try {
-              if (backend === "indexeddb") await idbPutRow(row);
-              else lsUpdateRow(row);
-            } catch {
-              lsUpdateRow(row);
+            const persisted = await persistRow(backend, row);
+            if (persisted) {
+              queueLog.debug("Offline queue: transient failure, will retry", {
+                id: rowId,
+                attempts: nextAttempts,
+                code: result.error?.code
+              });
+            } else {
+              await removeRow(backend, rowId);
+              queueLog.warn("Offline queue: dropping report (attempt counter unpersistable)", {
+                id: rowId,
+                code: result.error?.code
+              });
             }
-            queueLog.debug("Offline queue: transient failure, will retry", {
-              id: rowId,
-              attempts: nextAttempts,
-              code: result.error?.code
-            });
           }
         }
         failed++;
@@ -1804,6 +1827,180 @@ function parseIdentityToken(token) {
   }
 }
 
+// src/favicon.ts
+var MULTI_TENANT_PARENT_HOSTS = /* @__PURE__ */ new Set(["kensaur.us", "www.kensaur.us"]);
+var SLUG_DOMAIN_HINTS = {
+  "glot-it": "glot.it",
+  glotit: "glot.it",
+  "solo-boss-cloud": "sbc-front.vercel.app",
+  "mushi-mushi": "mushimushi.dev"
+};
+var SLUG_ICON_URL_HINTS = {
+  "mushi-mushi": "https://kensaur.us/mushi-mushi/admin/favicon.svg",
+  "solo-boss-cloud": "https://sbc-front.vercel.app/favicon.svg",
+  "glot-it": "https://kensaur.us/glot-it/apple-touch-icon.png",
+  glotit: "https://kensaur.us/glot-it/apple-touch-icon.png"
+};
+var UNTRUSTED_FAVICON_HOSTS = [
+  "www.google.com",
+  "icons.duckduckgo.com",
+  "icon.horse"
+];
+function isUntrustedFaviconUrl(url) {
+  try {
+    const host = new URL(url).hostname.toLowerCase();
+    return UNTRUSTED_FAVICON_HOSTS.some((h) => host === h || host.endsWith(`.${h}`));
+  } catch {
+    return false;
+  }
+}
+function faviconUrlCandidates(domain, _size = 32) {
+  return [
+    `https://${domain}/favicon.svg`,
+    `https://${domain}/favicon.ico`,
+    `https://${domain}/favicon-32x32.png`,
+    `https://${domain}/apple-touch-icon.png`
+  ];
+}
+function resolveProjectFaviconDomains(source) {
+  const out = [];
+  const add = (d) => {
+    const n = d?.trim().toLowerCase();
+    if (!n || out.includes(n)) return;
+    out.push(n);
+  };
+  add(githubRepoDomainHint(source.repo_url));
+  add(SLUG_DOMAIN_HINTS[source.project_slug.toLowerCase()]);
+  const fromOrigin = source.sdk_origin ? originToDomain(source.sdk_origin) : null;
+  if (fromOrigin && !MULTI_TENANT_PARENT_HOSTS.has(fromOrigin)) {
+    add(fromOrigin);
+  }
+  return out;
+}
+function projectFaviconUrlCandidates(source, size = 32) {
+  if (source.icon_url?.trim()) return [source.icon_url.trim()];
+  const seen = /* @__PURE__ */ new Set();
+  const urls = [];
+  const push = (url) => {
+    if (!url || seen.has(url) || isUntrustedFaviconUrl(url)) return;
+    seen.add(url);
+    urls.push(url);
+  };
+  const slugHint = SLUG_ICON_URL_HINTS[source.project_slug.toLowerCase()];
+  if (slugHint) push(slugHint);
+  for (const domain of resolveProjectFaviconDomains(source)) {
+    for (const url of faviconUrlCandidates(domain, size)) {
+      push(url);
+    }
+  }
+  return urls;
+}
+function originToDomain(origin) {
+  const trimmed = origin.trim();
+  if (!trimmed) return null;
+  if (/^(capacitor|file|content|app):/i.test(trimmed)) return null;
+  try {
+    const url = new URL(trimmed.includes("://") ? trimmed : `https://${trimmed}`);
+    const host = url.hostname.toLowerCase();
+    if (host === "localhost" || host === "127.0.0.1" || host.endsWith(".local")) {
+      return null;
+    }
+    return host;
+  } catch {
+    return null;
+  }
+}
+function githubRepoDomainHint(repoUrl) {
+  if (!repoUrl?.trim()) return null;
+  try {
+    const u = new URL(repoUrl.trim());
+    const host = u.hostname.toLowerCase();
+    const parts = u.pathname.replace(/^\/+|\/+$/g, "").split("/").filter(Boolean);
+    if (parts.length < 2) return null;
+    const repo = parts[1].replace(/\.git$/i, "").toLowerCase();
+    if (/^[a-z0-9][a-z0-9.-]*\.[a-z]{2,}$/i.test(repo)) return repo;
+    if (host === "github.com" && repo.endsWith(".github.io")) return repo;
+    if (host !== "github.com" && host !== "www.github.com") return host;
+    return null;
+  } catch {
+    return null;
+  }
+}
+function resolveProjectDomain(source) {
+  return resolveProjectFaviconDomains(source)[0] ?? null;
+}
+function isLikelyGenericFavicon(img) {
+  if (typeof document === "undefined") return false;
+  if (!img.complete || img.naturalWidth === 0 || img.naturalHeight === 0) return false;
+  try {
+    const canvas = document.createElement("canvas");
+    const w = img.naturalWidth;
+    const h = img.naturalHeight;
+    canvas.width = w;
+    canvas.height = h;
+    const ctx = canvas.getContext("2d");
+    if (!ctx) return false;
+    ctx.drawImage(img, 0, 0);
+    const { data } = ctx.getImageData(0, 0, w, h);
+    let opaque = 0;
+    let satSum = 0;
+    let maxDiff = 0;
+    for (let i = 0; i < data.length; i += 4) {
+      const r = data[i];
+      const g = data[i + 1];
+      const b = data[i + 2];
+      const a = data[i + 3];
+      if (a < 128) continue;
+      opaque++;
+      const max = Math.max(r, g, b);
+      const min = Math.min(r, g, b);
+      const diff = max - min;
+      maxDiff = Math.max(maxDiff, diff);
+      satSum += diff;
+    }
+    if (opaque === 0) return true;
+    const avgSat = satSum / opaque;
+    return avgSat < 14 && maxDiff < 24;
+  } catch {
+    return isUntrustedFaviconUrl(img.src);
+  }
+}
+function projectInitials(name) {
+  const parts = name.trim().split(/[\s._-]+/).filter(Boolean);
+  if (parts.length >= 2) {
+    return `${parts[0][0] ?? ""}${parts[1][0] ?? ""}`.toUpperCase();
+  }
+  const compact = name.replace(/[^a-zA-Z0-9]/g, "");
+  return (compact.slice(0, 2) || name.slice(0, 2) || "?").toUpperCase();
+}
+var INITIALS_CHIP_THEMES = [
+  "info",
+  "brand",
+  "warn",
+  "ok",
+  "accent"
+];
+function projectInitialsThemeIndex(projectId) {
+  let hash = 0;
+  for (let i = 0; i < projectId.length; i++) {
+    hash = (hash + projectId.charCodeAt(i)) % INITIALS_CHIP_THEMES.length;
+  }
+  return hash;
+}
+function readPageFaviconHref() {
+  if (typeof document === "undefined") return null;
+  const selectors = [
+    'link[rel="icon"]',
+    'link[rel="shortcut icon"]',
+    'link[rel="apple-touch-icon"]'
+  ];
+  for (const sel of selectors) {
+    const link = document.querySelector(sel);
+    if (link?.href) return link.href;
+  }
+  return null;
+}
+
 exports.DEFAULT_API_ENDPOINT = DEFAULT_API_ENDPOINT;
 exports.MAX_REPORT_PAYLOAD_BYTES = MAX_REPORT_PAYLOAD_BYTES;
 exports.MAX_SCREENSHOT_DATA_URL_BYTES = MAX_SCREENSHOT_DATA_URL_BYTES;
@@ -1815,12 +2012,17 @@ exports.MUSHI_IDENTITY_TOKEN_PREFIX = MUSHI_IDENTITY_TOKEN_PREFIX;
 exports.MUSHI_INTERNAL_HEADER = MUSHI_INTERNAL_HEADER;
 exports.MUSHI_INTERNAL_INIT_MARKER = MUSHI_INTERNAL_INIT_MARKER;
 exports.MUSHI_MOTION = MUSHI_MOTION;
+exports.MUSHI_PROJECT_HEADER = MUSHI_PROJECT_HEADER;
 exports.MUSHI_RADIUS = MUSHI_RADIUS;
+exports.MUSHI_SDK_PACKAGE_HEADER = MUSHI_SDK_PACKAGE_HEADER;
+exports.MUSHI_SDK_VERSION_HEADER = MUSHI_SDK_VERSION_HEADER;
 exports.MUSHI_SPACING = MUSHI_SPACING;
 exports.MUSHI_TYPE = MUSHI_TYPE;
+exports.MUSHI_USER_TOKEN_HEADER = MUSHI_USER_TOKEN_HEADER;
 exports.MUSHI_Z = MUSHI_Z;
 exports.REGION_ENDPOINTS = REGION_ENDPOINTS;
 exports.buildIdentityClaims = buildIdentityClaims;
+exports.buildSdkIngestHeaders = buildSdkIngestHeaders;
 exports.captureEnvironment = captureEnvironment;
 exports.checkReportPayloadSize = checkReportPayloadSize;
 exports.createApiClient = createApiClient;
@@ -1831,17 +2033,28 @@ exports.createPiiScrubber = createPiiScrubber;
 exports.createPreFilter = createPreFilter;
 exports.createRateLimiter = createRateLimiter;
 exports.estimateJsonBytes = estimateJsonBytes;
+exports.faviconUrlCandidates = faviconUrlCandidates;
 exports.formatBytes = formatBytes;
 exports.getDeviceFingerprintHash = getDeviceFingerprintHash;
 exports.getReporterToken = getReporterToken;
 exports.getSessionId = getSessionId;
+exports.githubRepoDomainHint = githubRepoDomainHint;
+exports.isLikelyGenericFavicon = isLikelyGenericFavicon;
+exports.isUntrustedFaviconUrl = isUntrustedFaviconUrl;
 exports.mushiPalette = mushiPalette;
 exports.mushiTokens = mushiTokens;
 exports.newUuid = newUuid;
 exports.noopLogger = noopLogger;
 exports.normaliseThrown = normaliseThrown;
+exports.originToDomain = originToDomain;
 exports.parseIdentityToken = parseIdentityToken;
+exports.projectFaviconUrlCandidates = projectFaviconUrlCandidates;
+exports.projectInitials = projectInitials;
+exports.projectInitialsThemeIndex = projectInitialsThemeIndex;
+exports.readPageFaviconHref = readPageFaviconHref;
 exports.resolveEnvConfig = resolveEnvConfig;
+exports.resolveProjectDomain = resolveProjectDomain;
+exports.resolveProjectFaviconDomains = resolveProjectFaviconDomains;
 exports.resolveRegionEndpoint = resolveRegionEndpoint;
 exports.scrubPii = scrubPii;
 //# sourceMappingURL=index.cjs.map