@mushi-mushi/core 1.19.0 → 1.19.2

package/CONTRIBUTING.md

@@ -27,12 +27,24 @@ pnpm build
 
 ```bash
 pnpm dev          # Start all dev servers (admin on :6464)
+```
+
+| Surface | URL |
+| --- | --- |
+| Admin console | http://localhost:6464 |
+| Docs site | http://localhost:3000 |
+| CLI console override | `MUSHI_CONSOLE_URL=http://localhost:6464` |
+
+```bash
 pnpm test         # Run Vitest across all packages
 pnpm typecheck    # TypeScript checks
 pnpm lint         # ESLint
 pnpm format       # Prettier
+pnpm smoke:cli-setup   # Playwright: onboarding ?setup=cli + success panel (skips headless if unsigned)
 ```
 
+Set `CLI_SETUP_SMOKE_STRICT=1` to fail the smoke script when Playwright is not signed in (CI gate).
+
 Ad-hoc screenshots captured during UI reviews can live temporarily at the repo
 root, but root-level `*.png` files are intentionally ignored. Canonical
 screenshots that should be versioned belong under `docs/screenshots/`.

package/README.md

@@ -38,6 +38,7 @@ Core types, API client, and utilities for the Mushi Mushi SDK.
 | `MushiCaptureExceptionOptions` | 1.0+ — options for `Mushi.captureException(err, opts)`: `level`, `tags`, `extras`, `category`, `userIntent` overrides for the structured report. |
 | `NormalisedException`          | 1.0+ — return type of `normaliseThrown(err)` (`{ name, message, stack?, cause? }`); used internally by `captureException` and exposed for adapters that want to ship their own thin wrappers. |
 | `MushiBannerLink`              | 1.8+ — flat action on the rich banner layout: `{ label, href? }` opens an external URL in a new tab, `{ label, featureRequest: true }` opens the widget in feature-request mode. Consumed via `MushiBannerConfig.links`. |
+| `screenshotSensitiveHint` (on `MushiWidgetConfig`) | 1.19+ — privacy caption under the screenshot preview: `true` = localized default, `string` = custom copy, `false` = hide caption (preview + Remove remain). Console-configurable via `GET /v1/sdk/config`. See [`docs/SDK_SCREENSHOT_PREVIEW.md`](../../docs/SDK_SCREENSHOT_PREVIEW.md). |
 
 Constants: `MUSHI_INTERNAL_HEADER` (`'X-Mushi-Internal'`),
 `MUSHI_INTERNAL_INIT_MARKER`, and the `MushiInternalRequestKind` literal union

package/dist/index.cjs

@@ -43,9 +43,23 @@ function formatBytes(n) {
 }
 
 // src/api-client.ts
+var _credWarningEmitted = false;
 var MUSHI_USER_TOKEN_HEADER = "X-Mushi-User-Token";
+var MUSHI_PROJECT_HEADER = "X-Mushi-Project";
 var MUSHI_SDK_PACKAGE_HEADER = "X-Mushi-SDK-Package";
 var MUSHI_SDK_VERSION_HEADER = "X-Mushi-SDK-Version";
+function buildSdkIngestHeaders(opts) {
+  const headers = {
+    "Content-Type": "application/json",
+    "X-Mushi-Api-Key": opts.apiKey,
+    [MUSHI_PROJECT_HEADER]: opts.projectId
+  };
+  if (opts.sdkPackage) headers[MUSHI_SDK_PACKAGE_HEADER] = opts.sdkPackage;
+  if (opts.sdkVersion) headers[MUSHI_SDK_VERSION_HEADER] = opts.sdkVersion;
+  if (opts.userToken) headers[MUSHI_USER_TOKEN_HEADER] = opts.userToken;
+  if (opts.internalKind) headers[MUSHI_INTERNAL_HEADER] = opts.internalKind;
+  return headers;
+}
 var DEFAULT_API_ENDPOINT = "https://dxptnwrhwsqckaftyymj.supabase.co/functions/v1/api";
 var MUSHI_INTERNAL_HEADER = "X-Mushi-Internal";
 var MUSHI_INTERNAL_INIT_MARKER = "__mushiInternal";
@@ -72,13 +86,14 @@ function createApiClient(options) {
       const response = await fetch(url, {
         method,
         headers: {
-          "Content-Type": "application/json",
-          "X-Mushi-Api-Key": apiKey,
-          "X-Mushi-Project": projectId,
-          ...sdkPackage ? { [MUSHI_SDK_PACKAGE_HEADER]: sdkPackage } : {},
-          ...sdkVersion ? { [MUSHI_SDK_VERSION_HEADER]: sdkVersion } : {},
-          ...userToken ? { [MUSHI_USER_TOKEN_HEADER]: userToken } : {},
-          ...internalKind ? { [MUSHI_INTERNAL_HEADER]: internalKind } : {},
+          ...buildSdkIngestHeaders({
+            apiKey,
+            projectId,
+            sdkPackage,
+            sdkVersion,
+            userToken,
+            internalKind
+          }),
           ...extraHeaders
         },
         body: body ? JSON.stringify(body) : void 0,
@@ -98,6 +113,13 @@ function createApiClient(options) {
       }
       if (!response.ok) {
         const errorBody = await response.json().catch(() => ({}));
+        if ((response.status === 401 || response.status === 403) && !_credWarningEmitted) {
+          _credWarningEmitted = true;
+          const where = baseUrl === DEFAULT_API_ENDPOINT ? "Get the correct values at: https://kensaur.us/mushi-mushi/admin/projects" : "Get the correct values from your Mushi console's Projects page.";
+          console.error(
+            `[Mushi] Credentials rejected (HTTP ${response.status}). Check your Project ID and API key scope (must be "report:write"). ` + where
+          );
+        }
         if (response.status >= 500 && retries > 0) {
           await sleep(getBackoffDelay(maxRetries - retries));
           return request(method, path, body, retries - 1, internalKind, extraHeaders);
@@ -1806,6 +1828,190 @@ function parseIdentityToken(token) {
   }
 }
 
+// src/favicon.ts
+var MULTI_TENANT_PARENT_HOSTS = /* @__PURE__ */ new Set(["kensaur.us", "www.kensaur.us"]);
+var SLUG_DOMAIN_HINTS = {
+  "glot-it": "glot.it",
+  glotit: "glot.it",
+  "solo-boss-cloud": "sbc-front.vercel.app",
+  "mushi-mushi": "mushimushi.dev"
+};
+var SLUG_ICON_URL_HINTS = {
+  "mushi-mushi": "https://kensaur.us/mushi-mushi/admin/favicon.svg",
+  "solo-boss-cloud": "https://sbc-front.vercel.app/favicon.svg",
+  "glot-it": "https://kensaur.us/glot-it/apple-touch-icon.png",
+  glotit: "https://kensaur.us/glot-it/apple-touch-icon.png"
+};
+var UNTRUSTED_FAVICON_HOSTS = [
+  "www.google.com",
+  "icons.duckduckgo.com",
+  "icon.horse"
+];
+function isUntrustedFaviconUrl(url) {
+  try {
+    const host = new URL(url).hostname.toLowerCase();
+    return UNTRUSTED_FAVICON_HOSTS.some((h) => host === h || host.endsWith(`.${h}`));
+  } catch {
+    return false;
+  }
+}
+function faviconUrlCandidates(domain, _size = 32) {
+  return [
+    `https://${domain}/favicon.svg`,
+    `https://${domain}/favicon.ico`,
+    `https://${domain}/favicon-32x32.png`,
+    `https://${domain}/apple-touch-icon.png`
+  ];
+}
+function resolveProjectFaviconDomains(source) {
+  const out = [];
+  const add = (d) => {
+    const n = d?.trim().toLowerCase();
+    if (!n || out.includes(n)) return;
+    out.push(n);
+  };
+  add(githubRepoDomainHint(source.repo_url));
+  add(SLUG_DOMAIN_HINTS[source.project_slug.toLowerCase()]);
+  const fromOrigin = source.sdk_origin ? originToDomain(source.sdk_origin) : null;
+  if (fromOrigin && !MULTI_TENANT_PARENT_HOSTS.has(fromOrigin)) {
+    add(fromOrigin);
+  }
+  return out;
+}
+function projectFaviconUrlCandidates(source, size = 32) {
+  if (source.icon_url?.trim()) return [source.icon_url.trim()];
+  const seen = /* @__PURE__ */ new Set();
+  const urls = [];
+  const push = (url) => {
+    if (!url || seen.has(url) || isUntrustedFaviconUrl(url)) return;
+    seen.add(url);
+    urls.push(url);
+  };
+  const slugHint = SLUG_ICON_URL_HINTS[source.project_slug.toLowerCase()];
+  if (slugHint) push(slugHint);
+  for (const domain of resolveProjectFaviconDomains(source)) {
+    for (const url of faviconUrlCandidates(domain, size)) {
+      push(url);
+    }
+  }
+  return urls;
+}
+function originToDomain(origin) {
+  const trimmed = origin.trim();
+  if (!trimmed) return null;
+  if (/^(capacitor|file|content|app):/i.test(trimmed)) return null;
+  try {
+    const url = new URL(trimmed.includes("://") ? trimmed : `https://${trimmed}`);
+    const host = url.hostname.toLowerCase();
+    if (host === "localhost" || host === "127.0.0.1" || host.endsWith(".local")) {
+      return null;
+    }
+    return host;
+  } catch {
+    return null;
+  }
+}
+function githubRepoDomainHint(repoUrl) {
+  if (!repoUrl?.trim()) return null;
+  try {
+    const u = new URL(repoUrl.trim());
+    const host = u.hostname.toLowerCase();
+    const parts = u.pathname.replace(/^\/+|\/+$/g, "").split("/").filter(Boolean);
+    if (parts.length < 2) return null;
+    const repo = parts[1].replace(/\.git$/i, "").toLowerCase();
+    if (/^[a-z0-9][a-z0-9.-]*\.[a-z]{2,}$/i.test(repo)) return repo;
+    if (host === "github.com" && repo.endsWith(".github.io")) return repo;
+    if (host !== "github.com" && host !== "www.github.com") return host;
+    return null;
+  } catch {
+    return null;
+  }
+}
+function resolveProjectDomain(source) {
+  return resolveProjectFaviconDomains(source)[0] ?? null;
+}
+function isLikelyGenericFavicon(img) {
+  if (typeof document === "undefined") return false;
+  if (!img.complete || img.naturalWidth === 0 || img.naturalHeight === 0) return false;
+  try {
+    const canvas = document.createElement("canvas");
+    const w = img.naturalWidth;
+    const h = img.naturalHeight;
+    canvas.width = w;
+    canvas.height = h;
+    const ctx = canvas.getContext("2d");
+    if (!ctx) return false;
+    ctx.drawImage(img, 0, 0);
+    const { data } = ctx.getImageData(0, 0, w, h);
+    let opaque = 0;
+    let satSum = 0;
+    let maxDiff = 0;
+    for (let i = 0; i < data.length; i += 4) {
+      const r = data[i];
+      const g = data[i + 1];
+      const b = data[i + 2];
+      const a = data[i + 3];
+      if (a < 128) continue;
+      opaque++;
+      const max = Math.max(r, g, b);
+      const min = Math.min(r, g, b);
+      const diff = max - min;
+      maxDiff = Math.max(maxDiff, diff);
+      satSum += diff;
+    }
+    if (opaque === 0) return true;
+    const avgSat = satSum / opaque;
+    return avgSat < 14 && maxDiff < 24;
+  } catch {
+    return isUntrustedFaviconUrl(img.src);
+  }
+}
+function projectInitials(name) {
+  const parts = name.trim().split(/[\s._-]+/).filter(Boolean);
+  if (parts.length >= 2) {
+    return `${parts[0][0] ?? ""}${parts[1][0] ?? ""}`.toUpperCase();
+  }
+  const compact = name.replace(/[^a-zA-Z0-9]/g, "");
+  return (compact.slice(0, 2) || name.slice(0, 2) || "?").toUpperCase();
+}
+var INITIALS_CHIP_THEMES = [
+  "info",
+  "brand",
+  "warn",
+  "ok",
+  "accent"
+];
+function projectInitialsThemeIndex(projectId) {
+  let hash = 0;
+  for (let i = 0; i < projectId.length; i++) {
+    hash = (hash + projectId.charCodeAt(i)) % INITIALS_CHIP_THEMES.length;
+  }
+  return hash;
+}
+function readPageFaviconHref() {
+  if (typeof document === "undefined") return null;
+  const selectors = [
+    'link[rel="icon"]',
+    'link[rel="shortcut icon"]',
+    'link[rel="apple-touch-icon"]'
+  ];
+  for (const sel of selectors) {
+    const link = document.querySelector(sel);
+    const href = link?.href;
+    if (href && isSafeFaviconHref(href)) return href;
+  }
+  return null;
+}
+function isSafeFaviconHref(href) {
+  try {
+    const base = typeof location !== "undefined" ? location.href : void 0;
+    const protocol = new URL(href, base).protocol;
+    return protocol === "http:" || protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+
 exports.DEFAULT_API_ENDPOINT = DEFAULT_API_ENDPOINT;
 exports.MAX_REPORT_PAYLOAD_BYTES = MAX_REPORT_PAYLOAD_BYTES;
 exports.MAX_SCREENSHOT_DATA_URL_BYTES = MAX_SCREENSHOT_DATA_URL_BYTES;
@@ -1817,12 +2023,17 @@ exports.MUSHI_IDENTITY_TOKEN_PREFIX = MUSHI_IDENTITY_TOKEN_PREFIX;
 exports.MUSHI_INTERNAL_HEADER = MUSHI_INTERNAL_HEADER;
 exports.MUSHI_INTERNAL_INIT_MARKER = MUSHI_INTERNAL_INIT_MARKER;
 exports.MUSHI_MOTION = MUSHI_MOTION;
+exports.MUSHI_PROJECT_HEADER = MUSHI_PROJECT_HEADER;
 exports.MUSHI_RADIUS = MUSHI_RADIUS;
+exports.MUSHI_SDK_PACKAGE_HEADER = MUSHI_SDK_PACKAGE_HEADER;
+exports.MUSHI_SDK_VERSION_HEADER = MUSHI_SDK_VERSION_HEADER;
 exports.MUSHI_SPACING = MUSHI_SPACING;
 exports.MUSHI_TYPE = MUSHI_TYPE;
+exports.MUSHI_USER_TOKEN_HEADER = MUSHI_USER_TOKEN_HEADER;
 exports.MUSHI_Z = MUSHI_Z;
 exports.REGION_ENDPOINTS = REGION_ENDPOINTS;
 exports.buildIdentityClaims = buildIdentityClaims;
+exports.buildSdkIngestHeaders = buildSdkIngestHeaders;
 exports.captureEnvironment = captureEnvironment;
 exports.checkReportPayloadSize = checkReportPayloadSize;
 exports.createApiClient = createApiClient;
@@ -1833,17 +2044,28 @@ exports.createPiiScrubber = createPiiScrubber;
 exports.createPreFilter = createPreFilter;
 exports.createRateLimiter = createRateLimiter;
 exports.estimateJsonBytes = estimateJsonBytes;
+exports.faviconUrlCandidates = faviconUrlCandidates;
 exports.formatBytes = formatBytes;
 exports.getDeviceFingerprintHash = getDeviceFingerprintHash;
 exports.getReporterToken = getReporterToken;
 exports.getSessionId = getSessionId;
+exports.githubRepoDomainHint = githubRepoDomainHint;
+exports.isLikelyGenericFavicon = isLikelyGenericFavicon;
+exports.isUntrustedFaviconUrl = isUntrustedFaviconUrl;
 exports.mushiPalette = mushiPalette;
 exports.mushiTokens = mushiTokens;
 exports.newUuid = newUuid;
 exports.noopLogger = noopLogger;
 exports.normaliseThrown = normaliseThrown;
+exports.originToDomain = originToDomain;
 exports.parseIdentityToken = parseIdentityToken;
+exports.projectFaviconUrlCandidates = projectFaviconUrlCandidates;
+exports.projectInitials = projectInitials;
+exports.projectInitialsThemeIndex = projectInitialsThemeIndex;
+exports.readPageFaviconHref = readPageFaviconHref;
 exports.resolveEnvConfig = resolveEnvConfig;
+exports.resolveProjectDomain = resolveProjectDomain;
+exports.resolveProjectFaviconDomains = resolveProjectFaviconDomains;
 exports.resolveRegionEndpoint = resolveRegionEndpoint;
 exports.scrubPii = scrubPii;
 //# sourceMappingURL=index.cjs.map