@mushi-mushi/core 1.19.1 → 1.20.0

package/CONTRIBUTING.md

@@ -81,6 +81,18 @@ tooling/
   tsconfig/      Shared TypeScript configs
 ```
 
+## What we don't accept
+
+Knowing this upfront saves everyone time.
+
+- **Automated / bulk / AI-slop PRs** — any PR that was opened by a script, an LLM agent acting without meaningful human review, or as part of a parallel bounty-farming sweep is closed on sight. The commit history, branch name, or helper scripts included in the PR make this obvious.
+- **PRs that target the wrong base** — all PRs must branch from and target `master`. PRs targeting `main` or any other branch are closed (and will show an inflated diff that is not your work).
+- **One PR per issue, one issue per PR** — splitting or duplicating work just to collect acknowledgements isn't welcome.
+- **Good-first-issues without claiming first** — comment on the issue to claim it before starting. If two people open PRs for the same issue, the one that commented first is prioritised.
+- **Documentation-only PRs that merely duplicate existing content** — if the information already exists (e.g. in another file in this repo), adding a redundant copy adds noise without value.
+
+If a PR violates these policies it will be closed with a brief explanation. No hard feelings — a genuine contribution on the same issue is always welcome.
+
 ## Making Changes
 
 1. Create a feature branch from `master`

package/dist/index.cjs

@@ -115,8 +115,9 @@ function createApiClient(options) {
         const errorBody = await response.json().catch(() => ({}));
         if ((response.status === 401 || response.status === 403) && !_credWarningEmitted) {
           _credWarningEmitted = true;
+          const where = baseUrl === DEFAULT_API_ENDPOINT ? "Get the correct values at: https://kensaur.us/mushi-mushi/admin/projects" : "Get the correct values from your Mushi console's Projects page.";
           console.error(
-            `[Mushi] Credentials rejected (HTTP ${response.status}). Check your Project ID and API key scope (must be "report:write"). Get the correct values at: https://kensaur.us/mushi-mushi/admin/projects`
+            `[Mushi] Credentials rejected (HTTP ${response.status}). Check your Project ID and API key scope (must be "report:write"). ` + where
           );
         }
         if (response.status >= 500 && retries > 0) {
@@ -1996,10 +1997,20 @@ function readPageFaviconHref() {
   ];
   for (const sel of selectors) {
     const link = document.querySelector(sel);
-    if (link?.href) return link.href;
+    const href = link?.href;
+    if (href && isSafeFaviconHref(href)) return href;
   }
   return null;
 }
+function isSafeFaviconHref(href) {
+  try {
+    const base = typeof location !== "undefined" ? location.href : void 0;
+    const protocol = new URL(href, base).protocol;
+    return protocol === "http:" || protocol === "https:";
+  } catch {
+    return false;
+  }
+}
 
 exports.DEFAULT_API_ENDPOINT = DEFAULT_API_ENDPOINT;
 exports.MAX_REPORT_PAYLOAD_BYTES = MAX_REPORT_PAYLOAD_BYTES;