@mushi-mushi/core 1.20.0 → 1.21.0

package/CONTRIBUTING.md

@@ -70,7 +70,7 @@ packages/
   react-native/  React Native SDK (MIT)
   cli/           CLI tool (MIT)
   mcp/           MCP server for coding agents (MIT)
-  server/        Supabase Edge Functions (AGPLv3)
+  server/        Supabase Edge Functions (AGPLv3; ee/ is commercial)
   agents/        Agentic fix pipeline (AGPLv3)
   verify/        Fix verification (AGPLv3)
 apps/
@@ -211,7 +211,7 @@ chore: bump dependencies
 ## License
 
 - SDK packages are MIT — your contributions will be MIT-licensed
-- Server/agents/verify are AGPLv3 — contributions to those packages fall under AGPLv3
+- Server/agents/verify are AGPLv3 — contributions to those packages fall under AGPLv3. A [commercial license](./COMMERCIAL-LICENSE.md) is available for hosted-SaaS use cases that cannot publish modifications. The `packages/server/ee/` directory is source-available but commercial (production use needs a license); contributions there are accepted under the same EE terms.
 
 ## Questions?
 

package/SECURITY.md

@@ -113,7 +113,7 @@ What we treat as in-scope attacker capabilities, and what we don't.
 | Compromised Supabase service-role key | ❌ | Treated as a tier-0 incident; would require key rotation and audit-log forensics. Not defendable in software. |
 | Compromise of `kensaurus@gmail.com` | ❌ | Treated as a project-fork event; downstream consumers should pin to the last known-good version and follow the new release channel. |
 | Physical / OS-level attacker on an end-user device | ❌ | Out of scope. |
-| Malicious fork using the Mushi name to ship malware | ❌ (technical) ✅ (legal) | The MIT/BSL grant lets the fork exist; the trademark policy (`TRADEMARK.md`) makes shipping it under the Mushi name an infringement we will pursue. |
+| Malicious fork using the Mushi name to ship malware | ❌ (technical) ✅ (legal) | The MIT / AGPLv3 grant lets the fork exist; the trademark policy (`TRADEMARK.md`) makes shipping it under the Mushi name an infringement we will pursue. |
 
 ## Data handling and PII
 

package/dist/index.cjs

@@ -42,6 +42,47 @@ function formatBytes(n) {
   return `${(n / (1024 * 1024)).toFixed(2)} MB`;
 }
 
+// src/digest.ts
+function getSubtle() {
+  try {
+    const g = globalThis;
+    const crypto2 = g["crypto"];
+    if (crypto2?.subtle) return crypto2.subtle;
+  } catch {
+  }
+  return null;
+}
+function bytesToHex(bytes) {
+  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function sha256Hex(value) {
+  const subtle = getSubtle();
+  if (subtle) {
+    const buffer = await subtle.digest("SHA-256", new TextEncoder().encode(value));
+    return bytesToHex(new Uint8Array(buffer));
+  }
+  const { sha256 } = await import('@noble/hashes/sha2.js');
+  return bytesToHex(sha256(new TextEncoder().encode(value)));
+}
+async function hmacSha256Hex(secret, value) {
+  const subtle = getSubtle();
+  if (subtle) {
+    const key = await subtle.importKey(
+      "raw",
+      new TextEncoder().encode(secret),
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["sign"]
+    );
+    const buffer = await subtle.sign("HMAC", key, new TextEncoder().encode(value));
+    return bytesToHex(new Uint8Array(buffer));
+  }
+  const { hmac } = await import('@noble/hashes/hmac.js');
+  const { sha256 } = await import('@noble/hashes/sha2.js');
+  const result = hmac(sha256, new TextEncoder().encode(secret), new TextEncoder().encode(value));
+  return bytesToHex(result);
+}
+
 // src/api-client.ts
 var _credWarningEmitted = false;
 var MUSHI_USER_TOKEN_HEADER = "X-Mushi-User-Token";
@@ -411,21 +452,6 @@ function createApiClient(options) {
     }
   };
 }
-async function sha256Hex(value) {
-  const buffer = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
-  return Array.from(new Uint8Array(buffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-async function hmacSha256Hex(secret, value) {
-  const key = await crypto.subtle.importKey(
-    "raw",
-    new TextEncoder().encode(secret),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
-  const buffer = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(value));
-  return Array.from(new Uint8Array(buffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -1381,20 +1407,9 @@ function capturePageLoadTiming(win) {
 }
 
 // src/reporter-token.ts
-var STORAGE_KEY = "mushi_reporter_token";
-function getReporterToken() {
-  if (typeof localStorage !== "undefined") {
-    const existing = localStorage.getItem(STORAGE_KEY);
-    if (existing) return existing;
-  }
-  const token = generateToken();
-  if (typeof localStorage !== "undefined") {
-    try {
-      localStorage.setItem(STORAGE_KEY, token);
-    } catch {
-    }
-  }
-  return token;
+var LEGACY_STORAGE_KEY = "mushi_reporter_token";
+function storageKey(projectId) {
+  return `mushi:reporter-token:${projectId}`;
 }
 function generateToken() {
   if (typeof crypto !== "undefined" && crypto.randomUUID) {
@@ -1411,6 +1426,38 @@ function generateToken() {
   const hex = Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
   return `mushi_${hex}`;
 }
+function readStoredToken(key) {
+  if (typeof localStorage === "undefined") return null;
+  try {
+    const existing = localStorage.getItem(key);
+    return existing && existing.length > 0 ? existing : null;
+  } catch {
+    return null;
+  }
+}
+function writeStoredToken(key, token) {
+  if (typeof localStorage === "undefined") return;
+  try {
+    localStorage.setItem(key, token);
+  } catch {
+  }
+}
+function getReporterToken(projectId) {
+  if (!projectId) {
+    const legacy2 = readStoredToken(LEGACY_STORAGE_KEY);
+    if (legacy2) return legacy2;
+    const token2 = generateToken();
+    writeStoredToken(LEGACY_STORAGE_KEY, token2);
+    return token2;
+  }
+  const key = storageKey(projectId);
+  const scoped = readStoredToken(key);
+  if (scoped) return scoped;
+  const legacy = readStoredToken(LEGACY_STORAGE_KEY);
+  const token = legacy ?? generateToken();
+  writeStoredToken(key, token);
+  return token;
+}
 
 // src/uuid.ts
 function newUuid() {
@@ -1706,6 +1753,42 @@ var MUSHI_COLORS_DARK = {
   ok: "#4ADE80",
   danger: "#F87171"
 };
+var MUSHI_TIER_COLORS = {
+  free: MUSHI_COLORS_LIGHT.inkMuted,
+  explorer: "#2563EB",
+  contributor: "#7C3AED",
+  champion: "#D97706",
+  default: MUSHI_COLORS_LIGHT.accent
+};
+var MUSHI_BANNER_NEON = {
+  bg: "#0FFF50",
+  fg: "#0a1a0a",
+  border: "#00C43A"
+};
+var MUSHI_ON_ACCENT = "#FAF7F0";
+var MUSHI_INVERSE = "#ffffff";
+var MUSHI_ACCENT_SHADOW = {
+  light: "#9A2A1E",
+  dark: "#7A1F15"
+};
+var MUSHI_BANNER_BRAND_BORDER = {
+  light: "#B52F1F",
+  dark: "#C4321E"
+};
+var MUSHI_REPORTER_STATUS = {
+  light: {
+    sent: { fg: "#1E4A8C", bg: "rgba(30,74,140,0.08)", border: "rgba(30,74,140,0.16)" },
+    review: { fg: "#8A5A00", bg: "rgba(180,120,0,0.10)", border: "rgba(180,120,0,0.18)" },
+    fixing: { fg: "#9A3D12", bg: "rgba(224,60,44,0.10)", border: "rgba(224,60,44,0.18)" },
+    fixed: { fg: "#1F6B3A", bg: "rgba(31,107,58,0.10)", border: "rgba(31,107,58,0.18)" }
+  },
+  dark: {
+    sent: { fg: "#A8C4FF", bg: "rgba(120,160,255,0.12)", border: "rgba(120,160,255,0.22)" },
+    review: { fg: "#FFD27A", bg: "rgba(255,190,90,0.12)", border: "rgba(255,190,90,0.22)" },
+    fixing: { fg: "#FFB899", bg: "rgba(255,120,60,0.12)", border: "rgba(255,120,60,0.24)" },
+    fixed: { fg: "#8FE3B0", bg: "rgba(80,200,130,0.12)", border: "rgba(80,200,130,0.22)" }
+  }
+};
 function mushiPalette(mode) {
   return mode === "dark" ? MUSHI_COLORS_DARK : MUSHI_COLORS_LIGHT;
 }
@@ -1752,16 +1835,32 @@ var MUSHI_MOTION = {
 var MUSHI_GEOMETRY = {
   bannerHeight: 36,
   fabSize: 52,
-  edgeTabWidth: 28,
+  /** edge-tab launcher width (px) */
+  edgeTabWidth: 32,
   /** default gutter from the screen edge (added on top of safe-area insets) */
   gutter: 24,
-  panelWidth: 384,
+  /** Web panel width (px) — matches shipped Shadow DOM widget */
+  panelWidth: 360,
+  /** max panel height before keyboard inset (px) */
+  panelMaxHeight: 480,
   /** below this viewport width the panel becomes a full-width bottom sheet */
   panelSheetBreakpoint: 480
 };
+function safeWidgetHex(v) {
+  return /^#[0-9a-fA-F]{3,8}$/.test(v) ? v : "";
+}
+function resolveWidgetAccent(mode, accent = "", accentText = "") {
+  const pal = mushiPalette(mode);
+  const safeAccent = safeWidgetHex(accent);
+  const safeAccentText = safeWidgetHex(accentText);
+  const resolvedAccent = safeAccent || pal.accent;
+  const accentWash = safeAccent ? mode === "dark" ? `${resolvedAccent}1F` : `${resolvedAccent}14` : pal.accentWash;
+  const accentInk = safeAccentText || pal.accentInk;
+  return { accent: resolvedAccent, accentWash, accentInk };
+}
 var MUSHI_COPY = {
   bannerLabel: "Beta",
-  bannerMessage: "Help us improve \u2014 your feedback shapes what we ship.",
+  bannerMessage: "Found a bug? Tap to report it.",
   bugCta: "Report a bug",
   featureCta: "Feature request",
   triggerText: "\u{1F41B}",
@@ -2015,6 +2114,9 @@ function isSafeFaviconHref(href) {
 exports.DEFAULT_API_ENDPOINT = DEFAULT_API_ENDPOINT;
 exports.MAX_REPORT_PAYLOAD_BYTES = MAX_REPORT_PAYLOAD_BYTES;
 exports.MAX_SCREENSHOT_DATA_URL_BYTES = MAX_SCREENSHOT_DATA_URL_BYTES;
+exports.MUSHI_ACCENT_SHADOW = MUSHI_ACCENT_SHADOW;
+exports.MUSHI_BANNER_BRAND_BORDER = MUSHI_BANNER_BRAND_BORDER;
+exports.MUSHI_BANNER_NEON = MUSHI_BANNER_NEON;
 exports.MUSHI_COLORS_DARK = MUSHI_COLORS_DARK;
 exports.MUSHI_COLORS_LIGHT = MUSHI_COLORS_LIGHT;
 exports.MUSHI_COPY = MUSHI_COPY;
@@ -2022,12 +2124,16 @@ exports.MUSHI_GEOMETRY = MUSHI_GEOMETRY;
 exports.MUSHI_IDENTITY_TOKEN_PREFIX = MUSHI_IDENTITY_TOKEN_PREFIX;
 exports.MUSHI_INTERNAL_HEADER = MUSHI_INTERNAL_HEADER;
 exports.MUSHI_INTERNAL_INIT_MARKER = MUSHI_INTERNAL_INIT_MARKER;
+exports.MUSHI_INVERSE = MUSHI_INVERSE;
 exports.MUSHI_MOTION = MUSHI_MOTION;
+exports.MUSHI_ON_ACCENT = MUSHI_ON_ACCENT;
 exports.MUSHI_PROJECT_HEADER = MUSHI_PROJECT_HEADER;
 exports.MUSHI_RADIUS = MUSHI_RADIUS;
+exports.MUSHI_REPORTER_STATUS = MUSHI_REPORTER_STATUS;
 exports.MUSHI_SDK_PACKAGE_HEADER = MUSHI_SDK_PACKAGE_HEADER;
 exports.MUSHI_SDK_VERSION_HEADER = MUSHI_SDK_VERSION_HEADER;
 exports.MUSHI_SPACING = MUSHI_SPACING;
+exports.MUSHI_TIER_COLORS = MUSHI_TIER_COLORS;
 exports.MUSHI_TYPE = MUSHI_TYPE;
 exports.MUSHI_USER_TOKEN_HEADER = MUSHI_USER_TOKEN_HEADER;
 exports.MUSHI_Z = MUSHI_Z;
@@ -2050,6 +2156,7 @@ exports.getDeviceFingerprintHash = getDeviceFingerprintHash;
 exports.getReporterToken = getReporterToken;
 exports.getSessionId = getSessionId;
 exports.githubRepoDomainHint = githubRepoDomainHint;
+exports.hmacSha256Hex = hmacSha256Hex;
 exports.isLikelyGenericFavicon = isLikelyGenericFavicon;
 exports.isUntrustedFaviconUrl = isUntrustedFaviconUrl;
 exports.mushiPalette = mushiPalette;
@@ -2067,6 +2174,9 @@ exports.resolveEnvConfig = resolveEnvConfig;
 exports.resolveProjectDomain = resolveProjectDomain;
 exports.resolveProjectFaviconDomains = resolveProjectFaviconDomains;
 exports.resolveRegionEndpoint = resolveRegionEndpoint;
+exports.resolveWidgetAccent = resolveWidgetAccent;
+exports.safeWidgetHex = safeWidgetHex;
 exports.scrubPii = scrubPii;
+exports.sha256Hex = sha256Hex;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map