@mushi-mushi/core 1.23.0 → 1.25.0

package/CONTRIBUTING.md

@@ -76,6 +76,7 @@ packages/
 apps/
   admin/         Admin dashboard (React + Tailwind)
   docs/          Documentation site (Nextra — apps/docs)
+  testers/       Tester marketplace portal (Next.js)
 tooling/
   eslint-config/ Shared ESLint flat config
   tsconfig/      Shared TypeScript configs
@@ -118,15 +119,22 @@ If your PR changes **user-visible SDK or CLI behavior**, update docs in the **sa
 Guardrails (run locally before pushing):
 
 ```bash
-pnpm check:docs-stats          # root README stat badges
+pnpm check:docs-stats          # root README stat badges + glance <sub> line
 pnpm check:sdk-version-matrix  # apps/docs/content/sdks/index.mdx versions
 pnpm check:internal-doc-links  # dead /foo links in MDX
-pnpm check:onboarding-drift    # phantom MCP env vars / stale tool names
+pnpm check:onboarding-drift    # phantom MCP env vars / stale tool names / native install coords
+pnpm check:catalog-sync        # MCP catalog ↔ admin counts ↔ prose "N tools"
+pnpm check:mcp-tools-doc       # mcp-tools.generated.mdx stale check
 pnpm check:bundle-docs         # @mushi-mushi/web size-limit vs README
+pnpm check:docs-drift          # versions + public docs links
 pnpm gen:llms-txt              # regenerate apps/docs/public/llms.txt after nav changes
 pnpm gen:mcp-tools-doc         # regenerate sdks/mcp-tools.generated.mdx from catalog.ts
 ```
 
+**Same-PR rule:** if behavior, env vars, CLI commands, MCP tools, or install
+coordinates change, update the matching docs in this PR and run
+`pnpm check:docs-drift && pnpm check:onboarding-drift && pnpm check:catalog-sync`.
+
 README changes on npm packages only appear on [npmjs.com](https://www.npmjs.com) after the next **Changesets publish**.
 
 ## Changesets

package/SECURITY.md

@@ -111,7 +111,7 @@ What we treat as in-scope attacker capabilities, and what we don't.
 | User pasting a Stripe / OpenAI / GitHub PAT into a bug report | ✅ | PII scrubber redacts ~15 vendor token formats client-side before the report leaves the device. Mirrors `packages/core/src/pii-scrubber.ts` across iOS, Android, Flutter, React Native. |
 | Stolen end-user device with the SDK installed | ⚠️ partial | Offline queue is AsyncStorage / Keychain / SharedPreferences — no app-level encryption beyond the OS default. Reports waiting to flush are vulnerable to a forensic attacker. |
 | Compromised Supabase service-role key | ❌ | Treated as a tier-0 incident; would require key rotation and audit-log forensics. Not defendable in software. |
-| Compromise of `kensaurus@gmail.com` | ❌ | Treated as a project-fork event; downstream consumers should pin to the last known-good version and follow the new release channel. |
+| Compromise of `kensaurus@gmail.com` mail account | ❌ | Treated as a project-fork event; downstream consumers should pin to the last known-good version and follow the new release channel. |
 | Physical / OS-level attacker on an end-user device | ❌ | Out of scope. |
 | Malicious fork using the Mushi name to ship malware | ❌ (technical) ✅ (legal) | The MIT / AGPLv3 grant lets the fork exist; the trademark policy (`TRADEMARK.md`) makes shipping it under the Mushi name an infringement we will pursue. |
 
@@ -157,6 +157,29 @@ Structured fields you set explicitly (`metadata.userEmail`,
 opt-in attribution data, and silently rewriting them would break
 support workflows.
 
+### CLI funnel telemetry
+
+The Mushi CLI sends two fire-and-forget signals to `/v1/cli/funnel` on your
+project's endpoint to help us detect where the onboarding wizard drops off:
+
+| Signal | When | What is sent |
+|--------|------|-------------|
+| `wizard_env_written` | After `npx mushi-mushi` writes `.env.local` | `event`, `source: "cli"` |
+| `mcp_setup_done` | After `mushi setup --ide` verifies the MCP key | `event`, `source: "cli"` |
+
+No file contents, stack traces, or identifiers beyond your project ID and API
+key are sent. The key is already on the endpoint — this adds no new disclosure.
+
+**Opt out** by setting `MUSHI_NO_TELEMETRY=1` in your shell or CI environment:
+
+```bash
+MUSHI_NO_TELEMETRY=1 npx mushi-mushi
+MUSHI_NO_TELEMETRY=1 mushi setup --ide cursor
+```
+
+These signals never block or delay the wizard — they time out silently after
+4 seconds and errors are discarded.
+
 ### Where data lives
 
 - **Reports & telemetry** — Supabase Postgres in the `us-west-1` region.

package/dist/index.cjs

@@ -360,6 +360,17 @@ function createApiClient(options) {
       );
     },
     // ─── Rewards program (P1) ──────────────────────────────────
+    /** POST /v1/sdk/session — lightweight session lifecycle events.
+     *  Best-effort (1 retry, no offline queue) — mirrors postDiscoveryEvent. */
+    async postSessionEvent(payload) {
+      return request(
+        "POST",
+        "/v1/sdk/session",
+        payload,
+        1,
+        "discovery"
+      );
+    },
     async submitActivity(userId, events, opts) {
       return request(
         "POST",
@@ -1169,12 +1180,12 @@ function createOfflineQueue(config = {}) {
     const n = row.attempts;
     return typeof n === "number" && Number.isFinite(n) ? n : 0;
   }
-  function isExpired(row, now) {
+  function isExpired(row, now2) {
     const queuedAt = row.queuedAt;
     if (!queuedAt) return false;
     const ts = Date.parse(queuedAt);
     if (Number.isNaN(ts)) return false;
-    return now - ts > MAX_QUEUE_AGE_MS;
+    return now2 - ts > MAX_QUEUE_AGE_MS;
   }
   function detectBackend() {
     if (backendType) return backendType;
@@ -1353,10 +1364,10 @@ function createOfflineQueue(config = {}) {
     } else {
       rows = lsRead();
     }
-    const now = Date.now();
+    const now2 = Date.now();
     const fresh = [];
     for (const row of rows) {
-      if (isExpired(row, now)) {
+      if (isExpired(row, now2)) {
         const rowId = row.id;
         await removeRow(backend, rowId);
         queueLog.debug("Offline queue: evicting stale report", { id: rowId });
@@ -1821,6 +1832,111 @@ function randomSuffix() {
   return n.toString(36).padStart(6, "0").slice(0, 6);
 }
 
+// src/session-tracker.ts
+var HEARTBEAT_INTERVAL_MS = 6e4;
+var _client = null;
+var _sdkVersion;
+var _userIdHash = null;
+var _reporterTokenHash = null;
+var _pageViewCount = 0;
+var _heartbeatTimer = null;
+var _initialized = false;
+function now() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function currentRoute() {
+  if (typeof window === "undefined") return "";
+  return window.location.pathname + window.location.search;
+}
+function userAgent() {
+  if (typeof navigator === "undefined") return null;
+  return navigator.userAgent ?? null;
+}
+function buildPayload(kind, extra) {
+  return {
+    kind,
+    session_id: getSessionId(),
+    ts: now(),
+    page_view_count: _pageViewCount,
+    reporter_token_hash: _reporterTokenHash,
+    user_id_hash: _userIdHash,
+    user_agent: userAgent(),
+    sdk_version: _sdkVersion,
+    ...extra
+  };
+}
+function send(payload) {
+  if (!_client) return;
+  _client.postSessionEvent(payload).catch(() => {
+  });
+}
+function initSessionTracker(opts) {
+  if (_initialized || typeof window === "undefined") return;
+  _initialized = true;
+  _client = opts.client;
+  _sdkVersion = opts.sdkVersion;
+  _reporterTokenHash = opts.reporterTokenHash ?? null;
+  _userIdHash = opts.userIdHash ?? null;
+  const entryRoute = currentRoute();
+  _pageViewCount = 1;
+  send(buildPayload("session_start", {
+    route: entryRoute,
+    referrer: typeof document !== "undefined" ? document.referrer ?? null : null
+  }));
+  _heartbeatTimer = setInterval(() => {
+    send(buildPayload("session_heartbeat", { route: currentRoute() }));
+  }, HEARTBEAT_INTERVAL_MS);
+  const onHide = () => {
+    if (typeof document !== "undefined" && document.visibilityState === "hidden") {
+      send(buildPayload("session_end", { route: currentRoute() }));
+    }
+  };
+  if (typeof document !== "undefined") {
+    document.addEventListener("visibilitychange", onHide, { passive: true });
+  }
+  if (typeof window !== "undefined") {
+    window.addEventListener("pagehide", () => {
+      send(buildPayload("session_end", { route: currentRoute() }));
+    }, { passive: true });
+  }
+  patchHistoryForPageViews();
+}
+function trackPageView(route) {
+  if (!_initialized || !_client) return;
+  _pageViewCount += 1;
+  send(buildPayload("page_view", { route: route ?? currentRoute() }));
+}
+function updateSessionIdentity(userIdHash) {
+  _userIdHash = userIdHash;
+}
+function destroySessionTracker() {
+  if (_heartbeatTimer != null) {
+    clearInterval(_heartbeatTimer);
+    _heartbeatTimer = null;
+  }
+  _initialized = false;
+  _client = null;
+}
+var _historyPatched = false;
+function patchHistoryForPageViews() {
+  if (_historyPatched || typeof history === "undefined") return;
+  _historyPatched = true;
+  const wrap = (original) => function(...args) {
+    const result = original.apply(this, args);
+    if (original === history.pushState) {
+      _pageViewCount += 1;
+      send(buildPayload("page_view", { route: currentRoute() }));
+    }
+    return result;
+  };
+  history.pushState = wrap(history.pushState);
+  history.replaceState = wrap(history.replaceState);
+  window.addEventListener("popstate", () => {
+    _pageViewCount += 1;
+    send(buildPayload("page_view", { route: currentRoute() }));
+  }, { passive: true });
+}
+
 // src/rate-limiter.ts
 var DEFAULT_MAX_BURST = 10;
 var DEFAULT_REFILL_RATE = 1;
@@ -1834,12 +1950,12 @@ function createRateLimiter(config = {}) {
   let tokens = maxBurst;
   let lastRefill = Date.now();
   function refill() {
-    const now = Date.now();
-    const elapsed = now - lastRefill;
+    const now2 = Date.now();
+    const elapsed = now2 - lastRefill;
     const refills = Math.floor(elapsed / refillIntervalMs);
     if (refills > 0) {
       tokens = Math.min(maxBurst, tokens + refills * refillRate);
-      lastRefill = now;
+      lastRefill = now2;
     }
   }
   function tryConsume() {
@@ -2153,15 +2269,15 @@ function mushiTokens(mode) {
 // src/identity.ts
 var MUSHI_IDENTITY_TOKEN_PREFIX = "mushi.identity";
 function buildIdentityClaims(input) {
-  const now = Math.floor(Date.now() / 1e3);
+  const now2 = Math.floor(Date.now() / 1e3);
   const ttl = input.ttlSeconds && input.ttlSeconds > 0 ? Math.min(input.ttlSeconds, 3600) : 600;
   return {
     projectId: input.projectId,
     sub: input.userId,
     ...input.email ? { email: input.email } : {},
     ...input.name ? { name: input.name } : {},
-    iat: now,
-    exp: now + ttl
+    iat: now2,
+    exp: now2 + ttl
   };
 }
 function base64UrlDecode(segment) {
@@ -2200,12 +2316,12 @@ var MULTI_TENANT_PARENT_HOSTS = /* @__PURE__ */ new Set(["kensaur.us", "www.kens
 var SLUG_DOMAIN_HINTS = {
   "glot-it": "glot.it",
   glotit: "glot.it",
-  "solo-boss-cloud": "sbc-front.vercel.app",
+  "solo-boss-cloud": "solo-boss.kensaur.us",
   "mushi-mushi": "kensaur.us"
 };
 var SLUG_ICON_URL_HINTS = {
   "mushi-mushi": "https://kensaur.us/mushi-mushi/admin/favicon.svg",
-  "solo-boss-cloud": "https://sbc-front.vercel.app/favicon.svg",
+  "solo-boss-cloud": "https://solo-boss.kensaur.us/favicon.svg",
   "glot-it": "https://kensaur.us/glot-it/apple-touch-icon.png",
   glotit: "https://kensaur.us/glot-it/apple-touch-icon.png"
 };
@@ -2419,6 +2535,7 @@ exports.createOfflineQueue = createOfflineQueue;
 exports.createPiiScrubber = createPiiScrubber;
 exports.createPreFilter = createPreFilter;
 exports.createRateLimiter = createRateLimiter;
+exports.destroySessionTracker = destroySessionTracker;
 exports.diagnoseEnvConfig = diagnoseEnvConfig;
 exports.estimateJsonBytes = estimateJsonBytes;
 exports.expandPreset = expandPreset;
@@ -2429,6 +2546,7 @@ exports.getReporterToken = getReporterToken;
 exports.getSessionId = getSessionId;
 exports.githubRepoDomainHint = githubRepoDomainHint;
 exports.hmacSha256Hex = hmacSha256Hex;
+exports.initSessionTracker = initSessionTracker;
 exports.isLikelyGenericFavicon = isLikelyGenericFavicon;
 exports.isUntrustedFaviconUrl = isUntrustedFaviconUrl;
 exports.mushiPalette = mushiPalette;
@@ -2450,6 +2568,8 @@ exports.resolveWidgetAccent = resolveWidgetAccent;
 exports.safeWidgetHex = safeWidgetHex;
 exports.scrubPii = scrubPii;
 exports.sha256Hex = sha256Hex;
+exports.trackPageView = trackPageView;
+exports.updateSessionIdentity = updateSessionIdentity;
 exports.validateConfig = validateConfig;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map