@mushi-mushi/mcp 0.20.0 → 0.20.2

package/README.md

@@ -146,7 +146,7 @@ The Mushi backend now exposes the same tool catalog over the **Streamable HTTP**
 
 ### Feature groups (`?features=` / `MUSHI_FEATURES`)
 
-Full catalog is **69 tools** (stdio / `MUSHI_FEATURES=all`). The hosted HTTP
+Full catalog is **72 tools** (stdio / `MUSHI_FEATURES=all`). The hosted HTTP
 endpoint exposes a leaner subset filtered by feature groups (see
 `mcp-hosted-tool-manifest.json`). New installs now default to the lean
 `triage,fixes,inventory,setup,docs` set automatically (stdio: when
@@ -390,7 +390,7 @@ Spawns `dist/index.js` with a dummy unreachable endpoint and confirms it adverti
 pnpm --filter @mushi-mushi/mcp build
 pnpm --filter @mushi-mushi/mcp test:smoke
 # OK; prints live tool/resource/prompt counts from the catalog
-# (see packages/mcp/src/catalog.ts — currently 69 tools / 8 resources / 4 prompts)
+# (see packages/mcp/src/catalog.ts — currently 72 tools / 8 resources / 4 prompts)
 ```
 
 ### Layer 3; Full localhost E2E (real binary + real backend behaviour)
@@ -484,4 +484,4 @@ MIT
 <!-- mushi-readme-stats-footer -->
 ---
 
-<sub>Monorepo scale (July 2026): 55 edge functions · 328 SQL migrations · 13 outbound plugins · 11 inbound adapters · 19 pipeline agents. Canonical counts: <a href="https://github.com/kensaurus/mushi-mushi/blob/master/docs/stats.md">docs/stats.md</a> · <code>pnpm docs-stats</code></sub>
+<sub>Monorepo scale (July 2026): 55 edge functions · 336 SQL migrations · 13 outbound plugins · 11 inbound adapters · 19 pipeline agents. Canonical counts: <a href="https://github.com/kensaurus/mushi-mushi/blob/master/docs/stats.md">docs/stats.md</a> · <code>pnpm docs-stats</code></sub>

package/dist/catalog.js

@@ -6,7 +6,7 @@ import {
   TDD_TOOL_CATALOG,
   TOOL_CATALOG,
   USE_MUSHI_INTENTS
-} from "./chunk-OZJEY3QR.js";
+} from "./chunk-RVZIKP4X.js";
 export {
   ALL_SCOPES,
   CODEBASE_TOOL_CATALOG,

package/dist/{chunk-OZJEY3QR.js → chunk-RVZIKP4X.js}

@@ -160,7 +160,7 @@ var TOOL_CATALOG = [
   {
     name: "dispatch_fix",
     title: "Dispatch Mushi fix agent",
-    description: 'Start a Mushi fix agent for a classified report; it writes a branch and opens a signed draft PR. Set agent="cursor_cloud" to dispatch a Cursor Cloud Agent (default uses the in-repo worker). Requires GitHub connected + an LLM key (run diagnose_setup mode=dispatch first). Returns { fixAttemptId }; poll get_fix_timeline for progress and merge_fix when CI is green. Write; NOT idempotent \u2014 each call starts a new attempt. Report must be classified \u2014 run triage_issue if not.',
+    description: 'Start a Mushi fix agent for a classified report; it writes a branch and opens a signed draft PR. Set agent="cursor_cloud" to dispatch a Cursor Cloud Agent (default uses the in-repo worker). Requires GitHub connected + an LLM key (run diagnose_setup mode=dispatch first). Returns { fixId, status } (fixId is the dispatch id; get_fix_timeline accepts it immediately); poll get_fix_timeline for progress and merge_fix when CI is green. Write; pass the same idempotencyKey to retry safely \u2014 without it each call starts a new attempt. Report must be classified \u2014 run triage_issue if not.',
     scope: "mcp:write",
     hints: { readOnly: false, destructive: false, idempotent: false, openWorld: true },
     useCase: "Let the in-repo agent attempt this fix for me (or: dispatch a Cursor Cloud Agent)."
@@ -295,6 +295,14 @@ var TOOL_CATALOG = [
     hints: { readOnly: true, idempotent: true, openWorld: true },
     useCase: "Analyze this bug report end-to-end and tell me what to do."
   },
+  {
+    name: "triage_next_steps",
+    title: "What should I work on now?",
+    description: 'Prioritised "do this next" list for the project: blocked auto-fixes first (with the unblock action), then in-flight fixes to shepherd to merge, then user-felt classified reports by severity, with robot/cron chores (dependency bumps) last. Returns { steps: [{ priority, action, reason, tool, args }], summary }. Read-only. Call this first when the user asks "what needs my attention / what should I triage or fix".',
+    scope: "mcp:read",
+    hints: { readOnly: true, idempotent: true, openWorld: true },
+    useCase: "What should I triage or fix right now?"
+  },
   // ── Lessons / evolution loop ─────────────────────────────────────────────
   {
     name: "query_lessons",
@@ -449,7 +457,7 @@ var TDD_TOOL_CATALOG = [
   {
     name: "list_byok_keys",
     title: "List your API key pool",
-    description: "List the project's BYOK API keys grouped by provider (anthropic | openai | firecrawl | browserbase | cursor). Returns { keys: [{ id, provider, label, priority, status, cooldownUntil }] } \u2014 metadata only, never the raw secret. Read-only. Use to see which keys are active vs rate-limited/exhausted; use add_byok_key to add one.",
+    description: "List the project's BYOK API keys grouped by provider (anthropic | openai | firecrawl | browserbase | cursor). Returns pooled { keys: [{ id, provider_slug, label, priority, status, cooldown_until, test_status, key_hint, base_url, last_tested_at, last_used_at }] } plus read-only { legacyKeys } metadata for credentials saved before the pooled lifecycle \u2014 never the raw secret. Read-only. Use to see which keys are validated, active, pending, legacy, or rate-limited; use add_byok_key to add one.",
     scope: "mcp:read",
     hints: { readOnly: true, idempotent: true, openWorld: true },
     useCase: "Which API keys are active and which are rate-limited?"
@@ -457,11 +465,27 @@ var TDD_TOOL_CATALOG = [
   {
     name: "add_byok_key",
     title: "Add an API key",
-    description: "Add a BYOK API key to the project pool for a provider (anthropic | openai | firecrawl | browserbase | cursor), with a label and priority for failover ordering. The raw key is stored encrypted in Supabase Vault and never returned. Returns { id, provider, label }. Write; NOT idempotent \u2014 adds a new row each call. Use to register a backup/rotated key; use list_byok_keys to review the pool.",
+    description: "Add and immediately validate a BYOK API key for anthropic | openai | firecrawl | browserbase | cursor. The raw key is stored encrypted in Supabase Vault and never returned; failed probes remain quarantined. Optional baseUrl is accepted only for allow-listed OpenAI-compatible HTTPS providers. Write; NOT idempotent.",
     scope: "mcp:write",
     hints: { readOnly: false, destructive: false, idempotent: false, openWorld: true },
     useCase: "Add a backup Anthropic key to the pool."
   },
+  {
+    name: "test_byok_key",
+    title: "Test an API key",
+    description: "Re-test one pooled BYOK credential by key id. A successful provider probe activates the key; auth, quota, and network failures keep it out of the runtime pool. Returns the sanitized validation result and updated key metadata. Write; idempotent.",
+    scope: "mcp:write",
+    hints: { readOnly: false, destructive: false, idempotent: true, openWorld: true },
+    useCase: "Re-test a quarantined OpenAI key after fixing its account quota."
+  },
+  {
+    name: "remove_byok_key",
+    title: "Remove an API key",
+    description: "Permanently remove one pooled BYOK credential by key id from the authenticated project, including its Vault secret. Write; destructive; idempotent.",
+    scope: "mcp:write",
+    hints: { readOnly: false, destructive: true, idempotent: true, openWorld: true },
+    useCase: "Remove a rotated or compromised provider key from the runtime pool."
+  },
   {
     name: "list_pending_review_stories",
     title: "List QA stories pending review",
@@ -604,24 +628,29 @@ var TDD_TOOL_CATALOG = [
   }
 ];
 var USE_MUSHI_INTENTS = {
+  // NOTE: every name below MUST be a registered TOOL (scopes.test.ts guards
+  // this). 2026-08-16 audit P0-3 found phantom names (get_report,
+  // get_dashboard, list_qa_stories) and prompts listed as tools
+  // (summarize_report_for_fix, mushi_setup) — agents routed here then
+  // failed the call and gave up.
   fix: {
     label: "Fix a bug",
     tools: [
       "get_recent_reports",
-      "get_report",
-      "summarize_report_for_fix",
+      "get_report_detail",
+      "triage_issue",
       "dispatch_fix",
       "start_skill_pipeline",
       "checkin_pipeline_step",
       "get_pipeline_run"
     ],
-    hint: "Call get_recent_reports to find the top unresolved bug, then summarize_report_for_fix before dispatching."
+    hint: "Call get_recent_reports to find the top unresolved bug, then triage_issue before dispatching."
   },
   status: {
     label: "Check project status",
     tools: [
-      "get_dashboard",
       "triage_next_steps",
+      "get_account_overview",
       "get_usage",
       "get_backend_health",
       "activation_status"
@@ -631,18 +660,19 @@ var USE_MUSHI_INTENTS = {
   setup: {
     label: "Set up Mushi",
     tools: [
-      "mushi_setup",
+      "diagnose_setup",
       "activation_status",
       "get_backend_health",
       "list_byok_keys",
-      "add_byok_key"
+      "add_byok_key",
+      "test_byok_key",
+      "remove_byok_key"
     ],
-    hint: "Call mushi_setup first \u2014 it diagnoses setup gaps and returns the next command to run."
+    hint: "Call diagnose_setup first \u2014 it diagnoses setup gaps and returns the next action to take."
   },
   qa: {
     label: "Run / review QA tests",
     tools: [
-      "list_qa_stories",
       "run_qa_story",
       "list_qa_story_runs",
       "get_qa_story_run",
@@ -650,7 +680,7 @@ var USE_MUSHI_INTENTS = {
       "approve_qa_story",
       "improve_qa_story"
     ],
-    hint: "Call list_qa_stories to see what test coverage exists; run_qa_story to trigger a run."
+    hint: "Call list_qa_story_runs to see recent coverage and outcomes; run_qa_story to trigger a run."
   },
   pipeline: {
     label: "Run an agent pipeline / skill",
@@ -665,12 +695,7 @@ var USE_MUSHI_INTENTS = {
   },
   audit: {
     label: "Audit / health check",
-    tools: [
-      "run_fullstack_audit",
-      "get_backend_health",
-      "get_dashboard",
-      "get_usage"
-    ],
+    tools: ["run_fullstack_audit", "get_backend_health", "get_account_overview", "get_usage"],
     hint: "Call run_fullstack_audit for a full-stack health scorecard."
   }
 };

package/dist/{chunk-VBXXUK5G.js → chunk-ZSVRLSW5.js}

@@ -98,8 +98,10 @@ var TOOL_FEATURE_MAP = {
   start_skill_pipeline: "skills",
   get_pipeline_run: "skills",
   checkin_pipeline_step: "skills",
-  list_byok_keys: "skills",
-  add_byok_key: "skills",
+  list_byok_keys: "setup",
+  add_byok_key: "setup",
+  test_byok_key: "setup",
+  remove_byok_key: "setup",
   // audit
   run_fullstack_audit: "audit",
   get_backend_health: "audit",

package/dist/clients.d.ts

@@ -46,7 +46,7 @@ import { FeatureGroup } from './feature-groups.js';
  * editor launch. Synced to package.json by `scripts/sync-mcp-pin.mjs` — never
  * hand-edit the version.
  */
-declare const MCP_PIN_SPEC = "@mushi-mushi/mcp@0.20.0";
+declare const MCP_PIN_SPEC = "@mushi-mushi/mcp@0.20.2";
 interface StdioConfig {
     command: string;
     args: string[];

package/dist/clients.js

@@ -5,10 +5,10 @@ import {
   DEFAULT_FEATURE_GROUPS,
   appendFeaturesToUrl,
   featuresQueryString
-} from "./chunk-VBXXUK5G.js";
+} from "./chunk-ZSVRLSW5.js";
 
 // src/clients.ts
-var MCP_PIN_SPEC = "@mushi-mushi/mcp@0.20.0";
+var MCP_PIN_SPEC = "@mushi-mushi/mcp@0.20.2";
 function projectServerName(projectId, projectName) {
   const nameSlug = projectName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 22);
   const idSuffix = projectId.replace(/-/g, "").slice(0, 6);

package/dist/feature-groups.js

@@ -9,7 +9,7 @@ import {
   parseFeaturesCsv,
   parseFeaturesParam,
   toolMatchesFeatures
-} from "./chunk-VBXXUK5G.js";
+} from "./chunk-ZSVRLSW5.js";
 export {
   ALL_FEATURE_GROUPS,
   DEFAULT_FEATURE_GROUPS,