@mushi-mushi/mcp 0.21.0 → 0.22.0

package/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@mushi-mushi/mcp",
   "mcpName": "io.github.kensaurus/mushi-mushi",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "license": "MIT",
-  "description": "MCP server for Mushi Mushi — triage user-felt bugs, pull evidence (screenshots, console logs, network requests), check blast radius, and dispatch fix PRs, all from your AI coding agent",
+  "description": "MCP server for Cursor, Claude Code and Copilot. The bug mediator for AI-built apps: plain-English diagnosis + a ready fix, in your editor.",
   "type": "module",
   "exports": {
     ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js"
     },
     "./catalog": {
       "types": "./dist/catalog.d.ts",
@@ -31,28 +31,33 @@
       "import": "./dist/clients.js"
     }
   },
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
+  "main": "./dist/server.js",
+  "types": "./dist/server.d.ts",
   "bin": {
     "mushi-mcp": "./dist/index.js"
   },
   "files": [
     "dist",
     "README.md",
-    "LICENSE",
-    "CONTRIBUTING.md",
-    "CODE_OF_CONDUCT.md",
-    "SECURITY.md"
+    "LICENSE"
   ],
   "dependencies": {
     "@modelcontextprotocol/core": "^2.0.0",
     "@modelcontextprotocol/server": "^2.0.0",
-    "@sentry/node": "^10.57.0",
     "zod": "^4.4.3",
-    "@mushi-mushi/core": "^1.28.0"
+    "@mushi-mushi/core": "^1.29.0"
+  },
+  "peerDependencies": {
+    "@sentry/node": "^10.57.0"
+  },
+  "peerDependenciesMeta": {
+    "@sentry/node": {
+      "optional": true
+    }
   },
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
+    "@sentry/node": "^10.57.0",
     "@types/node": "^22.20.0",
     "eslint": "^10.6.0",
     "tsup": "^8.5.1",
@@ -65,7 +70,7 @@
     "url": "https://github.com/kensaurus/mushi-mushi.git",
     "directory": "packages/mcp"
   },
-  "author": "Kenji Sakuramoto (https://bsky.app/profile/mushimushi.dev)",
+  "author": "Kenji Sakuramoto <kensaurus@gmail.com> (https://github.com/kensaurus)",
   "homepage": "https://kensaur.us/mushi-mushi",
   "bugs": {
     "url": "https://github.com/kensaurus/mushi-mushi/issues"
@@ -96,14 +101,11 @@
     "ai-agent",
     "llm",
     "observability",
-    "user-feedback"
+    "user-feedback",
+    "mushi"
   ],
   "engines": {
-    "node": ">=20"
-  },
-  "funding": {
-    "type": "github",
-    "url": "https://github.com/sponsors/kensaurus"
+    "node": ">=20.19.0"
   },
   "scripts": {
     "build": "tsup",

package/CODE_OF_CONDUCT.md

@@ -1,51 +0,0 @@
-<!--
-  AUTO-SYNCED from repo root by scripts/sync-community-files.mjs.
-  Do not edit here — edit the canonical file at the repository root and
-  re-run `node scripts/sync-community-files.mjs` (pre-commit hook does this
-  automatically).
--->
-
-# Contributor Covenant Code of Conduct
-
-## Our Pledge
-
-We as members, contributors, and leaders pledge to make participation in our
-community a harassment-free experience for everyone, regardless of age, body
-size, visible or invisible disability, ethnicity, sex characteristics, gender
-identity and expression, level of experience, education, socio-economic status,
-nationality, personal appearance, race, caste, color, religion, or sexual
-identity and orientation.
-
-We pledge to act and interact in ways that contribute to an open, welcoming,
-diverse, inclusive, and healthy community.
-
-## Our Standards
-
-Examples of behavior that contributes to a positive environment:
-
-- Using welcoming and inclusive language
-- Being respectful of differing viewpoints and experiences
-- Gracefully accepting constructive criticism
-- Focusing on what is best for the community
-- Showing empathy towards other community members
-
-Examples of unacceptable behavior:
-
-- The use of sexualized language or imagery, and sexual attention or advances of any kind
-- Trolling, insulting or derogatory comments, and personal or political attacks
-- Public or private harassment
-- Publishing others' private information without explicit permission
-- Other conduct which could reasonably be considered inappropriate in a professional setting
-
-## Enforcement
-
-Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported to the project team at **kensaurus@gmail.com**.
-
-All complaints will be reviewed and investigated promptly and fairly.
-
-## Attribution
-
-This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org/),
-version 2.1, available at
-https://www.contributor-covenant.org/version/2/1/code_of_conduct.html.

package/CONTRIBUTING.md

@@ -1,226 +0,0 @@
-<!--
-  AUTO-SYNCED from repo root by scripts/sync-community-files.mjs.
-  Do not edit here — edit the canonical file at the repository root and
-  re-run `node scripts/sync-community-files.mjs` (pre-commit hook does this
-  automatically).
--->
-
-# Contributing to Mushi Mushi
-
-Thanks for wanting to help. Here's everything you need to get started.
-
-## Prerequisites
-
-- **Node.js >= 22** (see `.node-version`)
-- **pnpm >= 10** — install with `corepack enable`
-
-## Setup
-
-```bash
-git clone https://github.com/kensaurus/mushi-mushi.git
-cd mushi-mushi
-pnpm install
-pnpm build
-```
-
-## Development
-
-```bash
-pnpm dev          # Start all dev servers (admin on :6464)
-```
-
-| Surface | URL |
-| --- | --- |
-| Admin console | http://localhost:6464 |
-| Docs site | http://localhost:3000 |
-| CLI console override | `MUSHI_CONSOLE_URL=http://localhost:6464` |
-
-```bash
-pnpm test         # Run Vitest across all packages
-pnpm typecheck    # TypeScript checks
-pnpm lint         # ESLint
-pnpm format       # Prettier
-pnpm smoke:cli-setup   # Playwright: onboarding ?setup=cli + success panel (skips headless if unsigned)
-```
-
-Set `CLI_SETUP_SMOKE_STRICT=1` to fail the smoke script when Playwright is not signed in (CI gate).
-
-Ad-hoc screenshots captured during UI reviews can live temporarily at the repo
-root, but root-level `*.png` files are intentionally ignored. Canonical
-screenshots that should be versioned belong under `docs/screenshots/`.
-
-### Working on a single package
-
-```bash
-cd packages/core
-pnpm dev          # Watch mode
-pnpm test         # Tests for this package only
-```
-
-## Project Structure
-
-```
-packages/
-  core/          Types, API client, offline queue (MIT)
-  web/           Browser SDK — widget, capture (MIT)
-  react/         React bindings (MIT)
-  vue/           Vue 3 plugin (MIT)
-  svelte/        Svelte SDK (MIT)
-  angular/       Angular SDK (MIT)
-  react-native/  React Native SDK (MIT)
-  cli/           CLI tool (MIT)
-  mcp/           MCP server for coding agents (MIT)
-  server/        Supabase Edge Functions (AGPLv3; ee/ is commercial)
-  agents/        Agentic fix pipeline (AGPLv3)
-  verify/        Fix verification (AGPLv3)
-apps/
-  admin/         Admin dashboard (React + Tailwind)
-  docs/          Documentation site (Nextra — apps/docs)
-  testers/       Tester marketplace portal (Next.js)
-tooling/
-  eslint-config/ Shared ESLint flat config
-  tsconfig/      Shared TypeScript configs
-```
-
-## What we don't accept
-
-Knowing this upfront saves everyone time.
-
-- **Automated / bulk / AI-slop PRs** — any PR that was opened by a script, an LLM agent acting without meaningful human review, or as part of a parallel bounty-farming sweep is closed on sight. The commit history, branch name, or helper scripts included in the PR make this obvious.
-- **PRs that target the wrong base** — all PRs must branch from and target `master`. PRs targeting `main` or any other branch are closed (and will show an inflated diff that is not your work).
-- **One PR per issue, one issue per PR** — splitting or duplicating work just to collect acknowledgements isn't welcome.
-- **Good-first-issues without claiming first** — comment on the issue to claim it before starting. If two people open PRs for the same issue, the one that commented first is prioritised.
-- **Documentation-only PRs that merely duplicate existing content** — if the information already exists (e.g. in another file in this repo), adding a redundant copy adds noise without value.
-
-If a PR violates these policies it will be closed with a brief explanation. No hard feelings — a genuine contribution on the same issue is always welcome.
-
-## Making Changes
-
-1. Create a feature branch from `master`
-2. Make your changes
-3. Add tests for new functionality
-4. Run `pnpm typecheck && pnpm lint && pnpm test` to verify
-5. Create a changeset if your change affects published packages:
-   ```bash
-   pnpm changeset
-   ```
-6. Open a pull request
-
-### Documentation (docs-as-code)
-
-If your PR changes **user-visible SDK or CLI behavior**, update docs in the **same PR**:
-
-| Surface | When to update |
-| --- | --- |
-| `packages/*/README.md` | npm-facing install/API/config changes for that package |
-| `apps/docs/content/**/*.mdx` | Long-form guides, quickstarts, admin console docs |
-| Root `README.md` | Marketing stats only when counts change — run `pnpm check:docs-stats` |
-
-Guardrails (run locally before pushing):
-
-```bash
-pnpm check:docs-stats          # root README stat badges + glance <sub> line
-pnpm check:sdk-version-matrix  # apps/docs/content/sdks/index.mdx versions
-pnpm check:internal-doc-links  # dead /foo links in MDX
-pnpm check:onboarding-drift    # phantom MCP env vars / stale tool names / native install coords
-pnpm check:catalog-sync        # MCP catalog ↔ admin counts ↔ prose "N tools"
-pnpm check:mcp-tools-doc       # mcp-tools.generated.mdx stale check
-pnpm check:bundle-docs         # @mushi-mushi/web size-limit vs README
-pnpm check:docs-drift          # versions + public docs links
-pnpm gen:llms-txt              # regenerate apps/docs/public/llms.txt after nav changes
-pnpm gen:mcp-tools-doc         # regenerate sdks/mcp-tools.generated.mdx from catalog.ts
-```
-
-**Same-PR rule:** if behavior, env vars, CLI commands, MCP tools, or install
-coordinates change, update the matching docs in this PR and run
-`pnpm check:docs-drift && pnpm check:onboarding-drift && pnpm check:catalog-sync`.
-
-README changes on npm packages only appear on [npmjs.com](https://www.npmjs.com) after the next **Changesets publish**.
-
-## Changesets
-
-We use [Changesets](https://github.com/changesets/changesets) for versioning. If your PR modifies a published package (`core`, `web`, `react`, `vue`, `svelte`, `angular`, `react-native`, `cli`, `mcp`), add a changeset:
-
-```bash
-pnpm changeset
-```
-
-Select the affected packages, the semver bump type, and write a summary. The changeset file gets committed with your PR.
-
-## Release flow
-
-Releases are fully automated once the version PR is merged. Maintainers don't run
-`npm publish` by hand for routine bumps. See **[`docs/DEPLOYMENT.md`](docs/DEPLOYMENT.md)**
-for the full production runbook (edge functions, admin SPA, docs site, migrations).
-
-1. PRs land on `master` with one or more changeset files in `.changeset/`.
-   Orphaned changesets (only ignored packages) fail `pnpm check:changeset-orphans`.
-2. `release.yml` runs on every push to `master`. It opens (or updates) a
-   **`chore: version packages`** PR on `changeset-release/master` that bumps
-   affected `package.json` files, rolls up changelogs, and deletes consumed
-   changesets.
-3. **Wait for CI on the version PR.** If checks don't appear (bot-branch
-   suppression), push an empty commit to `changeset-release/master`. If
-   `check:sdk-version-matrix` fails, run `pnpm gen:sdk-version-matrix` on that
-   branch and commit `apps/docs/content/sdks/index.mdx`.
-4. Merge the version PR. The publish step uses **OIDC Trusted Publishers** +
-   Sigstore provenance (with `NPM_TOKEN` only for brand-new package bootstrap).
-5. **Manually dispatch Release** unless a run starts within ~2 minutes:
-   **Actions → Release → Run workflow → `master`**. Squash-merges attributed to
-   `github-actions[bot]` usually suppress the auto `push` trigger — manual
-   dispatch is the normal path, not a fallback of last resort.
-
-```bash
-gh workflow run release.yml --ref master
-```
-
-### Adding a brand-new publishable package
-
-Trusted Publisher bindings are configured **per package** on `npmjs.com` and require the package to already exist on the registry. New packages therefore need a one-time bootstrap before OIDC can take over.
-
-1. Add the package under `packages/<name>/` with a real `version`, `files`, `publishConfig.access: "public"`, `LICENSE`, and the standard fields enforced by `pnpm check:publish-readiness`.
-2. Build it locally: `pnpm install && pnpm -r build`.
-3. Mint a short-lived granular access token at `https://www.npmjs.com/settings/<your-user>/tokens/granular-access-tokens/new` — **Bypass 2FA: ON**, **Read and write: All packages**, **Expiration: 7 days**.
-4. Bootstrap-publish:
-   ```bash
-   NPM_TOKEN=npm_xxx pnpm bootstrap:new-package
-   ```
-   The script auto-detects which workspace packages are missing on npm and publishes them via `pnpm publish --no-provenance` (so `workspace:^` specifiers get rewritten to real semver in the tarball).
-5. The script prints one URL per freshly-published package. Open each, click **GitHub Actions** under "Trusted Publisher", confirm the auto-filled fields (`<owner>` / `<repo>` / `release.yml`), and tap your security key.
-6. Revoke the bootstrap token at `https://www.npmjs.com/settings/<your-user>/tokens`.
-
-From the next changeset bump onward, that package publishes through the normal `release.yml` flow with full OIDC provenance — same as the rest.
-
-## Code Style
-
-- **TypeScript strict mode** — no `any` unless absolutely necessary
-- **Prettier** formats everything — run `pnpm format` before committing
-- **ESLint** catches bugs — `pnpm lint` must pass
-- **No default exports** in library packages — use named exports
-- **Dual ESM/CJS** builds via tsup for all SDK packages
-
-## Commit Messages
-
-Use conventional commits:
-
-```
-feat(core): add batch report submission
-fix(web): prevent widget from opening during screenshot
-docs(react): update provider usage example
-chore: bump dependencies
-```
-
-## Tests
-
-- **Framework:** Vitest
-- **Location:** Co-located with source (`src/foo.test.ts`)
-- **Coverage:** Required for `core`, `web`, `react` — encouraged for all packages
-
-## License
-
-- SDK packages are MIT — your contributions will be MIT-licensed
-- Server/agents/verify are AGPLv3 — contributions to those packages fall under AGPLv3. A [commercial license](./COMMERCIAL-LICENSE.md) is available for hosted-SaaS use cases that cannot publish modifications. The `packages/server/ee/` directory is source-available but commercial (production use needs a license); contributions there are accepted under the same EE terms.
-
-## Questions?
-
-Open an issue or start a discussion. We're happy to help.