@mushi-mushi/mcp 0.24.0 → 0.24.2

package/README.md

@@ -494,4 +494,4 @@ MIT
 <!-- mushi-readme-stats-footer -->
 ---
 
-<sub>Monorepo scale (July 2026): 64 edge functions · 410 SQL migrations · 13 outbound plugins · 11 inbound adapters · 19 pipeline agents. Canonical counts: <a href="https://github.com/kensaurus/mushi-mushi/blob/master/docs/stats.md">docs/stats.md</a> · <code>pnpm docs-stats</code></sub>
+<sub>Monorepo scale (July 2026): 64 edge functions · 413 SQL migrations · 13 outbound plugins · 11 inbound adapters · 19 pipeline agents. Canonical counts: <a href="https://github.com/kensaurus/mushi-mushi/blob/master/docs/stats.md">docs/stats.md</a> · <code>pnpm docs-stats</code></sub>

package/dist/catalog.js

@@ -8,7 +8,7 @@ import {
   TOOL_CATALOG,
   USE_MUSHI_INTENTS,
   routeUseMushiIntent
-} from "./chunk-2NW2VVWV.js";
+} from "./chunk-Y757GGQH.js";
 export {
   ALL_SCOPES,
   CODEBASE_TOOL_CATALOG,

package/dist/{chunk-2NW2VVWV.js → chunk-Y757GGQH.js}

@@ -491,7 +491,7 @@ var TOOL_CATALOG = [
   {
     name: "dispatch_fix",
     title: "Dispatch Mushi fix agent",
-    description: 'Start a Mushi fix agent for a classified report; it writes a branch and opens a signed draft PR. Set agent="cursor_cloud" to dispatch a Cursor Cloud Agent (default uses the in-repo worker). Requires GitHub connected + an LLM key (run diagnose_setup mode=dispatch first). Returns { fixId, status } (fixId is the dispatch id; get_fix_timeline accepts it immediately); poll get_fix_timeline for progress and merge_fix when CI is green. Write; pass the same idempotencyKey to retry safely \u2014 without it each call starts a new attempt. Report must be classified \u2014 run triage_issue if not.',
+    description: 'Start a Mushi fix agent for a classified report; it writes a branch and opens a signed draft PR. Set agent="cursor_cloud" to dispatch a Cursor Cloud Agent (default uses the in-repo worker). For a project with several linked repos, set targetRepoId (a project_repos.id) to choose the repo the PR opens against; omit it for the primary repo. Requires GitHub connected + an LLM key (run diagnose_setup mode=dispatch first). Returns { fixId, status } (fixId is the dispatch id; get_fix_timeline accepts it immediately); poll get_fix_timeline for progress and merge_fix when CI is green. Write; pass the same idempotencyKey to retry safely \u2014 without it each call starts a new attempt. Report must be classified \u2014 run triage_issue if not.',
     scope: "mcp:write",
     hints: { readOnly: false, destructive: false, idempotent: false, openWorld: true },
     useCase: "Let the in-repo agent attempt this fix for me (or: dispatch a Cursor Cloud Agent)."
@@ -820,7 +820,7 @@ var TDD_TOOL_CATALOG = [
   {
     name: "list_byok_keys",
     title: "List your API key pool",
-    description: "List the project's BYOK API keys grouped by provider (anthropic | openai | firecrawl | browserbase | cursor). Returns pooled { keys: [{ id, provider_slug, label, priority, status, cooldown_until, test_status, key_hint, base_url, last_tested_at, last_used_at }] } plus read-only { legacyKeys } metadata for credentials saved before the pooled lifecycle \u2014 never the raw secret. Read-only. Use to see which keys are validated, active, pending, legacy, or rate-limited; use add_byok_key to add one.",
+    description: "List the project's BYOK API keys grouped by provider (anthropic | openai | firecrawl | browserbase | cursor | supabase). Returns pooled { keys: [{ id, provider_slug, label, priority, status, cooldown_until, test_status, key_hint, base_url, last_tested_at, last_used_at }] } plus read-only { legacyKeys } metadata for credentials saved before the pooled lifecycle \u2014 never the raw secret. Read-only. Use to see which keys are validated, active, pending, legacy, or rate-limited; use add_byok_key to add one.",
     scope: "mcp:read",
     hints: { readOnly: true, idempotent: true, openWorld: true },
     useCase: "Which API keys are active and which are rate-limited?"
@@ -828,7 +828,7 @@ var TDD_TOOL_CATALOG = [
   {
     name: "add_byok_key",
     title: "Add an API key",
-    description: "Add and immediately validate a BYOK API key for anthropic | openai | firecrawl | browserbase | cursor. The raw key is stored encrypted in Supabase Vault and never returned; failed probes remain quarantined. Optional baseUrl is accepted only for allow-listed OpenAI-compatible HTTPS providers. Write; NOT idempotent.",
+    description: "Add and immediately validate a BYOK API key for anthropic | openai | firecrawl | browserbase | cursor | supabase (a scoped, read-only Supabase access token, checked against the linked supabase_project_ref). The raw key is stored encrypted in Supabase Vault and never returned; failed probes remain quarantined. Optional baseUrl is accepted only for allow-listed OpenAI-compatible HTTPS providers. Write; NOT idempotent.",
     scope: "mcp:write",
     hints: { readOnly: false, destructive: false, idempotent: false, openWorld: true },
     useCase: "Add a backup Anthropic key to the pool."
@@ -984,7 +984,7 @@ var TDD_TOOL_CATALOG = [
   {
     name: "run_fullstack_audit",
     title: "Run a full-stack health audit",
-    description: "Fan out a full-stack health audit for the current project: DB schema + advisors, API contract gate results (Gates 3\u20138), recent backend error logs, and RLS gap detection. Returns a PM-readable scorecard with severity-ranked findings and fix hints. Requires the project to have a Supabase PAT configured (Settings \u2192 API Keys, slug: supabase) and supabase_project_ref set in project settings for backend analysis. The audit completes synchronously in ~10 s. Triggers a background gate run for orphan_endpoint and unknown_call gates if they have not run today.",
+    description: "Fan out a full-stack health audit for the current project: DB schema + advisors, API contract gate results (Gates 3\u20138), recent backend error logs, and RLS gap detection. Returns a PM-readable scorecard with severity-ranked findings and fix hints. Backend analysis needs supabase_project_ref set (Settings \u2192 General) and a scoped, read-only Supabase access token added (Settings \u2192 AI keys, slug: supabase). The audit completes synchronously in ~10 s. Triggers a background gate run for orphan_endpoint and unknown_call gates if they have not run today.",
     scope: "mcp:write",
     hints: { readOnly: false, destructive: false, idempotent: true, openWorld: true },
     useCase: "Is this project healthy? Run a one-click full-stack audit to find API contract mismatches, unlinked backend features, schema drift, and security gaps."

package/dist/clients.d.ts

@@ -46,7 +46,7 @@ import { FeatureGroup } from './feature-groups.js';
  * editor launch. Synced to package.json by `scripts/sync-mcp-pin.mjs` — never
  * hand-edit the version.
  */
-declare const MCP_PIN_SPEC = "@mushi-mushi/mcp@0.24.0";
+declare const MCP_PIN_SPEC = "@mushi-mushi/mcp@0.24.2";
 interface StdioConfig {
     command: string;
     args: string[];

package/dist/clients.js

@@ -8,7 +8,7 @@ import {
 } from "./chunk-F65T4IGT.js";
 
 // src/clients.ts
-var MCP_PIN_SPEC = "@mushi-mushi/mcp@0.24.0";
+var MCP_PIN_SPEC = "@mushi-mushi/mcp@0.24.2";
 function projectServerName(projectId, projectName) {
   const nameSlug = projectName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 22);
   const idSuffix = projectId.replace(/-/g, "").slice(0, 6);

package/dist/index.js

@@ -567,7 +567,7 @@ var TOOL_CATALOG = [
   {
     name: "dispatch_fix",
     title: "Dispatch Mushi fix agent",
-    description: 'Start a Mushi fix agent for a classified report; it writes a branch and opens a signed draft PR. Set agent="cursor_cloud" to dispatch a Cursor Cloud Agent (default uses the in-repo worker). Requires GitHub connected + an LLM key (run diagnose_setup mode=dispatch first). Returns { fixId, status } (fixId is the dispatch id; get_fix_timeline accepts it immediately); poll get_fix_timeline for progress and merge_fix when CI is green. Write; pass the same idempotencyKey to retry safely \u2014 without it each call starts a new attempt. Report must be classified \u2014 run triage_issue if not.',
+    description: 'Start a Mushi fix agent for a classified report; it writes a branch and opens a signed draft PR. Set agent="cursor_cloud" to dispatch a Cursor Cloud Agent (default uses the in-repo worker). For a project with several linked repos, set targetRepoId (a project_repos.id) to choose the repo the PR opens against; omit it for the primary repo. Requires GitHub connected + an LLM key (run diagnose_setup mode=dispatch first). Returns { fixId, status } (fixId is the dispatch id; get_fix_timeline accepts it immediately); poll get_fix_timeline for progress and merge_fix when CI is green. Write; pass the same idempotencyKey to retry safely \u2014 without it each call starts a new attempt. Report must be classified \u2014 run triage_issue if not.',
     scope: "mcp:write",
     hints: { readOnly: false, destructive: false, idempotent: false, openWorld: true },
     useCase: "Let the in-repo agent attempt this fix for me (or: dispatch a Cursor Cloud Agent)."
@@ -812,7 +812,7 @@ var TDD_TOOL_CATALOG = [
   {
     name: "list_byok_keys",
     title: "List your API key pool",
-    description: "List the project's BYOK API keys grouped by provider (anthropic | openai | firecrawl | browserbase | cursor). Returns pooled { keys: [{ id, provider_slug, label, priority, status, cooldown_until, test_status, key_hint, base_url, last_tested_at, last_used_at }] } plus read-only { legacyKeys } metadata for credentials saved before the pooled lifecycle \u2014 never the raw secret. Read-only. Use to see which keys are validated, active, pending, legacy, or rate-limited; use add_byok_key to add one.",
+    description: "List the project's BYOK API keys grouped by provider (anthropic | openai | firecrawl | browserbase | cursor | supabase). Returns pooled { keys: [{ id, provider_slug, label, priority, status, cooldown_until, test_status, key_hint, base_url, last_tested_at, last_used_at }] } plus read-only { legacyKeys } metadata for credentials saved before the pooled lifecycle \u2014 never the raw secret. Read-only. Use to see which keys are validated, active, pending, legacy, or rate-limited; use add_byok_key to add one.",
     scope: "mcp:read",
     hints: { readOnly: true, idempotent: true, openWorld: true },
     useCase: "Which API keys are active and which are rate-limited?"
@@ -820,7 +820,7 @@ var TDD_TOOL_CATALOG = [
   {
     name: "add_byok_key",
     title: "Add an API key",
-    description: "Add and immediately validate a BYOK API key for anthropic | openai | firecrawl | browserbase | cursor. The raw key is stored encrypted in Supabase Vault and never returned; failed probes remain quarantined. Optional baseUrl is accepted only for allow-listed OpenAI-compatible HTTPS providers. Write; NOT idempotent.",
+    description: "Add and immediately validate a BYOK API key for anthropic | openai | firecrawl | browserbase | cursor | supabase (a scoped, read-only Supabase access token, checked against the linked supabase_project_ref). The raw key is stored encrypted in Supabase Vault and never returned; failed probes remain quarantined. Optional baseUrl is accepted only for allow-listed OpenAI-compatible HTTPS providers. Write; NOT idempotent.",
     scope: "mcp:write",
     hints: { readOnly: false, destructive: false, idempotent: false, openWorld: true },
     useCase: "Add a backup Anthropic key to the pool."
@@ -976,7 +976,7 @@ var TDD_TOOL_CATALOG = [
   {
     name: "run_fullstack_audit",
     title: "Run a full-stack health audit",
-    description: "Fan out a full-stack health audit for the current project: DB schema + advisors, API contract gate results (Gates 3\u20138), recent backend error logs, and RLS gap detection. Returns a PM-readable scorecard with severity-ranked findings and fix hints. Requires the project to have a Supabase PAT configured (Settings \u2192 API Keys, slug: supabase) and supabase_project_ref set in project settings for backend analysis. The audit completes synchronously in ~10 s. Triggers a background gate run for orphan_endpoint and unknown_call gates if they have not run today.",
+    description: "Fan out a full-stack health audit for the current project: DB schema + advisors, API contract gate results (Gates 3\u20138), recent backend error logs, and RLS gap detection. Returns a PM-readable scorecard with severity-ranked findings and fix hints. Backend analysis needs supabase_project_ref set (Settings \u2192 General) and a scoped, read-only Supabase access token added (Settings \u2192 AI keys, slug: supabase). The audit completes synchronously in ~10 s. Triggers a background gate run for orphan_endpoint and unknown_call gates if they have not run today.",
     scope: "mcp:write",
     hints: { readOnly: false, destructive: false, idempotent: true, openWorld: true },
     useCase: "Is this project healthy? Run a one-click full-stack audit to find API contract mismatches, unlinked backend features, schema drift, and security gaps."
@@ -1875,6 +1875,15 @@ var MUSHI_DOCS_INDEX = [
     headings: ["What it shows", "Out-of-date detection", "Setup checklist integration", "Where it lives", "Related"],
     excerpt: "The SDK health card shows the live heartbeat of every Mushi SDK that reported in the last 24 hours, so an SDK that never shipped is obvious."
   },
+  {
+    title: "SDK upgrade lockfile helper",
+    url: docUrl("/admin/sdk-upgrade-lockfile"),
+    route: "/admin/sdk-upgrade-lockfile",
+    markdown: "admin/sdk-upgrade-lockfile.md",
+    keywords: ["admin", "sdk-upgrade-lockfile", "sdk", "upgrade", "lockfile", "helper"],
+    headings: ["How it works", "Add the workflow", "What the action does", "Private registries", "Pinning", "Why Mushi does not write the lockfile or the workflow", "Limits"],
+    excerpt: "Add one workflow to your repo so Mushi's SDK upgrade PRs arrive with a refreshed lockfile and pass npm ci or pnpm install --frozen-lockfile."
+  },
   {
     title: "Settings",
     url: docUrl("/admin/settings"),
@@ -5797,6 +5806,9 @@ function createMushiServer(config) {
         ),
         inventoryActionNodeId: z.string().uuid().optional().describe(
           "Optional inventory Action node UUID for spec-traceability (\xA72.10). When provided, the fix-worker embeds the expected_outcome contract in the LLM prompt and runs validateAgainstSpec before opening the PR."
+        ),
+        targetRepoId: z.string().uuid().optional().describe(
+          "Optional linked repo id (project_repos.id) to open the fix PR against, for a project with several repos. Omit for the project's primary repo. Another project's repo id is rejected with 400 TARGET_REPO_NOT_IN_PROJECT."
         )
       }),
       outputSchema: z.object({
@@ -5827,6 +5839,7 @@ function createMushiServer(config) {
           reportId: args.reportId,
           agent: args.agent,
           inventoryActionNodeId: args.inventoryActionNodeId,
+          ...args.targetRepoId ? { targetRepoId: args.targetRepoId } : {},
           ...pid ? { projectId: pid } : {}
         })
       });
@@ -6680,7 +6693,7 @@ Be specific. No generic advice.`
       annotations: annotationsFor("add_byok_key", TDD_TOOL_CATALOG),
       inputSchema: z.object({
         projectId: z.string().describe("Project id"),
-        provider: z.enum(["anthropic", "openai", "firecrawl", "browserbase", "cursor"]).describe("Provider slug"),
+        provider: z.enum(["anthropic", "openai", "firecrawl", "browserbase", "cursor", "supabase"]).describe("Provider slug"),
         key: z.string().min(8).max(4096).describe("The API key value to add"),
         label: z.string().optional().describe("Human-readable label for this key"),
         priority: z.number().int().min(0).max(1e4).optional().describe("Priority for ordering (lower = higher priority)"),

package/dist/server.js

@@ -4,7 +4,7 @@ import {
   TDD_TOOL_CATALOG,
   TOOL_CATALOG,
   routeUseMushiIntent
-} from "./chunk-2NW2VVWV.js";
+} from "./chunk-Y757GGQH.js";
 import {
   MUSHI_SERVER_METADATA
 } from "./chunk-FJRPC4VR.js";
@@ -485,6 +485,15 @@ var MUSHI_DOCS_INDEX = [
     headings: ["What it shows", "Out-of-date detection", "Setup checklist integration", "Where it lives", "Related"],
     excerpt: "The SDK health card shows the live heartbeat of every Mushi SDK that reported in the last 24 hours, so an SDK that never shipped is obvious."
   },
+  {
+    title: "SDK upgrade lockfile helper",
+    url: docUrl("/admin/sdk-upgrade-lockfile"),
+    route: "/admin/sdk-upgrade-lockfile",
+    markdown: "admin/sdk-upgrade-lockfile.md",
+    keywords: ["admin", "sdk-upgrade-lockfile", "sdk", "upgrade", "lockfile", "helper"],
+    headings: ["How it works", "Add the workflow", "What the action does", "Private registries", "Pinning", "Why Mushi does not write the lockfile or the workflow", "Limits"],
+    excerpt: "Add one workflow to your repo so Mushi's SDK upgrade PRs arrive with a refreshed lockfile and pass npm ci or pnpm install --frozen-lockfile."
+  },
   {
     title: "Settings",
     url: docUrl("/admin/settings"),
@@ -4473,6 +4482,9 @@ function createMushiServer(config) {
         ),
         inventoryActionNodeId: z.string().uuid().optional().describe(
           "Optional inventory Action node UUID for spec-traceability (\xA72.10). When provided, the fix-worker embeds the expected_outcome contract in the LLM prompt and runs validateAgainstSpec before opening the PR."
+        ),
+        targetRepoId: z.string().uuid().optional().describe(
+          "Optional linked repo id (project_repos.id) to open the fix PR against, for a project with several repos. Omit for the project's primary repo. Another project's repo id is rejected with 400 TARGET_REPO_NOT_IN_PROJECT."
         )
       }),
       outputSchema: z.object({
@@ -4503,6 +4515,7 @@ function createMushiServer(config) {
           reportId: args.reportId,
           agent: args.agent,
           inventoryActionNodeId: args.inventoryActionNodeId,
+          ...args.targetRepoId ? { targetRepoId: args.targetRepoId } : {},
           ...pid ? { projectId: pid } : {}
         })
       });
@@ -5356,7 +5369,7 @@ Be specific. No generic advice.`
       annotations: annotationsFor("add_byok_key", TDD_TOOL_CATALOG),
       inputSchema: z.object({
         projectId: z.string().describe("Project id"),
-        provider: z.enum(["anthropic", "openai", "firecrawl", "browserbase", "cursor"]).describe("Provider slug"),
+        provider: z.enum(["anthropic", "openai", "firecrawl", "browserbase", "cursor", "supabase"]).describe("Provider slug"),
         key: z.string().min(8).max(4096).describe("The API key value to add"),
         label: z.string().optional().describe("Human-readable label for this key"),
         priority: z.number().int().min(0).max(1e4).optional().describe("Priority for ordering (lower = higher priority)"),

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mushi-mushi/mcp",
   "mcpName": "io.github.kensaurus/mushi-mushi",
-  "version": "0.24.0",
+  "version": "0.24.2",
   "license": "MIT",
   "description": "MCP server for Cursor, Claude Code and Copilot. The bug mediator for AI-built apps: plain-English diagnosis + a ready fix, in your editor.",
   "type": "module",