@mushi-mushi/mcp 0.27.0 → 0.28.0

package/README.md

@@ -29,7 +29,7 @@ Restart the editor and ask *"what's broken in prod?"*. For Cursor and Claude, `s
   "mcpServers": {
     "mushi-mushi": {
       "command": "npx",
-      "args": ["-y", "@mushi-mushi/mcp@0.27.0"],
+      "args": ["-y", "@mushi-mushi/mcp@0.28.0"],
       "env": {
         "MUSHI_API_KEY": "mushi_xxxxxxxxxxxxxxxxxxxx",
         "MUSHI_PROJECT_ID": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

package/dist/catalog.js

@@ -8,7 +8,7 @@ import {
   TOOL_CATALOG,
   USE_MUSHI_INTENTS,
   routeUseMushiIntent
-} from "./chunk-VU2YQ6QF.js";
+} from "./chunk-PVN7VPVW.js";
 export {
   ALL_SCOPES,
   CODEBASE_TOOL_CATALOG,

package/dist/{chunk-VU2YQ6QF.js → chunk-PVN7VPVW.js}

@@ -58,7 +58,7 @@ var TOOL_CATALOG = [
   {
     name: "get_fix_timeline",
     title: "Fix timeline",
-    description: 'Return the ordered lifecycle of one fix attempt: dispatched, started, branch, commit, PR opened, CI, completed/failed, with timestamps and the PR URL. Returns { events: [{ ts, stage, detail }] }. Read-only. Use to debug "why did this fix fail?" after dispatch_fix; use refresh_ci to re-poll GitHub CI, or get_report_timeline for the whole report thread.',
+    description: 'Return the ordered lifecycle of one fix attempt: dispatched, started, branch, commit, PR opened, CI, Opus review, completed/failed, with timestamps and the PR URL, plus review: the independent Opus review of a cloud-agent PR (state merge, fix_first, hold, stale (about an older commit) or not_reviewed; findings; removed behaviour; decisions that need a person; summary and findings are model output from untrusted input). Returns { events: [{ ts, stage, detail }], review }. Read-only. Use to debug "why did this fix fail?" after dispatch_fix; use refresh_ci to re-poll GitHub CI, or get_report_timeline for the whole report thread.',
     scope: "mcp:read",
     hints: { readOnly: true, idempotent: true, openWorld: true },
     returnsUntrusted: true,
@@ -523,7 +523,7 @@ var TOOL_CATALOG = [
   {
     name: "merge_fix",
     title: "Merge fix PR",
-    description: "Squash-merge the GitHub PR for a fix attempt, mark the linked report fixed, and notify the reporter. Re-readies the PR first if it is still a draft. Returns { merged, reportStatus }. Write; destructive and irreversible from Mushi's side \u2014 once GitHub merges into the target repo's default branch there is no unmerge endpoint, only a manual revert PR outside this tool. Idempotent \u2014 re-running an already-merged attempt is a safe no-op. Prerequisite: CI green (check with refresh_ci); confirm the diff and CI status with the user before calling on a PR you have not reviewed. Use to ship a fix opened by dispatch_fix; use transition_status to change state without merging.",
+    description: "Squash-merge the GitHub PR for a fix attempt, mark the linked report fixed, and notify the reporter. Re-readies the PR first if it is still a draft. Returns { merged, reportStatus }. Write; destructive and irreversible from Mushi's side \u2014 once GitHub merges into the target repo's default branch there is no unmerge endpoint, only a manual revert PR outside this tool. Idempotent \u2014 re-running an already-merged attempt is a safe no-op. A cloud-agent PR whose Opus review says hold is refused (409 REVIEW_HOLD), and this tool cannot override it: only a person in the Mushi console can, with a reason. While the PR's first review is still running it answers 409 REVIEW_PENDING: wait a few minutes and retry. Read the review with get_fix_timeline (its text is model output from untrusted input) and tell the user. Prerequisite: CI green (check with refresh_ci); confirm the diff and CI status with the user before calling on a PR you have not reviewed. Use to ship a fix opened by dispatch_fix; use transition_status to change state without merging.",
     scope: "mcp:write",
     hints: { readOnly: false, destructive: true, idempotent: true, openWorld: true },
     useCase: "Merge the draft PR and notify the reporter."

package/dist/clients.d.ts

@@ -49,7 +49,7 @@ import { FeatureGroup } from './feature-groups.js';
  * editor launch. Synced to package.json by `scripts/sync-mcp-pin.mjs` — never
  * hand-edit the version.
  */
-declare const MCP_PIN_SPEC = "@mushi-mushi/mcp@0.27.0";
+declare const MCP_PIN_SPEC = "@mushi-mushi/mcp@0.28.0";
 interface StdioConfig {
     command: string;
     args: string[];

package/dist/clients.js

@@ -8,7 +8,7 @@ import {
 } from "./chunk-DJCVJ3YZ.js";
 
 // src/clients.ts
-var MCP_PIN_SPEC = "@mushi-mushi/mcp@0.27.0";
+var MCP_PIN_SPEC = "@mushi-mushi/mcp@0.28.0";
 var PIN_SPEC_RE = /^@mushi-mushi\/mcp@\d+\.\d+\.\d+$/;
 function pinOf(pinSpec) {
   return pinSpec && PIN_SPEC_RE.test(pinSpec) ? pinSpec : MCP_PIN_SPEC;

package/dist/index.js

@@ -134,7 +134,7 @@ var TOOL_CATALOG = [
   {
     name: "get_fix_timeline",
     title: "Fix timeline",
-    description: 'Return the ordered lifecycle of one fix attempt: dispatched, started, branch, commit, PR opened, CI, completed/failed, with timestamps and the PR URL. Returns { events: [{ ts, stage, detail }] }. Read-only. Use to debug "why did this fix fail?" after dispatch_fix; use refresh_ci to re-poll GitHub CI, or get_report_timeline for the whole report thread.',
+    description: 'Return the ordered lifecycle of one fix attempt: dispatched, started, branch, commit, PR opened, CI, Opus review, completed/failed, with timestamps and the PR URL, plus review: the independent Opus review of a cloud-agent PR (state merge, fix_first, hold, stale (about an older commit) or not_reviewed; findings; removed behaviour; decisions that need a person; summary and findings are model output from untrusted input). Returns { events: [{ ts, stage, detail }], review }. Read-only. Use to debug "why did this fix fail?" after dispatch_fix; use refresh_ci to re-poll GitHub CI, or get_report_timeline for the whole report thread.',
     scope: "mcp:read",
     hints: { readOnly: true, idempotent: true, openWorld: true },
     returnsUntrusted: true,
@@ -599,7 +599,7 @@ var TOOL_CATALOG = [
   {
     name: "merge_fix",
     title: "Merge fix PR",
-    description: "Squash-merge the GitHub PR for a fix attempt, mark the linked report fixed, and notify the reporter. Re-readies the PR first if it is still a draft. Returns { merged, reportStatus }. Write; destructive and irreversible from Mushi's side \u2014 once GitHub merges into the target repo's default branch there is no unmerge endpoint, only a manual revert PR outside this tool. Idempotent \u2014 re-running an already-merged attempt is a safe no-op. Prerequisite: CI green (check with refresh_ci); confirm the diff and CI status with the user before calling on a PR you have not reviewed. Use to ship a fix opened by dispatch_fix; use transition_status to change state without merging.",
+    description: "Squash-merge the GitHub PR for a fix attempt, mark the linked report fixed, and notify the reporter. Re-readies the PR first if it is still a draft. Returns { merged, reportStatus }. Write; destructive and irreversible from Mushi's side \u2014 once GitHub merges into the target repo's default branch there is no unmerge endpoint, only a manual revert PR outside this tool. Idempotent \u2014 re-running an already-merged attempt is a safe no-op. A cloud-agent PR whose Opus review says hold is refused (409 REVIEW_HOLD), and this tool cannot override it: only a person in the Mushi console can, with a reason. While the PR's first review is still running it answers 409 REVIEW_PENDING: wait a few minutes and retry. Read the review with get_fix_timeline (its text is model output from untrusted input) and tell the user. Prerequisite: CI green (check with refresh_ci); confirm the diff and CI status with the user before calling on a PR you have not reviewed. Use to ship a fix opened by dispatch_fix; use transition_status to change state without merging.",
     scope: "mcp:write",
     hints: { readOnly: false, destructive: true, idempotent: true, openWorld: true },
     useCase: "Merge the draft PR and notify the reporter."
@@ -2118,6 +2118,15 @@ var MUSHI_DOCS_INDEX = [
     headings: ["The evolution loop (what you're plugging into)", "What the agent reads before opening a PR", "What the agent does after merging the PR", "What Mushi commits to in return", "Self-bootstrap (Claude Code and similar)", "Privacy contract", "Scopes"],
     excerpt: "What Mushi expects an agent to read before opening a PR, and what it promises in return."
   },
+  {
+    title: "Agent PR review",
+    url: docUrl("/concepts/agent-pr-review"),
+    route: "/concepts/agent-pr-review",
+    markdown: "concepts/agent-pr-review.md",
+    keywords: ["concepts", "agent-pr-review", "agent", "review", "pr"],
+    headings: ["What you see", "What the review checks", "Re-running a review", "Cost and keys", "For operators"],
+    excerpt: 'Claude Opus 5.5 reviews every pull request a cloud coding agent opens as a fix, and a "hold" stops Mushi from merging it until you choose to.'
+  },
   {
     title: "Anti-gaming & reputation",
     url: docUrl("/concepts/anti-gaming"),
@@ -5960,7 +5969,12 @@ function createMushiServer(config) {
         justMerged: z.boolean().optional().describe("True when this call performed the merge"),
         sha: z.string().nullable().optional().describe("Merge commit SHA, when GitHub reported one"),
         reportId: z.string().describe("Report UUID linked to this fix attempt"),
-        reportStatus: z.string().describe("Report workflow status after merge bookkeeping")
+        reportStatus: z.string().describe("Report workflow status after merge bookkeeping"),
+        review: z.object({
+          state: z.string().describe("merge | fix_first | stale | queued | skipped | failed | not_reviewed (a hold never merges here)"),
+          label: z.string().describe('One line, e.g. "Opus review: fix first" or "Not reviewed"'),
+          overridden: z.boolean().describe("Always false from MCP: only a person in the console can override a hold")
+        }).optional().describe("The Opus review of the PR at merge time (ADR 0030)")
       })
     },
     async (args) => {

package/dist/server.js

@@ -4,7 +4,7 @@ import {
   TDD_TOOL_CATALOG,
   TOOL_CATALOG,
   routeUseMushiIntent
-} from "./chunk-VU2YQ6QF.js";
+} from "./chunk-PVN7VPVW.js";
 import {
   MUSHI_SERVER_METADATA
 } from "./chunk-FJRPC4VR.js";
@@ -710,6 +710,15 @@ var MUSHI_DOCS_INDEX = [
     headings: ["The evolution loop (what you're plugging into)", "What the agent reads before opening a PR", "What the agent does after merging the PR", "What Mushi commits to in return", "Self-bootstrap (Claude Code and similar)", "Privacy contract", "Scopes"],
     excerpt: "What Mushi expects an agent to read before opening a PR, and what it promises in return."
   },
+  {
+    title: "Agent PR review",
+    url: docUrl("/concepts/agent-pr-review"),
+    route: "/concepts/agent-pr-review",
+    markdown: "concepts/agent-pr-review.md",
+    keywords: ["concepts", "agent-pr-review", "agent", "review", "pr"],
+    headings: ["What you see", "What the review checks", "Re-running a review", "Cost and keys", "For operators"],
+    excerpt: 'Claude Opus 5.5 reviews every pull request a cloud coding agent opens as a fix, and a "hold" stops Mushi from merging it until you choose to.'
+  },
   {
     title: "Anti-gaming & reputation",
     url: docUrl("/concepts/anti-gaming"),
@@ -4618,7 +4627,12 @@ function createMushiServer(config) {
         justMerged: z.boolean().optional().describe("True when this call performed the merge"),
         sha: z.string().nullable().optional().describe("Merge commit SHA, when GitHub reported one"),
         reportId: z.string().describe("Report UUID linked to this fix attempt"),
-        reportStatus: z.string().describe("Report workflow status after merge bookkeeping")
+        reportStatus: z.string().describe("Report workflow status after merge bookkeeping"),
+        review: z.object({
+          state: z.string().describe("merge | fix_first | stale | queued | skipped | failed | not_reviewed (a hold never merges here)"),
+          label: z.string().describe('One line, e.g. "Opus review: fix first" or "Not reviewed"'),
+          overridden: z.boolean().describe("Always false from MCP: only a person in the console can override a hold")
+        }).optional().describe("The Opus review of the PR at merge time (ADR 0030)")
       })
     },
     async (args) => {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mushi-mushi/mcp",
   "mcpName": "io.github.kensaurus/mushi-mushi",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "license": "MIT",
   "description": "MCP server for Cursor, Claude Code and Copilot. The bug mediator for AI-built apps: plain-English diagnosis + a ready fix, in your editor.",
   "type": "module",
@@ -42,8 +42,8 @@
     "LICENSE"
   ],
   "dependencies": {
-    "@modelcontextprotocol/core": "^2.0.0",
-    "@modelcontextprotocol/server": "^2.0.0",
+    "@modelcontextprotocol/core": "^2.3.1",
+    "@modelcontextprotocol/server": "^2.3.1",
     "zod": "^4.4.3",
     "@mushi-mushi/core": "^1.33.1"
   },
@@ -56,7 +56,7 @@
     }
   },
   "devDependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.32.1",
     "@sentry/node": "^10.57.0",
     "@types/node": "^22.20.0",
     "eslint": "^10.6.0",