@mushi-mushi/svelte 1.0.1 → 1.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CONTRIBUTING.md +26 -2
- package/README.md +0 -1
- package/SECURITY.md +1 -1
- package/package.json +12 -8
package/CONTRIBUTING.md
CHANGED
|
@@ -27,12 +27,24 @@ pnpm build
|
|
|
27
27
|
|
|
28
28
|
```bash
|
|
29
29
|
pnpm dev # Start all dev servers (admin on :6464)
|
|
30
|
+
```
|
|
31
|
+
|
|
32
|
+
| Surface | URL |
|
|
33
|
+
| --- | --- |
|
|
34
|
+
| Admin console | http://localhost:6464 |
|
|
35
|
+
| Docs site | http://localhost:3000 |
|
|
36
|
+
| CLI console override | `MUSHI_CONSOLE_URL=http://localhost:6464` |
|
|
37
|
+
|
|
38
|
+
```bash
|
|
30
39
|
pnpm test # Run Vitest across all packages
|
|
31
40
|
pnpm typecheck # TypeScript checks
|
|
32
41
|
pnpm lint # ESLint
|
|
33
42
|
pnpm format # Prettier
|
|
43
|
+
pnpm smoke:cli-setup # Playwright: onboarding ?setup=cli + success panel (skips headless if unsigned)
|
|
34
44
|
```
|
|
35
45
|
|
|
46
|
+
Set `CLI_SETUP_SMOKE_STRICT=1` to fail the smoke script when Playwright is not signed in (CI gate).
|
|
47
|
+
|
|
36
48
|
Ad-hoc screenshots captured during UI reviews can live temporarily at the repo
|
|
37
49
|
root, but root-level `*.png` files are intentionally ignored. Canonical
|
|
38
50
|
screenshots that should be versioned belong under `docs/screenshots/`.
|
|
@@ -58,7 +70,7 @@ packages/
|
|
|
58
70
|
react-native/ React Native SDK (MIT)
|
|
59
71
|
cli/ CLI tool (MIT)
|
|
60
72
|
mcp/ MCP server for coding agents (MIT)
|
|
61
|
-
server/ Supabase Edge Functions (AGPLv3)
|
|
73
|
+
server/ Supabase Edge Functions (AGPLv3; ee/ is commercial)
|
|
62
74
|
agents/ Agentic fix pipeline (AGPLv3)
|
|
63
75
|
verify/ Fix verification (AGPLv3)
|
|
64
76
|
apps/
|
|
@@ -69,6 +81,18 @@ tooling/
|
|
|
69
81
|
tsconfig/ Shared TypeScript configs
|
|
70
82
|
```
|
|
71
83
|
|
|
84
|
+
## What we don't accept
|
|
85
|
+
|
|
86
|
+
Knowing this upfront saves everyone time.
|
|
87
|
+
|
|
88
|
+
- **Automated / bulk / AI-slop PRs** — any PR that was opened by a script, an LLM agent acting without meaningful human review, or as part of a parallel bounty-farming sweep is closed on sight. The commit history, branch name, or helper scripts included in the PR make this obvious.
|
|
89
|
+
- **PRs that target the wrong base** — all PRs must branch from and target `master`. PRs targeting `main` or any other branch are closed (and will show an inflated diff that is not your work).
|
|
90
|
+
- **One PR per issue, one issue per PR** — splitting or duplicating work just to collect acknowledgements isn't welcome.
|
|
91
|
+
- **Good-first-issues without claiming first** — comment on the issue to claim it before starting. If two people open PRs for the same issue, the one that commented first is prioritised.
|
|
92
|
+
- **Documentation-only PRs that merely duplicate existing content** — if the information already exists (e.g. in another file in this repo), adding a redundant copy adds noise without value.
|
|
93
|
+
|
|
94
|
+
If a PR violates these policies it will be closed with a brief explanation. No hard feelings — a genuine contribution on the same issue is always welcome.
|
|
95
|
+
|
|
72
96
|
## Making Changes
|
|
73
97
|
|
|
74
98
|
1. Create a feature branch from `master`
|
|
@@ -187,7 +211,7 @@ chore: bump dependencies
|
|
|
187
211
|
## License
|
|
188
212
|
|
|
189
213
|
- SDK packages are MIT — your contributions will be MIT-licensed
|
|
190
|
-
- Server/agents/verify are AGPLv3 — contributions to those packages fall under AGPLv3
|
|
214
|
+
- Server/agents/verify are AGPLv3 — contributions to those packages fall under AGPLv3. A [commercial license](./COMMERCIAL-LICENSE.md) is available for hosted-SaaS use cases that cannot publish modifications. The `packages/server/ee/` directory is source-available but commercial (production use needs a license); contributions there are accepted under the same EE terms.
|
|
191
215
|
|
|
192
216
|
## Questions?
|
|
193
217
|
|
package/README.md
CHANGED
|
@@ -1,7 +1,6 @@
|
|
|
1
1
|
# @mushi-mushi/svelte
|
|
2
2
|
|
|
3
3
|
> **Your AI wrote it. Mushi tells you why it broke.**
|
|
4
|
-
> Plain-English diagnosis + a paste-ready fix, right inside Cursor. MIT-licensed SDKs · self-hostable · no second LLM key.
|
|
5
4
|
|
|
6
5
|
Svelte SDK for Mushi Mushi bug reporting. **API-only** — captures errors and submits reports but does not include the widget UI. Add `@mushi-mushi/web` alongside this package for the full Shadow DOM widget experience.
|
|
7
6
|
|
package/SECURITY.md
CHANGED
|
@@ -113,7 +113,7 @@ What we treat as in-scope attacker capabilities, and what we don't.
|
|
|
113
113
|
| Compromised Supabase service-role key | ❌ | Treated as a tier-0 incident; would require key rotation and audit-log forensics. Not defendable in software. |
|
|
114
114
|
| Compromise of `kensaurus@gmail.com` | ❌ | Treated as a project-fork event; downstream consumers should pin to the last known-good version and follow the new release channel. |
|
|
115
115
|
| Physical / OS-level attacker on an end-user device | ❌ | Out of scope. |
|
|
116
|
-
| Malicious fork using the Mushi name to ship malware | ❌ (technical) ✅ (legal) | The MIT/
|
|
116
|
+
| Malicious fork using the Mushi name to ship malware | ❌ (technical) ✅ (legal) | The MIT / AGPLv3 grant lets the fork exist; the trademark policy (`TRADEMARK.md`) makes shipping it under the Mushi name an infringement we will pursue. |
|
|
117
117
|
|
|
118
118
|
## Data handling and PII
|
|
119
119
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@mushi-mushi/svelte",
|
|
3
|
-
"version": "1.0.
|
|
3
|
+
"version": "1.0.2",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"description": "Svelte SDK for Mushi Mushi — context-based init, SvelteKit error hook integration",
|
|
6
6
|
"main": "./dist/index.cjs",
|
|
@@ -10,24 +10,24 @@
|
|
|
10
10
|
"svelte": ">=4"
|
|
11
11
|
},
|
|
12
12
|
"dependencies": {
|
|
13
|
-
"@mushi-mushi/core": "^1.
|
|
14
|
-
"@mushi-mushi/web": "^1.
|
|
13
|
+
"@mushi-mushi/core": "^1.21.0",
|
|
14
|
+
"@mushi-mushi/web": "^1.21.0"
|
|
15
15
|
},
|
|
16
16
|
"devDependencies": {
|
|
17
|
-
"eslint": "^10.
|
|
18
|
-
"svelte": "^5.
|
|
17
|
+
"eslint": "^10.4.1",
|
|
18
|
+
"svelte": "^5.56.3",
|
|
19
19
|
"tsup": "^8.5.1",
|
|
20
20
|
"typescript": "^6.0.3",
|
|
21
|
-
"vitest": "^4.1.
|
|
21
|
+
"vitest": "^4.1.8",
|
|
22
22
|
"@mushi-mushi/eslint-config": "0.0.0"
|
|
23
23
|
},
|
|
24
|
-
"author": "Kenji Sakuramoto",
|
|
24
|
+
"author": "Kenji Sakuramoto (https://bsky.app/profile/mushimushi.dev)",
|
|
25
25
|
"repository": {
|
|
26
26
|
"type": "git",
|
|
27
27
|
"url": "https://github.com/kensaurus/mushi-mushi.git",
|
|
28
28
|
"directory": "packages/svelte"
|
|
29
29
|
},
|
|
30
|
-
"homepage": "https://
|
|
30
|
+
"homepage": "https://kensaur.us/mushi-mushi",
|
|
31
31
|
"bugs": {
|
|
32
32
|
"url": "https://github.com/kensaurus/mushi-mushi/issues"
|
|
33
33
|
},
|
|
@@ -80,6 +80,10 @@
|
|
|
80
80
|
"engines": {
|
|
81
81
|
"node": ">=20"
|
|
82
82
|
},
|
|
83
|
+
"funding": {
|
|
84
|
+
"type": "github",
|
|
85
|
+
"url": "https://github.com/sponsors/kensaurus"
|
|
86
|
+
},
|
|
83
87
|
"scripts": {
|
|
84
88
|
"build": "tsup",
|
|
85
89
|
"lint": "eslint src/",
|