create-mushi-mushi 0.5.15 → 0.5.17

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CONTRIBUTING.md CHANGED
@@ -27,12 +27,24 @@ pnpm build
27
27
 
28
28
  ```bash
29
29
  pnpm dev # Start all dev servers (admin on :6464)
30
+ ```
31
+
32
+ | Surface | URL |
33
+ | --- | --- |
34
+ | Admin console | http://localhost:6464 |
35
+ | Docs site | http://localhost:3000 |
36
+ | CLI console override | `MUSHI_CONSOLE_URL=http://localhost:6464` |
37
+
38
+ ```bash
30
39
  pnpm test # Run Vitest across all packages
31
40
  pnpm typecheck # TypeScript checks
32
41
  pnpm lint # ESLint
33
42
  pnpm format # Prettier
43
+ pnpm smoke:cli-setup # Playwright: onboarding ?setup=cli + success panel (skips headless if unsigned)
34
44
  ```
35
45
 
46
+ Set `CLI_SETUP_SMOKE_STRICT=1` to fail the smoke script when Playwright is not signed in (CI gate).
47
+
36
48
  Ad-hoc screenshots captured during UI reviews can live temporarily at the repo
37
49
  root, but root-level `*.png` files are intentionally ignored. Canonical
38
50
  screenshots that should be versioned belong under `docs/screenshots/`.
@@ -58,9 +70,9 @@ packages/
58
70
  react-native/ React Native SDK (MIT)
59
71
  cli/ CLI tool (MIT)
60
72
  mcp/ MCP server for coding agents (MIT)
61
- server/ Supabase Edge Functions (BSL)
62
- agents/ Agentic fix pipeline (BSL)
63
- verify/ Fix verification (BSL)
73
+ server/ Supabase Edge Functions (AGPLv3)
74
+ agents/ Agentic fix pipeline (AGPLv3)
75
+ verify/ Fix verification (AGPLv3)
64
76
  apps/
65
77
  admin/ Admin dashboard (React + Tailwind)
66
78
  docs/ Documentation site (Nextra — apps/docs)
@@ -97,8 +109,10 @@ Guardrails (run locally before pushing):
97
109
  pnpm check:docs-stats # root README stat badges
98
110
  pnpm check:sdk-version-matrix # apps/docs/content/sdks/index.mdx versions
99
111
  pnpm check:internal-doc-links # dead /foo links in MDX
112
+ pnpm check:onboarding-drift # phantom MCP env vars / stale tool names
100
113
  pnpm check:bundle-docs # @mushi-mushi/web size-limit vs README
101
114
  pnpm gen:llms-txt # regenerate apps/docs/public/llms.txt after nav changes
115
+ pnpm gen:mcp-tools-doc # regenerate sdks/mcp-tools.generated.mdx from catalog.ts
102
116
  ```
103
117
 
104
118
  README changes on npm packages only appear on [npmjs.com](https://www.npmjs.com) after the next **Changesets publish**.
@@ -115,13 +129,30 @@ Select the affected packages, the semver bump type, and write a summary. The cha
115
129
 
116
130
  ## Release flow
117
131
 
118
- Releases are fully automated. Maintainers don't run `npm publish` by hand.
132
+ Releases are fully automated once the version PR is merged. Maintainers don't run
133
+ `npm publish` by hand for routine bumps. See **[`docs/DEPLOYMENT.md`](docs/DEPLOYMENT.md)**
134
+ for the full production runbook (edge functions, admin SPA, docs site, migrations).
119
135
 
120
136
  1. PRs land on `master` with one or more changeset files in `.changeset/`.
121
- 2. `release.yml` runs on every push to `master`. It opens (or updates) a `chore: version packages` PR that bumps every affected `package.json`, rolls up the changelogs, and deletes the consumed changesets.
122
- 3. Merging that "Version Packages" PR re-fires `release.yml`. The publish step authenticates to npm via **OpenID Connect (OIDC) Trusted Publishers** — no long-lived `NPM_TOKEN` is exchanged — and every tarball ships with a **Sigstore provenance attestation** uploaded to the public transparency log.
137
+ Orphaned changesets (only ignored packages) fail `pnpm check:changeset-orphans`.
138
+ 2. `release.yml` runs on every push to `master`. It opens (or updates) a
139
+ **`chore: version packages`** PR on `changeset-release/master` that bumps
140
+ affected `package.json` files, rolls up changelogs, and deletes consumed
141
+ changesets.
142
+ 3. **Wait for CI on the version PR.** If checks don't appear (bot-branch
143
+ suppression), push an empty commit to `changeset-release/master`. If
144
+ `check:sdk-version-matrix` fails, run `pnpm gen:sdk-version-matrix` on that
145
+ branch and commit `apps/docs/content/sdks/index.mdx`.
146
+ 4. Merge the version PR. The publish step uses **OIDC Trusted Publishers** +
147
+ Sigstore provenance (with `NPM_TOKEN` only for brand-new package bootstrap).
148
+ 5. **Manually dispatch Release** unless a run starts within ~2 minutes:
149
+ **Actions → Release → Run workflow → `master`**. Squash-merges attributed to
150
+ `github-actions[bot]` usually suppress the auto `push` trigger — manual
151
+ dispatch is the normal path, not a fallback of last resort.
123
152
 
124
- If GitHub's anti-loop protection suppresses the auto re-fire (the squash merge can be attributed to `github-actions[bot]`), trigger the workflow manually: **Actions → release → Run workflow → master**.
153
+ ```bash
154
+ gh workflow run release.yml --ref master
155
+ ```
125
156
 
126
157
  ### Adding a brand-new publishable package
127
158
 
@@ -168,7 +199,7 @@ chore: bump dependencies
168
199
  ## License
169
200
 
170
201
  - SDK packages are MIT — your contributions will be MIT-licensed
171
- - Server/agents/verify are BSL 1.1 — contributions to those packages fall under BSL
202
+ - Server/agents/verify are AGPLv3 — contributions to those packages fall under AGPLv3
172
203
 
173
204
  ## Questions?
174
205
 
package/README.md CHANGED
@@ -55,7 +55,7 @@ npx @mushi-mushi/cli init # scoped name
55
55
  ## Security
56
56
 
57
57
  - Credentials accepted via `--api-key` flag leak into `ps -ef`. Prefer the interactive prompt on dev machines; on CI, pass them via the environment and an explicit `--api-key "$MUSHI_API_KEY"` at the boundary.
58
- - The `~/.mushirc` credentials cache is written with mode `0o600` (owner read/write only) on Unix.
58
+ - The `~/.config/mushi/config.json` credentials cache is written with mode `0o600` (owner read/write only) on Unix. Legacy `~/.mushirc` auto-migrates on first load.
59
59
  - All env-file writes strip CR/LF/NUL from secrets to prevent accidental `.env` injection.
60
60
 
61
61
  ## Links
package/dist/index.js CHANGED
@@ -3,7 +3,7 @@
3
3
  // src/index.ts
4
4
  import { runInit } from "@mushi-mushi/cli/init";
5
5
  import { FRAMEWORK_IDS, isFrameworkId } from "@mushi-mushi/cli/detect";
6
- var VERSION = true ? "0.5.15" : "0.0.0-dev";
6
+ var VERSION = true ? "0.5.17" : "0.0.0-dev";
7
7
  var MIN_NODE_MAJOR = 18;
8
8
  var ISSUES_URL = "https://github.com/kensaurus/mushi-mushi/issues";
9
9
  var HELP = `create-mushi-mushi \u2014 add Mushi Mushi to your existing project
package/package.json CHANGED
@@ -1,20 +1,20 @@
1
1
  {
2
2
  "name": "create-mushi-mushi",
3
- "version": "0.5.15",
3
+ "version": "0.5.17",
4
4
  "license": "MIT",
5
5
  "description": "Run `npm create mushi-mushi` to add the Mushi Mushi bug-reporting SDK to your existing project — the wizard auto-detects your framework (React, Vue, Svelte, Angular, React Native, Expo, Capacitor) and installs the right package.",
6
6
  "bin": {
7
7
  "create-mushi-mushi": "./dist/index.js"
8
8
  },
9
9
  "dependencies": {
10
- "@mushi-mushi/cli": "^0.18.0"
10
+ "@mushi-mushi/cli": "^0.20.0"
11
11
  },
12
12
  "devDependencies": {
13
- "@types/node": "^22.19.17",
14
- "eslint": "^10.3.0",
13
+ "@types/node": "^22.19.21",
14
+ "eslint": "^10.4.1",
15
15
  "tsup": "^8.5.1",
16
16
  "typescript": "^6.0.3",
17
- "vitest": "^4.1.5",
17
+ "vitest": "^4.1.8",
18
18
  "@mushi-mushi/eslint-config": "0.0.0"
19
19
  },
20
20
  "author": "Kenji Sakuramoto",