Changelog

pending (pending release)

• `createBreadcrumbBuffer(options?)` — — 50-entry ring buffer of `{ timestamp, category, level, message, data? }`. Long messages truncate at 500 chars *at insert time* so a runaway log line can't push useful crumbs out of the buffer. PII scrubbing runs at report-snapshot time (not at insert) so in-app debugging stays unredacted while the wire payload stays clean.
• `normaliseThrown(thrown)` — — turns any thrown value (`Error`, string, plain object, `null`, frozen `DOMException`) into `{ name, message, stack?, cause? }` with an 8 KB stack cap and cyclic-cause guards. Powers `Mushi.captureException()`; exposed so adapters (Vue / Svelte / Angular / RN) can ship their own thin wrappers without re-implementing the normalisation.
• `captureEnvironment()` expansion — — same one-call API, richer payload: viewport + screen + DPR, **User-Agent Client Hints** when supported (`brands`, `mobile`, `platform`, `model`, plus the high-entropy values resolved out-of-band and folded back in on the next capture), accessibility prefs (`prefers-reduced-motion`, `prefers-color-scheme`, `prefers-contrast`), online / displayMode / page title, and a one-shot **page-load timing** read from `PerformanceNavigationTiming` (TTFB, DOMContentLoaded, FCP, LCP). Every individual field stays optional so a Safari / Firefox / iOS WebView still produces a useful payload.
• W3C `traceparent` end-to-end. — `MushiNodeClient.captureReport()` and the `express` / `fastify` / `hono` middlewares now extract the inbound `traceparent` header (or `payload.metadata.traceparent`) and forward it through Mushi → classify → fix dispatch → adapter calls. Your customer APM (Sentry, Datadog, Honeycomb, Tempo, Jaeger) shows one unbroken trace from "user clicks report" through "PR opens" without any host-app glue.
• `createOtelSpanProcessor()` upgraded. — New optional `OtelSpanProcessorOptions` — set `errorsOnly: false` to forward all sampled spans, or set `otlpEndpoint` / `otlpHeaders` to fan out to your own OTLP/HTTP+JSON collector (BYOK; defaults read `OTEL_EXPORTER_OTLP_ENDPOINT` / `OTEL_EXPORTER_OTLP_HEADERS`).
• `inventory://current` — resource — exposes the latest inventory snapshot to MCP clients with live `notifications/resources/updated` events when a new `inventory.yaml` is ingested. No more polling; LangGraph / OpenAI Agents / Claude Desktop see the new spec the moment it lands.
• `project://integration-health` — resource — last-known status for every BYOK channel (Jira, Linear, GitHub, PagerDuty, Slack, Datadog, Sentry, Honeycomb, Crashlytics, Bugsnag, Rollbar, MS Teams, Discord, Opsgenie, CloudWatch, Firebase Analytics, Grafana Loki, New Relic, Bugsnag) so an orchestrator can pre-flight before dispatching a fix.
• `dispatch_fix` accepts `inventoryActionNodeId` — — optional spec-traceability anchor (whitepaper §2.10). The fix-worker skips the graph walk and includes the Action's `expected_outcome` contract verbatim in the LLM prompt.
• `dispatch_fix` accepts `idempotencyKey` — — surfaces the new server-side `Idempotency-Key` header so a retried tool call can never double-dispatch.
• [Standard Webhooks](https://www.standardwebhooks.com/) signature verification. — Mushi now emits both legacy `X-Mushi-Signature` AND the standard `webhook-id` / `webhook-timestamp` / `webhook-signature` headers. Plugins built with `createPluginHandler` automatically prefer the standard headers when present and fall back to legacy. Receivers using competing tooling (Hookdeck, Inngest, Convoy, Defang) verify Mushi events without custom code.
• OAuth 2.0 Dynamic Client Registration — (`POST /v1/admin/auth/register`, [RFC 7591](https://www.rfc-editor.org/rfc/rfc7591)) — orchestrators self-onboard with an initial-access API key and receive `client_id` / `client_secret`. Audit-logged + cross-tenant safe (caller can only register clients in projects they own/admin).
• Idempotency-Key middleware — on `POST /v1/admin/fixes/dispatch` and `POST /v1/a2a/tasks` — RFC-style replay-on-retry, scoped by authenticated `user_id` (not body-supplied projectId) so a logged-in user cannot pollute another user's key namespace. JSON 2xx/4xx responses cached for 24h; 5xx and SSE responses always re-execute.
• `.well-known/agent-card` — discovery doc bumped to `schemaVersion: 1.0`, advertises the new tracing / webhooks / idempotency / dynamic-registration / `Last-Event-Id` capabilities.
• `GET /v1/admin/integrations/health` — — live integration health probe summary (status, latency, last-checked, source).
• `GET /v1/admin/inventory/:projectId/agents.md` — — auto-generated Markdown manifest of every Action node + open report for human/LLM consumption (also `?format=json`).
• `Last-Event-Id` resume — on `/v1/admin/fixes/dispatch/:id/stream` and `/v1/a2a/tasks/:id:subscribe` — clients reconnect after a network blip and replay missed `fix_events` without losing the trace.
• 42 missing FK indexes added — , 8 RLS policies rewritten with `(SELECT auth.uid())` initplan pattern, `citext` extension moved out of `public` (Supabase advisor cleanup wave).

• Launcher README — adds a Socket.dev badge and a new "Supply-chain &
• CLI — bumped `@clack/prompts` from `^0.11.0` to `^1.2.0`. v1 widened
• npm keyword arrays expanded across all 14 publishable packages. — Added
• README star CTA footer. — Added the bilingual _"もしMushi-chanのお役に立てたら、
• New `docs/marketing/` folder — with the full growth kit: `VOICE.md`,

• Launcher README — adds a Socket.dev badge and a new "Supply-chain &
• CLI — bumped `@clack/prompts` from `^0.11.0` to `^1.2.0`. v1 widened
• npm keyword arrays expanded across all 14 publishable packages. — Added
• README star CTA footer. — Added the bilingual _"もしMushi-chanのお役に立てたら、
• New `docs/marketing/` folder — with the full growth kit: `VOICE.md`,
• Community files in-tarball. — Snyk and Socket only credit community signals when the files are shipped inside the npm tarball, not when they live at the monorepo root. A pre-commit guard (`scripts/sync-community-files.mjs --check`) and the `pnpm release` script now auto-sync from the canonical root copies to prevent drift.
• `publishConfig.provenance: true` everywhere. — The Release workflow already set `NPM_CONFIG_PROVENANCE=true` at the job level, but per-package `publishConfig` is the explicit signal Socket reads for its Supply Chain score. `@mushi-mushi/cli`, `create-mushi-mushi`, and `mushi-mushi` already had it; the remaining 20 publishable packages now match.
• `.github/FUNDING.yml` — points at GitHub Sponsors so the repo exposes a funding signal to scanners and the GitHub UI.
• npm keyword arrays expanded across all 14 publishable packages. — Added
• README star CTA footer. — Added the bilingual _"もしMushi-chanのお役に立てたら、
• New `docs/marketing/` folder — with the full growth kit: `VOICE.md`,
• Community files in-tarball. — Snyk and Socket only credit community signals when the files are shipped inside the npm tarball, not when they live at the monorepo root. A pre-commit guard (`scripts/sync-community-files.mjs --check`) and the `pnpm release` script now auto-sync from the canonical root copies to prevent drift.

• npm keyword arrays expanded across all 14 publishable packages. — Added
• README star CTA footer. — Added the bilingual _"もしMushi-chanのお役に立てたら、
• New `docs/marketing/` folder — with the full growth kit: `VOICE.md`,
• `@mushi-mushi/cli` `0.3.0` — New `mushi init` command — interactive wizard built on `@clack/prompts` that auto-detects framework (Next, Nuxt, SvelteKit, Angular, Expo, Capacitor, plain React/Vue/Svelte, vanilla), package manager (npm/pnpm/yarn/bun), installs the right SDK, writes env vars with the right prefix (`NEXT_PUBLIC_`, `NUXT_PUBLIC_`, `VITE_`), warns when `.env.local` isn't gitignored, and prints the framework-specific snippet. Idempotent: never overwrites existing `MUSHI_*` env vars. Exposes new `./init` and `./detect` subpath exports for downstream packages.
• `mushi-mushi` `0.3.0` (NEW, unscoped) — One-command launcher — `npx mushi-mushi` runs the wizard. Gives the SDK a single brand entry point on npm so users don't have to know to look under `@mushi-mushi/*` first.
• `create-mushi-mushi` `0.3.0` (NEW) — `npm create mushi-mushi` — same wizard via the standard npm-create convention.
• All 16 published packages — keyword sweep — every package now ships `mushi-mushi` plus its framework-specific terms (`react`, `next.js`, `vue`, `nuxt`, `svelte`, `sveltekit`, `angular`, `react-native`, `expo`, `capacitor`, `ionic`, etc.) plus product terms (`session-replay`, `screenshot`, `shake-to-report`, `sentry-companion`, `error-tracking`, `ai-triage`) for npm search ranking.
• All SDK READMEs — discoverability cross-link header at the top — points users to the wizard and to every other framework SDK so people who land on `@mushi-mushi/react` can find `@mushi-mushi/vue` and vice-versa.
• Root README — quick-start now leads with `npx mushi-mushi`, with the manual install path documented as the fallback. Packages table gains a row for the launcher.
• npm keyword arrays expanded across all 14 publishable packages. — Added
• README star CTA footer. — Added the bilingual _"もしMushi-chanのお役に立てたら、
• New `docs/marketing/` folder — with the full growth kit: `VOICE.md`,

• npm keyword arrays expanded across all 14 publishable packages. — Added
• README star CTA footer. — Added the bilingual _"もしMushi-chanのお役に立てたら、
• New `docs/marketing/` folder — with the full growth kit: `VOICE.md`,
• Community files in-tarball. — Snyk and Socket only credit community signals when the files are shipped inside the npm tarball, not when they live at the monorepo root. A pre-commit guard (`scripts/sync-community-files.mjs --check`) and the `pnpm release` script now auto-sync from the canonical root copies to prevent drift.
• `publishConfig.provenance: true` everywhere. — The Release workflow already set `NPM_CONFIG_PROVENANCE=true` at the job level, but per-package `publishConfig` is the explicit signal Socket reads for its Supply Chain score. `@mushi-mushi/cli`, `create-mushi-mushi`, and `mushi-mushi` already had it; the remaining 20 publishable packages now match.
• `.github/FUNDING.yml` — points at GitHub Sponsors so the repo exposes a funding signal to scanners and the GitHub UI.
• `@mushi-mushi/cli` `0.3.0` — New `mushi init` command — interactive wizard built on `@clack/prompts` that auto-detects framework (Next, Nuxt, SvelteKit, Angular, Expo, Capacitor, plain React/Vue/Svelte, vanilla), package manager (npm/pnpm/yarn/bun), installs the right SDK, writes env vars with the right prefix (`NEXT_PUBLIC_`, `NUXT_PUBLIC_`, `VITE_`), warns when `.env.local` isn't gitignored, and prints the framework-specific snippet. Idempotent: never overwrites existing `MUSHI_*` env vars. Exposes new `./init` and `./detect` subpath exports for downstream packages.
• `mushi-mushi` `0.3.0` (NEW, unscoped) — One-command launcher — `npx mushi-mushi` runs the wizard. Gives the SDK a single brand entry point on npm so users don't have to know to look under `@mushi-mushi/*` first.
• `create-mushi-mushi` `0.3.0` (NEW) — `npm create mushi-mushi` — same wizard via the standard npm-create convention.
• All 16 published packages — keyword sweep — every package now ships `mushi-mushi` plus its framework-specific terms (`react`, `next.js`, `vue`, `nuxt`, `svelte`, `sveltekit`, `angular`, `react-native`, `expo`, `capacitor`, `ionic`, etc.) plus product terms (`session-replay`, `screenshot`, `shake-to-report`, `sentry-companion`, `error-tracking`, `ai-triage`) for npm search ranking.
• All SDK READMEs — discoverability cross-link header at the top — points users to the wizard and to every other framework SDK so people who land on `@mushi-mushi/react` can find `@mushi-mushi/vue` and vice-versa.
• Root README — quick-start now leads with `npx mushi-mushi`, with the manual install path documented as the fallback. Packages table gains a row for the launcher.

• npm keyword arrays expanded across all 14 publishable packages. — Added
• README star CTA footer. — Added the bilingual _"もしMushi-chanのお役に立てたら、
• New `docs/marketing/` folder — with the full growth kit: `VOICE.md`,
• Community files in-tarball. — Snyk and Socket only credit community signals when the files are shipped inside the npm tarball, not when they live at the monorepo root. A pre-commit guard (`scripts/sync-community-files.mjs --check`) and the `pnpm release` script now auto-sync from the canonical root copies to prevent drift.
• `publishConfig.provenance: true` everywhere. — The Release workflow already set `NPM_CONFIG_PROVENANCE=true` at the job level, but per-package `publishConfig` is the explicit signal Socket reads for its Supply Chain score. `@mushi-mushi/cli`, `create-mushi-mushi`, and `mushi-mushi` already had it; the remaining 20 publishable packages now match.
• `.github/FUNDING.yml` — points at GitHub Sponsors so the repo exposes a funding signal to scanners and the GitHub UI.
• Community files in-tarball. — Snyk and Socket only credit community signals when the files are shipped inside the npm tarball, not when they live at the monorepo root. A pre-commit guard (`scripts/sync-community-files.mjs --check`) and the `pnpm release` script now auto-sync from the canonical root copies to prevent drift.
• `publishConfig.provenance: true` everywhere. — The Release workflow already set `NPM_CONFIG_PROVENANCE=true` at the job level, but per-package `publishConfig` is the explicit signal Socket reads for its Supply Chain score. `@mushi-mushi/cli`, `create-mushi-mushi`, and `mushi-mushi` already had it; the remaining 20 publishable packages now match.
• `.github/FUNDING.yml` — points at GitHub Sponsors so the repo exposes a funding signal to scanners and the GitHub UI.
• `@mushi-mushi/cli` `0.3.0` — New `mushi init` command — interactive wizard built on `@clack/prompts` that auto-detects framework (Next, Nuxt, SvelteKit, Angular, Expo, Capacitor, plain React/Vue/Svelte, vanilla), package manager (npm/pnpm/yarn/bun), installs the right SDK, writes env vars with the right prefix (`NEXT_PUBLIC_`, `NUXT_PUBLIC_`, `VITE_`), warns when `.env.local` isn't gitignored, and prints the framework-specific snippet. Idempotent: never overwrites existing `MUSHI_*` env vars. Exposes new `./init` and `./detect` subpath exports for downstream packages.
• `mushi-mushi` `0.3.0` (NEW, unscoped) — One-command launcher — `npx mushi-mushi` runs the wizard. Gives the SDK a single brand entry point on npm so users don't have to know to look under `@mushi-mushi/*` first.
• `create-mushi-mushi` `0.3.0` (NEW) — `npm create mushi-mushi` — same wizard via the standard npm-create convention.