@4da/mcp-server 4.6.1 → 4.6.3

package/dist/tools/upgrade-planner.js

@@ -2,13 +2,27 @@
 /**
  * upgrade_planner tool
  *
- * Ranked upgrade recommendations for project dependencies.
+ * Ranked standalone upgrade recommendations for project dependencies.
  * Combines version freshness, vulnerability data, and deprecation status
  * to produce a prioritized upgrade plan.
+ *
+ * Honesty contract (Phase 0 hardening):
+ * - Transitive CVEs are surfaced as `waiting_on_upstream` steps instead of
+ *   being counted-but-never-recommended. No dependency-graph parsing happens
+ *   here — parent mapping is the desktop core's job; the honest label is ours.
+ * - Output carries explicit heuristic provenance: this is a point-in-time
+ *   standalone plan, not the 4DA app's cross-project, version-confirmed plan.
+ * - `projectPath` reports the directory set the dependencies were actually
+ *   resolved from, not whatever `process.cwd()` happens to be.
+ * - When no vulnerability scan has run, the plan says so instead of silently
+ *   producing a CVE-blind ranking.
  */
+import { maxSemver } from "../live/semver-utils.js";
+const PROVENANCE_NOTE = "Point-in-time heuristic from local lockfiles plus live registry/OSV lookups. " +
+    "Not the 4DA desktop app's cross-project, version-confirmed plan.";
 export const upgradePlannerTool = {
     name: "upgrade_planner",
-    description: "Ranked upgrade recommendations for dependencies. Prioritizes by vulnerability severity, deprecation, and version distance. Shows quick wins (patch/minor) vs breaking changes (major).",
+    description: "Ranked standalone upgrade recommendations for dependencies — call before upgrading, adding, or auditing any dependency to pick the safest order. Prioritizes by vulnerability severity (direct AND transitive), deprecation, and version distance. Splits quick wins (patch/minor) from breaking changes (major) and from transitive CVEs waiting on upstream. Run vulnerability_scan first for a CVE-aware plan. Privacy: live mode may query public registries and OSV with package names and versions; it never sends source code.",
     inputSchema: {
         type: "object",
         properties: {
@@ -28,6 +42,14 @@ export const upgradePlannerTool = {
         },
     },
 };
+const RISK_LEVELS = { low: 0, medium: 1, high: 2, critical: 3 };
+function severityToRisk(severities) {
+    if (severities.includes("critical"))
+        return "critical";
+    if (severities.includes("high"))
+        return "high";
+    return "medium";
+}
 export async function executeUpgradePlanner(_db, params, liveIntel) {
     if (!liveIntel || !liveIntel.isInitialized()) {
         return {
@@ -38,16 +60,20 @@ export async function executeUpgradePlanner(_db, params, liveIntel) {
             summary: "No project detected. Run from a directory with package.json, Cargo.toml, pyproject.toml, or go.mod.",
             quickWins: 0,
             breakingChanges: 0,
+            waitingOnUpstream: 0,
+            vulnerabilityDataAvailable: false,
+            provenance: { mode: "standalone_heuristic", note: PROVENANCE_NOTE },
         };
     }
     const includeDev = params.include_dev ?? false;
     let deps = liveIntel.getResolvedDeps();
     if (!includeDev)
         deps = deps.filter((d) => !d.isDev);
-    // Fetch registry data
+    // Fetch registry data (live lookups for direct deps; cached where fresh)
     const registryData = await liveIntel.fetchRegistryHealth(deps);
-    // Get vulnerability data
+    // Vulnerability data from the last scan this session (no network here).
     const vulnResult = liveIntel.getVulnerabilities();
+    const vulnerabilityDataAvailable = vulnResult !== null;
     const vulnsByPackage = new Map();
     if (vulnResult) {
         for (const v of vulnResult.vulnerabilities) {
@@ -58,31 +84,32 @@ export async function executeUpgradePlanner(_db, params, liveIntel) {
                 vulnId: v.vulnId,
                 summary: v.summary,
                 fixedVersion: v.fixedVersion,
+                platformActive: v.platformActive,
             });
         }
     }
-    // Build recommendations
+    // Build recommendations — direct deps (registry-informed)
     const recommendations = [];
+    const directPackages = new Set();
     for (const dep of registryData) {
+        directPackages.add(`${dep.ecosystem}\0${dep.name}`);
         const reasons = [];
         let risk = "low";
         let targetVersion = dep.latestStableVersion || dep.latestVersion;
+        let platformActive = true;
         // Check vulnerabilities
         const vulns = vulnsByPackage.get(dep.name);
         if (vulns && vulns.length > 0) {
-            const hasCritical = vulns.some((v) => v.severity === "critical");
-            const hasHigh = vulns.some((v) => v.severity === "high");
-            if (hasCritical)
-                risk = "critical";
-            else if (hasHigh)
-                risk = "high";
-            else
-                risk = "medium";
+            risk = severityToRisk(vulns.map((v) => v.severity));
             reasons.push(`${vulns.length} known CVE${vulns.length !== 1 ? "s" : ""} (${vulns.map((v) => v.vulnId).join(", ")})`);
+            if (vulns.every((v) => !v.platformActive)) {
+                platformActive = false;
+                reasons.push("Affected code is gated behind a target not active on this platform");
+            }
             // Use fixed version as target if available
-            const fixedVersions = vulns.map((v) => v.fixedVersion).filter(Boolean);
+            const fixedVersions = vulns.map((v) => v.fixedVersion).filter((f) => Boolean(f));
             if (fixedVersions.length > 0 && !targetVersion) {
-                targetVersion = fixedVersions[0];
+                targetVersion = maxSemver(fixedVersions);
             }
         }
         // Check deprecation
@@ -106,11 +133,9 @@ export async function executeUpgradePlanner(_db, params, liveIntel) {
                 reasons.push(`${d.patch} patch${d.patch !== 1 ? "es" : ""} behind`);
             }
         }
-        // Skip if no upgrade needed
+        // Skip if no upgrade needed (no vuln, not deprecated, not behind => no reasons)
         if (reasons.length === 0)
             continue;
-        if (dep.versionsBehind?.label === "up-to-date" && !dep.deprecated && !vulns)
-            continue;
         const label = dep.versionsBehind?.label;
         const upgradeType = !label || label === "up-to-date" ? "patch" : label;
         recommendations.push({
@@ -123,45 +148,101 @@ export async function executeUpgradePlanner(_db, params, liveIntel) {
             reasons,
             breaking: dep.versionsBehind?.label === "major",
             isDev: dep.isDev,
+            scope: "direct",
+            action: "upgrade_direct",
+            platformActive,
         });
     }
+    // Transitive vulnerable packages — previously counted in scan totals but
+    // never recommended. Surfaced as waiting_on_upstream with honest labels.
+    if (vulnResult) {
+        const transitive = new Map();
+        for (const v of vulnResult.vulnerabilities) {
+            if (v.isDirect)
+                continue;
+            if (directPackages.has(`${v.ecosystem}\0${v.package}`))
+                continue;
+            if (!includeDev && v.isDev && v.devScopeKnown)
+                continue;
+            const key = `${v.ecosystem}\0${v.package}`;
+            if (!transitive.has(key))
+                transitive.set(key, []);
+            transitive.get(key).push(v);
+        }
+        for (const entries of transitive.values()) {
+            const first = entries[0];
+            const fixedVersions = entries.map((e) => e.fixedVersion).filter((f) => Boolean(f));
+            const platformActive = !entries.every((e) => !e.platformActive);
+            const reasons = [
+                `${entries.length} known CVE${entries.length !== 1 ? "s" : ""} (${entries.map((e) => e.vulnId).join(", ")})`,
+                "Transitive dependency — not declared in your manifest; the fix arrives via a parent package update or a lockfile refresh",
+            ];
+            if (!platformActive) {
+                reasons.push("Affected code is gated behind a target not active on this platform");
+            }
+            recommendations.push({
+                package: first.package,
+                ecosystem: first.ecosystem,
+                currentVersion: first.currentVersion,
+                targetVersion: fixedVersions.length > 0 ? maxSemver(fixedVersions) : null,
+                upgradeType: "unknown",
+                risk: severityToRisk(entries.map((e) => e.severity)),
+                reasons,
+                breaking: false,
+                isDev: entries.every((e) => e.isDev),
+                scope: "transitive",
+                action: "waiting_on_upstream",
+                platformActive,
+            });
+        }
+    }
     // Filter by risk threshold
-    const riskLevels = { low: 0, medium: 1, high: 2, critical: 3 };
     const threshold = params.risk_threshold ?? "all";
     const filtered = threshold === "all"
         ? recommendations
-        : recommendations.filter((r) => riskLevels[r.risk] >= riskLevels[threshold]);
-    // Sort: critical > high > medium > low, then by breaking (non-breaking first for quick wins)
+        : recommendations.filter((r) => RISK_LEVELS[r.risk] >= RISK_LEVELS[threshold]);
+    // Sort: critical > high > medium > low, then fixable-now (direct) before
+    // waiting-on-upstream (transitive), then non-breaking first (quick wins).
     filtered.sort((a, b) => {
-        const riskDiff = riskLevels[b.risk] - riskLevels[a.risk];
+        const riskDiff = RISK_LEVELS[b.risk] - RISK_LEVELS[a.risk];
         if (riskDiff !== 0)
             return riskDiff;
+        if (a.scope !== b.scope)
+            return a.scope === "direct" ? -1 : 1;
         if (a.breaking !== b.breaking)
             return a.breaking ? 1 : -1;
         return 0;
     });
     const maxRecs = params.max_recommendations ?? 20;
     const limited = filtered.slice(0, maxRecs);
-    const quickWins = limited.filter((r) => !r.breaking).length;
-    const breakingChanges = limited.filter((r) => r.breaking).length;
+    const direct = limited.filter((r) => r.scope === "direct");
+    const quickWins = direct.filter((r) => !r.breaking).length;
+    const breakingChanges = direct.filter((r) => r.breaking).length;
+    const waitingOnUpstream = limited.filter((r) => r.scope === "transitive").length;
     // Summary
     const parts = [];
-    parts.push(`${limited.length} upgrade${limited.length !== 1 ? "s" : ""} recommended`);
-    if (quickWins > 0)
-        parts.push(`${quickWins} quick win${quickWins !== 1 ? "s" : ""} (patch/minor)`);
-    if (breakingChanges > 0)
-        parts.push(`${breakingChanges} breaking change${breakingChanges !== 1 ? "s" : ""} (major)`);
+    parts.push(`${limited.length} recommendation${limited.length !== 1 ? "s" : ""}`);
+    if (direct.length > 0)
+        parts.push(`${direct.length} fixable directly (${quickWins} quick win${quickWins !== 1 ? "s" : ""}, ${breakingChanges} breaking)`);
+    if (waitingOnUpstream > 0)
+        parts.push(`${waitingOnUpstream} transitive, waiting on upstream`);
     const criticalCount = limited.filter((r) => r.risk === "critical").length;
     if (criticalCount > 0)
         parts.push(`${criticalCount} critical`);
+    if (!vulnerabilityDataAvailable) {
+        parts.push("CVE data not loaded — run vulnerability_scan first for a security-aware plan");
+    }
     return {
         generatedAt: new Date().toISOString(),
-        projectPath: process.cwd(),
+        projectPath: liveIntel.getProjectRoot() ?? vulnResult?.projectPath ?? process.cwd(),
         totalDeps: deps.length,
         recommendations: limited,
         summary: parts.join(". ") + ".",
         quickWins,
         breakingChanges,
+        waitingOnUpstream,
+        vulnerabilityDataAvailable,
+        provenance: { mode: "standalone_heuristic", note: PROVENANCE_NOTE },
     };
 }
 //# sourceMappingURL=upgrade-planner.js.map

package/dist/tools/vulnerability-scan.d.ts

@@ -42,9 +42,11 @@ export declare const vulnerabilityScanTool: {
 export declare function executeVulnerabilityScan(db: FourDADatabase, params: VulnerabilityScanParams, liveIntelligence: LiveIntelligence | null): Promise<{
     scan_time: string;
     project: string;
+    host_platform: string;
     ecosystems_scanned: string[];
     total_dependencies_scanned: number;
     total_vulnerable_packages: number;
+    platform_inactive_packages: number;
     by_severity: {
         critical: number;
         high: number;
@@ -59,6 +61,26 @@ export declare function executeVulnerabilityScan(db: FourDADatabase, params: Vul
         is_dev: boolean;
         is_direct: boolean;
         dev_scope_known: boolean;
+        target: string | null;
+        platform_active: boolean;
+        vuln_id: string;
+        aliases: string[];
+        severity: "critical" | "high" | "medium" | "low" | "unknown";
+        cvss_score: number | null;
+        summary: string;
+        fixed_version: string | null;
+        published: string;
+        references: string[];
+    }[];
+    platform_inactive_vulnerabilities: {
+        package: string;
+        current_version: string;
+        ecosystem: import("../live/types.js").OsvEcosystem;
+        is_dev: boolean;
+        is_direct: boolean;
+        dev_scope_known: boolean;
+        target: string | null;
+        platform_active: boolean;
         vuln_id: string;
         aliases: string[];
         severity: "critical" | "high" | "medium" | "low" | "unknown";
@@ -76,6 +98,7 @@ export declare function executeVulnerabilityScan(db: FourDADatabase, params: Vul
         cached: boolean;
         offline: boolean;
         privacy: string;
+        relevance: string;
     };
 } | {
     error: null;
@@ -91,9 +114,11 @@ export declare function executeVulnerabilityScan(db: FourDADatabase, params: Vul
     note: string;
     scan_time: string;
     project: string;
+    host_platform: string;
     ecosystems_scanned: string[];
     total_dependencies_scanned: number;
     total_vulnerable_packages: number;
+    platform_inactive_packages: number;
     by_severity: {
         critical: number;
         high: number;
@@ -108,6 +133,26 @@ export declare function executeVulnerabilityScan(db: FourDADatabase, params: Vul
         is_dev: boolean;
         is_direct: boolean;
         dev_scope_known: boolean;
+        target: string | null;
+        platform_active: boolean;
+        vuln_id: string;
+        aliases: string[];
+        severity: "critical" | "high" | "medium" | "low" | "unknown";
+        cvss_score: number | null;
+        summary: string;
+        fixed_version: string | null;
+        published: string;
+        references: string[];
+    }[];
+    platform_inactive_vulnerabilities: {
+        package: string;
+        current_version: string;
+        ecosystem: import("../live/types.js").OsvEcosystem;
+        is_dev: boolean;
+        is_direct: boolean;
+        dev_scope_known: boolean;
+        target: string | null;
+        platform_active: boolean;
         vuln_id: string;
         aliases: string[];
         severity: "critical" | "high" | "medium" | "low" | "unknown";
@@ -125,6 +170,7 @@ export declare function executeVulnerabilityScan(db: FourDADatabase, params: Vul
         cached: boolean;
         offline: boolean;
         privacy: string;
+        relevance: string;
     };
     error?: undefined;
     offline?: undefined;

package/dist/tools/vulnerability-scan.js

@@ -10,6 +10,8 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { LiveIntelligence } from "../live/index.js";
 import { scanCurrentProject } from "../project-scanner.js";
+import { hostTarget } from "../live/platform.js";
+import { maxSemver } from "../live/semver-utils.js";
 export const vulnerabilityScanTool = {
     name: "vulnerability_scan",
     description: "Scan project dependencies for known vulnerabilities (CVEs) using OSV.dev. " +
@@ -60,7 +62,7 @@ export async function executeVulnerabilityScan(db, params, liveIntelligence) {
     if (normalizedPath(projectPath) !== normalizedPath(process.cwd())) {
         const scan = scanCurrentProject(projectPath);
         scanner = new LiveIntelligence(db.getRawDb());
-        scanner.initFromMultiEcosystem(projectPath, scan.depsByEcosystem);
+        scanner.initFromMultiEcosystem(projectPath, scan.depsByEcosystem, scan.depTargets);
     }
     if (!scanner.isInitialized()) {
         return {
@@ -121,47 +123,54 @@ function formatResult(result, severityFilter) {
     }
     // Sort: critical first, then high, etc.
     vulns.sort((a, b) => (SEVERITY_ORDER[b.severity] || 0) - (SEVERITY_ORDER[a.severity] || 0));
-    // Generate recommendations
+    // Relevance split: advisories on deps NOT active on the host platform are not
+    // actionable for this user (e.g. a Linux-only crate's CVE shown to a Windows
+    // dev). Keep them, but separated and labeled so they don't pollute the signal.
+    const active = vulns.filter((v) => v.platformActive !== false);
+    const inactive = vulns.filter((v) => v.platformActive === false);
+    // Recommendations are derived from platform-active vulns only.
     const recommendations = [];
     const byPackage = new Map();
-    for (const v of vulns) {
+    for (const v of active) {
         if (!byPackage.has(v.package))
             byPackage.set(v.package, []);
         byPackage.get(v.package).push(v);
     }
     for (const [pkg, pkgVulns] of byPackage) {
         const highest = pkgVulns[0];
-        const fixVersion = pkgVulns.find((v) => v.fixedVersion)?.fixedVersion;
-        if (fixVersion) {
-            recommendations.push(`Upgrade ${pkg} ${highest.currentVersion} \u2192 ${fixVersion} (fixes ${pkgVulns.length} ${highest.severity} severity CVE${pkgVulns.length > 1 ? "s" : ""})`);
+        const breakdown = severityBreakdown(pkgVulns);
+        // Target the HIGHEST published fix so the upgrade resolves every fixable CVE,
+        // not just the first one. (The old code picked the first fix version, which
+        // could leave higher-version-gated CVEs unfixed while claiming to fix them.)
+        const target = maxSemver(pkgVulns.map((v) => v.fixedVersion).filter((v) => Boolean(v)));
+        const total = pkgVulns.length;
+        const fixable = pkgVulns.filter((v) => v.fixedVersion).length;
+        if (target) {
+            const scope = fixable === total
+                ? `${total} CVE${total > 1 ? "s" : ""}`
+                : `${fixable} of ${total} CVEs (${total - fixable} with no published fix)`;
+            recommendations.push(`Upgrade ${pkg} ${highest.currentVersion} \u2192 ${target} \u2014 resolves ${scope} [${breakdown}]`);
         }
         else {
-            recommendations.push(`Review ${pkg} ${highest.currentVersion} \u2014 ${pkgVulns.length} known vulnerabilit${pkgVulns.length > 1 ? "ies" : "y"}, no fix version published`);
+            recommendations.push(`Review ${pkg} ${highest.currentVersion} \u2014 ${total} known vulnerabilit${total > 1 ? "ies" : "y"} [${breakdown}], no fix version published`);
         }
     }
+    const host = hostTarget();
+    const activePackages = new Set(active.map((v) => v.package)).size;
     return {
         scan_time: result.scannedAt,
         project: result.projectPath.split(/[/\\]/).pop() || result.projectPath,
+        host_platform: `${host.os}/${host.arch}`,
         ecosystems_scanned: result.ecosystemsScanned,
         total_dependencies_scanned: result.totalScanned,
-        total_vulnerable_packages: result.totalVulnerable,
+        total_vulnerable_packages: activePackages,
+        platform_inactive_packages: result.platformInactiveVulnerable,
         by_severity: result.bySeverity,
-        vulnerabilities: vulns.map((v) => ({
-            package: v.package,
-            current_version: v.currentVersion,
-            ecosystem: v.ecosystem,
-            is_dev: v.isDev,
-            is_direct: v.isDirect ?? null,
-            dev_scope_known: v.devScopeKnown ?? false,
-            vuln_id: v.vulnId,
-            aliases: v.aliases,
-            severity: v.severity,
-            cvss_score: v.cvssScore,
-            summary: v.summary,
-            fixed_version: v.fixedVersion,
-            published: v.published,
-            references: v.references,
-        })),
+        vulnerabilities: active.map(formatVuln),
+        // Advisories suppressed from the main list because the affected crate is not
+        // built on this host (e.g. cfg(not(windows)) deps on Windows). Surfaced for
+        // cross-platform builds, clearly labeled with the gating target.
+        platform_inactive_vulnerabilities: inactive.map(formatVuln),
         recommendations,
         clean_dependencies: result.cleanCount,
         scan_duration_ms: result.scanDurationMs,
@@ -170,7 +179,38 @@ function formatResult(result, severityFilter) {
             cached: result.cached,
             offline: result.offline,
             privacy: "Only package names and versions were sent (public manifest data)",
+            relevance: "Advisories are filtered to the host platform; inactive-target advisories are listed separately.",
         },
     };
 }
+/** "1 critical, 3 high, 2 medium" — severity-ordered, omitting empty buckets. */
+function severityBreakdown(vulns) {
+    const counts = {};
+    for (const v of vulns)
+        counts[v.severity] = (counts[v.severity] || 0) + 1;
+    return ["critical", "high", "medium", "low", "unknown"]
+        .filter((s) => counts[s])
+        .map((s) => `${counts[s]} ${s}`)
+        .join(", ");
+}
+function formatVuln(v) {
+    return {
+        package: v.package,
+        current_version: v.currentVersion,
+        ecosystem: v.ecosystem,
+        is_dev: v.isDev,
+        is_direct: v.isDirect ?? null,
+        dev_scope_known: v.devScopeKnown ?? false,
+        target: v.target,
+        platform_active: v.platformActive,
+        vuln_id: v.vulnId,
+        aliases: v.aliases,
+        severity: v.severity,
+        cvss_score: v.cvssScore,
+        summary: v.summary,
+        fixed_version: v.fixedVersion,
+        published: v.published,
+        references: v.references,
+    };
+}
 //# sourceMappingURL=vulnerability-scan.js.map

package/dist/tools/what-should-i-know.d.ts

@@ -50,6 +50,8 @@ interface WhatShouldIKnowResult {
         reason: string;
     };
     summary: string;
+    /** How relevant_wisdom was retrieved: "hybrid" when an embedding provider is active. */
+    wisdom_recall_mode: "hybrid" | "ranked_lexical";
 }
 export declare const whatShouldIKnowTool: {
     name: string;
@@ -72,6 +74,6 @@ export declare const whatShouldIKnowTool: {
         required: string[];
     };
 };
-export declare function executeWhatShouldIKnow(db: FourDADatabase, params: WhatShouldIKnowParams): WhatShouldIKnowResult;
+export declare function executeWhatShouldIKnow(db: FourDADatabase, params: WhatShouldIKnowParams): WhatShouldIKnowResult | Promise<WhatShouldIKnowResult>;
 export {};
 //# sourceMappingURL=what-should-i-know.d.ts.map