@4da/mcp-server 5.0.3 → 5.0.4

package/dist/db.js

@@ -836,7 +836,17 @@ export class FourDADatabase {
             query += ` AND source_type = ?`;
             params.push(sourceType);
         }
-        query += ` ORDER BY relevance_score DESC LIMIT ?`;
+        // Ranked read (desktop audit items 12+26, schema 110): order by the
+        // batch-relative rank when the analysis cycle has ranked the item, falling
+        // back to the evidence score. This mirrors the Rust source of truth —
+        // `RANKED_ORDER_EXPR` in `src-tauri/src/db/scoring_queries.rs` — and must
+        // stay textually in sync with it. The `relevance_score >= ?` membership
+        // filter above deliberately stays on evidence: evidence decides membership,
+        // rank decides order. Guarded on column existence for pre-110 DBs.
+        const rankedOrder = this.hasColumn("source_items", "rank_score")
+            ? `COALESCE(rank_score, relevance_score) DESC`
+            : `relevance_score DESC`;
+        query += ` ORDER BY ${rankedOrder} LIMIT ?`;
         // Over-fetch so near-duplicate collapsing below can still fill `limit`
         // (the same story arrives via reddit + rss + mastodon: live feeds showed
         // three copies of "Rust 1.98.0" in one 20-item response).

package/dist/live/osv-scanner.d.ts

@@ -8,7 +8,7 @@
  */
 import type { LiveCache } from "./cache.js";
 import type { RateLimiter } from "./rate-limiter.js";
-import type { ResolvedDependency, VulnerabilityScanResult } from "./types.js";
+import type { ResolvedDependency, OsvVulnerability, VulnerabilityScanResult } from "./types.js";
 export declare class OsvScanner {
     private cache;
     private rateLimiter;
@@ -28,3 +28,22 @@ export declare function extractCvssScore(severity: Array<{
     type: string;
     score: string;
 }> | undefined): number | null;
+/**
+ * Pick the fix version for the OSV range that actually CONTAINS the installed
+ * version — never another release line's fix. The old code returned the first
+ * range's first `fixed` event, so a multi-range advisory (e.g. undici fixed at
+ * 6.x on the 6 line and 7.x on the 7 line) recommended a DOWNGRADE to 6.x for
+ * an installed 7.x.
+ *
+ * Selection order:
+ * 1. The `fixed` of the interval containing installed (introduced <= installed
+ *    < fixed).
+ * 2. If that interval has no fix (or none contains installed), the smallest
+ *    published fix strictly ABOVE installed across all ranges.
+ * 3. If the installed version is unparseable, the highest published fix (it
+ *    resolves the advisory regardless of release line).
+ * 4. Otherwise null — omitting the recommendation beats emitting a downgrade.
+ *
+ * Hard guard: the returned version is never below the installed version.
+ */
+export declare function extractFixedVersion(affected: OsvVulnerability["affected"] | undefined, packageName: string, ecosystem: string, installedVersion: string | null): string | null;

package/dist/live/osv-scanner.js

@@ -9,6 +9,7 @@
  */
 import { fetchWithTimeout, fetchJson } from "./http-utils.js";
 import { cvssBaseScore } from "./cvss.js";
+import { compareSemver, maxSemver, parseSemver } from "./semver-utils.js";
 const OSV_BATCH_URL = "https://api.osv.dev/v1/querybatch";
 const OSV_VULN_URL = "https://api.osv.dev/v1/vulns/";
 const OSV_TIMEOUT_MS = 15_000;
@@ -174,7 +175,7 @@ export class OsvScanner {
 }
 function mapVulnerability(vuln, dep) {
     const { severity, cvssScore } = deriveSeverity(vuln);
-    const fixedVersion = extractFixedVersion(vuln.affected, dep.name, dep.ecosystem);
+    const fixedVersion = extractFixedVersion(vuln.affected, dep.name, dep.ecosystem, dep.version);
     return {
         package: dep.name,
         currentVersion: dep.version || "unknown",
@@ -260,18 +261,91 @@ function cvssToSeverity(score) {
         return "low";
     return "unknown";
 }
-function extractFixedVersion(affected, packageName, ecosystem) {
+/**
+ * Pick the fix version for the OSV range that actually CONTAINS the installed
+ * version — never another release line's fix. The old code returned the first
+ * range's first `fixed` event, so a multi-range advisory (e.g. undici fixed at
+ * 6.x on the 6 line and 7.x on the 7 line) recommended a DOWNGRADE to 6.x for
+ * an installed 7.x.
+ *
+ * Selection order:
+ * 1. The `fixed` of the interval containing installed (introduced <= installed
+ *    < fixed).
+ * 2. If that interval has no fix (or none contains installed), the smallest
+ *    published fix strictly ABOVE installed across all ranges.
+ * 3. If the installed version is unparseable, the highest published fix (it
+ *    resolves the advisory regardless of release line).
+ * 4. Otherwise null — omitting the recommendation beats emitting a downgrade.
+ *
+ * Hard guard: the returned version is never below the installed version.
+ */
+export function extractFixedVersion(affected, packageName, ecosystem, installedVersion) {
     if (!affected)
         return null;
+    const intervals = collectVulnerableIntervals(affected, packageName, ecosystem);
+    const fixes = intervals
+        .map((i) => i.fixed)
+        .filter((f) => f !== null);
+    if (fixes.length === 0)
+        return null;
+    if (installedVersion === null || parseSemver(installedVersion) === null) {
+        // Can't place the installed version on a release line — recommend the
+        // highest published fix so the upgrade resolves the advisory either way.
+        return maxSemver(fixes);
+    }
+    // The interval whose release line the installed version sits on. `compareSemver`
+    // returns 0 for unparseable bounds (e.g. introduced "0" = since inception),
+    // which keeps those intervals eligible on the introduced side only.
+    const containing = intervals.find((i) => compareSemver(installedVersion, i.introduced) >= 0 &&
+        (i.fixed === null || compareSemver(installedVersion, i.fixed) < 0));
+    if (containing?.fixed &&
+        compareSemver(containing.fixed, installedVersion) > 0) {
+        return containing.fixed;
+    }
+    // No fix on the installed line (open interval, or installed already past
+    // every containing range): smallest fix strictly above installed, or nothing.
+    const above = fixes.filter((f) => compareSemver(f, installedVersion) > 0);
+    if (above.length === 0)
+        return null;
+    return above.reduce((min, v) => (compareSemver(v, min) < 0 ? v : min), above[0]);
+}
+/**
+ * Flatten the matching package's version ranges into [introduced, fixed)
+ * intervals. OSV sorts events within a range; each `introduced` opens an
+ * interval and the next `fixed` closes it. GIT ranges hold commit hashes,
+ * not versions, and are skipped.
+ */
+function collectVulnerableIntervals(affected, packageName, ecosystem) {
+    const intervals = [];
     for (const a of affected) {
-        if (a.package.name === packageName && a.package.ecosystem === ecosystem) {
-            for (const range of a.ranges || []) {
-                for (const event of range.events || []) {
-                    if (event.fixed)
-                        return event.fixed;
+        if (a.package.name !== packageName || a.package.ecosystem !== ecosystem)
+            continue;
+        for (const range of a.ranges || []) {
+            if (range.type === "GIT")
+                continue;
+            let open = null;
+            for (const event of range.events || []) {
+                if (event.introduced !== undefined) {
+                    if (open)
+                        intervals.push(open);
+                    open = { introduced: event.introduced, fixed: null };
+                }
+                else if (event.fixed !== undefined) {
+                    if (open) {
+                        open.fixed = event.fixed;
+                        intervals.push(open);
+                        open = null;
+                    }
+                    else {
+                        // `fixed` with no preceding `introduced` — treat as vulnerable
+                        // since inception ("0" = OSV's since-the-beginning sentinel).
+                        intervals.push({ introduced: "0", fixed: event.fixed });
+                    }
                 }
             }
+            if (open)
+                intervals.push(open);
         }
     }
-    return null;
+    return intervals;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@4da/mcp-server",
-  "version": "5.0.3",
+  "version": "5.0.4",
   "mcpName": "io.github.4DA-Systems/4da-mcp-server",
   "description": "Dependency intelligence for AI coding agents. Live CVE scanning, dependency health, upgrade planning, ecosystem news, decision memory — zero config, privacy-first. 9 tools standalone, 14 total with desktop app.",
   "type": "module",