@4da/mcp-server 5.0.4 → 6.0.0

package/dist/live/dependency-set.js

@@ -0,0 +1,95 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Set operations over resolved dependencies, shared by the live layer.
+ * (Moved out of live/index.ts; behaviour unchanged except for the install
+ * fields, which did not exist before.)
+ */
+/**
+ * Deepest common ancestor of a set of directories (segment-wise, both slash
+ * styles). Null for an empty set; a single dir is its own root.
+ */
+export function commonPathRoot(dirs) {
+    if (dirs.length === 0)
+        return null;
+    const split = (p) => p.replace(/\\/g, "/").replace(/\/+$/, "").split("/");
+    let common = split(dirs[0]);
+    for (const dir of dirs.slice(1)) {
+        const parts = split(dir);
+        let i = 0;
+        while (i < common.length && i < parts.length && common[i].toLowerCase() === parts[i].toLowerCase())
+            i++;
+        common = common.slice(0, i);
+        if (common.length === 0)
+            break;
+    }
+    return common.length > 0 ? common.join("/") : null;
+}
+export function dedupeDependencies(deps) {
+    const unique = new Map();
+    for (const dep of deps) {
+        const key = `${dep.ecosystem}\0${dep.name}\0${dep.version ?? ""}`;
+        const existing = unique.get(key);
+        if (existing) {
+            existing.isDirect ||= dep.isDirect;
+            existing.devScopeKnown &&= dep.devScopeKnown;
+            existing.isDev = existing.devScopeKnown && existing.isDev && dep.isDev;
+            // A crate reachable via ANY active path is active, and its target label
+            // is then the active copy's: rsa 0.9.10, built for relay and not for
+            // src-tauri on Windows, read "not built for x86_64-pc-windows-msvc"
+            // beside platform_active: true (2026-10-02 agent eval).
+            if (dep.platformActive && !existing.platformActive)
+                existing.target = dep.target;
+            else if (existing.platformActive === dep.platformActive)
+                existing.target = existing.target ?? dep.target;
+            existing.platformActive ||= dep.platformActive;
+            // Union the provenance rather than discarding it — the same version can
+            // legitimately be pinned by several workspaces, and the reader needs all
+            // of them to know where to apply the fix.
+            for (const dir of dep.sourceDirs ?? []) {
+                if (!existing.sourceDirs.includes(dir))
+                    existing.sourceDirs.push(dir);
+            }
+            mergeInstallContext(existing, dep);
+        }
+        else {
+            unique.set(key, { ...dep, sourceDirs: [...(dep.sourceDirs ?? [])] });
+        }
+    }
+    return [...unique.values()];
+}
+/**
+ * A drift entry exists only because node_modules holds a version the lockfile
+ * does not pin. When a lockfile really does pin that same version somewhere,
+ * the merged entry is a lockfile instance, not drift, and must not read as
+ * "only in node_modules". Two drift entries keep the first one's context.
+ * A drifted install reading wins over a matching one, so a merge never hides
+ * a disagreement.
+ */
+function mergeInstallContext(existing, dep) {
+    if (existing.installDriftOf !== undefined && dep.installDriftOf === undefined) {
+        existing.installDriftOf = undefined;
+        existing.installFix = undefined;
+    }
+    if (dep.installedVersion === undefined)
+        return;
+    const drifted = (d) => d.installedVersion !== undefined && d.installedVersion !== null && d.installedVersion !== d.version;
+    if (existing.installedVersion === undefined || (drifted(dep) && !drifted(existing))) {
+        existing.installedVersion = dep.installedVersion;
+    }
+}
+export function emptyVulnResult(projectPath, offline) {
+    return {
+        scannedAt: new Date().toISOString(),
+        projectPath,
+        ecosystemsScanned: [],
+        totalScanned: 0,
+        totalVulnerable: 0,
+        platformInactiveVulnerable: 0,
+        bySeverity: { critical: 0, high: 0, medium: 0, low: 0, unknown: 0 },
+        vulnerabilities: [],
+        cleanCount: 0,
+        scanDurationMs: 0,
+        cached: false,
+        offline,
+    };
+}

package/dist/live/dev-scope.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Transitive dev/runtime scope from the desktop app's dependency inventory.
+ *
+ * A lockfile read tells the MCP server whether a package is direct. For a
+ * transitive it cannot tell dev from runtime, so under the shared severity
+ * rule a transitive gets the clamp but never the dev discount. In
+ * full-database mode the app's `dependency_instances` table records every
+ * installed instance with `is_dev` and `scope`; this module reads it.
+ *
+ * Only a real determination counts: `is_dev = 1`, or a `scope` of runtime,
+ * dev or build. The app's current writers stamp every row `is_dev = 0,
+ * scope = 'unknown'` as a placeholder. Reading that as "known runtime" would
+ * claim a certainty the app itself does not have. The grade would not change
+ * (unknown and runtime both get no discount), but `dev_scope_known` would lie.
+ */
+import type Database from "better-sqlite3";
+import type { ResolvedDependency } from "./types.js";
+/**
+ * A project path in the app's storage form: forward slashes, lowercased on
+ * Windows only. Must match `project_inclusion::canonical_storage_path` in the
+ * app, or the lookup misses every row.
+ */
+export declare function canonicalStoragePath(p: string): string;
+/**
+ * Stamp transitive dependencies with the dev scope the app determined for
+ * them. A dependency pinned in several workspaces is dev-only only when every
+ * one of them says dev, and known only when every one of them was determined.
+ * Anything short of that keeps the resolver's own (unknown) scope. Direct
+ * dependencies are untouched: their manifest already says. Returns new
+ * objects; never throws; a database without the table changes nothing.
+ */
+export declare function applyInstanceDevScope(db: Database.Database | null, deps: ResolvedDependency[]): ResolvedDependency[];

package/dist/live/dev-scope.js

@@ -0,0 +1,102 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Transitive dev/runtime scope from the desktop app's dependency inventory.
+ *
+ * A lockfile read tells the MCP server whether a package is direct. For a
+ * transitive it cannot tell dev from runtime, so under the shared severity
+ * rule a transitive gets the clamp but never the dev discount. In
+ * full-database mode the app's `dependency_instances` table records every
+ * installed instance with `is_dev` and `scope`; this module reads it.
+ *
+ * Only a real determination counts: `is_dev = 1`, or a `scope` of runtime,
+ * dev or build. The app's current writers stamp every row `is_dev = 0,
+ * scope = 'unknown'` as a placeholder. Reading that as "known runtime" would
+ * claim a certainty the app itself does not have. The grade would not change
+ * (unknown and runtime both get no discount), but `dev_scope_known` would lie.
+ */
+const DETERMINED_SCOPES = new Set(["runtime", "dev", "build"]);
+/**
+ * A project path in the app's storage form: forward slashes, lowercased on
+ * Windows only. Must match `project_inclusion::canonical_storage_path` in the
+ * app, or the lookup misses every row.
+ */
+export function canonicalStoragePath(p) {
+    const forward = p.replace(/\\/g, "/").replace(/\/+$/, "");
+    return process.platform === "win32" ? forward.toLowerCase() : forward;
+}
+function instanceKey(ecosystem, name, version) {
+    const normalized = ecosystem === "PyPI" ? name.toLowerCase() : name;
+    return `${normalized}\0${version}`;
+}
+function hasInstancesTable(db) {
+    try {
+        return (db
+            .prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'dependency_instances'")
+            .get() !== undefined);
+    }
+    catch {
+        return false;
+    }
+}
+/** Every instance row for one (project, ecosystem), keyed by name + version. Null when unreadable. */
+function loadScopeIndex(db, dir, ecosystem) {
+    const project = canonicalStoragePath(dir);
+    let rows;
+    try {
+        rows = db
+            .prepare("SELECT package_name, version, is_dev, scope FROM dependency_instances WHERE project_path = ? AND ecosystem = ?")
+            .all(project, ecosystem);
+    }
+    catch {
+        try {
+            // A table without the `scope` column: only `is_dev = 1` can count.
+            rows = db
+                .prepare("SELECT package_name, version, is_dev FROM dependency_instances WHERE project_path = ? AND ecosystem = ?")
+                .all(project, ecosystem);
+        }
+        catch {
+            return null;
+        }
+    }
+    const index = new Map();
+    for (const row of rows) {
+        const scope = (row.scope ?? "").toLowerCase();
+        const isDev = row.is_dev === 1 || scope === "dev";
+        index.set(instanceKey(ecosystem, row.package_name, row.version), {
+            known: row.is_dev === 1 || DETERMINED_SCOPES.has(scope),
+            isDev,
+        });
+    }
+    return index;
+}
+/**
+ * Stamp transitive dependencies with the dev scope the app determined for
+ * them. A dependency pinned in several workspaces is dev-only only when every
+ * one of them says dev, and known only when every one of them was determined.
+ * Anything short of that keeps the resolver's own (unknown) scope. Direct
+ * dependencies are untouched: their manifest already says. Returns new
+ * objects; never throws; a database without the table changes nothing.
+ */
+export function applyInstanceDevScope(db, deps) {
+    if (!db || !hasInstancesTable(db))
+        return deps;
+    const indexes = new Map();
+    const indexFor = (dir, ecosystem) => {
+        const key = `${canonicalStoragePath(dir)}\0${ecosystem}`;
+        if (!indexes.has(key))
+            indexes.set(key, loadScopeIndex(db, dir, ecosystem));
+        return indexes.get(key) ?? null;
+    };
+    return deps.map((dep) => {
+        if (dep.isDirect || !dep.version || dep.sourceDirs.length === 0)
+            return dep;
+        let allDev = true;
+        for (const dir of dep.sourceDirs) {
+            const row = indexFor(dir, dep.ecosystem)?.get(instanceKey(dep.ecosystem, dep.name, dep.version));
+            if (!row || !row.known)
+                return dep;
+            allDev &&= row.isDev;
+        }
+        return { ...dep, devScopeKnown: true, isDev: allDev };
+    });
+}

package/dist/live/file-signature.d.ts

@@ -0,0 +1,18 @@
+/**
+ * A cheap identity for a file at one moment, so the live layer can notice a
+ * change with stat calls alone: "absent", or mtime + size + inode.
+ *
+ * The inode matters for node_modules. npm packs every tarball file with one
+ * fixed mtime, and pnpm swaps a package version by re-pointing a link at a
+ * different store file, so two versions can share an mtime. They cannot share
+ * an inode.
+ */
+export type FileSignature = string;
+export declare const ABSENT: FileSignature;
+export declare function fileSignature(filePath: string): FileSignature;
+/** The modification time a signature recorded, or null for an absent file. */
+export declare function signatureMtime(signature: FileSignature | undefined): number | null;
+/** Signatures for a set of paths, taken now. */
+export declare function signatureMap(paths: Iterable<string>): Map<string, FileSignature>;
+/** True when any recorded file changed, appeared, or disappeared since its signature was taken. */
+export declare function anySignatureChanged(snapshot: Map<string, FileSignature>): boolean;

package/dist/live/file-signature.js

@@ -0,0 +1,43 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * A cheap identity for a file at one moment, so the live layer can notice a
+ * change with stat calls alone: "absent", or mtime + size + inode.
+ *
+ * The inode matters for node_modules. npm packs every tarball file with one
+ * fixed mtime, and pnpm swaps a package version by re-pointing a link at a
+ * different store file, so two versions can share an mtime. They cannot share
+ * an inode.
+ */
+import * as fs from "node:fs";
+export const ABSENT = "absent";
+export function fileSignature(filePath) {
+    try {
+        const s = fs.statSync(filePath);
+        return `${s.mtimeMs}:${s.size}:${s.ino}`;
+    }
+    catch {
+        return ABSENT;
+    }
+}
+/** The modification time a signature recorded, or null for an absent file. */
+export function signatureMtime(signature) {
+    if (!signature || signature === ABSENT)
+        return null;
+    const mtime = Number(signature.split(":")[0]);
+    return Number.isFinite(mtime) ? mtime : null;
+}
+/** Signatures for a set of paths, taken now. */
+export function signatureMap(paths) {
+    const out = new Map();
+    for (const p of paths)
+        out.set(p, fileSignature(p));
+    return out;
+}
+/** True when any recorded file changed, appeared, or disappeared since its signature was taken. */
+export function anySignatureChanged(snapshot) {
+    for (const [p, recorded] of snapshot) {
+        if (fileSignature(p) !== recorded)
+            return true;
+    }
+    return false;
+}

package/dist/live/go-registry.js

@@ -21,7 +21,9 @@ export class GoRegistry {
         this.rateLimiter = rateLimiter;
     }
     async getPackageInfo(name, currentVersion, isDev) {
-        const cacheKey = `go-reg:${name}`;
+        // Keyed by the installed version too: the cached answer carries currentVersion
+        // and its distance, so a name-only key served one project's answer to another.
+        const cacheKey = `go-reg:${name}@${currentVersion ?? ""}:${isDev ? 1 : 0}`;
         const cached = this.cache.get(cacheKey);
         if (cached !== null)
             return cached;

package/dist/live/hn-fetcher.js

@@ -10,7 +10,7 @@
 const HN_ALGOLIA_URL = "https://hn.algolia.com/api/v1/search";
 const HN_TIMEOUT_MS = 8_000;
 const HN_CACHE_TTL = 1800; // 30 minutes
-const MAX_QUERIES = 5;
+const MAX_QUERIES = 8;
 const RESULTS_PER_QUERY = 10;
 const MIN_POINTS = 10;
 export class HNFetcher {
@@ -110,7 +110,9 @@ function scoreAndMap(hits, techStack) {
         // "reactors" and weather stories arrived this way), not ecosystem news.
         .filter(({ matchedTech }) => matchedTech.length > 0)
         .map(({ hit, matchedTech }) => {
-        const techBoost = Math.min(matchedTech.length * 0.2, 0.4);
+        // A headline naming a dependency outranks language-level news.
+        const named = matchedTech.filter((t) => !LANGUAGE_TERMS.has(t));
+        const techBoost = named.length > 0 ? Math.min(0.3 + named.length * 0.1, 0.5) : 0.1;
         const pointsBoost = Math.min(hit.points / 500, 0.3);
         const commentsBoost = Math.min(hit.num_comments / 200, 0.2);
         const score = Math.min(0.1 + techBoost + pointsBoost + commentsBoost, 1.0);
@@ -123,12 +125,16 @@ function scoreAndMap(hits, techStack) {
             comments: hit.num_comments,
             published: hit.created_at,
             relevanceScore: Math.round(score * 100) / 100,
-            relevanceReason: `Matches your stack: ${matchedTech.join(", ")}`,
+            relevanceReason: named.length > 0
+                ? `Names ${named.join(", ")} (used in your projects)`
+                : `Language-level news: ${matchedTech.join(", ")}`,
         };
     })
         .sort((a, b) => b.relevanceScore - a.relevanceScore)
         .slice(0, 15);
 }
+/** Search terms that name a language rather than a dependency. */
+const LANGUAGE_TERMS = new Set(["rust", "python", "zig", "kotlin", "swift", "ruby", "elixir"]);
 const SKIP_TERMS = new Set([
     "javascript", "typescript", // too generic, floods results
     "docker", // too broad

package/dist/live/index.d.ts

@@ -8,9 +8,12 @@
  * Set FOURDA_OFFLINE=true to disable all network calls.
  */
 import type Database from "better-sqlite3";
-import type { ResolvedDependency, RegistryPackageInfo, VulnerabilityScanResult, LiveHeadline, LiveIntelligenceStatus } from "./types.js";
-export type { VulnerabilityScanResult, VulnerabilityEntry, LiveHeadline, LiveIntelligenceStatus, RegistryPackageInfo, DependencyHealthResult } from "./types.js";
+import type { ReleaseMetadataSource } from "./release-metadata.js";
+import { type ResolutionGroup } from "./resolution.js";
+import type { InstallDriftRecord, ResolutionProvenance, ResolvedDependency, RegistryPackageInfo, VulnerabilityScanResult, LiveHeadline, LiveIntelligenceStatus } from "./types.js";
+export type { VulnerabilityScanResult, VulnerabilityEntry, LiveHeadline, LiveIntelligenceStatus, RegistryPackageInfo, DependencyHealthResult, InstallDriftRecord, ResolutionProvenance, } from "./types.js";
 export declare class LiveIntelligence {
+    private db;
     private cache;
     private rateLimiter;
     private osvScanner;
@@ -19,13 +22,45 @@ export declare class LiveIntelligence {
     private cratesRegistry;
     private pypiRegistry;
     private goRegistry;
+    private npmPackuments;
+    private cratesVersions;
     private enabled;
     private lastVulnScan;
+    /** Whether the stored scan included direct devDependencies. */
+    private lastVulnScanIncludesDev;
+    /**
+     * Order of scan REQUESTS. A scan's result is stored only if no later request
+     * has stored one already: the init warmup (runtime scope) used to finish
+     * after an agent's `include_dev` scan and replace it, so `upgrade_planner`
+     * read a scan without the dev dependencies the agent had just scanned and
+     * sent node-fetch 2.6.0 to the ESM-only 3.3.2 with no advisories (2 of 6
+     * runs, 2026-10-03 pre-publish verification).
+     */
+    private scanRequests;
+    private storedScanRequest;
     private lastHeadlines;
     private resolvedDeps;
     private auditDeps;
     private initialized;
     private projectRoot;
+    /** One entry per resolution group: its inputs, result, and the file signatures that say when it went stale. */
+    private groupResults;
+    /** When the dependency set in use was assembled: at init, or at the last re-resolution. */
+    private resolvedAt;
+    /**
+     * Bumped by every re-resolution. A scan started under an older generation
+     * describes a dependency set that no longer exists: it may still be handed
+     * to the call that asked for it, but it is never stored or served later.
+     */
+    private generation;
+    /**
+     * The background vulnerability scan started at server init. Tools that need
+     * scan data before answering (`what_should_i_know`) await this through
+     * `ensureVulnerabilities` instead of reading the cache and finding it empty.
+     */
+    private warmup;
+    /** When the last warmup came back offline; gates the retry so an offline host is not re-probed on every call. */
+    private warmupFailedAt;
     constructor(db: Database.Database);
     /**
      * Initialize with project data. Call once after project scan.
@@ -41,6 +76,12 @@ export declare class LiveIntelligence {
         deps: string[];
         devDeps: string[];
     }>, depTargets?: Record<string, string>): void;
+    /**
+     * Initialize from every independently-locked project under `root` (see
+     * project-tree.ts): each group resolves from its own directory and keeps
+     * its manifest's platform targets; `root` is the reported project root.
+     */
+    initFromProjectTree(root: string, groups: ResolutionGroup[]): void;
     /**
      * Initialize from dependency groups that each carry their own resolution
      * directory. Used in 4DA database mode, where dependencies span multiple
@@ -57,6 +98,22 @@ export declare class LiveIntelligence {
         deps: string[];
         devDeps: string[];
     }>): void;
+    private applyGroups;
+    private rebuildDependencySet;
+    /**
+     * Re-resolve every group whose inputs changed since they were read (a
+     * lockfile rewritten, created or deleted; the fallback manifest; for npm,
+     * the node_modules install state), and drop every answer that described the
+     * old set: the stored scan and the warmup. Returns true when anything was
+     * re-resolved. Stat calls only, so it is cheap enough for the top of every
+     * tool call. A process that started before a `git pull` no longer answers
+     * for the dependency set it saw at startup.
+     */
+    refreshIfLockfilesChanged(): boolean;
+    /** When the dependency set in use was resolved, and from which files. Null before init. */
+    getResolutionProvenance(): ResolutionProvenance | null;
+    /** npm direct dependencies whose installed copy differs from the lockfile, per manifest directory. */
+    getInstallDrift(): InstallDriftRecord[];
     /**
      * Root directory the dependency set was resolved from, or null before init.
      * For multi-manifest (grouped) init this is the deepest common ancestor of
@@ -66,11 +123,43 @@ export declare class LiveIntelligence {
     getProjectRoot(): string | null;
     /**
      * Run vulnerability scan (returns cached if fresh, fetches otherwise).
+     *
+     * Without `includeDev`, only DIRECT devDependencies are left out (the
+     * documented contract). A transitive stays in whatever its scope: an
+     * unknown scope must not be hidden, and a known dev-only one is graded
+     * down by the shared severity rule, not dropped.
      */
     scanVulnerabilities(projectPath: string, options?: {
         includeDev?: boolean;
         forceRefresh?: boolean;
     }): Promise<VulnerabilityScanResult>;
+    /**
+     * Start the vulnerability scan in the background without blocking startup.
+     * Never rejects: a failed scan resolves to an empty OFFLINE result so the
+     * warmup can be awaited by anyone. Idempotent while a warmup is in flight.
+     *
+     * Before this existed, full-database mode initialised the dependency set
+     * and warmed headlines but never scanned, so `lastVulnScan` stayed null
+     * until some tool happened to call `vulnerability_scan` — and the first
+     * `what_should_i_know` of a session read an empty cache and reported
+     * "safe_to_delegate" for a task naming a package with an open advisory.
+     */
+    startVulnerabilityWarmup(projectPath: string): void;
+    /**
+     * A usable vulnerability scan, or null. Re-resolves first when a lockfile
+     * changed. Returns the stored scan when one exists, otherwise awaits the
+     * warmup (starting one if none is running) for at most `timeoutMs`. Null
+     * means the scan is not available: disabled, still running past the
+     * deadline, finished offline (an offline scan makes no clean-dependency
+     * claims, so it cannot support a "safe" verdict), or overtaken by a
+     * re-resolution while it ran. Never throws. A timed-out warmup keeps running
+     * so a later call can use it.
+     */
+    ensureVulnerabilities(projectPath: string, timeoutMs: number, options?: {
+        includeDev?: boolean;
+    }): Promise<VulnerabilityScanResult | null>;
+    /** A scan's result within `timeoutMs`, or null when it times out, comes back offline, or is overtaken by a re-resolution. */
+    private awaitScan;
     /**
      * Fetch relevant headlines for the user's tech stack.
      */
@@ -79,6 +168,8 @@ export declare class LiveIntelligence {
      * Get last vulnerability scan result (from cache/memory, no network).
      */
     getVulnerabilities(): VulnerabilityScanResult | null;
+    /** Whether the stored scan covered direct devDependencies (false when there is none). */
+    lastScanIncludesDev(): boolean;
     /**
      * Get last headlines (from cache/memory, no network).
      */
@@ -91,5 +182,17 @@ export declare class LiveIntelligence {
     isEnabled(): boolean;
     isInitialized(): boolean;
     fetchRegistryHealth(deps: ResolvedDependency[]): Promise<RegistryPackageInfo[]>;
+    /** Per-release registry readers for dependency_check (name-only requests). */
+    getReleaseSources(): {
+        npm: ReleaseMetadataSource;
+        "crates.io": ReleaseMetadataSource;
+    };
+    /**
+     * OSV advisories for explicit (ecosystem, name, version) triples that need
+     * not be in the project, e.g. a version an agent is about to install. Same
+     * scanner, cache and rate limit as vulnerability_scan; never touches the
+     * stored project scan. Disabled or failed yields an `offline` result.
+     */
+    queryAdvisories(deps: ResolvedDependency[]): Promise<VulnerabilityScanResult>;
     getStatus(): LiveIntelligenceStatus;
 }