@4da/mcp-server 6.0.2 → 6.2.0

package/dist/live/changelog.js

@@ -8,6 +8,8 @@
  *   conventional          `## [7.0.0](https://…/compare/…) (2025-06-24)`
  *   plain / prefixed      `## 1.2.3`, `# v1.2.3 (2024-01-01)`, `### Version 1.2.3`, `## fastembed 5.0.0`
  *   setext                `1.2.3` underlined with `===` / `---`
+ *   reStructuredText      `Version 3.0.0` underlined (or over- and underlined)
+ *                         with any of `= - ~ ^ * + # " '`, then `Released 2023-09-30`
  *   History.md (express)  `1.2.3 / 2020-01-01`
  * A heading only opens a section when the rest of it looks like a trailer
  * (date, link, "yanked") — `## Upgrading from 1.x` or `#### Rust 1.70 support`
@@ -19,6 +21,13 @@
  */
 import { compareVersionPrecedence } from "./semver-precedence.js";
 import { classifyEntry, classifyHeading, sanitizeEntry } from "./changelog-classify.js";
+/**
+ * Version of the parser AND classifier output. A parsed changelog is cached
+ * for 7 days per package version, so a fix to either one stays invisible
+ * for a week unless this changes: bump it with every change to parseChangelog
+ * or changelog-classify.ts that can alter a section or an entry's kind.
+ */
+export const CHANGELOG_PARSER_VERSION = 4;
 const NAME_STEMS = ["changelog", "changes", "history", "releases", "release-notes", "release_notes", "releasenotes", "news"];
 const NAME_EXTS = ["", ".md", ".markdown", ".txt", ".rst"];
 /** True for a root-level basename that names a changelog (case-insensitive). */
@@ -71,7 +80,14 @@ function extractDate(text) {
  * heading. Exported for tests.
  */
 export function parseVersionHeading(raw) {
-    const text = raw.trim().replace(/^\*\*|\*\*$/g, "");
+    // Inline HTML is markup, not heading text: stripe writes
+    // `## <a id="23-0-0"></a>23.0.0 - 2026-09-30`, and until 6.0.2 no stripe
+    // release was found (changelog.found: false, 2026-10-07).
+    const text = raw
+        .replace(/<\/?[A-Za-z][^<>]*>/g, " ")
+        .trim()
+        .replace(/^\*\*|\*\*$/g, "")
+        .trim();
     const m = HEADING.exec(text);
     if (!m)
         return null;
@@ -92,7 +108,13 @@ export function parseVersionHeading(raw) {
     return { version, date: extractDate(rest) };
 }
 const ATX = /^(#{1,6})\s+(.*?)\s*#*\s*$/;
-const SETEXT_RULE = /^\s*(=+|-+)\s*$/;
+/**
+ * A setext / reStructuredText underline. `=` and `-` at any length (Markdown);
+ * the other RST adornments need three, so a stray `**` is not a heading rule.
+ */
+const SETEXT_RULE = /^\s*(=+|-+|~{3,}|\^{3,}|\*{3,}|\+{3,}|#{3,}|"{3,}|'{3,})\s*$/;
+/** `Released 2023-09-30`, `Released on 2024-01-01`, `Release date: ...`, `Unreleased`: a date line under an RST heading. */
+const RELEASED_LINE = /^\s*(?:\*{0,2}(?:released|release date|date)\*{0,2}(?:\s+on)?\s*:?\s*(.*)|unreleased|\(unreleased\))\s*$/i;
 const BULLET = /^(\s*)(?:[-*+•]|\d+[.)])\s+(.*)$/;
 const LINK_DEF = /^\s*\[[^\]]+\]:\s*\S+/;
 const FENCE = /^\s*(```|~~~)/;
@@ -105,17 +127,37 @@ const PLAIN_LABEL = /^\s{0,3}([A-Za-z⚠][\w /&,'()⚠️-]{1,58}?)\s*:\s*$/;
 const HTML_LAYOUT = /^<\/?(?:details|summary|div|p|br|hr|img|picture|source|table|tr|td|th|thead|tbody|center|sup|sub)\b/i;
 /** A bullet that is only a label: "remove:", "**Breaking**:", "deps:". */
 const LABEL_BULLET = /^\W*([A-Za-z][\w -]{0,30}?)\W*:\W*$/;
+const KIND_SEVERITY = { breaking: 3, security: 2, deprecation: 1, change: 0 };
+/** Nested lines kept per entry, and the length of each. */
+const MAX_DETAILS = 12;
+const MAX_DETAIL_CHARS = 200;
 function flush(state) {
-    if (state.pending && state.current) {
-        const text = sanitizeEntry(state.pending.text);
-        const under = state.pending.under;
-        // Layout markup is not a change: actix-web 4 wraps pre-release notes in
-        // `<details> <summary>...</summary>`, and both lines were counted as removals.
-        if (text && !HTML_LAYOUT.test(text)) {
-            state.current.entries.push({ kind: classifyEntry(text, state.pending.context), text, ...(under ? { under } : {}) });
-        }
-    }
+    const pending = state.pending;
     state.pending = null;
+    if (!pending || !state.current)
+        return;
+    const text = sanitizeEntry(pending.text);
+    // Layout markup is not a change: actix-web 4 wraps pre-release notes in
+    // `<details> <summary>...</summary>`, and both lines were counted as removals.
+    if (!text || HTML_LAYOUT.test(text))
+        return;
+    const kind = classifyEntry(text, pending.context);
+    if (pending.into) {
+        const parent = pending.into;
+        const details = (parent.details ??= []);
+        if (details.length < MAX_DETAILS)
+            details.push(sanitizeEntry(pending.text, MAX_DETAIL_CHARS));
+        // "Breaking change: adds a DB type parameter" under a plain "fix: RawSql
+        // lifetime issues" bullet makes the entry breaking.
+        if (KIND_SEVERITY[kind] > KIND_SEVERITY[parent.kind])
+            parent.kind = kind;
+        return;
+    }
+    const under = pending.under;
+    const entry = { kind, text, ...(under ? { under } : {}) };
+    state.current.entries.push(entry);
+    if (pending.outer)
+        state.parentEntry = entry;
 }
 /**
  * Headings that name a kind of change (keep-a-changelog and conventional-commit
@@ -135,6 +177,7 @@ function openSection(state, heading, level) {
     state.parentIndent = null;
     state.headingText = null;
     state.parentText = null;
+    state.parentEntry = null;
 }
 /** A heading or parent bullet as context text: emphasis and code marks dropped, one line, at most 80 characters. */
 function contextText(raw) {
@@ -156,6 +199,8 @@ function addLine(state, line) {
             if (label) {
                 state.parentKind = classifyHeading(label[1]) ?? state.headingKind;
                 state.parentText = contextText(label[1]);
+                // A label's children are entries of their own, under the label.
+                state.parentEntry = null;
                 return;
             }
             // A breaking bullet lends "breaking" to its sub-points (date-fns 3.0: "**BREAKING**: Functions
@@ -167,7 +212,9 @@ function addLine(state, line) {
         }
         const context = !outer && state.parentKind ? state.parentKind : state.headingKind;
         const under = !outer && state.parentText ? state.parentText : state.headingText;
-        state.pending = { text, context, indent, under };
+        if (outer)
+            state.parentEntry = null;
+        state.pending = { text, context, indent, under, outer, into: outer ? null : state.parentEntry };
         return;
     }
     if (line.trim() === "") {
@@ -182,9 +229,54 @@ function addLine(state, line) {
         state.pending.text += ` ${line.trim()}`; // wrapped paragraph line
         return;
     }
+    // An indented paragraph after a blank line continues the list item above it
+    // (stripe 23.0.0: "* ⚠️ Remove ErrorType export", blank, "  Remove the ErrorType
+    // interface ..."): a detail of that entry, not an entry of its own.
+    if (!state.pending && state.parentEntry && /^\s{2,}\S/.test(line)) {
+        state.pending = {
+            text: line.trim(),
+            context: state.parentKind ?? state.headingKind,
+            indent: -2,
+            under: state.headingText,
+            into: state.parentEntry,
+        };
+        return;
+    }
     flush(state);
+    state.parentEntry = null;
     state.pending = { text: line, context: state.headingKind, indent: -1, under: state.headingText };
 }
+/** A heading that is not a release: a category inside the current release, or the end of it. */
+function subHeading(state, raw, level, setext = false) {
+    flush(state);
+    // A setext title ends the release only from a strictly higher level: "text" over
+    // "---" is also how a paragraph followed by a rule reads.
+    if (setext && level >= state.sectionLevel)
+        level = state.sectionLevel + 1;
+    // "## Migration guide" after the last release must not be read as part of it.
+    // A change-category heading ("## Changed", "## Breaking Changes") at the
+    // release's own level is still inside it: date-fns 3.0.0 writes
+    // "## v3.0.0" then "## Changed", and its ten BREAKING entries were dropped.
+    if (state.current && level <= state.sectionLevel && !isCategoryHeading(raw))
+        state.current = null;
+    state.headingKind = classifyHeading(raw);
+    state.headingText = contextText(raw);
+    state.parentKind = null;
+    state.parentIndent = null;
+    state.parentText = null;
+    state.parentEntry = null;
+}
+/**
+ * Setext / RST title level by adornment. Markdown fixes `=` at 1 and `-` at 2;
+ * reStructuredText ranks adornments in the order a document first uses them,
+ * so the rest rank below both, in a fixed order: close enough to compare a
+ * sub-heading with the release title above it.
+ */
+function adornmentLevel(ch) {
+    const order = "=-~^*+#\"'";
+    const i = order.indexOf(ch);
+    return i === -1 ? 3 : i + 1;
+}
 /** Parse a changelog into version sections, in document order (usually newest first). */
 export function parseChangelog(text) {
     const lines = text.replace(/\r\n?/g, "\n").split("\n");
@@ -198,6 +290,7 @@ export function parseChangelog(text) {
         headingText: null,
         parentText: null,
         pending: null,
+        parentEntry: null,
     };
     let inFence = false;
     let inComment = false;
@@ -231,30 +324,30 @@ export function parseChangelog(text) {
             const level = atx[1].length;
             if (heading)
                 openSection(state, heading, level);
-            else {
-                flush(state);
-                // "## Migration guide" after the last release must not be read as part of it.
-                // A change-category heading ("## Changed", "## Breaking Changes") at the
-                // release's own level is still inside it: date-fns 3.0.0 writes
-                // "## v3.0.0" then "## Changed", and its ten BREAKING entries were dropped.
-                if (state.current && level <= state.sectionLevel && !isCategoryHeading(atx[2]))
-                    state.current = null;
-                state.headingKind = classifyHeading(atx[2]);
-                state.headingText = contextText(atx[2]);
-                state.parentKind = null;
-                state.parentIndent = null;
-                state.parentText = null;
-            }
+            else
+                subHeading(state, atx[2], level);
             continue;
         }
         const next = lines[i + 1];
-        if (next !== undefined && SETEXT_RULE.test(next) && line.trim() !== "" && !BULLET.test(line)) {
+        if (next !== undefined && SETEXT_RULE.test(next) && line.trim() !== "" && !BULLET.test(line) && !SETEXT_RULE.test(line)) {
+            const level = adornmentLevel(next.trim()[0]);
             const heading = parseVersionHeading(line);
+            i++;
             if (heading) {
-                openSection(state, heading, next.trim().startsWith("=") ? 1 : 2);
-                i++;
+                openSection(state, heading, level);
                 continue;
             }
+            // A non-release setext / RST title is a sub-heading ("Breaking Changes" over
+            // `~~~~`), as an ATX one is: it was an entry until parser version 3.
+            subHeading(state, line, level, true);
+            continue;
+        }
+        // `Released 2023-09-30` right under an RST release title is its date, not a change (flask, werkzeug, click).
+        const released = state.current && state.current.entries.length === 0 && !state.pending ? RELEASED_LINE.exec(line) : null;
+        if (released && (released[1] === undefined || extractDate(released[1]) || /^(?:unreleased|tbd|-)?$/i.test(released[1].trim()))) {
+            if (released[1])
+                state.current.date ??= extractDate(released[1]);
+            continue;
         }
         // History.md style without an underline: `1.2.3 / 2020-01-01` alone on a line.
         const history = new RegExp(String.raw `^v?(${VERSION})\s+/\s+(.+)$`).exec(line.trim());
@@ -288,6 +381,7 @@ export function parseChangelog(text) {
             state.parentKind = null;
             state.parentIndent = null;
             state.parentText = null;
+            state.parentEntry = null;
             continue;
         }
         if (state.current)
@@ -296,10 +390,10 @@ export function parseChangelog(text) {
     flush(state);
     return state.sections;
 }
-/** True when `version` lies in (from, to] by semver precedence; unreadable versions are out. */
-export function inRange(version, from, to) {
-    const lower = compareVersionPrecedence(version, from);
-    const upper = compareVersionPrecedence(version, to);
+/** True when `version` lies in (from, to] by `order`; unreadable versions are out. */
+export function inRange(version, from, to, order = compareVersionPrecedence) {
+    const lower = order(version, from);
+    const upper = order(version, to);
     return lower !== null && upper !== null && lower > 0 && upper <= 0;
 }
 /**
@@ -309,10 +403,10 @@ export function inRange(version, from, to) {
  * stopped being maintained two majors ago is reported as not covering the
  * range instead of silently presenting a partial history as the whole one.
  */
-export function selectRange(sections, from, to, firstInRange) {
-    const readable = sections.filter((s) => compareVersionPrecedence(s.version, s.version) !== null);
-    const selected = readable.filter((s) => inRange(s.version, from, to));
-    const reachesTop = readable.some((s) => (compareVersionPrecedence(s.version, to) ?? -1) >= 0);
-    const reachesBottom = readable.some((s) => (compareVersionPrecedence(s.version, firstInRange) ?? 1) <= 0);
+export function selectRange(sections, from, to, firstInRange, order = compareVersionPrecedence) {
+    const readable = sections.filter((s) => order(s.version, s.version) !== null);
+    const selected = readable.filter((s) => inRange(s.version, from, to, order));
+    const reachesTop = readable.some((s) => (order(s.version, to) ?? -1) >= 0);
+    const reachesBottom = readable.some((s) => (order(s.version, firstInRange) ?? 1) <= 0);
     return { sections: selected, coversRange: selected.length > 0 && reachesTop && reachesBottom };
 }

package/dist/live/dev-scope.d.ts

@@ -13,7 +13,7 @@
  * claim a certainty the app itself does not have. The grade would not change
  * (unknown and runtime both get no discount), but `dev_scope_known` would lie.
  */
-import type Database from "better-sqlite3";
+import type { SqliteDatabase } from "../sqlite-driver.js";
 import type { ResolvedDependency } from "./types.js";
 /**
  * A project path in the app's storage form: forward slashes, lowercased on
@@ -29,4 +29,4 @@ export declare function canonicalStoragePath(p: string): string;
  * dependencies are untouched: their manifest already says. Returns new
  * objects; never throws; a database without the table changes nothing.
  */
-export declare function applyInstanceDevScope(db: Database.Database | null, deps: ResolvedDependency[]): ResolvedDependency[];
+export declare function applyInstanceDevScope(db: SqliteDatabase | null, deps: ResolvedDependency[]): ResolvedDependency[];

package/dist/live/fix-paths.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Fix paths for vulnerable dependencies: WHICH version to move to, and HOW.
+ *
+ * Two defects found by the fix-path oracle (2026-10-10, 19 public repos;
+ * each recommendation applied in a copy, re-resolved, re-scanned):
+ *
+ * 1. The target could itself be vulnerable. It was the highest fix among the
+ *    advisories that affect the installed version, so an advisory the
+ *    installed version predates was never consulted: openssl 0.10.38 was sent
+ *    to 0.10.79, which GHSA-phqj-4mhp-q6mq affects (0.10.50 up to 0.10.80).
+ *    Now: the smallest published version at or above every per-advisory fix
+ *    that NO advisory of the package affects (osv-ranges.ts).
+ * 2. Every transitive finding was "waiting on upstream", 3 wrong out of 3:
+ *    minimist 1.2.5 (npm), braces 3.0.2 (pnpm) and mio 0.8.0 (Cargo) all had
+ *    parents whose declared requirement already admitted the fix, and a
+ *    lockfile refresh fixed each one. Now: the parents' requirements are
+ *    read (from the lockfile, or from the parent's registry metadata for
+ *    pnpm and Cargo) and a refresh is recommended when they all admit a
+ *    clean version.
+ *
+ * Network: api.osv.dev (one /v1/query per vulnerable package) and the
+ * package's own registry; package names and versions only. Every lookup is
+ * cached, and any failure degrades to the old answer, never to a guess.
+ */
+import type { LiveCache } from "./cache.js";
+import type { RateLimiter } from "./rate-limiter.js";
+import { type AdvisoryRanges, type CleanTarget } from "./osv-ranges.js";
+import { type LockfileFormat } from "./lockfile-parents.js";
+import type { OsvEcosystem } from "./types.js";
+export interface CrateDepReq {
+    req: string;
+    optional: boolean;
+}
+export interface CratesSparse {
+    /** Versions not yanked. */
+    versions: string[];
+    /** version -> dependency crate name -> requirements (one per target/kind entry; dev-dependencies left out). */
+    reqs: Record<string, Record<string, CrateDepReq[]>>;
+}
+export declare class FixPathSources {
+    private cache;
+    private rateLimiter;
+    constructor(cache: LiveCache, rateLimiter: RateLimiter);
+    /** Every non-withdrawn OSV advisory for a package, as ranges; null when OSV could not be read. */
+    packageAdvisories(ecosystem: OsvEcosystem, name: string): Promise<AdvisoryRanges[] | null>;
+    /** Published, installable versions (not yanked); null when the registry could not be read or is not supported. */
+    publishedVersions(ecosystem: OsvEcosystem, name: string): Promise<string[] | null>;
+    /**
+     * The requirements `parent@parentVersion` declares on `dep`, from the
+     * registry: npm (pnpm lockfiles record none) and crates.io (Cargo.lock
+     * records none). Null when unknown; [] when the parent declares none.
+     */
+    parentRequirements(ecosystem: OsvEcosystem, parent: string, parentVersion: string, dep: string): Promise<string[] | null>;
+    private npmVersions;
+    /** A crate's sparse-index record: versions and per-version dependency requirements. */
+    cratesSparse(name: string): Promise<CratesSparse | null>;
+    private pypiVersions;
+    private goVersions;
+}
+export type FixTargetResult = CleanTarget;
+/** The minimal clean target for one installed copy, or null when the advisories could not be read. */
+export declare function cleanFixTarget(sources: FixPathSources, ecosystem: OsvEcosystem, name: string, perAdvisoryFixes: string[]): Promise<FixTargetResult | null>;
+/**
+ * Verified targets for many installed copies at once, within a time budget:
+ * the copies that could not be checked in time (or offline) are simply
+ * absent from the result, and the caller says so. Keyed by `key`.
+ */
+export declare function verifyFixTargets(sources: FixPathSources | null, items: Array<{
+    key: string;
+    ecosystem: OsvEcosystem;
+    name: string;
+    fixes: string[];
+}>, budgetMs: number, concurrency?: number): Promise<Map<string, CleanTarget>>;
+/** One clause for a target that is not the highest per-advisory fix, or null when it is. */
+export declare function targetNote(clean: CleanTarget): string | null;
+export interface RefreshVerdict {
+    /** True when every parent's requirement already admits a clean version. */
+    refreshFixes: boolean;
+    format: LockfileFormat;
+    /** The command, run in the lockfile's directory. */
+    command: string;
+    /** Parent requirements that do NOT admit a clean version (why it is waiting on upstream). */
+    blocking: Array<{
+        parent: string;
+        parentVersion: string | null;
+        requirement: string;
+    }>;
+    /** The version a refresh resolves to, when the registry's version list was read. */
+    resolvesTo: string | null;
+}
+/** The refresh command for one lockfile format. */
+export declare function refreshCommand(format: LockfileFormat, name: string, installed: string, target: string): string;
+/**
+ * Whether refreshing `lockfile` moves `name@installed` to a clean version
+ * without any parent changing its declared requirement. Null when the
+ * lockfile or a requirement cannot be read (the caller keeps "waiting on
+ * upstream", the conservative answer).
+ */
+export declare function refreshVerdict(sources: FixPathSources, ecosystem: OsvEcosystem, lockfile: string, name: string, installed: string, target: string, advisories: AdvisoryRanges[] | null, published: string[] | null): Promise<RefreshVerdict | null>;
+/**
+ * The locked crates `cargo update -p name@installed --precise target` cannot
+ * move by itself, as `crate@lockedVersion` specs to update first; null when it
+ * cannot be worked out (a registry read failed, or the walk is too large).
+ *
+ * Measured on nushell (2026-10-10): `cargo update -p openssl@0.10.38
+ * --precise 0.10.80` fails. 0.10.80 needs openssl-macros 0.1.1 -> syn 2 ->
+ * quote ^1.0.25, and quote 1.0.15 is locked by rstest, outside openssl's own
+ * dependency tree, so cargo keeps it and reports a conflict. `cargo update -p
+ * quote` first, then the precise update, works. Crates in the installed
+ * version's own tree may move with it (openssl-sys did) and are not listed.
+ *
+ * The walk follows the target's normal and build dependencies (optional ones
+ * only when the crate is already in the lockfile): a requirement a locked copy
+ * satisfies is reused; one whose compatibility line holds a locked copy that
+ * does not satisfy it names that copy; anything else is a new crate, walked
+ * at its newest matching version.
+ */
+export declare function cargoPrecisePrerequisites(sources: FixPathSources, lockContent: string, name: string, installed: string, target: string): Promise<string[] | null>;