@4da/mcp-server 6.2.2 → 6.2.3

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 6.2.3 — 2026-10-11
+
+### Yarn 1 refresh instruction covers alias entries
+
+The yarn 1 refresh step said "delete the `<name>@` entries from yarn.lock". A
+yarn 1 block is keyed by every spec that resolved to it, and an alias block's
+first key names the alias (`"string-width-cjs@npm:string-width@^4.2.0"`), so
+following the step left those blocks and kept the vulnerable version. It now
+names both forms: keys `"<name>@…"` and alias keys `"…@npm:<name>@…"`.
+
+### Fix-path parents name the real package
+
+The parent reader behind the fix-path rule ("a lockfile refresh is enough"
+vs "the parent must move") parsed lockfiles with its own code and still had
+the two naming defects 6.2.2 fixed in the package readers. It now names
+packages with the readers' helpers.
+
+- **yarn (v1 and berry): npm aliases.** A parent installed under an alias was
+  reported by the alias: on hono's benchmarks/routers lockfile, string-width
+  4.2.3 and wrap-ansi 7.0.0 were named `string-width-cjs` and `wrap-ansi-cjs`.
+  An aliased dependency edge (`string-width-cjs: "npm:string-width@^4.2.0"`)
+  was never matched, so @isaacs/cliui was missing from string-width 4.2.3's
+  parents, and its range is now the real package's `^4.2.0`.
+- **pnpm 5: entries keyed by a tarball URL.** Such an entry was dropped as a
+  parent and as a dependency: trpc's tarball-keyed @prisma/client 4.7.1 was
+  missing from prisma 4.7.1's parents, and the four workspace projects that
+  depend on it were missing from @prisma/client's. A dependency value that
+  points at another entry (that tarball key, or a pnpm alias's
+  `/real/1.2.3`) is now an edge to the package it installs.
+
 ## 6.2.2 — 2026-10-11
 
 ### Lockfile readers agree with the 4DA conformance corpus

package/dist/live/fix-paths.js

@@ -312,7 +312,10 @@ export function refreshCommand(format, name, installed, target) {
         case "yarn-berry":
             return `yarn up -R ${name}`;
         case "yarn":
-            return `delete the ${name}@ entries from yarn.lock, then run yarn install`;
+            // Yarn 1 has no command that refreshes a transitive copy. Its blocks are keyed
+            // by every spec that resolved to them, and an alias block's first key names
+            // the alias ("string-width-cjs@npm:string-width@^4.2.0"), so name both forms.
+            return `delete every yarn.lock entry that resolves to ${name} (keys "${name}@…" and alias keys "…@npm:${name}@…"), then run yarn install`;
         case "bun":
             return `delete the ${name} entries from bun.lock, then run bun install`;
         case "cargo":

package/dist/live/js-lockfile-readers.d.ts

@@ -17,12 +17,30 @@
  * file, link) is dropped instead of being queried as a package name.
  */
 import type { InstanceSet } from "./lockfile-types.js";
+/** An exact version with pnpm's peer suffixes removed: v6/v9 `1.2.3(react@18)`, v5 `1.2.3_react@18`. */
+export declare function exactVersion(raw: string): string | null;
 /**
  * Splits one `packages:` or `snapshots:` key into [name, version]:
  * v9 `'@scope/pkg@1.2.3(peer@4.5.6)'`, v6 `/pkg@1.2.3`, v5 `/@scope/pkg/1.2.3_peer@4.5.6`.
  * Returns null for a key that does not pin a registry version.
  */
 export declare function parsePnpmKey(rawKey: string): [string, string] | null;
+/** A `packages:`/`snapshots:` key, or a dependency value that points at one, in one spelling: unquoted, no leading `/`. */
+export declare function pnpmKeyRef(raw: string): string;
+export interface PnpmEntryReader {
+    /** One line inside a `packages:` or `snapshots:` section (indent > 0). */
+    line(indent: number, text: string): void;
+    /** Ends the entry being read: call at every section change and at the end of the file. */
+    finish(): void;
+}
+/**
+ * Reads `packages:`/`snapshots:` entries line by line and reports the
+ * registry (name, version) each installs (see pnpmEntryIdentity); entries
+ * that install no registry release are not reported.
+ */
+export declare function pnpmEntryReader(onEntry: (key: string, id: [string, string], dev: boolean | undefined) => void): PnpmEntryReader;
+/** Every `packages:`/`snapshots:` entry's registry (name, version), by pnpmKeyRef of its key. */
+export declare function pnpmEntryIdentities(content: string): Map<string, [string, string]>;
 /**
  * Reads a pnpm lockfile (v5.x, v6 or v9) into `versions`; the first version seen wins.
  *
@@ -37,6 +55,15 @@ export declare function parsePnpmKey(rawKey: string): [string, string] | null;
  * package key. pnpm 9 dropped that field, so its copies have unknown scope.
  */
 export declare function readPnpmLock(content: string, versions: Map<string, string>, instances?: InstanceSet): void;
+/**
+ * The registry package a yarn block installs. An npm alias
+ * (`"string-width-cjs": "npm:string-width@^4.2.0"`) keys the block by the
+ * alias, which is not a package: OSV knows `string-width`, so the alias was
+ * queried for nothing and the real package went unscanned (hono's
+ * benchmarks/routers yarn.lock, 4DA conformance corpus, 2026-10-12). berry
+ * names the real package in `resolution:`; v1 only in the alias spec.
+ */
+export declare function yarnPackageName(block: string, firstLine: string, headerName: string): string;
 /**
  * Reads a yarn lockfile (v1 or berry) into `versions`.
  * v1: `"@scope/pkg@^1.0.0", "@scope/pkg@^1.1.0":` then `  version "1.2.3"`.

package/dist/live/js-lockfile-readers.js

@@ -24,7 +24,7 @@ function unquote(s) {
     return s.length >= 2 && (s[0] === "'" || s[0] === '"') && s[s.length - 1] === s[0] ? s.slice(1, -1) : s;
 }
 /** An exact version with pnpm's peer suffixes removed: v6/v9 `1.2.3(react@18)`, v5 `1.2.3_react@18`. */
-function exactVersion(raw) {
+export function exactVersion(raw) {
     const version = unquote(raw.trim()).split("(")[0].split("_")[0].trim();
     return /^\d/.test(version) ? version : null;
 }
@@ -116,6 +116,60 @@ function pnpmEntryIdentity(entry) {
     }
     return parsed;
 }
+/** A `packages:`/`snapshots:` key, or a dependency value that points at one, in one spelling: unquoted, no leading `/`. */
+export function pnpmKeyRef(raw) {
+    return unquote(raw.trim()).replace(/^\//, "");
+}
+/**
+ * Reads `packages:`/`snapshots:` entries line by line and reports the
+ * registry (name, version) each installs (see pnpmEntryIdentity); entries
+ * that install no registry release are not reported.
+ */
+export function pnpmEntryReader(onEntry) {
+    let entry = null;
+    const finish = () => {
+        const id = entry ? pnpmEntryIdentity(entry) : null;
+        if (entry && id)
+            onEntry(entry.key, id, entry.dev);
+        entry = null;
+    };
+    return {
+        line(indent, text) {
+            if (indent === 2 && text.endsWith(":")) {
+                finish();
+                entry = { key: text.slice(0, -1), inResolution: false, local: false };
+            }
+            else if (entry && indent === 4) {
+                pnpmEntryField(entry, text);
+            }
+            else if (entry?.inResolution && indent > 4) {
+                pnpmResolutionText(entry, text);
+            }
+        },
+        finish,
+    };
+}
+/** Every `packages:`/`snapshots:` entry's registry (name, version), by pnpmKeyRef of its key. */
+export function pnpmEntryIdentities(content) {
+    const ids = new Map();
+    const reader = pnpmEntryReader((key, id) => ids.set(pnpmKeyRef(key), id));
+    let inEntries = false;
+    for (const line of content.split(/\r?\n/)) {
+        const text = line.trim();
+        if (text === "" || text.startsWith("#"))
+            continue;
+        const indent = line.length - line.trimStart().length;
+        if (indent === 0) {
+            reader.finish();
+            inEntries = text === "packages:" || text === "snapshots:";
+        }
+        else if (inEntries) {
+            reader.line(indent, text);
+        }
+    }
+    reader.finish();
+    return ids;
+}
 /**
  * Reads a pnpm lockfile (v5.x, v6 or v9) into `versions`; the first version seen wins.
  *
@@ -139,39 +193,25 @@ export function readPnpmLock(content, versions, instances) {
     let section = "";
     let blockIndent = -1; // column of the dependency block being read, or -1
     let pending = null; // v6/v9: a name whose `version:` line follows
-    let entry = null; // the packages/snapshots entry whose fields are being read
-    const finish = () => {
-        const id = entry ? pnpmEntryIdentity(entry) : null;
-        if (id) {
-            transitive.push(id);
-            if (entry.dev !== undefined)
-                devByKey.set(`${id[0]}\0${id[1]}`, entry.dev);
-        }
-        entry = null;
-    };
+    const entries = pnpmEntryReader((_key, id, dev) => {
+        transitive.push(id);
+        if (dev !== undefined)
+            devByKey.set(`${id[0]}\0${id[1]}`, dev);
+    });
     for (const line of content.split(/\r?\n/)) {
         const text = line.trim();
         if (text === "" || text.startsWith("#"))
             continue;
         const indent = line.length - line.trimStart().length;
         if (indent === 0) {
-            finish();
+            entries.finish();
             section = text.endsWith(":") ? text.slice(0, -1) : "";
             blockIndent = DEPENDENCY_BLOCKS.has(text) ? 0 : -1;
             pending = null;
             continue;
         }
         if (section === "packages" || section === "snapshots") {
-            if (indent === 2 && text.endsWith(":")) {
-                finish();
-                entry = { key: text.slice(0, -1), inResolution: false, local: false };
-            }
-            else if (entry && indent === 4) {
-                pnpmEntryField(entry, text);
-            }
-            else if (entry?.inResolution && indent > 4) {
-                pnpmResolutionText(entry, text);
-            }
+            entries.line(indent, text);
             continue;
         }
         if (section === "importers" && indent <= 4) {
@@ -204,7 +244,7 @@ export function readPnpmLock(content, versions, instances) {
             pending = null;
         }
     }
-    finish();
+    entries.finish();
     for (const [name, version] of transitive)
         setFirst(name, version);
     if (!instances)
@@ -224,7 +264,7 @@ export function readPnpmLock(content, versions, instances) {
  * benchmarks/routers yarn.lock, 4DA conformance corpus, 2026-10-12). berry
  * names the real package in `resolution:`; v1 only in the alias spec.
  */
-function yarnPackageName(block, firstLine, headerName) {
+export function yarnPackageName(block, firstLine, headerName) {
     const resolution = /^\s+resolution:\s+"?((?:@[^\s/@"]+\/)?[^\s/@"]+)@npm:/m.exec(block);
     if (resolution)
         return resolution[1];

package/dist/live/lockfile-parents.d.ts

@@ -45,8 +45,20 @@ export declare function packageLockParents(lock: {
  * dependency blocks resolve `name` to `version`. pnpm records resolved
  * versions only, so `range` is null. Importers (the project's own manifests)
  * become local edges with their `specifier` when the lockfile records one.
+ *
+ * Entries and dependency values are named the way the package reader names
+ * them (pnpmEntryIdentities): a pnpm 5 entry keyed by its tarball URL is the
+ * package its `name:`/`version:` fields say, and a dependency value that is a
+ * key rather than a version (that tarball key, or an alias's
+ * `/real/1.2.3`, `/real@1.2.3`, `real@1.2.3`) is an edge to the package it points at.
  */
 export declare function pnpmParents(content: string, name: string, version: string): ParentEdge[];
+/**
+ * Blocks whose dependencies resolve `name` to `version`. An npm alias edge
+ * (`string-width-cjs: "npm:string-width@^4.2.0"`) is an edge to the real
+ * package, with the real package's range; it resolves through the block whose
+ * spec is `string-width-cjs@npm:string-width@^4.2.0`.
+ */
 export declare function yarnParents(content: string, name: string, version: string): ParentEdge[];
 export declare function bunParents(lock: {
     packages?: Record<string, unknown>;

package/dist/live/lockfile-parents.js

@@ -11,7 +11,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { stripTrailingCommas } from "./bun-lockfile.js";
-import { parsePnpmKey } from "./js-lockfile-readers.js";
+import { exactVersion, parsePnpmKey, pnpmEntryIdentities, pnpmKeyRef, yarnPackageName } from "./js-lockfile-readers.js";
 import { packageNameFromNodeModulesPath, parseCargoLockPackages } from "./lockfile-parsers.js";
 const DEP_FIELDS = ["dependencies", "optionalDependencies", "peerDependencies"];
 /** The lockfile format of a path, or null for a file this module does not read. */
@@ -123,18 +123,32 @@ export function packageLockParents(lock, name, version) {
 // ---------------------------------------------------------------------------
 // pnpm-lock.yaml (v5, v6, v9)
 // ---------------------------------------------------------------------------
-function exactVersion(raw) {
-    const unquoted = raw.trim().replace(/^['"]|['"]$/g, "");
-    const v = unquoted.split("(")[0].split("_")[0].trim();
-    return /^\d/.test(v) ? v : null;
-}
 /**
  * Parents from `packages:` (v5/v6) or `snapshots:` (v9) entries whose
  * dependency blocks resolve `name` to `version`. pnpm records resolved
  * versions only, so `range` is null. Importers (the project's own manifests)
  * become local edges with their `specifier` when the lockfile records one.
+ *
+ * Entries and dependency values are named the way the package reader names
+ * them (pnpmEntryIdentities): a pnpm 5 entry keyed by its tarball URL is the
+ * package its `name:`/`version:` fields say, and a dependency value that is a
+ * key rather than a version (that tarball key, or an alias's
+ * `/real/1.2.3`, `/real@1.2.3`, `real@1.2.3`) is an edge to the package it points at.
  */
 export function pnpmParents(content, name, version) {
+    const ids = pnpmEntryIdentities(content);
+    /** The (name, version) a dependency line installs: `dep: 1.2.3`, or a value that points at an entry. */
+    const installs = (dep, value) => {
+        const exact = exactVersion(value);
+        if (exact)
+            return [dep, exact];
+        const ref = pnpmKeyRef(value);
+        return ids.get(ref) ?? parsePnpmKey(ref);
+    };
+    const isTarget = (dep, value) => {
+        const id = installs(dep, value);
+        return id !== null && id[0] === name && id[1] === version;
+    };
     const edges = [];
     const seen = new Set();
     let section = "";
@@ -142,7 +156,7 @@ export function pnpmParents(content, name, version) {
     let importer = null;
     let inDeps = false;
     let depIndent = -1;
-    let pendingImporterDep = false;
+    let pendingDep = null;
     let importerSpecifier = null;
     const add = (edge) => {
         const key = `${edge.parent}\0${edge.parentVersion}`;
@@ -166,7 +180,7 @@ export function pnpmParents(content, name, version) {
         }
         if (section === "packages" || section === "snapshots") {
             if (indent === 2 && text.endsWith(":")) {
-                parent = parsePnpmKey(text.slice(0, -1));
+                parent = ids.get(pnpmKeyRef(text.slice(0, -1))) ?? null;
                 inDeps = false;
             }
             else if (indent === 4 && parent) {
@@ -174,7 +188,7 @@ export function pnpmParents(content, name, version) {
             }
             else if (indent === 6 && parent && inDeps) {
                 const m = /^(?:'([^']+)'|"([^"]+)"|([^\s:'"]+)):\s*(.+)$/.exec(text);
-                if (m && (m[1] ?? m[2] ?? m[3]) === name && exactVersion(m[4]) === version) {
+                if (m && isTarget(m[1] ?? m[2] ?? m[3], m[4])) {
                     add({ parent: parent[0], parentVersion: parent[1], range: null, local: false });
                 }
             }
@@ -197,21 +211,23 @@ export function pnpmParents(content, name, version) {
         // A dependency of the project itself: v5 `name: 1.2.3`, v6/v9 `name:` + `specifier:` + `version:`.
         if (indent === depIndent + 2) {
             const m = /^(?:'([^']+)'|"([^"]+)"|([^\s:'"]+)):(?:\s+(.*))?$/.exec(text);
-            pendingImporterDep = !!m && (m[1] ?? m[2] ?? m[3]) === name;
+            pendingDep = m ? m[1] ?? m[2] ?? m[3] : null;
             importerSpecifier = null;
-            if (pendingImporterDep && m?.[4] && exactVersion(m[4]) === version) {
-                add({ parent: importer, parentVersion: null, range: null, local: true });
-                pendingImporterDep = false;
+            if (pendingDep && m?.[4]) {
+                if (isTarget(pendingDep, m[4]))
+                    add({ parent: importer, parentVersion: null, range: null, local: true });
+                pendingDep = null;
             }
         }
-        else if (indent === depIndent + 4 && pendingImporterDep) {
+        else if (indent === depIndent + 4 && pendingDep) {
             const spec = /^specifier:\s*(.+)$/.exec(text);
             if (spec)
                 importerSpecifier = spec[1].replace(/^['"]|['"]$/g, "");
             const ver = /^version:\s*(.+)$/.exec(text);
-            if (ver && exactVersion(ver[1]) === version) {
-                add({ parent: importer, parentVersion: null, range: importerSpecifier, local: true });
-                pendingImporterDep = false;
+            if (ver) {
+                if (isTarget(pendingDep, ver[1]))
+                    add({ parent: importer, parentVersion: null, range: importerSpecifier, local: true });
+                pendingDep = null;
             }
         }
     }
@@ -226,9 +242,11 @@ function parseYarnBlocks(content) {
     for (const block of content.split(/\r?\n(?=\S)/)) {
         const lines = block.split(/\r?\n/);
         const header = lines[0];
-        const name = /^"?(@?[^@\s"]+)@/.exec(header)?.[1];
-        if (!name || name.startsWith("__"))
+        const headerName = /^"?(@?[^@\s"]+)@/.exec(header)?.[1];
+        if (!headerName || headerName.startsWith("__"))
             continue;
+        // An npm alias block (`string-width-cjs@npm:string-width@^4.2.0`) installs the real package.
+        const name = yarnPackageName(block, header, headerName);
         const version = /^\s+version:?\s+"?([^"\s]+)"?\s*$/m.exec(block)?.[1];
         if (!version)
             continue;
@@ -260,21 +278,27 @@ function parseYarnBlocks(content) {
     }
     return blocks;
 }
+/**
+ * Blocks whose dependencies resolve `name` to `version`. An npm alias edge
+ * (`string-width-cjs: "npm:string-width@^4.2.0"`) is an edge to the real
+ * package, with the real package's range; it resolves through the block whose
+ * spec is `string-width-cjs@npm:string-width@^4.2.0`.
+ */
 export function yarnParents(content, name, version) {
     const blocks = parseYarnBlocks(content);
     const resolved = new Map();
     for (const b of blocks)
         for (const spec of b.specs)
-            resolved.set(spec, b.version);
+            resolved.set(spec, b);
     const edges = [];
     for (const b of blocks) {
         for (const [dep, rawRange] of b.deps) {
-            if (dep !== name)
-                continue;
-            const range = rawRange.replace(/^npm:/, "");
-            if (resolved.get(`${name}@${range}`) !== version)
+            const spec = rawRange.replace(/^npm:/, "");
+            const target = resolved.get(`${dep}@${spec}`);
+            if (!target || target.name !== name || target.version !== version)
                 continue;
-            edges.push({ parent: b.name, parentVersion: b.version, range, local: false });
+            const alias = /^npm:((?:@[^\s/@]+\/)?[^\s/@]+)@(.+)$/.exec(rawRange);
+            edges.push({ parent: b.name, parentVersion: b.version, range: alias ? alias[2] : spec, local: false });
         }
     }
     return edges;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@4da/mcp-server",
-  "version": "6.2.2",
+  "version": "6.2.3",
   "mcpName": "io.github.4DA-Systems/4da-mcp-server",
   "description": "Upgrade intelligence for AI coding agents: what changes between your installed and target version (changelog, breaking changes, the files you import it from), a pre-install verdict on each bump, vulnerability scanning at osv-scanner parity across npm/pnpm/yarn, Cargo, Python and Go lockfiles, ranked upgrade plans, task-scoped briefings, decision memory. Local, no account; works standalone, and adds the 4DA desktop app's signals, knowledge gaps and stack-judged news when it is installed.",
   "type": "module",