@4da/mcp-server 6.2.3 → 6.2.5

package/dist/live/withdrawn-releases.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Which releases a registry has withdrawn, so that no fix target is ever one
+ * of them (4DA FX-H5, the app's `osv/release_facts.rs`; the rule the shared
+ * fix_target vectors pin, README "Optional fix_target registry fields").
+ *
+ * - crates.io: `yanked`.
+ * - PyPI: a release whose every file is `yanked` (PEP 592).
+ * - npm: `deprecated`, but ONLY when a later, non-deprecated, stable release
+ *   exists on the same caret line (same major; same minor for 0.x). npm's
+ *   `deprecated` is often a whole-major "please upgrade" notice rather than a
+ *   withdrawn release: glob deprecates 160 of its 168 versions ("Old versions
+ *   of glob are not supported"), 10.5.0 included, and excluding them all sent
+ *   glob 10.4.5 to 12.0.0, a major jump. lodash 4.18.0 ("Bad release") is
+ *   excluded because 4.18.1 is clean on 4.x. A package whose `latest` is
+ *   itself deprecated (retired whole) excludes nothing.
+ *
+ * Pure functions; the registry readers (fix-paths.ts, npm-packument.ts) call
+ * them on what they already fetched.
+ */
+import type { PackageReleaseIndex } from "./release-metadata.js";
+/**
+ * dependency_check's view: every release of `index` that is never a candidate, with the
+ * registry's words. Withdrawn records (crates.io/PyPI yanked, npm unpublished, Go retracted:
+ * none of them installable as asked) plus the npm deprecations the rule above withdraws.
+ */
+export declare function excludedReleases(index: PackageReleaseIndex): Map<string, string>;
+/** npm's per-version `deprecated`: a non-empty message, or `true` (the app's `npm_deprecated`). */
+export declare function isNpmDeprecated(value: unknown): boolean;
+/**
+ * The npm releases to exclude as fix targets, from a packument's `versions`
+ * (version -> its `deprecated`) and `dist-tags.latest` (see the module notes).
+ */
+export declare function npmExcludedVersions(deprecation: Record<string, unknown>, latest: string | null | undefined): string[];
+/** How a registry names a withdrawal, for the release `version`. */
+export declare function withdrawalText(ecosystem: string, version: string, detail?: string | null): string;
+/**
+ * The withdrawn releases in plain words, releases with the same reason said once:
+ * "7.5.3, 7.5.4 and 7.5.5 are deprecated on npm ("Old versions of tar ...")".
+ */
+export declare function sayWithdrawn(versions: string[], why: Record<string, string>, ecosystem: string): string;
+/**
+ * The plain-words note for a target moved past withdrawn releases, or for no
+ * target because every release that would fix it was withdrawn (the app's
+ * Upgrade Plan wording: "No installable fix").
+ *   "4.18.0 is deprecated on npm ("Bad release..."); 4.18.1 is the smallest clean release"
+ *   "No installable fix: 0.3.17 is yanked on crates.io, and no later release is known to clear it"
+ * `why` holds the registry's own text per withdrawn release (withdrawalText).
+ * `clean: false`: the target clears only the advisories a release fixes.
+ */
+export declare function withheldNote(withheld: string[], target: string | null, why: Record<string, string>, ecosystem: string, clean?: boolean): string | null;

package/dist/live/withdrawn-releases.js

@@ -0,0 +1,125 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Which releases a registry has withdrawn, so that no fix target is ever one
+ * of them (4DA FX-H5, the app's `osv/release_facts.rs`; the rule the shared
+ * fix_target vectors pin, README "Optional fix_target registry fields").
+ *
+ * - crates.io: `yanked`.
+ * - PyPI: a release whose every file is `yanked` (PEP 592).
+ * - npm: `deprecated`, but ONLY when a later, non-deprecated, stable release
+ *   exists on the same caret line (same major; same minor for 0.x). npm's
+ *   `deprecated` is often a whole-major "please upgrade" notice rather than a
+ *   withdrawn release: glob deprecates 160 of its 168 versions ("Old versions
+ *   of glob are not supported"), 10.5.0 included, and excluding them all sent
+ *   glob 10.4.5 to 12.0.0, a major jump. lodash 4.18.0 ("Bad release") is
+ *   excluded because 4.18.1 is clean on 4.x. A package whose `latest` is
+ *   itself deprecated (retired whole) excludes nothing.
+ *
+ * Pure functions; the registry readers (fix-paths.ts, npm-packument.ts) call
+ * them on what they already fetched.
+ */
+import { comparePrecedence, parseSemverPrecedence } from "./semver-precedence.js";
+/**
+ * dependency_check's view: every release of `index` that is never a candidate, with the
+ * registry's words. Withdrawn records (crates.io/PyPI yanked, npm unpublished, Go retracted:
+ * none of them installable as asked) plus the npm deprecations the rule above withdraws.
+ */
+export function excludedReleases(index) {
+    const out = new Map();
+    const releases = Object.values(index.releases);
+    for (const r of releases) {
+        if (r.withdrawn)
+            out.set(r.version, r.withdrawn === "yanked" ? withdrawalText(index.ecosystem, r.version) : `${r.version} was ${r.withdrawn} from the registry`);
+    }
+    if (index.ecosystem === "npm") {
+        const live = Object.fromEntries(releases.filter((r) => !r.withdrawn).map((r) => [r.version, r.deprecated]));
+        for (const v of npmExcludedVersions(live, index.latest))
+            out.set(v, withdrawalText("npm", v, index.releases[v]?.deprecated));
+    }
+    return out;
+}
+/** npm's per-version `deprecated`: a non-empty message, or `true` (the app's `npm_deprecated`). */
+export function isNpmDeprecated(value) {
+    return (typeof value === "string" && value !== "") || value === true;
+}
+/**
+ * The npm releases to exclude as fix targets, from a packument's `versions`
+ * (version -> its `deprecated`) and `dist-tags.latest` (see the module notes).
+ */
+export function npmExcludedVersions(deprecation, latest) {
+    if (latest && latest in deprecation && isNpmDeprecated(deprecation[latest]))
+        return [];
+    const clean = Object.entries(deprecation)
+        .filter(([, d]) => !isNpmDeprecated(d))
+        .map(([v]) => parseSemverPrecedence(v))
+        .filter((p) => p !== null && p.prerelease.length === 0);
+    return Object.entries(deprecation)
+        .filter(([, d]) => isNpmDeprecated(d))
+        .filter(([v]) => {
+        const p = parseSemverPrecedence(v);
+        return p !== null && clean.some((c) => c.major === p.major && (p.major > 0 || c.minor === p.minor) && comparePrecedence(c, p) > 0);
+    })
+        .map(([v]) => v);
+}
+/** How a registry names a withdrawal, for the release `version`. */
+export function withdrawalText(ecosystem, version, detail) {
+    const quoted = detail?.trim() ? ` ("${clip(detail.trim(), 120)}")` : "";
+    switch (ecosystem) {
+        case "npm":
+            return `${version} is deprecated on npm${quoted}`;
+        case "crates.io":
+            return `${version} is yanked on crates.io`;
+        case "PyPI":
+            return `${version} is yanked on PyPI${quoted}`;
+        default:
+            return `${version} is withdrawn on the registry${quoted}`;
+    }
+}
+/** At most `max` characters, cut at a word, "..." when cut. */
+function clip(text, max) {
+    if (text.length <= max)
+        return text;
+    const cut = text.slice(0, max);
+    return `${cut.slice(0, Math.max(cut.lastIndexOf(" "), max / 2)).replace(/[\s,;:.]+$/, "")}...`;
+}
+/**
+ * The withdrawn releases in plain words, releases with the same reason said once:
+ * "7.5.3, 7.5.4 and 7.5.5 are deprecated on npm ("Old versions of tar ...")".
+ */
+export function sayWithdrawn(versions, why, ecosystem) {
+    const groups = [];
+    for (const v of versions) {
+        const text = why[v] ?? withdrawalText(ecosystem, v);
+        const rest = text.startsWith(`${v} is `) ? text.slice(v.length + " is ".length) : null;
+        const last = groups[groups.length - 1];
+        if (rest !== null && last && last.rest === rest)
+            last.versions.push(v);
+        else
+            groups.push({ rest: rest ?? text, versions: rest === null ? [] : [v] });
+    }
+    return groups
+        .map((g) => {
+        if (g.versions.length === 0)
+            return g.rest;
+        const names = g.versions.length === 1 ? g.versions[0] : `${g.versions.slice(0, -1).join(", ")} and ${g.versions[g.versions.length - 1]}`;
+        return `${names} ${g.versions.length === 1 ? "is" : "are"} ${g.rest}`;
+    })
+        .join("; ");
+}
+/**
+ * The plain-words note for a target moved past withdrawn releases, or for no
+ * target because every release that would fix it was withdrawn (the app's
+ * Upgrade Plan wording: "No installable fix").
+ *   "4.18.0 is deprecated on npm ("Bad release..."); 4.18.1 is the smallest clean release"
+ *   "No installable fix: 0.3.17 is yanked on crates.io, and no later release is known to clear it"
+ * `why` holds the registry's own text per withdrawn release (withdrawalText).
+ * `clean: false`: the target clears only the advisories a release fixes.
+ */
+export function withheldNote(withheld, target, why, ecosystem, clean = true) {
+    if (withheld.length === 0)
+        return null;
+    const said = sayWithdrawn(withheld, why, ecosystem);
+    if (!target)
+        return `No installable fix: ${said}, and no later release is known to clear it — pin, patch, or replace`;
+    return `${said}; ${target} is the smallest ${clean ? "clean release" : "installable release that clears the advisories a release fixes"}`;
+}

package/dist/project-manifests.d.ts

@@ -26,6 +26,13 @@ export declare function parsePyprojectDependencies(content: string): {
 };
 /** Requirement names (pins and ranges alike) from a requirements file, PEP 503 normalised. */
 export declare function parseRequirementNames(content: string): string[];
+/**
+ * Requirement names from a requirements file and every file it includes with `-r` (confined to
+ * `root`, as the version reader confines them): an included file's pins are declared too. A pin
+ * in `-r sub/inner.txt` read as "Transitive dependency, not declared in your manifest" (final
+ * release audit of 6.2.5, 7g: jinja2==2.10).
+ */
+export declare function requirementNamesWithIncludes(file: string, root?: string, visited?: Set<string>): string[];
 /** Direct Go dependencies: go.mod requirements not marked `// indirect`. */
 export declare function parseGoModDirectDeps(content: string): string[];
 /**

package/dist/project-manifests.js

@@ -15,7 +15,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { normalizePythonName, parseGoMod } from "./live/lockfile-parsers-pygo.js";
+import { compiledIndirect, compiledRequirements, confinedInclude, normalizePythonName, parseGoMod, requirementOptions } from "./live/lockfile-parsers-pygo.js";
 /** The body of a TOML table (`[name]`) up to the next table header, or null. */
 export function tomlTable(content, name) {
     const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -130,6 +130,37 @@ export function parseRequirementNames(content) {
     }
     return [...new Set(names)];
 }
+/**
+ * Requirement names from a requirements file and every file it includes with `-r` (confined to
+ * `root`, as the version reader confines them): an included file's pins are declared too. A pin
+ * in `-r sub/inner.txt` read as "Transitive dependency, not declared in your manifest" (final
+ * release audit of 6.2.5, 7g: jinja2==2.10).
+ */
+export function requirementNamesWithIncludes(file, root = path.dirname(path.resolve(file)), visited = new Set()) {
+    const key = path.resolve(file).toLowerCase();
+    if (visited.has(key))
+        return [];
+    visited.add(key);
+    let content;
+    try {
+        content = fs.readFileSync(file, "utf-8");
+    }
+    catch {
+        return [];
+    }
+    // A compiled file pins its whole tree: a pin there only because other packages require it
+    // (`# via requests`) is transitive, as go.mod's `// indirect` is (audit 6.2.5 A-4).
+    const compiled = compiledRequirements(content);
+    const names = parseRequirementNames(content).filter((n) => !compiled || !compiledIndirect(compiled, n));
+    for (const { option, target } of requirementOptions(content)) {
+        if (option !== "r")
+            continue;
+        const included = confinedInclude(path.dirname(file), target, root);
+        if (included)
+            names.push(...requirementNamesWithIncludes(included, root, visited));
+    }
+    return [...new Set(names)];
+}
 /** Direct Go dependencies: go.mod requirements not marked `// indirect`. */
 export function parseGoModDirectDeps(content) {
     return parseGoMod(content)
@@ -162,12 +193,15 @@ export function cargoWorkspaceDeps(root, content) {
             const name = /^name\s*=\s*"([^"]+)"/m.exec(tomlTable(manifest, "package") ?? "")?.[1];
             if (name)
                 memberNames.add(name);
-            for (const dep of tomlKeys(tomlTable(manifest, "dependencies")))
-                deps.add(dep);
-            for (const section of ["dev-dependencies", "build-dependencies"]) {
+            // build-dependencies run at build time on every machine that builds the crate: they are not
+            // dev-only (the app reads them as normal), and discounting them hid memoffset with
+            // include_dev: false (audit 6.2.5 F-3).
+            for (const section of ["dependencies", "build-dependencies"]) {
                 for (const dep of tomlKeys(tomlTable(manifest, section)))
-                    devDeps.add(dep);
+                    deps.add(dep);
             }
+            for (const dep of tomlKeys(tomlTable(manifest, "dev-dependencies")))
+                devDeps.add(dep);
         }
     }
     const strip = (set) => [...set].filter((d) => !memberNames.has(d));
@@ -176,6 +210,12 @@ export function cargoWorkspaceDeps(root, content) {
 }
 /** Member directories for one `members` entry: a path, or a path whose last segment is `*`. */
 function expandMemberGlob(root, pattern) {
+    // `members = ["../outside/*"]` was followed out of the project: manifests outside it were read
+    // and their dependency names sent to the registries (audit 6.2.5 C-4). Members must resolve inside.
+    const inside = (dir) => confinedInclude(root, path.relative(root, dir), root) !== null;
+    return expandMemberGlobUnconfined(root, pattern).filter(inside);
+}
+function expandMemberGlobUnconfined(root, pattern) {
     if (!pattern.includes("*"))
         return [path.join(root, pattern)];
     const star = pattern.indexOf("*");

package/dist/project-scanner.js

@@ -13,7 +13,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { cargoWorkspaceDeps, parseGoModDirectDeps, parsePyprojectDependencies, parseRequirementNames, } from "./project-manifests.js";
+import { cargoWorkspaceDeps, parseGoModDirectDeps, parsePyprojectDependencies, requirementNamesWithIncludes, } from "./project-manifests.js";
 // =============================================================================
 // Framework Detection Maps
 // =============================================================================
@@ -190,7 +190,8 @@ export function scanCurrentProject(cwd) {
             const rustDevDeps = [];
             parseTOMLDependencies(content, "[dependencies]", rustDeps, fwSet, RUST_FRAMEWORK_MAP);
             parseTOMLDependencies(content, "[dev-dependencies]", rustDevDeps, fwSet, RUST_FRAMEWORK_MAP);
-            parseTOMLDependencies(content, "[build-dependencies]", rustDevDeps, fwSet, RUST_FRAMEWORK_MAP);
+            // build-dependencies run at build time on every machine that builds the crate: normal, not dev (audit 6.2.5 F-3).
+            parseTOMLDependencies(content, "[build-dependencies]", rustDeps, fwSet, RUST_FRAMEWORK_MAP);
             // Platform-gated deps: [target.'cfg(...)'.dependencies] / [target.<triple>.dependencies].
             // Previously skipped entirely (e.g. windows-sys, winreg, libc were invisible).
             parseTargetDependencies(content, rustDeps, rustDevDeps, result.depTargets, fwSet, RUST_FRAMEWORK_MAP);
@@ -243,7 +244,8 @@ export function scanCurrentProject(cwd) {
     if (fs.existsSync(requirementsPath)) {
         langSet.add("python");
         try {
-            parseRequirementNames(fs.readFileSync(requirementsPath, "utf-8")).forEach((d) => pyDeps.add(d));
+            // Included files (`-r sub/inner.txt`) declare their pins too (audit 7g).
+            requirementNamesWithIncludes(requirementsPath, cwd).forEach((d) => pyDeps.add(d));
         }
         catch {
             // Skip
@@ -364,7 +366,7 @@ function parseTargetDependencies(content, deps, devDeps, depTargets, frameworkSe
     let m;
     while ((m = headerRegex.exec(content)) !== null) {
         const spec = m[1].trim().replace(/^['"]|['"]$/g, ""); // strip surrounding quotes
-        const isDev = m[2] !== "dependencies";
+        const isDev = m[2] === "dev-dependencies"; // build-dependencies are normal (audit 6.2.5 F-3)
         // Body runs from the end of this header line to the next section header.
         const rest = content.slice(m.index + m[0].length);
         const nextHeader = rest.search(/^\[/m);

package/dist/project-tree.d.ts

@@ -22,6 +22,13 @@
  * lockfile that was left out and say why.
  */
 import { type ProjectScanResult } from "./project-scanner.js";
+/**
+ * Manifests and lockfiles of ecosystems this server does not read, by file
+ * name: reported as `not_covered` so an empty or clean answer is never read
+ * as "no dependencies" (audit A2: a Maven or .NET project was told "No
+ * manifest files found... run from your project root").
+ */
+export declare function unsupportedEcosystem(name: string, names: string[]): string | null;
 /**
  * Measured on langchain (108 lockfiles, up to 3 levels down; 2026-10-10):
  * the walk plus every project scan takes about 2 s. Depth 4 covers it with a
@@ -48,6 +55,18 @@ export interface TreeDiscovery {
     skippedCount: number;
     /** True when the walk itself stopped at MAX_WALK_DIRS: lockfiles beyond it were not even counted. */
     walkTruncated: boolean;
+    /** Manifests and lockfiles of ecosystems this server does not read (the first MAX_LISTED_NOT_COVERED), relative to the root. */
+    notCovered?: Array<{
+        path: string;
+        ecosystem: string;
+    }>;
+    /** Every such file found (`notCovered` may list fewer). */
+    notCoveredCount?: number;
+    /** Lockfiles under test-fixture directories, left out unless include_test_fixtures was set. */
+    fixtures?: {
+        count: number;
+        dirs: string[];
+    };
 }
 /** Python requirement files: requirements.txt, requirements-dev.txt, dev_requirements.txt, _test_minimum_requirements.txt. */
 export declare function isRequirementsFileName(name: string): boolean;
@@ -62,10 +81,47 @@ export declare function lockfilesIn(dir: string, listing?: string[]): string[];
 export declare function scanProjectTree(root: string, limits?: {
     maxDepth: number;
     maxProjects: number;
+}, options?: {
+    includeFixtures?: boolean;
 }): {
     entries: ProjectTreeEntry[];
     discovery: TreeDiscovery;
 };
+/**
+ * The walk's report for `root`, taken once per process. For answers that
+ * had no walk recorded and must not claim "nothing here" unchecked (H3):
+ * vulnerability_scan's "nothing found" message and dependency_health's
+ * nothing-checked answer. Re-walking on every call cost a full tree walk per
+ * call (review of H3, 2026-10-18).
+ */
+export declare function discoveryFor(root: string): TreeDiscovery;
+/** A lockfile problem as the notes read it (lockfile-types.ts LockfileProblem). */
+export type LockfileProblemLike = {
+    file: string;
+    error: string;
+    skipped?: number;
+    refused?: true;
+};
+/**
+ * The three kinds, kept apart: a file that could not be read (UNREADABLE),
+ * one read with entries skipped (`skipped`, PARTIAL: a yarn.lock or
+ * requirements line past the length cap, audit L5), and a requirements
+ * include refused because it points outside the project (`refused`, B-11).
+ */
+export declare function splitLockfileProblems<P extends LockfileProblemLike>(problems: P[]): {
+    unreadable: P[];
+    partial: P[];
+    refused: P[];
+};
+/**
+ * One wording for every tool (vulnerability_scan, dependency_health,
+ * upgrade_planner). `show` renders a path (the scan shows it relative).
+ */
+export declare function lockfileProblemNotes(problems: LockfileProblemLike[], show?: (file: string) => string): string[];
+/** Kept for its importers (upgrade_planner): lockfileProblemNotes. */
+export declare function unreadableNotes(problems: LockfileProblemLike[]): string[];
+/** What a scan left out on purpose or cannot read: ecosystems it does not cover, and test fixtures. */
+export declare function exclusionNotes(discovery: TreeDiscovery | null): string[];
 /** One sentence for an answer, or null when nothing was left out. */
 export declare function discoveryNote(discovery: TreeDiscovery | null): string | null;
 /**

package/dist/project-tree.js

@@ -38,12 +38,57 @@ const LOCK_MARKERS = [
     "pdm.lock",
     "Pipfile.lock",
     "go.mod",
+    "Gemfile.lock",
+    "composer.lock",
 ];
 const SKIP_DIRS = new Set([
     "node_modules", "target", ".git", "dist", "build", "out", "vendor", ".venv", "venv",
-    "__pycache__", ".next", ".nuxt", "coverage", ".claude", ".codex", ".cursor", "fixtures",
-    "__fixtures__", "testdata", "test-fixtures", "__tests__", ".turbo", ".cache", ".pnpm-store",
+    "__pycache__", ".next", ".nuxt", "coverage", ".claude", ".codex", ".cursor",
+    ".turbo", ".cache", ".pnpm-store",
 ]);
+/**
+ * Directories whose lockfiles are test data, not the project's dependencies:
+ * a scan of D:\4DA\src-tauri read the 4DA conformance corpus
+ * (tests/conformance/cases, 10,000+ vendored packages) as the app's own
+ * (audit A3, 2026-10-12). Left out by default, counted and named in the
+ * answer (`not_scanned`), and scanned on request (include_test_fixtures).
+ */
+const FIXTURE_DIRS = new Set([
+    "fixtures", "__fixtures__", "testdata", "test-data", "test-fixtures", "__tests__", "tests", "test", "conformance",
+]);
+/**
+ * Manifests and lockfiles of ecosystems this server does not read, by file
+ * name: reported as `not_covered` so an empty or clean answer is never read
+ * as "no dependencies" (audit A2: a Maven or .NET project was told "No
+ * manifest files found... run from your project root").
+ */
+export function unsupportedEcosystem(name, names) {
+    if (name === "pom.xml")
+        return "Maven";
+    if (/^build\.gradle(\.kts)?$/.test(name) || name === "gradle.lockfile")
+        return "Maven (Gradle)";
+    if (/\.(cs|fs|vb)proj$/i.test(name) || name === "packages.lock.json" || name === "packages.config" || name === "Directory.Packages.props")
+        return "NuGet";
+    if (name === "pubspec.lock")
+        return "Pub";
+    if (name === "mix.lock")
+        return "Hex";
+    if (name === "Package.resolved")
+        return "SwiftPM";
+    if (name === "Podfile.lock")
+        return "CocoaPods";
+    if (name === "conan.lock")
+        return "ConanCenter";
+    if (name === "renv.lock")
+        return "CRAN";
+    if (name === "Gemfile" && !names.includes("Gemfile.lock"))
+        return "RubyGems (Gemfile with no Gemfile.lock)";
+    if (name === "composer.json" && !names.includes("composer.lock"))
+        return "Packagist (composer.json with no composer.lock)";
+    return null;
+}
+/** Entries listed in `notCovered`; the count covers the rest. */
+const MAX_LISTED_NOT_COVERED = 25;
 /**
  * Measured on langchain (108 lockfiles, up to 3 levels down; 2026-10-10):
  * the walk plus every project scan takes about 2 s. Depth 4 covers it with a
@@ -88,13 +133,26 @@ export function lockfilesIn(dir, listing) {
  * repository's .gitignore excludes are not part of the project and are
  * skipped (gitignore.ts); they are not reported as left out either.
  */
-export function scanProjectTree(root, limits = { maxDepth: MAX_DEPTH, maxProjects: MAX_PROJECTS }) {
+export function scanProjectTree(root, limits = { maxDepth: MAX_DEPTH, maxProjects: MAX_PROJECTS }, options = {}) {
     const entries = [{ dir: root, scan: scanCurrentProject(root) }];
     const ignore = new IgnoreRules(root);
     const skipped = [];
     let skippedCount = 0;
     let visited = 0;
     let walkTruncated = false;
+    const notCovered = [];
+    let notCoveredCount = 0;
+    const fixtures = { count: 0, dirs: [] };
+    const noteUnsupported = (rel, names) => {
+        for (const name of names) {
+            const ecosystem = unsupportedEcosystem(name, names);
+            if (!ecosystem)
+                continue;
+            notCoveredCount++;
+            if (notCovered.length < MAX_LISTED_NOT_COVERED)
+                notCovered.push({ path: rel ? `${rel}/${name}` : name, ecosystem });
+        }
+    };
     // One directory listing per directory: it decides both whether the
     // directory is a project and which children to descend into.
     const listing = (dir) => {
@@ -105,6 +163,25 @@ export function scanProjectTree(root, limits = { maxDepth: MAX_DEPTH, maxProject
             return null;
         }
     };
+    // Test-fixture lockfiles: counted, never scanned (unless asked for).
+    const countFixtures = (dir, children) => {
+        for (const child of children) {
+            if (!child.isDirectory() || SKIP_DIRS.has(child.name) || child.name.startsWith("."))
+                continue;
+            if (++visited > MAX_WALK_DIRS) {
+                walkTruncated = true;
+                return;
+            }
+            const sub = path.join(dir, child.name);
+            const grandchildren = listing(sub);
+            if (!grandchildren)
+                continue;
+            fixtures.count += lockfilesIn(sub, grandchildren.map((g) => g.name)).length;
+            countFixtures(sub, grandchildren);
+            if (walkTruncated)
+                return;
+        }
+    };
     const walk = (dir, rel, depth, children) => {
         for (const child of children) {
             if (!child.isDirectory() || SKIP_DIRS.has(child.name) || child.name.startsWith("."))
@@ -120,10 +197,21 @@ export function scanProjectTree(root, limits = { maxDepth: MAX_DEPTH, maxProject
             const grandchildren = listing(sub);
             if (!grandchildren)
                 continue;
+            if (!options.includeFixtures && FIXTURE_DIRS.has(child.name.toLowerCase())) {
+                const before = fixtures.count;
+                fixtures.count += lockfilesIn(sub, grandchildren.map((g) => g.name)).length;
+                countFixtures(sub, grandchildren);
+                if (fixtures.count > before && fixtures.dirs.length < 10)
+                    fixtures.dirs.push(childRel);
+                if (walkTruncated)
+                    return;
+                continue;
+            }
             // A .gitignore is only read where one exists.
             if (grandchildren.some((g) => g.name === ".gitignore"))
                 ignore.load(childRel);
             const names = grandchildren.map((g) => g.name);
+            noteUnsupported(childRel, names.filter((n) => !ignore.ignores(`${childRel}/${n}`, false)));
             const locks = lockfilesIn(sub, names).filter((name) => !ignore.ignores(`${childRel}/${name}`, false));
             if (locks.length > 0) {
                 const reason = depth > limits.maxDepth ? "depth" : entries.length >= limits.maxProjects ? "project_limit" : null;
@@ -142,12 +230,91 @@ export function scanProjectTree(root, limits = { maxDepth: MAX_DEPTH, maxProject
                 return;
         }
     };
-    walk(root, "", 1, listing(root) ?? []);
+    const rootListing = listing(root) ?? [];
+    noteUnsupported("", rootListing.filter((d) => d.isFile()).map((d) => d.name));
+    walk(root, "", 1, rootListing);
     return {
         entries,
-        discovery: { projects: entries.length, maxDepth: limits.maxDepth, maxProjects: limits.maxProjects, skipped, skippedCount, walkTruncated },
+        discovery: {
+            projects: entries.length,
+            maxDepth: limits.maxDepth,
+            maxProjects: limits.maxProjects,
+            skipped,
+            skippedCount,
+            walkTruncated,
+            ...(notCoveredCount > 0 ? { notCovered, notCoveredCount } : {}),
+            ...(fixtures.count > 0 ? { fixtures } : {}),
+        },
     };
 }
+const walkedDiscovery = new Map();
+/**
+ * The walk's report for `root`, taken once per process. For answers that
+ * had no walk recorded and must not claim "nothing here" unchecked (H3):
+ * vulnerability_scan's "nothing found" message and dependency_health's
+ * nothing-checked answer. Re-walking on every call cost a full tree walk per
+ * call (review of H3, 2026-10-18).
+ */
+export function discoveryFor(root) {
+    const key = path.resolve(root).toLowerCase();
+    let found = walkedDiscovery.get(key);
+    if (!found) {
+        found = scanProjectTree(root).discovery;
+        walkedDiscovery.set(key, found);
+    }
+    return found;
+}
+/**
+ * The three kinds, kept apart: a file that could not be read (UNREADABLE),
+ * one read with entries skipped (`skipped`, PARTIAL: a yarn.lock or
+ * requirements line past the length cap, audit L5), and a requirements
+ * include refused because it points outside the project (`refused`, B-11).
+ */
+export function splitLockfileProblems(problems) {
+    return {
+        unreadable: problems.filter((p) => !p.skipped && !p.refused),
+        partial: problems.filter((p) => Boolean(p.skipped) && !p.refused),
+        refused: problems.filter((p) => p.refused === true),
+    };
+}
+/**
+ * One wording for every tool (vulnerability_scan, dependency_health,
+ * upgrade_planner). `show` renders a path (the scan shows it relative).
+ */
+export function lockfileProblemNotes(problems, show = (f) => f) {
+    const listed = (ps) => `${ps.slice(0, 3).map((p) => `${show(p.file)} (${p.error})`).join("; ")}${ps.length > 3 ? "; ..." : ""}`;
+    const { unreadable, partial, refused } = splitLockfileProblems(problems);
+    const notes = [];
+    if (unreadable.length > 0) {
+        notes.push(`UNREADABLE: ${unreadable.length} lockfile${unreadable.length === 1 ? "" : "s"} could not be read, so ${unreadable.length === 1 ? "its" : "their"} dependencies were not checked: ${listed(unreadable)}.`);
+    }
+    if (partial.length > 0) {
+        notes.push(`PARTIAL: ${partial.length} lockfile${partial.length === 1 ? " was" : "s were"} read with entries skipped: ${listed(partial)}.`);
+    }
+    if (refused.length > 0) {
+        notes.push(`REFUSED: ${refused.length} requirements include${refused.length === 1 ? " was" : "s were"} not read: ${listed(refused)}.`);
+    }
+    return notes;
+}
+/** Kept for its importers (upgrade_planner): lockfileProblemNotes. */
+export function unreadableNotes(problems) {
+    return lockfileProblemNotes(problems);
+}
+/** What a scan left out on purpose or cannot read: ecosystems it does not cover, and test fixtures. */
+export function exclusionNotes(discovery) {
+    const notes = [];
+    const unsupported = discovery?.notCoveredCount ?? 0;
+    if (unsupported > 0) {
+        const ecosystems = [...new Set((discovery?.notCovered ?? []).map((n) => n.ecosystem.split(" ")[0]))].join(", ");
+        const listed = (discovery?.notCovered ?? []).slice(0, 3).map((n) => n.path).join(", ");
+        notes.push(`NOT COVERED: ${unsupported} manifest/lockfile${unsupported === 1 ? "" : "s"} of ecosystems this server does not read (${ecosystems}): ${listed}${unsupported > 3 ? ", ..." : ""}. Their dependencies were not checked at all; see not_covered.`);
+    }
+    const fixtures = discovery?.fixtures;
+    if (fixtures && fixtures.count > 0) {
+        notes.push(`Not scanned: ${fixtures.count} test-fixture lockfile${fixtures.count === 1 ? "" : "s"} under ${fixtures.dirs.slice(0, 3).join(", ")}${fixtures.dirs.length > 3 ? ", ..." : ""} (pass include_test_fixtures: true to scan them).`);
+    }
+    return notes;
+}
 /** One sentence for an answer, or null when nothing was left out. */
 export function discoveryNote(discovery) {
     if (!discovery || (discovery.skippedCount === 0 && !discovery.walkTruncated))
@@ -173,6 +340,8 @@ const LOCKS_BY_LANGUAGE = {
     rust: ["Cargo.lock"],
     python: ["poetry.lock", "uv.lock", "pdm.lock", "Pipfile.lock"],
     go: ["go.mod"],
+    ruby: ["Gemfile.lock"],
+    php: ["composer.lock"],
 };
 /**
  * Resolution groups for the live layer: one per (project directory, ecosystem).