@4da/mcp-server 6.2.3 → 6.2.5

package/dist/live/advisory-groups.js

@@ -0,0 +1,131 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * One advisory, many records. OSV publishes the same issue as a GHSA record
+ * and as an ecosystem record (PYSEC, RUSTSEC, GO), each naming the other in
+ * `aliases`. Counting records counted one issue two or three times:
+ * - tokio 1.18.0 showed "6 advisories" for 3 (audit A9);
+ * - pygoat's django "96 known vulnerabilities" for 51 (readiness audit M1, 2026-10-16).
+ * Every count of advisories goes through here.
+ */
+import { isMaintenanceNotice } from "./maintenance.js";
+import { isMalware } from "./malware.js";
+const RANK = { unknown: 0, low: 1, medium: 2, high: 3, critical: 4 };
+/**
+ * Group the records of ONE installed copy by shared ids. The grouping is transitive: a record
+ * naming ids of two groups joins them.
+ */
+export function groupAdvisories(entries) {
+    let groups = [];
+    for (const v of entries ?? []) {
+        const ids = [v.vulnId, ...(v.aliases ?? [])];
+        const hit = groups.filter((g) => ids.some((id) => g.ids.has(id)));
+        const merged = { ids: new Set(ids), best: v, members: [v] };
+        for (const g of hit) {
+            for (const id of g.ids)
+                merged.ids.add(id);
+            merged.members.push(...g.members);
+            if ((RANK[g.best.severity] ?? 0) > (RANK[merged.best.severity] ?? 0))
+                merged.best = g.best;
+        }
+        groups = [...groups.filter((g) => !hit.includes(g)), merged];
+    }
+    return groups;
+}
+/**
+ * THE grade of one alias group, shared with the 4DA app (`fourda_depengine::severity`, vectors
+ * severity.jsonl sv-001..sv-019): the MOST severe OWN grade among the group's records; only when no
+ * record has one, the highest grade among their GHSA aliases that can be read (`aliasGrades`, null =
+ * held but ungraded), the smallest id on a tie. An unmaintained-package notice is never graded
+ * from an alias.
+ */
+export function gradeGroup(records, aliasGrades) {
+    let own = null;
+    for (const r of records) {
+        if (r.own === "unknown")
+            continue;
+        if (!own || RANK[r.own] > RANK[own.grade])
+            own = { id: r.id, grade: r.own };
+    }
+    let severity = null;
+    let inheritedFrom = null;
+    if (own) {
+        severity = own.grade;
+    }
+    else {
+        const ids = new Set(records.map((r) => r.id));
+        const ghsas = [...new Set(records.filter((r) => !r.maintenance).flatMap((r) => r.aliases.filter((a) => /^GHSA-/i.test(a) && !ids.has(a))))].sort();
+        let best = null;
+        for (const id of ghsas) {
+            const g = aliasGrades.get(id);
+            if (!g || g === "unknown")
+                continue;
+            if (!best || RANK[g] > RANK[best.grade])
+                best = { id, grade: g };
+        }
+        if (best) {
+            severity = best.grade;
+            inheritedFrom = best.id;
+        }
+    }
+    // A malicious-package record (malware.ts) is critical (the 4DA lead, 2026-10-18; sv-010 read high).
+    const malicious = records.some((r) => isMalware(r.id, r.aliases, r.cweIds ?? [], r.summary ?? ""));
+    const urgency = malicious
+        ? "critical"
+        : severity === "critical" || severity === "high" || severity === "medium"
+            ? severity
+            : severity === "low"
+                ? "watch"
+                : records.every((r) => r.maintenance)
+                    ? "watch"
+                    : "medium";
+    return { severity, inheritedFrom, ownFrom: own?.id ?? null, urgency };
+}
+/**
+ * One severity per advisory, in every tool (the rule shared with the 4DA app, gradeGroup): within
+ * one alias group of one installed copy, every record carries the group's grade. vulnerability_scan
+ * kept the "richest" record's grade while dependency_check, dependency_health and upgrade_planner
+ * kept the most severe, so CVE-2026-4277 (GHSA-pwjp-ccjc-ghwg rated LOW, PYSEC-2026-52 CVSS 9.8) was
+ * low in one tool and critical in the others (final release audit of 6.2.5, 2026-10-18). A record
+ * that does not carry the grade itself names where it came from (`severityFrom`: the group record,
+ * or the GHSA alias of an inherited grade). A grade a record took from its alias
+ * (osv-scanner.ts rateFromAliases) never overrides an own grade in its group.
+ */
+export function gradeAliasGroups(entries) {
+    const byCopy = new Map();
+    for (const v of entries) {
+        const key = `${v.ecosystem}\u0000${v.package}\u0000${v.currentVersion}\u0000${v.installDriftOf ?? ""}`;
+        byCopy.set(key, [...(byCopy.get(key) ?? []), v]);
+    }
+    const regraded = new Map();
+    for (const copy of byCopy.values()) {
+        for (const group of groupAdvisories(copy)) {
+            if (group.members.length < 2)
+                continue;
+            const inherited = (m) => Boolean(m.severityFrom) && m.severityFrom !== m.vulnId;
+            const aliasGrades = new Map();
+            for (const m of group.members)
+                if (inherited(m))
+                    aliasGrades.set(m.severityFrom, m.severity);
+            const grade = gradeGroup(group.members.map((m) => ({ id: m.vulnId, own: inherited(m) ? "unknown" : m.severity, aliases: [...m.aliases, ...(inherited(m) ? [m.severityFrom] : [])], maintenance: isMaintenanceNotice(m) })), aliasGrades);
+            const severity = grade.severity ?? "unknown";
+            const from = grade.inheritedFrom ?? grade.ownFrom;
+            for (const m of group.members) {
+                if (isMaintenanceNotice(m) && grade.inheritedFrom)
+                    continue;
+                if (m.severity === severity && (!inherited(m) || m.severityFrom === from))
+                    continue;
+                const next = { ...m, severity };
+                if (from && from !== m.vulnId)
+                    next.severityFrom = from;
+                else
+                    delete next.severityFrom;
+                regraded.set(m, next);
+            }
+        }
+    }
+    return regraded.size === 0 ? [...entries] : entries.map((e) => regraded.get(e) ?? e);
+}
+/** Distinct advisories among the records of one installed copy. */
+export function distinctAdvisoryCount(entries) {
+    return groupAdvisories(entries).length;
+}

package/dist/live/cache.js

@@ -37,6 +37,14 @@ export function closeServerCacheDb() {
         serverCache.close();
     serverCache = null;
 }
+/**
+ * A row fetched "in the future" was written under a clock that was ahead, or the clock has
+ * since gone back (an RTC reset). Its expires_at came from that clock too, so it could keep a
+ * year-old "no advisories" answer live: scan 0 vulnerable, dependency_check proceed,
+ * what_should_i_know safe_to_delegate (audit 6.2.5 B-3). Such a row is never an answer, fresh or
+ * stale, and is purged at start. Five minutes of skew between processes is tolerated.
+ */
+const SANE_FETCHED_AT = "fetched_at <= datetime('now', '+5 minutes')";
 /**
  * Registry, OSV and changelog responses with a TTL.
  *
@@ -82,7 +90,7 @@ export class LiveCache {
             const hit = this.memory.get(key);
             return hit && this.live(hit) ? JSON.parse(hit.data) : null;
         }
-        const row = this.db.prepare("SELECT data FROM live_cache WHERE cache_key = ? AND expires_at > datetime('now')").get(key);
+        const row = this.db.prepare(`SELECT data FROM live_cache WHERE cache_key = ? AND expires_at > datetime('now') AND ${SANE_FETCHED_AT}`).get(key);
         if (!row)
             return null;
         try {
@@ -97,7 +105,7 @@ export class LiveCache {
             const hit = this.memory.get(key);
             return hit ? { data: JSON.parse(hit.data), fetchedAt: hit.fetched_at } : null;
         }
-        const row = this.db.prepare("SELECT data, fetched_at FROM live_cache WHERE cache_key = ?").get(key);
+        const row = this.db.prepare(`SELECT data, fetched_at FROM live_cache WHERE cache_key = ? AND ${SANE_FETCHED_AT}`).get(key);
         if (!row)
             return null;
         try {
@@ -150,7 +158,7 @@ export class LiveCache {
                     purged++;
             return purged;
         }
-        const result = this.db.prepare("DELETE FROM live_cache WHERE expires_at <= datetime('now')").run();
+        const result = this.db.prepare(`DELETE FROM live_cache WHERE expires_at <= datetime('now') OR NOT (${SANE_FETCHED_AT})`).run();
         return result.changes;
     }
     invalidateSource(source) {

package/dist/live/cargo-platform.d.ts

@@ -22,6 +22,12 @@ export declare function activeCratesForHost(dir: string): Set<string> | null;
  * untrusted input. `CARGO_TARGET_DIR` points at the same scratch directory so
  * cargo's metadata writes never land in the user's tree either.
  *
+ * The scratch directory lives in the server's per-user data directory, not
+ * the system temp directory. On a shared machine `/tmp` is writable by every
+ * user, so a `/tmp/.cargo/config.toml` or a pre-created
+ * `/tmp/4da-mcp-cargo-resolve/.cargo/config.toml` planted by another account
+ * could set `build.rustc-wrapper` and run code as this user (audit 6.2.5 C-2).
+ *
  * Exported for tests.
  */
 export declare function cargoTreeInvocation(dir: string): {

package/dist/live/cargo-platform.js

@@ -42,8 +42,8 @@
  */
 import { execFileSync } from "node:child_process";
 import * as fs from "node:fs";
-import * as os from "node:os";
 import * as path from "node:path";
+import { serverDataDir } from "../db.js";
 import { fileSignature } from "./file-signature.js";
 /** Rust target triple for the current host, or null for a platform we do not map. */
 export function hostTriple() {
@@ -133,10 +133,16 @@ function computeActiveCrates(dir) {
  * untrusted input. `CARGO_TARGET_DIR` points at the same scratch directory so
  * cargo's metadata writes never land in the user's tree either.
  *
+ * The scratch directory lives in the server's per-user data directory, not
+ * the system temp directory. On a shared machine `/tmp` is writable by every
+ * user, so a `/tmp/.cargo/config.toml` or a pre-created
+ * `/tmp/4da-mcp-cargo-resolve/.cargo/config.toml` planted by another account
+ * could set `build.rustc-wrapper` and run code as this user (audit 6.2.5 C-2).
+ *
  * Exported for tests.
  */
 export function cargoTreeInvocation(dir) {
-    const scratch = path.join(os.tmpdir(), "4da-mcp-cargo-resolve");
+    const scratch = path.join(serverDataDir(), "cargo-resolve");
     return {
         args: [
             "tree",

package/dist/live/changelog.js

@@ -107,7 +107,36 @@ export function parseVersionHeading(raw) {
         return null;
     return { version, date: extractDate(rest) };
 }
-const ATX = /^(#{1,6})\s+(.*?)\s*#*\s*$/;
+/**
+ * An ATX heading `## text ##` as [level, text], parsed by hand in linear time.
+ * The regex it replaces (`/^(#{1,6})\s+(.*?)\s*#*\s*$/`) was cubic on interior
+ * whitespace: a 1,000-space heading in a package's CHANGELOG took over 20 s on
+ * the event loop (audit 2026-10-12, B-10). Same result otherwise ("C#" reads "C").
+ */
+function parseAtx(line) {
+    const open = /^#{1,6}/.exec(line);
+    if (!open)
+        return null;
+    const level = open[0].length;
+    const after = line.slice(level);
+    const body = after.trimStart();
+    if (body.length === after.length)
+        return null; // "#tag" or "#######": not a heading
+    let end = body.length;
+    while (end > 0 && /\s/.test(body[end - 1]))
+        end--;
+    while (end > 0 && body[end - 1] === "#")
+        end--;
+    while (end > 0 && /\s/.test(body[end - 1]))
+        end--;
+    return [level, body.slice(0, end)];
+}
+/**
+ * Lines longer than this are cut before the line-shape regexes run, so every
+ * one of them works on bounded input and a hostile line costs milliseconds.
+ * No real heading, label or entry comes near it.
+ */
+const MAX_LINE = 4096;
 /**
  * A setext / reStructuredText underline. `=` and `-` at any length (Markdown);
  * the other RST adornments need three, so a stray `**` is not a heading rule.
@@ -279,7 +308,10 @@ function adornmentLevel(ch) {
 }
 /** Parse a changelog into version sections, in document order (usually newest first). */
 export function parseChangelog(text) {
-    const lines = text.replace(/\r\n?/g, "\n").split("\n");
+    const lines = text
+        .replace(/\r\n?/g, "\n")
+        .split("\n")
+        .map((l) => (l.length > MAX_LINE ? l.slice(0, MAX_LINE) : l));
     const state = {
         sections: [],
         current: null,
@@ -318,14 +350,14 @@ export function parseChangelog(text) {
         }
         if (LINK_DEF.test(line))
             continue;
-        const atx = ATX.exec(line);
+        const atx = parseAtx(line);
         if (atx) {
-            const heading = parseVersionHeading(atx[2]);
-            const level = atx[1].length;
+            const [level, text] = atx;
+            const heading = parseVersionHeading(text);
             if (heading)
                 openSection(state, heading, level);
             else
-                subHeading(state, atx[2], level);
+                subHeading(state, text, level);
             continue;
         }
         const next = lines[i + 1];

package/dist/live/dependency-set.d.ts

@@ -10,4 +10,12 @@ import type { ResolvedDependency, VulnerabilityScanResult } from "./types.js";
  */
 export declare function commonPathRoot(dirs: string[]): string | null;
 export declare function dedupeDependencies(deps: ResolvedDependency[]): ResolvedDependency[];
-export declare function emptyVulnResult(projectPath: string, offline: boolean): VulnerabilityScanResult;
+/**
+ * A scan with no findings. `unchecked` dependencies (offline: none of them
+ * could be asked) are counted in `totalScanned` and reported as unchecked,
+ * never as clean.
+ */
+export declare function emptyVulnResult(projectPath: string, offline: boolean, unchecked?: {
+    count: number;
+    reason: string;
+} | null): VulnerabilityScanResult;

package/dist/live/dependency-set.js

@@ -77,12 +77,17 @@ function mergeInstallContext(existing, dep) {
         existing.installedVersion = dep.installedVersion;
     }
 }
-export function emptyVulnResult(projectPath, offline) {
+/**
+ * A scan with no findings. `unchecked` dependencies (offline: none of them
+ * could be asked) are counted in `totalScanned` and reported as unchecked,
+ * never as clean.
+ */
+export function emptyVulnResult(projectPath, offline, unchecked = null) {
     return {
         scannedAt: new Date().toISOString(),
         projectPath,
         ecosystemsScanned: [],
-        totalScanned: 0,
+        totalScanned: unchecked?.count ?? 0,
         totalVulnerable: 0,
         platformInactiveVulnerable: 0,
         bySeverity: { critical: 0, high: 0, medium: 0, low: 0, unknown: 0 },
@@ -91,5 +96,8 @@ export function emptyVulnResult(projectPath, offline) {
         scanDurationMs: 0,
         cached: false,
         offline,
+        unchecked: unchecked?.count ?? 0,
+        uncheckedReason: unchecked?.reason ?? null,
+        staleAnswers: 0,
     };
 }