@4da/mcp-server 6.2.4 → 6.2.5

package/dist/tools/vulnerability-scan-concise.js

@@ -18,6 +18,17 @@ import { SEVERITY_RANK } from "../live/severity-scope.js";
 const MAX_PACKAGES = 40;
 const MAX_RECOMMENDATIONS = 25;
 const IDS_PER_ROW = 3;
+/** The withdrawn releases behind a row's fix: the checked target's, else its advisories' own line fixes. */
+function withheldOf(checked, vulns) {
+    if (checked?.withheld && checked.withheld.length > 0)
+        return { withheld: checked.withheld, ...(checked.withheld_note ? { withheld_note: checked.withheld_note } : {}) };
+    if (checked)
+        return {};
+    const rows = vulns;
+    const withheld = [...new Set(rows.flatMap((v) => v.withheld ?? []))];
+    const notes = [...new Set(rows.map((v) => v.withheld_note).filter((n) => Boolean(n)))];
+    return withheld.length > 0 ? { withheld, ...(notes.length > 0 ? { withheld_note: notes.join("; ") } : {}) } : {};
+}
 /** One row per package version: worst graded severity, the fix that clears every fixable advisory. */
 export function groupByPackage(rows, targets = {}) {
     const groups = new Map();
@@ -31,17 +42,23 @@ export function groupByPackage(rows, targets = {}) {
         const fixes = vulns.map((v) => v.fixed_version).filter((f) => Boolean(f));
         const unfixed = vulns.length - fixes.length;
         const checked = targets[`${worst.package}@${worst.current_version}`];
-        const fixed = checked?.checked === "all_advisories" ? checked.target : fixes.length > 0 ? maxVersion(fixes, worst.ecosystem) : null;
+        // fix_targets also carries the installed-advisories-only target, corrected by the registry
+        // when the highest fix is deprecated or yanked (audit H5); without an entry, the highest fix.
+        const fixed = checked ? checked.target : fixes.length > 0 ? maxVersion(fixes, worst.ecosystem) : null;
         // Unknown (null) only when no advisory row knows; any direct row makes it direct.
         const direct = vulns.some((v) => v.is_direct === true) ? true : vulns.some((v) => v.is_direct === null) ? null : false;
         out.push({
             package: worst.package,
             current_version: worst.current_version,
             severity: worst.severity,
+            ...(worst.severity_from ? { severity_from: worst.severity_from } : {}),
+            // Any malicious-package record on this copy: the row says so (audit 6.2.5 D-3).
+            ...(vulns.some((v) => v.malware === true) ? { malware: true } : {}),
             advisories: vulns.length,
             ids: vulns.slice(0, IDS_PER_ROW).map((v) => v.vuln_id),
             fixed_version: fixed,
             fix_checked: checked?.checked ?? "installed_advisories_only",
+            ...withheldOf(checked, vulns),
             ...(unfixed > 0 ? { unfixed_advisories: unfixed } : {}),
             is_direct: direct,
             ...(vulns.every((v) => v.is_dev) ? { is_dev: true } : {}),
@@ -65,24 +82,40 @@ export function conciseScanResult(full) {
     const omittedPackages = packages.length - listed.length;
     const omittedRecommendations = full.recommendations.length - recommendations.length;
     return {
+        // Leads the answer when any dependency went unchecked ("NOT CHECKED: ...").
+        ...(full.summary ? { summary: full.summary } : {}),
         scan_time: full.scan_time,
         project_root: full.project_root,
         host_platform: full.host_platform,
         ecosystems_scanned: full.ecosystems_scanned,
         total_dependencies_scanned: full.total_dependencies_scanned,
+        ...(full.dev_scope ? { dev_scope: full.dev_scope } : {}),
         total_vulnerable_packages: full.total_vulnerable_packages,
         ...(full.coverage
             ? {
                 coverage: {
                     complete: false,
                     note: full.coverage.note,
+                    ...(full.coverage.unchecked_dependencies !== undefined
+                        ? {
+                            unchecked_dependencies: full.coverage.unchecked_dependencies,
+                            checked_dependencies: full.coverage.checked_dependencies,
+                            osv_status: full.coverage.osv_status,
+                        }
+                        : {}),
                     lockfiles_not_scanned: full.coverage.lockfiles_not_scanned,
-                    ...("unresolved_manifests" in full.coverage ? { unresolved_manifests: full.coverage.unresolved_manifests } : {}),
+                    ...(full.coverage.unreadable_lockfiles ? { unreadable_lockfiles: full.coverage.unreadable_lockfiles } : {}),
+                    ...(full.coverage.partial_lockfiles ? { partial_lockfiles: full.coverage.partial_lockfiles } : {}),
+                    ...(full.coverage.refused_includes ? { refused_includes: full.coverage.refused_includes } : {}),
+                    ...(full.coverage.not_covered ? { not_covered: full.coverage.not_covered, not_covered_count: full.coverage.not_covered_count } : {}),
+                    ...(full.coverage.not_scanned ? { not_scanned: full.coverage.not_scanned } : {}),
+                    ...(full.coverage.unresolved_manifests ? { unresolved_manifests: full.coverage.unresolved_manifests } : {}),
                 },
             }
             : {}),
-        // Every listed advisory, before grouping and trimming.
+        // Every listed advisory, before grouping and trimming. Null when the scan is incomplete.
         by_severity: full.by_severity,
+        ...(full.found_in_checked_dependencies ? { found_in_checked_dependencies: full.found_in_checked_dependencies } : {}),
         vulnerable_packages: listed,
         ...(omittedPackages > 0
             ? { vulnerable_packages_note: `Showing the ${listed.length} most severe of ${packages.length} vulnerable package versions; pass severity_filter (e.g. "high") or response_format: "detailed" for the rest.` }
@@ -104,6 +137,7 @@ export function conciseScanResult(full) {
             lockfiles_read: full._meta.resolution.lockfiles.length,
             resolved_at: full._meta.resolution.resolved_at,
             privacy: full._meta.privacy,
+            ...(full._meta.alias_severity ? { alias_severity: full._meta.alias_severity } : {}),
         },
     };
 }

package/dist/tools/vulnerability-scan-format.d.ts

@@ -3,15 +3,18 @@
  * recommendations, install drift, the shared severity grade, and resolution
  * provenance. Split out of vulnerability-scan.ts, which keeps execution.
  */
-import type { InstallDriftRecord, ResolutionProvenance, VulnerabilityScanResult } from "../live/types.js";
+import type { AliasSeverityReport, InstallDriftRecord, ResolutionProvenance, VulnerabilityCoverage, VulnerabilityScanResult } from "../live/types.js";
 import { type TreeDiscovery } from "../project-tree.js";
-import type { CleanTarget } from "../live/osv-ranges.js";
+import type { LockfileProblem } from "../live/lockfile-types.js";
+import { type FixTargetResult } from "../live/fix-paths.js";
 /** What the formatter needs beyond the scan itself. */
 export interface ScanContext {
     resolution: ResolutionProvenance | null;
     reResolvedThisCall: boolean;
     drift: InstallDriftRecord[];
     includeDev: boolean;
+    /** Installed copies that are dev-only (every path a dev one): left out without include_dev. */
+    devOnlyCopies?: number;
     /** What the project-tree walk left out; null when the set did not come from a walk. */
     discovery?: TreeDiscovery | null;
     /** Manifests with no lockfile, whose ranged dependencies were not scanned. */
@@ -20,11 +23,13 @@ export interface ScanContext {
         manifest: string;
         ranges: number;
     }>;
+    /** Lockfiles present that could not be read (conflict markers, invalid JSON, ...). */
+    problems?: LockfileProblem[];
     /**
      * Upgrade targets checked against every advisory of the package, keyed by
      * fixTargetKey(); absent when the check could not run (offline, budget).
      */
-    verifiedTargets?: Map<string, CleanTarget>;
+    verifiedTargets?: Map<string, FixTargetResult>;
 }
 /** The key a verified target is stored under: one installed copy of a package. */
 export declare function fixTargetKey(ecosystem: string, name: string, version: string): string;
@@ -34,7 +39,7 @@ export declare function fixTargetKey(ecosystem: string, name: string, version: s
  * lockfile (declared ranges are not installs, so they are not sent to OSV).
  */
 export declare function scanCoverage(ctx: ScanContext, relative: (dir: string) => string, detailed: boolean): {
-    complete: boolean;
+    complete: false;
     note: string;
     lockfiles_not_scanned: number;
     skipped_lockfiles?: {
@@ -42,12 +47,84 @@ export declare function scanCoverage(ctx: ScanContext, relative: (dir: string) =
         reason: "depth" | "project_limit";
     }[] | undefined;
     walk_truncated?: boolean | undefined;
+    unreadable_lockfiles?: {
+        path: string;
+        error: string;
+    }[] | undefined;
+    partial_lockfiles?: {
+        path: string;
+        skipped_entries: number;
+        reason: string;
+    }[] | undefined;
+    refused_includes?: {
+        path: string;
+        reason: string;
+    }[] | undefined;
+    not_covered?: {
+        path: string;
+        ecosystem: string;
+    }[] | undefined;
+    not_covered_count?: number | undefined;
+    not_scanned?: {
+        test_fixture_lockfiles: number;
+        dirs: string[];
+    } | undefined;
     unresolved_manifests?: {
         manifest: string;
         declared_ranges: number;
         fix: string;
     }[] | undefined;
 } | null;
+/** The `coverage` block: everything the scan did not cover, the unchecked count first. */
+export interface MergedCoverage {
+    complete: false;
+    note: string;
+    lockfiles_not_scanned: number;
+    skipped_lockfiles?: Array<{
+        path: string;
+        reason: string;
+    }>;
+    walk_truncated?: boolean;
+    unresolved_manifests?: Array<{
+        manifest: string;
+        declared_ranges: number;
+        fix: string;
+    }>;
+    /** Lockfiles that could not be read at all. */
+    unreadable_lockfiles?: Array<{
+        path: string;
+        error: string;
+    }>;
+    /** Lockfiles read except for `skipped_entries` entries (a line past the length cap). */
+    partial_lockfiles?: Array<{
+        path: string;
+        skipped_entries: number;
+        reason: string;
+    }>;
+    /** Requirements includes not read because they point outside the project. */
+    refused_includes?: Array<{
+        path: string;
+        reason: string;
+    }>;
+    not_covered?: Array<{
+        path: string;
+        ecosystem: string;
+    }>;
+    not_covered_count?: number;
+    not_scanned?: {
+        test_fixture_lockfiles: number;
+        dirs: string[];
+    };
+    unchecked_dependencies?: number;
+    checked_dependencies?: number;
+    osv_status?: string;
+}
+/**
+ * One `coverage` block for everything the scan did not cover: lockfiles past
+ * the walk's bounds, manifests with no lockfile, and dependencies OSV.dev gave
+ * no answer for. The unchecked count leads the note.
+ */
+export declare function mergeCoverage(walk: ReturnType<typeof scanCoverage>, osv: VulnerabilityCoverage | null): MergedCoverage | null;
 /**
  * Collapse advisories that are the same finding under different identifiers.
  *
@@ -55,7 +132,11 @@ export declare function scanCoverage(ctx: ScanContext, relative: (dir: string) =
  * other in `aliases`. Reported separately they double the count and read as two
  * problems: `quinn-proto` showed as "2 high" for a single memory-exhaustion
  * bug. Keeps the entry with the most usable detail (a CVSS score, then a fix
- * version) and folds the rest into its alias list.
+ * version) and folds the rest into its alias list. The kept entry carries the
+ * group's MOST severe grade, naming the record it came from (`severityFrom`),
+ * as every other tool does (advisory-groups.ts gradeAliasGroups): keeping the
+ * richest record's own grade showed CVE-2026-4277 as low here and critical in
+ * dependency_check (final release audit of 6.2.5).
  */
 export declare function collapseAliases(vulns: VulnerabilityScanResult["vulnerabilities"]): import("../live/types.js").VulnerabilityEntry[];
 /**
@@ -71,32 +152,25 @@ export declare function platformFilterNote(vulns: VulnerabilityScanResult["vulne
 /** Shortest readable label for a manifest directory, relative to the scan root. */
 export declare function relativeDir(dir: string, root: string): string;
 export declare function formatScanResult(result: VulnerabilityScanResult, severityFilter: string | undefined, ctx: ScanContext): {
+    summary?: string | undefined;
     scan_time: string;
     project: string;
-    coverage?: {
-        complete: boolean;
-        note: string;
-        lockfiles_not_scanned: number;
-        skipped_lockfiles?: {
-            path: string;
-            reason: "depth" | "project_limit";
-        }[] | undefined;
-        walk_truncated?: boolean | undefined;
-        unresolved_manifests?: {
-            manifest: string;
-            declared_ranges: number;
-            fix: string;
-        }[] | undefined;
-    } | undefined;
+    coverage?: MergedCoverage | undefined;
     project_root: string;
     workspaces_with_findings: string[];
     host_platform: string;
     ecosystems_scanned: string[];
     total_dependencies_scanned: number;
-    total_vulnerable_packages: number;
+    dev_scope?: string | undefined;
+    total_vulnerable_packages: number | null;
     platform_inactive_packages: number;
-    by_severity: import("../live/severity-scope.js").SeverityCounts;
-    advisory_by_severity: import("../live/severity-scope.js").SeverityCounts;
+    by_severity: import("../live/severity-scope.js").SeverityCounts | null;
+    advisory_by_severity: import("../live/severity-scope.js").SeverityCounts | null;
+    found_in_checked_dependencies?: {
+        note: string;
+        vulnerable_packages: number;
+        by_severity: import("../live/severity-scope.js").SeverityCounts;
+    } | undefined;
     vulnerabilities: {
         package: string;
         current_version: string;
@@ -112,10 +186,14 @@ export declare function formatScanResult(result: VulnerabilityScanResult, severi
         aliases: string[];
         severity: "critical" | "high" | "low" | "medium" | "unknown";
         advisory_severity: "critical" | "high" | "low" | "medium" | "unknown";
+        malware?: boolean | undefined;
+        severity_from?: string | undefined;
         severity_note?: string | undefined;
         cvss_score: number | null;
         summary: string;
         fixed_version: string | null;
+        withheld?: string[] | undefined;
+        withheld_note?: string | null | undefined;
         published: string;
         references: string[];
     }[];
@@ -134,10 +212,14 @@ export declare function formatScanResult(result: VulnerabilityScanResult, severi
         aliases: string[];
         severity: "critical" | "high" | "low" | "medium" | "unknown";
         advisory_severity: "critical" | "high" | "low" | "medium" | "unknown";
+        malware?: boolean | undefined;
+        severity_from?: string | undefined;
         severity_note?: string | undefined;
         cvss_score: number | null;
         summary: string;
         fixed_version: string | null;
+        withheld?: string[] | undefined;
+        withheld_note?: string | null | undefined;
         published: string;
         references: string[];
     }[];
@@ -156,10 +238,14 @@ export declare function formatScanResult(result: VulnerabilityScanResult, severi
         aliases: string[];
         severity: "critical" | "high" | "low" | "medium" | "unknown";
         advisory_severity: "critical" | "high" | "low" | "medium" | "unknown";
+        malware?: boolean | undefined;
+        severity_from?: string | undefined;
         severity_note?: string | undefined;
         cvss_score: number | null;
         summary: string;
         fixed_version: string | null;
+        withheld?: string[] | undefined;
+        withheld_note?: string | null | undefined;
         published: string;
         references: string[];
     }[];
@@ -169,14 +255,23 @@ export declare function formatScanResult(result: VulnerabilityScanResult, severi
         target: string | null;
         checked: "all_advisories" | "installed_advisories_only";
         note?: string;
+        withheld?: string[];
+        withheld_note?: string;
     }>;
-    clean_dependencies: number;
+    clean_dependencies: number | null;
     scan_duration_ms: number;
     _meta: {
         source: string;
         cached: boolean;
         osv_cached: boolean;
         offline: boolean;
+        stale_osv_answers?: number | undefined;
+        alias_severity?: {
+            rated_from_alias: number;
+            unresolved: string[];
+            ungraded: string[];
+            note?: string | undefined;
+        } | undefined;
         privacy: string;
         relevance: string;
         severity_rule: string;
@@ -192,3 +287,10 @@ export declare function formatScanResult(result: VulnerabilityScanResult, severi
         };
     };
 };
+/** `_meta.alias_severity`: how many records were graded from a GHSA alias, and which stay unknown, with why. */
+export declare function aliasSeverityMeta(report: AliasSeverityReport): {
+    rated_from_alias: number;
+    unresolved: string[];
+    ungraded: string[];
+    note?: string | undefined;
+};