@4da/mcp-server 6.2.4 → 6.2.5

package/dist/live/github-releases.js

@@ -86,6 +86,9 @@ const KNOWN_TAG_PREFIX = /^(?:v|version[-_]?|release[-_]?|rel[-_]?)?$/i;
  */
 export function versionFromTag(tag, pkg, tagPrefix) {
     let rest = tag.trim();
+    // Real tags are short; the version regex below is superlinear on long ones (B-10).
+    if (rest.length > 256)
+        return null;
     if (tagPrefix) {
         if (!rest.startsWith(`${tagPrefix}/`))
             return null;

package/dist/live/held-dependencies.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Held dependencies: what an npm release installs whatever the project's lockfile holds.
+ *
+ * A release's own advisories are not the whole answer to "is this a clean fix". express 4.20.0
+ * exact-pins qs 6.11.0 (3 advisories), cookie 0.6.0, body-parser 1.20.3 and path-to-regexp
+ * 0.1.10; installing it installs them. vulnerability_scan and dependency_check named it the clean
+ * fix for NodeGoat's express 4.16.4, judged on express's own advisories alone, and agents wrote it
+ * in 2 of 2 headless runs (audit 6.2.5 D-4). The same holds one step wider: express 4.22.0 to
+ * 4.22.2 require qs "~6.14.0" / "~6.15.1", and every qs those ranges admit is affected by
+ * GHSA-4mjr-xmp4-gh2g (fixed in 6.16.0), so only 4.22.3 ("~6.16.0") installs clean.
+ *
+ * So a release HOLDS a dependency when its spec is
+ * - an exact pin: a bare version or `=version`, installed as written; or
+ * - a narrow range: one capped below the dependency's next major (`~1.2.3`, `^0.1.2`, `1.2.x`,
+ *   anything with a `<` bound, a hyphen range), whose newest admitted release is the best any
+ *   install can do (npm takes `latest` when the range admits it, else the highest it admits).
+ * A wide range (`^6.14.0`, `>=1`) is not held: a refresh can resolve it to the dependency's newest
+ * release on that major, and moving it is upgrade_planner's lever logic.
+ *
+ * A held dependency whose installed version an advisory affects brings that advisory with the
+ * release. The question is asked of OSV through the scanner the tools already use
+ * (LiveIntelligence.queryAdvisories: batched, cached per dependency, rate-limited), in one call per
+ * check. Fail closed: when a range's releases or OSV's answer cannot be had, the release is
+ * `unchecked` with the reason, and no tool calls it clean on that.
+ */
+import { type AdvisoryRanges } from "./osv-ranges.js";
+import type { ResolvedDependency, VulnerabilityEntry, VulnerabilityScanResult } from "./types.js";
+/** The registry facts this module reads (fix-paths.ts PackageReleaseFacts; a type only, no import cycle). */
+export interface HeldFacts {
+    versions: string[];
+    withdrawn: string[];
+    latest: string | null;
+    /** Per release: its held specs (dependency name -> spec). A release with none is absent. */
+    heldSpecs?: Record<string, Record<string, string>>;
+}
+export interface HeldSources {
+    releaseFacts(ecosystem: "npm", name: string): Promise<HeldFacts | null>;
+}
+/** The advisory lookup the tools share (LiveIntelligence.queryAdvisories). */
+export type AdvisoryQuery = (deps: ResolvedDependency[]) => Promise<VulnerabilityScanResult>;
+export interface HeldDependency {
+    name: string;
+    /** The release's own spec for it, as published. */
+    spec: string;
+    /** True for an exact pin; false for a narrow range. */
+    exact: boolean;
+    /** What an install of the release gets: the pin, or the newest release the range admits. */
+    version: string;
+    /** The advisories that affect `version` (one id per alias group, maintenance notices left out). */
+    ids: string[];
+    severity: VulnerabilityEntry["severity"];
+}
+export type HeldCheck = {
+    status: "checked";
+    affected: HeldDependency[];
+} | {
+    status: "unchecked";
+    reason: string;
+};
+/** How many releases a fix-target search judges at most (the advisories' target and the next on its line). */
+export declare const HELD_CANDIDATES = 10;
+/** The version an exact npm pin installs ("6.11.0", "=6.11.0", "v6.11.0"); null for anything else. */
+export declare function exactPinVersion(spec: unknown): string | null;
+/** Whether an npm range is capped below its dependency's next major (see the module comment). */
+export declare function isNarrowRange(spec: string): boolean;
+/** A release's held specs: exact pins and narrow ranges, dependencies and optionalDependencies (npm installs both). */
+export declare function heldSpecsOf(dependencies?: Record<string, unknown>, optionalDependencies?: Record<string, unknown>): Record<string, string>;
+/**
+ * For each release (`key` -> its held specs), which held dependencies an advisory affects: one OSV
+ * call for all of them, the narrow ranges resolved from each dependency's registry facts first.
+ * A release whose held dependencies could not all be resolved and judged is `unchecked`, unless
+ * one that could be is already affected (a concrete finding stands).
+ */
+export declare function heldAdvisories(sources: HeldSources, query: AdvisoryQuery, releases: Array<{
+    key: string;
+    specs: Record<string, string>;
+}>, deadline: number): Promise<Map<string, HeldCheck>>;
+/**
+ * "4.20.0 exact-pins qs 6.11.0 (GHSA-a, GHSA-b) and cookie 0.6.0 (GHSA-c)", and for a narrow range
+ * "4.22.0 requires qs "~6.14.0", whose newest admitted release 6.14.2 is affected (GHSA-d)".
+ * At most three dependencies are named; the rest are counted.
+ */
+export declare function heldText(release: string, affected: HeldDependency[]): string;
+/** The worst severity among held dependencies' advisories. */
+export declare function heldSeverity(affected: HeldDependency[]): VulnerabilityEntry["severity"];
+/** Same compatibility line in npm's caret sense: same major, or same 0.minor below 1.0. */
+export declare function sameNpmLine(a: string, b: string): boolean;
+/**
+ * The releases a fix-target search judges, smallest first: `target`, then the later stable,
+ * installable releases on its line that the package's own advisories leave clean (the one
+ * predicate every tool uses, osv-ranges cleanReleases), HELD_CANDIDATES in all at most.
+ */
+export declare function heldCandidates(target: string, facts: HeldFacts, advisories: readonly AdvisoryRanges[], installed?: string | null): string[];

package/dist/live/held-dependencies.js

@@ -0,0 +1,212 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Held dependencies: what an npm release installs whatever the project's lockfile holds.
+ *
+ * A release's own advisories are not the whole answer to "is this a clean fix". express 4.20.0
+ * exact-pins qs 6.11.0 (3 advisories), cookie 0.6.0, body-parser 1.20.3 and path-to-regexp
+ * 0.1.10; installing it installs them. vulnerability_scan and dependency_check named it the clean
+ * fix for NodeGoat's express 4.16.4, judged on express's own advisories alone, and agents wrote it
+ * in 2 of 2 headless runs (audit 6.2.5 D-4). The same holds one step wider: express 4.22.0 to
+ * 4.22.2 require qs "~6.14.0" / "~6.15.1", and every qs those ranges admit is affected by
+ * GHSA-4mjr-xmp4-gh2g (fixed in 6.16.0), so only 4.22.3 ("~6.16.0") installs clean.
+ *
+ * So a release HOLDS a dependency when its spec is
+ * - an exact pin: a bare version or `=version`, installed as written; or
+ * - a narrow range: one capped below the dependency's next major (`~1.2.3`, `^0.1.2`, `1.2.x`,
+ *   anything with a `<` bound, a hyphen range), whose newest admitted release is the best any
+ *   install can do (npm takes `latest` when the range admits it, else the highest it admits).
+ * A wide range (`^6.14.0`, `>=1`) is not held: a refresh can resolve it to the dependency's newest
+ * release on that major, and moving it is upgrade_planner's lever logic.
+ *
+ * A held dependency whose installed version an advisory affects brings that advisory with the
+ * release. The question is asked of OSV through the scanner the tools already use
+ * (LiveIntelligence.queryAdvisories: batched, cached per dependency, rate-limited), in one call per
+ * check. Fail closed: when a range's releases or OSV's answer cannot be had, the release is
+ * `unchecked` with the reason, and no tool calls it clean on that.
+ */
+import { cleanReleases, isPrereleaseVersion } from "./osv-ranges.js";
+import { groupAdvisories } from "./advisory-groups.js";
+import { isMaintenanceNotice } from "./maintenance.js";
+import { npmRangeAdmits } from "./range-satisfies.js";
+import { SEVERITY_RANK } from "./severity-scope.js";
+import { compareVersions } from "./version-compare.js";
+/** How many releases a fix-target search judges at most (the advisories' target and the next on its line). */
+export const HELD_CANDIDATES = 10;
+/** Registry reads in flight at once for the narrow ranges' release lists. */
+const FACTS_CONCURRENCY = 8;
+const EXACT = /^=?\s*v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?)(?:\+[0-9A-Za-z.-]+)?$/;
+/** The version an exact npm pin installs ("6.11.0", "=6.11.0", "v6.11.0"); null for anything else. */
+export function exactPinVersion(spec) {
+    if (typeof spec !== "string")
+        return null;
+    const m = EXACT.exec(spec.trim());
+    return m ? m[1] : null;
+}
+/** Whether an npm range is capped below its dependency's next major (see the module comment). */
+export function isNarrowRange(spec) {
+    const s = spec.trim();
+    if (s === "" || s.includes("||") || exactPinVersion(s) !== null)
+        return false;
+    // Protocols, paths, aliases and dist-tags are not registry ranges this reads.
+    if (/^[a-z][a-z+]*:/i.test(s) || s.includes("/") || /^(?!v\d)[a-z]/i.test(s))
+        return false;
+    if (s.startsWith("~"))
+        return true;
+    if (/^\^?\s*v?0\./.test(s))
+        return true;
+    if (/^v?\d+\.\d+(?:\.[xX*])?$/.test(s))
+        return true;
+    if (s.includes("<"))
+        return true;
+    return /^\S+\s+-\s+\S+$/.test(s);
+}
+/** A release's held specs: exact pins and narrow ranges, dependencies and optionalDependencies (npm installs both). */
+export function heldSpecsOf(dependencies, optionalDependencies) {
+    const out = {};
+    // An optional dependency's spec wins over the same name in dependencies, as npm reads it.
+    for (const [name, spec] of Object.entries({ ...dependencies, ...optionalDependencies })) {
+        if (typeof spec !== "string")
+            continue;
+        if (exactPinVersion(spec) !== null || isNarrowRange(spec))
+            out[name] = spec.trim();
+    }
+    return out;
+}
+/** The release an install of `spec` gets, from the dependency's registry facts; null when it cannot be said. */
+function resolveSpec(spec, facts) {
+    const pinned = exactPinVersion(spec);
+    if (pinned !== null)
+        return pinned;
+    if (!facts)
+        return null;
+    const admits = (v) => npmRangeAdmits(spec, v) === true;
+    if (facts.latest && admits(facts.latest))
+        return facts.latest;
+    const pool = [...facts.versions, ...facts.withdrawn].filter((v) => (spec.includes("-") || !isPrereleaseVersion(v, "npm")) && admits(v));
+    return pool.sort((a, b) => compareVersions(a, b, "npm")).pop() ?? null;
+}
+function lookupDep(name, version) {
+    return { name, version, ecosystem: "npm", isDev: false, isDirect: false, devScopeKnown: false, target: null, platformActive: true, sourceDirs: [] };
+}
+/** Resolves to `late` once `deadline` passes. */
+async function byDeadline(work, deadline, late) {
+    let timer;
+    const timeout = new Promise((resolve) => {
+        timer = setTimeout(() => resolve(late), Math.max(0, deadline - Date.now()));
+    });
+    try {
+        return await Promise.race([work.catch(() => late), timeout]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
+/**
+ * For each release (`key` -> its held specs), which held dependencies an advisory affects: one OSV
+ * call for all of them, the narrow ranges resolved from each dependency's registry facts first.
+ * A release whose held dependencies could not all be resolved and judged is `unchecked`, unless
+ * one that could be is already affected (a concrete finding stands).
+ */
+export async function heldAdvisories(sources, query, releases, deadline) {
+    const out = new Map();
+    const ranged = [...new Set(releases.flatMap((r) => Object.entries(r.specs).filter(([, s]) => exactPinVersion(s) === null).map(([n]) => n)))];
+    const facts = new Map();
+    let next = 0;
+    await Promise.all(Array.from({ length: Math.min(FACTS_CONCURRENCY, ranged.length) }, async () => {
+        while (next < ranged.length && Date.now() < deadline) {
+            const name = ranged[next++];
+            facts.set(name, await byDeadline(sources.releaseFacts("npm", name), deadline, null));
+        }
+    }));
+    const resolved = releases.map((r) => ({
+        key: r.key,
+        deps: Object.entries(r.specs).map(([name, spec]) => ({ name, spec, exact: exactPinVersion(spec) !== null, version: resolveSpec(spec, facts.get(name)) })),
+    }));
+    const wanted = new Map();
+    for (const r of resolved)
+        for (const d of r.deps)
+            if (d.version)
+                wanted.set(`${d.name}@${d.version}`, lookupDep(d.name, d.version));
+    let answer = null;
+    let failure = null;
+    if (wanted.size > 0) {
+        answer = await byDeadline(query([...wanted.values()]), deadline, null);
+        if (!answer)
+            failure = "the OSV.dev lookup did not finish in time";
+        else if (answer.offline)
+            failure = answer.uncheckedReason ?? "OSV.dev could not be queried";
+        else if ((answer.staleAnswers ?? 0) > 0)
+            failure = `OSV.dev gave only expired cached answers (${answer.staleReason ?? "the fresh query failed"})`;
+    }
+    const byCopy = new Map();
+    for (const v of failure ? [] : (answer?.vulnerabilities ?? [])) {
+        if (isMaintenanceNotice(v))
+            continue;
+        const k = `${v.package}@${v.currentVersion}`;
+        byCopy.set(k, [...(byCopy.get(k) ?? []), v]);
+    }
+    const hits = new Map();
+    for (const [k, entries] of byCopy) {
+        const groups = groupAdvisories(entries);
+        const worst = groups.map((g) => g.best.severity).reduce((a, b) => ((SEVERITY_RANK[b] ?? 0) > (SEVERITY_RANK[a] ?? 0) ? b : a), "unknown");
+        hits.set(k, { ids: groups.map((g) => g.best.vulnId).sort(), severity: worst });
+    }
+    for (const r of resolved) {
+        const affected = r.deps.flatMap((d) => {
+            const hit = d.version ? hits.get(`${d.name}@${d.version}`) : undefined;
+            return hit ? [{ name: d.name, spec: d.spec, exact: d.exact, version: d.version, ids: hit.ids, severity: hit.severity }] : [];
+        });
+        const unread = r.deps.filter((d) => !d.version).map((d) => `${d.name} "${d.spec}"`);
+        if (affected.length > 0)
+            out.set(r.key, { status: "checked", affected });
+        else if (unread.length > 0)
+            out.set(r.key, { status: "unchecked", reason: `the releases ${unread.slice(0, 3).join(", ")}${unread.length > 3 ? ` and ${unread.length - 3} more` : ""} admit could not be read from the npm registry` });
+        else if (failure && r.deps.length > 0)
+            out.set(r.key, { status: "unchecked", reason: failure });
+        else
+            out.set(r.key, { status: "checked", affected: [] });
+    }
+    return out;
+}
+/**
+ * "4.20.0 exact-pins qs 6.11.0 (GHSA-a, GHSA-b) and cookie 0.6.0 (GHSA-c)", and for a narrow range
+ * "4.22.0 requires qs "~6.14.0", whose newest admitted release 6.14.2 is affected (GHSA-d)".
+ * At most three dependencies are named; the rest are counted.
+ */
+export function heldText(release, affected) {
+    const shown = affected.slice(0, 3);
+    const and = (parts) => (parts.length > 1 ? `${parts.slice(0, -1).join(", ")} and ${parts[parts.length - 1]}` : parts[0]);
+    const exact = shown.filter((d) => d.exact).map((d) => `${d.name} ${d.version} (${d.ids.join(", ")})`);
+    const ranged = shown
+        .filter((d) => !d.exact)
+        .map((d) => `${d.name} "${d.spec}", whose newest admitted release ${d.version} is affected (${d.ids.join(", ")})`);
+    const clauses = [...(exact.length > 0 ? [`exact-pins ${and(exact)}`] : []), ...(ranged.length > 0 ? [`requires ${and(ranged)}`] : [])];
+    const rest = affected.length - shown.length;
+    const more = rest > 0 ? `, and ${rest} more affected dependenc${rest === 1 ? "y" : "ies"}` : "";
+    return `${release} ${clauses.join("; it also ")}${more}`;
+}
+/** The worst severity among held dependencies' advisories. */
+export function heldSeverity(affected) {
+    return affected.reduce((worst, d) => ((SEVERITY_RANK[d.severity] ?? 0) > (SEVERITY_RANK[worst] ?? 0) ? d.severity : worst), "unknown");
+}
+/** Same compatibility line in npm's caret sense: same major, or same 0.minor below 1.0. */
+export function sameNpmLine(a, b) {
+    const pa = /^v?(\d+)\.(\d+)\./.exec(a);
+    const pb = /^v?(\d+)\.(\d+)\./.exec(b);
+    if (!pa || !pb)
+        return false;
+    return pa[1] === pb[1] && (pa[1] !== "0" || pa[2] === pb[2]);
+}
+/**
+ * The releases a fix-target search judges, smallest first: `target`, then the later stable,
+ * installable releases on its line that the package's own advisories leave clean (the one
+ * predicate every tool uses, osv-ranges cleanReleases), HELD_CANDIDATES in all at most.
+ */
+export function heldCandidates(target, facts, advisories, installed) {
+    const view = cleanReleases(advisories, "npm", facts.versions, installed);
+    const later = facts.versions
+        .filter((v) => !isPrereleaseVersion(v, "npm") && sameNpmLine(v, target) && compareVersions(v, target, "npm") > 0 && view.clean(v))
+        .sort((a, b) => compareVersions(a, b, "npm"));
+    return [target, ...later].slice(0, HELD_CANDIDATES);
+}

package/dist/live/held-targets.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Fix targets judged by what they hold, not only by their own advisories (audit 6.2.5 D-4).
+ *
+ * cleanFixTarget (fix-paths.ts) picks the smallest release that no advisory of the package
+ * affects. For npm that is not yet a clean fix: express 4.20.0 is clear of express's advisories
+ * and exact-pins qs 6.11.0, cookie 0.6.0, body-parser 1.20.3 and path-to-regexp 0.1.10, all
+ * affected; 4.22.0 to 4.22.2 require qs ranges no clean qs is in. NodeGoat's scan said
+ * "Upgrade express 4.16.4 -> 4.20.0", and agents installed it.
+ *
+ * Here a checked npm target is judged with its held dependencies (held-dependencies.ts). When
+ * one is affected, the next releases on its line that the package's own advisories leave clean are
+ * judged too, HELD_CANDIDATES in all and in ONE advisory lookup for every target at once, and the
+ * smallest that holds nothing affected becomes the target, with the reason. None clean among
+ * them: the target stays, flagged `heldBlocked`; the check could not run (registry, OSV, time):
+ * flagged `heldUnchecked`. Either way the target is no longer reported as checked against every
+ * advisory (targetCheckedAll). A release that holds nothing needs no lookup at all.
+ */
+import { type AdvisoryQuery } from "./held-dependencies.js";
+import { type FixPathSources, type FixTargetResult } from "./fix-paths.js";
+export interface HeldTargetItem {
+    key: string;
+    name: string;
+    installed?: string | null;
+    clean: FixTargetResult;
+}
+/**
+ * The npm targets of `items`, re-judged by what they hold, within `deadline`. Returns the
+ * replacement result per key; keys with nothing held (or not npm, or not checked) are absent.
+ */
+export declare function withHeldTargets(sources: FixPathSources, query: AdvisoryQuery, items: HeldTargetItem[], deadline: number): Promise<Map<string, FixTargetResult>>;

package/dist/live/held-targets.js

@@ -0,0 +1,107 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Fix targets judged by what they hold, not only by their own advisories (audit 6.2.5 D-4).
+ *
+ * cleanFixTarget (fix-paths.ts) picks the smallest release that no advisory of the package
+ * affects. For npm that is not yet a clean fix: express 4.20.0 is clear of express's advisories
+ * and exact-pins qs 6.11.0, cookie 0.6.0, body-parser 1.20.3 and path-to-regexp 0.1.10, all
+ * affected; 4.22.0 to 4.22.2 require qs ranges no clean qs is in. NodeGoat's scan said
+ * "Upgrade express 4.16.4 -> 4.20.0", and agents installed it.
+ *
+ * Here a checked npm target is judged with its held dependencies (held-dependencies.ts). When
+ * one is affected, the next releases on its line that the package's own advisories leave clean are
+ * judged too, HELD_CANDIDATES in all and in ONE advisory lookup for every target at once, and the
+ * smallest that holds nothing affected becomes the target, with the reason. None clean among
+ * them: the target stays, flagged `heldBlocked`; the check could not run (registry, OSV, time):
+ * flagged `heldUnchecked`. Either way the target is no longer reported as checked against every
+ * advisory (targetCheckedAll). A release that holds nothing needs no lookup at all.
+ */
+import { heldAdvisories, heldCandidates } from "./held-dependencies.js";
+import { cleanReleases } from "./osv-ranges.js";
+import { lineNoticeText } from "./fix-paths.js";
+/**
+ * The npm targets of `items`, re-judged by what they hold, within `deadline`. Returns the
+ * replacement result per key; keys with nothing held (or not npm, or not checked) are absent.
+ */
+export async function withHeldTargets(sources, query, items, deadline) {
+    const out = new Map();
+    // Only a target that was checked against the package's own advisories can be moved on from;
+    // one that was not is already reported as checked against the installed version's advisories only.
+    const todo = items.filter((i) => i.clean.target && !i.clean.advisoriesUnread);
+    const plans = [];
+    await Promise.all(todo.map(async (item) => {
+        const target = item.clean.target;
+        const facts = await settle(sources.releaseFacts("npm", item.name), deadline);
+        if (!facts) {
+            out.set(item.key, { ...item.clean, heldUnchecked: "the npm registry could not be read in time" });
+            return;
+        }
+        if (!facts.heldSpecs) {
+            out.set(item.key, { ...item.clean, heldUnchecked: "the npm registry facts carry no dependency specs" });
+            return;
+        }
+        if (!facts.heldSpecs[target])
+            return; // holds nothing: what it installs is ranges a refresh moves
+        const advisories = await settle(sources.packageAdvisories("npm", item.name), deadline);
+        // Without the package's own advisory list no later release can be judged; the target alone still can.
+        const candidates = advisories ? heldCandidates(target, facts, advisories, item.installed) : [target];
+        plans.push({ item, candidates, facts });
+    }));
+    if (plans.length === 0)
+        return out;
+    const releases = plans.flatMap((p) => p.candidates.map((v) => ({ key: `${p.item.name}@${v}`, specs: p.facts.heldSpecs[v] ?? {} })));
+    const checks = await heldAdvisories(sources, query, releases, deadline);
+    for (const { item, candidates, facts } of plans) {
+        const target = item.clean.target;
+        const at = (v) => checks.get(`${item.name}@${v}`) ?? { status: "unchecked", reason: "the check did not finish in time" };
+        const own = at(target);
+        if (own.status === "unchecked") {
+            out.set(item.key, { ...item.clean, heldUnchecked: own.reason });
+            continue;
+        }
+        if (own.affected.length === 0)
+            continue;
+        const past = [];
+        let chosen = null;
+        for (const v of candidates) {
+            const c = at(v);
+            if (c.status === "checked" && c.affected.length === 0) {
+                chosen = v;
+                break;
+            }
+            // An unchecked candidate is passed silently: the one chosen after it was itself judged clean.
+            if (c.status === "checked")
+                past.push({ version: v, affected: c.affected });
+        }
+        if (!chosen) {
+            out.set(item.key, { ...item.clean, heldBlocked: { affected: own.affected, searched: candidates } });
+            continue;
+        }
+        const view = cleanReleases((await settle(sources.packageAdvisories("npm", item.name), deadline)) ?? [], "npm", facts.versions, item.installed);
+        const notice = facts.lineNotices?.[chosen];
+        const { targetNotice: _old, ...rest } = item.clean;
+        out.set(item.key, {
+            ...rest,
+            target: chosen,
+            stillAffectedBy: view.remains(chosen),
+            heldFrom: target,
+            heldPast: past,
+            ...(notice ? { targetNotice: lineNoticeText(chosen, notice) } : {}),
+        });
+    }
+    return out;
+}
+/** The value, or null when it fails or `deadline` passes first. */
+async function settle(work, deadline) {
+    let timer;
+    const late = new Promise((resolve) => {
+        timer = setTimeout(() => resolve(null), Math.max(0, deadline - Date.now()));
+    });
+    try {
+        return await Promise.race([work.catch(() => null), late]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}

package/dist/live/http-utils.js

@@ -2,12 +2,22 @@
 const DEFAULT_TIMEOUT_MS = 10_000;
 export async function fetchWithTimeout(url, options = {}, timeoutMs = DEFAULT_TIMEOUT_MS) {
     const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    let timeout = setTimeout(() => controller.abort(), timeoutMs);
     try {
-        return await fetch(url, { ...options, signal: controller.signal });
+        const response = await fetch(url, { ...options, signal: controller.signal });
+        // The headers are in; the body is not read yet. Clearing the abort here left json(), text()
+        // and arrayBuffer() with no deadline: a server that stalled mid-body hung vulnerability_scan
+        // and dependency_check, and every later scan that joined the stuck one (audit 6.2.5 B-6).
+        // The abort stays armed for the body, with its own allowance; unref'd, it never holds the
+        // process open, and aborting a body already read does nothing.
+        clearTimeout(timeout);
+        timeout = setTimeout(() => controller.abort(), timeoutMs);
+        timeout.unref?.();
+        return response;
     }
-    finally {
+    catch (error) {
         clearTimeout(timeout);
+        throw error;
     }
 }
 export async function fetchJson(url, options = {}, timeoutMs = DEFAULT_TIMEOUT_MS) {

package/dist/live/index.d.ts

@@ -13,6 +13,7 @@ import { FixPathSources } from "./fix-paths.js";
 import type { CheckEcosystem, ReleaseMetadataSource } from "./release-metadata.js";
 import { type ResolutionGroup } from "./resolution.js";
 import type { TreeDiscovery } from "../project-tree.js";
+import type { LockfileProblem } from "./lockfile-types.js";
 import type { InstallDriftRecord, ResolutionProvenance, ResolvedDependency, RegistryPackageInfo, VulnerabilityScanResult, LiveHeadline, LiveIntelligenceStatus } from "./types.js";
 export type { VulnerabilityScanResult, VulnerabilityEntry, LiveHeadline, LiveIntelligenceStatus, RegistryPackageInfo, DependencyHealthResult, InstallDriftRecord, ResolutionProvenance, } from "./types.js";
 export declare class LiveIntelligence {
@@ -116,6 +117,8 @@ export declare class LiveIntelligence {
         manifest: string;
         ranges: number;
     }>;
+    /** Lockfiles present in a resolved directory that could not be read, each with the reason. */
+    getLockfileProblems(): LockfileProblem[];
     /** What the project-tree walk left out (lockfiles past its bounds); null when the set did not come from a walk. */
     getDiscovery(): TreeDiscovery | null;
     /**
@@ -160,10 +163,10 @@ export declare class LiveIntelligence {
     /**
      * Run vulnerability scan (returns cached if fresh, fetches otherwise).
      *
-     * Without `includeDev`, only DIRECT devDependencies are left out (the
-     * documented contract). A transitive stays in whatever its scope: an
-     * unknown scope must not be hidden, and a known dev-only one is graded
-     * down by the shared severity rule, not dropped.
+     * Without `includeDev`, every dev-only copy is left out (severity-scope.ts
+     * isDevOnlyCopy: a direct devDependency, or a transitive whose every path
+     * is a dev one), the population dependency_health and upgrade_planner leave
+     * out too. A copy of unknown scope stays: it must not be hidden.
      */
     scanVulnerabilities(projectPath: string, options?: {
         includeDev?: boolean;

package/dist/live/index.js

@@ -23,9 +23,11 @@ import { GoReleasesReader } from "./go-releases.js";
 import { FixPathSources } from "./fix-paths.js";
 import { fetchRegistryHealthFor } from "./registry-health.js";
 import { commonPathRoot, dedupeDependencies, emptyVulnResult } from "./dependency-set.js";
+import { LOOKUPS_DISABLED } from "./scan-coverage.js";
 import { groupIsStale, resolveGroup } from "./resolution.js";
 import { mapEcosystem } from "./version-resolver.js";
 import { applyInstanceDevScope } from "./dev-scope.js";
+import { isDevOnlyCopy } from "./severity-scope.js";
 /** Minimum gap between vulnerability warmup attempts after an offline result. */
 const WARMUP_RETRY_MS = 60_000;
 export class LiveIntelligence {
@@ -160,6 +162,11 @@ export class LiveIntelligence {
     getUnresolvedManifests() {
         return this.groupResults.flatMap((r) => (r.unresolved ? [{ dir: r.group.dir, ...r.unresolved }] : []));
     }
+    /** Lockfiles present in a resolved directory that could not be read, each with the reason. */
+    getLockfileProblems() {
+        const seen = new Set();
+        return this.groupResults.flatMap((r) => r.problems ?? []).filter((p) => !seen.has(p.file) && (seen.add(p.file), true));
+    }
     /** What the project-tree walk left out (lockfiles past its bounds); null when the set did not come from a walk. */
     getDiscovery() {
         return this.discovery;
@@ -250,21 +257,19 @@ export class LiveIntelligence {
     /**
      * Run vulnerability scan (returns cached if fresh, fetches otherwise).
      *
-     * Without `includeDev`, only DIRECT devDependencies are left out (the
-     * documented contract). A transitive stays in whatever its scope: an
-     * unknown scope must not be hidden, and a known dev-only one is graded
-     * down by the shared severity rule, not dropped.
+     * Without `includeDev`, every dev-only copy is left out (severity-scope.ts
+     * isDevOnlyCopy: a direct devDependency, or a transitive whose every path
+     * is a dev one), the population dependency_health and upgrade_planner leave
+     * out too. A copy of unknown scope stays: it must not be hidden.
      */
     async scanVulnerabilities(projectPath, options) {
         if (!this.enabled) {
-            return emptyVulnResult(projectPath, true);
+            return emptyVulnResult(projectPath, true, { count: this.auditDeps.length, reason: LOOKUPS_DISABLED });
         }
-        const scoped = options?.includeDev
-            ? this.auditDeps
-            : this.auditDeps.filter((d) => !(d.isDirect && d.isDev));
         // Read at scan time, not init time: the app rewrites its inventory on
         // every rescan, and the freshest determination is the one to grade by.
-        const deps = applyInstanceDevScope(this.db, scoped);
+        const scoped = applyInstanceDevScope(this.db, this.auditDeps);
+        const deps = options?.includeDev ? scoped : scoped.filter((d) => !isDevOnlyCopy(d));
         if (deps.length === 0) {
             return emptyVulnResult(projectPath, false);
         }
@@ -297,12 +302,12 @@ export class LiveIntelligence {
             }
             return result;
         }
-        catch {
-            // Network failure — return last known or empty
-            if (generation === this.generation && this.lastVulnScan) {
-                return { ...this.lastVulnScan, offline: true, cached: true };
-            }
-            return emptyVulnResult(projectPath, true);
+        catch (error) {
+            // The scanner reports unreachable dependencies itself; reaching here is
+            // an unexpected failure. Nothing was checked, and the answer says so
+            // (it used to hand back the last scan or an empty one, read as clean).
+            const reason = `the scan failed (${error instanceof Error ? error.message.slice(0, 120) : String(error)})`;
+            return { ...emptyVulnResult(projectPath, true, { count: deps.length, reason }), ecosystemsScanned: [...new Set(deps.map((d) => d.ecosystem))] };
         }
     }
     /**
@@ -320,7 +325,7 @@ export class LiveIntelligence {
         if (this.warmup)
             return;
         this.warmupFailedAt = null;
-        this.warmup = this.scanVulnerabilities(projectPath).catch(() => emptyVulnResult(projectPath, true));
+        this.warmup = this.scanVulnerabilities(projectPath).catch((error) => emptyVulnResult(projectPath, true, { count: this.auditDeps.length, reason: `the scan failed (${String(error).slice(0, 120)})` }));
     }
     /**
      * A usable vulnerability scan, or null. Re-resolves first when a lockfile
@@ -467,12 +472,12 @@ export class LiveIntelligence {
      */
     async queryAdvisories(deps) {
         if (!this.enabled)
-            return emptyVulnResult("dependency_check", true);
+            return emptyVulnResult("dependency_check", true, { count: deps.length, reason: LOOKUPS_DISABLED });
         try {
             return await this.osvScanner.scan(deps, "dependency_check");
         }
-        catch {
-            return emptyVulnResult("dependency_check", true);
+        catch (error) {
+            return emptyVulnResult("dependency_check", true, { count: deps.length, reason: `the scan failed (${String(error).slice(0, 120)})` });
         }
     }
     getStatus() {

package/dist/live/install-state.js

@@ -126,8 +126,12 @@ export function checkInstallState(dir, resolved, lockfilePath) {
         const manifest = findInstalledManifest(dir, dep.name, chain);
         if (manifest)
             signatures.set(manifest, fileSignature(manifest));
-        const installedVersion = manifest ? readManifestVersion(manifest) : null;
-        if (installedVersion && installedVersion !== dep.version) {
+        // A leading `v` is not part of the version: @upstash/* publish "v2.0.7",
+        // which read as drift from the lockfile's 2.0.7 (audit L1), and would have
+        // gone to OSV as "v2.0.7". The 4DA app drops it the same way.
+        const raw = manifest ? readManifestVersion(manifest) : null;
+        const installedVersion = raw ? raw.trim().replace(/^v(?=\d)/, "") : null;
+        if (installedVersion && installedVersion !== dep.version.replace(/^v(?=\d)/, "")) {
             drift.push({
                 package: dep.name,
                 dir,

package/dist/live/js-lockfile-readers.d.ts

@@ -64,10 +64,17 @@ export declare function readPnpmLock(content: string, versions: Map<string, stri
  * names the real package in `resolution:`; v1 only in the alias spec.
  */
 export declare function yarnPackageName(block: string, firstLine: string, headerName: string): string;
+/** Lines longer than this in a yarn.lock are not read: no real entry comes near it. */
+export declare const MAX_LOCKFILE_LINE = 4096;
+/** The `version` of a yarn.lock block: v1 `  version "1.2.3"`, berry `  version: 1.2.3`. */
+export declare function yarnBlockVersion(block: string): string | null;
 /**
  * Reads a yarn lockfile (v1 or berry) into `versions`.
  * v1: `"@scope/pkg@^1.0.0", "@scope/pkg@^1.1.0":` then `  version "1.2.3"`.
  * berry: `"@scope/pkg@npm:^1.0.0":` then `  version: 1.2.3`.
  * Workspace, link, portal, file, exec and patch entries do not name a registry version.
+ * Returns how many entries were skipped because a line of theirs is longer
+ * than MAX_LOCKFILE_LINE, so the caller can say the read was partial (audit
+ * L5: the skip was silent).
  */
-export declare function readYarnLock(content: string, versions: Map<string, string>, instances?: InstanceSet, specs?: Map<string, string>): void;
+export declare function readYarnLock(content: string, versions: Map<string, string>, instances?: InstanceSet, specs?: Map<string, string>): number;