@4da/mcp-server 6.2.4 → 6.2.5

package/dist/live/js-lockfile-readers.js

@@ -249,8 +249,11 @@ export function readPnpmLock(content, versions, instances) {
         setFirst(name, version);
     if (!instances)
         return;
+    // A Set, not `transitive.some` per entry: that was O(n²), and a 200k-entry pnpm-lock.yaml
+    // held the single-threaded stdio server for 409 s (audit 6.2.5 C-8).
+    const seen = new Set(transitive.map(([n, v]) => `${n}${v}`));
     for (const [name, version] of versions) {
-        if (!transitive.some(([n, v]) => n === name && v === version))
+        if (!seen.has(`${name}${version}`))
             instances.add(name, version);
     }
     for (const [name, version] of transitive)
@@ -265,30 +268,63 @@ export function readPnpmLock(content, versions, instances) {
  * names the real package in `resolution:`; v1 only in the alias spec.
  */
 export function yarnPackageName(block, firstLine, headerName) {
-    const resolution = /^\s+resolution:\s+"?((?:@[^\s/@"]+\/)?[^\s/@"]+)@npm:/m.exec(block);
+    const resolution = yarnBlockField(block, /^[ \t]+resolution:[ \t]+"?((?:@[^\s/@"]+\/)?[^\s/@"]+)@npm:/);
     if (resolution)
-        return resolution[1];
+        return resolution;
     const alias = /^"?(?:@[^\s/@"]+\/)?[^\s/@"]+@npm:((?:@[^\s/@"]+\/)?[^\s/@"]+)@/.exec(firstLine);
     return alias ? alias[1] : headerName;
 }
+/** Lines longer than this in a yarn.lock are not read: no real entry comes near it. */
+export const MAX_LOCKFILE_LINE = 4096;
+/**
+ * The first capture of `lineRe` on any line of a yarn.lock block, or null.
+ * Line by line with single-line regexes: the multiline `/^\s+version.../m`
+ * forms they replace let `\s+` run across lines and took ~5 s on a hostile
+ * 64 KB block (audit 2026-10-12, B-10).
+ */
+function yarnBlockField(block, lineRe) {
+    for (const line of block.split(/\r?\n/)) {
+        if (line.length > MAX_LOCKFILE_LINE)
+            continue;
+        const m = lineRe.exec(line);
+        if (m)
+            return m[1];
+    }
+    return null;
+}
+/** The `version` of a yarn.lock block: v1 `  version "1.2.3"`, berry `  version: 1.2.3`. */
+export function yarnBlockVersion(block) {
+    return yarnBlockField(block, /^[ \t]+version:?[ \t]+"?([^"\s]+)"?[ \t]*$/);
+}
 /**
  * Reads a yarn lockfile (v1 or berry) into `versions`.
  * v1: `"@scope/pkg@^1.0.0", "@scope/pkg@^1.1.0":` then `  version "1.2.3"`.
  * berry: `"@scope/pkg@npm:^1.0.0":` then `  version: 1.2.3`.
  * Workspace, link, portal, file, exec and patch entries do not name a registry version.
+ * Returns how many entries were skipped because a line of theirs is longer
+ * than MAX_LOCKFILE_LINE, so the caller can say the read was partial (audit
+ * L5: the skip was silent).
  */
 export function readYarnLock(content, versions, instances, specs) {
+    let skipped = 0;
     for (const block of content.split(/\r?\n(?=\S)/)) {
         const firstLine = block.split(/\r?\n/)[0];
+        if (firstLine.length > MAX_LOCKFILE_LINE) {
+            skipped++;
+            continue;
+        }
         const header = /^"?(@?[^@\s"]+)@/.exec(firstLine);
         if (!header || header[1].startsWith("__"))
             continue;
         if (/@(?:workspace|link|portal|file|exec|patch):/.test(firstLine))
             continue;
-        const line = /^\s+version:?\s+"?([^"\s]+)"?\s*$/m.exec(block);
-        const version = line ? exactVersion(line[1]) : null;
-        if (!version)
+        const raw = yarnBlockVersion(block);
+        const version = raw ? exactVersion(raw) : null;
+        if (!version) {
+            if (block.split(/\r?\n/).some((line) => line.length > MAX_LOCKFILE_LINE))
+                skipped++;
             continue;
+        }
         const name = yarnPackageName(block, firstLine, header[1]);
         // One block per resolved version. Blocks are sorted by spec, so the first
         // block of a name can be an old nested copy; `specs` lets the caller pick
@@ -302,4 +338,5 @@ export function readYarnLock(content, versions, instances, specs) {
             }
         }
     }
+    return skipped;
 }

package/dist/live/lockfile-parents.d.ts

@@ -17,6 +17,19 @@ export interface ParentEdge {
     range: string | null;
     /** True when the parent is the project itself or a workspace member (then the package is direct there). */
     local: boolean;
+    /**
+     * True when the copy ships inside `parent`'s tarball (package-lock `inBundle`): `range` is then the
+     * exact version shipped. No refresh moves it and no override reaches it (both checked with npm
+     * 10.9.2, 2026-10-15); only a new `parent` release, or replacing `parent`, does (audit E8).
+     */
+    bundled?: boolean;
+    /**
+     * For a local edge: the declaring manifest's directory relative to the lockfile's ("." for the
+     * project itself, "packages/a" for a workspace member), when the lockfile names it.
+     */
+    dir?: string;
+    /** For a local edge: the manifest section that declares it. */
+    section?: "dependencies" | "devDependencies" | "optionalDependencies" | "peerDependencies";
 }
 export interface LockfileParents {
     format: LockfileFormat;
@@ -30,10 +43,12 @@ interface LockEntry {
     name?: string;
     version?: string;
     link?: boolean;
+    inBundle?: boolean;
     requires?: Record<string, string>;
     dependencies?: Record<string, string> | Record<string, LockEntry>;
     optionalDependencies?: Record<string, string>;
     peerDependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
 }
 export declare function packageLockParents(lock: {
     packages?: Record<string, LockEntry>;

package/dist/live/lockfile-parents.js

@@ -11,9 +11,16 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { stripTrailingCommas } from "./bun-lockfile.js";
-import { exactVersion, parsePnpmKey, pnpmEntryIdentities, pnpmKeyRef, yarnPackageName } from "./js-lockfile-readers.js";
+import { exactVersion, MAX_LOCKFILE_LINE, parsePnpmKey, pnpmEntryIdentities, pnpmKeyRef, yarnBlockVersion, yarnPackageName } from "./js-lockfile-readers.js";
 import { packageNameFromNodeModulesPath, parseCargoLockPackages } from "./lockfile-parsers.js";
 const DEP_FIELDS = ["dependencies", "optionalDependencies", "peerDependencies"];
+/**
+ * The project's own manifest and each workspace member's also declare devDependencies, which a
+ * dependency's lockfile entry never carries. Leaving them out read a dev-only transitive's lever
+ * as "no declared dependency above" (navcal: @vitest/mocker and tinypool arrive through the
+ * devDependency vitest) and a member's devDependency as undeclared (final release audit, finding 3).
+ */
+const LOCAL_DEP_FIELDS = ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"];
 /** The lockfile format of a path, or null for a file this module does not read. */
 export function lockfileFormat(file, content) {
     const base = path.basename(file);
@@ -73,27 +80,72 @@ function resolveInstallPath(packages, from, name) {
         dir = cut >= 0 ? dir.slice(0, cut) : "";
     }
 }
+/**
+ * The package a bundled copy at install path `at` ships inside: the nearest enclosing entry that is
+ * not itself `inBundle`. A level the lockfile does not list is passed over. Null when none is found.
+ */
+function bundleOwner(packages, at) {
+    let dir = at;
+    for (;;) {
+        const cut = dir.lastIndexOf("/node_modules/");
+        if (cut < 0)
+            return null;
+        dir = dir.slice(0, cut);
+        const entry = packages[dir];
+        if (entry && !entry.inBundle)
+            return dir;
+    }
+}
+/** A key that installs a DEPENDENCY (under some `node_modules/`), not the root or a workspace member's folder. */
+function isDependencyKey(key) {
+    return key.startsWith("node_modules/") || key.includes("/node_modules/");
+}
+/**
+ * Whether the entry at `key` is a copy bundled inside a DEPENDENCY's tarball. A project's or workspace
+ * member's own `bundleDependencies` also set `inBundle` (Arborist's bundler can be the root), but those
+ * copies sit in the user's tree, where `npm update` and overrides reach them like any other.
+ */
+function bundledInDependency(packages, key) {
+    if (!packages[key]?.inBundle)
+        return false;
+    const owner = bundleOwner(packages, key);
+    return owner !== null && isDependencyKey(owner);
+}
 export function packageLockParents(lock, name, version) {
     const edges = [];
     if (lock.packages && Object.keys(lock.packages).length > 0) {
         const packages = lock.packages;
+        // A bundled copy hangs off its bundle owner, pinned to the version shipped: the ranges the
+        // bundle's own packages declare say nothing about what a refresh can reach (audit E8:
+        // NodeGoat's debug 4.1.1 inside fsevents read "npm update debug" from needle's ^4.1.0).
+        const owners = new Set();
+        for (const [key, entry] of Object.entries(packages)) {
+            if (entry?.version !== version || packageNameFromNodeModulesPath(key) !== name || !bundledInDependency(packages, key))
+                continue;
+            const owner = bundleOwner(packages, key);
+            if (!owner || owners.has(owner))
+                continue;
+            owners.add(owner);
+            edges.push({ parent: packageNameFromNodeModulesPath(owner), parentVersion: packages[owner]?.version ?? null, range: version, local: false, bundled: true });
+        }
         for (const [key, entry] of Object.entries(packages)) {
             if (!entry || entry.link)
                 continue;
-            for (const field of DEP_FIELDS) {
+            const local = !key.startsWith("node_modules/") && !key.includes("/node_modules/");
+            for (const field of local ? LOCAL_DEP_FIELDS : DEP_FIELDS) {
                 const declared = entry[field];
                 const range = declared?.[name];
                 if (typeof range !== "string")
                     continue;
                 const at = resolveInstallPath(packages, key, name);
-                if (!at || packages[at]?.version !== version)
+                if (!at || packages[at]?.version !== version || bundledInDependency(packages, at))
                     continue;
-                const local = !key.startsWith("node_modules/") && !key.includes("/node_modules/");
                 edges.push({
                     parent: local ? entry.name ?? (key || lock.name || ".") : packageNameFromNodeModulesPath(key),
                     parentVersion: local ? null : entry.version ?? null,
                     range,
                     local,
+                    ...(local ? { dir: key === "" ? "." : key, section: field } : {}),
                 });
                 break;
             }
@@ -215,7 +267,7 @@ export function pnpmParents(content, name, version) {
             importerSpecifier = null;
             if (pendingDep && m?.[4]) {
                 if (isTarget(pendingDep, m[4]))
-                    add({ parent: importer, parentVersion: null, range: null, local: true });
+                    add({ parent: importer, parentVersion: null, range: null, local: true, dir: importer });
                 pendingDep = null;
             }
         }
@@ -226,7 +278,7 @@ export function pnpmParents(content, name, version) {
             const ver = /^version:\s*(.+)$/.exec(text);
             if (ver) {
                 if (isTarget(pendingDep, ver[1]))
-                    add({ parent: importer, parentVersion: null, range: importerSpecifier, local: true });
+                    add({ parent: importer, parentVersion: null, range: importerSpecifier, local: true, dir: importer });
                 pendingDep = null;
             }
         }
@@ -237,17 +289,40 @@ export function pnpmParents(content, name, version) {
 // yarn.lock (v1 and berry)
 // ---------------------------------------------------------------------------
 const unquote = (s) => s.trim().replace(/^"|"$/g, "");
+/**
+ * A yarn dependency line: v1 `name "range"`, berry `name: "npm:range"` or
+ * `"@scope/x": range`. The name by regex, the range by hand: the single regex
+ * this replaces had a lazy group before `"?\s*$` and was quadratic, ~5 s on a
+ * hostile 64 KB line (audit 2026-10-12, B-10). Same results otherwise.
+ */
+function yarnDepLine(text) {
+    if (text.length > MAX_LOCKFILE_LINE)
+        return null;
+    const head = /^"?((?:@[^\s"/]+\/)?[^\s":]+)"?:?\s+/.exec(text);
+    if (!head)
+        return null;
+    let range = text.slice(head[0].length).trimEnd();
+    if (range.startsWith('"'))
+        range = range.slice(1);
+    if (range.endsWith('"'))
+        range = range.slice(0, -1);
+    if (range === "" || range.includes('"'))
+        return null;
+    return [head[1], range];
+}
 function parseYarnBlocks(content) {
     const blocks = [];
     for (const block of content.split(/\r?\n(?=\S)/)) {
         const lines = block.split(/\r?\n/);
         const header = lines[0];
+        if (header.length > MAX_LOCKFILE_LINE)
+            continue;
         const headerName = /^"?(@?[^@\s"]+)@/.exec(header)?.[1];
         if (!headerName || headerName.startsWith("__"))
             continue;
         // An npm alias block (`string-width-cjs@npm:string-width@^4.2.0`) installs the real package.
         const name = yarnPackageName(block, header, headerName);
-        const version = /^\s+version:?\s+"?([^"\s]+)"?\s*$/m.exec(block)?.[1];
+        const version = yarnBlockVersion(block);
         if (!version)
             continue;
         const specs = header.replace(/:\s*$/, "").split(",").map((s) => unquote(s).replace(/@npm:/, "@"));
@@ -266,9 +341,9 @@ function parseYarnBlocks(content) {
             }
             if (inDeps && indent > depIndent) {
                 // v1: `name "range"`; berry: `name: "npm:range"` or `"@scope/x": range`.
-                const m = /^"?((?:@[^\s"/]+\/)?[^\s":]+)"?:?\s+"?([^"]+?)"?\s*$/.exec(text);
-                if (m)
-                    deps.push([m[1], m[2]]);
+                const dep = yarnDepLine(text);
+                if (dep)
+                    deps.push(dep);
             }
             else {
                 inDeps = false;

package/dist/live/lockfile-parsers-pygo.d.ts

@@ -14,7 +14,7 @@
  *   pseudo-version, so older advisories were missed and later ones invented.
  *   go.sum also lists versions the build never selected.
  */
-import { InstanceSet, type VersionSource } from "./lockfile-types.js";
+import { InstanceSet, type LockfileProblem, type VersionSource } from "./lockfile-types.js";
 /** PEP 503 normalised name: lowercase, runs of `-`, `_`, `.` become one `-`. */
 export declare function normalizePythonName(name: string): string;
 /**
@@ -44,11 +44,56 @@ export declare function resolvePython(cwd: string): VersionSource;
  * includes (relative to the file) and applying `-c`/`--constraint` files:
  * a constraints file installs nothing by itself, so its pins only give a
  * version to a name the requirements list without one. Null when unreadable.
+ *
+ * Includes are confined to `root`, the project directory (default: the
+ * file's own directory). A cloned repository's `-r ../outside/secrets.txt`,
+ * an absolute path, or a UNC path (on Windows, opening `\\host\share\x.txt`
+ * makes an SMB connection that sends the user's NTLM hash) used to be read,
+ * and every `NAME==VALUE` line in it went to OSV.dev and back to the agent.
+ * Such an include is skipped; absolute and UNC ones before any fs call.
+ * Skipped is not silent: each one goes to `problems` (audit M4), which the
+ * scan reports as a file whose pins were not checked.
  */
-export declare function readRequirementsFile(file: string, visited?: Set<string>): Array<{
+export declare function readRequirementsFile(file: string, visited?: Set<string>, root?: string, problems?: LockfileProblem[]): Array<{
     name: string;
     version: string;
 }> | null;
+/**
+ * The include's absolute path when `target` is a relative path that stays
+ * inside `root` (also after resolving symlinks, when it exists); otherwise
+ * null. Absolute, drive-letter and UNC targets are refused before any
+ * filesystem call.
+ */
+export declare function confinedInclude(dir: string, target: string, root: string): string | null;
+/** `-r file` / `--requirement=file` / `-c file` / `--constraint file` lines (local paths only). */
+export declare function requirementOptions(content: string): Array<{
+    option: "r" | "c";
+    target: string;
+}>;
+/**
+ * A requirements file a resolver wrote: `uv pip compile` or `pip-compile` output. Its source of
+ * truth is the input it was compiled from (requirements.in, pyproject.toml), and a hand edit of a
+ * pin is reverted by the next compile. Each pin's `# via` annotation says why it is there: an
+ * input (`-r requirements.in`, `name (pyproject.toml)`) or only the packages that require it.
+ * The server read `# via requests` pins as declared and said "change `idna==2.7` to `idna==3.15`
+ * in requirements.txt", which requests 2.19.1 (`idna<2.8`) then refused (audit 6.2.5 A-4).
+ */
+export interface CompiledRequirements {
+    /** The tool its header names; null when only `# via` annotations show it (a `--no-header` compile). */
+    tool: "uv" | "pip-compile" | null;
+    /** The single input file the header's command (else the `# via` annotations) names, as written there; null when none or several. */
+    input: string | null;
+    /** PEP 503 name -> its `# via` entries as written (an entry per required-by package or input). */
+    via: Map<string, string[]>;
+}
+export declare function compiledRequirements(content: string): CompiledRequirements | null;
+/**
+ * Indirect: compiled in only because other packages require it (every `# via` entry is a package).
+ * False for a pin an input names, and for one with no annotation (its reason is unknown).
+ */
+export declare function compiledIndirect(compiled: CompiledRequirements, name: string): boolean;
+/** The packages a compiled pin is `# via` (those that require it), PEP 503 normalised. */
+export declare function compiledRequiredBy(compiled: CompiledRequirements, name: string): string[];
 /**
  * [[package]] tables from poetry.lock (any version) or uv.lock. A pre-1.2
  * poetry.lock records `category = "dev"` for dev-only packages; newer files

package/dist/live/lockfile-parsers-pygo.js

@@ -53,7 +53,10 @@ export function requirementFiles(cwd) {
     catch {
         // no requirements/ folder
     }
-    return out;
+    // A symlinked requirements-dev.txt or a junctioned requirements/ folder can point anywhere; only
+    // `-r` includes were confined, so pins from outside the project reached OSV and the output
+    // (audit 6.2.5 C-3). Every file read must resolve inside the project.
+    return out.filter((file) => confinedInclude(cwd, path.relative(cwd, file), cwd) !== null);
 }
 /** Above this a .txt is not read to decide whether it is a requirements file. */
 const MAX_SNIFF_BYTES = 256 * 1024;
@@ -139,26 +142,39 @@ export function resolvePython(cwd) {
         }
         catch { /* unreadable */ }
     }
+    const collected = [];
     for (const file of requirementFiles(cwd)) {
         const dev = devRequirementsFile(file) ? true : undefined;
-        const pins = readRequirementsFile(file);
+        const pins = readRequirementsFile(file, new Set(), cwd, collected);
         if (pins === null)
             continue;
         for (const { name, version } of pins)
             take(name, version, dev);
         sources.push(file);
     }
+    // One problem per file, however many requirement files name it.
+    const problems = [...new Map(collected.map((p) => [p.file.toLowerCase(), p])).values()];
     if (sources.length === 0)
-        return emptySource();
-    return found(versions, instances, sources[0], lockfile ? "lockfile" : "manifest", { extraSources: sources.slice(1) });
+        return problems.length > 0 ? { ...emptySource(), problems } : emptySource();
+    const read = found(versions, instances, sources[0], lockfile ? "lockfile" : "manifest", { extraSources: sources.slice(1) });
+    return problems.length > 0 ? { ...read, problems } : read;
 }
 /**
  * Exact pins from one requirements file, following `-r`/`--requirement`
  * includes (relative to the file) and applying `-c`/`--constraint` files:
  * a constraints file installs nothing by itself, so its pins only give a
  * version to a name the requirements list without one. Null when unreadable.
+ *
+ * Includes are confined to `root`, the project directory (default: the
+ * file's own directory). A cloned repository's `-r ../outside/secrets.txt`,
+ * an absolute path, or a UNC path (on Windows, opening `\\host\share\x.txt`
+ * makes an SMB connection that sends the user's NTLM hash) used to be read,
+ * and every `NAME==VALUE` line in it went to OSV.dev and back to the agent.
+ * Such an include is skipped; absolute and UNC ones before any fs call.
+ * Skipped is not silent: each one goes to `problems` (audit M4), which the
+ * scan reports as a file whose pins were not checked.
  */
-export function readRequirementsFile(file, visited = new Set()) {
+export function readRequirementsFile(file, visited = new Set(), root = path.dirname(path.resolve(file)), problems = []) {
     const key = path.resolve(file).toLowerCase();
     if (visited.has(key))
         return [];
@@ -172,11 +188,23 @@ export function readRequirementsFile(file, visited = new Set()) {
     }
     const dir = path.dirname(file);
     const out = parseRequirements(content);
+    const overlong = overlongRequirementLines(content);
+    if (overlong > 0) {
+        problems.push({
+            file: path.resolve(file),
+            skipped: overlong,
+            error: `${overlong === 1 ? "1 line" : `${overlong} lines`} longer than ${MAX_REQUIREMENT_LINE} characters (not requirement syntax) ${overlong === 1 ? "was" : "were"} skipped, so any pin on ${overlong === 1 ? "it was" : "them was"} not checked`,
+        });
+    }
     const constraints = new Map();
     for (const { option, target } of requirementOptions(content)) {
-        const included = path.resolve(dir, target);
+        const included = confinedInclude(dir, target, root);
+        if (included === null) {
+            problems.push(refusedInclude(file, option, target));
+            continue;
+        }
         if (option === "r")
-            out.push(...(readRequirementsFile(included, visited) ?? []));
+            out.push(...(readRequirementsFile(included, visited, root, problems) ?? []));
         else
             for (const pin of parseRequirements(safeRead(included)))
                 constraints.set(pin.name, pin.version);
@@ -191,6 +219,84 @@ export function readRequirementsFile(file, visited = new Set()) {
     }
     return out;
 }
+/**
+ * A refused include as a coverage problem. `file` is the include as it
+ * resolves (an absolute, drive-letter or UNC target as written: it is never
+ * resolved or touched), so the note names the file whose pins went unchecked.
+ */
+function refusedInclude(from, option, target) {
+    const absolute = /^[\\/]/.test(target) || /^[A-Za-z]:/.test(target) || path.isAbsolute(target);
+    return {
+        file: absolute ? target : path.resolve(path.dirname(from), target),
+        refused: true,
+        error: `\`-${option} ${target}\` in ${path.basename(from)} points outside the project directory, and includes outside it are never read, so the ${option === "r" ? "pins" : "constraints"} in it were not checked`,
+    };
+}
+/**
+ * The include's absolute path when `target` is a relative path that stays
+ * inside `root` (also after resolving symlinks, when it exists); otherwise
+ * null. Absolute, drive-letter and UNC targets are refused before any
+ * filesystem call.
+ */
+export function confinedInclude(dir, target, root) {
+    if (/^[\\/]/.test(target) || /^[A-Za-z]:/.test(target) || path.isAbsolute(target))
+        return null;
+    const within = (base, p) => {
+        const rel = path.relative(base, p);
+        return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
+    };
+    const rootDir = path.resolve(root);
+    const included = path.resolve(dir, target);
+    if (!within(rootDir, included))
+        return null;
+    let real;
+    try {
+        real = fs.realpathSync(included);
+    }
+    catch {
+        return included; // missing: nothing to escape through, and the read fails quietly
+    }
+    try {
+        return within(fs.realpathSync(rootDir), real) ? included : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Longer lines are not requirements; capping them keeps the regexes below linear in the file size. */
+const MAX_REQUIREMENT_LINE = 4096;
+/**
+ * Logical lines (backslash continuations joined, `--hash` options dropped),
+ * with over-long lines left out. The cap used to apply with the hashes in:
+ * a `pip-compile --generate-hashes` entry with many wheels (aiohttp 3.8.0:
+ * 72 files, 5.7 KB) was dropped silently and never scanned. A hash is not
+ * part of the pin, so it goes before the cap; the split is on whitespace,
+ * which stays linear on a hostile line.
+ */
+function requirementLines(content) {
+    return logicalRequirementLines(content).filter((line) => line.length <= MAX_REQUIREMENT_LINE);
+}
+function logicalRequirementLines(content) {
+    return content
+        .replace(/\\\r?\n/g, " ")
+        .split(/\r?\n/)
+        .map((line) => (line.includes("--hash") ? withoutHashes(line) : line));
+}
+function withoutHashes(line) {
+    const tokens = line.split(/[ \t]+/);
+    const kept = [];
+    for (let i = 0; i < tokens.length; i++) {
+        if (tokens[i] === "--hash")
+            i++; // `--hash sha256:...`: the value is the next token
+        else if (!tokens[i].startsWith("--hash=") && !tokens[i].startsWith("--hash:"))
+            kept.push(tokens[i]);
+    }
+    return kept.join(" ");
+}
+/** Lines left out for length that are not comments: what a read missed (audit L5's class). */
+function overlongRequirementLines(content) {
+    return logicalRequirementLines(content).filter((line) => line.length > MAX_REQUIREMENT_LINE && !line.trimStart().startsWith("#")).length;
+}
 function safeRead(file) {
     try {
         return fs.readFileSync(file, "utf-8");
@@ -200,9 +306,9 @@ function safeRead(file) {
     }
 }
 /** `-r file` / `--requirement=file` / `-c file` / `--constraint file` lines (local paths only). */
-function requirementOptions(content) {
+export function requirementOptions(content) {
     const out = [];
-    for (const raw of content.replace(/\\\r?\n/g, " ").split(/\r?\n/)) {
+    for (const raw of requirementLines(content)) {
         const m = /^\s*(?:-(r|c)|--(requirement|constraint))(?:\s*=\s*|\s+)(\S+)/.exec(raw);
         if (!m || /^[a-z][a-z+]*:\/\//i.test(m[3]))
             continue;
@@ -210,10 +316,120 @@ function requirementOptions(content) {
     }
     return out;
 }
+/** Header lines searched for the tool and its command (uv writes 2, pip-compile 5 to 7). */
+const COMPILED_HEADER_LINES = 12;
+export function compiledRequirements(content) {
+    const lines = content.split(/\r?\n/);
+    const head = lines.slice(0, COMPILED_HEADER_LINES);
+    const tool = head.some((l) => /^#.*autogenerated by uv\b/i.test(l))
+        ? "uv"
+        : head.some((l) => /^#.*autogenerated by pip-compile\b/i.test(l))
+            ? "pip-compile"
+            : null;
+    const via = viaAnnotations(lines);
+    if (tool === null && via.size === 0)
+        return null;
+    return { tool, input: headerInput(head) ?? viaInput(via), via };
+}
+/** Whether a `# via` entry is a package that requires the pin (not an input file or `-c` constraint). */
+function viaIsPackage(entry) {
+    return /^[A-Za-z0-9][A-Za-z0-9._-]*(?:\[[^\]]*\])?$/.test(entry);
+}
+/** The input a `# via` entry names: `-r requirements.in`, or `project (pyproject.toml)`. */
+function viaSource(entry) {
+    return /^-r\s+(\S+)$/.exec(entry)?.[1] ?? /^\S+\s+\(([^()\s]+)\)$/.exec(entry)?.[1] ?? null;
+}
+/**
+ * Indirect: compiled in only because other packages require it (every `# via` entry is a package).
+ * False for a pin an input names, and for one with no annotation (its reason is unknown).
+ */
+export function compiledIndirect(compiled, name) {
+    const entries = (compiled.via.get(normalizePythonName(name)) ?? []).filter((e) => !/^-c\s/.test(e));
+    return entries.length > 0 && entries.every(viaIsPackage);
+}
+/** The packages a compiled pin is `# via` (those that require it), PEP 503 normalised. */
+export function compiledRequiredBy(compiled, name) {
+    return (compiled.via.get(normalizePythonName(name)) ?? []).filter(viaIsPackage).map((e) => normalizePythonName(e.replace(/\[.*$/, "")));
+}
+/**
+ * `# via` annotations per pin, in both styles the tools write: split (pip-tools 6+, uv)
+ *   idna==2.7
+ *       # via requests          or      # via
+ *                                       #   requests
+ *                                       #   -r requirements.in
+ * and pip-tools 5's inline `idna==2.7  # via requests, urllib3`.
+ */
+function viaAnnotations(lines) {
+    const out = new Map();
+    let current = null;
+    let listing = false;
+    const add = (entry) => {
+        const e = entry.trim();
+        if (current && e)
+            out.set(current, [...(out.get(current) ?? []), e]);
+    };
+    for (const raw of lines) {
+        if (raw.length > MAX_REQUIREMENT_LINE)
+            continue;
+        const line = raw.trim();
+        if (!line.startsWith("#")) {
+            listing = false;
+            if (line.startsWith("--hash") || line === "" || line.startsWith("-"))
+                continue; // a hash continuation or an option keeps the pin
+            const pin = /^([A-Za-z0-9][A-Za-z0-9._-]*)\s*(?:\[[^\]]*\])?\s*===?/.exec(line);
+            current = pin ? normalizePythonName(pin[1]) : null;
+            const inline = /\s#\s*via\s+(.+)$/.exec(line);
+            if (current && inline)
+                for (const e of inline[1].split(","))
+                    add(e);
+            continue;
+        }
+        const via = /^#\s*via\b\s*(.*)$/.exec(line);
+        if (via) {
+            listing = via[1].trim() === "";
+            if (!listing)
+                add(via[1]);
+        }
+        else if (listing && /^#\s{2,}\S/.test(line)) {
+            add(line.replace(/^#\s+/, ""));
+        }
+        else {
+            listing = false;
+        }
+    }
+    return out;
+}
+/** Input-file names a compile command takes: requirements.in / *.txt, pyproject.toml, setup.cfg, setup.py. */
+const COMPILE_INPUT = /(?:\.in|\.txt|(?:^|\/)pyproject\.toml|(?:^|\/)setup\.cfg|(?:^|\/)setup\.py)$/i;
+/** Options whose value is a file but not the input (output, constraints, overrides). */
+const COMPILE_FILE_OPTIONS = new Set(["-o", "--output-file", "-c", "--constraint", "--constraints", "--override", "--overrides", "-b", "--build-constraint", "--build-constraints"]);
+/** The one input file the header's command line names (uv: after "via the following command:"; pip-compile: "by the following command:" / "To update, run:"). */
+function headerInput(head) {
+    const at = head.findIndex((l) => /following command:|to update, run:/i.test(l));
+    if (at < 0)
+        return null;
+    const command = head.slice(at + 1).map((l) => l.replace(/^#\s*/, "").trim()).find((l) => l.length > 0);
+    if (!command)
+        return null;
+    const tokens = command.split(/\s+/);
+    const inputs = tokens.filter((t, i) => !t.startsWith("-") && COMPILE_INPUT.test(t) && !COMPILE_FILE_OPTIONS.has(tokens[i - 1] ?? ""));
+    return inputs.length === 1 ? inputs[0] : null;
+}
+/** The one input the `# via` annotations name (`-r requirements.in`, `(pyproject.toml)`), when they name exactly one. */
+function viaInput(via) {
+    const sources = new Set();
+    for (const entries of via.values())
+        for (const e of entries) {
+            const s = viaSource(e);
+            if (s)
+                sources.add(s);
+        }
+    return sources.size === 1 ? [...sources][0] : null;
+}
 /** Names a requirements file lists with no exact pin ("flask", "flask>=2"), PEP 503 normalised. */
 function unpinnedRequirementNames(content) {
     const out = [];
-    for (const raw of content.replace(/\\\r?\n/g, " ").split(/\r?\n/)) {
+    for (const raw of requirementLines(content)) {
         const line = raw.replace(/(^|\s)#.*$/, "").trim();
         if (!line || line.startsWith("-"))
             continue;
@@ -278,8 +494,10 @@ export function readTomlPackageLock(content) {
  */
 export function parseRequirements(content) {
     const out = [];
-    // Backslash continuations join physical lines into one requirement.
-    const logical = content.replace(/\\\r?\n/g, " ").split(/\r?\n/);
+    // Backslash continuations join physical lines into one requirement; a line
+    // over 4 KB is no requirement and is dropped before any regex sees it (a
+    // 64 KB line took ~5 s in the pin regex, audit 2026-10-12 B-10).
+    const logical = requirementLines(content);
     for (const raw of logical) {
         // A `#` starts a comment at line start or after whitespace (PEP 508 URLs may contain `#`).
         const line = raw.replace(/(^|\s)#.*$/, "").trim();