@dependfix/mcp 0.1.2 → 0.2.0

package/README.en-US.md

@@ -0,0 +1,78 @@
+# @dependfix/mcp
+
+<!-- i18n: switch -->
+[简体中文](./README.md) | [English](./README.en-US.md)
+
+> dependfix MCP Server package. Exposes dependfix's scan/fix capabilities to AI coding assistants (Claude, Copilot, Cursor, etc.) via [Model Context Protocol](https://modelcontextprotocol.io/).
+
+## Installation
+
+```bash
+pnpm add @dependfix/mcp
+```
+
+## Tools
+
+| Tool | Function | Inputs |
+|:-----||:---------|:-------|
+| `fetch_alerts` | Fetch Dependabot security alerts for specified repo (optionally parallel Code Scanning, read-only) | `repo`, `severity?`, `code_scanning?` |
+| `discover_repos` | Auto-discover repos by owner / org (read-only) | `owner[]`, `topics?`, `include?`, `exclude?`, `probe_dependabot?` |
+| `run_scan` | Run dependfix scan and fix on target repo | `repo`, `mode?`, `severity?`, `code_scanning?`, `max_alerts?`, `max_concurrency?`, `dry_run?`, `allow_major_upgrade?`, `ai_enabled?`, `ai_provider?`, `ai_model?`, `ai_trigger?` |
+| `fix_dependency` | Fix single dependency or lockfile (override / direct / lockfile) | `workDir`, `fix_type?`, `packageName?`, `targetVersion?` |
+| `cleanup_branches` | Clean up merged/closed dependfix branches (non-interactive) | `repo`, `dry_run?` |
+| `history` | Query history run summary for specified repo (read-only) | `repo` |
+| `get_last_report` | Read most recent JSON report (read-only) | — |
+
+Parameter semantics align with CLI (severity is threshold semantics: `high` keeps critical + high; `dry_run` defaults inferred from mode; AI params only pass through switch and model, apiKey read from env var).
+
+## Configuration
+
+Add via MCP config file (stdio transport):
+
+```json
+{
+  "mcpServers": {
+    "dependfix": {
+      "command": "npx",
+      "args": ["@dependfix/mcp"],
+      "env": {
+        "GITHUB_TOKEN": "${GITHUB_TOKEN}"
+      }
+    }
+  }
+}
+```
+
+Environment variables:
+
+| Variable | Description |
+|:---------|:------------|
+| `GITHUB_TOKEN` | GitHub access credential (required for fetching alerts / running scans / branch cleanup) |
+| `DEPENDFIX_MCP_REPORT_DIR` | JSON report output dir (default `./dependfix-reports`) |
+| `DEPENDFIX_AI_API_KEY` | AI assessment API Key (required when `run_scan` `ai_enabled` enabled; only via env var, never via tool params) |
+
+## Security boundaries
+
+- Credentials only read from environment variables (`GITHUB_TOKEN` / `DEPENDFIX_AI_API_KEY`), tool params do not pass sensitive information
+- `cleanup_branches` is pure GitHub API ops (list/status/delete remote branch), no local repo needed; only deletes `dependfix/` prefixed merged/closed branches, never touches open PR branches
+- `fix_dependency` requires locally cloned repo dir (`workDir`, operates on package.json / pnpm-workspace.yaml / pnpm-lock.yaml)
+
+## Local development
+
+```bash
+pnpm --filter @dependfix/mcp build   # Build dist
+pnpm --filter @dependfix/mcp test    # Consistency test
+node packages/mcp/dist/bin.mjs       # stdio launch
+```
+
+## Design
+
+See [mcp-server.md](https://github.com/dependfix/dependfix/blob/master/docs/design/governance/mcp-server.md) (Tool schema, CLI consistency, error handling, capability gaps and evolution path).
+
+## Related packages
+
+- [dependfix main project](https://github.com/dependfix/dependfix) — this package's source and full docs
+- [@dependfix/core](https://github.com/dependfix/dependfix/blob/master/packages/core/README.md) — core domain model library (this package depends on)
+- [@dependfix/engine](https://github.com/dependfix/dependfix/blob/master/packages/engine/README.md) — execution engine (this package depends on)
+- [dependfix](https://github.com/dependfix/dependfix/blob/master/packages/cli/README.md) — CLI application entry (same source capabilities)
+- [@dependfix/skills](https://github.com/dependfix/dependfix/blob/master/packages/skills/README.md) — Agent Skill source of truth

package/README.md

@@ -1,5 +1,8 @@
 # @dependfix/mcp
 
+<!-- i18n: switch -->
+[简体中文](./README.md) | [English](./README.en-US.md)
+
 > dependfix 的 MCP Server 包。通过 [Model Context Protocol](https://modelcontextprotocol.io/) 将 dependfix 的扫描/修复能力暴露给 AI 编程助手（Claude、Copilot、Cursor 等）。
 
 ## 安装
@@ -64,4 +67,12 @@ node packages/mcp/dist/bin.mjs       # stdio 启动
 
 ## 设计
 
-详见 [mcp-server.md](../../docs/design/governance/mcp-server.md)（Tool schema、与 CLI 的一致性、错误处理、能力差距与演进路线）。
+详见 [mcp-server.md](https://github.com/dependfix/dependfix/blob/master/docs/design/governance/mcp-server.md)（Tool schema、与 CLI 的一致性、错误处理、能力差距与演进路线）。
+
+## 相关包
+
+- [dependfix 主项目](https://github.com/dependfix/dependfix) — 本包源码与完整文档
+- [@dependfix/core](https://github.com/dependfix/dependfix/blob/master/packages/core/README.md) — 核心领域模型库（本包依赖）
+- [@dependfix/engine](https://github.com/dependfix/dependfix/blob/master/packages/engine/README.md) — 执行引擎（本包依赖）
+- [dependfix](https://github.com/dependfix/dependfix/blob/master/packages/cli/README.md) — CLI 应用入口（同源能力）
+- [@dependfix/skills](https://github.com/dependfix/dependfix/blob/master/packages/skills/README.md) — 产品 Agent Skill 权威源

package/dist/index.d.mts

@@ -11,9 +11,8 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
  * - history（只读）：查询仓库历史运行摘要
  * 凭据从 GITHUB_TOKEN 环境变量读取（mcp-server.md §4.3）。
  */
-declare const createMcpServer: () => McpServer;
+export declare const createMcpServer: () => McpServer;
 /** 连接 stdio 传输（bin 入口调用） */
-declare const connectStdio: () => Promise<void>;
+export declare const connectStdio: () => Promise<void>;
 //#endregion
-export { connectStdio, createMcpServer };
 //# sourceMappingURL=index.d.mts.map

package/dist/src.mjs

@@ -1,7 +1,8 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
-import { DEFAULT_RUNTIME_CONFIG, DependfixApp, RUNTIME_MODES, SEVERITY_THRESHOLDS, createGitHubClient, deleteRemoteBranch, discoverRepositories, fetchCodeScanningAlerts, fetchDependabotAlerts, getBranchPrStatus, listDependfixBranches, overrideTransitiveDependency, queryRepoHistory, repairLockfile, upgradeDependency } from "@dependfix/engine";
+import { DEFAULT_RUNTIME_CONFIG, DependfixApp, RUNTIME_MODES, SEVERITY_THRESHOLDS, createGitHubClient, deleteRemoteBranch, discoverRepositories, fetchCodeScanningAlerts, fetchDependabotAlerts, fetchPnpmAuditAlerts, getBranchPrStatus, listDependfixBranches, overrideTransitiveDependency, queryRepoHistory, repairLockfile, upgradeDependency } from "@dependfix/engine";
+import { fromPat } from "@dependfix/engine/auth";
 import { filterAlerts, isValidRepoIdentifier } from "@dependfix/core";
 import { readFileSync, readdirSync } from "node:fs";
 import { join } from "node:path";
@@ -56,7 +57,8 @@ const discoverReposSchema = z.object({
 	topics: z.array(z.string()).optional().describe("topic 白名单（AND 语义：必须包含全部指定 topics）"),
 	include: z.array(z.string()).optional().describe("仓库白名单 glob（如 owner/*、owner/pkg-*）"),
 	exclude: z.array(z.string()).optional().describe("仓库黑名单 glob（与 include 冲突时胜出）"),
-	probe_dependabot: z.boolean().optional().describe("探测 .github/dependabot.yml 存在性（默认 true；会额外触达 contents API）")
+	probe_dependabot: z.boolean().optional().describe("探测 .github/dependabot.yml 存在性（默认 true；会额外触达 contents API）"),
+	max_repos: z.number().int().min(0).optional().describe("发现规模上限：最多保留的仓库数（默认 100；0 表示不限制）")
 });
 /** `cleanup_branches` 输入：清理已合并/已关闭的 dependfix 分支 */
 const cleanupBranchesSchema = z.object({
@@ -65,6 +67,13 @@ const cleanupBranchesSchema = z.object({
 });
 /** `history` 输入：查询仓库历史运行摘要 */
 const historySchema = z.object({ repo: z.string().describe("目标仓库，格式 owner/repo") });
+/** `pnpm_audit` 输入：本地 pnpm audit 回退数据源 */
+const pnpmAuditSchema = z.object({
+	/** 本地仓库工作目录（已 clone，包含 pnpm-lock.yaml） */
+	workDir: z.string().describe("本地仓库工作目录（已 clone，包含 pnpm-lock.yaml）"),
+	/** 仓库标识（owner/repo 或 local 兜底；与 CLI --repo 同源语义） */
+	repository: z.string().describe("仓库标识（owner/repo 或 local 兜底；用于归一化 NormalizedSecurityAlert.repository 字段）")
+});
 
 //#endregion
 //#region src/tools/errors.ts
@@ -96,7 +105,7 @@ const fetchAlerts = async (input) => {
 	};
 	const [owner, repo] = input.repo.split("/");
 	try {
-		const client = createGitHubClient({ token });
+		const client = createGitHubClient({ auth: fromPat(token) });
 		const params = {
 			owner,
 			repo,
@@ -219,7 +228,12 @@ const runScan = async (input) => {
 				stage: e.stage,
 				category: e.category,
 				message: e.message
-			}))
+			})),
+			startedAt: result.startedAt,
+			finishedAt: result.finishedAt,
+			config: result.config,
+			alerts: result.alerts,
+			actions: result.actions
 		};
 	} catch (error) {
 		return toToolError(error);
@@ -340,7 +354,7 @@ const discoverRepos = async (input) => {
 		error: "owner 必填（至少一个 owner/org）"
 	};
 	try {
-		const client = createGitHubClient({ token });
+		const client = createGitHubClient({ auth: fromPat(token) });
 		const policy = {
 			include: input.include && input.include.length > 0 ? input.include : void 0,
 			exclude: input.exclude && input.exclude.length > 0 ? input.exclude : void 0
@@ -350,7 +364,8 @@ const discoverRepos = async (input) => {
 			owners: input.owner,
 			topics: input.topics,
 			policy,
-			probeDependabot: input.probe_dependabot ?? true
+			probeDependabot: input.probe_dependabot ?? true,
+			maxRepos: input.max_repos
 		});
 		return {
 			ok: true,
@@ -391,7 +406,7 @@ const cleanupBranches = async (input) => {
 	const [owner, repo] = input.repo.split("/");
 	const dryRun = input.dry_run ?? false;
 	try {
-		const client = createGitHubClient({ token });
+		const client = createGitHubClient({ auth: fromPat(token) });
 		const branches = await listDependfixBranches(client, owner, repo);
 		const statuses = await Promise.all(branches.map((branch) => getBranchPrStatus(client, owner, repo, branch)));
 		const merged = statuses.filter((s) => s.merged);
@@ -459,6 +474,48 @@ const getHistory = async (input) => {
 	}
 };
 
+//#endregion
+//#region src/tools/pnpm-audit.tool.ts
+/**
+* `pnpm_audit`：本地 pnpm audit 回退数据源（无 GitHub token 或 403 场景）。
+*
+* 设计意图（详见 docs/design/pnpm-audit-fallback.md）：
+* - 显式 `--alerts-source pnpm-audit` 触发（CLI）或显式调用 `pnpm_audit` tool（MCP）触发
+* - 复用 `fetchPnpmAuditAlerts` 解析 + 归一化逻辑（与 CLI 同源）
+* - audit 自身失败（无 lockfile / pnpm 不可用 / JSON 解析失败）→ 硬失败，绝不静默空跑
+*
+* 凭据：pnpm-audit 不需要 GitHub token（本地命令）；但保留 `requireToken()`
+* 调用与其它 tool 一致（保持 pattern 统一，未来如需 pnpm registry token 可扩展）。
+*
+* @param input.workDir 本地仓库工作目录（包含 pnpm-lock.yaml）
+* @param input.repository 仓库标识（owner/repo 或 local 兜底；与 CLI --repo 同源语义）
+*/
+const pnpmAudit = async (input) => {
+	const token = requireToken();
+	if (typeof token !== "string") return token;
+	try {
+		const normalizedAlerts = await fetchPnpmAuditAlerts(input);
+		return {
+			ok: true,
+			count: normalizedAlerts.length,
+			workDir: input.workDir,
+			repository: input.repository,
+			alerts: normalizedAlerts.map((a) => ({
+				id: a.id,
+				severity: a.severity,
+				packageName: a.packageName,
+				manifestPath: a.manifestPath,
+				recommendedVersion: a.recommendedVersion,
+				fixable: a.fixable,
+				htmlUrl: a.htmlUrl,
+				summary: a.summary
+			}))
+		};
+	} catch (error) {
+		return toToolError(error);
+	}
+};
+
 //#endregion
 //#region src/index.ts
 /**
@@ -547,6 +604,16 @@ const createMcpServer = () => {
 			text: JSON.stringify(result, null, 2)
 		}] };
 	});
+	server.registerTool("pnpm_audit", {
+		description: "本地 pnpm audit 回退数据源（无需 GitHub token；audit 失败硬返回错误）",
+		inputSchema: pnpmAuditSchema
+	}, async (input) => {
+		const result = await pnpmAudit(input);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
 	return server;
 };
 /** 连接 stdio 传输（bin 入口调用） */

package/dist/src.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"src.mjs","names":[],"sources":["../src/tools/schemas.ts","../src/tools/errors.ts","../src/tools/fetch-alerts.ts","../src/tools/get-last-report.ts","../src/tools/run-scan.ts","../src/tools/fix-dependency.ts","../src/tools/discover-repos.ts","../src/tools/cleanup-branches.ts","../src/tools/history.ts","../src/index.ts"],"sourcesContent":["import { z } from 'zod'\nimport { RUNTIME_MODES, SEVERITY_THRESHOLDS } from '@dependfix/engine'\n\n// run_scan 的 mode 子集：排除 cleanup-branches（由独立 cleanup_branches tool 承担；\n// DependfixApp 的该 mode 走交互确认，MCP stdio 不可用——见 mcp-server.md §8.3）。\n// 从 cli RUNTIME_MODES 派生（filter 跟随 cli 演进），非独立硬编码。\n// as unknown 桥接：filter 返回数组类型，z.enum 需要 readonly 元组。\nconst RUN_SCAN_MODES = RUNTIME_MODES.filter((m) => m !== 'cleanup-branches') as unknown as readonly ['report-only', 'fix', 'fix-and-pr']\n\n/** `fetch_alerts` 输入：拉取指定仓库的安全告警（Dependabot + 可选 Code Scanning） */\nexport const fetchAlertsSchema = z.object({\n    repo: z.string().describe('目标仓库，格式 owner/repo'),\n    severity: z.enum(SEVERITY_THRESHOLDS).default('high').describe('严重级别阈值（high 保留 critical + high，与 CLI 一致）'),\n    code_scanning: z.boolean().optional().describe('同时拉取 Code Scanning 告警（与 Dependabot 并行；需要 token 具备 security-events: read）'),\n})\n\n/** `get_last_report` 输入：读取最近一次 JSON 报告 */\nexport const getLastReportSchema = z.object({})\n\n/** `run_scan` 输入：对目标仓库执行 dependfix 扫描并修复 */\nexport const runScanSchema = z.object({\n    repo: z.string().describe('目标仓库，格式 owner/repo'),\n    mode: z.enum(RUN_SCAN_MODES).default('report-only').describe('执行模式（默认仅报告）'),\n    severity: z.enum(SEVERITY_THRESHOLDS).default('high').describe('严重级别阈值'),\n    code_scanning: z.boolean().optional().describe('同时拉取 Code Scanning 告警（默认 false）'),\n    max_alerts: z.number().int().min(1).max(1000).optional().describe('每仓库最多处理的告警数（默认 20）'),\n    max_concurrency: z.number().int().min(1).max(16).optional().describe('多仓库并发窗口（默认 1 保守串行）'),\n    dry_run: z.boolean().optional().describe('试运行不实际写入；缺省按 mode 推断（report-only 为 true）。与 mode=fix/fix-and-pr 互斥（会返回配置校验错误）'),\n    allow_major_upgrade: z.boolean().optional().describe('跨线 major 升级显式授权（默认 false；仅根直接依赖 + lockfile 单版本，强制完整验证）'),\n    ai_enabled: z.boolean().optional().describe('开启 AI breaking change 研判（默认 false；apiKey 从 DEPENDFIX_AI_API_KEY env 读取，禁止经 tool 参数传入）'),\n    ai_provider: z.enum(['openai-compatible', 'anthropic']).optional().describe('AI 提供商（默认 openai-compatible）'),\n    ai_model: z.string().optional().describe('AI 模型名（默认 deepseek-v4-flash）'),\n    ai_trigger: z.enum(['failure', 'major', 'both']).optional().describe('AI 触发范围（默认 both）'),\n})\n\n/** `fix_dependency` 输入：修复单个依赖（多修复类型） */\nexport const fixDependencySchema = z.object({\n    /** 本地仓库路径（已 clone 的目录，含 package.json/pnpm-lock.yaml） */\n    workDir: z.string().describe('本地仓库工作目录（已 clone，包含 package.json 与 pnpm-lock.yaml）'),\n    /** 修复类型：override（间接依赖 overrides）/ direct（直接依赖升级）/ lockfile（frozen-lockfile 漂移修复） */\n    fix_type: z.enum(['override', 'direct', 'lockfile']).default('override').describe('修复类型（默认 override）'),\n    /** override / direct 必填 */\n    packageName: z.string().optional().describe('依赖包名（fix_type=override/direct 必填）'),\n    /** override / direct 必填 */\n    targetVersion: z.string().optional().describe('目标精确版本，如 4.17.21（fix_type=override/direct 必填）'),\n})\n\n/** `discover_repos` 输入：按 owner / org 自动发现仓库 */\nexport const discoverReposSchema = z.object({\n    owner: z.array(z.string()).min(1).describe('owner / org 列表（分别发现后合并）'),\n    topics: z.array(z.string()).optional().describe('topic 白名单（AND 语义：必须包含全部指定 topics）'),\n    include: z.array(z.string()).optional().describe('仓库白名单 glob（如 owner/*、owner/pkg-*）'),\n    exclude: z.array(z.string()).optional().describe('仓库黑名单 glob（与 include 冲突时胜出）'),\n    probe_dependabot: z.boolean().optional().describe('探测 .github/dependabot.yml 存在性（默认 true；会额外触达 contents API）'),\n})\n\n/** `cleanup_branches` 输入：清理已合并/已关闭的 dependfix 分支 */\nexport const cleanupBranchesSchema = z.object({\n    repo: z.string().describe('目标仓库，格式 owner/repo'),\n    dry_run: z.boolean().optional().describe('仅列出待清理分支，不执行删除（默认 false）'),\n})\n\n/** `history` 输入：查询仓库历史运行摘要 */\nexport const historySchema = z.object({\n    repo: z.string().describe('目标仓库，格式 owner/repo'),\n})\n","// 统一 tool 错误模板（复用收口）：\n// - requireToken：GITHUB_TOKEN 检查。返回 token 字符串或错误对象；\n//   调用方用 `typeof token !== 'string'` 守卫收窄（项目未开 strictNullChecks，\n//   truthiness 判别收窄不生效，typeof 守卫是兼容形式）。\n// - toToolError：任意错误 → ok:false（统一 Error.message / String 转换）\n// 各 tool 的返回联合类型均含 `{ ok: false, error: string }` 分支，可安全返回。\n\nexport type ToolError = { ok: false, error: string }\n\nexport const requireToken = (): string | ToolError => {\n    const token = process.env.GITHUB_TOKEN\n    if (!token) {\n        return { ok: false, error: 'GITHUB_TOKEN not set（请配置环境变量）' }\n    }\n    return token\n}\n\nexport const toToolError = (error: unknown): ToolError => ({\n    ok: false,\n    error: error instanceof Error ? error.message : String(error),\n})\n","import { createGitHubClient, fetchCodeScanningAlerts, fetchDependabotAlerts, type FetchDependabotAlertsParams } from '@dependfix/engine'\nimport { filterAlerts, isValidRepoIdentifier, type SeverityThreshold } from '@dependfix/core'\nimport { requireToken, toToolError } from './errors'\n\n/** `fetch_alerts` 返回结构 */\nexport type FetchAlertsResult =\n    | {\n        ok: true\n        count: number\n        alerts: Array<{\n            id: number\n            severity: string\n            packageName: string\n            manifestPath: string\n            recommendedVersion: string\n            fixable: boolean\n            htmlUrl: string\n            summary: string\n        }>\n    }\n    | { ok: false, error: string }\n\n/**\n * `fetch_alerts`：拉取指定仓库的 Dependabot 安全告警（只读）。\n * 凭据从 GITHUB_TOKEN 环境变量读取（mcp-server.md §4.3）。\n */\nexport const fetchAlerts = async (input: { repo: string, severity: SeverityThreshold, code_scanning?: boolean }): Promise<FetchAlertsResult> => {\n    const token = requireToken()\n    if (typeof token !== 'string') {\n        return token\n    }\n\n    // repo 格式校验复用 core（与 CLI 同源，避免自研校验漂移）\n    if (!isValidRepoIdentifier(input.repo)) {\n        return { ok: false, error: `repo 格式非法（预期 owner/repo，收到 ${input.repo}）` }\n    }\n    const [owner, repo] = input.repo.split('/')\n\n    try {\n        const client = createGitHubClient({ token })\n        const params: FetchDependabotAlertsParams = {\n            owner,\n            repo,\n            state: 'open',\n        }\n\n        // Dependabot + 可选 Code Scanning 并行（复用 cli fetcher；与 CLI --code-scanning 同源）。\n        // 注意：CS 拉取失败（权限/网络）会使整个 tool 失败——与 CLI 现状一致\n        // （per-source 错误隔离为 backlog 登记项，暂缓），结果不静默丢弃。\n        const codeScanningEnabled = input.code_scanning ?? false\n        const [dependabotAlerts, codeScanningAlerts] = await Promise.all([\n            fetchDependabotAlerts(client, params),\n            codeScanningEnabled\n                ? fetchCodeScanningAlerts(client, { owner, repo })\n                : Promise.resolve([] as Awaited<ReturnType<typeof fetchDependabotAlerts>>),\n        ])\n        const alerts = [...dependabotAlerts, ...codeScanningAlerts]\n\n        // 严重级别过滤复用 core 阈值语义（与 CLI 一致：high 保留 critical + high；\n        // all 不过滤；Code Scanning 源 unknown 恒透传）。不使用相等匹配，避免 high 漏掉 critical。\n        const { filtered } = filterAlerts(alerts, { severityThreshold: input.severity })\n\n        return {\n            ok: true,\n            count: filtered.length,\n            alerts: filtered.map((a) => ({\n                id: a.id,\n                severity: a.severity,\n                packageName: a.packageName,\n                manifestPath: a.manifestPath,\n                recommendedVersion: a.recommendedVersion,\n                fixable: a.fixable,\n                htmlUrl: a.htmlUrl,\n                summary: a.summary,\n            })),\n        }\n    } catch (error) {\n        return toToolError(error)\n    }\n}\n","import { readFileSync, readdirSync } from 'node:fs'\nimport { join } from 'node:path'\nimport { toToolError } from './errors'\n\n/** `get_last_report` 返回结构 */\nexport type GetLastReportResult =\n    | { ok: true, file: string, report: unknown }\n    | { ok: false, error: string }\n\n/**\n * `get_last_report`：读取最近一次 JSON 报告（只读）。\n * 报告目录默认为 `./dependfix-reports`（可用 `DEPENDFIX_MCP_REPORT_DIR` 覆盖）。\n */\nexport const getLastReport = async (): Promise<GetLastReportResult> => {\n    const reportDir = process.env.DEPENDFIX_MCP_REPORT_DIR ?? './dependfix-reports'\n    try {\n        const files = readdirSync(reportDir)\n            .filter((f) => f.endsWith('.json'))\n            .sort()\n        if (files.length === 0) {\n            return { ok: false, error: `未找到报告（目录 ${reportDir} 为空）` }\n        }\n        const latest = files[files.length - 1]\n        const content = readFileSync(join(reportDir, latest), 'utf-8')\n        return {\n            ok: true,\n            file: latest,\n            report: JSON.parse(content),\n        }\n    } catch (error) {\n        return toToolError(error)\n    }\n}\n","import { DependfixApp, DEFAULT_RUNTIME_CONFIG, type RuntimeConfig } from '@dependfix/engine'\nimport { isValidRepoIdentifier } from '@dependfix/core'\nimport { requireToken, toToolError } from './errors'\n\n/** `run_scan` 返回结构 */\nexport type RunScanResult =\n    | {\n        ok: true\n        exitCode: number\n        runId: string\n        summary: import('@dependfix/core').RunSummary\n        repositories: Array<Record<string, unknown>>\n        errors: Array<Record<string, unknown>>\n    }\n    | { ok: false, error: string }\n\n/**\n * `run_scan`：对目标仓库执行 dependfix 扫描并修复。\n * 凭据从 GITHUB_TOKEN 环境变量读取；repo 为 GitHub 远程仓库（report-only 无需 clone）。\n */\nexport const runScan = async (input: {\n    repo: string\n    mode: 'report-only' | 'fix' | 'fix-and-pr'\n    severity: string\n    code_scanning?: boolean\n    max_alerts?: number\n    max_concurrency?: number\n    dry_run?: boolean\n    allow_major_upgrade?: boolean\n    ai_enabled?: boolean\n    ai_provider?: 'openai-compatible' | 'anthropic'\n    ai_model?: string\n    ai_trigger?: 'failure' | 'major' | 'both'\n}): Promise<RunScanResult> => {\n    const token = requireToken()\n    if (typeof token !== 'string') {\n        return token\n    }\n\n    // repo 格式校验复用 core（与 CLI 同源）\n    if (!isValidRepoIdentifier(input.repo)) {\n        return { ok: false, error: `repo 格式非法（预期 owner/repo，收到 ${input.repo}）` }\n    }\n    const [owner, repo] = input.repo.split('/')\n\n    // 展开 cli 默认配置（maxAlerts/maxConcurrency/maxRetries/maxBackoff/alertSource/ai 默认等\n    // 与 CLI 单一事实源对齐，避免手写默认值漂移），仅覆盖 tool 参数可控制字段。\n    const defaultAi = DEFAULT_RUNTIME_CONFIG.ai\n    const config: RuntimeConfig = {\n        ...DEFAULT_RUNTIME_CONFIG,\n        mode: input.mode,\n        severityThreshold: input.severity as 'critical' | 'high' | 'medium' | 'all',\n        repositories: [`${owner}/${repo}`],\n        // dry-run 显式参数优先，缺省按 mode 推断（report-only 即只读）\n        dryRun: input.dry_run ?? (input.mode === 'report-only'),\n        createPullRequest: input.mode === 'fix-and-pr',\n        commit: input.mode === 'fix',\n        cleanupBranches: false,\n        cleanupBranchesAuto: false,\n        githubToken: token,\n        codeScanningEnabled: input.code_scanning ?? DEFAULT_RUNTIME_CONFIG.codeScanningEnabled,\n        allowMajorUpgrade: input.allow_major_upgrade ?? DEFAULT_RUNTIME_CONFIG.allowMajorUpgrade,\n        maxAlertsPerRepository: input.max_alerts ?? DEFAULT_RUNTIME_CONFIG.maxAlertsPerRepository,\n        maxConcurrency: input.max_concurrency ?? DEFAULT_RUNTIME_CONFIG.maxConcurrency,\n        // AI 研判：展开 cli 默认（provider/model/baseUrl/trigger 与 CLI 对齐），\n        // 仅覆盖开关与显式参数；apiKey 只从 env 读取（DEPENDFIX_AI_API_KEY），\n        // 禁止经 tool 参数传入（防客户端日志泄露）。\n        // defaultAi 收窄：默认配置缺失时视为未开启（与类型声明一致，运行时恒有值）\n        ai: input.ai_enabled && defaultAi\n            ? {\n                ...defaultAi,\n                enabled: true,\n                provider: input.ai_provider ?? defaultAi.provider,\n                model: input.ai_model ?? defaultAi.model,\n                trigger: input.ai_trigger ?? defaultAi.trigger,\n                apiKey: process.env.DEPENDFIX_AI_API_KEY,\n            }\n            : undefined,\n    }\n\n    try {\n        const app = new DependfixApp({\n            config,\n            workDir: process.cwd(),\n            reportOutputDir: process.env.DEPENDFIX_MCP_REPORT_DIR ?? './dependfix-reports',\n        })\n        const { result, exitCode } = await app.run()\n\n        return {\n            ok: true,\n            exitCode,\n            runId: result.runId,\n            summary: result.summary,\n            repositories: result.repositories.map((r) => ({\n                repository: r.repository,\n                alertsCount: r.alertsCount,\n                fixable: r.fixable,\n                fixed: r.fixed,\n                failed: r.failed,\n                lockfileRepaired: r.lockfileRepaired,\n                verificationPassed: r.verificationPassed ?? undefined,\n                durationMs: r.durationMs,\n            })),\n            errors: result.errors.map((e) => ({\n                repository: e.repository,\n                stage: e.stage,\n                category: e.category,\n                message: e.message,\n            })),\n        }\n    } catch (error) {\n        return toToolError(error)\n    }\n}\n","import { overrideTransitiveDependency, repairLockfile, upgradeDependency, type LockfileDiff } from '@dependfix/engine'\nimport { toToolError } from './errors'\n\n/** `fix_dependency` 返回结构（按 fixType 判别） */\nexport type FixDependencyResult =\n    | {\n        ok: true\n        fixType: 'override' | 'direct'\n        packageName: string\n        fromVersion: string\n        toVersion: string\n        isMajor: boolean\n        warning?: string\n    }\n    | {\n        ok: true\n        fixType: 'lockfile'\n        strategy?: string\n        diff?: LockfileDiff | null\n        lockfileVersion?: string\n        lockfileVersionChanged?: boolean\n    }\n    | {\n        ok: false\n        fixType: 'override' | 'direct' | 'lockfile'\n        packageName?: string\n        fromVersion?: string\n        toVersion?: string\n        isMajor?: boolean\n        error: string\n    }\n\n/**\n * `fix_dependency`：修复单个依赖或 lockfile（按 `fix_type` 分发，复用 cli fixers）：\n * - `override`（默认）：间接依赖 → `overrideTransitiveDependency`（写入 pnpm overrides）\n * - `direct`：直接依赖 → `upgradeDependency`（改写 manifest + `pnpm install`，失败回滚）\n * - `lockfile`：frozen-lockfile 漂移 → `repairLockfile`（策略链修复，全部失败回滚）\n * 均需本地已 clone 的仓库目录（workDir）。\n */\nexport const fixDependency = async (input: {\n    workDir: string\n    fix_type?: 'override' | 'direct' | 'lockfile'\n    packageName?: string\n    targetVersion?: string\n}): Promise<FixDependencyResult> => {\n    const fixType = input.fix_type ?? 'override'\n    try {\n        switch (fixType) {\n            case 'lockfile': {\n                const result = repairLockfile({ workDir: input.workDir })\n                if (result.success) {\n                    return {\n                        ok: true,\n                        fixType: 'lockfile',\n                        strategy: result.strategy,\n                        diff: result.diff ?? null,\n                        lockfileVersion: result.lockfileVersion,\n                        lockfileVersionChanged: result.lockfileVersionChanged,\n                    }\n                }\n                return {\n                    ok: false,\n                    fixType: 'lockfile',\n                    error: result.failureDetail ?? 'lockfile repair failed',\n                }\n            }\n            case 'direct': {\n                if (!input.packageName || !input.targetVersion) {\n                    return { ok: false, fixType: 'direct', error: 'packageName 与 targetVersion 必填（fix_type=direct）' }\n                }\n                const result = await upgradeDependency({\n                    packageName: input.packageName,\n                    targetVersion: input.targetVersion,\n                    workDir: input.workDir,\n                })\n                if (result.success) {\n                    return {\n                        ok: true,\n                        fixType: 'direct',\n                        packageName: result.packageName,\n                        fromVersion: result.fromVersion,\n                        toVersion: result.toVersion,\n                        isMajor: result.isMajor,\n                        warning: result.warning,\n                    }\n                }\n                return {\n                    ok: false,\n                    fixType: 'direct',\n                    packageName: result.packageName,\n                    fromVersion: result.fromVersion,\n                    toVersion: result.toVersion,\n                    isMajor: result.isMajor,\n                    error: result.error ?? 'upgrade failed',\n                }\n            }\n            case 'override': {\n                if (!input.packageName || !input.targetVersion) {\n                    return { ok: false, fixType: 'override', error: 'packageName 与 targetVersion 必填（fix_type=override）' }\n                }\n                const result = await overrideTransitiveDependency({\n                    packageName: input.packageName,\n                    targetVersion: input.targetVersion,\n                    workDir: input.workDir,\n                })\n                if (result.success) {\n                    return {\n                        ok: true,\n                        fixType: 'override',\n                        packageName: result.packageName,\n                        fromVersion: result.fromVersion,\n                        toVersion: result.toVersion,\n                        isMajor: result.isMajor,\n                        warning: result.warning,\n                    }\n                }\n                return {\n                    ok: false,\n                    fixType: 'override',\n                    packageName: result.packageName,\n                    fromVersion: result.fromVersion,\n                    toVersion: result.toVersion,\n                    isMajor: result.isMajor,\n                    error: result.error ?? 'override failed',\n                }\n            }\n        }\n    } catch (error) {\n        return {\n            ok: false,\n            fixType,\n            error: toToolError(error).error,\n        }\n    }\n}\n","import { createGitHubClient, discoverRepositories, type RepoPolicy } from '@dependfix/engine'\nimport { requireToken, toToolError } from './errors'\n\n/** `discover_repos` 返回结构 */\nexport type DiscoverReposResult =\n    | {\n        ok: true\n        count: number\n        repositories: Array<{\n            fullName: string\n            defaultBranch: string\n            topics: string[]\n            hasDependabotConfig: boolean\n        }>\n    }\n    | { ok: false, error: string }\n\n/**\n * `discover_repos`：按 owner / org 自动发现仓库（复用 cli discoverRepositories，\n * 与 CLI `--owner` / `--repo-topics` / `--repo-include` / `--repo-exclude` 同源过滤链）。\n * 凭据从 GITHUB_TOKEN 环境变量读取。\n */\nexport const discoverRepos = async (input: {\n    owner: string[]\n    topics?: string[]\n    include?: string[]\n    exclude?: string[]\n    probe_dependabot?: boolean\n}): Promise<DiscoverReposResult> => {\n    const token = requireToken()\n    if (typeof token !== 'string') {\n        return token\n    }\n    if (input.owner.length === 0) {\n        return { ok: false, error: 'owner 必填（至少一个 owner/org）' }\n    }\n\n    try {\n        const client = createGitHubClient({ token })\n        const policy: RepoPolicy = {\n            include: input.include && input.include.length > 0 ? input.include : undefined,\n            exclude: input.exclude && input.exclude.length > 0 ? input.exclude : undefined,\n        }\n        const repos = await discoverRepositories({\n            client,\n            owners: input.owner,\n            topics: input.topics,\n            policy,\n            probeDependabot: input.probe_dependabot ?? true,\n        })\n        return {\n            ok: true,\n            count: repos.length,\n            repositories: repos.map((r) => ({\n                fullName: r.fullName,\n                defaultBranch: r.defaultBranch,\n                topics: r.topics,\n                hasDependabotConfig: r.hasDependabotConfig,\n            })),\n        }\n    } catch (error) {\n        return toToolError(error)\n    }\n}\n","import { createGitHubClient, deleteRemoteBranch, getBranchPrStatus, listDependfixBranches } from '@dependfix/engine'\nimport { isValidRepoIdentifier } from '@dependfix/core'\nimport { requireToken, toToolError } from './errors'\n\n/** `cleanup_branches` 返回结构 */\nexport type CleanupBranchesResult =\n    | {\n        ok: true\n        dryRun: boolean\n        scanned: string[]\n        /** 已删除分支（dry_run 时为空） */\n        deleted: string[]\n        /** 保留分支（open PR / 无 PR 未关闭） */\n        kept: string[]\n        /** 删除失败分支（best-effort，不中断） */\n        failed: string[]\n    }\n    | { ok: false, error: string }\n\n/**\n * `cleanup_branches`：清理已合并/已关闭的 dependfix 分支（非交互）。\n *\n * 复用 cli pr-creator 底层函数自编排，语义对齐 `autoCleanupMergedBranches`：\n * - 只处理 `dependfix/` 前缀分支（listDependfixBranches 已过滤）\n * - 删除候选 = 已合并（merged）+ 已关闭未合并（orphaned）；绝不触碰 open PR 分支\n * - 单分支删除失败记录到 `failed`，不中断其余删除（best-effort）\n * - dry_run 仅列清单（deleted/failed 为空）\n *\n * 刻意不走 DependfixApp 的 cleanup-branches mode：`runBranchCleanupForRepo`\n * 含交互式确认（非 TTY 默认拒绝），MCP stdio 下不可用。\n */\nexport const cleanupBranches = async (input: { repo: string, dry_run?: boolean }): Promise<CleanupBranchesResult> => {\n    const token = requireToken()\n    if (typeof token !== 'string') {\n        return token\n    }\n    if (!isValidRepoIdentifier(input.repo)) {\n        return { ok: false, error: `repo 格式非法（预期 owner/repo，收到 ${input.repo}）` }\n    }\n    const [owner, repo] = input.repo.split('/')\n    const dryRun = input.dry_run ?? false\n\n    try {\n        const client = createGitHubClient({ token })\n        const branches = await listDependfixBranches(client, owner, repo)\n        const statuses = await Promise.all(\n            branches.map((branch) => getBranchPrStatus(client, owner, repo, branch)),\n        )\n\n        const merged = statuses.filter((s) => s.merged)\n        const orphaned = statuses.filter((s) => s.closed && !s.merged)\n        const kept = statuses.filter((s) => !s.closed)\n        const candidates = [...merged, ...orphaned]\n\n        if (dryRun) {\n            return {\n                ok: true,\n                dryRun: true,\n                scanned: branches,\n                deleted: [],\n                kept: kept.map((s) => s.branch),\n                failed: [],\n            }\n        }\n\n        const deleted: string[] = []\n        const failed: string[] = []\n        for (const s of candidates) {\n            try {\n                await deleteRemoteBranch(client, owner, repo, s.branch)\n                deleted.push(s.branch)\n            } catch {\n                // 单分支删除失败（分支保护/不存在）不中断其余删除，best-effort\n                failed.push(s.branch)\n            }\n        }\n\n        return {\n            ok: true,\n            dryRun: false,\n            scanned: branches,\n            deleted,\n            kept: kept.map((s) => s.branch),\n            failed,\n        }\n    } catch (error) {\n        return toToolError(error)\n    }\n}\n","import { queryRepoHistory } from '@dependfix/engine'\nimport { isValidRepoIdentifier } from '@dependfix/core'\nimport { toToolError } from './errors'\n\n/** `history` 返回结构 */\nexport type HistoryResult =\n    | {\n        ok: true\n        repo: string\n        runs: Array<{\n            runId: string\n            startedAt: string\n            durationMs: number\n            repositories: string[]\n            summary: Record<string, unknown>\n            repoStats: Array<Record<string, unknown>>\n        }>\n    }\n    | { ok: false, error: string }\n\n/**\n * `history`：查询某仓库的历史运行摘要（倒序时间：最新在前）。\n * 复用 cli `queryRepoHistory`（读 dependfix-reports/index.json 聚合索引，\n * 与 `get_last_report` 的单文件语义不同）；报告目录可用 `DEPENDFIX_MCP_REPORT_DIR` 覆盖。\n */\nexport const getHistory = async (input: { repo: string }): Promise<HistoryResult> => {\n    if (!isValidRepoIdentifier(input.repo)) {\n        return { ok: false, error: `repo 格式非法（预期 owner/repo，收到 ${input.repo}）` }\n    }\n    try {\n        const reportDir = process.env.DEPENDFIX_MCP_REPORT_DIR ?? './dependfix-reports'\n        const entries = queryRepoHistory(input.repo, reportDir)\n        return {\n            ok: true,\n            repo: input.repo,\n            runs: entries.map((e) => ({\n                runId: e.runId,\n                startedAt: e.startedAt,\n                durationMs: e.durationMs,\n                repositories: e.repositories,\n                // 桥接：RunSummary/ArchiveRepoStats 无索引签名，显式转 unknown 再收窄\n                summary: e.summary as unknown as Record<string, unknown>,\n                repoStats: e.repoStats as unknown as Array<Record<string, unknown>>,\n            })),\n        }\n    } catch (error) {\n        return toToolError(error)\n    }\n}\n","import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'\nimport { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'\nimport { fetchAlertsSchema, getLastReportSchema, runScanSchema, fixDependencySchema, discoverReposSchema, cleanupBranchesSchema, historySchema } from './tools/schemas'\nimport { fetchAlerts } from './tools/fetch-alerts'\nimport { getLastReport } from './tools/get-last-report'\nimport { runScan } from './tools/run-scan'\nimport { fixDependency } from './tools/fix-dependency'\nimport { discoverRepos } from './tools/discover-repos'\nimport { cleanupBranches } from './tools/cleanup-branches'\nimport { getHistory } from './tools/history'\n\n/**\n * dependfix MCP Server：向 AI 助手暴露 7 个 tool。\n * - fetch_alerts（只读）：拉取 Dependabot / Code Scanning 告警\n * - get_last_report（只读）：读取最近 JSON 报告\n * - run_scan（写入）：执行扫描/修复（默认 report-only；支持 AI 研判透传）\n * - fix_dependency（写入）：修复单个依赖（override / direct / lockfile）\n * - discover_repos（只读）：按 owner / org 自动发现仓库\n * - cleanup_branches（写入）：清理已合并/已关闭的 dependfix 分支（非交互）\n * - history（只读）：查询仓库历史运行摘要\n * 凭据从 GITHUB_TOKEN 环境变量读取（mcp-server.md §4.3）。\n */\nexport const createMcpServer = (): McpServer => {\n    const server = new McpServer({\n        name: 'dependfix',\n        version: '0.1.0',\n    })\n\n    server.registerTool(\n        'fetch_alerts',\n        {\n            description: '拉取指定仓库的 Dependabot 安全告警（可选并行 Code Scanning，只读）',\n            inputSchema: fetchAlertsSchema,\n        },\n        async (input) => {\n            const result = await fetchAlerts(input)\n            return {\n                content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],\n            }\n        },\n    )\n\n    server.registerTool(\n        'get_last_report',\n        {\n            description: '读取最近一次 dependfix JSON 报告（只读）',\n            inputSchema: getLastReportSchema,\n        },\n        async () => {\n            const result = await getLastReport()\n            return {\n                content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],\n            }\n        },\n    )\n\n    server.registerTool(\n        'run_scan',\n        {\n            description: '对目标仓库执行 dependfix 扫描并修复（默认 report-only；支持 code-scanning / AI 研判等参数）',\n            inputSchema: runScanSchema,\n        },\n        async (input) => {\n            const result = await runScan(input)\n            return {\n                content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],\n            }\n        },\n    )\n\n    server.registerTool(\n        'fix_dependency',\n        {\n            description: '修复单个依赖或 lockfile（override / direct / lockfile；需要本地已 clone 仓库目录）',\n            inputSchema: fixDependencySchema,\n        },\n        async (input) => {\n            const result = await fixDependency(input)\n            return {\n                content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],\n            }\n        },\n    )\n\n    server.registerTool(\n        'discover_repos',\n        {\n            description: '按 owner / org 自动发现仓库（支持 topics / include / exclude 名单策略，只读）',\n            inputSchema: discoverReposSchema,\n        },\n        async (input) => {\n            const result = await discoverRepos(input)\n            return {\n                content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],\n            }\n        },\n    )\n\n    server.registerTool(\n        'cleanup_branches',\n        {\n            description: '清理已合并/已关闭的 dependfix 分支（非交互；只删 dependfix/ 前缀且 merged/closed，绝不触碰 open PR 分支）',\n            inputSchema: cleanupBranchesSchema,\n        },\n        async (input) => {\n            const result = await cleanupBranches(input)\n            return {\n                content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],\n            }\n        },\n    )\n\n    server.registerTool(\n        'history',\n        {\n            description: '查询指定仓库的历史运行摘要（倒序时间，只读）',\n            inputSchema: historySchema,\n        },\n        async (input) => {\n            const result = await getHistory(input)\n            return {\n                content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],\n            }\n        },\n    )\n\n    return server\n}\n\n/** 连接 stdio 传输（bin 入口调用） */\nexport const connectStdio = async (): Promise<void> => {\n    const server = createMcpServer()\n    const transport = new StdioServerTransport()\n    await server.connect(transport)\n}\n"],"mappings":";;;;;;;;;AAOA,MAAM,iBAAiB,cAAc,QAAQ,MAAM,MAAM,kBAAkB;;AAG3E,MAAa,oBAAoB,EAAE,OAAO;CACtC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,oBAAoB;CAC9C,UAAU,EAAE,KAAK,mBAAmB,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,SAAS,0CAA0C;CACzG,eAAe,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,0EAA0E;AAC7H,CAAC;;AAGD,MAAa,sBAAsB,EAAE,OAAO,CAAC,CAAC;;AAG9C,MAAa,gBAAgB,EAAE,OAAO;CAClC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,oBAAoB;CAC9C,MAAM,EAAE,KAAK,cAAc,CAAC,CAAC,QAAQ,aAAa,CAAC,CAAC,SAAS,aAAa;CAC1E,UAAU,EAAE,KAAK,mBAAmB,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,SAAS,QAAQ;CACvE,eAAe,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,iCAAiC;CAChF,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,oBAAoB;CACtF,iBAAiB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,oBAAoB;CACzF,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,8EAA8E;CACvH,qBAAqB,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,wDAAwD;CAC7G,YAAY,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,uFAAuF;CACnI,aAAa,EAAE,KAAK,CAAC,qBAAqB,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,8BAA8B;CAC1G,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,8BAA8B;CACvE,YAAY,EAAE,KAAK;EAAC;EAAW;EAAS;CAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,kBAAkB;AAC3F,CAAC;;AAGD,MAAa,sBAAsB,EAAE,OAAO;;CAExC,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS,oDAAoD;;CAEjF,UAAU,EAAE,KAAK;EAAC;EAAY;EAAU;CAAU,CAAC,CAAC,CAAC,QAAQ,UAAU,CAAC,CAAC,SAAS,mBAAmB;;CAErG,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,mCAAmC;;CAE/E,eAAe,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,+CAA+C;AACjG,CAAC;;AAGD,MAAa,sBAAsB,EAAE,OAAO;CACxC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,yBAAyB;CACpE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,mCAAmC;CACnF,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,mCAAmC;CACpF,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,6BAA6B;CAC9E,kBAAkB,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,2DAA2D;AACjH,CAAC;;AAGD,MAAa,wBAAwB,EAAE,OAAO;CAC1C,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,oBAAoB;CAC9C,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,0BAA0B;AACvE,CAAC;;AAGD,MAAa,gBAAgB,EAAE,OAAO,EAClC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,oBAAoB,EAClD,CAAC;;;;ACxDD,MAAa,qBAAyC;CAClD,MAAM,QAAQ,QAAQ,IAAI;CAC1B,IAAI,CAAC,OACD,OAAO;EAAE,IAAI;EAAO,OAAO;CAAgC;CAE/D,OAAO;AACX;AAEA,MAAa,eAAe,WAA+B;CACvD,IAAI;CACJ,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAChE;;;;;;;;ACMA,MAAa,cAAc,OAAO,UAA8G;CAC5I,MAAM,QAAQ,aAAa;CAC3B,IAAI,OAAO,UAAU,UACjB,OAAO;CAIX,IAAI,CAAC,sBAAsB,MAAM,IAAI,GACjC,OAAO;EAAE,IAAI;EAAO,OAAO,8BAA8B,MAAM,KAAK;CAAG;CAE3E,MAAM,CAAC,OAAO,QAAQ,MAAM,KAAK,MAAM,GAAG;CAE1C,IAAI;EACA,MAAM,SAAS,mBAAmB,EAAE,MAAM,CAAC;EAC3C,MAAM,SAAsC;GACxC;GACA;GACA,OAAO;EACX;EAKA,MAAM,sBAAsB,MAAM,iBAAiB;EACnD,MAAM,CAAC,kBAAkB,sBAAsB,MAAM,QAAQ,IAAI,CAC7D,sBAAsB,QAAQ,MAAM,GACpC,sBACM,wBAAwB,QAAQ;GAAE;GAAO;EAAK,CAAC,IAC/C,QAAQ,QAAQ,CAAC,CAAsD,CACjF,CAAC;EACD,MAAM,SAAS,CAAC,GAAG,kBAAkB,GAAG,kBAAkB;EAI1D,MAAM,EAAE,aAAa,aAAa,QAAQ,EAAE,mBAAmB,MAAM,SAAS,CAAC;EAE/E,OAAO;GACH,IAAI;GACJ,OAAO,SAAS;GAChB,QAAQ,SAAS,KAAK,OAAO;IACzB,IAAI,EAAE;IACN,UAAU,EAAE;IACZ,aAAa,EAAE;IACf,cAAc,EAAE;IAChB,oBAAoB,EAAE;IACtB,SAAS,EAAE;IACX,SAAS,EAAE;IACX,SAAS,EAAE;GACf,EAAE;EACN;CACJ,SAAS,OAAO;EACZ,OAAO,YAAY,KAAK;CAC5B;AACJ;;;;;;;;AClEA,MAAa,gBAAgB,YAA0C;CACnE,MAAM,YAAY,QAAQ,IAAI,4BAA4B;CAC1D,IAAI;EACA,MAAM,QAAQ,YAAY,SAAS,CAAC,CAC/B,QAAQ,MAAM,EAAE,SAAS,OAAO,CAAC,CAAC,CAClC,KAAK;EACV,IAAI,MAAM,WAAW,GACjB,OAAO;GAAE,IAAI;GAAO,OAAO,YAAY,UAAU;EAAM;EAE3D,MAAM,SAAS,MAAM,MAAM,SAAS;EACpC,MAAM,UAAU,aAAa,KAAK,WAAW,MAAM,GAAG,OAAO;EAC7D,OAAO;GACH,IAAI;GACJ,MAAM;GACN,QAAQ,KAAK,MAAM,OAAO;EAC9B;CACJ,SAAS,OAAO;EACZ,OAAO,YAAY,KAAK;CAC5B;AACJ;;;;;;;;ACZA,MAAa,UAAU,OAAO,UAaA;CAC1B,MAAM,QAAQ,aAAa;CAC3B,IAAI,OAAO,UAAU,UACjB,OAAO;CAIX,IAAI,CAAC,sBAAsB,MAAM,IAAI,GACjC,OAAO;EAAE,IAAI;EAAO,OAAO,8BAA8B,MAAM,KAAK;CAAG;CAE3E,MAAM,CAAC,OAAO,QAAQ,MAAM,KAAK,MAAM,GAAG;CAI1C,MAAM,YAAY,uBAAuB;CACzC,MAAM,SAAwB;EAC1B,GAAG;EACH,MAAM,MAAM;EACZ,mBAAmB,MAAM;EACzB,cAAc,CAAC,GAAG,MAAM,GAAG,MAAM;EAEjC,QAAQ,MAAM,WAAY,MAAM,SAAS;EACzC,mBAAmB,MAAM,SAAS;EAClC,QAAQ,MAAM,SAAS;EACvB,iBAAiB;EACjB,qBAAqB;EACrB,aAAa;EACb,qBAAqB,MAAM,iBAAiB,uBAAuB;EACnE,mBAAmB,MAAM,uBAAuB,uBAAuB;EACvE,wBAAwB,MAAM,cAAc,uBAAuB;EACnE,gBAAgB,MAAM,mBAAmB,uBAAuB;EAKhE,IAAI,MAAM,cAAc,YAClB;GACE,GAAG;GACH,SAAS;GACT,UAAU,MAAM,eAAe,UAAU;GACzC,OAAO,MAAM,YAAY,UAAU;GACnC,SAAS,MAAM,cAAc,UAAU;GACvC,QAAQ,QAAQ,IAAI;EACxB,IACE;CACV;CAEA,IAAI;EAMA,MAAM,EAAE,QAAQ,aAAa,MAAM,IALnB,aAAa;GACzB;GACA,SAAS,QAAQ,IAAI;GACrB,iBAAiB,QAAQ,IAAI,4BAA4B;EAC7D,CACqC,CAAC,CAAC,IAAI;EAE3C,OAAO;GACH,IAAI;GACJ;GACA,OAAO,OAAO;GACd,SAAS,OAAO;GAChB,cAAc,OAAO,aAAa,KAAK,OAAO;IAC1C,YAAY,EAAE;IACd,aAAa,EAAE;IACf,SAAS,EAAE;IACX,OAAO,EAAE;IACT,QAAQ,EAAE;IACV,kBAAkB,EAAE;IACpB,oBAAoB,EAAE,sBAAsB;IAC5C,YAAY,EAAE;GAClB,EAAE;GACF,QAAQ,OAAO,OAAO,KAAK,OAAO;IAC9B,YAAY,EAAE;IACd,OAAO,EAAE;IACT,UAAU,EAAE;IACZ,SAAS,EAAE;GACf,EAAE;EACN;CACJ,SAAS,OAAO;EACZ,OAAO,YAAY,KAAK;CAC5B;AACJ;;;;;;;;;;;AC1EA,MAAa,gBAAgB,OAAO,UAKA;CAChC,MAAM,UAAU,MAAM,YAAY;CAClC,IAAI;EACA,QAAQ,SAAR;GACI,KAAK,YAAY;IACb,MAAM,SAAS,eAAe,EAAE,SAAS,MAAM,QAAQ,CAAC;IACxD,IAAI,OAAO,SACP,OAAO;KACH,IAAI;KACJ,SAAS;KACT,UAAU,OAAO;KACjB,MAAM,OAAO,QAAQ;KACrB,iBAAiB,OAAO;KACxB,wBAAwB,OAAO;IACnC;IAEJ,OAAO;KACH,IAAI;KACJ,SAAS;KACT,OAAO,OAAO,iBAAiB;IACnC;GACJ;GACA,KAAK,UAAU;IACX,IAAI,CAAC,MAAM,eAAe,CAAC,MAAM,eAC7B,OAAO;KAAE,IAAI;KAAO,SAAS;KAAU,OAAO;IAAkD;IAEpG,MAAM,SAAS,MAAM,kBAAkB;KACnC,aAAa,MAAM;KACnB,eAAe,MAAM;KACrB,SAAS,MAAM;IACnB,CAAC;IACD,IAAI,OAAO,SACP,OAAO;KACH,IAAI;KACJ,SAAS;KACT,aAAa,OAAO;KACpB,aAAa,OAAO;KACpB,WAAW,OAAO;KAClB,SAAS,OAAO;KAChB,SAAS,OAAO;IACpB;IAEJ,OAAO;KACH,IAAI;KACJ,SAAS;KACT,aAAa,OAAO;KACpB,aAAa,OAAO;KACpB,WAAW,OAAO;KAClB,SAAS,OAAO;KAChB,OAAO,OAAO,SAAS;IAC3B;GACJ;GACA,KAAK,YAAY;IACb,IAAI,CAAC,MAAM,eAAe,CAAC,MAAM,eAC7B,OAAO;KAAE,IAAI;KAAO,SAAS;KAAY,OAAO;IAAoD;IAExG,MAAM,SAAS,MAAM,6BAA6B;KAC9C,aAAa,MAAM;KACnB,eAAe,MAAM;KACrB,SAAS,MAAM;IACnB,CAAC;IACD,IAAI,OAAO,SACP,OAAO;KACH,IAAI;KACJ,SAAS;KACT,aAAa,OAAO;KACpB,aAAa,OAAO;KACpB,WAAW,OAAO;KAClB,SAAS,OAAO;KAChB,SAAS,OAAO;IACpB;IAEJ,OAAO;KACH,IAAI;KACJ,SAAS;KACT,aAAa,OAAO;KACpB,aAAa,OAAO;KACpB,WAAW,OAAO;KAClB,SAAS,OAAO;KAChB,OAAO,OAAO,SAAS;IAC3B;GACJ;EACJ;CACJ,SAAS,OAAO;EACZ,OAAO;GACH,IAAI;GACJ;GACA,OAAO,YAAY,KAAK,CAAC,CAAC;EAC9B;CACJ;AACJ;;;;;;;;;AChHA,MAAa,gBAAgB,OAAO,UAMA;CAChC,MAAM,QAAQ,aAAa;CAC3B,IAAI,OAAO,UAAU,UACjB,OAAO;CAEX,IAAI,MAAM,MAAM,WAAW,GACvB,OAAO;EAAE,IAAI;EAAO,OAAO;CAA2B;CAG1D,IAAI;EACA,MAAM,SAAS,mBAAmB,EAAE,MAAM,CAAC;EAC3C,MAAM,SAAqB;GACvB,SAAS,MAAM,WAAW,MAAM,QAAQ,SAAS,IAAI,MAAM,UAAU;GACrE,SAAS,MAAM,WAAW,MAAM,QAAQ,SAAS,IAAI,MAAM,UAAU;EACzE;EACA,MAAM,QAAQ,MAAM,qBAAqB;GACrC;GACA,QAAQ,MAAM;GACd,QAAQ,MAAM;GACd;GACA,iBAAiB,MAAM,oBAAoB;EAC/C,CAAC;EACD,OAAO;GACH,IAAI;GACJ,OAAO,MAAM;GACb,cAAc,MAAM,KAAK,OAAO;IAC5B,UAAU,EAAE;IACZ,eAAe,EAAE;IACjB,QAAQ,EAAE;IACV,qBAAqB,EAAE;GAC3B,EAAE;EACN;CACJ,SAAS,OAAO;EACZ,OAAO,YAAY,KAAK;CAC5B;AACJ;;;;;;;;;;;;;;;;AChCA,MAAa,kBAAkB,OAAO,UAA+E;CACjH,MAAM,QAAQ,aAAa;CAC3B,IAAI,OAAO,UAAU,UACjB,OAAO;CAEX,IAAI,CAAC,sBAAsB,MAAM,IAAI,GACjC,OAAO;EAAE,IAAI;EAAO,OAAO,8BAA8B,MAAM,KAAK;CAAG;CAE3E,MAAM,CAAC,OAAO,QAAQ,MAAM,KAAK,MAAM,GAAG;CAC1C,MAAM,SAAS,MAAM,WAAW;CAEhC,IAAI;EACA,MAAM,SAAS,mBAAmB,EAAE,MAAM,CAAC;EAC3C,MAAM,WAAW,MAAM,sBAAsB,QAAQ,OAAO,IAAI;EAChE,MAAM,WAAW,MAAM,QAAQ,IAC3B,SAAS,KAAK,WAAW,kBAAkB,QAAQ,OAAO,MAAM,MAAM,CAAC,CAC3E;EAEA,MAAM,SAAS,SAAS,QAAQ,MAAM,EAAE,MAAM;EAC9C,MAAM,WAAW,SAAS,QAAQ,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;EAC7D,MAAM,OAAO,SAAS,QAAQ,MAAM,CAAC,EAAE,MAAM;EAC7C,MAAM,aAAa,CAAC,GAAG,QAAQ,GAAG,QAAQ;EAE1C,IAAI,QACA,OAAO;GACH,IAAI;GACJ,QAAQ;GACR,SAAS;GACT,SAAS,CAAC;GACV,MAAM,KAAK,KAAK,MAAM,EAAE,MAAM;GAC9B,QAAQ,CAAC;EACb;EAGJ,MAAM,UAAoB,CAAC;EAC3B,MAAM,SAAmB,CAAC;EAC1B,KAAK,MAAM,KAAK,YACZ,IAAI;GACA,MAAM,mBAAmB,QAAQ,OAAO,MAAM,EAAE,MAAM;GACtD,QAAQ,KAAK,EAAE,MAAM;EACzB,QAAQ;GAEJ,OAAO,KAAK,EAAE,MAAM;EACxB;EAGJ,OAAO;GACH,IAAI;GACJ,QAAQ;GACR,SAAS;GACT;GACA,MAAM,KAAK,KAAK,MAAM,EAAE,MAAM;GAC9B;EACJ;CACJ,SAAS,OAAO;EACZ,OAAO,YAAY,KAAK;CAC5B;AACJ;;;;;;;;;AC/DA,MAAa,aAAa,OAAO,UAAoD;CACjF,IAAI,CAAC,sBAAsB,MAAM,IAAI,GACjC,OAAO;EAAE,IAAI;EAAO,OAAO,8BAA8B,MAAM,KAAK;CAAG;CAE3E,IAAI;EACA,MAAM,YAAY,QAAQ,IAAI,4BAA4B;EAC1D,MAAM,UAAU,iBAAiB,MAAM,MAAM,SAAS;EACtD,OAAO;GACH,IAAI;GACJ,MAAM,MAAM;GACZ,MAAM,QAAQ,KAAK,OAAO;IACtB,OAAO,EAAE;IACT,WAAW,EAAE;IACb,YAAY,EAAE;IACd,cAAc,EAAE;IAEhB,SAAS,EAAE;IACX,WAAW,EAAE;GACjB,EAAE;EACN;CACJ,SAAS,OAAO;EACZ,OAAO,YAAY,KAAK;CAC5B;AACJ;;;;;;;;;;;;;;;AC1BA,MAAa,wBAAmC;CAC5C,MAAM,SAAS,IAAI,UAAU;EACzB,MAAM;EACN,SAAS;CACb,CAAC;CAED,OAAO,aACH,gBACA;EACI,aAAa;EACb,aAAa;CACjB,GACA,OAAO,UAAU;EACb,MAAM,SAAS,MAAM,YAAY,KAAK;EACtC,OAAO,EACH,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC;EAAE,CAAC,EACrE;CACJ,CACJ;CAEA,OAAO,aACH,mBACA;EACI,aAAa;EACb,aAAa;CACjB,GACA,YAAY;EACR,MAAM,SAAS,MAAM,cAAc;EACnC,OAAO,EACH,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC;EAAE,CAAC,EACrE;CACJ,CACJ;CAEA,OAAO,aACH,YACA;EACI,aAAa;EACb,aAAa;CACjB,GACA,OAAO,UAAU;EACb,MAAM,SAAS,MAAM,QAAQ,KAAK;EAClC,OAAO,EACH,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC;EAAE,CAAC,EACrE;CACJ,CACJ;CAEA,OAAO,aACH,kBACA;EACI,aAAa;EACb,aAAa;CACjB,GACA,OAAO,UAAU;EACb,MAAM,SAAS,MAAM,cAAc,KAAK;EACxC,OAAO,EACH,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC;EAAE,CAAC,EACrE;CACJ,CACJ;CAEA,OAAO,aACH,kBACA;EACI,aAAa;EACb,aAAa;CACjB,GACA,OAAO,UAAU;EACb,MAAM,SAAS,MAAM,cAAc,KAAK;EACxC,OAAO,EACH,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC;EAAE,CAAC,EACrE;CACJ,CACJ;CAEA,OAAO,aACH,oBACA;EACI,aAAa;EACb,aAAa;CACjB,GACA,OAAO,UAAU;EACb,MAAM,SAAS,MAAM,gBAAgB,KAAK;EAC1C,OAAO,EACH,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC;EAAE,CAAC,EACrE;CACJ,CACJ;CAEA,OAAO,aACH,WACA;EACI,aAAa;EACb,aAAa;CACjB,GACA,OAAO,UAAU;EACb,MAAM,SAAS,MAAM,WAAW,KAAK;EACrC,OAAO,EACH,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC;EAAE,CAAC,EACrE;CACJ,CACJ;CAEA,OAAO;AACX;;AAGA,MAAa,eAAe,YAA2B;CACnD,MAAM,SAAS,gBAAgB;CAC/B,MAAM,YAAY,IAAI,qBAAqB;CAC3C,MAAM,OAAO,QAAQ,SAAS;AAClC"}
+{"version":3,"file":"src.mjs","names":[],"sources":["../src/tools/schemas.ts","../src/tools/errors.ts","../src/tools/fetch-alerts.ts","../src/tools/get-last-report.ts","../src/tools/run-scan.ts","../src/tools/fix-dependency.ts","../src/tools/discover-repos.ts","../src/tools/cleanup-branches.ts","../src/tools/history.ts","../src/tools/pnpm-audit.tool.ts","../src/index.ts"],"sourcesContent":["import { z } from 'zod'\nimport { RUNTIME_MODES, SEVERITY_THRESHOLDS } from '@dependfix/engine'\n\n// run_scan 的 mode 子集：排除 cleanup-branches（由独立 cleanup_branches tool 承担；\n// DependfixApp 的该 mode 走交互确认，MCP stdio 不可用——见 mcp-server.md §8.3）。\n// 从 cli RUNTIME_MODES 派生（filter 跟随 cli 演进），非独立硬编码。\n// as unknown 桥接：filter 返回数组类型，z.enum 需要 readonly 元组。\nconst RUN_SCAN_MODES = RUNTIME_MODES.filter((m) => m !== 'cleanup-branches') as unknown as readonly ['report-only', 'fix', 'fix-and-pr']\n\n/** `fetch_alerts` 输入：拉取指定仓库的安全告警（Dependabot + 可选 Code Scanning） */\nexport const fetchAlertsSchema = z.object({\n    repo: z.string().describe('目标仓库，格式 owner/repo'),\n    severity: z.enum(SEVERITY_THRESHOLDS).default('high').describe('严重级别阈值（high 保留 critical + high，与 CLI 一致）'),\n    code_scanning: z.boolean().optional().describe('同时拉取 Code Scanning 告警（与 Dependabot 并行；需要 token 具备 security-events: read）'),\n})\n\n/** `get_last_report` 输入：读取最近一次 JSON 报告 */\nexport const getLastReportSchema = z.object({})\n\n/** `run_scan` 输入：对目标仓库执行 dependfix 扫描并修复 */\nexport const runScanSchema = z.object({\n    repo: z.string().describe('目标仓库，格式 owner/repo'),\n    mode: z.enum(RUN_SCAN_MODES).default('report-only').describe('执行模式（默认仅报告）'),\n    severity: z.enum(SEVERITY_THRESHOLDS).default('high').describe('严重级别阈值'),\n    code_scanning: z.boolean().optional().describe('同时拉取 Code Scanning 告警（默认 false）'),\n    max_alerts: z.number().int().min(1).max(1000).optional().describe('每仓库最多处理的告警数（默认 20）'),\n    max_concurrency: z.number().int().min(1).max(16).optional().describe('多仓库并发窗口（默认 1 保守串行）'),\n    dry_run: z.boolean().optional().describe('试运行不实际写入；缺省按 mode 推断（report-only 为 true）。与 mode=fix/fix-and-pr 互斥（会返回配置校验错误）'),\n    allow_major_upgrade: z.boolean().optional().describe('跨线 major 升级显式授权（默认 false；仅根直接依赖 + lockfile 单版本，强制完整验证）'),\n    ai_enabled: z.boolean().optional().describe('开启 AI breaking change 研判（默认 false；apiKey 从 DEPENDFIX_AI_API_KEY env 读取，禁止经 tool 参数传入）'),\n    ai_provider: z.enum(['openai-compatible', 'anthropic']).optional().describe('AI 提供商（默认 openai-compatible）'),\n    ai_model: z.string().optional().describe('AI 模型名（默认 deepseek-v4-flash）'),\n    ai_trigger: z.enum(['failure', 'major', 'both']).optional().describe('AI 触发范围（默认 both）'),\n})\n\n/** `fix_dependency` 输入：修复单个依赖（多修复类型） */\nexport const fixDependencySchema = z.object({\n    /** 本地仓库路径（已 clone 的目录，含 package.json/pnpm-lock.yaml） */\n    workDir: z.string().describe('本地仓库工作目录（已 clone，包含 package.json 与 pnpm-lock.yaml）'),\n    /** 修复类型：override（间接依赖 overrides）/ direct（直接依赖升级）/ lockfile（frozen-lockfile 漂移修复） */\n    fix_type: z.enum(['override', 'direct', 'lockfile']).default('override').describe('修复类型（默认 override）'),\n    /** override / direct 必填 */\n    packageName: z.string().optional().describe('依赖包名（fix_type=override/direct 必填）'),\n    /** override / direct 必填 */\n    targetVersion: z.string().optional().describe('目标精确版本，如 4.17.21（fix_type=override/direct 必填）'),\n})\n\n/** `discover_repos` 输入：按 owner / org 自动发现仓库 */\nexport const discoverReposSchema = z.object({\n    owner: z.array(z.string()).min(1).describe('owner / org 列表（分别发现后合并）'),\n    topics: z.array(z.string()).optional().describe('topic 白名单（AND 语义：必须包含全部指定 topics）'),\n    include: z.array(z.string()).optional().describe('仓库白名单 glob（如 owner/*、owner/pkg-*）'),\n    exclude: z.array(z.string()).optional().describe('仓库黑名单 glob（与 include 冲突时胜出）'),\n    probe_dependabot: z.boolean().optional().describe('探测 .github/dependabot.yml 存在性（默认 true；会额外触达 contents API）'),\n    max_repos: z.number().int().min(0).optional().describe('发现规模上限：最多保留的仓库数（默认 100；0 表示不限制）'),\n})\n\n/** `cleanup_branches` 输入：清理已合并/已关闭的 dependfix 分支 */\nexport const cleanupBranchesSchema = z.object({\n    repo: z.string().describe('目标仓库，格式 owner/repo'),\n    dry_run: z.boolean().optional().describe('仅列出待清理分支，不执行删除（默认 false）'),\n})\n\n/** `history` 输入：查询仓库历史运行摘要 */\nexport const historySchema = z.object({\n    repo: z.string().describe('目标仓库，格式 owner/repo'),\n})\n\n/** `pnpm_audit` 输入：本地 pnpm audit 回退数据源 */\nexport const pnpmAuditSchema = z.object({\n    /** 本地仓库工作目录（已 clone，包含 pnpm-lock.yaml） */\n    workDir: z.string().describe('本地仓库工作目录（已 clone，包含 pnpm-lock.yaml）'),\n    /** 仓库标识（owner/repo 或 local 兜底；与 CLI --repo 同源语义） */\n    repository: z.string().describe('仓库标识（owner/repo 或 local 兜底；用于归一化 NormalizedSecurityAlert.repository 字段）'),\n})\n","// 统一 tool 错误模板（复用收口）：\n// - requireToken：GITHUB_TOKEN 检查。返回 token 字符串或错误对象；\n//   调用方用 `typeof token !== 'string'` 守卫收窄（项目未开 strictNullChecks，\n//   truthiness 判别收窄不生效，typeof 守卫是兼容形式）。\n// - toToolError：任意错误 → ok:false（统一 Error.message / String 转换）\n// 各 tool 的返回联合类型均含 `{ ok: false, error: string }` 分支，可安全返回。\n\nexport type ToolError = { ok: false, error: string }\n\nexport const requireToken = (): string | ToolError => {\n    const token = process.env.GITHUB_TOKEN\n    if (!token) {\n        return { ok: false, error: 'GITHUB_TOKEN not set（请配置环境变量）' }\n    }\n    return token\n}\n\nexport const toToolError = (error: unknown): ToolError => ({\n    ok: false,\n    error: error instanceof Error ? error.message : String(error),\n})\n","import { createGitHubClient, fetchCodeScanningAlerts, fetchDependabotAlerts, type FetchDependabotAlertsParams } from '@dependfix/engine'\nimport { fromPat } from '@dependfix/engine/auth'\nimport { filterAlerts, isValidRepoIdentifier, type SeverityThreshold } from '@dependfix/core'\nimport { requireToken, toToolError } from './errors'\n\n/** `fetch_alerts` 返回结构 */\nexport type FetchAlertsResult =\n    | {\n        ok: true\n        count: number\n        alerts: Array<{\n            id: number\n            severity: string\n            packageName: string\n            manifestPath: string\n            recommendedVersion: string\n            fixable: boolean\n            htmlUrl: string\n            summary: string\n        }>\n    }\n    | { ok: false, error: string }\n\n/**\n * `fetch_alerts`：拉取指定仓库的 Dependabot 安全告警（只读）。\n * 凭据从 GITHUB_TOKEN 环境变量读取（mcp-server.md §4.3）。\n */\nexport const fetchAlerts = async (input: { repo: string, severity: SeverityThreshold, code_scanning?: boolean }): Promise<FetchAlertsResult> => {\n    const token = requireToken()\n    if (typeof token !== 'string') {\n        return token\n    }\n\n    // repo 格式校验复用 core（与 CLI 同源，避免自研校验漂移）\n    if (!isValidRepoIdentifier(input.repo)) {\n        return { ok: false, error: `repo 格式非法（预期 owner/repo，收到 ${input.repo}）` }\n    }\n    const [owner, repo] = input.repo.split('/')\n\n    try {\n        const client = createGitHubClient({ auth: fromPat(token) })\n        const params: FetchDependabotAlertsParams = {\n            owner,\n            repo,\n            state: 'open',\n        }\n\n        // Dependabot + 可选 Code Scanning 并行（复用 cli fetcher；与 CLI --code-scanning 同源）。\n        // 注意：CS 拉取失败（权限/网络）会使整个 tool 失败——与 CLI 现状一致\n        // （per-source 错误隔离为 backlog 登记项，暂缓），结果不静默丢弃。\n        const codeScanningEnabled = input.code_scanning ?? false\n        const [dependabotAlerts, codeScanningAlerts] = await Promise.all([\n            fetchDependabotAlerts(client, params),\n            codeScanningEnabled\n                ? fetchCodeScanningAlerts(client, { owner, repo })\n                : Promise.resolve([] as Awaited<ReturnType<typeof fetchDependabotAlerts>>),\n        ])\n        const alerts = [...dependabotAlerts, ...codeScanningAlerts]\n\n        // 严重级别过滤复用 core 阈值语义（与 CLI 一致：high 保留 critical + high；\n        // all 不过滤；Code Scanning 源 unknown 恒透传）。不使用相等匹配，避免 high 漏掉 critical。\n        const { filtered } = filterAlerts(alerts, { severityThreshold: input.severity })\n\n        return {\n            ok: true,\n            count: filtered.length,\n            alerts: filtered.map((a) => ({\n                id: a.id,\n                severity: a.severity,\n                packageName: a.packageName,\n                manifestPath: a.manifestPath,\n                recommendedVersion: a.recommendedVersion,\n                fixable: a.fixable,\n                htmlUrl: a.htmlUrl,\n                summary: a.summary,\n            })),\n        }\n    } catch (error) {\n        return toToolError(error)\n    }\n}\n","import { readFileSync, readdirSync } from 'node:fs'\nimport { join } from 'node:path'\nimport { toToolError } from './errors'\n\n/** `get_last_report` 返回结构 */\nexport type GetLastReportResult =\n    | { ok: true, file: string, report: unknown }\n    | { ok: false, error: string }\n\n/**\n * `get_last_report`：读取最近一次 JSON 报告（只读）。\n * 报告目录默认为 `./dependfix-reports`（可用 `DEPENDFIX_MCP_REPORT_DIR` 覆盖）。\n */\nexport const getLastReport = async (): Promise<GetLastReportResult> => {\n    const reportDir = process.env.DEPENDFIX_MCP_REPORT_DIR ?? './dependfix-reports'\n    try {\n        const files = readdirSync(reportDir)\n            .filter((f) => f.endsWith('.json'))\n            .sort()\n        if (files.length === 0) {\n            return { ok: false, error: `未找到报告（目录 ${reportDir} 为空）` }\n        }\n        const latest = files[files.length - 1]\n        const content = readFileSync(join(reportDir, latest), 'utf-8')\n        return {\n            ok: true,\n            file: latest,\n            report: JSON.parse(content),\n        }\n    } catch (error) {\n        return toToolError(error)\n    }\n}\n","import { DependfixApp, DEFAULT_RUNTIME_CONFIG, type RuntimeConfig } from '@dependfix/engine'\nimport { isValidRepoIdentifier } from '@dependfix/core'\nimport { requireToken, toToolError } from './errors'\n\n/** `run_scan` 返回结构（M28.4 RunResult 对齐 + 向后兼容）\n *\n * 字段对齐 `RunResult` 接口（packages/core/src/report/types.ts）：\n * - 8 字段保留（向后兼容——老客户端忽略未知字段）：\n *   ok / exitCode / runId / summary / repositories / errors\n * - 5 字段新增（M28.4 RunResult 对齐）：\n *   startedAt / finishedAt / config / alerts / actions\n *\n * 2 字段可选（按 --ai 开启 + 供应链信号决定；不在 RunScanResult 必填）：\n *   aiUsage? / supplyChainWarnings?（暂不映射——避免 RunScanResult 类型膨胀）\n */\nexport type RunScanResult =\n    | {\n        ok: true\n        exitCode: number\n        runId: string\n        summary: import('@dependfix/core').RunSummary\n        repositories: Array<Record<string, unknown>>\n        errors: Array<Record<string, unknown>>\n        /** RunResult.startedAt：ISO 8601 字符串 */\n        startedAt: string\n        /** RunResult.finishedAt：ISO 8601 字符串 */\n        finishedAt: string\n        /** RunResult.config：本次运行配置快照（RuntimeConfig） */\n        config: import('@dependfix/core').RunReportConfig\n        /** RunResult.alerts：所有仓库合并归一化告警 */\n        alerts: Array<import('@dependfix/core').NormalizedSecurityAlert>\n        /** RunResult.actions：所有仓库合并的修复动作 */\n        actions: Array<import('@dependfix/core').FixAction>\n    }\n    | { ok: false, error: string }\n\n/**\n * `run_scan`：对目标仓库执行 dependfix 扫描并修复。\n * 凭据从 GITHUB_TOKEN 环境变量读取；repo 为 GitHub 远程仓库（report-only 无需 clone）。\n */\nexport const runScan = async (input: {\n    repo: string\n    mode: 'report-only' | 'fix' | 'fix-and-pr'\n    severity: string\n    code_scanning?: boolean\n    max_alerts?: number\n    max_concurrency?: number\n    dry_run?: boolean\n    allow_major_upgrade?: boolean\n    ai_enabled?: boolean\n    ai_provider?: 'openai-compatible' | 'anthropic'\n    ai_model?: string\n    ai_trigger?: 'failure' | 'major' | 'both'\n}): Promise<RunScanResult> => {\n    const token = requireToken()\n    if (typeof token !== 'string') {\n        return token\n    }\n\n    // repo 格式校验复用 core（与 CLI 同源）\n    if (!isValidRepoIdentifier(input.repo)) {\n        return { ok: false, error: `repo 格式非法（预期 owner/repo，收到 ${input.repo}）` }\n    }\n    const [owner, repo] = input.repo.split('/')\n\n    // 展开 cli 默认配置（maxAlerts/maxConcurrency/maxRetries/maxBackoff/alertSource/ai 默认等\n    // 与 CLI 单一事实源对齐，避免手写默认值漂移），仅覆盖 tool 参数可控制字段。\n    const defaultAi = DEFAULT_RUNTIME_CONFIG.ai\n    const config: RuntimeConfig = {\n        ...DEFAULT_RUNTIME_CONFIG,\n        mode: input.mode,\n        severityThreshold: input.severity as 'critical' | 'high' | 'medium' | 'all',\n        repositories: [`${owner}/${repo}`],\n        // dry-run 显式参数优先，缺省按 mode 推断（report-only 即只读）\n        dryRun: input.dry_run ?? (input.mode === 'report-only'),\n        createPullRequest: input.mode === 'fix-and-pr',\n        commit: input.mode === 'fix',\n        cleanupBranches: false,\n        cleanupBranchesAuto: false,\n        githubToken: token,\n        codeScanningEnabled: input.code_scanning ?? DEFAULT_RUNTIME_CONFIG.codeScanningEnabled,\n        allowMajorUpgrade: input.allow_major_upgrade ?? DEFAULT_RUNTIME_CONFIG.allowMajorUpgrade,\n        maxAlertsPerRepository: input.max_alerts ?? DEFAULT_RUNTIME_CONFIG.maxAlertsPerRepository,\n        maxConcurrency: input.max_concurrency ?? DEFAULT_RUNTIME_CONFIG.maxConcurrency,\n        // AI 研判：展开 cli 默认（provider/model/baseUrl/trigger 与 CLI 对齐），\n        // 仅覆盖开关与显式参数；apiKey 只从 env 读取（DEPENDFIX_AI_API_KEY），\n        // 禁止经 tool 参数传入（防客户端日志泄露）。\n        // defaultAi 收窄：默认配置缺失时视为未开启（与类型声明一致，运行时恒有值）\n        ai: input.ai_enabled && defaultAi\n            ? {\n                ...defaultAi,\n                enabled: true,\n                provider: input.ai_provider ?? defaultAi.provider,\n                model: input.ai_model ?? defaultAi.model,\n                trigger: input.ai_trigger ?? defaultAi.trigger,\n                apiKey: process.env.DEPENDFIX_AI_API_KEY,\n            }\n            : undefined,\n    }\n\n    try {\n        const app = new DependfixApp({\n            config,\n            workDir: process.cwd(),\n            reportOutputDir: process.env.DEPENDFIX_MCP_REPORT_DIR ?? './dependfix-reports',\n        })\n        const { result, exitCode } = await app.run()\n\n        return {\n            ok: true,\n            exitCode,\n            runId: result.runId,\n            summary: result.summary,\n            repositories: result.repositories.map((r) => ({\n                repository: r.repository,\n                alertsCount: r.alertsCount,\n                fixable: r.fixable,\n                fixed: r.fixed,\n                failed: r.failed,\n                lockfileRepaired: r.lockfileRepaired,\n                verificationPassed: r.verificationPassed ?? undefined,\n                durationMs: r.durationMs,\n            })),\n            errors: result.errors.map((e) => ({\n                repository: e.repository,\n                stage: e.stage,\n                category: e.category,\n                message: e.message,\n            })),\n            startedAt: result.startedAt,\n            finishedAt: result.finishedAt,\n            config: result.config,\n            alerts: result.alerts,\n            actions: result.actions,\n        }\n    } catch (error) {\n        return toToolError(error)\n    }\n}\n","import { overrideTransitiveDependency, repairLockfile, upgradeDependency, type LockfileDiff } from '@dependfix/engine'\nimport { toToolError } from './errors'\n\n/** `fix_dependency` 返回结构（按 fixType 判别） */\nexport type FixDependencyResult =\n    | {\n        ok: true\n        fixType: 'override' | 'direct'\n        packageName: string\n        fromVersion: string\n        toVersion: string\n        isMajor: boolean\n        warning?: string\n    }\n    | {\n        ok: true\n        fixType: 'lockfile'\n        strategy?: string\n        diff?: LockfileDiff | null\n        lockfileVersion?: string\n        lockfileVersionChanged?: boolean\n    }\n    | {\n        ok: false\n        fixType: 'override' | 'direct' | 'lockfile'\n        packageName?: string\n        fromVersion?: string\n        toVersion?: string\n        isMajor?: boolean\n        error: string\n    }\n\n/**\n * `fix_dependency`：修复单个依赖或 lockfile（按 `fix_type` 分发，复用 cli fixers）：\n * - `override`（默认）：间接依赖 → `overrideTransitiveDependency`（写入 pnpm overrides）\n * - `direct`：直接依赖 → `upgradeDependency`（改写 manifest + `pnpm install`，失败回滚）\n * - `lockfile`：frozen-lockfile 漂移 → `repairLockfile`（策略链修复，全部失败回滚）\n * 均需本地已 clone 的仓库目录（workDir）。\n */\nexport const fixDependency = async (input: {\n    workDir: string\n    fix_type?: 'override' | 'direct' | 'lockfile'\n    packageName?: string\n    targetVersion?: string\n}): Promise<FixDependencyResult> => {\n    const fixType = input.fix_type ?? 'override'\n    try {\n        switch (fixType) {\n            case 'lockfile': {\n                const result = repairLockfile({ workDir: input.workDir })\n                if (result.success) {\n                    return {\n                        ok: true,\n                        fixType: 'lockfile',\n                        strategy: result.strategy,\n                        diff: result.diff ?? null,\n                        lockfileVersion: result.lockfileVersion,\n                        lockfileVersionChanged: result.lockfileVersionChanged,\n                    }\n                }\n                return {\n                    ok: false,\n                    fixType: 'lockfile',\n                    error: result.failureDetail ?? 'lockfile repair failed',\n                }\n            }\n            case 'direct': {\n                if (!input.packageName || !input.targetVersion) {\n                    return { ok: false, fixType: 'direct', error: 'packageName 与 targetVersion 必填（fix_type=direct）' }\n                }\n                const result = await upgradeDependency({\n                    packageName: input.packageName,\n                    targetVersion: input.targetVersion,\n                    workDir: input.workDir,\n                })\n                if (result.success) {\n                    return {\n                        ok: true,\n                        fixType: 'direct',\n                        packageName: result.packageName,\n                        fromVersion: result.fromVersion,\n                        toVersion: result.toVersion,\n                        isMajor: result.isMajor,\n                        warning: result.warning,\n                    }\n                }\n                return {\n                    ok: false,\n                    fixType: 'direct',\n                    packageName: result.packageName,\n                    fromVersion: result.fromVersion,\n                    toVersion: result.toVersion,\n                    isMajor: result.isMajor,\n                    error: result.error ?? 'upgrade failed',\n                }\n            }\n            case 'override': {\n                if (!input.packageName || !input.targetVersion) {\n                    return { ok: false, fixType: 'override', error: 'packageName 与 targetVersion 必填（fix_type=override）' }\n                }\n                const result = await overrideTransitiveDependency({\n                    packageName: input.packageName,\n                    targetVersion: input.targetVersion,\n                    workDir: input.workDir,\n                })\n                if (result.success) {\n                    return {\n                        ok: true,\n                        fixType: 'override',\n                        packageName: result.packageName,\n                        fromVersion: result.fromVersion,\n                        toVersion: result.toVersion,\n                        isMajor: result.isMajor,\n                        warning: result.warning,\n                    }\n                }\n                return {\n                    ok: false,\n                    fixType: 'override',\n                    packageName: result.packageName,\n                    fromVersion: result.fromVersion,\n                    toVersion: result.toVersion,\n                    isMajor: result.isMajor,\n                    error: result.error ?? 'override failed',\n                }\n            }\n        }\n    } catch (error) {\n        return {\n            ok: false,\n            fixType,\n            error: toToolError(error).error,\n        }\n    }\n}\n","import { createGitHubClient, discoverRepositories, type RepoPolicy } from '@dependfix/engine'\nimport { fromPat } from '@dependfix/engine/auth'\nimport { requireToken, toToolError } from './errors'\n\n/** `discover_repos` 返回结构 */\nexport type DiscoverReposResult =\n    | {\n        ok: true\n        count: number\n        repositories: Array<{\n            fullName: string\n            defaultBranch: string\n            topics: string[]\n            hasDependabotConfig: boolean\n        }>\n    }\n    | { ok: false, error: string }\n\n/**\n * `discover_repos`：按 owner / org 自动发现仓库（复用 cli discoverRepositories，\n * 与 CLI `--owner` / `--repo-topics` / `--repo-include` / `--repo-exclude` 同源过滤链）。\n * 凭据从 GITHUB_TOKEN 环境变量读取。\n */\nexport const discoverRepos = async (input: {\n    owner: string[]\n    topics?: string[]\n    include?: string[]\n    exclude?: string[]\n    probe_dependabot?: boolean\n    max_repos?: number\n}): Promise<DiscoverReposResult> => {\n    const token = requireToken()\n    if (typeof token !== 'string') {\n        return token\n    }\n    if (input.owner.length === 0) {\n        return { ok: false, error: 'owner 必填（至少一个 owner/org）' }\n    }\n\n    try {\n        const client = createGitHubClient({ auth: fromPat(token) })\n        const policy: RepoPolicy = {\n            include: input.include && input.include.length > 0 ? input.include : undefined,\n            exclude: input.exclude && input.exclude.length > 0 ? input.exclude : undefined,\n        }\n        const repos = await discoverRepositories({\n            client,\n            owners: input.owner,\n            topics: input.topics,\n            policy,\n            probeDependabot: input.probe_dependabot ?? true,\n            maxRepos: input.max_repos,\n        })\n        return {\n            ok: true,\n            count: repos.length,\n            repositories: repos.map((r) => ({\n                fullName: r.fullName,\n                defaultBranch: r.defaultBranch,\n                topics: r.topics,\n                hasDependabotConfig: r.hasDependabotConfig,\n            })),\n        }\n    } catch (error) {\n        return toToolError(error)\n    }\n}\n","import { createGitHubClient, deleteRemoteBranch, getBranchPrStatus, listDependfixBranches } from '@dependfix/engine'\nimport { fromPat } from '@dependfix/engine/auth'\nimport { isValidRepoIdentifier } from '@dependfix/core'\nimport { requireToken, toToolError } from './errors'\n\n/** `cleanup_branches` 返回结构 */\nexport type CleanupBranchesResult =\n    | {\n        ok: true\n        dryRun: boolean\n        scanned: string[]\n        /** 已删除分支（dry_run 时为空） */\n        deleted: string[]\n        /** 保留分支（open PR / 无 PR 未关闭） */\n        kept: string[]\n        /** 删除失败分支（best-effort，不中断） */\n        failed: string[]\n    }\n    | { ok: false, error: string }\n\n/**\n * `cleanup_branches`：清理已合并/已关闭的 dependfix 分支（非交互）。\n *\n * 复用 cli pr-creator 底层函数自编排，语义对齐 `autoCleanupMergedBranches`：\n * - 只处理 `dependfix/` 前缀分支（listDependfixBranches 已过滤）\n * - 删除候选 = 已合并（merged）+ 已关闭未合并（orphaned）；绝不触碰 open PR 分支\n * - 单分支删除失败记录到 `failed`，不中断其余删除（best-effort）\n * - dry_run 仅列清单（deleted/failed 为空）\n *\n * 刻意不走 DependfixApp 的 cleanup-branches mode：`runBranchCleanupForRepo`\n * 含交互式确认（非 TTY 默认拒绝），MCP stdio 下不可用。\n */\nexport const cleanupBranches = async (input: { repo: string, dry_run?: boolean }): Promise<CleanupBranchesResult> => {\n    const token = requireToken()\n    if (typeof token !== 'string') {\n        return token\n    }\n    if (!isValidRepoIdentifier(input.repo)) {\n        return { ok: false, error: `repo 格式非法（预期 owner/repo，收到 ${input.repo}）` }\n    }\n    const [owner, repo] = input.repo.split('/')\n    const dryRun = input.dry_run ?? false\n\n    try {\n        const client = createGitHubClient({ auth: fromPat(token) })\n        const branches = await listDependfixBranches(client, owner, repo)\n        const statuses = await Promise.all(\n            branches.map((branch) => getBranchPrStatus(client, owner, repo, branch)),\n        )\n\n        const merged = statuses.filter((s) => s.merged)\n        const orphaned = statuses.filter((s) => s.closed && !s.merged)\n        const kept = statuses.filter((s) => !s.closed)\n        const candidates = [...merged, ...orphaned]\n\n        if (dryRun) {\n            return {\n                ok: true,\n                dryRun: true,\n                scanned: branches,\n                deleted: [],\n                kept: kept.map((s) => s.branch),\n                failed: [],\n            }\n        }\n\n        const deleted: string[] = []\n        const failed: string[] = []\n        for (const s of candidates) {\n            try {\n                await deleteRemoteBranch(client, owner, repo, s.branch)\n                deleted.push(s.branch)\n            } catch {\n                // 单分支删除失败（分支保护/不存在）不中断其余删除，best-effort\n                failed.push(s.branch)\n            }\n        }\n\n        return {\n            ok: true,\n            dryRun: false,\n            scanned: branches,\n            deleted,\n            kept: kept.map((s) => s.branch),\n            failed,\n        }\n    } catch (error) {\n        return toToolError(error)\n    }\n}\n","import { queryRepoHistory } from '@dependfix/engine'\nimport { isValidRepoIdentifier } from '@dependfix/core'\nimport { toToolError } from './errors'\n\n/** `history` 返回结构 */\nexport type HistoryResult =\n    | {\n        ok: true\n        repo: string\n        runs: Array<{\n            runId: string\n            startedAt: string\n            durationMs: number\n            repositories: string[]\n            summary: Record<string, unknown>\n            repoStats: Array<Record<string, unknown>>\n        }>\n    }\n    | { ok: false, error: string }\n\n/**\n * `history`：查询某仓库的历史运行摘要（倒序时间：最新在前）。\n * 复用 cli `queryRepoHistory`（读 dependfix-reports/index.json 聚合索引，\n * 与 `get_last_report` 的单文件语义不同）；报告目录可用 `DEPENDFIX_MCP_REPORT_DIR` 覆盖。\n */\nexport const getHistory = async (input: { repo: string }): Promise<HistoryResult> => {\n    if (!isValidRepoIdentifier(input.repo)) {\n        return { ok: false, error: `repo 格式非法（预期 owner/repo，收到 ${input.repo}）` }\n    }\n    try {\n        const reportDir = process.env.DEPENDFIX_MCP_REPORT_DIR ?? './dependfix-reports'\n        const entries = queryRepoHistory(input.repo, reportDir)\n        return {\n            ok: true,\n            repo: input.repo,\n            runs: entries.map((e) => ({\n                runId: e.runId,\n                startedAt: e.startedAt,\n                durationMs: e.durationMs,\n                repositories: e.repositories,\n                // 桥接：RunSummary/ArchiveRepoStats 无索引签名，显式转 unknown 再收窄\n                summary: e.summary as unknown as Record<string, unknown>,\n                repoStats: e.repoStats as unknown as Array<Record<string, unknown>>,\n            })),\n        }\n    } catch (error) {\n        return toToolError(error)\n    }\n}\n","import { fetchPnpmAuditAlerts, type FetchPnpmAuditAlertsParams } from '@dependfix/engine'\nimport { requireToken, toToolError } from './errors'\n\n/**\n * `pnpm_audit` 返回结构\n *\n * 复用 `fetchAlerts` 的子集结构（id / severity / packageName / manifestPath /\n * recommendedVersion / fixable / htmlUrl / summary），让客户端能以一致形式\n * 消费 Dependabot / Code Scanning / pnpm-audit 三源告警。\n */\nexport type PnpmAuditResult =\n    | {\n        ok: true\n        /** pnpm-audit 归一化后的告警数 */\n        count: number\n        /** 工作目录（与 input.workDir 一致；方便客户端无需记录入参） */\n        workDir: string\n        /** 注入的仓库标识（owner/repo 或 local 兜底） */\n        repository: string\n        alerts: Array<{\n            id: number\n            severity: string\n            packageName: string\n            manifestPath: string\n            recommendedVersion: string\n            fixable: boolean\n            htmlUrl: string\n            summary: string\n        }>\n    }\n    | { ok: false, error: string }\n\n/**\n * `pnpm_audit`：本地 pnpm audit 回退数据源（无 GitHub token 或 403 场景）。\n *\n * 设计意图（详见 docs/design/pnpm-audit-fallback.md）：\n * - 显式 `--alerts-source pnpm-audit` 触发（CLI）或显式调用 `pnpm_audit` tool（MCP）触发\n * - 复用 `fetchPnpmAuditAlerts` 解析 + 归一化逻辑（与 CLI 同源）\n * - audit 自身失败（无 lockfile / pnpm 不可用 / JSON 解析失败）→ 硬失败，绝不静默空跑\n *\n * 凭据：pnpm-audit 不需要 GitHub token（本地命令）；但保留 `requireToken()`\n * 调用与其它 tool 一致（保持 pattern 统一，未来如需 pnpm registry token 可扩展）。\n *\n * @param input.workDir 本地仓库工作目录（包含 pnpm-lock.yaml）\n * @param input.repository 仓库标识（owner/repo 或 local 兜底；与 CLI --repo 同源语义）\n */\nexport const pnpmAudit = async (input: FetchPnpmAuditAlertsParams): Promise<PnpmAuditResult> => {\n    const token = requireToken()\n    if (typeof token !== 'string') {\n        return token\n    }\n\n    try {\n        const normalizedAlerts = await fetchPnpmAuditAlerts(input)\n        return {\n            ok: true,\n            count: normalizedAlerts.length,\n            workDir: input.workDir,\n            repository: input.repository,\n            alerts: normalizedAlerts.map((a) => ({\n                id: a.id,\n                severity: a.severity,\n                packageName: a.packageName,\n                manifestPath: a.manifestPath,\n                recommendedVersion: a.recommendedVersion,\n                fixable: a.fixable,\n                htmlUrl: a.htmlUrl,\n                summary: a.summary,\n            })),\n        }\n    } catch (error) {\n        return toToolError(error)\n    }\n}\n","import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'\nimport { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'\nimport { fetchAlertsSchema, getLastReportSchema, runScanSchema, fixDependencySchema, discoverReposSchema, cleanupBranchesSchema, historySchema, pnpmAuditSchema } from './tools/schemas'\nimport { fetchAlerts } from './tools/fetch-alerts'\nimport { getLastReport } from './tools/get-last-report'\nimport { runScan } from './tools/run-scan'\nimport { fixDependency } from './tools/fix-dependency'\nimport { discoverRepos } from './tools/discover-repos'\nimport { cleanupBranches } from './tools/cleanup-branches'\nimport { getHistory } from './tools/history'\nimport { pnpmAudit } from './tools/pnpm-audit.tool'\n\n/**\n * dependfix MCP Server：向 AI 助手暴露 7 个 tool。\n * - fetch_alerts（只读）：拉取 Dependabot / Code Scanning 告警\n * - get_last_report（只读）：读取最近 JSON 报告\n * - run_scan（写入）：执行扫描/修复（默认 report-only；支持 AI 研判透传）\n * - fix_dependency（写入）：修复单个依赖（override / direct / lockfile）\n * - discover_repos（只读）：按 owner / org 自动发现仓库\n * - cleanup_branches（写入）：清理已合并/已关闭的 dependfix 分支（非交互）\n * - history（只读）：查询仓库历史运行摘要\n * 凭据从 GITHUB_TOKEN 环境变量读取（mcp-server.md §4.3）。\n */\nexport const createMcpServer = (): McpServer => {\n    const server = new McpServer({\n        name: 'dependfix',\n        version: '0.1.0',\n    })\n\n    server.registerTool(\n        'fetch_alerts',\n        {\n            description: '拉取指定仓库的 Dependabot 安全告警（可选并行 Code Scanning，只读）',\n            inputSchema: fetchAlertsSchema,\n        },\n        async (input) => {\n            const result = await fetchAlerts(input)\n            return {\n                content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],\n            }\n        },\n    )\n\n    server.registerTool(\n        'get_last_report',\n        {\n            description: '读取最近一次 dependfix JSON 报告（只读）',\n            inputSchema: getLastReportSchema,\n        },\n        async () => {\n            const result = await getLastReport()\n            return {\n                content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],\n            }\n        },\n    )\n\n    server.registerTool(\n        'run_scan',\n        {\n            description: '对目标仓库执行 dependfix 扫描并修复（默认 report-only；支持 code-scanning / AI 研判等参数）',\n            inputSchema: runScanSchema,\n        },\n        async (input) => {\n            const result = await runScan(input)\n            return {\n                content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],\n            }\n        },\n    )\n\n    server.registerTool(\n        'fix_dependency',\n        {\n            description: '修复单个依赖或 lockfile（override / direct / lockfile；需要本地已 clone 仓库目录）',\n            inputSchema: fixDependencySchema,\n        },\n        async (input) => {\n            const result = await fixDependency(input)\n            return {\n                content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],\n            }\n        },\n    )\n\n    server.registerTool(\n        'discover_repos',\n        {\n            description: '按 owner / org 自动发现仓库（支持 topics / include / exclude 名单策略，只读）',\n            inputSchema: discoverReposSchema,\n        },\n        async (input) => {\n            const result = await discoverRepos(input)\n            return {\n                content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],\n            }\n        },\n    )\n\n    server.registerTool(\n        'cleanup_branches',\n        {\n            description: '清理已合并/已关闭的 dependfix 分支（非交互；只删 dependfix/ 前缀且 merged/closed，绝不触碰 open PR 分支）',\n            inputSchema: cleanupBranchesSchema,\n        },\n        async (input) => {\n            const result = await cleanupBranches(input)\n            return {\n                content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],\n            }\n        },\n    )\n\n    server.registerTool(\n        'history',\n        {\n            description: '查询指定仓库的历史运行摘要（倒序时间，只读）',\n            inputSchema: historySchema,\n        },\n        async (input) => {\n            const result = await getHistory(input)\n            return {\n                content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],\n            }\n        },\n    )\n\n    server.registerTool(\n        'pnpm_audit',\n        {\n            description: '本地 pnpm audit 回退数据源（无需 GitHub token；audit 失败硬返回错误）',\n            inputSchema: pnpmAuditSchema,\n        },\n        async (input) => {\n            const result = await pnpmAudit(input)\n            return {\n                content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],\n            }\n        },\n    )\n\n    return server\n}\n\n/** 连接 stdio 传输（bin 入口调用） */\nexport const connectStdio = async (): Promise<void> => {\n    const server = createMcpServer()\n    const transport = new StdioServerTransport()\n    await server.connect(transport)\n}\n"],"mappings":";;;;;;;;;;AAOA,MAAM,iBAAiB,cAAc,QAAQ,MAAM,MAAM,kBAAkB;;AAG3E,MAAa,oBAAoB,EAAE,OAAO;CACtC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,oBAAoB;CAC9C,UAAU,EAAE,KAAK,mBAAmB,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,SAAS,0CAA0C;CACzG,eAAe,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,0EAA0E;AAC7H,CAAC;;AAGD,MAAa,sBAAsB,EAAE,OAAO,CAAC,CAAC;;AAG9C,MAAa,gBAAgB,EAAE,OAAO;CAClC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,oBAAoB;CAC9C,MAAM,EAAE,KAAK,cAAc,CAAC,CAAC,QAAQ,aAAa,CAAC,CAAC,SAAS,aAAa;CAC1E,UAAU,EAAE,KAAK,mBAAmB,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,SAAS,QAAQ;CACvE,eAAe,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,iCAAiC;CAChF,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,oBAAoB;CACtF,iBAAiB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,oBAAoB;CACzF,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,8EAA8E;CACvH,qBAAqB,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,wDAAwD;CAC7G,YAAY,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,uFAAuF;CACnI,aAAa,EAAE,KAAK,CAAC,qBAAqB,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,8BAA8B;CAC1G,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,8BAA8B;CACvE,YAAY,EAAE,KAAK;EAAC;EAAW;EAAS;CAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,kBAAkB;AAC3F,CAAC;;AAGD,MAAa,sBAAsB,EAAE,OAAO;;CAExC,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS,oDAAoD;;CAEjF,UAAU,EAAE,KAAK;EAAC;EAAY;EAAU;CAAU,CAAC,CAAC,CAAC,QAAQ,UAAU,CAAC,CAAC,SAAS,mBAAmB;;CAErG,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,mCAAmC;;CAE/E,eAAe,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,+CAA+C;AACjG,CAAC;;AAGD,MAAa,sBAAsB,EAAE,OAAO;CACxC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,yBAAyB;CACpE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,mCAAmC;CACnF,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,mCAAmC;CACpF,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,6BAA6B;CAC9E,kBAAkB,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,2DAA2D;CAC7G,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,iCAAiC;AAC5F,CAAC;;AAGD,MAAa,wBAAwB,EAAE,OAAO;CAC1C,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,oBAAoB;CAC9C,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,0BAA0B;AACvE,CAAC;;AAGD,MAAa,gBAAgB,EAAE,OAAO,EAClC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,oBAAoB,EAClD,CAAC;;AAGD,MAAa,kBAAkB,EAAE,OAAO;;CAEpC,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS,qCAAqC;;CAElE,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS,yEAAyE;AAC7G,CAAC;;;;ACjED,MAAa,qBAAyC;CAClD,MAAM,QAAQ,QAAQ,IAAI;CAC1B,IAAI,CAAC,OACD,OAAO;EAAE,IAAI;EAAO,OAAO;CAAgC;CAE/D,OAAO;AACX;AAEA,MAAa,eAAe,WAA+B;CACvD,IAAI;CACJ,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAChE;;;;;;;;ACOA,MAAa,cAAc,OAAO,UAA8G;CAC5I,MAAM,QAAQ,aAAa;CAC3B,IAAI,OAAO,UAAU,UACjB,OAAO;CAIX,IAAI,CAAC,sBAAsB,MAAM,IAAI,GACjC,OAAO;EAAE,IAAI;EAAO,OAAO,8BAA8B,MAAM,KAAK;CAAG;CAE3E,MAAM,CAAC,OAAO,QAAQ,MAAM,KAAK,MAAM,GAAG;CAE1C,IAAI;EACA,MAAM,SAAS,mBAAmB,EAAE,MAAM,QAAQ,KAAK,EAAE,CAAC;EAC1D,MAAM,SAAsC;GACxC;GACA;GACA,OAAO;EACX;EAKA,MAAM,sBAAsB,MAAM,iBAAiB;EACnD,MAAM,CAAC,kBAAkB,sBAAsB,MAAM,QAAQ,IAAI,CAC7D,sBAAsB,QAAQ,MAAM,GACpC,sBACM,wBAAwB,QAAQ;GAAE;GAAO;EAAK,CAAC,IAC/C,QAAQ,QAAQ,CAAC,CAAsD,CACjF,CAAC;EACD,MAAM,SAAS,CAAC,GAAG,kBAAkB,GAAG,kBAAkB;EAI1D,MAAM,EAAE,aAAa,aAAa,QAAQ,EAAE,mBAAmB,MAAM,SAAS,CAAC;EAE/E,OAAO;GACH,IAAI;GACJ,OAAO,SAAS;GAChB,QAAQ,SAAS,KAAK,OAAO;IACzB,IAAI,EAAE;IACN,UAAU,EAAE;IACZ,aAAa,EAAE;IACf,cAAc,EAAE;IAChB,oBAAoB,EAAE;IACtB,SAAS,EAAE;IACX,SAAS,EAAE;IACX,SAAS,EAAE;GACf,EAAE;EACN;CACJ,SAAS,OAAO;EACZ,OAAO,YAAY,KAAK;CAC5B;AACJ;;;;;;;;ACnEA,MAAa,gBAAgB,YAA0C;CACnE,MAAM,YAAY,QAAQ,IAAI,4BAA4B;CAC1D,IAAI;EACA,MAAM,QAAQ,YAAY,SAAS,CAAC,CAC/B,QAAQ,MAAM,EAAE,SAAS,OAAO,CAAC,CAAC,CAClC,KAAK;EACV,IAAI,MAAM,WAAW,GACjB,OAAO;GAAE,IAAI;GAAO,OAAO,YAAY,UAAU;EAAM;EAE3D,MAAM,SAAS,MAAM,MAAM,SAAS;EACpC,MAAM,UAAU,aAAa,KAAK,WAAW,MAAM,GAAG,OAAO;EAC7D,OAAO;GACH,IAAI;GACJ,MAAM;GACN,QAAQ,KAAK,MAAM,OAAO;EAC9B;CACJ,SAAS,OAAO;EACZ,OAAO,YAAY,KAAK;CAC5B;AACJ;;;;;;;;ACQA,MAAa,UAAU,OAAO,UAaA;CAC1B,MAAM,QAAQ,aAAa;CAC3B,IAAI,OAAO,UAAU,UACjB,OAAO;CAIX,IAAI,CAAC,sBAAsB,MAAM,IAAI,GACjC,OAAO;EAAE,IAAI;EAAO,OAAO,8BAA8B,MAAM,KAAK;CAAG;CAE3E,MAAM,CAAC,OAAO,QAAQ,MAAM,KAAK,MAAM,GAAG;CAI1C,MAAM,YAAY,uBAAuB;CACzC,MAAM,SAAwB;EAC1B,GAAG;EACH,MAAM,MAAM;EACZ,mBAAmB,MAAM;EACzB,cAAc,CAAC,GAAG,MAAM,GAAG,MAAM;EAEjC,QAAQ,MAAM,WAAY,MAAM,SAAS;EACzC,mBAAmB,MAAM,SAAS;EAClC,QAAQ,MAAM,SAAS;EACvB,iBAAiB;EACjB,qBAAqB;EACrB,aAAa;EACb,qBAAqB,MAAM,iBAAiB,uBAAuB;EACnE,mBAAmB,MAAM,uBAAuB,uBAAuB;EACvE,wBAAwB,MAAM,cAAc,uBAAuB;EACnE,gBAAgB,MAAM,mBAAmB,uBAAuB;EAKhE,IAAI,MAAM,cAAc,YAClB;GACE,GAAG;GACH,SAAS;GACT,UAAU,MAAM,eAAe,UAAU;GACzC,OAAO,MAAM,YAAY,UAAU;GACnC,SAAS,MAAM,cAAc,UAAU;GACvC,QAAQ,QAAQ,IAAI;EACxB,IACE;CACV;CAEA,IAAI;EAMA,MAAM,EAAE,QAAQ,aAAa,MAAM,IALnB,aAAa;GACzB;GACA,SAAS,QAAQ,IAAI;GACrB,iBAAiB,QAAQ,IAAI,4BAA4B;EAC7D,CACqC,CAAC,CAAC,IAAI;EAE3C,OAAO;GACH,IAAI;GACJ;GACA,OAAO,OAAO;GACd,SAAS,OAAO;GAChB,cAAc,OAAO,aAAa,KAAK,OAAO;IAC1C,YAAY,EAAE;IACd,aAAa,EAAE;IACf,SAAS,EAAE;IACX,OAAO,EAAE;IACT,QAAQ,EAAE;IACV,kBAAkB,EAAE;IACpB,oBAAoB,EAAE,sBAAsB;IAC5C,YAAY,EAAE;GAClB,EAAE;GACF,QAAQ,OAAO,OAAO,KAAK,OAAO;IAC9B,YAAY,EAAE;IACd,OAAO,EAAE;IACT,UAAU,EAAE;IACZ,SAAS,EAAE;GACf,EAAE;GACF,WAAW,OAAO;GAClB,YAAY,OAAO;GACnB,QAAQ,OAAO;GACf,QAAQ,OAAO;GACf,SAAS,OAAO;EACpB;CACJ,SAAS,OAAO;EACZ,OAAO,YAAY,KAAK;CAC5B;AACJ;;;;;;;;;;;ACnGA,MAAa,gBAAgB,OAAO,UAKA;CAChC,MAAM,UAAU,MAAM,YAAY;CAClC,IAAI;EACA,QAAQ,SAAR;GACI,KAAK,YAAY;IACb,MAAM,SAAS,eAAe,EAAE,SAAS,MAAM,QAAQ,CAAC;IACxD,IAAI,OAAO,SACP,OAAO;KACH,IAAI;KACJ,SAAS;KACT,UAAU,OAAO;KACjB,MAAM,OAAO,QAAQ;KACrB,iBAAiB,OAAO;KACxB,wBAAwB,OAAO;IACnC;IAEJ,OAAO;KACH,IAAI;KACJ,SAAS;KACT,OAAO,OAAO,iBAAiB;IACnC;GACJ;GACA,KAAK,UAAU;IACX,IAAI,CAAC,MAAM,eAAe,CAAC,MAAM,eAC7B,OAAO;KAAE,IAAI;KAAO,SAAS;KAAU,OAAO;IAAkD;IAEpG,MAAM,SAAS,MAAM,kBAAkB;KACnC,aAAa,MAAM;KACnB,eAAe,MAAM;KACrB,SAAS,MAAM;IACnB,CAAC;IACD,IAAI,OAAO,SACP,OAAO;KACH,IAAI;KACJ,SAAS;KACT,aAAa,OAAO;KACpB,aAAa,OAAO;KACpB,WAAW,OAAO;KAClB,SAAS,OAAO;KAChB,SAAS,OAAO;IACpB;IAEJ,OAAO;KACH,IAAI;KACJ,SAAS;KACT,aAAa,OAAO;KACpB,aAAa,OAAO;KACpB,WAAW,OAAO;KAClB,SAAS,OAAO;KAChB,OAAO,OAAO,SAAS;IAC3B;GACJ;GACA,KAAK,YAAY;IACb,IAAI,CAAC,MAAM,eAAe,CAAC,MAAM,eAC7B,OAAO;KAAE,IAAI;KAAO,SAAS;KAAY,OAAO;IAAoD;IAExG,MAAM,SAAS,MAAM,6BAA6B;KAC9C,aAAa,MAAM;KACnB,eAAe,MAAM;KACrB,SAAS,MAAM;IACnB,CAAC;IACD,IAAI,OAAO,SACP,OAAO;KACH,IAAI;KACJ,SAAS;KACT,aAAa,OAAO;KACpB,aAAa,OAAO;KACpB,WAAW,OAAO;KAClB,SAAS,OAAO;KAChB,SAAS,OAAO;IACpB;IAEJ,OAAO;KACH,IAAI;KACJ,SAAS;KACT,aAAa,OAAO;KACpB,aAAa,OAAO;KACpB,WAAW,OAAO;KAClB,SAAS,OAAO;KAChB,OAAO,OAAO,SAAS;IAC3B;GACJ;EACJ;CACJ,SAAS,OAAO;EACZ,OAAO;GACH,IAAI;GACJ;GACA,OAAO,YAAY,KAAK,CAAC,CAAC;EAC9B;CACJ;AACJ;;;;;;;;;AC/GA,MAAa,gBAAgB,OAAO,UAOA;CAChC,MAAM,QAAQ,aAAa;CAC3B,IAAI,OAAO,UAAU,UACjB,OAAO;CAEX,IAAI,MAAM,MAAM,WAAW,GACvB,OAAO;EAAE,IAAI;EAAO,OAAO;CAA2B;CAG1D,IAAI;EACA,MAAM,SAAS,mBAAmB,EAAE,MAAM,QAAQ,KAAK,EAAE,CAAC;EAC1D,MAAM,SAAqB;GACvB,SAAS,MAAM,WAAW,MAAM,QAAQ,SAAS,IAAI,MAAM,UAAU;GACrE,SAAS,MAAM,WAAW,MAAM,QAAQ,SAAS,IAAI,MAAM,UAAU;EACzE;EACA,MAAM,QAAQ,MAAM,qBAAqB;GACrC;GACA,QAAQ,MAAM;GACd,QAAQ,MAAM;GACd;GACA,iBAAiB,MAAM,oBAAoB;GAC3C,UAAU,MAAM;EACpB,CAAC;EACD,OAAO;GACH,IAAI;GACJ,OAAO,MAAM;GACb,cAAc,MAAM,KAAK,OAAO;IAC5B,UAAU,EAAE;IACZ,eAAe,EAAE;IACjB,QAAQ,EAAE;IACV,qBAAqB,EAAE;GAC3B,EAAE;EACN;CACJ,SAAS,OAAO;EACZ,OAAO,YAAY,KAAK;CAC5B;AACJ;;;;;;;;;;;;;;;;AClCA,MAAa,kBAAkB,OAAO,UAA+E;CACjH,MAAM,QAAQ,aAAa;CAC3B,IAAI,OAAO,UAAU,UACjB,OAAO;CAEX,IAAI,CAAC,sBAAsB,MAAM,IAAI,GACjC,OAAO;EAAE,IAAI;EAAO,OAAO,8BAA8B,MAAM,KAAK;CAAG;CAE3E,MAAM,CAAC,OAAO,QAAQ,MAAM,KAAK,MAAM,GAAG;CAC1C,MAAM,SAAS,MAAM,WAAW;CAEhC,IAAI;EACA,MAAM,SAAS,mBAAmB,EAAE,MAAM,QAAQ,KAAK,EAAE,CAAC;EAC1D,MAAM,WAAW,MAAM,sBAAsB,QAAQ,OAAO,IAAI;EAChE,MAAM,WAAW,MAAM,QAAQ,IAC3B,SAAS,KAAK,WAAW,kBAAkB,QAAQ,OAAO,MAAM,MAAM,CAAC,CAC3E;EAEA,MAAM,SAAS,SAAS,QAAQ,MAAM,EAAE,MAAM;EAC9C,MAAM,WAAW,SAAS,QAAQ,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;EAC7D,MAAM,OAAO,SAAS,QAAQ,MAAM,CAAC,EAAE,MAAM;EAC7C,MAAM,aAAa,CAAC,GAAG,QAAQ,GAAG,QAAQ;EAE1C,IAAI,QACA,OAAO;GACH,IAAI;GACJ,QAAQ;GACR,SAAS;GACT,SAAS,CAAC;GACV,MAAM,KAAK,KAAK,MAAM,EAAE,MAAM;GAC9B,QAAQ,CAAC;EACb;EAGJ,MAAM,UAAoB,CAAC;EAC3B,MAAM,SAAmB,CAAC;EAC1B,KAAK,MAAM,KAAK,YACZ,IAAI;GACA,MAAM,mBAAmB,QAAQ,OAAO,MAAM,EAAE,MAAM;GACtD,QAAQ,KAAK,EAAE,MAAM;EACzB,QAAQ;GAEJ,OAAO,KAAK,EAAE,MAAM;EACxB;EAGJ,OAAO;GACH,IAAI;GACJ,QAAQ;GACR,SAAS;GACT;GACA,MAAM,KAAK,KAAK,MAAM,EAAE,MAAM;GAC9B;EACJ;CACJ,SAAS,OAAO;EACZ,OAAO,YAAY,KAAK;CAC5B;AACJ;;;;;;;;;AChEA,MAAa,aAAa,OAAO,UAAoD;CACjF,IAAI,CAAC,sBAAsB,MAAM,IAAI,GACjC,OAAO;EAAE,IAAI;EAAO,OAAO,8BAA8B,MAAM,KAAK;CAAG;CAE3E,IAAI;EACA,MAAM,YAAY,QAAQ,IAAI,4BAA4B;EAC1D,MAAM,UAAU,iBAAiB,MAAM,MAAM,SAAS;EACtD,OAAO;GACH,IAAI;GACJ,MAAM,MAAM;GACZ,MAAM,QAAQ,KAAK,OAAO;IACtB,OAAO,EAAE;IACT,WAAW,EAAE;IACb,YAAY,EAAE;IACd,cAAc,EAAE;IAEhB,SAAS,EAAE;IACX,WAAW,EAAE;GACjB,EAAE;EACN;CACJ,SAAS,OAAO;EACZ,OAAO,YAAY,KAAK;CAC5B;AACJ;;;;;;;;;;;;;;;;;;ACFA,MAAa,YAAY,OAAO,UAAgE;CAC5F,MAAM,QAAQ,aAAa;CAC3B,IAAI,OAAO,UAAU,UACjB,OAAO;CAGX,IAAI;EACA,MAAM,mBAAmB,MAAM,qBAAqB,KAAK;EACzD,OAAO;GACH,IAAI;GACJ,OAAO,iBAAiB;GACxB,SAAS,MAAM;GACf,YAAY,MAAM;GAClB,QAAQ,iBAAiB,KAAK,OAAO;IACjC,IAAI,EAAE;IACN,UAAU,EAAE;IACZ,aAAa,EAAE;IACf,cAAc,EAAE;IAChB,oBAAoB,EAAE;IACtB,SAAS,EAAE;IACX,SAAS,EAAE;IACX,SAAS,EAAE;GACf,EAAE;EACN;CACJ,SAAS,OAAO;EACZ,OAAO,YAAY,KAAK;CAC5B;AACJ;;;;;;;;;;;;;;;AClDA,MAAa,wBAAmC;CAC5C,MAAM,SAAS,IAAI,UAAU;EACzB,MAAM;EACN,SAAS;CACb,CAAC;CAED,OAAO,aACH,gBACA;EACI,aAAa;EACb,aAAa;CACjB,GACA,OAAO,UAAU;EACb,MAAM,SAAS,MAAM,YAAY,KAAK;EACtC,OAAO,EACH,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC;EAAE,CAAC,EACrE;CACJ,CACJ;CAEA,OAAO,aACH,mBACA;EACI,aAAa;EACb,aAAa;CACjB,GACA,YAAY;EACR,MAAM,SAAS,MAAM,cAAc;EACnC,OAAO,EACH,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC;EAAE,CAAC,EACrE;CACJ,CACJ;CAEA,OAAO,aACH,YACA;EACI,aAAa;EACb,aAAa;CACjB,GACA,OAAO,UAAU;EACb,MAAM,SAAS,MAAM,QAAQ,KAAK;EAClC,OAAO,EACH,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC;EAAE,CAAC,EACrE;CACJ,CACJ;CAEA,OAAO,aACH,kBACA;EACI,aAAa;EACb,aAAa;CACjB,GACA,OAAO,UAAU;EACb,MAAM,SAAS,MAAM,cAAc,KAAK;EACxC,OAAO,EACH,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC;EAAE,CAAC,EACrE;CACJ,CACJ;CAEA,OAAO,aACH,kBACA;EACI,aAAa;EACb,aAAa;CACjB,GACA,OAAO,UAAU;EACb,MAAM,SAAS,MAAM,cAAc,KAAK;EACxC,OAAO,EACH,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC;EAAE,CAAC,EACrE;CACJ,CACJ;CAEA,OAAO,aACH,oBACA;EACI,aAAa;EACb,aAAa;CACjB,GACA,OAAO,UAAU;EACb,MAAM,SAAS,MAAM,gBAAgB,KAAK;EAC1C,OAAO,EACH,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC;EAAE,CAAC,EACrE;CACJ,CACJ;CAEA,OAAO,aACH,WACA;EACI,aAAa;EACb,aAAa;CACjB,GACA,OAAO,UAAU;EACb,MAAM,SAAS,MAAM,WAAW,KAAK;EACrC,OAAO,EACH,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC;EAAE,CAAC,EACrE;CACJ,CACJ;CAEA,OAAO,aACH,cACA;EACI,aAAa;EACb,aAAa;CACjB,GACA,OAAO,UAAU;EACb,MAAM,SAAS,MAAM,UAAU,KAAK;EACpC,OAAO,EACH,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC;EAAE,CAAC,EACrE;CACJ,CACJ;CAEA,OAAO;AACX;;AAGA,MAAa,eAAe,YAA2B;CACnD,MAAM,SAAS,gBAAgB;CAC/B,MAAM,YAAY,IAAI,qBAAqB;CAC3C,MAAM,OAAO,QAAQ,SAAS;AAClC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dependfix/mcp",
-  "version": "0.1.2",
-  "description": "MCP Server for dependfix: expose scan/fix capabilities to AI assistants",
+  "version": "0.2.0",
+  "description": "dependfix MCP 服务：向 AI 助手暴露扫描/修复能力（stdio）",
   "author": "CaoMeiYouRen",
   "license": "MIT",
   "type": "module",
@@ -42,14 +42,14 @@
   ],
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "zod": "^4.4.3",
-    "@dependfix/engine": "0.1.3",
-    "@dependfix/core": "0.2.1"
+    "zod": "^4.6.1",
+    "@dependfix/core": "0.5.0",
+    "@dependfix/engine": "0.4.0"
   },
   "devDependencies": {
     "nock": "^14.0.17",
     "rimraf": "^6.1.3",
-    "tsdown": "^0.22.14",
+    "tsdown": "^0.23.0",
     "typescript": "^6.0.3"
   },
   "publishConfig": {