@homenshum/convex-mcp-nodebench 0.9.4 → 0.9.5

package/dist/index.js

@@ -79,7 +79,7 @@ for (const tool of ALL_TOOLS) {
 // ── Server setup ────────────────────────────────────────────────────
 const server = new Server({
     name: "convex-mcp-nodebench",
-    version: "0.9.4",
+    version: "0.9.5",
 }, {
     capabilities: {
         tools: {},

package/dist/tools/actionAuditTools.js

@@ -72,7 +72,10 @@ function auditActions(convexDir) {
             }
             const body = lines.slice(startLine, endLine).join("\n");
             // Check 1: ctx.db access in action (FATAL — not allowed)
-            if (/ctx\.db\.(get|query|insert|patch|replace|delete)\s*\(/.test(body)) {
+            // BUT: skip if ctx.db is inside an inline ctx.runMutation/ctx.runQuery callback
+            // e.g. ctx.runMutation(async (ctx) => { ctx.db.patch(...) }) — the inner ctx is a mutation context
+            const hasInlineCallback = /ctx\.run(Mutation|Query)\s*\(\s*async\s*\(/.test(body);
+            if (/ctx\.db\.(get|query|insert|patch|replace|delete)\s*\(/.test(body) && !hasInlineCallback) {
                 actionsWithDbAccess++;
                 issues.push({
                     severity: "critical",

package/dist/tools/authorizationTools.js

@@ -81,7 +81,8 @@ function auditAuthorization(convexDir) {
                     const identityAssign = body.match(/(?:const|let)\s+(\w+)\s*=\s*await\s+ctx\.auth\.getUserIdentity\s*\(\s*\)/);
                     if (identityAssign) {
                         const varName = identityAssign[1];
-                        const hasNullCheck = new RegExp(`if\\s*\\(\\s*!${varName}\\b|if\\s*\\(\\s*${varName}\\s*===?\\s*null|if\\s*\\(\\s*!${varName}\\s*\\)`).test(body);
+                        // Recognize: if (!var), if (var === null), if (var), var &&, var ?, throw on !var
+                        const hasNullCheck = new RegExp(`if\\s*\\(\\s*!${varName}\\b|if\\s*\\(\\s*${varName}\\s*===?\\s*null|if\\s*\\(\\s*${varName}\\s*\\)|${varName}\\s*&&|${varName}\\s*\\?|throw.*!${varName}|${varName}\\s*!==?\\s*null`).test(body);
                         if (!hasNullCheck) {
                             uncheckedIdentity++;
                             issues.push({
@@ -97,7 +98,8 @@ function auditAuthorization(convexDir) {
                     const authUserAssign = body.match(/(?:const|let)\s+(\w+)\s*=\s*await\s+getAuthUserId\s*\(/);
                     if (authUserAssign) {
                         const varName = authUserAssign[1];
-                        const hasNullCheck = new RegExp(`if\\s*\\(\\s*!${varName}\\b|if\\s*\\(\\s*${varName}\\s*===?\\s*null|throw.*!${varName}`).test(body);
+                        // Recognize: if (!var), if (var === null), if (var), var &&, var ?, throw on !var
+                        const hasNullCheck = new RegExp(`if\\s*\\(\\s*!${varName}\\b|if\\s*\\(\\s*${varName}\\s*===?\\s*null|if\\s*\\(\\s*${varName}\\s*\\)|${varName}\\s*&&|${varName}\\s*\\?|throw.*!${varName}|${varName}\\s*!==?\\s*null`).test(body);
                         if (!hasNullCheck) {
                             uncheckedIdentity++;
                             issues.push({

package/dist/tools/qualityGateTools.js

@@ -77,17 +77,18 @@ function runQualityGate(projectDir, thresholds) {
         }
         catch { /* skip */ }
     }
-    // Check 4: Type safety (as any casts)
+    // Check 4: Type safety (as any casts) — exclude test/eval files
     const typeSafety = getLatest("type_safety");
     if (typeSafety) {
         try {
             const issues = JSON.parse(typeSafety.issues_json);
-            const asAnyIssues = Array.isArray(issues)
-                ? issues.filter((i) => i.message?.includes("as any")).length
-                : 0;
+            // Exclude test, eval, benchmark, and fixture files from production quality gate
+            const testEvalPattern = /test|__tests__|spec|\.test\.|\.spec\.|fixtures|mocks|evaluation|liveEval|liveApiSmoke|benchmark|calibration|harness|quickTest|comprehensiveTest|comprehensiveEval/i;
             // Each as-any issue represents a FILE, count from message for actual number
             const actualCasts = Array.isArray(issues)
                 ? issues.reduce((sum, i) => {
+                    if (testEvalPattern.test(i.location ?? ""))
+                        return sum; // skip test/eval files
                     const countMatch = i.message?.match(/(\d+)\s+`as any`/);
                     return sum + (countMatch ? parseInt(countMatch[1], 10) : 0);
                 }, 0)
@@ -102,13 +103,13 @@ function runQualityGate(projectDir, thresholds) {
         }
         catch { /* skip */ }
     }
-    // Check 5: Unbounded collects
+    // Check 5: Unbounded collects (only warning-level — indexed collects are downgraded to info)
     const queryEfficiency = getLatest("query_efficiency");
     if (queryEfficiency) {
         try {
             const issues = JSON.parse(queryEfficiency.issues_json);
             const unbounded = Array.isArray(issues)
-                ? issues.filter((i) => i.message?.includes(".collect()")).length
+                ? issues.filter((i) => i.severity === "warning" && i.message?.includes(".collect()")).length
                 : 0;
             checks.push({
                 metric: "unbounded_collects",

package/dist/tools/queryEfficiencyTools.js

@@ -63,13 +63,16 @@ function auditQueryEfficiency(convexDir) {
                 const chain = lines.slice(chainStart, i + 1).join("\n");
                 if (!/\.take\s*\(/.test(chain) && !/\.paginate\s*\(/.test(chain)) {
                     collectWithoutLimit++;
-                    // Check if it's a bounded table or could be large
                     const tableMatch = chain.match(/\.query\s*\(\s*["'](\w+)["']\s*\)/);
+                    // Indexed queries are bounded by the index range — lower severity
+                    const hasIndex = /\.withIndex\s*\(/.test(chain);
                     issues.push({
-                        severity: "warning",
+                        severity: hasIndex ? "info" : "warning",
                         location: `${relativePath}:${i + 1}`,
                         message: `.collect() without .take() limit${tableMatch ? ` on table "${tableMatch[1]}"` : ""}. Could return entire table.`,
-                        fix: "Add .take(N) before .collect(), or use .paginate() for large result sets",
+                        fix: hasIndex
+                            ? "Consider adding .take(N) for predictable result sizes, even with index filtering"
+                            : "Add .take(N) before .collect(), or use .paginate() for large result sets",
                     });
                 }
             }

package/dist/tools/reportingTools.js

@@ -75,7 +75,7 @@ function buildSarif(projectDir, auditTypes, limit) {
                 tool: {
                     driver: {
                         name: "convex-mcp-nodebench",
-                        version: "0.9.4",
+                        version: "0.9.5",
                         informationUri: "https://www.npmjs.com/package/@homenshum/convex-mcp-nodebench",
                         rules: [...rulesMap.values()],
                     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homenshum/convex-mcp-nodebench",
-  "version": "0.9.4",
+  "version": "0.9.5",
   "description": "Convex-specific MCP server applying NodeBench self-instruct diligence patterns to Convex development. Schema audit, function compliance, deployment gates, persistent gotcha DB, and methodology guidance. Complements Context7 (raw docs) and official Convex MCP (deployment introspection) with structured verification workflows.",
   "type": "module",
   "bin": {