@luckychen1993/pm-mcp 0.1.1

package/dist/language-dependencies.js

@@ -0,0 +1,351 @@
+import fs from "node:fs";
+import path from "node:path";
+function result() {
+    return { dependencies: [], dependencyErrors: [] };
+}
+function ref(manifest, parser, confidence, name, version, scope) {
+    return { name: name.trim(), version: version.trim() || "*", scope, sourceManifest: manifest.path, parser, confidence };
+}
+function error(manifest, parser, message, line) {
+    return { sourceManifest: manifest.path, parser, message, ...(line === undefined ? {} : { line }) };
+}
+function readJson(file) {
+    const value = JSON.parse(fs.readFileSync(file, "utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("JSON root is not an object");
+    return value;
+}
+function nodeDependencies(manifest) {
+    const parser = "package-json", out = result();
+    let pkg;
+    try {
+        pkg = readJson(manifest.path);
+    }
+    catch (cause) {
+        out.dependencyErrors.push(error(manifest, parser, `invalid package.json: ${cause instanceof Error ? cause.message : String(cause)}`));
+        return out;
+    }
+    const sections = [
+        ["dependencies", "runtime"], ["devDependencies", "development"],
+        ["optionalDependencies", "optional"], ["peerDependencies", "peer"],
+    ];
+    for (const [section, scope] of sections) {
+        const value = pkg[section];
+        if (value === undefined)
+            continue;
+        if (!value || typeof value !== "object" || Array.isArray(value)) {
+            out.dependencyErrors.push(error(manifest, parser, `${section} must be an object`));
+            continue;
+        }
+        for (const [name, version] of Object.entries(value)) {
+            if (!name.trim() || typeof version !== "string" || !version.trim()) {
+                out.dependencyErrors.push(error(manifest, parser, `cannot parse ${section} entry ${name || "<empty>"}`));
+            }
+            else
+                out.dependencies.push(ref(manifest, parser, 1, name, version, scope));
+        }
+    }
+    return out;
+}
+function pep508(value) {
+    const base = value.split(/\s*;\s*/, 1)[0].trim();
+    const direct = base.match(/^([A-Za-z0-9][A-Za-z0-9._-]*)(?:\[[^\]]+\])?\s*@\s*(\S.+)$/);
+    if (direct)
+        return { name: direct[1], version: `@ ${direct[2].trim()}` };
+    const match = base.match(/^([A-Za-z0-9][A-Za-z0-9._-]*)(?:\[[^\]]+\])?\s*((?:(?:===|==|~=|!=|<=|>=|<|>)\s*[^,\s]+(?:\s*,\s*)?)*)$/);
+    return match ? { name: match[1], version: match[2].replace(/\s+/g, "") || "*" } : null;
+}
+function requirementsDependencies(manifest) {
+    const parser = "requirements-regex", out = result();
+    const scope = /(?:dev|test)/i.test(path.basename(manifest.path)) ? "development" : "runtime";
+    fs.readFileSync(manifest.path, "utf8").split(/\r?\n/).forEach((raw, index) => {
+        const line = raw.replace(/\s+#.*$/, "").trim();
+        if (!line || line.startsWith("#") || line.startsWith("-"))
+            return;
+        const parsed = pep508(line);
+        if (parsed)
+            out.dependencies.push(ref(manifest, parser, 0.9, parsed.name, parsed.version, scope));
+        else
+            out.dependencyErrors.push(error(manifest, parser, "unparsed requirement entry", index + 1));
+    });
+    return out;
+}
+function tomlSections(text) {
+    const sections = [];
+    let current = { name: "", body: "", startLine: 1 };
+    for (const [index, line] of text.split(/\r?\n/).entries()) {
+        const header = line.match(/^\s*\[([^\]]+)\]\s*(?:#.*)?$/);
+        if (header) {
+            sections.push(current);
+            current = { name: header[1].trim(), body: "", startLine: index + 2 };
+        }
+        else
+            current.body += line + "\n";
+    }
+    sections.push(current);
+    return sections;
+}
+function stringArray(body, key) {
+    const escapedKey = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const start = new RegExp(`^\\s*${escapedKey}\\s*=\\s*\\[`, "m").exec(body);
+    if (!start)
+        return null;
+    const open = start.index + start[0].lastIndexOf("[");
+    let quote = "", escaped = false, close = -1;
+    for (let i = open + 1; i < body.length; i++) {
+        const char = body[i];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (quote === '"' && char === "\\") {
+            escaped = true;
+            continue;
+        }
+        if (char === '"' || char === "'") {
+            if (!quote)
+                quote = char;
+            else if (quote === char)
+                quote = "";
+            continue;
+        }
+        if (!quote && char === "]") {
+            close = i;
+            break;
+        }
+    }
+    if (close < 0)
+        return { values: [], malformed: true };
+    const inner = body.slice(open + 1, close), values = [];
+    const token = /"((?:\\.|[^"\\])*)"|'([^']*)'/g;
+    let match;
+    while ((match = token.exec(inner))) {
+        if (match[1] !== undefined) {
+            try {
+                values.push(JSON.parse(`"${match[1]}"`));
+            }
+            catch {
+                return { values, malformed: true };
+            }
+        }
+        else
+            values.push(match[2]);
+    }
+    const remainder = inner.replace(token, "").replace(/#.*$/gm, "").replace(/[\s,]/g, "");
+    return { values, malformed: Boolean(remainder) };
+}
+function pyprojectDependencies(manifest) {
+    const parser = "pyproject-toml-regex", out = result();
+    for (const section of tomlSections(fs.readFileSync(manifest.path, "utf8"))) {
+        if (section.name === "project") {
+            const array = stringArray(section.body, "dependencies");
+            if (!array)
+                continue;
+            if (array.malformed)
+                out.dependencyErrors.push(error(manifest, parser, "malformed project.dependencies array", section.startLine));
+            for (const item of array.values) {
+                const parsed = pep508(item);
+                if (parsed)
+                    out.dependencies.push(ref(manifest, parser, 0.9, parsed.name, parsed.version, "runtime"));
+                else
+                    out.dependencyErrors.push(error(manifest, parser, "unparsed project dependency", section.startLine));
+            }
+        }
+        else if (section.name === "project.optional-dependencies") {
+            const keys = [...section.body.matchAll(/^\s*([A-Za-z0-9_.-]+)\s*=\s*\[/gm)].map((match) => match[1]);
+            for (const key of keys) {
+                const array = stringArray(section.body, key);
+                if (array.malformed)
+                    out.dependencyErrors.push(error(manifest, parser, `malformed optional dependency group ${key}`, section.startLine));
+                for (const item of array.values) {
+                    const parsed = pep508(item);
+                    if (parsed)
+                        out.dependencies.push(ref(manifest, parser, 0.85, parsed.name, parsed.version, `optional:${key}`));
+                    else
+                        out.dependencyErrors.push(error(manifest, parser, `unparsed optional dependency in ${key}`, section.startLine));
+                }
+            }
+        }
+        else if (section.name === "tool.poetry.dependencies" || /^tool\.poetry\.group\.[^.]+\.dependencies$/.test(section.name)) {
+            const scope = section.name === "tool.poetry.dependencies" ? "runtime" : "development";
+            section.body.split(/\r?\n/).forEach((raw, offset) => {
+                const line = raw.replace(/\s+#.*$/, "").trim();
+                if (!line)
+                    return;
+                const entry = line.match(/^([A-Za-z0-9_.-]+)\s*=\s*(.+)$/);
+                if (!entry) {
+                    out.dependencyErrors.push(error(manifest, parser, "unparsed poetry dependency entry", section.startLine + offset));
+                    return;
+                }
+                if (entry[1].toLowerCase() === "python")
+                    return;
+                const scalar = entry[2].match(/^["']([^"']+)["']$/)?.[1];
+                const inline = entry[2].match(/\bversion\s*=\s*["']([^"']+)["']/)?.[1];
+                const name = entry[2].match(/\bpackage\s*=\s*["']([^"']+)["']/)?.[1] ?? entry[1];
+                if (scalar ?? inline)
+                    out.dependencies.push(ref(manifest, parser, 0.8, name, scalar ?? inline, scope));
+                else
+                    out.dependencyErrors.push(error(manifest, parser, `unparsed poetry dependency ${entry[1]}`, section.startLine + offset));
+            });
+        }
+    }
+    return out;
+}
+function goDependencies(manifest) {
+    const parser = "go-mod-regex", out = result();
+    let block = false;
+    fs.readFileSync(manifest.path, "utf8").split(/\r?\n/).forEach((raw, index) => {
+        const trimmed = raw.trim();
+        if (/^require\s*\($/.test(trimmed)) {
+            block = true;
+            return;
+        }
+        if (block && trimmed === ")") {
+            block = false;
+            return;
+        }
+        if (!trimmed || trimmed.startsWith("//"))
+            return;
+        const candidate = block ? trimmed : trimmed.startsWith("require ") ? trimmed.slice(8).trim() : "";
+        if (!candidate)
+            return;
+        const indirect = /\/\/\s*indirect\s*$/.test(candidate);
+        const match = candidate.replace(/\s*\/\/.*$/, "").trim().match(/^(\S+)\s+(\S+)$/);
+        if (match)
+            out.dependencies.push(ref(manifest, parser, 0.95, match[1], match[2], indirect ? "indirect" : "runtime"));
+        else
+            out.dependencyErrors.push(error(manifest, parser, "unparsed require entry", index + 1));
+    });
+    if (block)
+        out.dependencyErrors.push(error(manifest, parser, "unterminated require block"));
+    return out;
+}
+function cargoDependencies(manifest) {
+    const parser = "cargo-toml-regex", out = result();
+    for (const section of tomlSections(fs.readFileSync(manifest.path, "utf8"))) {
+        const suffix = section.name.match(/(?:^|\.)(dev-dependencies|build-dependencies|dependencies)$/)?.[1];
+        if (!suffix)
+            continue;
+        const scope = suffix === "dev-dependencies" ? "development" : suffix === "build-dependencies" ? "build" : "runtime";
+        section.body.split(/\r?\n/).forEach((raw, offset) => {
+            const line = raw.replace(/\s+#.*$/, "").trim();
+            if (!line)
+                return;
+            const entry = line.match(/^["']?([^"'=\s]+)["']?\s*=\s*(.+)$/);
+            if (!entry) {
+                out.dependencyErrors.push(error(manifest, parser, "unparsed dependency entry", section.startLine + offset));
+                return;
+            }
+            const scalar = entry[2].match(/^["']([^"']+)["']$/)?.[1];
+            const version = scalar ?? entry[2].match(/\bversion\s*=\s*["']([^"']+)["']/)?.[1]
+                ?? (entry[2].match(/\bworkspace\s*=\s*true\b/) ? "workspace" : undefined)
+                ?? entry[2].match(/\bgit\s*=\s*["']([^"']+)["']/)?.[1]
+                ?? entry[2].match(/\bpath\s*=\s*["']([^"']+)["']/)?.[1];
+            const name = entry[2].match(/\bpackage\s*=\s*["']([^"']+)["']/)?.[1] ?? entry[1];
+            if (version)
+                out.dependencies.push(ref(manifest, parser, 0.9, name, version, scope));
+            else
+                out.dependencyErrors.push(error(manifest, parser, `unparsed dependency ${entry[1]}`, section.startLine + offset));
+        });
+    }
+    return out;
+}
+function xmlValue(block, tag) {
+    return block.match(new RegExp(`<${tag}\\b[^>]*>\\s*([^<]+?)\\s*</${tag}>`, "i"))?.[1].trim();
+}
+function mavenDependencies(manifest) {
+    const parser = "maven-xml-regex", out = result(), text = fs.readFileSync(manifest.path, "utf8");
+    const blocks = [...text.matchAll(/<dependency\b[^>]*>([\s\S]*?)<\/dependency>/gi)];
+    for (const match of blocks) {
+        const group = xmlValue(match[1], "groupId"), artifact = xmlValue(match[1], "artifactId");
+        if (!group || !artifact)
+            out.dependencyErrors.push(error(manifest, parser, "dependency missing groupId or artifactId"));
+        else
+            out.dependencies.push(ref(manifest, parser, 0.8, `${group}:${artifact}`, xmlValue(match[1], "version") ?? "managed", xmlValue(match[1], "scope") ?? "compile"));
+    }
+    const starts = [...text.matchAll(/<dependency\b/gi)].length;
+    for (let i = blocks.length; i < starts; i++)
+        out.dependencyErrors.push(error(manifest, parser, "unclosed or self-closing dependency element"));
+    return out;
+}
+function gradleDependencies(manifest) {
+    const parser = "gradle-coordinate-regex", out = result();
+    let depth = 0;
+    fs.readFileSync(manifest.path, "utf8").split(/\r?\n/).forEach((raw, index) => {
+        const line = raw.replace(/\/\/.*$/, "").trim(), opening = /\bdependencies\s*\{/.test(line);
+        if (opening)
+            depth += 1;
+        else if (depth > 0 && line && !/^[{}]+$/.test(line)) {
+            const entry = line.match(/^([A-Za-z][A-Za-z0-9_]*)\s*(?:\(\s*)?["']([^"']+)["']/);
+            if (entry) {
+                const parts = entry[2].split(":");
+                if (parts.length >= 3 && parts[0] && parts[1] && parts[2])
+                    out.dependencies.push(ref(manifest, parser, 0.75, `${parts[0]}:${parts[1]}`, parts[2], entry[1]));
+                else
+                    out.dependencyErrors.push(error(manifest, parser, `unparsed ${entry[1]} coordinate`, index + 1));
+            }
+            else if (/^[A-Za-z][A-Za-z0-9_]*\s*\(/.test(line))
+                out.dependencyErrors.push(error(manifest, parser, "unparsed dependency declaration", index + 1));
+        }
+        if (depth > 0)
+            depth += (line.match(/\{/g)?.length ?? 0) - (line.match(/\}/g)?.length ?? 0) - (opening ? 1 : 0);
+        if (depth < 0)
+            depth = 0;
+    });
+    return out;
+}
+function xmlAttribute(attrs, name) {
+    return attrs.match(new RegExp(`\\b${name}\\s*=\\s*["']([^"']+)["']`, "i"))?.[1];
+}
+function csprojDependencies(manifest) {
+    const parser = "msbuild-xml-regex", out = result(), text = fs.readFileSync(manifest.path, "utf8");
+    const blocks = [...text.matchAll(/<PackageReference\b([^>]*?)(?:\/>|>([\s\S]*?)<\/PackageReference>)/gi)];
+    for (const match of blocks) {
+        const name = xmlAttribute(match[1], "Include") ?? xmlAttribute(match[1], "Update");
+        if (!name) {
+            out.dependencyErrors.push(error(manifest, parser, "PackageReference missing Include or Update"));
+            continue;
+        }
+        const body = match[2] ?? "";
+        const version = xmlAttribute(match[1], "Version") ?? xmlValue(body, "Version") ?? "managed";
+        const privateAssets = xmlAttribute(match[1], "PrivateAssets") ?? xmlValue(body, "PrivateAssets") ?? "";
+        out.dependencies.push(ref(manifest, parser, 0.9, name, version, /\ball\b/i.test(privateAssets) ? "development" : "runtime"));
+    }
+    const starts = [...text.matchAll(/<PackageReference\b/gi)].length;
+    for (let i = blocks.length; i < starts; i++)
+        out.dependencyErrors.push(error(manifest, parser, "unclosed PackageReference element"));
+    return out;
+}
+export function parseManifestDependencies(manifests) {
+    const out = result();
+    for (const manifest of manifests) {
+        const base = path.basename(manifest.path).toLowerCase();
+        let parsed = null;
+        try {
+            if (manifest.kind === "node")
+                parsed = nodeDependencies(manifest);
+            else if (manifest.kind === "python")
+                parsed = base === "pyproject.toml" ? pyprojectDependencies(manifest) : requirementsDependencies(manifest);
+            else if (manifest.kind === "go")
+                parsed = goDependencies(manifest);
+            else if (manifest.kind === "rust")
+                parsed = cargoDependencies(manifest);
+            else if (manifest.kind === "maven")
+                parsed = mavenDependencies(manifest);
+            else if (manifest.kind === "gradle" && /^build\.gradle(?:\.kts)?$/i.test(base))
+                parsed = gradleDependencies(manifest);
+            else if (manifest.kind === "dotnet" && base.endsWith(".csproj"))
+                parsed = csprojDependencies(manifest);
+        }
+        catch (cause) {
+            out.dependencyErrors.push(error(manifest, `${manifest.kind}-manifest`, `manifest parse failed: ${cause instanceof Error ? cause.message : String(cause)}`));
+        }
+        if (parsed) {
+            out.dependencies.push(...parsed.dependencies);
+            out.dependencyErrors.push(...parsed.dependencyErrors);
+        }
+    }
+    out.dependencies.sort((a, b) => `${a.sourceManifest}\0${a.name}\0${a.scope}`.localeCompare(`${b.sourceManifest}\0${b.name}\0${b.scope}`));
+    out.dependencyErrors.sort((a, b) => `${a.sourceManifest}\0${a.line ?? 0}\0${a.message}`.localeCompare(`${b.sourceManifest}\0${b.line ?? 0}\0${b.message}`));
+    return out;
+}

package/dist/license.js

@@ -0,0 +1,261 @@
+import fs from "node:fs";
+import path from "node:path";
+import { loadFileNotes, loadProject } from "./store.js";
+import { isTestFile, readDirectDeps } from "./scan.js";
+import { ensureFresh, getIndex, iterateFileRows } from "./index-store.js";
+import { readText } from "./search.js";
+import { foldLines } from "./budget.js";
+/**
+ * 法律/许可证账：依赖许可证清单（直接+传递，含 pnpm 布局）、copyleft 冲突、可疑许可证头、来源登记。
+ * 离线能力边界：读本地依赖元数据与源码文本，不做外部相似度检索。
+ */
+const STRONG_COPYLEFT = ["GPL-2.0", "GPL-3.0", "AGPL-3.0", "SSPL-1.0", "GPL", "AGPL", "SSPL"];
+const WEAK_COPYLEFT = ["LGPL", "MPL-2.0", "MPL", "EPL", "CDDL", "EUPL", "Sleepycat"];
+const PERMISSIVE = ["MIT", "Apache-2.0", "Apache", "BSD-2-Clause", "BSD-3-Clause", "BSD", "ISC", "0BSD", "Unlicense", "Zlib", "Python-2.0", "BSL-1.0"];
+/** 单个包最多登记数（巨型依赖树保护；超出部分计数上报） */
+const MAX_DEPS = 800;
+function classify(license) {
+    const l = license.trim();
+    if (!l)
+        return "unknown";
+    const up = l.toUpperCase();
+    if (STRONG_COPYLEFT.some((k) => up.includes(k.toUpperCase()))) {
+        // LGPL 不算强 copyleft
+        if (up.startsWith("LGPL"))
+            return "weak-copyleft";
+        return "strong-copyleft";
+    }
+    if (WEAK_COPYLEFT.some((k) => up.includes(k.toUpperCase())))
+        return "weak-copyleft";
+    if (PERMISSIVE.some((k) => up === k.toUpperCase() || up.startsWith(k.toUpperCase())))
+        return "permissive";
+    return "unknown";
+}
+function readPkgLicense(pkgFile) {
+    try {
+        const pkg = JSON.parse(fs.readFileSync(pkgFile, "utf8"));
+        const license = typeof pkg.license === "string"
+            ? pkg.license
+            : Array.isArray(pkg.license)
+                ? pkg.license.join(" OR ")
+                : "";
+        return { version: String(pkg.version ?? ""), license };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * 盘点已安装依赖许可证：直接 + 传递。
+ * 覆盖三种布局：npm/yarn 扁平与嵌套（node_modules/<a>/node_modules/<b>）、
+ * pnpm（node_modules/.pnpm/<name>@<ver>/node_modules/<name>，直接依赖是符号链接）。
+ */
+function readNodeLicenses(root) {
+    const out = new Map();
+    const nm = path.join(root, "node_modules");
+    let truncated = 0;
+    if (!fs.existsSync(nm))
+        return { list: [], truncated: 0 };
+    const direct = new Set(readDirectDeps(root).deps);
+    const record = (name, pkgDir) => {
+        if (out.has(name) || out.size >= MAX_DEPS) {
+            if (!out.has(name))
+                truncated += 1;
+            return;
+        }
+        const meta = readPkgLicense(path.join(pkgDir, "package.json"));
+        out.set(name, {
+            name,
+            version: meta?.version ?? "",
+            license: meta?.license ?? "",
+            kind: classify(meta?.license ?? ""),
+            direct: direct.has(name),
+        });
+    };
+    const isDirLike = (d) => d.isDirectory() || d.isSymbolicLink();
+    // ① 一层 node_modules（npm/yarn 扁平 + pnpm 的符号链接直接依赖）
+    const level1 = [];
+    for (const entry of fs.readdirSync(nm, { withFileTypes: true })) {
+        if (entry.name === ".pnpm" || entry.name.startsWith("."))
+            continue;
+        if (entry.name.startsWith("@") && isDirLike(entry)) {
+            for (const sub of fs.readdirSync(path.join(nm, entry.name), { withFileTypes: true })) {
+                if (isDirLike(sub))
+                    level1.push(`${entry.name}/${sub.name}`);
+            }
+        }
+        else if (isDirLike(entry)) {
+            level1.push(entry.name);
+        }
+    }
+    for (const name of level1)
+        record(name, path.join(nm, ...name.split("/")));
+    // ② 嵌套依赖（npm2 老布局 / 部分包自带 node_modules）
+    for (const name of level1) {
+        const nested = path.join(nm, ...name.split("/"), "node_modules");
+        if (!fs.existsSync(nested))
+            continue;
+        for (const entry of fs.readdirSync(nested, { withFileTypes: true })) {
+            if (entry.name.startsWith("@") && isDirLike(entry)) {
+                for (const sub of fs.readdirSync(path.join(nested, entry.name), { withFileTypes: true })) {
+                    if (isDirLike(sub))
+                        record(`${entry.name}/${sub.name}`, path.join(nested, entry.name, sub.name));
+                }
+            }
+            else if (isDirLike(entry)) {
+                record(entry.name, path.join(nested, entry.name));
+            }
+        }
+    }
+    // ③ pnpm 布局：.pnpm/<name>@<version>/node_modules/<name> 覆盖整个依赖树（直接+传递）
+    const pnpmDir = path.join(nm, ".pnpm");
+    if (fs.existsSync(pnpmDir)) {
+        for (const entry of fs.readdirSync(pnpmDir, { withFileTypes: true })) {
+            if (!entry.isDirectory())
+                continue;
+            // 目录名 name@version；@scope/name@version → 包名取到最后一个 @ 前
+            const dirName = entry.name;
+            const at = dirName.lastIndexOf("@");
+            if (at <= 0)
+                continue;
+            const pkgName = dirName.slice(0, at);
+            if (!pkgName)
+                continue;
+            const realDir = path.join(pnpmDir, dirName, "node_modules", ...pkgName.split("/"));
+            if (fs.existsSync(path.join(realDir, "package.json")))
+                record(pkgName, realDir);
+        }
+    }
+    const list = [...out.values()].sort((a, b) => a.name.localeCompare(b.name));
+    return { list, truncated };
+}
+const GPL_HEADER = /GNU (LESSER |AFFERO )?GENERAL PUBLIC LICENSE/i;
+export function auditLicense(root, maxLines = 150) {
+    const project = loadProject(root);
+    const rootPkg = path.join(root, "package.json");
+    let pkgLicense = "";
+    if (fs.existsSync(rootPkg)) {
+        try {
+            pkgLicense = String(JSON.parse(fs.readFileSync(rootPkg, "utf8")).license ?? "");
+        }
+        catch {
+            /* ignore */
+        }
+    }
+    const declared = project.license || pkgLicense;
+    const projectKind = classify(declared);
+    const L = [];
+    L.push("## 许可证审计");
+    /* ① 项目声明 */
+    L.push("");
+    L.push("### ① 项目声明");
+    const hasLicenseFile = fs.existsSync(root) &&
+        fs.readdirSync(root).some((n) => /^licen[cs]e/i.test(n));
+    L.push(declared
+        ? `- 项目许可证: ${declared}（${label(projectKind)}）`
+        : "- ⚠️ 项目未声明许可证（update_project 补充 license 字段）");
+    L.push(hasLicenseFile ? "- LICENSE 文件: 存在" : "- ⚠️ 根目录缺少 LICENSE 文件");
+    /* ② 依赖清单（直接 + 传递，含 pnpm 布局） */
+    L.push("");
+    const { list: licenses, truncated } = readNodeLicenses(root);
+    const directList = licenses.filter((d) => d.direct);
+    const transitiveList = licenses.filter((d) => !d.direct);
+    L.push(`### ② 依赖许可证清单（直接 ${directList.length} + 传递 ${transitiveList.length}）`);
+    const conflicts = [];
+    const unknowns = [];
+    const emit = (d) => {
+        const tag = d.direct ? "" : "（传递）";
+        if (d.kind === "strong-copyleft") {
+            conflicts.push(`🔴 ${d.name}@${d.version} [${d.license || "?"}] 强 copyleft${tag}`);
+        }
+        else if (d.kind === "unknown") {
+            unknowns.push(d.name + tag);
+        }
+        else if (d.kind === "weak-copyleft") {
+            L.push(`🟡 ${d.name}@${d.version} [${d.license}] 弱 copyleft（注意按文件级义务使用）${tag}`);
+        }
+        else {
+            L.push(`🟢 ${d.name}@${d.version} [${d.license}]${tag}`);
+        }
+    };
+    if (licenses.length === 0) {
+        L.push("- （未发现已安装的 JS 依赖）");
+    }
+    for (const d of directList)
+        emit(d);
+    for (const d of transitiveList.slice(0, 60))
+        emit(d);
+    if (transitiveList.length > 60)
+        L.push(`…另有 ${transitiveList.length - 60} 个传递依赖未逐条列出（详见 node_modules）`);
+    if (truncated > 0)
+        L.push(`⚪ 依赖树超过 ${MAX_DEPS} 个，${truncated} 个未逐条登记`);
+    for (const c of conflicts)
+        L.push(c);
+    if (unknowns.length > 0)
+        L.push(`⚪ 许可证未知（需人工审查）: ${unknowns.slice(0, 20).join(", ")}`);
+    const declaredDeps = readDirectDeps(root).deps;
+    const foundNames = new Set(licenses.map((l) => l.name));
+    const missing = declaredDeps.filter((n) => !foundNames.has(n));
+    if (missing.length > 0) {
+        const hasPy = fs.existsSync(path.join(root, "requirements.txt"));
+        L.push(`⚪ 已声明但未在 node_modules 找到 ${missing.length} 个（未安装或元数据缺失${hasPy ? "；Python 依赖离线无法取许可证，需人工审查" : ""}）: ${missing.slice(0, 10).join(", ")}`);
+    }
+    if (conflicts.length > 0 && (projectKind === "permissive" || declared === "")) {
+        L.push("");
+        L.push(`- 🚩 项目按 ${declared || "专有"} 分发，但存在强 copyleft 依赖（含传递）。若闭源/专有分发，GPL/AGPL/SSPL 依赖会触发开源义务——请确认链接方式或替换依赖，必要时咨询法务。`);
+    }
+    /* ③ 可疑许可证头 */
+    L.push("");
+    L.push("### ③ 源码中的 GPL 家族许可证头（复制带许可证代码的常见痕迹）");
+    ensureFresh(root);
+    const hits = [];
+    for (const row of iterateFileRows(getIndex(root))) {
+        const rel = row.rel;
+        if (rel.startsWith(".pm/"))
+            continue;
+        // 测试文件常内嵌许可证字符串作为 fixture，不参与该启发式（信号针对混入源码的复制代码）
+        if (isTestFile(rel))
+            continue;
+        const content = readText(root, rel);
+        if (content === null)
+            continue;
+        if (GPL_HEADER.test(content.split("\n").slice(0, 40).join("\n")))
+            hits.push(rel);
+        if (hits.length >= 10)
+            break;
+    }
+    if (hits.length === 0)
+        L.push("- ✅ 未在前 40 行发现 GPL 家族许可证头。");
+    else {
+        for (const h of hits)
+            L.push(`- 🔴 ${h}：包含 GPL 家族许可证文本，疑似复制自 copyleft 项目——确认来源与义务，或用 annotate_file 登记来源。`);
+    }
+    /* ④ 来源登记 */
+    L.push("");
+    L.push("### ④ 来源登记（provenance）");
+    const notes = loadFileNotes(root).notes;
+    const sourced = Object.entries(notes).filter(([, n]) => n.source || n.license);
+    if (sourced.length === 0) {
+        L.push("- （暂无来源登记。引用外部代码时用 annotate_file 登记 source 与 license，纠纷时说得清代码从哪来。）");
+    }
+    else {
+        for (const [file, n] of sourced.slice(0, 10)) {
+            L.push(`- ${file}: ${n.source || "未填来源"}${n.license ? ` [${n.license}]` : ""}`);
+        }
+    }
+    L.push("");
+    L.push("> 边界说明：本审计是离线启发式（依赖元数据 + 文本头检测），不能检测「AI 复读受版权代码」本身，也不替代法务意见。");
+    return foldLines(L, { maxLines, hint: "冲突项优先，可用 update_project 声明许可证后重扫" });
+}
+function label(kind) {
+    switch (kind) {
+        case "strong-copyleft":
+            return "强 copyleft";
+        case "weak-copyleft":
+            return "弱 copyleft";
+        case "permissive":
+            return "宽松";
+        default:
+            return "未知";
+    }
+}

package/dist/paths.js

@@ -0,0 +1,51 @@
+import path from "node:path";
+import fs from "node:fs";
+import os from "node:os";
+/** 项目根解析顺序：--root 参数 > PM_ROOT 环境变量 > 当前工作目录 */
+export function resolveRoot(explicit) {
+    const raw = explicit?.trim() || process.env.PM_ROOT?.trim() || process.cwd();
+    return path.resolve(raw);
+}
+export const PM_DIR = ".pm";
+export function pmPath(root, ...segs) {
+    return path.join(root, PM_DIR, ...segs);
+}
+export const PROJECT_JSON = "project.json";
+export const ROADMAP_JSON = "roadmap.json";
+export const TASKS_JSON = "tasks.json";
+export const FEATURES_JSON = "features.json";
+export const SESSIONS_JSON = "sessions.json";
+export const DEBUGLOG_JSON = "debuglog.json";
+export const FILE_NOTES_JSON = "file-notes.json";
+export const SECURITY_JSON = "security.json";
+export const DECISIONS_DIR = "decisions";
+export const SNAPSHOTS_DIR = "snapshots";
+export const EXTRA_RULES_FILE = "security-rules.json";
+export function decisionsDir(root) {
+    return pmPath(root, DECISIONS_DIR);
+}
+export function snapshotsDir(root) {
+    return pmPath(root, SNAPSHOTS_DIR);
+}
+/** 仓库根目录下自动生成的仪表盘 */
+export function dashboardFile(root) {
+    return path.join(root, "PROJECT.md");
+}
+/** 全局项目注册表（跨项目查询用）；PM_MCP_HOME 可重定向（测试/多环境隔离用） */
+export function registryFile() {
+    const home = process.env.PM_MCP_HOME?.trim() || os.homedir();
+    return path.join(home, ".pm-mcp", "registry.json");
+}
+export function isInitialized(root) {
+    return fs.existsSync(pmPath(root, PROJECT_JSON));
+}
+export function requireInitialized(root) {
+    if (!isInitialized(root)) {
+        throw new Error(`项目未初始化（在 ${root} 下没有找到 ${PM_DIR}/${PROJECT_JSON}）。请先调用 init_project。`);
+    }
+}
+export function ensurePmDirs(root) {
+    fs.mkdirSync(pmPath(root), { recursive: true });
+    fs.mkdirSync(decisionsDir(root), { recursive: true });
+    fs.mkdirSync(snapshotsDir(root), { recursive: true });
+}