@luckychen1993/pm-mcp 0.1.4 → 0.3.0

package/dist/scan.js

@@ -2,33 +2,13 @@ import fs from "node:fs";
 import path from "node:path";
 import { globToRegExp, normSep } from "./budget.js";
 import { aggregates, getIndex, walkRefresh } from "./index-store.js";
+import { SCAN_IGNORE_DIRS, ignoreMatcher, projectScanIgnores } from "./scan-policy.js";
 /**
  * 代码树扫描：低层走查（生成器，内存恒定）+ scanProject 聚合入口。
  * 内容级结果存 SQLite 索引（index-store），未变更文件永不重读。
  * 超大项目保护：>10 万文件不物化 files 数组（聚合与点名走 SQL）。
  */
-export const DEFAULT_IGNORE_DIRS = new Set([
-    "node_modules",
-    ".git",
-    "dist",
-    "build",
-    "out",
-    ".next",
-    ".nuxt",
-    ".output",
-    ".turbo",
-    "coverage",
-    "__pycache__",
-    ".venv",
-    "venv",
-    "env",
-    ".pm",
-    ".idea",
-    ".vscode",
-    "target",
-    ".cache",
-    ".gradle",
-]);
+export const DEFAULT_IGNORE_DIRS = SCAN_IGNORE_DIRS;
 /** 真实目录树不太可能超过 64 层；超限的计数上报，绝不静默丢失 */
 export const DEPTH_LIMIT = 64;
 export const BINARY_EXTS = new Set([
@@ -112,7 +92,7 @@ export function needsSkipCount(rel, isTest) {
  * onSkippedDeep 在超深路径被跳过时回调（计数上报用）。
  */
 export function* walkStatEntries(root, opts = {}, onSkippedDeep) {
-    const extraRe = (opts.extraIgnores ?? []).map(globToRegExp);
+    const excluded = ignoreMatcher([...projectScanIgnores(root), ...(opts.extraIgnores ?? [])]);
     const includeRe = opts.include?.map(globToRegExp);
     const maxBytes = opts.maxFileBytes ?? 2 * 1024 * 1024;
     void maxBytes;
@@ -134,12 +114,12 @@ export function* walkStatEntries(root, opts = {}, onSkippedDeep) {
             if (entry.isDirectory()) {
                 if (DEFAULT_IGNORE_DIRS.has(entry.name))
                     continue;
-                if (extraRe.some((re) => re.test(rel)))
+                if (excluded(rel, true))
                     continue;
                 yield* walk(abs, depth + 1);
             }
             else if (entry.isFile()) {
-                if (extraRe.some((re) => re.test(rel)))
+                if (excluded(rel))
                     continue;
                 if (includeRe && !includeRe.some((re) => re.test(rel)))
                     continue;

package/dist/search.js

@@ -6,6 +6,7 @@ import { decisionsDir } from "./paths.js";
 import { loadGovernance } from "./governance-model.js";
 import { listFiles, DEFAULT_IGNORE_DIRS } from "./scan.js";
 import { foldLines, normSep } from "./budget.js";
+import { projectScanIgnores } from "./scan-policy.js";
 /**
  * 求证与检索：search_code（锚定真实代码）+ search_knowledge（历史结论）。
  * token 经济的一部分：返回 file:line 片段而非整文件。
@@ -36,14 +37,17 @@ export function rgSearch(root, query, glob, maxResults, regex) {
             args.push("-g", "!.pm/**");
         else
             args.push("-g", `!${dir}/**`);
+        args.push("-g", `!**/${dir}/**`);
     }
     args.push("--max-count", String(maxResults * 3));
     if (regex)
         args.push("-e", query);
     else
-        args.push("-F", query);
+        args.push("-F", "-e", query);
     if (glob)
         args.push("--glob", glob);
+    for (const excluded of projectScanIgnores(root))
+        args.push("--glob", `!${excluded}`);
     args.push(".");
     const r = spawnSync("rg", args, { cwd: root, encoding: "utf8", timeout: 120_000, maxBuffer: 64 * 1024 * 1024 });
     if (process.env.PM_RG_DEBUG)

package/dist/security.js

@@ -1,3 +1,5 @@
+import fs from "node:fs";
+import path from "node:path";
 import { createHash } from "node:crypto";
 import { loadExtraRules, loadProject, loadSecurity, saveSecurity } from "./store.js";
 import { latestSnapshot } from "./audit.js";
@@ -5,6 +7,7 @@ import { readDirectDeps } from "./scan.js";
 import { ensureFresh, getIndex, iterateFileRows, walkRefresh } from "./index-store.js";
 import { readText } from "./search.js";
 import { now } from "./types.js";
+import { scanExclusionNote } from "./scan-policy.js";
 const SECRET_PATTERNS = [
     { id: "secret.aws-access-key", severity: "high", pattern: /AKIA[0-9A-Z]{16}/, message: "疑似 AWS Access Key" },
     { id: "secret.github-token", severity: "high", pattern: /gh[pousr]_[A-Za-z0-9]{20,}/, message: "疑似 GitHub Token" },
@@ -69,8 +72,37 @@ function findSecretRule(value) {
 function fingerprint(ruleId, rel, matched) {
     return createHash("sha1").update(ruleId + "|" + rel + "|" + matched).digest("hex").slice(0, 16);
 }
+/** 只有根内普通路径的 ENOENT 才证明删除；权限错误、目录和链接均不证明修复。 */
+function findingFileState(root, rel) {
+    const parts = rel.replace(/\\/g, "/").split("/");
+    if (path.isAbsolute(rel) || parts.some((part) => !part || part === "." || part === ".."))
+        return "unknown";
+    let current = root;
+    let stat;
+    for (const part of parts) {
+        current = path.join(current, part);
+        try {
+            stat = fs.lstatSync(current);
+            if (stat.isSymbolicLink())
+                return "unknown";
+        }
+        catch (error) {
+            return error.code === "ENOENT" ? "missing" : "unknown";
+        }
+    }
+    return stat?.isFile() ? "file" : "unknown";
+}
 function scanDetections(root, forceContent = false, indexPrepared = false) {
     const out = [];
+    // 只跟踪已有 open 发现，不为百万文件仓库额外物化整棵扫描覆盖表。
+    const pending = loadSecurity(root).findings.filter((finding) => finding.status === "open");
+    const byFile = new Map();
+    for (const finding of pending) {
+        const entries = byFile.get(finding.file) ?? [];
+        entries.push(finding);
+        byFile.set(finding.file, entries);
+    }
+    const checkedFindings = new Map();
     const rules = [...SECRET_PATTERNS, ...DANGEROUS_PATTERNS];
     // 用户自定义规则
     for (const r of loadExtraRules(root).rules) {
@@ -113,6 +145,7 @@ function scanDetections(root, forceContent = false, indexPrepared = false) {
         const content = readText(root, rel, forceContent);
         if (content === null)
             continue;
+        const contentDigest = byFile.has(rel) ? createHash("sha256").update(content).digest("hex") : undefined;
         const lines = content.split("\n");
         for (const rule of rules) {
             if (rule.glob && !rule.glob.test(rel))
@@ -131,9 +164,18 @@ function scanDetections(root, forceContent = false, indexPrepared = false) {
                     message: rule.message,
                 });
             }
+            for (const finding of byFile.get(rel) ?? []) {
+                if (finding.rule === rule.id)
+                    checkedFindings.set(finding.fingerprint, contentDigest);
+            }
+        }
+    }
+    for (const finding of pending) {
+        if (!checkedFindings.has(finding.fingerprint) && findingFileState(root, finding.file) === "missing") {
+            checkedFindings.set(finding.fingerprint, null);
         }
     }
-    return out;
+    return { detections: out, checkedFindings };
 }
 /** 昂贵的全仓扫描阶段；调用方可在账本锁外完成，再把脱敏发现提交到账本。 */
 export function prepareSecurityAudit(root, options = {}) {
@@ -141,13 +183,14 @@ export function prepareSecurityAudit(root, options = {}) {
     const forceContent = options.forceContent ?? true;
     if (forceIndex)
         walkRefresh(root, { forceContent: true });
-    return { detections: scanDetections(root, forceContent, forceIndex || options.indexPrepared === true) };
+    return scanDetections(root, forceContent, forceIndex || options.indexPrepared === true);
 }
 /** 扫描并更新台账（幂等：重复扫描不产生重复条目） */
 export function auditSecurity(root, prepared) {
     const project = loadProject(root);
     const stamp = now();
-    const detections = prepared?.detections ?? scanDetections(root);
+    const scan = prepared ?? scanDetections(root);
+    const detections = scan.detections;
     const security = loadSecurity(root);
     const existing = new Map(security.findings.map((f) => [f.fingerprint, f]));
     const acceptedRefound = [];
@@ -186,10 +229,25 @@ export function auditSecurity(root, prepared) {
             });
         }
     }
-    // 不再检出且仍 open 的 → 自动转 fixed（附注说明）
+    // 没有命中不等于已修复：必须证明该旧发现的文件/规则已检查，或文件确已删除。
     let autoFixed = 0;
+    let unverified = 0;
+    const currentDigests = new Map();
     for (const f of security.findings) {
         if (f.status === "open" && !seen.has(f.fingerprint)) {
+            const expected = scan.checkedFindings?.get(f.fingerprint);
+            let confirmed = expected === null && findingFileState(root, f.file) === "missing";
+            if (typeof expected === "string") {
+                if (!currentDigests.has(f.file)) {
+                    const content = findingFileState(root, f.file) === "file" ? readText(root, f.file, true) : null;
+                    currentDigests.set(f.file, content === null ? null : createHash("sha256").update(content).digest("hex"));
+                }
+                confirmed = currentDigests.get(f.file) === expected;
+            }
+            if (!confirmed) {
+                unverified += 1;
+                continue;
+            }
             f.status = "fixed";
             f.note += "（自动：最近一次扫描未再检出）";
             autoFixed += 1;
@@ -208,6 +266,7 @@ export function auditSecurity(root, prepared) {
     const high = open.filter((f) => f.severity === "high");
     const L = [];
     L.push(`## 安全体检报告（exposure=${project.exposure}）`);
+    L.push(...scanExclusionNote(root));
     // exposure 兑现：不同暴露面使用不同处置口径
     if (project.exposure === "public") {
         const mustFix = open.filter((f) => f.severity === "high" || f.severity === "medium");
@@ -236,7 +295,9 @@ export function auditSecurity(root, prepared) {
         }
     }
     if (autoFixed > 0)
-        L.push(`自动关闭 ${autoFixed} 个（代码中已不再出现）。`);
+        L.push(`自动关闭 ${autoFixed} 个（已成功重扫未命中或确认文件删除）。`);
+    if (unverified > 0)
+        L.push(`⚠️ 扫描覆盖不足：${unverified} 个旧发现未获得完整检查证据，保持未解决状态（检查文件大小、可读性、扫描范围和规则）。`);
     if (newDeps.length > 0)
         L.push(`⚠️ 上次快照后新增依赖: ${newDeps.join(", ")}（AI 引入的依赖请审查来源与必要性）`);
     if (riskyDeps.length > 0)

package/dist/semantic-evidence-store.js

@@ -102,6 +102,28 @@ export function saveSemanticEvidence(root, id, input) {
         return parsed.data;
     });
 }
+/** Atomically replace the evidence set for one repository-relative source file under the ledger lock. */
+export function replaceSemanticEvidenceForFile(root, id, input) {
+    const safeId = validateSemanticEvidenceId(id);
+    const parsed = SemanticEvidenceDocumentSchema.safeParse(input);
+    if (!parsed.success) {
+        throw new Error(`语义证据 schema 校验失败: ${parsed.error.issues.map((issue) => `${issue.path.join(".") || "document"}: ${issue.message}`).join("; ")}`);
+    }
+    const absoluteRoot = path.resolve(root);
+    const directory = semanticEvidenceDir(absoluteRoot);
+    assertRealDirectoryWithinRoot(absoluteRoot, directory, true);
+    return withLedgerLock(absoluteRoot, () => {
+        assertRealDirectoryWithinRoot(absoluteRoot, directory, false);
+        const oldIds = evidenceIdsUnlocked(absoluteRoot)
+            .filter((candidate) => candidate !== safeId)
+            .filter((candidate) => loadUnlocked(absoluteRoot, candidate).file === parsed.data.file);
+        atomicWrite(semanticEvidencePath(absoluteRoot, safeId), `${JSON.stringify(parsed.data, null, 2)}
+`);
+        for (const oldId of oldIds)
+            fs.rmSync(semanticEvidencePath(absoluteRoot, oldId), { force: false });
+        return parsed.data;
+    });
+}
 export function loadSemanticEvidence(root, id) {
     return loadUnlocked(path.resolve(root), validateSemanticEvidenceId(id));
 }

package/dist/semantic-parsers.js

@@ -298,6 +298,24 @@ export function candidates(from, specifier, language, ownerRoots = []) {
         if (base === ".." || base.startsWith("../"))
             continue;
         out.add(base);
+        // TypeScript ESM convention: source specifiers ending in .js/.jsx/.mjs/.cjs often
+        // refer to .ts/.tsx/.mts/.cts files on disk (tsc rewriteRelativeImportExtensions
+        // and Node type stripping both map them this way). Candidates are appended after
+        // the literal path, so an existing .js file still wins resolution.
+        const specExt = path.posix.extname(base);
+        if (specExt === ".js" || specExt === ".jsx" || specExt === ".mjs" || specExt === ".cjs") {
+            const stem = base.slice(0, base.length - specExt.length);
+            if (specExt === ".js") {
+                out.add(`${stem}.ts`);
+                out.add(`${stem}.tsx`);
+            }
+            else if (specExt === ".jsx")
+                out.add(`${stem}.tsx`);
+            else if (specExt === ".mjs")
+                out.add(`${stem}.mts`);
+            else
+                out.add(`${stem}.cts`);
+        }
         if (!path.posix.extname(base)) {
             for (const ext of RESOLVE_EXTS)
                 out.add(base + ext);

package/dist/session-log.js

@@ -0,0 +1,14 @@
+import { loadSessions, nextId, saveSessions } from "./store.js";
+import { now } from "./types.js";
+import { captureFileHashes, projectFilePath } from "./git-state.js";
+/** 调用方持有账本锁；共享显式会话与任务自动会话的同一记录方式。 */
+export function appendSession(root, input, hashes) {
+    const files = (input.files ?? []).map(projectFilePath);
+    const fileHashes = hashes ?? captureFileHashes(root, files);
+    const data = loadSessions(root);
+    const id = nextId("S", data.seq, 4);
+    data.seq += 1;
+    data.sessions.push({ id, date: now(), author: input.author ?? "", summary: input.summary, files, next_steps: input.next_steps ?? [], file_hashes: fileHashes });
+    saveSessions(root, data);
+    return id;
+}

package/dist/setup-project.js

@@ -0,0 +1,146 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash, randomUUID } from "node:crypto";
+import { atomicWrite } from "./store.js";
+import { PACKAGE_SPEC, SERVER_NAME } from "./version.js";
+export function canonicalProjectRoot(root) {
+    const absolute = path.resolve(root);
+    let real;
+    try {
+        real = fs.realpathSync.native(absolute);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        real = absolute;
+    }
+    return process.platform === "win32" ? real.toLowerCase() : real;
+}
+export function codexProjectServerKey(root) {
+    const canonical = canonicalProjectRoot(root);
+    const slug = path.basename(canonical).toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "") || "project";
+    return `${SERVER_NAME}-${slug}-${createHash("sha256").update(canonical).digest("hex").slice(0, 12)}`;
+}
+function stringValue(value) {
+    return value.startsWith("'") ? value.slice(1, -1) : JSON.parse(value);
+}
+/** 仅处理本安装器的单行参数形式；复杂 TOML 明确拒绝，不猜测或输出配置原文。 */
+export function findCodexProjectEntry(text, root) {
+    if (text.includes('"""') || text.includes("'''"))
+        throw new Error("配置包含多行字符串，自动升级无法安全确认段落边界；未修改配置。");
+    const canonical = canonicalProjectRoot(root), expected = codexProjectServerKey(root);
+    const matches = [];
+    const headers = [...text.matchAll(/^(?:\uFEFF)?[ \t]*\[mcp_servers\.(?:([A-Za-z0-9_-]+)|"([^"\r\n]+)"|'([^'\r\n]+)')\][ \t]*(?:#.*)?\r?$/gm)];
+    for (const header of headers) {
+        const name = header[1] ?? header[2] ?? header[3];
+        if (name !== SERVER_NAME && !name.startsWith(SERVER_NAME + "-"))
+            continue;
+        const start = header.index + header[0].length;
+        const next = text.slice(start).search(/^[ \t]*\[/m);
+        const end = next < 0 ? text.length : start + next;
+        const section = text.slice(start, end);
+        const commands = [...section.matchAll(/^[ \t]*command[ \t]*=[ \t]*("[^\r\n]*"|'[^\r\n]*')[ \t]*(?:#.*)?\r?$/gm)];
+        const arrays = [...section.matchAll(/^[ \t]*args[ \t]*=[ \t]*(\[[^\r\n]*\])[ \t]*(?:#.*)?\r?$/gm)];
+        let entry;
+        try {
+            if (commands.length !== 1 || arrays.length !== 1)
+                throw new Error();
+            const command = stringValue(commands[0][1]), args = JSON.parse(arrays[0][1]);
+            if (typeof command !== "string" || !Array.isArray(args) || !args.every((value) => typeof value === "string"))
+                throw new Error();
+            const positions = args.flatMap((value, index) => value === "--root" ? [index] : []);
+            if (positions.length !== 1 || !path.isAbsolute(args[positions[0] + 1] ?? ""))
+                throw new Error();
+            const filters = [...section.matchAll(/^[ \t]*(enabled_tools|disabled_tools)[ \t]*=[ \t]*(\[[^\r\n]*\])/gm)];
+            entry = { name, command, args, root: canonicalProjectRoot(args[positions[0] + 1]), start, end,
+                enabled: !/^[ \t]*enabled[ \t]*=[ \t]*false\b/m.test(section),
+                toolFilters: [...section.matchAll(/^[ \t]*(?:enabled_tools|disabled_tools)[ \t]*=/gm)].length !== filters.length || filters.some((filter) => filter[1] === "enabled_tools" || JSON.parse(filter[2]).length > 0) };
+        }
+        catch { /* 无法识别的条目不会被覆盖 */ }
+        if (name === expected && entry?.root !== canonical)
+            throw new Error(`已有 [mcp_servers.${name}] 指向不同项目或无法确认 --root；未修改配置。`);
+        if (!entry && (name === SERVER_NAME || name === expected.slice(0, -13)))
+            throw new Error("旧 pm-mcp 条目的项目根无法确认，拒绝创建可能重复的启动项。");
+        if (entry?.root === canonical)
+            matches.push(entry);
+    }
+    if (matches.length > 1)
+        throw new Error("多个 pm-mcp 条目指向同一项目，需先明确保留哪个；未修改配置。");
+    return matches[0];
+}
+export function readCodexConfig(file) {
+    if (!fs.existsSync(file))
+        return "";
+    const stat = fs.lstatSync(file);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 2 * 1024 * 1024)
+        throw new Error("Codex 配置必须为有界普通文件，禁止链接。");
+    return fs.readFileSync(file, "utf8");
+}
+export function isPackageLaunch(entry) {
+    return /^npx(?:\.(?:cmd|exe))?$/i.test(path.basename(entry.command)) && entry.args.length === 4 && entry.args[0] === "-y" &&
+        /^@luckychen1993\/pm-mcp(?:@[^\s]+)?$/.test(entry.args[1]) && entry.args[2] === "--root";
+}
+/**
+ * 校验启动项指向本包已构建的本地入口（`dist/index.js` 或 `src/index.ts`）。
+ *
+ * 与 `isLocalLaunch` 的区别：**不要求 `--root`**。WorkBuddy 等多项目宿主
+ * 以会话工作区作为子进程 cwd，服务端按 cwd 解析项目根，此时参数里没有 `--root`。
+ */
+export function isLocalServerEntry(entry) {
+    if (!/^node(?:\.exe)?$/i.test(path.basename(entry.command)) || entry.args.length < 1 || !path.isAbsolute(entry.args[0]))
+        return false;
+    const file = path.resolve(entry.args[0]);
+    if (!/^(?:index|cli)\.(?:js|ts)$/.test(path.basename(file)))
+        return false;
+    try {
+        const stat = fs.lstatSync(file);
+        return stat.isFile() && !stat.isSymbolicLink() && JSON.parse(fs.readFileSync(path.join(path.dirname(file), "..", "package.json"), "utf8")).name === "@luckychen1993/pm-mcp";
+    }
+    catch {
+        return false;
+    }
+}
+export function isLocalLaunch(entry) {
+    return entry.args.length === 3 && entry.args[1] === "--root" && isLocalServerEntry(entry);
+}
+export function appendCodexProjectConfig(file, root, force, dryRun, log, local) {
+    const absolute = path.resolve(file), existing = readCodexConfig(absolute);
+    const entry = findCodexProjectEntry(existing, root);
+    const desired = local ?? { command: "npx", args: ["-y", PACKAGE_SPEC, "--root", path.resolve(root).replace(/\\/g, "/")] };
+    let updated;
+    if (entry) {
+        if (!force) {
+            log(`[skip] Codex already has [mcp_servers.${entry.name}] for this project; --force 可升级，现有配置保留。`);
+            return;
+        }
+        if (!isPackageLaunch(entry) && !isLocalLaunch(entry))
+            throw new Error("当前启动项不是可识别的 pm-mcp npx/node 形式；未修改配置。");
+        if (entry.command === desired.command && JSON.stringify(entry.args) === JSON.stringify(desired.args)) {
+            log("[skip] 启动配置已是目标版本；仍需通过 doctor 核验连接。");
+            return;
+        }
+        const section = existing.slice(entry.start, entry.end);
+        const replace = (name, value, input) => input.replace(new RegExp(`^([ \\t]*${name}[ \\t]*=[ \\t]*)(?:\\[[^\\r\\n]*\\]|"[^\\r\\n]*"|'[^\\r\\n]*')([ \\t]*(?:#.*)?)(\\r?)$`, "m"), (_all, prefix, suffix, cr) => prefix + value + suffix + cr);
+        const patched = replace("args", JSON.stringify(desired.args), replace("command", JSON.stringify(desired.command), section));
+        updated = existing.slice(0, entry.start) + patched + existing.slice(entry.end);
+        const checked = findCodexProjectEntry(updated, root);
+        if (!checked || checked.command !== desired.command || JSON.stringify(checked.args) !== JSON.stringify(desired.args))
+            throw new Error("启动配置替换验证失败，未写入。");
+        log(`[${dryRun ? "plan" : "upgrade"}] Codex [mcp_servers.${entry.name}]；仅替换 command/args，保留其余设置。`);
+    }
+    else {
+        const separator = existing.length === 0 || existing.endsWith("\n") ? "" : "\n";
+        const name = codexProjectServerKey(root);
+        updated = existing + `${separator}\n[mcp_servers.${name}]\ncommand = ${JSON.stringify(desired.command)}\nargs = ${JSON.stringify(desired.args)}\n`;
+        log(`[${dryRun ? "plan" : "write"}] Codex: ${absolute}`);
+        log(`[entry] [mcp_servers.${name}] → --root ${path.resolve(root)}`);
+    }
+    if (dryRun)
+        return;
+    fs.mkdirSync(path.dirname(absolute), { recursive: true });
+    if (readCodexConfig(absolute) !== existing)
+        throw new Error("配置在准备期间发生变化；未写入，请重新预览。");
+    if (fs.existsSync(absolute))
+        fs.copyFileSync(absolute, `${absolute}.backup-${Date.now()}-${randomUUID()}`, fs.constants.COPYFILE_EXCL);
+    atomicWrite(absolute, updated);
+}