@nxuss/lemma 1.17.0 → 1.18.0

package/dist/cjs/mcp/tools.js

@@ -36,6 +36,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectExpectedProjectName = void 0;
 exports.getToolSchemaChars = getToolSchemaChars;
 exports.getRegisteredToolNames = getRegisteredToolNames;
 exports.getAdvertisedToolNames = getAdvertisedToolNames;
@@ -54,6 +55,7 @@ const ContextSqueezer_1 = require("../utils/ContextSqueezer");
 const reportSavings_1 = require("../utils/reportSavings");
 const utils_1 = require("./utils");
 const FileFingerprint_1 = require("../utils/FileFingerprint");
+const ProjectIdentity_1 = require("../utils/ProjectIdentity");
 const GitBlameHeat_1 = require("../utils/GitBlameHeat");
 const TypeCoverage_1 = require("../utils/TypeCoverage");
 const ImportTreeContext_1 = require("../utils/ImportTreeContext");
@@ -3007,11 +3009,27 @@ function buildLocalOnboarding(cwd) {
     catch { /* brain unavailable */ }
     return lines.join("\n");
 }
+// Re-exported for callers/tests that already import detectExpectedProjectName from here —
+// the actual implementation lives in ../utils/ProjectIdentity, shared with the proxy daemon
+// (src/cli/lemma-proxy.ts) so both sides compute "project name" exactly one way.
+exports.detectExpectedProjectName = ProjectIdentity_1.detectProjectName;
 async function handleGetProjectOnboarding(_args) {
     const cwd = process.cwd();
     try {
         const port = (0, utils_1.getProxyPort)();
-        const response = await axios_1.default.get(`http://localhost:${port}/api/project/onboarding`, { timeout: 2000 });
+        // The proxy daemon is one global process per machine, tracked by a single shared
+        // ~/.lemma-cache/proxy.port file — every MCP client on the box points at whichever
+        // daemon happens to be listening there, regardless of which project it's actually
+        // running in. Its project identity is fixed to whatever cwd IT was started from, not
+        // ours. Without expectedProject, a daemon started for a different project answers with
+        // THAT project's stack/files/memories — a real cross-project data leak, not a cosmetic
+        // bug. The route only returns `markdown` when this matches; otherwise we fall through
+        // to the local (always correctly-scoped) generator below.
+        const expectedProject = (0, exports.detectExpectedProjectName)(cwd);
+        const response = await axios_1.default.get(`http://localhost:${port}/api/project/onboarding`, {
+            timeout: 2000,
+            params: { expectedProject },
+        });
         if (response.data?.markdown) {
             return { content: [{ type: "text", text: response.data.markdown }] };
         }
@@ -3536,30 +3554,31 @@ async function handleBatchToolCalls(args) {
 // ── TurboSqueeze ─────────────────────────────────────────────────
 async function handleTurboSqueeze(args) {
     const text = args?.text;
-    const stripComments = args?.stripComments !== false;
-    const stripImports = args?.stripImports !== false;
+    const wantStripComments = args?.stripComments !== false;
+    const wantStripImports = args?.stripImports !== false;
     const compactJson = args?.compactJson !== false;
     if (!text)
         throw new Error("text is required");
+    // Delegates to the same stripComments/stripImports/compactWhitespace primitives
+    // squeeze_prompt and the proxy's own cache-miss path use — this used to be a second,
+    // independent regex implementation of the same job that had drifted out of sync: its
+    // naive `//.*$` comment strip mangled any line containing a URL (http://, https://),
+    // a case the shared stripComments already guards against. One implementation now.
     let squeezed = text;
-    // Strip multi-line comments
-    if (stripComments) {
-        squeezed = squeezed.replace(/\/\*[\s\S]*?\*\//g, '');
-        squeezed = squeezed.replace(/\/\/.*$/gm, '');
-    }
-    // Remove empty lines and trim whitespace
-    squeezed = squeezed.replace(/^\s*[\r\n]/gm, '\n');
-    squeezed = squeezed.replace(/^[ \t]+/gm, ' ');
-    squeezed = squeezed.replace(/[ \t]+$/gm, '');
-    // Strip imports
-    if (stripImports) {
-        squeezed = squeezed.replace(/^import\s+[\s\S]*?from\s+['"][\w@\/\.-]+['"];?\s*$/gm, '');
-        squeezed = squeezed.replace(/^import\s+['"][\w@\/\.-]+['"];?\s*$/gm, '');
-        squeezed = squeezed.replace(/^const\s+\w+\s*=\s*require\(['"][\w@\/\.-]+['"]\);?\s*$/gm, '');
-        squeezed = squeezed.replace(/^require\(['"][\w@\/\.-]+['"]\);?\s*$/gm, '');
-    }
-    // Compact JSON
-    if (compactJson) {
+    if (wantStripComments)
+        squeezed = (0, ContextSqueezer_1.stripComments)(squeezed);
+    if (wantStripImports)
+        squeezed = (0, ContextSqueezer_1.stripImports)(squeezed);
+    squeezed = (0, ContextSqueezer_1.compactWhitespace)(squeezed);
+    // Compact JSON — the one genuinely turbosqueeze-specific step, kept as-is, but only when
+    // the input actually looks like JSON. Pre-existing bug found while consolidating this
+    // function: these regexes ran unconditionally whenever compactJson wasn't explicitly
+    // false, so ordinary code went through them too — `{ foo }` in an import statement came
+    // out as `{foo}`, and the same regexes would just as happily squash braces in real
+    // control-flow code. Gate on the input's own shape instead of trusting the caller only
+    // ever sets compactJson for genuine JSON.
+    const looksLikeJson = /^\s*[[{]/.test(squeezed);
+    if (compactJson && looksLikeJson) {
         squeezed = squeezed.replace(/"\s*:\s*/g, '":');
         squeezed = squeezed.replace(/,\s*"/g, ',"');
         squeezed = squeezed.replace(/\[\s+/g, '[');