@opencodehub/mcp 0.1.0

package/dist/tools/license-audit.js

@@ -0,0 +1,108 @@
+/**
+ * `license_audit` — classify Dependency nodes by license risk tier.
+ *
+ * Walks every Dependency node the ingestion pipeline produced and sorts
+ * each one into three buckets:
+ *
+ *   - copyleft    — names matching GPL/AGPL/SSPL/EUPL/CPAL/OSL/RPL. These
+ *                   are redistribution-contagious licenses that the host
+ *                   project (Apache-2.0) cannot safely link against.
+ *   - proprietary — explicit "PROPRIETARY" declarations.
+ *   - unknown     — missing licenses or the `"UNKNOWN"` sentinel emitted
+ *                   by the dependency phase when a manifest parser could
+ *                   not recover a declared license. A later release will
+ *                   populate real licenses from ecosystem metadata;
+ *                   until then most audits WILL return tier=WARN.
+ *
+ * Tier assignment:
+ *   BLOCK  — any copyleft OR any proprietary dep.
+ *   WARN   — no copyleft/proprietary, at least one unknown.
+ *   OK     — nothing flagged.
+ *
+ * Annotations are {readOnly, closedWorld, idempotent} — the tool only
+ * queries the graph.
+ */
+// biome-ignore-all lint/complexity/useLiteralKeys: dot-access disallowed on Record index signatures
+import { classifyDependencies } from "@opencodehub/analysis";
+import { toolErrorFromUnknown } from "../error-envelope.js";
+import { withNextSteps } from "../next-step-hints.js";
+import { stalenessFromMeta } from "../staleness.js";
+import { fromToolResult, repoArgShape, toToolResult, withStore, } from "./shared.js";
+const LicenseAuditInput = {
+    ...repoArgShape,
+};
+export async function runLicenseAudit(ctx, args) {
+    const call = await withStore(ctx, args, async (store, resolved) => {
+        try {
+            const all = await store.graph.listDependencies();
+            const deps = all.map((d) => ({
+                id: d.id,
+                name: d.name,
+                version: stringOr(d.version, "UNKNOWN"),
+                ecosystem: stringOr(d.ecosystem, "unknown"),
+                license: stringOr(d.license, "UNKNOWN"),
+                lockfileSource: stringOr(d.lockfileSource, d.filePath),
+            }));
+            const result = classifyDependencies(deps);
+            const header = `License audit for ${resolved.name}: tier=${result.tier} (${result.summary.okCount}/${result.summary.total} ok, ${result.summary.flaggedCount} flagged)`;
+            const bodyLines = [];
+            if (result.flagged.copyleft.length > 0) {
+                bodyLines.push(`Copyleft (${result.flagged.copyleft.length}):`, ...result.flagged.copyleft.map((d) => `  - [${d.ecosystem}] ${d.name}@${d.version} — ${d.license}`));
+            }
+            if (result.flagged.proprietary.length > 0) {
+                bodyLines.push(`Proprietary (${result.flagged.proprietary.length}):`, ...result.flagged.proprietary.map((d) => `  - [${d.ecosystem}] ${d.name}@${d.version} — ${d.license}`));
+            }
+            if (result.flagged.unknown.length > 0) {
+                bodyLines.push(`Unknown/missing (${result.flagged.unknown.length}):`, ...result.flagged.unknown
+                    .slice(0, 25)
+                    .map((d) => `  - [${d.ecosystem}] ${d.name}@${d.version}`));
+                if (result.flagged.unknown.length > 25) {
+                    bodyLines.push(`  ... ${result.flagged.unknown.length - 25} more (see structuredContent.flagged.unknown)`);
+                }
+            }
+            if (bodyLines.length === 0) {
+                bodyLines.push("All licenses cleared.");
+            }
+            const nextSteps = [];
+            if (result.tier === "BLOCK") {
+                nextSteps.push("review the copyleft/proprietary deps above — each must be replaced or explicitly approved by legal", "call `dependencies` with the offending ecosystem filter to see the full record");
+            }
+            else if (result.tier === "WARN") {
+                nextSteps.push("populate missing licenses: re-index with `codehub analyze --force` once the license-detection follow-up lands", "call `dependencies` to inspect the raw Dependency rows");
+            }
+            else {
+                nextSteps.push("no action required — re-run after bumping any dependency", "call `dependencies` to inspect the full list");
+            }
+            return withNextSteps([header, ...bodyLines].join("\n"), {
+                tier: result.tier,
+                flagged: result.flagged,
+                summary: result.summary,
+            }, nextSteps, stalenessFromMeta(resolved.meta));
+        }
+        catch (err) {
+            return toolErrorFromUnknown(err);
+        }
+    });
+    return toToolResult(call);
+}
+export function registerLicenseAuditTool(server, ctx) {
+    server.registerTool("license_audit", {
+        title: "Audit dependency licenses",
+        description: "Classify every Dependency node by license risk: copyleft (GPL/AGPL/SSPL/EUPL/CPAL/OSL/RPL), proprietary, unknown. Returns tier=BLOCK if any copyleft or proprietary dep, WARN if only unknowns, OK otherwise. Note: until per-ecosystem license detection lands, most Dependency nodes carry license='UNKNOWN', so most audits will return tier=WARN until that follow-up ships.",
+        inputSchema: LicenseAuditInput,
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            openWorldHint: false,
+            idempotentHint: true,
+        },
+    }, async (args) => fromToolResult(await runLicenseAudit(ctx, args)));
+}
+function stringOr(v, fallback) {
+    if (typeof v === "string")
+        return v;
+    if (typeof v === "number" || typeof v === "boolean")
+        return String(v);
+    return fallback;
+}
+//# sourceMappingURL=license-audit.js.map

package/dist/tools/license-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-audit.js","sourceRoot":"","sources":["../../src/tools/license-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,oGAAoG;AAGpG,OAAO,EAAE,oBAAoB,EAAsB,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,cAAc,EACd,YAAY,EAGZ,YAAY,EACZ,SAAS,GACV,MAAM,aAAa,CAAC;AAErB,MAAM,iBAAiB,GAAG;IACxB,GAAG,YAAY;CAChB,CAAC;AAOF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAgB,EAChB,IAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;QAChE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;YACjD,MAAM,IAAI,GAAoB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC5C,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC;gBACvC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC;gBAC3C,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC;gBACvC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC;aACvD,CAAC,CAAC,CAAC;YAEJ,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,qBAAqB,QAAQ,CAAC,IAAI,UAAU,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ,MAAM,CAAC,OAAO,CAAC,YAAY,WAAW,CAAC;YACxK,MAAM,SAAS,GAAa,EAAE,CAAC;YAC/B,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvC,SAAS,CAAC,IAAI,CACZ,aAAa,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,IAAI,EAC/C,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,OAAO,EAAE,CACpE,CACF,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1C,SAAS,CAAC,IAAI,CACZ,gBAAgB,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,IAAI,EACrD,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,OAAO,EAAE,CACpE,CACF,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtC,SAAS,CAAC,IAAI,CACZ,oBAAoB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EACrD,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO;qBACtB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;qBACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAC7D,CAAC;gBACF,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;oBACvC,SAAS,CAAC,IAAI,CACZ,SAAS,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,+CAA+C,CAC3F,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,SAAS,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,SAAS,GAAa,EAAE,CAAC;YAC/B,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,SAAS,CAAC,IAAI,CACZ,oGAAoG,EACpG,gFAAgF,CACjF,CAAC;YACJ,CAAC;iBAAM,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAClC,SAAS,CAAC,IAAI,CACZ,+GAA+G,EAC/G,wDAAwD,CACzD,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,IAAI,CACZ,0DAA0D,EAC1D,8CAA8C,CAC/C,CAAC;YACJ,CAAC;YAED,OAAO,aAAa,CAClB,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EACjC;gBACE,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,EACD,SAAS,EACT,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CACjC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAiB,EAAE,GAAgB;IAC1E,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,2BAA2B;QAClC,WAAW,EACT,kXAAkX;QACpX,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,aAAa,EAAE,KAAK;YACpB,cAAc,EAAE,IAAI;SACrB;KACF,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CACjE,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU,EAAE,QAAgB;IAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/tools/list-dead-code.d.ts

@@ -0,0 +1,26 @@
+/**
+ * `list_dead_code` — enumerate dead and unreachable-export symbols.
+ *
+ * Thin wrapper over {@link classifyDeadness} from `@opencodehub/analysis`.
+ * Reports:
+ *   - `dead` symbols: non-exported, no inbound referrers.
+ *   - `unreachableExports` (opt-in): exported symbols with no cross-module
+ *     referrer.
+ *   - `ghostCommunities`: Leiden communities whose every member is non-live.
+ *
+ * Read-only, closed-world, idempotent — consuming the classifier twice with
+ * the same inputs returns an identical result.
+ */
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { type ToolContext, type ToolResult } from "./shared.js";
+interface ListDeadCodeArgs {
+    readonly repo?: string | undefined;
+    readonly repo_uri?: string | undefined;
+    readonly includeUnreachableExports?: boolean | undefined;
+    readonly limit?: number | undefined;
+    readonly filePathPattern?: string | undefined;
+}
+export declare function runListDeadCode(ctx: ToolContext, args: ListDeadCodeArgs): Promise<ToolResult>;
+export declare function registerListDeadCodeTool(server: McpServer, ctx: ToolContext): void;
+export {};
+//# sourceMappingURL=list-dead-code.d.ts.map

package/dist/tools/list-dead-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-dead-code.d.ts","sourceRoot":"","sources":["../../src/tools/list-dead-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAMzE,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,UAAU,EAGhB,MAAM,aAAa,CAAC;AAuBrB,UAAU,gBAAgB;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/C;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,UAAU,CAAC,CA8ErB;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,GAAG,IAAI,CAiBlF"}

package/dist/tools/list-dead-code.js

@@ -0,0 +1,110 @@
+/**
+ * `list_dead_code` — enumerate dead and unreachable-export symbols.
+ *
+ * Thin wrapper over {@link classifyDeadness} from `@opencodehub/analysis`.
+ * Reports:
+ *   - `dead` symbols: non-exported, no inbound referrers.
+ *   - `unreachableExports` (opt-in): exported symbols with no cross-module
+ *     referrer.
+ *   - `ghostCommunities`: Leiden communities whose every member is non-live.
+ *
+ * Read-only, closed-world, idempotent — consuming the classifier twice with
+ * the same inputs returns an identical result.
+ */
+import { classifyDeadness } from "@opencodehub/analysis";
+import { z } from "zod";
+import { toolErrorFromUnknown } from "../error-envelope.js";
+import { withNextSteps } from "../next-step-hints.js";
+import { stalenessFromMeta } from "../staleness.js";
+import { fromToolResult, repoArgShape, toToolResult, withStore, } from "./shared.js";
+const ListDeadCodeInput = {
+    ...repoArgShape,
+    includeUnreachableExports: z
+        .boolean()
+        .optional()
+        .describe("When true, include exported symbols with no cross-module referrer in the `symbols` list. Default false."),
+    limit: z
+        .number()
+        .int()
+        .positive()
+        .max(10_000)
+        .optional()
+        .describe("Maximum number of symbols to return (default 100, max 10000)."),
+    filePathPattern: z
+        .string()
+        .optional()
+        .describe("Substring filter applied to each symbol's file path."),
+};
+export async function runListDeadCode(ctx, args) {
+    const limit = args.limit ?? 100;
+    const includeUnreachable = args.includeUnreachableExports ?? false;
+    const pattern = args.filePathPattern;
+    const call = await withStore(ctx, args, async (store, resolved) => {
+        try {
+            const result = await classifyDeadness(store.graph);
+            const filterByPath = (s) => pattern === undefined || s.filePath.includes(pattern);
+            const dead = result.dead.filter(filterByPath);
+            const unreachable = result.unreachableExports.filter(filterByPath);
+            const combined = includeUnreachable ? [...dead, ...unreachable] : [...dead];
+            const truncated = combined.slice(0, limit);
+            const summary = {
+                dead: result.dead.length,
+                unreachableExports: result.unreachableExports.length,
+                ghostCommunities: result.ghostCommunities.length,
+            };
+            const header = `Dead code in ${resolved.name}: ${summary.dead} dead · ${summary.unreachableExports} unreachable exports · ${summary.ghostCommunities} ghost communities.`;
+            const lines = [header];
+            if (truncated.length === 0) {
+                lines.push("(no non-live symbols match the filter)");
+            }
+            else {
+                lines.push(`Showing ${truncated.length} of ${combined.length}${pattern ? ` · filePath~${pattern}` : ""}:`);
+                for (const s of truncated) {
+                    lines.push(`  • [${s.deadness}] ${s.name} [${s.kind}] — ${s.filePath}:${s.startLine}`);
+                }
+            }
+            if (result.ghostCommunities.length > 0) {
+                lines.push(`Ghost communities (${result.ghostCommunities.length}):`);
+                for (const c of result.ghostCommunities.slice(0, 20)) {
+                    lines.push(`  ⊿ ${c}`);
+                }
+            }
+            const next = [];
+            if (summary.dead > 0) {
+                next.push("call `remove_dead_code` with dryRun=true to preview the deletion edit plan");
+            }
+            if (!includeUnreachable && summary.unreachableExports > 0) {
+                next.push("re-run with includeUnreachableExports=true to inspect exported-but-unreferenced symbols");
+            }
+            if (summary.ghostCommunities > 0) {
+                next.push("use `context` on a ghost community member to confirm it is truly unreferenced before deletion");
+            }
+            if (next.length === 0) {
+                next.push("graph is clean — no dead code detected");
+            }
+            return withNextSteps(lines.join("\n"), {
+                summary,
+                symbols: truncated,
+                ghostCommunities: [...result.ghostCommunities],
+            }, next, stalenessFromMeta(resolved.meta));
+        }
+        catch (err) {
+            return toolErrorFromUnknown(err);
+        }
+    });
+    return toToolResult(call);
+}
+export function registerListDeadCodeTool(server, ctx) {
+    server.registerTool("list_dead_code", {
+        title: "List dead and unreachable-export symbols",
+        description: "Classify every callable / type in the indexed graph as live, dead, or unreachable-export and return the non-live set. Also surfaces ghost communities — Leiden clusters whose every member is classified non-live.",
+        inputSchema: ListDeadCodeInput,
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+    }, async (args) => fromToolResult(await runListDeadCode(ctx, args)));
+}
+//# sourceMappingURL=list-dead-code.js.map

package/dist/tools/list-dead-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-dead-code.js","sourceRoot":"","sources":["../../src/tools/list-dead-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,gBAAgB,EAAmB,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,cAAc,EACd,YAAY,EAGZ,YAAY,EACZ,SAAS,GACV,MAAM,aAAa,CAAC;AAErB,MAAM,iBAAiB,GAAG;IACxB,GAAG,YAAY;IACf,yBAAyB,EAAE,CAAC;SACzB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,yGAAyG,CAC1G;IACH,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CAAC,MAAM,CAAC;SACX,QAAQ,EAAE;SACV,QAAQ,CAAC,+DAA+D,CAAC;IAC5E,eAAe,EAAE,CAAC;SACf,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,sDAAsD,CAAC;CACpE,CAAC;AAUF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAgB,EAChB,IAAsB;IAEtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC;IAChC,MAAM,kBAAkB,GAAG,IAAI,CAAC,yBAAyB,IAAI,KAAK,CAAC;IACnE,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC;IAErC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;QAChE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAEnD,MAAM,YAAY,GAAG,CAAC,CAAa,EAAW,EAAE,CAC9C,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAExD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC9C,MAAM,WAAW,GAAG,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAEnE,MAAM,QAAQ,GAAiB,kBAAkB,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1F,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAE3C,MAAM,OAAO,GAAG;gBACd,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBACxB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,CAAC,MAAM;gBACpD,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,CAAC,MAAM;aACjD,CAAC;YAEF,MAAM,MAAM,GAAG,gBAAgB,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,WAAW,OAAO,CAAC,kBAAkB,0BAA0B,OAAO,CAAC,gBAAgB,qBAAqB,CAAC;YAC1K,MAAM,KAAK,GAAa,CAAC,MAAM,CAAC,CAAC;YACjC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CACR,WAAW,SAAS,CAAC,MAAM,OAAO,QAAQ,CAAC,MAAM,GAC/C,OAAO,CAAC,CAAC,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC,CAAC,EACvC,GAAG,CACJ,CAAC;gBACF,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;oBAC1B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;gBACzF,CAAC;YACH,CAAC;YACD,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvC,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,CAAC;gBACrE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;oBACrD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;YAED,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBACrB,IAAI,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;YAC1F,CAAC;YACD,IAAI,CAAC,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,GAAG,CAAC,EAAE,CAAC;gBAC1D,IAAI,CAAC,IAAI,CACP,yFAAyF,CAC1F,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,IAAI,CACP,+FAA+F,CAChG,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;YACtD,CAAC;YAED,OAAO,aAAa,CAClB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAChB;gBACE,OAAO;gBACP,OAAO,EAAE,SAAS;gBAClB,gBAAgB,EAAE,CAAC,GAAG,MAAM,CAAC,gBAAgB,CAAC;aAC/C,EACD,IAAI,EACJ,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CACjC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAiB,EAAE,GAAgB;IAC1E,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,0CAA0C;QACjD,WAAW,EACT,oNAAoN;QACtN,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CACjE,CAAC;AACJ,CAAC"}

package/dist/tools/list-findings-delta.d.ts

@@ -0,0 +1,36 @@
+/**
+ * `list_findings_delta` — expose the SARIF baseline diff as an MCP tool.
+ *
+ * The SARIF baseline snapshot lives at `<repo>/.codehub/baseline.sarif`
+ * (frozen via `codehub baseline freeze`); the latest scan lives at
+ * `<repo>/.codehub/scan.sarif` (written by `codehub scan` / the `scan`
+ * tool). This tool reads both, runs {@link diffSarif}, and returns the
+ * four buckets (`new`, `fixed`, `unchanged`, `updated`) reshaped into an
+ * agent-friendly per-finding view keyed on the `opencodehub/v1` partial
+ * fingerprint.
+ *
+ * Annotation rationale:
+ *   readOnlyHint    = true   — reads two SARIF files; writes nothing.
+ *   destructiveHint = false  — no mutations.
+ *   openWorldHint   = false  — no external processes or network.
+ *   idempotentHint  = true   — same inputs → same buckets every call.
+ *
+ * Error handling:
+ *   - Missing `.codehub/scan.sarif` → tool-level error with a "run
+ *     `codehub scan` first" hint.
+ *   - Missing baseline → every current finding bucketed as `new` with a
+ *     `warning` surfaced alongside the payload so the agent knows the
+ *     baseline has never been frozen.
+ *   - Corrupt SARIF JSON / schema violation → `SCHEMA_MISMATCH` envelope.
+ */
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { type ToolContext, type ToolResult } from "./shared.js";
+interface ListFindingsDeltaArgs {
+    readonly repo?: string | undefined;
+    readonly repo_uri?: string | undefined;
+    readonly baseline?: string | undefined;
+}
+export declare function runListFindingsDelta(ctx: ToolContext, args: ListFindingsDeltaArgs): Promise<ToolResult>;
+export declare function registerListFindingsDeltaTool(server: McpServer, ctx: ToolContext): void;
+export {};
+//# sourceMappingURL=list-findings-delta.d.ts.map

package/dist/tools/list-findings-delta.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-findings-delta.d.ts","sourceRoot":"","sources":["../../src/tools/list-findings-delta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAazE,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,UAAU,EAGhB,MAAM,aAAa,CAAC;AA8CrB,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,UAAU,CAAC,CAiHrB;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,GAAG,IAAI,CAiBvF"}

package/dist/tools/list-findings-delta.js

@@ -0,0 +1,274 @@
+/**
+ * `list_findings_delta` — expose the SARIF baseline diff as an MCP tool.
+ *
+ * The SARIF baseline snapshot lives at `<repo>/.codehub/baseline.sarif`
+ * (frozen via `codehub baseline freeze`); the latest scan lives at
+ * `<repo>/.codehub/scan.sarif` (written by `codehub scan` / the `scan`
+ * tool). This tool reads both, runs {@link diffSarif}, and returns the
+ * four buckets (`new`, `fixed`, `unchanged`, `updated`) reshaped into an
+ * agent-friendly per-finding view keyed on the `opencodehub/v1` partial
+ * fingerprint.
+ *
+ * Annotation rationale:
+ *   readOnlyHint    = true   — reads two SARIF files; writes nothing.
+ *   destructiveHint = false  — no mutations.
+ *   openWorldHint   = false  — no external processes or network.
+ *   idempotentHint  = true   — same inputs → same buckets every call.
+ *
+ * Error handling:
+ *   - Missing `.codehub/scan.sarif` → tool-level error with a "run
+ *     `codehub scan` first" hint.
+ *   - Missing baseline → every current finding bucketed as `new` with a
+ *     `warning` surfaced alongside the payload so the agent knows the
+ *     baseline has never been frozen.
+ *   - Corrupt SARIF JSON / schema violation → `SCHEMA_MISMATCH` envelope.
+ */
+// biome-ignore-all lint/complexity/useLiteralKeys: dot-access disallowed on Record index signatures
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { diffSarif, SarifLogSchema, } from "@opencodehub/sarif";
+import { resolveRepoMetaDir } from "@opencodehub/storage";
+import { z } from "zod";
+import { toolError, toolErrorFromUnknown } from "../error-envelope.js";
+import { withNextSteps } from "../next-step-hints.js";
+import { stalenessFromMeta } from "../staleness.js";
+import { fromToolResult, repoArgShape, toToolResult, withStore, } from "./shared.js";
+const ListFindingsDeltaInput = {
+    ...repoArgShape,
+    baseline: z
+        .string()
+        .optional()
+        .describe("Custom path to a baseline SARIF log. When omitted, defaults to `<repo>/.codehub/baseline.sarif`."),
+};
+const OPENCODEHUB_FINGERPRINT_KEY = "opencodehub/v1";
+const EMPTY_SARIF_LOG = {
+    version: "2.1.0",
+    runs: [],
+};
+export async function runListFindingsDelta(ctx, args) {
+    const call = await withStore(ctx, args, async (_store, resolved) => {
+        try {
+            const metaDir = resolveRepoMetaDir(resolved.repoPath);
+            const currentPath = resolve(`${metaDir}/scan.sarif`);
+            const baselinePath = resolve(args.baseline ?? `${metaDir}/baseline.sarif`);
+            const currentRead = await readSarif(currentPath);
+            if (currentRead.kind === "missing") {
+                return toolError("NOT_FOUND", `No scan log found at ${currentPath}`, "Run `codehub scan` (or the `scan` MCP tool) in the target repo to generate .codehub/scan.sarif before diffing.");
+            }
+            if (currentRead.kind === "invalid") {
+                return toolError("SCHEMA_MISMATCH", `scan.sarif at ${currentPath} failed SARIF 2.1.0 validation: ${currentRead.message}`, "Regenerate the scan log with `codehub scan`; the existing file may be truncated or from an older format.");
+            }
+            const baselineRead = await readSarif(baselinePath);
+            const warnings = [];
+            let diff;
+            // Fast path: the current log already carries per-result
+            // `baselineState` tags (written by `codehub scan --baseline` and
+            // mirrored to the `baseline_state` column by `codehub ingest-sarif`).
+            // Reuse them instead of re-running the diff — the SARIF on disk is
+            // the source of truth for the `baseline_state` column, so reading
+            // from it is equivalent to reading from the column.
+            const tagged = reuseStoredBaselineStates(currentRead.log);
+            if (tagged !== undefined) {
+                diff = tagged;
+                if (baselineRead.kind === "missing") {
+                    warnings.push(`No baseline found at ${baselinePath}; returning baselineState tags already written by the most recent scan.`);
+                }
+            }
+            else if (baselineRead.kind === "missing") {
+                warnings.push(`No baseline found at ${baselinePath}; treating every current finding as new. Run \`codehub baseline freeze\` to establish a baseline.`);
+                diff = diffSarif(EMPTY_SARIF_LOG, currentRead.log);
+            }
+            else if (baselineRead.kind === "invalid") {
+                return toolError("SCHEMA_MISMATCH", `baseline.sarif at ${baselinePath} failed SARIF 2.1.0 validation: ${baselineRead.message}`, "Re-freeze the baseline with `codehub baseline freeze`; the existing file may be truncated or from an older format.");
+            }
+            else {
+                diff = diffSarif(baselineRead.log, currentRead.log);
+            }
+            const findings = {
+                new: diff.new.map((r) => toRow(r, "new")),
+                fixed: diff.fixed.map((r) => toRow(r, "fixed")),
+                unchanged: diff.unchanged.map((r) => toRow(r, "unchanged")),
+                updated: diff.updated.map((r) => toRow(r, "updated")),
+            };
+            const summary = {
+                new: findings.new.length,
+                fixed: findings.fixed.length,
+                unchanged: findings.unchanged.length,
+                updated: findings.updated.length,
+            };
+            const header = `Findings delta for ${resolved.name}: ${summary.new} new · ${summary.fixed} fixed · ${summary.unchanged} unchanged · ${summary.updated} updated`;
+            const lines = [header];
+            if (warnings.length > 0) {
+                for (const w of warnings)
+                    lines.push(`Warning: ${w}`);
+            }
+            if (summary.new > 0) {
+                lines.push("New findings:");
+                for (const row of findings.new.slice(0, 25)) {
+                    lines.push(formatRow(row));
+                }
+                if (findings.new.length > 25) {
+                    lines.push(`  … and ${findings.new.length - 25} more`);
+                }
+            }
+            const next = summary.new > 0
+                ? [
+                    "call `context` with a new finding's filePath for caller/callee neighbours",
+                    "call `verdict` to see how the delta maps to a PR decision",
+                ]
+                : summary.fixed > 0
+                    ? ["call `baseline freeze` via the CLI to adopt the improved state as the new baseline"]
+                    : [
+                        "call `list_findings` for the full non-delta finding list",
+                        "call `scan` to refresh .codehub/scan.sarif",
+                    ];
+            return withNextSteps(lines.join("\n"), {
+                summary,
+                findings,
+                baselinePath,
+                currentPath,
+                warnings,
+            }, next, stalenessFromMeta(resolved.meta));
+        }
+        catch (err) {
+            return toolErrorFromUnknown(err);
+        }
+    });
+    return toToolResult(call);
+}
+export function registerListFindingsDeltaTool(server, ctx) {
+    server.registerTool("list_findings_delta", {
+        title: "Diff SARIF findings against baseline",
+        description: "Diff the latest scan (`.codehub/scan.sarif`) against the frozen baseline (`.codehub/baseline.sarif` by default) and return findings bucketed into new / fixed / unchanged / updated, keyed on `partialFingerprints['opencodehub/v1']`. Read-only: reads SARIF files, writes nothing.",
+        inputSchema: ListFindingsDeltaInput,
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            openWorldHint: false,
+            idempotentHint: true,
+        },
+    }, async (args) => fromToolResult(await runListFindingsDelta(ctx, args)));
+}
+async function readSarif(path) {
+    let raw;
+    try {
+        raw = await readFile(path, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return { kind: "missing" };
+        throw err;
+    }
+    let parsedJson;
+    try {
+        parsedJson = JSON.parse(raw);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return { kind: "invalid", message: `JSON parse error: ${message}` };
+    }
+    const validated = SarifLogSchema.safeParse(parsedJson);
+    if (!validated.success) {
+        return { kind: "invalid", message: validated.error.message };
+    }
+    return { kind: "ok", log: validated.data };
+}
+function toRow(result, state) {
+    const physical = result.locations?.[0]?.physicalLocation;
+    const uri = typeof physical?.artifactLocation.uri === "string" ? physical.artifactLocation.uri : "";
+    const startLine = physical?.region?.startLine;
+    const severity = typeof result.level === "string" ? result.level : "none";
+    const messageText = typeof result.message?.text === "string" ? result.message.text : "";
+    const fingerprint = fingerprintOf(result);
+    const scannerId = scannerIdOf(result);
+    const row = {
+        ruleId: typeof result.ruleId === "string" ? result.ruleId : "",
+        severity,
+        scannerId,
+        message: messageText,
+        filePath: uri,
+        baselineState: state,
+        ...(typeof startLine === "number" && Number.isFinite(startLine) ? { startLine } : {}),
+        ...(fingerprint !== undefined ? { fingerprint } : {}),
+    };
+    return row;
+}
+function fingerprintOf(result) {
+    const pf = result.partialFingerprints;
+    if (pf === undefined || pf === null)
+        return undefined;
+    const candidate = pf[OPENCODEHUB_FINGERPRINT_KEY];
+    return typeof candidate === "string" && candidate.length > 0 ? candidate : undefined;
+}
+/**
+ * Extract a scanner id for display purposes. SARIF does not carry a
+ * per-result scanner name (only per-run). We check the result properties
+ * bag first (opencodehub enrichment stashes the source tool there) and
+ * fall back to the rule id's prefix when that is absent.
+ */
+function scannerIdOf(result) {
+    const props = result.properties;
+    if (props !== undefined && props !== null) {
+        const ocProps = props["opencodehub"];
+        if (ocProps !== null && typeof ocProps === "object") {
+            const scannerId = ocProps["scannerId"];
+            if (typeof scannerId === "string" && scannerId.length > 0)
+                return scannerId;
+        }
+        const flat = props["scannerId"];
+        if (typeof flat === "string" && flat.length > 0)
+            return flat;
+    }
+    const ruleId = typeof result.ruleId === "string" ? result.ruleId : "";
+    const dot = ruleId.indexOf(".");
+    if (dot > 0)
+        return ruleId.slice(0, dot);
+    return "unknown";
+}
+function formatRow(row) {
+    const loc = row.startLine !== undefined ? `${row.filePath}:${row.startLine}` : row.filePath;
+    const msg = row.message ? ` — ${row.message}` : "";
+    return `  - [${row.severity}] ${row.scannerId}:${row.ruleId} at ${loc}${msg}`;
+}
+/**
+ * Walk every SARIF result in `log`; if at least one result carries a
+ * `baselineState` tag, rebuild a {@link DiffResult} directly from those
+ * tags without re-running the diff. Returns `undefined` when no tags are
+ * present so the caller can fall back to the full diff path.
+ *
+ * Baseline-only findings (`fixed`) aren't re-emitted by the scanner path,
+ * so the `fixed` bucket is always empty here — consumers that need it
+ * must still run the full diff against a frozen baseline.
+ */
+function reuseStoredBaselineStates(log) {
+    const newR = [];
+    const unchanged = [];
+    const updated = [];
+    let anyTagged = false;
+    for (const run of log.runs) {
+        const results = run.results;
+        if (!Array.isArray(results))
+            continue;
+        for (const r of results) {
+            if (r === undefined)
+                continue;
+            const tag = r.baselineState;
+            if (tag === "new") {
+                newR.push(r);
+                anyTagged = true;
+            }
+            else if (tag === "unchanged") {
+                unchanged.push(r);
+                anyTagged = true;
+            }
+            else if (tag === "updated") {
+                updated.push(r);
+                anyTagged = true;
+            }
+        }
+    }
+    if (!anyTagged)
+        return undefined;
+    return { new: newR, fixed: [], unchanged, updated };
+}
+//# sourceMappingURL=list-findings-delta.js.map

package/dist/tools/list-findings-delta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-findings-delta.js","sourceRoot":"","sources":["../../src/tools/list-findings-delta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,oGAAoG;AAEpG,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAEL,SAAS,EAET,cAAc,GAEf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,cAAc,EACd,YAAY,EAGZ,YAAY,EACZ,SAAS,GACV,MAAM,aAAa,CAAC;AAErB,MAAM,sBAAsB,GAAG;IAC7B,GAAG,YAAY;IACf,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,kGAAkG,CACnG;CACJ,CAAC;AA6BF,MAAM,2BAA2B,GAAG,gBAAgB,CAAC;AAErD,MAAM,eAAe,GAAa;IAChC,OAAO,EAAE,OAAO;IAChB,IAAI,EAAE,EAAE;CACT,CAAC;AAQF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAgB,EAChB,IAA2B;IAE3B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE;QACjE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,OAAO,aAAa,CAAC,CAAC;YACrD,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,GAAG,OAAO,iBAAiB,CAAC,CAAC;YAE3E,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;YACjD,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACnC,OAAO,SAAS,CACd,WAAW,EACX,wBAAwB,WAAW,EAAE,EACrC,gHAAgH,CACjH,CAAC;YACJ,CAAC;YACD,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACnC,OAAO,SAAS,CACd,iBAAiB,EACjB,iBAAiB,WAAW,mCAAmC,WAAW,CAAC,OAAO,EAAE,EACpF,0GAA0G,CAC3G,CAAC;YACJ,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,IAAI,IAAgB,CAAC;YACrB,wDAAwD;YACxD,iEAAiE;YACjE,sEAAsE;YACtE,mEAAmE;YACnE,kEAAkE;YAClE,oDAAoD;YACpD,MAAM,MAAM,GAAG,yBAAyB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAC1D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,GAAG,MAAM,CAAC;gBACd,IAAI,YAAY,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBACpC,QAAQ,CAAC,IAAI,CACX,wBAAwB,YAAY,yEAAyE,CAC9G,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,IAAI,YAAY,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3C,QAAQ,CAAC,IAAI,CACX,wBAAwB,YAAY,mGAAmG,CACxI,CAAC;gBACF,IAAI,GAAG,SAAS,CAAC,eAAe,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;YACrD,CAAC;iBAAM,IAAI,YAAY,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3C,OAAO,SAAS,CACd,iBAAiB,EACjB,qBAAqB,YAAY,mCAAmC,YAAY,CAAC,OAAO,EAAE,EAC1F,oHAAoH,CACrH,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;YACtD,CAAC;YAED,MAAM,QAAQ,GAAkB;gBAC9B,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBACzC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBAC/C,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;gBAC3D,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;aACtD,CAAC;YACF,MAAM,OAAO,GAAiB;gBAC5B,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM;gBACxB,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;gBAC5B,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM;gBACpC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;aACjC,CAAC;YAEF,MAAM,MAAM,GAAG,sBAAsB,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,GAAG,UAAU,OAAO,CAAC,KAAK,YAAY,OAAO,CAAC,SAAS,gBAAgB,OAAO,CAAC,OAAO,UAAU,CAAC;YAChK,MAAM,KAAK,GAAa,CAAC,MAAM,CAAC,CAAC;YACjC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,KAAK,MAAM,CAAC,IAAI,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBAC5B,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;oBAC5C,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC7B,CAAC;gBACD,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;oBAC7B,KAAK,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC;YAED,MAAM,IAAI,GACR,OAAO,CAAC,GAAG,GAAG,CAAC;gBACb,CAAC,CAAC;oBACE,2EAA2E;oBAC3E,2DAA2D;iBAC5D;gBACH,CAAC,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC;oBACjB,CAAC,CAAC,CAAC,oFAAoF,CAAC;oBACxF,CAAC,CAAC;wBACE,0DAA0D;wBAC1D,4CAA4C;qBAC7C,CAAC;YAEV,OAAO,aAAa,CAClB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAChB;gBACE,OAAO;gBACP,QAAQ;gBACR,YAAY;gBACZ,WAAW;gBACX,QAAQ;aACT,EACD,IAAI,EACJ,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CACjC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAAiB,EAAE,GAAgB;IAC/E,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,KAAK,EAAE,sCAAsC;QAC7C,WAAW,EACT,sRAAsR;QACxR,WAAW,EAAE,sBAAsB;QACnC,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,aAAa,EAAE,KAAK;YACpB,cAAc,EAAE,IAAI;SACrB;KACF,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CACtE,CAAC;AACJ,CAAC;AAOD,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACjF,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,UAAmB,CAAC;IACxB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,OAAO,EAAE,EAAE,CAAC;IACtE,CAAC;IACD,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,KAAK,CAAC,MAAmB,EAAE,KAAuB;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC;IACzD,MAAM,GAAG,GACP,OAAO,QAAQ,EAAE,gBAAgB,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1F,MAAM,SAAS,GAAG,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1E,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,OAAO,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAEtC,MAAM,GAAG,GAAoB;QAC3B,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QAC9D,QAAQ;QACR,SAAS;QACT,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,GAAG;QACb,aAAa,EAAE,KAAK;QACpB,GAAG,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,MAAmB;IACxC,MAAM,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC;IACtC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,SAAS,GAAI,EAA8B,CAAC,2BAA2B,CAAC,CAAC;IAC/E,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACvF,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,MAAmB;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAI,KAAiC,CAAC,aAAa,CAAC,CAAC;QAClE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,SAAS,GAAI,OAAmC,CAAC,WAAW,CAAC,CAAC;YACpE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;QAC9E,CAAC;QACD,MAAM,IAAI,GAAI,KAAiC,CAAC,WAAW,CAAC,CAAC;QAC7D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/D,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,GAAoB;IACrC,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC5F,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,OAAO,QAAQ,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,OAAO,GAAG,GAAG,GAAG,EAAE,CAAC;AAChF,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,yBAAyB,CAAC,GAAa;IAC9C,MAAM,IAAI,GAAkB,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAkB,EAAE,CAAC;IACpC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,SAAS;gBAAE,SAAS;YAC9B,MAAM,GAAG,GAAI,CAA+C,CAAC,aAAa,CAAC;YAC3E,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;gBAClB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACb,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;iBAAM,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;gBAC/B,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;iBAAM,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AACtD,CAAC"}

package/dist/tools/list-findings.d.ts

@@ -0,0 +1,30 @@
+/**
+ * `list_findings` — enumerate Finding nodes for an indexed repo.
+ *
+ * Finding nodes are produced by `codehub ingest-sarif` (or `codehub scan`
+ * via its built-in ingestion step). Every node carries `scanner_id`,
+ * `rule_id`, `severity`, and `message` plus a flat `properties_bag`
+ * JSON string for the scanner's custom properties.
+ *
+ * Filters (all optional):
+ *   - `severity`  — restrict to one SARIF level.
+ *   - `scanner`   — restrict to a single scanner id.
+ *   - `ruleId`    — restrict to a single rule id.
+ *   - `filePath`  — substring match against `file_path`.
+ *   - `limit`     — row cap (default 500, max 10_000).
+ */
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { type ToolContext, type ToolResult } from "./shared.js";
+interface ListFindingsArgs {
+    readonly repo?: string | undefined;
+    readonly repo_uri?: string | undefined;
+    readonly severity?: "error" | "warning" | "note" | "none" | undefined;
+    readonly scanner?: string | undefined;
+    readonly ruleId?: string | undefined;
+    readonly filePath?: string | undefined;
+    readonly limit?: number | undefined;
+}
+export declare function runListFindings(ctx: ToolContext, args: ListFindingsArgs): Promise<ToolResult>;
+export declare function registerListFindingsTool(server: McpServer, ctx: ToolContext): void;
+export {};
+//# sourceMappingURL=list-findings.d.ts.map

package/dist/tools/list-findings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-findings.d.ts","sourceRoot":"","sources":["../../src/tools/list-findings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAKzE,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,UAAU,EAGhB,MAAM,aAAa,CAAC;AAsCrB,UAAU,gBAAgB;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACtE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,UAAU,CAAC,CAqFrB;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,GAAG,IAAI,CAiBlF"}