@orangepro/orangepro-mcp 0.2.11 → 0.2.13

package/README.md

@@ -1,9 +1,27 @@
-# OrangePro
+# OrangePro MCP
+
+[![npm version](https://badge.fury.io/js/@orangepro%2Fmcp-server.svg )](https://www.npmjs.com/package/@orangepro/mcp-server )
+[![MIT License](https://img.shields.io/badge/license-MIT-green.svg )](LICENSE)
+[![npm downloads](https://img.shields.io/npm/dw/@orangepro/mcp-server.svg )](https://www.npmjs.com/package/@orangepro/mcp-server )
+[![orangepro-mcp MCP server](https://glama.ai/mcp/servers/OrangeproAI/orangepro-mcp/badges/score.svg )](https://glama.ai/mcp/servers/OrangeproAI/orangepro-mcp )
 
 **Find the behaviors your tests miss. Generate grounded tests that actually run.**
 
 `opro` builds a knowledge graph from your local checkout, maps every behavior in your code, shows which ones are tested and which aren't, and generates integration-level tests grounded in real symbols — not hallucinated imports. It runs as a CLI and a local stdio MCP server.
 
+Once you run the mcp server against a repo, you can get behavior-coverage/html
+**<a href="https://orangeproai.github.io/orangepro-mcp/twenty-crm-behavior-coverage.html" target="_blank">→ Live example: Twenty CRM behavior coverage report</a>**
+
+<img width="895" alt="OrangePro system map — entry lanes, services, evidence tiers" src="https://github.com/user-attachments/assets/1ceba779-e0ec-4ec1-99ce-001bc3589b42" />
+
+*Fig 1: System map — entry lanes (GraphQL, HTTP, Jobs) flowing into services, sized by traffic, colored by evidence tier, red-ringed by risk.*
+
+<img width="818" height="1284" alt="Screenshot 2026-07-30 at 4 38 35 PM" src="https://github.com/user-attachments/assets/1c41475d-be2a-4c6d-ace6-c6546573bf97" />
+
+
+*Fig 2: Priority gaps — top 20 unproven behaviors ranked by blast radius, with generated test drafts and applicable testing categories.*
+
+---
 Install the target repository's dependencies first, then run OrangePro from that repository:
 
 ```bash
@@ -35,7 +53,6 @@ orangepro_generated/         ← contained generated tests; existing source file
 The report opens on a **system map** of your repo — entry lanes (GraphQL/HTTP/Jobs) flowing into the services they reach, sized by traffic, colored by evidence tier, risk-ringed — identical on every run. Each completed rerun shows a **delta banner** against the previous completed run. The report discloses when bounded path enumeration prunes additional branch expansions. Every behavior gets a plain-English description; every top risk gets a deterministic context line and a state-aware next step.
 
 Run `opro export` when you want a machine-readable evidence pack.
-<img width="895" height="960" alt="Screenshot 2026-07-08 at 1 18 01 AM" src="https://github.com/user-attachments/assets/73b8a812-2eab-43a1-8aed-4289545e630b" />
 
 ---
 

package/dist/local/generate/generator.js

@@ -11,6 +11,7 @@ import { GENERATED_DIR } from "./runHints.js";
 import { behaviorNodes, findNode, nodesByKind, priorityRank } from "../graph/factories.js";
 import { structurallyUnconfirmable } from "../graph/confirmable.js";
 import { shortHash } from "../util/hash.js";
+import { targetFingerprint } from "../ledger.js";
 import { reportProgress } from "../util/progress.js";
 import { redactSecrets, redactSecretsPreservingLineCount } from "../util/redact.js";
 import { systemClock } from "../util/time.js";
@@ -2042,6 +2043,25 @@ function planGroundedBuckets(graph, targets, framework, fileReader, limit, expli
     }
     return plan;
 }
+/**
+ * Previously generated drafts that may be reused verbatim for `behavior`: the
+ * newest run's RUNNABLE, non-stale drafts recorded against the target's CURRENT
+ * fingerprint. A missing fingerprint (unanalyzed file, unparseable id) pins
+ * nothing — the conservative direction is to regenerate, never to serve a draft
+ * whose target we cannot prove is unchanged.
+ */
+function pinnedDraftsFor(graph, behavior, fingerprint) {
+    if (!fingerprint || behavior.kind !== "CodeSymbol")
+        return [];
+    const matches = (graph.generated_tests ?? []).filter((t) => t.target_symbol_external_id === behavior.external_id &&
+        t.target_fingerprint === fingerprint &&
+        t.runnable !== false &&
+        t.stale !== true);
+    if (matches.length === 0)
+        return [];
+    const latestRunId = matches[matches.length - 1].run_id;
+    return matches.filter((t) => t.run_id === latestRunId);
+}
 /**
  * Select the same target behaviors + gathered context for the A/B comparison, so
  * both arms target identical behaviors and differ ONLY in whether the KG evidence
@@ -2067,7 +2087,7 @@ export async function generateTests(graph, opts, provider, fileReader, clock = s
     const { targets, warnings } = selectTargets(graph, opts);
     const framework = pickFramework(graph, opts, targets, fileReader);
     const runSelection = targetsForFramework(graph, targets, framework);
-    const runTargets = runSelection.targets;
+    let runTargets = runSelection.targets;
     warnings.push(...runSelection.warnings);
     const systemPrompt = opts.systemPrompt ?? buildSystemPrompt();
     const promptVersion = inputMode === "graph_grounded" && opts.prompt_version === "v5" ? PROMPT_VERSION_V5 : PROMPT_VERSION;
@@ -2076,6 +2096,24 @@ export async function generateTests(graph, opts, provider, fileReader, clock = s
     const run_id = `local-gen-${runSeed}`;
     const generated = [];
     const missing = [];
+    // Pin: a target whose code is byte-identical to what a previously RUNNABLE draft
+    // was written against gets that draft back verbatim — no model call, no new
+    // persisted record, no drift in what the agent is told to run. Regeneration
+    // resumes the moment the target's fingerprint changes.
+    const fingerprintOf = (behavior) => behavior.kind === "CodeSymbol" ? targetFingerprint(graph, behavior.external_id) : undefined;
+    if (opts.pin_unchanged && inputMode === "graph_grounded") {
+        const remaining = [];
+        for (const behavior of runTargets) {
+            const pinned = pinnedDraftsFor(graph, behavior, fingerprintOf(behavior));
+            if (pinned.length === 0 || generated.length >= limit) {
+                remaining.push(behavior);
+                continue;
+            }
+            generated.push(...pinned.slice(0, limit - generated.length).map((t) => ({ ...t, pinned: true })));
+            warnings.push(`Reused ${pinned.length} pinned draft(s) for "${behavior.title || behavior.external_id}" — the target is unchanged since they were generated (no model call).`);
+        }
+        runTargets = remaining;
+    }
     if (inputMode === "raw_prompt") {
         // Internal baseline only: broad sampling, one raw test per target (no buckets).
         // Cap ATTEMPTS (not successes): with empty completions skipped below, capping
@@ -2439,6 +2477,7 @@ export async function generateTests(graph, opts, provider, fileReader, clock = s
                         grounding: { entity_ids: gc.entityIds, source_refs: [], weak_relationships_used: [] },
                         weak_evidence_used: false,
                         target_symbol_external_id: behavior.external_id,
+                        ...(fingerprintOf(behavior) ? { target_fingerprint: fingerprintOf(behavior) } : {}),
                         runnable: false,
                         unresolved_reason: reason
                     });
@@ -2460,7 +2499,9 @@ export async function generateTests(graph, opts, provider, fileReader, clock = s
                         import_provenance
                     },
                     weak_evidence_used: gc.weakUsed.length > 0,
-                    ...(behavior.kind === "CodeSymbol" ? { target_symbol_external_id: behavior.external_id } : {}),
+                    ...(behavior.kind === "CodeSymbol"
+                        ? { target_symbol_external_id: behavior.external_id, ...(fingerprintOf(behavior) ? { target_fingerprint: fingerprintOf(behavior) } : {}) }
+                        : {}),
                     runnable: true
                 });
             }
@@ -2631,7 +2672,12 @@ export async function generateTests(graph, opts, provider, fileReader, clock = s
                     import_provenance
                 },
                 weak_evidence_used: item.weakUsed.length > 0,
-                ...(item.behavior.kind === "CodeSymbol" ? { target_symbol_external_id: item.behavior.external_id } : {}),
+                ...(item.behavior.kind === "CodeSymbol"
+                    ? {
+                        target_symbol_external_id: item.behavior.external_id,
+                        ...(fingerprintOf(item.behavior) ? { target_fingerprint: fingerprintOf(item.behavior) } : {})
+                    }
+                    : {}),
                 runnable,
                 ...(unresolved_reason ? { unresolved_reason } : {})
             });
@@ -2640,7 +2686,11 @@ export async function generateTests(graph, opts, provider, fileReader, clock = s
     if (targets.length === 0) {
         warnings.push("No behavior anchors available to target. Add requirements/templates or analyze a path with tests.");
     }
-    const run = generated.length
+    // A pinned draft belongs to the run that FIRST produced it: it must not be
+    // re-listed under this run_id (nor re-persisted), or every pin-only generation
+    // would duplicate the same draft in the graph.
+    const freshTests = generated.filter((t) => !t.pinned);
+    const run = freshTests.length
         ? {
             run_id,
             model_provider: provider.providerName,
@@ -2648,7 +2698,7 @@ export async function generateTests(graph, opts, provider, fileReader, clock = s
             input_mode: inputMode,
             prompt_version: promptVersion,
             created_at,
-            generated_test_ids: generated.map((t) => t.id)
+            generated_test_ids: freshTests.map((t) => t.id)
         }
         : null;
     return { run, generated_tests: generated, missing_evidence: missing, warnings };

package/dist/local/operations.js

@@ -41,7 +41,7 @@ import { renderCoverageReport } from "./pack/coverageReport.js";
 import { confirmedCoverageByLayer } from "./score/coverage.js";
 import { prepareRuntimeCoverage } from "./analyze/coverageArtifacts.js";
 import { appendLedgerRecord, canReproveLanguage, loadLedger, ledgerStats, proofEdgesFor, reproveTarget, resolveTargetSymbol, targetFingerprint, targetLanguage } from "./ledger.js";
-import { buildRtm, renderRtmCsv, renderRtmMarkdown } from "./rtm.js";
+import { buildRtm, provenSymbolIds, renderRtmCsv, renderRtmMarkdown } from "./rtm.js";
 import { buildProofDoctor, distillProofAttempts, loadProofAttempts, proofAttemptsFresh, writeProofAttempts } from "./proofDoctor.js";
 import { tryScopedReprove } from "./reprove/scoped.js";
 import { resolveContained, toWorkspaceRel } from "./reprove/paths.js";
@@ -811,7 +811,10 @@ export function opProofDoctor(root) {
 export function opGaps(root, opts = {}) {
     const graph = loadGraph(workspacePaths(root).graphPath);
     const gaps = findGaps(graph, opts);
-    const topRiskGaps = rankRiskGaps(graph, { limit: opts.limit ?? 10, repoRoot: root }).map((gap) => ({
+    // Ledger proofs are invisible to the graph's hard edges; pass them so a type
+    // whose every method is Dynamically Proven is suppressed instead of ranked.
+    const provenIds = provenSymbolIds(graph, loadLedger(root));
+    const topRiskGaps = rankRiskGaps(graph, { limit: opts.limit ?? 10, repoRoot: root, provenIds }).map((gap) => ({
         external_id: gap.id,
         title: gap.title,
         file: gap.file,
@@ -1598,7 +1601,11 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
         try {
             const graphForGeneration = loadGraph(workspacePaths(root).graphPath);
             const generatedTargets = new Set((graphForGeneration.generated_tests ?? []).map((t) => t.target_symbol_external_id).filter((id) => Boolean(id)));
-            const targetIds = rankRiskGaps(graphForGeneration, { repoRoot: root, limit: START_GENERATE_RISK_LIMIT })
+            const targetIds = rankRiskGaps(graphForGeneration, {
+                repoRoot: root,
+                limit: START_GENERATE_RISK_LIMIT,
+                provenIds: provenSymbolIds(graphForGeneration, loadLedger(root))
+            })
                 .map((gap) => gap.id)
                 .filter((id) => !generatedTargets.has(id));
             if (targetIds.length) {
@@ -1792,12 +1799,24 @@ export async function opGenerate(root, opts = {}, deps = defaultDeps()) {
         };
     }
     const reader = fileReaderFor(graph.workspace.root);
-    const result = await generateTests(graph, { target_ids: opts.target_ids, framework: opts.framework, limit: opts.limit, input_mode: opts.input_mode, prompt_version: opts.prompt_version }, provider, reader, deps.clock);
-    if (result.run && result.generated_tests.length) {
+    const result = await generateTests(graph, {
+        target_ids: opts.target_ids,
+        framework: opts.framework,
+        limit: opts.limit,
+        input_mode: opts.input_mode,
+        prompt_version: opts.prompt_version,
+        // Persisting lane: a runnable draft for an unchanged target is reused as-is
+        // rather than re-bought from the model on every run.
+        pin_unchanged: opts.pin_unchanged ?? true
+    }, provider, reader, deps.clock);
+    // Pinned drafts are already IN graph.generated_tests — appending them again
+    // would duplicate a draft on every generation of an unchanged target.
+    const freshTests = result.generated_tests.filter((t) => !t.pinned);
+    if (result.run && freshTests.length) {
         const next = {
             ...graph,
             generation_runs: [...graph.generation_runs, result.run],
-            generated_tests: [...graph.generated_tests, ...result.generated_tests],
+            generated_tests: [...graph.generated_tests, ...freshTests],
             updated_at: deps.clock()
         };
         saveGraph(paths.graphPath, next);

package/dist/local/rtm.js

@@ -47,6 +47,21 @@ export function buildRtm(graph, ledger, opts = {}) {
     const rows = opts.limit && opts.limit > 0 ? filteredRows.slice(0, opts.limit) : filteredRows;
     return { summary: summarizeRows(baseRows, unionRows), rows, ...(opts.scope ? { scope: opts.scope } : {}) };
 }
+/**
+ * CodeSymbol ids the RTM would call Dynamically Proven — the SAME selection
+ * buildRtm uses (`selectLedgerBySymbol(...).proven`), so proof judgment has one
+ * definition. Consumers outside the RTM (risk ranking's container suppression)
+ * need it because a proof leaves no graph edge and its target frequently sits
+ * outside the deterministic denominator.
+ */
+export function provenSymbolIds(graph, ledger) {
+    const out = new Set();
+    for (const [symbol, selected] of selectLedgerBySymbol(ledger, graph)) {
+        if (selected.proven)
+            out.add(symbol);
+    }
+    return out;
+}
 function inScope(node, targetSet, fileSet) {
     if (!targetSet && !fileSet)
         return true;

package/dist/local/score/risk.js

@@ -11,7 +11,37 @@ function symbolFile(n) {
 function symbolTitle(n) {
     return n.title ?? n.external_id.split("#")[1] ?? n.external_id;
 }
-function confirmedBehaviorIds(graph) {
+/**
+ * Structural container → member children, read from the analyzer's own
+ * `properties.member_of` (the same signal src/local/reprove/scoped.ts uses).
+ * Id-prefix matching cannot do this job: `sym:f.ts#a.b` is a child of
+ * `sym:f.ts#a` only by string luck, and a dotted symbol name with no container
+ * node would be mis-parented. A container is resolved inside the child's OWN
+ * file: a same-named symbol elsewhere is a different thing, and mis-parenting
+ * here would suppress a genuine gap.
+ */
+function containerChildren(graph) {
+    const symbols = graph.nodes.filter((n) => n.kind === "CodeSymbol");
+    const idByFileTitle = new Map();
+    for (const n of symbols)
+        idByFileTitle.set(`${symbolFile(n)}#${symbolTitle(n)}`, n.external_id);
+    const out = new Map();
+    for (const n of symbols) {
+        const memberOf = n.properties.member_of;
+        if (typeof memberOf !== "string" || memberOf === "")
+            continue;
+        const containerId = idByFileTitle.get(`${symbolFile(n)}#${memberOf}`);
+        if (!containerId || containerId === n.external_id)
+            continue;
+        const list = out.get(containerId);
+        if (list)
+            list.push(n.external_id);
+        else
+            out.set(containerId, [n.external_id]);
+    }
+    return out;
+}
+function confirmedBehaviorIds(graph, provenIds) {
     const ids = new Set();
     const nodeKinds = new Map(graph.nodes.map((n) => [n.external_id, n.kind]));
     for (const e of graph.edges) {
@@ -27,13 +57,15 @@ function confirmedBehaviorIds(graph) {
     // A container type whose every method child is confirmed has no distinct
     // untested surface left — suppress it from the gap ranking rather than
     // listing it as an unlinked candidate above its own proven methods.
-    const symbolIds = graph.nodes.filter((n) => n.kind === "CodeSymbol").map((n) => n.external_id);
-    for (const id of symbolIds) {
-        if (ids.has(id))
+    // "Confirmed" here means a hard static link OR a current ledger proof: the
+    // proof lane leaves no graph edge and usually sits outside the denominator,
+    // so a hard-edge-only check never fires for a dynamically proven type.
+    const eligible = new Set(graph.nodes.filter((n) => n.kind === "CodeSymbol" && n.denominator_eligible === true).map((n) => n.external_id));
+    for (const [containerId, children] of containerChildren(graph)) {
+        if (ids.has(containerId) || !eligible.has(containerId))
             continue;
-        const children = symbolIds.filter((s) => s.startsWith(id + "."));
-        if (children.length > 0 && children.every((c) => ids.has(c)))
-            ids.add(id);
+        if (children.every((c) => ids.has(c) || provenIds?.has(c) === true))
+            ids.add(containerId);
     }
     return ids;
 }
@@ -325,7 +357,7 @@ function candidateSignalIds(graph, candidateIds) {
 }
 export function rankRiskGaps(graph, opts = {}) {
     const limit = opts.limit ?? 20;
-    const confirmed = confirmedBehaviorIds(graph);
+    const confirmed = confirmedBehaviorIds(graph, opts.provenIds);
     const symbols = graph.nodes.filter((n) => n.kind === "CodeSymbol" && n.denominator_eligible === true && !n.stale && !confirmed.has(n.external_id));
     const symbolIds = new Set(symbols.map((s) => s.external_id));
     const symbolsByFile = new Map();

package/dist/local/viz/behaviorReportHtml.js

@@ -758,11 +758,11 @@ function renderRisks(){
       hiddenGeneratedFlows
         ? \`<div class="paywall-num">\${hiddenGeneratedFlows} more flows with tests</div>
            <div class="paywall-txt">OrangePro accepted \${D.generatedTotal} runnable generated test\${D.generatedTotal===1?"":"s"} across \${generatedRiskCount} high-risk flow\${generatedRiskCount===1?"":"s"}. Use the “Flows with tests” filter to review them first.</div>
-           <a class="paywall-btn" href="https://app.orangepro.ai" target="_blank">View all on OrangePro Platform &rarr;</a>\`
+           <a class="paywall-btn" href="https://platform.orangepro.ai/" target="_blank">View all on OrangePro Platform &rarr;</a>\`
         : remainingRiskFlows
           ? \`<div class="paywall-num">\${remainingRiskFlows} high-risk flows left</div>
              <div class="paywall-txt">The local MCP accepted \${D.generatedTotal} runnable generated test\${D.generatedTotal===1?"":"s"} across \${generatedRiskCount} high-risk flow\${generatedRiskCount===1?"":"s"}. Generate the remaining high-risk flow tests on OrangePro Platform.</div>
-             <a class="paywall-btn" href="https://app.orangepro.ai" target="_blank">Generate remaining tests on Platform &rarr;</a>\`
+             <a class="paywall-btn" href="https://platform.orangepro.ai/" target="_blank">Generate remaining tests on Platform &rarr;</a>\`
           : \`<div class="paywall-num">All generated tests are shown</div>
              <div class="paywall-txt">OrangePro generated tests for every high-risk flow in this report, and every generated test is visible here.</div>\`));
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orangepro/orangepro-mcp",
-  "version": "0.2.11",
+  "version": "0.2.13",
   "private": false,
   "description": "OrangePro (`opro`) — a local-first, BYOK CLI + MCP server that builds an evidence graph from a local checkout, ingests runtime coverage, and generates grounded tests. Metadata-only exports; no source upload; generated tests stay local.",
   "license": "MIT",
@@ -131,4 +131,4 @@
     "unplugin-swc": "^1.5.9",
     "vitest": "^3.2.0"
   }
-}
+}