@orangepro/orangepro-mcp 0.2.38 → 0.2.40

package/dist/local/cli.js

@@ -692,6 +692,8 @@ async function main() {
                 printJson(res);
             else {
                 out(`Test gaps (${res.gaps.length} of ${res.total_behaviors} behaviors):`);
+                for (const w of res.warnings ?? [])
+                    out(`  warning: ${w}`);
                 if (res.guidance)
                     out(`  ${res.guidance}`);
                 for (const g of res.gaps) {

package/dist/local/operations.js

@@ -656,7 +656,9 @@ export function opAnalyze(root, opts = {}, deps = defaultDeps()) {
     const coverageSuccess = runtimeCoveragePrepare?.generated
         .filter((g) => g.ok && g.artifact_path)
         .map((g) => `coverage artifact generated for ${g.language} module ${g.module_dir}: ${g.artifact_path}`) ?? [];
-    const warnings = [...coverageSuccess, ...coverageWarnings, ...(runtimeCoveragePrepare?.warnings ?? []), ...analyzeFragment.warnings, ...enrichFragments.flatMap((f) => f.warnings)];
+    // Risk-config problems must surface on EVERY entry point that ranks, not just `start`.
+    const riskConfigWarnings = loadRiskConfig(scanRoot).warnings;
+    const warnings = [...coverageSuccess, ...coverageWarnings, ...(runtimeCoveragePrepare?.warnings ?? []), ...analyzeFragment.warnings, ...enrichFragments.flatMap((f) => f.warnings), ...riskConfigWarnings];
     return {
         graph_path: paths.graphPath,
         sources_count: graph.sources.length,
@@ -876,8 +878,11 @@ export function opGaps(root, opts = {}) {
         is_new_code: gap.is_new_code,
         integration_signal: gap.integration_signal
     }));
+    // Same root the ranking itself uses (the analyzed source), not the workspace cwd.
+    const riskConfigWarnings = loadRiskConfig(graph.workspace.root).warnings;
     return {
         ...gaps,
+        ...(riskConfigWarnings.length ? { warnings: riskConfigWarnings } : {}),
         top_risk_gaps: topRiskGaps,
         risk_model: {
             formula: "OrangePro Risk Score = Probability(1-10) × Impact(1-10) × DetectionDifficulty(1|5|10); P = normalize(git_churn*0.35 + fan_out*0.30 + new_code*15 + complexity*0.20); I = normalize(fan_in*0.30 + route_weight*0.30 + flow_position*0.20 + data_sensitivity*0.20); D = {proven:1, associated:5, none:10}",
@@ -1556,7 +1561,7 @@ export async function opStart(root, opts = {}, deps = defaultDeps()) {
     reportProgress("start: deterministic graph is ready", { current: 4, total: 8 });
     // A per-repo/user risk config that fails to parse must announce itself here, not
     // silently revert to defaults (round-three review finding #1).
-    for (const w of loadRiskConfig(root).warnings)
+    for (const w of loadRiskConfig(scanRoot).warnings)
         warnings.push(w);
     const staticSnapshot = writeStartStaticSnapshot(root, opts.baseRef, warnings);
     const aiProviderConfigured = deps.aiProvider !== undefined || resolveProviderConfig(providerEnv, providerOpts) !== null;

package/dist/local/score/risk.js

@@ -737,6 +737,10 @@ export function configDisclosureFor(graph, repoRoot) {
             if (n.external_id === o.symbol || re.test(n.external_id))
                 suppressed.push({ symbol: n.title || n.external_id, reason: o.reason });
     }
+    const ignoreRes = cfg.classification.sensitivity_ignore.map(globToRegExp);
+    const sensitivityIgnored = ignoreRes.length
+        ? symbols.filter((n) => ignoreRes.some((re) => re.test(n.title || "") || re.test(n.external_id))).map((n) => n.title || n.external_id).slice(0, 50)
+        : [];
     return {
         hash: loaded.hash,
         warnings: loaded.warnings,
@@ -744,6 +748,13 @@ export function configDisclosureFor(graph, repoRoot) {
         suppressed,
         rankExcludePaths: cfg.classification.rank_exclude_paths,
         floor: cfg.tuning.irreversibility_floor,
-        silence: cfg.tuning.silence_multiplier
+        silence: cfg.tuning.silence_multiplier,
+        classification: {
+            test_support_paths: cfg.classification.test_support_paths,
+            scheduled_entry_paths: cfg.classification.scheduled_entry_paths,
+            destructive_sinks: cfg.classification.destructive_sinks,
+            sensitivity_ignore: cfg.classification.sensitivity_ignore
+        },
+        sensitivityIgnored
     };
 }

package/dist/local/viz/behaviorReportHtml.js

@@ -1034,12 +1034,16 @@ renderRisks();
   const C=D.configDisclosure, host=$("#config-disclosure");
   if(!C||!host)return;
   const warn=(C.warnings||[]).length>0;
-  const tuned=C.overridesActive>0||(C.rankExcludePaths||[]).length>0||!C.floor||!C.silence;
+  const K=C.classification||{};
+  const clsSet=["test_support_paths","scheduled_entry_paths","destructive_sinks","sensitivity_ignore"].filter(k=>(K[k]||[]).length>0);
+  const tuned=C.overridesActive>0||(C.rankExcludePaths||[]).length>0||!C.floor||!C.silence||clsSet.length>0;
   const bits=["config <b>"+esc(C.hash)+"</b>","overrides active <b>"+C.overridesActive+"</b>","suppressed <b>"+(C.suppressed||[]).length+"</b>"];
   if((C.rankExcludePaths||[]).length)bits.push("ranking excludes <b>"+esc(C.rankExcludePaths.join(", "))+"</b>");
   if(!C.floor)bits.push("<b>irreversibility floor OFF</b>");
   if(!C.silence)bits.push("<b>silence multiplier OFF</b>");
   let html="<div>"+bits.join(" · ")+"</div>";
+  clsSet.forEach(k=>{html+='<span class="cfg-row">'+esc(k)+': <b>'+esc(K[k].join(", "))+'</b></span>';});
+  if((C.sensitivityIgnored||[]).length)html+='<span class="cfg-row">sensitivity ignored by config (score changed): <b>'+esc(C.sensitivityIgnored.join(", "))+'</b></span>';
   (C.suppressed||[]).forEach(s=>{html+='<span class="cfg-row">suppressed by config: <b>'+esc(s.symbol)+'</b> — '+esc(s.reason)+'</span>';});
   (C.warnings||[]).forEach(w=>{html+='<span class="cfg-row">⚠ '+esc(w)+'</span>';});
   host.className="cfg"+(warn?" cfg-warn":tuned?" cfg-tuned":"");

package/dist/local/workspace.js

@@ -92,7 +92,16 @@ export function loadConfig(paths) {
             privacy: defaultPrivacySettings()
         };
     }
-    return JSON.parse(readFileSync(paths.configPath, "utf8"));
+    const raw = readFileSync(paths.configPath, "utf8");
+    try {
+        return JSON.parse(raw);
+    }
+    catch (err) {
+        // Fail loud AND clear: this file also carries the per-repo risk config, so a
+        // silent default here would be exactly the failure a verification layer must not have.
+        const hint = /\/\//.test(raw) ? " JSON does not allow // comments." : "";
+        throw new Error(`Unreadable ${paths.configPath}: ${err.message}.${hint} Fix the JSON, or delete the file to regenerate defaults.`);
+    }
 }
 export function saveConfig(paths, config) {
     writeJson(paths.configPath, config);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orangepro/orangepro-mcp",
-  "version": "0.2.38",
+  "version": "0.2.40",
   "private": false,
   "description": "OrangePro (`opro`) — a local-first, BYOK CLI + MCP server that builds an evidence graph from a local checkout, ingests runtime coverage, and generates grounded tests. Metadata-only exports; no source upload; generated tests stay local.",
   "license": "MIT",