@orangepro/orangepro-mcp 0.2.39 → 0.2.40

package/dist/local/cli.js

@@ -692,6 +692,8 @@ async function main() {
                 printJson(res);
             else {
                 out(`Test gaps (${res.gaps.length} of ${res.total_behaviors} behaviors):`);
+                for (const w of res.warnings ?? [])
+                    out(`  warning: ${w}`);
                 if (res.guidance)
                     out(`  ${res.guidance}`);
                 for (const g of res.gaps) {

package/dist/local/operations.js

@@ -656,7 +656,9 @@ export function opAnalyze(root, opts = {}, deps = defaultDeps()) {
     const coverageSuccess = runtimeCoveragePrepare?.generated
         .filter((g) => g.ok && g.artifact_path)
         .map((g) => `coverage artifact generated for ${g.language} module ${g.module_dir}: ${g.artifact_path}`) ?? [];
-    const warnings = [...coverageSuccess, ...coverageWarnings, ...(runtimeCoveragePrepare?.warnings ?? []), ...analyzeFragment.warnings, ...enrichFragments.flatMap((f) => f.warnings)];
+    // Risk-config problems must surface on EVERY entry point that ranks, not just `start`.
+    const riskConfigWarnings = loadRiskConfig(scanRoot).warnings;
+    const warnings = [...coverageSuccess, ...coverageWarnings, ...(runtimeCoveragePrepare?.warnings ?? []), ...analyzeFragment.warnings, ...enrichFragments.flatMap((f) => f.warnings), ...riskConfigWarnings];
     return {
         graph_path: paths.graphPath,
         sources_count: graph.sources.length,
@@ -876,8 +878,11 @@ export function opGaps(root, opts = {}) {
         is_new_code: gap.is_new_code,
         integration_signal: gap.integration_signal
     }));
+    // Same root the ranking itself uses (the analyzed source), not the workspace cwd.
+    const riskConfigWarnings = loadRiskConfig(graph.workspace.root).warnings;
     return {
         ...gaps,
+        ...(riskConfigWarnings.length ? { warnings: riskConfigWarnings } : {}),
         top_risk_gaps: topRiskGaps,
         risk_model: {
             formula: "OrangePro Risk Score = Probability(1-10) × Impact(1-10) × DetectionDifficulty(1|5|10); P = normalize(git_churn*0.35 + fan_out*0.30 + new_code*15 + complexity*0.20); I = normalize(fan_in*0.30 + route_weight*0.30 + flow_position*0.20 + data_sensitivity*0.20); D = {proven:1, associated:5, none:10}",

package/dist/local/workspace.js

@@ -92,7 +92,16 @@ export function loadConfig(paths) {
             privacy: defaultPrivacySettings()
         };
     }
-    return JSON.parse(readFileSync(paths.configPath, "utf8"));
+    const raw = readFileSync(paths.configPath, "utf8");
+    try {
+        return JSON.parse(raw);
+    }
+    catch (err) {
+        // Fail loud AND clear: this file also carries the per-repo risk config, so a
+        // silent default here would be exactly the failure a verification layer must not have.
+        const hint = /\/\//.test(raw) ? " JSON does not allow // comments." : "";
+        throw new Error(`Unreadable ${paths.configPath}: ${err.message}.${hint} Fix the JSON, or delete the file to regenerate defaults.`);
+    }
 }
 export function saveConfig(paths, config) {
     writeJson(paths.configPath, config);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orangepro/orangepro-mcp",
-  "version": "0.2.39",
+  "version": "0.2.40",
   "private": false,
   "description": "OrangePro (`opro`) — a local-first, BYOK CLI + MCP server that builds an evidence graph from a local checkout, ingests runtime coverage, and generates grounded tests. Metadata-only exports; no source upload; generated tests stay local.",
   "license": "MIT",