@runsec/mcp 1.0.67 → 1.0.69

package/bin/runsec-mcp.cjs

@@ -26,23 +26,15 @@ function isRunnableBinary(filePath) {
   }
 }
 
+const { hasOptionalEngine, resolveOptionalEngineBinary } = require("./engine-resolve.cjs");
+
 function optionalEngineResolvable(engine) {
-  const pkg = `@runsec/engine-${engine}-${process.platform}-${process.arch}`;
-  const win = process.platform === "win32";
-  const candidates = win
-    ? [`${pkg}/bin/${engine}.exe`, `${pkg}/bin/${engine}`]
-    : [`${pkg}/bin/${engine}`];
-  for (const candidate of candidates) {
-    console.error(`[RunSec Debug] runsec-mcp require.resolve: ${candidate}`);
-    try {
-      const resolved = require.resolve(candidate);
-      console.error(`[RunSec Debug] runsec-mcp optional OK ${candidate} -> ${resolved}`);
-      return true;
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      console.error(`[RunSec Debug] runsec-mcp require.resolve failed ${candidate}: ${message}`);
-    }
+  const resolved = resolveOptionalEngineBinary(engine);
+  if (resolved) {
+    console.error(`[RunSec Debug] runsec-mcp optional OK ${engine} -> ${resolved}`);
+    return true;
   }
+  console.error(`[RunSec Debug] runsec-mcp optional missing for ${engine}`);
   return false;
 }
 
@@ -70,7 +62,11 @@ function shouldFetchBundledBinaries() {
     return false;
   }
   const missing = binariesMissing();
-  console.error(`[RunSec Debug] binariesMissing()=${missing} PKG_ROOT=${PKG_ROOT}`);
+  console.error(
+    `[RunSec Debug] ensure-binaries needed: trufflehogOptional=${thOptional} syftOptional=${syOptional} binariesMissing=${missing}`
+  );
+  // If any optional engine package is missing, always try GitHub download into bin/
+  if (!thOptional || !syOptional) return true;
   return missing;
 }
 

package/dist/index.js

@@ -400,7 +400,7 @@ async function ignoreFinding(args) {
 }
 
 // src/engine/ruleEngine.ts
-var import_node_fs7 = require("fs");
+var import_node_fs8 = require("fs");
 var import_node_path13 = __toESM(require("path"));
 var import_ignore = __toESM(require("ignore"));
 
@@ -2004,12 +2004,27 @@ var import_node_util = require("util");
 var import_node_path10 = __toESM(require("path"));
 
 // src/engine/toolPaths.ts
-var import_node_fs6 = __toESM(require("fs"));
+var import_node_fs7 = __toESM(require("fs"));
 var import_node_path9 = __toESM(require("path"));
 
 // src/engine/binaryResolver.ts
+var import_node_fs6 = __toESM(require("fs"));
 var import_node_module = require("module");
 var import_node_path8 = __toESM(require("path"));
+var MIN_BINARY_BYTES = 1024;
+function getPackageRoot() {
+  const dir = __dirname;
+  if (import_node_path8.default.basename(dir) === "dist") {
+    return import_node_path8.default.resolve(dir, "..");
+  }
+  if (import_node_path8.default.basename(dir) === "engine" && import_node_path8.default.basename(import_node_path8.default.dirname(dir)) === "dist") {
+    return import_node_path8.default.resolve(dir, "../..");
+  }
+  return import_node_path8.default.resolve(dir, "..", "..");
+}
+function packageRequire() {
+  return (0, import_node_module.createRequire)(import_node_path8.default.join(getPackageRoot(), "package.json"));
+}
 var SUPPORTED_PLATFORMS = /* @__PURE__ */ new Set(["darwin", "linux", "win32"]);
 var SUPPORTED_ARCHES = /* @__PURE__ */ new Set(["x64", "arm64"]);
 function buildOptionalEnginePackageName(engineName, platform = process.platform, arch = process.arch) {
@@ -2039,15 +2054,18 @@ function getEngineExecutable(engineName) {
     );
     return engineName;
   }
-  console.error(`[RunSec Debug] Optional package name: ${packageName}`);
-  const require2 = (0, import_node_module.createRequire)(__filename);
+  console.error(`[RunSec Debug] Optional package name: ${packageName} packageRoot=${getPackageRoot()}`);
+  const req = packageRequire();
   const candidates = binResolveCandidates(engineName, packageName);
   for (const candidate of candidates) {
     console.error(`[RunSec Debug] require.resolve target: ${candidate}`);
     try {
-      const resolved = require2.resolve(candidate);
-      console.error(`[RunSec Debug] Found optional package binary at: ${resolved}`);
-      return resolved;
+      const resolved = req.resolve(candidate);
+      if (import_node_fs6.default.existsSync(resolved) && import_node_fs6.default.statSync(resolved).size >= MIN_BINARY_BYTES) {
+        console.error(`[RunSec Debug] Found optional package binary at: ${resolved}`);
+        return resolved;
+      }
+      console.error(`[RunSec Debug] Optional binary too small or missing: ${resolved}`);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       console.error(`[RunSec Debug] require.resolve failed for ${candidate}: ${message}`);
@@ -2063,40 +2081,40 @@ function isOptionalPackageExecutable(engineName, command) {
 }
 
 // src/engine/toolPaths.ts
-var MIN_BINARY_BYTES = 1024;
+var MIN_BINARY_BYTES2 = 1024;
 function binFileName(tool) {
   return process.platform === "win32" ? `${tool}.exe` : tool;
 }
 function isBundledBinaryRunnable(filePath) {
   try {
-    const stat = import_node_fs6.default.statSync(filePath);
-    if (!stat.isFile() || stat.size < MIN_BINARY_BYTES) return false;
-    const fd = import_node_fs6.default.openSync(filePath, "r");
+    const stat = import_node_fs7.default.statSync(filePath);
+    if (!stat.isFile() || stat.size < MIN_BINARY_BYTES2) return false;
+    const fd = import_node_fs7.default.openSync(filePath, "r");
     try {
       const magic = Buffer.alloc(2);
-      import_node_fs6.default.readSync(fd, magic, 0, 2, 0);
+      import_node_fs7.default.readSync(fd, magic, 0, 2, 0);
       if (process.platform === "win32") {
         return magic[0] === 77 && magic[1] === 90;
       }
       return magic[0] === 127 && magic[1] === 69;
     } finally {
-      import_node_fs6.default.closeSync(fd);
+      import_node_fs7.default.closeSync(fd);
     }
   } catch {
     return false;
   }
 }
-function getPackageRoot() {
+function getPackageRoot2() {
   if (import_node_path9.default.basename(__dirname) === "dist") {
     return import_node_path9.default.resolve(__dirname, "..");
   }
   return import_node_path9.default.resolve(__dirname, "..", "..");
 }
 function getBundledBinDir() {
-  return import_node_path9.default.join(getPackageRoot(), "bin");
+  return import_node_path9.default.join(getPackageRoot2(), "bin");
 }
 function resolveEngineBinary(tool) {
-  const packageRoot = getPackageRoot();
+  const packageRoot = getPackageRoot2();
   const bundledBinDir = getBundledBinDir();
   console.error(
     `[RunSec Debug] resolveEngineBinary(${tool}) packageRoot=${packageRoot} bundledBinDir=${bundledBinDir} __dirname=${__dirname}`
@@ -2109,10 +2127,10 @@ function resolveEngineBinary(tool) {
   }
   const bundled = import_node_path9.default.join(bundledBinDir, binFileName(tool));
   console.error(`[RunSec Debug] Checking bundled path: ${bundled}`);
-  const bundledExists = import_node_fs6.default.existsSync(bundled);
+  const bundledExists = import_node_fs7.default.existsSync(bundled);
   const bundledRunnable = bundledExists && isBundledBinaryRunnable(bundled);
   console.error(
-    `[RunSec Debug] Bundled path exists=${bundledExists} runnable=${bundledRunnable}` + (bundledExists ? ` size=${import_node_fs6.default.statSync(bundled).size}` : "")
+    `[RunSec Debug] Bundled path exists=${bundledExists} runnable=${bundledRunnable}` + (bundledExists ? ` size=${import_node_fs7.default.statSync(bundled).size}` : "")
   );
   if (bundledRunnable) {
     console.error(`[RunSec Debug] Using bundled binary for ${tool}: ${bundled}`);
@@ -2924,7 +2942,7 @@ async function buildIgnoreMatcher(workspaceRoot) {
   ]);
   const runsecIgnorePath = import_node_path13.default.join(workspaceRoot, RUNSEC_IGNORE_FILE);
   try {
-    const content = await import_node_fs7.promises.readFile(runsecIgnorePath, "utf-8");
+    const content = await import_node_fs8.promises.readFile(runsecIgnorePath, "utf-8");
     matcher.add(content);
   } catch {
   }
@@ -2936,7 +2954,7 @@ async function collectFilesWithStats(workspacePath, targetFiles) {
   let skippedByIgnore = 0;
   let stat;
   try {
-    stat = await import_node_fs7.promises.stat(root);
+    stat = await import_node_fs8.promises.stat(root);
   } catch {
     stat = null;
   }
@@ -2953,7 +2971,7 @@ async function collectFilesWithStats(workspacePath, targetFiles) {
         continue;
       }
       try {
-        const s = await import_node_fs7.promises.stat(candidate);
+        const s = await import_node_fs8.promises.stat(candidate);
         if (s.isFile()) out.push(candidate);
       } catch {
       }
@@ -3000,7 +3018,7 @@ async function executeAudit(toolName, args) {
 }
 
 // src/engine/reportFormatter.ts
-var import_node_fs8 = __toESM(require("fs"));
+var import_node_fs9 = __toESM(require("fs"));
 var import_node_path14 = __toESM(require("path"));
 var REPORT_SECTION_TITLES = {
   code: "Code Vulnerabilities",
@@ -3468,7 +3486,7 @@ function generateMarkdownReport(standard, findings, metrics, workspacePath) {
   const rows = Array.isArray(findings) ? findings : [];
   const reportContent = finalizeReportMarkdown(buildServerSideReportMarkdown(standard, rows, m));
   const reportPath = resolveReportPath(workspacePath);
-  import_node_fs8.default.writeFileSync(reportPath, reportContent, "utf-8");
+  import_node_fs9.default.writeFileSync(reportPath, reportContent, "utf-8");
   console.error(`[runsec] wrote unified report to: ${reportPath}`);
   console.error(`[runsec] X-RunSec-Verdict: ${m.verdict?.http_headers?.["X-RunSec-Verdict"] ?? m.verdict?.status ?? "PASS"}`);
   return `
@@ -3483,16 +3501,16 @@ Simply confirm that the scan is complete and the report is saved at the path abo
 }
 
 // src/engine/reviewFormatter.ts
-var import_node_fs13 = __toESM(require("fs"));
+var import_node_fs14 = __toESM(require("fs"));
 var import_node_path20 = __toESM(require("path"));
 
 // src/engine/threatModelEngine.ts
 var import_node_crypto4 = require("crypto");
-var import_node_fs12 = __toESM(require("fs"));
+var import_node_fs13 = __toESM(require("fs"));
 var import_node_path19 = __toESM(require("path"));
 
 // src/skills/skillsApi.ts
-var import_node_fs11 = __toESM(require("fs"));
+var import_node_fs12 = __toESM(require("fs"));
 var import_node_path18 = __toESM(require("path"));
 
 // src/skills/patternParser.ts
@@ -3579,23 +3597,23 @@ function getRagCachePath() {
 
 // src/skills/ragIndex.ts
 var import_node_crypto3 = require("crypto");
-var import_node_fs10 = __toESM(require("fs"));
+var import_node_fs11 = __toESM(require("fs"));
 var import_node_path17 = __toESM(require("path"));
 
 // src/skills/skillLoader.ts
-var import_node_fs9 = __toESM(require("fs"));
+var import_node_fs10 = __toESM(require("fs"));
 var import_node_path16 = __toESM(require("path"));
 function loadSkillManifests() {
   const skillsDir = getSkillsDirectory();
   const manifests = {};
-  if (!import_node_fs9.default.existsSync(skillsDir)) {
+  if (!import_node_fs10.default.existsSync(skillsDir)) {
     return manifests;
   }
-  for (const entry of import_node_fs9.default.readdirSync(skillsDir, { withFileTypes: true })) {
+  for (const entry of import_node_fs10.default.readdirSync(skillsDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
     const skillJson = import_node_path16.default.join(skillsDir, entry.name, "skill.json");
-    if (!import_node_fs9.default.existsSync(skillJson)) continue;
-    const data = JSON.parse(import_node_fs9.default.readFileSync(skillJson, "utf-8"));
+    if (!import_node_fs10.default.existsSync(skillJson)) continue;
+    const data = JSON.parse(import_node_fs10.default.readFileSync(skillJson, "utf-8"));
     const sid = String(data.skill_id ?? entry.name);
     manifests[sid] = { ...data, skill_id: sid, __dir_name: entry.name };
   }
@@ -3648,27 +3666,27 @@ function cosine(a, b) {
 }
 function hashFile(filePath) {
   const h = (0, import_node_crypto3.createHash)("sha256");
-  h.update(import_node_fs10.default.readFileSync(filePath));
+  h.update(import_node_fs11.default.readFileSync(filePath));
   return h.digest("hex");
 }
 function listSkillSourceFiles() {
   const skillsDir = getSkillsDirectory();
   const files = [];
   const walk = (dir) => {
-    for (const entry of import_node_fs10.default.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of import_node_fs11.default.readdirSync(dir, { withFileTypes: true })) {
       const full = import_node_path17.default.join(dir, entry.name);
       if (entry.isDirectory()) walk(full);
       else if (entry.isFile()) files.push(full);
     }
   };
-  if (import_node_fs10.default.existsSync(skillsDir)) walk(skillsDir);
+  if (import_node_fs11.default.existsSync(skillsDir)) walk(skillsDir);
   return files.sort();
 }
 function computeFilesChecksum() {
   const files = listSkillSourceFiles();
   const entries = [];
   for (const full of files) {
-    const st = import_node_fs10.default.statSync(full);
+    const st = import_node_fs11.default.statSync(full);
     const rel = import_node_path17.default.relative(getSkillsDirectory(), full).replace(/\\/g, "/");
     const mtimeNs = typeof st.mtimeNs === "bigint" ? Number(st.mtimeNs) : Math.round(st.mtimeMs * 1e6);
     entries.push({
@@ -3702,9 +3720,9 @@ function buildRagIndex() {
     const dir = skillDirectory(manifest);
     const indexPath = import_node_path17.default.join(dir, "index.md");
     const patternsPath = import_node_path17.default.join(dir, "patterns.md");
-    if (!import_node_fs10.default.existsSync(indexPath) || !import_node_fs10.default.existsSync(patternsPath)) continue;
-    const indexText = import_node_fs10.default.readFileSync(indexPath, "utf-8");
-    const patternsText = import_node_fs10.default.readFileSync(patternsPath, "utf-8");
+    if (!import_node_fs11.default.existsSync(indexPath) || !import_node_fs11.default.existsSync(patternsPath)) continue;
+    const indexText = import_node_fs11.default.readFileSync(indexPath, "utf-8");
+    const patternsText = import_node_fs11.default.readFileSync(patternsPath, "utf-8");
     const example_path = String(manifest.few_shot_examples ?? "");
     for (const paragraph of indexText.split(/\n\n+/).map((p) => p.trim()).filter(Boolean)) {
       chunks.push({
@@ -3745,9 +3763,9 @@ function buildRagIndex() {
 }
 function loadRagCache(current) {
   const cachePath = getRagCachePath();
-  if (!import_node_fs10.default.existsSync(cachePath)) return null;
+  if (!import_node_fs11.default.existsSync(cachePath)) return null;
   try {
-    const payload = JSON.parse(import_node_fs10.default.readFileSync(cachePath, "utf-8"));
+    const payload = JSON.parse(import_node_fs11.default.readFileSync(cachePath, "utf-8"));
     if (payload.schema_version !== RAG_CACHE_SCHEMA_VERSION) return null;
     if (JSON.stringify(payload.files_checksum) !== JSON.stringify(current)) return null;
     return deserializeChunks(payload.chunks ?? []);
@@ -3762,7 +3780,7 @@ function saveRagCache(chunks, filesChecksum) {
       files_checksum: filesChecksum,
       chunks: serializeChunks(chunks)
     };
-    import_node_fs10.default.writeFileSync(getRagCachePath(), JSON.stringify(payload), "utf-8");
+    import_node_fs11.default.writeFileSync(getRagCachePath(), JSON.stringify(payload), "utf-8");
   } catch {
     console.error("[runsec] RAG cache write failed; continuing in-memory only");
   }
@@ -3964,9 +3982,9 @@ function findPatternChunkByMetric(metricId) {
 // src/skills/skillsApi.ts
 function loadComplianceSnapshot() {
   const p = import_node_path18.default.join(getDataDirectory(), "rule-compliance-map.json");
-  if (!import_node_fs11.default.existsSync(p)) return {};
+  if (!import_node_fs12.default.existsSync(p)) return {};
   try {
-    return JSON.parse(import_node_fs11.default.readFileSync(p, "utf-8"));
+    return JSON.parse(import_node_fs12.default.readFileSync(p, "utf-8"));
   } catch {
     return {};
   }
@@ -3974,9 +3992,9 @@ function loadComplianceSnapshot() {
 function extractTestbedExample(metricId, examplePath, skillsRoot) {
   if (!examplePath) return "";
   const p = import_node_path18.default.isAbsolute(examplePath) ? examplePath : import_node_path18.default.join(import_node_path18.default.dirname(skillsRoot), "..", "..", examplePath);
-  const resolved = import_node_fs11.default.existsSync(p) ? p : import_node_path18.default.join(getDataDirectory(), "..", "..", examplePath);
-  if (!import_node_fs11.default.existsSync(resolved)) return "";
-  const lines = import_node_fs11.default.readFileSync(resolved, "utf-8").split(/\r?\n/);
+  const resolved = import_node_fs12.default.existsSync(p) ? p : import_node_path18.default.join(getDataDirectory(), "..", "..", examplePath);
+  if (!import_node_fs12.default.existsSync(resolved)) return "";
+  const lines = import_node_fs12.default.readFileSync(resolved, "utf-8").split(/\r?\n/);
   const needle = `Vulnerable: ${metricId}`;
   for (let idx = 0; idx < lines.length; idx += 1) {
     if (lines[idx].includes(needle)) {
@@ -4030,14 +4048,14 @@ function getSkillContext(args) {
   const dir = skillDirectory(manifest);
   const indexPath = import_node_path18.default.join(dir, "index.md");
   const patternsPath = import_node_path18.default.join(dir, "patterns.md");
-  if (!import_node_fs11.default.existsSync(indexPath) || !import_node_fs11.default.existsSync(patternsPath)) {
+  if (!import_node_fs12.default.existsSync(indexPath) || !import_node_fs12.default.existsSync(patternsPath)) {
     return {
       error: `incomplete skill data for ${skill_id}`,
-      index_exists: import_node_fs11.default.existsSync(indexPath),
-      patterns_exists: import_node_fs11.default.existsSync(patternsPath)
+      index_exists: import_node_fs12.default.existsSync(indexPath),
+      patterns_exists: import_node_fs12.default.existsSync(patternsPath)
     };
   }
-  const parsedRows = parsePatternRows(import_node_fs11.default.readFileSync(patternsPath, "utf-8"));
+  const parsedRows = parsePatternRows(import_node_fs12.default.readFileSync(patternsPath, "utf-8"));
   const grouped = {};
   for (const row of parsedRows) {
     const stack = row.stack.trim() || "Generic";
@@ -4055,8 +4073,8 @@ function getSkillContext(args) {
     skill_id,
     index_path: import_node_path18.default.relative(getDataDirectory(), indexPath).replace(/\\/g, "/"),
     patterns_path: import_node_path18.default.relative(getDataDirectory(), patternsPath).replace(/\\/g, "/"),
-    index_md: import_node_fs11.default.readFileSync(indexPath, "utf-8"),
-    patterns_md: import_node_fs11.default.readFileSync(patternsPath, "utf-8"),
+    index_md: import_node_fs12.default.readFileSync(indexPath, "utf-8"),
+    patterns_md: import_node_fs12.default.readFileSync(patternsPath, "utf-8"),
     patterns_by_stack: Object.fromEntries(Object.keys(grouped).sort().map((k) => [k, grouped[k]])),
     agent_system_insert: ANTI_HALLUCINATION_PROMPT,
     compliance_snapshot: loadComplianceSnapshot()
@@ -4159,7 +4177,7 @@ var STRIDE_LABELS = {
 };
 function readTextSafe(filePath, limit = 4e5) {
   try {
-    const data = import_node_fs12.default.readFileSync(filePath, "utf-8");
+    const data = import_node_fs13.default.readFileSync(filePath, "utf-8");
     return data.length > limit ? data.slice(0, limit) : data;
   } catch {
     return "";
@@ -4199,7 +4217,7 @@ function walkFiles2(root, opts) {
     let dir;
     try {
       dir = stack.pop();
-      const entries = import_node_fs12.default.readdirSync(dir, { withFileTypes: true });
+      const entries = import_node_fs13.default.readdirSync(dir, { withFileTypes: true });
       for (const ent of entries) {
         if (out.length >= max) break;
         const full = import_node_path19.default.join(dir, ent.name);
@@ -4268,7 +4286,7 @@ function collectRepoThreatSignals(scanRoot, syftPayload) {
     }
   };
   try {
-    for (const ent of import_node_fs12.default.readdirSync(root, { withFileTypes: true })) {
+    for (const ent of import_node_fs13.default.readdirSync(root, { withFileTypes: true })) {
       if (ent.isDirectory() && !ent.name.startsWith(".")) {
         signals.top_level_dirs.push(ent.name);
         if (signals.top_level_dirs.length >= 40) break;
@@ -4287,7 +4305,7 @@ function collectRepoThreatSignals(scanRoot, syftPayload) {
       const dir = stack.pop();
       let entries;
       try {
-        entries = import_node_fs12.default.readdirSync(dir, { withFileTypes: true });
+        entries = import_node_fs13.default.readdirSync(dir, { withFileTypes: true });
       } catch {
         continue;
       }
@@ -4317,7 +4335,7 @@ function collectRepoThreatSignals(scanRoot, syftPayload) {
   });
   for (const name of ["Dockerfile", "docker-compose.yml", "docker-compose.yaml"]) {
     const fp = import_node_path19.default.join(root, name);
-    if (import_node_fs12.default.existsSync(fp)) {
+    if (import_node_fs13.default.existsSync(fp)) {
       addKey(name);
       if (name === "Dockerfile") signals.flags.has_dockerfile = true;
       else signals.flags.has_compose = true;
@@ -4331,7 +4349,7 @@ function collectRepoThreatSignals(scanRoot, syftPayload) {
       break;
     }
   }
-  if (import_node_fs12.default.existsSync(import_node_path19.default.join(root, ".github", "workflows"))) {
+  if (import_node_fs13.default.existsSync(import_node_path19.default.join(root, ".github", "workflows"))) {
     signals.flags.has_github_workflows = true;
   }
   for (const pkg of signals.syft_packages) {
@@ -4364,11 +4382,11 @@ ${repoFp}`).digest("hex");
 }
 function loadThreatModelCache(workspaceRoot) {
   const p = import_node_path19.default.join(workspaceRoot, THREAT_MODEL_CACHE_FILE);
-  if (!import_node_fs12.default.existsSync(p)) {
+  if (!import_node_fs13.default.existsSync(p)) {
     return { schema_version: THREAT_MODEL_CACHE_SCHEMA_VERSION, entries: {} };
   }
   try {
-    const data = JSON.parse(import_node_fs12.default.readFileSync(p, "utf-8"));
+    const data = JSON.parse(import_node_fs13.default.readFileSync(p, "utf-8"));
     if (data.schema_version !== THREAT_MODEL_CACHE_SCHEMA_VERSION) {
       return { schema_version: THREAT_MODEL_CACHE_SCHEMA_VERSION, entries: {} };
     }
@@ -4388,7 +4406,7 @@ function saveThreatModelCache(workspaceRoot, cacheKey, markdown, baseline) {
     repo_fingerprint: String(baseline.repo_fingerprint ?? "")
   };
   payload.baseline = baseline;
-  import_node_fs12.default.writeFileSync(p, JSON.stringify(payload, null, 2), "utf-8");
+  import_node_fs13.default.writeFileSync(p, JSON.stringify(payload, null, 2), "utf-8");
   return p;
 }
 function strideClassifyClause(clause) {
@@ -4819,7 +4837,7 @@ Project: ${projectName}`;
   const cached = cache.entries[cacheKey];
   if (cached?.markdown) {
     const reportPath2 = import_node_path19.default.join(workspaceRoot, THREAT_MODEL_REPORT_FILE);
-    import_node_fs12.default.writeFileSync(reportPath2, cached.markdown, "utf-8");
+    import_node_fs13.default.writeFileSync(reportPath2, cached.markdown, "utf-8");
     return {
       profile,
       markdown: cached.markdown,
@@ -4857,7 +4875,7 @@ Project: ${projectName}`;
   };
   const cachePath = saveThreatModelCache(workspaceRoot, cacheKey, markdown, baselinePayload);
   const reportPath = import_node_path19.default.join(workspaceRoot, THREAT_MODEL_REPORT_FILE);
-  import_node_fs12.default.writeFileSync(reportPath, markdown, "utf-8");
+  import_node_fs13.default.writeFileSync(reportPath, markdown, "utf-8");
   return {
     profile,
     markdown,
@@ -5077,7 +5095,7 @@ function resolveSecurityReviewPath(workspacePath) {
 }
 function writeSecurityReviewReport(markdown, workspacePath) {
   const reportPath = resolveSecurityReviewPath(workspacePath);
-  import_node_fs13.default.writeFileSync(reportPath, markdown, "utf-8");
+  import_node_fs14.default.writeFileSync(reportPath, markdown, "utf-8");
   console.error(`[runsec] wrote security review to: ${reportPath}`);
   return reportPath;
 }
@@ -5116,11 +5134,11 @@ async function executeSecurityReview(opts) {
 }
 
 // src/engine/remediation.ts
-var import_node_fs15 = __toESM(require("fs"));
+var import_node_fs16 = __toESM(require("fs"));
 var import_node_path22 = __toESM(require("path"));
 
 // src/skills/metricLookup.ts
-var import_node_fs14 = __toESM(require("fs"));
+var import_node_fs15 = __toESM(require("fs"));
 var import_node_path21 = __toESM(require("path"));
 function findMetricRow(metricId) {
   const mid = metricId.trim().toUpperCase();
@@ -5128,8 +5146,8 @@ function findMetricRow(metricId) {
   const manifests = loadSkillManifests();
   for (const [, manifest] of Object.entries(manifests)) {
     const patternsPath = import_node_path21.default.join(skillDirectory(manifest), "patterns.md");
-    if (!import_node_fs14.default.existsSync(patternsPath)) continue;
-    const rows = parsePatternRows(import_node_fs14.default.readFileSync(patternsPath, "utf-8"));
+    if (!import_node_fs15.default.existsSync(patternsPath)) continue;
+    const rows = parsePatternRows(import_node_fs15.default.readFileSync(patternsPath, "utf-8"));
     const row = rows.find((r) => r.metric_id.toUpperCase() === mid);
     if (row) return row;
   }
@@ -5155,8 +5173,8 @@ function resolveTargetFile(workspaceRoot, filePath) {
       return { error: `refusing to modify path under blocked segment: ${seg}` };
     }
   }
-  if (!import_node_fs15.default.existsSync(abs)) return { error: `path does not exist: ${relFromRoot}` };
-  if (!import_node_fs15.default.statSync(abs).isFile()) return { error: `path is not a file: ${relFromRoot}` };
+  if (!import_node_fs16.default.existsSync(abs)) return { error: `path does not exist: ${relFromRoot}` };
+  if (!import_node_fs16.default.statSync(abs).isFile()) return { error: `path is not a file: ${relFromRoot}` };
   return { abs, rel: relFromRoot };
 }
 function normalizeNewlines(text) {
@@ -5223,12 +5241,12 @@ function locateTargetInFile(content, target) {
 }
 function writeBackup(absPath) {
   const backupPath = `${absPath}.bak`;
-  import_node_fs15.default.copyFileSync(absPath, backupPath);
+  import_node_fs16.default.copyFileSync(absPath, backupPath);
   return backupPath;
 }
 function applyDvs001Fix(absPath) {
   const rel = import_node_path22.default.basename(absPath);
-  const lines = import_node_fs15.default.readFileSync(absPath, "utf-8").split(/\r?\n/);
+  const lines = import_node_fs16.default.readFileSync(absPath, "utf-8").split(/\r?\n/);
   const newLines = lines.filter((ln) => !/^\s*user\s+root\s*$/i.test(ln.trim()));
   const hasNonRootUser = newLines.some(
     (ln) => /^\s*user\s+\S+\s*$/i.test(ln.trim()) && !/^\s*user\s+root\s*$/i.test(ln.trim())
@@ -5254,7 +5272,7 @@ function applyDvs001Fix(absPath) {
     };
   }
   const backupPath = writeBackup(absPath);
-  import_node_fs15.default.writeFileSync(absPath, `${newLines.join("\n")}
+  import_node_fs16.default.writeFileSync(absPath, `${newLines.join("\n")}
 `, "utf-8");
   return {
     status: "fixed",
@@ -5331,7 +5349,7 @@ function applyRemediation(args) {
       fix_template: row.fix_template
     };
   }
-  const original = import_node_fs15.default.readFileSync(resolved.abs, "utf-8");
+  const original = import_node_fs16.default.readFileSync(resolved.abs, "utf-8");
   const { index, count } = locateTargetInFile(original, target);
   if (count === 0) {
     return {
@@ -5358,7 +5376,7 @@ function applyRemediation(args) {
   const backupPath = writeBackup(resolved.abs);
   const ending = original.includes("\r\n") ? "\r\n" : "\n";
   const outText = updated.split("\n").join(ending);
-  import_node_fs15.default.writeFileSync(resolved.abs, outText.endsWith(ending) || !original.endsWith(ending) ? outText : outText + ending, "utf-8");
+  import_node_fs16.default.writeFileSync(resolved.abs, outText.endsWith(ending) || !original.endsWith(ending) ? outText : outText + ending, "utf-8");
   return {
     status: "fixed",
     message: "Remediation applied after exact target verification; backup created",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runsec/mcp",
-  "version": "1.0.67",
+  "version": "1.0.69",
   "main": "dist/index.js",
   "files": [
     "dist",