@securecode-ai/mcp 0.1.0

package/dist/project-map/parserLoader.js

@@ -0,0 +1,175 @@
+"use strict";
+/**
+ * Phase 4 — web-tree-sitter loader + WASM grammar resolver.
+ *
+ * web-tree-sitter ships a Node ESM/CJS entry plus language WASM blobs.
+ * In a VS Code extension the compiled JS runs from dist/, so the WASM
+ * files MUST be co-located somewhere we can resolve at runtime. We bundle
+ * the grammars under `resources/tree-sitter/` (see
+ * `resources/tree-sitter/README.md` for the vendoring recipe) and resolve
+ * them with an absolute path computed from the extension install dir.
+ *
+ * Loading is lazy and memoized: grammars are ~1-3 MB each and we only
+ * need the one matching the file being parsed.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadLanguage = loadLanguage;
+exports.parseSource = parseSource;
+exports.nodeText = nodeText;
+exports.grammarForFile = grammarForFile;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+let _tsPromise = null;
+const _languageCache = new Map();
+let _parserCache = null;
+/**
+ * Locate the directory holding the bundled WASM grammars.
+ *
+ * Standalone MCP: resolve from the package root (dist/project-map -> ../../resources/tree-sitter).
+ * Override with SECURECODE_GRAMMAR_DIR for custom installs.
+ */
+function grammarDir() {
+    if (process.env.SECURECODE_GRAMMAR_DIR) {
+        return process.env.SECURECODE_GRAMMAR_DIR;
+    }
+    // __dirname when compiled is <pkg>/dist/project-map. Two levels up.
+    const here = __dirname;
+    const pkgRoot = path.resolve(here, '..', '..');
+    return path.join(pkgRoot, 'resources', 'tree-sitter');
+}
+/**
+ * Lazy-load and initialise web-tree-sitter (Node CJS entry).
+ *
+ * The WASM runtime MUST be initialised before any Language.load() call. The
+ * initialiser moved between versions: >= 0.26 exposes a static `Parser.init()`,
+ * while <= 0.25 exposed a module-level `init()`. We try both, in that order.
+ * Getting this wrong is silent — Language.load() rejects and the Project Map
+ * degrades to producing nothing — so both shapes are handled explicitly.
+ */
+function loadTreeSitter() {
+    if (_tsPromise)
+        return _tsPromise;
+    _tsPromise = (async () => {
+        // web-tree-sitter's package "main" is the CJS bundle that works in Node.
+        const mod = require('web-tree-sitter');
+        if (typeof mod.Parser?.init === 'function') {
+            await mod.Parser.init();
+        }
+        else if (typeof mod.init === 'function') {
+            await mod.init();
+        }
+        return mod;
+    })();
+    return _tsPromise;
+}
+/** Resolve the Language namespace across both export shapes. */
+function languageNamespace(ts) {
+    const ns = ts.Language ?? ts.Parser?.Language;
+    if (!ns || typeof ns.load !== 'function') {
+        throw new Error('SecureCode: web-tree-sitter exposes no Language.load()');
+    }
+    return ns;
+}
+/**
+ * Load a language grammar by short name. Memoized per language.
+ * Throws if the WASM file is missing — callers should catch and degrade
+ * gracefully (the Project Map is best-effort; a missing grammar must never
+ * break a scan).
+ */
+function loadLanguage(name) {
+    if (_languageCache.has(name))
+        return _languageCache.get(name);
+    const p = (async () => {
+        const ts = await loadTreeSitter();
+        const file = path.join(grammarDir(), `tree-sitter-${name}.wasm`);
+        if (!fs.existsSync(file)) {
+            throw new Error(`SecureCode: tree-sitter grammar missing: ${file}`);
+        }
+        return languageNamespace(ts).load(file);
+    })();
+    _languageCache.set(name, p);
+    return p;
+}
+/**
+ * Parse source code with a grammar. Returns the root node or null when the
+ * grammar is unavailable (best-effort: callers must handle null).
+ */
+async function parseSource(source, language) {
+    try {
+        const ts = await loadTreeSitter();
+        const lang = await loadLanguage(language);
+        if (!_parserCache) {
+            _parserCache = new ts.Parser();
+        }
+        const parser = _parserCache;
+        parser.setLanguage(lang);
+        const tree = parser.parse(source);
+        // >= 0.26 exposes `rootNode` as a property; <= 0.25 had getRootNode().
+        const root = tree.rootNode ?? tree.getRootNode?.();
+        if (!root) {
+            throw new Error('SecureCode: tree-sitter returned no root node');
+        }
+        return { tree, root };
+    }
+    catch (err) {
+        // Best-effort: never let a parser failure kill the scan.
+        console.warn('SecureCode: tree-sitter parse failed:', err);
+        return null;
+    }
+}
+/**
+ * Convenience: extract the source text for a node using the original source
+ * string. Tree-sitter nodes don't always carry .text (depends on version).
+ */
+function nodeText(node, source) {
+    if (node.text !== undefined)
+        return node.text;
+    return source.slice(node.startIndex, node.endIndex);
+}
+/** Pick a grammar for a file path. */
+function grammarForFile(filePath) {
+    const ext = path.extname(filePath).toLowerCase();
+    if (ext === '.ts')
+        return 'typescript';
+    if (ext === '.tsx')
+        return 'tsx';
+    if (ext === '.py')
+        return 'python';
+    if (ext === '.js' || ext === '.jsx' || ext === '.mjs' || ext === '.cjs')
+        return 'javascript';
+    return 'unknown';
+}
+//# sourceMappingURL=parserLoader.js.map

package/dist/project-map/parserLoader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parserLoader.js","sourceRoot":"","sources":["../../src/project-map/parserLoader.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0GH,oCAYC;AAMD,kCAwBC;AAMD,4BAGC;AAGD,wCASC;AAvKD,uCAAyB;AACzB,2CAA6B;AA4C7B,IAAI,UAAU,GAA+B,IAAI,CAAC;AAClD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA4B,CAAC;AAC3D,IAAI,YAAY,GAA4B,IAAI,CAAC;AAEjD;;;;;GAKG;AACH,SAAS,UAAU;IACf,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;QACrC,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC9C,CAAC;IACD,oEAAoE;IACpE,MAAM,IAAI,GAAG,SAAS,CAAC;IACvB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc;IACnB,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,UAAU,GAAG,CAAC,KAAK,IAAI,EAAE;QACrB,yEAAyE;QACzE,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAe,CAAC;QACrD,IAAI,OAAO,GAAG,CAAC,MAAM,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;YACzC,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;aAAM,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACxC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACrB,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC,CAAC,EAAE,CAAC;IACL,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,gEAAgE;AAChE,SAAS,iBAAiB,CAAC,EAAc;IACrC,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC9C,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,IAAoD;IAC7E,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;IAC/D,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;QAClB,MAAM,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,eAAe,IAAI,OAAO,CAAC,CAAC;QACjE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,iBAAiB,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC,EAAE,CAAC;IACL,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5B,OAAO,CAAC,CAAC;AACb,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,WAAW,CAC7B,MAAc,EACd,QAAwD;IAExD,IAAI,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,YAAY,EAAE,CAAC;YAChB,YAAY,GAAG,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC;QAC5B,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,uEAAuE;QACvE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACnD,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,yDAAyD;QACzD,OAAO,CAAC,IAAI,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAgB,QAAQ,CAAC,IAAoB,EAAE,MAAc;IACzD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IAC9C,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,sCAAsC;AACtC,SAAgB,cAAc,CAC1B,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,YAAY,CAAC;IACvC,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC;IACnC,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,YAAY,CAAC;IAC7F,OAAO,SAAS,CAAC;AACrB,CAAC"}

package/dist/project-map/schemas.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Phase 4 — validator schema collection.
+ *
+ * Where a request body is declared by a schema (zod, Joi, yup, pydantic), the
+ * schema's fields ARE the endpoint's parameters: they are the inputs that
+ * actually reach the handler, and they are frequently the only place the field
+ * names appear at all. `CreateUserSchema.parse(req.body)` never mentions
+ * `email` or `name`, so a params pass that only looks for `req.body.<name>`
+ * reads reports an endpoint with no inputs.
+ */
+import { TreeSitterNode } from './parserLoader';
+import { ValidatorLibrary } from './types';
+/** A validation schema declared in a file, keyed by its local variable name. */
+export interface SchemaDef {
+    /** Field names the schema declares. */
+    fields: string[];
+    library: ValidatorLibrary;
+}
+/** Methods that run a schema against a value: `Schema.parse(req.body)`. */
+export declare const SCHEMA_VALIDATION_METHODS: Set<string>;
+/**
+ * Collect every validation schema declared in a file.
+ *
+ * JS/TS: `const S = z.object({...})` / `Joi.object({...})` / `yup.object({...})`.
+ * Python: `class S(BaseModel): ...` — pydantic models, including subclasses of
+ * a model already seen in this file.
+ */
+export declare function collectSchemas(root: TreeSitterNode, source: string, imports: Map<string, string>): Map<string, SchemaDef>;

package/dist/project-map/schemas.js

@@ -0,0 +1,131 @@
+"use strict";
+/**
+ * Phase 4 — validator schema collection.
+ *
+ * Where a request body is declared by a schema (zod, Joi, yup, pydantic), the
+ * schema's fields ARE the endpoint's parameters: they are the inputs that
+ * actually reach the handler, and they are frequently the only place the field
+ * names appear at all. `CreateUserSchema.parse(req.body)` never mentions
+ * `email` or `name`, so a params pass that only looks for `req.body.<name>`
+ * reads reports an endpoint with no inputs.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SCHEMA_VALIDATION_METHODS = void 0;
+exports.collectSchemas = collectSchemas;
+const astHelpers_1 = require("./astHelpers");
+/** Builder receivers that produce an object schema, mapped to their library. */
+const SCHEMA_BUILDERS = [
+    { library: 'zod', receivers: /^z$|^zod$/, methods: new Set(['object', 'strictObject']) },
+    { library: 'joi', receivers: /^joi$/i, methods: new Set(['object']) },
+    { library: 'yup', receivers: /^yup$/, methods: new Set(['object', 'shape']) },
+];
+/** Methods that run a schema against a value: `Schema.parse(req.body)`. */
+exports.SCHEMA_VALIDATION_METHODS = new Set([
+    'parse', 'safeParse', 'parseAsync', 'safeParseAsync',
+    'validate', 'validateAsync', 'validateSync',
+    'cast', 'load', 'model_validate', 'parse_obj',
+]);
+/** Field names declared by a JS object literal: `{ email: ..., name: ... }`. */
+function objectLiteralFields(node, source) {
+    const fields = [];
+    for (const child of node.namedChildren) {
+        if (child.type !== 'pair')
+            continue;
+        const key = child.child(0);
+        if (!key)
+            continue;
+        const text = source.slice(key.startIndex, key.endIndex);
+        fields.push((0, astHelpers_1.isStringLiteral)(key) ? (0, astHelpers_1.stringLiteralValue)(key, source) : text);
+    }
+    return fields;
+}
+/** Field names declared by a pydantic model body: `email: EmailStr`. */
+function pydanticModelFields(classNode, source) {
+    const body = classNode.namedChildren.find(c => c.type === 'block');
+    if (!body)
+        return [];
+    const fields = [];
+    for (const stmt of body.namedChildren) {
+        for (const n of stmt.type === 'expression_statement' ? stmt.namedChildren : [stmt]) {
+            if (n.type !== 'assignment')
+                continue;
+            const target = n.child(0);
+            if (target && (0, astHelpers_1.isIdentifier)(target)) {
+                fields.push(source.slice(target.startIndex, target.endIndex));
+            }
+        }
+    }
+    return fields;
+}
+/**
+ * Collect every validation schema declared in a file.
+ *
+ * JS/TS: `const S = z.object({...})` / `Joi.object({...})` / `yup.object({...})`.
+ * Python: `class S(BaseModel): ...` — pydantic models, including subclasses of
+ * a model already seen in this file.
+ */
+function collectSchemas(root, source, imports) {
+    const out = new Map();
+    for (const n of (0, astHelpers_1.walk)(root)) {
+        // --- JS/TS builder calls -------------------------------------------
+        if (n.type === 'variable_declarator') {
+            const name = n.child(0);
+            const value = n.child(n.childCount - 1);
+            if (!name || !value || !(0, astHelpers_1.isIdentifier)(name))
+                continue;
+            if (value.type !== 'call_expression')
+                continue;
+            const def = schemaFromBuilderCall(value, source, imports);
+            if (def)
+                out.set(source.slice(name.startIndex, name.endIndex), def);
+            continue;
+        }
+        // --- Python pydantic models ----------------------------------------
+        if (n.type === 'class_definition') {
+            const nameNode = n.namedChildren.find(c => (0, astHelpers_1.isIdentifier)(c));
+            const bases = n.namedChildren.find(c => c.type === 'argument_list');
+            if (!nameNode || !bases)
+                continue;
+            const baseText = source.slice(bases.startIndex, bases.endIndex);
+            const inheritsModel = /\bBaseModel\b/.test(baseText)
+                || [...out.keys()].some(k => new RegExp(`\\b${k}\\b`).test(baseText));
+            if (!inheritsModel)
+                continue;
+            const fields = pydanticModelFields(n, source);
+            if (fields.length === 0)
+                continue;
+            out.set(source.slice(nameNode.startIndex, nameNode.endIndex), {
+                fields,
+                library: 'pydantic',
+            });
+        }
+    }
+    return out;
+}
+/** Recognise `z.object({...})` / `Joi.object({...})` and read its fields. */
+function schemaFromBuilderCall(call, source, imports) {
+    const fn = call.child(0);
+    if (!fn || (fn.type !== 'member_expression' && fn.type !== 'attribute'))
+        return null;
+    const obj = fn.child(0);
+    const prop = fn.child(fn.childCount - 1);
+    if (!obj || !prop)
+        return null;
+    const receiver = (0, astHelpers_1.baseIdentifier)(obj, source);
+    if (!receiver)
+        return null;
+    const method = source.slice(prop.startIndex, prop.endIndex);
+    const spec = imports.get(receiver) ?? '';
+    const builder = SCHEMA_BUILDERS.find(b => b.methods.has(method) && (b.receivers.test(receiver) || b.receivers.test(spec)));
+    if (!builder)
+        return null;
+    const args = call.child(call.childCount - 1);
+    const literal = args?.namedChildren.find(c => c.type === 'object');
+    if (!literal)
+        return null;
+    const fields = objectLiteralFields(literal, source);
+    if (fields.length === 0)
+        return null;
+    return { fields, library: builder.library };
+}
+//# sourceMappingURL=schemas.js.map

package/dist/project-map/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/project-map/schemas.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAgEH,wCAsCC;AAnGD,6CAAuG;AAUvG,gFAAgF;AAChF,MAAM,eAAe,GAA6E;IAC9F,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,EAAE;IACxF,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE;IACrE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,EAAE;CAChF,CAAC;AAEF,2EAA2E;AAC9D,QAAA,yBAAyB,GAAG,IAAI,GAAG,CAAC;IAC7C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB;IACpD,UAAU,EAAE,eAAe,EAAE,cAAc;IAC3C,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,WAAW;CAChD,CAAC,CAAC;AAEH,gFAAgF;AAChF,SAAS,mBAAmB,CAAC,IAAoB,EAAE,MAAc;IAC7D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QACpC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,IAAA,4BAAe,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAA,+BAAkB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,wEAAwE;AACxE,SAAS,mBAAmB,CAAC,SAAyB,EAAE,MAAc;IAClE,MAAM,IAAI,GAAG,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IACnE,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACpC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACjF,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY;gBAAE,SAAS;YACtC,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,MAAM,IAAI,IAAA,yBAAY,EAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAClE,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,cAAc,CAC1B,IAAoB,EACpB,MAAc,EACd,OAA4B;IAE5B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAqB,CAAC;IAEzC,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,IAAI,CAAC,EAAE,CAAC;QACzB,sEAAsE;QACtE,IAAI,CAAC,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;YACxC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,IAAA,yBAAY,EAAC,IAAI,CAAC;gBAAE,SAAS;YACrD,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB;gBAAE,SAAS;YAC/C,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC1D,IAAI,GAAG;gBAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YACpE,SAAS;QACb,CAAC;QAED,sEAAsE;QACtE,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAA,yBAAY,EAAC,CAAC,CAAC,CAAC,CAAC;YAC5D,MAAM,KAAK,GAAG,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;YACpE,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK;gBAAE,SAAS;YAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAChE,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC;mBAC7C,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC1E,IAAI,CAAC,aAAa;gBAAE,SAAS;YAC7B,MAAM,MAAM,GAAG,mBAAmB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAClC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE;gBAC1D,MAAM;gBACN,OAAO,EAAE,UAAU;aACtB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACf,CAAC;AAED,6EAA6E;AAC7E,SAAS,qBAAqB,CAC1B,IAAoB,EACpB,MAAc,EACd,OAA4B;IAE5B,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,mBAAmB,IAAI,EAAE,CAAC,IAAI,KAAK,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE5D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACrC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;AAChD,CAAC"}

package/dist/project-map/types.d.ts

@@ -0,0 +1,232 @@
+/**
+ * Phase 4 Project Map — shared types.
+ *
+ * The Project Map is a local, Tree-sitter-derived model of every HTTP
+ * endpoint in the workspace plus the cross-file context that protects it
+ * (middleware chain, validators, auth, ORM/data layer). It is what lets the
+ * Juror reason about whether a route is actually defended, and what lets
+ * the Attacker build endpoint-specific scenarios instead of generic ones.
+ *
+ * Nothing here ever leaves the machine: only the derived `EndpointContext`
+ * for the file under scan is attached to the scan payload, and that is the
+ * ONLY new field the API contract gains (optional; ignored by today's API).
+ */
+/** HTTP method, uppercased. */
+export type HttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'HEAD' | 'OPTIONS' | 'ALL';
+/** Where a parameter lives on the request. */
+export type ParamSource = 'body' | 'query' | 'path' | 'header' | 'cookie' | 'unknown';
+/** Auth scheme detected for an endpoint. */
+export type AuthScheme = 'jwt' | 'session' | 'api-key' | 'oauth' | 'basic' | 'none' | 'unknown';
+/** ORM / data layer detected for an endpoint. */
+export type DataLayer = 'prisma' | 'typeorm' | 'sequelize' | 'knex' | 'mongoose' | 'raw-sql' | 'supabase' | 'sqlalchemy' | 'django-orm' | 'none' | 'unknown';
+/** Validator library detected for a parameter or handler. */
+export type ValidatorLibrary = 'zod' | 'joi' | 'express-validator' | 'yup' | 'ajv' | 'pydantic' | 'marshmallow' | 'none' | 'unknown';
+/** Response shape detected for an endpoint. */
+export type ResponseShape = 'json' | 'html' | 'redirect' | 'stream' | 'file' | 'text' | 'unknown';
+/**
+ * Confidence scores per the README Phase 4 spec.
+ *
+ * 1.0  — static literal (string-literal path, directly-registered middleware)
+ * 0.8  — runtime-confirmed (trace hook observed the relationship)
+ * 0.6  — intra-file dataflow (resolved from a same-file const/variable)
+ * 0.2  — unresolved (could not statically resolve; not yet traced)
+ * 0.15 — meta-programming (new Function / vm.runIn* / dynamic require)
+ * 0.1  — fully unresolved, no usable evidence
+ * 0.0  — dynamic import pattern (D1-D10), flagged but un-confirmed
+ */
+export declare const Confidence: {
+    readonly STATIC_LITERAL: 1;
+    readonly RUNTIME_CONFIRMED: 0.8;
+    readonly INTRA_FILE_DATAFLOW: 0.6;
+    readonly UNRESOLVED: 0.2;
+    readonly META_PROGRAMMING: 0.15;
+    readonly FULLY_UNRESOLVED: 0.1;
+    readonly DYNAMIC_PATTERN: 0;
+};
+/** A single parameter on an endpoint. */
+export interface EndpointParam {
+    name: string;
+    /** Best-effort type annotation as a string ('string', 'number', 'User', 'unknown'). */
+    type: string;
+    source: ParamSource;
+    /** True iff a validator call covers this param. */
+    validated: boolean;
+    /** Which validator library was detected, when validated. */
+    validator?: ValidatorLibrary;
+    /** Confidence that this param actually exists at this source. */
+    confidence: number;
+}
+/** A middleware entry in an endpoint's chain (registration order). */
+export interface MiddlewareEntry {
+    /** Local name of the middleware function or import. */
+    name: string;
+    /** File where the middleware is defined or imported (workspace-relative). */
+    sourceFile: string;
+    /** Line where it was registered (app.use(...) or app.get('/', mw, handler)). */
+    registrationLine: number;
+    /** Confidence that this middleware actually applies to this endpoint. */
+    confidence: number;
+}
+/** One node in the handler's call graph (a function the handler invokes). */
+export interface CallGraphNode {
+    /** Local name of the called function. */
+    name: string;
+    /** File where the called function is defined, when resolvable. */
+    calleeFile?: string;
+    /** Line of the call site. */
+    callLine: number;
+    /** Confidence that this call actually happens. */
+    confidence: number;
+}
+/**
+ * The full per-endpoint record — one of these is produced for every
+ * `app.get('/x', handler)` / `@app.get('/x')` / `@router.get('/x')` /
+ * `@app.route('/x')` / Fastify `.get('/x', handler)` / Koa `router.get(...)`
+ * / FastAPI `@app.get('/x')` / Django `path('x', view)` site discovered.
+ */
+export interface EndpointRecord {
+    /** Stable id: `${file}:${line}:${method}:${path}`. */
+    id: string;
+    method: HttpMethod;
+    /**
+     * Route path AS REGISTERED at the route site (string literal when
+     * available; '?' when dynamic). For a router mounted under a prefix in
+     * another file this stays router-local — see `mountedPath`.
+     */
+    path: string;
+    /**
+     * Full externally-visible path, when the router carrying this route is
+     * mounted under a prefix somewhere else (`/api/users` + `/:id`).
+     *
+     * Kept alongside `path` rather than replacing it: consumers key off the
+     * as-registered path to line up with the source, while an attacker or a
+     * trace needs the URL that is actually reachable. Absent when the router
+     * is not mounted anywhere we can see.
+     */
+    mountedPath?: string;
+    /** Handler function local name (or '<anonymous>'). */
+    handlerName: string;
+    /** Workspace-relative source file of the handler. */
+    sourceFile: string;
+    /** 1-indexed line of the handler registration / decorator. */
+    line: number;
+    /** Middleware chain in registration order (global app.use first, then route mw). */
+    middleware: MiddlewareEntry[];
+    /** Parameters extracted from the handler signature + validators. */
+    params: EndpointParam[];
+    authScheme: AuthScheme;
+    dataLayer: DataLayer;
+    validatorLibrary: ValidatorLibrary;
+    callGraph: CallGraphNode[];
+    responseShape: ResponseShape;
+    /**
+     * Confidence that `path` is the path this endpoint is really registered
+     * at: 1.0 for a string literal or a filesystem-derived route, 0.6 when it
+     * came from a same-file constant, UNRESOLVED when it is '?'.
+     *
+     * Kept separate from `confidence` because it is the one piece of evidence
+     * that exists even for an endpoint with no middleware, params or calls —
+     * without it such a record would be indistinguishable from one where
+     * nothing at all could be extracted.
+     */
+    pathConfidence?: number;
+    /** Aggregate confidence for the whole record (min of relationship confidences). */
+    confidence: number;
+    /** True iff a runtime trace confirmed this endpoint exists and was hit. */
+    runtimeConfirmed: boolean;
+}
+/** Layer 2 dynamic import pattern type (D1-D10). */
+export type DynamicPatternType = 'D1' | 'D2' | 'D3' | 'D4' | 'D5' | 'D6' | 'D7' | 'D8' | 'D9' | 'D10';
+/** A single dynamic import / meta-programming detection. */
+export interface DynamicPattern {
+    type: DynamicPatternType;
+    file: string;
+    line: number;
+    /** Short code snippet for surfacing in the panel. */
+    snippet: string;
+    /** Initial confidence — always 0.0 per spec. */
+    confidence: number;
+}
+/** Per-file extraction output. */
+export interface FileExtraction {
+    file: string;
+    language: 'javascript' | 'typescript' | 'tsx' | 'python' | 'unknown';
+    endpoints: EndpointRecord[];
+    dynamicPatterns: DynamicPattern[];
+    /** Imports resolved for cross-file use: name -> sourceFile (workspace-relative). */
+    imports: Record<string, string>;
+    /** mtimes/hash used by the cache. */
+    mtime: number;
+    hash: string;
+}
+/** The whole map. */
+export interface ProjectMap {
+    /** Workspace-relative file -> FileExtraction. */
+    files: Record<string, FileExtraction>;
+    /** Flat endpoint list (denormalized for the panel). */
+    endpoints: EndpointRecord[];
+    /** Flat dynamic-pattern list. */
+    dynamicPatterns: DynamicPattern[];
+    /** Schema version, bumped when the on-disk format changes. */
+    version: number;
+    /** Last full rebuild timestamp (ms). */
+    builtAt: number;
+}
+/** Schema version for the on-disk cache. Bump to invalidate old caches. */
+export declare const PROJECT_MAP_SCHEMA_VERSION = 1;
+/**
+ * EndpointContext — the slice of the Project Map that travels with a
+ * scan. This is the ONLY new field added to the scan payload, and the API
+ * contract is unchanged (today's API ignores it; Phase 5 consumes it).
+ *
+ * It captures everything the Juror needs to reason about whether the
+ * middleware on this route actually defends the sink being scanned:
+ * the middleware chain (with source files), the parameters and their
+ * validation status, the auth scheme, the ORM/data layer, the handler
+ * call graph, and the confidence per relationship.
+ */
+export interface EndpointContext {
+    /** Stable id: `${sourceFile}:${line}:${method}:${path}`. */
+    id?: string;
+    method: HttpMethod;
+    path: string;
+    /** Full externally-visible path when the router is mounted under a prefix. */
+    mountedPath?: string;
+    handlerName: string;
+    sourceFile: string;
+    line: number;
+    middleware: MiddlewareEntry[];
+    params: EndpointParam[];
+    authScheme: AuthScheme;
+    dataLayer: DataLayer;
+    validatorLibrary: ValidatorLibrary;
+    callGraph: CallGraphNode[];
+    responseShape: ResponseShape;
+    confidence: number;
+    runtimeConfirmed: boolean;
+}
+/**
+ * How a related file relates to the file being scanned.
+ *
+ * Mirrors `FileRelationship` in the API's `src/types/scanTypes.ts` exactly.
+ * The API renders the label verbatim into the Scout/Juror/Fixer prompts, so a
+ * value outside this union is not a type error on the wire — it is a prompt
+ * that says something the model has never been told how to read.
+ */
+export type FileRelationship = 'imports' | 'imported_by' | 'route_handler' | 'shared_type' | 'config' | 'middleware';
+/**
+ * A neighbouring source file shipped alongside the scanned file so the model
+ * can see what the file under scan depends on.
+ *
+ * Travels as `workspaceHints.relatedFiles`, which the API already consumes:
+ * `formatRelatedFilesContext` (api/src/services/contextService.ts) folds it
+ * into the Scout, Juror and Fixer prompts.
+ */
+export interface RelatedFile {
+    /** Workspace-relative, POSIX separators — the label the model sees. */
+    filePath: string;
+    content: string;
+    relationship: FileRelationship;
+}
+/** Convert an EndpointRecord into the serializable EndpointContext. */
+export declare function toEndpointContext(r: EndpointRecord): EndpointContext;

package/dist/project-map/types.js

@@ -0,0 +1,61 @@
+"use strict";
+/**
+ * Phase 4 Project Map — shared types.
+ *
+ * The Project Map is a local, Tree-sitter-derived model of every HTTP
+ * endpoint in the workspace plus the cross-file context that protects it
+ * (middleware chain, validators, auth, ORM/data layer). It is what lets the
+ * Juror reason about whether a route is actually defended, and what lets
+ * the Attacker build endpoint-specific scenarios instead of generic ones.
+ *
+ * Nothing here ever leaves the machine: only the derived `EndpointContext`
+ * for the file under scan is attached to the scan payload, and that is the
+ * ONLY new field the API contract gains (optional; ignored by today's API).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROJECT_MAP_SCHEMA_VERSION = exports.Confidence = void 0;
+exports.toEndpointContext = toEndpointContext;
+/**
+ * Confidence scores per the README Phase 4 spec.
+ *
+ * 1.0  — static literal (string-literal path, directly-registered middleware)
+ * 0.8  — runtime-confirmed (trace hook observed the relationship)
+ * 0.6  — intra-file dataflow (resolved from a same-file const/variable)
+ * 0.2  — unresolved (could not statically resolve; not yet traced)
+ * 0.15 — meta-programming (new Function / vm.runIn* / dynamic require)
+ * 0.1  — fully unresolved, no usable evidence
+ * 0.0  — dynamic import pattern (D1-D10), flagged but un-confirmed
+ */
+exports.Confidence = {
+    STATIC_LITERAL: 1.0,
+    RUNTIME_CONFIRMED: 0.8,
+    INTRA_FILE_DATAFLOW: 0.6,
+    UNRESOLVED: 0.2,
+    META_PROGRAMMING: 0.15,
+    FULLY_UNRESOLVED: 0.1,
+    DYNAMIC_PATTERN: 0.0,
+};
+/** Schema version for the on-disk cache. Bump to invalidate old caches. */
+exports.PROJECT_MAP_SCHEMA_VERSION = 1;
+/** Convert an EndpointRecord into the serializable EndpointContext. */
+function toEndpointContext(r) {
+    return {
+        id: r.id,
+        method: r.method,
+        path: r.path,
+        mountedPath: r.mountedPath,
+        handlerName: r.handlerName,
+        sourceFile: r.sourceFile,
+        line: r.line,
+        middleware: r.middleware,
+        params: r.params,
+        authScheme: r.authScheme,
+        dataLayer: r.dataLayer,
+        validatorLibrary: r.validatorLibrary,
+        callGraph: r.callGraph,
+        responseShape: r.responseShape,
+        confidence: r.confidence,
+        runtimeConfirmed: r.runtimeConfirmed,
+    };
+}
+//# sourceMappingURL=types.js.map

package/dist/project-map/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/project-map/types.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AA0RH,8CAmBC;AA9PD;;;;;;;;;;GAUG;AACU,QAAA,UAAU,GAAG;IACtB,cAAc,EAAE,GAAG;IACnB,iBAAiB,EAAE,GAAG;IACtB,mBAAmB,EAAE,GAAG;IACxB,UAAU,EAAE,GAAG;IACf,gBAAgB,EAAE,IAAI;IACtB,gBAAgB,EAAE,GAAG;IACrB,eAAe,EAAE,GAAG;CACd,CAAC;AAqJX,2EAA2E;AAC9D,QAAA,0BAA0B,GAAG,CAAC,CAAC;AAiE5C,uEAAuE;AACvE,SAAgB,iBAAiB,CAAC,CAAiB;IAC/C,OAAO;QACH,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;QACpC,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;KACvC,CAAC;AACN,CAAC"}

package/dist/tools/attack.d.ts

@@ -0,0 +1,2 @@
+import type { ServerContext } from '../mcp/types';
+export declare function toolAttack(ctx: ServerContext, args: any): Promise<unknown>;