@taiga-ai/mcp-server 0.26.0-dev.481 → 0.26.0-dev.483

package/dist/index.js

@@ -1763,6 +1763,85 @@ const MAINTENANCE_IGNORE_REASONS = [
 	"accepted_risk",
 	"wont_fix"
 ];
+/**
+* What one lockfile's group list says, read against what its osv-scanner
+* (osv-scalibr) extractor actually writes. Checked per extractor, because the
+* same list means different things in different files:
+*
+* - package-lock.json / npm-shrinkwrap.json: every package entry carries npm's
+*   `dev` / `optional` / `devOptional` flags, transitive ones included, so an
+*   EMPTY list is a runtime dependency, `dev` alone is dev-only, `optional`
+*   alone is shipped, and `dev` + `optional` (devOptional) is left undecided.
+* - pnpm-lock.yaml: `dev` comes from a per-package `dev: true` that lockfile
+*   v9 no longer writes, so an empty list says nothing; `dev` still means dev.
+* - poetry.lock: group names with `main` dropped; a non-main, non-optional
+*   group is not in the runtime install. Poetry 1.x lockfiles carry no groups
+*   at all, so an empty list says nothing.
+* - uv.lock: only direct members of a group are tagged, so an empty list says
+*   nothing; `dev` means dev.
+* - yarn.lock, go.mod/go.sum, Cargo.lock, Gemfile.lock and the rest carry no
+*   group information: unknown whatever the list says.
+*
+* Anything this cannot place is `unknown`, never `runtime`: a wrong "runtime"
+* on a build tool is the claim this exists to stop, and a wrong "dev only" on a
+* shipped package is worse.
+*/
+function lockfileScope(path, groups) {
+	const name = path.slice(path.lastIndexOf("/") + 1);
+	const set = new Set(groups.map((g) => g.trim().toLowerCase()).filter((g) => g !== ""));
+	switch (name) {
+		case "package-lock.json":
+		case "npm-shrinkwrap.json": {
+			if (set.size === 0) return "runtime";
+			const dev = set.has("dev");
+			const optional = set.has("optional");
+			if (dev && optional) return "unknown";
+			if (dev) return "dev";
+			if (optional && set.size === 1) return "runtime";
+			return "unknown";
+		}
+		case "pnpm-lock.yaml":
+		case "uv.lock": return set.size === 1 && set.has("dev") ? "dev" : "unknown";
+		case "poetry.lock": return set.size > 0 && !set.has("optional") && !set.has("main") ? "dev" : "unknown";
+		default: return "unknown";
+	}
+}
+/**
+* Whether a dependency finding sits only in development dependencies, in at
+* least one runtime dependency set, or in lockfiles that do not say. Decided
+* per lockfile (`lockfileScope`) and combined pessimistically: one runtime
+* lockfile makes the finding runtime, one lockfile that cannot say makes it
+* unknown, and only all-dev reads as dev. Groups the sweep did not record
+* (older images, code kinds) are unknown. Presentation only: the tier and the
+* auto-remediation gate do not read this, and a malicious package runs its
+* install script in any group.
+*/
+function dependencyScope(finding) {
+	if (finding.kind !== "vulnerable_dependency" && finding.kind !== "outdated_dependency") return "unknown";
+	const entries = Object.entries(finding.dependencyGroups ?? {});
+	if (entries.length === 0) return "unknown";
+	return combineScopes(entries.map(([path, groups]) => lockfileScope(path, Array.isArray(groups) ? groups : [])));
+}
+function combineScopes(scopes) {
+	if (scopes.includes("runtime")) return "runtime";
+	if (scopes.includes("unknown") || scopes.length === 0) return "unknown";
+	return "dev";
+}
+/**
+* Whether the repository declares the package itself. Per lockfile the sweep
+* says direct or transitive; across lockfiles one direct declaration makes the
+* finding direct (that copy is the repository's to bump), transitive only when
+* every readable lockfile says so, unknown when the sweep could read none of
+* them or did not record it (older images, code kinds). Presentation only; the
+* remediation step already finds every resolved copy and its parent itself.
+*/
+function dependencyRelation(finding) {
+	if (finding.kind !== "vulnerable_dependency" && finding.kind !== "outdated_dependency") return "unknown";
+	const values = Object.values(finding.dependencyRelation ?? {});
+	if (values.includes("direct")) return "direct";
+	if (values.length > 0 && values.every((v) => v === "transitive")) return "transitive";
+	return "unknown";
+}
 new Set(CODE_REMEDIATION_KINDS);
 /** A non-empty string, or null. */
 const locationText = z.string().min(1).nullable().catch(null);
@@ -4892,6 +4971,40 @@ function withFixability(row) {
 	};
 	return row;
 }
+/**
+* Dev-only, runtime or unknown, said on a dependency row (PRO-2861) in place of the raw per-lockfile groups
+* the API carries: the groups need the lockfile name to read, which `dependencyScope` does once here.
+*/
+function withDependencyScope(row, { keepGroups = false } = {}) {
+	const { dependencyGroups: _groups, dependencyRelation: _relation, ...lean } = row;
+	const rest = keepGroups ? {
+		...row,
+		dependencyRelation: void 0
+	} : lean;
+	if (!(row["kind"] === "vulnerable_dependency" || row["kind"] === "outdated_dependency")) return rest;
+	const kind = row["kind"];
+	return {
+		...rest,
+		dependencyScope: dependencyScope({
+			kind,
+			dependencyGroups: row["dependencyGroups"]
+		}),
+		dependencyRelation: dependencyRelation({
+			kind,
+			dependencyRelation: row["dependencyRelation"]
+		}),
+		...keepGroups ? { dependencyRelationByLockfile: row["dependencyRelation"] ?? null } : {}
+	};
+}
+/** A finding as a tool answers it: the row fields, the scope, and whether Fix would take it. */
+function findingRows(findings, extra = []) {
+	return pickFields(findings, [
+		...FINDING_ROW_FIELDS,
+		"dependencyGroups",
+		"dependencyRelation",
+		...extra
+	]).map((row) => withDependencyScope(row)).map(withFixability);
+}
 /** The parts of an advisory record an agent reads; the rest (every affected range, every reference) is full: true. */
 const ADVISORY_KEPT = [
 	"id",
@@ -5015,7 +5128,7 @@ function registerMaintenanceTools(server, client) {
 				sweep: null,
 				sweepNote: "The sweep overview could not be read: an empty list here is not an all-clear."
 			} : sweep ? { sweep } : {},
-			...page(pickFields(result.data, FINDING_ROW_FIELDS).map(withFixability), result.nextCursor),
+			...page(findingRows(result.data), result.nextCursor),
 			...typeof result.totalCount === "number" ? { totalCount: result.totalCount } : {},
 			...params.status === void 0 && params.severity === void 0 && params.kind === void 0 && typeof result.totalCount === "number" && sweep && sweep !== "unread" && typeof sweep["openFindings"] === "number" && sweep["openFindings"] !== result.totalCount ? { totalNote: "totalCount includes findings with a fix under way (remediating) and ignored findings whose ignore has expired; sweep.openFindings counts open ones only." } : {}
 		});
@@ -5030,10 +5143,10 @@ function registerMaintenanceTools(server, client) {
 		annotations: READ_ONLY
 	}, (params) => runTool(async () => {
 		const { runId, ...raw } = (await client.getFinding(params.findingId)).data;
-		const finding = withFixability(params.full ? raw : {
+		const finding = withFixability(params.full ? withDependencyScope(raw, { keepGroups: true }) : withDependencyScope({
 			...raw,
 			data: leanAdvisory(raw["data"])
-		});
+		}));
 		return toolResult(runId === void 0 ? finding : {
 			sweepId: runId,
 			...finding
@@ -5120,7 +5233,7 @@ function registerMaintenanceTools(server, client) {
 			...params.expiresAt !== void 0 ? { ignoreExpiresAt: params.expiresAt } : {}
 		} : { status: "open" };
 		const finding = (await client.updateFinding(params.findingId, body)).data;
-		return toolResult(pickFields([finding], [...FINDING_ROW_FIELDS, "ignoreNote"])[0]);
+		return toolResult(findingRows([finding], ["ignoreNote"])[0]);
 	}));
 	server.registerTool("taiga_fix_finding", {
 		title: "Fix a finding",
@@ -5136,7 +5249,7 @@ function registerMaintenanceTools(server, client) {
 			const fixed = (await client.remediateFinding(params.productId, params.findingId)).data;
 			return toolResult({
 				backlogItemId: fixed.backlogItemId,
-				finding: fixed.finding ? pickFields([fixed.finding], FINDING_ROW_FIELDS)[0] : null
+				finding: fixed.finding ? findingRows([fixed.finding])[0] : null
 			});
 		}
 		const finding = (await client.getFinding(params.findingId)).data;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.26.0-dev.481",
+  "version": "0.26.0-dev.483",
   "description": "Taiga for AI coding assistants: read products, policies, initiatives and runs, and operate the line, over MCP",
   "mcpName": "ga.tai/mcp-server",
   "type": "module",