@vaultcompass/vault-guard-mcp 1.4.7 → 1.6.0

package/dist/index.js

@@ -59,9 +59,11 @@ var BINARY_EXTENSIONS = /* @__PURE__ */ new Set([
 function isBinaryFile(filePath) {
   return BINARY_EXTENSIONS.has(import_path.default.extname(filePath).toLowerCase());
 }
-async function scanWorkspaceDirectory(root, scanner, concurrency = 10, configIgnorePatterns2 = []) {
+var MCP_SCAN_BUDGET_MS = 5e3;
+async function scanWorkspaceDirectory(root, scanner, concurrency = 10, configIgnorePatterns2 = [], scanBudgetMs = MCP_SCAN_BUDGET_MS) {
   const files = await (0, import_vault_guard_core.getFilesToScanAsync)(root, false, void 0, configIgnorePatterns2);
   const results = [];
+  const overBudget = [];
   let filesScanned = 0;
   let bytesScanned = 0;
   const scanOne = async (file) => {
@@ -71,10 +73,15 @@ async function scanWorkspaceDirectory(root, scanner, concurrency = 10, configIgn
       if (!st.isFile()) return;
       filesScanned += 1;
       bytesScanned += st.size;
+      const t0 = Date.now();
       const matches = await (0, import_vault_guard_core.scanTextFileAsync)(scanner, file, { maxFileBytes: MAX_FILE_SIZE });
+      const elapsed = Date.now() - t0;
       if (matches.length > 0) {
         results.push({ file, matches });
       }
+      if (elapsed > scanBudgetMs) {
+        overBudget.push({ file, elapsed_ms: elapsed, budget_ms: scanBudgetMs });
+      }
     } catch {
     }
   };
@@ -82,11 +89,11 @@ async function scanWorkspaceDirectory(root, scanner, concurrency = 10, configIgn
     const batch = files.slice(i, i + concurrency);
     await Promise.all(batch.map(scanOne));
   }
-  return { results, filesScanned, bytesScanned };
+  return { results, filesScanned, bytesScanned, overBudget };
 }
 
 // src/server.ts
-var SERVER_VERSION = true ? "1.4.7" : "0.0.0-dev";
+var SERVER_VERSION = true ? "1.6.0" : "0.0.0-dev";
 function loadMcpConfig(workspaceRoot) {
   let cfg;
   try {
@@ -107,6 +114,7 @@ function loadMcpConfig(workspaceRoot) {
 function makeScanner(config) {
   return new import_vault_guard_core2.SecretScanner(config);
 }
+var MAX_SCAN_BYTES = 10 * 1024 * 1024;
 function toolPayload(obj) {
   return {
     content: [{ type: "text", text: JSON.stringify(obj, null, 2) }]
@@ -204,7 +212,7 @@ function createMcpServer(options = {}) {
       }
       const dir = resolved.path;
       const t0 = Date.now();
-      const { results, filesScanned, bytesScanned } = await scanWorkspaceDirectory(
+      const { results, filesScanned, bytesScanned, overBudget } = await scanWorkspaceDirectory(
         dir,
         scanner,
         10,
@@ -219,8 +227,13 @@ function createMcpServer(options = {}) {
       return toolPayload({
         summary: {
           files_with_secrets: results.length,
-          total_matches: results.reduce((n, r) => n + r.matches.length, 0)
+          total_matches: results.reduce((n, r) => n + r.matches.length, 0),
+          // Post-hoc: these files WERE scanned, but took long enough that the
+          // result is not trusted. Surfaced so an agent is not handed a silent
+          // "clean" for a file whose scan behaved pathologically.
+          ...overBudget.length > 0 ? { files_over_scan_budget: overBudget.length } : {}
         },
+        ...overBudget.length > 0 ? { over_budget: overBudget } : {},
         json: JSON.parse((0, import_vault_guard_core2.formatJson)(results, { cwd: dir, run })),
         sarif: (0, import_vault_guard_core2.formatSarif)(results, { cwd: dir, run }),
         results
@@ -247,18 +260,28 @@ function createMcpServer(options = {}) {
       if (!import_fs2.default.existsSync(fp) || !import_fs2.default.statSync(fp).isFile()) {
         return toolPayload({ error: "not_a_file", path: fp });
       }
+      const st = import_fs2.default.statSync(fp);
+      if (st.size > MAX_SCAN_BYTES) {
+        return toolPayload({ error: "file_too_large", path: fp, bytes: st.size, max_bytes: MAX_SCAN_BYTES });
+      }
       const t0 = Date.now();
       const matches = scanner.scan(fp);
-      const st = import_fs2.default.statSync(fp);
+      const elapsed = Date.now() - t0;
       const run = {
-        duration_ms: Date.now() - t0,
+        duration_ms: elapsed,
         files_scanned: 1,
         bytes_scanned: st.size,
         patterns_active: scanner.getActivePatternCount()
       };
       const results = matches.length ? [{ file: fp, matches }] : [];
+      const overBudget = elapsed > MCP_SCAN_BUDGET_MS;
       return toolPayload({
-        summary: { files_with_secrets: results.length, total_matches: matches.length },
+        summary: {
+          files_with_secrets: results.length,
+          total_matches: matches.length,
+          ...overBudget ? { over_scan_budget: true } : {}
+        },
+        ...overBudget ? { over_budget: [{ file: fp, elapsed_ms: elapsed, budget_ms: MCP_SCAN_BUDGET_MS }] } : {},
         json: JSON.parse((0, import_vault_guard_core2.formatJson)(results, { cwd: workspaceRoot, run })),
         sarif: (0, import_vault_guard_core2.formatSarif)(results, { cwd: workspaceRoot, run })
       });
@@ -275,12 +298,15 @@ function createMcpServer(options = {}) {
       }
     },
     async ({ text, virtual_path }) => {
+      const bytes = Buffer.byteLength(text, "utf8");
+      if (bytes > MAX_SCAN_BYTES) {
+        return toolPayload({ error: "text_too_large", bytes, max_bytes: MAX_SCAN_BYTES });
+      }
       const scanner = makeScanner(loadMcpConfig(workspaceRoot));
       const t0 = Date.now();
       const matches = scanner.scanContent(text);
       const label = virtual_path ?? "inline://snippet";
       const results = matches.length ? [{ file: label, matches }] : [];
-      const bytes = Buffer.byteLength(text, "utf8");
       const run = {
         duration_ms: Date.now() - t0,
         files_scanned: 1,
@@ -308,16 +334,20 @@ function createMcpServer(options = {}) {
       const targets = paths && paths.length > 0 ? paths : ["."];
       let total = 0;
       const breakdown = {};
+      const visited = /* @__PURE__ */ new Set();
       const walkFile = (file) => {
         try {
-          if (!import_fs2.default.existsSync(file)) return;
-          const st = import_fs2.default.statSync(file);
-          if (st.isFile()) {
+          const lst = import_fs2.default.lstatSync(file);
+          if (lst.isSymbolicLink()) return;
+          if (lst.isFile()) {
             const n = tokenCounter.countTokensInFile(file);
             total += n;
             const ext = import_path2.default.extname(file) || "(no-ext)";
             breakdown[ext] = (breakdown[ext] ?? 0) + n;
-          } else if (st.isDirectory()) {
+          } else if (lst.isDirectory()) {
+            const real = import_fs2.default.realpathSync(file);
+            if (visited.has(real)) return;
+            visited.add(real);
             const entries = import_fs2.default.readdirSync(file, { withFileTypes: true });
             for (const e of entries) {
               if (e.name === "node_modules" || e.name === ".git") continue;
@@ -332,7 +362,12 @@ function createMcpServer(options = {}) {
         if (!resolved.ok) {
           return toolPayload({ error: resolved.error, path: resolved.path });
         }
-        walkFile(resolved.path);
+        let start = resolved.path;
+        try {
+          start = import_fs2.default.realpathSync(resolved.path);
+        } catch {
+        }
+        walkFile(start);
       }
       const estCostAnthropic = tokenCounter.calculateCost("anthropic", total, 0);
       return toolPayload({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vaultcompass/vault-guard-mcp",
-  "version": "1.4.7",
+  "version": "1.6.0",
   "description": "Let Cursor and Claude scan AI-proposed edits for secrets before applying. Local MCP server.",
   "main": "dist/index.js",
   "bin": {
@@ -26,8 +26,8 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
     "zod": "^4.4.3",
-    "@vaultcompass/vault-guard-core": "1.4.7",
-    "@vaultcompass/vault-guard-telemetry": "1.4.7"
+    "@vaultcompass/vault-guard-core": "1.6.0",
+    "@vaultcompass/vault-guard-telemetry": "1.6.0"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",