@visulima/vis-mcp 1.0.0-alpha.1 → 1.0.0-alpha.10

package/CHANGELOG.md

@@ -1,3 +1,203 @@
+## @visulima/vis-mcp [1.0.0-alpha.10](https://github.com/visulima/visulima/compare/@visulima/vis-mcp@1.0.0-alpha.9...@visulima/vis-mcp@1.0.0-alpha.10) (2026-05-14)
+
+### ⚠ BREAKING CHANGES
+
+* **vis:** the following security.* keys were renamed:
+- security.minimumReleaseAge          -> security.policies.first_seen.minutes
+- security.minimumReleaseAgeExclude   -> security.policies.first_seen.exclude
+- security.trustPolicy                -> security.policies.publisher_change.mode
+- security.trustPolicyExclude         -> security.policies.publisher_change.exclude
+- security.trustPolicyIgnoreAfter     -> security.policies.publisher_change.ignoreAfter
+- security.allowBuilds                -> security.policies.install_scripts.allow
+- security.strictDepBuilds            -> security.policies.install_scripts.strict
+- security.socket.minimumScore        -> security.policies.score.minimum
+- security.socket.acceptedRisks       -> security.acceptedRisks
+- security.audit.failOn               -> security.policies.vulnerability.failOn
+- security.audit.usage                -> security.policies.vulnerability.usage
+
+AcceptedRisk now carries optional policies[] and expiresAt fields so
+risks can be scoped per-policy and time-boxed. Native PM sync writers
+keep emitting pnpm-native field names since pnpm owns that schema.
+
+Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
+
+* chore(vis): address coderabbit review feedback
+
+- Add JSDoc to exported items across hook builtins, advisories, audit, docker
+- Document OSV `last_affected` inclusive-upper semantics with a focused test
+- Annotate NAPI u64→u32 truncations with JS Number range rationale
+- Switch vis-mcp tool payloads to zod schemas with `.catchall(z.unknown())`
+  so unknown CLI fields stay forward-compatible
+- Fence RFC code blocks with explicit languages and tidy hook-command
+  formatting (multi-line type, implicit-return arrows)
+
+Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
+
+* chore(vis): address second-round coderabbit feedback on policies rename
+
+- Drift report labels now reference `security.policies.*` paths so the
+  hint matches the keys users edit
+- `defineConfig` JSDoc examples use the new `security.policies` shape
+- `mergeSecurityDefaults` deep-merges every defaulted sub-policy
+  generically; `mergeVisConfigs` deep-merges `policies` and
+  `acceptedRisks` so presets aren't clobbered
+- Config-writer scopes its `allow:` match to follow an
+  `install_scripts:` opener
+- JSDoc clarifications for `audit.advisories.source` default,
+  `acceptedRisks.expiresAt`/`acceptedScore` ranges, `malware.mode`
+  cross-field default, and the current `policies.score.minimum`
+  wiring gap
+
+Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
+
+* chore(vis): finish coderabbit round-2 fixes — camelCase policies + wire score.minimum
+
+- Rename `PolicyName` union to camelCase (`firstSeen`, `installScripts`,
+  `publisherChange`, `unexpectedDeps`). Updates every consumer in src/,
+  test fixtures, schemas, and docs. JSON schema regenerated.
+- Add `types` mapping to the `#native` package.json import so TypeScript
+  resolves `index.d.ts` when consumers import the alias.
+- Thread `socketOptions.minimumScore` through `audit`, `doctor`, `check`,
+  `update`, `add`, `formatSecurityOverview`, `formatSummary`, and
+  `applyFilter`. `buildSocketOptions` now resolves the effective minimum
+  once (from `security.policies.score.minimum` or
+  `DEFAULT_LOW_SCORE_THRESHOLD`) so every consumer sees the same value
+  instead of comparing scores against the hard-coded constant.
+- Update the JSDoc on `policies.score.minimum` to reflect the new wiring.
+
+Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
+
+* feat(vis): add Socket-style policy engine with 4 offline-clean policies
+
+Introduce a unified `evaluatePolicies()` engine under `src/security/policies/`
+with four offline-clean modules: license, install_scripts, vulnerability,
+and unexpected_deps (baseline mode). Each policy emits PolicyDecisions
+(block/warn/info) keyed by package, with per-policy accepted-risk scoping
+and expiresAt support reused from the shared matcher.
+
+Wires the engine into `vis audit`: a new `--policies <names>` flag
+(comma-list, `all`, or `none`) narrows evaluation. Block-severity
+decisions feed into `--exit-code` and `--fail-on`. JSON output gains
+`policies[]` + `summary.policyBlocks`. SARIF and HTML formatters render
+policy decisions alongside vulnerabilities; CSAF and CycloneDX-VEX are
+intentionally left untouched (vuln-specific data models).
+
+Adds `readNodeModulesManifests()` to walk `node_modules/` (including the
+pnpm `.pnpm/` content-addressed store) and surface license + scripts +
+maintainers metadata for the offline policies.
+
+33 new unit + integration tests; full vitest suite (3582/3582) green;
+`tsc --noEmit` clean.
+
+Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
+
+* fix(vis): close three audit policy gating gaps surfaced by CodeRabbit
+
+- applyExitGate's fallthrough call to applyFailOnGate was dropping the
+  policyDecisions argument, so `vis audit --format sarif --fail-on high`
+  exited 0 when the only signal was a block-severity policy decision.
+  Forward the argument.
+- Unknown --policies tokens were silently swallowed when format was
+  json/sarif/csaf/cyclonedx-vex, so a typoed CI invocation reduced
+  enforcement with no log. Always emit the warning to stderr and
+  surface the tokens in JSON output as `warnings[]`.
+- Vulnerability-policy block decisions whose advisory was masked by
+  --severity used to exit 1 with no visible reason. Surface those
+  decisions in the human-readable "Policy Decisions" section so the
+  gate is always traceable.
+
+Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
+
+* fix(vis): correct npm/yarn min-release-age native config writers
+
+npm CLI types `min-release-age` as `Number` in days, not a duration string —
+vis wrote `48h`/`15m`, which npm's parseInt would silently read as 48/15 days.
+Write integer days rounded up so the native gate is never weaker than vis-config.
+
+Yarn Berry silently treats day suffixes in `npmMinimalAgeGate` as minutes
+
+### Features
+
+* **vis:** offline OSV scanner + unified security.policies ([#632](https://github.com/visulima/visulima/issues/632)) ([6461902](https://github.com/visulima/visulima/commit/646190243bf51bb6df172665d70fd501644e7bc3)), closes [#631](https://github.com/visulima/visulima/issues/631) [#631](https://github.com/visulima/visulima/issues/631) [yarnpkg/berry#6991](https://github.com/yarnpkg/berry/issues/6991)
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.22
+* **@visulima/vis:** upgraded to 1.0.0-alpha.20
+
+## @visulima/vis-mcp [1.0.0-alpha.9](https://github.com/visulima/visulima/compare/@visulima/vis-mcp@1.0.0-alpha.8...@visulima/vis-mcp@1.0.0-alpha.9) (2026-05-11)
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.21
+* **@visulima/vis:** upgraded to 1.0.0-alpha.19
+
+## @visulima/vis-mcp [1.0.0-alpha.8](https://github.com/visulima/visulima/compare/@visulima/vis-mcp@1.0.0-alpha.7...@visulima/vis-mcp@1.0.0-alpha.8) (2026-05-11)
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.20
+* **@visulima/vis:** upgraded to 1.0.0-alpha.18
+
+## @visulima/vis-mcp [1.0.0-alpha.7](https://github.com/visulima/visulima/compare/@visulima/vis-mcp@1.0.0-alpha.6...@visulima/vis-mcp@1.0.0-alpha.7) (2026-05-10)
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.19
+* **@visulima/vis:** upgraded to 1.0.0-alpha.17
+
+## @visulima/vis-mcp [1.0.0-alpha.6](https://github.com/visulima/visulima/compare/@visulima/vis-mcp@1.0.0-alpha.5...@visulima/vis-mcp@1.0.0-alpha.6) (2026-05-10)
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.18
+* **@visulima/vis:** upgraded to 1.0.0-alpha.16
+
+## @visulima/vis-mcp [1.0.0-alpha.5](https://github.com/visulima/visulima/compare/@visulima/vis-mcp@1.0.0-alpha.4...@visulima/vis-mcp@1.0.0-alpha.5) (2026-05-07)
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.17
+* **@visulima/vis:** upgraded to 1.0.0-alpha.15
+
+## @visulima/vis-mcp [1.0.0-alpha.4](https://github.com/visulima/visulima/compare/@visulima/vis-mcp@1.0.0-alpha.3...@visulima/vis-mcp@1.0.0-alpha.4) (2026-05-07)
+
+### Miscellaneous Chores
+
+* **vis-mcp:** bump eslint-plugin-zod and sort package.json keys ([787abc4](https://github.com/visulima/visulima/commit/787abc46e1b637fdb8968a492cd923537e404fbe))
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.16
+* **@visulima/vis:** upgraded to 1.0.0-alpha.14
+
+## @visulima/vis-mcp [1.0.0-alpha.3](https://github.com/visulima/visulima/compare/@visulima/vis-mcp@1.0.0-alpha.2...@visulima/vis-mcp@1.0.0-alpha.3) (2026-05-06)
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.15
+* **@visulima/vis:** upgraded to 1.0.0-alpha.13
+
+## @visulima/vis-mcp [1.0.0-alpha.2](https://github.com/visulima/visulima/compare/@visulima/vis-mcp@1.0.0-alpha.1...@visulima/vis-mcp@1.0.0-alpha.2) (2026-05-06)
+
+### Miscellaneous Chores
+
+* **vis-mcp:** housekeeping cleanup ([947eff5](https://github.com/visulima/visulima/commit/947eff503b5e170194f7f8e21bea2ab82b0786bf))
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.14
+* **@visulima/vis:** upgraded to 1.0.0-alpha.12
+
 ## @visulima/vis-mcp 1.0.0-alpha.1 (2026-05-04)
 
 ### Features

package/README.md

@@ -87,16 +87,16 @@ Add the server to `~/Library/Application Support/Claude/claude_desktop_config.js
 
 All eight tools are read-only. The agent prepares commands; a human runs them.
 
-| Tool                | What it does                                                                                           |
-| ------------------- | ------------------------------------------------------------------------------------------------------ |
-| `list_projects`     | List all workspace projects, optionally filtered by a vis query string.                                |
-| `describe_project`  | Return full metadata for one project (language, layer, stack, targets).                                |
-| `list_targets`      | Flatten projects into per-target rows; optionally narrow to one project.                               |
-| `list_templates`    | List scaffolding templates discovered in the workspace, with source and one-line description.          |
-| `describe_template` | Return template metadata: description, default destination, and the variable schema for `vis generate`.|
-| `get_run_logs`      | Read a run summary from `.task-runner/`; optionally filter to one task.                                |
-| `cache_why`         | Diff a task's hash inputs against the previous run to explain a rotation.                              |
-| `cache_hash`        | Print the recorded hash and per-input hash details for a task.                                         |
+| Tool                | What it does                                                                                            |
+| ------------------- | ------------------------------------------------------------------------------------------------------- |
+| `list_projects`     | List all workspace projects, optionally filtered by a vis query string.                                 |
+| `describe_project`  | Return full metadata for one project (language, layer, stack, targets).                                 |
+| `list_targets`      | Flatten projects into per-target rows; optionally narrow to one project.                                |
+| `list_templates`    | List scaffolding templates discovered in the workspace, with source and one-line description.           |
+| `describe_template` | Return template metadata: description, default destination, and the variable schema for `vis generate`. |
+| `get_run_logs`      | Read a run summary from `.task-runner/`; optionally filter to one task.                                 |
+| `cache_why`         | Diff a task's hash inputs against the previous run to explain a rotation.                               |
+| `cache_hash`        | Print the recorded hash and per-input hash details for a task.                                          |
 
 ## Related
 

package/dist/bin.js

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-import{startMcpServer as t}from"./packem_shared/registerAllTools-BOmyhKCR.js";try{await t()}catch(r){process.stderr.write(`[vis-mcp] failed to start: ${r instanceof Error?r.message:String(r)}
+import{startMcpServer as t}from"./packem_shared/registerAllTools-BIzixHAA.js";try{await t()}catch(r){process.stderr.write(`[vis-mcp] failed to start: ${r instanceof Error?r.message:String(r)}
 `),process.exit(1)}

package/dist/index.js

@@ -1 +1 @@
-import{execVis as o,execVisJson as s}from"./packem_shared/execVis-BzS_F-9x.js";import{errorResponse as i,okResponse as p}from"./packem_shared/okResponse-DdzqnveW.js";import{createMcpServer as c,registerAllTools as f,startMcpServer as m}from"./packem_shared/registerAllTools-BOmyhKCR.js";import{registerCacheHash as g}from"./packem_shared/registerCacheHash-CVckSIVO.js";import{registerCacheWhy as n}from"./packem_shared/registerCacheWhy-BfIjli7n.js";import{registerDescribeProject as h}from"./packem_shared/registerDescribeProject-Dhuzun-I.js";import{registerGetRunLogs as V}from"./packem_shared/registerGetRunLogs-BxkRfYZU.js";import{registerListProjects as T}from"./packem_shared/registerListProjects-C-AZj8RT.js";import{registerListTargets as k}from"./packem_shared/registerListTargets-Cq6bkF7O.js";import{isValidRunId as v,isValidTaskId as C}from"./packem_shared/isValidRunId-BKsKMWQf.js";export{c as createMcpServer,i as errorResponse,o as execVis,s as execVisJson,v as isValidRunId,C as isValidTaskId,p as okResponse,f as registerAllTools,g as registerCacheHash,n as registerCacheWhy,h as registerDescribeProject,V as registerGetRunLogs,T as registerListProjects,k as registerListTargets,m as startMcpServer};
+import{execVis as o,execVisJson as s}from"./packem_shared/execVis-BzS_F-9x.js";import{errorResponse as i,okResponse as p}from"./packem_shared/okResponse-DdzqnveW.js";import{createMcpServer as c,registerAllTools as f,startMcpServer as m}from"./packem_shared/registerAllTools-BIzixHAA.js";import{registerCacheHash as g}from"./packem_shared/registerCacheHash-CVckSIVO.js";import{registerCacheWhy as n}from"./packem_shared/registerCacheWhy-CMzL-Pg3.js";import{registerDescribeProject as h}from"./packem_shared/registerDescribeProject-Dhuzun-I.js";import{registerGetRunLogs as V}from"./packem_shared/registerGetRunLogs-BxkRfYZU.js";import{registerListProjects as T}from"./packem_shared/registerListProjects-C-AZj8RT.js";import{registerListTargets as k}from"./packem_shared/registerListTargets-Cq6bkF7O.js";import{isValidRunId as v,isValidTaskId as C}from"./packem_shared/isValidRunId-BKsKMWQf.js";export{c as createMcpServer,i as errorResponse,o as execVis,s as execVisJson,v as isValidRunId,C as isValidTaskId,p as okResponse,f as registerAllTools,g as registerCacheHash,n as registerCacheWhy,h as registerDescribeProject,V as registerGetRunLogs,T as registerListProjects,k as registerListTargets,m as startMcpServer};

package/dist/packem_shared/registerAllTools-BIzixHAA.js

@@ -0,0 +1,3 @@
+var y=Object.defineProperty;var n=(t,r)=>y(t,"name",{value:r,configurable:!0});import{readFile as g}from"node:fs/promises";import{createRequire as f}from"node:module";import{resolve as u,dirname as d}from"node:path";import{pathToFileURL as h,fileURLToPath as b}from"node:url";import{McpServer as w}from"@modelcontextprotocol/sdk/server/mcp.js";import{StdioServerTransport as k}from"@modelcontextprotocol/sdk/server/stdio.js";import{findUp as S}from"@visulima/fs";import*as e from"zod";import{execVisJson as l}from"./execVis-BzS_F-9x.js";import{okResponse as p,errorResponse as m}from"./okResponse-DdzqnveW.js";import{registerCacheHash as j}from"./registerCacheHash-CVckSIVO.js";import{registerCacheWhy as O}from"./registerCacheWhy-CMzL-Pg3.js";import{registerDescribeProject as R}from"./registerDescribeProject-Dhuzun-I.js";import{registerGetRunLogs as T}from"./registerGetRunLogs-BxkRfYZU.js";import{registerListProjects as P}from"./registerListProjects-C-AZj8RT.js";import{registerListTargets as V}from"./registerListTargets-Cq6bkF7O.js";var A=Object.defineProperty,_=n((t,r)=>A(t,"name",{value:r,configurable:!0}),"a$1");const B=e.object({advisoryCount:e.number(),lastSyncIso:e.string(),manifestEtag:e.string().nullable(),name:e.string()}),I=e.object({dbPath:e.string(),ecosystems:e.array(B),exists:e.boolean(),schemaVersion:e.number(),sizeBytes:e.number()}).catchall(e.unknown()),C=_(({server:t},r)=>{t.registerTool("advisory_status",{annotations:{readOnlyHint:!0},description:"Report the local OSV advisory DB freshness via `vis advisories status --format json`: DB path, schema version, per-ecosystem advisory counts, last sync timestamp, and ETag. Use this to detect whether the offline cache is stale before running an `audit` in offline mode.",inputSchema:{db:e.string().min(1).optional().describe("Override the cache DB path (default: <cache>/vis/advisories/db.sqlite).")}},async s=>{try{const a=["advisories","status","--format","json"];s.db!==void 0&&a.push("--db",s.db);const o=await l(r.visBin,a,{cwd:r.workspaceRoot}),i=I.parse(o);return p(i)}catch(a){return m(a)}})},"registerAdvisoryStatus");var D=Object.defineProperty,L=n((t,r)=>D(t,"name",{value:r,configurable:!0}),"a");const M=e.object({fixedVersions:e.array(e.string()).optional(),id:e.string(),severity:e.string(),summary:e.string().optional()}),E=e.object({acceptedRisk:e.unknown().optional(),name:e.string(),socketAlerts:e.array(e.unknown()).optional(),socketScore:e.number().nullable().optional(),version:e.string(),vulnerabilities:e.array(M)}),$=e.object({duplicates:e.array(e.object({name:e.string(),versionCount:e.number(),versions:e.array(e.string())})),packages:e.number(),results:e.array(E),summary:e.object({accepted:e.number(),duplicatePackages:e.number(),issues:e.number(),total:e.number()})}).catchall(e.unknown()),U=["low","medium","high","critical"],x=L(({server:t},r)=>{t.registerTool("audit",{annotations:{readOnlyHint:!0},description:"Audit installed packages for known vulnerabilities and supply-chain risk via `vis audit --format json`. Defaults to the local offline OSV cache when one exists, otherwise falls back to the live OSV API. Returns the parsed audit payload (results, duplicates, summary).",inputSchema:{ecosystem:e.string().optional().describe("Comma-separated OSV ecosystems to scan. Defaults to 'npm' (the only matcher wired today)."),offline:e.boolean().optional().describe("Force the local OSV cache. Errors if the cache is missing — run `vis advisories sync` first."),prodOnly:e.boolean().optional().describe("Skip devDependencies — scan the production graph only."),severity:e.enum(U).optional().describe("Minimum severity to report. Defaults to 'low'."),showAccepted:e.boolean().optional().describe("Include findings already on the workspace's accepted-risk list."),usage:e.boolean().optional().describe("Apply the reachability filter — only report vulnerabilities in statically-imported packages.")}},async s=>{try{const a=["audit","--format","json"];s.severity&&a.push("--severity",s.severity),s.offline&&a.push("--offline"),s.prodOnly&&a.push("--prod-only"),s.usage&&a.push("--usage"),s.ecosystem&&a.push("--ecosystem",s.ecosystem),s.showAccepted&&a.push("--show-accepted");const o=await l(r.visBin,a,{cwd:r.workspaceRoot}),i=$.parse(o);return p(i)}catch(a){return m(a)}})},"registerAudit");var H=Object.defineProperty,q=n((t,r)=>H(t,"name",{value:r,configurable:!0}),"r");const F=q(({server:t},r)=>{t.registerTool("describe_template",{annotations:{readOnlyHint:!0},description:"Return full metadata for a scaffolding template: description, default destination, and the variable schema (name, type, default, required, prompt, enum values). Use this before suggesting a `vis generate` command so option values can be filled correctly.",inputSchema:{name:e.string().describe('Template name (e.g. "package", "component"). Use list_templates to see available names.')}},async({name:s})=>{try{const a=await l(r.visBin,["generate",s,"--describe","--json"],{cwd:r.workspaceRoot});return p(a)}catch(a){return m(a)}})},"registerDescribeTemplate");var N=Object.defineProperty,J=n((t,r)=>N(t,"name",{value:r,configurable:!0}),"n");const W=J(({server:t},r)=>{t.registerTool("list_templates",{annotations:{readOnlyHint:!0},description:"List scaffolding templates discovered in the workspace (`.vis/templates/`, `.moon/templates/`, and `vis.config.ts` `generator.templates`). Each entry includes name, source, on-disk path, and one-line description.",inputSchema:{}},async()=>{try{const s=await l(r.visBin,["generate","--list","--json"],{cwd:r.workspaceRoot});return p({count:s.length,templates:s})}catch(s){return m(s)}})},"registerListTemplates");var z=Object.defineProperty,c=n((t,r)=>z(t,"name",{value:r,configurable:!0}),"s");const G=c(t=>{const r=process.env.VIS_MCP_VIS_BIN;if(r)return u(r);const s=f(h(`${t}/package.json`));let a,o;try{a=s.resolve("@visulima/vis/package.json"),o=s("@visulima/vis/package.json")}catch(v){throw new Error(`Cannot resolve \`@visulima/vis\` from ${t}. Install it as a workspace dependency, or set VIS_MCP_VIS_BIN to a vis CLI path.`,{cause:v})}const i=typeof o.bin=="string"?o.bin:o.bin?.vis;if(!i)throw new Error("`@visulima/vis` is installed but does not declare a `vis` bin entry — install a current version.");return u(d(a),i)},"resolveVisBin"),K=c(async()=>{try{const t=await S("package.json",{cwd:d(b(import.meta.url))});return t?JSON.parse(await g(t,"utf8")).version??"0.0.0":"0.0.0"}catch(t){return process.stderr.write(`[vis-mcp] failed to read package.json: ${t instanceof Error?t.message:String(t)}
+`),"0.0.0"}},"loadVersion"),Q=c((t,r)=>{P(t,r),R(t,r),V(t,r),W(t,r),F(t,r),T(t,r),O(t,r),j(t,r),x(t,r),C(t,r)},"registerAllTools"),X=c(async t=>{const r=new w({name:"vis",version:await K()}),s={server:r};return Q(s,t),{deps:s,server:r}},"createMcpServer"),ve=c(async()=>{const t=process.env.VIS_MCP_WORKSPACE_ROOT??process.cwd(),r={visBin:G(t),workspaceRoot:t},{server:s}=await X(r);await s.connect(new k),process.stderr.write(`[vis-mcp] ready (workspace: ${r.workspaceRoot})
+`)},"startMcpServer");export{X as createMcpServer,Q as registerAllTools,ve as startMcpServer};

package/dist/packem_shared/{registerCacheWhy-BfIjli7n.js → registerCacheWhy-CMzL-Pg3.js}

@@ -1 +1 @@
-var d=Object.defineProperty;var n=(r,e)=>d(r,"name",{value:e,configurable:!0});import*as o from"zod";import{execVisJson as p}from"./execVis-BzS_F-9x.js";import{errorResponse as i,okResponse as u}from"./okResponse-DdzqnveW.js";import{isValidTaskId as h,isValidRunId as l}from"./isValidRunId-BKsKMWQf.js";var m=Object.defineProperty,f=n((r,e)=>m(r,"name",{value:e,configurable:!0}),"i");const w=f(({server:r},e)=>{r.registerTool("cache_why",{annotations:{readOnlyHint:!0},description:"Explain why a task's cache hash rotated between runs. Diffs the task's hashDetails (command, nodes, runtime, implicitDeps) against the previous run to pinpoint what changed.",inputSchema:{runId:o.string().optional().describe("Run ID to inspect (default: latest)"),taskId:o.string().describe('Task ID like "@my/app:build"')}},async({runId:t,taskId:s})=>{if(!h(s))return i(new Error(`Invalid taskId "${s}". Expected "<project>:<target>".`));if(t!==void 0&&!l(t))return i(new Error(`Invalid runId "${t}". Expected filesystem-safe slug ([A-Za-z0-9_.-]).`));try{const a=["cache","why",s,"--format=json"];t&&a.push("--run",t);const c=await p(e.visBin,a,{cwd:e.workspaceRoot});return u(c)}catch(a){return i(a)}})},"registerCacheWhy");export{w as registerCacheWhy};
+var d=Object.defineProperty;var n=(r,e)=>d(r,"name",{value:e,configurable:!0});import*as o from"zod";import{execVisJson as p}from"./execVis-BzS_F-9x.js";import{errorResponse as i,okResponse as u}from"./okResponse-DdzqnveW.js";import{isValidTaskId as h,isValidRunId as l}from"./isValidRunId-BKsKMWQf.js";var m=Object.defineProperty,f=n((r,e)=>m(r,"name",{value:e,configurable:!0}),"i");const w=f(({server:r},e)=>{r.registerTool("cache_why",{annotations:{readOnlyHint:!0},description:"Explain why a task's cache hash rotated between runs. Diffs the task's hashDetails (command, nodes, runtime, implicitDeps) against the previous run to pinpoint what changed.",inputSchema:{runId:o.string().optional().describe("Run ID to inspect (default: latest)"),taskId:o.string().describe('Task ID like "@my/app:build"')}},async({runId:t,taskId:a})=>{if(!h(a))return i(new Error(`Invalid taskId "${a}". Expected "<project>:<target>".`));if(t!==void 0&&!l(t))return i(new Error(`Invalid runId "${t}". Expected filesystem-safe slug ([A-Za-z0-9_.-]).`));try{const s=["cache","why",a,"--format=json"];t&&s.push("--run",t);const c=await p(e.visBin,s,{cwd:e.workspaceRoot});return u(c)}catch(s){return i(s)}})},"registerCacheWhy");export{w as registerCacheWhy};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@visulima/vis-mcp",
-  "version": "1.0.0-alpha.1",
+  "version": "1.0.0-alpha.10",
   "description": "MCP (Model Context Protocol) server for @visulima/vis — exposes vis tooling to AI agents over stdio",
   "keywords": [
     "agent",
@@ -57,12 +57,12 @@
   ],
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@visulima/fs": "5.0.0-alpha.13",
+    "@visulima/fs": "5.0.0-alpha.22",
     "@visulima/path": "3.0.0-alpha.10",
     "zod": "4.4.3"
   },
   "peerDependencies": {
-    "@visulima/vis": "1.0.0-alpha.11"
+    "@visulima/vis": "1.0.0-alpha.20"
   },
   "engines": {
     "node": "^22.14.0 || >=24.10.0"

package/dist/packem_shared/registerAllTools-BOmyhKCR.js

@@ -1,3 +0,0 @@
-var u=Object.defineProperty;var i=(e,r)=>u(e,"name",{value:r,configurable:!0});import{readFile as f}from"node:fs/promises";import{createRequire as g}from"node:module";import{resolve as c,dirname as p}from"node:path";import{pathToFileURL as w,fileURLToPath as h}from"node:url";import{McpServer as y}from"@modelcontextprotocol/sdk/server/mcp.js";import{StdioServerTransport as b}from"@modelcontextprotocol/sdk/server/stdio.js";import{findUp as S}from"@visulima/fs";import{registerCacheHash as k}from"./registerCacheHash-CVckSIVO.js";import{registerCacheWhy as T}from"./registerCacheWhy-BfIjli7n.js";import{registerDescribeProject as R}from"./registerDescribeProject-Dhuzun-I.js";import*as _ from"zod";import{execVisJson as m}from"./execVis-BzS_F-9x.js";import{okResponse as l,errorResponse as v}from"./okResponse-DdzqnveW.js";import{registerGetRunLogs as j}from"./registerGetRunLogs-BxkRfYZU.js";import{registerListProjects as I}from"./registerListProjects-C-AZj8RT.js";import{registerListTargets as P}from"./registerListTargets-Cq6bkF7O.js";var L=Object.defineProperty,O=i((e,r)=>L(e,"name",{value:r,configurable:!0}),"r");const C=O(({server:e},r)=>{e.registerTool("describe_template",{annotations:{readOnlyHint:!0},description:"Return full metadata for a scaffolding template: description, default destination, and the variable schema (name, type, default, required, prompt, enum values). Use this before suggesting a `vis generate` command so option values can be filled correctly.",inputSchema:{name:_.string().describe('Template name (e.g. "package", "component"). Use list_templates to see available names.')}},async({name:t})=>{try{const s=await m(r.visBin,["generate",t,"--describe","--json"],{cwd:r.workspaceRoot});return l(s)}catch(s){return v(s)}})},"registerDescribeTemplate");var M=Object.defineProperty,V=i((e,r)=>M(e,"name",{value:r,configurable:!0}),"n");const B=V(({server:e},r)=>{e.registerTool("list_templates",{annotations:{readOnlyHint:!0},description:"List scaffolding templates discovered in the workspace (`.vis/templates/`, `.moon/templates/`, and `vis.config.ts` `generator.templates`). Each entry includes name, source, on-disk path, and one-line description.",inputSchema:{}},async()=>{try{const t=await m(r.visBin,["generate","--list","--json"],{cwd:r.workspaceRoot});return l({count:t.length,templates:t})}catch(t){return v(t)}})},"registerListTemplates");var E=Object.defineProperty,o=i((e,r)=>E(e,"name",{value:r,configurable:!0}),"s");const U=o(e=>{const r=process.env.VIS_MCP_VIS_BIN;if(r)return c(r);const t=g(w(`${e}/package.json`));let s,a;try{s=t.resolve("@visulima/vis/package.json"),a=t("@visulima/vis/package.json")}catch(d){throw new Error(`Cannot resolve \`@visulima/vis\` from ${e}. Install it as a workspace dependency, or set VIS_MCP_VIS_BIN to a vis CLI path.`,{cause:d})}const n=typeof a.bin=="string"?a.bin:a.bin?.vis;if(!n)throw new Error("`@visulima/vis` is installed but does not declare a `vis` bin entry — install a current version.");return c(p(s),n)},"resolveVisBin"),$=o(async()=>{try{const e=await S("package.json",{cwd:p(h(import.meta.url))});return e?JSON.parse(await f(e,"utf8")).version??"0.0.0":"0.0.0"}catch(e){return process.stderr.write(`[vis-mcp] failed to read package.json: ${e instanceof Error?e.message:String(e)}
-`),"0.0.0"}},"loadVersion"),A=o((e,r)=>{I(e,r),R(e,r),P(e,r),B(e,r),C(e,r),j(e,r),T(e,r),k(e,r)},"registerAllTools"),D=o(async e=>{const r=new y({name:"vis",version:await $()}),t={server:r};return A(t,e),{deps:t,server:r}},"createMcpServer"),te=o(async()=>{const e=process.env.VIS_MCP_WORKSPACE_ROOT??process.cwd(),r={visBin:U(e),workspaceRoot:e},{server:t}=await D(r);await t.connect(new b),process.stderr.write(`[vis-mcp] ready (workspace: ${r.workspaceRoot})
-`)},"startMcpServer");export{D as createMcpServer,A as registerAllTools,te as startMcpServer};