ast-mcp-server 0.13.1 → 0.14.0

package/dist/tools/relationship-schema.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { FRESHNESS_CAUSES, SNAPSHOT_STATES } from "../services/read-contracts.js";
-import { RELATIONSHIP_CONFIDENCES, RELATIONSHIP_EDGE_KINDS, RELATIONSHIP_PROVENANCES, RELATIONSHIP_RESOLUTIONS, } from "../services/relationships.js";
+import { RELATIONSHIP_CONFIDENCES, RELATIONSHIP_COVERAGE_STATUSES, RELATIONSHIP_EDGE_KINDS, RELATIONSHIP_PROVENANCES, RELATIONSHIP_RESOLUTIONS, } from "../services/relationships.js";
 export const SourceRangeSchema = z.object({
     start_line: z.number().int().positive(),
     start_column: z.number().int().positive().optional(),
@@ -18,6 +18,17 @@ export const FreshnessSchema = z.object({
     causes: z.array(z.enum(FRESHNESS_CAUSES)),
     checked_at: z.string().nullable(),
 });
+export const RelationshipCoverageEntrySchema = z.object({
+    kind: z.enum(RELATIONSHIP_EDGE_KINDS),
+    direction: z.enum(["incoming", "outgoing"]),
+    endpoint_class: z.enum(["module", "symbol"]),
+    status: z.enum(RELATIONSHIP_COVERAGE_STATUSES),
+});
+export const RelationshipWorkSchema = z.object({
+    work_items: z.number().int().min(0),
+    max_work_items: z.number().int().positive(),
+    work_limit_reached: z.boolean(),
+});
 export const RelationshipEdgeSchema = z.object({
     relationship_id: z.string(),
     source: RelationshipEndpointSchema,

package/docs/support.md

@@ -16,7 +16,7 @@ This document defines the supported platform, runtime, persistence, and operatio
 
 Published v0.12.0 requires Node.js `>=22.13.0`; its immutable matrix targets exact Node.js 22.13.0 and the governed Node.js 24 major. The earlier v0.8.1 Node.js 22.5.0/24 matrix remains historical evidence for those bytes only. A future runtime satisfying an engine range is not automatically a verified release target.
 
-The checked-evidence freezer requires GNU coreutils 9.7 `mv` with `--update=none-fail`, `--no-copy`, and `--no-target-directory`. Managed setup-file mutation additionally requires that same `mv` with `--exchange`, GNU coreutils `ln -L -T`, procfs descriptor paths at `/proc/self/fd`, `O_DIRECTORY`, and `O_NOFOLLOW`. It fails closed when any verified Linux primitive is unavailable. Equivalent publication, exchange, descriptor-link, and descriptor-relative mutation semantics have not been verified on other operating systems or architectures.
+The checked-evidence freezer requires GNU coreutils 9.7 `mv` with `--update=none-fail`, `--no-copy`, and `--no-target-directory`. Structural apply and managed setup-file mutation additionally require that same `mv` with `--exchange`, GNU coreutils `ln -L -T`, procfs descriptor paths at `/proc/self/fd`, `O_DIRECTORY`/`O_NOFOLLOW`, and successful owned link/exchange identity probes on each destination parent filesystem before source effects. Missing, denied, or behaviorally incompatible primitives fail closed; there is no rename, copy/delete, or pathname-only fallback. Equivalent semantics have not been verified on other operating systems, architectures, or filesystems.
 
 ## Local stdio trust boundary
 
@@ -30,7 +30,9 @@ The server does not provide:
 - tenant isolation;
 - protection from a malicious process running with the same filesystem authority.
 
-Operation locks coordinate cooperating same-user processes. They do not stop editors, network filesystems, or hostile same-user writers. Report-set freezer coordination likewise assumes cooperating same-UID processes and cannot defend checked evidence against a malicious process with the same filesystem authority. The freezer guarantees no-replace atomic visibility of the checked directory; it does not claim persistence across sudden power loss because parent-directory `fsync` durability is not established.
+Operation locks coordinate cooperating processes using the same configuration identity; they do not authorize writes against editors, overlapping configurations, network filesystems, continuously mutating writers, or hostile same-user processes. Structural replacement authenticates one exchanged pair at a time, and multi-file apply is sequential rather than globally atomic. Reverse rollback restores only exact owned pairs. Creation is no-clobber, but if a later failure follows its first publication, unlink ownership is not inferred: the destination and hidden stage are preserved and the outcome is `AMBIGUOUS_APPLY`. Deterministic promise barriers prove only the named publication and rollback interleavings, not arbitrary-writer atomicity.
+
+Report-set freezer coordination likewise assumes cooperating same-UID processes and cannot defend checked evidence against a malicious process with the same filesystem authority. The freezer guarantees no-replace atomic visibility of the checked directory; it does not claim persistence across sudden power loss because parent-directory `fsync` durability is not established.
 
 ## Optional supervised compiler worker
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ast-mcp-server",
-  "version": "0.13.1",
+  "version": "0.14.0",
   "description": "Structural code MCP server and batch CLI for compact TypeScript/JavaScript reads and hash-bound AST edits.",
   "keywords": [
     "mcp",
@@ -60,8 +60,10 @@
     "node": ">=22.13.0"
   },
   "resolutions": {
-    "hono": "4.12.34",
-    "nanoid": "3.3.18"
+    "fast-uri": "3.1.9",
+    "hono": "4.13.13",
+    "nanoid": "3.3.18",
+    "qs": "6.16.0"
   },
   "scripts": {
     "build": "tsc",
@@ -98,12 +100,12 @@
     "dev": "tsc --watch"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.12.0",
+    "@modelcontextprotocol/sdk": "^1.32.1",
     "@toon-format/toon": "4.1.0",
     "diff": "^9.0.0",
     "jsonc-parser": "^3.3.1",
     "ts-morph": "24.0.0",
-    "zod": "^3.23.8"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
@@ -113,8 +115,8 @@
     "prettier": "^3.9.6",
     "typescript": "^5.6.0",
     "typescript-eslint": "^8.65.0",
-    "vitest": "^4.1.10",
+    "vitest": "^4.1.12",
     "yaml": "^2.9.0"
   },
-  "gitHead": "27b80a3da169b473a3b5c5dfea69ed52903ed4c7"
+  "gitHead": "f6e64751398f69eb3f0f1abc808f4221f7d2bc52"
 }

package/skills/structural-code-editing/SKILL.md

@@ -29,6 +29,14 @@ Published v0.12.0 requires Node.js `>=22.13.0` and retains immutable release evi
 - Nunca reconstruir postimages desde un diff; después del apply, ejecutar el gate canónico del proyecto.
 - Conservar `correlation_id` en errores públicos sin exponer source, paths absolutos, argumentos, environment, cache, stacks ni credenciales.
 
+## Impacto y candidatos de test
+
+`ast_get_impact` separa dos canales. `coverage` asigna a cada kind/direction/endpoint una de `not_applicable`, `completed`, `unsupported` o `unfinished`; `truncation` y `work` describen límites de recorrido. `incomplete` es true si falla cualquiera. `proven_empty` exige cero edges, cobertura aplicable completa y ningún límite agotado.
+
+La selección default conserva los siete kinds. `contains` aplicable es `unsupported`, por lo que el default puede ser semánticamente incompleto sin truncamiento. Calls directas por identificador, `new` y tagged templates pueden ser exactas; property, element, dynamic, unresolved, multiple o external dispatch no generan edges adivinados y dejan esa dirección `unfinished`. No presentar esto como certificación de #219 o #220.
+
+`ast_find_test_candidates` fija seis kinds incoming (`reference`, `import`, `export`, `extends`, `implements`, `call`) y excluye `contains`. Solo acepta evidencia fresh/exact/resolved/compiler-authoritative, cobertura completa y trabajo/recorrido sin agotar. Si no, devuelve `INCOMPLETE_EVIDENCE`, no una página vacía. Después de admitir, pagina candidatos ordenados sin partir paths ni ocultar `coverage`/`work`. MCP entrega JSON canónico; TOON de batch debe conservar el mismo significado lógico.
+
 ## Diagnostic aggregates
 
 `ast_get_diagnostics` keeps its existing response shape unless `include_aggregates: true` is requested. Enabled summaries cover the complete normalized snapshot, not only the selected raw page, and cap both code and file groups at 20.

package/skills/structural-code-editing/releases.json

@@ -6,7 +6,7 @@
     "files": [
       {
         "path": "SKILL.md",
-        "sha256": "df2ebc3f3903cf5abf4eb6612da527cad97a92f29f1a9a475ea6e8b4cf47abfb"
+        "sha256": "33d0c6520c1ed54d42a502251a08baed86153bf9b6c275aed4525b2968f1553b"
       },
       {
         "path": "references/operations.md",