ast-mcp-server 0.14.2 → 0.14.3

package/CHANGELOG.md

@@ -6,7 +6,18 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
-## [0.14.2] — not yet published (2026-10-28)
+## [0.14.3] — not yet published (2026-10-28)
+
+### Security
+
+- Updated `@hono/node-server` to the patched `2.1.5` (GHSA-rmxm-3fg6-px4f, `serveStatic` decoded the request path a second time and could bypass middleware on static paths). It reaches the server only through `@modelcontextprotocol/sdk`, and the pinned resolution moved from `2.0.12`.
+- Updated `minimatch` to the patched `11.0.3` (GHSA-g3hv-75wg-m249, potential denial of service through globparts amplification). The pin sits above the `^10.x` ranges still declared by `eslint`, `@eslint/config-array`, `@typescript-eslint/typescript-estree` and `@ts-morph/common`, a documented exception: those packages only call `minimatch()` and `Minimatch#match()`, none of the API removed in `11`, and the dependency-policy test records the exception so it can be dropped once the parents admit `11`.
+
+### Fixed
+
+- `ast_get_impact` with `direction: "incoming"` no longer returns an empty, incomplete result on larger projects. The compiler resolver now finds incoming references through the language service instead of walking every AST node, so its work scales with the number of references rather than the project size, and the project-wide computed-call scan runs on its own budget so it can no longer starve the reference lookup (#353).
+
+## [0.14.2] — published to `latest` and `next`, registry verified (2026-10-28)
 
 ### Security
 
@@ -18,6 +29,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 - Updated development tooling: Vitest 5 (now with an explicit `vite` development dependency), `@types/node` 26, `gpt-tokenizer` 4, and patch updates to ESLint, Prettier, `typescript-eslint` and `yaml`. `process.disconnect` is now called optionally in the compiler worker entry to match the stricter Node 26 typings.
 - Updated reviewed GitHub Actions pins (`actions/setup-node` 7.1.0, `actions/upload-artifact` 7.0.2, `actions/download-artifact` 8.0.2, `github/codeql-action` 4.39.1), including the release workflow.
 
+### Release status
+
+- npm published immutable `0.14.2` bytes with integrity `sha512-fUKylMtamBEIBdLcGz27udjRLLl1+OTRir+0vRegN8x7JzM13uIZZ5lGFNEc7/rkUiFqmEE9HrrxvTRw2cgnYg==`. Public-registry verification passed; `latest` and `next` both resolve to `0.14.2`; and npm `gitHead`, the annotated `v0.14.2` tag, and the GitHub Release target exact commit `425a967002178dde685cae1dcf0ec5fad533ff54`.
+- Publish run `40753973275` succeeded on its first attempt, with no ambiguous readback; verification `40755636111` and promotion `40756782907` are green and authoritative.
+
 ## [0.14.1] — published to `latest` and `next`, registry verified (2026-10-26)
 
 ### Security

package/README.md

@@ -353,7 +353,7 @@ For a local candidate, pack and install its tarball instead:
 
 ```bash
 yarn pack --out ast-mcp-server-%v.tgz
-dsh plugin --profile web add ./ast-mcp-server-0.14.2.tgz
+dsh plugin --profile web add ./ast-mcp-server-0.14.3.tgz
 ```
 
 The first supported surface is **reads + prepare + preview**. Every apply path is

package/cordis.patch.yml

@@ -3,7 +3,7 @@
 # Mounts the packaged `ast-mcp-server` stdio command through the official
 # `@deepseek-ai/dsh-mcp-client` bridge. Harness does not resolve MCP binaries
 # from PATH, so the entrypoint is resolved relative to the profile directory
-# (`baseUrl`), where `dsh plugin --profile <name> add ./ast-mcp-server-0.14.2.tgz`
+# (`baseUrl`), where `dsh plugin --profile <name> add ./ast-mcp-server-0.14.3.tgz`
 # installs a locally packed package as a dependency.
 #
 # First-slice surface: reads + prepare + preview. Every apply path is denied

package/dist/services/relationships.js

@@ -946,10 +946,12 @@ function addScopedIncomingHeritageRelationships(state, edges) {
     addScopedCandidates(edges, candidates);
 }
 function addScopedIncomingReferences(state, edges, target) {
-    for (const sourceFile of scopedSourceFiles(state, edges)) {
+    const sourceFiles = scopedSourceFiles(state, edges);
+    const candidateReferences = scopedReferenceCandidates(state, edges, target, sourceFiles);
+    for (const sourceFile of sourceFiles) {
         consumeScopedWork(state, edges);
         const candidates = createScopedCandidateSet(edges);
-        sourceFile.forEachDescendant((reference) => {
+        const visitReference = (reference) => {
             consumeScopedWork(state, edges);
             if (!isCompilerReferenceNode(reference))
                 return;
@@ -967,10 +969,43 @@ function addScopedIncomingReferences(state, edges, target) {
             if (source && source.node !== target.node) {
                 candidates.push(createScopedEdge(state, symbolEndpoint(source, state.projectRoot), symbolEndpoint(target, state.projectRoot), "reference"));
             }
-        });
+        };
+        const known = candidateReferences?.get(sourceFile);
+        if (candidateReferences) {
+            for (const reference of known ?? [])
+                visitReference(reference);
+        }
+        else {
+            sourceFile.forEachDescendant(visitReference);
+        }
         addScopedCandidates(edges, candidates);
     }
 }
+// Asking the language service for the target's references costs work
+// proportional to the references found, not to the size of the project. Targets
+// it cannot answer for fall back to the exhaustive walk (undefined).
+function scopedReferenceCandidates(state, collector, target, sourceFiles) {
+    if (!Node.isReferenceFindable(target.node))
+        return undefined;
+    consumeScopedWork(state, collector);
+    const references = target.node.findReferencesAsNodes();
+    reserveScopedWork(state, collector, references.length);
+    const inScope = new Set(sourceFiles);
+    const byFile = new Map();
+    for (const reference of references) {
+        const sourceFile = reference.getSourceFile();
+        if (!inScope.has(sourceFile))
+            continue;
+        const bucket = byFile.get(sourceFile);
+        if (bucket)
+            bucket.push(reference);
+        else
+            byFile.set(sourceFile, [reference]);
+    }
+    for (const bucket of byFile.values())
+        bucket.sort((left, right) => left.getStart() - right.getStart());
+    return byFile;
+}
 function addScopedIncomingImports(state, edges, target) {
     const targetEndpoint = symbolEndpoint(target, state.projectRoot);
     for (const sourceFile of scopedSourceFiles(state, edges)) {
@@ -1096,23 +1131,44 @@ function computedCallAuthority(projectRoot, invocation) {
         workItems: workItems + alternatives.size,
     };
 }
+// The project-wide scan is independent of the endpoint being resolved, so it
+// runs on its own budget: spending the endpoint's budget here left large
+// projects with no work for the reference lookup. Exhausting it keeps the
+// sites found so far and reports the result as incomplete.
 function scopedComputedCallSites(state, collector) {
     if (state.computedCallSites) {
         reserveScopedWork(state, collector, state.computedCallSites.length);
-        return state.computedCallSites;
+        return { sites: state.computedCallSites, complete: state.computedCallSitesComplete === true };
     }
+    const scanCollector = {
+        ...collector,
+        workBudget: {
+            remaining: collector.workBudget.remaining + collector.workBudget.consumed,
+            consumed: 0,
+            limitReached: false,
+        },
+    };
     const sites = [];
-    for (const sourceFile of scopedSourceFiles(state, collector)) {
-        sourceFile.forEachDescendant((node) => {
-            consumeScopedWork(state, collector);
-            const expression = callLikeExpression(node);
-            if (expression && Node.isElementAccessExpression(unwrapInvocationExpression(expression))) {
-                sites.push(node);
-            }
-        });
+    let complete = true;
+    try {
+        for (const sourceFile of scopedSourceFiles(state, scanCollector)) {
+            sourceFile.forEachDescendant((node) => {
+                consumeScopedWork(state, scanCollector);
+                const expression = callLikeExpression(node);
+                if (expression && Node.isElementAccessExpression(unwrapInvocationExpression(expression))) {
+                    sites.push(node);
+                }
+            });
+        }
+    }
+    catch (error) {
+        if (!(error instanceof ScopedRelationshipWorkLimitReached))
+            throw error;
+        complete = false;
     }
     state.computedCallSites = sites;
-    return sites;
+    state.computedCallSitesComplete = complete;
+    return { sites, complete };
 }
 function scopedDirectCallTarget(state, collector, invocation) {
     const expression = callLikeExpression(invocation);
@@ -1148,7 +1204,10 @@ function scopedReferenceFlowsToUncertainCall(state, collector, reference) {
 function addScopedIncomingCalls(state, collector, target) {
     if (!Node.isReferenceFindable(target.node))
         return;
-    for (const invocation of scopedComputedCallSites(state, collector)) {
+    const computed = scopedComputedCallSites(state, collector);
+    if (!computed.complete)
+        collector.semanticUnfinished = true;
+    for (const invocation of computed.sites) {
         const authority = computedCallAuthority(state.projectRoot, invocation);
         reserveScopedWork(state, collector, authority.workItems);
         if (authority.state === "unfinished" &&

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ast-mcp-server",
-  "version": "0.14.2",
+  "version": "0.14.3",
   "description": "Structural code MCP server and batch CLI for compact TypeScript/JavaScript reads and hash-bound AST edits.",
   "keywords": [
     "mcp",
@@ -60,8 +60,10 @@
     "node": ">=22.13.0"
   },
   "resolutions": {
+    "@hono/node-server": "2.1.5",
     "fast-uri": "3.1.9",
     "hono": "4.13.13",
+    "minimatch": "11.0.3",
     "nanoid": "3.3.18",
     "qs": "6.16.1"
   },
@@ -119,5 +121,5 @@
     "vitest": "^5.0.5",
     "yaml": "^2.9.0"
   },
-  "gitHead": "425a967002178dde685cae1dcf0ec5fad533ff54"
+  "gitHead": "da7adf2662572454fdd388b549eb538fbfc5a380"
 }