deprecated-tracker 2.3.0 → 2.5.0

package/CHANGELOG.md

@@ -2,6 +2,61 @@
 
 All notable changes to the "Deprecated Tracker" extension will be documented in this file.
 
+## [2.5.0]
+
+### Changed
+
+- **Every surface was redesigned.** The results panel, the statistics overview, the settings panel and the sidebar view now share one palette, one type scale and one set of icons. The organising idea is the only classification the scanner can make honestly for every project: each deprecated declaration is **documented** (it names a replacement), **bare** (it says nothing) or **unused** (nothing calls it), and each is a different job. No severity levels and no removal-version grouping, both of which were explored and neither of which exists reliably in the data — `deprecationSchedule` is optional and usually absent, because it can only be recovered from prose in the tag. A composition band above the results carries the three counts, and each row picks up a coloured rail for its class.
+- **Emoji are gone from the interface.** `📊 📋 📦 ⚠️ 🔗 📈 🎯 🔥` in the statistics dashboard and `🔍 ⚙️ 📊 📋 🕒` in the sidebar are inline SVG, which takes a colour, follows the theme and renders identically on every platform. One pair remains, in the requirements panel, because an asset test asserts its exact text.
+- **The panel chrome shrank.** A 24px heading with 35px of padding around it became a 44px toolbar; rows are 38px. On a panel docked to a third of the screen, the old proportions spent more space describing the view than showing it. The sidebar lost its card border and its 44px drop-shadowed buttons for the same reason.
+- **Three hardcoded colours are gone.** `#ff9800`, `#f57c00` and `#ff6b6b` ignored the theme entirely. Every rule now reads a `--dt-*` token, and high-contrast themes hand every one of those tokens straight back to VS Code rather than overriding it.
+
+### Added
+
+- **The composition band filters.** Clicking *documented*, *no reason* or *unused* narrows the table to that class, and the active segment is marked with a ring rather than by colour alone.
+- **Resizable columns.** Drag the boundary between any two headers; double-click resets. The handle draws nothing — the `col-resize` cursor is the whole affordance — and it is grabbable beside any row, not only in the header.
+- **Click a row to expand its call sites**, with the count shown as a badge instead of a `Show 2 usages` button. Clicks that land on a link or a button still belong to that control.
+- **The table header stays put while the rows scroll.**
+- **Symbol and file names are reachable from the keyboard.** They were already clickable, but they are `<span>`s, so they had no tab stop and no `Enter` handler. Both now do, and the hover affordance is an underline that appears on the row rather than a permanent one — an underlined list is unreadable.
+
+### Fixed
+
+- **Switching away from a panel and back reset it.** `MainPanel` explicitly set `retainContextWhenHidden: false`, so VS Code tore the webview down whenever the tab went to the background and reloaded the HTML on return, losing the scroll position and every expanded call-site list. Clicking a result — the panel's main action — moved focus to the editor and did exactly that. The statistics and ignore panels never set the option at all and defaulted to the same behaviour. All three now retain their context, and the webview additionally declines to rebuild the table when it is re-sent a result set identical to the one already on screen.
+- **A column filter could zero a symbol's call sites.** The filters tested each item independently, but a declaration and its call sites are separate items and the call sites usually live in other files. Filtering by `api` therefore deleted every usage recorded in `edge-usages.ts` and left the declarations reading `0 · unused` — the row then classified itself as unused, which was false. Filters now select whole groups, matched against the same values the row displays, so a surviving group keeps all of its items.
+- **Cancelling a scan hid the View Results button until the next successful one.** Starting a scan hid the button, and neither the cancel path nor the failure path restored it, even though the previous scan's results were still held and still openable. The button's visibility now follows only whether results exist.
+- **The row separator broke into pieces.** It was drawn per cell, and the rows are CSS grids: the line stopped at every column gap, fell short of the row padding at both ends, and — because the cells are centred and differ in height — drew each segment at its own height. The separator belongs to the row.
+- **The webview panels showed a generic document icon** in their editor tabs. All five now carry the extension's own mark, in the light and dark variants VS Code needs for a tab icon.
+
+### Internal
+
+- **`style.css` was rebuilt on a token layer.** Every rule consumed `--vscode-*` directly across 1,467 lines, so a palette change meant editing hundreds of declarations; there is now one `:root` block and one override per theme class. Roughly 110 lines of verbatim-duplicated rules and 17 rule blocks with no matching markup were removed at the same time.
+- **`settings.css` carries its own copy of the tokens.** `SettingsPanel` builds its own `styleUri` and loads that file alone, so it never sees the shared stylesheet; pointing it at the shared tokens would leave every colour undefined.
+- **`--dt-faint` is not the colour the palette specified.** `#6F7B83` measures 3.9:1 on the dark ground and `#7E8A91` measures 3.5:1 on the light one, both under the 4.5:1 that AA requires for body text. They are `#8A959C` and `#6B767D`.
+
+## [2.4.1]
+
+### Fixed
+
+- **The webview panels escaped some values and not others.** The results history and the four statistics tables ran names, file paths and reasons through `escapeHtml`, but interpolated counts, kinds and scan ids straight into `innerHTML` on the assumption that a number cannot carry markup. That assumption holds for the value's type and not for its origin: every one of those fields is derived from the scanned project, which is code the extension was pointed at rather than code it trusts. Six sites across `main.js` and `statistics.js` now escape uniformly. Escaping a number is free, and a template where some interpolations are escaped and others are not is a template nobody can review at a glance.
+
+### Internal
+
+- **The packaging scripts built shell command strings out of `__dirname`.** `scripts/package.js` and `scripts/publish.js` composed `npm` and `npx` invocations by interpolating an absolute path into a string and handing it to `execSync`, so a checkout directory containing shell metacharacters would have been interpreted rather than quoted. Both now use `execFileSync` with an argv array, which has no shell to interpret anything. They invoke npm through `process.env.npm_execpath` rather than spawning `npm.cmd`, because Node refuses to spawn a `.cmd` without a shell and re-adding one would have undone the fix. The consequence for contributors: these scripts must be run through npm — `npm run build-package`, not `node scripts/package.js`, which now exits with a message saying so.
+- **Pinned patched versions of six transitive development dependencies.** An `overrides` block moves `js-yaml`, `minimatch`, `@babel/core` and `ajv` onto their fixed releases, taking `npm audit` to zero. None of this reaches a user: the published package declares no runtime dependencies, and these packages exist only under jest, eslint and their trees.
+
+## [2.4.0]
+
+### Added
+
+- **Go to declaration, from the usage.** A deprecated usage told you what it was and why, but not where the deprecated symbol lives — finding that meant searching for the name and picking the declaration out of its own call sites. The diagnostic now carries the declaration's location, so VS Code links to it from the Problems panel and the hover, and **Quick Fix** on the usage offers **Go to declaration (file:line)**. It navigates and nothing else: applying a replacement guessed out of the prose in a `@deprecated` tag stays parked, because a wrong edit is worse than none.
+
+## [2.3.1]
+
+### Fixed
+
+- **`scan_files` missed edits made after a file was staged.** The MCP tool took its changed lines from the index, so an agent that staged a file and then kept editing was told its newest code was clean — the exact flow the tool exists for. It now reads the working tree for the files it was given, while `--files` on the command line stays on the index: a pre-commit hook must judge what is about to be committed, not what merely happens to be in the editor.
+- **`mcp install --scope project` could register the tool where no agent would look.** Project scope means the directory the command ran in, so running it from a home folder registered a "project" that is never opened, and the repo it was meant for got nothing. The install now names the directory it used and warns when that directory is not a git repository, pointing at `--scope user` for a registration that applies everywhere. Success messages say where the entry went, which the agents' own CLIs do not report.
+
 ## [2.3.0]
 
 ### Changed

package/README.md

@@ -43,10 +43,28 @@ Recipes for husky, lefthook and the `pre-commit` framework (which has a `.pre-co
 Register it once and Claude Code or Codex can call the scanner by name:
 
 ```bash
-npx deprecated-tracker mcp install          # --agent claude-code|codex|all
+# Just you, every project you open
+npx deprecated-tracker mcp install --agent claude-code --scope user
+npx deprecated-tracker mcp install --agent codex --scope user
+
+# The whole team, committed with the repo — run it from inside the repo
+npx deprecated-tracker mcp install --agent claude-code --scope project
+npx deprecated-tracker mcp install --agent codex --scope project
+
+npx deprecated-tracker mcp install --agent all --scope project   # both at once
+npx deprecated-tracker mcp uninstall --agent all --scope user    # same flags to undo
 ```
 
-That exposes three tools — `scan_project`, `scan_changes` and `scan_files` — with schemas the agent can read, structured results, and no shell-approval prompt per call. Restart the agent afterwards; Claude Code will ask you to approve a project-scoped server the first time.
+That exposes three tools — `scan_project`, `scan_changes` and `scan_files` — with schemas the agent can read, structured results, and no shell-approval prompt per call.
+
+`--scope user` registers it for every project you open. `--scope project` is the default and registers it for **the directory you run the command in**, which is meant to be committed so a teammate has it after a clone — so run that one from inside the repo, not from your home folder, or you register a "project" no agent will ever open. The CLI prints which scope it used and where the entry went, and warns when a project install is happening outside a git repository. Where each lands:
+
+| Agent | `--scope project` | `--scope user` |
+|---|---|---|
+| `claude-code` | `.mcp.json` at the repo root | `mcpServers` in `~/.claude.json` |
+| `codex` | `.codex/config.toml` in the repo | `~/.codex/config.toml` |
+
+The agent's own CLI (`claude mcp add`, `codex mcp add`) is used when it is on PATH; otherwise the config file is merged, never replaced. Then **restart the agent** — and with project scope, Claude Code asks you to approve the server the first time it sees it (`/mcp` if you miss the prompt). `mcp uninstall` removes only the scope you name.
 
 No install needed either way: point `--files` at what the agent just wrote and read the JSON off stdout. Unstaged edits are covered, since a file with no staged hunks is read as entirely changed.
 

package/SECURITY.md

@@ -0,0 +1,52 @@
+# Security Policy
+
+## Supported versions
+
+Fixes land on the latest released version only. There are no maintenance
+branches for older releases.
+
+| Version | Supported |
+| ------- | --------- |
+| 2.4.x   | Yes       |
+| < 2.4   | No        |
+
+## Reporting a vulnerability
+
+Report privately through GitHub, not in a public issue:
+
+1. Go to the [Security tab](https://github.com/milad-hub/deprecated-tracker/security)
+2. Choose **Report a vulnerability**
+
+That opens a private advisory visible only to you and the maintainer. Please
+include the version, the platform, and the smallest reproduction you can manage.
+
+Expect an acknowledgement within a week. If a report is confirmed, the fix and
+the advisory are published together.
+
+## Scope
+
+The published npm package declares no runtime dependencies, but that is a
+statement about `package.json`, not about what executes on your machine.
+esbuild inlines whatever the sources import, so the TypeScript compiler ships
+inside `out/cli.js`. Anything bundled into a released artifact is in scope no
+matter which dependency block it was declared in.
+
+Reports that are in scope include:
+
+- Code execution or file access outside the scanned project, whether from the
+  CLI, the MCP server, or a configuration file
+- Cross-site scripting in the extension's webview panels, which render names,
+  file paths, and reasons taken from the scanned code
+- The `mcp install` / `mcp uninstall` commands writing outside their declared
+  target when given hostile input
+- Vulnerabilities in third-party code bundled into the published `.tgz` or
+  `.vsix`, including the TypeScript compiler
+
+Out of scope:
+
+- Vulnerabilities in build and test tooling that never leaves the development
+  machine — jest, eslint, prettier, esbuild and their dependency trees. These
+  are tracked through Dependabot instead.
+- Denial of service caused by pointing the scanner at a deliberately
+  pathological project. The scanner is a developer tool run against code you
+  already have on disk.

package/bin/deprecated-tracker.js

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
 "use strict";
 
 const { run } = require("../out/cli.js");

package/docs/CLI.md

@@ -173,9 +173,10 @@ the verbs by name, a schema for each, structured results instead of parsed
 stdout, and calls that do not each trip a shell-command approval.
 
 ```bash
-npx deprecated-tracker mcp install               # every agent found, project scope
+npx deprecated-tracker mcp install --agent claude-code --scope user
 npx deprecated-tracker mcp install --agent codex --scope user
-npx deprecated-tracker mcp uninstall             # same flags, same targets
+npx deprecated-tracker mcp install               # every agent found, project scope
+npx deprecated-tracker mcp uninstall --agent all --scope user
 ```
 
 | Tool | What it does |
@@ -199,6 +200,13 @@ Project scope is the default: it gets committed, so the whole team has the tool
 after a clone. `uninstall` removes only from the scope you name — cleaning up a
 project never touches a user-level registration.
 
+**A project registration means the directory you ran the command in.** Run it
+from your home folder and the tool is registered for a "project" no agent will
+ever open — nothing appears in the repo you meant, and it looks as though the
+install did nothing. The CLI names the directory it used and warns when that
+directory is not a git repository. Use `--scope user` when you want it
+everywhere regardless of where you happen to be standing.
+
 The agent's own CLI (`claude mcp add`, `codex mcp add`) is used when it is on
 PATH; otherwise the config file is edited directly, merging rather than
 replacing. Two things to expect afterwards: