githits 0.4.3 → 0.4.5

package/dist/shared/{chunk-15argn2z.js → chunk-ygqss6gp.js}

@@ -1,20 +1,16 @@
 import {
   __require,
   version
-} from "./chunk-q6d3ttgn.js";
+} from "./chunk-vfyz65v1.js";
 
 // src/services/app-config-paths.ts
 var APP_DIR = "githits";
 function getAppConfigDir(fs) {
   const home = fs.getHomeDir();
-  switch (process.platform) {
-    case "win32":
-      return fs.joinPath(process.env.APPDATA ?? fs.joinPath(home, "AppData", "Roaming"), APP_DIR);
-    case "darwin":
-      return fs.joinPath(home, "Library", "Application Support", APP_DIR);
-    default:
-      return fs.joinPath(process.env.XDG_CONFIG_HOME ?? fs.joinPath(home, ".config"), APP_DIR);
+  if (process.platform === "win32") {
+    return fs.joinPath(process.env.APPDATA ?? fs.joinPath(home, "AppData", "Roaming"), APP_DIR);
   }
+  return fs.joinPath(process.env.XDG_CONFIG_HOME ?? fs.joinPath(home, ".config"), APP_DIR);
 }
 function getAuthConfigPath(fs) {
   return fs.joinPath(getAppConfigDir(fs), "config.toml");
@@ -25,6 +21,15 @@ function getAuthFileStorageDir(fs) {
 function getLegacyAuthStorageDir(fs) {
   return fs.joinPath(fs.getHomeDir(), ".githits");
 }
+function getLegacyMacAppConfigDir(fs) {
+  return fs.joinPath(fs.getHomeDir(), "Library", "Application Support", APP_DIR);
+}
+function getLegacyMacAuthConfigPath(fs) {
+  return fs.joinPath(getLegacyMacAppConfigDir(fs), "config.toml");
+}
+function getLegacyMacAuthFileStorageDir(fs) {
+  return fs.joinPath(getLegacyMacAppConfigDir(fs), "auth");
+}
 // src/services/auth-config.ts
 import { parse as parseToml } from "smol-toml";
 import { z } from "zod";
@@ -50,7 +55,7 @@ function parseAuthStorageMode(value) {
   throw new AuthConfigError(`Invalid auth storage mode "${value}". Use "keychain" or "file". File mode stores OAuth credentials unencrypted on disk.`);
 }
 async function loadAuthConfig(fs) {
-  const configPath = getAuthConfigPath(fs);
+  let configPath = getAuthConfigPath(fs);
   const envMode = process.env.GITHITS_AUTH_STORAGE;
   if (envMode !== undefined && envMode.trim() !== "") {
     try {
@@ -63,7 +68,12 @@ async function loadAuthConfig(fs) {
     }
   }
   if (!await fs.exists(configPath)) {
-    return { storage: "keychain", configPath };
+    const legacyMacConfigPath = getLegacyMacAuthConfigPath(fs);
+    if (process.platform === "darwin" && await fs.exists(legacyMacConfigPath)) {
+      configPath = legacyMacConfigPath;
+    } else {
+      return { storage: "keychain", configPath };
+    }
   }
   let rawConfig;
   try {
@@ -732,6 +742,70 @@ async function clearAuthSessionBestEffort(clearTokens, clearClient) {
   if (firstError)
     throw firstError;
 }
+
+// src/services/auth-session-metadata-storage.ts
+var METADATA_FILE = "metadata.json";
+var DIR_MODE2 = 448;
+
+class AuthSessionMetadataStorage {
+  fs;
+  configDir;
+  metadataPath;
+  constructor(fs, configDir) {
+    this.fs = fs;
+    this.configDir = configDir ?? getAuthFileStorageDir(fs);
+    this.metadataPath = fs.joinPath(this.configDir, METADATA_FILE);
+  }
+  async load(baseUrl) {
+    const stored = await this.loadFile();
+    if (!stored)
+      return null;
+    const metadata = stored.sessions[normalizeBaseUrl(baseUrl)] ?? null;
+    return isAuthSessionMetadata(metadata) ? metadata : null;
+  }
+  async saveFromTokens(baseUrl, tokens) {
+    const stored = await this.loadFile() ?? {
+      version: 1,
+      sessions: {}
+    };
+    stored.sessions[normalizeBaseUrl(baseUrl)] = {
+      createdAt: tokens.createdAt,
+      expiresAt: tokens.expiresAt,
+      updatedAt: new Date().toISOString()
+    };
+    await this.fs.ensureDir(this.configDir, DIR_MODE2);
+    await this.fs.atomicWriteFile(this.metadataPath, JSON.stringify(stored, null, 2));
+  }
+  async clear(baseUrl) {
+    const stored = await this.loadFile();
+    if (!stored)
+      return;
+    delete stored.sessions[normalizeBaseUrl(baseUrl)];
+    if (Object.keys(stored.sessions).length === 0) {
+      await this.fs.deleteFile(this.metadataPath);
+      return;
+    }
+    await this.fs.atomicWriteFile(this.metadataPath, JSON.stringify(stored, null, 2));
+  }
+  async loadFile() {
+    if (!await this.fs.exists(this.metadataPath))
+      return null;
+    try {
+      const content = await this.fs.readFile(this.metadataPath);
+      const data = JSON.parse(content);
+      if (data.version !== 1 || !data.sessions)
+        return null;
+      return data;
+    } catch {
+      return null;
+    }
+  }
+}
+function isAuthSessionMetadata(value) {
+  if (value === null || typeof value !== "object")
+    return false;
+  return typeof value.createdAt === "string" && value.createdAt.length > 0 && typeof value.updatedAt === "string" && value.updatedAt.length > 0 && (value.expiresAt === null || typeof value.expiresAt === "string" && value.expiresAt.length > 0);
+}
 // src/services/browser-service.ts
 import open from "open";
 
@@ -1326,11 +1400,17 @@ class GitHitsServiceImpl {
         method: "POST",
         headers: this.headers(),
         body: JSON.stringify({
+          ...params.exampleId !== undefined && {
+            example_id: params.exampleId
+          },
           ...params.solutionId !== undefined && {
             solution_id: params.solutionId
           },
           accepted: params.accepted,
-          feedback_text: params.feedbackText ?? null
+          feedback_text: params.feedbackText ?? null,
+          ...params.toolName !== undefined && {
+            tool_name: params.toolName
+          }
         })
       });
       if (!response.ok) {
@@ -3533,15 +3613,19 @@ class MigratingAuthStorage {
   mode;
   configPath;
   onWarning;
+  metadata;
+  additionalLegacyStores;
   warnedFileModeKeychainExport = false;
   warnedAmbiguousPlaintext = false;
-  constructor(primary, file, legacy, mode, configPath = "your GitHits config.toml", onWarning = () => {}) {
+  constructor(primary, file, legacy, mode, configPath = "your GitHits config.toml", onWarning = () => {}, metadata, additionalLegacyStores = []) {
     this.primary = primary;
     this.file = file;
     this.legacy = legacy;
     this.mode = mode;
     this.configPath = configPath;
     this.onWarning = onWarning;
+    this.metadata = metadata;
+    this.additionalLegacyStores = additionalLegacyStores;
   }
   async loadTokens(baseUrl2) {
     if (this.mode === "file") {
@@ -3552,10 +3636,12 @@ class MigratingAuthStorage {
   async saveTokens(baseUrl2, data) {
     if (this.mode === "file") {
       await this.file.saveTokens(baseUrl2, data);
+      await this.saveMetadataBestEffort(baseUrl2, data);
       return;
     }
     try {
       await this.primary.saveTokens(baseUrl2, data);
+      await this.saveMetadataBestEffort(baseUrl2, data);
     } catch (error) {
       throw this.toPolicyError(error);
     }
@@ -3571,6 +3657,10 @@ class MigratingAuthStorage {
     const primaryError = await this.clearBestEffort(() => this.primary.clearTokens(baseUrl2));
     await this.clearBestEffort(() => this.file.clearTokens(baseUrl2));
     await this.clearBestEffort(() => this.legacy.clearTokens(baseUrl2));
+    for (const legacy of this.additionalLegacyStores) {
+      await this.clearBestEffort(() => legacy.clearTokens(baseUrl2));
+    }
+    await this.clearBestEffort(() => this.metadata?.clear(baseUrl2) ?? Promise.resolve());
     if (primaryError && !(primaryError instanceof KeychainUnavailableError)) {
       throw primaryError;
     }
@@ -3603,6 +3693,9 @@ class MigratingAuthStorage {
     const primaryError = await this.clearBestEffort(() => this.primary.clearClient(baseUrl2));
     await this.clearBestEffort(() => this.file.clearClient(baseUrl2));
     await this.clearBestEffort(() => this.legacy.clearClient(baseUrl2));
+    for (const legacy of this.additionalLegacyStores) {
+      await this.clearBestEffort(() => legacy.clearClient(baseUrl2));
+    }
     if (primaryError && !(primaryError instanceof KeychainUnavailableError)) {
       throw primaryError;
     }
@@ -3610,10 +3703,12 @@ class MigratingAuthStorage {
   async saveAuthSession(baseUrl2, client, tokens) {
     if (this.mode === "file") {
       await this.file.saveAuthSession(baseUrl2, client, tokens);
+      await this.saveMetadataBestEffort(baseUrl2, tokens);
       return;
     }
     try {
       await this.primary.saveAuthSession(baseUrl2, client, tokens);
+      await this.saveMetadataBestEffort(baseUrl2, tokens);
     } catch (error) {
       throw this.toPolicyError(error);
     }
@@ -3622,6 +3717,10 @@ class MigratingAuthStorage {
     const primaryError = await this.clearBestEffort(() => this.primary.clearAuthSession(baseUrl2));
     await this.clearBestEffort(() => this.file.clearAuthSession(baseUrl2));
     await this.clearBestEffort(() => this.legacy.clearAuthSession(baseUrl2));
+    for (const legacy of this.additionalLegacyStores) {
+      await this.clearBestEffort(() => legacy.clearAuthSession(baseUrl2));
+    }
+    await this.clearBestEffort(() => this.metadata?.clear(baseUrl2) ?? Promise.resolve());
     if (primaryError && !(primaryError instanceof KeychainUnavailableError)) {
       throw primaryError;
     }
@@ -3632,8 +3731,10 @@ class MigratingAuthStorage {
   async loadTokensKeychainMode(baseUrl2) {
     try {
       const primaryTokens = await this.primary.loadTokens(baseUrl2);
-      if (primaryTokens)
+      if (primaryTokens) {
+        await this.saveMetadataBestEffort(baseUrl2, primaryTokens);
         return primaryTokens;
+      }
     } catch (error) {
       if (!(error instanceof KeychainUnavailableError))
         throw error;
@@ -3648,7 +3749,8 @@ class MigratingAuthStorage {
         return candidate.data;
       throw error;
     }
-    await this.clearMigratedPlaintext(baseUrl2, "tokens", candidate.source, candidate.ambiguous);
+    await this.clearMigratedPlaintext(baseUrl2, "tokens", candidate.source, candidate.storage, candidate.ambiguous);
+    await this.saveMetadataBestEffort(baseUrl2, candidate.data);
     return candidate.data;
   }
   async loadTokensFileMode(baseUrl2) {
@@ -3656,8 +3758,9 @@ class MigratingAuthStorage {
     if (candidate) {
       if (candidate.source === "legacy") {
         await this.file.saveTokens(baseUrl2, candidate.data);
-        await this.clearBestEffort(() => this.legacy.clearTokens(baseUrl2));
+        await this.clearBestEffort(() => candidate.storage.clearTokens(baseUrl2));
       }
+      await this.saveMetadataBestEffort(baseUrl2, candidate.data);
       return candidate.data;
     }
     let primaryTokens = null;
@@ -3671,6 +3774,7 @@ class MigratingAuthStorage {
       return null;
     this.warnKeychainExport();
     await this.file.saveTokens(baseUrl2, primaryTokens);
+    await this.saveMetadataBestEffort(baseUrl2, primaryTokens);
     return primaryTokens;
   }
   async loadClientKeychainMode(baseUrl2) {
@@ -3692,7 +3796,7 @@ class MigratingAuthStorage {
         return candidate.data;
       throw error;
     }
-    await this.clearMigratedPlaintext(baseUrl2, "client", candidate.source, candidate.ambiguous);
+    await this.clearMigratedPlaintext(baseUrl2, "client", candidate.source, candidate.storage, candidate.ambiguous);
     return candidate.data;
   }
   async loadClientFileMode(baseUrl2) {
@@ -3700,7 +3804,7 @@ class MigratingAuthStorage {
     if (candidate) {
       if (candidate.source === "legacy") {
         await this.file.saveClient(baseUrl2, candidate.data);
-        await this.clearBestEffort(() => this.legacy.clearClient(baseUrl2));
+        await this.clearBestEffort(() => candidate.storage.clearClient(baseUrl2));
       }
       return candidate.data;
     }
@@ -3724,18 +3828,22 @@ class MigratingAuthStorage {
       candidates.push({
         data: fileTokens,
         source: "file",
+        storage: this.file,
         timestamp: fileTokens.createdAt,
         ambiguous: false
       });
     }
-    const legacyTokens = await this.legacy.loadTokens(baseUrl2);
-    if (legacyTokens) {
-      candidates.push({
-        data: legacyTokens,
-        source: "legacy",
-        timestamp: legacyTokens.createdAt,
-        ambiguous: false
-      });
+    for (const legacy of this.getLegacyStores()) {
+      const legacyTokens = await legacy.loadTokens(baseUrl2);
+      if (legacyTokens) {
+        candidates.push({
+          data: legacyTokens,
+          source: "legacy",
+          storage: legacy,
+          timestamp: legacyTokens.createdAt,
+          ambiguous: false
+        });
+      }
     }
     return this.selectNewestCandidate(candidates);
   }
@@ -3746,18 +3854,22 @@ class MigratingAuthStorage {
       candidates.push({
         data: fileClient,
         source: "file",
+        storage: this.file,
         timestamp: fileClient.registeredAt,
         ambiguous: false
       });
     }
-    const legacyClient = await this.legacy.loadClient(baseUrl2);
-    if (legacyClient) {
-      candidates.push({
-        data: legacyClient,
-        source: "legacy",
-        timestamp: legacyClient.registeredAt,
-        ambiguous: false
-      });
+    for (const legacy of this.getLegacyStores()) {
+      const legacyClient = await legacy.loadClient(baseUrl2);
+      if (legacyClient) {
+        candidates.push({
+          data: legacyClient,
+          source: "legacy",
+          storage: legacy,
+          timestamp: legacyClient.registeredAt,
+          ambiguous: false
+        });
+      }
     }
     return this.selectNewestCandidate(candidates);
   }
@@ -3772,7 +3884,7 @@ class MigratingAuthStorage {
     }));
     if (parsed.some((entry) => Number.isNaN(entry.timestampMs))) {
       this.warnAmbiguousPlaintext();
-      const selected = candidates.find((candidate) => candidate.source === "file") ?? candidates[0] ?? null;
+      const selected = candidates.find((candidate) => candidate.source === "file") ?? null;
       if (selected)
         selected.ambiguous = true;
       return selected;
@@ -3784,16 +3896,20 @@ class MigratingAuthStorage {
       return candidates[0] ?? null;
     if (second && first.timestampMs === second.timestampMs) {
       this.warnAmbiguousPlaintext();
-      const selected = candidates.find((candidate) => candidate.source === "file") ?? first.candidate;
+      const selected = candidates.find((candidate) => candidate.source === "file") ?? null;
+      if (!selected)
+        return null;
       selected.ambiguous = true;
       return selected;
     }
     return first.candidate;
   }
-  async clearMigratedPlaintext(baseUrl2, kind, source, ambiguous = false) {
+  async clearMigratedPlaintext(baseUrl2, kind, source, storage, ambiguous = false) {
     if (!ambiguous) {
       await this.clearPlaintextSource(this.file, baseUrl2, kind);
-      await this.clearPlaintextSource(this.legacy, baseUrl2, kind);
+      for (const legacy of this.getLegacyStores()) {
+        await this.clearPlaintextSource(legacy, baseUrl2, kind);
+      }
       return;
     }
     if (source === "file") {
@@ -3801,9 +3917,12 @@ class MigratingAuthStorage {
       return;
     }
     if (source === "legacy") {
-      await this.clearPlaintextSource(this.legacy, baseUrl2, kind);
+      await this.clearPlaintextSource(storage, baseUrl2, kind);
     }
   }
+  getLegacyStores() {
+    return [...this.additionalLegacyStores, this.legacy];
+  }
   async clearPlaintextSource(storage, baseUrl2, kind) {
     await this.clearBestEffort(() => kind === "tokens" ? storage.clearTokens(baseUrl2) : storage.clearClient(baseUrl2));
   }
@@ -3815,6 +3934,9 @@ class MigratingAuthStorage {
       return error;
     }
   }
+  async saveMetadataBestEffort(baseUrl2, tokens) {
+    await this.clearBestEffort(() => this.metadata?.saveFromTokens(baseUrl2, tokens) ?? Promise.resolve());
+  }
   toPolicyError(error) {
     if (!(error instanceof KeychainUnavailableError))
       return error;
@@ -4051,7 +4173,10 @@ query PackageSummary($registry: Registry!, $name: String!) {
 var packageVersionIdentitySchema = z3.object({
   name: z3.string().nullable().optional(),
   registry: z3.string().nullable().optional(),
-  version: z3.string().nullable().optional()
+  version: z3.string().nullable().optional(),
+  publishedAt: z3.string().nullable().optional(),
+  deprecated: z3.boolean().nullable().optional(),
+  deprecationReason: z3.string().nullable().optional()
 });
 var vulnerabilityDetailSchema = z3.object({
   osvId: z3.string().nullable().optional(),
@@ -4175,6 +4300,86 @@ var dependencyGraphSchema = z3.object({
   nodes: z3.array(dependencyGraphNodeSchema),
   edges: z3.array(dependencyGraphEdgeSchema)
 });
+var vulnerabilityCountSummarySchema = z3.object({
+  totalVulnerabilities: z3.number().int(),
+  critical: z3.number().int(),
+  high: z3.number().int(),
+  medium: z3.number().int(),
+  low: z3.number().int(),
+  unknown: z3.number().int()
+});
+var vulnerabilitySummaryDetailSchema = z3.object({
+  osvId: z3.string().nullable().optional(),
+  registry: z3.string().nullable().optional(),
+  packageName: z3.string().nullable().optional(),
+  summary: z3.string().nullable().optional(),
+  severityScore: z3.number().nullable().optional(),
+  severityType: z3.string().nullable().optional(),
+  affectedVersionRanges: z3.array(z3.string()).nullable().optional(),
+  fixedInVersions: z3.array(z3.string()).nullable().optional(),
+  publishedAt: z3.string().nullable().optional(),
+  modifiedAt: z3.string().nullable().optional(),
+  withdrawnAt: z3.string().nullable().optional(),
+  aliases: z3.array(z3.string()).nullable().optional(),
+  isMalicious: z3.boolean().nullable().optional()
+});
+var transitiveDependencyVulnerabilitySchema = z3.object({
+  version: z3.string(),
+  affectsResolvedVersion: z3.boolean(),
+  matchedAffectedVersionRanges: z3.array(z3.string()),
+  fixVersionsAboveResolved: z3.array(z3.string()),
+  nearestFixedVersion: z3.string().nullable().optional(),
+  advisory: vulnerabilitySummaryDetailSchema
+});
+var transitiveVulnerablePackageSchema = z3.object({
+  registry: z3.string(),
+  name: z3.string(),
+  versions: z3.array(z3.string()),
+  affectedCount: z3.number().int(),
+  nonAffectingCount: z3.number().int(),
+  totalCount: z3.number().int(),
+  maxSeverityScore: z3.number().nullable().optional(),
+  maxSeverityLabel: z3.string().nullable().optional(),
+  advisoryIds: z3.array(z3.string()),
+  mostCritical: vulnerabilitySummaryDetailSchema.nullable().optional(),
+  advisoryOccurrences: z3.array(transitiveDependencyVulnerabilitySchema).nullable().optional()
+});
+var transitiveVulnerabilitySummarySchema = z3.object({
+  affected: vulnerabilityCountSummarySchema,
+  nonAffecting: vulnerabilityCountSummarySchema,
+  combined: vulnerabilityCountSummarySchema,
+  totalPackagesAnalyzed: z3.number().int(),
+  affectedPackageCount: z3.number().int(),
+  packages: z3.array(transitiveVulnerablePackageSchema),
+  calculatedAt: z3.string().nullable().optional()
+}).nullable().optional();
+var dependencyDeprecationReasonSchema = z3.object({
+  version: z3.string(),
+  reason: z3.string().nullable().optional()
+});
+var deprecatedDependencySchema = z3.object({
+  registry: z3.string(),
+  name: z3.string(),
+  versions: z3.array(z3.string()),
+  reasons: z3.array(dependencyDeprecationReasonSchema)
+});
+var outdatedDependencyVersionSchema = z3.object({
+  version: z3.string(),
+  severity: z3.string()
+});
+var outdatedDependencySchema = z3.object({
+  registry: z3.string(),
+  name: z3.string(),
+  latestVersion: z3.string().nullable().optional(),
+  severity: z3.string(),
+  versions: z3.array(outdatedDependencyVersionSchema),
+  repositoryUrl: z3.string().nullable().optional()
+});
+var duplicateDependencySchema = z3.object({
+  registry: z3.string().nullable().optional(),
+  name: z3.string(),
+  versions: z3.array(z3.string())
+});
 var dependencyConflictEdgeSchema = z3.object({
   fromIndex: z3.number().int().nullable().optional(),
   toIndex: z3.number().int(),
@@ -4186,6 +4391,24 @@ var dependencyConflictSchema = z3.object({
   requiredVersions: z3.array(z3.string()),
   conflictingEdges: z3.array(dependencyConflictEdgeSchema)
 });
+var dependencyIssueConflictSchema = z3.object({
+  registry: z3.string().nullable().optional(),
+  name: z3.string(),
+  versions: z3.array(z3.string()),
+  requiredVersions: z3.array(z3.string()),
+  conflictingEdges: z3.array(dependencyConflictEdgeSchema)
+});
+var dependencyIssuesSummarySchema = z3.object({
+  totalCount: z3.number().int(),
+  deprecatedCount: z3.number().int(),
+  outdatedCount: z3.number().int(),
+  duplicateCount: z3.number().int(),
+  conflictCount: z3.number().int(),
+  deprecatedPackages: z3.array(deprecatedDependencySchema),
+  outdatedPackages: z3.array(outdatedDependencySchema),
+  duplicatePackages: z3.array(duplicateDependencySchema),
+  conflicts: z3.array(dependencyIssueConflictSchema)
+}).nullable().optional();
 var circularDependencyCycleSchema = z3.object({
   cycleStart: z3.string(),
   circularPath: z3.array(z3.string()),
@@ -4202,7 +4425,9 @@ var transitiveDependencySchema = z3.object({
   uniqueDependencies: z3.array(z3.string()).nullable().optional(),
   dependencyConflicts: z3.array(dependencyConflictSchema).nullable().optional(),
   circularDependencyCycles: z3.array(circularDependencyCycleSchema).nullable().optional(),
-  dependencyGraph: dependencyGraphSchema.nullable().optional()
+  dependencyGraph: dependencyGraphSchema.nullable().optional(),
+  vulnerabilitySummary: transitiveVulnerabilitySummarySchema,
+  dependencyIssues: dependencyIssuesSummarySchema
 }).nullable().optional();
 var dependencyBundleSchema = z3.object({
   direct: z3.array(directDependencySchema).nullable().optional(),
@@ -4332,6 +4557,203 @@ query PackageDependencies(
     }
   }
 }`;
+var PACKAGE_UPGRADE_DEPENDENCY_PROBE_QUERY = `
+query PackageUpgradeDependencyProbe(
+  $registry: Registry!
+  $name: String!
+  $version: String!
+  $includeTransitiveRisk: Boolean!
+  $includeTransitiveSecurity: Boolean!
+  $includeDependencyIssues: Boolean!
+  $includeDependencyChanges: Boolean!
+  $includeGroups: Boolean!
+  $lifecycle: [String!]
+  $minSeverity: Float
+) {
+  packageDependencies(
+    registry: $registry
+    name: $name
+    version: $version
+    includeTransitive: $includeTransitiveRisk
+    lifecycle: $lifecycle
+  ) {
+    package {
+      name
+      registry
+      version
+      publishedAt
+      deprecated
+      deprecationReason
+    }
+    dependencies {
+      direct {
+        name
+        versionConstraint
+        type
+      }
+      transitive @include(if: $includeTransitiveRisk) {
+        dependencyGraph @include(if: $includeDependencyChanges) {
+          formatVersion
+          nodes {
+            registry
+            name
+            version
+          }
+          edges {
+            fromIndex
+            toIndex
+            constraint
+            dependencyType
+          }
+        }
+        vulnerabilitySummary(minSeverity: $minSeverity) @include(if: $includeTransitiveSecurity) {
+          affected {
+            totalVulnerabilities
+            critical
+            high
+            medium
+            low
+            unknown
+          }
+          nonAffecting {
+            totalVulnerabilities
+            critical
+            high
+            medium
+            low
+            unknown
+          }
+          combined {
+            totalVulnerabilities
+            critical
+            high
+            medium
+            low
+            unknown
+          }
+          totalPackagesAnalyzed
+          affectedPackageCount
+          calculatedAt
+          packages {
+            registry
+            name
+            versions
+            affectedCount
+            nonAffectingCount
+            totalCount
+            maxSeverityScore
+            maxSeverityLabel
+            advisoryIds(scope: AFFECTED)
+            mostCritical {
+              osvId
+              registry
+              packageName
+              summary
+              severityScore
+              severityType
+              affectedVersionRanges
+              fixedInVersions
+              publishedAt
+              modifiedAt
+              withdrawnAt
+              aliases
+              isMalicious
+            }
+            advisoryOccurrences(scope: AFFECTED, minSeverity: $minSeverity, limit: 5) {
+              version
+              affectsResolvedVersion
+              matchedAffectedVersionRanges
+              fixVersionsAboveResolved
+              nearestFixedVersion
+              advisory {
+                osvId
+                registry
+                packageName
+                summary
+                severityScore
+                severityType
+                affectedVersionRanges
+                fixedInVersions
+                publishedAt
+                modifiedAt
+                withdrawnAt
+                aliases
+                isMalicious
+              }
+            }
+          }
+        }
+        dependencyIssues @include(if: $includeDependencyIssues) {
+          totalCount
+          deprecatedCount
+          outdatedCount
+          duplicateCount
+          conflictCount
+          deprecatedPackages {
+            registry
+            name
+            versions
+            reasons {
+              version
+              reason
+            }
+          }
+          outdatedPackages {
+            registry
+            name
+            latestVersion
+            severity
+            versions {
+              version
+              severity
+            }
+            repositoryUrl
+          }
+          duplicatePackages {
+            registry
+            name
+            versions
+          }
+          conflicts {
+            registry
+            name
+            versions
+            requiredVersions
+            conflictingEdges {
+              fromIndex
+              toIndex
+              versionConstraint
+              dependencyType
+            }
+          }
+        }
+      }
+    }
+    dependencyGroups @include(if: $includeGroups) {
+      primaryGroup
+      environmentMarkers {
+        type
+        value
+        raw
+      }
+      groups {
+        name
+        lifecycle
+        conditionType
+        conditionValue
+        selectionMode
+        exclusiveGroup
+        fallbackPriority
+        compatibleWith
+        defaultEnabled
+        dependencies {
+          name
+          constraint
+        }
+      }
+    }
+  }
+}`;
 var changelogPackageInfoSchema = z3.object({
   name: z3.string().nullable().optional(),
   registry: z3.string().nullable().optional(),
@@ -4799,7 +5221,10 @@ class PackageIntelligenceServiceImpl {
     const identity = {
       name,
       version: version2,
-      registry: data.package?.registry ?? undefined
+      registry: data.package?.registry ?? undefined,
+      publishedAt: data.package?.publishedAt ?? undefined,
+      deprecated: data.package?.deprecated ?? undefined,
+      deprecationReason: data.package?.deprecationReason ?? undefined
     };
     const security = data.security ? {
       affectedVulnerabilityCount: data.security.affectedVulnerabilityCount,
@@ -4839,6 +5264,58 @@ class PackageIntelligenceServiceImpl {
       executeWithToken: (token) => this.executePackageDependencies(token, params)
     }));
   }
+  async packageUpgradeDependencyProbe(params) {
+    return withTelemetrySpan("pkg-intel.upgrade-dependency-probe.request", () => executeWithTokenRefresh({
+      getToken: () => this.tokenProvider.getToken(),
+      forceRefresh: () => this.tokenProvider.forceRefresh(),
+      shouldRefresh: (error) => error instanceof AuthenticationError,
+      executeWithToken: (token) => this.executePackageUpgradeDependencyProbe(token, params)
+    }));
+  }
+  async executePackageUpgradeDependencyProbe(token, params) {
+    const includeTransitiveRisk = params.includeTransitiveSecurity === true || params.includeDependencyIssues === true || params.includeDependencyChanges === true;
+    let response;
+    try {
+      response = await postPkgseerGraphql({
+        endpointUrl: this.endpointUrl,
+        token,
+        query: PACKAGE_UPGRADE_DEPENDENCY_PROBE_QUERY,
+        variables: {
+          registry: params.registry,
+          name: params.packageName,
+          version: params.version,
+          includeTransitiveRisk,
+          includeTransitiveSecurity: params.includeTransitiveSecurity === true,
+          includeDependencyIssues: params.includeDependencyIssues === true,
+          includeDependencyChanges: params.includeDependencyChanges === true,
+          includeGroups: params.includeGroups === true,
+          lifecycle: params.includeGroups === true ? ["peer"] : undefined,
+          minSeverity: params.minSeverity
+        },
+        fetchFn: this.fetchFn
+      });
+    } catch (cause) {
+      if (cause instanceof PkgseerTransportError) {
+        throw new PackageIntelligenceNetworkError("Could not reach the package intelligence service. Check your connection or set GITHITS_CODE_NAV_URL.", { cause });
+      }
+      throw cause;
+    }
+    if (response.status < 200 || response.status >= 300) {
+      throw this.createHttpError(response);
+    }
+    const parsed = dependenciesGraphQLResponseSchema.safeParse(response.parsedBody);
+    if (!parsed.success) {
+      throw new MalformedPackageIntelligenceResponseError("Malformed response from the package-intelligence service.");
+    }
+    if (parsed.data.errors && parsed.data.errors.length > 0) {
+      throw promoteGenericVersionNotFound(this.createGraphQLError(parsed.data.errors), params);
+    }
+    const data = parsed.data.data?.packageDependencies;
+    if (!data) {
+      throw new MalformedPackageIntelligenceResponseError("Empty response from the package-intelligence service.");
+    }
+    return this.normaliseDependencyReport(data);
+  }
   async executePackageDependencies(token, params) {
     let response;
     try {
@@ -4887,7 +5364,10 @@ class PackageIntelligenceServiceImpl {
     const identity = {
       name,
       version: version2,
-      registry: data.package?.registry ?? undefined
+      registry: data.package?.registry ?? undefined,
+      publishedAt: data.package?.publishedAt ?? undefined,
+      deprecated: data.package?.deprecated ?? undefined,
+      deprecationReason: data.package?.deprecationReason ?? undefined
     };
     const bundle = data.dependencies;
     const dependencies = bundle ? {
@@ -4933,7 +5413,9 @@ class PackageIntelligenceServiceImpl {
             constraint: e.constraint ?? undefined,
             dependencyType: e.dependencyType ?? undefined
           }))
-        } : undefined
+        } : undefined,
+        vulnerabilitySummary: this.normaliseTransitiveVulnerabilitySummary(bundle.transitive.vulnerabilitySummary),
+        dependencyIssues: this.normaliseDependencyIssuesSummary(bundle.transitive.dependencyIssues)
       } : undefined
     } : undefined;
     const dependencyGroups = data.dependencyGroups ? {
@@ -4965,6 +5447,103 @@ class PackageIntelligenceServiceImpl {
       dependencyGroups
     };
   }
+  normaliseTransitiveVulnerabilitySummary(summary) {
+    if (!summary)
+      return;
+    return {
+      affected: summary.affected,
+      nonAffecting: summary.nonAffecting,
+      combined: summary.combined,
+      totalPackagesAnalyzed: summary.totalPackagesAnalyzed,
+      affectedPackageCount: summary.affectedPackageCount,
+      calculatedAt: summary.calculatedAt ?? undefined,
+      packages: summary.packages.map((pkg) => ({
+        registry: pkg.registry,
+        name: pkg.name,
+        versions: pkg.versions,
+        affectedCount: pkg.affectedCount,
+        nonAffectingCount: pkg.nonAffectingCount,
+        totalCount: pkg.totalCount,
+        maxSeverityScore: pkg.maxSeverityScore ?? undefined,
+        maxSeverityLabel: pkg.maxSeverityLabel ?? undefined,
+        advisoryIds: pkg.advisoryIds,
+        mostCritical: pkg.mostCritical ? this.normaliseVulnerabilitySummaryDetail(pkg.mostCritical) : undefined,
+        advisoryOccurrences: pkg.advisoryOccurrences?.map((occurrence) => ({
+          version: occurrence.version,
+          affectsResolvedVersion: occurrence.affectsResolvedVersion,
+          matchedAffectedVersionRanges: occurrence.matchedAffectedVersionRanges,
+          fixVersionsAboveResolved: occurrence.fixVersionsAboveResolved,
+          nearestFixedVersion: occurrence.nearestFixedVersion ?? undefined,
+          advisory: this.normaliseVulnerabilitySummaryDetail(occurrence.advisory)
+        })) ?? undefined
+      }))
+    };
+  }
+  normaliseVulnerabilitySummaryDetail(advisory) {
+    return {
+      osvId: advisory.osvId ?? undefined,
+      registry: advisory.registry ?? undefined,
+      packageName: advisory.packageName ?? undefined,
+      summary: advisory.summary ?? undefined,
+      severityScore: advisory.severityScore ?? undefined,
+      severityType: advisory.severityType ?? undefined,
+      affectedVersionRanges: advisory.affectedVersionRanges ?? undefined,
+      fixedInVersions: advisory.fixedInVersions ?? undefined,
+      publishedAt: advisory.publishedAt ?? undefined,
+      modifiedAt: advisory.modifiedAt ?? undefined,
+      withdrawnAt: advisory.withdrawnAt ?? undefined,
+      aliases: advisory.aliases ?? undefined,
+      isMalicious: advisory.isMalicious ?? undefined
+    };
+  }
+  normaliseDependencyIssuesSummary(issues) {
+    if (!issues)
+      return;
+    return {
+      totalCount: issues.totalCount,
+      deprecatedCount: issues.deprecatedCount,
+      outdatedCount: issues.outdatedCount,
+      duplicateCount: issues.duplicateCount,
+      conflictCount: issues.conflictCount,
+      deprecatedPackages: issues.deprecatedPackages.map((pkg) => ({
+        registry: pkg.registry,
+        name: pkg.name,
+        versions: pkg.versions,
+        reasons: pkg.reasons.map((reason) => ({
+          version: reason.version,
+          reason: reason.reason ?? undefined
+        }))
+      })),
+      outdatedPackages: issues.outdatedPackages.map((pkg) => ({
+        registry: pkg.registry,
+        name: pkg.name,
+        latestVersion: pkg.latestVersion ?? undefined,
+        severity: pkg.severity,
+        versions: pkg.versions.map((version2) => ({
+          version: version2.version,
+          severity: version2.severity
+        })),
+        repositoryUrl: pkg.repositoryUrl ?? undefined
+      })),
+      duplicatePackages: issues.duplicatePackages.map((pkg) => ({
+        registry: pkg.registry ?? undefined,
+        name: pkg.name,
+        versions: pkg.versions
+      })),
+      conflicts: issues.conflicts.map((conflict) => ({
+        registry: conflict.registry ?? undefined,
+        name: conflict.name,
+        versions: conflict.versions,
+        requiredVersions: conflict.requiredVersions,
+        conflictingEdges: conflict.conflictingEdges.map((edge) => ({
+          fromIndex: edge.fromIndex ?? undefined,
+          toIndex: edge.toIndex,
+          versionConstraint: edge.versionConstraint,
+          dependencyType: edge.dependencyType
+        }))
+      }))
+    };
+  }
   async packageChangelog(params) {
     return withTelemetrySpan("pkg-intel.changelog.request", () => executeWithTokenRefresh({
       getToken: () => this.tokenProvider.getToken(),
@@ -5423,7 +6002,7 @@ var NPM_DIST_TAGS_URL = "https://registry.npmjs.org/-/package/githits/dist-tags"
 var NPM_PACKAGE_VERSION_URL = "https://registry.npmjs.org/githits";
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
 var FETCH_TIMEOUT_MS = 1000;
-var DIR_MODE2 = 448;
+var DIR_MODE3 = 448;
 var UPDATE_COMMAND = "npm i -g githits@latest";
 var MAX_DEPRECATION_REASON_LENGTH = 200;
 
@@ -5613,7 +6192,7 @@ class NpmRegistryUpdateCheckService {
   }
   async saveCache(cache) {
     try {
-      await this.fs.ensureDir(this.configDir, DIR_MODE2);
+      await this.fs.ensureDir(this.configDir, DIR_MODE3);
       if (typeof this.fs.atomicWriteFile === "function") {
         await this.fs.atomicWriteFile(this.cachePath, `${JSON.stringify(cache, null, 2)}
 `);
@@ -5750,10 +6329,29 @@ async function createAuthStorage(fileSystemService) {
 function createAuthStorageForMode(fileSystemService, mode, configPath = "your GitHits config.toml") {
   const fileStorage = new ModeAwareFileAuthStorage(new AuthStorageImpl(fileSystemService, getAuthFileStorageDir(fileSystemService)), mode, configPath);
   const legacyStorage = new AuthStorageImpl(fileSystemService, getLegacyAuthStorageDir(fileSystemService));
+  const additionalLegacyStores = process.platform === "darwin" ? [
+    new AuthStorageImpl(fileSystemService, getLegacyMacAuthFileStorageDir(fileSystemService))
+  ] : [];
   const rawKeyring = new KeyringServiceImpl;
   const keyring = process.platform === "win32" ? new ChunkingKeyringService(rawKeyring, WINDOWS_MAX_ENTRY_SIZE) : rawKeyring;
   const keychainStorage = new KeychainAuthStorage(keyring);
-  return new LockedAuthStorage(new MigratingAuthStorage(keychainStorage, fileStorage, legacyStorage, mode, configPath, (message) => console.error(message)), fileSystemService);
+  const metadataStorage = new AuthSessionMetadataStorage(fileSystemService);
+  return new LockedAuthStorage(new MigratingAuthStorage(keychainStorage, fileStorage, legacyStorage, mode, configPath, (message) => console.error(message), metadataStorage, additionalLegacyStores), fileSystemService);
+}
+async function loadAutoLoginAuthSessionMetadata() {
+  const envToken = getEnvApiToken();
+  if (envToken) {
+    const now = new Date().toISOString();
+    return { createdAt: now, expiresAt: null, updatedAt: now };
+  }
+  const fileSystemService = new FileSystemServiceImpl;
+  const metadataStorage = new AuthSessionMetadataStorage(fileSystemService);
+  return metadataStorage.load(getMcpUrl());
+}
+async function clearAutoLoginAuthSessionMetadata() {
+  const fileSystemService = new FileSystemServiceImpl;
+  const metadataStorage = new AuthSessionMetadataStorage(fileSystemService);
+  await metadataStorage.clear(getMcpUrl());
 }
 async function createAuthCommandDependencies() {
   return withTelemetrySpan("container.create-auth-command", async () => {
@@ -5792,8 +6390,9 @@ function createStaticTokenProvider(token) {
     }
   };
 }
-async function createContainer() {
+async function createContainer(options = {}) {
   return withTelemetrySpan("container.create", async () => {
+    const resolveStoredToken = options.resolveStoredToken ?? true;
     const mcpUrl = getMcpUrl();
     const apiUrl = getApiUrl();
     const codeNavigationUrl = getCodeNavigationUrl();
@@ -5824,7 +6423,10 @@ async function createContainer() {
     }
     const authStorage = await createAuthStorage(fileSystemService);
     const tokenManager = new TokenManager({ authService, authStorage, mcpUrl });
-    const apiToken = await withTelemetrySpan("container.token.get", () => tokenManager.getToken());
+    const apiToken = resolveStoredToken ? await withTelemetrySpan("container.token.get", () => tokenManager.getToken()) : undefined;
+    if (resolveStoredToken && apiToken === undefined) {
+      await new AuthSessionMetadataStorage(fileSystemService).clear(mcpUrl);
+    }
     const codeNavigationService = new CodeNavigationServiceImpl(codeNavigationUrl, tokenManager);
     const packageIntelligenceService = new PackageIntelligenceServiceImpl(codeNavigationUrl, tokenManager);
     return {
@@ -5845,4 +6447,4 @@ async function createContainer() {
   });
 }
 
-export { AuthConfigError, CLIENT_UPDATE_REQUIRED_REASON, ClientUpdateRequiredError, debugLog, setMcpClientVersionProvider, setClientMode, isTelemetryEnabled, withTelemetrySpan, startTelemetrySpan, endTelemetrySpan, flushTelemetry, AuthenticationError, CodeNavigationAccessError, CodeNavigationGraphQLError, CodeNavigationIndexingError, CodeNavigationUnresolvableError, MalformedCodeNavigationResponseError, CodeNavigationTargetNotFoundError, CodeNavigationFileNotFoundError, CodeNavigationVersionNotFoundError, CodeNavigationValidationError, CodeNavigationFeatureFlagRequiredError, CodeNavigationNetworkError, CodeNavigationBackendError, getCodeNavigationUrl, ExecServiceImpl, FileSystemServiceImpl, AuthStorageLockTimeoutError, AuthStoragePolicyError, PackageIntelligenceAccessError, PackageIntelligenceFeatureFlagRequiredError, PackageIntelligenceNetworkError, PackageIntelligenceBackendError, PackageIntelligenceGraphQLError, PackageIntelligenceTargetNotFoundError, PackageIntelligenceValidationError, PackageIntelligenceVersionNotFoundError, MalformedPackageIntelligenceResponseError, PackageIntelligenceChangelogSourceNotFoundError, PromptServiceImpl, refreshExpiredToken, NpmRegistryUpdateCheckService, shouldRunUpdateCheck, shouldRunRequiredUpdateEnforcement, formatUpdateNotice, formatRequiredUpdateNotice, createAuthCommandDependencies, createAuthStatusDependencies, createContainer };
+export { AuthConfigError, CLIENT_UPDATE_REQUIRED_REASON, ClientUpdateRequiredError, debugLog, setMcpClientVersionProvider, setClientMode, isTelemetryEnabled, withTelemetrySpan, startTelemetrySpan, endTelemetrySpan, flushTelemetry, AuthenticationError, CodeNavigationAccessError, CodeNavigationGraphQLError, CodeNavigationIndexingError, CodeNavigationUnresolvableError, MalformedCodeNavigationResponseError, CodeNavigationTargetNotFoundError, CodeNavigationFileNotFoundError, CodeNavigationVersionNotFoundError, CodeNavigationValidationError, CodeNavigationFeatureFlagRequiredError, CodeNavigationNetworkError, CodeNavigationBackendError, getCodeNavigationUrl, ExecServiceImpl, FileSystemServiceImpl, AuthStorageLockTimeoutError, AuthStoragePolicyError, PackageIntelligenceAccessError, PackageIntelligenceFeatureFlagRequiredError, PackageIntelligenceNetworkError, PackageIntelligenceBackendError, PackageIntelligenceGraphQLError, PackageIntelligenceTargetNotFoundError, PackageIntelligenceValidationError, PackageIntelligenceVersionNotFoundError, MalformedPackageIntelligenceResponseError, PackageIntelligenceChangelogSourceNotFoundError, PromptServiceImpl, refreshExpiredToken, NpmRegistryUpdateCheckService, shouldRunUpdateCheck, shouldRunRequiredUpdateEnforcement, formatUpdateNotice, formatRequiredUpdateNotice, loadAutoLoginAuthSessionMetadata, clearAutoLoginAuthSessionMetadata, createAuthCommandDependencies, createAuthStatusDependencies, createContainer };