githits 0.4.4 → 0.4.5

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   version
-} from "./shared/chunk-96tjsv6y.js";
+} from "./shared/chunk-vfyz65v1.js";
 export {
   version
 };

package/dist/shared/{chunk-96tjsv6y.js → chunk-vfyz65v1.js}

@@ -1,6 +1,6 @@
 import { createRequire } from "node:module";
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 // package.json
-var version = "0.4.4";
+var version = "0.4.5";
 
 export { __require, version };

package/dist/shared/{chunk-tfqxat16.js → chunk-ygqss6gp.js}

@@ -1,7 +1,7 @@
 import {
   __require,
   version
-} from "./chunk-96tjsv6y.js";
+} from "./chunk-vfyz65v1.js";
 
 // src/services/app-config-paths.ts
 var APP_DIR = "githits";
@@ -1400,11 +1400,17 @@ class GitHitsServiceImpl {
         method: "POST",
         headers: this.headers(),
         body: JSON.stringify({
+          ...params.exampleId !== undefined && {
+            example_id: params.exampleId
+          },
           ...params.solutionId !== undefined && {
             solution_id: params.solutionId
           },
           accepted: params.accepted,
-          feedback_text: params.feedbackText ?? null
+          feedback_text: params.feedbackText ?? null,
+          ...params.toolName !== undefined && {
+            tool_name: params.toolName
+          }
         })
       });
       if (!response.ok) {
@@ -4167,7 +4173,10 @@ query PackageSummary($registry: Registry!, $name: String!) {
 var packageVersionIdentitySchema = z3.object({
   name: z3.string().nullable().optional(),
   registry: z3.string().nullable().optional(),
-  version: z3.string().nullable().optional()
+  version: z3.string().nullable().optional(),
+  publishedAt: z3.string().nullable().optional(),
+  deprecated: z3.boolean().nullable().optional(),
+  deprecationReason: z3.string().nullable().optional()
 });
 var vulnerabilityDetailSchema = z3.object({
   osvId: z3.string().nullable().optional(),
@@ -4291,6 +4300,86 @@ var dependencyGraphSchema = z3.object({
   nodes: z3.array(dependencyGraphNodeSchema),
   edges: z3.array(dependencyGraphEdgeSchema)
 });
+var vulnerabilityCountSummarySchema = z3.object({
+  totalVulnerabilities: z3.number().int(),
+  critical: z3.number().int(),
+  high: z3.number().int(),
+  medium: z3.number().int(),
+  low: z3.number().int(),
+  unknown: z3.number().int()
+});
+var vulnerabilitySummaryDetailSchema = z3.object({
+  osvId: z3.string().nullable().optional(),
+  registry: z3.string().nullable().optional(),
+  packageName: z3.string().nullable().optional(),
+  summary: z3.string().nullable().optional(),
+  severityScore: z3.number().nullable().optional(),
+  severityType: z3.string().nullable().optional(),
+  affectedVersionRanges: z3.array(z3.string()).nullable().optional(),
+  fixedInVersions: z3.array(z3.string()).nullable().optional(),
+  publishedAt: z3.string().nullable().optional(),
+  modifiedAt: z3.string().nullable().optional(),
+  withdrawnAt: z3.string().nullable().optional(),
+  aliases: z3.array(z3.string()).nullable().optional(),
+  isMalicious: z3.boolean().nullable().optional()
+});
+var transitiveDependencyVulnerabilitySchema = z3.object({
+  version: z3.string(),
+  affectsResolvedVersion: z3.boolean(),
+  matchedAffectedVersionRanges: z3.array(z3.string()),
+  fixVersionsAboveResolved: z3.array(z3.string()),
+  nearestFixedVersion: z3.string().nullable().optional(),
+  advisory: vulnerabilitySummaryDetailSchema
+});
+var transitiveVulnerablePackageSchema = z3.object({
+  registry: z3.string(),
+  name: z3.string(),
+  versions: z3.array(z3.string()),
+  affectedCount: z3.number().int(),
+  nonAffectingCount: z3.number().int(),
+  totalCount: z3.number().int(),
+  maxSeverityScore: z3.number().nullable().optional(),
+  maxSeverityLabel: z3.string().nullable().optional(),
+  advisoryIds: z3.array(z3.string()),
+  mostCritical: vulnerabilitySummaryDetailSchema.nullable().optional(),
+  advisoryOccurrences: z3.array(transitiveDependencyVulnerabilitySchema).nullable().optional()
+});
+var transitiveVulnerabilitySummarySchema = z3.object({
+  affected: vulnerabilityCountSummarySchema,
+  nonAffecting: vulnerabilityCountSummarySchema,
+  combined: vulnerabilityCountSummarySchema,
+  totalPackagesAnalyzed: z3.number().int(),
+  affectedPackageCount: z3.number().int(),
+  packages: z3.array(transitiveVulnerablePackageSchema),
+  calculatedAt: z3.string().nullable().optional()
+}).nullable().optional();
+var dependencyDeprecationReasonSchema = z3.object({
+  version: z3.string(),
+  reason: z3.string().nullable().optional()
+});
+var deprecatedDependencySchema = z3.object({
+  registry: z3.string(),
+  name: z3.string(),
+  versions: z3.array(z3.string()),
+  reasons: z3.array(dependencyDeprecationReasonSchema)
+});
+var outdatedDependencyVersionSchema = z3.object({
+  version: z3.string(),
+  severity: z3.string()
+});
+var outdatedDependencySchema = z3.object({
+  registry: z3.string(),
+  name: z3.string(),
+  latestVersion: z3.string().nullable().optional(),
+  severity: z3.string(),
+  versions: z3.array(outdatedDependencyVersionSchema),
+  repositoryUrl: z3.string().nullable().optional()
+});
+var duplicateDependencySchema = z3.object({
+  registry: z3.string().nullable().optional(),
+  name: z3.string(),
+  versions: z3.array(z3.string())
+});
 var dependencyConflictEdgeSchema = z3.object({
   fromIndex: z3.number().int().nullable().optional(),
   toIndex: z3.number().int(),
@@ -4302,6 +4391,24 @@ var dependencyConflictSchema = z3.object({
   requiredVersions: z3.array(z3.string()),
   conflictingEdges: z3.array(dependencyConflictEdgeSchema)
 });
+var dependencyIssueConflictSchema = z3.object({
+  registry: z3.string().nullable().optional(),
+  name: z3.string(),
+  versions: z3.array(z3.string()),
+  requiredVersions: z3.array(z3.string()),
+  conflictingEdges: z3.array(dependencyConflictEdgeSchema)
+});
+var dependencyIssuesSummarySchema = z3.object({
+  totalCount: z3.number().int(),
+  deprecatedCount: z3.number().int(),
+  outdatedCount: z3.number().int(),
+  duplicateCount: z3.number().int(),
+  conflictCount: z3.number().int(),
+  deprecatedPackages: z3.array(deprecatedDependencySchema),
+  outdatedPackages: z3.array(outdatedDependencySchema),
+  duplicatePackages: z3.array(duplicateDependencySchema),
+  conflicts: z3.array(dependencyIssueConflictSchema)
+}).nullable().optional();
 var circularDependencyCycleSchema = z3.object({
   cycleStart: z3.string(),
   circularPath: z3.array(z3.string()),
@@ -4318,7 +4425,9 @@ var transitiveDependencySchema = z3.object({
   uniqueDependencies: z3.array(z3.string()).nullable().optional(),
   dependencyConflicts: z3.array(dependencyConflictSchema).nullable().optional(),
   circularDependencyCycles: z3.array(circularDependencyCycleSchema).nullable().optional(),
-  dependencyGraph: dependencyGraphSchema.nullable().optional()
+  dependencyGraph: dependencyGraphSchema.nullable().optional(),
+  vulnerabilitySummary: transitiveVulnerabilitySummarySchema,
+  dependencyIssues: dependencyIssuesSummarySchema
 }).nullable().optional();
 var dependencyBundleSchema = z3.object({
   direct: z3.array(directDependencySchema).nullable().optional(),
@@ -4448,6 +4557,203 @@ query PackageDependencies(
     }
   }
 }`;
+var PACKAGE_UPGRADE_DEPENDENCY_PROBE_QUERY = `
+query PackageUpgradeDependencyProbe(
+  $registry: Registry!
+  $name: String!
+  $version: String!
+  $includeTransitiveRisk: Boolean!
+  $includeTransitiveSecurity: Boolean!
+  $includeDependencyIssues: Boolean!
+  $includeDependencyChanges: Boolean!
+  $includeGroups: Boolean!
+  $lifecycle: [String!]
+  $minSeverity: Float
+) {
+  packageDependencies(
+    registry: $registry
+    name: $name
+    version: $version
+    includeTransitive: $includeTransitiveRisk
+    lifecycle: $lifecycle
+  ) {
+    package {
+      name
+      registry
+      version
+      publishedAt
+      deprecated
+      deprecationReason
+    }
+    dependencies {
+      direct {
+        name
+        versionConstraint
+        type
+      }
+      transitive @include(if: $includeTransitiveRisk) {
+        dependencyGraph @include(if: $includeDependencyChanges) {
+          formatVersion
+          nodes {
+            registry
+            name
+            version
+          }
+          edges {
+            fromIndex
+            toIndex
+            constraint
+            dependencyType
+          }
+        }
+        vulnerabilitySummary(minSeverity: $minSeverity) @include(if: $includeTransitiveSecurity) {
+          affected {
+            totalVulnerabilities
+            critical
+            high
+            medium
+            low
+            unknown
+          }
+          nonAffecting {
+            totalVulnerabilities
+            critical
+            high
+            medium
+            low
+            unknown
+          }
+          combined {
+            totalVulnerabilities
+            critical
+            high
+            medium
+            low
+            unknown
+          }
+          totalPackagesAnalyzed
+          affectedPackageCount
+          calculatedAt
+          packages {
+            registry
+            name
+            versions
+            affectedCount
+            nonAffectingCount
+            totalCount
+            maxSeverityScore
+            maxSeverityLabel
+            advisoryIds(scope: AFFECTED)
+            mostCritical {
+              osvId
+              registry
+              packageName
+              summary
+              severityScore
+              severityType
+              affectedVersionRanges
+              fixedInVersions
+              publishedAt
+              modifiedAt
+              withdrawnAt
+              aliases
+              isMalicious
+            }
+            advisoryOccurrences(scope: AFFECTED, minSeverity: $minSeverity, limit: 5) {
+              version
+              affectsResolvedVersion
+              matchedAffectedVersionRanges
+              fixVersionsAboveResolved
+              nearestFixedVersion
+              advisory {
+                osvId
+                registry
+                packageName
+                summary
+                severityScore
+                severityType
+                affectedVersionRanges
+                fixedInVersions
+                publishedAt
+                modifiedAt
+                withdrawnAt
+                aliases
+                isMalicious
+              }
+            }
+          }
+        }
+        dependencyIssues @include(if: $includeDependencyIssues) {
+          totalCount
+          deprecatedCount
+          outdatedCount
+          duplicateCount
+          conflictCount
+          deprecatedPackages {
+            registry
+            name
+            versions
+            reasons {
+              version
+              reason
+            }
+          }
+          outdatedPackages {
+            registry
+            name
+            latestVersion
+            severity
+            versions {
+              version
+              severity
+            }
+            repositoryUrl
+          }
+          duplicatePackages {
+            registry
+            name
+            versions
+          }
+          conflicts {
+            registry
+            name
+            versions
+            requiredVersions
+            conflictingEdges {
+              fromIndex
+              toIndex
+              versionConstraint
+              dependencyType
+            }
+          }
+        }
+      }
+    }
+    dependencyGroups @include(if: $includeGroups) {
+      primaryGroup
+      environmentMarkers {
+        type
+        value
+        raw
+      }
+      groups {
+        name
+        lifecycle
+        conditionType
+        conditionValue
+        selectionMode
+        exclusiveGroup
+        fallbackPriority
+        compatibleWith
+        defaultEnabled
+        dependencies {
+          name
+          constraint
+        }
+      }
+    }
+  }
+}`;
 var changelogPackageInfoSchema = z3.object({
   name: z3.string().nullable().optional(),
   registry: z3.string().nullable().optional(),
@@ -4915,7 +5221,10 @@ class PackageIntelligenceServiceImpl {
     const identity = {
       name,
       version: version2,
-      registry: data.package?.registry ?? undefined
+      registry: data.package?.registry ?? undefined,
+      publishedAt: data.package?.publishedAt ?? undefined,
+      deprecated: data.package?.deprecated ?? undefined,
+      deprecationReason: data.package?.deprecationReason ?? undefined
     };
     const security = data.security ? {
       affectedVulnerabilityCount: data.security.affectedVulnerabilityCount,
@@ -4955,6 +5264,58 @@ class PackageIntelligenceServiceImpl {
       executeWithToken: (token) => this.executePackageDependencies(token, params)
     }));
   }
+  async packageUpgradeDependencyProbe(params) {
+    return withTelemetrySpan("pkg-intel.upgrade-dependency-probe.request", () => executeWithTokenRefresh({
+      getToken: () => this.tokenProvider.getToken(),
+      forceRefresh: () => this.tokenProvider.forceRefresh(),
+      shouldRefresh: (error) => error instanceof AuthenticationError,
+      executeWithToken: (token) => this.executePackageUpgradeDependencyProbe(token, params)
+    }));
+  }
+  async executePackageUpgradeDependencyProbe(token, params) {
+    const includeTransitiveRisk = params.includeTransitiveSecurity === true || params.includeDependencyIssues === true || params.includeDependencyChanges === true;
+    let response;
+    try {
+      response = await postPkgseerGraphql({
+        endpointUrl: this.endpointUrl,
+        token,
+        query: PACKAGE_UPGRADE_DEPENDENCY_PROBE_QUERY,
+        variables: {
+          registry: params.registry,
+          name: params.packageName,
+          version: params.version,
+          includeTransitiveRisk,
+          includeTransitiveSecurity: params.includeTransitiveSecurity === true,
+          includeDependencyIssues: params.includeDependencyIssues === true,
+          includeDependencyChanges: params.includeDependencyChanges === true,
+          includeGroups: params.includeGroups === true,
+          lifecycle: params.includeGroups === true ? ["peer"] : undefined,
+          minSeverity: params.minSeverity
+        },
+        fetchFn: this.fetchFn
+      });
+    } catch (cause) {
+      if (cause instanceof PkgseerTransportError) {
+        throw new PackageIntelligenceNetworkError("Could not reach the package intelligence service. Check your connection or set GITHITS_CODE_NAV_URL.", { cause });
+      }
+      throw cause;
+    }
+    if (response.status < 200 || response.status >= 300) {
+      throw this.createHttpError(response);
+    }
+    const parsed = dependenciesGraphQLResponseSchema.safeParse(response.parsedBody);
+    if (!parsed.success) {
+      throw new MalformedPackageIntelligenceResponseError("Malformed response from the package-intelligence service.");
+    }
+    if (parsed.data.errors && parsed.data.errors.length > 0) {
+      throw promoteGenericVersionNotFound(this.createGraphQLError(parsed.data.errors), params);
+    }
+    const data = parsed.data.data?.packageDependencies;
+    if (!data) {
+      throw new MalformedPackageIntelligenceResponseError("Empty response from the package-intelligence service.");
+    }
+    return this.normaliseDependencyReport(data);
+  }
   async executePackageDependencies(token, params) {
     let response;
     try {
@@ -5003,7 +5364,10 @@ class PackageIntelligenceServiceImpl {
     const identity = {
       name,
       version: version2,
-      registry: data.package?.registry ?? undefined
+      registry: data.package?.registry ?? undefined,
+      publishedAt: data.package?.publishedAt ?? undefined,
+      deprecated: data.package?.deprecated ?? undefined,
+      deprecationReason: data.package?.deprecationReason ?? undefined
     };
     const bundle = data.dependencies;
     const dependencies = bundle ? {
@@ -5049,7 +5413,9 @@ class PackageIntelligenceServiceImpl {
             constraint: e.constraint ?? undefined,
             dependencyType: e.dependencyType ?? undefined
           }))
-        } : undefined
+        } : undefined,
+        vulnerabilitySummary: this.normaliseTransitiveVulnerabilitySummary(bundle.transitive.vulnerabilitySummary),
+        dependencyIssues: this.normaliseDependencyIssuesSummary(bundle.transitive.dependencyIssues)
       } : undefined
     } : undefined;
     const dependencyGroups = data.dependencyGroups ? {
@@ -5081,6 +5447,103 @@ class PackageIntelligenceServiceImpl {
       dependencyGroups
     };
   }
+  normaliseTransitiveVulnerabilitySummary(summary) {
+    if (!summary)
+      return;
+    return {
+      affected: summary.affected,
+      nonAffecting: summary.nonAffecting,
+      combined: summary.combined,
+      totalPackagesAnalyzed: summary.totalPackagesAnalyzed,
+      affectedPackageCount: summary.affectedPackageCount,
+      calculatedAt: summary.calculatedAt ?? undefined,
+      packages: summary.packages.map((pkg) => ({
+        registry: pkg.registry,
+        name: pkg.name,
+        versions: pkg.versions,
+        affectedCount: pkg.affectedCount,
+        nonAffectingCount: pkg.nonAffectingCount,
+        totalCount: pkg.totalCount,
+        maxSeverityScore: pkg.maxSeverityScore ?? undefined,
+        maxSeverityLabel: pkg.maxSeverityLabel ?? undefined,
+        advisoryIds: pkg.advisoryIds,
+        mostCritical: pkg.mostCritical ? this.normaliseVulnerabilitySummaryDetail(pkg.mostCritical) : undefined,
+        advisoryOccurrences: pkg.advisoryOccurrences?.map((occurrence) => ({
+          version: occurrence.version,
+          affectsResolvedVersion: occurrence.affectsResolvedVersion,
+          matchedAffectedVersionRanges: occurrence.matchedAffectedVersionRanges,
+          fixVersionsAboveResolved: occurrence.fixVersionsAboveResolved,
+          nearestFixedVersion: occurrence.nearestFixedVersion ?? undefined,
+          advisory: this.normaliseVulnerabilitySummaryDetail(occurrence.advisory)
+        })) ?? undefined
+      }))
+    };
+  }
+  normaliseVulnerabilitySummaryDetail(advisory) {
+    return {
+      osvId: advisory.osvId ?? undefined,
+      registry: advisory.registry ?? undefined,
+      packageName: advisory.packageName ?? undefined,
+      summary: advisory.summary ?? undefined,
+      severityScore: advisory.severityScore ?? undefined,
+      severityType: advisory.severityType ?? undefined,
+      affectedVersionRanges: advisory.affectedVersionRanges ?? undefined,
+      fixedInVersions: advisory.fixedInVersions ?? undefined,
+      publishedAt: advisory.publishedAt ?? undefined,
+      modifiedAt: advisory.modifiedAt ?? undefined,
+      withdrawnAt: advisory.withdrawnAt ?? undefined,
+      aliases: advisory.aliases ?? undefined,
+      isMalicious: advisory.isMalicious ?? undefined
+    };
+  }
+  normaliseDependencyIssuesSummary(issues) {
+    if (!issues)
+      return;
+    return {
+      totalCount: issues.totalCount,
+      deprecatedCount: issues.deprecatedCount,
+      outdatedCount: issues.outdatedCount,
+      duplicateCount: issues.duplicateCount,
+      conflictCount: issues.conflictCount,
+      deprecatedPackages: issues.deprecatedPackages.map((pkg) => ({
+        registry: pkg.registry,
+        name: pkg.name,
+        versions: pkg.versions,
+        reasons: pkg.reasons.map((reason) => ({
+          version: reason.version,
+          reason: reason.reason ?? undefined
+        }))
+      })),
+      outdatedPackages: issues.outdatedPackages.map((pkg) => ({
+        registry: pkg.registry,
+        name: pkg.name,
+        latestVersion: pkg.latestVersion ?? undefined,
+        severity: pkg.severity,
+        versions: pkg.versions.map((version2) => ({
+          version: version2.version,
+          severity: version2.severity
+        })),
+        repositoryUrl: pkg.repositoryUrl ?? undefined
+      })),
+      duplicatePackages: issues.duplicatePackages.map((pkg) => ({
+        registry: pkg.registry ?? undefined,
+        name: pkg.name,
+        versions: pkg.versions
+      })),
+      conflicts: issues.conflicts.map((conflict) => ({
+        registry: conflict.registry ?? undefined,
+        name: conflict.name,
+        versions: conflict.versions,
+        requiredVersions: conflict.requiredVersions,
+        conflictingEdges: conflict.conflictingEdges.map((edge) => ({
+          fromIndex: edge.fromIndex ?? undefined,
+          toIndex: edge.toIndex,
+          versionConstraint: edge.versionConstraint,
+          dependencyType: edge.dependencyType
+        }))
+      }))
+    };
+  }
   async packageChangelog(params) {
     return withTelemetrySpan("pkg-intel.changelog.request", () => executeWithTokenRefresh({
       getToken: () => this.tokenProvider.getToken(),

package/dist/shared/{chunk-k35egwwf.js → chunk-zzmbjttb.js}

@@ -4,8 +4,8 @@ import {
   createAuthStatusDependencies,
   createContainer,
   loadAutoLoginAuthSessionMetadata
-} from "./chunk-tfqxat16.js";
-import"./chunk-96tjsv6y.js";
+} from "./chunk-ygqss6gp.js";
+import"./chunk-vfyz65v1.js";
 export {
   loadAutoLoginAuthSessionMetadata,
   createContainer,

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "githits",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "description": "Code examples from global open source for developers and AI assistants.",
   "mcpServers": {
     "githits": {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "githits",
   "description": "CLI companion for GitHits - code examples from global open source for developers and AI assistants",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "type": "module",
   "files": [
     "dist",
@@ -38,6 +38,8 @@
     "audit:pkg-ecosystems": "bun run scripts/pkg-ecosystem-audit.ts",
     "agent:e2e": "bun run scripts/agent-eval.ts",
     "agent:e2e:report": "bun run scripts/agent-eval-report.ts",
+    "agent:session": "bun run scripts/agent-session.ts",
+    "eval": "bun run eval/run.ts",
     "test": "bun test",
     "typecheck": "tsc",
     "format": "biome format --write .",

package/plugins/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "githits",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "description": "Code examples from global open source for developers and AI assistants",
   "author": {
     "name": "GitHits"

package/plugins/claude/commands/example.md

@@ -21,4 +21,5 @@ Optional parameters:
   licenses), or `"custom"` (user's blocklist).
 
 Present the results clearly. After the user has reviewed the result, use the
-`feedback` tool to report whether the example was helpful.
+`feedback` tool to report whether the example was helpful. Use the returned
+`solution_id` when available.

package/plugins/claude/commands/help.md

@@ -31,7 +31,7 @@ This plugin connects to the GitHits MCP server and always exposes these core too
   language. Requires `query`; `language` is optional and inferred when omitted.
 - **search_language** — Look up supported programming language names when you
   need to force a specific language.
-- **feedback** — Rate a search result to improve future quality.
+- **feedback** — Submit result or session feedback to improve future quality.
 
 Additional indexed dependency/package tools are available by default:
 `search`, `search_status`, `docs_list`, `docs_read`, `pkg_info`, `pkg_vulns`,

package/plugins/claude/commands/search.md

@@ -23,4 +23,5 @@ Optional parameters:
   licenses), or `"custom"` (user's blocklist).
 
 Present the results clearly. After the user has reviewed the result, use the
-`feedback` tool to report whether the example was helpful.
+`feedback` tool to report whether the result was helpful. Omit `solution_id`
+for generic session feedback about indexed search results.

package/plugins/claude/skills/search/SKILL.md

@@ -3,6 +3,8 @@ name: search
 description:
   Use GitHits MCP tools to find real-world code examples when model knowledge
   is insufficient.
+metadata:
+  internal: true
 ---
 
 Use GitHits when: