lurqrun 0.1.6 → 0.1.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (206) hide show
  1. package/README.md +18 -10
  2. package/dist/auditHandler-JCOJSUYW.js +23 -0
  3. package/dist/bin/lurq.js +3090 -23306
  4. package/dist/browserAuth-B6G27USY.js +95 -0
  5. package/dist/cache-DKI34SVS.js +12 -0
  6. package/dist/check-2FDGUOV7.js +192 -0
  7. package/dist/checkUpgrade-F2WESBPM.js +103 -0
  8. package/dist/chunk-2VMOWSRY.js +300 -0
  9. package/dist/chunk-3GHJR7XR.js +2049 -0
  10. package/dist/chunk-3N3Q3DSW.js +214 -0
  11. package/dist/chunk-4ESO33J6.js +34 -0
  12. package/dist/chunk-4F7ZESPO.js +132 -0
  13. package/dist/chunk-4KCPOMG6.js +68 -0
  14. package/dist/chunk-4ZYCIMY4.js +155 -0
  15. package/dist/chunk-63MUJNZL.js +318 -0
  16. package/dist/chunk-6AAEVQ7I.js +6336 -0
  17. package/dist/chunk-6EQ3ARXA.js +304 -0
  18. package/dist/chunk-6L3U7DZ5.js +23 -0
  19. package/dist/chunk-AHBP533R.js +220 -0
  20. package/dist/chunk-B43LCXBM.js +223 -0
  21. package/dist/chunk-BCANRN5B.js +33 -0
  22. package/dist/chunk-BUALU27S.js +123 -0
  23. package/dist/chunk-BULZAX2U.js +1554 -0
  24. package/dist/chunk-BV32UNLL.js +154 -0
  25. package/dist/chunk-C6GLE626.js +160 -0
  26. package/dist/chunk-CIDWNUAP.js +145 -0
  27. package/dist/chunk-CUP36ND3.js +2126 -0
  28. package/dist/chunk-CW5HJ3LX.js +96 -0
  29. package/dist/chunk-DB2VF5UD.js +315 -0
  30. package/dist/chunk-DWAGCNEL.js +210 -0
  31. package/dist/chunk-EA3DP5HG.js +293 -0
  32. package/dist/chunk-ELGCAM7P.js +184 -0
  33. package/dist/chunk-FW6BD2NO.js +1915 -0
  34. package/dist/chunk-GE37NVLN.js +15 -0
  35. package/dist/chunk-GPTKSNR6.js +171 -0
  36. package/dist/chunk-GRJXQBQZ.js +793 -0
  37. package/dist/chunk-HWBBVLOT.js +92 -0
  38. package/dist/chunk-I2JUKN6Z.js +24 -0
  39. package/dist/chunk-I3M2KJXB.js +56 -0
  40. package/dist/chunk-IQ4SDKKY.js +733 -0
  41. package/dist/chunk-J5FZYN4A.js +116 -0
  42. package/dist/chunk-L6N4JFW2.js +263 -0
  43. package/dist/chunk-LBFGSSF2.js +126 -0
  44. package/dist/chunk-LEGPB7DO.js +81 -0
  45. package/dist/chunk-LO35HLQZ.js +219 -0
  46. package/dist/chunk-LRD4GBYE.js +73 -0
  47. package/dist/chunk-LUAKDHLZ.js +40 -0
  48. package/dist/chunk-LYMPYETA.js +965 -0
  49. package/dist/chunk-M6NYEXCW.js +38 -0
  50. package/dist/chunk-MHUEVBVO.js +35 -0
  51. package/dist/chunk-MYGSLK44.js +37 -0
  52. package/dist/chunk-NH5I4KHH.js +201 -0
  53. package/dist/chunk-OQS4GUSI.js +1391 -0
  54. package/dist/chunk-PSX3GIAN.js +176 -0
  55. package/dist/chunk-Q5VPF4WI.js +26 -0
  56. package/dist/chunk-QKGYDMWB.js +7409 -0
  57. package/dist/chunk-QSL6QN5X.js +115 -0
  58. package/dist/chunk-SHCEBP3J.js +107 -0
  59. package/dist/chunk-SJOVFF7B.js +201 -0
  60. package/dist/chunk-ST2X2GYN.js +373 -0
  61. package/dist/chunk-TNTXWSYA.js +19 -0
  62. package/dist/chunk-U5AT3TD4.js +2128 -0
  63. package/dist/chunk-UDVNA7EA.js +483 -0
  64. package/dist/chunk-VL2E5T2A.js +109 -0
  65. package/dist/chunk-VLRHFMGJ.js +58 -0
  66. package/dist/chunk-WHX2ZFCG.js +4048 -0
  67. package/dist/chunk-WQ23REYT.js +37 -0
  68. package/dist/chunk-XBIDMHSK.js +15425 -0
  69. package/dist/chunk-Y5GI7RL3.js +66 -0
  70. package/dist/client-IRKAMDYZ.js +15 -0
  71. package/dist/commands-FIL5ET6P.js +911 -0
  72. package/dist/compat-R3UTFQ5Q.js +201 -0
  73. package/dist/dashboardIssue-WYYMBFIB.js +192 -0
  74. package/dist/diff-GZA2774U.js +13 -0
  75. package/dist/dist-4XXIXHHZ.js +12945 -0
  76. package/dist/e2b-FVPHDULZ.js +172 -0
  77. package/dist/extract-NKGKLIVT.js +444 -0
  78. package/dist/fetch-QYTUJVG2.js +22 -0
  79. package/dist/firstTouch-QQTJH4QX.js +55 -0
  80. package/dist/handlers-GEJAVZDK.js +53 -0
  81. package/dist/http-ETPYMBGD.js +5360 -0
  82. package/dist/ingestQueue-VKN4KBIF.js +35 -0
  83. package/dist/install-EK3W2COX.js +20 -0
  84. package/dist/installSkill-VQJWJVCL.js +52 -0
  85. package/dist/inventory-5AWSLJYU.js +31 -0
  86. package/dist/local-XPZMRH5R.js +13 -0
  87. package/dist/mcp-3JHD5SUZ.js +472 -0
  88. package/dist/mcpHandlers-QFN4MCFL.js +22 -0
  89. package/dist/mcpScan-QZHWENIP.js +1871 -0
  90. package/dist/mcpScanWorkflow-JPYCBGC4.js +81 -0
  91. package/dist/mcpStack-BYJCZNIV.js +20 -0
  92. package/dist/packages-THVFMWFP.js +42 -0
  93. package/dist/plan-V4OEI3J4.js +463 -0
  94. package/dist/planView-JRXGCG2N.js +79 -0
  95. package/dist/policy-3P6BGRDN.js +115 -0
  96. package/dist/references-6N7VEPHT.js +14 -0
  97. package/dist/release-4U4ABNSJ.js +128 -0
  98. package/dist/remote-YGCXYI4V.js +32 -0
  99. package/dist/reportRuns-CKQQYLY4.js +64 -0
  100. package/dist/sandbox-MEZLAODF.js +39 -0
  101. package/dist/server-KFUD5X57.js +55 -0
  102. package/dist/surface-V62GE554.js +141 -0
  103. package/dist/surface-YL6O67W3.js +36 -0
  104. package/dist/surfaceHandlers-X2IZKA3E.js +20 -0
  105. package/dist/typecheck-X7U5ELMR.js +268 -0
  106. package/dist/types-M5JP2W3D.js +10 -0
  107. package/dist/uninstall-P7RGBX6G.js +174 -0
  108. package/dist/upgrade-NQ5IWFZB.js +596 -0
  109. package/dist/upgradePlan-A4LRKLEG.js +146 -0
  110. package/dist/userConfig-Z3GQE776.js +20 -0
  111. package/dist/watch-DGFMWUDL.js +214 -0
  112. package/package.json +26 -21
  113. package/templates/agent-rules.md +4 -4
  114. package/templates/skill-instructions.md +13 -14
  115. package/dist/bin/lurq.js.map +0 -1
  116. package/dist/index.d.ts +0 -805
  117. package/dist/index.js +0 -23570
  118. package/dist/index.js.map +0 -1
  119. package/drizzle/0000_confused_fabian_cortez.sql +0 -54
  120. package/drizzle/0001_aspiring_timeslip.sql +0 -15
  121. package/drizzle/0002_lyrical_lila_cheney.sql +0 -14
  122. package/drizzle/0003_violet_giant_girl.sql +0 -14
  123. package/drizzle/0004_slim_valeria_richards.sql +0 -15
  124. package/drizzle/0005_petite_luke_cage.sql +0 -12
  125. package/drizzle/0006_calm_nighthawk.sql +0 -3
  126. package/drizzle/0007_slimy_naoko.sql +0 -1
  127. package/drizzle/0008_peaceful_tigra.sql +0 -1
  128. package/drizzle/0009_smooth_harrier.sql +0 -10
  129. package/drizzle/0010_curved_amphibian.sql +0 -2
  130. package/drizzle/0011_compat_provenance_closures.sql +0 -11
  131. package/drizzle/0012_api_surfaces.sql +0 -9
  132. package/drizzle/0013_nice_thanos.sql +0 -1
  133. package/drizzle/0014_luxuriant_malcolm_colcord.sql +0 -10
  134. package/drizzle/0015_past_fat_cobra.sql +0 -11
  135. package/drizzle/0016_futuristic_junta.sql +0 -50
  136. package/drizzle/0017_absent_grandmaster.sql +0 -20
  137. package/drizzle/0018_rainy_proemial_gods.sql +0 -1
  138. package/drizzle/0019_dashing_korvac.sql +0 -11
  139. package/drizzle/0020_normal_vulture.sql +0 -3
  140. package/drizzle/0021_dazzling_blue_shield.sql +0 -17
  141. package/drizzle/0022_massive_ghost_rider.sql +0 -24
  142. package/drizzle/0023_next_shatterstar.sql +0 -1
  143. package/drizzle/0024_dusty_maelstrom.sql +0 -15
  144. package/drizzle/0025_gifted_harpoon.sql +0 -5
  145. package/drizzle/0026_awesome_mordo.sql +0 -1
  146. package/drizzle/0027_charming_ulik.sql +0 -2
  147. package/drizzle/0028_romantic_loners.sql +0 -2
  148. package/drizzle/0029_busy_korvac.sql +0 -16
  149. package/drizzle/0030_steady_mathemanic.sql +0 -6
  150. package/drizzle/0031_redundant_maginty.sql +0 -2
  151. package/drizzle/0032_stack_resolutions.sql +0 -14
  152. package/drizzle/0033_graceful_tyger_tiger.sql +0 -3
  153. package/drizzle/0034_uneven_thunderbird.sql +0 -1
  154. package/drizzle/0035_api_key_scopes.sql +0 -1
  155. package/drizzle/0036_policy_audit.sql +0 -21
  156. package/drizzle/0037_subscription_seats.sql +0 -1
  157. package/drizzle/0038_symbol_offsets.sql +0 -2
  158. package/drizzle/0039_mcp_runtime_scans.sql +0 -80
  159. package/drizzle/0040_subscription_overage_and_interval.sql +0 -4
  160. package/drizzle/0041_account_email.sql +0 -38
  161. package/drizzle/0042_alert_channels.sql +0 -21
  162. package/drizzle/meta/0000_snapshot.json +0 -370
  163. package/drizzle/meta/0001_snapshot.json +0 -482
  164. package/drizzle/meta/0002_snapshot.json +0 -575
  165. package/drizzle/meta/0003_snapshot.json +0 -667
  166. package/drizzle/meta/0004_snapshot.json +0 -769
  167. package/drizzle/meta/0005_snapshot.json +0 -864
  168. package/drizzle/meta/0006_snapshot.json +0 -882
  169. package/drizzle/meta/0007_snapshot.json +0 -876
  170. package/drizzle/meta/0008_snapshot.json +0 -882
  171. package/drizzle/meta/0009_snapshot.json +0 -948
  172. package/drizzle/meta/0010_snapshot.json +0 -969
  173. package/drizzle/meta/0011_snapshot.json +0 -1049
  174. package/drizzle/meta/0012_snapshot.json +0 -1115
  175. package/drizzle/meta/0013_snapshot.json +0 -1121
  176. package/drizzle/meta/0014_snapshot.json +0 -1190
  177. package/drizzle/meta/0015_snapshot.json +0 -1280
  178. package/drizzle/meta/0016_snapshot.json +0 -1683
  179. package/drizzle/meta/0017_snapshot.json +0 -1834
  180. package/drizzle/meta/0018_snapshot.json +0 -1834
  181. package/drizzle/meta/0019_snapshot.json +0 -1909
  182. package/drizzle/meta/0020_snapshot.json +0 -1921
  183. package/drizzle/meta/0021_snapshot.json +0 -2045
  184. package/drizzle/meta/0022_snapshot.json +0 -2246
  185. package/drizzle/meta/0023_snapshot.json +0 -2252
  186. package/drizzle/meta/0024_snapshot.json +0 -2375
  187. package/drizzle/meta/0025_snapshot.json +0 -2407
  188. package/drizzle/meta/0026_snapshot.json +0 -2413
  189. package/drizzle/meta/0027_snapshot.json +0 -2425
  190. package/drizzle/meta/0028_snapshot.json +0 -2438
  191. package/drizzle/meta/0029_snapshot.json +0 -2546
  192. package/drizzle/meta/0030_snapshot.json +0 -2586
  193. package/drizzle/meta/0031_snapshot.json +0 -2598
  194. package/drizzle/meta/0032_snapshot.json +0 -2699
  195. package/drizzle/meta/0033_snapshot.json +0 -2712
  196. package/drizzle/meta/0034_snapshot.json +0 -2719
  197. package/drizzle/meta/0035_snapshot.json +0 -2726
  198. package/drizzle/meta/0036_snapshot.json +0 -2876
  199. package/drizzle/meta/0037_snapshot.json +0 -2883
  200. package/drizzle/meta/0038_snapshot.json +0 -2895
  201. package/drizzle/meta/0039_snapshot.json +0 -3501
  202. package/drizzle/meta/0040_snapshot.json +0 -3527
  203. package/drizzle/meta/0041_snapshot.json +0 -3824
  204. package/drizzle/meta/0042_snapshot.json +0 -3960
  205. package/drizzle/meta/_journal.json +0 -307
  206. package/src/data/seed.json +0 -253
@@ -0,0 +1,35 @@
1
+ import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
2
+ import {
3
+ drainIngestQueue,
4
+ enqueueIngest,
5
+ ingestQueueDepth,
6
+ resetIngestQueue,
7
+ runIngest
8
+ } from "./chunk-FW6BD2NO.js";
9
+ import "./chunk-BUALU27S.js";
10
+ import "./chunk-LRD4GBYE.js";
11
+ import "./chunk-BCANRN5B.js";
12
+ import "./chunk-2VMOWSRY.js";
13
+ import "./chunk-4ESO33J6.js";
14
+ import "./chunk-CW5HJ3LX.js";
15
+ import "./chunk-AHBP533R.js";
16
+ import "./chunk-SJOVFF7B.js";
17
+ import "./chunk-HWBBVLOT.js";
18
+ import "./chunk-NH5I4KHH.js";
19
+ import "./chunk-VLRHFMGJ.js";
20
+ import "./chunk-WQ23REYT.js";
21
+ import "./chunk-LYMPYETA.js";
22
+ import "./chunk-3GHJR7XR.js";
23
+ import "./chunk-GRJXQBQZ.js";
24
+ import "./chunk-WHX2ZFCG.js";
25
+ import "./chunk-LUAKDHLZ.js";
26
+ import "./chunk-MYGSLK44.js";
27
+ import "./chunk-GPTKSNR6.js";
28
+ import "./chunk-I3M2KJXB.js";
29
+ export {
30
+ drainIngestQueue,
31
+ enqueueIngest,
32
+ ingestQueueDepth,
33
+ resetIngestQueue,
34
+ runIngest
35
+ };
@@ -0,0 +1,20 @@
1
+ import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
2
+ import {
3
+ runSetup,
4
+ runningFromNpx,
5
+ withSetupOnMissingKey
6
+ } from "./chunk-EA3DP5HG.js";
7
+ import "./chunk-4ZYCIMY4.js";
8
+ import "./chunk-TNTXWSYA.js";
9
+ import "./chunk-4KCPOMG6.js";
10
+ import "./chunk-UDVNA7EA.js";
11
+ import "./chunk-LUAKDHLZ.js";
12
+ import "./chunk-MYGSLK44.js";
13
+ import "./chunk-Y5GI7RL3.js";
14
+ import "./chunk-GPTKSNR6.js";
15
+ import "./chunk-I3M2KJXB.js";
16
+ export {
17
+ runSetup,
18
+ runningFromNpx,
19
+ withSetupOnMissingKey
20
+ };
@@ -0,0 +1,52 @@
1
+ import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
2
+ import {
3
+ BLOCK_START,
4
+ SUPPORTED_AGENTS,
5
+ agentSpecs,
6
+ buildRemoteServerEntry,
7
+ buildRemoteTomlBlock,
8
+ buildServerEntry,
9
+ buildSkillFile,
10
+ buildTomlBlock,
11
+ installAgent,
12
+ installInstructions,
13
+ installInstructionsFile,
14
+ lurqInvocation,
15
+ printInstallReport,
16
+ readJsonObject,
17
+ removeMarkedBlock,
18
+ resolveAgents,
19
+ runInstallSkill,
20
+ stripTomlBlock,
21
+ upsertMarkedBlock,
22
+ writeFileAtomic,
23
+ writeJson
24
+ } from "./chunk-UDVNA7EA.js";
25
+ import "./chunk-LUAKDHLZ.js";
26
+ import "./chunk-MYGSLK44.js";
27
+ import "./chunk-Y5GI7RL3.js";
28
+ import "./chunk-GPTKSNR6.js";
29
+ import "./chunk-I3M2KJXB.js";
30
+ export {
31
+ BLOCK_START,
32
+ SUPPORTED_AGENTS,
33
+ agentSpecs,
34
+ buildRemoteServerEntry,
35
+ buildRemoteTomlBlock,
36
+ buildServerEntry,
37
+ buildSkillFile,
38
+ buildTomlBlock,
39
+ installAgent,
40
+ installInstructions,
41
+ installInstructionsFile,
42
+ lurqInvocation,
43
+ printInstallReport,
44
+ readJsonObject,
45
+ removeMarkedBlock,
46
+ resolveAgents,
47
+ runInstallSkill,
48
+ stripTomlBlock,
49
+ upsertMarkedBlock,
50
+ writeFileAtomic,
51
+ writeJson
52
+ };
@@ -0,0 +1,31 @@
1
+ import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
2
+ import {
3
+ MAX_ITEMS,
4
+ MAX_TRANSITIVES,
5
+ attributeTree,
6
+ classifyServer,
7
+ collectInventory,
8
+ expandWorkspaces,
9
+ mcpConfigPaths,
10
+ readLockTree,
11
+ readLockfile,
12
+ serversFromConfig,
13
+ splitSpec,
14
+ workspacePatterns
15
+ } from "./chunk-63MUJNZL.js";
16
+ import "./chunk-QKGYDMWB.js";
17
+ import "./chunk-I3M2KJXB.js";
18
+ export {
19
+ MAX_ITEMS,
20
+ MAX_TRANSITIVES,
21
+ attributeTree,
22
+ classifyServer,
23
+ collectInventory,
24
+ expandWorkspaces,
25
+ mcpConfigPaths,
26
+ readLockTree,
27
+ readLockfile,
28
+ serversFromConfig,
29
+ splitSpec,
30
+ workspacePatterns
31
+ };
@@ -0,0 +1,13 @@
1
+ import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
2
+ import {
3
+ LocalSandbox,
4
+ npmInstallArgs,
5
+ smokeScript
6
+ } from "./chunk-C6GLE626.js";
7
+ import "./chunk-GE37NVLN.js";
8
+ import "./chunk-I3M2KJXB.js";
9
+ export {
10
+ LocalSandbox,
11
+ npmInstallArgs,
12
+ smokeScript
13
+ };
@@ -0,0 +1,472 @@
1
+ import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
2
+ import {
3
+ sniffMissingEnv
4
+ } from "./chunk-U5AT3TD4.js";
5
+ import "./chunk-6AAEVQ7I.js";
6
+ import {
7
+ formatError
8
+ } from "./chunk-MHUEVBVO.js";
9
+ import {
10
+ configRequestLine,
11
+ fetchServerManifest,
12
+ missingConfig
13
+ } from "./chunk-LEGPB7DO.js";
14
+ import {
15
+ MCP_TIER,
16
+ mcpSurface,
17
+ surfaceHash
18
+ } from "./chunk-6EQ3ARXA.js";
19
+ import "./chunk-SHCEBP3J.js";
20
+ import {
21
+ bumpSurfaceAttempt,
22
+ dropSurfaceQueue,
23
+ enqueuePreviousSurface,
24
+ enqueueSurface,
25
+ getPendingSurfaces,
26
+ isExtractionCached,
27
+ mcpSurfaceRef,
28
+ recordObservation,
29
+ storeSurface,
30
+ upsertClaim,
31
+ upsertEntity
32
+ } from "./chunk-LO35HLQZ.js";
33
+ import {
34
+ getSandbox
35
+ } from "./chunk-I2JUKN6Z.js";
36
+ import "./chunk-C6GLE626.js";
37
+ import "./chunk-GE37NVLN.js";
38
+ import {
39
+ getPackageVersions
40
+ } from "./chunk-NH5I4KHH.js";
41
+ import "./chunk-VLRHFMGJ.js";
42
+ import "./chunk-LYMPYETA.js";
43
+ import "./chunk-GRJXQBQZ.js";
44
+ import "./chunk-WHX2ZFCG.js";
45
+ import {
46
+ logger
47
+ } from "./chunk-MYGSLK44.js";
48
+ import "./chunk-GPTKSNR6.js";
49
+ import {
50
+ init_esm_shims
51
+ } from "./chunk-I3M2KJXB.js";
52
+
53
+ // src/pipeline/mcp.ts
54
+ init_esm_shims();
55
+
56
+ // src/graph/oracles/mcpServer.ts
57
+ init_esm_shims();
58
+ var PROTOCOL_VERSION = "2026-07-28";
59
+ var HANDSHAKE_TIMEOUT_MS = 45e3;
60
+ var EVIDENCE_MAX = 800;
61
+ var MAX_PAGES = 50;
62
+ function probeScript(pkg, launchArgs = [], env = {}) {
63
+ return `
64
+ const { spawn } = require('node:child_process');
65
+ const { readFileSync } = require('node:fs');
66
+ const { join, basename } = require('node:path');
67
+
68
+ const PKG = ${JSON.stringify(pkg)};
69
+ const EXTRA_ARGS = ${JSON.stringify(launchArgs)};
70
+ const EXTRA_ENV = ${JSON.stringify(env)};
71
+
72
+ /**
73
+ * Resolve the server's entry point from its installed manifest.
74
+ *
75
+ * The package name is NOT the bin name often enough to matter \u2014
76
+ * @modelcontextprotocol/server-filesystem ships 'mcp-server-filesystem' \u2014 so
77
+ * 'npx <pkg>' misses, and the miss looks exactly like a server that fails to
78
+ * start. Read node_modules directly rather than require.resolve: an "exports"
79
+ * map is allowed to hide ./package.json, and a fresh install always has the
80
+ * flat path.
81
+ */
82
+ function launch() {
83
+ let manifest;
84
+ try {
85
+ manifest = JSON.parse(readFileSync(join(process.cwd(), 'node_modules', PKG, 'package.json'), 'utf8'));
86
+ } catch {
87
+ return { command: 'npx', args: ['--no-install', PKG] };
88
+ }
89
+ let rel = null;
90
+ if (typeof manifest.bin === 'string') rel = manifest.bin;
91
+ else if (manifest.bin && typeof manifest.bin === 'object') {
92
+ const keys = Object.keys(manifest.bin);
93
+ rel = manifest.bin[basename(PKG)] || manifest.bin[keys[0]];
94
+ }
95
+ if (!rel) rel = manifest.main;
96
+ if (!rel) return { command: 'npx', args: ['--no-install', PKG] };
97
+ return { command: process.execPath, args: [join(process.cwd(), 'node_modules', PKG, rel)] };
98
+ }
99
+
100
+ const { command, args } = launch();
101
+ // Extra arguments go AFTER the resolved entry point. A large share of servers
102
+ // ship a multi-command CLI where MCP is one verb, so launching the bin bare
103
+ // prints a help banner and exits \u2014 which is indistinguishable from a server
104
+ // that cannot start unless the verb is supplied.
105
+ // Env is embedded in the script rather than plumbed through the sandbox
106
+ // interface, so both drivers get it with no contract change.
107
+ const child = spawn(command, args.concat(EXTRA_ARGS), {
108
+ stdio: ['pipe', 'pipe', 'pipe'],
109
+ env: Object.assign({}, process.env, EXTRA_ENV),
110
+ });
111
+
112
+ let buf = '', done = false, stderr = '';
113
+ /**
114
+ * Emit the single result line and stop.
115
+ *
116
+ * The write callback is load-bearing. process.exit() abandons whatever has not
117
+ * yet drained from a pipe-backed stdout, and Node's pipe writes are async \u2014 so
118
+ * exiting on the next line silently truncates the payload at the pipe buffer
119
+ * (8 KiB on Linux and macOS). A 13-tool server fits and a 9-tool server with
120
+ * large nested schemas does not, which turned "this server documents its inputs
121
+ * thoroughly" into "this server is unreachable": the truncated JSON fails to
122
+ * parse and the caller records verified_false about a server that answered
123
+ * perfectly. Exit only once the bytes are actually gone.
124
+ */
125
+ const out = (o) => {
126
+ if (done) return;
127
+ done = true;
128
+ try { child.kill('SIGKILL'); } catch {}
129
+ process.stdout.write(JSON.stringify(o) + '\\n', () => process.exit(0));
130
+ };
131
+ const timer = setTimeout(() => out({ ok: false, stage: 'initialize', error: 'timeout awaiting handshake' }), ${HANDSHAKE_TIMEOUT_MS - 5e3});
132
+ const send = (msg) => { try { child.stdin.write(JSON.stringify(msg) + '\\n'); } catch (e) { out({ ok: false, stage: 'spawn', error: 'stdin closed: ' + String(e && e.message || e) }); } };
133
+
134
+ let serverInfo, protocolVersion;
135
+ let tools = [], pages = 0, nextId = 2;
136
+
137
+ // Pull every page. A single unpaginated read is the difference between "this
138
+ // server exposes 12 tools" and "this server exposes the first 12 of 40" \u2014 and
139
+ // the second, diffed against a full read, reports 28 tools as removed.
140
+ const listTools = (cursor) => send({
141
+ jsonrpc: '2.0', id: nextId, method: 'tools/list',
142
+ params: cursor ? { cursor: cursor } : {},
143
+ });
144
+
145
+ child.on('error', (e) => out({ ok: false, stage: 'spawn', error: String(e && e.message || e) }));
146
+ child.stderr.on('data', (d) => { stderr += d.toString().slice(0, 2000); });
147
+
148
+ child.stdout.on('data', (d) => {
149
+ buf += d.toString();
150
+ let i;
151
+ while ((i = buf.indexOf('\\n')) >= 0) {
152
+ const line = buf.slice(0, i).trim();
153
+ buf = buf.slice(i + 1);
154
+ if (!line) continue;
155
+ let msg;
156
+ try { msg = JSON.parse(line); } catch { continue; } // servers log non-JSON to stdout
157
+ if (msg.id === 1) {
158
+ if (msg.error) return out({ ok: false, stage: 'initialize', error: JSON.stringify(msg.error) });
159
+ serverInfo = msg.result && msg.result.serverInfo;
160
+ protocolVersion = msg.result && msg.result.protocolVersion;
161
+ send({ jsonrpc: '2.0', method: 'notifications/initialized' });
162
+ listTools(null);
163
+ } else if (msg.id === nextId) {
164
+ if (msg.error) return out({ ok: false, stage: 'tools/list', error: JSON.stringify(msg.error), serverInfo, protocolVersion });
165
+ const result = msg.result || {};
166
+ pages++;
167
+ for (const t of result.tools || []) {
168
+ tools.push({
169
+ name: t.name,
170
+ title: t.title,
171
+ description: t.description,
172
+ inputSchema: t.inputSchema,
173
+ outputSchema: t.outputSchema,
174
+ annotations: t.annotations,
175
+ });
176
+ }
177
+ if (result.nextCursor && pages < ${MAX_PAGES}) { nextId++; listTools(result.nextCursor); return; }
178
+ clearTimeout(timer);
179
+ return out({
180
+ ok: true, stage: 'done', serverInfo, protocolVersion, tools, pages,
181
+ truncated: Boolean(result.nextCursor),
182
+ });
183
+ }
184
+ }
185
+ });
186
+
187
+ child.on('exit', (code) => out({ ok: false, stage: 'spawn', error: 'exited ' + code + (stderr ? ': ' + stderr.slice(0, 400) : '') }));
188
+
189
+ send({
190
+ jsonrpc: '2.0', id: 1, method: 'initialize',
191
+ params: {
192
+ protocolVersion: ${JSON.stringify(PROTOCOL_VERSION)},
193
+ capabilities: {},
194
+ clientInfo: { name: 'lurq-oracle', version: '1' },
195
+ },
196
+ });
197
+ `.trim();
198
+ }
199
+ function parseProbeOutput(stdout) {
200
+ const lines = stdout.trim().split("\n").reverse();
201
+ for (const line of lines) {
202
+ const t = line.trim();
203
+ if (!t.startsWith("{")) continue;
204
+ try {
205
+ const parsed = JSON.parse(t);
206
+ if (typeof parsed.ok === "boolean") return parsed;
207
+ } catch {
208
+ }
209
+ }
210
+ return null;
211
+ }
212
+ var LAUNCH_VERBS = ["mcp", "serve", "--stdio"];
213
+ async function attempt(sandbox, pkg, version, args, env) {
214
+ const res = await sandbox.exec(`node -e ${shellQuote(probeScript(pkg, args, env))}`, {
215
+ install: [{ name: pkg, version }],
216
+ timeoutMs: HANDSHAKE_TIMEOUT_MS
217
+ });
218
+ return { probe: parseProbeOutput(res.stdout), stderr: res.stderr };
219
+ }
220
+ async function probeMcpServer(sandbox, pkg, version, opts = {}) {
221
+ const ladder = opts.args?.length ? [opts.args] : [[]];
222
+ for (const verb of LAUNCH_VERBS) ladder.push([verb]);
223
+ let last = { probe: null, stderr: "" };
224
+ for (const args of ladder) {
225
+ try {
226
+ const res = await attempt(sandbox, pkg, version, args, opts.env ?? {});
227
+ if (res.probe?.ok) return { ...res, launchedWith: args };
228
+ last = res;
229
+ } catch (err) {
230
+ throw new Error(`sandbox failure: ${String(err)}`);
231
+ }
232
+ }
233
+ return { ...last, launchedWith: [] };
234
+ }
235
+ var mcpServerOracle = {
236
+ id: "mcp_server.handshake",
237
+ version: "2",
238
+ // v2: full tool schemas + paginated tools/list
239
+ kind: "mcp_server",
240
+ ttlHours: 24 * 14,
241
+ // spec §2: on publish, else 14 days
242
+ rule: "Install the package, speak MCP over stdio (initialize \u2192 tools/list, all pages); failure is install error, handshake timeout, JSON-RPC error, or malformed tool list.",
243
+ async run(target, _env, sandbox) {
244
+ const started = Date.now();
245
+ const { probe, stderr } = await probeMcpServer(sandbox, target.name, target.version ?? null);
246
+ const observations = [];
247
+ const discovered = [];
248
+ if (!probe) {
249
+ observations.push({
250
+ relation: "initializes",
251
+ verdict: "verified_false",
252
+ evidence: truncate(`no probe output. stderr: ${stderr}`)
253
+ });
254
+ return { observations, costMillis: Date.now() - started };
255
+ }
256
+ if (!probe.ok) {
257
+ observations.push({
258
+ relation: "initializes",
259
+ verdict: "verified_false",
260
+ evidence: truncate(`stage=${probe.stage} ${probe.error ?? ""}`)
261
+ });
262
+ return { observations, costMillis: Date.now() - started };
263
+ }
264
+ if (probe.truncated) {
265
+ observations.push({
266
+ relation: "initializes",
267
+ verdict: "unverifiable",
268
+ evidence: truncate(
269
+ `tools/list still paginating after ${MAX_PAGES} pages (${probe.tools?.length ?? 0} tools read); list is incomplete`
270
+ )
271
+ });
272
+ return { observations, costMillis: Date.now() - started };
273
+ }
274
+ observations.push({
275
+ relation: "initializes",
276
+ verdict: "verified_true",
277
+ evidence: truncate(
278
+ `serverInfo=${probe.serverInfo?.name ?? "?"}@${probe.serverInfo?.version ?? "?"} protocol=${probe.protocolVersion ?? "?"} tools=${probe.tools?.length ?? 0} pages=${probe.pages ?? 1}`
279
+ )
280
+ });
281
+ for (const tool of probe.tools ?? []) {
282
+ const ref = {
283
+ kind: "mcp_tool",
284
+ namespace: target.namespace,
285
+ name: `${target.name}#${tool.name}`,
286
+ version: target.version ?? null
287
+ };
288
+ discovered.push(ref);
289
+ observations.push({
290
+ object: ref,
291
+ relation: "provides",
292
+ verdict: "verified_true",
293
+ evidence: truncate(tool.description ?? tool.name)
294
+ });
295
+ }
296
+ return { observations, discovered, costMillis: Date.now() - started };
297
+ }
298
+ };
299
+ function truncate(s) {
300
+ return s.replace(/\s+/g, " ").trim().slice(0, EVIDENCE_MAX);
301
+ }
302
+ function shellQuote(s) {
303
+ return `'${s.replace(/'/g, `'\\''`)}'`;
304
+ }
305
+
306
+ // src/pipeline/mcp.ts
307
+ var VERSION_LOOKBACK = 50;
308
+ var EXTRACTOR_VERSION = "2";
309
+ var PLACEHOLDER_VALUE = "lurq-placeholder-not-a-real-credential";
310
+ var MAX_ATTEMPTS = 3;
311
+ var MCP_PER_CYCLE = 3;
312
+ async function extractAndStoreMcp(db, server, version, opts = {}) {
313
+ const ref = mcpSurfaceRef(server, version);
314
+ const manifest = await fetchServerManifest(server);
315
+ if (manifest?.remoteOnly) {
316
+ return {
317
+ outcome: "not_stdio",
318
+ tools: [],
319
+ reason: `published only as a remote ${manifest.transport ?? "endpoint"}; there is no package to install and probe`
320
+ };
321
+ }
322
+ const missing = missingConfig(manifest, opts.env);
323
+ const placeholders = {};
324
+ for (const m of missing) placeholders[m.name] = PLACEHOLDER_VALUE;
325
+ const sandbox = opts.sandbox ?? await getSandbox();
326
+ const { probe, stderr } = await probeMcpServer(sandbox, server, version, {
327
+ args: manifest?.args ?? [],
328
+ env: placeholders
329
+ });
330
+ if (missing.length > 0 && !probe?.ok) {
331
+ return {
332
+ outcome: "needs_config",
333
+ tools: [],
334
+ reason: configRequestLine(server, missing),
335
+ missing
336
+ };
337
+ }
338
+ if (!probe || !probe.ok) {
339
+ const reason = probe ? `stage=${probe.stage} ${probe.error ?? ""}`.slice(0, 300) : `no probe output: ${stderr.slice(0, 200)}`;
340
+ const sniffed = sniffMissingEnv(`${probe?.error ?? ""} ${stderr}`);
341
+ if (sniffed) {
342
+ const inferred = [
343
+ { name: sniffed, description: null, required: true, secret: true, format: null }
344
+ ];
345
+ return {
346
+ outcome: "needs_config",
347
+ tools: [],
348
+ reason: `server did not start and its output names ${sniffed} as required (inferred from the server's own error, not a published manifest)`,
349
+ missing: inferred
350
+ };
351
+ }
352
+ await recordUnreachable(db, ref, reason);
353
+ return { outcome: "unreachable", tools: [], reason };
354
+ }
355
+ if (probe.truncated) {
356
+ return {
357
+ outcome: "truncated",
358
+ tools: probe.tools ?? [],
359
+ reason: "tools/list still paginating at the page ceiling; list incomplete"
360
+ };
361
+ }
362
+ const tools = probe.tools ?? [];
363
+ const hash = surfaceHash(tools);
364
+ if (await isExtractionCached(db, ref, hash, EXTRACTOR_VERSION, MCP_TIER)) {
365
+ return { outcome: "cached", tools, reason: null };
366
+ }
367
+ const res = await storeSurface(db, mcpSurface(server, version, tools), {
368
+ artifactHash: hash,
369
+ extractorVersion: EXTRACTOR_VERSION,
370
+ ref,
371
+ oracleId: mcpServerOracle.id
372
+ });
373
+ await queueNpmIngest(db, server);
374
+ return {
375
+ outcome: res.verdict === "undeclared" ? "undeclared" : "stored",
376
+ tools,
377
+ reason: res.verdict === "undeclared" ? "server listed no tools" : null
378
+ };
379
+ }
380
+ async function recordUnreachable(db, ref, reason) {
381
+ const entity = await upsertEntity(db, ref, 0);
382
+ const claim = await upsertClaim(db, {
383
+ subjectId: entity.id,
384
+ relation: "initializes",
385
+ environmentId: null,
386
+ tenantId: 0
387
+ });
388
+ await recordObservation(db, {
389
+ claimId: claim.id,
390
+ verdict: "verified_false",
391
+ class: "executed",
392
+ tier: MCP_TIER,
393
+ evidence: reason,
394
+ oracleId: mcpServerOracle.id,
395
+ oracleVer: EXTRACTOR_VERSION
396
+ });
397
+ }
398
+ async function queueNpmIngest(db, name) {
399
+ try {
400
+ const { enqueueIngest } = await import("./ingestQueue-VKN4KBIF.js");
401
+ enqueueIngest(db, name, null);
402
+ } catch (err) {
403
+ logger.debug(`mcp: npm ingest enqueue failed for ${name}: ${formatError(err)}`);
404
+ }
405
+ }
406
+ async function drainMcpQueue(db, opts = {}) {
407
+ const pending = await getPendingSurfaces(db, opts.limit ?? MCP_PER_CYCLE, "mcp_server");
408
+ const s = {
409
+ drained: 0,
410
+ stored: 0,
411
+ cached: 0,
412
+ undeclared: 0,
413
+ unreachable: 0,
414
+ needs_config: 0,
415
+ not_stdio: 0,
416
+ truncated: 0,
417
+ failed: 0,
418
+ backfilled: 0
419
+ };
420
+ for (const item of pending) {
421
+ s.drained++;
422
+ try {
423
+ const { outcome, reason } = await extractAndStoreMcp(db, item.packageName, item.version, {
424
+ sandbox: opts.sandbox
425
+ });
426
+ s[outcome]++;
427
+ if (reason) {
428
+ logger.info(
429
+ { server: item.packageName, version: item.version, outcome, reason },
430
+ "mcp: no surface stored"
431
+ );
432
+ }
433
+ if (item.version && (outcome === "stored" || outcome === "cached")) {
434
+ await enqueuePreviousSurface(
435
+ db,
436
+ item.packageName,
437
+ item.version,
438
+ await getPackageVersions(db, item.packageName, VERSION_LOOKBACK),
439
+ "mcp_server"
440
+ ).then(
441
+ (queued) => {
442
+ if (queued) s.backfilled++;
443
+ },
444
+ (err) => logger.warn(
445
+ { server: item.packageName, err: formatError(err) },
446
+ "mcp: predecessor backfill could not be queued"
447
+ )
448
+ );
449
+ }
450
+ await dropSurfaceQueue(db, item.id);
451
+ } catch (err) {
452
+ s.failed++;
453
+ if (item.attempts + 1 >= MAX_ATTEMPTS) await dropSurfaceQueue(db, item.id);
454
+ else await bumpSurfaceAttempt(db, item.id);
455
+ logger.warn(
456
+ { spec: item.specKey, attempts: item.attempts + 1, err: formatError(err) },
457
+ "mcp surface probe failed"
458
+ );
459
+ }
460
+ }
461
+ return s;
462
+ }
463
+ async function enqueueMcpServer(db, server, version) {
464
+ await enqueueSurface(db, server, version, "mcp_server");
465
+ }
466
+ export {
467
+ MCP_PER_CYCLE,
468
+ drainMcpQueue,
469
+ enqueueMcpServer,
470
+ extractAndStoreMcp,
471
+ sniffMissingEnv
472
+ };
@@ -0,0 +1,22 @@
1
+ import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
2
+ import {
3
+ handleMcpDrift,
4
+ handleMcpSurface
5
+ } from "./chunk-3N3Q3DSW.js";
6
+ import "./chunk-DB2VF5UD.js";
7
+ import "./chunk-LEGPB7DO.js";
8
+ import {
9
+ summarizeDrift
10
+ } from "./chunk-6EQ3ARXA.js";
11
+ import "./chunk-SHCEBP3J.js";
12
+ import "./chunk-LO35HLQZ.js";
13
+ import "./chunk-HWBBVLOT.js";
14
+ import "./chunk-LYMPYETA.js";
15
+ import "./chunk-MYGSLK44.js";
16
+ import "./chunk-GPTKSNR6.js";
17
+ import "./chunk-I3M2KJXB.js";
18
+ export {
19
+ handleMcpDrift,
20
+ handleMcpSurface,
21
+ summarizeDrift as summarize
22
+ };