lurqrun 0.1.7 → 0.1.8

package/dist/chunk-53SG6XWA.js

@@ -0,0 +1,141 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  SseError,
+  StreamableHTTPError,
+  UnauthorizedError
+} from "./chunk-X4W64MHU.js";
+import {
+  ErrorCode,
+  McpError
+} from "./chunk-D3K6IZVR.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/mcpScan/errors.ts
+init_esm_shims();
+var ENV_COMPLAINT = /\b([A-Z][A-Z0-9]{2,}(?:_[A-Z0-9]+)+)\b[^.\n]{0,60}?\b(required|must be set|not set|missing|is not defined)\b|\b(required|must be set|missing)\b[^.\n]{0,60}?\b([A-Z][A-Z0-9]{2,}(?:_[A-Z0-9]+)+)\b/;
+function sniffMissingEnv(text) {
+  const m = ENV_COMPLAINT.exec(text);
+  return m ? m[1] ?? m[4] ?? null : null;
+}
+var NETWORK_CODES = /* @__PURE__ */ new Set([
+  "ECONNREFUSED",
+  "ENOTFOUND",
+  "EAI_AGAIN",
+  "ECONNRESET",
+  "ETIMEDOUT",
+  "EHOSTUNREACH",
+  "ENETUNREACH",
+  "UND_ERR_CONNECT_TIMEOUT",
+  "UND_ERR_SOCKET",
+  "CERT_HAS_EXPIRED",
+  "DEPTH_ZERO_SELF_SIGNED_CERT",
+  "SELF_SIGNED_CERT_IN_CHAIN",
+  "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+  "ERR_TLS_CERT_ALTNAME_INVALID"
+]);
+function causeCode(err) {
+  let cur = err;
+  for (let i = 0; i < 5 && cur; i++) {
+    const code = cur.code;
+    if (typeof code === "string") return code;
+    cur = cur.cause;
+  }
+  return null;
+}
+var msg = (err) => err instanceof Error ? err.message : String(err);
+function classifyError(err, ctx) {
+  const message = msg(err).slice(0, 500);
+  if (err instanceof UnauthorizedError) {
+    return {
+      status: "auth_required",
+      error: message || "the server requires authorization",
+      hint: "this server signs in with OAuth, and lurq cannot reuse the token your agent holds; ask your agent to pass its tool list to the mcp_stack tool instead"
+    };
+  }
+  const httpCode = err instanceof StreamableHTTPError || err instanceof SseError ? err.code : void 0;
+  if (httpCode === 401 || httpCode === 403) {
+    return {
+      status: "auth_required",
+      error: `HTTP ${httpCode}`,
+      hint: "the server rejected the credentials in this config; check the Authorization header or token it is given"
+    };
+  }
+  if (typeof httpCode === "number" && httpCode > 0) {
+    return {
+      status: "unreachable",
+      error: `HTTP ${httpCode}: ${message}`,
+      hint: httpCode === 404 ? "nothing answers MCP at this url; check the path" : null
+    };
+  }
+  if (err instanceof McpError && err.code === ErrorCode.RequestTimeout) {
+    return {
+      status: "timeout",
+      error: message,
+      hint: ctx.transport === "stdio" ? "the server did not answer in time; a first run of npx/uvx downloads the package, so try again with a longer --timeout" : null
+    };
+  }
+  const code = causeCode(err);
+  if (code === "ENOENT" && ctx.transport === "stdio") {
+    return {
+      status: "spawn_failed",
+      error: `command not found: ${ctx.command ?? "(none)"}`,
+      hint: "install it, or use an absolute path in the config"
+    };
+  }
+  if (code && NETWORK_CODES.has(code)) {
+    return { status: "unreachable", error: `${code}: ${message}`, hint: null };
+  }
+  if (err instanceof TypeError && /fetch failed/i.test(message)) {
+    const cause = err.cause;
+    return {
+      status: "unreachable",
+      error: cause ? `fetch failed: ${msg(cause).slice(0, 300)}` : message,
+      hint: null
+    };
+  }
+  const closed = err instanceof McpError && err.code === ErrorCode.ConnectionClosed || /connection closed/i.test(message);
+  if (closed && ctx.transport === "stdio") {
+    const missing = sniffMissingEnv(ctx.stderrTail);
+    if (missing) {
+      return {
+        status: "needs_config",
+        error: `the server exited, and its output names ${missing} as required`,
+        hint: `set ${missing} in this server's env block`
+      };
+    }
+    if (ctx.stdoutNoise > 0 && !ctx.stderrTail.trim()) {
+      return {
+        status: "protocol_error",
+        error: "the server wrote non-protocol output to stdout and then closed",
+        hint: "stdio servers must log to stderr; stdout is reserved for JSON-RPC"
+      };
+    }
+    return {
+      status: "spawn_failed",
+      error: ctx.stderrTail.trim() ? `exited before completing the handshake: ${ctx.stderrTail.trim().split("\n").slice(-3).join(" | ")}` : "exited before completing the handshake",
+      hint: null
+    };
+  }
+  if (/protocol version is not supported/i.test(message)) {
+    return {
+      status: "protocol_error",
+      error: message,
+      hint: "the server speaks a protocol revision this lurq version does not; upgrade lurq"
+    };
+  }
+  if (ctx.stdoutNoise > 0) {
+    return {
+      status: "protocol_error",
+      error: `${message} (the server also wrote ${ctx.stdoutNoise} non-protocol line(s) to stdout)`,
+      hint: "stdio servers must log to stderr; stdout is reserved for JSON-RPC"
+    };
+  }
+  return { status: "protocol_error", error: message || "unknown error", hint: null };
+}
+
+export {
+  sniffMissingEnv,
+  classifyError
+};

package/dist/chunk-5ABNDB3I.js

@@ -0,0 +1,37 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/remoteProbe/url.ts
+init_esm_shims();
+var PLACEHOLDER = /\{[^{}]+\}/;
+function endpointIdentity(raw) {
+  if (typeof raw !== "string") return null;
+  const trimmed = raw.trim();
+  if (!trimmed || trimmed.length > 2048) return null;
+  const templated = PLACEHOLDER.test(trimmed);
+  let parsed;
+  try {
+    parsed = new URL(templated ? trimmed.replace(/\{[^{}]+\}/g, "placeholder") : trimmed);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
+  const host = parsed.hostname.toLowerCase();
+  if (!host) return null;
+  if (templated) return { url: trimmed, host, templated: true };
+  parsed.hash = "";
+  const path = parsed.pathname === "/" ? "" : parsed.pathname;
+  const port = parsed.port ? `:${parsed.port}` : "";
+  const auth = parsed.username ? `${parsed.username}${parsed.password ? `:${parsed.password}` : ""}@` : "";
+  return {
+    url: `${parsed.protocol}//${auth}${host}${port}${path}${parsed.search}`,
+    host,
+    templated: false
+  };
+}
+
+export {
+  endpointIdentity
+};

package/dist/chunk-5ALIJFDA.js

@@ -0,0 +1,114 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  require_semver
+} from "./chunk-3GHJR7XR.js";
+import {
+  __toESM,
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/fix/manifest.ts
+init_esm_shims();
+var import_semver = __toESM(require_semver(), 1);
+import { readFileSync } from "fs";
+import { join } from "path";
+import ts from "typescript";
+var BLOCKS = ["dependencies", "devDependencies", "optionalDependencies"];
+var SIMPLE_RANGE = /^(\^|~)?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/;
+function declaredRange(text, pkg) {
+  const sf = ts.parseJsonText("package.json", text);
+  const root = sf.statements[0]?.expression;
+  if (!root || !ts.isObjectLiteralExpression(root)) return null;
+  const propNamed = (obj, name) => obj.properties.find(
+    (p) => ts.isPropertyAssignment(p) && ts.isStringLiteral(p.name) && p.name.text === name
+  );
+  for (const block of BLOCKS) {
+    const blockProp = propNamed(root, block);
+    if (!blockProp || !ts.isObjectLiteralExpression(blockProp.initializer)) continue;
+    const dep = propNamed(blockProp.initializer, pkg);
+    if (!dep || !ts.isStringLiteral(dep.initializer)) continue;
+    const node = dep.initializer;
+    return { block, range: node.text, start: node.getStart(sf) + 1, end: node.getEnd() - 1 };
+  }
+  return null;
+}
+function decideRange(file, found, toVersion) {
+  if (!import_semver.default.valid(toVersion)) {
+    return { refusedBecause: `${toVersion} is not an exact version` };
+  }
+  if (import_semver.default.validRange(found.range) && import_semver.default.satisfies(toVersion, found.range)) {
+    return { satisfied: true };
+  }
+  const simple = SIMPLE_RANGE.exec(found.range);
+  if (!simple) {
+    return {
+      refusedBecause: `"${found.range}" is not a plain ^, ~ or exact range, so what it should become is a judgement`
+    };
+  }
+  const prefix = simple[1] ?? "";
+  return {
+    edit: {
+      file,
+      start: found.start,
+      end: found.end,
+      text: `${prefix}${toVersion}`,
+      was: found.range
+    }
+  };
+}
+function manifestFindings(root, targets, opts = {}) {
+  const files = opts.files ?? ["package.json"];
+  const read = opts.read ?? ((file) => {
+    try {
+      return readFileSync(join(root, file), "utf8");
+    } catch {
+      return null;
+    }
+  });
+  const texts = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    const text = read(file);
+    if (text !== null) texts.set(file, text);
+  }
+  const findings = [];
+  const refused = [];
+  for (const target of targets) {
+    const edits = [];
+    const bumped = [];
+    for (const [file, text] of texts) {
+      const found = declaredRange(text, target.package);
+      if (!found) continue;
+      const decision = decideRange(file, found, target.toVersion);
+      if (decision.edit) {
+        edits.push(decision.edit);
+        bumped.push(file);
+      } else if (decision.refusedBecause) {
+        refused.push({ package: target.package, file, reason: decision.refusedBecause });
+      }
+    }
+    if (edits.length === 0) continue;
+    findings.push({
+      domain: "package",
+      code: `outdated-range:${target.package}`,
+      // Blocking: with the source rewritten and the range still pinning the old
+      // major, the next install puts the old version back under new code.
+      severity: "blocking",
+      detail: `${target.package} is declared at a range that excludes ${target.toVersion} in ${bumped.length} manifest(s): ${bumped.join(", ")}`,
+      file: bumped[0],
+      evidence: `upgrading ${target.package} ${target.fromVersion} \u2192 ${target.toVersion}`,
+      fix: {
+        summary: `bump ${target.package} to ${target.toVersion} in ${bumped.length} manifest(s)`,
+        edits,
+        // Installing is the user's call; the type check is what proves the tree agrees.
+        verify: ["typecheck"]
+      }
+    });
+  }
+  return { findings, refused };
+}
+
+export {
+  declaredRange,
+  decideRange,
+  manifestFindings
+};

package/dist/{chunk-BULZAX2U.js → chunk-64ZF7KO4.js}

@@ -2,27 +2,19 @@ import { createRequire as __lurqCreateRequire } from 'node:module'; const requir
 import {
   assessVerdict
 } from "./chunk-QSL6QN5X.js";
-import {
-  getStoredSurface,
-  upsertSurface
-} from "./chunk-M6NYEXCW.js";
 import {
   getLatestVerificationByName
-} from "./chunk-6L3U7DZ5.js";
+} from "./chunk-NYZU5NCW.js";
 import {
   getStackResolution,
   recordStackResolution,
   resolveSet,
   stackKey
-} from "./chunk-J5FZYN4A.js";
+} from "./chunk-2WD4QAH4.js";
 import {
-  applyPolicy,
-  check,
-  describeRules,
-  diffPolicies,
-  hasRules,
-  withoutExpired
-} from "./chunk-PSX3GIAN.js";
+  getStoredSurface,
+  upsertSurface
+} from "./chunk-DSROTZ3Z.js";
 import {
   FIRST_TOUCH_BUDGET_MS,
   assembleMembers,
@@ -35,7 +27,7 @@ import {
   lookupSuccessor,
   recordOutcome,
   truncateSentences
-} from "./chunk-FW6BD2NO.js";
+} from "./chunk-TUXQ32WE.js";
 import {
   resolveArchitectureCompat,
   resolveRuntimeEngineConflicts
@@ -44,32 +36,25 @@ import {
   CONFIDENCE_WEIGHT,
   RANKING,
   loadWeights
-} from "./chunk-2VMOWSRY.js";
-import {
-  withBudget
-} from "./chunk-4ESO33J6.js";
+} from "./chunk-6DM6UQFD.js";
 import {
   enqueueCompatVerify,
   getSandboxEdges,
   pairKey
-} from "./chunk-CW5HJ3LX.js";
+} from "./chunk-EYAKM6YN.js";
 import {
   fetchNpmCompatAtVersion,
   fetchNpmRegistry,
   npmPackageExists,
   npmVersionExists
-} from "./chunk-AHBP533R.js";
-import {
-  HttpError,
-  httpRequest
-} from "./chunk-SJOVFF7B.js";
+} from "./chunk-D3VTZS7V.js";
 import {
-  cached
-} from "./chunk-HWBBVLOT.js";
+  withBudget
+} from "./chunk-4ESO33J6.js";
 import {
   getPackageByName,
   getTopPackageNames
-} from "./chunk-NH5I4KHH.js";
+} from "./chunk-NPVN2THM.js";
 import {
   DEFAULT_ECOSYSTEM
 } from "./chunk-VLRHFMGJ.js";
@@ -78,14 +63,29 @@ import {
   policyDecisions,
   selectionPolicies,
   selectionPolicyChanges
-} from "./chunk-LYMPYETA.js";
+} from "./chunk-4JHDSVIN.js";
+import {
+  HttpError,
+  httpRequest
+} from "./chunk-KYKSZ3XZ.js";
+import {
+  applyPolicy,
+  check,
+  describeRules,
+  diffPolicies,
+  hasRules,
+  withoutExpired
+} from "./chunk-HWFX4BC4.js";
+import {
+  cached
+} from "./chunk-6L67QMCP.js";
 import {
   logger
 } from "./chunk-MYGSLK44.js";
 import {
   CACHE_TTL,
   STALENESS_DAYS
-} from "./chunk-GPTKSNR6.js";
+} from "./chunk-72Y2FDVS.js";
 import {
   init_esm_shims
 } from "./chunk-I3M2KJXB.js";
@@ -616,9 +616,25 @@ async function recommend(db, opts, provider = createEmbeddingProvider()) {
   if (!queryVec) opts.onDegraded?.("vector retrieval unavailable");
   const category = opts.category ?? inferCategory(opts.need);
   const pool = Math.max(limit * 5, 25);
-  let fused = await hybridSearch(db, queryVec, provider.id, opts.need, opts.constraints, category, pool);
+  let fused = await hybridSearch(
+    db,
+    queryVec,
+    provider.id,
+    opts.need,
+    opts.constraints,
+    category,
+    pool
+  );
   if (category && fused.length < limit) {
-    const broad = await hybridSearch(db, queryVec, provider.id, opts.need, opts.constraints, null, pool);
+    const broad = await hybridSearch(
+      db,
+      queryVec,
+      provider.id,
+      opts.need,
+      opts.constraints,
+      null,
+      pool
+    );
     const seen = new Set(fused.map((f) => f.row.name));
     fused = fused.concat(broad.filter((f) => !seen.has(f.row.name)));
   }
@@ -695,7 +711,10 @@ async function runVectorQuery(db, queryVec, providerId, constraints, category, p
 async function runLexicalQuery(db, need, constraints, category, pool) {
   const tsquery = sql`websearch_to_tsquery('english', ${need})`;
   const rank = sql`ts_rank(${packages.searchVector}, ${tsquery})`;
-  const conditions = [sql`${packages.searchVector} @@ ${tsquery}`, ...buildConditions(constraints, category)];
+  const conditions = [
+    sql`${packages.searchVector} @@ ${tsquery}`,
+    ...buildConditions(constraints, category)
+  ];
   return db.select(ROW_COLUMNS).from(packages).where(and(...conditions)).orderBy(sql`${rank} desc`).limit(pool);
 }
 function toCandidate(row) {
@@ -1087,11 +1106,7 @@ function editDistance(a, b) {
     cur[0] = i;
     for (let j = 1; j <= n; j++) {
       const cost = a[i - 1] === b[j - 1] ? 0 : 1;
-      let val = Math.min(
-        (prev[j] ?? 0) + 1,
-        (cur[j - 1] ?? 0) + 1,
-        (prev[j - 1] ?? 0) + cost
-      );
+      let val = Math.min((prev[j] ?? 0) + 1, (cur[j - 1] ?? 0) + 1, (prev[j - 1] ?? 0) + cost);
       if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) {
         val = Math.min(val, (prevPrev[j - 2] ?? 0) + 1);
       }
@@ -1506,7 +1521,9 @@ async function handleUsage(db, input) {
       // The README is not in this response, so "fall back to the README"
       // left the agent with nothing to act on. Name the two things it can do.
       `No type-derived API surface for ${input.package}@${version}: it ships no .d.ts and ${types} has no matching major, or extraction is still running (retry in a few seconds). For the names it exports at runtime call resolve_surface; for usage, read https://www.npmjs.com/package/${input.package}/v/${version}.`
-    ) : shallow ? `Shallow surface: ${input.package} exports one value typed by ${surface.filter((s) => s.name !== "default").map((s) => s.name).join(", ")}, so its methods are that interface's members and are NOT listed here. Read them in its type declarations (${types} if the package bundles none), or call resolve_surface for the names it exports at runtime.` : page?.note
+    ) : shallow ? `Shallow surface: ${input.package} exports one value typed by ${surface.filter((s) => s.name !== "default").map((s) => s.name).join(
+      ", "
+    )}, so its methods are that interface's members and are NOT listed here. Read them in its type declarations (${types} if the package bundles none), or call resolve_surface for the names it exports at runtime.` : page?.note
   };
   if (input.knownVersion && input.knownVersion !== version && surface) {
     const known = await getOrExtractSurface(db, input.package, input.knownVersion, {

package/dist/{chunk-2VMOWSRY.js → chunk-6DM6UQFD.js}

@@ -115,12 +115,29 @@ var FIELD = {
   /** Reports at or above this cap the confidence note as fully-evidenced. */
   wellEvidencedReports: 25
 };
+var DISCOVERY = {
+  /** A queued candidate must clear this quality pre-score to graduate to ingest. */
+  minPreScore: 45,
+  /** Max candidates fully ingested per crawler run (cost bound). */
+  perRunCap: 25,
+  /** npm-search hits to pull per category keyword. */
+  searchSizePerCategory: 10,
+  /** Max dependency-graph neighbors to enqueue per tracked seed. */
+  graphNeighborsPerSeed: 20,
+  /** Ingest failures a candidate gets before it is marked `failed` and stops
+   *  being retried. Three, because the failures worth retrying are transient
+   *  (a registry 5xx, a GitHub rate limit) and clear within an hour or two,
+   *  while the ones that are not — a manifest we cannot parse — would otherwise
+   *  re-buy an LLM summary every cycle for as long as the crawler runs. */
+  maxIngestAttempts: 3
+};
 var DEFAULT_WEIGHTS = {
   health: { ...HEALTH_WEIGHTS },
   composite: { ...COMPOSITE }
 };
 function activeWeightsPath() {
-  if (existsSync(projectWeightsPath())) return { path: projectWeightsPath(), source: "project-config" };
+  if (existsSync(projectWeightsPath()))
+    return { path: projectWeightsPath(), source: "project-config" };
   if (existsSync(userWeightsPath())) return { path: userWeightsPath(), source: "user-config" };
   return null;
 }
@@ -288,6 +305,7 @@ export {
   RELIABILITY,
   EFFICIENCY,
   FIELD,
+  DISCOVERY,
   activeWeightsPath,
   loadWeights,
   validateWeights,

package/dist/{chunk-HWBBVLOT.js → chunk-6L67QMCP.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-MYGSLK44.js";
 import {
   VERSION
-} from "./chunk-GPTKSNR6.js";
+} from "./chunk-72Y2FDVS.js";
 import {
   init_esm_shims
 } from "./chunk-I3M2KJXB.js";

package/dist/{chunk-GPTKSNR6.js → chunk-72Y2FDVS.js}

@@ -9,7 +9,7 @@ init_esm_shims();
 // package.json
 var package_default = {
   name: "lurqrun",
-  version: "0.1.7",
+  version: "0.1.8",
   description: "Verify npm packages before your AI coding agent installs them: hallucinated and typosquatted names, advisories, API drift and version conflicts. MCP server, CLI and agent skill for Claude Code, Cursor and VS Code.",
   type: "module",
   license: "MIT",
@@ -116,6 +116,7 @@ var package_default = {
     semver: "^7.8.5",
     stripe: "^22.6.0",
     typescript: "^5.5.4",
+    undici: "^7.29.1",
     yaml: "^2.9.0",
     zod: "^3.23.8"
   },