openkrak-mcp 1.0.17 → 1.0.19

package/dist/index.js

@@ -242516,10 +242516,11 @@ function detectSecurityPatterns(filePath, content) {
 }
 async function classifyTopology(repoRoot, allFiles) {
   const type = await detectProjectType(repoRoot);
+  const framework = await detectFramework(repoRoot, allFiles);
   const entryPoints = detectEntryPoints(allFiles);
   const layers = detectLayers(allFiles);
   const modules = detectModules(allFiles);
-  return { type, entry_points: entryPoints, layers, modules };
+  return { type, entry_points: entryPoints, layers, modules, framework };
 }
 async function detectProjectType(repoRoot) {
   try {
@@ -242529,7 +242530,7 @@ async function detectProjectType(repoRoot) {
     if (pkg.private === true && Array.isArray(pkg.workspaces)) return "monorepo";
   } catch {
   }
-  for (const config of ["nx.json", "lerna.json"]) {
+  for (const config of ["nx.json", "lerna.json", "pnpm-workspace.yaml", "turbo.json"]) {
     try {
       await import_promises3.default.access(import_path4.default.join(repoRoot, config));
       return "monorepo";
@@ -242538,12 +242539,111 @@ async function detectProjectType(repoRoot) {
   }
   return "monolith";
 }
+async function readFrameworkFromPkg(pkgPath) {
+  try {
+    const pkg = JSON.parse(await import_promises3.default.readFile(pkgPath, "utf-8"));
+    const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+    if (deps["next"]) return `next@${deps["next"].replace(/[\^~]/g, "")}`;
+    if (deps["nuxt"]) return `nuxt@${deps["nuxt"].replace(/[\^~]/g, "")}`;
+    if (deps["@remix-run/react"]) return "remix";
+    if (deps["astro"]) return `astro@${deps["astro"].replace(/[\^~]/g, "")}`;
+    if (deps["svelte"]) return "svelte";
+    if (deps["vue"]) return `vue@${deps["vue"].replace(/[\^~]/g, "")}`;
+    if (deps["react"]) return `react@${deps["react"].replace(/[\^~]/g, "")}`;
+    if (deps["express"]) return `express@${deps["express"].replace(/[\^~]/g, "")}`;
+    if (deps["fastify"]) return `fastify@${deps["fastify"].replace(/[\^~]/g, "")}`;
+    if (deps["hono"]) return `hono@${deps["hono"].replace(/[\^~]/g, "")}`;
+    if (deps["@nestjs/core"]) return "nestjs";
+    if (deps["@angular/core"]) return "angular";
+  } catch {
+  }
+  return null;
+}
+async function findSubPackageRoots(repoRoot, allFiles) {
+  const candidates = /* @__PURE__ */ new Set();
+  for (const f of allFiles) {
+    const parts = f.split("/");
+    if (parts.length >= 1) candidates.add(parts[0]);
+    if (parts.length >= 2) candidates.add(`${parts[0]}/${parts[1]}`);
+  }
+  const roots = [];
+  for (const candidate of candidates) {
+    const pkgPath = import_path4.default.join(repoRoot, candidate, "package.json");
+    try {
+      await import_promises3.default.access(pkgPath);
+      roots.push(candidate);
+    } catch {
+    }
+  }
+  return roots;
+}
+async function detectFramework(repoRoot, allFiles) {
+  const rootFramework = await readFrameworkFromPkg(import_path4.default.join(repoRoot, "package.json"));
+  if (rootFramework) return rootFramework;
+  const configChecks = [
+    ["next.config.js", "next"],
+    ["next.config.mjs", "next"],
+    ["next.config.ts", "next"],
+    ["vite.config.ts", "vite"],
+    ["astro.config.mjs", "astro"]
+  ];
+  for (const [cfg, name] of configChecks) {
+    try {
+      await import_promises3.default.access(import_path4.default.join(repoRoot, cfg));
+      return name;
+    } catch {
+    }
+  }
+  if (allFiles && allFiles.length > 0) {
+    const subRoots = await findSubPackageRoots(repoRoot, allFiles);
+    const detected = [];
+    for (const subRoot of subRoots) {
+      const fw = await readFrameworkFromPkg(import_path4.default.join(repoRoot, subRoot, "package.json"));
+      if (fw && !detected.includes(fw)) detected.push(fw);
+    }
+    for (const subRoot of subRoots) {
+      for (const [cfg, name] of configChecks) {
+        try {
+          await import_promises3.default.access(import_path4.default.join(repoRoot, subRoot, cfg));
+          if (!detected.includes(name)) detected.push(name);
+        } catch {
+        }
+      }
+    }
+    if (detected.length === 1) return detected[0];
+    if (detected.length > 1) {
+      const prefixCount = /* @__PURE__ */ new Map();
+      for (const d of detected) {
+        const prefix = d.split("@")[0];
+        prefixCount.set(prefix, (prefixCount.get(prefix) ?? 0) + 1);
+      }
+      return [...prefixCount.entries()].map(([fw, count]) => count > 1 ? `${fw} (\xD7${count})` : fw).join(", ");
+    }
+  }
+  return null;
+}
 function detectEntryPoints(files) {
   const entries = [];
   for (const f of files) {
-    if (/\/(index|main|app|server|cli)\.(ts|js)x?$/.test(f)) {
-      const type = f.includes("cli") ? "cli" : f.includes("server") || f.includes("app") ? "api" : "main";
+    if (/\/(index|main|server|cli)\.(ts|js)x?$/.test(f)) {
+      const type = f.includes("cli") ? "cli" : f.includes("server") ? "api" : "main";
       entries.push({ path: f, type });
+      continue;
+    }
+    if (/(?:^|\/)app\/.*page\.(ts|js)x?$/.test(f) || /(?:^|\/)app\/layout\.(ts|js)x?$/.test(f)) {
+      entries.push({ path: f, type: "api" });
+      continue;
+    }
+    if (/(?:^|\/)app\/.*(?:loading|error|not-found)\.(ts|js)x?$/.test(f)) {
+      entries.push({ path: f, type: "api" });
+      continue;
+    }
+    if (/(?:^|\/)app\/.*route\.(ts|js)x?$/.test(f) || /(?:^|\/)pages\/api\//.test(f)) {
+      entries.push({ path: f, type: "api" });
+      continue;
+    }
+    if (/^src\/(main|index|App)\.(ts|js)x?$/.test(f)) {
+      entries.push({ path: f, type: "main" });
     }
   }
   return entries;
@@ -242975,6 +243075,73 @@ function buildImpactChains(candidates) {
 function describeMechanism(root, related, depth) {
   return `${root.type} in ${root.file} propagates via ${depth} dependency hop(s) to ${related.type} in ${related.file}`;
 }
+var CROSS_BUNDLE_SAFE_EXPORTS = /* @__PURE__ */ new Set([
+  // action_contracts
+  "ActionType",
+  "PlannedAction",
+  "ShellCommandSpec",
+  "TEST_COMMAND_WHITELIST",
+  "SENSITIVE_KEY_RE",
+  "DESTRUCTIVE_RE",
+  // orchestrator / plan
+  "OrchestratorPlan",
+  "OrchestratorStep",
+  // contracts / store
+  "MahadataStore",
+  "InMemoryMahadataStore",
+  "Mahadata",
+  "TokenCounter",
+  "LLMClientConfig",
+  // handlers exposed via MCP tool layer
+  "handleAnalyzeRepo",
+  "handleBlastRadius",
+  "handleGetHotspots",
+  "handleGetMahadata",
+  // shared utilities
+  "calculateRiskScore",
+  "assembleGraph",
+  "classifyTopology",
+  "resolveTaskDependencies",
+  // constants / prompts
+  "SYSTEM_PROMPT",
+  "JSON_TAG_RE",
+  // Next.js / framework reserved exports — always safe
+  "metadata",
+  "nextConfig",
+  "geistSans",
+  "geistMono",
+  "default"
+  // default exports are always externally consumable
+]);
+var SAFE_EXPORT_PREFIXES = [
+  "handle",
+  // MCP handlers
+  "create",
+  // factory functions
+  "build",
+  // builder functions
+  "run"
+  // runner functions exposed to orchestrator
+];
+var CROSS_BUNDLE_BARREL_PATTERNS = [
+  /\/contracts\/index\.ts$/,
+  /\/action_contracts\/index\.ts$/,
+  /\/action_layer\/index\.ts$/,
+  /\/shared\/index\.ts$/,
+  /\/shared\/logger\/index\.ts$/,
+  /\/orchestrator\/index\.ts$/
+];
+function isCrossBundleSafeSymbol(symbolName, filePath) {
+  if (CROSS_BUNDLE_SAFE_EXPORTS.has(symbolName)) return true;
+  for (const prefix of SAFE_EXPORT_PREFIXES) {
+    if (symbolName.startsWith(prefix)) return true;
+  }
+  if (symbolName === "logger" || symbolName.startsWith("logger")) return true;
+  for (const pattern of CROSS_BUNDLE_BARREL_PATTERNS) {
+    if (pattern.test(filePath)) return true;
+  }
+  return false;
+}
 function tagNoise(findings, chains) {
   const suppressionReasons = /* @__PURE__ */ new Map();
   const severityOrder = {
@@ -242984,6 +243151,17 @@ function tagNoise(findings, chains) {
     low: 1,
     info: 0
   };
+  for (const f of findings) {
+    if (f.type !== "dead_code") continue;
+    if (suppressionReasons.has(f.id)) continue;
+    const symbolName = f.symbol ? f.symbol.split("::")[1] ?? f.symbol : "";
+    if (isCrossBundleSafeSymbol(symbolName, f.file)) {
+      suppressionReasons.set(
+        f.id,
+        `Cross-bundle false positive: '${symbolName}' is a known exported interface consumed outside this scan boundary.`
+      );
+    }
+  }
   const groupedByFileType = /* @__PURE__ */ new Map();
   for (const f of findings) {
     const key = `${f.file}::${f.type}`;
@@ -243339,6 +243517,7 @@ function detectGodObjects(graph, couplingScores, fileRole) {
   for (const [file, count] of nodeCountByFile) {
     if (count <= NODE_COUNT_THRESHOLD) continue;
     if (fileRole.get(file) === "test") continue;
+    if (file.endsWith("/index.ts") || file.endsWith("/index.js") || file === "index.ts") continue;
     const coupling = couplingScores.get(file);
     if (!coupling) continue;
     if (coupling.fan_in <= FAN_IN_THRESHOLD && coupling.fan_out <= FAN_OUT_THRESHOLD) continue;
@@ -243366,7 +243545,8 @@ function aggregateHotspots(params) {
     cycleFindings,
     affectedSymbolsByFile,
     cyclePaths = [],
-    graph
+    graph,
+    changeFrequencyMap = /* @__PURE__ */ new Map()
   } = params;
   const cycleFilesFromPaths = /* @__PURE__ */ new Map();
   for (const path7 of cyclePaths) {
@@ -243418,7 +243598,10 @@ function aggregateHotspots(params) {
     const isRepository = file.includes("/repositories/") || file.includes("/repository/") || file.toLowerCase().includes("repository");
     const isFoundational = isRepository && methodCount >= 3 && (coupling?.fan_in ?? 0) >= 1;
     const foundationalBonus = isFoundational ? 0.25 : 0;
-    const rawScore = couplingScore * 0.4 + complexityScore * 0.15 + methodScore * 0.1 + violationPenalty + godObjectBonus + cyclePenalty + foundationalBonus;
+    const changeFreq = changeFrequencyMap.get(file) ?? 0;
+    const maxChangeFreq = Math.max(1, ...[...changeFrequencyMap.values()]);
+    const changeFreqScore = Math.min(1, changeFreq / maxChangeFreq);
+    const rawScore = couplingScore * 0.35 + complexityScore * 0.15 + methodScore * 0.1 + changeFreqScore * 0.1 + violationPenalty + godObjectBonus + cyclePenalty + foundationalBonus;
     const finalScore = Math.min(1, rawScore);
     const reasons = [];
     if (coupling && couplingScore > 0) {
@@ -243555,10 +243738,11 @@ function buildArchitectureViolationFindings(violations) {
   }));
 }
 var logger3 = createLogger("hotspot_registry");
-async function runHotspotRegistry(store) {
+async function runHotspotRegistry(store, opts) {
   const start = Date.now();
   const errors = [];
   const scanId = store.getMeta().scan_id;
+  const changeFrequencyMap = opts?.changeFrequencyMap ?? /* @__PURE__ */ new Map();
   const log = logger3.child({ scan_id: scanId });
   log.info({ event: "hotspot_registry.start" }, "Hotspot Registry started");
   const graph = store.getDependencyGraph();
@@ -243610,7 +243794,8 @@ async function runHotspotRegistry(store) {
     cycleFindings,
     affectedSymbolsByFile,
     cyclePaths: graph.stats.cycle_paths ?? [],
-    graph
+    graph,
+    changeFrequencyMap
   });
   const couplingFindings = buildCouplingFindings(couplingScores.values(), graph.nodes);
   const complexityFindings = buildComplexityFindings(complexityScores);
@@ -244856,8 +245041,22 @@ async function runPipeline(options) {
   try {
     logger7.info("Step 1/6: DeepStrike");
     await runDeepStrike(store, { repoRoot: options.repoPath });
+    const changeFrequencyMap = /* @__PURE__ */ new Map();
+    try {
+      const { execSync } = await import("child_process");
+      const gitLog = execSync("git log --name-only --pretty=format: -- .", {
+        cwd: options.repoPath,
+        encoding: "utf-8",
+        timeout: 8e3
+      });
+      for (const line of gitLog.split("\n")) {
+        const trimmed = line.trim().replace(/\\/g, "/");
+        if (trimmed) changeFrequencyMap.set(trimmed, (changeFrequencyMap.get(trimmed) ?? 0) + 1);
+      }
+    } catch {
+    }
     logger7.info("Step 2/6: Hotspot Registry");
-    await runHotspotRegistry(store);
+    await runHotspotRegistry(store, { repoRoot: options.repoPath, changeFrequencyMap });
     logger7.info("Step 3/6: Correlation Engine");
     await runCorrelationEngine(store);
     logger7.info("Step 4/6: Blast Radius Engine");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openkrak-mcp",
-  "version": "1.0.17",
+  "version": "1.0.19",
   "description": "OpenKrak MCP Server - AI coding intelligence via Dorchester engine",
   "mcpName": "io.github.FrnzJulianBergmann/openkrak",
   "type": "commonjs",