osv-scanner-mcp 0.1.0

package/dist/test/osv/scanReport.test.js

@@ -0,0 +1,342 @@
+import { describe, expect, it } from "vitest";
+import { parseOsvScanOutput } from "../../osv/scanReport.js";
+/**
+ * docs/DESIGN_TODO.mdの実機確認(pom.xml: log4j-core 2.14.1 / commons-collections 3.2.1 /
+ * jackson-databind 2.17.0)で観測した構造を縮約したフィクスチャ。
+ * - log4j: 複数リリース系統のfixedが混在
+ * - commons-collections: max_severityが空文字列
+ * - jackson-core: 同一pom.xmlが別のresults[]エントリに分かれて出力される
+ */
+const fixture = {
+    results: [
+        {
+            source: { path: "/work/demo/pom.xml", type: "lockfile" },
+            packages: [
+                {
+                    package: {
+                        name: "org.apache.logging.log4j:log4j-core",
+                        version: "2.14.1",
+                        ecosystem: "Maven",
+                    },
+                    groups: [
+                        {
+                            ids: ["GHSA-jfh8-c2jp-5v3q"],
+                            aliases: ["CVE-2021-44228", "GHSA-jfh8-c2jp-5v3q"],
+                            max_severity: "10.0",
+                        },
+                        {
+                            ids: ["GHSA-7rjr-3q55-vv33"],
+                            aliases: ["CVE-2021-45046", "GHSA-7rjr-3q55-vv33"],
+                            max_severity: "9.0",
+                        },
+                    ],
+                    vulnerabilities: [
+                        {
+                            id: "GHSA-jfh8-c2jp-5v3q",
+                            summary: "Remote code injection in Log4j",
+                            affected: [
+                                {
+                                    package: { name: "org.apache.logging.log4j:log4j-core", ecosystem: "Maven" },
+                                    ranges: [
+                                        {
+                                            type: "ECOSYSTEM",
+                                            events: [{ introduced: "2.13.0" }, { fixed: "2.15.0" }],
+                                        },
+                                        {
+                                            type: "ECOSYSTEM",
+                                            events: [{ introduced: "2.4" }, { fixed: "2.12.2" }],
+                                        },
+                                    ],
+                                },
+                                {
+                                    // 別パッケージのaffectedは無視されること
+                                    package: { name: "org.example:other-artifact", ecosystem: "Maven" },
+                                    ranges: [{ type: "ECOSYSTEM", events: [{ fixed: "99.9.9" }] }],
+                                },
+                            ],
+                        },
+                        {
+                            id: "GHSA-7rjr-3q55-vv33",
+                            summary: "Incomplete fix of CVE-2021-44228",
+                            affected: [
+                                {
+                                    package: { name: "org.apache.logging.log4j:log4j-core", ecosystem: "Maven" },
+                                    ranges: [
+                                        {
+                                            type: "ECOSYSTEM",
+                                            events: [{ introduced: "2.13.0" }, { fixed: "2.16.0" }],
+                                        },
+                                        {
+                                            type: "ECOSYSTEM",
+                                            events: [{ introduced: "2.0" }, { fixed: "2.12.2" }],
+                                        },
+                                    ],
+                                },
+                            ],
+                        },
+                    ],
+                },
+                {
+                    package: {
+                        name: "commons-collections:commons-collections",
+                        version: "3.2.1",
+                        ecosystem: "Maven",
+                    },
+                    groups: [
+                        {
+                            ids: ["GHSA-6hgm-866r-3cjv"],
+                            aliases: ["CVE-2015-6420", "GHSA-6hgm-866r-3cjv"],
+                            max_severity: "",
+                        },
+                    ],
+                    vulnerabilities: [
+                        {
+                            id: "GHSA-6hgm-866r-3cjv",
+                            summary: "Deserialization of untrusted data",
+                            affected: [
+                                {
+                                    package: { name: "commons-collections:commons-collections", ecosystem: "Maven" },
+                                    ranges: [{ type: "ECOSYSTEM", events: [{ introduced: "0" }, { fixed: "3.2.2" }] }],
+                                },
+                            ],
+                        },
+                    ],
+                },
+            ],
+        },
+        {
+            // 同一pom.xmlが別のresults[]エントリに分かれるケース
+            source: { path: "/work/demo/pom.xml", type: "lockfile" },
+            packages: [
+                {
+                    package: {
+                        name: "com.fasterxml.jackson.core:jackson-core",
+                        version: "2.17.0",
+                        ecosystem: "Maven",
+                    },
+                    groups: [
+                        {
+                            ids: ["GHSA-h46c-h94j-95f3"],
+                            aliases: ["CVE-2025-52999", "GHSA-h46c-h94j-95f3"],
+                            max_severity: "7.5",
+                        },
+                    ],
+                    vulnerabilities: [
+                        {
+                            id: "GHSA-h46c-h94j-95f3",
+                            summary: "jackson-core StackOverflowError",
+                            affected: [
+                                {
+                                    package: { name: "com.fasterxml.jackson.core:jackson-core", ecosystem: "Maven" },
+                                    ranges: [{ type: "ECOSYSTEM", events: [{ introduced: "0" }, { fixed: "2.15.0-rc1" }] }],
+                                },
+                            ],
+                        },
+                    ],
+                },
+            ],
+        },
+    ],
+    experimental_config: {},
+};
+describe("parseOsvScanOutput", () => {
+    const report = parseOsvScanOutput(fixture);
+    it("複数のresults[]エントリをフラットに集約し、source_filesは重複しない", () => {
+        expect(report.source_files).toEqual(["/work/demo/pom.xml"]);
+        expect(report.packages.map((p) => p.name)).toContain("com.fasterxml.jackson.core:jackson-core");
+        expect(report.vulnerable_package_count).toBe(3);
+        expect(report.vulnerability_count).toBe(4);
+    });
+    it("groupsの1エントリを1脆弱性として扱い、代表ID/CVE/aliasesを整理する", () => {
+        const log4j = report.packages.find((p) => p.name.endsWith("log4j-core"));
+        const log4shell = log4j.vulnerabilities[0];
+        expect(log4shell.id).toBe("GHSA-jfh8-c2jp-5v3q");
+        expect(log4shell.cve).toBe("CVE-2021-44228");
+        // 代表IDはaliasesから除外される
+        expect(log4shell.aliases).toEqual(["CVE-2021-44228"]);
+        expect(log4shell.summary).toBe("Remote code injection in Log4j");
+    });
+    it("max_severityをスコアと5段階ラベルに変換する", () => {
+        const log4j = report.packages.find((p) => p.name.endsWith("log4j-core"));
+        expect(log4j.vulnerabilities.map((v) => [v.severity_score, v.severity])).toEqual([
+            [10.0, "critical"],
+            [9.0, "critical"],
+        ]);
+        const jackson = report.packages.find((p) => p.name.endsWith("jackson-core"));
+        expect(jackson.vulnerabilities[0].severity).toBe("high");
+    });
+    it("空文字のmax_severityは例外を投げずunknown扱いにする", () => {
+        const commons = report.packages.find((p) => p.name.startsWith("commons-collections"));
+        const vuln = commons.vulnerabilities[0];
+        expect(vuln.severity_score).toBeNull();
+        expect(vuln.severity).toBe("unknown");
+    });
+    it("fixed_versionsを対象パッケージのaffectedのみからMaven昇順で収集する", () => {
+        const log4j = report.packages.find((p) => p.name.endsWith("log4j-core"));
+        const log4shell = log4j.vulnerabilities[0];
+        // 複数リリース系統(2.12系バックポートと2.15系)が混在し、99.9.9(別パッケージ)は含まれない
+        expect(log4shell.fixed_versions).toEqual(["2.12.2", "2.15.0"]);
+        // Maven優先順位規則でのソート: 2.15.0-rc1のような修飾子付きも正しく扱う
+        const jackson = report.packages.find((p) => p.name.endsWith("jackson-core"));
+        expect(jackson.vulnerabilities[0].fixed_versions).toEqual(["2.15.0-rc1"]);
+    });
+    it("パッケージは最も深刻な脆弱性を持つ順、unknownは末尾に並ぶ", () => {
+        expect(report.packages.map((p) => p.name)).toEqual([
+            "org.apache.logging.log4j:log4j-core", // 10.0
+            "com.fasterxml.jackson.core:jackson-core", // 7.5
+            "commons-collections:commons-collections", // unknown
+        ]);
+    });
+    it("severity_breakdownが集計される", () => {
+        expect(report.severity_breakdown).toEqual({
+            critical: 2,
+            high: 1,
+            medium: 0,
+            low: 0,
+            unknown: 1,
+        });
+    });
+    it("同一パッケージ・同一groupが重複して現れても二重計上しない", () => {
+        const results = fixture.results;
+        const duplicated = parseOsvScanOutput({ results: [...results, ...results] });
+        expect(duplicated.vulnerability_count).toBe(4);
+        expect(duplicated.vulnerable_package_count).toBe(3);
+    });
+});
+describe("parseOsvScanOutput (不正・欠損データへの耐性)", () => {
+    it("空オブジェクトやnullでも例外を投げず空レポートを返す", () => {
+        for (const input of [{}, null, undefined, [], "not json", 42, { results: "oops" }]) {
+            const report = parseOsvScanOutput(input);
+            expect(report.vulnerability_count).toBe(0);
+            expect(report.packages).toEqual([]);
+        }
+    });
+    it("脆弱性ゼロのパッケージはレポートに含めない", () => {
+        const report = parseOsvScanOutput({
+            results: [
+                {
+                    source: { path: "/x/pom.xml" },
+                    packages: [
+                        { package: { name: "a:a", version: "1.0", ecosystem: "Maven" }, groups: [] },
+                    ],
+                },
+            ],
+        });
+        expect(report.vulnerable_package_count).toBe(0);
+        expect(report.source_files).toEqual(["/x/pom.xml"]);
+    });
+    it("name/versionが欠けたパッケージや空のgroupはスキップする", () => {
+        const report = parseOsvScanOutput({
+            results: [
+                {
+                    packages: [
+                        { package: { name: "a:a" }, groups: [{ ids: ["GHSA-x"] }] },
+                        { package: { version: "1.0" }, groups: [{ ids: ["GHSA-y"] }] },
+                        {
+                            package: { name: "b:b", version: "2.0", ecosystem: "Maven" },
+                            groups: [{ ids: [], aliases: [] }, { max_severity: "5.0" }],
+                        },
+                    ],
+                },
+            ],
+        });
+        expect(report.vulnerability_count).toBe(0);
+    });
+    it("巨大なsummaryは切り詰める", () => {
+        const report = parseOsvScanOutput({
+            results: [
+                {
+                    packages: [
+                        {
+                            package: { name: "a:a", version: "1.0", ecosystem: "Maven" },
+                            groups: [{ ids: ["GHSA-x"], max_severity: "5.0" }],
+                            vulnerabilities: [{ id: "GHSA-x", summary: "x".repeat(2000) }],
+                        },
+                    ],
+                },
+            ],
+        });
+        const summary = report.packages[0].vulnerabilities[0].summary;
+        expect(summary.length).toBeLessThanOrEqual(501);
+        expect(summary.endsWith("…")).toBe(true);
+    });
+    it("非数値・範囲外のmax_severityはunknown扱いにする", () => {
+        const report = parseOsvScanOutput({
+            results: [
+                {
+                    packages: [
+                        {
+                            package: { name: "a:a", version: "1.0", ecosystem: "Maven" },
+                            groups: [
+                                { ids: ["GHSA-1"], max_severity: "abc" },
+                                { ids: ["GHSA-2"], max_severity: "99" },
+                                { ids: ["GHSA-3"], max_severity: "3.1" },
+                                { ids: ["GHSA-4"], max_severity: "-1" },
+                            ],
+                        },
+                    ],
+                },
+            ],
+        });
+        const severities = report.packages[0].vulnerabilities.map((v) => v.severity);
+        // low(3.1)が先、unknown3件は末尾
+        expect(severities).toEqual(["low", "unknown", "unknown", "unknown"]);
+    });
+    it("オブジェクトでないgroupエントリはスキップする", () => {
+        const report = parseOsvScanOutput({
+            results: [
+                {
+                    packages: [
+                        {
+                            package: { name: "a:a", version: "1.0", ecosystem: "Maven" },
+                            groups: ["junk", null, 42, { ids: ["GHSA-valid"], max_severity: "5.0" }],
+                        },
+                    ],
+                },
+            ],
+        });
+        expect(report.vulnerability_count).toBe(1);
+        expect(report.packages[0].vulnerabilities[0].id).toBe("GHSA-valid");
+    });
+    it("スコア同点のパッケージは名前順、脆弱性はID順で安定ソートされる", () => {
+        const report = parseOsvScanOutput({
+            results: [
+                {
+                    packages: [
+                        {
+                            package: { name: "z:z", version: "1.0", ecosystem: "Maven" },
+                            groups: [{ ids: ["GHSA-z"], max_severity: "5.0" }],
+                        },
+                        {
+                            package: { name: "a:a", version: "1.0", ecosystem: "Maven" },
+                            groups: [
+                                { ids: ["GHSA-b"], max_severity: "5.0" },
+                                { ids: ["GHSA-a"], max_severity: "5.0" },
+                            ],
+                        },
+                    ],
+                },
+            ],
+        });
+        expect(report.packages.map((p) => p.name)).toEqual(["a:a", "z:z"]);
+        expect(report.packages[0].vulnerabilities.map((v) => v.id)).toEqual(["GHSA-a", "GHSA-b"]);
+    });
+    it("GHSAが無くCVEのみのグループは代表ID自体をcveとして扱う", () => {
+        const report = parseOsvScanOutput({
+            results: [
+                {
+                    packages: [
+                        {
+                            package: { name: "a:a", version: "1.0", ecosystem: "Maven" },
+                            groups: [{ ids: ["CVE-2024-0001"], aliases: [], max_severity: "5.0" }],
+                        },
+                    ],
+                },
+            ],
+        });
+        const vuln = report.packages[0].vulnerabilities[0];
+        expect(vuln.id).toBe("CVE-2024-0001");
+        expect(vuln.cve).toBe("CVE-2024-0001");
+        expect(vuln.aliases).toEqual([]);
+    });
+});

package/dist/test/osv/suggestFix.test.js

@@ -0,0 +1,104 @@
+import { describe, expect, it } from "vitest";
+import { suggestUpgradeForPackage, suggestUpgrades } from "../../osv/suggestFix.js";
+function vuln(id, cve, fixedVersions, severity = "high") {
+    return {
+        id,
+        cve,
+        aliases: cve !== null ? [cve] : [],
+        severity_score: null,
+        severity,
+        summary: null,
+        fixed_versions: fixedVersions,
+    };
+}
+function pkg(name, version, vulnerabilities) {
+    return { name, version, ecosystem: "Maven", vulnerabilities };
+}
+describe("suggestUpgradeForPackage", () => {
+    it("設計メモの確定例: log4j-core 2.14.1は2.25.4/major_internalになる", () => {
+        // 実スキャン(2026-07-04)で取得したfixed_versionsをそのまま使用
+        const log4j = pkg("org.apache.logging.log4j:log4j-core", "2.14.1", [
+            vuln("GHSA-jfh8-c2jp-5v3q", "CVE-2021-44228", ["2.3.1", "2.12.2", "2.15.0"], "critical"),
+            vuln("GHSA-7rjr-3q55-vv33", "CVE-2021-45046", ["2.12.2", "2.16.0"], "critical"),
+            vuln("GHSA-p6xc-xr62-6r2g", "CVE-2021-45105", ["2.3.1", "2.12.3", "2.17.0"]),
+            vuln("GHSA-8489-44mv-ggj8", "CVE-2021-44832", ["2.3.2", "2.12.4", "2.17.1"], "medium"),
+            vuln("GHSA-3pxv-7cmr-fjr4", "CVE-2026-34480", ["2.25.4"], "medium"),
+            vuln("GHSA-6hg6-v5c8-fphq", "CVE-2026-34477", ["2.25.4"], "medium"),
+            vuln("GHSA-vc5p-v9hr-52mj", "CVE-2025-68161", ["2.25.3"], "medium"),
+        ]);
+        const suggestion = suggestUpgradeForPackage(log4j);
+        // 2.14系統向けの修正版は存在しない → 同一メジャー内の最大 2.25.4
+        expect(suggestion.recommended_upgrade).toBe("2.25.4");
+        expect(suggestion.upgrade_tier).toBe("major_internal");
+        expect(suggestion.upgrade_note).toContain("2.14系統向けの修正版は存在しない");
+        expect(suggestion.upgrade_note).toContain("2.25.4");
+        // CVEごとのTier: 2.14.1より古いバックポート(2.3.x/2.12.x)は候補にならない
+        const log4shell = suggestion.per_cve_detail.find((d) => d.cve === "CVE-2021-44228");
+        expect(log4shell.fixed_in).toBe("2.15.0");
+        expect(log4shell.tier).toBe("major_internal");
+        expect(suggestion.per_cve_detail.every((d) => d.tier === "major_internal")).toBe(true);
+    });
+    it("Tier 1: 同一major.minor系統内の最小修正版を優先する", () => {
+        const suggestion = suggestUpgradeForPackage(pkg("a:a", "2.14.1", [vuln("GHSA-1", "CVE-1", ["2.15.0", "2.14.3", "2.14.2"])]));
+        expect(suggestion.per_cve_detail[0].fixed_in).toBe("2.14.2");
+        expect(suggestion.per_cve_detail[0].tier).toBe("same_minor");
+        expect(suggestion.recommended_upgrade).toBe("2.14.2");
+        expect(suggestion.upgrade_tier).toBe("same_minor");
+        expect(suggestion.upgrade_note).toContain("現在の2.14系統内");
+    });
+    it("Tier 3: 同一メジャー内に修正版がなければメジャーアップグレードを明示する", () => {
+        const suggestion = suggestUpgradeForPackage(pkg("a:a", "1.2.3", [vuln("GHSA-1", "CVE-1", ["2.0.0", "3.0.0"])]));
+        expect(suggestion.recommended_upgrade).toBe("2.0.0");
+        expect(suggestion.upgrade_tier).toBe("cross_major");
+        expect(suggestion.upgrade_note).toContain("メジャーアップグレード");
+        expect(suggestion.upgrade_note).toContain("破壊的変更");
+    });
+    it("複数CVEの推奨は「全CVEを解消できる最小バージョン」(Tier結果の最大)", () => {
+        const suggestion = suggestUpgradeForPackage(pkg("a:a", "2.14.1", [
+            vuln("GHSA-1", "CVE-1", ["2.14.2"]), // same_minorで解消可能
+            vuln("GHSA-2", "CVE-2", ["2.16.0"]), // major_internalが必要
+        ]));
+        expect(suggestion.recommended_upgrade).toBe("2.16.0");
+        // 実際のアップグレード距離で再分類される(same_minorではない)
+        expect(suggestion.upgrade_tier).toBe("major_internal");
+    });
+    it("unfixed: 修正版が空、または現在以下しか無いCVEは推奨計算から除外して明示する", () => {
+        const suggestion = suggestUpgradeForPackage(pkg("a:a", "2.14.1", [
+            vuln("GHSA-1", "CVE-1", []), // 修正版なし
+            vuln("GHSA-2", "CVE-2", ["2.12.2"]), // 別ブランチ向けバックポートのみ
+            vuln("GHSA-3", "CVE-3", ["2.15.0"]),
+        ]));
+        expect(suggestion.recommended_upgrade).toBe("2.15.0");
+        const tiers = Object.fromEntries(suggestion.per_cve_detail.map((d) => [d.id, d.tier]));
+        expect(tiers).toEqual({ "GHSA-1": "unfixed", "GHSA-2": "unfixed", "GHSA-3": "major_internal" });
+        expect(suggestion.upgrade_note).toContain("残り2件は修正版が存在せず");
+    });
+    it("全CVEがunfixedならrecommended_upgradeはnull", () => {
+        const suggestion = suggestUpgradeForPackage(pkg("a:a", "3.2.1", [vuln("GHSA-1", "CVE-1", []), vuln("GHSA-2", null, ["3.0.0"])]));
+        expect(suggestion.recommended_upgrade).toBeNull();
+        expect(suggestion.upgrade_tier).toBeNull();
+        expect(suggestion.upgrade_note).toContain("全2件");
+        expect(suggestion.upgrade_note).toContain("unfixed");
+    });
+    it("系統を判定できないバージョンはcross_major扱いで全体最小を提示する", () => {
+        const suggestion = suggestUpgradeForPackage(pkg("a:a", "unknown-version", [vuln("GHSA-1", "CVE-1", ["1.2.3", "2.0.0"])]));
+        expect(suggestion.recommended_upgrade).toBe("1.2.3");
+        expect(suggestion.upgrade_tier).toBe("cross_major");
+        expect(suggestion.upgrade_note).toContain("系統を判定できない");
+    });
+    it("Maven優先順位で比較する(2.9.0 < 2.10.0、修飾子付きも正しく扱う)", () => {
+        const suggestion = suggestUpgradeForPackage(pkg("a:a", "2.9.0", [vuln("GHSA-1", "CVE-1", ["2.10.0", "2.9.1-RELEASE"])]));
+        // 2.9.1-RELEASE(=2.9.1)が同一系統内の修正版として選ばれる
+        expect(suggestion.per_cve_detail[0].fixed_in).toBe("2.9.1-RELEASE");
+        expect(suggestion.per_cve_detail[0].tier).toBe("same_minor");
+    });
+});
+describe("suggestUpgrades", () => {
+    it("パッケージの並び順(深刻度順)を維持したまま提案一覧を返す", () => {
+        const suggestions = suggestUpgrades([
+            pkg("a:critical-pkg", "1.0", [vuln("GHSA-1", "CVE-1", ["1.1"], "critical")]),
+            pkg("b:low-pkg", "1.0", [vuln("GHSA-2", "CVE-2", ["1.2"], "low")]),
+        ]);
+        expect(suggestions.map((s) => s.package)).toEqual(["a:critical-pkg", "b:low-pkg"]);
+    });
+});

package/dist/test/tools/explainVulnerability.test.js

@@ -0,0 +1,39 @@
+import { describe, expect, it } from "vitest";
+import { handleExplainVulnerability } from "../../tools/explainVulnerability.js";
+function parsePayload(result) {
+    return JSON.parse(result.content[0].text);
+}
+describe("handleExplainVulnerability", () => {
+    it("取得したレコードを構造化して返す", async () => {
+        const result = await handleExplainVulnerability({ vulnerability_id: "GHSA-jfh8-c2jp-5v3q" }, {
+            fetchFn: async () => new Response(JSON.stringify({
+                id: "GHSA-jfh8-c2jp-5v3q",
+                aliases: ["CVE-2021-44228"],
+                summary: "Remote code injection in Log4j",
+            }), { status: 200 }),
+        });
+        expect(result.isError).toBeUndefined();
+        const payload = parsePayload(result);
+        expect(payload.id).toBe("GHSA-jfh8-c2jp-5v3q");
+        expect(payload.aliases).toEqual(["CVE-2021-44228"]);
+    });
+    it("不正なIDはinvalid_vulnerability_idエラーになる(fetchは呼ばれない)", async () => {
+        let fetchCalled = false;
+        const result = await handleExplainVulnerability({ vulnerability_id: "../v1/query" }, {
+            fetchFn: async () => {
+                fetchCalled = true;
+                return new Response("{}", { status: 200 });
+            },
+        });
+        expect(result.isError).toBe(true);
+        expect(fetchCalled).toBe(false);
+        const payload = parsePayload(result);
+        expect(payload.error.kind).toBe("invalid_vulnerability_id");
+    });
+    it("404はvulnerability_not_foundエラーとして返る", async () => {
+        const result = await handleExplainVulnerability({ vulnerability_id: "GHSA-none-none-none" }, { fetchFn: async () => new Response("{}", { status: 404 }) });
+        expect(result.isError).toBe(true);
+        const payload = parsePayload(result);
+        expect(payload.error.kind).toBe("vulnerability_not_found");
+    });
+});

package/dist/test/tools/scanJavaProject.test.js

@@ -0,0 +1,87 @@
+import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { handleScanJavaProject } from "../../tools/scanJavaProject.js";
+let binDir;
+let projectDir;
+async function makeFakeBinary(name, script) {
+    const filePath = path.join(binDir, name);
+    await writeFile(filePath, `#!/bin/sh\n${script}\n`);
+    await chmod(filePath, 0o755);
+    return filePath;
+}
+const VULN_JSON = JSON.stringify({
+    results: [
+        {
+            source: { path: "/x/pom.xml" },
+            packages: [
+                {
+                    package: { name: "a:a", version: "1.0", ecosystem: "Maven" },
+                    groups: [{ ids: ["GHSA-test"], aliases: ["CVE-2020-1"], max_severity: "9.9" }],
+                },
+            ],
+        },
+    ],
+});
+function parsePayload(result) {
+    expect(result.content).toHaveLength(1);
+    expect(result.content[0].type).toBe("text");
+    return JSON.parse(result.content[0].text);
+}
+beforeAll(async () => {
+    binDir = await mkdtemp(path.join(os.tmpdir(), "osv-mcp-tool-bin-"));
+    projectDir = await mkdtemp(path.join(os.tmpdir(), "osv-mcp-tool-proj-"));
+    await writeFile(path.join(projectDir, "pom.xml"), "<project/>");
+});
+afterAll(async () => {
+    await rm(binDir, { recursive: true, force: true });
+    await rm(projectDir, { recursive: true, force: true });
+});
+describe("handleScanJavaProject", () => {
+    it("成功時はproject_dir/manifests付きのレポートJSONを返す", async () => {
+        const bin = await makeFakeBinary("ok", `echo '${VULN_JSON}'; exit 1`);
+        const result = await handleScanJavaProject({ project_path: projectDir }, { binaryPath: bin });
+        expect(result.isError).toBeUndefined();
+        const payload = parsePayload(result);
+        expect(payload.manifests).toEqual(["pom.xml"]);
+        expect(payload.vulnerability_count).toBe(1);
+        expect(typeof payload.project_dir).toBe("string");
+    });
+    it("ScanToolErrorはisError+kind付きのエラーJSONに変換される", async () => {
+        const result = await handleScanJavaProject({ project_path: "/no/such/path" }, { binaryPath: "/unused" });
+        expect(result.isError).toBe(true);
+        const payload = parsePayload(result);
+        expect(payload.error.kind).toBe("project_not_found");
+        expect(payload.error.message).toBeTruthy();
+    });
+    it("スキャン失敗時はstderr抜粋がdetailに入る", async () => {
+        const bin = await makeFakeBinary("broken", `echo 'kaboom' >&2; exit 127`);
+        const result = await handleScanJavaProject({ project_path: projectDir }, { binaryPath: bin });
+        expect(result.isError).toBe(true);
+        const payload = parsePayload(result);
+        expect(payload.error.kind).toBe("scan_failed");
+        expect(payload.error.detail).toContain("kaboom");
+    });
+    it("ScanToolError以外の想定外例外はinternal_errorに丸め、内部情報を漏らさない", async () => {
+        // 空文字のbinaryPathはspawnがTypeErrorを投げる(ScanToolErrorではない例外の代表例)
+        const result = await handleScanJavaProject({ project_path: projectDir }, { binaryPath: "" });
+        expect(result.isError).toBe(true);
+        const payload = parsePayload(result);
+        expect(payload.error.kind).toBe("internal_error");
+        expect(payload.error.message).not.toContain("TypeError");
+        expect(JSON.stringify(payload)).not.toContain("stack");
+    });
+    it("allowedRoot外のパスはpath_outside_allowed_rootで拒否される", async () => {
+        const otherRoot = await mkdtemp(path.join(os.tmpdir(), "osv-mcp-tool-root-"));
+        try {
+            const result = await handleScanJavaProject({ project_path: projectDir }, { binaryPath: "/unused", allowedRoot: otherRoot });
+            expect(result.isError).toBe(true);
+            const payload = parsePayload(result);
+            expect(payload.error.kind).toBe("path_outside_allowed_root");
+        }
+        finally {
+            await rm(otherRoot, { recursive: true, force: true });
+        }
+    });
+});

package/dist/test/tools/suggestFix.test.js

@@ -0,0 +1,79 @@
+import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { handleSuggestFix } from "../../tools/suggestFix.js";
+let binDir;
+let projectDir;
+async function makeFakeBinary(name, script) {
+    const filePath = path.join(binDir, name);
+    await writeFile(filePath, `#!/bin/sh\n${script}\n`);
+    await chmod(filePath, 0o755);
+    return filePath;
+}
+// 2.14.1に対し、same_minor修正なし・同一メジャー内の修正(2.15.0)あり、
+// さらにunfixedなCVEを1件含むスキャン結果
+const SCAN_JSON = JSON.stringify({
+    results: [
+        {
+            source: { path: "/x/pom.xml" },
+            packages: [
+                {
+                    package: { name: "a:a", version: "2.14.1", ecosystem: "Maven" },
+                    groups: [
+                        { ids: ["GHSA-fix"], aliases: ["CVE-2021-1"], max_severity: "9.0" },
+                        { ids: ["GHSA-unfixed"], aliases: ["CVE-2021-2"], max_severity: "5.0" },
+                    ],
+                    vulnerabilities: [
+                        {
+                            id: "GHSA-fix",
+                            affected: [
+                                {
+                                    package: { name: "a:a", ecosystem: "Maven" },
+                                    ranges: [
+                                        { type: "ECOSYSTEM", events: [{ introduced: "0" }, { fixed: "2.12.2" }] },
+                                        { type: "ECOSYSTEM", events: [{ introduced: "2.13.0" }, { fixed: "2.15.0" }] },
+                                    ],
+                                },
+                            ],
+                        },
+                        { id: "GHSA-unfixed", affected: [] },
+                    ],
+                },
+            ],
+        },
+    ],
+});
+function parsePayload(result) {
+    return JSON.parse(result.content[0].text);
+}
+beforeAll(async () => {
+    binDir = await mkdtemp(path.join(os.tmpdir(), "osv-mcp-fix-bin-"));
+    projectDir = await mkdtemp(path.join(os.tmpdir(), "osv-mcp-fix-proj-"));
+    await writeFile(path.join(projectDir, "pom.xml"), "<project/>");
+});
+afterAll(async () => {
+    await rm(binDir, { recursive: true, force: true });
+    await rm(projectDir, { recursive: true, force: true });
+});
+describe("handleSuggestFix", () => {
+    it("スキャン結果から3段階Tierの提案を組み立てて返す", async () => {
+        const bin = await makeFakeBinary("ok", `echo '${SCAN_JSON}'; exit 1`);
+        const result = await handleSuggestFix({ project_path: projectDir }, { binaryPath: bin });
+        expect(result.isError).toBeUndefined();
+        const payload = parsePayload(result);
+        expect(payload.vulnerable_package_count).toBe(1);
+        expect(payload.unfixed_vulnerability_count).toBe(1);
+        const suggestion = payload.suggestions[0];
+        expect(suggestion.recommended_upgrade).toBe("2.15.0");
+        expect(suggestion.upgrade_tier).toBe("major_internal");
+        const tiers = Object.fromEntries(suggestion.per_cve_detail.map((d) => [d.id, d.tier]));
+        expect(tiers).toEqual({ "GHSA-fix": "major_internal", "GHSA-unfixed": "unfixed" });
+    });
+    it("エラーはscan_java_projectと同じ形式(kind付きJSON)で返す", async () => {
+        const result = await handleSuggestFix({ project_path: "/no/such/path" }, { binaryPath: "/unused" });
+        expect(result.isError).toBe(true);
+        const payload = parsePayload(result);
+        expect(payload.error.kind).toBe("project_not_found");
+    });
+});