sdl-mcp 0.12.2 → 0.12.3

package/dist/cli/transport/http.js

@@ -1,7 +1,7 @@
 import { createReadStream, existsSync, statSync } from "fs";
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from "crypto";
 import { createServer } from "http";
-import { join } from "path";
+import { extname, isAbsolute, join, relative, resolve } from "path";
 import { fileURLToPath } from "url";
 import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
@@ -9,8 +9,6 @@ import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 import { createMCPServer, } from "../../server.js";
 import { logger } from "../../util/logger.js";
 import * as ladybugDb from "../../db/ladybug-queries.js";
-import { computeDelta } from "../../delta/diff.js";
-import { runGovernorLoop } from "../../delta/blastRadius.js";
 import { getLadybugConn } from "../../db/ladybug.js";
 import { indexRepo } from "../../indexer/indexer.js";
 import { formatDeferredWorkStatus, getActiveDeferredWorkStatus, } from "../../runtime/deferred-work-state.js";
@@ -18,14 +16,16 @@ import { BufferCheckpointRequestSchema, BufferPushRequestSchema, } from "../../m
 import { handleSymbolGetCard, handleSymbolSearch, } from "../../mcp/tools/symbol.js";
 import { getDefaultLiveIndexCoordinator } from "../../live-index/coordinator.js";
 import { routeConfigAdminApiRequest } from "../../config/admin-api.js";
+import { handleViewerApiRequest } from "../../viewer/routes.js";
+import { buildBlastRadiusGraph, buildGraphForSliceHandle, buildNeighborhood } from "../../viewer/legacy-graph.js";
 import { SessionManager } from "../../mcp/session-manager.js";
 import { createRuntimeIdentity } from "../../util/runtime-identity.js";
 const __dirname = fileURLToPath(new URL(".", import.meta.url));
 const UI_DIR_CANDIDATE = join(__dirname, "..", "..", "ui");
-// Ensure graph.html actually exists in the candidate — the compiled dist/ui
-// folder may contain only .js/.d.ts output from src/ui/graph.ts without the
-// html/css assets, in which case we must fall back to src/ui.
-const UI_DIR = existsSync(join(UI_DIR_CANDIDATE, "graph.html"))
+// Ensure observability.html actually exists in the candidate. The compiled
+// dist/ui folder may be missing copied html/css assets, in which case we must
+// fall back to src/ui.
+const UI_DIR = existsSync(join(UI_DIR_CANDIDATE, "observability.html"))
     ? UI_DIR_CANDIDATE
     : join(__dirname, "..", "..", "..", "src", "ui");
 /**
@@ -57,6 +57,7 @@ const OBSERVABILITY_UI_PATHS = new Set([
     "/ui/observability",
     "/ui/observability.js",
     "/ui/observability.css",
+    "/ui/viewer",
 ]);
 const LOCALHOST_ORIGIN_RE = /^https?:\/\/(localhost|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|\[::1\]|\[::ffff:127\.\d{1,3}\.\d{1,3}\.\d{1,3}\])(:\d+)?$/;
 function isLoopbackBindHost(host) {
@@ -217,7 +218,7 @@ class InMemoryEventStore {
     async replayEventsAfter(lastEventId, { send, }) {
         const entry = this.events.get(lastEventId);
         if (!entry) {
-            // Event was evicted by FIFO — return an empty replay rather than
+            // Event was evicted by FIFO — return an empty replay rather than
             // throwing, which would crash the SDK's resumability path (M4).
             return "";
         }
@@ -379,165 +380,44 @@ export async function routeSymbolCardApiRequest(request, services = {}) {
         },
     };
 }
-// ---------------------------------------------------------------------------
-// Graph visualization helpers
-// ---------------------------------------------------------------------------
-function toClusterPath(filePath) {
-    const slash = Math.max(filePath.lastIndexOf("/"), filePath.lastIndexOf("\\"));
-    if (slash === -1) {
-        return "root";
-    }
-    return filePath.slice(0, slash) || "root";
-}
-async function buildNodes(conn, symbolIds) {
-    const symbolMap = await ladybugDb.getSymbolsByIds(conn, symbolIds);
-    const metricsMap = await ladybugDb.getMetricsBySymbolIds(conn, symbolIds);
-    const fileIds = new Set();
-    for (const symbol of symbolMap.values()) {
-        fileIds.add(symbol.fileId);
-    }
-    const fileMap = await ladybugDb.getFilesByIds(conn, Array.from(fileIds));
-    const nodes = [];
-    for (const symbolId of symbolIds) {
-        const symbol = symbolMap.get(symbolId);
-        if (!symbol)
-            continue;
-        const file = fileMap.get(symbol.fileId);
-        const metrics = metricsMap.get(symbolId);
-        nodes.push({
-            id: symbolId,
-            label: symbol.name,
-            kind: symbol.kind,
-            file: file?.relPath,
-            fanIn: metrics?.fanIn,
-            fanOut: metrics?.fanOut,
-            size: Math.max(5, Math.min(40, (metrics?.fanIn ?? 0) + 6)),
-            cluster: toClusterPath(file?.relPath ?? ""),
-        });
-    }
-    return nodes;
-}
-async function buildLinksForNodes(conn, ids) {
-    const idList = Array.from(ids);
-    const edgeMap = await ladybugDb.getEdgesFromSymbolsForSlice(conn, idList);
-    const links = [];
-    for (const fromSymbolId of idList) {
-        const edges = edgeMap.get(fromSymbolId) ?? [];
-        for (const edge of edges) {
-            if (!ids.has(edge.toSymbolId))
-                continue;
-            links.push({
-                source: fromSymbolId,
-                target: edge.toSymbolId,
-                type: edge.edgeType,
-                weight: edge.weight,
-            });
-        }
+function contentTypeForUiPath(filePath) {
+    switch (extname(filePath)) {
+        case ".html":
+            return "text/html; charset=utf-8";
+        case ".css":
+            return "text/css; charset=utf-8";
+        case ".js":
+            return "application/javascript; charset=utf-8";
+        default:
+            return null;
     }
-    return links;
-}
-function collapseClusters(nodes, maxChildrenPerCluster = 10) {
-    const byCluster = new Map();
-    for (const node of nodes) {
-        const key = node.cluster ?? "root";
-        const list = byCluster.get(key) ?? [];
-        list.push(node);
-        byCluster.set(key, list);
-    }
-    const collapsed = [];
-    for (const [cluster, list] of byCluster) {
-        if (list.length <= maxChildrenPerCluster) {
-            collapsed.push(...list);
-            continue;
-        }
-        const sorted = [...list].sort((a, b) => (b.fanIn ?? 0) - (a.fanIn ?? 0));
-        collapsed.push(...sorted.slice(0, maxChildrenPerCluster));
-        collapsed.push({
-            id: `cluster:${cluster}`,
-            label: `${cluster} (+${list.length - maxChildrenPerCluster})`,
-            kind: "module",
-            cluster,
-            size: 10,
-        });
-    }
-    return collapsed;
-}
-async function buildNeighborhood(conn, symbolId, maxNodes) {
-    const ids = new Set();
-    ids.add(symbolId);
-    for (const edge of await ladybugDb.getEdgesFrom(conn, symbolId)) {
-        ids.add(edge.toSymbolId);
-    }
-    const edgesTo = await ladybugDb.getEdgesToSymbols(conn, [symbolId]);
-    for (const edge of edgesTo.get(symbolId) ?? []) {
-        ids.add(edge.fromSymbolId);
-    }
-    const limited = new Set(Array.from(ids).slice(0, maxNodes));
-    const nodes = await buildNodes(conn, Array.from(limited));
-    const links = await buildLinksForNodes(conn, limited);
-    return {
-        nodes: collapseClusters(nodes),
-        links,
-    };
 }
-async function buildRepoPreview(conn, repoId, maxNodes) {
-    const top = await ladybugDb.getTopSymbolsByFanIn(conn, repoId, maxNodes);
-    const symbolIds = top.map((row) => row.symbolId);
-    const ids = new Set(symbolIds);
-    const nodes = await buildNodes(conn, symbolIds);
-    const links = await buildLinksForNodes(conn, ids);
-    return {
-        nodes: collapseClusters(nodes),
-        links,
-    };
-}
-export async function buildGraphForSliceHandle(conn, repoId, handle, maxNodes, deps = {}) {
-    const getSliceHandleFn = deps.getSliceHandle ?? ladybugDb.getSliceHandle;
-    const buildRepoPreviewFn = deps.buildRepoPreview ?? buildRepoPreview;
-    const buildBlastRadiusGraphFn = deps.buildBlastRadiusGraph ?? buildBlastRadiusGraph;
-    const handleRow = await getSliceHandleFn(conn, handle);
-    if (!handleRow || handleRow.repoId !== repoId) {
+function getPrefixUiAsset(pathname) {
+    if (!pathname.startsWith("/ui/viewer/") && !pathname.startsWith("/ui/vendor/")) {
         return null;
     }
-    if (handleRow.minVersion && handleRow.maxVersion) {
-        return buildBlastRadiusGraphFn(conn, repoId, handleRow.minVersion, handleRow.maxVersion, maxNodes);
-    }
-    return buildRepoPreviewFn(conn, repoId, maxNodes);
+    const file = pathname.slice("/ui/".length);
+    const type = contentTypeForUiPath(file);
+    return type ? { file, type } : null;
 }
-async function buildBlastRadiusGraph(conn, repoId, fromVersion, toVersion, maxNodes) {
-    const delta = await computeDelta(repoId, fromVersion, toVersion);
-    const changedSymbolIds = delta.changedSymbols.map((change) => change.symbolId);
-    const governor = await runGovernorLoop(conn, changedSymbolIds, {
-        repoId,
-        budget: { maxCards: maxNodes, maxEstimatedTokens: 4000 },
-        runDiagnostics: false,
-    });
-    const ids = new Set();
-    for (const changed of delta.changedSymbols) {
-        ids.add(changed.symbolId);
-    }
-    for (const affected of governor.blastRadius) {
-        ids.add(affected.symbolId);
+function resolveUiAssetPath(file) {
+    const rootDir = resolve(UI_DIR);
+    const fullPath = resolve(rootDir, file);
+    const relativePath = relative(rootDir, fullPath);
+    if (relativePath.startsWith("..") || isAbsolute(relativePath)) {
+        return null;
     }
-    const limited = new Set(Array.from(ids).slice(0, maxNodes));
-    const nodes = await buildNodes(conn, Array.from(limited));
-    const links = await buildLinksForNodes(conn, limited);
-    return {
-        nodes: collapseClusters(nodes),
-        links,
-    };
+    return fullPath;
 }
-// ---------------------------------------------------------------------------
-// Static UI assets
-// ---------------------------------------------------------------------------
 function serveUiAsset(pathname, res) {
+    if (pathname === "/ui/graph" || pathname === "/ui/graph.html") {
+        res.writeHead(308, { Location: "/ui/viewer" });
+        res.end();
+        return true;
+    }
     const map = {
-        "/ui/graph": { file: "graph.html", type: "text/html; charset=utf-8" },
-        "/ui/graph.js": {
-            file: "graph.js",
-            type: "application/javascript; charset=utf-8",
-        },
-        "/ui/graph.css": { file: "graph.css", type: "text/css; charset=utf-8" },
+        "/ui/viewer": { file: "viewer/index.html", type: "text/html; charset=utf-8" },
+        "/ui/viewer/index.html": { file: "viewer/index.html", type: "text/html; charset=utf-8" },
         "/ui/observability": {
             file: "observability.html",
             type: "text/html; charset=utf-8",
@@ -561,11 +441,15 @@ function serveUiAsset(pathname, res) {
         },
         "/ui/config.css": { file: "config.css", type: "text/css; charset=utf-8" },
     };
-    const asset = map[pathname];
+    const asset = map[pathname] ?? getPrefixUiAsset(pathname);
     if (!asset) {
         return false;
     }
-    const fullPath = join(UI_DIR, asset.file);
+    const fullPath = resolveUiAssetPath(asset.file);
+    if (!fullPath) {
+        json(res, 404, { error: "UI asset not found" });
+        return true;
+    }
     try {
         if (!statSync(fullPath).isFile()) {
             json(res, 500, { error: "Failed to read UI asset" });
@@ -599,15 +483,18 @@ function serveUiAsset(pathname, res) {
         res.destroy(error instanceof Error ? error : undefined);
     });
     stream.once("open", () => {
-        res.writeHead(200, { "Content-Type": asset.type });
+        res.writeHead(200, { "Content-Type": asset.type, "Cache-Control": "no-cache" });
         stream.pipe(res);
     });
     return true;
 }
 // ---------------------------------------------------------------------------
 function serveObservabilityUiAsset(pathname, res) {
-    if (!OBSERVABILITY_UI_PATHS.has(pathname))
+    if (!OBSERVABILITY_UI_PATHS.has(pathname) &&
+        !pathname.startsWith("/ui/viewer/") &&
+        !pathname.startsWith("/ui/vendor/")) {
         return false;
+    }
     return serveUiAsset(pathname, res);
 }
 async function handleHealthRequest(req, res, checkHealth) {
@@ -695,6 +582,87 @@ async function routeObservabilityApiRequest(req, res, url, services) {
             json(res, 503, { error: "observability_disabled" });
             return true;
         }
+        if ((url.searchParams.get("types") ?? "").trim() === "graph") {
+            setCorsHeaders(req, res);
+            res.writeHead(200, {
+                "Content-Type": "text/event-stream",
+                "Cache-Control": "no-cache, no-transform",
+                Connection: "keep-alive",
+                "X-Accel-Buffering": "no",
+            });
+            let closed = false;
+            let unsubscribe = null;
+            let heartbeatTimer = null;
+            let maxStreamTimer = null;
+            const sendGraphEvent = (data) => {
+                if (closed || res.destroyed)
+                    return false;
+                try {
+                    const ok = res.write(`event: graph\ndata: ${JSON.stringify(data)}\n\n`);
+                    return ok && res.writableLength <= 1_048_576;
+                }
+                catch (err) {
+                    logger.warn("Graph SSE write failed", { error: err });
+                    return false;
+                }
+            };
+            const cleanupGraph = () => {
+                if (closed)
+                    return;
+                closed = true;
+                if (heartbeatTimer) {
+                    clearInterval(heartbeatTimer);
+                    heartbeatTimer = null;
+                }
+                if (maxStreamTimer) {
+                    clearTimeout(maxStreamTimer);
+                    maxStreamTimer = null;
+                }
+                if (unsubscribe) {
+                    unsubscribe();
+                    unsubscribe = null;
+                }
+            };
+            const endGraphStream = () => {
+                cleanupGraph();
+                try {
+                    res.end();
+                }
+                catch {
+                    /* best-effort */
+                }
+            };
+            req.on("close", cleanupGraph);
+            for (const event of observabilityService.getRecentGraphEvents(200)) {
+                if (!sendGraphEvent(event)) {
+                    endGraphStream();
+                    return true;
+                }
+            }
+            unsubscribe = observabilityService.onGraphEvent((event) => {
+                if (!sendGraphEvent(event)) {
+                    endGraphStream();
+                }
+            });
+            heartbeatTimer = setInterval(() => {
+                if (closed || res.destroyed) {
+                    cleanupGraph();
+                    return;
+                }
+                try {
+                    res.write(": heartbeat\n\n");
+                }
+                catch {
+                    endGraphStream();
+                }
+            }, sseHeartbeatMs);
+            heartbeatTimer.unref();
+            maxStreamTimer = setTimeout(() => {
+                endGraphStream();
+            }, sseMaxStreamMs);
+            maxStreamTimer.unref();
+            return true;
+        }
         const repoId = (url.searchParams.get("repoId") ?? "").trim();
         if (!repoId) {
             json(res, 400, { error: "missing_repoId" });
@@ -821,6 +789,10 @@ export async function handleObservabilityDashboardRequest(req, res, host, port,
         return true;
     }
     try {
+        if (pathname.startsWith("/api/graph/") &&
+            (await handleViewerApiRequest(req, res, pathname, url, services.observabilityService ?? null))) {
+            return true;
+        }
         return await routeObservabilityApiRequest(req, res, url, services);
     }
     catch (error) {
@@ -899,9 +871,12 @@ async function handleRestRequest(req, res, host, port, checkHealth, services) {
             return true;
         }
     }
-    // DB-dependent REST API routes — wrapped in try/catch for structured errors.
+    // DB-dependent REST API routes — wrapped in try/catch for structured errors.
     // Connection is acquired lazily per-route to avoid unnecessary pool checkouts.
     try {
+        if (await handleViewerApiRequest(req, res, pathname, url, services.observabilityService)) {
+            return true;
+        }
         const graphSliceMatch = pathname.match(/^\/api\/graph\/([^/]+)\/slice\/([^/]+)$/);
         if (req.method === "GET" && graphSliceMatch) {
             const conn = await getLadybugConn();
@@ -1030,7 +1005,7 @@ async function handleRestRequest(req, res, host, port, checkHealth, services) {
             });
             return true;
         }
-        // SSE streaming reindex endpoint — streams progress events, then a
+        // SSE streaming reindex endpoint — streams progress events, then a
         // final "complete" or "error" event. Used by `sdl-mcp index` when it
         // detects a running HTTP server and delegates indexing.
         const reindexStreamMatch = pathname.match(/^\/api\/repo\/([^/]+)\/reindex-stream$/);
@@ -1049,7 +1024,7 @@ async function handleRestRequest(req, res, host, port, checkHealth, services) {
                 }
             }
             catch {
-                // Empty or invalid body — use default mode
+                // Empty or invalid body — use default mode
             }
             // Set up SSE response
             setCorsHeaders(req, res);
@@ -1234,7 +1209,7 @@ async function handleMcpStreamableRequest(req, res, ctx) {
                         ctx.cleanupSession(registeredSessionId);
                     }
                     else {
-                        // MCPServer was created but never connected — stop it directly
+                        // MCPServer was created but never connected — stop it directly
                         void mcpServer.stop().catch((err) => {
                             logger.debug("Failed to stop unconnected MCP server", {
                                 error: err,
@@ -1305,7 +1280,7 @@ async function handleMcpStreamableRequest(req, res, ctx) {
     }
 }
 /**
- * Handle `GET /sse` — establishes a new SSE (deprecated) transport session.
+ * Handle `GET /sse` — establishes a new SSE (deprecated) transport session.
  * Validates the `Accept: text/event-stream` header, reserves a session slot,
  * creates the SSEServerTransport, and connects a new per-session MCP server.
  */
@@ -1364,7 +1339,7 @@ async function handleSseConnection(req, res, ctx) {
     }
 }
 /**
- * Handle `POST /message` — routes an incoming MCP message to an existing SSE
+ * Handle `POST /message` — routes an incoming MCP message to an existing SSE
  * (deprecated) session identified by the `sessionId` query parameter.
  */
 function handleSseMessage(req, res, url, ctx) {
@@ -1436,7 +1411,8 @@ export async function setupObservabilityDashboardSidecar(port, services = {}, ht
             const url = new URL(req.url ?? "/", `http://${host}:${port}`);
             const pathname = url.pathname;
             if (req.method !== "OPTIONS" &&
-                pathname.startsWith("/api/observability/") &&
+                (pathname.startsWith("/api/observability/") ||
+                    pathname.startsWith("/api/graph/")) &&
                 authToken &&
                 !isAuthorized(req, authToken)) {
                 const rateLimit = authRateLimiter.consume(getAuthRateLimitKey(req));
@@ -1536,7 +1512,7 @@ export async function setupHttpTransport(host, port, _graphDbPath, services = {}
     const cleanedUp = new Set();
     const sessionManager = services.sessionManager ?? new SessionManager(8);
     /**
-     * Idempotent session cleanup — safe to call from onclose, idle reaper,
+     * Idempotent session cleanup — safe to call from onclose, idle reaper,
      * error handlers, or graceful shutdown. Cleans transport, MCPServer, and
      * session manager state exactly once per session.
      */
@@ -1584,7 +1560,7 @@ export async function setupHttpTransport(host, port, _graphDbPath, services = {}
         effectiveServices,
         cleanupSession,
     };
-    // DB is already initialized by serve.ts → initGraphDb() before this
+    // DB is already initialized by serve.ts → initGraphDb() before this
     // function is called. A redundant initLadybugDb() here risked a
     // close+reopen cycle when normalizeGraphDbPath() returned a different
     // path (the DB directory now exists, flipping the hint from "file" to
@@ -1616,7 +1592,7 @@ export async function setupHttpTransport(host, port, _graphDbPath, services = {}
                 (pathname === "/.well-known/oauth-authorization-server" ||
                     pathname === "/.well-known/oauth-protected-resource")) {
                 json(res, 404, {
-                    error: "OAuth discovery not supported — this server does not require authentication",
+                    error: "OAuth discovery not supported — this server does not require authentication",
                 });
                 return;
             }
@@ -1666,14 +1642,14 @@ export async function setupHttpTransport(host, port, _graphDbPath, services = {}
                 return;
             }
             // ---------------------------------------------------------------
-            // Streamable HTTP Transport — /mcp (POST, GET, DELETE)
+            // Streamable HTTP Transport — /mcp (POST, GET, DELETE)
             // ---------------------------------------------------------------
             if (pathname === "/mcp") {
                 await handleMcpStreamableRequest(req, res, sessionCtx);
                 return;
             }
             // ---------------------------------------------------------------
-            // Deprecated SSE Transport — /sse (GET) + /message (POST)
+            // Deprecated SSE Transport — /sse (GET) + /message (POST)
             // Supports multiple concurrent SSE sessions (no singleton)
             // ---------------------------------------------------------------
             if (req.method === "GET" && pathname === "/sse") {
@@ -1734,7 +1710,7 @@ export async function setupHttpTransport(host, port, _graphDbPath, services = {}
             console.error(`  - SSE endpoint:    http://${host}:${actualPort}/sse`);
             console.error(`  - Sessions:        http://${host}:${actualPort}/api/sessions`);
             console.error(`  - Health check:    http://${host}:${actualPort}/health`);
-            console.error(`  - Graph UI:        http://${host}:${actualPort}/ui/graph`);
+            console.error(`  - Graph UI:        http://${host}:${actualPort}/ui/viewer`);
             if (host !== "localhost" && host !== "127.0.0.1" && host !== "::1") {
                 console.error(`\n  WARNING: Server is listening on ${host} over plaintext HTTP.` +
                     `\n  Traffic (including code content) is NOT encrypted.` +