sparda-mcp 0.14.0 → 0.14.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sparda-mcp",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "mcpName": "io.github.zyx77550/sparda-mcp",
   "description": "Compile backends to behavior graphs. Statically prove security, simulate APIs, and replay bugs.",
   "type": "module",

package/src/commands/apocalypse.js

@@ -16,7 +16,7 @@ import { atomicWriteFileSync as atomicWrite } from '../server/persistence.js';
 const ICONS = { critical: '✗', high: '✗', medium: '⚠', info: '·' };
 
 export async function runApocalypse(opts) {
-  const { graph } = compileUBG(opts.cwd, { write: false });
+  const { graph, report } = compileUBG(opts.cwd, { write: false });
   const canonical = canonicalizeGraph(graph);
   const baselinePath = path.join(opts.cwd, '.sparda', 'ubg.baseline.json');
 
@@ -42,7 +42,7 @@ export async function runApocalypse(opts) {
   }
 
   const findings = [...staticFindings, ...diffFindings];
-  const verdict = verdictOf(findings);
+  const verdict = verdictOf(findings, canonical);
 
   if (opts.sarif) {
     const sarifPath = path.join(opts.cwd, '.sparda', 'apocalypse.sarif');
@@ -64,7 +64,21 @@ export async function runApocalypse(opts) {
       console.log(`  ${ICONS[f.severity]} [${f.severity}] ${f.rule} — ${f.message}`);
       if (opts.verbose) for (const ev of f.evidence) console.log(`      evidence: ${ev}`);
     }
-    if (verdict.clean) {
+    if (!verdict.provable) {
+      console.log(
+        `✗ NO PROOF — 0 routes reached. SPARDA could not see this app's surface (a parser-coverage gap, not a clean bill of health); an empty graph proves nothing. This is NOT a pass — run with --verbose to see what was skipped.`,
+      );
+      if (opts.verbose) {
+        console.log(`      detected: ${report.framework} · entry ${report.entry}`);
+        if (report.skipped?.length)
+          for (const s of report.skipped)
+            console.log(`      skipped: ${s.reason}${s.file ? ` (${s.file})` : ''}`);
+        else
+          console.log(
+            `      no route call sites reached — routes are likely registered indirectly (a loader / DI pattern the static walk can't follow).`,
+          );
+      }
+    } else if (verdict.clean) {
       console.log(
         `✓ PROVEN — ${obligations} obligation(s) discharged, zero violations. No declared guard, invariant, transaction or aggregate boundary can be broken by this tree.`,
       );

package/src/commands/review.js

@@ -59,7 +59,7 @@ export function reviewGraphs(baseGraph, candidateGraph) {
   const removedEps = [...baseEps].filter((e) => !candEps.has(e)).sort(cmp);
 
   return {
-    verdict: verdictOf(findings),
+    verdict: verdictOf(findings, candidateGraph),
     obligations,
     findings,
     endpoints: { added, removed: removedEps },
@@ -168,7 +168,11 @@ function renderHuman(r) {
   }
 
   const c = v.counts;
-  if (v.clean)
+  if (!v.provable)
+    console.log(
+      "\n✗ NO PROOF — 0 routes reached in the working tree; SPARDA could not see this change's route surface (a parser-coverage gap). An empty graph proves nothing — this is NOT a pass.",
+    );
+  else if (v.clean)
     console.log(
       '\n✓ PROVEN — this diff removes no protection and introduces no new risk.',
     );
@@ -181,9 +185,11 @@ function renderHuman(r) {
 function renderMarkdown(r) {
   const { verdict: v, findings, endpoints } = r;
   const c = v.counts;
-  const head = v.clean
-    ? '✓ **PROVEN** — no protection removed, no new risk introduced.'
-    : `${v.safe ? '⚠ **RISKY**' : '✗ **NOT PROVEN**'} — ${c.critical} critical, ${c.high} high, ${c.medium} medium, ${c.info} info.`;
+  const head = !v.provable
+    ? "✗ **NO PROOF** — 0 routes reached in the working tree; SPARDA could not see this change's route surface (a parser-coverage gap). An empty graph proves nothing — this is NOT a pass."
+    : v.clean
+      ? '✓ **PROVEN** — no protection removed, no new risk introduced.'
+      : `${v.safe ? '⚠ **RISKY**' : '✗ **NOT PROVEN**'} — ${c.critical} critical, ${c.high} high, ${c.medium} medium, ${c.info} info.`;
   const lines = [`## 🔍 SPARDA semantic review (vs \`${r.base}\`)`, '', head, ''];
   if (endpoints.added.length || endpoints.removed.length) {
     lines.push('### Endpoint surface');

package/src/ubg/apocalypse.js

@@ -251,13 +251,26 @@ export function diffGraphs(baseline, candidate) {
 
 // ---------------------------------------------------------------------------
 
-export function verdictOf(findings) {
+export function verdictOf(findings, graph) {
   const counts = { critical: 0, high: 0, medium: 0, info: 0 };
   for (const f of findings) counts[f.severity]++;
+  // Provability guard: a compile that reached ZERO entrypoints proved nothing —
+  // an empty graph must never read as PROVEN/RISKY. A parser-coverage miss (a
+  // route surface the static eye could not see) has to be loud, not a silent
+  // green. `safe`/`clean` fold `provable` in, so every caller that gates on them
+  // (apocalypse & review both `exit 1` on !safe) refuses a blind compile for free.
+  // `graph` omitted (e.g. heal's regression delta, which isn't a whole-app
+  // proof) → provability is not asserted and the old semantics hold.
+  const entrypoints = graph
+    ? graph.nodes.filter((n) => n.kind === 'entrypoint').length
+    : null;
+  const provable = entrypoints === null || entrypoints > 0;
   return {
     counts,
-    safe: counts.critical === 0 && counts.high === 0,
-    clean: findings.length === 0,
+    entrypoints,
+    provable,
+    safe: provable && counts.critical === 0 && counts.high === 0,
+    clean: provable && findings.length === 0,
   };
 }
 

package/src/ubg/express.js

@@ -150,16 +150,23 @@ export function extractExpress(cwd, entryFile) {
 
     function handleUse(args, stmt) {
       if (!args.length) return;
-      // app.use('/prefix', router) → mount for second pass
-      if (args[0].type === 'StringLiteral' && args[1]?.type === 'Identifier') {
-        mounts.push({
-          prefix: joinPath(prefix, args[0].value),
-          file: mod.imports.get(args[1].name) ?? null,
-          ident: args[1].name,
-          fromFile: relFile,
-          depth: depth + 1, // nested mounts keep sinking, scanFile bounds them
-        });
-        return;
+      // app.use('/prefix', router) → mount for second pass. The router arg is
+      // usually an imported Identifier, but the inline-require idiom
+      // `app.use('/x', require('./x.controller'))` (rootpath-style apps) is just
+      // as common — resolve it directly. `undefined` = not a router mount at all
+      // (fall through to global-middleware handling below).
+      if (args[0].type === 'StringLiteral') {
+        const target = mountTargetFile(args[1], mod, absFile);
+        if (target !== undefined) {
+          mounts.push({
+            prefix: joinPath(prefix, args[0].value),
+            file: target, // null = named/required but unresolved → reported in the mounts loop
+            ident: mountIdentName(args[1]),
+            fromFile: relFile,
+            depth: depth + 1, // nested mounts keep sinking, scanFile bounds them
+          });
+          return;
+        }
       }
       // app.use(fn) / app.use(ident) at depth 0 → global middleware
       if (depth === 0) {
@@ -326,6 +333,37 @@ function collectRouteArrays(body) {
   return arrays;
 }
 
+// The second arg of app.use('/p', X): where does the mounted router live?
+//   Identifier            → the import it resolves to (null if unresolved)
+//   require('./x')        → the relative file it resolves to (null if non-relative)
+//   anything else         → undefined (not a router mount; e.g. a middleware call)
+function mountTargetFile(arg, mod, absFile) {
+  if (!arg) return undefined;
+  if (arg.type === 'Identifier') return mod.imports.get(arg.name) ?? null;
+  if (
+    arg.type === 'CallExpression' &&
+    arg.callee.type === 'Identifier' &&
+    arg.callee.name === 'require' &&
+    arg.arguments[0]?.type === 'StringLiteral'
+  ) {
+    return resolveRelImport(absFile, arg.arguments[0].value);
+  }
+  return undefined;
+}
+
+// a readable identifier for the mount's skipped-report when it can't resolve
+function mountIdentName(arg) {
+  if (arg?.type === 'Identifier') return arg.name;
+  if (
+    arg?.type === 'CallExpression' &&
+    arg.callee.type === 'Identifier' &&
+    arg.callee.name === 'require' &&
+    arg.arguments[0]?.type === 'StringLiteral'
+  )
+    return `require('${arg.arguments[0].value}')`;
+  return 'router';
+}
+
 function collectAppVars(node, appVars, routerVars) {
   if (node.type === 'ExportNamedDeclaration' && node.declaration)
     return collectAppVars(node.declaration, appVars, routerVars);