sparda-mcp 0.63.0 → 0.64.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sparda-mcp",
-  "version": "0.63.0",
+  "version": "0.64.0",
   "mcpName": "io.github.zyx77550/sparda-mcp",
   "description": "Compile backends to behavior graphs. Statically prove security, simulate APIs, and replay bugs.",
   "type": "module",

package/src/commands/apocalypse.js

@@ -45,8 +45,12 @@ export async function runApocalypse(opts) {
   const findings = [...staticFindings, ...diffFindings];
   // the honesty companion: where does the proof stop? (see `sparda blindspots`)
   const blind = surveyBlindspots(canonical, report);
-  // coverage feeds the verdict: a clean app that resolved almost nothing is SURFACE, not PROVEN
-  const verdict = verdictOf(findings, canonical, { coverage: blind.coverage.ratio });
+  // coverage feeds the verdict: a clean app that resolved almost nothing is SURFACE, not PROVEN;
+  // and any high-risk blind spot pulls a bare PROVEN down to PARTIAL (E-047, the giant-test rung)
+  const verdict = verdictOf(findings, canonical, {
+    coverage: blind.coverage.ratio,
+    blindHigh: blind.byRisk.critical + blind.byRisk.high,
+  });
 
   if (opts.sarif) {
     const sarifPath = path.join(opts.cwd, '.sparda', 'apocalypse.sarif');

package/src/commands/badge.js

@@ -16,7 +16,10 @@ export async function runBadge(opts) {
   const canonical = canonicalizeGraph(graph);
   const { findings } = checkGraph(canonical);
   const blind = surveyBlindspots(canonical, report);
-  const verdict = verdictOf(findings, canonical, { coverage: blind.coverage.ratio });
+  const verdict = verdictOf(findings, canonical, {
+    coverage: blind.coverage.ratio,
+    blindHigh: blind.byRisk.critical + blind.byRisk.high,
+  });
   const cov = Math.round(blind.coverage.ratio * 100);
   const { state, message, color } = badgeFor(verdict, { coverage: blind.coverage.ratio });
 

package/src/commands/dossier.js

@@ -21,7 +21,10 @@ export async function runDossier(opts) {
   const { findings, polarity } = checkGraph(canonical);
   const capsule = buildCapsule(canonical);
   const blindspots = surveyBlindspots(canonical, compiled.report);
-  const verdict = verdictOf(findings, canonical, { coverage: blindspots.coverage.ratio });
+  const verdict = verdictOf(findings, canonical, {
+    coverage: blindspots.coverage.ratio,
+    blindHigh: blindspots.byRisk.critical + blindspots.byRisk.high,
+  });
 
   const data = {
     app: path.basename(path.resolve(opts.cwd)) || 'app',

package/src/commands/init.js

@@ -48,6 +48,17 @@ export async function runInit(opts) {
     s.stop(
       `Stack detected: ${c.cyan('Next.js (App Router)')} — app dir: ${stack.entryFile}/, port: ${stack.port}`,
     );
+  } else {
+    s.stop(
+      `Stack detected: ${c.cyan(stack.framework)} — but AST parsing is not supported yet.`,
+    );
+    throw Object.assign(
+      new Error(`AST extraction for ${stack.framework} is not yet supported.`),
+      {
+        code: 'USER',
+        hint: `SPARDA detected ${stack.framework}, but currently only supports Express, FastAPI, and Next.js for AST parsing. NestJS and others are on the roadmap!`,
+      },
+    );
   }
 
   // Opt-in runtime probe (Brief #3): static is the floor, probe only ADDS routes

package/src/commands/prove.js

@@ -19,7 +19,10 @@ export async function runProve(opts) {
 
   const { findings, obligations } = checkGraph(canonical);
   const blind = surveyBlindspots(canonical, report);
-  const verdict = verdictOf(findings, canonical, { coverage: blind.coverage.ratio });
+  const verdict = verdictOf(findings, canonical, {
+    coverage: blind.coverage.ratio,
+    blindHigh: blind.byRisk.critical + blind.byRisk.high,
+  });
   const capsule = buildCapsule(canonical);
   const prints = fingerprintGraph(canonical);
   // one app-level seal: a content address over every route's behavior hash — the same

package/src/commands/review.js

@@ -62,11 +62,15 @@ export function reviewGraphs(baseGraph, candidateGraph) {
   // how much of the changed app SPARDA could actually see — and whether this PR moved
   // that boundary. A green review over a graph the PR made 20% blinder is not the same
   // as a green review at full sight; the reviewer must be able to tell them apart.
-  const candCov = surveyBlindspots(candidateGraph).coverage.ratio;
+  const candBlind = surveyBlindspots(candidateGraph);
+  const candCov = candBlind.coverage.ratio;
   const baseCov = surveyBlindspots(baseGraph).coverage.ratio;
 
   return {
-    verdict: verdictOf(findings, candidateGraph, { coverage: candCov }),
+    verdict: verdictOf(findings, candidateGraph, {
+      coverage: candCov,
+      blindHigh: candBlind.byRisk.critical + candBlind.byRisk.high,
+    }),
     obligations,
     findings,
     endpoints: { added, removed: removedEps },

package/src/server/stdio.js

@@ -1186,7 +1186,10 @@ export function proveApp(cwd, { route } = {}) {
   const blind = surveyBlindspots(canonical, report);
   // The verdict word always reflects the WHOLE app (a route filter narrows the finding list,
   // never the safety claim — an AI must never read "PROVEN" because it hid the rest).
-  const verdict = verdictOf(all, canonical, { coverage: blind.coverage.ratio });
+  const verdict = verdictOf(all, canonical, {
+    coverage: blind.coverage.ratio,
+    blindHigh: blind.byRisk.critical + blind.byRisk.high,
+  });
   return {
     verdict: verdictState(verdict),
     provable: verdict.provable,

package/src/ubg/apocalypse.js

@@ -488,7 +488,7 @@ const COVERAGE_FLOOR = 0.05;
 // finding, never changes the CI gate; a PARTIAL app is still clean, just qualified.
 const COVERAGE_COMPLETE = 0.6;
 
-export function verdictOf(findings, graph, { coverage } = {}) {
+export function verdictOf(findings, graph, { coverage, blindHigh = 0 } = {}) {
   const counts = { critical: 0, high: 0, medium: 0, info: 0 };
   for (const f of findings) counts[f.severity]++;
   // Advisory findings (BOLA/IDOR, ADR-058) are absence-based and FP-prone: they point a
@@ -528,9 +528,20 @@ export function verdictOf(findings, graph, { coverage } = {}) {
   // A clean whole-app proof below the completeness bar is PARTIAL — proved, but not over
   // the whole surface. Only meaningful when coverage was measured (whole-app run); a partial
   // graph (heal delta, coverage undefined) is never labelled partial.
+  //
+  // E-047 (the blind-spot rung, from the cal.com giant test): coverage is a RATIO, so on a
+  // huge app it can clear the bar (cal.com/api/v2: 71%) while the ABSOLUTE count of high-risk
+  // blind spots is large (46 guarded mutations whose writes never resolved). A bare "PROVEN"
+  // over 46 unproven high-risk mutations over-claims. So a clean app is also PARTIAL when any
+  // high-severity blind spot remains — the label carries the uncertainty (metrology's error
+  // bars), independent of the ratio. Sound: only ever SOFTENS PROVEN→PARTIAL, never masks a
+  // finding, never touches the CI gate (`safe`). blindHigh defaults to 0, so a caller that
+  // did not survey blind spots (heal delta) is unaffected.
   const clean = provable && !surfaceOnly && hardCount === 0;
   const partial =
-    clean && coverage != null && entrypoints > 0 && coverage < COVERAGE_COMPLETE;
+    clean &&
+    entrypoints > 0 &&
+    ((coverage != null && coverage < COVERAGE_COMPLETE) || blindHigh > 0);
   // `safe` is the CI gate (block a risky deploy): a surface-only app has no
   // critical/high findings and is NOT risky, so it does not fail the gate — it just
   // isn't a positive proof. `clean` is the strong claim (PROVEN) and DOES require

package/src/ubg/extract.js

@@ -140,6 +140,8 @@ const moduleCache = new Map(); // absFile -> module facts (parse once per compil
 export function clearModuleCache() {
   moduleCache.clear();
   tsconfigCache.clear();
+  workspaceCache.clear();
+  workspaceRootOf.clear();
 }
 
 // absFile → { ast, functions: Map<name,{node,line,exported}>, imports: Map<local,abs>, error }
@@ -357,7 +359,159 @@ export function resolveRelImport(fromFile, spec) {
   // cross-module hop (controller → service → repository) dead-ends and effects behind
   // DI are invisible. A bare npm package (`kysely`, `@nestjs/common`) simply resolves
   // to nothing here (no matching file under the project), which is correct.
-  return resolveAliasedImport(fromFile, clean(spec));
+  //
+  // The WORKSPACE fallback (the mycorrhizal network): a monorepo app's real mutation
+  // logic lives in shared workspace packages it imports by NAME, not by path — cal.com's
+  // `this.svc.updateEventType()` delegates to `@calcom/platform-libraries` → `@calcom/trpc`
+  // → `prisma.update()`, three packages away and entirely outside the analyzed app dir. A
+  // tsconfig alias can't reach them (they're resolved via the workspace, not `paths`). So
+  // when the alias miss, map the `@scope/pkg[/subpath]` specifier to the package's real
+  // directory under the workspace and resolve into it. Trees share nutrients across the
+  // fungal network, not just their own root ball — the schema/effect code is a shared
+  // nutrient drawn from the workspace, not the app's own folder.
+  return (
+    resolveAliasedImport(fromFile, clean(spec)) ??
+    resolveWorkspaceImport(fromFile, clean(spec))
+  );
+}
+
+// name -> absolute package dir, for every package in the workspace that owns `fromFile`.
+// Cached per workspace root (built once, ~100 package.json reads on a giant monorepo).
+const workspaceCache = new Map(); // rootDir -> Map(name -> dir)
+const workspaceRootOf = new Map(); // dir -> rootDir | null
+
+// walk up to the monorepo root: the nearest ancestor whose package.json declares
+// `workspaces`, or that carries a pnpm-workspace.yaml. `null` = not a workspace.
+function findWorkspaceRoot(fromFile) {
+  let dir = path.dirname(fromFile);
+  const chain = [];
+  for (let i = 0; i < 40; i++) {
+    if (workspaceRootOf.has(dir)) {
+      const v = workspaceRootOf.get(dir);
+      for (const d of chain) workspaceRootOf.set(d, v);
+      return v;
+    }
+    chain.push(dir);
+    let root = null;
+    try {
+      const pj = path.join(dir, 'package.json');
+      if (fs.existsSync(pj)) {
+        const pkg = JSON.parse(fs.readFileSync(pj, 'utf8'));
+        if (pkg.workspaces) root = dir;
+      }
+      if (!root && fs.existsSync(path.join(dir, 'pnpm-workspace.yaml'))) root = dir;
+    } catch {
+      // unreadable manifest — keep walking up
+    }
+    if (root) {
+      for (const d of chain) workspaceRootOf.set(d, root);
+      return root;
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  for (const d of chain) workspaceRootOf.set(d, null);
+  return null;
+}
+
+// the workspace's package globs, from package.json `workspaces` (array or {packages})
+// or a minimal pnpm-workspace.yaml parse (the `- '...'` list under `packages:`).
+function workspaceGlobs(root) {
+  const globs = [];
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+    const ws = pkg.workspaces;
+    if (Array.isArray(ws)) globs.push(...ws);
+    else if (ws && Array.isArray(ws.packages)) globs.push(...ws.packages);
+  } catch {
+    // no/invalid root package.json — fall through to pnpm
+  }
+  try {
+    const yml = fs.readFileSync(path.join(root, 'pnpm-workspace.yaml'), 'utf8');
+    for (const m of yml.matchAll(/^\s*-\s*['"]?([^'"\n]+?)['"]?\s*$/gm)) globs.push(m[1]);
+  } catch {
+    // no pnpm-workspace.yaml
+  }
+  return globs;
+}
+
+// expand one workspace glob to concrete package dirs. Supports the two forms real
+// workspaces use: an exact path (`packages/app-store`) and a trailing `/*` (one level of
+// subdirs, e.g. `packages/*`, `packages/platform/*`). `**` is treated as a single level —
+// good enough for every workspace layout in the wild, and never unbounded.
+function expandGlob(root, glob) {
+  const g = glob.replace(/\/\*\*$/, '/*');
+  const star = g.indexOf('*');
+  if (star === -1) return [path.resolve(root, g)];
+  const baseRel = g.slice(0, star).replace(/\/$/, '');
+  const baseDir = path.resolve(root, baseRel);
+  try {
+    return fs
+      .readdirSync(baseDir, { withFileTypes: true })
+      .filter((e) => e.isDirectory())
+      .map((e) => path.join(baseDir, e.name));
+  } catch {
+    return [];
+  }
+}
+
+export function workspacePackages(fromFile) {
+  const root = findWorkspaceRoot(fromFile);
+  if (!root) return null;
+  if (workspaceCache.has(root)) return workspaceCache.get(root);
+  const map = new Map();
+  for (const glob of workspaceGlobs(root)) {
+    for (const dir of expandGlob(root, glob)) {
+      try {
+        const pkg = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8'));
+        if (typeof pkg.name === 'string' && !map.has(pkg.name)) map.set(pkg.name, dir);
+      } catch {
+        // not a package (no/invalid package.json) — skip
+      }
+    }
+  }
+  workspaceCache.set(root, map);
+  return map;
+}
+
+// the entry file of a package with no subpath import (`@calcom/trpc`): its declared
+// source/main/module, else the conventional src/index or index.
+function packageEntry(dir) {
+  const fields = [];
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8'));
+    for (const f of [pkg.source, pkg.module, pkg.main])
+      if (typeof f === 'string') fields.push(f);
+  } catch {
+    // no package.json fields — conventions below still apply
+  }
+  for (const f of [...fields, 'src/index', 'index']) {
+    const hit = firstModuleFile(path.resolve(dir, f.replace(/\.(m?[jt]s|cjs)$/, '')));
+    if (hit) return hit;
+  }
+  return null;
+}
+
+// resolve `@scope/pkg/subpath` (or `pkg/subpath`) to a real source file under the
+// workspace. Longest package-name match wins (`@calcom/platform-libraries` beats a
+// hypothetical `@calcom/platform`), then the subpath resolves against the package dir.
+function resolveWorkspaceImport(fromFile, spec) {
+  if (spec.startsWith('.') || spec.startsWith('/')) return null;
+  const map = workspacePackages(fromFile);
+  if (!map) return null;
+  let best = null;
+  for (const name of map.keys()) {
+    if (
+      (spec === name || spec.startsWith(name + '/')) &&
+      name.length > (best?.length ?? -1)
+    )
+      best = name;
+  }
+  if (!best) return null;
+  const dir = map.get(best);
+  const sub = spec.length > best.length ? spec.slice(best.length + 1) : '';
+  return sub ? firstModuleFile(path.resolve(dir, sub)) : packageEntry(dir);
 }
 
 // probe the standard TS/JS extensions + index files for a resolved base path.

package/src/ubg/prisma.js

@@ -10,6 +10,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { cmp } from './schema.js';
+import { workspacePackages } from './extract.js';
 
 const SCHEMA_CANDIDATES = ['prisma/schema.prisma', 'schema.prisma', 'db/schema.prisma'];
 // Prisma's `prismaSchemaFolder` layout (stable since 6.x): the schema is SPLIT across many
@@ -55,6 +56,35 @@ function collectSchemaFiles(cwd, fileCandidates, dirCandidates) {
   return [];
 }
 
+// P4 (E-048, the mycorrhizal network for STATE): a monorepo app usually declares NO schema of
+// its own — it depends on a shared `@scope/prisma`-style workspace package that owns the whole
+// schema (cal.com: apps/web has 0 tables locally; `@calcom/prisma` has 100 models). Without
+// this the app's entire state layer is invisible and every mutation reasons against nothing.
+// When the app dir yields no schema, look through its workspace DEPENDENCIES for the package
+// that owns one — the same name→dir map the module resolver already builds. Schema-ish deps are
+// tried first (a `prisma`/`db` package is the DB package), then any remaining workspace dep.
+function workspaceSchemaFiles(cwd, fileCandidates, dirCandidates) {
+  let deps;
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'));
+    deps = { ...pkg.dependencies, ...pkg.devDependencies };
+  } catch {
+    return [];
+  }
+  const map = workspacePackages(path.join(cwd, 'package.json'));
+  if (!map) return [];
+  const inWorkspace = Object.keys(deps).filter((n) => map.has(n));
+  const ordered = [
+    ...inWorkspace.filter((n) => /prisma|schema|(^|[-/])db($|[-/])|database/i.test(n)),
+    ...inWorkspace.filter((n) => !/prisma|schema|(^|[-/])db($|[-/])|database/i.test(n)),
+  ];
+  for (const name of ordered) {
+    const files = collectSchemaFiles(map.get(name), fileCandidates, dirCandidates);
+    if (files.length) return files;
+  }
+  return [];
+}
+
 const TYPE_MAP = {
   string: 'string',
   int: 'number',
@@ -78,7 +108,11 @@ export function parsePrismaSchemas(cwd) {
   } catch {
     // no package.json / unparsable — the default candidates stand
   }
-  const files = collectSchemaFiles(cwd, candidates, SCHEMA_DIR_CANDIDATES);
+  // local first; then the workspace dependency that owns the shared schema (P4)
+  const local = collectSchemaFiles(cwd, candidates, SCHEMA_DIR_CANDIDATES);
+  const files = local.length
+    ? local
+    : workspaceSchemaFiles(cwd, candidates, SCHEMA_DIR_CANDIDATES);
   if (!files.length) return { tables: [], skipped, sourceFile: null };
 
   // Read + strip comments once per file; keep the relative path for correct per-table locs.