weavatrix 0.1.2 → 0.1.3

package/src/mcp/tools-health.mjs

@@ -38,19 +38,38 @@ export function tFindDuplicates(g, args, ctx) {
     if (args.mode === 'semantic') {
         const data = computeDuplicates(ctx.repoRoot, ctx.graphPath, {nameTwins: true})
         const frags = data.frags
-        const groups = (data.nameTwins || [])
-            .map((t) => ({...t, members: t.members.filter((i) => (!skipTests || !frags[i].test) && frags[i].n >= tokMin)}))
-            .map((t) => ({...t, fileCount: new Set(t.members.map((i) => frags[i].file)).size}))
-            .filter((t) => t.members.length >= 2 && t.fileCount >= 2)
-        if (!groups.length) return 'No same-name symbol groups across files (semantic mode).'
-        const top = groups.slice(0, Math.min(30, Math.max(1, Number(args.top_n) || 15)))
-        const lines = top.map((t, k) => {
-            const verdict = t.simMax < 60 ? '  ⚠ DIVERGENT — same name, different bodies (drift hazard)' : t.simMin >= 90 ? '  near-identical — extract a shared module' : ''
-            const head = `${k + 1}. "${t.label}" — ${t.members.length} definitions in ${t.fileCount} files, similarity ${t.simMin}–${t.simMax}%${verdict}`
-            const sites = t.members.slice(0, 8).map((i) => `     ${frags[i].file}:${frags[i].start}-${frags[i].end}  (${frags[i].n} tok)`)
-            return [head, ...sites].join('\n')
+        const candidates = []
+        for (const twin of data.nameTwins || []) {
+            const allowed = new Set(twin.members.filter((i) => (!skipTests || !frags[i].test) && frags[i].n >= tokMin))
+            const pairs = (twin.pairs || []).filter((p) => allowed.has(p.a) && allowed.has(p.b))
+            if (!pairs.length) continue
+            const closest = pairs.slice().sort((a, b) => b.similarity - a.similarity)[0]
+            const farthest = pairs.slice().sort((a, b) => a.similarity - b.similarity)[0]
+            if (closest.similarity >= 85) candidates.push({kind: 'clone', label: twin.label, pair: closest})
+            if (farthest.similarity <= 45) candidates.push({kind: 'collision', label: twin.label, pair: farthest})
+        }
+        for (const item of candidates) item.tokens = frags[item.pair.a].n + frags[item.pair.b].n
+        candidates.sort((a, b) => {
+            if (a.kind !== b.kind) return a.kind === 'clone' ? -1 : 1
+            return a.kind === 'clone'
+                ? b.pair.similarity - a.pair.similarity || b.tokens - a.tokens
+                : b.tokens - a.tokens || a.pair.similarity - b.pair.similarity
         })
-        return `Found ${groups.length} same-name symbol group(s) across files (semantic mode; similarity = renamed-token jaccard, LOW = divergent copies). Top ${top.length}:\n\n${lines.join('\n\n')}\n\nLow-similarity groups are the risky ones — same name, drifted behavior. read_source both sites to compare.`
+        if (!candidates.length) return 'No actionable same-name pairs across files (semantic mode; ambiguous middle-similarity pairs are suppressed).'
+        const top = candidates.slice(0, Math.min(30, Math.max(1, Number(args.top_n) || 15)))
+        const lines = top.map((item, k) => {
+            const a = frags[item.pair.a]
+            const b = frags[item.pair.b]
+            const verdict = item.kind === 'clone'
+                ? 'near-identical duplicate candidate — review, then extract shared logic if the contract is truly shared'
+                : 'name collision, not a duplicate — inspect only if these definitions should share a contract'
+            return [
+                `${k + 1}. "${item.label}" — ${item.pair.similarity}% similar; ${verdict}`,
+                `     ${a.file}:${a.start}-${a.end}  (${a.n} tok)`,
+                `     ${b.file}:${b.start}-${b.end}  (${b.n} tok)`,
+            ].join('\n')
+        })
+        return `Found ${candidates.length} actionable same-name pair(s) across files (semantic mode; one closest clone and/or farthest collision per name). Top ${top.length}:\n\n${lines.join('\n\n')}\n\nThese are review candidates, not automatic refactors. Use read_source on both sites before changing code.`
     }
     const data = computeDuplicates(ctx.repoRoot, ctx.graphPath, {includeStrings})
     const groups = groupClones(data, {simMin, tokMin, mode, skipTests})
@@ -87,14 +106,15 @@ export async function tRunAudit(g, args, ctx) {
     const sev = audit.summary.bySeverity
     const bycat = audit.summary.byCategory
     const line = (f) => {
-        const where = f.file ? `  (${f.file}${f.symbol ? ` ${f.symbol}` : ''})` : f.package ? `  (pkg ${f.package}${f.version ? `@${f.version}` : ''})` : ''
+        const where = f.file ? `  (${f.file}${f.symbol ? ` ${f.symbol}` : ''})` : f.package ? `  (pkg ${f.package}${f.version ? `@${f.version}` : ''}${f.manifest ? `; ${f.manifest}` : ''})` : ''
         return `  [${f.severity}/${f.confidence || '?'}] ${f.rule}: ${f.title}${where}${f.fixHint ? `\n      fix: ${f.fixHint}` : ''}`
     }
+    const check = (name, state) => `${name} ${state?.status || 'ERROR'}${state?.detail ? ` — ${state.detail}` : ''}`
     return [
         `Internal audit of ${audit.repo} (${audit.scanned.files} files, ${audit.scanned.symbols} symbols, ${audit.scanned.externalImports} external imports; malware scan: ${audit.scanned.malwareScanMode}).`,
         `Severity: critical ${sev.critical}, high ${sev.high}, medium ${sev.medium}, low ${sev.low}, info ${sev.info}. Categories: unused ${bycat.unused}, structure ${bycat.structure}, vulnerability ${bycat.vulnerability}, malware ${bycat.malware}.`,
-        `Structure: ${audit.structureReport?.cycles ?? 0} cycle(s), ${audit.structureReport?.orphans ?? 0} orphan(s). Dead: ${audit.deadReport.deadFiles} file(s), ${audit.deadReport.unusedExports} unused export(s).`,
-        audit.scanned.advisoryDbDate ? `Advisory DB: ${audit.scanned.advisoryDbDate}.` : 'Advisory DB: never refreshed for this repo — known-vuln matching skipped (see refresh_advisories).',
+        `Structure: ${audit.structureReport?.runtimeCycles ?? audit.structureReport?.cycles ?? 0} runtime cycle(s), ${audit.structureReport?.typeCouplings ?? 0} type-induced coupling group(s), ${audit.structureReport?.orphans ?? 0} orphan(s); import edges: ${audit.structureReport?.runtimeImportEdges ?? audit.structureReport?.importEdges ?? 0} runtime + ${audit.structureReport?.typeOnlyImportEdges ?? 0} type-only. Dead: ${audit.deadReport.deadFiles} file(s), ${audit.deadReport.unusedExports} unused export(s).`,
+        `Checks: ${check('OSV', audit.checks?.osv)}; ${check('malware', audit.checks?.malware)}. A NOT_CHECKED/PARTIAL/ERROR check is incomplete or unknown, never a clean zero.`,
         ``,
         `Showing ${shown.length} of ${filtered.length} finding(s)${cat ? ` in category "${cat}"` : ''}${args.min_severity ? ` at ≥${args.min_severity}` : ''}:`,
         ...shown.map(line),
@@ -120,13 +140,17 @@ export function tModuleMap(g, args, ctx) {
     const topN = Math.max(1, Math.min(60, Number(args.top_n) || 25))
     const mods = agg.modules.slice(0, topN)
     const edges = agg.moduleEdges.slice(0, Math.min(50, topN * 2))
+    const typeEdges = (agg.typeOnlyModuleEdges || []).slice(0, Math.min(50, topN * 2))
     return [
-        `Module map: ${agg.totals.files} files in ${agg.modules.length} folder-modules, ${agg.totals.moduleEdges} module edges. Top ${mods.length}:`,
+        `Module map: ${agg.totals.files} files in ${agg.modules.length} folder-modules, ${agg.totals.moduleEdges} runtime module dependencies and ${agg.totals.typeOnlyModuleEdges || 0} type-only dependencies. Top ${mods.length}:`,
         ...mods.map((m) => `  ${m.name} — ${m.fileCount} files, ${m.symbolCount} symbols`),
         ``,
-        `Strongest module dependencies:`,
+        `Strongest runtime module dependencies:`,
         ...edges.map((e) => `  ${e.from} → ${e.to}  (${e.count})`),
-    ].join('\n')
+        typeEdges.length ? `` : null,
+        typeEdges.length ? `Type-only module dependencies (compile-time contracts, not runtime coupling):` : null,
+        ...typeEdges.map((e) => `  ${e.from} → ${e.to}  (${e.count})`),
+    ].filter((line) => line != null).join('\n')
 }
 
 // Coverage × graph: map an EXISTING coverage report (istanbul/lcov/coverage.py/Go — read offline,

package/src/mcp/tools-impact.mjs

@@ -10,6 +10,46 @@ import {
 } from './graph-context.mjs'
 import {readCoverageForRepo} from '../analysis/coverage-reports.js'
 
+function reverseReach(g, seeds, maxDepth) {
+    const states = new Map([...seeds].map((id) => [String(id), {
+        runtimeDepth: 0, runtimeRelation: null, compileDepth: null, compileRelation: null,
+    }]))
+    const frontier = [...seeds].map((id) => ({id: String(id), depth: 0, compileOnly: false}))
+    for (let cursor = 0; cursor < frontier.length; cursor++) {
+        const current = frontier[cursor]
+        if (current.depth >= maxDepth) continue
+        for (const e of g.inn.get(current.id) || []) {
+            if (e.relation === 'contains') continue
+            const id = String(e.id)
+            const compileOnly = current.compileOnly || e.typeOnly === true
+            const depth = current.depth + 1
+            const entry = states.get(id) || {
+                runtimeDepth: null, runtimeRelation: null, compileDepth: null, compileRelation: null,
+            }
+            const depthKey = compileOnly ? 'compileDepth' : 'runtimeDepth'
+            const relationKey = compileOnly ? 'compileRelation' : 'runtimeRelation'
+            if (entry[depthKey] != null && entry[depthKey] <= depth) continue
+            entry[depthKey] = depth
+            entry[relationKey] = e.relation || 'rel'
+            states.set(id, entry)
+            frontier.push({id, depth, compileOnly})
+        }
+    }
+    return new Map([...states].map(([id, entry]) => [id, {
+        ...entry,
+        depth: entry.runtimeDepth ?? entry.compileDepth ?? 0,
+        compileOnly: entry.runtimeDepth == null,
+        relation: entry.runtimeDepth != null ? entry.runtimeRelation : entry.compileRelation,
+    }]))
+}
+
+const impactKind = (entry) => {
+    if (entry?.runtimeDepth != null) {
+        return entry.compileDepth != null ? `runtime + compile-time(d${entry.compileDepth})` : 'runtime'
+    }
+    return 'compile-time'
+}
+
 // Transitive blast-radius: who is affected if this node changes. Walks REVERSE dependency edges
 // (calls/imports/inherits — not structural `contains`) out to `depth`. For a symbol, also seeds its
 // containing file, because importers depend on the file rather than the individual symbol.
@@ -30,26 +70,10 @@ export function tGetDependents(g, {label, depth = 3, max_nodes = 40} = {}) {
             seeds.add(containingFile)
         }
     }
-    const depthOf = new Map([...seeds].map((s) => [s, 0]))
-    const relOf = new Map()
-    let frontier = [...seeds]
-    for (let d = 0; d < maxDepth && frontier.length; d++) {
-        const next = []
-        for (const cur of frontier) {
-            for (const e of g.inn.get(cur) || []) {
-                if (e.relation === 'contains') continue // structural nesting is not a dependency
-                const nid = String(e.id)
-                if (depthOf.has(nid)) continue
-                depthOf.set(nid, d + 1)
-                relOf.set(nid, e.relation || 'rel')
-                next.push(nid)
-            }
-        }
-        frontier = next
-    }
-    const ranked = [...depthOf.entries()]
+    const reached = reverseReach(g, seeds, maxDepth)
+    const ranked = [...reached.entries()]
         .filter(([nid]) => !seeds.has(nid))
-        .map(([nid, d]) => ({id: nid, d, deg: degreeOf(g, nid)}))
+        .map(([nid, entry]) => ({id: nid, d: entry.depth, entry, deg: degreeOf(g, nid)}))
         .sort((a, b) => a.d - b.d || b.deg - a.deg)
     if (!ranked.length) return [note, `No dependents found for ${n.label ?? id} within depth ${maxDepth} — nothing in the graph calls, imports, or inherits it.`].filter(Boolean).join('\n')
     const shown = ranked.slice(0, cap)
@@ -57,7 +81,7 @@ export function tGetDependents(g, {label, depth = 3, max_nodes = 40} = {}) {
         note,
         `Dependents of ${n.label ?? id} (reverse calls/imports/inherits, depth ≤${maxDepth}): ${ranked.length} found, showing ${shown.length} by proximity + connectivity.`,
         containingFile ? `Includes importers of its containing file ${labelOf(g, containingFile)}.` : null,
-        ...shown.map((r) => `  [d${r.d}] ${relOf.get(r.id) || 'rel'}  ${labelOf(g, r.id)}  (deg ${r.deg})  [${r.id}]`),
+        ...shown.map((r) => `  [d${r.d} ${impactKind(r.entry)}] ${r.entry.relation || 'rel'}  ${labelOf(g, r.id)}  (deg ${r.deg})  [${r.id}]`),
     ].filter(Boolean).join('\n')
 }
 
@@ -72,7 +96,8 @@ export function tGraphDiff(g, args, ctx) {
     const filter = args.path ? String(args.path).replace(/\\/g, '/') : null
     const scope = (graph) => filter ? {
         nodes: (graph.nodes || []).filter((n) => String(n.id).startsWith(filter)),
-        links: (graph.links || []).filter((l) => String(edgeEndpoint(l.source)).startsWith(filter) || String(edgeEndpoint(l.target)).startsWith(filter))
+        links: (graph.links || []).filter((l) => String(edgeEndpoint(l.source)).startsWith(filter) || String(edgeEndpoint(l.target)).startsWith(filter)),
+        edgeTypesV: graph.edgeTypesV || 0,
     } : graph
     return [
         `Graph diff (previous rebuild state → current)${filter ? `, scoped to ${filter}` : ''}:`,
@@ -144,27 +169,11 @@ export function tChangeImpact(g, args, ctx) {
 
     const maxDepth = Math.max(1, Math.min(4, Number(args.depth) || 2))
     const cap = Math.max(5, Math.min(120, Number(args.max_nodes) || 40))
-    const depthOf = new Map([...seeds].map((s) => [s, 0]))
-    const relOf = new Map()
-    let frontier = [...seeds]
-    for (let d = 0; d < maxDepth && frontier.length; d++) {
-        const next = []
-        for (const cur of frontier) {
-            for (const e of g.inn.get(cur) || []) {
-                if (e.relation === 'contains') continue
-                const nid = String(e.id)
-                if (depthOf.has(nid)) continue
-                depthOf.set(nid, d + 1)
-                relOf.set(nid, e.relation || 'rel')
-                next.push(nid)
-            }
-        }
-        frontier = next
-    }
+    const reached = reverseReach(g, seeds, maxDepth)
     const fileOfNode = (id) => { const s = String(id); const h = s.indexOf('#'); return h < 0 ? s : s.slice(0, h) }
-    const impacted = [...depthOf.entries()]
+    const impacted = [...reached.entries()]
         .filter(([nid]) => !seeds.has(nid) && !changedSet.has(fileOfNode(nid)))
-        .map(([nid, d]) => ({id: nid, d, deg: degreeOf(g, nid), file: fileOfNode(nid)}))
+        .map(([nid, entry]) => ({id: nid, d: entry.depth, entry, deg: degreeOf(g, nid), file: fileOfNode(nid)}))
         .sort((a, b) => a.d - b.d || b.deg - a.deg)
 
     // coverage overlay from EXISTING reports (fractions 0..1) — see coverage_map for details
@@ -172,6 +181,7 @@ export function tChangeImpact(g, args, ctx) {
     const coverage = readCoverageForRepo(ctx.repoRoot, knownFiles)
     const covOf = (file) => coverage.get(String(file).replace(/\\/g, '/'))?.pct ?? null
     const pctStr = (v) => (v == null ? 'cov n/a' : `cov ${Math.round(v * 100)}%`)
+    const hasCoverage = coverage.size > 0
 
     const shown = impacted.slice(0, cap)
     const untestedHotspots = shown.filter((n) => { const c = covOf(n.file); return c != null && c < 0.5 && n.deg >= 5 })
@@ -180,7 +190,8 @@ export function tChangeImpact(g, args, ctx) {
         impacted.length
             ? `${impacted.length} impacted node(s) within ${maxDepth} reverse hop(s), showing ${shown.length}:`
             : `Nothing else in the graph depends on the changed code within ${maxDepth} hop(s).`,
-        ...shown.map((n) => `  [d${n.d}] ${relOf.get(n.id) || 'rel'}  ${labelOf(g, n.id)}  (deg ${n.deg}, ${pctStr(covOf(n.file))})  [${n.id}]`),
+        hasCoverage ? `Coverage: existing report mapped where available.` : `Coverage: unavailable (no supported report found); per-node coverage labels omitted.`,
+        ...shown.map((n) => `  [d${n.d} ${impactKind(n.entry)}] ${n.entry.relation || 'rel'}  ${labelOf(g, n.id)}  (deg ${n.deg}${hasCoverage ? `, ${pctStr(covOf(n.file))}` : ''})  [${n.id}]`),
         untestedHotspots.length ? `` : null,
         untestedHotspots.length ? `Untested hotspots in the blast radius (<50% coverage, deg ≥5) — cover these before shipping:` : null,
         ...untestedHotspots.slice(0, 10).map((n) => `  ${labelOf(g, n.id)}  (${pctStr(covOf(n.file))}, deg ${n.deg})  ${n.file}`),

package/src/mcp-server.mjs

@@ -131,6 +131,9 @@ async function main() {
             if (!graph && tool.cap !== 'build' && tool.cap !== 'retarget') return reply(id, {content: [{type: 'text', text: `Graph unavailable: ${graphError}`}], isError: true})
             try {
                 let text = String(await tool.run(graph, params?.arguments || {}, ctx))
+                if (graph && graph.edgeTypesV < 1 && (tool.cap === 'graph' || tool.cap === 'health')) {
+                    text += '\n\nWarning: this saved graph predates typed import edges, so type-only imports cannot be separated from runtime dependencies. Call rebuild_graph once before acting on cycle, boundary, dependency, or blast-radius findings.'
+                }
                 // Graph answers silently reflect a point-in-time build — surface staleness on every graph tool.
                 if (tool.cap === 'graph') {
                     const warn = api.stalenessLine(ctx)

package/src/security/advisory-store.js

@@ -10,6 +10,7 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { homedir } from "node:os";
+import { createHash } from "node:crypto";
 import { uniqueBy } from "../util.js";
 
 export const DEFAULT_STORE = join(homedir(), ".weavatrix", "advisories.json");
@@ -22,6 +23,13 @@ const keyOf = (ecosystem, name) => `${ecosystem}|${ecosystem === "PyPI" ? String
 
 const uniquePackages = (pkgs) => uniqueBy(pkgs, (p) => `${p.ecosystem}|${p.name}|${p.version}`);
 
+export function advisoryQueryFingerprint(installed = []) {
+  const rows = uniquePackages(installed.filter((p) => p?.ecosystem && p?.name && p?.version && OSV_SUPPORTED_ECOSYSTEMS.has(p.ecosystem)))
+    .map((p) => `${p.ecosystem}|${p.name}|${p.version}`)
+    .sort();
+  return createHash("sha256").update(rows.join("\n"), "utf8").digest("hex");
+}
+
 async function fetchJson(fetcher, url, options, timeoutMs) {
   const timeout = Math.max(50, Number(timeoutMs) || DEFAULT_FETCH_TIMEOUT_MS);
   const ctrl = typeof AbortController === "function" ? new AbortController() : null;
@@ -119,6 +127,7 @@ export async function refreshAdvisories({ installed = [], storePath = DEFAULT_ST
   const store = loadStore(storePath);
   const idsByPkg = new Map(); // pkgIndex -> [vuln ids]
   const errors = [];
+  let queriedOk = 0;
 
   for (let i = 0; i < pkgs.length; i += batchSize) {
     const batch = pkgs.slice(i, i + batchSize);
@@ -128,7 +137,22 @@ export async function refreshAdvisories({ installed = [], storePath = DEFAULT_ST
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ queries: batch.map((p) => ({ package: { ecosystem: p.ecosystem, name: p.name }, version: p.version })) }),
       }, timeoutMs);
-      (json.results || []).forEach((r, j) => { if (r && Array.isArray(r.vulns) && r.vulns.length) idsByPkg.set(i + j, r.vulns.map((v) => v.id)); });
+      if (!Array.isArray(json?.results) || json.results.length !== batch.length) {
+        throw new Error(`OSV querybatch returned ${Array.isArray(json?.results) ? json.results.length : "no"} result(s) for ${batch.length} query item(s)`);
+      }
+      for (const [resultIndex, result] of json.results.entries()) {
+        if (!result || typeof result !== "object" || Array.isArray(result)) {
+          throw new Error(`OSV querybatch result ${resultIndex + 1} is not an object`);
+        }
+        if (result.vulns !== undefined && !Array.isArray(result.vulns)) {
+          throw new Error(`OSV querybatch result ${resultIndex + 1} has a non-array vulns field`);
+        }
+        if (Array.isArray(result.vulns) && result.vulns.some((v) => !v || typeof v.id !== "string" || !v.id.trim())) {
+          throw new Error(`OSV querybatch result ${resultIndex + 1} contains an advisory without a valid id`);
+        }
+      }
+      queriedOk += batch.length;
+      json.results.forEach((r, j) => { if (r && Array.isArray(r.vulns) && r.vulns.length) idsByPkg.set(i + j, r.vulns.map((v) => v.id)); });
     } catch (error) {
       errors.push(`querybatch ${Math.floor(i / batchSize) + 1}/${Math.ceil(pkgs.length / batchSize)}: ${error.message}`);
     }
@@ -141,16 +165,24 @@ export async function refreshAdvisories({ installed = [], storePath = DEFAULT_ST
   for (const [id, pkgList] of wanted) {
     try {
       const rec = await fetchJson(fetcher, OSV_VULN_URL + encodeURIComponent(id), {}, timeoutMs);
-      if (!rec || !rec.id) continue;
-      fetched++;
+      if (!rec || typeof rec.id !== "string" || !rec.id) throw new Error("OSV detail response is missing its advisory id");
+      if (rec.id !== id) throw new Error(`OSV detail id mismatch (expected ${id}, received ${rec.id})`);
+      let normalized = 0;
       for (const p of pkgList) {
         const row = normalizeRecord(rec, p.ecosystem, p.name);
-        if (!row) continue;
+        if (!row) {
+          errors.push(`${id}: OSV detail does not describe ${p.ecosystem}:${p.name} reported by querybatch`);
+          continue;
+        }
+        normalized++;
         const key = keyOf(p.ecosystem, p.name);
         const list = store.records[key] || (store.records[key] = []);
         const at = list.findIndex((x) => x.id === row.id);
         if (at >= 0) list[at] = row; else list.push(row);
       }
+      // Count a detail response as fetched only after at least one package-specific row was
+      // validated. A malformed or unrelated response must never make coverage look complete.
+      if (normalized > 0) fetched++;
     } catch (error) {
       errors.push(`${id}: ${error.message}`);
     }
@@ -158,20 +190,32 @@ export async function refreshAdvisories({ installed = [], storePath = DEFAULT_ST
 
   // A refresh where NOTHING was fetched but errors occurred (offline, OSV blocked) must NOT stamp
   // fetched_at — that would turn an empty cache into "No known vulnerabilities as of <today>".
-  if (errors.length && fetched === 0 && (idsByPkg.size === 0 || wanted.size > 0)) {
+  if (errors.length && queriedOk === 0) {
     return { ok: false, queried: pkgs.length, unsupported, error: `advisory refresh failed: ${errors[0]}${errors.length > 1 ? ` (+${errors.length - 1} more)` : ""}`, errors };
   }
   store.meta.fetched_at = new Date().toISOString();
+  const status = errors.length ? "PARTIAL" : "OK";
   // per-repo stamp: the cache only covers packages that were QUERIED — a repo that never refreshed must
   // show "fetch advisories", not "0 vulnerabilities as of <someone else's date>" (false assurance).
   // repoKeys[] lets one online pass (a "refresh all repos") stamp every repo whose packages it covered.
   const stampRepos = [...new Set([repoKey, ...repoKeys].filter(Boolean))];
-  if (stampRepos.length) { store.meta.repos = store.meta.repos || {}; for (const k of stampRepos) store.meta.repos[k] = store.meta.fetched_at; }
+  if (stampRepos.length) {
+    store.meta.repos = store.meta.repos || {};
+    for (const k of stampRepos) store.meta.repos[k] = {
+      fetched_at: store.meta.fetched_at,
+      status,
+      queried: pkgs.length,
+      queried_ok: queriedOk,
+      unsupported,
+      error_count: errors.length,
+      query_fingerprint: advisoryQueryFingerprint(pkgs),
+    };
+  }
   try {
     mkdirSync(dirname(storePath), { recursive: true });
     writeFileSync(storePath, JSON.stringify(store), "utf8");
   } catch (error) {
     return { ok: false, error: `store write failed: ${error.message}`, errors };
   }
-  return { ok: true, queried: pkgs.length, unsupported, vulnerable: wanted.size, fetched, saved: existsSync(storePath), errors };
+  return { ok: true, status, queried: pkgs.length, queriedOk, unsupported, vulnerable: wanted.size, fetched, saved: existsSync(storePath), errors };
 }