Dedup aliased advisories and promote sourceStatus warnings - #43
Merged
Conversation
Production evaluation surfaced two backend issues hurting agent usefulness on `pkg_vulns` and `search`. These client-side mitigations land ahead of the upstream fix so MCP consumers see correct counts and visible execution warnings today. `pkg_vulns` now collapses alias-clustered advisories — most visibly GHSA + RUSTSEC pairs on Crates that report the same CVE twice. The shared envelope builder unions clusters over `id ∪ aliases[]`, picks one canonical per cluster (severity-bearing first, then GHSA over RUSTSEC, then lexicographic id), and reports the maximum severity across non-withdrawn members. `summary.total` and `summary.bySeverity` are recomputed from the deduped list. Live: openssl@0.10.30 collapses from 25 to 15 advisories with bySeverity reconciling to the new total. `search` now surfaces a top-level `warnings: string[]` derived from noteworthy `sourceStatus` entries (incompatible/ignored query features or filters, lifecycle anomalies, free-form notes). Parser warnings are folded into the same array on completed and incomplete payloads so the text-v1 `warnings:` preamble shows both. Live: a docs-only query with a `kind:` qualifier now reports the dropped source instead of returning silently empty. Both transforms live in `src/shared/` and are exercised by the existing parity tests; they will be removed once the backend handles dedup and warning surfacing upstream (see notes in `docs/implementation/tools.md`). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two CLI-side mitigations for backend issues surfaced during the 2026-04-28 production evaluation. Both transforms live in
src/shared/and are exercised by the existing CLI/MCP parity tests.pkg_vulnsalias-cluster dedup — collapses GHSA + RUSTSEC entries that report the same CVE (most visibly on Crates) into one canonical advisory per cluster. Unions clusters overid ∪ aliases[], picks the canonical via severity-bearing → GHSA over RUSTSEC → lex tiebreaker, reports the maximum severity across non-withdrawn members.summary.totalandsummary.bySeverityare recomputed from the deduped list. Live:crates:openssl@0.10.30collapses from 25 → 15 advisories with bySeverity reconciling to the new total.searchwarnings promotion — surfaces a top-levelwarnings: string[]derived from noteworthysourceStatusentries (incompatible/ignored query features or filters, lifecycle anomalies, free-form notes). Parser warnings are folded in on completed and incomplete payloads so the text-v1warnings:preamble shows both. Live:search "parse kind:function" --in npm:zod --source docs --jsonnow emits the warning instead of returning silently empty.Both are scoped to be removed once the backend handles dedup and warning surfacing upstream — pointers and rationale recorded inline in
docs/implementation/tools.md.Reviewed by code-reviewer + codex-reviewer in parallel; ten findings addressed in-place (severity-max gated on
withdrawnAt, strictmodifiedAtsemantics,deleteover explicit-undefined, parser-warnings symmetry across all three payload paths, JSDoc accuracy).Test plan
bun test(1476 pass, 0 fail)bun run build(clean)githits pkg vulns crates:openssl@0.10.30 --jsonreturns 15 advisories withbySeveritysumming to totalgithits search "parse kind:function" --in npm:zod --source docs --jsonreturns top-levelwarnings[]with the dropped-source notice🤖 Generated with Claude Code