Skip to content

feat: surface backend package-path advisories in CLI and MCP grep - #516

Merged
jlitola merged 4 commits into
mainfrom
jlitola/package-path-advisories
Oct 25, 2026
Merged

jlitola merged 4 commits into
mainfrom
jlitola/package-path-advisories

Conversation

@jlitola

@jlitola jlitola commented Oct 24, 2026 •

Copy link
Copy Markdown
Contributor

Unified grep now reports backend-diagnosed package-path mistakes as one compact warning per distinct correction in CLI/MCP text and JSON:

Warning: Path is prefixed with package path "drizzle-orm". Did you mean "src/pg-core"?

No verbose explanation or alternate-target dump. JSON pathWarnings contains these same strings. The backend owns diagnosis and suggested paths; the client neither guesses nor retries. Native matches, failures, preparation and cursors remain intact. Core service consumers retain validated backend metadata.

Validation:

  • Final CI at ce5c3b2 is green: Linux/Windows tests, build checks, MCP package validation, secret scan, Bun and Node 20-26 compatibility. CI run.

  • Full unit suite: 6,681 passed. Final focused grep suites: 184 passed, 1,359 assertions, including text/JSON equality, controls, deduplication, multiple warnings, zero hits, native failures and short-wait pending pages.

  • Typecheck, format, builds and outside-workspace package validation passed. Lint retains 19 preexisting warnings in unchanged code.

  • Source and built unauthenticated smoke passed. Built CLI/MCP dev prefix/exact qualification passed in text and JSON, retaining the exact-path native failure.

  • Targeted agent eval: original scope preserved in text/JSON calls, correction recognized, no alternative executed; final inconclusive/high confidence, no recorded isolation violations or graded quality claim.

Review and rollout:

  • Internal and Claude Opus 5.5 review clean. Resumed Claude review found no code issues; its two documentation corrections are applied. The completed plan is removed, durable qualification is updated, and the known smoke-fixture gap is recorded in docs/plans/open-backlog.md. Reviewer retained for follow-up. No merge/release/deploy approval is implied.
  • Full authenticated smoke stops before grep on the existing Go recovery fixture (v20.10.0 now resolves v20.10.0+incompatible). Assertions were not weakened.
  • Production backend support was confirmed on 2026-10-24 at 10:25 UTC. Client releases and hosted remote-mcp package upgrade/deployment are still required and separately authorized.

Durable contract: docs/implementation/unified-grep.md. The backend backlog entry needs its owner's closure after shipping. No merge, release, publish or deploy performed.

Select and validate backend path warnings in both response modes, preserve them through shared projections, and display safely quoted unverified alternatives without changing search scope. Cover short-wait partial pages, quoting, native failures and CLI/MCP parity; document production schema and review prerequisites.
@jlitola jlitola added the enhancement New feature or request label Oct 24, 2026
Reuse the shared control escaper after JSON serialization so C1 controls cannot remain literal in advisory rows. Extend the existing quote test to prove terminal safety and exact JSON and shell round trips.
Summarize backend evidence as one warning per distinct correction instead of dumping explanations and alternate targets. Share wording across CLI and MCP text/JSON, preserve native results and scope, and cover control-safe warning parity.
Apply the clean Claude round’s documentation corrections, retain the compact qualification evidence, and move the existing authenticated smoke fixture gap to the backlog. Remove the completed implementation plan after review without changing runtime behavior.
@jlitola
jlitola marked this pull request as ready for review October 25, 2026 09:40
@jlitola
jlitola merged commit 098f842 into main Oct 25, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant