fix(docs): documented dependency-scan command does not match the MCP prompt name

Đang mở Phù hợp với người mới
  • Có gì không ổn?
#180 0 bình luận 0 reaction 0 người được giao Xem trên GitHub

Chưa có ai nhận issue này.

Đánh giá

Độ khó
1/5
Thời gian dự kiến
Dưới một giờ
Mức phù hợp với người mới
79/100
Loại issue
Lỗi
Độ rõ ràng
Đặc tả rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
node.js, typescript
Lĩnh vực
developer-experience, documentation

Hướng nghiên cứu

Đọc hướng dẫn quét phụ thuộc trong README.md và so sánh lệnh slash được tài liệu hóa với prompt đã đăng ký trong mcp-server/src/index.ts. Sửa cách viết trong README.md để khớp với prompt hiện có; xác minh rằng lệnh được tài liệu hóa khớp với tên đã đăng ký và kiểm tra khôi phục trong issue được đáp ứng.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

Summary

The README instructs users to run /security:scan-deps, but the extension registers the dependency-scanning MCP prompt as security:scan_deps. Gemini CLI preserves the underscore when converting this prompt into a slash command, so the documented spelling does not resolve. The dependency-scanning prompt exists; a separate TOML command file is not required.

Runtime or environment

The latest published extension release is v0.5.0, tag commit 0e4812c469a61fb87e29ce939f393715221553fb. Current main is 2227f3cf7150972baac695b8233abc2186408538. The README, command tree, extension manifest, and MCP entry-point source are identical across those two revisions. Runtime checks used the release's darwin.arm64.security.tar.gz installed into a disposable Gemini CLI home, Gemini CLI 0.67.0 (latest stable npm release), and Node.js v26.12.1. The CLI source tag resolves to dc6602cec4a6e823aa33937144245dc421e5165f.

Steps to reproduce

  1. Inspect README.md lines 57 and 59–62 on either extension baseline: the dependency-scanning instructions specify /security:scan-deps.
  2. Inspect the securityServer entry in gemini-extension.json, then its MCP prompt registration in mcp-server/src/index.ts lines 176–180: the registered name is security:scan_deps.
  3. For the executed runtime check, install the published extension asset into an isolated CLI home, connect an MCP SDK stdio client to the installed mcp-server/dist/index.js, and call prompts/list and prompts/get with both spellings. Feed the actual returned prompt descriptors into the installed CLI's exported McpPromptLoader.loadCommands, then call its exported parseSlashCommand with each spelling. The probe supplies only the configuration methods used to expose the observed server and prompt descriptors; it does not modify the loader or parser.

These checks exercised MCP discovery, prompt retrieval, slash-command construction, and command lookup. An authenticated interactive UI session and an actual vulnerability scan were not run.

Expected behavior

The dependency-scan command documented in the README should resolve to the extension's dependency-scanning prompt. MCP-backed slash commands are supported, so this does not require adding a command file.

Actual behavior

The installed extension's MCP server and the CLI loader return the underscore spelling. The CLI parser resolves that spelling and does not resolve the documented hyphen spelling. Meaningful probe output:

prompts/list: ["security:note-adder","security:scan_deps"]
McpPromptLoader commands: ["security:note-adder","security:scan_deps"]
parseSlashCommand /security:scan-deps: commandToExecute is undefined; canonicalPath is []
parseSlashCommand /security:scan_deps: commandToExecute.name is "security:scan_deps"
prompts/get underscore: text response, length 1790
prompts/get hyphen error: MCP error -32602: MCP error -32602: Prompt security:scan-deps not found

The complete commands/security/ tree contains only analyze.toml, analyze-full.toml, and analyze-github-pr.toml. There is no hyphen alias there. The CLI's MCP loader only replaces whitespace in prompt names, and its parser matches exact command names or explicitly supplied aliases.

Evidence

  • Expected source: README dependency-scanning instructions.
  • Failure source: Executed MCP and CLI loader/parser probe against the installed release; prompt registration establishes the same mismatch on main.
  • Evidence provenance: observed
  • Local verification: reproduced
  • Reproduction completeness: complete

The CLI prompt-name conversion preserves underscores; command lookup does not interchange underscores and hyphens. The extension manifest connects securityServer to this MCP entry point. Runtime observations concern command registration and retrieval, not scan execution or scan-result correctness.

Restoration check

Using the published extension, the dependency-scan spelling documented in the README should appear among registered slash commands, resolve in command lookup, and retrieve the dependency-scanning prompt. Retain a control showing that the resolved prompt requests dependency scanning rather than a code-change analysis.

References

Open PR #155 proposes renaming the prompt to match the README. It remains unmerged, and both checked extension baselines retain the mismatch. This report records the current released behavior; no PR comment is requested.

Triage assessment

  • Impact level: P2
  • Assessment status: supported
  • Impact basis: Following the documented dependency-scan command fails command lookup, blocking that documented entry point. The failure is bounded to its spelling; the dependency-scanning prompt is present.
  • Workaround status: available
  • Workaround basis: Use /security:scan_deps; the executed lookup resolves it and the MCP server returns its dependency-scanning prompt. End-to-end vulnerability scanning was not tested.
Ngôn ngữ chính
TypeScript
Star
793
Fork
60
Không có pull request nào được merge trong 30 ngày

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của gemini-cli-extensions/security

Tất cả issue của gemini-cli-extensions/security

Issue tương tự

Thêm issue về TypeScript

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.