fix: Hardcoded config (#11)

Author: math280h

CONTRIBUTING.md

@@ -84,10 +84,20 @@ In your crate `src/lib.rs`, implement `registry_definition()` using `safe_pkgs_c
 
 Update `app_registry_definitions()` in `src/main.rs` to include your crate's `registry_definition()`.
 
-### 7) Update central check-support policy only if needed
+### 7) Declare unsupported checks in your registry crate
 
-If your registry cannot support specific checks, add exclusions in `app_registry_check_support()` in `src/main.rs`.
-Do not duplicate support rules across registry crates.
+If your registry cannot support specific checks, set `excluded_checks` on the `RegistryDefinition` returned by your crate's `registry_definition()`:
+
+```rust
+RegistryDefinition {
+    key: "myregistry",
+    create_client,
+    create_lockfile_parser: Some(create_lockfile_parser),
+    excluded_checks: &["install_script"],
+}
+```
+
+No changes to `src/main.rs` or any other crate are required.
 
 ## Add a New Check
 
@@ -136,9 +146,9 @@ In your crate `src/lib.rs`:
 
 - Update `app_check_factories()` in `src/main.rs` to include `safe_pkgs_check_<name>::create_check`.
 
-### 7) Declare registry support in one place
+### 7) Declare registry support in the registry crate
 
-If a registry cannot support your new check, update central policy in `app_registry_check_support()` in `src/main.rs`.
+If a registry cannot support your new check, add the check ID to `excluded_checks` in that registry crate's `registry_definition()`.
 If no override is needed, no registry changes are required.
 
 ### 8) Verify support map

crates/checks/README.md

@@ -22,5 +22,5 @@ Conventions:
 App wiring:
 
 - The binary chooses enabled checks in `src/main.rs` via `app_check_factories()`.
-- Registry check-support compatibility is centralized in `app_registry_check_support()` in `src/main.rs`.
+- Registry check-support compatibility is declared via `excluded_checks` on each registry crate's `RegistryDefinition`.
 - The orchestrator in `src/checks.rs` runs factories and handles ordering/config gating.

crates/core/src/lib.rs

@@ -667,6 +667,8 @@ pub struct RegistryDefinition {
     pub key: &'static str,
     pub create_client: fn() -> Arc<dyn RegistryClient>,
     pub create_lockfile_parser: Option<fn() -> Arc<dyn LockfileParser>>,
+    /// Check IDs this registry does not support.
+    pub excluded_checks: &'static [CheckId],
 }
 
 pub trait RegistryPlugin: Send + Sync {

crates/registry/cargo/src/lib.rs

@@ -12,6 +12,7 @@ pub fn registry_definition() -> RegistryDefinition {
         key: "cargo",
         create_client,
         create_lockfile_parser: Some(create_lockfile_parser),
+        excluded_checks: &["install_script"],
     }
 }
 

crates/registry/npm/src/lib.rs

@@ -12,6 +12,7 @@ pub fn registry_definition() -> RegistryDefinition {
         key: "npm",
         create_client,
         create_lockfile_parser: Some(create_lockfile_parser),
+        excluded_checks: &[],
     }
 }
 

crates/registry/pypi/src/lib.rs

@@ -12,6 +12,7 @@ pub fn registry_definition() -> RegistryDefinition {
         key: "pypi",
         create_client,
         create_lockfile_parser: Some(create_lockfile_parser),
+        excluded_checks: &["install_script"],
     }
 }
 

src/main.rs

@@ -67,7 +67,7 @@ enum Commands {
         /// Path to a dependency file or project directory
         path: String,
         /// Registry for dependency file parsing and package checks
-        #[arg(long, default_value = "npm")]
+        #[arg(long, default_value_t = crate::registries::default_lockfile_registry_key().to_string())]
         registry: String,
     },
     /// Print check support for registries
@@ -87,17 +87,6 @@ pub(crate) fn app_registry_definitions() -> Vec<registries::RegistryDefinition>
     ]
 }
 
-const NO_INSTALL_SCRIPT_SUPPORT: &[registries::CheckId] = &["install_script"];
-
-/// Central registry/check compatibility policy.
-pub(crate) fn app_registry_check_support(registry_key: &str) -> registries::RegistryCheckSupport {
-    match registry_key {
-        // Central compatibility policy: these registries don't expose install scripts.
-        "cargo" | "pypi" => registries::RegistryCheckSupport::AllExcept(NO_INSTALL_SCRIPT_SUPPORT),
-        _ => registries::RegistryCheckSupport::All,
-    }
-}
-
 /// Returns check factories wired into this application build.
 pub(crate) fn app_check_factories() -> Vec<safe_pkgs_core::CheckFactory> {
     vec![
@@ -168,25 +157,15 @@ mod tests {
     }
 
     #[test]
-    fn registry_check_support_disables_install_script_for_non_npm() {
-        match app_registry_check_support("npm") {
-            registries::RegistryCheckSupport::All => {}
-            _ => panic!("npm should support all checks by default"),
-        }
-
-        match app_registry_check_support("cargo") {
-            registries::RegistryCheckSupport::AllExcept(disallowed) => {
-                assert_eq!(disallowed, NO_INSTALL_SCRIPT_SUPPORT);
-            }
-            _ => panic!("cargo should exclude install_script"),
-        }
+    fn registry_definitions_excluded_checks_are_correct() {
+        let defs = app_registry_definitions();
+        let npm = defs.iter().find(|d| d.key == "npm").expect("npm definition");
+        let cargo = defs.iter().find(|d| d.key == "cargo").expect("cargo definition");
+        let pypi = defs.iter().find(|d| d.key == "pypi").expect("pypi definition");
 
-        match app_registry_check_support("pypi") {
-            registries::RegistryCheckSupport::AllExcept(disallowed) => {
-                assert_eq!(disallowed, NO_INSTALL_SCRIPT_SUPPORT);
-            }
-            _ => panic!("pypi should exclude install_script"),
-        }
+        assert!(npm.excluded_checks.is_empty());
+        assert!(cargo.excluded_checks.contains(&"install_script"));
+        assert!(pypi.excluded_checks.contains(&"install_script"));
     }
 
     #[test]

src/mcp/server.rs

@@ -25,6 +25,14 @@ fn package_registry_schema(generator: &mut SchemaGenerator) -> Schema {
         "default".into(),
         serde_json::json!(crate::registries::default_package_registry_key()),
     );
+    schema.insert(
+        "description".into(),
+        serde_json::json!(format!(
+            "Package registry. Supported: {}. Defaults to \"{}\".",
+            crate::registries::supported_package_registry_keys().join("\", \""),
+            crate::registries::default_package_registry_key(),
+        )),
+    );
     schema
 }
 
@@ -38,13 +46,40 @@ fn lockfile_registry_schema(generator: &mut SchemaGenerator) -> Schema {
         "default".into(),
         serde_json::json!(crate::registries::default_lockfile_registry_key()),
     );
+    schema.insert(
+        "description".into(),
+        serde_json::json!(format!(
+            "Registry for parsing and checks. Supported: {}. Defaults to \"{}\".",
+            crate::registries::supported_lockfile_registry_keys().join("\", \""),
+            crate::registries::default_lockfile_registry_key(),
+        )),
+    );
     schema
 }
 
 fn default_lockfile_registry() -> String {
     crate::registries::default_lockfile_registry_key().to_string()
 }
 
+fn lockfile_path_schema(generator: &mut SchemaGenerator) -> Schema {
+    let mut schema = String::json_schema(generator);
+    let registry_files = crate::registries::supported_lockfile_registry_keys()
+        .into_iter()
+        .filter_map(|key| {
+            crate::registries::supported_lockfile_files_for_registry(key)
+                .map(|files| format!("{key}: {}", files.join("/")))
+        })
+        .collect::<Vec<_>>()
+        .join(", ");
+    schema.insert(
+        "description".into(),
+        serde_json::json!(format!(
+            "Path to a dependency file or project directory for batch safety checks ({registry_files}). Defaults to current working directory."
+        )),
+    );
+    schema
+}
+
 /// Parameters for the `check_package` MCP tool.
 #[derive(Debug, Deserialize, JsonSchema)]
 pub struct PackageQuery {
@@ -60,30 +95,19 @@ pub struct PackageQuery {
     /// Optional version. Uses latest when omitted.
     pub version: Option<String>,
 
-    #[schemars(
-        description = "Package registry. Defaults to \"npm\". Supported: \"npm\", \"cargo\", \"pypi\"."
-    )]
     #[serde(default = "default_package_registry")]
     #[schemars(schema_with = "package_registry_schema")]
-    /// Registry key (`npm`, `cargo`, `pypi`).
     pub registry: String,
 }
 
 /// Parameters for the `check_lockfile` MCP tool.
 #[derive(Debug, Deserialize, JsonSchema)]
 pub struct LockfileQuery {
-    #[schemars(
-        description = "Path to a dependency file or project directory for batch safety checks. npm: package-lock.json/package.json, cargo: Cargo.lock/Cargo.toml, pypi: requirements.txt/pyproject.toml. Defaults to current working directory."
-    )]
-    /// Path to a lockfile/manifest file or project directory.
+    #[schemars(schema_with = "lockfile_path_schema")]
     pub path: Option<String>,
 
-    #[schemars(
-        description = "Registry used for parsing and checks. Defaults to \"npm\". Supported: \"npm\", \"cargo\", \"pypi\"."
-    )]
     #[serde(default = "default_lockfile_registry")]
     #[schemars(schema_with = "lockfile_registry_schema")]
-    /// Registry key used for parser + checks.
     pub registry: String,
 }
 
@@ -167,13 +191,21 @@ impl SafePkgsServer {
 #[tool_handler]
 impl ServerHandler for SafePkgsServer {
     fn get_info(&self) -> ServerInfo {
+        let lockfile_keywords = crate::registries::supported_lockfile_registry_keys()
+            .into_iter()
+            .filter_map(|key| crate::registries::supported_lockfile_files_for_registry(key))
+            .flatten()
+            .map(|f| format!("`{f}`"))
+            .collect::<Vec<_>>()
+            .join(", ");
+        let instructions = format!(
+            "Dependency safety policy: (1) For single dependency intent keywords (`add`, `install`, `update`, `upgrade`, `bump`, `pin`), call `check_package` first and do not edit files before the result. (2) For batch/file intent keywords ({lockfile_keywords}, `install deps`, `audit lockfile`), call `check_lockfile` first. (3) Enforce gating: if `allow=false`, do not proceed; return risk, reasons, and machine-readable evidence."
+        );
         ServerInfo {
             protocol_version: ProtocolVersion::V_2024_11_05,
             capabilities: ServerCapabilities::builder().enable_tools().build(),
             server_info: Implementation::from_build_env(),
-            instructions: Some(
-                "Dependency safety policy: (1) For single dependency intent keywords (`add`, `install`, `update`, `upgrade`, `bump`, `pin`), call `check_package` first and do not edit files before the result. (2) For batch/file intent keywords (`package-lock.json`, `package.json`, `Cargo.lock`, `Cargo.toml`, `requirements.txt`, `pyproject.toml`, `install deps`, `audit lockfile`), call `check_lockfile` first. (3) Enforce gating: if `allow=false`, do not proceed; return risk, reasons, and machine-readable evidence.".into(),
-            ),
+            instructions: Some(instructions.into()),
         }
     }
 }

src/registries/mod.rs

@@ -8,15 +8,6 @@ pub use safe_pkgs_core::{
     CheckId, LockfileParser, RegistryClient, RegistryDefinition, RegistryPlugin, normalize_check_id,
 };
 
-/// Central check-support mode for a registry.
-#[derive(Clone, Copy)]
-pub enum RegistryCheckSupport {
-    /// Registry supports all known checks.
-    All,
-    /// Registry supports all checks except the listed ids.
-    AllExcept(&'static [CheckId]),
-}
-
 /// Runtime registry catalog built from app-registered definitions.
 #[derive(Clone)]
 pub struct RegistryCatalog {
@@ -65,14 +56,14 @@ impl RegistryCatalog {
         registry_definitions()
             .iter()
             .flat_map(|def| {
-                let support_mode = crate::app_registry_check_support(def.key);
+                let excluded = def.excluded_checks;
                 known_checks
                     .iter()
                     .copied()
                     .map(move |check| CheckSupportRow {
                         registry: def.key,
                         check,
-                        supported: check_is_supported(support_mode, check),
+                        supported: check_is_supported(excluded, check),
                     })
             })
             .collect()
@@ -87,8 +78,7 @@ pub fn register_default_catalog() -> RegistryCatalog {
     let mut plugins_by_key = HashMap::new();
     let known_checks = known_check_ids();
     for def in registry_definitions() {
-        let support_mode = crate::app_registry_check_support(def.key);
-        let supported_checks = supported_checks(support_mode, &known_checks);
+        let supported_checks = supported_checks(def.excluded_checks, &known_checks);
         let plugin = Arc::new(RegisteredPlugin {
             key: def.key,
             client: (def.create_client)(),
@@ -173,7 +163,7 @@ pub fn default_package_registry_key() -> &'static str {
     registry_definitions()
         .first()
         .map(|def| def.key)
-        .unwrap_or("npm")
+        .expect("at least one registry must be registered")
 }
 
 /// Returns the default lockfile registry key.
@@ -182,7 +172,7 @@ pub fn default_lockfile_registry_key() -> &'static str {
         .iter()
         .find(|def| def.create_lockfile_parser.is_some())
         .map(|def| def.key)
-        .unwrap_or("npm")
+        .expect("at least one lockfile-capable registry must be registered")
 }
 
 #[derive(Clone)]
@@ -225,22 +215,19 @@ fn known_check_ids() -> Vec<CheckId> {
         .collect()
 }
 
-fn supported_checks(mode: RegistryCheckSupport, known_checks: &[CheckId]) -> Vec<CheckId> {
+fn supported_checks(excluded: &[CheckId], known_checks: &[CheckId]) -> Vec<CheckId> {
     known_checks
         .iter()
         .copied()
-        .filter(|check| check_is_supported(mode, check))
+        .filter(|check| check_is_supported(excluded, check))
         .collect()
 }
 
-fn check_is_supported(mode: RegistryCheckSupport, check: CheckId) -> bool {
+fn check_is_supported(excluded: &[CheckId], check: CheckId) -> bool {
     let normalized_check = normalize_check_id(check);
-    match mode {
-        RegistryCheckSupport::All => true,
-        RegistryCheckSupport::AllExcept(disallowed) => !disallowed
-            .iter()
-            .any(|value| normalize_check_id(value) == normalized_check),
-    }
+    !excluded
+        .iter()
+        .any(|value| normalize_check_id(value) == normalized_check)
 }
 
 #[cfg(test)]