@hanna84/mcp-writing 2.10.3 → 2.10.4

package/CHANGELOG.md

@@ -4,11 +4,21 @@ All notable changes to this project will be documented in this file. Dates are d
 
 Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
 
+#### [v2.10.4](https://github.com/hannasdev/mcp-writing.git
+/compare/v2.10.3...v2.10.4)
+
+- fix(review-bundles): guard oversized scene_ids in planner [`#108`](https://github.com/hannasdev/mcp-writing.git
+/pull/108)
+
 #### [v2.10.3](https://github.com/hannasdev/mcp-writing.git
 /compare/v2.10.2...v2.10.3)
 
+> 26 April 2026
+
 - refactor(helpers): extract domain helpers and path safety utilities from index.js [`#107`](https://github.com/hannasdev/mcp-writing.git
 /pull/107)
+- Release 2.10.3 [`f3b296a`](https://github.com/hannasdev/mcp-writing.git
+/commit/f3b296a9dbbedafcedab12ca8492d479aaa68180)
 
 #### [v2.10.2](https://github.com/hannasdev/mcp-writing.git
 /compare/v2.10.1...v2.10.2)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanna84/mcp-writing",
-  "version": "2.10.3",
+  "version": "2.10.4",
   "description": "MCP service for AI-assisted reasoning and editing on long-form fiction projects",
   "type": "module",
   "main": "index.js",

package/review-bundles-planner.js

@@ -1,4 +1,5 @@
 const MAX_SORT_VALUE = Number.MAX_SAFE_INTEGER;
+const MAX_SCENE_ID_FILTER_PARAMS = 900;
 
 export const REVIEW_BUNDLE_PROFILES = ["outline_discussion", "editor_detailed", "beta_reader_personalized"];
 export const REVIEW_BUNDLE_STRICTNESS = ["warn", "fail"];
@@ -99,14 +100,22 @@ function resolveRequestedSceneIds(dbHandle, projectId, sceneIds) {
     return { requested: [], existing: new Set() };
   }
 
-  const placeholders = sceneIds.map(() => "?").join(",");
-  const rows = dbHandle.prepare(
-    `SELECT scene_id FROM scenes WHERE project_id = ? AND scene_id IN (${placeholders})`
-  ).all(projectId, ...sceneIds);
+  const existing = new Set();
+
+  for (let i = 0; i < sceneIds.length; i += MAX_SCENE_ID_FILTER_PARAMS) {
+    const chunk = sceneIds.slice(i, i + MAX_SCENE_ID_FILTER_PARAMS);
+    const placeholders = chunk.map(() => "?").join(",");
+    const rows = dbHandle.prepare(
+      `SELECT scene_id FROM scenes WHERE project_id = ? AND scene_id IN (${placeholders})`
+    ).all(projectId, ...chunk);
+    for (const row of rows) {
+      existing.add(row.scene_id);
+    }
+  }
 
   return {
     requested: sceneIds,
-    existing: new Set(rows.map(row => row.scene_id)),
+    existing,
   };
 }
 
@@ -129,6 +138,17 @@ export function buildReviewBundlePlan(dbHandle, {
     throw new ReviewBundlePlanError("INVALID_PROJECT_ID", "project_id is required.");
   }
 
+  if (Array.isArray(scene_ids) && scene_ids.length > MAX_SCENE_ID_FILTER_PARAMS) {
+    throw new ReviewBundlePlanError(
+      "SCENE_IDS_TOO_LARGE",
+      `scene_ids supports at most ${MAX_SCENE_ID_FILTER_PARAMS} entries per request.`,
+      {
+        max_scene_ids: MAX_SCENE_ID_FILTER_PARAMS,
+        received_scene_ids: scene_ids.length,
+      }
+    );
+  }
+
   assertProfile(profile);
   assertStrictness(strictness);
   assertFormat(format);