@misterhuydo/cairn-mcp 1.6.9 → 1.6.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@misterhuydo/cairn-mcp",
-  "version": "1.6.9",
+  "version": "1.6.10",
   "description": "MCP server that gives Claude Code persistent memory across sessions. Index your codebase once, search symbols, bundle source, scan for vulnerabilities, and checkpoint/resume work — across Java, TypeScript, Vue, Python, SQL and more.",
   "type": "module",
   "main": "index.js",

package/src/indexer/securityScanner.js

@@ -8,7 +8,7 @@ export const VULN_PATTERNS = [
 
   { id: 'CWE-89',  lang: ['java'],                          severity: 'HIGH',
     name: 'SQL Injection',
-    pattern: /"SELECT|INSERT|UPDATE|DELETE.*"\s*\+/i,
+    pattern: /"(SELECT|INSERT|UPDATE|DELETE)\b.*"\s*\+/i,
     fix: 'Use PreparedStatement with parameterized queries' },
 
   { id: 'CWE-326', lang: ['java'],                          severity: 'HIGH',
@@ -34,7 +34,7 @@ export const VULN_PATTERNS = [
 
   { id: 'CWE-89',  lang: ['javascript', 'typescript'],       severity: 'HIGH',
     name: 'SQL Injection (JS)',
-    pattern: /`\s*(SELECT|INSERT|UPDATE|DELETE).*\$\{/i,
+    pattern: /`\s*(SELECT|INSERT|UPDATE|DELETE)\b.*\$\{/i,
     fix: 'Use parameterized queries or an ORM' },
 
   { id: 'CWE-798', lang: ['javascript', 'typescript', 'vue'], severity: 'HIGH',

package/src/tools/checkpoint.js

@@ -3,6 +3,11 @@ import path from 'path';
 import { getCairnDir } from '../graph/cwd.js';
 
 export function checkpoint(_db, { message, active_files = [], notes = [] }) {
+  // Coerce notes to array in case the caller passed a pre-serialized JSON string
+  if (typeof notes === 'string') {
+    try { notes = JSON.parse(notes); } catch { notes = notes ? [notes] : []; }
+  }
+  if (!Array.isArray(notes)) notes = [];
   const cairnDir = getCairnDir();
   const sessionPath = path.join(cairnDir, 'session.json');
 

package/src/tools/resume.js

@@ -31,6 +31,11 @@ export async function resume(db) {
   }
 
   const session = JSON.parse(fs.readFileSync(sessionPath, 'utf8'));
+  // Guard against double-serialized notes (stored as JSON string instead of array)
+  if (typeof session.notes === 'string') {
+    try { session.notes = JSON.parse(session.notes); } catch { session.notes = []; }
+  }
+  if (!Array.isArray(session.notes)) session.notes = [];
 
   // Detect and auto-repair project relocation before any path comparisons
   let relocation = null;