@octocodeai/octocode-engine 16.5.0 → 16.5.1

package/README.md

@@ -122,7 +122,7 @@ Benchmark files:
 
 ## Tools
 
-Octocode ships **13 research tools**; the same implementations run identically over [MCP](#mcp) and the [CLI](#cli). `ghCloneRepo` is opt-in (`ENABLE_CLONE=true`); local tools require `ENABLE_LOCAL` (default: on). All flags: [Configuration Reference](https://github.com/bgauryy/octocode/blob/main/docs/mcp/CONFIGURATION.md).
+Octocode ships **13 research tools**; the same implementations run identically over [MCP](#mcp) and the [CLI](#cli). `ghCloneRepo` is opt-in for MCP (`ENABLE_CLONE=true`) and enabled by default for CLI; local tools require `ENABLE_LOCAL` (CLI default: on, MCP default: off). All flags: [Configuration Reference](https://github.com/bgauryy/octocode/blob/main/docs/mcp/CONFIGURATION.md).
 
 **Token knobs.** `concise:true` returns path/title-only lists. `minify` controls file read density: `symbols` = skeleton with line numbers, `standard` = comments/blanks stripped (default), `none` = exact bytes.
 
@@ -247,8 +247,8 @@ Local paths route to local tools; `owner/repo[/path]` targets route to GitHub to
 | `octocode repo <keywords...>` | Discover GitHub repositories |
 | `octocode pkg <package\|keywords>` | Search npm and hand off to source repositories |
 | `octocode binary <file>` | Inspect archives, compressed files, and native binaries |
-| `octocode unzip <archive>` | Unpack an archive to `<octocode-home>/unzip/<name>-<timestamp>/`, then use local `ls`, `grep`, `cat`, and `lsp` |
-| `octocode clone <owner/repo[/path][@branch]>` | Clone a repo or subtree to the Octocode home repo cache for local/LSP analysis (`ENABLE_CLONE=true`) |
+| `octocode unzip <archive>` | Unpack an archive to `<octocode-home>/tmp/unzip/<name>-<timestamp>/`, then use local `ls`, `grep`, `cat`, and `lsp` |
+| `octocode clone <owner/repo[/path][@branch]>` | Clone a repo or subtree to `<octocode-home>/tmp/clone/` for local/LSP analysis (`ENABLE_CLONE=true`) |
 | `octocode tools` | List tools, read schemas, or run any MCP tool directly from the terminal |
 | `octocode context` | Print agent-facing protocol, system prompt, tool descriptions, and schemas |
 | `octocode install` | Configure Octocode in MCP clients |
@@ -272,7 +272,7 @@ environment variables  >  <octocode-home>/.octocoderc  >  built-in defaults
 2. **Global config**: `<octocode-home>/.octocoderc`, machine-wide defaults read by **both the CLI and the MCP server**.
 3. **Built-in defaults**: used when neither is set.
 
-**Octocode home** (`<octocode-home>`) holds the global config, encrypted credentials, sessions, stats, logs, and the clone cache. Its location is fixed per platform (there is no override):
+**Octocode home** (`<octocode-home>`) holds the global config, encrypted credentials, sessions, stats, logs, and tmp materialization caches. Its location is fixed per platform (there is no override):
 
 | Platform | Location |
 |----------|----------|
@@ -308,7 +308,7 @@ The **Scope** column shows where a setting applies: `Both`, or `MCP` (the CLI ig
 |---------|-------------------|---------|-------|--------------|
 | `OCTOCODE_TOKEN` / `GH_TOKEN` / `GITHUB_TOKEN` | env only | unset | Both | GitHub token, in priority order. Tokens stay in env, never in `.octocoderc`. |
 | `GITHUB_API_URL` | `github.apiUrl` | `https://api.github.com` | Both | API endpoint; use `/api/v3` for GitHub Enterprise. |
-| `ENABLE_LOCAL` | `local.enabled` | `true` | **MCP** | Turns local filesystem + LSP tools on/off for the MCP server. The CLI always has local tools enabled and ignores this. |
+| `ENABLE_LOCAL` | `local.enabled` | CLI `true`, MCP `false` | Both | Turns local filesystem + LSP tools on/off. |
 | `ENABLE_CLONE` | `local.enableClone` | CLI `true`, MCP `false` | Both | `ghCloneRepo` and directory fetch. Default differs by surface; set `false` to disable in either. |
 | `WORKSPACE_ROOT` | `local.workspaceRoot` | `cwd` | Both | Absolute root for resolving relative local paths. |
 | `ALLOWED_PATHS` | `local.allowedPaths` | `[]` | Both | Extra path allowlist for local access; empty means home directory only after validation. |
@@ -317,7 +317,7 @@ The **Scope** column shows where a setting applies: `Both`, or `MCP` (the CLI ig
 | `MAX_RETRIES` | `network.maxRetries` | `3` | Both | Retry attempts (clamped `0..10`). |
 | `OCTOCODE_OUTPUT_FORMAT` | `output.format` | `yaml` | Both | Response format: `yaml` or `json`. |
 
-> **Local and clone defaults differ by surface.** The **CLI** is a local terminal, so local tools are always enabled (`ENABLE_LOCAL` is ignored) and clone is enabled by default. The **MCP server** honors `ENABLE_LOCAL` (default on) and defaults clone to off, so a deployment can control what an assistant may touch. An explicit `ENABLE_CLONE=false` (env or `.octocoderc`) disables clone in either surface.
+> **Local and clone defaults differ by surface.** The **CLI** honors `ENABLE_LOCAL` and defaults local tools on; clone is enabled by default. The **MCP server** honors `ENABLE_LOCAL` and defaults local tools and clone off, so a deployment can control what an assistant may touch. Explicit env or `.octocoderc` values override those defaults.
 
 ### Example `.octocoderc`
 
@@ -329,7 +329,7 @@ Drop this at `<octocode-home>/.octocoderc` for machine-wide defaults shared by t
   "github": { "apiUrl": "https://api.github.com" },
 
   "local": {
-    "enabled": true,            // MCP only; the CLI always has local tools on
+    "enabled": true,            // overrides the surface default for CLI and MCP
     "enableClone": false,       // false disables ghCloneRepo for CLI and MCP
     "workspaceRoot": "~/code",  // base for relative local paths (absolute or ~)
     "allowedPaths": []          // extra dirs the local tools may read
@@ -425,12 +425,12 @@ Four code-intelligence axes; three are native to the Rust engine and need no ext
 
 | Axis | What it does | How to use it |
 |------|--------------|---------------|
-| **Structural AST** | Tree-sitter shape queries (`pattern` or YAML `rule`) across 19 grammars. | `localSearchCode mode:"structural"` · CLI `grep --pattern`/`--rule` |
+| **Structural AST** | Tree-sitter shape queries (`pattern` or YAML `rule`) across 33 grammars. | `localSearchCode mode:"structural"` · CLI `grep --pattern`/`--rule` |
 | **Signature outline** | Body-free skeleton with line numbers from real tree-sitter parsing, no heuristics. An anti-growth guard returns the real file when a skeleton wouldn't be smaller. | `minify:"symbols"` · CLI `cat --mode symbols` |
 | **Content minification** | Comment/whitespace stripping for 70+ languages and config formats; HTML/Vue/Svelte also minify embedded `<style>`/`<script>`. | `minify:"standard"` (default) |
 | **LSP navigation** | definition, references, callers/callees, callHierarchy, hover, typeDefinition, implementation, documentSymbols, via an installed language server; JS/TS also have a native, no-server path. | `lspGetSemantics` · CLI `lsp` / `ls --symbols` |
 
-📋 **Full support matrix:** every extension with its exact AST, signature, LSP, and minify capability, machine-generated from the shipped binary, lives in **[`benchmark/SUPPORT.md`](https://github.com/bgauryy/octocode/blob/main/packages/octocode-benchmark/benchmark/SUPPORT.md)** (143 extensions: 38 AST, 25 signature, 33 LSP, 105 minify-only). Regenerate or verify with `yarn workspace @octocodeai/octocode-benchmark matrix:check`.
+📋 **Full support matrix:** every extension with its exact AST, signature, LSP, and minify capability, machine-generated from the shipped binary, lives in **[`benchmark/SUPPORT.md`](https://github.com/bgauryy/octocode/blob/main/packages/octocode-benchmark/benchmark/SUPPORT.md)** (150 extensions: 61 AST, 47 signature, 56 LSP, 89 minify-only). Regenerate or verify with `yarn workspace @octocodeai/octocode-benchmark matrix:check`.
 
 ---
 
@@ -544,15 +544,3 @@ Tune Pi's behavior with an `APPEND_SYSTEM.md` (a compact starter lives at [`docs
 ### The Manifest
 
 **"Code is Truth, but Context is the Map."** Read the [Manifest of Octocode for Research Driven Development](https://github.com/bgauryy/octocode/blob/main/MANIFEST.md) to understand the philosophy behind Octocode.
-
----
-
-### Contributing
-
-See the [Development Guide](https://github.com/bgauryy/octocode/blob/main/docs/DEVELOPMENT_GUIDE.md) for monorepo setup, testing, and contribution guidelines.
-
----
-
-<div align="center">
-  <sub>Built for the AI engineering community.</sub>
-</div>

package/dist/lsp/index.d.ts

@@ -1,7 +1,7 @@
 export { LSPClient } from './client.js';
 export { detectLanguageId, getLanguageServerForFile } from './config.js';
 export { acquirePooledClient, getLspStatus, isLanguageServerAvailable, LSP_UNAVAILABLE_HINT, pooledClientCount, releaseAllPooledClients, releasePooledClientForFile, type LspStatusInput, type LspStatusResult, } from './manager.js';
-export { SymbolResolver } from './resolver.js';
+export { resolveImportAliasDefinitions, SymbolResolver, type ImportAliasDefinitionInput, } from './resolver.js';
 export { safeReadFile, validateLSPServerPath } from './validation.js';
 export { resolveWorkspaceRootForFile } from './workspaceRoot.js';
 export type { CallHierarchyItem, CodeSnippet, ExactPosition, FuzzyPosition, IncomingCall, InitializationOptions, LanguageServerCommand, LanguageServerConfig, LSPPaginationInfo, LSPRange, OutgoingCall, ReferenceLocation, ReferencesByFile, SymbolKind, UserLanguageServerConfig, } from './types.js';

package/dist/lsp/index.js

@@ -1,6 +1,6 @@
 export { LSPClient } from './client.js';
 export { detectLanguageId, getLanguageServerForFile } from './config.js';
 export { acquirePooledClient, getLspStatus, isLanguageServerAvailable, LSP_UNAVAILABLE_HINT, pooledClientCount, releaseAllPooledClients, releasePooledClientForFile, } from './manager.js';
-export { SymbolResolver } from './resolver.js';
+export { resolveImportAliasDefinitions, SymbolResolver, } from './resolver.js';
 export { safeReadFile, validateLSPServerPath } from './validation.js';
 export { resolveWorkspaceRootForFile } from './workspaceRoot.js';

package/dist/lsp/resolver.d.ts

@@ -1,4 +1,4 @@
-import type { ExactPosition, FuzzyPosition } from './types.js';
+import type { CodeSnippet, ExactPosition, FuzzyPosition } from './types.js';
 export declare class SymbolResolutionError extends Error {
     readonly symbolName: string;
     readonly lineHint: number;
@@ -15,6 +15,11 @@ interface ResolvedSymbol {
     lineOffset: number;
     lineContent: string;
 }
+export interface ImportAliasDefinitionInput {
+    anchorUri: string;
+    symbolName: string;
+    locations: CodeSnippet[];
+}
 export declare function resolveSymbolPosition(filePath: string, symbolName: string, lineHint?: number, orderHint?: number): Promise<ResolvedSymbol>;
 export declare function resolveSymbolPosition(content: string, fuzzy: FuzzyPosition): ResolvedSymbol;
 export declare class SymbolResolver {
@@ -23,4 +28,5 @@ export declare class SymbolResolver {
     resolvePosition(filePath: string, fuzzy: FuzzyPosition): Promise<ResolvedSymbol>;
     resolvePositionFromContent(content: string, fuzzy: FuzzyPosition): ResolvedSymbol;
 }
+export declare function resolveImportAliasDefinitions({ anchorUri, symbolName, locations, }: ImportAliasDefinitionInput): Promise<CodeSnippet[]>;
 export {};

package/dist/lsp/resolver.js

@@ -1,3 +1,5 @@
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
 import { nativeBinding } from './native.js';
 export class SymbolResolutionError extends Error {
     symbolName;
@@ -71,3 +73,118 @@ export class SymbolResolver {
         }
     }
 }
+export async function resolveImportAliasDefinitions({ anchorUri, symbolName, locations, }) {
+    const resolved = await Promise.all(locations.map(location => resolveImportAliasDefinition(anchorUri, symbolName, location)));
+    return resolved;
+}
+async function resolveImportAliasDefinition(anchorUri, symbolName, location) {
+    const locationPath = snippetPath(location.uri, anchorUri);
+    if (!isSamePath(locationPath, anchorUri))
+        return location;
+    if (!isImportSnippet(location.content))
+        return location;
+    const importTarget = importTargetForSymbol(location.content, symbolName);
+    if (!importTarget?.moduleSpecifier.startsWith('.'))
+        return location;
+    const targetPath = await resolveLocalModulePath(locationPath, importTarget.moduleSpecifier);
+    if (!targetPath)
+        return location;
+    const content = await readFile(targetPath, 'utf-8');
+    const declaration = findExportedDeclaration(content, importTarget.exportedName);
+    if (!declaration)
+        return location;
+    return {
+        uri: targetPath,
+        range: {
+            start: { line: declaration.line - 1, character: declaration.character },
+            end: { line: declaration.line - 1, character: declaration.character },
+        },
+        displayRange: { startLine: declaration.line, endLine: declaration.line },
+        content: declaration.content,
+    };
+}
+function isImportSnippet(content) {
+    return /^\s*import\s/.test(content.trim());
+}
+function importTargetForSymbol(importLine, symbolName) {
+    const namedImport = importLine.match(/import\s*\{([^}]+)\}\s*from\s*['"]([^'"]+)['"]/);
+    const namedImports = namedImport?.[1];
+    const namedModulePath = namedImport?.[2];
+    if (namedImports && namedModulePath) {
+        for (const part of namedImports.split(',')) {
+            const [original, alias] = part
+                .trim()
+                .split(/\s+as\s+/)
+                .map(value => value.trim());
+            if (alias === symbolName || original === symbolName) {
+                return {
+                    moduleSpecifier: namedModulePath,
+                    exportedName: original,
+                };
+            }
+        }
+    }
+    const defaultImport = importLine.match(/import\s+([A-Za-z_$][\w$]*)\s+from\s*['"]([^'"]+)['"]/);
+    const defaultName = defaultImport?.[1];
+    const defaultModulePath = defaultImport?.[2];
+    if (defaultName === symbolName && defaultModulePath) {
+        return { moduleSpecifier: defaultModulePath, exportedName: symbolName };
+    }
+    return undefined;
+}
+async function resolveLocalModulePath(importerPath, moduleSpecifier) {
+    const basePath = path.resolve(path.dirname(filePathFromUri(importerPath)), moduleSpecifier);
+    const extension = path.extname(basePath);
+    const sourcePath = extension ? basePath.slice(0, -extension.length) : basePath;
+    const candidates = [
+        ...(extension === '.js' || extension === '.jsx'
+            ? [`${sourcePath}.ts`, `${sourcePath}.tsx`]
+            : []),
+        basePath,
+        `${basePath}.ts`,
+        `${basePath}.tsx`,
+        `${basePath}.js`,
+        `${basePath}.jsx`,
+        path.join(basePath, 'index.ts'),
+        path.join(basePath, 'index.tsx'),
+        path.join(basePath, 'index.js'),
+        path.join(basePath, 'index.jsx'),
+    ];
+    for (const candidate of candidates) {
+        try {
+            await readFile(candidate, 'utf-8');
+            return candidate;
+        }
+        catch {
+            // Try the next TypeScript/JavaScript resolution candidate.
+        }
+    }
+    return undefined;
+}
+function findExportedDeclaration(content, symbolName) {
+    const escaped = symbolName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const declarationPattern = new RegExp(`^\\s*export\\s+(?:default\\s+)?(?:async\\s+)?(?:function|class|interface|type|const|let|var|enum)\\s+${escaped}\\b`);
+    const lines = content.split(/\r?\n/);
+    for (const [index, line] of lines.entries()) {
+        if (!declarationPattern.test(line))
+            continue;
+        return {
+            line: index + 1,
+            character: Math.max(0, line.indexOf(symbolName)),
+            content: line.trim(),
+        };
+    }
+    return undefined;
+}
+function isSamePath(left, right) {
+    return (path.resolve(filePathFromUri(left)) === path.resolve(filePathFromUri(right)));
+}
+function snippetPath(uri, anchorUri) {
+    const filePath = filePathFromUri(uri);
+    if (path.isAbsolute(filePath))
+        return filePath;
+    return path.resolve(path.dirname(filePathFromUri(anchorUri)), filePath);
+}
+function filePathFromUri(uri) {
+    return uri.startsWith('file://') ? new URL(uri).pathname : uri;
+}

package/dist/security/discoveryFilter.d.ts

@@ -0,0 +1,11 @@
+export declare const DISCOVERY_IGNORED_FOLDER_NAMES: string[];
+export declare const DISCOVERY_IGNORED_FILE_NAMES: string[];
+export declare const DISCOVERY_IGNORED_FILE_EXTENSIONS: string[];
+export interface DiscoveryExtensionOptions {
+    lowercase?: boolean;
+    fallback?: string;
+    leadingDot?: boolean;
+}
+export declare function shouldIgnoreDiscoveryDir(folderName: string): boolean;
+export declare function shouldIgnoreDiscoveryFile(filePath: string): boolean;
+export declare function getDiscoveryExtension(filePath: string, options?: DiscoveryExtensionOptions): string;

package/dist/security/discoveryFilter.js

@@ -0,0 +1,264 @@
+export const DISCOVERY_IGNORED_FOLDER_NAMES = [
+    '.github',
+    '.git',
+    '.vscode',
+    '.devcontainer',
+    '.config',
+    '.cargo',
+    '.changeset',
+    '.husky',
+    '.aspect',
+    '.eslint-plugin-local',
+    '.yarn',
+    '.gemini',
+    '.ng-dev',
+    '.configurations',
+    '.tx',
+    'dist',
+    'build',
+    'out',
+    'output',
+    'target',
+    'release',
+    'node_modules',
+    'vendor',
+    'third_party',
+    'tmp',
+    'temp',
+    'cache',
+    '.cache',
+    '.tmp',
+    '.pytest_cache',
+    '.tox',
+    '.venv',
+    '.mypy_cache',
+    '.next',
+    '.svelte-kit',
+    '.turbo',
+    '.angular',
+    '.dart_tool',
+    '__pycache__',
+    '.ruff_cache',
+    '.nox',
+    'htmlcov',
+    'cover',
+    '.gradle',
+    '.m2',
+    '.sbt',
+    '.bloop',
+    '.metals',
+    '.bsp',
+    'bin',
+    'obj',
+    'TestResults',
+    'BenchmarkDotNet.Artifacts',
+    '.vendor-new',
+    'Godeps',
+    'composer.phar',
+    '.phpunit.result.cache',
+    '.bundle',
+    '.byebug_history',
+    '.rspec_status',
+    '.mvn',
+    '.aws',
+    '.gcp',
+    'fastlane',
+    'DerivedData',
+    'xcuserdata',
+    'local.properties',
+    '.navigation',
+    'captures',
+    '.externalNativeBuild',
+    '.cxx',
+    '.idea',
+    '.idea_modules',
+    '.vs',
+    '.history',
+    'coverage',
+    '.nyc_output',
+    'logs',
+    'log',
+    '.DS_Store',
+];
+export const DISCOVERY_IGNORED_FILE_NAMES = [
+    'package-lock.json',
+    '.secrets',
+    '.secret',
+    'secrets.json',
+    'secrets.yaml',
+    'secrets.yml',
+    'credentials.json',
+    'credentials.yaml',
+    'credentials.yml',
+    'auth.json',
+    'auth.yaml',
+    'auth.yml',
+    'api-keys.json',
+    'api_keys.json',
+    'service-account.json',
+    'service_account.json',
+    'private-key.pem',
+    'private_key.pem',
+    'id_rsa',
+    'id_dsa',
+    'id_ecdsa',
+    'id_ed25519',
+    'keyfile',
+    'keyfile.json',
+    'gcloud-service-key.json',
+    'firebase-adminsdk.json',
+    'google-services.json',
+    'GoogleService-Info.plist',
+    '.DS_Store',
+    'Thumbs.db',
+    'db.sqlite3',
+    'db.sqlite3-journal',
+    '.eslintcache',
+    '.stylelintcache',
+    '.node_repl_history',
+    '.yarn-integrity',
+    'celerybeat-schedule',
+    'celerybeat.pid',
+    'ThirdPartyNoticeText.txt',
+    'ThirdPartyNotices.txt',
+    'cglicenses.json',
+    'cgmanifest.json',
+];
+export const DISCOVERY_IGNORED_FILE_EXTENSIONS = [
+    '.lock',
+    '.log',
+    '.tmp',
+    '.temp',
+    '.cache',
+    '.bak',
+    '.backup',
+    '.orig',
+    '.swp',
+    '.swo',
+    '.rej',
+    '.pid',
+    '.seed',
+    '.old',
+    '.save',
+    '.temporary',
+    '.exe',
+    '.dll',
+    '.so',
+    '.dylib',
+    '.a',
+    '.lib',
+    '.o',
+    '.obj',
+    '.bin',
+    '.class',
+    '.pdb',
+    '.dSYM',
+    '.pyc',
+    '.pyo',
+    '.pyd',
+    '.jar',
+    '.war',
+    '.ear',
+    '.nar',
+    '.db',
+    '.sqlite',
+    '.sqlite3',
+    '.mdb',
+    '.accdb',
+    '.zip',
+    '.tar',
+    '.gz',
+    '.bz2',
+    '.xz',
+    '.lz',
+    '.lzma',
+    '.Z',
+    '.tgz',
+    '.rar',
+    '.7z',
+    '.deb',
+    '.rpm',
+    '.pkg',
+    '.dmg',
+    '.msi',
+    '.appx',
+    '.snap',
+    '.map',
+    '.d.ts.map',
+    '.min.js',
+    '.min.css',
+    '.key',
+    '.pem',
+    '.p12',
+    '.pfx',
+    '.crt',
+    '.cer',
+    '.der',
+    '.csr',
+    '.jks',
+    '.keystore',
+    '.truststore',
+    '.kate-swp',
+    '.gnome-desktop',
+    '.sublime-project',
+    '.sublime-workspace',
+    '.iml',
+    '.iws',
+    '.ipr',
+    '.patch',
+    '.diff',
+    '.prof',
+    '.profile',
+    '.trace',
+    '.perf',
+    '.coverage',
+    '.egg-info',
+    '.egg',
+    '.mo',
+    '.pot',
+    '.setup',
+    '.paket.template',
+];
+export function shouldIgnoreDiscoveryDir(folderName) {
+    const normalized = folderName.replace(/\\/g, '/');
+    const name = normalized.split('/').filter(Boolean).pop() ?? normalized;
+    return DISCOVERY_IGNORED_FOLDER_NAMES.includes(name);
+}
+export function shouldIgnoreDiscoveryFile(filePath) {
+    const normalizedPath = filePath.replace(/\\/g, '/');
+    const fileName = normalizedPath.split('/').pop() || '';
+    for (const ext of DISCOVERY_IGNORED_FILE_EXTENSIONS) {
+        if (fileName.endsWith(ext)) {
+            return true;
+        }
+    }
+    if (DISCOVERY_IGNORED_FILE_NAMES.includes(fileName)) {
+        return true;
+    }
+    const pathParts = normalizedPath.split('/');
+    for (const part of pathParts) {
+        if (DISCOVERY_IGNORED_FOLDER_NAMES.includes(part)) {
+            return true;
+        }
+    }
+    return false;
+}
+export function getDiscoveryExtension(filePath, options) {
+    const basename = filePath.split(/[\\/]/).pop() ?? filePath;
+    const fallback = options?.fallback ?? '';
+    let ext = fallback;
+    if (basename.startsWith('.')) {
+        const dotfileExt = basename.slice(1);
+        ext = dotfileExt.includes('.')
+            ? (basename.split('.').pop() ?? fallback)
+            : dotfileExt;
+    }
+    else {
+        const lastDot = basename.lastIndexOf('.');
+        ext = lastDot === -1 ? fallback : basename.slice(lastDot + 1);
+    }
+    const normalized = options?.lowercase ? ext.toLowerCase() : ext;
+    if (!normalized || !options?.leadingDot)
+        return normalized;
+    return normalized.startsWith('.') ? normalized : `.${normalized}`;
+}

package/dist/security/index.d.ts

@@ -7,6 +7,8 @@ export { withSecurityValidation, withBasicSecurityValidation, configureSecurity,
 export type { SecurityDepsConfig } from './withSecurityValidation.js';
 export { extractResearchFields, extractRepoOwnerFromParams, } from './paramExtractors.js';
 export { shouldIgnore, shouldIgnorePath, shouldIgnoreFile, } from './ignoredPathFilter.js';
+export { DISCOVERY_IGNORED_FILE_EXTENSIONS, DISCOVERY_IGNORED_FILE_NAMES, DISCOVERY_IGNORED_FOLDER_NAMES, getDiscoveryExtension, shouldIgnoreDiscoveryDir, shouldIgnoreDiscoveryFile, } from './discoveryFilter.js';
+export type { DiscoveryExtensionOptions } from './discoveryFilter.js';
 export { redactPath } from './pathUtils.js';
 export { ALLOWED_COMMANDS, DANGEROUS_PATTERNS, PATTERN_DANGEROUS_PATTERNS, } from './securityConstants.js';
 export { IGNORED_PATH_PATTERNS } from './pathPatterns.js';

package/dist/security/index.js

@@ -5,6 +5,7 @@ export { validateCommand } from './commandValidator.js';
 export { withSecurityValidation, withBasicSecurityValidation, configureSecurity, } from './withSecurityValidation.js';
 export { extractResearchFields, extractRepoOwnerFromParams, } from './paramExtractors.js';
 export { shouldIgnore, shouldIgnorePath, shouldIgnoreFile, } from './ignoredPathFilter.js';
+export { DISCOVERY_IGNORED_FILE_EXTENSIONS, DISCOVERY_IGNORED_FILE_NAMES, DISCOVERY_IGNORED_FOLDER_NAMES, getDiscoveryExtension, shouldIgnoreDiscoveryDir, shouldIgnoreDiscoveryFile, } from './discoveryFilter.js';
 export { redactPath } from './pathUtils.js';
 export { ALLOWED_COMMANDS, DANGEROUS_PATTERNS, PATTERN_DANGEROUS_PATTERNS, } from './securityConstants.js';
 export { IGNORED_PATH_PATTERNS } from './pathPatterns.js';