@octocodeai/octocode-engine 16.7.0 → 17.0.1

package/README.md

@@ -13,9 +13,7 @@
 
 **Evidence-first code research for AI agents and developers.**
 
-Octocode gives an agent the full context it needs to change, review, or explain code: real evidence from your **local workspace** and from **external** sources (GitHub repositories, pull requests, and npm packages). One toolset covers all of it: ripgrep and AST structural search, repository tree browsing, precise content fetching, LSP semantic navigation, and binary inspection.
-
-Run it as a **CLI** or an **MCP server**. A **Rust engine** keeps every call fast and token-efficient, minifying and skeletonizing code so an agent reads the shape of a file instead of every byte, from a single file to a mega-repo. It is also the best tool for **cross-repository research and exploration across millions of repositories**.
+Evidence from your **local workspace** and **external** sources (GitHub repos, PRs, npm). One toolset: ripgrep + AST search, trees, precise reads, and LSP — as a **CLI** or **MCP server**, backed by a **Rust engine** for fast, token-efficient results across single files or mega-repos.
 
 ---
 
@@ -53,7 +51,7 @@ npx octocode auth login
 npx octocode status       # verify the active token source
 ```
 
-**3. Choose your interface.** The same engine and 14 tools run identically either way.
+**3. Choose your interface.** The same engine and 12 tools run identically either way.
 
 **🖥️ CLI** — research straight from your terminal:
 
@@ -107,8 +105,7 @@ Octocode is useful whenever the next coding step depends on finding and proving
 | **Semantic navigation** | Resolve definitions, references, callers/callees, call hierarchy, hovers, symbols, diagnostics, and type relationships through LSP. |
 | **Structural matching** | Run AST-shaped searches with patterns or YAML rules so comments and strings do not become false positives. |
 | **Large-file context** | Minify, skeletonize, or paginate code so agents spend tokens on relevant structure instead of boilerplate. |
-| **Binary or archive inspection** | Inspect archives, compressed streams, native binaries, and strings without leaving the research flow. |
-| **Agent workflows** | Expose the same engine through MCP, CLI, OQL, and Agent Skills so assistants and humans use one evidence model. |
+| **Agent workflows** | Same engine via MCP, CLI, OQL, and Agent Skills. |
 
 See [Quick Start](#quick-start) to install in your terminal or AI assistant.
 
@@ -116,7 +113,7 @@ See [Quick Start](#quick-start) to install in your terminal or AI assistant.
 
 ## Tools
 
-Octocode ships **14 research tools**; the same implementations run identically over [MCP](#mcp) and the [CLI](#cli). Local tools are enabled by default; `ENABLE_LOCAL=false` disables them. `ghCloneRepo` is opt-in for MCP (`ENABLE_CLONE=true`) and enabled by default for CLI. All flags: [Configuration Reference](https://github.com/bgauryy/octocode/blob/main/docs/CONFIGURATION.md).
+**12 always-on tools** (same on [MCP](#mcp) and [CLI](#cli)). Local tools on by default (`ENABLE_LOCAL=false` to disable). `ghCloneRepo` is MCP opt-in (`ENABLE_CLONE=true`), CLI on by default. Flags: [Configuration](https://github.com/bgauryy/octocode/blob/main/docs/CONFIGURATION.md).
 
 **Token knobs.** `concise:true` returns path/title-only lists. `minify` controls file read density: `symbols` = skeleton with line numbers, `standard` = comments/blanks stripped (default), `none` = exact bytes.
 
@@ -139,7 +136,6 @@ Octocode ships **14 research tools**; the same implementations run identically o
 | `localViewStructure` | Browse a local directory tree: depth, filters, pagination, metadata. | `concise` |
 | `localFindFiles` | Find local files and directories by name, path, regex, extension, size, time, permissions, type. | |
 | `localGetFileContent` | Read a local file or region: exact slice, match string, line range, or paginated chars. | `minify` |
-| `localBinaryInspect` | Inspect archives, compressed streams, and native binaries: inspect (format/symbols/imports/deps), list, extract, decompress, strings. | |
 
 ### Package Search
 
@@ -157,7 +153,7 @@ Octocode ships **14 research tools**; the same implementations run identically o
 
 | Tool | What it does |
 |------|--------------|
-| `oqlSearch` | Runs typed OQL queries across code, content, structure, files, semantics, repositories, packages, pull requests, commits, artifacts, diff, research, graph, and materialization targets. |
+| `oqlSearch` | Runs typed OQL queries across code, content, structure, files, semantics, repositories, packages, pull requests, commits, diff, research, graph, and materialization targets. |
 
 Full schemas, fields, and examples for every tool live in [`docs/OCTOCODE_TOOLS.md`](https://github.com/bgauryy/octocode/blob/main/docs/OCTOCODE_TOOLS.md) (linked under [Documentation](#documentation)).
 
@@ -225,13 +221,13 @@ npx octocode --help       # full usage
 | `npx octocode search <path\|owner/repo> --tree` | Browse directory or repository structure |
 | `npx octocode search <file>` | Read file content; `--content-view exact\|compact\|symbols` or `--raw` |
 | `npx octocode search <file> --symbols` | Symbol outline for a file or source tree |
-| `npx octocode search --query <oql-json>` | Full OQL across all target types (code, commits, PRs, packages, artifacts …) |
+| `npx octocode search --query <oql-json>` | Full OQL across all target types (code, commits, PRs, packages, …) |
 
 #### More commands
 
-- **GitHub & npm** — `npx octocode search <…> --target repositories|packages|pullRequests|commits|artifacts|diff`
+- **GitHub & npm** — `npx octocode search <…> --target repositories|packages|pullRequests|commits|diff`
 - **LSP** — `npx octocode search <file> --op definition|references|callers|callees|hover|diagnostic|callHierarchy` (`--symbol`, `--line` to narrow)
-- **Cache & clone** — `npx octocode clone`, `npx octocode unzip`, `npx octocode cache fetch|status|clear`
+- **Cache & clone** — `npx octocode clone`, `npx octocode cache fetch|status|clear`
 - **Skills** — `npx octocode skill --list | --name <skill> | --add <github-path> | --install-all`
 - **Language servers** — `npx octocode lsp-server list|install|status|uninstall|clean`
 - **Setup & introspection** — `npx octocode install`, `npx octocode auth`, `npx octocode status`, `npx octocode tools`, `npx octocode context`
@@ -357,42 +353,17 @@ Four code-intelligence axes; three are native to the Rust engine and need no ext
 > [Agent Skills](https://agentskills.io/what-are-skills) are a lightweight, open format for extending AI agent capabilities.
 > Browse and install on [**skills.sh/bgauryy/octocode-mcp**](https://www.skills.sh/bgauryy/octocode-mcp)
 
-These are the skills the Octocode team itself uses to build Octocode. **Six source skills** live under [`skills/`](https://github.com/bgauryy/octocode/tree/main/skills); the separately managed **Awareness** skill lives under [`packages/octocode-awareness/skills/`](https://github.com/bgauryy/octocode/tree/main/packages/octocode-awareness/skills) and is bundled alongside them. The table below is the full seven-skill index. ⭐ **[Research](https://www.skills.sh/bgauryy/octocode-mcp/octocode-research)** is the recommended starting skill for technical research, code work, reviews, refactors, and repeated evidence loops.
-
-Each skill folder includes a human README with purpose, features, workflow, developer notes, and `npx octocode skill` installation. `SKILL.md` stays the compact agent-facing router.
-
-Install them with the Octocode CLI through `npx octocode`; no global install is required. Octocode refreshes the canonical source in `~/.octocode/skills/<skill>` and links it into the platform location by default. Pick the platform your agent reads from, or use `common` for the shared `~/.agents/skills` folder.
+**1 skill** under [`skills/`](https://github.com/bgauryy/octocode/tree/main/skills), bundled in the `octocode` package. Start with ⭐ [Research](https://www.skills.sh/bgauryy/octocode-mcp/octocode-research) for evidence-first code work.
 
 ```bash
-npx octocode skill --list                                      # browse available Octocode skills
-npx octocode skill --name octocode-research                    # install to ~/.agents/skills (common)
-npx octocode skill --name octocode-awareness                   # install bundled Awareness by name
-npx octocode skill --name octocode-research --platform pi      # install for Pi
-npx octocode skill --name octocode-research --platform all --dry-run  # preview before installing everywhere
-npx octocode skill --add --path /path/to/skills/octocode-awareness  # install from an agent-known local skill path
-npx octocode skill --add owner/repo/skills/my-skill            # install any GitHub skill folder
-npx octocode skill --add owner/repo/skills                     # install every skill in a GitHub skills library
-npx octocode skill --install-all                               # install every official Octocode skill to ~/.agents/skills
-npx octocode skill --help                                      # read live flags
+npx octocode skill --list
+npx octocode skill --name octocode-research
+npx octocode skill --help
 ```
 
-Platforms: `common` (default, `~/.agents/skills`), `cursor` (`~/.cursor/skills`), `claude` (`~/.claude/skills` and `~/.claude-desktop/skills`), `codex` (`~/.agents/skills`), `opencode` (`~/.config/opencode/skills`), `pi` (`~/.pi/agent/skills`), `copilot` (`~/.copilot/skills`), `gemini` (`~/.gemini/skills`), `all` · Modes: `symlink` (default), `copy`, `hybrid`
-
-The repository's cross-vendor sync helper is plan-first and path-safe: dry-run previews disclose replacements, writes require explicit approval, and destination names must be safe single path segments. Pi bundle sync also discloses removals during dry-run and preserves separately managed skills such as Awareness. Skill scripts use `@octocodeai/config` as the single environment-loading boundary.
-
-Workflow contracts are equally explicit: Brainstorming run ledgers and hooks stay workspace-scoped; Research can review a clean file but only recommends `APPROVE` after applicable verification passes; Prompt Optimizer accepts multiple intentional branches when every branch is unambiguous.
-
-| Skill | Directory | Install with `npx octocode` | Use it when |
-|-------|-----------|-----------------------------|-------------|
-| [**Brainstorming**](https://www.skills.sh/bgauryy/octocode-mcp/octocode-brainstorming) | `octocode-brainstorming/` | `npx octocode skill --name octocode-brainstorming` | The idea is fuzzy and needs prior-art or opportunity validation. |
-| ⭐ [**Research**](https://www.skills.sh/bgauryy/octocode-mcp/octocode-research) | `octocode-research/` | `npx octocode skill --name octocode-research` | You need evidence-first technical research, code work, review, refactor, architecture analysis, or repeated proof loops. |
-| [**RFC Generator**](https://www.skills.sh/bgauryy/octocode-mcp/octocode-rfc-generator) | `octocode-rfc-generator/` | `npx octocode skill --name octocode-rfc-generator` | You need a design doc, RFC, architecture proposal, migration plan, or rollout plan before coding. |
-| [**Roast**](https://www.skills.sh/bgauryy/octocode-mcp/octocode-roast) | `octocode-roast/` | `npx octocode skill --name octocode-roast` | You want blunt but actionable code critique. |
-| [**Skills**](https://www.skills.sh/bgauryy/octocode-mcp/octocode-skills) | `octocode-skills/` | `npx octocode skill --name octocode-skills` | You are working on Agent Skills themselves. |
-| [**Prompt Optimizer**](https://github.com/bgauryy/octocode/tree/main/skills/octocode-prompt-optimizer) | `octocode-prompt-optimizer/` | `npx octocode skill --name octocode-prompt-optimizer` | You want to optimize, strengthen, or shorten a prompt, `SKILL.md`, or `AGENTS.md`. |
-| [**Awareness**](https://www.skills.sh/bgauryy/octocode-mcp/octocode-awareness) | `packages/octocode-awareness/skills/octocode-awareness/` | `npx octocode skill --name octocode-awareness` | You need shared agent memory, file locks, notifications, handoffs, reflection, hooks, or verify-before-conclude in a shared repo. |
-
-Awareness is the primary skill for memory, locks, signals, reflection, schemas, and hooks. Older prompts that name `octocode-reflection` or `octocode-agent-communication` should load the same [`@octocodeai/octocode-awareness`](https://github.com/bgauryy/octocode/tree/main/packages/octocode-awareness) runtime.
+| Skill | Install | Use when |
+|-------|---------|----------|
+| ⭐ [**Research**](https://www.skills.sh/bgauryy/octocode-mcp/octocode-research) | `npx octocode skill --name octocode-research` | Evidence-first research, review, refactor, architecture. |
 
 ---
 
@@ -437,9 +408,6 @@ client → sanitize inputs (Rust) → run tool (GitHub / FS / LSP) → sanitize
 | [`packages/octocode-engine`](https://github.com/bgauryy/octocode/tree/main/packages/octocode-engine) | `@octocodeai/octocode-engine` | Rust/napi native engine: security scanning, minification, signatures, structural AST, ripgrep/diff/YAML, LSP. |
 | [`packages/octocode-config`](https://github.com/bgauryy/octocode/tree/main/packages/octocode-config) | `@octocodeai/config` | Zero-dep env + config loader: `getOctocodeHome`, `.env` parsing, `.octocoderc` reading. Single source used by every package and skill. |
 | [`packages/octocode-vscode`](https://github.com/bgauryy/octocode/tree/main/packages/octocode-vscode) | `octocode-mcp-vscode` | VS Code extension: GitHub OAuth + multi-editor MCP install. |
-| [`packages/octocode-awareness`](https://github.com/bgauryy/octocode/tree/main/packages/octocode-awareness) | `@octocodeai/octocode-awareness` | Shared workspace coordination: file locks, durable memory, agent-to-agent signals, and verification gates over one local SQLite store. Runtime behind Awareness, including the legacy Reflection and Agent Communication workflows. |
-| [`packages/octocode-pi-extension`](https://github.com/bgauryy/octocode/tree/main/packages/octocode-pi-extension) | `@octocodeai/pi-extension` | Official [Pi](https://github.com/earendil-works/pi) harness: operating-model system prompt, 13 native research tools registered in-process, memory tools, edit-safety hooks, and bundled workflow skills. |
-| [`packages/octocode-agent`](https://github.com/bgauryy/octocode/tree/main/packages/octocode-agent) | `octocode-agent` | Self-working coding agent CLI: launches Pi with `@octocodeai/pi-extension` as its harness under one branded command. |
 
 `packages/octocode-benchmark` (private, not published) holds benchmark methodology, evals, and run artifacts — see [Documentation](#documentation).
 
@@ -454,8 +422,7 @@ Website: **[octocode.ai](https://octocode.ai)** · Product docs: **[github.com/b
 | MCP server | [Octocode MCP Server](https://github.com/bgauryy/octocode/blob/main/docs/OCTOCODE_MCP.md) · [Configuration](https://github.com/bgauryy/octocode/blob/main/docs/CONFIGURATION.md) · [Authentication](https://github.com/bgauryy/octocode/blob/main/docs/CONFIGURATION.md) |
 | Tools and workflows | [Octocode Tools Reference](https://github.com/bgauryy/octocode/blob/main/docs/OCTOCODE_TOOLS.md) · [Octocode Research Skill](https://github.com/bgauryy/octocode/tree/main/skills/octocode-research) · [Search Guide](https://github.com/bgauryy/octocode/blob/main/docs/context/SEARCH_GUIDE.md) |
 | CLI and query language | [Octocode CLI Guide](https://github.com/bgauryy/octocode/blob/main/docs/OCTOCODE_CLI.md) · [Octocode Query Language](https://github.com/bgauryy/octocode/blob/main/docs/OCTOCODE_QUERY_LANGUAGE.md) · [OQL Research Graph Flow](https://github.com/bgauryy/octocode/blob/main/docs/context/OQL_RESEARCH_GRAPH_FLOW.md) |
-| Agent harness and skills | [Octocode Pi package](https://github.com/bgauryy/octocode/blob/main/packages/octocode-pi-extension/README.md) · [Octocode Awareness package](https://github.com/bgauryy/octocode/blob/main/packages/octocode-awareness/README.md) · [Skills](https://github.com/bgauryy/octocode/tree/main/skills) |
-| Pi | [Pi package README](https://github.com/bgauryy/octocode/blob/main/packages/octocode-pi-extension/README.md) · [Pi APPEND_SYSTEM starter](https://github.com/bgauryy/octocode/blob/main/packages/octocode-pi-extension/docs/PI/APPEND_SYSTEM.md) |
+| Skills | [Skills](https://github.com/bgauryy/octocode/tree/main/skills) |
 | Development and security | [Security Model](https://github.com/bgauryy/octocode/blob/main/docs/SECURITY.md) · [LSP Server Lifecycle](https://github.com/bgauryy/octocode/blob/main/docs/LSP_SERVER_LIFECYCLE.md) |
 | Benchmarks and evals | [Benchmark Summary](https://github.com/bgauryy/octocode/blob/main/packages/octocode-benchmark/BENCHMARK.md) · [Unified CLI/Tool/OQL Eval](https://github.com/bgauryy/octocode/blob/main/packages/octocode-benchmark/benchmark/octocode/README.md) · [Benchmark Runbook](https://github.com/bgauryy/octocode/blob/main/packages/octocode-benchmark/recipes/agent-benchmark-runbook.md) · [Support Matrix](https://github.com/bgauryy/octocode/blob/main/docs/LSP_SERVER_LIFECYCLE.md#full-format-support-matrix) |
 | Shared internals | [Credentials Architecture](https://github.com/bgauryy/octocode/blob/main/docs/CONFIGURATION.md#github-token) · [Session Persistence](https://github.com/bgauryy/octocode/blob/main/docs/OCTOCODE_MCP.md#session-persistence) |
@@ -486,19 +453,13 @@ Read the output and fix accordingly.
   npx octocode skill --name octocode-research --platform pi
   ```
 
-- **Adapter route — full tool surface.** Install [`pi-mcp-adapter`](https://github.com/nicobailon/pi-mcp-adapter) to expose all 14 Octocode MCP tools behind a single ~200-token proxy tool, so servers stay disconnected until a tool is actually called. Enable clone tools with `ENABLE_CLONE=true`.
-
-Tune Pi's behavior with an `APPEND_SYSTEM.md` packaged in [`@octocodeai/pi-extension`](https://github.com/bgauryy/octocode/blob/main/packages/octocode-pi-extension/README.md). The full walkthrough — package install, setup commands, skills, optional MCP setup, and custom models — is in the [**Pi package README**](https://github.com/bgauryy/octocode/blob/main/packages/octocode-pi-extension/README.md).
-
-### Octocode Harness
-
-The Octocode harness is the recommended agent environment for research-driven development: Pi supplies the local coding loop, `npx octocode` supplies structured code research, and Octocode Skills encode the workflows agents should follow before they edit.
+- **Adapter route — full tool surface.** Install [`pi-mcp-adapter`](https://github.com/nicobailon/pi-mcp-adapter) to expose Octocode MCP tools behind a single ~200-token proxy tool, so servers stay disconnected until a tool is actually called. Enable clone tools with `ENABLE_CLONE=true`.
 
-Docs: [Pi package README](https://github.com/bgauryy/octocode/blob/main/packages/octocode-pi-extension/README.md) · [APPEND_SYSTEM starter](https://github.com/bgauryy/octocode/blob/main/packages/octocode-pi-extension/docs/PI/APPEND_SYSTEM.md)
+### Research-driven loop
 
-It is deliberately research-oriented because most agent failures start before implementation: the agent guesses the owner of a behavior, trusts a snippet without reading the exact source, or edits before proving blast radius. The harness pushes the agent through a cheaper loop first: orient with trees and discovery output, search with Octocode, read exact evidence, use AST/LSP when identity matters, then patch and verify.
+Most agent failures start before implementation: the agent guesses the owner of a behavior, trusts a snippet without reading the exact source, or edits before proving blast radius. Prefer a cheaper loop first: orient with trees and discovery output, search with Octocode, read exact evidence, use AST/LSP when identity matters, then patch and verify.
 
-That shape keeps the editing surface small while preserving context for what matters: file anchors, symbols, call paths, PR/history evidence, package sources, and the verification command that proves the change. In short, Pi is the hands, Octocode is the map, and the skills/system prompt make the habit repeatable.
+That shape keeps the editing surface small while preserving context for what matters: file anchors, symbols, call paths, PR/history evidence, package sources, and the verification command that proves the change. In short, the host edits, Octocode is the map, and skills encode the habit.
 
 ### The Manifest
 

package/dist/lsp/serverManifest.d.ts

@@ -11,7 +11,7 @@ import { type PlatformId } from './platform.js';
  * Live network download is gated and requires a pinned `sha256` per asset.
  * Until SHAs are pinned the manifest still drives (a) honest detect-and-instruct
  * guidance and (b) reuse of a server a user/CI has pre-populated into the
- * managed cache `~/.octocode/lsp/<server>/<releaseTag>/<binName>`.
+ * managed cache `<octocode-home>/lsp/<server>/<releaseTag>/<binName>`.
  */
 export type ArchiveKind = 'none' | 'gz' | 'zip' | 'tar.gz' | 'tar.xz';
 export interface ManifestAsset {
@@ -51,9 +51,9 @@ export declare function listManifestServers(): Array<{
 /** Whether the manifest can, in principle, auto-provide this server. */
 export declare function isAutoDownloadable(serverName: string): boolean;
 /**
- * Root of the managed server cache. Defaults to `~/.octocode/lsp` (consistent
- * with the rest of octocode's home), overridable via `OCTOCODE_LSP_CACHE_DIR`
- * for read-only/ephemeral sandbox HOMEs or to point at a pre-baked image path.
+ * Root of the managed server cache. Defaults to `<octocode-home>/lsp` via
+ * @octocodeai/config, overridable via `OCTOCODE_LSP_CACHE_DIR` for
+ * read-only/ephemeral sandbox HOMEs or to point at a pre-baked image path.
  */
 export declare function managedCacheRoot(env?: NodeJS.ProcessEnv): string;
 /** Where a provisioned binary lives once installed/extracted. */

package/dist/lsp/serverManifest.js

@@ -1,7 +1,7 @@
 import { createHash } from 'node:crypto';
 import { existsSync, readFileSync, statSync } from 'node:fs';
-import { homedir } from 'node:os';
 import path from 'node:path';
+import { getOctocodeHome } from '@octocodeai/config';
 import { detectPlatformId } from './platform.js';
 import { MANIFEST } from './serverManifestData.js';
 function loadManifest() {
@@ -55,15 +55,15 @@ export function isAutoDownloadable(serverName) {
     return manifestServer(serverName) != null;
 }
 /**
- * Root of the managed server cache. Defaults to `~/.octocode/lsp` (consistent
- * with the rest of octocode's home), overridable via `OCTOCODE_LSP_CACHE_DIR`
- * for read-only/ephemeral sandbox HOMEs or to point at a pre-baked image path.
+ * Root of the managed server cache. Defaults to `<octocode-home>/lsp` via
+ * @octocodeai/config, overridable via `OCTOCODE_LSP_CACHE_DIR` for
+ * read-only/ephemeral sandbox HOMEs or to point at a pre-baked image path.
  */
 export function managedCacheRoot(env = process.env) {
     const override = env.OCTOCODE_LSP_CACHE_DIR?.trim();
     if (override)
         return path.resolve(override);
-    return path.join(homedir(), '.octocode', 'lsp');
+    return path.join(getOctocodeHome(env), 'lsp');
 }
 /** Where a provisioned binary lives once installed/extracted. */
 export function cachedServerBinPath(serverName, platformId = detectPlatformId()) {

package/dist/security/commandValidator.js

@@ -201,15 +201,9 @@ function validateCommandArgs(command, args) {
             };
         }
     }
-    else {
-        const backendError = validateArchiveBackendArgs(command, args);
-        if (backendError) {
-            return { isValid: false, error: backendError };
-        }
-    }
-    // grep: no per-flag allowlist — only the shared dangerous-pattern scan below
-    // applies. grep flags are wide (e.g. -r, -Z, --include) and intentionally
-    // left to the pattern scan rather than a strict allowlist.
+    // grep / ls: no per-flag allowlist — only the shared dangerous-pattern scan
+    // below applies. grep flags are wide (e.g. -r, -Z, --include) and
+    // intentionally left to the pattern scan rather than a strict allowlist.
     const patternPositions = getPatternArgPositions(command, args);
     for (let i = 0; i < args.length; i++) {
         const arg = args[i];
@@ -283,64 +277,6 @@ function getGrepPatternPositions(args) {
     }
     return positions;
 }
-function isPathLikeArg(value) {
-    return value.length > 0 && !value.startsWith('-');
-}
-function exactArgs(args, expected) {
-    return args.length === expected.length && args.every((arg, i) => arg === expected[i]);
-}
-function validateArchiveBackendArgs(command, args) {
-    switch (command) {
-        case 'file':
-            return args.length === 3 && exactArgs(args.slice(0, 2), ['--mime-type', '-b']) && isPathLikeArg(args[2])
-                ? null
-                : 'file arguments are restricted to --mime-type -b <path>';
-        case 'zcat':
-        case 'bzcat':
-        case 'zstdcat':
-        case 'lz4cat':
-            return args.length === 1 && isPathLikeArg(args[0])
-                ? null
-                : `${command} arguments are restricted to <path>`;
-        case 'gunzip':
-            return args.length === 2 && args[0] === '-c' && isPathLikeArg(args[1])
-                ? null
-                : 'gunzip arguments are restricted to -c <path>';
-        case 'xzcat':
-            return (args.length === 1 && isPathLikeArg(args[0])) ||
-                (args.length === 2 && args[0] === '--format=lzma' && isPathLikeArg(args[1]))
-                ? null
-                : 'xzcat arguments are restricted to <path> or --format=lzma <path>';
-        case 'zstd':
-            return args.length === 2 && args[0] === '-dcq' && isPathLikeArg(args[1])
-                ? null
-                : 'zstd arguments are restricted to -dcq <path>';
-        case 'brotli':
-            return args.length === 2 && args[0] === '-dc' && isPathLikeArg(args[1])
-                ? null
-                : 'brotli arguments are restricted to -dc <path>';
-        case 'lzfse':
-            return args.length === 5 && exactArgs(args.slice(0, 2), ['-decode', '-i']) && isPathLikeArg(args[2]) && args[3] === '-o' && args[4] === '/dev/stdout'
-                ? null
-                : 'lzfse arguments are restricted to -decode -i <path> -o /dev/stdout';
-        case 'tar':
-        case 'bsdtar':
-            return args.length === 4 && args[0] === '-xOf' && isPathLikeArg(args[1]) && args[2] === '--' && args[3].length > 0
-                ? null
-                : `${command} arguments are restricted to -xOf <archive> -- <entry>`;
-        case 'unzip':
-            return args.length === 3 && args[0] === '-p' && isPathLikeArg(args[1]) && args[2].length > 0
-                ? null
-                : 'unzip arguments are restricted to -p <archive> <entry>';
-        case '7z':
-        case '7zz':
-            return args.length === 6 && exactArgs(args.slice(0, 4), ['e', '-so', '-bd', '--']) && isPathLikeArg(args[4]) && args[5].length > 0
-                ? null
-                : `${command} arguments are restricted to e -so -bd -- <archive> <entry>`;
-        default:
-            return null;
-    }
-}
 const FIND_PATTERN_ARGS = new Set([
     '-name',
     '-iname',

package/dist/security/securityConstants.d.ts

@@ -1,3 +1,3 @@
-export declare const ALLOWED_COMMANDS: readonly ["rg", "ls", "find", "grep", "git", "file", "zcat", "gunzip", "bzcat", "xzcat", "zstdcat", "zstd", "lz4cat", "brotli", "lzfse", "tar", "unzip", "bsdtar", "7z", "7zz"];
+export declare const ALLOWED_COMMANDS: readonly ["rg", "ls", "find", "grep", "git"];
 export declare const DANGEROUS_PATTERNS: readonly [RegExp, RegExp, RegExp];
 export declare const PATTERN_DANGEROUS_PATTERNS: readonly [RegExp, RegExp, RegExp, RegExp];

package/dist/security/securityConstants.js

@@ -4,21 +4,6 @@ export const ALLOWED_COMMANDS = [
     'find',
     'grep',
     'git',
-    'file',
-    'zcat',
-    'gunzip',
-    'bzcat',
-    'xzcat',
-    'zstdcat',
-    'zstd',
-    'lz4cat',
-    'brotli',
-    'lzfse',
-    'tar',
-    'unzip',
-    'bsdtar',
-    '7z',
-    '7zz',
 ];
 export const DANGEROUS_PATTERNS = [
     /[;&|`$(){}[\]<>]/, // Shell metacharacters

package/dist/security/withSecurityValidation.d.ts

@@ -6,7 +6,7 @@ export interface SecurityDepsConfig {
 export declare function configureSecurity(deps: SecurityDepsConfig): void;
 export declare function withSecurityValidation<T extends Record<string, unknown>, TAuth = unknown>(toolName: string, toolHandler: (sanitizedArgs: T, authInfo?: TAuth, sessionId?: string) => Promise<ToolResult>, options?: {
     timeoutMs?: number;
-}): (args: unknown, extra: {
+}): (args: unknown, extra?: {
     authInfo?: TAuth;
     sessionId?: string;
     signal?: AbortSignal;

package/index.d.ts

@@ -45,94 +45,6 @@ export declare function applyContentViewMinification(content: string, filePath:
  */
 export declare function applyMinification(content: string, filePath: string): string
 
-/**
- * Structural inspection of a binary (executable / object / archive) file.
- *
- * `format`/`arch`/`bits`/`endianness`/`stripped` are always populated (the
- * fields the old `identify` mode produced). The list fields are populated only
- * when the file is a recognized executable format `goblin` could parse; for an
- * unrecognized file they stay empty and `notes` explains why (e.g. "use
- * mode=list/decompress for archives").
- *
- * Every list is capped (see `crate::binary::inspect::LIST_CAP`); the `*_count`
- * fields carry the true totals, and `truncated` is set when any list was cut.
- */
-export interface BinaryInspectInfo {
-  /** elf | macho | macho-fat | pe | coff | archive | wasm | unknown */
-  format: string
-  /** Human-readable one-line summary (drop-in for `file -b`). */
-  description: string
-  /** Space-separated hex of the leading bytes (drop-in for `xxd -p -l 32`). */
-  magicHex: string
-  arch?: string
-  bits?: number
-  /** "little" | "big" */
-  endianness?: string
-  stripped?: boolean
-  /** Hex entry-point address, when the format has one. */
-  entry?: string
-  symbols: Array<string>
-  imports: Array<string>
-  exports: Array<string>
-  sections: Array<string>
-  /** Dynamic dependencies / needed shared libraries. */
-  libraries: Array<string>
-  symbolCount: number
-  importCount: number
-  exportCount: number
-  /** True when any list was capped. */
-  truncated: boolean
-  /** Advisory notes (unrecognized format, parse degradation, size truncation). */
-  notes: Array<string>
-}
-
-/** Result of a strings extraction pass over a binary buffer. */
-export interface BinaryStrings {
-  /**
-   * Printable runs, longest-first. ASCII **and** UTF-16 (LE/BE) — the win
-   * over GNU `strings -a`, which misses wide strings. Each entry is prefixed
-   * with its hex byte offset when offsets were requested.
-   */
-  strings: Array<string>
-  /** Total runs found before any display capping. */
-  totalFound: number
-  /**
-   * True when more of the file remains to scan beyond this window — follow
-   * `next_scan_offset`. Lossless continuation cursor, **not** a data-loss
-   * flag (the old fixed-cap meaning): every byte is reachable by paging.
-   */
-  truncated: boolean
-  /**
-   * Absolute byte offset to start the next scan window, or `None` at EOF.
-   * Rewound to a safe break so no string is split across windows.
-   */
-  nextScanOffset?: number
-}
-
-/**
- * Native strings extraction. Recovers printable ASCII **and** UTF-16 (LE/BE)
- * runs of at least `min_length` from the scan window of `path` beginning at
- * `scan_offset`, longest-first, optionally hex offset-prefixed. Replaces the
- * `strings` shell-out and additionally surfaces the wide strings GNU
- * `strings -a` misses.
- *
- * Lossless pagination: the returned `nextScanOffset` (when set) is the absolute
- * byte offset of the next window, rewound to a safe break so no string is split
- * across windows. Pass `scanOffset = 0` for the first window.
- */
-export declare function extractBinaryStringsNative(path: string, minLength: number, includeOffsets: boolean, scanOffset: number): BinaryStrings
-
-/**
- * Native binary inspection (format lane). Parses `path` as an executable /
- * object / archive and returns its identity plus — for recognized executable
- * formats — symbols, imports, exports, sections and dynamic dependencies.
- *
- * Replaces the `file` + `xxd` shell-outs. Never throws on malformed input: a
- * parse failure degrades to magic-byte identity with an explanatory note. The
- * only `Err` cases are unreadable / oversized files.
- */
-export declare function inspectBinaryNative(path: string): BinaryInspectInfo
-
 /** Extract a byte-range substring from `content`. */
 export declare function byteSliceContent(content: string, byteStart: number, byteEnd: number): string
 
@@ -443,6 +355,19 @@ export interface FilterPatchOptions {
   contextLines?: number
 }
 
+/**
+ * Myers line diff (`oldText` → `newText`). Returns a full edit script of
+ * `{ opType, line }` ops (`same` | `add` | `remove`). Prefer this over an
+ * O(N·M) LCS for agent edit previews on mid/large files.
+ */
+export declare function computeLineDiff(oldText: string, newText: string): Array<LineDiffOp>
+
+export interface LineDiffOp {
+  /** `"same"` | `"add"` | `"remove"` */
+  opType: string
+  line: string
+}
+
 /** Convert a `file://` URI string back to an absolute filesystem path. */
 export declare function fromUri(uri: string): string
 
@@ -490,8 +415,10 @@ export declare const SUPPORTED_STRUCTURAL_EXTENSIONS: readonly string[]
  *
  * Char offsets match JavaScript `string.substring()` — pass them directly to
  * JavaScript string slicing without conversion.
+ *
+ * Runs on libuv's worker pool (tree-sitter parse) — returns a Promise.
  */
-export declare function getSemanticBoundaryOffsets(content: string, filePath: string): Array<number>
+export declare function getSemanticBoundaryOffsets(content: string, filePath: string): Promise<Array<number>>
 
 /**
  * Returns all extensions that have signature extraction support
@@ -979,8 +906,10 @@ export interface StructuralSearchDetailedResult {
  * (exactly one). Returns node ranges (1-based lines, ready as `lineHint`s)
  * plus captured metavariables. Throws on unsupported extension, invalid
  * pattern/rule, or both/neither query supplied.
+ *
+ * Runs on libuv's worker pool (tree-sitter parse) — returns a Promise.
  */
-export declare function structuralSearch(content: string, filePath: string, pattern?: string | undefined | null, rule?: string | undefined | null): Array<StructuralMatch>
+export declare function structuralSearch(content: string, filePath: string, pattern?: string | undefined | null, rule?: string | undefined | null): Promise<Array<StructuralMatch>>
 
 /**
  * Detailed structural search. Unsupported extensions and invalid queries return
@@ -993,7 +922,11 @@ export interface StructuralSearchFileResult {
   matches: Array<StructuralMatch>
 }
 
-export declare function structuralSearchFiles(options: StructuralSearchFilesOptions): StructuralSearchFilesResult
+/**
+ * Runs on libuv's worker pool — the directory walk + per-file parse is
+ * CPU/IO-bound and can span thousands of files. Returns a Promise.
+ */
+export declare function structuralSearchFiles(options: StructuralSearchFilesOptions): Promise<StructuralSearchFilesResult>
 
 export declare function structuralSearchFilesDetailed(options: StructuralSearchFilesOptions): StructuralSearchFilesDetailedResult
 
@@ -1002,7 +935,25 @@ export interface StructuralSearchFilesOptions {
   pattern?: string
   rule?: string
   include?: Array<string>
+  /**
+   * File-path globs to skip (gitignore-style, e.g. `"*.min.js"`, `"src/gen/**"`).
+   * Mirrors `localSearchCode.exclude` so OQL `scope.exclude` is honored on the
+   * structural lane — previously silently dropped (typed-contract violation).
+   */
+  exclude?: Array<string>
   excludeDir?: Array<string>
+  /**
+   * Include hidden (dot) files. `None` preserves the default walker behavior
+   * (hidden ignored); `Some(true)` forces them in.
+   */
+  hidden?: boolean
+  /**
+   * Bypass `.gitignore`/`.ignore` rules. `None` preserves defaults; `Some(true)`
+   * searches files normally hidden by ignore files (mirrors `localSearchCode.noIgnore`).
+   */
+  noIgnore?: boolean
+  /** Maximum directory descent depth (0 = just the root). `None` = unbounded. */
+  maxDepth?: number
   maxFiles?: number
   maxFileBytes?: number
 }
@@ -1012,6 +963,13 @@ export interface StructuralSearchFilesResult {
   totalMatches: number
   parsedFiles: number
   skippedByPreFilter: number
+  /**
+   * Candidate files whose extension has no grammar — not evaluated, hence
+   * not proof of absence. Mirrors the detailed result's counter so the two
+   * shapes agree and the warning text can't collapse unevaluated into
+   * anchor-absent.
+   */
+  skippedUnsupported: number
   skippedUnreadable: number
   skippedLarge: number
   warnings: Array<string>

package/index.js

@@ -42,6 +42,7 @@ export const structuralSearchFiles = nativeBinding.structuralSearchFiles
 export const structuralSearchFilesDetailed = nativeBinding.structuralSearchFilesDetailed
 export const getSupportedStructuralExtensions = nativeBinding.getSupportedStructuralExtensions
 export const getSemanticBoundaryOffsets = nativeBinding.getSemanticBoundaryOffsets
+
 export const getSupportedSignatureExtensions = nativeBinding.getSupportedSignatureExtensions
 export const jsonToYamlString = nativeBinding.jsonToYamlString
 export const getMINIFY_CONFIG = nativeBinding.getMINIFY_CONFIG
@@ -59,9 +60,8 @@ export const byteSliceContent = nativeBinding.byteSliceContent
 export const sliceContent = nativeBinding.sliceContent
 export const extractMatchingLines = nativeBinding.extractMatchingLines
 export const filterPatch = nativeBinding.filterPatch
+export const computeLineDiff = nativeBinding.computeLineDiff
 export const PatchLineType = nativeBinding.PatchLineType
-export const inspectBinaryNative = nativeBinding.inspectBinaryNative
-export const extractBinaryStringsNative = nativeBinding.extractBinaryStringsNative
 export const NativeLspClient = nativeBinding.NativeLspClient
 export const resolvePosition = nativeBinding.resolvePosition
 export const resolvePositionFromContent = nativeBinding.resolvePositionFromContent

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@octocodeai/octocode-engine",
-  "version": "16.7.0",
+  "version": "17.0.1",
   "description": "Rust native Octocode engine for context compression, structural search, and LSP semantic navigation",
   "type": "module",
   "main": "index.cjs",
@@ -12,7 +12,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/bgauryy/octocode-mcp.git",
+    "url": "https://github.com/bgauryy/octocode.git",
     "directory": "packages/octocode-engine"
   },
   "exports": {
@@ -263,12 +263,12 @@
     "README.md"
   ],
   "optionalDependencies": {
-    "@octocodeai/octocode-engine-darwin-arm64": "16.7.0",
-    "@octocodeai/octocode-engine-darwin-x64": "16.7.0",
-    "@octocodeai/octocode-engine-linux-arm64-gnu": "16.7.0",
-    "@octocodeai/octocode-engine-linux-x64-gnu": "16.7.0",
-    "@octocodeai/octocode-engine-linux-x64-musl": "16.7.0",
-    "@octocodeai/octocode-engine-win32-x64-msvc": "16.7.0"
+    "@octocodeai/octocode-engine-darwin-arm64": "17.0.1",
+    "@octocodeai/octocode-engine-darwin-x64": "17.0.1",
+    "@octocodeai/octocode-engine-linux-arm64-gnu": "17.0.1",
+    "@octocodeai/octocode-engine-linux-x64-gnu": "17.0.1",
+    "@octocodeai/octocode-engine-linux-x64-musl": "17.0.1",
+    "@octocodeai/octocode-engine-win32-x64-msvc": "17.0.1"
   },
   "engines": {
     "node": ">=20.0.0"
@@ -319,7 +319,7 @@
     "check:rust": "cargo check --all-targets --all-features",
     "fmt:rust": "cargo fmt --all",
     "fmt:rust:check": "cargo fmt --all -- --check",
-    "test:rust": "cargo test --all-targets --all-features",
+    "test:rust": "cargo test --lib --tests --all-features && cargo build --benches --all-features",
     "test:node": "vitest run",
     "test:node:coverage": "vitest run --coverage",
     "test:watch": "vitest watch",
@@ -341,6 +341,7 @@
     "prepublishOnly": "yarn version:sync"
   },
   "dependencies": {
+    "@octocodeai/config": "17.0.0",
     "bash-language-server": "^5.6.0",
     "intelephense": "^1.14.1",
     "pyright": "^1.1.411",