@oomkapwn/enquire-mcp 3.11.1-rc.2 → 3.11.1

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 All notable changes to this project will be documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.11.1] — 2026-06-28
+
+> **TL;DR:** **v3.11.1 STABLE — promoted `@rc` → `@latest` (maintainer call). A patch line that closes the case-fold-asymmetry class across all three of its instances.** It began as the **v3.11.0-STABLE external-audit response** (2 independent auditors — Cursor 4.3/ship, Goose 4.4/ship — both **0 CRIT / 0 HIGH / 0 MED**, the cleanest external round of the line; both re-verified the rc.17→rc.25 hardening holds through `dist/`). Cursor's 2 LOWs (`SCHEMA-validate-then-write-gap`) were **reasoned-rejected** (a false equivalence — the write-content sink is linear and already double-bounded by the 7.5 MB HTTP cap + 5 MB `maxFileBytes`; a 1 MB cap would reject legitimate large notes), and Goose's NEL/VT/FF finding was a confirmed non-defect. The real value came from internal adversarial lenses: an **anti-anchoring** Workflow caught a Greek word-final-sigma silent under-replace in `replace_in_notes` that *neither* external auditor found (rc.1), and the **mandatory pre-promotion re-sweep** then caught a third, more-severe instance of the same class — `obsidian_search_text` silently dropping notes on a final-Σ query token (rc.2) — before `@latest` flipped. All three instances are now consistent (per-code-point `foldForMatch` for `replace_in_notes` + `search_text`; the `semanticSearch` snippet-centring residual stays documented-accept as it's cosmetic). **46 tools · 19 prompts · 1434 tests · 0 CodeQL · 0 open dependabot.** No API breaks (additive patch). CI publishes `@latest` + signed provenance (SLSA L2) + OIDC MCP-registry sync. **Per-RC detail: rc.1 + rc.2 below.** **Lesson of the line: two strong external auditors with a clean bill of health still left a real correctness bug — the internal anti-anchoring + pre-promotion re-sweep are what found the class; external state-driven re-verification and internal un-enumerated-class hunting are complementary, exactly as the ≥2-auditor gate intends.**
+
 ## [3.11.1-rc.2] — 2026-06-28
 
 > **TL;DR:** **Pre-promotion re-sweep of rc.1 caught a third instance of the case-fold-asymmetry class — `searchText` — and it's worse than the documented-accept sibling.** Before flipping `@latest` I ran the mandatory pre-promotion re-sweep (3-lens Workflow `wom27daqi`); the fold-fix was verified regression-free over a 10,368-case differential, but the sibling sweep found `obsidian_search_text` carries the same needle-vs-haystack fold mismatch — and there `indexOf` is the SOLE matcher, so a Greek word-final-sigma query token **silently dropped the whole note** (a recall miss, not the cosmetic snippet mis-centring of the `semanticSearch` sibling). Fixed before promotion.

package/dist/index.d.ts

@@ -7,7 +7,7 @@
  * + `McpServer({version})`) and `src/tool-registry.ts` (used in the
  * `vault-info` resource payload).
  */
-export declare const VERSION = "3.11.1-rc.2";
+export declare const VERSION = "3.11.1";
 export { main } from "./cli.js";
 export { buildEmbedText, buildMcpServer, formatReadyBanner, prepareServerDeps, type ServeOptions, type ServerDeps, startServer } from "./server.js";
 export { parsePositiveInt, parseQuantizationMode } from "./tool-registry.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAoCA;;;;;;;GAOG;AACH,eAAO,MAAM,OAAO,gBAAgB,CAAC;AAUrC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EACL,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,WAAW,EACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAoCA;;;;;;;GAOG;AACH,eAAO,MAAM,OAAO,WAAW,CAAC;AAUhC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EACL,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,WAAW,EACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -40,7 +40,7 @@ import { main } from "./cli.js";
  * + `McpServer({version})`) and `src/tool-registry.ts` (used in the
  * `vault-info` resource payload).
  */
-export const VERSION = "3.11.1-rc.2";
+export const VERSION = "3.11.1";
 // Re-exports — preserve the v3.5.x public surface so http-transport.ts and
 // tests don't need to know about the new module layout. The set below
 // exactly matches the v3.5.x `export` declarations: `main`,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,yEAAyE;AACzE,8EAA8E;AAC9E,EAAE;AACF,sEAAsE;AACtE,uEAAuE;AACvE,qEAAqE;AACrE,kEAAkE;AAClE,kEAAkE;AAClE,EAAE;AACF,kBAAkB;AAClB,iFAAiF;AACjF,2FAA2F;AAC3F,wFAAwF;AACxF,sFAAsF;AACtF,sFAAsF;AACtF,yFAAyF;AACzF,gEAAgE;AAChE,2EAA2E;AAC3E,sEAAsE;AACtE,uFAAuF;AACvF,sFAAsF;AACtF,EAAE;AACF,yEAAyE;AACzE,wBAAwB;AACxB,2EAA2E;AAC3E,yEAAyE;AACzE,6EAA6E;AAC7E,+DAA+D;AAC/D,sFAAsF;AACtF,0EAA0E;AAE1E,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,aAAa,CAAC;AAErC,2EAA2E;AAC3E,sEAAsE;AACtE,4DAA4D;AAC5D,6EAA6E;AAC7E,sEAAsE;AACtE,sEAAsE;AACtE,2EAA2E;AAC3E,4EAA4E;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EACL,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EAGjB,WAAW,EACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE7E,4DAA4D;AAC5D,yEAAyE;AACzE,wEAAwE;AACxE,6EAA6E;AAC7E,sDAAsD;AACtD,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE;IACvB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,CAAC;QACH,oEAAoE;QACpE,mEAAmE;QACnE,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO,IAAI,KAAK,IAAI,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL,IAAI,UAAU,EAAE,CAAC;IACf,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,yEAAyE;AACzE,8EAA8E;AAC9E,EAAE;AACF,sEAAsE;AACtE,uEAAuE;AACvE,qEAAqE;AACrE,kEAAkE;AAClE,kEAAkE;AAClE,EAAE;AACF,kBAAkB;AAClB,iFAAiF;AACjF,2FAA2F;AAC3F,wFAAwF;AACxF,sFAAsF;AACtF,sFAAsF;AACtF,yFAAyF;AACzF,gEAAgE;AAChE,2EAA2E;AAC3E,sEAAsE;AACtE,uFAAuF;AACvF,sFAAsF;AACtF,EAAE;AACF,yEAAyE;AACzE,wBAAwB;AACxB,2EAA2E;AAC3E,yEAAyE;AACzE,6EAA6E;AAC7E,+DAA+D;AAC/D,sFAAsF;AACtF,0EAA0E;AAE1E,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAC;AAEhC,2EAA2E;AAC3E,sEAAsE;AACtE,4DAA4D;AAC5D,6EAA6E;AAC7E,sEAAsE;AACtE,sEAAsE;AACtE,2EAA2E;AAC3E,4EAA4E;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EACL,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EAGjB,WAAW,EACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE7E,4DAA4D;AAC5D,yEAAyE;AACzE,wEAAwE;AACxE,6EAA6E;AAC7E,sDAAsD;AACtD,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE;IACvB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,CAAC;QACH,oEAAoE;QACpE,mEAAmE;QACnE,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO,IAAI,KAAK,IAAI,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL,IAAI,UAAU,EAAE,CAAC;IACf,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "@oomkapwn/enquire-mcp",
-  "version": "3.11.1-rc.2",
+  "version": "3.11.1",
   "mcpName": "io.github.oomkapwn/enquire-mcp",
   "description": "MCP server giving AI agents (Claude Code, Claude Desktop, Cursor, ChatGPT, Codex, OpenClaw) persistent long-term memory backed by your local Obsidian markdown vault. Hybrid retrieval (BM25 + ML embeddings + BGE reranker, RRF-fused), HNSW + int8 quantization, agentic RAG (HyDE + sub-question decomposition), GraphRAG-light (Louvain), standalone Obsidian Bases, PDFs + Tesseract OCR. Vendor-neutral memory layer for any MCP-compatible agent. 46 tools, 19 MCP prompts, 1434 tests, signed npm build provenance (SLSA L2), semver-bound, MIT, zero cloud calls during serve.",
   "type": "module",