@oomkapwn/enquire-mcp 3.11.4-rc.3 → 3.11.4

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 All notable changes to this project will be documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.11.4] — 2026-07-01
+
+> **TL;DR:** **v3.11.4 STABLE — promoted `@rc` → `@latest`.** A fresh from-scratch **8-lens post-v3.11.3 audit** (code-core · code-recent · security/DoS/ReDoS · privacy/leak · concurrency · supply-chain · docs-currency · test-infra), each finding adversarially refuted-or-confirmed, returned **4 confirmed (1 MED + 3 LOW), 0 CRIT / 0 HIGH, 0 false positives** — an exceptionally clean bill of health. **MED (regression):** `replace_in_notes`/`rename_note` silently flattened CRLF/CR/U+2028/U+2029 line endings to LF across the whole file (the rc.23 `splitLines` migration made the split terminator-aware but left the rejoin a hard-coded `join("\n")`); fixed with a new `splitLinesWithEnds` (preserves each line's own terminator) + behavioral round-trip tests. **3 LOW:** a `get_note_neighbors` outbound-neighbor-past-cap misclassification, 9 translation test-count badges stale, and a parser-cap invariant's block-wide (rather than per-field) token search. Separately, the **4 open dependabot PRs** were evaluated and bundled (js-yaml 5.2.0, pdfjs-dist 6.1.200, `@napi-rs/canvas` 1.0.2, dev `@biomejs/biome` 2.5.1 + `@types/node` 26.0.1) — all in-range, behaviorally re-verified, no new advisories. **The MANDATORY pre-promotion re-sweep then caught the audit's OWN fix recursing its own class**: the parser-cap fix's field-boundary regex required `field: z.` (dot immediately after `z`), so it silently bled through the DOMINANT `field: z\n  .string()...` multi-line convention (58 of 160 fields in `tool-registry.ts`) — reproduced empirically by removing a real cap and watching the invariant still pass on a sibling's cap. Fixed (`z\b` word-boundary) and re-verified against the identical mutation. Test count 1441 → **1446**. **46 tools · 19 prompts · 1446 tests · 11 languages · 0 CodeQL · 0 open dependabot.** No API breaks (additive patch). CI publishes `@latest` + signed provenance (SLSA L2) + OIDC MCP-registry sync. **Per-RC detail: rc.1 → rc.3 below.** **Lesson: this release is the session's clearest proof of its own central discipline — a full audit found real findings, and the MANDATORY pre-promotion re-sweep then found that one of the audit's OWN fixes recursed the exact class it closed. Neither gate alone would have caught it; both together did.**
+
 ## [3.11.4-rc.3] — 2026-06-30
 
 > **TL;DR:** **the MANDATORY pre-promotion re-sweep caught rc.2's OWN fix recursing its own class.** Before flipping v3.11.4 → `@latest`, a 3-lens re-sweep of the rc.1+rc.2 diff verified everything — and lens 2 found rc.2's `fieldSlice` (the PARSERCAP-FIELD-1 fix) required `field: z.` (dot immediately after `z`), so it only recognized the single-line schema shape and silently bled through EVERY multi-line `field: z\n  .string()...` chain — **58 of 160 fields in `tool-registry.ts`, the codebase's DOMINANT convention** — into the next field's slice. Reproduced empirically: removing the real `.max(MAX_QUERY_LEN)` cap from `obsidian_hyde_search`'s `query` field still passed the invariant (it found the sibling `hypothetical_answer`'s cap instead). **Fixed** — `z\b` (word-boundary, not a literal dot) recognizes both shapes; the exact HyDE-shaped mutation now correctly fails; a matching multi-line NEGATIVE control added. Also closed the re-sweep's one minor: a dedicated behavioral regression test for `getNoteNeighbors`' NEIGHBORS-OUTBOUND-CAP-2 fix (an outbound neighbor past the display cap must never leak into `tag_siblings`) — previously verified only ad hoc. Test count 1445 → **1446**. No behavior change beyond the two test-infra fixes. Ships `@rc`. **Lesson (the session's signature pattern, once more): an audit-driven fix must be re-probed with the EXACT shape the codebase actually uses — the fix's own synthetic test corpus only covered the shape the auditor happened to write, not the dominant real-world shape; the pre-promotion re-sweep exists precisely to catch this before it reaches `@latest`.**

package/dist/index.d.ts

@@ -7,7 +7,7 @@
  * + `McpServer({version})`) and `src/tool-registry.ts` (used in the
  * `vault-info` resource payload).
  */
-export declare const VERSION = "3.11.4-rc.3";
+export declare const VERSION = "3.11.4";
 export { main } from "./cli.js";
 export { buildEmbedText, buildMcpServer, formatReadyBanner, prepareServerDeps, type ServeOptions, type ServerDeps, startServer } from "./server.js";
 export { parsePositiveInt, parseQuantizationMode } from "./tool-registry.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAoCA;;;;;;;GAOG;AACH,eAAO,MAAM,OAAO,gBAAgB,CAAC;AAUrC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EACL,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,WAAW,EACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAoCA;;;;;;;GAOG;AACH,eAAO,MAAM,OAAO,WAAW,CAAC;AAUhC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EACL,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,WAAW,EACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -40,7 +40,7 @@ import { main } from "./cli.js";
  * + `McpServer({version})`) and `src/tool-registry.ts` (used in the
  * `vault-info` resource payload).
  */
-export const VERSION = "3.11.4-rc.3";
+export const VERSION = "3.11.4";
 // Re-exports — preserve the v3.5.x public surface so http-transport.ts and
 // tests don't need to know about the new module layout. The set below
 // exactly matches the v3.5.x `export` declarations: `main`,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,yEAAyE;AACzE,8EAA8E;AAC9E,EAAE;AACF,sEAAsE;AACtE,uEAAuE;AACvE,qEAAqE;AACrE,kEAAkE;AAClE,kEAAkE;AAClE,EAAE;AACF,kBAAkB;AAClB,iFAAiF;AACjF,2FAA2F;AAC3F,wFAAwF;AACxF,sFAAsF;AACtF,sFAAsF;AACtF,yFAAyF;AACzF,gEAAgE;AAChE,2EAA2E;AAC3E,sEAAsE;AACtE,uFAAuF;AACvF,sFAAsF;AACtF,EAAE;AACF,yEAAyE;AACzE,wBAAwB;AACxB,2EAA2E;AAC3E,yEAAyE;AACzE,6EAA6E;AAC7E,+DAA+D;AAC/D,sFAAsF;AACtF,0EAA0E;AAE1E,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,aAAa,CAAC;AAErC,2EAA2E;AAC3E,sEAAsE;AACtE,4DAA4D;AAC5D,6EAA6E;AAC7E,sEAAsE;AACtE,sEAAsE;AACtE,2EAA2E;AAC3E,4EAA4E;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EACL,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EAGjB,WAAW,EACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE7E,4DAA4D;AAC5D,yEAAyE;AACzE,wEAAwE;AACxE,6EAA6E;AAC7E,sDAAsD;AACtD,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE;IACvB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,CAAC;QACH,oEAAoE;QACpE,mEAAmE;QACnE,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO,IAAI,KAAK,IAAI,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL,IAAI,UAAU,EAAE,CAAC;IACf,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,yEAAyE;AACzE,8EAA8E;AAC9E,EAAE;AACF,sEAAsE;AACtE,uEAAuE;AACvE,qEAAqE;AACrE,kEAAkE;AAClE,kEAAkE;AAClE,EAAE;AACF,kBAAkB;AAClB,iFAAiF;AACjF,2FAA2F;AAC3F,wFAAwF;AACxF,sFAAsF;AACtF,sFAAsF;AACtF,yFAAyF;AACzF,gEAAgE;AAChE,2EAA2E;AAC3E,sEAAsE;AACtE,uFAAuF;AACvF,sFAAsF;AACtF,EAAE;AACF,yEAAyE;AACzE,wBAAwB;AACxB,2EAA2E;AAC3E,yEAAyE;AACzE,6EAA6E;AAC7E,+DAA+D;AAC/D,sFAAsF;AACtF,0EAA0E;AAE1E,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAC;AAEhC,2EAA2E;AAC3E,sEAAsE;AACtE,4DAA4D;AAC5D,6EAA6E;AAC7E,sEAAsE;AACtE,sEAAsE;AACtE,2EAA2E;AAC3E,4EAA4E;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EACL,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EAGjB,WAAW,EACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE7E,4DAA4D;AAC5D,yEAAyE;AACzE,wEAAwE;AACxE,6EAA6E;AAC7E,sDAAsD;AACtD,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE;IACvB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,CAAC;QACH,oEAAoE;QACpE,mEAAmE;QACnE,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO,IAAI,KAAK,IAAI,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL,IAAI,UAAU,EAAE,CAAC;IACf,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "@oomkapwn/enquire-mcp",
-  "version": "3.11.4-rc.3",
+  "version": "3.11.4",
   "mcpName": "io.github.oomkapwn/enquire-mcp",
   "description": "MCP server giving AI agents (Claude Code, Claude Desktop, Cursor, ChatGPT, Codex, OpenClaw) persistent long-term memory backed by your local Obsidian markdown vault. Hybrid retrieval (BM25 + ML embeddings + BGE reranker, RRF-fused), HNSW + int8 quantization, agentic RAG (HyDE + sub-question decomposition), GraphRAG-light (Louvain), standalone Obsidian Bases, PDFs + Tesseract OCR. Vendor-neutral memory layer for any MCP-compatible agent. 46 tools, 19 MCP prompts, 1446 tests, signed npm build provenance (SLSA L2), semver-bound, MIT, zero cloud calls during serve.",
   "type": "module",