@oomkapwn/enquire-mcp 3.11.5-rc.6 → 3.11.5

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.11.5] — 2026-07-03
+
+> **TL;DR:** **promoted `@rc` → `@latest`** — v3.11.5 STABLE is a 6-RC internal-audit hardening cascade on top of stable 3.11.4 that closes the **fence/parser-desync class** at its root. The whole line was one class: a note-structure element (heading `#`, wikilink `[[…]]`, tag `#…`, question `Q:`) that appears ONLY inside a code fence must never be surfaced by an always-on tool — it must match the canonical parser (`stripCodeAndInline`/`parseNote`) + Obsidian. Roll-up of the RCs: **rc.1** a full from-scratch 12-lens project audit (1 MED write-path fence classifier that mis-read a line-leading inline `` ```span``` `` as a block-fence open and silently dropped `rename_note`/`replace_in_notes` edits, + 2 LOW + 1 INFO); **rc.2/rc.3/rc.4** three mandatory post-merge re-sweeps, each finding real siblings/residuals of the prior fix — rc.2 the two read-path fence-toggle siblings (`readNote(map)` heading drop + fts5 breadcrumb freeze) → extracted the shared `src/fence.ts` `opensBlockFence` leaf + an inventory invariant; rc.3 the PARSER-DESYNC class one layer deeper (4 always-on tools re-extracting wikilinks/tags/questions from the RAW body) → routed all through the exported `stripCodeAndInline` + `tests/parser-desync-invariant.test.ts`; rc.4 the 2 tail LOWs; **rc.5** a root-cause META-AUDIT that found a MED all 4 RCs + 30+ prior audits missed — a **char-BLIND fence toggle** (`inFence = !inFence` can't tell a ``` delimiter from a `~~~`) live in `write.ts` ×2 (data-affecting), `read.ts`, `meta.ts` → replaced by a canonical char-aware `advanceFence()` shared by all 5 walkers, with the fence-toggle invariant upgraded from presence to CORRECTNESS; **rc.6** the highest-leverage hardening — a GENERATIVE `tests/canonical-parser-agreement.test.ts` net (every fence shape the cascade fixed × every always-on extractor) that would have caught the entire class in one shot, mutation-verified. **13 confirmed findings, every one reproduced against `dist/` and closed with a behavioral test, most with an inventory invariant.** The mandatory pre-promotion re-sweep (regression · currency · invariant-soundness, 3-skeptic verify) recommended PROMOTE: all 5 fence walkers verified byte-identical rc.4↔rc.5 across 100k realistic notes; the only divergence is an adversarial unclosed-fence+mismatched-inner shape where rc.5 is the CommonMark-correct side (pre-existing, INFO). **46 tools · 19 prompts · 1479 tests · 11 languages.** CI publishes `@latest` + SLSA L2 provenance + OIDC MCP-registry sync.
+>
+> **Method note:** promoted on the maintainer "go" against the ≥2-external-auditor gate (v3.6.1), substantively met across the v3.9→v3.11 line. Folded into this promotion: `CITATION.cff` version/date bump (drift-guard pins it to the latest stable heading) and a version-agnostic rephrase of the `docs/QUICKSTART.md` `--version` example (was a stale `3.10.x` illustration). **Tracked for the next `@rc` line (genuine but non-blocking test-hardening, no shipped bug — all backstopped today):** extend the rc.6 generative net's generator to emit unclosed-fence / nested-fence / frontmatter-adjacent shapes (and reconcile `stripCodeAndInline`'s unclosed-fence leniency with the CommonMark-correct walkers); widen `parser-desync-invariant` to cover `bases.ts collectTags` (its own inline-tag regex escapes the current inventory); broaden the `fence-toggle-invariant` detector to non-`fence`-named state vars + the ternary toggle form.
+
 ## [3.11.5-rc.6] — 2026-07-03
 
 > **TL;DR:** **the meta-audit's highest-leverage hardening — a GENERATIVE canonical-parser-agreement net that would have caught the ENTIRE rc.1→rc.5 fence/parser class in one shot** (tests-only, no `src/` change). The whole cascade was one class: a note-structure element (heading `#`, wikilink `[[…]]`, tag `#…`, question `Q:`) that appears ONLY inside a code fence must never be surfaced by an always-on tool — matching the canonical parser (`stripCodeAndInline`/`parseNote`) + Obsidian. `tests/canonical-parser-agreement.test.ts` is a **matrix over every fence shape the cascade had to fix** (backtick, tilde, ≤3-space-indented, mismatched-inner-char `~~~`-in-```, line-start inline span) **× every always-on extractor** (`readNote` map, `buildWikilinkGraph`, `queryBase` `tag==`, `getOpenQuestions`, `validateNoteProposal`, fts5 `computeBreadcrumbsByLine`): each plants a unique decoy element inside a fence + a real control outside, and asserts the tool surfaces the real one and NOT the decoy. **Mutation-verified**: re-introducing the rc.5 char-blind toggle makes the net fail precisely on the `mismatchedInner` shape across 3 tools. **+6 tests (30 runtime assertions; 1473 → 1479).** This is the "one net catches the whole class" defense per the meta-audit — a future extractor that hand-rolls fence handling and diverges from the parser now fails CI on whichever shape it mishandles.

package/dist/index.d.ts

@@ -7,7 +7,7 @@
  * + `McpServer({version})`) and `src/tool-registry.ts` (used in the
  * `vault-info` resource payload).
  */
-export declare const VERSION = "3.11.5-rc.6";
+export declare const VERSION = "3.11.5";
 export { main } from "./cli.js";
 export { buildEmbedText, buildMcpServer, formatReadyBanner, prepareServerDeps, type ServeOptions, type ServerDeps, startServer } from "./server.js";
 export { parsePositiveInt, parseQuantizationMode } from "./tool-registry.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAoCA;;;;;;;GAOG;AACH,eAAO,MAAM,OAAO,gBAAgB,CAAC;AAUrC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EACL,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,WAAW,EACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAoCA;;;;;;;GAOG;AACH,eAAO,MAAM,OAAO,WAAW,CAAC;AAUhC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EACL,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,WAAW,EACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -40,7 +40,7 @@ import { main } from "./cli.js";
  * + `McpServer({version})`) and `src/tool-registry.ts` (used in the
  * `vault-info` resource payload).
  */
-export const VERSION = "3.11.5-rc.6";
+export const VERSION = "3.11.5";
 // Re-exports — preserve the v3.5.x public surface so http-transport.ts and
 // tests don't need to know about the new module layout. The set below
 // exactly matches the v3.5.x `export` declarations: `main`,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,yEAAyE;AACzE,8EAA8E;AAC9E,EAAE;AACF,sEAAsE;AACtE,uEAAuE;AACvE,qEAAqE;AACrE,kEAAkE;AAClE,kEAAkE;AAClE,EAAE;AACF,kBAAkB;AAClB,iFAAiF;AACjF,2FAA2F;AAC3F,wFAAwF;AACxF,sFAAsF;AACtF,sFAAsF;AACtF,yFAAyF;AACzF,gEAAgE;AAChE,2EAA2E;AAC3E,sEAAsE;AACtE,uFAAuF;AACvF,sFAAsF;AACtF,EAAE;AACF,yEAAyE;AACzE,wBAAwB;AACxB,2EAA2E;AAC3E,yEAAyE;AACzE,6EAA6E;AAC7E,+DAA+D;AAC/D,sFAAsF;AACtF,0EAA0E;AAE1E,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,aAAa,CAAC;AAErC,2EAA2E;AAC3E,sEAAsE;AACtE,4DAA4D;AAC5D,6EAA6E;AAC7E,sEAAsE;AACtE,sEAAsE;AACtE,2EAA2E;AAC3E,4EAA4E;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EACL,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EAGjB,WAAW,EACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE7E,4DAA4D;AAC5D,yEAAyE;AACzE,wEAAwE;AACxE,6EAA6E;AAC7E,sDAAsD;AACtD,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE;IACvB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,CAAC;QACH,oEAAoE;QACpE,mEAAmE;QACnE,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO,IAAI,KAAK,IAAI,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL,IAAI,UAAU,EAAE,CAAC;IACf,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,yEAAyE;AACzE,8EAA8E;AAC9E,EAAE;AACF,sEAAsE;AACtE,uEAAuE;AACvE,qEAAqE;AACrE,kEAAkE;AAClE,kEAAkE;AAClE,EAAE;AACF,kBAAkB;AAClB,iFAAiF;AACjF,2FAA2F;AAC3F,wFAAwF;AACxF,sFAAsF;AACtF,sFAAsF;AACtF,yFAAyF;AACzF,gEAAgE;AAChE,2EAA2E;AAC3E,sEAAsE;AACtE,uFAAuF;AACvF,sFAAsF;AACtF,EAAE;AACF,yEAAyE;AACzE,wBAAwB;AACxB,2EAA2E;AAC3E,yEAAyE;AACzE,6EAA6E;AAC7E,+DAA+D;AAC/D,sFAAsF;AACtF,0EAA0E;AAE1E,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAC;AAEhC,2EAA2E;AAC3E,sEAAsE;AACtE,4DAA4D;AAC5D,6EAA6E;AAC7E,sEAAsE;AACtE,sEAAsE;AACtE,2EAA2E;AAC3E,4EAA4E;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EACL,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EAGjB,WAAW,EACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE7E,4DAA4D;AAC5D,yEAAyE;AACzE,wEAAwE;AACxE,6EAA6E;AAC7E,sDAAsD;AACtD,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE;IACvB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,CAAC;QACH,oEAAoE;QACpE,mEAAmE;QACnE,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO,IAAI,KAAK,IAAI,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL,IAAI,UAAU,EAAE,CAAC;IACf,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/docs/QUICKSTART.md

@@ -29,7 +29,7 @@ Verify the install:
 enquire-mcp --version
 ```
 
-Expected output: the current version string (e.g. `3.10.x` on `@latest`).
+Expected output: your installed version string (matching the newest `@latest` release in the [CHANGELOG](../CHANGELOG.md)).
 
 ## Step 2 — Smoke test (30 seconds)
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "@oomkapwn/enquire-mcp",
-  "version": "3.11.5-rc.6",
+  "version": "3.11.5",
   "mcpName": "io.github.oomkapwn/enquire-mcp",
   "description": "MCP server giving AI agents (Claude Code, Claude Desktop, Cursor, ChatGPT, Codex, OpenClaw) persistent long-term memory backed by your local Obsidian markdown vault. Hybrid retrieval (BM25 + ML embeddings + BGE reranker, RRF-fused), HNSW + int8 quantization, agentic RAG (HyDE + sub-question decomposition), GraphRAG-light (Louvain), standalone Obsidian Bases, PDFs + Tesseract OCR. Vendor-neutral memory layer for any MCP-compatible agent. 46 tools, 19 MCP prompts, 1479 tests, signed npm build provenance (SLSA L2), semver-bound, MIT, zero cloud calls during serve.",
   "type": "module",