@programinglive/dev-workflow-mcp-server 1.12.0 → 1.13.0

package/scripts/create-admin.js

@@ -1,15 +1,17 @@
 #!/usr/bin/env node
+import { safeLog } from '../security/sanitizer.js';
 import 'dotenv/config';
 import pg from 'pg';
 import { createUser } from '../web/lib/auth.js';
+import { databaseConnectionUrl } from '../security/config.js';
 
 const { Pool } = pg;
 
 // Get database configuration from environment
-const dbUrl = process.env.DEV_WORKFLOW_DB_URL;
+const dbUrl = databaseConnectionUrl();
 
 if (!dbUrl) {
-    console.error('Error: DEV_WORKFLOW_DB_URL environment variable is not set');
+    safeLog('error', 'Error: DEV_WORKFLOW_DB_URL environment variable is not set');
     process.exit(1);
 }
 
@@ -17,7 +19,8 @@ const pool = new Pool({ connectionString: dbUrl });
 
 async function createAdminUser() {
     const username = process.env.ADMIN_USERNAME || 'admin';
-    const password = process.env.ADMIN_PASSWORD || 'admin123';
+    const password = process.env.ADMIN_PASSWORD;
+    if(!password || password.length<16) throw new Error('Provision ADMIN_PASSWORD privately with at least 16 characters');
     const email = process.env.ADMIN_EMAIL || 'admin@example.com';
 
     try {
@@ -25,19 +28,18 @@ async function createAdminUser() {
         const existing = await pool.query('SELECT id FROM users WHERE username = $1', [username]);
 
         if (existing.rows.length > 0) {
-            console.log(`✓ Admin user '${username}' already exists`);
+            safeLog('info', `✓ Admin user '${username}' already exists`);
             process.exit(0);
         }
 
         // Create admin user
         const user = await createUser(pool, username, password, email);
-        console.log(`✓ Created admin user: ${user.username}`);
-        console.log(`  Email: ${user.email}`);
-        console.log(`  Password: ${password}`);
-        console.log('\n⚠️  Please change the password after first login!');
+        safeLog('info', `✓ Created admin user: ${user.username}`);
+        safeLog('info', `  Email: ${user.email}`);
+        safeLog('info','Administrator created; credential value omitted');
 
     } catch (error) {
-        console.error('Error creating admin user:', error.message);
+        safeLog('error', 'Error creating admin user:', error.message);
         process.exit(1);
     } finally {
         await pool.end();

package/scripts/install-husky.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { safeLog } from '../security/sanitizer.js';
 
 /**
  * Installs husky git hooks when running inside a git checkout, and does
@@ -19,7 +20,7 @@ import { fileURLToPath } from 'node:url';
 const projectRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
 if (!existsSync(path.join(projectRoot, '.git'))) {
-  console.log('Not a git checkout - skipping husky install.');
+  safeLog('info', 'Not a git checkout - skipping husky install.');
   process.exit(0);
 }
 
@@ -37,7 +38,7 @@ try {
   execSync(command, { cwd: projectRoot, stdio: 'inherit', shell: true });
 } catch (error) {
   // Never fail an install because git hooks could not be set up.
-  console.warn(`Could not install husky hooks: ${error.message}`);
+  safeLog('warn', `Could not install husky hooks: ${error.message}`);
 }
 
 process.exit(0);

package/scripts/lint.mjs

@@ -0,0 +1,20 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { safeLog } from '../security/sanitizer.js';
+
+const skip=new Set(['node_modules','.git','.state','dist','out','.next','.superpowers']);
+let checked=0;
+async function walk(dir) {
+  for(const item of await fs.readdir(dir,{withFileTypes:true})) {
+    if(skip.has(item.name)||item.isSymbolicLink())continue;
+    const file=path.join(dir,item.name);
+    if(item.isDirectory()){await walk(file);continue;}
+    if(!/\.(?:js|mjs|cjs)$/.test(file))continue;
+    const result=spawnSync(process.execPath,['--check',file],{encoding:'utf8'});
+    if(result.status!==0){safeLog('error','JavaScript syntax check failed',file,result.stderr);process.exitCode=1;}
+    checked++;
+  }
+}
+await walk(process.cwd());
+safeLog('info',`Checked ${checked} JavaScript source files. Dashboard semantic lint runs separately with npm run lint --prefix web.`);

package/scripts/release.cjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
+const { ready, safeLog, flushLogs, assertSafeKnowledge, spawnLogged } = require('../security/log-bridge.cjs');
 
-const { spawnSync } = require('child_process');
+const spawnSync = spawnLogged;
 const fs = require('fs');
 const path = require('path');
 
@@ -130,17 +131,22 @@ function runProjectTests({ spawn = spawnSync, env = process.env, cwd = process.c
   const scripts = packageJson && packageJson.scripts ? packageJson.scripts : {};
 
   if (!scripts.test) {
-    console.log('ℹ️  Skipping tests: no "test" script detected in package.json');
+    safeLog('info', 'ℹ️  Skipping tests: no "test" script detected in package.json');
     return { status: 0 };
   }
 
   const packageManager = detectPackageManager({ env, cwd });
   const { command, args } = buildTestCommand(packageManager);
 
-  console.log(`🧪 Running tests with ${packageManager} ${args.join(' ')}`.trim());
-  return spawn(command, args, {
+  safeLog('info', `🧪 Running tests with ${packageManager} ${args.join(' ')}`.trim());
+  // Windows package-manager launchers are .cmd files, not native executables.
+  // Only the fixed, allowlisted manager and literal test subcommand enter cmd.
+  const executable = process.platform === 'win32' ? (env.ComSpec || 'cmd.exe') : command;
+  const testArgs = process.platform === 'win32' ? ['/d', '/s', '/c', `${command} test`] : args;
+  return spawn(executable, testArgs, {
     stdio: 'inherit',
-    env
+    env,
+    cwd
   });
 }
 
@@ -166,9 +172,9 @@ function runRelease({
 
   ensurePrdPresence({ cwd, dependencies });
 
-  const testResult = runProjectTests({ spawn, env });
-  if (testResult && typeof testResult.status === 'number' && testResult.status !== 0) {
-    return testResult;
+  const testResult = runProjectTests({ spawn, env, cwd });
+  if (!testResult || testResult.error || testResult.status !== 0) {
+    return { ...testResult, status: testResult?.status || 1 };
   }
 
   const standardVersionBin = require.resolve('standard-version/bin/cli.js');
@@ -179,8 +185,8 @@ function runRelease({
     cwd
   });
 
-  if (releaseResult && typeof releaseResult.status === 'number' && releaseResult.status !== 0) {
-    return releaseResult;
+  if (!releaseResult || releaseResult.error || releaseResult.status !== 0) {
+    return { ...releaseResult, status: releaseResult?.status || 1 };
   }
 
   const releaseNotesPath = dependencies.releaseNotesPath || path.join('docs', 'release-notes', 'RELEASE_NOTES.md');
@@ -190,28 +196,25 @@ function runRelease({
   try {
     notesUpdated = updateNotes();
   } catch (error) {
-    console.warn(`⚠️  Skipping release notes update: ${error.message}`);
+    safeLog('warn', `⚠️  Skipping release notes update: ${error.message}`);
   }
 
   if (notesUpdated) {
     const gitAddResult = spawnSync('git', ['add', releaseNotesPath], { stdio: 'inherit', cwd });
     if (!gitAddResult || typeof gitAddResult.status !== 'number' || gitAddResult.status !== 0) {
-      console.warn('⚠️  Release notes updated but failed to stage. Please add manually: git add ' + releaseNotesPath);
+      safeLog('warn', '⚠️  Release notes updated but failed to stage. Please add manually: git add ' + releaseNotesPath);
     }
   }
 
   return releaseResult;
 }
 if (require.main === module) {
-  try {
-    const result = runRelease();
-    if (result.status !== 0) {
-      process.exit(result.status ?? 1);
-    }
-  } catch (error) {
-    console.error(`❌ ${error.message}`);
-    process.exit(1);
-  }
+  (async()=>{
+    let exitCode=0;
+    try {await ready;const result=runRelease();exitCode=result.status ?? 1;}
+    catch(error){safeLog('error',error);exitCode=1;}
+    await flushLogs();process.exitCode=exitCode;
+  })();
 }
 
 module.exports = {
@@ -244,7 +247,7 @@ function ensurePrdPresence({ cwd = process.cwd(), dependencies = {} } = {}) {
     return true;
   }
 
-  const warn = typeof logger?.warn === 'function' ? logger.warn.bind(logger) : console.warn.bind(console);
+  const warn = typeof logger?.warn === 'function' ? logger.warn.bind(logger) : ((message)=>safeLog('warn',message));
   warn(`⚠️  Product Requirements Document missing (${prdDisplayPath}). Add ${DEFAULT_PRD_DISPLAY_PATH} so teams understand release expectations.`);
   return false;
 }

package/scripts/release.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { safeLog } from '../security/sanitizer.js';
 
 const { spawnSync } = require('child_process');
 const fs = require('fs');
@@ -120,14 +121,14 @@ function runProjectTests({ spawn = spawnSync, env = process.env, cwd = process.c
   const scripts = packageJson && packageJson.scripts ? packageJson.scripts : {};
 
   if (!scripts.test) {
-    console.log('ℹ️  Skipping tests: no "test" script detected in package.json');
+    safeLog('info', 'ℹ️  Skipping tests: no "test" script detected in package.json');
     return { status: 0 };
   }
 
   const packageManager = detectPackageManager({ env, cwd });
   const { command, args } = buildTestCommand(packageManager);
 
-  console.log(`🧪 Running tests with ${packageManager} ${args.join(' ')}`.trim());
+  safeLog('info', `🧪 Running tests with ${packageManager} ${args.join(' ')}`.trim());
   return spawn(command, args, {
     stdio: 'inherit',
     env
@@ -178,13 +179,13 @@ function runRelease({
   try {
     notesUpdated = updateNotes();
   } catch (error) {
-    console.warn(`⚠️  Skipping release notes update: ${error.message}`);
+    safeLog('warn', `⚠️  Skipping release notes update: ${error.message}`);
   }
 
   if (notesUpdated) {
     const gitAddResult = spawnSync('git', ['add', releaseNotesPath], { stdio: 'inherit', cwd });
     if (!gitAddResult || typeof gitAddResult.status !== 'number' || gitAddResult.status !== 0) {
-      console.warn('⚠️  Release notes updated but failed to stage. Please add manually: git add ' + releaseNotesPath);
+      safeLog('warn', '⚠️  Release notes updated but failed to stage. Please add manually: git add ' + releaseNotesPath);
     }
   }
 
@@ -198,7 +199,7 @@ if (require.main === module) {
       process.exit(result.status ?? 1);
     }
   } catch (error) {
-    console.error(`❌ ${error.message}`);
+    safeLog('error', `❌ ${error.message}`);
     process.exit(1);
   }
 }

package/scripts/setup-stack.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { safeLog } from '../security/sanitizer.js';
 
 /**
  * Unified Setup Script for AI Agent Development Stack:
@@ -154,17 +155,17 @@ function backupConfig(configPath, configDir) {
 function ensureDependencies() {
   const nodeModules = path.join(projectRoot, 'node_modules');
   if (existsSync(nodeModules)) {
-    console.log('✓ Dependencies already installed.');
+    safeLog('info', '✓ Dependencies already installed.');
     return true;
   }
 
-  console.log('📥 Installing dependencies (required: the MCP server imports dotenv and others)...');
+  safeLog('info', '📥 Installing dependencies (required: the MCP server imports dotenv and others)...');
   try {
     execSync('npm install --no-audit --no-fund', { cwd: projectRoot, stdio: 'inherit' });
-    console.log('✓ Dependencies installed.');
+    safeLog('info', '✓ Dependencies installed.');
     return true;
   } catch {
-    console.error('✗ npm install failed. The MCP server cannot start without dependencies.');
+    safeLog('error', '✗ npm install failed. The MCP server cannot start without dependencies.');
     return false;
   }
 }
@@ -279,7 +280,7 @@ function verifyInstall(configPath) {
 function ensureAgentsMd(targetProjectRoot) {
   const agentsMdPath = path.join(targetProjectRoot, 'AGENTS.md');
   if (existsSync(agentsMdPath)) {
-    console.log('✓ AGENTS.md already exists in project root.');
+    safeLog('info', '✓ AGENTS.md already exists in project root.');
     return;
   }
 
@@ -308,25 +309,25 @@ Before taking any action or answering user requests regarding code changes, chec
 
   try {
     writeFileSync(agentsMdPath, defaultAgentsMd, 'utf8');
-    console.log(`✓ Created AGENTS.md rule enforcement at ${agentsMdPath}`);
+    safeLog('info', `✓ Created AGENTS.md rule enforcement at ${agentsMdPath}`);
   } catch (error) {
-    console.warn('⚠️ Could not create AGENTS.md:', error.message);
+    safeLog('warn', '⚠️ Could not create AGENTS.md:', error.message);
   }
 }
 
 export async function setupStack() {
-  console.log('🚀 Setting up Unified AI Agent Development Stack...\n');
+  safeLog('info', '🚀 Setting up Unified AI Agent Development Stack...\n');
 
   const configDir = resolveConfigDir({ probe: probeConfigDir });
   const opencodeJsonPath = path.join(configDir, 'opencode.json');
   const serverIndexPath = path.join(projectRoot, 'index.js');
 
-  console.log(`✓ OpenCode config directory: ${configDir}`);
+  safeLog('info', `✓ OpenCode config directory: ${configDir}`);
 
   mkdirSync(path.join(configDir, 'plugins'), { recursive: true });
 
   const backup = backupConfig(opencodeJsonPath, configDir);
-  if (backup) console.log(`✓ Backed up opencode.json → ${backup}`);
+  if (backup) safeLog('info', `✓ Backed up opencode.json → ${backup}`);
 
   const hasOpencodeCli = hasCommand('opencode');
   const command = ['node', serverIndexPath];
@@ -334,21 +335,21 @@ export async function setupStack() {
 
   if (hasOpencodeCli) {
     try {
-      console.log('\n🔌 Registering Superpowers via OpenCode CLI...');
+      safeLog('info', '\n🔌 Registering Superpowers via OpenCode CLI...');
       execSync(`opencode plugin add "${SUPERPOWERS_SPEC}"`, { stdio: 'inherit' });
-      console.log('✓ Superpowers plugin registered.');
+      safeLog('info', '✓ Superpowers plugin registered.');
 
-      console.log('\n🔌 Registering dev-workflow MCP server via OpenCode CLI...');
+      safeLog('info', '\n🔌 Registering dev-workflow MCP server via OpenCode CLI...');
       execSync(`opencode mcp add ${MCP_SERVER_NAME} --global -- node "${serverIndexPath}"`, {
         stdio: 'inherit',
       });
-      console.log('✓ dev-workflow MCP server registered.');
+      safeLog('info', '✓ dev-workflow MCP server registered.');
       usedCli = true;
     } catch (error) {
-      console.warn(`⚠️ OpenCode CLI registration failed (${error.message}). Falling back to direct config edit.`);
+      safeLog('warn', `⚠️ OpenCode CLI registration failed (${error.message}). Falling back to direct config edit.`);
     }
   } else {
-    console.warn('⚠️ `opencode` CLI not found on PATH. Falling back to direct config edit.');
+    safeLog('warn', '⚠️ `opencode` CLI not found on PATH. Falling back to direct config edit.');
   }
 
   if (!usedCli) {
@@ -356,7 +357,7 @@ export async function setupStack() {
     mergePluginEntry(config);
     mergeMcpServer(config, { name: MCP_SERVER_NAME, command });
     writeConfig(opencodeJsonPath, config);
-    console.log(`✓ opencode.json updated directly at ${opencodeJsonPath}`);
+    safeLog('info', `✓ opencode.json updated directly at ${opencodeJsonPath}`);
   }
 
   // Whatever path we took, confirm the on-disk config is V2-shaped.
@@ -364,61 +365,61 @@ export async function setupStack() {
   mergePluginEntry(finalConfig);
   mergeMcpServer(finalConfig, { name: MCP_SERVER_NAME, command });
   writeConfig(opencodeJsonPath, finalConfig);
-  console.log('✓ opencode.json verified (V2 `plugins` + `mcp.servers`).');
+  safeLog('info', '✓ opencode.json verified (V2 `plugins` + `mcp.servers`).');
 
-  console.log('\n⚡ Checking RTK (Rust Token Killer)...');
+  safeLog('info', '\n⚡ Checking RTK (Rust Token Killer)...');
   if (hasCommand('rtk')) {
     try {
       const version = run('rtk --version').trim();
-      console.log(`✓ Found ${version}`);
+      safeLog('info', `✓ Found ${version}`);
       execSync('rtk init -g --opencode --auto-patch --no-trust-filters', { stdio: 'inherit' });
-      console.log('✓ RTK OpenCode plugin registered.');
+      safeLog('info', '✓ RTK OpenCode plugin registered.');
     } catch {
-      console.warn('⚠️ Could not run `rtk init -g --opencode`. Run it manually.');
+      safeLog('warn', '⚠️ Could not run `rtk init -g --opencode`. Run it manually.');
     }
   } else {
-    console.warn('⚠️ `rtk` not found on PATH. Install it, then re-run this script:');
-    console.log(process.platform === 'win32' ? '  winget install rtk-ai.rtk' : '  brew install rtk');
+    safeLog('warn', '⚠️ `rtk` not found on PATH. Install it, then re-run this script:');
+    safeLog('info', process.platform === 'win32' ? '  winget install rtk-ai.rtk' : '  brew install rtk');
   }
 
   const depsOk = ensureDependencies();
 
-  console.log('\n🔎 Smoke testing the MCP server...');
+  safeLog('info', '\n🔎 Smoke testing the MCP server...');
   const smoke = depsOk
     ? await smokeTestServer()
     : { ok: false, reason: 'skipped: dependencies missing', stderr: '' };
   if (smoke.ok) {
-    console.log(`✓ MCP server healthy (${smoke.reason}).`);
+    safeLog('info', `✓ MCP server healthy (${smoke.reason}).`);
   } else {
-    console.error(`✗ MCP server failed to start (${smoke.reason}).`);
-    if (smoke.stderr) console.error(smoke.stderr.trim());
+    safeLog('error', `✗ MCP server failed to start (${smoke.reason}).`);
+    if (smoke.stderr) safeLog('error', smoke.stderr.trim());
   }
 
   ensureAgentsMd(process.env.INIT_CWD || process.cwd());
 
-  console.log('\n🧪 Verifying installation...');
+  safeLog('info', '\n🧪 Verifying installation...');
   const checks = verifyInstall(opencodeJsonPath);
   let allOk = smoke.ok;
 
   for (const check of checks) {
-    console.log(`  ${check.ok ? '✓' : '✗'} ${check.check}`);
+    safeLog('info', `  ${check.ok ? '✓' : '✗'} ${check.check}`);
     if (!check.ok) {
       allOk = false;
-      if (check.detail) console.log(`      ${check.detail.split('\n')[0]}`);
+      if (check.detail) safeLog('info', `      ${check.detail.split('\n')[0]}`);
     }
   }
 
-  console.log('\n============================================================');
+  safeLog('info', '\n============================================================');
   if (allOk) {
-    console.log('🎉 UNIFIED AI AGENT DEVELOPMENT STACK INSTALLED SUCCESSFULLY!');
-    console.log('============================================================');
-    console.log('• Workflow Discipline (dev-workflow MCP): Active');
-    console.log('• Agentic Skills (Superpowers): Registered');
-    console.log('• Token Compression (RTK): Configured');
-    console.log('\nRestart OpenCode to start developing with superpowers! 🚀');
+    safeLog('info', '🎉 UNIFIED AI AGENT DEVELOPMENT STACK INSTALLED SUCCESSFULLY!');
+    safeLog('info', '============================================================');
+    safeLog('info', '• Workflow Discipline (dev-workflow MCP): Active');
+    safeLog('info', '• Agentic Skills (Superpowers): Registered');
+    safeLog('info', '• Token Compression (RTK): Configured');
+    safeLog('info', '\nRestart OpenCode to start developing with superpowers! 🚀');
   } else {
-    console.log('⚠️ SETUP INCOMPLETE - see the failed checks above.');
-    console.log('============================================================');
+    safeLog('info', '⚠️ SETUP INCOMPLETE - see the failed checks above.');
+    safeLog('info', '============================================================');
   }
 
   return allOk;
@@ -430,7 +431,7 @@ if (isDirectRun) {
   setupStack()
     .then((ok) => process.exit(ok ? 0 : 1))
     .catch((error) => {
-      console.error('Setup encountered an error:', error);
+      safeLog('error', 'Setup encountered an error:', error);
       process.exit(1);
     });
 }

package/scripts/update-release-notes.cjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+const { ready, safeLog, flushLogs, assertSafeKnowledge, spawnLogged } = require('../security/log-bridge.cjs');
 
 const fs = require('fs');
 const path = require('path');
@@ -12,32 +13,32 @@ function updateReleaseNotes({
 } = {}) {
   const releaseNotesPath = path.join(rootDir, releaseNotesRelativePath);
   if (!fs.existsSync(releaseNotesPath)) {
-    console.log(`ℹ️  Release notes file not found at ${releaseNotesPath}; skipping update.`);
+    safeLog('info', `ℹ️  Release notes file not found at ${releaseNotesPath}; skipping update.`);
     return false;
   }
 
   const packageJsonPath = path.join(rootDir, packageJsonRelativePath);
   if (!fs.existsSync(packageJsonPath)) {
-    console.log(`ℹ️  package.json not found at ${packageJsonPath}; skipping release notes update.`);
+    safeLog('info', `ℹ️  package.json not found at ${packageJsonPath}; skipping release notes update.`);
     return false;
   }
 
   const changelogPath = path.join(rootDir, changelogRelativePath);
   if (!fs.existsSync(changelogPath)) {
-    console.log(`ℹ️  CHANGELOG not found at ${changelogPath}; skipping release notes update.`);
+    safeLog('info', `ℹ️  CHANGELOG not found at ${changelogPath}; skipping release notes update.`);
     return false;
   }
 
   const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
   const version = packageJson.version;
   if (!version) {
-    console.log('ℹ️  package.json version is missing; skipping release notes update.');
+    safeLog('info', 'ℹ️  package.json version is missing; skipping release notes update.');
     return false;
   }
 
   const releaseNotesContent = fs.readFileSync(releaseNotesPath, 'utf8');
   if (releaseNotesContent.includes(`| ${version} `) || releaseNotesContent.includes(`## ${version}`)) {
-    console.log(`ℹ️  Release notes already contain version ${version}; skipping.`);
+    safeLog('info', `ℹ️  Release notes already contain version ${version}; skipping.`);
     return false;
   }
 
@@ -60,8 +61,9 @@ function updateReleaseNotes({
     detailBullets
   });
 
+  assertSafeKnowledge(updatedContent);
   fs.writeFileSync(releaseNotesPath, updatedContent);
-  console.log(`✅ Added release notes entry for version ${version}.`);
+  safeLog('info', `✅ Added release notes entry for version ${version}.`);
   return true;
 }
 
@@ -173,10 +175,9 @@ module.exports = {
 };
 
 if (require.main === module) {
-  try {
-    updateReleaseNotes();
-  } catch (error) {
-    console.error(`❌ Failed to update release notes: ${error.message}`);
-    process.exit(1);
-  }
+  (async()=>{
+    try {await ready;updateReleaseNotes();}
+    catch(error){safeLog('error',error);process.exitCode=1;}
+    await flushLogs();
+  })();
 }

package/scripts/update-release-notes.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { safeLog } from '../security/sanitizer.js';
 
 const fs = require('fs');
 const path = require('path');
@@ -12,32 +13,32 @@ function updateReleaseNotes({
 } = {}) {
   const releaseNotesPath = path.join(rootDir, releaseNotesRelativePath);
   if (!fs.existsSync(releaseNotesPath)) {
-    console.log(`ℹ️  Release notes file not found at ${releaseNotesPath}; skipping update.`);
+    safeLog('info', `ℹ️  Release notes file not found at ${releaseNotesPath}; skipping update.`);
     return false;
   }
 
   const packageJsonPath = path.join(rootDir, packageJsonRelativePath);
   if (!fs.existsSync(packageJsonPath)) {
-    console.log(`ℹ️  package.json not found at ${packageJsonPath}; skipping release notes update.`);
+    safeLog('info', `ℹ️  package.json not found at ${packageJsonPath}; skipping release notes update.`);
     return false;
   }
 
   const changelogPath = path.join(rootDir, changelogRelativePath);
   if (!fs.existsSync(changelogPath)) {
-    console.log(`ℹ️  CHANGELOG not found at ${changelogPath}; skipping release notes update.`);
+    safeLog('info', `ℹ️  CHANGELOG not found at ${changelogPath}; skipping release notes update.`);
     return false;
   }
 
   const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
   const version = packageJson.version;
   if (!version) {
-    console.log('ℹ️  package.json version is missing; skipping release notes update.');
+    safeLog('info', 'ℹ️  package.json version is missing; skipping release notes update.');
     return false;
   }
 
   const releaseNotesContent = fs.readFileSync(releaseNotesPath, 'utf8');
   if (releaseNotesContent.includes(`| ${version} `) || releaseNotesContent.includes(`## ${version}`)) {
-    console.log(`ℹ️  Release notes already contain version ${version}; skipping.`);
+    safeLog('info', `ℹ️  Release notes already contain version ${version}; skipping.`);
     return false;
   }
 
@@ -61,7 +62,7 @@ function updateReleaseNotes({
   });
 
   fs.writeFileSync(releaseNotesPath, updatedContent);
-  console.log(`✅ Added release notes entry for version ${version}.`);
+  safeLog('info', `✅ Added release notes entry for version ${version}.`);
   return true;
 }
 
@@ -176,7 +177,7 @@ if (require.main === module) {
   try {
     updateReleaseNotes();
   } catch (error) {
-    console.error(`❌ Failed to update release notes: ${error.message}`);
+    safeLog('error', `❌ Failed to update release notes: ${error.message}`);
     process.exit(1);
   }
 }

package/scripts/verify-bundle.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { safeLog } from '../security/sanitizer.js';
 
 /**
  * Verifies that the built bundle actually starts.
@@ -29,12 +30,12 @@ const STARTUP_PATTERN = /running on stdio|MCP Server starting/i;
 const TIMEOUT_MS = 15000;
 
 if (!existsSync(entry)) {
-  console.error(`✖ Bundle not found: ${entry}`);
-  console.error('  Run "npm run build:server" first.');
+  safeLog('error', `✖ Bundle not found: ${entry}`);
+  safeLog('error', '  Run "npm run build:server" first.');
   process.exit(1);
 }
 
-console.log(`Verifying ${path.relative(process.cwd(), entry)}`);
+safeLog('info', `Verifying ${path.relative(process.cwd(), entry)}`);
 
 const child = spawn(process.execPath, [entry], {
   stdio: ['pipe', 'pipe', 'pipe'],
@@ -63,13 +64,13 @@ function finish(ok, reason) {
 
   const output = `${stdout}${stderr}`;
   if (ok) {
-    console.log(`✓ ${reason}`);
+    safeLog('info', `✓ ${reason}`);
     process.exit(0);
   }
 
-  console.error(`✖ ${reason}`);
-  console.error('--- bundle output ---');
-  console.error(output.trim() || '(no output)');
+  safeLog('error', `✖ ${reason}`);
+  safeLog('error', '--- bundle output ---');
+  safeLog('error', output.trim() || '(no output)');
   process.exit(1);
 }