ast-mcp-server 0.8.0 → 0.8.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -6,7 +6,17 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
|
|
|
6
6
|
|
|
7
7
|
## [Unreleased]
|
|
8
8
|
|
|
9
|
-
## [0.8.
|
|
9
|
+
## [0.8.1] — release candidate (unreleased, 2026-08-14)
|
|
10
|
+
|
|
11
|
+
### Fixed
|
|
12
|
+
|
|
13
|
+
- Public-registry verification now prepares the pinned GNU coreutils 9.7 `mv` primitive before running the managed-setup consumer smoke, and workflow policy rejects removal or reordering of that prerequisite.
|
|
14
|
+
|
|
15
|
+
### Release status
|
|
16
|
+
|
|
17
|
+
- This version is bound to exact-SHA CI and the repository's staged `next` publication, public-registry verification, `latest` promotion, annotated-tag, and hosted-release sequence. npm registry and GitHub readbacks remain authoritative for those external transitions.
|
|
18
|
+
|
|
19
|
+
## [0.8.0] — published to `next`, verification failed, not promoted (2026-08-14)
|
|
10
20
|
|
|
11
21
|
### Fixed
|
|
12
22
|
|
|
@@ -25,9 +35,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
|
|
|
25
35
|
|
|
26
36
|
### Release status
|
|
27
37
|
|
|
28
|
-
-
|
|
38
|
+
- npm published these immutable bytes under `next` with provenance and the expected Git commit. Public-consumer verification stopped during managed setup because the verification workflow had not prepared its required GNU coreutils 9.7 `mv`; the package was never promoted to `latest`, tagged, or released on GitHub. Version `0.8.1` is the patch candidate intended to supersede it after verified publication.
|
|
29
39
|
|
|
30
|
-
## [0.7.2] — published to `latest
|
|
40
|
+
## [0.7.2] — published to `latest`, registry verified (2026-08-13)
|
|
31
41
|
|
|
32
42
|
### Fixed
|
|
33
43
|
|
|
@@ -41,7 +51,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
|
|
|
41
51
|
|
|
42
52
|
### Release status
|
|
43
53
|
|
|
44
|
-
- npm
|
|
54
|
+
- npm promoted the immutable `0.7.2` bytes to `latest`. Later `next` assignments do not alter those bytes, and the `0.8.x` sections above describe distinct package versions that cannot be attributed to `0.7.2`.
|
|
45
55
|
|
|
46
56
|
## [0.7.1] — published to `next`, verified, not promoted (2026-08-12)
|
|
47
57
|
|
package/README.md
CHANGED
|
@@ -82,7 +82,7 @@ The included batch benchmark records a 50% reduction in model round-trips and a
|
|
|
82
82
|
|
|
83
83
|
## Supported environment and trust boundary
|
|
84
84
|
|
|
85
|
-
The package engine floor remains Node.js `>=22.5.0`. The v0.8.
|
|
85
|
+
The package engine floor remains Node.js `>=22.5.0`. The v0.8.1 release matrix covers Linux x64 under exact Node.js 22.5.0 and the current Node.js 24 line, including managed setup-file publication. That mutation additionally requires GNU coreutils 9.7 `mv` supporting `--update=none-fail`, `--exchange`, `--no-copy`, and `--no-target-directory`, GNU coreutils `ln -L -T`, procfs descriptor paths at `/proc/self/fd`, and `O_DIRECTORY`/`O_NOFOLLOW`. Other Linux architectures or systems without those filesystem primitives, macOS, and Windows remain unverified until equivalent exact-tree gates pass.
|
|
86
86
|
|
|
87
87
|
This is a local stdio server. It runs with the invoking user's filesystem permissions, and clients may request any `project_root` that user can access. It does not provide HTTP authentication, sandboxing, tenant isolation, or a remote-service security boundary. Remote, untrusted, and multi-tenant operation is unsupported.
|
|
88
88
|
|
package/SECURITY.md
CHANGED
|
@@ -11,7 +11,7 @@ Security fixes are provided for the exact version currently identified by the np
|
|
|
11
11
|
| Earlier npm versions | No |
|
|
12
12
|
| Unpublished release candidates | No |
|
|
13
13
|
|
|
14
|
-
This project supports trusted single-user local stdio use; the supported operating-system and architecture boundary remains Linux x64 only. The package engine floor is Node.js `>=22.5.0`, and the v0.8.
|
|
14
|
+
This project supports trusted single-user local stdio use; the supported operating-system and architecture boundary remains Linux x64 only. The package engine floor is Node.js `>=22.5.0`, and the v0.8.1 release matrix covers Linux x64 under exact Node.js 22.5.0 and the current Node.js 24 line, including managed setup-file publication. That mutation requires GNU coreutils 9.7 `mv --update=none-fail --exchange --no-copy --no-target-directory`, GNU coreutils `ln -L -T`, and procfs descriptor-relative paths at `/proc/self/fd` with `O_DIRECTORY`/`O_NOFOLLOW`. Other Linux architectures and systems without those primitives are unverified, as are macOS and Windows. Remote, untrusted, and multi-tenant use is outside the supported security boundary.
|
|
15
15
|
|
|
16
16
|
## Reporting a vulnerability
|
|
17
17
|
|
package/docs/support.md
CHANGED
|
@@ -1,19 +1,19 @@
|
|
|
1
1
|
# Support policy
|
|
2
2
|
|
|
3
|
-
This document defines the supported platform, runtime, persistence, and operational boundary for `ast-mcp-server` v0.8.
|
|
3
|
+
This document defines the supported platform, runtime, persistence, and operational boundary for `ast-mcp-server` v0.8.1 and the current `Unreleased` development line.
|
|
4
4
|
|
|
5
5
|
## Supported release target
|
|
6
6
|
|
|
7
7
|
| Environment | Status | Contract |
|
|
8
8
|
| ----------------------------------------------------------------------------- | ----------- | --------------------------------------------------------------------------------------------- |
|
|
9
|
-
| Linux x64 with required GNU coreutils and procfs, Node.js 22.5.0 | Supported | v0.8.
|
|
10
|
-
| Linux x64 with required GNU coreutils and procfs, current Node.js 24 line | Supported | v0.8.
|
|
9
|
+
| Linux x64 with required GNU coreutils and procfs, Node.js 22.5.0 | Supported | v0.8.1 exact release matrix for MCP/CLI/package, lifecycle, mutation, and managed setup. |
|
|
10
|
+
| Linux x64 with required GNU coreutils and procfs, current Node.js 24 line | Supported | v0.8.1 exact release matrix for MCP/CLI/package, lifecycle, mutation, and managed setup. |
|
|
11
11
|
| Other Linux architectures or systems without the required filesystem features | Unverified | Not supported until equivalent architecture, mutation, and filesystem-publication gates pass. |
|
|
12
12
|
| macOS | Unverified | Not supported until equivalent filesystem, process, package, mutation, and canary gates pass. |
|
|
13
13
|
| Windows | Unverified | Not supported until equivalent filesystem, process, package, mutation, and canary gates pass. |
|
|
14
14
|
| Remote, untrusted, or multi-tenant service use | Unsupported | No network authentication, sandbox, or tenant-isolation boundary is provided. |
|
|
15
15
|
|
|
16
|
-
The package engine floor is Node.js `>=22.5.0`. The v0.8.
|
|
16
|
+
The package engine floor is Node.js `>=22.5.0`. The v0.8.1 release matrix exercises exact Node.js 22.5.0 and the current Node.js 24 line on Linux, including managed setup-file publication; a future version satisfying the engine range is not automatically a verified release target.
|
|
17
17
|
|
|
18
18
|
The checked-evidence freezer requires GNU coreutils 9.7 `mv` with `--update=none-fail`, `--no-copy`, and `--no-target-directory`. Managed setup-file mutation additionally requires that same `mv` with `--exchange`, GNU coreutils `ln -L -T`, procfs descriptor paths at `/proc/self/fd`, `O_DIRECTORY`, and `O_NOFOLLOW`. It fails closed when any verified Linux primitive is unavailable. Equivalent publication, exchange, descriptor-link, and descriptor-relative mutation semantics have not been verified on other operating systems or architectures.
|
|
19
19
|
|
|
@@ -35,7 +35,7 @@ Operation locks coordinate cooperating same-user processes. They do not stop edi
|
|
|
35
35
|
|
|
36
36
|
The supported default is memory-only indexing. When `AST_SYMBOL_INDEX_PERSISTENCE` is absent, persistence remains disabled and no persistent cache is created.
|
|
37
37
|
|
|
38
|
-
The only candidate-authorized opt-in persistence policy is `canary`; it is not enabled by default in v0.8.
|
|
38
|
+
The only candidate-authorized opt-in persistence policy is `canary`; it is not enabled by default in v0.8.1:
|
|
39
39
|
|
|
40
40
|
```bash
|
|
41
41
|
AST_SYMBOL_INDEX_PERSISTENCE=canary \
|
|
@@ -49,7 +49,7 @@ The cache root must be explicit and absolute. Use a dedicated local directory wi
|
|
|
49
49
|
|
|
50
50
|
## Production-readiness acceptance
|
|
51
51
|
|
|
52
|
-
The four retained Linux x64 production-readiness reports cover `ast-mcp-server` and `x-scraper` under Node.js 22.5.0 and Node.js 24 for package version 0.6.0, commit `2d0b21bbb80fae1acfca6a85d5891d87e68b59c1`, and tree `af931d49769fabdf06f623965a6cfe1f9afb8a81`. They are historical integration evidence only: they are not reattributed to v0.8.
|
|
52
|
+
The four retained Linux x64 production-readiness reports cover `ast-mcp-server` and `x-scraper` under Node.js 22.5.0 and Node.js 24 for package version 0.6.0, commit `2d0b21bbb80fae1acfca6a85d5891d87e68b59c1`, and tree `af931d49769fabdf06f623965a6cfe1f9afb8a81`. They are historical integration evidence only: they are not reattributed to v0.8.1 and do not establish managed setup-file publication for that release. The separate exact v0.8.1 release matrix validates the current repository under both supported runtime lines, including managed setup, but does not rebind those historical reports. MCP-PROD-404 remains normative for admission:
|
|
53
53
|
|
|
54
54
|
- zero semantic mismatches across disabled, cold, warm, restart, and rollback reads;
|
|
55
55
|
- byte-identical real-repository status and worktree trees;
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "ast-mcp-server",
|
|
3
|
-
"version": "0.8.
|
|
3
|
+
"version": "0.8.1",
|
|
4
4
|
"description": "Structural code MCP server and batch CLI for compact TypeScript/JavaScript reads and hash-bound AST edits.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"mcp",
|
|
@@ -96,5 +96,5 @@
|
|
|
96
96
|
"typescript-eslint": "^8.65.0",
|
|
97
97
|
"vitest": "^4.1.10"
|
|
98
98
|
},
|
|
99
|
-
"gitHead": "
|
|
99
|
+
"gitHead": "bc8026fa534262c293384b50a8dff0eaa2ca22da"
|
|
100
100
|
}
|
|
@@ -46,7 +46,7 @@ El setup falla cerrado ante un registro `ast` conflictivo. No eliminar ni reempl
|
|
|
46
46
|
|
|
47
47
|
## Runtime, soporte y errores
|
|
48
48
|
|
|
49
|
-
El paquete requiere Node.js `>=22.5.0`. La matriz de release de v0.8.
|
|
49
|
+
El paquete requiere Node.js `>=22.5.0`. La matriz de release de v0.8.1 cubre Linux x64 con Node.js 22.5.0 y la línea actual de Node.js 24, incluida la publicación de archivos gestionados por setup. Esa mutación requiere además GNU coreutils 9.7 `mv` con `--update=none-fail`, `--exchange`, `--no-copy` y `--no-target-directory`, GNU coreutils `ln -L -T`, y procfs en `/proc/self/fd` con `O_DIRECTORY`/`O_NOFOLLOW`. Otras arquitecturas Linux, sistemas sin esos primitivos, macOS y Windows están sin verificar.
|
|
50
50
|
|
|
51
51
|
El transporte soportado es stdio local bajo los permisos filesystem del usuario que invoca el proceso. No asumir autenticación HTTP, sandbox, aislamiento entre tenants ni una frontera segura para clientes remotos o no confiables.
|
|
52
52
|
|
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
"algorithm": "sha256",
|
|
4
4
|
"current": {
|
|
5
5
|
"version": "4.2.0",
|
|
6
|
-
"sha256": "
|
|
6
|
+
"sha256": "43a07546fcc8417b5e937881e20d4bb87e57bba0bce1ae0c5bb58d75a6f75870"
|
|
7
7
|
},
|
|
8
8
|
"predecessors": [
|
|
9
9
|
{
|
|
@@ -40,6 +40,11 @@
|
|
|
40
40
|
"version": "4.1.0",
|
|
41
41
|
"sha256": "6284fbeaf054947d20693d317604ceabf5a53d32e3c836855a321e5e26766e29",
|
|
42
42
|
"npm_versions": ["0.7.2"]
|
|
43
|
+
},
|
|
44
|
+
{
|
|
45
|
+
"version": "4.2.0",
|
|
46
|
+
"sha256": "b072ccf68ebd50a825dc9fdbdaaf35cdbf7045ae5fb9a9d7a412dc7b702ee7a0",
|
|
47
|
+
"npm_versions": ["0.8.0"]
|
|
43
48
|
}
|
|
44
49
|
]
|
|
45
50
|
}
|