kiri-mcp-server 0.9.6 → 0.10.0

package/dist/src/shared/utils/path.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Normalizes a database path by resolving to its canonical form.
+ *
+ * This prevents lock file and queue key bypass issues caused by symlinks or OS path aliases.
+ * The normalization strategy is:
+ * 1. Resolve to absolute path
+ * 2. If file exists, normalize the full path using realpathSync (follows symlinks)
+ * 3. If file doesn't exist, normalize parent directory and append filename
+ *
+ * Why this two-stage approach?
+ * - Database file may not exist yet (first indexer run)
+ * - realpathSync throws ENOENT on non-existent files
+ * - Must call ensureDbParentDir BEFORE this function to ensure parent exists
+ * - Once file exists, we normalize the full path to prevent symlink bypass
+ *
+ * @param input - Path to database file (may be relative or absolute)
+ * @returns Normalized absolute path (full path if exists, parent+filename if not)
+ *
+ * @example
+ * // First run (DB doesn't exist, symlink parent):
+ * ensureDbParentDir("/link/to/db.duckdb");  // Creates /real/path/
+ * normalizeDbPath("/link/to/db.duckdb")     // "/real/path/db.duckdb"
+ *
+ * // Second run (DB exists, accessed via symlink):
+ * normalizeDbPath("/link/db.duckdb")        // "/real/path/db.duckdb"
+ *
+ * // Result: Same normalized path → same lock file, same queue key
+ */
+export declare function normalizeDbPath(input: string): string;
+/**
+ * Ensures the parent directory of a database path exists.
+ * This should be called before normalizeDbPath to guarantee successful normalization.
+ *
+ * @param dbPath - Path to database file
+ */
+export declare function ensureDbParentDir(dbPath: string): Promise<void>;
+/**
+ * リポジトリパスを正規化して返す。realpath に失敗した場合は resolve 結果を使用する。
+ */
+export declare function normalizeRepoPath(input: string): string;
+/**
+ * 旧バージョンのパス表現（resolve ベース）との互換性を保つための候補一覧を返す。
+ * 配列の先頭は正規化済みパス。
+ */
+export declare function getRepoPathCandidates(input: string): string[];
+//# sourceMappingURL=path.d.ts.map

package/dist/src/shared/utils/path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../../../../src/shared/utils/path.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CA2BrD;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGrE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOvD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAQ7D"}

package/dist/src/shared/utils/path.js

@@ -0,0 +1,94 @@
+import { existsSync, realpathSync } from "node:fs";
+import { mkdir } from "node:fs/promises";
+import { dirname, basename, join, resolve } from "node:path";
+/**
+ * Normalizes a database path by resolving to its canonical form.
+ *
+ * This prevents lock file and queue key bypass issues caused by symlinks or OS path aliases.
+ * The normalization strategy is:
+ * 1. Resolve to absolute path
+ * 2. If file exists, normalize the full path using realpathSync (follows symlinks)
+ * 3. If file doesn't exist, normalize parent directory and append filename
+ *
+ * Why this two-stage approach?
+ * - Database file may not exist yet (first indexer run)
+ * - realpathSync throws ENOENT on non-existent files
+ * - Must call ensureDbParentDir BEFORE this function to ensure parent exists
+ * - Once file exists, we normalize the full path to prevent symlink bypass
+ *
+ * @param input - Path to database file (may be relative or absolute)
+ * @returns Normalized absolute path (full path if exists, parent+filename if not)
+ *
+ * @example
+ * // First run (DB doesn't exist, symlink parent):
+ * ensureDbParentDir("/link/to/db.duckdb");  // Creates /real/path/
+ * normalizeDbPath("/link/to/db.duckdb")     // "/real/path/db.duckdb"
+ *
+ * // Second run (DB exists, accessed via symlink):
+ * normalizeDbPath("/link/db.duckdb")        // "/real/path/db.duckdb"
+ *
+ * // Result: Same normalized path → same lock file, same queue key
+ */
+export function normalizeDbPath(input) {
+    const abs = resolve(input);
+    // Fix #1: If file exists, normalize the full path including the file itself
+    // This prevents symlink bypass: /tmp/db.duckdb -> /var/index.duckdb
+    if (existsSync(abs)) {
+        try {
+            return realpathSync.native(abs);
+        }
+        catch {
+            // Fallback to parent normalization if full path fails
+            // (e.g., permissions issue)
+        }
+    }
+    // File doesn't exist yet - normalize parent and append filename
+    const parentDir = dirname(abs);
+    const filename = basename(abs);
+    try {
+        // Normalize parent directory to canonical form
+        const canonicalParent = realpathSync.native(parentDir);
+        return join(canonicalParent, filename);
+    }
+    catch {
+        // Parent directory doesn't exist yet - caller should have called ensureDbParentDir
+        // Return unnormalized path as fallback (will cause issues!)
+        return abs;
+    }
+}
+/**
+ * Ensures the parent directory of a database path exists.
+ * This should be called before normalizeDbPath to guarantee successful normalization.
+ *
+ * @param dbPath - Path to database file
+ */
+export async function ensureDbParentDir(dbPath) {
+    const parentDir = dirname(resolve(dbPath));
+    await mkdir(parentDir, { recursive: true });
+}
+/**
+ * リポジトリパスを正規化して返す。realpath に失敗した場合は resolve 結果を使用する。
+ */
+export function normalizeRepoPath(input) {
+    const abs = resolve(input);
+    try {
+        return realpathSync.native(abs);
+    }
+    catch {
+        return abs;
+    }
+}
+/**
+ * 旧バージョンのパス表現（resolve ベース）との互換性を保つための候補一覧を返す。
+ * 配列の先頭は正規化済みパス。
+ */
+export function getRepoPathCandidates(input) {
+    const normalized = normalizeRepoPath(input);
+    const legacy = resolve(input);
+    const candidates = [normalized];
+    if (legacy !== normalized) {
+        candidates.push(legacy);
+    }
+    return candidates;
+}
+//# sourceMappingURL=path.js.map

package/dist/src/shared/utils/path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path.js","sourceRoot":"","sources":["../../../../src/shared/utils/path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAE3B,4EAA4E;IAC5E,oEAAoE;IACpE,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;YACtD,4BAA4B;QAC9B,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAE/B,IAAI,CAAC;QACH,+CAA+C;QAC/C,MAAM,eAAe,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,mFAAmF;QACnF,4DAA4D;QAC5D,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc;IACpD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1B,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/src/shared/utils/socket.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Socket Path Utility for Cross-Platform IPC
+ *
+ * Generates platform-appropriate IPC paths:
+ * - Unix/Linux/macOS: Unix domain socket files (e.g., /path/to/database.duckdb.sock)
+ * - Windows: Named pipes (e.g., \\.\pipe\kiri-<hash>)
+ */
+/**
+ * プラットフォームに応じた適切なソケットパスを生成
+ *
+ * Windows環境では名前付きパイプ形式（\\.\pipe\kiri-<hash>）を使用し、
+ * Unix系環境ではファイルシステムパス（<databasePath>.sock）を使用し、
+ * パス長が上限を超える場合は /tmp などの短いディレクトリに自動フォールバックする。
+ *
+ * **セキュリティ注意事項**:
+ * - Unix: ソケットファイルは0600パーミッション（所有者のみアクセス可能）で保護
+ *   しつつ、KIRI_SOCKET_DIR でフォールバック先ディレクトリを明示できます。
+ * - Windows: 名前付きパイプはデフォルトACLを使用（同一システムの他ユーザーが
+ *   アクセス可能な場合がある）。ハッシュベースのパイプ名で曖昧性を提供するが、
+ *   マルチユーザー環境では信頼できる環境でのみ使用することを推奨。
+ * - Windows環境では KIRI_PIPE_PREFIX 環境変数でパイプ名プレフィックスを
+ *   カスタマイズ可能（追加のセキュリティ層として利用可能）
+ *
+ * @param databasePath - データベースファイルの絶対パス
+ * @returns プラットフォーム固有のソケットパス
+ *
+ * @example
+ * // Unix/macOS/Linux
+ * getSocketPath("/path/to/database.duckdb")
+ * // => "/path/to/database.duckdb.sock"
+ *
+ * // Windows (デフォルト)
+ * getSocketPath("C:\\Users\\user\\database.duckdb")
+ * // => "\\\\.\\pipe\\kiri-a1b2c3d4..."
+ *
+ * // Windows (カスタムプレフィックス)
+ * process.env.KIRI_PIPE_PREFIX = "myapp"
+ * getSocketPath("C:\\Users\\user\\database.duckdb")
+ * // => "\\\\.\\pipe\\myapp-a1b2c3d4..."
+ */
+export declare function getSocketPath(databasePath: string, options?: {
+    ensureDir?: boolean;
+}): string;
+/**
+ * ソケットパスからデータベースパスを推測（Unix系のみ）
+ *
+ * Windows環境ではハッシュベースのパイプ名を使用するため、
+ * この関数は情報損失があり、デバッグ用途にのみ使用すべき。
+ *
+ * @param socketPath - ソケットパス
+ * @returns データベースパス（Unix系の場合）またはnull（Windows/不明な形式）
+ */
+export declare function getDatabasePathFromSocket(socketPath: string): string | null;
+/**
+ * デバッグ用のソケットパス情報を生成
+ *
+ * @param databasePath - データベースファイルの絶対パス
+ * @returns デバッグ情報文字列
+ */
+export declare function getSocketPathDebugInfo(databasePath: string): string;
+//# sourceMappingURL=socket.d.ts.map

package/dist/src/shared/utils/socket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"socket.d.ts","sourceRoot":"","sources":["../../../../src/shared/utils/socket.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAsDH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAsB7F;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAY3E;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CA+BnE"}

package/dist/src/shared/utils/socket.js

@@ -0,0 +1,156 @@
+/**
+ * Socket Path Utility for Cross-Platform IPC
+ *
+ * Generates platform-appropriate IPC paths:
+ * - Unix/Linux/macOS: Unix domain socket files (e.g., /path/to/database.duckdb.sock)
+ * - Windows: Named pipes (e.g., \\.\pipe\kiri-<hash>)
+ */
+import * as crypto from "crypto";
+import { mkdirSync } from "node:fs";
+import * as os from "os";
+import * as path from "path";
+const UNIX_SOCKET_PATH_MAX = 96; // macOS 104-byte limitに安全マージンを残す
+const SOCKET_PREFIX = "kiri";
+const SOCKET_DIR_ENV = "KIRI_SOCKET_DIR";
+function sanitizeBaseName(fileName) {
+    const sanitized = fileName.replace(/[^a-zA-Z0-9]/g, "-");
+    return sanitized.length > 0 ? sanitized.toLowerCase() : "db";
+}
+function ensureSocketDir(dirPath) {
+    try {
+        mkdirSync(dirPath, { recursive: true, mode: 0o700 });
+    }
+    catch (error) {
+        const err = error;
+        throw new Error(`Failed to prepare socket directory ${dirPath}: ${err.message}. ` +
+            `Set ${SOCKET_DIR_ENV} to a writable directory.`);
+    }
+}
+function buildFallbackUnixSocketPath(databasePath, ensureDir) {
+    const fallbackDir = process.env[SOCKET_DIR_ENV] || os.tmpdir();
+    const hash = crypto.createHash("sha256").update(databasePath).digest("hex");
+    const baseName = sanitizeBaseName(path.basename(databasePath));
+    const candidates = [
+        path.join(fallbackDir, `${SOCKET_PREFIX}-${baseName}-${hash.slice(0, 12)}.sock`),
+        path.join(fallbackDir, `${SOCKET_PREFIX}-${hash.slice(0, 12)}.sock`),
+        path.join(fallbackDir, `${SOCKET_PREFIX}-${hash.slice(0, 8)}.sock`),
+    ];
+    for (const candidate of candidates) {
+        if (Buffer.byteLength(candidate, "utf8") <= UNIX_SOCKET_PATH_MAX) {
+            if (ensureDir) {
+                ensureSocketDir(path.dirname(candidate));
+            }
+            return candidate;
+        }
+    }
+    throw new Error(`Unable to construct Unix socket path under ${UNIX_SOCKET_PATH_MAX} characters. ` +
+        `Set ${SOCKET_DIR_ENV} to a shorter directory.`);
+}
+/**
+ * プラットフォームに応じた適切なソケットパスを生成
+ *
+ * Windows環境では名前付きパイプ形式（\\.\pipe\kiri-<hash>）を使用し、
+ * Unix系環境ではファイルシステムパス（<databasePath>.sock）を使用し、
+ * パス長が上限を超える場合は /tmp などの短いディレクトリに自動フォールバックする。
+ *
+ * **セキュリティ注意事項**:
+ * - Unix: ソケットファイルは0600パーミッション（所有者のみアクセス可能）で保護
+ *   しつつ、KIRI_SOCKET_DIR でフォールバック先ディレクトリを明示できます。
+ * - Windows: 名前付きパイプはデフォルトACLを使用（同一システムの他ユーザーが
+ *   アクセス可能な場合がある）。ハッシュベースのパイプ名で曖昧性を提供するが、
+ *   マルチユーザー環境では信頼できる環境でのみ使用することを推奨。
+ * - Windows環境では KIRI_PIPE_PREFIX 環境変数でパイプ名プレフィックスを
+ *   カスタマイズ可能（追加のセキュリティ層として利用可能）
+ *
+ * @param databasePath - データベースファイルの絶対パス
+ * @returns プラットフォーム固有のソケットパス
+ *
+ * @example
+ * // Unix/macOS/Linux
+ * getSocketPath("/path/to/database.duckdb")
+ * // => "/path/to/database.duckdb.sock"
+ *
+ * // Windows (デフォルト)
+ * getSocketPath("C:\\Users\\user\\database.duckdb")
+ * // => "\\\\.\\pipe\\kiri-a1b2c3d4..."
+ *
+ * // Windows (カスタムプレフィックス)
+ * process.env.KIRI_PIPE_PREFIX = "myapp"
+ * getSocketPath("C:\\Users\\user\\database.duckdb")
+ * // => "\\\\.\\pipe\\myapp-a1b2c3d4..."
+ */
+export function getSocketPath(databasePath, options) {
+    const ensureDir = options?.ensureDir ?? false;
+    if (os.platform() === "win32") {
+        // Windows: 名前付きパイプを使用
+        // データベースパスのハッシュを使ってユニークなパイプ名を生成
+        const hash = crypto.createHash("sha256").update(databasePath).digest("hex");
+        // 環境変数でプレフィックスをカスタマイズ可能（追加のセキュリティ層）
+        const prefix = process.env.KIRI_PIPE_PREFIX || SOCKET_PREFIX;
+        // 最初の16文字を使用（衝突リスクは極めて低い）
+        const pipeName = `${prefix}-${hash.substring(0, 16)}`;
+        return `\\\\.\\pipe\\${pipeName}`;
+    }
+    const defaultSocketPath = `${databasePath}.sock`;
+    if (Buffer.byteLength(defaultSocketPath, "utf8") <= UNIX_SOCKET_PATH_MAX) {
+        if (ensureDir) {
+            ensureSocketDir(path.dirname(defaultSocketPath));
+        }
+        return defaultSocketPath;
+    }
+    return buildFallbackUnixSocketPath(databasePath, ensureDir);
+}
+/**
+ * ソケットパスからデータベースパスを推測（Unix系のみ）
+ *
+ * Windows環境ではハッシュベースのパイプ名を使用するため、
+ * この関数は情報損失があり、デバッグ用途にのみ使用すべき。
+ *
+ * @param socketPath - ソケットパス
+ * @returns データベースパス（Unix系の場合）またはnull（Windows/不明な形式）
+ */
+export function getDatabasePathFromSocket(socketPath) {
+    if (os.platform() === "win32") {
+        // Windowsではパイプ名からデータベースパスを復元できない
+        return null;
+    }
+    // Unix系: .sock拡張子を削除
+    if (socketPath.endsWith(".sock")) {
+        return socketPath.slice(0, -5); // ".sock" の長さは5
+    }
+    return null;
+}
+/**
+ * デバッグ用のソケットパス情報を生成
+ *
+ * @param databasePath - データベースファイルの絶対パス
+ * @returns デバッグ情報文字列
+ */
+export function getSocketPathDebugInfo(databasePath) {
+    const socketPath = getSocketPath(databasePath);
+    const platform = os.platform();
+    const defaultUnixSocket = `${databasePath}.sock`;
+    // プラットフォーム固有のpathモジュールを使用して正しくパースする
+    const pathModule = platform === "win32" ? path.win32 : path.posix;
+    const dbDir = pathModule.dirname(databasePath);
+    const dbBase = pathModule.basename(databasePath);
+    if (platform === "win32") {
+        return [
+            `Database: ${dbBase} (${dbDir})`,
+            `Socket: ${socketPath} (Windows named pipe)`,
+            `Note: Pipe name is derived from database path hash for uniqueness`,
+        ].join("\n");
+    }
+    else {
+        const lines = [
+            `Database: ${dbBase} (${dbDir})`,
+            `Socket: ${socketPath} (Unix domain socket)`,
+            `Permissions: Owner-only (0600)`,
+        ];
+        if (socketPath !== defaultUnixSocket) {
+            lines.push(`Fallback: Socket path shortened (set ${SOCKET_DIR_ENV} to override base directory)`);
+        }
+        return lines.join("\n");
+    }
+}
+//# sourceMappingURL=socket.js.map

package/dist/src/shared/utils/socket.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"socket.js","sourceRoot":"","sources":["../../../../src/shared/utils/socket.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,MAAM,oBAAoB,GAAG,EAAE,CAAC,CAAC,iCAAiC;AAClE,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEzC,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/D,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAA8B,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,sCAAsC,OAAO,KAAK,GAAG,CAAC,OAAO,IAAI;YAC/D,OAAO,cAAc,2BAA2B,CACnD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,YAAoB,EAAE,SAAkB;IAC3E,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;IAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IAE/D,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,aAAa,IAAI,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC;QAChF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,aAAa,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,aAAa,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;KACpE,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,oBAAoB,EAAE,CAAC;YACjE,IAAI,SAAS,EAAE,CAAC;gBACd,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CACb,8CAA8C,oBAAoB,eAAe;QAC/E,OAAO,cAAc,0BAA0B,CAClD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,aAAa,CAAC,YAAoB,EAAE,OAAiC;IACnF,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,KAAK,CAAC;IAC9C,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC9B,sBAAsB;QACtB,gCAAgC;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,oCAAoC;QACpC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,aAAa,CAAC;QAC7D,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,GAAG,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACtD,OAAO,gBAAgB,QAAQ,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,iBAAiB,GAAG,GAAG,YAAY,OAAO,CAAC;IACjD,IAAI,MAAM,CAAC,UAAU,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,oBAAoB,EAAE,CAAC;QACzE,IAAI,SAAS,EAAE,CAAC;YACd,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,OAAO,2BAA2B,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAAkB;IAC1D,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC9B,iCAAiC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qBAAqB;IACrB,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB;IAClD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,YAAoB;IACzD,MAAM,UAAU,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC/B,MAAM,iBAAiB,GAAG,GAAG,YAAY,OAAO,CAAC;IAEjD,oCAAoC;IACpC,MAAM,UAAU,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;IAClE,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAEjD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO;YACL,aAAa,MAAM,KAAK,KAAK,GAAG;YAChC,WAAW,UAAU,uBAAuB;YAC5C,mEAAmE;SACpE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG;YACZ,aAAa,MAAM,KAAK,KAAK,GAAG;YAChC,WAAW,UAAU,uBAAuB;YAC5C,gCAAgC;SACjC,CAAC;QAEF,IAAI,UAAU,KAAK,iBAAiB,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CACR,wCAAwC,cAAc,8BAA8B,CACrF,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC"}

package/dist/src/shared/utils/validation.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Validation utilities for CLI arguments and user input
+ */
+/**
+ * Parse a string to a positive integer with validation
+ *
+ * @param value - String value to parse
+ * @param defaultValue - Default value if input is undefined
+ * @param name - Parameter name for error messages
+ * @returns Parsed integer
+ * @throws Error if value is not a valid positive integer
+ */
+export declare function parsePositiveInt(value: string | undefined, defaultValue: number, name: string): number;
+//# sourceMappingURL=validation.d.ts.map

package/dist/src/shared/utils/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../../src/shared/utils/validation.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,GACX,MAAM,CAUR"}

package/dist/src/shared/utils/validation.js

@@ -0,0 +1,22 @@
+/**
+ * Validation utilities for CLI arguments and user input
+ */
+/**
+ * Parse a string to a positive integer with validation
+ *
+ * @param value - String value to parse
+ * @param defaultValue - Default value if input is undefined
+ * @param name - Parameter name for error messages
+ * @returns Parsed integer
+ * @throws Error if value is not a valid positive integer
+ */
+export function parsePositiveInt(value, defaultValue, name) {
+    if (!value)
+        return defaultValue;
+    const parsed = parseInt(value, 10);
+    if (Number.isNaN(parsed) || parsed < 0) {
+        throw new Error(`Invalid ${name}: "${value}". Expected a positive integer. Use default ${defaultValue} or specify a valid number.`);
+    }
+    return parsed;
+}
+//# sourceMappingURL=validation.js.map

package/dist/src/shared/utils/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../../src/shared/utils/validation.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAyB,EACzB,YAAoB,EACpB,IAAY;IAEZ,IAAI,CAAC,KAAK;QAAE,OAAO,YAAY,CAAC;IAEhC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,MAAM,KAAK,+CAA+C,YAAY,6BAA6B,CACnH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kiri-mcp-server",
-  "version": "0.9.6",
+  "version": "0.10.0",
   "description": "KIRI context extraction platform",
   "type": "module",
   "packageManager": "pnpm@9.0.0",
@@ -56,6 +56,15 @@
     "dev": "tsx src/server/main.ts --port 8765",
     "lint": "eslint \"{src,tests,scripts}/**/*.{ts,tsx}\" && prettier --check \"**/*.{ts,tsx,json,md,yml}\"",
     "test": "vitest run --coverage --pool=forks --poolOptions.forks.singleFork --poolOptions.forks.maxForks=1 --poolOptions.forks.minForks=1",
+    "verify": "tsx scripts/test/verify-all.ts",
+    "verify:unit": "tsx scripts/test/verify-all.ts --category unit",
+    "verify:dart": "tsx scripts/test/verify-all.ts --category dart",
+    "verify:integration": "tsx scripts/test/verify-all.ts --category integration",
+    "verify:tools": "tsx scripts/test/verify-all.ts --category tools",
+    "verify:watch": "tsx scripts/test/verify-all.ts --category watch",
+    "verify:eval": "tsx scripts/test/verify-all.ts --category eval",
+    "eval:golden": "tsx scripts/eval/run-golden.ts",
+    "eval:golden:verbose": "tsx scripts/eval/run-golden.ts --verbose",
     "check": "pnpm run lint && pnpm run test",
     "prepublishOnly": "pnpm run build"
   },
@@ -63,7 +72,9 @@
     "chokidar": "^4.0.3",
     "duckdb": "^1.1.0",
     "gpt-tokenizer": "^3.2.0",
+    "p-queue": "^9.0.0",
     "tree-sitter": "^0.22.0",
+    "tree-sitter-java": "^0.23.2",
     "tree-sitter-php": "^0.22.8",
     "tree-sitter-swift": "0.7.1",
     "typescript": "^5.6.3",
@@ -78,6 +89,8 @@
     "eslint": "^9.9.0",
     "eslint-config-prettier": "^9.1.0",
     "eslint-plugin-import": "^2.29.1",
+    "execa": "^9.6.0",
+    "fast-check": "^4.3.0",
     "lint-staged": "^15.2.10",
     "prettier": "^3.3.3",
     "simple-git-hooks": "^2.10.0",