mcp-code-context 3.0.6 → 3.4.1

package/SECURITY.md

@@ -0,0 +1,177 @@
+# Security Policy - mcp-code-context v3.4.1
+
+## 🔒 Security Improvements in v3.4.1
+
+This release addresses **all critical security vulnerabilities** from comprehensive adversarial audit, implements full middleware pipeline, and hardens all 13 tool handlers.
+
+---
+
+## Fixed Vulnerabilities
+
+### 1. Path Traversal (HIGH)
+**CVSS Score**: 8.1 (High)
+**Status**: ✅ FIXED in v3.2.0, **hardened in v3.4.1**
+
+**Description**: Path traversal check occurred BEFORE path normalization, allowing bypass with absolute paths.
+
+**Fix**: Check boundary AFTER `path.resolve()` normalization. In v3.4.1, **all 13 handlers** now require `projectRoot` and validate via `SecurityValidator`.
+
+---
+
+### 2. Regex Injection in renameSymbol (HIGH)
+**CVSS Score**: 7.5 (High)
+**Status**: ✅ FIXED in v3.2.0
+
+**Description**: User-provided symbol names used directly in regex without sanitization.
+
+**Fix**: Sanitize all regex metacharacters via `sanitizeRegexPattern()` before use.
+
+---
+
+### 3. Code Corruption via Invalid Syntax (CRITICAL)
+**CVSS Score**: 9.1 (Critical)
+**Status**: ✅ FIXED in v3.2.0
+
+**Description**: Write operations did not validate syntax of generated code.
+
+**Fix**: Mandatory AST syntax validation before all writes.
+
+---
+
+### 4. ReDoS in searchPattern and readLines (MEDIUM)
+**CVSS Score**: 5.3 (Medium)
+**Status**: ✅ FIXED in v3.4.1
+
+**Description**: User-provided regex patterns could cause catastrophic backtracking.
+
+**Fix**: All regex operations now use `safeRegexTest()` with pattern validation and timeout enforcement (1s limit).
+
+---
+
+### 5. Unbounded Memory in compress (MEDIUM)
+**CVSS Score**: 5.9 (Medium)
+**Status**: ✅ FIXED in v3.2.0
+
+**Fix**: `MAX_TOTAL_SIZE_BYTES` (50MB) + `MAX_FILES_REPO_MAP` (500) limits.
+
+---
+
+### 6. extractSymbol API Mismatch (CRITICAL)
+**CVSS Score**: 9.0 (Critical)
+**Status**: ✅ FIXED in v3.4.1
+
+**Description**: `read.ts` passed `content` as `symbolName` and real `symbolName` as `className`. Symbol extraction was 100% broken.
+
+**Fix**: Corrected argument order to match `BaseParser.extractSymbol(tree, symbolName, className?)`.
+
+---
+
+### 7. Handlers Without Path Validation (HIGH)
+**CVSS Score**: 8.5 (High)
+**Status**: ✅ FIXED in v3.4.1
+
+**Description**: `readLines`, `searchPattern`, `analyzeImpact`, `getSemanticRepoMap` had no path boundary check.
+
+**Fix**: All 13 handlers now require `projectRoot` and validate all paths via `SecurityValidator`.
+
+---
+
+### 8. renameSymbol Arbitrary Write (HIGH)
+**CVSS Score**: 8.0 (High)
+**Status**: ✅ FIXED in v3.4.1
+
+**Description**: `renameSymbol` wrote dependent files without SecurityValidator check, using non-atomic writes.
+
+**Fix**: Each dependent file path validated via SecurityValidator + atomic write (write-to-tmp + rename).
+
+---
+
+### 9. LCS Diff OOM (MEDIUM)
+**CVSS Score**: 5.0 (Medium)
+**Status**: ✅ FIXED in v3.4.1
+
+**Description**: LCS diff algorithm is O(n²) memory — 10K-line files cause OOM.
+
+**Fix**: `MAX_DIFF_LINES = 5000` guard — falls back to O(n) `generateSimpleDiff` for large files.
+
+---
+
+## Security Features
+
+### Defense in Depth
+
+1. **Input Validation**
+   - Path boundary enforcement on ALL handlers (v3.4.1)
+   - File size limits (10MB per file, 50MB total)
+   - Regex sanitization + timeout (1s limit)
+
+2. **Two-Phase Write Workflow** (v3.4.1)
+   - Phase 1: Dry-run returns diff + confirmation token
+   - Phase 2: Apply with token (5-minute expiry)
+   - Max 50 pending operations
+
+3. **Middleware Pipeline** (v3.4.1)
+   - Rate limiting (token bucket per operation)
+   - File locking (prevents concurrent writes)
+   - Audit logging (persistent `.mcp-audit-logs/`)
+   - Telemetry (operation metrics, percentiles)
+
+4. **Syntax Validation**
+   - AST parsing of generated code post-write
+   - Rejection of invalid syntax before any file modification
+
+5. **Atomic Writes**
+   - Write to `.tmp` file, then rename
+   - Prevents corruption on crash/timeout
+
+---
+
+## Reporting Vulnerabilities
+
+1. **DO NOT** open public GitHub issues for security vulnerabilities
+2. Include: Description, Steps to reproduce, Impact, Suggested fix
+3. Response: Critical 24h, High 72h, Medium 1 week
+
+---
+
+## Security Testing
+
+```bash
+npm run build:tests
+node dist-tests/tests/test-security.js
+```
+
+**Coverage**:
+- ✅ Path traversal (all handlers)
+- ✅ Regex injection (sanitization + timeout)
+- ✅ File size validation
+- ✅ ReDoS detection
+- ✅ Two-phase write confirmation
+- ✅ Rate limiting
+- ✅ File locking
+
+---
+
+## Completed Security Roadmap
+
+### v3.2.0 ✅
+- [x] Path traversal fix (normalize before check)
+- [x] Regex sanitization
+- [x] Syntax validation
+- [x] Bounded memory in compress
+
+### v3.4.1 ✅
+- [x] Regex timeout enforcement (safeRegexTest)
+- [x] Rate limiting (token bucket)
+- [x] File locking (concurrent write prevention)
+- [x] Audit logging (persistent, rotated)
+- [x] Telemetry (operation metrics)
+- [x] Two-phase write workflow
+- [x] All handlers validated with projectRoot
+- [x] extractSymbol bug fix
+- [x] Diff OOM guard
+
+---
+
+**Last Updated**: 2026-04-24
+**Version**: 3.4.1

package/dist/src/core/engine.d.ts

@@ -1,6 +1,6 @@
 /**
- * Core Engine - v3.0.0
- * Tree-sitter WASM-based parsing engine
+ * Core Engine - v3.4.1
+ * ASYNC I/O: Migrated to fs.promises
  */
 import { Parser, Language } from "web-tree-sitter";
 export interface EngineConfig {

package/dist/src/core/engine.js

@@ -1,12 +1,13 @@
 /**
- * Core Engine - v3.0.0
- * Tree-sitter WASM-based parsing engine
+ * Core Engine - v3.4.1
+ * ASYNC I/O: Migrated to fs.promises
  */
 import { Parser, Language } from "web-tree-sitter";
 import * as path from "node:path";
-import * as fs from "node:fs";
+import * as fs from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 import { dirname } from "path";
+import { createRequire } from "node:module";
 export class CodeContextEngine {
     config;
     initialized = false;
@@ -31,24 +32,39 @@ export class CodeContextEngine {
             throw new Error("Engine not initialized");
         }
         const wasmFile = `tree-sitter-${name}.wasm`;
-        // Try multiple paths: installed module, local dev, CWD fallback
         const possiblePaths = [
-            // When installed as npm package
+            // 1. If running from src/core/engine.ts (ts-node)
             path.join(dirname(fileURLToPath(import.meta.url)), "..", "..", "node_modules", "tree-sitter-wasms", "out", wasmFile),
-            // When running from source
+            // 2. If running from dist/src/core/engine.js (compiled)
+            path.join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "node_modules", "tree-sitter-wasms", "out", wasmFile),
+            // 3. Fallback to process.cwd()
             path.join(process.cwd(), "node_modules", "tree-sitter-wasms", "out", wasmFile),
         ];
+        // 4. Robust Node.js module resolution (handles npx hoisting and global installs)
+        try {
+            const require = createRequire(import.meta.url);
+            const pkgPath = require.resolve("tree-sitter-wasms/package.json");
+            possiblePaths.unshift(path.join(path.dirname(pkgPath), "out", wasmFile));
+        }
+        catch {
+            // Ignore resolution errors, fallback to manual paths
+        }
         let wasmPath = null;
         for (const p of possiblePaths) {
-            if (fs.existsSync(p)) {
+            try {
+                await fs.access(p);
                 wasmPath = p;
                 break;
             }
+            catch {
+                continue;
+            }
         }
         if (!wasmPath) {
             throw new Error(`WASM file not found: ${wasmFile}. Tried paths: ${possiblePaths.join(", ")}`);
         }
-        const wasmBuffer = fs.readFileSync(wasmPath);
+        // CRITICAL FIX: Async I/O
+        const wasmBuffer = await fs.readFile(wasmPath);
         const language = await Language.load(wasmBuffer);
         this.languages.set(name, language);
     }

package/dist/src/core/engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../../src/core/engine.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAO/B,MAAM,OAAO,iBAAiB;IACpB,MAAM,CAAe;IACrB,WAAW,GAAY,KAAK,CAAC;IAC7B,MAAM,GAAkB,IAAI,CAAC;IAC7B,SAAS,GAA0B,IAAI,GAAG,EAAE,CAAC;IAErD,YAAY,SAAuB,EAAE;QACnC,IAAI,CAAC,MAAM,GAAG;YACZ,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC;YAC1C,YAAY,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;YAC/B,GAAG,MAAM;SACV,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAE7B,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAEpB,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY;QAC7B,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,IAAI,OAAO,CAAC;QAE5C,gEAAgE;QAChE,MAAM,aAAa,GAAG;YACpB,gCAAgC;YAChC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ,CAAC;YACpH,2BAA2B;YAC3B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ,CAAC;SAC/E,CAAC;QAEF,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9B,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,QAAQ,GAAG,CAAC,CAAC;gBACb,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,kBAAkB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC;QAED,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,WAAW,CAAC,IAAY;QACtB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,YAAY;QACV,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,MAAM,EAAE,CAAC;IACtB,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF"}
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../../src/core/engine.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAO5C,MAAM,OAAO,iBAAiB;IACpB,MAAM,CAAe;IACrB,WAAW,GAAY,KAAK,CAAC;IAC7B,MAAM,GAAkB,IAAI,CAAC;IAC7B,SAAS,GAA0B,IAAI,GAAG,EAAE,CAAC;IAErD,YAAY,SAAuB,EAAE;QACnC,IAAI,CAAC,MAAM,GAAG;YACZ,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC;YAC1C,YAAY,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;YAC/B,GAAG,MAAM;SACV,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAE7B,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAEpB,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY;QAC7B,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,IAAI,OAAO,CAAC;QAE5C,MAAM,aAAa,GAAG;YACpB,kDAAkD;YAClD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ,CAAC;YACpH,wDAAwD;YACxD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ,CAAC;YAC1H,+BAA+B;YAC/B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ,CAAC;SAC/E,CAAC;QAEF,iFAAiF;QACjF,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;YAClE,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;QACvD,CAAC;QAED,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACnB,QAAQ,GAAG,CAAC,CAAC;gBACb,MAAM;YACR,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,kBAAkB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC;QAED,0BAA0B;QAC1B,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,WAAW,CAAC,IAAY;QACtB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,YAAY;QACV,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,MAAM,EAAE,CAAC;IACtB,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF"}

package/dist/src/core/validator.d.ts

@@ -1,6 +1,6 @@
 /**
- * Security Validator - v3.0.0
- * Mandatory project boundary enforcement
+ * Security Validator - v3.4.1
+ * CRITICAL FIX: Path traversal check AFTER normalization
  */
 export interface ValidationResult {
     valid: boolean;

package/dist/src/core/validator.js

@@ -1,6 +1,6 @@
 /**
- * Security Validator - v3.0.0
- * Mandatory project boundary enforcement
+ * Security Validator - v3.4.1
+ * CRITICAL FIX: Path traversal check AFTER normalization
  */
 import * as path from "node:path";
 import * as fs from "node:fs/promises";
@@ -10,15 +10,16 @@ export class SecurityValidator {
         this.projectRoot = path.resolve(projectRoot);
     }
     async validateFilePath(filePath) {
+        // Resolve FIRST, then check
         const resolved = path.resolve(filePath);
-        // Path traversal check (but allow Windows drive letters)
-        if (filePath.includes("..")) {
-            return { valid: false, error: "Invalid path: contains dangerous patterns" };
-        }
-        // Project boundary check (MANDATORY)
+        // CRITICAL: Check boundary AFTER normalization
         if (!resolved.startsWith(this.projectRoot)) {
             return { valid: false, error: "Path outside project boundary" };
         }
+        // Additional dangerous pattern check
+        if (filePath.includes("..") && !resolved.startsWith(this.projectRoot)) {
+            return { valid: false, error: "Invalid path: contains dangerous patterns" };
+        }
         // Existence check
         try {
             await fs.access(resolved);

package/dist/src/core/validator.js.map

@@ -1 +1 @@
-{"version":3,"file":"validator.js","sourceRoot":"","sources":["../../../src/core/validator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAQvC,MAAM,OAAO,iBAAiB;IACpB,WAAW,CAAS;IAE5B,YAAY,WAAmB;QAC7B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,QAAgB;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAExC,yDAAyD;QACzD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;QAC9E,CAAC;QAED,qCAAqC;QACrC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QAClE,CAAC;QAED,kBAAkB;QAClB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QACxD,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,QAAgB,EAAE,UAAkB,EAAE,GAAG,IAAI,GAAG,IAAI;QACzE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,CAAC;gBACxB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9F,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,KAAK,EAAE,EAAE,CAAC;QACxE,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"validator.js","sourceRoot":"","sources":["../../../src/core/validator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAQvC,MAAM,OAAO,iBAAiB;IACpB,WAAW,CAAS;IAE5B,YAAY,WAAmB;QAC7B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,QAAgB;QACrC,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAExC,+CAA+C;QAC/C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QAClE,CAAC;QAED,qCAAqC;QACrC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACtE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;QAC9E,CAAC;QAED,kBAAkB;QAClB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QACxD,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,QAAgB,EAAE,UAAkB,EAAE,GAAG,IAAI,GAAG,IAAI;QACzE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,CAAC;gBACxB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9F,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,KAAK,EAAE,EAAE,CAAC;QACxE,CAAC;IACH,CAAC;CACF"}

package/dist/src/index.d.ts

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 /**
- * mcp-code-context v3.0.6 - Tree-sitter WASM Edition
+ * mcp-code-context v3.4.1 - Tree-sitter WASM Edition
  *
- * Complete rewrite with:
+ * Production-ready with:
  * - Tree-sitter WASM for 100% AST accuracy (TypeScript, Python, PHP, Dart)
- * - Zero native dependencies (no Visual Studio, node-gyp, or Python required)
- * - 100% portable across Windows/Mac/Linux
- * - Async-first architecture
- * - Mandatory security boundaries
+ * - Zero native dependencies — 100% portable across Windows/Mac/Linux
+ * - Two-phase write workflow (dry-run + confirmation token)
+ * - Middleware pipeline: rate limiting, file locking, audit logging, telemetry
+ * - Mandatory security boundaries on ALL handlers
  */
 export {};