mcp-code-context 3.4.0 → 3.4.1

package/CHANGELOG.md

@@ -1,6 +1,6 @@
 # Changelog
 
-## [3.4.0] - 2026-04-24
+## [3.4.1] - 2026-04-24
 
 ### 🔒 PRODUCTION HARDENING - Security & Infrastructure Complete
 
@@ -30,7 +30,7 @@
 - **Security**: SecurityValidator enforced on all 13 handlers
 - **Architecture**: Middleware pipeline (RateLimiter → FileLock → Execute → AuditLog → Telemetry)
 - **Parsers**: Removed 300+ lines of duplicated replaceSymbol code
-- **Version**: Synchronized all version strings to 3.4.0
+- **Version**: Synchronized all version strings to 3.4.1
 
 ### Performance
 - Streaming I/O for files >5MB (prevents memory exhaustion)
@@ -49,7 +49,7 @@
 - ✅ All security tests passing
 - ✅ All rate limiter tests passing
 - ✅ All file lock tests passing
-- ✅ All v3.4.0 feature tests passing
+- ✅ All v3.4.1 feature tests passing
 - ✅ TypeScript: 0 compilation errors
 - ✅ Build: Clean production dist
 

package/CHANGELOG_v3.2.0.md

@@ -1,196 +1,196 @@
-# Changelog v3.2.0 - Security & Validation Hardening
-
-## 🔒 CRITICAL Security Fixes
-
-### Path Traversal Protection (CVE-LEVEL)
-**Impact**: HIGH - Could allow access to files outside project boundary
-**Fix**: Moved path traversal check AFTER `path.resolve()` normalization
-```typescript
-// BEFORE (vulnerable):
-if (filePath.includes("..")) return { valid: false };
-const resolved = path.resolve(filePath);
-
-// AFTER (secure):
-const resolved = path.resolve(filePath);
-if (!resolved.startsWith(this.projectRoot)) return { valid: false };
-```
-
-### Regex Injection in renameSymbol (CVE-LEVEL)
-**Impact**: HIGH - Could corrupt entire codebase with malicious symbol names
-**Fix**: Sanitize all regex inputs before use
-```typescript
-// BEFORE (vulnerable):
-const regex = new RegExp(`\\b${oldName}\\b`, "g");
-
-// AFTER (secure):
-const sanitized = oldName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-const regex = new RegExp(`\\b${sanitized}\\b`, "g");
-```
-
-### Syntax Validation Post-Write
-**Impact**: CRITICAL - Prevented silent code corruption
-**Fix**: All write operations now validate syntax before returning
-```typescript
-const syntaxCheck = validateSyntax(result, parser);
-if (!syntaxCheck.valid) {
-  return { success: false, error: syntaxCheck.error };
-}
-```
-
----
-
-## ✨ Major Improvements
-
-### 1. AST-Aware insertCode
-**Before**: Used `indexOf()` to find anchor (could match strings/comments)
-**After**: Uses AST `node.startIndex/endIndex` for precise positioning
-```typescript
-// Find anchor using AST
-const symbols = parser.findSymbols(tree);
-const anchorNode = symbols.find(s => s.name === anchorSymbol);
-insertIndex = anchorNode.startIndex; // Exact AST position
-```
-
-### 2. Improved renameSymbol
-- AST-based symbol location (not blind regex)
-- Only renames in import statements (not strings/comments)
-- Sanitized regex patterns
-- Better error messages
-
-### 3. Async I/O Migration
-**Before**: `fs.readFileSync()` blocked event loop
-**After**: `await fs.readFile()` non-blocking
-```typescript
-// engine.ts:60
-const wasmBuffer = await fs.readFile(wasmPath); // Was: fs.readFileSync
-```
-
-### 4. Centralized Constants
-**Before**: Hardcoded in 5+ files
-```typescript
-const excludeDirs = ["node_modules", "dist", "build", ".git"];
-```
-**After**: Single source of truth
-```typescript
-import { EXCLUDE_DIRS, SUPPORTED_EXTENSIONS } from "../utils/constants.js";
-```
-
-### 5. LCS-Based Diff Generation
-**Before**: Simple line-by-line (O(n))
-**After**: Longest Common Subsequence algorithm (O(n*m))
-- Cleaner diffs with proper context
-- Better readability
-- Configurable context lines
-
-### 6. Size Limits in compress
-**Before**: Only file count limit (500)
-**After**: Total size limit (50MB) + per-file check
-```typescript
-if (totalSize + stat.size > MAX_TOTAL_SIZE_BYTES) break;
-```
-
----
-
-## 🧪 Testing
-
-### New Security Test Suite
-- ✅ Path traversal protection (4 tests)
-- ✅ ReDoS detection (4 patterns)
-- ✅ Regex injection protection (4 tests)
-- ✅ File size validation (2 tests)
-
-**Coverage**: 100% on security-critical paths
-
-### Existing Tests
-- ✅ 47/47 parser tests passing
-- ✅ TypeScript, Python, PHP, Dart parsers validated
-- ✅ Symbol extraction, replacement, insertion tested
-
----
-
-## 📊 Metrics Improvement
-
-| Metric | v3.1.0 | v3.2.0 | Change |
-|--------|--------|--------|--------|
-| Security | 5.0/10 | 9.5/10 | +4.5 ✅ |
-| Code Quality | 6.5/10 | 8.5/10 | +2.0 ✅ |
-| Maintainability | 7.0/10 | 8.5/10 | +1.5 ✅ |
-| **Overall** | **6.2/10** | **8.8/10** | **+2.6** |
-
----
-
-## 🚨 Breaking Changes
-
-### Syntax Validation
-All write operations now validate syntax before returning. Invalid code will be rejected:
-```typescript
-// This will now fail if newContent has syntax errors:
-const result = await replaceSymbol({ symbolName, newContent, ... });
-```
-
-**Migration**: Ensure all generated code is syntactically valid before calling write operations.
-
----
-
-## 📝 Files Changed
-
-### Core
-- `src/core/validator.ts` - Path traversal fix
-- `src/core/engine.ts` - Async I/O migration
-
-### Operations
-- `src/operations/write.ts` - Syntax validation, AST positioning, sanitization
-- `src/operations/compress.ts` - Size limits
-- `src/operations/read.ts` - Centralized constants
-
-### Utils
-- `src/utils/constants.ts` - NEW: Centralized configuration
-- `src/utils/diff.ts` - NEW: LCS-based diff
-
-### Tests
-- `tests/test-security.ts` - NEW: Security test suite
-
----
-
-## 🔄 Upgrade Guide
-
-### From v3.1.0 to v3.2.0
-
-1. **No API changes** - Fully backward compatible
-2. **Stricter validation** - Some previously accepted (but invalid) code will now be rejected
-3. **Better error messages** - Syntax errors now caught before file write
-
-### Recommended Actions
-1. Run existing tests to ensure compatibility
-2. Review any custom write operations for syntax validity
-3. Update error handling to catch new validation errors
-
----
-
-## 🎯 Next Steps (v3.3.0)
-
-- [ ] Rate limiting for DoS protection
-- [ ] File locking for concurrent writes
-- [ ] Streaming for files >10MB
-- [ ] LSP integration for advanced refactoring
-- [ ] Telemetry and observability
-
----
-
-## 👥 Contributors
-
-- Security audit and fixes
-- Performance optimizations
-- Test coverage improvements
-
----
-
-## 📄 License
-
-MIT
-
----
-
-**Full Diff**: v3.1.0...v3.2.0
-**Release Date**: 2026-04-24
-**Stability**: Production-ready
+# Changelog v3.2.0 - Security & Validation Hardening
+
+## 🔒 CRITICAL Security Fixes
+
+### Path Traversal Protection (CVE-LEVEL)
+**Impact**: HIGH - Could allow access to files outside project boundary
+**Fix**: Moved path traversal check AFTER `path.resolve()` normalization
+```typescript
+// BEFORE (vulnerable):
+if (filePath.includes("..")) return { valid: false };
+const resolved = path.resolve(filePath);
+
+// AFTER (secure):
+const resolved = path.resolve(filePath);
+if (!resolved.startsWith(this.projectRoot)) return { valid: false };
+```
+
+### Regex Injection in renameSymbol (CVE-LEVEL)
+**Impact**: HIGH - Could corrupt entire codebase with malicious symbol names
+**Fix**: Sanitize all regex inputs before use
+```typescript
+// BEFORE (vulnerable):
+const regex = new RegExp(`\\b${oldName}\\b`, "g");
+
+// AFTER (secure):
+const sanitized = oldName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+const regex = new RegExp(`\\b${sanitized}\\b`, "g");
+```
+
+### Syntax Validation Post-Write
+**Impact**: CRITICAL - Prevented silent code corruption
+**Fix**: All write operations now validate syntax before returning
+```typescript
+const syntaxCheck = validateSyntax(result, parser);
+if (!syntaxCheck.valid) {
+  return { success: false, error: syntaxCheck.error };
+}
+```
+
+---
+
+## ✨ Major Improvements
+
+### 1. AST-Aware insertCode
+**Before**: Used `indexOf()` to find anchor (could match strings/comments)
+**After**: Uses AST `node.startIndex/endIndex` for precise positioning
+```typescript
+// Find anchor using AST
+const symbols = parser.findSymbols(tree);
+const anchorNode = symbols.find(s => s.name === anchorSymbol);
+insertIndex = anchorNode.startIndex; // Exact AST position
+```
+
+### 2. Improved renameSymbol
+- AST-based symbol location (not blind regex)
+- Only renames in import statements (not strings/comments)
+- Sanitized regex patterns
+- Better error messages
+
+### 3. Async I/O Migration
+**Before**: `fs.readFileSync()` blocked event loop
+**After**: `await fs.readFile()` non-blocking
+```typescript
+// engine.ts:60
+const wasmBuffer = await fs.readFile(wasmPath); // Was: fs.readFileSync
+```
+
+### 4. Centralized Constants
+**Before**: Hardcoded in 5+ files
+```typescript
+const excludeDirs = ["node_modules", "dist", "build", ".git"];
+```
+**After**: Single source of truth
+```typescript
+import { EXCLUDE_DIRS, SUPPORTED_EXTENSIONS } from "../utils/constants.js";
+```
+
+### 5. LCS-Based Diff Generation
+**Before**: Simple line-by-line (O(n))
+**After**: Longest Common Subsequence algorithm (O(n*m))
+- Cleaner diffs with proper context
+- Better readability
+- Configurable context lines
+
+### 6. Size Limits in compress
+**Before**: Only file count limit (500)
+**After**: Total size limit (50MB) + per-file check
+```typescript
+if (totalSize + stat.size > MAX_TOTAL_SIZE_BYTES) break;
+```
+
+---
+
+## 🧪 Testing
+
+### New Security Test Suite
+- ✅ Path traversal protection (4 tests)
+- ✅ ReDoS detection (4 patterns)
+- ✅ Regex injection protection (4 tests)
+- ✅ File size validation (2 tests)
+
+**Coverage**: 100% on security-critical paths
+
+### Existing Tests
+- ✅ 47/47 parser tests passing
+- ✅ TypeScript, Python, PHP, Dart parsers validated
+- ✅ Symbol extraction, replacement, insertion tested
+
+---
+
+## 📊 Metrics Improvement
+
+| Metric | v3.1.0 | v3.2.0 | Change |
+|--------|--------|--------|--------|
+| Security | 5.0/10 | 9.5/10 | +4.5 ✅ |
+| Code Quality | 6.5/10 | 8.5/10 | +2.0 ✅ |
+| Maintainability | 7.0/10 | 8.5/10 | +1.5 ✅ |
+| **Overall** | **6.2/10** | **8.8/10** | **+2.6** |
+
+---
+
+## 🚨 Breaking Changes
+
+### Syntax Validation
+All write operations now validate syntax before returning. Invalid code will be rejected:
+```typescript
+// This will now fail if newContent has syntax errors:
+const result = await replaceSymbol({ symbolName, newContent, ... });
+```
+
+**Migration**: Ensure all generated code is syntactically valid before calling write operations.
+
+---
+
+## 📝 Files Changed
+
+### Core
+- `src/core/validator.ts` - Path traversal fix
+- `src/core/engine.ts` - Async I/O migration
+
+### Operations
+- `src/operations/write.ts` - Syntax validation, AST positioning, sanitization
+- `src/operations/compress.ts` - Size limits
+- `src/operations/read.ts` - Centralized constants
+
+### Utils
+- `src/utils/constants.ts` - NEW: Centralized configuration
+- `src/utils/diff.ts` - NEW: LCS-based diff
+
+### Tests
+- `tests/test-security.ts` - NEW: Security test suite
+
+---
+
+## 🔄 Upgrade Guide
+
+### From v3.1.0 to v3.2.0
+
+1. **No API changes** - Fully backward compatible
+2. **Stricter validation** - Some previously accepted (but invalid) code will now be rejected
+3. **Better error messages** - Syntax errors now caught before file write
+
+### Recommended Actions
+1. Run existing tests to ensure compatibility
+2. Review any custom write operations for syntax validity
+3. Update error handling to catch new validation errors
+
+---
+
+## 🎯 Next Steps (v3.3.0)
+
+- [ ] Rate limiting for DoS protection
+- [ ] File locking for concurrent writes
+- [ ] Streaming for files >10MB
+- [ ] LSP integration for advanced refactoring
+- [ ] Telemetry and observability
+
+---
+
+## 👥 Contributors
+
+- Security audit and fixes
+- Performance optimizations
+- Test coverage improvements
+
+---
+
+## 📄 License
+
+MIT
+
+---
+
+**Full Diff**: v3.1.0...v3.2.0
+**Release Date**: 2026-04-24
+**Stability**: Production-ready