mcp-code-context 3.4.0 → 3.4.1

package/SECURITY.md

@@ -1,177 +1,177 @@
-# Security Policy - mcp-code-context v3.4.0
-
-## 🔒 Security Improvements in v3.4.0
-
-This release addresses **all critical security vulnerabilities** from comprehensive adversarial audit, implements full middleware pipeline, and hardens all 13 tool handlers.
-
----
-
-## Fixed Vulnerabilities
-
-### 1. Path Traversal (HIGH)
-**CVSS Score**: 8.1 (High)
-**Status**: ✅ FIXED in v3.2.0, **hardened in v3.4.0**
-
-**Description**: Path traversal check occurred BEFORE path normalization, allowing bypass with absolute paths.
-
-**Fix**: Check boundary AFTER `path.resolve()` normalization. In v3.4.0, **all 13 handlers** now require `projectRoot` and validate via `SecurityValidator`.
-
----
-
-### 2. Regex Injection in renameSymbol (HIGH)
-**CVSS Score**: 7.5 (High)
-**Status**: ✅ FIXED in v3.2.0
-
-**Description**: User-provided symbol names used directly in regex without sanitization.
-
-**Fix**: Sanitize all regex metacharacters via `sanitizeRegexPattern()` before use.
-
----
-
-### 3. Code Corruption via Invalid Syntax (CRITICAL)
-**CVSS Score**: 9.1 (Critical)
-**Status**: ✅ FIXED in v3.2.0
-
-**Description**: Write operations did not validate syntax of generated code.
-
-**Fix**: Mandatory AST syntax validation before all writes.
-
----
-
-### 4. ReDoS in searchPattern and readLines (MEDIUM)
-**CVSS Score**: 5.3 (Medium)
-**Status**: ✅ FIXED in v3.4.0
-
-**Description**: User-provided regex patterns could cause catastrophic backtracking.
-
-**Fix**: All regex operations now use `safeRegexTest()` with pattern validation and timeout enforcement (1s limit).
-
----
-
-### 5. Unbounded Memory in compress (MEDIUM)
-**CVSS Score**: 5.9 (Medium)
-**Status**: ✅ FIXED in v3.2.0
-
-**Fix**: `MAX_TOTAL_SIZE_BYTES` (50MB) + `MAX_FILES_REPO_MAP` (500) limits.
-
----
-
-### 6. extractSymbol API Mismatch (CRITICAL)
-**CVSS Score**: 9.0 (Critical)
-**Status**: ✅ FIXED in v3.4.0
-
-**Description**: `read.ts` passed `content` as `symbolName` and real `symbolName` as `className`. Symbol extraction was 100% broken.
-
-**Fix**: Corrected argument order to match `BaseParser.extractSymbol(tree, symbolName, className?)`.
-
----
-
-### 7. Handlers Without Path Validation (HIGH)
-**CVSS Score**: 8.5 (High)
-**Status**: ✅ FIXED in v3.4.0
-
-**Description**: `readLines`, `searchPattern`, `analyzeImpact`, `getSemanticRepoMap` had no path boundary check.
-
-**Fix**: All 13 handlers now require `projectRoot` and validate all paths via `SecurityValidator`.
-
----
-
-### 8. renameSymbol Arbitrary Write (HIGH)
-**CVSS Score**: 8.0 (High)
-**Status**: ✅ FIXED in v3.4.0
-
-**Description**: `renameSymbol` wrote dependent files without SecurityValidator check, using non-atomic writes.
-
-**Fix**: Each dependent file path validated via SecurityValidator + atomic write (write-to-tmp + rename).
-
----
-
-### 9. LCS Diff OOM (MEDIUM)
-**CVSS Score**: 5.0 (Medium)
-**Status**: ✅ FIXED in v3.4.0
-
-**Description**: LCS diff algorithm is O(n²) memory — 10K-line files cause OOM.
-
-**Fix**: `MAX_DIFF_LINES = 5000` guard — falls back to O(n) `generateSimpleDiff` for large files.
-
----
-
-## Security Features
-
-### Defense in Depth
-
-1. **Input Validation**
-   - Path boundary enforcement on ALL handlers (v3.4.0)
-   - File size limits (10MB per file, 50MB total)
-   - Regex sanitization + timeout (1s limit)
-
-2. **Two-Phase Write Workflow** (v3.4.0)
-   - Phase 1: Dry-run returns diff + confirmation token
-   - Phase 2: Apply with token (5-minute expiry)
-   - Max 50 pending operations
-
-3. **Middleware Pipeline** (v3.4.0)
-   - Rate limiting (token bucket per operation)
-   - File locking (prevents concurrent writes)
-   - Audit logging (persistent `.mcp-audit-logs/`)
-   - Telemetry (operation metrics, percentiles)
-
-4. **Syntax Validation**
-   - AST parsing of generated code post-write
-   - Rejection of invalid syntax before any file modification
-
-5. **Atomic Writes**
-   - Write to `.tmp` file, then rename
-   - Prevents corruption on crash/timeout
-
----
-
-## Reporting Vulnerabilities
-
-1. **DO NOT** open public GitHub issues for security vulnerabilities
-2. Include: Description, Steps to reproduce, Impact, Suggested fix
-3. Response: Critical 24h, High 72h, Medium 1 week
-
----
-
-## Security Testing
-
-```bash
-npm run build:tests
-node dist-tests/tests/test-security.js
-```
-
-**Coverage**:
-- ✅ Path traversal (all handlers)
-- ✅ Regex injection (sanitization + timeout)
-- ✅ File size validation
-- ✅ ReDoS detection
-- ✅ Two-phase write confirmation
-- ✅ Rate limiting
-- ✅ File locking
-
----
-
-## Completed Security Roadmap
-
-### v3.2.0 ✅
-- [x] Path traversal fix (normalize before check)
-- [x] Regex sanitization
-- [x] Syntax validation
-- [x] Bounded memory in compress
-
-### v3.4.0 ✅
-- [x] Regex timeout enforcement (safeRegexTest)
-- [x] Rate limiting (token bucket)
-- [x] File locking (concurrent write prevention)
-- [x] Audit logging (persistent, rotated)
-- [x] Telemetry (operation metrics)
-- [x] Two-phase write workflow
-- [x] All handlers validated with projectRoot
-- [x] extractSymbol bug fix
-- [x] Diff OOM guard
-
----
-
-**Last Updated**: 2026-04-24
-**Version**: 3.4.0
+# Security Policy - mcp-code-context v3.4.1
+
+## 🔒 Security Improvements in v3.4.1
+
+This release addresses **all critical security vulnerabilities** from comprehensive adversarial audit, implements full middleware pipeline, and hardens all 13 tool handlers.
+
+---
+
+## Fixed Vulnerabilities
+
+### 1. Path Traversal (HIGH)
+**CVSS Score**: 8.1 (High)
+**Status**: ✅ FIXED in v3.2.0, **hardened in v3.4.1**
+
+**Description**: Path traversal check occurred BEFORE path normalization, allowing bypass with absolute paths.
+
+**Fix**: Check boundary AFTER `path.resolve()` normalization. In v3.4.1, **all 13 handlers** now require `projectRoot` and validate via `SecurityValidator`.
+
+---
+
+### 2. Regex Injection in renameSymbol (HIGH)
+**CVSS Score**: 7.5 (High)
+**Status**: ✅ FIXED in v3.2.0
+
+**Description**: User-provided symbol names used directly in regex without sanitization.
+
+**Fix**: Sanitize all regex metacharacters via `sanitizeRegexPattern()` before use.
+
+---
+
+### 3. Code Corruption via Invalid Syntax (CRITICAL)
+**CVSS Score**: 9.1 (Critical)
+**Status**: ✅ FIXED in v3.2.0
+
+**Description**: Write operations did not validate syntax of generated code.
+
+**Fix**: Mandatory AST syntax validation before all writes.
+
+---
+
+### 4. ReDoS in searchPattern and readLines (MEDIUM)
+**CVSS Score**: 5.3 (Medium)
+**Status**: ✅ FIXED in v3.4.1
+
+**Description**: User-provided regex patterns could cause catastrophic backtracking.
+
+**Fix**: All regex operations now use `safeRegexTest()` with pattern validation and timeout enforcement (1s limit).
+
+---
+
+### 5. Unbounded Memory in compress (MEDIUM)
+**CVSS Score**: 5.9 (Medium)
+**Status**: ✅ FIXED in v3.2.0
+
+**Fix**: `MAX_TOTAL_SIZE_BYTES` (50MB) + `MAX_FILES_REPO_MAP` (500) limits.
+
+---
+
+### 6. extractSymbol API Mismatch (CRITICAL)
+**CVSS Score**: 9.0 (Critical)
+**Status**: ✅ FIXED in v3.4.1
+
+**Description**: `read.ts` passed `content` as `symbolName` and real `symbolName` as `className`. Symbol extraction was 100% broken.
+
+**Fix**: Corrected argument order to match `BaseParser.extractSymbol(tree, symbolName, className?)`.
+
+---
+
+### 7. Handlers Without Path Validation (HIGH)
+**CVSS Score**: 8.5 (High)
+**Status**: ✅ FIXED in v3.4.1
+
+**Description**: `readLines`, `searchPattern`, `analyzeImpact`, `getSemanticRepoMap` had no path boundary check.
+
+**Fix**: All 13 handlers now require `projectRoot` and validate all paths via `SecurityValidator`.
+
+---
+
+### 8. renameSymbol Arbitrary Write (HIGH)
+**CVSS Score**: 8.0 (High)
+**Status**: ✅ FIXED in v3.4.1
+
+**Description**: `renameSymbol` wrote dependent files without SecurityValidator check, using non-atomic writes.
+
+**Fix**: Each dependent file path validated via SecurityValidator + atomic write (write-to-tmp + rename).
+
+---
+
+### 9. LCS Diff OOM (MEDIUM)
+**CVSS Score**: 5.0 (Medium)
+**Status**: ✅ FIXED in v3.4.1
+
+**Description**: LCS diff algorithm is O(n²) memory — 10K-line files cause OOM.
+
+**Fix**: `MAX_DIFF_LINES = 5000` guard — falls back to O(n) `generateSimpleDiff` for large files.
+
+---
+
+## Security Features
+
+### Defense in Depth
+
+1. **Input Validation**
+   - Path boundary enforcement on ALL handlers (v3.4.1)
+   - File size limits (10MB per file, 50MB total)
+   - Regex sanitization + timeout (1s limit)
+
+2. **Two-Phase Write Workflow** (v3.4.1)
+   - Phase 1: Dry-run returns diff + confirmation token
+   - Phase 2: Apply with token (5-minute expiry)
+   - Max 50 pending operations
+
+3. **Middleware Pipeline** (v3.4.1)
+   - Rate limiting (token bucket per operation)
+   - File locking (prevents concurrent writes)
+   - Audit logging (persistent `.mcp-audit-logs/`)
+   - Telemetry (operation metrics, percentiles)
+
+4. **Syntax Validation**
+   - AST parsing of generated code post-write
+   - Rejection of invalid syntax before any file modification
+
+5. **Atomic Writes**
+   - Write to `.tmp` file, then rename
+   - Prevents corruption on crash/timeout
+
+---
+
+## Reporting Vulnerabilities
+
+1. **DO NOT** open public GitHub issues for security vulnerabilities
+2. Include: Description, Steps to reproduce, Impact, Suggested fix
+3. Response: Critical 24h, High 72h, Medium 1 week
+
+---
+
+## Security Testing
+
+```bash
+npm run build:tests
+node dist-tests/tests/test-security.js
+```
+
+**Coverage**:
+- ✅ Path traversal (all handlers)
+- ✅ Regex injection (sanitization + timeout)
+- ✅ File size validation
+- ✅ ReDoS detection
+- ✅ Two-phase write confirmation
+- ✅ Rate limiting
+- ✅ File locking
+
+---
+
+## Completed Security Roadmap
+
+### v3.2.0 ✅
+- [x] Path traversal fix (normalize before check)
+- [x] Regex sanitization
+- [x] Syntax validation
+- [x] Bounded memory in compress
+
+### v3.4.1 ✅
+- [x] Regex timeout enforcement (safeRegexTest)
+- [x] Rate limiting (token bucket)
+- [x] File locking (concurrent write prevention)
+- [x] Audit logging (persistent, rotated)
+- [x] Telemetry (operation metrics)
+- [x] Two-phase write workflow
+- [x] All handlers validated with projectRoot
+- [x] extractSymbol bug fix
+- [x] Diff OOM guard
+
+---
+
+**Last Updated**: 2026-04-24
+**Version**: 3.4.1

package/dist/src/core/engine.d.ts

@@ -1,5 +1,5 @@
 /**
- * Core Engine - v3.4.0
+ * Core Engine - v3.4.1
  * ASYNC I/O: Migrated to fs.promises
  */
 import { Parser, Language } from "web-tree-sitter";

package/dist/src/core/engine.js

@@ -1,5 +1,5 @@
 /**
- * Core Engine - v3.4.0
+ * Core Engine - v3.4.1
  * ASYNC I/O: Migrated to fs.promises
  */
 import { Parser, Language } from "web-tree-sitter";
@@ -7,6 +7,7 @@ import * as path from "node:path";
 import * as fs from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 import { dirname } from "path";
+import { createRequire } from "node:module";
 export class CodeContextEngine {
     config;
     initialized = false;
@@ -39,6 +40,15 @@ export class CodeContextEngine {
             // 3. Fallback to process.cwd()
             path.join(process.cwd(), "node_modules", "tree-sitter-wasms", "out", wasmFile),
         ];
+        // 4. Robust Node.js module resolution (handles npx hoisting and global installs)
+        try {
+            const require = createRequire(import.meta.url);
+            const pkgPath = require.resolve("tree-sitter-wasms/package.json");
+            possiblePaths.unshift(path.join(path.dirname(pkgPath), "out", wasmFile));
+        }
+        catch {
+            // Ignore resolution errors, fallback to manual paths
+        }
         let wasmPath = null;
         for (const p of possiblePaths) {
             try {

package/dist/src/core/engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../../src/core/engine.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAO/B,MAAM,OAAO,iBAAiB;IACpB,MAAM,CAAe;IACrB,WAAW,GAAY,KAAK,CAAC;IAC7B,MAAM,GAAkB,IAAI,CAAC;IAC7B,SAAS,GAA0B,IAAI,GAAG,EAAE,CAAC;IAErD,YAAY,SAAuB,EAAE;QACnC,IAAI,CAAC,MAAM,GAAG;YACZ,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC;YAC1C,YAAY,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;YAC/B,GAAG,MAAM;SACV,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAE7B,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAEpB,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY;QAC7B,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,IAAI,OAAO,CAAC;QAE5C,MAAM,aAAa,GAAG;YACpB,kDAAkD;YAClD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ,CAAC;YACpH,wDAAwD;YACxD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ,CAAC;YAC1H,+BAA+B;YAC/B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ,CAAC;SAC/E,CAAC;QAEF,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACnB,QAAQ,GAAG,CAAC,CAAC;gBACb,MAAM;YACR,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,kBAAkB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC;QAED,0BAA0B;QAC1B,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,WAAW,CAAC,IAAY;QACtB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,YAAY;QACV,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,MAAM,EAAE,CAAC;IACtB,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF"}
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../../src/core/engine.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAO5C,MAAM,OAAO,iBAAiB;IACpB,MAAM,CAAe;IACrB,WAAW,GAAY,KAAK,CAAC;IAC7B,MAAM,GAAkB,IAAI,CAAC;IAC7B,SAAS,GAA0B,IAAI,GAAG,EAAE,CAAC;IAErD,YAAY,SAAuB,EAAE;QACnC,IAAI,CAAC,MAAM,GAAG;YACZ,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC;YAC1C,YAAY,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;YAC/B,GAAG,MAAM;SACV,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAE7B,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAEpB,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY;QAC7B,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,IAAI,OAAO,CAAC;QAE5C,MAAM,aAAa,GAAG;YACpB,kDAAkD;YAClD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ,CAAC;YACpH,wDAAwD;YACxD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ,CAAC;YAC1H,+BAA+B;YAC/B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ,CAAC;SAC/E,CAAC;QAEF,iFAAiF;QACjF,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;YAClE,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;QACvD,CAAC;QAED,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACnB,QAAQ,GAAG,CAAC,CAAC;gBACb,MAAM;YACR,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,kBAAkB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC;QAED,0BAA0B;QAC1B,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,WAAW,CAAC,IAAY;QACtB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,YAAY;QACV,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,MAAM,EAAE,CAAC;IACtB,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF"}

package/dist/src/core/validator.d.ts

@@ -1,5 +1,5 @@
 /**
- * Security Validator - v3.4.0
+ * Security Validator - v3.4.1
  * CRITICAL FIX: Path traversal check AFTER normalization
  */
 export interface ValidationResult {

package/dist/src/core/validator.js

@@ -1,5 +1,5 @@
 /**
- * Security Validator - v3.4.0
+ * Security Validator - v3.4.1
  * CRITICAL FIX: Path traversal check AFTER normalization
  */
 import * as path from "node:path";

package/dist/src/index.d.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * mcp-code-context v3.4.0 - Tree-sitter WASM Edition
+ * mcp-code-context v3.4.1 - Tree-sitter WASM Edition
  *
  * Production-ready with:
  * - Tree-sitter WASM for 100% AST accuracy (TypeScript, Python, PHP, Dart)

package/dist/src/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * mcp-code-context v3.4.0 - Tree-sitter WASM Edition
+ * mcp-code-context v3.4.1 - Tree-sitter WASM Edition
  *
  * Production-ready with:
  * - Tree-sitter WASM for 100% AST accuracy (TypeScript, Python, PHP, Dart)
@@ -28,7 +28,7 @@ import { streamFile } from "./utils/streaming.js";
 import { BackupManager } from "./utils/backupManager.js";
 import * as fs from "node:fs/promises";
 const SERVER_NAME = "mcp-code-context";
-const SERVER_VERSION = "3.4.0";
+const SERVER_VERSION = "3.4.1";
 // Global instances
 let engine;
 let registry;

package/dist/src/operations/compress.d.ts

@@ -1,5 +1,5 @@
 /**
- * Semantic Compression - v3.4.0
+ * Semantic Compression - v3.4.1
  * IMPROVEMENTS: Centralized constants + size limits + timeout
  */
 import { ParserRegistry } from "../parsers/registry.js";

package/dist/src/operations/compress.js

@@ -1,5 +1,5 @@
 /**
- * Semantic Compression - v3.4.0
+ * Semantic Compression - v3.4.1
  * IMPROVEMENTS: Centralized constants + size limits + timeout
  */
 import * as fs from "node:fs/promises";

package/dist/src/operations/confirmationStore.d.ts

@@ -1,5 +1,5 @@
 /**
- * Confirmation Store - v3.4.0
+ * Confirmation Store - v3.4.1
  * Two-phase write: dry-run preview → confirm with token
  * Stores pending write operations with auto-expiry
  */

package/dist/src/operations/confirmationStore.js

@@ -1,5 +1,5 @@
 /**
- * Confirmation Store - v3.4.0
+ * Confirmation Store - v3.4.1
  * Two-phase write: dry-run preview → confirm with token
  * Stores pending write operations with auto-expiry
  */

package/dist/src/operations/read.d.ts

@@ -1,5 +1,5 @@
 /**
- * Read Operations - v3.4.0
+ * Read Operations - v3.4.1
  * FIXES: extractSymbol args, safe regex in readLines, forEach+async → for...of
  */
 import { BaseParser } from "../parsers/base.js";

package/dist/src/operations/read.js

@@ -1,5 +1,5 @@
 /**
- * Read Operations - v3.4.0
+ * Read Operations - v3.4.1
  * FIXES: extractSymbol args, safe regex in readLines, forEach+async → for...of
  */
 import * as fs from "node:fs/promises";

package/dist/src/operations/write.d.ts

@@ -1,5 +1,5 @@
 /**
- * Write Operations - v3.4.0
+ * Write Operations - v3.4.1
  * FIXES: SecurityValidator in renameSymbol, atomic writes, AST-based positioning
  */
 import { BaseParser } from "../parsers/base.js";
@@ -47,7 +47,7 @@ export declare function insertCode(options: InsertOptions): Promise<WriteResult>
 export declare function removeSymbol(options: RemoveOptions): Promise<WriteResult>;
 /**
  * Rename symbol using AST-aware replacement
- * v3.4.0 - SECURITY FIX: Validates all paths + uses atomic writes
+ * v3.4.1 - SECURITY FIX: Validates all paths + uses atomic writes
  */
 export declare function renameSymbol(params: {
     filePath: string;

package/dist/src/operations/write.js

@@ -1,5 +1,5 @@
 /**
- * Write Operations - v3.4.0
+ * Write Operations - v3.4.1
  * FIXES: SecurityValidator in renameSymbol, atomic writes, AST-based positioning
  */
 import * as fs from "node:fs/promises";
@@ -163,7 +163,7 @@ export async function removeSymbol(options) {
 }
 /**
  * Rename symbol using AST-aware replacement
- * v3.4.0 - SECURITY FIX: Validates all paths + uses atomic writes
+ * v3.4.1 - SECURITY FIX: Validates all paths + uses atomic writes
  */
 export async function renameSymbol(params) {
     try {

package/dist/src/parsers/base.d.ts

@@ -1,5 +1,5 @@
 /**
- * Base Parser - v3.4.0
+ * Base Parser - v3.4.1
  * Abstract base for all language parsers
  * IMPROVEMENT: replaceSymbol moved here using AST indices (eliminates indexOf fragility)
  */

package/dist/src/parsers/base.js

@@ -1,5 +1,5 @@
 /**
- * Base Parser - v3.4.0
+ * Base Parser - v3.4.1
  * Abstract base for all language parsers
  * IMPROVEMENT: replaceSymbol moved here using AST indices (eliminates indexOf fragility)
  */

package/dist/src/parsers/dartTreeSitter.d.ts

@@ -1,5 +1,5 @@
 /**
- * Dart Tree-sitter Parser - v3.4.0
+ * Dart Tree-sitter Parser - v3.4.1
  * 100% AST accuracy via WASM
  * CLEANUP: replaceSymbol removed (inherited from BaseParser)
  */

package/dist/src/parsers/dartTreeSitter.js

@@ -1,5 +1,5 @@
 /**
- * Dart Tree-sitter Parser - v3.4.0
+ * Dart Tree-sitter Parser - v3.4.1
  * 100% AST accuracy via WASM
  * CLEANUP: replaceSymbol removed (inherited from BaseParser)
  */

package/dist/src/parsers/php.d.ts

@@ -1,5 +1,5 @@
 /**
- * PHP Parser - v3.4.0
+ * PHP Parser - v3.4.1
  * CLEANUP: replaceSymbol removed (inherited from BaseParser)
  */
 import { Tree } from "web-tree-sitter";

package/dist/src/parsers/php.js

@@ -1,5 +1,5 @@
 /**
- * PHP Parser - v3.4.0
+ * PHP Parser - v3.4.1
  * CLEANUP: replaceSymbol removed (inherited from BaseParser)
  */
 import { BaseParser } from "./base.js";

package/dist/src/parsers/python.d.ts

@@ -1,5 +1,5 @@
 /**
- * Python Parser - v3.4.0
+ * Python Parser - v3.4.1
  * CLEANUP: replaceSymbol removed (inherited from BaseParser)
  */
 import { Tree } from "web-tree-sitter";

package/dist/src/parsers/python.js

@@ -1,5 +1,5 @@
 /**
- * Python Parser - v3.4.0
+ * Python Parser - v3.4.1
  * CLEANUP: replaceSymbol removed (inherited from BaseParser)
  */
 import { BaseParser } from "./base.js";

package/dist/src/parsers/registry.d.ts

@@ -1,5 +1,5 @@
 /**
- * Parser Registry - v3.4.0
+ * Parser Registry - v3.4.1
  * Manages all language parsers
  */
 import { BaseParser } from "./base.js";

package/dist/src/parsers/registry.js

@@ -1,5 +1,5 @@
 /**
- * Parser Registry - v3.4.0
+ * Parser Registry - v3.4.1
  * Manages all language parsers
  */
 import { TypeScriptParser } from "./typescript.js";

package/dist/src/parsers/typescript.d.ts

@@ -1,5 +1,5 @@
 /**
- * TypeScript Parser - v3.4.0
+ * TypeScript Parser - v3.4.1
  * Tree-sitter based TS/JS parser
  * CLEANUP: replaceSymbol removed (inherited from BaseParser)
  */

package/dist/src/parsers/typescript.js

@@ -1,5 +1,5 @@
 /**
- * TypeScript Parser - v3.4.0
+ * TypeScript Parser - v3.4.1
  * Tree-sitter based TS/JS parser
  * CLEANUP: replaceSymbol removed (inherited from BaseParser)
  */

package/dist/src/utils/auditLogger.d.ts

@@ -1,5 +1,5 @@
 /**
- * Audit Logger - v3.4.0
+ * Audit Logger - v3.4.1
  * Comprehensive audit trail for all operations
  */
 export interface AuditEntry {

package/dist/src/utils/auditLogger.js

@@ -1,5 +1,5 @@
 /**
- * Audit Logger - v3.4.0
+ * Audit Logger - v3.4.1
  * Comprehensive audit trail for all operations
  */
 import * as fs from "node:fs/promises";

package/dist/src/utils/backupManager.d.ts

@@ -1,5 +1,5 @@
 /**
- * Backup Manager - v3.4.0
+ * Backup Manager - v3.4.1
  * Handles rolling backups for file modifications
  */
 export declare class BackupManager {