mcp-code-context 3.5.1 → 3.5.3

package/dist/src/operations/write.js

@@ -1,5 +1,5 @@
 /**
- * Write Operations - v3.5.1
+ * Write Operations - v3.5.3
  * FIXES: SecurityValidator in renameSymbol, atomic writes, AST-based positioning
  * CRITICAL: renameSymbol Phase 1 is now pure-functional (no disk writes)
  */
@@ -173,7 +173,7 @@ export async function removeSymbol(options) {
 }
 /**
  * Rename symbol using AST-aware replacement
- * v3.5.1 - CRITICAL FIX: Pure-functional Phase 1 (no writes to disk)
+ * v3.5.3 - CRITICAL FIX: Pure-functional Phase 1 (no writes to disk)
  * All changes are accumulated in pendingWrites for Phase 2 confirmation.
  */
 export async function renameSymbol(params) {

package/dist/src/parsers/base.d.ts

@@ -1,5 +1,5 @@
 /**
- * Base Parser - v3.5.1
+ * Base Parser - v3.5.3
  * Abstract base for all language parsers
  * IMPROVEMENT: replaceSymbol moved here using AST indices (eliminates indexOf fragility)
  */

package/dist/src/parsers/base.js

@@ -1,5 +1,5 @@
 /**
- * Base Parser - v3.5.1
+ * Base Parser - v3.5.3
  * Abstract base for all language parsers
  * IMPROVEMENT: replaceSymbol moved here using AST indices (eliminates indexOf fragility)
  */

package/dist/src/parsers/dartTreeSitter.d.ts

@@ -1,5 +1,5 @@
 /**
- * Dart Tree-sitter Parser - v3.5.1
+ * Dart Tree-sitter Parser - v3.5.3
  * 100% AST accuracy via WASM
  * CLEANUP: replaceSymbol removed (inherited from BaseParser)
  */

package/dist/src/parsers/dartTreeSitter.js

@@ -1,5 +1,5 @@
 /**
- * Dart Tree-sitter Parser - v3.5.1
+ * Dart Tree-sitter Parser - v3.5.3
  * 100% AST accuracy via WASM
  * CLEANUP: replaceSymbol removed (inherited from BaseParser)
  */

package/dist/src/parsers/php.d.ts

@@ -1,5 +1,5 @@
 /**
- * PHP Parser - v3.5.1
+ * PHP Parser - v3.5.3
  * CLEANUP: replaceSymbol removed (inherited from BaseParser)
  */
 import { Tree } from "web-tree-sitter";

package/dist/src/parsers/php.js

@@ -1,5 +1,5 @@
 /**
- * PHP Parser - v3.5.1
+ * PHP Parser - v3.5.3
  * CLEANUP: replaceSymbol removed (inherited from BaseParser)
  */
 import { BaseParser } from "./base.js";

package/dist/src/parsers/python.d.ts

@@ -1,5 +1,5 @@
 /**
- * Python Parser - v3.5.1
+ * Python Parser - v3.5.3
  * CLEANUP: replaceSymbol removed (inherited from BaseParser)
  */
 import { Tree } from "web-tree-sitter";

package/dist/src/parsers/python.js

@@ -1,5 +1,5 @@
 /**
- * Python Parser - v3.5.1
+ * Python Parser - v3.5.3
  * CLEANUP: replaceSymbol removed (inherited from BaseParser)
  */
 import { BaseParser } from "./base.js";

package/dist/src/parsers/registry.d.ts

@@ -1,5 +1,5 @@
 /**
- * Parser Registry - v3.5.1
+ * Parser Registry - v3.5.3
  * Manages all language parsers
  */
 import { BaseParser } from "./base.js";

package/dist/src/parsers/registry.js

@@ -1,5 +1,5 @@
 /**
- * Parser Registry - v3.5.1
+ * Parser Registry - v3.5.3
  * Manages all language parsers
  */
 import { TypeScriptParser } from "./typescript.js";

package/dist/src/parsers/typescript.d.ts

@@ -1,5 +1,5 @@
 /**
- * TypeScript Parser - v3.5.1
+ * TypeScript Parser - v3.5.3
  * Tree-sitter based TS/JS parser
  * CLEANUP: replaceSymbol removed (inherited from BaseParser)
  */

package/dist/src/parsers/typescript.js

@@ -1,5 +1,5 @@
 /**
- * TypeScript Parser - v3.5.1
+ * TypeScript Parser - v3.5.3
  * Tree-sitter based TS/JS parser
  * CLEANUP: replaceSymbol removed (inherited from BaseParser)
  */

package/dist/src/utils/auditLogger.d.ts

@@ -1,5 +1,5 @@
 /**
- * Audit Logger - v3.5.1
+ * Audit Logger - v3.5.3
  * Comprehensive audit trail for all operations
  */
 export interface AuditEntry {

package/dist/src/utils/auditLogger.js

@@ -1,5 +1,5 @@
 /**
- * Audit Logger - v3.5.1
+ * Audit Logger - v3.5.3
  * Comprehensive audit trail for all operations
  */
 import * as fs from "node:fs/promises";

package/dist/src/utils/backupManager.d.ts

@@ -1,5 +1,5 @@
 /**
- * Backup Manager - v3.5.1
+ * Backup Manager - v3.5.3
  * Handles rolling backups for file modifications
  */
 export declare class BackupManager {

package/dist/src/utils/backupManager.js

@@ -1,5 +1,5 @@
 /**
- * Backup Manager - v3.5.1
+ * Backup Manager - v3.5.3
  * Handles rolling backups for file modifications
  */
 import * as fs from "node:fs/promises";

package/dist/src/utils/constants.d.ts

@@ -1,6 +1,6 @@
 /**
  * Constants - Centralized configuration
- * v3.5.1
+ * v3.5.3
  */
 export declare const EXCLUDE_DIRS: string[];
 export declare const SUPPORTED_EXTENSIONS: string[];

package/dist/src/utils/constants.js

@@ -1,6 +1,6 @@
 /**
  * Constants - Centralized configuration
- * v3.5.1
+ * v3.5.3
  */
 export const EXCLUDE_DIRS = [
     "node_modules",

package/dist/src/utils/diff.d.ts

@@ -1,5 +1,5 @@
 /**
- * Diff Engine - v3.5.1
+ * Diff Engine - v3.5.3
  * LCS-based unified diff with memory safety cap
  */
 /**

package/dist/src/utils/diff.js

@@ -1,5 +1,5 @@
 /**
- * Diff Engine - v3.5.1
+ * Diff Engine - v3.5.3
  * LCS-based unified diff with memory safety cap
  */
 const MAX_DIFF_LINES = 5000;

package/dist/src/utils/fileLock.d.ts

@@ -1,5 +1,5 @@
 /**
- * File Lock Manager - v3.5.1
+ * File Lock Manager - v3.5.3
  * Prevents concurrent writes to same file
  */
 interface LockInfo {

package/dist/src/utils/fileLock.js

@@ -1,5 +1,5 @@
 /**
- * File Lock Manager - v3.5.1
+ * File Lock Manager - v3.5.3
  * Prevents concurrent writes to same file
  */
 export class FileLockManager {

package/dist/src/utils/rateLimiter.d.ts

@@ -1,5 +1,5 @@
 /**
- * Rate Limiter - v3.5.1
+ * Rate Limiter - v3.5.3
  * Token bucket algorithm for DoS protection
  */
 interface RateLimitConfig {

package/dist/src/utils/rateLimiter.js

@@ -1,5 +1,5 @@
 /**
- * Rate Limiter - v3.5.1
+ * Rate Limiter - v3.5.3
  * Token bucket algorithm for DoS protection
  */
 export class RateLimiter {

package/dist/src/utils/safeRegex.d.ts

@@ -1,5 +1,5 @@
 /**
- * Safe Regex - v3.5.1
+ * Safe Regex - v3.5.3
  * CRITICAL FIX: Real ReDoS protection via worker_threads
  *
  * Problem: setTimeout cannot interrupt regex.test() in Node.js single-threaded event loop.

package/dist/src/utils/safeRegex.js

@@ -1,5 +1,5 @@
 /**
- * Safe Regex - v3.5.1
+ * Safe Regex - v3.5.3
  * CRITICAL FIX: Real ReDoS protection via worker_threads
  *
  * Problem: setTimeout cannot interrupt regex.test() in Node.js single-threaded event loop.

package/dist/src/utils/streaming.d.ts

@@ -1,5 +1,5 @@
 /**
- * File Streaming - v3.5.1
+ * File Streaming - v3.5.3
  * Stream large files in chunks to avoid memory exhaustion
  */
 export interface StreamOptions {

package/dist/src/utils/streaming.js

@@ -1,5 +1,5 @@
 /**
- * File Streaming - v3.5.1
+ * File Streaming - v3.5.3
  * Stream large files in chunks to avoid memory exhaustion
  */
 import * as fs from "node:fs";

package/dist/src/utils/telemetry.d.ts

@@ -1,5 +1,5 @@
 /**
- * Telemetry - v3.5.1
+ * Telemetry - v3.5.3
  * Metrics collection and monitoring
  */
 export interface Metric {

package/dist/src/utils/telemetry.js

@@ -1,5 +1,5 @@
 /**
- * Telemetry - v3.5.1
+ * Telemetry - v3.5.3
  * Metrics collection and monitoring
  */
 export class TelemetryCollector {

package/llms.txt

@@ -1,8 +1,8 @@
-# mcp-code-context v3.5.1
+# mcp-code-context v3.5.3
 
 > A Model Context Protocol (MCP) server with **Tree-sitter WASM parsers** for 100% AST accuracy. Zero native dependencies. Production-ready with middleware pipeline.
 
-## What's New in v3.5.1
+## What's New in v3.5.3
 
 🔒 **Production Hardening**:
 - ✅ Two-phase write workflow (dry-run + confirmation token)
@@ -142,13 +142,13 @@ This MCP server solves two problems:
 - `steps` (optional): Number of versions to go back (1-5, default: 1).
 **What it does:** Reverts the file to the state it was in before the last 1-5 modifications.
 
-### Write Tools (v3.5.1 Two-Phase Workflow)
+### Write Tools (v3.5.3 Two-Phase Workflow)
 
 All write tools follow a **Two-Phase Workflow**:
 1. **Phase 1 (Preview)**: Call without a token to get a unified `diff` and a `confirmationToken`.
 2. **Phase 2 (Apply)**: Call with `confirmationToken` and `confirm: true` to apply the changes.
 
-**Important Notes (v3.5.1):**
+**Important Notes (v3.5.3):**
 - ✅ **Windows CRLF Support**: Fully resolved. All operations work correctly on Windows files with CRLF line endings.
 - ✅ **Parameter Brace Handling**: Methods with braces in parameters (e.g., `{int? cart}`) are now handled correctly.
 
@@ -236,7 +236,7 @@ All write tools follow a **Two-Phase Workflow**:
 5. **Phase 2: Apply Edit** → Verify the diff, then call with the token and `confirm: true`.
 6. **Recovery** → Use `rollback_file` if needed.
 
-### Additional Tools (v3.5.1)
+### Additional Tools (v3.5.3)
 
 #### 11. `parse_file`
 **Purpose:** Parse a file using Tree-sitter and extract all symbols.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-code-context",
-  "version": "3.5.1",
+  "version": "3.5.3",
   "description": "Powerful MCP server with Tree-sitter WASM parsers for 100% AST accuracy. Zero native dependencies. Production-ready with streaming, telemetry, audit logging, rate limiting, file locking, and ReDoS protection. Supports TypeScript, JavaScript, PHP, Dart, and Python.",
   "type": "module",
   "main": "dist/src/index.js",
@@ -36,12 +36,27 @@
     "dart",
     "python"
   ],
-  "author": "",
+  "author": "Alejandro Chataing <a.chataing.a@gmail.com>",
   "license": "MIT",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/achatainga/mcp-code-context.git"
   },
+  "funding": [
+    {
+      "type": "ko-fi",
+      "url": "https://ko-fi.com/achatainga"
+    },
+    {
+      "type": "paypal",
+      "url": "https://paypal.me/achatainga"
+    }
+  ],
+  "homepage": "https://github.com/achatainga/mcp-code-context#readme",
+  "bugs": {
+    "url": "https://github.com/achatainga/mcp-code-context/issues",
+    "email": "a.chataing.a@gmail.com"
+  },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.12.0",
     "ignore": "^6.0.2",

package/CHANGELOG_v3.2.0.md

@@ -1,196 +0,0 @@
-# Changelog v3.2.0 - Security & Validation Hardening
-
-## 🔒 CRITICAL Security Fixes
-
-### Path Traversal Protection (CVE-LEVEL)
-**Impact**: HIGH - Could allow access to files outside project boundary
-**Fix**: Moved path traversal check AFTER `path.resolve()` normalization
-```typescript
-// BEFORE (vulnerable):
-if (filePath.includes("..")) return { valid: false };
-const resolved = path.resolve(filePath);
-
-// AFTER (secure):
-const resolved = path.resolve(filePath);
-if (!resolved.startsWith(this.projectRoot)) return { valid: false };
-```
-
-### Regex Injection in renameSymbol (CVE-LEVEL)
-**Impact**: HIGH - Could corrupt entire codebase with malicious symbol names
-**Fix**: Sanitize all regex inputs before use
-```typescript
-// BEFORE (vulnerable):
-const regex = new RegExp(`\\b${oldName}\\b`, "g");
-
-// AFTER (secure):
-const sanitized = oldName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-const regex = new RegExp(`\\b${sanitized}\\b`, "g");
-```
-
-### Syntax Validation Post-Write
-**Impact**: CRITICAL - Prevented silent code corruption
-**Fix**: All write operations now validate syntax before returning
-```typescript
-const syntaxCheck = validateSyntax(result, parser);
-if (!syntaxCheck.valid) {
-  return { success: false, error: syntaxCheck.error };
-}
-```
-
----
-
-## ✨ Major Improvements
-
-### 1. AST-Aware insertCode
-**Before**: Used `indexOf()` to find anchor (could match strings/comments)
-**After**: Uses AST `node.startIndex/endIndex` for precise positioning
-```typescript
-// Find anchor using AST
-const symbols = parser.findSymbols(tree);
-const anchorNode = symbols.find(s => s.name === anchorSymbol);
-insertIndex = anchorNode.startIndex; // Exact AST position
-```
-
-### 2. Improved renameSymbol
-- AST-based symbol location (not blind regex)
-- Only renames in import statements (not strings/comments)
-- Sanitized regex patterns
-- Better error messages
-
-### 3. Async I/O Migration
-**Before**: `fs.readFileSync()` blocked event loop
-**After**: `await fs.readFile()` non-blocking
-```typescript
-// engine.ts:60
-const wasmBuffer = await fs.readFile(wasmPath); // Was: fs.readFileSync
-```
-
-### 4. Centralized Constants
-**Before**: Hardcoded in 5+ files
-```typescript
-const excludeDirs = ["node_modules", "dist", "build", ".git"];
-```
-**After**: Single source of truth
-```typescript
-import { EXCLUDE_DIRS, SUPPORTED_EXTENSIONS } from "../utils/constants.js";
-```
-
-### 5. LCS-Based Diff Generation
-**Before**: Simple line-by-line (O(n))
-**After**: Longest Common Subsequence algorithm (O(n*m))
-- Cleaner diffs with proper context
-- Better readability
-- Configurable context lines
-
-### 6. Size Limits in compress
-**Before**: Only file count limit (500)
-**After**: Total size limit (50MB) + per-file check
-```typescript
-if (totalSize + stat.size > MAX_TOTAL_SIZE_BYTES) break;
-```
-
----
-
-## 🧪 Testing
-
-### New Security Test Suite
-- ✅ Path traversal protection (4 tests)
-- ✅ ReDoS detection (4 patterns)
-- ✅ Regex injection protection (4 tests)
-- ✅ File size validation (2 tests)
-
-**Coverage**: 100% on security-critical paths
-
-### Existing Tests
-- ✅ 47/47 parser tests passing
-- ✅ TypeScript, Python, PHP, Dart parsers validated
-- ✅ Symbol extraction, replacement, insertion tested
-
----
-
-## 📊 Metrics Improvement
-
-| Metric | v3.1.0 | v3.2.0 | Change |
-|--------|--------|--------|--------|
-| Security | 5.0/10 | 9.5/10 | +4.5 ✅ |
-| Code Quality | 6.5/10 | 8.5/10 | +2.0 ✅ |
-| Maintainability | 7.0/10 | 8.5/10 | +1.5 ✅ |
-| **Overall** | **6.2/10** | **8.8/10** | **+2.6** |
-
----
-
-## 🚨 Breaking Changes
-
-### Syntax Validation
-All write operations now validate syntax before returning. Invalid code will be rejected:
-```typescript
-// This will now fail if newContent has syntax errors:
-const result = await replaceSymbol({ symbolName, newContent, ... });
-```
-
-**Migration**: Ensure all generated code is syntactically valid before calling write operations.
-
----
-
-## 📝 Files Changed
-
-### Core
-- `src/core/validator.ts` - Path traversal fix
-- `src/core/engine.ts` - Async I/O migration
-
-### Operations
-- `src/operations/write.ts` - Syntax validation, AST positioning, sanitization
-- `src/operations/compress.ts` - Size limits
-- `src/operations/read.ts` - Centralized constants
-
-### Utils
-- `src/utils/constants.ts` - NEW: Centralized configuration
-- `src/utils/diff.ts` - NEW: LCS-based diff
-
-### Tests
-- `tests/test-security.ts` - NEW: Security test suite
-
----
-
-## 🔄 Upgrade Guide
-
-### From v3.1.0 to v3.2.0
-
-1. **No API changes** - Fully backward compatible
-2. **Stricter validation** - Some previously accepted (but invalid) code will now be rejected
-3. **Better error messages** - Syntax errors now caught before file write
-
-### Recommended Actions
-1. Run existing tests to ensure compatibility
-2. Review any custom write operations for syntax validity
-3. Update error handling to catch new validation errors
-
----
-
-## 🎯 Next Steps (v3.3.0)
-
-- [ ] Rate limiting for DoS protection
-- [ ] File locking for concurrent writes
-- [ ] Streaming for files >10MB
-- [ ] LSP integration for advanced refactoring
-- [ ] Telemetry and observability
-
----
-
-## 👥 Contributors
-
-- Security audit and fixes
-- Performance optimizations
-- Test coverage improvements
-
----
-
-## 📄 License
-
-MIT
-
----
-
-**Full Diff**: v3.1.0...v3.2.0
-**Release Date**: 2026-04-24
-**Stability**: Production-ready