mcp-code-context 3.5.2 → 3.5.3

package/dist/src/utils/telemetry.d.ts

@@ -1,5 +1,5 @@
 /**
- * Telemetry - v3.5.2
+ * Telemetry - v3.5.3
  * Metrics collection and monitoring
  */
 export interface Metric {

package/dist/src/utils/telemetry.js

@@ -1,5 +1,5 @@
 /**
- * Telemetry - v3.5.2
+ * Telemetry - v3.5.3
  * Metrics collection and monitoring
  */
 export class TelemetryCollector {

package/llms.txt

@@ -1,8 +1,8 @@
-# mcp-code-context v3.5.2
+# mcp-code-context v3.5.3
 
 > A Model Context Protocol (MCP) server with **Tree-sitter WASM parsers** for 100% AST accuracy. Zero native dependencies. Production-ready with middleware pipeline.
 
-## What's New in v3.5.2
+## What's New in v3.5.3
 
 🔒 **Production Hardening**:
 - ✅ Two-phase write workflow (dry-run + confirmation token)
@@ -142,13 +142,13 @@ This MCP server solves two problems:
 - `steps` (optional): Number of versions to go back (1-5, default: 1).
 **What it does:** Reverts the file to the state it was in before the last 1-5 modifications.
 
-### Write Tools (v3.5.2 Two-Phase Workflow)
+### Write Tools (v3.5.3 Two-Phase Workflow)
 
 All write tools follow a **Two-Phase Workflow**:
 1. **Phase 1 (Preview)**: Call without a token to get a unified `diff` and a `confirmationToken`.
 2. **Phase 2 (Apply)**: Call with `confirmationToken` and `confirm: true` to apply the changes.
 
-**Important Notes (v3.5.2):**
+**Important Notes (v3.5.3):**
 - ✅ **Windows CRLF Support**: Fully resolved. All operations work correctly on Windows files with CRLF line endings.
 - ✅ **Parameter Brace Handling**: Methods with braces in parameters (e.g., `{int? cart}`) are now handled correctly.
 
@@ -236,7 +236,7 @@ All write tools follow a **Two-Phase Workflow**:
 5. **Phase 2: Apply Edit** → Verify the diff, then call with the token and `confirm: true`.
 6. **Recovery** → Use `rollback_file` if needed.
 
-### Additional Tools (v3.5.2)
+### Additional Tools (v3.5.3)
 
 #### 11. `parse_file`
 **Purpose:** Parse a file using Tree-sitter and extract all symbols.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-code-context",
-  "version": "3.5.2",
+  "version": "3.5.3",
   "description": "Powerful MCP server with Tree-sitter WASM parsers for 100% AST accuracy. Zero native dependencies. Production-ready with streaming, telemetry, audit logging, rate limiting, file locking, and ReDoS protection. Supports TypeScript, JavaScript, PHP, Dart, and Python.",
   "type": "module",
   "main": "dist/src/index.js",
@@ -36,12 +36,27 @@
     "dart",
     "python"
   ],
-  "author": "",
+  "author": "Alejandro Chataing <a.chataing.a@gmail.com>",
   "license": "MIT",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/achatainga/mcp-code-context.git"
   },
+  "funding": [
+    {
+      "type": "ko-fi",
+      "url": "https://ko-fi.com/achatainga"
+    },
+    {
+      "type": "paypal",
+      "url": "https://paypal.me/achatainga"
+    }
+  ],
+  "homepage": "https://github.com/achatainga/mcp-code-context#readme",
+  "bugs": {
+    "url": "https://github.com/achatainga/mcp-code-context/issues",
+    "email": "a.chataing.a@gmail.com"
+  },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.12.0",
     "ignore": "^6.0.2",

package/CHANGELOG_v3.2.0.md

@@ -1,196 +0,0 @@
-# Changelog v3.2.0 - Security & Validation Hardening
-
-## 🔒 CRITICAL Security Fixes
-
-### Path Traversal Protection (CVE-LEVEL)
-**Impact**: HIGH - Could allow access to files outside project boundary
-**Fix**: Moved path traversal check AFTER `path.resolve()` normalization
-```typescript
-// BEFORE (vulnerable):
-if (filePath.includes("..")) return { valid: false };
-const resolved = path.resolve(filePath);
-
-// AFTER (secure):
-const resolved = path.resolve(filePath);
-if (!resolved.startsWith(this.projectRoot)) return { valid: false };
-```
-
-### Regex Injection in renameSymbol (CVE-LEVEL)
-**Impact**: HIGH - Could corrupt entire codebase with malicious symbol names
-**Fix**: Sanitize all regex inputs before use
-```typescript
-// BEFORE (vulnerable):
-const regex = new RegExp(`\\b${oldName}\\b`, "g");
-
-// AFTER (secure):
-const sanitized = oldName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-const regex = new RegExp(`\\b${sanitized}\\b`, "g");
-```
-
-### Syntax Validation Post-Write
-**Impact**: CRITICAL - Prevented silent code corruption
-**Fix**: All write operations now validate syntax before returning
-```typescript
-const syntaxCheck = validateSyntax(result, parser);
-if (!syntaxCheck.valid) {
-  return { success: false, error: syntaxCheck.error };
-}
-```
-
----
-
-## ✨ Major Improvements
-
-### 1. AST-Aware insertCode
-**Before**: Used `indexOf()` to find anchor (could match strings/comments)
-**After**: Uses AST `node.startIndex/endIndex` for precise positioning
-```typescript
-// Find anchor using AST
-const symbols = parser.findSymbols(tree);
-const anchorNode = symbols.find(s => s.name === anchorSymbol);
-insertIndex = anchorNode.startIndex; // Exact AST position
-```
-
-### 2. Improved renameSymbol
-- AST-based symbol location (not blind regex)
-- Only renames in import statements (not strings/comments)
-- Sanitized regex patterns
-- Better error messages
-
-### 3. Async I/O Migration
-**Before**: `fs.readFileSync()` blocked event loop
-**After**: `await fs.readFile()` non-blocking
-```typescript
-// engine.ts:60
-const wasmBuffer = await fs.readFile(wasmPath); // Was: fs.readFileSync
-```
-
-### 4. Centralized Constants
-**Before**: Hardcoded in 5+ files
-```typescript
-const excludeDirs = ["node_modules", "dist", "build", ".git"];
-```
-**After**: Single source of truth
-```typescript
-import { EXCLUDE_DIRS, SUPPORTED_EXTENSIONS } from "../utils/constants.js";
-```
-
-### 5. LCS-Based Diff Generation
-**Before**: Simple line-by-line (O(n))
-**After**: Longest Common Subsequence algorithm (O(n*m))
-- Cleaner diffs with proper context
-- Better readability
-- Configurable context lines
-
-### 6. Size Limits in compress
-**Before**: Only file count limit (500)
-**After**: Total size limit (50MB) + per-file check
-```typescript
-if (totalSize + stat.size > MAX_TOTAL_SIZE_BYTES) break;
-```
-
----
-
-## 🧪 Testing
-
-### New Security Test Suite
-- ✅ Path traversal protection (4 tests)
-- ✅ ReDoS detection (4 patterns)
-- ✅ Regex injection protection (4 tests)
-- ✅ File size validation (2 tests)
-
-**Coverage**: 100% on security-critical paths
-
-### Existing Tests
-- ✅ 47/47 parser tests passing
-- ✅ TypeScript, Python, PHP, Dart parsers validated
-- ✅ Symbol extraction, replacement, insertion tested
-
----
-
-## 📊 Metrics Improvement
-
-| Metric | v3.1.0 | v3.2.0 | Change |
-|--------|--------|--------|--------|
-| Security | 5.0/10 | 9.5/10 | +4.5 ✅ |
-| Code Quality | 6.5/10 | 8.5/10 | +2.0 ✅ |
-| Maintainability | 7.0/10 | 8.5/10 | +1.5 ✅ |
-| **Overall** | **6.2/10** | **8.8/10** | **+2.6** |
-
----
-
-## 🚨 Breaking Changes
-
-### Syntax Validation
-All write operations now validate syntax before returning. Invalid code will be rejected:
-```typescript
-// This will now fail if newContent has syntax errors:
-const result = await replaceSymbol({ symbolName, newContent, ... });
-```
-
-**Migration**: Ensure all generated code is syntactically valid before calling write operations.
-
----
-
-## 📝 Files Changed
-
-### Core
-- `src/core/validator.ts` - Path traversal fix
-- `src/core/engine.ts` - Async I/O migration
-
-### Operations
-- `src/operations/write.ts` - Syntax validation, AST positioning, sanitization
-- `src/operations/compress.ts` - Size limits
-- `src/operations/read.ts` - Centralized constants
-
-### Utils
-- `src/utils/constants.ts` - NEW: Centralized configuration
-- `src/utils/diff.ts` - NEW: LCS-based diff
-
-### Tests
-- `tests/test-security.ts` - NEW: Security test suite
-
----
-
-## 🔄 Upgrade Guide
-
-### From v3.1.0 to v3.2.0
-
-1. **No API changes** - Fully backward compatible
-2. **Stricter validation** - Some previously accepted (but invalid) code will now be rejected
-3. **Better error messages** - Syntax errors now caught before file write
-
-### Recommended Actions
-1. Run existing tests to ensure compatibility
-2. Review any custom write operations for syntax validity
-3. Update error handling to catch new validation errors
-
----
-
-## 🎯 Next Steps (v3.3.0)
-
-- [ ] Rate limiting for DoS protection
-- [ ] File locking for concurrent writes
-- [ ] Streaming for files >10MB
-- [ ] LSP integration for advanced refactoring
-- [ ] Telemetry and observability
-
----
-
-## 👥 Contributors
-
-- Security audit and fixes
-- Performance optimizations
-- Test coverage improvements
-
----
-
-## 📄 License
-
-MIT
-
----
-
-**Full Diff**: v3.1.0...v3.2.0
-**Release Date**: 2026-04-24
-**Stability**: Production-ready

package/CHANGELOG_v3.3.0.md

@@ -1,266 +0,0 @@
-# Changelog v3.3.0 - Production Hardening
-
-## 🚀 Major Features
-
-### 1. Rate Limiting (DoS Protection)
-**Token Bucket Algorithm** - Prevents abuse and resource exhaustion
-
-```typescript
-import { RateLimiter, OPERATION_COSTS } from "./utils/rateLimiter.js";
-
-const limiter = new RateLimiter({
-  maxTokens: 100,
-  refillRate: 10, // tokens per second
-  refillInterval: 1000 // ms
-});
-
-// Check if request allowed
-const result = await limiter.checkLimit("client-id", OPERATION_COSTS.get_semantic_repo_map);
-if (!result.allowed) {
-  console.log(`Rate limited. Retry after ${result.retryAfter}ms`);
-}
-```
-
-**Operation Costs**:
-- `get_semantic_repo_map`: 50 tokens (expensive)
-- `rename_symbol`: 40 tokens (cross-file)
-- `search_code_pattern`: 30 tokens
-- `analyze_impact`: 20 tokens
-- `replace_symbol`: 10 tokens
-- `read_file_surgical`: 5 tokens
-- `read_file_lines`: 2 tokens (cheap)
-
-**Features**:
-- ✅ Per-client token buckets
-- ✅ Automatic token refill
-- ✅ Configurable rates
-- ✅ Retry-after calculation
-- ✅ Inactive client cleanup (5min)
-
----
-
-### 2. File Locking (Concurrent Write Protection)
-**Prevents race conditions** when multiple clients edit same file
-
-```typescript
-import { FileLockManager } from "./utils/fileLock.js";
-
-const lockManager = new FileLockManager(30000); // 30s timeout
-
-// Acquire lock
-const result = await lockManager.acquireLock(
-  "/path/to/file.ts",
-  "client-id",
-  "write_operation"
-);
-
-if (result.acquired) {
-  // Perform write
-  await writeFile(...);
-  
-  // Release lock
-  lockManager.releaseLock("/path/to/file.ts", "client-id");
-} else {
-  console.log(`File locked by ${result.lockedBy}`);
-}
-```
-
-**Features**:
-- ✅ Per-file locks
-- ✅ Auto-release after timeout
-- ✅ Path normalization (Windows/Unix)
-- ✅ Force release (admin)
-- ✅ Multi-client support
-- ✅ Lock info tracking
-
----
-
-### 3. ReDoS Protection (Regex Timeout)
-**Prevents catastrophic backtracking** in user-provided regex
-
-```typescript
-import { safeRegexTest, validateRegexPattern } from "./utils/safeRegex.js";
-
-// Validate pattern
-const validation = validateRegexPattern("(a+)+");
-if (!validation.safe) {
-  console.log("Unsafe pattern:", validation.issues);
-  // ["Nested quantifiers (a+)+ detected"]
-}
-
-// Execute with timeout
-const result = await safeRegexTest(/(a+)+/, "aaaaaX", 1000);
-if (result.timedOut) {
-  console.log("Regex timeout - potential ReDoS");
-}
-```
-
-**Detected Patterns**:
-- `(a+)+` - Nested quantifiers
-- `(a*)*` - Nested quantifiers
-- `(a|b)*` - Alternation with star
-- `{1000,}` - Excessive repetition
-- Patterns >500 chars
-
-**Integration**:
-- ✅ `searchPattern` validates regex before execution
-- ✅ Async regex testing with timeout
-- ✅ Automatic rejection of unsafe patterns
-
----
-
-## 🔧 Improvements
-
-### searchPattern Enhanced
-**Before**:
-```typescript
-// Could hang on ReDoS patterns
-const regex = new RegExp(userPattern, "g");
-regex.test(line); // No timeout
-```
-
-**After**:
-```typescript
-// Validates pattern first
-const validation = validateRegexPattern(params.pattern);
-if (!validation.safe) {
-  return { success: false, error: "Unsafe regex" };
-}
-
-// Executes with timeout
-const result = await safeRegexTest(regex, line, 1000);
-if (result.timedOut) {
-  console.warn("Regex timeout");
-}
-```
-
----
-
-## 🧪 Testing
-
-### New Test Suites
-
-**Rate Limiter** (15 tests):
-- ✅ Basic rate limiting
-- ✅ Token refill
-- ✅ Multiple clients
-- ✅ Operation costs
-- ✅ Reset functionality
-
-**File Locking** (13 tests):
-- ✅ Basic locking
-- ✅ Lock timeout
-- ✅ Multiple files
-- ✅ Path normalization
-- ✅ Force release
-
-**Total**: 75 tests passing (47 parsers + 14 security + 14 v3.3.0)
-
----
-
-## 📊 Performance Impact
-
-| Feature | Overhead | Benefit |
-|---------|----------|---------|
-| Rate Limiter | ~0.1ms per request | Prevents DoS |
-| File Locking | ~0.2ms per write | Prevents corruption |
-| Regex Validation | ~1ms per pattern | Prevents ReDoS |
-
-**Overall**: <1ms overhead for 99% of operations
-
----
-
-## 🚨 Breaking Changes
-
-### searchPattern Validation
-**Before**: Accepted any regex pattern
-**After**: Rejects unsafe patterns
-
-```typescript
-// This will now fail:
-await searchPattern({ pattern: "(a+)+" }); 
-// Error: "Unsafe regex pattern: Nested quantifiers (a+)+ detected"
-
-// Workaround: Use simpler pattern
-await searchPattern({ pattern: "a+" }); // OK
-```
-
----
-
-## 🔄 Migration Guide
-
-### From v3.2.0 to v3.3.0
-
-**No API changes** - Fully backward compatible
-
-**Optional Integrations**:
-
-1. **Add Rate Limiting** (recommended):
-```typescript
-import { RateLimiter, OPERATION_COSTS } from "./utils/rateLimiter.js";
-
-const limiter = new RateLimiter();
-const result = await limiter.checkLimit(clientId, OPERATION_COSTS[toolName]);
-if (!result.allowed) {
-  return { error: `Rate limited. Retry after ${result.retryAfter}ms` };
-}
-```
-
-2. **Add File Locking** (recommended for writes):
-```typescript
-import { globalLockManager } from "./utils/fileLock.js";
-
-const lock = await globalLockManager.acquireLock(filePath, clientId, "write");
-if (!lock.acquired) {
-  return { error: `File locked by ${lock.lockedBy}` };
-}
-
-try {
-  await writeOperation();
-} finally {
-  globalLockManager.releaseLock(filePath, clientId);
-}
-```
-
----
-
-## 📈 Metrics Improvement
-
-| Metric | v3.2.0 | v3.3.0 | Change |
-|--------|--------|--------|--------|
-| Security | 9.5/10 | 10.0/10 | +0.5 ✅ |
-| Scalability | 6.5/10 | 9.0/10 | +2.5 ✅ |
-| Reliability | 8.0/10 | 9.5/10 | +1.5 ✅ |
-| **Overall** | **8.3/10** | **9.5/10** | **+1.2** |
-
----
-
-## 🎯 Production Readiness
-
-### Checklist
-- ✅ DoS protection (rate limiting)
-- ✅ Race condition prevention (file locking)
-- ✅ ReDoS protection (regex timeout)
-- ✅ Path traversal protection
-- ✅ Syntax validation
-- ✅ Comprehensive testing (75 tests)
-- ✅ Security documentation
-- ✅ Performance optimized
-
-**Status**: PRODUCTION-READY ✅
-
----
-
-## 🚀 Next Steps (v3.5.2)
-
-- [ ] Streaming for files >10MB
-- [ ] Telemetry and observability
-- [ ] Audit logging
-- [ ] Permission system
-- [ ] LSP integration
-
----
-
-**Full Diff**: v3.2.0...v3.3.0
-**Release Date**: 2026-04-24
-**Stability**: Production-ready