mcp-code-context 3.5.2 → 3.6.0

package/SECURITY.md

@@ -1,6 +1,6 @@
-# Security Policy - mcp-code-context v3.5.2
+# Security Policy - mcp-code-context v3.6.0
 
-## 🔒 Security Improvements in v3.5.2
+## 🔒 Security Improvements in v3.6.0
 
 This release addresses **all critical security vulnerabilities** from comprehensive adversarial audit, implements full middleware pipeline, and hardens all 13 tool handlers.
 
@@ -10,11 +10,11 @@ This release addresses **all critical security vulnerabilities** from comprehens
 
 ### 1. Path Traversal (HIGH)
 **CVSS Score**: 8.1 (High)
-**Status**: ✅ FIXED in v3.2.0, **hardened in v3.5.2**
+**Status**: ✅ FIXED in v3.2.0, **hardened in v3.6.0**
 
 **Description**: Path traversal check occurred BEFORE path normalization, allowing bypass with absolute paths.
 
-**Fix**: Check boundary AFTER `path.resolve()` normalization. In v3.5.2, **all 13 handlers** now require `projectRoot` and validate via `SecurityValidator`.
+**Fix**: Check boundary AFTER `path.resolve()` normalization. In v3.6.0, **all 13 handlers** now require `projectRoot` and validate via `SecurityValidator`.
 
 ---
 
@@ -40,7 +40,7 @@ This release addresses **all critical security vulnerabilities** from comprehens
 
 ### 4. ReDoS in searchPattern and readLines (MEDIUM)
 **CVSS Score**: 5.3 (Medium)
-**Status**: ✅ FIXED in v3.5.2
+**Status**: ✅ FIXED in v3.6.0
 
 **Description**: User-provided regex patterns could cause catastrophic backtracking.
 
@@ -58,7 +58,7 @@ This release addresses **all critical security vulnerabilities** from comprehens
 
 ### 6. extractSymbol API Mismatch (CRITICAL)
 **CVSS Score**: 9.0 (Critical)
-**Status**: ✅ FIXED in v3.5.2
+**Status**: ✅ FIXED in v3.6.0
 
 **Description**: `read.ts` passed `content` as `symbolName` and real `symbolName` as `className`. Symbol extraction was 100% broken.
 
@@ -68,7 +68,7 @@ This release addresses **all critical security vulnerabilities** from comprehens
 
 ### 7. Handlers Without Path Validation (HIGH)
 **CVSS Score**: 8.5 (High)
-**Status**: ✅ FIXED in v3.5.2
+**Status**: ✅ FIXED in v3.6.0
 
 **Description**: `readLines`, `searchPattern`, `analyzeImpact`, `getSemanticRepoMap` had no path boundary check.
 
@@ -78,7 +78,7 @@ This release addresses **all critical security vulnerabilities** from comprehens
 
 ### 8. renameSymbol Arbitrary Write (HIGH)
 **CVSS Score**: 8.0 (High)
-**Status**: ✅ FIXED in v3.5.2
+**Status**: ✅ FIXED in v3.6.0
 
 **Description**: `renameSymbol` wrote dependent files without SecurityValidator check, using non-atomic writes.
 
@@ -88,7 +88,7 @@ This release addresses **all critical security vulnerabilities** from comprehens
 
 ### 9. LCS Diff OOM (MEDIUM)
 **CVSS Score**: 5.0 (Medium)
-**Status**: ✅ FIXED in v3.5.2
+**Status**: ✅ FIXED in v3.6.0
 
 **Description**: LCS diff algorithm is O(n²) memory — 10K-line files cause OOM.
 
@@ -101,16 +101,16 @@ This release addresses **all critical security vulnerabilities** from comprehens
 ### Defense in Depth
 
 1. **Input Validation**
-   - Path boundary enforcement on ALL handlers (v3.5.2)
+   - Path boundary enforcement on ALL handlers (v3.6.0)
    - File size limits (10MB per file, 50MB total)
    - Regex sanitization + timeout (1s limit)
 
-2. **Two-Phase Write Workflow** (v3.5.2)
+2. **Two-Phase Write Workflow** (v3.6.0)
    - Phase 1: Dry-run returns diff + confirmation token
    - Phase 2: Apply with token (5-minute expiry)
    - Max 50 pending operations
 
-3. **Middleware Pipeline** (v3.5.2)
+3. **Middleware Pipeline** (v3.6.0)
    - Rate limiting (token bucket per operation)
    - File locking (prevents concurrent writes)
    - Audit logging (persistent `.mcp-audit-logs/`)
@@ -160,7 +160,7 @@ node dist-tests/tests/test-security.js
 - [x] Syntax validation
 - [x] Bounded memory in compress
 
-### v3.5.2 ✅
+### v3.6.0 ✅
 - [x] Regex timeout enforcement (safeRegexTest)
 - [x] Rate limiting (token bucket)
 - [x] File locking (concurrent write prevention)
@@ -174,4 +174,4 @@ node dist-tests/tests/test-security.js
 ---
 
 **Last Updated**: 2026-04-24
-**Version**: 3.5.2
+**Version**: 3.6.0

package/SPONSORS.md

@@ -0,0 +1,104 @@
+# Sponsors & Supporters
+
+Thank you to everyone who supports mcp-code-context! 🙏
+
+Your contributions help keep this project:
+- ✅ Free and open source
+- ✅ Actively maintained
+- ✅ Continuously improved
+
+---
+
+## 💎 Diamond Sponsors ($100+/month)
+
+*(No sponsors yet - be the first!)*
+
+---
+
+## 🥇 Gold Sponsors ($50-99/month)
+
+*(No sponsors yet)*
+
+---
+
+## 🥈 Silver Sponsors ($25-49/month)
+
+*(No sponsors yet)*
+
+---
+
+## 🥉 Bronze Supporters ($5-24/month)
+
+*(No sponsors yet)*
+
+---
+
+## ☕ One-Time Contributors
+
+*(No contributors yet - be the first!)*
+
+---
+
+## 🌟 How to Become a Sponsor
+
+See the [Support This Project](#support-this-project) section in the [README](README.md#support-this-project).
+
+### Available Options:
+
+**Monthly Memberships** (Ko-fi):
+- **$5/month** - Supporter: Name in SPONSORS.md + Early access to release notes
+- **$25/month** - Contributor: Priority support + Early access to features + Vote on roadmap
+- **$100/month** - Sponsor: Feature requests + Monthly consultation + Logo in README
+
+**One-Time Donations**:
+- **Ko-fi**: https://ko-fi.com/achatainga
+- **PayPal**: https://paypal.me/achatainga
+- **Binance (USDT)**: See README for addresses
+
+- **TRC20**: `0xa68d53f7853ce0175eb96aaad4a30c068ca96444`
+- **ERC20**: `0xa68d53f7853ce0175eb96aaad4a30c068ca96444`
+- **Binance Pay ID**: `367669339`
+
+---
+
+## 📊 Transparency Report
+
+### April 2025
+- **Monthly Donations**: $0
+- **One-Time Donations**: $0
+- **Total Supporters**: 0
+- **Expenses**: ~$20 (npm registry, testing credits, domain)
+- **Time Invested**: ~40 hours
+- **Net**: -$20
+
+*(Updated monthly)*
+
+---
+
+## 💼 Hire Me
+
+Need custom MCP tools or AI integrations?
+
+- **Rate**: $50-75/hour
+- **Email**: a.chataing.a@gmail.com
+- **Details**: [HIRE_ME.md](HIRE_ME.md)
+
+---
+
+## ❤️ Non-Financial Support
+
+Can't donate? No problem! You can still help:
+
+- ⭐ Star the repo on GitHub
+- 🐛 Report bugs or suggest features
+- 📝 Improve documentation
+- 🗣️ Share with others who might benefit
+- 💬 Help other users in discussions
+
+Every contribution matters, financial or not.
+
+---
+
+**Thank you for supporting open source! 🚀**
+
+*Built with ❤️ from Caracas, Venezuela 🇻🇪*

package/dist/src/core/cacheManager.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Cache Manager - v3.6.0
+ * WASM SQLite cache with debounced persistence
+ */
+export interface CachedFile {
+    filePath: string;
+    hash: string;
+    symbols: any[];
+    lastModified: number;
+    cachedAt: number;
+}
+export declare class CacheManager {
+    private db;
+    private dbPath;
+    private cacheDir;
+    private isDirty;
+    private persistTimer;
+    private initPromise;
+    private watcher;
+    private projectRoot;
+    constructor(projectRoot: string);
+    private init;
+    private initSchema;
+    get(filePath: string, currentHash: string): Promise<CachedFile | null>;
+    set(file: CachedFile): Promise<void>;
+    invalidate(filePath: string): Promise<void>;
+    clear(): Promise<void>;
+    getStats(): Promise<{
+        totalEntries: number;
+        totalSize: number;
+        oldestEntry: number | null;
+        newestEntry: number | null;
+    }>;
+    private schedulePersist;
+    private persist;
+    private persistSync;
+    close(): Promise<void>;
+    startWatcher(debounceMs?: number): void;
+    stopWatcher(): void;
+    getWatcherStatus(): {
+        isWatching: boolean;
+        watchedFiles: number;
+    };
+}

package/dist/src/core/cacheManager.js

@@ -0,0 +1,255 @@
+/**
+ * Cache Manager - v3.6.0
+ * WASM SQLite cache with debounced persistence
+ */
+import initSqlJs from 'sql.js';
+import * as fs from 'node:fs/promises';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
+import * as path from 'path';
+import * as crypto from 'node:crypto';
+import { tmpdir } from 'os';
+import { logger } from '../utils/logger.js';
+import { FileWatcher } from '../utils/fileWatcher.js';
+export class CacheManager {
+    db = null;
+    dbPath;
+    cacheDir;
+    isDirty = false;
+    persistTimer = null;
+    initPromise;
+    watcher = null;
+    projectRoot;
+    constructor(projectRoot) {
+        this.projectRoot = projectRoot;
+        const projectHash = crypto.createHash('md5')
+            .update(projectRoot)
+            .digest('hex')
+            .substring(0, 8);
+        this.cacheDir = path.join(tmpdir(), 'mcp-cache', projectHash);
+        this.dbPath = path.join(this.cacheDir, 'cache.db');
+        // Initialize on construction
+        this.initPromise = this.init();
+        // Persist on process exit
+        process.on('SIGINT', () => this.persistSync());
+        process.on('SIGTERM', () => this.persistSync());
+        process.on('exit', () => this.persistSync());
+    }
+    async init() {
+        try {
+            // Ensure cache directory exists (OS cleanup recovery)
+            if (!existsSync(this.cacheDir)) {
+                logger.warn({ cacheDir: this.cacheDir }, 'Cache directory deleted by OS, recreating');
+                mkdirSync(this.cacheDir, { recursive: true });
+            }
+            const SQL = await initSqlJs();
+            // Load existing database or create new
+            if (existsSync(this.dbPath)) {
+                const buffer = readFileSync(this.dbPath);
+                this.db = new SQL.Database(buffer);
+                logger.debug({ dbPath: this.dbPath }, 'Loaded existing cache database');
+            }
+            else {
+                this.db = new SQL.Database();
+                this.initSchema();
+                logger.info({ dbPath: this.dbPath }, 'Created new cache database');
+            }
+        }
+        catch (error) {
+            logger.error({ error }, 'Failed to initialize cache');
+            throw error;
+        }
+    }
+    initSchema() {
+        if (!this.db)
+            return;
+        this.db.run(`
+      CREATE TABLE IF NOT EXISTS file_cache (
+        file_path TEXT PRIMARY KEY,
+        hash TEXT NOT NULL,
+        symbols TEXT NOT NULL,
+        last_modified INTEGER NOT NULL,
+        cached_at INTEGER NOT NULL
+      )
+    `);
+        this.db.run(`
+      CREATE INDEX IF NOT EXISTS idx_cached_at ON file_cache(cached_at)
+    `);
+    }
+    async get(filePath, currentHash) {
+        await this.initPromise;
+        if (!this.db)
+            return null;
+        try {
+            const stmt = this.db.prepare('SELECT * FROM file_cache WHERE file_path = ? AND hash = ?');
+            stmt.bind([filePath, currentHash]);
+            if (stmt.step()) {
+                const row = stmt.getAsObject();
+                stmt.free();
+                return {
+                    filePath: row.file_path,
+                    hash: row.hash,
+                    symbols: JSON.parse(row.symbols),
+                    lastModified: row.last_modified,
+                    cachedAt: row.cached_at,
+                };
+            }
+            stmt.free();
+            return null;
+        }
+        catch (error) {
+            logger.error({ error, filePath }, 'Cache get failed');
+            return null;
+        }
+    }
+    async set(file) {
+        await this.initPromise;
+        if (!this.db)
+            return;
+        try {
+            this.db.run(`INSERT OR REPLACE INTO file_cache 
+         (file_path, hash, symbols, last_modified, cached_at) 
+         VALUES (?, ?, ?, ?, ?)`, [
+                file.filePath,
+                file.hash,
+                JSON.stringify(file.symbols),
+                file.lastModified,
+                file.cachedAt,
+            ]);
+            this.isDirty = true;
+            this.schedulePersist();
+        }
+        catch (error) {
+            logger.error({ error, filePath: file.filePath }, 'Cache set failed');
+        }
+    }
+    async invalidate(filePath) {
+        await this.initPromise;
+        if (!this.db)
+            return;
+        try {
+            this.db.run('DELETE FROM file_cache WHERE file_path = ?', [filePath]);
+            this.isDirty = true;
+            this.schedulePersist();
+        }
+        catch (error) {
+            logger.error({ error, filePath }, 'Cache invalidate failed');
+        }
+    }
+    async clear() {
+        await this.initPromise;
+        if (!this.db)
+            return;
+        try {
+            this.db.run('DELETE FROM file_cache');
+            this.isDirty = true;
+            await this.persist();
+            logger.info('Cache cleared');
+        }
+        catch (error) {
+            logger.error({ error }, 'Cache clear failed');
+        }
+    }
+    async getStats() {
+        await this.initPromise;
+        if (!this.db) {
+            return { totalEntries: 0, totalSize: 0, oldestEntry: null, newestEntry: null };
+        }
+        try {
+            const stmt = this.db.prepare(`
+        SELECT 
+          COUNT(*) as count,
+          MIN(cached_at) as oldest,
+          MAX(cached_at) as newest
+        FROM file_cache
+      `);
+            stmt.step();
+            const row = stmt.getAsObject();
+            stmt.free();
+            const totalSize = existsSync(this.dbPath)
+                ? (await fs.stat(this.dbPath)).size
+                : 0;
+            return {
+                totalEntries: row.count,
+                totalSize,
+                oldestEntry: row.oldest,
+                newestEntry: row.newest,
+            };
+        }
+        catch (error) {
+            logger.error({ error }, 'Failed to get cache stats');
+            return { totalEntries: 0, totalSize: 0, oldestEntry: null, newestEntry: null };
+        }
+    }
+    schedulePersist() {
+        if (this.persistTimer)
+            clearTimeout(this.persistTimer);
+        this.persistTimer = setTimeout(() => this.persist(), 5000);
+    }
+    async persist() {
+        if (!this.isDirty || !this.db)
+            return;
+        try {
+            const data = this.db.export();
+            const buffer = Buffer.from(data);
+            await fs.writeFile(this.dbPath, buffer);
+            this.isDirty = false;
+            logger.debug({ dbPath: this.dbPath, size: buffer.length }, 'Cache persisted');
+        }
+        catch (error) {
+            logger.error({ error }, 'Failed to persist cache');
+        }
+    }
+    persistSync() {
+        if (!this.isDirty || !this.db)
+            return;
+        try {
+            const data = this.db.export();
+            const buffer = Buffer.from(data);
+            writeFileSync(this.dbPath, buffer);
+            this.isDirty = false;
+        }
+        catch (error) {
+            console.error('Failed to persist cache on exit:', error);
+        }
+    }
+    async close() {
+        if (this.watcher) {
+            this.watcher.stop();
+            this.watcher = null;
+        }
+        if (this.persistTimer) {
+            clearTimeout(this.persistTimer);
+            this.persistTimer = null;
+        }
+        await this.persist();
+        if (this.db) {
+            this.db.close();
+            this.db = null;
+        }
+    }
+    startWatcher(debounceMs = 500) {
+        if (this.watcher) {
+            logger.warn({ projectRoot: this.projectRoot }, 'Watcher already started');
+            return;
+        }
+        this.watcher = new FileWatcher({
+            debounceMs,
+            ignored: [],
+            onFileChange: async (filePath) => {
+                await this.invalidate(filePath);
+                logger.debug({ filePath }, 'Cache invalidated by file watcher');
+            },
+        });
+        this.watcher.start(this.projectRoot);
+    }
+    stopWatcher() {
+        if (this.watcher) {
+            this.watcher.stop();
+            this.watcher = null;
+        }
+    }
+    getWatcherStatus() {
+        return this.watcher ? this.watcher.getStatus() : { isWatching: false, watchedFiles: 0 };
+    }
+}
+//# sourceMappingURL=cacheManager.js.map

package/dist/src/core/cacheManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cacheManager.js","sourceRoot":"","sources":["../../../src/core/cacheManager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,SAAuB,MAAM,QAAQ,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAUtD,MAAM,OAAO,YAAY;IACf,EAAE,GAAoB,IAAI,CAAC;IAC3B,MAAM,CAAS;IACf,QAAQ,CAAS;IACjB,OAAO,GAAG,KAAK,CAAC;IAChB,YAAY,GAA0B,IAAI,CAAC;IAC3C,WAAW,CAAgB;IAC3B,OAAO,GAAuB,IAAI,CAAC;IACnC,WAAW,CAAS;IAE5B,YAAY,WAAmB;QAC7B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;aACzC,MAAM,CAAC,WAAW,CAAC;aACnB,MAAM,CAAC,KAAK,CAAC;aACb,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAEnB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEnD,6BAA6B;QAC7B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE/B,0BAA0B;QAC1B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC;YACH,sDAAsD;YACtD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/B,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,2CAA2C,CAAC,CAAC;gBACtF,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;YAE9B,uCAAuC;YACvC,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzC,IAAI,CAAC,EAAE,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACnC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,gCAAgC,CAAC,CAAC;YAC1E,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,EAAE,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAC7B,IAAI,CAAC,UAAU,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,4BAA4B,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,4BAA4B,CAAC,CAAC;YACtD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO;QAErB,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;;;;;;;;KAQX,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;;KAEX,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAgB,EAAE,WAAmB;QAC7C,MAAM,IAAI,CAAC,WAAW,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAE1B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC1B,2DAA2D,CAC5D,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;YAEnC,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;gBAChB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;gBAEZ,OAAO;oBACL,QAAQ,EAAE,GAAG,CAAC,SAAmB;oBACjC,IAAI,EAAE,GAAG,CAAC,IAAc;oBACxB,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAiB,CAAC;oBAC1C,YAAY,EAAE,GAAG,CAAC,aAAuB;oBACzC,QAAQ,EAAE,GAAG,CAAC,SAAmB;iBAClC,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,kBAAkB,CAAC,CAAC;YACtD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAgB;QACxB,MAAM,IAAI,CAAC,WAAW,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO;QAErB,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,GAAG,CACT;;gCAEwB,EACxB;gBACE,IAAI,CAAC,QAAQ;gBACb,IAAI,CAAC,IAAI;gBACT,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;gBAC5B,IAAI,CAAC,YAAY;gBACjB,IAAI,CAAC,QAAQ;aACd,CACF,CAAC;YAEF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,kBAAkB,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAAgB;QAC/B,MAAM,IAAI,CAAC,WAAW,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO;QAErB,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,4CAA4C,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,yBAAyB,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,WAAW,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO;QAErB,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;YACtC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,oBAAoB,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QAMZ,MAAM,IAAI,CAAC,WAAW,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACjF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;;OAM5B,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;YAEZ,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;gBACvC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;gBACnC,CAAC,CAAC,CAAC,CAAC;YAEN,OAAO;gBACL,YAAY,EAAE,GAAG,CAAC,KAAe;gBACjC,SAAS;gBACT,WAAW,EAAE,GAAG,CAAC,MAAuB;gBACxC,WAAW,EAAE,GAAG,CAAC,MAAuB;aACzC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,2BAA2B,CAAC,CAAC;YACrD,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACjF,CAAC;IACH,CAAC;IAEO,eAAe;QACrB,IAAI,IAAI,CAAC,YAAY;YAAE,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO;QAEtC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,yBAAyB,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAEO,WAAW;QACjB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO;QAEtC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACnC,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAChC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IAED,YAAY,CAAC,aAAqB,GAAG;QACnC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,yBAAyB,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,IAAI,WAAW,CAAC;YAC7B,UAAU;YACV,OAAO,EAAE,EAAE;YACX,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBAC/B,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAChC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,EAAE,mCAAmC,CAAC,CAAC;YAClE,CAAC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAED,WAAW;QACT,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,CAAC;IACH,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAC1F,CAAC;CACF"}

package/dist/src/core/engine.d.ts

@@ -1,5 +1,5 @@
 /**
- * Core Engine - v3.5.2
+ * Core Engine - v3.6.0
  * ASYNC I/O: Migrated to fs.promises
  */
 import { Parser, Language } from "web-tree-sitter";

package/dist/src/core/engine.js

@@ -1,5 +1,5 @@
 /**
- * Core Engine - v3.5.2
+ * Core Engine - v3.6.0
  * ASYNC I/O: Migrated to fs.promises
  */
 import { Parser, Language } from "web-tree-sitter";

package/dist/src/core/validator.d.ts

@@ -1,5 +1,5 @@
 /**
- * Security Validator - v3.5.2
+ * Security Validator - v3.6.0
  * CRITICAL FIX: Path traversal check AFTER normalization
  */
 export interface ValidationResult {

package/dist/src/core/validator.js

@@ -1,5 +1,5 @@
 /**
- * Security Validator - v3.5.2
+ * Security Validator - v3.6.0
  * CRITICAL FIX: Path traversal check AFTER normalization
  */
 import * as path from "node:path";
@@ -12,18 +12,22 @@ export class SecurityValidator {
     async validateFilePath(filePath) {
         // Resolve FIRST, then check
         const resolved = path.resolve(filePath);
-        // CRITICAL: Check boundary AFTER normalization
-        if (!resolved.startsWith(this.projectRoot)) {
-            return { valid: false, error: "Path outside project boundary" };
+        // CRITICAL: Check boundary AFTER normalization (with path separator)
+        if (resolved !== this.projectRoot && !resolved.startsWith(this.projectRoot + path.sep)) {
+            return {
+                valid: false,
+                error: `Security: Path "${filePath}" is outside project boundary "${this.projectRoot}"`
+            };
         }
-        // NOTE: Path traversal already caught by startsWith check above.
-        // Removed dead code that duplicated the boundary check (unreachable condition).
         // Existence check
         try {
             await fs.access(resolved);
         }
         catch {
-            return { valid: false, error: "File does not exist" };
+            return {
+                valid: false,
+                error: `File not found: "${filePath}" (resolved to "${resolved}")`
+            };
         }
         return { valid: true, resolvedPath: resolved };
     }
@@ -31,12 +35,20 @@ export class SecurityValidator {
         try {
             const stat = await fs.stat(filePath);
             if (stat.size > maxSize) {
-                return { valid: false, error: `File too large: ${(stat.size / 1024 / 1024).toFixed(2)}MB` };
+                const sizeMB = (stat.size / 1024 / 1024).toFixed(2);
+                const maxMB = (maxSize / 1024 / 1024).toFixed(2);
+                return {
+                    valid: false,
+                    error: `File too large: ${sizeMB}MB exceeds maximum ${maxMB}MB`
+                };
             }
             return { valid: true };
         }
         catch (error) {
-            return { valid: false, error: `Failed to check file size: ${error}` };
+            return {
+                valid: false,
+                error: `Failed to check file size for "${filePath}": ${error instanceof Error ? error.message : String(error)}`
+            };
         }
     }
 }

package/dist/src/core/validator.js.map

@@ -1 +1 @@
-{"version":3,"file":"validator.js","sourceRoot":"","sources":["../../../src/core/validator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAQvC,MAAM,OAAO,iBAAiB;IACpB,WAAW,CAAS;IAE5B,YAAY,WAAmB;QAC7B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,QAAgB;QACrC,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAExC,+CAA+C;QAC/C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QAClE,CAAC;QAED,iEAAiE;QACjE,gFAAgF;QAEhF,kBAAkB;QAClB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QACxD,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,QAAgB,EAAE,UAAkB,EAAE,GAAG,IAAI,GAAG,IAAI;QACzE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,CAAC;gBACxB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9F,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,KAAK,EAAE,EAAE,CAAC;QACxE,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"validator.js","sourceRoot":"","sources":["../../../src/core/validator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAQvC,MAAM,OAAO,iBAAiB;IACpB,WAAW,CAAS;IAE5B,YAAY,WAAmB;QAC7B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,QAAgB;QACrC,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAExC,qEAAqE;QACrE,IAAI,QAAQ,KAAK,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvF,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,mBAAmB,QAAQ,kCAAkC,IAAI,CAAC,WAAW,GAAG;aACxF,CAAC;QACJ,CAAC;QAED,kBAAkB;QAClB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,oBAAoB,QAAQ,mBAAmB,QAAQ,IAAI;aACnE,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,QAAgB,EAAE,UAAkB,EAAE,GAAG,IAAI,GAAG,IAAI;QACzE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBACpD,MAAM,KAAK,GAAG,CAAC,OAAO,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBACjD,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,KAAK,EAAE,mBAAmB,MAAM,sBAAsB,KAAK,IAAI;iBAChE,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,kCAAkC,QAAQ,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAChH,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/src/index.d.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * mcp-code-context v3.5.2 - Tree-sitter WASM Edition
+ * mcp-code-context v3.6.0 - Tree-sitter WASM Edition
  *
  * Production-ready with:
  * - Tree-sitter WASM for 100% AST accuracy (TypeScript, Python, PHP, Dart)
@@ -8,5 +8,10 @@
  * - Two-phase write workflow (dry-run + confirmation token)
  * - Middleware pipeline: rate limiting, file locking, audit logging, telemetry
  * - Mandatory security boundaries on ALL handlers
+ * - Persistent WASM SQLite cache with <100ms hits
+ * - Structured logging with pino (JSON to stderr, MCP-safe)
+ * - File watcher with chokidar for auto cache invalidation
+ * - Fuzzy search with fuse.js + pagination
+ * - Token optimization: compact diffs, auto-optimize output
  */
 export {};