md-feedback 1.1.1 → 1.2.1

package/README.md

@@ -52,6 +52,11 @@ That's it. No install, no setup — `npx` handles everything.
 | `batch_apply` | Apply multiple operations in a single transaction |
 | `get_memo_changes` | Get implementation history and progress for a memo |
 
+## Safety & Reliability
+
+- **File mutex** — concurrent MCP tool calls are serialized per-file, preventing data corruption
+- **Improved anchor matching** — annotations find their intended location more reliably, even with multiple matches
+
 ## How It Works
 
 1. You annotate a markdown plan in the [VS Code extension](https://marketplace.visualstudio.com/items?itemName=yeominux.md-feedback-vscode)

package/dist/mcp-server.js

@@ -3224,8 +3224,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path2) {
-      let input = path2;
+    function removeDotSegments(path3) {
+      let input = path3;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -3424,8 +3424,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path2, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path2 && path2 !== "/" ? path2 : void 0;
+        const [path3, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path3 && path3 !== "/" ? path3 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -7276,8 +7276,8 @@ function getErrorMap() {
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path2, errorMaps, issueData } = params;
-  const fullPath = [...path2, ...issueData.path || []];
+  const { data, path: path3, errorMaps, issueData } = params;
+  const fullPath = [...path3, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -7393,11 +7393,11 @@ var errorUtil;
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path2, key) {
+  constructor(parent, value, path3, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path2;
+    this._path = path3;
     this._key = key;
   }
   get path() {
@@ -11035,10 +11035,10 @@ function assignProp(target, prop, value) {
     configurable: true
   });
 }
-function getElementAtPath(obj, path2) {
-  if (!path2)
+function getElementAtPath(obj, path3) {
+  if (!path3)
     return obj;
-  return path2.reduce((acc, key) => acc?.[key], obj);
+  return path3.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -11358,11 +11358,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path2, issues) {
+function prefixIssues(path3, issues) {
   return issues.map((iss) => {
     var _a;
     (_a = iss).path ?? (_a.path = []);
-    iss.path.unshift(path2);
+    iss.path.unshift(path3);
     return iss;
   });
 }
@@ -20848,6 +20848,7 @@ var StdioServerTransport = class {
 // src/file-ops.ts
 var import_fs = require("fs");
 var import_path = require("path");
+var import_node_crypto = require("node:crypto");
 function resolvePath(filePath) {
   return (0, import_path.isAbsolute)(filePath) ? filePath : (0, import_path.resolve)(process.cwd(), filePath);
 }
@@ -20864,9 +20865,16 @@ function readMarkdownFile(filePath) {
 }
 function writeMarkdownFile(filePath, content) {
   const resolved = resolvePath(filePath);
+  const dir = (0, import_path.dirname)(resolved);
+  const tmpPath = (0, import_path.join)(dir, `.mf-tmp-${(0, import_node_crypto.randomBytes)(6).toString("hex")}`);
   try {
-    (0, import_fs.writeFileSync)(resolved, content, "utf-8");
+    (0, import_fs.writeFileSync)(tmpPath, content, "utf-8");
+    (0, import_fs.renameSync)(tmpPath, resolved);
   } catch (err) {
+    try {
+      (0, import_fs.unlinkSync)(tmpPath);
+    } catch {
+    }
     throw new Error(`Cannot write file ${resolved}: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
@@ -20887,6 +20895,13 @@ function writeSnapshot(mdFilePath, content) {
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const snapshotPath = (0, import_path.join)(snapshotsDir, `snapshot-${ts}.md`);
   (0, import_fs.writeFileSync)(snapshotPath, content, "utf-8");
+  const files = (0, import_fs.readdirSync)(snapshotsDir).filter((f) => f.startsWith("snapshot-")).sort();
+  while (files.length > 20) {
+    try {
+      (0, import_fs.unlinkSync)((0, import_path.join)(snapshotsDir, files.shift()));
+    } catch {
+    }
+  }
   return snapshotPath;
 }
 function readProgress(mdFilePath) {
@@ -21155,6 +21170,12 @@ function generateContext(title, filePath, sections, highlights, docMemos, target
 }
 
 // ../../packages/shared/src/document-writer.ts
+function escAttrValue(s) {
+  return s.replace(/&/g, "&").replace(/"/g, """).replace(/\n/g, "
").replace(/-->/g, "-->");
+}
+function unescAttrValue(s) {
+  return s.replace(/-->/g, "-->").replace(/
/g, "\n").replace(/"/g, '"').replace(/&/g, "&");
+}
 function hashLine(line) {
   let hash = 5381;
   for (let i = 0; i < line.length; i++) {
@@ -21184,11 +21205,10 @@ var ARTIFACT_START_RE = /^<!-- MEMO_ARTIFACT\s*$/;
 var ARTIFACT_END_RE = /^-->$/;
 var DEPENDENCY_RE = /^<!-- MEMO_DEPENDENCY\s+id="([^"]+)"\s+from="([^"]+)"\s+to="([^"]+)"\s+type="([^"]+)" -->$/;
 function parseAttrs(lines) {
-  const unesc = (s) => s.replace(/&#10;/g, "\n").replace(/&quot;/g, '"');
   const attrs = {};
   for (const line of lines) {
     const m = line.trim().match(/^(\w+)="([^"]*)"$/);
-    if (m) attrs[m[1]] = unesc(m[2]);
+    if (m) attrs[m[1]] = unescAttrValue(m[2]);
   }
   return attrs;
 }
@@ -21209,7 +21229,6 @@ function splitDocument(markdown) {
   const dependencies = [];
   const checkpoints = [];
   const gates = [];
-  const unknownComments = [];
   let cursor = null;
   let openResponse = null;
   let i = 0;
@@ -21292,13 +21311,15 @@ function splitDocument(markdown) {
       }
       i++;
       const a = parseAttrs(attrLines);
+      const override = a.override;
       gates.push({
         id: a.id || `gate_${Date.now()}`,
         type: a.type || "custom",
         status: a.status || "blocked",
         blockedBy: a.blockedBy ? a.blockedBy.split(",").map((s) => s.trim()).filter(Boolean) : [],
         canProceedIf: a.canProceedIf || "",
-        doneDefinition: a.doneDefinition || ""
+        doneDefinition: a.doneDefinition || "",
+        ...override ? { override } : {}
       });
       continue;
     }
@@ -21448,8 +21469,7 @@ function splitDocument(markdown) {
     dependencies,
     checkpoints,
     gates,
-    cursor,
-    unknownComments
+    cursor
   };
 }
 function mergeDocument(parts) {
@@ -21480,71 +21500,70 @@ function mergeDocument(parts) {
   return sections.join("\n\n") + "\n";
 }
 function serializeMemoV2(memo) {
-  const esc2 = (s) => s.replace(/"/g, "&quot;").replace(/\n/g, "&#10;");
   return [
     "<!-- USER_MEMO",
-    `  id="${esc2(memo.id)}"`,
+    `  id="${escAttrValue(memo.id)}"`,
     `  type="${memo.type}"`,
     `  status="${memo.status}"`,
     `  owner="${memo.owner}"`,
-    `  source="${esc2(memo.source)}"`,
+    `  source="${escAttrValue(memo.source)}"`,
     `  color="${memo.color}"`,
-    `  text="${esc2(memo.text)}"`,
-    `  anchorText="${esc2(memo.anchorText)}"`,
-    `  anchor="${esc2(memo.anchor)}"`,
+    `  text="${escAttrValue(memo.text)}"`,
+    `  anchorText="${escAttrValue(memo.anchorText)}"`,
+    `  anchor="${escAttrValue(memo.anchor)}"`,
     `  createdAt="${memo.createdAt}"`,
     `  updatedAt="${memo.updatedAt}"`,
     "-->"
   ].join("\n");
 }
 function serializeGate(gate) {
-  return [
+  const lines = [
     "<!-- GATE",
     `  id="${gate.id}"`,
     `  type="${gate.type}"`,
     `  status="${gate.status}"`,
     `  blockedBy="${gate.blockedBy.join(",")}"`,
-    `  canProceedIf="${gate.canProceedIf.replace(/"/g, "&quot;")}"`,
-    `  doneDefinition="${gate.doneDefinition.replace(/"/g, "&quot;")}"`,
-    "-->"
-  ].join("\n");
+    `  canProceedIf="${escAttrValue(gate.canProceedIf)}"`,
+    `  doneDefinition="${escAttrValue(gate.doneDefinition)}"`
+  ];
+  if (gate.override) {
+    lines.push(`  override="${gate.override}"`);
+  }
+  lines.push("-->");
+  return lines.join("\n");
 }
 function serializeCursor(cursor) {
   return [
     "<!-- PLAN_CURSOR",
     `  taskId="${cursor.taskId}"`,
     `  step="${cursor.step}"`,
-    `  nextAction="${cursor.nextAction.replace(/"/g, "&quot;")}"`,
+    `  nextAction="${escAttrValue(cursor.nextAction)}"`,
     `  lastSeenHash="${cursor.lastSeenHash}"`,
     `  updatedAt="${cursor.updatedAt}"`,
     "-->"
   ].join("\n");
 }
 function serializeCheckpoint(cp) {
-  const note = cp.note.replace(/"/g, "&quot;");
   const sections = cp.sectionsReviewed.join(",");
-  return `<!-- CHECKPOINT id="${cp.id}" time="${cp.timestamp}" note="${note}" fixes=${cp.fixes} questions=${cp.questions} highlights=${cp.highlights} sections="${sections}" -->`;
+  return `<!-- CHECKPOINT id="${cp.id}" time="${cp.timestamp}" note="${escAttrValue(cp.note)}" fixes=${cp.fixes} questions=${cp.questions} highlights=${cp.highlights} sections="${sections}" -->`;
 }
 function serializeMemoImpl(impl) {
-  const esc2 = (s) => s.replace(/"/g, "&quot;").replace(/\n/g, "&#10;");
-  const ops = JSON.stringify(impl.operations).replace(/"/g, "&quot;");
   return [
     "<!-- MEMO_IMPL",
-    `  id="${esc2(impl.id)}"`,
-    `  memoId="${esc2(impl.memoId)}"`,
+    `  id="${escAttrValue(impl.id)}"`,
+    `  memoId="${escAttrValue(impl.memoId)}"`,
     `  status="${impl.status}"`,
-    `  operations="${ops}"`,
-    `  summary="${esc2(impl.summary)}"`,
+    `  operations="${escAttrValue(JSON.stringify(impl.operations))}"`,
+    `  summary="${escAttrValue(impl.summary)}"`,
     `  appliedAt="${impl.appliedAt}"`,
     "-->"
   ].join("\n");
 }
 function serializeMemoArtifact(art) {
-  const esc2 = (s) => s.replace(/"/g, "&quot;");
   return [
     "<!-- MEMO_ARTIFACT",
-    `  id="${esc2(art.id)}"`,
-    `  memoId="${esc2(art.memoId)}"`,
+    `  id="${escAttrValue(art.id)}"`,
+    `  memoId="${escAttrValue(art.memoId)}"`,
     `  files="${art.files.join(",")}"`,
     `  linkedAt="${art.linkedAt}"`,
     "-->"
@@ -22136,12 +22155,16 @@ function evaluateGate(gate, memos) {
 function evaluateAllGates(gates, memos) {
   return gates.map((gate) => ({
     ...gate,
-    status: evaluateGate(gate, memos)
+    status: gate.override || evaluateGate(gate, memos)
   }));
 }
 
+// src/tools.ts
+var import_node_fs2 = require("node:fs");
+
 // src/file-safety.ts
 var import_node_path = __toESM(require("node:path"));
+var import_node_fs = require("node:fs");
 var DEFAULT_BLOCKLIST = [
   "**/.env",
   ".env",
@@ -22184,6 +22207,16 @@ function validateFilePath(config2, filePath) {
   if (!resolved.startsWith(normalizedRoot + import_node_path.default.sep) && resolved !== normalizedRoot) {
     return { safe: false, reason: `Path "${filePath}" resolves outside workspace root` };
   }
+  if ((0, import_node_fs.existsSync)(resolved)) {
+    try {
+      const realResolved = (0, import_node_fs.realpathSync)(resolved);
+      const realRoot = (0, import_node_fs.realpathSync)(normalizedRoot);
+      if (!realResolved.startsWith(realRoot + import_node_path.default.sep) && realResolved !== realRoot) {
+        return { safe: false, reason: `Path "${filePath}" resolves outside workspace via symlink` };
+      }
+    } catch {
+    }
+  }
   const relative = import_node_path.default.relative(normalizedRoot, resolved).replace(/\\/g, "/");
   if (matchesAny(config2.blocklist, relative)) {
     return { safe: false, reason: `Path "${filePath}" matches blocklist pattern` };
@@ -22272,6 +22305,26 @@ function computeMetrics(memos, impls, gates, checkpoints, artifacts, dependencie
   };
 }
 
+// src/file-mutex.ts
+var import_node_path2 = __toESM(require("node:path"));
+var locks = /* @__PURE__ */ new Map();
+async function withFileLock(filePath, fn) {
+  const key = import_node_path2.default.resolve(filePath);
+  while (locks.has(key)) {
+    await locks.get(key);
+  }
+  let resolve2;
+  locks.set(key, new Promise((r) => {
+    resolve2 = r;
+  }));
+  try {
+    return await fn();
+  } finally {
+    locks.delete(key);
+    resolve2();
+  }
+}
+
 // src/tools.ts
 function computeLineHash(line) {
   let hash = 5381;
@@ -22281,6 +22334,17 @@ function computeLineHash(line) {
   return hash.toString(16).padStart(8, "0").slice(0, 8);
 }
 function registerTools(server2) {
+  const safety = createFileSafety();
+  function safeRead(file) {
+    const check2 = validateFilePath(safety, file);
+    if (!check2.safe) throw new Error(check2.reason);
+    return readMarkdownFile(file);
+  }
+  function safeWrite(file, content) {
+    const check2 = validateFilePath(safety, file);
+    if (!check2.safe) throw new Error(check2.reason);
+    writeMarkdownFile(file, content);
+  }
   server2.tool(
     "create_checkpoint",
     "Create a review checkpoint in an annotated markdown file. Records current annotation counts and reviewed sections.",
@@ -22288,11 +22352,11 @@ function registerTools(server2) {
       file: external_exports.string().describe("Path to the annotated markdown file"),
       note: external_exports.string().describe('Checkpoint note (e.g., "Phase 1 review done")')
     },
-    async ({ file, note }) => {
+    async ({ file, note }) => withFileLock(file, async () => {
       try {
-        const markdown = readMarkdownFile(file);
+        const markdown = safeRead(file);
         const { checkpoint, updatedMarkdown } = createCheckpoint(markdown, note);
-        writeMarkdownFile(file, updatedMarkdown);
+        safeWrite(file, updatedMarkdown);
         return {
           content: [{
             type: "text",
@@ -22308,7 +22372,7 @@ function registerTools(server2) {
           isError: true
         };
       }
-    }
+    })
   );
   server2.tool(
     "get_checkpoints",
@@ -22318,7 +22382,7 @@ function registerTools(server2) {
     },
     async ({ file }) => {
       try {
-        const markdown = readMarkdownFile(file);
+        const markdown = safeRead(file);
         const checkpoints = extractCheckpoints(markdown);
         return {
           content: [{
@@ -22346,7 +22410,7 @@ function registerTools(server2) {
     },
     async ({ file, target }) => {
       try {
-        const markdown = readMarkdownFile(file);
+        const markdown = safeRead(file);
         const doc = buildHandoffDocument(markdown, file);
         const handoff = formatHandoffMarkdown(doc, target || "standalone");
         return {
@@ -22374,7 +22438,7 @@ function registerTools(server2) {
     },
     async ({ file }) => {
       try {
-        const markdown = readMarkdownFile(file);
+        const markdown = safeRead(file);
         const counts = getAnnotationCounts(markdown);
         const checkpoints = extractCheckpoints(markdown);
         const sections = getSectionsWithAnnotations(markdown);
@@ -22410,7 +22474,7 @@ function registerTools(server2) {
     },
     async ({ file }) => {
       try {
-        const markdown = readMarkdownFile(file);
+        const markdown = safeRead(file);
         const doc = parseHandoffFile(markdown);
         if (!doc) {
           return {
@@ -22446,7 +22510,7 @@ function registerTools(server2) {
     },
     async ({ file }) => {
       try {
-        const markdown = readMarkdownFile(file);
+        const markdown = safeRead(file);
         const parts = splitDocument(markdown);
         const annotations = parts.memos.map((m) => ({
           id: m.id,
@@ -22486,13 +22550,14 @@ function registerTools(server2) {
     },
     async ({ file }) => {
       try {
-        const markdown = readMarkdownFile(file);
+        const markdown = safeRead(file);
         const parts = splitDocument(markdown);
         const allSections = getAllSections(markdown);
         const reviewedSections = getSectionsWithAnnotations(markdown);
         const gates = evaluateAllGates(parts.gates, parts.memos);
         const open = parts.memos.filter((m) => m.status === "open").length;
         const inProgress = parts.memos.filter((m) => m.status === "in_progress").length;
+        const needsReview = parts.memos.filter((m) => m.status === "needs_review").length;
         const answered = parts.memos.filter((m) => m.status === "answered").length;
         const done = parts.memos.filter((m) => m.status === "done").length;
         const failed = parts.memos.filter((m) => m.status === "failed").length;
@@ -22518,6 +22583,7 @@ function registerTools(server2) {
             total: parts.memos.length,
             open,
             inProgress,
+            needsReview,
             answered,
             done,
             failed,
@@ -22563,29 +22629,59 @@ function registerTools(server2) {
       text: external_exports.string().describe("The review feedback or note to attach"),
       occurrence: external_exports.number().int().min(1).optional().describe("Which occurrence of anchorText to annotate (1-indexed, default 1). Use when the same text appears multiple times.")
     },
-    async ({ file, anchorText, type, text, occurrence }) => {
+    async ({ file, anchorText, type, text, occurrence }) => withFileLock(file, async () => {
       try {
-        const markdown = readMarkdownFile(file);
+        const markdown = safeRead(file);
         const parts = splitDocument(markdown);
-        const targetOccurrence = occurrence ?? 1;
         const bodyLines = parts.body.split("\n");
         let anchorLine = -1;
-        let matchCount = 0;
-        for (let i = 0; i < bodyLines.length; i++) {
-          if (bodyLines[i].includes(anchorText)) {
-            matchCount++;
-            if (matchCount === targetOccurrence) {
-              anchorLine = i;
-              break;
+        if (occurrence) {
+          let matchCount = 0;
+          for (let i = 0; i < bodyLines.length; i++) {
+            if (bodyLines[i].includes(anchorText)) {
+              matchCount++;
+              if (matchCount === occurrence) {
+                anchorLine = i;
+                break;
+              }
+            }
+          }
+          if (anchorLine === -1) {
+            const errMsg = matchCount === 0 ? `Anchor text not found: "${anchorText}"` : `Anchor text "${anchorText}" has ${matchCount} occurrence(s), but occurrence=${occurrence} requested`;
+            return {
+              content: [{ type: "text", text: JSON.stringify({ error: errMsg }) }],
+              isError: true
+            };
+          }
+        } else {
+          const matches = [];
+          for (let i = 0; i < bodyLines.length; i++) {
+            if (bodyLines[i].includes(anchorText)) matches.push(i);
+          }
+          if (matches.length === 0) {
+            return {
+              content: [{ type: "text", text: JSON.stringify({ error: `Anchor text not found: "${anchorText}"` }) }],
+              isError: true
+            };
+          } else if (matches.length === 1) {
+            anchorLine = matches[0];
+          } else {
+            const exactMatch = matches.find((i) => bodyLines[i].trim() === anchorText.trim());
+            if (exactMatch !== void 0) {
+              anchorLine = exactMatch;
+            } else {
+              let bestIdx = matches[0];
+              let bestSurplus = Infinity;
+              for (const idx of matches) {
+                const surplus = bodyLines[idx].length - anchorText.length;
+                if (surplus < bestSurplus) {
+                  bestSurplus = surplus;
+                  bestIdx = idx;
+                }
+              }
+              anchorLine = bestIdx;
             }
           }
-        }
-        if (anchorLine === -1) {
-          const errMsg = matchCount === 0 ? `Anchor text not found: "${anchorText}"` : `Anchor text "${anchorText}" has ${matchCount} occurrence(s), but occurrence=${targetOccurrence} requested`;
-          return {
-            content: [{ type: "text", text: JSON.stringify({ error: errMsg }) }],
-            isError: true
-          };
         }
         const lineHash = computeLineHash(bodyLines[anchorLine]);
         const lineNum = anchorLine + 1;
@@ -22624,7 +22720,7 @@ function registerTools(server2) {
           updatedAt: (/* @__PURE__ */ new Date()).toISOString()
         };
         const updated = mergeDocument(parts);
-        writeMarkdownFile(file, updated);
+        safeWrite(file, updated);
         return {
           content: [{
             type: "text",
@@ -22640,7 +22736,7 @@ function registerTools(server2) {
           isError: true
         };
       }
-    }
+    })
   );
   server2.tool(
     "respond_to_memo",
@@ -22650,9 +22746,9 @@ function registerTools(server2) {
       memoId: external_exports.string().describe("The memo ID to respond to"),
       response: external_exports.string().describe("The response text (markdown supported)")
     },
-    async ({ file, memoId, response }) => {
+    async ({ file, memoId, response }) => withFileLock(file, async () => {
       try {
-        const markdown = readMarkdownFile(file);
+        const markdown = safeRead(file);
         const parts = splitDocument(markdown);
         const memo = parts.memos.find((m) => m.id === memoId);
         if (!memo) {
@@ -22733,7 +22829,7 @@ function registerTools(server2) {
           parts.gates = evaluateAllGates(parts.gates, parts.memos);
         }
         const updated = mergeDocument(parts);
-        writeMarkdownFile(file, updated);
+        safeWrite(file, updated);
         return {
           content: [{
             type: "text",
@@ -22754,7 +22850,7 @@ function registerTools(server2) {
           isError: true
         };
       }
-    }
+    })
   );
   server2.tool(
     "update_memo_status",
@@ -22762,12 +22858,12 @@ function registerTools(server2) {
     {
       file: external_exports.string().describe("Path to the annotated markdown file"),
       memoId: external_exports.string().describe("The memo ID to update"),
-      status: external_exports.enum(["open", "in_progress", "answered", "done", "failed", "wontfix"]).describe("New status"),
+      status: external_exports.enum(["open", "in_progress", "needs_review", "answered", "done", "failed", "wontfix"]).describe("New status"),
       owner: external_exports.enum(["human", "agent", "tool"]).optional().describe("Optionally change the owner")
     },
-    async ({ file, memoId, status, owner }) => {
+    async ({ file, memoId, status, owner }) => withFileLock(file, async () => {
       try {
-        const markdown = readMarkdownFile(file);
+        const markdown = safeRead(file);
         const parts = splitDocument(markdown);
         const memo = parts.memos.find((m) => m.id === memoId);
         if (!memo) {
@@ -22804,7 +22900,7 @@ function registerTools(server2) {
           updatedAt: (/* @__PURE__ */ new Date()).toISOString()
         };
         const updated = mergeDocument(parts);
-        writeMarkdownFile(file, updated);
+        safeWrite(file, updated);
         return {
           content: [{
             type: "text",
@@ -22820,7 +22916,7 @@ function registerTools(server2) {
           isError: true
         };
       }
-    }
+    })
   );
   server2.tool(
     "update_cursor",
@@ -22831,9 +22927,9 @@ function registerTools(server2) {
       step: external_exports.string().describe('Current step (e.g., "3/7" or "Phase 2")'),
       nextAction: external_exports.string().describe("Description of the next action to take")
     },
-    async ({ file, taskId, step, nextAction }) => {
+    async ({ file, taskId, step, nextAction }) => withFileLock(file, async () => {
       try {
-        const markdown = readMarkdownFile(file);
+        const markdown = safeRead(file);
         const parts = splitDocument(markdown);
         if (parts.memos.length > 0 && !parts.memos.some((m) => m.id === taskId)) {
           return {
@@ -22854,7 +22950,7 @@ function registerTools(server2) {
           updatedAt: (/* @__PURE__ */ new Date()).toISOString()
         };
         const updated = mergeDocument(parts);
-        writeMarkdownFile(file, updated);
+        safeWrite(file, updated);
         return {
           content: [{
             type: "text",
@@ -22870,7 +22966,7 @@ function registerTools(server2) {
           isError: true
         };
       }
-    }
+    })
   );
   server2.tool(
     "evaluate_gates",
@@ -22880,7 +22976,7 @@ function registerTools(server2) {
     },
     async ({ file }) => {
       try {
-        const markdown = readMarkdownFile(file);
+        const markdown = safeRead(file);
         const parts = splitDocument(markdown);
         const gates = evaluateAllGates(parts.gates, parts.memos);
         return {
@@ -22917,7 +23013,7 @@ function registerTools(server2) {
     },
     async ({ file, target }) => {
       try {
-        const markdown = readMarkdownFile(file);
+        const markdown = safeRead(file);
         if (target === "handoff") {
           const doc = buildHandoffDocument(markdown, file);
           const handoff = formatHandoffMarkdown(doc, "standalone");
@@ -22955,7 +23051,7 @@ function registerTools(server2) {
   );
   server2.tool(
     "apply_memo",
-    "Apply an implementation action to a memo. Supports text_replace (on current document), file_patch (apply patch to target file), and file_create (create a new file). Creates a snapshot before modification, records the implementation, and updates memo status to done.",
+    "Apply an implementation action to a memo. Supports text_replace (replaces all occurrences in current document), file_patch (overwrites target file \u2014 snapshot saved first), and file_create (create a new file). Creates a snapshot before modification, records the implementation, and updates memo status to done.",
     {
       file: external_exports.string().describe("Path to the annotated markdown file"),
       memoId: external_exports.string().describe("The memo ID to apply implementation to"),
@@ -22967,9 +23063,9 @@ function registerTools(server2) {
       patch: external_exports.string().optional().describe("For file_patch: the patch content"),
       content: external_exports.string().optional().describe("For file_create: the file content to write")
     },
-    async ({ file, memoId, action, dryRun, oldText, newText, targetFile, patch, content: fileContent }) => {
+    async ({ file, memoId, action, dryRun, oldText, newText, targetFile, patch, content: fileContent }) => withFileLock(file, async () => {
       try {
-        const markdown = readMarkdownFile(file);
+        const markdown = safeRead(file);
         const parts = splitDocument(markdown);
         const memo = parts.memos.find((m) => m.id === memoId);
         if (!memo) {
@@ -23020,16 +23116,6 @@ function registerTools(server2) {
             }]
           };
         }
-        if ((action === "file_patch" || action === "file_create") && targetFile) {
-          const safety = createFileSafety();
-          const check2 = validateFilePath(safety, targetFile);
-          if (!check2.safe) {
-            return {
-              content: [{ type: "text", text: JSON.stringify({ error: `File safety: ${check2.reason}` }) }],
-              isError: true
-            };
-          }
-        }
         writeSnapshot(file, markdown);
         if (action === "text_replace") {
           if (!parts.body.includes(oldText)) {
@@ -23038,14 +23124,17 @@ function registerTools(server2) {
               isError: true
             };
           }
-          parts.body = parts.body.replace(oldText, newText);
+          parts.body = parts.body.split(oldText).join(newText);
         } else if (action === "file_patch") {
-          writeMarkdownFile(targetFile, patch);
+          if ((0, import_node_fs2.existsSync)(targetFile)) {
+            writeSnapshot(targetFile, readMarkdownFile(targetFile));
+          }
+          safeWrite(targetFile, patch);
         } else if (action === "file_create") {
-          writeMarkdownFile(targetFile, fileContent);
+          safeWrite(targetFile, fileContent);
         }
         parts.impls.push(impl);
-        memo.status = "done";
+        memo.status = "needs_review";
         memo.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
         if (parts.gates.length > 0) {
           parts.gates = evaluateAllGates(parts.gates, parts.memos);
@@ -23060,7 +23149,7 @@ function registerTools(server2) {
           updatedAt: (/* @__PURE__ */ new Date()).toISOString()
         };
         const updated = mergeDocument(parts);
-        writeMarkdownFile(file, updated);
+        safeWrite(file, updated);
         return {
           content: [{
             type: "text",
@@ -23076,7 +23165,7 @@ function registerTools(server2) {
           isError: true
         };
       }
-    }
+    })
   );
   server2.tool(
     "link_artifacts",
@@ -23086,9 +23175,9 @@ function registerTools(server2) {
       memoId: external_exports.string().describe("The memo ID to link artifacts to"),
       files: external_exports.array(external_exports.string()).describe("Array of relative file paths to link")
     },
-    async ({ file, memoId, files: artifactFiles }) => {
+    async ({ file, memoId, files: artifactFiles }) => withFileLock(file, async () => {
       try {
-        const markdown = readMarkdownFile(file);
+        const markdown = safeRead(file);
         const parts = splitDocument(markdown);
         const memo = parts.memos.find((m) => m.id === memoId);
         if (!memo) {
@@ -23105,7 +23194,7 @@ function registerTools(server2) {
         };
         parts.artifacts.push(artifact);
         const updated = mergeDocument(parts);
-        writeMarkdownFile(file, updated);
+        safeWrite(file, updated);
         return {
           content: [{
             type: "text",
@@ -23121,7 +23210,7 @@ function registerTools(server2) {
           isError: true
         };
       }
-    }
+    })
   );
   server2.tool(
     "update_memo_progress",
@@ -23129,12 +23218,12 @@ function registerTools(server2) {
     {
       file: external_exports.string().describe("Path to the annotated markdown file"),
       memoId: external_exports.string().describe("The memo ID to update progress for"),
-      status: external_exports.enum(["in_progress", "done", "failed"]).describe("New progress status"),
+      status: external_exports.enum(["in_progress", "needs_review", "done", "failed"]).describe("New progress status"),
       message: external_exports.string().describe("Progress message describing what was done or what failed")
     },
-    async ({ file, memoId, status, message }) => {
+    async ({ file, memoId, status, message }) => withFileLock(file, async () => {
       try {
-        const markdown = readMarkdownFile(file);
+        const markdown = safeRead(file);
         const parts = splitDocument(markdown);
         const memo = parts.memos.find((m) => m.id === memoId);
         if (!memo) {
@@ -23165,7 +23254,7 @@ function registerTools(server2) {
           updatedAt: (/* @__PURE__ */ new Date()).toISOString()
         };
         const updated = mergeDocument(parts);
-        writeMarkdownFile(file, updated);
+        safeWrite(file, updated);
         return {
           content: [{
             type: "text",
@@ -23181,7 +23270,7 @@ function registerTools(server2) {
           isError: true
         };
       }
-    }
+    })
   );
   server2.tool(
     "rollback_memo",
@@ -23190,9 +23279,9 @@ function registerTools(server2) {
       file: external_exports.string().describe("Path to the annotated markdown file"),
       memoId: external_exports.string().describe("The memo ID to rollback")
     },
-    async ({ file, memoId }) => {
+    async ({ file, memoId }) => withFileLock(file, async () => {
       try {
-        const markdown = readMarkdownFile(file);
+        const markdown = safeRead(file);
         const parts = splitDocument(markdown);
         const memo = parts.memos.find((m) => m.id === memoId);
         if (!memo) {
@@ -23212,7 +23301,7 @@ function registerTools(server2) {
         for (const op of latestImpl.operations) {
           if (op.type === "text_replace") {
             if (parts.body.includes(op.after)) {
-              parts.body = parts.body.replace(op.after, op.before);
+              parts.body = parts.body.split(op.after).join(op.before);
             }
           }
         }
@@ -23232,7 +23321,7 @@ function registerTools(server2) {
           updatedAt: (/* @__PURE__ */ new Date()).toISOString()
         };
         const updated = mergeDocument(parts);
-        writeMarkdownFile(file, updated);
+        safeWrite(file, updated);
         return {
           content: [{
             type: "text",
@@ -23252,7 +23341,7 @@ function registerTools(server2) {
           isError: true
         };
       }
-    }
+    })
   );
   server2.tool(
     "batch_apply",
@@ -23269,26 +23358,18 @@ function registerTools(server2) {
         content: external_exports.string().optional().describe("For file_create: the file content to write")
       })).describe("Array of operations to apply")
     },
-    async ({ file, operations }) => {
+    async ({ file, operations }) => withFileLock(file, async () => {
       try {
-        const markdown = readMarkdownFile(file);
+        const markdown = safeRead(file);
         const parts = splitDocument(markdown);
         writeSnapshot(file, markdown);
         const results = [];
-        const safety = createFileSafety();
         for (const op of operations) {
           const memo = parts.memos.find((m) => m.id === op.memoId);
           if (!memo) {
             results.push({ memoId: op.memoId, implId: "", status: `error: memo not found` });
             continue;
           }
-          if ((op.action === "file_patch" || op.action === "file_create") && op.targetFile) {
-            const check2 = validateFilePath(safety, op.targetFile);
-            if (!check2.safe) {
-              results.push({ memoId: op.memoId, implId: "", status: `error: file safety: ${check2.reason}` });
-              continue;
-            }
-          }
           let operation;
           if (op.action === "text_replace") {
             if (!op.oldText || op.newText === void 0) {
@@ -23300,21 +23381,24 @@ function registerTools(server2) {
               results.push({ memoId: op.memoId, implId: "", status: "error: oldText not found in body" });
               continue;
             }
-            parts.body = parts.body.replace(op.oldText, op.newText);
+            parts.body = parts.body.split(op.oldText).join(op.newText);
           } else if (op.action === "file_patch") {
             if (!op.targetFile || !op.patch) {
               results.push({ memoId: op.memoId, implId: "", status: "error: file_patch requires targetFile and patch" });
               continue;
             }
             operation = { type: "file_patch", file: op.targetFile, patch: op.patch };
-            writeMarkdownFile(op.targetFile, op.patch);
+            if ((0, import_node_fs2.existsSync)(op.targetFile)) {
+              writeSnapshot(op.targetFile, readMarkdownFile(op.targetFile));
+            }
+            safeWrite(op.targetFile, op.patch);
           } else {
             if (!op.targetFile || op.content === void 0) {
               results.push({ memoId: op.memoId, implId: "", status: "error: file_create requires targetFile and content" });
               continue;
             }
             operation = { type: "file_create", file: op.targetFile, content: op.content };
-            writeMarkdownFile(op.targetFile, op.content);
+            safeWrite(op.targetFile, op.content);
           }
           const impl = {
             id: `impl_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 6)}`,
@@ -23325,7 +23409,7 @@ function registerTools(server2) {
             appliedAt: (/* @__PURE__ */ new Date()).toISOString()
           };
           parts.impls.push(impl);
-          memo.status = "done";
+          memo.status = "needs_review";
           memo.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
           results.push({ memoId: op.memoId, implId: impl.id, status: "applied" });
         }
@@ -23343,7 +23427,7 @@ function registerTools(server2) {
         };
         writeTransaction(file, { type: "batch_apply", results, timestamp: (/* @__PURE__ */ new Date()).toISOString() });
         const updated = mergeDocument(parts);
-        writeMarkdownFile(file, updated);
+        safeWrite(file, updated);
         return {
           content: [{
             type: "text",
@@ -23359,7 +23443,7 @@ function registerTools(server2) {
           isError: true
         };
       }
-    }
+    })
   );
   server2.tool(
     "get_memo_changes",
@@ -23370,7 +23454,7 @@ function registerTools(server2) {
     },
     async ({ file, memoId }) => {
       try {
-        const markdown = readMarkdownFile(file);
+        const markdown = safeRead(file);
         const parts = splitDocument(markdown);
         const impls = memoId ? parts.impls.filter((imp) => imp.memoId === memoId) : parts.impls;
         const allProgress = readProgress(file);
@@ -23401,13 +23485,13 @@ function log(msg) {
 }
 var server = new McpServer({
   name: "md-feedback",
-  version: "1.1.1"
+  version: "1.2.1"
 });
 registerTools(server);
 async function main() {
   const transport = new StdioServerTransport();
   await server.connect(transport);
-  log(`v${"1.1.1"} ready (stdio)`);
+  log(`v${"1.2.1"} ready (stdio)`);
 }
 main().catch((err) => {
   log(`fatal: ${err}`);

package/package.json

@@ -1,70 +1,73 @@
-{
-  "name": "md-feedback",
-  "version": "1.1.1",
-  "description": "MCP server for markdown plan review — AI agents read annotations, mark tasks done, evaluate quality gates, and generate session handoffs. 19 tools for Claude Code, Cursor, Copilot, and 8 more AI tools.",
-  "license": "SUL-1.0",
-  "author": "Yeomin Seon",
-  "type": "commonjs",
-  "bin": {
-    "md-feedback": "./bin/md-feedback.cjs"
-  },
-  "files": [
-    "dist/mcp-server.js",
-    "bin/md-feedback.cjs",
-    "README.md"
-  ],
-  "scripts": {
-    "build": "node esbuild.mjs"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.12.0",
-    "zod": "^3.23.0"
-  },
-  "devDependencies": {
-    "esbuild": "^0.24.2",
-    "typescript": "^5.7.0"
-  },
-  "engines": {
-    "node": ">=18"
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/yeominux/md-feedback"
-  },
-  "bugs": {
-    "url": "https://github.com/yeominux/md-feedback/issues"
-  },
-  "homepage": "https://github.com/yeominux/md-feedback#mcp-server",
-  "keywords": [
-    "mcp",
-    "mcp-server",
-    "model-context-protocol",
-    "markdown",
-    "feedback",
-    "ai",
-    "annotation",
-    "review",
-    "plan-review",
-    "ai-agent",
-    "coding-workflow",
-    "handoff",
-    "session-handoff",
-    "structured-feedback",
-    "checkpoint",
-    "ai-context",
-    "ai-coding",
-    "claude-code",
-    "cursor-ai",
-    "vibe-coding",
-    "context-engineering",
-    "gates",
-    "plan-review-tool",
-    "document-annotation",
-    "code-review",
-    "ai-workflow",
-    "copilot",
-    "markdown-review",
-    "developer-tools",
-    "quality-gate"
-  ]
-}
+{
+  "name": "md-feedback",
+  "version": "1.2.1",
+  "description": "MCP server for markdown plan review — AI agents read annotations, mark tasks done, evaluate quality gates, and generate session handoffs. 19 tools for Claude Code, Cursor, Copilot, and 8 more AI tools.",
+  "license": "SUL-1.0",
+  "author": "Yeomin Seon",
+  "type": "commonjs",
+  "bin": {
+    "md-feedback": "./bin/md-feedback.cjs"
+  },
+  "files": [
+    "dist/mcp-server.js",
+    "bin/md-feedback.cjs",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "node esbuild.mjs"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.12.0",
+    "zod": "^3.23.0"
+  },
+  "devDependencies": {
+    "esbuild": "^0.24.2",
+    "typescript": "^5.7.0"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/yeominux/md-feedback"
+  },
+  "bugs": {
+    "url": "https://github.com/yeominux/md-feedback/issues"
+  },
+  "homepage": "https://github.com/yeominux/md-feedback#mcp-server",
+  "keywords": [
+    "mcp",
+    "mcp-server",
+    "model-context-protocol",
+    "markdown",
+    "feedback",
+    "ai",
+    "annotation",
+    "review",
+    "plan-review",
+    "ai-agent",
+    "coding-workflow",
+    "handoff",
+    "session-handoff",
+    "structured-feedback",
+    "checkpoint",
+    "ai-context",
+    "ai-coding",
+    "claude-code",
+    "cursor-ai",
+    "vibe-coding",
+    "context-engineering",
+    "gates",
+    "plan-review-tool",
+    "document-annotation",
+    "code-review",
+    "ai-workflow",
+    "copilot",
+    "markdown-review",
+    "developer-tools",
+    "quality-gate",
+    "file-safety",
+    "concurrent-safety",
+    "gate-override"
+  ]
+}