pindex 1.5.0 → 1.7.0

package/dist/tools/schemas.js

@@ -1,6 +1,14 @@
 import { z } from 'zod';
 // ─── Zod Schemas for MCP Tool Input Validation ──────────────────────────────
 const reposField = z.array(z.string()).optional();
+/** A project-relative path that may not be absolute or contain ".." traversal
+ *  segments. Defense-in-depth on top of the runtime resolveWithinRoot guard. */
+const safeRelPath = z
+    .string()
+    .min(1)
+    .refine((p) => !p.startsWith('/') &&
+    !/^[A-Za-z]:[\\/]/.test(p) &&
+    !p.split(/[\\/]/).includes('..'), { message: 'Path must be project-relative and contain no ".." segments' });
 export const SearchSymbolsSchema = z.object({
     query: z.string().min(1),
     limit: z.number().int().positive().optional(),
@@ -38,13 +46,13 @@ export const GetProjectOverviewSchema = z.object({
     repos: reposField,
 });
 export const ReindexSchema = z.object({
-    target: z.string().optional(),
+    target: safeRelPath.optional(),
 });
 export const GetTokenStatsSchema = z.object({
     session_id: z.string().optional(),
 });
 export const StartComparisonSchema = z.object({
-    label: z.string().min(1),
+    label: z.string().min(1).max(200),
     mode: z.enum(['indexed', 'baseline']),
 });
 export const SearchDocsSchema = z.object({

package/dist/tools/schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/tools/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+EAA+E;AAE/E,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAElD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,UAAU;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,UAAU;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,KAAK,EAAE,UAAU;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,UAAU;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,KAAK,EAAE,UAAU;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChE,KAAK,EAAE,UAAU;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,KAAK,EAAE,UAAU;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;CACtC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnD,KAAK,EAAE,UAAU;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACtD,KAAK,EAAE,UAAU;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,+EAA+E;AAC/E,oEAAoE;AAEpE,MAAM,CAAC,MAAM,YAAY,GAAgC;IACvD,cAAc,EAAE,mBAAmB;IACnC,UAAU,EAAE,eAAe;IAC3B,WAAW,EAAE,gBAAgB;IAC7B,gBAAgB,EAAE,oBAAoB;IACtC,WAAW,EAAE,gBAAgB;IAC7B,gBAAgB,EAAE,qBAAqB;IACvC,oBAAoB,EAAE,wBAAwB;IAC9C,OAAO,EAAE,aAAa;IACtB,eAAe,EAAE,mBAAmB;IACpC,gBAAgB,EAAE,qBAAqB;IACvC,WAAW,EAAE,gBAAgB;IAC7B,aAAa,EAAE,iBAAiB;IAChC,YAAY,EAAE,iBAAiB;IAC/B,kBAAkB,EAAE,sBAAsB;CAC3C,CAAC"}
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/tools/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+EAA+E;AAE/E,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAElD;gFACgF;AAChF,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;IAClB,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAClC,EAAE,OAAO,EAAE,4DAA4D,EAAE,CAC1E,CAAC;AAEJ,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,UAAU;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,UAAU;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,KAAK,EAAE,UAAU;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,UAAU;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,KAAK,EAAE,UAAU;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChE,KAAK,EAAE,UAAU;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,KAAK,EAAE,UAAU;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;CACtC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnD,KAAK,EAAE,UAAU;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACtD,KAAK,EAAE,UAAU;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,+EAA+E;AAC/E,oEAAoE;AAEpE,MAAM,CAAC,MAAM,YAAY,GAAgC;IACvD,cAAc,EAAE,mBAAmB;IACnC,UAAU,EAAE,eAAe;IAC3B,WAAW,EAAE,gBAAgB;IAC7B,gBAAgB,EAAE,oBAAoB;IACtC,WAAW,EAAE,gBAAgB;IAC7B,gBAAgB,EAAE,qBAAqB;IACvC,oBAAoB,EAAE,wBAAwB;IAC9C,OAAO,EAAE,aAAa;IACtB,eAAe,EAAE,mBAAmB;IACpC,gBAAgB,EAAE,qBAAqB;IACvC,WAAW,EAAE,gBAAgB;IAC7B,aAAa,EAAE,iBAAiB;IAChC,YAAY,EAAE,iBAAiB;IAC/B,kBAAkB,EAAE,sBAAsB;CAC3C,CAAC"}

package/dist/util/net.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Loopback / origin helpers shared by the monitoring and GUI dashboards.
+ *
+ * The dashboards expose project paths, symbol names and session data. They bind
+ * to 127.0.0.1 by default, but loopback binding alone does not stop a malicious
+ * web page in the developer's browser from reaching them (DNS rebinding for HTTP,
+ * Cross-Site WebSocket Hijacking for WS, CSRF for side-effecting routes). These
+ * helpers implement a loopback-only Host/Origin policy that closes those gaps
+ * while still allowing an explicit non-loopback opt-in via PINDEX_BIND_HOST.
+ */
+/** True if the hostname (no port, brackets stripped) is the loopback interface. */
+export declare function isLoopbackHostname(hostname: string): boolean;
+/** Extracts the hostname from a Host/authority header, dropping any port.
+ *  Handles bracketed IPv6 literals such as `[::1]:7843`. */
+export declare function hostnameFromHeader(hostHeader: string | undefined): string;
+/** True when the dashboards should enforce a loopback-only Host/Origin policy.
+ *  Enforcement is on by default and only disabled when the operator explicitly
+ *  binds to a non-loopback interface via PINDEX_BIND_HOST (accepting the risk). */
+export declare function loopbackEnforced(): boolean;
+/** True if a request with the given Host header is permitted under the policy. */
+export declare function isAllowedHost(hostHeader: string | undefined): boolean;
+/** True if an Origin is acceptable: a loopback origin, or no Origin at all
+ *  (non-browser clients such as the CLI / curl never send one). */
+export declare function isAllowedOrigin(origin: string | undefined): boolean;
+//# sourceMappingURL=net.d.ts.map

package/dist/util/net.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"net.d.ts","sourceRoot":"","sources":["../../src/util/net.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAG5D;AAED;4DAC4D;AAC5D,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAKzE;AAED;;mFAEmF;AACnF,wBAAgB,gBAAgB,IAAI,OAAO,CAE1C;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGrE;AAED;mEACmE;AACnE,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAOnE"}

package/dist/util/net.js

@@ -0,0 +1,50 @@
+/**
+ * Loopback / origin helpers shared by the monitoring and GUI dashboards.
+ *
+ * The dashboards expose project paths, symbol names and session data. They bind
+ * to 127.0.0.1 by default, but loopback binding alone does not stop a malicious
+ * web page in the developer's browser from reaching them (DNS rebinding for HTTP,
+ * Cross-Site WebSocket Hijacking for WS, CSRF for side-effecting routes). These
+ * helpers implement a loopback-only Host/Origin policy that closes those gaps
+ * while still allowing an explicit non-loopback opt-in via PINDEX_BIND_HOST.
+ */
+/** True if the hostname (no port, brackets stripped) is the loopback interface. */
+export function isLoopbackHostname(hostname) {
+    const h = hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    return h === 'localhost' || h === '127.0.0.1' || h === '::1';
+}
+/** Extracts the hostname from a Host/authority header, dropping any port.
+ *  Handles bracketed IPv6 literals such as `[::1]:7843`. */
+export function hostnameFromHeader(hostHeader) {
+    if (!hostHeader)
+        return '';
+    const bracketed = /^\[([^\]]+)\]/.exec(hostHeader);
+    if (bracketed)
+        return bracketed[1];
+    return hostHeader.replace(/:\d+$/, '');
+}
+/** True when the dashboards should enforce a loopback-only Host/Origin policy.
+ *  Enforcement is on by default and only disabled when the operator explicitly
+ *  binds to a non-loopback interface via PINDEX_BIND_HOST (accepting the risk). */
+export function loopbackEnforced() {
+    return isLoopbackHostname(process.env.PINDEX_BIND_HOST ?? '127.0.0.1');
+}
+/** True if a request with the given Host header is permitted under the policy. */
+export function isAllowedHost(hostHeader) {
+    if (!loopbackEnforced())
+        return true;
+    return isLoopbackHostname(hostnameFromHeader(hostHeader));
+}
+/** True if an Origin is acceptable: a loopback origin, or no Origin at all
+ *  (non-browser clients such as the CLI / curl never send one). */
+export function isAllowedOrigin(origin) {
+    if (!origin)
+        return true;
+    try {
+        return isLoopbackHostname(new URL(origin).hostname);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=net.js.map

package/dist/util/net.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"net.js","sourceRoot":"","sources":["../../src/util/net.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,mFAAmF;AACnF,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,KAAK,CAAC;AAC/D,CAAC;AAED;4DAC4D;AAC5D,MAAM,UAAU,kBAAkB,CAAC,UAA8B;IAC/D,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACzC,CAAC;AAED;;mFAEmF;AACnF,MAAM,UAAU,gBAAgB;IAC9B,OAAO,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,WAAW,CAAC,CAAC;AACzE,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,aAAa,CAAC,UAA8B;IAC1D,IAAI,CAAC,gBAAgB,EAAE;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,kBAAkB,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;mEACmE;AACnE,MAAM,UAAU,eAAe,CAAC,MAA0B;IACxD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pindex",
-  "version": "1.5.0",
+  "version": "1.7.0",
   "description": "MCP server providing structural codebase indexing for token-efficient AI coding assistants on medium-to-large projects",
   "type": "module",
   "bin": {
@@ -22,6 +22,7 @@
     "test:coverage": "vitest run --coverage",
     "test:integration": "npm run build && vitest run --config vitest.integration.config.ts",
     "bench:index": "npm run build && node scripts/bench-index.mjs",
+    "bench:realism": "node scripts/realism-benchmark.mjs",
     "lint": "tsc --noEmit",
     "prepublishOnly": "npm run build",
     "start": "node dist/index.js",
@@ -38,17 +39,17 @@
   "license": "MIT",
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "better-sqlite3": "^11.5.0",
+    "better-sqlite3": "^12.10.0",
     "chokidar": "^3.6.0",
     "express": "^4.18.0",
     "glob": "^10.0.0",
     "open": "^9.1.0",
     "tree-sitter": "^0.21.0",
     "tree-sitter-typescript": "^0.21.0",
-    "uuid": "^9.0.0",
+    "uuid": "^14.0.1",
     "vscode-jsonrpc": "^8.2.1",
     "vscode-languageserver-protocol": "^3.17.5",
-    "ws": "^8.16.0",
+    "ws": "^8.21.0",
     "zod": "^4.3.6"
   },
   "optionalDependencies": {
@@ -59,7 +60,6 @@
     "@types/express": "^4.17.0",
     "@types/node": "^20.0.0",
     "@types/supertest": "^6.0.0",
-    "@types/uuid": "^9.0.0",
     "@types/ws": "^8.5.0",
     "@vitest/coverage-v8": "^4.0.18",
     "supertest": "^6.0.0",