v0.2.1

v0.2.1

Added

• universal_find_references: with more than one searched root the report now lists the searched roots, marks the root each file path is relative to (file.rs (relative to <root>)) and states how many duplicate files were skipped — so a path like project/src/lib.rs can no longer be mistaken for a second copy of src/lib.rs.
• universal_find_references: the audit log entry now records searchedRoots and duplicatesDropped.
• 10 new tests (symbols.test.ts): nested-root pruning, duplicate detection via a junction, sibling roots with an identical relative path, single-root parity with universalFindReferences, and the report format (total 348).
• CI (.github/workflows/ci.yml): npm ci + npm run build + npm test on windows-latest and ubuntu-latest, plus an ubuntu-latest job that runs the same suite with MCP_PROJECT_ROOT / MCP_EXTRA_ROOTS / MCP_PROJECT_NAMES set (the root registry and project aliases are read from the environment at import time, so both cases have to keep passing). CI status badge added to README.

Changed

• run_command_grep: a zero-match response no longer returns a bare (žiadna zhoda) — it now states what was scanned: (žiadna zhoda — 0 z N riadkov výstupu, exit code 0) on the normal path, and (žiadna zhoda — výstup prázdny, exit code M) / exit code neznámy (signal/timeout) in the catch block. Nájdených N zhôd: … is unchanged. Motivation: the same text was returned for "output scanned, nothing matched" and "command produced nothing", which was misread as a lost command (feedback 2026-09-16 — the only actionable part of a report that was otherwise not reproducible). New helper formatZeroMatch() in src/format.ts + 3 tests (total 354).

Fixed

• universal_find_references: every match was reported twice when cwd was omitted — all registered roots were searched, and because the registry contains nested pairs (D:\W\TS + the projects inside it, …\Rust + …\Rust\pixel-blaster-engine) the same file was reachable through two roots. The dedup key was the root-relative path (different per root) and totalMatches summed every root, so ColAlign reported 56 matches for 28 real ones, the listing was truncated mid-output, and the two path prefixes made one file look like two. Nested roots are now pruned (pruneNestedRoots), files are deduplicated by resolved real path, and totalMatches is the sum over the files actually listed. Distinct files that exist in two sibling roots under the same relative path are no longer silently dropped.
• universal_find_references: cwd was documented as "default: primary project root" while the implementation searched every registered root — the description now matches the behaviour (tool description, cwd parameter, help_tool, README).
• The test suite is no longer Windows-only. Fixtures that were hardcoded D:\... / Z:\... literals are relative paths on POSIX, so the affected tests could only pass on Windows (resolveCwdRequested, resolveFilePath, resolve_cwd, buildRegistrations / findMatchingRegistration, findOutOfRootWriteTargets, findSuspiciousCrossRootReads, findAliasByName / findAliasByPath, findEscapeReason — git -C bypass). They now build a real tree under os.tmpdir() with path.join/path.sep — the pattern the multi-root fallback block already used — and separator-agnostic path assertions. Coverage is unchanged (348 tests, still green on Windows); POSIX is enforced by the new CI job.
• POSIX: the command-target safety checks were silently Windows-only. isFlag() tested ^\/[a-z] unanchored, and on POSIX every absolute path starts with /<letter> — so an absolute POSIX path was read as a cmd flag and findOutOfRootWriteTargets never saw the target of mkdir /tmp/x, mkdir -p /tmp/x or copy a.txt /tmp/x (worst case the copy/move branch fell back to a.txt). QUOTED_PATH (cross-root reads, active with MCP_BLOCK_CROSS_ROOT_READS=1) matched C:\, ../ and ~/ only, so quoted absolute POSIX reads were invisible. Both are fixed: isFlag() now accepts a /x flag only as a 1–2 letter token, and QUOTED_PATH gained a POSIX absolute branch (a quoted token is a path, never a flag). The 5 previously skipped assertions run again, plus 3 new platform-neutral regression tests (mkdir/copy at the filesystem root, quoted absolute read) that fail on the old code even on Windows.

Known Limitations (documented)

• Residual: a 1–2 letter directory directly under the filesystem root (/a) is still read as a cmd flag by isFlag() — use a longer name or the unquoted full path form for such targets.