v0.1.0

Gives an MCP client a registry of the local project setup: group folders and git
projects discovered under configured roots, with scoped read/search/write
operations that cannot escape a project root.

Tools (10, stdio, MCP revision 2026-07-28 via @modelcontextprotocol/server 2.0.0):
map_workspace, list_groups, list_projects, find_project, project_info,
search, read_file, write_file, scaffold_project, refresh_registry

Behaviour

• Discovery: a directory containing .git is a project; the folders between a
  root and the project form its group path, at arbitrary depth.
• Freshness: full scan at startup, explicit refresh_registry, plus mtime
  revalidation of root and group dirs piggybacked on registry calls. No
  filesystem watcher, no disk cache.
• Configuration: PROJECT_LENS_PATH or a positional root argument; optional
  config file only for exclude globs and multiple roots. A malformed config
  fails startup rather than running with a silently widened scope.

Security

• Path traversal and symlink escapes rejected on every file operation.
• Secret-pattern files (.env*, .pem, id_rsa, credentials) never appear in
  key_files, listings or search results.
• Git remote userinfo (user:token@) stripped before it is returned.
• scaffold_project is user-initiated only, names allowlisted, no network; all
  subprocesses run through execFile argument arrays, never a shell.

Measured (personal PC, 42 projects / 16 groups): cold scan ~90 ms against a
500 ms budget, registry tools < 1 ms against 15-20 ms, project_info ~5 ms
against 100 ms, search ~7 ms against 80 ms.

Requires Node.js >= 22, git and ripgrep on PATH. Three runtime dependencies.
Published as @mpujado/project-lens to the private Gitea npm registry.