Repository navigation
This release hardens local repository inspection and restores trace coverage under bounded traversal.
Changes
- Bound repository analysis, subprocess output, parser work, MCP framing, lifecycle payloads and persisted JSON decoding. Corrupt relation metadata produces explicit partial-index diagnostics.
- Isolate optional native PHP parsing with runtime and memory limits; retain bounded regex extraction when enforceable native isolation is unavailable.
- Protect repository reads and private metadata files, validate Git administrative paths and reject executable local Git configuration.
- Require a per-launch dashboard capability, use an OS-assigned port by default, and separate authenticated work from incomplete/public connections.
- Minimize exported signatures and encode untrusted fields in Markdown and plain-text reports.
- Avoid repeated traversal of the same file from one start. Across six real-repository queries, default trace results now match the expanded reference Top 10 without exhausting the 1,000-state budget.
- Allow large flat Python configuration literals while retaining expression-chain and nesting limits.
- Pin CI actions to immutable commits and use read-only repository permissions.
Compatibility and upgrade
- Git metadata may be unavailable for repositories with unsupported local configuration, linked/external Git administrative directories, or untrusted executable paths. Filesystem orientation remains available where supported.
- Secure metadata/filesystem operations require the supported POSIX ownership and descriptor controls. Native PHP extraction falls back when hard isolation is unavailable.
- Large analyses may return explicit partial results. Open the dashboard using its newly printed private link for each launch.
- After updating the installed package, run
init-agent mapandinit-agent sync; restart the MCP host so it loads the new process. Existing running processes are not upgraded by publishing this release.
Validation
- 313 committed tests in the release CI suite, plus local benchmark and graph-quality guards and optional native PHP isolation checks on Linux/Python 3.11–3.13.
- 346 tests exercised in the complete local working copy, including 33 experimental tests outside this release (two platform/optional-dependency checks skipped locally).
- Real-repository map, incremental refresh, query, context, trace, export, estimate, reading plans, MCP stdio, and loopback dashboard checks passed. Six-query trace comparison retained 15/16 expected files in the Top 10; the remaining file ranked 28.