v0.1.4 — fix --write no longer corrupts TypeScript

A correctness release. Two of these are the kind you upgrade for rather than read about — both were present in v0.1.3.

Fixed

fix --write corrupted TypeScript source. (#117) Five fixers emitted Python # comments regardless of the file being edited, so on a .ts file they wrote lines that are a syntax error — and the tool reported success on its way out. Your file stopped parsing.

  # TODO(mcp-migrate): replaced by an explicit handle argument, see ...   ← v0.1.3
  // TODO(mcp-migrate): replaced by an explicit handle argument, see ...  ← v0.1.4

The prefix is now derived from the file once, in fixers/base.py, instead of being remembered correctly by each fixer. Also covers .mts/.cts/.mjs/.cjs, which the scanner reads and the one previously-correct fixer missed. Thanks @Vicky-Jha.

Every TypeScript project exited 2. (#98) 2 means "could not check", so a breaking finding could not fail a CI build. Exit codes are now derived from findings whenever files were actually read; 2 is reserved for trees where nothing was read at all. TypeScript drops into CI as of this release. Thanks @iphonekumar.

R010 could be silenced by a comment. (#113) A # TODO: server/discover is not implemented yet satisfied the "does this project already implement it?" check — the more clearly you documented the gap, the more certain R010 was that there wasn't one. Thanks @waterlemonnn.

R018/R019 were blind to the TypeScript SDK schema names. (#99) A server using the low-level SDK writes server.setRequestHandler(ListTasksRequestSchema, ...) and never writes the wire string, so a wire-only search saw nothing — the tool stayed silent on exactly the servers most likely to be broken. Thanks @waterlemonnn.

R003 re-ran a whole-project scan inside its per-file loop — quadratic, and caught by the new complexity guard on its first run. Thanks @s35153.

Added

• R017 reads TypeScript, taking coverage to 17 of 21 rules. Thanks @waterlemonnn.
• Live badge endpoints — the registry now generates shields.io endpoint documents, so a badge reports the grade at request time instead of the grade at the moment someone pasted a URL. Monorepos report the worst grade of their servers, because "something in here is an F" is the fact a reader needs. Thanks @djubx.
• A regression guard against quadratic scans that counts search_* calls rather than timing them — so it cannot flake on shared CI runners. Thanks @s35153.

Known issues

• TypeScript is scanned but not graded — still Python-only: R002, R013, R014, R021.
• Three false-positive classes remain: #87, #88, #89. Treat a finding as a prompt to look, not a verdict.
• R017 discards its own re.IGNORECASE (#123), so it misses "Resource Not Found".

Contributors

@Vicky-Jha, @iphonekumar, @waterlemonnn, @s35153, @djubx — plus @li2631026381-alt, whose closed PR surfaced #123.

Every fix in this release came from outside the repo.

uvx mcp-migrate@0.1.4 check .