v0.2.1

A flag is not consent

Starting a project MCP server runs whatever that repo's .mcp.json names. The rule has always been that standing in the directory is consent, because your own session starts the same command every turn — and a --cwd flag is not.

The check asked a looser question: is either path inside the other. So a target sitting underneath the working directory read as the monorepo case:

cd ~/projects && context-tax --cwd ./just-cloned   # ran the clone's servers

No session in ~/projects ever loads that file. Found by pointing 0.2.0 at seven freshly cloned repositories — one declared uvx arxiv-mcp-server, and the run tried to start it thirty seconds after git clone. Three HTTP servers from another clone were handshaked for the same reason.

Trust is now anchored on the project root the servers were resolved for. Both real monorepo directions keep working — pointing up at the root from a package, or down at a package from the root — and a nested checkout, which is its own project and never yours, is refused.

The rule moved into trust.ts because it could not be tested where it was: index.ts dispatches at module scope, so importing it runs the CLI. That is why no test could have caught this, and there are nine now.

A fix named a file you could not open

The line telling you which settings file to edit was clamped at three lines, like the diagnostic prose above it. On a deep path the … ate the path — the actionable half of the one actionable line. Two characters shorter and it survived.

The path is now printed whole, $HOME collapses to ~ so the usual one fits on a single line, and a path too long even for that starts on its own line. It still hard wraps rather than overhanging: every screen fits the window it was given is asserted in a test.

Also

1 memory files. A row that counts to one now says so.

Not breaking

Patch, not minor. api.ts is untouched, no exported type changed, and the new module is internal.

Full notes in CHANGELOG.md.

npx context-tax