release: v1.108.163 — license-key transport hardening (WS-8) + benchmark integrity (WS-7)

WS-8 (audit V12): validate.php checks POST the key in the request body;
starter-pack downloads carry it in the X-JCM-License header. The key never
rides a URL query string, so it can't land in server/proxy access logs.
Each path keeps a one-shot legacy fallback keyed to the exact pre-deploy
backend error signature, so ship order can't lock out a paying customer.
Also fixes install-pack rendering every 4xx JSON error as a network failure.

WS-7 (audit V1): benchmarks/results.md regenerated at v1.108.163 against
same-day re-indexes (99.6% aggregate, per-query 99.1-99.9%); README headline
reconciled to the same figure (stale 95% capped-index table replaced);
METHODOLOGY + provenance measured.json updated in lockstep (drift-guard
green); harness dead get_file_content_text fallback fixed; token baseline
v1.108.163 captured so analyze_perf(compare_release=) resolves.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: jgravelle

CHANGELOG.md

@@ -2,6 +2,43 @@
 
 All notable changes to jcodemunch-mcp are documented here.
 
+## [1.108.163] - 2026-07-23 - License-key transport hardening: key never rides the URL (audit WS-8)
+
+### Security
+- **License validation POSTs the key in the request body** (`org/license.py`).
+  The key previously traveled as a GET query parameter to the validation
+  endpoint, where it could land in server/proxy/CDN access logs. The check now
+  sends a form-encoded POST; a one-shot legacy GET fallback fires only on the
+  exact missing-parameter signature an older backend produces, so a deploy-order
+  gap can't lock out a paying customer (a genuine key rejection never retries).
+- **Starter-pack downloads carry the key in the `X-JCM-License` header**
+  (`cli/install_pack.py`) instead of `&license=` in the URL, with the same
+  narrowly-keyed one-shot legacy fallback.
+
+### Fixed
+- `install-pack` no longer reports every license/pack error as "Could not reach
+  the starter packs server": the API returns those as 4xx + JSON, and the old
+  `raise_for_status()` converted them into a bogus network error before the
+  real message could be shown. Transport failures still report as unreachable.
+
+### Benchmarks (audit WS-7 — benchmark integrity)
+- Regenerated `benchmarks/results.md` at v1.108.163 against same-day re-indexes
+  of the three canonical repos (express 172 / fastapi 1,000 / gin 109 files):
+  **99.6% aggregate reduction** (5,799,695 baseline tokens → 25,220), per-query
+  range 99.1–99.9%. The hand-written A/B test sections are preserved verbatim.
+- Reconciled the README headline to the single current figure: the stale
+  "95% average" table (from an old 34-file capped express index) is replaced by
+  the regenerated full-index numbers, so README, `benchmarks/results.md`,
+  `benchmarks/METHODOLOGY.md`, and `benchmarks/provenance/measured.json` now
+  all quote the same 99.6% aggregate. "95%+" floor phrasing elsewhere is
+  unchanged (conservative floor, still true).
+- Fixed the benchmark harness's dead baseline fallback: `measure_baseline`
+  called nonexistent `store.get_file_content_text(...)`; it now uses the real
+  `store.get_file_content(...)` reader.
+- Captured `benchmarks/token_baselines/v1.108.163.json` so
+  `analyze_perf(compare_release="1.108.163")` resolves a real comparison
+  instead of a baseline-missing error.
+
 ## [1.108.162] - 2026-07-23 - Canonical handoff contract: finalize_handoff + munch://handoff/<id> (#374)
 
 ### Added

README.md

@@ -4,7 +4,7 @@
 
 > **Real results, live from production**
 > **335B+ tokens saved** · **48,000+ developers** · **$1.69M+ in AI spend avoided** · **40,000+ kg CO₂ prevented**
-> Live telemetry at **[jcodemunch.com](https://jcodemunch.com/)** — benchmark: **95% average token reduction** (15 tasks / 3 repos, 99.8% peak).
+> Live telemetry at **[jcodemunch.com](https://jcodemunch.com/)** — benchmark: **99.6% average token reduction** (15 tasks / 3 repos, 99.9% peak; run 2026-07-23).
 
 Works with **Autohand Code**, **Claude Code**, **Cursor**, **VS Code**, **Codex CLI**, **Continue**, **Windsurf**, and any MCP-compatible client.
 
@@ -203,12 +203,12 @@ Measured with `tiktoken cl100k_base` across three public repos. Workflow: `searc
 
 | Repository | Files | Symbols | Baseline tokens | jCodeMunch tokens | Reduction |
 |------------|------:|--------:|----------------:|------------------:|----------:|
-| expressjs/express | 34 | 117 | 73,838 | ~1,300 avg | **98.4%** |
-| fastapi/fastapi | 156 | 1,359 | 214,312 | ~15,600 avg | **92.7%** |
-| gin-gonic/gin | 40 | 805 | 84,892 | ~1,730 avg | **98.0%** |
-| **Grand total (15 task-runs)** | | | **1,865,210** | **92,515** | **95.0%** |
+| expressjs/express | 172 | 182 | 143,355 | ~1,040 avg | **99.3%** |
+| fastapi/fastapi | 1,000 | 6,722 | 823,784 | ~2,490 avg | **99.7%** |
+| gin-gonic/gin | 109 | 1,502 | 192,800 | ~1,510 avg | **99.2%** |
+| **Grand total (15 task-runs)** | | | **5,799,695** | **25,220** | **99.6%** |
 
-Per-query results range from 79.7% (dense FastAPI router query) to 99.8% (sparse context-bind query on Express). The 95% figure is the aggregate. Run `python benchmarks/harness/run_benchmark.py` to reproduce.
+Per-query results range from 99.1% to 99.9%. The 99.6% figure is the aggregate (run 2026-07-23, v1.108.163, full un-capped indexes). Run `python benchmarks/harness/run_benchmark.py` to reproduce.
 
 ### A/B test on production codebase
 
@@ -379,7 +379,7 @@ Everything jCodeMunch does beyond answering a tool call is listed here. All of i
 - **Local index storage.** Indexes live at `~/.code-index/` (override with `CODE_INDEX_PATH`). Delete the directory and every trace of indexing is gone.
 - **Live session journal.** While the server runs, it periodically writes a small `_session_live.json` in `~/.code-index/` recording the files and searches the agent touched this session (paths and query strings only, no file contents). It exists so the out-of-process PreCompact hook can restore session orientation after context compaction. Throttled, atomically written, overwritten in place; disable with `JCODEMUNCH_LIVE_JOURNAL=0`.
 - **User-invoked network calls.** A few commands you run explicitly reach the network. None run in the background or fire on a plain import; each happens only when you invoke the command:
-  - **License validation.** `license`, `org-rollup`, and `install-pack --license` send your license key to `validate.php` on `j.gravelle.us` to confirm it. This gates only the team `org-rollup` feature; the individual tools never call it.
+  - **License validation.** `license`, `org-rollup`, and `install-pack --license` send your license key to `validate.php` on `j.gravelle.us` to confirm it. The key travels in the request body / a header, never the URL, so it can't land in intermediary access logs. This gates only the team `org-rollup` feature; the individual tools never call it.
   - **Starter-pack download.** `install-pack` fetches the pack catalog and any pre-built index pack you request from `j.gravelle.us` (a premium pack also sends your license key).
   - **Embedding-model download.** `download-model` — and the first semantic encode when the `[local-embed]` extra is installed — downloads the ONNX model (`all-MiniLM-L6-v2`, ~23 MB, one time) from `huggingface.co`; after that, semantic search needs no network.
 
@@ -1060,7 +1060,7 @@ suite stays usable in plan mode.
 **How much can I save on Claude / Opus tokens?**
 In retrieval-heavy workflows, code-reading tokens typically drop **95%+** because
 the agent fetches exact symbols instead of brute-reading whole files — benchmarked
-at a 95% average reduction across 15 tasks / 3 repositories, with peaks of 99.8%
+at a 99.6% average reduction across 15 tasks / 3 repositories, with peaks of 99.9%
 on large repos. Compact [MUNCH](SPEC_MUNCH.md) encoding then trims another ~45%
 off the wire. Full methodology and harness: [TOKEN_SAVINGS.md](TOKEN_SAVINGS.md)
 and [benchmarks/](benchmarks/).

benchmarks/METHODOLOGY.md

@@ -17,9 +17,9 @@ jcodemunch's standard skip patterns (node_modules, __pycache__, etc.).
 
 | Repository | Files Indexed | Symbols Extracted | Baseline Tokens |
 |------------|:------------:|:-----------------:|:--------------:|
-| expressjs/express | 165 | 181 | 137,978 |
-| fastapi/fastapi | 951 | 5,325 | 699,425 |
-| gin-gonic/gin | 98 | 1,489 | 187,018 |
+| expressjs/express | 172 | 182 | 143,355 |
+| fastapi/fastapi | 1,000 | 6,722 | 823,784 |
+| gin-gonic/gin | 109 | 1,502 | 192,800 |
 
 ## Query Corpus
 
@@ -145,11 +145,11 @@ details.
 ## Common Misreadings
 
 **"The claim is up to 99%."**
-The primary claim is **99.6% average** across all 15 task-runs (5,122,105 baseline tokens →
-19,406 jCodeMunch tokens). Individual queries reach 99.9% on large repos with tight symbol
-matches (e.g., `error exception` on fastapi/fastapi: 99.9%, 801x). The 99.6% aggregate
-is the honest headline across the current index state (express 165 files, fastapi 951 files,
-gin 98 files; run 2026-03-28).
+The primary claim is **99.6% average** across all 15 task-runs (5,799,695 baseline tokens →
+25,220 jCodeMunch tokens). Individual queries reach 99.9% on large repos with tight symbol
+matches (e.g., `error exception` on fastapi/fastapi). The 99.6% aggregate
+is the honest headline across the current index state (express 172 files, fastapi 1,000 files,
+gin 109 files; run 2026-07-23, v1.108.163, repos re-indexed same day).
 
 **"I tested a different repo and got 80%."**
 Results vary by repo structure. Flat script collections (e.g., a repository of hundreds

benchmarks/harness/run_benchmark.py

@@ -127,7 +127,9 @@ def measure_baseline(store: IndexStore, owner: str, name: str) -> dict:
             content = abs_path.read_text(encoding="utf-8", errors="replace")
         except Exception:
             try:
-                content = store.get_file_content_text(owner, name, rel_path) or ""
+                # Store-backed fallback (the real reader; the old
+                # get_file_content_text name never existed → dead fallback).
+                content = store.get_file_content(owner, name, rel_path, index) or ""
             except Exception:
                 content = ""
         total_tokens += count_tokens(content)

benchmarks/provenance/measured.json

@@ -3,10 +3,10 @@
   "token_reduction": {
     "average_pct": 99.6,
     "task_runs": 15,
-    "baseline_tokens": 5122105,
-    "jcodemunch_tokens": 19406,
+    "baseline_tokens": 5799695,
+    "jcodemunch_tokens": 25220,
     "tokenizer": "cl100k_base",
-    "run_date": "2026-03-28",
+    "run_date": "2026-07-23",
     "methodology": "benchmarks/METHODOLOGY.md",
     "results": "benchmarks/results.md"
   },

benchmarks/results.md

@@ -1,98 +1,97 @@
 # jcodemunch-mcp -- Token Efficiency Benchmark
 
 **Tokenizer:** `cl100k_base` (tiktoken)  
-**Workflow:** `search_symbols` (top 5) + `get_symbol_source` x 3
+**Workflow:** `search_symbols` (top 5) + `get_symbol` x 3  
 **Baseline:** all source files concatenated (minimum for "open every file" agent)  
+**Run:** 2026-07-23, jcodemunch-mcp v1.108.163 (repos re-indexed same day)  
 
 ## expressjs/express
 
 | Metric | Value |
 |--------|-------|
-| Files indexed | **165** |
-| Symbols extracted | **181** |
-| Baseline tokens (all files) | **137,978** |
+| Files indexed | **172** |
+| Symbols extracted | **182** |
+| Baseline tokens (all files) | **143,355** |
 
 | Query | Baseline tokens | jMunch tokens | Reduction | Ratio |
 |-------|---------------------:|-------------------:|----------:|------:|
-| `router route handler` | 137,978 | 886 | **99.4%** | 155.7x |
-| `middleware` | 137,978 | 1,008 | **99.3%** | 136.9x |
-| `error exception` | 137,978 | 859 | **99.4%** | 160.6x |
-| `request response` | 137,978 | 872 | **99.4%** | 158.2x |
-| `context bind` | 137,978 | 993 | **99.3%** | 139.0x |
-| **Average** | — | — | **99.4%** | **150.1x** |
+| `router route handler` | 143,355 | 1,342 | **99.1%** | 106.8x |
+| `middleware` | 143,355 | 1,284 | **99.1%** | 111.6x |
+| `error exception` | 143,355 | 1,167 | **99.2%** | 122.8x |
+| `request response` | 143,355 | 1,193 | **99.2%** | 120.2x |
+| `context bind` | 143,355 | 209 | **99.9%** | 685.9x |
+| **Average** | — | — | **99.3%** | **229.5x** |
 
 <details><summary>Query detail (search + fetch tokens, latency)</summary>
 
 | Query | Search&nbsp;tokens | Fetch&nbsp;tokens | Hits&nbsp;fetched | Search&nbsp;ms |
 |-------|-----------------:|------------------:|------------------:|---------------:|
-| `router route handler` | 381 | 505 | 3 | 6.2 |
-| `middleware` | 370 | 638 | 3 | 0.2 |
-| `error exception` | 362 | 497 | 3 | 7.1 |
-| `request response` | 372 | 500 | 3 | 0.5 |
-| `context bind` | 372 | 621 | 3 | 0.3 |
+| `router route handler` | 543 | 799 | 3 | 33.8 |
+| `middleware` | 495 | 789 | 3 | 1.2 |
+| `error exception` | 493 | 674 | 3 | 17.3 |
+| `request response` | 527 | 666 | 3 | 2.3 |
+| `context bind` | 209 | 0 | 0 | 5.6 |
 
 </details>
 
 ## fastapi/fastapi
 
 | Metric | Value |
 |--------|-------|
-| Files indexed | **951** |
-| Symbols extracted | **5,325** |
-| Baseline tokens (all files) | **699,425** |
+| Files indexed | **1,000** |
+| Symbols extracted | **6,722** |
+| Baseline tokens (all files) | **823,784** |
 
 | Query | Baseline&nbsp;tokens | jMunch&nbsp;tokens | Reduction | Ratio |
 |-------|---------------------:|-------------------:|----------:|------:|
-| `router route handler` | 699,425 | 1,199 | **99.8%** | 583.3x |
-| `middleware` | 699,425 | 1,643 | **99.8%** | 425.7x |
-| `error exception` | 699,425 | 873 | **99.9%** | 801.2x |
-| `request response` | 699,425 | 4,439 | **99.4%** | 157.6x |
-| `context bind` | 699,425 | 1,016 | **99.9%** | 688.4x |
-| **Average** | — | — | **99.8%** | **531.2x** |
+| `router route handler` | 823,784 | 1,608 | **99.8%** | 512.3x |
+| `middleware` | 823,784 | 1,837 | **99.8%** | 448.4x |
+| `error exception` | 823,784 | 1,231 | **99.9%** | 669.2x |
+| `request response` | 823,784 | 4,689 | **99.4%** | 175.7x |
+| `context bind` | 823,784 | 3,103 | **99.6%** | 265.5x |
+| **Average** | — | — | **99.7%** | **414.2x** |
 
 <details><summary>Query detail (search + fetch tokens, latency)</summary>
 
 | Query | Search&nbsp;tokens | Fetch&nbsp;tokens | Hits&nbsp;fetched | Search&nbsp;ms |
 |-------|-----------------:|------------------:|------------------:|---------------:|
-| `router route handler` | 464 | 735 | 3 | 131.4 |
-| `middleware` | 460 | 1,183 | 3 | 0.3 |
-| `error exception` | 383 | 490 | 3 | 0.7 |
-| `request response` | 430 | 4,009 | 3 | 12.0 |
-| `context bind` | 402 | 614 | 3 | 0.4 |
+| `router route handler` | 605 | 1,003 | 3 | 776.0 |
+| `middleware` | 556 | 1,281 | 3 | 1.5 |
+| `error exception` | 514 | 717 | 3 | 1.8 |
+| `request response` | 548 | 4,141 | 3 | 16.8 |
+| `context bind` | 556 | 2,547 | 3 | 1.9 |
 
 </details>
 
 ## gin-gonic/gin
 
 | Metric | Value |
 |--------|-------|
-| Files indexed | **98** |
-| Symbols extracted | **1,489** |
-| Baseline tokens (all files) | **187,018** |
+| Files indexed | **109** |
+| Symbols extracted | **1,502** |
+| Baseline tokens (all files) | **192,800** |
 
 | Query | Baseline&nbsp;tokens | jMunch&nbsp;tokens | Reduction | Ratio |
 |-------|---------------------:|-------------------:|----------:|------:|
-| `router route handler` | 187,018 | 1,151 | **99.4%** | 162.5x |
-| `middleware` | 187,018 | 1,130 | **99.4%** | 165.5x |
-| `error exception` | 187,018 | 818 | **99.6%** | 228.6x |
-| `request response` | 187,018 | 1,083 | **99.4%** | 172.7x |
-| `context bind` | 187,018 | 1,436 | **99.2%** | 130.2x |
-| **Average** | — | — | **99.4%** | **171.9x** |
+| `router route handler` | 192,800 | 1,568 | **99.2%** | 123.0x |
+| `middleware` | 192,800 | 1,726 | **99.1%** | 111.7x |
+| `error exception` | 192,800 | 1,099 | **99.4%** | 175.4x |
+| `request response` | 192,800 | 1,530 | **99.2%** | 126.0x |
+| `context bind` | 192,800 | 1,634 | **99.2%** | 118.0x |
+| **Average** | — | — | **99.2%** | **130.8x** |
 
 <details><summary>Query detail (search + fetch tokens, latency)</summary>
 
 | Query | Search&nbsp;tokens | Fetch&nbsp;tokens | Hits&nbsp;fetched | Search&nbsp;ms |
 |-------|-----------------:|------------------:|------------------:|---------------:|
-| `router route handler` | 440 | 711 | 3 | 43.5 |
-| `middleware` | 371 | 759 | 3 | 5.7 |
-| `error exception` | 345 | 473 | 3 | 0.8 |
-| `request response` | 387 | 696 | 3 | 0.8 |
-| `context bind` | 391 | 1,045 | 3 | 7.9 |
+| `router route handler` | 522 | 1,046 | 3 | 155.2 |
+| `middleware` | 441 | 1,285 | 3 | 15.4 |
+| `error exception` | 464 | 635 | 3 | 1.8 |
+| `request response` | 671 | 859 | 3 | 1.7 |
+| `context bind` | 490 | 1,144 | 3 | 18.1 |
 
 </details>
 
----
-
 ## Real-world A/B test: naming audit task (2026-03-18)
 
 50-iteration test by @Mharbulous comparing JCodeMunch vs native tools (Grep/Glob/Read) on a real Vue 3 + Firebase production codebase. Full report: [ab-test-naming-audit-2026-03-18.md](ab-test-naming-audit-2026-03-18.md)
@@ -132,9 +131,9 @@ Raw data: https://gist.github.com/Mharbulous/bb097396fa92ef1d34d03a72b56b2c61
 
 | | Tokens |
 |--|-------:|
-| Baseline total (15 task-runs) | 5,122,105 |
-| jMunch total | 19,406 |
+| Baseline total (15 task-runs) | 5,799,695 |
+| jMunch total | 25,220 |
 | **Reduction** | **99.6%** |
-| **Ratio** | **263.9x** |
+| **Ratio** | **230.0x** |
 
-> Measured with tiktoken `cl100k_base`. Baseline = all indexed source files. jMunch = search_symbols (top 5) + get_symbol_source x 3 per query.
+> Measured with tiktoken `cl100k_base`. Baseline = all indexed source files. jMunch = search_symbols (top 5) + get_symbol x 3 per query.

benchmarks/token_baselines/v1.108.163.json

@@ -0,0 +1,20 @@
+{
+  "version": "1.108.163",
+  "captured_at": "2026-07-23T18:57:47+00:00",
+  "session": {
+    "session_calls": 16,
+    "session_tokens_saved": 380286,
+    "session_duration_s": 1.8
+  },
+  "tools": {
+    "search_symbols": {
+      "tokens_saved": 132876
+    },
+    "get_symbol_source": {
+      "tokens_saved": 244668
+    },
+    "get_file_outline": {
+      "tokens_saved": 2742
+    }
+  }
+}

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "jcodemunch-mcp"
-version = "1.108.162"
+version = "1.108.163"
 description = "Token-efficient MCP server for source code exploration via tree-sitter AST parsing"
 readme = "README.md"
 requires-python = ">=3.10"

src/jcodemunch_mcp/cli/install_pack.py

@@ -59,6 +59,22 @@ def resolve_effective_license_key(explicit: Optional[str]) -> Optional[str]:
         return None
 
 
+def _looks_like_missing_license_response(resp) -> bool:
+    """True only for the exact answer a pre-header backend gives a licensed-pack
+    request whose key rode the X-JCM-License header it doesn't read: the
+    no-license 403. A real key rejection says "Invalid or expired license."
+    and must NOT retry over the legacy query string."""
+    if "application/json" not in resp.headers.get("content-type", ""):
+        return False
+    try:
+        data = resp.json()
+    except Exception:
+        return False
+    if not isinstance(data, dict):
+        return False
+    return "requires a jcodemunch license" in (data.get("error") or "").lower()
+
+
 def _mask_license(key: str) -> str:
     """Mask a license key for display: first 4 + last 4 chars."""
     if len(key) <= 8:
@@ -136,22 +152,40 @@ def _install_pack(
         print(f"  Pack '{pack_id}' is already installed. Use --force to re-download.")
         return 0
 
-    # Build download URL
+    # Build download URL. The license key travels in the X-JCM-License header,
+    # NEVER the URL query string, so it can't land in server/proxy access logs
+    # (audit finding V12).
     url = f"{STARTER_PACK_API}?action=download&pack={pack_id}"
-    if license_key:
-        url += f"&license={license_key}"
+    headers = {"X-JCM-License": license_key} if license_key else None
 
     print(f"  Downloading starter pack '{pack_id}'...", flush=True)
+    # No raise_for_status: the API reports license/pack errors as 4xx + JSON
+    # (handled below); raising on them rendered every one as a bogus
+    # "could not reach the server". Only transport failures are unreachable.
     try:
-        resp = httpx.get(url, timeout=120, follow_redirects=True)
-        resp.raise_for_status()
+        resp = httpx.get(url, timeout=120, follow_redirects=True, headers=headers)
     except httpx.HTTPError:
         print(
             f"  {_RED}{_CROSS} Could not reach the starter packs server. "
             f"Check your network connection.{_RESET}",
         )
         return 1
 
+    # Transitional: a backend that predates header support never saw the key
+    # and answers a licensed pack with its no-license 403. Retry ONCE over the
+    # legacy query-string transport so a paying customer isn't punished by a
+    # deploy-order gap. Remove once the deployed API is confirmed header-aware.
+    if license_key and _looks_like_missing_license_response(resp):
+        legacy_url = url + f"&license={license_key}"
+        try:
+            resp = httpx.get(legacy_url, timeout=120, follow_redirects=True)
+        except httpx.HTTPError:
+            print(
+                f"  {_RED}{_CROSS} Could not reach the starter packs server. "
+                f"Check your network connection.{_RESET}",
+            )
+            return 1
+
     content_type = resp.headers.get("content-type", "")
 
     # Error response (JSON)