v0.2.6 - Security Fix: Remove credentials from sdist

Security Fix

Versions 0.2.0–0.2.5 accidentally bundled .claude/settings.local.json into the source distribution (.tar.gz). This file stored API tokens as inline Bash permission patterns used during development.

Impact: Old/revoked tokens were exposed. PyPI detected and revoked the affected token automatically. No active credentials were exposed.

Fix:

• Added .claude/ to .gitignore
• Added [tool.hatch.build.targets.sdist] exclude = [".claude/"] to pyproject.toml

Action taken: All prior releases (0.2.0–0.2.5) should be yanked. Please upgrade to 0.2.6.

No functional code changes in this release.

v0.2.5 - Security Hardening & CLI Fix

What's New

Security Hardening (contributed by @snafu4)

• Path traversal protection: IndexStore now validates all file paths written to and read from the cache directory, preventing escape via ../../ style paths in repository file names or symbol metadata
• Owner/name sanitization: _safe_repo_component() validates repo owner and name against an allowlist pattern before use in filesystem paths
• Hardened in: save_index, get_symbol_content, and incremental_save

CLI Fix

• jcodemunch-mcp --help (-h) now exits cleanly with usage info instead of hanging

New Tests

• Path traversal blocked on raw file writes
• Path traversal blocked on symbol content reads
• Invalid owner/name components rejected
• --help exits with code 0

New Docs

• DEEP_THREAT_MODEL.md: STRIDE-style threat model covering all attack surfaces
• REPO_OVERVIEW_AND_SECURITY_AUDIT.md: High-level security posture overview

v0.2.4 - Doc Updates

Documentation Updates

• SPEC.md: _meta response envelope now documents tokens_saved and total_tokens_saved fields
• ARCHITECTURE.md: Added token_tracker.py to file tree; updated _meta example
• TOKEN_SAVINGS.md: New "Live Token Savings Counter" section explaining real-time per-call and cumulative savings in _meta

No code changes — this release documents the v0.2.4 token savings counter feature.

v0.2.4 - Token Savings Counter

What's New

Real-Time Token Savings Counter

Every tool response now includes _meta.tokens_saved and _meta.total_tokens_saved showing how many tokens were saved compared to reading raw source files directly.

• tokens_saved: Tokens saved by this specific call
• total_tokens_saved: Cumulative tokens saved across all calls (persisted to ~/.code-index/_savings.json)

Works across all tools:

• get_file_outline: raw file size vs sum of symbol byte lengths
• get_symbol / get_symbols: raw file size vs symbol byte length
• get_repo_outline: sum of all file sizes vs metadata-only response
• search_symbols: matched file sizes vs returned symbol byte lengths

Token estimation uses fast os.stat calls only — no extra file reads or API calls.

v0.2.3 - Google Gemini Support

What's New

Google Gemini Support for AI Summaries

The summarizer now supports Google Gemini Flash as an alternative to Claude Haiku for AI-generated symbol summaries.

Provider auto-selection:

• ANTHROPIC_API_KEY set → Claude Haiku (default, takes priority)
• GOOGLE_API_KEY set → Gemini Flash
• Both set → Anthropic wins
• Neither set → docstrings or signature fallback (no change)

Install with Gemini support:

pip install jcodemunch-mcp[gemini]

Standard install (Anthropic only):

pip install jcodemunch-mcp

No code changes required — just set the appropriate API key and the right provider is selected automatically.

Supported Languages

Python, JavaScript, TypeScript, Go, Rust, Java, PHP

v0.2.2 - Bug Fix

Bug Fix

Fix incorrect byte offsets in test_byte_offset_retrieval

Corrects a test-only bug where byte_offset and byte_length were set to wrong values in tests/test_storage.py, causing CI failures on Python 3.11.

• byte_offset: 14 → 12 ("line1\nline2\n" is 12 bytes)
• byte_length: 14 → 19 ("def foo():\n pass" is 19 bytes)

No changes to production code.

v0.2.1 - PHP Language Support

What's New

PHP Language Support

jCodeMunch now indexes PHP codebases natively.

Supported constructs:

• Functions, classes, methods
• Interfaces, traits, enums (as type symbols)
• Constants (const declarations)
• Return type annotations
• PHPDoc /** */ comment extraction
• PHP 8 #[Attribute] decorator syntax

File extensions: .php

Tested against: PHPMailer (55 files, 512 symbols indexed)

Token Savings on PHP Codebases

Benchmarked against PHPMailer — a real-world library where PHPMailer.php alone is ~200KB:

Scenario	Without MCP	With MCP	Savings
API discovery	~63,700 tokens	~3,162 tokens	95%
Fetch one method	~49,888 tokens	~1,575 tokens	97%
Full architecture	~70,414 tokens	~4,162 tokens	94%

Supported Languages

Python, JavaScript, TypeScript, Go, Rust, Java, PHP (new)

v0.2.0 - Production Ready

jCodeMunch MCP v0.2.0

First public release of jCodeMunch MCP — a Model Context Protocol server that dramatically reduces token usage when working with large codebases.

Features

• Index GitHub repos and local folders for fast symbol-level code search
• Extract functions, classes, methods, constants, and types with AI-generated summaries
• Full-text search across indexed file contents
• Supports Python, JavaScript, TypeScript, Go, Rust, and Java
• Persistent local cache for repeated access without re-indexing
• Configurable AI summaries using Claude models

Tools

• index_repo — Index a GitHub repository
• index_folder — Index a local folder
• list_repos — List all indexed repositories
• get_repo_outline — High-level directory and language breakdown
• get_file_tree — Browse the file tree of an indexed repo
• get_file_outline — Get all symbols in a file
• get_symbol / get_symbols — Retrieve full source of specific symbols
• search_symbols — Semantic search across symbols
• search_text — Full-text search across file contents
• invalidate_cache — Force a full re-index

Token Savings

Typical savings of 50–99% compared to loading raw files, depending on the task. See TOKEN_SAVINGS.md for benchmarks.

Installation

See README.md for full setup instructions including Claude Desktop and Claude Code configuration.