• Create ticket/issue

Follow the guide to enable codebase context checks.

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status:
Action logging: New filesystem scanning and pattern expansion usage logs counts but does not clearly log
critical actions like individual file indexing decisions or outcomes, which may limit
reconstructing events.

matchedFiles, err := idx.config.GetDocumentFiles()
if err != nil {
	return nil, fmt.Errorf("failed to get document files: %w", err)
}

// Get modification times for all matched files
for _, path := range matchedFiles {
	info, err := os.Stat(path)
	if err != nil {
		fmt.Fprintf(os.Stderr, "[WARN] Error accessing %s: %v\n", path, err)
		continue
	}

	// Store file path and modification time
	fsFiles[path] = info.ModTime()
}

fmt.Fprintf(os.Stderr, "[INFO] Found %d markdown files in filesystem\n", len(fsFiles))

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status:
Error handling: Pattern expansion and directory walking warn and continue on errors (e.g., expandPattern
Walk returns nil on err), which may hide failures without aggregation or actionable
context.

err := filepath.Walk(pattern, func(path string, info os.FileInfo, err error) error {
	if err != nil {
		return nil // Continue despite errors
	}
	if !info.IsDir() && filepath.Ext(path) == ".md" {
		files = append(files, path)
	}
	return nil
})
if err != nil {
	return nil, err
}

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status:
Log verbosity: Logging of full document patterns and base directories may reveal filesystem structure
paths which could be sensitive in some environments.

fmt.Fprintf(os.Stderr, "[INFO] Document patterns: %v\n", cfg.DocumentPatterns)
fmt.Fprintf(os.Stderr, "[INFO] Database path: %s\n", cfg.DBPath)

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status:
Path validation: The updated validatePath allows any path whose relative path does not start with
'.' which could misclassify paths like '..' edge-cases; needs strict
prefix check to avoid traversal across different roots.

func validatePath(filePath string, baseDirs []string) error {
	absPath, err := filepath.Abs(filePath)
	if err != nil {
		return err
	}

	// Check if path is within any of the base directories
	for _, baseDir := range baseDirs {
		absBase, err := filepath.Abs(baseDir)
		if err != nil {
			continue
		}

		relPath, err := filepath.Rel(absBase, absPath)
		if err != nil {
			continue
		}

		// Check if path escapes base directory
		if len(relPath) > 0 && relPath[0] != '.' {
			// Path is within this base directory


 ... (clipped 6 lines)

Replace the custom glob pattern implementation, particularly the logic for ,
with a robust third-party library like github.com/bmatcuk/doublestar. This will
simplify the code in internal/config/config.go and reduce maintenance.**

Examples:

func (c *Config) expandPattern(pattern string) ([]string, error) {
	var files []string

	// Check if pattern looks like a directory (no wildcards and no .md extension)
	if !strings.Contains(pattern, "*") && !strings.Contains(pattern, "?") {
		// Treat as directory - walk it for all .md files
		err := filepath.Walk(pattern, func(path string, info os.FileInfo, err error) error {
			if err != nil {
				return nil // Continue despite errors
			}

 ... (clipped 121 lines)

Solution Walkthrough:

Before:

// internal/config/config.go
func (c *Config) expandPattern(pattern string) ([]string, error) {
	// Check if pattern is a directory vs glob
	if !strings.Contains(pattern, "*") && !strings.Contains(pattern, "?") {
		// Manually walk directory for .md files
		err := filepath.Walk(pattern, ...)
		return files, err
	}

	// Custom handling for **
	if strings.Contains(pattern, "**") {
		return c.expandDoubleStarPattern(pattern)
	}

	// Simple glob
	matches, err := filepath.Glob(pattern)
	// ... filter for .md files
	return files, nil
}

func (c *Config) expandDoubleStarPattern(pattern string) ([]string, error) {
	// Custom implementation for ** glob
	parts := strings.SplitN(pattern, "**", 2)
	// ... walk base directory and match suffix
}

After:

// internal/config/config.go
import "github.com/bmatcuk/doublestar/v4"

func (c *Config) expandPattern(pattern string) ([]string, error) {
	globPattern := pattern
	info, err := os.Stat(pattern)
	// If pattern is a directory, append glob for all markdown files
	if err == nil && info.IsDir() {
		globPattern = filepath.Join(pattern, "**/*.md")
	}

	// Use library for all globbing, including **
	matches, err := doublestar.Glob(os.DirFS("."), globPattern)
	if err != nil {
		return nil, err
	}

	// Filter results to ensure they are markdown files
	// ...
	return files, nil
}

Improve the security of validatePath by checking if the relative path starts
with .. to more reliably prevent path traversal attacks.

internal/mcp/tools.go [363-367]

 // Check if path escapes base directory
-if len(relPath) > 0 && relPath[0] != '.' {
+if !strings.HasPrefix(relPath, "..") {
 	// Path is within this base directory
 	return nil
 }

• Apply / Chat

Replace the custom glob pattern implementation in expandDoubleStarPattern
with a dedicated library like github.com/bmatcuk/doublestar/v4 to simplify the
code and improve correctness.**

internal/config/config.go [235-238]

-// Check if path matches the suffix pattern
-if c.matchesSuffix(path, baseDir, suffix) {
-	files = append(files, path)
-}
+// We can use doublestar to handle the globbing directly.
+// No need to manually walk and match.

• Apply / Chat

In expandPattern, propagate errors from filepath.Walk instead of ignoring them
to ensure issues like permission errors are not silently skipped.

internal/config/config.go [162-178]

 // Check if pattern looks like a directory (no wildcards and no .md extension)
 if !strings.Contains(pattern, "*") && !strings.Contains(pattern, "?") {
 	// Treat as directory - walk it for all .md files
 	err := filepath.Walk(pattern, func(path string, info os.FileInfo, err error) error {
 		if err != nil {
-			return nil // Continue despite errors
+			return err // Propagate errors
 		}
 		if !info.IsDir() && filepath.Ext(path) == ".md" {
 			files = append(files, path)
 		}
 		return nil
 	})
 	if err != nil {
 		return nil, err
 	}
 	return files, nil
 }

• Apply / Chat