chore(release): 1.3.3

Author: PatrickSys

.gitmodules

@@ -1,4 +1,5 @@
 [submodule "internal-docs"]
 	path = internal-docs
 	url = https://github.com/PatrickSys/codebase-context-internal.git
+	update = none
 

CHANGELOG.md

@@ -1,6 +1,18 @@
 # Changelog
 
 
+## [1.3.3] - 2026-01-18
+
+### Fixed
+- **Security**: Resolve `pnpm audit` advisories by updating `hono` to 4.11.4 and removing the vulnerable `diff` transitive dependency (replaced `ts-node` with `tsx` for `pnpm dev`).
+
+### Changed
+- **Docs**: Clarify private `internal-docs/` submodule setup, add `npx --yes` tip, document `CODEBASE_ROOT`, and list `get_indexing_status` tool.
+- **Submodule**: Disable automatic updates for `internal-docs` (`update = none`).
+
+### Removed
+- **Dev**: Remove local-only `test-context.cjs` helper script.
+
 ## [1.3.2] - 2026-01-16
 
 ### Changed

CONTRIBUTING.md

@@ -10,9 +10,11 @@ pnpm build
 
 ```
 
+Note: this repo references a private submodule at `internal-docs/`. If you don't have access, clone without `--recurse-submodules` or ignore submodule update errors.
+
 ## Using the Package
 
-This is an MCP server, not a CLI tool. See [README.md](./README.md) for configuration with Claude Desktop, VS Code, Cursor, etc.
+See [README.md](./README.md) for configuration with Claude Desktop, VS Code, Cursor, etc.
 
 ## Project Structure
 

README.md

@@ -17,6 +17,8 @@ Add this to your MCP client config (Claude Desktop, VS Code, Cursor, etc.).
 }
 ```
 
+If your environment prompts on first run, use `npx --yes ...` (or `npx -y ...`) to auto-confirm.
+
 ## What You Get
 
 - **Internal library discovery** → `@mycompany/ui-toolkit`: 847 uses vs `primeng`: 3 uses
@@ -56,6 +58,7 @@ Now the agent checks patterns automatically instead of waiting for you to ask.
 | `get_component_usage` | Find where a library/component is used |
 | `get_team_patterns` | Pattern frequencies + canonical examples |
 | `get_codebase_metadata` | Project structure overview |
+| `get_indexing_status` | Indexing progress + last stats |
 | `get_style_guide` | Query style guide rules |
 | `detect_circular_dependencies` | Find import cycles between files |
 | `refresh_index` | Re-index the codebase |
@@ -67,6 +70,7 @@ Now the agent checks patterns automatically instead of waiting for you to ask.
 |----------|---------|-------------|
 | `EMBEDDING_PROVIDER` | `transformers` | `openai` (fast, cloud) or `transformers` (local, private) |
 | `OPENAI_API_KEY` | - | Required if provider is `openai` |
+| `CODEBASE_ROOT` | - | Project root to index (CLI arg takes precedence) |
 | `CODEBASE_CONTEXT_DEBUG` | - | Set to `1` to enable verbose logging (startup messages, analyzer registration) |
 
 ## Performance Note

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codebase-context",
-  "version": "1.3.2",
+  "version": "1.3.3",
   "description": "MCP server that helps AI agents understand your codebase - patterns, libraries, architecture, monorepo support",
   "type": "module",
   "main": "./dist/lib.js",
@@ -76,7 +76,7 @@
     "build": "tsc",
     "prepublishOnly": "pnpm run build",
     "start": "node dist/index.js",
-    "dev": "ts-node src/index.ts",
+    "dev": "tsx src/index.ts",
     "watch": "tsc -w",
     "test": "vitest run",
     "test:watch": "vitest",
@@ -92,6 +92,7 @@
     "@xenova/transformers": "^2.17.0",
     "fuse.js": "^7.0.0",
     "glob": "^10.3.10",
+    "hono": "4.11.4",
     "ignore": "^5.3.1",
     "typescript": "^5.3.3",
     "uuid": "^9.0.1",
@@ -109,7 +110,7 @@
     "eslint-plugin-import": "^2.32.0",
     "globals": "^17.0.0",
     "prettier": "^3.7.4",
-    "ts-node": "^10.9.2",
+    "tsx": "^4.21.0",
     "typescript-eslint": "^8.51.0",
     "vitest": "^4.0.16"
   },