Sync server src/test/dist to dd/sqlite-annotation-cache tip

Brings in all review feedback fixes (FTS safety, offset-only LIMIT,
cache limit param, int/positive Zod schemas, store lifecycle fix)
and the rebuilt dist.

Author: data-douser

server/dist/codeql-development-mcp-server.js

@@ -4,9 +4,8 @@
 
 import { executeCodeQLCommand } from './cli-executor';
 import { logger } from '../utils/logger';
-import { writeFileSync, readFileSync, statSync } from 'fs';
+import { closeSync, fstatSync, mkdirSync, openSync, readFileSync, writeFileSync } from 'fs';
 import { dirname, isAbsolute } from 'path';
-import { mkdirSync } from 'fs';
 
 export interface QueryEvaluationResult {
   success: boolean;
@@ -37,7 +36,11 @@ export type BuiltInEvaluator = keyof typeof BUILT_IN_EVALUATORS;
 /**
  * In-memory cache for extracted query metadata, keyed by file path.
  * Stores the file modification time to invalidate when the file changes.
+ * Bounded to {@link METADATA_CACHE_MAX} entries; least-recently-used entries
+ * (by access) are evicted when the limit is reached. Entries are refreshed
+ * on cache hits via delete+set, so Map iteration order reflects LRU state.
  */
+const METADATA_CACHE_MAX = 256;
 const metadataCache = new Map<string, { mtime: number; metadata: QueryMetadata }>();
 
 /**
@@ -46,15 +49,23 @@ const metadataCache = new Map<string, { mtime: number; metadata: QueryMetadata }
  */
 export async function extractQueryMetadata(queryPath: string): Promise<QueryMetadata> {
   try {
-    // Check cache with mtime validation
-    const stat = statSync(queryPath);
-    const mtime = stat.mtimeMs;
-    const cached = metadataCache.get(queryPath);
-    if (cached && cached.mtime === mtime) {
-      return cached.metadata;
+    // Open once, then fstat + read via the fd to avoid TOCTOU race (CWE-367).
+    const fd = openSync(queryPath, 'r');
+    let queryContent: string;
+    let mtime: number;
+    try {
+      mtime = fstatSync(fd).mtimeMs;
+      const cached = metadataCache.get(queryPath);
+      if (cached && cached.mtime === mtime) {
+        // Refresh position in Map to implement true LRU behavior.
+        metadataCache.delete(queryPath);
+        metadataCache.set(queryPath, cached);
+        return cached.metadata;
+      }
+      queryContent = readFileSync(fd, 'utf-8');
+    } finally {
+      closeSync(fd);
     }
-
-    const queryContent = readFileSync(queryPath, 'utf-8');
     const metadata: QueryMetadata = {};
 
     // Extract metadata from comments using regex patterns
@@ -75,6 +86,11 @@ export async function extractQueryMetadata(queryPath: string): Promise<QueryMeta
       metadata.tags = tagsMatch[1].split(/\s+/).filter(t => t.length > 0);
     }
 
+    // Evict oldest entries when the cache exceeds the size limit.
+    if (metadataCache.size >= METADATA_CACHE_MAX) {
+      const firstKey = metadataCache.keys().next().value;
+      if (firstKey !== undefined) metadataCache.delete(firstKey);
+    }
     metadataCache.set(queryPath, { mtime, metadata });
     return metadata;
   } catch (error) {

server/dist/codeql-development-mcp-server.js.map

@@ -9,8 +9,7 @@
 import { basename, dirname } from 'path';
 import { mkdirSync, readFileSync } from 'fs';
 import { createHash } from 'crypto';
-import { executeCodeQLCommand, CLIExecutionResult } from './cli-executor';
-import { getActualCodeqlVersion } from './cli-executor';
+import { CLIExecutionResult, executeCodeQLCommand, getActualCodeqlVersion } from './cli-executor';
 import { evaluateQueryResults, extractQueryMetadata, QueryEvaluationResult } from './query-results-evaluator';
 import { resolveQueryPath } from './query-resolver';
 import { sessionDataManager } from './session-data-manager';

server/src/lib/cli-tool-registry.ts

@@ -1,6 +1,6 @@
 /**
  * Session Data Management
- * Provides session lifecycle management backed by SqliteStore (sql.js WASM)
+ * Provides session lifecycle management backed by SqliteStore (sql.js asm.js)
  */
 
 import { mkdirSync, writeFileSync } from 'fs';
@@ -45,10 +45,18 @@ export class SessionDataManager {
 
   /**
    * Initialize the database and ensure it's properly set up.
-   * Must be awaited before any session operations (sql.js WASM init is async).
+   * Must be awaited before any session operations (sql.js init is async).
    */
   async initialize(): Promise<void> {
     try {
+      // (Re)create the store if storageLocation changed since construction
+      // (e.g. via updateConfig or test mocks), closing the previous store first.
+      const storageDir = this.getConfig().storageLocation;
+      if (storageDir !== this.storageDir) {
+        this.store.close();
+        this.storageDir = storageDir;
+        this.store = new SqliteStore(this.storageDir);
+      }
       await this.store.initialize();
       const count = this.store.countSessions();
       logger.info(`Session data manager initialized with ${count} sessions`);