Commits

Commit history

1. Commits on Aug 30, 2026

   • fix: cover the project scope component boundary with a discriminating fixture

     vitali87

     committed
     da5e714View commit details

     Copy full SHA for da5e714

     View code at this pointBrowse repository at this point

   • fix: bind MCP per-request project scope into its own query tool so filtering precedes the row cap and truncation (#1508)

     vitali87

     committed
     fc9b272View commit details

     Copy full SHA for fc9b272

     View code at this pointBrowse repository at this point
2. Commits on Aug 29, 2026

   • fix: refuse an unscopable query BEFORE it reaches the graph (#1494)

     Show description for 6208dab
     vitali87

     committed
     6208dabView commit details

     Copy full SHA for 6208dab

     View code at this pointBrowse repository at this point

   • fix: an aggregate excuses only itself, not the rest of its projection term (#1494)

     vitali87

     committed
     f4fcb62View commit details

     Copy full SHA for f4fcb62

     View code at this pointBrowse repository at this point

   • fix: remove overlapping quantifiers from the aggregate-operand pattern (#1494)

     vitali87

     committed
     a482e17View commit details

     Copy full SHA for a482e17

     View code at this pointBrowse repository at this point

   • fix: require every aggregate operand to be a bindable alias (#1494)

     vitali87

     committed
     dc94c57View commit details

     Copy full SHA for dc94c57

     View code at this pointBrowse repository at this point

   • fix: refuse wildcard aggregates and regex restrictions in scoped queries (#1494)

     vitali87

     committed
     88d1475View commit details

     Copy full SHA for 88d1475

     View code at this pointBrowse repository at this point

   • fix: require the scoped WHERE clause to be a plain conjunction instead of blacklisting operators (#1494)

     vitali87

     committed
     2068d11View commit details

     Copy full SHA for 2068d11

     View code at this pointBrowse repository at this point

   • fix: refuse negated and unbindable aggregates that defeat the project restriction (#1494)

     vitali87

     committed
     4275cadView commit details

     Copy full SHA for 4275cad

     View code at this pointBrowse repository at this point

   • fix: detect a disjunction on word boundaries so a newline OR cannot bypass the scope guard (#1494)

     vitali87

     committed
     1808819View commit details

     Copy full SHA for 1808819

     View code at this pointBrowse repository at this point

   • fix: cut trailing Cypher clauses on any whitespace so a newline ORDER BY cannot fake evidence (#1494)

     vitali87

     committed
     0a9a4b5View commit details

     Copy full SHA for 0a9a4b5

     View code at this pointBrowse repository at this point

   • fix: refuse a disjunction that makes the project restriction optional (#1494)

     vitali87

     committed
     f32c2deView commit details

     Copy full SHA for f32c2de

     View code at this pointBrowse repository at this point

   • fix: bind aggregate restrictions to the active project and require a qualified name for attribution (#1494)

     vitali87

     committed
     0c50213View commit details

     Copy full SHA for 0c50213

     View code at this pointBrowse repository at this point

   • refactor: reuse the inert-text pattern for comment stripping instead of a second regex (#1494)

     vitali87

     committed
     db84d99View commit details

     Copy full SHA for db84d99

     View code at this pointBrowse repository at this point
3. Commits on Aug 28, 2026

   • fix: fail closed on values the project filter cannot inspect (#1494)

     vitali87

     committed
     3aabe7fView commit details

     Copy full SHA for 3aabe7f

     View code at this pointBrowse repository at this point

   • fix: strip comments before checking a query restricts to the project (#1494)

     vitali87

     committed
     39b0db4View commit details

     Copy full SHA for 39b0db4

     View code at this pointBrowse repository at this point

   • fix: refuse property aggregates over aliases the query never restricts (#1494)

     vitali87

     committed
     b550ab1View commit details

     Copy full SHA for b550ab1

     View code at this pointBrowse repository at this point
4. Commits on Aug 27, 2026

   • fix: the restriction must constrain the alias being counted

     Show description for 3a49068
     vitali87

     committed
     3a49068View commit details

     Copy full SHA for 3a49068

     View code at this pointBrowse repository at this point

   • fix: an AGGREGATED entity must carry its qualified name too

     Show description for 527e1b4
     vitali87

     committed
     527e1b4View commit details

     Copy full SHA for 527e1b4

     View code at this pointBrowse repository at this point

   • fix: inspect dict KEYS too; the docstring's "every value" was false

     Show description for 462efda
     vitali87

     committed
     462efdaView commit details

     Copy full SHA for 462efda

     View code at this pointBrowse repository at this point

   • fix: default-deny on query STRUCTURE instead of enumerating bypasses

     Show description for 82651cc
     vitali87

     committed
     82651ccView commit details

     Copy full SHA for 82651cc

     View code at this pointBrowse repository at this point

   • fix: require the literal project name to authorise a scoped aggregate

     Show description for 1cbb799
     vitali87

     committed
     1cbb799View commit details

     Copy full SHA for 1cbb799

     View code at this pointBrowse repository at this point

   • fix: a Cypher comment is not project evidence either

     Show description for be92141
     vitali87

     committed
     be92141View commit details

     Copy full SHA for be92141

     View code at this pointBrowse repository at this point

   • docs: reattach three comments to the regexes they describe

     Show description for cb89ed4
     vitali87

     committed
     cb89ed4View commit details

     Copy full SHA for cb89ed4

     View code at this pointBrowse repository at this point

   • fix: three more scoping bypasses, all textual-matching artefacts

     Show description for 7ad5249
     vitali87

     committed
     7ad5249View commit details

     Copy full SHA for 7ad5249

     View code at this pointBrowse repository at this point

   • fix: require every projected entity to carry its own qualified name

     Show description for 0ba9ee9
     vitali87

     committed
     0ba9ee9View commit details

     Copy full SHA for 0ba9ee9

     View code at this pointBrowse repository at this point

   • fix: bind an aggregate's restriction to the REQUESTED project

     Show description for 6d4e2b2
     vitali87

     committed
     6d4e2b2View commit details

     Copy full SHA for 6d4e2b2

     View code at this pointBrowse repository at this point

   • docs: correct two docstrings that described pre-fix behaviour

     Show description for dccac0c
     vitali87

     committed
     dccac0cView commit details

     Copy full SHA for dccac0c

     View code at this pointBrowse repository at this point

   • fix: type the scoping filter with ResultRow, not dict[str, object]

     Show description for e9d9686
     vitali87

     committed
     e9d9686View commit details

     Copy full SHA for e9d9686

     View code at this pointBrowse repository at this point

   • fix: evidence must be a projected property, and aggregates leak magnitude

     Show description for 661983c
     vitali87

     committed
     661983cView commit details

     Copy full SHA for 661983c

     View code at this pointBrowse repository at this point

   • fix: five scoping holes found in review

     Show description for 05bce96
     vitali87

     committed
     05bce96View commit details

     Copy full SHA for 05bce96

     View code at this pointBrowse repository at this point

   • fix: close the scoping leak for rows keyed on anything but qualified_name

     Show description for aafc643
     vitali87

     committed
     aafc643View commit details

     Copy full SHA for aafc643

     View code at this pointBrowse repository at this point

   • feat: scope MCP retrieval to one project per request

     Show description for 0fe030c
     vitali87

     committed
     0fe030cView commit details

     Copy full SHA for 0fe030c

     View code at this pointBrowse repository at this point
5. Commits on May 15, 2026

   • feat(query): guard against unbounded Cypher path queries with validator, memory hint, and timeout

     vitali87

     committed
     cb2794cView commit details

     Copy full SHA for cb2794c

     View code at this pointBrowse repository at this point
6. Commits on Mar 21, 2026

   • feat: add token-based truncation for Cypher query results (closes #165)

     vitali87

     committed
     ddae753View commit details

     Copy full SHA for ddae753

     View code at this pointBrowse repository at this point