release: v1.5.1 — Phase 3+4 complete, DX/trust/excellence

Phase 3 (Developer Experience and Trust):
- P3-1: benchmarks/METHODOLOGY.md with full reproducibility details
- P3-2: token savings labeled as estimates (estimate_method in _meta);
  search_text raw_bytes now counts only files with matches
- P3-3: VALID_KINDS frozenset in symbols.py; kind enum updated with
  template+import; server-side validation rejects unknown kinds
- P3-4/P3-5: CI matrix now includes windows-latest and Python 3.13
- P3-6: test_load_v3_index_without_imports upgrade path test
- P3-7: TROUBLESHOOTING.md with 11 common failure scenarios
- P3-8: has_source_file returns False for empty source_files
- P3-9: optional bearer token auth for HTTP transport (JCODEMUNCH_HTTP_TOKEN)
- P3-10: JCODEMUNCH_REDACT_SOURCE_ROOT env var

Phase 4 (Excellence):
- P4-1: estimate_method field in all _meta envelopes
- P4-2: SHA-256 checksum sidecars for index integrity verification
- P4-3: schema validation on index load (rejects missing required fields)
- P4-4: GitHub rate limit retry with exponential backoff in fetch_repo_tree
- P4-5: removed duplicate [test] dep group from pyproject.toml
- P4-6: CI switched to uv with uv.lock for reproducible builds

Maintenance:
- M1/M3: maintenance practices documented in CLAUDE.md
- M2: version history sorted ascending
- M4: fixed FLUSH_INTERVAL docstring (said 10, actual is 3)

Removed TODO.md (all items complete). 604 tests pass.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

release: v1.5.0 — production hardening (TODO.md Phase 1-2)

Security: ReDoS protection in search_text, symlink-safe temp files,
cross-process file locking (filelock), SSRF prevention for API base URLs.

Performance: bounded heap search O(n log k), metadata sidecars for
list_repos, LRU index cache with mtime invalidation, streaming file
indexing (peak memory drops from ~1GB to ~500KB).

Quality: consolidated skip patterns (single source of truth),
BaseSummarizer base class (deduplicates _build_prompt/_parse_response),
exception logging in all silent catch blocks, HTTP transport deps as
optional extras.

Tests: +13 new tests (search_columns, get_context_bundle, ReDoS hardening).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

release: v1.4.4 — assembly language support (WLA-DX, NASM, GAS, CA65)

Regex-based symbol extraction for .asm/.s/.S/.inc/.65816/.z80/.spc/.6502
files covering four assembler dialects:
- WLA-DX: .section, .ramsection, .macro, .define/.def, .struct, .enum, .proc
- NASM/YASM: section, %define, %macro, equ, struc
- GAS: .set/.equ, .macro, labels
- CA65: .segment, .proc, .macro, .define, = constants

Symbol mapping: labels→function, sections→class, macros→function,
constants→constant, structs→type, enum members→constant.
Local _-prefixed labels excluded. Docstrings from preceding ; comments.
Import extraction for .include/.incbin/%include.

27 tests covering all four dialects. Real-world validated on a 50+ file
SNES project (65816/WLA-DX). Contributed by astrobleem (PR #105).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: additive flush in token_tracker prevents cross-process savings loss

_flush_locked was overwriting the on-disk total with self._total (this
process's in-memory view), so concurrent MCP instances clobbered each
other's accumulated savings at flush time. Changed to additive write:

    data["total_tokens_saved"] = data.get("total_tokens_saved", 0) + self._unflushed

Each process now only contributes its own unflushed delta, making
concurrent flushes safe in the common case. Reported in PR #103.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

release: v1.4.2 — XML name/key symbol extraction (closes #102)

Extend _parse_xml_symbols to recognise name and key as identity
attributes alongside the existing id check.  Priority: id > name > key;
first match wins so elements with multiple identity attrs produce one
symbol.  qualified_name now encodes tag::value (e.g. block::foundationConcrete,
action_sequence::resetAccountState) so the element type is preserved and
searchable.  Covers all patterns reported in #102: repeated named child
elements under a root container, progression/attribute trees, gameevents,
buffs, items, recipes, entity groups, etc.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat: add CLI interface and README onboarding fix (v1.4.1)

- cli/cli.py: minimal 47-line CLI over the shared ~/.code-index/ store;
  covers all jMRI ops (list, index, outline, search, get, text, file, invalidate)
- cli/README.md: explains why MCP is the preferred interface (context
  continuity, _meta cost ledger, ecosystem direction), documents CLI usage
- README.md: add "Step 3: Tell Claude to actually use it" section with
  copy-pasteable CLAUDE.md snippets — addresses the most common onboarding failure
- Bump version to 1.4.1

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat: OpenAPI support, AHK hotkeys/#HotIf, public benchmark corpus (v…

…1.3.9 + v1.4.0)

v1.3.9 — OpenAPI / Swagger support
- Index .openapi.yaml/.yml/.json, .swagger.yaml/.yml/.json, and well-known
  basenames (openapi.yaml, swagger.json, etc.) regardless of directory
- Extracts: API info block, paths as function symbols, schema definitions
  as class symbols, reusable component schemas
- get_language_for_path: basename check before compound-extension matching
- "openapi" added to search_symbols language filter enum

v1.4.0 — AHK hotkey/HotIf indexing + public benchmark corpus
- AutoHotkey: index hotkey definitions (F1::, #n::, #n::Run "notepad")
  as kind="constant" at top level
- AutoHotkey: index #HotIf directives (opening expression + bare reset)
- benchmarks/tasks.json: tool-agnostic public task corpus (5 tasks × 3 repos)
- benchmarks/README.md: full methodology docs + how to benchmark other tools
- benchmarks/results.md: canonical tiktoken results (95.0%, 20.2x, 15 runs)
- benchmarks/harness/run_benchmark.py: load tasks from tasks.json when present
- Remove obsolete v0.2.22 proxy-based benchmark files

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat: OpenAPI support, AHK hotkeys/#HotIf, public benchmark corpus (v…

…1.3.9 + v1.4.0)

v1.3.9 — OpenAPI / Swagger support
- Index .openapi.yaml/.yml/.json, .swagger.yaml/.yml/.json, and well-known
  basenames (openapi.yaml, swagger.json, etc.) regardless of directory
- Extracts: API info block, paths as function symbols, schema definitions
  as class symbols, reusable component schemas
- get_language_for_path: basename check before compound-extension matching
- "openapi" added to search_symbols language filter enum

v1.4.0 — AHK hotkey/HotIf indexing + public benchmark corpus
- AutoHotkey: index hotkey definitions (F1::, #n::, #n::Run "notepad")
  as kind="constant" at top level
- AutoHotkey: index #HotIf directives (opening expression + bare reset)
- benchmarks/tasks.json: tool-agnostic public task corpus (5 tasks × 3 repos)
- benchmarks/README.md: full methodology docs + how to benchmark other tools
- benchmarks/results.md: canonical tiktoken results (95.0%, 20.2x, 15 runs)
- benchmarks/harness/run_benchmark.py: load tasks from tasks.json when present
- Remove obsolete v0.2.22 proxy-based benchmark files

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

chore: bump version to 1.3.8 (get_context_bundle)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

chore: bump version to 1.3.7 (C# properties/events/destructors)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>