feat: stability upgrades, smart watcher, and professional refinements

[ThaRealJozef]

Hey!!
Loving this MCP server, but I ran into a couple of annoying issues while using it on my laptop (intense CPU usage and some pathing crashes). I decided to dive in and fix them to make the experience smoother.

Here is what I changed:

1. The "Smart Watcher" (Performance Fix)

The original file watcher was a bit too eager—it triggered a re-index on every single file save. If I was typing fast or switching branches, my CPU would spike and freeze the IDE.
The Fix:
I implemented a Debounced Queue in features/index-codebase.js.

• It now waits for 10 seconds of silence (you stop typing) before it starts indexing.
• Added a 60s Safety Valve so the index doesn't get too stale if you never stop working.
• Added Concurrency Guards so it never tries to index twice at the same time (no race conditions).
  Result: My laptop is silent now, and the index still stays up to date.

2. Information Security & Robustness (New!)

I hardened the server against common vulnerabilities and edge cases.

• Command Injection Mitigation: Switched from exec to execFile for Windows attribute commands, preventing shell injection attacks.
• Strict Input Validation: Added robust validation to the configure_workspace tool to prevent crashes from malformed JSON or missing arguments.
• Strict Env Parsing: Environment variables (like SMART_CODING_BATCH_SIZE) are now strictly parsed as numbers or strings, avoiding "magic" type coercion bugs.
• Privacy First: Configuration files now use absolute paths internally but are stored relative to the project, and personal paths are scrubbed from the repo.

3. "Zero-Touch" Experience (New!)

The server is now much smarter about startup.

• Auto-Detection: It defaults to the current working directory (process.cwd()) if no workspace is provided.
• Help Command: Added index.js --help for usage instructions.
• Robust CLI: improved handling of --workspace arguments, including quoted paths and paths with = signs.

4. Crash Prevention

The server used to crash hard if a client sent an unexpanded variable like ${workspaceFolder} in the args.

• I added a check in index.js to catch this.
• Now it logs a warning: "[Wait] Workspace variable not expanded..." and falls back to a safe default instead of killing the process.

5. New Tool: configure_workspace

I added a new tool so we can fix the workspace path at runtime.

• If the server starts in the wrong folder, you don't have to restart it.
• Just ask the Agent: "Switch workspace to C:/My/Project" and it handles it dynamically.
• Now returns specific error messages (e.g., "Permission Denied" vs "Directory Not Found").

6. Better Logs

Added some loud-and-clear === INDEXING STARTED === logs so you actually know when it's working in the background.

---

Checked everything locally and it makes the whole workflow much snappier and safer. Hope this helps others too!

[ondrejnebesky]

I love the workspace detection in this PR. The MCP tool is great, but can be tricky using it in multiple projects