Security fixes, new MCP tools, and quality improvements

[tomehb]

Summary

This PR includes critical security fixes, new features, and quality improvements for the translator-ai MCP server.

Security Fixes (Critical)

Command Injection Vulnerability - The MCP server used exec() with string interpolation, allowing arbitrary command execution:

// BEFORE (vulnerable)
const cmd = `translator-ai ${inputFile} -l ${targetLanguage}`;
await execAsync(cmd);  // Injection possible!

// AFTER (secure)
await execFileAsync('translator-ai', [inputFile, '-l', targetLanguage]);

Changes:

• Replace exec() with execFile() - no shell interpretation
• Add input validation for file paths and language codes
• Use argument arrays instead of string interpolation

New Features

3 New MCP Tools

Tool	Description
detect_language	Detect source language of a JSON file
validate_translation	Verify translated file has all keys from source
translate_string	Translate a single text string

Context Parameter

• All translation tools now accept a context parameter for cultural adaptation
• Example: "Use formal Spanish, Latin American dialect"

Provider/Model Info

• MCP responses now show which AI provider and model was used
• Example: Provider: gemini | Model: gemini-3-flash-preview

Bug Fixes

• Fix uninitialized variable in ollama.ts extraction strategies
• Remove outdated @ts-ignore in gemini.ts (type now exists in SDK v0.24.1)
• Fix path validation rejecting valid {lang} placeholder in output paths

Configuration & Tests

• Rename jest.config.js → jest.config.cjs for ESM compatibility
• Add moduleNameMapper to resolve .js imports in tests
• Update npm start to use compiled dist (fixes integration tests)
• All 139 tests passing

Documentation

• Add npm link instructions for MCP server development setup
• Document all 5 MCP tools with examples
• Add fork notice with funding link for original developer

Attribution

This PR was developed with AI assistance (Claude Code). All changes have been human-reviewed and tested