@assistant-ui/mcp-docs-server 0.1.31 → 0.1.32

package/dist/utils/paths.js

@@ -1,84 +1,74 @@
-import { readdir, stat } from "node:fs/promises";
-import { join, extname } from "node:path";
-import { DOCS_PATH, MDX_EXTENSION, MD_EXTENSION } from "../constants.js";
+import { DOCS_PATH, MDX_EXTENSION } from "../constants.js";
 import { logger } from "./logger.js";
+import { extname, join } from "node:path";
+import { readdir, stat } from "node:fs/promises";
+//#region src/utils/paths.ts
 const SIMILARITY_THRESHOLDS = {
-    EXACT_MATCH: 1,
-    CONTAINS_MATCH: 0.8,
-    PARTIAL_MATCH: 0.5,
-    MIN_SUGGESTION: 0.3,
+	EXACT_MATCH: 1,
+	CONTAINS_MATCH: .8,
+	PARTIAL_MATCH: .5,
+	MIN_SUGGESTION: .3
 };
-export async function listDirContents(dirPath) {
-    try {
-        const items = await readdir(dirPath, { withFileTypes: true });
-        const directories = items
-            .filter((item) => item.isDirectory())
-            .map((item) => item.name)
-            .filter((name) => !name.startsWith("."))
-            .sort();
-        const files = items
-            .filter((item) => item.isFile() &&
-            (extname(item.name) === MDX_EXTENSION ||
-                extname(item.name) === MD_EXTENSION))
-            .map((item) => item.name)
-            .sort();
-        return { directories, files };
-    }
-    catch (error) {
-        logger.error(`Failed to list directory contents: ${dirPath}`, error);
-        return { directories: [], files: [] };
-    }
+async function listDirContents(dirPath) {
+	try {
+		const items = await readdir(dirPath, { withFileTypes: true });
+		return {
+			directories: items.filter((item) => item.isDirectory()).map((item) => item.name).filter((name) => !name.startsWith(".")).sort(),
+			files: items.filter((item) => item.isFile() && (extname(item.name) === ".mdx" || extname(item.name) === ".md")).map((item) => item.name).sort()
+		};
+	} catch (error) {
+		logger.error(`Failed to list directory contents: ${dirPath}`, error);
+		return {
+			directories: [],
+			files: []
+		};
+	}
 }
-export async function getAvailablePaths() {
-    const paths = [];
-    async function scanDirectory(dir, prefix = "") {
-        const { directories, files } = await listDirContents(dir);
-        for (const file of files) {
-            const name = file.replace(MDX_EXTENSION, "").replace(MD_EXTENSION, "");
-            paths.push(prefix ? `${prefix}/${name}` : name);
-        }
-        for (const subdir of directories) {
-            const subdirPath = join(dir, subdir);
-            const newPrefix = prefix ? `${prefix}/${subdir}` : subdir;
-            paths.push(newPrefix);
-            await scanDirectory(subdirPath, newPrefix);
-        }
-    }
-    await scanDirectory(DOCS_PATH);
-    return paths.sort();
+async function getAvailablePaths() {
+	const paths = [];
+	async function scanDirectory(dir, prefix = "") {
+		const { directories, files } = await listDirContents(dir);
+		for (const file of files) {
+			const name = file.replace(MDX_EXTENSION, "").replace(".md", "");
+			paths.push(prefix ? `${prefix}/${name}` : name);
+		}
+		for (const subdir of directories) {
+			const subdirPath = join(dir, subdir);
+			const newPrefix = prefix ? `${prefix}/${subdir}` : subdir;
+			paths.push(newPrefix);
+			await scanDirectory(subdirPath, newPrefix);
+		}
+	}
+	await scanDirectory(DOCS_PATH);
+	return paths.sort();
 }
-export function findNearestPaths(requestedPath, availablePaths) {
-    const normalizedRequest = requestedPath
-        .toLowerCase()
-        .replace(/[^a-z0-9]/g, "");
-    const scored = availablePaths.map((path) => {
-        const normalizedPath = path.toLowerCase().replace(/[^a-z0-9]/g, "");
-        if (normalizedPath.includes(normalizedRequest)) {
-            return { path, score: SIMILARITY_THRESHOLDS.EXACT_MATCH };
-        }
-        if (normalizedRequest.includes(normalizedPath)) {
-            return { path, score: SIMILARITY_THRESHOLDS.CONTAINS_MATCH };
-        }
-        const overlap = [...normalizedRequest].filter((char) => normalizedPath.includes(char)).length;
-        return {
-            path,
-            score: (overlap / normalizedRequest.length) *
-                SIMILARITY_THRESHOLDS.PARTIAL_MATCH,
-        };
-    });
-    return scored
-        .filter((item) => item.score > SIMILARITY_THRESHOLDS.MIN_SUGGESTION)
-        .sort((a, b) => b.score - a.score)
-        .slice(0, 3)
-        .map((item) => item.path);
+function findNearestPaths(requestedPath, availablePaths) {
+	const normalizedRequest = requestedPath.toLowerCase().replace(/[^a-z0-9]/g, "");
+	return availablePaths.map((path) => {
+		const normalizedPath = path.toLowerCase().replace(/[^a-z0-9]/g, "");
+		if (normalizedPath.includes(normalizedRequest)) return {
+			path,
+			score: SIMILARITY_THRESHOLDS.EXACT_MATCH
+		};
+		if (normalizedRequest.includes(normalizedPath)) return {
+			path,
+			score: SIMILARITY_THRESHOLDS.CONTAINS_MATCH
+		};
+		return {
+			path,
+			score: [...normalizedRequest].filter((char) => normalizedPath.includes(char)).length / normalizedRequest.length * SIMILARITY_THRESHOLDS.PARTIAL_MATCH
+		};
+	}).filter((item) => item.score > SIMILARITY_THRESHOLDS.MIN_SUGGESTION).sort((a, b) => b.score - a.score).slice(0, 3).map((item) => item.path);
 }
-export async function pathExists(path) {
-    try {
-        await stat(path);
-        return true;
-    }
-    catch {
-        return false;
-    }
+async function pathExists(path) {
+	try {
+		await stat(path);
+		return true;
+	} catch {
+		return false;
+	}
 }
+//#endregion
+export { findNearestPaths, getAvailablePaths, listDirContents, pathExists };
+
 //# sourceMappingURL=paths.js.map

package/dist/utils/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/utils/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,MAAM,qBAAqB,GAAG;IAC5B,WAAW,EAAE,CAAC;IACd,cAAc,EAAE,GAAG;IACnB,aAAa,EAAE,GAAG;IAClB,cAAc,EAAE,GAAG;CACX,CAAC;AAEX,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAe;IAInD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAE9D,MAAM,WAAW,GAAG,KAAK;aACtB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;aACpC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;aACxB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;aACvC,IAAI,EAAE,CAAC;QAEV,MAAM,KAAK,GAAG,KAAK;aAChB,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,MAAM,EAAE;YACb,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,aAAa;gBACnC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,YAAY,CAAC,CACzC;aACA,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;aACxB,IAAI,EAAE,CAAC;QAEV,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,sCAAsC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;QACrE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACxC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,UAAU,aAAa,CAC1B,GAAW,EACX,SAAiB,EAAE;QAEnB,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAE1D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YACvE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;YACjC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACrC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,MAAM,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,aAAqB,EACrB,cAAwB;IAExB,MAAM,iBAAiB,GAAG,aAAa;SACpC,WAAW,EAAE;SACb,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAE7B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACzC,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAEpE,IAAI,cAAc,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,qBAAqB,CAAC,WAAW,EAAE,CAAC;QAC5D,CAAC;QAED,IAAI,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,qBAAqB,CAAC,cAAc,EAAE,CAAC;QAC/D,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,GAAG,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACrD,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC9B,CAAC,MAAM,CAAC;QAET,OAAO;YACL,IAAI;YACJ,KAAK,EACH,CAAC,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC;gBACpC,qBAAqB,CAAC,aAAa;SACtC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM;SACV,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,GAAG,qBAAqB,CAAC,cAAc,CAAC;SACnE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SACjC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"paths.js","names":[],"sources":["../../src/utils/paths.ts"],"sourcesContent":["import { readdir, stat } from \"node:fs/promises\";\nimport { join, extname } from \"node:path\";\nimport { DOCS_PATH, MDX_EXTENSION, MD_EXTENSION } from \"../constants.js\";\nimport { logger } from \"./logger.js\";\n\nconst SIMILARITY_THRESHOLDS = {\n  EXACT_MATCH: 1,\n  CONTAINS_MATCH: 0.8,\n  PARTIAL_MATCH: 0.5,\n  MIN_SUGGESTION: 0.3,\n} as const;\n\nexport async function listDirContents(dirPath: string): Promise<{\n  directories: string[];\n  files: string[];\n}> {\n  try {\n    const items = await readdir(dirPath, { withFileTypes: true });\n\n    const directories = items\n      .filter((item) => item.isDirectory())\n      .map((item) => item.name)\n      .filter((name) => !name.startsWith(\".\"))\n      .sort();\n\n    const files = items\n      .filter(\n        (item) =>\n          item.isFile() &&\n          (extname(item.name) === MDX_EXTENSION ||\n            extname(item.name) === MD_EXTENSION),\n      )\n      .map((item) => item.name)\n      .sort();\n\n    return { directories, files };\n  } catch (error) {\n    logger.error(`Failed to list directory contents: ${dirPath}`, error);\n    return { directories: [], files: [] };\n  }\n}\n\nexport async function getAvailablePaths(): Promise<string[]> {\n  const paths: string[] = [];\n\n  async function scanDirectory(\n    dir: string,\n    prefix: string = \"\",\n  ): Promise<void> {\n    const { directories, files } = await listDirContents(dir);\n\n    for (const file of files) {\n      const name = file.replace(MDX_EXTENSION, \"\").replace(MD_EXTENSION, \"\");\n      paths.push(prefix ? `${prefix}/${name}` : name);\n    }\n\n    for (const subdir of directories) {\n      const subdirPath = join(dir, subdir);\n      const newPrefix = prefix ? `${prefix}/${subdir}` : subdir;\n      paths.push(newPrefix);\n      await scanDirectory(subdirPath, newPrefix);\n    }\n  }\n\n  await scanDirectory(DOCS_PATH);\n  return paths.sort();\n}\n\nexport function findNearestPaths(\n  requestedPath: string,\n  availablePaths: string[],\n): string[] {\n  const normalizedRequest = requestedPath\n    .toLowerCase()\n    .replace(/[^a-z0-9]/g, \"\");\n\n  const scored = availablePaths.map((path) => {\n    const normalizedPath = path.toLowerCase().replace(/[^a-z0-9]/g, \"\");\n\n    if (normalizedPath.includes(normalizedRequest)) {\n      return { path, score: SIMILARITY_THRESHOLDS.EXACT_MATCH };\n    }\n\n    if (normalizedRequest.includes(normalizedPath)) {\n      return { path, score: SIMILARITY_THRESHOLDS.CONTAINS_MATCH };\n    }\n\n    const overlap = [...normalizedRequest].filter((char) =>\n      normalizedPath.includes(char),\n    ).length;\n\n    return {\n      path,\n      score:\n        (overlap / normalizedRequest.length) *\n        SIMILARITY_THRESHOLDS.PARTIAL_MATCH,\n    };\n  });\n\n  return scored\n    .filter((item) => item.score > SIMILARITY_THRESHOLDS.MIN_SUGGESTION)\n    .sort((a, b) => b.score - a.score)\n    .slice(0, 3)\n    .map((item) => item.path);\n}\n\nexport async function pathExists(path: string): Promise<boolean> {\n  try {\n    await stat(path);\n    return true;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;AAKA,MAAM,wBAAwB;CAC5B,aAAa;CACb,gBAAgB;CAChB,eAAe;CACf,gBAAgB;AAClB;AAEA,eAAsB,gBAAgB,SAGnC;CACD,IAAI;EACF,MAAM,QAAQ,MAAM,QAAQ,SAAS,EAAE,eAAe,KAAK,CAAC;EAkB5D,OAAO;GAAE,aAhBW,MACjB,QAAQ,SAAS,KAAK,YAAY,CAAC,EACnC,KAAK,SAAS,KAAK,IAAI,EACvB,QAAQ,SAAS,CAAC,KAAK,WAAW,GAAG,CAAC,EACtC,KAYgB;GAAG,OAVR,MACX,QACE,SACC,KAAK,OAAO,MACX,QAAQ,KAAK,IAAI,MAAA,UAChB,QAAQ,KAAK,IAAI,MAAA,MACvB,EACC,KAAK,SAAS,KAAK,IAAI,EACvB,KAEuB;EAAE;CAC9B,SAAS,OAAO;EACd,OAAO,MAAM,sCAAsC,WAAW,KAAK;EACnE,OAAO;GAAE,aAAa,CAAC;GAAG,OAAO,CAAC;EAAE;CACtC;AACF;AAEA,eAAsB,oBAAuC;CAC3D,MAAM,QAAkB,CAAC;CAEzB,eAAe,cACb,KACA,SAAiB,IACF;EACf,MAAM,EAAE,aAAa,UAAU,MAAM,gBAAgB,GAAG;EAExD,KAAK,MAAM,QAAQ,OAAO;GACxB,MAAM,OAAO,KAAK,QAAQ,eAAe,EAAE,EAAE,QAAA,OAAsB,EAAE;GACrE,MAAM,KAAK,SAAS,GAAG,OAAO,GAAG,SAAS,IAAI;EAChD;EAEA,KAAK,MAAM,UAAU,aAAa;GAChC,MAAM,aAAa,KAAK,KAAK,MAAM;GACnC,MAAM,YAAY,SAAS,GAAG,OAAO,GAAG,WAAW;GACnD,MAAM,KAAK,SAAS;GACpB,MAAM,cAAc,YAAY,SAAS;EAC3C;CACF;CAEA,MAAM,cAAc,SAAS;CAC7B,OAAO,MAAM,KAAK;AACpB;AAEA,SAAgB,iBACd,eACA,gBACU;CACV,MAAM,oBAAoB,cACvB,YAAY,EACZ,QAAQ,cAAc,EAAE;CAyB3B,OAvBe,eAAe,KAAK,SAAS;EAC1C,MAAM,iBAAiB,KAAK,YAAY,EAAE,QAAQ,cAAc,EAAE;EAElE,IAAI,eAAe,SAAS,iBAAiB,GAC3C,OAAO;GAAE;GAAM,OAAO,sBAAsB;EAAY;EAG1D,IAAI,kBAAkB,SAAS,cAAc,GAC3C,OAAO;GAAE;GAAM,OAAO,sBAAsB;EAAe;EAO7D,OAAO;GACL;GACA,OANc,CAAC,GAAG,iBAAiB,EAAE,QAAQ,SAC7C,eAAe,SAAS,IAAI,CAC9B,EAAE,SAKa,kBAAkB,SAC7B,sBAAsB;EAC1B;CACF,CAEY,EACT,QAAQ,SAAS,KAAK,QAAQ,sBAAsB,cAAc,EAClE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAChC,MAAM,GAAG,CAAC,EACV,KAAK,SAAS,KAAK,IAAI;AAC5B;AAEA,eAAsB,WAAW,MAAgC;CAC/D,IAAI;EACF,MAAM,KAAK,IAAI;EACf,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF"}

package/dist/utils/security.d.ts

@@ -1,2 +1,5 @@
-export declare function sanitizePath(userPath: string): string;
+//#region src/utils/security.d.ts
+declare function sanitizePath(userPath: string): string;
+//#endregion
+export { sanitizePath };
 //# sourceMappingURL=security.d.ts.map

package/dist/utils/security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/utils/security.ts"],"names":[],"mappings":"AAEA,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAiDrD"}
+{"version":3,"file":"security.d.ts","names":[],"sources":["../../src/utils/security.ts"],"mappings":";iBAEgB,YAAA,CAAa,QAAgB"}

package/dist/utils/security.js

@@ -1,43 +1,22 @@
 import path from "node:path";
-export function sanitizePath(userPath) {
-    if (!userPath || typeof userPath !== "string") {
-        throw new Error("Invalid path: Path must be a non-empty string");
-    }
-    // Check for traversal patterns before normalization - defense in depth
-    if (userPath.includes("../") || userPath.includes("..\\")) {
-        throw new Error("Invalid path: Directory traversal attempt detected");
-    }
-    const normalized = path.normalize(userPath);
-    if (path.isAbsolute(normalized)) {
-        throw new Error("Invalid path: Absolute paths are not allowed");
-    }
-    const relativePath = path.relative("", normalized);
-    if (relativePath.startsWith("..")) {
-        throw new Error("Invalid path: Directory traversal attempt detected");
-    }
-    if (relativePath.includes("..")) {
-        throw new Error("Invalid path: Path contains invalid traversal sequences");
-    }
-    if (relativePath.includes("\0")) {
-        throw new Error("Invalid path: Path contains null bytes");
-    }
-    if (process.platform !== "win32") {
-        if (normalized.includes("\\")) {
-            throw new Error("Invalid path: Backslashes not allowed");
-        }
-    }
-    else {
-        if (normalized.includes(":") || normalized.startsWith("\\\\")) {
-            throw new Error("Invalid path: Path contains invalid Windows characters");
-        }
-    }
-    const segments = relativePath.split(path.sep);
-    for (const segment of segments) {
-        if (segment.startsWith(".") && segment !== ".") {
-            throw new Error("Invalid path: Hidden files are not allowed");
-        }
-    }
-    // Always return Unix-style paths for consistency across platforms
-    return relativePath.replace(/\\/g, "/");
+//#region src/utils/security.ts
+function sanitizePath(userPath) {
+	if (!userPath || typeof userPath !== "string") throw new Error("Invalid path: Path must be a non-empty string");
+	if (userPath.includes("../") || userPath.includes("..\\")) throw new Error("Invalid path: Directory traversal attempt detected");
+	const normalized = path.normalize(userPath);
+	if (path.isAbsolute(normalized)) throw new Error("Invalid path: Absolute paths are not allowed");
+	const relativePath = path.relative("", normalized);
+	if (relativePath.startsWith("..")) throw new Error("Invalid path: Directory traversal attempt detected");
+	if (relativePath.includes("..")) throw new Error("Invalid path: Path contains invalid traversal sequences");
+	if (relativePath.includes("\0")) throw new Error("Invalid path: Path contains null bytes");
+	if (process.platform !== "win32") {
+		if (normalized.includes("\\")) throw new Error("Invalid path: Backslashes not allowed");
+	} else if (normalized.includes(":") || normalized.startsWith("\\\\")) throw new Error("Invalid path: Path contains invalid Windows characters");
+	const segments = relativePath.split(path.sep);
+	for (const segment of segments) if (segment.startsWith(".") && segment !== ".") throw new Error("Invalid path: Hidden files are not allowed");
+	return relativePath.replace(/\\/g, "/");
 }
+//#endregion
+export { sanitizePath };
+
 //# sourceMappingURL=security.js.map

package/dist/utils/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/utils/security.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,uEAAuE;IACvE,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAE5C,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAEnD,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,OAAO,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"security.js","names":[],"sources":["../../src/utils/security.ts"],"sourcesContent":["import path from \"node:path\";\n\nexport function sanitizePath(userPath: string): string {\n  if (!userPath || typeof userPath !== \"string\") {\n    throw new Error(\"Invalid path: Path must be a non-empty string\");\n  }\n\n  // Check for traversal patterns before normalization - defense in depth\n  if (userPath.includes(\"../\") || userPath.includes(\"..\\\\\")) {\n    throw new Error(\"Invalid path: Directory traversal attempt detected\");\n  }\n\n  const normalized = path.normalize(userPath);\n\n  if (path.isAbsolute(normalized)) {\n    throw new Error(\"Invalid path: Absolute paths are not allowed\");\n  }\n\n  const relativePath = path.relative(\"\", normalized);\n\n  if (relativePath.startsWith(\"..\")) {\n    throw new Error(\"Invalid path: Directory traversal attempt detected\");\n  }\n\n  if (relativePath.includes(\"..\")) {\n    throw new Error(\"Invalid path: Path contains invalid traversal sequences\");\n  }\n\n  if (relativePath.includes(\"\\0\")) {\n    throw new Error(\"Invalid path: Path contains null bytes\");\n  }\n\n  if (process.platform !== \"win32\") {\n    if (normalized.includes(\"\\\\\")) {\n      throw new Error(\"Invalid path: Backslashes not allowed\");\n    }\n  } else {\n    if (normalized.includes(\":\") || normalized.startsWith(\"\\\\\\\\\")) {\n      throw new Error(\"Invalid path: Path contains invalid Windows characters\");\n    }\n  }\n\n  const segments = relativePath.split(path.sep);\n  for (const segment of segments) {\n    if (segment.startsWith(\".\") && segment !== \".\") {\n      throw new Error(\"Invalid path: Hidden files are not allowed\");\n    }\n  }\n\n  // Always return Unix-style paths for consistency across platforms\n  return relativePath.replace(/\\\\/g, \"/\");\n}\n"],"mappings":";;AAEA,SAAgB,aAAa,UAA0B;CACrD,IAAI,CAAC,YAAY,OAAO,aAAa,UACnC,MAAM,IAAI,MAAM,+CAA+C;CAIjE,IAAI,SAAS,SAAS,KAAK,KAAK,SAAS,SAAS,MAAM,GACtD,MAAM,IAAI,MAAM,oDAAoD;CAGtE,MAAM,aAAa,KAAK,UAAU,QAAQ;CAE1C,IAAI,KAAK,WAAW,UAAU,GAC5B,MAAM,IAAI,MAAM,8CAA8C;CAGhE,MAAM,eAAe,KAAK,SAAS,IAAI,UAAU;CAEjD,IAAI,aAAa,WAAW,IAAI,GAC9B,MAAM,IAAI,MAAM,oDAAoD;CAGtE,IAAI,aAAa,SAAS,IAAI,GAC5B,MAAM,IAAI,MAAM,yDAAyD;CAG3E,IAAI,aAAa,SAAS,IAAI,GAC5B,MAAM,IAAI,MAAM,wCAAwC;CAG1D,IAAI,QAAQ,aAAa;MACnB,WAAW,SAAS,IAAI,GAC1B,MAAM,IAAI,MAAM,uCAAuC;CAAA,OAGzD,IAAI,WAAW,SAAS,GAAG,KAAK,WAAW,WAAW,MAAM,GAC1D,MAAM,IAAI,MAAM,wDAAwD;CAI5E,MAAM,WAAW,aAAa,MAAM,KAAK,GAAG;CAC5C,KAAK,MAAM,WAAW,UACpB,IAAI,QAAQ,WAAW,GAAG,KAAK,YAAY,KACzC,MAAM,IAAI,MAAM,4CAA4C;CAKhE,OAAO,aAAa,QAAQ,OAAO,GAAG;AACxC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assistant-ui/mcp-docs-server",
-  "version": "0.1.31",
+  "version": "0.1.32",
   "description": "MCP server for assistant-ui documentation and examples",
   "keywords": [
     "mcp",
@@ -37,10 +37,10 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@types/node": "^25.6.0",
-    "tsx": "^4.21.0",
-    "vitest": "^4.1.5",
-    "@assistant-ui/x-buildutils": "0.0.7"
+    "@types/node": "^25.9.1",
+    "tsx": "^4.22.3",
+    "vitest": "^4.1.7",
+    "@assistant-ui/x-buildutils": "0.0.9"
   },
   "publishConfig": {
     "access": "public",

package/.docs/raw/docs/(reference)/api-reference/adapters/feedback-speech.mdx

@@ -1,41 +0,0 @@
----
-title: Feedback and Speech Adapters
-description: Capture message feedback and connect speech or dictation.
----
-
-## Feedback
-
-`FeedbackAdapter` receives message feedback submitted through action primitives or runtime actions.
-
-```tsx
-const runtime = useLocalRuntime(chatModelAdapter, {
-  adapters: {
-    feedback: {
-      submit: async ({ message, type }) => {
-        await fetch("/api/feedback", {
-          method: "POST",
-          body: JSON.stringify({ messageId: message.id, type }),
-        });
-      },
-    },
-  },
-});
-```
-
-## Speech
-
-`SpeechSynthesisAdapter` controls text-to-speech playback. `WebSpeechSynthesisAdapter` provides a browser implementation.
-
-```tsx
-import { WebSpeechSynthesisAdapter } from "@assistant-ui/react";
-
-const runtime = useLocalRuntime(chatModelAdapter, {
-  adapters: {
-    speech: new WebSpeechSynthesisAdapter(),
-  },
-});
-```
-
-## Dictation and Suggestions
-
-Runtime adapters can also provide dictation and suggestion behavior. Dictation powers composer voice input; suggestions power prompt suggestions rendered by thread and suggestion primitives.

package/.docs/raw/docs/(reference)/api-reference/context-providers/text-message-part-provider.mdx

@@ -1,40 +0,0 @@
----
-title: <TextMessagePartProvider />
-description: Context provider for reusing text components outside of message content.
----
-
-The `TextMessagePartProvider` provides data and APIs for `TextMessagePart` components.
-
-This is useful if you want to reuse the same `Text` component outside of a message text, e.g. with the `@assistant-ui/react-markdown` package.
-
-```tsx
-import { TextMessagePartProvider } from "@assistant-ui/react";
-
-const MyApp = () => {
-  return (
-    <TextMessagePartProvider text={"Hello!"}>
-      <MyMarkdownText />
-    </TextMessagePartProvider>
-  );
-};
-```
-
-#### Properties
-
-<ParametersTable
-  type="TextMessagePartProviderProps"
-  parameters={[
-    {
-      name: "text",
-      type: "string",
-      required: true,
-      description: "The text content to provide to child components.",
-    },
-    {
-      name: "isRunning",
-      type: "boolean",
-      required: false,
-      description: "Whether the text is still being streamed. Defaults to false.",
-    },
-  ]}
-/>

package/.docs/raw/docs/(reference)/api-reference/integrations/react-data-stream.mdx

@@ -1,260 +0,0 @@
----
-title: "@assistant-ui/react-data-stream"
-description: Hooks for connecting to data stream protocol endpoints and Assistant Cloud.
----
-
-Data Stream protocol integration for assistant-ui.
-
-
-## API Reference
-
-### `useDataStreamRuntime`
-
-Create a runtime that connects to a data stream protocol endpoint.
-
-```tsx
-import { useDataStreamRuntime } from "@assistant-ui/react-data-stream";
-
-const MyRuntimeProvider = ({ children }: { children: React.ReactNode }) => {
-  const runtime = useDataStreamRuntime({
-    api: "/api/chat",
-  });
-
-  return (
-    <AssistantRuntimeProvider runtime={runtime}>
-      {children}
-    </AssistantRuntimeProvider>
-  );
-};
-```
-
-<ParametersTable
-  parameters={[
-    {
-      name: "api",
-      type: "string",
-      description: "The API endpoint URL for the data stream protocol.",
-    },
-    {
-      name: "protocol",
-      type: '"ui-message-stream" | "data-stream"',
-      description: 'The streaming protocol to use. Defaults to "ui-message-stream". Use "data-stream" for legacy AI SDK compatibility.',
-    },
-    {
-      name: "onData",
-      type: "(data: { type: string; name: string; data: unknown; transient?: boolean }) => void",
-      description: "Optional callback for data-* parts. Only applies when using the ui-message-stream protocol.",
-    },
-    {
-      name: "onResponse",
-      type: "(response: Response) => void | Promise<void>",
-      description: "Optional callback called when a response is received.",
-    },
-    {
-      name: "onFinish",
-      type: "(message: ThreadMessage) => void",
-      description: "Optional callback called when a message is finished.",
-    },
-    {
-      name: "onError",
-      type: "(error: Error) => void",
-      description: "Optional callback called when an error occurs.",
-    },
-    {
-      name: "onCancel",
-      type: "() => void",
-      description: "Optional callback called when a request is cancelled.",
-    },
-    {
-      name: "credentials",
-      type: "RequestCredentials",
-      description: "Optional credentials mode for the fetch request.",
-    },
-    {
-      name: "headers",
-      type: "Record<string, string> | Headers | (() => Promise<Record<string, string> | Headers>)",
-      description: "Optional headers to include in the request.",
-    },
-    {
-      name: "body",
-      type: "object | (() => Promise<object | undefined>)",
-      description: "Optional additional body parameters to include in the request. Can be an object or an async function that returns one.",
-    },
-    {
-      name: "sendExtraMessageFields",
-      type: "boolean",
-      description: "Whether to include extra message fields like IDs in the request.",
-    },
-  ]}
-/>
-
-### `useCloudRuntime`
-
-Create a runtime that connects to Assistant Cloud using the data stream protocol.
-
-```tsx
-import { useCloudRuntime } from "@assistant-ui/react-data-stream";
-
-const MyRuntimeProvider = ({ children }: { children: React.ReactNode }) => {
-  const runtime = useCloudRuntime({
-    cloud: assistantCloud,
-    assistantId: "my-assistant-id",
-  });
-
-  return (
-    <AssistantRuntimeProvider runtime={runtime}>
-      {children}
-    </AssistantRuntimeProvider>
-  );
-};
-```
-
-<ParametersTable
-  parameters={[
-    {
-      name: "cloud",
-      type: "AssistantCloud",
-      description: "The Assistant Cloud instance.",
-    },
-    {
-      name: "assistantId",
-      type: "string",
-      description: "The ID of the assistant to connect to.",
-    },
-    {
-      name: "protocol",
-      type: '"ui-message-stream" | "data-stream"',
-      description: 'The streaming protocol to use. Defaults to "ui-message-stream". Use "data-stream" for legacy AI SDK compatibility.',
-    },
-    {
-      name: "onData",
-      type: "(data: { type: string; name: string; data: unknown; transient?: boolean }) => void",
-      description: "Optional callback for data-* parts. Only applies when using the ui-message-stream protocol.",
-    },
-    {
-      name: "onResponse",
-      type: "(response: Response) => void | Promise<void>",
-      description: "Optional callback called when a response is received.",
-    },
-    {
-      name: "onFinish",
-      type: "(message: ThreadMessage) => void",
-      description: "Optional callback called when a message is finished.",
-    },
-    {
-      name: "onError",
-      type: "(error: Error) => void",
-      description: "Optional callback called when an error occurs.",
-    },
-    {
-      name: "onCancel",
-      type: "() => void",
-      description: "Optional callback called when a request is cancelled.",
-    },
-    {
-      name: "credentials",
-      type: "RequestCredentials",
-      description: "Optional credentials mode for the fetch request.",
-    },
-    {
-      name: "headers",
-      type: "Record<string, string> | Headers | (() => Promise<Record<string, string> | Headers>)",
-      description: "Optional headers to include in the request.",
-    },
-    {
-      name: "body",
-      type: "object | (() => Promise<object | undefined>)",
-      description: "Optional additional body parameters to include in the request. Can be an object or an async function that returns one.",
-    },
-    {
-      name: "sendExtraMessageFields",
-      type: "boolean",
-      description: "Whether to include extra message fields like IDs in the request.",
-    },
-  ]}
-/>
-
-### `toLanguageModelMessages`
-
-Convert assistant-ui messages to AI SDK's `LanguageModelV2Message` format.
-
-<Callout type="info">
-For custom integrations, consider using `toGenericMessages` from `assistant-stream` instead.
-This function is specific to the AI SDK format.
-</Callout>
-
-```tsx
-import { toLanguageModelMessages } from "@assistant-ui/react-data-stream";
-
-const languageModelMessages = toLanguageModelMessages(messages, {
-  unstable_includeId: true,
-});
-```
-
-<ParametersTable
-  parameters={[
-    {
-      name: "messages",
-      type: "readonly ThreadMessage[]",
-      description: "The messages to convert.",
-    },
-    {
-      name: "options",
-      type: "{ unstable_includeId?: boolean }",
-      description: "Optional conversion options.",
-      children: [
-        {
-          type: "{ unstable_includeId?: boolean }",
-          parameters: [
-            {
-              name: "unstable_includeId",
-              type: "boolean",
-              description: "Whether to include message IDs in the converted messages.",
-            },
-          ],
-        },
-      ],
-    },
-  ]}
-/>
-
----
-
-## Framework-Agnostic Utilities
-
-For custom integrations that don't use the AI SDK, use these utilities from `assistant-stream`:
-
-### `toGenericMessages`
-
-Convert thread messages to a framework-agnostic format.
-
-```tsx
-import { toGenericMessages } from "assistant-stream";
-
-const genericMessages = toGenericMessages(messages);
-```
-
-Returns an array of `GenericMessage` which can be one of:
-- `{ role: "system"; content: string }`
-- `{ role: "user"; content: (GenericTextPart | GenericFilePart)[] }`
-- `{ role: "assistant"; content: (GenericTextPart | GenericToolCallPart)[] }`
-- `{ role: "tool"; content: GenericToolResultPart[] }`
-
-### `toToolsJSONSchema`
-
-Convert tool definitions to JSON Schema format.
-
-```tsx
-import { toToolsJSONSchema } from "assistant-stream";
-
-const toolSchemas = toToolsJSONSchema(tools);
-// Returns: Record<string, { description?: string; parameters: JSONSchema7 }>
-```
-
-By default, filters out disabled tools and backend-only tools. Use the `filter` option to customize:
-
-```tsx
-const allTools = toToolsJSONSchema(tools, {
-  filter: () => true, // Include all tools
-});
-```