@bitbonsai/mcpvault 0.11.3 → 0.11.4

package/dist/src/pathfilter.d.ts

@@ -4,6 +4,14 @@ export declare class PathFilter {
     private allowedExtensions;
     constructor(config?: Partial<PathFilterConfig>);
     private simpleGlobMatch;
+    /**
+     * Canonicalize a path for restricted-directory matching. On Windows the
+     * filesystem strips trailing dots and spaces from each path segment, so
+     * ".git." and ".git " both resolve to ".git". Fold those away (and collapse
+     * "./" / duplicate separators) before matching the deny-list, otherwise the
+     * restriction can be bypassed with an equivalent name.
+     */
+    private canonicalizeForMatch;
     isAllowed(path: string): boolean;
     isAllowedForListing(path: string): boolean;
     private isIgnoredPath;

package/dist/src/pathfilter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pathfilter.d.ts","sourceRoot":"","sources":["../../src/pathfilter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,qBAAa,UAAU;IACrB,OAAO,CAAC,eAAe,CAAW;IAClC,OAAO,CAAC,iBAAiB,CAAW;gBAExB,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC;IAuB9C,OAAO,CAAC,eAAe;IAkBvB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAyBhC,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAY1C,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,MAAM;IA0Bd,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE;CAGvC"}
+{"version":3,"file":"pathfilter.d.ts","sourceRoot":"","sources":["../../src/pathfilter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,qBAAa,UAAU;IACrB,OAAO,CAAC,eAAe,CAAW;IAClC,OAAO,CAAC,iBAAiB,CAAW;gBAExB,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC;IAuB9C,OAAO,CAAC,eAAe;IAoBvB;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAQ5B,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAyBhC,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAY1C,OAAO,CAAC,aAAa;IAmBrB,OAAO,CAAC,MAAM;IA0Bd,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE;CAGvC"}

package/dist/src/pathfilter.js

@@ -33,9 +33,25 @@ export class PathFilter {
             .replace(/\\\?/g, '[^/]'); // ? matches single character except / (unescape)
         // Ensure we match the full path
         regexPattern = '^' + regexPattern + '$';
-        const regex = new RegExp(regexPattern);
+        // Case-insensitive: on case-insensitive filesystems (macOS, Windows) the OS
+        // resolves ".Git" to ".git", so the deny-list must match regardless of case.
+        const regex = new RegExp(regexPattern, 'i');
         return regex.test(path);
     }
+    /**
+     * Canonicalize a path for restricted-directory matching. On Windows the
+     * filesystem strips trailing dots and spaces from each path segment, so
+     * ".git." and ".git " both resolve to ".git". Fold those away (and collapse
+     * "./" / duplicate separators) before matching the deny-list, otherwise the
+     * restriction can be bypassed with an equivalent name.
+     */
+    canonicalizeForMatch(normalizedPath) {
+        return normalizedPath
+            .split('/')
+            .filter(seg => seg !== '' && seg !== '.')
+            .map(seg => seg.replace(/[. ]+$/, ''))
+            .join('/');
+    }
     isAllowed(path) {
         if (typeof path !== "string") {
             throw new Error("path is required and must be a string");
@@ -64,9 +80,14 @@ export class PathFilter {
         return !this.isIgnoredPath(normalizedPath);
     }
     isIgnoredPath(normalizedPath) {
+        // Match against the canonical form so case- and trailing dot/space-variants
+        // (".Git/config", ".git./config", ".git /config") cannot bypass the deny-list
+        // on case-insensitive / Windows filesystems.
+        const canonicalPath = this.canonicalizeForMatch(normalizedPath);
         // Check if path matches any ignored pattern
         for (const pattern of this.ignoredPatterns) {
-            if (this.simpleGlobMatch(pattern, normalizedPath)) {
+            if (this.simpleGlobMatch(pattern, normalizedPath) ||
+                this.simpleGlobMatch(pattern, canonicalPath)) {
                 return true;
             }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bitbonsai/mcpvault",
-  "version": "0.11.3",
+  "version": "0.11.4",
   "description": "Universal AI bridge for Obsidian vaults - connect any MCP-compatible assistant",
   "homepage": "https://mcpvault.org",
   "author": "bitbonsai",