@edda-business/mcp 0.69.0 → 0.69.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@edda-business/mcp",
-  "version": "0.69.0",
+  "version": "0.69.2",
   "description": "Edda — the company data layer for AI agents.",
   "license": "Apache-2.0",
   "publishConfig": {

package/src/server.js

@@ -62,18 +62,26 @@ const norm = (s) => String(s ?? "").trim().toLowerCase().replace(/\.md$/, "");
 async function resolvePathToId(path) {
   const list = await get("/v2/company/pages");
   const pages = list?.pages ?? [];
-  const base = norm(String(path).split("/").pop());
+  const segs = String(path).split("/").map((x) => x.trim()).filter(Boolean);
+  const base = norm(segs[segs.length - 1] ?? "");
+  const folderSegs = segs.length > 1 ? segs.slice(0, -1).map(norm) : null;
   let cands = pages.filter((p) => norm(p.name) === base);
-  if (!cands.length) return { error: `No company page named "${String(path).split("/").pop()}". Use search to find the exact path first.` };
+  // EDDA-91: a folder-qualified request MUST honour its folder. The old basename-only match
+  // silently substituted an unrelated same-named page from the caller's visible scope when the
+  // requested folder was out of scope (or misspelled) — an exact read must return THAT document
+  // or a truthful unavailable, never masquerade. The message deliberately does not reveal
+  // whether the path exists for someone else.
+  if (folderSegs) {
+    cands = cands.filter((p) => p.folder && folderSegs.includes(norm(p.folder)));
+  }
+  if (!cands.length) {
+    return { error: folderSegs
+      ? `"${String(path)}" is not available here — it either does not exist or is outside what this seat can read. Use search to see what you can access.`
+      : `No company page named "${String(path).split("/").pop()}". Use search to find the exact path first.` };
+  }
   if (cands.length > 1) {
-    // Prefer a candidate whose folder slug appears in the requested path.
-    const pref = cands.filter((p) => p.folder && norm(path).includes(norm(p.folder)));
-    if (pref.length === 1) return { id: pref[0].id };
-    cands = pref.length ? pref : cands;
-    if (cands.length > 1) {
-      const opts = cands.map((p) => `  • ${[p.folder, p.name].filter(Boolean).join("/")}  (id: ${p.id})`).join("\n");
-      return { error: `Several pages match "${base}". Pass one of these ids as \`id\`:\n${opts}` };
-    }
+    const opts = cands.map((p) => `  • ${[p.folder, p.name].filter(Boolean).join("/")}  (id: ${p.id})`).join("\n");
+    return { error: `Several pages match "${base}". Pass one of these ids as \`id\`:\n${opts}` };
   }
   return { id: cands[0].id };
 }
@@ -225,6 +233,11 @@ export function createServer() {
           for (const pg of recent) lines.push(`  · ${[pg.folder, pg.name].filter(Boolean).join("/")} (${String(pg.updated_at).slice(0, 10)})`);
         }
         lines.push(`\nInbox: ${r?.inbox_pending ?? 0} item(s) waiting.`);
+        const paths = r?.folder_paths ?? [];
+        if (paths.length) {
+          lines.push(`\nFolder tree (use these EXACT paths as destinations — a bare project name creates a NEW top-level project):`);
+          for (const p of paths) lines.push(`  ${p}`);
+        }
         return text(lines.join("\n"));
       } catch (e) {
         const msg = String(e?.message || e);