@floomhq/floom-mcp-sync 1.0.24 → 1.0.26

package/dist/auto-sync.js

@@ -17,7 +17,37 @@ const HEARTBEAT_MS = 10 * 60 * 1000; // 10 minutes
 const AUTH_WARNING_MS = 10 * 60 * 1000;
 const MANIFEST_SEGMENT_RE = /^[A-Za-z0-9._-]{1,128}$/;
 const PACKAGE_FILE_SEGMENT_RE = /^[A-Za-z0-9._-]{1,128}$/;
-const SUPPORT_DIRS = new Set(["references", "examples", "scripts", "assets"]);
+const SUPPORT_DIRS = new Set([
+    "agents",
+    "assets",
+    "canvas-fonts",
+    "checks",
+    "core",
+    "evidence",
+    "examples",
+    "helpers",
+    "reference",
+    "references",
+    "schemas",
+    "scripts",
+    "spreadsheets",
+    "templates",
+    "tests",
+    "themes",
+]);
+const ROOT_FILE_EXTENSIONS = [
+    ".env.example",
+    ".js",
+    ".json",
+    ".md",
+    ".py",
+    ".sh",
+    ".toml",
+    ".ts",
+    ".txt",
+    ".yaml",
+    ".yml",
+];
 const FD_PATH_ROOT = "/proc/self/fd";
 const PACKAGE_FILE_LIMIT = 100;
 const PACKAGE_TOTAL_BYTES_LIMIT = 1_000_000;
@@ -173,6 +203,8 @@ function normalizePackageFilePath(path) {
     const segments = path.split("/").filter(Boolean);
     if (segments.length === 1 && segments[0] === "SKILL.md")
         return "SKILL.md";
+    if (segments.length === 1 && isAllowedRootPackageFile(segments[0] ?? ""))
+        return segments[0] ?? "";
     const first = segments[0];
     if (segments.length < 2 || first === undefined || !SUPPORT_DIRS.has(first)) {
         throw new Error("Invalid package file path");
@@ -182,6 +214,11 @@ function normalizePackageFilePath(path) {
     }
     return segments.join("/");
 }
+function isAllowedRootPackageFile(name) {
+    if (!name || (name.startsWith(".") && name !== ".env.example"))
+        return false;
+    return ROOT_FILE_EXTENSIONS.some((ext) => name.toLowerCase().endsWith(ext));
+}
 async function planPackageSync(root, files, manifest) {
     let missing = 0;
     let unchanged = 0;

package/dist/lib/manifest.js

@@ -33,13 +33,51 @@ function isEntryForKey(key, value) {
 function isPackageFilePath(packagePath) {
     if (packagePath.length === 1 && packagePath[0] === "SKILL.md")
         return true;
+    if (packagePath.length === 1 && isAllowedRootPackageFile(packagePath[0] ?? ""))
+        return true;
     if (packagePath.length < 2)
         return false;
     const first = packagePath[0];
-    if (first === undefined || !["references", "examples", "scripts", "assets"].includes(first))
+    if (first === undefined || !SUPPORT_DIRS.has(first))
         return false;
     return packagePath.every((segment) => segment !== "." && segment !== ".." && segment.length > 0);
 }
+const SUPPORT_DIRS = new Set([
+    "agents",
+    "assets",
+    "canvas-fonts",
+    "checks",
+    "core",
+    "evidence",
+    "examples",
+    "helpers",
+    "reference",
+    "references",
+    "schemas",
+    "scripts",
+    "spreadsheets",
+    "templates",
+    "tests",
+    "themes",
+]);
+const ROOT_FILE_EXTENSIONS = [
+    ".env.example",
+    ".js",
+    ".json",
+    ".md",
+    ".py",
+    ".sh",
+    ".toml",
+    ".ts",
+    ".txt",
+    ".yaml",
+    ".yml",
+];
+function isAllowedRootPackageFile(name) {
+    if (!name || (name.startsWith(".") && name !== ".env.example"))
+        return false;
+    return ROOT_FILE_EXTENSIONS.some((ext) => name.toLowerCase().endsWith(ext));
+}
 export async function readSyncManifest() {
     try {
         await ensureSyncManifestDir();

package/dist/server.js

@@ -5,7 +5,7 @@ import { autoSync } from "./auto-sync.js";
 import { getSkill } from "./tools/get.js";
 import { searchSkills } from "./tools/search.js";
 import { syncStatus } from "./tools/status.js";
-const SERVER_VERSION = "1.0.24";
+const SERVER_VERSION = "1.0.26";
 const DEFAULT_INTERVAL_MS = 60_000;
 const MIN_INTERVAL_MS = 10_000;
 const SEARCH_TYPES = new Set(["knowledge", "instruction", "workflow", "skill"]);

package/dist/tools/get.js

@@ -6,7 +6,37 @@ const PACKAGE_FILE_LIMIT = 100;
 const PACKAGE_FILE_BYTES_LIMIT = 500_000;
 const PACKAGE_TOTAL_BYTES_LIMIT = 1_000_000;
 const PATH_SEGMENT_RE = /^[A-Za-z0-9._-]{1,128}$/;
-const SUPPORT_DIRS = new Set(["references", "examples", "scripts", "assets"]);
+const SUPPORT_DIRS = new Set([
+    "agents",
+    "assets",
+    "canvas-fonts",
+    "checks",
+    "core",
+    "evidence",
+    "examples",
+    "helpers",
+    "reference",
+    "references",
+    "schemas",
+    "scripts",
+    "spreadsheets",
+    "templates",
+    "tests",
+    "themes",
+]);
+const ROOT_FILE_EXTENSIONS = [
+    ".env.example",
+    ".js",
+    ".json",
+    ".md",
+    ".py",
+    ".sh",
+    ".toml",
+    ".ts",
+    ".txt",
+    ".yaml",
+    ".yml",
+];
 const SHA256_RE = /^[a-f0-9]{64}$/i;
 const BASE64_RE = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
 export async function getSkill(slug) {
@@ -30,7 +60,7 @@ export async function getSkill(slug) {
         content: detail.body_md,
         package: {
             main: "SKILL.md",
-            supporting_dirs: ["references", "examples", "scripts", "assets"],
+            supporting_dirs: Array.from(SUPPORT_DIRS),
         },
         package_files: normalizePackageFiles(detail.package_files ?? detail.files),
     };
@@ -103,9 +133,16 @@ function isSafePackagePath(path) {
     if (!path || path.length > 512 || path.startsWith("/") || path.includes("\\") || path.includes("//"))
         return false;
     const segments = path.split("/");
+    if (segments.length === 1)
+        return isAllowedRootPackageFile(segments[0] ?? "") && PATH_SEGMENT_RE.test(segments[0] ?? "");
     if (segments.length < 2)
         return false;
     if (!SUPPORT_DIRS.has(segments[0] ?? ""))
         return false;
     return segments.every((segment) => PATH_SEGMENT_RE.test(segment) && segment !== "." && segment !== "..");
 }
+function isAllowedRootPackageFile(name) {
+    if (!name || (name.startsWith(".") && name !== ".env.example"))
+        return false;
+    return ROOT_FILE_EXTENSIONS.some((ext) => name.toLowerCase().endsWith(ext));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floomhq/floom-mcp-sync",
-  "version": "1.0.24",
+  "version": "1.0.26",
   "description": "Lightweight Floom MCP server for search, on-demand skill fetch, status, and sync.",
   "license": "MIT",
   "type": "module",