@grampro/kit 2.7.0 → 2.7.1

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 2.7.1
+
+### Security
+
+**get_guidance could read any .md file on disk.** It appended `.md` to a
+caller-supplied `topic` and joined it onto the references folder with no
+traversal guard, so `topic = "../../../../CHANGELOG"` returned the repo
+CHANGELOG and the same trick reached any `.md` file the server process could
+open. Found by a VAPT pass driving the tool with traversal payloads. The
+server runs with your own authority, so it is a confused-deputy hole rather
+than privilege escalation — but a tool that advertises nine fixed topics
+should not become a file-exfiltration primitive for a prompt-injected agent.
+It now refuses any `topic` that is not one of the shipped guidance names, with
+a resolved-prefix check behind the allowlist. A regression test drives the
+same payloads.
+
+**Affected: 2.4.4 through 2.7.0** — every release that has shipped the MCP
+server. Each was checked by running the same payload against its published
+tarball. 2.4.3 and earlier have no MCP server and are not affected. A project
+that installed the package locally needs `npm i -D @grampro/kit@latest`. One
+configured with `npx -y @grampro/kit mcp` may keep running a cached copy; check
+with `npx -y @grampro/kit --version`, and if it is not 2.7.1, run
+`npx -y @grampro/kit@2.7.1 mcp` once to replace it.
+
 ## 2.7.0
 
 ### Added

package/README.md

@@ -135,7 +135,13 @@ anything first.
 No dependencies, and it starts in about the time an empty Node process
 takes. Full walkthrough, including a prompt to paste:
 [kit.gramproindia.com/mcp-server](https://kit.gramproindia.com/mcp-server).
-Details in [`tools/mcp/README.md`](tools/mcp/README.md).
+Details in [`tools/mcp/README.md`](tools/mcp/README.md), including what a tool
+call can and cannot reach.
+
+**Use 2.7.1 or later.** From 2.4.4 through 2.7.0, a crafted `get_guidance`
+call could read any `.md` file the server could open. The
+[changelog](CHANGELOG.md#271) explains how to check which version your agent
+is running.
 
 ## Figma plugin
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@grampro/kit",
-  "version": "2.7.0",
-  "description": "GramproKit \u2014 an agent-native UI runtime for React. Copy-in components you own, each publishing a contract that software can read.",
+  "version": "2.7.1",
+  "description": "GramproKit — an agent-native UI runtime for React. Copy-in components you own, each publishing a contract that software can read.",
   "type": "module",
   "files": [
     "index.cjs",

package/source/components/accordion/passport.json

@@ -10,7 +10,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "core/index.ts",
       "core/open.ts",

package/source/components/alert/passport.json

@@ -8,7 +8,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "core/index.ts",
       "core/live.ts",

package/source/components/avatar/passport.json

@@ -9,7 +9,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "core/identity.ts",
       "core/index.ts",

package/source/components/badge/passport.json

@@ -9,7 +9,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "core/count.ts",
       "core/index.ts",

package/source/components/breadcrumb/passport.json

@@ -8,7 +8,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "core/index.ts",
       "core/trail.ts",

package/source/components/button/passport.json

@@ -8,7 +8,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "core/index.ts",
       "core/state.ts",

package/source/components/card/passport.json

@@ -12,7 +12,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "core/index.ts",
       "core/trend.ts",

package/source/components/checkbox/passport.json

@@ -10,7 +10,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "core/agent.ts",
       "core/group.ts",

package/source/components/combobox/passport.json

@@ -9,7 +9,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "core/agent.ts",
       "core/filter.ts",

package/source/components/data-grid/passport.json

@@ -14,7 +14,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "agent/coerce.ts",
       "agent/contract.ts",

package/source/components/date-picker/passport.json

@@ -10,7 +10,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "core/agent.ts",
       "core/calendar.ts",

package/source/components/dialog/passport.json

@@ -9,7 +9,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "core/api.ts",
       "core/dialog.ts",

package/source/components/file-uploader/passport.json

@@ -13,7 +13,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "core/format.ts",
       "core/index.ts",

package/source/components/input/passport.json

@@ -9,7 +9,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "core/agent.ts",
       "core/count.ts",

package/source/components/menu/passport.json

@@ -16,7 +16,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "core/index.ts",
       "core/navigation.ts",

package/source/components/modal/passport.json

@@ -8,7 +8,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "core/dismiss.ts",
       "core/index.ts",

package/source/components/number-input/passport.json

@@ -8,7 +8,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "core/agent.ts",
       "core/format.ts",

package/source/components/popover/passport.json

@@ -8,7 +8,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "core/index.ts",
       "core/types.ts",

package/source/components/progress/passport.json

@@ -9,7 +9,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "core/index.ts",
       "core/progress.ts",

package/source/components/radio-group/passport.json

@@ -10,7 +10,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "core/agent.ts",
       "core/group.ts",

package/source/components/skeleton/passport.json

@@ -9,7 +9,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "core/index.ts",
       "core/lines.ts",

package/source/components/spinner/passport.json

@@ -8,7 +8,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "core/index.ts",
       "core/types.ts",

package/source/components/switch/passport.json

@@ -8,7 +8,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "core/agent.ts",
       "core/index.ts",

package/source/components/tabs/passport.json

@@ -12,7 +12,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "core/index.ts",
       "core/navigation.ts",

package/source/components/textarea/passport.json

@@ -8,7 +8,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "core/agent.ts",
       "core/count.ts",

package/source/components/toaster/passport.json

@@ -11,7 +11,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "core/api.ts",
       "core/index.ts",

package/source/components/tooltip/passport.json

@@ -8,7 +8,7 @@
     ]
   },
   "source": {
-    "libraryVersion": "2.7.0",
+    "libraryVersion": "2.7.1",
     "files": [
       "core/index.ts",
       "core/types.ts",

package/tools/mcp/README.md

@@ -266,3 +266,26 @@ CLI's own dependencies, which are no use to a JSON-RPC loop and cost around
 The catalogue it serves is the one in this package, not the components
 copied into your project — so an agent can see a component before you
 install it, and `install_component` puts it in place.
+
+### What a caller can reach
+
+Every tool argument is treated as untrusted. An agent that has read a hostile
+web page or design file can be steered into calling these tools with
+anything, so the boundary has to hold no matter who wrote the arguments.
+
+- **`get_guidance`** serves only the guidance topics that ship in this
+  package. Any other topic is refused, including one containing `../`. Before
+  2.7.1 it was not refused: a crafted topic could read any `.md` file the
+  server could open. See the changelog.
+- **`get_component`, `get_example` and `install_component`** accept only names
+  in the catalogue. A name is reduced to letters and digits before anything
+  is looked up, and `install_component` runs the CLI with an argument list,
+  never through a shell.
+- **`figma_frame` with `designFile`** reads the path it is given, with your
+  user's permissions. It only returns content from a file shaped like the
+  plugin's export, and refuses anything else without quoting it. A file that
+  *is* shaped like an export gets read as one, which is the tool's purpose.
+
+The server runs as you, so none of this stops an agent that can already read
+your files directly. What it prevents is a tool that advertises one narrow
+job being turned into a general file reader.

package/tools/mcp/server.cjs

@@ -197,7 +197,23 @@ function getGuidance(topic) {
     ? fs.readdirSync(REFERENCES).filter((f) => f.endsWith(".md")).map((f) => f.replace(/\.md$/, ""))
     : [];
   if (!topic) return { topics: available };
+
+  /*
+   * `topic` is caller-controlled, and `path.join(REFERENCES, topic + ".md")`
+   * followed a `../` out of the references folder: a prompt-injected agent
+   * could turn this into "read any .md file on disk". The list is already an
+   * allowlist of what actually ships, so a topic that is not one of those
+   * names is refused before any path is built. The resolved-prefix check is
+   * the belt to that braces — it also stops a name that readdir would never
+   * produce, such as one reaching through a symlink.
+   */
+  if (!available.includes(topic)) {
+    return { error: `No guidance for "${topic}".`, topics: available };
+  }
   const file = path.join(REFERENCES, `${topic}.md`);
+  if (!path.resolve(file).startsWith(path.resolve(REFERENCES) + path.sep)) {
+    return { error: `No guidance for "${topic}".`, topics: available };
+  }
   if (!fs.existsSync(file)) return { error: `No guidance for "${topic}".`, topics: available };
   return { topic, text: fs.readFileSync(file, "utf8") };
 }