@j0hanz/filesystem-mcp 1.14.0 → 1.15.0

package/dist/resources/tool-info.js

@@ -63,14 +63,14 @@ export function buildCoreContextPack() {
         const annotations = e.annotations ? ` ${e.annotations.join(' ')}` : '';
         return `| \`${e.name}\` | ${e.description}${annotations} |`;
     });
-    return `<core_context>\n| Tool | Purpose |\n|------|---------|\n${rows.join('\n')}\n</core_context>`;
+    return `## Tool Summary\n\n| Tool | Purpose |\n|------|---------|\n${rows.join('\n')}`;
 }
 export function getSharedConstraints() {
     return [
-        'Use allowed roots only (from CLI negotiation).',
-        'Sensitive paths are denylisted by default.',
-        `Limits enforced: max file size ${Math.floor(MAX_TEXT_FILE_SIZE / 1024 / 1024)}MB; search caps ${MAX_SEARCH_RESULTS} files, ${DEFAULT_SEARCH_CONTENT_RESULTS} content matches.`,
-        'If response includes `resourceUri`, call `resources/read` immediately — cached results expire on restart.',
+        'Operate within allowed roots only (negotiated at startup via CLI).',
+        'Sensitive file paths (e.g. .env, *.pem, *id_rsa*) are denied by default.',
+        `Enforced limits: max file size ${Math.floor(MAX_TEXT_FILE_SIZE / 1024 / 1024)} MB, file search cap ${MAX_SEARCH_RESULTS} results, content search cap ${DEFAULT_SEARCH_CONTENT_RESULTS} matches.`,
+        'When a response includes `resourceUri`, call `resources/read` immediately — cached results expire on server restart.',
     ];
 }
 function formatTaskSupportLabel(taskSupport) {
@@ -86,6 +86,14 @@ function formatTaskSupportLabel(taskSupport) {
 function toJsonSchemaObject(schema, io = 'output') {
     return z.toJSONSchema(schema, { io });
 }
+function summarizeArrayType(schema) {
+    if (Array.isArray(schema.prefixItems) && schema.prefixItems.length > 0) {
+        const itemTypes = schema.prefixItems.map(summarizeSchemaType).join(', ');
+        return `tuple<${itemTypes}>`;
+    }
+    const itemType = schema.items ? summarizeSchemaType(schema.items) : 'unknown';
+    return `array<${itemType}>`;
+}
 function summarizeSchemaType(schema) {
     if (Array.isArray(schema.enum) && schema.enum.length > 0) {
         return `enum(${schema.enum.map((value) => JSON.stringify(value)).join(', ')})`;
@@ -100,14 +108,7 @@ function summarizeSchemaType(schema) {
         return schema.oneOf.map(summarizeSchemaType).join(' | ');
     }
     if (schema.type === 'array') {
-        if (Array.isArray(schema.prefixItems) && schema.prefixItems.length > 0) {
-            const itemTypes = schema.prefixItems.map(summarizeSchemaType).join(', ');
-            return `tuple<${itemTypes}>`;
-        }
-        const itemType = schema.items
-            ? summarizeSchemaType(schema.items)
-            : 'unknown';
-        return `array<${itemType}>`;
+        return summarizeArrayType(schema);
     }
     if (schema.type === 'object' && schema.additionalProperties === false) {
         return 'object (strict)';
@@ -117,16 +118,23 @@ function summarizeSchemaType(schema) {
     }
     return 'unknown';
 }
+function formatFieldLabel(label) {
+    return label
+        .split('_')
+        .map((word) => word.charAt(0).toUpperCase() + word.slice(1))
+        .join(' ');
+}
 function buildSchemaFieldLines(label, schema) {
+    const heading = `**${formatFieldLabel(label)}:**`;
     if (!schema) {
-        return [`<${label}>`, '- none', `</${label}>`];
+        return [heading, '- none'];
     }
     const io = label === 'input_fields' ? 'input' : 'output';
     const jsonSchema = toJsonSchemaObject(schema, io);
     const properties = jsonSchema.properties ?? {};
     const required = new Set(jsonSchema.required ?? []);
     const fieldNames = Object.keys(properties);
-    const lines = [`<${label}>`];
+    const lines = [heading];
     if (typeof jsonSchema.description === 'string' &&
         jsonSchema.description.length > 0) {
         lines.push(`- Schema constraints: ${jsonSchema.description}`);
@@ -135,7 +143,7 @@ function buildSchemaFieldLines(label, schema) {
         lines.push('- Unknown fields are rejected (`additionalProperties: false`).');
     }
     if (fieldNames.length === 0) {
-        lines.push('- object with no fields', `</${label}>`);
+        lines.push('- object with no fields');
         return lines;
     }
     lines.push(...fieldNames.map((fieldName) => {
@@ -147,7 +155,7 @@ function buildSchemaFieldLines(label, schema) {
             ? fieldSchema.description
             : 'No description.';
         return `- ${fieldName} (${type}, ${requiredLabel}): ${description}`;
-    }), `</${label}>`);
+    }));
     return lines;
 }
 export function buildToolInfo(name) {
@@ -165,37 +173,34 @@ export function buildToolInfo(name) {
     if (contract.annotations?.openWorldHint)
         annotationLines.push('- openWorldHint: true');
     const lines = [
-        `<tool_info name="${entry.name}">`,
-        `## ${entry.name}`,
+        `---`,
+        `# ${entry.name}`,
         '',
-        `Title: ${entry.title}`,
-        `Description: ${entry.description}`,
+        `**Title:** ${entry.title}`,
+        `**Description:** ${entry.description}`,
         '',
-        '<execution>',
+        '**Execution:**',
         `- taskSupport: ${formatTaskSupportLabel(contract.taskSupport)}`,
-        '</execution>',
         '',
         ...buildSchemaFieldLines('input_fields', contract.inputSchema),
         '',
         ...buildSchemaFieldLines('output_fields', contract.outputSchema),
     ];
     if (annotationLines.length > 0) {
-        lines.push('', '<annotations>', ...annotationLines, '</annotations>');
+        lines.push('', '**Behavior:**', ...annotationLines);
     }
     if (entry.nuances && entry.nuances.length > 0) {
-        lines.push('', '<nuances>');
+        lines.push('', '**Usage Notes:**');
         for (const nuance of entry.nuances) {
             lines.push(`- ${nuance}`);
         }
-        lines.push('</nuances>');
     }
     if (entry.gotchas && entry.gotchas.length > 0) {
-        lines.push('', '<gotchas>');
+        lines.push('', '**Warnings:**');
         for (const gotcha of entry.gotchas) {
             lines.push(`- ${gotcha}`);
         }
-        lines.push('</gotchas>');
     }
-    lines.push('</tool_info>');
+    lines.push('---');
     return lines.join('\n');
 }

package/dist/resources/workflows.js

@@ -18,22 +18,43 @@ export function buildWorkflowGuide() {
         'rm',
         'mkdir',
     ]));
-    return `<workflows>
-### A: EXPLORE — directory layout or file content
-1. ${exploreTools}.
-   > **Strict:** Resolve paths first. Never guess.
-
-### B: SEARCH — files by pattern or content
-1. ${searchTools}.
-   > **Strict:** Content search with \`grep\`, not \`find\`.
-
-### C: EDIT — modify files or layout
-1. ${editTools}.
-2. Use \`edit\` for targeted changes, \`search_and_replace\` for bulk changes, and \`mv\`/\`rm\`/\`mkdir\` for layout updates.
-   > **Strict:** Confirm destructive ops (\`write\`, \`mv\`, \`rm\`, bulk replace).
-
-### D: PATCH — apply unified diffs
-1. \`diff_files\` → \`apply_patch(dryRun:true)\` → \`apply_patch\`.
-   > **Tip:** Feed \`diff_files\` output directly. Multi-file patches: \`path\` = base dir, results per file.
-</workflows>`;
+    return `## Workflows
+
+### A: Explore — Discover directory layout or file content
+
+**Tools:** ${exploreTools}
+
+1. Start with \`roots\` to identify allowed directories.
+2. Use \`ls\` or \`tree\` to map structure, then \`stat\` or \`read\` for details.
+
+> Resolve paths before acting. Never assume a path exists.
+
+### B: Search — Find files by name or content
+
+**Tools:** ${searchTools}
+
+1. Use \`find\` for file name/glob matching.
+2. Use \`grep\` for content search (supports regex).
+3. Use \`read\` to inspect matched files.
+
+> Use \`grep\` for content, \`find\` for filenames. Do not conflate them.
+
+### C: Edit — Modify files or directory layout
+
+**Tools:** ${editTools}
+
+1. Use \`edit\` for targeted single-file changes (exact text match → replace).
+2. Use \`search_and_replace\` for bulk changes across multiple files.
+3. Use \`mv\`, \`rm\`, \`mkdir\` for structural changes.
+
+> Confirm destructive operations (\`write\`, \`mv\`, \`rm\`, bulk replace) before executing.
+
+### D: Patch — Generate and apply unified diffs
+
+1. Generate: \`diff_files(original, modified)\`.
+2. Validate: \`apply_patch(patch, dryRun: true)\`.
+3. Apply: \`apply_patch(patch)\`.
+
+> Multi-file patches: set \`path\` to the base directory. Results are reported per file.
+`;
 }

package/dist/resources.d.ts

@@ -1,4 +1,4 @@
-import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { type McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { ResourceStore } from './lib/resource-store.js';
 import { type IconInfo } from './tools/shared.js';
 export declare function registerInstructionResource(server: McpServer, instructions: string, iconInfo?: IconInfo): void;

package/dist/resources.js

@@ -1,4 +1,4 @@
-import { ResourceTemplate } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { ResourceTemplate, } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { ErrorCode, McpError } from './lib/errors.js';
 import { globalMetrics } from './lib/observability.js';
 import { buildToolCatalog } from './resources/tool-catalog.js';
@@ -104,7 +104,7 @@ export function registerResultResources(server, store, iconInfo) {
     }, iconInfo), (uri, variables) => {
         const { id } = variables;
         if (typeof id !== 'string' || id.length === 0) {
-            throw new McpError(ErrorCode.E_NOT_FOUND, 'Cached result has expired — re-run the tool to regenerate.');
+            throw new McpError(ErrorCode.NOT_FOUND, 'Cached result expired. Re-run the tool to regenerate.');
         }
         const entry = store.getText(uri.toString());
         return {
@@ -130,11 +130,11 @@ export function registerToolInfoResource(server, iconInfo) {
     }, iconInfo), (uri, variables) => {
         const { name } = variables;
         if (typeof name !== 'string' || name.length === 0) {
-            throw new McpError(ErrorCode.E_INVALID_INPUT, 'Tool name is required');
+            throw new McpError(ErrorCode.INVALID_INPUT, 'Tool name is required');
         }
         const content = buildToolInfo(name);
         if (content === undefined) {
-            throw new McpError(ErrorCode.E_INVALID_INPUT, `Tool not found: ${name}`);
+            throw new McpError(ErrorCode.INVALID_INPUT, `Tool not found: ${name}`);
         }
         return {
             contents: [

package/dist/schemas.d.ts

@@ -22,9 +22,9 @@ export declare const ListDirectoryInputSchema: z.ZodObject<{
     maxDepth: z.ZodOptional<z.ZodInt>;
     maxEntries: z.ZodDefault<z.ZodOptional<z.ZodInt>>;
     sortBy: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
-        name: "name";
-        size: "size";
         type: "type";
+        size: "size";
+        name: "name";
         modified: "modified";
     }>>>;
     pattern: z.ZodOptional<z.ZodString>;
@@ -39,8 +39,8 @@ export declare const SearchFilesInputSchema: z.ZodObject<{
     includeIgnored: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     includeHidden: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     sortBy: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
-        name: "name";
         size: "size";
+        name: "name";
         path: "path";
         modified: "modified";
     }>>>;
@@ -208,18 +208,18 @@ export declare const ReadMultipleFilesOutputSchema: z.ZodObject<{
         }>>;
         error: z.ZodOptional<z.ZodObject<{
             code: z.ZodEnum<{
-                readonly E_ACCESS_DENIED: "E_ACCESS_DENIED";
-                readonly E_NOT_FOUND: "E_NOT_FOUND";
-                readonly E_NOT_FILE: "E_NOT_FILE";
-                readonly E_NOT_DIRECTORY: "E_NOT_DIRECTORY";
-                readonly E_TOO_LARGE: "E_TOO_LARGE";
-                readonly E_TIMEOUT: "E_TIMEOUT";
-                readonly E_CANCELLED: "E_CANCELLED";
-                readonly E_INVALID_PATTERN: "E_INVALID_PATTERN";
-                readonly E_INVALID_INPUT: "E_INVALID_INPUT";
-                readonly E_PERMISSION_DENIED: "E_PERMISSION_DENIED";
-                readonly E_SYMLINK_NOT_ALLOWED: "E_SYMLINK_NOT_ALLOWED";
-                readonly E_UNKNOWN: "E_UNKNOWN";
+                readonly ACCESS_DENIED: "ACCESS_DENIED";
+                readonly NOT_FOUND: "NOT_FOUND";
+                readonly NOT_FILE: "NOT_FILE";
+                readonly NOT_DIRECTORY: "NOT_DIRECTORY";
+                readonly TOO_LARGE: "TOO_LARGE";
+                readonly TIMEOUT: "TIMEOUT";
+                readonly CANCELLED: "CANCELLED";
+                readonly INVALID_PATTERN: "INVALID_PATTERN";
+                readonly INVALID_INPUT: "INVALID_INPUT";
+                readonly PERMISSION_DENIED: "PERMISSION_DENIED";
+                readonly SYMLINK_NOT_ALLOWED: "SYMLINK_NOT_ALLOWED";
+                readonly UNKNOWN: "UNKNOWN";
             }>;
             message: z.ZodString;
             path: z.ZodOptional<z.ZodString>;
@@ -279,18 +279,18 @@ export declare const GetMultipleFileInfoOutputSchema: z.ZodObject<{
         }, z.core.$strict>>;
         error: z.ZodOptional<z.ZodObject<{
             code: z.ZodEnum<{
-                readonly E_ACCESS_DENIED: "E_ACCESS_DENIED";
-                readonly E_NOT_FOUND: "E_NOT_FOUND";
-                readonly E_NOT_FILE: "E_NOT_FILE";
-                readonly E_NOT_DIRECTORY: "E_NOT_DIRECTORY";
-                readonly E_TOO_LARGE: "E_TOO_LARGE";
-                readonly E_TIMEOUT: "E_TIMEOUT";
-                readonly E_CANCELLED: "E_CANCELLED";
-                readonly E_INVALID_PATTERN: "E_INVALID_PATTERN";
-                readonly E_INVALID_INPUT: "E_INVALID_INPUT";
-                readonly E_PERMISSION_DENIED: "E_PERMISSION_DENIED";
-                readonly E_SYMLINK_NOT_ALLOWED: "E_SYMLINK_NOT_ALLOWED";
-                readonly E_UNKNOWN: "E_UNKNOWN";
+                readonly ACCESS_DENIED: "ACCESS_DENIED";
+                readonly NOT_FOUND: "NOT_FOUND";
+                readonly NOT_FILE: "NOT_FILE";
+                readonly NOT_DIRECTORY: "NOT_DIRECTORY";
+                readonly TOO_LARGE: "TOO_LARGE";
+                readonly TIMEOUT: "TIMEOUT";
+                readonly CANCELLED: "CANCELLED";
+                readonly INVALID_PATTERN: "INVALID_PATTERN";
+                readonly INVALID_INPUT: "INVALID_INPUT";
+                readonly PERMISSION_DENIED: "PERMISSION_DENIED";
+                readonly SYMLINK_NOT_ALLOWED: "SYMLINK_NOT_ALLOWED";
+                readonly UNKNOWN: "UNKNOWN";
             }>;
             message: z.ZodString;
             path: z.ZodOptional<z.ZodString>;
@@ -354,18 +354,18 @@ export declare const MoveFileOutputSchema: z.ZodObject<{
         source: z.ZodString;
         error: z.ZodObject<{
             code: z.ZodEnum<{
-                readonly E_ACCESS_DENIED: "E_ACCESS_DENIED";
-                readonly E_NOT_FOUND: "E_NOT_FOUND";
-                readonly E_NOT_FILE: "E_NOT_FILE";
-                readonly E_NOT_DIRECTORY: "E_NOT_DIRECTORY";
-                readonly E_TOO_LARGE: "E_TOO_LARGE";
-                readonly E_TIMEOUT: "E_TIMEOUT";
-                readonly E_CANCELLED: "E_CANCELLED";
-                readonly E_INVALID_PATTERN: "E_INVALID_PATTERN";
-                readonly E_INVALID_INPUT: "E_INVALID_INPUT";
-                readonly E_PERMISSION_DENIED: "E_PERMISSION_DENIED";
-                readonly E_SYMLINK_NOT_ALLOWED: "E_SYMLINK_NOT_ALLOWED";
-                readonly E_UNKNOWN: "E_UNKNOWN";
+                readonly ACCESS_DENIED: "ACCESS_DENIED";
+                readonly NOT_FOUND: "NOT_FOUND";
+                readonly NOT_FILE: "NOT_FILE";
+                readonly NOT_DIRECTORY: "NOT_DIRECTORY";
+                readonly TOO_LARGE: "TOO_LARGE";
+                readonly TIMEOUT: "TIMEOUT";
+                readonly CANCELLED: "CANCELLED";
+                readonly INVALID_PATTERN: "INVALID_PATTERN";
+                readonly INVALID_INPUT: "INVALID_INPUT";
+                readonly PERMISSION_DENIED: "PERMISSION_DENIED";
+                readonly SYMLINK_NOT_ALLOWED: "SYMLINK_NOT_ALLOWED";
+                readonly UNKNOWN: "UNKNOWN";
             }>;
             message: z.ZodString;
             path: z.ZodOptional<z.ZodString>;
@@ -431,18 +431,18 @@ export declare const ApplyPatchOutputSchema: z.ZodObject<{
         linesRemoved: z.ZodOptional<z.ZodInt>;
         error: z.ZodOptional<z.ZodObject<{
             code: z.ZodEnum<{
-                readonly E_ACCESS_DENIED: "E_ACCESS_DENIED";
-                readonly E_NOT_FOUND: "E_NOT_FOUND";
-                readonly E_NOT_FILE: "E_NOT_FILE";
-                readonly E_NOT_DIRECTORY: "E_NOT_DIRECTORY";
-                readonly E_TOO_LARGE: "E_TOO_LARGE";
-                readonly E_TIMEOUT: "E_TIMEOUT";
-                readonly E_CANCELLED: "E_CANCELLED";
-                readonly E_INVALID_PATTERN: "E_INVALID_PATTERN";
-                readonly E_INVALID_INPUT: "E_INVALID_INPUT";
-                readonly E_PERMISSION_DENIED: "E_PERMISSION_DENIED";
-                readonly E_SYMLINK_NOT_ALLOWED: "E_SYMLINK_NOT_ALLOWED";
-                readonly E_UNKNOWN: "E_UNKNOWN";
+                readonly ACCESS_DENIED: "ACCESS_DENIED";
+                readonly NOT_FOUND: "NOT_FOUND";
+                readonly NOT_FILE: "NOT_FILE";
+                readonly NOT_DIRECTORY: "NOT_DIRECTORY";
+                readonly TOO_LARGE: "TOO_LARGE";
+                readonly TIMEOUT: "TIMEOUT";
+                readonly CANCELLED: "CANCELLED";
+                readonly INVALID_PATTERN: "INVALID_PATTERN";
+                readonly INVALID_INPUT: "INVALID_INPUT";
+                readonly PERMISSION_DENIED: "PERMISSION_DENIED";
+                readonly SYMLINK_NOT_ALLOWED: "SYMLINK_NOT_ALLOWED";
+                readonly UNKNOWN: "UNKNOWN";
             }>;
             message: z.ZodString;
             path: z.ZodOptional<z.ZodString>;
@@ -458,9 +458,9 @@ export declare const SearchAndReplaceInputSchema: z.ZodObject<{
     isRegex: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     caseSensitive: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     dryRun: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
-    includeHidden: z.ZodOptional<z.ZodBoolean>;
-    includeIgnored: z.ZodOptional<z.ZodBoolean>;
-    returnDiff: z.ZodOptional<z.ZodBoolean>;
+    includeHidden: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    includeIgnored: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    returnDiff: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     maxFiles: z.ZodOptional<z.ZodInt>;
 }, z.core.$strict>;
 export declare const SearchAndReplaceOutputSchema: z.ZodObject<{
@@ -473,18 +473,18 @@ export declare const SearchAndReplaceOutputSchema: z.ZodObject<{
         path: z.ZodString;
         error: z.ZodObject<{
             code: z.ZodEnum<{
-                readonly E_ACCESS_DENIED: "E_ACCESS_DENIED";
-                readonly E_NOT_FOUND: "E_NOT_FOUND";
-                readonly E_NOT_FILE: "E_NOT_FILE";
-                readonly E_NOT_DIRECTORY: "E_NOT_DIRECTORY";
-                readonly E_TOO_LARGE: "E_TOO_LARGE";
-                readonly E_TIMEOUT: "E_TIMEOUT";
-                readonly E_CANCELLED: "E_CANCELLED";
-                readonly E_INVALID_PATTERN: "E_INVALID_PATTERN";
-                readonly E_INVALID_INPUT: "E_INVALID_INPUT";
-                readonly E_PERMISSION_DENIED: "E_PERMISSION_DENIED";
-                readonly E_SYMLINK_NOT_ALLOWED: "E_SYMLINK_NOT_ALLOWED";
-                readonly E_UNKNOWN: "E_UNKNOWN";
+                readonly ACCESS_DENIED: "ACCESS_DENIED";
+                readonly NOT_FOUND: "NOT_FOUND";
+                readonly NOT_FILE: "NOT_FILE";
+                readonly NOT_DIRECTORY: "NOT_DIRECTORY";
+                readonly TOO_LARGE: "TOO_LARGE";
+                readonly TIMEOUT: "TIMEOUT";
+                readonly CANCELLED: "CANCELLED";
+                readonly INVALID_PATTERN: "INVALID_PATTERN";
+                readonly INVALID_INPUT: "INVALID_INPUT";
+                readonly PERMISSION_DENIED: "PERMISSION_DENIED";
+                readonly SYMLINK_NOT_ALLOWED: "SYMLINK_NOT_ALLOWED";
+                readonly UNKNOWN: "UNKNOWN";
             }>;
             message: z.ZodString;
             path: z.ZodOptional<z.ZodString>;

package/dist/schemas.js

@@ -20,6 +20,13 @@ const PathSchemaBase = z
     .max(MAX_PATH_LENGTH, `Path too long (max ${MAX_PATH_LENGTH} chars)`);
 const OptionalPathSchema = PathSchemaBase.optional();
 const RequiredPathSchema = PathSchemaBase.min(1, 'Path required');
+const SafeGlobPatternSchema = z
+    .string()
+    .min(1, 'Pattern required')
+    .max(1000, 'Max 1000 chars')
+    .refine((val) => isSafeGlobPattern(val), {
+    error: 'Invalid glob or unsafe path (absolute/.. forbidden)',
+});
 const FileTypeSchema = z.enum(['file', 'directory', 'symlink', 'other']);
 const ListDirectorySortSchema = z.enum(['name', 'size', 'modified', 'type']);
 const SearchFilesSortSchema = z.enum(['name', 'size', 'modified', 'path']);
@@ -37,7 +44,7 @@ const TreeEntrySchema = z.lazy(() => z.strictObject({
     children: z.array(TreeEntrySchema).optional().describe('Children'),
 }));
 const ErrorSchema = z.strictObject({
-    code: z.enum(ErrorCode).describe('Error code (e.g. E_NOT_FOUND)'),
+    code: z.enum(ErrorCode).describe('Error code (e.g. NOT_FOUND)'),
     message: z.string().describe('Human-readable message'),
     path: z.string().optional().describe('Relevant path'),
     suggestion: z.string().optional().describe('Fix suggestion'),
@@ -126,15 +133,7 @@ export const ListDirectoryInputSchema = z.strictObject({
     sortBy: ListDirectorySortSchema.optional()
         .default('name')
         .describe('Sort field (name, size, modified, type)'),
-    pattern: z
-        .string()
-        .min(1, 'Pattern required')
-        .max(1000, 'Max 1000 chars')
-        .refine((val) => isSafeGlobPattern(val), {
-        error: 'Invalid glob or unsafe path (absolute/.. forbidden)',
-    })
-        .optional()
-        .describe('Optional glob pattern filter (e.g. "**/*.ts")'),
+    pattern: SafeGlobPatternSchema.optional().describe('Optional glob pattern filter (e.g. "**/*.ts")'),
     includeSymlinkTargets: defaultFalseBoolean('Resolve and include symlink targets in results'),
     cursor: z
         .string()
@@ -146,14 +145,7 @@ export const ListAllowedDirectoriesInputSchema = z
     .describe('No input parameters.');
 export const SearchFilesInputSchema = z.strictObject({
     path: OptionalPathSchema.describe(DESC_PATH_ROOT),
-    pattern: z
-        .string()
-        .min(1, 'Pattern required')
-        .max(1000, 'Max 1000 chars')
-        .refine((val) => isSafeGlobPattern(val), {
-        error: 'Invalid glob or unsafe path (absolute/.. forbidden)',
-    })
-        .describe('Glob pattern (e.g. "**/*.ts", "src/*.js")'),
+    pattern: SafeGlobPatternSchema.describe('Glob pattern (e.g. "**/*.ts", "src/*.js")'),
     maxResults: z
         .int({ error: 'Must be integer' })
         .min(1, 'Min: 1')
@@ -221,11 +213,7 @@ export const SearchContentInputSchema = z.strictObject({
         .optional()
         .default(DEFAULT_SEARCH_CONTENT_RESULTS)
         .describe(`Maximum match rows to return. Default: ${DEFAULT_SEARCH_CONTENT_RESULTS}`),
-    filePattern: z
-        .string()
-        .min(1, 'Pattern required')
-        .max(1000, 'Max 1000 chars')
-        .optional()
+    filePattern: SafeGlobPatternSchema.optional()
         .default('**/*')
         .describe('Glob for candidate files (e.g. "**/*.ts")'),
     includeHidden: defaultFalseBoolean('Include hidden items (starting with .)'),
@@ -449,6 +437,8 @@ export const EditFileInputSchema = z.strictObject({
         .array(z.strictObject({
         oldText: z
             .string()
+            .min(1, 'oldText required')
+            .max(102400, 'Max 100KB')
             .describe('Exact literal string to replace (character-for-character). Include 3–5 lines of context for unique targeting.'),
         newText: z
             .string()
@@ -621,15 +611,8 @@ export const ApplyPatchOutputSchema = z.strictObject({
 });
 export const SearchAndReplaceInputSchema = z.strictObject({
     path: OptionalPathSchema.describe(DESC_PATH_ROOT),
-    filePattern: z
-        .string()
-        .min(1, 'Pattern required')
-        .max(1000, 'Max 1000 chars')
-        .optional()
+    filePattern: SafeGlobPatternSchema.optional()
         .default('**/*')
-        .refine((val) => isSafeGlobPattern(val), {
-        error: 'Invalid glob or unsafe path (absolute/.. forbidden)',
-    })
         .describe('Glob to filter files. Default: **/*'),
     searchPattern: z
         .string()
@@ -644,18 +627,9 @@ export const SearchAndReplaceInputSchema = z.strictObject({
         .default(true)
         .describe('Case-sensitive matching. Default: true.'),
     dryRun: defaultFalseBoolean('Preview matches without writing. Check changedFiles and matches in the response before committing.'),
-    includeHidden: z
-        .boolean()
-        .optional()
-        .describe('Include hidden files/directories (starting with .). Default: false.'),
-    includeIgnored: z
-        .boolean()
-        .optional()
-        .describe('Include .gitignore-ignored files (node_modules, dist). Default: false.'),
-    returnDiff: z
-        .boolean()
-        .optional()
-        .describe('Return unified diff of changes even if dryRun is false. Default: false.'),
+    includeHidden: defaultFalseBoolean('Include hidden files/directories (starting with .). Default: false.'),
+    includeIgnored: defaultFalseBoolean('Include .gitignore-ignored files (node_modules, dist). Default: false.'),
+    returnDiff: defaultFalseBoolean('Return unified diff of changes even if dryRun is false. Default: false.'),
     maxFiles: z
         .int({ error: 'Must be integer' })
         .min(1, 'Min: 1')
@@ -687,7 +661,10 @@ export const SearchAndReplaceOutputSchema = z.strictObject({
         .boolean()
         .optional()
         .describe('Changed file list truncated'),
-    diff: z.string().optional().describe('Unified diff of changes (dryRun only)'),
+    diff: z
+        .string()
+        .optional()
+        .describe('Unified diff of changes when `dryRun` or `returnDiff` is enabled'),
     diffTruncated: z
         .boolean()
         .optional()

package/dist/server/bootstrap.d.ts

@@ -1,14 +1,15 @@
-import * as http from 'node:http';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import type { LoggingLevel } from '@modelcontextprotocol/sdk/types.js';
-export interface ServerOptions {
-    allowCwd?: boolean;
-    cliAllowedDirs?: string[];
-}
-export interface LoggingState {
-    minimumLevel: LoggingLevel;
-}
-export declare function logToMcp(server: McpServer | undefined, level: LoggingLevel, data: string, minLevel?: LoggingLevel): void;
+import { type Server } from 'node:http';
+import { type LoggingState } from '../lib/logger.js';
+import { type ServerOptions } from './roots-manager.js';
+export declare const activeServers: Map<string, {
+    server: McpServer;
+    loggingState: LoggingState;
+}>;
+export declare let stdioServer: {
+    server: McpServer;
+    loggingState: LoggingState;
+} | undefined;
 export declare function createServer(options?: ServerOptions): Promise<McpServer>;
 export declare function startServer(server: McpServer): Promise<void>;
-export declare function startHttpServer(port: number, options: ServerOptions): Promise<http.Server>;
+export declare function startHttpServer(port: number, options: ServerOptions): Promise<Server>;