@j0hanz/filesystem-mcp 1.19.0 → 2.0.0

package/dist/core/search.js

@@ -0,0 +1,248 @@
+import { stat as fsStat, readFile } from 'node:fs/promises';
+import { RE2 } from '@adguard/re2-wasm';
+import { StopReasonTracker } from './concurrency.js';
+import { globEntries } from './glob.js';
+import { escapeRegexLiteral } from './primitives.js';
+import { getMaxTextFileSize } from './util.js';
+/** Occurrence-counting bound, so one pathological line cannot spin forever. */
+const MAX_MATCHES_PER_LINE = 100_000;
+/**
+ * Compile a pattern on RE2 rather than on V8's irregexp.
+ *
+ * Patterns arrive from the MCP client, so a backtracking engine would let one
+ * request pin the event loop with no way out: an abort signal cannot preempt a
+ * synchronous `exec`, and on stdio that wedges the whole server. RE2 matches in
+ * time linear in the input and cannot backtrack at all, so the hazard is gone
+ * rather than bounded.
+ *
+ * RE2 rejects the constructs the tool schema documents as unsupported —
+ * lookahead, lookbehind, backreferences — with its own {@link SyntaxError},
+ * which the tool layer turns into a normal tool error. It always matches in
+ * Unicode mode and requires the `u` flag to say so.
+ *
+ * Every compiled pattern owns memory in re2-wasm's fixed 16 MB heap, which
+ * `ALLOW_MEMORY_GROWTH` is off for. re2-wasm never frees it and a
+ * FinalizationRegistry does not keep up (V8 sees no pressure from the wasm
+ * heap), so exhaustion is an emscripten `abort()` that kills regex search for
+ * the rest of the process. Every caller MUST pass the result to
+ * {@link freeRegex} when it is done with it.
+ */
+export function compileRegex(pattern, options = {}) {
+    const flags = options.caseSensitive ? 'gu' : 'giu';
+    try {
+        return new RE2(pattern, flags);
+    }
+    catch (error) {
+        if (!(error instanceof SyntaxError))
+            throw error;
+        throw new SyntaxError(`${error.message} — lookahead, lookbehind, and backreferences are not supported.`, { cause: error });
+    }
+}
+/**
+ * Release a compiled pattern's wasm memory. re2-wasm exposes no disposal of its
+ * own, so this reaches the embind handle it holds privately; a version that
+ * renames the field degrades to the pre-existing leak rather than throwing.
+ * Idempotent — a second call on an already-freed handle is swallowed. Using a
+ * {@link Regex} after freeing it is undefined behaviour in the wasm heap, so
+ * free only in a `finally` that owns the compile.
+ */
+export function freeRegex(regex) {
+    const handle = regex?.wrapper;
+    try {
+        handle?.delete?.();
+    }
+    catch {
+        // already deleted, or a re2-wasm build without embind disposal
+    }
+}
+/**
+ * Count non-overlapping occurrences of a global regex in a single line. Guards
+ * zero-length matches (e.g. `a*`) so they cannot loop forever.
+ */
+function countLineMatches(regex, line) {
+    regex.lastIndex = 0;
+    let count = 0;
+    let match;
+    while ((match = regex.exec(line)) !== null) {
+        count++;
+        if (match.index === regex.lastIndex)
+            regex.lastIndex++; // advance past zero-length match
+        if (count >= MAX_MATCHES_PER_LINE)
+            break;
+    }
+    return count;
+}
+/** Owns the compiled pattern's lifetime; the scan itself is `scanContent`. */
+export async function searchContent(directory, pattern, options, pathGuard) {
+    const regexPattern = options.isRegex ? pattern || '' : escapeRegexLiteral(pattern || '');
+    const regex = compileRegex(regexPattern, { caseSensitive: Boolean(options.caseSensitive) });
+    try {
+        return await scanContent(directory, options, pathGuard, regex);
+    }
+    finally {
+        freeRegex(regex);
+    }
+}
+async function* guardedEntries(entries, pathGuard, signal, counters) {
+    // The signal carries both client cancellation and the tool's search timeout,
+    // so an abort means "return what we have, marked incomplete" rather than
+    // throw — but it must never be reported as a finished scan.
+    for await (const entry of entries) {
+        if (signal?.aborted) {
+            counters.stoppedByAbort = true;
+            return;
+        }
+        try {
+            await pathGuard.validateExistingPath(entry.path);
+        }
+        catch {
+            counters.skippedInaccessible++;
+            continue;
+        }
+        yield entry;
+    }
+}
+async function scanContent(directory, options, pathGuard, regex) {
+    const matches = [];
+    const maxResults = options.maxResults ?? 100;
+    const maxFileSize = options.maxFileSize ?? getMaxTextFileSize();
+    const entries = globEntries({
+        cwd: directory,
+        pattern: options.filePattern ?? '**/*',
+        excludePatterns: options.excludePatterns ?? [],
+        includeHidden: Boolean(options.includeHidden),
+        respectGitignore: Boolean(options.respectGitignore),
+        maxDepth: options.maxDepth ?? 100,
+        suppressErrors: true,
+    });
+    let filesScanned = 0;
+    let filesMatched = 0;
+    let matchingLines = 0;
+    let skippedTooLarge = 0;
+    const counters = { skippedInaccessible: 0, stoppedByAbort: false };
+    for await (const entry of guardedEntries(entries, pathGuard, options.signal, counters)) {
+        if (matches.length >= maxResults)
+            break;
+        // Skip oversized files before reading to avoid unbounded memory use. Count
+        // them: "no matches" for a reason other than the pattern must be visible.
+        try {
+            const stats = await fsStat(entry.path);
+            if (stats.size > maxFileSize) {
+                skippedTooLarge++;
+                continue;
+            }
+        }
+        catch {
+            counters.skippedInaccessible++;
+            continue;
+        }
+        filesScanned++;
+        try {
+            const content = await readFile(entry.path, { encoding: 'utf-8', signal: options.signal });
+            const lines = content.split('\n');
+            let matchedFile = false;
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                if (line === undefined)
+                    continue;
+                // One scan per line: countLineMatches resets lastIndex itself, so it
+                // doubles as the "does this line match" test.
+                const occurrences = countLineMatches(regex, line);
+                if (occurrences > 0) {
+                    matchedFile = true;
+                    matchingLines++;
+                    matches.push({
+                        file: entry.path,
+                        line: i + 1,
+                        content: line,
+                        matchCount: occurrences,
+                    });
+                    if (matches.length >= maxResults)
+                        break;
+                }
+            }
+            if (matchedFile)
+                filesMatched++;
+        }
+        catch {
+            // A read failure while the signal is aborted IS the abort, not an
+            // unreadable file — stop rather than spend another iteration and then
+            // report a cut-short scan as complete.
+            if (options.signal?.aborted) {
+                counters.stoppedByAbort = true;
+                break;
+            }
+            // ignore read errors (e.g. binary files)
+        }
+    }
+    const tracker = new StopReasonTracker();
+    if (matches.length >= maxResults)
+        tracker.hitMaxResults();
+    if (counters.stoppedByAbort)
+        tracker.hitAbort();
+    const stoppedReason = tracker.resolve();
+    return {
+        basePath: directory,
+        matches,
+        summary: {
+            matchingLines,
+            filesScanned,
+            filesMatched,
+            truncated: tracker.truncated,
+            skippedInaccessible: counters.skippedInaccessible,
+            skippedTooLarge,
+            ...(stoppedReason ? { stoppedReason } : {}),
+        },
+    };
+}
+export async function searchFiles(directory, pattern, excludePatterns, options, pathGuard) {
+    const maxResults = options.maxResults ?? 100;
+    const entries = globEntries({
+        cwd: directory,
+        pattern,
+        excludePatterns,
+        includeHidden: Boolean(options.includeHidden),
+        respectGitignore: Boolean(options.respectGitignore),
+        maxDepth: options.maxDepth ?? 100,
+        suppressErrors: true,
+    });
+    const results = [];
+    let filesScanned = 0;
+    const counters = { skippedInaccessible: 0, stoppedByAbort: false };
+    for await (const entry of guardedEntries(entries, pathGuard, options.signal, counters)) {
+        if (results.length >= maxResults)
+            break;
+        filesScanned++;
+        results.push({ path: entry.path });
+    }
+    // Sorting — only name / path are supported; size / modified were removed
+    // (the glob never collected stats, so they were always undefined).
+    if (options.sortBy === 'name') {
+        results.sort((a, b) => {
+            const aName = a.path.split(/[/\\]/).pop() ?? '';
+            const bName = b.path.split(/[/\\]/).pop() ?? '';
+            return aName.localeCompare(bName);
+        });
+    }
+    else {
+        results.sort((a, b) => a.path.localeCompare(b.path));
+    }
+    const tracker = new StopReasonTracker();
+    if (results.length >= maxResults)
+        tracker.hitMaxResults();
+    if (counters.stoppedByAbort)
+        tracker.hitAbort();
+    const stoppedReason = tracker.resolve();
+    return {
+        basePath: directory,
+        results,
+        summary: {
+            matched: results.length,
+            filesScanned,
+            truncated: tracker.truncated,
+            skippedInaccessible: counters.skippedInaccessible,
+            ...(stoppedReason ? { stoppedReason } : {}),
+        },
+    };
+}
+//# sourceMappingURL=search.js.map

package/dist/core/search.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"search.js","sourceRoot":"","sources":["../../src/core/search.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,IAAI,MAAM,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAG5D,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAC;AAExC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,EAAE,WAAW,EAAkB,MAAM,WAAW,CAAC;AAExD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAc/C,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAErC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,UAA+B,EAAE;IAC7E,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IACnD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,WAAW,CAAC;YAAE,MAAM,KAAK,CAAC;QACjD,MAAM,IAAI,WAAW,CACnB,GAAG,KAAK,CAAC,OAAO,iEAAiE,EACjF,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,KAAwB;IAChD,MAAM,MAAM,GAAI,KAAsE,EAAE,OAAO,CAAC;IAChG,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;IACjE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,KAAY,EAAE,IAAY;IAClD,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;IACpB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAA0B,CAAC;IAC/B,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,KAAK,EAAE,CAAC;QACR,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,SAAS;YAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,iCAAiC;QACzF,IAAI,KAAK,IAAI,oBAAoB;YAAE,MAAM;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAoCD,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,SAAiB,EACjB,OAAe,EACf,OAA6B,EAC7B,SAAoB;IAEpB,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,YAAY,CAAC,YAAY,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC5F,IAAI,CAAC;QACH,OAAO,MAAM,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACjE,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,SAAS,CAAC,CAAC,cAAc,CAC5B,OAAiC,EACjC,SAAoB,EACpB,MAA+B,EAC/B,QAAkE;IAElE,6EAA6E;IAC7E,yEAAyE;IACzE,4DAA4D;IAC5D,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAClC,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,QAAQ,CAAC,cAAc,GAAG,IAAI,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,mBAAmB,EAAE,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,SAAiB,EACjB,OAA6B,EAC7B,SAAoB,EACpB,KAAY;IAEZ,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC;IAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,kBAAkB,EAAE,CAAC;IAEhE,MAAM,OAAO,GAAG,WAAW,CAAC;QAC1B,GAAG,EAAE,SAAS;QACd,OAAO,EAAE,OAAO,CAAC,WAAW,IAAI,MAAM;QACtC,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,EAAE;QAC9C,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACnD,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,GAAG;QACjC,cAAc,EAAE,IAAI;KACrB,CAAC,CAAC;IAEH,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,MAAM,QAAQ,GAAG,EAAE,mBAAmB,EAAE,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IAEnE,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QACvF,IAAI,OAAO,CAAC,MAAM,IAAI,UAAU;YAAE,MAAM;QAExC,2EAA2E;QAC3E,0EAA0E;QAC1E,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,KAAK,CAAC,IAAI,GAAG,WAAW,EAAE,CAAC;gBAC7B,eAAe,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,mBAAmB,EAAE,CAAC;YAC/B,SAAS;QACX,CAAC;QAED,YAAY,EAAE,CAAC;QAEf,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1F,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,WAAW,GAAG,KAAK,CAAC;YACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtB,IAAI,IAAI,KAAK,SAAS;oBAAE,SAAS;gBACjC,qEAAqE;gBACrE,8CAA8C;gBAC9C,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBAClD,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;oBACpB,WAAW,GAAG,IAAI,CAAC;oBACnB,aAAa,EAAE,CAAC;oBAChB,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,OAAO,EAAE,IAAI;wBACb,UAAU,EAAE,WAAW;qBACxB,CAAC,CAAC;oBACH,IAAI,OAAO,CAAC,MAAM,IAAI,UAAU;wBAAE,MAAM;gBAC1C,CAAC;YACH,CAAC;YACD,IAAI,WAAW;gBAAE,YAAY,EAAE,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,sEAAsE;YACtE,uCAAuC;YACvC,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC5B,QAAQ,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC/B,MAAM;YACR,CAAC;YACD,yCAAyC;QAC3C,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,iBAAiB,EAAE,CAAC;IACxC,IAAI,OAAO,CAAC,MAAM,IAAI,UAAU;QAAE,OAAO,CAAC,aAAa,EAAE,CAAC;IAC1D,IAAI,QAAQ,CAAC,cAAc;QAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;IAChD,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAExC,OAAO;QACL,QAAQ,EAAE,SAAS;QACnB,OAAO;QACP,OAAO,EAAE;YACP,aAAa;YACb,YAAY;YACZ,YAAY;YACZ,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;YACjD,eAAe;YACf,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,OAAe,EACf,eAAyB,EACzB,OAOC,EACD,SAAoB;IAYpB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC;IAC7C,MAAM,OAAO,GAAG,WAAW,CAAC;QAC1B,GAAG,EAAE,SAAS;QACd,OAAO;QACP,eAAe;QACf,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACnD,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,GAAG;QACjC,cAAc,EAAE,IAAI;KACrB,CAAC,CAAC;IACH,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,MAAM,QAAQ,GAAG,EAAE,mBAAmB,EAAE,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IAEnE,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QACvF,IAAI,OAAO,CAAC,MAAM,IAAI,UAAU;YAAE,MAAM;QACxC,YAAY,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,yEAAyE;IACzE,mEAAmE;IACnE,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACpB,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAChD,OAAO,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,iBAAiB,EAAE,CAAC;IACxC,IAAI,OAAO,CAAC,MAAM,IAAI,UAAU;QAAE,OAAO,CAAC,aAAa,EAAE,CAAC;IAC1D,IAAI,QAAQ,CAAC,cAAc;QAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;IAChD,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAExC,OAAO;QACL,QAAQ,EAAE,SAAS;QACnB,OAAO;QACP,OAAO,EAAE;YACP,OAAO,EAAE,OAAO,CAAC,MAAM;YACvB,YAAY;YACZ,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;YACjD,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { stat as fsStat, readFile } from 'node:fs/promises';\n\nimport type { RE2ExecArray } from '@adguard/re2-wasm';\nimport { RE2 } from '@adguard/re2-wasm';\n\nimport { StopReasonTracker } from './concurrency.js';\nimport type { StoppedReason } from './concurrency.js';\nimport { globEntries, type GlobEntry } from './glob.js';\nimport type { PathGuard } from './path.js';\nimport { escapeRegexLiteral } from './primitives.js';\nimport { getMaxTextFileSize } from './util.js';\n\ninterface SearchResult {\n  file: string;\n  line: number;\n  content: string;\n  matchCount?: number;\n}\n\nexport type Regex = RE2;\nexport interface RegexCompileOptions {\n  caseSensitive?: boolean;\n}\n\n/** Occurrence-counting bound, so one pathological line cannot spin forever. */\nconst MAX_MATCHES_PER_LINE = 100_000;\n\n/**\n * Compile a pattern on RE2 rather than on V8's irregexp.\n *\n * Patterns arrive from the MCP client, so a backtracking engine would let one\n * request pin the event loop with no way out: an abort signal cannot preempt a\n * synchronous `exec`, and on stdio that wedges the whole server. RE2 matches in\n * time linear in the input and cannot backtrack at all, so the hazard is gone\n * rather than bounded.\n *\n * RE2 rejects the constructs the tool schema documents as unsupported —\n * lookahead, lookbehind, backreferences — with its own {@link SyntaxError},\n * which the tool layer turns into a normal tool error. It always matches in\n * Unicode mode and requires the `u` flag to say so.\n *\n * Every compiled pattern owns memory in re2-wasm's fixed 16 MB heap, which\n * `ALLOW_MEMORY_GROWTH` is off for. re2-wasm never frees it and a\n * FinalizationRegistry does not keep up (V8 sees no pressure from the wasm\n * heap), so exhaustion is an emscripten `abort()` that kills regex search for\n * the rest of the process. Every caller MUST pass the result to\n * {@link freeRegex} when it is done with it.\n */\nexport function compileRegex(pattern: string, options: RegexCompileOptions = {}): Regex {\n  const flags = options.caseSensitive ? 'gu' : 'giu';\n  try {\n    return new RE2(pattern, flags);\n  } catch (error) {\n    if (!(error instanceof SyntaxError)) throw error;\n    throw new SyntaxError(\n      `${error.message} — lookahead, lookbehind, and backreferences are not supported.`,\n      { cause: error },\n    );\n  }\n}\n\n/**\n * Release a compiled pattern's wasm memory. re2-wasm exposes no disposal of its\n * own, so this reaches the embind handle it holds privately; a version that\n * renames the field degrades to the pre-existing leak rather than throwing.\n * Idempotent — a second call on an already-freed handle is swallowed. Using a\n * {@link Regex} after freeing it is undefined behaviour in the wasm heap, so\n * free only in a `finally` that owns the compile.\n */\nexport function freeRegex(regex: Regex | undefined): void {\n  const handle = (regex as unknown as { wrapper?: { delete?: () => void } } | undefined)?.wrapper;\n  try {\n    handle?.delete?.();\n  } catch {\n    // already deleted, or a re2-wasm build without embind disposal\n  }\n}\n\n/**\n * Count non-overlapping occurrences of a global regex in a single line. Guards\n * zero-length matches (e.g. `a*`) so they cannot loop forever.\n */\nfunction countLineMatches(regex: Regex, line: string): number {\n  regex.lastIndex = 0;\n  let count = 0;\n  let match: RE2ExecArray | null;\n  while ((match = regex.exec(line)) !== null) {\n    count++;\n    if (match.index === regex.lastIndex) regex.lastIndex++; // advance past zero-length match\n    if (count >= MAX_MATCHES_PER_LINE) break;\n  }\n  return count;\n}\n\nexport interface SearchContentOptions {\n  caseSensitive?: boolean;\n  isRegex?: boolean;\n  maxResults?: number;\n  filePattern?: string;\n  excludePatterns?: string[];\n  respectGitignore?: boolean;\n  includeHidden?: boolean;\n  maxDepth?: number;\n  maxFileSize?: number;\n  signal?: AbortSignal;\n}\n\nexport interface SearchContentOutcome {\n  basePath: string;\n  matches: SearchResult[];\n  summary: {\n    /**\n     * Matching *lines*, one per entry in `matches` — not pattern occurrences.\n     * A line with three occurrences counts once here and reports 3 in its own\n     * `SearchResult.matchCount`.\n     */\n    matchingLines: number;\n    filesScanned: number;\n    filesMatched: number;\n    truncated: boolean;\n    /** Files the guard rejected or that could not be stat'd. */\n    skippedInaccessible: number;\n    /** Files skipped unread because they exceed maxFileSize. */\n    skippedTooLarge: number;\n    stoppedReason?: StoppedReason;\n  };\n}\n\n/** Owns the compiled pattern's lifetime; the scan itself is `scanContent`. */\nexport async function searchContent(\n  directory: string,\n  pattern: string,\n  options: SearchContentOptions,\n  pathGuard: PathGuard,\n): Promise<SearchContentOutcome> {\n  const regexPattern = options.isRegex ? pattern || '' : escapeRegexLiteral(pattern || '');\n  const regex = compileRegex(regexPattern, { caseSensitive: Boolean(options.caseSensitive) });\n  try {\n    return await scanContent(directory, options, pathGuard, regex);\n  } finally {\n    freeRegex(regex);\n  }\n}\n\nasync function* guardedEntries(\n  entries: AsyncIterable<GlobEntry>,\n  pathGuard: PathGuard,\n  signal: AbortSignal | undefined,\n  counters: { skippedInaccessible: number; stoppedByAbort: boolean },\n): AsyncGenerator<GlobEntry> {\n  // The signal carries both client cancellation and the tool's search timeout,\n  // so an abort means \"return what we have, marked incomplete\" rather than\n  // throw — but it must never be reported as a finished scan.\n  for await (const entry of entries) {\n    if (signal?.aborted) {\n      counters.stoppedByAbort = true;\n      return;\n    }\n    try {\n      await pathGuard.validateExistingPath(entry.path);\n    } catch {\n      counters.skippedInaccessible++;\n      continue;\n    }\n    yield entry;\n  }\n}\n\nasync function scanContent(\n  directory: string,\n  options: SearchContentOptions,\n  pathGuard: PathGuard,\n  regex: Regex,\n): Promise<SearchContentOutcome> {\n  const matches: SearchResult[] = [];\n  const maxResults = options.maxResults ?? 100;\n  const maxFileSize = options.maxFileSize ?? getMaxTextFileSize();\n\n  const entries = globEntries({\n    cwd: directory,\n    pattern: options.filePattern ?? '**/*',\n    excludePatterns: options.excludePatterns ?? [],\n    includeHidden: Boolean(options.includeHidden),\n    respectGitignore: Boolean(options.respectGitignore),\n    maxDepth: options.maxDepth ?? 100,\n    suppressErrors: true,\n  });\n\n  let filesScanned = 0;\n  let filesMatched = 0;\n  let matchingLines = 0;\n  let skippedTooLarge = 0;\n  const counters = { skippedInaccessible: 0, stoppedByAbort: false };\n\n  for await (const entry of guardedEntries(entries, pathGuard, options.signal, counters)) {\n    if (matches.length >= maxResults) break;\n\n    // Skip oversized files before reading to avoid unbounded memory use. Count\n    // them: \"no matches\" for a reason other than the pattern must be visible.\n    try {\n      const stats = await fsStat(entry.path);\n      if (stats.size > maxFileSize) {\n        skippedTooLarge++;\n        continue;\n      }\n    } catch {\n      counters.skippedInaccessible++;\n      continue;\n    }\n\n    filesScanned++;\n\n    try {\n      const content = await readFile(entry.path, { encoding: 'utf-8', signal: options.signal });\n      const lines = content.split('\\n');\n      let matchedFile = false;\n      for (let i = 0; i < lines.length; i++) {\n        const line = lines[i];\n        if (line === undefined) continue;\n        // One scan per line: countLineMatches resets lastIndex itself, so it\n        // doubles as the \"does this line match\" test.\n        const occurrences = countLineMatches(regex, line);\n        if (occurrences > 0) {\n          matchedFile = true;\n          matchingLines++;\n          matches.push({\n            file: entry.path,\n            line: i + 1,\n            content: line,\n            matchCount: occurrences,\n          });\n          if (matches.length >= maxResults) break;\n        }\n      }\n      if (matchedFile) filesMatched++;\n    } catch {\n      // A read failure while the signal is aborted IS the abort, not an\n      // unreadable file — stop rather than spend another iteration and then\n      // report a cut-short scan as complete.\n      if (options.signal?.aborted) {\n        counters.stoppedByAbort = true;\n        break;\n      }\n      // ignore read errors (e.g. binary files)\n    }\n  }\n\n  const tracker = new StopReasonTracker();\n  if (matches.length >= maxResults) tracker.hitMaxResults();\n  if (counters.stoppedByAbort) tracker.hitAbort();\n  const stoppedReason = tracker.resolve();\n\n  return {\n    basePath: directory,\n    matches,\n    summary: {\n      matchingLines,\n      filesScanned,\n      filesMatched,\n      truncated: tracker.truncated,\n      skippedInaccessible: counters.skippedInaccessible,\n      skippedTooLarge,\n      ...(stoppedReason ? { stoppedReason } : {}),\n    },\n  };\n}\n\nexport async function searchFiles(\n  directory: string,\n  pattern: string,\n  excludePatterns: string[],\n  options: {\n    maxResults?: number;\n    includeHidden?: boolean;\n    sortBy?: 'name' | 'path';\n    respectGitignore?: boolean;\n    maxDepth?: number;\n    signal?: AbortSignal;\n  },\n  pathGuard: PathGuard,\n): Promise<{\n  basePath: string;\n  results: { path: string }[];\n  summary: {\n    matched: number;\n    filesScanned: number;\n    truncated: boolean;\n    skippedInaccessible: number;\n    stoppedReason?: StoppedReason;\n  };\n}> {\n  const maxResults = options.maxResults ?? 100;\n  const entries = globEntries({\n    cwd: directory,\n    pattern,\n    excludePatterns,\n    includeHidden: Boolean(options.includeHidden),\n    respectGitignore: Boolean(options.respectGitignore),\n    maxDepth: options.maxDepth ?? 100,\n    suppressErrors: true,\n  });\n  const results: { path: string }[] = [];\n  let filesScanned = 0;\n  const counters = { skippedInaccessible: 0, stoppedByAbort: false };\n\n  for await (const entry of guardedEntries(entries, pathGuard, options.signal, counters)) {\n    if (results.length >= maxResults) break;\n    filesScanned++;\n    results.push({ path: entry.path });\n  }\n\n  // Sorting — only name / path are supported; size / modified were removed\n  // (the glob never collected stats, so they were always undefined).\n  if (options.sortBy === 'name') {\n    results.sort((a, b) => {\n      const aName = a.path.split(/[/\\\\]/).pop() ?? '';\n      const bName = b.path.split(/[/\\\\]/).pop() ?? '';\n      return aName.localeCompare(bName);\n    });\n  } else {\n    results.sort((a, b) => a.path.localeCompare(b.path));\n  }\n\n  const tracker = new StopReasonTracker();\n  if (results.length >= maxResults) tracker.hitMaxResults();\n  if (counters.stoppedByAbort) tracker.hitAbort();\n  const stoppedReason = tracker.resolve();\n\n  return {\n    basePath: directory,\n    results,\n    summary: {\n      matched: results.length,\n      filesScanned,\n      truncated: tracker.truncated,\n      skippedInaccessible: counters.skippedInaccessible,\n      ...(stoppedReason ? { stoppedReason } : {}),\n    },\n  };\n}\n"]}

package/dist/core/sensitive.d.ts

@@ -0,0 +1,6 @@
+export declare class SensitiveMatcher {
+    private readonly patterns;
+    constructor(patterns?: readonly string[]);
+    isSensitive(filePath: string): boolean;
+}
+//# sourceMappingURL=sensitive.d.ts.map

package/dist/core/sensitive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive.d.ts","sourceRoot":"","sources":["../../src/core/sensitive.ts"],"names":[],"mappings":"AA+JA,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;gBAElC,QAAQ,GAAE,SAAS,MAAM,EAA6B;IAIlE,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;CAWvC"}

package/dist/core/sensitive.js

@@ -0,0 +1,142 @@
+// Sensitive-file denylist policy: the compiled pattern set, the path
+// normalization that feeds it, and the NTFS alternate-data-stream stripping
+// Windows needs. Split out of path.ts so the denylist has its own home — it
+// shares only isAlpha / toPosixPath / IS_WINDOWS with the primitives in
+// primitives.ts, not the allowed-directory assembly. path-completer.ts and
+// glob.ts reach it through PathGuard.isSensitive, which delegates here.
+import { normalize, posix, sep } from 'node:path';
+import { cli } from './config.js';
+import { IS_WINDOWS, isAlpha, parseTrueEnvFlag, toPosixPath } from './primitives.js';
+const CHAR_COLON = 58;
+const CHAR_FORWARD_SLASH = 47;
+function normalizeForMatch(input) {
+    // Always lowercase for case-insensitive denylist matching on all platforms.
+    return toPosixPath(normalize(input)).toLowerCase();
+}
+function isWindowsAbsolutePosixPath(normalizedPattern) {
+    return (normalizedPattern.length >= 3 &&
+        normalizedPattern.charCodeAt(1) === CHAR_COLON &&
+        normalizedPattern.charCodeAt(2) === CHAR_FORWARD_SLASH &&
+        isAlpha(normalizedPattern.charCodeAt(0)));
+}
+function compilePatternGlobs(normalizedPattern) {
+    const globs = new Set([normalizedPattern]);
+    const isRooted = normalizedPattern.startsWith('**/') || isWindowsAbsolutePosixPath(normalizedPattern);
+    if (!isRooted) {
+        const withoutRoot = normalizedPattern.replace(/^\/+/, '');
+        if (withoutRoot) {
+            globs.add(`**/${withoutRoot}`);
+        }
+    }
+    return Array.from(globs);
+}
+function compilePatterns(patterns) {
+    const deduped = Array.from(new Set(patterns.map((p) => p.trim()).filter((p) => p.length > 0)));
+    return deduped.map((pattern) => {
+        const normalized = normalizeForMatch(pattern);
+        const matchesPath = normalized.includes('/');
+        return {
+            globs: matchesPath ? compilePatternGlobs(normalized) : [normalized],
+            matchesPath,
+        };
+    });
+}
+function toPatternSet(patterns) {
+    const pathGlobs = new Set();
+    const nameGlobs = new Set();
+    for (const pattern of patterns) {
+        const target = pattern.matchesPath ? pathGlobs : nameGlobs;
+        for (const glob of pattern.globs) {
+            target.add(glob);
+        }
+    }
+    return {
+        pathGlobs: [...pathGlobs],
+        nameGlobs: [...nameGlobs],
+    };
+}
+function matchesAnyGlob(globs, candidate) {
+    if (globs.length === 0)
+        return false;
+    for (const glob of globs) {
+        if (posix.matchesGlob(candidate, glob))
+            return true;
+    }
+    return false;
+}
+// Strip NTFS alternate-data-stream suffixes (the ":stream" after a segment)
+// before denylist matching, so `.env:secret` is caught as `.env`. Preserves the
+// drive-letter colon in the first segment of an absolute path. Also trims
+// trailing dots/spaces: Win32 strips them at the syscall boundary (a request
+// to create `.env ` actually creates `.env`), so without trimming them here the
+// exact-name patterns (`.env`, `.npmrc`) are bypassed on Windows. Mirrors the
+// precedent in getReservedDeviceName (path.ts) which trims for the same reason.
+function stripAlternateDataStreams(filePath) {
+    const parts = filePath.split(/[\\/]/);
+    const stripped = parts.map((segment, i) => {
+        if (i === 0 &&
+            segment.length === 2 &&
+            isAlpha(segment.charCodeAt(0)) &&
+            segment.charCodeAt(1) === CHAR_COLON) {
+            return segment;
+        }
+        const colonIdx = segment.indexOf(':');
+        const withoutStream = colonIdx !== -1 ? segment.slice(0, colonIdx) : segment;
+        // Win32 strips trailing dots and spaces at the syscall boundary, so a
+        // request for ".env " creates ".env". Strip them before denylist matching
+        // or the exact-name patterns (".env", ".npmrc") are bypassed on Windows.
+        return trimTrailingDotsAndSpaces(withoutStream);
+    });
+    return stripped.join(sep);
+}
+const trimTrailingDotsAndSpaces = (segment) => segment.replace(/[. ]+$/, '');
+const DEFAULT_SENSITIVE_PATTERNS = [
+    '.env',
+    '.env.*',
+    '.npmrc',
+    '.pypirc',
+    '.aws/credentials',
+    '.aws/config',
+    '.mcpregistry_*_token',
+    '*.pem',
+    '*.key',
+    '*.p12',
+    '*.pfx',
+    '*.crt',
+    '*.cer',
+    '*id_rsa*',
+    '*id_dsa*',
+];
+function buildSensitivePatterns() {
+    const allowSensitive = cli.allowSensitive ?? parseTrueEnvFlag(process.env['FS_ALLOW_SENSITIVE'], 'FS_ALLOW_SENSITIVE');
+    const envValue = process.env['FS_DENYLIST'];
+    const envDenylist = envValue
+        ? envValue
+            .split(/[,\n]/u)
+            .map((t) => t.trim())
+            .filter((t) => t.length > 0)
+        : [];
+    const flagDenylist = cli.denyPatterns ?? [];
+    // FS_ALLOW_SENSITIVE suppresses built-ins only; deny entries (env and --deny)
+    // always apply. Set-dedupe so a pattern in both sources matches once.
+    return [
+        ...(allowSensitive ? [] : DEFAULT_SENSITIVE_PATTERNS),
+        ...new Set([...envDenylist, ...flagDenylist]),
+    ];
+}
+export class SensitiveMatcher {
+    patterns;
+    constructor(patterns = buildSensitivePatterns()) {
+        this.patterns = toPatternSet(compilePatterns(patterns));
+    }
+    isSensitive(filePath) {
+        if (this.patterns.pathGlobs.length === 0 && this.patterns.nameGlobs.length === 0) {
+            return false;
+        }
+        const pathToCheck = IS_WINDOWS ? stripAlternateDataStreams(filePath) : filePath;
+        const normalizedPath = normalizeForMatch(pathToCheck);
+        return (matchesAnyGlob(this.patterns.pathGlobs, normalizedPath) ||
+            matchesAnyGlob(this.patterns.nameGlobs, posix.basename(normalizedPath)));
+    }
+}
+//# sourceMappingURL=sensitive.js.map

package/dist/core/sensitive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive.js","sourceRoot":"","sources":["../../src/core/sensitive.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,4EAA4E;AAC5E,4EAA4E;AAC5E,wEAAwE;AACxE,2EAA2E;AAC3E,wEAAwE;AACxE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAElD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAErF,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B,SAAS,iBAAiB,CAAC,KAAa;IACtC,4EAA4E;IAC5E,OAAO,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACrD,CAAC;AAYD,SAAS,0BAA0B,CAAC,iBAAyB;IAC3D,OAAO,CACL,iBAAiB,CAAC,MAAM,IAAI,CAAC;QAC7B,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU;QAC9C,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,kBAAkB;QACtD,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CACzC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,iBAAyB;IACpD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAEnD,MAAM,QAAQ,GACZ,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,0BAA0B,CAAC,iBAAiB,CAAC,CAAC;IACvF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1D,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,CAAC,GAAG,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,eAAe,CAAC,QAA2B;IAClD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7C,OAAO;YACL,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;YACnE,WAAW;SACZ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,QAAoC;IACxD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC;QACzB,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAwB,EAAE,SAAiB;IACjE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAErC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACtD,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,gFAAgF;AAChF,0EAA0E;AAC1E,6EAA6E;AAC7E,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,SAAS,yBAAyB,CAAC,QAAgB;IACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE;QACxC,IACE,CAAC,KAAK,CAAC;YACP,OAAO,CAAC,MAAM,KAAK,CAAC;YACpB,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC9B,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,EACpC,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,aAAa,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC7E,sEAAsE;QACtE,0EAA0E;QAC1E,yEAAyE;QACzE,OAAO,yBAAyB,CAAC,aAAa,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,yBAAyB,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAE7F,MAAM,0BAA0B,GAAG;IACjC,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,kBAAkB;IAClB,aAAa;IACb,sBAAsB;IACtB,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,UAAU;IACV,UAAU;CACF,CAAC;AAEX,SAAS,sBAAsB;IAC7B,MAAM,cAAc,GAClB,GAAG,CAAC,cAAc,IAAI,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAClG,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,QAAQ;QAC1B,CAAC,CAAC,QAAQ;aACL,KAAK,CAAC,QAAQ,CAAC;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAChC,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;IAC5C,8EAA8E;IAC9E,sEAAsE;IACtE,OAAO;QACL,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,0BAA0B,CAAC;QACrD,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,EAAE,GAAG,YAAY,CAAC,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,gBAAgB;IACV,QAAQ,CAAqB;IAE9C,YAAY,WAA8B,sBAAsB,EAAE;QAChE,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,WAAW,CAAC,QAAgB;QAC1B,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAChF,MAAM,cAAc,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACtD,OAAO,CACL,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;YACvD,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CACxE,CAAC;IACJ,CAAC;CACF","sourcesContent":["// Sensitive-file denylist policy: the compiled pattern set, the path\n// normalization that feeds it, and the NTFS alternate-data-stream stripping\n// Windows needs. Split out of path.ts so the denylist has its own home — it\n// shares only isAlpha / toPosixPath / IS_WINDOWS with the primitives in\n// primitives.ts, not the allowed-directory assembly. path-completer.ts and\n// glob.ts reach it through PathGuard.isSensitive, which delegates here.\nimport { normalize, posix, sep } from 'node:path';\n\nimport { cli } from './config.js';\nimport { IS_WINDOWS, isAlpha, parseTrueEnvFlag, toPosixPath } from './primitives.js';\n\nconst CHAR_COLON = 58;\nconst CHAR_FORWARD_SLASH = 47;\n\nfunction normalizeForMatch(input: string): string {\n  // Always lowercase for case-insensitive denylist matching on all platforms.\n  return toPosixPath(normalize(input)).toLowerCase();\n}\n\ninterface CompiledPattern {\n  globs: readonly string[];\n  matchesPath: boolean;\n}\n\ninterface CompiledPatternSet {\n  pathGlobs: readonly string[];\n  nameGlobs: readonly string[];\n}\n\nfunction isWindowsAbsolutePosixPath(normalizedPattern: string): boolean {\n  return (\n    normalizedPattern.length >= 3 &&\n    normalizedPattern.charCodeAt(1) === CHAR_COLON &&\n    normalizedPattern.charCodeAt(2) === CHAR_FORWARD_SLASH &&\n    isAlpha(normalizedPattern.charCodeAt(0))\n  );\n}\n\nfunction compilePatternGlobs(normalizedPattern: string): readonly string[] {\n  const globs = new Set<string>([normalizedPattern]);\n\n  const isRooted =\n    normalizedPattern.startsWith('**/') || isWindowsAbsolutePosixPath(normalizedPattern);\n  if (!isRooted) {\n    const withoutRoot = normalizedPattern.replace(/^\\/+/, '');\n    if (withoutRoot) {\n      globs.add(`**/${withoutRoot}`);\n    }\n  }\n\n  return Array.from(globs);\n}\n\nfunction compilePatterns(patterns: readonly string[]): CompiledPattern[] {\n  const deduped = Array.from(new Set(patterns.map((p) => p.trim()).filter((p) => p.length > 0)));\n  return deduped.map((pattern) => {\n    const normalized = normalizeForMatch(pattern);\n    const matchesPath = normalized.includes('/');\n    return {\n      globs: matchesPath ? compilePatternGlobs(normalized) : [normalized],\n      matchesPath,\n    };\n  });\n}\n\nfunction toPatternSet(patterns: readonly CompiledPattern[]): CompiledPatternSet {\n  const pathGlobs = new Set<string>();\n  const nameGlobs = new Set<string>();\n\n  for (const pattern of patterns) {\n    const target = pattern.matchesPath ? pathGlobs : nameGlobs;\n    for (const glob of pattern.globs) {\n      target.add(glob);\n    }\n  }\n\n  return {\n    pathGlobs: [...pathGlobs],\n    nameGlobs: [...nameGlobs],\n  };\n}\n\nfunction matchesAnyGlob(globs: readonly string[], candidate: string): boolean {\n  if (globs.length === 0) return false;\n\n  for (const glob of globs) {\n    if (posix.matchesGlob(candidate, glob)) return true;\n  }\n\n  return false;\n}\n\n// Strip NTFS alternate-data-stream suffixes (the \":stream\" after a segment)\n// before denylist matching, so `.env:secret` is caught as `.env`. Preserves the\n// drive-letter colon in the first segment of an absolute path. Also trims\n// trailing dots/spaces: Win32 strips them at the syscall boundary (a request\n// to create `.env ` actually creates `.env`), so without trimming them here the\n// exact-name patterns (`.env`, `.npmrc`) are bypassed on Windows. Mirrors the\n// precedent in getReservedDeviceName (path.ts) which trims for the same reason.\nfunction stripAlternateDataStreams(filePath: string): string {\n  const parts = filePath.split(/[\\\\/]/);\n  const stripped = parts.map((segment, i) => {\n    if (\n      i === 0 &&\n      segment.length === 2 &&\n      isAlpha(segment.charCodeAt(0)) &&\n      segment.charCodeAt(1) === CHAR_COLON\n    ) {\n      return segment;\n    }\n    const colonIdx = segment.indexOf(':');\n    const withoutStream = colonIdx !== -1 ? segment.slice(0, colonIdx) : segment;\n    // Win32 strips trailing dots and spaces at the syscall boundary, so a\n    // request for \".env \" creates \".env\". Strip them before denylist matching\n    // or the exact-name patterns (\".env\", \".npmrc\") are bypassed on Windows.\n    return trimTrailingDotsAndSpaces(withoutStream);\n  });\n  return stripped.join(sep);\n}\n\nconst trimTrailingDotsAndSpaces = (segment: string): string => segment.replace(/[. ]+$/, '');\n\nconst DEFAULT_SENSITIVE_PATTERNS = [\n  '.env',\n  '.env.*',\n  '.npmrc',\n  '.pypirc',\n  '.aws/credentials',\n  '.aws/config',\n  '.mcpregistry_*_token',\n  '*.pem',\n  '*.key',\n  '*.p12',\n  '*.pfx',\n  '*.crt',\n  '*.cer',\n  '*id_rsa*',\n  '*id_dsa*',\n] as const;\n\nfunction buildSensitivePatterns(): readonly string[] {\n  const allowSensitive =\n    cli.allowSensitive ?? parseTrueEnvFlag(process.env['FS_ALLOW_SENSITIVE'], 'FS_ALLOW_SENSITIVE');\n  const envValue = process.env['FS_DENYLIST'];\n  const envDenylist = envValue\n    ? envValue\n        .split(/[,\\n]/u)\n        .map((t) => t.trim())\n        .filter((t) => t.length > 0)\n    : [];\n  const flagDenylist = cli.denyPatterns ?? [];\n  // FS_ALLOW_SENSITIVE suppresses built-ins only; deny entries (env and --deny)\n  // always apply. Set-dedupe so a pattern in both sources matches once.\n  return [\n    ...(allowSensitive ? [] : DEFAULT_SENSITIVE_PATTERNS),\n    ...new Set([...envDenylist, ...flagDenylist]),\n  ];\n}\n\nexport class SensitiveMatcher {\n  private readonly patterns: CompiledPatternSet;\n\n  constructor(patterns: readonly string[] = buildSensitivePatterns()) {\n    this.patterns = toPatternSet(compilePatterns(patterns));\n  }\n\n  isSensitive(filePath: string): boolean {\n    if (this.patterns.pathGlobs.length === 0 && this.patterns.nameGlobs.length === 0) {\n      return false;\n    }\n    const pathToCheck = IS_WINDOWS ? stripAlternateDataStreams(filePath) : filePath;\n    const normalizedPath = normalizeForMatch(pathToCheck);\n    return (\n      matchesAnyGlob(this.patterns.pathGlobs, normalizedPath) ||\n      matchesAnyGlob(this.patterns.nameGlobs, posix.basename(normalizedPath))\n    );\n  }\n}\n"]}

package/dist/core/store.d.ts

@@ -0,0 +1,57 @@
+import type { ContentBlock } from '@modelcontextprotocol/server';
+interface ResourceEntry {
+    uri: string;
+    name: string;
+    mimeType: string;
+    size: number;
+    storedAt: string;
+    expiresAt: string;
+    text: string;
+}
+export declare class ResourceStore {
+    private readonly byUri;
+    private _totalBytes;
+    private readonly onListChanged;
+    constructor(onListChanged?: () => void);
+    private emitListChanged;
+    private bumpLru;
+    private removeEntry;
+    private evictOldest;
+    private pruneExpiredEntries;
+    private enforceLimits;
+    private getExisting;
+    private checkBeforePut;
+    putText(params: {
+        name: string;
+        mimeType?: string;
+        text: string;
+    }): ResourceEntry;
+    getEntry(uri: string): ResourceEntry;
+    /**
+     * Returns live URIs currently in the store.
+     * Side effect: prunes expired entries before returning.
+     *
+     * Deliberately silent: this is the read path `resources/list` runs through,
+     * and the caller is already receiving the post-prune list. Emitting here
+     * would tell the client its list changed while handing it that same list.
+     */
+    keys(): string[];
+}
+export interface JsonResourceResult {
+    entry: {
+        uri: string;
+        size: number;
+        mimeType: string;
+        expiresAt: string;
+    };
+    link: ContentBlock;
+}
+/**
+ * Owner of the externalize-a-payload rule: a tool whose inline response is
+ * truncated publishes the full value to the resource store as pretty-printed
+ * JSON and hands back the URI to reach it by, plus the link block that offers
+ * it to the user.
+ */
+export declare function putJsonResource(store: ResourceStore, name: string, value: Record<string, unknown> | readonly unknown[]): JsonResourceResult;
+export {};
+//# sourceMappingURL=store.d.ts.map

package/dist/core/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/core/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAQjE,UAAU,aAAa;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAeD,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoC;IAC1D,OAAO,CAAC,WAAW,CAAK;IAExB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2B;gBAE7C,aAAa,CAAC,EAAE,MAAM,IAAI;IAItC,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,OAAO;IAQf,OAAO,CAAC,WAAW;IAUnB,OAAO,CAAC,WAAW;IAQnB,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,aAAa;IAerB,OAAO,CAAC,WAAW;IAuBnB,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,aAAa;IAqBjF,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa;IAIpC;;;;;;;OAOG;IACH,IAAI,IAAI,MAAM,EAAE;CAIjB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE;QACL,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,IAAI,EAAE,YAAY,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,aAAa,EACpB,IAAI,EAAE,MAAM,EAIZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,OAAO,EAAE,GAClD,kBAAkB,CAuBpB"}