@j0hanz/filesystem-mcp 1.9.0 → 1.10.0

package/dist/lib/file-operations/search.js

@@ -1,5 +1,6 @@
 import * as fsp from 'node:fs/promises';
 import * as path from 'node:path';
+import { existsSync } from 'node:fs';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { parentPort, threadId, Worker, workerData } from 'node:worker_threads';
 import RE2 from 're2';
@@ -17,6 +18,7 @@ export const MatcherOptionsSchema = z.strictObject({
     caseSensitive: z.boolean(),
     wholeWord: z.boolean(),
     isLiteral: z.boolean(),
+    multiline: z.boolean(),
 });
 function countRegexLineMatches(regex, line) {
     regex.lastIndex = 0;
@@ -67,8 +69,11 @@ function buildLiteralMatcher(pattern, options) {
         return count;
     };
 }
-function buildRegexMatcher(final, caseSensitive) {
-    const regex = new RE2(final, caseSensitive ? 'g' : 'gi');
+function buildRegexMatcher(final, caseSensitive, multiline) {
+    let flags = caseSensitive ? 'g' : 'gi';
+    if (multiline)
+        flags += 'm';
+    const regex = new RE2(final, flags);
     return (line) => countRegexLineMatches(regex, line);
 }
 export function buildMatcher(pattern, options) {
@@ -80,7 +85,7 @@ export function buildMatcher(pattern, options) {
     }
     const final = buildRegexPattern(pattern, options);
     validatePattern(pattern, options); // Re-validate to be safe
-    return buildRegexMatcher(final, options.caseSensitive);
+    return buildRegexMatcher(final, options.caseSensitive, options.multiline);
 }
 // --- Configuration & Schemas ---
 const SEARCH_CONTENT_MAX_RESULTS = 500;
@@ -88,14 +93,15 @@ const SearchOptionsSchema = z.strictObject({
     filePattern: z.string().min(1),
     excludePatterns: z.array(z.string()),
     caseSensitive: z.boolean(),
-    maxResults: z.number().int().nonnegative(),
-    maxFileSize: z.number().int().nonnegative(),
-    maxFilesScanned: z.number().int().nonnegative(),
-    timeoutMs: z.number().int().nonnegative(),
+    maxResults: z.int().min(0),
+    maxFileSize: z.int().min(0),
+    maxFilesScanned: z.int().min(0),
+    timeoutMs: z.int().min(0),
     skipBinary: z.boolean(),
-    contextLines: z.number().int().nonnegative(),
+    contextLines: z.int().min(0),
     wholeWord: z.boolean(),
     isLiteral: z.boolean(),
+    multiline: z.boolean(),
     includeHidden: z.boolean(),
     baseNameMatch: z.boolean(),
     caseSensitiveFileMatch: z.boolean(),
@@ -112,6 +118,7 @@ const DEFAULTS = {
     contextLines: 0,
     wholeWord: false,
     isLiteral: true,
+    multiline: false,
     includeHidden: false,
     baseNameMatch: false,
     caseSensitiveFileMatch: true,
@@ -297,6 +304,14 @@ function buildScanFileOptions(opts) {
         contextLines: opts.contextLines,
     };
 }
+function buildMatcherOptions(opts) {
+    return {
+        caseSensitive: opts.caseSensitive,
+        wholeWord: opts.wholeWord,
+        isLiteral: opts.isLiteral,
+        multiline: opts.multiline,
+    };
+}
 function applyScanOutcome(summary, outcome) {
     if (outcome.matched)
         summary.filesMatched++;
@@ -344,6 +359,7 @@ const isSourceContext = currentDir.endsWith('src\\lib\\file-operations') ||
     currentDir.endsWith('src/lib/file-operations');
 const WORKER_SCRIPT_PATH = path.join(currentDir, isSourceContext ? 'search-worker.ts' : 'search-worker.js');
 const WORKER_SCRIPT_URL = pathToFileURL(WORKER_SCRIPT_PATH);
+const hasWorkerScript = existsSync(WORKER_SCRIPT_PATH);
 class SearchWorkerPool {
     size;
     debug;
@@ -475,7 +491,7 @@ class SearchWorkerPool {
     }
 }
 function isWorkerPoolAvailable() {
-    return !isSourceContext;
+    return !isSourceContext && hasWorkerScript;
 }
 function shouldUseWorkers() {
     return isWorkerPoolAvailable() && SEARCH_WORKERS >= 2;
@@ -516,8 +532,8 @@ async function executeSequential(files, pattern, opts, signal, summary) {
     }
     return matches;
 }
-// Helper to manage pool filling
-async function fillWorkerPool(pool, pending, iterator, pattern, matcherOpts, scanOpts, maxResults, currentMatches, summary) {
+async function fillWorkerPool(context) {
+    const { pool, pending, iterator, pattern, matcherOpts, scanOpts, maxResults, currentMatches, summary, } = context;
     while (pending.size < SEARCH_WORKERS) {
         const result = await iterator.next();
         if (result.done)
@@ -574,15 +590,20 @@ async function waitForWinner(pending) {
     }
     return Promise.race(raceCandidates);
 }
+function updateParallelTruncation(summary, signal, matchesLength, maxResults) {
+    if (signal.aborted) {
+        markTruncated(summary, 'timeout');
+        return;
+    }
+    if (matchesLength >= maxResults) {
+        markTruncated(summary, 'maxResults');
+    }
+}
 async function executeParallel(files, pattern, opts, signal, summary) {
     const pool = getPool();
     const matches = [];
     const scanOpts = buildScanFileOptions(opts);
-    const matcherOpts = {
-        caseSensitive: opts.caseSensitive,
-        wholeWord: opts.wholeWord,
-        isLiteral: opts.isLiteral,
-    };
+    const matcherOpts = buildMatcherOptions(opts);
     const pending = new Set();
     const iterator = files[Symbol.asyncIterator]();
     let exhausted = false;
@@ -598,7 +619,17 @@ async function executeParallel(files, pattern, opts, signal, summary) {
                 break;
             }
             if (!exhausted) {
-                exhausted = await fillWorkerPool(pool, pending, iterator, pattern, matcherOpts, scanOpts, opts.maxResults, matches.length, summary);
+                exhausted = await fillWorkerPool({
+                    pool,
+                    pending,
+                    iterator,
+                    pattern,
+                    matcherOpts,
+                    scanOpts,
+                    maxResults: opts.maxResults,
+                    currentMatches: matches.length,
+                    summary,
+                });
             }
             if (pending.size === 0 && exhausted) {
                 break;
@@ -617,13 +648,7 @@ async function executeParallel(files, pattern, opts, signal, summary) {
         if (iterator.return)
             await iterator.return();
     }
-    // Update summary truncation
-    if (signal.aborted) {
-        markTruncated(summary, 'timeout');
-    }
-    else if (matches.length >= opts.maxResults) {
-        markTruncated(summary, 'maxResults');
-    }
+    updateParallelTruncation(summary, signal, matches.length, opts.maxResults);
     return matches;
 }
 // --- Entry Points ---
@@ -702,11 +727,7 @@ async function searchDirectory(details, opts, pattern, signal, onProgress) {
             summary.stoppedReason = 'maxFiles';
         }
     }
-    const matcherOpts = {
-        caseSensitive: opts.caseSensitive,
-        wholeWord: opts.wholeWord,
-        isLiteral: opts.isLiteral,
-    };
+    const matcherOpts = buildMatcherOptions(opts);
     validatePattern(pattern, matcherOpts);
     const matches = shouldUseWorkers()
         ? await executeParallel(countingStream(), pattern, opts, signal, summary)
@@ -841,7 +862,8 @@ function handleEntry(entry, entryType, needsStats, normalized, state) {
         state.stoppedReason = 'maxResults';
     }
 }
-async function collectFromStream(stream, root, rootDirectories, gitignoreMatcher, normalized, needsStats, state, signal, accessDeps, onProgress) {
+async function collectFromStream(stream, signal, context) {
+    const { root, rootDirectories, gitignoreMatcher, normalized, needsStats, state, accessDeps, onProgress, } = context;
     for await (const entry of stream) {
         if (shouldStopCollecting(state, normalized, signal))
             break;
@@ -891,7 +913,16 @@ async function collectSearchResults(root, pattern, excludePatterns, normalized,
     const gitignoreMatcher = normalized.respectGitignore
         ? await loadRootGitignore(root, signal)
         : null;
-    await collectFromStream(stream, root, rootDirectories, gitignoreMatcher, normalized, needsStats, state, signal, accessDeps, onProgress);
+    await collectFromStream(stream, signal, {
+        root,
+        rootDirectories,
+        gitignoreMatcher,
+        normalized,
+        needsStats,
+        state,
+        accessDeps,
+        ...(onProgress ? { onProgress } : {}),
+    });
     return buildCollectResult(state);
 }
 function buildSearchSummary(results, filesScanned, truncated, stoppedReason, skippedInaccessible) {
@@ -956,7 +987,8 @@ function getMatcherCacheKey(pattern, options) {
     const cs = options.caseSensitive ? '1' : '0';
     const ww = options.wholeWord ? '1' : '0';
     const lit = options.isLiteral ? '1' : '0';
-    return `${pattern}|${cs}|${ww}|${lit}`;
+    const ml = options.multiline ? '1' : '0';
+    return `${pattern}|${cs}|${ww}|${lit}|${ml}`;
 }
 function getCachedMatcher(pattern, options) {
     const key = getMatcherCacheKey(pattern, options);

package/dist/lib/fs-helpers.d.ts

@@ -19,11 +19,12 @@ export declare function processInParallel<T, R>(items: T[], processor: (item: T)
 export declare function getFileType(stats: Stats): FileType;
 export declare function isHidden(name: string): boolean;
 export declare function isProbablyBinary(filePath: string, existingHandle?: fsp.FileHandle, signal?: AbortSignal): Promise<boolean>;
-type ReadMode = 'head' | 'full' | 'range';
+type ReadMode = 'head' | 'full' | 'range' | 'tail';
 interface ReadFileOptions {
     encoding?: BufferEncoding;
     maxSize?: number;
     head?: number;
+    tail?: number;
     startLine?: number;
     endLine?: number;
     skipBinary?: boolean;
@@ -36,6 +37,7 @@ interface ReadFileResult {
     totalLines?: number;
     readMode: ReadMode;
     head?: number;
+    tail?: number;
     startLine?: number;
     endLine?: number;
     linesRead?: number;

package/dist/lib/fs-helpers.js

@@ -241,15 +241,20 @@ function isBinarySlice(slice) {
 }
 function validateReadOptions(options) {
     const hasHead = options.head !== undefined;
+    const hasTail = options.tail !== undefined;
     const hasStart = options.startLine !== undefined;
     const hasEnd = options.endLine !== undefined;
     assertPositiveSafeIntegerOption('maxSize', options.maxSize, 'maxSize must be at least 1');
     assertPositiveSafeIntegerOption('head', options.head, 'head must be at least 1');
+    assertPositiveSafeIntegerOption('tail', options.tail, 'tail must be at least 1');
     assertPositiveSafeIntegerOption('startLine', options.startLine, 'startLine must be at least 1');
     assertPositiveSafeIntegerOption('endLine', options.endLine, 'endLine must be at least 1');
     if (hasHead && (hasStart || hasEnd)) {
         throw new McpError(ErrorCode.E_INVALID_INPUT, 'head cannot be used together with startLine/endLine');
     }
+    if (hasTail && (hasHead || hasStart || hasEnd)) {
+        throw new McpError(ErrorCode.E_INVALID_INPUT, 'tail cannot be used together with head/startLine/endLine');
+    }
     if (hasEnd && !hasStart) {
         throw new McpError(ErrorCode.E_INVALID_INPUT, 'endLine requires startLine');
     }
@@ -269,6 +274,9 @@ function normalizeOptions(options) {
     if (options.head !== undefined) {
         normalized.head = options.head;
     }
+    if (options.tail !== undefined) {
+        normalized.tail = options.tail;
+    }
     if (options.startLine !== undefined) {
         normalized.startLine = options.startLine;
     }
@@ -298,6 +306,8 @@ function buildReadContentOptions(normalized) {
 function resolveReadMode(options) {
     if (options.head !== undefined)
         return 'head';
+    if (options.tail !== undefined)
+        return 'tail';
     if (options.startLine !== undefined)
         return 'range';
     return 'full';
@@ -446,6 +456,37 @@ async function readRangeContent(handle, startLine, endLine, options) {
         hasMoreLines: effectiveHasMoreLines,
     };
 }
+async function readTailContent(handle, tail, options) {
+    assertNotAborted(options.signal);
+    const ring = new Array(tail);
+    let totalLines = 0;
+    let head = 0;
+    let size = 0;
+    for await (const line of handle.readLines({
+        encoding: options.encoding,
+        signal: options.signal,
+    })) {
+        ring[head] = line;
+        head = (head + 1) % tail;
+        if (size < tail)
+            size++;
+        totalLines++;
+    }
+    const lines = new Array(size);
+    const start = size < tail ? 0 : head;
+    for (let i = 0; i < size; i++) {
+        lines[i] = ring[(start + i) % tail] ?? '';
+    }
+    const content = lines.join('\n');
+    const linesRead = countLines(content);
+    const hasMoreLines = totalLines > tail;
+    return {
+        content,
+        truncated: hasMoreLines,
+        linesRead,
+        hasMoreLines,
+    };
+}
 async function readFullContent(handle, encoding, maxSize, requestedPath, signal) {
     const buffer = await readFileBufferWithLimit(handle, maxSize, requestedPath, signal);
     const content = buffer.toString(encoding);
@@ -501,6 +542,17 @@ function buildFullResult(validPath, content, totalLines) {
         hasMoreLines: false,
     };
 }
+function buildTailResult(validPath, content, truncated, tail, linesRead, hasMoreLines) {
+    return {
+        path: validPath,
+        content,
+        truncated,
+        readMode: 'tail',
+        tail,
+        linesRead,
+        hasMoreLines,
+    };
+}
 function assertSizeWithinLimit(size, maxSize, filePath) {
     if (size <= maxSize)
         return;
@@ -526,11 +578,22 @@ async function readFullResult(handle, validPath, filePath, stats, normalized) {
     const { content, totalLines } = await readFullContent(handle, normalized.encoding, normalized.maxSize, filePath, normalized.signal);
     return buildFullResult(validPath, content, totalLines);
 }
+async function readTailResult(handle, validPath, filePath, normalized) {
+    if (normalized.tail === undefined) {
+        throw new McpError(ErrorCode.E_INVALID_INPUT, 'Missing tail option', filePath);
+    }
+    const readOptions = buildReadContentOptions(normalized);
+    const { content, truncated, linesRead, hasMoreLines } = await readTailContent(handle, normalized.tail, readOptions);
+    return buildTailResult(validPath, content, truncated, normalized.tail, linesRead, hasMoreLines);
+}
 async function readByMode(handle, validPath, filePath, stats, normalized) {
     const mode = resolveReadMode(normalized);
     if (mode === 'head') {
         return readHeadResult(handle, validPath, filePath, normalized);
     }
+    if (mode === 'tail') {
+        return readTailResult(handle, validPath, filePath, normalized);
+    }
     if (mode === 'range') {
         return readRangeResult(handle, validPath, filePath, normalized);
     }

package/dist/lib/paths.d.ts

@@ -3,6 +3,10 @@ import { McpError } from './errors.js';
 export declare function toPosixPath(value: string): string;
 export declare function isSensitivePath(requestedPath: string, resolvedPath?: string): boolean;
 export declare function assertAllowedFileAccess(requestedPath: string, resolvedPath?: string): void;
+export interface AllowedDirectoriesState {
+    primary: string[];
+    expanded: string[];
+}
 /**
  * Normalizes any path-like input to an absolute path suitable for comparisons.
  * - Expands "~" home directory shorthand.
@@ -10,9 +14,13 @@ export declare function assertAllowedFileAccess(requestedPath: string, resolvedP
  * - Lowercases Windows drive letter for stable comparisons.
  */
 export declare function normalizePath(p: string): string;
+export declare function withAllowedDirectoriesState<T>(state: AllowedDirectoriesState, run: () => T): T;
+export declare function getAllowedDirectoriesState(): AllowedDirectoriesState;
+export declare function setAllowedDirectoriesStateResolved(state: AllowedDirectoriesState): void;
 export declare function getAllowedDirectories(): string[];
 export declare function isAllowedDirectoryRoot(normalizedPath: string): boolean;
 export declare function isPathWithinDirectories(normalizedPath: string, allowedDirs: readonly string[]): boolean;
+export declare function resolveAllowedDirectoriesState(dirs: readonly string[], signal?: AbortSignal): Promise<AllowedDirectoriesState>;
 export declare function setAllowedDirectoriesResolved(dirs: readonly string[], signal?: AbortSignal): Promise<void>;
 export declare function getReservedDeviceNameForPath(requestedPath: string): string | undefined;
 export declare function isWindowsDriveRelativePath(requestedPath: string): boolean;

package/dist/lib/paths.js

@@ -1,6 +1,7 @@
 import * as fs from 'node:fs/promises';
 import * as os from 'node:os';
 import * as path from 'node:path';
+import { AsyncLocalStorage } from 'node:async_hooks';
 import { platform } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { SENSITIVE_FILE_ALLOWLIST, SENSITIVE_FILE_DENYLIST, } from './constants.js';
@@ -15,12 +16,17 @@ export function toPosixPath(value) {
 }
 const IS_WINDOWS = platform() === 'win32';
 const WINDOWS_ABSOLUTE_RE = /^[a-z]:\//iu;
+const HOME_PREFIX_LENGTH = 2;
+const CHAR_CODE_SPACE = 32;
+const CHAR_CODE_DOT = 46;
 function normalizePathForMatch(input) {
     return toPosixPath(path.normalize(input));
 }
 function normalizeForMatch(input) {
     const normalized = normalizePathForMatch(input);
-    return IS_WINDOWS ? normalized.toLowerCase() : normalized;
+    // Always lowercase for case-insensitive denylist matching on all platforms.
+    // Prevents bypassing `.env` block with `.ENV` on case-sensitive filesystems.
+    return normalized.toLowerCase();
 }
 function compilePatternGlobs(normalizedPattern) {
     const globs = new Set([normalizedPattern]);
@@ -137,16 +143,27 @@ const RESERVED_DEVICE_NAMES = new Set([
     'LPT8',
     'LPT9',
 ]);
+const allowedDirectoriesContext = new AsyncLocalStorage({
+    name: 'filesystem-mcp:allowed-directories',
+});
 function dedupePreserveOrder(items) {
     return [...new Set(items)];
 }
+function cloneAllowedDirectoriesState(state) {
+    return {
+        primary: [...state.primary],
+        expanded: [...state.expanded],
+    };
+}
 function expandHome(filepath) {
     if (filepath === '~')
         return HOMEDIR;
     // Accept both "~/" and "~\\" for cross-platform UX.
     if (filepath.startsWith('~/') || filepath.startsWith('~\\')) {
         // Avoid `path.join(HOMEDIR, "/foo")` resetting to the filesystem root.
-        const rest = filepath.slice(2).replace(LEADING_SEPARATORS_RE, '');
+        const rest = filepath
+            .slice(HOME_PREFIX_LENGTH)
+            .replace(LEADING_SEPARATORS_RE, '');
         return rest.length === 0 ? HOMEDIR : path.join(HOMEDIR, rest);
     }
     return filepath;
@@ -164,9 +181,12 @@ export function normalizePath(p) {
     }
     return resolved;
 }
-function normalizeForComparison(value) {
+function normalizeCaseForComparison(value) {
     return IS_WINDOWS ? value.toLowerCase() : value;
 }
+function normalizeForComparison(value) {
+    return normalizeCaseForComparison(value);
+}
 function rethrowIfAborted(error) {
     if (isAbortError(error))
         throw error;
@@ -174,11 +194,9 @@ function rethrowIfAborted(error) {
 function isSamePath(left, right) {
     if (left === right)
         return true;
-    const leftResolved = path.resolve(left);
-    const rightResolved = path.resolve(right);
-    return IS_WINDOWS
-        ? leftResolved.toLowerCase() === rightResolved.toLowerCase()
-        : leftResolved === rightResolved;
+    const leftResolved = normalizeCaseForComparison(path.resolve(left));
+    const rightResolved = normalizeCaseForComparison(path.resolve(right));
+    return leftResolved === rightResolved;
 }
 function stripTrailingSeparator(normalized) {
     return normalized.length > 1 && normalized.endsWith(PATH_SEPARATOR)
@@ -218,26 +236,41 @@ function normalizeAllowedDirectories(dirs) {
 // single MCP session per process, so this is safe. In HTTP mode all HTTP
 // sessions within the same process share one policy — multi-tenant isolation
 // (different roots per session) requires separate server processes.
-let allowedDirectoriesExpanded = [];
-let allowedDirectoriesPrimary = [];
+let defaultAllowedDirectoriesState = {
+    primary: [],
+    expanded: [],
+};
 function setAllowedDirectoriesState(primary, expanded) {
-    allowedDirectoriesPrimary = dedupePreserveOrder(primary);
-    allowedDirectoriesExpanded = dedupePreserveOrder(expanded);
+    defaultAllowedDirectoriesState = {
+        primary: dedupePreserveOrder(primary),
+        expanded: dedupePreserveOrder(expanded),
+    };
+}
+function getActiveAllowedDirectoriesState() {
+    return allowedDirectoriesContext.getStore() ?? defaultAllowedDirectoriesState;
+}
+export function withAllowedDirectoriesState(state, run) {
+    return allowedDirectoriesContext.run(cloneAllowedDirectoriesState(state), run);
+}
+export function getAllowedDirectoriesState() {
+    return cloneAllowedDirectoriesState(getActiveAllowedDirectoriesState());
+}
+export function setAllowedDirectoriesStateResolved(state) {
+    setAllowedDirectoriesState(state.primary, state.expanded);
 }
 export function getAllowedDirectories() {
-    return [...allowedDirectoriesExpanded];
+    return [...getActiveAllowedDirectoriesState().expanded];
 }
 export function isAllowedDirectoryRoot(normalizedPath) {
-    for (const dir of allowedDirectoriesExpanded) {
+    for (const dir of getActiveAllowedDirectoriesState().expanded) {
         if (isSamePath(normalizedPath, dir))
             return true;
     }
     return false;
 }
 function getAllowedDirectoriesForRelativeResolution() {
-    return allowedDirectoriesPrimary.length > 0
-        ? allowedDirectoriesPrimary
-        : allowedDirectoriesExpanded;
+    const state = getActiveAllowedDirectoriesState();
+    return state.primary.length > 0 ? state.primary : state.expanded;
 }
 function isPathInsideDirectory(normalizedDirectory, normalizedCandidate) {
     const root = normalizeForComparison(normalizedDirectory);
@@ -286,10 +319,14 @@ async function expandAllowedDirectories(primaryDirs, signal) {
     }
     return dedupePreserveOrder(expanded);
 }
-export async function setAllowedDirectoriesResolved(dirs, signal) {
+export async function resolveAllowedDirectoriesState(dirs, signal) {
     const primary = normalizeAllowedDirectories(dirs);
     const expanded = await expandAllowedDirectories(primary, signal);
-    setAllowedDirectoriesState(primary, expanded);
+    return { primary, expanded };
+}
+export async function setAllowedDirectoriesResolved(dirs, signal) {
+    const state = await resolveAllowedDirectoriesState(dirs, signal);
+    setAllowedDirectoriesStateResolved(state);
 }
 function ensureNonEmptyPath(requestedPath) {
     if (!requestedPath || requestedPath.trim().length === 0) {
@@ -306,7 +343,7 @@ function getReservedDeviceName(segment) {
     let end = segment.length;
     while (end > 0) {
         const c = segment.charCodeAt(end - 1);
-        if (c === 32 || c === 46)
+        if (c === CHAR_CODE_SPACE || c === CHAR_CODE_DOT)
             end--; // space or dot
         else
             break;
@@ -440,7 +477,7 @@ async function resolveRealPathOrThrow(options) {
         throw toMcpError(requestedPath, error);
     }
 }
-async function validateExistingPathDetailsInternal(requestedPath, signal) {
+function preparePathAccess(requestedPath) {
     const normalizedRequested = validateRequestedPath(requestedPath);
     const allowedDirs = getAllowedDirectories();
     ensureWithinAllowedDirectories({
@@ -449,15 +486,60 @@ async function validateExistingPathDetailsInternal(requestedPath, signal) {
         allowedDirs,
         details: { normalizedPath: normalizedRequested },
     });
+    return { allowedDirs, normalizedRequested };
+}
+function ensureResolvedPathAllowed(options) {
+    const { requestedPath, resolvedPath, normalizedResolved, allowedDirs } = options;
+    if (isPathWithinDirectories(normalizedResolved, allowedDirs))
+        return;
+    throw toAccessDeniedWithHint(requestedPath, resolvedPath, normalizedResolved);
+}
+async function statPathOrThrow(requestedPath, resolvedPath, signal) {
+    try {
+        assertNotAborted(signal);
+        return await withAbort(fs.stat(resolvedPath), signal);
+    }
+    catch (error) {
+        rethrowIfAborted(error);
+        throw toMcpError(requestedPath, error);
+    }
+}
+async function resolveNearestExistingRealPathOrThrow(options) {
+    const { requestedPath, startPath, signal } = options;
+    let current = startPath;
+    for (;;) {
+        try {
+            assertNotAborted(signal);
+            return await withAbort(fs.realpath(current), signal);
+        }
+        catch (error) {
+            rethrowIfAborted(error);
+            const code = isNodeError(error) ? error.code : undefined;
+            if (code !== 'ENOENT') {
+                throw toMcpError(requestedPath, error);
+            }
+            const parent = path.dirname(current);
+            if (parent === current) {
+                throw toMcpError(requestedPath, error);
+            }
+            current = parent;
+        }
+    }
+}
+async function validateExistingPathDetailsInternal(requestedPath, signal) {
+    const { allowedDirs, normalizedRequested } = preparePathAccess(requestedPath);
     const realPath = await resolveRealPathOrThrow({
         requestedPath,
         normalizedRequested,
         ...(signal ? { signal } : {}),
     });
     const normalizedReal = normalizePath(realPath);
-    if (!isPathWithinDirectories(normalizedReal, allowedDirs)) {
-        throw toAccessDeniedWithHint(requestedPath, realPath, normalizedReal);
-    }
+    ensureResolvedPathAllowed({
+        requestedPath,
+        resolvedPath: realPath,
+        normalizedResolved: normalizedReal,
+        allowedDirs,
+    });
     return {
         requestedPath: normalizedRequested,
         resolvedPath: normalizedReal,
@@ -473,55 +555,28 @@ export async function validateExistingPath(requestedPath, signal) {
 }
 export async function validateExistingDirectory(requestedPath, signal) {
     const details = await validateExistingPathDetailsInternal(requestedPath, signal);
-    let stats;
-    try {
-        assertNotAborted(signal);
-        stats = await withAbort(fs.stat(details.resolvedPath), signal);
-    }
-    catch (error) {
-        rethrowIfAborted(error);
-        throw toMcpError(requestedPath, error);
-    }
+    const stats = await statPathOrThrow(requestedPath, details.resolvedPath, signal);
     if (!stats.isDirectory()) {
         throw new McpError(ErrorCode.E_NOT_DIRECTORY, `Not a directory: ${requestedPath}`, requestedPath);
     }
     return details.resolvedPath;
 }
 export async function validatePathForWrite(requestedPath, signal) {
-    const normalizedRequested = validateRequestedPath(requestedPath);
-    const allowedDirs = getAllowedDirectories();
-    ensureWithinAllowedDirectories({
-        normalizedPath: normalizedRequested,
+    const { allowedDirs, normalizedRequested } = preparePathAccess(requestedPath);
+    assertAllowedFileAccess(requestedPath, normalizedRequested);
+    const realPath = await resolveNearestExistingRealPathOrThrow({
+        requestedPath,
+        startPath: normalizedRequested,
+        ...(signal ? { signal } : {}),
+    });
+    const normalizedReal = normalizePath(realPath);
+    ensureResolvedPathAllowed({
         requestedPath,
+        resolvedPath: realPath,
+        normalizedResolved: normalizedReal,
         allowedDirs,
-        details: { normalizedPath: normalizedRequested },
     });
-    assertAllowedFileAccess(requestedPath, normalizedRequested);
-    let current = normalizedRequested;
-    for (;;) {
-        try {
-            assertNotAborted(signal);
-            const realPath = await withAbort(fs.realpath(current), signal);
-            const normalizedReal = normalizePath(realPath);
-            if (!isPathWithinDirectories(normalizedReal, allowedDirs)) {
-                throw toAccessDeniedWithHint(requestedPath, realPath, normalizedReal);
-            }
-            return normalizedRequested;
-        }
-        catch (error) {
-            rethrowIfAborted(error);
-            const code = isNodeError(error) ? error.code : undefined;
-            if (code === 'ENOENT') {
-                const parent = path.dirname(current);
-                if (parent === current) {
-                    throw toMcpError(requestedPath, error);
-                }
-                current = parent;
-                continue;
-            }
-            throw toMcpError(requestedPath, error);
-        }
-    }
+    return normalizedRequested;
 }
 function isFileRoot(root) {
     return root.uri.startsWith('file://');