@j0hanz/filesystem-mcp 1.9.1 → 1.10.0

package/dist/schemas.js

@@ -39,6 +39,7 @@ const TreeEntrySchema = z.lazy(() => z.strictObject({
     name: z.string().describe('Name'),
     type: FileTypeSchema.describe('Type'),
     relativePath: z.string().describe('Relative path'),
+    size: z.number().optional().describe('File size bytes (when includeSizes)'),
     children: z.array(TreeEntrySchema).optional().describe('Children'),
 }));
 const ErrorSchema = z.strictObject({
@@ -57,6 +58,12 @@ const HeadLinesSchema = z
     .max(100000, 'Max: 100,000')
     .optional()
     .describe('Read first N lines');
+const TailLinesSchema = z
+    .int({ error: 'Must be integer' })
+    .min(1, 'Min: 1')
+    .max(100000, 'Max: 100,000')
+    .optional()
+    .describe('Read last N lines');
 const LineNumberSchema = z.int({ error: 'Must be integer' }).min(1, 'Min: 1');
 function addReadRangeIssue(ctx, path, message) {
     ctx.addIssue({
@@ -67,11 +74,15 @@ function addReadRangeIssue(ctx, path, message) {
 }
 const validateReadRange = (value, ctx) => {
     const hasHead = value.head !== undefined;
+    const hasTail = value.tail !== undefined;
     const hasStart = value.startLine !== undefined;
     const hasEnd = value.endLine !== undefined;
     if (hasHead && (hasStart || hasEnd)) {
         addReadRangeIssue(ctx, 'head', "Cannot use 'head' with 'startLine'/'endLine'");
     }
+    if (hasTail && (hasHead || hasStart || hasEnd)) {
+        addReadRangeIssue(ctx, 'tail', "Cannot use 'tail' with 'head'/'startLine'/'endLine'");
+    }
     if (hasEnd && !hasStart) {
         addReadRangeIssue(ctx, 'endLine', "'endLine' requires 'startLine'");
     }
@@ -84,6 +95,7 @@ const validateReadRange = (value, ctx) => {
 function createReadRangeInputFields(descriptions) {
     return {
         head: HeadLinesSchema.describe(descriptions.head),
+        tail: TailLinesSchema.describe(descriptions.tail),
         startLine: LineNumberSchema.optional().describe(descriptions.startLine),
         endLine: LineNumberSchema.optional().describe(descriptions.endLine),
     };
@@ -193,6 +205,7 @@ export const TreeInputSchema = z.strictObject({
         .describe(`Max entries. Default: ${DEFAULT_TREE_ENTRIES}`),
     includeHidden: defaultFalseBoolean('Include hidden items (starting with .)'),
     includeIgnored: defaultFalseBoolean('Include ignored items. Disables .gitignore.'),
+    includeSizes: defaultFalseBoolean('Include file sizes in tree entries'),
 });
 export const SearchContentInputSchema = z.strictObject({
     path: OptionalPathSchema.describe(DESC_PATH_ROOT),
@@ -227,15 +240,18 @@ export const SearchContentInputSchema = z.strictObject({
         .describe('Glob for candidate files (e.g. "**/*.ts")'),
     includeHidden: defaultFalseBoolean('Include hidden items (starting with .)'),
     includeIgnored: defaultFalseBoolean('Include ignored items (node_modules, etc).'),
+    multiline: defaultFalseBoolean('Multi-line mode. ^ and $ match line boundaries when isRegex=true.'),
 });
 export const ReadFileInputSchema = z
     .strictObject({
     path: RequiredPathSchema.describe(DESC_PATH_REQUIRED),
     ...createReadRangeInputFields({
         head: 'Read first N lines (preview)',
+        tail: 'Read last N lines',
         startLine: 'Start line (1-based, inclusive)',
         endLine: 'End line (1-based, inclusive). Requires startLine.',
     }),
+    includeHash: defaultFalseBoolean('Include SHA-256 hash of full file content'),
 })
     .superRefine(validateReadRange);
 export const ReadMultipleFilesInputSchema = z
@@ -247,6 +263,7 @@ export const ReadMultipleFilesInputSchema = z
         .describe('Files to read. e.g. ["src/index.ts"]'),
     ...createReadRangeInputFields({
         head: 'Read first N lines of each file',
+        tail: 'Read last N lines of each file',
         startLine: 'Start line (1-based, inclusive) per file',
         endLine: 'End line (1-based, inclusive) per file. Requires startLine.',
     }),
@@ -336,6 +353,10 @@ export const SearchContentOutputSchema = SearchSummarySchema.extend({
         .array(z.strictObject({
         file: z.string().describe('Relative path'),
         line: z.number(),
+        column: z
+            .number()
+            .optional()
+            .describe('Column of first match (0-based)'),
         content: z.string(),
         matchCount: z.number(),
         contextBefore: z.array(z.string()).optional(),
@@ -370,8 +391,12 @@ const ReadResultSchema = z.strictObject({
     truncated: z.boolean().optional().describe('Truncated?'),
     resourceUri: z.string().optional().describe('Full content URI'),
     totalLines: z.number().optional().describe('Total lines'),
-    readMode: z.enum(['full', 'head', 'range']).optional().describe('Mode'),
+    readMode: z
+        .enum(['full', 'head', 'tail', 'range'])
+        .optional()
+        .describe('Mode'),
     head: z.number().optional().describe('Head lines'),
+    tail: z.number().optional().describe('Tail lines'),
     startLine: z.number().optional().describe('Start line'),
     endLine: z.number().optional().describe('End line'),
     linesRead: z.number().optional().describe('Lines read'),
@@ -380,12 +405,13 @@ const ReadResultSchema = z.strictObject({
 export const ReadFileOutputSchema = ReadResultSchema.extend({
     ok: z.boolean(),
     path: z.string().optional(),
+    contentHash: z.string().optional().describe('SHA-256 of full file content'),
     error: ErrorSchema.optional(),
 });
 const ReadMultipleFileResultSchema = ReadResultSchema.extend({
     path: z.string().describe('File path'),
     truncationReason: z
-        .enum(['head', 'range', 'externalized'])
+        .enum(['head', 'tail', 'range', 'externalized'])
         .optional()
         .describe('Why content was truncated'),
     maxTotalSize: z.number().optional().describe('Max total size budget'),
@@ -470,6 +496,7 @@ export const EditFileOutputSchema = z.strictObject({
         .array(z.string())
         .optional()
         .describe('Edits that could not be applied'),
+    diff: z.string().optional().describe('Unified diff of changes (dryRun)'),
     error: ErrorSchema.optional(),
 });
 export const MoveFileInputSchema = z
@@ -544,6 +571,9 @@ export const DiffFilesOutputSchema = z.strictObject({
     ok: z.boolean(),
     diff: z.string().optional().describe('Unified diff content'),
     isIdentical: z.boolean().optional().describe('True if files are identical'),
+    linesAdded: z.number().optional().describe('Lines added'),
+    linesRemoved: z.number().optional().describe('Lines removed'),
+    hunksCount: z.number().optional().describe('Number of diff hunks'),
     truncated: z.boolean().optional().describe('Diff content truncated?'),
     resourceUri: z.string().optional().describe('Full diff content URI'),
     error: ErrorSchema.optional(),
@@ -552,6 +582,10 @@ export const ApplyPatchInputSchema = z.strictObject({
     path: RequiredPathSchema.describe('Path to file to patch'),
     patch: z
         .string()
+        .min(1, 'Patch content required')
+        .refine((val) => /@@ -\d+(?:,\d+)? \+\d+(?:,\d+)? @@/u.test(val), {
+        error: 'Patch must include hunk headers (e.g., @@ -1,2 +1,2 @@)',
+    })
         .describe('Unified diff with @@ hunk headers. Generate with `diff_files`.'),
     fuzzFactor: z
         .int({ error: 'Must be integer' })
@@ -574,6 +608,20 @@ export const ApplyPatchOutputSchema = z.strictObject({
     ok: z.boolean(),
     path: z.string().optional(),
     applied: z.boolean().optional(),
+    hunksApplied: z.number().optional().describe('Hunks applied'),
+    linesAdded: z.number().optional().describe('Lines added'),
+    linesRemoved: z.number().optional().describe('Lines removed'),
+    results: z
+        .array(z.strictObject({
+        path: z.string().describe('File path'),
+        applied: z.boolean().describe('Patch applied successfully'),
+        hunksApplied: z.number().optional().describe('Hunks applied'),
+        linesAdded: z.number().optional().describe('Lines added'),
+        linesRemoved: z.number().optional().describe('Lines removed'),
+        error: z.string().optional().describe('Error message'),
+    }))
+        .optional()
+        .describe('Per-file results for multi-file patches'),
     error: ErrorSchema.optional(),
 });
 export const SearchAndReplaceInputSchema = z.strictObject({
@@ -582,16 +630,24 @@ export const SearchAndReplaceInputSchema = z.strictObject({
         .string()
         .min(1, 'Pattern required')
         .max(1000, 'Max 1000 chars')
+        .optional()
+        .default('**/*')
         .refine((val) => isSafeGlobPattern(val), {
         error: 'Invalid glob or unsafe path (absolute/.. forbidden)',
     })
-        .describe('Glob pattern (e.g. "**/*.ts")'),
+        .describe('Glob to filter files. Default: **/*'),
     searchPattern: z
         .string()
         .min(1, 'Search pattern required')
+        .max(1000, 'Max 1000 chars')
         .describe('Text to search for. Literal by default; RE2 regex when `isRegex=true`.'),
     replacement: z.string().describe('Replacement text'),
     isRegex: defaultFalseBoolean('Treat searchPattern as RE2 regex. Supports capture groups ($1, $2) in replacement.'),
+    caseSensitive: z
+        .boolean()
+        .optional()
+        .default(true)
+        .describe('Case-sensitive matching. Default: true.'),
     dryRun: defaultFalseBoolean('Preview matches without writing. Check changedFiles and matches in the response before committing.'),
     includeHidden: z
         .boolean()
@@ -605,6 +661,12 @@ export const SearchAndReplaceInputSchema = z.strictObject({
         .boolean()
         .optional()
         .describe('Return unified diff of changes even if dryRun is false. Default: false.'),
+    maxFiles: z
+        .int({ error: 'Must be integer' })
+        .min(1, 'Min: 1')
+        .max(10000, 'Max: 10,000')
+        .optional()
+        .describe('Max files to process before stopping'),
 });
 export const SearchAndReplaceOutputSchema = z.strictObject({
     ok: z.boolean(),
@@ -631,6 +693,14 @@ export const SearchAndReplaceOutputSchema = z.strictObject({
         .optional()
         .describe('Changed file list truncated'),
     diff: z.string().optional().describe('Unified diff of changes (dryRun only)'),
+    diffTruncated: z
+        .boolean()
+        .optional()
+        .describe('Diff was truncated to fit size limit'),
+    stoppedReason: z
+        .enum(['maxFiles'])
+        .optional()
+        .describe('Why processing stopped early'),
     dryRun: z.boolean().optional(),
     error: ErrorSchema.optional(),
 });

package/dist/server/bootstrap.js

@@ -13,7 +13,7 @@ import { createInMemoryResourceStore } from '../lib/resource-store.js';
 import { isRecord } from '../lib/utils.js';
 import { registerCompletions } from '../completions.js';
 import { pkgInfo } from '../pkg-info.js';
-import { registerGetHelpPrompt } from '../prompts.js';
+import { registerAnalyzePathPrompt, registerCompareFilesPrompt, registerGetHelpPrompt, } from '../prompts.js';
 import { registerInstructionResource, registerMetricsResource, registerResultResources, registerToolCatalogResource, registerToolInfoResource, registerWorkflowGuideResource, } from '../resources.js';
 import { buildServerInstructions } from '../resources/generated-instructions.js';
 import { registerAllTools } from '../tools.js';
@@ -52,9 +52,7 @@ export function buildServerCapabilities(options = {}) {
     if (options.enableTaskToolRequests) {
         // NOTE: enabling task tool requests requires the caller to configure
         // an InMemoryTaskStore and InMemoryTaskMessageQueue on the McpServer.
-        // InMemoryTaskStore accumulates completed task records with no TTL eviction —
-        // suitable for short-lived stdio sessions. Long-running HTTP servers should
-        // replace it with a TTL-evicting store to avoid unbounded memory growth.
+        // InMemoryTaskStore auto-evicts tasks after TTL via setTimeout.
         capabilities.tasks = {
             list: {},
             cancel: {},
@@ -145,7 +143,7 @@ export async function createServer(options = {}) {
         }),
     };
     if (taskToolSupport) {
-        // Enabling task tool support requires configuring a task store and message queue on the server config. We use in-memory implementations which are suitable for short-lived stdio sessions. Long-running HTTP servers should replace these with TTL-evicting implementations to avoid unbounded memory growth.
+        // Enabling task tool support requires configuring a task store and message queue on the server config. We use in-memory implementations from the SDK which auto-evict tasks after their TTL expires (via setTimeout). Suitable for both stdio and HTTP sessions.
         serverConfig.taskStore = new InMemoryTaskStore();
         serverConfig.taskMessageQueue = new InMemoryTaskMessageQueue();
     }
@@ -174,6 +172,8 @@ export async function createServer(options = {}) {
     registerWorkflowGuideResource(server, localIcon);
     registerToolInfoResource(server, localIcon);
     registerGetHelpPrompt(server, serverInstructions, localIcon);
+    registerCompareFilesPrompt(server, localIcon);
+    registerAnalyzePathPrompt(server, localIcon);
     registerResultResources(server, resourceStore, localIcon);
     registerMetricsResource(server, localIcon);
     registerCompletions(server, serverInstructions);
@@ -250,7 +250,11 @@ async function createHttpSession(options, sessions) {
     const transport = new StreamableHTTPServerTransport({
         sessionIdGenerator: () => randomUUID(),
         onsessioninitialized: (sessionId) => {
-            sessions.set(sessionId, { server: mcpServer, rootsManager, transport });
+            sessions.set(sessionId, {
+                server: mcpServer,
+                rootsManager,
+                transport,
+            });
             rootsManager.logMissingDirectoriesIfNeeded(mcpServer);
         },
     });
@@ -276,11 +280,57 @@ function sendJsonRpcError(res, status, code, message) {
     }));
 }
 const LOCALHOST_ORIGIN_RE = /^https?:\/\/(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/u;
+const MAX_SESSION_ID_LENGTH = 256;
+const MAX_BEARER_TOKEN_LENGTH = 4096;
+const JSON_RPC_SERVER_ERROR = -32000;
+const JSON_RPC_INVALID_REQUEST = -32600;
+const JSON_RPC_PARSE_ERROR = -32700;
+const JSON_RPC_INTERNAL_ERROR = -32603;
 function isAllowedOrigin(origin) {
     if (origin === undefined)
         return true; // Non-browser clients omit Origin.
     return LOCALHOST_ORIGIN_RE.test(origin);
 }
+function getSessionId(req) {
+    const rawSessionId = req.headers['mcp-session-id'];
+    return typeof rawSessionId === 'string' &&
+        rawSessionId.length <= MAX_SESSION_ID_LENGTH
+        ? rawSessionId
+        : undefined;
+}
+function isAuthorizedBearer(apiKey, authHeader) {
+    const bearerPrefix = 'Bearer ';
+    if (typeof authHeader !== 'string' || !authHeader.startsWith(bearerPrefix)) {
+        return false;
+    }
+    const userKey = authHeader.slice(bearerPrefix.length);
+    if (userKey.length > MAX_BEARER_TOKEN_LENGTH) {
+        return false;
+    }
+    const expectedHash = createHash('sha256').update(apiKey).digest();
+    const actualHash = createHash('sha256').update(userKey).digest();
+    return timingSafeEqual(expectedHash, actualHash);
+}
+function writeUnauthorizedResponse(res) {
+    res.writeHead(401, {
+        'Content-Type': 'application/json',
+        'WWW-Authenticate': 'Bearer',
+    });
+    res.end(JSON.stringify({
+        jsonrpc: '2.0',
+        error: { code: JSON_RPC_SERVER_ERROR, message: 'Unauthorized' },
+        id: null,
+    }));
+}
+function ensureAuthorizedRequest(req, res) {
+    const apiKey = process.env['FILESYSTEM_MCP_API_KEY'];
+    if (!apiKey)
+        return true;
+    if (isAuthorizedBearer(apiKey, req.headers['authorization']))
+        return true;
+    writeUnauthorizedResponse(res);
+    return false;
+}
 function discardRequestBody(req) {
     req.on('error', () => {
         // Best effort drain to avoid corrupting keep-alive pipelines.
@@ -290,6 +340,14 @@ function discardRequestBody(req) {
 async function handleSessionTransportRequest(session, req, res, body) {
     await withAllowedDirectoriesState(session.rootsManager.getAllowedDirectoriesState(), () => session.transport.handleRequest(req, res, body));
 }
+function getSessionOrRespondNotFound(sessions, sessionId, res) {
+    const session = sessions.get(sessionId);
+    if (!session) {
+        sendJsonRpcError(res, 404, JSON_RPC_SERVER_ERROR, 'Session not found');
+        return undefined;
+    }
+    return session;
+}
 function isLoopbackHttpHost(host) {
     const normalized = host.trim().toLowerCase();
     return (normalized === '127.0.0.1' ||
@@ -310,92 +368,49 @@ export async function startHttpServer(port, options) {
     assertHttpBindingSecurity(httpHost);
     async function handleMcpRequest(req, res) {
         const { method } = req;
-        const MAX_SESSION_ID_LENGTH = 256;
-        const rawSessionId = req.headers['mcp-session-id'];
-        const sessionId = typeof rawSessionId === 'string' &&
-            rawSessionId.length <= MAX_SESSION_ID_LENGTH
-            ? rawSessionId
-            : undefined;
+        const sessionId = getSessionId(req);
         const { origin } = req.headers;
         if (!isAllowedOrigin(origin)) {
-            sendJsonRpcError(res, 403, -32000, 'Forbidden: disallowed origin');
+            sendJsonRpcError(res, 403, JSON_RPC_SERVER_ERROR, 'Forbidden: disallowed origin');
             return;
         }
-        const apiKey = process.env['FILESYSTEM_MCP_API_KEY'];
-        if (apiKey) {
-            const authHeader = req.headers['authorization'];
-            const bearerPrefix = 'Bearer ';
-            let authorized = false;
-            if (typeof authHeader === 'string' &&
-                authHeader.startsWith(bearerPrefix)) {
-                const userKey = authHeader.slice(bearerPrefix.length);
-                if (userKey.length <= 4096) {
-                    const expectedHash = createHash('sha256').update(apiKey).digest();
-                    const actualHash = createHash('sha256').update(userKey).digest();
-                    authorized = timingSafeEqual(expectedHash, actualHash);
-                }
-            }
-            if (!authorized) {
-                res.writeHead(401, {
-                    'Content-Type': 'application/json',
-                    'WWW-Authenticate': 'Bearer',
-                });
-                res.end(JSON.stringify({
-                    jsonrpc: '2.0',
-                    error: { code: -32000, message: 'Unauthorized' },
-                    id: null,
-                }));
-                return;
-            }
-        }
+        if (!ensureAuthorizedRequest(req, res))
+            return;
         try {
             if (method === 'POST') {
                 if (sessionId) {
-                    if (!sessions.has(sessionId)) {
-                        sendJsonRpcError(res, 404, -32000, 'Session not found');
+                    const session = getSessionOrRespondNotFound(sessions, sessionId, res);
+                    if (!session) {
                         discardRequestBody(req);
                         return;
                     }
                     const body = await readRequestBody(req);
-                    const session = sessions.get(sessionId);
-                    if (session) {
-                        await handleSessionTransportRequest(session, req, res, body);
-                    }
-                    else {
-                        sendJsonRpcError(res, 404, -32000, 'Session not found');
-                    }
+                    await handleSessionTransportRequest(session, req, res, body);
                     return;
                 }
                 const body = await readRequestBody(req);
                 if (isInitializeRequest(body)) {
                     const maxSessions = parseEnvInt('FILESYSTEM_MCP_MAX_HTTP_SESSIONS', 100, 1, 10_000);
                     if (sessions.size >= maxSessions) {
-                        sendJsonRpcError(res, 503, -32000, 'Too many sessions');
+                        sendJsonRpcError(res, 503, JSON_RPC_SERVER_ERROR, 'Too many sessions');
                         return;
                     }
                     const session = await createHttpSession(options, sessions);
                     await handleSessionTransportRequest(session, req, res, body);
                     return;
                 }
-                sendJsonRpcError(res, 400, -32000, 'Bad Request: No valid session ID provided');
+                sendJsonRpcError(res, 400, JSON_RPC_SERVER_ERROR, 'Bad Request: No valid session ID provided');
                 discardRequestBody(req);
             }
             else if (method === 'GET' || method === 'DELETE') {
                 if (!sessionId) {
-                    sendJsonRpcError(res, 400, -32000, 'Bad Request: Missing session ID');
+                    sendJsonRpcError(res, 400, JSON_RPC_SERVER_ERROR, 'Bad Request: Missing session ID');
                     return;
                 }
-                if (!sessions.has(sessionId)) {
-                    sendJsonRpcError(res, 404, -32000, 'Session not found');
+                const session = getSessionOrRespondNotFound(sessions, sessionId, res);
+                if (!session)
                     return;
-                }
-                const session = sessions.get(sessionId);
-                if (session) {
-                    await handleSessionTransportRequest(session, req, res);
-                }
-                else {
-                    sendJsonRpcError(res, 404, -32000, 'Session not found');
-                }
+                await handleSessionTransportRequest(session, req, res);
             }
             else {
                 res.writeHead(405, {
@@ -404,21 +419,26 @@ export async function startHttpServer(port, options) {
                 });
                 res.end(JSON.stringify({
                     jsonrpc: '2.0',
-                    error: { code: -32000, message: 'Method Not Allowed' },
+                    error: {
+                        code: JSON_RPC_SERVER_ERROR,
+                        message: 'Method Not Allowed',
+                    },
                     id: null,
                 }));
             }
         }
         catch (error) {
             if (error instanceof RequestBodyError && !res.headersSent) {
-                const rpcCode = error.statusCode === 413 ? -32600 : -32700;
+                const rpcCode = error.statusCode === 413
+                    ? JSON_RPC_INVALID_REQUEST
+                    : JSON_RPC_PARSE_ERROR;
                 res.setHeader('Connection', 'close');
                 sendJsonRpcError(res, error.statusCode, rpcCode, error.message);
                 return;
             }
             console.error('[HTTP] Error handling request:', formatUnknownErrorMessage(error));
             if (!res.headersSent) {
-                sendJsonRpcError(res, 500, -32603, 'Internal Server Error');
+                sendJsonRpcError(res, 500, JSON_RPC_INTERNAL_ERROR, 'Internal Server Error');
             }
         }
     }