@mandujs/mcp 0.38.7 → 0.38.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mandujs/mcp",
-  "version": "0.38.7",
+  "version": "0.38.8",
   "description": "Mandu MCP Server - Agent-native interface for Mandu framework operations",
   "type": "module",
   "main": "./src/index.ts",
@@ -34,7 +34,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@mandujs/core": "^0.54.13",
+    "@mandujs/core": "^0.54.16",
     "@mandujs/ate": "^0.26.1",
     "@mandujs/skills": "^0.20.1",
     "@modelcontextprotocol/sdk": "^1.25.3"

package/src/tools/spec.ts

@@ -1,11 +1,11 @@
 import type { Tool } from "@modelcontextprotocol/sdk/types.js";
-import {
-  loadManifest,
-  generateManifest,
-} from "@mandujs/core";
-import { getProjectPaths } from "../utils/project.js";
-import path from "path";
-import fs from "fs/promises";
+import {
+  loadManifest,
+  generateManifest,
+} from "@mandujs/core";
+import { getProjectPaths, isInsideProject } from "../utils/project.js";
+import path from "path";
+import fs from "fs/promises";
 
 export const specToolDefinitions: Tool[] = [
   {
@@ -151,26 +151,42 @@ export function specTools(projectRoot: string) {
         kind: "api" | "page";
         withSlot?: boolean;
         withContract?: boolean;
-      };
-
-      const createdFiles: string[] = [];
-
-      // Scaffold app/ file
-      const fileName = kind === "api" ? "route.ts" : "page.tsx";
-      const appFilePath = path.join(paths.appDir, routePath, fileName);
-      const appFileDir = path.dirname(appFilePath);
-
-      await fs.mkdir(appFileDir, { recursive: true });
+      };
+
+      const createdFiles: string[] = [];
+      const normalizedRoutePath = normalizeRoutePath(routePath);
+      if (!normalizedRoutePath) {
+        return {
+          error: "Route path must be a non-empty relative path inside app/",
+        };
+      }
+
+      // Scaffold app/ file
+      const fileName = kind === "api" ? "route.ts" : "page.tsx";
+      const appFilePath = path.resolve(paths.appDir, normalizedRoutePath, fileName);
+      if (!isInsideProject(appFilePath, paths.appDir)) {
+        return {
+          error: "Route path resolves outside app/",
+        };
+      }
+      if (await Bun.file(appFilePath).exists()) {
+        return {
+          error: `Route source already exists: app/${normalizedRoutePath}/${fileName}`,
+        };
+      }
+      const appFileDir = path.dirname(appFilePath);
+
+      await fs.mkdir(appFileDir, { recursive: true });
 
       if (kind === "api") {
         await Bun.write(appFilePath, `export function GET(req: Request) {\n  return Response.json({ message: "Hello" });\n}\n`);
-      } else {
-        await Bun.write(appFilePath, `export default function Page() {\n  return <div>Page</div>;\n}\n`);
-      }
-      createdFiles.push(`app/${routePath}/${fileName}`);
-
-      // Derive route ID from path
-      const routeId = routePath.replace(/\//g, "-").replace(/[\[\]\.]/g, "");
+      } else {
+        await Bun.write(appFilePath, `export default function Page() {\n  return <div>Page</div>;\n}\n`);
+      }
+      createdFiles.push(`app/${normalizedRoutePath}/${fileName}`);
+
+      // Derive route ID from path
+      const routeId = normalizedRoutePath.replace(/\//g, "-").replace(/[\[\]\.]/g, "");
 
       // Scaffold slot if requested
       if (withSlot) {
@@ -265,6 +281,22 @@ export function specTools(projectRoot: string) {
   handlers["mandu_add_route"] = handlers["mandu.route.add"];
   handlers["mandu_delete_route"] = handlers["mandu.route.delete"];
   handlers["mandu_validate_manifest"] = handlers["mandu.manifest.validate"];
-
-  return handlers;
-}
+
+  return handlers;
+}
+
+function normalizeRoutePath(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim().replace(/\\/g, "/");
+  const withoutAppPrefix = trimmed.replace(/^app\//, "");
+  const normalized = withoutAppPrefix.replace(/^\/+|\/+$/g, "");
+  if (!normalized) return null;
+
+  const segments = normalized.split("/").filter(Boolean);
+  if (segments.length === 0) return null;
+  if (segments.some((segment) => segment === "." || segment === ".." || segment.includes(":") || segment.includes("\0"))) {
+    return null;
+  }
+
+  return segments.join("/");
+}