@mindstone/mcp-server-elevenlabs 0.3.0 → 0.4.0

package/dist/untrusted-content.js

@@ -0,0 +1,104 @@
+/**
+ * AGENTS.md security invariant #6 — content fetched from an external system
+ * MUST be wrapped in an `<untrusted-content source="…">…</untrusted-content>`
+ * envelope (with close-tag breakout escaping) before it is returned to the
+ * LLM, so the model treats third-party / attacker-controllable text as DATA,
+ * not as instructions.
+ *
+ * This is the canonical implementation a new connector ships with. It is a
+ * VENDORED copy of the shared reference in `test-harness/src/untrusted-content.ts`
+ * — connectors cannot `import` the test-harness at runtime (it is a
+ * test/dev-only `file:` dependency that is never published into a connector's
+ * `dist/`), so the helper lives in the connector's own runtime source. Keep
+ * this byte-for-byte in sync with the shared reference; do NOT weaken the
+ * escaping back to a simple `replaceAll` (that family misses whitespace / case
+ * close-tag variants like `</untrusted-content >` / `</UNTRUSTED-CONTENT>`).
+ *
+ * `scripts/check-untrusted-coverage.mjs` greps for a reference to
+ * `untrusted-content` in any connector that talks to an external system; this
+ * file (and the call sites that import from it) is what satisfies that gate.
+ */
+const UNTRUSTED_CLOSE_TAG_VARIANT = /<\/untrusted-content\s*>/gi;
+const ESCAPED_UNTRUSTED_CLOSE_TAG = '<\\/untrusted-content>';
+const UNTRUSTED_ENVELOPE = /^<untrusted-content source="[^"]*">([\s\S]*)<\/untrusted-content>$/;
+function escapeAttr(s) {
+    return s.replaceAll('&', '&amp;').replaceAll('"', '&quot;').replaceAll('<', '&lt;').replaceAll('>', '&gt;');
+}
+function escapeCloseTagSentinels(s) {
+    return s.replace(UNTRUSTED_CLOSE_TAG_VARIANT, ESCAPED_UNTRUSTED_CLOSE_TAG);
+}
+function unescapeCloseTagSentinels(s) {
+    return s.replaceAll(ESCAPED_UNTRUSTED_CLOSE_TAG, '</untrusted-content>');
+}
+/**
+ * Wrap a single untrusted string in an `<untrusted-content source="…">`
+ * envelope, escaping any embedded close-tag variant so the envelope cannot be
+ * broken out of. `undefined` passes through untouched. Idempotent for the same
+ * `source`.
+ */
+export function wrapUntrusted(text, source) {
+    if (text === undefined)
+        return undefined;
+    const open = `<untrusted-content source="${escapeAttr(source)}">`;
+    const close = '</untrusted-content>';
+    if (text.startsWith(open) && text.endsWith(close) && text.length >= open.length + close.length) {
+        const inner = text.slice(open.length, text.length - close.length);
+        if (!UNTRUSTED_CLOSE_TAG_VARIANT.test(inner)) {
+            UNTRUSTED_CLOSE_TAG_VARIANT.lastIndex = 0;
+            return text;
+        }
+        UNTRUSTED_CLOSE_TAG_VARIANT.lastIndex = 0;
+    }
+    return `${open}${escapeCloseTagSentinels(text)}${close}`;
+}
+/**
+ * Strip one `<untrusted-content>` envelope from `text` if present, returning raw
+ * strings unchanged. This is intentionally one-layer and idempotent for already
+ * raw input so callers can accept either displayed wrapped content or manually
+ * authored content.
+ */
+export function unwrapUntrusted(text) {
+    const match = UNTRUSTED_ENVELOPE.exec(text);
+    if (!match)
+        return text;
+    return unescapeCloseTagSentinels(match[1]);
+}
+/**
+ * Recursively wrap every string key and value reachable inside `value`.
+ * Non-string leaves pass through unchanged.
+ */
+export function wrapUntrustedJsonStrings(value, source) {
+    if (typeof value === 'string') {
+        return wrapUntrusted(value, source);
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => wrapUntrustedJsonStrings(item, source));
+    }
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+            wrapUntrusted(key, source) ?? key,
+            wrapUntrustedJsonStrings(item, source),
+        ]));
+    }
+    return value;
+}
+/**
+ * Recursively unwrap every string key and value reachable inside `value`.
+ * Non-string leaves pass through unchanged.
+ */
+export function unwrapUntrustedJsonStrings(value) {
+    if (typeof value === 'string') {
+        return unwrapUntrusted(value);
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => unwrapUntrustedJsonStrings(item));
+    }
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+            unwrapUntrusted(key),
+            unwrapUntrustedJsonStrings(item),
+        ]));
+    }
+    return value;
+}
+//# sourceMappingURL=untrusted-content.js.map

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@mindstone/mcp-server-elevenlabs",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "mcpName": "io.github.mindstone/mcp-server-elevenlabs",
-  "description": "ElevenLabs MCP server for Model Context Protocol hosts \u2014 music, TTS, sound effects, voices, transcription",
+  "description": "ElevenLabs MCP server for Model Context Protocol hosts — music, TTS, sound effects, voices, transcription",
   "license": "FSL-1.1-MIT",
   "type": "module",
   "bin": {